linux (6.10.9-1) unstable; urgency=medium

linux (6.10.9-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.8
    - drm/amdgpu/mes: fix mes ring buffer overflow
    - erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially
      fails
    - ALSA: seq: Skip event type filtering for UMP events
    - ALSA: hda/realtek: Enable mute/micmute LEDs on HP Laptop 14-ey0xxx
    - ALSA: hda/realtek: support HP Pavilion Aero 13-bg0xxx Mute LED
    - [ppc64el] tpm: ibmvtpm: Call tpm2_sessions_init() to initialize session
      support
    - btrfs: fix a use-after-free when hitting errors inside
      btrfs_submit_chunk()
    - btrfs: run delayed iputs when flushing delalloc
    - smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()
    - [arm64,armhf] pinctrl: rockchip: correct RK3328 iomux width flag for
      GPIO2-B pins
    - pinctrl: single: fix potential NULL dereference in pcs_get_function()
    - netfs, ceph: Partially revert "netfs: Replace PG_fscache by setting
      folio->private and marking dirty"
    - wifi: wfx: repair open network AP mode
    - wifi: mwifiex: duplicate static structs used in driver instances
    - [amd64,arm64] net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc
      response
    - mptcp: close subflow when receiving TCP+FIN
    - mptcp: sched: check both backup in retrans
    - mptcp: pr_debug: add missing \n at the end
    - mptcp: pm: reuse ID 0 after delete and re-add
    - mptcp: pm: skip connecting to already established sf
    - mptcp: pm: reset MPC endp ID when re-added
    - mptcp: pm: send ACK on an active subflow
    - mptcp: pm: fix RM_ADDR ID for the initial subflow
    - mptcp: pm: do not remove already closed subflows
    - mptcp: pm: fix ID 0 endp usage after multiple re-creations
    - mptcp: avoid duplicated SUB_CLOSED events
    - mptcp: pm: ADD_ADDR 0 is not a new address
    - binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined
    - [arm64] drm/v3d: Disable preemption while updating GPU stats
    - [x86] drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict
    - [x86] drm/i915/dp_mst: Fix MST state after a sink reset
    - drm/amdgpu: align pp_power_profile_mode with kernel docs
    - drm/amdgpu/swsmu: always force a state reprogram on init
    - drm/vmwgfx: Prevent unmapping active read buffers
    - drm/vmwgfx: Fix prime with external buffers
    - drm/vmwgfx: Disable coherent dumb buffers without 3d (Closes: #1079167)
    - video/aperture: optionally match the device in sysfb_disable()
    - drm/amdgpu: Do not wait for MP0_C2PMSG_33 IFWI init in SRIOV
    - drm/amdgpu: fix eGPU hotplug regression
    - pinctrl: qcom: x1e80100: Update PDC hwirq map
    - [x86] ASoC: SOF: amd: move iram-dram fence register programming sequence
    - [x86] ASoC: SOF: amd: Fix for incorrect acp error register offsets
    - [x86] ASoC: amd: acp: fix module autoloading
    - [x86] ASoC: SOF: amd: Fix for acp init sequence
    - ALSA: hda: cs35l56: Don't use the device index as a calibration index
    - ASoC: cs-amp-lib-test: Force test calibration blob entries to be valid
    - ASoC: cs-amp-lib: Ignore empty UEFI calibration entries
    - nfsd: ensure that nfsd4_fattr_args.context is zeroed out
    - backing-file: convert to using fops->splice_write
    - pinctrl: mediatek: common-v2: Fix broken bias-disable for
      PULL_PU_PD_RSEL_TYPE
    - pinctrl: qcom: x1e80100: Fix special pin offsets
    - pinctrl: starfive: jh7110: Correct the level trigger configuration of iev
      register
    - nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open
    - mm: Fix missing folio invalidation calls during truncation
    - afs: Fix post-setattr file edit to do truncation correctly
    - netfs: Fix netfs_release_folio() to say no if folio dirty
    - netfs: Fix trimming of streaming-write folios in netfs_inval_folio()
    - netfs: Fix missing iterator reset on retry of short read
    - netfs: Fix interaction of streaming writes with zero-point tracker
    - smb/client: remove unused rq_iter_size from struct smb_rqst
    - cifs: Fix FALLOC_FL_PUNCH_HOLE support
    - nfsd: hold reference to delegation when updating it for cb_getattr
    - nfsd: fix potential UAF in nfsd4_cb_getattr_release
    - fs/nfsd: fix update of inode attrs in CB_GETATTR
    - selinux,smack: don't bypass permissions check in inode_setsecctx hook
    - [x86] cpufreq/amd-pstate: Use topology_logical_package_id() instead of
      logical_die_id()
    - phy: fsl-imx8mq-usb: fix tuning parameter name
    - soundwire: stream: fix programming slave ports for non-continous port maps
    - [arm64] phy: qcom: qmp-pcie: Fix X1E80100 PCIe Gen4 PHY initialisation
    - [arm64] phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume
    - [x86] dmaengine: dw: Add peripheral bus width verification
    - [x86] dmaengine: dw: Add memory bus width verification
    - [armhf] dmaengine: ti: omap-dma: Initialize sglen after allocation
    - pktgen: use cpus_read_lock() in pg_net_init()
    - cpufreq/amd-pstate-ut: Don't check for highest perf matching on prefcore
    - Bluetooth: btnxpuart: Handle FW Download Abort scenario
    - Bluetooth: btnxpuart: Fix random crash seen while removing driver
    - Bluetooth: hci_core: Fix not handling hibernation actions
    - iommu: Do not return 0 from map_pages if it doesn't do anything
    - netfilter: nf_tables: restore IP sanity checks for netdev/egress
    - wifi: iwlwifi: mvm: take the mutex before running link selection
    - wifi: iwlwifi: fw: fix wgds rev 3 exact size
    - wifi: iwlwifi: mvm: allow 6 GHz channels in MLO scan
    - ethtool: check device is present when getting link settings
    - hwmon: (pt5161l) Fix invalid temperature reading
    - net_sched: sch_fq: fix incorrect behavior for small weights
    - netfilter: nf_tables_ipv6: consider network offset in netdev/egress
      validation
    - bonding: implement xdo_dev_state_free and call it after deletion
    - bonding: extract the use of real_device into local variable
    - bonding: change ipsec_lock from spin lock to mutex
    - gtp: fix a potential NULL pointer dereference
    - tcp: fix forever orphan socket caused by tcp_abort
    - sctp: fix association labeling in the duplicate COOKIE-ECHO case
    - drm/amd/display: avoid using null object of framebuffer
    - net: busy-poll: use ktime_get_ns() instead of local_clock()
    - nfc: pn533: Add poll mod list filling check
    - io_uring/kbuf: return correct iovec count from classic buffer peek
    - [arm64] soc: qcom: cmd-db: Map shared memory as WC, not WB
    - [arm64] soc: qcom: pmic_glink: Actually communicate when remote goes down
    - [arm64] soc: qcom: pmic_glink: Fix race during initialization
    - cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
    - usb: typec: fsa4480: Relax CHIP_ID check
    - [arm64] firmware: qcom: scm: Mark get_wq_ctx() as atomic call
    - scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress
    - dt-bindings: usb: microchip,usb2514: Fix reference USB device schema
    - USB: serial: option: add MeiG Smart SRM825L
    - usb: gadget: uvc: queue pump work in uvcg_video_enable()
    - [arm64] dts: qcom: x1e80100-crd: fix PCIe4 PHY supply
    - [arm64] dts: qcom: x1e80100-qcp: fix PCIe4 PHY supply
    - [arm64] dts: qcom: x1e80100: add missing PCIe minimum OPP
    - [arm64] dts: qcom: x1e80100: fix PCIe domain numbers
    - usb: dwc3: ep0: Don't reset resource alloc flag (including ep0)
    - [arm64] usb: dwc3: xilinx: add missing depopulate in probe error path
    - [armhf] usb: dwc3: omap: add missing depopulate in probe error path
    - usb: dwc3: core: Prevent USB core invalid event buffer address access
    - usb: dwc3: st: fix probed platform device ref count on probe error path
    - usb: dwc3: st: add missing depopulate in probe error path
    - usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
      remove_power_attributes()
    - usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
    - usb: cdnsp: fix for Link TRB with TC
    - usb: typec: ucsi: Move unregister out of atomic section
    - [arm64] dts: qcom: ipq5332: Fix interrupt trigger type for usb
    - [armhf] dts: omap3-n900: correct the accelerometer orientation
    - [arm64] dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962
    - [arm64] dts: imx93: update default value for snps,clk-csr
    - [arm64] dts: freescale: imx93-tqma9352: fix CMA alloc-ranges
    - [arm64] dts: freescale: imx93-tqma9352-mba93xxla: fix typo
    - firmware: microchip: fix incorrect error report of programming:timeout on
      success
    - scsi: aacraid: Fix double-free on probe failure
    - apparmor: fix policy_unpack_test on big endian systems
    - nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.9
    - drm/fb-helper: Don't schedule_work() to flush frame buffer during panic()
    - drm: panel-orientation-quirks: Add quirk for OrangePi Neo
    - scsi: ufs: core: Check LSDBS cap when !mcq
    - scsi: ufs: core: Bypass quick recovery if force reset is needed
    - btrfs: tree-checker: validate dref root and objectid
    - ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
    - ALSA: hda/conexant: Mute speakers at suspend / shutdown
    - [x86] CPU/AMD: Add models 0x60-0x6f to the Zen5 range
    - ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
    - ALSA: ump: Explicitly reset RPN with Null RPN
    - ALSA: seq: ump: Use the common RPN/bank conversion context
    - ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
    - ALSA: seq: ump: Explicitly reset RPN with Null RPN
    - net/mlx5: DR, Fix 'stack guard page was hit' error in dr_rule
    - smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp
    - [x86] ASoC: amd: yc: Support mic on HP 14-em0002la
    - spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
    - [x86] platform/x86/amd: pmf: Add quirk for ROG Ally X
    - [x86] platform/x86/amd/pmf: Add new ACPI ID AMDI0107
    - btrfs: factor out stripe length calculation into a helper
    - btrfs: scrub: update last_physical after scrubbing one stripe
    - btrfs: fix qgroup reserve leaks in cow_file_range
    - i2c: Fix conditional for substituting empty ACPI functions
    - virtio-net: check feature before configuring the vq coalescing command
    - dma-debug: avoid deadlock between dma debug vs printk and netconsole
    - net: usb: qmi_wwan: add MeiG Smart SRM825L
    - [x86] ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6
    - ASoC: codecs: ES8326: button detect issue
    - [arm64] dts: qcom: x1e80100: Describe the PCIe 6a resources
    - [arm64] dts: qcom: x1e80100-crd: fix up PCIe6a pinctrl node
    - [arm64] dts: qcom: x1e80100-crd: fix missing PCIe4 gpios
    - [arm64] dts: qcom: x1e80100-qcp: fix up PCIe6a pinctrl node
    - [arm64] dts: qcom: x1e80100-qcp: fix missing PCIe4 gpios
    - drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
    - Revert "drm/amd/display: Fix incorrect pointer assignment"
    - drm/amd/display: Handle the case which quad_part is equal 0
    - drm/amd/display: Assign linear_pitch_alignment even for VM
    - drm/amdgpu: Handle sg size limit for contiguous allocation
    - drm/amdgpu: fix overflowed array index read warning
    - drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
    - drm/amd/pm: fix uninitialized variable warning
    - drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
    - drm/amd/pm: fix warning using uninitialized value of max_vid_step
    - drm/amd/pm: Fix negative array index read
    - drm/amd/pm: fix uninitialized variable warning for smu_v13
    - drm/amd/pm: fix the Out-of-bounds read warning
    - drm/amdgpu: fix uninitialized scalar variable warning
    - drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
    - drm/amdgpu: avoid reading vf2pf info size from FB
    - drm/amd/display: Ensure array index tg_inst won't be -1
    - drm/amd/display: Check gpio_id before used as array index
    - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
    - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than
      max_links
    - drm/amd/display: Fix incorrect size calculation for loop
    - drm/amd/display: Check index for aux_rd_interval before using
    - drm/amd/display: Add missing NULL pointer check within
      dpcd_extend_address_range
    - drm/amd/display: Add array index check for hdcp ddc access
    - drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
    - drm/amd/display: Check msg_id before processing transcation
    - drm/amd/display: Release state memory if amdgpu_dm_create_color_properties
      fail
    - drm/amd/display: Check link_index before accessing dc->links[]
    - drm/amd/display: Add otg_master NULL check within
      resource_log_pipe_topology_update
    - drm/amd/display: Fix Coverity INTERGER_OVERFLOW within
      construct_integrated_info
    - drm/amd/display: Fix Coverity INTEGER_OVERFLOW within
      dal_gpio_service_create
    - drm/amd/display: Release clck_src memory if clk_src_construct fails
    - drm/amd/display: Spinlock before reading event
    - drm/amd/display: Fix Coverity INTEGER_OVERFLOW within
      decide_fallback_link_setting_max_bw_policy
    - drm/amd/display: Ensure index calculation will not overflow
    - drm/amd/display: Skip inactive planes within
      ModeSupportAndSystemConfiguration
    - drm/amd/display: Fix writeback job lock evasion within dm_crtc_high_irq
    - drm/amd/display: Fix index may exceed array range within
      fpu_update_bw_bounding_box
    - drm/amd/amdgpu: Check tbo resource pointer
    - drm/drm-bridge: Drop conditionals around of_node pointers
    - drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt
    - drm/amdgpu/pm: Fix uninitialized variable warning for smu10
    - drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
    - drm/amdgpu: Fix the uninitialized variable warning
    - drm/amdgpu: Fix out-of-bounds write warning
    - drm/amdgpu: fix uninitialized variable warning for amdgpu_xgmi
    - drm/amdgpu: fix uninitialized variable warning for jpeg_v4
    - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
    - drm/amdgpu: Fix uninitialized variable warning in amdgpu_info_ioctl
    - drm/amdgpu: fix ucode out-of-bounds read warning
    - drm/amdgpu: fix mc_data out-of-bounds read warning
    - drm/amdkfd: Reconcile the definition and use of oem_id in struct
      kfd_topology_device
    - apparmor: fix possible NULL pointer dereference
    - wifi: ath12k: initialize 'ret' in ath12k_qmi_load_file_target_mem()
    - wifi: ath11k: initialize 'ret' in ath11k_qmi_load_file_target_mem()
    - wifi: ath12k: initialize 'ret' in
      ath12k_dp_rxdma_ring_sel_config_wcn7850()
    - drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy
      SOCs
    - drm/amdgpu/pm: Check input value for power profile setting on smu11, smu13
      and smu14
    - drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend
    - drm/amdgpu: Fix the warning division or modulo by zero
    - drm/amdgpu: fix dereference after null check
    - drm/amdgpu: fix the waring dereferencing hive
    - drm/amd/pm: check specific index for aldebaran
    - drm/amd/pm: check specific index for smu13
    - drm/amdgpu: the warning dereferencing obj for nbio_v7_4
    - drm/amdgpu: fix the warning bad bit shift operation for aca_error_type
      type
    - drm/amd/pm: check negtive return for table entries
    - wifi: rtw89: ser: avoid multiple deinit on same CAM
    - drm/kfd: Correct pinned buffer handling at kfd restore and validate
      process
    - drm/amdgpu: fix compiler 'side-effect' check issue for RAS_EVENT_LOG()
    - drm/amd/display: Fix pipe addition logic in calc_blocks_to_ungate DCN35
    - drm/amdgpu: Queue KFD reset workitem in VF FED
    - drm/amdgpu: update type of buf size to u32 for eeprom functions
    - wifi: iwlwifi: remove fw_running op
    - wifi: cfg80211: restrict operation during radar detection
    - cpufreq: scmi: Avoid overflow of target_freq in fast switch
    - PCI: al: Check IORESOURCE_BUS existence during probe
    - remoteproc: mediatek: Zero out only remaining bytes of IPI buffer
    - wifi: iwlwifi: mvm: use only beacon BSS load for active links
    - wifi: mac80211: check ieee80211_bss_info_change_notify() against MLD
    - hwspinlock: Introduce hwspin_lock_bust()
    - [arm64] soc: qcom: smem: Add qcom_smem_bust_hwspin_lock_by_host()
    - remoteproc: qcom_q6v5_pas: Add hwspinlock bust on stop
    - RDMA/efa: Properly handle unexpected AQ completions
    - ionic: fix potential irq name truncation
    - pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode.
    - rcu/nocb: Remove buggy bypass lock contention mitigation
    - media: v4l2-cci: Always assign *val
    - usbip: Don't submit special requests twice
    - usb: typec: ucsi: Fix null pointer dereference in trace
    - fsnotify: clear PARENT_WATCHED flags lazily
    - net: remove NULL-pointer net parameter in ip_metrics_convert
    - tcp: annotate data-races around tw->tw_ts_recent and
      tw->tw_ts_recent_stamp
    - drm/amdgu: fix Unintentional integer overflow for mall size
    - regmap: spi: Fix potential off-by-one when calculating reserved size
    - smack: tcp: ipv4, fix incorrect labeling
    - [x86] platform/chrome: cros_ec_lpc: MEC access can use an AML mutex
    - net/mlx5e: SHAMPO, Fix incorrect page release
    - [arm64] drm/meson: plane: Add error handling
    - crypto: stm32/cryp - call finalize with bh disabled
    - gfs2: Revert "Add quota_change type"
    - RAS/AMD/ATL: Validate address map when information is gathered
    - net: tcp/dccp: prepare for tw_timer un-pinning
    - drm/bridge: tc358767: Check if fully initialized before signalling HPD
      event via IRQ
    - [arm64] pinctrl: renesas: rzg2l: Validate power registers for SD and ETH
    - thermal: trip: Use READ_ONCE() for lockless access to trip properties
    - [x86] hwmon: (k10temp) Check return value of amd_smn_read()
    - wifi: cfg80211: make hash table duplicates more survivable
    - f2fs: fix to do sanity check on blocks for inline_data inode
    - driver: iio: add missing checks on iio_info's callback access
    - block: remove the blk_flush_integrity call in blk_integrity_unregister
    - drm/amdgpu: add skip_hw_access checks for sriov
    - drm/amdgpu: add lock in amdgpu_gart_invalidate_tlb
    - drm/amdgpu: add lock in kfd_process_dequeue_from_device
    - drm/amdgpu: fix overflowed constant warning in mmhub_set_clockgating()
    - drm/amd/display: Don't use fsleep for PSR exit waits on dmub replay
    - drm/amd/display: added NULL check at start of dc_validate_stream
    - drm/amd/display: Correct the defined value for
      AMDGPU_DMUB_NOTIFICATION_MAX
    - drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection
    - drm/amd/display: use preferred link settings for dp signal only
    - drm/amd/display: Disable DMCUB timeout for DCN35
    - drm/amd/display: Avoid overflow from uint32_t to uint8_t
    - drm/amdgpu: set RAS fed status for more cases
    - drm/amd/display: Check BIOS images before it is used
    - drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
    - crypto: ecc - Fix off-by-one missing to clear most significant digit
    - media: uvcvideo: Enforce alignment of frame and interval
    - pinctrl: core: reset gpio_device in loop in pinctrl_pins_show()
    - mm: Fix filemap_invalidate_inode() to use invalidate_inode_pages2_range()
    - drm/amdgpu: remove redundant semicolons in RAS_EVENT_LOG
    - i2c: Use IS_REACHABLE() for substituting empty ACPI functions

  [ Aurelien Jarno ]
  * [riscv64] udeb: Ship mtd in kernel-image, drop mtd-core-modules and
    add it to to Provides of kernel-image.

  [ Marcin Juszkiewicz ]
  * [udeb] introduce drm-core-modules to handle 'kernel-image' modules which
    require 'drm' module
  * [arm64] udeb: ship mtd in kernel-image, drop mtd-core-modules and
    add it to to provides of kernel-image.
  * [arm64] udeb: ship typec in kernel-image

  [ Salvatore Bonaccorso ]
  * [hppa/parisc] Delay write-protection until mark_rodata_ro() call

[dgit import unpatched linux 6.10.9-1]