# changelog

author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2047.508.1.el7uek]
changelog:
  - RDMA/cma: Revert INIT-INIT patch (Mike Marciniszyn)  [Orabug: 33324346]  
  - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb (Phillip Potter)  [Orabug: 33329032]  
  - ip: Manual backport of pskb_inet_may_pull() (Håkon Bugge)  [Orabug: 33329032]  
  - Revert "Revert "net: geneve: check skb is large enough for IPv4/IPv6 header"" (Håkon Bugge)  [Orabug: 33329032]  
  - ext4: fix race writing to an inline_data file while its xattrs are changing (Theodore Ts'o)  [Orabug: 33327179]  {CVE-2021-40490} 
  - uek-rpm: add CONFIG_PVPANIC_PCI to aarch64 (Mihai Carabas)  [Orabug: 33155642]  
  - misc/pvpanic: fix set driver data (Mihai Carabas)  [Orabug: 33155642]  
  - misc/pvpanic-pci: Allow automatic loading (Eric Auger)  [Orabug: 33155642]  
  - misc/pvpanic: Remove some dead-code (Christophe JAILLET)  [Orabug: 33155642]  
  - misc/pvpanic: Make 'pvpanic_probe()' resource managed (Christophe JAILLET)  [Orabug: 33155642]  
  - misc/pvpanic-mmio: Use GFP_KERNEL instead of GFP_ATOMIC (Christophe JAILLET)  [Orabug: 33155642]  
  - misc/pvpanic-mmio: Fix error handling in 'pvpanic_mmio_probe()' (Christophe JAILLET)  [Orabug: 33155642]  
  - misc/pvpanic-pci: Use GFP_KERNEL instead of GFP_ATOMIC (Christophe JAILLET)  [Orabug: 33155642]  
  - misc/pvpanic-pci: Fix error handling in 'pvpanic_pci_probe()' (Christophe JAILLET)  [Orabug: 33155642]  
  - misc/pvpanic: Make some symbols static (YueHaibing)  [Orabug: 33155642]  
  - misc/pvpanic: fix return value check in pvpanic_pci_probe() (Qiheng Lin)  [Orabug: 33155642]  
  - misc/pvpanic: add PCI driver (Mihai Carabas)  [Orabug: 33155642]  
  - misc/pvpanic: probe multiple instances (Mihai Carabas)  [Orabug: 33155642]  
  - misc/pvpanic: split-up generic and platform dependent code (Mihai Carabas)  [Orabug: 33155642]  
  - misc/pvpanic: Export module FDT device table (Shile Zhang)  [Orabug: 33155642]  
  - misc: pvpanic: sysfs_emit uses should have a newline (Joe Perches)  [Orabug: 33155642]  
  - misc: pvpanic: introduce events device attribue (zhenwei pi)  [Orabug: 33155642]  
  - misc: pvpanic: introduce device capability (zhenwei pi)  [Orabug: 33155642]  
  - misc: pvpanic: Check devm_ioport_map() for NULL (Andy Shevchenko)  [Orabug: 33155642]  
  - misc: pvpanic: Replace OF headers by mod_devicetable.h (Andy Shevchenko)  [Orabug: 33155642]  
  - misc: pvpanic: Combine ACPI and platform drivers (Andy Shevchenko)  [Orabug: 33155642]  
  - misc: pvpanic: Use devm_platform_ioremap_resource() (Wang ShaoBo)  [Orabug: 33155642]  
  - driver core: platform: Introduce platform_get_mem_or_io() (Andy Shevchenko)  [Orabug: 33155642]  
  - misc: pvpanic: move bit definition to uapi header file (zhenwei pi)  [Orabug: 33155642]  
  - misc: pvpanic: fix warning implicit declaration (Anders Roxell)  [Orabug: 33155642]  
  - misc/pvpanic: resolve compile errors for arch=um (Peng Hao)  [Orabug: 33155642]  
  - misc/pvpanic: fix a NULL vs IS_ERR() check (Dan Carpenter)  [Orabug: 33155642]  
  - misc/pvpanic: remove a redundant comma (Peng Hao)  [Orabug: 33155642]  
  - misc/pvpanic: convert to SPDX license tags (Peng Hao)  [Orabug: 33155642]  
  - misc/pvpanic: change header file sort style (Peng Hao)  [Orabug: 33155642]  
  - misc/pvpanic: remove unnecessary header file (Peng Hao)  [Orabug: 33155642]  
  - misc/pvpanic : break dependency on ACPI (Peng Hao)  [Orabug: 33155642]  
  - misc/pvpanic : grouping ACPI related stuff (Peng Hao)  [Orabug: 33155642]  
  - misc/pvpanic: add support to get pvpanic device info FDT (Peng Hao)  [Orabug: 33155642]  
  - dt-bindings: misc/pvpanic: add document for pvpanic-mmio (Peng Hao)  [Orabug: 33155642]  
  - misc/pvpanic: add MMIO support (Peng Hao)  [Orabug: 33155642]  
  - misc/pvpanic: simplify the code using acpi_dev_resource_io (Peng Hao)  [Orabug: 33155642]  
  - pvpanic: move pvpanic to misc as common driver (Peng Hao)  [Orabug: 33155642]  
  - fuse: fix bad inode (Miklos Szeredi)  [Orabug: 32769032]  {CVE-2020-36322} 
  - Linux 4.14.243 (Greg Kroah-Hartman)   
  - spi: mediatek: Fix fifo transfer (Guenter Roeck)   
  - Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout" (Greg Kroah-Hartman)   
  - KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped() (Sean Christopherson)   
  - KVM: do not assume PTE is writable after follow_pfn (Paolo Bonzini)   
  - Revert "Bluetooth: Shutdown controller after workqueues are flushed or cancelled" (Greg Kroah-Hartman)   
  - net: Fix zero-copy head len calculation. (Pravin B Shelar)   
  - qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union() (Jia He)   
  - r8152: Fix potential PM refcount imbalance (Takashi Iwai)   
  - regulator: rt5033: Fix n_voltages settings for BUCK and LDO (Axel Lin)   
  - btrfs: mark compressed range uptodate only if all bio succeed (Goldwyn Rodrigues)   
  - Linux 4.14.242 (Greg Kroah-Hartman)   
  - Revert "perf map: Fix dso->nsinfo refcounting" (Arnaldo Carvalho de Melo)   
  - can: hi311x: fix a signedness bug in hi3110_cmd() (Dan Carpenter)   
  - sis900: Fix missing pci_disable_device() in probe and remove (Wang Hai)   
  - tulip: windbond-840: Fix missing pci_disable_device() in probe and remove (Wang Hai)   
  - sctp: fix return value check in __sctp_rcv_asconf_lookup (Marcelo Ricardo Leitner)   
  - net/mlx5: Fix flow table chaining (Maor Gottlieb)   
  - net: llc: fix skb_over_panic (Pavel Skripkin)   
  - mlx4: Fix missing error code in mlx4_load_one() (Jiapeng Chong)   
  - tipc: fix sleeping in tipc accept routine (Hoang Le)   
  - netfilter: nft_nat: allow to specify layer 4 protocol NAT only (Pablo Neira Ayuso)   
  - netfilter: conntrack: adjust stop timestamp to real expiry value (Florian Westphal)   
  - cfg80211: Fix possible memory leak in function cfg80211_bss_update (Nguyen Dinh Phi)   
  - x86/asm: Ensure asm/proto.h can be included stand-alone (Jan Kiszka)   
  - nfc: nfcsim: fix use after free during module unload (Krzysztof Kozlowski)   
  - NIU: fix incorrect error return, missed in previous revert (Paul Jakma)   
  - can: esd_usb2: fix memory leak (Pavel Skripkin)   
  - can: ems_usb: fix memory leak (Pavel Skripkin)   
  - can: usb_8dev: fix memory leak (Pavel Skripkin)   
  - can: mcba_usb_start(): add missing urb->transfer_dma initialization (Pavel Skripkin)   
  - can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF (Ziyang Xuan)   
  - x86/kvm: fix vcpu-id indexed array sizes (Juergen Gross)   
  - gro: ensure frag0 meets IP header alignment (Eric Dumazet)   
  - virtio_net: Do not pull payload in skb->head (Eric Dumazet)   
  - ARM: dts: versatile: Fix up interrupt controller node names (Sudeep Holla)   
  - hfs: add lock nesting notation to hfs_find_init (Desmond Cheong Zhi Xi)   
  - hfs: fix high memory mapping in hfs_bnode_read (Desmond Cheong Zhi Xi)   
  - hfs: add missing clean-up in hfs_fill_super (Desmond Cheong Zhi Xi)   
  - sctp: move 198 addresses from unusable to private scope (Xin Long)   
  - net: annotate data race around sk_ll_usec (Eric Dumazet)   
  - net/802/garp: fix memleak in garp_request_join() (Yang Yingliang)   
  - net/802/mrp: fix memleak in mrp_request_join() (Yang Yingliang)   
  - workqueue: fix UAF in pwq_unbound_release_workfn() (Yang Yingliang)   
  - af_unix: fix garbage collect vs MSG_PEEK (Miklos Szeredi)   
  - net: split out functions related to registering inflight socket files (Jens Axboe)   
  - KVM: x86: determine if an exception has an error code only when injecting it. (Maxim Levitsky)   
  - selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c (Greg Kroah-Hartman)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2047.508.2.el7uek]
changelog:
  - KVM: x86: Check kvm_rebooting in kvm_spurious_fault() (Sean Christopherson)  [Orabug: 33360245]  
  - Revert "uek-rpm: mark /etc/ld.so.conf.d/ files as %config" (aloktiw)  [Orabug: 33359680]  
  - net/mlx5: Rate limit errors in command interface (Leon Romanovsky)  [Orabug: 33305503]  
  - Bluetooth: defer cleanup of resources in hci_unregister_dev() (Tetsuo Handa)  [Orabug: 33292634]  {CVE-2021-3573} 
  - Bluetooth: use correct lock to prevent UAF of hdev object (Lin Ma)  [Orabug: 33292634]  
  - Bluetooth: fix the erroneous flush_work() order (Lin Ma)  [Orabug: 33292634]  {CVE-2021-3564} 
  - IB/core: Read subnet_prefix in ib_query_port via cache. (Anand Khoje)  [Orabug: 33134287]  
  - IB/core: Removed port validity check from ib_get_cached_subnet_prefix (Anand Khoje)  [Orabug: 33134287]  
  - uek-rpm: Add dm-cache-smq.ko module (John Donnelly)  [Orabug: 29198153]


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2047.508.3.el7uek]
changelog:
  - fuse: fix live lock in fuse_iget() (Amir Goldstein)  [Orabug: 33396682]  {CVE-2021-28950} 
  - block: workaround to avoid self-deadlock in del_gendisk (Junxiao Bi)  [Orabug: 33392821]  
  - net: bonding: add new option arp_allslaves for arp_ip_target (Venkat Venkatsubra)  [Orabug: 33352735]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.508.3.1.el7uek]
changelog:
  - block: Fix bio_integrity_payload handling for cloned bios (Martin K. Petersen)  [Orabug: 33335729]


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.508.3.3.el7uek]
changelog:
  - xfs: punch out data fork delalloc blocks on COW writeback failure (Brian Foster)  [Orabug: 33557611]  
  - xfs: fix reflink source file racing with directio writes (Darrick J. Wong)  [Orabug: 33557611]  
  - xfs: split up the xfs_reflink_end_cow work into smaller transactions (Darrick J. Wong)  [Orabug: 33557611]  
  - xfs: flush removing page cache in xfs_reflink_remap_prep (Dave Chinner)  [Orabug: 33557611]  
  - xfs: fix shared extent data corruption due to missing cow reservation (Brian Foster)  [Orabug: 33557611]  
  - xfs: fix pagecache truncation prior to reflink (Darrick J. Wong)  [Orabug: 33557611]  
  - xfs: fix fork selection in xfs_find_trim_cow_extent (Christoph Hellwig)  [Orabug: 33557611]  
  - xfs: remove the unused trimmed argument from xfs_reflink_trim_around_shared (Christoph Hellwig)  [Orabug: 33557611]  
  - xfs: skip delalloc COW blocks in xfs_reflink_end_cow (Christoph Hellwig)  [Orabug: 33557611]  
  - xfs: fix transaction leak in xfs_reflink_allocate_cow() (Dave Chinner)  [Orabug: 33557611]  
  - xfs: cow unwritten conversion uses uninitialized dfops (Brian Foster)  [Orabug: 33557611]  
  - xfs: fix double ijoin in xfs_reflink_clear_inode_flag() (Dave Chinner)  [Orabug: 33557611]  
  - xfs: fix double ijoin in xfs_reflink_cancel_cow_range (Dave Chinner)  [Orabug: 33557611]  
  - xfs: minor cleanup for xfs_reflink_end_cow (Christoph Hellwig)  [Orabug: 33557611]  
  - xfs: fix transaction allocation deadlock in IO path (Dave Chinner)  [Orabug: 33557611]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.509.0.el7uek]
changelog:
  - uek-rpm: Pensando: disable CONFIG_PENSANDO_SOC_BSM_ENABLE (Dave Kleikamp)  [Orabug: 33428270]  
  - KVM: SVM: Drop __sme_page_pa for vmsave/vmload (Alejandro Jimenez)  [Orabug: 33413954]  
  - video: fbdev: cirrusfb: check pixclock to avoid divide by zero (George Kennedy)  [Orabug: 33406904]  
  - kvm: export per-vcpu exits to userspace (Dongli Zhang)  [Orabug: 33403457]  
  - tools/power/turbostat: Fallback to an MSR read for EPB (Borislav Petkov)  [Orabug: 33387024]  
  - RDMA/core: Save kernel caller name when creating CQ using ib_create_cq() (Bharat Potnuri)  [Orabug: 33353576]  
  - locking/csd_lock: Make csdlock_debug=1 default (Stephen Brennan)  [Orabug: 33245814]  
  - uek-rpm: config: Enable CONFIG_CSD_LOCK_WAIT_DEBUG (Stephen Brennan)  [Orabug: 33245814]  
  - locking/csd_lock: Remove unused "idle" event (Stephen Brennan)  [Orabug: 33245814]  
  - locking/csd_lock: Add more data to CSD lock debugging (Juergen Gross)  [Orabug: 33245814]  
  - smp: refactor queueing of single smp call (Stephen Brennan)  [Orabug: 33245814]  
  - locking/csd_lock: Prepare more CSD lock debugging (Juergen Gross)  [Orabug: 33245814]  
  - locking/csd_lock: Add boot parameter for controlling CSD lock debugging (Juergen Gross)  [Orabug: 33245814]  
  - kernel/smp: Provide CSD lock timeout diagnostics (Paul E. McKenney)  [Orabug: 33245814]  
  - smp: Fix kABI breakage in __call_single_data (Stephen Brennan)  [Orabug: 33245814]  
  - smp: Add source and destination CPUs to __call_single_data (Paul E. McKenney)  [Orabug: 33245814]  
  - x86/jump_label: Initialize static branching early (Pavel Tatashin)  [Orabug: 33245814]  
  - x86/alternatives, jumplabel: Use text_poke_early() before mm_init() (Pavel Tatashin)  [Orabug: 33245814]  
  - NFSv4.1 make cachethis=no for writes (Olga Kornievskaia)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS: Add missing encode / decode sequence_maxsz to v4.2 operations (Anna Schumaker)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFSv4: Initialise connection to the server in nfs4_alloc_client() (Trond Myklebust)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS add a simple sync nfs4_proc_commit after async COPY (Olga Kornievskaia)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS handle COPY ERR_OFFLOAD_NO_REQS (Olga Kornievskaia)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS send OFFLOAD_CANCEL when COPY killed (Olga Kornievskaia)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS export nfs4_async_handle_error (Olga Kornievskaia)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS handle COPY reply CB_OFFLOAD call race (Olga Kornievskaia)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS add support for asynchronous COPY (Olga Kornievskaia)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS COPY xdr handle async reply (Olga Kornievskaia)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS OFFLOAD_CANCEL xdr (Olga Kornievskaia)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS CB_OFFLOAD xdr (Olga Kornievskaia)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS: Merge nfs41_free_stateid() with _nfs41_free_stateid() (Anna Schumaker)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS: Pass "privileged" value to nfs4_init_sequence() (Anna Schumaker)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS: Move call to nfs4_state_protect() to nfs4_commit_setup() (Anna Schumaker)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS: Move call to nfs4_state_protect_write() to nfs4_write_setup() (Anna Schumaker)  [Orabug: 33209530]  {CVE-2021-38199} 
  - NFS: Move delegation recall into the NFSv4 callback for rename_setup() (Trond Myklebust)  [Orabug: 33209530]  {CVE-2021-38199} 
  - uek-rpm: Remove unnecessary ld.so.conf.d file (Stephen Brennan)  [Orabug: 33186981]  
  - dccp: don't duplicate ccid when cloning dccp sock (Lin, Zhenpeng)  [Orabug: 32046139]  {CVE-2017-6074} {CVE-2020-16119} {CVE-2020-16119} 
  - ocfs2: drop acl cache for directories too (Wengang Wang)  [Orabug: 33253529]  
  - Linux 4.14.245 (Sasha Levin)   {CVE-2021-3656} 
  - netfilter: nft_exthdr: fix endianness of tcp option cast (Sergey Marinkevich)   
  - fs: warn about impending deprecation of mandatory locks (Jeff Layton)   
  - locks: print a warning when mount fails due to lack of "mand" support (Jeff Layton)   
  - ASoC: intel: atom: Fix breakage for PCM buffer address setup (Takashi Iwai)   
  - btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (NeilBrown)   
  - ipack: tpci200: fix many double free issues in tpci200_pci_probe (Dongliang Mu)   
  - ALSA: hda - fix the 'Capture Switch' value change notifications (Jaroslav Kysela)   
  - mmc: dw_mmc: Fix hang on data CRC error (Vincent Whitchurch)   
  - net: mdio-mux: Handle -EPROBE_DEFER correctly (Saravana Kannan)   
  - net: mdio-mux: Don't ignore memory allocation errors (Saravana Kannan)   
  - net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32 (Dinghao Liu)   
  - ptp_pch: Restore dependency on PCI (Andy Shevchenko)   
  - net: 6pack: fix slab-out-of-bounds in decode_data (Pavel Skripkin)   
  - bnxt: don't lock the tx queue from napi poll (Jakub Kicinski)   
  - vhost: Fix the calculation in vhost_overflow() (Xie Yongji)   
  - dccp: add do-while-0 stubs for dccp_pr_debug macros (Randy Dunlap)   
  - Bluetooth: hidp: use correct wait queue when removing ctrl_wait (Ole Bjørn Midtbø)   
  - net: usb: lan78xx: don't modify phy_device state concurrently (Ivan T. Ivanov)   
  - ARM: dts: nomadik: Fix up interrupt controller node names (Sudeep Holla)   
  - scsi: core: Avoid printing an error if target_alloc() returns -ENXIO (Sreekanth Reddy)   
  - scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach() (Ye Bin)   
  - scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry() (Harshvardhan Jha)   
  - dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available (Peter Ujfalusi)   
  - ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218 (Dave Gerlach)   
  - dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe() (Yu Kuai)   
  - ath9k: Postpone key cache entry deletion for TXQ frames reference it (Jouni Malinen)   
  - ath: Modify ath_key_delete() to not need full key entry (Jouni Malinen)   
  - ath: Export ath_hw_keysetmac() (Jouni Malinen)   
  - ath9k: Clear key cache explicitly on disabling hardware (Jouni Malinen)   
  - ath: Use safer key clearing with key cache entries (Jouni Malinen)   
  - x86/fpu: Make init_fpstate correct with optimized XSAVE (Thomas Gleixner)   
  - KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) (Maxim Levitsky)   
  - mac80211: drop data frames without key on encrypted links (Johannes Berg)   
  - vmlinux.lds.h: Handle clang's module.{c,d}tor sections (Nathan Chancellor)   
  - PCI/MSI: Enforce MSI[X] entry updates to be visible (Thomas Gleixner)   
  - PCI/MSI: Enforce that MSI-X table entry is masked for update (Thomas Gleixner)   
  - PCI/MSI: Mask all unused MSI-X entries (Thomas Gleixner)   
  - PCI/MSI: Protect msi_desc::masked for multi-MSI (Saeed Mirzamohammadi)   
  - PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown() (Thomas Gleixner)   
  - PCI/MSI: Correct misleading comments (Thomas Gleixner)   
  - PCI/MSI: Do not set invalid bits in MSI mask (Thomas Gleixner)   
  - PCI/MSI: Enable and mask MSI-X early (Thomas Gleixner)   
  - x86/resctrl: Fix default monitoring groups reporting (Babu Moger)   
  - x86/tools: Fix objdump version check again (Randy Dunlap)   
  - powerpc/kprobes: Fix kprobe Oops happens in booke (Pu Lehui)   
  - vsock/virtio: avoid potential deadlock when vsock device remove (Longpeng(Mike))   
  - xen/events: Fix race in set_evtchn_to_irq (Maximilian Heyne)   
  - tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets (Neal Cardwell)   
  - net: bridge: fix memleak in br_add_if() (Yang Yingliang)   
  - net: Fix memory leak in ieee802154_raw_deliver (Takeshi Misawa)   
  - psample: Add a fwd declaration for skbuff (Roi Dayan)   
  - ppp: Fix generating ifname when empty IFLA_IFNAME is specified (Pali Rohár)   
  - net: dsa: mt7530: add the missing RxUnicast MIB counter (DENG Qingfang)   
  - ASoC: cs42l42: Remove duplicate control for WNF filter frequency (Richard Fitzgerald)   
  - ASoC: cs42l42: Fix inversion of ADC Notch Switch control (Richard Fitzgerald)   
  - ASoC: cs42l42: Don't allow SND_SOC_DAIFMT_LEFT_J (Richard Fitzgerald)   
  - ASoC: cs42l42: Correct definition of ADC Volume control (Richard Fitzgerald)   
  - ACPI: NFIT: Fix support for virtual SPA ranges (Dan Williams)   
  - i2c: dev: zero out array used for i2c reads from userspace (Greg Kroah-Hartman)   
  - ASoC: intel: atom: Fix reference to PCM buffer address (Takashi Iwai)   
  - iio: adc: Fix incorrect exit of for-loop (Colin Ian King)   
  - iio: humidity: hdc100x: Add margin to the conversion time (Chris Lesiak)   
  - Linux 4.14.244 (Greg Kroah-Hartman)   
  - net: xilinx_emaclite: Do not print real IOMEM pointer (YueHaibing)   
  - ovl: prevent private clone if bind mount is not allowed (Miklos Szeredi)   
  - ppp: Fix generating ppp unit id when ifname is not specified (Pali Rohár)   
  - USB:ehci:fix Kunpeng920 ehci hardware problem (Longfang Liu)   
  - net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and ql_adapter_reset (Letu Ren)   
  - alpha: Send stop IPI to send to online CPUs (Prarit Bhargava)   
  - reiserfs: check directory items on read from disk (Shreyansh Chouhan)   
  - reiserfs: add check for root_inode in reiserfs_fill_super (Yu Kuai)   
  - libata: fix ata_pio_sector for CONFIG_HIGHMEM (Christoph Hellwig)   
  - qmi_wwan: add network device usage statistics for qmimux devices (Reinhard Speyerer)   
  - perf/x86/amd: Don't touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest (Like Xu)   
  - spi: meson-spicc: fix memory leak in meson_spicc_remove (Dongliang Mu)   
  - pcmcia: i82092: fix a null pointer dereference bug (Zheyu Ma)   
  - MIPS: Malta: Do not byte-swap accesses to the CBUS UART (Maciej W. Rozycki)   
  - serial: 8250: Mask out floating 16/32-bit bus bits (Maciej W. Rozycki)   
  - ext4: fix potential htree corruption when growing large_dir directories (Theodore Ts'o)   
  - pipe: increase minimum default pipe size to 2 pages (Alex Xu (Hello71))   
  - media: rtl28xxu: fix zero-length control request (Johan Hovold)   
  - staging: rtl8723bs: Fix a resource leak in sd_int_dpc (Xiangyang Zhang)   
  - scripts/tracing: fix the bug that can't parse raw_trace_func (Hui Su)   
  - usb: otg-fsm: Fix hrtimer list corruption (Dmitry Osipenko)   
  - usb: gadget: f_hid: idle uses the highest byte for duration (Maxim Devaev)   
  - usb: gadget: f_hid: fixed NULL pointer dereference (Phil Elwell)   
  - usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers (Maxim Devaev)   
  - USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2 (David Bauer)   
  - USB: serial: ch341: fix character loss at high transfer rates (Willy Tarreau)   
  - USB: serial: option: add Telit FD980 composition 0x1056 (Daniele Palmas)   
  - USB: usbtmc: Fix RCU stall warning (Qiang.zhang)   
  - net: vxge: fix use-after-free in vxge_device_unregister (Pavel Skripkin)   
  - net: fec: fix use-after-free in fec_drv_remove (Pavel Skripkin)   
  - net: pegasus: fix uninit-value in get_interrupt_interval (Pavel Skripkin)   
  - bnx2x: fix an error code in bnx2x_nic_load() (Dan Carpenter)   
  - mips: Fix non-POSIX regexp (H. Nikolaus Schaller)   
  - nfp: update ethtool reporting of pauseframe control (Fei Qin)   
  - net: natsemi: Fix missing pci_disable_device() in probe and remove (Wang Hai)   
  - media: videobuf2-core: dequeue if start_streaming fails (Hans Verkuil)   
  - scsi: sr: Return correct event when media event code is 3 (Li Manyi)   
  - omap5-board-common: remove not physically existing vdds_1v8_main fixed-regulator (H. Nikolaus Schaller)   
  - clk: stm32f4: fix post divisor setup for I2S/SAI PLLs (Dario Binacchi)   
  - ALSA: seq: Fix racy deletion of subscriber (Takashi Iwai)   
  - Revert "ACPICA: Fix memory leak caused by _CID repair function" (Rafael J. Wysocki)


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.509.1.el7uek]
changelog:
  - net/mlx{4,5},rds_rdma: fix non-determinism when comp_vector is zero (Håkon Bugge)  [Orabug: 33449986]  
  - net/mlx{4,5}: Fix signed formal parameter (Håkon Bugge)  [Orabug: 33449986]  
  - openvswitch: fix build warning in ovs_fragment() (John Donnelly)  [Orabug: 33460370]  
  - arm64: pensando: Kernel PCIe manager for Pensando SmartNIC (Rob Gardner)  [Orabug: 33413998]  
  - net/rds: "no error" is no error (Gerd Rausch)  [Orabug: 33457412]  
  - x86/vector: search CPU vector starts from last successfully assigned (Joe Jin)  [Orabug: 33451207]  
  - Linux 4.14.247 (Greg Kroah-Hartman)   
  - s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant (Ilya Leoshkevich)   
  - net: renesas: sh_eth: Fix freeing wrong tx descriptor (Yoshihiro Shimoda)   
  - qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom (Dinghao Liu)   
  - netfilter: socket: icmp6: fix use-after-scope (Benjamin Hesmans)   
  - net: dsa: b53: Fix calculating number of switch ports (Rafał Miłecki)   
  - ARC: export clear_user_page() for modules (Randy Dunlap)   
  - mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' (Christophe JAILLET)   
  - PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n (Andy Shevchenko)   
  - ethtool: Fix an error code in cxgb2.c (Yang Li)   
  - net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920 (Daniele Palmas)   
  - PCI: Add ACS quirks for Cavium multi-function devices (George Cherian)   
  - mfd: Don't use irq_create_mapping() to resolve a mapping (Marc Zyngier)   
  - dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation (Miquel Raynal)   
  - mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range() (David Hildenbrand)   
  - tcp: fix tp->undo_retrans accounting in tcp_sacktag_one() (zhenggy)   
  - net/af_unix: fix a data-race in unix_dgram_poll (Eric Dumazet)   
  - events: Reuse value read using READ_ONCE instead of re-reading it (Baptiste Lepers)   
  - tipc: increase timeout in tipc_sk_enqueue() (Hoang Le)   
  - r6040: Restore MDIO clock frequency after MAC reset (Florian Fainelli)   
  - net/l2tp: Fix reference count leak in l2tp_udp_recv_core (Xiyu Yang)   
  - ptp: dp83640: don't define PAGE0 (Randy Dunlap)   
  - net-caif: avoid user-triggerable WARN_ON(1) (Eric Dumazet)   
  - x86/mm: Fix kern_addr_valid() to cope with existing but not present entries (Mike Rapoport)   
  - PM: base: power: don't try to use non-existing RTC for storing data (Juergen Gross)   
  - bnx2x: Fix enabling network interfaces without VFs (Adrian Bunk)   
  - xen: reset legacy rtc flag for PV domU (Juergen Gross)   
  - platform/chrome: cros_ec_proto: Send command again when timeout occurs (Patryk Duda)   
  - memcg: enable accounting for pids in nested pid namespaces (Vasily Averin)   
  - mm/hugetlb: initialize hugetlb_usage in mm_init (Liu Zixian)   
  - cpufreq: powernv: Fix init_chip_info initialization in numa=off (Pratik R. Sampat)   
  - scsi: qla2xxx: Sync queue idx with queue_pair_map idx (Saurav Kashyap)   
  - scsi: BusLogic: Fix missing pr_cont() use (Maciej W. Rozycki)   
  - parisc: fix crash with signals and alloca (Mikulas Patocka)   
  - net: w5100: check return value after calling platform_get_resource() (Yang Yingliang)   
  - net: fix NULL pointer reference in cipso_v4_doi_free (王贇)   
  - ath9k: fix sleeping in atomic context (Miaoqing Pan)   
  - ath9k: fix OOB read ar9300_eeprom_restore_internal (Zekun Shen)   
  - parport: remove non-zero check on count (Colin Ian King)   
  - ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B (Xiaotan Luo)   
  - ASoC: rockchip: i2s: Fix regmap_ops hang (Sugar Zhang)   
  - usbip:vhci_hcd USB port can get stuck in the disabled state (Shuah Khan)   
  - usbip: give back URBs for unsent unlink requests during cleanup (Anirudh Rayabharam)   
  - usb: musb: musb_dsps: request_irq() after initializing musb (Nadezda Lutovinova)   
  - Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set" (Mathias Nyman)   
  - cifs: fix wrong release in sess_alloc_buffer() failed path (Ding Hui)   
  - selftests/bpf: Enlarge select() timeout for test_maps (Li Zhijian)   
  - mmc: rtsx_pci: Fix long reads when clock is prescaled (Thomas Hebb)   
  - mmc: sdhci-of-arasan: Check return value of non-void funtions (Manish Narani)   
  - gfs2: Don't call dlm after protocol is unmounted (Bob Peterson)   
  - staging: rts5208: Fix get_ms_information() heap buffer size (Kees Cook)   
  - rpc: fix gss_svc_init cleanup on failure (J. Bruce Fields)   
  - ARM: tegra: tamonten: Fix UART pad setting (Andreas Obergschwandtner)   
  - gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port() (Tuo Li)   
  - Bluetooth: avoid circular locks in sco_sock_connect (Desmond Cheong Zhi Xi)   
  - net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe() (Nathan Chancellor)   
  - arm64: dts: qcom: sdm660: use reg value for memory node (Vinod Koul)   
  - media: v4l2-dv-timings.c: fix wrong condition in two for-loops (Hans Verkuil)   
  - ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output (Hans de Goede)   
  - Bluetooth: skip invalid hci_sync_conn_complete_evt (Desmond Cheong Zhi Xi)   
  - ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init() (Andy Shevchenko)   
  - staging: ks7010: Fix the initialization of the 'sleep_status' structure (Christophe JAILLET)   
  - serial: 8250_pci: make setup_port() parameters explicitly unsigned (Greg Kroah-Hartman)   
  - hvsi: don't panic on tty_register_driver failure (Jiri Slaby)   
  - xtensa: ISS: don't panic in rs_init (Jiri Slaby)   
  - serial: 8250: Define RX trigger levels for OxSemi 950 devices (Maciej W. Rozycki)   
  - s390/jump_label: print real address in a case of a jump label bug (Heiko Carstens)   
  - flow_dissector: Fix out-of-bounds warnings (Gustavo A. R. Silva)   
  - ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() (Gustavo A. R. Silva)   
  - video: fbdev: riva: Error out if 'pixclock' equals zero (Zheyu Ma)   
  - video: fbdev: kyro: Error out if 'pixclock' equals zero (Zheyu Ma)   
  - video: fbdev: asiliantfb: Error out if 'pixclock' equals zero (Zheyu Ma)   
  - bpf/tests: Do not PASS tests without actually testing the result (Johan Almbladh)   
  - bpf/tests: Fix copy-and-paste error in double word test (Johan Almbladh)   
  - tty: serial: jsm: hold port lock when reporting modem line changes (Zheyu Ma)   
  - staging: board: Fix uninitialized spinlock when attaching genpd (Geert Uytterhoeven)   
  - usb: gadget: composite: Allow bMaxPower=0 if self-powered (Jack Pham)   
  - usb: gadget: u_ether: fix a potential null pointer dereference (Maciej Żenczykowski)   
  - usb: host: fotg210: fix the actual_length of an iso packet (Kelly Devilliv)   
  - usb: host: fotg210: fix the endpoint's transactional opportunities calculation (Kelly Devilliv)   
  - Smack: Fix wrong semantics in smk_access_entry() (Tianjia Zhang)   
  - netlink: Deal with ESRCH error in nlmsg_notify() (Yajun Deng)   
  - video: fbdev: kyro: fix a DoS bug by restricting user input (Zheyu Ma)   
  - ARM: dts: qcom: apq8064: correct clock names (David Heidelberg)   
  - iio: dac: ad5624r: Fix incorrect handling of an optional regulator. (Jonathan Cameron)   
  - PCI: Use pci_update_current_state() in pci_enable_device_flags() (Rafael J. Wysocki)   
  - crypto: mxs-dcp - Use sg_mapping_iter to copy data (Sean Anderson)   
  - media: dib8000: rewrite the init prbs logic (Mauro Carvalho Chehab)   
  - MIPS: Malta: fix alignment of the devicetree buffer (Oleksij Rempel)   
  - scsi: qedi: Fix error codes in qedi_alloc_global_queues() (Dan Carpenter)   
  - pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry() (Zhen Lei)   
  - openrisc: don't printk() unconditionally (Randy Dunlap)   
  - vfio: Use config not menuconfig for VFIO_NOIOMMU (Jason Gunthorpe)   
  - pinctrl: samsung: Fix pinctrl bank pin count (Jaehyoung Choi)   
  - docs: Fix infiniband uverbs minor number (Leon Romanovsky)   
  - RDMA/iwcm: Release resources if iw_cm module initialization fails (Leon Romanovsky)   
  - HID: input: do not report stylus battery state as "full" (Dmitry Torokhov)   
  - PCI: aardvark: Fix masking and unmasking legacy INTx interrupts (Pali Rohár)   
  - PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response (Pali Rohár)   
  - PCI: xilinx-nwl: Enable the clock through CCF (Hyun Kwon)   
  - PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure (Krzysztof Wilczyński)   
  - PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported (Marek Behún)   
  - ARM: 9105/1: atags_to_fdt: don't warn about stack size (David Heidelberg)   
  - libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs (Hans de Goede)   
  - media: rc-loopback: return number of emitters rather than error (Sean Young)   
  - media: uvc: don't do DMA on stack (Mauro Carvalho Chehab)   
  - VMCI: fix NULL pointer dereference when unmapping queue pair (Wang Hai)   
  - dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() (Arne Welzel)   
  - power: supply: max17042: handle fails of reading status register (Krzysztof Kozlowski)   
  - block: bfq: fix bfq_set_next_ioprio_data() (Damien Le Moal)   
  - crypto: public_key: fix overflow during implicit conversion (zhenwei pi)   
  - soc: aspeed: lpc-ctrl: Fix boundary check for mmap (Iwona Winiarska)   
  - 9p/xen: Fix end of loop tests for list_for_each_entry (Harshvardhan Jha)   
  - include/linux/list.h: add a macro to test if entry is pointing to the head (Andy Shevchenko)   
  - xen: fix setting of max_pfn in shared_info (Juergen Gross)   
  - powerpc/perf/hv-gpci: Fix counter value parsing (Kajol Jain)   
  - PCI/MSI: Skip masking MSI-X on Xen PV (Marek Marczykowski-Górecki)   
  - blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN (Niklas Cassel)   
  - blk-zoned: allow zone management send operations without CAP_SYS_ADMIN (Niklas Cassel)   
  - rtc: tps65910: Correct driver module alias (Dmitry Osipenko)   
  - fbmem: don't allow too huge resolutions (Tetsuo Handa)   
  - clk: kirkwood: Fix a clocking boot regression (Linus Walleij)   
  - backlight: pwm_bl: Improve bootloader/kernel device handover (Daniel Thompson)   
  - IMA: remove -Wmissing-prototypes warning (Austin Kim)   
  - KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted (Zelin Deng)   
  - x86/resctrl: Fix a maybe-uninitialized build warning treated as error (Babu Moger)   
  - tty: Fix data race between tiocsti() and flush_to_ldisc() (Nguyen Dinh Phi)   
  - netns: protect netns ID lookups with RCU (Guillaume Nault)   
  - net: qualcomm: fix QCA7000 checksum handling (Stefan Wahren)   
  - net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed (Xiyu Yang)   
  - ipv4: make exception cache less predictible (Eric Dumazet)   
  - bcma: Fix memory leak for internally-handled cores (Zenghui Yu)   
  - ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() (Dan Carpenter)   
  - tty: serial: fsl_lpuart: fix the wrong mapbase value (Andy Duan)   
  - usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available (Christophe JAILLET)   
  - usb: ehci-orion: Handle errors of clk_prepare_enable() in probe (Evgeny Novikov)   
  - i2c: mt65xx: fix IRQ check (Sergey Shtylyov)   
  - CIFS: Fix a potencially linear read overflow (Len Baker)   
  - mmc: moxart: Fix issue with uninitialized dma_slave_config (Tony Lindgren)   
  - mmc: dw_mmc: Fix issue with uninitialized dma_slave_config (Tony Lindgren)   
  - i2c: s3c2410: fix IRQ check (Sergey Shtylyov)   
  - i2c: iop3xx: fix deferred probing (Sergey Shtylyov)   
  - Bluetooth: add timeout sanity check to hci_inquiry (Pavel Skripkin)   
  - usb: gadget: mv_u3d: request_irq() after initializing UDC (Nadezda Lutovinova)   
  - mac80211: Fix insufficient headroom issue for AMSDU (Chih-Kang Chang)   
  - usb: phy: tahvo: add IRQ check (Sergey Shtylyov)   
  - usb: host: ohci-tmio: add IRQ check (Sergey Shtylyov)   
  - Bluetooth: Move shutdown callback before flushing tx and rx queue (Kai-Heng Feng)   
  - usb: phy: twl6030: add IRQ checks (Sergey Shtylyov)   
  - usb: phy: fsl-usb: add IRQ check (Sergey Shtylyov)   
  - usb: gadget: udc: at91: add IRQ check (Sergey Shtylyov)   
  - drm/msm/dsi: Fix some reference counted resource leaks (Christophe JAILLET)   
  - Bluetooth: fix repeated calls to sco_sock_kill (Desmond Cheong Zhi Xi)   
  - arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 (Krzysztof Kozlowski)   
  - Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow (Colin Ian King)   
  - soc: qcom: smsm: Fix missed interrupts if state changes while masked (Stephan Gerhold)   
  - PCI: PM: Enable PME if it can be signaled from D3cold (Rafael J. Wysocki)   
  - PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (Rafael J. Wysocki)   
  - media: em28xx-input: fix refcount bug in em28xx_usb_disconnect (Dongliang Mu)   
  - i2c: highlander: add IRQ check (Sergey Shtylyov)   
  - net: cipso: fix warnings in netlbl_cipsov4_add_std (Pavel Skripkin)   
  - tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos (Martin KaFai Lau)   
  - Bluetooth: sco: prevent information leak in sco_conn_defer_accept() (Dan Carpenter)   
  - media: go7007: remove redundant initialization (Pavel Skripkin)   
  - media: dvb-usb: fix uninit-value in vp702x_read_mac_addr (Dongliang Mu)   
  - media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init (Dongliang Mu)   
  - soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally (Geert Uytterhoeven)   
  - certs: Trigger creation of RSA module signing key if it's not an RSA key (Stefan Berger)   
  - crypto: qat - use proper type for vf_mask (Giovanni Cabiddu)   
  - clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel (Phong Hoang)   
  - spi: spi-pic32: Fix issue with uninitialized dma_slave_config (Tony Lindgren)   
  - spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config (Tony Lindgren)   
  - m68k: emu: Fix invalid free in nfeth_cleanup() (Pavel Skripkin)   
  - udf_get_extendedattr() had no boundary checks. (Stian Skjelstad)   
  - crypto: qat - do not export adf_iov_putmsg() (Giovanni Cabiddu)   
  - crypto: qat - fix naming for init/shutdown VF to PF notifications (Marco Chiappero)   
  - crypto: qat - fix reuse of completion variable (Marco Chiappero)   
  - crypto: qat - handle both source of interrupt in VF ISR (Giovanni Cabiddu)   
  - crypto: qat - do not ignore errors from enable_vf2pf_comms() (Giovanni Cabiddu)   
  - libata: fix ata_host_start() (Damien Le Moal)   
  - s390/cio: add dev_busid sysfs entry for each subchannel (Vineeth Vijayan)   
  - power: supply: max17042_battery: fix typo in MAx17042_TOFF (Sebastian Krzyszkowiak)   
  - nvme-rdma: don't update queue count when failing to set io queues (Ruozhu Li)   
  - isofs: joliet: Fix iocharset=utf8 mount option (Pali Rohár)   
  - udf: Check LVID earlier (Jan Kara)   
  - crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() (Tony Lindgren)   
  - power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors (Hans de Goede)   
  - crypto: mxs-dcp - Check for DMA mapping errors (Sean Anderson)   
  - regmap: fix the offset of register error log (Jeongtae Park)   
  - PCI: Call Max Payload Size-related fixup quirks early (Marek Behún)   
  - x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions (Paul Gortmaker)   
  - usb: host: xhci-rcar: Don't reload firmware after the completion (Yoshihiro Shimoda)   
  - Revert "btrfs: compression: don't try to compress if we don't have enough pages" (Qu Wenruo)   
  - mm/page_alloc: speed up the iteration of max_order (Muchun Song)   
  - net: ll_temac: Remove left-over debug message (Esben Haabendal)   
  - powerpc/boot: Delete unneeded .globl _zimage_start (Fangrui Song)   
  - powerpc/module64: Fix comment in R_PPC64_ENTRY handling (Michael Ellerman)   
  - crypto: talitos - reduce max key size for SEC1 (Christophe Leroy)   
  - mm/kmemleak.c: make cond_resched() rate-limiting more efficient (Andrew Morton)   
  - s390/disassembler: correct disassembly lines alignment (Vasily Gorbik)   
  - ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2) (Mathieu Desnoyers)   
  - ath10k: fix recent bandwidth conversion bug (Christian Lamparter)   
  - f2fs: fix potential overflow (Chao Yu)   
  - USB: serial: mos7720: improve OOM-handling in read_mos_reg() (Tom Rix)   
  - igmp: Add ip_mc_list lock in ip_check_mc_rcu (Liu Jian)   
  - media: stkwebcam: fix memory leak in stk_camera_probe (Pavel Skripkin)   
  - clk: fix build warning for orphan_list (Greg Kroah-Hartman)   
  - ALSA: pcm: fix divide error in snd_pcm_lib_ioctl (Zubin Mithra)   
  - ARM: 8918/2: only build return_address() if needed (Ben Dooks)   
  - cryptoloop: add a deprecation warning (Christoph Hellwig)   
  - perf/x86/amd/ibs: Work around erratum #1197 (Kim Phillips)   
  - perf/x86/intel/pt: Fix mask of num_address_ranges (Xiaoyao Li)   
  - qede: Fix memset corruption (Shai Malin)   
  - net: macb: Add a NULL check on desc_ptp (Harini Katakam)   
  - qed: Fix the VF msix vectors flow (Shai Malin)   
  - xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG (Randy Dunlap)   
  - ext4: fix race writing to an inline_data file while its xattrs are changing (Theodore Ts'o)   
  - Linux 4.14.246 (Greg Kroah-Hartman)   
  - Revert "floppy: reintroduce O_NDELAY fix" (Denis Efremov)   
  - KVM: X86: MMU: Use the correct inherited permissions to get shadow page (Lai Jiangshan)   
  - KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs (Sean Christopherson)   
  - fbmem: add margin check to fb_check_caps() (George Kennedy)   
  - vt_kdsetmode: extend console locking (Linus Torvalds)   
  - drm/nouveau/disp: power down unused DP links during init (Ben Skeggs)   
  - drm: Copy drm_wait_vblank to user before returning (Mark Yacoub)   
  - vringh: Use wiov->used to check for read/write desc order (Neeraj Upadhyay)   
  - virtio: Improve vq->broken access to avoid any compiler optimization (Parav Pandit)   
  - opp: remove WARN when no valid OPPs remain (Michał Mirosław)   
  - usb: gadget: u_audio: fix race condition on endpoint stop (Jerome Brunet)   
  - net: marvell: fix MVNETA_TX_IN_PRGRS bit number (Maxim Kiselev)   
  - xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()' (Christophe JAILLET)   
  - ip_gre: add validation for csum_start (Shreyansh Chouhan)   
  - e1000e: Fix the max snoop/no-snoop latency for 10M (Sasha Neftin)   
  - IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs() (Tuo Li)   
  - usb: dwc3: gadget: Stop EP0 transfers during pullup disable (Wesley Cheng)   
  - usb: dwc3: gadget: Fix dwc3_calc_trbs_left() (Thinh Nguyen)   
  - USB: serial: option: add new VID/PID to support Fibocom FG150 (Zhengjun Zhang)   
  - Revert "USB: serial: ch341: fix character loss at high transfer rates" (Johan Hovold)   
  - can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters (Stefan Mätje)   
  - ARC: Fix CONFIG_STACKDEPOT (Guenter Roeck)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.509.2.el7uek]
changelog:
  - rds/ib: handle rds uncongested notifications in worker (Manjunath Patil)  [Orabug: 33467790]  
  - block: Fix bio_integrity_payload handling for cloned bios (Martin K. Petersen)  [Orabug: 33485629]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.509.2.1.el7uek]
changelog:
  - Revert "x86/vector: search CPU vector starts from last successfully assigned" (John Donnelly)  [Orabug: 33513920]


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.509.2.2.el7uek]
changelog:
  - xfs: punch out data fork delalloc blocks on COW writeback failure (Brian Foster)  [Orabug: 33557700]  
  - xfs: fix reflink source file racing with directio writes (Darrick J. Wong)  [Orabug: 33557700]  
  - xfs: split up the xfs_reflink_end_cow work into smaller transactions (Darrick J. Wong)  [Orabug: 33557700]  
  - xfs: flush removing page cache in xfs_reflink_remap_prep (Dave Chinner)  [Orabug: 33557700]  
  - xfs: fix shared extent data corruption due to missing cow reservation (Brian Foster)  [Orabug: 33557700]  
  - xfs: fix pagecache truncation prior to reflink (Darrick J. Wong)  [Orabug: 33557700]  
  - xfs: fix fork selection in xfs_find_trim_cow_extent (Christoph Hellwig)  [Orabug: 33557700]  
  - xfs: remove the unused trimmed argument from xfs_reflink_trim_around_shared (Christoph Hellwig)  [Orabug: 33557700]  
  - xfs: skip delalloc COW blocks in xfs_reflink_end_cow (Christoph Hellwig)  [Orabug: 33557700]  
  - xfs: fix transaction leak in xfs_reflink_allocate_cow() (Dave Chinner)  [Orabug: 33557700]  
  - xfs: cow unwritten conversion uses uninitialized dfops (Brian Foster)  [Orabug: 33557700]  
  - xfs: fix double ijoin in xfs_reflink_clear_inode_flag() (Dave Chinner)  [Orabug: 33557700]  
  - xfs: fix double ijoin in xfs_reflink_cancel_cow_range (Dave Chinner)  [Orabug: 33557700]  
  - xfs: minor cleanup for xfs_reflink_end_cow (Christoph Hellwig)  [Orabug: 33557700]  
  - xfs: fix transaction allocation deadlock in IO path (Dave Chinner)  [Orabug: 33557700]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.509.2.3.el7uek]
changelog:
  - rds/ib: Use both iova and key in free_mr socket call (aru kolappan)  [Orabug: 33670981]  
  - take care multiple extents in CoW extent converting (Wengang Wang)  [Orabug: 33647277]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.510.0.el7uek]
changelog:
  - xen-blkfront: sanitize the removal state machine (Christoph Hellwig)  [Orabug: 33486179]  
  - xen/blkfront: fix ring info addressing (Juergen Gross)  [Orabug: 33486179]  
  - xen/blkfront: limit allocated memory size to actual use case (Juergen Gross)  [Orabug: 33486179]  
  - xen-blkfront: do not remove disk when device_create_file() is failed (Dongli Zhang)  [Orabug: 33486179]  
  - cifs: move cifsFileInfo_put logic into a work-queue (Ronnie Sahlberg)  [Orabug: 33473933]  
  - genirq/affinity: Spread irq vectors among present CPUs as far as possible (Ming Lei)  [Orabug: 33456847]  
  - genirq/affinity: Allow irq spreading from a given starting point (Ming Lei)  [Orabug: 33456847]  
  - genirq/affinity: Move actual irq vector spreading into a helper function (Ming Lei)  [Orabug: 33456847]  
  - genirq/affinity: Rename *node_to_possible_cpumask as *node_to_cpumask (Ming Lei)  [Orabug: 33456847]  
  - net/mlx5: Initialize nvec based on "num_possible_cpus()" (Gerd Rausch)  [Orabug: 33451394]  
  - net/rds: Bring tasklets back for better latency (Gerd Rausch)  [Orabug: 33308966]  
  - net/rds: Throttle check for CQ CPU affinity (Gerd Rausch)  [Orabug: 33308966]  
  - net/rds: Follow the observed CQ CPU affinity (Gerd Rausch)  [Orabug: 33308966]  
  - net/rds: Add "preferred_cpu" option to "rds_rdma.ko" (Gerd Rausch)  [Orabug: 33308966]  
  - net/mlx5: Add new verb "ib_get_vector_irqn" (Gerd Rausch)  [Orabug: 33308966]  
  - net/mlx5: Fix MLX5_EQ_VEC_COMP_BASE usage (Gerd Rausch)  [Orabug: 33308966]  
  - net/rds: Fix "rds_ib_init" initialization order (Gerd Rausch)  [Orabug: 33308966]  
  - net/rds: Use the preferred_cpu in rds_queue_{,delayed}_work (Gerd Rausch)  [Orabug: 33308966]  
  - net/rds: Make workers use the designated CPU (Gerd Rausch)  [Orabug: 33308966]  
  - net/rds: Put more CPU cores to work (Gerd Rausch)  [Orabug: 33308966]  
  - net/rds: Get rid of tasklets (Gerd Rausch)  [Orabug: 33308966]  
  - net/rds: Use the same vector for send & receive (Gerd Rausch)  [Orabug: 33308966]  
  - net/rds: Allocate rds_ib_{incoming,frag}_slab on HCA NUMA nodeid (Gerd Rausch)  [Orabug: 33308966]  
  - net/rds: Allocate pages on HCA NUMA nodeid (Gerd Rausch)  [Orabug: 33308966]  
  - btrfs: always wait on ordered extents at fsync time (Josef Bacik)  [Orabug: 33046870]  
  - sctp: account stream padding length for reconf chunk (Eiichi Tsukata)  [Orabug: 32816609]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.510.1.el7uek]
changelog:
  - RDS: Remove obsolete flag (Hans Westgaard Ry)  [Orabug: 33516782]  
  - RDMA/mlx5: Avoid taking MRs from larger MR cache pools when a pool is empty (Aharon Landau)  [Orabug: 33514377]  
  - IB/mlx4: Implement backend callback for "ib_get_vector_irqn" (Gerd Rausch)  [Orabug: 33509437]  
  - Revert "x86/vector: search CPU vector starts from last successfully assigned" (John Donnelly)  [Orabug: 33488855]  
  - rds: Fix leak in rds_init (Håkon Bugge)  [Orabug: 33488611]  
  - rds: include pid in rds_sock struct (Rohit Nair)  [Orabug: 33481153]  
  - RDS-IB: Add garbage-collection to cache (Hans Westgaard Ry)  [Orabug: 33426208]  
  - RDS-IB: Fix cachehit statistics (Hans Westgaard Ry)  [Orabug: 33426208]  
  - RDS-IB: Fix cache-allocation statistics (Hans Westgaard Ry)  [Orabug: 33426208]  
  - netem: use 64 bit divide by rate (Stephen Hemminger)  [Orabug: 33135408]  
  - fs/dcache: add trace points for negative dentry pruning (Gautham Ananthakrishna)  [Orabug: 31182222]  
  - fs/dcache: remove global pool for negative dentry percpu counters (Gautham Ananthakrishna)  [Orabug: 31182222]  
  - fs/dcache: enforce a hard limit on the negative dentry count (Gautham Ananthakrishna)  [Orabug: 31182222]  
  - fs/dcache: Estimate the number of negative dentries to prune per filesystem (Gautham Ananthakrishna)  [Orabug: 31182222]  
  - fs/dcache: change name and granularity of negative dentry sysctl parameter (Gautham Ananthakrishna)  [Orabug: 31182222]  
  - fs/dcache: schedule only one instance of negative dentry shrinker (Gautham Ananthakrishna)  [Orabug: 31182222]  
  - fs/dcache: correct the usage of static_key for negative dentry (Gautham Ananthakrishna)  [Orabug: 31182222]  
  - fs/dcache: Spread negative dentry pruning across multiple CPUs (Waiman Long)  [Orabug: 31182222]  
  - fs/dcache: Enable automatic pruning of negative dentries (Waiman Long)  [Orabug: 31182222]  
  - fs/dcache: Add sysctl parameter neg-dentry-pc as a soft limit on negative dentries (Waiman Long)  [Orabug: 31182222]  
  - fs/dcache: Track & report number of negative dentries (Waiman Long)  [Orabug: 31182222]  
  - Linux 4.14.249 (Greg Kroah-Hartman)   
  - cred: allow get_cred() and put_cred() to be given NULL. (NeilBrown)   
  - HID: usbhid: free raw_report buffers in usbhid_stop (Anirudh Rayabharam)   
  - netfilter: ipset: Fix oversized kvmalloc() calls (Jozsef Kadlecsik)   
  - HID: betop: fix slab-out-of-bounds Write in betop_probe (F.A.Sulaiman)   
  - crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (Dan Carpenter)   
  - usb: hso: remove the bailout parameter (Dongliang Mu)   
  - usb: hso: fix error handling code of hso_create_net_device (Dongliang Mu)   
  - hso: fix bailout in error case of probe (Oliver Neukum)   
  - arm64: Extend workaround for erratum 1024718 to all versions of Cortex-A55 (Suzuki K Poulose)   
  - ARM: 9098/1: ftrace: MODULE_PLT: Fix build problem without DYNAMIC_FTRACE (Alex Sverdlin)   
  - ARM: 9079/1: ftrace: Add MODULE_PLTS support (Alex Sverdlin)   
  - ARM: 9078/1: Add warn suppress parameter to arm_gen_branch_link() (Alex Sverdlin)   
  - ARM: 9077/1: PLT: Move struct plt_entries definition to header (Alex Sverdlin)   
  - EDAC/synopsys: Fix wrong value type assignment for edac_mode (Sai Krishna Potthuri)   
  - net: udp: annotate data race around udp_sk(sk)->corkflag (Eric Dumazet)   
  - ext4: fix potential infinite loop in ext4_dx_readdir() (yangerkun)   
  - ipack: ipoctal: fix module reference leak (Johan Hovold)   
  - ipack: ipoctal: fix missing allocation-failure check (Johan Hovold)   
  - ipack: ipoctal: fix tty-registration error handling (Johan Hovold)   
  - ipack: ipoctal: fix tty registration race (Johan Hovold)   
  - ipack: ipoctal: fix stack information leak (Johan Hovold)   
  - af_unix: fix races in sk_peer_pid and sk_peer_cred accesses (Saeed Mirzamohammadi)   
  - scsi: csiostor: Add module softdep on cxgb4 (Rahul Lakkireddy)   
  - e100: fix buffer overrun in e100_get_regs (Jacob Keller)   
  - e100: fix length calculation in e100_get_regs_len (Jacob Keller)   
  - hwmon: (tmp421) fix rounding for negative values (Paul Fertser)   
  - sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb (Xin Long)   
  - mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap (Lorenzo Bianconi)   
  - mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug (Chih-Kang Chang)   
  - ipvs: check that ip_vs_conn_tab_bits is between 8 and 20 (Andrea Claudi)   
  - mac80211: fix use-after-free in CCMP/GCMP RX (Johannes Berg)   
  - cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory (James Morse)   
  - cpufreq: schedutil: Use kobject release() method to free sugov_tunables (Kevin Hao)   
  - tty: Fix out-of-bound vmalloc access in imageblit (Igor Matheus Andrade Torrente)   
  - qnx4: work around gcc false positive warning bug (Linus Torvalds)   
  - xen/balloon: fix balloon kthread freezing (Juergen Gross)   
  - PCI: aardvark: Fix checking for PIO status (Evan Wang)   
  - PCI: aardvark: Fix checking for PIO Non-posted Request (Pali Rohár)   
  - arm64: dts: marvell: armada-37xx: Extend PCIe MEM space (Pali Rohár)   
  - spi: Fix tegra20 build with CONFIG_PM=n (Linus Torvalds)   
  - net: 6pack: Fix tx timeout and slot time (Guenter Roeck)   
  - alpha: Declare virt_to_phys and virt_to_bus parameter as pointer to volatile (Guenter Roeck)   
  - arm64: Mark __stack_chk_guard as __ro_after_init (Dan Li)   
  - parisc: Use absolute_pointer() to define PAGE0 (Helge Deller)   
  - qnx4: avoid stringop-overread errors (Linus Torvalds)   
  - sparc: avoid stringop-overread errors (Linus Torvalds)   
  - net: i825xx: Use absolute_pointer for memcpy from fixed memory location (Guenter Roeck)   
  - compiler.h: Introduce absolute_pointer macro (Guenter Roeck)   
  - xen/balloon: use a kernel thread instead a workqueue (Juergen Gross)   
  - m68k: Double cast io functions to unsigned long (Guenter Roeck)   
  - net: stmmac: allow CSR clock of 300MHz (Jesper Nilsson)   
  - net: macb: fix use after free on rmmod (Tong Zhang)   
  - blktrace: Fix uaf in blk_trace access after removing by sysfs (Zhihao Cheng)   
  - md: fix a lock order reversal in md_alloc (Christoph Hellwig)   
  - irqchip/gic-v3-its: Fix potential VPE leak on error (Kaige Fu)   
  - thermal/core: Potential buffer overflow in thermal_build_list_of_policies() (Dan Carpenter)   
  - scsi: iscsi: Adjust iface sysfs attr detection (Baokun Li)   
  - net/mlx4_en: Don't allow aRFS for encapsulated packets (Aya Levin)   
  - bnxt_en: Fix TX timeout when TX ring size is set to the smallest (Michael Chan)   
  - net: hso: fix muxed tty registration (Johan Hovold)   
  - serial: mvebu-uart: fix driver's tx_empty callback (Pali Rohár)   
  - mcb: fix error handling in mcb_alloc_bus() (Dan Carpenter)   
  - USB: serial: option: add device id for Foxconn T99W265 (Slark Xiao)   
  - USB: serial: option: remove duplicate USB device ID (Krzysztof Kozlowski)   
  - USB: serial: option: add Telit LN920 compositions (Carlo Lobrano)   
  - USB: serial: mos7840: remove duplicated 0xac24 device ID (Krzysztof Kozlowski)   
  - Re-enable UAS for LaCie Rugged USB3-FW with fk quirk (Julian Sikorski)   
  - staging: greybus: uart: fix tty use after free (Johan Hovold)   
  - USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter (Uwe Brandt)   
  - usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c (Ondrej Zary)   
  - xen/x86: fix PV trap handling on secondary processors (Jan Beulich)   
  - cifs: fix incorrect check for null pointer in header_assemble (Steve French)   
  - usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned() (Dan Carpenter)   
  - usb: gadget: r8a66597: fix a loop in set_feature() (Dan Carpenter)   
  - Linux 4.14.248 (Greg Kroah-Hartman)   
  - drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV (Guenter Roeck)   
  - blk-throttle: fix UAF by deleteing timer in blk_throtl_exit() (Li Jinlin)   
  - pwm: rockchip: Don't modify HW state in .remove() callback (Uwe Kleine-König)   
  - nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group (Nanyong Sun)   
  - nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group (Nanyong Sun)   
  - nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group (Nanyong Sun)   
  - nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group (Nanyong Sun)   
  - nilfs2: fix NULL pointer in nilfs_##name##_attr_release (Nanyong Sun)   
  - nilfs2: fix memory leak in nilfs_sysfs_create_device_group (Nanyong Sun)   
  - ceph: lockdep annotations for try_nonblocking_invalidate (Jeff Layton)   
  - dmaengine: xilinx_dma: Set DMA mask for coherent APIs (Radhey Shyam Pandey)   
  - dmaengine: ioat: depends on !UML (Johannes Berg)   
  - parisc: Move pci_dev_is_behind_card_dino to where it is used (Guenter Roeck)   
  - Kconfig.debug: drop selecting non-existing HARDLOCKUP_DETECTOR_ARCH (Lukas Bulwahn)   
  - pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered (Uwe Kleine-König)   
  - profiling: fix shift-out-of-bounds bugs (Pavel Skripkin)   
  - prctl: allow to setup brk for et_dyn executables (Cyrill Gorcunov)   
  - 9p/trans_virtio: Remove sysfs file on probe failure (Xie Yongji)   
  - thermal/drivers/exynos: Fix an error code in exynos_tmu_probe() (Dan Carpenter)   
  - dmaengine: acpi: Avoid comparison GSI with Linux vIRQ (Andy Shevchenko)   
  - sctp: add param size validation for SCTP_PARAM_SET_PRIMARY (Marcelo Ricardo Leitner)   
  - sctp: validate chunk size in __rcv_asconf_lookup (Marcelo Ricardo Leitner)   
  - crypto: talitos - fix max key size for sha384 and sha512 (Christophe Leroy)   
  - apparmor: remove duplicate macro list_entry_is_head() (Andy Shevchenko)   
  - rcu: Fix missed wakeup of exp_wq waiters (Neeraj Upadhyay)   
  - s390/bpf: Fix optimizing out zero-extensions (Ilya Leoshkevich)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.510.2.el7uek]
changelog:
  - rds: ib: Fix bug when comp_vector is IB_CQ_FORCE_ZERO_CV (Håkon Bugge)  [Orabug: 33538398]  
  - nfsd: back channel stuck in SEQ4_STATUS_CB_PATH_DOWN (Dai Ngo)  [Orabug: 33536948]  
  - nfsd: handle repeated BIND_CONN_TO_SESSION (J. Bruce Fields)  [Orabug: 33536948]  
  - xen/netfront: stop tx queues during live migration (Dongli Zhang)  [Orabug: 33536404]  
  - Linux 4.14.252 (Greg Kroah-Hartman)   
  - r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256 (Vegard Nossum)   
  - qed: Fix missing error code in qed_slowpath_start() (chongjiapeng)   
  - acpi/arm64: fix next_platform_timer() section mismatch error (Jackie Liu)   
  - drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling (Dan Carpenter)   
  - drm/msm: Fix null pointer dereference on pointer edp (Colin Ian King)   
  - pata_legacy: fix a couple uninitialized variable bugs (Dan Carpenter)   
  - NFC: digital: fix possible memory leak in digital_in_send_sdd_req() (Ziyang Xuan)   
  - NFC: digital: fix possible memory leak in digital_tg_listen_mdaa() (Ziyang Xuan)   
  - nfc: fix error handling of nfc_proto_register() (Ziyang Xuan)   
  - ethernet: s2io: fix setting mac address during resume (Arnd Bergmann)   
  - net: encx24j600: check error in devm_regmap_init_encx24j600 (Nanyong Sun)   
  - net: korina: select CRC32 (Vegard Nossum)   
  - net: arc: select CRC32 (Vegard Nossum)   
  - iio: ssp_sensors: fix error code in ssp_print_mcu_debug() (Dan Carpenter)   
  - iio: ssp_sensors: add more range checking in ssp_parse_dataframe() (Dan Carpenter)   
  - iio: light: opt3001: Fixed timeout error when 0 lux (Jiri Valek - 2N)   
  - iio: adc128s052: Fix the error handling path of 'adc128_probe()' (Christophe JAILLET)   
  - iio: adc: aspeed: set driver data when adc probe. (Billy Tsai)   
  - x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically (Borislav Petkov)   
  - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Stephen Boyd)   
  - virtio: write back F_VERSION_1 before validate (Halil Pasic)   
  - USB: serial: option: add prod. id for Quectel EG91 (Tomaz Solc)   
  - USB: serial: option: add Telit LE910Cx composition 0x1204 (Daniele Palmas)   
  - USB: serial: option: add Quectel EC200S-CN module support (Yu-Tung Chang)   
  - USB: serial: qcserial: add EM9191 QDL support (Aleksander Morgado)   
  - Input: xpad - add support for another USB ID of Nacon GC-100 (Michael Cullen)   
  - usb: musb: dsps: Fix the probe error path (Miquel Raynal)   
  - efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock() (Zhang Jianhua)   
  - efi/cper: use stack buffer for error record decoding (Ard Biesheuvel)   
  - cb710: avoid NULL pointer subtraction (Arnd Bergmann)   
  - xhci: Enable trust tx length quirk for Fresco FL11 USB controller (Nikolay Martynov)   
  - xhci: Fix command ring pointer corruption while aborting a command (Pavankumar Kondeti)   
  - btrfs: check for error when looking up inode during dir entry replay (Filipe Manana)   
  - btrfs: deal with errors when adding inode reference during log replay (Filipe Manana)   
  - btrfs: deal with errors when replaying dir entry during log replay (Filipe Manana)   
  - s390: fix strrchr() implementation (Roberto Sassu)   
  - ALSA: seq: Fix a potential UAF by wrong private_free call order (Takashi Iwai)   
  - stable: clamp SUBLEVEL in 4.14 (Sasha Levin)   
  - Linux 4.14.251 (Greg Kroah-Hartman)   
  - sched: Always inline is_percpu_thread() (Peter Zijlstra)   
  - perf/x86: Reset destroy callback on event init failure (Anand K Mistry)   
  - scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" (Colin Ian King)   
  - scsi: ses: Fix unsigned comparison with less than zero (Jiapeng Chong)   
  - net: sun: SUNVNET_COMMON should depend on INET (Randy Dunlap)   
  - m68k: Handle arrivals of multiple signals correctly (Al Viro)   
  - mac80211: Drop frames from invalid MAC address in ad-hoc mode (YueHaibing)   
  - netfilter: ip6_tables: zero-initialize fragment offset (Jeremy Sowden)   
  - HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS (Mizuho Mori)   
  - net: phy: bcm7xxx: Fixed indirect MMD operations (Florian Fainelli)   
  - i2c: acpi: fix resource leak in reconfiguration device addition (Jamie Iles)   
  - i40e: fix endless loop under rtnl (Jiri Benc)   
  - rtnetlink: fix if_nlmsg_stats_size() under estimation (Eric Dumazet)   
  - drm/nouveau/debugfs: fix file release memory leak (Yang Yingliang)   
  - netlink: annotate data races around nlk->bound (Eric Dumazet)   
  - net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size() (Eric Dumazet)   
  - ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence (Oleksij Rempel)   
  - ptp_pch: Load module automatically if ID matches (Andy Shevchenko)   
  - powerpc/fsl/dts: Fix phy-connection-type for fm1mac3 (Pali Rohár)   
  - net_sched: fix NULL deref in fifo_set_limit() (Eric Dumazet)   
  - phy: mdio: fix memory leak (Pavel Skripkin)   
  - bpf: Fix integer overflow in prealloc_elems_and_freelist() (Tatsuhiko Yasumatsu)   
  - xtensa: call irqchip_init only when CONFIG_USE_OF is selected (Max Filippov)   
  - bpf, mips: Validate conditional branch offsets (Piotr Krysiuk)   
  - bpf: add also cbpf long jump test cases with heavy expansion (Daniel Borkmann)   
  - ARM: dts: qcom: apq8064: use compatible which contains chipid (David Heidelberg)   
  - ARM: dts: omap3430-sdp: Fix NAND device node (Roger Quadros)   
  - xen/balloon: fix cancelled balloon action (Juergen Gross)   
  - nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero (Trond Myklebust)   
  - ovl: fix missing negative dentry check in ovl_rename() (Zheng Liang)   
  - USB: cdc-acm: fix break reporting (Johan Hovold)   
  - USB: cdc-acm: fix racy tty buffer accesses (Johan Hovold)   
  - Partially revert "usb: Kconfig: using select for USB_COMMON dependency" (Ben Hutchings)   
  - Linux 4.14.250 (Greg Kroah-Hartman)   
  - libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD. (Kate Hsuan)   
  - scsi: ses: Retry failed Send/Receive Diagnostic commands (Wen Xiong)   
  - usb: dwc2: check return value after calling platform_get_resource() (Yang Yingliang)   
  - usb: testusb: Fix for showing the connection speed (Faizel K B)   
  - scsi: sd: Free scsi_disk device via put_device() (Ming Lei)   
  - ext2: fix sleeping in atomic bugs on error (Dan Carpenter)   
  - sparc64: fix pci_iounmap() when CONFIG_PCI is not set (Linus Torvalds)   
  - xen-netback: correct success/error reporting for the SKB-with-fraglist case (Jan Beulich)   
  - net: mdio: introduce a shutdown method to mdio device drivers (Vladimir Oltean)


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.510.3.el7uek]
changelog:
  - uek-rpm: Pensando: Enable CONFIG_DM_CRYPT=y (Dave Kleikamp)  [Orabug: 33585517]  
  - kernfs: don't create a negative dentry if inactive node exists (Ian Kent)  [Orabug: 33548754]  
  - kernfs: also call kernfs_set_rev() for positive dentry (Hou Tao)  [Orabug: 33548754]  
  - kernfs: use simple_xattrs for security attributes (Ondrej Mosnacek)  [Orabug: 33548754]  
  - kernfs: dont call d_splice_alias() under kernfs node lock (Ian Kent)  [Orabug: 33548754]  
  - kernfs: use i_lock to protect concurrent inode updates (Ian Kent)  [Orabug: 33548754]  
  - kernfs: switch kernfs to use an rwsem (Ian Kent)  [Orabug: 33548754]  
  - kernfs: use VFS negative dentry caching (Ian Kent)  [Orabug: 33548754]  
  - kernfs: add a revision to identify directory node changes (Ian Kent)  [Orabug: 33548754]  
  - selftests: breakpoints: fix compile error on breakpoint_test_arm64 (Sumit Semwal)  [Orabug: 33577681]  
  - Revert "net/rds: Allocate pages on HCA NUMA nodeid" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "net/rds: Allocate rds_ib_{incoming,frag}_slab on HCA NUMA nodeid" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "net/rds: Use the same vector for send & receive" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "net/rds: Get rid of tasklets" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "net/rds: Put more CPU cores to work" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "net/rds: Make workers use the designated CPU" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "net/rds: Use the preferred_cpu in rds_queue_{,delayed}_work" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "net/rds: Fix "rds_ib_init" initialization order" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "net/mlx5: Fix MLX5_EQ_VEC_COMP_BASE usage" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "net/mlx5: Add new verb "ib_get_vector_irqn"" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "net/rds: Add "preferred_cpu" option to "rds_rdma.ko"" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "net/rds: Follow the observed CQ CPU affinity" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "net/rds: Throttle check for CQ CPU affinity" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "net/rds: Bring tasklets back for better latency" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "IB/mlx4: Implement backend callback for "ib_get_vector_irqn"" (Gerd Rausch)  [Orabug: 33561326]  
  - Revert "bnxt_en: Remove the setting of dev_port." (John Sobecki)  [Orabug: 33553100]  
  - xfs: punch out data fork delalloc blocks on COW writeback failure (Brian Foster)  [Orabug: 33542386]  
  - xfs: fix reflink source file racing with directio writes (Darrick J. Wong)  [Orabug: 33542386]  
  - xfs: split up the xfs_reflink_end_cow work into smaller transactions (Darrick J. Wong)  [Orabug: 33542386]  
  - xfs: flush removing page cache in xfs_reflink_remap_prep (Dave Chinner)  [Orabug: 33542386]  
  - xfs: fix shared extent data corruption due to missing cow reservation (Brian Foster)  [Orabug: 33542386]  
  - xfs: fix pagecache truncation prior to reflink (Darrick J. Wong)  [Orabug: 33542386]  
  - xfs: fix fork selection in xfs_find_trim_cow_extent (Christoph Hellwig)  [Orabug: 33542386]  
  - xfs: remove the unused trimmed argument from xfs_reflink_trim_around_shared (Christoph Hellwig)  [Orabug: 33542386]  
  - xfs: skip delalloc COW blocks in xfs_reflink_end_cow (Christoph Hellwig)  [Orabug: 33542386]  
  - xfs: fix transaction leak in xfs_reflink_allocate_cow() (Dave Chinner)  [Orabug: 33542386]  
  - xfs: cow unwritten conversion uses uninitialized dfops (Brian Foster)  [Orabug: 33542386]  
  - xfs: fix double ijoin in xfs_reflink_clear_inode_flag() (Dave Chinner)  [Orabug: 33542386]  
  - xfs: fix double ijoin in xfs_reflink_cancel_cow_range (Dave Chinner)  [Orabug: 33542386]  
  - xfs: minor cleanup for xfs_reflink_end_cow (Christoph Hellwig)  [Orabug: 33542386]  
  - xfs: fix transaction allocation deadlock in IO path (Dave Chinner)  [Orabug: 33542386]  
  - scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma() (Dexuan Cui)  [Orabug: 33548143]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.510.4.1.el7uek]
changelog:
  - rds/ib: Use both iova and key in free_mr socket call (aru kolappan)  [Orabug: 33670990]  
  - take care multiple extents in CoW extent converting (Wengang Wang)  [Orabug: 33647290]


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.510.5.el7uek]
changelog:
  - net/rds: RDS connection shutdown stuck after CQ access violation error (aru kolappan)  [Orabug: 33585476]  
  - ocfs2: fix race between searching chunks and release journal_head from buffer_head (Gautham Ananthakrishna)  [Orabug: 33501677]  
  - rds: ib: Ack seq not always received in monotonic increasing order (Håkon Bugge)  [Orabug: 33620419]  
  - net/rds: Refactor rds_ib_recv_refill_one (Freddy Carrillo)  [Orabug: 33265955]  
  - arm64: pcie: Intercept Pensando specific SError (Henry Willard)  [Orabug: 33590080]  
  - arm64: pcie: Change bad_mode hook to cap_pciep_access_in_progress() (Henry Willard)  [Orabug: 33590080]  
  - arm64: pcie: Remove Pensando SError trapping patch (Henry Willard)  [Orabug: 33590080]  
  - take care multiple extents in CoW extent converting (Wengang Wang)  [Orabug: 33473949]  
  - net/mlx5e: ethtool, Add support for EEPROM high pages query (Erez Alfasi)  [Orabug: 33525560]  
  - ethtool: Add SFF-8436 and SFF-8636 max EEPROM length definitions (Erez Alfasi)  [Orabug: 33525560]  
  - net/mlx5: Remove unnecessary prints from mlx5_enter_error_state. (Anand Khoje)  [Orabug: 33651549]  
  - uek-rpm: Add _raw_spin_trylock to KABI (John Donnelly)  [Orabug: 33651431]  
  - x86/clear_page: add alternative for clear_page_clzero() (Ankur Arora)  [Orabug: 33651433]  
  - x86/asm: add clzero based page clearing (Ankur Arora)  [Orabug: 33580825]  
  - x86/cpu/amd: enable X86_FEATURE_NT_GOOD on all AMD Zen models (Ankur Arora)  [Orabug: 33580825]  
  - x86/cpu/amd: Call init_amd_zn() om Family 19h processors too (Kim Phillips)  [Orabug: 33580825]  
  - cpufreq: intel_pstate: Add Icelake servers support in no-HWP mode (Giovanni Gherdovich)  [Orabug: 33651434]  
  - net/rds: Don't pummel the subnet-manager (Gerd Rausch)  [Orabug: 33651436]  
  - uek-rpm: Add smartpqi driver module in ueknano kernel (Somasundaram Krishnasamy)  [Orabug: 33651437]  
  - rds: ib: Reduce the contention caused by the asynchronous workers to flush the mr pool (Praveen Kumar Kannoju)  [Orabug: 33651440]  
  - net: ipv6: Discard next-hop MTU less than minimum link MTU (Georg Kohmann)  [Orabug: 33651444]  
  - RDMA/rxe: Bump up default maximum values used via uverbs (Rao Shoaib)  [Orabug: 33651442]


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.510.5.1.el7uek]
changelog:
  - fget: check that the fd still exists after getting a ref to it (Linus Torvalds)  [Orabug: 33679805]  {CVE-2021-0920} 
  - fs: add fget_many() and fput_many() (Jens Axboe)  [Orabug: 33679805]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.510.5.2.el7uek]
changelog:
  - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong)  [Orabug: 33722441]  {CVE-2021-4155}


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.510.5.3.el7uek]
changelog:
  - panic: reinitialize logbuf locks before notifiers (Stephen Brennan)  [Orabug: 33703438]  
  - panic: disable optimistic spin after halting CPUs (Stephen Brennan)  [Orabug: 33703438]


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.510.5.4.el7uek]
changelog:
  - net: macsec: Severe performance regression in "...preserve ordering" (Venkat Venkatsubra)  [Orabug: 33771165]


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.510.5.5.el7uek]
changelog:
  - xfs: force the log offline when log intent item recovery fails (Darrick J. Wong)  [Orabug: 33757273]  
  - xfs: cancel intents immediately if process_intents fails (Darrick J. Wong)  [Orabug: 33757273]  
  - x86/vector: search CPU vector starts from last successfully assigned (Joe Jin)  [Orabug: 33290504]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.510.5.6.el7uek]
changelog:
  - ocfs2: fix data corruption on truncate (Jan Kara)  [Orabug: 33886144]  
  - ocfs2: fix data corruption after conversion from inline format (Jan Kara)  [Orabug: 33886144]


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.511.0.el7uek]
changelog:
  - Linux 4.14.253 (Greg Kroah-Hartman)   
  - ASoC: DAPM: Cover regression by kctl change notification fix (Takashi Iwai)   
  - ARM: 9122/1: select HAVE_FUTEX_CMPXCHG (Nick Desaulniers)   
  - tracing: Have all levels of checks prevent recursion (Steven Rostedt (VMware))   
  - net: mdiobus: Fix memory leak in __mdiobus_register (Yanfei Xu)   
  - ALSA: hda: avoid write to STATESTS if controller is in reset (Kai Vehmanen)   
  - platform/x86: intel_scu_ipc: Update timeout value in comment (Prashant Malani)   
  - isdn: mISDN: Fix sleeping function called from invalid context (Zheyu Ma)   
  - ARM: dts: spear3xx: Fix gmac node (Herve Codina)   
  - net: stmmac: add support for dwmac 3.40a (Herve Codina)   
  - btrfs: deal with errors when checking if a dir entry exists during log replay (Filipe Manana)   
  - netfilter: Kconfig: use 'default y' instead of 'm' for bool config option (Vegard Nossum)   
  - isdn: cpai: check ctr->cnr to avoid array index out of bound (Xiaolong Huang)   
  - nfc: nci: fix the UAF of rf_conn_info object (Lin Ma)   
  - ASoC: DAPM: Fix missing kctl change notifications (Takashi Iwai)   
  - ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset (Brendan Grieve)   
  - vfs: check fd has read access in kernel_read_file_from_fd() (Matthew Wilcox (Oracle))   
  - elfcore: correct reference to CONFIG_UML (Lukas Bulwahn)   
  - ocfs2: mount fails with buffer overflow in strlen (Valentin Vidic)   
  - ocfs2: fix data corruption after conversion from inline format (Jan Kara)   
  - can: peak_pci: peak_pci_remove(): fix UAF (Zheyu Ma)   
  - can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification (Stephane Grosjean)   
  - can: rcar_can: fix suspend/resume (Yoshihiro Shimoda)   
  - NIOS2: irqflags: rename a redefined register name (Randy Dunlap)   
  - netfilter: ipvs: make global sysctl readonly in non-init netns (Antoine Tenart)   
  - NFSD: Keep existing listeners on portlist error (Benjamin Coddington)   
  - xtensa: xtfpga: Try software restart before simulating CPU reset (Guenter Roeck)   
  - xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF (Max Filippov)   
  - ARM: dts: at91: sama5d2_som1_ek: disable ISC node by default (Eugen Hristev)   
  - uek-rpm: Add _raw_spin_trylock to KABI (John Donnelly)  [Orabug: 33557961]  
  - cpufreq: intel_pstate: Add Icelake servers support in no-HWP mode (Giovanni Gherdovich)  [Orabug: 33581183]  
  - RDMA/rxe: Bump up default maximum values used via uverbs (Rao Shoaib)  [Orabug: 33615343]  
  - net: ipv6: Discard next-hop MTU less than minimum link MTU (Georg Kohmann)  [Orabug: 33615357]  
  - rds: ib: Reduce the contention caused by the asynchronous workers to flush the mr pool (Praveen Kumar Kannoju)  [Orabug: 33611440]  
  - net/mlx5: Remove unnecessary prints from mlx5_enter_error_state. (Anand Khoje)  [Orabug: 33175315]  
  - net/rds: Don't pummel the subnet-manager (Gerd Rausch)  [Orabug: 33589568]  
  - x86/clear_page: add alternative for clear_page_clzero() (Ankur Arora)  [Orabug: 33580825]  
  - x86/asm: add clzero based page clearing (Ankur Arora)  [Orabug: 33580825]  
  - x86/cpu/amd: enable X86_FEATURE_NT_GOOD on all AMD Zen models (Ankur Arora)  [Orabug: 33580825]  
  - x86/cpu/amd: Call init_amd_zn() om Family 19h processors too (Kim Phillips)  [Orabug: 33580825]  
  - uek-rpm: Add smartpqi driver module in ueknano kernel (Somasundaram Krishnasamy)  [Orabug: 33590163]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.511.1.el7uek]
changelog:
  - uek-rpm: Update ol7 locklist with fnic symbols (Saeed Mirzamohammadi)  [Orabug: 33590914]  
  - mm, oom: dump stack of victim when reaping failed (David Rientjes)  [Orabug: 33647102]  
  - memcg: prohibit unconditional exceeding the limit of dying tasks (Vasily Averin)  [Orabug: 33647102]  
  - memcg: enable memcg oom-kill for __GFP_NOFAIL (Shakeel Butt)  [Orabug: 33647102]  
  - memcg, oom: no oom-kill for __GFP_RETRY_MAYFAIL (Shakeel Butt)  [Orabug: 33647102]  
  - memcg: killed threads should not invoke memcg OOM killer (Tetsuo Handa)  [Orabug: 33647102]  
  - memcg, oom: notify on oom killer invocation from the charge path (Michal Hocko)  [Orabug: 33647102]  
  - mm: memcontrol: print proper OOM header when no eligible victim left (Johannes Weiner)  [Orabug: 33647102]  
  - memcg, oom: move out_of_memory back to the charge path (Michal Hocko)  [Orabug: 33647102]  
  - rds/ib: Use both iova and key in free_mr socket call (aru kolappan)  [Orabug: 33671340]  
  - arm64: kexec: Suppress kexec on embedded systems (smartnics) (Henry Willard)  [Orabug: 33699776]  
  - fget: check that the fd still exists after getting a ref to it (Linus Torvalds)  [Orabug: 33679805]  {CVE-2021-0920} 
  - fs: add fget_many() and fput_many() (Jens Axboe)  [Orabug: 33679805]  
  - xfs: remove all COW fork extents when remounting readonly (Darrick J. Wong)  [Orabug: 33676191]  
  - RDS/IB: Fix error when trying to unallocate ring buffers (Hans Westgaard Ry)  [Orabug: 33620350]  
  - net: macsec: Severe performance regression in "...preserve ordering" (Venkat Venkatsubra)  [Orabug: 33557957]  
  - Linux 4.14.256 (Greg Kroah-Hartman)   
  - soc/tegra: pmc: Fix imbalanced clock disabling in error code path (Dmitry Osipenko)   
  - usb: max-3421: Use driver data instead of maintaining a list of bound devices (Uwe Kleine-König)   
  - RDMA/netlink: Add __maybe_unused to static inline in C file (Leon Romanovsky)   
  - batman-adv: Don't always reallocate the fragmentation skb head (Sven Eckelmann)   
  - batman-adv: Reserve needed_*room for fragments (Sven Eckelmann)   
  - batman-adv: Consider fragmentation for needed_headroom (Sven Eckelmann)   
  - batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh (Linus Lüssing)   
  - batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN (Linus Lüssing)   
  - perf/core: Avoid put_page() when GUP fails (Greg Thelen)   
  - drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors (hongao)   
  - drm/udl: fix control-message timeout (Johan Hovold)   
  - cfg80211: call cfg80211_stop_ap when switch from P2P_GO type (Nguyen Dinh Phi)   
  - parisc/sticon: fix reverse colors (Sven Schnelle)   
  - btrfs: fix memory ordering between normal and ordered work functions (Nikolay Borisov)   
  - mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag (Rustam Kovhaev)   
  - hexagon: export raw I/O routines for modules (Nathan Chancellor)   
  - tun: fix bonding active backup with arp monitoring (Nicolas Dichtel)   
  - perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server (Alexander Antonov)   
  - perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server (Alexander Antonov)   
  - NFC: reorder the logic in nfc_{un,}register_device (Lin Ma)   
  - NFC: reorganize the functions in nci_request (Lin Ma)   
  - i40e: Fix NULL ptr dereference on VSI filter sync (Michal Maloszewski)   
  - net: virtio_net_hdr_to_skb: count transport header in UFO (Jonathan Davies)   
  - platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()' (Christophe JAILLET)   
  - mips: lantiq: add support for clk_get_parent() (Randy Dunlap)   
  - mips: bcm63xx: add support for clk_get_parent() (Randy Dunlap)   
  - MIPS: generic/yamon-dt: fix uninitialized variable error (Colin Ian King)   
  - iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset (Surabhi Boob)   
  - net: bnx2x: fix variable dereferenced before check (Pavel Skripkin)   
  - sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() (Vincent Donnefort)   
  - mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set (Randy Dunlap)   
  - sh: define __BIG_ENDIAN for math-emu (Randy Dunlap)   
  - sh: fix kconfig unmet dependency warning for FRAME_POINTER (Randy Dunlap)   
  - maple: fix wrong return value of maple_bus_init(). (Lu Wei)   
  - sh: check return code of request_irq (Nick Desaulniers)   
  - powerpc/dcr: Use cmplwi instead of 3-argument cmpli (Michael Ellerman)   
  - ALSA: gus: fix null pointer dereference on pointer block (Chengfeng Ye)   
  - powerpc/5200: dts: fix memory node unit name (Anatolij Gustschin)   
  - scsi: target: Fix alua_tg_pt_gps_count tracking (Mike Christie)   
  - scsi: target: Fix ordered tag handling (Mike Christie)   
  - MIPS: sni: Fix the build (Bart Van Assche)   
  - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Guanghui Feng)   
  - usb: host: ohci-tmio: check return value after calling platform_get_resource() (Yang Yingliang)   
  - ARM: dts: omap: fix gpmc,mux-add-data type (Roger Quadros)   
  - scsi: advansys: Fix kernel pointer leak (Guo Zhi)   
  - usb: musb: tusb6010: check return value after calling platform_get_resource() (Yang Yingliang)   
  - scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() (James Smart)   
  - arm64: zynqmp: Fix serial compatible string (Michal Simek)   
  - PCI/MSI: Destroy sysfs before freeing entries (Thomas Gleixner)   
  - parisc/entry: fix trace test in syscall exit path (Sven Schnelle)   
  - tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT (Paul Burton)   
  - ext4: fix lazy initialization next schedule time computation in more granular unit (Shaoying Xu)   
  - PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros (Pali Rohár)   
  - s390/cio: check the subchannel validity for dev_busid (Vineeth Vijayan)   
  - mm, oom: do not trigger out_of_memory from the #PF (Michal Hocko)   
  - mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks (Vasily Averin)   
  - powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 (Naveen N. Rao)   
  - powerpc/bpf: Validate branch ranges (Naveen N. Rao)   
  - powerpc/lib: Add helper to check if offset is within conditional branch range (Naveen N. Rao)   
  - ARM: 9156/1: drop cc-option fallbacks for architecture selection (Arnd Bergmann)   
  - ARM: 9155/1: fix early early_iounmap() (Michał Mirosław)   
  - USB: chipidea: fix interrupt deadlock (Johan Hovold)   
  - vsock: prevent unnecessary refcnt inc for nonblocking connect (Eiichi Tsukata)   
  - nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails (Chengfeng Ye)   
  - llc: fix out-of-bound array index in llc_sk_dev_hash() (Eric Dumazet)   
  - mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration() (Miaohe Lin)   
  - bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed (Huang Guobin)   
  - ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses (Hans de Goede)   
  - net: davinci_emac: Fix interrupt pacing disable (Maxim Kiselev)   
  - xen-pciback: Fix return in pm_ctrl_init() (YueHaibing)   
  - i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()' (Christophe JAILLET)   
  - scsi: qla2xxx: Turn off target reset during issue_lip (Quinn Tran)   
  - ar7: fix kernel builds for compiler test (Jackie Liu)   
  - watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT (Ahmad Fatoum)   
  - m68k: set a default value for MEMORY_RESERVE (Randy Dunlap)   
  - dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result` (Lars-Peter Clausen)   
  - netfilter: nfnetlink_queue: fix OOB when mac header was cleared (Florian Westphal)   
  - auxdisplay: ht16k33: Fix frame buffer device blanking (Geert Uytterhoeven)   
  - auxdisplay: ht16k33: Connect backlight to fbdev (Geert Uytterhoeven)   
  - auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string (Geert Uytterhoeven)   
  - dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro (Claudiu Beznea)   
  - mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() (Evgeny Novikov)   
  - fs: orangefs: fix error return code of orangefs_revalidate_lookup() (Jia-Ju Bai)   
  - NFS: Fix deadlocks in nfs_scan_commit_list() (Trond Myklebust)   
  - PCI: aardvark: Don't spam about PIO Response Status (Marek Behún)   
  - drm/plane-helper: fix uninitialized variable reference (Alex Xu (Hello71))   
  - pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds (Baptiste Lepers)   
  - rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined (Arnaud Pouliquen)   
  - apparmor: fix error check (Tom Rix)   
  - power: supply: bq27xxx: Fix kernel crash on IRQ handler register error (Hans de Goede)   
  - mips: cm: Convert to bitfield API to fix out-of-bounds access (Geert Uytterhoeven)   
  - serial: xilinx_uartps: Fix race condition causing stuck TX (Anssi Hannula)   
  - ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER (Richard Fitzgerald)   
  - ASoC: cs42l42: Correct some register default values (Richard Fitzgerald)   
  - RDMA/mlx4: Return missed an error if device doesn't support steering (Leon Romanovsky)   
  - scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() (Dan Carpenter)   
  - power: supply: rt5033_battery: Change voltage values to µV (Jakob Hauser)   
  - usb: gadget: hid: fix error code in do_config() (Dan Carpenter)   
  - serial: 8250_dw: Drop wrong use of ACPI_PTR() (Andy Shevchenko)   
  - video: fbdev: chipsfb: use memset_io() instead of memset() (Christophe Leroy)   
  - memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe (Dongliang Mu)   
  - soc/tegra: Fix an error handling path in tegra_powergate_power_up() (Christophe JAILLET)   
  - arm: dts: omap3-gta04a4: accelerometer irq fix (Andreas Kemnade)   
  - ALSA: hda: Reduce udelay() at SKL+ position reporting (Takashi Iwai)   
  - JFS: fix memleak in jfs_mount (Dongliang Mu)   
  - MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT (Jackie Liu)   
  - scsi: dc395: Fix error case unwinding (Tong Zhang)   
  - ARM: dts: at91: tse850: the emac<->phy interface is rmii (Peter Rosin)   
  - ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc() (Jackie Liu)   
  - RDMA/rxe: Fix wrong port_cap_flags (Junji Wei)   
  - ibmvnic: Process crqs after enabling interrupts (Sukadev Bhattiprolu)   
  - crypto: pcrypt - Delay write to padata->info (Daniel Jordan)   
  - net: phylink: avoid mvneta warning when setting pause parameters (Russell King (Oracle))   
  - net: amd-xgbe: Toggle PLL settings during rate change (Shyam Sundar S K)   
  - libertas: Fix possible memory leak in probe and disconnect (Wang Hai)   
  - libertas_tf: Fix possible memory leak in probe and disconnect (Wang Hai)   
  - samples/kretprobes: Fix return value if register_kretprobe() failed (Tiezhu Yang)   
  - irq: mips: avoid nested irq_enter() (Mark Rutland)   
  - s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap() (David Hildenbrand)   
  - smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi (Tetsuo Handa)   
  - PM: hibernate: fix sparse warnings (Anders Roxell)   
  - phy: micrel: ksz8041nl: do not use power down mode (Stefan Agner)   
  - mwifiex: Send DELBA requests according to spec (Jonas Dreßler)   
  - platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning (Nathan Chancellor)   
  - mmc: mxs-mmc: disable regulator on error and in the remove function (Christophe JAILLET)   
  - net: stream: don't purge sk_error_queue in sk_stream_kill_queues() (Jakub Kicinski)   
  - drm/msm: uninitialized variable in msm_gem_import() (Dan Carpenter)   
  - ath10k: fix max antenna gain unit (Sven Eckelmann)   
  - hwmon: Fix possible memleak in __hwmon_device_register() (Yang Yingliang)   
  - memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() (Dan Carpenter)   
  - memstick: avoid out-of-range warning (Arnd Bergmann)   
  - b43: fix a lower bounds test (Dan Carpenter)   
  - b43legacy: fix a lower bounds test (Dan Carpenter)   
  - hwrng: mtk - Force runtime pm ops for sleep ops (Markus Schneider-Pargmann)   
  - crypto: qat - disregard spurious PFVF interrupts (Giovanni Cabiddu)   
  - crypto: qat - detect PFVF collision after ACK (Giovanni Cabiddu)   
  - ath9k: Fix potential interrupt storm on queue reset (Linus Lüssing)   
  - cpuidle: Fix kobject memory leaks in error paths (Anel Orazgaliyeva)   
  - media: cx23885: Fix snd_card_free call on null card pointer (Colin Ian King)   
  - media: si470x: Avoid card name truncation (Kees Cook)   
  - media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()' (Christophe JAILLET)   
  - media: dvb-usb: fix ununit-value in az6027_rc_query (Pavel Skripkin)   
  - cgroup: Make rebind_subsystems() disable v2 controllers all at once (Waiman Long)   
  - parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling (Sven Schnelle)   
  - task_stack: Fix end_of_stack() for architectures with upwards-growing stack (Helge Deller)   
  - parisc: fix warning in flush_tlb_all (Sven Schnelle)   
  - spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() (Yang Yingliang)   
  - ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 (Arnd Bergmann)   
  - gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE (Stephen Suryaputra)   
  - ARM: clang: Do not rely on lr register for stacktrace (Masami Hiramatsu)   
  - smackfs: use __GFP_NOFAIL for smk_cipso_doi() (Tetsuo Handa)   
  - iwlwifi: mvm: disable RX-diversity in powersave (Johannes Berg)   
  - PM: hibernate: Get block device exclusively in swsusp_check() (Ye Bin)   
  - mwl8k: Fix use-after-free in mwl8k_fw_state_machine() (Zheyu Ma)   
  - tracing/cfi: Fix cmp_entries_* functions signature mismatch (Kalesh Singh)   
  - lib/xz: Validate the value before assigning it to an enum variable (Lasse Collin)   
  - lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression (Lasse Collin)   
  - memstick: r592: Fix a UAF bug when removing the driver (Zheyu Ma)   
  - leaking_addresses: Always print a trailing newline (Kees Cook)   
  - ACPI: battery: Accept charges over the design capacity as full (André Almeida)   
  - ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() (Tuo Li)   
  - tracefs: Have tracefs directories not set OTH permission bits by default (Steven Rostedt (VMware))   
  - media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() (Anant Thazhemadam)   
  - ACPICA: Avoid evaluating methods too early during system resume (Rafael J. Wysocki)   
  - ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK (Randy Dunlap)   
  - media: mceusb: return without resubmitting URB in case of -EPROTO error. (Rajat Asthana)   
  - media: s5p-mfc: Add checking to s5p_mfc_probe(). (Nadezda Lutovinova)   
  - media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() (Tuo Li)   
  - media: uvcvideo: Set capability in s_param (Ricardo Ribalda)   
  - media: netup_unidvb: handle interrupt properly according to the firmware (Zheyu Ma)   
  - media: mt9p031: Fix corrupted frame after restarting stream (Dirk Bender)   
  - mwifiex: Properly initialize private structure on interface type changes (Jonas Dreßler)   
  - mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type (Jonas Dreßler)   
  - x86: Increase exception stack sizes (Peter Zijlstra)   
  - smackfs: Fix use-after-free in netlbl_catmap_walk() (Pawan Gupta)   
  - locking/lockdep: Avoid RCU-induced noinstr fail (Peter Zijlstra)   
  - MIPS: lantiq: dma: reset correct number of channel (Aleksander Jan Bajkowski)   
  - MIPS: lantiq: dma: add small delay after reset (Aleksander Jan Bajkowski)   
  - platform/x86: wmi: do not fail if disabling fails (Barnabás Pőcze)   
  - Bluetooth: fix use-after-free error in lock_sock_nested() (Wang ShaoBo)   
  - Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() (Takashi Iwai)   {CVE-2021-3640} 
  - USB: iowarrior: fix control-message timeouts (Johan Hovold)   
  - USB: serial: keyspan: fix memleak on probe errors (Wang Hai)   
  - iio: dac: ad5446: Fix ad5622_write() return value (Pekka Korpinen)   
  - pinctrl: core: fix possible memory leak in pinctrl_enable() (Yang Yingliang)   
  - quota: correct error number in free_dqentry() (Zhang Yi)   
  - quota: check block number when reading the block in quota file (Zhang Yi)   
  - PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG (Marek Behún)   
  - PCI: aardvark: Fix return value of MSI domain .alloc() method (Marek Behún)   
  - PCI: aardvark: Do not unmask unused interrupts (Pali Rohár)   
  - PCI: aardvark: Do not clear status bits of masked interrupts (Pali Rohár)   
  - xen/balloon: add late_initcall_sync() for initial ballooning done (Juergen Gross)   
  - ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume (Pavel Skripkin)   
  - ALSA: mixer: oss: Fix racy access to slots (Takashi Iwai)   
  - serial: core: Fix initializing and restoring termios speed (Pali Rohár)   
  - powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found (Xiaoming Ni)   
  - power: supply: max17042_battery: use VFSOC for capacity when no rsns (Henrik Grimler)   
  - power: supply: max17042_battery: Prevent int underflow in set_soc_threshold (Sebastian Krzyszkowiak)   
  - signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT (Eric W. Biederman)   
  - signal: Remove the bogus sigkill_pending in ptrace_stop (Eric W. Biederman)   
  - RDMA/qedr: Fix NULL deref for query_qp on the GSI QP (Alok Prasad)   
  - wcn36xx: handle connection loss indication (Benjamin Li)   
  - libata: fix checking of DMA state (Reimar Döffinger)   
  - mwifiex: Read a PCI register after writing the TX ring write pointer (Jonas Dreßler)   
  - wcn36xx: Fix HT40 capability for 2Ghz band (Loic Poulain)   
  - evm: mark evm_fixmode as __ro_after_init (Austin Kim)   
  - rtl8187: fix control-message timeouts (Johan Hovold)   
  - PCI: Mark Atheros QCA6174 to avoid bus reset (Ingmar Klein)   
  - ath10k: fix division by zero in send path (Johan Hovold)   
  - ath10k: fix control-message timeout (Johan Hovold)   
  - ath6kl: fix control-message timeout (Johan Hovold)   
  - ath6kl: fix division by zero in send path (Johan Hovold)   
  - mwifiex: fix division by zero in fw download path (Johan Hovold)   
  - EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell (Eric Badger)   
  - regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property (Krzysztof Kozlowski)   
  - regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled (Krzysztof Kozlowski)   
  - hwmon: (pmbus/lm25066) Add offset coefficients (Zev Weiss)   
  - btrfs: fix lost error handling when replaying directory deletes (Filipe Manana)   
  - vmxnet3: do not stop tx queues after netif_device_detach() (Dongli Zhang)   
  - watchdog: Fix OMAP watchdog early handling (Walter Stoll)   
  - spi: spl022: fix Microwire full duplex mode (Thomas Perrot)   
  - bpf: Prevent increasing bpf_jit_limit above max (Lorenz Bauer)   
  - mmc: winbond: don't build on M68K (Randy Dunlap)   
  - hyperv/vmbus: include linux/bitops.h (Arnd Bergmann)   
  - sfc: Don't use netif_info before net_device setup (Erik Ekman)   
  - cavium: Fix return values of the probe function (Zheyu Ma)   
  - scsi: qla2xxx: Fix unmap of already freed sgl (Dmitry Bogdanov)   
  - cavium: Return negative value when pci_alloc_irq_vectors() fails (Zheyu Ma)   
  - x86/irq: Ensure PI wakeup handler is unregistered before module unload (Sean Christopherson)   
  - ALSA: timer: Unconditionally unlink slave instances, too (Takashi Iwai)   
  - ALSA: timer: Fix use-after-free problem (Wang Wensheng)   
  - ALSA: synth: missing check for possible NULL after the call to kstrdup (Austin Kim)   
  - ALSA: line6: fix control and interrupt message timeouts (Johan Hovold)   
  - ALSA: 6fire: fix control and bulk message timeouts (Johan Hovold)   
  - ALSA: ua101: fix division by zero at probe (Johan Hovold)   
  - media: ite-cir: IR receiver stop working after receive overflow (Sean Young)   
  - tpm: Check for integer overflow in tpm2_map_response_body() (Dan Carpenter)   
  - parisc: Fix ptrace check on syscall return (Helge Deller)   
  - mmc: dw_mmc: Dont wait for DRTO on Write RSP error (Christian Löhle)   
  - ocfs2: fix data corruption on truncate (Jan Kara)   
  - libata: fix read log timeout value (Damien Le Moal)   
  - Input: i8042 - Add quirk for Fujitsu Lifebook T725 (Takashi Iwai)   
  - Input: elantench - fix misreporting trackpoint coordinates (Phoenix Huang)   
  - binder: use cred instead of task for selinux checks (Todd Kjos)   
  - binder: use euid from cred instead of using task (Todd Kjos)   
  - xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay (Mathias Nyman)   
  - Linux 4.14.255 (Greg Kroah-Hartman)   
  - rsi: fix control-message timeout (Johan Hovold)   
  - staging: rtl8192u: fix control-message timeouts (Johan Hovold)   
  - staging: r8712u: fix control-message timeout (Johan Hovold)   
  - comedi: vmk80xx: fix bulk and interrupt message timeouts (Johan Hovold)   
  - comedi: vmk80xx: fix bulk-buffer overflow (Johan Hovold)   
  - comedi: vmk80xx: fix transfer-buffer overflows (Johan Hovold)   
  - comedi: ni_usb6501: fix NULL-deref in command paths (Johan Hovold)   
  - comedi: dt9812: fix DMA buffers on stack (Johan Hovold)   
  - isofs: Fix out of bound access for corrupted isofs image (Jan Kara)   
  - printk/console: Allow to disable console output by using console="" or console=null (Petr Mladek)   
  - usb-storage: Add compatibility quirk flags for iODD 2531/2541 (James Buren)   
  - usb: musb: Balance list entry in musb_gadget_queue (Viraj Shah)   
  - usb: gadget: Mark USB_FSL_QE broken on 64-bit (Geert Uytterhoeven)   
  - Revert "x86/kvm: fix vcpu-id indexed array sizes" (Juergen Gross)   
  - block: introduce multi-page bvec helpers (Ming Lei)   
  - IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields (Mike Marciniszyn)   
  - IB/qib: Use struct_size() helper (Gustavo A. R. Silva)   
  - ARM: 9120/1: Revert "amba: make use of -1 IRQs warn" (Wang Kefeng)   
  - arch: pgtable: define MAX_POSSIBLE_PHYSMEM_BITS where needed (Arnd Bergmann)   
  - mm/zsmalloc: Prepare to variable MAX_PHYSMEM_BITS (Kirill A. Shutemov)   
  - media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() (Dan Carpenter)   
  - scsi: core: Put LLD module refcnt after SCSI device is released (Ming Lei)   
  - Linux 4.14.254 (Greg Kroah-Hartman)   
  - sctp: add vtag check in sctp_sf_ootb (Xin Long)   
  - sctp: add vtag check in sctp_sf_do_8_5_1_E_sa (Xin Long)   
  - sctp: add vtag check in sctp_sf_violation (Xin Long)   
  - sctp: fix the processing for COOKIE_ECHO chunk (Xin Long)   
  - sctp: use init_tag from inithdr for ABORT chunk (Xin Long)   
  - net: nxp: lpc_eth.c: avoid hang when bringing interface down (Trevor Woerner)   
  - nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST (Guenter Roeck)   
  - net: batman-adv: fix error handling (Pavel Skripkin)   
  - regmap: Fix possible double-free in regcache_rbtree_exit() (Yang Yingliang)   
  - net: lan78xx: fix division by zero in send path (Johan Hovold)   
  - mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit (Haibo Chen)   
  - mmc: sdhci: Map more voltage level to SDHCI_POWER_330 (Shawn Guo)   
  - mmc: dw_mmc: exynos: fix the finding clock sample value (Jaehoon Chung)   
  - mmc: vub300: fix control-message timeouts (Johan Hovold)   
  - ipv4: use siphash instead of Jenkins in fnhe_hashfun() (Eric Dumazet)   
  - Revert "net: mdiobus: Fix memory leak in __mdiobus_register" (Pavel Skripkin)   
  - nfc: port100: fix using -ERRNO as command type mask (Krzysztof Kozlowski)   
  - ata: sata_mv: Fix the error handling of mv_chip_id() (Zheyu Ma)   
  - usbnet: fix error return code in usbnet_probe() (Wang Hai)   
  - usbnet: sanity check for maxpacket (Oliver Neukum)   
  - ARM: 8819/1: Remove '-p' from LDFLAGS (Nathan Chancellor)   
  - powerpc/bpf: Fix BPF_MOD when imm == 1 (Naveen N. Rao)   
  - ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype (Arnd Bergmann)   
  - ARM: 9134/1: remove duplicate memcpy() definition (Arnd Bergmann)   
  - ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned (Nick Desaulniers)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.511.2.el7uek]
changelog:
  - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong)  [Orabug: 33756155]  {CVE-2021-4155} 
  - net/mlx5e: ethtool, Add support for EEPROM high pages query (Erez Alfasi)  [Orabug: 33755527]  
  - ethtool: Add SFF-8436 and SFF-8636 max EEPROM length definitions (Erez Alfasi)  [Orabug: 33755527]  
  - scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() (George Kennedy)  [Orabug: 33731361]  
  - uek-rpm: configs: disable CONFIG_USB_GADGET (aloktiw)  [Orabug: 33730434]  
  - rds: ib: Incorporate the stat counter "ib_rdma_flush_mr_pool_avoided" in the structure "rds_ib_stat_names" (Praveen Kumar Kannoju)  [Orabug: 33720886]  
  - panic: reinitialize logbuf locks before notifiers (Stephen Brennan)  [Orabug: 33703438]  
  - panic: disable optimistic spin after halting CPUs (Stephen Brennan)  [Orabug: 33703438]  
  - atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait (Zekun Shen)  [Orabug: 33594985]  {CVE-2021-43975} 
  - x86/MCE/AMD, EDAC/mce_amd: Remove struct smca_hwid.xec_bitmap (Yazen Ghannam)  [Orabug: 33427596]  
  - EDAC/mce_amd: Add new error descriptions for existing types (Yazen Ghannam)  [Orabug: 33427596]  
  - x86/mce, EDAC/mce_amd: Print PPIN in machine check records (Smita Koralahalli)  [Orabug: 33427596]  
  - x86/mce/amd, edac: Remove report_gart_errors (Borislav Petkov)  [Orabug: 33427596]  
  - x86/mce/amd: Add PPIN support for AMD MCE (Wei Huang)  [Orabug: 33427596]  
  - x86/mce: Take action on UCNA/Deferred errors again (Jan H. Schönherr)  [Orabug: 33427596]  
  - xen/mcelog: add PPIN to record when available (Jan Beulich)  [Orabug: 33427596]  
  - xen/mcelog: drop __MC_MSR_MCGCAP (Jan Beulich)  [Orabug: 33427596]  
  - x86/MCE/AMD: Don't report L1 BTB MCA errors on some family 17h models (Yazen Ghannam)  [Orabug: 33427596]  
  - x86/MCE: Add an MCE-record filtering function (Yazen Ghannam)  [Orabug: 33427596]  
  - EDAC, mce_amd: Print ExtErrorCode and description on a single line (Yazen Ghannam)  [Orabug: 33427596]  
  - mstflint_access: Update driver code to v4.18.0-1 from Github (Sharath Srinivasan)  [Orabug: 33186485]  
  - mstflint_access: Update driver code to v4.17.0-1 from Github (Sharath Srinivasan)  [Orabug: 33186485]  
  - mstflint_access: Add README.txt (Sharath Srinivasan)  [Orabug: 33186485]  
  - Revert "Revert "net/mlx4_core: Add masking for a few queries on HCA caps"" (Freddy Carrillo)  [Orabug: 32603654]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.511.3.el7uek]
changelog:
  - scsi: vmw_pvscsi: Set residual data length conditionally (Alexey Makhalov)  [Orabug: 33761308]  
  - xfs: force the log offline when log intent item recovery fails (Darrick J. Wong)  [Orabug: 33757273]  
  - xfs: cancel intents immediately if process_intents fails (Darrick J. Wong)  [Orabug: 33757273]  
  - arm64/efi: remove spurious WARN_ON for !4K kernels (Mark Rutland)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Allow use of LPI tables in reserved memory (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Register LPI tables with EFI config table (Marc Zyngier)  [Orabug: 33749641]  
  - efi: add API to reserve memory persistently across kexec reboot (Ard Biesheuvel)  [Orabug: 33749641]  
  - efi/arm: libstub: add a root memreserve config table (Ard Biesheuvel)  [Orabug: 33749641]  
  - efi: honour memory reservations passed via a linux specific config table (Ard Biesheuvel)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Check that all RDs have the same property table (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Use pre-programmed redistributor tables with kdump kernels (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Allow use of pre-programmed LPI tables (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Keep track of property table's PA and VA (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Move pending table allocation to init time (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Split property table clearing from allocation (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Simplify LPI_PENDBASE_SZ usage (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Change initialization ordering for LPIs (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Cap lpi_id_bits to reduce memory footprint (Jia He)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Make its_lock a raw_spin_lock_t (Sebastian Andrzej Siewior)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Honor hypervisor enforced LPI range (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3: Expose GICD_TYPER in the rdist structure (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Drop chunk allocation compatibility (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Move minimum LPI requirements to individual busses (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Use full range of LPIs (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Refactor LPI allocator (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Fix reprogramming of redistributors on CPU hotplug (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Only emit VSYNC if targetting a valid collection (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Only emit SYNC if targetting a valid collection (Marc Zyngier)  [Orabug: 33749641]  
  - irqchip/gic-v3: Ensure GICR_CTLR.EnableLPI=0 is observed before enabling (Shanker Donthineni)  [Orabug: 33749641]  
  - irqchip/gic-v3-its: Pass its_node pointer to each command builder (Marc Zyngier)  [Orabug: 33749641]  
  - tee: handle lookup of shm with reference count 0 (Jens Wiklander)  [Orabug: 33739583]  {CVE-2021-44733} 
  - rds/ib: Kernel change to extend rds-info functionality (Rohit Nair)  [Orabug: 33660978]  
  - net/mlx5: Fix eeprom support for SFP module (Eran Ben Elisha)  [Orabug: 33541468]  
  - x86/vector: search CPU vector starts from last successfully assigned (Joe Jin)  [Orabug: 33290504]


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.511.4.el7uek]
changelog:
  - net/rds: Refactor rds_ib_recv_refill_one (Freddy Carrillo)  [Orabug: 33811840]  
  - net/rds: RDS connection shutdown stuck after CQ access violation error (aru kolappan)  [Orabug: 33811824]  
  - ocfs2: fix race between searching chunks and release journal_head from buffer_head (Gautham Ananthakrishna)  [Orabug: 33811779]  
  - rds: ib: Ack seq not always received in monotonic increasing order (Håkon Bugge)  [Orabug: 33810922]  
  - arm64: pcie: Intercept Pensando specific SError (Henry Willard)  [Orabug: 33811771]  
  - arm64: pcie: Change bad_mode hook to cap_pciep_access_in_progress() (Henry Willard)  [Orabug: 33811771]  
  - arm64: pcie: Remove Pensando SError trapping patch (Henry Willard)  [Orabug: 33811771]  
  - take care multiple extents in CoW extent converting (Wengang Wang)  [Orabug: 33811755]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.511.5.el7uek]
changelog:
  - irq/msi: add extra step when both old and new affinity are not current cpu (Joe Jin)  [Orabug: 33789982]  
  - Revert "rds/ib: Kernel change to extend rds-info functionality" (Rohit Nair)  [Orabug: 33795472]  
  - smp: always continue to process IRQ work (Stephen Brennan)  [Orabug: 33775326]  
  - scsi: libiscsi: Fix iscsi_task use after free() (Mike Christie)  [Orabug: 33674803]  
  - scsi: libiscsi: Drop taskqueuelock (Mike Christie)  [Orabug: 33674803]  
  - netfilter: fix regression in looped (broad|multi)cast's MAC handling (Ignacy Gawędzki)   
  - PM: hibernate: use correct mode for swsusp_close() (Thomas Zeitlhofer)   
  - tracefs: Set all files to the same group ownership as the mount option (Steven Rostedt (VMware))   
  - binder: fix test regression due to sender_euid change (Todd Kjos)   
  - IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() (José Expósito)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.511.5.1.el7uek]
changelog:
  - arm64, mm, efi: Account for GICv3 LPI tables in static memblock reserve table (Ard Biesheuvel)  [Orabug: 33836770]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.511.5.2.el7uek]
changelog:
  - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman)  [Orabug: 33876756]  {CVE-2022-0492} 
  - scsi: libiscsi: Hold back_lock when calling iscsi_complete_task (Gulam Mohamed)  [Orabug: 33876755]


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.511.5.3.el7uek]
changelog:
  - x86/speculation: The choice of retpoline mode is sometimes ignored (Patrick Colp)  [Orabug: 33910224]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-2047.511.5.4.el7uek]
changelog:
  - x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp)  [Orabug: 33922122]  {CVE-2021-26341} 
  - x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp)  [Orabug: 33922122]  {CVE-2021-26341} 
  - x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips)  [Orabug: 33922122]  {CVE-2021-26341} 
  - x86/speculation: Use generic retpoline by default on AMD (Kim Phillips)  [Orabug: 33922122]  {CVE-2021-26341} 
  - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf)  [Orabug: 33922122]  {CVE-2021-26341} 
  - Documentation/hw-vuln: Update spectre doc (Peter Zijlstra)  [Orabug: 33922122]  {CVE-2021-26341} 
  - x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra)  [Orabug: 33922122]  {CVE-2021-26341} 
  - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel))  [Orabug: 33922122]  {CVE-2021-26341} 
  - x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov)  [Orabug: 33922122]  {CVE-2021-26341} 
  - x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp)  [Orabug: 33922122]  {CVE-2021-26341} 
  - x86/speculation: Fix bug in retpoline mode on AMD with `spectre_v2=none` (Patrick Colp)  [Orabug: 33922122]  {CVE-2021-26341} 
  - bpf: Add kconfig knob for disabling unpriv bpf by default (Daniel Borkmann)  [Orabug: 33926438]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-2047.511.5.4.el7uek]
changelog:
  - x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp)  [Orabug: 33922122]  {CVE-2021-26401} 
  - x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp)  [Orabug: 33922122]  {CVE-2021-26401} 
  - x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips)  [Orabug: 33922122]  {CVE-2021-26401} 
  - x86/speculation: Use generic retpoline by default on AMD (Kim Phillips)  [Orabug: 33922122]  {CVE-2021-26401} 
  - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf)  [Orabug: 33922122]  {CVE-2021-26401} 
  - Documentation/hw-vuln: Update spectre doc (Peter Zijlstra)  [Orabug: 33922122]  {CVE-2021-26401} 
  - x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra)  [Orabug: 33922122]  {CVE-2021-26401} 
  - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel))  [Orabug: 33922122]  {CVE-2021-26401} 
  - x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov)  [Orabug: 33922122]  {CVE-2021-26401} 
  - x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp)  [Orabug: 33922122]  {CVE-2021-26401} 
  - x86/speculation: Fix bug in retpoline mode on AMD with `spectre_v2=none` (Patrick Colp)  [Orabug: 33922122]  {CVE-2021-26401} 
  - bpf: Add kconfig knob for disabling unpriv bpf by default (Daniel Borkmann)  [Orabug: 33926438]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.511.5.5.el7uek]
changelog:
  - rds: ib: Make selection of completion_vector QoS aware (Håkon Bugge)  [Orabug: 33937054]  
  - x86/smpboot: check cpu_initialized_mask first after returning from schedule() (Dongli Zhang)  [Orabug: 33937052]  
  - blk-stat: delete useless code (Shaohua Li)  [Orabug: 33937039]  
  - bpf: Disallow unprivileged bpf by default (Pawan Gupta)  [Orabug: 33926438]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.511.5.5.1.el7uek]
changelog:
  - netfilter: nf_tables: initialize registers in nft_do_chain() (Pablo Neira Ayuso)  [Orabug: 34018777]  {CVE-2022-1016}


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.511.5.5.3.el7uek]
changelog:
  - mlx4_core: calculate log_num_mtt based on total system memory (Wei Lin Guay)  [Orabug: 26526968] [Orabug: 34142589]  
  - xen/x86: Add interface for querying amount of host memory (Boris Ostrovsky)  [Orabug: 26526923] [Orabug: 34142589]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.511.5.6.el7uek]
changelog:
  - lib/iov_iter: initialize "flags" in new pipe_buffer (Max Kellermann)  [Orabug: 33942242]  {CVE-2022-0847}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.511.5.8.el7uek]
changelog:
  - netfilter: nf_tables: initialize registers in nft_do_chain() (Pablo Neira Ayuso)  [Orabug: 34048826]  {CVE-2022-1016}


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.512.0.el7uek]
changelog:
  - bpf: Disallow unprivileged bpf by default (Pawan Gupta)  [Orabug: 33734682]  
  - bpf: Add kconfig knob for disabling unpriv bpf by default (Daniel Borkmann)  [Orabug: 33734682]  
  - RDMA/rxe: Use correct sizing on buffers holding page DMA addresses (Shiraz Saleem)  [Orabug: 33676942]  
  - hwmon: (k10temp) Add support for Zen3 CPUs (Rahul Rohit)  [Orabug: 33782835]  
  - arm64, mm, efi: Account for GICv3 LPI tables in static memblock reserve table (Ard Biesheuvel)  [Orabug: 33787546]  
  - uek-rpm: Pensando: Enable Elba EDAC (Dave Kleikamp)  [Orabug: 33831294]  
  - dsc-drivers: update for 1.15.9-C-64 (Dave Kleikamp)  [Orabug: 33831294]  
  - drivers/hwmon: Adding support LTC3888 (David Clear)  [Orabug: 33831294]  
  - drivers/edac: Add Elba EDAC support (David Clear)  [Orabug: 33831294]  
  - arm64/configs: Remove CONFIG_PENSANDO_SOC_CAPMEM_HUGEPAGE (David Clear)  [Orabug: 33831294]  
  - drivers/soc/pensando: Add reset cause driver (David Clear)  [Orabug: 33831294]  
  - net/rds: Fix memory leak in __rds_conn_create() on alloc_ordered_workqueue fail (Freddy Carrillo)  [Orabug: 33811475]  
  - x86/smpboot: check cpu_initialized_mask first after returning from schedule() (Dongli Zhang)  [Orabug: 33544127]  
  - Linux 4.14.259 (Greg Kroah-Hartman)   
  - xen/console: harden hvc_xen against event channel storms (Juergen Gross)   
  - Input: touchscreen - avoid bitwise vs logical OR warning (Nathan Chancellor)   
  - ARM: 8800/1: use choice for kernel unwinders (Stefan Agner)   
  - mwifiex: Remove unnecessary braces from HostCmd_SET_SEQ_NO_BSS_INFO (Nathan Chancellor)   
  - ARM: 8805/2: remove unneeded naked function usage (Nicolas Pitre)   
  - net: lan78xx: Avoid unnecessary self assignment (Nathan Chancellor)   
  - fuse: annotate lock in fuse_reverse_inval_entry() (Miklos Szeredi)   
  - ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name (Fabio Estevam)   
  - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Sudeep Holla)   
  - net: systemport: Add global locking for descriptor lifecycle (Florian Fainelli)   
  - libata: if T_LENGTH is zero, dma direction should be DMA_NONE (George Kennedy)   
  - timekeeping: Really make sure wall_to_monotonic isn't positive (Yu Liao)   
  - USB: serial: option: add Telit FN990 compositions (Daniele Palmas)   
  - PCI/MSI: Mask MSI-X vectors only on success (Stefan Roese)   
  - PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error (Thomas Gleixner)   
  - USB: gadget: bRequestType is a bitfield, not a enum (Greg Kroah-Hartman)   
  - sit: do not call ipip6_dev_free() from sit_init_net() (Eric Dumazet)   
  - net/packet: rx_owner_map depends on pg_vec (Willem de Bruijn)   
  - ixgbe: set X550 MDIO speed before talking to PHY (Cyril Novikov)   
  - igbvf: fix double free in `igbvf_probe` (Letu Ren)   
  - soc/tegra: fuse: Fix bitwise vs. logical OR warning (Nathan Chancellor)   
  - dmaengine: st_fdma: fix MODULE_ALIAS (Alyssa Ross)   
  - ARM: socfpga: dts: fix qspi node compatible (Dinh Nguyen)   
  - x86/sme: Explicitly map new EFI memmap table as encrypted (Tom Lendacky)   
  - nfsd: fix use-after-free due to delegation race (J. Bruce Fields)   
  - audit: improve robustness of the audit queue handling (Paul Moore)   
  - dm btree remove: fix use after free in rebalance_children() (Joe Thornber)   
  - recordmcount.pl: look for jgnop instruction as well as bcrl on s390 (Jerome Marchand)   
  - mac80211: send ADDBA requests using the tid/queue of the aggregation session (Felix Fietkau)   
  - hwmon: (dell-smm) Fix warning on /proc/i8k creation error (Armin Wolf)   
  - bpf: fix panic due to oob in bpf_prog_test_run_skb (Daniel Borkmann)   
  - tracing: Fix a kmemleak false positive in tracing_map (Chen Jun)   
  - net: netlink: af_netlink: Prevent empty skb by adding a check on len. (Harshit Mogalapalli)   
  - i2c: rk3x: Handle a spurious start completion interrupt flag (Ondrej Jirman)   
  - parisc/agp: Annotate parisc agp init functions with __init (Helge Deller)   
  - net/mlx4_en: Update reported link modes for 1/10G (Erik Ekman)   
  - drm/msm/dsi: set default num_data_lanes (Philip Chen)   
  - nfc: fix segfault in nfc_genl_dump_devices_done (Tadeusz Struk)   
  - Linux 4.14.258 (Greg Kroah-Hartman)   
  - irqchip: nvic: Fix offset for Interrupt Priority Offsets (Vladimir Murzin)   
  - irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL (Wudi Wang)   
  - irqchip/armada-370-xp: Fix support for Multi-MSI interrupts (Pali Rohár)   
  - irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() (Pali Rohár)   
  - iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove (Yang Yingliang)   
  - iio: adc: axp20x_adc: fix charging current reporting on AXP22x (Evgeny Boger)   
  - iio: dln2: Check return value of devm_iio_trigger_register() (Lars-Peter Clausen)   
  - iio: dln2-adc: Fix lockdep complaint (Noralf Trønnes)   
  - iio: itg3200: Call iio_trigger_notify_done() on error (Lars-Peter Clausen)   
  - iio: kxsd9: Don't return error code in trigger handler (Lars-Peter Clausen)   
  - iio: ltr501: Don't return error code in trigger handler (Lars-Peter Clausen)   
  - iio: mma8452: Fix trigger reference couting (Lars-Peter Clausen)   
  - iio: stk3310: Don't return error code in interrupt handler (Lars-Peter Clausen)   
  - iio: trigger: stm32-timer: fix MODULE_ALIAS (Alyssa Ross)   
  - iio: trigger: Fix reference counting (Lars-Peter Clausen)   
  - usb: core: config: using bit mask instead of individual bits (Pavel Hofman)   
  - xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending (Kai-Heng Feng)   
  - usb: core: config: fix validation of wMaxPacketValue entries (Pavel Hofman)   
  - USB: gadget: zero allocate endpoint 0 buffers (Greg Kroah-Hartman)   
  - USB: gadget: detect too-big endpoint 0 requests (Greg Kroah-Hartman)   
  - net/qla3xxx: fix an error code in ql_adapter_up() (Dan Carpenter)   
  - net, neigh: clear whole pneigh_entry at alloc time (Eric Dumazet)   
  - net: fec: only clear interrupt of handling queue in fec_enet_rx_queue() (Joakim Zhang)   
  - net: altera: set a couple error code in probe() (Dan Carpenter)   
  - net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero (Lee Jones)   
  - qede: validate non LSO skb length (Manish Chopra)   
  - block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) (Davidlohr Bueso)   
  - tracefs: Set all files to the same group ownership as the mount option (Steven Rostedt (VMware))   
  - signalfd: use wake_up_pollfree() (Eric Biggers)   
  - binder: use wake_up_pollfree() (Eric Biggers)   
  - wait: add wake_up_pollfree() (Eric Biggers)   
  - libata: add horkage for ASMedia 1092 (Hannes Reinecke)   
  - can: m_can: Disable and ignore ELO interrupt (Brian Silverman)   
  - can: pch_can: pch_can_rx_normal: fix use after free (Vincent Mailhol)   
  - tracefs: Have new files inherit the ownership of their parent (Steven Rostedt (VMware))   
  - ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() (Takashi Iwai)   
  - ALSA: pcm: oss: Limit the period size to 16MB (Takashi Iwai)   
  - ALSA: pcm: oss: Fix negative period/buffer sizes (Takashi Iwai)   
  - ALSA: ctl: Fix copy of updated id with element read/write (Alan Young)   
  - mm: bdi: initialize bdi_min_ratio when bdi is unregistered (Manjong Lee)   
  - IB/hfi1: Correct guard on eager buffer deallocation (Mike Marciniszyn)   
  - seg6: fix the iif in the IPv6 socket control block (Andrea Mayer)   
  - nfp: Fix memory leak in nfp_cpp_area_cache_add() (Jianglei Nie)   
  - bpf: Fix the off-by-two error in range markings (Maxim Mikityanskiy)   
  - nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (Krzysztof Kozlowski)   
  - can: sja1000: fix use after free in ems_pcmcia_add_card() (Dan Carpenter)   
  - HID: check for valid USB device for many HID drivers (Greg Kroah-Hartman)   
  - HID: wacom: fix problems when device is not a valid USB device (Greg Kroah-Hartman)   
  - HID: add USB_HID dependancy on some USB HID drivers (Greg Kroah-Hartman)   
  - HID: add USB_HID dependancy to hid-chicony (Greg Kroah-Hartman)   
  - HID: add USB_HID dependancy to hid-prodikeys (Greg Kroah-Hartman)   
  - HID: add hid_is_usb() function to make it simpler for USB detection (Greg Kroah-Hartman)   
  - Linux 4.14.257 (Greg Kroah-Hartman)   {CVE-2021-38199} 
  - parisc: Mark cr16 CPU clocksource unstable on all SMP machines (Helge Deller)   
  - serial: core: fix transmit-buffer reset and memleak (Johan Hovold)   
  - serial: pl011: Add ACPI SBSA UART match id (Pierre Gondois)   
  - tty: serial: msm_serial: Deactivate RX DMA for polling support (Sven Eckelmann)   
  - x86/64/mm: Map all kernel memory into trampoline_pgd (Joerg Roedel)   
  - usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect (Badhri Jagan Sridharan)   
  - xhci: Fix commad ring abort, write all 64 bits to CRCR register. (Mathias Nyman)   
  - vgacon: Propagate console boot parameters before calling `vc_resize' (Maciej W. Rozycki)   
  - parisc: Fix "make install" on newer debian releases (Helge Deller)   
  - parisc: Fix KBUILD_IMAGE for self-extracting kernel (Helge Deller)   
  - net/smc: Keep smc_close_final rc during active close (Tony Lu)   
  - net/rds: correct socket tunable error in rds_tcp_tune() (William Kucharski)   
  - net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ is available (Sven Schuchmann)   
  - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() (Zhou Qingyang)   
  - siphash: use _unaligned version by default (Arnd Bergmann)   
  - net: mpls: Fix notifications when deleting a device (Benjamin Poirier)   
  - net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings() (Zhou Qingyang)   
  - natsemi: xtensa: fix section mismatch warnings (Randy Dunlap)   
  - sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl (Baokun Li)   
  - sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl (Baokun Li)   
  - kprobes: Limit max data_size of the kretprobe instances (Masami Hiramatsu)   
  - vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit (Stephen Suryaputra)   
  - perf hist: Fix memory leak of a perf_hpp_fmt (Ian Rogers)   
  - net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock() (Teng Qi)   
  - net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound (zhangyue)   
  - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Teng Qi)   
  - scsi: iscsi: Unblock session then wake up error handler (Mike Christie)   
  - thermal: core: Reset previous low and high trip during thermal zone init (Manaf Meethalavalappu Pallikunhi)   
  - btrfs: check-integrity: fix a warning on write caching disabled disk (Wang Yugui)   
  - s390/setup: avoid using memblock_enforce_memory_limit (Vasily Gorbik)   
  - platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep (Slark Xiao)   
  - net: return correct error code (liuguoqiang)   
  - NFSv42: Fix pagecache invalidation after COPY/CLONE (Benjamin Coddington)   
  - ipc: WARN if trying to remove ipc object which is absent (Alexander Mikhalitsyn)   
  - shm: extend forced shm destroy to support objects from several IPC nses (Alexander Mikhalitsyn)   
  - tty: hvc: replace BUG_ON() with negative return value (Juergen Gross)   
  - xen: sync include/xen/interface/io/ring.h with Xen's newest version (Juergen Gross)   
  - fuse: release pipe buf after last use (Miklos Szeredi)   
  - NFC: add NCI_UNREG flag to eliminate the race (Lin Ma)   
  - arm64: dts: marvell: armada-37xx: Set pcie_reset_pin to gpio function (Marek Behún)   
  - arm64: dts: marvell: armada-37xx: declare PCIe reset pin (Miquel Raynal)   
  - pinctrl: armada-37xx: Correct PWM pins definitions (Marek Behún)   
  - pinctrl: armada-37xx: add missing pin: PCIe1 Wakeup (Gregory CLEMENT)   
  - pinctrl: armada-37xx: Correct mpp definitions (Marek Behún)   
  - PCI: aardvark: Fix checking for link up via LTSSM state (Pali Rohár)   
  - PCI: aardvark: Fix link training (Pali Rohár)   
  - PCI: aardvark: Fix PCIe Max Payload Size setting (Pali Rohár)   
  - PCI: aardvark: Configure PCIe resources from 'ranges' DT property (Pali Rohár)   
  - PCI: aardvark: Remove PCIe outbound window configuration (Evan Wang)   
  - PCI: aardvark: Update comment about disabling link training (Pali Rohár)   
  - PCI: aardvark: Move PCIe reset card code to advk_pcie_train_link() (Pali Rohár)   
  - PCI: aardvark: Fix compilation on s390 (Pali Rohár)   
  - PCI: aardvark: Don't touch PCIe registers if no card connected (Pali Rohár)   
  - PCI: aardvark: Introduce an advk_pcie_valid_device() helper (Thomas Petazzoni)   
  - PCI: aardvark: Indicate error in 'val' when config read fails (Pali Rohár)   
  - PCI: aardvark: Replace custom macros by standard linux/pci_regs.h macros (Pali Rohár)   
  - PCI: aardvark: Issue PERST via GPIO (Pali Rohár)   
  - PCI: aardvark: Improve link training (Marek Behún)   
  - PCI: aardvark: Train link immediately after enabling training (Pali Rohár)   
  - PCI: aardvark: Wait for endpoint to be ready before training link (Remi Pommarel)   
  - PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (Wen Yang)   
  - PCI: aardvark: Fix I/O space page leak (Sergei Shtylyov)   
  - s390/mm: validate VMA in PGSTE manipulation functions (David Hildenbrand)   
  - tracing: Check pid filtering when creating events (Steven Rostedt (VMware))   
  - vhost/vsock: fix incorrect used length reported to the guest (Stefano Garzarella)   
  - net/smc: Don't call clcsock shutdown twice when smc shutdown (Tony Lu)   
  - MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48 (Huang Pei)   
  - tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows (Eric Dumazet)   
  - net/smc: Ensure the active closing peer first closes clcsock (Tony Lu)   
  - ipv6: fix typos in __ip6_finish_output() (Eric Dumazet)   
  - drm/vc4: fix error code in vc4_create_object() (Dan Carpenter)   
  - scsi: mpt3sas: Fix kernel panic during drive powercycle test (Sreekanth Reddy)   
  - ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE (Takashi Iwai)   
  - NFSv42: Don't fail clone() unless the OP_CLONE operation failed (Trond Myklebust)   
  - net: ieee802154: handle iftypes as u32 (Alexander Aring)   
  - ASoC: topology: Add missing rwsem around snd_ctl_remove() calls (Takashi Iwai)   
  - ARM: dts: BCM5301X: Add interrupt properties to GPIO node (Florian Fainelli)   
  - ARM: dts: BCM5301X: Fix I2C controller interrupt (Florian Fainelli)   
  - netfilter: ipvs: Fix reuse connection if RS weight is 0 (yangxingwu)   
  - tracing: Fix pid filtering when triggers are attached (Steven Rostedt (VMware))   
  - xen: detect uninitialized xenbus in xenbus_init (Stefano Stabellini)   
  - xen: don't continue xenstore initialization in case of errors (Stefano Stabellini)   
  - fuse: fix page stealing (Miklos Szeredi)   
  - staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (Dan Carpenter)   
  - HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts (Jason Gerecke)   
  - media: cec: copy sequence field for the reply (Hans Verkuil)   
  - ALSA: ctxfi: Fix out-of-range access (Takashi Iwai)   
  - usb: hub: Fix locking issues with address0_mutex (Mathias Nyman)   
  - usb: hub: Fix usb enumeration issue due to address0 race (Mathias Nyman)   
  - USB: serial: option: add Fibocom FM101-GL variants (Mingjie Zhang)   
  - USB: serial: option: add Telit LE910S1 0x9200 composition (Daniele Palmas)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.512.1.el7uek]
changelog:
  - Revert "stable: clamp SUBLEVEL in 4.14" (Alan Maguire)  [Orabug: 33861950]  
  - tipc: improve size validations for received domain records (Jon Maloy)  [Orabug: 33850803]  {CVE-2022-0435} {CVE-2022-0435} 
  - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman)  [Orabug: 33825688]  {CVE-2022-0492} 
  - blk-stat: delete useless code (Shaohua Li)  [Orabug: 33772945]  
  - DMA/rxe: Update default value of RXE_MAX_PDN (Rao Shoaib)  [Orabug: 33676598]


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.512.3.el7uek]
changelog:
  - lib/timerqueue: Rely on rbtree semantics for next timer (Davidlohr Bueso)  [Orabug: 33406086]  {CVE-2021-20317} {CVE-2021-20317} 
  - rds/ib: Resize CQ if send-/recv-ring-size are changed (Hans Westgaard Ry)  [Orabug: 33940520]  
  - uek-rpm: remove uek-rpm/ol8 (John Donnelly)  [Orabug: 33665655]  
  - uek-rpm: Enable config CONFIG_SCSI_MQ_DEFAULT (Saeed Mirzamohammadi)  [Orabug: 33973455]  
  - sched: restore the sliding search window for select_idle_cpu() (Libo Chen)  [Orabug: 33965297]  
  - NFSv4: Handle case where the lookup of a directory fails (Trond Myklebust)  [Orabug: 33958155]  {CVE-2022-24448} 
  - Linux 4.14.261 (Greg Kroah-Hartman)   
  - sctp: use call_rcu to free endpoint (Xin Long)   
  - net: fix use-after-free in tw_timer_handler (Muchun Song)   
  - Input: spaceball - fix parsing of movement data packets (Leo L. Schwab)   
  - Input: appletouch - initialize work before device registration (Pavel Skripkin)   
  - binder: fix async_free_space accounting for empty parcels (Todd Kjos)   
  - usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. (Vincent Pelletier)   
  - xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. (Mathias Nyman)   
  - uapi: fix linux/nfc.h userspace compilation errors (Dmitry V. Levin)   
  - nfc: uapi: use kernel size_t to fix user-space builds (Krzysztof Kozlowski)   
  - fsl/fman: Fix missing put_device() call in fman_port_probe (Miaoqian Lin)   
  - NFC: st21nfca: Fix memory leak in device probe and remove (Wei Yongjun)   
  - net: usb: pegasus: Do not drop long Ethernet frames (Matthias-Christian Ott)   
  - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() (Dan Carpenter)   
  - selinux: initialize proto variable in selinux_ip_postroute_compat() (Tom Rix)   
  - recordmcount.pl: fix typo in s390 mcount regex (Heiko Carstens)   
  - platform/x86: apple-gmux: use resource_size() with res (Wang Qing)   
  - HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option (Hans de Goede)   
  - Linux 4.14.260 (Greg Kroah-Hartman)   
  - phonet/pep: refuse to enable an unbound pipe (Rémi Denis-Courmont)   
  - hamradio: improve the incomplete fix to avoid NPD (Lin Ma)   
  - hamradio: defer ax25 kfree after unregister_netdev (Lin Ma)   
  - ax25: NPD bug when detaching AX25 device (Lin Ma)   
  - hwmon: (lm90) Do not report 'busy' status bit as alarm (Guenter Roeck)   
  - KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state (Sean Christopherson)   
  - usb: gadget: u_ether: fix race in setting MAC address in setup phase (Marian Postevca)   
  - f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() (Chao Yu)   
  - ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling (Ard Biesheuvel)   
  - pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines (Fabien Dessenne)   
  - x86/pkey: Fix undefined behaviour with PKRU_WD_BIT (Andrew Cooper)   
  - Input: atmel_mxt_ts - fix double free in mxt_read_info_block (José Expósito)   
  - ALSA: drivers: opl3: Fix incorrect use of vp->state (Colin Ian King)   
  - ALSA: jack: Check the return value of kstrdup() (Xiaoke Wang)   
  - hwmon: (lm90) Fix usage of CONFIG2 register in detect function (Guenter Roeck)   
  - sfc: falcon: Check null pointer of rx_queue->page_ring (Jiasheng Jiang)   
  - drivers: net: smc911x: Check for error irq (Jiasheng Jiang)   
  - fjes: Check for error irq (Jiasheng Jiang)   
  - bonding: fix ad_actor_system option setting to default (Fernando Fernandez Mancera)   
  - net: skip virtio_net_hdr_set_proto if protocol already set (Willem de Bruijn)   
  - qlcnic: potential dereference null pointer of rx_queue->page_ring (Jiasheng Jiang)   
  - spi: change clk_disable_unprepare to clk_unprepare (Dongliang Mu)   
  - HID: holtek: fix mouse probing (Benjamin Tissoires)   
  - can: kvaser_usb: get CAN clock frequency from device (Jimmy Assarsson)   
  - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Greg Jesionowski)   
  - x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp)  [Orabug: 33937656]  {CVE-2021-26401} 
  - x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp)  [Orabug: 33937656]  {CVE-2021-26401} 
  - x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips)  [Orabug: 33937656]  {CVE-2021-26401} 
  - x86/speculation: Use generic retpoline by default on AMD (Kim Phillips)  [Orabug: 33937656]  {CVE-2021-26401} 
  - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf)  [Orabug: 33937656]  {CVE-2021-26401} 
  - Documentation/hw-vuln: Update spectre doc (Peter Zijlstra)  [Orabug: 33937656]  {CVE-2021-26401} 
  - x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra)  [Orabug: 33937656]  {CVE-2021-26401} 
  - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel))  [Orabug: 33937656]  {CVE-2021-26401} 
  - x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov)  [Orabug: 33937656]  {CVE-2021-26401} 
  - x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp)  [Orabug: 33937656]  {CVE-2021-26401} 
  - x86/speculation: Fix bug in retpoline mode on AMD with `spectre_v2=none` (Patrick Colp)  [Orabug: 33937656]  {CVE-2021-26401} 
  - ACPICA: Enable sleep button on ACPI legacy wake (Anchal Agarwal)  [Orabug: 33925502]  
  - ipv4: tcp: send zero IPID in SYNACK messages (Eric Dumazet)  [Orabug: 33917057]  {CVE-2020-36516} 
  - ipv4: avoid using shared IP generator for connected sockets (Eric Dumazet)  [Orabug: 33917057]  {CVE-2020-36516} 
  - lib/iov_iter: initialize "flags" in new pipe_buffer (Max Kellermann)  [Orabug: 33910800]  {CVE-2022-0847} 
  - x86/speculation: The choice of retpoline mode is sometimes ignored (Patrick Colp)  [Orabug: 33890092]  
  - udf: Restore i_lenAlloc when inode expansion fails (Jan Kara)  [Orabug: 33870267]  {CVE-2022-0617} 
  - udf: Fix NULL ptr deref when converting from inline format (Jan Kara)  [Orabug: 33870267]  {CVE-2022-0617} 
  - scsi: libiscsi: Hold back_lock when calling iscsi_complete_task (Gulam Mohamed)  [Orabug: 33851182]  
  - drm/vmwgfx: Fix stale file descriptors on failed usercopy (Mathias Krause)  [Orabug: 33840433]  {CVE-2022-22942} 
  - drm/i915: Flush TLBs before releasing backing store (Tvrtko Ursulin)  [Orabug: 33835811]  {CVE-2022-0330} 
  - proc/vmcore: fix clearing user buffer by properly using clear_user() (David Hildenbrand)  [Orabug: 33832650]  
  - rds/ib: recover rds connection from stuck rx path (Nagappan Ramasamy Palaniappan)  [Orabug: 33820767]  
  - rds: ib: Make selection of completion_vector QoS aware (Håkon Bugge)  [Orabug: 33819408]  
  - Enable CONFIG_DM_DUST and nano for UEK5 (Gulam Mohamed)  [Orabug: 33653698]  
  - dm dust: use dust block size for badblocklist index (Bryan Gurney)  [Orabug: 33653698]  
  - dm dust: Make dm_dust_init and dm_dust_exit static (YueHaibing)  [Orabug: 33653698]  
  - dm dust: remove redundant unsigned comparison to less than zero (Colin Ian King)  [Orabug: 33653698]  
  - dm: add dust target (Bryan Gurney)  [Orabug: 33653698]  
  - hugetlbfs: flush TLBs correctly after huge_pmd_unshare (Nadav Amit)  [Orabug: 33617219]  {CVE-2021-4002} 
  - rds/ib: handle posted ACK during connection shutdown (Nagappan Ramasamy Palaniappan)  [Orabug: 33820747]  
  - rds/ib: reap tx completions during connection shutdown (Nagappan Ramasamy Palaniappan)  [Orabug: 33820747]  
  - rds/ib: recover rds connection from stuck tx path (Nagappan Ramasamy Palaniappan)  [Orabug: 33820747]  
  - rds/ib: Kernel change to extend rds-info functionality (Rohit Nair)  [Orabug: 33821341]  
  - uek-rpm: Add missing symbols to kabi_lockedlist (Stephen Brennan)  [Orabug: 33871558]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.512.4.el7uek]
changelog:
  - Linux 4.14.265 (Greg Kroah-Hartman)   
  - ext4: fix error handling in ext4_restore_inline_data() (Ritesh Harjani)   
  - EDAC/xgene: Fix deferred probing (Sergey Shtylyov)   
  - EDAC/altera: Fix deferred probing (Sergey Shtylyov)   
  - rtc: cmos: Evaluate century appropriate (Riwen Lu)   
  - selftests: futex: Use variable MAKE instead of make (Muhammad Usama Anjum)   
  - nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client. (Dai Ngo)   
  - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe (John Meneghini)   
  - ASoC: fsl: Add missing error handling in pcm030_fabric_probe (Miaoqian Lin)   
  - drm/i915/overlay: Prevent divide by zero bugs in scaling (Dan Carpenter)   
  - net: macsec: Verify that send_sci is on when setting Tx sci explicitly (Lior Nahmanson)   
  - net: ieee802154: Return meaningful error codes from the netlink helpers (Miquel Raynal)   
  - net: ieee802154: ca8210: Stop leaking skb's (Miquel Raynal)   
  - spi: meson-spicc: add IRQ check in meson_spicc_probe (Miaoqian Lin)   
  - spi: mediatek: Avoid NULL pointer crash in interrupt (Benjamin Gaignard)   
  - spi: bcm-qspi: check for valid cs before applying chip select (Kamal Dasu)   
  - iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() (Joerg Roedel)   
  - iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() (Guoqing Jiang)   
  - RDMA/mlx4: Don't continue event handler after memory allocation failure (Leon Romanovsky)   
  - block: bio-integrity: Advance seed correctly for larger interval sizes (Martin K. Petersen)   
  - drm/nouveau: fix off by one in BIOS boundary checking (Nick Lopez)   
  - ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (Mark Brown)   
  - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (Mark Brown)   
  - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (Mark Brown)   
  - audit: improve audit queue handling when "audit=1" on cmdline (Paul Moore)   
  - af_packet: fix data-race in packet_setsockopt / packet_setsockopt (Eric Dumazet)   
  - rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() (Eric Dumazet)   
  - net: amd-xgbe: Fix skb data length underflow (Shyam Sundar S K)   
  - net: amd-xgbe: ensure to reset the tx_timer_active flag (Raju Rangoju)   
  - ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback (Georgi Valkov)   
  - netfilter: nat: limit port clash resolution attempts (Florian Westphal)   
  - netfilter: nat: remove l4 protocol port rovers (Florian Westphal)   
  - bpf: fix truncated jump targets on heavy expansions (Daniel Borkmann)   
  - ipv4: raw: lock the socket in raw_bind() (Eric Dumazet)   
  - yam: fix a memory leak in yam_siocdevprivate() (Hangyu Hua)   
  - ibmvnic: don't spin in tasklet (Sukadev Bhattiprolu)   
  - drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (José Expósito)   
  - drm/msm: Fix wrong size calculation (Xianting Tian)   
  - net-procfs: show net devices bound packet types (Jianguo Wu)   
  - NFSv4: nfs_atomic_open() can race when looking up a non-regular file (Trond Myklebust)   
  - NFSv4: Handle case where the lookup of a directory fails (Trond Myklebust)   
  - hwmon: (lm90) Reduce maximum conversion rate for G781 (Guenter Roeck)   
  - ping: fix the sk_bound_dev_if match in ping_lookup (Xin Long)   
  - net: fix information leakage in /proc/net/ptype (Saeed Mirzamohammadi)   
  - ipv6_tunnel: Rate limit warning messages (Ido Schimmel)   
  - scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() (John Meneghini)   
  - rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev (Matthias Kaehlcke)   
  - rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (Sujit Kautkar)   
  - i40e: fix unsigned stat widths (Joe Damato)   
  - i40e: Increase delay to 1 s after global EMP reset (Jedrzej Jagielski)   
  - lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() (Christophe Leroy)   
  - powerpc/32: Fix boot failure with GCC latent entropy plugin (Christophe Leroy)   
  - net: sfp: ignore disabled SFP node (Marek Behún)   
  - usb: typec: tcpm: Do not disconnect while receiving VBUS off (Badhri Jagan Sridharan)   
  - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Alan Stern)   
  - usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS (Pavankumar Kondeti)   
  - usb: common: ulpi: Fix crash in ulpi_match() (Jon Hunter)   
  - usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge (Alan Stern)   
  - tty: Add support for Brainboxes UC cards. (Cameron Williams)   
  - tty: n_gsm: fix SW flow control encoding/handling (daniel.starke@siemens.com)   
  - serial: stm32: fix software flow control transfer (Valentin Caron)   
  - netfilter: nft_payload: do not update layer 4 checksum when mangling fragments (Pablo Neira Ayuso)   
  - PM: wakeup: simplify the output logic of pm_show_wakelocks() (Greg Kroah-Hartman)   
  - scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices (Steffen Maier)   
  - s390/hypfs: include z/VM guests with access control group set (Vasily Gorbik)   
  - Bluetooth: refactor malicious adv data check (Brian Gix)   
  - Linux 4.14.264 (Greg Kroah-Hartman)   
  - can: bcm: fix UAF of bcm op (Ziyang Xuan)   
  - Linux 4.14.263 (Greg Kroah-Hartman)   
  - gianfar: fix jumbo packets+napi+rx overrun crash (Michael Braun)   
  - gianfar: simplify FCS handling and fix memory leak (Andy Spencer)   
  - drm/ttm/nouveau: don't call tt destroy callback on alloc failure. (Dave Airlie)   
  - mips,s390,sh,sparc: gup: Work around the "COW can break either way" issue (Ben Hutchings)   
  - lib82596: Fix IRQ check in sni_82596_probe (Miaoqian Lin)   
  - scripts/dtc: dtx_diff: remove broken example from help text (Matthias Schiffer)   
  - bcmgenet: add WOL IRQ check (Sergey Shtylyov)   
  - net_sched: restore "mpu xxx" handling (Kevin Bracey)   
  - dmaengine: at_xdmac: Fix at_xdmac_lld struct definition (Tudor Ambarus)   
  - dmaengine: at_xdmac: Fix lld view setting (Tudor Ambarus)   
  - dmaengine: at_xdmac: Print debug message after realeasing the lock (Tudor Ambarus)   
  - dmaengine: at_xdmac: Don't start transactions at tx_submit level (Tudor Ambarus)   
  - libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route() (Guillaume Nault)   
  - netns: add schedule point in ops_exit_list() (Eric Dumazet)   
  - net: axienet: fix number of TX ring slots for available check (Robert Hancock)   
  - net: axienet: Wait for PhyRstCmplt after core reset (Robert Hancock)   
  - af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (Eric Dumazet)   
  - parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries (Miaoqian Lin)   
  - net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module (Tobias Waldekranz)   
  - powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses (Tobias Waldekranz)   
  - powerpc/cell: Fix clang -Wimplicit-fallthrough warning (Anders Roxell)   
  - RDMA/rxe: Fix a typo in opcode name (Chengguang Xu)   
  - RDMA/hns: Modify the mapping attribute of doorbell to device (Yixing Liu)   
  - Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization (Lukas Bulwahn)   
  - firmware: Update Kconfig help text for Google firmware (Ben Hutchings)   
  - drm/radeon: fix error handling in radeon_driver_open_kms (Christian König)   
  - crypto: stm32/crc32 - Fix kernel BUG triggered in probe() (Marek Vasut)   
  - ext4: don't use the orphan list when migrating an inode (Theodore Ts'o)   
  - ext4: Fix BUG_ON in ext4_bread when write quota data (Ye Bin)   
  - ext4: set csum seed in tmp inode while migrating to extents (Luís Henriques)   
  - ext4: make sure quota gets properly shutdown on error (Jan Kara)   
  - iwlwifi: mvm: Increase the scan timeout guard to 30 seconds (Ilan Peer)   
  - cputime, cpuacct: Include guest time in user time in cpuacct.stat (Andrey Ryabinin)   
  - serial: Fix incorrect rs485 polarity on uart open (Lukas Wunner)   
  - ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers (Petr Cvachoucek)   
  - power: bq25890: Enable continuous conversion for ADC at charging (Yauhen Kharuzhy)   
  - ASoC: mediatek: mt8173: fix device_node leak (Tzung-Bi Shih)   
  - scsi: sr: Don't use GFP_DMA (Christoph Hellwig)   
  - MIPS: Octeon: Fix build errors using clang (Tianjia Zhang)   
  - i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters (Lakshmi Sowjanya D)   
  - MIPS: OCTEON: add put_device() after of_find_device_by_node() (Ye Guojin)   
  - ALSA: seq: Set upper limit of processed events (Takashi Iwai)   
  - w1: Misuse of get_user()/put_user() reported by sparse (Christophe Leroy)   
  - i2c: mpc: Correct I2C reset procedure (Joakim Tjernlund)   
  - powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING (Michael Ellerman)   
  - i2c: i801: Don't silently correct invalid transfer size (Heiner Kallweit)   
  - powerpc/watchdog: Fix missed watchdog reset due to memory ordering race (Nicholas Piggin)   
  - powerpc/btext: add missing of_node_put (Julia Lawall)   
  - powerpc/cell: add missing of_node_put (Julia Lawall)   
  - powerpc/powernv: add missing of_node_put (Julia Lawall)   
  - powerpc/6xx: add missing of_node_put (Julia Lawall)   
  - parisc: Avoid calling faulthandler_disabled() twice (John David Anglin)   
  - serial: core: Keep mctrl register state and cached copy in sync (Lukas Wunner)   
  - serial: pl010: Drop CR register reset on set_termios (Lukas Wunner)   
  - net: phy: marvell: configure RGMII delays for 88E1118 (Russell King (Oracle))   
  - dm space map common: add bounds check to sm_ll_lookup_bitmap() (Joe Thornber)   
  - dm btree: add a defensive bounds check to insert_at() (Joe Thornber)   
  - mac80211: allow non-standard VHT MCS-10/11 (Ping-Ke Shih)   
  - net: mdio: Demote probed message to debug print (Florian Fainelli)   
  - btrfs: remove BUG_ON(!eie) in find_parent_nodes (Josef Bacik)   
  - btrfs: remove BUG_ON() in find_parent_nodes() (Josef Bacik)   
  - ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (Kirill A. Shutemov)   
  - ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (Rafael J. Wysocki)   
  - ACPICA: Utilities: Avoid deleting the same object twice in a row (Rafael J. Wysocki)   
  - ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (Mark Langsdorf)   
  - jffs2: GC deadlock reading a page that is used in jffs2_write_begin() (Kyeong Yoo)   
  - um: registers: Rename function names to avoid conflicts and build problems (Randy Dunlap)   
  - iwlwifi: remove module loading failure message (Johannes Berg)   
  - iwlwifi: fix leaks/bad data after failed firmware load (Johannes Berg)   
  - ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream (Zekun Shen)   
  - usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 (Kai-Heng Feng)   
  - arm64: tegra: Adjust length of CCPLEX cluster MMIO region (Thierry Reding)   
  - mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO (Ulf Hansson)   
  - media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() (Zhou Qingyang)   
  - media: igorplugusb: receiver overflow should be reported (Sean Young)   
  - bpf: Do not WARN in bpf_warn_invalid_xdp_action() (Paolo Abeni)   
  - net: bonding: debug: avoid printing debug logs when bond is not notifying peers (Suresh Kumar)   
  - ath10k: Fix tx hanging (Sebastian Gottschall)   
  - iwlwifi: mvm: synchronize with FW after multicast commands (Johannes Berg)   
  - media: m920x: don't use stack on USB reads (Mauro Carvalho Chehab)   
  - media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() (Zhou Qingyang)   
  - media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds. (James Hilliard)   
  - floppy: Add max size check for user space request (Xiongwei Song)   
  - usb: uhci: add aspeed ast2600 uhci support (Neal Liu)   
  - mwifiex: Fix skb_over_panic in mwifiex_usb_recv() (Zekun Shen)   
  - HSI: core: Fix return freed object in hsi_new_client (Chengfeng Ye)   
  - gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use (Hans de Goede)   
  - drm/bridge: megachips: Ensure both bridges are probed before registration (Martyn Welch)   
  - mlxsw: pci: Add shutdown method in PCI driver (Danielle Ratson)   
  - media: b2c2: Add missing check in flexcop_pci_isr: (Zheyu Ma)   
  - HID: apple: Do not reset quirks when the Fn key is not found (José Expósito)   
  - usb: gadget: f_fs: Use stream_open() for endpoint files (Pavankumar Kondeti)   
  - drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR (Ben Skeggs)   
  - ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply (Zekun Shen)   
  - fs: dlm: filter user dlm messages for kernel locks (Alexander Aring)   
  - Bluetooth: Fix debugfs entry leak in hci_register_dev() (Wei Yongjun)   
  - RDMA/cxgb4: Set queue pair state when being queried (Kamal Heib)   
  - mips: bcm63xx: add support for clk_set_parent() (Randy Dunlap)   
  - mips: lantiq: add support for clk_set_parent() (Randy Dunlap)   
  - misc: lattice-ecp3-config: Fix task hung when firmware load failed (Wei Yongjun)   
  - ASoC: samsung: idma: Check of ioremap return value (Jiasheng Jiang)   
  - iommu/iova: Fix race between FQ timeout and teardown (Xiongfeng Wang)   
  - dmaengine: pxa/mmp: stop referencing config->slave_id (Arnd Bergmann)   
  - RDMA/core: Let ib_find_gid() continue search even after empty entry (Avihai Horon)   
  - scsi: ufs: Fix race conditions related to driver data (Bart Van Assche)   
  - char/mwave: Adjust io port register size (Kees Cook)   
  - ALSA: oss: fix compile error when OSS_DEBUG is enabled (Bixuan Cui)   
  - powerpc/prom_init: Fix improper check of prom_getprop() (Peiwei Hu)   
  - RDMA/hns: Validate the pkey index (Kamal Heib)   
  - ALSA: hda: Add missing rwsem around snd_ctl_remove() calls (Takashi Iwai)   
  - ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls (Takashi Iwai)   
  - ALSA: jack: Add missing rwsem around snd_ctl_remove() calls (Takashi Iwai)   
  - ext4: avoid trim error on fs with small groups (Jan Kara)   
  - net: mcs7830: handle usb read errors properly (Pavel Skripkin)   
  - pcmcia: fix setting of kthread task states (Dominik Brodowski)   
  - can: xilinx_can: xcan_probe(): check for error irq (Jiasheng Jiang)   
  - can: softing: softing_startstop(): fix set but not used variable warning (Marc Kleine-Budde)   
  - tpm: add request_locality before write TPM_INT_ENABLE (Chen Jun)   
  - spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe (Miaoqian Lin)   
  - fsl/fman: Check for null pointer after calling devm_ioremap (Jiasheng Jiang)   
  - ppp: ensure minimum packet size in ppp_write() (Eric Dumazet)   
  - pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() (Zhou Qingyang)   
  - pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() (Zhou Qingyang)   
  - x86/mce/inject: Avoid out-of-bounds write when setting flags (Zhang Zixun)   
  - usb: ftdi-elan: fix memory leak on device disconnect (Wei Yongjun)   
  - media: msi001: fix possible null-ptr-deref in msi001_probe() (Wang Hai)   
  - media: dw2102: Fix use after free (Anton Vasilyev)   
  - sched/rt: Try to restart rt period timer when rt runtime exceeded (Li Hua)   
  - media: si2157: Fix "warm" tuner state detection (Robert Schlabbach)   
  - media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() (Zhou Qingyang)   
  - media: dib8000: Fix a memleak in dib8000_init() (Zhou Qingyang)   
  - floppy: Fix hang in watchdog when disk is ejected (Tasos Sahanidis)   
  - serial: amba-pl011: do not request memory region twice (Lino Sanfilippo)   
  - drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() (Zhou Qingyang)   
  - drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() (Zhou Qingyang)   
  - arm64: dts: qcom: msm8916: fix MMC controller aliases (Dmitry Baryshkov)   
  - netfilter: bridge: add support for pppoe filtering (Florian Westphal)   
  - media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released (Dafna Hirschfeld)   
  - tty: serial: atmel: Call dma_async_issue_pending() (Tudor Ambarus)   
  - tty: serial: atmel: Check return code of dmaengine_submit() (Tudor Ambarus)   
  - crypto: qce - fix uaf on qce_ahash_register_one (Chengfeng Ye)   
  - media: dmxdev: fix UAF when dvb_register_device() fails (Wang Hai)   
  - Bluetooth: stop proccessing malicious adv data (Pavel Skripkin)   
  - media: em28xx: fix memory leak in em28xx_init_dev (Dongliang Mu)   
  - wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND (Bryan O'Donoghue)   
  - clk: bcm-2835: Remove rounding up the dividers (Maxime Ripard)   
  - clk: bcm-2835: Pick the closest clock rate (Maxime Ripard)   
  - Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails (Wang Hai)   
  - PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (Yifeng Li)   
  - shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode (Gang Li)   
  - can: softing_cs: softingcs_probe(): fix memleak on registration failure (Johan Hovold)   
  - media: stk1160: fix control-message timeouts (Johan Hovold)   
  - media: pvrusb2: fix control-message timeouts (Johan Hovold)   
  - media: redrat3: fix control-message timeouts (Johan Hovold)   
  - media: dib0700: fix undefined behavior in tuner shutdown (Michael Kuron)   
  - media: s2255: fix control-message timeouts (Johan Hovold)   
  - media: cpia2: fix control-message timeouts (Johan Hovold)   
  - media: em28xx: fix control-message timeouts (Johan Hovold)   
  - media: mceusb: fix control-message timeouts (Johan Hovold)   
  - media: flexcop-usb: fix control-message timeouts (Johan Hovold)   
  - rtc: cmos: take rtc_lock while reading from CMOS (Mateusz Jończyk)   
  - nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() (Krzysztof Kozlowski)   
  - HID: wacom: Avoid using stale array indicies to read contact count (Jason Gerecke)   
  - HID: wacom: Ignore the confidence flag when a touch is removed (Jason Gerecke)   
  - HID: uhid: Fix worker destroying device without any protection (Jann Horn)   
  - Bluetooth: fix init and cleanup of sco_conn.timeout_work (Desmond Cheong Zhi Xi)   
  - Bluetooth: schedule SCO timeouts with delayed_work (Desmond Cheong Zhi Xi)   
  - rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled (Larry Finger)   
  - media: uvcvideo: fix division by zero at stream start (Johan Hovold)   
  - orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc() (Christophe JAILLET)   
  - drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() (Nathan Chancellor)   
  - staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn() (Nathan Chancellor)   
  - random: fix data race on crng init time (Eric Biggers)   
  - random: fix data race on crng_node_pool (Eric Biggers)   
  - can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved} (Brian Silverman)   
  - can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data (Marc Kleine-Budde)   
  - mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe() (Andy Shevchenko)   
  - USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status (Alan Stern)   
  - USB: core: Fix bug in resuming hub's handling of wakeup requests (Alan Stern)   
  - Bluetooth: bfusb: fix division by zero in send path (Johan Hovold)   
  - Linux 4.14.262 (Greg Kroah-Hartman)   
  - mISDN: change function names to avoid conflicts (wolfgang huang)   
  - net: udp: fix alignment problem in udp4_seq_show() (yangxingwu)   
  - ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate (William Zhao)   
  - scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() (Lixiaokeng)   
  - ipv6: Do cleanup if attribute validation fails in multipath route (David Ahern)   
  - ipv6: Continue processing multipath route even if gateway attribute is invalid (David Ahern)   
  - phonet: refcount leak in pep_sock_accep (Hangyu Hua)   
  - rndis_host: support Hytera digital radios (Thomas Toye)   
  - power: reset: ltc2952: Fix use of floating point literals (Nathan Chancellor)   
  - sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc (Eric Dumazet)   
  - ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route (David Ahern)   
  - ipv6: Check attribute length for RTA_GATEWAY in multipath route (David Ahern)   
  - i40e: Fix incorrect netdev's real number of RX/TX queues (Jedrzej Jagielski)   
  - i40e: fix use-after-free in i40e_sync_filters_subtask() (Di Zhu)   
  - mac80211: initialize variable have_higher_than_11mbit (Tom Rix)   
  - RDMA/core: Don't infoleak GRH fields (Leon Romanovsky)   
  - ieee802154: atusb: fix uninit value in atusb_set_extended_addr (Pavel Skripkin)   
  - virtio_pci: Support surprise removal of virtio pci device (Parav Pandit)   
  - tracing: Tag trace_percpu_buffer as a percpu pointer (Naveen N. Rao)   
  - tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() (Naveen N. Rao)   
  - Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models (Takashi Iwai)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.512.5.el7uek]
changelog:
  - netfilter: nf_tables: initialize registers in nft_do_chain() (Pablo Neira Ayuso)  [Orabug: 34012925]  {CVE-2022-1016} 
  - rds: Fix incorrect initialization order (Håkon Bugge)  [Orabug: 33923372]  
  - btrfs: unlock newly allocated extent buffer after error (Qu Wenruo)  [Orabug: 33997138]  {CVE-2021-4149} 
  - sr9700: sanity check for packet length (Oliver Neukum)  [Orabug: 33962706]  {CVE-2022-26966}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.512.6.el7uek]
changelog:
  - Revert "rds/ib: recover rds connection from stuck rx path" (Rohit Nair)  [Orabug: 34039271]  
  - uek-rpm: update kABI lists for new symbols (Saeed Mirzamohammadi)  [Orabug: 33993774]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.513.0.el7uek]
changelog:
  - rds: ib: Initialize SG table properly (Håkon Bugge)  [Orabug: 34031914]  
  - rds: ib: Fix racy credit tracepoints (Håkon Bugge)  [Orabug: 33980856]  
  - net/rds: Fix math on error code (Freddy Carrillo)  [Orabug: 33945366]  
  - ice: Add E810-XXV pci device ids to UEK5 (John Donnelly)  [Orabug: 33750110]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.513.1.el7uek]
changelog:
  - mm/page-writeback: Fix performance when BDI's share of ratio is 0. (Chi Wu)  [Orabug: 34050050]  
  - esp: Fix possible buffer overflow in ESP transformation (Steffen Klassert)  [Orabug: 33997301]  {CVE-2022-27666}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.513.2.el7uek]
changelog:
  - Revert "rds/ib: recover rds connection from stuck tx path" (Nagappan Ramasamy Palaniappan)  [Orabug: 34124234]  
  - Revert "rds/ib: reap tx completions during connection shutdown" (Nagappan Ramasamy Palaniappan)  [Orabug: 34124234]  
  - Revert "rds/ib: handle posted ACK during connection shutdown" (Nagappan Ramasamy Palaniappan)  [Orabug: 34124234]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-2047.513.2.1.el7uek]
changelog:
  - perf: Fix sys_perf_event_open() race against self (Peter Zijlstra)  [Orabug: 34175592]  {CVE-2022-1729}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.514.0.el7uek]
changelog:
  - memstick: rtsx_usb_ms: fix UAF (Tong Zhang)  [Orabug: 34132125]  {CVE-2022-0487} 
  - A/A Bonding: Allow setting rdmaip_active_bonding_failback param (Sharath Srinivasan)  [Orabug: 34130294]  
  - drm/vgem: Close use-after-free race in vgem_gem_create (Daniel Vetter)  [Orabug: 34111756]  
  - drm/vgem: Reclassify buffer creation debug message (Chris Wilson)  [Orabug: 34111756]  
  - nbd: Fix NULL pointer in flush_workqueue (Sun Ke)  [Orabug: 34111753]  
  - IB/cma: Allow XRC INI QPs to set their local ACK timeout (Håkon Bugge)  [Orabug: 34094202]  
  - vfs: make sync_filesystem return errors from ->sync_fs (Darrick J. Wong)  [Orabug: 34084997]  
  - xfs: prevent UAF in xfs_log_item_in_current_chkpt (Darrick J. Wong)  [Orabug: 34084997]  
  - xfs: check sb_meta_uuid for dabuf buffer recovery (Dave Chinner)  [Orabug: 34084997]  
  - xfs: only run COW extent recovery when there are no live extents (Darrick J. Wong)  [Orabug: 34084997]  
  - rds/ib: Fix ib_rx_total_frags while freeing frags (Praveen Kumar Kannoju)  [Orabug: 34066623]  
  - rds: ib: Force 16-byte alignment on rds_ib_device (Håkon Bugge)  [Orabug: 34043118]  
  - rds: ib: INFO: trying to register non-static key during rmmod (Freddy Carrillo)  [Orabug: 34041727]  
  - mlx4_core: calculate log_num_mtt based on total system memory (Wei Lin Guay)  [Orabug: 26526968] [Orabug: 33602562]  
  - xen/x86: Add interface for querying amount of host memory (Boris Ostrovsky)  [Orabug: 26526923] [Orabug: 33602562]  
  - Linux 4.14.276 (Greg Kroah-Hartman)   
  - i2c: pasemi: Wait for write xfers to finish (Martin Povišer)   
  - smp: Fix offline cpu check in flush_smp_call_function_queue() (Nadav Amit)   
  - ARM: davinci: da850-evm: Avoid NULL pointer dereference (Nathan Chancellor)   
  - ALSA: pcm: Test for "silence" field in struct "pcm_format_data" (Fabio M. De Francesco)   
  - gcc-plugins: latent_entropy: use /dev/urandom (Jason A. Donenfeld)   
  - mm: kmemleak: take a full lowmem check in kmemleak_*_phys() (Patrick Wang)   
  - mm, page_alloc: fix build_zonerefs_node() (Juergen Gross)   
  - drivers: net: slip: fix NPD bug in sl_tx_timeout() (Duoming Zhou)   
  - scsi: mvsas: Add PCI ID of RocketRaid 2640 (Alexey Galakhov)   
  - gpu: ipu-v3: Fix dev_dbg frequency output (Leo Ruan)   
  - ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs (Christian Lamparter)   
  - net: micrel: fix KS8851_MLL Kconfig (Randy Dunlap)   
  - scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 (Tyrel Datwyler)   
  - scsi: target: tcmu: Fix possible page UAF (Xiaoguang Wang)   
  - Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer (Michael Kelley)   
  - drm/amdkfd: Check for potential null return of kmalloc_array() (QintaoShen)   
  - drm/amd: Add USBC connector ID (Aurabindo Pillai)   
  - cifs: potential buffer overflow in handling symlinks (Harshit Mogalapalli)   
  - nfc: nci: add flush_workqueue to prevent uaf (Lin Ma)   
  - net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link (Dinh Nguyen)   
  - mlxsw: i2c: Fix initialization error flow (Vadim Pasternak)   
  - gpiolib: acpi: use correct format characters (Linus Torvalds)   
  - veth: Ensure eth header is in skb's linear part (Guillaume Nault)   
  - memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe (Miaoqian Lin)   
  - xfrm: policy: match with both mark and mask on user interfaces (Xin Long)   
  - cgroup: Use open-time cgroup namespace for process migration perm checks (Tejun Heo)   
  - cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv (Tejun Heo)   
  - cgroup: Use open-time credentials for process migraton perm checks (Tejun Heo)   
  - mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning (Waiman Long)   
  - arm64: module: remove (NOLOAD) from linker script (Fangrui Song)   
  - mm: don't skip swap entry even if zap_details specified (Peter Xu)   
  - dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error" (Vinod Koul)   
  - tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts (Arnaldo Carvalho de Melo)   
  - perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - arm64: patch_text: Fixup last cpu should be master (Guo Ren)   
  - btrfs: fix qgroup reserve overflow the qgroup limit (Ethan Lien)   
  - x86/speculation: Restore speculation related MSRs during S3 resume (Pawan Gupta)   
  - x86/pm: Save the MSR validity status at context setup (Pawan Gupta)   
  - mm/mempolicy: fix mpol_new leak in shared_policy_replace (Miaohe Lin)   
  - mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) (Paolo Bonzini)   
  - Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" (Pali Rohár)   
  - drbd: Fix five use after free bugs in get_initial_state (Lv Yunlong)   
  - drm/imx: Fix memory leak in imx_pd_connector_get_modes (José Expósito)   
  - net: stmmac: Fix unset max_speed difference between DT and non-DT platforms (Chen-Yu Tsai)   
  - scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() (Christophe JAILLET)   
  - drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire() (Dan Carpenter)   
  - mm: fix race between MADV_FREE reclaim and blkdev direct IO read (Mauricio Faria de Oliveira)   
  - net: add missing SOF_TIMESTAMPING_OPT_ID support (Willem de Bruijn)   
  - ipv6: add missing tx timestamping on IPPROTO_RAW (Willem de Bruijn)   
  - parisc: Fix CPU affinity for Lasi, WAX and Dino chips (Helge Deller)   
  - jfs: prevent NULL deref in diFree (Haimin Zhang)   
  - virtio_console: eliminate anonymous module_init & module_exit (Randy Dunlap)   
  - serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() (Jiri Slaby)   
  - NFS: swap-out must always use STABLE writes. (NeilBrown)   
  - NFS: swap IO handling is slightly different for O_DIRECT IO (NeilBrown)   
  - SUNRPC/call_alloc: async tasks mustn't block waiting for memory (NeilBrown)   
  - w1: w1_therm: fixes w1_seq for ds28ea00 sensors (Lucas Denefle)   
  - init/main.c: return 1 from handled __setup() functions (Randy Dunlap)   
  - Bluetooth: Fix use after free in hci_send_acl (Luiz Augusto von Dentz)   
  - xtensa: fix DTC warning unit_address_format (Max Filippov)   
  - usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm (H. Nikolaus Schaller)   
  - scsi: libfc: Fix use after free in fc_exch_abts_resp() (Jianglei Nie)   
  - MIPS: fix fortify panic when copying asm exception handlers (Alexander Lobakin)   
  - bnxt_en: Eliminate unintended link toggle during FW reset (Michael Chan)   
  - macvtap: advertise link netns via netlink (Sven Eckelmann)   
  - net/smc: correct settings of RMB window update limit (Dust Li)   
  - scsi: aha152x: Fix aha152x_setup() __setup handler return value (Randy Dunlap)   
  - scsi: pm8001: Fix pm8001_mpi_task_abort_resp() (Damien Le Moal)   
  - dm ioctl: prevent potential spectre v1 gadget (Jordy Zomer)   
  - iommu/arm-smmu-v3: fix event handling soft lockup (Zhou Guanghui)   
  - PCI: aardvark: Fix support for MSI interrupts (Pali Rohár)   
  - powerpc: Set crashkernel offset to mid of RMA region (Sourabh Jain)   
  - power: supply: axp20x_battery: properly report current when discharging (Evgeny Boger)   
  - scsi: bfa: Replace snprintf() with sysfs_emit() (Yang Guang)   
  - scsi: mvsas: Replace snprintf() with sysfs_emit() (Yang Guang)   
  - powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 (Maxim Kiselev)   
  - ptp: replace snprintf with sysfs_emit (Yang Guang)   
  - ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 (Zekun Shen)   
  - KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs (Jim Mattson)   
  - ARM: 9187/1: JIVE: fix return value of __setup handler (Randy Dunlap)   
  - rtc: wm8350: Handle error for wm8350_register_irq (Jiasheng Jiang)   
  - ubifs: Rectify space amount budget for mkdir/tmpfile operations (Zhihao Cheng)   
  - KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated (Vitaly Kuznetsov)   
  - openvswitch: Fixed nd target mask field in the flow dump. (Martin Varghese)   
  - ARM: dts: spear13xx: Update SPI dma properties (Kuldeep Singh)   
  - ARM: dts: spear1340: Update serial node properties (Kuldeep Singh)   
  - ASoC: topology: Allow TLV control to be either read or write (Amadeusz Sławiński)   
  - ubi: fastmap: Return error code if memory allocation fails in add_aeb() (Zhihao Cheng)   
  - mm/memcontrol: return 1 from cgroup.memory __setup() handler (Randy Dunlap)   
  - mm/mmap: return 1 from stack_guard_gap __setup() handler (Randy Dunlap)   
  - ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (Rafael J. Wysocki)   
  - ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl (Baokun Li)   
  - pinctrl: pinconf-generic: Print arguments for bias-pull-* (Chen-Yu Tsai)   
  - gfs2: Make sure FITRIM minlen is rounded up to fs block size (Andrew Price)   
  - can: mcba_usb: properly check endpoint type (Pavel Skripkin)   
  - can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path (Hangyu Hua)   
  - ubifs: rename_whiteout: correct old_dir size computing (Baokun Li)   
  - ubifs: setflags: Make dirtied_ino_d 8 bytes aligned (Zhihao Cheng)   
  - ubifs: Add missing iput if do_tmpfile() failed in rename whiteout (Zhihao Cheng)   
  - ubifs: rename_whiteout: Fix double free for whiteout_ui->data (Zhihao Cheng)   
  - KVM: Prevent module exit until all VMs are freed (David Matlack)   
  - scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() (Saurav Kashyap)   
  - powerpc/lib/sstep: Fix build errors with newer binutils (Anders Roxell)   
  - powerpc/lib/sstep: Fix 'sthcx' instruction (Anders Roxell)   
  - mmc: host: Return an error when ->enable_sdio_irq() ops is missing (Ulf Hansson)   
  - media: hdpvr: initialize dev->worker at hdpvr_register_videodev (Dongliang Mu)   
  - video: fbdev: sm712fb: Fix crash in smtcfb_write() (Zheyu Ma)   
  - ARM: mmp: Fix failure to remove sram device (Uwe Kleine-König)   
  - ARM: tegra: tamonten: Fix I2C3 pad setting (Richard Leitner)   
  - media: cx88-mpeg: clear interrupt status register before streaming video (Daniel González Cabanelas)   
  - ASoC: soc-core: skip zero num_dai component in searching dai name (Shengjiu Wang)   
  - video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() (Jing Yao)   
  - video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() (Jing Yao)   
  - ARM: dts: bcm2837: Add the missing L1/L2 cache information (Richard Schleich)   
  - ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 (David Heidelberg)   
  - video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit (Yang Guang)   
  - video: fbdev: cirrusfb: check pixclock to avoid divide by zero (George Kennedy)   
  - video: fbdev: w100fb: Reset global state (Evgeny Novikov)   
  - video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow (Tim Gardner)   
  - ntfs: add sanity check on allocation size (Dongliang Mu)   
  - ext4: don't BUG if someone dirty pages without asking ext4 first (Theodore Ts'o)   
  - spi: tegra20: Use of_device_get_match_data() (Minghao Chi)   
  - PM: core: keep irq flags in device_pm_check_callbacks() (Dmitry Baryshkov)   
  - ACPI/APEI: Limit printable size of BERT table data (Darren Hart)   
  - ACPICA: Avoid walking the ACPI Namespace if it is not there (Rafael J. Wysocki)   
  - irqchip/nvic: Release nvic_base upon failure (Souptick Joarder (HPE))   
  - Fix incorrect type in assignment of ipv6 port for audit (Casey Schaufler)   
  - loop: use sysfs_emit() in the sysfs xxx show() (Chaitanya Kulkarni)   
  - selinux: use correct type for context length (Christian Göttsche)   
  - lib/test: use after free in register_test_dev_kmod() (Dan Carpenter)   
  - NFSv4/pNFS: Fix another issue with a list iterator pointing to the head (Trond Myklebust)   
  - net/x25: Fix null-ptr-deref caused by x25_disconnect (Duoming Zhou)   
  - qlcnic: dcb: default to returning -EOPNOTSUPP (Tom Rix)   
  - net: phy: broadcom: Fix brcm_fet_config_init() (Florian Fainelli)   
  - xen: fix is_xen_pmu() (Juergen Gross)   
  - netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options (Pablo Neira Ayuso)   
  - jfs: fix divide error in dbNextAG (Pavel Skripkin)   
  - kgdbts: fix return value of __setup handler (Randy Dunlap)   
  - kgdboc: fix return value of __setup handler (Randy Dunlap)   
  - tty: hvc: fix return value of __setup handler (Randy Dunlap)   
  - pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe (Miaoqian Lin)   
  - pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe (Miaoqian Lin)   
  - pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init (Miaoqian Lin)   
  - NFS: remove unneeded check in decode_devicenotify_args() (Alexey Khoroshilov)   
  - clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver (Miaoqian Lin)   
  - clk: clps711x: Terminate clk_div_table with sentinel element (Jonathan Neuschäfer)   
  - clk: loongson1: Terminate clk_div_table with sentinel element (Jonathan Neuschäfer)   
  - remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region (Miaoqian Lin)   
  - clk: qcom: clk-rcg2: Update the frac table for pixel clock (Taniya Das)   
  - iio: adc: Add check for devm_request_threaded_irq (Jiasheng Jiang)   
  - serial: 8250: Fix race condition in RTS-after-send handling (Uwe Kleine-König)   
  - serial: 8250_mid: Balance reference count for PCI DMA device (Andy Shevchenko)   
  - staging:iio:adc:ad7280a: Fix handing of device address bit reversing. (Jonathan Cameron)   
  - pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() (Uwe Kleine-König)   
  - mxser: fix xmit_buf leak in activate when LSR == 0xff (Jiri Slaby)   
  - mfd: asic3: Add missing iounmap() on error asic3_mfd_probe (Miaoqian Lin)   
  - tcp: ensure PMTU updates are processed during fastopen (Jakub Kicinski)   
  - i2c: mux: demux-pinctrl: do not deactivate a master that is not active (Peter Rosin)   
  - af_netlink: Fix shift out of bounds in group mask calculation (Petr Machata)   
  - USB: storage: ums-realtek: fix error code in rts51x_read_mem() (Dan Carpenter)   
  - mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init (Xin Xiong)   
  - MIPS: RB532: fix return value of __setup handler (Randy Dunlap)   
  - vxcan: enable local echo for sent CAN frames (Oliver Hartkopp)   
  - mfd: mc13xxx: Add check for mc13xxx_irq_request (Jiasheng Jiang)   
  - powerpc/sysdev: fix incorrect use to determine if list is empty (Jakob Koschel)   
  - power: supply: wm8350-power: Add missing free in free_charger_irq (Jiasheng Jiang)   
  - power: supply: wm8350-power: Handle error for wm8350_register_irq (Jiasheng Jiang)   
  - i2c: xiic: Make bus names unique (Robert Hancock)   
  - KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() (Hou Wenlong)   
  - KVM: x86: Fix emulation in writing cr8 (Zhenzhong Duan)   
  - power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return (Hans de Goede)   
  - drm/tegra: Fix reference leak in tegra_dsi_ganged_probe (Miaoqian Lin)   
  - ext2: correct max file size computing (Zhang Yi)   
  - TOMOYO: fix __setup handlers return values (Randy Dunlap)   
  - scsi: pm8001: Fix abort all task initialization (Damien Le Moal)   
  - scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() (Damien Le Moal)   
  - scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() (Damien Le Moal)   
  - scsi: pm8001: Fix command initialization in pm80XX_send_read_log() (Damien Le Moal)   
  - dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS (Aashish Sharma)   
  - iwlwifi: Fix -EIO error code that is never returned (Colin Ian King)   
  - HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports (Dmitry Torokhov)   
  - power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init (Miaoqian Lin)   
  - ray_cs: Check ioremap return value (Jiasheng Jiang)   
  - power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe (Miaoqian Lin)   
  - ath9k_htc: fix uninit value bugs (Pavel Skripkin)   
  - drm/edid: Don't clear formats if using deep color (Maxime Ripard)   
  - mtd: onenand: Check for error irq (Jiasheng Jiang)   
  - ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe (Miaoqian Lin)   
  - ASoC: imx-es8328: Fix error return code in imx_es8328_probe() (Wang Wensheng)   
  - ASoC: mxs: Fix error handling in mxs_sgtl5000_probe (Miaoqian Lin)   
  - ASoC: dmaengine: do not use a NULL prepare_slave_config() callback (Codrin Ciubotariu)   
  - video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of (Miaoqian Lin)   
  - ASoC: fsi: Add check for clk_enable (Jiasheng Jiang)   
  - ASoC: wm8350: Handle error for wm8350_register_irq (Jiasheng Jiang)   
  - ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe (Miaoqian Lin)   
  - media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED (Dafna Hirschfeld)   
  - ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction (Takashi Sakamoto)   
  - memory: emif: check the pointer temp in get_device_details() (Jia-Ju Bai)   
  - memory: emif: Add check for setup_interrupts (Jiasheng Jiang)   
  - ASoC: atmel_ssc_dai: Handle errors for clk_enable (Jiasheng Jiang)   
  - ASoC: mxs-saif: Handle errors for clk_enable (Jiasheng Jiang)   
  - printk: fix return value of printk.devkmsg __setup handler (Randy Dunlap)   
  - arm64: dts: broadcom: Fix sata nodename (Frank Wunderlich)   
  - arm64: dts: ns2: Fix spi-cpol and spi-cpha property (Kuldeep Singh)   
  - ALSA: spi: Add check for clk_enable() (Jiasheng Jiang)   
  - ASoC: ti: davinci-i2s: Add check for clk_enable() (Jiasheng Jiang)   
  - media: usb: go7007: s2250-board: fix leak in probe() (Dan Carpenter)   
  - soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe (Miaoqian Lin)   
  - ARM: dts: qcom: ipq4019: fix sleep clock (Pavel Kubelun)   
  - video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() (Dan Carpenter)   
  - video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() (Wang Hai)   
  - media: coda: Fix missing put_device() call in coda_get_vdoa_data (Miaoqian Lin)   
  - perf/x86/intel/pt: Fix address filter config for 32-bit kernel (Adrian Hunter)   
  - perf/core: Fix address filter parser for multiple filters (Adrian Hunter)   
  - sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa (Bharata B Rao)   
  - clocksource: acpi_pm: fix return value of __setup handler (Randy Dunlap)   
  - hwmon: (pmbus) Add Vin unit off handling (Brandon Wyman)   
  - crypto: ccp - ccp_dmaengine_unregister release dma channels (Dāvis Mosāns)   
  - ACPI: APEI: fix return value of __setup handlers (Randy Dunlap)   
  - crypto: vmx - add missing dependencies (Petr Vorel)   
  - hwrng: atmel - disable trng on failure path (Claudiu Beznea)   
  - PM: suspend: fix return value of __setup handler (Randy Dunlap)   
  - PM: hibernate: fix __setup handler error handling (Randy Dunlap)   
  - hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING (Armin Wolf)   
  - hwmon: (pmbus) Add mutex to regulator ops (Patrick Rudolph)   
  - spi: pxa2xx-pci: Balance reference count for PCI DMA device (Andy Shevchenko)   
  - selftests/x86: Add validity check and allow field splitting (Muhammad Usama Anjum)   
  - spi: tegra114: Add missing IRQ check in tegra_spi_probe (Miaoqian Lin)   
  - crypto: mxs-dcp - Fix scatterlist processing (Tomas Paukrt)   
  - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Herbert Xu)   
  - PCI: pciehp: Clear cmd_busy bit in polling mode (Liguang Zhang)   
  - brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio (Hector Martin)   
  - brcmfmac: firmware: Allocate space for default boardrev in nvram (Hector Martin)   
  - media: davinci: vpif: fix unbalanced runtime PM get (Johan Hovold)   
  - DEC: Limit PMAX memory probing to R3k systems (Maciej W. Rozycki)   
  - lib/raid6/test: fix multiple definition linking error (Dirk Müller)   
  - thermal: int340x: Increase bitmap size (Srinivas Pandruvada)   
  - carl9170: fix missing bit-wise or operator for tx_params (Colin Ian King)   
  - ARM: dts: exynos: add missing HDMI supplies on SMDK5420 (Krzysztof Kozlowski)   
  - ARM: dts: exynos: add missing HDMI supplies on SMDK5250 (Krzysztof Kozlowski)   
  - ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 (Krzysztof Kozlowski)   
  - ARM: dts: at91: sama5d2: Fix PMERRLOC resource size (Tudor Ambarus)   
  - video: fbdev: atari: Atari 2 bpp (STe) palette bugfix (Michael Schmitz)   
  - video: fbdev: sm712fb: Fix crash in smtcfb_read() (Helge Deller)   
  - drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() (Duoming Zhou)   
  - ACPI: properties: Consistently return -ENOENT if there are no more references (Sakari Ailus)   
  - drbd: fix potential silent data corruption (Lars Ellenberg)   
  - ALSA: cs4236: fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" (José Expósito)   
  - qed: validate and restrict untrusted VFs vlan promisc mode (Manish Chopra)   
  - qed: display VF trust config (Manish Chopra)   
  - scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands (Damien Le Moal)   
  - mempolicy: mbind_range() set_policy() after vma_merge() (Hugh Dickins)   
  - mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node (Alistair Popple)   
  - jffs2: fix memory leak in jffs2_scan_medium (Baokun Li)   
  - jffs2: fix memory leak in jffs2_do_mount_fs (Baokun Li)   
  - jffs2: fix use-after-free in jffs2_clear_xattr_subsystem (Baokun Li)   
  - can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path (Hangyu Hua)   
  - pinctrl: samsung: drop pin banks references on error paths (Krzysztof Kozlowski)   
  - NFSD: prevent underflow in nfssvc_decode_writeargs() (Dan Carpenter)   
  - SUNRPC: avoid race between mod_timer() and del_timer_sync() (NeilBrown)   
  - Documentation: update stable tree link (Bagas Sanjaya)   
  - Documentation: add link to stable release candidate tree (Bagas Sanjaya)   
  - ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE (Jann Horn)   
  - clk: uniphier: Fix fixed-rate initialization (Kunihiko Hayashi)   
  - iio: inkern: make a best effort on offset calculation (Liam Beguin)   
  - iio: inkern: apply consumer scale when no channel scale is available (Liam Beguin)   
  - iio: inkern: apply consumer scale on IIO_VAL_INT cases (Liam Beguin)   
  - coresight: Fix TRCCONFIGR.QE sysfs interface (James Clark)   
  - USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c (Alan Stern)   
  - virtio-blk: Use blk_validate_block_size() to validate block size (Xie Yongji)   
  - block: Add a helper to validate the block size (Xie Yongji)   
  - tpm: fix reference counting for struct tpm_chip (Lino Sanfilippo)   
  - fuse: fix pipe buffer lifetime for direct_io (Miklos Szeredi)   
  - af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register (Haimin Zhang)   
  - spi: Fix erroneous sgs value with min_t() (Biju Das)   
  - spi: Fix invalid sgs value (Biju Das)   
  - ethernet: sun: Free the coherent when failing in probing (Zheyu Ma)   
  - virtio_console: break out of buf poll on remove (Michael S. Tsirkin)   
  - netdevice: add the case if dev is NULL (Yajun Deng)   
  - USB: serial: simple: add Nokia phone driver (Johan Hovold)   
  - USB: serial: pl2303: add IBM device IDs (Eddie James)   
  - Linux 4.14.275 (Greg Kroah-Hartman)   
  - arm64: add ID_AA64ISAR2_EL1 sys register (James Morse)   
  - arm64: entry: Add macro for reading symbol addresses from the trampoline (James Morse)   
  - arm64: entry: Add vectors that have the bhb mitigation sequences (James Morse)   
  - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations (James Morse)   
  - arm64: entry: Make the kpti trampoline's kpti sequence optional (James Morse)   
  - arm64: entry: Move trampoline macros out of ifdef'd section (James Morse)   
  - arm64: entry: Don't assume tramp_vectors is the start of the vectors (James Morse)   
  - arm64: entry: Move the trampoline data page before the text page (James Morse)   
  - arm64: entry: Make the trampoline cleanup optional (James Morse)   
  - arm64: entry.S: Add ventry overflow sanity checks (James Morse)   
  - arm64: Add Cortex-X2 CPU part definition (Anshuman Khandual)   
  - arm64: Add Neoverse-N2, Cortex-A710 CPU part definition (Suzuki K Poulose)   
  - arm64: Add part number for Arm Cortex-A77 (Rob Herring)   
  - arm64: Add part number for Neoverse N1 (Marc Zyngier)   
  - arm64: Make ARM64_ERRATUM_1188873 depend on COMPAT (Marc Zyngier)   
  - arm64: Add silicon-errata.txt entry for ARM erratum 1188873 (Marc Zyngier)   
  - arm64: arch_timer: avoid unused function warning (Arnd Bergmann)   
  - arm64: arch_timer: Add workaround for ARM erratum 1188873 (Marc Zyngier)   
  - Linux 4.14.274 (Greg Kroah-Hartman)   
  - llc: only change llc->dev when bind() succeeds (Eric Dumazet)   
  - mac80211: fix potential double free on mesh join (Linus Lüssing)   
  - crypto: qat - disable registration of algorithms (Giovanni Cabiddu)   
  - ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU (Werner Sembach)   
  - ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 (Maximilian Luz)   
  - ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board (Mark Cilissen)   
  - drivers: net: xgene: Fix regression in CRC stripping (Stephane Graber)   
  - ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec (Giacomo Guiduzzi)   
  - ALSA: cmipci: Restore aux vol on suspend/resume (Jonathan Teh)   
  - ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB (Lars-Peter Clausen)   
  - ALSA: pcm: Add stream lock during PCM reset ioctl operations (Takashi Iwai)   
  - llc: fix netdevice reference leaks in llc_ui_bind() (Eric Dumazet)   
  - thermal: int340x: fix memory leak in int3400_notify() (Chuansheng Liu)   
  - staging: fbtft: fb_st7789v: reset display before initialization (Oliver Graute)   
  - net: ipv6: fix skb_over_panic in __ip6_append_data (Tadeusz Struk)   
  - nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION (Jordy Zomer)   
  - Linux 4.14.273 (Greg Kroah-Hartman)   
  - perf symbols: Fix symbol size calculation condition (Michael Petlan)   
  - Input: aiptek - properly check endpoint type (Pavel Skripkin)   
  - usb: gadget: Fix use-after-free bug by not setting udc->dev.driver (Alan Stern)   
  - usb: gadget: rndis: prevent integer overflow in rndis_set_response() (Dan Carpenter)   
  - net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit() (Nicolas Dichtel)   
  - atm: eni: Add check for dma_map_single (Jiasheng Jiang)   
  - net/packet: fix slab-out-of-bounds access in packet_recvmsg() (Eric Dumazet)   
  - efi: fix return value of __setup handlers (Randy Dunlap)   
  - fs: sysfs_emit: Remove PAGE_SIZE alignment check (Lucas Wei)   
  - kselftest/vm: fix tests build with old libc (Chengming Zhou)   
  - sfc: extend the locking on mcdi->seqno (Niels Dossche)   
  - tcp: make tcp_read_sock() more robust (Eric Dumazet)   
  - nl80211: Update bss channel on channel switch for P2P_CLIENT (Sreeramya Soratkal)   
  - atm: firestream: check the return value of ioremap() in fs_init() (Jia-Ju Bai)   
  - can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready (Lad Prabhakar)   
  - ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE (Julian Braha)   
  - MIPS: smp: fill in sibling and core maps earlier (Alexander Lobakin)   
  - ARM: dts: rockchip: fix a typo on rk3288 crypto-controller (Corentin Labbe)   
  - arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity (Jakob Unterwurzacher)   
  - xfrm: Fix xfrm migrate issues when address family changes (Yan Yan)   
  - sctp: fix the processing for INIT_ACK chunk (Xin Long)   
  - sctp: fix the processing for INIT chunk (Xin Long)   
  - Linux 4.14.272 (Greg Kroah-Hartman)   
  - ext4: add check to prevent attempting to resize an fs with sparse_super2 (Josh Triplett)   
  - ARM: fix Thumb2 regression with Spectre BHB (Russell King (Oracle))   
  - virtio: acknowledge all features before access (Michael S. Tsirkin)   
  - virtio: unexport virtio_finalize_features (Michael S. Tsirkin)   
  - staging: gdm724x: fix use after free in gdm_lte_rx() (Dan Carpenter)   
  - ARM: Spectre-BHB: provide empty stub for non-config (Randy Dunlap)   
  - selftests/memfd: clean up mapping in mfd_fail_write (Mike Kravetz)   
  - tracing: Ensure trace buffer is at least 4096 bytes large (Sven Schnelle)   
  - Revert "xen-netback: Check for hotplug-status existence before watching" (Marek Marczykowski-Górecki)   
  - Revert "xen-netback: remove 'hotplug-status' once it has served its purpose" (Marek Marczykowski-Górecki)   
  - net-sysfs: add check for netdevice being present to speed_show (suresh kumar)   
  - sctp: fix kernel-infoleak for SCTP sockets (Eric Dumazet)   
  - gpio: ts4900: Do not set DAT and OE together (Mark Featherston)   
  - NFC: port100: fix use-after-free in port100_send_complete (Pavel Skripkin)   
  - net/mlx5: Fix size field in bufferx_reg struct (Mohammad Kabat)   
  - ax25: Fix NULL pointer dereference in ax25_kill_by_device (Duoming Zhou)   
  - net: ethernet: lpc_eth: Handle error for clk_enable (Jiasheng Jiang)   
  - net: ethernet: ti: cpts: Handle error for clk_enable (Jiasheng Jiang)   
  - ethernet: Fix error handling in xemaclite_of_probe (Miaoqian Lin)   
  - qed: return status of qed_iov_get_link (Tom Rix)   
  - net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare() (Jia-Ju Bai)   
  - Linux 4.14.271 (Greg Kroah-Hartman)   
  - xen/9p: use alloc/free_pages_exact() (Juergen Gross)   {CVE-2022-23041} 
  - xen/gntalloc: don't use gnttab_query_foreign_access() (Juergen Gross)   {CVE-2022-23039} 
  - xen/scsifront: don't use gnttab_query_foreign_access() for mapped status (Juergen Gross)   {CVE-2022-23038} 
  - xen/grant-table: add gnttab_try_end_foreign_access() (Juergen Gross)   {CVE-2022-23036} {CVE-2022-23038} 
  - xen/xenbus: don't let xenbus_grant_ring() remove grants in error case (Juergen Gross)   {CVE-2022-23040} 
  - ARM: fix build warning in proc-v7-bugs.c (Russell King (Oracle))   
  - ARM: Do not use NOCROSSREFS directive with ld.lld (Nathan Chancellor)   
  - ARM: fix co-processor register typo (Russell King (Oracle))   
  - ARM: fix build error when BPF_SYSCALL is disabled (Emmanuel Gil Peyrot)   
  - ARM: include unprivileged BPF status in Spectre V2 reporting (Russell King (Oracle))   
  - ARM: Spectre-BHB workaround (Russell King (Oracle))   
  - ARM: use LOADADDR() to get load address of sections (Russell King (Oracle))   
  - ARM: early traps initialisation (Russell King (Oracle))   
  - ARM: report Spectre v2 status through sysfs (Russell King (Oracle))   
  - arm/arm64: smccc/psci: add arm_smccc_1_1_get_conduit() (Mark Rutland)   
  - arm/arm64: Provide a wrapper for SMCCC 1.1 calls (Steven Price)   
  - x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT (Josh Poimboeuf)   
  - Linux 4.14.270 (Greg Kroah-Hartman)   
  - hamradio: fix macro redefine warning (Huang Pei)   
  - net: dcb: disable softirqs in dcbnl_flush_dev() (Vladimir Oltean)   
  - memfd: fix F_SEAL_WRITE after shmem huge page allocated (Hugh Dickins)   
  - HID: add mapping for KEY_ALL_APPLICATIONS (William Mahon)   
  - Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (Hans de Goede)   
  - Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (Hans de Goede)   
  - nl80211: Handle nla_memdup failures in handle_nan_filter (Jiasheng Jiang)   
  - net: chelsio: cxgb3: check the return value of pci_find_capability() (Jia-Ju Bai)   
  - soc: fsl: qe: Check of ioremap return value (Jiasheng Jiang)   
  - ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions (Randy Dunlap)   
  - can: gs_usb: change active_channels's type from atomic_t to u8 (Vincent Mailhol)   
  - efivars: Respect "block" flag in efivar_entry_set_safe() (Jann Horn)   
  - net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe() (Zheyu Ma)   
  - net: sxgbe: fix return value of __setup handler (Randy Dunlap)   
  - net: stmmac: fix return value of __setup handler (Randy Dunlap)   
  - mac80211: fix forwarded mesh frames AC & queue selection (Nicolas Escande)   
  - firmware: qemu_fw_cfg: fix kobject leak in probe error path (Johan Hovold)   
  - firmware: Fix a reference count leak. (Qiushi Wu)   
  - net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server (D. Wythe)   
  - net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error generated by client (D. Wythe)   
  - net: dcb: flush lingering app table entries for unregistered devices (Vladimir Oltean)   
  - batman-adv: Don't expect inter-netns unique iflink indices (Sven Eckelmann)   
  - batman-adv: Request iflink once in batadv_get_real_netdevice (Sven Eckelmann)   
  - batman-adv: Request iflink once in batadv-on-batadv check (Sven Eckelmann)   
  - netfilter: nf_queue: fix possible use-after-free (Florian Westphal)   
  - netfilter: nf_queue: don't assume sk is full socket (Florian Westphal)   
  - xfrm: enforce validity of offload input flags (Leon Romanovsky)   
  - netfilter: fix use-after-free in __nf_register_net_hook() (Eric Dumazet)   
  - xfrm: fix MTU regression (Jiri Bohac)   
  - ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min (Marek Vasut)   
  - ALSA: intel_hdmi: Fix reference to PCM buffer address (Zhen Ni)   
  - ata: pata_hpt37x: fix PCI clock detection (Sergey Shtylyov)   
  - usb: gadget: clear related members when goto fail (Hangyu Hua)   
  - usb: gadget: don't release an existing dev->buf (Hangyu Hua)   
  - net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990 (Daniele Palmas)   
  - i2c: qup: allow COMPILE_TEST (Wolfram Sang)   
  - i2c: cadence: allow COMPILE_TEST (Wolfram Sang)   
  - dmaengine: shdma: Fix runtime PM imbalance on error (Yongzhi Liu)   
  - cifs: fix double free race when mount fails in cifs_get_root() (Ronnie Sahlberg)   
  - Input: clear BTN_RIGHT/MIDDLE on buttonpads (José Expósito)   
  - i2c: bcm2835: Avoid clock stretching timeouts (Eric Anholt)   
  - mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work (JaeMan Park)   
  - mac80211_hwsim: report NOACK frames in tx_status (Benjamin Beichler)   
  - Linux 4.14.269 (Greg Kroah-Hartman)   
  - fget: clarify and improve __fget_files() implementation (Linus Torvalds)   
  - memblock: use kfree() to release kmalloced memblock regions (Miaohe Lin)   
  - Revert "drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR" (Karol Herbst)   
  - tty: n_gsm: fix proper link termination after failed open (daniel.starke@siemens.com)   
  - tty: n_gsm: fix encoding of control signal octet bit DV (daniel.starke@siemens.com)   
  - xhci: Prevent futile URB re-submissions due to incorrect return value. (Hongyu Xie)   
  - xhci: re-initialize the HC during resume if HCE was set (Puma Hsu)   
  - usb: dwc3: gadget: Let the interrupt handler disable bottom halves. (Sebastian Andrzej Siewior)   
  - USB: serial: option: add Telit LE910R1 compositions (Daniele Palmas)   
  - USB: serial: option: add support for DW5829e (Slark Xiao)   
  - tracefs: Set the group ownership in apply_options() not parse_options() (Steven Rostedt (Google))   
  - USB: gadget: validate endpoint index for xilinx udc (Szymon Heidrich)   
  - usb: gadget: rndis: add spinlock for rndis response list (Daehwan Jung)   
  - Revert "USB: serial: ch341: add new Product ID for CH341A" (Dmytro Bagrii)   
  - ata: pata_hpt37x: disable primary channel on HPT371 (Sergey Shtylyov)   
  - iio: adc: men_z188_adc: Fix a resource leak in an error handling path (Christophe JAILLET)   
  - RDMA/ib_srp: Fix a deadlock (Bart Van Assche)   
  - configfs: fix a race in configfs_{,un}register_subsystem() (ChenXiaoSong)   
  - net/mlx5e: Fix wrong return value on ioctl EEPROM query failure (Gal Pressman)   
  - drm/edid: Always set RGB444 (Maxime Ripard)   
  - openvswitch: Fix setting ipv6 fields causing hw csum failure (Paul Blakey)   
  - gso: do not skip outer ip header in case of ipip and net_failover (Tao Liu)   
  - net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends (Eric Dumazet)   
  - ping: remove pr_err from ping_lookup (Xin Long)   
  - serial: 8250: of: Fix mapped region size when using reg-offset property (Robert Hancock)   
  - USB: zaurus: support another broken Zaurus (Oliver Neukum)   
  - parisc/unaligned: Fix ldw() and stw() unalignment handlers (Helge Deller)   
  - parisc/unaligned: Fix fldd and fstd unaligned handlers on 32-bit kernel (Helge Deller)   
  - vhost/vsock: don't check owner in vhost_vsock_stop() while releasing (Stefano Garzarella)   
  - cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug (Zhang Qiao)   
  - Linux 4.14.268 (Greg Kroah-Hartman)   
  - net: macb: Align the dma and coherent dma masks (Marc St-Amand)   
  - net: usb: qmi_wwan: Add support for Dell DW5829e (Slark Xiao)   
  - tracing: Fix tp_printk option related with tp_printk_stop_on_boot (JaeSang Yoo)   
  - ata: libata-core: Disable TRIM on M88V29 (Zoltán Böszörményi)   
  - ARM: OMAP2+: hwmod: Add of_node_put() before break (Wan Jiabing)   
  - NFS: Do not report writeback errors in nfs_getattr() (Trond Myklebust)   
  - KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW (Jim Mattson)   
  - mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status (david regan)   
  - mtd: rawnand: brcmnand: Refactored code to introduce helper functions (Kamal Dasu)   
  - i2c: brcmstb: fix support for DSL and CM variants (Rafał Miłecki)   
  - dmaengine: sh: rcar-dmac: Check for error num after setting mask (Jiasheng Jiang)   
  - net: sched: limit TC_ACT_REPEAT loops (Eric Dumazet)   
  - EDAC: Fix calculation of returned address and next offset in edac_align_ptr() (Eliav Farber)   
  - NFS: LOOKUP_DIRECTORY is also ok with symlinks (Trond Myklebust)   
  - powerpc/lib/sstep: fix 'ptesync' build error (Anders Roxell)   
  - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (Mark Brown)   
  - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (Mark Brown)   
  - ALSA: hda: Fix missing codec probe on Shenker Dock 15 (Takashi Iwai)   
  - ALSA: hda: Fix regression on forced probe mask option (Takashi Iwai)   
  - libsubcmd: Fix use-after-free for realloc(..., 0) (Kees Cook)   
  - bonding: fix data-races around agg_select_timer (Eric Dumazet)   
  - drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit (Eric Dumazet)   
  - ping: fix the dif and sdif check in ping_lookup (Xin Long)   
  - net: ieee802154: ca8210: Fix lifs/sifs periods (Miquel Raynal)   
  - iwlwifi: pcie: gen2: fix locking when "HW not ready" (Johannes Berg)   
  - iwlwifi: pcie: fix locking when "HW not ready" (Johannes Berg)   
  - vsock: remove vsock from connected table when connect is interrupted by a signal (Seth Forshee)   
  - taskstats: Cleanup the use of task->exit_code (Eric W. Biederman)   
  - xfrm: Don't accidentally set RTO_ONLINK in decode_session4() (Guillaume Nault)   
  - drm/radeon: Fix backlight control on iMac 12,1 (Nicholas Bishop)   
  - iwlwifi: fix use-after-free (Johannes Berg)   
  - Revert "module, async: async_synchronize_full() on module init iff async is used" (Igor Pylypiv)   
  - quota: make dquot_quota_sync return errors from ->sync_fs (Darrick J. Wong)   
  - vfs: make freeze_super abort when sync_filesystem returns error (Darrick J. Wong)   
  - ax25: improve the incomplete fix to avoid UAF and NPD bugs (Duoming Zhou)   
  - selftests/zram: Adapt the situation that /dev/zram0 is being used (Yang Xu)   
  - selftests/zram01.sh: Fix compression ratio calculation (Yang Xu)   
  - selftests/zram: Skip max_comp_streams interface on newer kernel (Yang Xu)   
  - net: ieee802154: at86rf230: Stop leaking skb's (Miquel Raynal)   
  - btrfs: send: in case of IO error log it (Dāvis Mosāns)   
  - parisc: Fix sglist access in ccio-dma.c (John David Anglin)   
  - parisc: Fix data TLB miss in sba_unmap_sg (John David Anglin)   
  - serial: parisc: GSC: fix build when IOSAPIC is not set (Randy Dunlap)   
  - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (Jann Horn)   
  - Makefile.extrawarn: Move -Wunaligned-access to W=1 (Nathan Chancellor)   
  - Linux 4.14.267 (Greg Kroah-Hartman)   
  - perf: Fix list corruption in perf_cgroup_switch() (Song Liu)   
  - hwmon: (dell-smm) Speed up setting of fan speed (Armin Wolf)   
  - seccomp: Invalidate seccomp mode to catch death failures (Kees Cook)   
  - USB: serial: cp210x: add CPI Bulk Coin Recycler id (Johan Hovold)   
  - USB: serial: cp210x: add NCR Retail IO box id (Johan Hovold)   
  - USB: serial: ch341: add support for GW Instek USB2.0-Serial devices (Stephan Brunner)   
  - USB: serial: option: add ZTE MF286D modem (Pawel Dembicki)   
  - USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 (Cameron Williams)   
  - usb: gadget: rndis: check size of RNDIS_MSG_SET command (Greg Kroah-Hartman)   
  - USB: gadget: validate interface OS descriptor requests (Szymon Heidrich)   
  - usb: dwc3: gadget: Prevent core from processing stale TRBs (Udipto Goswami)   
  - usb: ulpi: Call of_node_put correctly (Sean Anderson)   
  - usb: ulpi: Move of_node_put to ulpi_dev_release (Sean Anderson)   
  - n_tty: wake up poll(POLLRDNORM) on receiving data (TATSUKAWA KOSUKE (立川 江介))   
  - vt_ioctl: add array_index_nospec to VT_ACTIVATE (Jakob Koschel)   
  - vt_ioctl: fix array_index_nospec in vt_setactivate (Jakob Koschel)   
  - net: amd-xgbe: disable interrupts during pci removal (Raju Rangoju)   
  - tipc: rate limit warning for received illegal binding update (Jon Maloy)   
  - net: fix a memleak when uncloning an skb dst and its metadata (Antoine Tenart)   
  - net: do not keep the dst cache when uncloning an skb dst and its metadata (Antoine Tenart)   
  - ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (Eric Dumazet)   
  - bonding: pair enable_port with slave_arr_updates (Mahesh Bandewar)   
  - usb: f_fs: Fix use-after-free for epfile (Udipto Goswami)   
  - ARM: dts: imx6qdl-udoo: Properly describe the SD card detect (Fabio Estevam)   
  - staging: fbtft: Fix error path in fbtft_driver_module_init() (Uwe Kleine-König)   
  - ARM: dts: meson: Fix the UART compatible strings (Martin Blumenstingl)   
  - ARM: dts: imx23-evk: Remove MX23_PAD_SSP1_DETECT from hog group (Fabio Estevam)   
  - Revert "net: axienet: Wait for PhyRstCmplt after core reset" (Sasha Levin)   
  - net: stmmac: dwmac-sun8i: use return val of readl_poll_timeout() (Jisheng Zhang)   
  - usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend (Amelie Delaunay)   
  - scsi: target: iscsi: Make sure the np under each tpg is unique (ZouMingzhe)   
  - NFSv4 expose nfs_parse_server_name function (Olga Kornievskaia)   
  - NFSv4 remove zero number of fs_locations entries error check (Olga Kornievskaia)   
  - NFSv4.1: Fix uninitialised variable in devicenotify (Trond Myklebust)   
  - nfs: nfs4clinet: check the return value of kstrdup() (Xiaoke Wang)   
  - NFSv4 only print the label when its queried (Olga Kornievskaia)   
  - NFSD: Clamp WRITE offsets (Chuck Lever)   
  - NFS: Fix initialisation of nfs_client cl_flags field (Trond Myklebust)   
  - net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs (Pavel Parkhomenko)   
  - mmc: sdhci-of-esdhc: Check for error num after setting mask (Jiasheng Jiang)   
  - ima: Allow template selection with ima_template[_fmt]= after ima_hash= (Roberto Sassu)   
  - ima: Remove ima_policy file before directory (Stefan Berger)   
  - integrity: check the return value of audit_log_start() (Xiaoke Wang)   
  - Linux 4.14.266 (Greg Kroah-Hartman)   
  - moxart: fix potential use-after-free on remove path (Greg Kroah-Hartman)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.514.1.el7uek]
changelog:
  - uek: kabi: Correct kABI symbols (Saeed Mirzamohammadi)  [Orabug: 34162205]  
  - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls (Takashi Iwai)  [Orabug: 34007906]  {CVE-2022-1048} 
  - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls (Takashi Iwai)  [Orabug: 34007906]  {CVE-2022-1048} 
  - ALSA: pcm: Fix races among concurrent prealloc proc writes (Takashi Iwai)  [Orabug: 34007906]  {CVE-2022-1048} 
  - ALSA: pcm: Fix races among concurrent read/write and buffer changes (Takashi Iwai)  [Orabug: 34007906]  {CVE-2022-1048} 
  - Revert "net: micrel: fix KS8851_MLL Kconfig" (Marek Vasut)   
  - Revert "net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link" (Greg Kroah-Hartman)   
  - x86/cpu: Load microcode during restore_processor_state() (Borislav Petkov)   
  - ASoC: dmaengine: Restore NULL prepare_slave_config() callback (Codrin Ciubotariu)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.514.2.el7uek]
changelog:
  - perf: Fix sys_perf_event_open() race against self (Peter Zijlstra)  [Orabug: 34207044]  {CVE-2022-1729} 
  - debug: Lock down kgdb (Stephen Brennan)  [Orabug: 34207043]  {CVE-2022-21499}


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-2047.514.4.el7uek]
changelog:
  - Add debugfs for controlling MMIO state data (Kanth Ghatraju)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21127} {CVE-2022-21125} {CVE-2022-21166} 
  - KVM: x86/speculation: Disable Fill buffer clear within guests (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation/mmio: Reuse SRBDS mitigation for SBDS (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation/srbds: Update SRBDS mitigation selection (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation/mmio: Enable CPU Fill buffer clearing on idle (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation: Add a common function for MD_CLEAR mitigation update (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - Documentation: Add documentation for Processor MMIO Stale Data (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation: Fix redundant MDS mitigation message (Waiman Long)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.515.0.el7uek]
changelog:
  - net: ip: avoid OOM kills with large UDP sends over loopback (Venkat Venkatsubra)  [Orabug: 34066209]  
  - rdmaip: Flush ARP cache after address has been cleared (Gerd Rausch)  [Orabug: 34285241]  
  - rds: Include congested flag in rds_sock struct. (Rohit Nair)  [Orabug: 34261492]  
  - cpu/hotplug: Allow the CPU in CPU_UP_PREPARE state to be brought up again. (Longpeng(Mike))  [Orabug: 34234771]  
  - x86/xen: Allow to retry if cpu_initialize_context() failed. (Boris Ostrovsky)  [Orabug: 34234771]  
  - floppy: use a statically allocated error counter (Willy Tarreau)  [Orabug: 34218640]  {CVE-2022-1652} 
  - assoc_array: Fix BUG_ON during garbage collect (Stephen Brennan)  [Orabug: 34162064]  
  - exec, elf: fix reserve_va_range() sanity check (Anthony Yznaga)  [Orabug: 32387887]  
  - exec, elf: use already allocated notes data in reserve_va_range() (Anthony Yznaga)  [Orabug: 32387887]  
  - mm: madv_doexec_flag sysctl (Anthony Yznaga)  [Orabug: 32387887]  
  - mm: introduce MADV_DOEXEC (Anthony Yznaga)  [Orabug: 32387887]  
  - exec, elf: require opt-in for accepting preserved mem (Anthony Yznaga)  [Orabug: 32387887]  
  - mm: introduce VM_EXEC_KEEP (Anthony Yznaga)  [Orabug: 32387887]  
  - mm: fail exec if stack expansion will overlap another vma (Anthony Yznaga)  [Orabug: 32387887]  
  - mm: do not assume only the stack vma exists in setup_arg_pages() (Anthony Yznaga)  [Orabug: 32387887]  
  - ELF: when loading PIE binaries check for overlap with existing mappings (Anthony Yznaga)  [Orabug: 32387887]  
  - Linux 4.14.280 (Greg Kroah-Hartman)   
  - tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe() (Yang Yingliang)   
  - ping: fix address binding wrt vrf (Nicolas Dichtel)   
  - drm/vmwgfx: Initialize drm_mode_fb_cmd2 (Zack Rusin)   
  - cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp() (Waiman Long)   
  - USB: serial: option: add Fibocom MA510 modem (Sven Schwermer)   
  - USB: serial: option: add Fibocom L610 modem (Sven Schwermer)   
  - USB: serial: qcserial: add support for Sierra Wireless EM7590 (Ethan Yang)   
  - USB: serial: pl2303: add device id for HP LM930 Display (Scott Chen)   
  - usb: cdc-wdm: fix reading stuck on device close (Sergey Ryazanov)   
  - tcp: resalt the secret every 10 seconds (Eric Dumazet)   
  - ASoC: ops: Validate input values in snd_soc_put_volsw_range() (Mark Brown)   
  - ASoC: max98090: Generate notifications on changes for custom control (Mark Brown)   
  - ASoC: max98090: Reject invalid values in custom control put() (Mark Brown)   
  - hwmon: (f71882fg) Fix negative temperature (Ji-Ze Hong (Peter Hong))   
  - net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe() (Taehee Yoo)   
  - net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending (Guangguan Wang)   
  - s390/lcs: fix variable dereferenced before check (Alexandra Winter)   
  - s390/ctcm: fix potential memory leak (Alexandra Winter)   
  - s390/ctcm: fix variable dereferenced before check (Alexandra Winter)   
  - hwmon: (ltq-cputemp) restrict it to SOC_XWAY (Randy Dunlap)   
  - mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection (Johannes Berg)   
  - netlink: do not reset transport header in netlink_recvmsg() (Eric Dumazet)   
  - ipv4: drop dst in multicast routing path (Lokesh Dhoundiyal)   
  - net: Fix features skip in for_each_netdev_feature() (Tariq Toukan)   
  - batman-adv: Don't skb_split skbuffs with frag_list (Sven Eckelmann)   
  - Linux 4.14.279 (Greg Kroah-Hartman)   
  - VFS: Fix memory leak caused by concurrently mounting fs with subtype (ChenXiaoSong)   
  - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock (Takashi Iwai)   
  - mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic() (Muchun Song)   
  - mm: hugetlb: fix missing cache flush in copy_huge_page_from_user() (Muchun Song)   
  - mmc: rtsx: add 74 Clocks in power on flow (Ricky WU)   
  - Bluetooth: Fix the creation of hdev->name (Itay Iellin)   
  - can: grcan: only use the NAPI poll budget for RX (Andreas Larsson)   
  - can: grcan: grcan_probe(): fix broken system id check for errata workaround needs (Andreas Larsson)   
  - block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit (Lee Jones)   
  - MIPS: Use address-of operator on section symbols (Nathan Chancellor)   
  - Linux 4.14.278 (Greg Kroah-Hartman)   
  - PCI: aardvark: Fix reading MSI interrupt number (Pali Rohár)   
  - PCI: aardvark: Clear all MSIs at setup (Pali Rohár)   
  - dm: interlock pending dm_io and dm_wait_for_bios_completion (Mike Snitzer)   
  - dm: fix mempool NULL pointer race when completing IO (Jiazi Li)   
  - net: ipv6: ensure we call ipv6_mc_down() at most once (j.nixdorf@avm.de)   
  - kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU (Sandipan Das)   
  - net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter() (Eric Dumazet)   
  - btrfs: always log symlinks in full mode (Filipe Manana)   
  - smsc911x: allow using IRQ0 (Sergey Shtylyov)   
  - net: emaclite: Add error handling for of_address_to_resource() (Shravya Kumbham)   
  - hwmon: (adt7470) Fix warning on module removal (Armin Wolf)   
  - NFC: netlink: fix sleep in atomic bug when firmware download timeout (Duoming Zhou)   
  - nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs (Duoming Zhou)   
  - nfc: replace improper check device_is_registered() in netlink related functions (Duoming Zhou)   
  - can: grcan: use ofdev->dev when allocating DMA memory (Daniel Hellstrom)   
  - can: grcan: grcan_close(): fix deadlock (Duoming Zhou)   
  - ASoC: wm8958: Fix change notifications for DSP controls (Mark Brown)   
  - firewire: core: extend card->lock in fw_core_handle_bus_reset (Niels Dossche)   
  - firewire: remove check of list iterator against head past the loop body (Jakob Koschel)   
  - firewire: fix potential uaf in outbound_phy_packet_callback() (Chengfeng Ye)   
  - Revert "SUNRPC: attempt AF_LOCAL connect on setup" (Trond Myklebust)   
  - ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes (Takashi Sakamoto)   
  - parisc: Merge model and model name into one line in /proc/cpuinfo (Helge Deller)   
  - MIPS: Fix CP0 counter erratum detection for R4k CPUs (Maciej W. Rozycki)   
  - tty: n_gsm: fix incorrect UA handling (Daniel Starke)   
  - tty: n_gsm: fix wrong command frame length field encoding (Daniel Starke)   
  - tty: n_gsm: fix wrong command retry handling (Daniel Starke)   
  - tty: n_gsm: fix missing explicit ldisc flush (Daniel Starke)   
  - tty: n_gsm: fix insufficient txframe size (Daniel Starke)   
  - tty: n_gsm: fix malformed counter for out of frame data (Daniel Starke)   
  - tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 (Daniel Starke)   
  - drivers: net: hippi: Fix deadlock in rr_close() (Duoming Zhou)   
  - cifs: destage any unwritten data to the server before calling copychunk_write (Ronnie Sahlberg)   
  - x86: __memcpy_flushcache: fix wrong alignment if size > 2^32 (Mikulas Patocka)   
  - ASoC: wm8731: Disable the regulator when probing fails (Zheyu Ma)   
  - bnx2x: fix napi API usage sequence (Manish Chopra)   
  - net: bcmgenet: hide status block before TX timestamping (Jonathan Lemon)   
  - clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource() (Yang Yingliang)   
  - bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create() (Christophe JAILLET)   
  - tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT (Eric Dumazet)   
  - ip_gre: Make o_seqno start from 0 in native mode (Peilin Ye)   
  - pinctrl: pistachio: fix use of irq_of_parse_and_map() (Lv Ruyi)   
  - sctp: check asoc strreset_chunk in sctp_generate_reconf_event (Xin Long)   
  - mtd: rawnand: Fix return value check of wait_for_completion_timeout (Miaoqian Lin)   
  - ipvs: correctly print the memory size of ip_vs_conn_tab (Pengcheng Yang)   
  - ARM: dts: Fix mmc order for omap3-gta04 (H. Nikolaus Schaller)   
  - ARM: OMAP2+: Fix refcount leak in omap_gic_of_init (Miaoqian Lin)   
  - phy: samsung: exynos5250-sata: fix missing device put in probe error paths (Krzysztof Kozlowski)   
  - phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe (Miaoqian Lin)   
  - ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue (Fabio Estevam)   
  - USB: Fix xhci event ring dequeue pointer ERDP update issue (Weitao Wang)   
  - hex2bin: fix access beyond string end (Mikulas Patocka)   
  - hex2bin: make the function hex_to_bin constant-time (Mikulas Patocka)   
  - serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device (Maciej W. Rozycki)   
  - serial: 8250: Also set sticky MCR bits in console restoration (Maciej W. Rozycki)   
  - usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind() (Vijayavardhan Vennapusa)   
  - usb: gadget: uvc: Fix crash when encoding data for usb request (Dan Vacura)   
  - usb: misc: fix improper handling of refcount in uss720_probe() (Hangyu Hua)   
  - iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on() (Zheyu Ma)   
  - iio: dac: ad5446: Fix read_raw not returning set value (Michael Hennerich)   
  - iio: dac: ad5592r: Fix the missing return value. (Zizhuang Deng)   
  - xhci: stop polling roothubs after shutdown (Henry Lin)   
  - USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions (Daniele Palmas)   
  - USB: serial: option: add support for Cinterion MV32-WA/MV32-WB (Slark Xiao)   
  - USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader (Bruno Thomsen)   
  - USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS (Kees Cook)   
  - USB: quirks: add STRING quirk for VCOM device (Oliver Neukum)   
  - USB: quirks: add a Realtek card reader (Oliver Neukum)   
  - usb: mtu3: fix USB 3.0 dual-role-switch from device to host (Macpaul Lin)   
  - lightnvm: disable the subsystem (Greg Kroah-Hartman)   
  - net/sched: cls_u32: fix netns refcount changes in u32_change() (Eric Dumazet)   
  - hamradio: remove needs_free_netdev to avoid UAF (Lin Ma)   
  - hamradio: defer 6pack kfree after unregister_netdev (Lin Ma)   
  - floppy: disable FDRAWCMD by default (Willy Tarreau)   
  - Linux 4.14.277 (Greg Kroah-Hartman)   
  - ax25: Fix UAF bugs in ax25 timers (Duoming Zhou)   
  - ax25: Fix NULL pointer dereferences in ax25 timers (Duoming Zhou)   
  - ax25: fix NPD bug in ax25_disconnect (Duoming Zhou)   
  - ax25: fix UAF bug in ax25_send_control() (Duoming Zhou)   
  - ax25: Fix refcount leaks caused by ax25_cb_del() (Duoming Zhou)   
  - ax25: fix UAF bugs of net_device caused by rebinding operation (Duoming Zhou)   
  - ax25: fix reference count leaks of ax25_dev (Duoming Zhou)   
  - ax25: add refcount in ax25_dev to avoid UAF bugs (Duoming Zhou)   
  - block/compat_ioctl: fix range check in BLKGETSIZE (Khazhismel Kumykov)   
  - staging: ion: Prevent incorrect reference counting behavour (Lee Jones)   
  - ext4: force overhead calculation if the s_overhead_cluster makes no sense (Theodore Ts'o)   
  - ext4: fix overhead calculation to account for the reserved gdt blocks (Theodore Ts'o)   
  - ext4: limit length to bitmap_maxbytes - blocksize in punch_hole (Tadeusz Struk)   
  - ext4: fix symlink file size not match to file content (Ye Bin)   
  - ARC: entry: fix syscall_trace_exit argument (Sergey Matyukevich)   
  - e1000e: Fix possible overflow in LTR decoding (Sasha Neftin)   
  - ASoC: soc-dapm: fix two incorrect uses of list iterator (Xiaomeng Tong)   
  - openvswitch: fix OOB access in reserve_sfa_size() (Paolo Valerio)   
  - powerpc/perf: Fix power9 event alternatives (Athira Rajeev)   
  - dma: at_xdmac: fix a missing check on list iterator (Xiaomeng Tong)   
  - ata: pata_marvell: Check the 'bmdma_addr' beforing reading (Zheyu Ma)   
  - stat: fix inconsistency between struct stat and struct compat_stat (Mikulas Patocka)   
  - net: macb: Restart tx only if queue pointer is lagging (Tomas Melin)   
  - drm/msm/mdp5: check the return of kzalloc() (Xiaoke Wang)   
  - brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant (Borislav Petkov)   
  - cifs: Check the IOCB_DIRECT flag, not O_DIRECT (David Howells)   
  - vxlan: fix error return code in vxlan_fdb_append (Hongbin Wang)   
  - ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant (Borislav Petkov)   
  - platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative (Jiapeng Chong)   
  - ARM: vexpress/spc: Avoid negative array index when !SMP (Kees Cook)   
  - netlink: reset network and mac headers in netlink_dump() (Eric Dumazet)   
  - net/packet: fix packet_sock xmit return value checking (Hangbin Liu)   
  - dmaengine: imx-sdma: Fix error checking in sdma_event_remap (Miaoqian Lin)   
  - tcp: Fix potential use-after-free due to double kfree() (Kuniyuki Iwashima)   
  - tcp: fix race condition when creating child sockets from syncookies (Ricardo Dias)   
  - ALSA: usb-audio: Clear MIDI port active flag after draining (Takashi Iwai)   
  - gfs2: assign rgrp glock before compute_bitstructs (Bob Peterson)   
  - can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path (Hangyu Hua)   
  - tracing: Dump stacktrace trigger to the corresponding instance (Daniel Bristot de Oliveira)   
  - tracing: Have traceon and traceoff trigger honor the instance (Steven Rostedt (Google))   
  - mm: page_alloc: fix building error on -Werror=array-compare (Xiongwei Song)   
  - etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead (Kees Cook)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.515.1.el7uek]
changelog:
  - sched/rt: Disable RT_RUNTIME_SHARE by default (Daniel Bristot de Oliveira)  [Orabug: 34193333]  
  - mstflint_access: Update driver code to v4.20.1-1 from Github (Qing Huang)  [Orabug: 34286148]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.515.3.el7uek]
changelog:
  - uek-rpm: Enable Pensando EMMC reset controller (Thomas Tai)  [Orabug: 34325721]  
  - mfd: pensando_elbasr: Add Pensando Elba System Resource Chip (Brad Larson)  [Orabug: 34325721]  
  - dsc-drivers: update drivers for 1.15.9-C-65 (Shannon Nelson)  [Orabug: 34325721]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.516.0.el7uek]
changelog:
  - scsi: mpt3sas: Remove scsi_dma_map() error messages (Sreekanth Reddy)  [Orabug: 34328903]  
  - uek: kabi: new protected symbols for USM in OL7 (Saeed Mirzamohammadi)  [Orabug: 34233902]  
  - vfio/type1: add ioctl to check for correct pin accounting (Anthony Yznaga)  [Orabug: 32967885]  
  - vfio/type1: track pages pinned by vfio across exec (Anthony Yznaga)  [Orabug: 32967885]  
  - mm: track driver pinned pages across exec (Anthony Yznaga)  [Orabug: 32967885]  
  - vfio/type1: Fix vfio_find_dma_valid return (Anthony Yznaga)  [Orabug: 32967885]  
  - vfio/type1: fix unmap all on ILP32 (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: block on invalid vaddr (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: implement notify callback (Steve Sistare)  [Orabug: 32967885]  
  - vfio: iommu driver notify callback (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: implement interfaces to update vaddr (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: massage unmap iteration (Steve Sistare)  [Orabug: 32967885]  
  - vfio: interfaces to update vaddr (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: implement unmap all (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: unmap cleanup (Steve Sistare)  [Orabug: 32967885]  
  - vfio: option to unmap all (Steve Sistare)  [Orabug: 32967885]  
  - Linux 4.14.284 (Greg Kroah-Hartman)   
  - x86/speculation/mmio: Print SMT warning (Josh Poimboeuf)   
  - x86/cpu: Add another Alder Lake CPU to the Intel family (Gayatri Kammela)   
  - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family (Tony Luck)   
  - x86/cpu: Add Comet Lake to the Intel CPU models header (Kan Liang)   
  - x86/cpu: Add Cannonlake to Intel family (Rajneesh Bhardwaj)   
  - x86/cpu: Add Jasper Lake to Intel family (Zhang Rui)   
  - cpu/speculation: Add prototype for cpu_show_srbds() (Guenter Roeck)   
  - x86/cpu: Add Elkhart Lake to Intel family (Gayatri Kammela)   
  - Linux 4.14.283 (Greg Kroah-Hartman)   
  - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd (Eric Dumazet)   
  - PCI: qcom: Fix unbalanced PHY init on probe errors (Johan Hovold)   
  - mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N (Tokunori Ikegami)   
  - mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write (Tokunori Ikegami)   
  - md/raid0: Ignore RAID0 layout if the second zone has only one device (Pascal Hambourg)   
  - powerpc/32: Fix overread/overwrite of thread_struct via ptrace (Michael Ellerman)   
  - Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag (Mathias Nyman)   
  - ixgbe: fix unexpected VLAN Rx in promisc mode on VF (Olivier Matz)   
  - ixgbe: fix bcast packets Rx on VF after promisc removal (Olivier Matz)   
  - nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling (Martin Faltesek)   
  - nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION (Martin Faltesek)   
  - ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files (Sergey Shtylyov)   
  - cifs: return errors during session setup during reconnects (Shyam Prasad N)   
  - ALSA: hda/conexant - Fix loopback issue with CX20632 (huangwenhui)   
  - vringh: Fix loop descriptors check in the indirect cases (Xie Yongji)   
  - nodemask: Fix return values to be unsigned (Kees Cook)   
  - nbd: fix io hung while disconnecting device (Yu Kuai)   
  - nbd: fix race between nbd_alloc_config() and module removal (Yu Kuai)   
  - nbd: call genl_unregister_family() first in nbd_cleanup() (Yu Kuai)   
  - modpost: fix undefined behavior of is_arm_mapping_symbol() (Masahiro Yamada)   
  - drm/radeon: fix a possible null pointer dereference (Gong Yuanjun)   
  - Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" (Michal Kubecek)   
  - md: protect md_unregister_thread from reentrancy (Guoqing Jiang)   
  - kernfs: Separate kernfs_pr_cont_buf and rename_lock. (Hao Luo)   
  - serial: msm_serial: disable interrupts in __msm_console_write() (John Ogness)   
  - staging: rtl8712: fix uninit-value in r871xu_drv_init() (Wang Cheng)   
  - clocksource/drivers/sp804: Avoid error on multiple instances (Andre Przywara)   
  - extcon: Modify extcon device to be created after driver data is set (bumwoo lee)   
  - misc: rtsx: set NULL intfdata when probe fails (Shuah Khan)   
  - usb: dwc2: gadget: don't reset gadget's driver->bus (Marek Szyprowski)   
  - USB: hcd-pci: Fully suspend across freeze/thaw cycle (Evan Green)   
  - drivers: usb: host: Fix deadlock in oxu_bus_suspend() (Duoming Zhou)   
  - drivers: tty: serial: Fix deadlock in sa1100_set_termios() (Duoming Zhou)   
  - USB: host: isp116x: check return value after calling platform_get_resource() (Zhen Ni)   
  - drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() (Duoming Zhou)   
  - tty: Fix a possible resource leak in icom_probe (Huang Guobin)   
  - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() (Zheyu Ma)   
  - lkdtm/usercopy: Expand size of "out of frame" object (Kees Cook)   
  - iio: dummy: iio_simple_dummy: check the return value of kstrdup() (Xiaoke Wang)   
  - drm: imx: fix compiler warning with gcc-12 (Linus Torvalds)   
  - net: altera: Fix refcount leak in altera_tse_mdio_create (Miaoqian Lin)   
  - net: ipv6: unexport __init-annotated seg6_hmac_init() (Masahiro Yamada)   
  - net: xfrm: unexport __init-annotated xfrm4_protocol_init() (Masahiro Yamada)   
  - net: mdio: unexport __init-annotated mdio_bus_init() (Masahiro Yamada)   
  - SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() (Chuck Lever)   
  - net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure (Gal Pressman)   
  - ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe (Miaoqian Lin)   
  - xprtrdma: treat all calls not a bcall when bc_serv is NULL (Kinglong Mee)   
  - video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() (Yang Yingliang)   
  - m68knommu: fix undefined reference to `_init_sp' (Greg Ungerer)   
  - m68knommu: set ZERO_PAGE() to the allocated zeroed page (Greg Ungerer)   
  - i2c: cadence: Increase timeout per message if necessary (Lucas Tanure)   
  - tracing: Avoid adding tracer option before update_tracer_options (Mark-PK Tsai)   
  - tracing: Fix sleeping function called from invalid context on RT kernel (Jun Miao)   
  - mips: cpc: Fix refcount leak in mips_cpc_default_phys_base (Gong Yuanjun)   
  - perf c2c: Fix sorting in percent_rmt_hitm_cmp() (Leo Yan)   
  - tcp: tcp_rtx_synack() can be called from process context (Eric Dumazet)   
  - ubi: ubi_create_volume: Fix use-after-free when volume creation failed (Zhihao Cheng)   
  - jffs2: fix memory leak in jffs2_do_fill_super (Baokun Li)   
  - modpost: fix removing numeric suffixes (Alexander Lobakin)   
  - net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (Miaoqian Lin)   
  - net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry() (Dan Carpenter)   
  - clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (Miaoqian Lin)   
  - serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 (Ilpo Järvinen)   
  - serial: sh-sci: Don't allow CS5-6 (Ilpo Järvinen)   
  - serial: txx9: Don't allow CS5-6 (Ilpo Järvinen)   
  - serial: digicolor-usart: Don't allow CS5-6 (Ilpo Järvinen)   
  - serial: meson: acquire port->lock in startup() (John Ogness)   
  - rtc: mt6397: check return value after calling platform_get_resource() (Yang Yingliang)   
  - soc: rockchip: Fix refcount leak in rockchip_grf_init (Miaoqian Lin)   
  - coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier (Guilherme G. Piccoli)   
  - rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - pwm: lp3943: Fix duty calculation in case period was clamped (Uwe Kleine-König)   
  - USB: storage: karma: fix rio_karma_init return (Lin Ma)   
  - usb: usbip: add missing device lock on tweak configuration cmd (Niels Dossche)   
  - usb: usbip: fix a refcount leak in stub_probe() (Hangyu Hua)   
  - tty: goldfish: Use tty_port_destroy() to destroy port (Wang Weiyang)   
  - staging: greybus: codecs: fix type confusion of list iterator variable (Jakob Koschel)   
  - pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards (Randy Dunlap)   
  - netfilter: nf_tables: disallow non-stateful expression in sets earlier (Pablo Neira Ayuso)   
  - MIPS: IP27: Remove incorrect `cpu_has_fpu' override (Maciej W. Rozycki)   
  - RDMA/rxe: Generate a completion for unsupported/invalid opcode (Xiao Yang)   
  - phy: qcom-qmp: fix reset-controller leak on probe errors (Johan Hovold)   
  - dt-bindings: gpio: altera: correct interrupt-cells (Dinh Nguyen)   
  - docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 (Akira Yokosawa)   
  - phy: qcom-qmp: fix struct clk leak on probe errors (Johan Hovold)   
  - arm64: dts: qcom: ipq8074: fix the sleep clock frequency (Kathiravan T)   
  - gma500: fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - carl9170: tx: fix an incorrect use of list iterator (Xiaomeng Tong)   
  - ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control (Mark Brown)   
  - rtl818x: Prevent using not initialized queues (Alexander Wetzel)   
  - hugetlb: fix huge_pmd_unshare address update (Mike Kravetz)   
  - nodemask.h: fix compilation error with GCC12 (Christophe de Dinechin)   
  - iommu/msm: Fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - um: Fix out-of-bounds read in LDT setup (Vincent Whitchurch)   
  - um: chan_user: Fix winch_tramp() return value (Johannes Berg)   
  - mac80211: upgrade passive scan to active scan on DFS channels after beacon rx (Felix Fietkau)   
  - irqchip: irq-xtensa-mx: fix initial IRQ affinity (Max Filippov)   
  - irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x (Pali Rohár)   
  - RDMA/hfi1: Fix potential integer multiplication overflow errors (Dennis Dalessandro)   
  - md: fix an incorrect NULL check in md_reload_sb (Xiaomeng Tong)   
  - md: fix an incorrect NULL check in does_sb_need_changing (Xiaomeng Tong)   
  - drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX (Brian Norris)   
  - drm/nouveau/clk: Fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. (Dave Airlie)   
  - scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled (Manivannan Sadhasivam)   
  - scsi: dc395x: Fix a missing check on list iterator (Xiaomeng Tong)   
  - ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock (Junxiao Bi via Ocfs2-devel)   
  - dlm: fix missing lkb refcount handling (Alexander Aring)   
  - dlm: fix plock invalid read (Alexander Aring)   
  - ext4: avoid cycles in directory h-tree (Jan Kara)   
  - ext4: verify dir block before splitting it (Jan Kara)   
  - ext4: fix bug_on in ext4_writepages (Ye Bin)   
  - ext4: fix use-after-free in ext4_rename_dir_prepare (Ye Bin)   
  - fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages (Zhihao Cheng)   
  - iwlwifi: mvm: fix assert 1F04 upon reconfig (Emmanuel Grumbach)   
  - wifi: mac80211: fix use-after-free in chanctx code (Johannes Berg)   
  - perf jevents: Fix event syntax error caused by ExtSel (Zhengjun Xing)   
  - perf c2c: Use stdio interface if slang is not supported (Leo Yan)   
  - iommu/amd: Increase timeout waiting for GA log enablement (Joerg Roedel)   
  - video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup (Miaoqian Lin)   
  - iommu/mediatek: Add list_del in mtk_iommu_remove (Yong Wu)   
  - mailbox: forward the hrtimer if not queued and under a lock (Björn Ardö)   
  - powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup (Miaoqian Lin)   
  - powerpc/perf: Fix the threshold compare group constraint for power9 (Kajol Jain)   
  - Input: sparcspkr - fix refcount leak in bbc_beep_probe (Miaoqian Lin)   
  - tty: fix deadlock caused by calling printk() under tty_port->lock (Qi Zheng)   
  - powerpc/4xx/cpm: Fix return value of __setup() handler (Randy Dunlap)   
  - powerpc/idle: Fix return value of __setup() handler (Randy Dunlap)   
  - powerpc/8xx: export 'cpm_setbrg' for modules (Randy Dunlap)   
  - drivers/base/node.c: fix compaction sysfs file leak (Miaohe Lin)   
  - pinctrl: mvebu: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() (Gustavo A. R. Silva)   
  - mfd: ipaq-micro: Fix error check return value of platform_get_irq() (Lv Ruyi)   
  - ARM: dts: bcm2835-rpi-b: Fix GPIO line names (Stefan Wahren)   
  - ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT (Phil Elwell)   
  - soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc (Miaoqian Lin)   
  - soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc (Miaoqian Lin)   
  - rxrpc: Don't try to resend the request if we're receiving the reply (David Howells)   
  - rxrpc: Fix listen() setting the bar too high for the prealloc rings (David Howells)   
  - ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() (Yang Yingliang)   
  - sctp: read sk->sk_bound_dev_if once in sctp_rcv() (Eric Dumazet)   
  - m68k: math-emu: Fix dependencies of math emulation support (Geert Uytterhoeven)   
  - Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout (Ying Hsu)   
  - media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (Pavel Skripkin)   
  - media: exynos4-is: Change clk_disable to clk_disable_unprepare (Miaoqian Lin)   
  - media: st-delta: Fix PM disable depth imbalance in delta_probe (Miaoqian Lin)   
  - regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt (Miaoqian Lin)   
  - ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe (Miaoqian Lin)   
  - media: uvcvideo: Fix missing check to determine if element is found in list (Xiaomeng Tong)   
  - drm/msm: return an error pointer in msm_gem_prime_get_sg_table() (Dan Carpenter)   
  - x86/mm: Cleanup the control_va_addr_alignment() __setup handler (Randy Dunlap)   
  - irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - x86: Fix return value of __setup handlers (Randy Dunlap)   
  - drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() (Yang Yingliang)   
  - drm/msm/hdmi: check return value after calling platform_get_resource_byname() (Yang Yingliang)   
  - drm/msm/dsi: fix error checks and return values for DSI xmit functions (Dmitry Baryshkov)   
  - x86/pm: Fix false positive kmemleak report in msr_build_context() (Matthieu Baerts)   
  - fsnotify: fix wrong lockdep annotations (Amir Goldstein)   
  - inotify: show inotify mask flags in proc fdinfo (Amir Goldstein)   
  - ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix (Dan Carpenter)   
  - spi: img-spfi: Fix pm_runtime_get_sync() error checking (Zheng Yongjun)   
  - HID: hid-led: fix maximum brightness for Dream Cheeky (Jonathan Teh)   
  - efi: Add missing prototype for efi_capsule_setup_info (Jan Kiszka)   
  - NFC: NULL out the dev->rfkill to prevent UAF (Lin Ma)   
  - spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout (Miaoqian Lin)   
  - drm/mediatek: Fix mtk_cec_mask() (Miles Chen)   
  - x86/delay: Fix the wrong asm constraint in delay_loop() (Ammar Faizi)   
  - ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe (Miaoqian Lin)   
  - ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe (Miaoqian Lin)   
  - ath9k: fix ar9003_get_eepmisc (Wenli Looi)   
  - drm: fix EDID struct for old ARM OABI format (Saeed Mirzamohammadi)   
  - RDMA/hfi1: Prevent panic when SDMA is disabled (Douglas Miller)   
  - macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled (Finn Thain)   
  - powerpc/xics: fix refcount leak in icp_opal_init() (Lv Ruyi)   
  - tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate (Vasily Averin)   
  - PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (Yicong Yang)   
  - ARM: hisi: Add missing of_node_put after of_find_compatible_node (Peng Wu)   
  - ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM (Krzysztof Kozlowski)   
  - ARM: versatile: Add missing of_node_put in dcscb_init (Peng Wu)   
  - fat: add ratelimit to fat*_ent_bread() (OGAWA Hirofumi)   
  - ARM: OMAP1: clock: Fix UART rate reporting algorithm (Janusz Krzysztofik)   
  - fs: jfs: fix possible NULL pointer dereference in dbFree() (Zixuan Fu)   
  - ARM: dts: ox820: align interrupt controller node name with dtschema (Krzysztof Kozlowski)   
  - eth: tg3: silence the GCC 12 array-bounds warning (Jakub Kicinski)   
  - rxrpc: Return an error to sendmsg if call failed (David Howells)   
  - media: exynos4-is: Fix compile warning (Kwanghoon Son)   
  - net: phy: micrel: Allow probing without .driver_data (Fabio Estevam)   
  - ASoC: rt5645: Fix errorenous cleanup order (Lin Ma)   
  - nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags (Smith, Kyle Miller (Nimble Kernel))   
  - openrisc: start CPU timer early in boot (Jason A. Donenfeld)   
  - rtlwifi: Use pr_warn instead of WARN_ONCE (Dongliang Mu)   
  - ipmi:ssif: Check for NULL msg when handling events and messages (Corey Minyard)   
  - dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC (Mikulas Patocka)   
  - s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES (Heiko Carstens)   
  - ASoC: dapm: Don't fold register value changes into notifications (Mark Brown)   
  - ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL (jianghaoran)   
  - drm/amd/pm: fix the compile warning (Evan Quan)   
  - scsi: megaraid: Fix error check return value of register_chrdev() (Lv Ruyi)   
  - media: cx25821: Fix the warning when removing the module (Zheyu Ma)   
  - media: pci: cx23885: Fix the error handling in cx23885_initdev() (Zheyu Ma)   
  - media: venus: hfi: avoid null dereference in deinit (Luca Weiss)   
  - ath9k: fix QCA9561 PA bias level (Thibaut VARÈNE)   
  - drm/amd/pm: fix double free in si_parse_power_table() (Keita Suzuki)   
  - ALSA: jack: Access input_dev under mutex (Amadeusz Sławiński)   
  - ACPICA: Avoid cache flush inside virtual machines (Kirill A. Shutemov)   
  - ipw2x00: Fix potential NULL dereference in libipw_xmit() (Haowen Bai)   
  - b43: Fix assigning negative value to unsigned variable (Haowen Bai)   
  - b43legacy: Fix assigning negative value to unsigned variable (Haowen Bai)   
  - mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue (Niels Dossche)   
  - drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes (Liu Zixian)   
  - btrfs: repair super block num_devices automatically (Qu Wenruo)   
  - btrfs: add "0x" prefix for unsupported optional features (Qu Wenruo)   
  - ptrace: Reimplement PTRACE_KILL by always sending SIGKILL (Eric W. Biederman)   
  - ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP (Eric W. Biederman)   
  - USB: new quirk for Dell Gen 2 devices (Monish Kumar R)   
  - USB: serial: option: add Quectel BG95 modem (Carl Yin(殷张成))   
  - binfmt_flat: do not stop relocating GOT entries prematurely on riscv (Niklas Cassel)   
  - Linux 4.14.282 (Greg Kroah-Hartman)   
  - bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes (Liu Jian)   
  - NFSD: Fix possible sleep during nfsd4_release_lockowner() (Chuck Lever)   
  - docs: submitting-patches: Fix crossref to 'The canonical patch format' (Akira Yokosawa)   
  - tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe() (Xiu Jianfeng)   
  - dm verity: set DM_TARGET_IMMUTABLE feature flag (Sarthak Kukreti)   
  - dm stats: add cond_resched when looping over entries (Mikulas Patocka)   
  - dm crypt: make printing of the key constant-time (Mikulas Patocka)   
  - dm integrity: fix error code in dm_integrity_ctr() (Dan Carpenter)   
  - zsmalloc: fix races between asynchronous zspage free and page migration (Sultan Alsawaf)   
  - netfilter: conntrack: re-fetch conntrack after insertion (Florian Westphal)   
  - exec: Force single empty string when argv is empty (Kees Cook)   
  - block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern (Haimin Zhang)   
  - drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency() (Gustavo A. R. Silva)   
  - drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers (Piyush Malgujar)   
  - net: ftgmac100: Disable hardware checksum on AST2600 (Joel Stanley)   
  - net: af_key: check encryption module availability consistency (Thomas Bartschies)   
  - ACPI: sysfs: Fix BERT error region memory mapping (Lorenzo Pieralisi)   
  - ACPI: sysfs: Make sparse happy about address space in use (Andy Shevchenko)   
  - secure_seq: use the 64 bits of the siphash for port offset calculation (Willy Tarreau)   
  - tcp: change source port randomizarion at connect() time (Eric Dumazet)   
  - staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan() (Denis Efremov (Oracle))   
  - x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests (Thomas Gleixner)   
  - Linux 4.14.281 (Greg Kroah-Hartman)   
  - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE"" (Linus Torvalds)   
  - swiotlb: fix info leak with DMA_FROM_DEVICE (Halil Pasic)   
  - net: atlantic: verify hw_head_ lies within TX buffer ring (Grant Grundler)   
  - net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe() (Yang Yingliang)   
  - ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one() (Yang Yingliang)   
  - mac80211: fix rx reordering with non explicit / psmp ack policy (Felix Fietkau)   
  - scsi: qla2xxx: Fix missed DMA unmap for aborted commands (Gleb Chesnokov)   
  - perf bench numa: Address compiler error on s390 (Thomas Richter)   
  - gpio: mvebu/pwm: Refuse requests with inverted polarity (Uwe Kleine-König)   
  - gpio: gpio-vf610: do not touch other bits when set the target bit (Haibo Chen)   
  - net: bridge: Clear offload_fwd_mark when passing frame up bridge interface. (Andrew Lunn)   
  - igb: skip phy status check where unavailable (Kevin Mitchell)   
  - ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 (Ard Biesheuvel)   
  - ARM: 9196/1: spectre-bhb: enable for Cortex-A15 (Ard Biesheuvel)   
  - net: af_key: add check for pfkey_broadcast in function pfkey_process (Jiasheng Jiang)   
  - NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc (Duoming Zhou)   
  - net/qla3xxx: Fix a test in ql_reset_work() (Christophe JAILLET)   
  - clk: at91: generated: consider range when calculating best rate (Codrin Ciubotariu)   
  - net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() (Zixuan Fu)   
  - net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() (Zixuan Fu)   
  - mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch() (Ulf Hansson)   
  - mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD (Ulf Hansson)   
  - mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC (Ulf Hansson)   
  - drm/dp/mst: fix a possible memory leak in fetch_monitor_name() (Hangyu Hua)   
  - ALSA: wavefront: Proper check of get_user() error (Takashi Iwai)   
  - ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() (linyujun)   
  - drbd: remove usage of list iterator variable after loop (Jakob Koschel)   
  - MIPS: lantiq: check the return value of kzalloc() (Xiaoke Wang)   
  - Input: stmfts - fix reference leak in stmfts_input_open (Zheng Yongjun)   
  - Input: add bounds checking to input_set_capability() (Jeff LaBundy)   
  - um: Cleanup syscall_handler_t definition/cast, fix warning (David Gow)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.516.1.el7uek]
changelog:
  - KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() (Vitaly Kuznetsov)  [Orabug: 34323860]  {CVE-2022-2153} 
  - KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq (Vitaly Kuznetsov)  [Orabug: 34323860]  {CVE-2022-2153} 
  - KVM: Add infrastructure and macro to mark VM as bugged (Sean Christopherson)  [Orabug: 34323860]  {CVE-2022-2153} 
  - xfs: don't use delalloc extents for COW on files with extsize hints (Christoph Hellwig)  [Orabug: 34180868]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-2047.516.1.1.el7uek]
changelog:
  - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug: 34460938]  {CVE-2022-2588}


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.516.2.el7uek]
changelog:
  - Restore "module, async: async_synchronize_full() on module init iff async is used" (Mridula Shastry)  [Orabug: 34480697]  
  - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug: 34480738]  {CVE-2022-2588}


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-2047.516.2.1.el7uek]
changelog:
  - rds: copy_from_user only once per rds_sendmsg system call (Hans Westgaard Ry)  [Orabug: 33981856]  {CVE-2022-21385}


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.516.2.3.el7uek]
changelog:
  - KVM: x86: use raw clock values consistently (Paolo Bonzini)  [Orabug: 34630475]  
  - KVM: x86: reorganize pvclock_gtod_data members (Paolo Bonzini)  [Orabug: 34630475]  
  - KVM: x86: switch KVMCLOCK base to monotonic raw clock (Marcelo Tosatti)  [Orabug: 34630475]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.517.0.el7uek]
changelog:
  - mpt3sas: Fix panic observed while accessing the hw ctx queue (Gulam Mohamed)  [Orabug: 34446738]  
  - driver: marvell: mmc: Add new bus modes overrides from DT (Wojciech Bartczak)  [Orabug: 34440004]  
  - octeontx2: mmc: Adds mechanism to modify all MMC bus modes timings (Wojciech Bartczak)  [Orabug: 34440004]  
  - rds/rdma: correctly assign the dest qp num in rds ib connection (Rohit Nair)  [Orabug: 34429478]  
  - Revert "uek-rpm: Enable config CONFIG_SCSI_MQ_DEFAULT" (Gulam Mohamed)  [Orabug: 34419153]  
  - net/rds : Adding support to print SCQ and RCQ completion vectors in rds-info. (Anand Khoje)  [Orabug: 34398210]  
  - IB/mlx5: Disable BME for unbound devices too (Håkon Bugge)  [Orabug: 34395378]  
  - net/mlx5: Rearm the FW tracer after each tracer event (Feras Daoud)  [Orabug: 34387281]  
  - net/mlx5: FW tracer, Add debug prints (Saeed Mahameed)  [Orabug: 34387281]  
  - perf script: Fix crash because of missing evsel->priv (Ravi Bangoria)  [Orabug: 34382257]  
  - net/rds: Fix a NULL dereference in rds_tcp_accept_one() (Harshit Mogalapalli)  [Orabug: 34371946]  
  - ocfs2: kill EBUSY from dlmfs_evict_inode (Junxiao Bi)  [Orabug: 34364338]  
  - ocfs2: dlmfs: don't clear USER_LOCK_ATTACHED when destroying lock (Junxiao Bi)  [Orabug: 34364338]  
  - rds: ib: Qualify RNR Retry Timer check with firmware version (Freddy Carrillo)  [Orabug: 33665743]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.517.1.el7uek]
changelog:
  - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug: 34480752]  {CVE-2022-2588} 
  - Restore "module, async: async_synchronize_full() on module init iff async is used" (Mridula Shastry)  [Orabug: 34469834]  
  - net/rds: Replace #ifdef DEBUG with CONFIG_SLUB_DEBUG (Freddy Carrillo)  [Orabug: 34405766]  
  - ext4: Move to shared i_rwsem even without dioread_nolock mount opt (Ritesh Harjani)  [Orabug: 34295843]  
  - ext4: Start with shared i_rwsem in case of DIO instead of exclusive (Ritesh Harjani)  [Orabug: 34295843]  
  - ext4: further refactoring bufferio and dio helper (Junxiao Bi)  [Orabug: 34295843]  
  - ext4: refactor ext4_file_write_iter (Junxiao Bi)  [Orabug: 34295843]  
  - xen/manage: Use orderly_reboot() to reboot (Ross Lagerwall)  [Orabug: 34211118]  
  - xen/manage: revert "xen/manage: enable C_A_D to force reboot" (Dongli Zhang)  [Orabug: 34211118]  
  - Linux 4.14.288 (Greg Kroah-Hartman)   
  - dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate (Miaoqian Lin)   
  - dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (Miaoqian Lin)   
  - dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly (Michael Walle)   
  - ida: don't use BUG_ON() for debugging (Linus Torvalds)   
  - i2c: cadence: Unregister the clk notifier in error path (Satish Nagireddy)   
  - pinctrl: sunxi: a83t: Fix NAND function name for some pins (Samuel Holland)   
  - xfs: remove incorrect ASSERT in xfs_rename (Eric Sandeen)   
  - powerpc/powernv: delay rng platform device creation until later in boot (Jason A. Donenfeld)   
  - video: of_display_timing.h: include errno.h (Hsin-Yi Wang)   
  - fbcon: Disallow setting font bigger than screen size (Helge Deller)   
  - iommu/vt-d: Fix PCI bus rescan device hot add (Yian Chen)   
  - net: rose: fix UAF bug caused by rose_t0timer_expiry (Duoming Zhou)   
  - usbnet: fix memory leak in error case (Oliver Neukum)   
  - can: gs_usb: gs_usb_open/close(): fix memory leak (Rhett Aultman)   
  - can: grcan: grcan_probe(): remove extra of_node_get() (Liang He)   
  - mm/slub: add missing TID updates on slab deactivation (Jann Horn)   
  - esp: limit skb_page_frag_refill use to a single page (Sabrina Dubroca)   
  - Linux 4.14.287 (Greg Kroah-Hartman)   
  - xen/gntdev: Avoid blocking in unmap_grant_pages() (Demi Marie Obenour)   
  - net: usb: qmi_wwan: add Telit 0x1070 composition (Daniele Palmas)   
  - net: usb: qmi_wwan: add Telit 0x1060 composition (Carlo Lobrano)   
  - xen/arm: Fix race in RB-tree based P2M accounting (Oleksandr Tyshchenko)   
  - net: Rename and export copy_skb_header (Ilya Lesokhin)   
  - ipv6/sit: fix ipip6_tunnel_get_prl return value (katrinzhou)   
  - sit: use min (kernel test robot)   
  - hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails (Yang Yingliang)   
  - NFC: nxp-nci: Don't issue a zero length i2c_master_read() (Michael Walle)   
  - nfc: nfcmrvl: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - net: bonding: fix use-after-free after 802.3ad slave unbind (Yevhen Orlov)   
  - net: bonding: fix possible NULL deref in rlb code (Eric Dumazet)   
  - netfilter: nft_dynset: restore set element counter when failing to update (Pablo Neira Ayuso)   
  - caif_virtio: fix race between virtio_device_ready() and ndo_open() (Jason Wang)   
  - net: ipv6: unexport __init-annotated seg6_hmac_net_init() (YueHaibing)   
  - usbnet: fix memory allocation in helpers (Oliver Neukum)   
  - RDMA/qedr: Fix reporting QP timeout attribute (Kamal Heib)   
  - net: usb: ax88179_178a: Fix packet receiving (Jose Alonso)   
  - net: rose: fix UAF bugs caused by timer handler (Duoming Zhou)   
  - SUNRPC: Fix READ_PLUS crasher (Chuck Lever)   
  - s390/archrandom: simplify back to earlier design and initialize earlier (Jason A. Donenfeld)   
  - dm raid: fix KASAN warning in raid5_add_disks (Mikulas Patocka)   
  - dm raid: fix accesses beyond end of raid member array (Heinz Mauelshagen)   
  - nvdimm: Fix badblocks clear off-by-one error (Chris Ye)   
  - Linux 4.14.286 (Greg Kroah-Hartman)   
  - swiotlb: skip swiotlb_bounce when orig_addr is zero (Liu Shixin)   
  - kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] (Naveen N. Rao)   
  - fdt: Update CRC check for rng-seed (Hsin-Yi Wang)   
  - xen: unexport __init-annotated xen_xlate_map_ballooned_pages() (Masahiro Yamada)   
  - drm: remove drm_fb_helper_modinit (Christoph Hellwig)   
  - powerpc/pseries: wire up rng during setup_arch() (Jason A. Donenfeld)   
  - modpost: fix section mismatch check for exported init/exit sections (Masahiro Yamada)   
  - ARM: cns3xxx: Fix refcount leak in cns3xxx_init (Miaoqian Lin)   
  - ARM: Fix refcount leak in axxia_boot_secondary (Miaoqian Lin)   
  - ARM: exynos: Fix refcount leak in exynos_map_pmu (Miaoqian Lin)   
  - ARM: dts: imx6qdl: correct PU regulator ramp delay (Lucas Stach)   
  - powerpc/powernv: wire up rng during setup_arch (Jason A. Donenfeld)   
  - powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address (Andrew Donnellan)   
  - powerpc: Enable execve syscall exit tracepoint (Naveen N. Rao)   
  - xtensa: Fix refcount leak bug in time.c (Liang He)   
  - xtensa: xtfpga: Fix refcount leak bug in setup (Liang He)   
  - iio: adc: axp288: Override TS pin bias current for some models (Hans de Goede)   
  - iio: trigger: sysfs: fix use-after-free on remove (Vincent Whitchurch)   
  - iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up() (Zheyu Ma)   
  - iio: accel: mma8452: ignore the return value of reset operation (Haibo Chen)   
  - iio:accel:bma180: rearrange iio trigger get and register (Dmitry Rokosov)   
  - usb: chipidea: udc: check request status before setting device address (Xu Yang)   
  - iio: adc: vf610: fix conversion mode sysfs node name (Baruch Siach)   
  - igb: Make DMA faster when CPU is active on the PCIe link (Kai-Heng Feng)   
  - MIPS: Remove repetitive increase irq_err_count (huhai)   
  - x86/xen: Remove undefined behavior in setup_features() (Julien Grall)   
  - bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers (Jay Vosburgh)   
  - USB: serial: option: add Quectel RM500K module support (Macpaul Lin)   
  - USB: serial: option: add Quectel EM05-G modem (Yonglin Tan)   
  - USB: serial: option: add Telit LE910Cx 0x1250 composition (Carlo Lobrano)   
  - random: quiet urandom warning ratelimit suppression message (Jason A. Donenfeld)   
  - dm era: commit metadata in postsuspend after worker stops (Nikos Tsironis)   
  - ata: libata: add qc->flags in ata_qc_complete_template tracepoint (Edward Wu)   
  - random: schedule mix_interrupt_randomness() less often (Jason A. Donenfeld)   
  - vt: drop old FONT ioctls (Jiri Slaby)   
  - Linux 4.14.285 (Greg Kroah-Hartman)   
  - tcp: drop the hash_32() part from the index calculation (Willy Tarreau)   
  - tcp: increase source port perturb table to 2^16 (Willy Tarreau)   
  - tcp: dynamically allocate the perturb table used by source ports (Willy Tarreau)   
  - tcp: add small random increments to the source port (Willy Tarreau)   
  - tcp: use different parts of the port_offset for index and offset (Willy Tarreau)   
  - tcp: add some entropy in __inet_hash_connect() (Eric Dumazet)   
  - xprtrdma: fix incorrect header size calculations (Colin Ian King)   
  - usb: gadget: u_ether: fix regression in setting fixed MAC address (Marian Postevca)   
  - s390/mm: use non-quiescing sske for KVM switch to keyed guest (Christian Borntraeger)   
  - virtio-pci: Remove wrong address verification in vp_del_vqs() (Murilo Opsfelder Araujo)   
  - ext4: add reserved GDT blocks check (Zhang Yi)   
  - ext4: make variable "count" signed (Ding Xiang)   
  - ext4: fix bug_on ext4_mb_use_inode_pa (Baokun Li)   
  - serial: 8250: Store to lsr_save_flags after lsr read (Ilpo Järvinen)   
  - usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe (Miaoqian Lin)   
  - usb: dwc2: Fix memory leak in dwc2_hcd_init (Miaoqian Lin)   
  - USB: serial: io_ti: add Agilent E5805A support (Robert Eckelmann)   
  - USB: serial: option: add support for Cinterion MV31 with new baseline (Slark Xiao)   
  - comedi: vmk80xx: fix expression for tx buffer size (Ian Abbott)   
  - irqchip/gic/realview: Fix refcount leak in realview_gic_of_init (Miaoqian Lin)   
  - certs/blacklist_hashes.c: fix const confusion in certs blacklist (Masahiro Yamada)   
  - arm64: ftrace: fix branch range checks (Mark Rutland)   
  - net: bgmac: Fix an erroneous kfree() in bgmac_remove() (Christophe JAILLET)   
  - misc: atmel-ssc: Fix IRQ check in ssc_probe (Miaoqian Lin)   
  - tty: goldfish: Fix free_irq() on remove (Vincent Whitchurch)   
  - i40e: Fix call trace in setup_tx_descriptors (Aleksandr Loktionov)   
  - pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE (Trond Myklebust)   
  - random: credit cpu and bootloader seeds by default (Jason A. Donenfeld)   
  - net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag (Chen Lin)   
  - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg (Wang Yufen)   
  - nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (Xiaohui Zhang)   
  - virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed (chengkaitao)   
  - scsi: pmcraid: Fix missing resource cleanup in error case (Chengguang Xu)   
  - scsi: ipr: Fix missing/incorrect resource cleanup in error case (Chengguang Xu)   
  - scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology (James Smart)   
  - scsi: vmw_pvscsi: Expand vcpuHint to 16 bits (Wentao Wang)   
  - ASoC: wm8962: Fix suspend while playing music (Adam Ford)   
  - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (Sergey Shtylyov)   
  - ASoC: cs42l56: Correct typo in minimum level for SX volume controls (Charles Keepax)   
  - ASoC: cs42l52: Correct TLV for Bypass Volume (Charles Keepax)   
  - ASoC: cs53l30: Correct number of volume levels on SX controls (Charles Keepax)   
  - ASoC: cs42l52: Fix TLV scales for mixer controls (Charles Keepax)   
  - random: account for arch randomness in bits (Jason A. Donenfeld)   
  - random: mark bootloader randomness code as __init (Jason A. Donenfeld)   
  - random: avoid checking crng_ready() twice in random_init() (Jason A. Donenfeld)   
  - crypto: drbg - make reseeding from get_random_bytes() synchronous (Nicolai Stange)   
  - crypto: drbg - always try to free Jitter RNG instance (Stephan Müller)   
  - crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed() (Nicolai Stange)   
  - crypto: drbg - track whether DRBG was seeded with !rng_is_initialized() (Nicolai Stange)   
  - crypto: drbg - prepare for more fine-grained tracking of seeding state (Nicolai Stange)   
  - crypto: drbg - always seeded with SP800-90B compliant noise source (Stephan Müller)   
  - crypto: drbg - add FIPS 140-2 CTRNG for noise source (Stephan Mueller)   
  - Revert "random: use static branch for crng_ready()" (Jason A. Donenfeld)   
  - random: check for signals after page of pool writes (Jason A. Donenfeld)   
  - random: wire up fops->splice_{read,write}_iter() (Jens Axboe)   
  - random: convert to using fops->write_iter() (Jens Axboe)   
  - random: move randomize_page() into mm where it belongs (Jason A. Donenfeld)   
  - random: move initialization functions out of hot pages (Jason A. Donenfeld)   
  - random: use proper jiffies comparison macro (Jason A. Donenfeld)   
  - random: use symbolic constants for crng_init states (Jason A. Donenfeld)   
  - siphash: use one source of truth for siphash permutations (Jason A. Donenfeld)   
  - random: help compiler out with fast_mix() by using simpler arguments (Jason A. Donenfeld)   
  - random: do not use input pool from hard IRQs (Saeed Mirzamohammadi)   
  - random: order timer entropy functions below interrupt functions (Jason A. Donenfeld)   
  - random: do not pretend to handle premature next security model (Jason A. Donenfeld)   
  - random: do not use batches when !crng_ready() (Jason A. Donenfeld)   
  - random: insist on random_get_entropy() existing in order to simplify (Jason A. Donenfeld)   
  - xtensa: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - sparc: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - um: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - x86/tsc: Use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - nios2: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - arm: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - mips: use fallback for random_get_entropy() instead of just c0 random (Jason A. Donenfeld)   
  - m68k: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - timekeeping: Add raw clock fallback for random_get_entropy() (Jason A. Donenfeld)   
  - powerpc: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - alpha: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - parisc: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - s390: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - ia64: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - init: call time_init() before rand_initialize() (Jason A. Donenfeld)   
  - random: fix sysctl documentation nits (Jason A. Donenfeld)   
  - random: document crng_fast_key_erasure() destination possibility (Jason A. Donenfeld)   
  - random: make random_get_entropy() return an unsigned long (Jason A. Donenfeld)   
  - random: check for signals every PAGE_SIZE chunk of /dev/[u]random (Jason A. Donenfeld)   
  - random: check for signal_pending() outside of need_resched() check (Jann Horn)   
  - random: do not allow user to keep crng key around on stack (Jason A. Donenfeld)   
  - random: do not split fast init input in add_hwgenerator_randomness() (Jan Varho)   
  - random: mix build-time latent entropy into pool at init (Jason A. Donenfeld)   
  - random: re-add removed comment about get_random_{u32,u64} reseeding (Jason A. Donenfeld)   
  - random: treat bootloader trust toggle the same way as cpu trust toggle (Jason A. Donenfeld)   
  - random: skip fast_init if hwrng provides large chunk of entropy (Jason A. Donenfeld)   
  - random: check for signal and try earlier when generating entropy (Jason A. Donenfeld)   
  - random: reseed more often immediately after booting (Jason A. Donenfeld)   
  - random: make consistent usage of crng_ready() (Jason A. Donenfeld)   
  - random: use SipHash as interrupt entropy accumulator (Jason A. Donenfeld)   
  - random: replace custom notifier chain with standard one (Jason A. Donenfeld)   
  - random: don't let 644 read-only sysctls be written to (Jason A. Donenfeld)   
  - random: give sysctl_random_min_urandom_seed a more sensible value (Jason A. Donenfeld)   
  - random: do crng pre-init loading in worker rather than irq (Jason A. Donenfeld)   
  - random: unify cycles_t and jiffies usage and types (Jason A. Donenfeld)   
  - random: cleanup UUID handling (Jason A. Donenfeld)   
  - random: only wake up writers after zap if threshold was passed (Jason A. Donenfeld)   
  - random: round-robin registers as ulong, not u32 (Jason A. Donenfeld)   
  - random: pull add_hwgenerator_randomness() declaration into random.h (Jason A. Donenfeld)   
  - random: check for crng_init == 0 in add_device_randomness() (Jason A. Donenfeld)   
  - random: unify early init crng load accounting (Jason A. Donenfeld)   
  - random: do not take pool spinlock at boot (Jason A. Donenfeld)   
  - random: defer fast pool mixing to worker (Jason A. Donenfeld)   
  - random: rewrite header introductory comment (Jason A. Donenfeld)   
  - random: group sysctl functions (Jason A. Donenfeld)   
  - random: group userspace read/write functions (Jason A. Donenfeld)   
  - random: group entropy collection functions (Jason A. Donenfeld)   
  - random: group entropy extraction functions (Jason A. Donenfeld)   
  - random: remove useless header comment (Jason A. Donenfeld)   
  - random: introduce drain_entropy() helper to declutter crng_reseed() (Jason A. Donenfeld)   
  - random: deobfuscate irq u32/u64 contributions (Jason A. Donenfeld)   
  - random: add proper SPDX header (Jason A. Donenfeld)   
  - random: remove unused tracepoints (Jason A. Donenfeld)   
  - random: remove ifdef'd out interrupt bench (Jason A. Donenfeld)   
  - random: tie batched entropy generation to base_crng generation (Jason A. Donenfeld)   
  - random: zero buffer after reading entropy from userspace (Jason A. Donenfeld)   
  - random: remove outdated INT_MAX >> 6 check in urandom_read() (Jason A. Donenfeld)   
  - random: use hash function for crng_slow_load() (Jason A. Donenfeld)   
  - random: absorb fast pool into input pool after fast load (Jason A. Donenfeld)   
  - random: do not xor RDRAND when writing into /dev/random (Jason A. Donenfeld)   
  - random: ensure early RDSEED goes through mixer on init (Jason A. Donenfeld)   
  - random: inline leaves of rand_initialize() (Jason A. Donenfeld)   
  - random: use RDSEED instead of RDRAND in entropy extraction (Jason A. Donenfeld)   
  - random: fix locking in crng_fast_load() (Dominik Brodowski)   
  - random: remove batched entropy locking (Jason A. Donenfeld)   
  - random: remove use_input_pool parameter from crng_reseed() (Eric Biggers)   
  - random: make credit_entropy_bits() always safe (Jason A. Donenfeld)   
  - random: always wake up entropy writers after extraction (Jason A. Donenfeld)   
  - random: use linear min-entropy accumulation crediting (Jason A. Donenfeld)   
  - random: simplify entropy debiting (Jason A. Donenfeld)   
  - random: use computational hash for entropy extraction (Jason A. Donenfeld)   
  - random: only call crng_finalize_init() for primary_crng (Dominik Brodowski)   
  - random: access primary_pool directly rather than through pointer (Dominik Brodowski)   
  - random: continually use hwgenerator randomness (Dominik Brodowski)   
  - random: simplify arithmetic function flow in account() (Jason A. Donenfeld)   
  - random: access input_pool_data directly rather than through pointer (Jason A. Donenfeld)   
  - random: cleanup fractional entropy shift constants (Jason A. Donenfeld)   
  - random: prepend remaining pool constants with POOL_ (Jason A. Donenfeld)   
  - random: de-duplicate INPUT_POOL constants (Jason A. Donenfeld)   
  - random: remove unused OUTPUT_POOL constants (Jason A. Donenfeld)   
  - random: rather than entropy_store abstraction, use global (Jason A. Donenfeld)   
  - random: try to actively add entropy rather than passively wait for it (Linus Torvalds)   
  - random: remove unused extract_entropy() reserved argument (Jason A. Donenfeld)   
  - random: remove incomplete last_data logic (Jason A. Donenfeld)   
  - random: cleanup integer types (Jason A. Donenfeld)   
  - crypto: chacha20 - Fix chacha20_block() keystream alignment (again) (Eric Biggers)   
  - random: cleanup poolinfo abstraction (Jason A. Donenfeld)   
  - random: fix typo in comments (Schspa Shi)   
  - random: don't reset crng_init_cnt on urandom_read() (Jann Horn)   
  - random: avoid superfluous call to RDRAND in CRNG extraction (Jason A. Donenfeld)   
  - random: early initialization of ChaCha constants (Dominik Brodowski)   
  - random: initialize ChaCha20 constants with correct endianness (Eric Biggers)   
  - random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs (Jason A. Donenfeld)   
  - random: harmonize "crng init done" messages (Dominik Brodowski)   
  - random: mix bootloader randomness into pool (Jason A. Donenfeld)   
  - random: do not re-init if crng_reseed completes before primary init (Jason A. Donenfeld)   
  - random: do not sign extend bytes for rotation when mixing (Jason A. Donenfeld)   
  - random: use BLAKE2s instead of SHA1 in extraction (Jason A. Donenfeld)   
  - random: remove unused irq_flags argument from add_interrupt_randomness() (Saeed Mirzamohammadi)   
  - random: document add_hwgenerator_randomness() with other input functions (Mark Brown)   
  - crypto: blake2s - adjust include guard naming (Eric Biggers)   
  - crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h> (Eric Biggers)   
  - MAINTAINERS: co-maintain random.c (Jason A. Donenfeld)   
  - random: remove dead code left over from blocking pool (Eric Biggers)   
  - random: avoid arch_get_random_seed_long() when collecting IRQ randomness (Ard Biesheuvel)   
  - random: add arch_get_random_*long_early() (Mark Rutland)   
  - powerpc: Use bool in archrandom.h (Richard Henderson)   
  - linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check (Richard Henderson)   
  - linux/random.h: Use false with bool (Richard Henderson)   
  - linux/random.h: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - s390: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - powerpc: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - x86: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - random: avoid warnings for !CONFIG_NUMA builds (Mark Rutland)   
  - random: split primary/secondary crng init paths (Mark Rutland)   
  - random: remove some dead code of poolinfo (Yangtao Li)   
  - random: fix typo in add_timer_randomness() (Yangtao Li)   
  - random: Add and use pr_fmt() (Yangtao Li)   
  - random: convert to ENTROPY_BITS for better code readability (Yangtao Li)   
  - random: remove unnecessary unlikely() (Yangtao Li)   
  - random: remove kernel.random.read_wakeup_threshold (Andy Lutomirski)   
  - random: delete code to pull data into pools (Andy Lutomirski)   
  - random: remove the blocking pool (Andy Lutomirski)   
  - random: fix crash on multiple early calls to add_bootloader_randomness() (Dominik Brodowski)   
  - char/random: silence a lockdep splat with printk() (Sergey Senozhatsky)   
  - random: make /dev/random be almost like /dev/urandom (Andy Lutomirski)   
  - random: ignore GRND_RANDOM in getentropy(2) (Andy Lutomirski)   
  - random: add GRND_INSECURE to return best-effort non-cryptographic bytes (Andy Lutomirski)   
  - random: Add a urandom_read_nowait() for random APIs that don't warn (Andy Lutomirski)   
  - random: Don't wake crng_init_wait when crng_init == 1 (Andy Lutomirski)   
  - lib/crypto: sha1: re-roll loops to reduce code size (Jason A. Donenfeld)   
  - lib/crypto: blake2s: move hmac construction into wireguard (Jason A. Donenfeld)   
  - crypto: blake2s - generic C library implementation and selftest (Jason A. Donenfeld)   
  - crypto: Deduplicate le32_to_cpu_array() and cpu_to_le32_array() (Andy Shevchenko)   
  - Revert "hwrng: core - Freeze khwrng thread during suspend" (Herbert Xu)   
  - char/random: Add a newline at the end of the file (Borislav Petkov)   
  - random: Use wait_event_freezable() in add_hwgenerator_randomness() (Stephen Boyd)   
  - fdt: add support for rng-seed (Hsin-Yi Wang)   
  - random: Support freezable kthreads in add_hwgenerator_randomness() (Stephen Boyd)   
  - random: fix soft lockup when trying to read from an uninitialized blocking pool (Theodore Ts'o)   
  - latent_entropy: avoid build error when plugin cflags are not set (Vasily Gorbik)   
  - random: document get_random_int() family (George Spelvin)   
  - random: move rand_initialize() earlier (Kees Cook)   
  - random: only read from /dev/random after its pool has received 128 bits (Theodore Ts'o)   
  - drivers/char/random.c: make primary_crng static (Rasmus Villemoes)   
  - drivers/char/random.c: remove unused stuct poolinfo::poolbits (Rasmus Villemoes)   
  - drivers/char/random.c: constify poolinfo_table (Rasmus Villemoes)   
  - random: make CPU trust a boot parameter (Kees Cook)   
  - random: Make crng state queryable (Jason A. Donenfeld)   
  - random: remove preempt disabled region (Ingo Molnar)   
  - random: add a config option to trust the CPU's hwrng (Theodore Ts'o)   
  - random: Return nbytes filled from hw RNG (Tobin C. Harding)   
  - random: Fix whitespace pre random-bytes work (Tobin C. Harding)   
  - drivers/char/random.c: remove unused dont_count_entropy (Rasmus Villemoes)   
  - random: optimize add_interrupt_randomness (Andi Kleen)   
  - random: always fill buffer in get_random_bytes_wait (Jason A. Donenfeld)   
  - crypto: chacha20 - Fix keystream alignment for chacha20_block() (Eric Biggers)   
  - 9p: missing chunk of "fs/9p: Don't update file type when updating file attributes" (Al Viro)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.517.2.el7uek]
changelog:
  - kernfs: Replace global kernfs_open_file_mutex with hashed mutexes. (Imran Khan)  [Orabug: 34476942]  
  - kernfs: Introduce interface to access global kernfs_open_file_mutex. (Imran Khan)  [Orabug: 34476942]  
  - kernfs: make ->attr.open RCU protected. (Imran Khan)  [Orabug: 34476942]  
  - kernfs: Rename kernfs_put_open_node to kernfs_unlink_open_file. (Imran Khan)  [Orabug: 34476942]  
  - kernfs: Remove reference counting for kernfs_open_node. (Imran Khan)  [Orabug: 34476942]  
  - rds/ib: handle posted ACK during connection shutdown (Rohit Nair)  [Orabug: 34465810]  
  - rds/ib: reap tx completions during connection shutdown (Rohit Nair)  [Orabug: 34465810]  
  - scsi: target: Fix WRITE_SAME No Data Buffer crash (Mike Christie)  [Orabug: 34419972]  {CVE-2022-21546} 
  - rds/rdma: destroy CQs during user initiated rds connection resets (Rohit Nair)  [Orabug: 34414240]  
  - rds: copy_from_user only once per rds_sendmsg system call (Hans Westgaard Ry)  [Orabug: 34510858]  {CVE-2022-21385}


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.517.3.el7uek]
changelog:
  - KVM: x86: use raw clock values consistently (Paolo Bonzini)  [Orabug: 34575637]  
  - KVM: x86: reorganize pvclock_gtod_data members (Paolo Bonzini)  [Orabug: 34575637]  
  - KVM: x86: switch KVMCLOCK base to monotonic raw clock (Marcelo Tosatti)  [Orabug: 34575637]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.517.1.el7uek]
changelog:
  - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug: 34480752]  {CVE-2022-2588} 
  - Restore "module, async: async_synchronize_full() on module init iff async is used" (Mridula Shastry)  [Orabug: 34469834]  
  - net/rds: Replace #ifdef DEBUG with CONFIG_SLUB_DEBUG (Freddy Carrillo)  [Orabug: 34405766]  
  - ext4: Move to shared i_rwsem even without dioread_nolock mount opt (Ritesh Harjani)  [Orabug: 34295843]  
  - ext4: Start with shared i_rwsem in case of DIO instead of exclusive (Ritesh Harjani)  [Orabug: 34295843]  
  - ext4: further refactoring bufferio and dio helper (Junxiao Bi)  [Orabug: 34295843]  
  - ext4: refactor ext4_file_write_iter (Junxiao Bi)  [Orabug: 34295843]  
  - xen/manage: Use orderly_reboot() to reboot (Ross Lagerwall)  [Orabug: 34211118]  
  - xen/manage: revert "xen/manage: enable C_A_D to force reboot" (Dongli Zhang)  [Orabug: 34211118]  
  - Linux 4.14.288 (Greg Kroah-Hartman)   
  - dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate (Miaoqian Lin)   
  - dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (Miaoqian Lin)   
  - dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly (Michael Walle)   
  - ida: don't use BUG_ON() for debugging (Linus Torvalds)   
  - i2c: cadence: Unregister the clk notifier in error path (Satish Nagireddy)   
  - pinctrl: sunxi: a83t: Fix NAND function name for some pins (Samuel Holland)   
  - xfs: remove incorrect ASSERT in xfs_rename (Eric Sandeen)   
  - powerpc/powernv: delay rng platform device creation until later in boot (Jason A. Donenfeld)   
  - video: of_display_timing.h: include errno.h (Hsin-Yi Wang)   
  - fbcon: Disallow setting font bigger than screen size (Helge Deller)   
  - iommu/vt-d: Fix PCI bus rescan device hot add (Yian Chen)   
  - net: rose: fix UAF bug caused by rose_t0timer_expiry (Duoming Zhou)   
  - usbnet: fix memory leak in error case (Oliver Neukum)   
  - can: gs_usb: gs_usb_open/close(): fix memory leak (Rhett Aultman)   
  - can: grcan: grcan_probe(): remove extra of_node_get() (Liang He)   
  - mm/slub: add missing TID updates on slab deactivation (Jann Horn)   
  - esp: limit skb_page_frag_refill use to a single page (Sabrina Dubroca)   
  - Linux 4.14.287 (Greg Kroah-Hartman)   
  - xen/gntdev: Avoid blocking in unmap_grant_pages() (Demi Marie Obenour)   
  - net: usb: qmi_wwan: add Telit 0x1070 composition (Daniele Palmas)   
  - net: usb: qmi_wwan: add Telit 0x1060 composition (Carlo Lobrano)   
  - xen/arm: Fix race in RB-tree based P2M accounting (Oleksandr Tyshchenko)   
  - net: Rename and export copy_skb_header (Ilya Lesokhin)   
  - ipv6/sit: fix ipip6_tunnel_get_prl return value (katrinzhou)   
  - sit: use min (kernel test robot)   
  - hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails (Yang Yingliang)   
  - NFC: nxp-nci: Don't issue a zero length i2c_master_read() (Michael Walle)   
  - nfc: nfcmrvl: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - net: bonding: fix use-after-free after 802.3ad slave unbind (Yevhen Orlov)   
  - net: bonding: fix possible NULL deref in rlb code (Eric Dumazet)   
  - netfilter: nft_dynset: restore set element counter when failing to update (Pablo Neira Ayuso)   
  - caif_virtio: fix race between virtio_device_ready() and ndo_open() (Jason Wang)   
  - net: ipv6: unexport __init-annotated seg6_hmac_net_init() (YueHaibing)   
  - usbnet: fix memory allocation in helpers (Oliver Neukum)   
  - RDMA/qedr: Fix reporting QP timeout attribute (Kamal Heib)   
  - net: usb: ax88179_178a: Fix packet receiving (Jose Alonso)   
  - net: rose: fix UAF bugs caused by timer handler (Duoming Zhou)   
  - SUNRPC: Fix READ_PLUS crasher (Chuck Lever)   
  - s390/archrandom: simplify back to earlier design and initialize earlier (Jason A. Donenfeld)   
  - dm raid: fix KASAN warning in raid5_add_disks (Mikulas Patocka)   
  - dm raid: fix accesses beyond end of raid member array (Heinz Mauelshagen)   
  - nvdimm: Fix badblocks clear off-by-one error (Chris Ye)   
  - Linux 4.14.286 (Greg Kroah-Hartman)   
  - swiotlb: skip swiotlb_bounce when orig_addr is zero (Liu Shixin)   
  - kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] (Naveen N. Rao)   
  - fdt: Update CRC check for rng-seed (Hsin-Yi Wang)   
  - xen: unexport __init-annotated xen_xlate_map_ballooned_pages() (Masahiro Yamada)   
  - drm: remove drm_fb_helper_modinit (Christoph Hellwig)   
  - powerpc/pseries: wire up rng during setup_arch() (Jason A. Donenfeld)   
  - modpost: fix section mismatch check for exported init/exit sections (Masahiro Yamada)   
  - ARM: cns3xxx: Fix refcount leak in cns3xxx_init (Miaoqian Lin)   
  - ARM: Fix refcount leak in axxia_boot_secondary (Miaoqian Lin)   
  - ARM: exynos: Fix refcount leak in exynos_map_pmu (Miaoqian Lin)   
  - ARM: dts: imx6qdl: correct PU regulator ramp delay (Lucas Stach)   
  - powerpc/powernv: wire up rng during setup_arch (Jason A. Donenfeld)   
  - powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address (Andrew Donnellan)   
  - powerpc: Enable execve syscall exit tracepoint (Naveen N. Rao)   
  - xtensa: Fix refcount leak bug in time.c (Liang He)   
  - xtensa: xtfpga: Fix refcount leak bug in setup (Liang He)   
  - iio: adc: axp288: Override TS pin bias current for some models (Hans de Goede)   
  - iio: trigger: sysfs: fix use-after-free on remove (Vincent Whitchurch)   
  - iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up() (Zheyu Ma)   
  - iio: accel: mma8452: ignore the return value of reset operation (Haibo Chen)   
  - iio:accel:bma180: rearrange iio trigger get and register (Dmitry Rokosov)   
  - usb: chipidea: udc: check request status before setting device address (Xu Yang)   
  - iio: adc: vf610: fix conversion mode sysfs node name (Baruch Siach)   
  - igb: Make DMA faster when CPU is active on the PCIe link (Kai-Heng Feng)   
  - MIPS: Remove repetitive increase irq_err_count (huhai)   
  - x86/xen: Remove undefined behavior in setup_features() (Julien Grall)   
  - bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers (Jay Vosburgh)   
  - USB: serial: option: add Quectel RM500K module support (Macpaul Lin)   
  - USB: serial: option: add Quectel EM05-G modem (Yonglin Tan)   
  - USB: serial: option: add Telit LE910Cx 0x1250 composition (Carlo Lobrano)   
  - random: quiet urandom warning ratelimit suppression message (Jason A. Donenfeld)   
  - dm era: commit metadata in postsuspend after worker stops (Nikos Tsironis)   
  - ata: libata: add qc->flags in ata_qc_complete_template tracepoint (Edward Wu)   
  - random: schedule mix_interrupt_randomness() less often (Jason A. Donenfeld)   
  - vt: drop old FONT ioctls (Jiri Slaby)   
  - Linux 4.14.285 (Greg Kroah-Hartman)   
  - tcp: drop the hash_32() part from the index calculation (Willy Tarreau)   
  - tcp: increase source port perturb table to 2^16 (Willy Tarreau) [Orabug: 34247937] {CVE-2022-32296}
  - tcp: dynamically allocate the perturb table used by source ports (Willy Tarreau)   
  - tcp: add small random increments to the source port (Willy Tarreau)   
  - tcp: use different parts of the port_offset for index and offset (Willy Tarreau)   
  - tcp: add some entropy in __inet_hash_connect() (Eric Dumazet)   
  - xprtrdma: fix incorrect header size calculations (Colin Ian King)   
  - usb: gadget: u_ether: fix regression in setting fixed MAC address (Marian Postevca)   
  - s390/mm: use non-quiescing sske for KVM switch to keyed guest (Christian Borntraeger)   
  - virtio-pci: Remove wrong address verification in vp_del_vqs() (Murilo Opsfelder Araujo)   
  - ext4: add reserved GDT blocks check (Zhang Yi)   
  - ext4: make variable "count" signed (Ding Xiang)   
  - ext4: fix bug_on ext4_mb_use_inode_pa (Baokun Li)   
  - serial: 8250: Store to lsr_save_flags after lsr read (Ilpo Järvinen)   
  - usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe (Miaoqian Lin)   
  - usb: dwc2: Fix memory leak in dwc2_hcd_init (Miaoqian Lin)   
  - USB: serial: io_ti: add Agilent E5805A support (Robert Eckelmann)   
  - USB: serial: option: add support for Cinterion MV31 with new baseline (Slark Xiao)   
  - comedi: vmk80xx: fix expression for tx buffer size (Ian Abbott)   
  - irqchip/gic/realview: Fix refcount leak in realview_gic_of_init (Miaoqian Lin)   
  - certs/blacklist_hashes.c: fix const confusion in certs blacklist (Masahiro Yamada)   
  - arm64: ftrace: fix branch range checks (Mark Rutland)   
  - net: bgmac: Fix an erroneous kfree() in bgmac_remove() (Christophe JAILLET)   
  - misc: atmel-ssc: Fix IRQ check in ssc_probe (Miaoqian Lin)   
  - tty: goldfish: Fix free_irq() on remove (Vincent Whitchurch)   
  - i40e: Fix call trace in setup_tx_descriptors (Aleksandr Loktionov)   
  - pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE (Trond Myklebust)   
  - random: credit cpu and bootloader seeds by default (Jason A. Donenfeld)   
  - net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag (Chen Lin)   
  - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg (Wang Yufen)   
  - nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (Xiaohui Zhang)   
  - virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed (chengkaitao)   
  - scsi: pmcraid: Fix missing resource cleanup in error case (Chengguang Xu)   
  - scsi: ipr: Fix missing/incorrect resource cleanup in error case (Chengguang Xu)   
  - scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology (James Smart)   
  - scsi: vmw_pvscsi: Expand vcpuHint to 16 bits (Wentao Wang)   
  - ASoC: wm8962: Fix suspend while playing music (Adam Ford)   
  - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (Sergey Shtylyov)   
  - ASoC: cs42l56: Correct typo in minimum level for SX volume controls (Charles Keepax)   
  - ASoC: cs42l52: Correct TLV for Bypass Volume (Charles Keepax)   
  - ASoC: cs53l30: Correct number of volume levels on SX controls (Charles Keepax)   
  - ASoC: cs42l52: Fix TLV scales for mixer controls (Charles Keepax)   
  - random: account for arch randomness in bits (Jason A. Donenfeld)   
  - random: mark bootloader randomness code as __init (Jason A. Donenfeld)   
  - random: avoid checking crng_ready() twice in random_init() (Jason A. Donenfeld)   
  - crypto: drbg - make reseeding from get_random_bytes() synchronous (Nicolai Stange)   
  - crypto: drbg - always try to free Jitter RNG instance (Stephan Müller)   
  - crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed() (Nicolai Stange)   
  - crypto: drbg - track whether DRBG was seeded with !rng_is_initialized() (Nicolai Stange)   
  - crypto: drbg - prepare for more fine-grained tracking of seeding state (Nicolai Stange)   
  - crypto: drbg - always seeded with SP800-90B compliant noise source (Stephan Müller)   
  - crypto: drbg - add FIPS 140-2 CTRNG for noise source (Stephan Mueller)   
  - Revert "random: use static branch for crng_ready()" (Jason A. Donenfeld)   
  - random: check for signals after page of pool writes (Jason A. Donenfeld)   
  - random: wire up fops->splice_{read,write}_iter() (Jens Axboe)   
  - random: convert to using fops->write_iter() (Jens Axboe)   
  - random: move randomize_page() into mm where it belongs (Jason A. Donenfeld)   
  - random: move initialization functions out of hot pages (Jason A. Donenfeld)   
  - random: use proper jiffies comparison macro (Jason A. Donenfeld)   
  - random: use symbolic constants for crng_init states (Jason A. Donenfeld)   
  - siphash: use one source of truth for siphash permutations (Jason A. Donenfeld)   
  - random: help compiler out with fast_mix() by using simpler arguments (Jason A. Donenfeld)   
  - random: do not use input pool from hard IRQs (Saeed Mirzamohammadi)   
  - random: order timer entropy functions below interrupt functions (Jason A. Donenfeld)   
  - random: do not pretend to handle premature next security model (Jason A. Donenfeld)   
  - random: do not use batches when !crng_ready() (Jason A. Donenfeld)   
  - random: insist on random_get_entropy() existing in order to simplify (Jason A. Donenfeld)   
  - xtensa: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - sparc: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - um: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - x86/tsc: Use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - nios2: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - arm: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - mips: use fallback for random_get_entropy() instead of just c0 random (Jason A. Donenfeld)   
  - m68k: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - timekeeping: Add raw clock fallback for random_get_entropy() (Jason A. Donenfeld)   
  - powerpc: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - alpha: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - parisc: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - s390: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - ia64: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - init: call time_init() before rand_initialize() (Jason A. Donenfeld)   
  - random: fix sysctl documentation nits (Jason A. Donenfeld)   
  - random: document crng_fast_key_erasure() destination possibility (Jason A. Donenfeld)   
  - random: make random_get_entropy() return an unsigned long (Jason A. Donenfeld)   
  - random: check for signals every PAGE_SIZE chunk of /dev/[u]random (Jason A. Donenfeld)   
  - random: check for signal_pending() outside of need_resched() check (Jann Horn)   
  - random: do not allow user to keep crng key around on stack (Jason A. Donenfeld)   
  - random: do not split fast init input in add_hwgenerator_randomness() (Jan Varho)   
  - random: mix build-time latent entropy into pool at init (Jason A. Donenfeld)   
  - random: re-add removed comment about get_random_{u32,u64} reseeding (Jason A. Donenfeld)   
  - random: treat bootloader trust toggle the same way as cpu trust toggle (Jason A. Donenfeld)   
  - random: skip fast_init if hwrng provides large chunk of entropy (Jason A. Donenfeld)   
  - random: check for signal and try earlier when generating entropy (Jason A. Donenfeld)   
  - random: reseed more often immediately after booting (Jason A. Donenfeld)   
  - random: make consistent usage of crng_ready() (Jason A. Donenfeld)   
  - random: use SipHash as interrupt entropy accumulator (Jason A. Donenfeld)   
  - random: replace custom notifier chain with standard one (Jason A. Donenfeld)   
  - random: don't let 644 read-only sysctls be written to (Jason A. Donenfeld)   
  - random: give sysctl_random_min_urandom_seed a more sensible value (Jason A. Donenfeld)   
  - random: do crng pre-init loading in worker rather than irq (Jason A. Donenfeld)   
  - random: unify cycles_t and jiffies usage and types (Jason A. Donenfeld)   
  - random: cleanup UUID handling (Jason A. Donenfeld)   
  - random: only wake up writers after zap if threshold was passed (Jason A. Donenfeld)   
  - random: round-robin registers as ulong, not u32 (Jason A. Donenfeld)   
  - random: pull add_hwgenerator_randomness() declaration into random.h (Jason A. Donenfeld)   
  - random: check for crng_init == 0 in add_device_randomness() (Jason A. Donenfeld)   
  - random: unify early init crng load accounting (Jason A. Donenfeld)   
  - random: do not take pool spinlock at boot (Jason A. Donenfeld)   
  - random: defer fast pool mixing to worker (Jason A. Donenfeld)   
  - random: rewrite header introductory comment (Jason A. Donenfeld)   
  - random: group sysctl functions (Jason A. Donenfeld)   
  - random: group userspace read/write functions (Jason A. Donenfeld)   
  - random: group entropy collection functions (Jason A. Donenfeld)   
  - random: group entropy extraction functions (Jason A. Donenfeld)   
  - random: remove useless header comment (Jason A. Donenfeld)   
  - random: introduce drain_entropy() helper to declutter crng_reseed() (Jason A. Donenfeld)   
  - random: deobfuscate irq u32/u64 contributions (Jason A. Donenfeld)   
  - random: add proper SPDX header (Jason A. Donenfeld)   
  - random: remove unused tracepoints (Jason A. Donenfeld)   
  - random: remove ifdef'd out interrupt bench (Jason A. Donenfeld)   
  - random: tie batched entropy generation to base_crng generation (Jason A. Donenfeld)   
  - random: zero buffer after reading entropy from userspace (Jason A. Donenfeld)   
  - random: remove outdated INT_MAX >> 6 check in urandom_read() (Jason A. Donenfeld)   
  - random: use hash function for crng_slow_load() (Jason A. Donenfeld)   
  - random: absorb fast pool into input pool after fast load (Jason A. Donenfeld)   
  - random: do not xor RDRAND when writing into /dev/random (Jason A. Donenfeld)   
  - random: ensure early RDSEED goes through mixer on init (Jason A. Donenfeld)   
  - random: inline leaves of rand_initialize() (Jason A. Donenfeld)   
  - random: use RDSEED instead of RDRAND in entropy extraction (Jason A. Donenfeld)   
  - random: fix locking in crng_fast_load() (Dominik Brodowski)   
  - random: remove batched entropy locking (Jason A. Donenfeld)   
  - random: remove use_input_pool parameter from crng_reseed() (Eric Biggers)   
  - random: make credit_entropy_bits() always safe (Jason A. Donenfeld)   
  - random: always wake up entropy writers after extraction (Jason A. Donenfeld)   
  - random: use linear min-entropy accumulation crediting (Jason A. Donenfeld)   
  - random: simplify entropy debiting (Jason A. Donenfeld)   
  - random: use computational hash for entropy extraction (Jason A. Donenfeld)   
  - random: only call crng_finalize_init() for primary_crng (Dominik Brodowski)   
  - random: access primary_pool directly rather than through pointer (Dominik Brodowski)   
  - random: continually use hwgenerator randomness (Dominik Brodowski)   
  - random: simplify arithmetic function flow in account() (Jason A. Donenfeld)   
  - random: access input_pool_data directly rather than through pointer (Jason A. Donenfeld)   
  - random: cleanup fractional entropy shift constants (Jason A. Donenfeld)   
  - random: prepend remaining pool constants with POOL_ (Jason A. Donenfeld)   
  - random: de-duplicate INPUT_POOL constants (Jason A. Donenfeld)   
  - random: remove unused OUTPUT_POOL constants (Jason A. Donenfeld)   
  - random: rather than entropy_store abstraction, use global (Jason A. Donenfeld)   
  - random: try to actively add entropy rather than passively wait for it (Linus Torvalds)   
  - random: remove unused extract_entropy() reserved argument (Jason A. Donenfeld)   
  - random: remove incomplete last_data logic (Jason A. Donenfeld)   
  - random: cleanup integer types (Jason A. Donenfeld)   
  - crypto: chacha20 - Fix chacha20_block() keystream alignment (again) (Eric Biggers)   
  - random: cleanup poolinfo abstraction (Jason A. Donenfeld)   
  - random: fix typo in comments (Schspa Shi)   
  - random: don't reset crng_init_cnt on urandom_read() (Jann Horn)   
  - random: avoid superfluous call to RDRAND in CRNG extraction (Jason A. Donenfeld)   
  - random: early initialization of ChaCha constants (Dominik Brodowski)   
  - random: initialize ChaCha20 constants with correct endianness (Eric Biggers)   
  - random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs (Jason A. Donenfeld)   
  - random: harmonize "crng init done" messages (Dominik Brodowski)   
  - random: mix bootloader randomness into pool (Jason A. Donenfeld)   
  - random: do not re-init if crng_reseed completes before primary init (Jason A. Donenfeld)   
  - random: do not sign extend bytes for rotation when mixing (Jason A. Donenfeld)   
  - random: use BLAKE2s instead of SHA1 in extraction (Jason A. Donenfeld)   
  - random: remove unused irq_flags argument from add_interrupt_randomness() (Saeed Mirzamohammadi)   
  - random: document add_hwgenerator_randomness() with other input functions (Mark Brown)   
  - crypto: blake2s - adjust include guard naming (Eric Biggers)   
  - crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h> (Eric Biggers)   
  - MAINTAINERS: co-maintain random.c (Jason A. Donenfeld)   
  - random: remove dead code left over from blocking pool (Eric Biggers)   
  - random: avoid arch_get_random_seed_long() when collecting IRQ randomness (Ard Biesheuvel)   
  - random: add arch_get_random_*long_early() (Mark Rutland)   
  - powerpc: Use bool in archrandom.h (Richard Henderson)   
  - linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check (Richard Henderson)   
  - linux/random.h: Use false with bool (Richard Henderson)   
  - linux/random.h: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - s390: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - powerpc: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - x86: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - random: avoid warnings for !CONFIG_NUMA builds (Mark Rutland)   
  - random: split primary/secondary crng init paths (Mark Rutland)   
  - random: remove some dead code of poolinfo (Yangtao Li)   
  - random: fix typo in add_timer_randomness() (Yangtao Li)   
  - random: Add and use pr_fmt() (Yangtao Li)   
  - random: convert to ENTROPY_BITS for better code readability (Yangtao Li)   
  - random: remove unnecessary unlikely() (Yangtao Li)   
  - random: remove kernel.random.read_wakeup_threshold (Andy Lutomirski)   
  - random: delete code to pull data into pools (Andy Lutomirski)   
  - random: remove the blocking pool (Andy Lutomirski)   
  - random: fix crash on multiple early calls to add_bootloader_randomness() (Dominik Brodowski)   
  - char/random: silence a lockdep splat with printk() (Sergey Senozhatsky)   
  - random: make /dev/random be almost like /dev/urandom (Andy Lutomirski)   
  - random: ignore GRND_RANDOM in getentropy(2) (Andy Lutomirski)   
  - random: add GRND_INSECURE to return best-effort non-cryptographic bytes (Andy Lutomirski)   
  - random: Add a urandom_read_nowait() for random APIs that don't warn (Andy Lutomirski)   
  - random: Don't wake crng_init_wait when crng_init == 1 (Andy Lutomirski)   
  - lib/crypto: sha1: re-roll loops to reduce code size (Jason A. Donenfeld)   
  - lib/crypto: blake2s: move hmac construction into wireguard (Jason A. Donenfeld)   
  - crypto: blake2s - generic C library implementation and selftest (Jason A. Donenfeld)   
  - crypto: Deduplicate le32_to_cpu_array() and cpu_to_le32_array() (Andy Shevchenko)   
  - Revert "hwrng: core - Freeze khwrng thread during suspend" (Herbert Xu)   
  - char/random: Add a newline at the end of the file (Borislav Petkov)   
  - random: Use wait_event_freezable() in add_hwgenerator_randomness() (Stephen Boyd)   
  - fdt: add support for rng-seed (Hsin-Yi Wang)   
  - random: Support freezable kthreads in add_hwgenerator_randomness() (Stephen Boyd)   
  - random: fix soft lockup when trying to read from an uninitialized blocking pool (Theodore Ts'o)   
  - latent_entropy: avoid build error when plugin cflags are not set (Vasily Gorbik)   
  - random: document get_random_int() family (George Spelvin)   
  - random: move rand_initialize() earlier (Kees Cook)   
  - random: only read from /dev/random after its pool has received 128 bits (Theodore Ts'o)   
  - drivers/char/random.c: make primary_crng static (Rasmus Villemoes)   
  - drivers/char/random.c: remove unused stuct poolinfo::poolbits (Rasmus Villemoes)   
  - drivers/char/random.c: constify poolinfo_table (Rasmus Villemoes)   
  - random: make CPU trust a boot parameter (Kees Cook)   
  - random: Make crng state queryable (Jason A. Donenfeld)   
  - random: remove preempt disabled region (Ingo Molnar)   
  - random: add a config option to trust the CPU's hwrng (Theodore Ts'o)   
  - random: Return nbytes filled from hw RNG (Tobin C. Harding)   
  - random: Fix whitespace pre random-bytes work (Tobin C. Harding)   
  - drivers/char/random.c: remove unused dont_count_entropy (Rasmus Villemoes)   
  - random: optimize add_interrupt_randomness (Andi Kleen)   
  - random: always fill buffer in get_random_bytes_wait (Jason A. Donenfeld)   
  - crypto: chacha20 - Fix keystream alignment for chacha20_block() (Eric Biggers)   
  - 9p: missing chunk of "fs/9p: Don't update file type when updating file attributes" (Al Viro)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.518.0.el7uek]
changelog:
  - lockdown: also lock down previous kgdb use (Daniel Thompson)  [Orabug: 34543517]  {CVE-2022-21499} 
  - Revert "debug: Lock down kgdb" (Alok Tiwari)  [Orabug: 34543517]  
  - vmcoreinfo: add kallsyms_num_syms symbol (Stephen Brennan)  [Orabug: 34475880]  
  - vmcoreinfo: include kallsyms symbols (Stephen Brennan)  [Orabug: 34475880]  
  - kallsyms: move declarations to internal header (Stephen Brennan)  [Orabug: 34475880]  
  - mpt3sas: avoid SOFT_RESET on shutdown (John Donnelly)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Update driver version to 39.100.00.00 (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Use firmware recommended queue depth (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Transition IOC to Ready state during shutdown (Sreekanth Reddy)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix fall-through warnings for Clang (Gustavo A. R. Silva)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Handle firmware faults during first half of IOC init (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix deadlock while cancelling the running firmware event (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Documentation cleanup (Randy Dunlap)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix timeouts observed while reenabling IRQ (Sreekanth Reddy)  [Orabug: 34408138]  
  - scsi: mpt3sas: Fix two kernel-doc headers (Bart Van Assche)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix out-of-bounds warnings in _ctl_addnl_diag_query (Gustavo A. R. Silva)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix endianness for ActiveCablePowerRequirement (Sreekanth Reddy)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Only one vSES is present even when IOC has multi vSES (Sreekanth Reddy)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix a typo (Bhaskar Chowdhury)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix a few kernel-doc issues (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force reply post buffer allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force reply buffer allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force sense buffer allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force chain buffer allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Replace unnecessary dynamic allocation with a static one (Gustavo A. R. Silva)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Do not use GFP_KERNEL in atomic context (Christophe JAILLET)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix some kernel-doc misnaming issues (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix a couple of misdocumented functions/params (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix a bunch of potential naming doc-rot (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Move a little data from the stack onto the heap (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix misspelling of _base_put_smid_default_atomic() (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Additional diagnostic buffer query interface (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix ReplyPostFree pool allocation (Sreekanth Reddy)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Simplify bool comparison (YANG LI)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix spelling mistake in Kconfig "compatiblity" -> "compatibility" (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Signedness bug in _base_get_diag_triggers() (Dan Carpenter)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Block PCI config access from userspace during reset (Sreekanth Reddy)  [Orabug: 34408138]  
  - Linux 4.14.290 (Greg Kroah-Hartman)   
  - PCI: hv: Fix interrupt mapping for multi-MSI (Jeffrey Hugo)   
  - PCI: hv: Reuse existing IRTE allocation in compose_msi_msg() (Jeffrey Hugo)   
  - PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI (Jeffrey Hugo)   
  - PCI: hv: Fix multi-MSI to allow more than one MSI vector (Jeffrey Hugo)   
  - net: usb: ax88179_178a needs FLAG_SEND_ZLP (Jose Alonso)   
  - tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() (Jiri Slaby)   
  - tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push() (Jiri Slaby)   
  - tty: drop tty_schedule_flip() (Jiri Slaby)   
  - tty: the rest, stop using tty_schedule_flip() (Jiri Slaby)   
  - tty: drivers/tty/, stop using tty_schedule_flip() (Jiri Slaby)   
  - Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks (Luiz Augusto von Dentz)   
  - Bluetooth: SCO: Fix sco_send_frame returning skb->len (Luiz Augusto von Dentz)   
  - Bluetooth: Fix passing NULL to PTR_ERR (Luiz Augusto von Dentz)   
  - Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg (Luiz Augusto von Dentz)   
  - Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg (Luiz Augusto von Dentz)   
  - Bluetooth: Add bt_skb_sendmmsg helper (Luiz Augusto von Dentz)   
  - Bluetooth: Add bt_skb_sendmsg helper (Luiz Augusto von Dentz)   
  - ALSA: memalloc: Align buffer allocations in page size (Takashi Iwai)   
  - tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - drm/tilcdc: Remove obsolete crtc_mode_valid() hack (Jyri Sarha)   
  - bpf: Make sure mac_header was set before using it (Eric Dumazet)   
  - mm/mempolicy: fix uninit-value in mpol_rebind_policy() (Wang Cheng)   
  - Revert "Revert "char/random: silence a lockdep splat with printk()"" (Jason A. Donenfeld)   
  - be2net: Fix buffer overflow in be_get_module_eeprom (Hristo Venev)   
  - tcp: Fix a data-race around sysctl_tcp_notsent_lowat. (Kuniyuki Iwashima)   
  - igmp: Fix a data-race around sysctl_igmp_max_memberships. (Kuniyuki Iwashima)   
  - igmp: Fix data-races around sysctl_igmp_llm_reports. (Kuniyuki Iwashima)   
  - net: stmmac: fix dma queue left shift overflow issue (Junxiao Chang)   
  - i2c: cadence: Change large transfer count reset logic to be unconditional (Robert Hancock)   
  - tcp: Fix a data-race around sysctl_tcp_probe_interval. (Kuniyuki Iwashima)   
  - tcp: Fix a data-race around sysctl_tcp_probe_threshold. (Kuniyuki Iwashima)   
  - tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. (Kuniyuki Iwashima)   
  - ip: Fix a data-race around sysctl_fwmark_reflect. (Kuniyuki Iwashima)   
  - perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() (Peter Zijlstra)   
  - power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe (Miaoqian Lin)   
  - xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup() (Hangyu Hua)   
  - xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE (Demi Marie Obenour)   
  - Linux 4.14.289 (Greg Kroah-Hartman)   
  - can: m_can: m_can_tx_handler(): fix use after free of skb (Marc Kleine-Budde)   
  - mm: invalidate hwpoison page cache page in fault path (Rik van Riel)   
  - serial: 8250: fix return error code in serial8250_request_std_resource() (Yi Yang)   
  - tty: serial: samsung_tty: set dma burst_size to 1 (Chanho Park)   
  - usb: dwc3: gadget: Fix event pending check (Thinh Nguyen)   
  - USB: serial: ftdi_sio: add Belimo device ids (Lucien Buchmann)   
  - signal handling: don't use BUG_ON() for debugging (Linus Torvalds)   
  - x86: Clear .brk area at early boot (Juergen Gross)   
  - irqchip: or1k-pic: Undefine mask_ack for level triggered hardware (Stafford Horne)   
  - ASoC: wm5110: Fix DRE control (Charles Keepax)   
  - ASoC: ops: Fix off by one in range control validation (Mark Brown)   
  - net: sfp: fix memory leak in sfp_probe() (Jianglei Nie)   
  - NFC: nxp-nci: don't print header length mismatch on i2c error (Michael Walle)   
  - net: tipc: fix possible refcount leak in tipc_sk_create() (Hangyu Hua)   
  - platform/x86: hp-wmi: Ignore Sanitization Mode event (Kai-Heng Feng)   
  - cpufreq: pmac32-cpufreq: Fix refcount leak bug (Liang He)   
  - netfilter: br_netfilter: do not skip all hooks with 0 priority (Florian Westphal)   
  - virtio_mmio: Restore guest page size on resume (Stephan Gerhold)   
  - virtio_mmio: Add missing PM calls to freeze/restore (Stephan Gerhold)   
  - sfc: fix kernel panic when creating VF (Íñigo Huguet)   
  - seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors (Andrea Mayer)   
  - seg6: fix skb checksum evaluation in SRH encapsulation/insertion (Andrea Mayer)   
  - sfc: fix use after free when disabling sriov (Íñigo Huguet)   
  - ipv4: Fix data-races around sysctl_ip_dynaddr. (Kuniyuki Iwashima)   
  - icmp: Fix a data-race around sysctl_icmp_ratemask. (Kuniyuki Iwashima)   
  - icmp: Fix a data-race around sysctl_icmp_ratelimit. (Kuniyuki Iwashima)   
  - ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero (Michal Suchanek)   
  - icmp: Fix data-races around sysctl. (Kuniyuki Iwashima)   
  - cipso: Fix data-races around sysctl. (Kuniyuki Iwashima)   
  - net: Fix data-races around sysctl_mem. (Kuniyuki Iwashima)   
  - inetpeer: Fix data-races around sysctl. (Kuniyuki Iwashima)   
  - ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle (Ard Biesheuvel)   
  - xhci: make xhci_handshake timeout for xhci_reset() adjustable (Mathias Nyman)   
  - xhci: bail out early if driver can't accress host in resume (Mathias Nyman)   
  - net: dsa: bcm_sf2: force pause link settings (Doug Berger)   
  - nilfs2: fix incorrect masking of permission flags for symlinks (Ryusuke Konishi)   
  - cgroup: Use separate src/dst nodes when preloading css_sets for migration (Tejun Heo)   
  - ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction (Ard Biesheuvel)   
  - ARM: 9213/1: Print message about disabled Spectre workarounds only once (Dmitry Osipenko)   
  - net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer (Steven Rostedt (Google))   
  - xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue (Juergen Gross)   
  - ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (Meng Tang)   
  - ALSA: hda - Add fixup for Dell Latitidue E5430 (Meng Tang)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.518.1.el7uek]
changelog:
  - xfs: fix out of bound access (Junxiao Bi)  [Orabug: 33089469] [Orabug: 34535011]  
  - KVM: x86: use raw clock values consistently (Paolo Bonzini)  [Orabug: 34362737]  
  - KVM: x86: reorganize pvclock_gtod_data members (Paolo Bonzini)  [Orabug: 34362737]  
  - KVM: x86: switch KVMCLOCK base to monotonic raw clock (Marcelo Tosatti)  [Orabug: 34362737]  
  - netfilter: ebtables: reject blobs that don't provide all entry points (Florian Westphal)  [Orabug: 32176166]  
  - sysfs: turn WARN() into pr_warn() (Greg Kroah-Hartman)  [Orabug: 32176118]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.518.2.el7uek]
changelog:
  - af_key: Do not call xfrm_probe_algs in parallel (Herbert Xu)  [Orabug: 34566753]  {CVE-2022-3028} 
  - l2tp: fix tunnel lookup use-after-free race (James Chapman)  [Orabug: 32504113]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.518.4.1.el7uek]
changelog:
  - Revert "xfs: don't use delalloc extents for COW on files with extsize hints" (Saeed Mirzamohammadi)  [Orabug: 34716022]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.518.4.2.el7uek]
changelog:
  - EDAC: Drop duplicated array of strings for memory type names (Jane Chu)  [Orabug: 34765038]  
  - xfs: don't ever put nlink > 0 inodes on the unlinked list (Darrick J. Wong)  [Orabug: 34765034]  
  - xfs: trim IO to found COW extent limit (Eric Sandeen)  [Orabug: 34765017]  
  - xfs: don't use delalloc extents for COW on files with extsize hints (Christoph Hellwig)  [Orabug: 34765017]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.516.0.el7uek]
changelog:
  - scsi: mpt3sas: Remove scsi_dma_map() error messages (Sreekanth Reddy)  [Orabug: 34328903]  
  - uek: kabi: new protected symbols for USM in OL7 (Saeed Mirzamohammadi)  [Orabug: 34233902]  
  - vfio/type1: add ioctl to check for correct pin accounting (Anthony Yznaga)  [Orabug: 32967885]  
  - vfio/type1: track pages pinned by vfio across exec (Anthony Yznaga)  [Orabug: 32967885]  
  - mm: track driver pinned pages across exec (Anthony Yznaga)  [Orabug: 32967885]  
  - vfio/type1: Fix vfio_find_dma_valid return (Anthony Yznaga)  [Orabug: 32967885]  
  - vfio/type1: fix unmap all on ILP32 (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: block on invalid vaddr (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: implement notify callback (Steve Sistare)  [Orabug: 32967885]  
  - vfio: iommu driver notify callback (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: implement interfaces to update vaddr (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: massage unmap iteration (Steve Sistare)  [Orabug: 32967885]  
  - vfio: interfaces to update vaddr (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: implement unmap all (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: unmap cleanup (Steve Sistare)  [Orabug: 32967885]  
  - vfio: option to unmap all (Steve Sistare)  [Orabug: 32967885]  
  - Linux 4.14.284 (Greg Kroah-Hartman)   
  - x86/speculation/mmio: Print SMT warning (Josh Poimboeuf)   
  - x86/cpu: Add another Alder Lake CPU to the Intel family (Gayatri Kammela)   
  - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family (Tony Luck)   
  - x86/cpu: Add Comet Lake to the Intel CPU models header (Kan Liang)   
  - x86/cpu: Add Cannonlake to Intel family (Rajneesh Bhardwaj)   
  - x86/cpu: Add Jasper Lake to Intel family (Zhang Rui)   
  - cpu/speculation: Add prototype for cpu_show_srbds() (Guenter Roeck)   
  - x86/cpu: Add Elkhart Lake to Intel family (Gayatri Kammela)   
  - Linux 4.14.283 (Greg Kroah-Hartman)   
  - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd (Eric Dumazet)   
  - PCI: qcom: Fix unbalanced PHY init on probe errors (Johan Hovold)   
  - mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N (Tokunori Ikegami)   
  - mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write (Tokunori Ikegami)   
  - md/raid0: Ignore RAID0 layout if the second zone has only one device (Pascal Hambourg)   
  - powerpc/32: Fix overread/overwrite of thread_struct via ptrace (Michael Ellerman)   
  - Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag (Mathias Nyman)   
  - ixgbe: fix unexpected VLAN Rx in promisc mode on VF (Olivier Matz)   
  - ixgbe: fix bcast packets Rx on VF after promisc removal (Olivier Matz)   
  - nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling (Martin Faltesek)   
  - nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION (Martin Faltesek)   
  - ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files (Sergey Shtylyov)   
  - cifs: return errors during session setup during reconnects (Shyam Prasad N)   
  - ALSA: hda/conexant - Fix loopback issue with CX20632 (huangwenhui)   
  - vringh: Fix loop descriptors check in the indirect cases (Xie Yongji)   
  - nodemask: Fix return values to be unsigned (Kees Cook)   
  - nbd: fix io hung while disconnecting device (Yu Kuai)   
  - nbd: fix race between nbd_alloc_config() and module removal (Yu Kuai)   
  - nbd: call genl_unregister_family() first in nbd_cleanup() (Yu Kuai)   
  - modpost: fix undefined behavior of is_arm_mapping_symbol() (Masahiro Yamada)   
  - drm/radeon: fix a possible null pointer dereference (Gong Yuanjun)   
  - Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" (Michal Kubecek)   
  - md: protect md_unregister_thread from reentrancy (Guoqing Jiang)   
  - kernfs: Separate kernfs_pr_cont_buf and rename_lock. (Hao Luo)   
  - serial: msm_serial: disable interrupts in __msm_console_write() (John Ogness)   
  - staging: rtl8712: fix uninit-value in r871xu_drv_init() (Wang Cheng)   
  - clocksource/drivers/sp804: Avoid error on multiple instances (Andre Przywara)   
  - extcon: Modify extcon device to be created after driver data is set (bumwoo lee)   
  - misc: rtsx: set NULL intfdata when probe fails (Shuah Khan)   
  - usb: dwc2: gadget: don't reset gadget's driver->bus (Marek Szyprowski)   
  - USB: hcd-pci: Fully suspend across freeze/thaw cycle (Evan Green)   
  - drivers: usb: host: Fix deadlock in oxu_bus_suspend() (Duoming Zhou)   
  - drivers: tty: serial: Fix deadlock in sa1100_set_termios() (Duoming Zhou)   
  - USB: host: isp116x: check return value after calling platform_get_resource() (Zhen Ni)   
  - drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() (Duoming Zhou)   
  - tty: Fix a possible resource leak in icom_probe (Huang Guobin)   
  - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() (Zheyu Ma)   
  - lkdtm/usercopy: Expand size of "out of frame" object (Kees Cook)   
  - iio: dummy: iio_simple_dummy: check the return value of kstrdup() (Xiaoke Wang)   
  - drm: imx: fix compiler warning with gcc-12 (Linus Torvalds)   
  - net: altera: Fix refcount leak in altera_tse_mdio_create (Miaoqian Lin)   
  - net: ipv6: unexport __init-annotated seg6_hmac_init() (Masahiro Yamada)   
  - net: xfrm: unexport __init-annotated xfrm4_protocol_init() (Masahiro Yamada)   
  - net: mdio: unexport __init-annotated mdio_bus_init() (Masahiro Yamada)   
  - SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() (Chuck Lever)   
  - net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure (Gal Pressman)   
  - ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe (Miaoqian Lin)   
  - xprtrdma: treat all calls not a bcall when bc_serv is NULL (Kinglong Mee)   
  - video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() (Yang Yingliang)   
  - m68knommu: fix undefined reference to `_init_sp' (Greg Ungerer)   
  - m68knommu: set ZERO_PAGE() to the allocated zeroed page (Greg Ungerer)   
  - i2c: cadence: Increase timeout per message if necessary (Lucas Tanure)   
  - tracing: Avoid adding tracer option before update_tracer_options (Mark-PK Tsai)   
  - tracing: Fix sleeping function called from invalid context on RT kernel (Jun Miao)   
  - mips: cpc: Fix refcount leak in mips_cpc_default_phys_base (Gong Yuanjun)   
  - perf c2c: Fix sorting in percent_rmt_hitm_cmp() (Leo Yan)   
  - tcp: tcp_rtx_synack() can be called from process context (Eric Dumazet)   
  - ubi: ubi_create_volume: Fix use-after-free when volume creation failed (Zhihao Cheng)   
  - jffs2: fix memory leak in jffs2_do_fill_super (Baokun Li)   
  - modpost: fix removing numeric suffixes (Alexander Lobakin)   
  - net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (Miaoqian Lin)   
  - net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry() (Dan Carpenter)   
  - clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (Miaoqian Lin)   
  - serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 (Ilpo Järvinen)   
  - serial: sh-sci: Don't allow CS5-6 (Ilpo Järvinen)   
  - serial: txx9: Don't allow CS5-6 (Ilpo Järvinen)   
  - serial: digicolor-usart: Don't allow CS5-6 (Ilpo Järvinen)   
  - serial: meson: acquire port->lock in startup() (John Ogness)   
  - rtc: mt6397: check return value after calling platform_get_resource() (Yang Yingliang)   
  - soc: rockchip: Fix refcount leak in rockchip_grf_init (Miaoqian Lin)   
  - coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier (Guilherme G. Piccoli)   
  - rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - pwm: lp3943: Fix duty calculation in case period was clamped (Uwe Kleine-König)   
  - USB: storage: karma: fix rio_karma_init return (Lin Ma)   
  - usb: usbip: add missing device lock on tweak configuration cmd (Niels Dossche)   
  - usb: usbip: fix a refcount leak in stub_probe() (Hangyu Hua)   
  - tty: goldfish: Use tty_port_destroy() to destroy port (Wang Weiyang)   
  - staging: greybus: codecs: fix type confusion of list iterator variable (Jakob Koschel)   
  - pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards (Randy Dunlap)   
  - netfilter: nf_tables: disallow non-stateful expression in sets earlier (Pablo Neira Ayuso) [Orabug: 34247342] {CVE-2022-32250} {CVE-2022-1966}
  - MIPS: IP27: Remove incorrect `cpu_has_fpu' override (Maciej W. Rozycki)   
  - RDMA/rxe: Generate a completion for unsupported/invalid opcode (Xiao Yang)   
  - phy: qcom-qmp: fix reset-controller leak on probe errors (Johan Hovold)   
  - dt-bindings: gpio: altera: correct interrupt-cells (Dinh Nguyen)   
  - docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 (Akira Yokosawa)   
  - phy: qcom-qmp: fix struct clk leak on probe errors (Johan Hovold)   
  - arm64: dts: qcom: ipq8074: fix the sleep clock frequency (Kathiravan T)   
  - gma500: fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - carl9170: tx: fix an incorrect use of list iterator (Xiaomeng Tong)   
  - ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control (Mark Brown)   
  - rtl818x: Prevent using not initialized queues (Alexander Wetzel)   
  - hugetlb: fix huge_pmd_unshare address update (Mike Kravetz)   
  - nodemask.h: fix compilation error with GCC12 (Christophe de Dinechin)   
  - iommu/msm: Fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - um: Fix out-of-bounds read in LDT setup (Vincent Whitchurch)   
  - um: chan_user: Fix winch_tramp() return value (Johannes Berg)   
  - mac80211: upgrade passive scan to active scan on DFS channels after beacon rx (Felix Fietkau)   
  - irqchip: irq-xtensa-mx: fix initial IRQ affinity (Max Filippov)   
  - irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x (Pali Rohár)   
  - RDMA/hfi1: Fix potential integer multiplication overflow errors (Dennis Dalessandro)   
  - md: fix an incorrect NULL check in md_reload_sb (Xiaomeng Tong)   
  - md: fix an incorrect NULL check in does_sb_need_changing (Xiaomeng Tong)   
  - drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX (Brian Norris)   
  - drm/nouveau/clk: Fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. (Dave Airlie)   
  - scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled (Manivannan Sadhasivam)   
  - scsi: dc395x: Fix a missing check on list iterator (Xiaomeng Tong)   
  - ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock (Junxiao Bi via Ocfs2-devel)   
  - dlm: fix missing lkb refcount handling (Alexander Aring)   
  - dlm: fix plock invalid read (Alexander Aring)   
  - ext4: avoid cycles in directory h-tree (Jan Kara)   
  - ext4: verify dir block before splitting it (Jan Kara)   
  - ext4: fix bug_on in ext4_writepages (Ye Bin)   
  - ext4: fix use-after-free in ext4_rename_dir_prepare (Ye Bin)   
  - fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages (Zhihao Cheng)   
  - iwlwifi: mvm: fix assert 1F04 upon reconfig (Emmanuel Grumbach)   
  - wifi: mac80211: fix use-after-free in chanctx code (Johannes Berg)   
  - perf jevents: Fix event syntax error caused by ExtSel (Zhengjun Xing)   
  - perf c2c: Use stdio interface if slang is not supported (Leo Yan)   
  - iommu/amd: Increase timeout waiting for GA log enablement (Joerg Roedel)   
  - video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup (Miaoqian Lin)   
  - iommu/mediatek: Add list_del in mtk_iommu_remove (Yong Wu)   
  - mailbox: forward the hrtimer if not queued and under a lock (Björn Ardö)   
  - powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup (Miaoqian Lin)   
  - powerpc/perf: Fix the threshold compare group constraint for power9 (Kajol Jain)   
  - Input: sparcspkr - fix refcount leak in bbc_beep_probe (Miaoqian Lin)   
  - tty: fix deadlock caused by calling printk() under tty_port->lock (Qi Zheng)   
  - powerpc/4xx/cpm: Fix return value of __setup() handler (Randy Dunlap)   
  - powerpc/idle: Fix return value of __setup() handler (Randy Dunlap)   
  - powerpc/8xx: export 'cpm_setbrg' for modules (Randy Dunlap)   
  - drivers/base/node.c: fix compaction sysfs file leak (Miaohe Lin)   
  - pinctrl: mvebu: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() (Gustavo A. R. Silva)   
  - mfd: ipaq-micro: Fix error check return value of platform_get_irq() (Lv Ruyi)   
  - ARM: dts: bcm2835-rpi-b: Fix GPIO line names (Stefan Wahren)   
  - ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT (Phil Elwell)   
  - soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc (Miaoqian Lin)   
  - soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc (Miaoqian Lin)   
  - rxrpc: Don't try to resend the request if we're receiving the reply (David Howells)   
  - rxrpc: Fix listen() setting the bar too high for the prealloc rings (David Howells)   
  - ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() (Yang Yingliang)   
  - sctp: read sk->sk_bound_dev_if once in sctp_rcv() (Eric Dumazet)   
  - m68k: math-emu: Fix dependencies of math emulation support (Geert Uytterhoeven)   
  - Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout (Ying Hsu)   
  - media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (Pavel Skripkin)   
  - media: exynos4-is: Change clk_disable to clk_disable_unprepare (Miaoqian Lin)   
  - media: st-delta: Fix PM disable depth imbalance in delta_probe (Miaoqian Lin)   
  - regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt (Miaoqian Lin)   
  - ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe (Miaoqian Lin)   
  - media: uvcvideo: Fix missing check to determine if element is found in list (Xiaomeng Tong)   
  - drm/msm: return an error pointer in msm_gem_prime_get_sg_table() (Dan Carpenter)   
  - x86/mm: Cleanup the control_va_addr_alignment() __setup handler (Randy Dunlap)   
  - irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - x86: Fix return value of __setup handlers (Randy Dunlap)   
  - drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() (Yang Yingliang)   
  - drm/msm/hdmi: check return value after calling platform_get_resource_byname() (Yang Yingliang)   
  - drm/msm/dsi: fix error checks and return values for DSI xmit functions (Dmitry Baryshkov)   
  - x86/pm: Fix false positive kmemleak report in msr_build_context() (Matthieu Baerts)   
  - fsnotify: fix wrong lockdep annotations (Amir Goldstein)   
  - inotify: show inotify mask flags in proc fdinfo (Amir Goldstein)   
  - ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix (Dan Carpenter)   
  - spi: img-spfi: Fix pm_runtime_get_sync() error checking (Zheng Yongjun)   
  - HID: hid-led: fix maximum brightness for Dream Cheeky (Jonathan Teh)   
  - efi: Add missing prototype for efi_capsule_setup_info (Jan Kiszka)   
  - NFC: NULL out the dev->rfkill to prevent UAF (Lin Ma)   
  - spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout (Miaoqian Lin)   
  - drm/mediatek: Fix mtk_cec_mask() (Miles Chen)   
  - x86/delay: Fix the wrong asm constraint in delay_loop() (Ammar Faizi)   
  - ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe (Miaoqian Lin)   
  - ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe (Miaoqian Lin)   
  - ath9k: fix ar9003_get_eepmisc (Wenli Looi)   
  - drm: fix EDID struct for old ARM OABI format (Saeed Mirzamohammadi)   
  - RDMA/hfi1: Prevent panic when SDMA is disabled (Douglas Miller)   
  - macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled (Finn Thain)   
  - powerpc/xics: fix refcount leak in icp_opal_init() (Lv Ruyi)   
  - tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate (Vasily Averin)   
  - PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (Yicong Yang)   
  - ARM: hisi: Add missing of_node_put after of_find_compatible_node (Peng Wu)   
  - ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM (Krzysztof Kozlowski)   
  - ARM: versatile: Add missing of_node_put in dcscb_init (Peng Wu)   
  - fat: add ratelimit to fat*_ent_bread() (OGAWA Hirofumi)   
  - ARM: OMAP1: clock: Fix UART rate reporting algorithm (Janusz Krzysztofik)   
  - fs: jfs: fix possible NULL pointer dereference in dbFree() (Zixuan Fu)   
  - ARM: dts: ox820: align interrupt controller node name with dtschema (Krzysztof Kozlowski)   
  - eth: tg3: silence the GCC 12 array-bounds warning (Jakub Kicinski)   
  - rxrpc: Return an error to sendmsg if call failed (David Howells)   
  - media: exynos4-is: Fix compile warning (Kwanghoon Son)   
  - net: phy: micrel: Allow probing without .driver_data (Fabio Estevam)   
  - ASoC: rt5645: Fix errorenous cleanup order (Lin Ma)   
  - nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags (Smith, Kyle Miller (Nimble Kernel))   
  - openrisc: start CPU timer early in boot (Jason A. Donenfeld)   
  - rtlwifi: Use pr_warn instead of WARN_ONCE (Dongliang Mu)   
  - ipmi:ssif: Check for NULL msg when handling events and messages (Corey Minyard)   
  - dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC (Mikulas Patocka)   
  - s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES (Heiko Carstens)   
  - ASoC: dapm: Don't fold register value changes into notifications (Mark Brown)   
  - ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL (jianghaoran)   
  - drm/amd/pm: fix the compile warning (Evan Quan)   
  - scsi: megaraid: Fix error check return value of register_chrdev() (Lv Ruyi)   
  - media: cx25821: Fix the warning when removing the module (Zheyu Ma)   
  - media: pci: cx23885: Fix the error handling in cx23885_initdev() (Zheyu Ma)   
  - media: venus: hfi: avoid null dereference in deinit (Luca Weiss)   
  - ath9k: fix QCA9561 PA bias level (Thibaut VARÈNE)   
  - drm/amd/pm: fix double free in si_parse_power_table() (Keita Suzuki)   
  - ALSA: jack: Access input_dev under mutex (Amadeusz Sławiński)   
  - ACPICA: Avoid cache flush inside virtual machines (Kirill A. Shutemov)   
  - ipw2x00: Fix potential NULL dereference in libipw_xmit() (Haowen Bai)   
  - b43: Fix assigning negative value to unsigned variable (Haowen Bai)   
  - b43legacy: Fix assigning negative value to unsigned variable (Haowen Bai)   
  - mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue (Niels Dossche)   
  - drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes (Liu Zixian)   
  - btrfs: repair super block num_devices automatically (Qu Wenruo)   
  - btrfs: add "0x" prefix for unsupported optional features (Qu Wenruo)   
  - ptrace: Reimplement PTRACE_KILL by always sending SIGKILL (Eric W. Biederman)   
  - ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP (Eric W. Biederman)   
  - USB: new quirk for Dell Gen 2 devices (Monish Kumar R)   
  - USB: serial: option: add Quectel BG95 modem (Carl Yin(殷张成))   
  - binfmt_flat: do not stop relocating GOT entries prematurely on riscv (Niklas Cassel)   
  - Linux 4.14.282 (Greg Kroah-Hartman)   
  - bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes (Liu Jian)   
  - NFSD: Fix possible sleep during nfsd4_release_lockowner() (Chuck Lever)   
  - docs: submitting-patches: Fix crossref to 'The canonical patch format' (Akira Yokosawa)   
  - tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe() (Xiu Jianfeng)   
  - dm verity: set DM_TARGET_IMMUTABLE feature flag (Sarthak Kukreti)   
  - dm stats: add cond_resched when looping over entries (Mikulas Patocka)   
  - dm crypt: make printing of the key constant-time (Mikulas Patocka)   
  - dm integrity: fix error code in dm_integrity_ctr() (Dan Carpenter)   
  - zsmalloc: fix races between asynchronous zspage free and page migration (Sultan Alsawaf)   
  - netfilter: conntrack: re-fetch conntrack after insertion (Florian Westphal)   
  - exec: Force single empty string when argv is empty (Kees Cook)   
  - block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern (Haimin Zhang)   
  - drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency() (Gustavo A. R. Silva)   
  - drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers (Piyush Malgujar)   
  - net: ftgmac100: Disable hardware checksum on AST2600 (Joel Stanley)   
  - net: af_key: check encryption module availability consistency (Thomas Bartschies)   
  - ACPI: sysfs: Fix BERT error region memory mapping (Lorenzo Pieralisi)   
  - ACPI: sysfs: Make sparse happy about address space in use (Andy Shevchenko)   
  - secure_seq: use the 64 bits of the siphash for port offset calculation (Willy Tarreau)   
  - tcp: change source port randomizarion at connect() time (Eric Dumazet)   
  - staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan() (Denis Efremov (Oracle))   
  - x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests (Thomas Gleixner)   
  - Linux 4.14.281 (Greg Kroah-Hartman)   
  - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE"" (Linus Torvalds)   
  - swiotlb: fix info leak with DMA_FROM_DEVICE (Halil Pasic)   
  - net: atlantic: verify hw_head_ lies within TX buffer ring (Grant Grundler)   
  - net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe() (Yang Yingliang)   
  - ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one() (Yang Yingliang)   
  - mac80211: fix rx reordering with non explicit / psmp ack policy (Felix Fietkau)   
  - scsi: qla2xxx: Fix missed DMA unmap for aborted commands (Gleb Chesnokov)   
  - perf bench numa: Address compiler error on s390 (Thomas Richter)   
  - gpio: mvebu/pwm: Refuse requests with inverted polarity (Uwe Kleine-König)   
  - gpio: gpio-vf610: do not touch other bits when set the target bit (Haibo Chen)   
  - net: bridge: Clear offload_fwd_mark when passing frame up bridge interface. (Andrew Lunn)   
  - igb: skip phy status check where unavailable (Kevin Mitchell)   
  - ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 (Ard Biesheuvel)   
  - ARM: 9196/1: spectre-bhb: enable for Cortex-A15 (Ard Biesheuvel)   
  - net: af_key: add check for pfkey_broadcast in function pfkey_process (Jiasheng Jiang)   
  - NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc (Duoming Zhou)   
  - net/qla3xxx: Fix a test in ql_reset_work() (Christophe JAILLET)   
  - clk: at91: generated: consider range when calculating best rate (Codrin Ciubotariu)   
  - net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() (Zixuan Fu)   
  - net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() (Zixuan Fu)   
  - mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch() (Ulf Hansson)   
  - mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD (Ulf Hansson)   
  - mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC (Ulf Hansson)   
  - drm/dp/mst: fix a possible memory leak in fetch_monitor_name() (Hangyu Hua)   
  - ALSA: wavefront: Proper check of get_user() error (Takashi Iwai)   
  - ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() (linyujun)   
  - drbd: remove usage of list iterator variable after loop (Jakob Koschel)   
  - MIPS: lantiq: check the return value of kzalloc() (Xiaoke Wang)   
  - Input: stmfts - fix reference leak in stmfts_input_open (Zheng Yongjun)   
  - Input: add bounds checking to input_set_capability() (Jeff LaBundy)   
  - um: Cleanup syscall_handler_t definition/cast, fix warning (David Gow)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.519.0.el7uek]
changelog:
  - media: em28xx: initialize refcount before kref_get (Dongliang Mu)  [Orabug: 34619521]  {CVE-2022-3239} 
  - net: vlan: Avoid using BUG() in vlan_proto_idx() (Florian Fainelli)  [Orabug: 34625406]  
  - net/rds: Send congestion map updates only via path zero (Anand Khoje)  [Orabug: 34578052]  
  - rds: cong: Make rds_cong_wait an array to reduce lock contention (Håkon Bugge)  [Orabug: 34574094]  
  - rds: cong: Make rs_cong_notify and rs_cong_mask atomic64_t (Håkon Bugge)  [Orabug: 34574094]  
  - scsi: tcmu: track nl commands (Mike Christie)  [Orabug: 32011411]  
  - scsi: tcmu: remove useless code and clean up the code style. (Xiubo Li)  [Orabug: 32011411]  
  - Linux 4.14.295 (Greg Kroah-Hartman)   
  - ext4: make directory inode spreading reflect flexbg size (Jan Kara)   
  - Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region (Vitaly Kuznetsov)   
  - s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup (Stefan Haberland)   
  - serial: tegra: Use uart_xmit_advance(), fixes icount.tx accounting (Ilpo Järvinen)   
  - serial: Create uart_xmit_advance() (Ilpo Järvinen)   
  - net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD (Sean Anderson)   
  - perf kcore_copy: Do not check /proc/modules is unchanged (Adrian Hunter)   
  - can: gs_usb: gs_can_open(): fix race dev->can.state condition (Marc Kleine-Budde)   
  - netfilter: ebtables: fix memory leak when blob is malformed (Florian Westphal)   
  - of: mdio: Add of_node_put() when breaking out of for_each_xx (Liang He)   
  - MIPS: lantiq: export clk_get_io() for lantiq_wdt.ko (Randy Dunlap)   
  - net: team: Unsync device addresses on ndo_stop (Benjamin Poirier)   
  - ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header (Lu Wei)   
  - iavf: Fix cached head and tail value for iavf_get_tx_pending (Brett Creeley)   
  - netfilter: nf_conntrack_irc: Tighten matching on DCC message (David Leadbeater)   
  - netfilter: nf_conntrack_sip: fix ct_sip_walk_headers (Igor Ryzhov)   
  - arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma (Fabio Estevam)   
  - mm/slub: fix to return errno if kmalloc() fails (Chao Yu)   
  - ALSA: hda: add Intel 5 Series / 3400 PCI DID (Kai Vehmanen)   
  - ALSA: hda/tegra: set depop delay for tegra (Mohan Kumar)   
  - USB: serial: option: add Quectel RM520N (jerry meng)   
  - USB: serial: option: add Quectel BG95 0x0203 composition (Carl Yin(殷张成))   
  - USB: core: Fix RST error in hub.c (Alan Stern)   
  - wifi: mac80211: Fix UAF in ieee80211_scan_rx() (Siddh Raman Pant)   
  - ALSA: hda/sigmatel: Fix unused variable warning for beep power change (Takashi Iwai)   
  - video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write (Hyunwoo Kim)   
  - mksysmap: Fix the mismatch of 'L0' symbols in System.map (Youling Tang)   
  - MIPS: OCTEON: irq: Fix octeon_irq_force_ciu_mapping() (Alexander Sverdlin)   
  - net: usb: qmi_wwan: add Quectel RM520N (jerry.meng)   
  - ALSA: hda/sigmatel: Keep power up while beep is enabled (Takashi Iwai)   
  - regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe() (Xiaolei Wang)   
  - ASoC: nau8824: Fix semaphore unbalance at error paths (Takashi Iwai)   
  - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Stefan Metzmacher)   
  - parisc: ccio-dma: Add missing iounmap in error path in ccio_probe() (Yang Yingliang)   
  - drm/meson: Correct OSD1 global alpha value (Stuart Menefy)   
  - gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in mpc85xx (Pali Rohár)   
  - of: fdt: fix off-by-one error in unflatten_dt_nodes() (Sergey Shtylyov)   
  - Linux 4.14.294 (Greg Kroah-Hartman)   
  - tracefs: Only clobber mode/uid/gid on remount if asked (Brian Norris)   
  - platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes (Hans de Goede)   
  - ieee802154: cc2520: add rc code in cc2520_tx() (Li Qiong)   
  - tg3: Disable tg3 device on system reboot to avoid triggering AER (Kai-Heng Feng)   
  - HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo (Jason Wang)   
  - drm/msm/rd: Fix FIFO-full deadlock (Rob Clark)   
  - mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region() (Jann Horn)   
  - Linux 4.14.293 (Greg Kroah-Hartman)   
  - SUNRPC: use _bh spinlocking on ->transport_lock (NeilBrown)   
  - MIPS: loongson32: ls1c: Fix hang during startup (Yang Ling)   
  - USB: serial: ch341: fix disabled rx timer on older devices (Johan Hovold)   
  - USB: serial: ch341: fix lost character on LCR updates (Johan Hovold)   
  - usb: dwc3: fix PHY disable sequence (Johan Hovold)   
  - sch_sfb: Also store skb len before calling child enqueue (Toke Høiland-Jørgensen)   
  - tcp: fix early ETIMEDOUT after spurious non-SACK RTO (Neal Cardwell)   
  - ipv6: sr: fix out-of-bounds read when setting HMAC data. (David Lebrun)   
  - tipc: fix shift wrapping bug in map_get() (Dan Carpenter)   
  - sch_sfb: Don't assume the skb is still around after enqueueing to child (Toke Høiland-Jørgensen)   
  - netfilter: nf_conntrack_irc: Fix forged IP logic (David Leadbeater)   
  - netfilter: br_netfilter: Drop dst references before setting. (Harsh Modi)   
  - driver core: Don't probe devices after bus_type.match() probe deferral (Isaac J. Manjarres)   
  - scsi: mpt3sas: Fix use-after-free warning (Sreekanth Reddy)   
  - kprobes: Prohibit probes in gate area (Christian A. Ehrhardt)   
  - ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() (Dongxiang Ke)   
  - ALSA: aloop: Fix random zeros in capture data when using jiffies timer (Pattara Teerapong)   
  - ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() (Tasos Sahanidis)   
  - fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init() (Yang Yingliang)   
  - parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines (Helge Deller)   
  - parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources() (Li Qiong)   
  - drm/radeon: add a force flush to delay work when radeon (Zhenneng Li)   
  - drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup. (Candice Li)   
  - Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()" (Yee Lee)   
  - fs: only do a memory barrier for the first set_buffer_uptodate() (Linus Torvalds)   
  - wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd() (Stanislaw Gruszka)   
  - efi: capsule-loader: Fix use-after-free in efi_capsule_write (Hyunwoo Kim)   
  - ALSA: seq: Fix data-race at module auto-loading (Takashi Iwai)   
  - ALSA: seq: oss: Fix data-race for max_midi_devs access (Takashi Iwai)   
  - net: mac802154: Fix a condition in the receive path (Miquel Raynal)   
  - wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected (Siddh Raman Pant)   
  - usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS (Krishna Kurapati)   
  - USB: core: Prevent nested device-reset calls (Alan Stern)   
  - s390: fix nospec table alignments (Josh Poimboeuf)   
  - s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages (Gerald Schaefer)   
  - usb-storage: Add ignore-residue quirk for NXP PN7462AU (Witold Lipieta)   
  - USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020) (Thierry GUIBERT)   
  - usb: dwc2: fix wrong order of phy_power_on and phy_init (Heiner Kallweit)   
  - USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode (Slark Xiao)   
  - USB: serial: option: add Quectel EM060K modem (Yonglin Tan)   
  - USB: serial: option: add support for OPPO R11 diag port (Yan Xinyu)   
  - USB: serial: cp210x: add Decagon UCA device id (Johan Hovold)   
  - xhci: Add grace period after xHC start to prevent premature runtime suspend. (Mathias Nyman)   
  - thunderbolt: Use the actual buffer in tb_async_error() (Mika Westerberg)   
  - hwmon: (gpio-fan) Fix array out of bounds access (Armin Wolf)   
  - Input: rk805-pwrkey - fix module autoloading (Peter Robinson)   
  - drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported" (Colin Ian King)   
  - binder: fix UAF of ref->proc caused by race condition (Carlos Llamas)   
  - USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id (Niek Nooijens)   
  - vt: Clear selection before changing the font (Helge Deller)   
  - staging: rtl8712: fix use after free bugs (Dan Carpenter)   
  - serial: fsl_lpuart: RS485 RTS polariy is inverse (Shenwei Wang)   
  - kcm: fix strp_init() order and cleanup (Cong Wang)   
  - ethernet: rocker: fix sleep in atomic context bug in neigh_timer_handler (Duoming Zhou)   
  - wifi: cfg80211: debugfs: fix return type in ht40allow_map_read() (Dan Carpenter)   
  - platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask (Andy Shevchenko)   
  - drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg (Douglas Anderson)   
  - bpf: Fix the off-by-two error in range markings (Maxim Mikityanskiy)   
  - selftests/bpf: Fix test_align verifier log patterns (Stanislav Fomichev)   
  - bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() (John Fastabend)   
  - Linux 4.14.292 (Greg Kroah-Hartman)   
  - net: neigh: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - kprobes: don't call disarm_kprobe() for disabled kprobes (Kuniyuki Iwashima)   
  - netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y (Geert Uytterhoeven)   
  - s390/hypfs: avoid error message under KVM (Juergen Gross)   
  - neigh: fix possible DoS due to net iface start/stop loop (Denis V. Lunev)   
  - mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (Jann Horn)   
  - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (Yang Jihong)   
  - fbdev: fb_pm2fb: Avoid potential divide by zero error (Letu Ren)   
  - HID: hidraw: fix memory leak in hidraw_release() (Karthik Alapati)   
  - media: pvrusb2: fix memory leak in pvr_probe (Dongliang Mu)   
  - Bluetooth: L2CAP: Fix build errors in some archs (Luiz Augusto von Dentz)   
  - kbuild: Fix include path in scripts/Makefile.modpost (Jing Leng)   
  - x86/bugs: Add "unknown" reporting for MMIO Stale Data (Pawan Gupta)   
  - x86/cpu: Add Tiger Lake to Intel family (Gayatri Kammela)   
  - s390/mm: do not trigger write fault when vma does not allow VM_WRITE (Gerald Schaefer)   
  - arm64: map FDT as RW for early_init_dt_scan() (Hsin-Yi Wang)   
  - mm: Force TLB flush for PFNMAP mappings before unlink_file_vma() (Jann Horn)   
  - md: call __md_stop_writes in md_stop (Guoqing Jiang)   
  - mm/hugetlb: fix hugetlb not supporting softdirty tracking (David Hildenbrand)   
  - asm-generic: sections: refactor memory_intersects (Quanyang Wang)   
  - loop: Check for overflow while configuring loop (Siddh Raman Pant)   
  - btrfs: check if root is readonly while setting security xattr (Goldwyn Rodrigues)   
  - ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter (Jacob Keller)   
  - net: Fix a data-race around sysctl_somaxconn. (Kuniyuki Iwashima)   
  - net: Fix a data-race around netdev_budget_usecs. (Kuniyuki Iwashima)   
  - net: Fix a data-race around netdev_budget. (Kuniyuki Iwashima)   
  - net: Fix a data-race around sysctl_net_busy_read. (Kuniyuki Iwashima)   
  - net: Fix a data-race around sysctl_net_busy_poll. (Kuniyuki Iwashima)   
  - net: Fix a data-race around sysctl_tstamp_allow_data. (Kuniyuki Iwashima)   
  - ratelimit: Fix data-races in ___ratelimit(). (Kuniyuki Iwashima)   
  - net: Fix data-races around weight_p and dev_weight_[rt]x_bias. (Kuniyuki Iwashima)   
  - netfilter: nft_payload: do not truncate csum_offset and csum_type (Pablo Neira Ayuso)   
  - netfilter: nft_payload: report ERANGE for too long offset and length (Pablo Neira Ayuso)   
  - net: ipvtap - add __init/__exit annotations to module init/exit funcs (Maciej Żenczykowski)   
  - bonding: 802.3ad: fix no transmission of LACPDUs (Jonathan Toppins)   
  - rose: check NULL rose_loopback_neigh->loopback (Bernard Pidoux)   
  - xfrm: fix refcount leak in __xfrm_policy_check() (Xin Xiong)   
  - pinctrl: amd: Don't save/restore interrupt status and wake status bits (Basavaraj Natikar)   
  - parisc: Fix exception handler for fldw and fstw instructions (Helge Deller)   
  - audit: fix potential double free on error path from fsnotify_add_inode_mark (Gaosheng Cui)   
  - Linux 4.14.291 (Greg Kroah-Hartman)   
  - MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 (Nathan Chancellor)   
  - video: fbdev: i740fb: Check the argument of i740_calc_vclk() (Zheyu Ma)   
  - powerpc/64: Init jump labels before parse_early_param() (Zhouyi Zhou)   
  - smb3: check xattr value length earlier (Steve French)   
  - ALSA: timer: Use deferred fasync helper (Takashi Iwai)   
  - ALSA: core: Add async signal helpers (Takashi Iwai)   
  - mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start (Liang He)   
  - vfio: Clear the caps->buf to NULL after free (Schspa Shi)   
  - tty: serial: Fix refcount leak bug in ucc_uart.c (Liang He)   
  - ext4: avoid resizing to a partial cluster size (Kiselev, Oleg)   
  - ext4: avoid remove directory when directory is corrupted (Ye Bin)   
  - drivers:md:fix a potential use-after-free bug (Wentao_Liang)   
  - cxl: Fix a memory leak in an error handling path (Christophe JAILLET)   
  - gadgetfs: ep_io - wait until IRQ finishes (Jozef Martiniak)   
  - clk: qcom: ipq8074: dont disable gcc_sleep_clk_src (Robert Marko)   
  - usb: host: ohci-ppc-of: Fix refcount leak bug (Liang He)   
  - irqchip/tegra: Fix overflow implicit truncation warnings (Sai Prakash Ranjan)   
  - PCI: Add ACS quirk for Broadcom BCM5750x NICs (Pavan Chebbi)   
  - drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors() (Liang He)   
  - btrfs: raid56: don't trust any cached sector in __raid56_parity_recover() (Qu Wenruo)   
  - btrfs: only write the sectors in the vertical stripe which has data stripes (Qu Wenruo)   
  - kbuild: clear LDFLAGS in the top Makefile (Masahiro Yamada)   
  - igb: Add lock to avoid data race (Lin Ma)   
  - fec: Fix timer capture timing in `fec_ptp_enable_pps()` (Csókás Bence)   
  - i40e: Fix to stop tx_timeout recovery if GLOBR fails (Alan Brady)   
  - powerpc/pci: Fix get_phb_number() locking (Michael Ellerman)   
  - netfilter: nf_tables: really skip inactive sets when allocating name (Pablo Neira Ayuso)   
  - nios2: add force_successful_syscall_return() (Al Viro)   
  - nios2: restarts apply only to the first sigframe we build... (Al Viro)   
  - nios2: fix syscall restart checks (Al Viro)   
  - nios2: traced syscall does need to check the syscall number (Al Viro)   
  - nios2: don't leave NULLs in sys_call_table[] (Al Viro)   
  - nios2: page fault et.al. are *not* restartable syscalls... (Al Viro)   
  - atm: idt77252: fix use-after-free bugs caused by tst_timer (Duoming Zhou)   
  - xen/xenbus: fix return type in xenbus_file_read() (Dan Carpenter)   
  - tools build: Switch to new openssl API for test-libcrypto (Roberto Sassu)   
  - vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout() (Peilin Ye)   
  - vsock: Fix memory leak in vsock_connect() (Peilin Ye)   
  - geneve: do not use RT_TOS for IPv6 flowlabel (Matthias May)   
  - ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool (Sakari Ailus)   
  - pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed (Nikita Travkin)   
  - pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map (Miaoqian Lin)   
  - SUNRPC: Reinitialise the backchannel request buffers before reuse (Trond Myklebust)   
  - NFSv4.1: RECLAIM_COMPLETE must handle EACCES (Zhang Xianwei)   
  - apparmor: fix reference count leak in aa_pivotroot() (Xin Xiong)   
  - apparmor: fix aa_label_asxprint return check (Tom Rix)   
  - apparmor: Fix failed mount permission check error message (John Johansen)   
  - apparmor: fix quiet_denied for file rules (John Johansen)   
  - can: ems_usb: fix clang's -Wunaligned-access warning (Marc Kleine-Budde)   
  - btrfs: fix lost error handling when looking up extended ref on log replay (Filipe Manana)   
  - ata: libata-eh: Add missing command name (Damien Le Moal)   
  - ALSA: info: Fix llseek return value when using callback (Amadeusz Sławiński)   
  - powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E (Christophe Leroy)   
  - net_sched: cls_route: disallow handle of 0 (Jamal Hadi Salim)   
  - net/9p: Initialize the iounit field during fid creation (Tyler Hicks)   
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression (Luiz Augusto von Dentz)   
  - Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" (Jose Alonso)   
  - scsi: sg: Allow waiting for commands to complete on removed device (Tony Battersby)   
  - tcp: fix over estimation in sk_forced_mem_schedule() (Eric Dumazet)   
  - btrfs: reject log replay if there is unsupported RO compat flag (Qu Wenruo)   
  - dm raid: fix address sanitizer warning in raid_status (Mikulas Patocka)   
  - dm raid: fix address sanitizer warning in raid_resume (Mikulas Patocka)   
  - intel_th: pci: Add Meteor Lake-P support (Alexander Shishkin)   
  - intel_th: pci: Add Raptor Lake-S PCH support (Alexander Shishkin)   
  - intel_th: pci: Add Raptor Lake-S CPU support (Alexander Shishkin)   
  - ext4: correct the misjudgment in ext4_iget_extra_inode (Baokun Li)   
  - ext4: correct max_inline_xattr_value_size computing (Baokun Li)   
  - ext4: fix extent status tree race in writeback error recovery path (Eric Whitney)   
  - ext4: update s_overhead_clusters in the superblock during an on-line resize (Theodore Ts'o)   
  - ext4: fix use-after-free in ext4_xattr_set_entry (Baokun Li)   
  - ext4: make sure ext4_append() always allocates new block (Lukas Czerner)   
  - ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (Baokun Li)   
  - spmi: trace: fix stack-out-of-bound access in SPMI tracing functions (David Collins)   
  - x86/olpc: fix 'logical not is only applied to the left hand side' (Alexander Lobakin)   
  - scsi: zfcp: Fix missing auto port scan and thus missing target ports (Steffen Maier)   
  - video: fbdev: s3fb: Check the size of screen before memset_io() (Zheyu Ma)   
  - video: fbdev: arkfb: Check the size of screen before memset_io() (Zheyu Ma)   
  - video: fbdev: vt8623fb: Check the size of screen before memset_io() (Zheyu Ma)   
  - tools/thermal: Fix possible path truncations (Florian Fainelli)   
  - video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() (Zheyu Ma)   
  - x86/numa: Use cpumask_available instead of hardcoded NULL check (Siddh Raman Pant)   
  - genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO (Arnaldo Carvalho de Melo)   
  - powerpc/pci: Fix PHB numbering when using opal-phbid (Michael Ellerman)   
  - kprobes: Forbid probing on trampoline and BPF code areas (Chen Zhongjin)   
  - powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address (Miaoqian Lin)   
  - powerpc/xive: Fix refcount leak in xive_get_max_prio (Miaoqian Lin)   
  - powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader (Miaoqian Lin)   
  - powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias (Pali Rohár)   
  - video: fbdev: sis: fix typos in SiS_GetModeID() (Rustam Subkhankulov)   
  - video: fbdev: amba-clcd: Fix refcount leak bugs (Liang He)   
  - s390/zcore: fix race when reading from hardware system area (Alexander Gordeev)   
  - iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop (Liang He)   
  - mfd: t7l66xb: Drop platform disable callback (Uwe Kleine-König)   
  - kfifo: fix kfifo_to_user() return type (Dan Carpenter)   
  - iommu/exynos: Handle failed IOMMU device registration properly (Sam Protsenko)   
  - tty: n_gsm: fix DM command (Daniel Starke)   
  - tty: n_gsm: fix wrong T1 retry count handling (Daniel Starke)   
  - vfio/ccw: Do not change FSM state in subchannel event (Eric Farman)   
  - remoteproc: qcom: wcnss: Fix handling of IRQs (Sireesh Kodali)   
  - tty: n_gsm: fix race condition in gsmld_write() (Daniel Starke)   
  - tty: n_gsm: fix packet re-transmission without open control channel (Daniel Starke)   
  - tty: n_gsm: fix non flow control frames during mux flow off (Daniel Starke)   
  - profiling: fix shift too large makes kernel panic (Chen Zhongjin)   
  - ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe (Miaoqian Lin)   
  - ASoC: codecs: da7210: add check for i2c_add_driver (Jiasheng Jiang)   
  - ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe (Miaoqian Lin)   
  - jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted (Zhihao Cheng)   
  - ext4: recover csum seed of tmp_inode after migrating to extents (Li Lingfeng)   
  - RDMA/rxe: Fix error unwind in rxe_create_qp() (Zhu Yanjun)   
  - mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region (Miaohe Lin)   
  - platform/olpc: Fix uninitialized data in debugfs write (Dan Carpenter)   
  - USB: serial: fix tty-port initialized comments (Johan Hovold)   
  - mmc: cavium-thunderx: Add of_node_put() when breaking out of loop (Liang He)   
  - mmc: cavium-octeon: Add of_node_put() when breaking out of loop (Liang He)   
  - gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data() (Liang He)   
  - RDMA/hfi1: fix potential memory leak in setup_base_ctxt() (Jianglei Nie)   
  - usb: gadget: udc: amd5536 depends on HAS_DMA (Randy Dunlap)   
  - scsi: smartpqi: Fix DMA direction for RAID requests (Mahesh Rajashekhara)   
  - mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R (Eugen Hristev)   
  - memstick/ms_block: Fix a memory leak (Christophe JAILLET)   
  - memstick/ms_block: Fix some incorrect memory allocation (Christophe JAILLET)   
  - mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch (Miaoqian Lin)   
  - misc: rtsx: Fix an error handling path in rtsx_pci_probe() (Christophe JAILLET)   
  - usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe (Miaoqian Lin)   
  - usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe (Miaoqian Lin)   
  - fpga: altera-pr-ip: fix unsigned comparison with less than zero (Marco Pagani)   
  - mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path (Uwe Kleine-König)   
  - mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release (Duoming Zhou)   
  - mtd: maps: Fix refcount leak in ap_flash_init (Miaoqian Lin)   
  - mtd: maps: Fix refcount leak in of_flash_probe_versatile (Miaoqian Lin)   
  - dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock (Hangyu Hua)   
  - net: rose: fix netdev reference changes (Eric Dumazet)   
  - wifi: libertas: Fix possible refcount leak in if_usb_probe() (Hangyu Hua)   
  - wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()` (Ammar Faizi)   
  - i2c: mux-gpmux: Add of_node_put() when breaking out of loop (Liang He)   
  - i2c: cadence: Support PEC for SMBus block read (Lars-Peter Clausen)   
  - Bluetooth: hci_intel: Add check for platform_driver_register (Jiasheng Jiang)   
  - can: pch_can: pch_can_error(): initialize errc before using it (Vincent Mailhol)   
  - can: error: specify the values of data[5..7] of CAN error frames (Vincent Mailhol)   
  - can: usb_8dev: do not report txerr and rxerr during bus-off (Vincent Mailhol)   
  - can: sun4i_can: do not report txerr and rxerr during bus-off (Vincent Mailhol)   
  - can: hi311x: do not report txerr and rxerr during bus-off (Vincent Mailhol)   
  - can: sja1000: do not report txerr and rxerr during bus-off (Vincent Mailhol)   
  - can: rcar_can: do not report txerr and rxerr during bus-off (Vincent Mailhol)   
  - can: pch_can: do not report txerr and rxerr during bus-off (Vincent Mailhol)   
  - wifi: p54: add missing parentheses in p54_flush() (Rustam Subkhankulov)   
  - wifi: p54: Fix an error handling path in p54spi_probe() (Christophe JAILLET)   
  - wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() (Dan Carpenter)   
  - fs: check FMODE_LSEEK to control internal pipe splicing (Jason A. Donenfeld)   
  - selftests: timers: clocksource-switch: fix passing errors from child (Wolfram Sang)   
  - selftests: timers: valid-adjtimex: build fix for newer toolchains (Wolfram Sang)   
  - tcp: make retransmitted SKB fit into the send window (Yonglong Li)   
  - media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment (AngeloGioacchino Del Regno)   
  - drm: bridge: sii8620: fix possible off-by-one (Hangyu Hua)   
  - drm/mediatek: dpi: Remove output format of YUV (Bo-Chen Chen)   
  - drm/rockchip: vop: Don't crash for invalid duplicate_state() (Brian Norris)   
  - drm/vc4: dsi: Correct DSI divider calculations (Dave Stevenson)   
  - media: hdpvr: fix error value returns in hdpvr_read (Niels Dossche)   
  - drm: bridge: adv7511: Add check for mipi_dsi_driver_register (Jiasheng Jiang)   
  - wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd() (Alexey Kodanev)   
  - ath9k: fix use-after-free in ath9k_hif_usb_rx_cb (Pavel Skripkin)   
  - i2c: Fix a potential use after free (Xu Wang)   
  - drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function (Xinlei Lee)   
  - drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() (Alexey Kodanev)   
  - dm: return early from dm_pr_call() if DM device is suspended (Mike Snitzer)   
  - thermal/tools/tmon: Include pthread and time headers in tmon.h (Markus Mayer)   
  - regulator: of: Fix refcount leak bug in of_get_regulation_constraints() (Liang He)   
  - arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node (Sireesh Kodali)   
  - ARM: dts: qcom: pm8841: add required thermal-sensor-cells (Krzysztof Kozlowski)   
  - cpufreq: zynq: Fix refcount leak in zynq_get_revision (Miaoqian Lin)   
  - soc: fsl: guts: machine variable might be unset (Michael Walle)   
  - ARM: dts: ast2500-evb: fix board compatible (Krzysztof Kozlowski)   
  - x86/pmem: Fix platform-device leak in error path (Johan Hovold)   
  - ARM: bcm: Fix refcount leak in bcm_kona_smc_init (Miaoqian Lin)   
  - ARM: findbit: fix overflowing offset (Russell King (Oracle))   
  - selinux: Add boundary check in put_entry() (Xiu Jianfeng)   
  - PM: hibernate: defer device probing when resuming from hibernation (Tetsuo Handa)   
  - ACPI: LPSS: Fix missing check in register_device_clock() (huhai)   
  - ACPI: PM: save NVS memory for Lenovo G40-45 (Manyi Li)   
  - ARM: OMAP2+: display: Fix refcount leak bug (Liang He)   
  - ARM: dts: imx6ul: fix qspi node compatible (Alexander Stein)   
  - ARM: dts: imx6ul: add missing properties for sram (Alexander Stein)   
  - ext2: Add more validity checks for inode counts (Jan Kara)   
  - arm64: fix oops in concurrently setting insn_emulation sysctls (haibinzhang (张海斌))   
  - arm64: Do not forget syscall when starting a new thread. (Francis Laniel)   
  - netfilter: nf_tables: fix null deref due to zeroed list head (Florian Westphal)   
  - USB: HCD: Fix URB giveback issue in tasklet function (Weitao Wang)   
  - MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK (Huacai Chen)   
  - powerpc/powernv: Avoid crashing if rng is NULL (Michael Ellerman)   
  - powerpc/fsl-pci: Fix Class Code of PCIe Root Port (Pali Rohár)   
  - PCI: Add defines for normal and subtractive PCI bridges (Pali Rohár)   
  - ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr() (Alexander Lobakin)   
  - md-raid10: fix KASAN warning (Mikulas Patocka)   
  - fuse: limit nsec (Miklos Szeredi)   
  - iio: light: isl29028: Fix the warning in isl29028_remove() (Zheyu Ma)   
  - drm/amdgpu: Check BO's requested pinning domains against its preferred_domains (Leo Li)   
  - drm/nouveau: fix another off-by-one in nvbios_addr (Timur Tabi)   
  - parisc: Fix device names in /proc/iomem (Helge Deller)   
  - usbnet: Fix linkwatch use-after-free on disconnect (Lukas Wunner)   
  - fs: Add missing umask strip in vfs_tmpfile (Yang Xu)   
  - vfs: Check the truncate maximum size in inode_newsize_ok() (David Howells)   
  - ALSA: hda/cirrus - support for iMac 12,1 model (Allen Ballway)   
  - ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model (Meng Tang)   
  - KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP (Sean Christopherson)   
  - KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks (Sean Christopherson)   
  - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (Maciej S. Szmigiero)   
  - HID: wacom: Don't register pad_input for touch switch (Ping Cheng)   
  - add barriers to buffer_uptodate and set_buffer_uptodate (Mikulas Patocka)   
  - ALSA: bcd2000: Fix a UAF bug on the error path of probing (Zheyu Ma)   
  - x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments (Nick Desaulniers)   
  - Makefile: link with -z noexecstack --no-warn-rwx-segments (Nick Desaulniers)   
  - macintosh/adb: fix oob read in do_adb_query() function (Ning Qiang)   
  - ACPI: video: Shortening quirk list by identifying Clevo by board_name only (Werner Sembach)   
  - ACPI: video: Force backlight native for some TongFang devices (Werner Sembach)   
  - mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle. (Wei Mingzhi)   
  - ARM: crypto: comment out gcc warning that breaks clang builds (Greg Kroah-Hartman)   
  - netfilter: nf_queue: do not allow packet truncation below transport header offset (Florian Westphal)   
  - net: sungem_phy: Add of_node_put() for reference returned by of_get_parent() (Liang He)   
  - net: ping6: Fix memleak in ipv6_renew_options(). (Kuniyuki Iwashima)   
  - scsi: ufs: host: Hold reference returned by of_parse_phandle() (Liang He)   
  - s390/archrandom: prevent CPACF trng invocations in interrupt context (Harald Freudenberger)   
  - ntfs: fix use-after-free in ntfs_ucsncmp() (ChenXiaoSong)   
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (Luiz Augusto von Dentz)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.519.1.el7uek]
changelog:
  - uek: kabi: update kABI files for new symbol (Saeed Mirzamohammadi)  [Orabug: 34595585]  
  - EDAC/mce_amd: Do not load edac_mce_amd module on guests (Smita Koralahalli)  [Orabug: 34484269]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.519.2.el7uek]
changelog:
  - Revert "xfs: don't use delalloc extents for COW on files with extsize hints" (Saeed Mirzamohammadi)  [Orabug: 34715947]  
  - uapi: Fix linux/rds.h userspace compilation issues (Ka-Cheong Poon)  [Orabug: 32392165] [Orabug: 34710962]  
  - uapi: Fix linux/rds.h userspace compilation errors. (Vinson Lee)  [Orabug: 34710962]  
  - uapi: fix linux/rds.h userspace compilation error (Dmitry V. Levin)  [Orabug: 34710962]  
  - uapi: fix linux/rds.h userspace compilation errors (Dmitry V. Levin)  [Orabug: 34710962]  
  - EDAC: Drop duplicated array of strings for memory type names (Jane Chu)  [Orabug: 34645040]  
  - xfs: don't ever put nlink > 0 inodes on the unlinked list (Darrick J. Wong)  [Orabug: 34431355]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.519.2.1.el7uek]
changelog:
  - xfs: trim IO to found COW extent limit (Eric Sandeen)  [Orabug: 34765284]  
  - xfs: don't use delalloc extents for COW on files with extsize hints (Christoph Hellwig)  [Orabug: 34765284]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.520.0.el7uek]
changelog:
  - uapi: Fix [rs]cq_vector data types in rds[6]_info_rdma_connection (Mark Haywood)  [Orabug: 34732042]  
  - uapi: Fix congested flag type in rds[6]_info_socket (Mark Haywood)  [Orabug: 34732042]  
  - scsi: target: core: Silence the message about unknown VPD pages (Konstantin Shelekhin)  [Orabug: 34728690]  
  - mISDN: fix use-after-free bugs in l1oip timer handlers (Duoming Zhou)  [Orabug: 34719782]  {CVE-2022-3565} 
  - uek-rpm: add aarch64 to list of vdso arches (Tom Saeger)  [Orabug: 34716203]  
  - xfs: trim IO to found COW extent limit (Eric Sandeen)  [Orabug: 34705398]  
  - xfs: don't use delalloc extents for COW on files with extsize hints (Christoph Hellwig)  [Orabug: 34705398]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.520.1.el7uek]
changelog:
  - rds: ib: Fix cleanup of rds_ib_cache_gc_worker (Håkon Bugge)  [Orabug: 34806078]  
  - scsi: stex: Properly zero out the passthrough command structure (Linus Torvalds)  [Orabug: 34670756]  {CVE-2022-40768} 
  - do_wait: make PIDTYPE_PID case O(1) instead of O(n) (Jim Newsome)  [Orabug: 34420117]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.520.2.el7uek]
changelog:
  - rds: Remove the cp_rdsinfo_pending flag (Håkon Bugge)  [Orabug: 34658891]  
  - RDMA/mlx5: Change debug log level for remote access error syndromes (Arumugam Kolappan)  [Orabug: 34798453]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-2047.520.3.1.el7uek]
changelog:
  - proc: proc_skip_spaces() shouldn't think it is working on C strings (Linus Torvalds)  [Orabug: 34883027]  {CVE-2022-4378} 
  - proc: avoid integer type confusion in get_proc_long (Linus Torvalds)  [Orabug: 34883027]  {CVE-2022-4378} 
  - hugetlbfs: don't delete error page from pagecache (James Houghton)  [Orabug: 34883072]  
  - mm: shmem: don't truncate page if memory failure happens (Yang Shi)  [Orabug: 34883072]  
  - mm: hwpoison: refactor refcount check handling (Yang Shi)  [Orabug: 34883072]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.521.1.el7uek]
changelog:
  - net/mlx5: Use debug message instead of warn (Yishai Hadas)  [Orabug: 34834553]  
  - hugetlbfs: don't delete error page from pagecache (James Houghton)  [Orabug: 34772618]  
  - mm: shmem: don't truncate page if memory failure happens (Yang Shi)  [Orabug: 34772618]  
  - mm: hwpoison: refactor refcount check handling (Yang Shi)  [Orabug: 34772618]  
  - kvm: x86: limit the maximum number of vPMU fixed counters to 3 (Like Xu)  [Orabug: 34756992]  
  - LTS version: v4.14.298 (Saeed Mirzamohammadi)   
  - can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive (Biju Das)   
  - net: ehea: fix possible memory leak in ehea_register_port() (Yang Yingliang)   
  - openvswitch: switch from WARN to pr_warn (Aaron Conole)   
  - ALSA: aoa: Fix I2S device accounting (Takashi Iwai)   
  - ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() (Yang Yingliang)   
  - PM: domains: Fix handling of unavailable/disabled idle states (Sudeep Holla)   
  - net: ksz884x: fix missing pci_disable_device() on error in pcidev_init() (Yang Yingliang)   
  - i40e: Fix flow-type by setting GL_HASH_INSET registers (Slawomir Laba)   
  - i40e: Fix ethtool rx-flow-hash setting for X722 (Slawomir Laba)   
  - media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced' (Hans Verkuil)   
  - media: v4l2-dv-timings: add sanity checks for blanking values (Hans Verkuil)   
  - media: vivid: dev->bitmap_cap wasn't freed in all cases (Hans Verkuil)   
  - media: vivid: s_fbuf: add more sanity checks (Hans Verkuil)   
  - PM: hibernate: Allow hybrid sleep to work with s2idle (Mario Limonciello)   
  - can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path (Dongliang Mu)   
  - tcp: fix indefinite deferral of RTO with SACK reneging (Neal Cardwell)   
  - net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY (Zhang Changzhong)   
  - kcm: annotate data-races around kcm->rx_wait (Eric Dumazet)   
  - kcm: annotate data-races around kcm->rx_psock (Eric Dumazet)   
  - amd-xgbe: add the bit rate quirk for Molex cables (Raju Rangoju)   
  - amd-xgbe: fix the SFP compliance codes check for DAC cables (Raju Rangoju)   
  - x86/unwind/orc: Fix unreliable stack dump with gcov (Chen Zhongjin)   
  - ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() (Yang Yingliang)   
  - arc: iounmap() arg is volatile (Randy Dunlap)   
  - drm/msm: Fix return type of mdp4_lvds_connector_mode_valid (Nathan Huckleberry)   
  - net: ieee802154: fix error return code in dgram_bind() (Wei Yongjun)   
  - mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages (Rik van Riel)   
  - xen/gntdev: Prevent leaking grants (M. Vefa Bicakci)   
  - Xen/gntdev: don't ignore kernel unmapping error (Jan Beulich)   
  - s390/futex: add missing EX_TABLE entry to __futex_atomic_op() (Heiko Carstens)   
  - kernfs: fix use-after-free in __kernfs_remove (Christian A. Ehrhardt)   
  - mmc: core: Fix kernel panic when remove non-standard SDIO card (Matthew Ma)   
  - drm/msm/hdmi: fix memory corruption with too many bridges (Johan Hovold)   
  - mac802154: Fix LQI recording (Miquel Raynal)   
  - fbdev: smscufx: Fix several use-after-free bugs (Hyunwoo Kim)   
  - iio: light: tsl2583: Fix module unloading (Shreeya Patel)   
  - tools: iio: iio_utils: fix digit calculation (Matti Vaittinen)   
  - xhci: Remove device endpoints from bandwidth list when freeing the device (Mathias Nyman)   
  - usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller (Jens Glathe)   
  - usb: bdc: change state when port disconnected (Justin Chen)   
  - usb: dwc3: gadget: Don't set IMI for no_interrupt (Thinh Nguyen)   
  - USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM (Hannu Hartikainen)   
  - ALSA: au88x0: use explicitly signed char (Jason A. Donenfeld)   
  - ALSA: Use del_timer_sync() before freeing timer (Steven Rostedt (Google))   
  - ACPI: video: Force backlight native for more TongFang devices (Werner Sembach)   
  - media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls (Chen-Yu Tsai)   
  - iommu/vt-d: Clean up si_domain in the init_dmars() error path (Jerry Snitselaar)   
  - net: hns: fix possible memory leak in hnae_ae_register() (Yang Yingliang)   
  - net/atm: fix proc_mpc_write incorrect return value (Xiaobo Liu)   
  - HID: magicmouse: Do not set BTN_MOUSE on double report (José Expósito)   
  - ACPI: extlog: Handle multiple records (Tony Luck)   
  - btrfs: fix processing of delayed data refs during backref walking (Filipe Manana)   
  - r8152: add PID for the Lenovo OneLink+ Dock (Jean-Francois Le Fillatre)   
  - arm64: errata: Remove AES hwcap for COMPAT tasks (James Morse)   
  - KVM: arm64: vgic: Fix exit condition in scan_its_table() (Eric Ren)   
  - ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS (Kai-Heng Feng)   
  - ata: ahci-imx: Fix MODULE_ALIAS (Alexander Stein)   
  - x86/microcode/AMD: Apply the patch early on every logical thread (Borislav Petkov)   
  - ocfs2: fix BUG when iput after ocfs2_mknod fails (Joseph Qi)   
  - ocfs2: clear dinode links count in case of error (Joseph Qi)   
  - LTS version: v4.14.297 is skipped (Saeed Mirzamohammadi)   
  - LTS version: v4.14.296 (Saeed Mirzamohammadi)   
  - thermal: intel_powerclamp: Use first online CPU as control_cpu (Rafael J. Wysocki)   
  - inet: fully convert sk->sk_rx_dst to RCU rules (Eric Dumazet)   
  - efi: libstub: drop pointless get_memory_map() call (Ard Biesheuvel)   
  - md: Replace snprintf with scnprintf (Saurabh Sengar)   
  - ext4: continue to expand file system when the target size doesn't reach (Jerry Lee 李修賢)   
  - net/ieee802154: don't warn zero-sized raw_sendmsg() (Tetsuo Handa)   
  - net: ieee802154: return -EINVAL for unknown addr type (Alexander Aring)   
  - perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc (Adrian Hunter)   
  - usb: idmouse: fix an uninit-value in idmouse_open (Dongliang Mu)   
  - Revert "usb: storage: Add quirk for Samsung Fit flash" (sunghwan jung)   
  - usb: musb: Fix musb_gadget.c rxstate overflow bug (Robin Guo)   
  - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() (Jianglei Nie)   
  - md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d (Logan Gunthorpe)   
  - HID: roccat: Fix use-after-free in roccat_read() (Hyunwoo Kim)   
  - nbd: Fix hung when signal interrupts nbd_start_device_ioctl() (Shigeru Yoshida)   
  - scsi: 3w-9xxx: Avoid disabling device if failing to enable it (Letu Ren)   
  - media: cx88: Fix a null-ptr-deref bug in buffer_prepare() (Zheyu Ma)   
  - ARM: dts: imx6sl: add missing properties for sram (Alexander Stein)   
  - ARM: dts: imx6qp: add missing properties for sram (Alexander Stein)   
  - ARM: dts: imx6dl: add missing properties for sram (Alexander Stein)   
  - ARM: dts: imx6q: add missing properties for sram (Alexander Stein)   
  - ARM: dts: imx7d-sdb: config the max pressure for tsc2046 (Haibo Chen)   
  - drm/amdgpu: fix initial connector audio value (hongao)   
  - platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading (Hans de Goede)   
  - drm/vc4: vec: Fix timings for VEC modes (Mateusz Kwiatkowski)   
  - drm: Prevent drm_copy_field() to attempt copying a NULL pointer (Javier Martinez Canillas)   
  - drm: Use size_t type for len variable in drm_copy_field() (Javier Martinez Canillas)   
  - r8152: Rate limit overflow messages (Andrew Gaul)   
  - Bluetooth: L2CAP: Fix user-after-free (Luiz Augusto von Dentz)   
  - net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory (Liu Jian)   
  - wifi: rt2x00: correctly set BBP register 86 for MT7620 (Daniel Golle)   
  - wifi: rt2x00: set SoC wmac clock register (Daniel Golle)   
  - wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620 (Daniel Golle)   
  - wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620 (Daniel Golle)   
  - can: bcm: check the result of can_send() in bcm_can_tx() (Ziyang Xuan)   
  - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times (Luiz Augusto von Dentz)   
  - Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create() (Tetsuo Handa)   
  - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (Alexander Coffin)   
  - xfrm: Update ipcomp_scratches with NULL when freed (Khalid Masum)   
  - wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() (Tetsuo Handa)   
  - tcp: annotate data-race around tcp_md5sig_pool_populated (Eric Dumazet)   
  - openvswitch: Fix overreporting of drops in dropwatch (Mike Pattrick)   
  - openvswitch: Fix double reporting of drops in dropwatch (Mike Pattrick)   
  - wifi: brcmfmac: fix invalid address access when enabling SCAN log level (Wright Feng)   
  - NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data (Anna Schumaker)   
  - thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash (Srinivas Pandruvada)   
  - powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue (Chao Qin)   
  - MIPS: BCM47XX: Cast memcmp() of function to (void *) (Kees Cook)   
  - ACPI: video: Add Toshiba Satellite/Portege Z830 quirk (Arvid Norlander)   
  - f2fs: fix race condition on setting FI_NO_EXTENT flag (Zhang Qilong)   
  - iommu/iova: Fix module config properly (Robin Murphy)   
  - iommu/omap: Fix buffer overflow in debugfs (Dan Carpenter)   
  - powerpc: Fix SPE Power ISA properties for e500v1 platforms (Pali Rohár)   
  - powerpc/powernv: add missing of_node_put() in opal_export_attrs() (Zheng Yongjun)   
  - powerpc/pci_dn: Add missing of_node_put() (Liang He)   
  - powerpc/sysdev/fsl_msi: Add missing of_node_put() (Liang He)   
  - powerpc/math_emu/efp: Include module.h (Nathan Chancellor)   
  - mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg (Jack Wang)   
  - clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe (Miaoqian Lin)   
  - clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration (Stefan Wahren)   
  - spmi: pmic-arb: correct duplicate APID to PPID mapping logic (David Collins)   
  - dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup() (Dave Jiang)   
  - mfd: sm501: Add check for platform_driver_register() (Jiasheng Jiang)   
  - mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init() (Christophe JAILLET)   
  - mfd: lp8788: Fix an error handling path in lp8788_probe() (Christophe JAILLET)   
  - mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq() (Christophe JAILLET)   
  - mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe() (Christophe JAILLET)   
  - fsi: core: Check error number after calling ida_simple_get (Jiasheng Jiang)   
  - serial: 8250: Fix restoring termios speed after suspend (Pali Rohár)   
  - firmware: google: Test spinlock on panic path to avoid lockups (Guilherme G. Piccoli)   
  - phy: qualcomm: call clk_disable_unprepare in the error handling (Dongliang Mu)   
  - drivers: serial: jsm: fix some leaks in probe (Dan Carpenter)   
  - usb: gadget: function: fix dangling pnp_string in f_printer.c (Albert Briscoe)   
  - xhci: Don't show warning for reinit on known broken suspend (Mario Limonciello)   
  - md/raid5: Ensure stripe_fill happens on non-read IO with journal (Logan Gunthorpe)   
  - ata: fix ata_id_has_dipm() (Niklas Cassel)   
  - ata: fix ata_id_has_ncq_autosense() (Niklas Cassel)   
  - ata: fix ata_id_has_devslp() (Niklas Cassel)   
  - ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting() (Niklas Cassel)   
  - dyndbg: let query-modname override actual module name (Jim Cromie)   
  - dyndbg: fix module.dyndbg handling (Jim Cromie)   
  - RDMA/rxe: Fix the error caused by qp->sk (Zhu Yanjun)   
  - RDMA/rxe: Fix "kernel NULL pointer dereference" error (Zhu Yanjun)   
  - media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init (Miaoqian Lin)   
  - tty: xilinx_uartps: Fix the ignore_status (Shubhrajyoti Datta)   
  - media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop (Liang He)   
  - HSI: omap_ssi_port: Fix dma_map_sg error check (Jack Wang)   
  - HSI: omap_ssi: Fix refcount leak in ssi_probe (Miaoqian Lin)   
  - clk: tegra20: Fix refcount leak in tegra20_clock_init (Miaoqian Lin)   
  - clk: tegra: Fix refcount leak in tegra114_clock_init (Miaoqian Lin)   
  - clk: tegra: Fix refcount leak in tegra210_clock_init (Miaoqian Lin)   
  - clk: oxnas: Hold reference returned by of_get_parent() (Liang He)   
  - iio: ABI: Fix wrong format of differential capacitance channel ABI. (Jonathan Cameron)   
  - iio: inkern: only release the device node when done with it (Nuno Sá)   
  - iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX (Claudiu Beznea)   
  - ARM: dts: exynos: fix polarity of VBUS GPIO of Origen (Dmitry Torokhov)   
  - ARM: Drop CMDLINE_* dependency on ATAGS (Geert Uytterhoeven)   
  - ARM: dts: kirkwood: lsxl: remove first ethernet port (Michael Walle)   
  - ARM: dts: kirkwood: lsxl: fix serial line (Michael Walle)   
  - ARM: dts: turris-omnia: Fix mpp26 pin name and comment (Marek Behún)   
  - soc: qcom: smem_state: Add refcounting for the 'state->of_node' (Liang He)   
  - soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() (Liang He)   
  - memory: of: Fix refcount leak bug in of_get_ddr_timings() (Liang He)   
  - mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe() (Christophe JAILLET)   
  - ALSA: dmaengine: increment buffer pointer atomically (Andreas Pape)   
  - ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API (Liang He)   
  - mmc: au1xmmc: Fix an error handling path in au1xmmc_probe() (Christophe JAILLET)   
  - drm/bridge: megachips: Fix a null pointer dereference bug (Zheyu Ma)   
  - platform/x86: msi-laptop: Fix resource cleanup (Hans de Goede)   
  - platform/x86: msi-laptop: Fix old-ec check for backlight registering (Hans de Goede)   
  - drm/mipi-dsi: Detach devices when removing the host (Maxime Ripard)   
  - bnx2x: fix potential memory leak in bnx2x_tpa_stop() (Jianglei Nie)   
  - tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited (Neal Cardwell)   
  - vhost/vsock: Use kvmalloc/kvfree for larger packets. (Junichi Uekawa)   
  - spi: s3c64xx: Fix large transfers with DMA (Vincent Whitchurch)   
  - netfilter: nft_fib: Fix for rpath check with VRF devices (Phil Sutter)   
  - spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe (Zhang Qilong)   
  - net: fs_enet: Fix wrong check in do_pd_setup (Zheng Yongjun)   
  - wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration (Bitterblue Smith)   
  - wifi: rtl8xxxu: Fix skb misuse in TX queue selection (Bitterblue Smith)   
  - spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime() (Xu Qiang)   
  - spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume() (Xu Qiang)   
  - wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse() (Dan Carpenter)   
  - wifi: mac80211: allow bw change during channel switch in mesh (Hari Chandrakanthan)   
  - wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() (Wen Gong)   
  - sh: machvec: Use char[] for section boundaries (Kees Cook)   
  - selinux: use "grep -E" instead of "egrep" (Greg Kroah-Hartman)   
  - gcov: support GCC 12.1 and newer compilers (Martin Liska)   
  - KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility (Michal Luczaj)   
  - ring-buffer: Fix race between reset page and reading page (Steven Rostedt (Google))   
  - ring-buffer: Check pending waiters when doing wake ups as well (Steven Rostedt (Google))   
  - ring-buffer: Allow splice to read previous partially read pages (Steven Rostedt (Google))   
  - ftrace: Properly unset FTRACE_HASH_FL_MOD (Zheng Yejian)   
  - livepatch: fix race between fork and KLP transition (Rik van Riel)   
  - ext4: place buffer head allocation before handle start (Jinke Han)   
  - ext4: make ext4_lazyinit_thread freezable (Lalith Rajendran)   
  - ext4: fix null-ptr-deref in ext4_write_info (Baokun Li)   
  - ext4: avoid crash when inline data creation follows DIO write (Jan Kara)   
  - nilfs2: fix lockdep warnings during disk space reclamation (Ryusuke Konishi)   
  - nilfs2: fix lockdep warnings in page operations for btree nodes (Ryusuke Konishi)   
  - nilfs2: fix use-after-free bug of struct nilfs_root (Ryusuke Konishi)   
  - fbdev: smscufx: Fix use-after-free in ufx_ops_open() (Hyunwoo Kim)   
  - PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge (Maciej W. Rozycki)   
  - UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK (Huacai Chen)   
  - parisc: fbdev/stifb: Align graphics memory size to 4MB (Helge Deller)   
  - Revert "fs: check FMODE_LSEEK to control internal pipe splicing" (Sasha Levin)   
  - regulator: qcom_rpm: Fix circular deferral regression (Linus Walleij)   
  - quota: Check next/prev free block number after reading from quota file (Zhihao Cheng)   
  - HID: multitouch: Add memory barriers (Andri Yngvason)   
  - fs: dlm: handle -EBUSY first in lock arg validation (Alexander Aring)   
  - fs: dlm: fix race between test_bit() and queue_work() (Alexander Aring)   
  - iio: dac: ad5593r: Fix i2c read protocol requirements (Michael Hennerich)   
  - ALSA: usb-audio: Fix NULL dererence at error path (Takashi Iwai)   
  - ALSA: usb-audio: Fix potential memory leaks (Takashi Iwai)   
  - ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free() (Takashi Iwai)   
  - ALSA: oss: Fix potential deadlock at unregistration (Takashi Iwai)   
  - random: use expired timer rather than wq for mixing fast pool (Jason A. Donenfeld)   
  - Input: xpad - fix wireless 360 controller breaking after suspend (Cameron Gutman)   
  - Input: xpad - add supported devices as contributed on github (Pavel Rojtberg)   
  - wifi: mac80211_hwsim: avoid mac80211 warning on bad rate (Johannes Berg)   
  - random: avoid reading two cache lines on irq randomness (Jason A. Donenfeld)   
  - random: restore O_NONBLOCK support (Jason A. Donenfeld)   
  - USB: serial: qcserial: add new usb-id for Dell branded EM7455 (Frank Wunderlich)   
  - ALSA: hda: Fix position reporting on Poulsbo (Takashi Iwai)   
  - random: clamp credited irq bits to maximum mixed (Jason A. Donenfeld)   
  - ceph: don't truncate file in atomic_open (Hu Weiwen)   
  - nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure (Ryusuke Konishi)   
  - nilfs2: fix leak of nilfs_root in case of writer thread creation failure (Ryusuke Konishi)   
  - nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level() (Ryusuke Konishi)   
  - netfilter: nf_queue: fix socket leak (Vimal Agrawal)   
  - rpmsg: qcom: glink: replace strncpy() with strscpy_pad() (Krzysztof Kozlowski)   
  - mmc: core: Terminate infinite loop in SD-UHS voltage switch (Brian Norris)   
  - mmc: core: Replace with already defined values for readability (ChanWoo Lee)   
  - USB: serial: ftdi_sio: fix 300 bps rate for SIO (Johan Hovold)   
  - usb: mon: make mmapped memory read only (Tadeusz Struk)   
  - um: Cleanup compiler warning in arch/x86/um/tls_32.c (Lukas Straub)   
  - um: Cleanup syscall_handler_t cast in syscalls_32.h (Lukas Straub)   
  - net/ieee802154: fix uninit value bug in dgram_sendmsg (Haimin Zhang)   
  - ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer (Sergei Antonov)   
  - dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure (Swati Agarwal)   
  - dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property (Swati Agarwal)   
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Dongliang Mu)   
  - ARM: fix function graph tracer and unwinder dependencies (Russell King)   
  - i2c: dev: prevent ZERO_SIZE_PTR deref in i2cdev_ioctl_rdwr() (Alexander Popov)   
  - Makefile.extrawarn: Move -Wcast-function-type-strict to W=1 (Sami Tolvanen)   
  - clk: iproc: Do not rely on node name for correct PLL setup (Florian Fainelli)   
  - clk: iproc: Minor tidy up of iproc pll data structures (Lori Hikichi)   
  - selftests: Fix the if conditions of in test_extra_filter() (Wang Yufen)   
  - nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices (Michael Kelley)   
  - nvme: add new line after variable declatation (Chaitanya Kulkarni)   
  - usbnet: Fix memory leak in usbnet_disconnect() (Peilin Ye)   
  - Input: melfas_mip4 - fix return value check in mip4_probe() (Yang Yingliang)   
  - Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time" (Brian Norris)   
  - soc: sunxi: sram: Fix debugfs info for A64 SRAM C (Samuel Holland)   
  - soc: sunxi: sram: Actually claim SRAM regions (Samuel Holland)   
  - mm/migrate_device.c: flush TLB while holding PTL (Alistair Popple)   
  - mm: prevent page_frag_alloc() from corrupting the memory (Maurizio Lombardi)   
  - mm/page_alloc: fix race condition between build_all_zonelists and page allocation (Mel Gorman)   
  - mmc: moxart: fix 4-bit bus width and remove 8-bit bus width (Sergei Antonov)   
  - ntfs: fix BUG_ON in ntfs_lookup_inode_by_name() (ChenXiaoSong)   
  - net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455 (Frank Wunderlich)   
  - uas: ignore UAS for Thinkplus chips (Hongling Zeng)   
  - usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS (Hongling Zeng)   
  - uas: add no-uas quirk for Hiksemi usb_disk (Hongling Zeng)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.521.2.el7uek]
changelog:
  - RDS/IB: Fix the misplaced counter update rdma dto path (Devesh Sharma)  [Orabug: 34865849]  
  - IB/ipoib: Do not warn if IPoIB debugfs doesn't exist (Alaa Hleihel)  [Orabug: 34780038]  
  - proc: proc_skip_spaces() shouldn't think it is working on C strings (Linus Torvalds)  [Orabug: 34882780]  {CVE-2022-4378} 
  - proc: avoid integer type confusion in get_proc_long (Linus Torvalds)  [Orabug: 34882780]  {CVE-2022-4378}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.521.3.el7uek]
changelog:
  - Revert "random: use expired timer rather than wq for mixing fast pool" (Saeed Mirzamohammadi)  [Orabug: 34918228]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.522.1.el7uek]
changelog:
  - uek-rpm: ol7: Add enhanced kABI diagnostics (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: ol7: Add Symtypes files (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: ol7: Enable creation of Symtypes files (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: Add kabi tool and documentation (Stephen Brennan)  [Orabug: 34879138]  
  - xfs: don't reuse busy extents on extent trim (Brian Foster)  [Orabug: 34605583]  
  - RDMA/ucma: Put a lock around every call to the rdma_cm layer (Jason Gunthorpe)  [Orabug: 34106064]  
  - LTS version: v4.14.302 (Saeed Mirzamohammadi)   
  - net: mvneta: Fix an out of bounds check (Dan Carpenter)   
  - ipv6: avoid use-after-free in ip6_fragment() (Eric Dumazet)   
  - net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() (Yang Yingliang)   
  - ethernet: aeroflex: fix potential skb leak in greth_init_rings() (Zhang Changzhong)   
  - tipc: Fix potential OOB in tipc_link_proto_rcv() (YueHaibing)   
  - net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (Liu Jian)   
  - net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (Liu Jian)   
  - net: stmmac: fix "snps,axi-config" node property parsing (Jisheng Zhang)   
  - NFC: nci: Bounds check struct nfc_target arrays (Kees Cook)   
  - net: mvneta: Prevent out of bounds read in mvneta_config_rss() (Dan Carpenter)   
  - net: encx24j600: Fix invalid logic in reading of MISTAT register (Valentina Goncharenko)   
  - net: encx24j600: Add parentheses to fix precedence (Valentina Goncharenko)   
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (Wei Yongjun)   
  - Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() (Wang ShaoBo)   
  - igb: Allocate MSI-X vector when testing (Akihiko Odaki)   
  - e1000e: Fix TX dispatch condition (Akihiko Odaki)   
  - gpio: amd8111: Fix PCI device reference count leak (Xiongfeng Wang)   
  - ca8210: Fix crash by zero initializing data (Hauke Mehrtens)   
  - ieee802154: cc2520: Fix error return code in cc2520_hw_init() (Ziyang Xuan)   
  - HID: core: fix shift-out-of-bounds in hid_report_raw_event (ZhangPeng)   
  - HID: hid-lg4ff: Add check for empty lbuf (Anastasia Belova)   
  - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (Thomas Huth)   
  - memcg: fix possible use-after-free in memcg_write_event_control() (Tejun Heo)   
  - media: v4l2-dv-timings.c: fix too strict blanking sanity checks (Hans Verkuil)   
  - xen/netback: do some code cleanup (Juergen Gross)   
  - net: usb: qmi_wwan: add u-blox 0x1342 composition (Davide Tronchin)   
  - regulator: twl6030: fix get status of twl6032 regulators (Andreas Kemnade)   
  - ASoC: soc-pcm: Add NULL check in BE reparenting (Srinivasa Rao Mandadapu)   
  - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event (Kees Cook)   
  - ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 (Johan Jonker)   
  - ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation (Giulio Benetti)   
  - ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels (Tomislav Novak)   
  - ARM: dts: rockchip: fix ir-receiver node names (Johan Jonker)   
  - arm: dts: rockchip: fix node name for hym8563 rtc (Sebastian Reichel)   
  - LTS version: v4.14.301 (Saeed Mirzamohammadi)   
  - ipc/sem: Fix dangling sem_array access in semtimedop race (Jann Horn)   
  - v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails (Linus Torvalds)   
  - mmc: sdhci: Fix voltage switch delay (Adrian Hunter)   
  - mmc: sdhci: use FIELD_GET for preset value bit masks (Masahiro Yamada)   
  - x86/ioremap: Fix page aligned size calculation in __ioremap_caller() (Michael Kelley)   
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (Luiz Augusto von Dentz)   {CVE-2022-42896} 
  - x86/pm: Add enumeration check before spec MSRs save/restore setup (Saeed Mirzamohammadi)   
  - nvme: restrict management ioctls to admin (Keith Busch)   
  - tcp/udp: Fix memory leak in ipv6_renew_options(). (Kuniyuki Iwashima)  [Orabug: 34719346]  {CVE-2022-3524} 
  - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (Xiongfeng Wang)   
  - pinctrl: single: Fix potential division by zero (Maxim Korotkov)   
  - ASoC: ops: Fix bounds check for _sx controls (Mark Brown)   
  - efi: random: Properly limit the size of the random seed (Ben Hutchings)   
  - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (ZhangPeng)   
  - tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" (Tiezhu Yang)   
  - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (ChenXiaoSong)   
  - perf: Add sample_flags to indicate the PMU-filled sample data (Kan Liang)   
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (Yang Yingliang)   
  - hwmon: (coretemp) Check for null before removing sysfs attrs (Phil Auld)   
  - net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed (Yoshihiro Shimoda)   
  - packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE (Willem de Bruijn)   
  - net: hsr: Fix potential use-after-free (YueHaibing)   
  - dsa: lan9303: Correct stat name (Jerry Ray)   
  - net/9p: Fix a potential socket leak in p9_socket_open (Wang Hai)   
  - net: net_netdev: Fix error handling in ntb_netdev_init_module() (Yuan Can)   
  - net: phy: fix null-ptr-deref while probe() failed (Yang Yingliang)   
  - qlcnic: fix sleep-in-atomic-context bugs caused by msleep (Duoming Zhou)   
  - can: cc770: cc770_isa_probe(): add missing free_cc770dev() (Zhang Changzhong)   
  - can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() (Zhang Changzhong)   
  - net/mlx5: Fix uninitialized variable bug in outlen_write() (YueHaibing)   
  - of: property: decrement node refcount in of_fwnode_get_reference_args() (Yang Yingliang)   
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (Gaosheng Cui)   
  - hwmon: (i5500_temp) fix missing pci_disable_device() (Yang Yingliang)   
  - iio: light: rpr0521: add missing Kconfig dependencies (Paul Gazzillo)   
  - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw (Wei Yongjun)   
  - iio: health: afe4403: Fix oob read in afe4403_read_raw (Wei Yongjun)   
  - drm/amdgpu: always register an MMU notifier for userptr (Christian König)   
  - net: usb: qmi_wwan: add Telit 0x103a composition (Enrico Sau)   
  - tcp: configurable source port perturb table size (Gleb Mazovetskiy)   
  - platform/x86: hp-wmi: Ignore Smart Experience App event (Kai-Heng Feng)   
  - platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) (Hans de Goede)   
  - platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() (Xiongfeng Wang)   
  - xen/platform-pci: add missing free_irq() in error path (ruanjinjie)   
  - serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() (Lukas Wunner)   
  - Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode (Aman Dhoot)   
  - nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty (Chen Zhongjin)   
  - kconfig: display recursive dependency resolution hint just once (Masahiro Yamada)   
  - iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails (Chen Zhongjin)   
  - iio: light: apds9960: fix wrong register for gesture gain (Alejandro Concepción Rodríguez)   
  - arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency (Jakob Unterwurzacher)   
  - nios2: add FORCE for vmlinuz.gz (Randy Dunlap)   
  - s390/crashdump: fix TOD programmable field size (Heiko Carstens)   
  - net: thunderx: Fix the ACPI memory leak (Yu Liao)   
  - nfc: st-nci: fix memory leaks in EVT_TRANSACTION (Martin Faltesek)   
  - nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION (Martin Faltesek)   
  - s390/dasd: fix no record found for raw_track_access (Stefan Haberland)   
  - dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). (Kuniyuki Iwashima)   
  - NFC: nci: fix memory leak in nci_rx_data_packet() (Liu Shixin)   
  - xfrm: Fix ignored return value in xfrm6_init() (Chen Zhongjin)   
  - net/qla3xxx: fix potential memleak in ql3xxx_send() (Zhang Changzhong)   
  - net/mlx4: Check retval of mlx4_bitmap_init (Peter Kosyh)   
  - ARM: mxs: fix memory leak in mxs_machine_init() (Zheng Yongjun)   
  - 9p/fd: fix issue of list_del corruption in p9_fd_cancel() (Zhengchao Shao)   
  - net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() (Wang Hai)   
  - nfc/nci: fix race with opening and closing (Lin Ma)   
  - ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl (Michael Grzeschik)   
  - bus: sunxi-rsb: Support atomic transfers (Samuel Holland)   
  - ARM: dts: am335x-pcm-953: Define fixed regulators in root node (Dominik Haller)   
  - af_key: Fix send_acquire race with pfkey_register (Herbert Xu)   
  - MIPS: pic32: treat port as signed integer (Jason A. Donenfeld)   
  - spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run (Sean Nyekjaer)   
  - wifi: mac80211: Fix ack frame idr leak when mesh has no route (Nicolas Cavallari)   
  - audit: fix undefined behavior in bit shift for AUDIT_BIT (Gaosheng Cui)   
  - wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support (Jonas Jelonek)   
  - LTS version: v4.14.300 (Saeed Mirzamohammadi)   
  - ntfs: check overflow when iterating ATTR_RECORDs (Hawkins Jiawei)   
  - ntfs: fix out-of-bounds read in ntfs_attr_find() (Hawkins Jiawei)   
  - ntfs: fix use-after-free in ntfs_attr_find() (Hawkins Jiawei)   
  - mm: fs: initialize fsdata passed to write_begin/write_end interface (Alexander Potapenko)   
  - 9p/trans_fd: always use O_NONBLOCK read/write (Tetsuo Handa)   
  - gfs2: Switch from strlcpy to strscpy (Andreas Gruenbacher)   
  - gfs2: Check sb_bsize_shift after reading superblock (Andrew Price)   
  - 9p: trans_fd/p9_conn_cancel: drop client lock earlier (Dominique Martinet)   
  - kcm: close race conditions on sk_receive_queue (Cong Wang)   
  - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (Baisong Zhong)   
  - kcm: avoid potential race in kcm_tx_work (Eric Dumazet)   
  - tcp: cdg: allow tcp_cdg_release() to be called multiple times (Eric Dumazet)   
  - macvlan: enforce a consistent minimal mtu (Eric Dumazet)   
  - serial: 8250: Flush DMA Rx on RLSI (Ilpo Järvinen)   
  - nilfs2: fix use-after-free bug of ns_writer on remount (Ryusuke Konishi)   
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (Alexander Potapenko)   
  - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (Xiongfeng Wang)   
  - mmc: core: properly select voltage range without power cycle (Yann Gautier)   
  - serial: 8250_lpss: Configure DMA also w/o DMA filter (Ilpo Järvinen)   
  - serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs (Ilpo Järvinen)   
  - dm ioctl: fix misbehavior if list_versions races with module loading (Mikulas Patocka)   
  - iio: pressure: ms5611: changed hardcoded SPI speed to value limited (Mitja Spes)   
  - iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() (Yang Yingliang)   
  - iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() (Yang Yingliang)   
  - usb: chipidea: fix deadlock in ci_otg_del_timer (Duoming Zhou)   
  - usb: add NO_LPM quirk for Realforce 87U Keyboard (Nicolas Dumazet)   
  - USB: serial: option: add Fibocom FM160 0x0111 composition (Reinhard Speyerer)   
  - USB: serial: option: add u-blox LARA-L6 modem (Davide Tronchin)   
  - USB: serial: option: add u-blox LARA-R6 00B modem (Davide Tronchin)   
  - USB: serial: option: remove old LARA-R6 PID (Davide Tronchin)   
  - USB: serial: option: add Sierra Wireless EM9191 (Benoît Monin)   
  - ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (Takashi Iwai)   
  - ring_buffer: Do not deactivate non-existant pages (Daniil Tatianin)   
  - ftrace: Fix null pointer dereference in ftrace_add_mod() (Xiu Jianfeng)   
  - ftrace: Optimize the allocation for mcount entries (Wang Wensheng)   
  - ftrace: Fix the possible incorrect kernel message (Wang Wensheng)   
  - cifs: Fix wrong return value checking when GETFLAGS (Zhang Xiaoxu)   
  - net/x25: Fix skb leak in x25_lapb_receive_frame() (Wei Yongjun)   
  - drbd: use after free in drbd_create_device() (Dan Carpenter)   
  - xen/pcpu: fix possible memory leak in register_pcpu() (Yang Yingliang)   
  - net: caif: fix double disconnect client in chnl_net_open() (Zhengchao Shao)   
  - mISDN: fix misuse of put_device() in mISDN_register_device() (Wang ShaoBo)   
  - mISDN: fix possible memory leak in mISDN_dsp_element_register() (Yang Yingliang)   
  - net: bgmac: Drop free_netdev() from bgmac_enet_remove() (Wei Yongjun)   
  - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (Zeng Heng)   
  - parport_pc: Avoid FIFO port location truncation (Maciej W. Rozycki)   
  - block: sed-opal: kmalloc the cmd/resp buffers (Serge Semin)   
  - ASoC: soc-utils: Remove __exit for snd_soc_util_exit() (Chen Zhongjin)   
  - tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send (Duoming Zhou)   
  - serial: 8250: omap: Flush PM QOS work on remove (Tony Lindgren)   
  - serial: 8250_omap: remove wait loop from Errata i202 workaround (Matthias Schiffer)   
  - ASoC: core: Fix use-after-free in snd_soc_exit() (Chen Zhongjin)   
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm (Luiz Augusto von Dentz)   
  - drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid (Nathan Huckleberry)   
  - selftests/futex: fix build for clang (Ricardo Cañuelo)   
  - x86/cpu: Restore AMD's DE_CFG MSR after resume (Borislav Petkov)   
  - dmaengine: at_hdmac: Check return code of dma_async_device_register (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix impossible condition (Tudor Ambarus)   
  - dmaengine: at_hdmac: Don't allow CPU to reorder channel enable (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors (Tudor Ambarus)   
  - dmaengine: at_hdmac: Don't start transactions at tx_submit level (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix at_lli struct definition (Tudor Ambarus)   
  - cert host tools: Stop complaining about deprecated OpenSSL functions (Linus Torvalds)   
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (ZhangPeng)   
  - btrfs: selftests: fix wrong error check in btrfs_free_dummy_root() (Zhang Xiaoxu)   
  - platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi (Jorge Lopez)   
  - drm/i915/dmabuf: fix sg_table handling in map_dma_buf (Matthew Auld)   
  - nilfs2: fix deadlock in nilfs_count_free_blocks() (Ryusuke Konishi)   
  - ALSA: usb-audio: Add quirk entry for M-Audio Micro (Takashi Iwai)   
  - ALSA: hda: fix potential memleak in 'add_widget_node' (Ye Bin)   
  - arm64: efi: Fix handling of misaligned runtime regions and drop warning (Ard Biesheuvel)   
  - net: macvlan: fix memory leaks of macvlan_common_newlink (Chuang Wang)   
  - net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open() (Zhengchao Shao)   
  - ethernet: s2io: disable napi when start nic failed in s2io_card_up() (Zhengchao Shao)   
  - net: cxgb3_main: disable napi when bind qsets failed in cxgb_up() (Zhengchao Shao)   
  - drivers: net: xgene: disable napi when register irq failed in xgene_enet_open() (Zhengchao Shao)   
  - dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() (Christophe JAILLET)   
  - tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header (Xin Long)   
  - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (Alexander Potapenko)   
  - drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register() (Yuan Can)   
  - hamradio: fix issue of dev reference count leakage in bpq_device_event() (Zhengchao Shao)   
  - net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event() (Zhengchao Shao)   
  - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK (Gaosheng Cui)   
  - net: fman: Unregister ethernet device on removal (Sean Anderson)   
  - bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer (Alex Barba)   
  - net: gso: fix panic on frag_list with mixed head alloc types (Jiri Benc)   
  - HID: hyperv: fix possible memory leak in mousevsc_probe() (Yang Yingliang)   
  - LTS version: v4.14.299 (Saeed Mirzamohammadi)   
  - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() (Dokyung Song)   
  - linux/const.h: move UL() macro to include/linux/const.h (Masahiro Yamada)   
  - linux/const.h: prefix include guard of uapi/linux/const.h with _UAPI (Masahiro Yamada)   
  - KVM: x86: emulator: update the emulation mode after CR0 write (Maxim Levitsky)   
  - KVM: x86: emulator: introduce emulator_recalc_and_set_mode (Maxim Levitsky)   
  - KVM: x86: emulator: em_sysexit should update ctxt->mode (Maxim Levitsky)   
  - KVM: x86: Mask off reserved bits in CPUID.80000008H (Jim Mattson)   
  - ext4: fix warning in 'ext4_da_release_space' (Ye Bin)   
  - parisc: Export iosapic_serial_irq() symbol for serial port driver (Helge Deller)   
  - parisc: Make 8250_gsc driver dependend on CONFIG_PARISC (Helge Deller)   
  - efi: random: reduce seed size to 32 bytes (Ard Biesheuvel)   
  - ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices (John Veness)   
  - capabilities: fix potential memleak on error path from vfs_getxattr_alloc() (Gaosheng Cui)   
  - tcp/udp: Make early_demux back namespacified. (Kuniyuki Iwashima)   
  - btrfs: fix type of parameter generation in btrfs_get_dentry (David Sterba)   
  - block, bfq: protect 'bfqd->queued' by 'bfqd->lock' (Yu Kuai)   
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory (Luiz Augusto von Dentz)   {CVE-2022-42895} 
  - i2c: xiic: Add platform module alias (Martin Tůma)   
  - media: dvb-frontends/drxk: initialize err to 0 (Hans Verkuil)   
  - media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE (Hans Verkuil)   
  - net, neigh: Fix null-ptr-deref in neigh_table_clear() (Chen Zhongjin)   
  - net: mdio: fix undefined behavior in bit shift for __mdiobus_register (Gaosheng Cui)   
  - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() (Zhengchao Shao)   
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Maxim Mikityanskiy)   
  - btrfs: fix ulist leaks in error paths of qgroup self tests (Filipe Manana)   
  - btrfs: fix inode list leak during backref walking at resolve_indirect_refs() (Filipe Manana)   
  - isdn: mISDN: netjet: fix wrong check of device registration (Yang Yingliang)   
  - mISDN: fix possible memory leak in mISDN_register_device() (Yang Yingliang)   
  - rose: Fix NULL pointer dereference in rose_send_frame() (Zhang Qilong)   
  - ipvs: use explicitly signed chars (Jason A. Donenfeld)   
  - net: sched: Fix use after free in red_enqueue() (Dan Carpenter)   
  - ata: pata_legacy: fix pdc20230_set_piomode() (Sergey Shtylyov)   
  - net: fec: fix improper use of NETDEV_TX_BUSY (Zhang Changzhong)   
  - nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() (Shang XiaoJing)   
  - nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send() (Shang XiaoJing)   
  - net: dsa: Fix possible memory leaks in dsa_loop_init() (Chen Zhongjin)   
  - nfs4: Fix kmemleak when allocate slot failed (Zhang Xiaoxu)   
  - NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot (Trond Myklebust)   
  - NFSv4.1: Handle RECLAIM_COMPLETE trunking errors (Trond Myklebust)


