linux (5.10.92-1) bullseye-security; urgency=high

linux (5.10.92-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.85
    - usb: gadget: uvc: fix multiple opens
    - gcc-plugins: simplify GCC plugin-dev capability test
    - gcc-plugins: fix gcc 11 indigestion with plugins...
    - HID: quirks: Add quirk for the Microsoft Surface 3 type-cover
    - HID: add hid_is_usb() function to make it simpler for USB detection
    - HID: bigbenff: prevent null pointer dereference
    - HID: wacom: fix problems when device is not a valid USB device
    - HID: check for valid USB device for many HID drivers
    - [amd64] nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six
      8-bit groups
    - [amd64] IB/hfi1: Insure use of smp_processor_id() is preempt disabled
    - [amd64] IB/hfi1: Fix early init panic
    - [amd64] IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr
    - can: kvaser_usb: get CAN clock frequency from device
    - [x86] can: sja1000: fix use after free in ems_pcmcia_add_card()
    - drm/amdgpu: move iommu_resume before ip init/resume
    - drm/amdgpu: init iommu after amdkfd device init
    - nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
    - vrf: don't run conntrack on vrf with !dflt qdisc
    - bpf, x86: Fix "no previous prototype" warning
    - bpf: Fix the off-by-two error in range markings
    - ice: ignore dropped packets during init
    - bonding: make tx_rebalance_counter an atomic
    - nfp: Fix memory leak in nfp_cpp_area_cache_add()
    - seg6: fix the iif in the IPv6 socket control block
    - udp: using datalen to cap max gso segments
    - netfilter: conntrack: annotate data-races around ct->timeout
    - iavf: restore MSI state on reset
    - iavf: Fix reporting when setting descriptor count
    - [amd64] IB/hfi1: Correct guard on eager buffer deallocation
    - devlink: fix netns refcount leak in devlink_nl_cmd_reload()
    - net/sched: fq_pie: prevent dismantle issue
    - [x86] KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB
      flush hypercall
    - mm: bdi: initialize bdi_min_ratio when bdi is unregistered
    - ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform
    - ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1
    - ALSA: pcm: oss: Fix negative period/buffer sizes
    - ALSA: pcm: oss: Limit the period size to 16MB
    - ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*()
    - scsi: qla2xxx: Format log strings only if needed
    - btrfs: clear extent buffer uptodate when we fail to write it
    - btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling
    - md: fix update super 1.0 on rdev size change
    - nfsd: fix use-after-free due to delegation race (Closes: #988044)
    - nfsd: Fix nsfd startup race (again)
    - tracefs: Have new files inherit the ownership of their parent
    - [arm64] clk: qcom: regmap-mux: fix parent clock lookup
    - drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence.
    - [i386] can: pch_can: pch_can_rx_normal: fix use after free
    - libata: add horkage for ASMedia 1092
    - wait: add wake_up_pollfree()
    - binder: use wake_up_pollfree()
    - signalfd: use wake_up_pollfree()
    - aio: keep poll requests on waitqueue until completed
    - aio: fix use-after-free due to missing POLLFREE handling
    - [arm64,armhf] net: mvpp2: fix XDP rx queues registering
    - tracefs: Set all files to the same group ownership as the mount option
    - block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
    - scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()
    - scsi: scsi_debug: Fix buffer size of REPORT ZONES command
    - qede: validate non LSO skb length
    - PM: runtime: Fix pm_runtime_active() kerneldoc comment
    - ASoC: rt5682: Fix crash due to out of scope stack vars
    - [arm64] RDMA/hns: Do not halt commands during reset until later
    - [arm64] RDMA/hns: Do not destroy QP resources in the hw resetting phase
    - i40e: Fix failed opcode appearing if handling messages from VF
    - i40e: Fix pre-set max number of queues for VF
    - i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
    - [arm64] Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on
      emulated bridge"
    - Documentation/locking/locktypes: Update migrate_disable() bits.
    - dt-bindings: net: Reintroduce PHY no lane swap binding
    - net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
    - [arm64,armhf] net: fec: only clear interrupt of handling queue in
      fec_enet_rx_queue()
    - net, neigh: clear whole pneigh_entry at alloc time
    - net/qla3xxx: fix an error code in ql_adapter_up()
    - USB: gadget: detect too-big endpoint 0 requests (CVE-2021-39685)
    - USB: gadget: zero allocate endpoint 0 buffers (CVE-2021-39685)
    - usb: core: config: fix validation of wMaxPacketValue entries
    - xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime
      suspending
    - usb: core: config: using bit mask instead of individual bits
    - xhci: avoid race between disable slot command and host runtime suspend
    - iio: gyro: adxrs290: fix data signedness
    - iio: trigger: Fix reference counting
    - iio: stk3310: Don't return error code in interrupt handler
    - iio: mma8452: Fix trigger reference couting
    - iio: ltr501: Don't return error code in trigger handler
    - iio: kxsd9: Don't return error code in trigger handler
    - iio: itg3200: Call iio_trigger_notify_done() on error
    - iio: adc: axp20x_adc: fix charging current reporting on AXP22x
    - iio: ad7768-1: Call iio_trigger_notify_done() on error
    - iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
    - [armhf] irqchip/aspeed-scu: Replace update_bits with write_bits.
    - [armhf] irqchip/armada-370-xp: Fix return value of
      armada_370_xp_msi_alloc()
    - [armhf] irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
    - [arm64,armhf] irqchip/irq-gic-v3-its.c: Force synchronisation when issuing
      INVALL
    - kbuild: simplify GCC_PLUGINS enablement in dummy-tools/gcc
    - doc: gcc-plugins: update gcc-plugins.rst
    - MAINTAINERS: adjust GCC PLUGINS after gcc-plugin.sh removal
    - Documentation/Kbuild: Remove references to gcc-plugin.sh
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.86
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.87
    - nfc: fix segfault in nfc_genl_dump_devices_done
    - [arm64] drm/msm/dsi: set default num_data_lanes
    - [arm64] KVM: arm64: Save PSTATE early on exit
    - [arm64] Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP"
    - net/mlx4_en: Update reported link modes for 1/10G
    - ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
    - ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P
    - [arm64,armhf] i2c: rk3x: Handle a spurious start completion interrupt flag
    - net: netlink: af_netlink: Prevent empty skb by adding a check on len.
    - [x86] KVM: x86: Ignore sparse banks size for an "all CPUs", non-sparse IPI
      req
    - bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc
    - fuse: make sure reclaim doesn't write the inode
    - [x86] hwmon: (dell-smm) Fix warning on /proc/i8k creation error
    - ethtool: do not perform operations on net devices being unregistered
    - [armel,armhf] memblock: free_unused_memmap: use pageblock units instead of
      MAX_ORDER
    - [armel,armhf] memblock: align freed memory map on pageblock boundaries
      with SPARSEMEM
    - memblock: ensure there is no overflow in memblock_overlaps_region()
    - [armel,armhf] arm: extend pfn_valid to take into account freed memory map
      alignment
    - [armel,armhf] arm: ioremap: don't abuse pfn_valid() to check if pfn is in
      RAM
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.88
    - KVM: downgrade two BUG_ONs to WARN_ON_ONCE
    - mac80211: fix regression in SSN handling of addba tx
    - mac80211: mark TX-during-stop for TX in in_reconfig
    - mac80211: send ADDBA requests using the tid/queue of the aggregation
      session
    - mac80211: validate extended element ID is present
    - bpf: Fix signed bounds propagation after mov32
    - bpf: Make 32->64 bounds propagation slightly more robust
    - virtio_ring: Fix querying of maximum DMA mapping size for virtio device
    - dm btree remove: fix use after free in rebalance_children()
    - audit: improve robustness of the audit queue handling
    - [arm64] dts: imx8mp-evk: Improve the Ethernet PHY description
    - [arm64] dts: rockchip: fix rk3308-roc-cc vcc-sd supply
    - [arm64] dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply
    - mac80211: track only QoS data frames for admission control
    - ceph: fix duplicate increment of opened_inodes metric
    - ceph: initialize pathlen variable in reconnect_caps_cb
    - [armhf] socfpga: dts: fix qspi node compatible
    - clk: Don't parent clks until the parent is fully registered
    - [armhf] soc: imx: Register SoC device only on i.MX boards
    - virtio/vsock: fix the transport to work with VMADDR_CID_ANY
    - [s390x] kexec_file: fix error handling when applying relocations
    - sch_cake: do not call cake_destroy() from cake_init()
    - inet_diag: fix kernel-infoleak for UDP sockets
    - [arm64] net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg
    - net/sched: sch_ets: don't remove idle classes from the round-robin list
    - drm/ast: potential dereference of null pointer
    - mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock
    - mac80211: fix lookup when adding AddBA extension element
    - flow_offload: return EOPNOTSUPP for the unsupported mpls action type
    - rds: memory leak in __rds_conn_create() (CVE-2021-45480)
    - [arm64,armhf] soc/tegra: fuse: Fix bitwise vs. logical OR warning
    - igb: Fix removal of unicast MAC filters of VFs
    - igbvf: fix double free in `igbvf_probe`
    - igc: Fix typo in i225 LTR functions
    - ixgbe: Document how to enable NBASE-T support
    - ixgbe: set X550 MDIO speed before talking to PHY
    - netdevsim: Zero-initialize memory for new map's value in function
      nsim_bpf_map_alloc (CVE-2021-4135)
    - net/packet: rx_owner_map depends on pg_vec
    - sfc_ef100: potential dereference of null pointer
    - net: Fix double 0x prefix print in SKB dump
    - net/smc: Prevent smc_release() from long blocking
    - sit: do not call ipip6_dev_free() from sit_init_net()
    - USB: gadget: bRequestType is a bitfield, not a enum
    - Revert "usb: early: convert to readl_poll_timeout_atomic()"
    - [x86] KVM: x86: Drop guest CPUID check for host initiated writes to
      MSR_IA32_PERF_CAPABILITIES
    - [x86] tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous
    - USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04)
    - [arm*] usb: dwc2: fix STM ID/VBUS detection startup delay in
      dwc2_driver_probe
    - PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
    - PCI/MSI: Mask MSI-X vectors only on success
    - usb: xhci: Extend support for runtime power management for AMD's Yellow
      carp.
    - USB: serial: cp210x: fix CP2105 GPIO registration
    - USB: serial: option: add Telit FN990 compositions
    - btrfs: fix memory leak in __add_inode_ref()
    - btrfs: fix double free of anon_dev after failure to create subvolume
    - zonefs: add MODULE_ALIAS_FS
    - iocost: Fix divide-by-zero on donation from low hweight cgroup
    - [x86] serial: 8250_fintek: Fix garbled text for console
    - timekeeping: Really make sure wall_to_monotonic isn't positive
    - libata: if T_LENGTH is zero, dma direction should be DMA_NONE
    - drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE
    - Input: touchscreen - avoid bitwise vs logical OR warning
    - xsk: Do not sleep in poll() when need_wakeup set
    - media: mxl111sf: change mutex_init() location
    - fuse: annotate lock in fuse_reverse_inval_entry()
    - ovl: fix warning in ovl_create_real()
    - scsi: scsi_debug: Don't call kcalloc() if size arg is zero
    - scsi: scsi_debug: Fix type in min_t to avoid stack OOB
    - scsi: scsi_debug: Sanity check block descriptor length in
      resp_mode_select()
    - rcu: Mark accesses to rcu_state.n_force_qs
    - [armhf] bus: ti-sysc: Fix variable set but not used warning for
      reinit_modules
    - Revert "xsk: Do not sleep in poll() when need_wakeup set"
    - xen/blkfront: harden blkfront against event channel storms
      (CVE-2021-28711)
    - xen/netfront: harden netfront against event channel storms
      (CVE-2021-28712)
    - xen/console: harden hvc_xen against event channel storms (CVE-2021-28713)
    - xen/netback: fix rx queue stall detection (CVE-2021-28714)
    - xen/netback: don't queue unlimited number of packages (CVE-2021-28715)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.89
    - net: usb: lan78xx: add Allied Telesis AT29M2-AF
    - ext4: prevent partial update of the extent blocks
    - ext4: check for out-of-order index extents in ext4_valid_extent_entries()
    - ext4: check for inconsistent extents between index and leaf block
    - HID: holtek: fix mouse probing
    - [arm64] dts: allwinner: orangepi-zero-plus: fix PHY mode
    - [arm64] spi: change clk_disable_unprepare to clk_unprepare
    - [amd64] IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
    - [arm64] RDMA/hns: Replace kfree() with kvfree()
    - netfilter: fix regression in looped (broad|multi)cast's MAC handling
    - qlcnic: potential dereference null pointer of rx_queue->page_ring
    - net: accept UFOv6 packages in virtio_net_hdr_to_skb
    - net: skip virtio_net_hdr_set_proto if protocol already set
    - igb: fix deadlock caused by taking RTNL in RPM resume path
    - ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
    - bonding: fix ad_actor_system option setting to default
    - [amd64] fjes: Check for error irq
    - [armhf] drivers: net: smc911x: Check for error irq
    - sfc: Check null pointer of rx_queue->page_ring
    - sfc: falcon: Check null pointer of rx_queue->page_ring
    - Input: elantech - fix stack out of bound access in
      elantech_change_report_id()
    - [arm*] pinctrl: bcm2835: Change init order for gpio hogs
    - hwmon: (lm90) Fix usage of CONFIG2 register in detect function
    - hwmon: (lm90) Add basic support for TI TMP461
    - hwmon: (lm90) Introduce flag indicating extended temperature support
    - hwmon: (lm90) Drop critical attribute support for MAX6654
    - ALSA: jack: Check the return value of kstrdup()
    - ALSA: drivers: opl3: Fix incorrect use of vp->state
    - ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6
    - ALSA: hda/realtek: Add new alc285-hp-amp-init model
    - ALSA: hda/realtek: Fix quirk for Clevo NJ51CU
    - Input: atmel_mxt_ts - fix double free in mxt_read_info_block
    - ipmi: bail out if init_srcu_struct fails
    - ipmi: ssif: initialize ssif_info->client early
    - ipmi: fix initialization when workqueue allocation fails
    - [arm64] tee: handle lookup of shm with reference count 0
    - [x86] pkey: Fix undefined behaviour with PKRU_WD_BIT
    - [x86] platform/x86: intel_pmc_core: fix memleak on registration failure
    - [x86] KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this
      vCPU
    - [armhf] pinctrl: stm32: consider the GPIO offset to expose all the GPIO
      lines
    - [arm64,armhf] mmc: sdhci-tegra: Fix switch to HS400ES mode
    - mmc: core: Disable card detect during shutdown
    - [arm64,armhf] mmc: mmci: stm32: clear DLYB_CR after sending tuning command
    - [armel,armhf] 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling
    - mac80211: fix locking in ieee80211_start_ap error path
    - mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
    - [arm64] tee: optee: Fix incorrect page free bug
    - f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
      (CVE-2021-45469)
    - ceph: fix up non-directory creation in SGID directories
    - usb: gadget: u_ether: fix race in setting MAC address in setup phase
    - [x86] KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state
    - mm: mempolicy: fix THP allocations escaping mempolicy restrictions
    - [arm64] Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312
    - Input: goodix - add id->model mapping for the "9111" model
    - ASoC: rt5682: fix the wrong jack type detected
    - hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681
    - hwmon: (lm90) Do not report 'busy' status bit as alarm
    - ax25: NPD bug when detaching AX25 device
    - hamradio: defer ax25 kfree after unregister_netdev
    - hamradio: improve the incomplete fix to avoid NPD
    - phonet/pep: refuse to enable an unbound pipe
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.90
    - Input: i8042 - add deferred probe support
    - Input: i8042 - enable deferred probe quirk for ASUS UM325UA
    - tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok().
    - tomoyo: use hwight16() in tomoyo_domain_quota_is_ok()
    - [x86] platform/x86: apple-gmux: use resource_size() with res
    - memblock: fix memblock_phys_alloc() section mismatch error
    - selinux: initialize proto variable in selinux_ip_postroute_compat()
    - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
    - net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources
    - net/mlx5e: Wrap the tx reporter dump callback to extract the sq
    - net/mlx5e: Fix ICOSQ recovery flow for XSK
    - udp: using datalen to cap ipv6 udp max gso segments
    - sctp: use call_rcu to free endpoint
    - net/smc: fix using of uninitialized completions
    - net: usb: pegasus: Do not drop long Ethernet frames
    - net/smc: improved fix wait on already cleared link
    - net/smc: don't send CDC/LLC message if link not ready
    - net/smc: fix kernel panic caused by race of smc_sock
    - igc: Fix TX timestamp support for non-MSI-X platforms
    - net/mlx5e: Fix wrong features assignment in case of error
    - [armhf] net/ncsi: check for error return from call to nla_put_u32
    - i2c: validate user data in compat ioctl
    - nfc: uapi: use kernel size_t to fix user-space builds
    - uapi: fix linux/nfc.h userspace compilation errors
    - drm/amdgpu: When the VCN(1.0) block is suspended, powergating is
      explicitly enabled
    - drm/amdgpu: add support for IP discovery gc_info table v2
    - xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set.
    - usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
    - [arm*] binder: fix async_free_space accounting for empty parcels
    - [x86] scsi: vmw_pvscsi: Set residual data length conditionally
    - Input: appletouch - initialize work before device registration
    - Input: spaceball - fix parsing of movement data packets
    - net: fix use-after-free in tw_timer_handler
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.91
    - f2fs: quota: fix potential deadlock
    - tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
    - tracing: Tag trace_percpu_buffer as a percpu pointer
    - ieee802154: atusb: fix uninit value in atusb_set_extended_addr
    - i40e: Fix to not show opcode msg on unsuccessful VF MAC change
    - iavf: Fix limit of total number of queues to active queues of VF
    - RDMA/core: Don't infoleak GRH fields
    - netrom: fix copying in user data in nr_setsockopt
    - RDMA/uverbs: Check for null return of kmalloc_array
    - mac80211: initialize variable have_higher_than_11mbit
    - sfc: The RX page_ring is optional
    - i40e: fix use-after-free in i40e_sync_filters_subtask()
    - i40e: Fix for displaying message regarding NVM version
    - i40e: Fix incorrect netdev's real number of RX/TX queues
    - ipv4: Check attribute length for RTA_GATEWAY in multipath route
    - ipv4: Check attribute length for RTA_FLOW in multipath route
    - ipv6: Check attribute length for RTA_GATEWAY in multipath route
    - ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
    - lwtunnel: Validate RTA_ENCAP_TYPE attribute length
    - batman-adv: mcast: don't send link-local multicast to mcast routers
    - sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
    - net: ena: Fix undefined state when tx request id is out of bounds
    - net: ena: Fix error handling when calculating max IO queues number
    - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
      (CVE-2021-4155)
    - power: supply: core: Break capacity loop
    - rndis_host: support Hytera digital radios
    - phonet: refcount leak in pep_sock_accep (CVE-2021-45095)
    - ipv6: Continue processing multipath route even if gateway attribute is
      invalid
    - ipv6: Do cleanup if attribute validation fails in multipath route
    - scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
    - ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
    - net: udp: fix alignment problem in udp4_seq_show()
    - [amd64,arm64] atlantic: Fix buff_ring OOB in aq_ring_rx_clean
    - mISDN: change function names to avoid conflicts
    - drm/amd/display: Added power down for DCN10
    - ipv6: raw: check passed optlen before reading
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.92
    - md: revert io stats accounting
    - workqueue: Fix unbind_workers() VS wq_worker_running() race
    - bpf: Fix out of bounds access from invalid *_or_null type verification
      (CVE-2022-23222)
    - Bluetooth: btusb: fix memory leak in btusb_mtk_submit_wmt_recv_urb()
    - Bluetooth: btusb: Add two more Bluetooth parts for WCN6855
    - Bluetooth: btusb: Add support for Foxconn MT7922A
    - Bluetooth: btusb: Add support for Foxconn QCA 0xe0d0
    - Bluetooth: bfusb: fix division by zero in send path
    - [armhf] dts: exynos: Fix BCM4330 Bluetooth reset polarity in I9100
    - USB: core: Fix bug in resuming hub's handling of wakeup requests
    - USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status
    - ath11k: Fix buffer overflow when scanning with extraie
    - mmc: sdhci-pci: Add PCI ID for Intel ADL
    - veth: Do not record rx queue hint in veth_xmit
    - [x86] mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
    - can: gs_usb: fix use of uninitialized variable, detach device on reception
      of invalid USB data
    - can: isotp: convert struct tpcon::{idx,len} to unsigned int
    - can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved}
    - random: fix data race on crng_node_pool
    - random: fix data race on crng init time
    - random: fix crash on multiple early calls to add_bootloader_randomness()
    - media: Revert "media: uvcvideo: Set unique vdev name based in type"
    - [x86] drm/i915: Avoid bitwise vs logical OR warning in
      snb_wm_latency_quirk()

  [ Salvatore Bonaccorso ]
  * [arm64] drivers/net/ethernet/google: Enable GVE as module (Closes: #996974)
  * Refresh "Export symbols needed by Android drivers"
  * [rt] Update to 5.10.87-rt59
  * Bump ABI to 11
  * [rt] Update to 5.10.90-rt60
  * vfs: fs_context: fix up param length parsing in legacy_parse_param
    (CVE-2022-0185)

  [ Andrew Balmos ]
  * net/can: Enable CONFIG_CAN_MCP251X as module

  [ Cyril Brulebois ]
  * arm64: dts: Add support for Raspberry Pi Compute Module 4 IO Board,
    producing a DTB that's almost entirely identical to what a v5.16-rc8
    build produces, with lots of thanks to Uwe Kleine-König for the heavy
    lifting!

[dgit import unpatched linux 5.10.92-1]