# changelog

author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.528.1.el7uek]
changelog:
  - LTS version: v4.14.320 (Saeed Mirzamohammadi)   
  - i2c: imx-lpi2c: fix type char overflow issue when calculating the clock cycle (Clark Wang)   
  - x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys (Dheeraj Kumar Srivastava)   
  - drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl (Min Li)   
  - drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl (Min Li)   
  - drm/exynos: vidi: fix a wrong error return (Inki Dae)   
  - s390/cio: unregister device when the only path is gone (Vineeth Vijayan)   
  - usb: gadget: udc: fix NULL dereference in remove() (Dan Carpenter)   
  - fbdev: imsttfb: Release framebuffer and dealloc cmap on error path (Helge Deller)   
  - nfcsim.c: Fix error checking for debugfs_create_dir (Osama Muhammad)   
  - arm64: Add missing Set/Way CMO encodings (Marc Zyngier)   
  - HID: wacom: Add error check to wacom_parse_and_register() (Denis Arefev)   
  - scsi: target: iscsi: Prevent login threads from racing between each other (Maurizio Lombardi)   
  - netfilter: nf_tables: disallow element updates of bound anonymous sets (Pablo Neira Ayuso)   
  - be2net: Extend xmit workaround to BE3 chip (Ross Lagerwall)   
  - mmc: usdhi60rol0: fix deferred probing (Sergey Shtylyov)   
  - mmc: omap_hsmmc: fix deferred probing (Sergey Shtylyov)   
  - mmc: omap: fix deferred probing (Sergey Shtylyov)   
  - mmc: mtk-sd: fix deferred probing (Sergey Shtylyov)   
  - net: qca_spi: Avoid high load if QCA7000 is not available (Stefan Wahren)   
  - xfrm: Linearize the skb after offloading if needed. (Sebastian Andrzej Siewior)   
  - nilfs2: prevent general protection fault in nilfs_clear_dirty_page() (Ryusuke Konishi)   
  - cgroup: Do not corrupt task iteration when rebinding subsystem (Xiu Jianfeng)   
  - Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs (Michael Kelley)   
  - nilfs2: fix buffer corruption due to concurrent device reads (Ryusuke Konishi)   
  - nilfs2: reject devices with insufficient block count (Ryusuke Konishi)   
  - serial: lantiq: add missing interrupt ack (Bernhard Seibold)   
  - LTS version: v4.14.319 (Saeed Mirzamohammadi)   
  - mmc: block: ensure error propagation for non-blk (Christian Loehle)   
  - powerpc: Fix defconfig choice logic when cross compiling (Michael Ellerman)   
  - neighbour: delete neigh_lookup_nodev as not used (Leon Romanovsky)   
  - neighbour: Remove unused inline function neigh_key_eq16() (Gaosheng Cui)   
  - selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET (Alex Maftei)   
  - net: tipc: resize nlattr array to correct size (Lin Ma)   
  - net: lapbether: only support ethernet devices (Eric Dumazet)   
  - drm/nouveau/dp: check for NULL nv_connector->native_mode (Natalia Petrova)   
  - igb: fix nvm.ops.read() error handling (Aleksandr Loktionov)   
  - sctp: fix an error code in sctp_sf_eat_auth() (Dan Carpenter)   
  - IB/isert: Fix incorrect release of isert connection (Saravanan Vajravel)   
  - IB/isert: Fix possible list corruption in CMA handler (Saravanan Vajravel)   
  - IB/isert: Fix dead lock in ib_isert (Saravanan Vajravel)   
  - ping6: Fix send to link-local addresses with VRF. (Guillaume Nault)   
  - netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM (Pablo Neira Ayuso)   
  - USB: serial: option: add Quectel EM061KGL series (Jerry Meng)   
  - Remove DECnet support from kernel (Stephen Hemminger)   
  - net: usb: qmi_wwan: add support for Compal RXM-G1 (Wes Huang)   
  - nilfs2: fix possible out-of-bounds segment allocation in resize ioctl (Ryusuke Konishi)   
  - nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() (Ryusuke Konishi)   
  - nios2: dts: Fix tse_mac "max-frame-size" property (Janne Grunau)   
  - ocfs2: check new file size on fallocate call (Luís Henriques)   
  - ocfs2: fix use-after-free when unmounting read-only filesystem (Luís Henriques)   
  - xen/blkfront: Only check REQ_FUA for writes (Ross Lagerwall)   
  - mips: Move initrd_start check after initrd address sanitisation. (Liviu Dudau)   
  - MIPS: Alchemy: fix dbdma2 (Manuel Lauss)   
  - power: supply: Fix logic checking if system is running from battery (Mario Limonciello)   
  - regulator: Fix error checking for debugfs_create_dir (Osama Muhammad)   
  - power: supply: Ratelimit no data debug output (Marek Vasut)   
  - ARM: dts: vexpress: add missing cache properties (Krzysztof Kozlowski)   
  - power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule() (Hans de Goede)   
  - power: supply: ab8500: Fix external_power_changed race (Hans de Goede)   
  - LTS version: v4.14.318 (Saeed Mirzamohammadi)   
  - btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (Zixuan Fu)   
  - btrfs: check return value of btrfs_commit_transaction in relocation (Josef Bacik)   
  - ext4: only check dquot_initialize_needed() when debugging (Theodore Ts'o)   
  - i2c: sprd: Delete i2c adapter in .remove's error path (Uwe Kleine-König)   
  - Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk (Luiz Augusto von Dentz)   
  - ceph: fix use-after-free bug for inodes when flushing capsnaps (Xiubo Li)   
  - drm/amdgpu: fix xclk freq on CHIP_STONEY (Chia-I Wu)   
  - Input: psmouse - fix OOB access in Elantech protocol (Dmitry Torokhov)   
  - Input: xpad - delete a Razer DeathAdder mouse VID/PID entry (Ismael Ferreras Morezuelas)   
  - batman-adv: Broken sync while rescheduling delayed work (Vladislav Efanov)   
  - bnxt_en: Query default VLAN before VNIC setup on a VF (Somnath Kotur)   
  - net: sched: move rtm_tca_policy declaration to include file (Eric Dumazet)   
  - rfs: annotate lockless accesses to RFS sock flow table (Eric Dumazet)   
  - rfs: annotate lockless accesses to sk->sk_rxhash (Eric Dumazet)   
  - Bluetooth: L2CAP: Add missing checks for invalid DCID (Sungwoo Kim)   
  - Bluetooth: Fix l2cap_disconnect_req deadlock (Ying Hsu)   
  - spi: qup: Request DMA before enabling clocks (Stephan Gerhold)   
  - i40e: fix build warnings in i40e_alloc.h (Greg Kroah-Hartman)   
  - i40iw: fix build warning in i40iw_manage_apbvt() (Greg Kroah-Hartman)   
  - LTS version: v4.14.317 (Saeed Mirzamohammadi)   
  - wifi: rtlwifi: 8192de: correct checking of IQK reload (Ping-Ke Shih)   
  - Fix double fget() in vhost_net_set_backend() (Al Viro)   
  - net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize (Tudor Ambarus)   
  - cdc_ncm: Fix the build warning (Alexander Bersenev)   
  - cdc_ncm: Implement the 32-bit version of NCM Transfer Block (Alexander Bersenev)   
  - scsi: dpt_i2o: Do not process completions with invalid addresses (Ben Hutchings)   
  - scsi: dpt_i2o: Remove broken pass-through ioctl (I2OUSERCMD) (Ben Hutchings)   
  - fbcon: Fix null-ptr-deref in soft_cursor (Helge Deller)   
  - ext4: add lockdep annotations for i_data_sem for ea_inode's (Theodore Ts'o)   
  - tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK (Sherry Sun)   
  - mmc: vub300: fix invalid response handling (Deren Wu)   
  - regulator: da905{2,5}: Remove unnecessary array check (Nathan Chancellor)   
  - wifi: rtlwifi: remove always-true condition pointed out by GCC 12 (Jakub Kicinski)   
  - lib/dynamic_debug.c: use address-of operator on section symbols (Nathan Chancellor)   
  - kernel/extable.c: use address-of operator on section symbols (Nathan Chancellor)   
  - eth: sun: cassini: remove dead code (Martin Liška)   
  - gcc-12: disable '-Wdangling-pointer' warning for now (Linus Torvalds)   
  - ACPI: thermal: drop an always true check (Adam Borowski)   
  - x86/boot: Wrap literal addresses in absolute_pointer() (Kees Cook)   
  - ata: libata-scsi: Use correct device no in ata_find_dev() (Damien Le Moal)   
  - scsi: stex: Fix gcc 13 warnings (Bart Van Assche)   
  - usb: gadget: f_fs: Add unbind event before functionfs_unbind (Uttkarsh Aggarwal)   
  - net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818 (Sebastian Krzyszkowiak)   
  - iio: dac: mcp4725: Fix i2c_master_send() return value handling (Marek Vasut)   
  - HID: wacom: avoid integer overflow in wacom_intuos_inout() (Nikita Zhandarovich)   
  - iio: adc: mxs-lradc: fix the order of two cleanup operations (Jiakai Luo)   
  - mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() (Dan Carpenter)   
  - atm: hide unused procfs functions (Arnd Bergmann)   
  - ALSA: oss: avoid missing-prototype warnings (Arnd Bergmann)   
  - netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT (Tom Rix)   
  - wifi: b43: fix incorrect __packed annotation (Arnd Bergmann)   
  - scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed (Wenchao Hao)   
  - wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value (Yun Lu)   
  - media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 (Hyunwoo Kim)   
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (Takashi Iwai)   
  - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() (Hyunwoo Kim)   
  - media: netup_unidvb: fix irq init by register it at the end of probe (Wei Chen)   
  - media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address (Wei Chen)   
  - media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer() (Wei Chen)   
  - media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer (Zhang Shurong)   
  - media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer() (Wei Chen)   
  - media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer() (Wei Chen)   
  - media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() (Wei Chen)   
  - ASoC: ssm2602: Add workaround for playback distortions (Paweł Anikiel)   
  - ASoC: dwc: limit the number of overrun messages (Maxim Kochetkov)   
  - nbd: Fix debugfs_create_dir error checking (Ivan Orlov)   
  - fbdev: stifb: Fix info entry in sti_struct on error path (Helge Deller)   
  - fbdev: modedb: Add 1920x1080 at 60 Hz video mode (Helge Deller)   
  - ARM: 9295/1: unwind:fix unwind abort for uleb128 case (Haibo Li)   
  - mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() (Lee Jones)   
  - net: dsa: mv88e6xxx: Increase wait after reset deactivation (Andreas Svensson)   
  - udp6: Fix race condition in udp6_sendmsg & connect (Vladislav Efanov)   
  - tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set (Cambda Zhu)   
  - af_packet: do not use READ_ONCE() in packet_bind() (Eric Dumazet)   
  - af_packet: Fix data-races of pkt_sk(sk)->num. (Kuniyuki Iwashima)   
  - netrom: fix info-leak in nr_write_internal() (Eric Dumazet)   
  - dmaengine: pl330: rename _start to prevent build error (Randy Dunlap)   
  - bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() (Ruihan Li)   
  - ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg (Cezary Rojewski)   
  - power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize (Hans de Goede)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.529.1.el7uek]
changelog:
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (George Kennedy)  [Orabug: 35649492]  {CVE-2023-3567} 
  - ocfs2: always read both high and low parts of dinode link count (Alexey Asemov)  [Orabug: 35643004]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.529.2.el7uek]
changelog:
  - x86/cpu: persist X86_FEATURE_NT_GOOD for late reload (Ankur Arora)  [Orabug: 35693947]  
  - uek-rpm: Disable cls_tcindex in file tcindex-disable.conf (Sherry Yang)  [Orabug: 35678739]  
  - uek-rpm: Update kernel's linux-firmware dependency. (Somasundaram Krishnasamy)  [Orabug: 35678693]  
  - Revert "sched/fair: sanitize vruntime of entity being placed" (Saeed Mirzamohammadi)  [Orabug: 35651310]  
  - Revert "sched/fair: Sanitize vruntime of entity being migrated" (Saeed Mirzamohammadi)  [Orabug: 35651310]  
  - x86/microcode/AMD: Clean up per-family patch size checks (Borislav Petkov)  [Orabug: 35643967]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.527.1.el7uek]
changelog:
  - mips64: Enable CRYPTO_USER_API_SKCIPHER config (Vijay Kumar)  [Orabug: 35458816]  
  - net/rds: Fix copy&paste error (Gerd Rausch)  [Orabug: 35416949]  
  - uek-rpm: Blacklist cls_tcindex module (Somasundaram Krishnasamy)  [Orabug: 35408336]  
  - LTS version: v4.14.316 (Saeed Mirzamohammadi)   
  - 3c589_cs: Fix an error handling path in tc589_probe() (Christophe JAILLET)   
  - forcedeth: Fix an error handling path in nv_probe() (Christophe JAILLET)   
  - x86/show_trace_log_lvl: Ensure stack pointer is aligned, again (Vernon Lovejoy)   
  - xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() (Dan Carpenter)   
  - power: supply: sbs-charger: Fix INHIBITED bit for Status reg (Daisuke Nojiri)   
  - power: supply: bq27xxx: Fix poll_interval handling and races on remove (Hans de Goede)   
  - power: supply: bq27xxx: Fix I2C IRQ race on remove (Hans de Goede)   
  - power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition (Hans de Goede)   
  - power: supply: leds: Fix blink to LED on transition (Hans de Goede)   
  - ipv6: Fix out-of-bounds access in ipv6_find_tlv() (Gavrilov Ilia)   
  - net: fix skb leak in __skb_tstamp_tx() (Pratyush Yadav)   
  - media: radio-shark: Add endpoint checks (Alan Stern)   
  - USB: sisusbvga: Add endpoint checks (Alan Stern)   
  - x86/mm: Avoid incomplete Global INVLPG flushes (Saeed Mirzamohammadi)   
  - USB: core: Add routines for endpoint checks in old drivers (Alan Stern)   
  - selftests/memfd: Fix unknown type name build failure (Hardik Garg)   
  - netfilter: nf_tables: fix register ordering (Florian Westphal)   
  - netfilter: nf_tables: do not allow SET_ID to refer to another table (Pablo Neira Ayuso)   
  - netfilter: nf_tables: do not allow RULE_ID to refer to another chain (Pablo Neira Ayuso)   
  - netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL (Pablo Neira Ayuso)   
  - netfilter: nf_tables: stricter validation of element data (Pablo Neira Ayuso) [Orabug: 34362007] {CVE-2022-34918}
  - netfilter: nf_tables: allow up to 64 bytes in the set element data area (Pablo Neira Ayuso)   
  - netfilter: nf_tables: add nft_setelem_parse_key() (Pablo Neira Ayuso)   
  - netfilter: nf_tables: validate registers coming from userspace. (Pablo Neira Ayuso) [Orabug: 34012908] {CVE-2022-1015}
  - netfilter: nftables: statify nft_parse_register() (Pablo Neira Ayuso)   
  - netfilter: nftables: add nft_parse_register_store() and use it (Pablo Neira Ayuso)   
  - netfilter: nftables: add nft_parse_register_load() and use it (Pablo Neira Ayuso)   
  - parisc: Allow to reboot machine after system halt (Helge Deller)   
  - m68k: Move signal frame following exception on 68020/030 (Finn Thain)   
  - spi: fsl-cpm: Use 16 bit mode for large transfers with even size (Christophe Leroy)   
  - spi: fsl-spi: Re-organise transfer bits_per_word adaptation (Christophe Leroy)   
  - spi: spi-fsl-spi: automatically adapt bits-per-word in cpu mode (Rasmus Villemoes)   
  - netfilter: nf_tables: bogus EBUSY in helper removal from transaction (Pablo Neira Ayuso)   
  - nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() (Ryusuke Konishi)   
  - ceph: force updating the msg pointer in non-split case (Xiubo Li)   
  - serial: Add support for Advantech PCI-1611U card (Vitaliy Tomin)   
  - statfs: enforce statfs[64] structure initialization (Ilya Leoshkevich)   
  - ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table (Nikhil Mahale)   
  - ALSA: hda: Fix Oops by 9.1 surround channel names (Takashi Iwai)   
  - usb-storage: fix deadlock when a scsi command timeouts more than once (Maxime Bizon)   
  - vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() (Eric Dumazet)   
  - igb: fix bit_shift to be in [1..8] range (Aleksandr Loktionov)   
  - cassini: Fix a memory leak in the error handling path of cas_init_one() (Christophe JAILLET)   
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Dong Chenchen)   
  - media: netup_unidvb: fix use-after-free at del_timer() (Duoming Zhou)   
  - vsock: avoid to close connected socket after the timeout (Zhuang Shengen)   
  - net: fec: Better handle pm_runtime_get() failing in .remove() (Uwe Kleine-König)   
  - af_key: Reject optional tunnel/BEET mode templates in outbound policies (Tobias Brunner)   
  - cpupower: Make TSC read per CPU for Mperf monitor (Wyes Karny)   
  - mfd: dln2: Fix memory leak in dln2_probe() (Qiang Ning)   
  - phy: st: miphy28lp: use _poll_timeout functions for waits (Alain Volmat)   
  - Input: xpad - add constants for GIP interface numbers (Vicki Pfau)   
  - clk: tegra20: fix gcc-7 constant overflow warning (Arnd Bergmann)   
  - recordmcount: Fix memory leaks in the uwrite function (Hao Zeng)   
  - sched: Fix KCSAN noinstr violation (Josh Poimboeuf)   
  - mcb-pci: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - serial: 8250: Reinit port->pm on port specific driver unbind (Tony Lindgren)   
  - HID: wacom: generic: Set battery quirk only when we see battery data (Jason Gerecke)   
  - spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 (Kevin Groeneveld)   
  - HID: logitech-hidpp: Reconcile USB and Unifying serials (Bastien Nocera)   
  - HID: logitech-hidpp: Don't use the USB serial for USB devices (Bastien Nocera)   
  - staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE (Philipp Hortmann)   
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (Min Li)   
  - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (Hans de Goede)   
  - ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() (Ojaswin Mujoo)   
  - ext4: set goal start correctly in ext4_mb_normalize_request (Kemeng Shi)   
  - gfs2: Fix inode height consistency check (Andreas Gruenbacher)   
  - scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition (Zheng Wang)   
  - lib: cpu_rmap: Avoid use after free on rmap->obj array entries (Eli Cohen)   
  - net: Catch invalid index in XPS mapping (Nick Child)   
  - net: pasemi: Fix return type of pasemi_mac_start_tx() (Nathan Chancellor)   
  - ext2: Check block size validity during mount (Jan Kara)   
  - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex (Hector Martin)   
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects (void0red)   
  - ACPICA: Avoid undefined behavior: applying zero offset to null pointer (Tamir Duberstein)   
  - drm/tegra: Avoid potential 32-bit integer overflow (Nur Hussein)   
  - ACPI: EC: Fix oops when removing custom query handlers (Armin Wolf)   
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang)   
  - regmap: cache: Return error in cache sync operations for REGCACHE_NONE (Alexander Stein)   
  - fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() (Tetsuo Handa)   
  - af_unix: Fix a data race of sk->sk_receive_queue->qlen. (Kuniyuki Iwashima)   
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (t.feng)   
  - net: annotate sk->sk_err write from do_recvmmsg() (Eric Dumazet)   
  - netlink: annotate accesses to nlk->cb_running (Eric Dumazet)   
  - net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). (Kuniyuki Iwashima)   
  - LTS version: v4.14.315 (Saeed Mirzamohammadi)   
  - mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock (Tetsuo Handa)   
  - printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h (Tetsuo Handa)   
  - drbd: correctly submit flush bio on barrier (Christoph Böhmwalder)   
  - serial: 8250: Fix serial8250_tx_empty() race with DMA Tx (Ilpo Järvinen)   
  - tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH (Ilpo Järvinen)   
  - perf bench: Share some global variables to fix build with gcc 10 (Arnaldo Carvalho de Melo)   
  - ext4: fix invalid free tracking in ext4_xattr_move_to_block() (Theodore Ts'o)   
  - ext4: remove a BUG_ON in ext4_mb_release_group_pa() (Theodore Ts'o)   
  - ext4: bail out of ext4_xattr_ibody_get() fails for any reason (Theodore Ts'o)   
  - ext4: add bounds checking in get_max_inline_xattr_value_size() (Theodore Ts'o)   
  - ext4: improve error recovery code paths in __ext4_remount() (Theodore Ts'o)   
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus)   
  - HID: wacom: Set a default resolution for older tablets (Ping Cheng)   
  - ARM: dts: s5pv210: correct MIPI CSIS clock name (Krzysztof Kozlowski)   
  - ARM: dts: exynos: fix WM8960 clock name in Itop Elite (Krzysztof Kozlowski)   
  - sh: nmi_debug: fix return value of __setup handler (Randy Dunlap)   
  - sh: math-emu: fix macro redefined warning (Randy Dunlap)   
  - cifs: fix pcchunk length type in smb2_copychunk_range (Pawel Witek)   
  - btrfs: print-tree: parent bytenr must be aligned to sector size (Anastasia Belova)   
  - btrfs: fix btrfs_prev_leaf() to not return the same key twice (Filipe Manana)   
  - perf symbols: Fix return incorrect build_id size in elf_read_build_id() (Yang Jihong)   
  - perf map: Delete two variable initialisations before null pointer checks in sort__sym_from_cmp() (Markus Elfring)   
  - perf vendor events power9: Remove UTF-8 characters from JSON files (Kajol Jain)   
  - ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init` (Ruliang Lin)   
  - af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). (Kuniyuki Iwashima)   
  - net/sched: act_mirred: Add carrier check (Victor Nogueira)   
  - writeback: fix call of incorrect macro (Maxim Korotkov)   
  - sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() (Cong Wang)   
  - netfilter: nf_tables: deactivate anonymous set from preparation phase (Pablo Neira Ayuso)   
  - netfilter: nf_tables: bogus EBUSY when deleting set after flush (Pablo Neira Ayuso)   
  - netfilter: nf_tables: use-after-free in failing rule with bound set (Pablo Neira Ayuso)   
  - netfilter: nft_hash: fix nft_hash_deactivate (Pablo Neira Ayuso)   
  - netfilter: nf_tables: unbind set in rule from commit path (Pablo Neira Ayuso)   
  - netfilter: nf_tables: split set destruction in deactivate and destroy phase (Florian Westphal)   
  - perf auxtrace: Fix address filter entire kernel size (Adrian Hunter)   
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern (Mike Snitzer)   
  - dm flakey: fix a crash with invalid table line (Mikulas Patocka)   
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (Mike Snitzer)   
  - s390/dasd: fix hanging blockdevice after request requeue (Stefan Haberland)   
  - btrfs: scrub: reject unsupported scrub flags (Qu Wenruo)   
  - clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent (Quentin Schulz)   
  - wifi: rtl8xxxu: RTL8192EU always needs full init (Bitterblue Smith)   
  - nilfs2: fix infinite loop in nilfs_mdt_get_block() (Ryusuke Konishi)   
  - nilfs2: do not write dirty data after degenerating to read-only (Ryusuke Konishi)   
  - parisc: Fix argument pointer in real64_call_asm() (Helge Deller)   
  - dmaengine: at_xdmac: do not enable all cyclic channels (Claudiu Beznea)   
  - phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port (Gaosheng Cui)   
  - NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease (Trond Myklebust)   
  - IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order (Patrick Kelsey)   
  - clk: add missing of_node_put() in "assigned-clocks" property parsing (Clément Léger)   
  - power: supply: generic-adc-battery: fix unit scaling (Sebastian Reichel)   
  - RDMA/rdmavt: Delete unnecessary NULL check (Natalia Petrova)   
  - perf/core: Fix hardlockup failure caused by perf throttle (Yang Jihong)   
  - powerpc/rtas: use memmove for potentially overlapping buffer copy (Nathan Lynch)   
  - macintosh: via-pmu-led: requires ATA to be set (Randy Dunlap)   
  - powerpc/sysdev/tsi108: fix resource printk format warnings (Randy Dunlap)   
  - powerpc/wii: fix resource printk format warnings (Randy Dunlap)   
  - powerpc/mpc512x: fix resource printk format warning (Randy Dunlap)   
  - macintosh/windfarm_smu_sat: Add missing of_node_put() (Liang He)   
  - spmi: Add a check for remove callback when removing a SPMI driver (Jishnu Prakash)   
  - staging: rtl8192e: Fix W_DISABLE# does not work after stop/start (Philipp Hortmann)   
  - serial: 8250: Add missing wakeup event reporting (Florian Fainelli)   
  - tty: serial: fsl_lpuart: adjust buffer length to the intended size (Shenwei Wang)   
  - usb: chipidea: fix missing goto in `ci_hdrc_probe` (Yinhao Hu)   
  - sh: sq: Fix incorrect element size for allocating bitmap buffer (John Paul Adrian Glaubitz)   
  - uapi/linux/const.h: prefer ISO-friendly __typeof__ (Saeed Mirzamohammadi)   
  - ia64: mm/contig: fix section mismatch warning/error (Randy Dunlap)   
  - of: Fix modalias string generation (Miquel Raynal)   
  - spi: fsl-spi: Fix CPM/QE mode Litte Endian (Christophe Leroy)   
  - linux/vt_buffer.h: allow either builtin or modular for macros (Randy Dunlap)   
  - pstore: Revert pmsg_lock back to a normal mutex (John Stultz)   
  - tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (Kuniyuki Iwashima)   
  - net: amd: Fix link leak when verifying config failed (Gencen Gan)   
  - ipv4: Fix potential uninit variable access bug in __ip_make_skb() (Ziyang Xuan)   
  - ixgbe: Enable setting RSS table to default values (Joe Damato)   
  - ixgbe: Allow flow hash to be set via ethtool (Joe Damato)   
  - wifi: iwlwifi: mvm: check firmware response size (Johannes Berg)   
  - wifi: iwlwifi: make the loop for card preparation effective (Emmanuel Grumbach)   
  - md/raid10: fix leak of 'r10bio->remaining' for recovery (Yu Kuai)   
  - scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS (Danila Chernetsov)   
  - scsi: target: iscsit: Fix TAS handling during conn cleanup (Mike Christie)   
  - net/packet: convert po->auxdata to an atomic flag (Eric Dumazet)   
  - net/packet: convert po->origdev to an atomic flag (Eric Dumazet)   
  - vlan: partially enable SIOCSHWTSTAMP in container (Vadim Fedorenko)   
  - scm: fix MSG_CTRUNC setting condition for SO_PASSSEC (Alexander Mikhalitsyn)   
  - wifi: ath6kl: reduce WARN to dev_dbg() in callback (Fedor Pchelkin)   
  - wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() (Dan Carpenter)   
  - wifi: ath6kl: minor fix for allocation size (Alexey V. Vissarionov)   
  - arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step (Sumit Garg)   
  - x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() (Saurabh Sengar)   
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (Zheng Wang)   
  - x86/apic: Fix atomic update of offset in reserve_eilvt_offset() (Uros Bizjak)   
  - media: av7110: prevent underflow in write_ts_to_decoder() (Dan Carpenter)   
  - media: bdisp: Add missing check for create_workqueue (Jiasheng Jiang)   
  - drm/probe-helper: Cancel previous job before starting new one (Dom Cobley)   
  - drm/vgem: add missing mutex_destroy (Maíra Canal)   
  - drm/rockchip: Drop unbalanced obj unref (Rob Clark)   
  - selinux: ensure av_permissions.h is built when needed (Paul Moore)   
  - selinux: fix Makefile dependencies of flask.h (Ondrej Mosnacek)   
  - ubifs: Free memory for tmpfile name (Mårten Lindahl)   
  - ubi: Fix return value overwrite issue in try_write_vid_and_data() (Wang YanQing)   
  - i2c: omap: Fix standard mode false ACK readings (Reid Tonking)   
  - reiserfs: Add security prefix to xattr name in reiserfs_security_write() (Roberto Sassu)   
  - ring-buffer: Sync IRQ works before buffer destruction (Johannes Berg)   
  - MIPS: fw: Allow firmware to pass a empty env (Jiaxun Yang)   
  - staging: iio: resolver: ads1210: fix config mode (Nuno Sá)   
  - perf sched: Cast PTHREAD_STACK_MIN to int as it may turn into sysconf(__SC_THREAD_STACK_MIN_VALUE) (Arnaldo Carvalho de Melo)   
  - USB: dwc3: fix runtime pm imbalance on unbind (Johan Hovold)   
  - iio: adc: palmas_gpadc: fix NULL dereference on rmmod (Patrik Dahlström)   
  - USB: serial: option: add UNISOC vendor and TOZED LT70C product (Arınç ÜNAL)   
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ruihan Li)   
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (Jisoo Jang)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.529.3.el7uek]
changelog:
  - uek-rpm: Update kernel linux-firmware dependency to 20230516-999.26.git6c9e0ed5. (Somasundaram Krishnasamy)  [Orabug: 35724203]  
  - LTS version: v4.14.322 (Saeed Mirzamohammadi)   
  - drm/edid: fix objtool warning in drm_cvt_modes() (Linus Torvalds)   
  - mtd: rawnand: omap_elm: Fix incorrect type in assignment (Roger Quadros)   
  - test_firmware: fix a memory leak with reqs buffer (Mirsad Goran Todorovac)   
  - ext2: Drop fragment support (Jan Kara)   
  - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (Alan Stern)   
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Sungwoo Kim)   
  - fs/sysv: Null check to prevent null-ptr-deref bug (Prince Kumar Maurya)   
  - USB: zaurus: Add ID for A-300/B-500/C-700 (Ross Maynard)   
  - libceph: fix potential hang in ceph_osdc_notify() (Ilya Dryomov)   
  - loop: Select I/O scheduler 'none' from inside add_disk() (Bart Van Assche)   
  - tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_net (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_vals[] (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_lock (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_stamp (Eric Dumazet)   
  - tcp_metrics: fix addr_same() helper (Eric Dumazet)   
  - ip6mr: Fix skb_under_panic in ip6mr_cache_report() (Yue Haibing)   
  - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (valis)   
  - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (valis)   
  - net: add missing data-race annotation for sk_ll_usec (Eric Dumazet)   
  - net: add missing data-race annotations around sk->sk_peek_off (Eric Dumazet)   
  - perf test uprobe_from_different_cu: Skip if there is no gcc (Georg Müller)   
  - net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer() (Yuanjun Gong)   
  - word-at-a-time: use the same return type for has_zero regardless of endianness (ndesaulniers@google.com)   
  - perf: Fix function pointer case (Peter Zijlstra)   
  - net/sched: cls_u32: Fix reference counter leak leading to overflow (Lee Jones)   
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Pedro Tammela)   
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (M A Ramdhan)   
  - drm/client: Fix memory leak in drm_client_target_cloned (Jocelyn Falempe)   
  - dm cache policy smq: ensure IO doesn't prevent cleaner policy progress (Joe Thornber)   
  - ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register (Mark Brown)   
  - s390/dasd: fix hanging device after quiesce/resume (Stefan Haberland)   
  - irq-bcm6345-l1: Do not assume a fixed block to cpu mapping (Jonas Gorski)   
  - tpm_tis: Explicitly check for error code (Alexander Steffen)   
  - hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled (Gilles Buloz)   
  - staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() (Zhang Shurong)   
  - Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group (Greg Kroah-Hartman)   
  - usb: xhci-mtk: set the dma max_seg_size (Ricardo Ribalda)   
  - usb: ohci-at91: Fix the unhandle interrupt when resume (Guiting Shen)   
  - can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED (Marc Kleine-Budde)   
  - USB: serial: simple: sort driver entries (Johan Hovold)   
  - USB: serial: simple: add Kaufmann RKS+CAN VCP (Oliver Neukum)   
  - USB: serial: option: add Quectel EC200A module support (Mohsen Tahmasebi)   
  - USB: serial: option: support Quectel EM060K_128 (Jerry Meng)   
  - tracing: Fix warning in trace_buffered_event_disable() (Zheng Yejian)   
  - ring-buffer: Fix wrong stat of cpu_buffer->read (Zheng Yejian)   
  - ata: pata_ns87415: mark ns87560_tf_read static (Arnd Bergmann)   
  - dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (Yu Kuai)   
  - block: Fix a source code comment in include/uapi/linux/blkzoned.h (Bart Van Assche)   
  - ASoC: fsl_spdif: Silence output on stop (Matus Gajdos)   
  - benet: fix return value check in be_lancer_xmit_workarounds() (Yuanjun Gong)   
  - platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100 (Maxim Mikityanskiy)   
  - team: reset team's flags when down link is P2P device (Hangbin Liu)   
  - bonding: reset bond's flags when down link is P2P device (Hangbin Liu)   
  - tcp: Reduce chance of collisions in inet6_hashfn(). (Stewart Smith)   
  - ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address (Maciej Żenczykowski)   
  - ethernet: atheros: fix return value check in atl1e_tso_csum() (Yuanjun Gong)   
  - i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir() (Wang Ming)   
  - gpio: tps68470: Make tps68470_gpio_output() always set the initial value (Hans de Goede)   
  - tcp: annotate data-races around fastopenq.max_qlen (Eric Dumazet)   
  - tcp: annotate data-races around tp->notsent_lowat (Eric Dumazet)   
  - tcp: annotate data-races around rskq_defer_accept (Eric Dumazet)   
  - netfilter: nf_tables: fix spurious set element insertion failure (Florian Westphal)   
  - llc: Don't drop packet from non-root netns. (Kuniyuki Iwashima)   
  - fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe (Zhang Shurong)   
  - net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field() (Tanmay Patil)   
  - pinctrl: amd: Use amd_pinconf_set() for all config options (Mario Limonciello)   
  - fbdev: imxfb: warn about invalid left/right margin (Martin Kaiser)   
  - spi: bcm63xx: fix max prepend length (Jonas Gorski)   
  - igb: Fix igb_down hung on surprise removal (Ying Hsu)   
  - wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() (Gustavo A. R. Silva)   
  - bpf: Address KCSAN report on bpf_lru_list (Martin KaFai Lau)   
  - sched/fair: Don't balance task to its current running CPU (Yicong Yang)   
  - posix-timers: Ensure timer ID search-loop limit is valid (Saeed Mirzamohammadi)   
  - md/raid10: prevent soft lockup while flush writes (Yu Kuai)   
  - md: fix data corruption for raid456 when reshape restart while grow up (Yu Kuai)   
  - nbd: Add the maximum limit of allocated index in nbd_dev_add (Zhong Jinghua)   
  - debugobjects: Recheck debug_objects_enabled before reporting (Tetsuo Handa)   
  - ext4: correct inline offset when handling xattrs in inode body (Eric Whitney)   
  - can: bcm: Fix UAF in bcm_proc_show() (YueHaibing)   
  - fuse: revalidate: don't invalidate if interrupted (Miklos Szeredi)   
  - perf probe: Add test for regression introduced by switch to die_get_decl_file() (Georg Müller)   
  - serial: atmel: don't enable IRQs prematurely (Dan Carpenter)   
  - scsi: qla2xxx: Pointer may be dereferenced (Shreyas Deodhar)   
  - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() (Nilesh Javali)   
  - scsi: qla2xxx: Fix potential NULL pointer dereference (Bikash Hazarika)   
  - scsi: qla2xxx: Wait for io return on terminate rport (Quinn Tran)   
  - xtensa: ISS: fix call to split_if_spec (Max Filippov)   
  - ring-buffer: Fix deadloop issue on reading trace_pipe (Zheng Yejian)   
  - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk (Christophe JAILLET)   
  - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error (Christophe JAILLET)   
  - Revert "8250: add support for ASIX devices with a FIFO bug" (Jiaqing Zhao)   
  - meson saradc: fix clock divider mask length (George Stark)   
  - hwrng: imx-rngc - fix the timeout for init and self check (Martin Kaiser)   
  - fs: dlm: return positive pid value for F_GETLK (Alexander Aring)   
  - md/raid0: add discard support for the 'original' layout (Jason Baron)   
  - misc: pci_endpoint_test: Re-init completion for every test (Damien Le Moal)   
  - PCI: Add function 1 DMA alias quirk for Marvell 88SE9235 (Robin Murphy)   
  - jfs: jfs_dmap: Validate db_l2nbperpage while mounting (Siddh Raman Pant)   
  - ext4: only update i_reserved_data_blocks on successful block allocation (Baokun Li)   
  - ext4: fix wrong unit use in ext4_mb_clear_bb (Kemeng Shi)   
  - perf intel-pt: Fix CYC timestamps after standalone CBR (Adrian Hunter)   
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (Ding Hui)   
  - tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation (Jarkko Sakkinen)   
  - net/sched: make psched_mtu() RTNL-less safe (Pedro Tammela)   
  - wifi: airo: avoid uninitialized warning in airo_get_rate() (Randy Dunlap)   
  - ipv6/addrconf: fix a potential refcount underflow for idev (Ziyang Xuan)   
  - NTB: ntb_transport: fix possible memory leak while device_register() fails (Yang Yingliang)   
  - ntb: intel: Fix error handling in intel_ntb_pci_driver_init() (Yuan Can)   
  - NTB: amd: Fix error handling in amd_ntb_pci_driver_init() (Yuan Can)   
  - ntb: idt: Fix error handling in idt_pci_driver_init() (Yuan Can)   
  - udp6: fix udp6_ehashfn() typo (Eric Dumazet)   
  - net: mvneta: fix txq_map in case of txq_number==1 (Klaus Kudielka)   
  - workqueue: clean up WORK_* constant types, clarify masking (Linus Torvalds)   
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Thadeu Lima de Souza Cascardo)   
  - netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (Florent Revest)   
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Pablo Neira Ayuso)   
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Pablo Neira Ayuso)   
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (Pablo Neira Ayuso)   
  - spi: spi-fsl-spi: allow changing bits_per_word while CS is still active (Rasmus Villemoes)   
  - spi: spi-fsl-spi: relax message sanity checking a little (Rasmus Villemoes)   
  - spi: spi-fsl-spi: remove always-true conditional in fsl_spi_do_one_msg (Rasmus Villemoes)   
  - ARM: orion5x: fix d2net gpio initialization (Arnd Bergmann)   
  - btrfs: fix race when deleting quota root from the dirty cow roots list (Filipe Manana)   
  - jffs2: reduce stack usage in jffs2_build_xattr_subsystem() (Fabian Frederick)   
  - integrity: Fix possible multiple allocation in integrity_inode_get() (Tianjia Zhang)   
  - mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M (Robert Marko)   
  - mmc: core: disable TRIM on Kingston EMMC04G-M627 (Robert Marko)   
  - NFSD: add encoding of op_recall flag for write delegation (Dai Ngo)   
  - sh: dma: Fix DMA channel offset calculation (Artur Rojek)   
  - net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX (Lin Ma)   
  - tcp: annotate data races in __tcp_oow_rate_limited() (Eric Dumazet)   
  - net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode (Vladimir Oltean)   
  - powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y (Randy Dunlap)   
  - mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 (Nishanth Menon)   
  - spi: bcm-qspi: return error if neither hif_mspi nor mspi is available (Jonas Gorski)   
  - Add MODULE_FIRMWARE() for FIRMWARE_TG357766. (Tobias Heider)   
  - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (Chengfeng Ye)   
  - rtc: st-lpc: Release some resources in st_rtc_probe() in case of error (Christophe JAILLET)   
  - mfd: stmpe: Only disable the regulators if they are enabled (Christophe JAILLET)   
  - mfd: intel-lpss: Add missing check for platform_get_resource (Jiasheng Jiang)   
  - mfd: rt5033: Drop rt5033-battery sub-device (Stephan Gerhold)   
  - usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() (Li Yang)   
  - extcon: Fix kernel doc of property capability fields to avoid warnings (Andy Shevchenko)   
  - extcon: Fix kernel doc of property fields to avoid warnings (Andy Shevchenko)   
  - media: usb: siano: Fix warning due to null work_func_t function pointer (Duoming Zhou)   
  - media: videodev2.h: Fix struct v4l2_input tuner index comment (Marek Vasut)   
  - media: usb: Check az6007_read() return value (Daniil Dulov)   
  - sh: j2: Use ioremap() to translate device tree address into kernel memory (John Paul Adrian Glaubitz)   
  - w1: fix loop in w1_fini() (Dan Carpenter)   
  - block: change all __u32 annotations to __be32 in affs_hardblocks.h (Michael Schmitz)   
  - USB: serial: option: add LARA-R6 01B PIDs (Davide Tronchin)   
  - modpost: fix off by one in is_executable_section() (Dan Carpenter)   
  - modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} (Masahiro Yamada)   
  - modpost: fix section mismatch message for R_ARM_ABS32 (Masahiro Yamada)   
  - crypto: nx - fix build warnings when DEBUG_FS is not enabled (Randy Dunlap)   
  - pinctrl: at91-pio4: check return value of devm_kasprintf() (Claudiu Beznea)   
  - perf dwarf-aux: Fix off-by-one in die_get_varname() (Namhyung Kim)   
  - pinctrl: cherryview: Return correct value if pin in push-pull mode (Andy Shevchenko)   
  - PCI: Add pci_clear_master() stub for non-CONFIG_PCI (Sui Jingfeng)   
  - scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() (Yuchen Yang)   
  - ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer (Su Hui)   
  - drm/radeon: fix possible division-by-zero errors (Nikita Zhandarovich)   
  - fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() (Christophe JAILLET)   
  - soc/fsl/qe: fix usb.c build errors (Randy Dunlap)   
  - ASoC: es8316: Increment max value for ALC Capture Target Volume control (Cristian Ciocaltea)   
  - ARM: ep93xx: fix missing-prototype warnings (Arnd Bergmann)   
  - drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H (Dario Binacchi)   
  - Input: adxl34x - do not hardcode interrupt trigger type (Marek Vasut)   
  - ARM: dts: BCM5301X: Drop "clock-names" from the SPI node (Rafał Miłecki)   
  - Input: drv260x - sleep between polling GO bit (Luca Weiss)   
  - radeon: avoid double free in ci_dpm_init() (Nikita Zhandarovich)   
  - netlink: Add __sock_i_ino() for __netlink_diag_dump(). (Kuniyuki Iwashima)   
  - netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. (Ilia.Gavrilov)   
  - lib/ts_bm: reset initial match offset for every block of text (Jeremy Sowden)   
  - gtp: Fix use-after-free in __gtp_encap_destroy(). (Kuniyuki Iwashima)   
  - netlink: do not hard code device address lenth in fdb dumps (Eric Dumazet)   
  - netlink: fix potential deadlock in netlink_set_err() (Eric Dumazet)   
  - wifi: ath9k: convert msecs to jiffies where needed (Dmitry Antipov)   
  - wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() (Remi Pommarel)   
  - memstick r592: make memstick_debug_get_tpc_name() static (Arnd Bergmann)   
  - kexec: fix a memory leak in crash_shrink_memory() (Zhen Lei)   
  - watchdog/perf: more properly prevent false positives with turbo modes (Douglas Anderson)   
  - watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config (Douglas Anderson)   
  - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (Fedor Pchelkin)   
  - wifi: ray_cs: Fix an error handling path in ray_probe() (Christophe JAILLET)   
  - wifi: wl3501_cs: Fix an error handling path in wl3501_probe() (Christophe JAILLET)   
  - wifi: atmel: Fix an error handling path in atmel_probe() (Christophe JAILLET)   
  - wifi: orinoco: Fix an error handling path in orinoco_cs_probe() (Christophe JAILLET)   
  - wifi: orinoco: Fix an error handling path in spectrum_cs_probe() (Christophe JAILLET)   
  - wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx (Fedor Pchelkin)   
  - wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation (Peter Seiderer)   
  - evm: Complete description of evm_inode_setattr() (Roberto Sassu)   
  - PM: domains: fix integer overflow issues in genpd_parse_state() (Nikita Zhandarovich)   
  - md/raid10: fix io loss while replacement replace rdev (Li Nan)   
  - md/raid10: fix wrong setting of max_corr_read_errors (Li Nan)   
  - md/raid10: fix overflow of md/safe_mode_delay (Li Nan)   
  - treewide: Remove uninitialized_var() usage (Kees Cook)   
  - drm/amdgpu: Validate VM ioctl flags. (Bas Nieuwenhuizen)   
  - scripts/tags.sh: Resolve gtags empty index generation (Ahmed S. Darwish)   
  - drm/edid: Fix uninitialized variable in drm_cvt_modes() (Lyude Paul)   
  - fbdev: imsttfb: Fix use after free bug in imsttfb_probe (Zheng Wang)   
  - x86/smp: Use dedicated cache-line for mwait_play_dead() (Thomas Gleixner)   
  - x86/microcode/AMD: Load late on both threads too (Borislav Petkov (AMD))   
  - gfs2: Don't deref jdesc in evict (Bob Peterson)   
  - LTS version: v4.14.321 (Saeed Mirzamohammadi)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.1.el7uek]
changelog:
  - rds: Remove gratuitous include of time.h from rds.h (Mark Haywood)  [Orabug: 35742762]  
  - smp: Reduce NMI traffic from CSD waiters to CSD destination (Imran Khan)  [Orabug: 35236407]  
  - smp: Reduce logging due to dump_stack of CSD waiters (Imran Khan)  [Orabug: 35236407]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.2.el7uek]
changelog:
  - LTS version: v4.14.325 (Saeed Mirzamohammadi)   
  - Revert "ARM: ep93xx: fix missing-prototype warnings" (Greg Kroah-Hartman)   
  - Revert "MIPS: Alchemy: fix dbdma2" (Greg Kroah-Hartman)   
  - LTS version: v4.14.324 (Saeed Mirzamohammadi)   
  - dma-buf/sw_sync: Avoid recursive lock during fence signal (Rob Clark)   
  - scsi: core: raid_class: Remove raid_component_add() (Zhu Wang)   
  - scsi: snic: Fix double free in snic_tgt_create() (Zhu Wang)   
  - rtnetlink: Reject negative ifindexes in RTM_NEWLINK (Ido Schimmel)   
  - x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 (Feng Tang)   
  - media: vcodec: Fix potential array out-of-bounds in encoder queue_setup (Wei Chen)   
  - lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels (Helge Deller)   
  - batman-adv: Fix batadv_v_ogm_aggr_send memory leak (Remi Pommarel)   
  - batman-adv: Fix TT global entry leak when client roamed back (Remi Pommarel)   
  - batman-adv: Do not get eth header before batadv_check_management_packet (Remi Pommarel)   
  - batman-adv: Trigger events for auto adjusted MTU (Sven Eckelmann)   
  - ibmveth: Use dcbf rather than dcbfl (Michael Ellerman)   
  - ipvs: fix racy memcpy in proc_do_sync_threshold (Sishuai Gong)   
  - ipvs: Improve robustness to the ipvs sysctl (Junwei Hu)   
  - igb: Avoid starting unnecessary workqueues (Alessio Igor Bogani)   
  - sock: annotate data-races around prot->memory_pressure (Eric Dumazet)   
  - tracing: Fix memleak due to race between current_tracer and trace (Zheng Yejian)   
  - net: phy: broadcom: stub c45 read/write for 54810 (Justin Chen)   
  - net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure (Lin Ma)   
  - net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled (Jason Xing)   
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Kuniyuki Iwashima)   
  - ASoC: rt5665: add missed regulator_bulk_disable (Zhang Shurong)   
  - netfilter: set default timeout to 3 secs for sctp shutdown send and recv state (Xin Long)   
  - test_firmware: prevent race conditions by a correct implementation of locking (Mirsad Goran Todorovac)   
  - binder: fix memory leak in binder_init() (Qi Zheng)   
  - serial: 8250: Fix oops for port->pm on uart_change_pm() (Tony Lindgren)   
  - mmc: wbsd: fix double mmc_free_host() in wbsd_init() (Yang Yingliang)   
  - cifs: Release folio lock on fscache read hit. (Russell Harmon via samba-technical)   
  - ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. (dengxiang)   
  - net: do not allow gso_size to be set to GSO_BY_FRAGS (Eric Dumazet)   
  - sock: Fix misuse of sk_under_memory_pressure() (Abel Wu)   
  - i40e: fix misleading debug logs (Andrii Staikov)   
  - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan)   
  - netfilter: nft_dynset: disallow object maps (Pablo Neira Ayuso)   
  - xfrm: add NULL check in xfrm_update_ae_params (Lin Ma)   
  - ip_vti: fix potential slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - ip6_vti: fix slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - net: af_key: fix sadb_x_filter validation (Lin Ma)   
  - net: xfrm: Fix xfrm_address_filter OOB read (Lin Ma)   
  - fbdev: mmp: fix value check in mmphw_probe() (Yuanjun Gong)   
  - drm/amdgpu: Fix potential fence use-after-free v2 (shanzhulig)   
  - Bluetooth: L2CAP: Fix use-after-free (Zhengping Jiang)   
  - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() (Armin Wolf)   
  - gfs2: Fix possible data races in gfs2_show_options() (Tuo Li)   
  - media: platform: mediatek: vpu: fix NULL ptr dereference (Hans Verkuil)   
  - media: v4l2-mem2mem: add lock to protect parameter num_rdy (Yunfei Dong)   
  - FS: JFS: Check for read-only mounted filesystem in txBegin (Immad Mir)   
  - FS: JFS: Fix null-ptr-deref Read in txBegin (Immad Mir)   
  - MIPS: dec: prom: Address -Warray-bounds warning (Gustavo A. R. Silva)   
  - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (Yogesh)   
  - udf: Fix uninitialized array access for some pathnames (Jan Kara)   
  - quota: fix warning in dqgrab() (Ye Bin)   
  - quota: Properly disable quotas when add_dquot_ref() fails (Jan Kara)   
  - ALSA: emu10k1: roll up loops in DSP setup code for Audigy (Oswald Buddenhagen)   
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init (hackyzh002)   
  - lib/mpi: Eliminate unused umul_ppmm definitions for MIPS (Nathan Chancellor)   
  - LTS version: v4.14.323 (Saeed Mirzamohammadi)   
  - alpha: remove __init annotation from exported page_is_ram() (Masahiro Yamada)   
  - scsi: core: Fix possible memory leak if device_add() fails (Zhu Wang)   
  - scsi: snic: Fix possible memory leak if device_add() fails (Zhu Wang)   
  - scsi: 53c700: Check that command slot is not NULL (Alexandra Diupina)   
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Michael Kelley)   
  - scsi: core: Fix legacy /proc parsing buffer overflow (Tony Battersby)   
  - netfilter: nf_tables: report use refcount overflow (Pablo Neira Ayuso)   
  - btrfs: don't stop integrity writeback too early (Christoph Hellwig)   
  - IB/hfi1: Fix possible panic during hotplug remove (Douglas Miller)   
  - drivers: net: prevent tun_build_skb() to exceed the packet size limit (Andrew Kanner)   
  - dccp: fix data-race around dp->dccps_mss_cache (Eric Dumazet)   
  - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan)   
  - net/packet: annotate data-races around tp->status (Eric Dumazet)   
  - drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes (Karol Herbst)   
  - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Kirill A. Shutemov)   
  - usb: dwc3: Properly handle processing of pending events (Elson Roy Serrao)   
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Alan Stern)   
  - iio: cros_ec: Fix the allocation size for cros_ec_command (Yiyuan Guo)   
  - test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation (Mirsad Goran Todorovac)   
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (Ryusuke Konishi)   
  - radix tree test suite: fix incorrect allocation size for pthreads (Colin Ian King)   
  - dmaengine: pl330: Return DMA_PAUSED when transaction is paused (Ilpo Järvinen)   
  - ipv6: adjust ndisc_is_useropt() to also return true for PIO (Maciej Żenczykowski)   
  - mmc: moxart: read scr register without changing byte order (Sergei Antonov)   
  - sparc: fix up arch_cpu_finalize_init() build breakage. (Greg Kroah-Hartman)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.3.el7uek]
changelog:
  - Add the new PCI Device IDs to support new generation of AMD 19h processors. (Partha Sarathi Satapathy)  [Orabug: 35773822]  
  - hwmon: (k10temp) Add support for AMD Family 19h Models 10h-1Fh and A0h-AFh (Babu Moger)  [Orabug: 35773822]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.4.el7uek]
changelog:
  - rds: Fix lack of reentrancy for connection reset with dst addr zero (Håkon Bugge)  [Orabug: 35819110]  {CVE-2023-22024} 
  - kernfs: fix missing kernfs_iattr_rwsem locking (Ian Kent)  [Orabug: 35796772]  
  - uek-rpm: Removing pre scriptlet to not allow firmware downgrade (Samasth Norway Ananda)  [Orabug: 35756463]  
  - scsi: megaraid_sas: Fix deadlock on firmware crashdump (Junxiao Bi)  [Orabug: 35702793]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.5.el7uek]
changelog:
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng)  [Orabug: 35824288]  {CVE-2023-42753} 
  - netfilter: xt_u32: validate user space input (Wander Lairson Costa)   
  - netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.531.1.el7uek]
changelog:
  - ocfs2: ocfs2 crash due to invalid h_next_leaf_blk value in extent block (Gautham Ananthakrishna)  [Orabug: 35859332]  
  - bnxt_en: fix NULL dereference in bnxt_flash_package_from_file() (Samasth Norway Ananda)  [Orabug: 35848949]  
  - LTS version: v4.14.326 (Saeed Mirzamohammadi)   
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (valis)   
  - mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write (William Zhang)   
  - mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller (William Zhang)   
  - mtd: rawnand: brcmnand: Fix potential false time out warning (William Zhang)   
  - mtd: rawnand: brcmnand: Fix crash during the panic_write (William Zhang)   
  - nfsd: fix change_info in NFSv4 RENAME replies (Jeff Layton)   
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (Filipe Manana)   
  - attr: block mode changes of symlinks (Christian Brauner)   
  - md/raid1: fix error: ISO C90 forbids mixed declarations (Nigel Croxon)   
  - kobject: Add sanity check for kset->kobj.ktype in kset_register() (Zhen Lei)   
  - serial: cpm_uart: Avoid suspicious locking (Christophe Leroy)   
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (Konstantin Shelekhin)   
  - usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc (Ma Ke)   
  - media: pci: cx23885: replace BUG with error return (Hans Verkuil)   
  - media: tuners: qt1010: replace BUG_ON with a regular error (Hans Verkuil)   
  - iio: core: Use min() instead of min_t() to make code more robust (Andy Shevchenko)   
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (Zhang Shurong)   
  - media: anysee: fix null-ptr-deref in anysee_master_xfer (Zhang Shurong)   
  - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer (Zhang Shurong)   
  - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() (Zhang Shurong)   
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer (Zhang Shurong)   
  - powerpc/pseries: fix possible memory leak in ibmebus_bus_init() (ruanjinjie)   
  - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (Liu Shixin via Jfs-discussion)   
  - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (Andrew Kanner)   
  - ext2: fix datatype of block number in ext2_xattr_set2() (Georg Ottinger)   
  - md: raid1: fix potential OOB in raid1_remove_disk() (Zhang Shurong)   
  - drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable() (Tuo Li)   
  - alx: fix OOB-read compiler warning (GONG, Ruiqi)   
  - tpm_tis: Resend command to recover from data transfer errors (Alexander Steffen)   
  - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (Mark O'Donovan)   
  - wifi: mwifiex: fix fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix printk specifier (Dongliang Mu)   
  - hw_breakpoint: fix single-stepping when using bpf_overflow_handler (Tomislav Novak)   
  - ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 (Jiri Slaby (SUSE))   
  - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (Abhishek Mainkar)   
  - btrfs: output extra debug info if we failed to find an inline backref (Qu Wenruo)   
  - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Fedor Pchelkin)   
  - parisc: Drop loops_per_jiffy from per_cpu struct (Helge Deller)   
  - kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). (Kuniyuki Iwashima)   
  - ixgbe: fix timestamp configuration code (Vadim Fedorenko)   
  - kcm: Fix memory leak in error path of kcm_sendmsg() (Shigeru Yoshida)   
  - net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() (Hangyu Hua)   
  - ata: pata_ftide010: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - ata: sata_gemini: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - igb: Change IGB_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - kcm: Destroy mutex in kcm_exit_net() (Shigeru Yoshida)   
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis)   
  - af_unix: Fix data race around sk->sk_err. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around sk->sk_shutdown. (Kuniyuki Iwashima)   
  - af_unix: Fix data-race around unix_tot_inflight. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around user->unix_inflight. (Kuniyuki Iwashima)   
  - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr (Alex Henrie)   
  - igb: disable virtualization features on 82580 (Corinna Vinschen)   
  - net: read sk->sk_family once in sk_mc_loop() (Eric Dumazet)   
  - pwm: lpc32xx: Remove handling of PWM channels (Vladimir Zapolskiy)   
  - watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load (Raag Jadav)   
  - x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() (Sean Christopherson)   
  - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info (Fedor Pchelkin)   
  - clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock (Dmitry Baryshkov)   
  - parisc: led: Reduce CPU overhead for disk & lan LED computation (Helge Deller)   
  - parisc: led: Fix LAN receive and transmit LEDs (Helge Deller)   
  - drm/ast: Fix DRAM init on AST2200 (Thomas Zimmermann)   
  - fbdev/ep93xx-fb: Do not assign to struct fb_info.dev (Thomas Zimmermann)   
  - scsi: qla2xxx: Turn off noisy message log (Quinn Tran)   
  - scsi: qla2xxx: fix inconsistent TMF timeout (Quinn Tran)   
  - crypto: stm32 - fix loop iterating through scatterlist for DMA (Thomas Bourgoin)   
  - pstore/ram: Check start of empty przs during init (Enlin Mu)   
  - net: handle ARPHRD_PPP in dev_is_mac_header_xmit() (Nicolas Dichtel)   
  - X.509: if signature is unsupported skip validation (Thore Sommer)   
  - dccp: Fix out of bounds access in DCCP error handler (Jann Horn)   
  - parisc: Fix /proc/cpuinfo output for lscpu (Helge Deller)   
  - procfs: block chmod on /proc/thread-self/comm (Aleksa Sarai)   
  - Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" (Bjorn Helgaas)   
  - ntb: Fix calculation ntb_transport_tx_free_entry() (Dave Jiang)   
  - ntb: Clean up tx tail index on link down (Dave Jiang)   
  - ntb: Drop packets when qp link is down (Dave Jiang)   
  - media: dvb: symbol fixup for dvb_attach() (Greg Kroah-Hartman)   
  - backlight/lv5207lp: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/bd6107: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/gpio_backlight: Compare against struct fb_info.device (Thomas Zimmermann)   
  - ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() (Gustavo A. R. Silva)   
  - ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (Takashi Iwai)   
  - PM / devfreq: Fix leak in devfreq_dev_release() (Boris Brezillon)   
  - igb: set max size RX buffer when store bad packet is enabled (Radoslaw Tyl)   
  - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU (Eric Dumazet)   
  - dmaengine: ste_dma40: Add missing IRQ check in d40_probe (ruanjinjie)   
  - rpmsg: glink: Add check for kstrdup (Jiasheng Jiang)   
  - HID: multitouch: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu)   
  - Revert "IB/isert: Fix incorrect release of isert connection" (Leon Romanovsky)   
  - amba: bus: fix refcount leak (Peng Fan)   
  - serial: tegra: handle clk prepare error in tegra_uart_hw_init() (Yi Yang)   
  - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (Chengfeng Ye)   
  - scsi: core: Use 32-bit hostnum in scsi_host_lookup() (Tony Battersby)   
  - cgroup:namespace: Remove unused cgroup_namespaces_init() (Lu Jialin)   
  - USB: gadget: f_mass_storage: Fix unused variable warning (Alan Stern)   
  - media: go7007: Remove redundant if statement (Colin Ian King)   
  - dma-buf/sync_file: Fix docs syntax (Rob Clark)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (Oleksandr Natalenko)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (Oleksandr Natalenko)   
  - x86/APM: drop the duplicate APM_MINOR_DEV macro (Randy Dunlap)   
  - scsi: qla4xxx: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: be2iscsi: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() (Lin Ma)   
  - usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() (Xu Yang)   
  - media: mediatek: vcodec: Return NULL if no vdec_fb is found (Irui Wang)   
  - media: cx24120: Add retval check for cx24120_message_send() (Daniil Dulov)   
  - media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() (Christophe JAILLET)   
  - media: dib7000p: Fix potential division by zero (Daniil Dulov)   
  - drivers: usb: smsusb: fix error handling code in smsusb_init_device (Dongliang Mu)   
  - NFSD: da_addr_body field missing in some GETDEVICEINFO replies (Chuck Lever)   
  - fs: lockd: avoid possible wrong NULL parameter (Su Hui)   
  - jfs: validate max amount of blocks before allocation. (Alexei Filippov)   
  - powerpc/iommu: Fix notifiers being shared by PCI and VIO buses (Russell Currey)   
  - nfs/blocklayout: Use the passed in gfp flags (Dan Carpenter)   
  - wifi: ath10k: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: pciehp: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: Mark NVIDIA T4 GPUs to avoid bus reset (Wu Zongyong)   
  - clk: sunxi-ng: Modify mismatched function name (Zhang Jianhua)   
  - drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() (Minjie Du)   
  - ALSA: ac97: Fix possible error value of *rac97 (Su Hui)   
  - audit: fix possible soft lockup in __audit_inode_child() (Gaosheng Cui)   
  - smackfs: Prevent underflow in smk_set_cipso() (Dan Carpenter)   
  - of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() (Ruan Jinjie)   
  - drm: adv7511: Fix low refresh rate register for ADV7533/5 (Bogdan Togorean)   
  - ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: BCM53573: Add cells sizes to PCIe node (Rafał Miłecki)   
  - netrom: Deny concurrent connect(). (Kuniyuki Iwashima)   
  - net: arcnet: Do not call kfree_skb() under local_irq_disable() (Jinjie Ruan)   
  - wifi: ath9k: use IS_ERR() with debugfs_create_dir() (Wang Ming)   
  - wifi: mwifiex: avoid possible NULL skb pointer dereference (Dmitry Antipov)   
  - wifi: ath9k: protect WMI command response buffer replacement with a lock (Fedor Pchelkin)   
  - wifi: mwifiex: Fix missed return in oob checks failed path (Polaris Pi)   
  - wifi: mwifiex: fix memory leak in mwifiex_histogram_read() (Dmitry Antipov)   
  - fs: ocfs2: namei: check return value of ocfs2_add_entry() (Artem Chernyshev)   
  - lwt: Check LWTUNNEL_XMIT_CONTINUE strictly (Yan Zhai)   
  - crypto: caam - fix unchecked return value error (Gaurav Jain)   
  - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Menglong Dong)   
  - Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (Yuanjun Gong)   
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Polaris Pi)   
  - can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM (Marc Kleine-Budde)   
  - spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() (Zhang Shurong)   
  - regmap: rbtree: Use alloc_flags for memory allocations (Dan Carpenter)   
  - cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() (Liao Chang)   
  - fs: Fix error checking for d_hash_and_lookup() (Wang Ming)   
  - reiserfs: Check the return value from __getblk() (Matthew Wilcox)   
  - Revert "net: macsec: preserve ingress frame ordering" (Sabrina Dubroca)   
  - udf: Handle error when adding extent to a file (Jan Kara)   
  - udf: Check consistency of Space Bitmap Descriptor (Vladislav Efanov)   
  - powerpc/32s: Fix assembler warning about r0 (Christophe Leroy)   
  - powerpc/32: Include .branch_lt in data section (Joel Stanley)   
  - ALSA: seq: oss: Fix racy open/close of MIDI devices (Takashi Iwai)   
  - cifs: add a warning when the in-flight count goes negative (Shyam Prasad N)   
  - sctp: handle invalid error codes without calling BUG() (Dan Carpenter)   
  - bnx2x: fix page fault following EEH recovery (David Christensen)   
  - netlabel: fix shift wrapping bug in netlbl_catmap_setlong() (Dmitry Mastykin)   
  - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock (Chengfeng Ye)   
  - idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM (Baoquan He)   
  - net: usb: qmi_wwan: add Quectel EM05GV2 (Martin Kohn)   
  - security: keys: perform capable check only on privileged operations (Christian Göttsche)   
  - ASoc: codecs: ES8316: Fix DMIC config (Edgar)   
  - fs/nls: make load_nls() take a const parameter (Saeed Mirzamohammadi)   
  - s390/dasd: use correct number of retries for ERP requests (Stefan Haberland)   
  - m68k: Fix invalid .section syntax (Ben Hutchings)   
  - ethernet: atheros: fix return value check in atl1c_tso_csum() (Yuanjun Gong)   
  - ASoC: da7219: Flush pending AAD IRQ when suspending (Dmytro Maluka)   
  - 9p: virtio: make sure 'offs' is initialized in zc_request (Dominique Martinet)   
  - lib/ubsan: remove returns-nonnull-attribute checks (Andrey Ryabinin)   
  - pinctrl: amd: Don't show `Invalid config param` errors (Mario Limonciello)   
  - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (Ryusuke Konishi)   
  - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() (Ryusuke Konishi)   
  - serial: sc16is7xx: fix bug when first setting GPIO direction (Hugo Villeneuve)   
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (Zheng Wang)   
  - HID: wacom: remove the battery when the EKR is off (Aaron Armstrong Skomra)   
  - USB: serial: option: add FOXCONN T99W368/T99W373 product (Slark Xiao)   
  - USB: serial: option: add Quectel EM05G variant (0x030e) (Martin Kohn)   
  - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules (Christoph Hellwig)   
  - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff (Christoph Hellwig)   
  - mmc: au1xmmc: force non-modular build and remove symbol_get usage (Christoph Hellwig)   
  - ARM: pxa: remove use of symbol_get() (Arnd Bergmann)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.531.2.el7uek]
changelog:
  - rtnetlink: Reject negative ifindexes in RTM_NEWLINK (Ido Schimmel)  [Orabug: 35867429]  
  - Revert "rtnetlink: Reject negative ifindexes in RTM_NEWLINK" (Boris Ostrovsky)  [Orabug: 35867429]  
  - rds: Add proper refcnt when an RDS MR references an RDS Socket (Håkon Bugge)  [Orabug: 35836950]  
  - rds: Check for UAF in rds_destroy_mr (Håkon Bugge)  [Orabug: 35836950]  
  - xfs: reserve less log space when recovering log intent items (Darrick J. Wong)  [Orabug: 35587163]  
  - xfs: reserve blocks for refcount / rmap log item recovery (Darrick J. Wong)  [Orabug: 35587163]  
  - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Pin-yen Lin)   
  - dccp: fix dccp_v4_err()/dccp_v6_err() again (Eric Dumazet)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.1.el7uek]
changelog:
  - rds/ib: Preserve dest qp num in the connect request (Arumugam Kolappan)  [Orabug: 35649849]  
  - rds: Provision to allow all trace points at module load time (Arumugam Kolappan)  [Orabug: 35355776]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.2.el7uek]
changelog:
  - x86: change default to spec_store_bypass_disable=prctl spectre_v2_user=prctl (Andrea Arcangeli)  [Orabug: 35905888]  
  - LTS version: 4.14.328 (Saeed Mirzamohammadi)   
  - Bluetooth: hci_event: Fix using memcmp when comparing keys (Luiz Augusto von Dentz)   
  - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (Kees Cook)   
  - Bluetooth: hci_sock: fix slab oob read in create_monitor_event (Edward AD)   
  - gpio: vf610: set value before the direction to avoid a glitch (Haibo Chen)   
  - s390/pci: fix iommu bitmap allocation (Niklas Schnelle)   
  - perf: Disallow mis-matched inherited group reads (Saeed Mirzamohammadi)   
  - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (Puliang Lu)   
  - USB: serial: option: add entry for Sierra EM9191 with new firmware (Benoît Monin)   
  - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (Fabio Porcedda)   
  - ACPI: irq: Fix incorrect return value in acpi_register_gsi() (Sunil V L)   
  - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" (Andy Shevchenko)   
  - mmc: core: Capture correct oemid-bits for eMMC cards (Avri Altman)   
  - sky2: Make sure there is at least one frag_addr available (Kees Cook)   
  - wifi: cfg80211: avoid leaking stack data into trace (Benjamin Berg)   
  - wifi: mac80211: allow transmitting EAPOL frames with tainted key (Wen Gong)   
  - Bluetooth: hci_core: Fix build warnings (Luiz Augusto von Dentz)   
  - Bluetooth: Avoid redundant authentication (Ying Hsu)   
  - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (Ma Ke)   
  - tracing: relax trace_event_eval_update() execution with cond_resched() (Clément Léger)   
  - ata: libata-eh: Fix compilation warning in ata_eh_link_report() (Damien Le Moal)   
  - gpio: timberdale: Fix potential deadlock on &tgpio->lock (Chengfeng Ye)   
  - overlayfs: set ctime when setting mtime and atime (Jeff Layton)   
  - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (Heiner Kallweit)   
  - btrfs: initialize start_slot in btrfs_log_prealloc_extents (Josef Bacik)   
  - ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone (Tony Lindgren)   
  - i40e: prevent crash on probe if hw registers have invalid values (Michal Schmidt)   
  - net: usb: smsc95xx: Fix an error code in smsc95xx_reset() (Dan Carpenter)   
  - net: rfkill: gpio: prevent value glitch during probe (Josua Mayer)   
  - net: ipv6: fix return value check in esp_remove_trailer (Ma Ke)   
  - net: ipv4: fix return value check in esp_remove_trailer (Ma Ke)   
  - xfrm: fix a data-race in xfrm_gen_index() (Saeed Mirzamohammadi)   
  - netfilter: nft_payload: fix wrong mac header matching (Florian Westphal)   
  - KVM: x86: Mask LVTPC when handling a PMI (Jim Mattson)   
  - regmap: fix NULL deref on lookup (Johan Hovold)   
  - nfc: nci: fix possible NULL pointer dereference in send_acknowledge() (Krzysztof Kozlowski)   
  - Bluetooth: avoid memcmp() out of bounds warning (Arnd Bergmann)   
  - Bluetooth: hci_event: Fix coding style (Luiz Augusto von Dentz)   
  - Bluetooth: vhci: Fix race when opening vhci device (Arkadiusz Bokowy)   
  - Bluetooth: Fix a refcnt underflow problem for hci_conn (Ziyang Xuan)   
  - Bluetooth: Reject connection with the device which has same BD_ADDR (Lee, Chun-Yi)   
  - Bluetooth: hci_event: Ignore NULL link key (Lee, Chun-Yi)   
  - usb: hub: Guard against accesses to uninitialized BOS descriptors (Ricardo Cañuelo)   
  - x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs (Borislav Petkov (AMD))   
  - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call (Krishna Kurapati)   
  - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio (Piyush Mehta)   
  - pinctrl: avoid unsafe code pattern in find_pinctrl() (Dmitry Torokhov)   
  - cgroup: Remove duplicates in cgroup v1 tasks file (Michal Koutný)   
  - Input: xpad - add PXN V900 support (Matthias Berndt)   
  - Input: powermate - fix use-after-free in powermate_config_complete (Javier Carrasco)   
  - ceph: fix incorrect revoked caps assert in ceph_fill_file_size() (Xiubo Li)   
  - mcb: remove is_added flag from mcb_device struct (Jorge Sanjuan Garcia)   
  - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug (Alexander Zangerl)   
  - iio: pressure: bmp280: Fix NULL pointer exception (Phil Elwell)   
  - usb: musb: Modify the "HWVers" register address (Xingxing Luo)   
  - usb: musb: Get the musb_qh poniter after musb_giveback (Xingxing Luo)   
  - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read (Javier Carrasco)   
  - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer (Wesley Cheng)   
  - workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() (Waiman Long)   
  - nfc: nci: assert requested protocol is valid (Jeremy Cline)   
  - ixgbe: fix crash with empty VF macvlan list (Dan Carpenter)   
  - drm/vmwgfx: fix typo of sizeof argument (Konstantin Meskhidze)   
  - ieee802154: ca8210: Fix a potential UAF in ca8210_probe (Dinghao Liu)   
  - drm: etvnaviv: fix bad backport leading to warning (Martin Fuzzey)   
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (Hans de Goede)   
  - RDMA/cxgb4: Check skb value for failure to allocate (Artem Chernyshev)   
  - LTS version: 4.14.327 (Saeed Mirzamohammadi)   
  - parisc: Restore __ldcw_align for PA-RISC 2.0 processors (John David Anglin)   
  - RDMA/mlx5: Fix NULL string error (Shay Drory)   
  - RDMA/cma: Fix truncation compilation warning in make_cma_ports (Leon Romanovsky)   
  - gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() (Bartosz Golaszewski)   
  - IB/mlx4: Fix the size of a buffer in add_port_entries() (Christophe JAILLET)   
  - cpupower: add Makefile dependencies for install targets (Ivan Babrou)   
  - sctp: update hb timer immediately after users change hb_interval (Xin Long)   
  - sctp: update transport state when processing a dupcook packet (Xin Long)   
  - tcp: fix delayed ACKs for MSS boundary condition (Neal Cardwell)   
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Shigeru Yoshida)   
  - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (David Howells)   
  - modpost: add missing else to the "of" check (Mauricio Faria de Oliveira)   
  - scsi: target: core: Fix deadlock due to recursive locking (Junxiao Bi)   
  - regmap: rbtree: Fix wrong register marked as in-cache when creating new node (Richard Fitzgerald)   
  - drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close() (Alexandra Diupina)   
  - ubi: Refuse attaching if mtd's erasesize is 0 (Zhihao Cheng)   
  - wifi: mwifiex: Fix tlv_buf_left calculation (Gustavo A. R. Silva)   
  - scsi: zfcp: Fix a double put in zfcp_port_enqueue() (Dinghao Liu)   
  - media: dvb: symbol fixup for dvb_attach() - again (Greg Kroah-Hartman)   
  - ata: libata: disallow dev-initiated LPM transitions to unsupported states (Niklas Cassel)   
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Budimir Markovic)   
  - ext4: fix rec_len verify error (Shida Zhang)   
  - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (George Kennedy)   
  - fs: binfmt_elf_efpic: fix personality for ELF-FDPIC (Greg Ungerer)   
  - ata: libata-sata: increase PMP SRST timeout to 10s (Matthias Schiffer)   
  - ata: libata-core: Fix port and device removal (Damien Le Moal)   
  - ata: libata-core: Fix ata_port_request_pm() locking (Damien Le Moal)   
  - btrfs: properly report 0 avail for very full file systems (Josef Bacik)   
  - i2c: i801: unregister tco_pdev in i801_probe() error path (Heiner Kallweit)   
  - ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES (Niklas Cassel)   
  - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() (Pan Bian)   
  - serial: 8250_port: Check IRQ data before use (Andy Shevchenko)   
  - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Mika Westerberg)   
  - watchdog: iTCO_wdt: No need to stop the timer in probe (Mika Westerberg)   
  - ata: libahci: clear pending interrupt status (Szuying Chen)   
  - ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones (Hannes Reinecke)   
  - fbdev/sh7760fb: Depend on FB=y (Thomas Zimmermann)   
  - ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset() (Niklas Cassel)   
  - ring-buffer: Avoid softlockup in ring_buffer_resize() (Zheng Yejian)   
  - selftests/ftrace: Correctly enable event in instance-event.tc (Zheng Yejian)   
  - parisc: irq: Make irq_stack_union static to avoid sparse warning (Helge Deller)   
  - parisc: iosapic.c: Fix sparse warnings (Helge Deller)   
  - parisc: sba: Fix compile warning wrt list of SBA devices (Helge Deller)   
  - xtensa: boot/lib: fix function prototypes (Max Filippov)   
  - xtensa: boot: don't add include-dirs (Randy Dunlap)   
  - clk: tegra: fix error return case for recalc_rate (Timo Alho)   
  - i2c: mux: demux-pinctrl: check the return value of devm_kstrdup() (Xiaoke Wang)   
  - gpio: tb10x: Fix an error handling path in tb10x_gpio_probe() (Christophe JAILLET)   
  - team: fix null-ptr-deref when team device type is changed (Ziyang Xuan)   
  - powerpc/perf/hv-24x7: Update domain value check (Kajol Jain)   
  - ipv4: fix null-deref in ipv4_link_failure (Kyle Zeng)   
  - NFS/pNFS: Report EINVAL errors from connect() to the server (Trond Myklebust)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.2.el7uek]
changelog:
  - LTS version: v4.14.325 (Saeed Mirzamohammadi)   
  - Revert "ARM: ep93xx: fix missing-prototype warnings" (Greg Kroah-Hartman)   
  - Revert "MIPS: Alchemy: fix dbdma2" (Greg Kroah-Hartman)   
  - LTS version: v4.14.324 (Saeed Mirzamohammadi)   
  - dma-buf/sw_sync: Avoid recursive lock during fence signal (Rob Clark)   
  - scsi: core: raid_class: Remove raid_component_add() (Zhu Wang)   
  - scsi: snic: Fix double free in snic_tgt_create() (Zhu Wang)   
  - rtnetlink: Reject negative ifindexes in RTM_NEWLINK (Ido Schimmel)   
  - x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 (Feng Tang)   
  - media: vcodec: Fix potential array out-of-bounds in encoder queue_setup (Wei Chen)   
  - lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels (Helge Deller)   
  - batman-adv: Fix batadv_v_ogm_aggr_send memory leak (Remi Pommarel)   
  - batman-adv: Fix TT global entry leak when client roamed back (Remi Pommarel)   
  - batman-adv: Do not get eth header before batadv_check_management_packet (Remi Pommarel)   
  - batman-adv: Trigger events for auto adjusted MTU (Sven Eckelmann)   
  - ibmveth: Use dcbf rather than dcbfl (Michael Ellerman)   
  - ipvs: fix racy memcpy in proc_do_sync_threshold (Sishuai Gong)   
  - ipvs: Improve robustness to the ipvs sysctl (Junwei Hu)   
  - igb: Avoid starting unnecessary workqueues (Alessio Igor Bogani)   
  - sock: annotate data-races around prot->memory_pressure (Eric Dumazet)   
  - tracing: Fix memleak due to race between current_tracer and trace (Zheng Yejian)   
  - net: phy: broadcom: stub c45 read/write for 54810 (Justin Chen)   
  - net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure (Lin Ma)   
  - net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled (Jason Xing)   
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Kuniyuki Iwashima) [Orabug: 35814409] {CVE-2023-4622}
  - ASoC: rt5665: add missed regulator_bulk_disable (Zhang Shurong)   
  - netfilter: set default timeout to 3 secs for sctp shutdown send and recv state (Xin Long)   
  - test_firmware: prevent race conditions by a correct implementation of locking (Mirsad Goran Todorovac)   
  - binder: fix memory leak in binder_init() (Qi Zheng)   
  - serial: 8250: Fix oops for port->pm on uart_change_pm() (Tony Lindgren)   
  - mmc: wbsd: fix double mmc_free_host() in wbsd_init() (Yang Yingliang)   
  - cifs: Release folio lock on fscache read hit. (Russell Harmon via samba-technical)   
  - ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. (dengxiang)   
  - net: do not allow gso_size to be set to GSO_BY_FRAGS (Eric Dumazet)   
  - sock: Fix misuse of sk_under_memory_pressure() (Abel Wu)   
  - i40e: fix misleading debug logs (Andrii Staikov)   
  - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan)   
  - netfilter: nft_dynset: disallow object maps (Pablo Neira Ayuso)   
  - xfrm: add NULL check in xfrm_update_ae_params (Lin Ma) [Orabug: 35754508] {CVE-2023-3772}
  - ip_vti: fix potential slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - ip6_vti: fix slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - net: af_key: fix sadb_x_filter validation (Lin Ma)   
  - net: xfrm: Fix xfrm_address_filter OOB read (Lin Ma) [Orabug: 35923516] {CVE-2023-39194}
  - fbdev: mmp: fix value check in mmphw_probe() (Yuanjun Gong)   
  - drm/amdgpu: Fix potential fence use-after-free v2 (shanzhulig)   
  - Bluetooth: L2CAP: Fix use-after-free (Zhengping Jiang)   
  - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() (Armin Wolf)   
  - gfs2: Fix possible data races in gfs2_show_options() (Tuo Li)   
  - media: platform: mediatek: vpu: fix NULL ptr dereference (Hans Verkuil)   
  - media: v4l2-mem2mem: add lock to protect parameter num_rdy (Yunfei Dong)   
  - FS: JFS: Check for read-only mounted filesystem in txBegin (Immad Mir)   
  - FS: JFS: Fix null-ptr-deref Read in txBegin (Immad Mir)   
  - MIPS: dec: prom: Address -Warray-bounds warning (Gustavo A. R. Silva)   
  - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (Yogesh)   
  - udf: Fix uninitialized array access for some pathnames (Jan Kara)   
  - quota: fix warning in dqgrab() (Ye Bin)   
  - quota: Properly disable quotas when add_dquot_ref() fails (Jan Kara)   
  - ALSA: emu10k1: roll up loops in DSP setup code for Audigy (Oswald Buddenhagen)   
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init (hackyzh002)   
  - lib/mpi: Eliminate unused umul_ppmm definitions for MIPS (Nathan Chancellor)   
  - LTS version: v4.14.323 (Saeed Mirzamohammadi)   
  - alpha: remove __init annotation from exported page_is_ram() (Masahiro Yamada)   
  - scsi: core: Fix possible memory leak if device_add() fails (Zhu Wang)   
  - scsi: snic: Fix possible memory leak if device_add() fails (Zhu Wang)   
  - scsi: 53c700: Check that command slot is not NULL (Alexandra Diupina)   
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Michael Kelley)   
  - scsi: core: Fix legacy /proc parsing buffer overflow (Tony Battersby)   
  - netfilter: nf_tables: report use refcount overflow (Pablo Neira Ayuso)   
  - btrfs: don't stop integrity writeback too early (Christoph Hellwig)   
  - IB/hfi1: Fix possible panic during hotplug remove (Douglas Miller)   
  - drivers: net: prevent tun_build_skb() to exceed the packet size limit (Andrew Kanner)   
  - dccp: fix data-race around dp->dccps_mss_cache (Eric Dumazet)   
  - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan)   
  - net/packet: annotate data-races around tp->status (Eric Dumazet)   
  - drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes (Karol Herbst)   
  - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Kirill A. Shutemov)   
  - usb: dwc3: Properly handle processing of pending events (Elson Roy Serrao)   
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Alan Stern)   
  - iio: cros_ec: Fix the allocation size for cros_ec_command (Yiyuan Guo)   
  - test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation (Mirsad Goran Todorovac)   
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (Ryusuke Konishi)   
  - radix tree test suite: fix incorrect allocation size for pthreads (Colin Ian King)   
  - dmaengine: pl330: Return DMA_PAUSED when transaction is paused (Ilpo Järvinen)   
  - ipv6: adjust ndisc_is_useropt() to also return true for PIO (Maciej Żenczykowski)   
  - mmc: moxart: read scr register without changing byte order (Sergei Antonov)   
  - sparc: fix up arch_cpu_finalize_init() build breakage. (Greg Kroah-Hartman)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.5.el7uek]
changelog:
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng)  [Orabug: 35824288]  {CVE-2023-42753} 
  - netfilter: xt_u32: validate user space input (Wander Lairson Costa) [Orabug: 35923468] {CVE-2023-39192}
  - netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa) [Orabug: 35923499] {CVE-2023-39193}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.531.1.el7uek]
changelog:
  - ocfs2: ocfs2 crash due to invalid h_next_leaf_blk value in extent block (Gautham Ananthakrishna)  [Orabug: 35859332]  
  - bnxt_en: fix NULL dereference in bnxt_flash_package_from_file() (Samasth Norway Ananda)  [Orabug: 35848949]  
  - LTS version: v4.14.326 (Saeed Mirzamohammadi)   
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (valis) [Orabug: 35814287] {CVE-2023-4207} 
  - mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write (William Zhang)   
  - mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller (William Zhang)   
  - mtd: rawnand: brcmnand: Fix potential false time out warning (William Zhang)   
  - mtd: rawnand: brcmnand: Fix crash during the panic_write (William Zhang)   
  - nfsd: fix change_info in NFSv4 RENAME replies (Jeff Layton)   
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (Filipe Manana)   
  - attr: block mode changes of symlinks (Christian Brauner)   
  - md/raid1: fix error: ISO C90 forbids mixed declarations (Nigel Croxon)   
  - kobject: Add sanity check for kset->kobj.ktype in kset_register() (Zhen Lei)   
  - serial: cpm_uart: Avoid suspicious locking (Christophe Leroy)   
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (Konstantin Shelekhin)   
  - usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc (Ma Ke)   
  - media: pci: cx23885: replace BUG with error return (Hans Verkuil)   
  - media: tuners: qt1010: replace BUG_ON with a regular error (Hans Verkuil)   
  - iio: core: Use min() instead of min_t() to make code more robust (Andy Shevchenko)   
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (Zhang Shurong)   
  - media: anysee: fix null-ptr-deref in anysee_master_xfer (Zhang Shurong)   
  - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer (Zhang Shurong)   
  - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() (Zhang Shurong)   
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer (Zhang Shurong)   
  - powerpc/pseries: fix possible memory leak in ibmebus_bus_init() (ruanjinjie)   
  - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (Liu Shixin via Jfs-discussion)   
  - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (Andrew Kanner)   
  - ext2: fix datatype of block number in ext2_xattr_set2() (Georg Ottinger)   
  - md: raid1: fix potential OOB in raid1_remove_disk() (Zhang Shurong)   
  - drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable() (Tuo Li)   
  - alx: fix OOB-read compiler warning (GONG, Ruiqi)   
  - tpm_tis: Resend command to recover from data transfer errors (Alexander Steffen)   
  - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (Mark O'Donovan)   
  - wifi: mwifiex: fix fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix printk specifier (Dongliang Mu)   
  - hw_breakpoint: fix single-stepping when using bpf_overflow_handler (Tomislav Novak)   
  - ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 (Jiri Slaby (SUSE))   
  - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (Abhishek Mainkar)   
  - btrfs: output extra debug info if we failed to find an inline backref (Qu Wenruo)   
  - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Fedor Pchelkin)   
  - parisc: Drop loops_per_jiffy from per_cpu struct (Helge Deller)   
  - kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). (Kuniyuki Iwashima)   
  - ixgbe: fix timestamp configuration code (Vadim Fedorenko)   
  - kcm: Fix memory leak in error path of kcm_sendmsg() (Shigeru Yoshida)   
  - net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() (Hangyu Hua)   
  - ata: pata_ftide010: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - ata: sata_gemini: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - igb: Change IGB_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - kcm: Destroy mutex in kcm_exit_net() (Shigeru Yoshida)   
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis) [Orabug: 35814456] {CVE-2023-4921}
  - af_unix: Fix data race around sk->sk_err. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around sk->sk_shutdown. (Kuniyuki Iwashima)   
  - af_unix: Fix data-race around unix_tot_inflight. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around user->unix_inflight. (Kuniyuki Iwashima)   
  - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr (Alex Henrie)   
  - igb: disable virtualization features on 82580 (Corinna Vinschen)   
  - net: read sk->sk_family once in sk_mc_loop() (Eric Dumazet)   
  - pwm: lpc32xx: Remove handling of PWM channels (Vladimir Zapolskiy)   
  - watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load (Raag Jadav)   
  - x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() (Sean Christopherson)   
  - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info (Fedor Pchelkin)   
  - clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock (Dmitry Baryshkov)   
  - parisc: led: Reduce CPU overhead for disk & lan LED computation (Helge Deller)   
  - parisc: led: Fix LAN receive and transmit LEDs (Helge Deller)   
  - drm/ast: Fix DRAM init on AST2200 (Thomas Zimmermann)   
  - fbdev/ep93xx-fb: Do not assign to struct fb_info.dev (Thomas Zimmermann)   
  - scsi: qla2xxx: Turn off noisy message log (Quinn Tran)   
  - scsi: qla2xxx: fix inconsistent TMF timeout (Quinn Tran)   
  - crypto: stm32 - fix loop iterating through scatterlist for DMA (Thomas Bourgoin)   
  - pstore/ram: Check start of empty przs during init (Enlin Mu)   
  - net: handle ARPHRD_PPP in dev_is_mac_header_xmit() (Nicolas Dichtel)   
  - X.509: if signature is unsupported skip validation (Thore Sommer)   
  - dccp: Fix out of bounds access in DCCP error handler (Jann Horn)   
  - parisc: Fix /proc/cpuinfo output for lscpu (Helge Deller)   
  - procfs: block chmod on /proc/thread-self/comm (Aleksa Sarai)   
  - Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" (Bjorn Helgaas)   
  - ntb: Fix calculation ntb_transport_tx_free_entry() (Dave Jiang)   
  - ntb: Clean up tx tail index on link down (Dave Jiang)   
  - ntb: Drop packets when qp link is down (Dave Jiang)   
  - media: dvb: symbol fixup for dvb_attach() (Greg Kroah-Hartman)   
  - backlight/lv5207lp: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/bd6107: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/gpio_backlight: Compare against struct fb_info.device (Thomas Zimmermann)   
  - ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() (Gustavo A. R. Silva)   
  - ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (Takashi Iwai)   
  - PM / devfreq: Fix leak in devfreq_dev_release() (Boris Brezillon)   
  - igb: set max size RX buffer when store bad packet is enabled (Radoslaw Tyl) [Orabug: 35924097] {CVE-2023-45871}
  - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU (Eric Dumazet) [Orabug: 35924001] {CVE-2023-42752}
  - dmaengine: ste_dma40: Add missing IRQ check in d40_probe (ruanjinjie)   
  - rpmsg: glink: Add check for kstrdup (Jiasheng Jiang)   
  - HID: multitouch: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu)   
  - Revert "IB/isert: Fix incorrect release of isert connection" (Leon Romanovsky)   
  - amba: bus: fix refcount leak (Peng Fan)   
  - serial: tegra: handle clk prepare error in tegra_uart_hw_init() (Yi Yang)   
  - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (Chengfeng Ye)   
  - scsi: core: Use 32-bit hostnum in scsi_host_lookup() (Tony Battersby)   
  - cgroup:namespace: Remove unused cgroup_namespaces_init() (Lu Jialin)   
  - USB: gadget: f_mass_storage: Fix unused variable warning (Alan Stern)   
  - media: go7007: Remove redundant if statement (Colin Ian King)   
  - dma-buf/sync_file: Fix docs syntax (Rob Clark)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (Oleksandr Natalenko)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (Oleksandr Natalenko)   
  - x86/APM: drop the duplicate APM_MINOR_DEV macro (Randy Dunlap)   
  - scsi: qla4xxx: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: be2iscsi: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() (Lin Ma)   
  - usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() (Xu Yang)   
  - media: mediatek: vcodec: Return NULL if no vdec_fb is found (Irui Wang)   
  - media: cx24120: Add retval check for cx24120_message_send() (Daniil Dulov)   
  - media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() (Christophe JAILLET)   
  - media: dib7000p: Fix potential division by zero (Daniil Dulov)   
  - drivers: usb: smsusb: fix error handling code in smsusb_init_device (Dongliang Mu)   
  - NFSD: da_addr_body field missing in some GETDEVICEINFO replies (Chuck Lever)   
  - fs: lockd: avoid possible wrong NULL parameter (Su Hui)   
  - jfs: validate max amount of blocks before allocation. (Alexei Filippov)   
  - powerpc/iommu: Fix notifiers being shared by PCI and VIO buses (Russell Currey)   
  - nfs/blocklayout: Use the passed in gfp flags (Dan Carpenter)   
  - wifi: ath10k: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: pciehp: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: Mark NVIDIA T4 GPUs to avoid bus reset (Wu Zongyong)   
  - clk: sunxi-ng: Modify mismatched function name (Zhang Jianhua)   
  - drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() (Minjie Du)   
  - ALSA: ac97: Fix possible error value of *rac97 (Su Hui)   
  - audit: fix possible soft lockup in __audit_inode_child() (Gaosheng Cui)   
  - smackfs: Prevent underflow in smk_set_cipso() (Dan Carpenter)   
  - of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() (Ruan Jinjie)   
  - drm: adv7511: Fix low refresh rate register for ADV7533/5 (Bogdan Togorean)   
  - ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: BCM53573: Add cells sizes to PCIe node (Rafał Miłecki)   
  - netrom: Deny concurrent connect(). (Kuniyuki Iwashima)   
  - net: arcnet: Do not call kfree_skb() under local_irq_disable() (Jinjie Ruan)   
  - wifi: ath9k: use IS_ERR() with debugfs_create_dir() (Wang Ming)   
  - wifi: mwifiex: avoid possible NULL skb pointer dereference (Dmitry Antipov)   
  - wifi: ath9k: protect WMI command response buffer replacement with a lock (Fedor Pchelkin)   
  - wifi: mwifiex: Fix missed return in oob checks failed path (Polaris Pi)   
  - wifi: mwifiex: fix memory leak in mwifiex_histogram_read() (Dmitry Antipov)   
  - fs: ocfs2: namei: check return value of ocfs2_add_entry() (Artem Chernyshev)   
  - lwt: Check LWTUNNEL_XMIT_CONTINUE strictly (Yan Zhai)   
  - crypto: caam - fix unchecked return value error (Gaurav Jain)   
  - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Menglong Dong)   
  - Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (Yuanjun Gong)   
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Polaris Pi)   
  - can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM (Marc Kleine-Budde)   
  - spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() (Zhang Shurong)   
  - regmap: rbtree: Use alloc_flags for memory allocations (Dan Carpenter)   
  - cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() (Liao Chang)   
  - fs: Fix error checking for d_hash_and_lookup() (Wang Ming)   
  - reiserfs: Check the return value from __getblk() (Matthew Wilcox)   
  - Revert "net: macsec: preserve ingress frame ordering" (Sabrina Dubroca)   
  - udf: Handle error when adding extent to a file (Jan Kara)   
  - udf: Check consistency of Space Bitmap Descriptor (Vladislav Efanov)   
  - powerpc/32s: Fix assembler warning about r0 (Christophe Leroy)   
  - powerpc/32: Include .branch_lt in data section (Joel Stanley)   
  - ALSA: seq: oss: Fix racy open/close of MIDI devices (Takashi Iwai)   
  - cifs: add a warning when the in-flight count goes negative (Shyam Prasad N)   
  - sctp: handle invalid error codes without calling BUG() (Dan Carpenter)   
  - bnx2x: fix page fault following EEH recovery (David Christensen)   
  - netlabel: fix shift wrapping bug in netlbl_catmap_setlong() (Dmitry Mastykin)   
  - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock (Chengfeng Ye)   
  - idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM (Baoquan He)   
  - net: usb: qmi_wwan: add Quectel EM05GV2 (Martin Kohn)   
  - security: keys: perform capable check only on privileged operations (Christian Göttsche)   
  - ASoc: codecs: ES8316: Fix DMIC config (Edgar)   
  - fs/nls: make load_nls() take a const parameter (Saeed Mirzamohammadi)   
  - s390/dasd: use correct number of retries for ERP requests (Stefan Haberland)   
  - m68k: Fix invalid .section syntax (Ben Hutchings)   
  - ethernet: atheros: fix return value check in atl1c_tso_csum() (Yuanjun Gong)   
  - ASoC: da7219: Flush pending AAD IRQ when suspending (Dmytro Maluka)   
  - 9p: virtio: make sure 'offs' is initialized in zc_request (Dominique Martinet)   
  - lib/ubsan: remove returns-nonnull-attribute checks (Andrey Ryabinin)   
  - pinctrl: amd: Don't show `Invalid config param` errors (Mario Limonciello)   
  - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (Ryusuke Konishi)   
  - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() (Ryusuke Konishi)   
  - serial: sc16is7xx: fix bug when first setting GPIO direction (Hugo Villeneuve)   
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (Zheng Wang) [Orabug: 35282808] {CVE-2023-1989}
  - HID: wacom: remove the battery when the EKR is off (Aaron Armstrong Skomra)   
  - USB: serial: option: add FOXCONN T99W368/T99W373 product (Slark Xiao)   
  - USB: serial: option: add Quectel EM05G variant (0x030e) (Martin Kohn)   
  - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules (Christoph Hellwig)   
  - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff (Christoph Hellwig)   
  - mmc: au1xmmc: force non-modular build and remove symbol_get usage (Christoph Hellwig)   
  - ARM: pxa: remove use of symbol_get() (Arnd Bergmann)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.2.el7uek]
changelog:
  - x86: change default to spec_store_bypass_disable=prctl spectre_v2_user=prctl (Andrea Arcangeli)  [Orabug: 35905888]  
  - LTS version: 4.14.328 (Saeed Mirzamohammadi)   
  - Bluetooth: hci_event: Fix using memcmp when comparing keys (Luiz Augusto von Dentz)   
  - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (Kees Cook)   
  - Bluetooth: hci_sock: fix slab oob read in create_monitor_event (Edward AD)   
  - gpio: vf610: set value before the direction to avoid a glitch (Haibo Chen)   
  - s390/pci: fix iommu bitmap allocation (Niklas Schnelle)   
  - perf: Disallow mis-matched inherited group reads (Saeed Mirzamohammadi)   
  - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (Puliang Lu)   
  - USB: serial: option: add entry for Sierra EM9191 with new firmware (Benoît Monin)   
  - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (Fabio Porcedda)   
  - ACPI: irq: Fix incorrect return value in acpi_register_gsi() (Sunil V L)   
  - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" (Andy Shevchenko)   
  - mmc: core: Capture correct oemid-bits for eMMC cards (Avri Altman)   
  - sky2: Make sure there is at least one frag_addr available (Kees Cook)   
  - wifi: cfg80211: avoid leaking stack data into trace (Benjamin Berg)   
  - wifi: mac80211: allow transmitting EAPOL frames with tainted key (Wen Gong)   
  - Bluetooth: hci_core: Fix build warnings (Luiz Augusto von Dentz)   
  - Bluetooth: Avoid redundant authentication (Ying Hsu)   
  - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (Ma Ke)   
  - tracing: relax trace_event_eval_update() execution with cond_resched() (Clément Léger)   
  - ata: libata-eh: Fix compilation warning in ata_eh_link_report() (Damien Le Moal)   
  - gpio: timberdale: Fix potential deadlock on &tgpio->lock (Chengfeng Ye)   
  - overlayfs: set ctime when setting mtime and atime (Jeff Layton)   
  - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (Heiner Kallweit)   
  - btrfs: initialize start_slot in btrfs_log_prealloc_extents (Josef Bacik)   
  - ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone (Tony Lindgren)   
  - i40e: prevent crash on probe if hw registers have invalid values (Michal Schmidt)   
  - net: usb: smsc95xx: Fix an error code in smsc95xx_reset() (Dan Carpenter)   
  - net: rfkill: gpio: prevent value glitch during probe (Josua Mayer)   
  - net: ipv6: fix return value check in esp_remove_trailer (Ma Ke)   
  - net: ipv4: fix return value check in esp_remove_trailer (Ma Ke)   
  - xfrm: fix a data-race in xfrm_gen_index() (Saeed Mirzamohammadi)   
  - netfilter: nft_payload: fix wrong mac header matching (Florian Westphal)   
  - KVM: x86: Mask LVTPC when handling a PMI (Jim Mattson)   
  - regmap: fix NULL deref on lookup (Johan Hovold)   
  - nfc: nci: fix possible NULL pointer dereference in send_acknowledge() (Krzysztof Kozlowski)   
  - Bluetooth: avoid memcmp() out of bounds warning (Arnd Bergmann)   
  - Bluetooth: hci_event: Fix coding style (Luiz Augusto von Dentz)   
  - Bluetooth: vhci: Fix race when opening vhci device (Arkadiusz Bokowy)   
  - Bluetooth: Fix a refcnt underflow problem for hci_conn (Ziyang Xuan)   
  - Bluetooth: Reject connection with the device which has same BD_ADDR (Lee, Chun-Yi)   
  - Bluetooth: hci_event: Ignore NULL link key (Lee, Chun-Yi)   
  - usb: hub: Guard against accesses to uninitialized BOS descriptors (Ricardo Cañuelo)   
  - x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs (Borislav Petkov (AMD))   
  - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call (Krishna Kurapati)   
  - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio (Piyush Mehta)   
  - pinctrl: avoid unsafe code pattern in find_pinctrl() (Dmitry Torokhov)   
  - cgroup: Remove duplicates in cgroup v1 tasks file (Michal Koutný)   
  - Input: xpad - add PXN V900 support (Matthias Berndt)   
  - Input: powermate - fix use-after-free in powermate_config_complete (Javier Carrasco)   
  - ceph: fix incorrect revoked caps assert in ceph_fill_file_size() (Xiubo Li)   
  - mcb: remove is_added flag from mcb_device struct (Jorge Sanjuan Garcia)   
  - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug (Alexander Zangerl)   
  - iio: pressure: bmp280: Fix NULL pointer exception (Phil Elwell)   
  - usb: musb: Modify the "HWVers" register address (Xingxing Luo)   
  - usb: musb: Get the musb_qh poniter after musb_giveback (Xingxing Luo)   
  - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read (Javier Carrasco)   
  - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer (Wesley Cheng)   
  - workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() (Waiman Long)   
  - nfc: nci: assert requested protocol is valid (Jeremy Cline)   
  - ixgbe: fix crash with empty VF macvlan list (Dan Carpenter)   
  - drm/vmwgfx: fix typo of sizeof argument (Konstantin Meskhidze)   
  - ieee802154: ca8210: Fix a potential UAF in ca8210_probe (Dinghao Liu)   
  - drm: etvnaviv: fix bad backport leading to warning (Martin Fuzzey)   
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (Hans de Goede)   
  - RDMA/cxgb4: Check skb value for failure to allocate (Artem Chernyshev)   
  - LTS version: 4.14.327 (Saeed Mirzamohammadi)   
  - parisc: Restore __ldcw_align for PA-RISC 2.0 processors (John David Anglin)   
  - RDMA/mlx5: Fix NULL string error (Shay Drory)   
  - RDMA/cma: Fix truncation compilation warning in make_cma_ports (Leon Romanovsky)   
  - gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() (Bartosz Golaszewski)   
  - IB/mlx4: Fix the size of a buffer in add_port_entries() (Christophe JAILLET)   
  - cpupower: add Makefile dependencies for install targets (Ivan Babrou)   
  - sctp: update hb timer immediately after users change hb_interval (Xin Long)   
  - sctp: update transport state when processing a dupcook packet (Xin Long)   
  - tcp: fix delayed ACKs for MSS boundary condition (Neal Cardwell)   
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Shigeru Yoshida)   
  - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (David Howells)   
  - modpost: add missing else to the "of" check (Mauricio Faria de Oliveira)   
  - scsi: target: core: Fix deadlock due to recursive locking (Junxiao Bi)   
  - regmap: rbtree: Fix wrong register marked as in-cache when creating new node (Richard Fitzgerald)   
  - drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close() (Alexandra Diupina)   
  - ubi: Refuse attaching if mtd's erasesize is 0 (Zhihao Cheng)   
  - wifi: mwifiex: Fix tlv_buf_left calculation (Gustavo A. R. Silva)   
  - scsi: zfcp: Fix a double put in zfcp_port_enqueue() (Dinghao Liu)   
  - media: dvb: symbol fixup for dvb_attach() - again (Greg Kroah-Hartman)   
  - ata: libata: disallow dev-initiated LPM transitions to unsupported states (Niklas Cassel)   
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Budimir Markovic) [Orabug: 35810543] {CVE-2023-4623}
  - ext4: fix rec_len verify error (Shida Zhang)   
  - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (George Kennedy)   
  - fs: binfmt_elf_efpic: fix personality for ELF-FDPIC (Greg Ungerer)   
  - ata: libata-sata: increase PMP SRST timeout to 10s (Matthias Schiffer)   
  - ata: libata-core: Fix port and device removal (Damien Le Moal)   
  - ata: libata-core: Fix ata_port_request_pm() locking (Damien Le Moal)   
  - btrfs: properly report 0 avail for very full file systems (Josef Bacik)   
  - i2c: i801: unregister tco_pdev in i801_probe() error path (Heiner Kallweit)   
  - ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES (Niklas Cassel)   
  - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() (Pan Bian)   
  - serial: 8250_port: Check IRQ data before use (Andy Shevchenko)   
  - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Mika Westerberg)   
  - watchdog: iTCO_wdt: No need to stop the timer in probe (Mika Westerberg)   
  - ata: libahci: clear pending interrupt status (Szuying Chen)   
  - ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones (Hannes Reinecke)   
  - fbdev/sh7760fb: Depend on FB=y (Thomas Zimmermann)   
  - ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset() (Niklas Cassel)   
  - ring-buffer: Avoid softlockup in ring_buffer_resize() (Zheng Yejian)   
  - selftests/ftrace: Correctly enable event in instance-event.tc (Zheng Yejian)   
  - parisc: irq: Make irq_stack_union static to avoid sparse warning (Helge Deller)   
  - parisc: iosapic.c: Fix sparse warnings (Helge Deller)   
  - parisc: sba: Fix compile warning wrt list of SBA devices (Helge Deller)   
  - xtensa: boot/lib: fix function prototypes (Max Filippov)   
  - xtensa: boot: don't add include-dirs (Randy Dunlap)   
  - clk: tegra: fix error return case for recalc_rate (Timo Alho)   
  - i2c: mux: demux-pinctrl: check the return value of devm_kstrdup() (Xiaoke Wang)   
  - gpio: tb10x: Fix an error handling path in tb10x_gpio_probe() (Christophe JAILLET)   
  - team: fix null-ptr-deref when team device type is changed (Ziyang Xuan)   
  - powerpc/perf/hv-24x7: Update domain value check (Kajol Jain)   
  - ipv4: fix null-deref in ipv4_link_failure (Kyle Zeng)   
  - NFS/pNFS: Report EINVAL errors from connect() to the server (Trond Myklebust)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.3.el7uek]
changelog:
  - Revert "mmc: core: Capture correct oemid-bits for eMMC cards" (Dominique Martinet)   
  - media: dvb-usb-v2: af9035: fix missing unlock (Hans Verkuil)   
  - perf/core: Fix potential NULL deref (Peter Zijlstra)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.533.1.el7uek]
changelog:
  - vhost-scsi: fix vqs allocation memory corruption (Dongli Zhang)  [Orabug: 36110885]  
  - xfs: try to avoid allocation blocking on busy extents (Mark Tinguely)  [Orabug: 35960820]  
  - KVM: x86: Don't unnecessarily force masterclock update on vCPU hotplug (Sean Christopherson)  [Orabug: 35910097]


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.533.2.el7uek]
changelog:
  - LTS version: 4.14.334 (Yifei Liu)   
  - powerpc/ftrace: Fix stack teardown in ftrace_no_trace (Naveen N Rao)   
  - powerpc/ftrace: Create a dummy stackframe to fix stack unwind (Naveen N Rao)   
  - ring-buffer: Fix memory leak of free page (Steven Rostedt (Google))   
  - team: Fix use-after-free when an option instance allocation fails (Florent Revest)   
  - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS (Baokun Li)   
  - HID: hid-asus: add const to read-only outgoing usb buffer (Denis Benato)   
  - net: usb: qmi_wwan: claim interface 4 for ZTE MF290 (Lech Perczak)   
  - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation (Linus Torvalds)   
  - HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad (Aoba K)   
  - HID: hid-asus: reset the backlight brightness level on resume (Denis Benato)   
  - platform/x86: intel_telemetry: Fix kernel doc descriptions (Andy Shevchenko)   
  - bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (Coly Li)   
  - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" (Ming Lei)   
  - appletalk: Fix Use-After-Free in atalk_ioctl (Hyunwoo Kim)   
  - vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() (Nikolay Kuratov)   
  - sign-file: Fix incorrect return values check (Yusong Gao)   
  - net: Remove acked SYN flag from packet in the transmit queue correctly (Dong Chenchen)   
  - qed: Fix a potential use-after-free in qed_cxt_tables_alloc (Dinghao Liu)   
  - net/rose: Fix Use-After-Free in rose_ioctl (Hyunwoo Kim)   
  - atm: Fix Use-After-Free in do_vcc_ioctl (Hyunwoo Kim)   
  - atm: solos-pci: Fix potential deadlock on &tx_queue_lock (Chengfeng Ye)   
  - atm: solos-pci: Fix potential deadlock on &cli_queue_lock (Chengfeng Ye)   
  - qca_spi: Fix reset behavior (Stefan Wahren)   
  - qca_debug: Fix ethtool -G iface tx behavior (Stefan Wahren)   
  - qca_debug: Prevent crash on TX ring changes (Stefan Wahren)   
  - LTS version: 4.14.333 (Yifei Liu)   
  - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group (Ido Schimmel)   
  - psample: Require 'CAP_NET_ADMIN' when joining "packets" group (Ido Schimmel)   
  - genetlink: add CAP_NET_ADMIN test for multicast bind (Ido Schimmel)   
  - netlink: don't call ->netlink_bind with table lock held (Ido Schimmel)   
  - nilfs2: fix missing error check for sb_set_blocksize call (Ryusuke Konishi)   
  - KVM: s390/mm: Properly reset no-dat (Claudio Imbrenda)   
  - serial: 8250_omap: Add earlycon support for the AM654 UART controller (Ronald Wahl)   
  - serial: sc16is7xx: address RX timeout interrupt errata (Daniel Mack)   
  - parport: Add support for Brainboxes IX/UC/PX parallel cards (Cameron Williams)   
  - packet: Move reference count in packet_sock to atomic_long_t (Daniel Borkmann)   
  - tracing: Fix a possible race when disabling buffered events (Petr Pavlu)   
  - tracing: Fix incomplete locking when disabling buffered events (Petr Pavlu)   
  - tracing: Always update snapshot buffer size (Steven Rostedt (Google))   
  - nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() (Ryusuke Konishi)   
  - ALSA: pcm: fix out-of-bounds in snd_pcm_state_names (Jason Zhang)   
  - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() (Dinghao Liu)   
  - tracing: Fix a warning when allocating buffered events fails (Petr Pavlu)   
  - hwmon: (acpi_power_meter) Fix 4.29 MW bug (Armin Wolf)   
  - RDMA/bnxt_re: Correct module description string (Kalesh AP)   
  - tcp: do not accept ACK of bytes we never sent (Eric Dumazet)   
  - net: hns: fix fake link up on xge port (Yonglong Liu)   
  - drm/amdgpu: correct chunk_ptr to a pointer to chunk. (YuanShang)   
  - tg3: Increment tx_dropped in tg3_tso_bug() (Alex Pakhunov)   
  - tg3: Move the [rt]x_dropped counters to tg3_napi (Alex Pakhunov)   
  - LTS version: 4.14.332 (Yifei Liu)   
  - driver core: Release all resources during unbind before updating device links (Saravana Kannan)   
  - net: ravb: Start TX queues after HW initialization succeeded (Claudiu Beznea)   
  - ravb: Fix races between ravb_tx_timeout_work() and net related ops (Yoshihiro Shimoda)   
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet (Zhengchao Shao)   
  - btrfs: send: ensure send_fd is writable (Jann Horn)   
  - btrfs: fix off-by-one when checking chunk map includes logical address (Filipe Manana)   
  - powerpc: Don't clobber f0/vs0 during fp|altivec register save (Timothy Pearson)   
  - dm verity: don't perform FEC for failed readahead IO (Wu Bo)   
  - dm-verity: align struct dm_verity_fec_io properly (Mikulas Patocka)   
  - firewire: core: fix possible memory leak in create_units() (Yang Yingliang)   
  - pinctrl: avoid reload of p state in list iteration (Maria Yu)   
  - usb: dwc3: set the dma max_seg_size (Ricardo Ribalda)   
  - USB: serial: option: don't claim interface 4 for ZTE MF290 (Lech Perczak)   
  - USB: serial: option: fix FM101R-GL defines (Puliang Lu)   
  - USB: serial: option: add Fibocom L7xx modules (Victor Fragoso)   
  - bcache: prevent potential division by zero error (Rand Deeb)   
  - bcache: check return value from btree_node_alloc_replacement() (Coly Li)   
  - USB: serial: option: add Luat Air72*U series products (Asuna Yang)   
  - s390/dasd: protect device queue against concurrent access (Jan Höppner)   
  - mtd: rawnand: brcmnand: Fix ecc chunk calculation for erased page bitfips (Claire Lin)   
  - net: axienet: Fix check for partial TX checksum (Samuel Holland)   
  - amd-xgbe: propagate the correct speed and duplex status (Raju Rangoju)   
  - amd-xgbe: handle corner-case during sfp hotplug (Raju Rangoju)   
  - arm/xen: fix xen_vcpu_info allocation alignment (Stefano Stabellini)   
  - net: usb: ax88179_178a: fix failed operations during ax88179_reset (Jose Ignacio Tornos Martinez)   
  - ipv4: Correct/silence an endian warning in __ip_do_redirect (Kunwu Chan)   
  - drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full (Jonas Karlman)   
  - ata: pata_isapnp: Add missing error check for devm_ioport_map() (Chen Ni)   
  - drm/panel: simple: Fix Innolux G101ICE-L01 timings (Marek Vasut)   
  - RDMA/irdma: Prevent zero-length STAG registration (Christopher Bednarz)   
  - LTS version: 4.14.331 (Yifei Liu)   
  - net: sched: fix race condition in qdisc_graft() (Eric Dumazet)   
  - scsi: virtio_scsi: limit number of hw queues by nr_cpu_ids (Dongli Zhang)   
  - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (Kemeng Shi)   
  - ext4: correct return value of ext4_convert_meta_bg (Kemeng Shi)   
  - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Kemeng Shi)   
  - ext4: apply umask if ACL support is disabled (Max Kellermann)   
  - media: venus: hfi: fix the check to handle session buffer requirement (Vikash Garodia)   
  - media: sharp: fix sharp encoding (Sean Young)   
  - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte (Heiner Kallweit)   
  - net: dsa: lan9303: consequently nested-lock physical MDIO (Alexander Sverdlin)   
  - ALSA: info: Fix potential deadlock at disconnection (Takashi Iwai)   
  - parisc/pgtable: Do not drop upper 5 address bits of physical address (Helge Deller)   
  - parisc: Prevent booting 64-bit kernels on PA1.x machines (Helge Deller)   
  - mcb: fix error handling for different scenarios when parsing (Sanjuán García, Jorge)   
  - jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev (Zhihao Cheng)   
  - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware (Herve Codina)   
  - mmc: meson-gx: Remove setting of CMD_CFG_ERROR (Rong Chen)   
  - PM: hibernate: Clean up sync_read handling in snapshot_write_next() (Brian Geffon)   
  - PM: hibernate: Use __get_safe_page() rather than touching the list (Brian Geffon)   
  - mmc: vub300: fix an error code (Dan Carpenter)   
  - PCI/sysfs: Protect driver's D3cold preference from user space (Lukas Wunner)   
  - hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (David Woodhouse)   
  - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() (Paul Moore)   
  - audit: don't take task_lock() in audit_exe_compare() code path (Paul Moore)   
  - KVM: x86: Ignore MSR_AMD64_TW_CFG access (Maciej S. Szmigiero)   
  - randstruct: Fix gcc-plugin performance mode to stay in group (Kees Cook)   
  - media: venus: hfi: add checks to perform sanity on queue pointers (Vikash Garodia)   
  - pwm: Fix double shift bug (Dan Carpenter)   
  - gfs2: ignore negated quota changes (Bob Peterson)   
  - media: vivid: avoid integer overflow (Hans Verkuil)   
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Rajeshwar R Shinde)   
  - i2c: sun6i-p2wi: Prevent potential division by zero (Axel Lin)   
  - tty: vcc: Add check for kstrdup() in vcc_probe() (Yi Yang)   
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (Wenchao Hao)   
  - atm: iphase: Do PCI error checks on own line (Ilpo Järvinen)   
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream (Cezary Rojewski)   
  - jfs: fix array-index-out-of-bounds in diAlloc (Manas Ghandat)   
  - jfs: fix array-index-out-of-bounds in dbFindLeaf (Manas Ghandat)   
  - fs/jfs: Add validity check for db_maxag and db_agpref (Juntong Deng)   
  - fs/jfs: Add check for negative db_l2nbperpage (Juntong Deng)   
  - RDMA/hfi1: Use FIELD_GET() to extract Link Width (Ilpo Järvinen)   
  - crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin)   
  - selftests/efivarfs: create-read: fix a resource leak (zhujun2)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (Mario Limonciello)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (Mario Limonciello)   
  - net: annotate data-races around sk->sk_dst_pending_confirm (Eric Dumazet)   
  - wifi: ath10k: fix clang-specific fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix clang-specific fortify warnings (Dmitry Antipov)   
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Ping-Ke Shih)   
  - x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size (Mike Rapoport (IBM))   
  - clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware (Ronald Wahl)   
  - clocksource/drivers/timer-imx-gpt: Fix potential memory leak (Jacky Bai)   
  - locking/ww_mutex/test: Fix potential workqueue corruption (John Stultz)   
  - LTS version: 4.14.330 (Yifei Liu)   
  - btrfs: use u64 for buffer sizes in the tree search ioctls (Filipe Manana)   
  - fbdev: fsl-diu-fb: mark wr_reg_wa() static (Arnd Bergmann)   
  - netfilter: xt_recent: fix (increase) ipv6 literal buffer length (Maciej Żenczykowski)   
  - tg3: power down device only on SYSTEM_POWER_OFF (George Shuklin)   
  - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. (Kuniyuki Iwashima)   
  - dccp: Call security_inet_conn_request() after setting IPv4 addresses. (Kuniyuki Iwashima)   
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Shigeru Yoshida)   
  - llc: verify mac len before reading mac header (Willem de Bruijn)   
  - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume (Florian Fainelli)   
  - media: s3c-camif: Avoid inappropriate kfree() (Katya Orlova)   
  - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: ds: fix refcount leak in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: cs: fix possible hung task and memory leak pccardd() (Yang Yingliang)   
  - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() (Christophe JAILLET)   
  - USB: usbip: fix stub_dev hub disconnect (Jonas Blixt)   
  - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave() (Jinjie Ruan)   
  - dmaengine: ti: edma: handle irq_of_parse_and_map() errors (Dan Carpenter)   
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (Jia-Ju Bai)   
  - tty: tty_jobctrl: fix pid memleak in disassociate_ctty() (Yi Yang)   
  - mfd: dln2: Fix double put in dln2_probe (Dinghao Liu)   
  - ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails (Cezary Rojewski)   
  - sh: bios: Revive earlyprintk support (Geert Uytterhoeven)   
  - RDMA/hfi1: Workaround truncation compilation error (Leon Romanovsky)   
  - ext4: move 'ix' sanity check to corrent position (Gou Hao)   
  - ARM: 9321/1: memset: cast the constant byte to unsigned char (Kursad Oney)   
  - hwrng: geode - fix accessing registers (Jonas Gorski)   
  - firmware: ti_sci: Mark driver as non removable (Dhruva Gole)   
  - ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator (Krzysztof Kozlowski)   
  - drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe() (Christophe JAILLET)   
  - drm/radeon: possible buffer overflow (Konstantin Meskhidze)   
  - drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs (Jonas Karlman)   
  - platform/x86: wmi: Fix probe failure when failing to register WMI devices (Armin Wolf)   
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: keystone: pll: fix a couple NULL vs IS_ERR() checks (Dan Carpenter)   
  - clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies (Devi Priya)   
  - ipv6: avoid atomic fragment on GSO packets (Yan Zhai)   
  - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() (Christophe JAILLET)   
  - thermal: core: prevent potential string overflow (Dan Carpenter)   
  - wifi: rtlwifi: fix EDCA limit set by BT coexistence (Dmitry Antipov)   
  - tcp_metrics: do not create an entry from tcp_init_metrics() (Eric Dumazet)   
  - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics() (Eric Dumazet)   
  - i40e: fix potential memory leaks in i40e_remove() (Andrii Staikov)   
  - LTS version: 4.14.329 (Yifei Liu)   
  - tty: 8250: Add support for Intashield IS-100 (Cameron Williams)   
  - tty: 8250: Add support for Brainboxes UP cards (Cameron Williams)   
  - tty: 8250: Add support for additional Brainboxes UC cards (Cameron Williams)   
  - tty: 8250: Remove UC-257 and UC-431 (Cameron Williams)   
  - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility (LihaSika)   
  - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device (Vicki Pfau)   
  - remove the sx8 block driver (Christoph Hellwig)   
  - ata: ahci: fix enum constants for gcc-13 (Arnd Bergmann)   
  - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw (Su Hui)   
  - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e (Hans de Goede)   
  - scsi: mpt3sas: Fix in error path (Tomas Henzl)   
  - fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit() (Jorge Maidana)   
  - ASoC: rt5650: fix the wrong result of key button (Shuming Fan)   
  - netfilter: nfnetlink_log: silence bogus compiler warning (Florian Westphal)   
  - fbdev: atyfb: only use ioremap_uc() on i386 and ia64 (Arnd Bergmann)   
  - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport (Dmitry Torokhov)   
  - dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe (Zhang Shurong)   
  - irqchip/stm32-exti: add missing DT IRQ flag translation (Ben Wolsieffer)   
  - ASoC: simple-card: fixup asoc_simple_probe() error handling (Kuninori Morimoto)   
  - x86: Fix .brk attribute in linker script (Juergen Gross)   
  - rpmsg: Fix possible refcount leak in rpmsg_register_device_override() (Hangyu Hua)   
  - rpmsg: glink: Release driver_override (Bjorn Andersson)   
  - rpmsg: Fix calling device_lock() on non-initialized device (Krzysztof Kozlowski)   
  - rpmsg: Fix kfree() of static memory on setting driver_override (Krzysztof Kozlowski)   
  - driver: platform: Add helper for safer setting of driver_override (Krzysztof Kozlowski)   
  - x86/mm: Fix RESERVE_BRK() for older binutils (Josh Poimboeuf)   
  - x86/mm: Simplify RESERVE_BRK() (Josh Poimboeuf)   
  - x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility (Thomas Gleixner)   
  - nfsd: lock_rename() needs both directories to live on the same fs (Al Viro)   
  - f2fs: fix to do sanity check on inode type during garbage collection (Chao Yu)   
  - kobject: Fix slab-out-of-bounds in fill_kobj_path() (Wang Hai)   
  - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper() (Lukasz Majczak)   
  - ARM: 8933/1: replace Sun/Solaris style flag on section directive (Nick Desaulniers)   
  - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (Ivan Vecera)   
  - gtp: uapi: fix GTPA_MAX (Pablo Neira Ayuso)   
  - tcp: fix wrong RTO timeout when received SACK reneging (Fred Chen)   
  - r8152: Increase USB control msg timeout to 5000ms as per spec (Douglas Anderson)   
  - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry (Mateusz Palczewski)   
  - treewide: Spelling fix in comment (Kunwu Chan)   
  - virtio_balloon: Fix endless deflation and inflation on arm64 (Gavin Shan)   
  - mcb-lpc: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - mcb: Return actual parsed size when reading chameleon table (Rodríguez Barbarin, José Javier)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.533.3.el7uek]
changelog:
  - net: rfkill: gpio: set GPIO direction (Rouven Czerwinski)   
  - sched/fair: Fix tg->load when offlining a CPU (Vincent Guittot)  [Orabug: 36185208]  
  - IB/cm: Cancel mad on the DREQ event when the state is MRA_REP_RCVD (Mark Zhang)  [Orabug: 36143229]  
  - sched/rt: pick_next_rt_entity(): check list_entry (Pietro Borrello)  [Orabug: 35181559]  {CVE-2023-1077}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.531.1.el7uek]
changelog:
  - ocfs2: ocfs2 crash due to invalid h_next_leaf_blk value in extent block (Gautham Ananthakrishna)  [Orabug: 35859332]  
  - bnxt_en: fix NULL dereference in bnxt_flash_package_from_file() (Samasth Norway Ananda)  [Orabug: 35848949]  
  - LTS version: v4.14.326 (Saeed Mirzamohammadi)   
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (valis) [Orabug: 35814287] {CVE-2023-4207} {CVE-2023-4128}
  - mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write (William Zhang)   
  - mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller (William Zhang)   
  - mtd: rawnand: brcmnand: Fix potential false time out warning (William Zhang)   
  - mtd: rawnand: brcmnand: Fix crash during the panic_write (William Zhang)   
  - nfsd: fix change_info in NFSv4 RENAME replies (Jeff Layton)   
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (Filipe Manana)   
  - attr: block mode changes of symlinks (Christian Brauner)   
  - md/raid1: fix error: ISO C90 forbids mixed declarations (Nigel Croxon)   
  - kobject: Add sanity check for kset->kobj.ktype in kset_register() (Zhen Lei)   
  - serial: cpm_uart: Avoid suspicious locking (Christophe Leroy)   
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (Konstantin Shelekhin)   
  - usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc (Ma Ke)   
  - media: pci: cx23885: replace BUG with error return (Hans Verkuil)   
  - media: tuners: qt1010: replace BUG_ON with a regular error (Hans Verkuil)   
  - iio: core: Use min() instead of min_t() to make code more robust (Andy Shevchenko)   
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (Zhang Shurong)   
  - media: anysee: fix null-ptr-deref in anysee_master_xfer (Zhang Shurong)   
  - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer (Zhang Shurong)   
  - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() (Zhang Shurong)   
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer (Zhang Shurong)   
  - powerpc/pseries: fix possible memory leak in ibmebus_bus_init() (ruanjinjie)   
  - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (Liu Shixin via Jfs-discussion)   
  - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (Andrew Kanner)   
  - ext2: fix datatype of block number in ext2_xattr_set2() (Georg Ottinger)   
  - md: raid1: fix potential OOB in raid1_remove_disk() (Zhang Shurong)   
  - drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable() (Tuo Li)   
  - alx: fix OOB-read compiler warning (GONG, Ruiqi)   
  - tpm_tis: Resend command to recover from data transfer errors (Alexander Steffen)   
  - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (Mark O'Donovan)   
  - wifi: mwifiex: fix fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix printk specifier (Dongliang Mu)   
  - hw_breakpoint: fix single-stepping when using bpf_overflow_handler (Tomislav Novak)   
  - ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 (Jiri Slaby (SUSE))   
  - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (Abhishek Mainkar)   
  - btrfs: output extra debug info if we failed to find an inline backref (Qu Wenruo)   
  - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Fedor Pchelkin)   
  - parisc: Drop loops_per_jiffy from per_cpu struct (Helge Deller)   
  - kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). (Kuniyuki Iwashima)   
  - ixgbe: fix timestamp configuration code (Vadim Fedorenko)   
  - kcm: Fix memory leak in error path of kcm_sendmsg() (Shigeru Yoshida)   
  - net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() (Hangyu Hua)   
  - ata: pata_ftide010: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - ata: sata_gemini: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - igb: Change IGB_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - kcm: Destroy mutex in kcm_exit_net() (Shigeru Yoshida)   
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis) [Orabug: 35814456] {CVE-2023-4921}
  - af_unix: Fix data race around sk->sk_err. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around sk->sk_shutdown. (Kuniyuki Iwashima)   
  - af_unix: Fix data-race around unix_tot_inflight. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around user->unix_inflight. (Kuniyuki Iwashima)   
  - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr (Alex Henrie)   
  - igb: disable virtualization features on 82580 (Corinna Vinschen)   
  - net: read sk->sk_family once in sk_mc_loop() (Eric Dumazet)   
  - pwm: lpc32xx: Remove handling of PWM channels (Vladimir Zapolskiy)   
  - watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load (Raag Jadav)   
  - x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() (Sean Christopherson)   
  - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info (Fedor Pchelkin)   
  - clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock (Dmitry Baryshkov)   
  - parisc: led: Reduce CPU overhead for disk & lan LED computation (Helge Deller)   
  - parisc: led: Fix LAN receive and transmit LEDs (Helge Deller)   
  - drm/ast: Fix DRAM init on AST2200 (Thomas Zimmermann)   
  - fbdev/ep93xx-fb: Do not assign to struct fb_info.dev (Thomas Zimmermann)   
  - scsi: qla2xxx: Turn off noisy message log (Quinn Tran)   
  - scsi: qla2xxx: fix inconsistent TMF timeout (Quinn Tran)   
  - crypto: stm32 - fix loop iterating through scatterlist for DMA (Thomas Bourgoin)   
  - pstore/ram: Check start of empty przs during init (Enlin Mu)   
  - net: handle ARPHRD_PPP in dev_is_mac_header_xmit() (Nicolas Dichtel)   
  - X.509: if signature is unsupported skip validation (Thore Sommer)   
  - dccp: Fix out of bounds access in DCCP error handler (Jann Horn)   
  - parisc: Fix /proc/cpuinfo output for lscpu (Helge Deller)   
  - procfs: block chmod on /proc/thread-self/comm (Aleksa Sarai)   
  - Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" (Bjorn Helgaas)   
  - ntb: Fix calculation ntb_transport_tx_free_entry() (Dave Jiang)   
  - ntb: Clean up tx tail index on link down (Dave Jiang)   
  - ntb: Drop packets when qp link is down (Dave Jiang)   
  - media: dvb: symbol fixup for dvb_attach() (Greg Kroah-Hartman)   
  - backlight/lv5207lp: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/bd6107: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/gpio_backlight: Compare against struct fb_info.device (Thomas Zimmermann)   
  - ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() (Gustavo A. R. Silva)   
  - ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (Takashi Iwai)   
  - PM / devfreq: Fix leak in devfreq_dev_release() (Boris Brezillon)   
  - igb: set max size RX buffer when store bad packet is enabled (Radoslaw Tyl) [Orabug: 35924097] {CVE-2023-45871}
  - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU (Eric Dumazet) [Orabug: 35924001] {CVE-2023-42752}
  - dmaengine: ste_dma40: Add missing IRQ check in d40_probe (ruanjinjie)   
  - rpmsg: glink: Add check for kstrdup (Jiasheng Jiang)   
  - HID: multitouch: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu)   
  - Revert "IB/isert: Fix incorrect release of isert connection" (Leon Romanovsky)   
  - amba: bus: fix refcount leak (Peng Fan)   
  - serial: tegra: handle clk prepare error in tegra_uart_hw_init() (Yi Yang)   
  - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (Chengfeng Ye)   
  - scsi: core: Use 32-bit hostnum in scsi_host_lookup() (Tony Battersby)   
  - cgroup:namespace: Remove unused cgroup_namespaces_init() (Lu Jialin)   
  - USB: gadget: f_mass_storage: Fix unused variable warning (Alan Stern)   
  - media: go7007: Remove redundant if statement (Colin Ian King)   
  - dma-buf/sync_file: Fix docs syntax (Rob Clark)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (Oleksandr Natalenko)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (Oleksandr Natalenko)   
  - x86/APM: drop the duplicate APM_MINOR_DEV macro (Randy Dunlap)   
  - scsi: qla4xxx: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: be2iscsi: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() (Lin Ma)   
  - usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() (Xu Yang)   
  - media: mediatek: vcodec: Return NULL if no vdec_fb is found (Irui Wang)   
  - media: cx24120: Add retval check for cx24120_message_send() (Daniil Dulov)   
  - media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() (Christophe JAILLET)   
  - media: dib7000p: Fix potential division by zero (Daniil Dulov)   
  - drivers: usb: smsusb: fix error handling code in smsusb_init_device (Dongliang Mu)   
  - NFSD: da_addr_body field missing in some GETDEVICEINFO replies (Chuck Lever)   
  - fs: lockd: avoid possible wrong NULL parameter (Su Hui)   
  - jfs: validate max amount of blocks before allocation. (Alexei Filippov)   
  - powerpc/iommu: Fix notifiers being shared by PCI and VIO buses (Russell Currey)   
  - nfs/blocklayout: Use the passed in gfp flags (Dan Carpenter)   
  - wifi: ath10k: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: pciehp: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: Mark NVIDIA T4 GPUs to avoid bus reset (Wu Zongyong)   
  - clk: sunxi-ng: Modify mismatched function name (Zhang Jianhua)   
  - drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() (Minjie Du)   
  - ALSA: ac97: Fix possible error value of *rac97 (Su Hui)   
  - audit: fix possible soft lockup in __audit_inode_child() (Gaosheng Cui)   
  - smackfs: Prevent underflow in smk_set_cipso() (Dan Carpenter)   
  - of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() (Ruan Jinjie)   
  - drm: adv7511: Fix low refresh rate register for ADV7533/5 (Bogdan Togorean)   
  - ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: BCM53573: Add cells sizes to PCIe node (Rafał Miłecki)   
  - netrom: Deny concurrent connect(). (Kuniyuki Iwashima)   
  - net: arcnet: Do not call kfree_skb() under local_irq_disable() (Jinjie Ruan)   
  - wifi: ath9k: use IS_ERR() with debugfs_create_dir() (Wang Ming)   
  - wifi: mwifiex: avoid possible NULL skb pointer dereference (Dmitry Antipov)   
  - wifi: ath9k: protect WMI command response buffer replacement with a lock (Fedor Pchelkin)   
  - wifi: mwifiex: Fix missed return in oob checks failed path (Polaris Pi)   
  - wifi: mwifiex: fix memory leak in mwifiex_histogram_read() (Dmitry Antipov)   
  - fs: ocfs2: namei: check return value of ocfs2_add_entry() (Artem Chernyshev)   
  - lwt: Check LWTUNNEL_XMIT_CONTINUE strictly (Yan Zhai)   
  - crypto: caam - fix unchecked return value error (Gaurav Jain)   
  - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Menglong Dong)   
  - Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (Yuanjun Gong)   
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Polaris Pi)   
  - can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM (Marc Kleine-Budde)   
  - spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() (Zhang Shurong)   
  - regmap: rbtree: Use alloc_flags for memory allocations (Dan Carpenter)   
  - cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() (Liao Chang)   
  - fs: Fix error checking for d_hash_and_lookup() (Wang Ming)   
  - reiserfs: Check the return value from __getblk() (Matthew Wilcox)   
  - Revert "net: macsec: preserve ingress frame ordering" (Sabrina Dubroca)   
  - udf: Handle error when adding extent to a file (Jan Kara)   
  - udf: Check consistency of Space Bitmap Descriptor (Vladislav Efanov)   
  - powerpc/32s: Fix assembler warning about r0 (Christophe Leroy)   
  - powerpc/32: Include .branch_lt in data section (Joel Stanley)   
  - ALSA: seq: oss: Fix racy open/close of MIDI devices (Takashi Iwai)   
  - cifs: add a warning when the in-flight count goes negative (Shyam Prasad N)   
  - sctp: handle invalid error codes without calling BUG() (Dan Carpenter)   
  - bnx2x: fix page fault following EEH recovery (David Christensen)   
  - netlabel: fix shift wrapping bug in netlbl_catmap_setlong() (Dmitry Mastykin)   
  - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock (Chengfeng Ye)   
  - idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM (Baoquan He)   
  - net: usb: qmi_wwan: add Quectel EM05GV2 (Martin Kohn)   
  - security: keys: perform capable check only on privileged operations (Christian Göttsche)   
  - ASoc: codecs: ES8316: Fix DMIC config (Edgar)   
  - fs/nls: make load_nls() take a const parameter (Saeed Mirzamohammadi)   
  - s390/dasd: use correct number of retries for ERP requests (Stefan Haberland)   
  - m68k: Fix invalid .section syntax (Ben Hutchings)   
  - ethernet: atheros: fix return value check in atl1c_tso_csum() (Yuanjun Gong)   
  - ASoC: da7219: Flush pending AAD IRQ when suspending (Dmytro Maluka)   
  - 9p: virtio: make sure 'offs' is initialized in zc_request (Dominique Martinet)   
  - lib/ubsan: remove returns-nonnull-attribute checks (Andrey Ryabinin)   
  - pinctrl: amd: Don't show `Invalid config param` errors (Mario Limonciello)   
  - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (Ryusuke Konishi)   
  - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() (Ryusuke Konishi)   
  - serial: sc16is7xx: fix bug when first setting GPIO direction (Hugo Villeneuve)   
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (Zheng Wang) [Orabug: 35282808] {CVE-2023-1989}
  - HID: wacom: remove the battery when the EKR is off (Aaron Armstrong Skomra)   
  - USB: serial: option: add FOXCONN T99W368/T99W373 product (Slark Xiao)   
  - USB: serial: option: add Quectel EM05G variant (0x030e) (Martin Kohn)   
  - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules (Christoph Hellwig)   
  - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff (Christoph Hellwig)   
  - mmc: au1xmmc: force non-modular build and remove symbol_get usage (Christoph Hellwig)   
  - ARM: pxa: remove use of symbol_get() (Arnd Bergmann)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.2.el7uek]
changelog:
  - x86: change default to spec_store_bypass_disable=prctl spectre_v2_user=prctl (Andrea Arcangeli)  [Orabug: 35905888]  
  - LTS version: 4.14.328 (Saeed Mirzamohammadi)   
  - Bluetooth: hci_event: Fix using memcmp when comparing keys (Luiz Augusto von Dentz)   
  - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (Kees Cook)   
  - Bluetooth: hci_sock: fix slab oob read in create_monitor_event (Edward AD)   
  - gpio: vf610: set value before the direction to avoid a glitch (Haibo Chen)   
  - s390/pci: fix iommu bitmap allocation (Niklas Schnelle)   
  - perf: Disallow mis-matched inherited group reads (Saeed Mirzamohammadi)   
  - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (Puliang Lu)   
  - USB: serial: option: add entry for Sierra EM9191 with new firmware (Benoît Monin)   
  - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (Fabio Porcedda)   
  - ACPI: irq: Fix incorrect return value in acpi_register_gsi() (Sunil V L)   
  - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" (Andy Shevchenko)   
  - mmc: core: Capture correct oemid-bits for eMMC cards (Avri Altman)   
  - sky2: Make sure there is at least one frag_addr available (Kees Cook)   
  - wifi: cfg80211: avoid leaking stack data into trace (Benjamin Berg)   
  - wifi: mac80211: allow transmitting EAPOL frames with tainted key (Wen Gong)   
  - Bluetooth: hci_core: Fix build warnings (Luiz Augusto von Dentz)   
  - Bluetooth: Avoid redundant authentication (Ying Hsu)   
  - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (Ma Ke)   
  - tracing: relax trace_event_eval_update() execution with cond_resched() (Clément Léger)   
  - ata: libata-eh: Fix compilation warning in ata_eh_link_report() (Damien Le Moal)   
  - gpio: timberdale: Fix potential deadlock on &tgpio->lock (Chengfeng Ye)   
  - overlayfs: set ctime when setting mtime and atime (Jeff Layton)   
  - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (Heiner Kallweit)   
  - btrfs: initialize start_slot in btrfs_log_prealloc_extents (Josef Bacik)   
  - ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone (Tony Lindgren)   
  - i40e: prevent crash on probe if hw registers have invalid values (Michal Schmidt)   
  - net: usb: smsc95xx: Fix an error code in smsc95xx_reset() (Dan Carpenter)   
  - net: rfkill: gpio: prevent value glitch during probe (Josua Mayer)   
  - net: ipv6: fix return value check in esp_remove_trailer (Ma Ke)   
  - net: ipv4: fix return value check in esp_remove_trailer (Ma Ke)   
  - xfrm: fix a data-race in xfrm_gen_index() (Saeed Mirzamohammadi)   
  - netfilter: nft_payload: fix wrong mac header matching (Florian Westphal)   
  - KVM: x86: Mask LVTPC when handling a PMI (Jim Mattson)   
  - regmap: fix NULL deref on lookup (Johan Hovold)   
  - nfc: nci: fix possible NULL pointer dereference in send_acknowledge() (Krzysztof Kozlowski)   
  - Bluetooth: avoid memcmp() out of bounds warning (Arnd Bergmann)   
  - Bluetooth: hci_event: Fix coding style (Luiz Augusto von Dentz)   
  - Bluetooth: vhci: Fix race when opening vhci device (Arkadiusz Bokowy)   
  - Bluetooth: Fix a refcnt underflow problem for hci_conn (Ziyang Xuan)   
  - Bluetooth: Reject connection with the device which has same BD_ADDR (Lee, Chun-Yi) [Orabug: 35959597] {CVE-2020-26555}
  - Bluetooth: hci_event: Ignore NULL link key (Lee, Chun-Yi)   
  - usb: hub: Guard against accesses to uninitialized BOS descriptors (Ricardo Cañuelo)   
  - x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs (Borislav Petkov (AMD))   
  - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call (Krishna Kurapati)   
  - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio (Piyush Mehta)   
  - pinctrl: avoid unsafe code pattern in find_pinctrl() (Dmitry Torokhov)   
  - cgroup: Remove duplicates in cgroup v1 tasks file (Michal Koutný)   
  - Input: xpad - add PXN V900 support (Matthias Berndt)   
  - Input: powermate - fix use-after-free in powermate_config_complete (Javier Carrasco)   
  - ceph: fix incorrect revoked caps assert in ceph_fill_file_size() (Xiubo Li)   
  - mcb: remove is_added flag from mcb_device struct (Jorge Sanjuan Garcia)   
  - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug (Alexander Zangerl)   
  - iio: pressure: bmp280: Fix NULL pointer exception (Phil Elwell)   
  - usb: musb: Modify the "HWVers" register address (Xingxing Luo)   
  - usb: musb: Get the musb_qh poniter after musb_giveback (Xingxing Luo)   
  - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read (Javier Carrasco)   
  - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer (Wesley Cheng)   
  - workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() (Waiman Long)   
  - nfc: nci: assert requested protocol is valid (Jeremy Cline)   
  - ixgbe: fix crash with empty VF macvlan list (Dan Carpenter)   
  - drm/vmwgfx: fix typo of sizeof argument (Konstantin Meskhidze)   
  - ieee802154: ca8210: Fix a potential UAF in ca8210_probe (Dinghao Liu)   
  - drm: etvnaviv: fix bad backport leading to warning (Martin Fuzzey)   
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (Hans de Goede)   
  - RDMA/cxgb4: Check skb value for failure to allocate (Artem Chernyshev)   
  - LTS version: 4.14.327 (Saeed Mirzamohammadi)   
  - parisc: Restore __ldcw_align for PA-RISC 2.0 processors (John David Anglin)   
  - RDMA/mlx5: Fix NULL string error (Shay Drory)   
  - RDMA/cma: Fix truncation compilation warning in make_cma_ports (Leon Romanovsky)   
  - gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() (Bartosz Golaszewski)   
  - IB/mlx4: Fix the size of a buffer in add_port_entries() (Christophe JAILLET)   
  - cpupower: add Makefile dependencies for install targets (Ivan Babrou)   
  - sctp: update hb timer immediately after users change hb_interval (Xin Long)   
  - sctp: update transport state when processing a dupcook packet (Xin Long)   
  - tcp: fix delayed ACKs for MSS boundary condition (Neal Cardwell)   
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Shigeru Yoshida)   
  - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (David Howells)   
  - modpost: add missing else to the "of" check (Mauricio Faria de Oliveira)   
  - scsi: target: core: Fix deadlock due to recursive locking (Junxiao Bi)   
  - regmap: rbtree: Fix wrong register marked as in-cache when creating new node (Richard Fitzgerald)   
  - drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close() (Alexandra Diupina)   
  - ubi: Refuse attaching if mtd's erasesize is 0 (Zhihao Cheng)   
  - wifi: mwifiex: Fix tlv_buf_left calculation (Gustavo A. R. Silva)   
  - scsi: zfcp: Fix a double put in zfcp_port_enqueue() (Dinghao Liu)   
  - media: dvb: symbol fixup for dvb_attach() - again (Greg Kroah-Hartman)   
  - ata: libata: disallow dev-initiated LPM transitions to unsupported states (Niklas Cassel)   
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Budimir Markovic) [Orabug: 35810543] {CVE-2023-4623}
  - ext4: fix rec_len verify error (Shida Zhang)   
  - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (George Kennedy)   
  - fs: binfmt_elf_efpic: fix personality for ELF-FDPIC (Greg Ungerer)   
  - ata: libata-sata: increase PMP SRST timeout to 10s (Matthias Schiffer)   
  - ata: libata-core: Fix port and device removal (Damien Le Moal)   
  - ata: libata-core: Fix ata_port_request_pm() locking (Damien Le Moal)   
  - btrfs: properly report 0 avail for very full file systems (Josef Bacik)   
  - i2c: i801: unregister tco_pdev in i801_probe() error path (Heiner Kallweit)   
  - ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES (Niklas Cassel)   
  - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() (Pan Bian)   
  - serial: 8250_port: Check IRQ data before use (Andy Shevchenko)   
  - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Mika Westerberg)   
  - watchdog: iTCO_wdt: No need to stop the timer in probe (Mika Westerberg)   
  - ata: libahci: clear pending interrupt status (Szuying Chen)   
  - ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones (Hannes Reinecke)   
  - fbdev/sh7760fb: Depend on FB=y (Thomas Zimmermann)   
  - ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset() (Niklas Cassel)   
  - ring-buffer: Avoid softlockup in ring_buffer_resize() (Zheng Yejian)   
  - selftests/ftrace: Correctly enable event in instance-event.tc (Zheng Yejian)   
  - parisc: irq: Make irq_stack_union static to avoid sparse warning (Helge Deller)   
  - parisc: iosapic.c: Fix sparse warnings (Helge Deller)   
  - parisc: sba: Fix compile warning wrt list of SBA devices (Helge Deller)   
  - xtensa: boot/lib: fix function prototypes (Max Filippov)   
  - xtensa: boot: don't add include-dirs (Randy Dunlap)   
  - clk: tegra: fix error return case for recalc_rate (Timo Alho)   
  - i2c: mux: demux-pinctrl: check the return value of devm_kstrdup() (Xiaoke Wang)   
  - gpio: tb10x: Fix an error handling path in tb10x_gpio_probe() (Christophe JAILLET)   
  - team: fix null-ptr-deref when team device type is changed (Ziyang Xuan)   
  - powerpc/perf/hv-24x7: Update domain value check (Kajol Jain)   
  - ipv4: fix null-deref in ipv4_link_failure (Kyle Zeng)   
  - NFS/pNFS: Report EINVAL errors from connect() to the server (Trond Myklebust)


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.533.2.el7uek]
changelog:
  - LTS version: 4.14.334 (Yifei Liu)   
  - powerpc/ftrace: Fix stack teardown in ftrace_no_trace (Naveen N Rao)   
  - powerpc/ftrace: Create a dummy stackframe to fix stack unwind (Naveen N Rao)   
  - ring-buffer: Fix memory leak of free page (Steven Rostedt (Google))   
  - team: Fix use-after-free when an option instance allocation fails (Florent Revest)   
  - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS (Baokun Li)   
  - HID: hid-asus: add const to read-only outgoing usb buffer (Denis Benato)   
  - net: usb: qmi_wwan: claim interface 4 for ZTE MF290 (Lech Perczak)   
  - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation (Linus Torvalds)   
  - HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad (Aoba K)   
  - HID: hid-asus: reset the backlight brightness level on resume (Denis Benato)   
  - platform/x86: intel_telemetry: Fix kernel doc descriptions (Andy Shevchenko)   
  - bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (Coly Li)   
  - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" (Ming Lei)   
  - appletalk: Fix Use-After-Free in atalk_ioctl (Hyunwoo Kim)   
  - vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() (Nikolay Kuratov)   
  - sign-file: Fix incorrect return values check (Yusong Gao)   
  - net: Remove acked SYN flag from packet in the transmit queue correctly (Dong Chenchen)   
  - qed: Fix a potential use-after-free in qed_cxt_tables_alloc (Dinghao Liu)   
  - net/rose: Fix Use-After-Free in rose_ioctl (Hyunwoo Kim)   
  - atm: Fix Use-After-Free in do_vcc_ioctl (Hyunwoo Kim)   
  - atm: solos-pci: Fix potential deadlock on &tx_queue_lock (Chengfeng Ye)   
  - atm: solos-pci: Fix potential deadlock on &cli_queue_lock (Chengfeng Ye)   
  - qca_spi: Fix reset behavior (Stefan Wahren)   
  - qca_debug: Fix ethtool -G iface tx behavior (Stefan Wahren)   
  - qca_debug: Prevent crash on TX ring changes (Stefan Wahren)   
  - LTS version: 4.14.333 (Yifei Liu)   
  - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group (Ido Schimmel)   
  - psample: Require 'CAP_NET_ADMIN' when joining "packets" group (Ido Schimmel)   
  - genetlink: add CAP_NET_ADMIN test for multicast bind (Ido Schimmel)   
  - netlink: don't call ->netlink_bind with table lock held (Ido Schimmel)   
  - nilfs2: fix missing error check for sb_set_blocksize call (Ryusuke Konishi)   
  - KVM: s390/mm: Properly reset no-dat (Claudio Imbrenda)   
  - serial: 8250_omap: Add earlycon support for the AM654 UART controller (Ronald Wahl)   
  - serial: sc16is7xx: address RX timeout interrupt errata (Daniel Mack)   
  - parport: Add support for Brainboxes IX/UC/PX parallel cards (Cameron Williams)   
  - packet: Move reference count in packet_sock to atomic_long_t (Daniel Borkmann)   
  - tracing: Fix a possible race when disabling buffered events (Petr Pavlu)   
  - tracing: Fix incomplete locking when disabling buffered events (Petr Pavlu)   
  - tracing: Always update snapshot buffer size (Steven Rostedt (Google))   
  - nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() (Ryusuke Konishi)   
  - ALSA: pcm: fix out-of-bounds in snd_pcm_state_names (Jason Zhang)   
  - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() (Dinghao Liu)   
  - tracing: Fix a warning when allocating buffered events fails (Petr Pavlu)   
  - hwmon: (acpi_power_meter) Fix 4.29 MW bug (Armin Wolf)   
  - RDMA/bnxt_re: Correct module description string (Kalesh AP)   
  - tcp: do not accept ACK of bytes we never sent (Eric Dumazet)   
  - net: hns: fix fake link up on xge port (Yonglong Liu)   
  - drm/amdgpu: correct chunk_ptr to a pointer to chunk. (YuanShang)   
  - tg3: Increment tx_dropped in tg3_tso_bug() (Alex Pakhunov)   
  - tg3: Move the [rt]x_dropped counters to tg3_napi (Alex Pakhunov)   
  - LTS version: 4.14.332 (Yifei Liu)   
  - driver core: Release all resources during unbind before updating device links (Saravana Kannan)   
  - net: ravb: Start TX queues after HW initialization succeeded (Claudiu Beznea)   
  - ravb: Fix races between ravb_tx_timeout_work() and net related ops (Yoshihiro Shimoda)   
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet (Zhengchao Shao)   
  - btrfs: send: ensure send_fd is writable (Jann Horn)   
  - btrfs: fix off-by-one when checking chunk map includes logical address (Filipe Manana)   
  - powerpc: Don't clobber f0/vs0 during fp|altivec register save (Timothy Pearson)   
  - dm verity: don't perform FEC for failed readahead IO (Wu Bo)   
  - dm-verity: align struct dm_verity_fec_io properly (Mikulas Patocka)   
  - firewire: core: fix possible memory leak in create_units() (Yang Yingliang)   
  - pinctrl: avoid reload of p state in list iteration (Maria Yu)   
  - usb: dwc3: set the dma max_seg_size (Ricardo Ribalda)   
  - USB: serial: option: don't claim interface 4 for ZTE MF290 (Lech Perczak)   
  - USB: serial: option: fix FM101R-GL defines (Puliang Lu)   
  - USB: serial: option: add Fibocom L7xx modules (Victor Fragoso)   
  - bcache: prevent potential division by zero error (Rand Deeb)   
  - bcache: check return value from btree_node_alloc_replacement() (Coly Li)   
  - USB: serial: option: add Luat Air72*U series products (Asuna Yang)   
  - s390/dasd: protect device queue against concurrent access (Jan Höppner)   
  - mtd: rawnand: brcmnand: Fix ecc chunk calculation for erased page bitfips (Claire Lin)   
  - net: axienet: Fix check for partial TX checksum (Samuel Holland)   
  - amd-xgbe: propagate the correct speed and duplex status (Raju Rangoju)   
  - amd-xgbe: handle corner-case during sfp hotplug (Raju Rangoju)   
  - arm/xen: fix xen_vcpu_info allocation alignment (Stefano Stabellini)   
  - net: usb: ax88179_178a: fix failed operations during ax88179_reset (Jose Ignacio Tornos Martinez)   
  - ipv4: Correct/silence an endian warning in __ip_do_redirect (Kunwu Chan)   
  - drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full (Jonas Karlman)   
  - ata: pata_isapnp: Add missing error check for devm_ioport_map() (Chen Ni)   
  - drm/panel: simple: Fix Innolux G101ICE-L01 timings (Marek Vasut)   
  - RDMA/irdma: Prevent zero-length STAG registration (Christopher Bednarz) [Orabug: 36155615] {CVE-2023-25775}
  - LTS version: 4.14.331 (Yifei Liu)   
  - net: sched: fix race condition in qdisc_graft() (Eric Dumazet) [Orabug: 35250826] {CVE-2023-0590}
  - scsi: virtio_scsi: limit number of hw queues by nr_cpu_ids (Dongli Zhang)   
  - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (Kemeng Shi)   
  - ext4: correct return value of ext4_convert_meta_bg (Kemeng Shi)   
  - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Kemeng Shi)   
  - ext4: apply umask if ACL support is disabled (Max Kellermann)   
  - media: venus: hfi: fix the check to handle session buffer requirement (Vikash Garodia)   
  - media: sharp: fix sharp encoding (Sean Young)   
  - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte (Heiner Kallweit)   
  - net: dsa: lan9303: consequently nested-lock physical MDIO (Alexander Sverdlin)   
  - ALSA: info: Fix potential deadlock at disconnection (Takashi Iwai)   
  - parisc/pgtable: Do not drop upper 5 address bits of physical address (Helge Deller)   
  - parisc: Prevent booting 64-bit kernels on PA1.x machines (Helge Deller)   
  - mcb: fix error handling for different scenarios when parsing (Sanjuán García, Jorge)   
  - jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev (Zhihao Cheng)   
  - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware (Herve Codina)   
  - mmc: meson-gx: Remove setting of CMD_CFG_ERROR (Rong Chen)   
  - PM: hibernate: Clean up sync_read handling in snapshot_write_next() (Brian Geffon)   
  - PM: hibernate: Use __get_safe_page() rather than touching the list (Brian Geffon)   
  - mmc: vub300: fix an error code (Dan Carpenter)   
  - PCI/sysfs: Protect driver's D3cold preference from user space (Lukas Wunner)   
  - hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (David Woodhouse)   
  - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() (Paul Moore)   
  - audit: don't take task_lock() in audit_exe_compare() code path (Paul Moore)   
  - KVM: x86: Ignore MSR_AMD64_TW_CFG access (Maciej S. Szmigiero)   
  - randstruct: Fix gcc-plugin performance mode to stay in group (Kees Cook)   
  - media: venus: hfi: add checks to perform sanity on queue pointers (Vikash Garodia)   
  - pwm: Fix double shift bug (Dan Carpenter)   
  - gfs2: ignore negated quota changes (Bob Peterson)   
  - media: vivid: avoid integer overflow (Hans Verkuil)   
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Rajeshwar R Shinde)   
  - i2c: sun6i-p2wi: Prevent potential division by zero (Axel Lin)   
  - tty: vcc: Add check for kstrdup() in vcc_probe() (Yi Yang)   
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (Wenchao Hao)   
  - atm: iphase: Do PCI error checks on own line (Ilpo Järvinen)   
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream (Cezary Rojewski)   
  - jfs: fix array-index-out-of-bounds in diAlloc (Manas Ghandat)   
  - jfs: fix array-index-out-of-bounds in dbFindLeaf (Manas Ghandat)   
  - fs/jfs: Add validity check for db_maxag and db_agpref (Juntong Deng)   
  - fs/jfs: Add check for negative db_l2nbperpage (Juntong Deng)   
  - RDMA/hfi1: Use FIELD_GET() to extract Link Width (Ilpo Järvinen)   
  - crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin)   
  - selftests/efivarfs: create-read: fix a resource leak (zhujun2)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (Mario Limonciello)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (Mario Limonciello)   
  - net: annotate data-races around sk->sk_dst_pending_confirm (Eric Dumazet)   
  - wifi: ath10k: fix clang-specific fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix clang-specific fortify warnings (Dmitry Antipov)   
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Ping-Ke Shih)   
  - x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size (Mike Rapoport (IBM))   
  - clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware (Ronald Wahl)   
  - clocksource/drivers/timer-imx-gpt: Fix potential memory leak (Jacky Bai)   
  - locking/ww_mutex/test: Fix potential workqueue corruption (John Stultz)   
  - LTS version: 4.14.330 (Yifei Liu)   
  - btrfs: use u64 for buffer sizes in the tree search ioctls (Filipe Manana)   
  - fbdev: fsl-diu-fb: mark wr_reg_wa() static (Arnd Bergmann)   
  - netfilter: xt_recent: fix (increase) ipv6 literal buffer length (Maciej Żenczykowski)   
  - tg3: power down device only on SYSTEM_POWER_OFF (George Shuklin)   
  - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. (Kuniyuki Iwashima)   
  - dccp: Call security_inet_conn_request() after setting IPv4 addresses. (Kuniyuki Iwashima)   
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Shigeru Yoshida)   
  - llc: verify mac len before reading mac header (Willem de Bruijn)   
  - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume (Florian Fainelli)   
  - media: s3c-camif: Avoid inappropriate kfree() (Katya Orlova)   
  - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: ds: fix refcount leak in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: cs: fix possible hung task and memory leak pccardd() (Yang Yingliang)   
  - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() (Christophe JAILLET)   
  - USB: usbip: fix stub_dev hub disconnect (Jonas Blixt)   
  - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave() (Jinjie Ruan)   
  - dmaengine: ti: edma: handle irq_of_parse_and_map() errors (Dan Carpenter)   
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (Jia-Ju Bai)   
  - tty: tty_jobctrl: fix pid memleak in disassociate_ctty() (Yi Yang)   
  - mfd: dln2: Fix double put in dln2_probe (Dinghao Liu)   
  - ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails (Cezary Rojewski)   
  - sh: bios: Revive earlyprintk support (Geert Uytterhoeven)   
  - RDMA/hfi1: Workaround truncation compilation error (Leon Romanovsky)   
  - ext4: move 'ix' sanity check to corrent position (Gou Hao)   
  - ARM: 9321/1: memset: cast the constant byte to unsigned char (Kursad Oney)   
  - hwrng: geode - fix accessing registers (Jonas Gorski)   
  - firmware: ti_sci: Mark driver as non removable (Dhruva Gole)   
  - ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator (Krzysztof Kozlowski)   
  - drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe() (Christophe JAILLET)   
  - drm/radeon: possible buffer overflow (Konstantin Meskhidze)   
  - drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs (Jonas Karlman)   
  - platform/x86: wmi: Fix probe failure when failing to register WMI devices (Armin Wolf)   
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: keystone: pll: fix a couple NULL vs IS_ERR() checks (Dan Carpenter)   
  - clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies (Devi Priya)   
  - ipv6: avoid atomic fragment on GSO packets (Yan Zhai)   
  - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() (Christophe JAILLET)   
  - thermal: core: prevent potential string overflow (Dan Carpenter)   
  - wifi: rtlwifi: fix EDCA limit set by BT coexistence (Dmitry Antipov)   
  - tcp_metrics: do not create an entry from tcp_init_metrics() (Eric Dumazet)   
  - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics() (Eric Dumazet)   
  - i40e: fix potential memory leaks in i40e_remove() (Andrii Staikov)   
  - LTS version: 4.14.329 (Yifei Liu)   
  - tty: 8250: Add support for Intashield IS-100 (Cameron Williams)   
  - tty: 8250: Add support for Brainboxes UP cards (Cameron Williams)   
  - tty: 8250: Add support for additional Brainboxes UC cards (Cameron Williams)   
  - tty: 8250: Remove UC-257 and UC-431 (Cameron Williams)   
  - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility (LihaSika)   
  - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device (Vicki Pfau)   
  - remove the sx8 block driver (Christoph Hellwig)   
  - ata: ahci: fix enum constants for gcc-13 (Arnd Bergmann)   
  - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw (Su Hui)   
  - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e (Hans de Goede)   
  - scsi: mpt3sas: Fix in error path (Tomas Henzl)   
  - fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit() (Jorge Maidana)   
  - ASoC: rt5650: fix the wrong result of key button (Shuming Fan)   
  - netfilter: nfnetlink_log: silence bogus compiler warning (Florian Westphal)   
  - fbdev: atyfb: only use ioremap_uc() on i386 and ia64 (Arnd Bergmann)   
  - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport (Dmitry Torokhov)   
  - dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe (Zhang Shurong)   
  - irqchip/stm32-exti: add missing DT IRQ flag translation (Ben Wolsieffer)   
  - ASoC: simple-card: fixup asoc_simple_probe() error handling (Kuninori Morimoto)   
  - x86: Fix .brk attribute in linker script (Juergen Gross)   
  - rpmsg: Fix possible refcount leak in rpmsg_register_device_override() (Hangyu Hua)   
  - rpmsg: glink: Release driver_override (Bjorn Andersson)   
  - rpmsg: Fix calling device_lock() on non-initialized device (Krzysztof Kozlowski)   
  - rpmsg: Fix kfree() of static memory on setting driver_override (Krzysztof Kozlowski)   
  - driver: platform: Add helper for safer setting of driver_override (Krzysztof Kozlowski)   
  - x86/mm: Fix RESERVE_BRK() for older binutils (Josh Poimboeuf)   
  - x86/mm: Simplify RESERVE_BRK() (Josh Poimboeuf) [Orabug: 34335626] {CVE-2022-23816} {CVE-2022-29901}
  - x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility (Thomas Gleixner)   
  - nfsd: lock_rename() needs both directories to live on the same fs (Al Viro)   
  - f2fs: fix to do sanity check on inode type during garbage collection (Chao Yu)   
  - kobject: Fix slab-out-of-bounds in fill_kobj_path() (Wang Hai) [Orabug: 35924075] {CVE-2023-45863}
  - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper() (Lukasz Majczak)   
  - ARM: 8933/1: replace Sun/Solaris style flag on section directive (Nick Desaulniers)   
  - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (Ivan Vecera)   
  - gtp: uapi: fix GTPA_MAX (Pablo Neira Ayuso)   
  - tcp: fix wrong RTO timeout when received SACK reneging (Fred Chen)   
  - r8152: Increase USB control msg timeout to 5000ms as per spec (Douglas Anderson)   
  - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry (Mateusz Palczewski)   
  - treewide: Spelling fix in comment (Kunwu Chan)   
  - virtio_balloon: Fix endless deflation and inflation on arm64 (Gavin Shan)   
  - mcb-lpc: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - mcb: Return actual parsed size when reading chameleon table (Rodríguez Barbarin, José Javier)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.534.1.el7uek]
changelog:
  -  LTS version: 4.14.336 (Yifei Liu)   
  - mmc: core: Cancel delayed work before releasing host (Geert Uytterhoeven)   
  - mmc: rpmb: fixes pause retune on all RPMB partitions. (Jorge Ramirez-Ortiz)   
  - firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards (Takashi Sakamoto)   
  - i40e: fix use-after-free in i40e_aqc_add_filters() (Ke Xiao)   
  - net: bcmgenet: Fix FCS generation for fragmented skbuffs (Adrian Cinal)   
  - net: sched: em_text: fix possible memory leak in em_text_destroy() (Hangyu Hua)   
  - nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local (Siddh Raman Pant)   
  - LTS version: 4.14.335 (Yifei Liu)   
  - block: Don't invalidate pagecache for invalid falloc modes (Sarthak Kukreti)   
  - dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() (Mikulas Patocka)   
  - net: 9p: avoid freeing uninit memory in p9pdu_vreadf (Fedor Pchelkin)   
  - Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent (Luiz Augusto von Dentz)   
  - USB: serial: option: add Quectel RM500Q R13 firmware support (Reinhard Speyerer)   
  - USB: serial: option: add Foxconn T99W265 with new baseline (Slark Xiao)   
  - USB: serial: option: add Quectel EG912Y module support (Alper Ak)   
  - USB: serial: ftdi_sio: update Actisense PIDs constant names (Mark Glover)   
  - wifi: cfg80211: fix certs build to not depend on file order (Johannes Berg)   
  - wifi: cfg80211: Add my certificate (Chen-Yu Tsai)   
  - iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table (Javier Carrasco)   
  - Input: ipaq-micro-keys - add error handling for devm_kmemdup (Haoran Liu)   
  - iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw (Su Hui)   
  - ethernet: atheros: fix a memleak in atl1e_setup_ring_resources (Zhipeng Lu)   
  - net: sched: ife: fix potential use-after-free (Eric Dumazet)   
  - wifi: mac80211: mesh_plink: fix matches_local logic (Johannes Berg)   
  - s390/vx: fix save/restore of fpu kernel context (Heiko Carstens)   
  - ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init (Kunwu Chan)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.534.2.el7uek]
changelog:
  - workqueue: Make sure struct worker is accessible for wq_worker_comm() (Tejun Heo)  [Orabug: 36300552]  
  - workqueue: Show the latest workqueue name in /proc/PID/{comm,stat,status} (Tejun Heo)  [Orabug: 36300552]  
  - workqueue: Set worker->desc to workqueue name by default (Tejun Heo)  [Orabug: 36300552]  
  - workqueue: Make worker_attach/detach_pool() update worker->pool (Tejun Heo)  [Orabug: 36300552]  
  - workqueue: Replace pool->attach_mutex with global wq_pool_attach_mutex (Tejun Heo)  [Orabug: 36300552]


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.534.3.el7uek]
changelog:
  - scsi: megaraid_sas: Correct value passed to scsi_device_lookup() (Guixin Liu)  [Orabug: 36345169]  
  - scsi: megaraid_sas: Update max supported LD IDs to 240 (Chandrakanth Patil)  [Orabug: 36344166]


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.535.1.el7uek]
changelog:
  - mm: avoid conflict between MADV_DOEXEC and upstream advice values (Anthony Yznaga)  [Orabug: 36334310]  
  - net/rds: print PPID/COMM of process doing user reset on RDS connection (Juan Garcia)  [Orabug: 36248431]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.535.2.el7uek]
changelog:
  - Fix null ptr in rds_tcp_recv_path (Allison Henderson)  [Orabug: 33499812]  
  - LTS version: v4.14.338 (Saeed Mirzamohammadi)   
  - crypto: scompress - initialize per-CPU variables on each CPU (Sebastian Andrzej Siewior)   
  - Revert "NFSD: Fix possible sleep during nfsd4_release_lockowner()" (Greg Kroah-Hartman)   
  - i2c: s3c24xx: fix transferring more than one message in polling mode (Marek Szyprowski)   
  - i2c: s3c24xx: fix read transfers in polling mode (Marek Szyprowski)   
  - kdb: Fix a potential buffer overflow in kdb_local() (Christophe JAILLET)   
  - kdb: Censor attempts to set PROMPT without ENABLE_MEM_READ (Daniel Thompson)   
  - ipvs: avoid stat macros calls from preemptible context (Fedor Pchelkin)   
  - net: ravb: Fix dma_addr_t truncation in error case (Nikita Yushchenko)   
  - serial: imx: Correct clock error message in function probe() (Christoph Niedermaier)   
  - apparmor: avoid crash when parsed profile name is empty (Fedor Pchelkin)   
  - MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup() (Christophe JAILLET)   
  - MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup() (Christophe JAILLET)   
  - HID: wacom: Correct behavior when processing some confidence == false touches (Jason Gerecke)   
  - wifi: mwifiex: configure BSSID consistently when starting AP (David Lin)   
  - wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors (Ilpo Järvinen)   
  - wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code (Ilpo Järvinen)   
  - fbdev: flush deferred work in fb_deferred_io_fsync() (Nam Cao)   
  - ALSA: oxygen: Fix right channel of capture volume mixer (Takashi Iwai)   
  - usb: mon: Fix atomicity violation in mon_bin_vma_fault (Gui-Dong Han)   
  - usb: chipidea: wait controller resume finished for wakeup irq (Xu Yang)   
  - usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart (Uttkarsh Aggarwal)   
  - usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host() (Xu Yang)   
  - tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug (Heiko Carstens)   
  - binder: fix unused alloc->free_async_space (Carlos Llamas)   
  - binder: fix race between mmput() and do_exit() (Carlos Llamas)   
  - Input: atkbd - use ab83 as id when skipping the getid command (Hans de Goede)   
  - binder: fix async space check for 0-sized buffers (Carlos Llamas)   
  - watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling (Stefan Wahren)   
  - watchdog: set cdev owner before adding (Curtis Klein)   
  - gpu/drm/radeon: fix two memleaks in radeon_vm_init (Zhipeng Lu)   
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Zhipeng Lu)   
  - drm/amd/pm: fix a double-free in si_dpm_init (Zhipeng Lu)   
  - media: dvbdev: drop refcount on error path in dvb_device_open() (Dan Carpenter)   
  - media: cx231xx: fix a memleak in cx231xx_init_isoc (Zhipeng Lu)   
  - drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table (Zhipeng Lu)   
  - drm/radeon/dpm: fix a memleak in sumo_parse_power_table (Zhipeng Lu)   
  - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Yang Yingliang)   
  - drm/drv: propagate errors from drm_modeset_register_all() (Dmitry Baryshkov)   
  - drm/msm/mdp4: flush vblank event on disable (Dmitry Baryshkov)   
  - ASoC: cs35l34: Fix GPIO name and drop legacy include (Linus Walleij)   
  - ASoC: cs35l33: Fix GPIO name and drop legacy include (Linus Walleij)   
  - drm/radeon: check return value of radeon_ring_lock() (Nikita Zhandarovich)   
  - drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() (Nikita Zhandarovich)   
  - drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() (Nikita Zhandarovich)   
  - f2fs: fix to avoid dirent corruption (Chao Yu)   
  - drm/bridge: Fix typo in post_disable() description (Dario Binacchi)   
  - media: pvrusb2: fix use after free on context disconnection (Ricardo B. Marliere)   
  - RDMA/usnic: Silence uninitialized symbol smatch warnings (Leon Romanovsky)   
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (Eric Dumazet)   
  - Bluetooth: Fix bogus check for re-auth no supported with non-ssp (Luiz Augusto von Dentz)   
  - wifi: rtlwifi: rtl8192se: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8192ee: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8192de: using calculate_bit_shift() (Su Hui)   
  - rtlwifi: rtl8192de: make arrays static const, makes object smaller (Colin Ian King)   
  - wifi: rtlwifi: rtl8192ce: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8192cu: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8192c: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: add calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior (Su Hui)   
  - rtlwifi: Use ffs in <foo>_phy_calculate_bit_shift (Joe Perches)   
  - firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() (Christophe JAILLET)   
  - net/ncsi: Fix netlink major/minor version numbers (Peter Delevoryas)   
  - ncsi: internal.h: Fix a spello (Bhaskar Chowdhury)   
  - wifi: libertas: stop selecting wext (Arnd Bergmann)   
  - bpf, lpm: Fix check prefixlen before walking trie (Florian Lehner)   
  - NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT (Trond Myklebust)   
  - crypto: scomp - fix req->dst buffer overflow (Chengming Zhou)   
  - crypto: scompress - Use per-CPU struct instead multiple variables (Sebastian Andrzej Siewior)   
  - crypto: scompress - return proper error code for allocation failure (Sebastian Andrzej Siewior)   
  - crypto: sahara - do not resize req->src when doing hash operations (Ovidiu Panait)   
  - crypto: sahara - fix processing hash requests with req->nbytes < sg->length (Ovidiu Panait)   
  - crypto: sahara - improve error handling in sahara_sha_process() (Ovidiu Panait)   
  - crypto: sahara - fix wait_for_completion_timeout() error handling (Ovidiu Panait)   
  - crypto: sahara - fix ahash reqsize (Ovidiu Panait)   
  - crypto: virtio - Wait for tasklet to complete on device remove (wangyangxin)   
  - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() (Sergey Shtylyov)   
  - crypto: sahara - fix error handling in sahara_hw_descriptor_create() (Ovidiu Panait)   
  - crypto: sahara - fix processing requests with cryptlen < sg->length (Ovidiu Panait)   
  - crypto: sahara - fix ahash selftest failure (Ovidiu Panait)   
  - crypto: sahara - remove FLAGS_NEW_KEY logic (Ovidiu Panait)   
  - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu)   
  - crypto: ccp - fix memleak in ccp_init_dm_workarea (Dinghao Liu)   
  - crypto: virtio - Handle dataq logic with tasklet (Gonglei (Arei))   
  - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier (ZhaoLong Wang)   
  - calipso: fix memory leak in netlbl_calipso_add_pass() (Gavrilov Ilia)   
  - netlabel: remove unused parameter in netlbl_netlink_auditinfo() (Zheng Yejian)   
  - net: netlabel: Fix kerneldoc warnings (Andrew Lunn)   
  - ACPI: video: check for error while searching for backlight device parent (Nikita Kiryushin)   
  - mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response (Ronald Monthero)   
  - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Kunwu Chan)   
  - powerpc/powernv: Add a null pointer check in opal_event_init() (Kunwu Chan)   
  - selftests/powerpc: Fix error handling in FPU/VMX preemption tests (Michael Ellerman)   
  - powerpc/pseries/memhp: Fix access beyond end of drmem array (Nathan Lynch)   
  - powerpc/pseries/memhotplug: Quieten some DLPAR operations (Laurent Dufour)   
  - powerpc/44x: select I2C for CURRITUCK (Randy Dunlap)   
  - powerpc: remove redundant 'default n' from Kconfig-s (Bartlomiej Zolnierkiewicz)   
  - powerpc: add crtsavres.o to always-y instead of extra-y (Masahiro Yamada)   
  - EDAC/thunderx: Fix possible out-of-bounds string access (Arnd Bergmann)   
  - x86/lib: Fix overflow when counting digits (Colin Ian King)   
  - coresight: etm4x: Fix width of CCITMIN field (James Clark)   
  - uio: Fix use-after-free in uio_open (Guanghui Feng)   
  - binder: fix comment on binder_alloc_new_buf() return value (Carlos Llamas)   
  - drm/crtc: fix uninitialized variable use (Jani Nikula)   
  - Input: xpad - add Razer Wolverine V2 support (Luca Weiss)   
  - ARC: fix spare error (Vineet Gupta)   
  - s390/scm: fix virtual vs physical address confusion (Vineeth Vijayan)   
  - Input: atkbd - skip ATKBD_CMD_GETID in translated mode (Hans de Goede)   
  - reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)   
  - ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI (Steven Rostedt (Google))   
  - tracing: Add size check when printing trace_marker output (Steven Rostedt (Google))   
  - tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing (Steven Rostedt (Google))   
  - drm/crtc: Fix uninit-value bug in drm_mode_setcrtc (Ziqi Zhao)   
  - jbd2: correct the printing of write_flags in jbd2_write_superblock() (Zhang Yi)   
  - clk: rockchip: rk3128: Fix HCLK_OTG gate register (Weihao Li)   
  - drm/exynos: fix a potential error pointer dereference (Xiang Yang)   
  - ASoC: da7219: Support low DC impedance headset (David Rau)   
  - net/tg3: fix race condition in tg3_reset_task() (Thinh Tran)   
  - ASoC: rt5650: add mutex to avoid the jack detection failure (Shuming Fan)   
  - ASoC: cs43130: Fix incorrect frame delay configuration (Maciej Strozek)   
  - ASoC: cs43130: Fix the position of const qualifier (Maciej Strozek)   
  - f2fs: explicitly null-terminate the xattr list (Eric Biggers)   
  - LTS version: v4.14.337 (Saeed Mirzamohammadi)   
  - ipv6: remove max_size check inline with ipv4 (Saeed Mirzamohammadi)   
  - ipv6: make ip6_rt_gc_expire an atomic_t (Saeed Mirzamohammadi)   
  - net/dst: use a smaller percpu_counter batch for dst entries accounting (Eric Dumazet)   
  - net: add a route cache full diagnostic message (Peter Oskolkov)   
  - netfilter: nf_tables: Reject tables of unsupported family (Phil Sutter)   
  - fuse: nlookup missing decrement in fuse_direntplus_link (ruanmeisi)   
  - mm: fix unmap_mapping_range high bits shift bug (Jiajun Xie)   
  - mm/memory-failure: check the mapcount of the precise page (Matthew Wilcox (Oracle))   
  - bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters() (Michael Chan)   
  - asix: Add check for usbnet_get_endpoints (Chen Ni)   
  - net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues (Dinghao Liu)   
  - net/qla3xxx: switch from 'pci_' to 'dma_' API (Christophe JAILLET)


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.533.2.el7uek]
changelog:
  - LTS version: 4.14.334 (Yifei Liu)   
  - powerpc/ftrace: Fix stack teardown in ftrace_no_trace (Naveen N Rao)   
  - powerpc/ftrace: Create a dummy stackframe to fix stack unwind (Naveen N Rao)   
  - ring-buffer: Fix memory leak of free page (Steven Rostedt (Google))   
  - team: Fix use-after-free when an option instance allocation fails (Florent Revest)   
  - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS (Baokun Li)   
  - HID: hid-asus: add const to read-only outgoing usb buffer (Denis Benato)   
  - net: usb: qmi_wwan: claim interface 4 for ZTE MF290 (Lech Perczak)   
  - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation (Linus Torvalds)   
  - HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad (Aoba K)   
  - HID: hid-asus: reset the backlight brightness level on resume (Denis Benato)   
  - platform/x86: intel_telemetry: Fix kernel doc descriptions (Andy Shevchenko)   
  - bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (Coly Li)   
  - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" (Ming Lei)   
  - appletalk: Fix Use-After-Free in atalk_ioctl (Hyunwoo Kim)   
  - vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() (Nikolay Kuratov)   
  - sign-file: Fix incorrect return values check (Yusong Gao)   
  - net: Remove acked SYN flag from packet in the transmit queue correctly (Dong Chenchen)   
  - qed: Fix a potential use-after-free in qed_cxt_tables_alloc (Dinghao Liu)   
  - net/rose: Fix Use-After-Free in rose_ioctl (Hyunwoo Kim)   
  - atm: Fix Use-After-Free in do_vcc_ioctl (Hyunwoo Kim) [Orabug: 36229395] {CVE-2023-51780}
  - atm: solos-pci: Fix potential deadlock on &tx_queue_lock (Chengfeng Ye)   
  - atm: solos-pci: Fix potential deadlock on &cli_queue_lock (Chengfeng Ye)   
  - qca_spi: Fix reset behavior (Stefan Wahren)   
  - qca_debug: Fix ethtool -G iface tx behavior (Stefan Wahren)   
  - qca_debug: Prevent crash on TX ring changes (Stefan Wahren)   
  - LTS version: 4.14.333 (Yifei Liu)   
  - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group (Ido Schimmel)   
  - psample: Require 'CAP_NET_ADMIN' when joining "packets" group (Ido Schimmel)   
  - genetlink: add CAP_NET_ADMIN test for multicast bind (Ido Schimmel)   
  - netlink: don't call ->netlink_bind with table lock held (Ido Schimmel)   
  - nilfs2: fix missing error check for sb_set_blocksize call (Ryusuke Konishi)   
  - KVM: s390/mm: Properly reset no-dat (Claudio Imbrenda)   
  - serial: 8250_omap: Add earlycon support for the AM654 UART controller (Ronald Wahl)   
  - serial: sc16is7xx: address RX timeout interrupt errata (Daniel Mack)   
  - parport: Add support for Brainboxes IX/UC/PX parallel cards (Cameron Williams)   
  - packet: Move reference count in packet_sock to atomic_long_t (Daniel Borkmann)   
  - tracing: Fix a possible race when disabling buffered events (Petr Pavlu)   
  - tracing: Fix incomplete locking when disabling buffered events (Petr Pavlu)   
  - tracing: Always update snapshot buffer size (Steven Rostedt (Google))   
  - nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() (Ryusuke Konishi)   
  - ALSA: pcm: fix out-of-bounds in snd_pcm_state_names (Jason Zhang)   
  - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() (Dinghao Liu)   
  - tracing: Fix a warning when allocating buffered events fails (Petr Pavlu)   
  - hwmon: (acpi_power_meter) Fix 4.29 MW bug (Armin Wolf)   
  - RDMA/bnxt_re: Correct module description string (Kalesh AP)   
  - tcp: do not accept ACK of bytes we never sent (Eric Dumazet)   
  - net: hns: fix fake link up on xge port (Yonglong Liu)   
  - drm/amdgpu: correct chunk_ptr to a pointer to chunk. (YuanShang)   
  - tg3: Increment tx_dropped in tg3_tso_bug() (Alex Pakhunov)   
  - tg3: Move the [rt]x_dropped counters to tg3_napi (Alex Pakhunov)   
  - LTS version: 4.14.332 (Yifei Liu)   
  - driver core: Release all resources during unbind before updating device links (Saravana Kannan)   
  - net: ravb: Start TX queues after HW initialization succeeded (Claudiu Beznea)   
  - ravb: Fix races between ravb_tx_timeout_work() and net related ops (Yoshihiro Shimoda)   
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet (Zhengchao Shao)   
  - btrfs: send: ensure send_fd is writable (Jann Horn)   
  - btrfs: fix off-by-one when checking chunk map includes logical address (Filipe Manana)   
  - powerpc: Don't clobber f0/vs0 during fp|altivec register save (Timothy Pearson)   
  - dm verity: don't perform FEC for failed readahead IO (Wu Bo)   
  - dm-verity: align struct dm_verity_fec_io properly (Mikulas Patocka)   
  - firewire: core: fix possible memory leak in create_units() (Yang Yingliang)   
  - pinctrl: avoid reload of p state in list iteration (Maria Yu)   
  - usb: dwc3: set the dma max_seg_size (Ricardo Ribalda)   
  - USB: serial: option: don't claim interface 4 for ZTE MF290 (Lech Perczak)   
  - USB: serial: option: fix FM101R-GL defines (Puliang Lu)   
  - USB: serial: option: add Fibocom L7xx modules (Victor Fragoso)   
  - bcache: prevent potential division by zero error (Rand Deeb)   
  - bcache: check return value from btree_node_alloc_replacement() (Coly Li)   
  - USB: serial: option: add Luat Air72*U series products (Asuna Yang)   
  - s390/dasd: protect device queue against concurrent access (Jan Höppner)   
  - mtd: rawnand: brcmnand: Fix ecc chunk calculation for erased page bitfips (Claire Lin)   
  - net: axienet: Fix check for partial TX checksum (Samuel Holland)   
  - amd-xgbe: propagate the correct speed and duplex status (Raju Rangoju)   
  - amd-xgbe: handle corner-case during sfp hotplug (Raju Rangoju)   
  - arm/xen: fix xen_vcpu_info allocation alignment (Stefano Stabellini)   
  - net: usb: ax88179_178a: fix failed operations during ax88179_reset (Jose Ignacio Tornos Martinez)   
  - ipv4: Correct/silence an endian warning in __ip_do_redirect (Kunwu Chan)   
  - drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full (Jonas Karlman)   
  - ata: pata_isapnp: Add missing error check for devm_ioport_map() (Chen Ni)   
  - drm/panel: simple: Fix Innolux G101ICE-L01 timings (Marek Vasut)   
  - RDMA/irdma: Prevent zero-length STAG registration (Christopher Bednarz) [Orabug: 36155615] {CVE-2023-25775}
  - LTS version: 4.14.331 (Yifei Liu)   
  - net: sched: fix race condition in qdisc_graft() (Eric Dumazet) [Orabug: 35250826] {CVE-2023-0590}
  - scsi: virtio_scsi: limit number of hw queues by nr_cpu_ids (Dongli Zhang)   
  - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (Kemeng Shi)   
  - ext4: correct return value of ext4_convert_meta_bg (Kemeng Shi)   
  - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Kemeng Shi)   
  - ext4: apply umask if ACL support is disabled (Max Kellermann)   
  - media: venus: hfi: fix the check to handle session buffer requirement (Vikash Garodia)   
  - media: sharp: fix sharp encoding (Sean Young)   
  - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte (Heiner Kallweit)   
  - net: dsa: lan9303: consequently nested-lock physical MDIO (Alexander Sverdlin)   
  - ALSA: info: Fix potential deadlock at disconnection (Takashi Iwai)   
  - parisc/pgtable: Do not drop upper 5 address bits of physical address (Helge Deller)   
  - parisc: Prevent booting 64-bit kernels on PA1.x machines (Helge Deller)   
  - mcb: fix error handling for different scenarios when parsing (Sanjuán García, Jorge)   
  - jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev (Zhihao Cheng)   
  - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware (Herve Codina)   
  - mmc: meson-gx: Remove setting of CMD_CFG_ERROR (Rong Chen)   
  - PM: hibernate: Clean up sync_read handling in snapshot_write_next() (Brian Geffon)   
  - PM: hibernate: Use __get_safe_page() rather than touching the list (Brian Geffon)   
  - mmc: vub300: fix an error code (Dan Carpenter)   
  - PCI/sysfs: Protect driver's D3cold preference from user space (Lukas Wunner)   
  - hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (David Woodhouse)   
  - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() (Paul Moore)   
  - audit: don't take task_lock() in audit_exe_compare() code path (Paul Moore)   
  - KVM: x86: Ignore MSR_AMD64_TW_CFG access (Maciej S. Szmigiero)   
  - randstruct: Fix gcc-plugin performance mode to stay in group (Kees Cook)   
  - media: venus: hfi: add checks to perform sanity on queue pointers (Vikash Garodia)   
  - pwm: Fix double shift bug (Dan Carpenter)   
  - gfs2: ignore negated quota changes (Bob Peterson)   
  - media: vivid: avoid integer overflow (Hans Verkuil)   
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Rajeshwar R Shinde)   
  - i2c: sun6i-p2wi: Prevent potential division by zero (Axel Lin)   
  - tty: vcc: Add check for kstrdup() in vcc_probe() (Yi Yang)   
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (Wenchao Hao)   
  - atm: iphase: Do PCI error checks on own line (Ilpo Järvinen)   
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream (Cezary Rojewski)   
  - jfs: fix array-index-out-of-bounds in diAlloc (Manas Ghandat)   
  - jfs: fix array-index-out-of-bounds in dbFindLeaf (Manas Ghandat)   
  - fs/jfs: Add validity check for db_maxag and db_agpref (Juntong Deng)   
  - fs/jfs: Add check for negative db_l2nbperpage (Juntong Deng)   
  - RDMA/hfi1: Use FIELD_GET() to extract Link Width (Ilpo Järvinen)   
  - crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin)   
  - selftests/efivarfs: create-read: fix a resource leak (zhujun2)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (Mario Limonciello)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (Mario Limonciello)   
  - net: annotate data-races around sk->sk_dst_pending_confirm (Eric Dumazet)   
  - wifi: ath10k: fix clang-specific fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix clang-specific fortify warnings (Dmitry Antipov)   
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Ping-Ke Shih)   
  - x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size (Mike Rapoport (IBM))   
  - clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware (Ronald Wahl)   
  - clocksource/drivers/timer-imx-gpt: Fix potential memory leak (Jacky Bai)   
  - locking/ww_mutex/test: Fix potential workqueue corruption (John Stultz)   
  - LTS version: 4.14.330 (Yifei Liu)   
  - btrfs: use u64 for buffer sizes in the tree search ioctls (Filipe Manana)   
  - fbdev: fsl-diu-fb: mark wr_reg_wa() static (Arnd Bergmann)   
  - netfilter: xt_recent: fix (increase) ipv6 literal buffer length (Maciej Żenczykowski)   
  - tg3: power down device only on SYSTEM_POWER_OFF (George Shuklin)   
  - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. (Kuniyuki Iwashima)   
  - dccp: Call security_inet_conn_request() after setting IPv4 addresses. (Kuniyuki Iwashima)   
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Shigeru Yoshida)   
  - llc: verify mac len before reading mac header (Willem de Bruijn)   
  - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume (Florian Fainelli)   
  - media: s3c-camif: Avoid inappropriate kfree() (Katya Orlova)   
  - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: ds: fix refcount leak in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: cs: fix possible hung task and memory leak pccardd() (Yang Yingliang)   
  - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() (Christophe JAILLET)   
  - USB: usbip: fix stub_dev hub disconnect (Jonas Blixt)   
  - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave() (Jinjie Ruan)   
  - dmaengine: ti: edma: handle irq_of_parse_and_map() errors (Dan Carpenter)   
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (Jia-Ju Bai)   
  - tty: tty_jobctrl: fix pid memleak in disassociate_ctty() (Yi Yang)   
  - mfd: dln2: Fix double put in dln2_probe (Dinghao Liu)   
  - ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails (Cezary Rojewski)   
  - sh: bios: Revive earlyprintk support (Geert Uytterhoeven)   
  - RDMA/hfi1: Workaround truncation compilation error (Leon Romanovsky)   
  - ext4: move 'ix' sanity check to corrent position (Gou Hao)   
  - ARM: 9321/1: memset: cast the constant byte to unsigned char (Kursad Oney)   
  - hwrng: geode - fix accessing registers (Jonas Gorski)   
  - firmware: ti_sci: Mark driver as non removable (Dhruva Gole)   
  - ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator (Krzysztof Kozlowski)   
  - drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe() (Christophe JAILLET)   
  - drm/radeon: possible buffer overflow (Konstantin Meskhidze)   
  - drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs (Jonas Karlman)   
  - platform/x86: wmi: Fix probe failure when failing to register WMI devices (Armin Wolf)   
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: keystone: pll: fix a couple NULL vs IS_ERR() checks (Dan Carpenter)   
  - clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies (Devi Priya)   
  - ipv6: avoid atomic fragment on GSO packets (Yan Zhai)   
  - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() (Christophe JAILLET)   
  - thermal: core: prevent potential string overflow (Dan Carpenter)   
  - wifi: rtlwifi: fix EDCA limit set by BT coexistence (Dmitry Antipov)   
  - tcp_metrics: do not create an entry from tcp_init_metrics() (Eric Dumazet)   
  - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics() (Eric Dumazet)   
  - i40e: fix potential memory leaks in i40e_remove() (Andrii Staikov)   
  - LTS version: 4.14.329 (Yifei Liu)   
  - tty: 8250: Add support for Intashield IS-100 (Cameron Williams)   
  - tty: 8250: Add support for Brainboxes UP cards (Cameron Williams)   
  - tty: 8250: Add support for additional Brainboxes UC cards (Cameron Williams)   
  - tty: 8250: Remove UC-257 and UC-431 (Cameron Williams)   
  - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility (LihaSika)   
  - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device (Vicki Pfau)   
  - remove the sx8 block driver (Christoph Hellwig)   
  - ata: ahci: fix enum constants for gcc-13 (Arnd Bergmann)   
  - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw (Su Hui)   
  - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e (Hans de Goede)   
  - scsi: mpt3sas: Fix in error path (Tomas Henzl)   
  - fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit() (Jorge Maidana)   
  - ASoC: rt5650: fix the wrong result of key button (Shuming Fan)   
  - netfilter: nfnetlink_log: silence bogus compiler warning (Florian Westphal)   
  - fbdev: atyfb: only use ioremap_uc() on i386 and ia64 (Arnd Bergmann)   
  - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport (Dmitry Torokhov)   
  - dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe (Zhang Shurong)   
  - irqchip/stm32-exti: add missing DT IRQ flag translation (Ben Wolsieffer)   
  - ASoC: simple-card: fixup asoc_simple_probe() error handling (Kuninori Morimoto)   
  - x86: Fix .brk attribute in linker script (Juergen Gross)   
  - rpmsg: Fix possible refcount leak in rpmsg_register_device_override() (Hangyu Hua)   
  - rpmsg: glink: Release driver_override (Bjorn Andersson)   
  - rpmsg: Fix calling device_lock() on non-initialized device (Krzysztof Kozlowski)   
  - rpmsg: Fix kfree() of static memory on setting driver_override (Krzysztof Kozlowski)   
  - driver: platform: Add helper for safer setting of driver_override (Krzysztof Kozlowski)   
  - x86/mm: Fix RESERVE_BRK() for older binutils (Josh Poimboeuf)   
  - x86/mm: Simplify RESERVE_BRK() (Josh Poimboeuf) [Orabug: 34335626] {CVE-2022-23816} {CVE-2022-29901}
  - x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility (Thomas Gleixner)   
  - nfsd: lock_rename() needs both directories to live on the same fs (Al Viro)   
  - f2fs: fix to do sanity check on inode type during garbage collection (Chao Yu)   
  - kobject: Fix slab-out-of-bounds in fill_kobj_path() (Wang Hai) [Orabug: 35924075] {CVE-2023-45863}
  - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper() (Lukasz Majczak)   
  - ARM: 8933/1: replace Sun/Solaris style flag on section directive (Nick Desaulniers)   
  - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (Ivan Vecera)   
  - gtp: uapi: fix GTPA_MAX (Pablo Neira Ayuso)   
  - tcp: fix wrong RTO timeout when received SACK reneging (Fred Chen)   
  - r8152: Increase USB control msg timeout to 5000ms as per spec (Douglas Anderson)   
  - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry (Mateusz Palczewski)   
  - treewide: Spelling fix in comment (Kunwu Chan)   
  - virtio_balloon: Fix endless deflation and inflation on arm64 (Gavin Shan)   
  - mcb-lpc: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - mcb: Return actual parsed size when reading chameleon table (Rodríguez Barbarin, José Javier)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.535.2.el7uek]
changelog:
  - Fix null ptr in rds_tcp_recv_path (Allison Henderson)  [Orabug: 33499812]  
  - LTS version: v4.14.338 (Saeed Mirzamohammadi)   
  - crypto: scompress - initialize per-CPU variables on each CPU (Sebastian Andrzej Siewior)   
  - Revert "NFSD: Fix possible sleep during nfsd4_release_lockowner()" (Greg Kroah-Hartman)   
  - i2c: s3c24xx: fix transferring more than one message in polling mode (Marek Szyprowski)   
  - i2c: s3c24xx: fix read transfers in polling mode (Marek Szyprowski)   
  - kdb: Fix a potential buffer overflow in kdb_local() (Christophe JAILLET)   
  - kdb: Censor attempts to set PROMPT without ENABLE_MEM_READ (Daniel Thompson)   
  - ipvs: avoid stat macros calls from preemptible context (Fedor Pchelkin)   
  - net: ravb: Fix dma_addr_t truncation in error case (Nikita Yushchenko)   
  - serial: imx: Correct clock error message in function probe() (Christoph Niedermaier)   
  - apparmor: avoid crash when parsed profile name is empty (Fedor Pchelkin)   
  - MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup() (Christophe JAILLET)   
  - MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup() (Christophe JAILLET)   
  - HID: wacom: Correct behavior when processing some confidence == false touches (Jason Gerecke)   
  - wifi: mwifiex: configure BSSID consistently when starting AP (David Lin)   
  - wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors (Ilpo Järvinen)   
  - wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code (Ilpo Järvinen)   
  - fbdev: flush deferred work in fb_deferred_io_fsync() (Nam Cao)   
  - ALSA: oxygen: Fix right channel of capture volume mixer (Takashi Iwai)   
  - usb: mon: Fix atomicity violation in mon_bin_vma_fault (Gui-Dong Han)   
  - usb: chipidea: wait controller resume finished for wakeup irq (Xu Yang)   
  - usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart (Uttkarsh Aggarwal)   
  - usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host() (Xu Yang)   
  - tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug (Heiko Carstens)   
  - binder: fix unused alloc->free_async_space (Carlos Llamas)   
  - binder: fix race between mmput() and do_exit() (Carlos Llamas)   
  - Input: atkbd - use ab83 as id when skipping the getid command (Hans de Goede)   
  - binder: fix async space check for 0-sized buffers (Carlos Llamas)   
  - watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling (Stefan Wahren)   
  - watchdog: set cdev owner before adding (Curtis Klein)   
  - gpu/drm/radeon: fix two memleaks in radeon_vm_init (Zhipeng Lu)   
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Zhipeng Lu)   
  - drm/amd/pm: fix a double-free in si_dpm_init (Zhipeng Lu)   
  - media: dvbdev: drop refcount on error path in dvb_device_open() (Dan Carpenter)   
  - media: cx231xx: fix a memleak in cx231xx_init_isoc (Zhipeng Lu)   
  - drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table (Zhipeng Lu)   
  - drm/radeon/dpm: fix a memleak in sumo_parse_power_table (Zhipeng Lu)   
  - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Yang Yingliang)   
  - drm/drv: propagate errors from drm_modeset_register_all() (Dmitry Baryshkov)   
  - drm/msm/mdp4: flush vblank event on disable (Dmitry Baryshkov)   
  - ASoC: cs35l34: Fix GPIO name and drop legacy include (Linus Walleij)   
  - ASoC: cs35l33: Fix GPIO name and drop legacy include (Linus Walleij)   
  - drm/radeon: check return value of radeon_ring_lock() (Nikita Zhandarovich)   
  - drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() (Nikita Zhandarovich)   
  - drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() (Nikita Zhandarovich)   
  - f2fs: fix to avoid dirent corruption (Chao Yu)   
  - drm/bridge: Fix typo in post_disable() description (Dario Binacchi)   
  - media: pvrusb2: fix use after free on context disconnection (Ricardo B. Marliere)   
  - RDMA/usnic: Silence uninitialized symbol smatch warnings (Leon Romanovsky)   
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (Eric Dumazet)   
  - Bluetooth: Fix bogus check for re-auth no supported with non-ssp (Luiz Augusto von Dentz)   
  - wifi: rtlwifi: rtl8192se: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8192ee: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8192de: using calculate_bit_shift() (Su Hui)   
  - rtlwifi: rtl8192de: make arrays static const, makes object smaller (Colin Ian King)   
  - wifi: rtlwifi: rtl8192ce: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8192cu: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8192c: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: add calculate_bit_shift() (Su Hui)   
  - wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior (Su Hui)   
  - rtlwifi: Use ffs in <foo>_phy_calculate_bit_shift (Joe Perches)   
  - firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() (Christophe JAILLET)   
  - net/ncsi: Fix netlink major/minor version numbers (Peter Delevoryas)   
  - ncsi: internal.h: Fix a spello (Bhaskar Chowdhury)   
  - wifi: libertas: stop selecting wext (Arnd Bergmann)   
  - bpf, lpm: Fix check prefixlen before walking trie (Florian Lehner)   
  - NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT (Trond Myklebust)   
  - crypto: scomp - fix req->dst buffer overflow (Chengming Zhou)   
  - crypto: scompress - Use per-CPU struct instead multiple variables (Sebastian Andrzej Siewior)   
  - crypto: scompress - return proper error code for allocation failure (Sebastian Andrzej Siewior)   
  - crypto: sahara - do not resize req->src when doing hash operations (Ovidiu Panait)   
  - crypto: sahara - fix processing hash requests with req->nbytes < sg->length (Ovidiu Panait)   
  - crypto: sahara - improve error handling in sahara_sha_process() (Ovidiu Panait)   
  - crypto: sahara - fix wait_for_completion_timeout() error handling (Ovidiu Panait)   
  - crypto: sahara - fix ahash reqsize (Ovidiu Panait)   
  - crypto: virtio - Wait for tasklet to complete on device remove (wangyangxin)   
  - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() (Sergey Shtylyov)   
  - crypto: sahara - fix error handling in sahara_hw_descriptor_create() (Ovidiu Panait)   
  - crypto: sahara - fix processing requests with cryptlen < sg->length (Ovidiu Panait)   
  - crypto: sahara - fix ahash selftest failure (Ovidiu Panait)   
  - crypto: sahara - remove FLAGS_NEW_KEY logic (Ovidiu Panait)   
  - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu)   
  - crypto: ccp - fix memleak in ccp_init_dm_workarea (Dinghao Liu)   
  - crypto: virtio - Handle dataq logic with tasklet (Gonglei (Arei))   
  - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier (ZhaoLong Wang)   
  - calipso: fix memory leak in netlbl_calipso_add_pass() (Gavrilov Ilia)   
  - netlabel: remove unused parameter in netlbl_netlink_auditinfo() (Zheng Yejian)   
  - net: netlabel: Fix kerneldoc warnings (Andrew Lunn)   
  - ACPI: video: check for error while searching for backlight device parent (Nikita Kiryushin)   
  - mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response (Ronald Monthero)   
  - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Kunwu Chan)   
  - powerpc/powernv: Add a null pointer check in opal_event_init() (Kunwu Chan)   
  - selftests/powerpc: Fix error handling in FPU/VMX preemption tests (Michael Ellerman)   
  - powerpc/pseries/memhp: Fix access beyond end of drmem array (Nathan Lynch)   
  - powerpc/pseries/memhotplug: Quieten some DLPAR operations (Laurent Dufour)   
  - powerpc/44x: select I2C for CURRITUCK (Randy Dunlap)   
  - powerpc: remove redundant 'default n' from Kconfig-s (Bartlomiej Zolnierkiewicz)   
  - powerpc: add crtsavres.o to always-y instead of extra-y (Masahiro Yamada)   
  - EDAC/thunderx: Fix possible out-of-bounds string access (Arnd Bergmann)   
  - x86/lib: Fix overflow when counting digits (Colin Ian King)   
  - coresight: etm4x: Fix width of CCITMIN field (James Clark)   
  - uio: Fix use-after-free in uio_open (Guanghui Feng)   
  - binder: fix comment on binder_alloc_new_buf() return value (Carlos Llamas)   
  - drm/crtc: fix uninitialized variable use (Jani Nikula)   
  - Input: xpad - add Razer Wolverine V2 support (Luca Weiss)   
  - ARC: fix spare error (Vineet Gupta)   
  - s390/scm: fix virtual vs physical address confusion (Vineeth Vijayan)   
  - Input: atkbd - skip ATKBD_CMD_GETID in translated mode (Hans de Goede)   
  - reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)   
  - ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI (Steven Rostedt (Google))   
  - tracing: Add size check when printing trace_marker output (Steven Rostedt (Google))   
  - tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing (Steven Rostedt (Google))   
  - drm/crtc: Fix uninit-value bug in drm_mode_setcrtc (Ziqi Zhao)   
  - jbd2: correct the printing of write_flags in jbd2_write_superblock() (Zhang Yi)   
  - clk: rockchip: rk3128: Fix HCLK_OTG gate register (Weihao Li)   
  - drm/exynos: fix a potential error pointer dereference (Xiang Yang)   
  - ASoC: da7219: Support low DC impedance headset (David Rau)   
  - net/tg3: fix race condition in tg3_reset_task() (Thinh Tran)   
  - ASoC: rt5650: add mutex to avoid the jack detection failure (Shuming Fan)   
  - ASoC: cs43130: Fix incorrect frame delay configuration (Maciej Strozek)   
  - ASoC: cs43130: Fix the position of const qualifier (Maciej Strozek)   
  - f2fs: explicitly null-terminate the xattr list (Eric Biggers)   
  - LTS version: v4.14.337 (Saeed Mirzamohammadi)   
  - ipv6: remove max_size check inline with ipv4 (Saeed Mirzamohammadi)   
  - ipv6: make ip6_rt_gc_expire an atomic_t (Saeed Mirzamohammadi)   
  - net/dst: use a smaller percpu_counter batch for dst entries accounting (Eric Dumazet)   
  - net: add a route cache full diagnostic message (Peter Oskolkov)   
  - netfilter: nf_tables: Reject tables of unsupported family (Phil Sutter) [Orabug: 36192153] {CVE-2023-6040}
  - fuse: nlookup missing decrement in fuse_direntplus_link (ruanmeisi)   
  - mm: fix unmap_mapping_range high bits shift bug (Jiajun Xie)   
  - mm/memory-failure: check the mapcount of the precise page (Matthew Wilcox (Oracle))   
  - bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters() (Michael Chan)   
  - asix: Add check for usbnet_get_endpoints (Chen Ni)   
  - net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues (Dinghao Liu)   
  - net/qla3xxx: switch from 'pci_' to 'dma_' API (Christophe JAILLET)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.536.2.el7uek]
changelog:
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal)  [Orabug: 36466544]  {CVE-2024-1086} 
  - RDMA/cm: add timeout to cm_destroy_id wait (Manjunath Patil)  [Orabug: 36280065]  
  - mm: avoid heavy swap lock contention when unmapping with ktask (Anthony Yznaga)  [Orabug: 36201622]  
  - mm: use less threads when unmapping some large VMAs (Anthony Yznaga)  [Orabug: 36201622]  
  - LTS version: v4.14.341 (Yifei Liu)   
  - gpio: 74x164: Enable output pins after registers are reset (Arturas Moskvinas)   
  - cachefiles: fix memory leak in cachefiles_add_cache() (Baokun Li)   
  - mmc: core: Fix eMMC initialization with 1-bit bus connection (Ivan Semenov)   
  - btrfs: dev-replace: properly validate device names (David Sterba)   
  - wifi: nl80211: reject iftype change with mesh ID change (Johannes Berg)   
  - gtp: fix use-after-free and null-ptr-deref in gtp_newlink() (Alexander Ofitserov)   
  - ALSA: Drop leftover snd-rtctimer stuff from Makefile (Takashi Iwai)   
  - power: supply: bq27xxx-i2c: Do not free non existing IRQ (Hans de Goede)   
  - efi/capsule-loader: fix incorrect allocation size (Arnd Bergmann)   
  - Bluetooth: Enforce validation on max value of connection interval (Kai-Heng Feng)   
  - Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST (Luiz Augusto von Dentz)   
  - Bluetooth: Avoid potential use-after-free in hci_error_reset (Ying Hsu)   
  - net: usb: dm9601: fix wrong return value in dm9601_mdio_read (Javier Carrasco)   
  - lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected (Oleksij Rempel)   
  - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter (Ryosuke Yasuoka)   
  - LTS version: v4.14.340 (Yifei Liu)   
  - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio (Bart Van Assche)   
  - KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() (Oliver Upton)   
  - PCI/MSI: Prevent MSI hardware interrupt number truncation (Vidya Sagar)   
  - s390: use the correct count for __iowrite64_copy() (Jason Gunthorpe)   
  - packet: move from strlcpy with unused retval to strscpy (Wolfram Sang)   
  - ipv6: sr: fix possible use-after-free and null-ptr-deref (Vasiliy Kovalev)   
  - nouveau: fix function cast warnings (Arnd Bergmann)   
  - scsi: jazz_esp: Only build if SCSI core is builtin (Randy Dunlap)   
  - RDMA/srpt: fix function pointer cast warnings (Arnd Bergmann)   
  - RDMA/srpt: Support specifying the srpt_service_guid parameter (Bart Van Assche)   
  - IB/hfi1: Fix a memleak in init_credit_return (Zhipeng Lu)   
  - usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs (Krishna Kurapati)   
  - l2tp: pass correct message length to ip6_append_data (Tom Parkin)   
  - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() (Vasiliy Kovalev)   
  - dm-crypt: don't modify the data when using authenticated encryption (Mikulas Patocka)   
  - mm: memcontrol: switch to rcu protection in drain_all_stock() (Roman Gushchin)   
  - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Alexandra Winter)   
  - virtio-blk: Ensure no requests in virtqueues before deleting vqs. (Yi Sun)   
  - firewire: core: send bus reset promptly on gap count error (Takashi Sakamoto)   
  - hwmon: (coretemp) Enlarge per package core count limit (Zhang Rui)   
  - regulator: pwm-regulator: Add validity checks in continuous .get_voltage (Martin Blumenstingl)   
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Baokun Li)   
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Baokun Li)   
  - ahci: asm1166: correct count of reported ports (Conrad Kostecki)   
  - fbdev: sis: Error out if pixclock equals zero (Fullway Wang)   
  - fbdev: savage: Error out if pixclock equals zero (Fullway Wang)   
  - wifi: mac80211: fix race condition on enabling fast-xmit (Felix Fietkau)   
  - wifi: cfg80211: fix missing interfaces when dumping (Michal Kazior)   
  - dmaengine: shdma: increase size of 'dev_id' (Vinod Koul)   
  - scsi: target: core: Add TMF to tmr_list handling (Dmitry Bogdanov)   
  - sched/rt: Disallow writing invalid values to sched_rt_period_us (Cyril Hrubis)   
  - sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset (Cyril Hrubis)   
  - sched/rt: Fix sysctl_sched_rr_timeslice intial value (Cyril Hrubis)   
  - nilfs2: replace WARN_ONs for invalid DAT metadata block requests (Ryusuke Konishi)   
  - memcg: add refcnt for pcpu stock to avoid UAF problem in drain_all_stock() (GONG, Ruiqi)   
  - net/sched: Retire dsmark qdisc (Jamal Hadi Salim)   
  - net/sched: Retire ATM qdisc (Jamal Hadi Salim)   
  - net/sched: Retire CBQ qdisc (Jamal Hadi Salim)   
  - LTS version: v4.14.339 (Yifei Liu)   
  - PCI: Only override AMD USB controller if required (Guilherme G. Piccoli)   
  - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (Dan Carpenter)   
  - lsm: new security_file_ioctl_compat() hook (Alfred Piccioni)   
  - nilfs2: fix potential bug in end_buffer_async_write (Ryusuke Konishi)   
  - sched/membarrier: reduce the ability to hammer on sys_membarrier (Linus Torvalds)   
  - Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" (Junxiao Bi)   
  - pmdomain: core: Move the unused cleanup to a _sync initcall (Konrad Dybcio)   
  - irqchip/irq-brcmstb-l2: Add write memory barrier before exit (Doug Berger)   
  - nfp: use correct macro for LengthSelect in BAR config (Daniel Basilio)   
  - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() (Ryusuke Konishi)   
  - nilfs2: fix data corruption in dsync block recovery for small block sizes (Ryusuke Konishi)   
  - ALSA: hda/conexant: Add quirk for SWS JS201D (bo liu)   
  - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Steve Wahl)   
  - staging: iio: ad5933: fix type mismatch regression (David Schiller)   
  - ext4: fix double-free of blocks due to wrong extents moved_len (Baokun Li)   
  - nfc: nci: free rx_data_reassembly skb on NCI device cleanup (Fedor Pchelkin)   
  - firewire: core: correct documentation of fw_csr_string() kernel API (Takashi Sakamoto)   
  - scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" (Lee Duncan)   
  - usb: f_mass_storage: forbid async queue when shutdown happen (yuan linyu)   
  - USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT (Oliver Neukum)   
  - HID: wacom: Do not register input devices until after hid_hw_start (Jason Gerecke)   
  - HID: wacom: generic: Avoid reporting a serial of '0' to userspace (Tatsunosuke Tobita)   
  - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Zach O'Keefe)   
  - tracing/trigger: Fix to return error if failed to alloc snapshot (Masami Hiramatsu (Google))   
  - i40e: Fix waiting for queues of all VSIs to be disabled (Ivan Vecera)   
  - MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler (Guenter Roeck)   
  - net: sysfs: Fix /sys/class/net/<iface> path for statistics (Breno Leitao)   
  - Documentation: net-sysfs: describe missing statistics (Julian Wiedmann)   
  - ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work() (Alexey Khoroshilov)   
  - spi: ppc4xx: Drop write-only variable (Uwe Kleine-König)   
  - btrfs: send: return EOPNOTSUPP on unknown flags (David Sterba)   
  - vhost: use kzalloc() instead of kmalloc() followed by memset() (Prathu Baronia)   
  - Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID (Hans de Goede)   
  - USB: serial: cp210x: add ID for IMST iM871A-USB (Leonard Dallmayr)   
  - USB: serial: option: add Fibocom FM101-GL variant (Puliang Lu)   
  - USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e (JackBB Wu)   
  - net/af_iucv: clean up a try_then_request_module() (Julian Wiedmann)   
  - netfilter: nft_compat: restrict match/target protocol to u16 (Pablo Neira Ayuso)   
  - netfilter: nft_compat: reject unused compat flag (Pablo Neira Ayuso)   
  - ppp_async: limit MRU to 64K (Eric Dumazet)   
  - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (Shigeru Yoshida)   
  - rxrpc: Fix response to PING RESPONSE ACKs to a dead call (David Howells)   
  - inet: read sk->sk_family once in inet_recv_error() (Eric Dumazet)   
  - hwmon: (aspeed-pwm-tacho) mutex for tach reading (Loic Prylli)   
  - atm: idt77252: fix a memleak in open_card_ubr0 (Zhipeng Lu)   
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Tony Lindgren)   
  - dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV (Frank Li)   
  - bonding: remove print in bond_verify_device_path (Zhengchao Shao)   
  - HID: apple: Add 2021 magic keyboard FN key mapping (Benjamin Berg)   
  - HID: apple: Add support for the 2021 Magic Keyboard (Alex Henrie)   
  - HID: apple: Swap the Fn and Left Control keys on Apple keyboards (free5lot)   
  - net: sysfs: Fix /sys/class/net/<iface> path (Breno Leitao)   
  - af_unix: fix lockdep positive in sk_diag_dump_icons() (Eric Dumazet)   
  - net: ipv4: fix a memleak in ip_setup_cork (Zhipeng Lu)   
  - net: Fix one possible memleak in ip_setup_cork (Gao Feng)   
  - netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger (Pablo Neira Ayuso)   
  - llc: call sock_orphan() at release time (Eric Dumazet)   
  - ipv6: Ensure natural alignment of const ipv6 loopback and router addresses (Helge Deller)   
  - ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550() (Christophe JAILLET)   
  - ixgbe: Refactor overtemp event handling (Jedrzej Jagielski)   
  - ixgbe: Remove non-inclusive language (Piotr Skajewski)   
  - net: remove unneeded break (Tom Rix)   
  - scsi: isci: Fix an error code problem in isci_io_request_build() (Su Hui)   
  - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update (Edward Adam Davis)   
  - drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()' (Srinivasan Shanmugam)   
  - ceph: fix deadlock or deadcode of misusing dget() (Xiubo Li)   
  - virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings (Zhu Yanjun)   
  - libsubcmd: Fix memory leak in uniq() (Ian Rogers)   
  - usb: hub: Replace hardcoded quirk value with BIT() macro (Hardik Gajjar)   
  - mfd: ti_am335x_tscadc: Fix TI SoC dependencies (Peter Robinson)   
  - um: net: Fix return type of uml_net_start_xmit() (Nathan Chancellor)   
  - um: Don't use vfprintf() for os_info() (Benjamin Berg)   
  - um: Fix naming clash between UML and scheduler (Anton Ivanov)   
  - leds: trigger: panic: Don't register panic notifier if creating the trigger failed (Heiner Kallweit)   
  - clk: mmp: pxa168: Fix memory leak in pxa168_clk_init() (Kuan-Wei Chiu)   
  - clk: hi3620: Fix memory leak in hi3620_mmc_clk_init() (Kuan-Wei Chiu)   
  - media: ddbridge: fix an error code problem in ddb_probe (Su Hui)   
  - IB/ipoib: Fix mcast list locking (Daniel Vacek)   
  - drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time (Douglas Anderson)   
  - ALSA: hda: Intel: add HDA_ARL PCI ID support (Pierre-Louis Bossart)   
  - ALSA: hda: Add Icelake PCI ID (Guneshwor Singh)   
  - PCI: add INTEL_HDA_ARL to pci_ids.h (Pierre-Louis Bossart)   
  - media: stk1160: Fixed high volume of stk1160_dbg messages (Ghanshyam Agrawal)   
  - drm/mipi-dsi: Fix detach call without attach (Tomi Valkeinen)   
  - drm/framebuffer: Fix use of uninitialized variable (Tomi Valkeinen)   
  - drm/drm_file: fix use of uninitialized variable (Tomi Valkeinen)   
  - RDMA/IPoIB: Fix error code return in ipoib_mcast_join (Jack Wang)   
  - fast_dput(): handle underflows gracefully (Al Viro)   
  - ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument (Cristian Ciocaltea)   
  - wifi: cfg80211: free beacon_ies when overridden from hidden BSS (Benjamin Berg)   
  - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() (Su Hui)   
  - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices (Zenm Chen)   
  - md: Whenassemble the array, consult the superblock of the freshest device (Alex Lyakas)   
  - ARM: dts: imx23/28: Fix the DMA controller node name (Fabio Estevam)   
  - ARM: dts: imx23-sansa: Use preferred i2c-gpios properties (Fabio Estevam)   
  - ARM: dts: imx27-apf27dev: Fix LED name (Fabio Estevam)   
  - ARM: dts: imx1: Fix sram node (Fabio Estevam)   
  - ARM: dts: imx27: Fix sram node (Fabio Estevam)   
  - ARM: dts: imx: Use flash@0,0 pattern (Fabio Estevam)   
  - ARM: dts: imx25/27-eukrea: Fix RTC node name (Fabio Estevam)   
  - ARM: dts: rockchip: fix rk3036 hdmi ports node (Johan Jonker)   
  - scsi: libfc: Fix up timeout error in fc_fcp_rec_error() (Hannes Reinecke)   
  - scsi: libfc: Don't schedule abort twice (Hannes Reinecke)   
  - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Hou Tao)   
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Minsuk Kang)   
  - ARM: dts: imx7s: Fix nand-controller #size-cells (Alexander Stein)   
  - ARM: dts: imx7s: Fix lcdif compatible (Alexander Stein)   
  - bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk (Zhengchao Shao)   
  - PCI: Add no PM reset quirk for NVIDIA Spectrum devices (Ido Schimmel)   
  - scsi: lpfc: Fix possible file string name overflow when updating firmware (Justin Tee)   
  - ext4: unify the type of flexbg_size to unsigned int (Baokun Li)   
  - SUNRPC: Fix a suspicious RCU usage warning (Anna Schumaker)   
  - KVM: s390: fix setting of fpc register (Heiko Carstens)   
  - s390/ptrace: handle setting of fpc register correctly (Heiko Carstens)   
  - jfs: fix array-index-out-of-bounds in diNewExt (Edward Adam Davis)   
  - rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() (Oleg Nesterov)   
  - pstore/ram: Fix crash when setting number of cpus to an odd number (Weichen Chen)   
  - jfs: fix uaf in jfs_evict_inode (Edward Adam Davis)   
  - jfs: fix array-index-out-of-bounds in dbAdjTree (Manas Ghandat)   
  - jfs: fix slab-out-of-bounds Read in dtSearch (Manas Ghandat)   
  - UBSAN: array-index-out-of-bounds in dtSplitRoot (Osama Muhammad)   
  - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree (Osama Muhammad)   
  - ACPI: extlog: fix NULL pointer dereference check (Prarit Bhargava)   
  - PNP: ACPI: fix fortify warning (Dmitry Antipov)   
  - ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop (Yuluo Qiu)   
  - audit: Send netlink ACK before setting connection in auditd_set (Chris Riches)   
  - powerpc/lib: Validate size for vector operations (Naveen N Rao)   
  - powerpc/mm: Fix build failures due to arch_reserved_kernel_pages() (Michael Ellerman)   
  - powerpc: Fix build error due to is_valid_bugaddr() (Michael Ellerman)   
  - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Kunwu Chan)   
  - tick/sched: Preserve number of idle sleeps across CPU hotplug events (Tim Chen)   
  - mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan (Xi Ruoyao)   
  - drm/bridge: nxp-ptn3460: simplify some error checking (Dan Carpenter)   
  - drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking (Dan Carpenter)   
  - drm: Don't unref the same fb many times by mistake due to deadlock handling (Ville Syrjälä)   
  - gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04 (Mario Limonciello)   
  - btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args (Qu Wenruo)   
  - btrfs: don't warn if discard range is not aligned to sector (David Sterba)   
  - net: fec: fix the unhandled context fault from smmu (Shenwei Wang)   
  - fjes: fix memleaks in fjes_hw_setup (Zhipeng Lu)   
  - netfilter: nf_tables: restrict anonymous set and map names to 16 bytes (Florian Westphal)   
  - net/mlx5e: fix a double-free in arfs_create_groups (Zhipeng Lu)   
  - net/mlx5: Use kfree(ft->g) in arfs_create_groups() (Denis Efremov)   
  - netlink: fix potential sleeping issue in mqueue_flush_file (Zhengchao Shao)   
  - tcp: Add memory barrier to tcp_push() (Salvatore Dipietro)   
  - net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv (Sharath Srinivasan)   
  - llc: Drop support for ETH_P_TR_802_2. (Kuniyuki Iwashima)   
  - llc: make llc_ui_sendmsg() more robust against bonding changes (Eric Dumazet)   
  - vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING (Lin Ma)   
  - drivers: core: fix kernel-doc markup for dev_err_probe() (Mauro Carvalho Chehab)   
  - driver code: print symbolic error code (Michał Mirosław)   
  - Revert "driver core: Annotate dev_err_probe() with __must_check" (Greg Kroah-Hartman)   
  - driver core: Annotate dev_err_probe() with __must_check (Andy Shevchenko)   
  - x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum (Maciej S. Szmigiero)   
  - powerpc: Use always instead of always-y in for crtsavres.o (Nathan Chancellor)   
  - block: Remove special-casing of compound pages (Matthew Wilcox (Oracle))   
  - parisc/firmware: Fix F-extend for PDC addresses (Helge Deller)   
  - rpmsg: virtio: Free driver_override when rpmsg_remove() (Xiaolei Wang)   
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Herbert Xu)   
  - PM: hibernate: Enforce ordering during image compression/decompression (Hongchen Zhang)   
  - crypto: api - Disallow identical driver names (Herbert Xu)   
  - serial: sc16is7xx: add check for unsupported SPI modes during probe (Hugo Villeneuve)   
  - spi: introduce SPI_MODE_X_MASK macro (Oleksij Rempel)   
  - driver core: add device probe log helper (Andrzej Hajda)   
  - serial: sc16is7xx: set safe default SPI clock frequency (Hugo Villeneuve)   
  - units: add the HZ macros (Daniel Lezcano)   
  - units: change from 'L' to 'UL' (Daniel Lezcano)   
  - units: Add Watt units (Daniel Lezcano)   
  - include/linux/units.h: add helpers for kelvin to/from Celsius conversion (Akinobu Mita)   
  - PCI: mediatek: Clear interrupt status before dispatching handler (qizhong cheng)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.536.3.el7uek]
changelog:
  - Revert "net/sched: Retire CBQ qdisc" (Saeed Mirzamohammadi)   
  - Revert "net/sched: Retire ATM qdisc" (Saeed Mirzamohammadi)   
  - Revert "net/sched: Retire dsmark qdisc" (Saeed Mirzamohammadi)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.536.4.el7uek]
changelog:
  - rds/rdma: print connection up/down time while dropping/connecting (Juan Garcia)  [Orabug: 36264661]  
  - bonding: rate-limit bonding driver inspect messages (Praveen Kumar Kannoju)  [Orabug: 36223525]


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2048.el7uek]
changelog:
  - RDMA/umem: Move to allocate SG table from pages (Maor Gottlieb)  [Orabug: 32005755]  
  - lib/scatterlist: Add support in dynamic allocation of SG table from pages (Maor Gottlieb)  [Orabug: 32005755]  
  - lib/scatterlist: Add SG_CHAIN and SG_END macros for LSB encodings (Anshuman Khandual)  [Orabug: 32005755]  
  - lib/scatterlist: Avoid potential scatterlist entry overflow (Tvrtko Ursulin)  [Orabug: 32005755]  
  - lib/scatterlist: Fix offset type in sg_alloc_table_from_pages (Tvrtko Ursulin)  [Orabug: 32005755]  
  - ACPI: NFIT: Add runtime firmware activate support (Dan Williams)  [Orabug: 32082058]  
  - PM, libnvdimm: Add runtime firmware activation support (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Convert to DEVICE_ATTR_ADMIN_RO() (Dan Williams)  [Orabug: 32082058]  
  - driver-core: Introduce DEVICE_ATTR_ADMIN_{RO,RW} (Dan Williams)  [Orabug: 32082058]  
  - tools/testing/nvdimm: Emulate firmware activation commands (Dan Williams)  [Orabug: 32082058]  
  - tools/testing/nvdimm: Prepare nfit_ctl_test() for ND_CMD_CALL emulation (Dan Williams)  [Orabug: 32082058]  
  - tools/testing/nvdimm: Add command debug messages (Dan Williams)  [Orabug: 32082058]  
  - tools/testing/nvdimm: Cleanup dimm index passing (Dan Williams)  [Orabug: 32082058]  
  - ACPI: NFIT: Define runtime firmware activation commands (Dan Williams)  [Orabug: 32082058]  
  - ACPI: NFIT: Move bus_dsm_mask out of generic nvdimm_bus_descriptor (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Validate command family indices (Dan Williams)  [Orabug: 32082058]  
  - hibernation_availablePM: hibernate: Incorporate concurrency handling (Domenico Andreoli)  [Orabug: 32082058]  
  - libnvdimm: Move nvdimm_bus_attribute_group to device_type (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm/of_pmem: Provide a unique name for bus provider (Aneesh Kumar K.V)  [Orabug: 32082058]  
  - libnvdimm: Move nvdimm_attribute_group to device_type (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Move nd_mapping_attribute_group to device_type (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Move nd_region_attribute_group to device_type (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Move nd_numa_attribute_group to device_type (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Move nd_device_attribute_group to device_type (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Move region attribute group definition (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm/region: Rewrite _probe_success() to _advance_seeds() (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Move attribute groups to device type (Dan Williams)  [Orabug: 32082058]  
  - acpi/nfit: improve bounds checking for 'func' (Dan Carpenter)  [Orabug: 32082058]  
  - ACPI/nfit: delete the function to_acpi_nfit_desc (Xiaochun Lee)  [Orabug: 32082058]  
  - ocfs2: initialize ip_next_orphan (Wengang Wang)  [Orabug: 32159054]  
  - lockdown: make lockdown mode available in securityfs (Alan Maguire)  [Orabug: 32164650]  
  - uek-rpm: Don't build emb2 kernel for mips (Dave Kleikamp)  [Orabug: 32176894]  
  - page_frag: Recover from memory pressure (Dongli Zhang)  [Orabug: 32177980]  
  - rds: fix out-of-tree build broken by tracepoints (Alan Maguire)  [Orabug: 32180549]


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2049.el7uek]
changelog:
  - scsi: qla2xxx: Update version to 10.02.00.103-k (Nilesh Javali)  [Orabug: 32214187]  
  - qla2xxx: back port upstream patch (Quinn Tran)  [Orabug: 32214187]  
  - scsi: scsi_transport_fc: Add FPIN fc event codes (James Smart)  [Orabug: 32214187]  
  - scsi: scsi_transport_fc: refactor event posting routines (James Smart)  [Orabug: 32214187]  
  - Revert "scsi: qla2xxx: Disable T10-DIF feature with FC-NVMe during probe" (Quinn Tran)  [Orabug: 32214187]  
  - Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" (Saurav Kashyap)  [Orabug: 32214187]  
  - scsi: qla2xxx: Check if FW supports MQ before enabling (Saurav Kashyap)  [Orabug: 32214187]  
  - scsi: qla2xxx: Allow ql2xextended_error_logging special value 1 to be set anytime (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Reduce noisy debug message (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Reduce duplicate code in reporting speed (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Indicate correct supported speeds for Mezz card (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Flush I/O on zone disable (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Flush all sessions on zone disable (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: remove incorrect sparse #ifdef (Linus Torvalds)  [Orabug: 32214187]  
  - scsi: qla2xxx: Return EBUSY on fcport deletion (Daniel Wagner)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix return of uninitialized value in rval (Colin Ian King)  [Orabug: 32214187]  
  - scsi: qla2xxx: Initialize variable in qla8044_poll_reg() (Tom Rix)  [Orabug: 32214187]  
  - scsi: qla2xxx: Do not consume srb greedily (Daniel Wagner)  [Orabug: 32214187]  
  - scsi: qla2xxx: Use constant when it is known (Pavel Machek (CIP))  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix null pointer access during disconnect from subsystem (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix inconsistent format argument type in qla_dbg.c (Ye Bin)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix inconsistent format argument type in qla_os.c (Ye Bin)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix inconsistent format argument type in tcm_qla2xxx.c (Ye Bin)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix point-to-point (N2N) device discovery issue (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix crash on session cleanup with unload (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix reset of MPI firmware (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix MPI reset needed message (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix buffer-buffer credit extraction error (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix WARN_ON in qla_nvme_register_hba (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Correct the check for sscanf() return value (Saurav Kashyap)  [Orabug: 32214187]  
  - scsi: qla2xxx: Update version to 10.02.00.102-k (Nilesh Javali)  [Orabug: 32214187]  
  - scsi: qla2xxx: Add SLER and PI control support (Saurav Kashyap)  [Orabug: 32214187]  
  - scsi: qla2xxx: Add IOCB resource tracking (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Add rport fields in debugfs (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Make tgt_port_database available in initiator mode (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix I/O errors during LIP reset tests (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Performance tweak (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix memory size truncation (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Honor status qualifier in FCP_RSP per spec (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Allow dev_loss_tmo setting for FC-NVMe devices (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Setup debugfs entries for remote ports (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix I/O failures during remote port toggle testing (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Remove unneeded variable 'rval' (Jason Yan)  [Orabug: 32214187]  
  - scsi: qla2xxx: Handle incorrect entry_type entries (Daniel Wagner)  [Orabug: 32214187]  
  - scsi: qla2xxx: Log calling function name in qla2x00_get_sp_from_handle() (Daniel Wagner)  [Orabug: 32214187]  
  - scsi: qla2xxx: Simplify return value logic in qla2x00_get_sp_from_handle() (Daniel Wagner)  [Orabug: 32214187]  
  - scsi: qla2xxx: Warn if done() or free() are called on an already freed srb (Daniel Wagner)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix the return value (Xianting Tian)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba() (Tianjia Zhang)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix wrong return value in qlt_chk_unresolv_exchg() (Tianjia Zhang)  [Orabug: 32214187]  
  - scsi: qla2xxx: Remove redundant variable initialization (Tianjia Zhang)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix the size used in a 'dma_free_coherent()' call (Christophe JAILLET)  [Orabug: 32214187]  
  - scsi: qla2xxx: Remove pci-dma-compat wrapper API (Suraj Upadhyay)  [Orabug: 32214187]  
  - scsi: qla2xxx: Remove superfluous memset() (Li Heng)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix regression on sparc64 (René Rebe)  [Orabug: 32214187]  
  - scsi: qla2xxx: Use MBX_TOV_SECONDS for mailbox command timeout values (Enzo Matsumiya)  [Orabug: 32214187]  
  - scsi: qla2xxx: Address a set of sparse warnings (Shyam Sundar)  [Orabug: 32214187]  
  - scsi: qla2xxx: SAN congestion management implementation (Shyam Sundar)  [Orabug: 32214187]  
  - scsi: qla2xxx: Change in PUREX to handle FPIN ELS requests (Shyam Sundar)  [Orabug: 32214187]  
  - scsi: qla2xxx: Introduce a function for computing the debug message prefix (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Make qla2x00_restart_isp() easier to read (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix a Coverity complaint in qla2100_fw_dump() (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Make __qla2x00_alloc_iocbs() initialize 32 bits of request_t.handle (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Remove a superfluous cast (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Initialize 'n' before using it (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Make qla82xx_flash_wait_write_finish() easier to read (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Remove the __packed annotation from struct fcp_hdr and fcp_hdr_le (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Check the size of struct fcp_hdr at compile time (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: fc: Update Descriptor definition and add RDF and Link Integrity FPINs (James Smart)  [Orabug: 32214187]  
  - scsi: fc: add FPIN ELS definition (James Smart)  [Orabug: 32214187]  
  - hv_netvsc: make recording RSS hash depend on feature flag (Stephen Hemminger)  [Orabug: 32159974]  
  - hv_netvsc: record hardware hash in skb (Stephen Hemminger)  [Orabug: 32159974]  
  - staging: rts5208: rename SG_END macro (Arnd Bergmann)  [Orabug: 32218535]  
  - misc: rtsx: rename SG_END macro (Arnd Bergmann)  [Orabug: 32218535]  
  - Linux 4.14.209 (Greg Kroah-Hartman)   
  - x86/microcode/intel: Check patch signature before saving microcode for early loading (Chen Yu)   
  - s390/dasd: fix null pointer dereference for ERP requests (Stefan Haberland)   
  - s390/cpum_sf.c: fix file permission for cpum_sfb_size (Thomas Richter)   
  - mac80211: free sta in sta_info_insert_finish() on errors (Johannes Berg)   
  - mac80211: minstrel: fix tx status processing corner case (Felix Fietkau)   
  - mac80211: minstrel: remove deferred sampling code (Felix Fietkau)   
  - xtensa: disable preemption around cache alias management calls (Max Filippov)   
  - regulator: workaround self-referent regulators (Michał Mirosław)   
  - regulator: avoid resolve_supply() infinite recursion (Michał Mirosław)   
  - regulator: fix memory leak with repeated set_machine_constraints() (Michał Mirosław)   
  - iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode (Hans de Goede)   
  - iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum (Hans de Goede)   
  - ext4: fix bogus warning in ext4_update_dx_flag() (Jan Kara)   
  - staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids (Brian O'Keefe)   
  - efivarfs: fix memory leak in efivarfs_create() (Vamshi K Sthambamkadi)   
  - tty: serial: imx: keep console clocks always on (Fugang Duan)   
  - ALSA: mixart: Fix mutex deadlock (Takashi Iwai)   
  - ALSA: ctl: fix error path at adding user-defined element set (Takashi Sakamoto)   
  - speakup: Do not let the line discipline be used several times (Samuel Thibault)   
  - powerpc/uaccess-flush: fix missing includes in kup-radix.h (Daniel Axtens)   
  - libfs: fix error cast of negative value in simple_attr_write() (Yicong Yang)   
  - xfs: revert "xfs: fix rmap key and record comparison functions" (Darrick J. Wong)   
  - regulator: ti-abb: Fix array out of bound read access on the first transition (Nishanth Menon)   
  - MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu (Zhang Qilong)   
  - ASoC: qcom: lpass-platform: Fix memory leak (Srinivasa Rao Mandadapu)   
  - can: m_can: m_can_handle_state_change(): fix state change (Wu Bo)   
  - can: peak_usb: fix potential integer overflow on shift of a int (Colin Ian King)   
  - can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() (Marc Kleine-Budde)   
  - can: ti_hecc: Fix memleak in ti_hecc_probe (Zhang Qilong)   
  - can: dev: can_restart(): post buffer from the right context (Alejandro Concepcion Rodriguez)   
  - can: af_can: prevent potential access of uninitialized member in canfd_rcv() (Anant Thazhemadam)   
  - can: af_can: prevent potential access of uninitialized member in can_rcv() (Anant Thazhemadam)   
  - perf lock: Don't free "lock_seq_stat" if read_count isn't zero (Leo Yan)   
  - ARM: dts: imx50-evk: Fix the chip select 1 IOMUX (Fabio Estevam)   
  - arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy (Sergey Matyukevich)   
  - MIPS: export has_transparent_hugepage() for modules (Randy Dunlap)   
  - Input: adxl34x - clean up a data type in adxl34x_probe() (Dan Carpenter)   
  - vfs: remove lockdep bogosity in __sb_start_write (Darrick J. Wong)   
  - arm64: psci: Avoid printing in cpu_psci_cpu_die() (Will Deacon)   
  - pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq (Jianqun Xu)   
  - net: ftgmac100: Fix crash when removing driver (Joel Stanley)   
  - tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate (Ryan Sharpelletti)   
  - net: usb: qmi_wwan: Set DTR quirk for MR400 (Filip Moc)   
  - net/mlx5: Disable QoS when min_rates on all VFs are zero (Vladyslav Tarasiuk)   
  - sctp: change to hold/put transport for proto_unreach_timer (Xin Long)   
  - qlcnic: fix error return code in qlcnic_83xx_restart_hw() (Zhang Changzhong)   
  - net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request (Xie He)   
  - net/mlx4_core: Fix init_hca fields offset (Aya Levin)   
  - netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist() (Paul Moore)   
  - netlabel: fix our progress tracking in netlbl_unlabel_staticlist() (Paul Moore)   
  - net: Have netpoll bring-up DSA management interface (Florian Fainelli)   
  - net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 (Tobias Waldekranz)   
  - net: bridge: add missing counters to ndo_get_stats64 callback (Heiner Kallweit)   
  - net: b44: fix error return code in b44_init_one() (Zhang Changzhong)   
  - mlxsw: core: Use variable timeout for EMAD retries (Ido Schimmel)   
  - inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() (Wang Hai)   
  - devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() (Wang Hai)   
  - bnxt_en: read EEPROM A2h address using page 0 (Edwin Peer)   
  - atm: nicstar: Unmap DMA on send error (Sebastian Andrzej Siewior)   
  - ah6: fix error return code in ah6_input() (Zhang Changzhong)   
  - Linux 4.14.208 (Greg Kroah-Hartman)   
  - ACPI: GED: fix -Wformat (Nick Desaulniers)   
  - KVM: x86: clflushopt should be treated as a no-op by emulation (David Edmondson)   
  - can: proc: can_remove_proc(): silence remove_proc_entry warning (Zhang Changzhong)   
  - mac80211: always wind down STA state (Johannes Berg)   
  - Input: sunkbd - avoid use-after-free in teardown paths (Dmitry Torokhov)   
  - powerpc/8xx: Always fault when _PAGE_ACCESSED is not set (Christophe Leroy)   
  - gpio: mockup: fix resource leak in error path (Bartosz Golaszewski)   
  - i2c: imx: Fix external abort on interrupt in exit paths (Krzysztof Kozlowski)   
  - i2c: imx: use clk notifier for rate changes (Lucas Stach)   
  - powerpc/64s: flush L1D after user accesses (Nicholas Piggin)   {CVE-2020-4788} 
  - powerpc/uaccess: Evaluate macro arguments once, before user access is allowed (Nicholas Piggin)   
  - powerpc: Fix __clear_user() with KUAP enabled (Andrew Donnellan)   
  - powerpc: Implement user_access_begin and friends (Christophe Leroy)   
  - powerpc: Add a framework for user access tracking (Christophe Leroy)   
  - powerpc/64s: flush L1D on kernel entry (Nicholas Piggin)   {CVE-2020-4788} 
  - powerpc/64s: move some exception handlers out of line (Daniel Axtens)   
  - powerpc/64s: Define MASKABLE_RELON_EXCEPTION_PSERIES_OOL (Daniel Axtens)   
  - Linux 4.14.207 (Greg Kroah-Hartman)   
  - mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race (Nicholas Piggin)   
  - Convert trailing spaces and periods in path components (Boris Protopopov)   
  - reboot: fix overflow parsing reboot cpu number (Matteo Croce)   
  - Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" (Matteo Croce)   
  - perf/core: Fix race in the perf_mmap_close() function (Jiri Olsa)   
  - xen/events: block rogue events for some time (Juergen Gross)   
  - xen/events: defer eoi in case of excessive number of events (Juergen Gross)   
  - xen/events: use a common cpu hotplug hook for event channels (Juergen Gross)   
  - xen/events: switch user event channels to lateeoi model (Juergen Gross)   
  - xen/pciback: use lateeoi irq binding (Juergen Gross)   
  - xen/pvcallsback: use lateeoi irq binding (Juergen Gross)   
  - xen/scsiback: use lateeoi irq binding (Juergen Gross)   
  - xen/netback: use lateeoi irq binding (Juergen Gross)   
  - xen/blkback: use lateeoi irq binding (Juergen Gross)   
  - xen/events: add a new "late EOI" evtchn framework (Juergen Gross)   
  - xen/events: fix race in evtchn_fifo_unmask() (Juergen Gross)   
  - xen/events: add a proper barrier to 2-level uevent unmasking (Juergen Gross)   
  - xen/events: avoid removing an event channel while handling it (Juergen Gross)   
  - perf/core: Fix crash when using HW tracing kernel filters (Mathieu Poirier)   
  - x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP (Anand K Mistry)   
  - random32: make prandom_u32() output unpredictable (George Spelvin)   
  - net: Update window_clamp if SOCK_RCVBUF is set (Mao Wenan)   
  - r8169: fix potential skb double free in an error path (Heiner Kallweit)   
  - vrf: Fix fast path output packet handling with async Netfilter rules (Martin Willi)   
  - net/x25: Fix null-ptr-deref in x25_connect (Martin Schiller)   
  - net/af_iucv: fix null pointer dereference on shutdown (Ursula Braun)   
  - IPv6: Set SIT tunnel hard_header_len to zero (Oliver Herms)   
  - swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb" (Stefano Stabellini)   
  - pinctrl: amd: fix incorrect way to disable debounce filter (Coiby Xu)   
  - pinctrl: amd: use higher precision for 512 RtcClk (Coiby Xu)   
  - drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] (Thomas Zimmermann)   
  - don't dump the threads that had been already exiting when zapped. (Al Viro)   
  - selinux: Fix error return code in sel_ib_pkey_sid_slow() (Chen Zhou)   
  - futex: Don't enable IRQs unconditionally in put_pi_state() (Dan Carpenter)   
  - mei: protect mei_cl_mtu from null dereference (Alexander Usyskin)   
  - usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode (Chris Brandt)   
  - uio: Fix use-after-free in uio_unregister_device() (Shin'ichiro Kawasaki)   
  - thunderbolt: Add the missed ida_simple_remove() in ring_request_msix() (Jing Xiangfeng)   
  - ext4: unlock xattr_sem properly in ext4_inline_data_truncate() (Joseph Qi)   
  - ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA (Kaixu Xia)   
  - perf: Fix get_recursion_context() (Peter Zijlstra)   
  - cosa: Add missing kfree in error path of cosa_write (Wang Hai)   
  - of/address: Fix of_node memory leak in of_dma_is_coherent (Evan Nimmo)   
  - xfs: fix a missing unlock on error in xfs_fs_map_blocks (Christoph Hellwig)   
  - xfs: fix rmap key and record comparison functions (Darrick J. Wong)   
  - xfs: fix flags argument to rmap lookup when converting shared file rmaps (Darrick J. Wong)   
  - nbd: fix a block_device refcount leak in nbd_release (Christoph Hellwig)   
  - pinctrl: aspeed: Fix GPI only function problem. (Billy Tsai)   
  - ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template (Andrew Jeffery)   
  - pinctrl: intel: Set default bias in case no particular value given (Andy Shevchenko)   
  - iommu/amd: Increase interrupt remapping table limit to 512 entries (Suravee Suthikulpanit)   
  - scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() (Hannes Reinecke)   
  - cfg80211: regulatory: Fix inconsistent format argument (Ye Bin)   
  - mac80211: fix use of skb payload instead of header (Johannes Berg)   
  - drm/amdgpu: perform srbm soft reset always on SDMA resume (Evan Quan)   
  - scsi: hpsa: Fix memory leak in hpsa_init_one() (Keita Suzuki)   
  - gfs2: check for live vs. read-only file system in gfs2_fitrim (Bob Peterson)   
  - gfs2: Add missing truncate_inode_pages_final for sd_aspace (Bob Peterson)   
  - gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free (Bob Peterson)   
  - usb: gadget: goku_udc: fix potential crashes in probe (Evgeny Novikov)   
  - ath9k_htc: Use appropriate rs_datalen type (Masashi Honma)   
  - Btrfs: fix missing error return if writeback for extent buffer never started (Filipe Manana)   
  - xfs: flush new eof page on truncate to avoid post-eof corruption (Brian Foster)   
  - can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on (Stephane Grosjean)   
  - can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping (Stephane Grosjean)   
  - can: peak_usb: add range checking in decode operations (Dan Carpenter)   
  - can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() (Oleksij Rempel)   
  - can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames (Oliver Hartkopp)   
  - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context (Vincent Mailhol)   
  - can: rx-offload: don't call kfree_skb() from IRQ context (Marc Kleine-Budde)   
  - ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (Dan Carpenter)   
  - perf tools: Add missing swap for ino_generation (Jiri Olsa)   
  - net: xfrm: fix a race condition during allocing spi (zhuoliang zhang)   
  - hv_balloon: disable warning when floor reached (Olaf Hering)   
  - genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY (Marc Zyngier)   
  - btrfs: reschedule when cloning lots of extents (Johannes Thumshirn)   
  - btrfs: sysfs: init devices outside of the chunk_mutex (Josef Bacik)   
  - nbd: don't update block size after device is started (Ming Lei)   
  - time: Prevent undefined behaviour in timespec64_to_ns() (Zeng Tao)   
  - mm: mempolicy: fix potential pte_unmap_unlock pte error (Shijie Luo)   
  - ring-buffer: Fix recursion protection transitions between interrupt context (Steven Rostedt (VMware))   
  - regulator: defer probe when trying to get voltage from unresolved supply (Michał Mirosław)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2050.el7uek]
changelog:
  - bnxt_en: Release PCI regions when DMA mask setup fails during probe. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: fix error return code in bnxt_init_board() (Zhang Changzhong)  [Orabug: 32223710]  
  - bnxt_en: Fix counter overflow logic. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Re-write PCI BARs after PCI fatal error. (Vasundhara Volam)  [Orabug: 32223710]  
  - bnxt_en: Set driver default message level. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Enable online self tests for multi-host/NPAR mode. (Vasundhara Volam)  [Orabug: 32223710]  
  - bnxt_en: Eliminate unnecessary RX resets. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Reduce unnecessary message log during RX errors. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Add a software counter for RX ring reset. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Implement RX ring reset in response to buffer errors. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Refactor bnxt_init_one_rx_ring(). (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Refactor bnxt_free_rx_skbs(). (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Update firmware interface spec to 1.10.1.68. (Vasundhara Volam)  [Orabug: 32223710]  
  - bnxt_en: Improve preset max value for ethtool -l. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Handle ethernet link being disabled by firmware. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: add basic infrastructure to support PAM4 link speeds (Edwin Peer)  [Orabug: 32223710]  
  - bnxt_en: refactor bnxt_get_fw_speed() (Edwin Peer)  [Orabug: 32223710]  
  - bnxt_en: refactor code to limit speed advertising (Edwin Peer)  [Orabug: 32223710]  
  - bnxt_en: Update firmware interface spec to 1.10.1.65. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Fix wrong flag value passed to HWRM_PORT_QSTATS_EXT fw call. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Fix HWRM_FUNC_QSTATS_EXT firmware call. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Return -EOPNOTSUPP for ETHTOOL_GREGS on VFs. (Vasundhara Volam)  [Orabug: 32223710]  
  - bnxt_en: return proper error codes in bnxt_show_temp (Edwin Peer)  [Orabug: 32223710]  
  - bnxt_en: Setup default RSS map in all scenarios. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: init RSS table for Minimal-Static VF reservation (Edwin Peer)  [Orabug: 32223710]  
  - bnxt_en: fix HWRM error when querying VF temperature (Edwin Peer)  [Orabug: 32223710]  
  - bnxt_en: Fix ethtool -S statitics with XDP or TCs enabled. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Don't query FW when netif_running() is false. (Pavan Chebbi)  [Orabug: 32223710]  
  - bnxt_en: Add support for 'ethtool -d' (Vasundhara Volam)  [Orabug: 32223710]  
  - bnxt_en: Switch over to use the 64-bit software accumulated counters. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Accumulate all counters. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Retrieve hardware masks for port counters. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Retrieve hardware counter masks from firmware if available. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Allocate additional memory for all statistics blocks. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Refactor statistics code and structures. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Use macros to define port statistics size and offset. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Update firmware interface to 1.10.1.54. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Remove PCIe non-counters from ethtool statistics (Vasundhara Volam)  [Orabug: 32223710]  
  - net: bnxt: don't complain if TC flower can't be supported (Jakub Kicinski)  [Orabug: 32223710]  
  - bnxt_en: Fix completion ring sizing with TPA enabled. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Init ethtool link settings after reading updated PHY configuration. (Vasundhara Volam)  [Orabug: 32223710]  
  - scsi: mpt3sas: Update driver version to 36.100.00.00 (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Handle trigger page after firmware update (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add persistent MPI trigger page (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add persistent SCSI sense trigger page (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add persistent Event trigger page (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add persistent Master trigger page (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add persistent trigger pages support (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Sync time periodically between driver and firmware (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Bump driver version to 35.101.00.00 (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add module parameter multipath_on_hba (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Handle vSES vphy object during HBA reset (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add bypass_dirty_port_flag parameter (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Handling HBA vSES device (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Set valid PhysicalPort in SMPPassThrough (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Update hba_port objects after host reset (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Get sas_device objects using device's rphy (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Rename transport_del_phy_from_an_existing_port() (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Get device objects using sas_address & portID (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Update hba_port's sas_address & phy_mask (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Rearrange _scsih_mark_responding_sas_device() (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Allocate memory for hba_port objects (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Define hba_port structure (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Fix ioctl timeout (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: A small correction in _base_process_reply_queue (Tomas Henzl)  [Orabug: 32242280]  
  - scsi: mpt3sas: Fix sync irqs (Tomas Henzl)  [Orabug: 32242280]  
  - scsi: mpt3sas: Detect tampered Aero and Sea adapters (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Don't call disable_irq from IRQ poll handler (Tomas Henzl)  [Orabug: 32242280]  
  - scsi: mpt3sas: Remove pci-dma-compat wrapper API (Suraj Upadhyay)  [Orabug: 32242280]  
  - scsi: mpt3sas: Remove superfluous memset() (Li Heng)  [Orabug: 32242280]  
  - scsi: mpt3sas: Update driver version to 35.100.00.00 (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Postprocessing of target and LUN reset (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add functions to check if any cmd is outstanding on Target and LUN (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Rename and export interrupt mask/unmask functions (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Cancel the running work during host reset (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Dump system registers for debugging (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Memset config_cmds.reply buffer with zeros (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Fix kdoc comments format (Damien Le Moal)  [Orabug: 32242280]  
  - scsi: mpt3sas: Fix set but unused variable (Damien Le Moal)  [Orabug: 32242280]  
  - scsi: mpt3sas: Fix error returns in BRM_status_show (Johannes Thumshirn)  [Orabug: 32242280]  
  - scsi: mpt3sas: Fix unlock imbalance (Damien Le Moal)  [Orabug: 32242280]  
  - scsi: mpt3sas: Fix spelling mistake (Flavio Suligoi)  [Orabug: 32242280]  
  - dm crypt: Allow unaligned bio buffer lengths for skcipher devices (Sudhakar Panneerselvam)  [Orabug: 31208895]  
  - vhost scsi: fix lun reset completion handling (Mike Christie)  [Orabug: 31782538]  
  - vhost scsi: Add support for LUN resets. (Mike Christie)  [Orabug: 31782538]  
  - vhost/scsi: Use copy_to_iter() to send control queue response (Bijan Mottahedeh)  [Orabug: 31782538]  
  - vhost scsi: add lun parser helper (Mike Christie)  [Orabug: 31782538]  
  - vhost scsi: fix cmd completion race (Mike Christie)  [Orabug: 31782538]  
  - vhost scsi: alloc cmds per vq instead of session (Mike Christie)  [Orabug: 31782538]  
  - vhost: add helper to check if a vq has been setup (Mike Christie)  [Orabug: 31782538]  
  - scsi: sd: Allow user to configure command retries (Mike Christie)  [Orabug: 31782538]  
  - scsi: core: Add limitless cmd retry support (Mike Christie)  [Orabug: 31782538]  
  - intel_idle: Customize IceLake server support (Chen Yu)  [Orabug: 32213908]  
  - qla2xxx: Add missing module version banner (John Donnelly)  [Orabug: 32249004]  
  - Linux 4.14.210 (Greg Kroah-Hartman)   
  - USB: core: Fix regression in Hercules audio card (Alan Stern)   
  - USB: core: add endpoint-blacklist quirk (Johan Hovold)   
  - x86/resctrl: Add necessary kernfs_put() calls to prevent refcount leak (Xiaochen Shen)   
  - x86/resctrl: Remove superfluous kernfs_get() calls to prevent refcount leak (Xiaochen Shen)   
  - usb: gadget: Fix memleak in gadgetfs_fill_super (Zhang Qilong)   
  - usb: gadget: f_midi: Fix memleak in f_midi_alloc (Zhang Qilong)   
  - USB: core: Change %pK for __user pointers to %px (Alan Stern)   
  - perf probe: Fix to die_entrypc() returns error correctly (Masami Hiramatsu)   
  - can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 (Marc Kleine-Budde)   
  - platform/x86: toshiba_acpi: Fix the wrong variable assignment (Kaixu Xia)   
  - can: gs_usb: fix endianess problem with candleLight firmware (Marc Kleine-Budde)   
  - efivarfs: revert "fix memory leak in efivarfs_create()" (Ard Biesheuvel)   
  - ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq (Lijun Pan)   
  - ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues (Lijun Pan)   
  - net: ena: set initial DMA width to avoid intel iommu issue (Shay Agroskin)   
  - nfc: s3fwrn5: use signed integer for parsing GPIO numbers (Krzysztof Kozlowski)   
  - IB/mthca: fix return value of error branch in mthca_init_cq() (Xiongfeng Wang)   
  - bnxt_en: Release PCI regions when DMA mask setup fails during probe. (Michael Chan)   
  - video: hyperv_fb: Fix the cache type when mapping the VRAM (Dexuan Cui)   
  - bnxt_en: fix error return code in bnxt_init_board() (Zhang Changzhong)   
  - bnxt_en: fix error return code in bnxt_init_one() (Zhang Changzhong)   
  - scsi: ufs: Fix race between shutdown and runtime resume flow (Stanley Chu)   
  - batman-adv: set .owner to THIS_MODULE (Taehee Yoo)   
  - phy: tegra: xusb: Fix dangling pointer on probe failure (Marc Zyngier)   
  - perf/x86: fix sysfs type mismatches (Sami Tolvanen)   
  - scsi: target: iscsi: Fix cmd abort fabric stop race (Mike Christie)   
  - scsi: libiscsi: Fix NOP race condition (Lee Duncan)   
  - dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size (Sugar Zhang)   
  - nvme: free sq/cq dbbuf pointers when dbbuf set fails (Minwoo Im)   
  - proc: don't allow async path resolution of /proc/self components (Jens Axboe)   
  - HID: Add Logitech Dinovo Edge battery quirk (Hans de Goede)   
  - x86/xen: don't unbind uninitialized lock_kicker_irq (Brian Masney)   
  - dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant (Marc Ferland)   
  - HID: hid-sensor-hub: Fix issue with devices with no report ID (Pablo Ceballos)   
  - Input: i8042 - allow insmod to succeed on devices without an i8042 controller (Hans de Goede)   
  - HID: cypress: Support Varmilo Keyboards' media hotkeys (Frank Yang)   
  - ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close (Kai Vehmanen)   
  - ALSA: hda/hdmi: Use single mutex unlock in error paths (Takashi Iwai)   
  - arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() (Will Deacon)   
  - arm64: pgtable: Fix pte_accessible() (Will Deacon)   
  - btrfs: adjust return values of btrfs_inode_by_name (Su Yue)   
  - btrfs: tree-checker: Enhance chunk checker to validate chunk profile (Qu Wenruo)   
  - PCI: Add device even if driver attach failed (Rajat Jain)   
  - wireless: Use linux/stddef.h instead of stddef.h (Hauke Mehrtens)   
  - btrfs: fix lockdep splat when reading qgroup config on mount (Filipe Manana)   
  - mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() (Gerald Schaefer)   
  - perf event: Check ref_reloc_sym before using it (Igor Lubashev)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2051.el7uek]
changelog:
  - Linux 4.14.212 (Greg Kroah-Hartman)   
  - x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes (Masami Hiramatsu)   
  - Input: i8042 - fix error return code in i8042_setup_aux() (Luo Meng)   
  - i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc() (Zhihao Cheng)   
  - gfs2: check for empty rgrp tree in gfs2_ri_update (Bob Peterson)   
  - tracing: Fix userstacktrace option for instances (Steven Rostedt (VMware))   
  - spi: bcm2835: Release the DMA channel if probe fails after dma_init (Peter Ujfalusi)   
  - spi: bcm2835: Fix use-after-free on unbind (Lukas Wunner)   
  - spi: bcm-qspi: Fix use-after-free on unbind (Lukas Wunner)   
  - spi: Introduce device-managed SPI controller allocation (Lukas Wunner)   
  - iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs (Suravee Suthikulpanit)   
  - speakup: Reject setting the speakup line discipline outside of speakup (Samuel Thibault)   
  - i2c: imx: Check for I2SR_IAL after every byte (Christian Eggers)   
  - i2c: imx: Fix reset of I2SR_IAL flag (Christian Eggers)   
  - mm/swapfile: do not sleep with a spin lock held (Qian Cai)   
  - cifs: fix potential use-after-free in cifs_echo_request() (Paulo Alcantara)   
  - ftrace: Fix updating FTRACE_FL_TRAMP (Naveen N. Rao)   
  - ALSA: hda/generic: Add option to enforce preferred_dacs pairs (Takashi Iwai)   
  - ALSA: hda/realtek - Add new codec supported for ALC897 (Kailang Yang)   
  - tty: Fix ->session locking (Jann Horn)   
  - tty: Fix ->pgrp locking in tiocspgrp() (Jann Horn)   
  - USB: serial: option: fix Quectel BG96 matching (Bjørn Mork)   
  - USB: serial: option: add support for Thales Cinterion EXS82 (Giacinto Cifelli)   
  - USB: serial: option: add Fibocom NL668 variants (Vincent Palatin)   
  - USB: serial: ch341: sort device-id entries (Johan Hovold)   
  - USB: serial: ch341: add new Product ID for CH341A (Jan-Niklas Burfeind)   
  - USB: serial: kl5kusb105: fix memleak on open (Johan Hovold)   
  - usb: gadget: f_fs: Use local copy of descriptors for userspace copy (Vamsi Krishna Samavedam)   
  - vlan: consolidate VLAN parsing code and limit max parsing depth (Toke Høiland-Jørgensen)   
  - pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(..., GPIOD_OUT_HIGH) (Hans de Goede)   
  - pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq pin to output (Hans de Goede)   
  - Linux 4.14.211 (Greg Kroah-Hartman)   
  - RDMA/i40iw: Address an mmap handler exploit in i40iw (Shiraz Saleem)   
  - Input: i8042 - add ByteSpeed touchpad to noloop table (Po-Hsu Lin)   
  - Input: xpad - support Ardwiino Controllers (Sanjay Govind)   
  - ALSA: usb-audio: US16x08: fix value count for level meters (Hector Martin)   
  - dt-bindings: net: correct interrupt flags in examples (Krzysztof Kozlowski)   
  - net/mlx5: Fix wrong address reclaim when command interface is down (Eran Ben Elisha)   
  - net: pasemi: fix error return code in pasemi_mac_open() (Zhang Changzhong)   
  - cxgb3: fix error return code in t3_sge_alloc_qset() (Zhang Changzhong)   
  - net/x25: prevent a couple of overflows (Dan Carpenter)   
  - ibmvnic: Fix TX completion error handling (Thomas Falcon)   
  - ibmvnic: Ensure that SCRQ entry reads are correctly ordered (Thomas Falcon)   
  - ipv4: Fix tos mask in inet_rtm_getroute() (Guillaume Nault)   
  - netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal (Antoine Tenart)   
  - bonding: wait for sysfs kobject destruction before freeing struct slave (Jamie Iles)   
  - usbnet: ipheth: fix connectivity with iOS 14 (Yves-Alexis Perez)   
  - tun: honor IOCB_NOWAIT flag (Jens Axboe)   
  - tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control (Alexander Duyck)   
  - sock: set sk_err to ee_errno on dequeue from errq (Willem de Bruijn)   
  - rose: Fix Null pointer dereference in rose_send_frame() (Anmol Karn)   
  - net/af_iucv: set correct sk_protocol for child sockets (Julian Wiedmann)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2052.el7uek]
changelog:
  - xenbus/xenbus_backend: Disallow pending watch messages (SeongJae Park)  [Orabug: 32253410]  {CVE-2020-29568} 
  - xen/xenbus: Count pending messages for each watch (SeongJae Park)  [Orabug: 32253410]  {CVE-2020-29568} 
  - xen/xenbus/xen_bus_type: Support will_handle watch callback (SeongJae Park)  [Orabug: 32253410]  {CVE-2020-29568} 
  - xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path() (SeongJae Park)  [Orabug: 32253410]  {CVE-2020-29568} 
  - xen/xenbus: Allow watches discard events before queueing (SeongJae Park)  [Orabug: 32253410]  {CVE-2020-29568} 
  - xen-blkback: set ring->xenblkd to NULL after kthread_stop() (Pawel Wieczorkiewicz)  [Orabug: 32260254]  {CVE-2020-29569} 
  - partitions/efi: Enable no warning option for the GPT warnings related to alternative header (Saeed Mirzamohammadi)  [Orabug: 32302137]  
  - net/rds: Only yield with a valid "i_connecting_ts" timestamp (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Only increment rdma_resolve_route timeout on error (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Don't block workqueues "cma_wq" and "cm.wq" (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Don't drop neighbor loopback connection (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Take the GID offset into account for IB devices (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Leave the neighbor cache alone (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Give each connection its own workqueue (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Disassociate ic and cm_id before rdma_destroy_id (Gerd Rausch)  [Orabug: 32306094]  
  - Revert "rds: ib: Implement proper cm_id compare" (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Add a rdma_cm watchdog timer (Gerd Rausch)  [Orabug: 32306094]  
  - Revert "RDS: IB: fix panic with handlers running post teardown" (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Release all resources allocated by "rds_ib_setup_qp" (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Change the "rds_aux_wq" workqueue to loose order (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Don't sleep inside worker threads (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Fix a few race conditions (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Execute "rdma_destroy_id" in the background (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Delay reconnects from passive side by 3 seconds (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Drop connections when peers perform failover (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Yield to incoming connection requests (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Remove stale comments about random backoff (Gerd Rausch)  [Orabug: 32306094]


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2101.el7uek]
changelog:
  - x86/process: Mark cpu inactive before offlining (Mridula Shastry)  [Orabug: 32245070]  
  - mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start (Zhang Xiaohui)  [Orabug: 32349204]  {CVE-2020-36158} 
  - add license checking to kABI checker (Dan Duval)  [Orabug: 32355207]  
  - Linux 4.14.213 (Greg Kroah-Hartman)   
  - PCI: Fix pci_slot_release() NULL pointer dereference (Jubin Zhong)   
  - libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels (Dan Williams)   
  - clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9 (Terry Zhou)   
  - md/cluster: fix deadlock when node is doing resync job (Zhao Heming)   
  - iio:imu:bmi160: Fix too large a buffer. (Jonathan Cameron)   
  - iio:pressure:mpl3115: Force alignment of buffer (Jonathan Cameron)   
  - iio:light:rpr0521: Fix timestamp alignment and prevent data leak. (Jonathan Cameron)   
  - iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume (Qinglang Miao)   
  - iio: buffer: Fix demux update (Nuno Sá)   
  - mtd: parser: cmdline: Fix parsing of part-names with colons (Sven Eckelmann)   
  - soc: qcom: smp2p: Safely acquire spinlock without IRQs (Evan Green)   
  - spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path (Lukas Wunner)   
  - spi: sc18is602: Don't leak SPI master in probe error path (Lukas Wunner)   
  - spi: rb4xx: Don't leak SPI master in probe error path (Lukas Wunner)   
  - spi: pic32: Don't leak DMA channels in probe error path (Lukas Wunner)   
  - spi: davinci: Fix use-after-free on unbind (Lukas Wunner)   
  - spi: spi-sh: Fix use-after-free on unbind (Lukas Wunner)   
  - drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() (Zwane Mwaikambo)   
  - jfs: Fix array index bounds check in dbAdjTree (Dave Kleikamp)   
  - jffs2: Fix GC exit abnormally (Zhe Li)   
  - ceph: fix race in concurrent __ceph_remove_cap invocations (Luis Henriques)   
  - ima: Don't modify file descriptor mode on the fly (Roberto Sassu)   
  - powerpc/powernv/memtrace: Don't leak kernel memory to user space (David Hildenbrand)   
  - powerpc/xmon: Change printk() to pr_cont() (Christophe Leroy)   
  - powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter (Tyrel Datwyler)   
  - ARM: dts: at91: sama5d2: fix CAN message ram offset and size (Nicolas Ferre)   
  - KVM: arm64: Introduce handling of AArch32 TTBCR2 traps (Marc Zyngier)   
  - ext4: fix deadlock with fs freezing and EA inodes (Jan Kara)   
  - ext4: fix a memory leak of ext4_free_data (Chunguang Xu)   
  - USB: serial: keyspan_pda: fix write unthrottling (Johan Hovold)   
  - USB: serial: keyspan_pda: fix tx-unthrottle use-after-free (Johan Hovold)   
  - USB: serial: keyspan_pda: fix write-wakeup use-after-free (Johan Hovold)   
  - USB: serial: keyspan_pda: fix stalled writes (Johan Hovold)   
  - USB: serial: keyspan_pda: fix write deadlock (Johan Hovold)   
  - USB: serial: keyspan_pda: fix dropped unthrottle interrupts (Johan Hovold)   
  - USB: serial: mos7720: fix parallel-port state restore (Johan Hovold)   
  - EDAC/amd64: Fix PCI component registration (Borislav Petkov)   
  - crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() (Ard Biesheuvel)   
  - powerpc/perf: Exclude kernel samples while counting events in user space. (Athira Rajeev)   
  - staging: comedi: mf6x4: Fix AI end-of-conversion detection (Ian Abbott)   
  - s390/dasd: fix list corruption of lcu list (Stefan Haberland)   
  - s390/dasd: fix list corruption of pavgroup group list (Stefan Haberland)   
  - s390/dasd: prevent inconsistent LCU device data (Stefan Haberland)   
  - s390/smp: perform initial CPU reset also for SMT siblings (Sven Schnelle)   
  - ALSA: usb-audio: Disable sample read check if firmware doesn't give back (Takashi Iwai)   
  - ALSA: pcm: oss: Fix a few more UBSAN fixes (Takashi Iwai)   
  - ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (Chris Chiu)   
  - ACPI: PNP: compare the string length in the matching_id() (Hui Wang)   
  - Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" (Daniel Scally)   
  - PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() (Rafael J. Wysocki)   
  - Input: cyapa_gen6 - fix out-of-bounds stack access (Arnd Bergmann)   
  - media: netup_unidvb: Don't leak SPI master in probe error path (Lukas Wunner)   
  - media: sunxi-cir: ensure IR is handled when it is continuous (Sean Young)   
  - media: gspca: Fix memory leak in probe (Alan Stern)   
  - Input: goodix - add upside-down quirk for Teclast X98 Pro tablet (Simon Beginn)   
  - Input: cros_ec_keyb - send 'scancodes' in addition to key events (Dmitry Torokhov)   
  - fix namespaced fscaps when !CONFIG_SECURITY (Serge Hallyn)   
  - cfg80211: initialize rekey_data (Sara Sharon)   
  - clk: sunxi-ng: Make sure divider tables have sentinel (Jernej Skrabec)   
  - clk: s2mps11: Fix a resource leak in error handling paths in the probe function (Christophe JAILLET)   
  - qlcnic: Fix error code in probe (Dan Carpenter)   
  - perf record: Fix memory leak when using '--user-regs=?' to list registers (Zheng Zengkai)   
  - pwm: lp3943: Dynamically allocate PWM chip base (Lokesh Vutla)   
  - pwm: zx: Add missing cleanup in error path (Uwe Kleine-König)   
  - clk: ti: Fix memleak in ti_fapll_synth_setup (Zhang Qilong)   
  - watchdog: coh901327: add COMMON_CLK dependency (Arnd Bergmann)   
  - watchdog: qcom: Avoid context switch in restart handler (Manivannan Sadhasivam)   
  - net: korina: fix return value (Vincent Stehlé)   
  - net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function (Christophe JAILLET)   
  - net: bcmgenet: Fix a resource leak in an error handling path in the probe functin (Christophe JAILLET)   
  - checkpatch: fix unescaped left brace (Dwaipayan Ray)   
  - powerpc/ps3: use dma_mapping_error() (Vincent Stehlé)   
  - nfc: s3fwrn5: Release the nfc firmware (Bongsu Jeon)   
  - um: chan_xterm: Fix fd leak (Anton Ivanov)   
  - watchdog: sirfsoc: Add missing dependency on HAS_IOMEM (Guenter Roeck)   
  - irqchip/alpine-msi: Fix freeing of interrupts on allocation error path (Marc Zyngier)   
  - ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control() (Dan Carpenter)   
  - extcon: max77693: Fix modalias string (Marek Szyprowski)   
  - clk: tegra: Fix duplicated SE clock entry (Dmitry Osipenko)   
  - x86/kprobes: Restore BTF if the single-stepping is cancelled (Masami Hiramatsu)   
  - nfs_common: need lock during iterate through the list (Cheng Lin)   
  - nfsd: Fix message level for normal termination (kazuo ito)   
  - speakup: fix uninitialized flush_lock (Yang Yingliang)   
  - usb: oxu210hp-hcd: Fix memory leak in oxu_create (Zhang Qilong)   
  - usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe (Zhang Qilong)   
  - powerpc/pseries/hibernation: remove redundant cacheinfo update (Nathan Lynch)   
  - powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops (Nathan Lynch)   
  - scsi: fnic: Fix error return code in fnic_probe() (Zhang Changzhong)   
  - scsi: pm80xx: Fix error return in pm8001_pci_probe() (Zhang Qilong)   
  - scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe (Qinglang Miao)   
  - cpufreq: scpi: Add missing MODULE_ALIAS (Pali Rohár)   
  - cpufreq: loongson1: Add missing MODULE_ALIAS (Pali Rohár)   
  - cpufreq: st: Add missing MODULE_DEVICE_TABLE (Pali Rohár)   
  - cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE (Pali Rohár)   
  - cpufreq: highbank: Add missing MODULE_DEVICE_TABLE (Pali Rohár)   
  - clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI (Keqian Zhu)   
  - dm ioctl: fix error return code in target_message (Qinglang Miao)   
  - ASoC: jz4740-i2s: add missed checks for clk_get() (Chuhong Yuan)   
  - net/mlx5: Properly convey driver version to firmware (Leon Romanovsky)   
  - memstick: r592: Fix error return in r592_probe() (Jing Xiangfeng)   
  - arm64: dts: rockchip: Fix UART pull-ups on rk3328 (Chen-Yu Tsai)   
  - pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() (Yu Kuai)   
  - ARM: dts: at91: sama5d2: map securam as device (Claudiu Beznea)   
  - clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent() (Yu Kuai)   
  - media: saa7146: fix array overflow in vidioc_s_audio() (Dan Carpenter)   
  - vfio-pci: Use io_remap_pfn_range() for PCI IO memory (Jason Gunthorpe)   
  - NFS: switch nfsiod to be an UNBOUND workqueue. (NeilBrown)   
  - lockd: don't use interval-based rebinding over TCP (Calum Mackay)   
  - SUNRPC: xprt_load_transport() needs to support the netid "rdma6" (Trond Myklebust)   
  - NFSv4.2: condition READDIR's mask for security label based on LSM state (Olga Kornievskaia)   
  - ath10k: Release some resources in an error handling path (Christophe JAILLET)   
  - ath10k: Fix an error handling path (Christophe JAILLET)   
  - ARM: dts: at91: at91sam9rl: fix ADC triggers (Alexandre Belloni)   
  - PCI: iproc: Fix out-of-bound array accesses (Bharat Gooty)   
  - genirq/irqdomain: Don't try to free an interrupt that has no mapping (Marc Zyngier)   
  - power: supply: bq24190_charger: fix reference leak (Zhang Qilong)   
  - ARM: dts: Remove non-existent i2c1 from 98dx3236 (Chris Packham)   
  - HSI: omap_ssi: Don't jump to free ID in ssi_add_controller() (Jing Xiangfeng)   
  - media: max2175: fix max2175_set_csm_mode() error code (Dan Carpenter)   
  - mips: cdmm: fix use-after-free in mips_cdmm_bus_discover (Qinglang Miao)   
  - samples: bpf: Fix lwt_len_hist reusing previous BPF map (Daniel T. Lee)   
  - media: siano: fix memory leak of debugfs members in smsdvb_hotplug (Keita Suzuki)   
  - cw1200: fix missing destroy_workqueue() on error in cw1200_init_common (Qinglang Miao)   
  - orinoco: Move context allocation after processing the skb (Sebastian Andrzej Siewior)   
  - ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host (Cristian Birsan)   
  - ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host (Cristian Birsan)   
  - memstick: fix a double-free bug in memstick_check (Qinglang Miao)   
  - RDMA/cxgb4: Validate the number of CQEs (Kamal Heib)   
  - Input: omap4-keypad - fix runtime PM error handling (Zhang Qilong)   
  - drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe (Zhihao Cheng)   
  - soc: ti: Fix reference imbalance in knav_dma_probe (Zhang Qilong)   
  - soc: ti: knav_qmss: fix reference leak in knav_queue_probe (Zhang Qilong)   
  - crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe (Zhang Qilong)   
  - powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 (Christophe Leroy)   
  - Input: ads7846 - fix unaligned access on 7845 (Dmitry Torokhov)   
  - Input: ads7846 - fix integer overflow on Rt calculation (Oleksij Rempel)   
  - Input: ads7846 - fix race that causes missing releases (David Jander)   
  - drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() (Yang Yingliang)   
  - media: solo6x10: fix missing snd_card_free in error handling case (Qinglang Miao)   
  - scsi: core: Fix VPD LUN ID designator priorities (Martin Wilck)   
  - media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm() (Yu Kuai)   
  - staging: greybus: codecs: Fix reference counter leak in error handling (Zhang Qilong)   
  - MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA (Necip Fazil Yildiran)   
  - RDMa/mthca: Work around -Wenum-conversion warning (Arnd Bergmann)   
  - ASoC: arizona: Fix a wrong free in wm8997_probe (Zhang Qilong)   
  - ASoC: wm8998: Fix PM disable depth imbalance on error (Zhang Qilong)   
  - mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure (Tsuchiya Yuto)   
  - spi: tegra114: fix reference leak in tegra spi ops (Zhang Qilong)   
  - spi: tegra20-sflash: fix reference leak in tegra_sflash_resume (Zhang Qilong)   
  - spi: tegra20-slink: fix reference leak in slink ops of tegra20 (Zhang Qilong)   
  - spi: spi-ti-qspi: fix reference leak in ti_qspi_setup (Zhang Qilong)   
  - Bluetooth: Fix null pointer dereference in hci_event_packet() (Anmol Karn)   
  - arm64: dts: exynos: Correct psci compatible used on Exynos7 (Paweł Chmiel)   
  - selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling (Paul Moore)   
  - ASoC: pcm: DRAIN support reactivation (Cezary Rojewski)   
  - spi: img-spfi: fix reference leak in img_spfi_resume (Zhang Qilong)   
  - crypto: talitos - Fix return type of current_desc_hdr() (Christophe Leroy)   
  - sched: Reenable interrupts in do_sched_yield() (Thomas Gleixner)   
  - sched/deadline: Fix sched_dl_global_validate() (Peng Liu)   
  - ARM: p2v: fix handling of LPAE translation in BE mode (Ard Biesheuvel)   
  - x86/mm/ident_map: Check for errors from ident_pud_init() (Arvind Sankar)   
  - RDMA/rxe: Compute PSN windows correctly (Bob Pearson)   
  - selinux: fix error initialization in inode_doinit_with_dentry() (Tianyue Ren)   
  - RDMA/bnxt_re: Set queue pair state when being queried (Kamal Heib)   
  - soc: mediatek: Check if power domains can be powered on at boot time (Nicolas Boichat)   
  - soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains() (Dan Carpenter)   
  - drm/gma500: fix double free of gma_connector (Tom Rix)   
  - Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() (Peilin Ye)   
  - md: fix a warning caused by a race between concurrent md_ioctl()s (Dae R. Jeong)   
  - crypto: af_alg - avoid undefined behavior accessing salg_name (Eric Biggers)   
  - media: msi2500: assign SPI bus number dynamically (Antti Palosaari)   
  - quota: Sanity-check quota file headers on load (Jan Kara)   
  - serial_core: Check for port state when tty is in error state (Alexey Kardashevskiy)   
  - HID: i2c-hid: add Vero K147 to descriptor override (Julian Sax)   
  - ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU (Krzysztof Kozlowski)   
  - ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 (Krzysztof Kozlowski)   
  - ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU (Krzysztof Kozlowski)   
  - usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul (Fabio Estevam)   
  - USB: gadget: f_rndis: fix bitrate for SuperSpeed and above (Will McVicker)   
  - usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus (Jack Pham)   
  - USB: gadget: f_midi: setup SuperSpeed Plus descriptors (Will McVicker)   
  - USB: gadget: f_acm: add support for SuperSpeed Plus (taehyun.cho)   
  - USB: serial: option: add interface-number sanity check to flag handling (Johan Hovold)   
  - soc/tegra: fuse: Fix index bug in get_process_id (Nicolin Chen)   
  - dm table: Remove BUG_ON(in_interrupt()) (Thomas Gleixner)   
  - scsi: mpt3sas: Increase IOCInit request timeout to 30s (Sreekanth Reddy)   
  - vxlan: Copy needed_tailroom from lowerdev (Sven Eckelmann)   
  - vxlan: Add needed_headroom for lower device (Sven Eckelmann)   
  - drm/tegra: sor: Disable clocks on error in tegra_sor_init() (Qinglang Miao)   
  - kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling (Nicholas Piggin)   
  - RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait (Leon Romanovsky)   
  - can: softing: softing_netdev_open(): fix error handling (Zhang Qilong)   
  - scsi: bnx2i: Requires MMU (Randy Dunlap)   
  - gpio: mvebu: fix potential user-after-free on probe (Baruch Siach)   
  - ARM: dts: sun8i: v3s: fix GIC node memory range (Icenowy Zheng)   
  - pinctrl: baytrail: Avoid clearing debounce value when turning it off (Andy Shevchenko)   
  - pinctrl: merrifield: Set default bias in case no particular value given (Andy Shevchenko)   
  - drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi (Xin Xiong)   
  - serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access (Alexander Sverdlin)   
  - ALSA: pcm: oss: Fix potential out-of-bounds shift (Takashi Iwai)   
  - USB: sisusbvga: Make console support depend on BROKEN (Thomas Gleixner)   
  - USB: UAS: introduce a quirk to set no_write_same (Oliver Neukum)   
  - xhci: Give USB2 ports time to enter U3 in bus suspend (Li Jun)   
  - ALSA: usb-audio: Fix control 'access overflow' errors from chmap (Takashi Iwai)   
  - ALSA: usb-audio: Fix potential out-of-bounds shift (Takashi Iwai)   
  - USB: add RESET_RESUME quirk for Snapscan 1212 (Oliver Neukum)   
  - USB: dummy-hcd: Fix uninitialized array use in init() (Bui Quang Minh)   
  - mac80211: mesh: fix mesh_pathtbl_init() error path (Eric Dumazet)   
  - net: bridge: vlan: fix error return code in __vlan_add() (Zhang Changzhong)   
  - net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux (Martin Blumenstingl)   
  - net: stmmac: delete the eee_ctrl_timer after napi disabled (Fugang Duan)   
  - net/mlx4_en: Handle TX error CQE (Moshe Shemesh)   
  - net/mlx4_en: Avoid scheduling restart task if it is already running (Moshe Shemesh)   
  - tcp: fix cwnd-limited bug for TSO deferral where we send nothing (Neal Cardwell)   
  - net: stmmac: free tx skb buffer in stmmac_resume() (Fugang Duan)   
  - PCI: qcom: Add missing reset for ipq806x (Ansuel Smith)   
  - x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP (Arvind Sankar)   
  - scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()" (Dan Carpenter)   
  - kbuild: avoid static_assert for genksyms (Arnd Bergmann)   
  - pinctrl: amd: remove debounce filter setting in IRQ type setting (Coiby Xu)   
  - Input: i8042 - add Acer laptops to the i8042 reset list (Chris Chiu)   
  - Input: cm109 - do not stomp on control URB (Dmitry Torokhov)   
  - platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE (Timo Witte)   
  - soc: fsl: dpio: Get the cpumask through cpumask_of(cpu) (Hao Si)   
  - scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE (Can Guo)   
  - ARC: stack unwinding: don't assume non-current task is sleeping (Vineet Gupta)   
  - iwlwifi: mvm: fix kernel panic in case of assert during CSA (Sara Sharon)   
  - arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards. (Markus Reichl)   
  - iwlwifi: pcie: limit memory read spin time (Johannes Berg)   
  - spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe (Nathan Chancellor)   
  - spi: bcm2835aux: Fix use-after-free on unbind (Lukas Wunner)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2102.el7uek]
changelog:
  - net/rds: Fix gfp_t parameter (Hans Westgaard Ry)  [Orabug: 32372159]  
  - uek-rpm: update kABI lists for new symbol (Dan Duval)  [Orabug: 32378207]  
  - A/A Bonding: Fix a one-byte-off kmalloc (Håkon Bugge)  [Orabug: 32380825]  
  - net/mlx5: Use a single MSIX vector for all control EQs in VFs (Ariel Levkovich)  [Orabug: 31785236]  
  - net/mlx5: Fix available EQs FW used to reserve (Denis Drozdov)  [Orabug: 31785236]  
  - net/mlx5: Use max_num_eqs for calculation of required MSIX vectors (Denis Drozdov)  [Orabug: 31785236]  
  - net/mlx5: Expose DEVX specification (Yishai Hadas)  [Orabug: 31785236]  
  - A/A Bonding: Introduce selective interface name inclusion (Håkon Bugge)  [Orabug: 32321059]  
  - Linux 4.14.215 (Greg Kroah-Hartman)   
  - scsi: target: Fix XCOPY NAA identifier lookup (David Disseldorp)   {CVE-2020-28374} 
  - KVM: x86: fix shift out of bounds reported by UBSAN (Paolo Bonzini)   
  - x86/mtrr: Correct the range check before performing MTRR type lookups (Ying-Tsun Huang)   
  - netfilter: xt_RATEEST: reject non-null terminated string from userspace (Florian Westphal)   
  - netfilter: ipset: fix shift-out-of-bounds in htable_bits() (Vasily Averin)   
  - Revert "device property: Keep secondary firmware node secondary by type" (Bard Liao)   
  - ALSA: hda/realtek - Fix speaker volume control on Lenovo C940 (Kailang Yang)   
  - ALSA: hda/conexant: add a new hda codec CX11970 (bo liu)   
  - x86/mm: Fix leak of pmd ptlock (Dan Williams)   
  - USB: serial: keyspan_pda: remove unused variable (Johan Hovold)   
  - usb: gadget: configfs: Fix use-after-free issue with udc_name (Eddie Hung)   
  - usb: gadget: configfs: Preserve function ordering after bind failure (Chandana Kishori Chiluveru)   
  - usb: gadget: Fix spinlock lockup on usb_function_deactivate (Sriharsha Allenki)   
  - USB: gadget: legacy: fix return error code in acm_ms_bind() (Yang Yingliang)   
  - usb: gadget: function: printer: Fix a memory leak for interface descriptor (Zqiang)   
  - usb: gadget: f_uac2: reset wMaxPacketSize (Jerome Brunet)   
  - usb: gadget: select CONFIG_CRC32 (Arnd Bergmann)   
  - ALSA: usb-audio: Fix UBSAN warnings for MIDI jacks (Takashi Iwai)   
  - USB: usblp: fix DMA to stack (Johan Hovold)   
  - USB: yurex: fix control-URB timeout handling (Johan Hovold)   
  - USB: serial: option: add Quectel EM160R-GL (Bjørn Mork)   
  - USB: serial: option: add LongSung M5710 module support (Daniel Palmer)   
  - USB: serial: iuu_phoenix: fix DMA from stack (Johan Hovold)   
  - usb: uas: Add PNY USB Portable SSD to unusual_uas (Thinh Nguyen)   
  - usb: usbip: vhci_hcd: protect shift size (Randy Dunlap)   
  - USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set (Michael Grzeschik)   
  - usb: chipidea: ci_hdrc_imx: add missing put_device() call in usbmisc_get_init_data() (Yu Kuai)   
  - usb: dwc3: ulpi: Use VStsDone to detect PHY regs access completion (Serge Semin)   
  - USB: cdc-acm: blacklist another IR Droid device (Sean Young)   
  - usb: gadget: enable super speed plus (taehyun.cho)   
  - crypto: ecdh - avoid buffer overflow in ecdh_set_secret() (Ard Biesheuvel)   
  - video: hyperv_fb: Fix the mmap() regression for v5.4.y and older (Dexuan Cui)   
  - net: systemport: set dev->max_mtu to UMAC_MAX_MTU_SIZE (Florian Fainelli)   
  - net: mvpp2: Fix GoP port 3 Networking Complex Control configurations (Stefan Chulski)   
  - net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc (Antoine Tenart)   
  - net: sched: prevent invalid Scell_log shift count (Randy Dunlap)   
  - vhost_net: fix ubuf refcount incorrectly when sendmsg fails (Yunjian Wang)   
  - net: usb: qmi_wwan: add Quectel EM160R-GL (Bjørn Mork)   
  - CDC-NCM: remove "connected" log message (Roland Dreier)   
  - net: hdlc_ppp: Fix issues when mod_timer is called while timer is running (Xie He)   
  - net: hns: fix return value check in __lb_other_process() (Yunjian Wang)   
  - ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst() (Guillaume Nault)   
  - net: ethernet: ti: cpts: fix ethtool output when no ptp_clock registered (Grygorii Strashko)   
  - net-sysfs: take the rtnl lock when storing xps_cpus (Antoine Tenart)   
  - net: ethernet: Fix memleak in ethoc_probe (Dinghao Liu)   
  - net/ncsi: Use real net-device for response handler (John Wang)   
  - virtio_net: Fix recursive call to cpus_read_lock() (Jeff Dike)   
  - qede: fix offload for IPIP tunnel packets (Manish Chopra)   
  - atm: idt77252: call pci_disable_device() on error path (Dan Carpenter)   
  - ethernet: ucc_geth: set dev->max_mtu to 1518 (Rasmus Villemoes)   
  - ethernet: ucc_geth: fix use-after-free in ucc_geth_remove() (Rasmus Villemoes)   
  - depmod: handle the case of /sbin/depmod without /sbin in PATH (Linus Torvalds)   
  - lib/genalloc: fix the overflow when size is too big (Huang Shijie)   
  - scsi: ide: Do not set the RQF_PREEMPT flag for sense requests (Bart Van Assche)   
  - scsi: ufs-pci: Ensure UFS device is in PowerDown mode for suspend-to-disk ->poweroff() (Adrian Hunter)   
  - workqueue: Kick a worker based on the actual activation of delayed works (Yunfeng Ye)   
  - kbuild: don't hardcode depmod path (Dominique Martinet)   
  - Linux 4.14.214 (Greg Kroah-Hartman)   
  - iio:magnetometer:mag3110: Fix alignment and data leak issues. (Jonathan Cameron)   
  - iio:imu:bmi160: Fix alignment and data leak issues (Jonathan Cameron)   
  - kdev_t: always inline major/minor helper functions (Josh Poimboeuf)   
  - dm verity: skip verity work if I/O error when system is shutting down (Hyeongseok Kim)   
  - ALSA: pcm: Clear the full allocated memory at hw_params (Takashi Iwai)   
  - module: delay kobject uevent until after module init call (Jessica Yu)   
  - powerpc: sysdev: add missing iounmap() on error in mpic_msgr_probe() (Qinglang Miao)   
  - quota: Don't overflow quota file offsets (Jan Kara)   
  - module: set MODULE_STATE_GOING state when a module fails to load (Miroslav Benes)   
  - rtc: sun6i: Fix memleak in sun6i_rtc_clk_init (Dinghao Liu)   
  - ALSA: seq: Use bool for snd_seq_queue internal flags (Takashi Iwai)   
  - media: gp8psk: initialize stats at power control logic (Mauro Carvalho Chehab)   
  - misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() (Anant Thazhemadam)   
  - reiserfs: add check for an invalid ih_entry_count (Rustam Kovhaev)   
  - of: fix linker-section match-table corruption (Johan Hovold)   
  - uapi: move constants from <linux/kernel.h> to <linux/const.h> (Petr Vorel)   
  - powerpc/bitops: Fix possible undefined behaviour with fls() and fls64() (Christophe Leroy)   
  - USB: serial: digi_acceleport: fix write-wakeup deadlocks (Johan Hovold)   
  - s390/dasd: fix hanging device offline processing (Stefan Haberland)   
  - vfio/pci: Move dummy_resources_list init in vfio_pci_probe() (Eric Auger)   
  - mm: memcontrol: implement lruvec stat functions on top of each other (Johannes Weiner)   
  - mm: memcontrol: eliminate raw access to stat and event counters (Johannes Weiner)   
  - ALSA: usb-audio: fix sync-ep altsetting sanity check (Johan Hovold)   
  - ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk (Alberto Aguirre)   
  - ALSA: hda/ca0132 - Fix work handling in delayed HP detection (Takashi Iwai)   
  - md/raid10: initialize r10_bio->read_slot before use. (Kevin Vigor)   
  - x86/entry/64: Add instruction suffix (Jan Beulich)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2103.el7uek]
changelog:
  - Linux 4.14.216 (Greg Kroah-Hartman)   
  - net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet (Vasily Averin)   
  - block: fix use-after-free in disk_part_iter_next (Ming Lei)   
  - KVM: arm64: Don't access PMCR_EL0 when no PMU is available (Marc Zyngier)   
  - wan: ds26522: select CONFIG_BITREVERSE (Arnd Bergmann)   
  - net/mlx5e: Fix two double free cases (Dinghao Liu)   
  - net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups (Dinghao Liu)   
  - iommu/intel: Fix memleak in intel_irq_remapping_alloc (Dinghao Liu)   
  - block: rsxx: select CONFIG_CRC32 (Arnd Bergmann)   
  - wil6210: select CONFIG_CRC32 (Arnd Bergmann)   
  - dmaengine: xilinx_dma: fix mixed_enum_type coverity warning (Shravya Kumbham)   
  - dmaengine: xilinx_dma: check dma_async_device_register return value (Shravya Kumbham)   
  - spi: stm32: FIFO threshold level - fix align packet size (Roman Guskov)   
  - cpufreq: powernow-k8: pass policy rather than use cpufreq_cpu_get() (Colin Ian King)   
  - i2c: sprd: use a specific timeout to avoid system hang up issue (Chunyan Zhang)   
  - ARM: OMAP2+: omap_device: fix idling of devices during probe (Andreas Kemnade)   
  - iio: imu: st_lsm6dsx: fix edge-trigger interrupts (Lorenzo Bianconi)   
  - iio: imu: st_lsm6dsx: flip irq return logic (Sean Nyekjaer)   
  - spi: pxa2xx: Fix use-after-free on unbind (Lukas Wunner)   
  - ubifs: wbuf: Don't leak kernel memory to flash (Richard Weinberger)   
  - drm/i915: Fix mismatch between misplaced vma check and vma insert (Chris Wilson)   
  - vmlinux.lds.h: Add PGO and AutoFDO input sections (Nick Desaulniers)   
  - x86/resctrl: Don't move a task to the same resource group (Fenghua Yu)   
  - x86/resctrl: Use an IPI instead of task_work_add() to update PQR_ASSOC MSR (Fenghua Yu)   
  - net: fix pmtu check in nopmtudisc mode (Florian Westphal)   
  - net: ip: always refragment ip defragmented packets (Florian Westphal)   
  - net: vlan: avoid leaks on register_vlan_dev() failures (Jakub Kicinski)   
  - net: cdc_ncm: correct overhead in delayed_ndp_size (Jouni K. Seppänen)   
  - powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at (Mathieu Desnoyers)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2104.el7uek]
changelog:
  - net/rds: In rds_send_xmit() use sg_next() to get the next sg entry (Sharath Srinivasan)  [Orabug: 32441609]  
  - Revert "rds: Deregister all FRWR mr with free_mr" (aru kolappan)  [Orabug: 32426611]  
  - x86/msr: Add a pointer to an URL which contains further details (Borislav Petkov)  [Orabug: 32164605]  
  - x86/msr: Downgrade unrecognized MSR message (Borislav Petkov)  [Orabug: 32164605]  
  - x86/msr: Do not allow writes to MSR_IA32_ENERGY_PERF_BIAS (Borislav Petkov)  [Orabug: 32164605]  
  - x86/msr: Prevent userspace MSR access from dominating the console (Chris Down)  [Orabug: 32164605]  
  - x86/msr: Filter MSR writes (Borislav Petkov)  [Orabug: 32164605]  
  - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (Borislav Petkov)  [Orabug: 32164605]  
  - tools/power/turbostat: Read energy_perf_bias from sysfs (Borislav Petkov)  [Orabug: 32164605]  
  - tools/power/cpupower: Read energy_perf_bias from sysfs (Borislav Petkov)  [Orabug: 32164605]  
  - uek-rpm: update config-aarch-embedded2 for Elba (Dave Kleikamp)  [Orabug: 32374187]  
  - elba: u-boot environment partitions in the device-tree (David Clear)  [Orabug: 32374187]  
  - i2c: Add Elba Ortano Lattice RD1173 I2C controller driver. (David Clear)  [Orabug: 32374187]  
  - elba: one more mnet for elba.dtsi (David Clear)  [Orabug: 32374187]  
  - elba: Add IPv6 support to elba_defconfig (David Clear)  [Orabug: 32374187]  
  - mmc: sdhci-cadence-elba sdhci driver cleanup (David Clear)  [Orabug: 32374187]  
  - spi-dw: custom chip-select handler for elba (David Clear)  [Orabug: 32374187]  
  - arch/arm64: Pensando elba dts and config files (David Clear)  [Orabug: 32374187]  
  - drivers/soc/pensando: crash dump driver. (David Clear)  [Orabug: 32374187]  
  - drivers/pensando/soc: Boot State Machine (BSM) integration. (David Clear)  [Orabug: 32374187]  
  - drivers/soc/pensando: /dev/capmem driver. (David Clear)  [Orabug: 32374187]  
  - drivers/mmc/host: Pensando Elba support in the Cadence EMMC host controller (David Clear)  [Orabug: 32374187]  
  - drivers/gpio: support the Elba SPI chip-selects. (David Clear)  [Orabug: 32374187]  
  - arch/arm64: Pensando Elba SoC declaration. (David Clear)  [Orabug: 32374187]  
  - mmc: sdhci-cadence: fix PHY write (Vladimir Kondratiev)  [Orabug: 32374187]  
  - mmc: sdhci-cadence: set SDHCI_QUIRK2_PRESET_VALUE_BROKEN for UniPhier (Masahiro Yamada)  [Orabug: 32374187]  
  - mmc: sdhci-cadence: remove unneeded 'inline' marker (Masahiro Yamada)  [Orabug: 32374187]  
  - mmc: sdhci-cadence: use struct_size() helper (Gustavo A. R. Silva)  [Orabug: 32374187]  
  - mmc: sdhci-cadence: fix logically and structurally dead code (Gustavo A. R. Silva)  [Orabug: 32374187]  
  - mmc: sdhci-cadence: send tune request twice to work around errata (Masahiro Yamada)  [Orabug: 32374187]  
  - mmc: sdhci-cadence: use bitfield access macros for cleanup (Masahiro Yamada)  [Orabug: 32374187]  
  - Revert "Support the reset pulse width from the device-tree." (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Initial Pensando Capri SoC declaration" (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Add Capri EMMC phy and instantiate the driver in the dts" (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Capri SPI driver" (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Interrupt domain controllers for Capri ASIC." (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Add uio support for Capri PCIE and Link interrupts" (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Pensando/Capri PCIE panic handler." (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Pensando crash dump driver" (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Pensando Boot State Machine (BSM) integration." (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Add mnic nodes to the Pensando devicetree" (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "mtd/spi-nor/cadence-quadspi.c: Speed up reads." (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Add /proc/xmaps" (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Add Pensando Capri board .dts files and default configs" (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Provide for precise control of pgprot for Pensando" (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Kconfig option to disable outer-cache-allocate for Pensando" (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Add /dev/capmem driver for Pensando" (Dave Kleikamp)  [Orabug: 32374187]  
  - Revert "Make low-speed APB bus accesses single threaded" (Dave Kleikamp)  [Orabug: 32374187]  
  - net/rds: Incorrect RDS protocol version fall back (Ka-Cheong Poon)  [Orabug: 32376162]  
  - A/A Bonding: Add synchronized bundle failback (Gerd Rausch)  [Orabug: 32381884]  
  - net/rds: Missing RDS/RDMA private data in response to connection request (Ka-Cheong Poon)  [Orabug: 32388406]  
  - Linux 4.14.217 (Greg Kroah-Hartman)   
  - spi: cadence: cache reference clock rate during probe (Michael Hennerich)   
  - net: ipv6: Validate GSO SKB before finish IPv6 processing (Aya Levin)   
  - net: skbuff: disambiguate argument and member for skb_list_walk_safe helper (Jason A. Donenfeld)   
  - net: introduce skb_list_walk_safe for skb segment walking (Jason A. Donenfeld)   
  - net: use skb_list_del_init() to remove from RX sublists (Edward Cree)   
  - tipc: fix NULL deref in tipc_link_xmit() (Hoang Le)   
  - rxrpc: Fix handling of an unsupported token type in rxrpc_read() (David Howells)   
  - net: avoid 32 x truesize under-estimation for tiny skbs (Eric Dumazet)   
  - net: sit: unregister_netdevice on newlink's error path (Jakub Kicinski)   
  - net: stmmac: Fixed mtu channged by cache aligned (David Wu)   
  - net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands (Petr Machata)   
  - net: dcb: Validate netlink message in DCB handler (Petr Machata)   
  - esp: avoid unneeded kmap_atomic call (Willem de Bruijn)   
  - rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request (Andrey Zhizhikin)   
  - netxen_nic: fix MSI/MSI-x interrupts (Manish Chopra)   
  - nfsd4: readdirplus shouldn't return parent of export (J. Bruce Fields)   
  - usb: ohci: Make distrust_firmware param default to false (Hamish Martin)   
  - netfilter: conntrack: fix reading nf_conntrack_buckets (Jesper Dangaard Brouer)   
  - ALSA: fireface: Fix integer overflow in transmit_midi_msg() (Geert Uytterhoeven)   
  - ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (Geert Uytterhoeven)   
  - dm: eliminate potential source of excessive kernel log noise (Mike Snitzer)   
  - net: sunrpc: interpret the return value of kstrtou32 correctly (j.nixdorf@avm.de)   
  - mm, slub: consider rest of partial list if acquire_slab() fails (Jann Horn)   
  - RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp (Dinghao Liu)   
  - ext4: fix superblock checksum failure when setting password salt (Jan Kara)   
  - NFS: nfs_igrab_and_active must first reference the superblock (Trond Myklebust)   
  - pNFS: Mark layout for return if return-on-close was not sent (Trond Myklebust)   
  - NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock (Dave Wysochanski)   
  - ASoC: Intel: fix error code cnl_set_dsp_D0() (Dan Carpenter)   
  - dump_common_audit_data(): fix racy accesses to ->d_name (Al Viro)   
  - ARM: picoxcell: fix missing interrupt-parent properties (Arnd Bergmann)   
  - ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (Shawn Guo)   
  - net: ethernet: fs_enet: Add missing MODULE_LICENSE (Michael Ellerman)   
  - misdn: dsp: select CONFIG_BITREVERSE (Arnd Bergmann)   
  - arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC (Randy Dunlap)   
  - ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram (Rasmus Villemoes)   
  - btrfs: fix transaction leak and crash after RO remount caused by qgroup rescan (Filipe Manana)   
  - ARC: build: add boot_targets to PHONY (Masahiro Yamada)   
  - ARC: build: add uImage.lzma to the top-level target (Masahiro Yamada)   
  - ARC: build: remove non-existing bootpImage from KBUILD_IMAGE (Masahiro Yamada)   
  - ext4: fix bug for rename with RENAME_WHITEOUT (yangerkun)   
  - r8152: Add Lenovo Powered USB-C Travel Hub (Leon Schuermann)   
  - dm snapshot: flush merged data before committing metadata (Akilesh Kailash)   
  - mm/hugetlb: fix potential missing huge page size info (Miaohe Lin)   
  - ACPI: scan: Harden acpi_device_add() against device ID overflows (Dexuan Cui)   
  - MIPS: relocatable: fix possible boot hangup with KASLR enabled (Alexander Lobakin)   
  - MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB (Paul Cercueil)   
  - ASoC: dapm: remove widget from dirty list on free (Thomas Hebb)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2105.el7uek]
changelog:
  - tap: fix use-after-free (Michael S. Tsirkin)  [Orabug: 32466004]  
  - uek-rpm: config-aarch-embedded2 update for Jan 2021 Elba patches (Dave Kleikamp)  [Orabug: 32466168]  
  - dts/pensando: Fix compatile -> compatible typeo. (David Clear)  [Orabug: 32466168]  
  - Interrupt domain controllers for Elba ASIC. (David Clear)  [Orabug: 32466168]  
  - elba_defconfig: CONFIG_PTP_1588_CLOCK=y (David Clear)  [Orabug: 32466168]  
  - soc/pensando: pcie driver (David Clear)  [Orabug: 32466168]  
  - pcie: control access to pcie clock domain registers (David Clear)  [Orabug: 32466168]  
  - mmc: sdhci-cadence-elba ADMA and HS200 tuning support (David Clear)  [Orabug: 32466168]  
  - enable rcu callback offloading & adaptive tick mode to reduce jitter (David Clear)  [Orabug: 32466168]  
  - nbd: freeze the queue while we're adding connections (Josef Bacik)  [Orabug: 32447286]  {CVE-2021-3348} 
  - rds: avoid crash on IB conn path shutdown prepare (Alan Maguire)  [Orabug: 32466765]  
  - Linux 4.14.218 (Greg Kroah-Hartman)   
  - fs: fix lazytime expiration handling in __writeback_single_inode() (Eric Biggers)   
  - writeback: Drop I_DIRTY_TIME_EXPIRE (Jan Kara)   
  - fs: move I_DIRTY_INODE to fs.h (Christoph Hellwig)   
  - x86/boot/compressed: Disable relocation relaxation (Arvind Sankar)   
  - tracing: Fix race in trace_open and buffer resize call (Gaurav Kohli)   
  - futex: Handle faults correctly for PI futexes (Thomas Gleixner)   
  - futex: Simplify fixup_pi_state_owner() (Thomas Gleixner)   
  - futex: Use pi_state_update_owner() in put_pi_state() (Thomas Gleixner)   
  - rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (Thomas Gleixner)   
  - futex: Provide and use pi_state_update_owner() (Thomas Gleixner)   
  - futex: Replace pointless printk in fixup_owner() (Thomas Gleixner)   
  - futex: Ensure the correct return value from futex_lock_pi() (Thomas Gleixner)   
  - Revert "mm/slub: fix a memory leak in sysfs_slab_add()" (Wang Hai)   
  - gpio: mvebu: fix pwm .get_state period calculation (Baruch Siach)   
  - futex: futex_wake_op, fix sign_extend32 sign bits (Jiri Slaby)   
  - net: dsa: b53: fix an off by one in checking "vlan->vid" (Dan Carpenter)   
  - net_sched: avoid shift-out-of-bounds in tcindex_set_parms() (Eric Dumazet)   
  - ipv6: create multicast route with RTPROT_KERNEL (Matteo Croce)   
  - udp: mask TOS bits in udp_v4_early_demux() (Guillaume Nault)   
  - skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too (Alexander Lobakin)   
  - sh_eth: Fix power down vs. is_opened flag ordering (Geert Uytterhoeven)   
  - sh: dma: fix kconfig dependency for G2_DMA (Necip Fazil Yildiran)   
  - netfilter: rpfilter: mask ecn bits before fib lookup (Guillaume Nault)   
  - compiler.h: Raise minimum version of GCC to 5.1 for arm64 (Will Deacon)   
  - xhci: tegra: Delay for disabling LFPS detector (JC Kuo)   
  - xhci: make sure TRB is fully written before giving it to the controller (Mathias Nyman)   
  - usb: bdc: Make bdc pci driver depend on BROKEN (Patrik Jakobsson)   
  - usb: udc: core: Use lock when write to soft_connect (Thinh Nguyen)   
  - USB: ehci: fix an interrupt calltrace error (Longfang Liu)   
  - ehci: fix EHCI host controller initialization sequence (Eugene Korenevsky)   
  - stm class: Fix module init return on allocation failure (Wang Hui)   
  - intel_th: pci: Add Alder Lake-P support (Alexander Shishkin)   
  - irqchip/mips-cpu: Set IPI domain parent chip (Mathias Kresin)   
  - iio: ad5504: Fix setting power-down state (Lars-Peter Clausen)   
  - can: vxcan: vxcan_xmit: fix use after free bug (Vincent Mailhol)   
  - can: dev: can_restart: fix use after free bug (Vincent Mailhol)   
  - i2c: octeon: check correct size of maximum RECV_LEN packet (Wolfram Sang)   
  - drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields (Ben Skeggs)   
  - drm/nouveau/privring: ack interrupts the same way as RM (Ben Skeggs)   
  - drm/nouveau/bios: fix issue shadowing expansion ROMs (Ben Skeggs)   
  - xen: Fix event channel callback via INTX/GSI (David Woodhouse)   
  - scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback (Can Guo)   
  - ASoC: Intel: haswell: Add missing pm_ops (Cezary Rojewski)   
  - drm/atomic: put state on error path (Pan Bian)   
  - dm: avoid filesystem lookup in dm_get_dev_t() (Hannes Reinecke)   
  - mmc: sdhci-xenon: fix 1.8v regulator stabilization (Alex Leibovich)   
  - ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (Hans de Goede)   
  - ALSA: hda/via: Add minimum mute flag (Takashi Iwai)   
  - ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (Takashi Iwai)   
  - i2c: bpmp-tegra: Ignore unknown I2C_M flags (Mikko Perttunen)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2106.el7uek]
changelog:
  - selinux: allow reading labels before policy is loaded (Jonathan Lebon)  [Orabug: 32492278]  
  - selinux: allow labeling before policy is loaded (Jonathan Lebon)  [Orabug: 32492278]  
  - ovl: verify permissions in ovl_path_open() (Miklos Szeredi)  [Orabug: 32046374]  {CVE-2020-16120} 
  - ovl: switch to mounter creds in readdir (Miklos Szeredi)  [Orabug: 32046374]  {CVE-2020-16120} 
  - ovl: pass correct flags for opening real directory (Miklos Szeredi)  [Orabug: 32046374]  
  - l2tp: fix race in pppol2tp_release with session object destroy (James Chapman)  [Orabug: 32397622]  
  - l2tp: fix races with tunnel socket close (James Chapman)  [Orabug: 32397622]  
  - l2tp: don't use inet_shutdown on ppp session destroy (James Chapman)  [Orabug: 32397622]  
  - l2tp: don't use inet_shutdown on tunnel destroy (James Chapman)  [Orabug: 32397622]  
  - l2tp: exit_net cleanup check added (Vasily Averin)  [Orabug: 32397622]  
  - l2tp: remove the .tunnel_sock field from struct pppol2tp_session (Guillaume Nault)  [Orabug: 32397622]  
  - l2tp: avoid using ->tunnel_sock for getting session's parent tunnel (Guillaume Nault)  [Orabug: 32397622]  
  - l2tp: remove .tunnel_sock from struct l2tp_eth (Guillaume Nault)  [Orabug: 32397622]  
  - l2tp: don't close sessions in l2tp_tunnel_destruct() (Guillaume Nault)  [Orabug: 32397622]  
  - l2tp: remove field 'dev' from struct l2tp_eth (Guillaume Nault)  [Orabug: 32397622]  
  - l2tp: remove l2tp_tunnel_count and l2tp_session_count (Guillaume Nault)  [Orabug: 32397622]  
  - l2tp: remove ->ref() and ->deref() (Guillaume Nault)  [Orabug: 32397622]  
  - net: l2tp: mark expected switch fall-through (Gustavo A. R. Silva)  [Orabug: 32397622]  
  - l2tp: initialise PPP sessions before registering them (Guillaume Nault)  [Orabug: 32397622]  
  - uek-rpm: Enable Oracle Pilot BMC module (Eric Snowberg)  [Orabug: 32422663]  
  - hwmon: Add a new Oracle Pilot BMC driver (Eric Snowberg)  [Orabug: 32422663]  
  - nvmet-rdma: fix bonding failover possible NULL deref (Sagi Grimberg)  [Orabug: 32430930]  
  - rds: CONFIG_RDS_DEBUG + tracepoints breaks rds build (Alan Maguire)  [Orabug: 32442427]  
  - vhost scsi: alloc vhost_scsi with kvzalloc() to avoid delay (Dongli Zhang)  [Orabug: 32471686]  
  - rds: tracepoints incorrectly reporting valid rds ping as drop (Alan Maguire)  [Orabug: 32479157]  
  - rds: tracepoint-related KASAN: use-after-free Read in rds_send_xmit (Alan Maguire)  [Orabug: 32480217]  
  - Fix double free KASAN warnings and use after free of kmalloc-32 object. (Imran Khan)  [Orabug: 32480341]  
  - net/rds: WARNING in rds_conn_drop (Ka-Cheong Poon)  [Orabug: 32481706]  
  - A/A Bonding: In rdmaip synchronize access to ip_config[].rdmaip_dev (Sharath Srinivasan)  [Orabug: 32486195]  
  - Linux 4.14.220 (Greg Kroah-Hartman)   
  - kthread: Extract KTHREAD_IS_PER_CPU (Peter Zijlstra)   
  - objtool: Don't fail on missing symbol table (Josh Poimboeuf)   
  - scsi: ibmvfc: Set default timeout to avoid crash during migration (Brian King)   
  - mac80211: fix fast-rx encryption check (Felix Fietkau)   
  - scsi: libfc: Avoid invoking response handler twice if ep is already completed (Javed Hasan)   
  - scsi: scsi_transport_srp: Don't block target in failfast state (Martin Wilck)   
  - x86: __always_inline __{rd,wr}msr() (Peter Zijlstra)   
  - phy: cpcap-usb: Fix warning for missing regulator_disable (Tony Lindgren)   
  - driver core: Extend device_is_dependent() (Rafael J. Wysocki)   
  - base: core: Remove WARN_ON from link dependencies check (Benjamin Gaignard)   
  - net_sched: gen_estimator: support large ewma log (Eric Dumazet)   
  - net_sched: reject silly cell_log in qdisc_get_rtab() (Eric Dumazet)   
  - ACPI: thermal: Do not call acpi_thermal_check() directly (Rafael J. Wysocki)   
  - ibmvnic: Ensure that CRQ entry read are correctly ordered (Lijun Pan)   
  - net: dsa: bcm_sf2: put device node before return (Pan Bian)   
  - Linux 4.14.219 (Greg Kroah-Hartman)   
  - tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN (Pengcheng Yang)   
  - team: protect features update by RCU to avoid deadlock (Ivan Vecera)   
  - NFC: fix possible resource leak (Pan Bian)   
  - NFC: fix resource leak when target index is invalid (Pan Bian)   
  - iommu/vt-d: Don't dereference iommu_device if IOMMU_API is not built (Bartosz Golaszewski)   
  - iommu/vt-d: Gracefully handle DMAR units with no supported address widths (David Woodhouse)   
  - x86/entry/64/compat: Fix "x86/entry/64/compat: Preserve r8-r11 in int $0x80" (Andy Lutomirski)   
  - x86/entry/64/compat: Preserve r8-r11 in int $0x80 (Andy Lutomirski)   
  - can: dev: prevent potential information leak in can_fill_info() (Dan Carpenter)   
  - mac80211: pause TX while changing interface type (Johannes Berg)   
  - iwlwifi: pcie: reschedule in long-running memory reads (Johannes Berg)   
  - iwlwifi: pcie: use jiffies for memory read spin time limit (Johannes Berg)   
  - RDMA/cxgb4: Fix the reported max_recv_sge value (Kamal Heib)   
  - xfrm: Fix oops in xfrm_replay_advance_bmp (Shmulik Ladkani)   
  - netfilter: nft_dynset: add timeout extension to template (Pablo Neira Ayuso)   
  - ARM: imx: build suspend-imx6.S with arm instruction set (Max Krummenacher)   
  - xen-blkfront: allow discard-* nodes to be optional (Roger Pau Monne)   
  - mt7601u: fix rx buffer refcounting (Lorenzo Bianconi)   
  - mt7601u: fix kernel crash unplugging the device (Lorenzo Bianconi)   
  - leds: trigger: fix potential deadlock with libata (Andrea Righi)   
  - xen: Fix XenStore initialisation for XS_LOCAL (David Woodhouse)   
  - KVM: x86: get smi pending status correctly (Jay Zhou)   
  - KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] (Like Xu)   
  - drivers: soc: atmel: add null entry at the end of at91_soc_allowed_list[] (Claudiu Beznea)   
  - drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs (Sudeep Holla)   
  - net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family (Giacinto Cifelli)   
  - wext: fix NULL-ptr-dereference with cfg80211's lack of commit() (Johannes Berg)   
  - ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming (Koen Vandeputte)   
  - ACPI: sysfs: Prefer "compatible" modalias (Kai-Heng Feng)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2108.el7uek]
changelog:
  - block/diskstats: accumulate all per-cpu counters in one pass (Konstantin Khlebnikov)  [Orabug: 32531558]  
  - uek-rpm: config-aarch-embedded2 update for Feb 2021 Elba patches (Dave Kleikamp)  [Orabug: 32544727]  
  - huge page support for device memory (Neel Patel)  [Orabug: 32544727]  
  - mmc: sdhci-cadence-elba.c: Remove SDHCI_QUIRK_BROKEN_TIMEOUT_VAL (David Clear)  [Orabug: 32544727]  
  - net/mlx5e: Rx, checksum handling refactoring (Saeed Mahameed)  [Orabug: 32319635]  
  - net/mlx5e: Rx, Fix checksum calculation for new hardware (Saeed Mahameed)  [Orabug: 32319635]  
  - net/mlx5e: Rx, Check ip headers sanity (Saeed Mahameed)  [Orabug: 32319635]  
  - net/mlx5e: Rx, Fixup skb checksum for packets with tail padding (Saeed Mahameed)  [Orabug: 32319635]  
  - net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames (Cong Wang)  [Orabug: 32319635]  
  - mlx5: fix get_ip_proto() (Cong Wang)  [Orabug: 32319635]  
  - net/mlx5e: Set ECN for received packets using CQE indication (Natali Shechtman)  [Orabug: 32319635]  
  - net/mlx5e: CHECKSUM_COMPLETE offload for VLAN/QinQ packets (Gal Pressman)  [Orabug: 32319635]  
  - KVM: nVMX: use correct clean fields when copying from eVMCS (Vitaly Kuznetsov)  [Orabug: 32544091]  
  - Enable perf trace support for OL7 kernel builds. (Mridula Shastry)  [Orabug: 32528193]  
  - rds: ib: Remove two ib_modify_qp() calls (Håkon Bugge)  [Orabug: 32519916]  
  - PCI: hotplug: Add module parameter to allow user control of LEDs (James Puthukattukaran)  [Orabug: 32556983]  
  - net/rds: Need to check shutdown progress in rds_conn_path_destroy() (Ka-Cheong Poon)  [Orabug: 32536001]  
  - arm64: kexec: add support for kexec with spin-table (Henry Willard)  [Orabug: 32124944]  
  - x86/kvm/hyper-v: move VMX controls sanitization out of nested_enable_evmcs() (Vitaly Kuznetsov)  [Orabug: 31553478]  
  - x86/kvm/hyper-v: remove stale evmcs_already_enabled check from nested_enable_evmcs() (Vitaly Kuznetsov)  [Orabug: 31553478]  
  - Linux 4.14.222 (Greg Kroah-Hartman)   
  - kvm: check tlbs_dirty directly (Lai Jiangshan)   
  - usb: gadget: u_ether: Fix MTU size mismatch with RX packet size (Manish Narani)   
  - USB: Gadget Ethernet: Re-enable Jumbo frames. (John Greb)   
  - scsi: qla2xxx: Fix crash during driver load on big endian machines (Arun Easi)   
  - xen-blkback: fix error handling in xen_blkbk_map() (Jan Beulich)   
  - xen-scsiback: don't "handle" error by BUG() (Jan Beulich)   
  - xen-netback: don't "handle" error by BUG() (Jan Beulich)   
  - xen-blkback: don't "handle" error by BUG() (Jan Beulich)   
  - xen/arm: don't ignore return errors from set_phys_to_machine (Stefano Stabellini)   
  - Xen/gntdev: correct error checking in gntdev_map_grant_pages() (Jan Beulich)   
  - Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages() (Jan Beulich)   
  - Xen/x86: also check kernel mapping in set_foreign_p2m_mapping() (Jan Beulich)   
  - Xen/x86: don't bail early from clear_foreign_p2m_mapping() (Jan Beulich)   
  - tracing: Avoid calling cc-option -mrecord-mcount for every Makefile (Vasily Gorbik)   
  - tracing: Fix SKIP_STACK_VALIDATION=1 build due to bad merge with -mrecord-mcount (Greg Thelen)   
  - trace: Use -mcount-record for dynamic ftrace (Andi Kleen)   
  - x86/build: Disable CET instrumentation in the kernel for 32-bit too (Borislav Petkov)   
  - h8300: fix PREEMPTION build, TI_PRE_COUNT undefined (Randy Dunlap)   
  - i2c: stm32f7: fix configuration of the digital filter (Alain Volmat)   
  - vsock: fix locking in vsock_shutdown() (Stefano Garzarella)   
  - vsock/virtio: update credit only if socket is not closed (Stefano Garzarella)   
  - net: watchdog: hold device global xmit lock during tx disable (Edwin Peer)   
  - net/vmw_vsock: improve locking in vsock_connect_timeout() (Norbert Slusarek)   
  - usb: dwc3: ulpi: Replace CPU-based busyloop with Protocol-based one (Serge Semin)   
  - usb: dwc3: ulpi: fix checkpatch warning (Felipe Balbi)   
  - netfilter: conntrack: skip identical origin tuple in same zone only (Florian Westphal)   
  - netfilter: xt_recent: Fix attempt to update deleted entry (Jozsef Kadlecsik)   
  - bpf: Check for integer overflow when using roundup_pow_of_two() (Bui Quang Minh)   
  - memblock: do not start bottom-up allocations with kernel_end (Roman Gushchin)   
  - ARM: ensure the signal page contains defined contents (Russell King)   
  - ARM: dts: lpc32xx: Revert set default clock rate of HCLK PLL (Alexandre Belloni)   
  - ovl: skip getxattr of security labels (Amir Goldstein)   
  - cap: fix conversions on getxattr (Miklos Szeredi)   
  - ovl: perform vfs_getxattr() with mounter creds (Miklos Szeredi)   
  - platform/x86: hp-wmi: Disable tablet-mode reporting by default (Hans de Goede)   
  - arm64: dts: rockchip: Fix PCIe DT properties on rk3399 (Marc Zyngier)   
  - MIPS: BMIPS: Fix section mismatch warning (Jaedon Shin)   
  - arm/xen: Don't probe xenbus as part of an early initcall (Julien Grall)   
  - tracing: Check length before giving out the filter buffer (Steven Rostedt (VMware))   
  - tracing: Do not count ftrace events in top level enable output (Steven Rostedt (VMware))   
  - squashfs: add more sanity checks in xattr id lookup (Phillip Lougher)   
  - squashfs: add more sanity checks in inode lookup (Phillip Lougher)   
  - squashfs: add more sanity checks in id lookup (Phillip Lougher)   
  - memcg: fix a crash in wb_workfn when a device disappears (Theodore Ts'o)   
  - include/trace/events/writeback.h: fix -Wstringop-truncation warnings (Qian Cai)   
  - lib/string: Add strscpy_pad() function (Tobin C. Harding)   
  - SUNRPC: Handle 0 length opaque XDR object data properly (Dave Wysochanski)   
  - SUNRPC: Move simple_get_bytes and simple_get_netobj into private header (Dave Wysochanski)   
  - iwlwifi: mvm: guard against device removal in reprobe (Johannes Berg)   
  - iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap (Emmanuel Grumbach)   
  - iwlwifi: mvm: take mutex for calling iwl_mvm_get_sync_time() (Johannes Berg)   
  - pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process() (Trond Myklebust)   
  - af_key: relax availability checks for skb size calculation (Cong Wang)   
  - remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load (Sibi Sankar)   
  - remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load (Sibi Sankar)   
  - fgraph: Initialize tracing_graph_pause at task creation (Steven Rostedt (VMware))   
  - sched/topology: Assert non-NUMA topology masks don't (partially) overlap (Valentin Schneider)  [Orabug: 32479533]  
  - Linux 4.14.221 (Greg Kroah-Hartman)   
  - net: dsa: mv88e6xxx: override existent unicast portvec in port_fdb_add (DENG Qingfang)   
  - iommu/vt-d: Do not use flush-queue when caching-mode is on (Nadav Amit)   
  - Input: xpad - sync supported devices with fork on GitHub (Benjamin Valentin)   
  - x86/apic: Add extra serialization for non-serializing MSRs (Dave Hansen)   
  - x86/build: Disable CET instrumentation in the kernel (Josh Poimboeuf)   
  - mm: thp: fix MADV_REMOVE deadlock on shmem THP (Hugh Dickins)   
  - mm: hugetlb: remove VM_BUG_ON_PAGE from page_huge_active (Muchun Song)   
  - mm: hugetlb: fix a race between isolating and freeing page (Muchun Song)   
  - mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page (Muchun Song)   
  - ARM: footbridge: fix dc21285 PCI configuration accessors (Russell King)   
  - nvme-pci: avoid the deepest sleep state on Kingston A2000 SSDs (Thorsten Leemhuis)   
  - mmc: core: Limit retries when analyse of SDIO tuples fails (Fengnan Chang)   
  - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Gustavo A. R. Silva)   
  - cifs: report error instead of invalid when revalidating a dentry fails (Aurelien Aptel)   
  - xhci: fix bounce buffer usage for non-sg list case (Mathias Nyman)   
  - kretprobe: Avoid re-registration of the same kretprobe earlier (Wang ShaoBo)   
  - mac80211: fix station rate table updates on assoc (Felix Fietkau)   
  - ovl: fix dentry leak in ovl_get_redirect (Liangyan)   
  - usb: dwc2: Fix endpoint direction check in ep_from_windex (Heiko Stuebner)   
  - USB: usblp: don't call usb_set_interface if there's a single alt (Jeremy Figgins)   
  - USB: gadget: legacy: fix an error code in eth_bind() (Dan Carpenter)   
  - ipv4: fix race condition between route lookup and invalidation (Wei Wang)   
  - elfcore: fix building with clang (Arnd Bergmann)   
  - objtool: Support Clang non-section symbols in ORC generation (Josh Poimboeuf)   
  - net: lapb: Copy the skb before sending a packet (Xie He)   
  - arm64: dts: ls1046a: fix dcfg address range (Zyta Szpak)   
  - Input: i8042 - unbreak Pegatron C15B (Alexey Dobriyan)   
  - USB: serial: option: Adding support for Cinterion MV31 (Christoph Schemmel)   
  - USB: serial: cp210x: add new VID/PID for supporting Teraoka AD2000 (Chenxin Jin)   
  - USB: serial: cp210x: add pid/vid for WSDA-200-USB (Pho Tran)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2109.el7uek]
changelog:
  - rds: ensure saddr/daddr for tracepoints is not NULL (Alan Maguire)  [Orabug: 32580942]  
  - vhost: do not try to access device IOTLB when not initialized (Jason Wang)  [Orabug: 32577432]  
  - hsr: use netdev_err() instead of WARN_ONCE() (Taehee Yoo)  [Orabug: 32576072]  
  - net/rds: Reject error code change (Ka-Cheong Poon)  [Orabug: 32565542]  
  - rds: rds_drop_egress events should be enabled as part of RDS_RTD_SND (Alan Maguire)  [Orabug: 32587018]  
  - rds: use dedicated rds_send_lock_contention tracepoint instead of drop (Alan Maguire)  [Orabug: 32587018]  
  - net/rds: increase 1MB MR pool size for RDS (Manjunath Patil)  [Orabug: 32556088]  
  - Linux 4.14.223 (Greg Kroah-Hartman)   
  - dm era: Update in-core bitset after committing the metadata (Nikos Tsironis)   
  - net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending (Jason A. Donenfeld)   
  - ipv6: silence compilation warning for non-IPV6 builds (Leon Romanovsky)   
  - ipv6: icmp6: avoid indirect call for icmpv6_send() (Eric Dumazet)   
  - sunvnet: use icmp_ndo_send helper (Jason A. Donenfeld)   
  - gtp: use icmp_ndo_send helper (Jason A. Donenfeld)   
  - icmp: allow icmpv6_ndo_send to work with CONFIG_IPV6=n (Jason A. Donenfeld)   
  - icmp: introduce helper for nat'd source address in network device context (Jason A. Donenfeld)   
  - dm era: only resize metadata in preresume (Nikos Tsironis)   
  - dm era: Reinitialize bitset cache before digesting a new writeset (Nikos Tsironis)   
  - dm era: Use correct value size in equality function of writeset tree (Nikos Tsironis)   
  - dm era: Fix bitset memory leaks (Nikos Tsironis)   
  - dm era: Verify the data block size hasn't changed (Nikos Tsironis)   
  - dm era: Recover committed writeset after crash (Nikos Tsironis)   
  - gfs2: Don't skip dlm unlock if glock has an lvb (Bob Peterson)   
  - sparc32: fix a user-triggerable oops in clear_user() (Al Viro)   
  - f2fs: fix out-of-repair __setattr_copy() (Chao Yu)   
  - printk: fix deadlock when kernel panic (Muchun Song)   
  - gpio: pcf857x: Fix missing first interrupt (Maxim Kiselev)   
  - mmc: sdhci-esdhc-imx: fix kernel panic when remove module (Frank Li)   
  - module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols (Fangrui Song)   
  - libnvdimm/dimm: Avoid race between probe and available_slots_show() (Dan Williams)   
  - usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop() (Yoshihiro Shimoda)   
  - mm: hugetlb: fix a race between freeing and dissolving the page (Muchun Song)   
  - hugetlb: fix copy_huge_page_from_user contig page struct assumption (Mike Kravetz)   
  - fs/affs: release old buffer head on error path (Pan Bian)   
  - mtd: spi-nor: hisi-sfc: Put child node np on error path (Pan Bian)   
  - watchdog: mei_wdt: request stop on unregister (Alexander Usyskin)   
  - arm64: uprobe: Return EOPNOTSUPP for AARCH32 instruction probing (He Zhe)   
  - floppy: reintroduce O_NDELAY fix (Jiri Kosina)   
  - x86/reboot: Force all cpus to exit VMX root if VMX is supported (Sean Christopherson)   
  - staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table (Martin Kaiser)   
  - drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue (Sabyrzhan Tasbolatov)   
  - seccomp: Add missing return in non-void function (Paul Cercueil)   
  - crypto: sun4i-ss - handle BigEndian for cipher (Corentin Labbe)   
  - crypto: sun4i-ss - checking sg length is not sufficient (Corentin Labbe)   
  - btrfs: fix extent buffer leak on failure to copy root (Filipe Manana)   
  - btrfs: fix reloc root leak with 0 ref reloc roots on recovery (Josef Bacik)   
  - btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root (Josef Bacik)   
  - KEYS: trusted: Fix migratable=1 failing (Jarkko Sakkinen)   
  - tpm_tis: Fix check_locality for correct locality acquisition (James Bottomley)   
  - ALSA: hda/realtek: modify EAPD in the ALC886 (PeiSen Hou)   
  - usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt (Thinh Nguyen)   
  - usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1 (Thinh Nguyen)   
  - USB: serial: mos7720: fix error code in mos7720_write() (Dan Carpenter)   
  - USB: serial: mos7840: fix error code in mos7840_write() (Dan Carpenter)   
  - usb: musb: Fix runtime PM race in musb_queue_resume_work (Paul Cercueil)   
  - USB: serial: option: update interface mapping for ZTE P685M (Lech Perczak)   
  - Input: i8042 - add ASUS Zenbook Flip to noselftest list (Marcos Paulo de Souza)   
  - Input: joydev - prevent potential read overflow in ioctl (Dan Carpenter)   
  - Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S (Olivier Crête)   
  - Input: raydium_ts_i2c - do not send zero length (jeffrey.lin)   
  - HID: wacom: Ignore attempts to overwrite the touch_max value from HID (Jason Gerecke)   
  - ACPI: configfs: add missing check after configfs_register_default_group() (Qinglang Miao)   
  - ACPI: property: Fix fwnode string properties matching (Rafael J. Wysocki)   
  - blk-settings: align max_sectors on "logical_block_size" boundary (Mikulas Patocka)   
  - scsi: bnx2fc: Fix Kconfig warning & CNIC build errors (Randy Dunlap)   
  - mm/rmap: fix potential pte_unmap on an not mapped pte (Miaohe Lin)   
  - i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition (Maxime Ripard)   
  - arm64: Add missing ISB after invalidating TLB in __primary_switch (Marc Zyngier)   
  - mm/hugetlb: fix potential double free in hugetlb_register_node() error path (Miaohe Lin)   
  - mm/memory.c: fix potential pte_unmap_unlock pte error (Miaohe Lin)   
  - ocfs2: fix a use after free on error (Dan Carpenter)   
  - net/mlx4_core: Add missed mlx4_free_cmd_mailbox() (Chuhong Yuan)   
  - i40e: Fix overwriting flow control settings during driver loading (Mateusz Palczewski)   
  - i40e: Fix flow for IPv6 next header (extension header) (Slawomir Laba)   
  - ext4: fix potential htree index checksum corruption (Theodore Ts'o)   
  - drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY) (Konrad Dybcio)   
  - PCI: Align checking of syscall user config accessors (Heiner Kallweit)   
  - VMCI: Use set_page_dirty_lock() when unregistering guest memory (Jorgen Hansen)   
  - pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare() (Simon South)   
  - misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users (Aswath Govindraju)   
  - misc: eeprom_93xx46: Fix module alias to enable module autoprobe (Aswath Govindraju)   
  - sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set (Randy Dunlap)   
  - Input: elo - fix an error code in elo_connect() (Dan Carpenter)   
  - perf test: Fix unaligned access in sample parsing test (Namhyung Kim)   
  - perf intel-pt: Fix missing CYC processing in PSB (Adrian Hunter)   
  - spi: pxa2xx: Fix the controller numbering for Wildcat Point (Andy Shevchenko)   
  - powerpc/8xx: Fix software emulation interrupt (Christophe Leroy)   
  - powerpc/pseries/dlpar: handle ibm, configure-connector delay status (Nathan Lynch)   
  - mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq() (Dan Carpenter)   
  - spi: stm32: properly handle 0 byte transfer (Alain Volmat)   
  - RDMA/rxe: Fix coding error in rxe_recv.c (Bob Pearson)   
  - perf tools: Fix DSO filtering when not finding a map for a sampled address (Arnaldo Carvalho de Melo)   
  - tracepoint: Do not fail unregistering a probe due to memory failure (Steven Rostedt (VMware))   
  - amba: Fix resource leak for drivers without .remove (Uwe Kleine-König)   
  - ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores (Vladimir Murzin)   
  - mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe (Christophe JAILLET)   
  - powerpc/47x: Disable 256k page size (Christophe Leroy)   
  - IB/umad: Return EIO in case of when device disassociated (Shay Drory)   
  - auxdisplay: ht16k33: Fix refresh rate handling (Geert Uytterhoeven)   
  - isofs: release buffer head before return (Pan Bian)   
  - spi: atmel: Put allocated master before return (Pan Bian)   
  - certs: Fix blacklist flag type confusion (David Howells)   
  - regulator: axp20x: Fix reference cout leak (Pan Bian)   
  - clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined (Tom Rix)   
  - rtc: s5m: select REGMAP_I2C (Bartosz Golaszewski)   
  - power: reset: at91-sama5d2_shdwc: fix wkupdbc mask (Claudiu Beznea)   
  - of/fdt: Make sure no-map does not remove already reserved regions (Nicolas Boichat)   
  - fdt: Properly handle "no-map" field in the memory region (KarimAllah Ahmed)   
  - mfd: bd9571mwv: Use devm_mfd_add_devices() (Yoshihiro Shimoda)   
  - dmaengine: hsu: disable spurious interrupt (Ferry Toth)   
  - dmaengine: fsldma: Fix a resource leak in an error handling path of the probe function (Christophe JAILLET)   
  - dmaengine: fsldma: Fix a resource leak in the remove function (Christophe JAILLET)   
  - HID: core: detect and skip invalid inputs to snto32() (Randy Dunlap)   
  - spi: cadence-quadspi: Abort read if dummy cycles required are too many (Pratyush Yadav)   
  - quota: Fix memory leak when handling corrupted quota file (Jan Kara)   
  - clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL (Martin Blumenstingl)   
  - capabilities: Don't allow writing ambiguous v3 file capabilities (Eric W. Biederman)   
  - jffs2: fix use after free in jffs2_sum_write_data() (Tom Rix)   
  - fs/jfs: fix potential integer overflow on shift of a int (Colin Ian King)   
  - ima: Free IMA measurement buffer after kexec syscall (Lakshmi Ramasubramanian)   
  - ima: Free IMA measurement buffer on error (Lakshmi Ramasubramanian)   
  - crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key() (Daniele Alessandrelli)   
  - hwrng: timeriomem - Fix cooldown period calculation (Jan Henrik Weinstock)   
  - btrfs: clarify error returns values in __load_free_space_cache (Zhihao Cheng)   
  - Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind() (Andrea Parri (Microsoft))   
  - ata: ahci_brcm: Add back regulators management (Florian Fainelli)   
  - media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values (Laurent Pinchart)   
  - media: pxa_camera: declare variable when DEBUG is defined (Tom Rix)   
  - media: cx25821: Fix a bug when reallocating some dma memory (Christophe JAILLET)   
  - media: qm1d1c0042: fix error return code in qm1d1c0042_init() (Luo Meng)   
  - media: lmedm04: Fix misuse of comma (Joe Perches)   
  - crypto: bcm - Rename struct device_private to bcm_device_private (Jiri Olsa)   
  - ASoC: cs42l56: fix up error handling in probe (Dan Carpenter)   
  - media: tm6000: Fix memleak in tm6000_start_stream (Dinghao Liu)   
  - media: media/pci: Fix memleak in empress_init (Dinghao Liu)   
  - media: vsp1: Fix an error handling path in the probe function (Christophe JAILLET)   
  - media: i2c: ov5670: Fix PIXEL_RATE minimum value (Jacopo Mondi)   
  - MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0 (Nathan Chancellor)   
  - MIPS: c-r4k: Fix section mismatch for loongson2_sc_init (Nathan Chancellor)   
  - crypto: sun4i-ss - fix kmap usage (Corentin Labbe)   
  - gma500: clean up error handling in init (Dan Carpenter)   
  - drm/gma500: Fix error return code in psb_driver_load() (Jialin Zhang)   
  - fbdev: aty: SPARC64 requires FB_ATY_CT (Randy Dunlap)   
  - net: mvneta: Remove per-cpu queue mapping for Armada 3700 (Maxime Chevallier)   
  - net: amd-xgbe: Reset link when the link never comes back (Shyam Sundar S K)   
  - net: amd-xgbe: Reset the PHY rx data path when mailbox command timeout (Shyam Sundar S K)   
  - ibmvnic: skip send_request_unmap for timeout reset (Lijun Pan)   
  - b43: N-PHY: Fix the update of coef for the PHY revision >= 3case (Colin Ian King)   
  - mac80211: fix potential overflow when multiplying to u32 integers (Colin Ian King)   
  - xen/netback: fix spurious event detection for common event case (Juergen Gross)   
  - bnxt_en: reverse order of TX disable and carrier off (Edwin Peer)   
  - ath9k: fix data bus crash when setting nf_override via debugfs (Linus Lüssing)   
  - bpf_lru_list: Read double-checked variable once without lock (Marco Elver)   
  - ARM: s3c: fix fiq for clang IAS (Arnd Bergmann)   
  - arm64: dts: msm8916: Fix reserved and rfsa nodes unit address (Vincent Knecht)   
  - staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory rules (Chen-Yu Tsai)   
  - usb: dwc2: Make "trimming xfer length" a debug message (Guenter Roeck)   
  - usb: dwc2: Abort transaction after errors with unknown reason (Guenter Roeck)   
  - usb: dwc2: Do not update data length if it is 0 on inbound transfers (Guenter Roeck)   
  - ARM: dts: Configure missing thermal interrupt for 4430 (Tony Lindgren)   
  - Bluetooth: Put HCI device if inquiry procedure interrupts (Pan Bian)   
  - Bluetooth: drop HCI device reference before return (Pan Bian)   
  - usb: gadget: u_audio: Free requests only after callback (Jack Pham)   
  - cpufreq: brcmstb-avs-cpufreq: Fix resource leaks in ->remove() (Christophe JAILLET)   
  - arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso (Krzysztof Kozlowski)   
  - arm64: dts: exynos: correct PMIC interrupt trigger level on TM2 (Krzysztof Kozlowski)   
  - ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa (Krzysztof Kozlowski)   
  - ARM: dts: exynos: correct PMIC interrupt trigger level on Spring (Krzysztof Kozlowski)   
  - ARM: dts: exynos: correct PMIC interrupt trigger level on Rinato (Krzysztof Kozlowski)   
  - ARM: dts: exynos: correct PMIC interrupt trigger level on Monk (Krzysztof Kozlowski)   
  - Bluetooth: Fix initializing response id after clearing struct (Christopher William Snowhill)   
  - Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function (Christophe JAILLET)   
  - random: fix the RNDRESEEDCRNG ioctl (Eric Biggers)   
  - MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section (Alexander Lobakin)   
  - kdb: Make memory allocations more robust (Sumit Garg)   
  - vmlinux.lds.h: add DWARF v5 sections (Nick Desaulniers)   
  - scripts/recordmcount.pl: support big endian for ARCH sh (Rong Chen)   
  - cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath. (Shyam Prasad N)   
  - NET: usb: qmi_wwan: Adding support for Cinterion MV31 (Christoph Schemmel)   
  - arm64: tegra: Add power-domain for Tegra210 HDA (Sameer Pujar)   
  - ntfs: check for valid standard information attribute (Rustam Kovhaev)   
  - usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable (Stefan Ursella)   
  - HID: make arrays usage and value to be the same (Will McVicker)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2110.el7uek]
changelog:
  - mm/vmscan: fix infinite loop in drop_slab_node (Chunxin Zang)  [Orabug: 32620157]  
  - objtool: fix warning on white space (John Donnelly)  [Orabug: 32613446]  
  - uek-rpm: add opbmc to nano-kernel (Eric Snowberg)  [Orabug: 32555677]  
  - ovl: restore creds in all return paths of ovl_iterate (Somasundaram Krishnasamy)  [Orabug: 32620389]  
  - Linux 4.14.224 (Greg Kroah-Hartman)   
  - media: v4l: ioctl: Fix memory leak in video_usercopy (Sakari Ailus)   
  - swap: fix swapfile read/write offset (Jens Axboe)   
  - zsmalloc: account the number of compacted pages correctly (Rokudo Yan)   
  - xen-netback: respect gnttab_map_refs()'s return value (Jan Beulich)   
  - Xen/gnttab: handle p2m update errors on a per-slot basis (Jan Beulich)   
  - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech)   
  - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech)   
  - sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output (Joe Perches)   
  - scsi: iscsi: Restrict sessions and handles to admin capabilities (Lee Duncan)   
  - parisc: Bump 64-bit IRQ stack size to 64 KB (John David Anglin)   
  - f2fs: handle unallocated section and zone on pinned/atgc (Jaegeuk Kim)   
  - media: uvcvideo: Allow entities with no pads (Ricardo Ribalda)   
  - staging: most: sound: add sanity check for function argument (Christian Gromm)   
  - Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data (Gopal Tiwari)   
  - x86/build: Treat R_386_PLT32 relocation as R_386_PC32 (Fangrui Song)   
  - ath10k: fix wmi mgmt tx queue full due to race condition (Miaoqing Pan)   
  - pktgen: fix misuse of BUG_ON() in pktgen_thread_worker() (Di Zhu)   
  - wlcore: Fix command execute failure 19 for wl12xx (Tony Lindgren)   
  - vt/consolemap: do font sum unsigned (Jiri Slaby)   
  - x86/reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk (Heiner Kallweit)   
  - staging: fwserial: Fix error handling in fwserial_create (Dinghao Liu)   
  - dt-bindings: net: btusb: DT fix s/interrupt-name/interrupt-names/ (Geert Uytterhoeven)   
  - net: bridge: use switchdev for port flags set through sysfs too (Vladimir Oltean)   
  - mm/hugetlb.c: fix unnecessary address expansion of pmd sharing (Li Xinhai)   
  - net: fix up truesize of cloned skb in skb_prepare_for_shift() (Marco Elver)   
  - smackfs: restrict bytes count in smackfs write functions (Sabyrzhan Tasbolatov)   
  - xfs: Fix assert failure in xfs_setattr_size() (Yumei Huang)   
  - media: mceusb: sanity check for prescaler value (Sean Young)   
  - JFS: more checks for invalid superblock (Randy Dunlap)   
  - arm64: Use correct ll/sc atomic constraints (Andrew Murray)   
  - arm64: cmpxchg: Use "K" instead of "L" for ll/sc immediate constraint (Will Deacon)   
  - arm64: Avoid redundant type conversions in xchg() and cmpxchg() (Will Deacon)   
  - arm64 module: set plt* section addresses to 0x0 (Shaoying Xu)   
  - virtio/s390: implement virtio-ccw revision 2 correctly (Cornelia Huck)   
  - drm/virtio: use kvmalloc for large allocations (Sergey Senozhatsky)   
  - hugetlb: fix update_and_free_page contig page struct assumption (Mike Kravetz)   
  - scripts: set proper OpenSSL include dir also for sign-file (Rolf Eike Beer)   
  - scripts: use pkg-config to locate libcrypto (Rolf Eike Beer)   
  - net: usb: qmi_wwan: support ZTE P685M modem (Lech Perczak)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2111.el7uek]
changelog:
  - EDAC: skx_common: downgrade message importance on missing PCI device (Aristeu Rozanski)  [Orabug: 32651293]  
  - KVM: kvmclock: Fix vCPUs > 64 can't be online/hotpluged (Wanpeng Li)  [Orabug: 32641708]  
  - xen/netback: avoid race in xenvif_rx_ring_slots_available() (Juergen Gross)  [Orabug: 32640123]  
  - Linux 4.14.226 (Greg Kroah-Hartman)   
  - xen/events: avoid handling the same event on two cpus at the same time (Juergen Gross)   
  - xen/events: don't unmask an event channel when an eoi is pending (Juergen Gross)   
  - xen/events: reset affinity of 2-level event when tearing it down (Juergen Gross)   
  - iio: imu: adis16400: release allocated memory on failure (Navid Emamdoost)   
  - KVM: arm64: Fix exclusive limit for IPA size (Marc Zyngier)   
  - hwmon: (lm90) Fix max6658 sporadic wrong temperature reading (Boyang Yu)   
  - binfmt_misc: fix possible deadlock in bm_register_write (Lior Ribak)   
  - powerpc/64s: Fix instruction encoding for lis in ppc_function_entry() (Naveen N. Rao)   
  - include/linux/sched/mm.h: use rcu_dereference in in_vfork() (Matthew Wilcox (Oracle))   
  - stop_machine: mark helpers __always_inline (Arnd Bergmann)   
  - configfs: fix a use-after-free in __configfs_open_file (Daiyue Zhang)   
  - block: rsxx: fix error return code of rsxx_pci_probe() (Jia-Ju Bai)   
  - NFSv4.2: fix return value of _nfs4_get_security_label() (Ondrej Mosnacek)   
  - sh_eth: fix TRSCER mask for R7S72100 (Sergey Shtylyov)   
  - staging: comedi: pcl818: Fix endian problem for AI command data (Ian Abbott)   
  - staging: comedi: pcl711: Fix endian problem for AI command data (Ian Abbott)   
  - staging: comedi: me4000: Fix endian problem for AI command data (Ian Abbott)   
  - staging: comedi: dmm32at: Fix endian problem for AI command data (Ian Abbott)   
  - staging: comedi: das800: Fix endian problem for AI command data (Ian Abbott)   
  - staging: comedi: das6402: Fix endian problem for AI command data (Ian Abbott)   
  - staging: comedi: adv_pci1710: Fix endian problem for AI command data (Ian Abbott)   
  - staging: comedi: addi_apci_1500: Fix endian problem for command sample (Ian Abbott)   
  - staging: comedi: addi_apci_1032: Fix endian problem for COS sample (Ian Abbott)   
  - staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan (Lee Gibson)   
  - staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd (Lee Gibson)   
  - staging: ks7010: prevent buffer overflow in ks_wlan_set_scan() (Dan Carpenter)   
  - staging: rtl8188eu: fix potential memory corruption in rtw_check_beacon_data() (Dan Carpenter)   
  - staging: rtl8712: unterminated string leads to read overflow (Dan Carpenter)   
  - staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan() (Dan Carpenter)   
  - staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan() (Dan Carpenter)   
  - usbip: fix vhci_hcd attach_store() races leading to gpf (Shuah Khan)   
  - usbip: fix stub_dev usbip_sockfd_store() races leading to gpf (Shuah Khan)   
  - usbip: fix vudc to check for stream socket (Shuah Khan)   
  - usbip: fix vhci_hcd to check for stream socket (Shuah Khan)   
  - usbip: fix stub_dev to check for stream socket (Shuah Khan)   
  - USB: serial: cp210x: add some more GE USB IDs (Sebastian Reichel)   
  - USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter (Karan Singhal)   
  - USB: serial: ch341: add new Product ID (Niv Sardi)   
  - USB: serial: io_edgeport: fix memory leak in edge_startup (Pavel Skripkin)   
  - usb: xhci: Fix ASMedia ASM1042A and ASM3242 DMA addressing (Forest Crossman)   
  - xhci: Improve detection of device initiated wake signal. (Mathias Nyman)   
  - usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM (Yoshihiro Shimoda)   
  - usb: gadget: f_uac1: stop playback on function disable (Ruslan Bilovol)   
  - usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot (Ruslan Bilovol)   
  - USB: gadget: u_ether: Fix a configfs return code (Dan Carpenter)   
  - Goodix Fingerprint device is not a modem (Yorick de Wid)   
  - mmc: core: Fix partition switch time for eMMC (Adrian Hunter)   
  - s390/dasd: fix hanging IO request during DASD driver unbind (Stefan Haberland)   
  - s390/dasd: fix hanging DASD driver unbind (Stefan Haberland)   
  - Revert 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file capabilities") (Eric W. Biederman)   
  - ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar (Takashi Iwai)   
  - ALSA: hda: Avoid spurious unsol event handling during S3/S4 (Takashi Iwai)   
  - ALSA: hda: Drop the BATCH workaround for AMD controllers (Takashi Iwai)   
  - ALSA: hda/hdmi: Cancel pending works before suspend (Takashi Iwai)   
  - scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling (Mike Christie)   
  - s390/smp: __smp_rescan_cpus() - move cpumask away from stack (Heiko Carstens)   
  - PCI: mediatek: Add missing of_node_put() to fix reference leak (Krzysztof Wilczyński)   
  - PCI: xgene-msi: Fix race in installing chained irq handler (Martin Kaiser)   
  - powerpc/perf: Record counter overflow always if SAMPLE_IP is unset (Athira Rajeev)   
  - powerpc: improve handling of unrecoverable system reset (Nicholas Piggin)   
  - mmc: mediatek: fix race condition between msdc_request_timeout and irq (Chaotian Jing)   
  - mmc: mxs-mmc: Fix a resource leak in an error handling path in 'mxs_mmc_probe()' (Christophe JAILLET)   
  - udf: fix silent AED tagLocation corruption (Steven J. Magnani)   
  - net: phy: fix save wrong speed and duplex problem if autoneg is on (Guangbin Huang)   
  - media: usbtv: Fix deadlock on suspend (Maxim Mikityanskiy)   
  - s390/cio: return -EFAULT if copy_to_user() fails (Eric Farman)   
  - drm: meson_drv add shutdown function (Artem Lapkin)   
  - drm/compat: Clear bounce structures (Daniel Vetter)   
  - s390/cio: return -EFAULT if copy_to_user() fails again (Wang Qing)   
  - perf traceevent: Ensure read cmdlines are null terminated. (Ian Rogers)   
  - net: stmmac: stop each tx channel independently (Joakim Zhang)   
  - net: davicom: Fix regulator not turned off on driver removal (Paul Cercueil)   
  - net: davicom: Fix regulator not turned off on failed probe (Paul Cercueil)   
  - net: lapbether: Remove netif_start_queue / netif_stop_queue (Xie He)   
  - cipso,calipso: resolve a number of problems with the DOI refcounts (Paul Moore)   
  - net: usb: qmi_wwan: allow qmimux add/del with master up (Daniele Palmas)   
  - net: sched: avoid duplicates in classes dump (Maximilian Heyne)   
  - net: stmmac: fix incorrect DMA channel intr enable setting of EQoS v4.10 (Ong Boon Leong)   
  - net/mlx4_en: update moderation when config reset (Kevin(Yudong) Yang)   
  - sh_eth: fix TRSCER mask for SH771x (Sergey Shtylyov)   
  - Revert "mm, slub: consider rest of partial list if acquire_slab() fails" (Linus Torvalds)   
  - cifs: return proper error code in statfs(2) (Paulo Alcantara)   
  - netfilter: x_tables: gpf inside xt_find_revision() (Vasily Averin)   
  - can: flexcan: enable RX FIFO after FRZ/HALT valid (Joakim Zhang)   
  - can: flexcan: assert FRZ bit in flexcan_chip_freeze() (Joakim Zhang)   
  - can: skb: can_skb_set_owner(): fix ref counting if socket was closed before setting skb ownership (Oleksij Rempel)   
  - net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0 (Balazs Nemeth)   
  - net: Fix gro aggregation for udp encaps with zero csum (Daniel Borkmann)   
  - ath9k: fix transmitting to stations in dynamic SMPS mode (Felix Fietkau)   
  - ethernet: alx: fix order of calls on resume (Jakub Kicinski)   
  - uapi: nfnetlink_cthelper.h: fix userspace compilation error (Dmitry V. Levin)   
  - Linux 4.14.225 (Greg Kroah-Hartman)   
  - drm/msm/a5xx: Remove overwriting A5XX_PC_DBG_ECO_CNTL register (AngeloGioacchino Del Regno)   
  - misc: eeprom_93xx46: Add quirk to support Microchip 93LC46B eeprom (Aswath Govindraju)   
  - PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller (Bjorn Helgaas)   
  - platform/x86: acer-wmi: Add ACER_CAP_KBD_DOCK quirk for the Aspire Switch 10E SW3-016 (Hans de Goede)   
  - platform/x86: acer-wmi: Add support for SW_TABLET_MODE on Switch devices (Hans de Goede)   
  - platform/x86: acer-wmi: Add ACER_CAP_SET_FUNCTION_MODE capability flag (Hans de Goede)   
  - platform/x86: acer-wmi: Add new force_caps module parameter (Hans de Goede)   
  - platform/x86: acer-wmi: Cleanup accelerometer device handling (Hans de Goede)   
  - platform/x86: acer-wmi: Cleanup ACER_CAP_FOO defines (Hans de Goede)   
  - mwifiex: pcie: skip cancel_work_sync() on reset failure path (Tsuchiya Yuto)   
  - iommu/amd: Fix sleeping in atomic in increase_address_space() (Andrey Ryabinin)   
  - dm table: fix iterate_devices based device capability checks (Jeffle Xu)   
  - rsxx: Return -EFAULT if copy_to_user() fails (Dan Carpenter)   
  - ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits (Colin Ian King)   
  - usbip: tools: fix build error for multiple definition (Antonio Borneo)   
  - PM: runtime: Update device status before letting suppliers suspend (Rafael J. Wysocki)   
  - btrfs: fix raid6 qstripe kmap (Ira Weiny)   
  - btrfs: raid56: simplify tracking of Q stripe presence (David Sterba)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2112.el7uek]
changelog:
  - RDMA/rxe: Use correct sizing on buffers holding page DMA addresses (Shiraz Saleem)  [Orabug: 32648073]  
  - RDMA/core: Fix corrupted SL on passive side (Håkon Bugge)  [Orabug: 32662968]  
  - rds: Bug in rds_tcp_tune() prevents rds_tcp_rcvbuf tunable from working properly (William Kucharski)  [Orabug: 32665250]  
  - Linux 4.14.227 (Greg Kroah-Hartman)   
  - genirq: Disable interrupts for force threaded handlers (Thomas Gleixner)   
  - ext4: fix potential error in ext4_do_update_inode (Shijie Luo)   
  - ext4: do not try to set xattr into ea_inode if value is empty (zhangyi (F))   
  - ext4: find old entry again if failed to rename whiteout (zhangyi (F))   
  - x86: Introduce TS_COMPAT_RESTART to fix get_nr_restart_syscall() (Oleg Nesterov)   
  - x86: Move TS_COMPAT back to asm/thread_info.h (Oleg Nesterov)   
  - kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data() (Oleg Nesterov)   
  - x86/ioapic: Ignore IRQ2 again (Thomas Gleixner)   
  - perf/x86/intel: Fix a crash caused by zero PEBS status (Kan Liang)   
  - PCI: rpadlpar: Fix potential drc_name corruption in store functions (Tyrel Datwyler)   
  - iio: hid-sensor-temperature: Fix issues of timestamp channel (Ye Xiang)   
  - iio: hid-sensor-prox: Fix scale not correct issue (Ye Xiang)   
  - iio: hid-sensor-humidity: Fix alignment issue of timestamp channel (Ye Xiang)   
  - iio: gyro: mpu3050: Fix error handling in mpu3050_trigger_handler (Dinghao Liu)   
  - iio: adis16400: Fix an error code in adis16400_initial_setup() (Dan Carpenter)   
  - iio:adc:qcom-spmi-vadc: add default scale to LR_MUX2_BAT_ID channel (Jonathan Albrieux)   
  - iio:adc:stm32-adc: Add HAS_IOMEM dependency (Jonathan Cameron)   
  - usb: gadget: configfs: Fix KASAN use-after-free (Jim Lin)   
  - USB: replace hardcode maximum usb string length by definition (Macpaul Lin)   
  - usb-storage: Add quirk to defeat Kindle's automatic unload (Alan Stern)   
  - nvme-rdma: fix possible hang when failing to set io queues (Sagi Grimberg)   
  - scsi: lpfc: Fix some error codes in debugfs (Dan Carpenter)   
  - net/qrtr: fix __netdev_alloc_skb call (Pavel Skripkin)   
  - sunrpc: fix refcount leak for rpc auth modules (Daniel Kobras)   
  - svcrdma: disable timeouts on rdma backchannel (Timo Rothenpieler)   
  - NFSD: Repair misuse of sv_lock in 5.10.16-rt30. (Joe Korty)   
  - nvmet: don't check iosqes,iocqes for discovery controllers (Sagi Grimberg)   
  - btrfs: fix race when cloning extent buffer during rewind of an old root (Filipe Manana)   
  - tools build feature: Check if pthread_barrier_t is available (Arnaldo Carvalho de Melo)   
  - perf: Make perf able to build with latest libbfd (Changbin Du)   
  - tools build: Check if gettid() is available before providing helper (Arnaldo Carvalho de Melo)   
  - tools build feature: Check if eventfd() is available (Arnaldo Carvalho de Melo)   
  - tools build feature: Check if get_current_dir_name() is available (Arnaldo Carvalho de Melo)   
  - perf tools: Use - Revert "PM: runtime: Update device status before letting suppliers suspend" (Rafael J. Wysocki)   
  - bpf: Prohibit alu ops for pointer types not defining ptr_limit (Piotr Krysiuk)   
  - net: dsa: b53: Support setting learning on port (Florian Fainelli)   
  - bpf: Add sanity check for upper ptr_limit (Piotr Krysiuk)   
  - bpf: Simplify alu_limit masking for pointer arithmetic (Piotr Krysiuk)   
  - bpf: Fix off-by-one for area size in creating mask to left (Piotr Krysiuk)   
  - ext4: check journal inode extents more carefully (Jan Kara)   
  - ext4: don't allow overlapping system zones (Jan Kara)   
  - ext4: handle error of ext4_setup_system_zone() on remount (Jan Kara)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2113.el7uek]
changelog:
  - uek-rpm: Update SecureBoot Digicert 2021 certificates (Somasundaram Krishnasamy)  [Orabug: 32532670]  
  - rds: Add code to debug rds_tcp loopback hang (Rao Shoaib)  [Orabug: 32422981]  
  - tcp: send in-queue bytes in cmsg upon read (Soheil Hassas Yeganeh)  [Orabug: 32648213]  
  - IB/rxe: increase max MR limit (Vijay Immanuel)  [Orabug: 32648079]  
  - RDMA/rxe: Compute the maximum sges and inline size based on the WQE size (Rao Shoaib)  [Orabug: 32648063]  
  - Linux 4.14.228 (Greg Kroah-Hartman)   
  - xen-blkback: don't leak persistent grants from xen_blkbk_map() (Jan Beulich)   
  - can: peak_usb: Revert "can: peak_usb: add forgotten supported devices" (Marc Kleine-Budde)   
  - ext4: add reclaim checks to xattr code (Jan Kara)   
  - mac80211: fix double free in ibss_leave (Markus Theil)   
  - net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() (Eric Dumazet)   
  - net: sched: validate stab values (Eric Dumazet)   
  - can: dev: Move device back to init netns on owning netns delete (Martin Willi)   
  - locking/mutex: Fix non debug version of mutex_lock_io_nested() (Thomas Gleixner)   
  - scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() (Jia-Ju Bai)   
  - scsi: qedi: Fix error return code of qedi_alloc_global_queues() (Jia-Ju Bai)   
  - perf auxtrace: Fix auxtrace queue conflict (Adrian Hunter)   
  - ACPI: scan: Use unique number for instance_no (Andy Shevchenko)   
  - ACPI: scan: Rearrange memory allocation in acpi_device_add() (Rafael J. Wysocki)   
  - RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (Potnuri Bharat Teja)   
  - net/mlx5e: Fix error path for ethtool set-priv-flag (Aya Levin)   
  - arm64: kdump: update ppos when reading elfcorehdr (Pavel Tatashin)   
  - drm/msm: fix shutdown hook in case GPU components failed to bind (Dmitry Baryshkov)   
  - net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes (Corentin Labbe)   
  - net: cdc-phonet: fix data-interface release on probe failure (Johan Hovold)   
  - mac80211: fix rate mask reset (Johannes Berg)   
  - can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning (Torin Cooper-Bennun)   
  - can: c_can: move runtime PM enable/disable to c_can_platform (Tong Zhang)   
  - can: c_can_pci: c_can_pci_remove(): fix use-after-free (Tong Zhang)   
  - can: peak_usb: add forgotten supported devices (Stephane Grosjean)   
  - ftgmac100: Restart MAC HW once (Dylan Hung)   
  - net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template (Lv Yunlong)   
  - e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 (Dinghao Liu)   
  - e1000e: add rtnl_lock() to e1000_reset_task (Vitaly Lifshits)   
  - net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port (Florian Fainelli)   
  - macvlan: macvlan_count_rx() needs to be aware of preemption (Eric Dumazet)   
  - libbpf: Fix INSTALL flag order (Georgi Valkov)   
  - bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD (Grygorii Strashko)   
  - dm ioctl: fix out of bounds array access when no devices (Mikulas Patocka)   
  - ARM: dts: at91-sama5d27_som1: fix phy address to 7 (Claudiu Beznea)   
  - arm64: dts: ls1043a: mark crypto engine dma coherent (Horia Geantă)   
  - arm64: dts: ls1012a: mark crypto engine dma coherent (Horia Geantă)   
  - arm64: dts: ls1046a: mark crypto engine dma coherent (Horia Geantă)   
  - squashfs: fix xattr id and id lookup sanity checks (Phillip Lougher)   
  - squashfs: fix inode lookup sanity checks (Sean Nyekjaer)   
  - ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign (Sergei Trofimovich)   
  - ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls (Sergei Trofimovich)   
  - nfs: we don't support removing system.nfs4_acl (J. Bruce Fields)   
  - drm/radeon: fix AGP dependency (Christian König)   
  - u64_stats,lockdep: Fix u64_stats_init() vs lockdep (Peter Zijlstra)   
  - sparc64: Fix opcode filtering in handling of no fault loads (Rob Gardner)   
  - atm: idt77252: fix null-ptr-dereference (Tong Zhang)   
  - atm: uPD98402: fix incorrect allocation (Tong Zhang)   
  - net: wan: fix error return code of uhdlc_init() (Jia-Ju Bai)   
  - net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch() (Jia-Ju Bai)   
  - NFS: Correct size calculation for create reply length (Frank Sorenson)   
  - nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default (Timo Rothenpieler)   
  - gpiolib: acpi: Add missing IRQF_ONESHOT (Yang Li)   
  - sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count (Denis Efremov)   
  - net: tehuti: fix error return code in bdx_probe() (Jia-Ju Bai)   
  - ixgbe: Fix memleak in ixgbe_configure_clsu32 (Dinghao Liu)   
  - Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" (Hayes Wang)   
  - atm: lanai: dont run lanai_dev_close if not open (Tong Zhang)   
  - atm: eni: dont release is never initialized (Tong Zhang)   
  - powerpc/4xx: Fix build errors from mfdcr() (Michael Ellerman)   
  - net: fec: ptp: avoid register access when ipg clock is disabled (Heiko Thiery)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2114.el7uek]
changelog:
  - IB/mlx5: Use fragmented QP's buffer for in-kernel users (Guy Levi)  [Orabug: 32753106]  
  - net/mlx5: Refactor fragmented buffer struct fields and init flow (Tariq Toukan)  [Orabug: 32753106]  
  - netfilter: x_tables: Use correct memory barriers. (Mark Tomlinson)  [Orabug: 32709122]  {CVE-2021-29650} 
  - netfilter: x_tables: make xt_replace_table wait until old rules are not used anymore (Florian Westphal)  [Orabug: 32709122]  {CVE-2021-29650} 
  - RDMA/rxe: ipc_bench fails with SoftRoCE plus shpd (Rao Shoaib)  [Orabug: 32716141]  
  - uek-rpm: Enable IRQ time accounting option for UEK5 (Saeed Mirzamohammadi)  [Orabug: 32733984]  
  - Revert "rds: ib: Remove two ib_modify_qp() calls" (Sharath Srinivasan)  [Orabug: 32715566]  
  - Linux 4.14.229 (Greg Kroah-Hartman)   
  - drivers: video: fbcon: fix NULL dereference in fbcon_cursor() (Du Cheng)   
  - staging: rtl8192e: Change state information from u16 to u8 (Atul Gopinathan)   
  - staging: rtl8192e: Fix incorrect source in memcpy() (Atul Gopinathan)   
  - usb: gadget: udc: amd5536udc_pci fix null-ptr-dereference (Tong Zhang)   
  - USB: cdc-acm: fix use-after-free after probe failure (Johan Hovold)   
  - USB: cdc-acm: downgrade message to debug (Oliver Neukum)   
  - USB: cdc-acm: untangle a circular dependency between callback and softint (Oliver Neukum)   
  - cdc-acm: fix BREAK rx code path adding necessary calls (Oliver Neukum)   
  - usb: xhci-mtk: fix broken streams issue on 0.96 xHCI (Chunfeng Yun)   
  - usb: musb: Fix suspend with devices connected for a64 (Tony Lindgren)   
  - USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem (Vincent Palatin)   
  - usbip: vhci_hcd fix shift out-of-bounds in vhci_hub_control() (Shuah Khan)   
  - firewire: nosy: Fix a use-after-free bug in nosy_ioctl() (Zheyu Ma)   
  - extcon: Fix error handling in extcon_dev_register (Dinghao Liu)   
  - extcon: Add stubs for extcon_register_notifier_all() functions (Krzysztof Kozlowski)   
  - pinctrl: rockchip: fix restore error in resume (Wang Panzhenzhuan)   
  - reiserfs: update reiserfs_xattrs_initialized() condition (Tetsuo Handa)   
  - drm/amdgpu: check alignment on CPU page for bo map (Xℹ Ruoyao)   
  - drm/amdgpu: fix offset calculation in amdgpu_vm_bo_clear_mappings() (Nirmoy Das)   
  - mm: fix race by making init_zero_pfn() early_initcall (Ilya Lipnitskiy)   
  - tracing: Fix stack trace event size (Steven Rostedt (VMware))   
  - ALSA: hda/realtek: call alc_update_headset_mode() in hp_automute_hook (Hui Wang)   
  - ALSA: hda/realtek: fix a determine_headset_type issue for a Dell AIO (Hui Wang)   
  - ALSA: usb-audio: Apply sample rate quirk to Logitech Connect (Ikjoon Jang)   
  - bpf: Remove MTU check in __bpf_skb_max_len (Jesper Dangaard Brouer)   
  - net: wan/lmc: unregister device when no matching device is found (Tong Zhang)   
  - appletalk: Fix skb allocation size in loopback case (Doug Brown)   
  - net: ethernet: aquantia: Handle error cleanup of start on open (Nathan Rossi)   
  - brcmfmac: clear EAP/association status bits on linkdown events (Luca Pesce)   
  - ext4: do not iput inode under running transaction in ext4_rename() (zhangyi (F))   
  - ASoC: rt5659: Update MCLK rate in set_sysclk() (Sameer Pujar)   
  - staging: comedi: cb_pcidas64: fix request_irq() warn (Tong Zhang)   
  - staging: comedi: cb_pcidas: fix request_irq() warn (Tong Zhang)   
  - scsi: qla2xxx: Fix broken #endif placement (Alexey Dobriyan)   
  - scsi: st: Fix a use after free in st_open() (Lv Yunlong)   
  - vhost: Fix vhost_vq_reset() (Laurent Vivier)   
  - powerpc: Force inlining of cpu_has_feature() to avoid build failure (Christophe Leroy)   
  - ASoC: cs42l42: Always wait at least 3ms after reset (Lucas Tanure)   
  - ASoC: cs42l42: Fix mixer volume control (Lucas Tanure)   
  - ASoC: es8316: Simplify adc_pga_gain_tlv table (Hans de Goede)   
  - ASoC: sgtl5000: set DAP_AVC_CTRL register to correct default value on probe (Benjamin Rood)   
  - ASoC: rt5651: Fix dac- and adc- vol-tlv values being off by a factor of 10 (Hans de Goede)   
  - ASoC: rt5640: Fix dac- and adc- vol-tlv values being off by a factor of 10 (Hans de Goede)   
  - rpc: fix NULL dereference on kmalloc failure (J. Bruce Fields)   
  - ext4: fix bh ref count on error paths (Zhaolong Zhang)   
  - ipv6: weaken the v4mapped source check (Jakub Kicinski)   
  - selinux: vsock: Set SID for socket returned by accept() (David Brazdil)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2115.el7uek]
changelog:
  - tcp: do not mess with cloned skbs in tcp_add_backlog() (Eric Dumazet)  [Orabug: 32760315]  
  - md/bitmap: wait for external bitmap writes to complete during tear down (Sudhakar Panneerselvam)  [Orabug: 32764209]  
  - rds: ib: move statistics counting from caller to callee in rds_ib_recv_refill (Håkon Bugge)  [Orabug: 32738050]  
  - ocfs2: fix deadlock between setattr and dio_end_io_write (Wengang Wang)  [Orabug: 32763850]  
  - IB/mlx5: Reduce max order of memory allocated for xlt update (Praveen Kumar Kannoju)  [Orabug: 32751625]  
  - Linux 4.14.230 (Greg Kroah-Hartman)   
  - can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate (Angelo Dureghello)   
  - init/Kconfig: make COMPILE_TEST depend on HAS_IOMEM (Masahiro Yamada)   
  - init/Kconfig: make COMPILE_TEST depend on !S390 (Heiko Carstens)   
  - bpf, x86: Validate computation of branch displacements for x86-64 (Piotr Krysiuk)   
  - cifs: Silently ignore unknown oplock break handle (Vincent Whitchurch)   
  - cifs: revalidate mapping when we open files for SMB1 POSIX (Ronnie Sahlberg)   
  - ia64: mca: allocate early mca with GFP_ATOMIC (Sergei Trofimovich)   
  - scsi: target: pscsi: Clean up after failure in pscsi_map_sg() (Martin Wilck)   
  - x86/build: Turn off -fcf-protection for realmode targets (Arnd Bergmann)   
  - platform/x86: thinkpad_acpi: Allow the FnLock LED to change state (Esteve Varela Colominas)   
  - drm/msm: Ratelimit invalid-fence message (Rob Clark)   
  - mac80211: choose first enabled channel for monitor (Karthikeyan Kathirvel)   
  - mISDN: fix crash in fritzpci (Tong Zhang)   
  - net: pxa168_eth: Fix a potential data race in pxa168_eth_remove (Pavel Andrianov)   
  - ARM: dts: am33xx: add aliases for mmc interfaces (Mans Rullgard)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2116.el7uek]
changelog:
  - uek-rpm: Add Amazon Elastic Network Adapter module to nano rpm. (Somasundaram Krishnasamy)  [Orabug: 32795493]  
  - Linux 4.14.231 (Greg Kroah-Hartman)   
  - xen/events: fix setting irq affinity (Juergen Gross)   
  - perf map: Tighten snprintf() string precision to pass gcc check on some 32-bit arches (Arnaldo Carvalho de Melo)   
  - netfilter: x_tables: fix compat match/target pad out-of-bound write (Florian Westphal)   
  - net: phy: broadcom: Only advertise EEE for supported modes (Florian Fainelli)   
  - block: only update parent bi_status when bio fail (Yufen Yu)   
  - gfs2: report "already frozen/thawed" errors (Bob Peterson)   
  - drm/imx: imx-ldb: fix out of bounds array access warning (Arnd Bergmann)   
  - KVM: arm64: Disable guest access to trace filter controls (Suzuki K Poulose)   
  - KVM: arm64: Hide system instruction access to Trace registers (Suzuki K Poulose)   
  - Revert "cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath." (Greg Kroah-Hartman)   
  - net: ieee802154: stop dump llsec params for monitors (Alexander Aring)   
  - net: ieee802154: forbid monitor for del llsec seclevel (Alexander Aring)   
  - net: ieee802154: forbid monitor for set llsec params (Alexander Aring)   
  - net: ieee802154: fix nl802154 del llsec devkey (Alexander Aring)   
  - net: ieee802154: fix nl802154 add llsec key (Alexander Aring)   
  - net: ieee802154: fix nl802154 del llsec dev (Alexander Aring)   
  - net: ieee802154: fix nl802154 del llsec key (Alexander Aring)   
  - net: ieee802154: nl-mac: fix check on panid (Alexander Aring)   
  - net: mac802154: Fix general protection fault (Pavel Skripkin)   
  - drivers: net: fix memory leak in peak_usb_create_dev (Pavel Skripkin)   
  - drivers: net: fix memory leak in atusb_probe (Pavel Skripkin)   
  - net: tun: set tun->dev->addr_len during TUNSETLINK processing (Phillip Potter)   
  - cfg80211: remove WARN_ON() in cfg80211_sme_connect (Du Cheng)   
  - usbip: fix vudc usbip_sockfd_store races leading to gpf (Shuah Khan)   
  - net/ncsi: Avoid GFP_KERNEL in response handler (Samuel Mendoza-Jonas)   
  - net/ncsi: Refactor MAC, VLAN filters (Samuel Mendoza-Jonas)   
  - net/ncsi: Add generic netlink family (Samuel Mendoza-Jonas)   
  - net/ncsi: Don't return error on normal response (Samuel Mendoza-Jonas)   
  - net/ncsi: Improve general state logging (Samuel Mendoza-Jonas)   
  - net/ncsi: Make local function ncsi_get_filter() static (Wei Yongjun)   
  - clk: socfpga: fix iomem pointer cast on 64-bit (Krzysztof Kozlowski)   
  - RDMA/cxgb4: check for ipv6 address properly while destroying listener (Potnuri Bharat Teja)   
  - net/mlx5: Fix placement of log_max_flow_counter (Raed Salem)   
  - s390/cpcmd: fix inline assembly register clobbering (Alexander Gordeev)   
  - workqueue: Move the position of debug_work_activate() in __queue_work() (Zqiang)   
  - clk: fix invalid usage of list cursor in unregister (Lukasz Bartosik)   
  - clk: fix invalid usage of list cursor in register (Lukasz Bartosik)   
  - soc/fsl: qbman: fix conflicting alignment attributes (Arnd Bergmann)   
  - ASoC: sunxi: sun4i-codec: fill ASoC card owner (Bastian Germann)   
  - net/ncsi: Avoid channel_monitor hrtimer deadlock (Milton Miller)   
  - ARM: dts: imx6: pbab01: Set vmmc supply for both SD interfaces (Stefan Riedmueller)   
  - net:tipc: Fix a double free in tipc_sk_mcast_rcv (Lv Yunlong)   
  - gianfar: Handle error code at MAC address change (Claudiu Manoil)   
  - sch_red: fix off-by-one checks in red_check_params() (Eric Dumazet)   
  - amd-xgbe: Update DMA coherency values (Shyam Sundar S K)   
  - ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled for some chips (Shengjiu Wang)   
  - regulator: bd9571mwv: Fix AVS and DVFS voltage range (Geert Uytterhoeven)   
  - i2c: turn recovery error on init to debug (Wolfram Sang)   
  - usbip: synchronize event handler with sysfs code paths (Shuah Khan)   
  - usbip: stub-dev synchronize sysfs code paths (Shuah Khan)   
  - usbip: add sysfs_lock to synchronize sysfs code paths (Shuah Khan)   
  - net: sched: sch_teql: fix null-pointer dereference (Pavel Tikhomirov)   
  - net: ensure mac header is set in virtio_net_hdr_to_skb() (Eric Dumazet)   
  - batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field (Tetsuo Handa)   
  - ARM: dts: turris-omnia: configure LED[2]/INTn pin as interrupt pin (Marek Behún)   
  - parisc: avoid a warning on u8 cast for cmpxchg on u8 pointers (Gao Xiang)   
  - parisc: parisc-agp requires SBA IOMMU driver (Helge Deller)   
  - fs: direct-io: fix missing sdio->boundary (Jack Qiu)   
  - ia64: fix user_stack_pointer() for ptrace() (Sergei Trofimovich)   
  - net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh (Muhammad Usama Anjum)   
  - xen/evtchn: Change irq_info lock to raw_spinlock_t (Luca Fancellu)   
  - nfc: Avoid endless loops caused by repeated llcp_sock_connect() (Xiaoming Ni)   
  - nfc: fix memory leak in llcp_sock_connect() (Xiaoming Ni)   {CVE-2020-25672} 
  - nfc: fix refcount leak in llcp_sock_connect() (Xiaoming Ni)   {CVE-2020-25671} 
  - nfc: fix refcount leak in llcp_sock_bind() (Xiaoming Ni)   {CVE-2020-25670} 
  - ASoC: intel: atom: Stop advertising non working S24LE support (Hans de Goede)   
  - ALSA: aloop: Fix initialization of controls (Jonas Holmberg)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2118.el7uek]
changelog:
  - IB/ipoib: Improve latency in ipoib/cm connection formation (Manjunath Patil)  [Orabug: 32852999]  
  - exec, elf: fix reserve_va_range() sanity check (Anthony Yznaga)  [Orabug: 32387886]  
  - exec, elf: use already allocated notes data in reserve_va_range() (Anthony Yznaga)  [Orabug: 32387886]  
  - mm: madv_doexec_flag sysctl (Anthony Yznaga)  [Orabug: 32387886]  
  - mm: introduce MADV_DOEXEC (Anthony Yznaga)  [Orabug: 32387886]  
  - exec, elf: require opt-in for accepting preserved mem (Anthony Yznaga)  [Orabug: 32387886]  
  - mm: introduce VM_EXEC_KEEP (Anthony Yznaga)  [Orabug: 32387886]  
  - mm: fail exec if stack expansion will overlap another vma (Anthony Yznaga)  [Orabug: 32387886]  
  - mm: do not assume only the stack vma exists in setup_arg_pages() (Anthony Yznaga)  [Orabug: 32387886]  
  - ELF: when loading PIE binaries check for overlap with existing mappings (Anthony Yznaga)  [Orabug: 32387886]  
  - net/mlx4: Treat VFs fair when handling comm_channel_events (Hans Westgaard Ry)  [Orabug: 32763088]  
  - x86/amd: Disable IBS on Rome processors due to erratum 1215 (Boris Ostrovsky)  [Orabug: 32817186]  
  - Linux 4.14.232 (Greg Kroah-Hartman)   
  - USB: CDC-ACM: fix poison/unpoison imbalance (Oliver Neukum)   
  - net: hso: fix NULL-deref on disconnect regression (Johan Hovold)   
  - x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access (Mike Galbraith)   
  - ia64: tools: remove duplicate definition of ia64_mf() on ia64 (John Paul Adrian Glaubitz)   
  - ia64: fix discontig.c section mismatches (Randy Dunlap)   
  - cavium/liquidio: Fix duplicate argument (Wan Jiabing)   
  - xen-netback: Check for hotplug-status existence before watching (Michael Brown)   
  - s390/entry: save the caller of psw_idle (Vasily Gorbik)   
  - net: geneve: check skb is large enough for IPv4/IPv6 header (Phillip Potter)   
  - ARM: dts: Fix swapped mmc order for omap3 (Tony Lindgren)   
  - HID: wacom: Assign boolean values to a bool variable (Jiapeng Zhong)   
  - HID: alps: fix error return code in alps_input_configured() (Jia-Ju Bai)   
  - pinctrl: lewisburg: Update number of pins in community (Yuanyuan Zhong)   
  - ext4: correct error label in ext4_rename() (Zhang Yi)   
  - net: hso: fix null-ptr-deref during tty device unregistration (Anirudh Rayabharam)   
  - gup: document and work around "COW can break either way" issue (Linus Torvalds)   
  - ARM: 9071/1: uprobes: Don't hook on thumb instructions (Fredrik Strupe)   
  - ARM: footbridge: fix PCI interrupt mapping (Russell King)   
  - ibmvnic: remove duplicate napi_schedule call in open function (Lijun Pan)   
  - ibmvnic: remove duplicate napi_schedule call in do_reset function (Lijun Pan)   
  - ibmvnic: avoid calling napi_disable() twice (Lijun Pan)   
  - i40e: fix the panic when running bpf in xdpdrv mode (Jason Xing)   
  - net: sit: Unregister catch-all devices (Hristo Venev)   
  - net: davicom: Fix regulator not turned off on failed probe (Christophe JAILLET)   
  - netfilter: nft_limit: avoid possible divide error in nft_limit_init (Eric Dumazet)   
  - netfilter: conntrack: do not print icmpv6 as unknown via /proc (Pablo Neira Ayuso)   
  - scsi: libsas: Reset num_scatter if libata marks qc as NODATA (Jolly Shah)   
  - arm64: fix inline asm in load_unaligned_zeropad() (Peter Collingbourne)   
  - readdir: make sure to verify directory entry for legacy interfaces too (Linus Torvalds)   
  - HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices (Ping Cheng)   
  - Input: i8042 - fix Pegatron C15B ID entry (Arnd Bergmann)   
  - mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN (Seevalamuthu Mariappan)   
  - usbip: Fix incorrect double assignment to udc->ud.tcp_rx (Colin Ian King)   
  - pcnet32: Use pci_resource_len to validate PCI resource (Guenter Roeck)   
  - net: ieee802154: forbid monitor for add llsec seclevel (Alexander Aring)   
  - net: ieee802154: stop dump llsec seclevels for monitors (Alexander Aring)   
  - net: ieee802154: forbid monitor for add llsec devkey (Alexander Aring)   
  - net: ieee802154: stop dump llsec devkeys for monitors (Alexander Aring)   
  - net: ieee802154: forbid monitor for add llsec dev (Alexander Aring)   
  - net: ieee802154: stop dump llsec devs for monitors (Alexander Aring)   
  - net: ieee802154: stop dump llsec keys for monitors (Alexander Aring)   
  - scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state (Martin Wilck)   
  - ASoC: fsl_esai: Fix TDM slot setup for I2S mode (Alexander Shiyan)   
  - ARM: keystone: fix integer overflow warning (Arnd Bergmann)   
  - neighbour: Disregard DEAD dst in neigh_update (Tong Zhu)   
  - arc: kernel: Return -EFAULT if copy_to_user() fails (Wang Qing)   
  - ARM: dts: Fix moving mmc devices with aliases for omap4 & 5 (Tony Lindgren)   
  - dmaengine: dw: Make it dependent to HAS_IOMEM (Andy Shevchenko)   
  - Input: nspire-keypad - enable interrupts only when opened (Fabian Vogt)   
  - net/sctp: fix race condition in sctp_destroy_sock (Or Cohen)   {CVE-2021-23133}


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2120.el7uek]
changelog:
  - video: hyperv_fb: Add ratelimit on error message (Michael Kelley)  [Orabug: 32867570]  
  - Drivers: hv: vmbus: Initialize unload_event statically (Andrea Parri (Microsoft))  [Orabug: 32867570]  
  - Drivers: hv: vmbus: Increase wait time for VMbus unload (Michael Kelley)  [Orabug: 32867570]  
  - rds: Change return code from rds_send_xmit() when lock is taken (Håkon Bugge)  [Orabug: 32852361]  
  - rds: Fix unintended fall-through in rds_send_worker (Håkon Bugge)  [Orabug: 32852361]  
  - mm/memory-failure: unnecessary amount of unmapping (Jane Chu)  [Orabug: 32838006]  
  - mm: fix memory_failure() handling of dax-namespace metadata (Dan Williams)  [Orabug: 32838006]  
  - memremap: move from kernel/ to mm/ (Christoph Hellwig)  [Orabug: 32838006]  
  - mm,hwpoison: send SIGBUS to PF_MCE_EARLY processes on action required events (Aili Yao)  [Orabug: 32838006]  
  - mm,memory_failure: always pin the page in madvise_inject_error (Oscar Salvador)  [Orabug: 32838006]  
  - mm/memory-failure.c: remove unused macro `writeback' (Alex Shi)  [Orabug: 32838006]  
  - mm/memory-failure: do pgoff calculation before for_each_process() (Xianting Tian)  [Orabug: 32838006]  
  - mm/memory-failure: send SIGBUS(BUS_MCEERR_AR) only to current thread (Naoya Horiguchi)  [Orabug: 32838006]  
  - mm/memory-failure: prioritize prctl(PR_MCE_KILL) over vm.memory_failure_early_kill (Naoya Horiguchi)  [Orabug: 32838006]  
  - mm, memory_failure: don't send BUS_MCEERR_AO for action required error (Wetp Zhang)  [Orabug: 32838006]  
  - uek-rpm: config-aarch-embedded2 update for networking options (Thomas Tai)  [Orabug: 32894174]


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2121.el7uek]
changelog:
  - scsi: iscsi: Fix iSCSI cls conn state (Gulam Mohamed)  [Orabug: 32916587]  
  - scsi: iscsi: Fix race condition between login and sync thread (Gulam Mohamed)  [Orabug: 32916587]  
  - scsi: iscsi: Report connection state in sysfs (Gulam Mohamed)  [Orabug: 32916587]  
  - uek-rpm: config-aarch-embedded2 add missing networking options (Thomas Tai)  [Orabug: 32899527]  
  - scsi: core: add scsi_host_busy_iter() (Hannes Reinecke)  [Orabug: 32625117]  
  - scsi: fnic: Use scsi_host_busy_iter() to traverse commands (Hannes Reinecke)  [Orabug: 32625117]  
  - scsi: fnic: Kill 'exclude_id' argument to fnic_cleanup_io() (Hannes Reinecke)  [Orabug: 32625117]  
  - scsi: fnic: Validate io_req before others (Karan Tilak Kumar)  [Orabug: 32625117]  
  - scsi: fnic: Set scsi_set_resid() only for underflow (Karan Tilak Kumar)  [Orabug: 32625117]  
  - scsi: fnic: Fix memleak in vnic_dev_init_devcmd2 (Dinghao Liu)  [Orabug: 32625117]  
  - scsi: fnic: Avoid looping in TRANS ETH on unload (Karan Tilak Kumar)  [Orabug: 32625117]  
  - scsi: fnic: Change shost_printk() to FNIC_FCS_DBG() (Karan Tilak Kumar)  [Orabug: 32625117]  
  - scsi: fnic: Simplify the return expression of vnic_wq_copy_alloc() (Liu Shixin)  [Orabug: 32625117]  
  - scsi: fnic: Fix inconsistent format argument type in fnic_debugfs.c (Ye Bin)  [Orabug: 32625117]  
  - scsi: fnic: Do not call 'scsi_done()' for unhandled commands (Hannes Reinecke)  [Orabug: 32625117]  
  - scsi: fnic: Remove unneeded semicolon (Jason Yan)  [Orabug: 32625117]  
  - scsi: fnic: Remove set but not used variable in is_fnic_fip_flogi_reject() (Jason Yan)  [Orabug: 32625117]  
  - scsi: fnic: Remove set but not used 'old_vlan' (Jason Yan)  [Orabug: 32625117]  
  - scsi: fnic: Use eth_broadcast_addr() to assign broadcast address (Miaohe Lin)  [Orabug: 32625117]  
  - scsi: fnic: Use true, false for fnic->internal_reset_inprogress (Jason Yan)  [Orabug: 32625117]  
  - scsi: fnic: make vnic_wq_get_ctrl and vnic_wq_alloc_ring static (Jason Yan)  [Orabug: 32625117]  
  - scsi: fnic: make fnic_list and fnic_list_lock static (Jason Yan)  [Orabug: 32625117]  
  - scsi: fnic: make some symbols static (Jason Yan)  [Orabug: 32625117]  
  - scsi: fnic: Use scnprintf() for avoiding potential buffer overflow (Takashi Iwai)  [Orabug: 32625117]  
  - scsi: fnic: make array dev_cmd_err static const, makes object smaller (Colin Ian King)  [Orabug: 32625117]  
  - scsi: fnic: print port speed only at driver init or speed change (John Pittman)  [Orabug: 32625117]  
  - scsi: fnic: remove redundant assignment of variable rc (Colin Ian King)  [Orabug: 32625117]  
  - scsi: fnic: Remove set but not used variable 'vdev' (YueHaibing)  [Orabug: 32625117]  
  - scsi: fnic: no need to check return value of debugfs_create functions (Greg Kroah-Hartman)  [Orabug: 32625117]  
  - scsi: fnic: Update fnic driver version to 1.6.0.47 (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: Enable fnic devcmd2 interface (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: Adding devcmd2 init and posting interfaces (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: Add devcmd2 initialization helpers (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: fnic devcmd2 controller definitions (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: fnic devcmd2 interface definitions (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: Impose upper limit on max. # of CQs processed per intr (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: RQ enable and then post descriptors (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: delaying vnic dev enable till after req intr (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: Warn when calling done for IO not issued to fw (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: fnic stats for max CQs processed and ISR time (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: Add port speed stat to fnic debug stats (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: use fnic_lock to guard fnic->state_flags (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: vnic_rq_clean change BUG_ON to WARN_ON (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: change fnic queue depth to 256 (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: support to display 20G port speed (Satish Kharat)  [Orabug: 32625117]  
  - scsi: fnic: Use vzalloc (Sabyasachi Gupta)  [Orabug: 32625117]  
  - fnic: fix fnic_scsi_host_{start,end}_tag (Christoph Hellwig)  [Orabug: 32625117]  
  - scsi: fnic: replace gross legacy tag hack with blk-mq hack (Jens Axboe)  [Orabug: 32625117]  
  - scsi: fnic: switch to generic DMA API (Christoph Hellwig)  [Orabug: 32625117]  
  - scsi: fnic: fix spelling mistake in fnic stats "Abord" -> "Abort" (Colin Ian King)  [Orabug: 32625117]  
  - scsi: fnic: use 64-bit timestamps (Arnd Bergmann)  [Orabug: 32625117]  
  - scsi: fnic: use kzalloc in fnic_fcoe_process_vlan_resp (Rasmus Villemoes)  [Orabug: 32625117]  
  - scsi: fnic: add a space after %p in printf format (Nicolas Iooss)  [Orabug: 32625117]  
  - scsi: fnic: Fix coccinelle warnings (Vasyl Gomonovych)  [Orabug: 32625117]  
  - Linux 4.14.233 (Greg Kroah-Hartman)   
  - ipv6: remove extra dev_hold() for fallback tunnels (Eric Dumazet)   
  - xhci: Do not use GFP_KERNEL in (potentially) atomic context (Christophe JAILLET)   
  - ip6_tunnel: sit: proper dev_{hold|put} in ndo_[un]init methods (Eric Dumazet)   
  - sit: proper dev_{hold|put} in ndo_[un]init methods (Eric Dumazet)   
  - serial: 8250: fix potential deadlock in rs485-mode (Tomas Melin)   
  - lib: stackdepot: turn depot_lock spinlock to raw_spinlock (Zqiang)   
  - block: reexpand iov_iter after read/write (yangerkun)   
  - ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP (Hui Wang)   
  - gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055 (Hans de Goede)   
  - ceph: fix fscache invalidation (Jeff Layton)   
  - um: Mark all kernel symbols as local (Johannes Berg)   
  - Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state (Hans de Goede)   
  - Input: elants_i2c - do not bind to i2c-hid compatible ACPI instantiated devices (Hans de Goede)   
  - ACPI / hotplug / PCI: Fix reference count leak in enable_slot() (Feilong Lin)   
  - ARM: 9066/1: ftrace: pause/unpause function graph tracer in cpu_suspend() (louis.wang)   
  - PCI: thunder: Fix compile testing (Arnd Bergmann)   
  - isdn: capi: fix mismatched prototypes (Arnd Bergmann)   
  - cxgb4: Fix the -Wmisleading-indentation warning (Kaixu Xia)   
  - usb: sl811-hcd: improve misleading indentation (Arnd Bergmann)   
  - kgdb: fix gcc-11 warning on indentation (Arnd Bergmann)   
  - x86/msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes (Arnd Bergmann)   
  - clk: exynos7: Mark aclk_fsys1_200 as critical (Paweł Chmiel)   
  - netfilter: conntrack: Make global sysctls readonly in non-init netns (Jonathon Reinhart)   
  - kobject_uevent: remove warning in init_uevent_argv() (Greg Kroah-Hartman)   
  - thermal/core/fair share: Lock the thermal zone while looping over instances (Lukasz Luba)   
  - MIPS: Avoid handcoded DIVU in `__div64_32' altogether (Maciej W. Rozycki)   
  - MIPS: Avoid DIVU in `__div64_32' is result would be zero (Maciej W. Rozycki)   
  - MIPS: Reinstate platform `__div64_32' handler (Maciej W. Rozycki)   
  - FDDI: defxx: Make MMIO the configuration default except for EISA (Maciej W. Rozycki)   
  - KVM: x86: Cancel pvclock_gtod_work on module removal (Thomas Gleixner)   
  - iio: tsl2583: Fix division by a zero lux_val (Colin Ian King)   
  - iio: gyro: mpu3050: Fix reported temperature value (Dmitry Osipenko)   
  - usb: core: hub: fix race condition about TRSMRCY of resume (Chunfeng Yun)   
  - usb: dwc2: Fix gadget DMA unmap direction (Phil Elwell)   
  - usb: xhci: Increase timeout for HC halt (Maximilian Luz)   
  - usb: dwc3: omap: improve extcon initialization (Marcel Hamer)   
  - blk-mq: Swap two calls in blk_mq_exit_queue() (Bart Van Assche)   
  - ACPI: scan: Fix a memory leak in an error handling path (Christophe JAILLET)   
  - usb: fotg210-hcd: Fix an error message (Christophe JAILLET)   
  - iio: proximity: pulsedlight: Fix rumtime PM imbalance on error (Dinghao Liu)   
  - drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected (Kai-Heng Feng)   
  - userfaultfd: release page in error path to avoid BUG_ON (Axel Rasmussen)   
  - squashfs: fix divide error in calculate_skip() (Phillip Lougher)   
  - powerpc/64s: Fix crashes when toggling entry flush barrier (Michael Ellerman)   
  - powerpc/64s: Fix crashes when toggling stf barrier (Michael Ellerman)   
  - ARC: entry: fix off-by-one error in syscall number validation (Vineet Gupta)   
  - netfilter: nftables: avoid overflows in nft_hash_buckets() (Eric Dumazet)   
  - kernel: kexec_file: fix error return code of kexec_calculate_store_digests() (Jia-Ju Bai)   
  - net: fix nla_strcmp to handle more then one trailing null character (Maciej Żenczykowski)   
  - ksm: fix potential missing rmap_item for stable_node (Miaohe Lin)   
  - mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts() (Miaohe Lin)   
  - khugepaged: fix wrong result value for trace_mm_collapse_huge_page_isolate() (Miaohe Lin)   
  - drm/radeon: Fix off-by-one power_state index heap overwrite (Kees Cook)   
  - sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b (Xin Long)   
  - rtc: ds1307: Fix wday settings for rx8130 (Nobuhiro Iwamatsu)   
  - NFSv4.2 fix handling of sr_eof in SEEK's reply (Olga Kornievskaia)   
  - pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() (Nikola Livic)   
  - NFS: Deal correctly with attribute generation counter overflow (Trond Myklebust)   
  - NFSv4.2: Always flush out writes in nfs42_proc_fallocate() (Trond Myklebust)   
  - rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data() (Jia-Ju Bai)   
  - ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook (Zhen Lei)   
  - PCI: Release OF node in pci_scan_device()'s error path (Dmitry Baryshkov)   
  - f2fs: fix a redundant call to f2fs_balance_fs if an error occurs (Colin Ian King)   
  - ASoC: rt286: Make RT286_SET_GPIO_* readable and writable (David Ward)   
  - net: ethernet: mtk_eth_soc: fix RX VLAN offload (Felix Fietkau)   
  - powerpc/iommu: Annotate nested lock for lockdep (Alexey Kardashevskiy)   
  - wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join (Gustavo A. R. Silva)   
  - wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt (Gustavo A. R. Silva)   
  - powerpc/pseries: Stop calling printk in rtas_stop_self() (Michael Ellerman)   
  - samples/bpf: Fix broken tracex1 due to kprobe argument change (Yaqi Chen)   
  - ASoC: rt286: Generalize support for ALC3263 codec (David Ward)   
  - powerpc/smp: Set numa node before updating mask (Srikar Dronamraju)   
  - sctp: Fix out-of-bounds warning in sctp_process_asconf_param() (Gustavo A. R. Silva)   
  - kconfig: nconf: stop endless search loops (Mihai Moldovan)   
  - selftests: Set CC to clang in lib.mk if LLVM is set (Yonghong Song)   
  - cuse: prevent clone (Miklos Szeredi)   
  - pinctrl: samsung: use 'int' for register masks in Exynos (Krzysztof Kozlowski)   
  - mac80211: clear the beacon's CRC after channel switch (Emmanuel Grumbach)   
  - ip6_vti: proper dev_{hold|put} in ndo_[un]init methods (Eric Dumazet)   
  - Bluetooth: check for zapped sk before connecting (Archie Pusaka)   
  - Bluetooth: initialize skb_queue_head at l2cap_chan_create() (Tetsuo Handa)   
  - Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default (Archie Pusaka)   
  - ALSA: rme9652: don't disable if not enabled (Tong Zhang)   
  - ALSA: hdspm: don't disable if not enabled (Tong Zhang)   
  - ALSA: hdsp: don't disable if not enabled (Tong Zhang)   
  - net: stmmac: Set FIFO sizes for ipq806x (Jonathan McDowell)   
  - tipc: convert dest node's address to network order (Hoang Le)   
  - fs: dlm: fix debugfs dump (Alexander Aring)   
  - tpm: fix error return code in tpm2_get_cc_attrs_tbl() (Zhen Lei)   
  - Revert "fdt: Properly handle "no-map" field in the memory region" (Quentin Perret)   
  - Revert "of/fdt: Make sure no-map does not remove already reserved regions" (Quentin Perret)   
  - sctp: delay auto_asconf init until binding the first addr (Xin Long)   {CVE-2021-23133} 
  - Revert "net/sctp: fix race condition in sctp_destroy_sock" (Xin Long)   
  - smp: Fix smp_call_function_single_async prototype (Arnd Bergmann)   
  - kfifo: fix ternary sign extension bugs (Dan Carpenter)   
  - net:nfc:digital: Fix a double free in digital_tg_recv_dep_req (Lv Yunlong)   
  - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Lv Yunlong)   
  - powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of 'add') (Christophe Leroy)   
  - ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices (Toke Høiland-Jørgensen)   
  - net: davinci_emac: Fix incorrect masking of tx and rx error channel (Colin Ian King)   
  - RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (Sindhu Devale)   
  - vsock/vmci: log once the failed queue pair allocation (Stefano Garzarella)   
  - mwl8k: Fix a double Free in mwl8k_probe_hw (Lv Yunlong)   
  - i2c: sh7760: fix IRQ error path (Sergey Shtylyov)   
  - rtlwifi: 8821ae: upgrade PHY and RF parameters (Ping-Ke Shih)   
  - powerpc/pseries: extract host bridge from pci_bus prior to bus removal (Tyrel Datwyler)   
  - MIPS: pci-legacy: stop using of_pci_range_to_resource (Ilya Lipnitskiy)   
  - i2c: sh7760: add IRQ check (Sergey Shtylyov)   
  - i2c: jz4780: add IRQ check (Sergey Shtylyov)   
  - i2c: emev2: add IRQ check (Sergey Shtylyov)   
  - i2c: cadence: add IRQ check (Sergey Shtylyov)   
  - net: thunderx: Fix unintentional sign extension issue (Colin Ian King)   
  - IB/hfi1: Fix error return code in parse_platform_config() (Wang Wensheng)   
  - mt7601u: fix always true expression (Colin Ian King)   
  - mac80211: bail out if cipher schemes are invalid (Johannes Berg)   
  - powerpc: iommu: fix build when neither PCI or IBMVIO is set (Randy Dunlap)   
  - powerpc/perf: Fix PMU constraint check for EBB events (Athira Rajeev)   
  - liquidio: Fix unintented sign extension of a left shift of a u16 (Colin Ian King)   
  - ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls (Takashi Iwai)   
  - nfc: pn533: prevent potential memory corruption (Dan Carpenter)   
  - bug: Remove redundant condition check in report_bug (Andrew Scull)   
  - ALSA: core: remove redundant spin_lock pair in snd_card_disconnect (Jia Zhou)   
  - powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration (Chen Huang)   
  - powerpc/prom: Mark identical_pvr_fixup as __init (Nathan Chancellor)   
  - net: lapbether: Prevent racing when checking whether the netif is running (Xie He)   
  - perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed chars (Arnaldo Carvalho de Melo)   
  - HID: plantronics: Workaround for double volume key presses (Maxim Mikityanskiy)   
  - x86/events/amd/iommu: Fix sysfs type mismatch (Nathan Chancellor)   
  - HSI: core: fix resource leaks in hsi_add_client_from_dt() (Dan Carpenter)   
  - mfd: stm32-timers: Avoid clearing auto reload register (Fabrice Gasnier)   
  - scsi: sni_53c710: Add IRQ check (Sergey Shtylyov)   
  - scsi: sun3x_esp: Add IRQ check (Sergey Shtylyov)   
  - scsi: jazz_esp: Add IRQ check (Sergey Shtylyov)   
  - clk: uniphier: Fix potential infinite loop (Colin Ian King)   
  - vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer (Jason Gunthorpe)   
  - ata: libahci_platform: fix IRQ check (Sergey Shtylyov)   
  - sata_mv: add IRQ checks (Sergey Shtylyov)   
  - pata_ipx4xx_cf: fix IRQ check (Sergey Shtylyov)   
  - pata_arasan_cf: fix IRQ check (Sergey Shtylyov)   
  - x86/kprobes: Fix to check non boostable prefixes correctly (Masami Hiramatsu)   
  - media: m88rs6000t: avoid potential out-of-bounds reads on arrays (Colin Ian King)   
  - media: omap4iss: return error code when omap4iss_get() failed (Yang Yingliang)   
  - media: vivid: fix assignment of dev->fbuf_out_flags (Colin Ian King)   
  - ttyprintk: Add TTY hangup callback. (Tetsuo Handa)   
  - x86/platform/uv: Fix !KEXEC build failure (Ingo Molnar)   
  - platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table (Steffen Dirkwinkel)   
  - firmware: qcom-scm: Fix QCOM_SCM configuration (He Ying)   
  - tty: fix return value for unsupported ioctls (Johan Hovold)   
  - tty: actually undefine superseded ASYNC flags (Johan Hovold)   
  - USB: cdc-acm: fix unprivileged TIOCCSERIAL (Johan Hovold)   
  - usb: gadget: r8a66597: Add missing null check on return from platform_get_resource (Colin Ian King)   
  - crypto: qat - Fix a double free in adf_create_ring (Lv Yunlong)   
  - ACPI: CPPC: Replace cppc_attr with kobj_attribute (Nathan Chancellor)   
  - soc: qcom: mdt_loader: Detect truncated read of segments (Bjorn Andersson)   
  - soc: qcom: mdt_loader: Validate that p_filesz < p_memsz (Bjorn Andersson)   
  - spi: Fix use-after-free with devm_spi_alloc_* (William A. Kennington III)   
  - staging: greybus: uart: fix unprivileged TIOCCSERIAL (Johan Hovold)   
  - staging: rtl8192u: Fix potential infinite loop (Colin Ian King)   
  - mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init (Lv Yunlong)   
  - USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR() (Yang Yingliang)   
  - crypto: qat - fix error path in adf_isr_resource_alloc() (Giovanni Cabiddu)   
  - phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally (Geert Uytterhoeven)   
  - bus: qcom: Put child node before return (Pan Bian)   
  - mtd: require write permissions for locking and badblock ioctls (Michael Walle)   
  - fotg210-udc: Complete OUT requests on short packets (Fabian Vogt)   
  - fotg210-udc: Don't DMA more than the buffer can take (Fabian Vogt)   
  - fotg210-udc: Mask GRP2 interrupts we don't handle (Fabian Vogt)   
  - fotg210-udc: Remove a dubious condition leading to fotg210_done (Fabian Vogt)   
  - fotg210-udc: Fix EP0 IN requests bigger than two packets (Fabian Vogt)   
  - fotg210-udc: Fix DMA on EP0 for length > max packet size (Fabian Vogt)   
  - crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init (Tong Zhang)   
  - crypto: qat - don't release uninitialized resources (Tong Zhang)   
  - usb: gadget: pch_udc: Check for DMA mapping error (Andy Shevchenko)   
  - usb: gadget: pch_udc: Check if driver is present before calling ->setup() (Andy Shevchenko)   
  - usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() (Andy Shevchenko)   
  - x86/microcode: Check for offline CPUs before requesting new microcode (Otavio Pontes)   
  - usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS (Badhri Jagan Sridharan)   
  - serial: stm32: fix tx_empty condition (Erwan Le Ray)   
  - serial: stm32: fix incorrect characters on console (Erwan Le Ray)   
  - ARM: dts: exynos: correct PMIC interrupt trigger level on Snow (Krzysztof Kozlowski)   
  - ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 (Krzysztof Kozlowski)   
  - ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family (Krzysztof Kozlowski)   
  - memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] (Colin Ian King)   
  - usb: gadget: pch_udc: Revert d3cb25a12138 completely (Andy Shevchenko)   
  - KVM: s390: split kvm_s390_real_to_abs (Claudio Imbrenda)   
  - KVM: s390: fix guarded storage control register handling (Heiko Carstens)   
  - KVM: s390: split kvm_s390_logical_to_effective (Claudio Imbrenda)   
  - x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported (Sean Christopherson)   
  - ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices (Takashi Iwai)   
  - ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries (Takashi Iwai)   
  - ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries (Takashi Iwai)   
  - ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries (Takashi Iwai)   
  - ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries (Takashi Iwai)   
  - drm/radeon: fix copy of uninitialized variable back to userspace (Colin Ian King)   
  - cfg80211: scan: drop entry from hidden_list on overflow (Johannes Berg)   
  - ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() (Dan Carpenter)   
  - md: md_open returns -EBUSY when entering racing area (Zhao Heming)   
  - md: factor out a mddev_find_locked helper from mddev_find (Christoph Hellwig)   
  - md: split mddev_find (Christoph Hellwig)   
  - md-cluster: fix use-after-free issue when removing rdev (Heming Zhao)   
  - tracing: Restructure trace_clock_global() to never block (Steven Rostedt (VMware))   
  - misc: vmw_vmci: explicitly initialize vmci_datagram payload (Tetsuo Handa)   
  - misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct (Tetsuo Handa)   
  - misc: lis3lv02d: Fix false-positive WARN on various HP models (Hans de Goede)   
  - FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR (Maciej W. Rozycki)   
  - MIPS: pci-rt2880: fix slot 0 configuration (Ilya Lipnitskiy)   
  - net/nfc: fix use-after-free llcp_sock_bind/connect (Or Cohen)   {CVE-2021-23134} 
  - bluetooth: eliminate the potential race condition when removing the HCI controller (Lin Ma)   
  - Bluetooth: verify AMP hci_chan before amp_destroy (Archie Pusaka)   
  - modules: inherit TAINT_PROPRIETARY_MODULE (Christoph Hellwig)   
  - modules: return licensing information from find_symbol (Christoph Hellwig)   
  - modules: rename the licence field in struct symsearch to license (Christoph Hellwig)   
  - modules: unexport __module_address (Christoph Hellwig)   
  - modules: unexport __module_text_address (Christoph Hellwig)   
  - modules: mark each_symbol_section static (Christoph Hellwig)   
  - modules: mark find_symbol static (Christoph Hellwig)   
  - modules: mark ref_module static (Christoph Hellwig)   
  - dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails (Benjamin Block)   
  - dm space map common: fix division bug in sm_ll_find_free_block() (Joe Thornber)   
  - dm persistent data: packed struct should have an aligned() attribute too (Joe Thornber)   
  - tracing: Map all PIDs to command lines (Steven Rostedt (VMware))   
  - usb: dwc3: gadget: Fix START_TRANSFER link state check (Thinh Nguyen)   
  - usb: gadget/function/f_fs string table fix for multiple languages (Dean Anderson)   
  - usb: gadget: Fix double free of device descriptor pointers (Hemant Kumar)   
  - usb: gadget: dummy_hcd: fix gpf in gadget_setup (Anirudh Rayabharam)   
  - media: dvbdev: Fix memory leak in dvb_media_device_free() (Peilin Ye)   
  - ext4: fix error code in ext4_commit_super (Fengnan Chang)   
  - ext4: fix check to prevent false positive report of incorrect used inodes (Zhang Yi)   
  - ftrace: Handle commands when closing set_ftrace_filter file (Steven Rostedt (VMware))   
  - posix-timers: Preserve return value in clock_adjtime32() (Chen Jun)   
  - Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op") (Thomas Gleixner)   
  - jffs2: check the validity of dstlen in jffs2_zlib_compress() (Yang Yang)   
  - Fix misc new gcc warnings (Linus Torvalds)   
  - security: commoncap: fix -Wstringop-overread warning (Arnd Bergmann)   
  - md/raid1: properly indicate failure when ending a failed write request (Paul Clements)   
  - intel_th: pci: Add Alder Lake-M support (Alexander Shishkin)   
  - powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h (Tony Ambardar)   
  - powerpc/eeh: Fix EEH handling for hugepages in ioremap space. (Mahesh Salgaonkar)   
  - jffs2: Fix kasan slab-out-of-bounds problem (lizhe)   
  - NFSv4: Don't discard segments marked for return in _pnfs_return_layout() (Trond Myklebust)   
  - ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure (Marc Zyngier)   
  - openvswitch: fix stack OOB read while fragmenting IPv4 packets (Davide Caratti)   
  - arm64/vdso: Discard .note.gnu.property sections in vDSO (Bill Wendling)   
  - btrfs: fix race when picking most recent mod log operation for an old root (Filipe Manana)   
  - ALSA: sb: Fix two use after free in snd_sb_qsound_build (Lv Yunlong)   
  - ALSA: hda/conexant: Re-order CX5066 quirk table entries (Takashi Iwai)   
  - ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer (Lv Yunlong)   
  - scsi: libfc: Fix a format specifier (Bart Van Assche)   
  - scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic (James Smart)   
  - scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response (James Smart)   
  - drm/amdgpu: fix NULL pointer dereference (Guchun Chen)   
  - drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal (Marijn Suijten)   
  - media: gscpa/stv06xx: fix memory leak (Hans Verkuil)   
  - media: dvb-usb: fix memory leak in dvb_usb_adapter_init (Pavel Skripkin)   
  - media: i2c: adv7842: fix possible use-after-free in adv7842_remove() (Yang Yingliang)   
  - media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove() (Yang Yingliang)   
  - media: adv7604: fix possible use-after-free in adv76xx_remove() (Yang Yingliang)   
  - power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() (Yang Yingliang)   
  - power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() (Yang Yingliang)   
  - clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return (Colin Ian King)   
  - media: vivid: update EDID (Hans Verkuil)   
  - media: em28xx: fix memory leak (Muhammad Usama Anjum)   
  - scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg() (Ewan D. Milne)   
  - scsi: qla2xxx: Fix use after free in bsg (Quinn Tran)   
  - scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats() (Bart Van Assche)   
  - drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f (shaoyunl)   
  - power: supply: Use IRQF_ONESHOT (dongjian)   
  - media: gspca/sq905.c: fix uninitialized variable (Hans Verkuil)   
  - media: media/saa7164: fix saa7164_encoder_register() memory leak bugs (Daniel Niv)   
  - extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged (Hans de Goede)   
  - power: supply: bq27xxx: fix power_avg for newer ICs (Matthias Schiffer)   
  - media: ite-cir: check for receive overflow (Sean Young)   
  - scsi: target: pscsi: Fix warning in pscsi_complete_cmd() (Chaitanya Kulkarni)   
  - scsi: lpfc: Fix pt2pt connection does not recover after LOGO (James Smart)   
  - scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe (James Smart)   
  - btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s (Josef Bacik)   
  - phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() (Yang Yingliang)   
  - intel_th: Consistency and off-by-one fix (Pavel Machek)   
  - spi: omap-100k: Fix reference leak to master (Wei Yongjun)   
  - spi: dln2: Fix reference leak to master (Wei Yongjun)   
  - perf/arm_pmu_platform: Fix error handling (Robin Murphy)   
  - tee: optee: do not check memref size on return from Secure World (Jerome Forissier)   
  - x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS) (John Millikin)   
  - PCI: PM: Do not read power state in pci_enable_device_flags() (Rafael J. Wysocki)   
  - usb: xhci: Fix port minor revision (Thinh Nguyen)   
  - usb: dwc3: gadget: Ignore EP queue requests during bus reset (Wesley Cheng)   
  - usb: gadget: f_uac1: validate input parameters (Ruslan Bilovol)   
  - usb: gadget: uvc: add bInterval checking for HS mode (Pawel Laszczak)   
  - crypto: api - check for ERR pointers in crypto_destroy_tfm() (Ard Biesheuvel)   
  - staging: wimax/i2400m: fix byte-order issue (karthik alapati)   
  - fbdev: zero-fill colormap in fbcmap.c (Phillip Potter)   
  - intel_th: pci: Add Rocket Lake CPU support (Alexander Shishkin)   
  - btrfs: fix metadata extent leak after failure to create subvolume (Filipe Manana)   
  - cifs: Return correct error code from smb2_get_enc_key (Paul Aurich)   
  - mmc: core: Set read only for SD cards with permanent write protect bit (Seunghui Lee)   
  - mmc: core: Do a power cycle when the CMD11 fails (DooHyun Hwang)   
  - mmc: block: Update ext_csd.cache_ctrl if it was written (Avri Altman)   
  - spi: spi-ti-qspi: Free DMA resources (Tudor Ambarus)   
  - ecryptfs: fix kernel panic with null dev_name (Jeffrey Mitchell)   
  - arm64: dts: mt8173: fix property typo of 'phys' in dsi node (Chunfeng Yun)   
  - ACPI: custom_method: fix a possible memory leak (Mark Langsdorf)   
  - ACPI: custom_method: fix potential use-after-free issue (Mark Langsdorf)   
  - s390/disassembler: increase ebpf disasm buffer size (Vasily Gorbik)   
  - platform/x86: thinkpad_acpi: Correct thermal sensor allocation (Mark Pearson)   
  - USB: Add reset-resume quirk for WD19's Realtek Hub (Chris Chiu)   
  - USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet (Kai-Heng Feng)   
  - ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX (Takashi Iwai)   
  - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd() (Jiri Kosina)   
  - bpf: Fix masking negation logic upon negative dst register (Daniel Borkmann)   
  - mips: Do not include hi and lo in clobber list for R6 (Romain Naour)   
  - MIPS: cpu-features.h: Replace __mips_isa_rev with MIPS_ISA_REV (Matt Redfearn)   
  - MIPS: Introduce isa-rev.h to define MIPS_ISA_REV (Matt Redfearn)   
  - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd() (Jiri Kosina)   
  - net: usb: ax88179_178a: initialize local variables before use (Phillip Potter)   
  - bpf: fix up selftests after backports were fixed (Frank van der Linden)   
  - bpf: Fix backport of "bpf: restrict unknown scalars of mixed signed bounds for unprivileged" (Samuel Mendoza-Jonas)   
  - ACPI: x86: Call acpi_boot_table_init() after acpi_table_upgrade() (Rafael J. Wysocki)   
  - ACPI: tables: x86: Reserve memory occupied by ACPI tables (Rafael J. Wysocki)   
  - usbip: vudc synchronize sysfs code paths (Shuah Khan)


