# changelog

author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.522.2.el7uek]
changelog:
  - tcp: fix ambiguity for SACKed TLP retransmits with RTT < min_rtt (Neal Cardwell)  [Orabug: 34961109]  
  - vhost-scsi: Fix max number of virtqueues (Mike Christie)  [Orabug: 34915131]  
  - net/rds: drop rs_transport module reference count on error (Gerd Rausch)  [Orabug: 34500808]  
  - scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts (Gulam Mohamed)  [Orabug: 34306796]  
  - IB/mlx5: Add a signature check to received EQEs and CQEs (Rohit Nair)  [Orabug: 34105979]  
  - net/rds: rds_tcp_accept_one ought to not discard messages (Gerd Rausch)  [Orabug: 34488377]  
  - net/rds: No shortcut out of RDS_CONN_ERROR (Gerd Rausch)  [Orabug: 34276065]  
  - net/rds: Don't force state RDS_CONN_RESETTING (Gerd Rausch)  [Orabug: 34276065]  
  - net/rds: Preserve essential connection state flags (Gerd Rausch)  [Orabug: 34276065]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.522.3.el7uek]
changelog:
  - ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC (Sasha Levin)  [Orabug: 34653896]  {CVE-2022-3303} 
  - net/rds: Fill in rds_exthdr_size gaps (Gerd Rausch)  [Orabug: 34979172]  
  - net/rds: Trigger rds_send_hs_ping() more than once (Gerd Rausch)  [Orabug: 34607787]  
  - Revert "RDS: TCP: Track peer's connection generation number" (Gerd Rausch)  [Orabug: 34700111]  
  - net/rds: Use the first lane until RDS_EXTHDR_NPATHS arrives (Gerd Rausch)  [Orabug: 28720880]  
  - net/rds: Kick-start TCP receiver after accept (Gerd Rausch)  [Orabug: 34600821]  
  - net/rds: rds_tcp_conn_path_shutdown must not discard messages (Gerd Rausch)  [Orabug: 34560682]  
  - net/rds: Encode cp_index in TCP source port (Gerd Rausch)  [Orabug: 34556027]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.522.1.el7uek]
changelog:
  - uek-rpm: ol7: Add enhanced kABI diagnostics (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: ol7: Add Symtypes files (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: ol7: Enable creation of Symtypes files (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: Add kabi tool and documentation (Stephen Brennan)  [Orabug: 34879138]  
  - xfs: don't reuse busy extents on extent trim (Brian Foster)  [Orabug: 34605583]  
  - RDMA/ucma: Put a lock around every call to the rdma_cm layer (Jason Gunthorpe)  [Orabug: 34106064]  
  - LTS version: v4.14.302 (Saeed Mirzamohammadi)   
  - net: mvneta: Fix an out of bounds check (Dan Carpenter)   
  - ipv6: avoid use-after-free in ip6_fragment() (Eric Dumazet)   
  - net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() (Yang Yingliang)   
  - ethernet: aeroflex: fix potential skb leak in greth_init_rings() (Zhang Changzhong)   
  - tipc: Fix potential OOB in tipc_link_proto_rcv() (YueHaibing)   
  - net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (Liu Jian)   
  - net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (Liu Jian)   
  - net: stmmac: fix "snps,axi-config" node property parsing (Jisheng Zhang)   
  - NFC: nci: Bounds check struct nfc_target arrays (Kees Cook)   
  - net: mvneta: Prevent out of bounds read in mvneta_config_rss() (Dan Carpenter)   
  - net: encx24j600: Fix invalid logic in reading of MISTAT register (Valentina Goncharenko)   
  - net: encx24j600: Add parentheses to fix precedence (Valentina Goncharenko)   
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (Wei Yongjun)   
  - Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() (Wang ShaoBo)   
  - igb: Allocate MSI-X vector when testing (Akihiko Odaki)   
  - e1000e: Fix TX dispatch condition (Akihiko Odaki)   
  - gpio: amd8111: Fix PCI device reference count leak (Xiongfeng Wang)   
  - ca8210: Fix crash by zero initializing data (Hauke Mehrtens)   
  - ieee802154: cc2520: Fix error return code in cc2520_hw_init() (Ziyang Xuan)   
  - HID: core: fix shift-out-of-bounds in hid_report_raw_event (ZhangPeng)   
  - HID: hid-lg4ff: Add check for empty lbuf (Anastasia Belova)   
  - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (Thomas Huth)   
  - memcg: fix possible use-after-free in memcg_write_event_control() (Tejun Heo)   
  - media: v4l2-dv-timings.c: fix too strict blanking sanity checks (Hans Verkuil)   
  - xen/netback: do some code cleanup (Juergen Gross)   
  - net: usb: qmi_wwan: add u-blox 0x1342 composition (Davide Tronchin)   
  - regulator: twl6030: fix get status of twl6032 regulators (Andreas Kemnade)   
  - ASoC: soc-pcm: Add NULL check in BE reparenting (Srinivasa Rao Mandadapu)   
  - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event (Kees Cook)   
  - ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 (Johan Jonker)   
  - ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation (Giulio Benetti)   
  - ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels (Tomislav Novak)   
  - ARM: dts: rockchip: fix ir-receiver node names (Johan Jonker)   
  - arm: dts: rockchip: fix node name for hym8563 rtc (Sebastian Reichel)   
  - LTS version: v4.14.301 (Saeed Mirzamohammadi)   
  - ipc/sem: Fix dangling sem_array access in semtimedop race (Jann Horn)   
  - v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails (Linus Torvalds)   
  - mmc: sdhci: Fix voltage switch delay (Adrian Hunter)   
  - mmc: sdhci: use FIELD_GET for preset value bit masks (Masahiro Yamada)   
  - x86/ioremap: Fix page aligned size calculation in __ioremap_caller() (Michael Kelley)   
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (Luiz Augusto von Dentz)   [Orabug: 34833306] {CVE-2022-42896} 
  - x86/pm: Add enumeration check before spec MSRs save/restore setup (Saeed Mirzamohammadi)   
  - nvme: restrict management ioctls to admin (Keith Busch) [Orabug: 34619367] {CVE-2022-3169}
  - tcp/udp: Fix memory leak in ipv6_renew_options(). (Kuniyuki Iwashima)  [Orabug: 34719346]  {CVE-2022-3524} 
  - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (Xiongfeng Wang)   
  - pinctrl: single: Fix potential division by zero (Maxim Korotkov)   
  - ASoC: ops: Fix bounds check for _sx controls (Mark Brown)   
  - efi: random: Properly limit the size of the random seed (Ben Hutchings)   
  - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (ZhangPeng)   
  - tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" (Tiezhu Yang)   
  - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (ChenXiaoSong)   
  - perf: Add sample_flags to indicate the PMU-filled sample data (Kan Liang)   
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (Yang Yingliang)   
  - hwmon: (coretemp) Check for null before removing sysfs attrs (Phil Auld)   
  - net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed (Yoshihiro Shimoda)   
  - packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE (Willem de Bruijn)   
  - net: hsr: Fix potential use-after-free (YueHaibing)   
  - dsa: lan9303: Correct stat name (Jerry Ray)   
  - net/9p: Fix a potential socket leak in p9_socket_open (Wang Hai)   
  - net: net_netdev: Fix error handling in ntb_netdev_init_module() (Yuan Can)   
  - net: phy: fix null-ptr-deref while probe() failed (Yang Yingliang)   
  - qlcnic: fix sleep-in-atomic-context bugs caused by msleep (Duoming Zhou)   
  - can: cc770: cc770_isa_probe(): add missing free_cc770dev() (Zhang Changzhong)   
  - can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() (Zhang Changzhong)   
  - net/mlx5: Fix uninitialized variable bug in outlen_write() (YueHaibing)   
  - of: property: decrement node refcount in of_fwnode_get_reference_args() (Yang Yingliang)   
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (Gaosheng Cui)   
  - hwmon: (i5500_temp) fix missing pci_disable_device() (Yang Yingliang)   
  - iio: light: rpr0521: add missing Kconfig dependencies (Paul Gazzillo)   
  - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw (Wei Yongjun)   
  - iio: health: afe4403: Fix oob read in afe4403_read_raw (Wei Yongjun)   
  - drm/amdgpu: always register an MMU notifier for userptr (Christian König)   
  - net: usb: qmi_wwan: add Telit 0x103a composition (Enrico Sau)   
  - tcp: configurable source port perturb table size (Gleb Mazovetskiy)   
  - platform/x86: hp-wmi: Ignore Smart Experience App event (Kai-Heng Feng)   
  - platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) (Hans de Goede)   
  - platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() (Xiongfeng Wang)   
  - xen/platform-pci: add missing free_irq() in error path (ruanjinjie)   
  - serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() (Lukas Wunner)   
  - Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode (Aman Dhoot)   
  - nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty (Chen Zhongjin)   
  - kconfig: display recursive dependency resolution hint just once (Masahiro Yamada)   
  - iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails (Chen Zhongjin)   
  - iio: light: apds9960: fix wrong register for gesture gain (Alejandro Concepción Rodríguez)   
  - arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency (Jakob Unterwurzacher)   
  - nios2: add FORCE for vmlinuz.gz (Randy Dunlap)   
  - s390/crashdump: fix TOD programmable field size (Heiko Carstens)   
  - net: thunderx: Fix the ACPI memory leak (Yu Liao)   
  - nfc: st-nci: fix memory leaks in EVT_TRANSACTION (Martin Faltesek)   
  - nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION (Martin Faltesek)   
  - s390/dasd: fix no record found for raw_track_access (Stefan Haberland)   
  - dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). (Kuniyuki Iwashima)   
  - NFC: nci: fix memory leak in nci_rx_data_packet() (Liu Shixin)   
  - xfrm: Fix ignored return value in xfrm6_init() (Chen Zhongjin)   
  - net/qla3xxx: fix potential memleak in ql3xxx_send() (Zhang Changzhong)   
  - net/mlx4: Check retval of mlx4_bitmap_init (Peter Kosyh)   
  - ARM: mxs: fix memory leak in mxs_machine_init() (Zheng Yongjun)   
  - 9p/fd: fix issue of list_del corruption in p9_fd_cancel() (Zhengchao Shao)   
  - net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() (Wang Hai)   
  - nfc/nci: fix race with opening and closing (Lin Ma)   
  - ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl (Michael Grzeschik)   
  - bus: sunxi-rsb: Support atomic transfers (Samuel Holland)   
  - ARM: dts: am335x-pcm-953: Define fixed regulators in root node (Dominik Haller)   
  - af_key: Fix send_acquire race with pfkey_register (Herbert Xu)   
  - MIPS: pic32: treat port as signed integer (Jason A. Donenfeld)   
  - spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run (Sean Nyekjaer)   
  - wifi: mac80211: Fix ack frame idr leak when mesh has no route (Nicolas Cavallari)   
  - audit: fix undefined behavior in bit shift for AUDIT_BIT (Gaosheng Cui)   
  - wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support (Jonas Jelonek)   
  - LTS version: v4.14.300 (Saeed Mirzamohammadi)   
  - ntfs: check overflow when iterating ATTR_RECORDs (Hawkins Jiawei)   
  - ntfs: fix out-of-bounds read in ntfs_attr_find() (Hawkins Jiawei)   
  - ntfs: fix use-after-free in ntfs_attr_find() (Hawkins Jiawei)   
  - mm: fs: initialize fsdata passed to write_begin/write_end interface (Alexander Potapenko)   
  - 9p/trans_fd: always use O_NONBLOCK read/write (Tetsuo Handa)   
  - gfs2: Switch from strlcpy to strscpy (Andreas Gruenbacher)   
  - gfs2: Check sb_bsize_shift after reading superblock (Andrew Price)   
  - 9p: trans_fd/p9_conn_cancel: drop client lock earlier (Dominique Martinet)   
  - kcm: close race conditions on sk_receive_queue (Cong Wang)   
  - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (Baisong Zhong)   
  - kcm: avoid potential race in kcm_tx_work (Eric Dumazet)   
  - tcp: cdg: allow tcp_cdg_release() to be called multiple times (Eric Dumazet)   
  - macvlan: enforce a consistent minimal mtu (Eric Dumazet)   
  - serial: 8250: Flush DMA Rx on RLSI (Ilpo Järvinen)   
  - nilfs2: fix use-after-free bug of ns_writer on remount (Ryusuke Konishi)   
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (Alexander Potapenko)   
  - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (Xiongfeng Wang)   
  - mmc: core: properly select voltage range without power cycle (Yann Gautier)   
  - serial: 8250_lpss: Configure DMA also w/o DMA filter (Ilpo Järvinen)   
  - serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs (Ilpo Järvinen)   
  - dm ioctl: fix misbehavior if list_versions races with module loading (Mikulas Patocka)   
  - iio: pressure: ms5611: changed hardcoded SPI speed to value limited (Mitja Spes)   
  - iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() (Yang Yingliang)   
  - iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() (Yang Yingliang)   
  - usb: chipidea: fix deadlock in ci_otg_del_timer (Duoming Zhou)   
  - usb: add NO_LPM quirk for Realforce 87U Keyboard (Nicolas Dumazet)   
  - USB: serial: option: add Fibocom FM160 0x0111 composition (Reinhard Speyerer)   
  - USB: serial: option: add u-blox LARA-L6 modem (Davide Tronchin)   
  - USB: serial: option: add u-blox LARA-R6 00B modem (Davide Tronchin)   
  - USB: serial: option: remove old LARA-R6 PID (Davide Tronchin)   
  - USB: serial: option: add Sierra Wireless EM9191 (Benoît Monin)   
  - ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (Takashi Iwai)   
  - ring_buffer: Do not deactivate non-existant pages (Daniil Tatianin)   
  - ftrace: Fix null pointer dereference in ftrace_add_mod() (Xiu Jianfeng)   
  - ftrace: Optimize the allocation for mcount entries (Wang Wensheng)   
  - ftrace: Fix the possible incorrect kernel message (Wang Wensheng)   
  - cifs: Fix wrong return value checking when GETFLAGS (Zhang Xiaoxu)   
  - net/x25: Fix skb leak in x25_lapb_receive_frame() (Wei Yongjun)   
  - drbd: use after free in drbd_create_device() (Dan Carpenter)   
  - xen/pcpu: fix possible memory leak in register_pcpu() (Yang Yingliang)   
  - net: caif: fix double disconnect client in chnl_net_open() (Zhengchao Shao)   
  - mISDN: fix misuse of put_device() in mISDN_register_device() (Wang ShaoBo)   
  - mISDN: fix possible memory leak in mISDN_dsp_element_register() (Yang Yingliang)   
  - net: bgmac: Drop free_netdev() from bgmac_enet_remove() (Wei Yongjun)   
  - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (Zeng Heng)   
  - parport_pc: Avoid FIFO port location truncation (Maciej W. Rozycki)   
  - block: sed-opal: kmalloc the cmd/resp buffers (Serge Semin)   
  - ASoC: soc-utils: Remove __exit for snd_soc_util_exit() (Chen Zhongjin)   
  - tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send (Duoming Zhou)   
  - serial: 8250: omap: Flush PM QOS work on remove (Tony Lindgren)   
  - serial: 8250_omap: remove wait loop from Errata i202 workaround (Matthias Schiffer)   
  - ASoC: core: Fix use-after-free in snd_soc_exit() (Chen Zhongjin)   
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm (Luiz Augusto von Dentz)   
  - drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid (Nathan Huckleberry)   
  - selftests/futex: fix build for clang (Ricardo Cañuelo)   
  - x86/cpu: Restore AMD's DE_CFG MSR after resume (Borislav Petkov)   
  - dmaengine: at_hdmac: Check return code of dma_async_device_register (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix impossible condition (Tudor Ambarus)   
  - dmaengine: at_hdmac: Don't allow CPU to reorder channel enable (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors (Tudor Ambarus)   
  - dmaengine: at_hdmac: Don't start transactions at tx_submit level (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix at_lli struct definition (Tudor Ambarus)   
  - cert host tools: Stop complaining about deprecated OpenSSL functions (Linus Torvalds)   
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (ZhangPeng)   
  - btrfs: selftests: fix wrong error check in btrfs_free_dummy_root() (Zhang Xiaoxu)   
  - platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi (Jorge Lopez)   
  - drm/i915/dmabuf: fix sg_table handling in map_dma_buf (Matthew Auld)   
  - nilfs2: fix deadlock in nilfs_count_free_blocks() (Ryusuke Konishi)   
  - ALSA: usb-audio: Add quirk entry for M-Audio Micro (Takashi Iwai)   
  - ALSA: hda: fix potential memleak in 'add_widget_node' (Ye Bin)   
  - arm64: efi: Fix handling of misaligned runtime regions and drop warning (Ard Biesheuvel)   
  - net: macvlan: fix memory leaks of macvlan_common_newlink (Chuang Wang)   
  - net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open() (Zhengchao Shao)   
  - ethernet: s2io: disable napi when start nic failed in s2io_card_up() (Zhengchao Shao)   
  - net: cxgb3_main: disable napi when bind qsets failed in cxgb_up() (Zhengchao Shao)   
  - drivers: net: xgene: disable napi when register irq failed in xgene_enet_open() (Zhengchao Shao)   
  - dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() (Christophe JAILLET)   
  - tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header (Xin Long)   
  - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (Alexander Potapenko)   
  - drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register() (Yuan Can)   
  - hamradio: fix issue of dev reference count leakage in bpq_device_event() (Zhengchao Shao)   
  - net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event() (Zhengchao Shao)   
  - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK (Gaosheng Cui)   
  - net: fman: Unregister ethernet device on removal (Sean Anderson)   
  - bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer (Alex Barba)   
  - net: gso: fix panic on frag_list with mixed head alloc types (Jiri Benc)   
  - HID: hyperv: fix possible memory leak in mousevsc_probe() (Yang Yingliang)   
  - LTS version: v4.14.299 (Saeed Mirzamohammadi)   
  - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() (Dokyung Song) [Orabug: 34951545] {CVE-2022-3628}
  - linux/const.h: move UL() macro to include/linux/const.h (Masahiro Yamada)   
  - linux/const.h: prefix include guard of uapi/linux/const.h with _UAPI (Masahiro Yamada)   
  - KVM: x86: emulator: update the emulation mode after CR0 write (Maxim Levitsky)   
  - KVM: x86: emulator: introduce emulator_recalc_and_set_mode (Maxim Levitsky)   
  - KVM: x86: emulator: em_sysexit should update ctxt->mode (Maxim Levitsky)   
  - KVM: x86: Mask off reserved bits in CPUID.80000008H (Jim Mattson)   
  - ext4: fix warning in 'ext4_da_release_space' (Ye Bin)   
  - parisc: Export iosapic_serial_irq() symbol for serial port driver (Helge Deller)   
  - parisc: Make 8250_gsc driver dependend on CONFIG_PARISC (Helge Deller)   
  - efi: random: reduce seed size to 32 bytes (Ard Biesheuvel)   
  - ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices (John Veness)   
  - capabilities: fix potential memleak on error path from vfs_getxattr_alloc() (Gaosheng Cui)   
  - tcp/udp: Make early_demux back namespacified. (Kuniyuki Iwashima)   
  - btrfs: fix type of parameter generation in btrfs_get_dentry (David Sterba)   
  - block, bfq: protect 'bfqd->queued' by 'bfqd->lock' (Yu Kuai)   
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory (Luiz Augusto von Dentz)   [Orabug: 34951661] {CVE-2022-42895} 
  - i2c: xiic: Add platform module alias (Martin Tůma)   
  - media: dvb-frontends/drxk: initialize err to 0 (Hans Verkuil)   
  - media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE (Hans Verkuil)   
  - net, neigh: Fix null-ptr-deref in neigh_table_clear() (Chen Zhongjin)   
  - net: mdio: fix undefined behavior in bit shift for __mdiobus_register (Gaosheng Cui)   
  - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() (Zhengchao Shao) [Orabug: 34752621] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Maxim Mikityanskiy)   
  - btrfs: fix ulist leaks in error paths of qgroup self tests (Filipe Manana)   
  - btrfs: fix inode list leak during backref walking at resolve_indirect_refs() (Filipe Manana)   
  - isdn: mISDN: netjet: fix wrong check of device registration (Yang Yingliang)   
  - mISDN: fix possible memory leak in mISDN_register_device() (Yang Yingliang)   
  - rose: Fix NULL pointer dereference in rose_send_frame() (Zhang Qilong)   
  - ipvs: use explicitly signed chars (Jason A. Donenfeld)   
  - net: sched: Fix use after free in red_enqueue() (Dan Carpenter)   
  - ata: pata_legacy: fix pdc20230_set_piomode() (Sergey Shtylyov)   
  - net: fec: fix improper use of NETDEV_TX_BUSY (Zhang Changzhong)   
  - nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() (Shang XiaoJing)   
  - nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send() (Shang XiaoJing)   
  - net: dsa: Fix possible memory leaks in dsa_loop_init() (Chen Zhongjin)   
  - nfs4: Fix kmemleak when allocate slot failed (Zhang Xiaoxu)   
  - NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot (Trond Myklebust)   
  - NFSv4.1: Handle RECLAIM_COMPLETE trunking errors (Trond Myklebust)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.523.1.el7uek]
changelog:
  - x86/kexec: Do not reserve EFI setup_data in the kexec e820 table (Dave Young)  [Orabug: 34966703]  
  - xfs: make COW fork unwritten extent conversions more robust (Christoph Hellwig)  [Orabug: 34390903]  
  - scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan (Chandrakanth patil)  [Orabug: 34242965]  
  - scsi: megaraid_sas: Early detection of VD deletion through RaidMap update (Kashyap Desai)  [Orabug: 34242965]  
  - LTS version: v4.14.304 (Saeed Mirzamohammadi)   
  - x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN (YingChi Long)   
  - gsmi: fix null-deref in gsmi_get_variable (Khazhismel Kumykov)   
  - serial: atmel: fix incorrect baudrate setup (Tobias Schramm)   
  - serial: pch_uart: Pass correct sg to dma_unmap_sg() (Ilpo Järvinen)   
  - usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 (Juhyung Park)   
  - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() (Maciej Żenczykowski)   
  - usb: gadget: g_webcam: Send color matching descriptor per frame (Daniel Scally)   
  - usb: host: ehci-fsl: Fix module alias (Alexander Stein)   
  - USB: serial: cp210x: add SCALANCE LPE-9000 device id (Michael Adler)   
  - usb: core: hub: disable autosuspend for TI TUSB8041 (Flavio Suligoi)   
  - USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 (Greg Kroah-Hartman)   
  - USB: serial: option: add Quectel EM05CN modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EM05CN (SG) modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EC200U modem (Ali Mirghasemi)   
  - USB: serial: option: add Quectel EM05-G (RS) modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EM05-G (CS) modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EM05-G (GR) modem (Duke Xin(辛安文))   
  - prlimit: do_prlimit needs to have a speculation check (Greg Kroah-Hartman)   
  - usb: xhci: Check endpoint is valid before dereferencing it (Jimmy Hu)   
  - xhci-pci: set the dma max_seg_size (Ricardo Ribalda)   
  - nilfs2: fix general protection fault in nilfs_btree_insert() (Ryusuke Konishi)   
  - f2fs: let's avoid panic if extent_tree is not created (Jaegeuk Kim)   
  - RDMA/srp: Move large values to a new enum for gcc13 (Jiri Slaby (SUSE))   
  - net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats (Daniil Tatianin)   
  - pNFS/filelayout: Fix coalescing test for single DS (Olga Kornievskaia)   
  - LTS version: v4.14.303 (Saeed Mirzamohammadi)   
  - Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout" (Ferry Toth)   
  - nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() (Minsuk Kang)   
  - hvc/xen: lock console list traversal (Roger Pau Monne)   
  - regulator: da9211: Use irq handler when ready (Ricardo Ribalda)   
  - EDAC/device: Fix period calculation in edac_device_reset_delay_period() (Eliav Farber)   
  - x86/boot: Avoid using Intel mnemonics in AT&T syntax asm (Peter Zijlstra)   
  - netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. (Gavrilov Ilia)   
  - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (Herbert Xu) [Orabug: 35005830] {CVE-2023-0394}
  - platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe (Hans de Goede)   
  - ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (Clement Lecigne)   
  - net/ulp: prevent ULP without clone op from entering the LISTEN status (Paolo Abeni)   
  - s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple() (Heiko Carstens)   
  - perf auxtrace: Fix address filter duplicate symbol selection (Adrian Hunter)   
  - docs: Fix the docs build with Sphinx 6.0 (Jonathan Corbet)   
  - net: sched: disallow noqueue for qdisc classes (Frederick Lawler) [Orabug: 35005793] {CVE-2022-47929}
  - ravb: Fix "failed to switch device to config mode" message during unbind (Biju Das)   
  - driver core: Fix bus_type.match() error handling in __driver_attach() (Isaac J. Manjarres)   
  - parisc: Align parisc MADV_XXX constants with all other architectures (Helge Deller)   
  - hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling (Linus Torvalds)   
  - hfs/hfsplus: use WARN_ON for sanity check (Arnd Bergmann)   
  - nfsd: fix handling of readdir in v4root vs. mount upcall timeout (Jeff Layton)   
  - x86/bugs: Flush IBP in ib_prctl_set() (Rodrigo Branco)   
  - udf: Fix extension of the last extent in the file (Jan Kara)   
  - caif: fix memory leak in cfctrl_linkup_request() (Zhengchao Shao)   
  - usb: rndis_host: Secure rndis_query check against int overflow (Szymon Heidrich)   
  - net: sched: atm: dont intepret cls results when asked to drop (Jamal Hadi Salim) [Orabug: 34983615] {CVE-2023-23455}
  - net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe (Miaoqian Lin)   
  - net: amd-xgbe: add missed tasklet_kill (Jiguang Xiao)   
  - nfc: Fix potential resource leaks (Miaoqian Lin)   
  - qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (Daniil Tatianin)   
  - bpf: pull before calling skb_postpull_rcsum() (Jakub Kicinski)   
  - SUNRPC: ensure the matching upcall is in-flight upon downcall (minoura makoto)   
  - ext4: allocate extended attribute value in vmalloc area (Ye Bin)   
  - ext4: avoid unaccounted block allocation when expanding inode (Jan Kara)   
  - ext4: initialize quota before expanding inode in setproject ioctl (Jan Kara)   
  - ext4: fix inode leak in ext4_xattr_inode_create() on an error path (Ye Bin)   
  - ext4: avoid BUG_ON when creating xattrs (Jan Kara)   
  - ext4: fix error code return to user-space in ext4_get_branch() (Luís Henriques)   
  - ext4: init quota for 'old.inode' in 'ext4_rename' (Ye Bin)   
  - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode (Baokun Li)   
  - ext4: fix undefined behavior in bit shift for ext4_check_flag_values (Gaosheng Cui)   
  - ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop (Baokun Li)   
  - drm/vmwgfx: Validate the box size for the snooped cursor (Zack Rusin)   
  - drm/connector: send hotplug uevent on connector cleanup (Simon Ser)   
  - device_cgroup: Roll back to original exceptions after copy failure (Wang Weiyang)   
  - parisc: led: Fix potential null-ptr-deref in start_task() (Shang XiaoJing)   
  - iommu/amd: Fix ivrs_acpihid cmdline parsing code (Kim Phillips)   
  - crypto: n2 - add missing hash statesize (Corentin Labbe)   
  - PCI/sysfs: Fix double free in error path (Sascha Hauer)   
  - PCI: Fix pci_device_is_present() for VFs by checking PF (Michael S. Tsirkin)   
  - ima: Fix a potential NULL pointer access in ima_restore_measurement_list (Huaxin Lu)   
  - cifs: fix confusing debug message (Paulo Alcantara)   
  - media: dvb-core: Fix UAF due to refcount races at releasing (Takashi Iwai) [Orabug: 34820630] {CVE-2022-41218}
  - media: dvb-core: Fix double free in dvb_register_device() (Keita Suzuki)   
  - ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod (Nick Desaulniers)   
  - tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line (Yang Jihong)   
  - x86/microcode/intel: Do not retry microcode reloading on the APs (Ashok Raj)   
  - dm cache: set needs_check flag after aborting metadata (Mike Snitzer)   
  - dm cache: Fix UAF in destroy() (Luo Meng)   
  - dm thin: Fix UAF in run_timer_softirq() (Luo Meng)   
  - dm thin: Use last transaction's pmd->root when commit failed (Zhihao Cheng)   
  - dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort (Mike Snitzer)   
  - selftests: Use optional USERCFLAGS and USERLDFLAGS (Mickaël Salaün)   
  - ARM: ux500: do not directly dereference __iomem (Jason A. Donenfeld)   
  - ktest.pl minconfig: Unset configs instead of just removing them (Steven Rostedt)   
  - media: stv0288: use explicitly signed char (Jason A. Donenfeld)   
  - tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo)   
  - tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo)   
  - mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING (Deren Wu)   
  - md: fix a crash in mempool_free (Mikulas Patocka)   
  - pnode: terminate at peers of source (Christian Brauner)   
  - ALSA: line6: fix stack overflow in line6_midi_transmit (Artem Egorkine)   
  - ALSA: line6: correct midi status byte when receiving data from podxt (Artem Egorkine)   
  - hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount (Aditya Garg)   
  - HID: plantronics: Additional PIDs for double volume key presses quirk (Terry Junge)   
  - powerpc/rtas: avoid scheduling in rtas_os_term() (Nathan Lynch)   
  - powerpc/rtas: avoid device tree lookups in rtas_os_term() (Nathan Lynch)   
  - media: dvbdev: fix refcnt bug (Lin Ma) [Orabug: 34983296] {CVE-2022-45886} {CVE-2022-45884} {CVE-2022-45919} {CVE-2022-45887} {CVE-2022-45885}
  - gcov: add support for checksum field (Rickard x Andersson)   
  - iio: adc: ad_sigma_delta: do not use internal iio_dev lock (Nuno Sá)   
  - reiserfs: Add missing calls to reiserfs_security_free() (Roberto Sassu)   
  - HID: wacom: Ensure bootloader PID is usable in hidraw mode (Jason Gerecke)   
  - usb: dwc3: core: defer probe on ulpi_read_id timeout (Ferry Toth)   
  - pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES (John Stultz)   
  - pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion (John Stultz)   
  - ASoC: rt5670: Remove unbalanced pm_runtime_put() (Hans de Goede)   
  - ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() (Wang Jingjin)   
  - ASoC: wm8994: Fix potential deadlock (Marek Szyprowski)   
  - ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() (Wang Jingjin)   
  - ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() (Wang Yufen)   
  - orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() (Zhang Xiaoxu)   
  - drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() (Nathan Chancellor)   
  - drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() (Nathan Chancellor)   
  - clk: st: Fix memory leak in st_of_quadfs_setup() (Xiu Jianfeng)   
  - media: si470x: Fix use-after-free in si470x_int_in_callback() (Shigeru Yoshida)   
  - mmc: f-sdh30: Add quirks for broken timeout clock capability (Kunihiko Hayashi)   
  - blk-mq: fix possible memleak when register 'hctx' failed (Ye Bin)   
  - media: dvb-usb: fix memory leak in dvb_usb_adapter_init() (Mazin Al Haddad)   
  - media: dvbdev: adopts refcnt to avoid UAF (Lin Ma) [Orabug: 34983296] {CVE-2022-45887} {CVE-2022-45885} {CVE-2022-45884} {CVE-2022-45886} {CVE-2022-45919}
  - media: dvb-frontends: fix leak of memory fw (Yan Lei)   
  - ppp: associate skb with a device at tx (Stanislav Fomichev)   
  - mrp: introduce active flags to prevent UAF when applicant uninit (Schspa Shi)   
  - md/raid1: stop mdx_raid1 thread when raid1 array run failed (Jiang Li)   
  - drm/sti: Use drm_mode_copy() (Ville Syrjälä)   
  - s390/lcs: Fix return type of lcs_start_xmit() (Nathan Chancellor)   
  - s390/netiucv: Fix return type of netiucv_tx() (Nathan Chancellor)   
  - s390/ctcm: Fix return type of ctc{mp,}m_tx() (Nathan Chancellor)   
  - igb: Do not free q_vector unless new one was allocated (Kees Cook)   
  - wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() (Minsuk Kang)   
  - hamradio: baycom_epp: Fix return type of baycom_send_packet() (Nathan Chancellor)   
  - net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() (Nathan Chancellor)   
  - bpf: make sure skb->len != 0 when redirecting to a tunneling device (Stanislav Fomichev)   
  - ipmi: fix memleak when unload ipmi driver (Zhang Yuchen)   
  - ASoC: codecs: rt298: Add quirk for KBL-R RVP platform (Amadeusz Sławiński)   
  - wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out (Shigeru Yoshida)   
  - wifi: ath9k: verify the expected usb_endpoints are present (Fedor Pchelkin)   
  - hfs: fix OOB Read in __hfs_brec_find (ZhangPeng)   
  - acct: fix potential integer overflow in encode_comp_t() (Zheng Yejian)   
  - nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() (Ryusuke Konishi)   
  - ACPICA: Fix error code path in acpi_ds_call_control_method() (Rafael J. Wysocki)   
  - fs: jfs: fix shift-out-of-bounds in dbDiscardAG (Hoi Pok Wu)   
  - udf: Avoid double brelse() in udf_rename() (Shigeru Yoshida)   
  - fs: jfs: fix shift-out-of-bounds in dbAllocAG (Dongliang Mu)   
  - binfmt_misc: fix shift-out-of-bounds in check_special_flags (Liu Shixin)   
  - net: stream: purge sk_error_queue in sk_stream_kill_queues() (Eric Dumazet)   
  - myri10ge: Fix an error handling path in myri10ge_probe() (Christophe JAILLET)   
  - net_sched: reject TCF_EM_SIMPLE case for complex ematch module (Cong Wang)   
  - skbuff: Account for tail adjustment during pull operations (Subash Abhinov Kasiviswanathan)   
  - openvswitch: Fix flow lookup to use unmasked key (Eelco Chaudron)   
  - r6040: Fix kmemleak in probe and remove (Li Zetao)   
  - nfc: pn533: Clear nfc_target before being used (Minsuk Kang)   
  - mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (Dan Aloni)   
  - rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() (Gaosheng Cui)   
  - selftests/powerpc: Fix resource leaks (Miaoqian Lin)   
  - powerpc/hv-gpci: Fix hv_gpci event list (Kajol Jain)   
  - powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() (Yang Yingliang)   
  - powerpc/perf: callchain validate kernel stack pointer bounds (Nicholas Piggin)   
  - powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() (Yang Yingliang)   
  - cxl: Fix refcount leak in cxl_calc_capp_routing (Miaoqian Lin)   
  - powerpc/52xx: Fix a resource leak in an error handling path (Christophe JAILLET)   
  - macintosh/macio-adb: check the return value of ioremap() (Xie Shaowen)   
  - macintosh: fix possible memory leak in macio_add_one_device() (Yang Yingliang)   
  - iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() (Yuan Can)   
  - iommu/amd: Fix pci device refcount leak in ppr_notifier() (Yang Yingliang)   
  - rtc: snvs: Allow a time difference on clock register read (Stefan Eichenberger)   
  - include/uapi/linux/swab: Fix potentially missing __always_inline (Matt Redfearn)   
  - HSI: omap_ssi_core: Fix error handling in ssi_init() (Yuan Can)   
  - power: supply: fix residue sysfs file in error handle route of __power_supply_register() (Zeng Heng)   
  - HSI: omap_ssi_core: fix possible memory leak in ssi_probe() (Yang Yingliang)   
  - HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() (Yang Yingliang)   
  - fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() (Christophe JAILLET)   
  - fbdev: vermilion: decrease reference count in error path (Xiongfeng Wang)   
  - fbdev: via: Fix error in via_core_init() (Shang XiaoJing)   
  - fbdev: pm2fb: fix missing pci_disable_device() (Yang Yingliang)   
  - fbdev: ssd1307fb: Drop optional dependency (Andy Shevchenko)   
  - usb: storage: Add check for kcalloc (Jiasheng Jiang)   
  - i2c: ismt: Fix an out-of-bounds bug in ismt_access() (Zheyu Ma) [Orabug: 34555528] {CVE-2022-2873}
  - vme: Fix error not catched in fake_init() (Chen Zhongjin)   
  - staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() (YueHaibing)   
  - staging: rtl8192u: Fix use after free in ieee80211_rx() (Dan Carpenter)   
  - i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe (Hui Tang)   
  - chardev: fix error handling in cdev_device_add() (Yang Yingliang)   
  - mcb: mcb-parse: fix error handing in chameleon_parse_gdd() (Yang Yingliang)   
  - drivers: mcb: fix resource leak in mcb_probe() (Zhengchao Shao)   
  - cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() (Yang Yingliang)   
  - cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() (Yang Yingliang)   
  - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os (Zheng Wang)   
  - misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (ruanjinjie)   
  - test_firmware: fix memory leak in test_firmware_init() (Zhengchao Shao)   
  - serial: sunsab: Fix error handling in sunsab_init() (Yuan Can)   
  - serial: pch: Fix PCI device refcount leak in pch_request_dma() (Xiongfeng Wang)   
  - serial: amba-pl011: avoid SBSA UART accessing DMACR register (Jiamei Xie)   
  - staging: vme_user: Fix possible UAF in tsi148_dma_list_add (Gaosheng Cui)   
  - usb: fotg210-udc: Fix ages old endianness issues (Linus Walleij)   
  - uio: uio_dmem_genirq: Fix deadlock between irq config and handling (Rafael Mendonca)   
  - uio: uio_dmem_genirq: Fix missing unlock in irq configuration (Rafael Mendonca)   
  - vfio: platform: Do not pass return buffer to ACPI _RST method (Rafael Mendonca)   
  - class: fix possible memory leak in __class_register() (Yang Yingliang)   
  - drivers: dio: fix possible memory leak in dio_init() (Yang Yingliang)   
  - IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces (Dragos Tatulea)   
  - hwrng: geode - Fix PCI device refcount leak (Xiongfeng Wang)   
  - hwrng: amd - Fix PCI device refcount leak (Xiongfeng Wang)   
  - crypto: img-hash - Fix variable dereferenced before check 'hdev->req' (Gaosheng Cui)   
  - orangefs: Fix sysfs not cleanup when dev init failed (Zhang Xiaoxu)   
  - RDMA/hfi1: Fix error return code in parse_platform_config() (Wang Yufen)   
  - scsi: snic: Fix possible UAF in snic_tgt_create() (Gaosheng Cui)   
  - scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails (Chen Zhongjin)   
  - scsi: ipr: Fix WARNING in ipr_init() (Shang XiaoJing)   
  - scsi: fcoe: Fix possible name leak when device_register() fails (Yang Yingliang)   
  - scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() (Yang Yingliang)   
  - scsi: hpsa: Fix error handling in hpsa_add_sas_host() (Yang Yingliang)   
  - RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed (Zhang Xiaoxu)   
  - RDMA/hfi: Decrease PCI device reference count in error path (Xiongfeng Wang)   
  - PCI: Check for alloc failure in pci_request_irq() (Zeng Heng)   
  - apparmor: fix a memleak in multi_transaction_new() (Gaosheng Cui)   
  - stmmac: fix potential division by 0 (Piergiorgio Beruto)   
  - Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - ntb_netdev: Use dev_kfree_skb_any() in interrupt context (Eric Pilmore)   
  - net: lan9303: Fix read error execution path (Jerry Ray)   
  - net: amd-xgbe: Check only the minimum speed for active/passive cables (Tom Lendacky)   
  - net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net/tunnel: wait until all sk_user_data reader finish before releasing the sock (Hangbin Liu)   
  - net: farsync: Fix kmemleak when rmmods farsync (Li Zetao)   
  - ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (Yuan Can)   
  - net: defxx: Fix missing err handling in dfx_init() (Yongqiang Liu)   
  - net: vmw_vsock: vmci: Check memcpy_from_msg() (Artem Chernyshev)   
  - blktrace: Fix output non-blktrace event when blk_classic option enabled (Yang Jihong)   
  - wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() (Wang Yufen)   
  - wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h (Bitterblue Smith)   
  - clk: samsung: Fix memory leak in _samsung_clk_register_pll() (Xiu Jianfeng)   
  - media: coda: Add check for kmalloc (Jiasheng Jiang)   
  - media: coda: Add check for dcoda_iram_alloc (Jiasheng Jiang)   
  - media: c8sectpfe: Add of_node_put() when breaking out of loop (Liang He)   
  - mmc: mmci: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: wbsd: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: via-sdmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: wmt-sdmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: vub300: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: toshsd: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: mxcmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: moxart: fix return value check of mmc_add_host() (Yang Yingliang)   
  - NFSv4.x: Fail client initialisation if state manager thread can't run (Trond Myklebust)   
  - SUNRPC: Fix missing release socket in rpc_sockname() (Wang ShaoBo)   
  - ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt (Gaosheng Cui)   
  - media: saa7164: fix missing pci_disable_device() (Liu Shixin)   
  - regulator: core: fix module refcount leak in set_supply() (Yang Yingliang)   
  - bonding: uninitialized variable in bond_miimon_inspect() (Dan Carpenter)   
  - ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe (Zhang Qilong)   
  - drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() (Xiongfeng Wang)   
  - drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() (Xiongfeng Wang)   
  - ALSA: asihpi: fix missing pci_disable_device() (Liu Shixin)   
  - NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn (Trond Myklebust)   
  - NFSv4.2: Fix a memory stomp in decode_attr_security_label (Trond Myklebust)   
  - media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC (Aakarsh Jain)   
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() (Baisong Zhong)   
  - pinctrl: pinconf-generic: add missing of_node_put() (ZhangPeng)   
  - media: imon: fix a race condition in send_packet() (Gautam Menghani)   
  - mtd: maps: pxa2xx-flash: fix memory leak in probe (Zheng Yongjun)   
  - clk: rockchip: Fix memory leak in rockchip_clk_register_pll() (Xiu Jianfeng)   
  - ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT (Baisong Zhong)   
  - HID: hid-sensor-custom: set fixed size for custom attributes (Marcus Folkesson)   
  - media: platform: exynos4-is: Fix error handling in fimc_md_init() (Yuan Can)   
  - media: solo6x10: fix possible memory leak in solo_sysfs_init() (Yang Yingliang)   
  - Input: elants_i2c - properly handle the reset GPIO when power is off (Douglas Anderson)   
  - mtd: lpddr2_nvm: Fix possible null-ptr-deref (Hui Tang)   
  - wifi: ath10k: Fix return value in ath10k_pci_init() (Xiu Jianfeng)   
  - ima: Fix misuse of dereference of pointer in template_desc_init_fields() (Xiu Jianfeng)   
  - regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() (Yang Yingliang)   
  - ASoC: pxa: fix null-pointer dereference in filter() (Zeng Heng)   
  - drm/radeon: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo)   
  - media: camss: Clean up received buffers on failed start of streaming (Vladimir Zapolskiy)   
  - mtd: Fix device name leak when register device failed in add_mtd_device() (Zhang Xiaoxu)   
  - media: vivid: fix compose size exceed boundary (Liu Shixin)   
  - spi: Update reference to struct spi_controller (Jonathan Neuschäfer)   
  - media: i2c: ad5820: Fix error path (Ricardo Ribalda)   
  - wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() (Fedor Pchelkin)   
  - wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() (Fedor Pchelkin)   
  - rapidio: devices: fix missing put_device in mport_cdev_open (Cai Xinchen)   
  - hfs: Fix OOB Write in hfs_asc2mac (ZhangPeng)   
  - eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD (Zhang Qilong)   
  - rapidio: fix possible UAF when kfifo_alloc() fails (Wang Weiyang)   
  - fs: sysv: Fix sysv_nblocks() returns wrong value (Chen Zhongjin)   
  - MIPS: BCM63xx: Add check for NULL for clk in clk_enable (Anastasia Belova)   
  - platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() (Yu Liao)   
  - x86/xen: Fix memory leak in xen_init_lock_cpu() (Xiu Jianfeng)   
  - uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix (Oleg Nesterov)   
  - ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (Li Zetao)   
  - rapidio: rio: fix possible name leak in rio_register_mport() (Yang Yingliang)   
  - rapidio: fix possible name leaks when rio_add_device() fails (Yang Yingliang)   
  - lib/notifier-error-inject: fix error when writing -errno to debugfs file (Akinobu Mita)   
  - libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value (Akinobu Mita)   
  - irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() (Shang XiaoJing)   
  - PNP: fix name memory leak in pnp_alloc_dev() (Yang Yingliang)   
  - MIPS: vpe-cmp: fix possible memory leak while module exiting (Yang Yingliang)   
  - MIPS: vpe-mt: fix possible memory leak while module exiting (Yang Yingliang)   
  - ocfs2: fix memory leak in ocfs2_stack_glue_init() (Shang XiaoJing)   
  - timerqueue: Use rb_entry_safe() in timerqueue_getnext() (Barnabás Pőcze)   
  - perf: Fix possible memleak in pmu_dev_alloc() (Chen Zhongjin)   
  - fs: don't audit the capability check in simple_xattr_list() (Ondrej Mosnacek)   
  - PM: hibernate: Fix mistake in kerneldoc comment (xiongxin)   
  - alpha: fix syscall entry in !AUDUT_SYSCALL case (Al Viro)   
  - cpuidle: dt: Return the correct numbers of parsed idle states (Ulf Hansson)   
  - tpm/tpm_crb: Fix error message in __crb_relinquish_locality() (Michael Kelley)   
  - pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP (Stephen Boyd)   
  - ARM: mmp: fix timer_read delay (Doug Brown)   
  - pstore/ram: Fix error return code in ramoops_probe() (Wang Yufen)   
  - ARM: dts: turris-omnia: Add switch port 6 node (Pali Rohár)   
  - ARM: dts: turris-omnia: Add ethernet aliases (Pali Rohár)   
  - ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name (AngeloGioacchino Del Regno)   
  - soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe (Zhang Qilong)   
  - arm: dts: spear600: Fix clcd interrupt (Kory Maincent)   
  - drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static (Chen Jiahao)   
  - ARM: dts: qcom: apq8064: fix coresight compatible (Luca Weiss)   
  - usb: musb: remove extra check in musb_gadget_vbus_draw (Ivaylo Dimitrov)   
  - net: loopback: use NET_NAME_PREDICTABLE for name_assign_type (Rasmus Villemoes)   
  - Bluetooth: L2CAP: Fix u8 overflow (Sungwoo Kim) [Orabug: 34880796] {CVE-2022-45934}
  - igb: Initialize mailbox message for VF reset (Tony Nguyen)   
  - USB: serial: cp210x: add Kamstrup RF sniffer PIDs (Bruno Thomsen)   
  - USB: serial: option: add Quectel EM05-G modem (Duke Xin)   
  - usb: gadget: uvc: Prevent buffer overflow in setup handler (Szymon Heidrich)   
  - udf: Fix extending file within last block (Jan Kara)   
  - udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size (Jan Kara)   
  - udf: Fix preallocation discarding at indirect extent boundary (Jan Kara)   
  - udf: Drop unused arguments of udf_delete_aext() (Jan Kara)   
  - udf: Discard preallocation before extending file with a hole (Jan Kara)   
  - perf script python: Remove explicit shebang from tests/attr.c (Tony Jones)   
  - ASoC: ops: Correct bounds check for second channel on SX controls (Charles Keepax)   
  - can: mcba_usb: Fix termination command argument (Yasushi SHOJI)   
  - can: sja1000: fix size of OCR_MODE_MASK define (Heiko Schocher)   
  - ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() (Mark Brown)   
  - nfp: fix use-after-free in area_cache_get() (Jialiang Wang) [Orabug: 34719740] {CVE-2022-3545}
  - block: unhash blkdev part inode when the part is deleted (Ming Lei)   
  - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (Jann Horn)   
  - mm/khugepaged: fix GUP-fast interaction by sending IPI (Jann Horn)   
  - once: add DO_ONCE_SLOW() for sleepable contexts (Eric Dumazet)   
  - libtraceevent: Fix build with binutils 2.35 (Ben Hutchings)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.523.2.el7uek]
changelog:
  - RDMA/addr: Refresh neighbour entries upon rdma_resolve_addr() (Gerd Rausch)  [Orabug: 35060577]  
  - xfs: fix incorrect i_nlink caused by inode racing (Long Li)  [Orabug: 35040849]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.523.3.el7uek]
changelog:
  - driver/soc/pensando: cap_pcie: refactor pciep_regrd32 (David Clear)  [Orabug: 35089515]  
  - mtd: spi-nor: Add support for Winbond w25q02nw flash. (David Clear)  [Orabug: 35089515]  
  - drivers/i2c: Lattice I2C driver update (David Clear)  [Orabug: 35089515]  
  - drivers/soc/pensando: Adding Elba sbus driver (David Clear)  [Orabug: 35089515]  
  - Arm64: Pensando: Enable ltc2978 driver for Ortano ADI cards (Austin Sehnert)  [Orabug: 35080511]  
  - scsi: target: core: Remove from tmr_list during LUN unlink (Dmitry Bogdanov)  [Orabug: 35040145]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.523.4.el7uek]
changelog:
  - rds: ib: Keep IB MRs on clean_list unless we are tearing down the pool (Håkon Bugge)  [Orabug: 34987235]  
  - rds: ib: Add FRWR related statistics counters (Håkon Bugge)  [Orabug: 34987235]  
  - net/rds: The fast registration work queue is not destroyed (Ka-Cheong Poon)  [Orabug: 25962452] [Orabug: 31712036]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.523.4.1.el7uek]
changelog:
  - mm: kvmalloc does not fallback to vmalloc for incompatible gfp flags (Michal Hocko)  [Orabug: 35164196]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.523.4.2.el7uek]
changelog:
  - xfs: add missing cmap->br_state = XFS_EXT_NORM update (Gao Xiang)  [Orabug: 35215030]  
  - x86/tsc: Disable clocksource watchdog for TSC on qualified platorms (Feng Tang)  [Orabug: 35215029]  
  - x86/tsc: Add a timer to make sure TSC_adjust is always checked (Feng Tang)  [Orabug: 35215029]  
  - block: fix handling for BIO_NO_PAGE_REF (Ming Lei)  [Orabug: 35215061]  
  - block: add BIO_NO_PAGE_REF flag (Jens Axboe)  [Orabug: 35215061]  
  - block: implement bio helper to add iter bvec pages to bio (Jens Axboe)  [Orabug: 35215061]  
  - block: introduce mp_bvec_for_each_page() for iterating over page (Ming Lei)  [Orabug: 35215061]  
  - KVM: x86: Prevent set vCPU into INIT/SIPI_RECEIVED state when INIT are latched (Liran Alon)  [Orabug: 35215019]  
  - KVM: x86: Evaluate latched_init in KVM_SET_VCPU_EVENTS when vCPU not in SMM (Liran Alon)  [Orabug: 35215019]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.524.1.el7uek]
changelog:
  - Revert "Change mincore() to count "mapped" pages rather than "cached" pages" (Linus Torvalds)  [Orabug: 35124753]  
  - Revert "XFS: code enhancement to help debug" (Stephen Brennan)  [Orabug: 35070084]  
  - NFSv4: Fix OPEN / CLOSE race (Trond Myklebust)  [Orabug: 34998974]  
  - LTS version: v4.14.306 (Saeed Mirzamohammadi)   
  - nilfs2: fix underflow in second superblock position calculations (Ryusuke Konishi)   
  - kvm: initialize all of the kvm_debugregs structure before sending it to userspace (Greg Kroah-Hartman)   
  - i40e: Add checking for null for nlmsg_find_attr() (Natalia Petrova)   
  - ipv6: Fix tcp socket connection with DSCP. (Guillaume Nault)   
  - ipv6: Fix datagram socket connection with DSCP. (Guillaume Nault)   
  - net: mpls: fix stale pointer if allocation fails during device rename (Jakub Kicinski)   
  - net: stmmac: Restrict warning on disabling DMA store and fwd mode (Cristian Ciocaltea)   
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Miko Larsson)   
  - dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions. (Kuniyuki Iwashima)   
  - net: bgmac: fix BCM5358 support by setting correct flags (Rafał Miłecki)   
  - i40e: add double of VLAN header when computing the max MTU (Jason Xing)   
  - revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" (Andrew Morton)   
  - hugetlb: check for undefined shift on 32 bit architectures (Mike Kravetz)   
  - ALSA: hda/conexant: add a new hda codec SN6180 (Bo Liu)   
  - mmc: sdio: fix possible resource leaks in some error paths (Yang Yingliang)   
  - Revert "x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN" (Greg Kroah-Hartman)   
  - aio: fix mremap after fork null-deref (Seth Jenkins)   
  - nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association (Amit Engel)   
  - net/rose: Fix to not accept on connected socket (Hyunwoo Kim)   
  - tools/virtio: fix the vringh test for virtio ring changes (Shunsuke Mie)   
  - migrate: hugetlb: check for hugetlb shared PMD in node migration (Mike Kravetz)   
  - usb: core: add quirk for Alcor Link AK9563 smartcard reader (Mark Pearson)   
  - net: USB: Fix wrong-direction WARNING in plusb.c (Alan Stern)   
  - pinctrl: single: fix potential NULL dereference (Maxim Korotkov)   
  - pinctrl: aspeed: Fix confusing types in return value (Joel Stanley)   
  - ALSA: pci: lx6464es: fix a debug loop (Dan Carpenter)   
  - ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() (Artemii Karasev)   
  - btrfs: limit device extents to the device size (Josef Bacik)   
  - serial: 8250_dma: Fix DMA Rx rearm race (Ilpo Järvinen)   
  - serial: 8250_dma: Fix DMA Rx completion race (Ilpo Järvinen)   
  - Squashfs: fix handling and sanity checking of xattr_ids count (Phillip Lougher)   
  - mm/swapfile: add cond_resched() in get_swap_pages() (Longlong Xia)   
  - mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps (Mike Kravetz)   
  - parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case (Helge Deller)   
  - parisc: Fix return code of pdc_iodc_print() (Helge Deller)   
  - iio:adc:twl6030: Enable measurements of VUSB, VBAT and others (Andreas Kemnade)   
  - iio: adc: berlin2-adc: Add missing of_node_put() in error path (Xiongfeng Wang)   
  - iio: hid: fix the retval in accel_3d_capture_sample (Dmitry Perchanov)   
  - efi: Accept version 2 of memory attributes table (Ard Biesheuvel)   
  - watchdog: diag288_wdt: fix __diag288() inline assembly (Alexander Egorenkov)   
  - watchdog: diag288_wdt: do not use stack buffers for hardware data (Alexander Egorenkov)   
  - fbcon: Check font dimension limits (Samuel Thibault)   
  - usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait (Udipto Goswami)   
  - net/x25: Fix to not accept on connected socket (Hyunwoo Kim)   
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Mike Christie)   
  - scsi: target: core: Fix warning on RT kernels (Maurizio Lombardi)   
  - net: openvswitch: fix flow memory leak in ovs_flow_cmd_new (Fedor Pchelkin)   
  - sctp: do not check hb_timer.expires when resetting hb_timer (Xin Long)   
  - squashfs: harden sanity check in squashfs_read_xattr_id_table (Fedor Pchelkin)   
  - netrom: Fix use-after-free caused by accept on already connected socket (Hyunwoo Kim)   
  - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() (Artemii Karasev)   
  - bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() (Yuan Can)   
  - firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region (Takashi Sakamoto)   
  - LTS version: v4.14.305 (Saeed Mirzamohammadi)   
  - usb: host: xhci-plat: add wakeup entry at sysfs (Peter Chen)   
  - ipv6: ensure sane device mtu in tunnels (Eric Dumazet)   
  - mm: kvmalloc does not fallback to vmalloc for incompatible gfp flags (Michal Hocko)   
  - exit: Use READ_ONCE() for all oops/warn limit reads (Kees Cook)   
  - docs: Fix path paste-o for /sys/kernel/warn_count (Kees Cook)   
  - panic: Expose "warn_count" to sysfs (Kees Cook)   
  - panic: Introduce warn_limit (Kees Cook)   
  - panic: Consolidate open-coded panic_on_warn checks (Kees Cook)   
  - exit: Allow oops_limit to be disabled (Kees Cook)   
  - exit: Expose "oops_count" to sysfs (Kees Cook)   
  - exit: Put an upper limit on how often we can oops (Jann Horn)   
  - ia64: make IA64_MCA_RECOVERY bool instead of tristate (Randy Dunlap)   
  - h8300: Fix build errors from do_exit() to make_task_dead() transition (Nathan Chancellor)   
  - hexagon: Fix function name in die() (Nathan Chancellor)   
  - objtool: Add a missing comma to avoid string concatenation (Eric W. Biederman)   
  - exit: Add and use make_task_dead. (Eric W. Biederman)   
  - panic: unset panic_on_warn inside panic() (Tiezhu Yang)   
  - sysctl: add a new register_sysctl_init() interface (Xiaoming Ni)   
  - x86/entry/64: Add instruction suffix to SYSRET (Jan Beulich)   
  - x86/asm: Fix an assembler warning with current binutils (Mikulas Patocka)   
  - drm/radeon/dp: make radeon_dp_get_dp_link_config static (Alex Deucher)   
  - wifi: brcmfmac: fix up incorrect 4.14.y backport for brcmf_fw_map_chip_to_name() (Greg Kroah-Hartman)   
  - x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL (Thomas Gleixner)   
  - Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" (Dmitry Torokhov)   
  - net/tg3: resolve deadlock in tg3_reset_task() during EEH (David Christensen)   
  - net: ravb: Fix possible hang if RIS2_QFF1 happen (Yoshihiro Shimoda)   
  - sctp: fail if no bound addresses can be used for a given scope (Marcelo Ricardo Leitner)   
  - netrom: Fix use-after-free of a listening socket. (Kuniyuki Iwashima)   
  - netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE (Sriram Yagnaraman)   
  - netlink: annotate data races around sk_state (Eric Dumazet)   
  - netlink: annotate data races around dst_portid and dst_group (Eric Dumazet)   
  - EDAC/device: Respect any driver-supplied workqueue polling value (Manivannan Sadhasivam)   
  - ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment (Giulio Benetti)   
  - tracing: Make sure trace_printk() can output as soon as it can be used (Steven Rostedt (Google))   
  - module: Don't wait for GOING modules (Petr Pavlu)   
  - scsi: hpsa: Fix allocation size for scsi_host_alloc() (Alexey V. Vissarionov)   
  - Bluetooth: hci_sync: cancel cmd_timer if hci_open failed (Archie Pusaka)   
  - fs: reiserfs: remove useless new_opts in reiserfs_remount (Dongliang Mu)   
  - comedi: adv_pci1760: Fix PWM instruction handling (Ian Abbott)   
  - w1: fix WARNING after calling w1_process() (Yang Yingliang)   
  - w1: fix deadloop in __w1_remove_master_device() (Yang Yingliang)   
  - HID: betop: check shape of output reports (Pietro Borrello)   
  - dmaengine: Fix double increment of client_count in dma_chan_get() (Koba Ko)   
  - net: mlx5: eliminate anonymous module_init & module_exit (Randy Dunlap)   
  - usb: gadget: f_fs: Ensure ep0req is dequeued before free_request (Udipto Goswami)   
  - usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait (Udipto Goswami)   
  - HID: check empty report_list in hid_validate_values() (Pietro Borrello)   
  - net: mdio: validate parameter addr in mdiobus_get_phy() (Heiner Kallweit)   
  - net: usb: sr9700: Handle negative len (Szymon Heidrich)   
  - wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid (Szymon Heidrich) [Orabug: 35037714] {CVE-2023-23559}
  - net: nfc: Fix use-after-free in local_cleanup() (Jisoo Jang)   
  - phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() (Shang XiaoJing)   
  - amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent (Raju Rangoju)   
  - affs: initialize fsdata in affs_truncate() (Alexander Potapenko)   
  - IB/hfi1: Reserve user expected TIDs (Dean Luick)   
  - IB/hfi1: Reject a zero-length user expected buffer (Dean Luick)   
  - tomoyo: fix broken dependency on *.conf.default (Masahiro Yamada)   
  - EDAC/highbank: Fix memory leak in highbank_mc_probe() (Miaoqian Lin)   
  - HID: intel_ish-hid: Add check for ishtp_dma_tx_map (Jiasheng Jiang)   
  - ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' (Fabio Estevam)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.524.2.el7uek]
changelog:
  - x86/kdump: Fall back to reserve high crashkernel memory (Dave Young)  [Orabug: 35158700]  
  - NFS: If the VFS sets LOOKUP_REVAL then force a lookup of the dentry (Trond Myklebust)  [Orabug: 35136066]  
  - nfsd: Do not refuse to serve out of cache (Trond Myklebust)  [Orabug: 35136066]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.524.3.el7uek]
changelog:
  - KVM: x86/pmu: Update AMD PMC sample period to fix guest NMI-watchdog (Like Xu)  [Orabug: 35182018]  
  - KVM: x86: Prevent set vCPU into INIT/SIPI_RECEIVED state when INIT are latched (Liran Alon)  [Orabug: 35146837]  
  - KVM: x86: Evaluate latched_init in KVM_SET_VCPU_EVENTS when vCPU not in SMM (Liran Alon)  [Orabug: 35146837]  
  - mm: use ktask for copying page ranges in vma_dup() (Anthony Yznaga)  [Orabug: 35054623]  
  - mm: parallelize unmap_page_range() for some large VMAs (Anthony Yznaga)  [Orabug: 35054623]  
  - hv_netvsc: Add check for kvmalloc_array (Jiasheng Jiang)  [Orabug: 34951483]  {CVE-2022-3107} 
  - block: fix handling for BIO_NO_PAGE_REF (Ming Lei)  [Orabug: 34602747]  
  - block: add BIO_NO_PAGE_REF flag (Jens Axboe)  [Orabug: 34602747]  
  - block: implement bio helper to add iter bvec pages to bio (Jens Axboe)  [Orabug: 34602747]  
  - block: introduce mp_bvec_for_each_page() for iterating over page (Ming Lei)  [Orabug: 34602747]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.524.4.el7uek]
changelog:
  - xfs: add missing cmap->br_state = XFS_EXT_NORM update (Gao Xiang)  [Orabug: 35202792]  
  - x86/tsc: Disable clocksource watchdog for TSC on qualified platorms (Feng Tang)  [Orabug: 35181414]  
  - x86/tsc: Add a timer to make sure TSC_adjust is always checked (Feng Tang)  [Orabug: 35181414]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.525.1.el7uek]
changelog:
  - net/rds: use appropriate return code while dropping a connection (Praveen Kumar Kannoju)  [Orabug: 35279328]  
  - net/rds: use appropriate reason while dropping a connection (Praveen Kumar Kannoju)  [Orabug: 35278125]  
  - netfilter: ebtables: fix table blob use-after-free (Florian Westphal)  [Orabug: 35256192]  
  - net/rds: Adding TCP stats for TCP keepalive timeout (Nagappan Ramasamy Palaniappan)  [Orabug: 35254380]  
  - x86/cpu: Fix LFENCE serialization check in init_amd() (Rhythm Mahajan)  [Orabug: 35225921]  
  - taskstats: Fix memory leak due to taskstats_counts objects. (Imran Khan)  [Orabug: 34768713]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.526.1.el7uek]
changelog:
  - mm, compaction: Skip all pinned pages during scan (Khalid Aziz)  [Orabug: 35300710]  
  - LTS version: v4.14.314 (Saeed Mirzamohammadi)   
  - ASN.1: Fix check for strdup() success (Ekaterina Orlova)   
  - iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() (Dan Carpenter)   
  - counter: 104-quad-8: Fix race condition between FLAG and CNTR reads (William Breathitt Gray)   
  - sctp: Call inet6_destroy_sock() via sk->sk_destruct(). (Kuniyuki Iwashima)   
  - dccp: Call inet6_destroy_sock() via sk->sk_destruct(). (Kuniyuki Iwashima)   
  - inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). (Kuniyuki Iwashima)   
  - tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). (Kuniyuki Iwashima)   
  - udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM). (Kuniyuki Iwashima)   
  - ext4: fix use-after-free in ext4_xattr_set_entry (Baokun Li)   
  - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Ritesh Harjani)   
  - Revert "ext4: fix use-after-free in ext4_xattr_set_entry" (Tudor Ambarus)   
  - x86/purgatory: Don't generate debug info for purgatory.ro (Pingfan Liu)   
  - memstick: fix memory leak if card device is never registered (Greg Kroah-Hartman)   
  - nilfs2: initialize unused bytes in segment summary blocks (Ryusuke Konishi)   
  - xen/netback: use same error messages for same errors (Juergen Gross)   
  - s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling (Heiko Carstens)   
  - net: dsa: b53: mmap: add phy ops (Álvaro Fernández Rojas)   
  - scsi: core: Improve scsi_vpd_inquiry() checks (Damien Le Moal)   
  - scsi: megaraid_sas: Fix fw_crash_buffer_show() (Tomas Henzl)   
  - selftests: sigaltstack: fix -Wuninitialized (Nick Desaulniers)   
  - f2fs: Fix f2fs_truncate_partial_nodes ftrace event (Douglas Raillard)   
  - e1000e: Disable TSO on i219-LM card to increase speed (Sebastian Basierski)   
  - mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() (Nikita Zhandarovich)   
  - i40e: fix i40e_setup_misc_vector() error handling (Aleksandr Loktionov)   
  - i40e: fix accessing vsi->active_filters without holding lock (Aleksandr Loktionov)   
  - virtio_net: bugfix overflow inside xdp_linearize_page() (Xuan Zhuo)   
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Gwangun Jung)   
  - ARM: dts: rockchip: fix a typo error for rk3288 spdif node (Jianqun Xu)   
  - LTS version: v4.14.313 (Saeed Mirzamohammadi)   
  - arm64: KVM: Fix system register enumeration (Marc Zyngier)   
  - KVM: arm64: Filter out invalid core register IDs in KVM_GET_REG_LIST (Dave Martin)   
  - KVM: arm64: Factor out core register ID enumeration (Dave Martin)   
  - coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug (Steve Clevenger)   
  - watchdog: sbsa_wdog: Make sure the timeout programming is within the limits (George Cherian)   
  - cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() (Waiman Long)   
  - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size (Zhihao Cheng)   
  - verify_pefile: relax wrapper length check (Robbie Harwood)   
  - efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L (Hans de Goede)   
  - i2c: imx-lpi2c: clean rx/tx buffers upon new message (Alexander Stein)   
  - net: macb: fix a memory corruption in extended buffer descriptor mode (Roman Gushchin)   
  - qlcnic: check pci_reset_function result (Denis Plotnikov)   
  - niu: Fix missing unwind goto in niu_alloc_channels() (Harshit Mogalapalli)   
  - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition (Zheng Wang)   
  - mtdblock: tolerate corrected bit-flips (Bang Li)   
  - Bluetooth: Fix race condition in hidp_session_thread (Min Li)   
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (Luiz Augusto von Dentz)   
  - ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards (Oswald Buddenhagen)   
  - ALSA: i2c/cs8427: fix iec958 mixer control deactivation (Oswald Buddenhagen)   
  - ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard (Oswald Buddenhagen)   
  - ALSA: emu10k1: fix capture interrupt handler unlinking (Oswald Buddenhagen)   
  - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() (Rongwei Wang)   
  - ring-buffer: Fix race while reader and writer are on the same page (Zheng Yejian)   
  - ftrace: Mark get_lock_parent_ip() __always_inline (John Keeping)   
  - perf/core: Fix the same task check in perf_event_set_output (Kan Liang)   
  - nilfs2: fix sysfs interface lifetime (Ryusuke Konishi)   
  - nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() (Ryusuke Konishi)   
  - tty: serial: sh-sci: Fix Rx on RZ/G2L SCI (Biju Das)   
  - iio: dac: cio-dac: Fix max DAC write value check for 12-bit (William Breathitt Gray)   
  - USB: serial: option: add Quectel RM500U-CN modem (Bjørn Mork)   
  - USB: serial: option: add Telit FE990 compositions (Enrico Sau)   
  - USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs (Kees Jan Koster)   
  - gpio: davinci: Add irq chip flag to skip set wake (Dhruva Gole)   
  - ipv6: Fix an uninit variable access bug in __ip6_make_skb() (Ziyang Xuan)   
  - icmp: guard against too small mtu (Eric Dumazet)   
  - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta (Felix Fietkau)   
  - pwm: cros-ec: Explicitly set .polarity in .get_state() (Uwe Kleine-König)   
  - LTS version: v4.14.312 (Saeed Mirzamohammadi)   
  - ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() (Harshit Mogalapalli)   
  - net: sched: cbq: dont intepret cls results when asked to drop (Jamal Hadi Salim)   
  - ext4: fix kernel BUG in 'ext4_write_inline_data_end()' (Ye Bin)   
  - usb: host: ohci-pxa27x: Fix and & vs | typo (Dan Carpenter)   
  - s390/uaccess: add missing earlyclobber annotations to __clear_user() (Heiko Carstens)   
  - drm/etnaviv: fix reference leak when mmaping imported buffer (Lucas Stach)   
  - ALSA: usb-audio: Fix regression on detection of Roland VS-100 (Takashi Iwai)   
  - ALSA: hda/conexant: Partial revert of a quirk for Lenovo (Takashi Iwai)   
  - pinctrl: at91-pio4: fix domain name assignment (Johan Hovold)   
  - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (David Disseldorp)   
  - Input: focaltech - use explicitly signed char type (Jason A. Donenfeld)   
  - i40e: fix registers dump after run ethtool adapter self test (Radoslaw Tyl)   
  - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Ivan Orlov)   
  - scsi: megaraid_sas: Fix crash after a double completion (Tomas Henzl)   
  - fbdev: au1200fb: Fix potential divide by zero (Wei Chen)   
  - fbdev: lxfb: Fix potential divide by zero (Wei Chen)   
  - fbdev: intelfb: Fix potential divide by zero (Wei Chen)   
  - fbdev: nvidia: Fix potential divide by zero (Wei Chen)   
  - sched_getaffinity: don't assume 'cpumask_size()' is fully initialized (Linus Torvalds)   
  - fbdev: tgafb: Fix potential divide by zero (Wei Chen)   
  - ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() (Kuninori Morimoto)   
  - ALSA: asihpi: check pao in control_message() (Kuninori Morimoto)   
  - md: avoid signed overflow in slot_store() (NeilBrown)   
  - ocfs2: fix data corruption after failed write (Jan Kara via Ocfs2-devel)   
  - sched/fair: Sanitize vruntime of entity being migrated (Vincent Guittot)   
  - sched/fair: sanitize vruntime of entity being placed (Zhang Qiao)   
  - dm crypt: add cond_resched() to dmcrypt_write() (Mikulas Patocka)   
  - dm stats: check for and propagate alloc_percpu failure (Jiasheng Jiang)   
  - i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() (Wei Chen)   
  - nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() (Ryusuke Konishi)   
  - usb: chipidea: core: fix possible concurrent when switch role (Xu Yang)   
  - usb: chipdea: core: fix return -EINVAL if request role is the same with current role (Xu Yang)   
  - igb: revert rtnl_lock() that causes deadlock (Lin Ma)   
  - usb: gadget: u_audio: don't let userspace block driver unbind (Alvin Šipraga)   
  - scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR (Joel Selvaraj)   
  - sh: sanitize the flags on sigreturn (Al Viro)   
  - net: usb: qmi_wwan: add Telit 0x1080 composition (Enrico Sau)   
  - net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 (Enrico Sau)   
  - scsi: ufs: core: Add soft dependency on governor_simpleondemand (Adrien Thierry)   
  - scsi: target: iscsi: Fix an error message in iscsi_check_key() (Maurizio Lombardi)   
  - m68k: Only force 030 bus error if PC not in exception table (Michael Schmitz)   
  - ca8210: fix mac_len negative array access (Alexander Aring)   
  - riscv: Bump COMMAND_LINE_SIZE value to 1024 (Alexandre Ghiti)   
  - thunderbolt: Use const qualifier for `ring_interrupt_index` (Mario Limonciello)   
  - uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 (Yaroslav Furman)   
  - hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs (Frank Crawford)   
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work (Zheng Wang)   
  - Bluetooth: btqcomsmd: Fix command timeout after setting BD address (Stephan Gerhold)   
  - net: mdio: thunder: Add missing fwnode_handle_put() (Liang He)   
  - hvc/xen: prevent concurrent accesses to the shared ring (Roger Pau Monne)   
  - atm: idt77252: fix kmemleak when rmmod idt77252 (Li Zetao)   
  - net/mlx5: Read the TC mapping of all priorities on ETS query (Maher Sanalla)   
  - bpf: Adjust insufficient default bpf_jit_limit (Daniel Borkmann)   
  - net/ps3_gelic_net: Use dma_mapping_error (Geoff Levand)   
  - net/ps3_gelic_net: Fix RX sk_buff length (Geoff Levand)   
  - net: qcom/emac: Fix use after free bug in emac_remove due to race condition (Zheng Wang)   
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach (Zheng Wang)   
  - qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info (Daniil Tatianin)   
  - net: usb: smsc95xx: Limit packet length to skb->len (Szymon Heidrich)   
  - scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() (Yu Kuai)   
  - i2c: imx-lpi2c: check only for enabled interrupt flags (Alexander Stein)   
  - igbvf: Regard vf reset nack as success (Akihiko Odaki)   
  - intel/igbvf: free irq on the error path in igbvf_request_msix() (Gaosheng Cui)   
  - iavf: fix inverted Rx hash condition leading to disabled hash (Alexander Lobakin)   
  - power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition (Zheng Wang)   
  - LTS version: v4.14.311 (Saeed Mirzamohammadi)   
  - HID: uhid: Over-ride the default maximum data buffer value with our own (Lee Jones)   
  - HID: core: Provide new max_buffer_size attribute to over-ride the default (Lee Jones)   
  - serial: 8250_em: Fix UART port type (Biju Das)   
  - drm/i915: Don't use stolen memory for ring buffers with LLC (John Harrison)   
  - fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks (Helge Deller)   
  - ftrace: Fix invalid address access in lookup_rec() when index is 0 (Chen Zhongjin)   
  - sh: intc: Avoid spurious sizeof-pointer-div warning (Michael Karcher)   
  - ext4: fix task hung in ext4_xattr_delete_inode (Baokun Li)   
  - ext4: fail ext4_iget if special inode unallocated (Baokun Li)   
  - mmc: atmel-mci: fix race between stop command and start of next command (Tobias Schramm)   
  - media: m5mols: fix off-by-one loop termination error (Linus Torvalds)   
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition (Zheng Wang)   
  - hwmon: (adt7475) Fix masking of hysteresis registers (Tony O'Brien)   
  - hwmon: (adt7475) Display smoothing attributes in correct order (Tony O'Brien)   
  - ethernet: sun: add check for the mdesc_grab() (Liang He)   
  - net/iucv: Fix size of interrupt data (Alexandra Winter)   
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (Szymon Heidrich)   
  - ipv4: Fix incorrect table ID in IOCTL path (Ido Schimmel)   
  - block: sunvdc: add check for mdesc_grab() returning NULL (Liang He)   
  - nvmet: avoid potential UAF in nvmet_req_complete() (Damien Le Moal)   
  - net: usb: smsc75xx: Limit packet length to skb->len (Szymon Heidrich)   
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition (Zheng Wang)   
  - net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails (Heiner Kallweit)   
  - net: tunnels: annotate lockless accesses to dev->needed_headroom (Eric Dumazet)   
  - qed/qed_dev: guard against a possible division by zero (Daniil Tatianin)   
  - nfc: pn533: initialize struct pn533_out_arg properly (Fedor Pchelkin)   
  - tcp: tcp_make_synack() can be called from process context (Breno Leitao)   
  - fs: sysfs_emit_at: Remove PAGE_SIZE alignment check (Eric Biggers)   
  - ext4: fix cgroup writeback accounting with fs-layer encryption (Eric Biggers)   
  - LTS version: v4.14.310 (Saeed Mirzamohammadi)   
  - drm/i915: Don't use BAR mappings for ring buffers with LLC (John Harrison)   
  - tipc: improve function tipc_wait_for_cond() (Tung Nguyen)   
  - media: ov5640: Fix analogue gain control (Paul Elder)   
  - PCI: Add SolidRun vendor ID (Alvaro Karsz)   
  - macintosh: windfarm: Use unsigned type for 1-bit bitfields (Nathan Chancellor)   
  - alpha: fix R_ALPHA_LITERAL reloc for large modules (Edward Humes)   
  - MIPS: Fix a compilation issue (xurui)   
  - net: caif: Fix use-after-free in cfusbl_device_notify() (Shigeru Yoshida)   
  - ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (Eric Dumazet)   
  - nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties (Kang Chen)   
  - nfc: change order inside nfc_se_io error path (Fedor Pchelkin)   
  - ext4: zero i_disksize when initializing the bootloader inode (Zhihao Cheng)   
  - ext4: fix WARNING in ext4_update_inline_data (Ye Bin)   
  - ext4: move where set the MAY_INLINE_DATA flag is set (Ye Bin)   
  - ext4: fix another off-by-one fsmap error on 1k block filesystems (Darrick J. Wong)   
  - ext4: fix RENAME_WHITEOUT handling for inline directories (Eric Whitney)   
  - x86/CPU/AMD: Disable XSAVES on AMD family 0x17 (Andrew Cooper)   
  - LTS version: v4.14.309 (Saeed Mirzamohammadi)   
  - staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh (Philipp Hortmann)   
  - staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script (Philipp Hortmann)   
  - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" (Hector Martin)   
  - LTS version: v4.14.308 (Saeed Mirzamohammadi)   
  - thermal: intel: powerclamp: Fix cur_state for multi package system (Srinivas Pandruvada)   
  - tcp: Fix listen() regression in 4.14.303. (Kuniyuki Iwashima)   
  - s390/setup: init jump labels before command line parsing (Vasily Gorbik)   
  - s390/maccess: add no DAT mode to kernel_write (Vasily Gorbik)   
  - Bluetooth: hci_sock: purge socket queues in the destruct() callback (Nguyen Dinh Phi)   
  - phy: rockchip-typec: Fix unsigned comparison with less than zero (Jiapeng Chong)   
  - usb: uvc: Enumerate valid values for color matching (Daniel Scally)   
  - USB: ene_usb6250: Allocate enough memory for full object (Kees Cook)   
  - usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math (Kees Cook)   
  - iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() (Harshit Mogalapalli)   
  - iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() (Harshit Mogalapalli)   
  - tools/iio/iio_utils:fix memory leak (Yulong Zhang)   
  - tty: serial: fsl_lpuart: disable the CTS when send break signal (Sherry Sun)   
  - tty: fix out-of-bounds access in tty_driver_lookup_tty() (Sven Schnelle)   
  - media: uvcvideo: Handle cameras with invalid descriptors (Ricardo Ribalda)   
  - firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 (Darrell Kavanagh)   
  - tracing: Add NULL checks for buffer in ring_buffer_free_read_page() (Jia-Ju Bai)   
  - thermal: intel: quark_dts: fix error pointer dereference (Dan Carpenter)   
  - scsi: ipr: Work around fortify-string warning (Arnd Bergmann)   
  - tcp: tcp_check_req() can be called from process context (Eric Dumazet)   
  - ARM: dts: spear320-hmi: correct STMPE GPIO compatible (Krzysztof Kozlowski)   
  - nfc: fix memory leak of se_io context in nfc_genl_se_io (Fedor Pchelkin)   
  - 9p/xen: fix connection sequence (Juergen Gross)   
  - 9p/xen: fix version parsing (Juergen Gross)   
  - net: fix __dev_kfree_skb_any() vs drop monitor (Eric Dumazet)   
  - netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() (Hangyu Hua)   
  - watchdog: pcwd_usb: Fix attempting to access uninitialized memory (Li Hua)   
  - watchdog: Fix kmemleak in watchdog_cdev_register (Chen Jun)   
  - watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path (ruanjinjie)   
  - x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list (Ammar Faizi)   
  - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed (Zhihao Cheng)   
  - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() (Zhihao Cheng)   
  - ubifs: ubifs_writepage: Mark page dirty after writing inode failed (Zhihao Cheng)   
  - ubifs: dirty_cow_znode: Fix memleak in error handling path (Zhihao Cheng)   
  - ubifs: Re-statistic cleaned znode count if commit failed (Zhihao Cheng)   
  - ubi: Fix possible null-ptr-deref in ubi_free_volume() (Yang Yingliang)   
  - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (Li Zetao)   
  - ubi: Fix use-after-free when volume resizing failed (Li Zetao)   
  - ubifs: Reserve one leb for each journal head while doing budget (Zhihao Cheng)   
  - ubifs: Fix wrong dirty space budget for dirty inode (Zhihao Cheng)   
  - ubifs: Rectify space budget for ubifs_xrename() (Zhihao Cheng)   
  - ubi: ensure that VID header offset + VID header size <= alloc, size (George Kennedy)   
  - pwm: stm32-lp: fix the check on arr and cmp registers update (Fabrice Gasnier)   
  - fs/jfs: fix shift exponent db_agl2size negative (Liu Shixin via Jfs-discussion)   
  - net/sched: Retire tcindex classifier (Jamal Hadi Salim)   
  - kbuild: Port silent mode detection to future gnu make. (Dmitry Goncharov)   
  - drm/radeon: Fix eDP for single-display iMac11,2 (Mark Hawrylak)   
  - PCI: Avoid FLR for AMD FCH AHCI adapters (Damien Le Moal)   
  - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() (Tomas Henzl)   
  - scsi: ses: Fix possible desc_ptr out-of-bounds accesses (Tomas Henzl)   
  - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses (Tomas Henzl)   
  - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() (Tomas Henzl)   
  - scsi: ses: Don't attach if enclosure has no components (James Bottomley)   
  - scsi: qla2xxx: Fix erroneous link down (Quinn Tran)   
  - scsi: qla2xxx: Fix link failure in NPIV environment (Quinn Tran)   
  - ktest.pl: Fix missing "end_monitor" when machine check fails (Steven Rostedt)   
  - mips: fix syscall_get_nr (Elvira Khabirova)   
  - alpha: fix FEN fault handling (Al Viro)   
  - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (Ilya Dryomov)   
  - ARM: dts: exynos: correct TMU phandle in Odroid XU (Krzysztof Kozlowski)   
  - ARM: dts: exynos: correct TMU phandle in Exynos4 (Krzysztof Kozlowski)   
  - dm flakey: don't corrupt the zero page (Mikulas Patocka)   
  - dm flakey: fix logic when corrupting a bio (Mikulas Patocka)   
  - wifi: cfg80211: Fix use after free for wext (Alexander Wetzel)   
  - wifi: rtl8xxxu: Use a longer retry limit of 48 (Bitterblue Smith)   
  - ext4: refuse to create ea block when umounted (Jun Nie)   
  - ext4: optimize ea_inode block expansion (Jun Nie)   
  - ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() (Dmitry Fomin)   
  - irqdomain: Drop bogus fwspec-mapping error handling (Johan Hovold)   
  - irqdomain: Fix disassociation race (Johan Hovold)   
  - irqdomain: Fix association race (Johan Hovold)   
  - ima: Align ima_file_mmap() parameters with mmap_file LSM hook (Roberto Sassu)   
  - Documentation/hw-vuln: Document the interaction between IBRS and STIBP (KP Singh)   
  - x86/microcode/AMD: Fix mixed steppings support (Borislav Petkov (AMD))   
  - x86/microcode/AMD: Add a @cpu parameter to the reloading functions (Borislav Petkov (AMD))   
  - x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter (Borislav Petkov (AMD))   
  - x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range (Yang Jihong)   
  - x86/kprobes: Fix __recover_optprobed_insn check optimizing logic (Yang Jihong)   
  - x86/reboot: Disable SVM, not just VMX, when stopping CPUs (Sean Christopherson)   
  - x86/crash: Disable virt in core NMI crash handler to avoid double shootdown (Sean Christopherson)   
  - x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) (Sean Christopherson)   
  - udf: Fix file corruption when appending just after end of preallocated extent (Jan Kara)   
  - udf: Do not update file length for failed writes to inline files (Jan Kara)   
  - udf: Do not bother merging very long extents (Jan Kara)   
  - udf: Truncate added extents on failed expansion (Jan Kara)   
  - ocfs2: fix non-auto defrag path not working issue (Heming Zhao via Ocfs2-devel)   
  - ocfs2: fix defrag path triggering jbd2 ASSERT (Heming Zhao via Ocfs2-devel)   
  - f2fs: fix information leak in f2fs_move_inline_dirents() (Eric Biggers)   
  - fs: hfsplus: fix UAF issue in hfsplus_put_super (Dongliang Mu)   
  - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create (Liu Shixin)   
  - s390/kprobes: fix current_kprobe never cleared after kprobes reenter (Vasily Gorbik)   
  - s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler (Vasily Gorbik)   
  - rtc: pm8xxx: fix set-alarm race (Johan Hovold)   
  - wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu (Jun ASAKA)   
  - spi: bcm63xx-hsspi: Fix multi-bit mode setting (William Zhang)   
  - dm cache: add cond_resched() to various workqueue loops (Mike Snitzer)   
  - dm thin: add cond_resched() to various workqueue loops (Mike Snitzer)   
  - pinctrl: at91: use devm_kasprintf() to avoid potential leaks (Claudiu Beznea)   
  - regulator: s5m8767: Bounds check id indexing into arrays (Kees Cook)   
  - regulator: max77802: Bounds check regulator id against opmode (Kees Cook)   
  - ASoC: kirkwood: Iterate over array indexes instead of using pointer math (Kees Cook)   
  - docs/scripts/gdb: add necessary make scripts_gdb step (Jakob Koschel)   
  - drm/msm/dsi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang)   
  - drm/radeon: free iio for atombios when driver shutdown (Liwei Song)   
  - ACPI: video: Fix Lenovo Ideapad Z570 DMI match (Hans de Goede)   
  - m68k: Check syscall_trace_enter() return code (Michael Schmitz)   
  - net: bcmgenet: Add a check for oversized packets (Florian Fainelli)   
  - ACPI: Don't build ACPICA with '-Os' (Mark Rutland)   
  - inet: fix fast path in __inet_hash_connect() (Pietro Borrello)   
  - timers: Prevent union confusion from unexpected restart_syscall() (Jann Horn)   
  - thermal: intel: Fix unsigned comparison with less than zero (Yang Li)   
  - rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() (Paul E. McKenney)   
  - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (Jisoo Jang)   
  - ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy (Markuss Broks)   
  - udf: Define EFSCORRUPTED error code (Jan Kara)   
  - rpmsg: glink: Avoid infinite loop on intent for missing channel (Bjorn Andersson)   
  - media: usb: siano: Fix use after free bugs caused by do_submit_urb (Duoming Zhou)   
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() (Duoming Zhou)   
  - media: platform: ti: Add missing check for devm_regulator_get (Jiasheng Jiang)   
  - MIPS: vpe-mt: drop physical_memsize (Randy Dunlap)   
  - powerpc/pseries/lparcfg: add missing RTAS retry status handling (Nathan Lynch)   
  - powerpc/powernv/ioda: Skip unallocated resources when mapping to PE (Frederic Barrat)   
  - Input: ads7846 - don't check penirq immediately for 7845 (Luca Ellero)   
  - Input: ads7846 - don't report pressure for ads7845 (Luca Ellero)   
  - mtd: rawnand: sunxi: Fix the size of the last OOB region (Samuel Holland)   
  - mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() (Qiheng Lin)   
  - dm: remove flush_scheduled_work() during local_exit() (Mike Snitzer)   
  - scsi: aic94xx: Add missing check for dma_map_single() (Jiasheng Jiang)   
  - hwmon: (ltc2945) Handle error case in ltc2945_value_store (Jonathan Cormier)   
  - gpio: vf610: connect GPIO label to dev name (Haibo Chen)   
  - ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() (Kuninori Morimoto)   
  - drm/mediatek: Drop unbalanced obj unref (Rob Clark)   
  - drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness (Daniel Mentz)   
  - ALSA: hda/ca0132: minor fix for allocation size (Alexey V. Vissarionov)   
  - pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups (Miaoqian Lin)   
  - drm/msm/hdmi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang)   
  - gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() (Liang He)   
  - drm/bridge: megachips: Fix error handling in i2c_register_driver() (Yuan Can)   
  - drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC (Geert Uytterhoeven)   
  - irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts (Florian Fainelli)   
  - can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error (Frank Jungclaus)   
  - wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() (Dan Carpenter)   
  - m68k: /proc/hardware should depend on PROC_FS (Randy Dunlap)   
  - crypto: rsa-pkcs1pad - Use akcipher_request_complete (Herbert Xu)   
  - Bluetooth: L2CAP: Fix potential user-after-free (Luiz Augusto von Dentz)   
  - cpufreq: davinci: Fix clk use after free (Uwe Kleine-König)   
  - irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe (Miaoqian Lin)   
  - irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains (Miaoqian Lin)   
  - net/mlx5: Enhance debug print in page allocation failure (Jack Morgenstein)   
  - crypto: seqiv - Handle EBUSY correctly (Herbert Xu)   
  - ACPI: battery: Fix missing NUL-termination with large strings (Armin Wolf)   
  - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() (Minsuk Kang)   
  - wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function (Fedor Pchelkin)   
  - wifi: orinoco: check return value of hermes_write_wordrec() (Alexey Kodanev)   
  - ACPICA: nsrepair: handle cases without a return value correctly (Daniil Tatianin)   
  - lib/mpi: Fix buffer overrun when SG is too long (Herbert Xu)   
  - genirq: Fix the return type of kstat_cpu_irqs_sum() (Zhen Lei)   
  - wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() (Zhengchao Shao)   
  - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (Zhang Changzhong)   
  - wifi: ipw2200: fix memory leak in ipw_wdev_init() (Zhengchao Shao)   
  - wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: libertas: fix memory leak in lbs_init_adapter() (Zhengchao Shao)   
  - arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name (Neil Armstrong)   
  - arm64: dts: amlogic: meson-gx: add missing unit address to rng node name (Neil Armstrong)   
  - arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name (Neil Armstrong)   
  - ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato (Krzysztof Kozlowski)   
  - ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() (Yang Yingliang)   
  - arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address (Martin Blumenstingl)   
  - arm64: dts: meson-gx: Fix Ethernet MAC address unit name (Martin Blumenstingl)   
  - ARM: zynq: Fix refcount leak in zynq_early_slcr_init (Qiheng Lin)   
  - ARM: OMAP2+: Fix memory leak in realtime_counter_init() (Chen Hui)   
  - HID: asus: use spinlock to safely schedule workers (Pietro Borrello)   
  - HID: asus: use spinlock to protect concurrent accesses (Pietro Borrello)   
  - HID: asus: Remove check for same LED brightness on set (Luke D. Jones)   
  - USB: core: Don't hold device lock while reading the "descriptors" sysfs file (Alan Stern)   
  - USB: serial: option: add support for VW/Skoda "Carstick LTE" (Florian Zumbiehl)   
  - dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size (Jiasheng Jiang)   
  - bpf: Fix truncation handling for mod32 dst reg wrt zero (Daniel Borkmann)   
  - bpf: Fix 32 bit src register truncation on div/mod (Daniel Borkmann)   
  - bpf: fix subprog verifier bypass by div/mod by 0 exception (Daniel Borkmann)   
  - bpf: Do not use ax register in interpreter on div/mod (Daniel Borkmann)   
  - net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues(). (Kuniyuki Iwashima)   
  - IB/hfi1: Assign npages earlier (Dean Luick)   
  - btrfs: send: limit number of clones and allocated memory size (David Sterba)   
  - ARM: dts: rockchip: add power-domains property to dp node on rk3288 (Johan Jonker)   
  - LTS version: v4.14.307 (Saeed Mirzamohammadi)   
  - wifi: mwifiex: Add missing compatible string for SD8787 (Lukas Wunner)   
  - uaccess: Add speculation barrier to copy_from_user() (Dave Hansen)   
  - alarmtimer: Prevent starvation by small intervals and SIG_IGN (Thomas Gleixner)   
  - powerpc: dts: t208x: Disable 10G on MAC1 and MAC2 (Sean Anderson)   
  - random: always mix cycle counter in add_latent_entropy() (Jason A. Donenfeld)   
  - powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G (Sean Anderson)   
  - wifi: rtl8xxxu: gen2: Turn on the rate control (Bitterblue Smith)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.526.2.el7uek]
changelog:
  - Revert "net/sched: Retire tcindex classifier" (Saeed Mirzamohammadi)  [Orabug: 35415066]  
  - elba.dtsi: Improved sdclk and sdclk-hsmmc timing. (David Clear)  [Orabug: 35411611]  
  - dsc-drivers: update ionic drivers to 23.04.1-001 (Dave Kleikamp)  [Orabug: 35411611]  
  - dsc-drivers: update ionic drivers to 22.11.1-001 (Dave Kleikamp)  [Orabug: 35411611]  
  - dsc-drivers: update drivers for 1.15.9-C-100 (Dave Kleikamp)  [Orabug: 35411611]  
  - kernfs: change kernfs_rename_lock into a read-write lock. (Imran Khan)  [Orabug: 35257586]  
  - kernfs: Use a per-fs rwsem to protect per-fs list of kernfs_super_info. (Imran Khan)  [Orabug: 35257586]  
  - kernfs: Introduce separate rwsem to protect inode attributes. (Imran Khan)  [Orabug: 35257586]  
  - btrfs: scan device in non-exclusive mode (Anand Jain)  [Orabug: 35153012]  
  - btrfs: free device in btrfs_close_devices for a single device filesystem (Anand Jain)  [Orabug: 35153012]  
  - SUNRPC: remove the maximum number of retries in call_bind_status (Dai Ngo)  [Orabug: 34640827]  
  - KVM: nVMX: add CR4_LA57 bit to nested CR4_FIXED1 (Chenyi Qiang)  [Orabug: 32715898]  
  - Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" (Liu Jian)   
  - Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path" (Zhihao Cheng)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.526.2.1.el7uek]
changelog:
  - xfs: log recovery stage split EFIs with multiple extents (Wengang Wang)  [Orabug: 35490075]  
  - xfs: IO time one extent per EFI (Wengang Wang)  [Orabug: 35490075]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.527.1.el7uek]
changelog:
  - mips64: Enable CRYPTO_USER_API_SKCIPHER config (Vijay Kumar)  [Orabug: 35458816]  
  - net/rds: Fix copy&paste error (Gerd Rausch)  [Orabug: 35416949]  
  - uek-rpm: Blacklist cls_tcindex module (Somasundaram Krishnasamy)  [Orabug: 35408336]  
  - LTS version: v4.14.316 (Saeed Mirzamohammadi)   
  - 3c589_cs: Fix an error handling path in tc589_probe() (Christophe JAILLET)   
  - forcedeth: Fix an error handling path in nv_probe() (Christophe JAILLET)   
  - x86/show_trace_log_lvl: Ensure stack pointer is aligned, again (Vernon Lovejoy)   
  - xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() (Dan Carpenter)   
  - power: supply: sbs-charger: Fix INHIBITED bit for Status reg (Daisuke Nojiri)   
  - power: supply: bq27xxx: Fix poll_interval handling and races on remove (Hans de Goede)   
  - power: supply: bq27xxx: Fix I2C IRQ race on remove (Hans de Goede)   
  - power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition (Hans de Goede)   
  - power: supply: leds: Fix blink to LED on transition (Hans de Goede)   
  - ipv6: Fix out-of-bounds access in ipv6_find_tlv() (Gavrilov Ilia)   
  - net: fix skb leak in __skb_tstamp_tx() (Pratyush Yadav)   
  - media: radio-shark: Add endpoint checks (Alan Stern)   
  - USB: sisusbvga: Add endpoint checks (Alan Stern)   
  - x86/mm: Avoid incomplete Global INVLPG flushes (Saeed Mirzamohammadi)   
  - USB: core: Add routines for endpoint checks in old drivers (Alan Stern)   
  - selftests/memfd: Fix unknown type name build failure (Hardik Garg)   
  - netfilter: nf_tables: fix register ordering (Florian Westphal)   
  - netfilter: nf_tables: do not allow SET_ID to refer to another table (Pablo Neira Ayuso)   
  - netfilter: nf_tables: do not allow RULE_ID to refer to another chain (Pablo Neira Ayuso)   
  - netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL (Pablo Neira Ayuso)   
  - netfilter: nf_tables: stricter validation of element data (Pablo Neira Ayuso)   
  - netfilter: nf_tables: allow up to 64 bytes in the set element data area (Pablo Neira Ayuso)   
  - netfilter: nf_tables: add nft_setelem_parse_key() (Pablo Neira Ayuso)   
  - netfilter: nf_tables: validate registers coming from userspace. (Pablo Neira Ayuso)   
  - netfilter: nftables: statify nft_parse_register() (Pablo Neira Ayuso)   
  - netfilter: nftables: add nft_parse_register_store() and use it (Pablo Neira Ayuso)   
  - netfilter: nftables: add nft_parse_register_load() and use it (Pablo Neira Ayuso)   
  - parisc: Allow to reboot machine after system halt (Helge Deller)   
  - m68k: Move signal frame following exception on 68020/030 (Finn Thain)   
  - spi: fsl-cpm: Use 16 bit mode for large transfers with even size (Christophe Leroy)   
  - spi: fsl-spi: Re-organise transfer bits_per_word adaptation (Christophe Leroy)   
  - spi: spi-fsl-spi: automatically adapt bits-per-word in cpu mode (Rasmus Villemoes)   
  - netfilter: nf_tables: bogus EBUSY in helper removal from transaction (Pablo Neira Ayuso)   
  - nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() (Ryusuke Konishi)   
  - ceph: force updating the msg pointer in non-split case (Xiubo Li)   
  - serial: Add support for Advantech PCI-1611U card (Vitaliy Tomin)   
  - statfs: enforce statfs[64] structure initialization (Ilya Leoshkevich)   
  - ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table (Nikhil Mahale)   
  - ALSA: hda: Fix Oops by 9.1 surround channel names (Takashi Iwai)   
  - usb-storage: fix deadlock when a scsi command timeouts more than once (Maxime Bizon)   
  - vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() (Eric Dumazet)   
  - igb: fix bit_shift to be in [1..8] range (Aleksandr Loktionov)   
  - cassini: Fix a memory leak in the error handling path of cas_init_one() (Christophe JAILLET)   
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Dong Chenchen)   
  - media: netup_unidvb: fix use-after-free at del_timer() (Duoming Zhou)   
  - vsock: avoid to close connected socket after the timeout (Zhuang Shengen)   
  - net: fec: Better handle pm_runtime_get() failing in .remove() (Uwe Kleine-König)   
  - af_key: Reject optional tunnel/BEET mode templates in outbound policies (Tobias Brunner)   
  - cpupower: Make TSC read per CPU for Mperf monitor (Wyes Karny)   
  - mfd: dln2: Fix memory leak in dln2_probe() (Qiang Ning)   
  - phy: st: miphy28lp: use _poll_timeout functions for waits (Alain Volmat)   
  - Input: xpad - add constants for GIP interface numbers (Vicki Pfau)   
  - clk: tegra20: fix gcc-7 constant overflow warning (Arnd Bergmann)   
  - recordmcount: Fix memory leaks in the uwrite function (Hao Zeng)   
  - sched: Fix KCSAN noinstr violation (Josh Poimboeuf)   
  - mcb-pci: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - serial: 8250: Reinit port->pm on port specific driver unbind (Tony Lindgren)   
  - HID: wacom: generic: Set battery quirk only when we see battery data (Jason Gerecke)   
  - spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 (Kevin Groeneveld)   
  - HID: logitech-hidpp: Reconcile USB and Unifying serials (Bastien Nocera)   
  - HID: logitech-hidpp: Don't use the USB serial for USB devices (Bastien Nocera)   
  - staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE (Philipp Hortmann)   
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (Min Li)   
  - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (Hans de Goede)   
  - ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() (Ojaswin Mujoo)   
  - ext4: set goal start correctly in ext4_mb_normalize_request (Kemeng Shi)   
  - gfs2: Fix inode height consistency check (Andreas Gruenbacher)   
  - scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition (Zheng Wang)   
  - lib: cpu_rmap: Avoid use after free on rmap->obj array entries (Eli Cohen)   
  - net: Catch invalid index in XPS mapping (Nick Child)   
  - net: pasemi: Fix return type of pasemi_mac_start_tx() (Nathan Chancellor)   
  - ext2: Check block size validity during mount (Jan Kara)   
  - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex (Hector Martin)   
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects (void0red)   
  - ACPICA: Avoid undefined behavior: applying zero offset to null pointer (Tamir Duberstein)   
  - drm/tegra: Avoid potential 32-bit integer overflow (Nur Hussein)   
  - ACPI: EC: Fix oops when removing custom query handlers (Armin Wolf)   
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang)   
  - regmap: cache: Return error in cache sync operations for REGCACHE_NONE (Alexander Stein)   
  - fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() (Tetsuo Handa)   
  - af_unix: Fix a data race of sk->sk_receive_queue->qlen. (Kuniyuki Iwashima)   
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (t.feng)   
  - net: annotate sk->sk_err write from do_recvmmsg() (Eric Dumazet)   
  - netlink: annotate accesses to nlk->cb_running (Eric Dumazet)   
  - net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). (Kuniyuki Iwashima)   
  - LTS version: v4.14.315 (Saeed Mirzamohammadi)   
  - mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock (Tetsuo Handa)   
  - printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h (Tetsuo Handa)   
  - drbd: correctly submit flush bio on barrier (Christoph Böhmwalder)   
  - serial: 8250: Fix serial8250_tx_empty() race with DMA Tx (Ilpo Järvinen)   
  - tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH (Ilpo Järvinen)   
  - perf bench: Share some global variables to fix build with gcc 10 (Arnaldo Carvalho de Melo)   
  - ext4: fix invalid free tracking in ext4_xattr_move_to_block() (Theodore Ts'o)   
  - ext4: remove a BUG_ON in ext4_mb_release_group_pa() (Theodore Ts'o)   
  - ext4: bail out of ext4_xattr_ibody_get() fails for any reason (Theodore Ts'o)   
  - ext4: add bounds checking in get_max_inline_xattr_value_size() (Theodore Ts'o)   
  - ext4: improve error recovery code paths in __ext4_remount() (Theodore Ts'o)   
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus)   
  - HID: wacom: Set a default resolution for older tablets (Ping Cheng)   
  - ARM: dts: s5pv210: correct MIPI CSIS clock name (Krzysztof Kozlowski)   
  - ARM: dts: exynos: fix WM8960 clock name in Itop Elite (Krzysztof Kozlowski)   
  - sh: nmi_debug: fix return value of __setup handler (Randy Dunlap)   
  - sh: math-emu: fix macro redefined warning (Randy Dunlap)   
  - cifs: fix pcchunk length type in smb2_copychunk_range (Pawel Witek)   
  - btrfs: print-tree: parent bytenr must be aligned to sector size (Anastasia Belova)   
  - btrfs: fix btrfs_prev_leaf() to not return the same key twice (Filipe Manana)   
  - perf symbols: Fix return incorrect build_id size in elf_read_build_id() (Yang Jihong)   
  - perf map: Delete two variable initialisations before null pointer checks in sort__sym_from_cmp() (Markus Elfring)   
  - perf vendor events power9: Remove UTF-8 characters from JSON files (Kajol Jain)   
  - ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init` (Ruliang Lin)   
  - af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). (Kuniyuki Iwashima)   
  - net/sched: act_mirred: Add carrier check (Victor Nogueira)   
  - writeback: fix call of incorrect macro (Maxim Korotkov)   
  - sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() (Cong Wang)   
  - netfilter: nf_tables: deactivate anonymous set from preparation phase (Pablo Neira Ayuso)   
  - netfilter: nf_tables: bogus EBUSY when deleting set after flush (Pablo Neira Ayuso)   
  - netfilter: nf_tables: use-after-free in failing rule with bound set (Pablo Neira Ayuso)   
  - netfilter: nft_hash: fix nft_hash_deactivate (Pablo Neira Ayuso)   
  - netfilter: nf_tables: unbind set in rule from commit path (Pablo Neira Ayuso)   
  - netfilter: nf_tables: split set destruction in deactivate and destroy phase (Florian Westphal)   
  - perf auxtrace: Fix address filter entire kernel size (Adrian Hunter)   
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern (Mike Snitzer)   
  - dm flakey: fix a crash with invalid table line (Mikulas Patocka)   
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (Mike Snitzer)   
  - s390/dasd: fix hanging blockdevice after request requeue (Stefan Haberland)   
  - btrfs: scrub: reject unsupported scrub flags (Qu Wenruo)   
  - clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent (Quentin Schulz)   
  - wifi: rtl8xxxu: RTL8192EU always needs full init (Bitterblue Smith)   
  - nilfs2: fix infinite loop in nilfs_mdt_get_block() (Ryusuke Konishi)   
  - nilfs2: do not write dirty data after degenerating to read-only (Ryusuke Konishi)   
  - parisc: Fix argument pointer in real64_call_asm() (Helge Deller)   
  - dmaengine: at_xdmac: do not enable all cyclic channels (Claudiu Beznea)   
  - phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port (Gaosheng Cui)   
  - NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease (Trond Myklebust)   
  - IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order (Patrick Kelsey)   
  - clk: add missing of_node_put() in "assigned-clocks" property parsing (Clément Léger)   
  - power: supply: generic-adc-battery: fix unit scaling (Sebastian Reichel)   
  - RDMA/rdmavt: Delete unnecessary NULL check (Natalia Petrova)   
  - perf/core: Fix hardlockup failure caused by perf throttle (Yang Jihong)   
  - powerpc/rtas: use memmove for potentially overlapping buffer copy (Nathan Lynch)   
  - macintosh: via-pmu-led: requires ATA to be set (Randy Dunlap)   
  - powerpc/sysdev/tsi108: fix resource printk format warnings (Randy Dunlap)   
  - powerpc/wii: fix resource printk format warnings (Randy Dunlap)   
  - powerpc/mpc512x: fix resource printk format warning (Randy Dunlap)   
  - macintosh/windfarm_smu_sat: Add missing of_node_put() (Liang He)   
  - spmi: Add a check for remove callback when removing a SPMI driver (Jishnu Prakash)   
  - staging: rtl8192e: Fix W_DISABLE# does not work after stop/start (Philipp Hortmann)   
  - serial: 8250: Add missing wakeup event reporting (Florian Fainelli)   
  - tty: serial: fsl_lpuart: adjust buffer length to the intended size (Shenwei Wang)   
  - usb: chipidea: fix missing goto in `ci_hdrc_probe` (Yinhao Hu)   
  - sh: sq: Fix incorrect element size for allocating bitmap buffer (John Paul Adrian Glaubitz)   
  - uapi/linux/const.h: prefer ISO-friendly __typeof__ (Saeed Mirzamohammadi)   
  - ia64: mm/contig: fix section mismatch warning/error (Randy Dunlap)   
  - of: Fix modalias string generation (Miquel Raynal)   
  - spi: fsl-spi: Fix CPM/QE mode Litte Endian (Christophe Leroy)   
  - linux/vt_buffer.h: allow either builtin or modular for macros (Randy Dunlap)   
  - pstore: Revert pmsg_lock back to a normal mutex (John Stultz)   
  - tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (Kuniyuki Iwashima)   
  - net: amd: Fix link leak when verifying config failed (Gencen Gan)   
  - ipv4: Fix potential uninit variable access bug in __ip_make_skb() (Ziyang Xuan)   
  - ixgbe: Enable setting RSS table to default values (Joe Damato)   
  - ixgbe: Allow flow hash to be set via ethtool (Joe Damato)   
  - wifi: iwlwifi: mvm: check firmware response size (Johannes Berg)   
  - wifi: iwlwifi: make the loop for card preparation effective (Emmanuel Grumbach)   
  - md/raid10: fix leak of 'r10bio->remaining' for recovery (Yu Kuai)   
  - scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS (Danila Chernetsov)   
  - scsi: target: iscsit: Fix TAS handling during conn cleanup (Mike Christie)   
  - net/packet: convert po->auxdata to an atomic flag (Eric Dumazet)   
  - net/packet: convert po->origdev to an atomic flag (Eric Dumazet)   
  - vlan: partially enable SIOCSHWTSTAMP in container (Vadim Fedorenko)   
  - scm: fix MSG_CTRUNC setting condition for SO_PASSSEC (Alexander Mikhalitsyn)   
  - wifi: ath6kl: reduce WARN to dev_dbg() in callback (Fedor Pchelkin)   
  - wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() (Dan Carpenter)   
  - wifi: ath6kl: minor fix for allocation size (Alexey V. Vissarionov)   
  - arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step (Sumit Garg)   
  - x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() (Saurabh Sengar)   
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (Zheng Wang)   
  - x86/apic: Fix atomic update of offset in reserve_eilvt_offset() (Uros Bizjak)   
  - media: av7110: prevent underflow in write_ts_to_decoder() (Dan Carpenter)   
  - media: bdisp: Add missing check for create_workqueue (Jiasheng Jiang)   
  - drm/probe-helper: Cancel previous job before starting new one (Dom Cobley)   
  - drm/vgem: add missing mutex_destroy (Maíra Canal)   
  - drm/rockchip: Drop unbalanced obj unref (Rob Clark)   
  - selinux: ensure av_permissions.h is built when needed (Paul Moore)   
  - selinux: fix Makefile dependencies of flask.h (Ondrej Mosnacek)   
  - ubifs: Free memory for tmpfile name (Mårten Lindahl)   
  - ubi: Fix return value overwrite issue in try_write_vid_and_data() (Wang YanQing)   
  - i2c: omap: Fix standard mode false ACK readings (Reid Tonking)   
  - reiserfs: Add security prefix to xattr name in reiserfs_security_write() (Roberto Sassu)   
  - ring-buffer: Sync IRQ works before buffer destruction (Johannes Berg)   
  - MIPS: fw: Allow firmware to pass a empty env (Jiaxun Yang)   
  - staging: iio: resolver: ads1210: fix config mode (Nuno Sá)   
  - perf sched: Cast PTHREAD_STACK_MIN to int as it may turn into sysconf(__SC_THREAD_STACK_MIN_VALUE) (Arnaldo Carvalho de Melo)   
  - USB: dwc3: fix runtime pm imbalance on unbind (Johan Hovold)   
  - iio: adc: palmas_gpadc: fix NULL dereference on rmmod (Patrik Dahlström)   
  - USB: serial: option: add UNISOC vendor and TOZED LT70C product (Arınç ÜNAL)   
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ruihan Li)   
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (Jisoo Jang)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.527.2.el7uek]
changelog:
  - Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE" (Greg Kroah-Hartman)   
  - lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() (Ben Hutchings)   
  - selinux: don't use make's grouped targets feature yet (Paul Moore)   
  - xfs: log recovery stage split EFIs with multiple extents (Wengang Wang)  [Orabug: 35475139]  
  - xfs: IO time one extent per EFI (Wengang Wang)  [Orabug: 35475139]  
  - uek_kabi: Add UEK_KABI_DEPRECATE_ENUM (Sherry Yang)  [Orabug: 35469884]  
  - bnxt_en: Clear DEFRAG flag in firmware message when retry flashing. (Pavan Chebbi)  [Orabug: 35406837]  
  - bnxt_en: Enable batch mode when using HWRM_NVM_MODIFY to flash packages. (Michael Chan)  [Orabug: 35406837]  
  - bnxt_en: Retry installing FW package under NO_SPACE error condition. (Pavan Chebbi)  [Orabug: 35406837]  
  - bnxt_en: Restructure bnxt_flash_package_from_fw_obj() to execute in a loop. (Pavan Chebbi)  [Orabug: 35406837]  
  - bnxt_en: Rearrange the logic in bnxt_flash_package_from_fw_obj(). (Michael Chan)  [Orabug: 35406837]  
  - bnxt_en: Refactor bnxt_flash_nvram. (Pavan Chebbi)  [Orabug: 35406837]  
  - bnxt_en: fix error handling when flashing from file (Edwin Peer)  [Orabug: 35406837]  
  - bnxt_en: Fix return code to "flash_device". (Vasundhara Volam)  [Orabug: 35406837]  
  - bnxt_en: Return -EAGAIN if fw command returns BUSY (Vasundhara Volam)  [Orabug: 35406837]  
  - bnxt_en: Convert error code in firmware message response to standard code. (Michael Chan)  [Orabug: 35406837]  
  - bnxt_en: return proper error when FW returns HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED (Vasundhara Volam)  [Orabug: 35406837]  
  - bnxt_en: Use a common function to print the same ethtool -f error message. (Michael Chan)  [Orabug: 35406837]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.526.1.el7uek]
changelog:
  - mm, compaction: Skip all pinned pages during scan (Khalid Aziz)  [Orabug: 35300710]  
  - LTS version: v4.14.314 (Saeed Mirzamohammadi)   
  - ASN.1: Fix check for strdup() success (Ekaterina Orlova)   
  - iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() (Dan Carpenter)   
  - counter: 104-quad-8: Fix race condition between FLAG and CNTR reads (William Breathitt Gray)   
  - sctp: Call inet6_destroy_sock() via sk->sk_destruct(). (Kuniyuki Iwashima)   
  - dccp: Call inet6_destroy_sock() via sk->sk_destruct(). (Kuniyuki Iwashima)   
  - inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). (Kuniyuki Iwashima)   
  - tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). (Kuniyuki Iwashima)   
  - udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM). (Kuniyuki Iwashima)   
  - ext4: fix use-after-free in ext4_xattr_set_entry (Baokun Li)   
  - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Ritesh Harjani)   
  - Revert "ext4: fix use-after-free in ext4_xattr_set_entry" (Tudor Ambarus)   
  - x86/purgatory: Don't generate debug info for purgatory.ro (Pingfan Liu)   
  - memstick: fix memory leak if card device is never registered (Greg Kroah-Hartman)   
  - nilfs2: initialize unused bytes in segment summary blocks (Ryusuke Konishi)   
  - xen/netback: use same error messages for same errors (Juergen Gross)   
  - s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling (Heiko Carstens)   
  - net: dsa: b53: mmap: add phy ops (Álvaro Fernández Rojas)   
  - scsi: core: Improve scsi_vpd_inquiry() checks (Damien Le Moal)   
  - scsi: megaraid_sas: Fix fw_crash_buffer_show() (Tomas Henzl)   
  - selftests: sigaltstack: fix -Wuninitialized (Nick Desaulniers)   
  - f2fs: Fix f2fs_truncate_partial_nodes ftrace event (Douglas Raillard)   
  - e1000e: Disable TSO on i219-LM card to increase speed (Sebastian Basierski)   
  - mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() (Nikita Zhandarovich)   
  - i40e: fix i40e_setup_misc_vector() error handling (Aleksandr Loktionov)   
  - i40e: fix accessing vsi->active_filters without holding lock (Aleksandr Loktionov)   
  - virtio_net: bugfix overflow inside xdp_linearize_page() (Xuan Zhuo)   
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Gwangun Jung)   
  - ARM: dts: rockchip: fix a typo error for rk3288 spdif node (Jianqun Xu)   
  - LTS version: v4.14.313 (Saeed Mirzamohammadi)   
  - arm64: KVM: Fix system register enumeration (Marc Zyngier)   
  - KVM: arm64: Filter out invalid core register IDs in KVM_GET_REG_LIST (Dave Martin)   
  - KVM: arm64: Factor out core register ID enumeration (Dave Martin)   
  - coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug (Steve Clevenger)   
  - watchdog: sbsa_wdog: Make sure the timeout programming is within the limits (George Cherian)   
  - cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() (Waiman Long)   
  - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size (Zhihao Cheng)   
  - verify_pefile: relax wrapper length check (Robbie Harwood)   
  - efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L (Hans de Goede)   
  - i2c: imx-lpi2c: clean rx/tx buffers upon new message (Alexander Stein)   
  - net: macb: fix a memory corruption in extended buffer descriptor mode (Roman Gushchin)   
  - qlcnic: check pci_reset_function result (Denis Plotnikov)   
  - niu: Fix missing unwind goto in niu_alloc_channels() (Harshit Mogalapalli)   
  - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition (Zheng Wang)   
  - mtdblock: tolerate corrected bit-flips (Bang Li)   
  - Bluetooth: Fix race condition in hidp_session_thread (Min Li)   
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (Luiz Augusto von Dentz)   
  - ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards (Oswald Buddenhagen)   
  - ALSA: i2c/cs8427: fix iec958 mixer control deactivation (Oswald Buddenhagen)   
  - ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard (Oswald Buddenhagen)   
  - ALSA: emu10k1: fix capture interrupt handler unlinking (Oswald Buddenhagen)   
  - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() (Rongwei Wang)   
  - ring-buffer: Fix race while reader and writer are on the same page (Zheng Yejian)   
  - ftrace: Mark get_lock_parent_ip() __always_inline (John Keeping)   
  - perf/core: Fix the same task check in perf_event_set_output (Kan Liang)   
  - nilfs2: fix sysfs interface lifetime (Ryusuke Konishi)   
  - nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() (Ryusuke Konishi)   
  - tty: serial: sh-sci: Fix Rx on RZ/G2L SCI (Biju Das)   
  - iio: dac: cio-dac: Fix max DAC write value check for 12-bit (William Breathitt Gray)   
  - USB: serial: option: add Quectel RM500U-CN modem (Bjørn Mork)   
  - USB: serial: option: add Telit FE990 compositions (Enrico Sau)   
  - USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs (Kees Jan Koster)   
  - gpio: davinci: Add irq chip flag to skip set wake (Dhruva Gole)   
  - ipv6: Fix an uninit variable access bug in __ip6_make_skb() (Ziyang Xuan)   
  - icmp: guard against too small mtu (Eric Dumazet)   
  - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta (Felix Fietkau)   
  - pwm: cros-ec: Explicitly set .polarity in .get_state() (Uwe Kleine-König)   
  - LTS version: v4.14.312 (Saeed Mirzamohammadi)   
  - ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() (Harshit Mogalapalli)   
  - net: sched: cbq: dont intepret cls results when asked to drop (Jamal Hadi Salim) [Orabug: 34983585] {CVE-2023-23454}
  - ext4: fix kernel BUG in 'ext4_write_inline_data_end()' (Ye Bin)   
  - usb: host: ohci-pxa27x: Fix and & vs | typo (Dan Carpenter)   
  - s390/uaccess: add missing earlyclobber annotations to __clear_user() (Heiko Carstens)   
  - drm/etnaviv: fix reference leak when mmaping imported buffer (Lucas Stach)   
  - ALSA: usb-audio: Fix regression on detection of Roland VS-100 (Takashi Iwai)   
  - ALSA: hda/conexant: Partial revert of a quirk for Lenovo (Takashi Iwai)   
  - pinctrl: at91-pio4: fix domain name assignment (Johan Hovold)   
  - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (David Disseldorp)   
  - Input: focaltech - use explicitly signed char type (Jason A. Donenfeld)   
  - i40e: fix registers dump after run ethtool adapter self test (Radoslaw Tyl)   
  - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Ivan Orlov)   
  - scsi: megaraid_sas: Fix crash after a double completion (Tomas Henzl)   
  - fbdev: au1200fb: Fix potential divide by zero (Wei Chen)   
  - fbdev: lxfb: Fix potential divide by zero (Wei Chen)   
  - fbdev: intelfb: Fix potential divide by zero (Wei Chen)   
  - fbdev: nvidia: Fix potential divide by zero (Wei Chen)   
  - sched_getaffinity: don't assume 'cpumask_size()' is fully initialized (Linus Torvalds)   
  - fbdev: tgafb: Fix potential divide by zero (Wei Chen)   
  - ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() (Kuninori Morimoto)   
  - ALSA: asihpi: check pao in control_message() (Kuninori Morimoto)   
  - md: avoid signed overflow in slot_store() (NeilBrown)   
  - ocfs2: fix data corruption after failed write (Jan Kara via Ocfs2-devel)   
  - sched/fair: Sanitize vruntime of entity being migrated (Vincent Guittot)   
  - sched/fair: sanitize vruntime of entity being placed (Zhang Qiao)   
  - dm crypt: add cond_resched() to dmcrypt_write() (Mikulas Patocka)   
  - dm stats: check for and propagate alloc_percpu failure (Jiasheng Jiang)   
  - i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() (Wei Chen)   
  - nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() (Ryusuke Konishi)   
  - usb: chipidea: core: fix possible concurrent when switch role (Xu Yang)   
  - usb: chipdea: core: fix return -EINVAL if request role is the same with current role (Xu Yang)   
  - igb: revert rtnl_lock() that causes deadlock (Lin Ma)   
  - usb: gadget: u_audio: don't let userspace block driver unbind (Alvin Šipraga)   
  - scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR (Joel Selvaraj)   
  - sh: sanitize the flags on sigreturn (Al Viro)   
  - net: usb: qmi_wwan: add Telit 0x1080 composition (Enrico Sau)   
  - net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 (Enrico Sau)   
  - scsi: ufs: core: Add soft dependency on governor_simpleondemand (Adrien Thierry)   
  - scsi: target: iscsi: Fix an error message in iscsi_check_key() (Maurizio Lombardi)   
  - m68k: Only force 030 bus error if PC not in exception table (Michael Schmitz)   
  - ca8210: fix mac_len negative array access (Alexander Aring)   
  - riscv: Bump COMMAND_LINE_SIZE value to 1024 (Alexandre Ghiti)   
  - thunderbolt: Use const qualifier for `ring_interrupt_index` (Mario Limonciello)   
  - uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 (Yaroslav Furman)   
  - hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs (Frank Crawford)   
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work (Zheng Wang)   
  - Bluetooth: btqcomsmd: Fix command timeout after setting BD address (Stephan Gerhold)   
  - net: mdio: thunder: Add missing fwnode_handle_put() (Liang He)   
  - hvc/xen: prevent concurrent accesses to the shared ring (Roger Pau Monne)   
  - atm: idt77252: fix kmemleak when rmmod idt77252 (Li Zetao)   
  - net/mlx5: Read the TC mapping of all priorities on ETS query (Maher Sanalla)   
  - bpf: Adjust insufficient default bpf_jit_limit (Daniel Borkmann)   
  - net/ps3_gelic_net: Use dma_mapping_error (Geoff Levand)   
  - net/ps3_gelic_net: Fix RX sk_buff length (Geoff Levand)   
  - net: qcom/emac: Fix use after free bug in emac_remove due to race condition (Zheng Wang)   
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach (Zheng Wang)   
  - qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info (Daniil Tatianin)   
  - net: usb: smsc95xx: Limit packet length to skb->len (Szymon Heidrich)   
  - scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() (Yu Kuai)   
  - i2c: imx-lpi2c: check only for enabled interrupt flags (Alexander Stein)   
  - igbvf: Regard vf reset nack as success (Akihiko Odaki)   
  - intel/igbvf: free irq on the error path in igbvf_request_msix() (Gaosheng Cui)   
  - iavf: fix inverted Rx hash condition leading to disabled hash (Alexander Lobakin)   
  - power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition (Zheng Wang)   
  - LTS version: v4.14.311 (Saeed Mirzamohammadi)   
  - HID: uhid: Over-ride the default maximum data buffer value with our own (Lee Jones)   
  - HID: core: Provide new max_buffer_size attribute to over-ride the default (Lee Jones)   
  - serial: 8250_em: Fix UART port type (Biju Das)   
  - drm/i915: Don't use stolen memory for ring buffers with LLC (John Harrison)   
  - fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks (Helge Deller)   
  - ftrace: Fix invalid address access in lookup_rec() when index is 0 (Chen Zhongjin)   
  - sh: intc: Avoid spurious sizeof-pointer-div warning (Michael Karcher)   
  - ext4: fix task hung in ext4_xattr_delete_inode (Baokun Li)   
  - ext4: fail ext4_iget if special inode unallocated (Baokun Li)   
  - mmc: atmel-mci: fix race between stop command and start of next command (Tobias Schramm)   
  - media: m5mols: fix off-by-one loop termination error (Linus Torvalds)   
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition (Zheng Wang)   
  - hwmon: (adt7475) Fix masking of hysteresis registers (Tony O'Brien)   
  - hwmon: (adt7475) Display smoothing attributes in correct order (Tony O'Brien)   
  - ethernet: sun: add check for the mdesc_grab() (Liang He)   
  - net/iucv: Fix size of interrupt data (Alexandra Winter)   
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (Szymon Heidrich)   
  - ipv4: Fix incorrect table ID in IOCTL path (Ido Schimmel)   
  - block: sunvdc: add check for mdesc_grab() returning NULL (Liang He)   
  - nvmet: avoid potential UAF in nvmet_req_complete() (Damien Le Moal)   
  - net: usb: smsc75xx: Limit packet length to skb->len (Szymon Heidrich)   
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition (Zheng Wang)   
  - net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails (Heiner Kallweit)   
  - net: tunnels: annotate lockless accesses to dev->needed_headroom (Eric Dumazet)   
  - qed/qed_dev: guard against a possible division by zero (Daniil Tatianin)   
  - nfc: pn533: initialize struct pn533_out_arg properly (Fedor Pchelkin)   
  - tcp: tcp_make_synack() can be called from process context (Breno Leitao)   
  - fs: sysfs_emit_at: Remove PAGE_SIZE alignment check (Eric Biggers)   
  - ext4: fix cgroup writeback accounting with fs-layer encryption (Eric Biggers)   
  - LTS version: v4.14.310 (Saeed Mirzamohammadi)   
  - drm/i915: Don't use BAR mappings for ring buffers with LLC (John Harrison)   
  - tipc: improve function tipc_wait_for_cond() (Tung Nguyen)   
  - media: ov5640: Fix analogue gain control (Paul Elder)   
  - PCI: Add SolidRun vendor ID (Alvaro Karsz)   
  - macintosh: windfarm: Use unsigned type for 1-bit bitfields (Nathan Chancellor)   
  - alpha: fix R_ALPHA_LITERAL reloc for large modules (Edward Humes)   
  - MIPS: Fix a compilation issue (xurui)   
  - net: caif: Fix use-after-free in cfusbl_device_notify() (Shigeru Yoshida)   
  - ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (Eric Dumazet)   
  - nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties (Kang Chen)   
  - nfc: change order inside nfc_se_io error path (Fedor Pchelkin)   
  - ext4: zero i_disksize when initializing the bootloader inode (Zhihao Cheng)   
  - ext4: fix WARNING in ext4_update_inline_data (Ye Bin)   
  - ext4: move where set the MAY_INLINE_DATA flag is set (Ye Bin)   
  - ext4: fix another off-by-one fsmap error on 1k block filesystems (Darrick J. Wong)   
  - ext4: fix RENAME_WHITEOUT handling for inline directories (Eric Whitney)   
  - x86/CPU/AMD: Disable XSAVES on AMD family 0x17 (Andrew Cooper)   
  - LTS version: v4.14.309 (Saeed Mirzamohammadi)   
  - staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh (Philipp Hortmann)   
  - staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script (Philipp Hortmann)   
  - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" (Hector Martin)   
  - LTS version: v4.14.308 (Saeed Mirzamohammadi)   
  - thermal: intel: powerclamp: Fix cur_state for multi package system (Srinivas Pandruvada)   
  - tcp: Fix listen() regression in 4.14.303. (Kuniyuki Iwashima)   
  - s390/setup: init jump labels before command line parsing (Vasily Gorbik)   
  - s390/maccess: add no DAT mode to kernel_write (Vasily Gorbik)   
  - Bluetooth: hci_sock: purge socket queues in the destruct() callback (Nguyen Dinh Phi)   
  - phy: rockchip-typec: Fix unsigned comparison with less than zero (Jiapeng Chong)   
  - usb: uvc: Enumerate valid values for color matching (Daniel Scally)   
  - USB: ene_usb6250: Allocate enough memory for full object (Kees Cook)   
  - usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math (Kees Cook)   
  - iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() (Harshit Mogalapalli)   
  - iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() (Harshit Mogalapalli)   
  - tools/iio/iio_utils:fix memory leak (Yulong Zhang)   
  - tty: serial: fsl_lpuart: disable the CTS when send break signal (Sherry Sun)   
  - tty: fix out-of-bounds access in tty_driver_lookup_tty() (Sven Schnelle)   
  - media: uvcvideo: Handle cameras with invalid descriptors (Ricardo Ribalda)   
  - firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 (Darrell Kavanagh)   
  - tracing: Add NULL checks for buffer in ring_buffer_free_read_page() (Jia-Ju Bai)   
  - thermal: intel: quark_dts: fix error pointer dereference (Dan Carpenter)   
  - scsi: ipr: Work around fortify-string warning (Arnd Bergmann)   
  - tcp: tcp_check_req() can be called from process context (Eric Dumazet)   
  - ARM: dts: spear320-hmi: correct STMPE GPIO compatible (Krzysztof Kozlowski)   
  - nfc: fix memory leak of se_io context in nfc_genl_se_io (Fedor Pchelkin)   
  - 9p/xen: fix connection sequence (Juergen Gross)   
  - 9p/xen: fix version parsing (Juergen Gross)   
  - net: fix __dev_kfree_skb_any() vs drop monitor (Eric Dumazet)   
  - netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() (Hangyu Hua)   
  - watchdog: pcwd_usb: Fix attempting to access uninitialized memory (Li Hua)   
  - watchdog: Fix kmemleak in watchdog_cdev_register (Chen Jun)   
  - watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path (ruanjinjie)   
  - x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list (Ammar Faizi)   
  - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed (Zhihao Cheng)   
  - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() (Zhihao Cheng)   
  - ubifs: ubifs_writepage: Mark page dirty after writing inode failed (Zhihao Cheng)   
  - ubifs: dirty_cow_znode: Fix memleak in error handling path (Zhihao Cheng)   
  - ubifs: Re-statistic cleaned znode count if commit failed (Zhihao Cheng)   
  - ubi: Fix possible null-ptr-deref in ubi_free_volume() (Yang Yingliang)   
  - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (Li Zetao)   
  - ubi: Fix use-after-free when volume resizing failed (Li Zetao)   
  - ubifs: Reserve one leb for each journal head while doing budget (Zhihao Cheng)   
  - ubifs: Fix wrong dirty space budget for dirty inode (Zhihao Cheng)   
  - ubifs: Rectify space budget for ubifs_xrename() (Zhihao Cheng)   
  - ubi: ensure that VID header offset + VID header size <= alloc, size (George Kennedy)   
  - pwm: stm32-lp: fix the check on arr and cmp registers update (Fabrice Gasnier)   
  - fs/jfs: fix shift exponent db_agl2size negative (Liu Shixin via Jfs-discussion)   
  - net/sched: Retire tcindex classifier (Jamal Hadi Salim)   
  - kbuild: Port silent mode detection to future gnu make. (Dmitry Goncharov)   
  - drm/radeon: Fix eDP for single-display iMac11,2 (Mark Hawrylak)   
  - PCI: Avoid FLR for AMD FCH AHCI adapters (Damien Le Moal)   
  - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() (Tomas Henzl)   
  - scsi: ses: Fix possible desc_ptr out-of-bounds accesses (Tomas Henzl)   
  - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses (Tomas Henzl)   
  - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() (Tomas Henzl)   
  - scsi: ses: Don't attach if enclosure has no components (James Bottomley)   
  - scsi: qla2xxx: Fix erroneous link down (Quinn Tran)   
  - scsi: qla2xxx: Fix link failure in NPIV environment (Quinn Tran)   
  - ktest.pl: Fix missing "end_monitor" when machine check fails (Steven Rostedt)   
  - mips: fix syscall_get_nr (Elvira Khabirova)   
  - alpha: fix FEN fault handling (Al Viro)   
  - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (Ilya Dryomov)   
  - ARM: dts: exynos: correct TMU phandle in Odroid XU (Krzysztof Kozlowski)   
  - ARM: dts: exynos: correct TMU phandle in Exynos4 (Krzysztof Kozlowski)   
  - dm flakey: don't corrupt the zero page (Mikulas Patocka)   
  - dm flakey: fix logic when corrupting a bio (Mikulas Patocka)   
  - wifi: cfg80211: Fix use after free for wext (Alexander Wetzel)   
  - wifi: rtl8xxxu: Use a longer retry limit of 48 (Bitterblue Smith)   
  - ext4: refuse to create ea block when umounted (Jun Nie)   
  - ext4: optimize ea_inode block expansion (Jun Nie)   
  - ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() (Dmitry Fomin)   
  - irqdomain: Drop bogus fwspec-mapping error handling (Johan Hovold)   
  - irqdomain: Fix disassociation race (Johan Hovold)   
  - irqdomain: Fix association race (Johan Hovold)   
  - ima: Align ima_file_mmap() parameters with mmap_file LSM hook (Roberto Sassu)   
  - Documentation/hw-vuln: Document the interaction between IBRS and STIBP (KP Singh)   
  - x86/microcode/AMD: Fix mixed steppings support (Borislav Petkov (AMD))   
  - x86/microcode/AMD: Add a @cpu parameter to the reloading functions (Borislav Petkov (AMD))   
  - x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter (Borislav Petkov (AMD))   
  - x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range (Yang Jihong)   
  - x86/kprobes: Fix __recover_optprobed_insn check optimizing logic (Yang Jihong)   
  - x86/reboot: Disable SVM, not just VMX, when stopping CPUs (Sean Christopherson)   
  - x86/crash: Disable virt in core NMI crash handler to avoid double shootdown (Sean Christopherson)   
  - x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) (Sean Christopherson)   
  - udf: Fix file corruption when appending just after end of preallocated extent (Jan Kara)   
  - udf: Do not update file length for failed writes to inline files (Jan Kara)   
  - udf: Do not bother merging very long extents (Jan Kara)   
  - udf: Truncate added extents on failed expansion (Jan Kara)   
  - ocfs2: fix non-auto defrag path not working issue (Heming Zhao via Ocfs2-devel)   
  - ocfs2: fix defrag path triggering jbd2 ASSERT (Heming Zhao via Ocfs2-devel)   
  - f2fs: fix information leak in f2fs_move_inline_dirents() (Eric Biggers)   
  - fs: hfsplus: fix UAF issue in hfsplus_put_super (Dongliang Mu)   
  - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create (Liu Shixin)   
  - s390/kprobes: fix current_kprobe never cleared after kprobes reenter (Vasily Gorbik)   
  - s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler (Vasily Gorbik)   
  - rtc: pm8xxx: fix set-alarm race (Johan Hovold)   
  - wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu (Jun ASAKA)   
  - spi: bcm63xx-hsspi: Fix multi-bit mode setting (William Zhang)   
  - dm cache: add cond_resched() to various workqueue loops (Mike Snitzer)   
  - dm thin: add cond_resched() to various workqueue loops (Mike Snitzer)   
  - pinctrl: at91: use devm_kasprintf() to avoid potential leaks (Claudiu Beznea)   
  - regulator: s5m8767: Bounds check id indexing into arrays (Kees Cook)   
  - regulator: max77802: Bounds check regulator id against opmode (Kees Cook)   
  - ASoC: kirkwood: Iterate over array indexes instead of using pointer math (Kees Cook)   
  - docs/scripts/gdb: add necessary make scripts_gdb step (Jakob Koschel)   
  - drm/msm/dsi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang)   
  - drm/radeon: free iio for atombios when driver shutdown (Liwei Song)   
  - ACPI: video: Fix Lenovo Ideapad Z570 DMI match (Hans de Goede)   
  - m68k: Check syscall_trace_enter() return code (Michael Schmitz)   
  - net: bcmgenet: Add a check for oversized packets (Florian Fainelli)   
  - ACPI: Don't build ACPICA with '-Os' (Mark Rutland)   
  - inet: fix fast path in __inet_hash_connect() (Pietro Borrello)   
  - timers: Prevent union confusion from unexpected restart_syscall() (Jann Horn)   
  - thermal: intel: Fix unsigned comparison with less than zero (Yang Li)   
  - rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() (Paul E. McKenney)   
  - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (Jisoo Jang)   
  - ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy (Markuss Broks)   
  - udf: Define EFSCORRUPTED error code (Jan Kara)   
  - rpmsg: glink: Avoid infinite loop on intent for missing channel (Bjorn Andersson)   
  - media: usb: siano: Fix use after free bugs caused by do_submit_urb (Duoming Zhou)   
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() (Duoming Zhou) [Orabug: 35181651] {CVE-2023-1118}
  - media: platform: ti: Add missing check for devm_regulator_get (Jiasheng Jiang)   
  - MIPS: vpe-mt: drop physical_memsize (Randy Dunlap)   
  - powerpc/pseries/lparcfg: add missing RTAS retry status handling (Nathan Lynch)   
  - powerpc/powernv/ioda: Skip unallocated resources when mapping to PE (Frederic Barrat)   
  - Input: ads7846 - don't check penirq immediately for 7845 (Luca Ellero)   
  - Input: ads7846 - don't report pressure for ads7845 (Luca Ellero)   
  - mtd: rawnand: sunxi: Fix the size of the last OOB region (Samuel Holland)   
  - mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() (Qiheng Lin)   
  - dm: remove flush_scheduled_work() during local_exit() (Mike Snitzer)   
  - scsi: aic94xx: Add missing check for dma_map_single() (Jiasheng Jiang)   
  - hwmon: (ltc2945) Handle error case in ltc2945_value_store (Jonathan Cormier)   
  - gpio: vf610: connect GPIO label to dev name (Haibo Chen)   
  - ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() (Kuninori Morimoto)   
  - drm/mediatek: Drop unbalanced obj unref (Rob Clark)   
  - drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness (Daniel Mentz)   
  - ALSA: hda/ca0132: minor fix for allocation size (Alexey V. Vissarionov)   
  - pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups (Miaoqian Lin)   
  - drm/msm/hdmi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang)   
  - gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() (Liang He)   
  - drm/bridge: megachips: Fix error handling in i2c_register_driver() (Yuan Can)   
  - drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC (Geert Uytterhoeven)   
  - irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts (Florian Fainelli)   
  - can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error (Frank Jungclaus)   
  - wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() (Dan Carpenter)   
  - m68k: /proc/hardware should depend on PROC_FS (Randy Dunlap)   
  - crypto: rsa-pkcs1pad - Use akcipher_request_complete (Herbert Xu)   
  - Bluetooth: L2CAP: Fix potential user-after-free (Luiz Augusto von Dentz)   
  - cpufreq: davinci: Fix clk use after free (Uwe Kleine-König)   
  - irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe (Miaoqian Lin)   
  - irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains (Miaoqian Lin)   
  - net/mlx5: Enhance debug print in page allocation failure (Jack Morgenstein)   
  - crypto: seqiv - Handle EBUSY correctly (Herbert Xu)   
  - ACPI: battery: Fix missing NUL-termination with large strings (Armin Wolf)   
  - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() (Minsuk Kang)   
  - wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function (Fedor Pchelkin)   
  - wifi: orinoco: check return value of hermes_write_wordrec() (Alexey Kodanev)   
  - ACPICA: nsrepair: handle cases without a return value correctly (Daniil Tatianin)   
  - lib/mpi: Fix buffer overrun when SG is too long (Herbert Xu)   
  - genirq: Fix the return type of kstat_cpu_irqs_sum() (Zhen Lei)   
  - wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() (Zhengchao Shao)   
  - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (Zhang Changzhong)   
  - wifi: ipw2200: fix memory leak in ipw_wdev_init() (Zhengchao Shao)   
  - wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: libertas: fix memory leak in lbs_init_adapter() (Zhengchao Shao)   
  - arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name (Neil Armstrong)   
  - arm64: dts: amlogic: meson-gx: add missing unit address to rng node name (Neil Armstrong)   
  - arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name (Neil Armstrong)   
  - ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato (Krzysztof Kozlowski)   
  - ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() (Yang Yingliang)   
  - arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address (Martin Blumenstingl)   
  - arm64: dts: meson-gx: Fix Ethernet MAC address unit name (Martin Blumenstingl)   
  - ARM: zynq: Fix refcount leak in zynq_early_slcr_init (Qiheng Lin)   
  - ARM: OMAP2+: Fix memory leak in realtime_counter_init() (Chen Hui)   
  - HID: asus: use spinlock to safely schedule workers (Pietro Borrello) [Orabug: 35181604] {CVE-2023-1079}
  - HID: asus: use spinlock to protect concurrent accesses (Pietro Borrello)   
  - HID: asus: Remove check for same LED brightness on set (Luke D. Jones)   
  - USB: core: Don't hold device lock while reading the "descriptors" sysfs file (Alan Stern)   
  - USB: serial: option: add support for VW/Skoda "Carstick LTE" (Florian Zumbiehl)   
  - dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size (Jiasheng Jiang)   
  - bpf: Fix truncation handling for mod32 dst reg wrt zero (Daniel Borkmann)   
  - bpf: Fix 32 bit src register truncation on div/mod (Daniel Borkmann) [Orabug: 33041998] {CVE-2021-3600}
  - bpf: fix subprog verifier bypass by div/mod by 0 exception (Daniel Borkmann)   
  - bpf: Do not use ax register in interpreter on div/mod (Daniel Borkmann)   
  - net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues(). (Kuniyuki Iwashima)   
  - IB/hfi1: Assign npages earlier (Dean Luick)   
  - btrfs: send: limit number of clones and allocated memory size (David Sterba)   
  - ARM: dts: rockchip: add power-domains property to dp node on rk3288 (Johan Jonker)   
  - LTS version: v4.14.307 (Saeed Mirzamohammadi)   
  - wifi: mwifiex: Add missing compatible string for SD8787 (Lukas Wunner)   
  - uaccess: Add speculation barrier to copy_from_user() (Dave Hansen)   
  - alarmtimer: Prevent starvation by small intervals and SIG_IGN (Thomas Gleixner)   
  - powerpc: dts: t208x: Disable 10G on MAC1 and MAC2 (Sean Anderson)   
  - random: always mix cycle counter in add_latent_entropy() (Jason A. Donenfeld)   
  - powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G (Sean Anderson)   
  - wifi: rtl8xxxu: gen2: Turn on the rate control (Bitterblue Smith)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.527.1.el7uek]
changelog:
  - mips64: Enable CRYPTO_USER_API_SKCIPHER config (Vijay Kumar)  [Orabug: 35458816]  
  - net/rds: Fix copy&paste error (Gerd Rausch)  [Orabug: 35416949]  
  - uek-rpm: Blacklist cls_tcindex module (Somasundaram Krishnasamy)  [Orabug: 35408336]  
  - LTS version: v4.14.316 (Saeed Mirzamohammadi)   
  - 3c589_cs: Fix an error handling path in tc589_probe() (Christophe JAILLET)   
  - forcedeth: Fix an error handling path in nv_probe() (Christophe JAILLET)   
  - x86/show_trace_log_lvl: Ensure stack pointer is aligned, again (Vernon Lovejoy)   
  - xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() (Dan Carpenter)   
  - power: supply: sbs-charger: Fix INHIBITED bit for Status reg (Daisuke Nojiri)   
  - power: supply: bq27xxx: Fix poll_interval handling and races on remove (Hans de Goede)   
  - power: supply: bq27xxx: Fix I2C IRQ race on remove (Hans de Goede)   
  - power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition (Hans de Goede)   
  - power: supply: leds: Fix blink to LED on transition (Hans de Goede)   
  - ipv6: Fix out-of-bounds access in ipv6_find_tlv() (Gavrilov Ilia)   
  - net: fix skb leak in __skb_tstamp_tx() (Pratyush Yadav)   
  - media: radio-shark: Add endpoint checks (Alan Stern)   
  - USB: sisusbvga: Add endpoint checks (Alan Stern)   
  - x86/mm: Avoid incomplete Global INVLPG flushes (Saeed Mirzamohammadi)   
  - USB: core: Add routines for endpoint checks in old drivers (Alan Stern)   
  - selftests/memfd: Fix unknown type name build failure (Hardik Garg)   
  - netfilter: nf_tables: fix register ordering (Florian Westphal)   
  - netfilter: nf_tables: do not allow SET_ID to refer to another table (Pablo Neira Ayuso)   
  - netfilter: nf_tables: do not allow RULE_ID to refer to another chain (Pablo Neira Ayuso)   
  - netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL (Pablo Neira Ayuso)   
  - netfilter: nf_tables: stricter validation of element data (Pablo Neira Ayuso) [Orabug: 34362007] {CVE-2022-34918}
  - netfilter: nf_tables: allow up to 64 bytes in the set element data area (Pablo Neira Ayuso)   
  - netfilter: nf_tables: add nft_setelem_parse_key() (Pablo Neira Ayuso)   
  - netfilter: nf_tables: validate registers coming from userspace. (Pablo Neira Ayuso)   
  - netfilter: nftables: statify nft_parse_register() (Pablo Neira Ayuso)   
  - netfilter: nftables: add nft_parse_register_store() and use it (Pablo Neira Ayuso)   
  - netfilter: nftables: add nft_parse_register_load() and use it (Pablo Neira Ayuso)   
  - parisc: Allow to reboot machine after system halt (Helge Deller)   
  - m68k: Move signal frame following exception on 68020/030 (Finn Thain)   
  - spi: fsl-cpm: Use 16 bit mode for large transfers with even size (Christophe Leroy)   
  - spi: fsl-spi: Re-organise transfer bits_per_word adaptation (Christophe Leroy)   
  - spi: spi-fsl-spi: automatically adapt bits-per-word in cpu mode (Rasmus Villemoes)   
  - netfilter: nf_tables: bogus EBUSY in helper removal from transaction (Pablo Neira Ayuso)   
  - nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() (Ryusuke Konishi)   
  - ceph: force updating the msg pointer in non-split case (Xiubo Li)   
  - serial: Add support for Advantech PCI-1611U card (Vitaliy Tomin)   
  - statfs: enforce statfs[64] structure initialization (Ilya Leoshkevich)   
  - ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table (Nikhil Mahale)   
  - ALSA: hda: Fix Oops by 9.1 surround channel names (Takashi Iwai)   
  - usb-storage: fix deadlock when a scsi command timeouts more than once (Maxime Bizon)   
  - vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() (Eric Dumazet)   
  - igb: fix bit_shift to be in [1..8] range (Aleksandr Loktionov)   
  - cassini: Fix a memory leak in the error handling path of cas_init_one() (Christophe JAILLET)   
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Dong Chenchen)   
  - media: netup_unidvb: fix use-after-free at del_timer() (Duoming Zhou)   
  - vsock: avoid to close connected socket after the timeout (Zhuang Shengen)   
  - net: fec: Better handle pm_runtime_get() failing in .remove() (Uwe Kleine-König)   
  - af_key: Reject optional tunnel/BEET mode templates in outbound policies (Tobias Brunner)   
  - cpupower: Make TSC read per CPU for Mperf monitor (Wyes Karny)   
  - mfd: dln2: Fix memory leak in dln2_probe() (Qiang Ning)   
  - phy: st: miphy28lp: use _poll_timeout functions for waits (Alain Volmat)   
  - Input: xpad - add constants for GIP interface numbers (Vicki Pfau)   
  - clk: tegra20: fix gcc-7 constant overflow warning (Arnd Bergmann)   
  - recordmcount: Fix memory leaks in the uwrite function (Hao Zeng)   
  - sched: Fix KCSAN noinstr violation (Josh Poimboeuf)   
  - mcb-pci: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - serial: 8250: Reinit port->pm on port specific driver unbind (Tony Lindgren)   
  - HID: wacom: generic: Set battery quirk only when we see battery data (Jason Gerecke)   
  - spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 (Kevin Groeneveld)   
  - HID: logitech-hidpp: Reconcile USB and Unifying serials (Bastien Nocera)   
  - HID: logitech-hidpp: Don't use the USB serial for USB devices (Bastien Nocera)   
  - staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE (Philipp Hortmann)   
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (Min Li)   
  - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (Hans de Goede)   
  - ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() (Ojaswin Mujoo)   
  - ext4: set goal start correctly in ext4_mb_normalize_request (Kemeng Shi)   
  - gfs2: Fix inode height consistency check (Andreas Gruenbacher)   
  - scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition (Zheng Wang)   
  - lib: cpu_rmap: Avoid use after free on rmap->obj array entries (Eli Cohen)   
  - net: Catch invalid index in XPS mapping (Nick Child)   
  - net: pasemi: Fix return type of pasemi_mac_start_tx() (Nathan Chancellor)   
  - ext2: Check block size validity during mount (Jan Kara)   
  - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex (Hector Martin)   
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects (void0red)   
  - ACPICA: Avoid undefined behavior: applying zero offset to null pointer (Tamir Duberstein)   
  - drm/tegra: Avoid potential 32-bit integer overflow (Nur Hussein)   
  - ACPI: EC: Fix oops when removing custom query handlers (Armin Wolf)   
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang)   
  - regmap: cache: Return error in cache sync operations for REGCACHE_NONE (Alexander Stein)   
  - fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() (Tetsuo Handa)   
  - af_unix: Fix a data race of sk->sk_receive_queue->qlen. (Kuniyuki Iwashima)   
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (t.feng)   
  - net: annotate sk->sk_err write from do_recvmmsg() (Eric Dumazet)   
  - netlink: annotate accesses to nlk->cb_running (Eric Dumazet)   
  - net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). (Kuniyuki Iwashima)   
  - LTS version: v4.14.315 (Saeed Mirzamohammadi)   
  - mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock (Tetsuo Handa)   
  - printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h (Tetsuo Handa)   
  - drbd: correctly submit flush bio on barrier (Christoph Böhmwalder)   
  - serial: 8250: Fix serial8250_tx_empty() race with DMA Tx (Ilpo Järvinen)   
  - tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH (Ilpo Järvinen)   
  - perf bench: Share some global variables to fix build with gcc 10 (Arnaldo Carvalho de Melo)   
  - ext4: fix invalid free tracking in ext4_xattr_move_to_block() (Theodore Ts'o)   
  - ext4: remove a BUG_ON in ext4_mb_release_group_pa() (Theodore Ts'o)   
  - ext4: bail out of ext4_xattr_ibody_get() fails for any reason (Theodore Ts'o)   
  - ext4: add bounds checking in get_max_inline_xattr_value_size() (Theodore Ts'o)   
  - ext4: improve error recovery code paths in __ext4_remount() (Theodore Ts'o)   
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus)   
  - HID: wacom: Set a default resolution for older tablets (Ping Cheng)   
  - ARM: dts: s5pv210: correct MIPI CSIS clock name (Krzysztof Kozlowski)   
  - ARM: dts: exynos: fix WM8960 clock name in Itop Elite (Krzysztof Kozlowski)   
  - sh: nmi_debug: fix return value of __setup handler (Randy Dunlap)   
  - sh: math-emu: fix macro redefined warning (Randy Dunlap)   
  - cifs: fix pcchunk length type in smb2_copychunk_range (Pawel Witek)   
  - btrfs: print-tree: parent bytenr must be aligned to sector size (Anastasia Belova)   
  - btrfs: fix btrfs_prev_leaf() to not return the same key twice (Filipe Manana)   
  - perf symbols: Fix return incorrect build_id size in elf_read_build_id() (Yang Jihong)   
  - perf map: Delete two variable initialisations before null pointer checks in sort__sym_from_cmp() (Markus Elfring)   
  - perf vendor events power9: Remove UTF-8 characters from JSON files (Kajol Jain)   
  - ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init` (Ruliang Lin)   
  - af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). (Kuniyuki Iwashima)   
  - net/sched: act_mirred: Add carrier check (Victor Nogueira)   
  - writeback: fix call of incorrect macro (Maxim Korotkov)   
  - sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() (Cong Wang)   
  - netfilter: nf_tables: deactivate anonymous set from preparation phase (Pablo Neira Ayuso)   
  - netfilter: nf_tables: bogus EBUSY when deleting set after flush (Pablo Neira Ayuso)   
  - netfilter: nf_tables: use-after-free in failing rule with bound set (Pablo Neira Ayuso)   
  - netfilter: nft_hash: fix nft_hash_deactivate (Pablo Neira Ayuso)   
  - netfilter: nf_tables: unbind set in rule from commit path (Pablo Neira Ayuso)   
  - netfilter: nf_tables: split set destruction in deactivate and destroy phase (Florian Westphal)   
  - perf auxtrace: Fix address filter entire kernel size (Adrian Hunter)   
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern (Mike Snitzer)   
  - dm flakey: fix a crash with invalid table line (Mikulas Patocka)   
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (Mike Snitzer)   
  - s390/dasd: fix hanging blockdevice after request requeue (Stefan Haberland)   
  - btrfs: scrub: reject unsupported scrub flags (Qu Wenruo)   
  - clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent (Quentin Schulz)   
  - wifi: rtl8xxxu: RTL8192EU always needs full init (Bitterblue Smith)   
  - nilfs2: fix infinite loop in nilfs_mdt_get_block() (Ryusuke Konishi)   
  - nilfs2: do not write dirty data after degenerating to read-only (Ryusuke Konishi)   
  - parisc: Fix argument pointer in real64_call_asm() (Helge Deller)   
  - dmaengine: at_xdmac: do not enable all cyclic channels (Claudiu Beznea)   
  - phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port (Gaosheng Cui)   
  - NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease (Trond Myklebust)   
  - IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order (Patrick Kelsey)   
  - clk: add missing of_node_put() in "assigned-clocks" property parsing (Clément Léger)   
  - power: supply: generic-adc-battery: fix unit scaling (Sebastian Reichel)   
  - RDMA/rdmavt: Delete unnecessary NULL check (Natalia Petrova)   
  - perf/core: Fix hardlockup failure caused by perf throttle (Yang Jihong)   
  - powerpc/rtas: use memmove for potentially overlapping buffer copy (Nathan Lynch)   
  - macintosh: via-pmu-led: requires ATA to be set (Randy Dunlap)   
  - powerpc/sysdev/tsi108: fix resource printk format warnings (Randy Dunlap)   
  - powerpc/wii: fix resource printk format warnings (Randy Dunlap)   
  - powerpc/mpc512x: fix resource printk format warning (Randy Dunlap)   
  - macintosh/windfarm_smu_sat: Add missing of_node_put() (Liang He)   
  - spmi: Add a check for remove callback when removing a SPMI driver (Jishnu Prakash)   
  - staging: rtl8192e: Fix W_DISABLE# does not work after stop/start (Philipp Hortmann)   
  - serial: 8250: Add missing wakeup event reporting (Florian Fainelli)   
  - tty: serial: fsl_lpuart: adjust buffer length to the intended size (Shenwei Wang)   
  - usb: chipidea: fix missing goto in `ci_hdrc_probe` (Yinhao Hu)   
  - sh: sq: Fix incorrect element size for allocating bitmap buffer (John Paul Adrian Glaubitz)   
  - uapi/linux/const.h: prefer ISO-friendly __typeof__ (Saeed Mirzamohammadi)   
  - ia64: mm/contig: fix section mismatch warning/error (Randy Dunlap)   
  - of: Fix modalias string generation (Miquel Raynal)   
  - spi: fsl-spi: Fix CPM/QE mode Litte Endian (Christophe Leroy)   
  - linux/vt_buffer.h: allow either builtin or modular for macros (Randy Dunlap)   
  - pstore: Revert pmsg_lock back to a normal mutex (John Stultz)   
  - tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (Kuniyuki Iwashima)   
  - net: amd: Fix link leak when verifying config failed (Gencen Gan)   
  - ipv4: Fix potential uninit variable access bug in __ip_make_skb() (Ziyang Xuan)   
  - ixgbe: Enable setting RSS table to default values (Joe Damato)   
  - ixgbe: Allow flow hash to be set via ethtool (Joe Damato)   
  - wifi: iwlwifi: mvm: check firmware response size (Johannes Berg)   
  - wifi: iwlwifi: make the loop for card preparation effective (Emmanuel Grumbach)   
  - md/raid10: fix leak of 'r10bio->remaining' for recovery (Yu Kuai)   
  - scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS (Danila Chernetsov)   
  - scsi: target: iscsit: Fix TAS handling during conn cleanup (Mike Christie)   
  - net/packet: convert po->auxdata to an atomic flag (Eric Dumazet)   
  - net/packet: convert po->origdev to an atomic flag (Eric Dumazet)   
  - vlan: partially enable SIOCSHWTSTAMP in container (Vadim Fedorenko)   
  - scm: fix MSG_CTRUNC setting condition for SO_PASSSEC (Alexander Mikhalitsyn)   
  - wifi: ath6kl: reduce WARN to dev_dbg() in callback (Fedor Pchelkin)   
  - wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() (Dan Carpenter)   
  - wifi: ath6kl: minor fix for allocation size (Alexey V. Vissarionov)   
  - arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step (Sumit Garg)   
  - x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() (Saurabh Sengar)   
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (Zheng Wang)   
  - x86/apic: Fix atomic update of offset in reserve_eilvt_offset() (Uros Bizjak)   
  - media: av7110: prevent underflow in write_ts_to_decoder() (Dan Carpenter)   
  - media: bdisp: Add missing check for create_workqueue (Jiasheng Jiang)   
  - drm/probe-helper: Cancel previous job before starting new one (Dom Cobley)   
  - drm/vgem: add missing mutex_destroy (Maíra Canal)   
  - drm/rockchip: Drop unbalanced obj unref (Rob Clark)   
  - selinux: ensure av_permissions.h is built when needed (Paul Moore)   
  - selinux: fix Makefile dependencies of flask.h (Ondrej Mosnacek)   
  - ubifs: Free memory for tmpfile name (Mårten Lindahl)   
  - ubi: Fix return value overwrite issue in try_write_vid_and_data() (Wang YanQing)   
  - i2c: omap: Fix standard mode false ACK readings (Reid Tonking)   
  - reiserfs: Add security prefix to xattr name in reiserfs_security_write() (Roberto Sassu)   
  - ring-buffer: Sync IRQ works before buffer destruction (Johannes Berg)   
  - MIPS: fw: Allow firmware to pass a empty env (Jiaxun Yang)   
  - staging: iio: resolver: ads1210: fix config mode (Nuno Sá)   
  - perf sched: Cast PTHREAD_STACK_MIN to int as it may turn into sysconf(__SC_THREAD_STACK_MIN_VALUE) (Arnaldo Carvalho de Melo)   
  - USB: dwc3: fix runtime pm imbalance on unbind (Johan Hovold)   
  - iio: adc: palmas_gpadc: fix NULL dereference on rmmod (Patrik Dahlström)   
  - USB: serial: option: add UNISOC vendor and TOZED LT70C product (Arınç ÜNAL)   
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ruihan Li)   
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (Jisoo Jang)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.528.1.el7uek]
changelog:
  - LTS version: v4.14.320 (Saeed Mirzamohammadi)   
  - i2c: imx-lpi2c: fix type char overflow issue when calculating the clock cycle (Clark Wang)   
  - x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys (Dheeraj Kumar Srivastava)   
  - drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl (Min Li)   
  - drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl (Min Li)   
  - drm/exynos: vidi: fix a wrong error return (Inki Dae)   
  - s390/cio: unregister device when the only path is gone (Vineeth Vijayan)   
  - usb: gadget: udc: fix NULL dereference in remove() (Dan Carpenter)   
  - fbdev: imsttfb: Release framebuffer and dealloc cmap on error path (Helge Deller)   
  - nfcsim.c: Fix error checking for debugfs_create_dir (Osama Muhammad)   
  - arm64: Add missing Set/Way CMO encodings (Marc Zyngier)   
  - HID: wacom: Add error check to wacom_parse_and_register() (Denis Arefev)   
  - scsi: target: iscsi: Prevent login threads from racing between each other (Maurizio Lombardi)   
  - netfilter: nf_tables: disallow element updates of bound anonymous sets (Pablo Neira Ayuso)   
  - be2net: Extend xmit workaround to BE3 chip (Ross Lagerwall)   
  - mmc: usdhi60rol0: fix deferred probing (Sergey Shtylyov)   
  - mmc: omap_hsmmc: fix deferred probing (Sergey Shtylyov)   
  - mmc: omap: fix deferred probing (Sergey Shtylyov)   
  - mmc: mtk-sd: fix deferred probing (Sergey Shtylyov)   
  - net: qca_spi: Avoid high load if QCA7000 is not available (Stefan Wahren)   
  - xfrm: Linearize the skb after offloading if needed. (Sebastian Andrzej Siewior)   
  - nilfs2: prevent general protection fault in nilfs_clear_dirty_page() (Ryusuke Konishi)   
  - cgroup: Do not corrupt task iteration when rebinding subsystem (Xiu Jianfeng)   
  - Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs (Michael Kelley)   
  - nilfs2: fix buffer corruption due to concurrent device reads (Ryusuke Konishi)   
  - nilfs2: reject devices with insufficient block count (Ryusuke Konishi)   
  - serial: lantiq: add missing interrupt ack (Bernhard Seibold)   
  - LTS version: v4.14.319 (Saeed Mirzamohammadi)   
  - mmc: block: ensure error propagation for non-blk (Christian Loehle)   
  - powerpc: Fix defconfig choice logic when cross compiling (Michael Ellerman)   
  - neighbour: delete neigh_lookup_nodev as not used (Leon Romanovsky)   
  - neighbour: Remove unused inline function neigh_key_eq16() (Gaosheng Cui)   
  - selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET (Alex Maftei)   
  - net: tipc: resize nlattr array to correct size (Lin Ma)   
  - net: lapbether: only support ethernet devices (Eric Dumazet)   
  - drm/nouveau/dp: check for NULL nv_connector->native_mode (Natalia Petrova)   
  - igb: fix nvm.ops.read() error handling (Aleksandr Loktionov)   
  - sctp: fix an error code in sctp_sf_eat_auth() (Dan Carpenter)   
  - IB/isert: Fix incorrect release of isert connection (Saravanan Vajravel)   
  - IB/isert: Fix possible list corruption in CMA handler (Saravanan Vajravel)   
  - IB/isert: Fix dead lock in ib_isert (Saravanan Vajravel)   
  - ping6: Fix send to link-local addresses with VRF. (Guillaume Nault)   
  - netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM (Pablo Neira Ayuso)   
  - USB: serial: option: add Quectel EM061KGL series (Jerry Meng)   
  - Remove DECnet support from kernel (Stephen Hemminger)   
  - net: usb: qmi_wwan: add support for Compal RXM-G1 (Wes Huang)   
  - nilfs2: fix possible out-of-bounds segment allocation in resize ioctl (Ryusuke Konishi)   
  - nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() (Ryusuke Konishi)   
  - nios2: dts: Fix tse_mac "max-frame-size" property (Janne Grunau)   
  - ocfs2: check new file size on fallocate call (Luís Henriques)   
  - ocfs2: fix use-after-free when unmounting read-only filesystem (Luís Henriques)   
  - xen/blkfront: Only check REQ_FUA for writes (Ross Lagerwall)   
  - mips: Move initrd_start check after initrd address sanitisation. (Liviu Dudau)   
  - MIPS: Alchemy: fix dbdma2 (Manuel Lauss)   
  - power: supply: Fix logic checking if system is running from battery (Mario Limonciello)   
  - regulator: Fix error checking for debugfs_create_dir (Osama Muhammad)   
  - power: supply: Ratelimit no data debug output (Marek Vasut)   
  - ARM: dts: vexpress: add missing cache properties (Krzysztof Kozlowski)   
  - power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule() (Hans de Goede)   
  - power: supply: ab8500: Fix external_power_changed race (Hans de Goede)   
  - LTS version: v4.14.318 (Saeed Mirzamohammadi)   
  - btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (Zixuan Fu)   
  - btrfs: check return value of btrfs_commit_transaction in relocation (Josef Bacik)   
  - ext4: only check dquot_initialize_needed() when debugging (Theodore Ts'o)   
  - i2c: sprd: Delete i2c adapter in .remove's error path (Uwe Kleine-König)   
  - Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk (Luiz Augusto von Dentz)   
  - ceph: fix use-after-free bug for inodes when flushing capsnaps (Xiubo Li)   
  - drm/amdgpu: fix xclk freq on CHIP_STONEY (Chia-I Wu)   
  - Input: psmouse - fix OOB access in Elantech protocol (Dmitry Torokhov)   
  - Input: xpad - delete a Razer DeathAdder mouse VID/PID entry (Ismael Ferreras Morezuelas)   
  - batman-adv: Broken sync while rescheduling delayed work (Vladislav Efanov)   
  - bnxt_en: Query default VLAN before VNIC setup on a VF (Somnath Kotur)   
  - net: sched: move rtm_tca_policy declaration to include file (Eric Dumazet)   
  - rfs: annotate lockless accesses to RFS sock flow table (Eric Dumazet)   
  - rfs: annotate lockless accesses to sk->sk_rxhash (Eric Dumazet)   
  - Bluetooth: L2CAP: Add missing checks for invalid DCID (Sungwoo Kim)   
  - Bluetooth: Fix l2cap_disconnect_req deadlock (Ying Hsu)   
  - spi: qup: Request DMA before enabling clocks (Stephan Gerhold)   
  - i40e: fix build warnings in i40e_alloc.h (Greg Kroah-Hartman)   
  - i40iw: fix build warning in i40iw_manage_apbvt() (Greg Kroah-Hartman)   
  - LTS version: v4.14.317 (Saeed Mirzamohammadi)   
  - wifi: rtlwifi: 8192de: correct checking of IQK reload (Ping-Ke Shih)   
  - Fix double fget() in vhost_net_set_backend() (Al Viro)   
  - net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize (Tudor Ambarus)   
  - cdc_ncm: Fix the build warning (Alexander Bersenev)   
  - cdc_ncm: Implement the 32-bit version of NCM Transfer Block (Alexander Bersenev)   
  - scsi: dpt_i2o: Do not process completions with invalid addresses (Ben Hutchings)   
  - scsi: dpt_i2o: Remove broken pass-through ioctl (I2OUSERCMD) (Ben Hutchings)   
  - fbcon: Fix null-ptr-deref in soft_cursor (Helge Deller)   
  - ext4: add lockdep annotations for i_data_sem for ea_inode's (Theodore Ts'o)   
  - tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK (Sherry Sun)   
  - mmc: vub300: fix invalid response handling (Deren Wu)   
  - regulator: da905{2,5}: Remove unnecessary array check (Nathan Chancellor)   
  - wifi: rtlwifi: remove always-true condition pointed out by GCC 12 (Jakub Kicinski)   
  - lib/dynamic_debug.c: use address-of operator on section symbols (Nathan Chancellor)   
  - kernel/extable.c: use address-of operator on section symbols (Nathan Chancellor)   
  - eth: sun: cassini: remove dead code (Martin Liška)   
  - gcc-12: disable '-Wdangling-pointer' warning for now (Linus Torvalds)   
  - ACPI: thermal: drop an always true check (Adam Borowski)   
  - x86/boot: Wrap literal addresses in absolute_pointer() (Kees Cook)   
  - ata: libata-scsi: Use correct device no in ata_find_dev() (Damien Le Moal)   
  - scsi: stex: Fix gcc 13 warnings (Bart Van Assche)   
  - usb: gadget: f_fs: Add unbind event before functionfs_unbind (Uttkarsh Aggarwal)   
  - net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818 (Sebastian Krzyszkowiak)   
  - iio: dac: mcp4725: Fix i2c_master_send() return value handling (Marek Vasut)   
  - HID: wacom: avoid integer overflow in wacom_intuos_inout() (Nikita Zhandarovich)   
  - iio: adc: mxs-lradc: fix the order of two cleanup operations (Jiakai Luo)   
  - mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() (Dan Carpenter)   
  - atm: hide unused procfs functions (Arnd Bergmann)   
  - ALSA: oss: avoid missing-prototype warnings (Arnd Bergmann)   
  - netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT (Tom Rix)   
  - wifi: b43: fix incorrect __packed annotation (Arnd Bergmann)   
  - scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed (Wenchao Hao)   
  - wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value (Yun Lu)   
  - media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 (Hyunwoo Kim)   
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (Takashi Iwai)   
  - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() (Hyunwoo Kim)   
  - media: netup_unidvb: fix irq init by register it at the end of probe (Wei Chen)   
  - media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address (Wei Chen)   
  - media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer() (Wei Chen)   
  - media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer (Zhang Shurong)   
  - media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer() (Wei Chen)   
  - media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer() (Wei Chen)   
  - media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() (Wei Chen)   
  - ASoC: ssm2602: Add workaround for playback distortions (Paweł Anikiel)   
  - ASoC: dwc: limit the number of overrun messages (Maxim Kochetkov)   
  - nbd: Fix debugfs_create_dir error checking (Ivan Orlov)   
  - fbdev: stifb: Fix info entry in sti_struct on error path (Helge Deller)   
  - fbdev: modedb: Add 1920x1080 at 60 Hz video mode (Helge Deller)   
  - ARM: 9295/1: unwind:fix unwind abort for uleb128 case (Haibo Li)   
  - mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() (Lee Jones)   
  - net: dsa: mv88e6xxx: Increase wait after reset deactivation (Andreas Svensson)   
  - udp6: Fix race condition in udp6_sendmsg & connect (Vladislav Efanov)   
  - tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set (Cambda Zhu)   
  - af_packet: do not use READ_ONCE() in packet_bind() (Eric Dumazet)   
  - af_packet: Fix data-races of pkt_sk(sk)->num. (Kuniyuki Iwashima)   
  - netrom: fix info-leak in nr_write_internal() (Eric Dumazet)   
  - dmaengine: pl330: rename _start to prevent build error (Randy Dunlap)   
  - bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() (Ruihan Li)   
  - ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg (Cezary Rojewski)   
  - power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize (Hans de Goede)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.528.2.1.el7uek]
changelog:
  - uek-rpm: Disable cls_tcindex in file tcindex-disable.conf (Sherry Yang)  [Orabug: 35698204]  
  - x86/microcode/AMD: Clean up per-family patch size checks (Borislav Petkov)  [Orabug: 35698200]  
  - Revert "sched/fair: sanitize vruntime of entity being placed" (Saeed Mirzamohammadi)  [Orabug: 35698196]  
  - Revert "sched/fair: Sanitize vruntime of entity being migrated" (Saeed Mirzamohammadi)  [Orabug: 35698196]  
  - uek-rpm: Update kernel's linux-firmware dependency. (Somasundaram Krishnasamy)  [Orabug: 35698191]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.528.2.2.el7uek]
changelog:
  - xfs: reserve less log space when recovering log intent items (Darrick J. Wong)  [Orabug: 35905454]  
  - xfs: reserve blocks for refcount / rmap log item recovery (Darrick J. Wong)  [Orabug: 35905454]  
  - ocfs2: ocfs2 crash due to invalid h_next_leaf_blk value in extent block (Gautham Ananthakrishna)  [Orabug: 35905446]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.528.2.3.el7uek]
changelog:
  - bnxt_en: fix NULL dereference in bnxt_flash_package_from_file() (Samasth Norway Ananda)  [Orabug: 36201748]


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.528.2.4.el7uek]
changelog:
  - scsi: megaraid_sas: Correct value passed to scsi_device_lookup() (Guixin Liu)  [Orabug: 36345482]  
  - scsi: megaraid_sas: Update max supported LD IDs to 240 (Chandrakanth Patil)  [Orabug: 36345456]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.527.1.el7uek]
changelog:
  - mips64: Enable CRYPTO_USER_API_SKCIPHER config (Vijay Kumar)  [Orabug: 35458816]  
  - net/rds: Fix copy&paste error (Gerd Rausch)  [Orabug: 35416949]  
  - uek-rpm: Blacklist cls_tcindex module (Somasundaram Krishnasamy)  [Orabug: 35408336]  
  - LTS version: v4.14.316 (Saeed Mirzamohammadi)   
  - 3c589_cs: Fix an error handling path in tc589_probe() (Christophe JAILLET)   
  - forcedeth: Fix an error handling path in nv_probe() (Christophe JAILLET)   
  - x86/show_trace_log_lvl: Ensure stack pointer is aligned, again (Vernon Lovejoy)   
  - xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() (Dan Carpenter)   
  - power: supply: sbs-charger: Fix INHIBITED bit for Status reg (Daisuke Nojiri)   
  - power: supply: bq27xxx: Fix poll_interval handling and races on remove (Hans de Goede)   
  - power: supply: bq27xxx: Fix I2C IRQ race on remove (Hans de Goede)   
  - power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition (Hans de Goede)   
  - power: supply: leds: Fix blink to LED on transition (Hans de Goede)   
  - ipv6: Fix out-of-bounds access in ipv6_find_tlv() (Gavrilov Ilia)   
  - net: fix skb leak in __skb_tstamp_tx() (Pratyush Yadav)   
  - media: radio-shark: Add endpoint checks (Alan Stern)   
  - USB: sisusbvga: Add endpoint checks (Alan Stern)   
  - x86/mm: Avoid incomplete Global INVLPG flushes (Saeed Mirzamohammadi)   
  - USB: core: Add routines for endpoint checks in old drivers (Alan Stern)   
  - selftests/memfd: Fix unknown type name build failure (Hardik Garg)   
  - netfilter: nf_tables: fix register ordering (Florian Westphal)   
  - netfilter: nf_tables: do not allow SET_ID to refer to another table (Pablo Neira Ayuso)   
  - netfilter: nf_tables: do not allow RULE_ID to refer to another chain (Pablo Neira Ayuso)   
  - netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL (Pablo Neira Ayuso)   
  - netfilter: nf_tables: stricter validation of element data (Pablo Neira Ayuso) [Orabug: 34362007] {CVE-2022-34918}
  - netfilter: nf_tables: allow up to 64 bytes in the set element data area (Pablo Neira Ayuso)   
  - netfilter: nf_tables: add nft_setelem_parse_key() (Pablo Neira Ayuso)   
  - netfilter: nf_tables: validate registers coming from userspace. (Pablo Neira Ayuso) [Orabug: 34012908] {CVE-2022-1015}
  - netfilter: nftables: statify nft_parse_register() (Pablo Neira Ayuso)   
  - netfilter: nftables: add nft_parse_register_store() and use it (Pablo Neira Ayuso)   
  - netfilter: nftables: add nft_parse_register_load() and use it (Pablo Neira Ayuso)   
  - parisc: Allow to reboot machine after system halt (Helge Deller)   
  - m68k: Move signal frame following exception on 68020/030 (Finn Thain)   
  - spi: fsl-cpm: Use 16 bit mode for large transfers with even size (Christophe Leroy)   
  - spi: fsl-spi: Re-organise transfer bits_per_word adaptation (Christophe Leroy)   
  - spi: spi-fsl-spi: automatically adapt bits-per-word in cpu mode (Rasmus Villemoes)   
  - netfilter: nf_tables: bogus EBUSY in helper removal from transaction (Pablo Neira Ayuso)   
  - nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() (Ryusuke Konishi)   
  - ceph: force updating the msg pointer in non-split case (Xiubo Li)   
  - serial: Add support for Advantech PCI-1611U card (Vitaliy Tomin)   
  - statfs: enforce statfs[64] structure initialization (Ilya Leoshkevich)   
  - ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table (Nikhil Mahale)   
  - ALSA: hda: Fix Oops by 9.1 surround channel names (Takashi Iwai)   
  - usb-storage: fix deadlock when a scsi command timeouts more than once (Maxime Bizon)   
  - vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() (Eric Dumazet)   
  - igb: fix bit_shift to be in [1..8] range (Aleksandr Loktionov)   
  - cassini: Fix a memory leak in the error handling path of cas_init_one() (Christophe JAILLET)   
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Dong Chenchen)   
  - media: netup_unidvb: fix use-after-free at del_timer() (Duoming Zhou)   
  - vsock: avoid to close connected socket after the timeout (Zhuang Shengen)   
  - net: fec: Better handle pm_runtime_get() failing in .remove() (Uwe Kleine-König)   
  - af_key: Reject optional tunnel/BEET mode templates in outbound policies (Tobias Brunner)   
  - cpupower: Make TSC read per CPU for Mperf monitor (Wyes Karny)   
  - mfd: dln2: Fix memory leak in dln2_probe() (Qiang Ning)   
  - phy: st: miphy28lp: use _poll_timeout functions for waits (Alain Volmat)   
  - Input: xpad - add constants for GIP interface numbers (Vicki Pfau)   
  - clk: tegra20: fix gcc-7 constant overflow warning (Arnd Bergmann)   
  - recordmcount: Fix memory leaks in the uwrite function (Hao Zeng)   
  - sched: Fix KCSAN noinstr violation (Josh Poimboeuf)   
  - mcb-pci: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - serial: 8250: Reinit port->pm on port specific driver unbind (Tony Lindgren)   
  - HID: wacom: generic: Set battery quirk only when we see battery data (Jason Gerecke)   
  - spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 (Kevin Groeneveld)   
  - HID: logitech-hidpp: Reconcile USB and Unifying serials (Bastien Nocera)   
  - HID: logitech-hidpp: Don't use the USB serial for USB devices (Bastien Nocera)   
  - staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE (Philipp Hortmann)   
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (Min Li)   
  - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (Hans de Goede)   
  - ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() (Ojaswin Mujoo)   
  - ext4: set goal start correctly in ext4_mb_normalize_request (Kemeng Shi)   
  - gfs2: Fix inode height consistency check (Andreas Gruenbacher)   
  - scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition (Zheng Wang)   
  - lib: cpu_rmap: Avoid use after free on rmap->obj array entries (Eli Cohen)   
  - net: Catch invalid index in XPS mapping (Nick Child)   
  - net: pasemi: Fix return type of pasemi_mac_start_tx() (Nathan Chancellor)   
  - ext2: Check block size validity during mount (Jan Kara)   
  - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex (Hector Martin)   
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects (void0red)   
  - ACPICA: Avoid undefined behavior: applying zero offset to null pointer (Tamir Duberstein)   
  - drm/tegra: Avoid potential 32-bit integer overflow (Nur Hussein)   
  - ACPI: EC: Fix oops when removing custom query handlers (Armin Wolf)   
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang)   
  - regmap: cache: Return error in cache sync operations for REGCACHE_NONE (Alexander Stein)   
  - fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() (Tetsuo Handa)   
  - af_unix: Fix a data race of sk->sk_receive_queue->qlen. (Kuniyuki Iwashima)   
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (t.feng)   
  - net: annotate sk->sk_err write from do_recvmmsg() (Eric Dumazet)   
  - netlink: annotate accesses to nlk->cb_running (Eric Dumazet)   
  - net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). (Kuniyuki Iwashima)   
  - LTS version: v4.14.315 (Saeed Mirzamohammadi)   
  - mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock (Tetsuo Handa)   
  - printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h (Tetsuo Handa)   
  - drbd: correctly submit flush bio on barrier (Christoph Böhmwalder)   
  - serial: 8250: Fix serial8250_tx_empty() race with DMA Tx (Ilpo Järvinen)   
  - tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH (Ilpo Järvinen)   
  - perf bench: Share some global variables to fix build with gcc 10 (Arnaldo Carvalho de Melo)   
  - ext4: fix invalid free tracking in ext4_xattr_move_to_block() (Theodore Ts'o)   
  - ext4: remove a BUG_ON in ext4_mb_release_group_pa() (Theodore Ts'o)   
  - ext4: bail out of ext4_xattr_ibody_get() fails for any reason (Theodore Ts'o)   
  - ext4: add bounds checking in get_max_inline_xattr_value_size() (Theodore Ts'o)   
  - ext4: improve error recovery code paths in __ext4_remount() (Theodore Ts'o)   
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus)   
  - HID: wacom: Set a default resolution for older tablets (Ping Cheng)   
  - ARM: dts: s5pv210: correct MIPI CSIS clock name (Krzysztof Kozlowski)   
  - ARM: dts: exynos: fix WM8960 clock name in Itop Elite (Krzysztof Kozlowski)   
  - sh: nmi_debug: fix return value of __setup handler (Randy Dunlap)   
  - sh: math-emu: fix macro redefined warning (Randy Dunlap)   
  - cifs: fix pcchunk length type in smb2_copychunk_range (Pawel Witek)   
  - btrfs: print-tree: parent bytenr must be aligned to sector size (Anastasia Belova)   
  - btrfs: fix btrfs_prev_leaf() to not return the same key twice (Filipe Manana)   
  - perf symbols: Fix return incorrect build_id size in elf_read_build_id() (Yang Jihong)   
  - perf map: Delete two variable initialisations before null pointer checks in sort__sym_from_cmp() (Markus Elfring)   
  - perf vendor events power9: Remove UTF-8 characters from JSON files (Kajol Jain)   
  - ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init` (Ruliang Lin)   
  - af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). (Kuniyuki Iwashima)   
  - net/sched: act_mirred: Add carrier check (Victor Nogueira)   
  - writeback: fix call of incorrect macro (Maxim Korotkov)   
  - sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() (Cong Wang)   
  - netfilter: nf_tables: deactivate anonymous set from preparation phase (Pablo Neira Ayuso)   
  - netfilter: nf_tables: bogus EBUSY when deleting set after flush (Pablo Neira Ayuso)   
  - netfilter: nf_tables: use-after-free in failing rule with bound set (Pablo Neira Ayuso)   
  - netfilter: nft_hash: fix nft_hash_deactivate (Pablo Neira Ayuso)   
  - netfilter: nf_tables: unbind set in rule from commit path (Pablo Neira Ayuso)   
  - netfilter: nf_tables: split set destruction in deactivate and destroy phase (Florian Westphal)   
  - perf auxtrace: Fix address filter entire kernel size (Adrian Hunter)   
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern (Mike Snitzer)   
  - dm flakey: fix a crash with invalid table line (Mikulas Patocka)   
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (Mike Snitzer)   
  - s390/dasd: fix hanging blockdevice after request requeue (Stefan Haberland)   
  - btrfs: scrub: reject unsupported scrub flags (Qu Wenruo)   
  - clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent (Quentin Schulz)   
  - wifi: rtl8xxxu: RTL8192EU always needs full init (Bitterblue Smith)   
  - nilfs2: fix infinite loop in nilfs_mdt_get_block() (Ryusuke Konishi)   
  - nilfs2: do not write dirty data after degenerating to read-only (Ryusuke Konishi)   
  - parisc: Fix argument pointer in real64_call_asm() (Helge Deller)   
  - dmaengine: at_xdmac: do not enable all cyclic channels (Claudiu Beznea)   
  - phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port (Gaosheng Cui)   
  - NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease (Trond Myklebust)   
  - IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order (Patrick Kelsey)   
  - clk: add missing of_node_put() in "assigned-clocks" property parsing (Clément Léger)   
  - power: supply: generic-adc-battery: fix unit scaling (Sebastian Reichel)   
  - RDMA/rdmavt: Delete unnecessary NULL check (Natalia Petrova)   
  - perf/core: Fix hardlockup failure caused by perf throttle (Yang Jihong)   
  - powerpc/rtas: use memmove for potentially overlapping buffer copy (Nathan Lynch)   
  - macintosh: via-pmu-led: requires ATA to be set (Randy Dunlap)   
  - powerpc/sysdev/tsi108: fix resource printk format warnings (Randy Dunlap)   
  - powerpc/wii: fix resource printk format warnings (Randy Dunlap)   
  - powerpc/mpc512x: fix resource printk format warning (Randy Dunlap)   
  - macintosh/windfarm_smu_sat: Add missing of_node_put() (Liang He)   
  - spmi: Add a check for remove callback when removing a SPMI driver (Jishnu Prakash)   
  - staging: rtl8192e: Fix W_DISABLE# does not work after stop/start (Philipp Hortmann)   
  - serial: 8250: Add missing wakeup event reporting (Florian Fainelli)   
  - tty: serial: fsl_lpuart: adjust buffer length to the intended size (Shenwei Wang)   
  - usb: chipidea: fix missing goto in `ci_hdrc_probe` (Yinhao Hu)   
  - sh: sq: Fix incorrect element size for allocating bitmap buffer (John Paul Adrian Glaubitz)   
  - uapi/linux/const.h: prefer ISO-friendly __typeof__ (Saeed Mirzamohammadi)   
  - ia64: mm/contig: fix section mismatch warning/error (Randy Dunlap)   
  - of: Fix modalias string generation (Miquel Raynal)   
  - spi: fsl-spi: Fix CPM/QE mode Litte Endian (Christophe Leroy)   
  - linux/vt_buffer.h: allow either builtin or modular for macros (Randy Dunlap)   
  - pstore: Revert pmsg_lock back to a normal mutex (John Stultz)   
  - tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (Kuniyuki Iwashima)   
  - net: amd: Fix link leak when verifying config failed (Gencen Gan)   
  - ipv4: Fix potential uninit variable access bug in __ip_make_skb() (Ziyang Xuan)   
  - ixgbe: Enable setting RSS table to default values (Joe Damato)   
  - ixgbe: Allow flow hash to be set via ethtool (Joe Damato)   
  - wifi: iwlwifi: mvm: check firmware response size (Johannes Berg)   
  - wifi: iwlwifi: make the loop for card preparation effective (Emmanuel Grumbach)   
  - md/raid10: fix leak of 'r10bio->remaining' for recovery (Yu Kuai)   
  - scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS (Danila Chernetsov)   
  - scsi: target: iscsit: Fix TAS handling during conn cleanup (Mike Christie)   
  - net/packet: convert po->auxdata to an atomic flag (Eric Dumazet)   
  - net/packet: convert po->origdev to an atomic flag (Eric Dumazet)   
  - vlan: partially enable SIOCSHWTSTAMP in container (Vadim Fedorenko)   
  - scm: fix MSG_CTRUNC setting condition for SO_PASSSEC (Alexander Mikhalitsyn)   
  - wifi: ath6kl: reduce WARN to dev_dbg() in callback (Fedor Pchelkin)   
  - wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() (Dan Carpenter)   
  - wifi: ath6kl: minor fix for allocation size (Alexey V. Vissarionov)   
  - arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step (Sumit Garg)   
  - x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() (Saurabh Sengar)   
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (Zheng Wang)   
  - x86/apic: Fix atomic update of offset in reserve_eilvt_offset() (Uros Bizjak)   
  - media: av7110: prevent underflow in write_ts_to_decoder() (Dan Carpenter)   
  - media: bdisp: Add missing check for create_workqueue (Jiasheng Jiang)   
  - drm/probe-helper: Cancel previous job before starting new one (Dom Cobley)   
  - drm/vgem: add missing mutex_destroy (Maíra Canal)   
  - drm/rockchip: Drop unbalanced obj unref (Rob Clark)   
  - selinux: ensure av_permissions.h is built when needed (Paul Moore)   
  - selinux: fix Makefile dependencies of flask.h (Ondrej Mosnacek)   
  - ubifs: Free memory for tmpfile name (Mårten Lindahl)   
  - ubi: Fix return value overwrite issue in try_write_vid_and_data() (Wang YanQing)   
  - i2c: omap: Fix standard mode false ACK readings (Reid Tonking)   
  - reiserfs: Add security prefix to xattr name in reiserfs_security_write() (Roberto Sassu)   
  - ring-buffer: Sync IRQ works before buffer destruction (Johannes Berg)   
  - MIPS: fw: Allow firmware to pass a empty env (Jiaxun Yang)   
  - staging: iio: resolver: ads1210: fix config mode (Nuno Sá)   
  - perf sched: Cast PTHREAD_STACK_MIN to int as it may turn into sysconf(__SC_THREAD_STACK_MIN_VALUE) (Arnaldo Carvalho de Melo)   
  - USB: dwc3: fix runtime pm imbalance on unbind (Johan Hovold)   
  - iio: adc: palmas_gpadc: fix NULL dereference on rmmod (Patrik Dahlström)   
  - USB: serial: option: add UNISOC vendor and TOZED LT70C product (Arınç ÜNAL)   
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ruihan Li)   
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (Jisoo Jang)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.529.1.el7uek]
changelog:
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (George Kennedy)  [Orabug: 35649492]  {CVE-2023-3567} 
  - ocfs2: always read both high and low parts of dinode link count (Alexey Asemov)  [Orabug: 35643004]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.529.2.el7uek]
changelog:
  - x86/cpu: persist X86_FEATURE_NT_GOOD for late reload (Ankur Arora)  [Orabug: 35693947]  
  - uek-rpm: Disable cls_tcindex in file tcindex-disable.conf (Sherry Yang)  [Orabug: 35678739]  
  - uek-rpm: Update kernel's linux-firmware dependency. (Somasundaram Krishnasamy)  [Orabug: 35678693]  
  - Revert "sched/fair: sanitize vruntime of entity being placed" (Saeed Mirzamohammadi)  [Orabug: 35651310]  
  - Revert "sched/fair: Sanitize vruntime of entity being migrated" (Saeed Mirzamohammadi)  [Orabug: 35651310]  
  - x86/microcode/AMD: Clean up per-family patch size checks (Borislav Petkov)  [Orabug: 35643967]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.529.3.el7uek]
changelog:
  - uek-rpm: Update kernel linux-firmware dependency to 20230516-999.26.git6c9e0ed5. (Somasundaram Krishnasamy)  [Orabug: 35724203]  
  - LTS version: v4.14.322 (Saeed Mirzamohammadi)   
  - drm/edid: fix objtool warning in drm_cvt_modes() (Linus Torvalds)   
  - mtd: rawnand: omap_elm: Fix incorrect type in assignment (Roger Quadros)   
  - test_firmware: fix a memory leak with reqs buffer (Mirsad Goran Todorovac)   
  - ext2: Drop fragment support (Jan Kara)   
  - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (Alan Stern)   
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Sungwoo Kim)   
  - fs/sysv: Null check to prevent null-ptr-deref bug (Prince Kumar Maurya)   
  - USB: zaurus: Add ID for A-300/B-500/C-700 (Ross Maynard)   
  - libceph: fix potential hang in ceph_osdc_notify() (Ilya Dryomov)   
  - loop: Select I/O scheduler 'none' from inside add_disk() (Bart Van Assche)   
  - tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_net (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_vals[] (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_lock (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_stamp (Eric Dumazet)   
  - tcp_metrics: fix addr_same() helper (Eric Dumazet)   
  - ip6mr: Fix skb_under_panic in ip6mr_cache_report() (Yue Haibing)   
  - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (valis)   
  - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (valis)   
  - net: add missing data-race annotation for sk_ll_usec (Eric Dumazet)   
  - net: add missing data-race annotations around sk->sk_peek_off (Eric Dumazet)   
  - perf test uprobe_from_different_cu: Skip if there is no gcc (Georg Müller)   
  - net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer() (Yuanjun Gong)   
  - word-at-a-time: use the same return type for has_zero regardless of endianness (ndesaulniers@google.com)   
  - perf: Fix function pointer case (Peter Zijlstra)   
  - net/sched: cls_u32: Fix reference counter leak leading to overflow (Lee Jones)   
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Pedro Tammela)   
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (M A Ramdhan)   
  - drm/client: Fix memory leak in drm_client_target_cloned (Jocelyn Falempe)   
  - dm cache policy smq: ensure IO doesn't prevent cleaner policy progress (Joe Thornber)   
  - ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register (Mark Brown)   
  - s390/dasd: fix hanging device after quiesce/resume (Stefan Haberland)   
  - irq-bcm6345-l1: Do not assume a fixed block to cpu mapping (Jonas Gorski)   
  - tpm_tis: Explicitly check for error code (Alexander Steffen)   
  - hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled (Gilles Buloz)   
  - staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() (Zhang Shurong)   
  - Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group (Greg Kroah-Hartman)   
  - usb: xhci-mtk: set the dma max_seg_size (Ricardo Ribalda)   
  - usb: ohci-at91: Fix the unhandle interrupt when resume (Guiting Shen)   
  - can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED (Marc Kleine-Budde)   
  - USB: serial: simple: sort driver entries (Johan Hovold)   
  - USB: serial: simple: add Kaufmann RKS+CAN VCP (Oliver Neukum)   
  - USB: serial: option: add Quectel EC200A module support (Mohsen Tahmasebi)   
  - USB: serial: option: support Quectel EM060K_128 (Jerry Meng)   
  - tracing: Fix warning in trace_buffered_event_disable() (Zheng Yejian)   
  - ring-buffer: Fix wrong stat of cpu_buffer->read (Zheng Yejian)   
  - ata: pata_ns87415: mark ns87560_tf_read static (Arnd Bergmann)   
  - dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (Yu Kuai)   
  - block: Fix a source code comment in include/uapi/linux/blkzoned.h (Bart Van Assche)   
  - ASoC: fsl_spdif: Silence output on stop (Matus Gajdos)   
  - benet: fix return value check in be_lancer_xmit_workarounds() (Yuanjun Gong)   
  - platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100 (Maxim Mikityanskiy)   
  - team: reset team's flags when down link is P2P device (Hangbin Liu)   
  - bonding: reset bond's flags when down link is P2P device (Hangbin Liu)   
  - tcp: Reduce chance of collisions in inet6_hashfn(). (Stewart Smith)   
  - ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address (Maciej Żenczykowski)   
  - ethernet: atheros: fix return value check in atl1e_tso_csum() (Yuanjun Gong)   
  - i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir() (Wang Ming)   
  - gpio: tps68470: Make tps68470_gpio_output() always set the initial value (Hans de Goede)   
  - tcp: annotate data-races around fastopenq.max_qlen (Eric Dumazet)   
  - tcp: annotate data-races around tp->notsent_lowat (Eric Dumazet)   
  - tcp: annotate data-races around rskq_defer_accept (Eric Dumazet)   
  - netfilter: nf_tables: fix spurious set element insertion failure (Florian Westphal)   
  - llc: Don't drop packet from non-root netns. (Kuniyuki Iwashima)   
  - fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe (Zhang Shurong)   
  - net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field() (Tanmay Patil)   
  - pinctrl: amd: Use amd_pinconf_set() for all config options (Mario Limonciello)   
  - fbdev: imxfb: warn about invalid left/right margin (Martin Kaiser)   
  - spi: bcm63xx: fix max prepend length (Jonas Gorski)   
  - igb: Fix igb_down hung on surprise removal (Ying Hsu)   
  - wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() (Gustavo A. R. Silva)   
  - bpf: Address KCSAN report on bpf_lru_list (Martin KaFai Lau)   
  - sched/fair: Don't balance task to its current running CPU (Yicong Yang)   
  - posix-timers: Ensure timer ID search-loop limit is valid (Saeed Mirzamohammadi)   
  - md/raid10: prevent soft lockup while flush writes (Yu Kuai)   
  - md: fix data corruption for raid456 when reshape restart while grow up (Yu Kuai)   
  - nbd: Add the maximum limit of allocated index in nbd_dev_add (Zhong Jinghua)   
  - debugobjects: Recheck debug_objects_enabled before reporting (Tetsuo Handa)   
  - ext4: correct inline offset when handling xattrs in inode body (Eric Whitney)   
  - can: bcm: Fix UAF in bcm_proc_show() (YueHaibing)   
  - fuse: revalidate: don't invalidate if interrupted (Miklos Szeredi)   
  - perf probe: Add test for regression introduced by switch to die_get_decl_file() (Georg Müller)   
  - serial: atmel: don't enable IRQs prematurely (Dan Carpenter)   
  - scsi: qla2xxx: Pointer may be dereferenced (Shreyas Deodhar)   
  - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() (Nilesh Javali)   
  - scsi: qla2xxx: Fix potential NULL pointer dereference (Bikash Hazarika)   
  - scsi: qla2xxx: Wait for io return on terminate rport (Quinn Tran)   
  - xtensa: ISS: fix call to split_if_spec (Max Filippov)   
  - ring-buffer: Fix deadloop issue on reading trace_pipe (Zheng Yejian)   
  - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk (Christophe JAILLET)   
  - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error (Christophe JAILLET)   
  - Revert "8250: add support for ASIX devices with a FIFO bug" (Jiaqing Zhao)   
  - meson saradc: fix clock divider mask length (George Stark)   
  - hwrng: imx-rngc - fix the timeout for init and self check (Martin Kaiser)   
  - fs: dlm: return positive pid value for F_GETLK (Alexander Aring)   
  - md/raid0: add discard support for the 'original' layout (Jason Baron)   
  - misc: pci_endpoint_test: Re-init completion for every test (Damien Le Moal)   
  - PCI: Add function 1 DMA alias quirk for Marvell 88SE9235 (Robin Murphy)   
  - jfs: jfs_dmap: Validate db_l2nbperpage while mounting (Siddh Raman Pant)   
  - ext4: only update i_reserved_data_blocks on successful block allocation (Baokun Li)   
  - ext4: fix wrong unit use in ext4_mb_clear_bb (Kemeng Shi)   
  - perf intel-pt: Fix CYC timestamps after standalone CBR (Adrian Hunter)   
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (Ding Hui)   
  - tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation (Jarkko Sakkinen)   
  - net/sched: make psched_mtu() RTNL-less safe (Pedro Tammela)   
  - wifi: airo: avoid uninitialized warning in airo_get_rate() (Randy Dunlap)   
  - ipv6/addrconf: fix a potential refcount underflow for idev (Ziyang Xuan)   
  - NTB: ntb_transport: fix possible memory leak while device_register() fails (Yang Yingliang)   
  - ntb: intel: Fix error handling in intel_ntb_pci_driver_init() (Yuan Can)   
  - NTB: amd: Fix error handling in amd_ntb_pci_driver_init() (Yuan Can)   
  - ntb: idt: Fix error handling in idt_pci_driver_init() (Yuan Can)   
  - udp6: fix udp6_ehashfn() typo (Eric Dumazet)   
  - net: mvneta: fix txq_map in case of txq_number==1 (Klaus Kudielka)   
  - workqueue: clean up WORK_* constant types, clarify masking (Linus Torvalds)   
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Thadeu Lima de Souza Cascardo)   
  - netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (Florent Revest)   
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Pablo Neira Ayuso)   
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Pablo Neira Ayuso)   
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (Pablo Neira Ayuso)   
  - spi: spi-fsl-spi: allow changing bits_per_word while CS is still active (Rasmus Villemoes)   
  - spi: spi-fsl-spi: relax message sanity checking a little (Rasmus Villemoes)   
  - spi: spi-fsl-spi: remove always-true conditional in fsl_spi_do_one_msg (Rasmus Villemoes)   
  - ARM: orion5x: fix d2net gpio initialization (Arnd Bergmann)   
  - btrfs: fix race when deleting quota root from the dirty cow roots list (Filipe Manana)   
  - jffs2: reduce stack usage in jffs2_build_xattr_subsystem() (Fabian Frederick)   
  - integrity: Fix possible multiple allocation in integrity_inode_get() (Tianjia Zhang)   
  - mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M (Robert Marko)   
  - mmc: core: disable TRIM on Kingston EMMC04G-M627 (Robert Marko)   
  - NFSD: add encoding of op_recall flag for write delegation (Dai Ngo)   
  - sh: dma: Fix DMA channel offset calculation (Artur Rojek)   
  - net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX (Lin Ma)   
  - tcp: annotate data races in __tcp_oow_rate_limited() (Eric Dumazet)   
  - net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode (Vladimir Oltean)   
  - powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y (Randy Dunlap)   
  - mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 (Nishanth Menon)   
  - spi: bcm-qspi: return error if neither hif_mspi nor mspi is available (Jonas Gorski)   
  - Add MODULE_FIRMWARE() for FIRMWARE_TG357766. (Tobias Heider)   
  - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (Chengfeng Ye)   
  - rtc: st-lpc: Release some resources in st_rtc_probe() in case of error (Christophe JAILLET)   
  - mfd: stmpe: Only disable the regulators if they are enabled (Christophe JAILLET)   
  - mfd: intel-lpss: Add missing check for platform_get_resource (Jiasheng Jiang)   
  - mfd: rt5033: Drop rt5033-battery sub-device (Stephan Gerhold)   
  - usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() (Li Yang)   
  - extcon: Fix kernel doc of property capability fields to avoid warnings (Andy Shevchenko)   
  - extcon: Fix kernel doc of property fields to avoid warnings (Andy Shevchenko)   
  - media: usb: siano: Fix warning due to null work_func_t function pointer (Duoming Zhou)   
  - media: videodev2.h: Fix struct v4l2_input tuner index comment (Marek Vasut)   
  - media: usb: Check az6007_read() return value (Daniil Dulov)   
  - sh: j2: Use ioremap() to translate device tree address into kernel memory (John Paul Adrian Glaubitz)   
  - w1: fix loop in w1_fini() (Dan Carpenter)   
  - block: change all __u32 annotations to __be32 in affs_hardblocks.h (Michael Schmitz)   
  - USB: serial: option: add LARA-R6 01B PIDs (Davide Tronchin)   
  - modpost: fix off by one in is_executable_section() (Dan Carpenter)   
  - modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} (Masahiro Yamada)   
  - modpost: fix section mismatch message for R_ARM_ABS32 (Masahiro Yamada)   
  - crypto: nx - fix build warnings when DEBUG_FS is not enabled (Randy Dunlap)   
  - pinctrl: at91-pio4: check return value of devm_kasprintf() (Claudiu Beznea)   
  - perf dwarf-aux: Fix off-by-one in die_get_varname() (Namhyung Kim)   
  - pinctrl: cherryview: Return correct value if pin in push-pull mode (Andy Shevchenko)   
  - PCI: Add pci_clear_master() stub for non-CONFIG_PCI (Sui Jingfeng)   
  - scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() (Yuchen Yang)   
  - ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer (Su Hui)   
  - drm/radeon: fix possible division-by-zero errors (Nikita Zhandarovich)   
  - fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() (Christophe JAILLET)   
  - soc/fsl/qe: fix usb.c build errors (Randy Dunlap)   
  - ASoC: es8316: Increment max value for ALC Capture Target Volume control (Cristian Ciocaltea)   
  - ARM: ep93xx: fix missing-prototype warnings (Arnd Bergmann)   
  - drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H (Dario Binacchi)   
  - Input: adxl34x - do not hardcode interrupt trigger type (Marek Vasut)   
  - ARM: dts: BCM5301X: Drop "clock-names" from the SPI node (Rafał Miłecki)   
  - Input: drv260x - sleep between polling GO bit (Luca Weiss)   
  - radeon: avoid double free in ci_dpm_init() (Nikita Zhandarovich)   
  - netlink: Add __sock_i_ino() for __netlink_diag_dump(). (Kuniyuki Iwashima)   
  - netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. (Ilia.Gavrilov)   
  - lib/ts_bm: reset initial match offset for every block of text (Jeremy Sowden)   
  - gtp: Fix use-after-free in __gtp_encap_destroy(). (Kuniyuki Iwashima)   
  - netlink: do not hard code device address lenth in fdb dumps (Eric Dumazet)   
  - netlink: fix potential deadlock in netlink_set_err() (Eric Dumazet)   
  - wifi: ath9k: convert msecs to jiffies where needed (Dmitry Antipov)   
  - wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() (Remi Pommarel)   
  - memstick r592: make memstick_debug_get_tpc_name() static (Arnd Bergmann)   
  - kexec: fix a memory leak in crash_shrink_memory() (Zhen Lei)   
  - watchdog/perf: more properly prevent false positives with turbo modes (Douglas Anderson)   
  - watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config (Douglas Anderson)   
  - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (Fedor Pchelkin)   
  - wifi: ray_cs: Fix an error handling path in ray_probe() (Christophe JAILLET)   
  - wifi: wl3501_cs: Fix an error handling path in wl3501_probe() (Christophe JAILLET)   
  - wifi: atmel: Fix an error handling path in atmel_probe() (Christophe JAILLET)   
  - wifi: orinoco: Fix an error handling path in orinoco_cs_probe() (Christophe JAILLET)   
  - wifi: orinoco: Fix an error handling path in spectrum_cs_probe() (Christophe JAILLET)   
  - wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx (Fedor Pchelkin)   
  - wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation (Peter Seiderer)   
  - evm: Complete description of evm_inode_setattr() (Roberto Sassu)   
  - PM: domains: fix integer overflow issues in genpd_parse_state() (Nikita Zhandarovich)   
  - md/raid10: fix io loss while replacement replace rdev (Li Nan)   
  - md/raid10: fix wrong setting of max_corr_read_errors (Li Nan)   
  - md/raid10: fix overflow of md/safe_mode_delay (Li Nan)   
  - treewide: Remove uninitialized_var() usage (Kees Cook)   
  - drm/amdgpu: Validate VM ioctl flags. (Bas Nieuwenhuizen)   
  - scripts/tags.sh: Resolve gtags empty index generation (Ahmed S. Darwish)   
  - drm/edid: Fix uninitialized variable in drm_cvt_modes() (Lyude Paul)   
  - fbdev: imsttfb: Fix use after free bug in imsttfb_probe (Zheng Wang)   
  - x86/smp: Use dedicated cache-line for mwait_play_dead() (Thomas Gleixner)   
  - x86/microcode/AMD: Load late on both threads too (Borislav Petkov (AMD))   
  - gfs2: Don't deref jdesc in evict (Bob Peterson)   
  - LTS version: v4.14.321 (Saeed Mirzamohammadi)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2047.529.3.1.el7uek]
changelog:
  - rds: Fix lack of reentrancy for connection reset with dst addr zero (Håkon Bugge)  [Orabug: 35708852]  {CVE-2023-22024}


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-2047.529.3.2.el7uek]
changelog:
  - netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa)  [Orabug: 35824309]  
  - netfilter: xt_u32: validate user space input (Wander Lairson Costa)  [Orabug: 35824309]  
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng)  [Orabug: 35824309]  {CVE-2023-42753}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.1.el7uek]
changelog:
  - rds: Remove gratuitous include of time.h from rds.h (Mark Haywood)  [Orabug: 35742762]  
  - smp: Reduce NMI traffic from CSD waiters to CSD destination (Imran Khan)  [Orabug: 35236407]  
  - smp: Reduce logging due to dump_stack of CSD waiters (Imran Khan)  [Orabug: 35236407]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.2.el7uek]
changelog:
  - LTS version: v4.14.325 (Saeed Mirzamohammadi)   
  - Revert "ARM: ep93xx: fix missing-prototype warnings" (Greg Kroah-Hartman)   
  - Revert "MIPS: Alchemy: fix dbdma2" (Greg Kroah-Hartman)   
  - LTS version: v4.14.324 (Saeed Mirzamohammadi)   
  - dma-buf/sw_sync: Avoid recursive lock during fence signal (Rob Clark)   
  - scsi: core: raid_class: Remove raid_component_add() (Zhu Wang)   
  - scsi: snic: Fix double free in snic_tgt_create() (Zhu Wang)   
  - rtnetlink: Reject negative ifindexes in RTM_NEWLINK (Ido Schimmel)   
  - x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 (Feng Tang)   
  - media: vcodec: Fix potential array out-of-bounds in encoder queue_setup (Wei Chen)   
  - lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels (Helge Deller)   
  - batman-adv: Fix batadv_v_ogm_aggr_send memory leak (Remi Pommarel)   
  - batman-adv: Fix TT global entry leak when client roamed back (Remi Pommarel)   
  - batman-adv: Do not get eth header before batadv_check_management_packet (Remi Pommarel)   
  - batman-adv: Trigger events for auto adjusted MTU (Sven Eckelmann)   
  - ibmveth: Use dcbf rather than dcbfl (Michael Ellerman)   
  - ipvs: fix racy memcpy in proc_do_sync_threshold (Sishuai Gong)   
  - ipvs: Improve robustness to the ipvs sysctl (Junwei Hu)   
  - igb: Avoid starting unnecessary workqueues (Alessio Igor Bogani)   
  - sock: annotate data-races around prot->memory_pressure (Eric Dumazet)   
  - tracing: Fix memleak due to race between current_tracer and trace (Zheng Yejian)   
  - net: phy: broadcom: stub c45 read/write for 54810 (Justin Chen)   
  - net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure (Lin Ma)   
  - net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled (Jason Xing)   
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Kuniyuki Iwashima)   
  - ASoC: rt5665: add missed regulator_bulk_disable (Zhang Shurong)   
  - netfilter: set default timeout to 3 secs for sctp shutdown send and recv state (Xin Long)   
  - test_firmware: prevent race conditions by a correct implementation of locking (Mirsad Goran Todorovac)   
  - binder: fix memory leak in binder_init() (Qi Zheng)   
  - serial: 8250: Fix oops for port->pm on uart_change_pm() (Tony Lindgren)   
  - mmc: wbsd: fix double mmc_free_host() in wbsd_init() (Yang Yingliang)   
  - cifs: Release folio lock on fscache read hit. (Russell Harmon via samba-technical)   
  - ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. (dengxiang)   
  - net: do not allow gso_size to be set to GSO_BY_FRAGS (Eric Dumazet)   
  - sock: Fix misuse of sk_under_memory_pressure() (Abel Wu)   
  - i40e: fix misleading debug logs (Andrii Staikov)   
  - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan)   
  - netfilter: nft_dynset: disallow object maps (Pablo Neira Ayuso)   
  - xfrm: add NULL check in xfrm_update_ae_params (Lin Ma)   
  - ip_vti: fix potential slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - ip6_vti: fix slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - net: af_key: fix sadb_x_filter validation (Lin Ma)   
  - net: xfrm: Fix xfrm_address_filter OOB read (Lin Ma)   
  - fbdev: mmp: fix value check in mmphw_probe() (Yuanjun Gong)   
  - drm/amdgpu: Fix potential fence use-after-free v2 (shanzhulig)   
  - Bluetooth: L2CAP: Fix use-after-free (Zhengping Jiang)   
  - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() (Armin Wolf)   
  - gfs2: Fix possible data races in gfs2_show_options() (Tuo Li)   
  - media: platform: mediatek: vpu: fix NULL ptr dereference (Hans Verkuil)   
  - media: v4l2-mem2mem: add lock to protect parameter num_rdy (Yunfei Dong)   
  - FS: JFS: Check for read-only mounted filesystem in txBegin (Immad Mir)   
  - FS: JFS: Fix null-ptr-deref Read in txBegin (Immad Mir)   
  - MIPS: dec: prom: Address -Warray-bounds warning (Gustavo A. R. Silva)   
  - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (Yogesh)   
  - udf: Fix uninitialized array access for some pathnames (Jan Kara)   
  - quota: fix warning in dqgrab() (Ye Bin)   
  - quota: Properly disable quotas when add_dquot_ref() fails (Jan Kara)   
  - ALSA: emu10k1: roll up loops in DSP setup code for Audigy (Oswald Buddenhagen)   
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init (hackyzh002)   
  - lib/mpi: Eliminate unused umul_ppmm definitions for MIPS (Nathan Chancellor)   
  - LTS version: v4.14.323 (Saeed Mirzamohammadi)   
  - alpha: remove __init annotation from exported page_is_ram() (Masahiro Yamada)   
  - scsi: core: Fix possible memory leak if device_add() fails (Zhu Wang)   
  - scsi: snic: Fix possible memory leak if device_add() fails (Zhu Wang)   
  - scsi: 53c700: Check that command slot is not NULL (Alexandra Diupina)   
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Michael Kelley)   
  - scsi: core: Fix legacy /proc parsing buffer overflow (Tony Battersby)   
  - netfilter: nf_tables: report use refcount overflow (Pablo Neira Ayuso)   
  - btrfs: don't stop integrity writeback too early (Christoph Hellwig)   
  - IB/hfi1: Fix possible panic during hotplug remove (Douglas Miller)   
  - drivers: net: prevent tun_build_skb() to exceed the packet size limit (Andrew Kanner)   
  - dccp: fix data-race around dp->dccps_mss_cache (Eric Dumazet)   
  - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan)   
  - net/packet: annotate data-races around tp->status (Eric Dumazet)   
  - drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes (Karol Herbst)   
  - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Kirill A. Shutemov)   
  - usb: dwc3: Properly handle processing of pending events (Elson Roy Serrao)   
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Alan Stern)   
  - iio: cros_ec: Fix the allocation size for cros_ec_command (Yiyuan Guo)   
  - test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation (Mirsad Goran Todorovac)   
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (Ryusuke Konishi)   
  - radix tree test suite: fix incorrect allocation size for pthreads (Colin Ian King)   
  - dmaengine: pl330: Return DMA_PAUSED when transaction is paused (Ilpo Järvinen)   
  - ipv6: adjust ndisc_is_useropt() to also return true for PIO (Maciej Żenczykowski)   
  - mmc: moxart: read scr register without changing byte order (Sergei Antonov)   
  - sparc: fix up arch_cpu_finalize_init() build breakage. (Greg Kroah-Hartman)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.3.el7uek]
changelog:
  - Add the new PCI Device IDs to support new generation of AMD 19h processors. (Partha Sarathi Satapathy)  [Orabug: 35773822]  
  - hwmon: (k10temp) Add support for AMD Family 19h Models 10h-1Fh and A0h-AFh (Babu Moger)  [Orabug: 35773822]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.4.el7uek]
changelog:
  - rds: Fix lack of reentrancy for connection reset with dst addr zero (Håkon Bugge)  [Orabug: 35819110]  {CVE-2023-22024} 
  - kernfs: fix missing kernfs_iattr_rwsem locking (Ian Kent)  [Orabug: 35796772]  
  - uek-rpm: Removing pre scriptlet to not allow firmware downgrade (Samasth Norway Ananda)  [Orabug: 35756463]  
  - scsi: megaraid_sas: Fix deadlock on firmware crashdump (Junxiao Bi)  [Orabug: 35702793]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.5.el7uek]
changelog:
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng)  [Orabug: 35824288]  {CVE-2023-42753} 
  - netfilter: xt_u32: validate user space input (Wander Lairson Costa)   
  - netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.5.1.el7uek]
changelog:
  - Revert "rtnetlink: Reject negative ifindexes in RTM_NEWLINK" (Saeed Mirzamohammadi)  [Orabug: 35896831]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.531.1.el7uek]
changelog:
  - ocfs2: ocfs2 crash due to invalid h_next_leaf_blk value in extent block (Gautham Ananthakrishna)  [Orabug: 35859332]  
  - bnxt_en: fix NULL dereference in bnxt_flash_package_from_file() (Samasth Norway Ananda)  [Orabug: 35848949]  
  - LTS version: v4.14.326 (Saeed Mirzamohammadi)   
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (valis)   
  - mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write (William Zhang)   
  - mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller (William Zhang)   
  - mtd: rawnand: brcmnand: Fix potential false time out warning (William Zhang)   
  - mtd: rawnand: brcmnand: Fix crash during the panic_write (William Zhang)   
  - nfsd: fix change_info in NFSv4 RENAME replies (Jeff Layton)   
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (Filipe Manana)   
  - attr: block mode changes of symlinks (Christian Brauner)   
  - md/raid1: fix error: ISO C90 forbids mixed declarations (Nigel Croxon)   
  - kobject: Add sanity check for kset->kobj.ktype in kset_register() (Zhen Lei)   
  - serial: cpm_uart: Avoid suspicious locking (Christophe Leroy)   
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (Konstantin Shelekhin)   
  - usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc (Ma Ke)   
  - media: pci: cx23885: replace BUG with error return (Hans Verkuil)   
  - media: tuners: qt1010: replace BUG_ON with a regular error (Hans Verkuil)   
  - iio: core: Use min() instead of min_t() to make code more robust (Andy Shevchenko)   
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (Zhang Shurong)   
  - media: anysee: fix null-ptr-deref in anysee_master_xfer (Zhang Shurong)   
  - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer (Zhang Shurong)   
  - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() (Zhang Shurong)   
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer (Zhang Shurong)   
  - powerpc/pseries: fix possible memory leak in ibmebus_bus_init() (ruanjinjie)   
  - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (Liu Shixin via Jfs-discussion)   
  - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (Andrew Kanner)   
  - ext2: fix datatype of block number in ext2_xattr_set2() (Georg Ottinger)   
  - md: raid1: fix potential OOB in raid1_remove_disk() (Zhang Shurong)   
  - drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable() (Tuo Li)   
  - alx: fix OOB-read compiler warning (GONG, Ruiqi)   
  - tpm_tis: Resend command to recover from data transfer errors (Alexander Steffen)   
  - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (Mark O'Donovan)   
  - wifi: mwifiex: fix fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix printk specifier (Dongliang Mu)   
  - hw_breakpoint: fix single-stepping when using bpf_overflow_handler (Tomislav Novak)   
  - ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 (Jiri Slaby (SUSE))   
  - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (Abhishek Mainkar)   
  - btrfs: output extra debug info if we failed to find an inline backref (Qu Wenruo)   
  - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Fedor Pchelkin)   
  - parisc: Drop loops_per_jiffy from per_cpu struct (Helge Deller)   
  - kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). (Kuniyuki Iwashima)   
  - ixgbe: fix timestamp configuration code (Vadim Fedorenko)   
  - kcm: Fix memory leak in error path of kcm_sendmsg() (Shigeru Yoshida)   
  - net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() (Hangyu Hua)   
  - ata: pata_ftide010: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - ata: sata_gemini: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - igb: Change IGB_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - kcm: Destroy mutex in kcm_exit_net() (Shigeru Yoshida)   
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis)   
  - af_unix: Fix data race around sk->sk_err. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around sk->sk_shutdown. (Kuniyuki Iwashima)   
  - af_unix: Fix data-race around unix_tot_inflight. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around user->unix_inflight. (Kuniyuki Iwashima)   
  - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr (Alex Henrie)   
  - igb: disable virtualization features on 82580 (Corinna Vinschen)   
  - net: read sk->sk_family once in sk_mc_loop() (Eric Dumazet)   
  - pwm: lpc32xx: Remove handling of PWM channels (Vladimir Zapolskiy)   
  - watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load (Raag Jadav)   
  - x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() (Sean Christopherson)   
  - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info (Fedor Pchelkin)   
  - clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock (Dmitry Baryshkov)   
  - parisc: led: Reduce CPU overhead for disk & lan LED computation (Helge Deller)   
  - parisc: led: Fix LAN receive and transmit LEDs (Helge Deller)   
  - drm/ast: Fix DRAM init on AST2200 (Thomas Zimmermann)   
  - fbdev/ep93xx-fb: Do not assign to struct fb_info.dev (Thomas Zimmermann)   
  - scsi: qla2xxx: Turn off noisy message log (Quinn Tran)   
  - scsi: qla2xxx: fix inconsistent TMF timeout (Quinn Tran)   
  - crypto: stm32 - fix loop iterating through scatterlist for DMA (Thomas Bourgoin)   
  - pstore/ram: Check start of empty przs during init (Enlin Mu)   
  - net: handle ARPHRD_PPP in dev_is_mac_header_xmit() (Nicolas Dichtel)   
  - X.509: if signature is unsupported skip validation (Thore Sommer)   
  - dccp: Fix out of bounds access in DCCP error handler (Jann Horn)   
  - parisc: Fix /proc/cpuinfo output for lscpu (Helge Deller)   
  - procfs: block chmod on /proc/thread-self/comm (Aleksa Sarai)   
  - Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" (Bjorn Helgaas)   
  - ntb: Fix calculation ntb_transport_tx_free_entry() (Dave Jiang)   
  - ntb: Clean up tx tail index on link down (Dave Jiang)   
  - ntb: Drop packets when qp link is down (Dave Jiang)   
  - media: dvb: symbol fixup for dvb_attach() (Greg Kroah-Hartman)   
  - backlight/lv5207lp: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/bd6107: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/gpio_backlight: Compare against struct fb_info.device (Thomas Zimmermann)   
  - ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() (Gustavo A. R. Silva)   
  - ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (Takashi Iwai)   
  - PM / devfreq: Fix leak in devfreq_dev_release() (Boris Brezillon)   
  - igb: set max size RX buffer when store bad packet is enabled (Radoslaw Tyl)   
  - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU (Eric Dumazet)   
  - dmaengine: ste_dma40: Add missing IRQ check in d40_probe (ruanjinjie)   
  - rpmsg: glink: Add check for kstrdup (Jiasheng Jiang)   
  - HID: multitouch: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu)   
  - Revert "IB/isert: Fix incorrect release of isert connection" (Leon Romanovsky)   
  - amba: bus: fix refcount leak (Peng Fan)   
  - serial: tegra: handle clk prepare error in tegra_uart_hw_init() (Yi Yang)   
  - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (Chengfeng Ye)   
  - scsi: core: Use 32-bit hostnum in scsi_host_lookup() (Tony Battersby)   
  - cgroup:namespace: Remove unused cgroup_namespaces_init() (Lu Jialin)   
  - USB: gadget: f_mass_storage: Fix unused variable warning (Alan Stern)   
  - media: go7007: Remove redundant if statement (Colin Ian King)   
  - dma-buf/sync_file: Fix docs syntax (Rob Clark)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (Oleksandr Natalenko)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (Oleksandr Natalenko)   
  - x86/APM: drop the duplicate APM_MINOR_DEV macro (Randy Dunlap)   
  - scsi: qla4xxx: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: be2iscsi: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() (Lin Ma)   
  - usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() (Xu Yang)   
  - media: mediatek: vcodec: Return NULL if no vdec_fb is found (Irui Wang)   
  - media: cx24120: Add retval check for cx24120_message_send() (Daniil Dulov)   
  - media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() (Christophe JAILLET)   
  - media: dib7000p: Fix potential division by zero (Daniil Dulov)   
  - drivers: usb: smsusb: fix error handling code in smsusb_init_device (Dongliang Mu)   
  - NFSD: da_addr_body field missing in some GETDEVICEINFO replies (Chuck Lever)   
  - fs: lockd: avoid possible wrong NULL parameter (Su Hui)   
  - jfs: validate max amount of blocks before allocation. (Alexei Filippov)   
  - powerpc/iommu: Fix notifiers being shared by PCI and VIO buses (Russell Currey)   
  - nfs/blocklayout: Use the passed in gfp flags (Dan Carpenter)   
  - wifi: ath10k: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: pciehp: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: Mark NVIDIA T4 GPUs to avoid bus reset (Wu Zongyong)   
  - clk: sunxi-ng: Modify mismatched function name (Zhang Jianhua)   
  - drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() (Minjie Du)   
  - ALSA: ac97: Fix possible error value of *rac97 (Su Hui)   
  - audit: fix possible soft lockup in __audit_inode_child() (Gaosheng Cui)   
  - smackfs: Prevent underflow in smk_set_cipso() (Dan Carpenter)   
  - of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() (Ruan Jinjie)   
  - drm: adv7511: Fix low refresh rate register for ADV7533/5 (Bogdan Togorean)   
  - ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: BCM53573: Add cells sizes to PCIe node (Rafał Miłecki)   
  - netrom: Deny concurrent connect(). (Kuniyuki Iwashima)   
  - net: arcnet: Do not call kfree_skb() under local_irq_disable() (Jinjie Ruan)   
  - wifi: ath9k: use IS_ERR() with debugfs_create_dir() (Wang Ming)   
  - wifi: mwifiex: avoid possible NULL skb pointer dereference (Dmitry Antipov)   
  - wifi: ath9k: protect WMI command response buffer replacement with a lock (Fedor Pchelkin)   
  - wifi: mwifiex: Fix missed return in oob checks failed path (Polaris Pi)   
  - wifi: mwifiex: fix memory leak in mwifiex_histogram_read() (Dmitry Antipov)   
  - fs: ocfs2: namei: check return value of ocfs2_add_entry() (Artem Chernyshev)   
  - lwt: Check LWTUNNEL_XMIT_CONTINUE strictly (Yan Zhai)   
  - crypto: caam - fix unchecked return value error (Gaurav Jain)   
  - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Menglong Dong)   
  - Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (Yuanjun Gong)   
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Polaris Pi)   
  - can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM (Marc Kleine-Budde)   
  - spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() (Zhang Shurong)   
  - regmap: rbtree: Use alloc_flags for memory allocations (Dan Carpenter)   
  - cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() (Liao Chang)   
  - fs: Fix error checking for d_hash_and_lookup() (Wang Ming)   
  - reiserfs: Check the return value from __getblk() (Matthew Wilcox)   
  - Revert "net: macsec: preserve ingress frame ordering" (Sabrina Dubroca)   
  - udf: Handle error when adding extent to a file (Jan Kara)   
  - udf: Check consistency of Space Bitmap Descriptor (Vladislav Efanov)   
  - powerpc/32s: Fix assembler warning about r0 (Christophe Leroy)   
  - powerpc/32: Include .branch_lt in data section (Joel Stanley)   
  - ALSA: seq: oss: Fix racy open/close of MIDI devices (Takashi Iwai)   
  - cifs: add a warning when the in-flight count goes negative (Shyam Prasad N)   
  - sctp: handle invalid error codes without calling BUG() (Dan Carpenter)   
  - bnx2x: fix page fault following EEH recovery (David Christensen)   
  - netlabel: fix shift wrapping bug in netlbl_catmap_setlong() (Dmitry Mastykin)   
  - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock (Chengfeng Ye)   
  - idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM (Baoquan He)   
  - net: usb: qmi_wwan: add Quectel EM05GV2 (Martin Kohn)   
  - security: keys: perform capable check only on privileged operations (Christian Göttsche)   
  - ASoc: codecs: ES8316: Fix DMIC config (Edgar)   
  - fs/nls: make load_nls() take a const parameter (Saeed Mirzamohammadi)   
  - s390/dasd: use correct number of retries for ERP requests (Stefan Haberland)   
  - m68k: Fix invalid .section syntax (Ben Hutchings)   
  - ethernet: atheros: fix return value check in atl1c_tso_csum() (Yuanjun Gong)   
  - ASoC: da7219: Flush pending AAD IRQ when suspending (Dmytro Maluka)   
  - 9p: virtio: make sure 'offs' is initialized in zc_request (Dominique Martinet)   
  - lib/ubsan: remove returns-nonnull-attribute checks (Andrey Ryabinin)   
  - pinctrl: amd: Don't show `Invalid config param` errors (Mario Limonciello)   
  - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (Ryusuke Konishi)   
  - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() (Ryusuke Konishi)   
  - serial: sc16is7xx: fix bug when first setting GPIO direction (Hugo Villeneuve)   
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (Zheng Wang)   
  - HID: wacom: remove the battery when the EKR is off (Aaron Armstrong Skomra)   
  - USB: serial: option: add FOXCONN T99W368/T99W373 product (Slark Xiao)   
  - USB: serial: option: add Quectel EM05G variant (0x030e) (Martin Kohn)   
  - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules (Christoph Hellwig)   
  - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff (Christoph Hellwig)   
  - mmc: au1xmmc: force non-modular build and remove symbol_get usage (Christoph Hellwig)   
  - ARM: pxa: remove use of symbol_get() (Arnd Bergmann)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.531.2.el7uek]
changelog:
  - rtnetlink: Reject negative ifindexes in RTM_NEWLINK (Ido Schimmel)  [Orabug: 35867429]  
  - Revert "rtnetlink: Reject negative ifindexes in RTM_NEWLINK" (Boris Ostrovsky)  [Orabug: 35867429]  
  - rds: Add proper refcnt when an RDS MR references an RDS Socket (Håkon Bugge)  [Orabug: 35836950]  
  - rds: Check for UAF in rds_destroy_mr (Håkon Bugge)  [Orabug: 35836950]  
  - xfs: reserve less log space when recovering log intent items (Darrick J. Wong)  [Orabug: 35587163]  
  - xfs: reserve blocks for refcount / rmap log item recovery (Darrick J. Wong)  [Orabug: 35587163]  
  - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Pin-yen Lin)   
  - dccp: fix dccp_v4_err()/dccp_v6_err() again (Eric Dumazet)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.531.2.1.el7uek]
changelog:
  - x86: change default to spec_store_bypass_disable=prctl spectre_v2_user=prctl (Andrea Arcangeli)  [Orabug: 35973454]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.2.el7uek]
changelog:
  - LTS version: v4.14.325 (Saeed Mirzamohammadi)   
  - Revert "ARM: ep93xx: fix missing-prototype warnings" (Greg Kroah-Hartman)   
  - Revert "MIPS: Alchemy: fix dbdma2" (Greg Kroah-Hartman)   
  - LTS version: v4.14.324 (Saeed Mirzamohammadi)   
  - dma-buf/sw_sync: Avoid recursive lock during fence signal (Rob Clark)   
  - scsi: core: raid_class: Remove raid_component_add() (Zhu Wang)   
  - scsi: snic: Fix double free in snic_tgt_create() (Zhu Wang)   
  - rtnetlink: Reject negative ifindexes in RTM_NEWLINK (Ido Schimmel)   
  - x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 (Feng Tang)   
  - media: vcodec: Fix potential array out-of-bounds in encoder queue_setup (Wei Chen)   
  - lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels (Helge Deller)   
  - batman-adv: Fix batadv_v_ogm_aggr_send memory leak (Remi Pommarel)   
  - batman-adv: Fix TT global entry leak when client roamed back (Remi Pommarel)   
  - batman-adv: Do not get eth header before batadv_check_management_packet (Remi Pommarel)   
  - batman-adv: Trigger events for auto adjusted MTU (Sven Eckelmann)   
  - ibmveth: Use dcbf rather than dcbfl (Michael Ellerman)   
  - ipvs: fix racy memcpy in proc_do_sync_threshold (Sishuai Gong)   
  - ipvs: Improve robustness to the ipvs sysctl (Junwei Hu)   
  - igb: Avoid starting unnecessary workqueues (Alessio Igor Bogani)   
  - sock: annotate data-races around prot->memory_pressure (Eric Dumazet)   
  - tracing: Fix memleak due to race between current_tracer and trace (Zheng Yejian)   
  - net: phy: broadcom: stub c45 read/write for 54810 (Justin Chen)   
  - net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure (Lin Ma)   
  - net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled (Jason Xing)   
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Kuniyuki Iwashima) [Orabug: 35814409] {CVE-2023-4622}
  - ASoC: rt5665: add missed regulator_bulk_disable (Zhang Shurong)   
  - netfilter: set default timeout to 3 secs for sctp shutdown send and recv state (Xin Long)   
  - test_firmware: prevent race conditions by a correct implementation of locking (Mirsad Goran Todorovac)   
  - binder: fix memory leak in binder_init() (Qi Zheng)   
  - serial: 8250: Fix oops for port->pm on uart_change_pm() (Tony Lindgren)   
  - mmc: wbsd: fix double mmc_free_host() in wbsd_init() (Yang Yingliang)   
  - cifs: Release folio lock on fscache read hit. (Russell Harmon via samba-technical)   
  - ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. (dengxiang)   
  - net: do not allow gso_size to be set to GSO_BY_FRAGS (Eric Dumazet)   
  - sock: Fix misuse of sk_under_memory_pressure() (Abel Wu)   
  - i40e: fix misleading debug logs (Andrii Staikov)   
  - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan)   
  - netfilter: nft_dynset: disallow object maps (Pablo Neira Ayuso)   
  - xfrm: add NULL check in xfrm_update_ae_params (Lin Ma) [Orabug: 35754508] {CVE-2023-3772}
  - ip_vti: fix potential slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - ip6_vti: fix slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - net: af_key: fix sadb_x_filter validation (Lin Ma)   
  - net: xfrm: Fix xfrm_address_filter OOB read (Lin Ma) [Orabug: 35923516] {CVE-2023-39194}
  - fbdev: mmp: fix value check in mmphw_probe() (Yuanjun Gong)   
  - drm/amdgpu: Fix potential fence use-after-free v2 (shanzhulig)   
  - Bluetooth: L2CAP: Fix use-after-free (Zhengping Jiang)   
  - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() (Armin Wolf)   
  - gfs2: Fix possible data races in gfs2_show_options() (Tuo Li)   
  - media: platform: mediatek: vpu: fix NULL ptr dereference (Hans Verkuil)   
  - media: v4l2-mem2mem: add lock to protect parameter num_rdy (Yunfei Dong)   
  - FS: JFS: Check for read-only mounted filesystem in txBegin (Immad Mir)   
  - FS: JFS: Fix null-ptr-deref Read in txBegin (Immad Mir)   
  - MIPS: dec: prom: Address -Warray-bounds warning (Gustavo A. R. Silva)   
  - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (Yogesh)   
  - udf: Fix uninitialized array access for some pathnames (Jan Kara)   
  - quota: fix warning in dqgrab() (Ye Bin)   
  - quota: Properly disable quotas when add_dquot_ref() fails (Jan Kara)   
  - ALSA: emu10k1: roll up loops in DSP setup code for Audigy (Oswald Buddenhagen)   
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init (hackyzh002)   
  - lib/mpi: Eliminate unused umul_ppmm definitions for MIPS (Nathan Chancellor)   
  - LTS version: v4.14.323 (Saeed Mirzamohammadi)   
  - alpha: remove __init annotation from exported page_is_ram() (Masahiro Yamada)   
  - scsi: core: Fix possible memory leak if device_add() fails (Zhu Wang)   
  - scsi: snic: Fix possible memory leak if device_add() fails (Zhu Wang)   
  - scsi: 53c700: Check that command slot is not NULL (Alexandra Diupina)   
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Michael Kelley)   
  - scsi: core: Fix legacy /proc parsing buffer overflow (Tony Battersby)   
  - netfilter: nf_tables: report use refcount overflow (Pablo Neira Ayuso)   
  - btrfs: don't stop integrity writeback too early (Christoph Hellwig)   
  - IB/hfi1: Fix possible panic during hotplug remove (Douglas Miller)   
  - drivers: net: prevent tun_build_skb() to exceed the packet size limit (Andrew Kanner)   
  - dccp: fix data-race around dp->dccps_mss_cache (Eric Dumazet)   
  - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan)   
  - net/packet: annotate data-races around tp->status (Eric Dumazet)   
  - drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes (Karol Herbst)   
  - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Kirill A. Shutemov)   
  - usb: dwc3: Properly handle processing of pending events (Elson Roy Serrao)   
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Alan Stern)   
  - iio: cros_ec: Fix the allocation size for cros_ec_command (Yiyuan Guo)   
  - test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation (Mirsad Goran Todorovac)   
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (Ryusuke Konishi)   
  - radix tree test suite: fix incorrect allocation size for pthreads (Colin Ian King)   
  - dmaengine: pl330: Return DMA_PAUSED when transaction is paused (Ilpo Järvinen)   
  - ipv6: adjust ndisc_is_useropt() to also return true for PIO (Maciej Żenczykowski)   
  - mmc: moxart: read scr register without changing byte order (Sergei Antonov)   
  - sparc: fix up arch_cpu_finalize_init() build breakage. (Greg Kroah-Hartman)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.5.el7uek]
changelog:
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng)  [Orabug: 35824288]  {CVE-2023-42753} 
  - netfilter: xt_u32: validate user space input (Wander Lairson Costa) [Orabug: 35923468] {CVE-2023-39192}
  - netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa) [Orabug: 35923499] {CVE-2023-39193}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.531.1.el7uek]
changelog:
  - ocfs2: ocfs2 crash due to invalid h_next_leaf_blk value in extent block (Gautham Ananthakrishna)  [Orabug: 35859332]  
  - bnxt_en: fix NULL dereference in bnxt_flash_package_from_file() (Samasth Norway Ananda)  [Orabug: 35848949]  
  - LTS version: v4.14.326 (Saeed Mirzamohammadi)   
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (valis) [Orabug: 35814287] {CVE-2023-4207} 
  - mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write (William Zhang)   
  - mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller (William Zhang)   
  - mtd: rawnand: brcmnand: Fix potential false time out warning (William Zhang)   
  - mtd: rawnand: brcmnand: Fix crash during the panic_write (William Zhang)   
  - nfsd: fix change_info in NFSv4 RENAME replies (Jeff Layton)   
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (Filipe Manana)   
  - attr: block mode changes of symlinks (Christian Brauner)   
  - md/raid1: fix error: ISO C90 forbids mixed declarations (Nigel Croxon)   
  - kobject: Add sanity check for kset->kobj.ktype in kset_register() (Zhen Lei)   
  - serial: cpm_uart: Avoid suspicious locking (Christophe Leroy)   
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (Konstantin Shelekhin)   
  - usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc (Ma Ke)   
  - media: pci: cx23885: replace BUG with error return (Hans Verkuil)   
  - media: tuners: qt1010: replace BUG_ON with a regular error (Hans Verkuil)   
  - iio: core: Use min() instead of min_t() to make code more robust (Andy Shevchenko)   
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (Zhang Shurong)   
  - media: anysee: fix null-ptr-deref in anysee_master_xfer (Zhang Shurong)   
  - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer (Zhang Shurong)   
  - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() (Zhang Shurong)   
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer (Zhang Shurong)   
  - powerpc/pseries: fix possible memory leak in ibmebus_bus_init() (ruanjinjie)   
  - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (Liu Shixin via Jfs-discussion)   
  - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (Andrew Kanner)   
  - ext2: fix datatype of block number in ext2_xattr_set2() (Georg Ottinger)   
  - md: raid1: fix potential OOB in raid1_remove_disk() (Zhang Shurong)   
  - drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable() (Tuo Li)   
  - alx: fix OOB-read compiler warning (GONG, Ruiqi)   
  - tpm_tis: Resend command to recover from data transfer errors (Alexander Steffen)   
  - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (Mark O'Donovan)   
  - wifi: mwifiex: fix fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix printk specifier (Dongliang Mu)   
  - hw_breakpoint: fix single-stepping when using bpf_overflow_handler (Tomislav Novak)   
  - ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 (Jiri Slaby (SUSE))   
  - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (Abhishek Mainkar)   
  - btrfs: output extra debug info if we failed to find an inline backref (Qu Wenruo)   
  - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Fedor Pchelkin)   
  - parisc: Drop loops_per_jiffy from per_cpu struct (Helge Deller)   
  - kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). (Kuniyuki Iwashima)   
  - ixgbe: fix timestamp configuration code (Vadim Fedorenko)   
  - kcm: Fix memory leak in error path of kcm_sendmsg() (Shigeru Yoshida)   
  - net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() (Hangyu Hua)   
  - ata: pata_ftide010: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - ata: sata_gemini: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - igb: Change IGB_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - kcm: Destroy mutex in kcm_exit_net() (Shigeru Yoshida)   
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis) [Orabug: 35814456] {CVE-2023-4921}
  - af_unix: Fix data race around sk->sk_err. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around sk->sk_shutdown. (Kuniyuki Iwashima)   
  - af_unix: Fix data-race around unix_tot_inflight. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around user->unix_inflight. (Kuniyuki Iwashima)   
  - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr (Alex Henrie)   
  - igb: disable virtualization features on 82580 (Corinna Vinschen)   
  - net: read sk->sk_family once in sk_mc_loop() (Eric Dumazet)   
  - pwm: lpc32xx: Remove handling of PWM channels (Vladimir Zapolskiy)   
  - watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load (Raag Jadav)   
  - x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() (Sean Christopherson)   
  - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info (Fedor Pchelkin)   
  - clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock (Dmitry Baryshkov)   
  - parisc: led: Reduce CPU overhead for disk & lan LED computation (Helge Deller)   
  - parisc: led: Fix LAN receive and transmit LEDs (Helge Deller)   
  - drm/ast: Fix DRAM init on AST2200 (Thomas Zimmermann)   
  - fbdev/ep93xx-fb: Do not assign to struct fb_info.dev (Thomas Zimmermann)   
  - scsi: qla2xxx: Turn off noisy message log (Quinn Tran)   
  - scsi: qla2xxx: fix inconsistent TMF timeout (Quinn Tran)   
  - crypto: stm32 - fix loop iterating through scatterlist for DMA (Thomas Bourgoin)   
  - pstore/ram: Check start of empty przs during init (Enlin Mu)   
  - net: handle ARPHRD_PPP in dev_is_mac_header_xmit() (Nicolas Dichtel)   
  - X.509: if signature is unsupported skip validation (Thore Sommer)   
  - dccp: Fix out of bounds access in DCCP error handler (Jann Horn)   
  - parisc: Fix /proc/cpuinfo output for lscpu (Helge Deller)   
  - procfs: block chmod on /proc/thread-self/comm (Aleksa Sarai)   
  - Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" (Bjorn Helgaas)   
  - ntb: Fix calculation ntb_transport_tx_free_entry() (Dave Jiang)   
  - ntb: Clean up tx tail index on link down (Dave Jiang)   
  - ntb: Drop packets when qp link is down (Dave Jiang)   
  - media: dvb: symbol fixup for dvb_attach() (Greg Kroah-Hartman)   
  - backlight/lv5207lp: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/bd6107: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/gpio_backlight: Compare against struct fb_info.device (Thomas Zimmermann)   
  - ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() (Gustavo A. R. Silva)   
  - ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (Takashi Iwai)   
  - PM / devfreq: Fix leak in devfreq_dev_release() (Boris Brezillon)   
  - igb: set max size RX buffer when store bad packet is enabled (Radoslaw Tyl) [Orabug: 35924097] {CVE-2023-45871}
  - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU (Eric Dumazet) [Orabug: 35924001] {CVE-2023-42752}
  - dmaengine: ste_dma40: Add missing IRQ check in d40_probe (ruanjinjie)   
  - rpmsg: glink: Add check for kstrdup (Jiasheng Jiang)   
  - HID: multitouch: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu)   
  - Revert "IB/isert: Fix incorrect release of isert connection" (Leon Romanovsky)   
  - amba: bus: fix refcount leak (Peng Fan)   
  - serial: tegra: handle clk prepare error in tegra_uart_hw_init() (Yi Yang)   
  - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (Chengfeng Ye)   
  - scsi: core: Use 32-bit hostnum in scsi_host_lookup() (Tony Battersby)   
  - cgroup:namespace: Remove unused cgroup_namespaces_init() (Lu Jialin)   
  - USB: gadget: f_mass_storage: Fix unused variable warning (Alan Stern)   
  - media: go7007: Remove redundant if statement (Colin Ian King)   
  - dma-buf/sync_file: Fix docs syntax (Rob Clark)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (Oleksandr Natalenko)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (Oleksandr Natalenko)   
  - x86/APM: drop the duplicate APM_MINOR_DEV macro (Randy Dunlap)   
  - scsi: qla4xxx: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: be2iscsi: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() (Lin Ma)   
  - usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() (Xu Yang)   
  - media: mediatek: vcodec: Return NULL if no vdec_fb is found (Irui Wang)   
  - media: cx24120: Add retval check for cx24120_message_send() (Daniil Dulov)   
  - media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() (Christophe JAILLET)   
  - media: dib7000p: Fix potential division by zero (Daniil Dulov)   
  - drivers: usb: smsusb: fix error handling code in smsusb_init_device (Dongliang Mu)   
  - NFSD: da_addr_body field missing in some GETDEVICEINFO replies (Chuck Lever)   
  - fs: lockd: avoid possible wrong NULL parameter (Su Hui)   
  - jfs: validate max amount of blocks before allocation. (Alexei Filippov)   
  - powerpc/iommu: Fix notifiers being shared by PCI and VIO buses (Russell Currey)   
  - nfs/blocklayout: Use the passed in gfp flags (Dan Carpenter)   
  - wifi: ath10k: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: pciehp: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: Mark NVIDIA T4 GPUs to avoid bus reset (Wu Zongyong)   
  - clk: sunxi-ng: Modify mismatched function name (Zhang Jianhua)   
  - drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() (Minjie Du)   
  - ALSA: ac97: Fix possible error value of *rac97 (Su Hui)   
  - audit: fix possible soft lockup in __audit_inode_child() (Gaosheng Cui)   
  - smackfs: Prevent underflow in smk_set_cipso() (Dan Carpenter)   
  - of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() (Ruan Jinjie)   
  - drm: adv7511: Fix low refresh rate register for ADV7533/5 (Bogdan Togorean)   
  - ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: BCM53573: Add cells sizes to PCIe node (Rafał Miłecki)   
  - netrom: Deny concurrent connect(). (Kuniyuki Iwashima)   
  - net: arcnet: Do not call kfree_skb() under local_irq_disable() (Jinjie Ruan)   
  - wifi: ath9k: use IS_ERR() with debugfs_create_dir() (Wang Ming)   
  - wifi: mwifiex: avoid possible NULL skb pointer dereference (Dmitry Antipov)   
  - wifi: ath9k: protect WMI command response buffer replacement with a lock (Fedor Pchelkin)   
  - wifi: mwifiex: Fix missed return in oob checks failed path (Polaris Pi)   
  - wifi: mwifiex: fix memory leak in mwifiex_histogram_read() (Dmitry Antipov)   
  - fs: ocfs2: namei: check return value of ocfs2_add_entry() (Artem Chernyshev)   
  - lwt: Check LWTUNNEL_XMIT_CONTINUE strictly (Yan Zhai)   
  - crypto: caam - fix unchecked return value error (Gaurav Jain)   
  - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Menglong Dong)   
  - Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (Yuanjun Gong)   
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Polaris Pi)   
  - can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM (Marc Kleine-Budde)   
  - spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() (Zhang Shurong)   
  - regmap: rbtree: Use alloc_flags for memory allocations (Dan Carpenter)   
  - cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() (Liao Chang)   
  - fs: Fix error checking for d_hash_and_lookup() (Wang Ming)   
  - reiserfs: Check the return value from __getblk() (Matthew Wilcox)   
  - Revert "net: macsec: preserve ingress frame ordering" (Sabrina Dubroca)   
  - udf: Handle error when adding extent to a file (Jan Kara)   
  - udf: Check consistency of Space Bitmap Descriptor (Vladislav Efanov)   
  - powerpc/32s: Fix assembler warning about r0 (Christophe Leroy)   
  - powerpc/32: Include .branch_lt in data section (Joel Stanley)   
  - ALSA: seq: oss: Fix racy open/close of MIDI devices (Takashi Iwai)   
  - cifs: add a warning when the in-flight count goes negative (Shyam Prasad N)   
  - sctp: handle invalid error codes without calling BUG() (Dan Carpenter)   
  - bnx2x: fix page fault following EEH recovery (David Christensen)   
  - netlabel: fix shift wrapping bug in netlbl_catmap_setlong() (Dmitry Mastykin)   
  - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock (Chengfeng Ye)   
  - idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM (Baoquan He)   
  - net: usb: qmi_wwan: add Quectel EM05GV2 (Martin Kohn)   
  - security: keys: perform capable check only on privileged operations (Christian Göttsche)   
  - ASoc: codecs: ES8316: Fix DMIC config (Edgar)   
  - fs/nls: make load_nls() take a const parameter (Saeed Mirzamohammadi)   
  - s390/dasd: use correct number of retries for ERP requests (Stefan Haberland)   
  - m68k: Fix invalid .section syntax (Ben Hutchings)   
  - ethernet: atheros: fix return value check in atl1c_tso_csum() (Yuanjun Gong)   
  - ASoC: da7219: Flush pending AAD IRQ when suspending (Dmytro Maluka)   
  - 9p: virtio: make sure 'offs' is initialized in zc_request (Dominique Martinet)   
  - lib/ubsan: remove returns-nonnull-attribute checks (Andrey Ryabinin)   
  - pinctrl: amd: Don't show `Invalid config param` errors (Mario Limonciello)   
  - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (Ryusuke Konishi)   
  - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() (Ryusuke Konishi)   
  - serial: sc16is7xx: fix bug when first setting GPIO direction (Hugo Villeneuve)   
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (Zheng Wang) [Orabug: 35282808] {CVE-2023-1989}
  - HID: wacom: remove the battery when the EKR is off (Aaron Armstrong Skomra)   
  - USB: serial: option: add FOXCONN T99W368/T99W373 product (Slark Xiao)   
  - USB: serial: option: add Quectel EM05G variant (0x030e) (Martin Kohn)   
  - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules (Christoph Hellwig)   
  - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff (Christoph Hellwig)   
  - mmc: au1xmmc: force non-modular build and remove symbol_get usage (Christoph Hellwig)   
  - ARM: pxa: remove use of symbol_get() (Arnd Bergmann)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.1.el7uek]
changelog:
  - rds/ib: Preserve dest qp num in the connect request (Arumugam Kolappan)  [Orabug: 35649849]  
  - rds: Provision to allow all trace points at module load time (Arumugam Kolappan)  [Orabug: 35355776]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.2.el7uek]
changelog:
  - x86: change default to spec_store_bypass_disable=prctl spectre_v2_user=prctl (Andrea Arcangeli)  [Orabug: 35905888]  
  - LTS version: 4.14.328 (Saeed Mirzamohammadi)   
  - Bluetooth: hci_event: Fix using memcmp when comparing keys (Luiz Augusto von Dentz)   
  - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (Kees Cook)   
  - Bluetooth: hci_sock: fix slab oob read in create_monitor_event (Edward AD)   
  - gpio: vf610: set value before the direction to avoid a glitch (Haibo Chen)   
  - s390/pci: fix iommu bitmap allocation (Niklas Schnelle)   
  - perf: Disallow mis-matched inherited group reads (Saeed Mirzamohammadi)   
  - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (Puliang Lu)   
  - USB: serial: option: add entry for Sierra EM9191 with new firmware (Benoît Monin)   
  - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (Fabio Porcedda)   
  - ACPI: irq: Fix incorrect return value in acpi_register_gsi() (Sunil V L)   
  - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" (Andy Shevchenko)   
  - mmc: core: Capture correct oemid-bits for eMMC cards (Avri Altman)   
  - sky2: Make sure there is at least one frag_addr available (Kees Cook)   
  - wifi: cfg80211: avoid leaking stack data into trace (Benjamin Berg)   
  - wifi: mac80211: allow transmitting EAPOL frames with tainted key (Wen Gong)   
  - Bluetooth: hci_core: Fix build warnings (Luiz Augusto von Dentz)   
  - Bluetooth: Avoid redundant authentication (Ying Hsu)   
  - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (Ma Ke)   
  - tracing: relax trace_event_eval_update() execution with cond_resched() (Clément Léger)   
  - ata: libata-eh: Fix compilation warning in ata_eh_link_report() (Damien Le Moal)   
  - gpio: timberdale: Fix potential deadlock on &tgpio->lock (Chengfeng Ye)   
  - overlayfs: set ctime when setting mtime and atime (Jeff Layton)   
  - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (Heiner Kallweit)   
  - btrfs: initialize start_slot in btrfs_log_prealloc_extents (Josef Bacik)   
  - ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone (Tony Lindgren)   
  - i40e: prevent crash on probe if hw registers have invalid values (Michal Schmidt)   
  - net: usb: smsc95xx: Fix an error code in smsc95xx_reset() (Dan Carpenter)   
  - net: rfkill: gpio: prevent value glitch during probe (Josua Mayer)   
  - net: ipv6: fix return value check in esp_remove_trailer (Ma Ke)   
  - net: ipv4: fix return value check in esp_remove_trailer (Ma Ke)   
  - xfrm: fix a data-race in xfrm_gen_index() (Saeed Mirzamohammadi)   
  - netfilter: nft_payload: fix wrong mac header matching (Florian Westphal)   
  - KVM: x86: Mask LVTPC when handling a PMI (Jim Mattson)   
  - regmap: fix NULL deref on lookup (Johan Hovold)   
  - nfc: nci: fix possible NULL pointer dereference in send_acknowledge() (Krzysztof Kozlowski)   
  - Bluetooth: avoid memcmp() out of bounds warning (Arnd Bergmann)   
  - Bluetooth: hci_event: Fix coding style (Luiz Augusto von Dentz)   
  - Bluetooth: vhci: Fix race when opening vhci device (Arkadiusz Bokowy)   
  - Bluetooth: Fix a refcnt underflow problem for hci_conn (Ziyang Xuan)   
  - Bluetooth: Reject connection with the device which has same BD_ADDR (Lee, Chun-Yi)   
  - Bluetooth: hci_event: Ignore NULL link key (Lee, Chun-Yi)   
  - usb: hub: Guard against accesses to uninitialized BOS descriptors (Ricardo Cañuelo)   
  - x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs (Borislav Petkov (AMD))   
  - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call (Krishna Kurapati)   
  - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio (Piyush Mehta)   
  - pinctrl: avoid unsafe code pattern in find_pinctrl() (Dmitry Torokhov)   
  - cgroup: Remove duplicates in cgroup v1 tasks file (Michal Koutný)   
  - Input: xpad - add PXN V900 support (Matthias Berndt)   
  - Input: powermate - fix use-after-free in powermate_config_complete (Javier Carrasco)   
  - ceph: fix incorrect revoked caps assert in ceph_fill_file_size() (Xiubo Li)   
  - mcb: remove is_added flag from mcb_device struct (Jorge Sanjuan Garcia)   
  - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug (Alexander Zangerl)   
  - iio: pressure: bmp280: Fix NULL pointer exception (Phil Elwell)   
  - usb: musb: Modify the "HWVers" register address (Xingxing Luo)   
  - usb: musb: Get the musb_qh poniter after musb_giveback (Xingxing Luo)   
  - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read (Javier Carrasco)   
  - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer (Wesley Cheng)   
  - workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() (Waiman Long)   
  - nfc: nci: assert requested protocol is valid (Jeremy Cline)   
  - ixgbe: fix crash with empty VF macvlan list (Dan Carpenter)   
  - drm/vmwgfx: fix typo of sizeof argument (Konstantin Meskhidze)   
  - ieee802154: ca8210: Fix a potential UAF in ca8210_probe (Dinghao Liu)   
  - drm: etvnaviv: fix bad backport leading to warning (Martin Fuzzey)   
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (Hans de Goede)   
  - RDMA/cxgb4: Check skb value for failure to allocate (Artem Chernyshev)   
  - LTS version: 4.14.327 (Saeed Mirzamohammadi)   
  - parisc: Restore __ldcw_align for PA-RISC 2.0 processors (John David Anglin)   
  - RDMA/mlx5: Fix NULL string error (Shay Drory)   
  - RDMA/cma: Fix truncation compilation warning in make_cma_ports (Leon Romanovsky)   
  - gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() (Bartosz Golaszewski)   
  - IB/mlx4: Fix the size of a buffer in add_port_entries() (Christophe JAILLET)   
  - cpupower: add Makefile dependencies for install targets (Ivan Babrou)   
  - sctp: update hb timer immediately after users change hb_interval (Xin Long)   
  - sctp: update transport state when processing a dupcook packet (Xin Long)   
  - tcp: fix delayed ACKs for MSS boundary condition (Neal Cardwell)   
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Shigeru Yoshida)   
  - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (David Howells)   
  - modpost: add missing else to the "of" check (Mauricio Faria de Oliveira)   
  - scsi: target: core: Fix deadlock due to recursive locking (Junxiao Bi)   
  - regmap: rbtree: Fix wrong register marked as in-cache when creating new node (Richard Fitzgerald)   
  - drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close() (Alexandra Diupina)   
  - ubi: Refuse attaching if mtd's erasesize is 0 (Zhihao Cheng)   
  - wifi: mwifiex: Fix tlv_buf_left calculation (Gustavo A. R. Silva)   
  - scsi: zfcp: Fix a double put in zfcp_port_enqueue() (Dinghao Liu)   
  - media: dvb: symbol fixup for dvb_attach() - again (Greg Kroah-Hartman)   
  - ata: libata: disallow dev-initiated LPM transitions to unsupported states (Niklas Cassel)   
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Budimir Markovic) [Orabug: 35810543] {CVE-2023-4623}
  - ext4: fix rec_len verify error (Shida Zhang)   
  - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (George Kennedy)   
  - fs: binfmt_elf_efpic: fix personality for ELF-FDPIC (Greg Ungerer)   
  - ata: libata-sata: increase PMP SRST timeout to 10s (Matthias Schiffer)   
  - ata: libata-core: Fix port and device removal (Damien Le Moal)   
  - ata: libata-core: Fix ata_port_request_pm() locking (Damien Le Moal)   
  - btrfs: properly report 0 avail for very full file systems (Josef Bacik)   
  - i2c: i801: unregister tco_pdev in i801_probe() error path (Heiner Kallweit)   
  - ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES (Niklas Cassel)   
  - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() (Pan Bian)   
  - serial: 8250_port: Check IRQ data before use (Andy Shevchenko)   
  - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Mika Westerberg)   
  - watchdog: iTCO_wdt: No need to stop the timer in probe (Mika Westerberg)   
  - ata: libahci: clear pending interrupt status (Szuying Chen)   
  - ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones (Hannes Reinecke)   
  - fbdev/sh7760fb: Depend on FB=y (Thomas Zimmermann)   
  - ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset() (Niklas Cassel)   
  - ring-buffer: Avoid softlockup in ring_buffer_resize() (Zheng Yejian)   
  - selftests/ftrace: Correctly enable event in instance-event.tc (Zheng Yejian)   
  - parisc: irq: Make irq_stack_union static to avoid sparse warning (Helge Deller)   
  - parisc: iosapic.c: Fix sparse warnings (Helge Deller)   
  - parisc: sba: Fix compile warning wrt list of SBA devices (Helge Deller)   
  - xtensa: boot/lib: fix function prototypes (Max Filippov)   
  - xtensa: boot: don't add include-dirs (Randy Dunlap)   
  - clk: tegra: fix error return case for recalc_rate (Timo Alho)   
  - i2c: mux: demux-pinctrl: check the return value of devm_kstrdup() (Xiaoke Wang)   
  - gpio: tb10x: Fix an error handling path in tb10x_gpio_probe() (Christophe JAILLET)   
  - team: fix null-ptr-deref when team device type is changed (Ziyang Xuan)   
  - powerpc/perf/hv-24x7: Update domain value check (Kajol Jain)   
  - ipv4: fix null-deref in ipv4_link_failure (Kyle Zeng)   
  - NFS/pNFS: Report EINVAL errors from connect() to the server (Trond Myklebust)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.3.el7uek]
changelog:
  - Revert "mmc: core: Capture correct oemid-bits for eMMC cards" (Dominique Martinet)   
  - media: dvb-usb-v2: af9035: fix missing unlock (Hans Verkuil)   
  - perf/core: Fix potential NULL deref (Peter Zijlstra)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.3.1.el7uek]
changelog:
  - KVM: x86: Don't unnecessarily force masterclock update on vCPU hotplug (Sean Christopherson)  [Orabug: 36148712]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.533.1.el7uek]
changelog:
  - vhost-scsi: fix vqs allocation memory corruption (Dongli Zhang)  [Orabug: 36110885]  
  - xfs: try to avoid allocation blocking on busy extents (Mark Tinguely)  [Orabug: 35960820]  
  - KVM: x86: Don't unnecessarily force masterclock update on vCPU hotplug (Sean Christopherson)  [Orabug: 35910097]


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.533.2.el7uek]
changelog:
  - LTS version: 4.14.334 (Yifei Liu)   
  - powerpc/ftrace: Fix stack teardown in ftrace_no_trace (Naveen N Rao)   
  - powerpc/ftrace: Create a dummy stackframe to fix stack unwind (Naveen N Rao)   
  - ring-buffer: Fix memory leak of free page (Steven Rostedt (Google))   
  - team: Fix use-after-free when an option instance allocation fails (Florent Revest)   
  - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS (Baokun Li)   
  - HID: hid-asus: add const to read-only outgoing usb buffer (Denis Benato)   
  - net: usb: qmi_wwan: claim interface 4 for ZTE MF290 (Lech Perczak)   
  - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation (Linus Torvalds)   
  - HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad (Aoba K)   
  - HID: hid-asus: reset the backlight brightness level on resume (Denis Benato)   
  - platform/x86: intel_telemetry: Fix kernel doc descriptions (Andy Shevchenko)   
  - bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (Coly Li)   
  - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" (Ming Lei)   
  - appletalk: Fix Use-After-Free in atalk_ioctl (Hyunwoo Kim)   
  - vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() (Nikolay Kuratov)   
  - sign-file: Fix incorrect return values check (Yusong Gao)   
  - net: Remove acked SYN flag from packet in the transmit queue correctly (Dong Chenchen)   
  - qed: Fix a potential use-after-free in qed_cxt_tables_alloc (Dinghao Liu)   
  - net/rose: Fix Use-After-Free in rose_ioctl (Hyunwoo Kim)   
  - atm: Fix Use-After-Free in do_vcc_ioctl (Hyunwoo Kim)   
  - atm: solos-pci: Fix potential deadlock on &tx_queue_lock (Chengfeng Ye)   
  - atm: solos-pci: Fix potential deadlock on &cli_queue_lock (Chengfeng Ye)   
  - qca_spi: Fix reset behavior (Stefan Wahren)   
  - qca_debug: Fix ethtool -G iface tx behavior (Stefan Wahren)   
  - qca_debug: Prevent crash on TX ring changes (Stefan Wahren)   
  - LTS version: 4.14.333 (Yifei Liu)   
  - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group (Ido Schimmel)   
  - psample: Require 'CAP_NET_ADMIN' when joining "packets" group (Ido Schimmel)   
  - genetlink: add CAP_NET_ADMIN test for multicast bind (Ido Schimmel)   
  - netlink: don't call ->netlink_bind with table lock held (Ido Schimmel)   
  - nilfs2: fix missing error check for sb_set_blocksize call (Ryusuke Konishi)   
  - KVM: s390/mm: Properly reset no-dat (Claudio Imbrenda)   
  - serial: 8250_omap: Add earlycon support for the AM654 UART controller (Ronald Wahl)   
  - serial: sc16is7xx: address RX timeout interrupt errata (Daniel Mack)   
  - parport: Add support for Brainboxes IX/UC/PX parallel cards (Cameron Williams)   
  - packet: Move reference count in packet_sock to atomic_long_t (Daniel Borkmann)   
  - tracing: Fix a possible race when disabling buffered events (Petr Pavlu)   
  - tracing: Fix incomplete locking when disabling buffered events (Petr Pavlu)   
  - tracing: Always update snapshot buffer size (Steven Rostedt (Google))   
  - nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() (Ryusuke Konishi)   
  - ALSA: pcm: fix out-of-bounds in snd_pcm_state_names (Jason Zhang)   
  - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() (Dinghao Liu)   
  - tracing: Fix a warning when allocating buffered events fails (Petr Pavlu)   
  - hwmon: (acpi_power_meter) Fix 4.29 MW bug (Armin Wolf)   
  - RDMA/bnxt_re: Correct module description string (Kalesh AP)   
  - tcp: do not accept ACK of bytes we never sent (Eric Dumazet)   
  - net: hns: fix fake link up on xge port (Yonglong Liu)   
  - drm/amdgpu: correct chunk_ptr to a pointer to chunk. (YuanShang)   
  - tg3: Increment tx_dropped in tg3_tso_bug() (Alex Pakhunov)   
  - tg3: Move the [rt]x_dropped counters to tg3_napi (Alex Pakhunov)   
  - LTS version: 4.14.332 (Yifei Liu)   
  - driver core: Release all resources during unbind before updating device links (Saravana Kannan)   
  - net: ravb: Start TX queues after HW initialization succeeded (Claudiu Beznea)   
  - ravb: Fix races between ravb_tx_timeout_work() and net related ops (Yoshihiro Shimoda)   
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet (Zhengchao Shao)   
  - btrfs: send: ensure send_fd is writable (Jann Horn)   
  - btrfs: fix off-by-one when checking chunk map includes logical address (Filipe Manana)   
  - powerpc: Don't clobber f0/vs0 during fp|altivec register save (Timothy Pearson)   
  - dm verity: don't perform FEC for failed readahead IO (Wu Bo)   
  - dm-verity: align struct dm_verity_fec_io properly (Mikulas Patocka)   
  - firewire: core: fix possible memory leak in create_units() (Yang Yingliang)   
  - pinctrl: avoid reload of p state in list iteration (Maria Yu)   
  - usb: dwc3: set the dma max_seg_size (Ricardo Ribalda)   
  - USB: serial: option: don't claim interface 4 for ZTE MF290 (Lech Perczak)   
  - USB: serial: option: fix FM101R-GL defines (Puliang Lu)   
  - USB: serial: option: add Fibocom L7xx modules (Victor Fragoso)   
  - bcache: prevent potential division by zero error (Rand Deeb)   
  - bcache: check return value from btree_node_alloc_replacement() (Coly Li)   
  - USB: serial: option: add Luat Air72*U series products (Asuna Yang)   
  - s390/dasd: protect device queue against concurrent access (Jan Höppner)   
  - mtd: rawnand: brcmnand: Fix ecc chunk calculation for erased page bitfips (Claire Lin)   
  - net: axienet: Fix check for partial TX checksum (Samuel Holland)   
  - amd-xgbe: propagate the correct speed and duplex status (Raju Rangoju)   
  - amd-xgbe: handle corner-case during sfp hotplug (Raju Rangoju)   
  - arm/xen: fix xen_vcpu_info allocation alignment (Stefano Stabellini)   
  - net: usb: ax88179_178a: fix failed operations during ax88179_reset (Jose Ignacio Tornos Martinez)   
  - ipv4: Correct/silence an endian warning in __ip_do_redirect (Kunwu Chan)   
  - drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full (Jonas Karlman)   
  - ata: pata_isapnp: Add missing error check for devm_ioport_map() (Chen Ni)   
  - drm/panel: simple: Fix Innolux G101ICE-L01 timings (Marek Vasut)   
  - RDMA/irdma: Prevent zero-length STAG registration (Christopher Bednarz)   
  - LTS version: 4.14.331 (Yifei Liu)   
  - net: sched: fix race condition in qdisc_graft() (Eric Dumazet)   
  - scsi: virtio_scsi: limit number of hw queues by nr_cpu_ids (Dongli Zhang)   
  - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (Kemeng Shi)   
  - ext4: correct return value of ext4_convert_meta_bg (Kemeng Shi)   
  - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Kemeng Shi)   
  - ext4: apply umask if ACL support is disabled (Max Kellermann)   
  - media: venus: hfi: fix the check to handle session buffer requirement (Vikash Garodia)   
  - media: sharp: fix sharp encoding (Sean Young)   
  - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte (Heiner Kallweit)   
  - net: dsa: lan9303: consequently nested-lock physical MDIO (Alexander Sverdlin)   
  - ALSA: info: Fix potential deadlock at disconnection (Takashi Iwai)   
  - parisc/pgtable: Do not drop upper 5 address bits of physical address (Helge Deller)   
  - parisc: Prevent booting 64-bit kernels on PA1.x machines (Helge Deller)   
  - mcb: fix error handling for different scenarios when parsing (Sanjuán García, Jorge)   
  - jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev (Zhihao Cheng)   
  - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware (Herve Codina)   
  - mmc: meson-gx: Remove setting of CMD_CFG_ERROR (Rong Chen)   
  - PM: hibernate: Clean up sync_read handling in snapshot_write_next() (Brian Geffon)   
  - PM: hibernate: Use __get_safe_page() rather than touching the list (Brian Geffon)   
  - mmc: vub300: fix an error code (Dan Carpenter)   
  - PCI/sysfs: Protect driver's D3cold preference from user space (Lukas Wunner)   
  - hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (David Woodhouse)   
  - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() (Paul Moore)   
  - audit: don't take task_lock() in audit_exe_compare() code path (Paul Moore)   
  - KVM: x86: Ignore MSR_AMD64_TW_CFG access (Maciej S. Szmigiero)   
  - randstruct: Fix gcc-plugin performance mode to stay in group (Kees Cook)   
  - media: venus: hfi: add checks to perform sanity on queue pointers (Vikash Garodia)   
  - pwm: Fix double shift bug (Dan Carpenter)   
  - gfs2: ignore negated quota changes (Bob Peterson)   
  - media: vivid: avoid integer overflow (Hans Verkuil)   
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Rajeshwar R Shinde)   
  - i2c: sun6i-p2wi: Prevent potential division by zero (Axel Lin)   
  - tty: vcc: Add check for kstrdup() in vcc_probe() (Yi Yang)   
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (Wenchao Hao)   
  - atm: iphase: Do PCI error checks on own line (Ilpo Järvinen)   
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream (Cezary Rojewski)   
  - jfs: fix array-index-out-of-bounds in diAlloc (Manas Ghandat)   
  - jfs: fix array-index-out-of-bounds in dbFindLeaf (Manas Ghandat)   
  - fs/jfs: Add validity check for db_maxag and db_agpref (Juntong Deng)   
  - fs/jfs: Add check for negative db_l2nbperpage (Juntong Deng)   
  - RDMA/hfi1: Use FIELD_GET() to extract Link Width (Ilpo Järvinen)   
  - crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin)   
  - selftests/efivarfs: create-read: fix a resource leak (zhujun2)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (Mario Limonciello)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (Mario Limonciello)   
  - net: annotate data-races around sk->sk_dst_pending_confirm (Eric Dumazet)   
  - wifi: ath10k: fix clang-specific fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix clang-specific fortify warnings (Dmitry Antipov)   
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Ping-Ke Shih)   
  - x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size (Mike Rapoport (IBM))   
  - clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware (Ronald Wahl)   
  - clocksource/drivers/timer-imx-gpt: Fix potential memory leak (Jacky Bai)   
  - locking/ww_mutex/test: Fix potential workqueue corruption (John Stultz)   
  - LTS version: 4.14.330 (Yifei Liu)   
  - btrfs: use u64 for buffer sizes in the tree search ioctls (Filipe Manana)   
  - fbdev: fsl-diu-fb: mark wr_reg_wa() static (Arnd Bergmann)   
  - netfilter: xt_recent: fix (increase) ipv6 literal buffer length (Maciej Żenczykowski)   
  - tg3: power down device only on SYSTEM_POWER_OFF (George Shuklin)   
  - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. (Kuniyuki Iwashima)   
  - dccp: Call security_inet_conn_request() after setting IPv4 addresses. (Kuniyuki Iwashima)   
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Shigeru Yoshida)   
  - llc: verify mac len before reading mac header (Willem de Bruijn)   
  - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume (Florian Fainelli)   
  - media: s3c-camif: Avoid inappropriate kfree() (Katya Orlova)   
  - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: ds: fix refcount leak in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: cs: fix possible hung task and memory leak pccardd() (Yang Yingliang)   
  - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() (Christophe JAILLET)   
  - USB: usbip: fix stub_dev hub disconnect (Jonas Blixt)   
  - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave() (Jinjie Ruan)   
  - dmaengine: ti: edma: handle irq_of_parse_and_map() errors (Dan Carpenter)   
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (Jia-Ju Bai)   
  - tty: tty_jobctrl: fix pid memleak in disassociate_ctty() (Yi Yang)   
  - mfd: dln2: Fix double put in dln2_probe (Dinghao Liu)   
  - ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails (Cezary Rojewski)   
  - sh: bios: Revive earlyprintk support (Geert Uytterhoeven)   
  - RDMA/hfi1: Workaround truncation compilation error (Leon Romanovsky)   
  - ext4: move 'ix' sanity check to corrent position (Gou Hao)   
  - ARM: 9321/1: memset: cast the constant byte to unsigned char (Kursad Oney)   
  - hwrng: geode - fix accessing registers (Jonas Gorski)   
  - firmware: ti_sci: Mark driver as non removable (Dhruva Gole)   
  - ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator (Krzysztof Kozlowski)   
  - drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe() (Christophe JAILLET)   
  - drm/radeon: possible buffer overflow (Konstantin Meskhidze)   
  - drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs (Jonas Karlman)   
  - platform/x86: wmi: Fix probe failure when failing to register WMI devices (Armin Wolf)   
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: keystone: pll: fix a couple NULL vs IS_ERR() checks (Dan Carpenter)   
  - clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies (Devi Priya)   
  - ipv6: avoid atomic fragment on GSO packets (Yan Zhai)   
  - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() (Christophe JAILLET)   
  - thermal: core: prevent potential string overflow (Dan Carpenter)   
  - wifi: rtlwifi: fix EDCA limit set by BT coexistence (Dmitry Antipov)   
  - tcp_metrics: do not create an entry from tcp_init_metrics() (Eric Dumazet)   
  - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics() (Eric Dumazet)   
  - i40e: fix potential memory leaks in i40e_remove() (Andrii Staikov)   
  - LTS version: 4.14.329 (Yifei Liu)   
  - tty: 8250: Add support for Intashield IS-100 (Cameron Williams)   
  - tty: 8250: Add support for Brainboxes UP cards (Cameron Williams)   
  - tty: 8250: Add support for additional Brainboxes UC cards (Cameron Williams)   
  - tty: 8250: Remove UC-257 and UC-431 (Cameron Williams)   
  - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility (LihaSika)   
  - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device (Vicki Pfau)   
  - remove the sx8 block driver (Christoph Hellwig)   
  - ata: ahci: fix enum constants for gcc-13 (Arnd Bergmann)   
  - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw (Su Hui)   
  - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e (Hans de Goede)   
  - scsi: mpt3sas: Fix in error path (Tomas Henzl)   
  - fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit() (Jorge Maidana)   
  - ASoC: rt5650: fix the wrong result of key button (Shuming Fan)   
  - netfilter: nfnetlink_log: silence bogus compiler warning (Florian Westphal)   
  - fbdev: atyfb: only use ioremap_uc() on i386 and ia64 (Arnd Bergmann)   
  - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport (Dmitry Torokhov)   
  - dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe (Zhang Shurong)   
  - irqchip/stm32-exti: add missing DT IRQ flag translation (Ben Wolsieffer)   
  - ASoC: simple-card: fixup asoc_simple_probe() error handling (Kuninori Morimoto)   
  - x86: Fix .brk attribute in linker script (Juergen Gross)   
  - rpmsg: Fix possible refcount leak in rpmsg_register_device_override() (Hangyu Hua)   
  - rpmsg: glink: Release driver_override (Bjorn Andersson)   
  - rpmsg: Fix calling device_lock() on non-initialized device (Krzysztof Kozlowski)   
  - rpmsg: Fix kfree() of static memory on setting driver_override (Krzysztof Kozlowski)   
  - driver: platform: Add helper for safer setting of driver_override (Krzysztof Kozlowski)   
  - x86/mm: Fix RESERVE_BRK() for older binutils (Josh Poimboeuf)   
  - x86/mm: Simplify RESERVE_BRK() (Josh Poimboeuf)   
  - x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility (Thomas Gleixner)   
  - nfsd: lock_rename() needs both directories to live on the same fs (Al Viro)   
  - f2fs: fix to do sanity check on inode type during garbage collection (Chao Yu)   
  - kobject: Fix slab-out-of-bounds in fill_kobj_path() (Wang Hai)   
  - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper() (Lukasz Majczak)   
  - ARM: 8933/1: replace Sun/Solaris style flag on section directive (Nick Desaulniers)   
  - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (Ivan Vecera)   
  - gtp: uapi: fix GTPA_MAX (Pablo Neira Ayuso)   
  - tcp: fix wrong RTO timeout when received SACK reneging (Fred Chen)   
  - r8152: Increase USB control msg timeout to 5000ms as per spec (Douglas Anderson)   
  - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry (Mateusz Palczewski)   
  - treewide: Spelling fix in comment (Kunwu Chan)   
  - virtio_balloon: Fix endless deflation and inflation on arm64 (Gavin Shan)   
  - mcb-lpc: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - mcb: Return actual parsed size when reading chameleon table (Rodríguez Barbarin, José Javier)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.533.3.el7uek]
changelog:
  - net: rfkill: gpio: set GPIO direction (Rouven Czerwinski)   
  - sched/fair: Fix tg->load when offlining a CPU (Vincent Guittot)  [Orabug: 36185208]  
  - IB/cm: Cancel mad on the DREQ event when the state is MRA_REP_RCVD (Mark Zhang)  [Orabug: 36143229]  
  - sched/rt: pick_next_rt_entity(): check list_entry (Pietro Borrello)  [Orabug: 35181559]  {CVE-2023-1077}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.2.el7uek]
changelog:
  - x86: change default to spec_store_bypass_disable=prctl spectre_v2_user=prctl (Andrea Arcangeli)  [Orabug: 35905888]  
  - LTS version: 4.14.328 (Saeed Mirzamohammadi)   
  - Bluetooth: hci_event: Fix using memcmp when comparing keys (Luiz Augusto von Dentz)   
  - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (Kees Cook)   
  - Bluetooth: hci_sock: fix slab oob read in create_monitor_event (Edward AD)   
  - gpio: vf610: set value before the direction to avoid a glitch (Haibo Chen)   
  - s390/pci: fix iommu bitmap allocation (Niklas Schnelle)   
  - perf: Disallow mis-matched inherited group reads (Saeed Mirzamohammadi)   
  - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (Puliang Lu)   
  - USB: serial: option: add entry for Sierra EM9191 with new firmware (Benoît Monin)   
  - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (Fabio Porcedda)   
  - ACPI: irq: Fix incorrect return value in acpi_register_gsi() (Sunil V L)   
  - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" (Andy Shevchenko)   
  - mmc: core: Capture correct oemid-bits for eMMC cards (Avri Altman)   
  - sky2: Make sure there is at least one frag_addr available (Kees Cook)   
  - wifi: cfg80211: avoid leaking stack data into trace (Benjamin Berg)   
  - wifi: mac80211: allow transmitting EAPOL frames with tainted key (Wen Gong)   
  - Bluetooth: hci_core: Fix build warnings (Luiz Augusto von Dentz)   
  - Bluetooth: Avoid redundant authentication (Ying Hsu)   
  - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (Ma Ke)   
  - tracing: relax trace_event_eval_update() execution with cond_resched() (Clément Léger)   
  - ata: libata-eh: Fix compilation warning in ata_eh_link_report() (Damien Le Moal)   
  - gpio: timberdale: Fix potential deadlock on &tgpio->lock (Chengfeng Ye)   
  - overlayfs: set ctime when setting mtime and atime (Jeff Layton)   
  - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (Heiner Kallweit)   
  - btrfs: initialize start_slot in btrfs_log_prealloc_extents (Josef Bacik)   
  - ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone (Tony Lindgren)   
  - i40e: prevent crash on probe if hw registers have invalid values (Michal Schmidt)   
  - net: usb: smsc95xx: Fix an error code in smsc95xx_reset() (Dan Carpenter)   
  - net: rfkill: gpio: prevent value glitch during probe (Josua Mayer)   
  - net: ipv6: fix return value check in esp_remove_trailer (Ma Ke)   
  - net: ipv4: fix return value check in esp_remove_trailer (Ma Ke)   
  - xfrm: fix a data-race in xfrm_gen_index() (Saeed Mirzamohammadi)   
  - netfilter: nft_payload: fix wrong mac header matching (Florian Westphal)   
  - KVM: x86: Mask LVTPC when handling a PMI (Jim Mattson)   
  - regmap: fix NULL deref on lookup (Johan Hovold)   
  - nfc: nci: fix possible NULL pointer dereference in send_acknowledge() (Krzysztof Kozlowski)   
  - Bluetooth: avoid memcmp() out of bounds warning (Arnd Bergmann)   
  - Bluetooth: hci_event: Fix coding style (Luiz Augusto von Dentz)   
  - Bluetooth: vhci: Fix race when opening vhci device (Arkadiusz Bokowy)   
  - Bluetooth: Fix a refcnt underflow problem for hci_conn (Ziyang Xuan)   
  - Bluetooth: Reject connection with the device which has same BD_ADDR (Lee, Chun-Yi) [Orabug: 35959597] {CVE-2020-26555}
  - Bluetooth: hci_event: Ignore NULL link key (Lee, Chun-Yi)   
  - usb: hub: Guard against accesses to uninitialized BOS descriptors (Ricardo Cañuelo)   
  - x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs (Borislav Petkov (AMD))   
  - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call (Krishna Kurapati)   
  - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio (Piyush Mehta)   
  - pinctrl: avoid unsafe code pattern in find_pinctrl() (Dmitry Torokhov)   
  - cgroup: Remove duplicates in cgroup v1 tasks file (Michal Koutný)   
  - Input: xpad - add PXN V900 support (Matthias Berndt)   
  - Input: powermate - fix use-after-free in powermate_config_complete (Javier Carrasco)   
  - ceph: fix incorrect revoked caps assert in ceph_fill_file_size() (Xiubo Li)   
  - mcb: remove is_added flag from mcb_device struct (Jorge Sanjuan Garcia)   
  - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug (Alexander Zangerl)   
  - iio: pressure: bmp280: Fix NULL pointer exception (Phil Elwell)   
  - usb: musb: Modify the "HWVers" register address (Xingxing Luo)   
  - usb: musb: Get the musb_qh poniter after musb_giveback (Xingxing Luo)   
  - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read (Javier Carrasco)   
  - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer (Wesley Cheng)   
  - workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() (Waiman Long)   
  - nfc: nci: assert requested protocol is valid (Jeremy Cline)   
  - ixgbe: fix crash with empty VF macvlan list (Dan Carpenter)   
  - drm/vmwgfx: fix typo of sizeof argument (Konstantin Meskhidze)   
  - ieee802154: ca8210: Fix a potential UAF in ca8210_probe (Dinghao Liu)   
  - drm: etvnaviv: fix bad backport leading to warning (Martin Fuzzey)   
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (Hans de Goede)   
  - RDMA/cxgb4: Check skb value for failure to allocate (Artem Chernyshev)   
  - LTS version: 4.14.327 (Saeed Mirzamohammadi)   
  - parisc: Restore __ldcw_align for PA-RISC 2.0 processors (John David Anglin)   
  - RDMA/mlx5: Fix NULL string error (Shay Drory)   
  - RDMA/cma: Fix truncation compilation warning in make_cma_ports (Leon Romanovsky)   
  - gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() (Bartosz Golaszewski)   
  - IB/mlx4: Fix the size of a buffer in add_port_entries() (Christophe JAILLET)   
  - cpupower: add Makefile dependencies for install targets (Ivan Babrou)   
  - sctp: update hb timer immediately after users change hb_interval (Xin Long)   
  - sctp: update transport state when processing a dupcook packet (Xin Long)   
  - tcp: fix delayed ACKs for MSS boundary condition (Neal Cardwell)   
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Shigeru Yoshida)   
  - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (David Howells)   
  - modpost: add missing else to the "of" check (Mauricio Faria de Oliveira)   
  - scsi: target: core: Fix deadlock due to recursive locking (Junxiao Bi)   
  - regmap: rbtree: Fix wrong register marked as in-cache when creating new node (Richard Fitzgerald)   
  - drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close() (Alexandra Diupina)   
  - ubi: Refuse attaching if mtd's erasesize is 0 (Zhihao Cheng)   
  - wifi: mwifiex: Fix tlv_buf_left calculation (Gustavo A. R. Silva)   
  - scsi: zfcp: Fix a double put in zfcp_port_enqueue() (Dinghao Liu)   
  - media: dvb: symbol fixup for dvb_attach() - again (Greg Kroah-Hartman)   
  - ata: libata: disallow dev-initiated LPM transitions to unsupported states (Niklas Cassel)   
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Budimir Markovic) [Orabug: 35810543] {CVE-2023-4623}
  - ext4: fix rec_len verify error (Shida Zhang)   
  - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (George Kennedy)   
  - fs: binfmt_elf_efpic: fix personality for ELF-FDPIC (Greg Ungerer)   
  - ata: libata-sata: increase PMP SRST timeout to 10s (Matthias Schiffer)   
  - ata: libata-core: Fix port and device removal (Damien Le Moal)   
  - ata: libata-core: Fix ata_port_request_pm() locking (Damien Le Moal)   
  - btrfs: properly report 0 avail for very full file systems (Josef Bacik)   
  - i2c: i801: unregister tco_pdev in i801_probe() error path (Heiner Kallweit)   
  - ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES (Niklas Cassel)   
  - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() (Pan Bian)   
  - serial: 8250_port: Check IRQ data before use (Andy Shevchenko)   
  - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Mika Westerberg)   
  - watchdog: iTCO_wdt: No need to stop the timer in probe (Mika Westerberg)   
  - ata: libahci: clear pending interrupt status (Szuying Chen)   
  - ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones (Hannes Reinecke)   
  - fbdev/sh7760fb: Depend on FB=y (Thomas Zimmermann)   
  - ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset() (Niklas Cassel)   
  - ring-buffer: Avoid softlockup in ring_buffer_resize() (Zheng Yejian)   
  - selftests/ftrace: Correctly enable event in instance-event.tc (Zheng Yejian)   
  - parisc: irq: Make irq_stack_union static to avoid sparse warning (Helge Deller)   
  - parisc: iosapic.c: Fix sparse warnings (Helge Deller)   
  - parisc: sba: Fix compile warning wrt list of SBA devices (Helge Deller)   
  - xtensa: boot/lib: fix function prototypes (Max Filippov)   
  - xtensa: boot: don't add include-dirs (Randy Dunlap)   
  - clk: tegra: fix error return case for recalc_rate (Timo Alho)   
  - i2c: mux: demux-pinctrl: check the return value of devm_kstrdup() (Xiaoke Wang)   
  - gpio: tb10x: Fix an error handling path in tb10x_gpio_probe() (Christophe JAILLET)   
  - team: fix null-ptr-deref when team device type is changed (Ziyang Xuan)   
  - powerpc/perf/hv-24x7: Update domain value check (Kajol Jain)   
  - ipv4: fix null-deref in ipv4_link_failure (Kyle Zeng)   
  - NFS/pNFS: Report EINVAL errors from connect() to the server (Trond Myklebust)


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.533.2.el7uek]
changelog:
  - LTS version: 4.14.334 (Yifei Liu)   
  - powerpc/ftrace: Fix stack teardown in ftrace_no_trace (Naveen N Rao)   
  - powerpc/ftrace: Create a dummy stackframe to fix stack unwind (Naveen N Rao)   
  - ring-buffer: Fix memory leak of free page (Steven Rostedt (Google))   
  - team: Fix use-after-free when an option instance allocation fails (Florent Revest)   
  - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS (Baokun Li)   
  - HID: hid-asus: add const to read-only outgoing usb buffer (Denis Benato)   
  - net: usb: qmi_wwan: claim interface 4 for ZTE MF290 (Lech Perczak)   
  - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation (Linus Torvalds)   
  - HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad (Aoba K)   
  - HID: hid-asus: reset the backlight brightness level on resume (Denis Benato)   
  - platform/x86: intel_telemetry: Fix kernel doc descriptions (Andy Shevchenko)   
  - bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (Coly Li)   
  - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" (Ming Lei)   
  - appletalk: Fix Use-After-Free in atalk_ioctl (Hyunwoo Kim)   
  - vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() (Nikolay Kuratov)   
  - sign-file: Fix incorrect return values check (Yusong Gao)   
  - net: Remove acked SYN flag from packet in the transmit queue correctly (Dong Chenchen)   
  - qed: Fix a potential use-after-free in qed_cxt_tables_alloc (Dinghao Liu)   
  - net/rose: Fix Use-After-Free in rose_ioctl (Hyunwoo Kim)   
  - atm: Fix Use-After-Free in do_vcc_ioctl (Hyunwoo Kim)   
  - atm: solos-pci: Fix potential deadlock on &tx_queue_lock (Chengfeng Ye)   
  - atm: solos-pci: Fix potential deadlock on &cli_queue_lock (Chengfeng Ye)   
  - qca_spi: Fix reset behavior (Stefan Wahren)   
  - qca_debug: Fix ethtool -G iface tx behavior (Stefan Wahren)   
  - qca_debug: Prevent crash on TX ring changes (Stefan Wahren)   
  - LTS version: 4.14.333 (Yifei Liu)   
  - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group (Ido Schimmel)   
  - psample: Require 'CAP_NET_ADMIN' when joining "packets" group (Ido Schimmel)   
  - genetlink: add CAP_NET_ADMIN test for multicast bind (Ido Schimmel)   
  - netlink: don't call ->netlink_bind with table lock held (Ido Schimmel)   
  - nilfs2: fix missing error check for sb_set_blocksize call (Ryusuke Konishi)   
  - KVM: s390/mm: Properly reset no-dat (Claudio Imbrenda)   
  - serial: 8250_omap: Add earlycon support for the AM654 UART controller (Ronald Wahl)   
  - serial: sc16is7xx: address RX timeout interrupt errata (Daniel Mack)   
  - parport: Add support for Brainboxes IX/UC/PX parallel cards (Cameron Williams)   
  - packet: Move reference count in packet_sock to atomic_long_t (Daniel Borkmann)   
  - tracing: Fix a possible race when disabling buffered events (Petr Pavlu)   
  - tracing: Fix incomplete locking when disabling buffered events (Petr Pavlu)   
  - tracing: Always update snapshot buffer size (Steven Rostedt (Google))   
  - nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() (Ryusuke Konishi)   
  - ALSA: pcm: fix out-of-bounds in snd_pcm_state_names (Jason Zhang)   
  - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() (Dinghao Liu)   
  - tracing: Fix a warning when allocating buffered events fails (Petr Pavlu)   
  - hwmon: (acpi_power_meter) Fix 4.29 MW bug (Armin Wolf)   
  - RDMA/bnxt_re: Correct module description string (Kalesh AP)   
  - tcp: do not accept ACK of bytes we never sent (Eric Dumazet)   
  - net: hns: fix fake link up on xge port (Yonglong Liu)   
  - drm/amdgpu: correct chunk_ptr to a pointer to chunk. (YuanShang)   
  - tg3: Increment tx_dropped in tg3_tso_bug() (Alex Pakhunov)   
  - tg3: Move the [rt]x_dropped counters to tg3_napi (Alex Pakhunov)   
  - LTS version: 4.14.332 (Yifei Liu)   
  - driver core: Release all resources during unbind before updating device links (Saravana Kannan)   
  - net: ravb: Start TX queues after HW initialization succeeded (Claudiu Beznea)   
  - ravb: Fix races between ravb_tx_timeout_work() and net related ops (Yoshihiro Shimoda)   
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet (Zhengchao Shao)   
  - btrfs: send: ensure send_fd is writable (Jann Horn)   
  - btrfs: fix off-by-one when checking chunk map includes logical address (Filipe Manana)   
  - powerpc: Don't clobber f0/vs0 during fp|altivec register save (Timothy Pearson)   
  - dm verity: don't perform FEC for failed readahead IO (Wu Bo)   
  - dm-verity: align struct dm_verity_fec_io properly (Mikulas Patocka)   
  - firewire: core: fix possible memory leak in create_units() (Yang Yingliang)   
  - pinctrl: avoid reload of p state in list iteration (Maria Yu)   
  - usb: dwc3: set the dma max_seg_size (Ricardo Ribalda)   
  - USB: serial: option: don't claim interface 4 for ZTE MF290 (Lech Perczak)   
  - USB: serial: option: fix FM101R-GL defines (Puliang Lu)   
  - USB: serial: option: add Fibocom L7xx modules (Victor Fragoso)   
  - bcache: prevent potential division by zero error (Rand Deeb)   
  - bcache: check return value from btree_node_alloc_replacement() (Coly Li)   
  - USB: serial: option: add Luat Air72*U series products (Asuna Yang)   
  - s390/dasd: protect device queue against concurrent access (Jan Höppner)   
  - mtd: rawnand: brcmnand: Fix ecc chunk calculation for erased page bitfips (Claire Lin)   
  - net: axienet: Fix check for partial TX checksum (Samuel Holland)   
  - amd-xgbe: propagate the correct speed and duplex status (Raju Rangoju)   
  - amd-xgbe: handle corner-case during sfp hotplug (Raju Rangoju)   
  - arm/xen: fix xen_vcpu_info allocation alignment (Stefano Stabellini)   
  - net: usb: ax88179_178a: fix failed operations during ax88179_reset (Jose Ignacio Tornos Martinez)   
  - ipv4: Correct/silence an endian warning in __ip_do_redirect (Kunwu Chan)   
  - drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full (Jonas Karlman)   
  - ata: pata_isapnp: Add missing error check for devm_ioport_map() (Chen Ni)   
  - drm/panel: simple: Fix Innolux G101ICE-L01 timings (Marek Vasut)   
  - RDMA/irdma: Prevent zero-length STAG registration (Christopher Bednarz) [Orabug: 36155615] {CVE-2023-25775}
  - LTS version: 4.14.331 (Yifei Liu)   
  - net: sched: fix race condition in qdisc_graft() (Eric Dumazet) [Orabug: 35250826] {CVE-2023-0590}
  - scsi: virtio_scsi: limit number of hw queues by nr_cpu_ids (Dongli Zhang)   
  - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (Kemeng Shi)   
  - ext4: correct return value of ext4_convert_meta_bg (Kemeng Shi)   
  - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Kemeng Shi)   
  - ext4: apply umask if ACL support is disabled (Max Kellermann)   
  - media: venus: hfi: fix the check to handle session buffer requirement (Vikash Garodia)   
  - media: sharp: fix sharp encoding (Sean Young)   
  - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte (Heiner Kallweit)   
  - net: dsa: lan9303: consequently nested-lock physical MDIO (Alexander Sverdlin)   
  - ALSA: info: Fix potential deadlock at disconnection (Takashi Iwai)   
  - parisc/pgtable: Do not drop upper 5 address bits of physical address (Helge Deller)   
  - parisc: Prevent booting 64-bit kernels on PA1.x machines (Helge Deller)   
  - mcb: fix error handling for different scenarios when parsing (Sanjuán García, Jorge)   
  - jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev (Zhihao Cheng)   
  - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware (Herve Codina)   
  - mmc: meson-gx: Remove setting of CMD_CFG_ERROR (Rong Chen)   
  - PM: hibernate: Clean up sync_read handling in snapshot_write_next() (Brian Geffon)   
  - PM: hibernate: Use __get_safe_page() rather than touching the list (Brian Geffon)   
  - mmc: vub300: fix an error code (Dan Carpenter)   
  - PCI/sysfs: Protect driver's D3cold preference from user space (Lukas Wunner)   
  - hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (David Woodhouse)   
  - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() (Paul Moore)   
  - audit: don't take task_lock() in audit_exe_compare() code path (Paul Moore)   
  - KVM: x86: Ignore MSR_AMD64_TW_CFG access (Maciej S. Szmigiero)   
  - randstruct: Fix gcc-plugin performance mode to stay in group (Kees Cook)   
  - media: venus: hfi: add checks to perform sanity on queue pointers (Vikash Garodia)   
  - pwm: Fix double shift bug (Dan Carpenter)   
  - gfs2: ignore negated quota changes (Bob Peterson)   
  - media: vivid: avoid integer overflow (Hans Verkuil)   
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Rajeshwar R Shinde)   
  - i2c: sun6i-p2wi: Prevent potential division by zero (Axel Lin)   
  - tty: vcc: Add check for kstrdup() in vcc_probe() (Yi Yang)   
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (Wenchao Hao)   
  - atm: iphase: Do PCI error checks on own line (Ilpo Järvinen)   
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream (Cezary Rojewski)   
  - jfs: fix array-index-out-of-bounds in diAlloc (Manas Ghandat)   
  - jfs: fix array-index-out-of-bounds in dbFindLeaf (Manas Ghandat)   
  - fs/jfs: Add validity check for db_maxag and db_agpref (Juntong Deng)   
  - fs/jfs: Add check for negative db_l2nbperpage (Juntong Deng)   
  - RDMA/hfi1: Use FIELD_GET() to extract Link Width (Ilpo Järvinen)   
  - crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin)   
  - selftests/efivarfs: create-read: fix a resource leak (zhujun2)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (Mario Limonciello)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (Mario Limonciello)   
  - net: annotate data-races around sk->sk_dst_pending_confirm (Eric Dumazet)   
  - wifi: ath10k: fix clang-specific fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix clang-specific fortify warnings (Dmitry Antipov)   
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Ping-Ke Shih)   
  - x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size (Mike Rapoport (IBM))   
  - clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware (Ronald Wahl)   
  - clocksource/drivers/timer-imx-gpt: Fix potential memory leak (Jacky Bai)   
  - locking/ww_mutex/test: Fix potential workqueue corruption (John Stultz)   
  - LTS version: 4.14.330 (Yifei Liu)   
  - btrfs: use u64 for buffer sizes in the tree search ioctls (Filipe Manana)   
  - fbdev: fsl-diu-fb: mark wr_reg_wa() static (Arnd Bergmann)   
  - netfilter: xt_recent: fix (increase) ipv6 literal buffer length (Maciej Żenczykowski)   
  - tg3: power down device only on SYSTEM_POWER_OFF (George Shuklin)   
  - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. (Kuniyuki Iwashima)   
  - dccp: Call security_inet_conn_request() after setting IPv4 addresses. (Kuniyuki Iwashima)   
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Shigeru Yoshida)   
  - llc: verify mac len before reading mac header (Willem de Bruijn)   
  - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume (Florian Fainelli)   
  - media: s3c-camif: Avoid inappropriate kfree() (Katya Orlova)   
  - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: ds: fix refcount leak in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: cs: fix possible hung task and memory leak pccardd() (Yang Yingliang)   
  - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() (Christophe JAILLET)   
  - USB: usbip: fix stub_dev hub disconnect (Jonas Blixt)   
  - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave() (Jinjie Ruan)   
  - dmaengine: ti: edma: handle irq_of_parse_and_map() errors (Dan Carpenter)   
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (Jia-Ju Bai)   
  - tty: tty_jobctrl: fix pid memleak in disassociate_ctty() (Yi Yang)   
  - mfd: dln2: Fix double put in dln2_probe (Dinghao Liu)   
  - ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails (Cezary Rojewski)   
  - sh: bios: Revive earlyprintk support (Geert Uytterhoeven)   
  - RDMA/hfi1: Workaround truncation compilation error (Leon Romanovsky)   
  - ext4: move 'ix' sanity check to corrent position (Gou Hao)   
  - ARM: 9321/1: memset: cast the constant byte to unsigned char (Kursad Oney)   
  - hwrng: geode - fix accessing registers (Jonas Gorski)   
  - firmware: ti_sci: Mark driver as non removable (Dhruva Gole)   
  - ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator (Krzysztof Kozlowski)   
  - drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe() (Christophe JAILLET)   
  - drm/radeon: possible buffer overflow (Konstantin Meskhidze)   
  - drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs (Jonas Karlman)   
  - platform/x86: wmi: Fix probe failure when failing to register WMI devices (Armin Wolf)   
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: keystone: pll: fix a couple NULL vs IS_ERR() checks (Dan Carpenter)   
  - clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies (Devi Priya)   
  - ipv6: avoid atomic fragment on GSO packets (Yan Zhai)   
  - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() (Christophe JAILLET)   
  - thermal: core: prevent potential string overflow (Dan Carpenter)   
  - wifi: rtlwifi: fix EDCA limit set by BT coexistence (Dmitry Antipov)   
  - tcp_metrics: do not create an entry from tcp_init_metrics() (Eric Dumazet)   
  - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics() (Eric Dumazet)   
  - i40e: fix potential memory leaks in i40e_remove() (Andrii Staikov)   
  - LTS version: 4.14.329 (Yifei Liu)   
  - tty: 8250: Add support for Intashield IS-100 (Cameron Williams)   
  - tty: 8250: Add support for Brainboxes UP cards (Cameron Williams)   
  - tty: 8250: Add support for additional Brainboxes UC cards (Cameron Williams)   
  - tty: 8250: Remove UC-257 and UC-431 (Cameron Williams)   
  - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility (LihaSika)   
  - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device (Vicki Pfau)   
  - remove the sx8 block driver (Christoph Hellwig)   
  - ata: ahci: fix enum constants for gcc-13 (Arnd Bergmann)   
  - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw (Su Hui)   
  - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e (Hans de Goede)   
  - scsi: mpt3sas: Fix in error path (Tomas Henzl)   
  - fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit() (Jorge Maidana)   
  - ASoC: rt5650: fix the wrong result of key button (Shuming Fan)   
  - netfilter: nfnetlink_log: silence bogus compiler warning (Florian Westphal)   
  - fbdev: atyfb: only use ioremap_uc() on i386 and ia64 (Arnd Bergmann)   
  - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport (Dmitry Torokhov)   
  - dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe (Zhang Shurong)   
  - irqchip/stm32-exti: add missing DT IRQ flag translation (Ben Wolsieffer)   
  - ASoC: simple-card: fixup asoc_simple_probe() error handling (Kuninori Morimoto)   
  - x86: Fix .brk attribute in linker script (Juergen Gross)   
  - rpmsg: Fix possible refcount leak in rpmsg_register_device_override() (Hangyu Hua)   
  - rpmsg: glink: Release driver_override (Bjorn Andersson)   
  - rpmsg: Fix calling device_lock() on non-initialized device (Krzysztof Kozlowski)   
  - rpmsg: Fix kfree() of static memory on setting driver_override (Krzysztof Kozlowski)   
  - driver: platform: Add helper for safer setting of driver_override (Krzysztof Kozlowski)   
  - x86/mm: Fix RESERVE_BRK() for older binutils (Josh Poimboeuf)   
  - x86/mm: Simplify RESERVE_BRK() (Josh Poimboeuf) [Orabug: 34335626] {CVE-2022-23816} {CVE-2022-29901}
  - x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility (Thomas Gleixner)   
  - nfsd: lock_rename() needs both directories to live on the same fs (Al Viro)   
  - f2fs: fix to do sanity check on inode type during garbage collection (Chao Yu)   
  - kobject: Fix slab-out-of-bounds in fill_kobj_path() (Wang Hai) [Orabug: 35924075] {CVE-2023-45863}
  - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper() (Lukasz Majczak)   
  - ARM: 8933/1: replace Sun/Solaris style flag on section directive (Nick Desaulniers)   
  - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (Ivan Vecera)   
  - gtp: uapi: fix GTPA_MAX (Pablo Neira Ayuso)   
  - tcp: fix wrong RTO timeout when received SACK reneging (Fred Chen)   
  - r8152: Increase USB control msg timeout to 5000ms as per spec (Douglas Anderson)   
  - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry (Mateusz Palczewski)   
  - treewide: Spelling fix in comment (Kunwu Chan)   
  - virtio_balloon: Fix endless deflation and inflation on arm64 (Gavin Shan)   
  - mcb-lpc: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - mcb: Return actual parsed size when reading chameleon table (Rodríguez Barbarin, José Javier)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.534.1.el7uek]
changelog:
  -  LTS version: 4.14.336 (Yifei Liu)   
  - mmc: core: Cancel delayed work before releasing host (Geert Uytterhoeven)   
  - mmc: rpmb: fixes pause retune on all RPMB partitions. (Jorge Ramirez-Ortiz)   
  - firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards (Takashi Sakamoto)   
  - i40e: fix use-after-free in i40e_aqc_add_filters() (Ke Xiao)   
  - net: bcmgenet: Fix FCS generation for fragmented skbuffs (Adrian Cinal)   
  - net: sched: em_text: fix possible memory leak in em_text_destroy() (Hangyu Hua)   
  - nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local (Siddh Raman Pant)   
  - LTS version: 4.14.335 (Yifei Liu)   
  - block: Don't invalidate pagecache for invalid falloc modes (Sarthak Kukreti)   
  - dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() (Mikulas Patocka)   
  - net: 9p: avoid freeing uninit memory in p9pdu_vreadf (Fedor Pchelkin)   
  - Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent (Luiz Augusto von Dentz)   
  - USB: serial: option: add Quectel RM500Q R13 firmware support (Reinhard Speyerer)   
  - USB: serial: option: add Foxconn T99W265 with new baseline (Slark Xiao)   
  - USB: serial: option: add Quectel EG912Y module support (Alper Ak)   
  - USB: serial: ftdi_sio: update Actisense PIDs constant names (Mark Glover)   
  - wifi: cfg80211: fix certs build to not depend on file order (Johannes Berg)   
  - wifi: cfg80211: Add my certificate (Chen-Yu Tsai)   
  - iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table (Javier Carrasco)   
  - Input: ipaq-micro-keys - add error handling for devm_kmemdup (Haoran Liu)   
  - iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw (Su Hui)   
  - ethernet: atheros: fix a memleak in atl1e_setup_ring_resources (Zhipeng Lu)   
  - net: sched: ife: fix potential use-after-free (Eric Dumazet)   
  - wifi: mac80211: mesh_plink: fix matches_local logic (Johannes Berg)   
  - s390/vx: fix save/restore of fpu kernel context (Heiko Carstens)   
  - ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init (Kunwu Chan)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.534.2.el7uek]
changelog:
  - workqueue: Make sure struct worker is accessible for wq_worker_comm() (Tejun Heo)  [Orabug: 36300552]  
  - workqueue: Show the latest workqueue name in /proc/PID/{comm,stat,status} (Tejun Heo)  [Orabug: 36300552]  
  - workqueue: Set worker->desc to workqueue name by default (Tejun Heo)  [Orabug: 36300552]  
  - workqueue: Make worker_attach/detach_pool() update worker->pool (Tejun Heo)  [Orabug: 36300552]  
  - workqueue: Replace pool->attach_mutex with global wq_pool_attach_mutex (Tejun Heo)  [Orabug: 36300552]


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.534.3.el7uek]
changelog:
  - scsi: megaraid_sas: Correct value passed to scsi_device_lookup() (Guixin Liu)  [Orabug: 36345169]  
  - scsi: megaraid_sas: Update max supported LD IDs to 240 (Chandrakanth Patil)  [Orabug: 36344166]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.534.3.1.el7uek]
changelog:
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal)  [Orabug: 36251145]  {CVE-2024-1086}


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.533.2.el7uek]
changelog:
  - LTS version: 4.14.334 (Yifei Liu)   
  - powerpc/ftrace: Fix stack teardown in ftrace_no_trace (Naveen N Rao)   
  - powerpc/ftrace: Create a dummy stackframe to fix stack unwind (Naveen N Rao)   
  - ring-buffer: Fix memory leak of free page (Steven Rostedt (Google))   
  - team: Fix use-after-free when an option instance allocation fails (Florent Revest)   
  - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS (Baokun Li)   
  - HID: hid-asus: add const to read-only outgoing usb buffer (Denis Benato)   
  - net: usb: qmi_wwan: claim interface 4 for ZTE MF290 (Lech Perczak)   
  - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation (Linus Torvalds)   
  - HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad (Aoba K)   
  - HID: hid-asus: reset the backlight brightness level on resume (Denis Benato)   
  - platform/x86: intel_telemetry: Fix kernel doc descriptions (Andy Shevchenko)   
  - bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (Coly Li)   
  - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" (Ming Lei)   
  - appletalk: Fix Use-After-Free in atalk_ioctl (Hyunwoo Kim)   
  - vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() (Nikolay Kuratov)   
  - sign-file: Fix incorrect return values check (Yusong Gao)   
  - net: Remove acked SYN flag from packet in the transmit queue correctly (Dong Chenchen)   
  - qed: Fix a potential use-after-free in qed_cxt_tables_alloc (Dinghao Liu)   
  - net/rose: Fix Use-After-Free in rose_ioctl (Hyunwoo Kim)   
  - atm: Fix Use-After-Free in do_vcc_ioctl (Hyunwoo Kim) [Orabug: 36229395] {CVE-2023-51780}
  - atm: solos-pci: Fix potential deadlock on &tx_queue_lock (Chengfeng Ye)   
  - atm: solos-pci: Fix potential deadlock on &cli_queue_lock (Chengfeng Ye)   
  - qca_spi: Fix reset behavior (Stefan Wahren)   
  - qca_debug: Fix ethtool -G iface tx behavior (Stefan Wahren)   
  - qca_debug: Prevent crash on TX ring changes (Stefan Wahren)   
  - LTS version: 4.14.333 (Yifei Liu)   
  - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group (Ido Schimmel)   
  - psample: Require 'CAP_NET_ADMIN' when joining "packets" group (Ido Schimmel)   
  - genetlink: add CAP_NET_ADMIN test for multicast bind (Ido Schimmel)   
  - netlink: don't call ->netlink_bind with table lock held (Ido Schimmel)   
  - nilfs2: fix missing error check for sb_set_blocksize call (Ryusuke Konishi)   
  - KVM: s390/mm: Properly reset no-dat (Claudio Imbrenda)   
  - serial: 8250_omap: Add earlycon support for the AM654 UART controller (Ronald Wahl)   
  - serial: sc16is7xx: address RX timeout interrupt errata (Daniel Mack)   
  - parport: Add support for Brainboxes IX/UC/PX parallel cards (Cameron Williams)   
  - packet: Move reference count in packet_sock to atomic_long_t (Daniel Borkmann)   
  - tracing: Fix a possible race when disabling buffered events (Petr Pavlu)   
  - tracing: Fix incomplete locking when disabling buffered events (Petr Pavlu)   
  - tracing: Always update snapshot buffer size (Steven Rostedt (Google))   
  - nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() (Ryusuke Konishi)   
  - ALSA: pcm: fix out-of-bounds in snd_pcm_state_names (Jason Zhang)   
  - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() (Dinghao Liu)   
  - tracing: Fix a warning when allocating buffered events fails (Petr Pavlu)   
  - hwmon: (acpi_power_meter) Fix 4.29 MW bug (Armin Wolf)   
  - RDMA/bnxt_re: Correct module description string (Kalesh AP)   
  - tcp: do not accept ACK of bytes we never sent (Eric Dumazet)   
  - net: hns: fix fake link up on xge port (Yonglong Liu)   
  - drm/amdgpu: correct chunk_ptr to a pointer to chunk. (YuanShang)   
  - tg3: Increment tx_dropped in tg3_tso_bug() (Alex Pakhunov)   
  - tg3: Move the [rt]x_dropped counters to tg3_napi (Alex Pakhunov)   
  - LTS version: 4.14.332 (Yifei Liu)   
  - driver core: Release all resources during unbind before updating device links (Saravana Kannan)   
  - net: ravb: Start TX queues after HW initialization succeeded (Claudiu Beznea)   
  - ravb: Fix races between ravb_tx_timeout_work() and net related ops (Yoshihiro Shimoda)   
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet (Zhengchao Shao)   
  - btrfs: send: ensure send_fd is writable (Jann Horn)   
  - btrfs: fix off-by-one when checking chunk map includes logical address (Filipe Manana)   
  - powerpc: Don't clobber f0/vs0 during fp|altivec register save (Timothy Pearson)   
  - dm verity: don't perform FEC for failed readahead IO (Wu Bo)   
  - dm-verity: align struct dm_verity_fec_io properly (Mikulas Patocka)   
  - firewire: core: fix possible memory leak in create_units() (Yang Yingliang)   
  - pinctrl: avoid reload of p state in list iteration (Maria Yu)   
  - usb: dwc3: set the dma max_seg_size (Ricardo Ribalda)   
  - USB: serial: option: don't claim interface 4 for ZTE MF290 (Lech Perczak)   
  - USB: serial: option: fix FM101R-GL defines (Puliang Lu)   
  - USB: serial: option: add Fibocom L7xx modules (Victor Fragoso)   
  - bcache: prevent potential division by zero error (Rand Deeb)   
  - bcache: check return value from btree_node_alloc_replacement() (Coly Li)   
  - USB: serial: option: add Luat Air72*U series products (Asuna Yang)   
  - s390/dasd: protect device queue against concurrent access (Jan Höppner)   
  - mtd: rawnand: brcmnand: Fix ecc chunk calculation for erased page bitfips (Claire Lin)   
  - net: axienet: Fix check for partial TX checksum (Samuel Holland)   
  - amd-xgbe: propagate the correct speed and duplex status (Raju Rangoju)   
  - amd-xgbe: handle corner-case during sfp hotplug (Raju Rangoju)   
  - arm/xen: fix xen_vcpu_info allocation alignment (Stefano Stabellini)   
  - net: usb: ax88179_178a: fix failed operations during ax88179_reset (Jose Ignacio Tornos Martinez)   
  - ipv4: Correct/silence an endian warning in __ip_do_redirect (Kunwu Chan)   
  - drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full (Jonas Karlman)   
  - ata: pata_isapnp: Add missing error check for devm_ioport_map() (Chen Ni)   
  - drm/panel: simple: Fix Innolux G101ICE-L01 timings (Marek Vasut)   
  - RDMA/irdma: Prevent zero-length STAG registration (Christopher Bednarz) [Orabug: 36155615] {CVE-2023-25775}
  - LTS version: 4.14.331 (Yifei Liu)   
  - net: sched: fix race condition in qdisc_graft() (Eric Dumazet) [Orabug: 35250826] {CVE-2023-0590}
  - scsi: virtio_scsi: limit number of hw queues by nr_cpu_ids (Dongli Zhang)   
  - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (Kemeng Shi)   
  - ext4: correct return value of ext4_convert_meta_bg (Kemeng Shi)   
  - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Kemeng Shi)   
  - ext4: apply umask if ACL support is disabled (Max Kellermann)   
  - media: venus: hfi: fix the check to handle session buffer requirement (Vikash Garodia)   
  - media: sharp: fix sharp encoding (Sean Young)   
  - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte (Heiner Kallweit)   
  - net: dsa: lan9303: consequently nested-lock physical MDIO (Alexander Sverdlin)   
  - ALSA: info: Fix potential deadlock at disconnection (Takashi Iwai)   
  - parisc/pgtable: Do not drop upper 5 address bits of physical address (Helge Deller)   
  - parisc: Prevent booting 64-bit kernels on PA1.x machines (Helge Deller)   
  - mcb: fix error handling for different scenarios when parsing (Sanjuán García, Jorge)   
  - jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev (Zhihao Cheng)   
  - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware (Herve Codina)   
  - mmc: meson-gx: Remove setting of CMD_CFG_ERROR (Rong Chen)   
  - PM: hibernate: Clean up sync_read handling in snapshot_write_next() (Brian Geffon)   
  - PM: hibernate: Use __get_safe_page() rather than touching the list (Brian Geffon)   
  - mmc: vub300: fix an error code (Dan Carpenter)   
  - PCI/sysfs: Protect driver's D3cold preference from user space (Lukas Wunner)   
  - hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (David Woodhouse)   
  - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() (Paul Moore)   
  - audit: don't take task_lock() in audit_exe_compare() code path (Paul Moore)   
  - KVM: x86: Ignore MSR_AMD64_TW_CFG access (Maciej S. Szmigiero)   
  - randstruct: Fix gcc-plugin performance mode to stay in group (Kees Cook)   
  - media: venus: hfi: add checks to perform sanity on queue pointers (Vikash Garodia)   
  - pwm: Fix double shift bug (Dan Carpenter)   
  - gfs2: ignore negated quota changes (Bob Peterson)   
  - media: vivid: avoid integer overflow (Hans Verkuil)   
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Rajeshwar R Shinde)   
  - i2c: sun6i-p2wi: Prevent potential division by zero (Axel Lin)   
  - tty: vcc: Add check for kstrdup() in vcc_probe() (Yi Yang)   
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (Wenchao Hao)   
  - atm: iphase: Do PCI error checks on own line (Ilpo Järvinen)   
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream (Cezary Rojewski)   
  - jfs: fix array-index-out-of-bounds in diAlloc (Manas Ghandat)   
  - jfs: fix array-index-out-of-bounds in dbFindLeaf (Manas Ghandat)   
  - fs/jfs: Add validity check for db_maxag and db_agpref (Juntong Deng)   
  - fs/jfs: Add check for negative db_l2nbperpage (Juntong Deng)   
  - RDMA/hfi1: Use FIELD_GET() to extract Link Width (Ilpo Järvinen)   
  - crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin)   
  - selftests/efivarfs: create-read: fix a resource leak (zhujun2)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (Mario Limonciello)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (Mario Limonciello)   
  - net: annotate data-races around sk->sk_dst_pending_confirm (Eric Dumazet)   
  - wifi: ath10k: fix clang-specific fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix clang-specific fortify warnings (Dmitry Antipov)   
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Ping-Ke Shih)   
  - x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size (Mike Rapoport (IBM))   
  - clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware (Ronald Wahl)   
  - clocksource/drivers/timer-imx-gpt: Fix potential memory leak (Jacky Bai)   
  - locking/ww_mutex/test: Fix potential workqueue corruption (John Stultz)   
  - LTS version: 4.14.330 (Yifei Liu)   
  - btrfs: use u64 for buffer sizes in the tree search ioctls (Filipe Manana)   
  - fbdev: fsl-diu-fb: mark wr_reg_wa() static (Arnd Bergmann)   
  - netfilter: xt_recent: fix (increase) ipv6 literal buffer length (Maciej Żenczykowski)   
  - tg3: power down device only on SYSTEM_POWER_OFF (George Shuklin)   
  - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. (Kuniyuki Iwashima)   
  - dccp: Call security_inet_conn_request() after setting IPv4 addresses. (Kuniyuki Iwashima)   
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Shigeru Yoshida)   
  - llc: verify mac len before reading mac header (Willem de Bruijn)   
  - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume (Florian Fainelli)   
  - media: s3c-camif: Avoid inappropriate kfree() (Katya Orlova)   
  - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: ds: fix refcount leak in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: cs: fix possible hung task and memory leak pccardd() (Yang Yingliang)   
  - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() (Christophe JAILLET)   
  - USB: usbip: fix stub_dev hub disconnect (Jonas Blixt)   
  - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave() (Jinjie Ruan)   
  - dmaengine: ti: edma: handle irq_of_parse_and_map() errors (Dan Carpenter)   
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (Jia-Ju Bai)   
  - tty: tty_jobctrl: fix pid memleak in disassociate_ctty() (Yi Yang)   
  - mfd: dln2: Fix double put in dln2_probe (Dinghao Liu)   
  - ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails (Cezary Rojewski)   
  - sh: bios: Revive earlyprintk support (Geert Uytterhoeven)   
  - RDMA/hfi1: Workaround truncation compilation error (Leon Romanovsky)   
  - ext4: move 'ix' sanity check to corrent position (Gou Hao)   
  - ARM: 9321/1: memset: cast the constant byte to unsigned char (Kursad Oney)   
  - hwrng: geode - fix accessing registers (Jonas Gorski)   
  - firmware: ti_sci: Mark driver as non removable (Dhruva Gole)   
  - ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator (Krzysztof Kozlowski)   
  - drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe() (Christophe JAILLET)   
  - drm/radeon: possible buffer overflow (Konstantin Meskhidze)   
  - drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs (Jonas Karlman)   
  - platform/x86: wmi: Fix probe failure when failing to register WMI devices (Armin Wolf)   
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: keystone: pll: fix a couple NULL vs IS_ERR() checks (Dan Carpenter)   
  - clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies (Devi Priya)   
  - ipv6: avoid atomic fragment on GSO packets (Yan Zhai)   
  - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() (Christophe JAILLET)   
  - thermal: core: prevent potential string overflow (Dan Carpenter)   
  - wifi: rtlwifi: fix EDCA limit set by BT coexistence (Dmitry Antipov)   
  - tcp_metrics: do not create an entry from tcp_init_metrics() (Eric Dumazet)   
  - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics() (Eric Dumazet)   
  - i40e: fix potential memory leaks in i40e_remove() (Andrii Staikov)   
  - LTS version: 4.14.329 (Yifei Liu)   
  - tty: 8250: Add support for Intashield IS-100 (Cameron Williams)   
  - tty: 8250: Add support for Brainboxes UP cards (Cameron Williams)   
  - tty: 8250: Add support for additional Brainboxes UC cards (Cameron Williams)   
  - tty: 8250: Remove UC-257 and UC-431 (Cameron Williams)   
  - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility (LihaSika)   
  - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device (Vicki Pfau)   
  - remove the sx8 block driver (Christoph Hellwig)   
  - ata: ahci: fix enum constants for gcc-13 (Arnd Bergmann)   
  - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw (Su Hui)   
  - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e (Hans de Goede)   
  - scsi: mpt3sas: Fix in error path (Tomas Henzl)   
  - fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit() (Jorge Maidana)   
  - ASoC: rt5650: fix the wrong result of key button (Shuming Fan)   
  - netfilter: nfnetlink_log: silence bogus compiler warning (Florian Westphal)   
  - fbdev: atyfb: only use ioremap_uc() on i386 and ia64 (Arnd Bergmann)   
  - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport (Dmitry Torokhov)   
  - dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe (Zhang Shurong)   
  - irqchip/stm32-exti: add missing DT IRQ flag translation (Ben Wolsieffer)   
  - ASoC: simple-card: fixup asoc_simple_probe() error handling (Kuninori Morimoto)   
  - x86: Fix .brk attribute in linker script (Juergen Gross)   
  - rpmsg: Fix possible refcount leak in rpmsg_register_device_override() (Hangyu Hua)   
  - rpmsg: glink: Release driver_override (Bjorn Andersson)   
  - rpmsg: Fix calling device_lock() on non-initialized device (Krzysztof Kozlowski)   
  - rpmsg: Fix kfree() of static memory on setting driver_override (Krzysztof Kozlowski)   
  - driver: platform: Add helper for safer setting of driver_override (Krzysztof Kozlowski)   
  - x86/mm: Fix RESERVE_BRK() for older binutils (Josh Poimboeuf)   
  - x86/mm: Simplify RESERVE_BRK() (Josh Poimboeuf) [Orabug: 34335626] {CVE-2022-23816} {CVE-2022-29901}
  - x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility (Thomas Gleixner)   
  - nfsd: lock_rename() needs both directories to live on the same fs (Al Viro)   
  - f2fs: fix to do sanity check on inode type during garbage collection (Chao Yu)   
  - kobject: Fix slab-out-of-bounds in fill_kobj_path() (Wang Hai) [Orabug: 35924075] {CVE-2023-45863}
  - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper() (Lukasz Majczak)   
  - ARM: 8933/1: replace Sun/Solaris style flag on section directive (Nick Desaulniers)   
  - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (Ivan Vecera)   
  - gtp: uapi: fix GTPA_MAX (Pablo Neira Ayuso)   
  - tcp: fix wrong RTO timeout when received SACK reneging (Fred Chen)   
  - r8152: Increase USB control msg timeout to 5000ms as per spec (Douglas Anderson)   
  - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry (Mateusz Palczewski)   
  - treewide: Spelling fix in comment (Kunwu Chan)   
  - virtio_balloon: Fix endless deflation and inflation on arm64 (Gavin Shan)   
  - mcb-lpc: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - mcb: Return actual parsed size when reading chameleon table (Rodríguez Barbarin, José Javier)


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.535.1.el7uek]
changelog:
  - mm: avoid conflict between MADV_DOEXEC and upstream advice values (Anthony Yznaga)  [Orabug: 36334310]  
  - net/rds: print PPID/COMM of process doing user reset on RDS connection (Juan Garcia)  [Orabug: 36248431]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.535.2.el7uek]
changelog:
  - Fix null ptr in rds_tcp_recv_path (Allison Henderson)  [Orabug: 33499812]  
  - LTS version: v4.14.338 (Saeed Mirzamohammadi)   
  - crypto: scompress - initialize per-CPU variables on each CPU (Sebastian Andrzej Siewior)   
  - Revert "NFSD: Fix possible sleep during nfsd4_release_lockowner()" (Greg Kroah-Hartman)   
  - i2c: s3c24xx: fix transferring more than one message in polling mode (Marek Szyprowski)   
  - i2c: s3c24xx: fix read transfers in polling mode (Marek Szyprowski)   
  - kdb: Fix a potential buffer overflow in kdb_local() (Christophe JAILLET)   
  - kdb: Censor attempts to set PROMPT without ENABLE_MEM_READ (Daniel Thompson)   
  - ipvs: avoid stat macros calls from preemptible context (Fedor Pchelkin)   
  - net: ravb: Fix dma_addr_t truncation in error case (Nikita Yushchenko)   
  - serial: imx: Correct clock error message in function probe() (Christoph Niedermaier)   
  - apparmor: avoid crash when parsed profile name is empty (Fedor Pchelkin)   
  - MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup() (Christophe JAILLET)   
  - MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup() (Christophe JAILLET)   
  - HID: wacom: Correct behavior when processing some confidence == false touches (Jason Gerecke)   
  - wifi: mwifiex: configure BSSID consistently when starting AP (David Lin)   
  - wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors (Ilpo Järvinen)   
  - wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code (Ilpo Järvinen)   
  - fbdev: flush deferred work in fb_deferred_io_fsync() (Nam Cao)   
  - ALSA: oxygen: Fix right channel of capture volume mixer (Takashi Iwai)   
  - usb: mon: Fix atomicity violation in mon_bin_vma_fault (Gui-Dong Han)   
  - usb: chipidea: wait controller resume finished for wakeup irq (Xu Yang)   
  - usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart (Uttkarsh Aggarwal)   
  - usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host() (Xu Yang)   
  - tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug (Heiko Carstens)   
  - binder: fix unused alloc->free_async_space (Carlos Llamas)   
  - binder: fix race between mmput() and do_exit() (Carlos Llamas)   
  - Input: atkbd - use ab83 as id when skipping the getid command (Hans de Goede)   
  - binder: fix async space check for 0-sized buffers (Carlos Llamas)   
  - watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling (Stefan Wahren)   
  - watchdog: set cdev owner before adding (Curtis Klein)   
  - gpu/drm/radeon: fix two memleaks in radeon_vm_init (Zhipeng Lu)   
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Zhipeng Lu)   
  - drm/amd/pm: fix a double-free in si_dpm_init (Zhipeng Lu)   
  - media: dvbdev: drop refcount on error path in dvb_device_open() (Dan Carpenter)   
  - media: cx231xx: fix a memleak in cx231xx_init_isoc (Zhipeng Lu)   
  - drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table (Zhipeng Lu)   
  - drm/radeon/dpm: fix a memleak in sumo_parse_power_table (Zhipeng Lu)   
  - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Yang Yingliang)   
  - drm/drv: propagate errors from drm_modeset_register_all() (Dmitry Baryshkov)   
  - drm/msm/mdp4: flush vblank event on disable (Dmitry Baryshkov)   
  - ASoC: cs35l34: Fix GPIO name and drop legacy include (Linus Walleij)   
  - ASoC: cs35l33: Fix GPIO name and drop legacy include (Linus Walleij)   
  - drm/radeon: check return value of radeon_ring_lock() (Nikita Zhandarovich)   
  - drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() (Nikita Zhandarovich)   
  - drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() (Nikita Zhandarovich)   
  - f2fs: fix to avoid dirent corruption (Chao Yu)   
  - drm/bridge: Fix typo in post_disable() description (Dario Binacchi)   
  - media: pvrusb2: fix use after free on context disconnection (Ricardo B. Marliere)   
  - RDMA/usnic: Silence uninitialized symbol smatch warnings (Leon Romanovsky)   
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (Eric Dumazet)   
  - Bluetooth: Fix bogus check for re-auth no supported with non-ssp (Luiz Augusto von Dentz)   
  - wifi: rtlwifi: rtl8192se: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8192ee: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8192de: using calculate_bit_shift() (Su Hui)   
  - rtlwifi: rtl8192de: make arrays static const, makes object smaller (Colin Ian King)   
  - wifi: rtlwifi: rtl8192ce: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8192cu: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8192c: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: add calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior (Su Hui)   
  - rtlwifi: Use ffs in <foo>_phy_calculate_bit_shift (Joe Perches)   
  - firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() (Christophe JAILLET)   
  - net/ncsi: Fix netlink major/minor version numbers (Peter Delevoryas)   
  - ncsi: internal.h: Fix a spello (Bhaskar Chowdhury)   
  - wifi: libertas: stop selecting wext (Arnd Bergmann)   
  - bpf, lpm: Fix check prefixlen before walking trie (Florian Lehner)   
  - NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT (Trond Myklebust)   
  - crypto: scomp - fix req->dst buffer overflow (Chengming Zhou)   
  - crypto: scompress - Use per-CPU struct instead multiple variables (Sebastian Andrzej Siewior)   
  - crypto: scompress - return proper error code for allocation failure (Sebastian Andrzej Siewior)   
  - crypto: sahara - do not resize req->src when doing hash operations (Ovidiu Panait)   
  - crypto: sahara - fix processing hash requests with req->nbytes < sg->length (Ovidiu Panait)   
  - crypto: sahara - improve error handling in sahara_sha_process() (Ovidiu Panait)   
  - crypto: sahara - fix wait_for_completion_timeout() error handling (Ovidiu Panait)   
  - crypto: sahara - fix ahash reqsize (Ovidiu Panait)   
  - crypto: virtio - Wait for tasklet to complete on device remove (wangyangxin)   
  - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() (Sergey Shtylyov)   
  - crypto: sahara - fix error handling in sahara_hw_descriptor_create() (Ovidiu Panait)   
  - crypto: sahara - fix processing requests with cryptlen < sg->length (Ovidiu Panait)   
  - crypto: sahara - fix ahash selftest failure (Ovidiu Panait)   
  - crypto: sahara - remove FLAGS_NEW_KEY logic (Ovidiu Panait)   
  - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu)   
  - crypto: ccp - fix memleak in ccp_init_dm_workarea (Dinghao Liu)   
  - crypto: virtio - Handle dataq logic with tasklet (Gonglei (Arei))   
  - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier (ZhaoLong Wang)   
  - calipso: fix memory leak in netlbl_calipso_add_pass() (Gavrilov Ilia)   
  - netlabel: remove unused parameter in netlbl_netlink_auditinfo() (Zheng Yejian)   
  - net: netlabel: Fix kerneldoc warnings (Andrew Lunn)   
  - ACPI: video: check for error while searching for backlight device parent (Nikita Kiryushin)   
  - mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response (Ronald Monthero)   
  - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Kunwu Chan)   
  - powerpc/powernv: Add a null pointer check in opal_event_init() (Kunwu Chan)   
  - selftests/powerpc: Fix error handling in FPU/VMX preemption tests (Michael Ellerman)   
  - powerpc/pseries/memhp: Fix access beyond end of drmem array (Nathan Lynch)   
  - powerpc/pseries/memhotplug: Quieten some DLPAR operations (Laurent Dufour)   
  - powerpc/44x: select I2C for CURRITUCK (Randy Dunlap)   
  - powerpc: remove redundant 'default n' from Kconfig-s (Bartlomiej Zolnierkiewicz)   
  - powerpc: add crtsavres.o to always-y instead of extra-y (Masahiro Yamada)   
  - EDAC/thunderx: Fix possible out-of-bounds string access (Arnd Bergmann)   
  - x86/lib: Fix overflow when counting digits (Colin Ian King)   
  - coresight: etm4x: Fix width of CCITMIN field (James Clark)   
  - uio: Fix use-after-free in uio_open (Guanghui Feng)   
  - binder: fix comment on binder_alloc_new_buf() return value (Carlos Llamas)   
  - drm/crtc: fix uninitialized variable use (Jani Nikula)   
  - Input: xpad - add Razer Wolverine V2 support (Luca Weiss)   
  - ARC: fix spare error (Vineet Gupta)   
  - s390/scm: fix virtual vs physical address confusion (Vineeth Vijayan)   
  - Input: atkbd - skip ATKBD_CMD_GETID in translated mode (Hans de Goede)   
  - reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)   
  - ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI (Steven Rostedt (Google))   
  - tracing: Add size check when printing trace_marker output (Steven Rostedt (Google))   
  - tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing (Steven Rostedt (Google))   
  - drm/crtc: Fix uninit-value bug in drm_mode_setcrtc (Ziqi Zhao)   
  - jbd2: correct the printing of write_flags in jbd2_write_superblock() (Zhang Yi)   
  - clk: rockchip: rk3128: Fix HCLK_OTG gate register (Weihao Li)   
  - drm/exynos: fix a potential error pointer dereference (Xiang Yang)   
  - ASoC: da7219: Support low DC impedance headset (David Rau)   
  - net/tg3: fix race condition in tg3_reset_task() (Thinh Tran)   
  - ASoC: rt5650: add mutex to avoid the jack detection failure (Shuming Fan)   
  - ASoC: cs43130: Fix incorrect frame delay configuration (Maciej Strozek)   
  - ASoC: cs43130: Fix the position of const qualifier (Maciej Strozek)   
  - f2fs: explicitly null-terminate the xattr list (Eric Biggers)   
  - LTS version: v4.14.337 (Saeed Mirzamohammadi)   
  - ipv6: remove max_size check inline with ipv4 (Saeed Mirzamohammadi)   
  - ipv6: make ip6_rt_gc_expire an atomic_t (Saeed Mirzamohammadi)   
  - net/dst: use a smaller percpu_counter batch for dst entries accounting (Eric Dumazet)   
  - net: add a route cache full diagnostic message (Peter Oskolkov)   
  - netfilter: nf_tables: Reject tables of unsupported family (Phil Sutter) [Orabug: 36192153] {CVE-2023-6040}
  - fuse: nlookup missing decrement in fuse_direntplus_link (ruanmeisi)   
  - mm: fix unmap_mapping_range high bits shift bug (Jiajun Xie)   
  - mm/memory-failure: check the mapcount of the precise page (Matthew Wilcox (Oracle))   
  - bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters() (Michael Chan)   
  - asix: Add check for usbnet_get_endpoints (Chen Ni)   
  - net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues (Dinghao Liu)   
  - net/qla3xxx: switch from 'pci_' to 'dma_' API (Christophe JAILLET)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.535.2.1.el7uek]
changelog:
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal)  [Orabug: 36467681]  {CVE-2024-1086}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.536.2.el7uek]
changelog:
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal)  [Orabug: 36466544]  {CVE-2024-1086} 
  - RDMA/cm: add timeout to cm_destroy_id wait (Manjunath Patil)  [Orabug: 36280065]  
  - mm: avoid heavy swap lock contention when unmapping with ktask (Anthony Yznaga)  [Orabug: 36201622]  
  - mm: use less threads when unmapping some large VMAs (Anthony Yznaga)  [Orabug: 36201622]  
  - LTS version: v4.14.341 (Yifei Liu)   
  - gpio: 74x164: Enable output pins after registers are reset (Arturas Moskvinas)   
  - cachefiles: fix memory leak in cachefiles_add_cache() (Baokun Li)   
  - mmc: core: Fix eMMC initialization with 1-bit bus connection (Ivan Semenov)   
  - btrfs: dev-replace: properly validate device names (David Sterba)   
  - wifi: nl80211: reject iftype change with mesh ID change (Johannes Berg)   
  - gtp: fix use-after-free and null-ptr-deref in gtp_newlink() (Alexander Ofitserov)   
  - ALSA: Drop leftover snd-rtctimer stuff from Makefile (Takashi Iwai)   
  - power: supply: bq27xxx-i2c: Do not free non existing IRQ (Hans de Goede)   
  - efi/capsule-loader: fix incorrect allocation size (Arnd Bergmann)   
  - Bluetooth: Enforce validation on max value of connection interval (Kai-Heng Feng)   
  - Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST (Luiz Augusto von Dentz)   
  - Bluetooth: Avoid potential use-after-free in hci_error_reset (Ying Hsu)   
  - net: usb: dm9601: fix wrong return value in dm9601_mdio_read (Javier Carrasco)   
  - lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected (Oleksij Rempel)   
  - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter (Ryosuke Yasuoka)   
  - LTS version: v4.14.340 (Yifei Liu)   
  - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio (Bart Van Assche)   
  - KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() (Oliver Upton)   
  - PCI/MSI: Prevent MSI hardware interrupt number truncation (Vidya Sagar)   
  - s390: use the correct count for __iowrite64_copy() (Jason Gunthorpe)   
  - packet: move from strlcpy with unused retval to strscpy (Wolfram Sang)   
  - ipv6: sr: fix possible use-after-free and null-ptr-deref (Vasiliy Kovalev)   
  - nouveau: fix function cast warnings (Arnd Bergmann)   
  - scsi: jazz_esp: Only build if SCSI core is builtin (Randy Dunlap)   
  - RDMA/srpt: fix function pointer cast warnings (Arnd Bergmann)   
  - RDMA/srpt: Support specifying the srpt_service_guid parameter (Bart Van Assche)   
  - IB/hfi1: Fix a memleak in init_credit_return (Zhipeng Lu)   
  - usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs (Krishna Kurapati)   
  - l2tp: pass correct message length to ip6_append_data (Tom Parkin)   
  - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() (Vasiliy Kovalev)   
  - dm-crypt: don't modify the data when using authenticated encryption (Mikulas Patocka)   
  - mm: memcontrol: switch to rcu protection in drain_all_stock() (Roman Gushchin)   
  - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Alexandra Winter)   
  - virtio-blk: Ensure no requests in virtqueues before deleting vqs. (Yi Sun)   
  - firewire: core: send bus reset promptly on gap count error (Takashi Sakamoto)   
  - hwmon: (coretemp) Enlarge per package core count limit (Zhang Rui)   
  - regulator: pwm-regulator: Add validity checks in continuous .get_voltage (Martin Blumenstingl)   
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Baokun Li)   
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Baokun Li)   
  - ahci: asm1166: correct count of reported ports (Conrad Kostecki)   
  - fbdev: sis: Error out if pixclock equals zero (Fullway Wang)   
  - fbdev: savage: Error out if pixclock equals zero (Fullway Wang)   
  - wifi: mac80211: fix race condition on enabling fast-xmit (Felix Fietkau)   
  - wifi: cfg80211: fix missing interfaces when dumping (Michal Kazior)   
  - dmaengine: shdma: increase size of 'dev_id' (Vinod Koul)   
  - scsi: target: core: Add TMF to tmr_list handling (Dmitry Bogdanov)   
  - sched/rt: Disallow writing invalid values to sched_rt_period_us (Cyril Hrubis)   
  - sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset (Cyril Hrubis)   
  - sched/rt: Fix sysctl_sched_rr_timeslice intial value (Cyril Hrubis)   
  - nilfs2: replace WARN_ONs for invalid DAT metadata block requests (Ryusuke Konishi)   
  - memcg: add refcnt for pcpu stock to avoid UAF problem in drain_all_stock() (GONG, Ruiqi)   
  - net/sched: Retire dsmark qdisc (Jamal Hadi Salim)   
  - net/sched: Retire ATM qdisc (Jamal Hadi Salim)   
  - net/sched: Retire CBQ qdisc (Jamal Hadi Salim)   
  - LTS version: v4.14.339 (Yifei Liu)   
  - PCI: Only override AMD USB controller if required (Guilherme G. Piccoli)   
  - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (Dan Carpenter)   
  - lsm: new security_file_ioctl_compat() hook (Alfred Piccioni)   
  - nilfs2: fix potential bug in end_buffer_async_write (Ryusuke Konishi)   
  - sched/membarrier: reduce the ability to hammer on sys_membarrier (Linus Torvalds)   
  - Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" (Junxiao Bi)   
  - pmdomain: core: Move the unused cleanup to a _sync initcall (Konrad Dybcio)   
  - irqchip/irq-brcmstb-l2: Add write memory barrier before exit (Doug Berger)   
  - nfp: use correct macro for LengthSelect in BAR config (Daniel Basilio)   
  - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() (Ryusuke Konishi)   
  - nilfs2: fix data corruption in dsync block recovery for small block sizes (Ryusuke Konishi)   
  - ALSA: hda/conexant: Add quirk for SWS JS201D (bo liu)   
  - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Steve Wahl)   
  - staging: iio: ad5933: fix type mismatch regression (David Schiller)   
  - ext4: fix double-free of blocks due to wrong extents moved_len (Baokun Li)   
  - nfc: nci: free rx_data_reassembly skb on NCI device cleanup (Fedor Pchelkin)   
  - firewire: core: correct documentation of fw_csr_string() kernel API (Takashi Sakamoto)   
  - scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" (Lee Duncan)   
  - usb: f_mass_storage: forbid async queue when shutdown happen (yuan linyu)   
  - USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT (Oliver Neukum)   
  - HID: wacom: Do not register input devices until after hid_hw_start (Jason Gerecke)   
  - HID: wacom: generic: Avoid reporting a serial of '0' to userspace (Tatsunosuke Tobita)   
  - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Zach O'Keefe)   
  - tracing/trigger: Fix to return error if failed to alloc snapshot (Masami Hiramatsu (Google))   
  - i40e: Fix waiting for queues of all VSIs to be disabled (Ivan Vecera)   
  - MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler (Guenter Roeck)   
  - net: sysfs: Fix /sys/class/net/<iface> path for statistics (Breno Leitao)   
  - Documentation: net-sysfs: describe missing statistics (Julian Wiedmann)   
  - ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work() (Alexey Khoroshilov)   
  - spi: ppc4xx: Drop write-only variable (Uwe Kleine-König)   
  - btrfs: send: return EOPNOTSUPP on unknown flags (David Sterba)   
  - vhost: use kzalloc() instead of kmalloc() followed by memset() (Prathu Baronia)   
  - Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID (Hans de Goede)   
  - USB: serial: cp210x: add ID for IMST iM871A-USB (Leonard Dallmayr)   
  - USB: serial: option: add Fibocom FM101-GL variant (Puliang Lu)   
  - USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e (JackBB Wu)   
  - net/af_iucv: clean up a try_then_request_module() (Julian Wiedmann)   
  - netfilter: nft_compat: restrict match/target protocol to u16 (Pablo Neira Ayuso)   
  - netfilter: nft_compat: reject unused compat flag (Pablo Neira Ayuso)   
  - ppp_async: limit MRU to 64K (Eric Dumazet)   
  - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (Shigeru Yoshida)   
  - rxrpc: Fix response to PING RESPONSE ACKs to a dead call (David Howells)   
  - inet: read sk->sk_family once in inet_recv_error() (Eric Dumazet)   
  - hwmon: (aspeed-pwm-tacho) mutex for tach reading (Loic Prylli)   
  - atm: idt77252: fix a memleak in open_card_ubr0 (Zhipeng Lu)   
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Tony Lindgren)   
  - dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV (Frank Li)   
  - bonding: remove print in bond_verify_device_path (Zhengchao Shao)   
  - HID: apple: Add 2021 magic keyboard FN key mapping (Benjamin Berg)   
  - HID: apple: Add support for the 2021 Magic Keyboard (Alex Henrie)   
  - HID: apple: Swap the Fn and Left Control keys on Apple keyboards (free5lot)   
  - net: sysfs: Fix /sys/class/net/<iface> path (Breno Leitao)   
  - af_unix: fix lockdep positive in sk_diag_dump_icons() (Eric Dumazet)   
  - net: ipv4: fix a memleak in ip_setup_cork (Zhipeng Lu)   
  - net: Fix one possible memleak in ip_setup_cork (Gao Feng)   
  - netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger (Pablo Neira Ayuso)   
  - llc: call sock_orphan() at release time (Eric Dumazet)   
  - ipv6: Ensure natural alignment of const ipv6 loopback and router addresses (Helge Deller)   
  - ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550() (Christophe JAILLET)   
  - ixgbe: Refactor overtemp event handling (Jedrzej Jagielski)   
  - ixgbe: Remove non-inclusive language (Piotr Skajewski)   
  - net: remove unneeded break (Tom Rix)   
  - scsi: isci: Fix an error code problem in isci_io_request_build() (Su Hui)   
  - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update (Edward Adam Davis)   
  - drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()' (Srinivasan Shanmugam)   
  - ceph: fix deadlock or deadcode of misusing dget() (Xiubo Li)   
  - virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings (Zhu Yanjun)   
  - libsubcmd: Fix memory leak in uniq() (Ian Rogers)   
  - usb: hub: Replace hardcoded quirk value with BIT() macro (Hardik Gajjar)   
  - mfd: ti_am335x_tscadc: Fix TI SoC dependencies (Peter Robinson)   
  - um: net: Fix return type of uml_net_start_xmit() (Nathan Chancellor)   
  - um: Don't use vfprintf() for os_info() (Benjamin Berg)   
  - um: Fix naming clash between UML and scheduler (Anton Ivanov)   
  - leds: trigger: panic: Don't register panic notifier if creating the trigger failed (Heiner Kallweit)   
  - clk: mmp: pxa168: Fix memory leak in pxa168_clk_init() (Kuan-Wei Chiu)   
  - clk: hi3620: Fix memory leak in hi3620_mmc_clk_init() (Kuan-Wei Chiu)   
  - media: ddbridge: fix an error code problem in ddb_probe (Su Hui)   
  - IB/ipoib: Fix mcast list locking (Daniel Vacek)   
  - drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time (Douglas Anderson)   
  - ALSA: hda: Intel: add HDA_ARL PCI ID support (Pierre-Louis Bossart)   
  - ALSA: hda: Add Icelake PCI ID (Guneshwor Singh)   
  - PCI: add INTEL_HDA_ARL to pci_ids.h (Pierre-Louis Bossart)   
  - media: stk1160: Fixed high volume of stk1160_dbg messages (Ghanshyam Agrawal)   
  - drm/mipi-dsi: Fix detach call without attach (Tomi Valkeinen)   
  - drm/framebuffer: Fix use of uninitialized variable (Tomi Valkeinen)   
  - drm/drm_file: fix use of uninitialized variable (Tomi Valkeinen)   
  - RDMA/IPoIB: Fix error code return in ipoib_mcast_join (Jack Wang)   
  - fast_dput(): handle underflows gracefully (Al Viro)   
  - ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument (Cristian Ciocaltea)   
  - wifi: cfg80211: free beacon_ies when overridden from hidden BSS (Benjamin Berg)   
  - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() (Su Hui)   
  - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices (Zenm Chen)   
  - md: Whenassemble the array, consult the superblock of the freshest device (Alex Lyakas)   
  - ARM: dts: imx23/28: Fix the DMA controller node name (Fabio Estevam)   
  - ARM: dts: imx23-sansa: Use preferred i2c-gpios properties (Fabio Estevam)   
  - ARM: dts: imx27-apf27dev: Fix LED name (Fabio Estevam)   
  - ARM: dts: imx1: Fix sram node (Fabio Estevam)   
  - ARM: dts: imx27: Fix sram node (Fabio Estevam)   
  - ARM: dts: imx: Use flash@0,0 pattern (Fabio Estevam)   
  - ARM: dts: imx25/27-eukrea: Fix RTC node name (Fabio Estevam)   
  - ARM: dts: rockchip: fix rk3036 hdmi ports node (Johan Jonker)   
  - scsi: libfc: Fix up timeout error in fc_fcp_rec_error() (Hannes Reinecke)   
  - scsi: libfc: Don't schedule abort twice (Hannes Reinecke)   
  - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Hou Tao)   
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Minsuk Kang)   
  - ARM: dts: imx7s: Fix nand-controller #size-cells (Alexander Stein)   
  - ARM: dts: imx7s: Fix lcdif compatible (Alexander Stein)   
  - bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk (Zhengchao Shao)   
  - PCI: Add no PM reset quirk for NVIDIA Spectrum devices (Ido Schimmel)   
  - scsi: lpfc: Fix possible file string name overflow when updating firmware (Justin Tee)   
  - ext4: unify the type of flexbg_size to unsigned int (Baokun Li)   
  - SUNRPC: Fix a suspicious RCU usage warning (Anna Schumaker)   
  - KVM: s390: fix setting of fpc register (Heiko Carstens)   
  - s390/ptrace: handle setting of fpc register correctly (Heiko Carstens)   
  - jfs: fix array-index-out-of-bounds in diNewExt (Edward Adam Davis)   
  - rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() (Oleg Nesterov)   
  - pstore/ram: Fix crash when setting number of cpus to an odd number (Weichen Chen)   
  - jfs: fix uaf in jfs_evict_inode (Edward Adam Davis)   
  - jfs: fix array-index-out-of-bounds in dbAdjTree (Manas Ghandat)   
  - jfs: fix slab-out-of-bounds Read in dtSearch (Manas Ghandat)   
  - UBSAN: array-index-out-of-bounds in dtSplitRoot (Osama Muhammad)   
  - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree (Osama Muhammad)   
  - ACPI: extlog: fix NULL pointer dereference check (Prarit Bhargava)   
  - PNP: ACPI: fix fortify warning (Dmitry Antipov)   
  - ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop (Yuluo Qiu)   
  - audit: Send netlink ACK before setting connection in auditd_set (Chris Riches)   
  - powerpc/lib: Validate size for vector operations (Naveen N Rao)   
  - powerpc/mm: Fix build failures due to arch_reserved_kernel_pages() (Michael Ellerman)   
  - powerpc: Fix build error due to is_valid_bugaddr() (Michael Ellerman)   
  - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Kunwu Chan)   
  - tick/sched: Preserve number of idle sleeps across CPU hotplug events (Tim Chen)   
  - mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan (Xi Ruoyao)   
  - drm/bridge: nxp-ptn3460: simplify some error checking (Dan Carpenter)   
  - drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking (Dan Carpenter)   
  - drm: Don't unref the same fb many times by mistake due to deadlock handling (Ville Syrjälä)   
  - gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04 (Mario Limonciello)   
  - btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args (Qu Wenruo)   
  - btrfs: don't warn if discard range is not aligned to sector (David Sterba)   
  - net: fec: fix the unhandled context fault from smmu (Shenwei Wang)   
  - fjes: fix memleaks in fjes_hw_setup (Zhipeng Lu)   
  - netfilter: nf_tables: restrict anonymous set and map names to 16 bytes (Florian Westphal)   
  - net/mlx5e: fix a double-free in arfs_create_groups (Zhipeng Lu)   
  - net/mlx5: Use kfree(ft->g) in arfs_create_groups() (Denis Efremov)   
  - netlink: fix potential sleeping issue in mqueue_flush_file (Zhengchao Shao)   
  - tcp: Add memory barrier to tcp_push() (Salvatore Dipietro)   
  - net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv (Sharath Srinivasan)   
  - llc: Drop support for ETH_P_TR_802_2. (Kuniyuki Iwashima)   
  - llc: make llc_ui_sendmsg() more robust against bonding changes (Eric Dumazet)   
  - vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING (Lin Ma)   
  - drivers: core: fix kernel-doc markup for dev_err_probe() (Mauro Carvalho Chehab)   
  - driver code: print symbolic error code (Michał Mirosław)   
  - Revert "driver core: Annotate dev_err_probe() with __must_check" (Greg Kroah-Hartman)   
  - driver core: Annotate dev_err_probe() with __must_check (Andy Shevchenko)   
  - x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum (Maciej S. Szmigiero)   
  - powerpc: Use always instead of always-y in for crtsavres.o (Nathan Chancellor)   
  - block: Remove special-casing of compound pages (Matthew Wilcox (Oracle))   
  - parisc/firmware: Fix F-extend for PDC addresses (Helge Deller)   
  - rpmsg: virtio: Free driver_override when rpmsg_remove() (Xiaolei Wang)   
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Herbert Xu)   
  - PM: hibernate: Enforce ordering during image compression/decompression (Hongchen Zhang)   
  - crypto: api - Disallow identical driver names (Herbert Xu)   
  - serial: sc16is7xx: add check for unsupported SPI modes during probe (Hugo Villeneuve)   
  - spi: introduce SPI_MODE_X_MASK macro (Oleksij Rempel)   
  - driver core: add device probe log helper (Andrzej Hajda)   
  - serial: sc16is7xx: set safe default SPI clock frequency (Hugo Villeneuve)   
  - units: add the HZ macros (Daniel Lezcano)   
  - units: change from 'L' to 'UL' (Daniel Lezcano)   
  - units: Add Watt units (Daniel Lezcano)   
  - include/linux/units.h: add helpers for kelvin to/from Celsius conversion (Akinobu Mita)   
  - PCI: mediatek: Clear interrupt status before dispatching handler (qizhong cheng)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.536.3.el7uek]
changelog:
  - Revert "net/sched: Retire CBQ qdisc" (Saeed Mirzamohammadi)   
  - Revert "net/sched: Retire ATM qdisc" (Saeed Mirzamohammadi)   
  - Revert "net/sched: Retire dsmark qdisc" (Saeed Mirzamohammadi)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.536.4.el7uek]
changelog:
  - rds/rdma: print connection up/down time while dropping/connecting (Juan Garcia)  [Orabug: 36264661]  
  - bonding: rate-limit bonding driver inspect messages (Praveen Kumar Kannoju)  [Orabug: 36223525]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.536.5.el7uek]
changelog:
  - mmc: core: Fix switch on gp3 partition (Dominique Martinet)   
  - Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"" (Song Liu)   
  - mm/memory-failure: fix an incorrect use of tail pages (Liu Shixin)   
  - Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped." (Ingo Molnar)   
  - sched/fair: More accurate reweight_entity() (Peter Zijlstra)  [Orabug: 36468903]  
  - sched/fair: Introduce {en,de}queue_load_avg() (Peter Zijlstra)  [Orabug: 36468903]  
  - sched/fair: Rename {en,de}queue_entity_load_avg() (Peter Zijlstra)  [Orabug: 36468903]  
  - sched/fair: Move enqueue migrate handling (Peter Zijlstra)  [Orabug: 36468903]  
  - sched/fair: Change update_load_avg() arguments (Peter Zijlstra)  [Orabug: 36468903]  
  - sched/fair: Remove se->load.weight from se->avg.load_sum (Peter Zijlstra)  [Orabug: 36468903]  
  - sched/fair: Cure calc_cfs_shares() vs. reweight_entity() (Peter Zijlstra)  [Orabug: 36468903]  
  - sched/fair: Add comment to calc_cfs_shares() (Peter Zijlstra)  [Orabug: 36468903]  
  - sched/fair: Clean up calc_cfs_shares() (Peter Zijlstra)  [Orabug: 36468903]  
  - rds/rdma: Fix congestion value for userspace consumption (Juan Garcia)  [Orabug: 36264644]  
  - rds: Include transport protocol name in rds-info -k output (Juan Garcia)  [Orabug: 36264644]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.537.1.el7uek]
changelog:
  - igb: free up irq resources in device shutdown path. (Imran Khan)  [Orabug: 36547251]  
  - RDMA/cm: Print the old state when cm_destroy_id gets timeout (Mark Zhang)  [Orabug: 36546697]  
  - exec, elf: ignore malformed note segments (Anthony Yznaga)  [Orabug: 36524978]  
  - LTS version: v4.14.343 (Yifei Liu)   
  - crypto: af_alg - Work around empty control messages without MSG_MORE (Herbert Xu)   
  - crypto: af_alg - Fix regression on empty requests (Herbert Xu)   
  - spi: spi-mt65xx: Fix NULL pointer access in interrupt handler (Fei Shao)   
  - net/bnx2x: Prevent access to a freed page in page_pool (Thinh Tran)   
  - hsr: Handle failures in module init (Felix Maurer)   
  - rds: introduce acquire/release ordering in acquire/release_in_xmit() (Yewon Choi)   
  - hsr: Fix uninit-value access in hsr_get_node() (Shigeru Yoshida)   
  - net: hsr: fix placement of logical operator in a multi-line statement (Murali Karicheri)   
  - usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin (Colin Ian King)   
  - staging: greybus: fix get_channel_from_mode() failure path (Dan Carpenter)   
  - serial: 8250_exar: Don't remove GPIO device on suspend (Andy Shevchenko)   
  - rtc: mt6397: select IRQ_DOMAIN instead of depending on it (Randy Dunlap)   
  - rtc: mediatek: enhance the description for MediaTek PMIC based RTC (Sean Wang)   
  - tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT (Tudor Ambarus)   
  - serial: max310x: fix syntax error in IRQ error message (Hugo Villeneuve)   
  - clk: qcom: gdsc: Add support to update GDSC transition delay (Taniya Das)   
  - NFS: Fix an off by one in root_nfs_cat() (Christophe JAILLET)   
  - net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() (Christophe JAILLET)   
  - scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn (Arnd Bergmann)   
  - scsi: csiostor: Avoid function pointer casts (Arnd Bergmann)   
  - ALSA: usb-audio: Stop parsing channels bits when all channels are found. (Johan Carlsson)   
  - sparc32: Fix section mismatch in leon_pci_grpci (Sam Ravnborg)   
  - backlight: lp8788: Fully initialize backlight_properties during probe (Daniel Thompson)   
  - backlight: lm3639: Fully initialize backlight_properties during probe (Daniel Thompson)   
  - backlight: da9052: Fully initialize backlight_properties during probe (Daniel Thompson)   
  - backlight: lm3630a: Don't set bl->props.brightness in get_brightness (Luca Weiss)   
  - backlight: lm3630a: Initialize backlight_properties on init (Luca Weiss)   
  - powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc. (Michael Ellerman)   
  - powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks (Kajol Jain)   
  - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip (Hsin-Yi Wang)   
  - media: go7007: fix a memleak in go7007_load_encoder (Zhipeng Lu)   
  - media: dvb-frontends: avoid stack overflow warnings with clang (Arnd Bergmann)   
  - media: pvrusb2: fix uaf in pvr2_context_set_notify (Edward Adam Davis)   
  - drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int() (Srinivasan Shanmugam)   
  - mtd: rawnand: lpc32xx_mlc: fix irq handler prototype (Arnd Bergmann)   
  - crypto: arm/sha - fix function cast warnings (Arnd Bergmann)   
  - crypto: arm - Rename functions to avoid conflict with crypto/sha256.h (Hans de Goede)   
  - mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref (Peter Griffin)   
  - drm/tegra: put drm_gem_object ref on error in tegra_fb_create (Fedor Pchelkin)   
  - clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister() (Christophe JAILLET)   
  - PCI: Mark 3ware-9650SE Root Port Extended Tags as broken (Jörg Wedekind)   
  - drm/mediatek: dsi: Fix DSI RGB666 formats and definitions (AngeloGioacchino Del Regno)   
  - media: pvrusb2: fix pvr2_stream_callback casts (Arnd Bergmann)   
  - media: go7007: add check of return value of go7007_read_addr() (Daniil Dulov)   
  - ALSA: seq: fix function cast warnings (Takashi Iwai)   
  - drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode() (Nikita Zhandarovich)   
  - perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str() (Yang Jihong)   
  - quota: Fix rcu annotations of inode dquot pointers (Jan Kara)   
  - quota: Fix potential NULL pointer dereference (Wang Jianjian)   
  - quota: simplify drop_dquot_ref() (Baokun Li)   
  - quota: check time limit when back out space/inode change (Chengguang Xu)   
  - fs/quota: erase unused but set variable warning (Jiang Biao)   
  - quota: code cleanup for __dquot_alloc_space() (Chengguang Xu)   
  - clk: qcom: reset: Ensure write completion on reset de/assertion (Konrad Dybcio)   
  - clk: qcom: reset: Commonize the de/assert functions (Konrad Dybcio)   
  - clk: qcom: reset: support resetting multiple bits (Robert Marko)   
  - clk: qcom: reset: Allow specifying custom reset delay (Stephan Gerhold)   
  - media: edia: dvbdev: fix a use-after-free (Zhipeng Lu)   
  - media: dvb-core: Fix use-after-free due to race at dvb_register_device() (Hyunwoo Kim)   
  - media: dvbdev: convert DVB device types into an enum (Mauro Carvalho Chehab)   
  - media: dvbdev: fix error logic at dvb_register_device() (Mauro Carvalho Chehab)   
  - media: dvbdev: Fix memleak in dvb_register_device (Dinghao Liu)   
  - media: media/dvb: Use kmemdup rather than duplicating its implementation (Fuqian Huang)   
  - media: dvbdev: remove double-unlock (Mauro Carvalho Chehab)   
  - media: v4l2-tpg: fix some memleaks in tpg_alloc (Zhipeng Lu)   
  - media: em28xx: annotate unchecked call to media_device_register() (Nikita Zhandarovich)   
  - media: tc358743: register v4l2 async device only after successful setup (Alexander Stein)   
  - drm: Don't treat 0 as -1 in drm_fixp2int_ceil (Harry Wentland)   
  - drm/rockchip: inno_hdmi: Fix video timing (Alex Bee)   
  - drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe() (Christophe JAILLET)   
  - drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe() (Christophe JAILLET)   
  - drm/tegra: dsi: Make use of the helper function dev_err_probe() (Cai Huoqing)   
  - gpu: host1x: mipi: Update tegra_mipi_request() to be node based (Sowjanya Komatineni)   
  - drm/tegra: dsi: Add missing check for of_find_device_by_node (Chen Ni)   
  - dm: call the resume method on internal suspend (Mikulas Patocka)   
  - dm raid: fix false positive for requeue needed during reshape (Ming Lei)   
  - net/x25: fix incorrect parameter validation in the x25_getsockopt() function (Gavrilov Ilia)   
  - net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function (Gavrilov Ilia)   
  - udp: fix incorrect parameter validation in the udp_lib_getsockopt() function (Gavrilov Ilia)   
  - l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function (Gavrilov Ilia)   
  - tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function (Gavrilov Ilia)   
  - ipv6: fib6_rules: flush route cache when rule is changed (Shiming Cheng)   
  - bpf: Fix stackmap overflow check on 32-bit arches (Toke Høiland-Jørgensen)   
  - bpf: Fix hashtab overflow check on 32-bit arches (Toke Høiland-Jørgensen)   
  - sr9800: Add check for usbnet_get_endpoints (Chen Ni)   
  - Bluetooth: hci_core: Fix possible buffer overflow (Luiz Augusto von Dentz)   
  - Bluetooth: Remove superfluous call to hci_conn_check_pending() (Jonas Dreßler)   
  - igb: Fix missing time sync events (Vinicius Costa Gomes)   
  - igb: move PEROUT and EXTTS isr logic to separate functions (Ruud Bos)   
  - mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function (Christophe JAILLET)   
  - SUNRPC: fix some memleaks in gssx_dec_option_array (Zhipeng Lu)   
  - x86, relocs: Ignore relocations in .notes section (Kees Cook)   
  - ACPI: scan: Fix device check notification handling (Rafael J. Wysocki)   
  - ARM: dts: arm: realview: Fix development chip ROM compatible value (Geert Uytterhoeven)   
  - wifi: brcmsmac: avoid function pointer casts (Arnd Bergmann)   
  - iommu/amd: Mark interrupt as managed (Mario Limonciello)   
  - bus: tegra-aconnect: Update dependency to ARCH_TEGRA (Peter Robinson)   
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Armin Wolf)   
  - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() (Zhipeng Lu)   
  - af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc(). (Kuniyuki Iwashima)   
  - sock_diag: annotate data-races around sock_diag_handlers[family] (Eric Dumazet)   
  - sock_diag: request _diag module only when the family or proto has been registered (Xin Long)   
  - wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir() (Jinjie Ruan)   
  - wifi: b43: Disable QoS for bcm4331 (Rahul Rameshbabu)   
  - wifi: b43: Stop correct queue in DMA worker when QoS is disabled (Rahul Rameshbabu)   
  - b43: main: Fix use true/false for bool type (Saurav Girepunje)   
  - wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled (Rahul Rameshbabu)   
  - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled (Rahul Rameshbabu)   
  - b43: dma: Fix use true/false for bool type variable (Saurav Girepunje)   
  - timekeeping: Fix cross-timestamp interpolation for non-x86 (Peter Hilber)   
  - timekeeping: Fix cross-timestamp interpolation corner case decision (Peter Hilber)   
  - timekeeping: Fix cross-timestamp interpolation on counter wrap (Peter Hilber)   
  - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts (Chun-Yi Lee)   
  - md: Don't clear MD_CLOSING when the raid is about to stop (Li Nan)   
  - md: implement ->set_read_only to hook into BLKROSET processing (Christoph Hellwig)   
  - block: add a new set_read_only method (Christoph Hellwig)   
  - md: switch to ->check_events for media change notifications (Christoph Hellwig)   
  - fs/select: rework stack allocation hack for clang (Arnd Bergmann)   
  - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Nikita Zhandarovich)   
  - crypto: algif_aead - Only wake up when ctx->more is zero (Herbert Xu)   
  - crypto: af_alg - make some functions static (Eric Biggers)   
  - ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll (Stuart Henderson)   
  - ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode (Stuart Henderson)   
  - ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC (Stuart Henderson)   
  - Input: gpio_keys_polled - suppress deferred probe error for gpio (Uwe Kleine-König)   
  - firewire: core: use long bus reset on gap count error (Takashi Sakamoto)   
  - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security (Yuxuan Hu)   
  - scsi: mpt3sas: Prevent sending diag_reset when the controller is ready (Ranjan Kumar)   
  - dm-verity, dm-crypt: align "struct bvec_iter" correctly (Mikulas Patocka)   
  - block: sed-opal: handle empty atoms when parsing response (Greg Joyce)   
  - net/iucv: fix the allocation size of iucv_path_table array (Alexander Gordeev)   
  - MIPS: Clear Cause.BD in instruction_pointer_set (Jiaxun Yang)   
  - x86/xen: Add some null pointer checking to smp.c (Kunwu Chan)   
  - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (Xiu Jianfeng)   
  - xen/events: only register debug interrupt for 2-level events (Juergen Gross)   
  - LTS version: v4.14.342 (Yifei Liu)   
  - selftests/vm: fix map_hugetlb length used for testing read and write (Christophe Leroy)   
  - selftests/vm: fix display of page size in map_hugetlb (Christophe Leroy)   
  - getrusage: use sig->stats_lock rather than lock_task_sighand() (Oleg Nesterov)   
  - getrusage: use __for_each_thread() (Oleg Nesterov)   
  - getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Oleg Nesterov)   
  - getrusage: add the "signal_struct *sig" local variable (Oleg Nesterov)   
  - hv_netvsc: use netif_is_bond_master() instead of open code (Juhee Kang)   
  - um: allow not setting extra rpaths in the linux binary (Johannes Berg)   
  - selftests: mm: fix map_hugetlb failure on 64K page size systems (Nico Pache)   
  - tools/selftest/vm: allow choosing mem size and page size in map_hugetlb (Christophe Leroy)   
  - netrom: Fix data-races around sysctl_net_busy_read (Jason Xing)   
  - netrom: Fix a data-race around sysctl_netrom_link_fails_count (Jason Xing)   
  - netrom: Fix a data-race around sysctl_netrom_routing_control (Jason Xing)   
  - netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout (Jason Xing)   
  - netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size (Jason Xing)   
  - netrom: Fix a data-race around sysctl_netrom_transport_busy_delay (Jason Xing)   
  - netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay (Jason Xing)   
  - netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries (Jason Xing)   
  - netrom: Fix a data-race around sysctl_netrom_transport_timeout (Jason Xing)   
  - netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser (Jason Xing)   
  - netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser (Jason Xing)   
  - netrom: Fix a data-race around sysctl_netrom_default_path_quality (Jason Xing)   
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Lena Wang)   
  - netfilter: nf_ct_h323: Extend nf_h323_error_boundary to work on bits as well (Eric Sesterhenn)   
  - netfilter: nf_ct_h323: Convert CHECK_BOUND macro to function (Eric Sesterhenn)   
  - netfilter: nf_ct_h323: Out Of Bound Read in Netfilter Conntrack (Eric Sesterhenn)   
  - netfilter: nf_conntrack_h323: Remove typedef struct (Harsha Sharma)   
  - geneve: make sure to pull inner header in geneve_rx() (Eric Dumazet)   
  - net: move definition of pcpu_lstats to header file (Li RongQing)   
  - net: lan78xx: fix runtime PM count underflow on link stop (Oleksij Rempel)   
  - lan78xx: Fix race conditions in suspend/resume handling (John Efstathiades)   
  - lan78xx: Fix partial packet errors on suspend/resume (John Efstathiades)   
  - lan78xx: Add missing return code checks (John Efstathiades)   
  - lan78xx: Fix white space and style issues (John Efstathiades)   
  - net: usb: lan78xx: Remove lots of set but unused 'ret' variables (Lee Jones)   
  - net: usb: lan78xx: Disable interrupts before calling generic_handle_irq() (Daniel Wagner)   
  - net: lan78xx: Allow for VLAN headers in timeout calcs (Dave Stevenson)   
  - ip: validate header length on virtual device xmit (Willem de Bruijn)


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.537.3.el7uek]
changelog:
  - ahci: asm1064: asm1166: don't limit reported ports (Conrad Kostecki)   
  - ahci: asm1064: correct count of reported ports (Andrey Jr. Melnikov)   
  - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion (Bart Van Assche)   
  - igb: fix __free_irq warnings seen during module unload. (Imran Khan)  [Orabug: 36618479]  
  - mm: fix misleading-indentation build warning (Anthony Yznaga)  [Orabug: 36612276]  
  - uek: kabi: Enable the size checks and fix broken APIs (Saeed Mirzamohammadi)  [Orabug: 36545474]  
  - uek: kabi: Introduce new APIs to check for size (Saeed Mirzamohammadi)  [Orabug: 36545474]  
  - cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock (Tejun Heo)  [Orabug: 36480026]  
  - uek-rpm: ol7: fix prod build with editbuildid (Stephen Brennan)  [Orabug: 35099077]  
  - uek-rpm: ol7: Prevent vmlinux build ID mismatch (Stephen Brennan)  [Orabug: 35099077]  
  - uek-rpm: ol7: Remove fancy_debuginfo (Stephen Brennan)  [Orabug: 35099077]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.537.4.el7uek]
changelog:
  - uek-rpm: iptables/nftables TABLE_ADD failed (Operation not supported) (Venkat Venkatsubra)  [Orabug: 36638482]  
  - Revert "crypto: api - Disallow identical driver names" (Greg Kroah-Hartman)   
  - Revert "tracing/trigger: Fix to return error if failed to alloc snapshot" (Siddh Raman Pant)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.538.1.el7uek]
changelog:
  - uek-rpm: Enable FUNCTION_GRAPH_RETVAL in UEK5 (Jianfeng Wang)  [Orabug: 36460666]  
  - fgraph: Add declaration of "struct fgraph_ret_regs" (Steven Rostedt (Google))  [Orabug: 36460666]  
  - x86/ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL (Donglin Peng)  [Orabug: 36460666]  
  - arm64: ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL (Donglin Peng)  [Orabug: 36460666]  
  - arm64: ftrace: remove return_regs macros (Mark Rutland)  [Orabug: 36460666]  
  - function_graph: Support recording and printing the return value of function (Donglin Peng)  [Orabug: 36460666]  
  - fgraph: Make overruns 4 bytes in graph stack structure (Steven Rostedt (VMware))  [Orabug: 36460666]  
  - net/rds: Get RDS statistics for each possible CPU (Anand Khoje)  [Orabug: 35830450]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.538.2.el7uek]
changelog:
  - slub: use count_partial_free_approx() in slab_out_of_memory() (Jianfeng Wang)  [Orabug: 36655470]  
  - slub: introduce count_partial_free_approx() (Jianfeng Wang)  [Orabug: 36655470]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.538.3.el7uek]
changelog:
  - uek-rpm: disable --strict-build-id on mips64 (Stephen Brennan)  [Orabug: 36717400]  
  - LTS version: v4.14.348 (Yifei Liu)   
  - docs: kernel_include.py: Cope with docutils 0.21 (Akira Yokosawa)   
  - serial: kgdboc: Fix NMI-safety problems from keyboard reset code (Daniel Thompson)   
  - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() (Dominique Martinet)   
  - dm: limit the number of targets and parameter size area (Mikulas Patocka)   
  - Revert "selftests: mm: fix map_hugetlb failure on 64K page size systems" (Harshit Mogalapalli)   
  - LTS version: v4.14.347 (Yifei Liu)   
  - rds: Fix build regression. (David S. Miller)   
  - RDS: IB: Use DEFINE_PER_CPU_SHARED_ALIGNED for rds_ib_stats (Nathan Chancellor)   
  - af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc(). (Kuniyuki Iwashima)   
  - net: fix out-of-bounds access in ops_init (Thadeu Lima de Souza Cascardo)   
  - drm/vmwgfx: Fix invalid reads in fence signaled events (Zack Rusin)   
  - dyndbg: fix old BUG_ON in >control parser (Jim Cromie)   
  - tipc: fix UAF in error path (Paolo Abeni)   
  - usb: gadget: f_fs: Fix a race condition when processing setup packets. (Chris Wulff)   
  - usb: gadget: composite: fix OS descriptors w_value logic (Peter Korsgaard)   
  - firewire: nosy: ensure user_length is taken into account when fetching packet contents (Thanassis Avgerinos)   
  - af_unix: Fix garbage collector racing against connect() (Michal Luczaj)   
  - af_unix: Do not use atomic ops for unix_sk(sk)->inflight. (Kuniyuki Iwashima)   
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (Eric Dumazet)   
  - net/ipv6: Refactor fib6_rule_action (David Ahern)   
  - net: bridge: fix corrupted ethernet header on multicast-to-unicast (Felix Fietkau)   
  - net: bridge: use DEV_STATS_INC() (Eric Dumazet)   
  - phonet: fix rtm_phonet_notify() skb allocation (Eric Dumazet)   
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Roded Zats)   
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (Duoming Zhou)   
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (Duoming Zhou)   
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (Eric Dumazet)   
  - tcp: remove redundant check on tskb (Colin Ian King)   
  - net:usb:qmi_wwan: support Rolling modules (Vanillan Wang)   
  - fs/9p: drop inodes immediately on non-.L too (Joakim Sindholt)   
  - gpio: crystalcove: Use -ENOTSUPP consistently (Andy Shevchenko)   
  - gpio: wcove: Use -ENOTSUPP consistently (Andy Shevchenko)   
  - 9p: explicitly deny setlease attempts (Jeff Layton)   
  - fs/9p: translate O_TRUNC into OTRUNC (Joakim Sindholt)   
  - fs/9p: only translate RWX permissions for plain 9P2000 (Joakim Sindholt)   
  - selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior (John Stultz)   
  - scsi: target: Fix SELinux error when systemd-modules loads the target module (Maurizio Lombardi)   
  - tools/power turbostat: Fix Bzy_MHz documentation typo (Peng Liu)   
  - tools/power turbostat: Fix added raw MSR output (Doug Smythies)   
  - firewire: ohci: mask bus reset interrupts between ISR and bottom half (Adam Goldman)   
  - ata: sata_gemini: Check clk_enable() result (Chen Ni)   
  - net: bcmgenet: Reset RBUF on first open (Phil Elwell)   
  - ALSA: line6: Zero-initialize message buffers (Takashi Iwai)   
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (Saurav Kashyap)   
  - net: mark racy access on sk->sk_rcvbuf (linke li)   
  - wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc (Jeff Johnson)   
  - scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic (Justin Tee)   
  - tipc: fix a possible memleak in tipc_buf_append (Xin Long)   
  - net: bridge: fix multicast-to-unicast with fraglist GSO (Felix Fietkau)   
  - net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341 (Marek Behún)   
  - net: dsa: mv88e6xxx: Fix name of switch 88E6141 (Uwe Kleine-König)   
  - net: dsa: mv88e6xxx: Add number of MACs in the ATU (Andrew Lunn)   
  - net l2tp: drop flow hash on forward (David Bauer)   
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). (Kuniyuki Iwashima)   
  - bna: ensure the copied buf is NUL terminated (Bui Quang Minh)   
  - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() (Zeng Heng)   
  - power: rt9455: hide unused rt9455_boost_voltage_values (Arnd Bergmann)   
  - pinctrl: core: delete incorrect free in pinctrl_enable() (Dan Carpenter)   
  - ethernet: Add helper for assigning packet type when dest address does not match device address (Rahul Rameshbabu)   
  - ethernet: add a helper for assigning port addresses (Jakub Kicinski)   
  - net: create netdev->dev_addr assignment helpers (Jakub Kicinski)   
  - net: slightly optimize eth_type_trans (Li RongQing)   
  - wifi: nl80211: don't free NULL coalescing rule (Johannes Berg)   
  - dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state" (Vinod Koul)   
  - dmaengine: pl330: issue_pending waits until WFP state (Bumyong Lee)   
  - LTS version: v4.14.346 (Yifei Liu)   
  - Simplify major/minor non-dynamic logic (Mauro Carvalho Chehab)   
  - net: fix unused variable warning in do_tcp_setsockopt() (Harshit Mogalapalli)   
  - serial: core: fix kernel-doc for uart_port_unlock_irqrestore() (Randy Dunlap)   
  - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up (Nam Cao)   
  - i2c: smbus: fix NULL function pointer dereference (Wolfram Sang)   
  - i2c: add param sanity check to i2c_transfer() (Ard Biesheuvel)   
  - idma64: Don't try to serve interrupts when device is powered off (Andy Shevchenko)   
  - mtd: diskonchip: work around ubsan link failure (Arnd Bergmann)   
  - stackdepot: respect __GFP_NOLOCKDEP allocation flag (Andrey Ryabinin)   
  - net: b44: set pause params only when interface is up (Peter Münster)   
  - irqchip/gic-v3-its: Prevent double free on error (Guanrui Huang)   
  - arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma (Iskander Amara)   
  - btrfs: fix information leak in btrfs_ioctl_logical_to_ino() (Johannes Thumshirn)   
  - Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() (Nathan Chancellor)   
  - tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together (Robin H. Johnson)   
  - tracing: Show size of requested perf buffer (Robin H. Johnson)   
  - drm/amdgpu: validate the parameters of bo mapping operations more clearly (xinhui pan)   
  - amdgpu: validate offset_in_bo of drm_amdgpu_gem_va (Chia-I Wu)   
  - drm/amdgpu: restrict bo mapping within gpu address limits (Rajneesh Bhardwaj)   
  - serial: mxs-auart: add spinlock around changing cts state (Emil Kronborg)   
  - serial: core: Provide port lock wrappers (Thomas Gleixner)   
  - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Sindhu Devale)   
  - ipvs: Fix checksumming on GSO of SCTP packets (Ismael Luceno)   
  - net: gtp: Fix Use-After-Free in gtp_dellink (Hyunwoo Kim)   
  - net: usb: ax88179_178a: stop lying about skb->truesize (Eric Dumazet)   
  - NFC: trf7970a: disable all regulators on removal (Paul Geurts)   
  - mlxsw: core: Unregister EMAD trap using FORWARD action (Ido Schimmel)   
  - vxlan: drop packets from invalid src-address (David Bauer)   
  - ARC: [plat-hsdk]: Remove misplaced interrupt-cells property (Alexey Brodkin)   
  - arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma (Quentin Schulz)   
  - arm64: dts: rockchip: fix alphabetical ordering RK3399 puma (Iskander Amara)   
  - nilfs2: fix OOB in nilfs_set_de_type (Jeongjun Park)   
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Alan Stern)   
  - speakup: Avoid crash on very long word (Samuel Thibault)   
  - usb: dwc2: host: Fix dereference issue in DDMA completion flow. (Minas Harutyunyan)   
  - Revert "usb: cdc-wdm: close race between read and workqueue" (Greg Kroah-Hartman)   
  - USB: serial: option: add Telit FN920C04 rmnet compositions (Daniele Palmas)   
  - USB: serial: option: add Rolling RW101-GL and RW135-GL support (Vanillan Wang)   
  - USB: serial: option: support Quectel EM060K sub-models (Jerry Meng)   
  - USB: serial: option: add Lonsung U8300/U9300 product (Coia Prant)   
  - USB: serial: option: add support for Fibocom FM650/FG650 (Chuanhong Guo)   
  - USB: serial: option: add Fibocom FM135-GL variants (bolan wang)   
  - serial/pmac_zilog: Remove flawed mitigation for rx irq flood (Finn Thain)   
  - comedi: vmk80xx: fix incomplete endpoint checking (Nikita Zhandarovich)   
  - drm: nv04: Fix out of bounds access (Mikhail Kobuk)   
  - tun: limit printing rate when illegal packet received by tun dev (Lei Chen)   
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Ziyang Xuan)   
  - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Pablo Neira Ayuso)   
  - kprobes: Fix possible use-after-free issue on kprobe registration (Zheng Yejian)   
  - selftests/ftrace: Limit length in subsystem-enable tests (Yuanhe Shu)   
  - x86/apic: Force native_apic_mem_read() to use the MOV instruction (Adam Dunlap)   
  - selftests: timers: Fix abs() warning in posix_timers test (John Stultz)   
  - vhost: Add smp_rmb() in vhost_vq_avail_empty() (Gavin Shan)   
  - tracing: hide unused ftrace_event_id_fops (Arnd Bergmann)   
  - net/mlx5: Properly link new fs rules into the tree (Cosmin Ratiu)   
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc)   
  - ipv4/route: avoid unused-but-set-variable warning (Arnd Bergmann)   
  - geneve: fix header validation in geneve[6]_xmit_skb (Eric Dumazet)   
  - nouveau: fix function cast warning (Arnd Bergmann)   
  - Bluetooth: Fix memory leak in hci_req_sync_complete() (Dmitry Antipov)   
  - batman-adv: Avoid infinite loop trying to resize local TT (Sven Eckelmann)   
  - LTS version: v4.14.345 (Yifei Liu)   
  - net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() (Liu Jian)   
  - Revert "net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()" (Vegard Nossum)   
  - netfilter: nftables: exthdr: fix 4-byte stack OOB write (Florian Westphal)   
  - ext4: fix to check return value of freeze_bdev() in ext4_shutdown() (Chao Yu)   
  - Revert "ext4: fix to check return value of freeze_bdev() in ext4_shutdown()" (Vegard Nossum)   
  - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Vasiliy Kovalev)   
  - Bluetooth: btintel: Fixe build regression (Luiz Augusto von Dentz)   
  - x86/mm/pat: fix VM_PAT handling in COW mappings (David Hildenbrand)   
  - virtio: reenable config if freezing device failed (David Hildenbrand)   
  - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (Thadeu Lima de Souza Cascardo)   
  - fbmon: prevent division by zero in fb_videomode_from_videomode() (Roman Smirnov)   
  - fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 (Aleksandr Burakov)   
  - usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined (Colin Ian King)   
  - tools: iio: replace seekdir() in iio_generic_buffer (Petre Rodan)   
  - block: prevent division by zero in blk_rq_stat_sum() (Roman Smirnov)   
  - SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int (Dai Ngo)   
  - media: sta2x11: fix irq handler cast (Arnd Bergmann)   
  - isofs: handle CDs with bad root inode but good Joliet root directory (Alex Henrie)   
  - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (Justin Tee)   
  - sysv: don't call sb_bread() with pointers_lock held (Tetsuo Handa)   
  - Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails (Kunwu Chan)   
  - Bluetooth: btintel: Fix null ptr deref in btintel_read_version (Edward Adam Davis)   
  - btrfs: send: handle path ref underflow in header iterate_inode_ref() (David Sterba)   
  - btrfs: export: handle invalid inode or root reference in btrfs_get_parent() (David Sterba)   
  - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() (David Sterba)   
  - tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num() (Samasth Norway Ananda)   
  - arm64: dts: rockchip: fix rk3399 hdmi ports node (Johan Jonker)   
  - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Harshit Mogalapalli)   
  - wifi: ath9k: fix LNA selection in ath_ant_try_scan() (Dmitry Antipov)   
  - ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone (I Gede Agastya Darma Laksana)   
  - ata: sata_mv: Fix PCI device ID table declaration compilation warning (Arnd Bergmann)   
  - ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit (Arnd Bergmann)   
  - ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw (Stephen Lee)   
  - init: open /initrd.image with O_LARGEFILE (John Sperbeck)   
  - staging: vc04_services: fix information leak in create_component() (Dan Carpenter)   
  - staging: vc04_services: changen strncpy() to strscpy_pad() (Arnd Bergmann)   
  - staging: mmal-vchiq: Fix client_component for 64 bit kernel (Dave Stevenson)   
  - staging: mmal-vchiq: Allocate and free components as required (Dave Stevenson)   
  - staging: mmal-vchiq: Avoid use of bool in structures (Dave Stevenson)   
  - ipv6: Fix infinite recursion in fib6_dump_done(). (Kuniyuki Iwashima)   
  - selftests: reuseaddr_conflict: add missing new line at the end of the output (Jakub Kicinski)   
  - net/sched: act_skbmod: prevent kernel-infoleak (Eric Dumazet)   
  - net: stmmac: fix rx queue priority assignment (Piotr Wejman)   
  - net: stmmac: Fix issues when number of Queues >= 4 (Jose Abreu)   
  - mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations (Vlastimil Babka)   
  - netfilter: nf_tables: disallow timeout for anonymous sets (Pablo Neira Ayuso)   
  - Bluetooth: Fix TOCTOU in HCI debugfs implementation (Bastien Nocera)   
  - Bluetooth: hci_event: set the conn encrypted before conn establishes (Hui Wang)   
  - tcp: properly terminate timers for kernel sockets (Eric Dumazet)   
  - mptcp: add sk_stop_timer_sync helper (Geliang Tang)   
  - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet (Ryosuke Yasuoka)   
  - USB: core: Fix deadlock in usb_deauthorize_interface() (Alan Stern)   
  - scsi: lpfc: Correct size for wqe for memset() (Muhammad Usama Anjum)   
  - scsi: qla2xxx: Fix command flush on cable pull (Quinn Tran)   
  - usb: udc: remove warning when queue disabled ep (yuan linyu)   
  - usb: dwc2: host: Fix ISOC flow in DDMA mode (Minas Harutyunyan)   
  - usb: dwc2: host: Fix hibernation flow (Minas Harutyunyan)   
  - powerpc: xor_vmx: Add '-mhard-float' to CFLAGS (Nathan Chancellor)   
  - efivarfs: Request at most 512 bytes for variable names (Tim Schumacher)   
  - perf/core: Fix reentry problem in perf_output_read_group() (Yang Jihong)   
  - loop: Call loop_config_discard() only after new config is applied (Martijn Coenen)   
  - Revert "loop: Check for overflow while configuring loop" (Genjian Zhang)   
  - btrfs: allocate btrfs_ioctl_defrag_range_args on stack (Goldwyn Rodrigues)   
  - btrfs: add define for oldest generation (Anand Jain)   
  - printk: Update @console_may_schedule in console_trylock_spinning() (John Ogness)   
  - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs (Duoming Zhou)   
  - ALSA: aica: Fix a long-time build breakage (Takashi Iwai)   
  - ALSA: sh: aica: Convert timers to use timer_setup() (Kees Cook)   
  - usb: cdc-wdm: close race between read and workqueue (Oliver Neukum)   
  - USB: cdc-wdm: Fix use after free in service_outstanding_interrupt(). (Tetsuo Handa)   
  - exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack() (Max Filippov)   
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Felix Fietkau)   
  - mm/migrate: set swap entry values of THP tail pages properly. (Zi Yan)   
  - vt: fix memory overlapping when deleting chars in the buffer (Yangxi Xiang)   
  - tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled (Sherry Sun)   
  - usb: port: Don't try to peer unused USB ports based on location (Mathias Nyman)   
  - usb: gadget: ncm: Fix handling of zero block length packets (Krishna Kurapati)   
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Alan Stern)   
  - ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform (Kailang Yang)   
  - xfrm: Avoid clang fortify warning in copy_to_user_tmpl() (Nathan Chancellor)   
  - netfilter: nf_tables: reject constant set with timeout (Pablo Neira Ayuso)   
  - netfilter: nf_tables: disallow anonymous set with timeout flag (Pablo Neira Ayuso)   
  - comedi: comedi_test: Prevent timers rescheduling during deletion (Ian Abbott)   
  - nilfs2: prevent kernel bug at submit_bh_wbc() (Ryusuke Konishi)   
  - nilfs2: use a more common logging style (Joe Perches)   
  - nilfs2: fix failure to detect DAT corruption in btree and direct mappings (Ryusuke Konishi)   
  - memtest: use {READ,WRITE}_ONCE in memory scanning (Qiang Zhang)   
  - drm/vc4: hdmi: do not return negative values from .get_modes() (Jani Nikula)   
  - drm/imx/ipuv3: do not return negative values from .get_modes() (Jani Nikula)   
  - s390/zcrypt: fix reference counting on zcrypt card objects (Harald Freudenberger)   
  - soc: fsl: qbman: Use raw spinlock for cgr_lock (Sean Anderson)   
  - soc: fsl: qbman: Add CGR update function (Sean Anderson)   
  - soc: fsl: qbman: Add helper for sanity checking cgr ops (Sean Anderson)   
  - soc: fsl: qbman: Always disable interrupts when taking cgr_lock (Sean Anderson)   
  - vfio/platform: Disable virqfds on cleanup (Alex Williamson)   
  - kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 (Nathan Chancellor)   
  - speakup: Fix 8bit characters from direct synth (Samuel Thibault)   
  - hwmon: (amc6821) add of_match table (Josua Mayer)   
  - dm-raid: fix lockdep waring in "pers->hot_add_disk" (Yu Kuai)   
  - PCI/PM: Drain runtime-idle callbacks before driver removal (Rafael J. Wysocki)   
  - PCI: Drop pci_device_remove() test of pci_dev->driver (Uwe Kleine-König)   
  - fuse: don't unhash root (Miklos Szeredi)   
  - mmc: tmio: avoid concurrent runs of mmc_request_done() (Wolfram Sang)   
  - PM: sleep: wakeirq: fix wake irq warning in system suspend (Qingliang Li)   
  - USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M (Toru Katagiri)   
  - USB: serial: option: add MeiG Smart SLM320 product (Aurélien Jacobs)   
  - USB: serial: cp210x: add ID for MGP Instruments PDS100 (Christian Häggström)   
  - USB: serial: add device ID for VeriFone adapter (Cameron Williams)   
  - USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB (Daniel Vogelbacher)   
  - powerpc/fsl: Fix mfpmr build errors with newer binutils (Michael Ellerman)   
  - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays (Gabor Juhos)   
  - clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays (Gabor Juhos)   
  - PM: suspend: Set mem_sleep_current during kernel command line setup (Maulik Shah)   
  - parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds (Guenter Roeck)   
  - parisc: Fix csum_ipv6_magic on 64-bit systems (Guenter Roeck)   
  - parisc: Fix csum_ipv6_magic on 32-bit systems (Guenter Roeck)   
  - parisc: Fix ip_fast_csum (Guenter Roeck)   
  - parisc: Do not hardcode registers in checksum functions (Helge Deller)   
  - ubi: correct the calculation of fastmap size (Zhang Yi)   
  - ubi: Check for too small LEB size in VTBL code (Richard Weinberger)   
  - ubifs: Set page uptodate in the correct place (Matthew Wilcox (Oracle))   
  - fat: fix uninitialized field in nostale filehandles (Jan Kara)   
  - crypto: qat - resolve race condition during AER recovery (Damian Muszynski)   
  - crypto: qat - fix double free during reset (Svyatoslav Pankratov)   
  - sparc64: NMI watchdog: fix return value of __setup handler (Randy Dunlap)   
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson)   
  - media: xc4000: Fix atomicity violation in xc4000_get_frequency (Gui-Dong Han)   
  - arm: dts: marvell: Fix maxium->maxim typo in brownstone dts (Duje Mihanović)   
  - ARM: dts: mmp2-brownstone: Don't redeclare phandle references (Lubomir Rintel)   
  - smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity() (Roberto Sassu)   
  - smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr() (Roberto Sassu)   
  - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach (Zheng Wang)   
  - x86/bugs: Use sysfs_emit() (Borislav Petkov)   
  - LTS version: v4.14.344 (Yifei Liu)   
  - binder: signal epoll threads of self-work (Carlos Llamas)   
  - ANDROID: binder: Add thread->process_todo flag. (Martijn Coenen)   
  - scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() (Wei Yongjun)   
  - scsi: bnx2fc: Remove set but not used variable 'oxid' (YueHaibing)   
  - net: check dev->gso_max_size in gso_features_check() (Eric Dumazet)   
  - driver: staging: count ashmem_range into SLAB_RECLAIMBLE (Zhaoyang Huang)   
  - net: warn if gso_type isn't set for a GSO SKB (Heiner Kallweit)   
  - staging: android: ashmem: Remove use of unlikely() (Alistair Strachan)   
  - ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5 (Bin Li)   
  - ALSA: hda/realtek: Enable headset onLenovo M70/M90 (Bin Li)   
  - ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB (Edward Pacman)   
  - ALSA: hda/realtek - ALC897 headset MIC no sound (Kailang Yang)   
  - ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform (Kailang Yang)   
  - ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW (Hui Wang)   
  - ALSA: hda/realtek - The front Mic on a HP machine doesn't work (Jeremy Szu)   
  - ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662 (Jian-Hong Pan)   
  - ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662 (Jian-Hong Pan)   
  - ALSA: hda/realtek - Add Headset Mic supported for HP cPC (Kailang Yang)   
  - ALSA: hda/realtek - More constifications (Takashi Iwai)   
  - Add Acer Aspire Ethos 8951G model quirk (Sergey Bostandzhyan)   
  - devcoredump: Send uevent once devcd is ready (Mukesh Ojha)   
  - devcoredump : Serialize devcd_del work (Mukesh Ojha)   
  - netfilter: xt_owner: Fix for unsafe access of sk->sk_socket (Phil Sutter)   
  - netfilter: xt_owner: Add supplementary groups option (Lukasz Pawelczyk)   
  - mtd: cfi_cmdset_0001: Byte swap OTP info (Linus Walleij)   
  - mtd: cfi_cmdset_0001: Support the absence of protection registers (Jean-Philippe Brucker)   
  - s390/cmma: fix detection of DAT pages (Heiko Carstens)   
  - s390/mm: fix phys vs virt confusion in mark_kernel_pXd() functions family (Alexander Gordeev)   
  - ALSA: hda/realtek: Headset Mic VREF to 100% (Kailang Yang)   
  - hfsplus: unmap the page in the "fail_page" label (Fabio M. De Francesco)   
  - ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS (Marios Levogiannis)   
  - ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (Jian-Hong Pan)   
  - ALSA: hda/realtek - Add quirk for Tuxedo XC 1509 (Richard Sailer)   
  - ALSA: hda/realtek - Headset microphone and internal speaker support for System76 oryp5 (Jeremy Soller)   
  - ALSA: hda/realtek - Clevo P950ER ALC1220 Fixup (Jeremy Soller)   
  - ALSA: hda/realtek - Add support for ALC1220 (Peisen)   
  - hv_netvsc: Fix race of register_netdevice_notifier and VF register (Haiyang Zhang)   
  - pwm: sti: Reduce number of allocations and drop usage of chip_data (Uwe Kleine-König)   
  - pwm: sti: Avoid conditional gotos (Thierry Reding)   
  - tools: iio: iio_generic_buffer ensure alignment (Matti Vaittinen)   
  - tools: iio: iio_generic_buffer: Fix some integer type and calculation (Chenyuan Mi)   
  - tools: iio: privatize globals and functions in iio_generic_buffer.c file (Alexandru Ardelean)   
  - leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu' (Christophe JAILLET)   
  - ledtrig-cpu: Limit to 8 CPUs (Pavel Machek)   
  - leds: pwm: Don't disable the PWM when the LED should be off (Uwe Kleine-König)   
  - leds: pwm: convert to atomic PWM API (Uwe Kleine-König)   
  - leds: pwm: simplify if condition (Uwe Kleine-König)   
  - regmap: debugfs: Fix a erroneous check after snprintf() (Christophe JAILLET)   
  - regmap: Allow missing device in regmap_name_read_file() (David Lechner)   
  - tcp_metrics: add missing barriers on delete (Eric Dumazet)   
  - tcp: batch tcp_net_metrics_exit (Eric Dumazet)   
  - tcp: fix excessive TLP and RACK timeouts from HZ rounding (Neal Cardwell)   
  - tcp: Namespace-ify sysctl_tcp_early_retrans (Eric Dumazet)   
  - net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (Eric Dumazet)   
  - ata: libata-core: Do not register PM operations for SAS ports (Damien Le Moal)   
  - libata: make ata_port_type const (Bhumika Goyal)   
  - libata: Add new med_power_with_dipm link_power_management_policy setting (Hans de Goede)   
  - ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (Kailang Yang)   
  - ALSA: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist (Jaroslav Kysela)   
  - ALSA: hda: Add Intel NUC7i3BNB to the power_save blacklist (Hans de Goede)   
  - ext4: mark group as trimmed only if it was fully scanned (Dmitry Monakhov)   
  - ext4: add new helper interface ext4_try_to_trim_range() (Wang Jianchao)   
  - ext4: remove the 'group' parameter of ext4_trim_extent (Wang Jianchao)   
  - scsi: qla2xxx: Remove unsupported ql2xenabledif option (Manish Rangankar)   
  - usb: typec: tcpci: clear the fault status bit (Marco Felsch)   
  - usb: typec: add fwnode to tcpc (Li Jun)   
  - staging: typec: fix endianness mismatch identified by sparse (Gabriel L. Somlo)   
  - staging: typec: tcpm: Document data structures (Guenter Roeck)   
  - serial: sc16is7xx: fix broken port 0 uart init (Hugo Villeneuve)   
  - sc16is7xx: Set iobase to device index (Daniel Mack)   
  - dlm: fix plock lookup when using multiple lockspaces (Alexander Aring)   
  - drm/tegra: dpaux: Fix incorrect return value of platform_get_irq (Yangtao Li)   
  - drm/tegra: Remove superfluous error messages around platform_get_irq() (Tan Zhongjun)   
  - ARM: dts: BCM53573: Drop nonexistent #usb-cells (Rafał Miłecki)   
  - ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name (Serge Semin)   
  - wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx (Fedor Pchelkin)   
  - ath9k: use irqsave() in USB's complete callback (Sebastian Andrzej Siewior)   
  - wifi: mwifiex: fix error recovery in PCIE buffer descriptor management (Dmitry Antipov)   
  - mwifiex: switch from 'pci_' to 'dma_' API (Christophe JAILLET)   
  - mwifiex: drop 'set_consistent_dma_mask' log message (Brian Norris)   
  - bonding: fix macvlan over alb bond support (Hangbin Liu)   
  - net: remove bond_slave_has_mac_rcu() (Jakub Kicinski)   
  - fbdev: fix potential OOB read in fast_imageblit() (Zhang Shurong)   
  - fbdev: Fix sys_imageblit() for arbitrary image widths (Thomas Zimmermann)   
  - fbdev: Improve performance of sys_imageblit() (Thomas Zimmermann)   
  - tty: serial: fsl_lpuart: add earlycon for imx8ulp platform (Sherry Sun)   
  - Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP" (Alexander Stein)   
  - MIPS: cpu-features: Use boot_cpu_type for CPU type based features (Jiaxun Yang)   
  - MIPS: cpu-features: Enable octeon_cache by cpu_type (Jiaxun Yang)   
  - fs: dlm: fix mismatch of plock results from userspace (Alexander Aring)   
  - fs: dlm: use dlm_plock_info for do_unlock_close (Alexander Aring)   
  - fs: dlm: change plock interrupted message to debug again (Alexander Aring)   
  - fs: dlm: add pid to debug log (Alexander Aring)   
  - dlm: replace usage of found with dedicated list iterator variable (Jakob Koschel)   
  - dlm: improve plock logging if interrupted (Alexander Aring)   
  - nfsd: Remove incorrect check in nfsd4_validate_stateid (Trond Myklebust)   
  - nfsd4: kill warnings on testing stateids with mismatched clientids (J. Bruce Fields)   
  - mmc: meson-gx: remove redundant mmc_request_done() call from irq context (Martin Hundebøll)   
  - mmc: meson-gx: remove useless lock (Jerome Brunet)   
  - PM: sleep: wakeirq: fix wake irq arming (Johan Hovold)   
  - PM / wakeirq: support enabling wake-up irq after runtime_suspend called (Chunfeng Yun)   
  - scsi: zfcp: Defer fc_rport blocking until after ADISC response (Steffen Maier)   
  - scsi: zfcp: workqueue: set description for port work items with their WWPN as context (Steffen Maier)   
  - btrfs: check for commit error at btrfs_attach_transaction_barrier() (Filipe Manana)   
  - btrfs: simplify IS_ERR/PTR_ERR checks (Al Viro)   
  - fs: dlm: interrupt posix locks only when process is killed (Alexander Aring)   
  - dlm: rearrange async condition return (Alexander Aring)   
  - dlm: cleanup plock_op vs plock_xop (Alexander Aring)   
  - ext4: Fix reusing stale buffer heads from last failed mounting (Zhihao Cheng)   
  - ext4: rename journal_dev to s_journal_dev inside ext4_sb_info (Chunguang Xu)   
  - tcp: annotate data-races around tp->linger2 (Eric Dumazet)   
  - net: Replace the limit of TCP_LINGER2 with TCP_FIN_TIMEOUT_MAX (Cambda Zhu)   
  - ceph: don't let check_caps skip sending responses for revoke msgs (Xiubo Li)   
  - ceph: define argument structure for handle_cap_grant (Yan, Zheng)   
  - net: bcmgenet: Ensure MDIO unregistration has clocks enabled (Florian Fainelli)   
  - net: bcmgenet: Avoid calling platform_device_put() twice in bcmgenet_mii_exit() (Wei Yongjun)   
  - net: tcp_input: Neaten DBGUNDO (Joe Perches)   
  - i2c: xiic: Don't try to handle more interrupt events after error (Robert Hancock)   
  - i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process() (Marek Vasut)   
  - i2c: xiic: Fix broken locking on tx_msg (Marek Vasut)   
  - i2c: xiic: Change code alignment to 1 space only (Jaakko Laine)   
  - i2c: xiic: Add timeout to the rx fifo wait loop (Shubhrajyoti Datta)   
  - i2c: xiic: Fix kerneldoc warnings (Shubhrajyoti Datta)   
  - hwrng: virtio - Fix race on data_avail and actual data (Herbert Xu)   
  - hwrng: virtio - always add a pending request (Laurent Vivier)   
  - hwrng: virtio - don't waste entropy (Laurent Vivier)   
  - hwrng: virtio - don't wait on cleanup (Laurent Vivier)   
  - hwrng: virtio - add an internal buffer (Laurent Vivier)   
  - nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect() (Krzysztof Kozlowski)   
  - nfc: constify several pointers to u8, char and sk_buff (Krzysztof Kozlowski)   
  - irqchip/jcore-aic: Fix missing allocation of IRQ descriptors (John Paul Adrian Glaubitz)   
  - irqchip/jcore-aic: Kill use of irq_create_strict_mappings() (Marc Zyngier)   
  - Documentation: fix little inconsistencies (Pavel Machek)   
  - usb: musb: fix MUSB_QUIRK_B_DISCONNECT_99 handling (Thomas Petazzoni)   
  - net/rose: fix races in rose_kill_by_device() (Eric Dumazet)   
  - reset: Fix crash when freeing non-existent optional resets (Geert Uytterhoeven)   
  - ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE (Namjae Jeon)   
  - PCI: keystone: Don't discard .probe() callback (Uwe Kleine-König)   
  - PCI: keystone: Don't discard .remove() callback (Uwe Kleine-König)   
  - can: dev: can_restart(): fix race condition between controller restart and netif_carrier_on() (Marc Kleine-Budde)   
  - can: dev: can_restart(): don't crash kernel if carrier is OK (Marc Kleine-Budde)   
  - r8169: fix the KCSAN reported data-race in rtl_tx while reading TxDescArray[entry].opts1 (Mirsad Goran Todorovac)   
  - xen-netback: use default TX queue size for vifs (Roger Pau Monne)   
  - MIPS: Alchemy: only build mmc support helpers if au1xmmc is enabled (Christoph Hellwig)   
  - arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller (Konrad Dybcio)   
  - regmap: Account for register length in SMBus I/O limits (Mark Brown)   
  - x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms (Zhang Rui)   
  - ASoC: cs42l51: fix driver to properly autoload with automatic module loading (Thomas Petazzoni)   
  - PCI: qcom: Disable write access to read only registers for IP v2.3.3 (Manivannan Sadhasivam)   
  - pinctrl: amd: Only use special debounce behavior for GPIO 0 (Mario Limonciello)   
  - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Daniel Vacek)   
  - usb: fotg210-hcd: delete an incorrect bounds test (Dan Carpenter)   
  - smb: client: fix OOB in smbCalcSize() (Paulo Alcantara)   
  - btrfs: do not allow non subvolume root targets for snapshot (Josef Bacik)   
  - pinctrl: at91-pio4: use dedicated lock class for IRQ (Alexis Lothoré)   
  - net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() (Liu Jian)   
  - arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names (AngeloGioacchino Del Regno)   
  - IB/isert: Fix unaligned immediate-data handling (Sagi Grimberg)   
  - fbdev: stifb: Make the STI next font pointer a 32-bit signed offset (Helge Deller)   
  - smb3: fix touch -h of symlink (Steve French)   
  - MIPS: KVM: Fix a build warning about variable set but not used (Huacai Chen)   
  - cifs: spnego: add ';' in HOST_KEY_LEN (Anastasia Belova)   
  - macvlan: Don't propagate promisc change to lower dev in passthru (Vlad Buslov)   
  - ppp: limit MRU to 64K (Willem de Bruijn)   
  - ptp: annotate data-race around q->head and q->tail (Eric Dumazet)   
  - xen/events: fix delayed eoi list handling (Juergen Gross)   
  - tipc: Fix kernel-infoleak due to uninitialized TLV value (Shigeru Yoshida)   
  - tty: Fix uninit-value access in ppp_sync_receive() (Shigeru Yoshida)   
  - iio: exynos-adc: request second interupt only when touchscreen mode is used (Marek Szyprowski)   
  - selftests/ftrace: Add new test case which checks non unique symbol (Francis Laniel)   
  - media: v4l2-fwnode: fix v4l2_fwnode_parse_link handling (Marco Felsch)   
  - block: fix signed int overflow in Amiga partition support (Michael Schmitz)   
  - iio: addac: stx104: Fix race condition for stx104_write_raw() (William Breathitt Gray)   
  - ext4: fix to check return value of freeze_bdev() in ext4_shutdown() (Chao Yu)   
  - btrfs: fix extent buffer leak after tree mod log failure at split_node() (Filipe Manana)   
  - pinctrl: amd: Detect internal GPIO0 debounce handling (Mario Limonciello)   
  - ALSA: jack: Fix mutex call in snd_jack_report() (Takashi Iwai)   
  - IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors (Patrick Kelsey)   
  - ARM: 9303/1: kprobes: avoid missing-declaration warnings (Arnd Bergmann)


