# changelog

author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.523.3.el7uek]
changelog:
  - driver/soc/pensando: cap_pcie: refactor pciep_regrd32 (David Clear)  [Orabug: 35089515]  
  - mtd: spi-nor: Add support for Winbond w25q02nw flash. (David Clear)  [Orabug: 35089515]  
  - drivers/i2c: Lattice I2C driver update (David Clear)  [Orabug: 35089515]  
  - drivers/soc/pensando: Adding Elba sbus driver (David Clear)  [Orabug: 35089515]  
  - Arm64: Pensando: Enable ltc2978 driver for Ortano ADI cards (Austin Sehnert)  [Orabug: 35080511]  
  - scsi: target: core: Remove from tmr_list during LUN unlink (Dmitry Bogdanov)  [Orabug: 35040145]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.523.4.el7uek]
changelog:
  - rds: ib: Keep IB MRs on clean_list unless we are tearing down the pool (Håkon Bugge)  [Orabug: 34987235]  
  - rds: ib: Add FRWR related statistics counters (Håkon Bugge)  [Orabug: 34987235]  
  - net/rds: The fast registration work queue is not destroyed (Ka-Cheong Poon)  [Orabug: 25962452] [Orabug: 31712036]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.523.4.1.el7uek]
changelog:
  - mm: kvmalloc does not fallback to vmalloc for incompatible gfp flags (Michal Hocko)  [Orabug: 35164196]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.523.4.2.el7uek]
changelog:
  - xfs: add missing cmap->br_state = XFS_EXT_NORM update (Gao Xiang)  [Orabug: 35215030]  
  - x86/tsc: Disable clocksource watchdog for TSC on qualified platorms (Feng Tang)  [Orabug: 35215029]  
  - x86/tsc: Add a timer to make sure TSC_adjust is always checked (Feng Tang)  [Orabug: 35215029]  
  - block: fix handling for BIO_NO_PAGE_REF (Ming Lei)  [Orabug: 35215061]  
  - block: add BIO_NO_PAGE_REF flag (Jens Axboe)  [Orabug: 35215061]  
  - block: implement bio helper to add iter bvec pages to bio (Jens Axboe)  [Orabug: 35215061]  
  - block: introduce mp_bvec_for_each_page() for iterating over page (Ming Lei)  [Orabug: 35215061]  
  - KVM: x86: Prevent set vCPU into INIT/SIPI_RECEIVED state when INIT are latched (Liran Alon)  [Orabug: 35215019]  
  - KVM: x86: Evaluate latched_init in KVM_SET_VCPU_EVENTS when vCPU not in SMM (Liran Alon)  [Orabug: 35215019]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.524.1.el7uek]
changelog:
  - Revert "Change mincore() to count "mapped" pages rather than "cached" pages" (Linus Torvalds)  [Orabug: 35124753]  
  - Revert "XFS: code enhancement to help debug" (Stephen Brennan)  [Orabug: 35070084]  
  - NFSv4: Fix OPEN / CLOSE race (Trond Myklebust)  [Orabug: 34998974]  
  - LTS version: v4.14.306 (Saeed Mirzamohammadi)   
  - nilfs2: fix underflow in second superblock position calculations (Ryusuke Konishi)   
  - kvm: initialize all of the kvm_debugregs structure before sending it to userspace (Greg Kroah-Hartman)   
  - i40e: Add checking for null for nlmsg_find_attr() (Natalia Petrova)   
  - ipv6: Fix tcp socket connection with DSCP. (Guillaume Nault)   
  - ipv6: Fix datagram socket connection with DSCP. (Guillaume Nault)   
  - net: mpls: fix stale pointer if allocation fails during device rename (Jakub Kicinski)   
  - net: stmmac: Restrict warning on disabling DMA store and fwd mode (Cristian Ciocaltea)   
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Miko Larsson)   
  - dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions. (Kuniyuki Iwashima)   
  - net: bgmac: fix BCM5358 support by setting correct flags (Rafał Miłecki)   
  - i40e: add double of VLAN header when computing the max MTU (Jason Xing)   
  - revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" (Andrew Morton)   
  - hugetlb: check for undefined shift on 32 bit architectures (Mike Kravetz)   
  - ALSA: hda/conexant: add a new hda codec SN6180 (Bo Liu)   
  - mmc: sdio: fix possible resource leaks in some error paths (Yang Yingliang)   
  - Revert "x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN" (Greg Kroah-Hartman)   
  - aio: fix mremap after fork null-deref (Seth Jenkins)   
  - nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association (Amit Engel)   
  - net/rose: Fix to not accept on connected socket (Hyunwoo Kim)   
  - tools/virtio: fix the vringh test for virtio ring changes (Shunsuke Mie)   
  - migrate: hugetlb: check for hugetlb shared PMD in node migration (Mike Kravetz)   
  - usb: core: add quirk for Alcor Link AK9563 smartcard reader (Mark Pearson)   
  - net: USB: Fix wrong-direction WARNING in plusb.c (Alan Stern)   
  - pinctrl: single: fix potential NULL dereference (Maxim Korotkov)   
  - pinctrl: aspeed: Fix confusing types in return value (Joel Stanley)   
  - ALSA: pci: lx6464es: fix a debug loop (Dan Carpenter)   
  - ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() (Artemii Karasev)   
  - btrfs: limit device extents to the device size (Josef Bacik)   
  - serial: 8250_dma: Fix DMA Rx rearm race (Ilpo Järvinen)   
  - serial: 8250_dma: Fix DMA Rx completion race (Ilpo Järvinen)   
  - Squashfs: fix handling and sanity checking of xattr_ids count (Phillip Lougher)   
  - mm/swapfile: add cond_resched() in get_swap_pages() (Longlong Xia)   
  - mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps (Mike Kravetz)   
  - parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case (Helge Deller)   
  - parisc: Fix return code of pdc_iodc_print() (Helge Deller)   
  - iio:adc:twl6030: Enable measurements of VUSB, VBAT and others (Andreas Kemnade)   
  - iio: adc: berlin2-adc: Add missing of_node_put() in error path (Xiongfeng Wang)   
  - iio: hid: fix the retval in accel_3d_capture_sample (Dmitry Perchanov)   
  - efi: Accept version 2 of memory attributes table (Ard Biesheuvel)   
  - watchdog: diag288_wdt: fix __diag288() inline assembly (Alexander Egorenkov)   
  - watchdog: diag288_wdt: do not use stack buffers for hardware data (Alexander Egorenkov)   
  - fbcon: Check font dimension limits (Samuel Thibault)   
  - usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait (Udipto Goswami)   
  - net/x25: Fix to not accept on connected socket (Hyunwoo Kim)   
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Mike Christie)   
  - scsi: target: core: Fix warning on RT kernels (Maurizio Lombardi)   
  - net: openvswitch: fix flow memory leak in ovs_flow_cmd_new (Fedor Pchelkin)   
  - sctp: do not check hb_timer.expires when resetting hb_timer (Xin Long)   
  - squashfs: harden sanity check in squashfs_read_xattr_id_table (Fedor Pchelkin)   
  - netrom: Fix use-after-free caused by accept on already connected socket (Hyunwoo Kim)   
  - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() (Artemii Karasev)   
  - bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() (Yuan Can)   
  - firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region (Takashi Sakamoto)   
  - LTS version: v4.14.305 (Saeed Mirzamohammadi)   
  - usb: host: xhci-plat: add wakeup entry at sysfs (Peter Chen)   
  - ipv6: ensure sane device mtu in tunnels (Eric Dumazet)   
  - mm: kvmalloc does not fallback to vmalloc for incompatible gfp flags (Michal Hocko)   
  - exit: Use READ_ONCE() for all oops/warn limit reads (Kees Cook)   
  - docs: Fix path paste-o for /sys/kernel/warn_count (Kees Cook)   
  - panic: Expose "warn_count" to sysfs (Kees Cook)   
  - panic: Introduce warn_limit (Kees Cook)   
  - panic: Consolidate open-coded panic_on_warn checks (Kees Cook)   
  - exit: Allow oops_limit to be disabled (Kees Cook)   
  - exit: Expose "oops_count" to sysfs (Kees Cook)   
  - exit: Put an upper limit on how often we can oops (Jann Horn)   
  - ia64: make IA64_MCA_RECOVERY bool instead of tristate (Randy Dunlap)   
  - h8300: Fix build errors from do_exit() to make_task_dead() transition (Nathan Chancellor)   
  - hexagon: Fix function name in die() (Nathan Chancellor)   
  - objtool: Add a missing comma to avoid string concatenation (Eric W. Biederman)   
  - exit: Add and use make_task_dead. (Eric W. Biederman)   
  - panic: unset panic_on_warn inside panic() (Tiezhu Yang)   
  - sysctl: add a new register_sysctl_init() interface (Xiaoming Ni)   
  - x86/entry/64: Add instruction suffix to SYSRET (Jan Beulich)   
  - x86/asm: Fix an assembler warning with current binutils (Mikulas Patocka)   
  - drm/radeon/dp: make radeon_dp_get_dp_link_config static (Alex Deucher)   
  - wifi: brcmfmac: fix up incorrect 4.14.y backport for brcmf_fw_map_chip_to_name() (Greg Kroah-Hartman)   
  - x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL (Thomas Gleixner)   
  - Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" (Dmitry Torokhov)   
  - net/tg3: resolve deadlock in tg3_reset_task() during EEH (David Christensen)   
  - net: ravb: Fix possible hang if RIS2_QFF1 happen (Yoshihiro Shimoda)   
  - sctp: fail if no bound addresses can be used for a given scope (Marcelo Ricardo Leitner)   
  - netrom: Fix use-after-free of a listening socket. (Kuniyuki Iwashima)   
  - netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE (Sriram Yagnaraman)   
  - netlink: annotate data races around sk_state (Eric Dumazet)   
  - netlink: annotate data races around dst_portid and dst_group (Eric Dumazet)   
  - EDAC/device: Respect any driver-supplied workqueue polling value (Manivannan Sadhasivam)   
  - ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment (Giulio Benetti)   
  - tracing: Make sure trace_printk() can output as soon as it can be used (Steven Rostedt (Google))   
  - module: Don't wait for GOING modules (Petr Pavlu)   
  - scsi: hpsa: Fix allocation size for scsi_host_alloc() (Alexey V. Vissarionov)   
  - Bluetooth: hci_sync: cancel cmd_timer if hci_open failed (Archie Pusaka)   
  - fs: reiserfs: remove useless new_opts in reiserfs_remount (Dongliang Mu)   
  - comedi: adv_pci1760: Fix PWM instruction handling (Ian Abbott)   
  - w1: fix WARNING after calling w1_process() (Yang Yingliang)   
  - w1: fix deadloop in __w1_remove_master_device() (Yang Yingliang)   
  - HID: betop: check shape of output reports (Pietro Borrello)   
  - dmaengine: Fix double increment of client_count in dma_chan_get() (Koba Ko)   
  - net: mlx5: eliminate anonymous module_init & module_exit (Randy Dunlap)   
  - usb: gadget: f_fs: Ensure ep0req is dequeued before free_request (Udipto Goswami)   
  - usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait (Udipto Goswami)   
  - HID: check empty report_list in hid_validate_values() (Pietro Borrello)   
  - net: mdio: validate parameter addr in mdiobus_get_phy() (Heiner Kallweit)   
  - net: usb: sr9700: Handle negative len (Szymon Heidrich)   
  - wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid (Szymon Heidrich)   
  - net: nfc: Fix use-after-free in local_cleanup() (Jisoo Jang)   
  - phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() (Shang XiaoJing)   
  - amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent (Raju Rangoju)   
  - affs: initialize fsdata in affs_truncate() (Alexander Potapenko)   
  - IB/hfi1: Reserve user expected TIDs (Dean Luick)   
  - IB/hfi1: Reject a zero-length user expected buffer (Dean Luick)   
  - tomoyo: fix broken dependency on *.conf.default (Masahiro Yamada)   
  - EDAC/highbank: Fix memory leak in highbank_mc_probe() (Miaoqian Lin)   
  - HID: intel_ish-hid: Add check for ishtp_dma_tx_map (Jiasheng Jiang)   
  - ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' (Fabio Estevam)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.524.2.el7uek]
changelog:
  - x86/kdump: Fall back to reserve high crashkernel memory (Dave Young)  [Orabug: 35158700]  
  - NFS: If the VFS sets LOOKUP_REVAL then force a lookup of the dentry (Trond Myklebust)  [Orabug: 35136066]  
  - nfsd: Do not refuse to serve out of cache (Trond Myklebust)  [Orabug: 35136066]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.524.1.el7uek]
changelog:
  - Revert "Change mincore() to count "mapped" pages rather than "cached" pages" (Linus Torvalds)  [Orabug: 35124753]  
  - Revert "XFS: code enhancement to help debug" (Stephen Brennan)  [Orabug: 35070084]  
  - NFSv4: Fix OPEN / CLOSE race (Trond Myklebust)  [Orabug: 34998974]  
  - LTS version: v4.14.306 (Saeed Mirzamohammadi)   
  - nilfs2: fix underflow in second superblock position calculations (Ryusuke Konishi)   
  - kvm: initialize all of the kvm_debugregs structure before sending it to userspace (Greg Kroah-Hartman)   
  - i40e: Add checking for null for nlmsg_find_attr() (Natalia Petrova)   
  - ipv6: Fix tcp socket connection with DSCP. (Guillaume Nault)   
  - ipv6: Fix datagram socket connection with DSCP. (Guillaume Nault)   
  - net: mpls: fix stale pointer if allocation fails during device rename (Jakub Kicinski)   
  - net: stmmac: Restrict warning on disabling DMA store and fwd mode (Cristian Ciocaltea)   
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Miko Larsson)   
  - dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions. (Kuniyuki Iwashima)   
  - net: bgmac: fix BCM5358 support by setting correct flags (Rafał Miłecki)   
  - i40e: add double of VLAN header when computing the max MTU (Jason Xing)   
  - revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" (Andrew Morton)   
  - hugetlb: check for undefined shift on 32 bit architectures (Mike Kravetz)   
  - ALSA: hda/conexant: add a new hda codec SN6180 (Bo Liu)   
  - mmc: sdio: fix possible resource leaks in some error paths (Yang Yingliang)   
  - Revert "x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN" (Greg Kroah-Hartman)   
  - aio: fix mremap after fork null-deref (Seth Jenkins)   
  - nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association (Amit Engel)   
  - net/rose: Fix to not accept on connected socket (Hyunwoo Kim)   
  - tools/virtio: fix the vringh test for virtio ring changes (Shunsuke Mie)   
  - migrate: hugetlb: check for hugetlb shared PMD in node migration (Mike Kravetz)   
  - usb: core: add quirk for Alcor Link AK9563 smartcard reader (Mark Pearson)   
  - net: USB: Fix wrong-direction WARNING in plusb.c (Alan Stern)   
  - pinctrl: single: fix potential NULL dereference (Maxim Korotkov)   
  - pinctrl: aspeed: Fix confusing types in return value (Joel Stanley)   
  - ALSA: pci: lx6464es: fix a debug loop (Dan Carpenter)   
  - ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() (Artemii Karasev)   
  - btrfs: limit device extents to the device size (Josef Bacik)   
  - serial: 8250_dma: Fix DMA Rx rearm race (Ilpo Järvinen)   
  - serial: 8250_dma: Fix DMA Rx completion race (Ilpo Järvinen)   
  - Squashfs: fix handling and sanity checking of xattr_ids count (Phillip Lougher)   
  - mm/swapfile: add cond_resched() in get_swap_pages() (Longlong Xia)   
  - mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps (Mike Kravetz)   
  - parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case (Helge Deller)   
  - parisc: Fix return code of pdc_iodc_print() (Helge Deller)   
  - iio:adc:twl6030: Enable measurements of VUSB, VBAT and others (Andreas Kemnade)   
  - iio: adc: berlin2-adc: Add missing of_node_put() in error path (Xiongfeng Wang)   
  - iio: hid: fix the retval in accel_3d_capture_sample (Dmitry Perchanov)   
  - efi: Accept version 2 of memory attributes table (Ard Biesheuvel)   
  - watchdog: diag288_wdt: fix __diag288() inline assembly (Alexander Egorenkov)   
  - watchdog: diag288_wdt: do not use stack buffers for hardware data (Alexander Egorenkov)   
  - fbcon: Check font dimension limits (Samuel Thibault)   
  - usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait (Udipto Goswami)   
  - net/x25: Fix to not accept on connected socket (Hyunwoo Kim)   
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Mike Christie)   
  - scsi: target: core: Fix warning on RT kernels (Maurizio Lombardi)   
  - net: openvswitch: fix flow memory leak in ovs_flow_cmd_new (Fedor Pchelkin)   
  - sctp: do not check hb_timer.expires when resetting hb_timer (Xin Long)   
  - squashfs: harden sanity check in squashfs_read_xattr_id_table (Fedor Pchelkin)   
  - netrom: Fix use-after-free caused by accept on already connected socket (Hyunwoo Kim)   
  - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() (Artemii Karasev)   
  - bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() (Yuan Can)   
  - firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region (Takashi Sakamoto)   
  - LTS version: v4.14.305 (Saeed Mirzamohammadi)   
  - usb: host: xhci-plat: add wakeup entry at sysfs (Peter Chen)   
  - ipv6: ensure sane device mtu in tunnels (Eric Dumazet)   
  - mm: kvmalloc does not fallback to vmalloc for incompatible gfp flags (Michal Hocko)   
  - exit: Use READ_ONCE() for all oops/warn limit reads (Kees Cook)   
  - docs: Fix path paste-o for /sys/kernel/warn_count (Kees Cook)   
  - panic: Expose "warn_count" to sysfs (Kees Cook)   
  - panic: Introduce warn_limit (Kees Cook)   
  - panic: Consolidate open-coded panic_on_warn checks (Kees Cook)   
  - exit: Allow oops_limit to be disabled (Kees Cook)   
  - exit: Expose "oops_count" to sysfs (Kees Cook)   
  - exit: Put an upper limit on how often we can oops (Jann Horn)   
  - ia64: make IA64_MCA_RECOVERY bool instead of tristate (Randy Dunlap)   
  - h8300: Fix build errors from do_exit() to make_task_dead() transition (Nathan Chancellor)   
  - hexagon: Fix function name in die() (Nathan Chancellor)   
  - objtool: Add a missing comma to avoid string concatenation (Eric W. Biederman)   
  - exit: Add and use make_task_dead. (Eric W. Biederman)   
  - panic: unset panic_on_warn inside panic() (Tiezhu Yang)   
  - sysctl: add a new register_sysctl_init() interface (Xiaoming Ni)   
  - x86/entry/64: Add instruction suffix to SYSRET (Jan Beulich)   
  - x86/asm: Fix an assembler warning with current binutils (Mikulas Patocka)   
  - drm/radeon/dp: make radeon_dp_get_dp_link_config static (Alex Deucher)   
  - wifi: brcmfmac: fix up incorrect 4.14.y backport for brcmf_fw_map_chip_to_name() (Greg Kroah-Hartman)   
  - x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL (Thomas Gleixner)   
  - Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" (Dmitry Torokhov)   
  - net/tg3: resolve deadlock in tg3_reset_task() during EEH (David Christensen)   
  - net: ravb: Fix possible hang if RIS2_QFF1 happen (Yoshihiro Shimoda)   
  - sctp: fail if no bound addresses can be used for a given scope (Marcelo Ricardo Leitner)   
  - netrom: Fix use-after-free of a listening socket. (Kuniyuki Iwashima)   
  - netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE (Sriram Yagnaraman)   
  - netlink: annotate data races around sk_state (Eric Dumazet)   
  - netlink: annotate data races around dst_portid and dst_group (Eric Dumazet)   
  - EDAC/device: Respect any driver-supplied workqueue polling value (Manivannan Sadhasivam)   
  - ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment (Giulio Benetti)   
  - tracing: Make sure trace_printk() can output as soon as it can be used (Steven Rostedt (Google))   
  - module: Don't wait for GOING modules (Petr Pavlu)   
  - scsi: hpsa: Fix allocation size for scsi_host_alloc() (Alexey V. Vissarionov)   
  - Bluetooth: hci_sync: cancel cmd_timer if hci_open failed (Archie Pusaka)   
  - fs: reiserfs: remove useless new_opts in reiserfs_remount (Dongliang Mu)   
  - comedi: adv_pci1760: Fix PWM instruction handling (Ian Abbott)   
  - w1: fix WARNING after calling w1_process() (Yang Yingliang)   
  - w1: fix deadloop in __w1_remove_master_device() (Yang Yingliang)   
  - HID: betop: check shape of output reports (Pietro Borrello)   
  - dmaengine: Fix double increment of client_count in dma_chan_get() (Koba Ko)   
  - net: mlx5: eliminate anonymous module_init & module_exit (Randy Dunlap)   
  - usb: gadget: f_fs: Ensure ep0req is dequeued before free_request (Udipto Goswami)   
  - usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait (Udipto Goswami)   
  - HID: check empty report_list in hid_validate_values() (Pietro Borrello)   
  - net: mdio: validate parameter addr in mdiobus_get_phy() (Heiner Kallweit)   
  - net: usb: sr9700: Handle negative len (Szymon Heidrich)   
  - wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid (Szymon Heidrich) [Orabug: 35037714] {CVE-2023-23559}
  - net: nfc: Fix use-after-free in local_cleanup() (Jisoo Jang)   
  - phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() (Shang XiaoJing)   
  - amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent (Raju Rangoju)   
  - affs: initialize fsdata in affs_truncate() (Alexander Potapenko)   
  - IB/hfi1: Reserve user expected TIDs (Dean Luick)   
  - IB/hfi1: Reject a zero-length user expected buffer (Dean Luick)   
  - tomoyo: fix broken dependency on *.conf.default (Masahiro Yamada)   
  - EDAC/highbank: Fix memory leak in highbank_mc_probe() (Miaoqian Lin)   
  - HID: intel_ish-hid: Add check for ishtp_dma_tx_map (Jiasheng Jiang)   
  - ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' (Fabio Estevam)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.524.3.el7uek]
changelog:
  - KVM: x86/pmu: Update AMD PMC sample period to fix guest NMI-watchdog (Like Xu)  [Orabug: 35182018]  
  - KVM: x86: Prevent set vCPU into INIT/SIPI_RECEIVED state when INIT are latched (Liran Alon)  [Orabug: 35146837]  
  - KVM: x86: Evaluate latched_init in KVM_SET_VCPU_EVENTS when vCPU not in SMM (Liran Alon)  [Orabug: 35146837]  
  - mm: use ktask for copying page ranges in vma_dup() (Anthony Yznaga)  [Orabug: 35054623]  
  - mm: parallelize unmap_page_range() for some large VMAs (Anthony Yznaga)  [Orabug: 35054623]  
  - hv_netvsc: Add check for kvmalloc_array (Jiasheng Jiang)  [Orabug: 34951483]  {CVE-2022-3107} 
  - block: fix handling for BIO_NO_PAGE_REF (Ming Lei)  [Orabug: 34602747]  
  - block: add BIO_NO_PAGE_REF flag (Jens Axboe)  [Orabug: 34602747]  
  - block: implement bio helper to add iter bvec pages to bio (Jens Axboe)  [Orabug: 34602747]  
  - block: introduce mp_bvec_for_each_page() for iterating over page (Ming Lei)  [Orabug: 34602747]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.524.4.el7uek]
changelog:
  - xfs: add missing cmap->br_state = XFS_EXT_NORM update (Gao Xiang)  [Orabug: 35202792]  
  - x86/tsc: Disable clocksource watchdog for TSC on qualified platorms (Feng Tang)  [Orabug: 35181414]  
  - x86/tsc: Add a timer to make sure TSC_adjust is always checked (Feng Tang)  [Orabug: 35181414]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.525.1.el7uek]
changelog:
  - net/rds: use appropriate return code while dropping a connection (Praveen Kumar Kannoju)  [Orabug: 35279328]  
  - net/rds: use appropriate reason while dropping a connection (Praveen Kumar Kannoju)  [Orabug: 35278125]  
  - netfilter: ebtables: fix table blob use-after-free (Florian Westphal)  [Orabug: 35256192]  
  - net/rds: Adding TCP stats for TCP keepalive timeout (Nagappan Ramasamy Palaniappan)  [Orabug: 35254380]  
  - x86/cpu: Fix LFENCE serialization check in init_amd() (Rhythm Mahajan)  [Orabug: 35225921]  
  - taskstats: Fix memory leak due to taskstats_counts objects. (Imran Khan)  [Orabug: 34768713]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.526.1.el7uek]
changelog:
  - mm, compaction: Skip all pinned pages during scan (Khalid Aziz)  [Orabug: 35300710]  
  - LTS version: v4.14.314 (Saeed Mirzamohammadi)   
  - ASN.1: Fix check for strdup() success (Ekaterina Orlova)   
  - iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() (Dan Carpenter)   
  - counter: 104-quad-8: Fix race condition between FLAG and CNTR reads (William Breathitt Gray)   
  - sctp: Call inet6_destroy_sock() via sk->sk_destruct(). (Kuniyuki Iwashima)   
  - dccp: Call inet6_destroy_sock() via sk->sk_destruct(). (Kuniyuki Iwashima)   
  - inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). (Kuniyuki Iwashima)   
  - tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). (Kuniyuki Iwashima)   
  - udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM). (Kuniyuki Iwashima)   
  - ext4: fix use-after-free in ext4_xattr_set_entry (Baokun Li)   
  - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Ritesh Harjani)   
  - Revert "ext4: fix use-after-free in ext4_xattr_set_entry" (Tudor Ambarus)   
  - x86/purgatory: Don't generate debug info for purgatory.ro (Pingfan Liu)   
  - memstick: fix memory leak if card device is never registered (Greg Kroah-Hartman)   
  - nilfs2: initialize unused bytes in segment summary blocks (Ryusuke Konishi)   
  - xen/netback: use same error messages for same errors (Juergen Gross)   
  - s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling (Heiko Carstens)   
  - net: dsa: b53: mmap: add phy ops (Álvaro Fernández Rojas)   
  - scsi: core: Improve scsi_vpd_inquiry() checks (Damien Le Moal)   
  - scsi: megaraid_sas: Fix fw_crash_buffer_show() (Tomas Henzl)   
  - selftests: sigaltstack: fix -Wuninitialized (Nick Desaulniers)   
  - f2fs: Fix f2fs_truncate_partial_nodes ftrace event (Douglas Raillard)   
  - e1000e: Disable TSO on i219-LM card to increase speed (Sebastian Basierski)   
  - mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() (Nikita Zhandarovich)   
  - i40e: fix i40e_setup_misc_vector() error handling (Aleksandr Loktionov)   
  - i40e: fix accessing vsi->active_filters without holding lock (Aleksandr Loktionov)   
  - virtio_net: bugfix overflow inside xdp_linearize_page() (Xuan Zhuo)   
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Gwangun Jung)   
  - ARM: dts: rockchip: fix a typo error for rk3288 spdif node (Jianqun Xu)   
  - LTS version: v4.14.313 (Saeed Mirzamohammadi)   
  - arm64: KVM: Fix system register enumeration (Marc Zyngier)   
  - KVM: arm64: Filter out invalid core register IDs in KVM_GET_REG_LIST (Dave Martin)   
  - KVM: arm64: Factor out core register ID enumeration (Dave Martin)   
  - coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug (Steve Clevenger)   
  - watchdog: sbsa_wdog: Make sure the timeout programming is within the limits (George Cherian)   
  - cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() (Waiman Long)   
  - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size (Zhihao Cheng)   
  - verify_pefile: relax wrapper length check (Robbie Harwood)   
  - efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L (Hans de Goede)   
  - i2c: imx-lpi2c: clean rx/tx buffers upon new message (Alexander Stein)   
  - net: macb: fix a memory corruption in extended buffer descriptor mode (Roman Gushchin)   
  - qlcnic: check pci_reset_function result (Denis Plotnikov)   
  - niu: Fix missing unwind goto in niu_alloc_channels() (Harshit Mogalapalli)   
  - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition (Zheng Wang)   
  - mtdblock: tolerate corrected bit-flips (Bang Li)   
  - Bluetooth: Fix race condition in hidp_session_thread (Min Li)   
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (Luiz Augusto von Dentz)   
  - ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards (Oswald Buddenhagen)   
  - ALSA: i2c/cs8427: fix iec958 mixer control deactivation (Oswald Buddenhagen)   
  - ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard (Oswald Buddenhagen)   
  - ALSA: emu10k1: fix capture interrupt handler unlinking (Oswald Buddenhagen)   
  - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() (Rongwei Wang)   
  - ring-buffer: Fix race while reader and writer are on the same page (Zheng Yejian)   
  - ftrace: Mark get_lock_parent_ip() __always_inline (John Keeping)   
  - perf/core: Fix the same task check in perf_event_set_output (Kan Liang)   
  - nilfs2: fix sysfs interface lifetime (Ryusuke Konishi)   
  - nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() (Ryusuke Konishi)   
  - tty: serial: sh-sci: Fix Rx on RZ/G2L SCI (Biju Das)   
  - iio: dac: cio-dac: Fix max DAC write value check for 12-bit (William Breathitt Gray)   
  - USB: serial: option: add Quectel RM500U-CN modem (Bjørn Mork)   
  - USB: serial: option: add Telit FE990 compositions (Enrico Sau)   
  - USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs (Kees Jan Koster)   
  - gpio: davinci: Add irq chip flag to skip set wake (Dhruva Gole)   
  - ipv6: Fix an uninit variable access bug in __ip6_make_skb() (Ziyang Xuan)   
  - icmp: guard against too small mtu (Eric Dumazet)   
  - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta (Felix Fietkau)   
  - pwm: cros-ec: Explicitly set .polarity in .get_state() (Uwe Kleine-König)   
  - LTS version: v4.14.312 (Saeed Mirzamohammadi)   
  - ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() (Harshit Mogalapalli)   
  - net: sched: cbq: dont intepret cls results when asked to drop (Jamal Hadi Salim)   
  - ext4: fix kernel BUG in 'ext4_write_inline_data_end()' (Ye Bin)   
  - usb: host: ohci-pxa27x: Fix and & vs | typo (Dan Carpenter)   
  - s390/uaccess: add missing earlyclobber annotations to __clear_user() (Heiko Carstens)   
  - drm/etnaviv: fix reference leak when mmaping imported buffer (Lucas Stach)   
  - ALSA: usb-audio: Fix regression on detection of Roland VS-100 (Takashi Iwai)   
  - ALSA: hda/conexant: Partial revert of a quirk for Lenovo (Takashi Iwai)   
  - pinctrl: at91-pio4: fix domain name assignment (Johan Hovold)   
  - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (David Disseldorp)   
  - Input: focaltech - use explicitly signed char type (Jason A. Donenfeld)   
  - i40e: fix registers dump after run ethtool adapter self test (Radoslaw Tyl)   
  - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Ivan Orlov)   
  - scsi: megaraid_sas: Fix crash after a double completion (Tomas Henzl)   
  - fbdev: au1200fb: Fix potential divide by zero (Wei Chen)   
  - fbdev: lxfb: Fix potential divide by zero (Wei Chen)   
  - fbdev: intelfb: Fix potential divide by zero (Wei Chen)   
  - fbdev: nvidia: Fix potential divide by zero (Wei Chen)   
  - sched_getaffinity: don't assume 'cpumask_size()' is fully initialized (Linus Torvalds)   
  - fbdev: tgafb: Fix potential divide by zero (Wei Chen)   
  - ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() (Kuninori Morimoto)   
  - ALSA: asihpi: check pao in control_message() (Kuninori Morimoto)   
  - md: avoid signed overflow in slot_store() (NeilBrown)   
  - ocfs2: fix data corruption after failed write (Jan Kara via Ocfs2-devel)   
  - sched/fair: Sanitize vruntime of entity being migrated (Vincent Guittot)   
  - sched/fair: sanitize vruntime of entity being placed (Zhang Qiao)   
  - dm crypt: add cond_resched() to dmcrypt_write() (Mikulas Patocka)   
  - dm stats: check for and propagate alloc_percpu failure (Jiasheng Jiang)   
  - i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() (Wei Chen)   
  - nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() (Ryusuke Konishi)   
  - usb: chipidea: core: fix possible concurrent when switch role (Xu Yang)   
  - usb: chipdea: core: fix return -EINVAL if request role is the same with current role (Xu Yang)   
  - igb: revert rtnl_lock() that causes deadlock (Lin Ma)   
  - usb: gadget: u_audio: don't let userspace block driver unbind (Alvin Šipraga)   
  - scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR (Joel Selvaraj)   
  - sh: sanitize the flags on sigreturn (Al Viro)   
  - net: usb: qmi_wwan: add Telit 0x1080 composition (Enrico Sau)   
  - net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 (Enrico Sau)   
  - scsi: ufs: core: Add soft dependency on governor_simpleondemand (Adrien Thierry)   
  - scsi: target: iscsi: Fix an error message in iscsi_check_key() (Maurizio Lombardi)   
  - m68k: Only force 030 bus error if PC not in exception table (Michael Schmitz)   
  - ca8210: fix mac_len negative array access (Alexander Aring)   
  - riscv: Bump COMMAND_LINE_SIZE value to 1024 (Alexandre Ghiti)   
  - thunderbolt: Use const qualifier for `ring_interrupt_index` (Mario Limonciello)   
  - uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 (Yaroslav Furman)   
  - hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs (Frank Crawford)   
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work (Zheng Wang)   
  - Bluetooth: btqcomsmd: Fix command timeout after setting BD address (Stephan Gerhold)   
  - net: mdio: thunder: Add missing fwnode_handle_put() (Liang He)   
  - hvc/xen: prevent concurrent accesses to the shared ring (Roger Pau Monne)   
  - atm: idt77252: fix kmemleak when rmmod idt77252 (Li Zetao)   
  - net/mlx5: Read the TC mapping of all priorities on ETS query (Maher Sanalla)   
  - bpf: Adjust insufficient default bpf_jit_limit (Daniel Borkmann)   
  - net/ps3_gelic_net: Use dma_mapping_error (Geoff Levand)   
  - net/ps3_gelic_net: Fix RX sk_buff length (Geoff Levand)   
  - net: qcom/emac: Fix use after free bug in emac_remove due to race condition (Zheng Wang)   
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach (Zheng Wang)   
  - qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info (Daniil Tatianin)   
  - net: usb: smsc95xx: Limit packet length to skb->len (Szymon Heidrich)   
  - scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() (Yu Kuai)   
  - i2c: imx-lpi2c: check only for enabled interrupt flags (Alexander Stein)   
  - igbvf: Regard vf reset nack as success (Akihiko Odaki)   
  - intel/igbvf: free irq on the error path in igbvf_request_msix() (Gaosheng Cui)   
  - iavf: fix inverted Rx hash condition leading to disabled hash (Alexander Lobakin)   
  - power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition (Zheng Wang)   
  - LTS version: v4.14.311 (Saeed Mirzamohammadi)   
  - HID: uhid: Over-ride the default maximum data buffer value with our own (Lee Jones)   
  - HID: core: Provide new max_buffer_size attribute to over-ride the default (Lee Jones)   
  - serial: 8250_em: Fix UART port type (Biju Das)   
  - drm/i915: Don't use stolen memory for ring buffers with LLC (John Harrison)   
  - fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks (Helge Deller)   
  - ftrace: Fix invalid address access in lookup_rec() when index is 0 (Chen Zhongjin)   
  - sh: intc: Avoid spurious sizeof-pointer-div warning (Michael Karcher)   
  - ext4: fix task hung in ext4_xattr_delete_inode (Baokun Li)   
  - ext4: fail ext4_iget if special inode unallocated (Baokun Li)   
  - mmc: atmel-mci: fix race between stop command and start of next command (Tobias Schramm)   
  - media: m5mols: fix off-by-one loop termination error (Linus Torvalds)   
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition (Zheng Wang)   
  - hwmon: (adt7475) Fix masking of hysteresis registers (Tony O'Brien)   
  - hwmon: (adt7475) Display smoothing attributes in correct order (Tony O'Brien)   
  - ethernet: sun: add check for the mdesc_grab() (Liang He)   
  - net/iucv: Fix size of interrupt data (Alexandra Winter)   
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (Szymon Heidrich)   
  - ipv4: Fix incorrect table ID in IOCTL path (Ido Schimmel)   
  - block: sunvdc: add check for mdesc_grab() returning NULL (Liang He)   
  - nvmet: avoid potential UAF in nvmet_req_complete() (Damien Le Moal)   
  - net: usb: smsc75xx: Limit packet length to skb->len (Szymon Heidrich)   
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition (Zheng Wang)   
  - net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails (Heiner Kallweit)   
  - net: tunnels: annotate lockless accesses to dev->needed_headroom (Eric Dumazet)   
  - qed/qed_dev: guard against a possible division by zero (Daniil Tatianin)   
  - nfc: pn533: initialize struct pn533_out_arg properly (Fedor Pchelkin)   
  - tcp: tcp_make_synack() can be called from process context (Breno Leitao)   
  - fs: sysfs_emit_at: Remove PAGE_SIZE alignment check (Eric Biggers)   
  - ext4: fix cgroup writeback accounting with fs-layer encryption (Eric Biggers)   
  - LTS version: v4.14.310 (Saeed Mirzamohammadi)   
  - drm/i915: Don't use BAR mappings for ring buffers with LLC (John Harrison)   
  - tipc: improve function tipc_wait_for_cond() (Tung Nguyen)   
  - media: ov5640: Fix analogue gain control (Paul Elder)   
  - PCI: Add SolidRun vendor ID (Alvaro Karsz)   
  - macintosh: windfarm: Use unsigned type for 1-bit bitfields (Nathan Chancellor)   
  - alpha: fix R_ALPHA_LITERAL reloc for large modules (Edward Humes)   
  - MIPS: Fix a compilation issue (xurui)   
  - net: caif: Fix use-after-free in cfusbl_device_notify() (Shigeru Yoshida)   
  - ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (Eric Dumazet)   
  - nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties (Kang Chen)   
  - nfc: change order inside nfc_se_io error path (Fedor Pchelkin)   
  - ext4: zero i_disksize when initializing the bootloader inode (Zhihao Cheng)   
  - ext4: fix WARNING in ext4_update_inline_data (Ye Bin)   
  - ext4: move where set the MAY_INLINE_DATA flag is set (Ye Bin)   
  - ext4: fix another off-by-one fsmap error on 1k block filesystems (Darrick J. Wong)   
  - ext4: fix RENAME_WHITEOUT handling for inline directories (Eric Whitney)   
  - x86/CPU/AMD: Disable XSAVES on AMD family 0x17 (Andrew Cooper)   
  - LTS version: v4.14.309 (Saeed Mirzamohammadi)   
  - staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh (Philipp Hortmann)   
  - staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script (Philipp Hortmann)   
  - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" (Hector Martin)   
  - LTS version: v4.14.308 (Saeed Mirzamohammadi)   
  - thermal: intel: powerclamp: Fix cur_state for multi package system (Srinivas Pandruvada)   
  - tcp: Fix listen() regression in 4.14.303. (Kuniyuki Iwashima)   
  - s390/setup: init jump labels before command line parsing (Vasily Gorbik)   
  - s390/maccess: add no DAT mode to kernel_write (Vasily Gorbik)   
  - Bluetooth: hci_sock: purge socket queues in the destruct() callback (Nguyen Dinh Phi)   
  - phy: rockchip-typec: Fix unsigned comparison with less than zero (Jiapeng Chong)   
  - usb: uvc: Enumerate valid values for color matching (Daniel Scally)   
  - USB: ene_usb6250: Allocate enough memory for full object (Kees Cook)   
  - usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math (Kees Cook)   
  - iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() (Harshit Mogalapalli)   
  - iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() (Harshit Mogalapalli)   
  - tools/iio/iio_utils:fix memory leak (Yulong Zhang)   
  - tty: serial: fsl_lpuart: disable the CTS when send break signal (Sherry Sun)   
  - tty: fix out-of-bounds access in tty_driver_lookup_tty() (Sven Schnelle)   
  - media: uvcvideo: Handle cameras with invalid descriptors (Ricardo Ribalda)   
  - firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 (Darrell Kavanagh)   
  - tracing: Add NULL checks for buffer in ring_buffer_free_read_page() (Jia-Ju Bai)   
  - thermal: intel: quark_dts: fix error pointer dereference (Dan Carpenter)   
  - scsi: ipr: Work around fortify-string warning (Arnd Bergmann)   
  - tcp: tcp_check_req() can be called from process context (Eric Dumazet)   
  - ARM: dts: spear320-hmi: correct STMPE GPIO compatible (Krzysztof Kozlowski)   
  - nfc: fix memory leak of se_io context in nfc_genl_se_io (Fedor Pchelkin)   
  - 9p/xen: fix connection sequence (Juergen Gross)   
  - 9p/xen: fix version parsing (Juergen Gross)   
  - net: fix __dev_kfree_skb_any() vs drop monitor (Eric Dumazet)   
  - netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() (Hangyu Hua)   
  - watchdog: pcwd_usb: Fix attempting to access uninitialized memory (Li Hua)   
  - watchdog: Fix kmemleak in watchdog_cdev_register (Chen Jun)   
  - watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path (ruanjinjie)   
  - x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list (Ammar Faizi)   
  - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed (Zhihao Cheng)   
  - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() (Zhihao Cheng)   
  - ubifs: ubifs_writepage: Mark page dirty after writing inode failed (Zhihao Cheng)   
  - ubifs: dirty_cow_znode: Fix memleak in error handling path (Zhihao Cheng)   
  - ubifs: Re-statistic cleaned znode count if commit failed (Zhihao Cheng)   
  - ubi: Fix possible null-ptr-deref in ubi_free_volume() (Yang Yingliang)   
  - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (Li Zetao)   
  - ubi: Fix use-after-free when volume resizing failed (Li Zetao)   
  - ubifs: Reserve one leb for each journal head while doing budget (Zhihao Cheng)   
  - ubifs: Fix wrong dirty space budget for dirty inode (Zhihao Cheng)   
  - ubifs: Rectify space budget for ubifs_xrename() (Zhihao Cheng)   
  - ubi: ensure that VID header offset + VID header size <= alloc, size (George Kennedy)   
  - pwm: stm32-lp: fix the check on arr and cmp registers update (Fabrice Gasnier)   
  - fs/jfs: fix shift exponent db_agl2size negative (Liu Shixin via Jfs-discussion)   
  - net/sched: Retire tcindex classifier (Jamal Hadi Salim)   
  - kbuild: Port silent mode detection to future gnu make. (Dmitry Goncharov)   
  - drm/radeon: Fix eDP for single-display iMac11,2 (Mark Hawrylak)   
  - PCI: Avoid FLR for AMD FCH AHCI adapters (Damien Le Moal)   
  - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() (Tomas Henzl)   
  - scsi: ses: Fix possible desc_ptr out-of-bounds accesses (Tomas Henzl)   
  - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses (Tomas Henzl)   
  - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() (Tomas Henzl)   
  - scsi: ses: Don't attach if enclosure has no components (James Bottomley)   
  - scsi: qla2xxx: Fix erroneous link down (Quinn Tran)   
  - scsi: qla2xxx: Fix link failure in NPIV environment (Quinn Tran)   
  - ktest.pl: Fix missing "end_monitor" when machine check fails (Steven Rostedt)   
  - mips: fix syscall_get_nr (Elvira Khabirova)   
  - alpha: fix FEN fault handling (Al Viro)   
  - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (Ilya Dryomov)   
  - ARM: dts: exynos: correct TMU phandle in Odroid XU (Krzysztof Kozlowski)   
  - ARM: dts: exynos: correct TMU phandle in Exynos4 (Krzysztof Kozlowski)   
  - dm flakey: don't corrupt the zero page (Mikulas Patocka)   
  - dm flakey: fix logic when corrupting a bio (Mikulas Patocka)   
  - wifi: cfg80211: Fix use after free for wext (Alexander Wetzel)   
  - wifi: rtl8xxxu: Use a longer retry limit of 48 (Bitterblue Smith)   
  - ext4: refuse to create ea block when umounted (Jun Nie)   
  - ext4: optimize ea_inode block expansion (Jun Nie)   
  - ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() (Dmitry Fomin)   
  - irqdomain: Drop bogus fwspec-mapping error handling (Johan Hovold)   
  - irqdomain: Fix disassociation race (Johan Hovold)   
  - irqdomain: Fix association race (Johan Hovold)   
  - ima: Align ima_file_mmap() parameters with mmap_file LSM hook (Roberto Sassu)   
  - Documentation/hw-vuln: Document the interaction between IBRS and STIBP (KP Singh)   
  - x86/microcode/AMD: Fix mixed steppings support (Borislav Petkov (AMD))   
  - x86/microcode/AMD: Add a @cpu parameter to the reloading functions (Borislav Petkov (AMD))   
  - x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter (Borislav Petkov (AMD))   
  - x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range (Yang Jihong)   
  - x86/kprobes: Fix __recover_optprobed_insn check optimizing logic (Yang Jihong)   
  - x86/reboot: Disable SVM, not just VMX, when stopping CPUs (Sean Christopherson)   
  - x86/crash: Disable virt in core NMI crash handler to avoid double shootdown (Sean Christopherson)   
  - x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) (Sean Christopherson)   
  - udf: Fix file corruption when appending just after end of preallocated extent (Jan Kara)   
  - udf: Do not update file length for failed writes to inline files (Jan Kara)   
  - udf: Do not bother merging very long extents (Jan Kara)   
  - udf: Truncate added extents on failed expansion (Jan Kara)   
  - ocfs2: fix non-auto defrag path not working issue (Heming Zhao via Ocfs2-devel)   
  - ocfs2: fix defrag path triggering jbd2 ASSERT (Heming Zhao via Ocfs2-devel)   
  - f2fs: fix information leak in f2fs_move_inline_dirents() (Eric Biggers)   
  - fs: hfsplus: fix UAF issue in hfsplus_put_super (Dongliang Mu)   
  - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create (Liu Shixin)   
  - s390/kprobes: fix current_kprobe never cleared after kprobes reenter (Vasily Gorbik)   
  - s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler (Vasily Gorbik)   
  - rtc: pm8xxx: fix set-alarm race (Johan Hovold)   
  - wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu (Jun ASAKA)   
  - spi: bcm63xx-hsspi: Fix multi-bit mode setting (William Zhang)   
  - dm cache: add cond_resched() to various workqueue loops (Mike Snitzer)   
  - dm thin: add cond_resched() to various workqueue loops (Mike Snitzer)   
  - pinctrl: at91: use devm_kasprintf() to avoid potential leaks (Claudiu Beznea)   
  - regulator: s5m8767: Bounds check id indexing into arrays (Kees Cook)   
  - regulator: max77802: Bounds check regulator id against opmode (Kees Cook)   
  - ASoC: kirkwood: Iterate over array indexes instead of using pointer math (Kees Cook)   
  - docs/scripts/gdb: add necessary make scripts_gdb step (Jakob Koschel)   
  - drm/msm/dsi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang)   
  - drm/radeon: free iio for atombios when driver shutdown (Liwei Song)   
  - ACPI: video: Fix Lenovo Ideapad Z570 DMI match (Hans de Goede)   
  - m68k: Check syscall_trace_enter() return code (Michael Schmitz)   
  - net: bcmgenet: Add a check for oversized packets (Florian Fainelli)   
  - ACPI: Don't build ACPICA with '-Os' (Mark Rutland)   
  - inet: fix fast path in __inet_hash_connect() (Pietro Borrello)   
  - timers: Prevent union confusion from unexpected restart_syscall() (Jann Horn)   
  - thermal: intel: Fix unsigned comparison with less than zero (Yang Li)   
  - rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() (Paul E. McKenney)   
  - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (Jisoo Jang)   
  - ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy (Markuss Broks)   
  - udf: Define EFSCORRUPTED error code (Jan Kara)   
  - rpmsg: glink: Avoid infinite loop on intent for missing channel (Bjorn Andersson)   
  - media: usb: siano: Fix use after free bugs caused by do_submit_urb (Duoming Zhou)   
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() (Duoming Zhou)   
  - media: platform: ti: Add missing check for devm_regulator_get (Jiasheng Jiang)   
  - MIPS: vpe-mt: drop physical_memsize (Randy Dunlap)   
  - powerpc/pseries/lparcfg: add missing RTAS retry status handling (Nathan Lynch)   
  - powerpc/powernv/ioda: Skip unallocated resources when mapping to PE (Frederic Barrat)   
  - Input: ads7846 - don't check penirq immediately for 7845 (Luca Ellero)   
  - Input: ads7846 - don't report pressure for ads7845 (Luca Ellero)   
  - mtd: rawnand: sunxi: Fix the size of the last OOB region (Samuel Holland)   
  - mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() (Qiheng Lin)   
  - dm: remove flush_scheduled_work() during local_exit() (Mike Snitzer)   
  - scsi: aic94xx: Add missing check for dma_map_single() (Jiasheng Jiang)   
  - hwmon: (ltc2945) Handle error case in ltc2945_value_store (Jonathan Cormier)   
  - gpio: vf610: connect GPIO label to dev name (Haibo Chen)   
  - ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() (Kuninori Morimoto)   
  - drm/mediatek: Drop unbalanced obj unref (Rob Clark)   
  - drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness (Daniel Mentz)   
  - ALSA: hda/ca0132: minor fix for allocation size (Alexey V. Vissarionov)   
  - pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups (Miaoqian Lin)   
  - drm/msm/hdmi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang)   
  - gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() (Liang He)   
  - drm/bridge: megachips: Fix error handling in i2c_register_driver() (Yuan Can)   
  - drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC (Geert Uytterhoeven)   
  - irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts (Florian Fainelli)   
  - can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error (Frank Jungclaus)   
  - wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() (Dan Carpenter)   
  - m68k: /proc/hardware should depend on PROC_FS (Randy Dunlap)   
  - crypto: rsa-pkcs1pad - Use akcipher_request_complete (Herbert Xu)   
  - Bluetooth: L2CAP: Fix potential user-after-free (Luiz Augusto von Dentz)   
  - cpufreq: davinci: Fix clk use after free (Uwe Kleine-König)   
  - irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe (Miaoqian Lin)   
  - irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains (Miaoqian Lin)   
  - net/mlx5: Enhance debug print in page allocation failure (Jack Morgenstein)   
  - crypto: seqiv - Handle EBUSY correctly (Herbert Xu)   
  - ACPI: battery: Fix missing NUL-termination with large strings (Armin Wolf)   
  - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() (Minsuk Kang)   
  - wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function (Fedor Pchelkin)   
  - wifi: orinoco: check return value of hermes_write_wordrec() (Alexey Kodanev)   
  - ACPICA: nsrepair: handle cases without a return value correctly (Daniil Tatianin)   
  - lib/mpi: Fix buffer overrun when SG is too long (Herbert Xu)   
  - genirq: Fix the return type of kstat_cpu_irqs_sum() (Zhen Lei)   
  - wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() (Zhengchao Shao)   
  - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (Zhang Changzhong)   
  - wifi: ipw2200: fix memory leak in ipw_wdev_init() (Zhengchao Shao)   
  - wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: libertas: fix memory leak in lbs_init_adapter() (Zhengchao Shao)   
  - arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name (Neil Armstrong)   
  - arm64: dts: amlogic: meson-gx: add missing unit address to rng node name (Neil Armstrong)   
  - arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name (Neil Armstrong)   
  - ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato (Krzysztof Kozlowski)   
  - ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() (Yang Yingliang)   
  - arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address (Martin Blumenstingl)   
  - arm64: dts: meson-gx: Fix Ethernet MAC address unit name (Martin Blumenstingl)   
  - ARM: zynq: Fix refcount leak in zynq_early_slcr_init (Qiheng Lin)   
  - ARM: OMAP2+: Fix memory leak in realtime_counter_init() (Chen Hui)   
  - HID: asus: use spinlock to safely schedule workers (Pietro Borrello)   
  - HID: asus: use spinlock to protect concurrent accesses (Pietro Borrello)   
  - HID: asus: Remove check for same LED brightness on set (Luke D. Jones)   
  - USB: core: Don't hold device lock while reading the "descriptors" sysfs file (Alan Stern)   
  - USB: serial: option: add support for VW/Skoda "Carstick LTE" (Florian Zumbiehl)   
  - dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size (Jiasheng Jiang)   
  - bpf: Fix truncation handling for mod32 dst reg wrt zero (Daniel Borkmann)   
  - bpf: Fix 32 bit src register truncation on div/mod (Daniel Borkmann)   
  - bpf: fix subprog verifier bypass by div/mod by 0 exception (Daniel Borkmann)   
  - bpf: Do not use ax register in interpreter on div/mod (Daniel Borkmann)   
  - net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues(). (Kuniyuki Iwashima)   
  - IB/hfi1: Assign npages earlier (Dean Luick)   
  - btrfs: send: limit number of clones and allocated memory size (David Sterba)   
  - ARM: dts: rockchip: add power-domains property to dp node on rk3288 (Johan Jonker)   
  - LTS version: v4.14.307 (Saeed Mirzamohammadi)   
  - wifi: mwifiex: Add missing compatible string for SD8787 (Lukas Wunner)   
  - uaccess: Add speculation barrier to copy_from_user() (Dave Hansen)   
  - alarmtimer: Prevent starvation by small intervals and SIG_IGN (Thomas Gleixner)   
  - powerpc: dts: t208x: Disable 10G on MAC1 and MAC2 (Sean Anderson)   
  - random: always mix cycle counter in add_latent_entropy() (Jason A. Donenfeld)   
  - powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G (Sean Anderson)   
  - wifi: rtl8xxxu: gen2: Turn on the rate control (Bitterblue Smith)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.526.2.el7uek]
changelog:
  - Revert "net/sched: Retire tcindex classifier" (Saeed Mirzamohammadi)  [Orabug: 35415066]  
  - elba.dtsi: Improved sdclk and sdclk-hsmmc timing. (David Clear)  [Orabug: 35411611]  
  - dsc-drivers: update ionic drivers to 23.04.1-001 (Dave Kleikamp)  [Orabug: 35411611]  
  - dsc-drivers: update ionic drivers to 22.11.1-001 (Dave Kleikamp)  [Orabug: 35411611]  
  - dsc-drivers: update drivers for 1.15.9-C-100 (Dave Kleikamp)  [Orabug: 35411611]  
  - kernfs: change kernfs_rename_lock into a read-write lock. (Imran Khan)  [Orabug: 35257586]  
  - kernfs: Use a per-fs rwsem to protect per-fs list of kernfs_super_info. (Imran Khan)  [Orabug: 35257586]  
  - kernfs: Introduce separate rwsem to protect inode attributes. (Imran Khan)  [Orabug: 35257586]  
  - btrfs: scan device in non-exclusive mode (Anand Jain)  [Orabug: 35153012]  
  - btrfs: free device in btrfs_close_devices for a single device filesystem (Anand Jain)  [Orabug: 35153012]  
  - SUNRPC: remove the maximum number of retries in call_bind_status (Dai Ngo)  [Orabug: 34640827]  
  - KVM: nVMX: add CR4_LA57 bit to nested CR4_FIXED1 (Chenyi Qiang)  [Orabug: 32715898]  
  - Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" (Liu Jian)   
  - Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path" (Zhihao Cheng)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.526.2.1.el7uek]
changelog:
  - xfs: log recovery stage split EFIs with multiple extents (Wengang Wang)  [Orabug: 35490075]  
  - xfs: IO time one extent per EFI (Wengang Wang)  [Orabug: 35490075]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.527.1.el7uek]
changelog:
  - mips64: Enable CRYPTO_USER_API_SKCIPHER config (Vijay Kumar)  [Orabug: 35458816]  
  - net/rds: Fix copy&paste error (Gerd Rausch)  [Orabug: 35416949]  
  - uek-rpm: Blacklist cls_tcindex module (Somasundaram Krishnasamy)  [Orabug: 35408336]  
  - LTS version: v4.14.316 (Saeed Mirzamohammadi)   
  - 3c589_cs: Fix an error handling path in tc589_probe() (Christophe JAILLET)   
  - forcedeth: Fix an error handling path in nv_probe() (Christophe JAILLET)   
  - x86/show_trace_log_lvl: Ensure stack pointer is aligned, again (Vernon Lovejoy)   
  - xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() (Dan Carpenter)   
  - power: supply: sbs-charger: Fix INHIBITED bit for Status reg (Daisuke Nojiri)   
  - power: supply: bq27xxx: Fix poll_interval handling and races on remove (Hans de Goede)   
  - power: supply: bq27xxx: Fix I2C IRQ race on remove (Hans de Goede)   
  - power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition (Hans de Goede)   
  - power: supply: leds: Fix blink to LED on transition (Hans de Goede)   
  - ipv6: Fix out-of-bounds access in ipv6_find_tlv() (Gavrilov Ilia)   
  - net: fix skb leak in __skb_tstamp_tx() (Pratyush Yadav)   
  - media: radio-shark: Add endpoint checks (Alan Stern)   
  - USB: sisusbvga: Add endpoint checks (Alan Stern)   
  - x86/mm: Avoid incomplete Global INVLPG flushes (Saeed Mirzamohammadi)   
  - USB: core: Add routines for endpoint checks in old drivers (Alan Stern)   
  - selftests/memfd: Fix unknown type name build failure (Hardik Garg)   
  - netfilter: nf_tables: fix register ordering (Florian Westphal)   
  - netfilter: nf_tables: do not allow SET_ID to refer to another table (Pablo Neira Ayuso)   
  - netfilter: nf_tables: do not allow RULE_ID to refer to another chain (Pablo Neira Ayuso)   
  - netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL (Pablo Neira Ayuso)   
  - netfilter: nf_tables: stricter validation of element data (Pablo Neira Ayuso)   
  - netfilter: nf_tables: allow up to 64 bytes in the set element data area (Pablo Neira Ayuso)   
  - netfilter: nf_tables: add nft_setelem_parse_key() (Pablo Neira Ayuso)   
  - netfilter: nf_tables: validate registers coming from userspace. (Pablo Neira Ayuso)   
  - netfilter: nftables: statify nft_parse_register() (Pablo Neira Ayuso)   
  - netfilter: nftables: add nft_parse_register_store() and use it (Pablo Neira Ayuso)   
  - netfilter: nftables: add nft_parse_register_load() and use it (Pablo Neira Ayuso)   
  - parisc: Allow to reboot machine after system halt (Helge Deller)   
  - m68k: Move signal frame following exception on 68020/030 (Finn Thain)   
  - spi: fsl-cpm: Use 16 bit mode for large transfers with even size (Christophe Leroy)   
  - spi: fsl-spi: Re-organise transfer bits_per_word adaptation (Christophe Leroy)   
  - spi: spi-fsl-spi: automatically adapt bits-per-word in cpu mode (Rasmus Villemoes)   
  - netfilter: nf_tables: bogus EBUSY in helper removal from transaction (Pablo Neira Ayuso)   
  - nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() (Ryusuke Konishi)   
  - ceph: force updating the msg pointer in non-split case (Xiubo Li)   
  - serial: Add support for Advantech PCI-1611U card (Vitaliy Tomin)   
  - statfs: enforce statfs[64] structure initialization (Ilya Leoshkevich)   
  - ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table (Nikhil Mahale)   
  - ALSA: hda: Fix Oops by 9.1 surround channel names (Takashi Iwai)   
  - usb-storage: fix deadlock when a scsi command timeouts more than once (Maxime Bizon)   
  - vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() (Eric Dumazet)   
  - igb: fix bit_shift to be in [1..8] range (Aleksandr Loktionov)   
  - cassini: Fix a memory leak in the error handling path of cas_init_one() (Christophe JAILLET)   
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Dong Chenchen)   
  - media: netup_unidvb: fix use-after-free at del_timer() (Duoming Zhou)   
  - vsock: avoid to close connected socket after the timeout (Zhuang Shengen)   
  - net: fec: Better handle pm_runtime_get() failing in .remove() (Uwe Kleine-König)   
  - af_key: Reject optional tunnel/BEET mode templates in outbound policies (Tobias Brunner)   
  - cpupower: Make TSC read per CPU for Mperf monitor (Wyes Karny)   
  - mfd: dln2: Fix memory leak in dln2_probe() (Qiang Ning)   
  - phy: st: miphy28lp: use _poll_timeout functions for waits (Alain Volmat)   
  - Input: xpad - add constants for GIP interface numbers (Vicki Pfau)   
  - clk: tegra20: fix gcc-7 constant overflow warning (Arnd Bergmann)   
  - recordmcount: Fix memory leaks in the uwrite function (Hao Zeng)   
  - sched: Fix KCSAN noinstr violation (Josh Poimboeuf)   
  - mcb-pci: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - serial: 8250: Reinit port->pm on port specific driver unbind (Tony Lindgren)   
  - HID: wacom: generic: Set battery quirk only when we see battery data (Jason Gerecke)   
  - spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 (Kevin Groeneveld)   
  - HID: logitech-hidpp: Reconcile USB and Unifying serials (Bastien Nocera)   
  - HID: logitech-hidpp: Don't use the USB serial for USB devices (Bastien Nocera)   
  - staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE (Philipp Hortmann)   
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (Min Li)   
  - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (Hans de Goede)   
  - ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() (Ojaswin Mujoo)   
  - ext4: set goal start correctly in ext4_mb_normalize_request (Kemeng Shi)   
  - gfs2: Fix inode height consistency check (Andreas Gruenbacher)   
  - scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition (Zheng Wang)   
  - lib: cpu_rmap: Avoid use after free on rmap->obj array entries (Eli Cohen)   
  - net: Catch invalid index in XPS mapping (Nick Child)   
  - net: pasemi: Fix return type of pasemi_mac_start_tx() (Nathan Chancellor)   
  - ext2: Check block size validity during mount (Jan Kara)   
  - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex (Hector Martin)   
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects (void0red)   
  - ACPICA: Avoid undefined behavior: applying zero offset to null pointer (Tamir Duberstein)   
  - drm/tegra: Avoid potential 32-bit integer overflow (Nur Hussein)   
  - ACPI: EC: Fix oops when removing custom query handlers (Armin Wolf)   
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang)   
  - regmap: cache: Return error in cache sync operations for REGCACHE_NONE (Alexander Stein)   
  - fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() (Tetsuo Handa)   
  - af_unix: Fix a data race of sk->sk_receive_queue->qlen. (Kuniyuki Iwashima)   
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (t.feng)   
  - net: annotate sk->sk_err write from do_recvmmsg() (Eric Dumazet)   
  - netlink: annotate accesses to nlk->cb_running (Eric Dumazet)   
  - net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). (Kuniyuki Iwashima)   
  - LTS version: v4.14.315 (Saeed Mirzamohammadi)   
  - mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock (Tetsuo Handa)   
  - printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h (Tetsuo Handa)   
  - drbd: correctly submit flush bio on barrier (Christoph Böhmwalder)   
  - serial: 8250: Fix serial8250_tx_empty() race with DMA Tx (Ilpo Järvinen)   
  - tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH (Ilpo Järvinen)   
  - perf bench: Share some global variables to fix build with gcc 10 (Arnaldo Carvalho de Melo)   
  - ext4: fix invalid free tracking in ext4_xattr_move_to_block() (Theodore Ts'o)   
  - ext4: remove a BUG_ON in ext4_mb_release_group_pa() (Theodore Ts'o)   
  - ext4: bail out of ext4_xattr_ibody_get() fails for any reason (Theodore Ts'o)   
  - ext4: add bounds checking in get_max_inline_xattr_value_size() (Theodore Ts'o)   
  - ext4: improve error recovery code paths in __ext4_remount() (Theodore Ts'o)   
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus)   
  - HID: wacom: Set a default resolution for older tablets (Ping Cheng)   
  - ARM: dts: s5pv210: correct MIPI CSIS clock name (Krzysztof Kozlowski)   
  - ARM: dts: exynos: fix WM8960 clock name in Itop Elite (Krzysztof Kozlowski)   
  - sh: nmi_debug: fix return value of __setup handler (Randy Dunlap)   
  - sh: math-emu: fix macro redefined warning (Randy Dunlap)   
  - cifs: fix pcchunk length type in smb2_copychunk_range (Pawel Witek)   
  - btrfs: print-tree: parent bytenr must be aligned to sector size (Anastasia Belova)   
  - btrfs: fix btrfs_prev_leaf() to not return the same key twice (Filipe Manana)   
  - perf symbols: Fix return incorrect build_id size in elf_read_build_id() (Yang Jihong)   
  - perf map: Delete two variable initialisations before null pointer checks in sort__sym_from_cmp() (Markus Elfring)   
  - perf vendor events power9: Remove UTF-8 characters from JSON files (Kajol Jain)   
  - ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init` (Ruliang Lin)   
  - af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). (Kuniyuki Iwashima)   
  - net/sched: act_mirred: Add carrier check (Victor Nogueira)   
  - writeback: fix call of incorrect macro (Maxim Korotkov)   
  - sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() (Cong Wang)   
  - netfilter: nf_tables: deactivate anonymous set from preparation phase (Pablo Neira Ayuso)   
  - netfilter: nf_tables: bogus EBUSY when deleting set after flush (Pablo Neira Ayuso)   
  - netfilter: nf_tables: use-after-free in failing rule with bound set (Pablo Neira Ayuso)   
  - netfilter: nft_hash: fix nft_hash_deactivate (Pablo Neira Ayuso)   
  - netfilter: nf_tables: unbind set in rule from commit path (Pablo Neira Ayuso)   
  - netfilter: nf_tables: split set destruction in deactivate and destroy phase (Florian Westphal)   
  - perf auxtrace: Fix address filter entire kernel size (Adrian Hunter)   
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern (Mike Snitzer)   
  - dm flakey: fix a crash with invalid table line (Mikulas Patocka)   
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (Mike Snitzer)   
  - s390/dasd: fix hanging blockdevice after request requeue (Stefan Haberland)   
  - btrfs: scrub: reject unsupported scrub flags (Qu Wenruo)   
  - clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent (Quentin Schulz)   
  - wifi: rtl8xxxu: RTL8192EU always needs full init (Bitterblue Smith)   
  - nilfs2: fix infinite loop in nilfs_mdt_get_block() (Ryusuke Konishi)   
  - nilfs2: do not write dirty data after degenerating to read-only (Ryusuke Konishi)   
  - parisc: Fix argument pointer in real64_call_asm() (Helge Deller)   
  - dmaengine: at_xdmac: do not enable all cyclic channels (Claudiu Beznea)   
  - phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port (Gaosheng Cui)   
  - NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease (Trond Myklebust)   
  - IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order (Patrick Kelsey)   
  - clk: add missing of_node_put() in "assigned-clocks" property parsing (Clément Léger)   
  - power: supply: generic-adc-battery: fix unit scaling (Sebastian Reichel)   
  - RDMA/rdmavt: Delete unnecessary NULL check (Natalia Petrova)   
  - perf/core: Fix hardlockup failure caused by perf throttle (Yang Jihong)   
  - powerpc/rtas: use memmove for potentially overlapping buffer copy (Nathan Lynch)   
  - macintosh: via-pmu-led: requires ATA to be set (Randy Dunlap)   
  - powerpc/sysdev/tsi108: fix resource printk format warnings (Randy Dunlap)   
  - powerpc/wii: fix resource printk format warnings (Randy Dunlap)   
  - powerpc/mpc512x: fix resource printk format warning (Randy Dunlap)   
  - macintosh/windfarm_smu_sat: Add missing of_node_put() (Liang He)   
  - spmi: Add a check for remove callback when removing a SPMI driver (Jishnu Prakash)   
  - staging: rtl8192e: Fix W_DISABLE# does not work after stop/start (Philipp Hortmann)   
  - serial: 8250: Add missing wakeup event reporting (Florian Fainelli)   
  - tty: serial: fsl_lpuart: adjust buffer length to the intended size (Shenwei Wang)   
  - usb: chipidea: fix missing goto in `ci_hdrc_probe` (Yinhao Hu)   
  - sh: sq: Fix incorrect element size for allocating bitmap buffer (John Paul Adrian Glaubitz)   
  - uapi/linux/const.h: prefer ISO-friendly __typeof__ (Saeed Mirzamohammadi)   
  - ia64: mm/contig: fix section mismatch warning/error (Randy Dunlap)   
  - of: Fix modalias string generation (Miquel Raynal)   
  - spi: fsl-spi: Fix CPM/QE mode Litte Endian (Christophe Leroy)   
  - linux/vt_buffer.h: allow either builtin or modular for macros (Randy Dunlap)   
  - pstore: Revert pmsg_lock back to a normal mutex (John Stultz)   
  - tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (Kuniyuki Iwashima)   
  - net: amd: Fix link leak when verifying config failed (Gencen Gan)   
  - ipv4: Fix potential uninit variable access bug in __ip_make_skb() (Ziyang Xuan)   
  - ixgbe: Enable setting RSS table to default values (Joe Damato)   
  - ixgbe: Allow flow hash to be set via ethtool (Joe Damato)   
  - wifi: iwlwifi: mvm: check firmware response size (Johannes Berg)   
  - wifi: iwlwifi: make the loop for card preparation effective (Emmanuel Grumbach)   
  - md/raid10: fix leak of 'r10bio->remaining' for recovery (Yu Kuai)   
  - scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS (Danila Chernetsov)   
  - scsi: target: iscsit: Fix TAS handling during conn cleanup (Mike Christie)   
  - net/packet: convert po->auxdata to an atomic flag (Eric Dumazet)   
  - net/packet: convert po->origdev to an atomic flag (Eric Dumazet)   
  - vlan: partially enable SIOCSHWTSTAMP in container (Vadim Fedorenko)   
  - scm: fix MSG_CTRUNC setting condition for SO_PASSSEC (Alexander Mikhalitsyn)   
  - wifi: ath6kl: reduce WARN to dev_dbg() in callback (Fedor Pchelkin)   
  - wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() (Dan Carpenter)   
  - wifi: ath6kl: minor fix for allocation size (Alexey V. Vissarionov)   
  - arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step (Sumit Garg)   
  - x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() (Saurabh Sengar)   
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (Zheng Wang)   
  - x86/apic: Fix atomic update of offset in reserve_eilvt_offset() (Uros Bizjak)   
  - media: av7110: prevent underflow in write_ts_to_decoder() (Dan Carpenter)   
  - media: bdisp: Add missing check for create_workqueue (Jiasheng Jiang)   
  - drm/probe-helper: Cancel previous job before starting new one (Dom Cobley)   
  - drm/vgem: add missing mutex_destroy (Maíra Canal)   
  - drm/rockchip: Drop unbalanced obj unref (Rob Clark)   
  - selinux: ensure av_permissions.h is built when needed (Paul Moore)   
  - selinux: fix Makefile dependencies of flask.h (Ondrej Mosnacek)   
  - ubifs: Free memory for tmpfile name (Mårten Lindahl)   
  - ubi: Fix return value overwrite issue in try_write_vid_and_data() (Wang YanQing)   
  - i2c: omap: Fix standard mode false ACK readings (Reid Tonking)   
  - reiserfs: Add security prefix to xattr name in reiserfs_security_write() (Roberto Sassu)   
  - ring-buffer: Sync IRQ works before buffer destruction (Johannes Berg)   
  - MIPS: fw: Allow firmware to pass a empty env (Jiaxun Yang)   
  - staging: iio: resolver: ads1210: fix config mode (Nuno Sá)   
  - perf sched: Cast PTHREAD_STACK_MIN to int as it may turn into sysconf(__SC_THREAD_STACK_MIN_VALUE) (Arnaldo Carvalho de Melo)   
  - USB: dwc3: fix runtime pm imbalance on unbind (Johan Hovold)   
  - iio: adc: palmas_gpadc: fix NULL dereference on rmmod (Patrik Dahlström)   
  - USB: serial: option: add UNISOC vendor and TOZED LT70C product (Arınç ÜNAL)   
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ruihan Li)   
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (Jisoo Jang)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.527.2.el7uek]
changelog:
  - Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE" (Greg Kroah-Hartman)   
  - lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() (Ben Hutchings)   
  - selinux: don't use make's grouped targets feature yet (Paul Moore)   
  - xfs: log recovery stage split EFIs with multiple extents (Wengang Wang)  [Orabug: 35475139]  
  - xfs: IO time one extent per EFI (Wengang Wang)  [Orabug: 35475139]  
  - uek_kabi: Add UEK_KABI_DEPRECATE_ENUM (Sherry Yang)  [Orabug: 35469884]  
  - bnxt_en: Clear DEFRAG flag in firmware message when retry flashing. (Pavan Chebbi)  [Orabug: 35406837]  
  - bnxt_en: Enable batch mode when using HWRM_NVM_MODIFY to flash packages. (Michael Chan)  [Orabug: 35406837]  
  - bnxt_en: Retry installing FW package under NO_SPACE error condition. (Pavan Chebbi)  [Orabug: 35406837]  
  - bnxt_en: Restructure bnxt_flash_package_from_fw_obj() to execute in a loop. (Pavan Chebbi)  [Orabug: 35406837]  
  - bnxt_en: Rearrange the logic in bnxt_flash_package_from_fw_obj(). (Michael Chan)  [Orabug: 35406837]  
  - bnxt_en: Refactor bnxt_flash_nvram. (Pavan Chebbi)  [Orabug: 35406837]  
  - bnxt_en: fix error handling when flashing from file (Edwin Peer)  [Orabug: 35406837]  
  - bnxt_en: Fix return code to "flash_device". (Vasundhara Volam)  [Orabug: 35406837]  
  - bnxt_en: Return -EAGAIN if fw command returns BUSY (Vasundhara Volam)  [Orabug: 35406837]  
  - bnxt_en: Convert error code in firmware message response to standard code. (Michael Chan)  [Orabug: 35406837]  
  - bnxt_en: return proper error when FW returns HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED (Vasundhara Volam)  [Orabug: 35406837]  
  - bnxt_en: Use a common function to print the same ethtool -f error message. (Michael Chan)  [Orabug: 35406837]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.526.1.el7uek]
changelog:
  - mm, compaction: Skip all pinned pages during scan (Khalid Aziz)  [Orabug: 35300710]  
  - LTS version: v4.14.314 (Saeed Mirzamohammadi)   
  - ASN.1: Fix check for strdup() success (Ekaterina Orlova)   
  - iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() (Dan Carpenter)   
  - counter: 104-quad-8: Fix race condition between FLAG and CNTR reads (William Breathitt Gray)   
  - sctp: Call inet6_destroy_sock() via sk->sk_destruct(). (Kuniyuki Iwashima)   
  - dccp: Call inet6_destroy_sock() via sk->sk_destruct(). (Kuniyuki Iwashima)   
  - inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). (Kuniyuki Iwashima)   
  - tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). (Kuniyuki Iwashima)   
  - udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM). (Kuniyuki Iwashima)   
  - ext4: fix use-after-free in ext4_xattr_set_entry (Baokun Li)   
  - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Ritesh Harjani)   
  - Revert "ext4: fix use-after-free in ext4_xattr_set_entry" (Tudor Ambarus)   
  - x86/purgatory: Don't generate debug info for purgatory.ro (Pingfan Liu)   
  - memstick: fix memory leak if card device is never registered (Greg Kroah-Hartman)   
  - nilfs2: initialize unused bytes in segment summary blocks (Ryusuke Konishi)   
  - xen/netback: use same error messages for same errors (Juergen Gross)   
  - s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling (Heiko Carstens)   
  - net: dsa: b53: mmap: add phy ops (Álvaro Fernández Rojas)   
  - scsi: core: Improve scsi_vpd_inquiry() checks (Damien Le Moal)   
  - scsi: megaraid_sas: Fix fw_crash_buffer_show() (Tomas Henzl)   
  - selftests: sigaltstack: fix -Wuninitialized (Nick Desaulniers)   
  - f2fs: Fix f2fs_truncate_partial_nodes ftrace event (Douglas Raillard)   
  - e1000e: Disable TSO on i219-LM card to increase speed (Sebastian Basierski)   
  - mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() (Nikita Zhandarovich)   
  - i40e: fix i40e_setup_misc_vector() error handling (Aleksandr Loktionov)   
  - i40e: fix accessing vsi->active_filters without holding lock (Aleksandr Loktionov)   
  - virtio_net: bugfix overflow inside xdp_linearize_page() (Xuan Zhuo)   
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Gwangun Jung)   
  - ARM: dts: rockchip: fix a typo error for rk3288 spdif node (Jianqun Xu)   
  - LTS version: v4.14.313 (Saeed Mirzamohammadi)   
  - arm64: KVM: Fix system register enumeration (Marc Zyngier)   
  - KVM: arm64: Filter out invalid core register IDs in KVM_GET_REG_LIST (Dave Martin)   
  - KVM: arm64: Factor out core register ID enumeration (Dave Martin)   
  - coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug (Steve Clevenger)   
  - watchdog: sbsa_wdog: Make sure the timeout programming is within the limits (George Cherian)   
  - cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() (Waiman Long)   
  - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size (Zhihao Cheng)   
  - verify_pefile: relax wrapper length check (Robbie Harwood)   
  - efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L (Hans de Goede)   
  - i2c: imx-lpi2c: clean rx/tx buffers upon new message (Alexander Stein)   
  - net: macb: fix a memory corruption in extended buffer descriptor mode (Roman Gushchin)   
  - qlcnic: check pci_reset_function result (Denis Plotnikov)   
  - niu: Fix missing unwind goto in niu_alloc_channels() (Harshit Mogalapalli)   
  - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition (Zheng Wang)   
  - mtdblock: tolerate corrected bit-flips (Bang Li)   
  - Bluetooth: Fix race condition in hidp_session_thread (Min Li)   
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (Luiz Augusto von Dentz)   
  - ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards (Oswald Buddenhagen)   
  - ALSA: i2c/cs8427: fix iec958 mixer control deactivation (Oswald Buddenhagen)   
  - ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard (Oswald Buddenhagen)   
  - ALSA: emu10k1: fix capture interrupt handler unlinking (Oswald Buddenhagen)   
  - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() (Rongwei Wang)   
  - ring-buffer: Fix race while reader and writer are on the same page (Zheng Yejian)   
  - ftrace: Mark get_lock_parent_ip() __always_inline (John Keeping)   
  - perf/core: Fix the same task check in perf_event_set_output (Kan Liang)   
  - nilfs2: fix sysfs interface lifetime (Ryusuke Konishi)   
  - nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() (Ryusuke Konishi)   
  - tty: serial: sh-sci: Fix Rx on RZ/G2L SCI (Biju Das)   
  - iio: dac: cio-dac: Fix max DAC write value check for 12-bit (William Breathitt Gray)   
  - USB: serial: option: add Quectel RM500U-CN modem (Bjørn Mork)   
  - USB: serial: option: add Telit FE990 compositions (Enrico Sau)   
  - USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs (Kees Jan Koster)   
  - gpio: davinci: Add irq chip flag to skip set wake (Dhruva Gole)   
  - ipv6: Fix an uninit variable access bug in __ip6_make_skb() (Ziyang Xuan)   
  - icmp: guard against too small mtu (Eric Dumazet)   
  - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta (Felix Fietkau)   
  - pwm: cros-ec: Explicitly set .polarity in .get_state() (Uwe Kleine-König)   
  - LTS version: v4.14.312 (Saeed Mirzamohammadi)   
  - ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() (Harshit Mogalapalli)   
  - net: sched: cbq: dont intepret cls results when asked to drop (Jamal Hadi Salim) [Orabug: 34983585] {CVE-2023-23454}
  - ext4: fix kernel BUG in 'ext4_write_inline_data_end()' (Ye Bin)   
  - usb: host: ohci-pxa27x: Fix and & vs | typo (Dan Carpenter)   
  - s390/uaccess: add missing earlyclobber annotations to __clear_user() (Heiko Carstens)   
  - drm/etnaviv: fix reference leak when mmaping imported buffer (Lucas Stach)   
  - ALSA: usb-audio: Fix regression on detection of Roland VS-100 (Takashi Iwai)   
  - ALSA: hda/conexant: Partial revert of a quirk for Lenovo (Takashi Iwai)   
  - pinctrl: at91-pio4: fix domain name assignment (Johan Hovold)   
  - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (David Disseldorp)   
  - Input: focaltech - use explicitly signed char type (Jason A. Donenfeld)   
  - i40e: fix registers dump after run ethtool adapter self test (Radoslaw Tyl)   
  - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Ivan Orlov)   
  - scsi: megaraid_sas: Fix crash after a double completion (Tomas Henzl)   
  - fbdev: au1200fb: Fix potential divide by zero (Wei Chen)   
  - fbdev: lxfb: Fix potential divide by zero (Wei Chen)   
  - fbdev: intelfb: Fix potential divide by zero (Wei Chen)   
  - fbdev: nvidia: Fix potential divide by zero (Wei Chen)   
  - sched_getaffinity: don't assume 'cpumask_size()' is fully initialized (Linus Torvalds)   
  - fbdev: tgafb: Fix potential divide by zero (Wei Chen)   
  - ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() (Kuninori Morimoto)   
  - ALSA: asihpi: check pao in control_message() (Kuninori Morimoto)   
  - md: avoid signed overflow in slot_store() (NeilBrown)   
  - ocfs2: fix data corruption after failed write (Jan Kara via Ocfs2-devel)   
  - sched/fair: Sanitize vruntime of entity being migrated (Vincent Guittot)   
  - sched/fair: sanitize vruntime of entity being placed (Zhang Qiao)   
  - dm crypt: add cond_resched() to dmcrypt_write() (Mikulas Patocka)   
  - dm stats: check for and propagate alloc_percpu failure (Jiasheng Jiang)   
  - i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() (Wei Chen)   
  - nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() (Ryusuke Konishi)   
  - usb: chipidea: core: fix possible concurrent when switch role (Xu Yang)   
  - usb: chipdea: core: fix return -EINVAL if request role is the same with current role (Xu Yang)   
  - igb: revert rtnl_lock() that causes deadlock (Lin Ma)   
  - usb: gadget: u_audio: don't let userspace block driver unbind (Alvin Šipraga)   
  - scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR (Joel Selvaraj)   
  - sh: sanitize the flags on sigreturn (Al Viro)   
  - net: usb: qmi_wwan: add Telit 0x1080 composition (Enrico Sau)   
  - net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 (Enrico Sau)   
  - scsi: ufs: core: Add soft dependency on governor_simpleondemand (Adrien Thierry)   
  - scsi: target: iscsi: Fix an error message in iscsi_check_key() (Maurizio Lombardi)   
  - m68k: Only force 030 bus error if PC not in exception table (Michael Schmitz)   
  - ca8210: fix mac_len negative array access (Alexander Aring)   
  - riscv: Bump COMMAND_LINE_SIZE value to 1024 (Alexandre Ghiti)   
  - thunderbolt: Use const qualifier for `ring_interrupt_index` (Mario Limonciello)   
  - uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 (Yaroslav Furman)   
  - hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs (Frank Crawford)   
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work (Zheng Wang)   
  - Bluetooth: btqcomsmd: Fix command timeout after setting BD address (Stephan Gerhold)   
  - net: mdio: thunder: Add missing fwnode_handle_put() (Liang He)   
  - hvc/xen: prevent concurrent accesses to the shared ring (Roger Pau Monne)   
  - atm: idt77252: fix kmemleak when rmmod idt77252 (Li Zetao)   
  - net/mlx5: Read the TC mapping of all priorities on ETS query (Maher Sanalla)   
  - bpf: Adjust insufficient default bpf_jit_limit (Daniel Borkmann)   
  - net/ps3_gelic_net: Use dma_mapping_error (Geoff Levand)   
  - net/ps3_gelic_net: Fix RX sk_buff length (Geoff Levand)   
  - net: qcom/emac: Fix use after free bug in emac_remove due to race condition (Zheng Wang)   
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach (Zheng Wang)   
  - qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info (Daniil Tatianin)   
  - net: usb: smsc95xx: Limit packet length to skb->len (Szymon Heidrich)   
  - scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() (Yu Kuai)   
  - i2c: imx-lpi2c: check only for enabled interrupt flags (Alexander Stein)   
  - igbvf: Regard vf reset nack as success (Akihiko Odaki)   
  - intel/igbvf: free irq on the error path in igbvf_request_msix() (Gaosheng Cui)   
  - iavf: fix inverted Rx hash condition leading to disabled hash (Alexander Lobakin)   
  - power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition (Zheng Wang)   
  - LTS version: v4.14.311 (Saeed Mirzamohammadi)   
  - HID: uhid: Over-ride the default maximum data buffer value with our own (Lee Jones)   
  - HID: core: Provide new max_buffer_size attribute to over-ride the default (Lee Jones)   
  - serial: 8250_em: Fix UART port type (Biju Das)   
  - drm/i915: Don't use stolen memory for ring buffers with LLC (John Harrison)   
  - fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks (Helge Deller)   
  - ftrace: Fix invalid address access in lookup_rec() when index is 0 (Chen Zhongjin)   
  - sh: intc: Avoid spurious sizeof-pointer-div warning (Michael Karcher)   
  - ext4: fix task hung in ext4_xattr_delete_inode (Baokun Li)   
  - ext4: fail ext4_iget if special inode unallocated (Baokun Li)   
  - mmc: atmel-mci: fix race between stop command and start of next command (Tobias Schramm)   
  - media: m5mols: fix off-by-one loop termination error (Linus Torvalds)   
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition (Zheng Wang)   
  - hwmon: (adt7475) Fix masking of hysteresis registers (Tony O'Brien)   
  - hwmon: (adt7475) Display smoothing attributes in correct order (Tony O'Brien)   
  - ethernet: sun: add check for the mdesc_grab() (Liang He)   
  - net/iucv: Fix size of interrupt data (Alexandra Winter)   
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (Szymon Heidrich)   
  - ipv4: Fix incorrect table ID in IOCTL path (Ido Schimmel)   
  - block: sunvdc: add check for mdesc_grab() returning NULL (Liang He)   
  - nvmet: avoid potential UAF in nvmet_req_complete() (Damien Le Moal)   
  - net: usb: smsc75xx: Limit packet length to skb->len (Szymon Heidrich)   
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition (Zheng Wang)   
  - net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails (Heiner Kallweit)   
  - net: tunnels: annotate lockless accesses to dev->needed_headroom (Eric Dumazet)   
  - qed/qed_dev: guard against a possible division by zero (Daniil Tatianin)   
  - nfc: pn533: initialize struct pn533_out_arg properly (Fedor Pchelkin)   
  - tcp: tcp_make_synack() can be called from process context (Breno Leitao)   
  - fs: sysfs_emit_at: Remove PAGE_SIZE alignment check (Eric Biggers)   
  - ext4: fix cgroup writeback accounting with fs-layer encryption (Eric Biggers)   
  - LTS version: v4.14.310 (Saeed Mirzamohammadi)   
  - drm/i915: Don't use BAR mappings for ring buffers with LLC (John Harrison)   
  - tipc: improve function tipc_wait_for_cond() (Tung Nguyen)   
  - media: ov5640: Fix analogue gain control (Paul Elder)   
  - PCI: Add SolidRun vendor ID (Alvaro Karsz)   
  - macintosh: windfarm: Use unsigned type for 1-bit bitfields (Nathan Chancellor)   
  - alpha: fix R_ALPHA_LITERAL reloc for large modules (Edward Humes)   
  - MIPS: Fix a compilation issue (xurui)   
  - net: caif: Fix use-after-free in cfusbl_device_notify() (Shigeru Yoshida)   
  - ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (Eric Dumazet)   
  - nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties (Kang Chen)   
  - nfc: change order inside nfc_se_io error path (Fedor Pchelkin)   
  - ext4: zero i_disksize when initializing the bootloader inode (Zhihao Cheng)   
  - ext4: fix WARNING in ext4_update_inline_data (Ye Bin)   
  - ext4: move where set the MAY_INLINE_DATA flag is set (Ye Bin)   
  - ext4: fix another off-by-one fsmap error on 1k block filesystems (Darrick J. Wong)   
  - ext4: fix RENAME_WHITEOUT handling for inline directories (Eric Whitney)   
  - x86/CPU/AMD: Disable XSAVES on AMD family 0x17 (Andrew Cooper)   
  - LTS version: v4.14.309 (Saeed Mirzamohammadi)   
  - staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh (Philipp Hortmann)   
  - staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script (Philipp Hortmann)   
  - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" (Hector Martin)   
  - LTS version: v4.14.308 (Saeed Mirzamohammadi)   
  - thermal: intel: powerclamp: Fix cur_state for multi package system (Srinivas Pandruvada)   
  - tcp: Fix listen() regression in 4.14.303. (Kuniyuki Iwashima)   
  - s390/setup: init jump labels before command line parsing (Vasily Gorbik)   
  - s390/maccess: add no DAT mode to kernel_write (Vasily Gorbik)   
  - Bluetooth: hci_sock: purge socket queues in the destruct() callback (Nguyen Dinh Phi)   
  - phy: rockchip-typec: Fix unsigned comparison with less than zero (Jiapeng Chong)   
  - usb: uvc: Enumerate valid values for color matching (Daniel Scally)   
  - USB: ene_usb6250: Allocate enough memory for full object (Kees Cook)   
  - usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math (Kees Cook)   
  - iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() (Harshit Mogalapalli)   
  - iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() (Harshit Mogalapalli)   
  - tools/iio/iio_utils:fix memory leak (Yulong Zhang)   
  - tty: serial: fsl_lpuart: disable the CTS when send break signal (Sherry Sun)   
  - tty: fix out-of-bounds access in tty_driver_lookup_tty() (Sven Schnelle)   
  - media: uvcvideo: Handle cameras with invalid descriptors (Ricardo Ribalda)   
  - firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 (Darrell Kavanagh)   
  - tracing: Add NULL checks for buffer in ring_buffer_free_read_page() (Jia-Ju Bai)   
  - thermal: intel: quark_dts: fix error pointer dereference (Dan Carpenter)   
  - scsi: ipr: Work around fortify-string warning (Arnd Bergmann)   
  - tcp: tcp_check_req() can be called from process context (Eric Dumazet)   
  - ARM: dts: spear320-hmi: correct STMPE GPIO compatible (Krzysztof Kozlowski)   
  - nfc: fix memory leak of se_io context in nfc_genl_se_io (Fedor Pchelkin)   
  - 9p/xen: fix connection sequence (Juergen Gross)   
  - 9p/xen: fix version parsing (Juergen Gross)   
  - net: fix __dev_kfree_skb_any() vs drop monitor (Eric Dumazet)   
  - netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() (Hangyu Hua)   
  - watchdog: pcwd_usb: Fix attempting to access uninitialized memory (Li Hua)   
  - watchdog: Fix kmemleak in watchdog_cdev_register (Chen Jun)   
  - watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path (ruanjinjie)   
  - x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list (Ammar Faizi)   
  - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed (Zhihao Cheng)   
  - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() (Zhihao Cheng)   
  - ubifs: ubifs_writepage: Mark page dirty after writing inode failed (Zhihao Cheng)   
  - ubifs: dirty_cow_znode: Fix memleak in error handling path (Zhihao Cheng)   
  - ubifs: Re-statistic cleaned znode count if commit failed (Zhihao Cheng)   
  - ubi: Fix possible null-ptr-deref in ubi_free_volume() (Yang Yingliang)   
  - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (Li Zetao)   
  - ubi: Fix use-after-free when volume resizing failed (Li Zetao)   
  - ubifs: Reserve one leb for each journal head while doing budget (Zhihao Cheng)   
  - ubifs: Fix wrong dirty space budget for dirty inode (Zhihao Cheng)   
  - ubifs: Rectify space budget for ubifs_xrename() (Zhihao Cheng)   
  - ubi: ensure that VID header offset + VID header size <= alloc, size (George Kennedy)   
  - pwm: stm32-lp: fix the check on arr and cmp registers update (Fabrice Gasnier)   
  - fs/jfs: fix shift exponent db_agl2size negative (Liu Shixin via Jfs-discussion)   
  - net/sched: Retire tcindex classifier (Jamal Hadi Salim)   
  - kbuild: Port silent mode detection to future gnu make. (Dmitry Goncharov)   
  - drm/radeon: Fix eDP for single-display iMac11,2 (Mark Hawrylak)   
  - PCI: Avoid FLR for AMD FCH AHCI adapters (Damien Le Moal)   
  - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() (Tomas Henzl)   
  - scsi: ses: Fix possible desc_ptr out-of-bounds accesses (Tomas Henzl)   
  - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses (Tomas Henzl)   
  - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() (Tomas Henzl)   
  - scsi: ses: Don't attach if enclosure has no components (James Bottomley)   
  - scsi: qla2xxx: Fix erroneous link down (Quinn Tran)   
  - scsi: qla2xxx: Fix link failure in NPIV environment (Quinn Tran)   
  - ktest.pl: Fix missing "end_monitor" when machine check fails (Steven Rostedt)   
  - mips: fix syscall_get_nr (Elvira Khabirova)   
  - alpha: fix FEN fault handling (Al Viro)   
  - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (Ilya Dryomov)   
  - ARM: dts: exynos: correct TMU phandle in Odroid XU (Krzysztof Kozlowski)   
  - ARM: dts: exynos: correct TMU phandle in Exynos4 (Krzysztof Kozlowski)   
  - dm flakey: don't corrupt the zero page (Mikulas Patocka)   
  - dm flakey: fix logic when corrupting a bio (Mikulas Patocka)   
  - wifi: cfg80211: Fix use after free for wext (Alexander Wetzel)   
  - wifi: rtl8xxxu: Use a longer retry limit of 48 (Bitterblue Smith)   
  - ext4: refuse to create ea block when umounted (Jun Nie)   
  - ext4: optimize ea_inode block expansion (Jun Nie)   
  - ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() (Dmitry Fomin)   
  - irqdomain: Drop bogus fwspec-mapping error handling (Johan Hovold)   
  - irqdomain: Fix disassociation race (Johan Hovold)   
  - irqdomain: Fix association race (Johan Hovold)   
  - ima: Align ima_file_mmap() parameters with mmap_file LSM hook (Roberto Sassu)   
  - Documentation/hw-vuln: Document the interaction between IBRS and STIBP (KP Singh)   
  - x86/microcode/AMD: Fix mixed steppings support (Borislav Petkov (AMD))   
  - x86/microcode/AMD: Add a @cpu parameter to the reloading functions (Borislav Petkov (AMD))   
  - x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter (Borislav Petkov (AMD))   
  - x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range (Yang Jihong)   
  - x86/kprobes: Fix __recover_optprobed_insn check optimizing logic (Yang Jihong)   
  - x86/reboot: Disable SVM, not just VMX, when stopping CPUs (Sean Christopherson)   
  - x86/crash: Disable virt in core NMI crash handler to avoid double shootdown (Sean Christopherson)   
  - x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) (Sean Christopherson)   
  - udf: Fix file corruption when appending just after end of preallocated extent (Jan Kara)   
  - udf: Do not update file length for failed writes to inline files (Jan Kara)   
  - udf: Do not bother merging very long extents (Jan Kara)   
  - udf: Truncate added extents on failed expansion (Jan Kara)   
  - ocfs2: fix non-auto defrag path not working issue (Heming Zhao via Ocfs2-devel)   
  - ocfs2: fix defrag path triggering jbd2 ASSERT (Heming Zhao via Ocfs2-devel)   
  - f2fs: fix information leak in f2fs_move_inline_dirents() (Eric Biggers)   
  - fs: hfsplus: fix UAF issue in hfsplus_put_super (Dongliang Mu)   
  - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create (Liu Shixin)   
  - s390/kprobes: fix current_kprobe never cleared after kprobes reenter (Vasily Gorbik)   
  - s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler (Vasily Gorbik)   
  - rtc: pm8xxx: fix set-alarm race (Johan Hovold)   
  - wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu (Jun ASAKA)   
  - spi: bcm63xx-hsspi: Fix multi-bit mode setting (William Zhang)   
  - dm cache: add cond_resched() to various workqueue loops (Mike Snitzer)   
  - dm thin: add cond_resched() to various workqueue loops (Mike Snitzer)   
  - pinctrl: at91: use devm_kasprintf() to avoid potential leaks (Claudiu Beznea)   
  - regulator: s5m8767: Bounds check id indexing into arrays (Kees Cook)   
  - regulator: max77802: Bounds check regulator id against opmode (Kees Cook)   
  - ASoC: kirkwood: Iterate over array indexes instead of using pointer math (Kees Cook)   
  - docs/scripts/gdb: add necessary make scripts_gdb step (Jakob Koschel)   
  - drm/msm/dsi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang)   
  - drm/radeon: free iio for atombios when driver shutdown (Liwei Song)   
  - ACPI: video: Fix Lenovo Ideapad Z570 DMI match (Hans de Goede)   
  - m68k: Check syscall_trace_enter() return code (Michael Schmitz)   
  - net: bcmgenet: Add a check for oversized packets (Florian Fainelli)   
  - ACPI: Don't build ACPICA with '-Os' (Mark Rutland)   
  - inet: fix fast path in __inet_hash_connect() (Pietro Borrello)   
  - timers: Prevent union confusion from unexpected restart_syscall() (Jann Horn)   
  - thermal: intel: Fix unsigned comparison with less than zero (Yang Li)   
  - rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() (Paul E. McKenney)   
  - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (Jisoo Jang)   
  - ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy (Markuss Broks)   
  - udf: Define EFSCORRUPTED error code (Jan Kara)   
  - rpmsg: glink: Avoid infinite loop on intent for missing channel (Bjorn Andersson)   
  - media: usb: siano: Fix use after free bugs caused by do_submit_urb (Duoming Zhou)   
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() (Duoming Zhou) [Orabug: 35181651] {CVE-2023-1118}
  - media: platform: ti: Add missing check for devm_regulator_get (Jiasheng Jiang)   
  - MIPS: vpe-mt: drop physical_memsize (Randy Dunlap)   
  - powerpc/pseries/lparcfg: add missing RTAS retry status handling (Nathan Lynch)   
  - powerpc/powernv/ioda: Skip unallocated resources when mapping to PE (Frederic Barrat)   
  - Input: ads7846 - don't check penirq immediately for 7845 (Luca Ellero)   
  - Input: ads7846 - don't report pressure for ads7845 (Luca Ellero)   
  - mtd: rawnand: sunxi: Fix the size of the last OOB region (Samuel Holland)   
  - mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() (Qiheng Lin)   
  - dm: remove flush_scheduled_work() during local_exit() (Mike Snitzer)   
  - scsi: aic94xx: Add missing check for dma_map_single() (Jiasheng Jiang)   
  - hwmon: (ltc2945) Handle error case in ltc2945_value_store (Jonathan Cormier)   
  - gpio: vf610: connect GPIO label to dev name (Haibo Chen)   
  - ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() (Kuninori Morimoto)   
  - drm/mediatek: Drop unbalanced obj unref (Rob Clark)   
  - drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness (Daniel Mentz)   
  - ALSA: hda/ca0132: minor fix for allocation size (Alexey V. Vissarionov)   
  - pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups (Miaoqian Lin)   
  - drm/msm/hdmi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang)   
  - gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() (Liang He)   
  - drm/bridge: megachips: Fix error handling in i2c_register_driver() (Yuan Can)   
  - drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC (Geert Uytterhoeven)   
  - irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts (Florian Fainelli)   
  - can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error (Frank Jungclaus)   
  - wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() (Dan Carpenter)   
  - m68k: /proc/hardware should depend on PROC_FS (Randy Dunlap)   
  - crypto: rsa-pkcs1pad - Use akcipher_request_complete (Herbert Xu)   
  - Bluetooth: L2CAP: Fix potential user-after-free (Luiz Augusto von Dentz)   
  - cpufreq: davinci: Fix clk use after free (Uwe Kleine-König)   
  - irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe (Miaoqian Lin)   
  - irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains (Miaoqian Lin)   
  - net/mlx5: Enhance debug print in page allocation failure (Jack Morgenstein)   
  - crypto: seqiv - Handle EBUSY correctly (Herbert Xu)   
  - ACPI: battery: Fix missing NUL-termination with large strings (Armin Wolf)   
  - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() (Minsuk Kang)   
  - wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function (Fedor Pchelkin)   
  - wifi: orinoco: check return value of hermes_write_wordrec() (Alexey Kodanev)   
  - ACPICA: nsrepair: handle cases without a return value correctly (Daniil Tatianin)   
  - lib/mpi: Fix buffer overrun when SG is too long (Herbert Xu)   
  - genirq: Fix the return type of kstat_cpu_irqs_sum() (Zhen Lei)   
  - wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() (Zhengchao Shao)   
  - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (Zhang Changzhong)   
  - wifi: ipw2200: fix memory leak in ipw_wdev_init() (Zhengchao Shao)   
  - wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - wifi: libertas: fix memory leak in lbs_init_adapter() (Zhengchao Shao)   
  - arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name (Neil Armstrong)   
  - arm64: dts: amlogic: meson-gx: add missing unit address to rng node name (Neil Armstrong)   
  - arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name (Neil Armstrong)   
  - ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato (Krzysztof Kozlowski)   
  - ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() (Yang Yingliang)   
  - arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address (Martin Blumenstingl)   
  - arm64: dts: meson-gx: Fix Ethernet MAC address unit name (Martin Blumenstingl)   
  - ARM: zynq: Fix refcount leak in zynq_early_slcr_init (Qiheng Lin)   
  - ARM: OMAP2+: Fix memory leak in realtime_counter_init() (Chen Hui)   
  - HID: asus: use spinlock to safely schedule workers (Pietro Borrello) [Orabug: 35181604] {CVE-2023-1079}
  - HID: asus: use spinlock to protect concurrent accesses (Pietro Borrello)   
  - HID: asus: Remove check for same LED brightness on set (Luke D. Jones)   
  - USB: core: Don't hold device lock while reading the "descriptors" sysfs file (Alan Stern)   
  - USB: serial: option: add support for VW/Skoda "Carstick LTE" (Florian Zumbiehl)   
  - dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size (Jiasheng Jiang)   
  - bpf: Fix truncation handling for mod32 dst reg wrt zero (Daniel Borkmann)   
  - bpf: Fix 32 bit src register truncation on div/mod (Daniel Borkmann) [Orabug: 33041998] {CVE-2021-3600}
  - bpf: fix subprog verifier bypass by div/mod by 0 exception (Daniel Borkmann)   
  - bpf: Do not use ax register in interpreter on div/mod (Daniel Borkmann)   
  - net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues(). (Kuniyuki Iwashima)   
  - IB/hfi1: Assign npages earlier (Dean Luick)   
  - btrfs: send: limit number of clones and allocated memory size (David Sterba)   
  - ARM: dts: rockchip: add power-domains property to dp node on rk3288 (Johan Jonker)   
  - LTS version: v4.14.307 (Saeed Mirzamohammadi)   
  - wifi: mwifiex: Add missing compatible string for SD8787 (Lukas Wunner)   
  - uaccess: Add speculation barrier to copy_from_user() (Dave Hansen)   
  - alarmtimer: Prevent starvation by small intervals and SIG_IGN (Thomas Gleixner)   
  - powerpc: dts: t208x: Disable 10G on MAC1 and MAC2 (Sean Anderson)   
  - random: always mix cycle counter in add_latent_entropy() (Jason A. Donenfeld)   
  - powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G (Sean Anderson)   
  - wifi: rtl8xxxu: gen2: Turn on the rate control (Bitterblue Smith)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.527.1.el7uek]
changelog:
  - mips64: Enable CRYPTO_USER_API_SKCIPHER config (Vijay Kumar)  [Orabug: 35458816]  
  - net/rds: Fix copy&paste error (Gerd Rausch)  [Orabug: 35416949]  
  - uek-rpm: Blacklist cls_tcindex module (Somasundaram Krishnasamy)  [Orabug: 35408336]  
  - LTS version: v4.14.316 (Saeed Mirzamohammadi)   
  - 3c589_cs: Fix an error handling path in tc589_probe() (Christophe JAILLET)   
  - forcedeth: Fix an error handling path in nv_probe() (Christophe JAILLET)   
  - x86/show_trace_log_lvl: Ensure stack pointer is aligned, again (Vernon Lovejoy)   
  - xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() (Dan Carpenter)   
  - power: supply: sbs-charger: Fix INHIBITED bit for Status reg (Daisuke Nojiri)   
  - power: supply: bq27xxx: Fix poll_interval handling and races on remove (Hans de Goede)   
  - power: supply: bq27xxx: Fix I2C IRQ race on remove (Hans de Goede)   
  - power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition (Hans de Goede)   
  - power: supply: leds: Fix blink to LED on transition (Hans de Goede)   
  - ipv6: Fix out-of-bounds access in ipv6_find_tlv() (Gavrilov Ilia)   
  - net: fix skb leak in __skb_tstamp_tx() (Pratyush Yadav)   
  - media: radio-shark: Add endpoint checks (Alan Stern)   
  - USB: sisusbvga: Add endpoint checks (Alan Stern)   
  - x86/mm: Avoid incomplete Global INVLPG flushes (Saeed Mirzamohammadi)   
  - USB: core: Add routines for endpoint checks in old drivers (Alan Stern)   
  - selftests/memfd: Fix unknown type name build failure (Hardik Garg)   
  - netfilter: nf_tables: fix register ordering (Florian Westphal)   
  - netfilter: nf_tables: do not allow SET_ID to refer to another table (Pablo Neira Ayuso)   
  - netfilter: nf_tables: do not allow RULE_ID to refer to another chain (Pablo Neira Ayuso)   
  - netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL (Pablo Neira Ayuso)   
  - netfilter: nf_tables: stricter validation of element data (Pablo Neira Ayuso) [Orabug: 34362007] {CVE-2022-34918}
  - netfilter: nf_tables: allow up to 64 bytes in the set element data area (Pablo Neira Ayuso)   
  - netfilter: nf_tables: add nft_setelem_parse_key() (Pablo Neira Ayuso)   
  - netfilter: nf_tables: validate registers coming from userspace. (Pablo Neira Ayuso)   
  - netfilter: nftables: statify nft_parse_register() (Pablo Neira Ayuso)   
  - netfilter: nftables: add nft_parse_register_store() and use it (Pablo Neira Ayuso)   
  - netfilter: nftables: add nft_parse_register_load() and use it (Pablo Neira Ayuso)   
  - parisc: Allow to reboot machine after system halt (Helge Deller)   
  - m68k: Move signal frame following exception on 68020/030 (Finn Thain)   
  - spi: fsl-cpm: Use 16 bit mode for large transfers with even size (Christophe Leroy)   
  - spi: fsl-spi: Re-organise transfer bits_per_word adaptation (Christophe Leroy)   
  - spi: spi-fsl-spi: automatically adapt bits-per-word in cpu mode (Rasmus Villemoes)   
  - netfilter: nf_tables: bogus EBUSY in helper removal from transaction (Pablo Neira Ayuso)   
  - nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() (Ryusuke Konishi)   
  - ceph: force updating the msg pointer in non-split case (Xiubo Li)   
  - serial: Add support for Advantech PCI-1611U card (Vitaliy Tomin)   
  - statfs: enforce statfs[64] structure initialization (Ilya Leoshkevich)   
  - ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table (Nikhil Mahale)   
  - ALSA: hda: Fix Oops by 9.1 surround channel names (Takashi Iwai)   
  - usb-storage: fix deadlock when a scsi command timeouts more than once (Maxime Bizon)   
  - vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() (Eric Dumazet)   
  - igb: fix bit_shift to be in [1..8] range (Aleksandr Loktionov)   
  - cassini: Fix a memory leak in the error handling path of cas_init_one() (Christophe JAILLET)   
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Dong Chenchen)   
  - media: netup_unidvb: fix use-after-free at del_timer() (Duoming Zhou)   
  - vsock: avoid to close connected socket after the timeout (Zhuang Shengen)   
  - net: fec: Better handle pm_runtime_get() failing in .remove() (Uwe Kleine-König)   
  - af_key: Reject optional tunnel/BEET mode templates in outbound policies (Tobias Brunner)   
  - cpupower: Make TSC read per CPU for Mperf monitor (Wyes Karny)   
  - mfd: dln2: Fix memory leak in dln2_probe() (Qiang Ning)   
  - phy: st: miphy28lp: use _poll_timeout functions for waits (Alain Volmat)   
  - Input: xpad - add constants for GIP interface numbers (Vicki Pfau)   
  - clk: tegra20: fix gcc-7 constant overflow warning (Arnd Bergmann)   
  - recordmcount: Fix memory leaks in the uwrite function (Hao Zeng)   
  - sched: Fix KCSAN noinstr violation (Josh Poimboeuf)   
  - mcb-pci: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - serial: 8250: Reinit port->pm on port specific driver unbind (Tony Lindgren)   
  - HID: wacom: generic: Set battery quirk only when we see battery data (Jason Gerecke)   
  - spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 (Kevin Groeneveld)   
  - HID: logitech-hidpp: Reconcile USB and Unifying serials (Bastien Nocera)   
  - HID: logitech-hidpp: Don't use the USB serial for USB devices (Bastien Nocera)   
  - staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE (Philipp Hortmann)   
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (Min Li)   
  - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (Hans de Goede)   
  - ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() (Ojaswin Mujoo)   
  - ext4: set goal start correctly in ext4_mb_normalize_request (Kemeng Shi)   
  - gfs2: Fix inode height consistency check (Andreas Gruenbacher)   
  - scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition (Zheng Wang)   
  - lib: cpu_rmap: Avoid use after free on rmap->obj array entries (Eli Cohen)   
  - net: Catch invalid index in XPS mapping (Nick Child)   
  - net: pasemi: Fix return type of pasemi_mac_start_tx() (Nathan Chancellor)   
  - ext2: Check block size validity during mount (Jan Kara)   
  - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex (Hector Martin)   
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects (void0red)   
  - ACPICA: Avoid undefined behavior: applying zero offset to null pointer (Tamir Duberstein)   
  - drm/tegra: Avoid potential 32-bit integer overflow (Nur Hussein)   
  - ACPI: EC: Fix oops when removing custom query handlers (Armin Wolf)   
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang)   
  - regmap: cache: Return error in cache sync operations for REGCACHE_NONE (Alexander Stein)   
  - fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() (Tetsuo Handa)   
  - af_unix: Fix a data race of sk->sk_receive_queue->qlen. (Kuniyuki Iwashima)   
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (t.feng)   
  - net: annotate sk->sk_err write from do_recvmmsg() (Eric Dumazet)   
  - netlink: annotate accesses to nlk->cb_running (Eric Dumazet)   
  - net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). (Kuniyuki Iwashima)   
  - LTS version: v4.14.315 (Saeed Mirzamohammadi)   
  - mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock (Tetsuo Handa)   
  - printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h (Tetsuo Handa)   
  - drbd: correctly submit flush bio on barrier (Christoph Böhmwalder)   
  - serial: 8250: Fix serial8250_tx_empty() race with DMA Tx (Ilpo Järvinen)   
  - tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH (Ilpo Järvinen)   
  - perf bench: Share some global variables to fix build with gcc 10 (Arnaldo Carvalho de Melo)   
  - ext4: fix invalid free tracking in ext4_xattr_move_to_block() (Theodore Ts'o)   
  - ext4: remove a BUG_ON in ext4_mb_release_group_pa() (Theodore Ts'o)   
  - ext4: bail out of ext4_xattr_ibody_get() fails for any reason (Theodore Ts'o)   
  - ext4: add bounds checking in get_max_inline_xattr_value_size() (Theodore Ts'o)   
  - ext4: improve error recovery code paths in __ext4_remount() (Theodore Ts'o)   
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus)   
  - HID: wacom: Set a default resolution for older tablets (Ping Cheng)   
  - ARM: dts: s5pv210: correct MIPI CSIS clock name (Krzysztof Kozlowski)   
  - ARM: dts: exynos: fix WM8960 clock name in Itop Elite (Krzysztof Kozlowski)   
  - sh: nmi_debug: fix return value of __setup handler (Randy Dunlap)   
  - sh: math-emu: fix macro redefined warning (Randy Dunlap)   
  - cifs: fix pcchunk length type in smb2_copychunk_range (Pawel Witek)   
  - btrfs: print-tree: parent bytenr must be aligned to sector size (Anastasia Belova)   
  - btrfs: fix btrfs_prev_leaf() to not return the same key twice (Filipe Manana)   
  - perf symbols: Fix return incorrect build_id size in elf_read_build_id() (Yang Jihong)   
  - perf map: Delete two variable initialisations before null pointer checks in sort__sym_from_cmp() (Markus Elfring)   
  - perf vendor events power9: Remove UTF-8 characters from JSON files (Kajol Jain)   
  - ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init` (Ruliang Lin)   
  - af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). (Kuniyuki Iwashima)   
  - net/sched: act_mirred: Add carrier check (Victor Nogueira)   
  - writeback: fix call of incorrect macro (Maxim Korotkov)   
  - sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() (Cong Wang)   
  - netfilter: nf_tables: deactivate anonymous set from preparation phase (Pablo Neira Ayuso)   
  - netfilter: nf_tables: bogus EBUSY when deleting set after flush (Pablo Neira Ayuso)   
  - netfilter: nf_tables: use-after-free in failing rule with bound set (Pablo Neira Ayuso)   
  - netfilter: nft_hash: fix nft_hash_deactivate (Pablo Neira Ayuso)   
  - netfilter: nf_tables: unbind set in rule from commit path (Pablo Neira Ayuso)   
  - netfilter: nf_tables: split set destruction in deactivate and destroy phase (Florian Westphal)   
  - perf auxtrace: Fix address filter entire kernel size (Adrian Hunter)   
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern (Mike Snitzer)   
  - dm flakey: fix a crash with invalid table line (Mikulas Patocka)   
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (Mike Snitzer)   
  - s390/dasd: fix hanging blockdevice after request requeue (Stefan Haberland)   
  - btrfs: scrub: reject unsupported scrub flags (Qu Wenruo)   
  - clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent (Quentin Schulz)   
  - wifi: rtl8xxxu: RTL8192EU always needs full init (Bitterblue Smith)   
  - nilfs2: fix infinite loop in nilfs_mdt_get_block() (Ryusuke Konishi)   
  - nilfs2: do not write dirty data after degenerating to read-only (Ryusuke Konishi)   
  - parisc: Fix argument pointer in real64_call_asm() (Helge Deller)   
  - dmaengine: at_xdmac: do not enable all cyclic channels (Claudiu Beznea)   
  - phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port (Gaosheng Cui)   
  - NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease (Trond Myklebust)   
  - IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order (Patrick Kelsey)   
  - clk: add missing of_node_put() in "assigned-clocks" property parsing (Clément Léger)   
  - power: supply: generic-adc-battery: fix unit scaling (Sebastian Reichel)   
  - RDMA/rdmavt: Delete unnecessary NULL check (Natalia Petrova)   
  - perf/core: Fix hardlockup failure caused by perf throttle (Yang Jihong)   
  - powerpc/rtas: use memmove for potentially overlapping buffer copy (Nathan Lynch)   
  - macintosh: via-pmu-led: requires ATA to be set (Randy Dunlap)   
  - powerpc/sysdev/tsi108: fix resource printk format warnings (Randy Dunlap)   
  - powerpc/wii: fix resource printk format warnings (Randy Dunlap)   
  - powerpc/mpc512x: fix resource printk format warning (Randy Dunlap)   
  - macintosh/windfarm_smu_sat: Add missing of_node_put() (Liang He)   
  - spmi: Add a check for remove callback when removing a SPMI driver (Jishnu Prakash)   
  - staging: rtl8192e: Fix W_DISABLE# does not work after stop/start (Philipp Hortmann)   
  - serial: 8250: Add missing wakeup event reporting (Florian Fainelli)   
  - tty: serial: fsl_lpuart: adjust buffer length to the intended size (Shenwei Wang)   
  - usb: chipidea: fix missing goto in `ci_hdrc_probe` (Yinhao Hu)   
  - sh: sq: Fix incorrect element size for allocating bitmap buffer (John Paul Adrian Glaubitz)   
  - uapi/linux/const.h: prefer ISO-friendly __typeof__ (Saeed Mirzamohammadi)   
  - ia64: mm/contig: fix section mismatch warning/error (Randy Dunlap)   
  - of: Fix modalias string generation (Miquel Raynal)   
  - spi: fsl-spi: Fix CPM/QE mode Litte Endian (Christophe Leroy)   
  - linux/vt_buffer.h: allow either builtin or modular for macros (Randy Dunlap)   
  - pstore: Revert pmsg_lock back to a normal mutex (John Stultz)   
  - tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (Kuniyuki Iwashima)   
  - net: amd: Fix link leak when verifying config failed (Gencen Gan)   
  - ipv4: Fix potential uninit variable access bug in __ip_make_skb() (Ziyang Xuan)   
  - ixgbe: Enable setting RSS table to default values (Joe Damato)   
  - ixgbe: Allow flow hash to be set via ethtool (Joe Damato)   
  - wifi: iwlwifi: mvm: check firmware response size (Johannes Berg)   
  - wifi: iwlwifi: make the loop for card preparation effective (Emmanuel Grumbach)   
  - md/raid10: fix leak of 'r10bio->remaining' for recovery (Yu Kuai)   
  - scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS (Danila Chernetsov)   
  - scsi: target: iscsit: Fix TAS handling during conn cleanup (Mike Christie)   
  - net/packet: convert po->auxdata to an atomic flag (Eric Dumazet)   
  - net/packet: convert po->origdev to an atomic flag (Eric Dumazet)   
  - vlan: partially enable SIOCSHWTSTAMP in container (Vadim Fedorenko)   
  - scm: fix MSG_CTRUNC setting condition for SO_PASSSEC (Alexander Mikhalitsyn)   
  - wifi: ath6kl: reduce WARN to dev_dbg() in callback (Fedor Pchelkin)   
  - wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() (Dan Carpenter)   
  - wifi: ath6kl: minor fix for allocation size (Alexey V. Vissarionov)   
  - arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step (Sumit Garg)   
  - x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() (Saurabh Sengar)   
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (Zheng Wang)   
  - x86/apic: Fix atomic update of offset in reserve_eilvt_offset() (Uros Bizjak)   
  - media: av7110: prevent underflow in write_ts_to_decoder() (Dan Carpenter)   
  - media: bdisp: Add missing check for create_workqueue (Jiasheng Jiang)   
  - drm/probe-helper: Cancel previous job before starting new one (Dom Cobley)   
  - drm/vgem: add missing mutex_destroy (Maíra Canal)   
  - drm/rockchip: Drop unbalanced obj unref (Rob Clark)   
  - selinux: ensure av_permissions.h is built when needed (Paul Moore)   
  - selinux: fix Makefile dependencies of flask.h (Ondrej Mosnacek)   
  - ubifs: Free memory for tmpfile name (Mårten Lindahl)   
  - ubi: Fix return value overwrite issue in try_write_vid_and_data() (Wang YanQing)   
  - i2c: omap: Fix standard mode false ACK readings (Reid Tonking)   
  - reiserfs: Add security prefix to xattr name in reiserfs_security_write() (Roberto Sassu)   
  - ring-buffer: Sync IRQ works before buffer destruction (Johannes Berg)   
  - MIPS: fw: Allow firmware to pass a empty env (Jiaxun Yang)   
  - staging: iio: resolver: ads1210: fix config mode (Nuno Sá)   
  - perf sched: Cast PTHREAD_STACK_MIN to int as it may turn into sysconf(__SC_THREAD_STACK_MIN_VALUE) (Arnaldo Carvalho de Melo)   
  - USB: dwc3: fix runtime pm imbalance on unbind (Johan Hovold)   
  - iio: adc: palmas_gpadc: fix NULL dereference on rmmod (Patrik Dahlström)   
  - USB: serial: option: add UNISOC vendor and TOZED LT70C product (Arınç ÜNAL)   
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ruihan Li)   
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (Jisoo Jang)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.528.1.el7uek]
changelog:
  - LTS version: v4.14.320 (Saeed Mirzamohammadi)   
  - i2c: imx-lpi2c: fix type char overflow issue when calculating the clock cycle (Clark Wang)   
  - x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys (Dheeraj Kumar Srivastava)   
  - drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl (Min Li)   
  - drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl (Min Li)   
  - drm/exynos: vidi: fix a wrong error return (Inki Dae)   
  - s390/cio: unregister device when the only path is gone (Vineeth Vijayan)   
  - usb: gadget: udc: fix NULL dereference in remove() (Dan Carpenter)   
  - fbdev: imsttfb: Release framebuffer and dealloc cmap on error path (Helge Deller)   
  - nfcsim.c: Fix error checking for debugfs_create_dir (Osama Muhammad)   
  - arm64: Add missing Set/Way CMO encodings (Marc Zyngier)   
  - HID: wacom: Add error check to wacom_parse_and_register() (Denis Arefev)   
  - scsi: target: iscsi: Prevent login threads from racing between each other (Maurizio Lombardi)   
  - netfilter: nf_tables: disallow element updates of bound anonymous sets (Pablo Neira Ayuso)   
  - be2net: Extend xmit workaround to BE3 chip (Ross Lagerwall)   
  - mmc: usdhi60rol0: fix deferred probing (Sergey Shtylyov)   
  - mmc: omap_hsmmc: fix deferred probing (Sergey Shtylyov)   
  - mmc: omap: fix deferred probing (Sergey Shtylyov)   
  - mmc: mtk-sd: fix deferred probing (Sergey Shtylyov)   
  - net: qca_spi: Avoid high load if QCA7000 is not available (Stefan Wahren)   
  - xfrm: Linearize the skb after offloading if needed. (Sebastian Andrzej Siewior)   
  - nilfs2: prevent general protection fault in nilfs_clear_dirty_page() (Ryusuke Konishi)   
  - cgroup: Do not corrupt task iteration when rebinding subsystem (Xiu Jianfeng)   
  - Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs (Michael Kelley)   
  - nilfs2: fix buffer corruption due to concurrent device reads (Ryusuke Konishi)   
  - nilfs2: reject devices with insufficient block count (Ryusuke Konishi)   
  - serial: lantiq: add missing interrupt ack (Bernhard Seibold)   
  - LTS version: v4.14.319 (Saeed Mirzamohammadi)   
  - mmc: block: ensure error propagation for non-blk (Christian Loehle)   
  - powerpc: Fix defconfig choice logic when cross compiling (Michael Ellerman)   
  - neighbour: delete neigh_lookup_nodev as not used (Leon Romanovsky)   
  - neighbour: Remove unused inline function neigh_key_eq16() (Gaosheng Cui)   
  - selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET (Alex Maftei)   
  - net: tipc: resize nlattr array to correct size (Lin Ma)   
  - net: lapbether: only support ethernet devices (Eric Dumazet)   
  - drm/nouveau/dp: check for NULL nv_connector->native_mode (Natalia Petrova)   
  - igb: fix nvm.ops.read() error handling (Aleksandr Loktionov)   
  - sctp: fix an error code in sctp_sf_eat_auth() (Dan Carpenter)   
  - IB/isert: Fix incorrect release of isert connection (Saravanan Vajravel)   
  - IB/isert: Fix possible list corruption in CMA handler (Saravanan Vajravel)   
  - IB/isert: Fix dead lock in ib_isert (Saravanan Vajravel)   
  - ping6: Fix send to link-local addresses with VRF. (Guillaume Nault)   
  - netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM (Pablo Neira Ayuso)   
  - USB: serial: option: add Quectel EM061KGL series (Jerry Meng)   
  - Remove DECnet support from kernel (Stephen Hemminger)   
  - net: usb: qmi_wwan: add support for Compal RXM-G1 (Wes Huang)   
  - nilfs2: fix possible out-of-bounds segment allocation in resize ioctl (Ryusuke Konishi)   
  - nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() (Ryusuke Konishi)   
  - nios2: dts: Fix tse_mac "max-frame-size" property (Janne Grunau)   
  - ocfs2: check new file size on fallocate call (Luís Henriques)   
  - ocfs2: fix use-after-free when unmounting read-only filesystem (Luís Henriques)   
  - xen/blkfront: Only check REQ_FUA for writes (Ross Lagerwall)   
  - mips: Move initrd_start check after initrd address sanitisation. (Liviu Dudau)   
  - MIPS: Alchemy: fix dbdma2 (Manuel Lauss)   
  - power: supply: Fix logic checking if system is running from battery (Mario Limonciello)   
  - regulator: Fix error checking for debugfs_create_dir (Osama Muhammad)   
  - power: supply: Ratelimit no data debug output (Marek Vasut)   
  - ARM: dts: vexpress: add missing cache properties (Krzysztof Kozlowski)   
  - power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule() (Hans de Goede)   
  - power: supply: ab8500: Fix external_power_changed race (Hans de Goede)   
  - LTS version: v4.14.318 (Saeed Mirzamohammadi)   
  - btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (Zixuan Fu)   
  - btrfs: check return value of btrfs_commit_transaction in relocation (Josef Bacik)   
  - ext4: only check dquot_initialize_needed() when debugging (Theodore Ts'o)   
  - i2c: sprd: Delete i2c adapter in .remove's error path (Uwe Kleine-König)   
  - Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk (Luiz Augusto von Dentz)   
  - ceph: fix use-after-free bug for inodes when flushing capsnaps (Xiubo Li)   
  - drm/amdgpu: fix xclk freq on CHIP_STONEY (Chia-I Wu)   
  - Input: psmouse - fix OOB access in Elantech protocol (Dmitry Torokhov)   
  - Input: xpad - delete a Razer DeathAdder mouse VID/PID entry (Ismael Ferreras Morezuelas)   
  - batman-adv: Broken sync while rescheduling delayed work (Vladislav Efanov)   
  - bnxt_en: Query default VLAN before VNIC setup on a VF (Somnath Kotur)   
  - net: sched: move rtm_tca_policy declaration to include file (Eric Dumazet)   
  - rfs: annotate lockless accesses to RFS sock flow table (Eric Dumazet)   
  - rfs: annotate lockless accesses to sk->sk_rxhash (Eric Dumazet)   
  - Bluetooth: L2CAP: Add missing checks for invalid DCID (Sungwoo Kim)   
  - Bluetooth: Fix l2cap_disconnect_req deadlock (Ying Hsu)   
  - spi: qup: Request DMA before enabling clocks (Stephan Gerhold)   
  - i40e: fix build warnings in i40e_alloc.h (Greg Kroah-Hartman)   
  - i40iw: fix build warning in i40iw_manage_apbvt() (Greg Kroah-Hartman)   
  - LTS version: v4.14.317 (Saeed Mirzamohammadi)   
  - wifi: rtlwifi: 8192de: correct checking of IQK reload (Ping-Ke Shih)   
  - Fix double fget() in vhost_net_set_backend() (Al Viro)   
  - net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize (Tudor Ambarus)   
  - cdc_ncm: Fix the build warning (Alexander Bersenev)   
  - cdc_ncm: Implement the 32-bit version of NCM Transfer Block (Alexander Bersenev)   
  - scsi: dpt_i2o: Do not process completions with invalid addresses (Ben Hutchings)   
  - scsi: dpt_i2o: Remove broken pass-through ioctl (I2OUSERCMD) (Ben Hutchings)   
  - fbcon: Fix null-ptr-deref in soft_cursor (Helge Deller)   
  - ext4: add lockdep annotations for i_data_sem for ea_inode's (Theodore Ts'o)   
  - tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK (Sherry Sun)   
  - mmc: vub300: fix invalid response handling (Deren Wu)   
  - regulator: da905{2,5}: Remove unnecessary array check (Nathan Chancellor)   
  - wifi: rtlwifi: remove always-true condition pointed out by GCC 12 (Jakub Kicinski)   
  - lib/dynamic_debug.c: use address-of operator on section symbols (Nathan Chancellor)   
  - kernel/extable.c: use address-of operator on section symbols (Nathan Chancellor)   
  - eth: sun: cassini: remove dead code (Martin Liška)   
  - gcc-12: disable '-Wdangling-pointer' warning for now (Linus Torvalds)   
  - ACPI: thermal: drop an always true check (Adam Borowski)   
  - x86/boot: Wrap literal addresses in absolute_pointer() (Kees Cook)   
  - ata: libata-scsi: Use correct device no in ata_find_dev() (Damien Le Moal)   
  - scsi: stex: Fix gcc 13 warnings (Bart Van Assche)   
  - usb: gadget: f_fs: Add unbind event before functionfs_unbind (Uttkarsh Aggarwal)   
  - net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818 (Sebastian Krzyszkowiak)   
  - iio: dac: mcp4725: Fix i2c_master_send() return value handling (Marek Vasut)   
  - HID: wacom: avoid integer overflow in wacom_intuos_inout() (Nikita Zhandarovich)   
  - iio: adc: mxs-lradc: fix the order of two cleanup operations (Jiakai Luo)   
  - mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() (Dan Carpenter)   
  - atm: hide unused procfs functions (Arnd Bergmann)   
  - ALSA: oss: avoid missing-prototype warnings (Arnd Bergmann)   
  - netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT (Tom Rix)   
  - wifi: b43: fix incorrect __packed annotation (Arnd Bergmann)   
  - scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed (Wenchao Hao)   
  - wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value (Yun Lu)   
  - media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 (Hyunwoo Kim)   
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (Takashi Iwai)   
  - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() (Hyunwoo Kim)   
  - media: netup_unidvb: fix irq init by register it at the end of probe (Wei Chen)   
  - media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address (Wei Chen)   
  - media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer() (Wei Chen)   
  - media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer (Zhang Shurong)   
  - media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer() (Wei Chen)   
  - media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer() (Wei Chen)   
  - media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() (Wei Chen)   
  - ASoC: ssm2602: Add workaround for playback distortions (Paweł Anikiel)   
  - ASoC: dwc: limit the number of overrun messages (Maxim Kochetkov)   
  - nbd: Fix debugfs_create_dir error checking (Ivan Orlov)   
  - fbdev: stifb: Fix info entry in sti_struct on error path (Helge Deller)   
  - fbdev: modedb: Add 1920x1080 at 60 Hz video mode (Helge Deller)   
  - ARM: 9295/1: unwind:fix unwind abort for uleb128 case (Haibo Li)   
  - mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() (Lee Jones)   
  - net: dsa: mv88e6xxx: Increase wait after reset deactivation (Andreas Svensson)   
  - udp6: Fix race condition in udp6_sendmsg & connect (Vladislav Efanov)   
  - tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set (Cambda Zhu)   
  - af_packet: do not use READ_ONCE() in packet_bind() (Eric Dumazet)   
  - af_packet: Fix data-races of pkt_sk(sk)->num. (Kuniyuki Iwashima)   
  - netrom: fix info-leak in nr_write_internal() (Eric Dumazet)   
  - dmaengine: pl330: rename _start to prevent build error (Randy Dunlap)   
  - bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() (Ruihan Li)   
  - ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg (Cezary Rojewski)   
  - power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize (Hans de Goede)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.528.2.1.el7uek]
changelog:
  - uek-rpm: Disable cls_tcindex in file tcindex-disable.conf (Sherry Yang)  [Orabug: 35698204]  
  - x86/microcode/AMD: Clean up per-family patch size checks (Borislav Petkov)  [Orabug: 35698200]  
  - Revert "sched/fair: sanitize vruntime of entity being placed" (Saeed Mirzamohammadi)  [Orabug: 35698196]  
  - Revert "sched/fair: Sanitize vruntime of entity being migrated" (Saeed Mirzamohammadi)  [Orabug: 35698196]  
  - uek-rpm: Update kernel's linux-firmware dependency. (Somasundaram Krishnasamy)  [Orabug: 35698191]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.528.2.2.el7uek]
changelog:
  - xfs: reserve less log space when recovering log intent items (Darrick J. Wong)  [Orabug: 35905454]  
  - xfs: reserve blocks for refcount / rmap log item recovery (Darrick J. Wong)  [Orabug: 35905454]  
  - ocfs2: ocfs2 crash due to invalid h_next_leaf_blk value in extent block (Gautham Ananthakrishna)  [Orabug: 35905446]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.528.2.3.el7uek]
changelog:
  - bnxt_en: fix NULL dereference in bnxt_flash_package_from_file() (Samasth Norway Ananda)  [Orabug: 36201748]


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.528.2.4.el7uek]
changelog:
  - scsi: megaraid_sas: Correct value passed to scsi_device_lookup() (Guixin Liu)  [Orabug: 36345482]  
  - scsi: megaraid_sas: Update max supported LD IDs to 240 (Chandrakanth Patil)  [Orabug: 36345456]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.529.1.el7uek]
changelog:
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (George Kennedy)  [Orabug: 35649492]  {CVE-2023-3567} 
  - ocfs2: always read both high and low parts of dinode link count (Alexey Asemov)  [Orabug: 35643004]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.529.2.el7uek]
changelog:
  - x86/cpu: persist X86_FEATURE_NT_GOOD for late reload (Ankur Arora)  [Orabug: 35693947]  
  - uek-rpm: Disable cls_tcindex in file tcindex-disable.conf (Sherry Yang)  [Orabug: 35678739]  
  - uek-rpm: Update kernel's linux-firmware dependency. (Somasundaram Krishnasamy)  [Orabug: 35678693]  
  - Revert "sched/fair: sanitize vruntime of entity being placed" (Saeed Mirzamohammadi)  [Orabug: 35651310]  
  - Revert "sched/fair: Sanitize vruntime of entity being migrated" (Saeed Mirzamohammadi)  [Orabug: 35651310]  
  - x86/microcode/AMD: Clean up per-family patch size checks (Borislav Petkov)  [Orabug: 35643967]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.527.1.el7uek]
changelog:
  - mips64: Enable CRYPTO_USER_API_SKCIPHER config (Vijay Kumar)  [Orabug: 35458816]  
  - net/rds: Fix copy&paste error (Gerd Rausch)  [Orabug: 35416949]  
  - uek-rpm: Blacklist cls_tcindex module (Somasundaram Krishnasamy)  [Orabug: 35408336]  
  - LTS version: v4.14.316 (Saeed Mirzamohammadi)   
  - 3c589_cs: Fix an error handling path in tc589_probe() (Christophe JAILLET)   
  - forcedeth: Fix an error handling path in nv_probe() (Christophe JAILLET)   
  - x86/show_trace_log_lvl: Ensure stack pointer is aligned, again (Vernon Lovejoy)   
  - xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() (Dan Carpenter)   
  - power: supply: sbs-charger: Fix INHIBITED bit for Status reg (Daisuke Nojiri)   
  - power: supply: bq27xxx: Fix poll_interval handling and races on remove (Hans de Goede)   
  - power: supply: bq27xxx: Fix I2C IRQ race on remove (Hans de Goede)   
  - power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition (Hans de Goede)   
  - power: supply: leds: Fix blink to LED on transition (Hans de Goede)   
  - ipv6: Fix out-of-bounds access in ipv6_find_tlv() (Gavrilov Ilia)   
  - net: fix skb leak in __skb_tstamp_tx() (Pratyush Yadav)   
  - media: radio-shark: Add endpoint checks (Alan Stern)   
  - USB: sisusbvga: Add endpoint checks (Alan Stern)   
  - x86/mm: Avoid incomplete Global INVLPG flushes (Saeed Mirzamohammadi)   
  - USB: core: Add routines for endpoint checks in old drivers (Alan Stern)   
  - selftests/memfd: Fix unknown type name build failure (Hardik Garg)   
  - netfilter: nf_tables: fix register ordering (Florian Westphal)   
  - netfilter: nf_tables: do not allow SET_ID to refer to another table (Pablo Neira Ayuso)   
  - netfilter: nf_tables: do not allow RULE_ID to refer to another chain (Pablo Neira Ayuso)   
  - netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL (Pablo Neira Ayuso)   
  - netfilter: nf_tables: stricter validation of element data (Pablo Neira Ayuso) [Orabug: 34362007] {CVE-2022-34918}
  - netfilter: nf_tables: allow up to 64 bytes in the set element data area (Pablo Neira Ayuso)   
  - netfilter: nf_tables: add nft_setelem_parse_key() (Pablo Neira Ayuso)   
  - netfilter: nf_tables: validate registers coming from userspace. (Pablo Neira Ayuso) [Orabug: 34012908] {CVE-2022-1015}
  - netfilter: nftables: statify nft_parse_register() (Pablo Neira Ayuso)   
  - netfilter: nftables: add nft_parse_register_store() and use it (Pablo Neira Ayuso)   
  - netfilter: nftables: add nft_parse_register_load() and use it (Pablo Neira Ayuso)   
  - parisc: Allow to reboot machine after system halt (Helge Deller)   
  - m68k: Move signal frame following exception on 68020/030 (Finn Thain)   
  - spi: fsl-cpm: Use 16 bit mode for large transfers with even size (Christophe Leroy)   
  - spi: fsl-spi: Re-organise transfer bits_per_word adaptation (Christophe Leroy)   
  - spi: spi-fsl-spi: automatically adapt bits-per-word in cpu mode (Rasmus Villemoes)   
  - netfilter: nf_tables: bogus EBUSY in helper removal from transaction (Pablo Neira Ayuso)   
  - nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() (Ryusuke Konishi)   
  - ceph: force updating the msg pointer in non-split case (Xiubo Li)   
  - serial: Add support for Advantech PCI-1611U card (Vitaliy Tomin)   
  - statfs: enforce statfs[64] structure initialization (Ilya Leoshkevich)   
  - ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table (Nikhil Mahale)   
  - ALSA: hda: Fix Oops by 9.1 surround channel names (Takashi Iwai)   
  - usb-storage: fix deadlock when a scsi command timeouts more than once (Maxime Bizon)   
  - vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() (Eric Dumazet)   
  - igb: fix bit_shift to be in [1..8] range (Aleksandr Loktionov)   
  - cassini: Fix a memory leak in the error handling path of cas_init_one() (Christophe JAILLET)   
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Dong Chenchen)   
  - media: netup_unidvb: fix use-after-free at del_timer() (Duoming Zhou)   
  - vsock: avoid to close connected socket after the timeout (Zhuang Shengen)   
  - net: fec: Better handle pm_runtime_get() failing in .remove() (Uwe Kleine-König)   
  - af_key: Reject optional tunnel/BEET mode templates in outbound policies (Tobias Brunner)   
  - cpupower: Make TSC read per CPU for Mperf monitor (Wyes Karny)   
  - mfd: dln2: Fix memory leak in dln2_probe() (Qiang Ning)   
  - phy: st: miphy28lp: use _poll_timeout functions for waits (Alain Volmat)   
  - Input: xpad - add constants for GIP interface numbers (Vicki Pfau)   
  - clk: tegra20: fix gcc-7 constant overflow warning (Arnd Bergmann)   
  - recordmcount: Fix memory leaks in the uwrite function (Hao Zeng)   
  - sched: Fix KCSAN noinstr violation (Josh Poimboeuf)   
  - mcb-pci: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - serial: 8250: Reinit port->pm on port specific driver unbind (Tony Lindgren)   
  - HID: wacom: generic: Set battery quirk only when we see battery data (Jason Gerecke)   
  - spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 (Kevin Groeneveld)   
  - HID: logitech-hidpp: Reconcile USB and Unifying serials (Bastien Nocera)   
  - HID: logitech-hidpp: Don't use the USB serial for USB devices (Bastien Nocera)   
  - staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE (Philipp Hortmann)   
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (Min Li)   
  - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (Hans de Goede)   
  - ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() (Ojaswin Mujoo)   
  - ext4: set goal start correctly in ext4_mb_normalize_request (Kemeng Shi)   
  - gfs2: Fix inode height consistency check (Andreas Gruenbacher)   
  - scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition (Zheng Wang)   
  - lib: cpu_rmap: Avoid use after free on rmap->obj array entries (Eli Cohen)   
  - net: Catch invalid index in XPS mapping (Nick Child)   
  - net: pasemi: Fix return type of pasemi_mac_start_tx() (Nathan Chancellor)   
  - ext2: Check block size validity during mount (Jan Kara)   
  - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex (Hector Martin)   
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects (void0red)   
  - ACPICA: Avoid undefined behavior: applying zero offset to null pointer (Tamir Duberstein)   
  - drm/tegra: Avoid potential 32-bit integer overflow (Nur Hussein)   
  - ACPI: EC: Fix oops when removing custom query handlers (Armin Wolf)   
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang)   
  - regmap: cache: Return error in cache sync operations for REGCACHE_NONE (Alexander Stein)   
  - fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() (Tetsuo Handa)   
  - af_unix: Fix a data race of sk->sk_receive_queue->qlen. (Kuniyuki Iwashima)   
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (t.feng)   
  - net: annotate sk->sk_err write from do_recvmmsg() (Eric Dumazet)   
  - netlink: annotate accesses to nlk->cb_running (Eric Dumazet)   
  - net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). (Kuniyuki Iwashima)   
  - LTS version: v4.14.315 (Saeed Mirzamohammadi)   
  - mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock (Tetsuo Handa)   
  - printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h (Tetsuo Handa)   
  - drbd: correctly submit flush bio on barrier (Christoph Böhmwalder)   
  - serial: 8250: Fix serial8250_tx_empty() race with DMA Tx (Ilpo Järvinen)   
  - tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH (Ilpo Järvinen)   
  - perf bench: Share some global variables to fix build with gcc 10 (Arnaldo Carvalho de Melo)   
  - ext4: fix invalid free tracking in ext4_xattr_move_to_block() (Theodore Ts'o)   
  - ext4: remove a BUG_ON in ext4_mb_release_group_pa() (Theodore Ts'o)   
  - ext4: bail out of ext4_xattr_ibody_get() fails for any reason (Theodore Ts'o)   
  - ext4: add bounds checking in get_max_inline_xattr_value_size() (Theodore Ts'o)   
  - ext4: improve error recovery code paths in __ext4_remount() (Theodore Ts'o)   
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus)   
  - HID: wacom: Set a default resolution for older tablets (Ping Cheng)   
  - ARM: dts: s5pv210: correct MIPI CSIS clock name (Krzysztof Kozlowski)   
  - ARM: dts: exynos: fix WM8960 clock name in Itop Elite (Krzysztof Kozlowski)   
  - sh: nmi_debug: fix return value of __setup handler (Randy Dunlap)   
  - sh: math-emu: fix macro redefined warning (Randy Dunlap)   
  - cifs: fix pcchunk length type in smb2_copychunk_range (Pawel Witek)   
  - btrfs: print-tree: parent bytenr must be aligned to sector size (Anastasia Belova)   
  - btrfs: fix btrfs_prev_leaf() to not return the same key twice (Filipe Manana)   
  - perf symbols: Fix return incorrect build_id size in elf_read_build_id() (Yang Jihong)   
  - perf map: Delete two variable initialisations before null pointer checks in sort__sym_from_cmp() (Markus Elfring)   
  - perf vendor events power9: Remove UTF-8 characters from JSON files (Kajol Jain)   
  - ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init` (Ruliang Lin)   
  - af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). (Kuniyuki Iwashima)   
  - net/sched: act_mirred: Add carrier check (Victor Nogueira)   
  - writeback: fix call of incorrect macro (Maxim Korotkov)   
  - sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() (Cong Wang)   
  - netfilter: nf_tables: deactivate anonymous set from preparation phase (Pablo Neira Ayuso)   
  - netfilter: nf_tables: bogus EBUSY when deleting set after flush (Pablo Neira Ayuso)   
  - netfilter: nf_tables: use-after-free in failing rule with bound set (Pablo Neira Ayuso)   
  - netfilter: nft_hash: fix nft_hash_deactivate (Pablo Neira Ayuso)   
  - netfilter: nf_tables: unbind set in rule from commit path (Pablo Neira Ayuso)   
  - netfilter: nf_tables: split set destruction in deactivate and destroy phase (Florian Westphal)   
  - perf auxtrace: Fix address filter entire kernel size (Adrian Hunter)   
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern (Mike Snitzer)   
  - dm flakey: fix a crash with invalid table line (Mikulas Patocka)   
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (Mike Snitzer)   
  - s390/dasd: fix hanging blockdevice after request requeue (Stefan Haberland)   
  - btrfs: scrub: reject unsupported scrub flags (Qu Wenruo)   
  - clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent (Quentin Schulz)   
  - wifi: rtl8xxxu: RTL8192EU always needs full init (Bitterblue Smith)   
  - nilfs2: fix infinite loop in nilfs_mdt_get_block() (Ryusuke Konishi)   
  - nilfs2: do not write dirty data after degenerating to read-only (Ryusuke Konishi)   
  - parisc: Fix argument pointer in real64_call_asm() (Helge Deller)   
  - dmaengine: at_xdmac: do not enable all cyclic channels (Claudiu Beznea)   
  - phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port (Gaosheng Cui)   
  - NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease (Trond Myklebust)   
  - IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order (Patrick Kelsey)   
  - clk: add missing of_node_put() in "assigned-clocks" property parsing (Clément Léger)   
  - power: supply: generic-adc-battery: fix unit scaling (Sebastian Reichel)   
  - RDMA/rdmavt: Delete unnecessary NULL check (Natalia Petrova)   
  - perf/core: Fix hardlockup failure caused by perf throttle (Yang Jihong)   
  - powerpc/rtas: use memmove for potentially overlapping buffer copy (Nathan Lynch)   
  - macintosh: via-pmu-led: requires ATA to be set (Randy Dunlap)   
  - powerpc/sysdev/tsi108: fix resource printk format warnings (Randy Dunlap)   
  - powerpc/wii: fix resource printk format warnings (Randy Dunlap)   
  - powerpc/mpc512x: fix resource printk format warning (Randy Dunlap)   
  - macintosh/windfarm_smu_sat: Add missing of_node_put() (Liang He)   
  - spmi: Add a check for remove callback when removing a SPMI driver (Jishnu Prakash)   
  - staging: rtl8192e: Fix W_DISABLE# does not work after stop/start (Philipp Hortmann)   
  - serial: 8250: Add missing wakeup event reporting (Florian Fainelli)   
  - tty: serial: fsl_lpuart: adjust buffer length to the intended size (Shenwei Wang)   
  - usb: chipidea: fix missing goto in `ci_hdrc_probe` (Yinhao Hu)   
  - sh: sq: Fix incorrect element size for allocating bitmap buffer (John Paul Adrian Glaubitz)   
  - uapi/linux/const.h: prefer ISO-friendly __typeof__ (Saeed Mirzamohammadi)   
  - ia64: mm/contig: fix section mismatch warning/error (Randy Dunlap)   
  - of: Fix modalias string generation (Miquel Raynal)   
  - spi: fsl-spi: Fix CPM/QE mode Litte Endian (Christophe Leroy)   
  - linux/vt_buffer.h: allow either builtin or modular for macros (Randy Dunlap)   
  - pstore: Revert pmsg_lock back to a normal mutex (John Stultz)   
  - tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (Kuniyuki Iwashima)   
  - net: amd: Fix link leak when verifying config failed (Gencen Gan)   
  - ipv4: Fix potential uninit variable access bug in __ip_make_skb() (Ziyang Xuan)   
  - ixgbe: Enable setting RSS table to default values (Joe Damato)   
  - ixgbe: Allow flow hash to be set via ethtool (Joe Damato)   
  - wifi: iwlwifi: mvm: check firmware response size (Johannes Berg)   
  - wifi: iwlwifi: make the loop for card preparation effective (Emmanuel Grumbach)   
  - md/raid10: fix leak of 'r10bio->remaining' for recovery (Yu Kuai)   
  - scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS (Danila Chernetsov)   
  - scsi: target: iscsit: Fix TAS handling during conn cleanup (Mike Christie)   
  - net/packet: convert po->auxdata to an atomic flag (Eric Dumazet)   
  - net/packet: convert po->origdev to an atomic flag (Eric Dumazet)   
  - vlan: partially enable SIOCSHWTSTAMP in container (Vadim Fedorenko)   
  - scm: fix MSG_CTRUNC setting condition for SO_PASSSEC (Alexander Mikhalitsyn)   
  - wifi: ath6kl: reduce WARN to dev_dbg() in callback (Fedor Pchelkin)   
  - wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() (Dan Carpenter)   
  - wifi: ath6kl: minor fix for allocation size (Alexey V. Vissarionov)   
  - arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step (Sumit Garg)   
  - x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() (Saurabh Sengar)   
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (Zheng Wang)   
  - x86/apic: Fix atomic update of offset in reserve_eilvt_offset() (Uros Bizjak)   
  - media: av7110: prevent underflow in write_ts_to_decoder() (Dan Carpenter)   
  - media: bdisp: Add missing check for create_workqueue (Jiasheng Jiang)   
  - drm/probe-helper: Cancel previous job before starting new one (Dom Cobley)   
  - drm/vgem: add missing mutex_destroy (Maíra Canal)   
  - drm/rockchip: Drop unbalanced obj unref (Rob Clark)   
  - selinux: ensure av_permissions.h is built when needed (Paul Moore)   
  - selinux: fix Makefile dependencies of flask.h (Ondrej Mosnacek)   
  - ubifs: Free memory for tmpfile name (Mårten Lindahl)   
  - ubi: Fix return value overwrite issue in try_write_vid_and_data() (Wang YanQing)   
  - i2c: omap: Fix standard mode false ACK readings (Reid Tonking)   
  - reiserfs: Add security prefix to xattr name in reiserfs_security_write() (Roberto Sassu)   
  - ring-buffer: Sync IRQ works before buffer destruction (Johannes Berg)   
  - MIPS: fw: Allow firmware to pass a empty env (Jiaxun Yang)   
  - staging: iio: resolver: ads1210: fix config mode (Nuno Sá)   
  - perf sched: Cast PTHREAD_STACK_MIN to int as it may turn into sysconf(__SC_THREAD_STACK_MIN_VALUE) (Arnaldo Carvalho de Melo)   
  - USB: dwc3: fix runtime pm imbalance on unbind (Johan Hovold)   
  - iio: adc: palmas_gpadc: fix NULL dereference on rmmod (Patrik Dahlström)   
  - USB: serial: option: add UNISOC vendor and TOZED LT70C product (Arınç ÜNAL)   
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ruihan Li)   
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (Jisoo Jang)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.529.3.el7uek]
changelog:
  - uek-rpm: Update kernel linux-firmware dependency to 20230516-999.26.git6c9e0ed5. (Somasundaram Krishnasamy)  [Orabug: 35724203]  
  - LTS version: v4.14.322 (Saeed Mirzamohammadi)   
  - drm/edid: fix objtool warning in drm_cvt_modes() (Linus Torvalds)   
  - mtd: rawnand: omap_elm: Fix incorrect type in assignment (Roger Quadros)   
  - test_firmware: fix a memory leak with reqs buffer (Mirsad Goran Todorovac)   
  - ext2: Drop fragment support (Jan Kara)   
  - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (Alan Stern)   
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Sungwoo Kim)   
  - fs/sysv: Null check to prevent null-ptr-deref bug (Prince Kumar Maurya)   
  - USB: zaurus: Add ID for A-300/B-500/C-700 (Ross Maynard)   
  - libceph: fix potential hang in ceph_osdc_notify() (Ilya Dryomov)   
  - loop: Select I/O scheduler 'none' from inside add_disk() (Bart Van Assche)   
  - tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_net (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_vals[] (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_lock (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_stamp (Eric Dumazet)   
  - tcp_metrics: fix addr_same() helper (Eric Dumazet)   
  - ip6mr: Fix skb_under_panic in ip6mr_cache_report() (Yue Haibing)   
  - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (valis)   
  - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (valis)   
  - net: add missing data-race annotation for sk_ll_usec (Eric Dumazet)   
  - net: add missing data-race annotations around sk->sk_peek_off (Eric Dumazet)   
  - perf test uprobe_from_different_cu: Skip if there is no gcc (Georg Müller)   
  - net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer() (Yuanjun Gong)   
  - word-at-a-time: use the same return type for has_zero regardless of endianness (ndesaulniers@google.com)   
  - perf: Fix function pointer case (Peter Zijlstra)   
  - net/sched: cls_u32: Fix reference counter leak leading to overflow (Lee Jones)   
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Pedro Tammela)   
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (M A Ramdhan)   
  - drm/client: Fix memory leak in drm_client_target_cloned (Jocelyn Falempe)   
  - dm cache policy smq: ensure IO doesn't prevent cleaner policy progress (Joe Thornber)   
  - ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register (Mark Brown)   
  - s390/dasd: fix hanging device after quiesce/resume (Stefan Haberland)   
  - irq-bcm6345-l1: Do not assume a fixed block to cpu mapping (Jonas Gorski)   
  - tpm_tis: Explicitly check for error code (Alexander Steffen)   
  - hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled (Gilles Buloz)   
  - staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() (Zhang Shurong)   
  - Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group (Greg Kroah-Hartman)   
  - usb: xhci-mtk: set the dma max_seg_size (Ricardo Ribalda)   
  - usb: ohci-at91: Fix the unhandle interrupt when resume (Guiting Shen)   
  - can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED (Marc Kleine-Budde)   
  - USB: serial: simple: sort driver entries (Johan Hovold)   
  - USB: serial: simple: add Kaufmann RKS+CAN VCP (Oliver Neukum)   
  - USB: serial: option: add Quectel EC200A module support (Mohsen Tahmasebi)   
  - USB: serial: option: support Quectel EM060K_128 (Jerry Meng)   
  - tracing: Fix warning in trace_buffered_event_disable() (Zheng Yejian)   
  - ring-buffer: Fix wrong stat of cpu_buffer->read (Zheng Yejian)   
  - ata: pata_ns87415: mark ns87560_tf_read static (Arnd Bergmann)   
  - dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (Yu Kuai)   
  - block: Fix a source code comment in include/uapi/linux/blkzoned.h (Bart Van Assche)   
  - ASoC: fsl_spdif: Silence output on stop (Matus Gajdos)   
  - benet: fix return value check in be_lancer_xmit_workarounds() (Yuanjun Gong)   
  - platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100 (Maxim Mikityanskiy)   
  - team: reset team's flags when down link is P2P device (Hangbin Liu)   
  - bonding: reset bond's flags when down link is P2P device (Hangbin Liu)   
  - tcp: Reduce chance of collisions in inet6_hashfn(). (Stewart Smith)   
  - ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address (Maciej Żenczykowski)   
  - ethernet: atheros: fix return value check in atl1e_tso_csum() (Yuanjun Gong)   
  - i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir() (Wang Ming)   
  - gpio: tps68470: Make tps68470_gpio_output() always set the initial value (Hans de Goede)   
  - tcp: annotate data-races around fastopenq.max_qlen (Eric Dumazet)   
  - tcp: annotate data-races around tp->notsent_lowat (Eric Dumazet)   
  - tcp: annotate data-races around rskq_defer_accept (Eric Dumazet)   
  - netfilter: nf_tables: fix spurious set element insertion failure (Florian Westphal)   
  - llc: Don't drop packet from non-root netns. (Kuniyuki Iwashima)   
  - fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe (Zhang Shurong)   
  - net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field() (Tanmay Patil)   
  - pinctrl: amd: Use amd_pinconf_set() for all config options (Mario Limonciello)   
  - fbdev: imxfb: warn about invalid left/right margin (Martin Kaiser)   
  - spi: bcm63xx: fix max prepend length (Jonas Gorski)   
  - igb: Fix igb_down hung on surprise removal (Ying Hsu)   
  - wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() (Gustavo A. R. Silva)   
  - bpf: Address KCSAN report on bpf_lru_list (Martin KaFai Lau)   
  - sched/fair: Don't balance task to its current running CPU (Yicong Yang)   
  - posix-timers: Ensure timer ID search-loop limit is valid (Saeed Mirzamohammadi)   
  - md/raid10: prevent soft lockup while flush writes (Yu Kuai)   
  - md: fix data corruption for raid456 when reshape restart while grow up (Yu Kuai)   
  - nbd: Add the maximum limit of allocated index in nbd_dev_add (Zhong Jinghua)   
  - debugobjects: Recheck debug_objects_enabled before reporting (Tetsuo Handa)   
  - ext4: correct inline offset when handling xattrs in inode body (Eric Whitney)   
  - can: bcm: Fix UAF in bcm_proc_show() (YueHaibing)   
  - fuse: revalidate: don't invalidate if interrupted (Miklos Szeredi)   
  - perf probe: Add test for regression introduced by switch to die_get_decl_file() (Georg Müller)   
  - serial: atmel: don't enable IRQs prematurely (Dan Carpenter)   
  - scsi: qla2xxx: Pointer may be dereferenced (Shreyas Deodhar)   
  - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() (Nilesh Javali)   
  - scsi: qla2xxx: Fix potential NULL pointer dereference (Bikash Hazarika)   
  - scsi: qla2xxx: Wait for io return on terminate rport (Quinn Tran)   
  - xtensa: ISS: fix call to split_if_spec (Max Filippov)   
  - ring-buffer: Fix deadloop issue on reading trace_pipe (Zheng Yejian)   
  - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk (Christophe JAILLET)   
  - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error (Christophe JAILLET)   
  - Revert "8250: add support for ASIX devices with a FIFO bug" (Jiaqing Zhao)   
  - meson saradc: fix clock divider mask length (George Stark)   
  - hwrng: imx-rngc - fix the timeout for init and self check (Martin Kaiser)   
  - fs: dlm: return positive pid value for F_GETLK (Alexander Aring)   
  - md/raid0: add discard support for the 'original' layout (Jason Baron)   
  - misc: pci_endpoint_test: Re-init completion for every test (Damien Le Moal)   
  - PCI: Add function 1 DMA alias quirk for Marvell 88SE9235 (Robin Murphy)   
  - jfs: jfs_dmap: Validate db_l2nbperpage while mounting (Siddh Raman Pant)   
  - ext4: only update i_reserved_data_blocks on successful block allocation (Baokun Li)   
  - ext4: fix wrong unit use in ext4_mb_clear_bb (Kemeng Shi)   
  - perf intel-pt: Fix CYC timestamps after standalone CBR (Adrian Hunter)   
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (Ding Hui)   
  - tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation (Jarkko Sakkinen)   
  - net/sched: make psched_mtu() RTNL-less safe (Pedro Tammela)   
  - wifi: airo: avoid uninitialized warning in airo_get_rate() (Randy Dunlap)   
  - ipv6/addrconf: fix a potential refcount underflow for idev (Ziyang Xuan)   
  - NTB: ntb_transport: fix possible memory leak while device_register() fails (Yang Yingliang)   
  - ntb: intel: Fix error handling in intel_ntb_pci_driver_init() (Yuan Can)   
  - NTB: amd: Fix error handling in amd_ntb_pci_driver_init() (Yuan Can)   
  - ntb: idt: Fix error handling in idt_pci_driver_init() (Yuan Can)   
  - udp6: fix udp6_ehashfn() typo (Eric Dumazet)   
  - net: mvneta: fix txq_map in case of txq_number==1 (Klaus Kudielka)   
  - workqueue: clean up WORK_* constant types, clarify masking (Linus Torvalds)   
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Thadeu Lima de Souza Cascardo)   
  - netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (Florent Revest)   
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Pablo Neira Ayuso)   
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Pablo Neira Ayuso)   
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (Pablo Neira Ayuso)   
  - spi: spi-fsl-spi: allow changing bits_per_word while CS is still active (Rasmus Villemoes)   
  - spi: spi-fsl-spi: relax message sanity checking a little (Rasmus Villemoes)   
  - spi: spi-fsl-spi: remove always-true conditional in fsl_spi_do_one_msg (Rasmus Villemoes)   
  - ARM: orion5x: fix d2net gpio initialization (Arnd Bergmann)   
  - btrfs: fix race when deleting quota root from the dirty cow roots list (Filipe Manana)   
  - jffs2: reduce stack usage in jffs2_build_xattr_subsystem() (Fabian Frederick)   
  - integrity: Fix possible multiple allocation in integrity_inode_get() (Tianjia Zhang)   
  - mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M (Robert Marko)   
  - mmc: core: disable TRIM on Kingston EMMC04G-M627 (Robert Marko)   
  - NFSD: add encoding of op_recall flag for write delegation (Dai Ngo)   
  - sh: dma: Fix DMA channel offset calculation (Artur Rojek)   
  - net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX (Lin Ma)   
  - tcp: annotate data races in __tcp_oow_rate_limited() (Eric Dumazet)   
  - net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode (Vladimir Oltean)   
  - powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y (Randy Dunlap)   
  - mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 (Nishanth Menon)   
  - spi: bcm-qspi: return error if neither hif_mspi nor mspi is available (Jonas Gorski)   
  - Add MODULE_FIRMWARE() for FIRMWARE_TG357766. (Tobias Heider)   
  - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (Chengfeng Ye)   
  - rtc: st-lpc: Release some resources in st_rtc_probe() in case of error (Christophe JAILLET)   
  - mfd: stmpe: Only disable the regulators if they are enabled (Christophe JAILLET)   
  - mfd: intel-lpss: Add missing check for platform_get_resource (Jiasheng Jiang)   
  - mfd: rt5033: Drop rt5033-battery sub-device (Stephan Gerhold)   
  - usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() (Li Yang)   
  - extcon: Fix kernel doc of property capability fields to avoid warnings (Andy Shevchenko)   
  - extcon: Fix kernel doc of property fields to avoid warnings (Andy Shevchenko)   
  - media: usb: siano: Fix warning due to null work_func_t function pointer (Duoming Zhou)   
  - media: videodev2.h: Fix struct v4l2_input tuner index comment (Marek Vasut)   
  - media: usb: Check az6007_read() return value (Daniil Dulov)   
  - sh: j2: Use ioremap() to translate device tree address into kernel memory (John Paul Adrian Glaubitz)   
  - w1: fix loop in w1_fini() (Dan Carpenter)   
  - block: change all __u32 annotations to __be32 in affs_hardblocks.h (Michael Schmitz)   
  - USB: serial: option: add LARA-R6 01B PIDs (Davide Tronchin)   
  - modpost: fix off by one in is_executable_section() (Dan Carpenter)   
  - modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} (Masahiro Yamada)   
  - modpost: fix section mismatch message for R_ARM_ABS32 (Masahiro Yamada)   
  - crypto: nx - fix build warnings when DEBUG_FS is not enabled (Randy Dunlap)   
  - pinctrl: at91-pio4: check return value of devm_kasprintf() (Claudiu Beznea)   
  - perf dwarf-aux: Fix off-by-one in die_get_varname() (Namhyung Kim)   
  - pinctrl: cherryview: Return correct value if pin in push-pull mode (Andy Shevchenko)   
  - PCI: Add pci_clear_master() stub for non-CONFIG_PCI (Sui Jingfeng)   
  - scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() (Yuchen Yang)   
  - ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer (Su Hui)   
  - drm/radeon: fix possible division-by-zero errors (Nikita Zhandarovich)   
  - fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() (Christophe JAILLET)   
  - soc/fsl/qe: fix usb.c build errors (Randy Dunlap)   
  - ASoC: es8316: Increment max value for ALC Capture Target Volume control (Cristian Ciocaltea)   
  - ARM: ep93xx: fix missing-prototype warnings (Arnd Bergmann)   
  - drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H (Dario Binacchi)   
  - Input: adxl34x - do not hardcode interrupt trigger type (Marek Vasut)   
  - ARM: dts: BCM5301X: Drop "clock-names" from the SPI node (Rafał Miłecki)   
  - Input: drv260x - sleep between polling GO bit (Luca Weiss)   
  - radeon: avoid double free in ci_dpm_init() (Nikita Zhandarovich)   
  - netlink: Add __sock_i_ino() for __netlink_diag_dump(). (Kuniyuki Iwashima)   
  - netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. (Ilia.Gavrilov)   
  - lib/ts_bm: reset initial match offset for every block of text (Jeremy Sowden)   
  - gtp: Fix use-after-free in __gtp_encap_destroy(). (Kuniyuki Iwashima)   
  - netlink: do not hard code device address lenth in fdb dumps (Eric Dumazet)   
  - netlink: fix potential deadlock in netlink_set_err() (Eric Dumazet)   
  - wifi: ath9k: convert msecs to jiffies where needed (Dmitry Antipov)   
  - wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() (Remi Pommarel)   
  - memstick r592: make memstick_debug_get_tpc_name() static (Arnd Bergmann)   
  - kexec: fix a memory leak in crash_shrink_memory() (Zhen Lei)   
  - watchdog/perf: more properly prevent false positives with turbo modes (Douglas Anderson)   
  - watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config (Douglas Anderson)   
  - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (Fedor Pchelkin)   
  - wifi: ray_cs: Fix an error handling path in ray_probe() (Christophe JAILLET)   
  - wifi: wl3501_cs: Fix an error handling path in wl3501_probe() (Christophe JAILLET)   
  - wifi: atmel: Fix an error handling path in atmel_probe() (Christophe JAILLET)   
  - wifi: orinoco: Fix an error handling path in orinoco_cs_probe() (Christophe JAILLET)   
  - wifi: orinoco: Fix an error handling path in spectrum_cs_probe() (Christophe JAILLET)   
  - wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx (Fedor Pchelkin)   
  - wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation (Peter Seiderer)   
  - evm: Complete description of evm_inode_setattr() (Roberto Sassu)   
  - PM: domains: fix integer overflow issues in genpd_parse_state() (Nikita Zhandarovich)   
  - md/raid10: fix io loss while replacement replace rdev (Li Nan)   
  - md/raid10: fix wrong setting of max_corr_read_errors (Li Nan)   
  - md/raid10: fix overflow of md/safe_mode_delay (Li Nan)   
  - treewide: Remove uninitialized_var() usage (Kees Cook)   
  - drm/amdgpu: Validate VM ioctl flags. (Bas Nieuwenhuizen)   
  - scripts/tags.sh: Resolve gtags empty index generation (Ahmed S. Darwish)   
  - drm/edid: Fix uninitialized variable in drm_cvt_modes() (Lyude Paul)   
  - fbdev: imsttfb: Fix use after free bug in imsttfb_probe (Zheng Wang)   
  - x86/smp: Use dedicated cache-line for mwait_play_dead() (Thomas Gleixner)   
  - x86/microcode/AMD: Load late on both threads too (Borislav Petkov (AMD))   
  - gfs2: Don't deref jdesc in evict (Bob Peterson)   
  - LTS version: v4.14.321 (Saeed Mirzamohammadi)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2047.529.3.1.el7uek]
changelog:
  - rds: Fix lack of reentrancy for connection reset with dst addr zero (Håkon Bugge)  [Orabug: 35708852]  {CVE-2023-22024}


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-2047.529.3.2.el7uek]
changelog:
  - netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa)  [Orabug: 35824309]  
  - netfilter: xt_u32: validate user space input (Wander Lairson Costa)  [Orabug: 35824309]  
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng)  [Orabug: 35824309]  {CVE-2023-42753}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.1.el7uek]
changelog:
  - rds: Remove gratuitous include of time.h from rds.h (Mark Haywood)  [Orabug: 35742762]  
  - smp: Reduce NMI traffic from CSD waiters to CSD destination (Imran Khan)  [Orabug: 35236407]  
  - smp: Reduce logging due to dump_stack of CSD waiters (Imran Khan)  [Orabug: 35236407]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.2.el7uek]
changelog:
  - LTS version: v4.14.325 (Saeed Mirzamohammadi)   
  - Revert "ARM: ep93xx: fix missing-prototype warnings" (Greg Kroah-Hartman)   
  - Revert "MIPS: Alchemy: fix dbdma2" (Greg Kroah-Hartman)   
  - LTS version: v4.14.324 (Saeed Mirzamohammadi)   
  - dma-buf/sw_sync: Avoid recursive lock during fence signal (Rob Clark)   
  - scsi: core: raid_class: Remove raid_component_add() (Zhu Wang)   
  - scsi: snic: Fix double free in snic_tgt_create() (Zhu Wang)   
  - rtnetlink: Reject negative ifindexes in RTM_NEWLINK (Ido Schimmel)   
  - x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 (Feng Tang)   
  - media: vcodec: Fix potential array out-of-bounds in encoder queue_setup (Wei Chen)   
  - lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels (Helge Deller)   
  - batman-adv: Fix batadv_v_ogm_aggr_send memory leak (Remi Pommarel)   
  - batman-adv: Fix TT global entry leak when client roamed back (Remi Pommarel)   
  - batman-adv: Do not get eth header before batadv_check_management_packet (Remi Pommarel)   
  - batman-adv: Trigger events for auto adjusted MTU (Sven Eckelmann)   
  - ibmveth: Use dcbf rather than dcbfl (Michael Ellerman)   
  - ipvs: fix racy memcpy in proc_do_sync_threshold (Sishuai Gong)   
  - ipvs: Improve robustness to the ipvs sysctl (Junwei Hu)   
  - igb: Avoid starting unnecessary workqueues (Alessio Igor Bogani)   
  - sock: annotate data-races around prot->memory_pressure (Eric Dumazet)   
  - tracing: Fix memleak due to race between current_tracer and trace (Zheng Yejian)   
  - net: phy: broadcom: stub c45 read/write for 54810 (Justin Chen)   
  - net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure (Lin Ma)   
  - net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled (Jason Xing)   
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Kuniyuki Iwashima)   
  - ASoC: rt5665: add missed regulator_bulk_disable (Zhang Shurong)   
  - netfilter: set default timeout to 3 secs for sctp shutdown send and recv state (Xin Long)   
  - test_firmware: prevent race conditions by a correct implementation of locking (Mirsad Goran Todorovac)   
  - binder: fix memory leak in binder_init() (Qi Zheng)   
  - serial: 8250: Fix oops for port->pm on uart_change_pm() (Tony Lindgren)   
  - mmc: wbsd: fix double mmc_free_host() in wbsd_init() (Yang Yingliang)   
  - cifs: Release folio lock on fscache read hit. (Russell Harmon via samba-technical)   
  - ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. (dengxiang)   
  - net: do not allow gso_size to be set to GSO_BY_FRAGS (Eric Dumazet)   
  - sock: Fix misuse of sk_under_memory_pressure() (Abel Wu)   
  - i40e: fix misleading debug logs (Andrii Staikov)   
  - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan)   
  - netfilter: nft_dynset: disallow object maps (Pablo Neira Ayuso)   
  - xfrm: add NULL check in xfrm_update_ae_params (Lin Ma)   
  - ip_vti: fix potential slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - ip6_vti: fix slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - net: af_key: fix sadb_x_filter validation (Lin Ma)   
  - net: xfrm: Fix xfrm_address_filter OOB read (Lin Ma)   
  - fbdev: mmp: fix value check in mmphw_probe() (Yuanjun Gong)   
  - drm/amdgpu: Fix potential fence use-after-free v2 (shanzhulig)   
  - Bluetooth: L2CAP: Fix use-after-free (Zhengping Jiang)   
  - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() (Armin Wolf)   
  - gfs2: Fix possible data races in gfs2_show_options() (Tuo Li)   
  - media: platform: mediatek: vpu: fix NULL ptr dereference (Hans Verkuil)   
  - media: v4l2-mem2mem: add lock to protect parameter num_rdy (Yunfei Dong)   
  - FS: JFS: Check for read-only mounted filesystem in txBegin (Immad Mir)   
  - FS: JFS: Fix null-ptr-deref Read in txBegin (Immad Mir)   
  - MIPS: dec: prom: Address -Warray-bounds warning (Gustavo A. R. Silva)   
  - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (Yogesh)   
  - udf: Fix uninitialized array access for some pathnames (Jan Kara)   
  - quota: fix warning in dqgrab() (Ye Bin)   
  - quota: Properly disable quotas when add_dquot_ref() fails (Jan Kara)   
  - ALSA: emu10k1: roll up loops in DSP setup code for Audigy (Oswald Buddenhagen)   
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init (hackyzh002)   
  - lib/mpi: Eliminate unused umul_ppmm definitions for MIPS (Nathan Chancellor)   
  - LTS version: v4.14.323 (Saeed Mirzamohammadi)   
  - alpha: remove __init annotation from exported page_is_ram() (Masahiro Yamada)   
  - scsi: core: Fix possible memory leak if device_add() fails (Zhu Wang)   
  - scsi: snic: Fix possible memory leak if device_add() fails (Zhu Wang)   
  - scsi: 53c700: Check that command slot is not NULL (Alexandra Diupina)   
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Michael Kelley)   
  - scsi: core: Fix legacy /proc parsing buffer overflow (Tony Battersby)   
  - netfilter: nf_tables: report use refcount overflow (Pablo Neira Ayuso)   
  - btrfs: don't stop integrity writeback too early (Christoph Hellwig)   
  - IB/hfi1: Fix possible panic during hotplug remove (Douglas Miller)   
  - drivers: net: prevent tun_build_skb() to exceed the packet size limit (Andrew Kanner)   
  - dccp: fix data-race around dp->dccps_mss_cache (Eric Dumazet)   
  - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan)   
  - net/packet: annotate data-races around tp->status (Eric Dumazet)   
  - drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes (Karol Herbst)   
  - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Kirill A. Shutemov)   
  - usb: dwc3: Properly handle processing of pending events (Elson Roy Serrao)   
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Alan Stern)   
  - iio: cros_ec: Fix the allocation size for cros_ec_command (Yiyuan Guo)   
  - test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation (Mirsad Goran Todorovac)   
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (Ryusuke Konishi)   
  - radix tree test suite: fix incorrect allocation size for pthreads (Colin Ian King)   
  - dmaengine: pl330: Return DMA_PAUSED when transaction is paused (Ilpo Järvinen)   
  - ipv6: adjust ndisc_is_useropt() to also return true for PIO (Maciej Żenczykowski)   
  - mmc: moxart: read scr register without changing byte order (Sergei Antonov)   
  - sparc: fix up arch_cpu_finalize_init() build breakage. (Greg Kroah-Hartman)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.3.el7uek]
changelog:
  - Add the new PCI Device IDs to support new generation of AMD 19h processors. (Partha Sarathi Satapathy)  [Orabug: 35773822]  
  - hwmon: (k10temp) Add support for AMD Family 19h Models 10h-1Fh and A0h-AFh (Babu Moger)  [Orabug: 35773822]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.4.el7uek]
changelog:
  - rds: Fix lack of reentrancy for connection reset with dst addr zero (Håkon Bugge)  [Orabug: 35819110]  {CVE-2023-22024} 
  - kernfs: fix missing kernfs_iattr_rwsem locking (Ian Kent)  [Orabug: 35796772]  
  - uek-rpm: Removing pre scriptlet to not allow firmware downgrade (Samasth Norway Ananda)  [Orabug: 35756463]  
  - scsi: megaraid_sas: Fix deadlock on firmware crashdump (Junxiao Bi)  [Orabug: 35702793]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.5.el7uek]
changelog:
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng)  [Orabug: 35824288]  {CVE-2023-42753} 
  - netfilter: xt_u32: validate user space input (Wander Lairson Costa)   
  - netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.5.1.el7uek]
changelog:
  - Revert "rtnetlink: Reject negative ifindexes in RTM_NEWLINK" (Saeed Mirzamohammadi)  [Orabug: 35896831]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.531.1.el7uek]
changelog:
  - ocfs2: ocfs2 crash due to invalid h_next_leaf_blk value in extent block (Gautham Ananthakrishna)  [Orabug: 35859332]  
  - bnxt_en: fix NULL dereference in bnxt_flash_package_from_file() (Samasth Norway Ananda)  [Orabug: 35848949]  
  - LTS version: v4.14.326 (Saeed Mirzamohammadi)   
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (valis)   
  - mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write (William Zhang)   
  - mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller (William Zhang)   
  - mtd: rawnand: brcmnand: Fix potential false time out warning (William Zhang)   
  - mtd: rawnand: brcmnand: Fix crash during the panic_write (William Zhang)   
  - nfsd: fix change_info in NFSv4 RENAME replies (Jeff Layton)   
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (Filipe Manana)   
  - attr: block mode changes of symlinks (Christian Brauner)   
  - md/raid1: fix error: ISO C90 forbids mixed declarations (Nigel Croxon)   
  - kobject: Add sanity check for kset->kobj.ktype in kset_register() (Zhen Lei)   
  - serial: cpm_uart: Avoid suspicious locking (Christophe Leroy)   
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (Konstantin Shelekhin)   
  - usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc (Ma Ke)   
  - media: pci: cx23885: replace BUG with error return (Hans Verkuil)   
  - media: tuners: qt1010: replace BUG_ON with a regular error (Hans Verkuil)   
  - iio: core: Use min() instead of min_t() to make code more robust (Andy Shevchenko)   
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (Zhang Shurong)   
  - media: anysee: fix null-ptr-deref in anysee_master_xfer (Zhang Shurong)   
  - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer (Zhang Shurong)   
  - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() (Zhang Shurong)   
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer (Zhang Shurong)   
  - powerpc/pseries: fix possible memory leak in ibmebus_bus_init() (ruanjinjie)   
  - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (Liu Shixin via Jfs-discussion)   
  - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (Andrew Kanner)   
  - ext2: fix datatype of block number in ext2_xattr_set2() (Georg Ottinger)   
  - md: raid1: fix potential OOB in raid1_remove_disk() (Zhang Shurong)   
  - drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable() (Tuo Li)   
  - alx: fix OOB-read compiler warning (GONG, Ruiqi)   
  - tpm_tis: Resend command to recover from data transfer errors (Alexander Steffen)   
  - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (Mark O'Donovan)   
  - wifi: mwifiex: fix fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix printk specifier (Dongliang Mu)   
  - hw_breakpoint: fix single-stepping when using bpf_overflow_handler (Tomislav Novak)   
  - ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 (Jiri Slaby (SUSE))   
  - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (Abhishek Mainkar)   
  - btrfs: output extra debug info if we failed to find an inline backref (Qu Wenruo)   
  - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Fedor Pchelkin)   
  - parisc: Drop loops_per_jiffy from per_cpu struct (Helge Deller)   
  - kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). (Kuniyuki Iwashima)   
  - ixgbe: fix timestamp configuration code (Vadim Fedorenko)   
  - kcm: Fix memory leak in error path of kcm_sendmsg() (Shigeru Yoshida)   
  - net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() (Hangyu Hua)   
  - ata: pata_ftide010: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - ata: sata_gemini: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - igb: Change IGB_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - kcm: Destroy mutex in kcm_exit_net() (Shigeru Yoshida)   
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis)   
  - af_unix: Fix data race around sk->sk_err. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around sk->sk_shutdown. (Kuniyuki Iwashima)   
  - af_unix: Fix data-race around unix_tot_inflight. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around user->unix_inflight. (Kuniyuki Iwashima)   
  - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr (Alex Henrie)   
  - igb: disable virtualization features on 82580 (Corinna Vinschen)   
  - net: read sk->sk_family once in sk_mc_loop() (Eric Dumazet)   
  - pwm: lpc32xx: Remove handling of PWM channels (Vladimir Zapolskiy)   
  - watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load (Raag Jadav)   
  - x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() (Sean Christopherson)   
  - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info (Fedor Pchelkin)   
  - clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock (Dmitry Baryshkov)   
  - parisc: led: Reduce CPU overhead for disk & lan LED computation (Helge Deller)   
  - parisc: led: Fix LAN receive and transmit LEDs (Helge Deller)   
  - drm/ast: Fix DRAM init on AST2200 (Thomas Zimmermann)   
  - fbdev/ep93xx-fb: Do not assign to struct fb_info.dev (Thomas Zimmermann)   
  - scsi: qla2xxx: Turn off noisy message log (Quinn Tran)   
  - scsi: qla2xxx: fix inconsistent TMF timeout (Quinn Tran)   
  - crypto: stm32 - fix loop iterating through scatterlist for DMA (Thomas Bourgoin)   
  - pstore/ram: Check start of empty przs during init (Enlin Mu)   
  - net: handle ARPHRD_PPP in dev_is_mac_header_xmit() (Nicolas Dichtel)   
  - X.509: if signature is unsupported skip validation (Thore Sommer)   
  - dccp: Fix out of bounds access in DCCP error handler (Jann Horn)   
  - parisc: Fix /proc/cpuinfo output for lscpu (Helge Deller)   
  - procfs: block chmod on /proc/thread-self/comm (Aleksa Sarai)   
  - Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" (Bjorn Helgaas)   
  - ntb: Fix calculation ntb_transport_tx_free_entry() (Dave Jiang)   
  - ntb: Clean up tx tail index on link down (Dave Jiang)   
  - ntb: Drop packets when qp link is down (Dave Jiang)   
  - media: dvb: symbol fixup for dvb_attach() (Greg Kroah-Hartman)   
  - backlight/lv5207lp: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/bd6107: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/gpio_backlight: Compare against struct fb_info.device (Thomas Zimmermann)   
  - ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() (Gustavo A. R. Silva)   
  - ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (Takashi Iwai)   
  - PM / devfreq: Fix leak in devfreq_dev_release() (Boris Brezillon)   
  - igb: set max size RX buffer when store bad packet is enabled (Radoslaw Tyl)   
  - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU (Eric Dumazet)   
  - dmaengine: ste_dma40: Add missing IRQ check in d40_probe (ruanjinjie)   
  - rpmsg: glink: Add check for kstrdup (Jiasheng Jiang)   
  - HID: multitouch: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu)   
  - Revert "IB/isert: Fix incorrect release of isert connection" (Leon Romanovsky)   
  - amba: bus: fix refcount leak (Peng Fan)   
  - serial: tegra: handle clk prepare error in tegra_uart_hw_init() (Yi Yang)   
  - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (Chengfeng Ye)   
  - scsi: core: Use 32-bit hostnum in scsi_host_lookup() (Tony Battersby)   
  - cgroup:namespace: Remove unused cgroup_namespaces_init() (Lu Jialin)   
  - USB: gadget: f_mass_storage: Fix unused variable warning (Alan Stern)   
  - media: go7007: Remove redundant if statement (Colin Ian King)   
  - dma-buf/sync_file: Fix docs syntax (Rob Clark)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (Oleksandr Natalenko)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (Oleksandr Natalenko)   
  - x86/APM: drop the duplicate APM_MINOR_DEV macro (Randy Dunlap)   
  - scsi: qla4xxx: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: be2iscsi: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() (Lin Ma)   
  - usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() (Xu Yang)   
  - media: mediatek: vcodec: Return NULL if no vdec_fb is found (Irui Wang)   
  - media: cx24120: Add retval check for cx24120_message_send() (Daniil Dulov)   
  - media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() (Christophe JAILLET)   
  - media: dib7000p: Fix potential division by zero (Daniil Dulov)   
  - drivers: usb: smsusb: fix error handling code in smsusb_init_device (Dongliang Mu)   
  - NFSD: da_addr_body field missing in some GETDEVICEINFO replies (Chuck Lever)   
  - fs: lockd: avoid possible wrong NULL parameter (Su Hui)   
  - jfs: validate max amount of blocks before allocation. (Alexei Filippov)   
  - powerpc/iommu: Fix notifiers being shared by PCI and VIO buses (Russell Currey)   
  - nfs/blocklayout: Use the passed in gfp flags (Dan Carpenter)   
  - wifi: ath10k: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: pciehp: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: Mark NVIDIA T4 GPUs to avoid bus reset (Wu Zongyong)   
  - clk: sunxi-ng: Modify mismatched function name (Zhang Jianhua)   
  - drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() (Minjie Du)   
  - ALSA: ac97: Fix possible error value of *rac97 (Su Hui)   
  - audit: fix possible soft lockup in __audit_inode_child() (Gaosheng Cui)   
  - smackfs: Prevent underflow in smk_set_cipso() (Dan Carpenter)   
  - of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() (Ruan Jinjie)   
  - drm: adv7511: Fix low refresh rate register for ADV7533/5 (Bogdan Togorean)   
  - ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: BCM53573: Add cells sizes to PCIe node (Rafał Miłecki)   
  - netrom: Deny concurrent connect(). (Kuniyuki Iwashima)   
  - net: arcnet: Do not call kfree_skb() under local_irq_disable() (Jinjie Ruan)   
  - wifi: ath9k: use IS_ERR() with debugfs_create_dir() (Wang Ming)   
  - wifi: mwifiex: avoid possible NULL skb pointer dereference (Dmitry Antipov)   
  - wifi: ath9k: protect WMI command response buffer replacement with a lock (Fedor Pchelkin)   
  - wifi: mwifiex: Fix missed return in oob checks failed path (Polaris Pi)   
  - wifi: mwifiex: fix memory leak in mwifiex_histogram_read() (Dmitry Antipov)   
  - fs: ocfs2: namei: check return value of ocfs2_add_entry() (Artem Chernyshev)   
  - lwt: Check LWTUNNEL_XMIT_CONTINUE strictly (Yan Zhai)   
  - crypto: caam - fix unchecked return value error (Gaurav Jain)   
  - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Menglong Dong)   
  - Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (Yuanjun Gong)   
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Polaris Pi)   
  - can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM (Marc Kleine-Budde)   
  - spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() (Zhang Shurong)   
  - regmap: rbtree: Use alloc_flags for memory allocations (Dan Carpenter)   
  - cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() (Liao Chang)   
  - fs: Fix error checking for d_hash_and_lookup() (Wang Ming)   
  - reiserfs: Check the return value from __getblk() (Matthew Wilcox)   
  - Revert "net: macsec: preserve ingress frame ordering" (Sabrina Dubroca)   
  - udf: Handle error when adding extent to a file (Jan Kara)   
  - udf: Check consistency of Space Bitmap Descriptor (Vladislav Efanov)   
  - powerpc/32s: Fix assembler warning about r0 (Christophe Leroy)   
  - powerpc/32: Include .branch_lt in data section (Joel Stanley)   
  - ALSA: seq: oss: Fix racy open/close of MIDI devices (Takashi Iwai)   
  - cifs: add a warning when the in-flight count goes negative (Shyam Prasad N)   
  - sctp: handle invalid error codes without calling BUG() (Dan Carpenter)   
  - bnx2x: fix page fault following EEH recovery (David Christensen)   
  - netlabel: fix shift wrapping bug in netlbl_catmap_setlong() (Dmitry Mastykin)   
  - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock (Chengfeng Ye)   
  - idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM (Baoquan He)   
  - net: usb: qmi_wwan: add Quectel EM05GV2 (Martin Kohn)   
  - security: keys: perform capable check only on privileged operations (Christian Göttsche)   
  - ASoc: codecs: ES8316: Fix DMIC config (Edgar)   
  - fs/nls: make load_nls() take a const parameter (Saeed Mirzamohammadi)   
  - s390/dasd: use correct number of retries for ERP requests (Stefan Haberland)   
  - m68k: Fix invalid .section syntax (Ben Hutchings)   
  - ethernet: atheros: fix return value check in atl1c_tso_csum() (Yuanjun Gong)   
  - ASoC: da7219: Flush pending AAD IRQ when suspending (Dmytro Maluka)   
  - 9p: virtio: make sure 'offs' is initialized in zc_request (Dominique Martinet)   
  - lib/ubsan: remove returns-nonnull-attribute checks (Andrey Ryabinin)   
  - pinctrl: amd: Don't show `Invalid config param` errors (Mario Limonciello)   
  - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (Ryusuke Konishi)   
  - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() (Ryusuke Konishi)   
  - serial: sc16is7xx: fix bug when first setting GPIO direction (Hugo Villeneuve)   
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (Zheng Wang)   
  - HID: wacom: remove the battery when the EKR is off (Aaron Armstrong Skomra)   
  - USB: serial: option: add FOXCONN T99W368/T99W373 product (Slark Xiao)   
  - USB: serial: option: add Quectel EM05G variant (0x030e) (Martin Kohn)   
  - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules (Christoph Hellwig)   
  - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff (Christoph Hellwig)   
  - mmc: au1xmmc: force non-modular build and remove symbol_get usage (Christoph Hellwig)   
  - ARM: pxa: remove use of symbol_get() (Arnd Bergmann)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.531.2.el7uek]
changelog:
  - rtnetlink: Reject negative ifindexes in RTM_NEWLINK (Ido Schimmel)  [Orabug: 35867429]  
  - Revert "rtnetlink: Reject negative ifindexes in RTM_NEWLINK" (Boris Ostrovsky)  [Orabug: 35867429]  
  - rds: Add proper refcnt when an RDS MR references an RDS Socket (Håkon Bugge)  [Orabug: 35836950]  
  - rds: Check for UAF in rds_destroy_mr (Håkon Bugge)  [Orabug: 35836950]  
  - xfs: reserve less log space when recovering log intent items (Darrick J. Wong)  [Orabug: 35587163]  
  - xfs: reserve blocks for refcount / rmap log item recovery (Darrick J. Wong)  [Orabug: 35587163]  
  - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Pin-yen Lin)   
  - dccp: fix dccp_v4_err()/dccp_v6_err() again (Eric Dumazet)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.531.2.1.el7uek]
changelog:
  - x86: change default to spec_store_bypass_disable=prctl spectre_v2_user=prctl (Andrea Arcangeli)  [Orabug: 35973454]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.1.el7uek]
changelog:
  - rds/ib: Preserve dest qp num in the connect request (Arumugam Kolappan)  [Orabug: 35649849]  
  - rds: Provision to allow all trace points at module load time (Arumugam Kolappan)  [Orabug: 35355776]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.2.el7uek]
changelog:
  - x86: change default to spec_store_bypass_disable=prctl spectre_v2_user=prctl (Andrea Arcangeli)  [Orabug: 35905888]  
  - LTS version: 4.14.328 (Saeed Mirzamohammadi)   
  - Bluetooth: hci_event: Fix using memcmp when comparing keys (Luiz Augusto von Dentz)   
  - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (Kees Cook)   
  - Bluetooth: hci_sock: fix slab oob read in create_monitor_event (Edward AD)   
  - gpio: vf610: set value before the direction to avoid a glitch (Haibo Chen)   
  - s390/pci: fix iommu bitmap allocation (Niklas Schnelle)   
  - perf: Disallow mis-matched inherited group reads (Saeed Mirzamohammadi)   
  - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (Puliang Lu)   
  - USB: serial: option: add entry for Sierra EM9191 with new firmware (Benoît Monin)   
  - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (Fabio Porcedda)   
  - ACPI: irq: Fix incorrect return value in acpi_register_gsi() (Sunil V L)   
  - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" (Andy Shevchenko)   
  - mmc: core: Capture correct oemid-bits for eMMC cards (Avri Altman)   
  - sky2: Make sure there is at least one frag_addr available (Kees Cook)   
  - wifi: cfg80211: avoid leaking stack data into trace (Benjamin Berg)   
  - wifi: mac80211: allow transmitting EAPOL frames with tainted key (Wen Gong)   
  - Bluetooth: hci_core: Fix build warnings (Luiz Augusto von Dentz)   
  - Bluetooth: Avoid redundant authentication (Ying Hsu)   
  - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (Ma Ke)   
  - tracing: relax trace_event_eval_update() execution with cond_resched() (Clément Léger)   
  - ata: libata-eh: Fix compilation warning in ata_eh_link_report() (Damien Le Moal)   
  - gpio: timberdale: Fix potential deadlock on &tgpio->lock (Chengfeng Ye)   
  - overlayfs: set ctime when setting mtime and atime (Jeff Layton)   
  - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (Heiner Kallweit)   
  - btrfs: initialize start_slot in btrfs_log_prealloc_extents (Josef Bacik)   
  - ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone (Tony Lindgren)   
  - i40e: prevent crash on probe if hw registers have invalid values (Michal Schmidt)   
  - net: usb: smsc95xx: Fix an error code in smsc95xx_reset() (Dan Carpenter)   
  - net: rfkill: gpio: prevent value glitch during probe (Josua Mayer)   
  - net: ipv6: fix return value check in esp_remove_trailer (Ma Ke)   
  - net: ipv4: fix return value check in esp_remove_trailer (Ma Ke)   
  - xfrm: fix a data-race in xfrm_gen_index() (Saeed Mirzamohammadi)   
  - netfilter: nft_payload: fix wrong mac header matching (Florian Westphal)   
  - KVM: x86: Mask LVTPC when handling a PMI (Jim Mattson)   
  - regmap: fix NULL deref on lookup (Johan Hovold)   
  - nfc: nci: fix possible NULL pointer dereference in send_acknowledge() (Krzysztof Kozlowski)   
  - Bluetooth: avoid memcmp() out of bounds warning (Arnd Bergmann)   
  - Bluetooth: hci_event: Fix coding style (Luiz Augusto von Dentz)   
  - Bluetooth: vhci: Fix race when opening vhci device (Arkadiusz Bokowy)   
  - Bluetooth: Fix a refcnt underflow problem for hci_conn (Ziyang Xuan)   
  - Bluetooth: Reject connection with the device which has same BD_ADDR (Lee, Chun-Yi)   
  - Bluetooth: hci_event: Ignore NULL link key (Lee, Chun-Yi)   
  - usb: hub: Guard against accesses to uninitialized BOS descriptors (Ricardo Cañuelo)   
  - x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs (Borislav Petkov (AMD))   
  - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call (Krishna Kurapati)   
  - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio (Piyush Mehta)   
  - pinctrl: avoid unsafe code pattern in find_pinctrl() (Dmitry Torokhov)   
  - cgroup: Remove duplicates in cgroup v1 tasks file (Michal Koutný)   
  - Input: xpad - add PXN V900 support (Matthias Berndt)   
  - Input: powermate - fix use-after-free in powermate_config_complete (Javier Carrasco)   
  - ceph: fix incorrect revoked caps assert in ceph_fill_file_size() (Xiubo Li)   
  - mcb: remove is_added flag from mcb_device struct (Jorge Sanjuan Garcia)   
  - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug (Alexander Zangerl)   
  - iio: pressure: bmp280: Fix NULL pointer exception (Phil Elwell)   
  - usb: musb: Modify the "HWVers" register address (Xingxing Luo)   
  - usb: musb: Get the musb_qh poniter after musb_giveback (Xingxing Luo)   
  - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read (Javier Carrasco)   
  - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer (Wesley Cheng)   
  - workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() (Waiman Long)   
  - nfc: nci: assert requested protocol is valid (Jeremy Cline)   
  - ixgbe: fix crash with empty VF macvlan list (Dan Carpenter)   
  - drm/vmwgfx: fix typo of sizeof argument (Konstantin Meskhidze)   
  - ieee802154: ca8210: Fix a potential UAF in ca8210_probe (Dinghao Liu)   
  - drm: etvnaviv: fix bad backport leading to warning (Martin Fuzzey)   
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (Hans de Goede)   
  - RDMA/cxgb4: Check skb value for failure to allocate (Artem Chernyshev)   
  - LTS version: 4.14.327 (Saeed Mirzamohammadi)   
  - parisc: Restore __ldcw_align for PA-RISC 2.0 processors (John David Anglin)   
  - RDMA/mlx5: Fix NULL string error (Shay Drory)   
  - RDMA/cma: Fix truncation compilation warning in make_cma_ports (Leon Romanovsky)   
  - gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() (Bartosz Golaszewski)   
  - IB/mlx4: Fix the size of a buffer in add_port_entries() (Christophe JAILLET)   
  - cpupower: add Makefile dependencies for install targets (Ivan Babrou)   
  - sctp: update hb timer immediately after users change hb_interval (Xin Long)   
  - sctp: update transport state when processing a dupcook packet (Xin Long)   
  - tcp: fix delayed ACKs for MSS boundary condition (Neal Cardwell)   
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Shigeru Yoshida)   
  - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (David Howells)   
  - modpost: add missing else to the "of" check (Mauricio Faria de Oliveira)   
  - scsi: target: core: Fix deadlock due to recursive locking (Junxiao Bi)   
  - regmap: rbtree: Fix wrong register marked as in-cache when creating new node (Richard Fitzgerald)   
  - drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close() (Alexandra Diupina)   
  - ubi: Refuse attaching if mtd's erasesize is 0 (Zhihao Cheng)   
  - wifi: mwifiex: Fix tlv_buf_left calculation (Gustavo A. R. Silva)   
  - scsi: zfcp: Fix a double put in zfcp_port_enqueue() (Dinghao Liu)   
  - media: dvb: symbol fixup for dvb_attach() - again (Greg Kroah-Hartman)   
  - ata: libata: disallow dev-initiated LPM transitions to unsupported states (Niklas Cassel)   
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Budimir Markovic)   
  - ext4: fix rec_len verify error (Shida Zhang)   
  - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (George Kennedy)   
  - fs: binfmt_elf_efpic: fix personality for ELF-FDPIC (Greg Ungerer)   
  - ata: libata-sata: increase PMP SRST timeout to 10s (Matthias Schiffer)   
  - ata: libata-core: Fix port and device removal (Damien Le Moal)   
  - ata: libata-core: Fix ata_port_request_pm() locking (Damien Le Moal)   
  - btrfs: properly report 0 avail for very full file systems (Josef Bacik)   
  - i2c: i801: unregister tco_pdev in i801_probe() error path (Heiner Kallweit)   
  - ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES (Niklas Cassel)   
  - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() (Pan Bian)   
  - serial: 8250_port: Check IRQ data before use (Andy Shevchenko)   
  - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Mika Westerberg)   
  - watchdog: iTCO_wdt: No need to stop the timer in probe (Mika Westerberg)   
  - ata: libahci: clear pending interrupt status (Szuying Chen)   
  - ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones (Hannes Reinecke)   
  - fbdev/sh7760fb: Depend on FB=y (Thomas Zimmermann)   
  - ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset() (Niklas Cassel)   
  - ring-buffer: Avoid softlockup in ring_buffer_resize() (Zheng Yejian)   
  - selftests/ftrace: Correctly enable event in instance-event.tc (Zheng Yejian)   
  - parisc: irq: Make irq_stack_union static to avoid sparse warning (Helge Deller)   
  - parisc: iosapic.c: Fix sparse warnings (Helge Deller)   
  - parisc: sba: Fix compile warning wrt list of SBA devices (Helge Deller)   
  - xtensa: boot/lib: fix function prototypes (Max Filippov)   
  - xtensa: boot: don't add include-dirs (Randy Dunlap)   
  - clk: tegra: fix error return case for recalc_rate (Timo Alho)   
  - i2c: mux: demux-pinctrl: check the return value of devm_kstrdup() (Xiaoke Wang)   
  - gpio: tb10x: Fix an error handling path in tb10x_gpio_probe() (Christophe JAILLET)   
  - team: fix null-ptr-deref when team device type is changed (Ziyang Xuan)   
  - powerpc/perf/hv-24x7: Update domain value check (Kajol Jain)   
  - ipv4: fix null-deref in ipv4_link_failure (Kyle Zeng)   
  - NFS/pNFS: Report EINVAL errors from connect() to the server (Trond Myklebust)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.2.el7uek]
changelog:
  - LTS version: v4.14.325 (Saeed Mirzamohammadi)   
  - Revert "ARM: ep93xx: fix missing-prototype warnings" (Greg Kroah-Hartman)   
  - Revert "MIPS: Alchemy: fix dbdma2" (Greg Kroah-Hartman)   
  - LTS version: v4.14.324 (Saeed Mirzamohammadi)   
  - dma-buf/sw_sync: Avoid recursive lock during fence signal (Rob Clark)   
  - scsi: core: raid_class: Remove raid_component_add() (Zhu Wang)   
  - scsi: snic: Fix double free in snic_tgt_create() (Zhu Wang)   
  - rtnetlink: Reject negative ifindexes in RTM_NEWLINK (Ido Schimmel)   
  - x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 (Feng Tang)   
  - media: vcodec: Fix potential array out-of-bounds in encoder queue_setup (Wei Chen)   
  - lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels (Helge Deller)   
  - batman-adv: Fix batadv_v_ogm_aggr_send memory leak (Remi Pommarel)   
  - batman-adv: Fix TT global entry leak when client roamed back (Remi Pommarel)   
  - batman-adv: Do not get eth header before batadv_check_management_packet (Remi Pommarel)   
  - batman-adv: Trigger events for auto adjusted MTU (Sven Eckelmann)   
  - ibmveth: Use dcbf rather than dcbfl (Michael Ellerman)   
  - ipvs: fix racy memcpy in proc_do_sync_threshold (Sishuai Gong)   
  - ipvs: Improve robustness to the ipvs sysctl (Junwei Hu)   
  - igb: Avoid starting unnecessary workqueues (Alessio Igor Bogani)   
  - sock: annotate data-races around prot->memory_pressure (Eric Dumazet)   
  - tracing: Fix memleak due to race between current_tracer and trace (Zheng Yejian)   
  - net: phy: broadcom: stub c45 read/write for 54810 (Justin Chen)   
  - net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure (Lin Ma)   
  - net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled (Jason Xing)   
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Kuniyuki Iwashima) [Orabug: 35814409] {CVE-2023-4622}
  - ASoC: rt5665: add missed regulator_bulk_disable (Zhang Shurong)   
  - netfilter: set default timeout to 3 secs for sctp shutdown send and recv state (Xin Long)   
  - test_firmware: prevent race conditions by a correct implementation of locking (Mirsad Goran Todorovac)   
  - binder: fix memory leak in binder_init() (Qi Zheng)   
  - serial: 8250: Fix oops for port->pm on uart_change_pm() (Tony Lindgren)   
  - mmc: wbsd: fix double mmc_free_host() in wbsd_init() (Yang Yingliang)   
  - cifs: Release folio lock on fscache read hit. (Russell Harmon via samba-technical)   
  - ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. (dengxiang)   
  - net: do not allow gso_size to be set to GSO_BY_FRAGS (Eric Dumazet)   
  - sock: Fix misuse of sk_under_memory_pressure() (Abel Wu)   
  - i40e: fix misleading debug logs (Andrii Staikov)   
  - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan)   
  - netfilter: nft_dynset: disallow object maps (Pablo Neira Ayuso)   
  - xfrm: add NULL check in xfrm_update_ae_params (Lin Ma) [Orabug: 35754508] {CVE-2023-3772}
  - ip_vti: fix potential slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - ip6_vti: fix slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - net: af_key: fix sadb_x_filter validation (Lin Ma)   
  - net: xfrm: Fix xfrm_address_filter OOB read (Lin Ma) [Orabug: 35923516] {CVE-2023-39194}
  - fbdev: mmp: fix value check in mmphw_probe() (Yuanjun Gong)   
  - drm/amdgpu: Fix potential fence use-after-free v2 (shanzhulig)   
  - Bluetooth: L2CAP: Fix use-after-free (Zhengping Jiang)   
  - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() (Armin Wolf)   
  - gfs2: Fix possible data races in gfs2_show_options() (Tuo Li)   
  - media: platform: mediatek: vpu: fix NULL ptr dereference (Hans Verkuil)   
  - media: v4l2-mem2mem: add lock to protect parameter num_rdy (Yunfei Dong)   
  - FS: JFS: Check for read-only mounted filesystem in txBegin (Immad Mir)   
  - FS: JFS: Fix null-ptr-deref Read in txBegin (Immad Mir)   
  - MIPS: dec: prom: Address -Warray-bounds warning (Gustavo A. R. Silva)   
  - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (Yogesh)   
  - udf: Fix uninitialized array access for some pathnames (Jan Kara)   
  - quota: fix warning in dqgrab() (Ye Bin)   
  - quota: Properly disable quotas when add_dquot_ref() fails (Jan Kara)   
  - ALSA: emu10k1: roll up loops in DSP setup code for Audigy (Oswald Buddenhagen)   
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init (hackyzh002)   
  - lib/mpi: Eliminate unused umul_ppmm definitions for MIPS (Nathan Chancellor)   
  - LTS version: v4.14.323 (Saeed Mirzamohammadi)   
  - alpha: remove __init annotation from exported page_is_ram() (Masahiro Yamada)   
  - scsi: core: Fix possible memory leak if device_add() fails (Zhu Wang)   
  - scsi: snic: Fix possible memory leak if device_add() fails (Zhu Wang)   
  - scsi: 53c700: Check that command slot is not NULL (Alexandra Diupina)   
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Michael Kelley)   
  - scsi: core: Fix legacy /proc parsing buffer overflow (Tony Battersby)   
  - netfilter: nf_tables: report use refcount overflow (Pablo Neira Ayuso)   
  - btrfs: don't stop integrity writeback too early (Christoph Hellwig)   
  - IB/hfi1: Fix possible panic during hotplug remove (Douglas Miller)   
  - drivers: net: prevent tun_build_skb() to exceed the packet size limit (Andrew Kanner)   
  - dccp: fix data-race around dp->dccps_mss_cache (Eric Dumazet)   
  - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan)   
  - net/packet: annotate data-races around tp->status (Eric Dumazet)   
  - drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes (Karol Herbst)   
  - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Kirill A. Shutemov)   
  - usb: dwc3: Properly handle processing of pending events (Elson Roy Serrao)   
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Alan Stern)   
  - iio: cros_ec: Fix the allocation size for cros_ec_command (Yiyuan Guo)   
  - test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation (Mirsad Goran Todorovac)   
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (Ryusuke Konishi)   
  - radix tree test suite: fix incorrect allocation size for pthreads (Colin Ian King)   
  - dmaengine: pl330: Return DMA_PAUSED when transaction is paused (Ilpo Järvinen)   
  - ipv6: adjust ndisc_is_useropt() to also return true for PIO (Maciej Żenczykowski)   
  - mmc: moxart: read scr register without changing byte order (Sergei Antonov)   
  - sparc: fix up arch_cpu_finalize_init() build breakage. (Greg Kroah-Hartman)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.530.5.el7uek]
changelog:
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng)  [Orabug: 35824288]  {CVE-2023-42753} 
  - netfilter: xt_u32: validate user space input (Wander Lairson Costa) [Orabug: 35923468] {CVE-2023-39192}
  - netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa) [Orabug: 35923499] {CVE-2023-39193}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.531.1.el7uek]
changelog:
  - ocfs2: ocfs2 crash due to invalid h_next_leaf_blk value in extent block (Gautham Ananthakrishna)  [Orabug: 35859332]  
  - bnxt_en: fix NULL dereference in bnxt_flash_package_from_file() (Samasth Norway Ananda)  [Orabug: 35848949]  
  - LTS version: v4.14.326 (Saeed Mirzamohammadi)   
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (valis) [Orabug: 35814287] {CVE-2023-4207} 
  - mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write (William Zhang)   
  - mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller (William Zhang)   
  - mtd: rawnand: brcmnand: Fix potential false time out warning (William Zhang)   
  - mtd: rawnand: brcmnand: Fix crash during the panic_write (William Zhang)   
  - nfsd: fix change_info in NFSv4 RENAME replies (Jeff Layton)   
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (Filipe Manana)   
  - attr: block mode changes of symlinks (Christian Brauner)   
  - md/raid1: fix error: ISO C90 forbids mixed declarations (Nigel Croxon)   
  - kobject: Add sanity check for kset->kobj.ktype in kset_register() (Zhen Lei)   
  - serial: cpm_uart: Avoid suspicious locking (Christophe Leroy)   
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (Konstantin Shelekhin)   
  - usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc (Ma Ke)   
  - media: pci: cx23885: replace BUG with error return (Hans Verkuil)   
  - media: tuners: qt1010: replace BUG_ON with a regular error (Hans Verkuil)   
  - iio: core: Use min() instead of min_t() to make code more robust (Andy Shevchenko)   
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (Zhang Shurong)   
  - media: anysee: fix null-ptr-deref in anysee_master_xfer (Zhang Shurong)   
  - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer (Zhang Shurong)   
  - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() (Zhang Shurong)   
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer (Zhang Shurong)   
  - powerpc/pseries: fix possible memory leak in ibmebus_bus_init() (ruanjinjie)   
  - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (Liu Shixin via Jfs-discussion)   
  - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (Andrew Kanner)   
  - ext2: fix datatype of block number in ext2_xattr_set2() (Georg Ottinger)   
  - md: raid1: fix potential OOB in raid1_remove_disk() (Zhang Shurong)   
  - drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable() (Tuo Li)   
  - alx: fix OOB-read compiler warning (GONG, Ruiqi)   
  - tpm_tis: Resend command to recover from data transfer errors (Alexander Steffen)   
  - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (Mark O'Donovan)   
  - wifi: mwifiex: fix fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix printk specifier (Dongliang Mu)   
  - hw_breakpoint: fix single-stepping when using bpf_overflow_handler (Tomislav Novak)   
  - ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 (Jiri Slaby (SUSE))   
  - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (Abhishek Mainkar)   
  - btrfs: output extra debug info if we failed to find an inline backref (Qu Wenruo)   
  - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Fedor Pchelkin)   
  - parisc: Drop loops_per_jiffy from per_cpu struct (Helge Deller)   
  - kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). (Kuniyuki Iwashima)   
  - ixgbe: fix timestamp configuration code (Vadim Fedorenko)   
  - kcm: Fix memory leak in error path of kcm_sendmsg() (Shigeru Yoshida)   
  - net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() (Hangyu Hua)   
  - ata: pata_ftide010: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - ata: sata_gemini: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - igb: Change IGB_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - kcm: Destroy mutex in kcm_exit_net() (Shigeru Yoshida)   
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis) [Orabug: 35814456] {CVE-2023-4921}
  - af_unix: Fix data race around sk->sk_err. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around sk->sk_shutdown. (Kuniyuki Iwashima)   
  - af_unix: Fix data-race around unix_tot_inflight. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around user->unix_inflight. (Kuniyuki Iwashima)   
  - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr (Alex Henrie)   
  - igb: disable virtualization features on 82580 (Corinna Vinschen)   
  - net: read sk->sk_family once in sk_mc_loop() (Eric Dumazet)   
  - pwm: lpc32xx: Remove handling of PWM channels (Vladimir Zapolskiy)   
  - watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load (Raag Jadav)   
  - x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() (Sean Christopherson)   
  - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info (Fedor Pchelkin)   
  - clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock (Dmitry Baryshkov)   
  - parisc: led: Reduce CPU overhead for disk & lan LED computation (Helge Deller)   
  - parisc: led: Fix LAN receive and transmit LEDs (Helge Deller)   
  - drm/ast: Fix DRAM init on AST2200 (Thomas Zimmermann)   
  - fbdev/ep93xx-fb: Do not assign to struct fb_info.dev (Thomas Zimmermann)   
  - scsi: qla2xxx: Turn off noisy message log (Quinn Tran)   
  - scsi: qla2xxx: fix inconsistent TMF timeout (Quinn Tran)   
  - crypto: stm32 - fix loop iterating through scatterlist for DMA (Thomas Bourgoin)   
  - pstore/ram: Check start of empty przs during init (Enlin Mu)   
  - net: handle ARPHRD_PPP in dev_is_mac_header_xmit() (Nicolas Dichtel)   
  - X.509: if signature is unsupported skip validation (Thore Sommer)   
  - dccp: Fix out of bounds access in DCCP error handler (Jann Horn)   
  - parisc: Fix /proc/cpuinfo output for lscpu (Helge Deller)   
  - procfs: block chmod on /proc/thread-self/comm (Aleksa Sarai)   
  - Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" (Bjorn Helgaas)   
  - ntb: Fix calculation ntb_transport_tx_free_entry() (Dave Jiang)   
  - ntb: Clean up tx tail index on link down (Dave Jiang)   
  - ntb: Drop packets when qp link is down (Dave Jiang)   
  - media: dvb: symbol fixup for dvb_attach() (Greg Kroah-Hartman)   
  - backlight/lv5207lp: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/bd6107: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/gpio_backlight: Compare against struct fb_info.device (Thomas Zimmermann)   
  - ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() (Gustavo A. R. Silva)   
  - ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (Takashi Iwai)   
  - PM / devfreq: Fix leak in devfreq_dev_release() (Boris Brezillon)   
  - igb: set max size RX buffer when store bad packet is enabled (Radoslaw Tyl) [Orabug: 35924097] {CVE-2023-45871}
  - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU (Eric Dumazet) [Orabug: 35924001] {CVE-2023-42752}
  - dmaengine: ste_dma40: Add missing IRQ check in d40_probe (ruanjinjie)   
  - rpmsg: glink: Add check for kstrdup (Jiasheng Jiang)   
  - HID: multitouch: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu)   
  - Revert "IB/isert: Fix incorrect release of isert connection" (Leon Romanovsky)   
  - amba: bus: fix refcount leak (Peng Fan)   
  - serial: tegra: handle clk prepare error in tegra_uart_hw_init() (Yi Yang)   
  - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (Chengfeng Ye)   
  - scsi: core: Use 32-bit hostnum in scsi_host_lookup() (Tony Battersby)   
  - cgroup:namespace: Remove unused cgroup_namespaces_init() (Lu Jialin)   
  - USB: gadget: f_mass_storage: Fix unused variable warning (Alan Stern)   
  - media: go7007: Remove redundant if statement (Colin Ian King)   
  - dma-buf/sync_file: Fix docs syntax (Rob Clark)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (Oleksandr Natalenko)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (Oleksandr Natalenko)   
  - x86/APM: drop the duplicate APM_MINOR_DEV macro (Randy Dunlap)   
  - scsi: qla4xxx: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: be2iscsi: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() (Lin Ma)   
  - usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() (Xu Yang)   
  - media: mediatek: vcodec: Return NULL if no vdec_fb is found (Irui Wang)   
  - media: cx24120: Add retval check for cx24120_message_send() (Daniil Dulov)   
  - media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() (Christophe JAILLET)   
  - media: dib7000p: Fix potential division by zero (Daniil Dulov)   
  - drivers: usb: smsusb: fix error handling code in smsusb_init_device (Dongliang Mu)   
  - NFSD: da_addr_body field missing in some GETDEVICEINFO replies (Chuck Lever)   
  - fs: lockd: avoid possible wrong NULL parameter (Su Hui)   
  - jfs: validate max amount of blocks before allocation. (Alexei Filippov)   
  - powerpc/iommu: Fix notifiers being shared by PCI and VIO buses (Russell Currey)   
  - nfs/blocklayout: Use the passed in gfp flags (Dan Carpenter)   
  - wifi: ath10k: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: pciehp: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: Mark NVIDIA T4 GPUs to avoid bus reset (Wu Zongyong)   
  - clk: sunxi-ng: Modify mismatched function name (Zhang Jianhua)   
  - drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() (Minjie Du)   
  - ALSA: ac97: Fix possible error value of *rac97 (Su Hui)   
  - audit: fix possible soft lockup in __audit_inode_child() (Gaosheng Cui)   
  - smackfs: Prevent underflow in smk_set_cipso() (Dan Carpenter)   
  - of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() (Ruan Jinjie)   
  - drm: adv7511: Fix low refresh rate register for ADV7533/5 (Bogdan Togorean)   
  - ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: BCM53573: Add cells sizes to PCIe node (Rafał Miłecki)   
  - netrom: Deny concurrent connect(). (Kuniyuki Iwashima)   
  - net: arcnet: Do not call kfree_skb() under local_irq_disable() (Jinjie Ruan)   
  - wifi: ath9k: use IS_ERR() with debugfs_create_dir() (Wang Ming)   
  - wifi: mwifiex: avoid possible NULL skb pointer dereference (Dmitry Antipov)   
  - wifi: ath9k: protect WMI command response buffer replacement with a lock (Fedor Pchelkin)   
  - wifi: mwifiex: Fix missed return in oob checks failed path (Polaris Pi)   
  - wifi: mwifiex: fix memory leak in mwifiex_histogram_read() (Dmitry Antipov)   
  - fs: ocfs2: namei: check return value of ocfs2_add_entry() (Artem Chernyshev)   
  - lwt: Check LWTUNNEL_XMIT_CONTINUE strictly (Yan Zhai)   
  - crypto: caam - fix unchecked return value error (Gaurav Jain)   
  - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Menglong Dong)   
  - Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (Yuanjun Gong)   
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Polaris Pi)   
  - can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM (Marc Kleine-Budde)   
  - spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() (Zhang Shurong)   
  - regmap: rbtree: Use alloc_flags for memory allocations (Dan Carpenter)   
  - cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() (Liao Chang)   
  - fs: Fix error checking for d_hash_and_lookup() (Wang Ming)   
  - reiserfs: Check the return value from __getblk() (Matthew Wilcox)   
  - Revert "net: macsec: preserve ingress frame ordering" (Sabrina Dubroca)   
  - udf: Handle error when adding extent to a file (Jan Kara)   
  - udf: Check consistency of Space Bitmap Descriptor (Vladislav Efanov)   
  - powerpc/32s: Fix assembler warning about r0 (Christophe Leroy)   
  - powerpc/32: Include .branch_lt in data section (Joel Stanley)   
  - ALSA: seq: oss: Fix racy open/close of MIDI devices (Takashi Iwai)   
  - cifs: add a warning when the in-flight count goes negative (Shyam Prasad N)   
  - sctp: handle invalid error codes without calling BUG() (Dan Carpenter)   
  - bnx2x: fix page fault following EEH recovery (David Christensen)   
  - netlabel: fix shift wrapping bug in netlbl_catmap_setlong() (Dmitry Mastykin)   
  - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock (Chengfeng Ye)   
  - idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM (Baoquan He)   
  - net: usb: qmi_wwan: add Quectel EM05GV2 (Martin Kohn)   
  - security: keys: perform capable check only on privileged operations (Christian Göttsche)   
  - ASoc: codecs: ES8316: Fix DMIC config (Edgar)   
  - fs/nls: make load_nls() take a const parameter (Saeed Mirzamohammadi)   
  - s390/dasd: use correct number of retries for ERP requests (Stefan Haberland)   
  - m68k: Fix invalid .section syntax (Ben Hutchings)   
  - ethernet: atheros: fix return value check in atl1c_tso_csum() (Yuanjun Gong)   
  - ASoC: da7219: Flush pending AAD IRQ when suspending (Dmytro Maluka)   
  - 9p: virtio: make sure 'offs' is initialized in zc_request (Dominique Martinet)   
  - lib/ubsan: remove returns-nonnull-attribute checks (Andrey Ryabinin)   
  - pinctrl: amd: Don't show `Invalid config param` errors (Mario Limonciello)   
  - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (Ryusuke Konishi)   
  - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() (Ryusuke Konishi)   
  - serial: sc16is7xx: fix bug when first setting GPIO direction (Hugo Villeneuve)   
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (Zheng Wang) [Orabug: 35282808] {CVE-2023-1989}
  - HID: wacom: remove the battery when the EKR is off (Aaron Armstrong Skomra)   
  - USB: serial: option: add FOXCONN T99W368/T99W373 product (Slark Xiao)   
  - USB: serial: option: add Quectel EM05G variant (0x030e) (Martin Kohn)   
  - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules (Christoph Hellwig)   
  - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff (Christoph Hellwig)   
  - mmc: au1xmmc: force non-modular build and remove symbol_get usage (Christoph Hellwig)   
  - ARM: pxa: remove use of symbol_get() (Arnd Bergmann)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.2.el7uek]
changelog:
  - x86: change default to spec_store_bypass_disable=prctl spectre_v2_user=prctl (Andrea Arcangeli)  [Orabug: 35905888]  
  - LTS version: 4.14.328 (Saeed Mirzamohammadi)   
  - Bluetooth: hci_event: Fix using memcmp when comparing keys (Luiz Augusto von Dentz)   
  - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (Kees Cook)   
  - Bluetooth: hci_sock: fix slab oob read in create_monitor_event (Edward AD)   
  - gpio: vf610: set value before the direction to avoid a glitch (Haibo Chen)   
  - s390/pci: fix iommu bitmap allocation (Niklas Schnelle)   
  - perf: Disallow mis-matched inherited group reads (Saeed Mirzamohammadi)   
  - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (Puliang Lu)   
  - USB: serial: option: add entry for Sierra EM9191 with new firmware (Benoît Monin)   
  - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (Fabio Porcedda)   
  - ACPI: irq: Fix incorrect return value in acpi_register_gsi() (Sunil V L)   
  - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" (Andy Shevchenko)   
  - mmc: core: Capture correct oemid-bits for eMMC cards (Avri Altman)   
  - sky2: Make sure there is at least one frag_addr available (Kees Cook)   
  - wifi: cfg80211: avoid leaking stack data into trace (Benjamin Berg)   
  - wifi: mac80211: allow transmitting EAPOL frames with tainted key (Wen Gong)   
  - Bluetooth: hci_core: Fix build warnings (Luiz Augusto von Dentz)   
  - Bluetooth: Avoid redundant authentication (Ying Hsu)   
  - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (Ma Ke)   
  - tracing: relax trace_event_eval_update() execution with cond_resched() (Clément Léger)   
  - ata: libata-eh: Fix compilation warning in ata_eh_link_report() (Damien Le Moal)   
  - gpio: timberdale: Fix potential deadlock on &tgpio->lock (Chengfeng Ye)   
  - overlayfs: set ctime when setting mtime and atime (Jeff Layton)   
  - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (Heiner Kallweit)   
  - btrfs: initialize start_slot in btrfs_log_prealloc_extents (Josef Bacik)   
  - ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone (Tony Lindgren)   
  - i40e: prevent crash on probe if hw registers have invalid values (Michal Schmidt)   
  - net: usb: smsc95xx: Fix an error code in smsc95xx_reset() (Dan Carpenter)   
  - net: rfkill: gpio: prevent value glitch during probe (Josua Mayer)   
  - net: ipv6: fix return value check in esp_remove_trailer (Ma Ke)   
  - net: ipv4: fix return value check in esp_remove_trailer (Ma Ke)   
  - xfrm: fix a data-race in xfrm_gen_index() (Saeed Mirzamohammadi)   
  - netfilter: nft_payload: fix wrong mac header matching (Florian Westphal)   
  - KVM: x86: Mask LVTPC when handling a PMI (Jim Mattson)   
  - regmap: fix NULL deref on lookup (Johan Hovold)   
  - nfc: nci: fix possible NULL pointer dereference in send_acknowledge() (Krzysztof Kozlowski)   
  - Bluetooth: avoid memcmp() out of bounds warning (Arnd Bergmann)   
  - Bluetooth: hci_event: Fix coding style (Luiz Augusto von Dentz)   
  - Bluetooth: vhci: Fix race when opening vhci device (Arkadiusz Bokowy)   
  - Bluetooth: Fix a refcnt underflow problem for hci_conn (Ziyang Xuan)   
  - Bluetooth: Reject connection with the device which has same BD_ADDR (Lee, Chun-Yi)   
  - Bluetooth: hci_event: Ignore NULL link key (Lee, Chun-Yi)   
  - usb: hub: Guard against accesses to uninitialized BOS descriptors (Ricardo Cañuelo)   
  - x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs (Borislav Petkov (AMD))   
  - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call (Krishna Kurapati)   
  - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio (Piyush Mehta)   
  - pinctrl: avoid unsafe code pattern in find_pinctrl() (Dmitry Torokhov)   
  - cgroup: Remove duplicates in cgroup v1 tasks file (Michal Koutný)   
  - Input: xpad - add PXN V900 support (Matthias Berndt)   
  - Input: powermate - fix use-after-free in powermate_config_complete (Javier Carrasco)   
  - ceph: fix incorrect revoked caps assert in ceph_fill_file_size() (Xiubo Li)   
  - mcb: remove is_added flag from mcb_device struct (Jorge Sanjuan Garcia)   
  - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug (Alexander Zangerl)   
  - iio: pressure: bmp280: Fix NULL pointer exception (Phil Elwell)   
  - usb: musb: Modify the "HWVers" register address (Xingxing Luo)   
  - usb: musb: Get the musb_qh poniter after musb_giveback (Xingxing Luo)   
  - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read (Javier Carrasco)   
  - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer (Wesley Cheng)   
  - workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() (Waiman Long)   
  - nfc: nci: assert requested protocol is valid (Jeremy Cline)   
  - ixgbe: fix crash with empty VF macvlan list (Dan Carpenter)   
  - drm/vmwgfx: fix typo of sizeof argument (Konstantin Meskhidze)   
  - ieee802154: ca8210: Fix a potential UAF in ca8210_probe (Dinghao Liu)   
  - drm: etvnaviv: fix bad backport leading to warning (Martin Fuzzey)   
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (Hans de Goede)   
  - RDMA/cxgb4: Check skb value for failure to allocate (Artem Chernyshev)   
  - LTS version: 4.14.327 (Saeed Mirzamohammadi)   
  - parisc: Restore __ldcw_align for PA-RISC 2.0 processors (John David Anglin)   
  - RDMA/mlx5: Fix NULL string error (Shay Drory)   
  - RDMA/cma: Fix truncation compilation warning in make_cma_ports (Leon Romanovsky)   
  - gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() (Bartosz Golaszewski)   
  - IB/mlx4: Fix the size of a buffer in add_port_entries() (Christophe JAILLET)   
  - cpupower: add Makefile dependencies for install targets (Ivan Babrou)   
  - sctp: update hb timer immediately after users change hb_interval (Xin Long)   
  - sctp: update transport state when processing a dupcook packet (Xin Long)   
  - tcp: fix delayed ACKs for MSS boundary condition (Neal Cardwell)   
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Shigeru Yoshida)   
  - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (David Howells)   
  - modpost: add missing else to the "of" check (Mauricio Faria de Oliveira)   
  - scsi: target: core: Fix deadlock due to recursive locking (Junxiao Bi)   
  - regmap: rbtree: Fix wrong register marked as in-cache when creating new node (Richard Fitzgerald)   
  - drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close() (Alexandra Diupina)   
  - ubi: Refuse attaching if mtd's erasesize is 0 (Zhihao Cheng)   
  - wifi: mwifiex: Fix tlv_buf_left calculation (Gustavo A. R. Silva)   
  - scsi: zfcp: Fix a double put in zfcp_port_enqueue() (Dinghao Liu)   
  - media: dvb: symbol fixup for dvb_attach() - again (Greg Kroah-Hartman)   
  - ata: libata: disallow dev-initiated LPM transitions to unsupported states (Niklas Cassel)   
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Budimir Markovic) [Orabug: 35810543] {CVE-2023-4623}
  - ext4: fix rec_len verify error (Shida Zhang)   
  - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (George Kennedy)   
  - fs: binfmt_elf_efpic: fix personality for ELF-FDPIC (Greg Ungerer)   
  - ata: libata-sata: increase PMP SRST timeout to 10s (Matthias Schiffer)   
  - ata: libata-core: Fix port and device removal (Damien Le Moal)   
  - ata: libata-core: Fix ata_port_request_pm() locking (Damien Le Moal)   
  - btrfs: properly report 0 avail for very full file systems (Josef Bacik)   
  - i2c: i801: unregister tco_pdev in i801_probe() error path (Heiner Kallweit)   
  - ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES (Niklas Cassel)   
  - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() (Pan Bian)   
  - serial: 8250_port: Check IRQ data before use (Andy Shevchenko)   
  - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Mika Westerberg)   
  - watchdog: iTCO_wdt: No need to stop the timer in probe (Mika Westerberg)   
  - ata: libahci: clear pending interrupt status (Szuying Chen)   
  - ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones (Hannes Reinecke)   
  - fbdev/sh7760fb: Depend on FB=y (Thomas Zimmermann)   
  - ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset() (Niklas Cassel)   
  - ring-buffer: Avoid softlockup in ring_buffer_resize() (Zheng Yejian)   
  - selftests/ftrace: Correctly enable event in instance-event.tc (Zheng Yejian)   
  - parisc: irq: Make irq_stack_union static to avoid sparse warning (Helge Deller)   
  - parisc: iosapic.c: Fix sparse warnings (Helge Deller)   
  - parisc: sba: Fix compile warning wrt list of SBA devices (Helge Deller)   
  - xtensa: boot/lib: fix function prototypes (Max Filippov)   
  - xtensa: boot: don't add include-dirs (Randy Dunlap)   
  - clk: tegra: fix error return case for recalc_rate (Timo Alho)   
  - i2c: mux: demux-pinctrl: check the return value of devm_kstrdup() (Xiaoke Wang)   
  - gpio: tb10x: Fix an error handling path in tb10x_gpio_probe() (Christophe JAILLET)   
  - team: fix null-ptr-deref when team device type is changed (Ziyang Xuan)   
  - powerpc/perf/hv-24x7: Update domain value check (Kajol Jain)   
  - ipv4: fix null-deref in ipv4_link_failure (Kyle Zeng)   
  - NFS/pNFS: Report EINVAL errors from connect() to the server (Trond Myklebust)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.3.el7uek]
changelog:
  - Revert "mmc: core: Capture correct oemid-bits for eMMC cards" (Dominique Martinet)   
  - media: dvb-usb-v2: af9035: fix missing unlock (Hans Verkuil)   
  - perf/core: Fix potential NULL deref (Peter Zijlstra)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.3.1.el7uek]
changelog:
  - KVM: x86: Don't unnecessarily force masterclock update on vCPU hotplug (Sean Christopherson)  [Orabug: 36148712]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.533.1.el7uek]
changelog:
  - vhost-scsi: fix vqs allocation memory corruption (Dongli Zhang)  [Orabug: 36110885]  
  - xfs: try to avoid allocation blocking on busy extents (Mark Tinguely)  [Orabug: 35960820]  
  - KVM: x86: Don't unnecessarily force masterclock update on vCPU hotplug (Sean Christopherson)  [Orabug: 35910097]


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.533.2.el7uek]
changelog:
  - LTS version: 4.14.334 (Yifei Liu)   
  - powerpc/ftrace: Fix stack teardown in ftrace_no_trace (Naveen N Rao)   
  - powerpc/ftrace: Create a dummy stackframe to fix stack unwind (Naveen N Rao)   
  - ring-buffer: Fix memory leak of free page (Steven Rostedt (Google))   
  - team: Fix use-after-free when an option instance allocation fails (Florent Revest)   
  - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS (Baokun Li)   
  - HID: hid-asus: add const to read-only outgoing usb buffer (Denis Benato)   
  - net: usb: qmi_wwan: claim interface 4 for ZTE MF290 (Lech Perczak)   
  - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation (Linus Torvalds)   
  - HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad (Aoba K)   
  - HID: hid-asus: reset the backlight brightness level on resume (Denis Benato)   
  - platform/x86: intel_telemetry: Fix kernel doc descriptions (Andy Shevchenko)   
  - bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (Coly Li)   
  - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" (Ming Lei)   
  - appletalk: Fix Use-After-Free in atalk_ioctl (Hyunwoo Kim)   
  - vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() (Nikolay Kuratov)   
  - sign-file: Fix incorrect return values check (Yusong Gao)   
  - net: Remove acked SYN flag from packet in the transmit queue correctly (Dong Chenchen)   
  - qed: Fix a potential use-after-free in qed_cxt_tables_alloc (Dinghao Liu)   
  - net/rose: Fix Use-After-Free in rose_ioctl (Hyunwoo Kim)   
  - atm: Fix Use-After-Free in do_vcc_ioctl (Hyunwoo Kim)   
  - atm: solos-pci: Fix potential deadlock on &tx_queue_lock (Chengfeng Ye)   
  - atm: solos-pci: Fix potential deadlock on &cli_queue_lock (Chengfeng Ye)   
  - qca_spi: Fix reset behavior (Stefan Wahren)   
  - qca_debug: Fix ethtool -G iface tx behavior (Stefan Wahren)   
  - qca_debug: Prevent crash on TX ring changes (Stefan Wahren)   
  - LTS version: 4.14.333 (Yifei Liu)   
  - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group (Ido Schimmel)   
  - psample: Require 'CAP_NET_ADMIN' when joining "packets" group (Ido Schimmel)   
  - genetlink: add CAP_NET_ADMIN test for multicast bind (Ido Schimmel)   
  - netlink: don't call ->netlink_bind with table lock held (Ido Schimmel)   
  - nilfs2: fix missing error check for sb_set_blocksize call (Ryusuke Konishi)   
  - KVM: s390/mm: Properly reset no-dat (Claudio Imbrenda)   
  - serial: 8250_omap: Add earlycon support for the AM654 UART controller (Ronald Wahl)   
  - serial: sc16is7xx: address RX timeout interrupt errata (Daniel Mack)   
  - parport: Add support for Brainboxes IX/UC/PX parallel cards (Cameron Williams)   
  - packet: Move reference count in packet_sock to atomic_long_t (Daniel Borkmann)   
  - tracing: Fix a possible race when disabling buffered events (Petr Pavlu)   
  - tracing: Fix incomplete locking when disabling buffered events (Petr Pavlu)   
  - tracing: Always update snapshot buffer size (Steven Rostedt (Google))   
  - nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() (Ryusuke Konishi)   
  - ALSA: pcm: fix out-of-bounds in snd_pcm_state_names (Jason Zhang)   
  - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() (Dinghao Liu)   
  - tracing: Fix a warning when allocating buffered events fails (Petr Pavlu)   
  - hwmon: (acpi_power_meter) Fix 4.29 MW bug (Armin Wolf)   
  - RDMA/bnxt_re: Correct module description string (Kalesh AP)   
  - tcp: do not accept ACK of bytes we never sent (Eric Dumazet)   
  - net: hns: fix fake link up on xge port (Yonglong Liu)   
  - drm/amdgpu: correct chunk_ptr to a pointer to chunk. (YuanShang)   
  - tg3: Increment tx_dropped in tg3_tso_bug() (Alex Pakhunov)   
  - tg3: Move the [rt]x_dropped counters to tg3_napi (Alex Pakhunov)   
  - LTS version: 4.14.332 (Yifei Liu)   
  - driver core: Release all resources during unbind before updating device links (Saravana Kannan)   
  - net: ravb: Start TX queues after HW initialization succeeded (Claudiu Beznea)   
  - ravb: Fix races between ravb_tx_timeout_work() and net related ops (Yoshihiro Shimoda)   
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet (Zhengchao Shao)   
  - btrfs: send: ensure send_fd is writable (Jann Horn)   
  - btrfs: fix off-by-one when checking chunk map includes logical address (Filipe Manana)   
  - powerpc: Don't clobber f0/vs0 during fp|altivec register save (Timothy Pearson)   
  - dm verity: don't perform FEC for failed readahead IO (Wu Bo)   
  - dm-verity: align struct dm_verity_fec_io properly (Mikulas Patocka)   
  - firewire: core: fix possible memory leak in create_units() (Yang Yingliang)   
  - pinctrl: avoid reload of p state in list iteration (Maria Yu)   
  - usb: dwc3: set the dma max_seg_size (Ricardo Ribalda)   
  - USB: serial: option: don't claim interface 4 for ZTE MF290 (Lech Perczak)   
  - USB: serial: option: fix FM101R-GL defines (Puliang Lu)   
  - USB: serial: option: add Fibocom L7xx modules (Victor Fragoso)   
  - bcache: prevent potential division by zero error (Rand Deeb)   
  - bcache: check return value from btree_node_alloc_replacement() (Coly Li)   
  - USB: serial: option: add Luat Air72*U series products (Asuna Yang)   
  - s390/dasd: protect device queue against concurrent access (Jan Höppner)   
  - mtd: rawnand: brcmnand: Fix ecc chunk calculation for erased page bitfips (Claire Lin)   
  - net: axienet: Fix check for partial TX checksum (Samuel Holland)   
  - amd-xgbe: propagate the correct speed and duplex status (Raju Rangoju)   
  - amd-xgbe: handle corner-case during sfp hotplug (Raju Rangoju)   
  - arm/xen: fix xen_vcpu_info allocation alignment (Stefano Stabellini)   
  - net: usb: ax88179_178a: fix failed operations during ax88179_reset (Jose Ignacio Tornos Martinez)   
  - ipv4: Correct/silence an endian warning in __ip_do_redirect (Kunwu Chan)   
  - drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full (Jonas Karlman)   
  - ata: pata_isapnp: Add missing error check for devm_ioport_map() (Chen Ni)   
  - drm/panel: simple: Fix Innolux G101ICE-L01 timings (Marek Vasut)   
  - RDMA/irdma: Prevent zero-length STAG registration (Christopher Bednarz)   
  - LTS version: 4.14.331 (Yifei Liu)   
  - net: sched: fix race condition in qdisc_graft() (Eric Dumazet)   
  - scsi: virtio_scsi: limit number of hw queues by nr_cpu_ids (Dongli Zhang)   
  - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (Kemeng Shi)   
  - ext4: correct return value of ext4_convert_meta_bg (Kemeng Shi)   
  - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Kemeng Shi)   
  - ext4: apply umask if ACL support is disabled (Max Kellermann)   
  - media: venus: hfi: fix the check to handle session buffer requirement (Vikash Garodia)   
  - media: sharp: fix sharp encoding (Sean Young)   
  - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte (Heiner Kallweit)   
  - net: dsa: lan9303: consequently nested-lock physical MDIO (Alexander Sverdlin)   
  - ALSA: info: Fix potential deadlock at disconnection (Takashi Iwai)   
  - parisc/pgtable: Do not drop upper 5 address bits of physical address (Helge Deller)   
  - parisc: Prevent booting 64-bit kernels on PA1.x machines (Helge Deller)   
  - mcb: fix error handling for different scenarios when parsing (Sanjuán García, Jorge)   
  - jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev (Zhihao Cheng)   
  - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware (Herve Codina)   
  - mmc: meson-gx: Remove setting of CMD_CFG_ERROR (Rong Chen)   
  - PM: hibernate: Clean up sync_read handling in snapshot_write_next() (Brian Geffon)   
  - PM: hibernate: Use __get_safe_page() rather than touching the list (Brian Geffon)   
  - mmc: vub300: fix an error code (Dan Carpenter)   
  - PCI/sysfs: Protect driver's D3cold preference from user space (Lukas Wunner)   
  - hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (David Woodhouse)   
  - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() (Paul Moore)   
  - audit: don't take task_lock() in audit_exe_compare() code path (Paul Moore)   
  - KVM: x86: Ignore MSR_AMD64_TW_CFG access (Maciej S. Szmigiero)   
  - randstruct: Fix gcc-plugin performance mode to stay in group (Kees Cook)   
  - media: venus: hfi: add checks to perform sanity on queue pointers (Vikash Garodia)   
  - pwm: Fix double shift bug (Dan Carpenter)   
  - gfs2: ignore negated quota changes (Bob Peterson)   
  - media: vivid: avoid integer overflow (Hans Verkuil)   
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Rajeshwar R Shinde)   
  - i2c: sun6i-p2wi: Prevent potential division by zero (Axel Lin)   
  - tty: vcc: Add check for kstrdup() in vcc_probe() (Yi Yang)   
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (Wenchao Hao)   
  - atm: iphase: Do PCI error checks on own line (Ilpo Järvinen)   
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream (Cezary Rojewski)   
  - jfs: fix array-index-out-of-bounds in diAlloc (Manas Ghandat)   
  - jfs: fix array-index-out-of-bounds in dbFindLeaf (Manas Ghandat)   
  - fs/jfs: Add validity check for db_maxag and db_agpref (Juntong Deng)   
  - fs/jfs: Add check for negative db_l2nbperpage (Juntong Deng)   
  - RDMA/hfi1: Use FIELD_GET() to extract Link Width (Ilpo Järvinen)   
  - crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin)   
  - selftests/efivarfs: create-read: fix a resource leak (zhujun2)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (Mario Limonciello)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (Mario Limonciello)   
  - net: annotate data-races around sk->sk_dst_pending_confirm (Eric Dumazet)   
  - wifi: ath10k: fix clang-specific fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix clang-specific fortify warnings (Dmitry Antipov)   
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Ping-Ke Shih)   
  - x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size (Mike Rapoport (IBM))   
  - clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware (Ronald Wahl)   
  - clocksource/drivers/timer-imx-gpt: Fix potential memory leak (Jacky Bai)   
  - locking/ww_mutex/test: Fix potential workqueue corruption (John Stultz)   
  - LTS version: 4.14.330 (Yifei Liu)   
  - btrfs: use u64 for buffer sizes in the tree search ioctls (Filipe Manana)   
  - fbdev: fsl-diu-fb: mark wr_reg_wa() static (Arnd Bergmann)   
  - netfilter: xt_recent: fix (increase) ipv6 literal buffer length (Maciej Żenczykowski)   
  - tg3: power down device only on SYSTEM_POWER_OFF (George Shuklin)   
  - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. (Kuniyuki Iwashima)   
  - dccp: Call security_inet_conn_request() after setting IPv4 addresses. (Kuniyuki Iwashima)   
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Shigeru Yoshida)   
  - llc: verify mac len before reading mac header (Willem de Bruijn)   
  - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume (Florian Fainelli)   
  - media: s3c-camif: Avoid inappropriate kfree() (Katya Orlova)   
  - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: ds: fix refcount leak in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: cs: fix possible hung task and memory leak pccardd() (Yang Yingliang)   
  - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() (Christophe JAILLET)   
  - USB: usbip: fix stub_dev hub disconnect (Jonas Blixt)   
  - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave() (Jinjie Ruan)   
  - dmaengine: ti: edma: handle irq_of_parse_and_map() errors (Dan Carpenter)   
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (Jia-Ju Bai)   
  - tty: tty_jobctrl: fix pid memleak in disassociate_ctty() (Yi Yang)   
  - mfd: dln2: Fix double put in dln2_probe (Dinghao Liu)   
  - ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails (Cezary Rojewski)   
  - sh: bios: Revive earlyprintk support (Geert Uytterhoeven)   
  - RDMA/hfi1: Workaround truncation compilation error (Leon Romanovsky)   
  - ext4: move 'ix' sanity check to corrent position (Gou Hao)   
  - ARM: 9321/1: memset: cast the constant byte to unsigned char (Kursad Oney)   
  - hwrng: geode - fix accessing registers (Jonas Gorski)   
  - firmware: ti_sci: Mark driver as non removable (Dhruva Gole)   
  - ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator (Krzysztof Kozlowski)   
  - drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe() (Christophe JAILLET)   
  - drm/radeon: possible buffer overflow (Konstantin Meskhidze)   
  - drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs (Jonas Karlman)   
  - platform/x86: wmi: Fix probe failure when failing to register WMI devices (Armin Wolf)   
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: keystone: pll: fix a couple NULL vs IS_ERR() checks (Dan Carpenter)   
  - clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies (Devi Priya)   
  - ipv6: avoid atomic fragment on GSO packets (Yan Zhai)   
  - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() (Christophe JAILLET)   
  - thermal: core: prevent potential string overflow (Dan Carpenter)   
  - wifi: rtlwifi: fix EDCA limit set by BT coexistence (Dmitry Antipov)   
  - tcp_metrics: do not create an entry from tcp_init_metrics() (Eric Dumazet)   
  - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics() (Eric Dumazet)   
  - i40e: fix potential memory leaks in i40e_remove() (Andrii Staikov)   
  - LTS version: 4.14.329 (Yifei Liu)   
  - tty: 8250: Add support for Intashield IS-100 (Cameron Williams)   
  - tty: 8250: Add support for Brainboxes UP cards (Cameron Williams)   
  - tty: 8250: Add support for additional Brainboxes UC cards (Cameron Williams)   
  - tty: 8250: Remove UC-257 and UC-431 (Cameron Williams)   
  - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility (LihaSika)   
  - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device (Vicki Pfau)   
  - remove the sx8 block driver (Christoph Hellwig)   
  - ata: ahci: fix enum constants for gcc-13 (Arnd Bergmann)   
  - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw (Su Hui)   
  - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e (Hans de Goede)   
  - scsi: mpt3sas: Fix in error path (Tomas Henzl)   
  - fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit() (Jorge Maidana)   
  - ASoC: rt5650: fix the wrong result of key button (Shuming Fan)   
  - netfilter: nfnetlink_log: silence bogus compiler warning (Florian Westphal)   
  - fbdev: atyfb: only use ioremap_uc() on i386 and ia64 (Arnd Bergmann)   
  - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport (Dmitry Torokhov)   
  - dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe (Zhang Shurong)   
  - irqchip/stm32-exti: add missing DT IRQ flag translation (Ben Wolsieffer)   
  - ASoC: simple-card: fixup asoc_simple_probe() error handling (Kuninori Morimoto)   
  - x86: Fix .brk attribute in linker script (Juergen Gross)   
  - rpmsg: Fix possible refcount leak in rpmsg_register_device_override() (Hangyu Hua)   
  - rpmsg: glink: Release driver_override (Bjorn Andersson)   
  - rpmsg: Fix calling device_lock() on non-initialized device (Krzysztof Kozlowski)   
  - rpmsg: Fix kfree() of static memory on setting driver_override (Krzysztof Kozlowski)   
  - driver: platform: Add helper for safer setting of driver_override (Krzysztof Kozlowski)   
  - x86/mm: Fix RESERVE_BRK() for older binutils (Josh Poimboeuf)   
  - x86/mm: Simplify RESERVE_BRK() (Josh Poimboeuf)   
  - x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility (Thomas Gleixner)   
  - nfsd: lock_rename() needs both directories to live on the same fs (Al Viro)   
  - f2fs: fix to do sanity check on inode type during garbage collection (Chao Yu)   
  - kobject: Fix slab-out-of-bounds in fill_kobj_path() (Wang Hai)   
  - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper() (Lukasz Majczak)   
  - ARM: 8933/1: replace Sun/Solaris style flag on section directive (Nick Desaulniers)   
  - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (Ivan Vecera)   
  - gtp: uapi: fix GTPA_MAX (Pablo Neira Ayuso)   
  - tcp: fix wrong RTO timeout when received SACK reneging (Fred Chen)   
  - r8152: Increase USB control msg timeout to 5000ms as per spec (Douglas Anderson)   
  - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry (Mateusz Palczewski)   
  - treewide: Spelling fix in comment (Kunwu Chan)   
  - virtio_balloon: Fix endless deflation and inflation on arm64 (Gavin Shan)   
  - mcb-lpc: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - mcb: Return actual parsed size when reading chameleon table (Rodríguez Barbarin, José Javier)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.533.3.el7uek]
changelog:
  - net: rfkill: gpio: set GPIO direction (Rouven Czerwinski)   
  - sched/fair: Fix tg->load when offlining a CPU (Vincent Guittot)  [Orabug: 36185208]  
  - IB/cm: Cancel mad on the DREQ event when the state is MRA_REP_RCVD (Mark Zhang)  [Orabug: 36143229]  
  - sched/rt: pick_next_rt_entity(): check list_entry (Pietro Borrello)  [Orabug: 35181559]  {CVE-2023-1077}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.531.1.el7uek]
changelog:
  - ocfs2: ocfs2 crash due to invalid h_next_leaf_blk value in extent block (Gautham Ananthakrishna)  [Orabug: 35859332]  
  - bnxt_en: fix NULL dereference in bnxt_flash_package_from_file() (Samasth Norway Ananda)  [Orabug: 35848949]  
  - LTS version: v4.14.326 (Saeed Mirzamohammadi)   
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (valis) [Orabug: 35814287] {CVE-2023-4207} {CVE-2023-4128}
  - mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write (William Zhang)   
  - mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller (William Zhang)   
  - mtd: rawnand: brcmnand: Fix potential false time out warning (William Zhang)   
  - mtd: rawnand: brcmnand: Fix crash during the panic_write (William Zhang)   
  - nfsd: fix change_info in NFSv4 RENAME replies (Jeff Layton)   
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (Filipe Manana)   
  - attr: block mode changes of symlinks (Christian Brauner)   
  - md/raid1: fix error: ISO C90 forbids mixed declarations (Nigel Croxon)   
  - kobject: Add sanity check for kset->kobj.ktype in kset_register() (Zhen Lei)   
  - serial: cpm_uart: Avoid suspicious locking (Christophe Leroy)   
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (Konstantin Shelekhin)   
  - usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc (Ma Ke)   
  - media: pci: cx23885: replace BUG with error return (Hans Verkuil)   
  - media: tuners: qt1010: replace BUG_ON with a regular error (Hans Verkuil)   
  - iio: core: Use min() instead of min_t() to make code more robust (Andy Shevchenko)   
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (Zhang Shurong)   
  - media: anysee: fix null-ptr-deref in anysee_master_xfer (Zhang Shurong)   
  - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer (Zhang Shurong)   
  - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() (Zhang Shurong)   
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer (Zhang Shurong)   
  - powerpc/pseries: fix possible memory leak in ibmebus_bus_init() (ruanjinjie)   
  - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (Liu Shixin via Jfs-discussion)   
  - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (Andrew Kanner)   
  - ext2: fix datatype of block number in ext2_xattr_set2() (Georg Ottinger)   
  - md: raid1: fix potential OOB in raid1_remove_disk() (Zhang Shurong)   
  - drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable() (Tuo Li)   
  - alx: fix OOB-read compiler warning (GONG, Ruiqi)   
  - tpm_tis: Resend command to recover from data transfer errors (Alexander Steffen)   
  - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (Mark O'Donovan)   
  - wifi: mwifiex: fix fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix printk specifier (Dongliang Mu)   
  - hw_breakpoint: fix single-stepping when using bpf_overflow_handler (Tomislav Novak)   
  - ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 (Jiri Slaby (SUSE))   
  - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (Abhishek Mainkar)   
  - btrfs: output extra debug info if we failed to find an inline backref (Qu Wenruo)   
  - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Fedor Pchelkin)   
  - parisc: Drop loops_per_jiffy from per_cpu struct (Helge Deller)   
  - kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). (Kuniyuki Iwashima)   
  - ixgbe: fix timestamp configuration code (Vadim Fedorenko)   
  - kcm: Fix memory leak in error path of kcm_sendmsg() (Shigeru Yoshida)   
  - net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() (Hangyu Hua)   
  - ata: pata_ftide010: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - ata: sata_gemini: Add missing MODULE_DESCRIPTION (Damien Le Moal)   
  - igb: Change IGB_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80 (Olga Zaborska)   
  - kcm: Destroy mutex in kcm_exit_net() (Shigeru Yoshida)   
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis) [Orabug: 35814456] {CVE-2023-4921}
  - af_unix: Fix data race around sk->sk_err. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around sk->sk_shutdown. (Kuniyuki Iwashima)   
  - af_unix: Fix data-race around unix_tot_inflight. (Kuniyuki Iwashima)   
  - af_unix: Fix data-races around user->unix_inflight. (Kuniyuki Iwashima)   
  - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr (Alex Henrie)   
  - igb: disable virtualization features on 82580 (Corinna Vinschen)   
  - net: read sk->sk_family once in sk_mc_loop() (Eric Dumazet)   
  - pwm: lpc32xx: Remove handling of PWM channels (Vladimir Zapolskiy)   
  - watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load (Raag Jadav)   
  - x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() (Sean Christopherson)   
  - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info (Fedor Pchelkin)   
  - clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock (Dmitry Baryshkov)   
  - parisc: led: Reduce CPU overhead for disk & lan LED computation (Helge Deller)   
  - parisc: led: Fix LAN receive and transmit LEDs (Helge Deller)   
  - drm/ast: Fix DRAM init on AST2200 (Thomas Zimmermann)   
  - fbdev/ep93xx-fb: Do not assign to struct fb_info.dev (Thomas Zimmermann)   
  - scsi: qla2xxx: Turn off noisy message log (Quinn Tran)   
  - scsi: qla2xxx: fix inconsistent TMF timeout (Quinn Tran)   
  - crypto: stm32 - fix loop iterating through scatterlist for DMA (Thomas Bourgoin)   
  - pstore/ram: Check start of empty przs during init (Enlin Mu)   
  - net: handle ARPHRD_PPP in dev_is_mac_header_xmit() (Nicolas Dichtel)   
  - X.509: if signature is unsupported skip validation (Thore Sommer)   
  - dccp: Fix out of bounds access in DCCP error handler (Jann Horn)   
  - parisc: Fix /proc/cpuinfo output for lscpu (Helge Deller)   
  - procfs: block chmod on /proc/thread-self/comm (Aleksa Sarai)   
  - Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" (Bjorn Helgaas)   
  - ntb: Fix calculation ntb_transport_tx_free_entry() (Dave Jiang)   
  - ntb: Clean up tx tail index on link down (Dave Jiang)   
  - ntb: Drop packets when qp link is down (Dave Jiang)   
  - media: dvb: symbol fixup for dvb_attach() (Greg Kroah-Hartman)   
  - backlight/lv5207lp: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/bd6107: Compare against struct fb_info.device (Thomas Zimmermann)   
  - backlight/gpio_backlight: Compare against struct fb_info.device (Thomas Zimmermann)   
  - ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() (Gustavo A. R. Silva)   
  - ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (Takashi Iwai)   
  - PM / devfreq: Fix leak in devfreq_dev_release() (Boris Brezillon)   
  - igb: set max size RX buffer when store bad packet is enabled (Radoslaw Tyl) [Orabug: 35924097] {CVE-2023-45871}
  - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU (Eric Dumazet) [Orabug: 35924001] {CVE-2023-42752}
  - dmaengine: ste_dma40: Add missing IRQ check in d40_probe (ruanjinjie)   
  - rpmsg: glink: Add check for kstrdup (Jiasheng Jiang)   
  - HID: multitouch: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu)   
  - Revert "IB/isert: Fix incorrect release of isert connection" (Leon Romanovsky)   
  - amba: bus: fix refcount leak (Peng Fan)   
  - serial: tegra: handle clk prepare error in tegra_uart_hw_init() (Yi Yang)   
  - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (Chengfeng Ye)   
  - scsi: core: Use 32-bit hostnum in scsi_host_lookup() (Tony Battersby)   
  - cgroup:namespace: Remove unused cgroup_namespaces_init() (Lu Jialin)   
  - USB: gadget: f_mass_storage: Fix unused variable warning (Alan Stern)   
  - media: go7007: Remove redundant if statement (Colin Ian King)   
  - dma-buf/sync_file: Fix docs syntax (Rob Clark)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (Oleksandr Natalenko)   
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (Oleksandr Natalenko)   
  - x86/APM: drop the duplicate APM_MINOR_DEV macro (Randy Dunlap)   
  - scsi: qla4xxx: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: be2iscsi: Add length check when parsing nlattrs (Lin Ma)   
  - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() (Lin Ma)   
  - usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() (Xu Yang)   
  - media: mediatek: vcodec: Return NULL if no vdec_fb is found (Irui Wang)   
  - media: cx24120: Add retval check for cx24120_message_send() (Daniil Dulov)   
  - media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() (Christophe JAILLET)   
  - media: dib7000p: Fix potential division by zero (Daniil Dulov)   
  - drivers: usb: smsusb: fix error handling code in smsusb_init_device (Dongliang Mu)   
  - NFSD: da_addr_body field missing in some GETDEVICEINFO replies (Chuck Lever)   
  - fs: lockd: avoid possible wrong NULL parameter (Su Hui)   
  - jfs: validate max amount of blocks before allocation. (Alexei Filippov)   
  - powerpc/iommu: Fix notifiers being shared by PCI and VIO buses (Russell Currey)   
  - nfs/blocklayout: Use the passed in gfp flags (Dan Carpenter)   
  - wifi: ath10k: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: pciehp: Use RMW accessors for changing LNKCTL (Ilpo Järvinen)   
  - PCI: Mark NVIDIA T4 GPUs to avoid bus reset (Wu Zongyong)   
  - clk: sunxi-ng: Modify mismatched function name (Zhang Jianhua)   
  - drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() (Minjie Du)   
  - ALSA: ac97: Fix possible error value of *rac97 (Su Hui)   
  - audit: fix possible soft lockup in __audit_inode_child() (Gaosheng Cui)   
  - smackfs: Prevent underflow in smk_set_cipso() (Dan Carpenter)   
  - of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() (Ruan Jinjie)   
  - drm: adv7511: Fix low refresh rate register for ADV7533/5 (Bogdan Togorean)   
  - ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) (Krzysztof Kozlowski)   
  - ARM: dts: BCM53573: Add cells sizes to PCIe node (Rafał Miłecki)   
  - netrom: Deny concurrent connect(). (Kuniyuki Iwashima)   
  - net: arcnet: Do not call kfree_skb() under local_irq_disable() (Jinjie Ruan)   
  - wifi: ath9k: use IS_ERR() with debugfs_create_dir() (Wang Ming)   
  - wifi: mwifiex: avoid possible NULL skb pointer dereference (Dmitry Antipov)   
  - wifi: ath9k: protect WMI command response buffer replacement with a lock (Fedor Pchelkin)   
  - wifi: mwifiex: Fix missed return in oob checks failed path (Polaris Pi)   
  - wifi: mwifiex: fix memory leak in mwifiex_histogram_read() (Dmitry Antipov)   
  - fs: ocfs2: namei: check return value of ocfs2_add_entry() (Artem Chernyshev)   
  - lwt: Check LWTUNNEL_XMIT_CONTINUE strictly (Yan Zhai)   
  - crypto: caam - fix unchecked return value error (Gaurav Jain)   
  - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Menglong Dong)   
  - Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (Yuanjun Gong)   
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Polaris Pi)   
  - can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM (Marc Kleine-Budde)   
  - spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() (Zhang Shurong)   
  - regmap: rbtree: Use alloc_flags for memory allocations (Dan Carpenter)   
  - cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() (Liao Chang)   
  - fs: Fix error checking for d_hash_and_lookup() (Wang Ming)   
  - reiserfs: Check the return value from __getblk() (Matthew Wilcox)   
  - Revert "net: macsec: preserve ingress frame ordering" (Sabrina Dubroca)   
  - udf: Handle error when adding extent to a file (Jan Kara)   
  - udf: Check consistency of Space Bitmap Descriptor (Vladislav Efanov)   
  - powerpc/32s: Fix assembler warning about r0 (Christophe Leroy)   
  - powerpc/32: Include .branch_lt in data section (Joel Stanley)   
  - ALSA: seq: oss: Fix racy open/close of MIDI devices (Takashi Iwai)   
  - cifs: add a warning when the in-flight count goes negative (Shyam Prasad N)   
  - sctp: handle invalid error codes without calling BUG() (Dan Carpenter)   
  - bnx2x: fix page fault following EEH recovery (David Christensen)   
  - netlabel: fix shift wrapping bug in netlbl_catmap_setlong() (Dmitry Mastykin)   
  - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock (Chengfeng Ye)   
  - idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM (Baoquan He)   
  - net: usb: qmi_wwan: add Quectel EM05GV2 (Martin Kohn)   
  - security: keys: perform capable check only on privileged operations (Christian Göttsche)   
  - ASoc: codecs: ES8316: Fix DMIC config (Edgar)   
  - fs/nls: make load_nls() take a const parameter (Saeed Mirzamohammadi)   
  - s390/dasd: use correct number of retries for ERP requests (Stefan Haberland)   
  - m68k: Fix invalid .section syntax (Ben Hutchings)   
  - ethernet: atheros: fix return value check in atl1c_tso_csum() (Yuanjun Gong)   
  - ASoC: da7219: Flush pending AAD IRQ when suspending (Dmytro Maluka)   
  - 9p: virtio: make sure 'offs' is initialized in zc_request (Dominique Martinet)   
  - lib/ubsan: remove returns-nonnull-attribute checks (Andrey Ryabinin)   
  - pinctrl: amd: Don't show `Invalid config param` errors (Mario Limonciello)   
  - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (Ryusuke Konishi)   
  - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() (Ryusuke Konishi)   
  - serial: sc16is7xx: fix bug when first setting GPIO direction (Hugo Villeneuve)   
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (Zheng Wang) [Orabug: 35282808] {CVE-2023-1989}
  - HID: wacom: remove the battery when the EKR is off (Aaron Armstrong Skomra)   
  - USB: serial: option: add FOXCONN T99W368/T99W373 product (Slark Xiao)   
  - USB: serial: option: add Quectel EM05G variant (0x030e) (Martin Kohn)   
  - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules (Christoph Hellwig)   
  - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff (Christoph Hellwig)   
  - mmc: au1xmmc: force non-modular build and remove symbol_get usage (Christoph Hellwig)   
  - ARM: pxa: remove use of symbol_get() (Arnd Bergmann)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.532.2.el7uek]
changelog:
  - x86: change default to spec_store_bypass_disable=prctl spectre_v2_user=prctl (Andrea Arcangeli)  [Orabug: 35905888]  
  - LTS version: 4.14.328 (Saeed Mirzamohammadi)   
  - Bluetooth: hci_event: Fix using memcmp when comparing keys (Luiz Augusto von Dentz)   
  - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (Kees Cook)   
  - Bluetooth: hci_sock: fix slab oob read in create_monitor_event (Edward AD)   
  - gpio: vf610: set value before the direction to avoid a glitch (Haibo Chen)   
  - s390/pci: fix iommu bitmap allocation (Niklas Schnelle)   
  - perf: Disallow mis-matched inherited group reads (Saeed Mirzamohammadi)   
  - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (Puliang Lu)   
  - USB: serial: option: add entry for Sierra EM9191 with new firmware (Benoît Monin)   
  - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (Fabio Porcedda)   
  - ACPI: irq: Fix incorrect return value in acpi_register_gsi() (Sunil V L)   
  - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" (Andy Shevchenko)   
  - mmc: core: Capture correct oemid-bits for eMMC cards (Avri Altman)   
  - sky2: Make sure there is at least one frag_addr available (Kees Cook)   
  - wifi: cfg80211: avoid leaking stack data into trace (Benjamin Berg)   
  - wifi: mac80211: allow transmitting EAPOL frames with tainted key (Wen Gong)   
  - Bluetooth: hci_core: Fix build warnings (Luiz Augusto von Dentz)   
  - Bluetooth: Avoid redundant authentication (Ying Hsu)   
  - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (Ma Ke)   
  - tracing: relax trace_event_eval_update() execution with cond_resched() (Clément Léger)   
  - ata: libata-eh: Fix compilation warning in ata_eh_link_report() (Damien Le Moal)   
  - gpio: timberdale: Fix potential deadlock on &tgpio->lock (Chengfeng Ye)   
  - overlayfs: set ctime when setting mtime and atime (Jeff Layton)   
  - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (Heiner Kallweit)   
  - btrfs: initialize start_slot in btrfs_log_prealloc_extents (Josef Bacik)   
  - ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone (Tony Lindgren)   
  - i40e: prevent crash on probe if hw registers have invalid values (Michal Schmidt)   
  - net: usb: smsc95xx: Fix an error code in smsc95xx_reset() (Dan Carpenter)   
  - net: rfkill: gpio: prevent value glitch during probe (Josua Mayer)   
  - net: ipv6: fix return value check in esp_remove_trailer (Ma Ke)   
  - net: ipv4: fix return value check in esp_remove_trailer (Ma Ke)   
  - xfrm: fix a data-race in xfrm_gen_index() (Saeed Mirzamohammadi)   
  - netfilter: nft_payload: fix wrong mac header matching (Florian Westphal)   
  - KVM: x86: Mask LVTPC when handling a PMI (Jim Mattson)   
  - regmap: fix NULL deref on lookup (Johan Hovold)   
  - nfc: nci: fix possible NULL pointer dereference in send_acknowledge() (Krzysztof Kozlowski)   
  - Bluetooth: avoid memcmp() out of bounds warning (Arnd Bergmann)   
  - Bluetooth: hci_event: Fix coding style (Luiz Augusto von Dentz)   
  - Bluetooth: vhci: Fix race when opening vhci device (Arkadiusz Bokowy)   
  - Bluetooth: Fix a refcnt underflow problem for hci_conn (Ziyang Xuan)   
  - Bluetooth: Reject connection with the device which has same BD_ADDR (Lee, Chun-Yi) [Orabug: 35959597] {CVE-2020-26555}
  - Bluetooth: hci_event: Ignore NULL link key (Lee, Chun-Yi)   
  - usb: hub: Guard against accesses to uninitialized BOS descriptors (Ricardo Cañuelo)   
  - x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs (Borislav Petkov (AMD))   
  - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call (Krishna Kurapati)   
  - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio (Piyush Mehta)   
  - pinctrl: avoid unsafe code pattern in find_pinctrl() (Dmitry Torokhov)   
  - cgroup: Remove duplicates in cgroup v1 tasks file (Michal Koutný)   
  - Input: xpad - add PXN V900 support (Matthias Berndt)   
  - Input: powermate - fix use-after-free in powermate_config_complete (Javier Carrasco)   
  - ceph: fix incorrect revoked caps assert in ceph_fill_file_size() (Xiubo Li)   
  - mcb: remove is_added flag from mcb_device struct (Jorge Sanjuan Garcia)   
  - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug (Alexander Zangerl)   
  - iio: pressure: bmp280: Fix NULL pointer exception (Phil Elwell)   
  - usb: musb: Modify the "HWVers" register address (Xingxing Luo)   
  - usb: musb: Get the musb_qh poniter after musb_giveback (Xingxing Luo)   
  - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read (Javier Carrasco)   
  - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer (Wesley Cheng)   
  - workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() (Waiman Long)   
  - nfc: nci: assert requested protocol is valid (Jeremy Cline)   
  - ixgbe: fix crash with empty VF macvlan list (Dan Carpenter)   
  - drm/vmwgfx: fix typo of sizeof argument (Konstantin Meskhidze)   
  - ieee802154: ca8210: Fix a potential UAF in ca8210_probe (Dinghao Liu)   
  - drm: etvnaviv: fix bad backport leading to warning (Martin Fuzzey)   
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (Hans de Goede)   
  - RDMA/cxgb4: Check skb value for failure to allocate (Artem Chernyshev)   
  - LTS version: 4.14.327 (Saeed Mirzamohammadi)   
  - parisc: Restore __ldcw_align for PA-RISC 2.0 processors (John David Anglin)   
  - RDMA/mlx5: Fix NULL string error (Shay Drory)   
  - RDMA/cma: Fix truncation compilation warning in make_cma_ports (Leon Romanovsky)   
  - gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() (Bartosz Golaszewski)   
  - IB/mlx4: Fix the size of a buffer in add_port_entries() (Christophe JAILLET)   
  - cpupower: add Makefile dependencies for install targets (Ivan Babrou)   
  - sctp: update hb timer immediately after users change hb_interval (Xin Long)   
  - sctp: update transport state when processing a dupcook packet (Xin Long)   
  - tcp: fix delayed ACKs for MSS boundary condition (Neal Cardwell)   
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Shigeru Yoshida)   
  - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (David Howells)   
  - modpost: add missing else to the "of" check (Mauricio Faria de Oliveira)   
  - scsi: target: core: Fix deadlock due to recursive locking (Junxiao Bi)   
  - regmap: rbtree: Fix wrong register marked as in-cache when creating new node (Richard Fitzgerald)   
  - drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close() (Alexandra Diupina)   
  - ubi: Refuse attaching if mtd's erasesize is 0 (Zhihao Cheng)   
  - wifi: mwifiex: Fix tlv_buf_left calculation (Gustavo A. R. Silva)   
  - scsi: zfcp: Fix a double put in zfcp_port_enqueue() (Dinghao Liu)   
  - media: dvb: symbol fixup for dvb_attach() - again (Greg Kroah-Hartman)   
  - ata: libata: disallow dev-initiated LPM transitions to unsupported states (Niklas Cassel)   
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Budimir Markovic) [Orabug: 35810543] {CVE-2023-4623}
  - ext4: fix rec_len verify error (Shida Zhang)   
  - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (George Kennedy)   
  - fs: binfmt_elf_efpic: fix personality for ELF-FDPIC (Greg Ungerer)   
  - ata: libata-sata: increase PMP SRST timeout to 10s (Matthias Schiffer)   
  - ata: libata-core: Fix port and device removal (Damien Le Moal)   
  - ata: libata-core: Fix ata_port_request_pm() locking (Damien Le Moal)   
  - btrfs: properly report 0 avail for very full file systems (Josef Bacik)   
  - i2c: i801: unregister tco_pdev in i801_probe() error path (Heiner Kallweit)   
  - ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES (Niklas Cassel)   
  - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() (Pan Bian)   
  - serial: 8250_port: Check IRQ data before use (Andy Shevchenko)   
  - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Mika Westerberg)   
  - watchdog: iTCO_wdt: No need to stop the timer in probe (Mika Westerberg)   
  - ata: libahci: clear pending interrupt status (Szuying Chen)   
  - ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones (Hannes Reinecke)   
  - fbdev/sh7760fb: Depend on FB=y (Thomas Zimmermann)   
  - ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset() (Niklas Cassel)   
  - ring-buffer: Avoid softlockup in ring_buffer_resize() (Zheng Yejian)   
  - selftests/ftrace: Correctly enable event in instance-event.tc (Zheng Yejian)   
  - parisc: irq: Make irq_stack_union static to avoid sparse warning (Helge Deller)   
  - parisc: iosapic.c: Fix sparse warnings (Helge Deller)   
  - parisc: sba: Fix compile warning wrt list of SBA devices (Helge Deller)   
  - xtensa: boot/lib: fix function prototypes (Max Filippov)   
  - xtensa: boot: don't add include-dirs (Randy Dunlap)   
  - clk: tegra: fix error return case for recalc_rate (Timo Alho)   
  - i2c: mux: demux-pinctrl: check the return value of devm_kstrdup() (Xiaoke Wang)   
  - gpio: tb10x: Fix an error handling path in tb10x_gpio_probe() (Christophe JAILLET)   
  - team: fix null-ptr-deref when team device type is changed (Ziyang Xuan)   
  - powerpc/perf/hv-24x7: Update domain value check (Kajol Jain)   
  - ipv4: fix null-deref in ipv4_link_failure (Kyle Zeng)   
  - NFS/pNFS: Report EINVAL errors from connect() to the server (Trond Myklebust)


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.533.2.el7uek]
changelog:
  - LTS version: 4.14.334 (Yifei Liu)   
  - powerpc/ftrace: Fix stack teardown in ftrace_no_trace (Naveen N Rao)   
  - powerpc/ftrace: Create a dummy stackframe to fix stack unwind (Naveen N Rao)   
  - ring-buffer: Fix memory leak of free page (Steven Rostedt (Google))   
  - team: Fix use-after-free when an option instance allocation fails (Florent Revest)   
  - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS (Baokun Li)   
  - HID: hid-asus: add const to read-only outgoing usb buffer (Denis Benato)   
  - net: usb: qmi_wwan: claim interface 4 for ZTE MF290 (Lech Perczak)   
  - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation (Linus Torvalds)   
  - HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad (Aoba K)   
  - HID: hid-asus: reset the backlight brightness level on resume (Denis Benato)   
  - platform/x86: intel_telemetry: Fix kernel doc descriptions (Andy Shevchenko)   
  - bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (Coly Li)   
  - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" (Ming Lei)   
  - appletalk: Fix Use-After-Free in atalk_ioctl (Hyunwoo Kim)   
  - vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() (Nikolay Kuratov)   
  - sign-file: Fix incorrect return values check (Yusong Gao)   
  - net: Remove acked SYN flag from packet in the transmit queue correctly (Dong Chenchen)   
  - qed: Fix a potential use-after-free in qed_cxt_tables_alloc (Dinghao Liu)   
  - net/rose: Fix Use-After-Free in rose_ioctl (Hyunwoo Kim)   
  - atm: Fix Use-After-Free in do_vcc_ioctl (Hyunwoo Kim)   
  - atm: solos-pci: Fix potential deadlock on &tx_queue_lock (Chengfeng Ye)   
  - atm: solos-pci: Fix potential deadlock on &cli_queue_lock (Chengfeng Ye)   
  - qca_spi: Fix reset behavior (Stefan Wahren)   
  - qca_debug: Fix ethtool -G iface tx behavior (Stefan Wahren)   
  - qca_debug: Prevent crash on TX ring changes (Stefan Wahren)   
  - LTS version: 4.14.333 (Yifei Liu)   
  - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group (Ido Schimmel)   
  - psample: Require 'CAP_NET_ADMIN' when joining "packets" group (Ido Schimmel)   
  - genetlink: add CAP_NET_ADMIN test for multicast bind (Ido Schimmel)   
  - netlink: don't call ->netlink_bind with table lock held (Ido Schimmel)   
  - nilfs2: fix missing error check for sb_set_blocksize call (Ryusuke Konishi)   
  - KVM: s390/mm: Properly reset no-dat (Claudio Imbrenda)   
  - serial: 8250_omap: Add earlycon support for the AM654 UART controller (Ronald Wahl)   
  - serial: sc16is7xx: address RX timeout interrupt errata (Daniel Mack)   
  - parport: Add support for Brainboxes IX/UC/PX parallel cards (Cameron Williams)   
  - packet: Move reference count in packet_sock to atomic_long_t (Daniel Borkmann)   
  - tracing: Fix a possible race when disabling buffered events (Petr Pavlu)   
  - tracing: Fix incomplete locking when disabling buffered events (Petr Pavlu)   
  - tracing: Always update snapshot buffer size (Steven Rostedt (Google))   
  - nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() (Ryusuke Konishi)   
  - ALSA: pcm: fix out-of-bounds in snd_pcm_state_names (Jason Zhang)   
  - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() (Dinghao Liu)   
  - tracing: Fix a warning when allocating buffered events fails (Petr Pavlu)   
  - hwmon: (acpi_power_meter) Fix 4.29 MW bug (Armin Wolf)   
  - RDMA/bnxt_re: Correct module description string (Kalesh AP)   
  - tcp: do not accept ACK of bytes we never sent (Eric Dumazet)   
  - net: hns: fix fake link up on xge port (Yonglong Liu)   
  - drm/amdgpu: correct chunk_ptr to a pointer to chunk. (YuanShang)   
  - tg3: Increment tx_dropped in tg3_tso_bug() (Alex Pakhunov)   
  - tg3: Move the [rt]x_dropped counters to tg3_napi (Alex Pakhunov)   
  - LTS version: 4.14.332 (Yifei Liu)   
  - driver core: Release all resources during unbind before updating device links (Saravana Kannan)   
  - net: ravb: Start TX queues after HW initialization succeeded (Claudiu Beznea)   
  - ravb: Fix races between ravb_tx_timeout_work() and net related ops (Yoshihiro Shimoda)   
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet (Zhengchao Shao)   
  - btrfs: send: ensure send_fd is writable (Jann Horn)   
  - btrfs: fix off-by-one when checking chunk map includes logical address (Filipe Manana)   
  - powerpc: Don't clobber f0/vs0 during fp|altivec register save (Timothy Pearson)   
  - dm verity: don't perform FEC for failed readahead IO (Wu Bo)   
  - dm-verity: align struct dm_verity_fec_io properly (Mikulas Patocka)   
  - firewire: core: fix possible memory leak in create_units() (Yang Yingliang)   
  - pinctrl: avoid reload of p state in list iteration (Maria Yu)   
  - usb: dwc3: set the dma max_seg_size (Ricardo Ribalda)   
  - USB: serial: option: don't claim interface 4 for ZTE MF290 (Lech Perczak)   
  - USB: serial: option: fix FM101R-GL defines (Puliang Lu)   
  - USB: serial: option: add Fibocom L7xx modules (Victor Fragoso)   
  - bcache: prevent potential division by zero error (Rand Deeb)   
  - bcache: check return value from btree_node_alloc_replacement() (Coly Li)   
  - USB: serial: option: add Luat Air72*U series products (Asuna Yang)   
  - s390/dasd: protect device queue against concurrent access (Jan Höppner)   
  - mtd: rawnand: brcmnand: Fix ecc chunk calculation for erased page bitfips (Claire Lin)   
  - net: axienet: Fix check for partial TX checksum (Samuel Holland)   
  - amd-xgbe: propagate the correct speed and duplex status (Raju Rangoju)   
  - amd-xgbe: handle corner-case during sfp hotplug (Raju Rangoju)   
  - arm/xen: fix xen_vcpu_info allocation alignment (Stefano Stabellini)   
  - net: usb: ax88179_178a: fix failed operations during ax88179_reset (Jose Ignacio Tornos Martinez)   
  - ipv4: Correct/silence an endian warning in __ip_do_redirect (Kunwu Chan)   
  - drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full (Jonas Karlman)   
  - ata: pata_isapnp: Add missing error check for devm_ioport_map() (Chen Ni)   
  - drm/panel: simple: Fix Innolux G101ICE-L01 timings (Marek Vasut)   
  - RDMA/irdma: Prevent zero-length STAG registration (Christopher Bednarz) [Orabug: 36155615] {CVE-2023-25775}
  - LTS version: 4.14.331 (Yifei Liu)   
  - net: sched: fix race condition in qdisc_graft() (Eric Dumazet) [Orabug: 35250826] {CVE-2023-0590}
  - scsi: virtio_scsi: limit number of hw queues by nr_cpu_ids (Dongli Zhang)   
  - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (Kemeng Shi)   
  - ext4: correct return value of ext4_convert_meta_bg (Kemeng Shi)   
  - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Kemeng Shi)   
  - ext4: apply umask if ACL support is disabled (Max Kellermann)   
  - media: venus: hfi: fix the check to handle session buffer requirement (Vikash Garodia)   
  - media: sharp: fix sharp encoding (Sean Young)   
  - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte (Heiner Kallweit)   
  - net: dsa: lan9303: consequently nested-lock physical MDIO (Alexander Sverdlin)   
  - ALSA: info: Fix potential deadlock at disconnection (Takashi Iwai)   
  - parisc/pgtable: Do not drop upper 5 address bits of physical address (Helge Deller)   
  - parisc: Prevent booting 64-bit kernels on PA1.x machines (Helge Deller)   
  - mcb: fix error handling for different scenarios when parsing (Sanjuán García, Jorge)   
  - jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev (Zhihao Cheng)   
  - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware (Herve Codina)   
  - mmc: meson-gx: Remove setting of CMD_CFG_ERROR (Rong Chen)   
  - PM: hibernate: Clean up sync_read handling in snapshot_write_next() (Brian Geffon)   
  - PM: hibernate: Use __get_safe_page() rather than touching the list (Brian Geffon)   
  - mmc: vub300: fix an error code (Dan Carpenter)   
  - PCI/sysfs: Protect driver's D3cold preference from user space (Lukas Wunner)   
  - hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (David Woodhouse)   
  - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() (Paul Moore)   
  - audit: don't take task_lock() in audit_exe_compare() code path (Paul Moore)   
  - KVM: x86: Ignore MSR_AMD64_TW_CFG access (Maciej S. Szmigiero)   
  - randstruct: Fix gcc-plugin performance mode to stay in group (Kees Cook)   
  - media: venus: hfi: add checks to perform sanity on queue pointers (Vikash Garodia)   
  - pwm: Fix double shift bug (Dan Carpenter)   
  - gfs2: ignore negated quota changes (Bob Peterson)   
  - media: vivid: avoid integer overflow (Hans Verkuil)   
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Rajeshwar R Shinde)   
  - i2c: sun6i-p2wi: Prevent potential division by zero (Axel Lin)   
  - tty: vcc: Add check for kstrdup() in vcc_probe() (Yi Yang)   
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (Wenchao Hao)   
  - atm: iphase: Do PCI error checks on own line (Ilpo Järvinen)   
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream (Cezary Rojewski)   
  - jfs: fix array-index-out-of-bounds in diAlloc (Manas Ghandat)   
  - jfs: fix array-index-out-of-bounds in dbFindLeaf (Manas Ghandat)   
  - fs/jfs: Add validity check for db_maxag and db_agpref (Juntong Deng)   
  - fs/jfs: Add check for negative db_l2nbperpage (Juntong Deng)   
  - RDMA/hfi1: Use FIELD_GET() to extract Link Width (Ilpo Järvinen)   
  - crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin)   
  - selftests/efivarfs: create-read: fix a resource leak (zhujun2)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (Mario Limonciello)   
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (Mario Limonciello)   
  - net: annotate data-races around sk->sk_dst_pending_confirm (Eric Dumazet)   
  - wifi: ath10k: fix clang-specific fortify warning (Dmitry Antipov)   
  - wifi: ath9k: fix clang-specific fortify warnings (Dmitry Antipov)   
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Ping-Ke Shih)   
  - x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size (Mike Rapoport (IBM))   
  - clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware (Ronald Wahl)   
  - clocksource/drivers/timer-imx-gpt: Fix potential memory leak (Jacky Bai)   
  - locking/ww_mutex/test: Fix potential workqueue corruption (John Stultz)   
  - LTS version: 4.14.330 (Yifei Liu)   
  - btrfs: use u64 for buffer sizes in the tree search ioctls (Filipe Manana)   
  - fbdev: fsl-diu-fb: mark wr_reg_wa() static (Arnd Bergmann)   
  - netfilter: xt_recent: fix (increase) ipv6 literal buffer length (Maciej Żenczykowski)   
  - tg3: power down device only on SYSTEM_POWER_OFF (George Shuklin)   
  - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. (Kuniyuki Iwashima)   
  - dccp: Call security_inet_conn_request() after setting IPv4 addresses. (Kuniyuki Iwashima)   
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Shigeru Yoshida)   
  - llc: verify mac len before reading mac header (Willem de Bruijn)   
  - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume (Florian Fainelli)   
  - media: s3c-camif: Avoid inappropriate kfree() (Katya Orlova)   
  - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: ds: fix refcount leak in pcmcia_device_add() (Yang Yingliang)   
  - pcmcia: cs: fix possible hung task and memory leak pccardd() (Yang Yingliang)   
  - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() (Christophe JAILLET)   
  - USB: usbip: fix stub_dev hub disconnect (Jonas Blixt)   
  - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave() (Jinjie Ruan)   
  - dmaengine: ti: edma: handle irq_of_parse_and_map() errors (Dan Carpenter)   
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (Jia-Ju Bai)   
  - tty: tty_jobctrl: fix pid memleak in disassociate_ctty() (Yi Yang)   
  - mfd: dln2: Fix double put in dln2_probe (Dinghao Liu)   
  - ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails (Cezary Rojewski)   
  - sh: bios: Revive earlyprintk support (Geert Uytterhoeven)   
  - RDMA/hfi1: Workaround truncation compilation error (Leon Romanovsky)   
  - ext4: move 'ix' sanity check to corrent position (Gou Hao)   
  - ARM: 9321/1: memset: cast the constant byte to unsigned char (Kursad Oney)   
  - hwrng: geode - fix accessing registers (Jonas Gorski)   
  - firmware: ti_sci: Mark driver as non removable (Dhruva Gole)   
  - ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator (Krzysztof Kozlowski)   
  - drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe() (Christophe JAILLET)   
  - drm/radeon: possible buffer overflow (Konstantin Meskhidze)   
  - drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs (Jonas Karlman)   
  - platform/x86: wmi: Fix probe failure when failing to register WMI devices (Armin Wolf)   
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data (Jiasheng Jiang)   
  - clk: keystone: pll: fix a couple NULL vs IS_ERR() checks (Dan Carpenter)   
  - clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies (Devi Priya)   
  - ipv6: avoid atomic fragment on GSO packets (Yan Zhai)   
  - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() (Christophe JAILLET)   
  - thermal: core: prevent potential string overflow (Dan Carpenter)   
  - wifi: rtlwifi: fix EDCA limit set by BT coexistence (Dmitry Antipov)   
  - tcp_metrics: do not create an entry from tcp_init_metrics() (Eric Dumazet)   
  - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics() (Eric Dumazet)   
  - i40e: fix potential memory leaks in i40e_remove() (Andrii Staikov)   
  - LTS version: 4.14.329 (Yifei Liu)   
  - tty: 8250: Add support for Intashield IS-100 (Cameron Williams)   
  - tty: 8250: Add support for Brainboxes UP cards (Cameron Williams)   
  - tty: 8250: Add support for additional Brainboxes UC cards (Cameron Williams)   
  - tty: 8250: Remove UC-257 and UC-431 (Cameron Williams)   
  - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility (LihaSika)   
  - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device (Vicki Pfau)   
  - remove the sx8 block driver (Christoph Hellwig)   
  - ata: ahci: fix enum constants for gcc-13 (Arnd Bergmann)   
  - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw (Su Hui)   
  - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e (Hans de Goede)   
  - scsi: mpt3sas: Fix in error path (Tomas Henzl)   
  - fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit() (Jorge Maidana)   
  - ASoC: rt5650: fix the wrong result of key button (Shuming Fan)   
  - netfilter: nfnetlink_log: silence bogus compiler warning (Florian Westphal)   
  - fbdev: atyfb: only use ioremap_uc() on i386 and ia64 (Arnd Bergmann)   
  - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport (Dmitry Torokhov)   
  - dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe (Zhang Shurong)   
  - irqchip/stm32-exti: add missing DT IRQ flag translation (Ben Wolsieffer)   
  - ASoC: simple-card: fixup asoc_simple_probe() error handling (Kuninori Morimoto)   
  - x86: Fix .brk attribute in linker script (Juergen Gross)   
  - rpmsg: Fix possible refcount leak in rpmsg_register_device_override() (Hangyu Hua)   
  - rpmsg: glink: Release driver_override (Bjorn Andersson)   
  - rpmsg: Fix calling device_lock() on non-initialized device (Krzysztof Kozlowski)   
  - rpmsg: Fix kfree() of static memory on setting driver_override (Krzysztof Kozlowski)   
  - driver: platform: Add helper for safer setting of driver_override (Krzysztof Kozlowski)   
  - x86/mm: Fix RESERVE_BRK() for older binutils (Josh Poimboeuf)   
  - x86/mm: Simplify RESERVE_BRK() (Josh Poimboeuf) [Orabug: 34335626] {CVE-2022-23816} {CVE-2022-29901}
  - x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility (Thomas Gleixner)   
  - nfsd: lock_rename() needs both directories to live on the same fs (Al Viro)   
  - f2fs: fix to do sanity check on inode type during garbage collection (Chao Yu)   
  - kobject: Fix slab-out-of-bounds in fill_kobj_path() (Wang Hai) [Orabug: 35924075] {CVE-2023-45863}
  - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper() (Lukasz Majczak)   
  - ARM: 8933/1: replace Sun/Solaris style flag on section directive (Nick Desaulniers)   
  - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() (Herve Codina)   
  - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (Ivan Vecera)   
  - gtp: uapi: fix GTPA_MAX (Pablo Neira Ayuso)   
  - tcp: fix wrong RTO timeout when received SACK reneging (Fred Chen)   
  - r8152: Increase USB control msg timeout to 5000ms as per spec (Douglas Anderson)   
  - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry (Mateusz Palczewski)   
  - treewide: Spelling fix in comment (Kunwu Chan)   
  - virtio_balloon: Fix endless deflation and inflation on arm64 (Gavin Shan)   
  - mcb-lpc: Reallocate memory region to avoid memory overlapping (Rodríguez Barbarin, José Javier)   
  - mcb: Return actual parsed size when reading chameleon table (Rodríguez Barbarin, José Javier)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.534.1.el7uek]
changelog:
  -  LTS version: 4.14.336 (Yifei Liu)   
  - mmc: core: Cancel delayed work before releasing host (Geert Uytterhoeven)   
  - mmc: rpmb: fixes pause retune on all RPMB partitions. (Jorge Ramirez-Ortiz)   
  - firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards (Takashi Sakamoto)   
  - i40e: fix use-after-free in i40e_aqc_add_filters() (Ke Xiao)   
  - net: bcmgenet: Fix FCS generation for fragmented skbuffs (Adrian Cinal)   
  - net: sched: em_text: fix possible memory leak in em_text_destroy() (Hangyu Hua)   
  - nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local (Siddh Raman Pant)   
  - LTS version: 4.14.335 (Yifei Liu)   
  - block: Don't invalidate pagecache for invalid falloc modes (Sarthak Kukreti)   
  - dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() (Mikulas Patocka)   
  - net: 9p: avoid freeing uninit memory in p9pdu_vreadf (Fedor Pchelkin)   
  - Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent (Luiz Augusto von Dentz)   
  - USB: serial: option: add Quectel RM500Q R13 firmware support (Reinhard Speyerer)   
  - USB: serial: option: add Foxconn T99W265 with new baseline (Slark Xiao)   
  - USB: serial: option: add Quectel EG912Y module support (Alper Ak)   
  - USB: serial: ftdi_sio: update Actisense PIDs constant names (Mark Glover)   
  - wifi: cfg80211: fix certs build to not depend on file order (Johannes Berg)   
  - wifi: cfg80211: Add my certificate (Chen-Yu Tsai)   
  - iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table (Javier Carrasco)   
  - Input: ipaq-micro-keys - add error handling for devm_kmemdup (Haoran Liu)   
  - iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw (Su Hui)   
  - ethernet: atheros: fix a memleak in atl1e_setup_ring_resources (Zhipeng Lu)   
  - net: sched: ife: fix potential use-after-free (Eric Dumazet)   
  - wifi: mac80211: mesh_plink: fix matches_local logic (Johannes Berg)   
  - s390/vx: fix save/restore of fpu kernel context (Heiko Carstens)   
  - ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init (Kunwu Chan)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.534.2.el7uek]
changelog:
  - workqueue: Make sure struct worker is accessible for wq_worker_comm() (Tejun Heo)  [Orabug: 36300552]  
  - workqueue: Show the latest workqueue name in /proc/PID/{comm,stat,status} (Tejun Heo)  [Orabug: 36300552]  
  - workqueue: Set worker->desc to workqueue name by default (Tejun Heo)  [Orabug: 36300552]  
  - workqueue: Make worker_attach/detach_pool() update worker->pool (Tejun Heo)  [Orabug: 36300552]  
  - workqueue: Replace pool->attach_mutex with global wq_pool_attach_mutex (Tejun Heo)  [Orabug: 36300552]


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.534.3.el7uek]
changelog:
  - scsi: megaraid_sas: Correct value passed to scsi_device_lookup() (Guixin Liu)  [Orabug: 36345169]  
  - scsi: megaraid_sas: Update max supported LD IDs to 240 (Chandrakanth Patil)  [Orabug: 36344166]


author: Yifei Liu <yifei.l.liu@oracle.com> [4.14.35-2047.535.1.el7uek]
changelog:
  - mm: avoid conflict between MADV_DOEXEC and upstream advice values (Anthony Yznaga)  [Orabug: 36334310]  
  - net/rds: print PPID/COMM of process doing user reset on RDS connection (Juan Garcia)  [Orabug: 36248431]


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2042.el7uek]
changelog:
  - uek-rpm: Create initramfs at postinstall stage also. (Somasundaram Krishnasamy)  [Orabug: 31358098]  
  - IB/ipoib: Arm "send_cq" to process completions in due time (Gerd Rausch)  [Orabug: 31821366]  
  - hdlc_ppp: add range checks in ppp_cp_parse_cr() (Dan Carpenter)  [Orabug: 31989188]  {CVE-2020-25643} 
  - SUNRPC: Remove xprt_connect_status() again (John Donnelly)  [Orabug: 32010393]  
  - geneve: add transport ports in route lookup for geneve (Mark Gray)  [Orabug: 32014098]  {CVE-2020-25645} 
  - nvme-fc: fix double-free scenarios on hw queues (James Smart)  [Orabug: 32019909]  
  - x86/kvm: move kvm_load/put_guest_xcr0 into atomic context (WANG Chao)  [Orabug: 32021854]  
  - xfs: fix warning: unused variable 'sb' (John Donnelly)  [Orabug: 32014589]  
  - nvme-pci: remove queue_count_ops for write_queues and poll_queues (Minwoo Im)  [Orabug: 32016209]  
  - nvme: Corrects warning: unused variable 'startka' (John Donnelly)  [Orabug: 32016209]  
  - uek-rpm: config-aarch64-embedded add fast_kexec (Henry Willard)  [Orabug: 31981075]  
  - arm64: kexec: Add optional fast shutdown for kexec (Henry Willard)  [Orabug: 31981075]  
  - ocfs2: remove unused ocfs2_prepare_inode_for_refcount() (John Donnelly)  [Orabug: 32007779]  
  - rds: fixes warning: unused variable 'cache_sz_k' (John Donnelly)  [Orabug: 32007782]  
  - panic: move disabling iommu to after dump_stack() (John Donnelly)  [Orabug: 32009002]  
  - net: add high_order_alloc_disable sysctl (Eric Dumazet)  [Orabug: 31907602]  
  - mm, page_alloc: double zone's batchsize (Aaron Lu)  [Orabug: 31907602]  
  - mm/free_pcppages_bulk: prefetch buddy while not holding lock (Aaron Lu)  [Orabug: 31907602]  
  - mm/free_pcppages_bulk: do not hold lock when picking pages to free (Aaron Lu)  [Orabug: 31907602]  
  - btrfs: Don't submit any btree write bio if the fs has errors (Qu Wenruo)  [Orabug: 31265339]  {CVE-2019-19377} {CVE-2019-19377} {CVE-2019-19377} 
  - nvmet: Disable keep-alive timer when kato is cleared to 0h (Amit Engel)  [Orabug: 31996193]  
  - uek-rpm: Add old OL keys to the default .blacklist keyring (Eric Snowberg)  [Orabug: 31961117]  
  - certs: Add ability to preload revocation certs (Eric Snowberg)  [Orabug: 31961117]  
  - certs: Move load_system_certificate_list to a common function (Eric Snowberg)  [Orabug: 31961117]  
  - certs: Add EFI_CERT_X509_GUID support for dbx entries (Eric Snowberg)  [Orabug: 31961117]  {CVE-2020-26541} 
  - Revert "l2tp: initialise PPP sessions before registering them" (George Kennedy)  [Orabug: 31902910]  
  - blk-mq: warning: unused variable 'ctx' (John Donnelly)  [Orabug: 31915634]  
  - ghes: Corrects: warning: unused variable 'vaddr' [-Wunused-variable] (John Donnelly)  [Orabug: 31915651]  
  - ACPI: properties: Implement get_match_data() callback (Sinan Kaya)  [Orabug: 31915651]  
  - x86/mitigations: Restore paranoid checks for int3 handling (Boris Ostrovsky)  [Orabug: 31999341]  
  - Linux 4.14.196 (Greg Kroah-Hartman)   
  - ALSA: usb-audio: Update documentation comment for MS2109 quirk (Hector Martin)   
  - HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() (Peilin Ye)   
  - tpm: Unify the mismatching TPM space buffer sizes (Jarkko Sakkinen)   
  - btrfs: check the right error variable in btrfs_del_dir_entries_in_log (Josef Bacik)   
  - usb: storage: Add unusual_uas entry for Sony PSZ drives (Alan Stern)   
  - USB: cdc-acm: rework notification_buffer resizing (Tom Rix)   
  - USB: gadget: u_f: Unbreak offset calculation in VLAs (Andy Shevchenko)   
  - USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb() (Brooke Basile)   
  - USB: gadget: u_f: add overflow checks to VLA macros (Brooke Basile)   
  - usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe() (Tang Bin)   
  - USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge (Cyril Roelandt)   
  - USB: quirks: Add no-lpm quirk for another Raydium touchscreen (Kai-Heng Feng)   
  - usb: uas: Add quirk for PNY Pro Elite (Thinh Nguyen)   
  - USB: yurex: Fix bad gfp argument (Alan Stern)   
  - drm/amdgpu: Fix buffer overflow in INFO ioctl (Alex Deucher)   
  - device property: Fix the secondary firmware node handling in set_primary_fwnode() (Heikki Krogerus)   
  - PM: sleep: core: Fix the handling of pending runtime resume requests (Rafael J. Wysocki)   
  - xhci: Do warm-reset when both CAS and XDEV_RESUME are set (Kai-Heng Feng)   
  - XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information. (Thomas Gleixner)   
  - writeback: Fix sync livelock due to b_dirty_time processing (Jan Kara)   
  - writeback: Avoid skipping inode writeback (Jan Kara)   
  - writeback: Protect inode->i_io_list with inode->i_lock (Jan Kara)   
  - serial: 8250: change lock order in serial8250_do_startup() (Sergey Senozhatsky)   
  - serial: 8250_exar: Fix number of ports for Commtech PCIe cards (Valmer Huhn)   
  - serial: pl011: Don't leak amba_ports entry on driver register error (Lukas Wunner)   
  - serial: pl011: Fix oops on -EPROBE_DEFER (Lukas Wunner)   
  - serial: samsung: Removes the IRQ not found warning (Tamseel Shams)   
  - vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize() (George Kennedy)   
  - vt: defer kfree() of vc_screenbuf in vc_do_resize() (Tetsuo Handa)   
  - USB: lvtest: return proper error code in probe (Evgeny Novikov)   
  - fbcon: prevent user font height or width change from causing potential out-of-bounds access (George Kennedy)   
  - btrfs: fix space cache memory leak after transaction abort (Filipe Manana)   
  - HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON commands (Hans de Goede)   
  - powerpc/perf: Fix soft lockups due to missed interrupt accounting (Athira Rajeev)   
  - net: gianfar: Add of_node_put() before goto statement (Sumera Priyadarsini)   
  - scsi: ufs: Clean up completed request without interrupt notification (Stanley Chu)   
  - scsi: ufs: Improve interrupt handling for shared interrupts (Adrian Hunter)   
  - scsi: ufs: Fix possible infinite loop in ufshcd_hold (Stanley Chu)   
  - s390/cio: add cond_resched() in the slow_eval_known_fn() loop (Vineeth Vijayan)   
  - spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate (Amelie Delaunay)   
  - fs: prevent BUG_ON in submit_bh_wbc() (Xianting Tian)   
  - jbd2: abort journal if free a async write error metadata buffer (zhangyi (F))   
  - ext4: don't BUG on inconsistent journal feature (Jan Kara)   
  - jbd2: make sure jh have b_transaction set in refile/unfile_buffer (Lukas Czerner)   
  - usb: gadget: f_tcm: Fix some resource leaks in some error paths (Christophe JAILLET)   
  - i2c: rcar: in slave mode, clear NACK earlier (Wolfram Sang)   
  - null_blk: fix passing of REQ_FUA flag in null_handle_rq (Hou Pu)   
  - nvme-fc: Fix wrong return value in __nvme_fc_init_request() (Tianjia Zhang)   
  - media: gpio-ir-tx: improve precision of transmitted signal due to scheduling (Sean Young)   
  - Revert "ath10k: fix DMA related firmware crashes on multiple devices" (Zhi Chen)   
  - efi: provide empty efi_enter_virtual_mode implementation (Andrey Konovalov)   
  - USB: sisusbvga: Fix a potential UB casued by left shifting a negative value (Changming Liu)   
  - powerpc/spufs: add CONFIG_COREDUMP dependency (Arnd Bergmann)   
  - KVM: arm64: Fix symbol dependency in __hyp_call_panic_nvhe (David Brazdil)   
  - media: davinci: vpif_capture: fix potential double free (Evgeny Novikov)   
  - EDAC/ie31200: Fallback if host bridge device is already initialized (Jason Baron)   
  - scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() (Javed Hasan)   
  - ceph: fix potential mdsc use-after-free crash (Xiubo Li)   
  - scsi: iscsi: Do not put host in iscsi_set_flashnode_param() (Jing Xiangfeng)   
  - locking/lockdep: Fix overflow in presentation of average lock-time (Chris Wilson)   
  - drm/nouveau: Fix reference count leak in nouveau_connector_detect (Aditya Pakki)   
  - drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open (Aditya Pakki)   
  - f2fs: fix use-after-free issue (Li Guifu)   
  - cec-api: prevent leaking memory through hole in structure (Hans Verkuil)   
  - mips/vdso: Fix resource leaks in genvdso.c (Peng Fan)   
  - rtlwifi: rtl8192cu: Prevent leaking urb (Reto Schneider)   
  - PCI: Fix pci_create_slot() reference count leak (Qiushi Wu)   
  - omapfb: fix multiple reference count leaks due to pm_runtime_get_sync (Aditya Pakki)   
  - selftests/powerpc: Purge extra count_pmc() calls of ebb selftests (Desnes A. Nunes do Rosario)   
  - scsi: lpfc: Fix shost refcount mismatch when deleting vport (Dick Kennedy)   
  - drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails (Navid Emamdoost)   
  - drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config (Navid Emamdoost)   
  - drm/amd/display: fix ref count leak in amdgpu_drm_ioctl (Navid Emamdoost)   
  - drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms (Navid Emamdoost)   
  - drm/radeon: fix multiple reference count leak (Aditya Pakki)   
  - drm/amdkfd: Fix reference count leaks. (Qiushi Wu)   
  - iommu/iova: Don't BUG on invalid PFNs (Robin Murphy)   
  - scsi: target: tcmu: Fix crash on ARM during cmd completion (Bodo Stroesser)   
  - blktrace: ensure our debugfs dir exists (Luis Chamberlain)   
  - media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq() (Jia-Ju Bai)   
  - powerpc/xive: Ignore kmemleak false positives (Alexey Kardashevskiy)   
  - arm64: dts: qcom: msm8916: Pull down PDM GPIOs during sleep (Stephan Gerhold)   
  - mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs (Andy Shevchenko)   
  - ASoC: tegra: Fix reference count leaks. (Qiushi Wu)   
  - ALSA: pci: delete repeated words in comments (Randy Dunlap)   
  - gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY (Mark Tomlinson)   
  - ipvlan: fix device features (Mahesh Bandewar)   
  - tipc: fix uninit skb->data in tipc_nl_compat_dumpit() (Cong Wang)   
  - net: Fix potential wrong skb->protocol in skb_vlan_untag() (Miaohe Lin)   
  - powerpc/64s: Don't init FSCR_DSCR in __init_FSCR() (Michael Ellerman)   
  - Linux 4.14.195 (Greg Kroah-Hartman)   
  - KVM: arm/arm64: Don't reschedule in unmap_stage2_range() (Will Deacon)   
  - clk: Evict unregistered clks from parent caches (Stephen Boyd)   
  - xen: don't reschedule in preemption off sections (Juergen Gross)   
  - mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible (Peter Xu)   
  - do_epoll_ctl(): clean the failure exits up a bit (Al Viro)   
  - epoll: Keep a reference on files added to the check list (Marc Zyngier)   
  - powerpc/pseries: Do not initiate shutdown when system is running on UPS (Vasant Hegde)   
  - net: dsa: b53: check for timeout (Tom Rix)   
  - hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit() (Haiyang Zhang)   
  - bonding: fix active-backup failover for current ARP slave (Jiri Wiesner)   
  - vfio/type1: Add proper error unwind for vfio_iommu_replay() (Alex Williamson)   
  - ASoC: intel: Fix memleak in sst_media_open (Dinghao Liu)   
  - ASoC: msm8916-wcd-analog: fix register Interrupt offset (Srinivas Kandagatla)   
  - bonding: fix a potential double-unregister (Cong Wang)   
  - bonding: show saner speed for broadcast mode (Jarod Wilson)   
  - net: fec: correct the error path for regulator disable in probe (Fugang Duan)   
  - i40e: Fix crash during removing i40e driver (Grzegorz Szczurek)   
  - i40e: Set RX_ONLY mode for unicast promiscuous on VLAN (Przemyslaw Patynowski)   
  - alpha: fix annotation of io{read,write}{16,32}be() (Luc Van Oostenryck)   
  - xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init (Eiichi Tsukata)   
  - virtio_ring: Avoid loop when vq is broken in virtqueue_poll (Mao Wenan)   
  - scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases (Javed Hasan)   
  - cpufreq: intel_pstate: Fix cpuinfo_max_freq when MSR_TURBO_RATIO_LIMIT is 0 (Srinivas Pandruvada)   
  - jffs2: fix UAF problem (Zhe Li)   
  - xfs: fix inode quota reservation checks (Darrick J. Wong)   
  - m68knommu: fix overwriting of bits in ColdFire V3 cache control (Greg Ungerer)   
  - Input: psmouse - add a newline when printing 'proto' by sysfs (Xiongfeng Wang)   
  - media: vpss: clean up resources in init (Evgeny Novikov)   
  - rtc: goldfish: Enable interrupt in set_alarm() when necessary (Huacai Chen)   
  - media: budget-core: Improve exception handling in budget_register() (Chuhong Yuan)   
  - scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices (Stanley Chu)   
  - spi: Prevent adding devices below an unregistering controller (Lukas Wunner)   
  - jbd2: add the missing unlock_buffer() in the error path of jbd2_write_superblock() (zhangyi (F))   
  - ext4: fix checking of directory entry validity for inline directories (Jan Kara)   
  - mm, page_alloc: fix core hung in free_pcppages_bulk() (Charan Teja Reddy)   
  - mm: include CMA pages in lowmem_reserve at boot (Doug Berger)   
  - kernel/relay.c: fix memleak on destroy relay channel (Wei Yongjun)   
  - romfs: fix uninitialized memory leak in romfs_dev_read() (Jann Horn)   
  - btrfs: sysfs: use NOFS for device creation (Josef Bacik)   
  - btrfs: inode: fix NULL pointer dereference if inode doesn't need compression (Qu Wenruo)   
  - btrfs: Move free_pages_out label in inline extent handling branch in compress_file_range (Nikolay Borisov)   
  - btrfs: don't show full path of bind mounts in subvol= (Josef Bacik)   
  - btrfs: export helpers for subvolume name/id resolution (Marcos Paulo de Souza)   
  - powerpc: Allow 4224 bytes of stack expansion for the signal frame (Michael Ellerman)   
  - powerpc/mm: Only read faulting instruction when necessary in do_page_fault() (Christophe Leroy)   
  - khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() (Hugh Dickins)   
  - khugepaged: khugepaged_test_exit() check mmget_still_valid() (Hugh Dickins)   
  - perf probe: Fix memory leakage when the probe point is not found (Masami Hiramatsu)   
  - drm/vgem: Replace opencoded version of drm_gem_dumb_map_offset() (Chris Wilson)   
  - Linux 4.14.194 (Greg Kroah-Hartman)   
  - dm cache: remove all obsolete writethrough-specific code (Mike Snitzer)   
  - dm cache: pass cache structure to mode functions (Mike Snitzer)   
  - genirq/affinity: Make affinity setting if activated opt-in (Thomas Gleixner)   
  - genirq/affinity: Handle affinity setting on inactive interrupts correctly (Thomas Gleixner)   
  - khugepaged: retract_page_tables() remember to test exit (Hugh Dickins)   
  - sh: landisk: Add missing initialization of sh_io_port_base (Geert Uytterhoeven)   
  - tools build feature: Quote CC and CXX for their arguments (Daniel Díaz)   
  - perf bench mem: Always memset source before memcpy (Vincent Whitchurch)   
  - ALSA: echoaudio: Fix potential Oops in snd_echo_resume() (Dinghao Liu)   
  - mfd: dln2: Run event handler loop under spinlock (Andy Shevchenko)   
  - test_kmod: avoid potential double free in trigger_config_run_type() (Tiezhu Yang)   
  - fs/ufs: avoid potential u32 multiplication overflow (Colin Ian King)   
  - net: qcom/emac: add missed clk_disable_unprepare in error path of emac_clks_phase1_init (Wang Hai)   
  - drm/vmwgfx: Fix two list_for_each loop exit tests (Dan Carpenter)   
  - drm/vmwgfx: Use correct vmw_legacy_display_unit pointer (Dan Carpenter)   
  - Input: sentelic - fix error return when fsp_reg_write fails (Colin Ian King)   
  - i2c: rcar: avoid race when unregistering slave (Wolfram Sang)   
  - tools build feature: Use CC and CXX from parent (Thomas Hebb)   
  - pwm: bcm-iproc: handle clk_get_rate() return (Rayagonda Kokatanur)   
  - clk: clk-atlas6: fix return value check in atlas6_clk_init() (Xu Wang)   
  - i2c: rcar: slave: only send STOP event when we have been addressed (Wolfram Sang)   
  - iommu/vt-d: Enforce PASID devTLB field mask (Liu Yi L)   
  - iommu/omap: Check for failure of a call to omap_iommu_dump_ctx (Colin Ian King)   
  - dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue() (Ming Lei)   
  - gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers (Steve Longerbeam)   
  - USB: serial: ftdi_sio: clean up receive processing (Johan Hovold)   
  - USB: serial: ftdi_sio: make process-packet buffer unsigned (Johan Hovold)   
  - RDMA/ipoib: Return void from ipoib_ib_dev_stop() (Kamal Heib)   
  - mfd: arizona: Ensure 32k clock is put on driver unbind and error (Charles Keepax)   
  - drm/imx: imx-ldb: Disable both channels for split mode in enc->disable() (Liu Ying)   
  - perf intel-pt: Fix FUP packet state (Adrian Hunter)   
  - pseries: Fix 64 bit logical memory block panic (Anton Blanchard)   
  - watchdog: f71808e_wdt: clear watchdog timeout occurred flag (Ahmad Fatoum)   
  - watchdog: f71808e_wdt: remove use of wrong watchdog_info option (Ahmad Fatoum)   
  - watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options (Ahmad Fatoum)   
  - tracing: Use trace_sched_process_free() instead of exit() for pid tracing (Steven Rostedt (VMware))   
  - tracing/hwlat: Honor the tracing_cpumask (Kevin Hao)   
  - kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler (Muchun Song)   
  - ftrace: Setup correct FTRACE_FL_REGS flags for module (Chengming Zhou)   
  - ext2: fix missing percpu_counter_inc (Mikulas Patocka)   
  - MIPS: CPU#0 is not hotpluggable (Huacai Chen)   
  - mac80211: fix misplaced while instead of if (Johannes Berg)   
  - bcache: allocate meta data pages as compound pages (Coly Li)   
  - md/raid5: Fix Force reconstruct-write io stuck in degraded raid5 (ChangSyun Peng)   
  - net/compat: Add missing sock updates for SCM_RIGHTS (Kees Cook)   
  - net: stmmac: dwmac1000: provide multicast filter fallback (Jonathan McDowell)   
  - net: ethernet: stmmac: Disable hardware multicast filter (Jonathan McDowell)   
  - powerpc: Fix circular dependency between percpu.h and mmu.h (Michael Ellerman)   
  - xtensa: fix xtensa_pmu_setup prototype (Max Filippov)   
  - iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw() (Alexandru Ardelean)   
  - dt-bindings: iio: io-channel-mux: Fix compatible string in example code (Christian Eggers)   
  - btrfs: fix memory leaks after failure to lookup checksums during inode logging (Filipe Manana)   
  - btrfs: don't allocate anonymous block device for user invisible roots (Qu Wenruo)   
  - PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context() (Rafael J. Wysocki)   
  - smb3: warn on confusing error scenario with sec=krb5 (Steve French)   
  - net: initialize fastreuse on inet_inherit_port (Tim Froidcoeur)   
  - xen/balloon: make the balloon wait interruptible (Roger Pau Monne)   
  - xen/balloon: fix accounting in alloc_xenballooned_pages error path (Roger Pau Monne)   
  - irqdomain/treewide: Free firmware node after domain removal (Jon Derrick)   
  - ARM: 8992/1: Fix unwind_frame for clang-built kernels (Nathan Huckleberry)   
  - parisc: mask out enable and reserved bits from sba imask (Sven Schnelle)   
  - parisc: Implement __smp_store_release and __smp_load_acquire barriers (John David Anglin)   
  - mtd: rawnand: qcom: avoid write to unavailable register (Sivaprakash Murugesan)   
  - spi: spidev: Align buffers for DMA (Christian Eggers)   
  - 9p: Fix memory leak in v9fs_mount (Zheng Bin)   
  - ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109 (Hector Martin)   
  - fs/minix: reject too-large maximum file size (Eric Biggers)   
  - fs/minix: don't allow getting deleted inodes (Eric Biggers)   
  - fs/minix: check return value of sb_getblk() (Eric Biggers)   
  - bitfield.h: don't compile-time validate _val in FIELD_FIT (Jakub Kicinski)   
  - crypto: ccp - Fix use of merged scatterlists (John Allen)   
  - crypto: qat - fix double free in qat_uclo_create_batch_init_list (Tom Rix)   
  - ALSA: usb-audio: add quirk for Pioneer DDJ-RB (Hector Martin)   
  - ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109 (Hector Martin)   
  - ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support (Mirko Dietrich)   
  - USB: serial: cp210x: enable usb generic throttle/unthrottle (Brant Merryman)   
  - USB: serial: cp210x: re-enable auto-RTS on open (Brant Merryman)   
  - net: Set fput_needed iff FDPUT_FPUT is set (Miaohe Lin)   
  - net: refactor bind_bucket fastreuse into helper (Tim Froidcoeur)   
  - net/nfc/rawsock.c: add CAP_NET_RAW check. (Qingyu Li)   
  - drivers/net/wan/lapbether: Added needed_headroom and a skb->len check (Xie He)   
  - af_packet: TPACKET_V3: fix fill status rwlock imbalance (John Ogness)   
  - crypto: aesni - add compatibility with IAS (Jian Cai)   
  - x86/fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task (Eric Dumazet)   
  - pinctrl-single: fix pcs_parse_pinconf() return value (Drew Fustini)   
  - dlm: Fix kobject memleak (Wang Hai)   
  - fsl/fman: fix eth hash table allocation (Florinel Iordache)   
  - fsl/fman: check dereferencing null pointer (Florinel Iordache)   
  - fsl/fman: fix unreachable code (Florinel Iordache)   
  - fsl/fman: fix dereference null return value (Florinel Iordache)   
  - fsl/fman: use 32-bit unsigned integer (Florinel Iordache)   
  - net: spider_net: Fix the size used in a 'dma_free_coherent()' call (Christophe JAILLET)   
  - liquidio: Fix wrong return value in cn23xx_get_pf_num() (Tianjia Zhang)   
  - net: ethernet: aquantia: Fix wrong return value (Tianjia Zhang)   
  - tools, build: Propagate build failures from tools/build/Makefile.build (Andrii Nakryiko)   
  - wl1251: fix always return 0 error (Wang Hai)   
  - s390/qeth: don't process empty bridge port events (Julian Wiedmann)   
  - selftests/powerpc: Fix online CPU selection (Sandipan Das)   
  - PCI: Release IVRS table in AMD ACS quirk (Hanjun Guo)   
  - selftests/powerpc: Fix CPU affinity for child process (Harish)   
  - Bluetooth: hci_serdev: Only unregister device if it was registered (Nicolas Boichat)   
  - power: supply: check if calc_soc succeeded in pm860x_init_battery (Tom Rix)   
  - Smack: prevent underflow in smk_set_cipso() (Dan Carpenter)   
  - Smack: fix another vsscanf out of bounds (Dan Carpenter)   
  - net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration (Chris Packham)   
  - scsi: mesh: Fix panic after host or bus reset (Finn Thain)   
  - usb: dwc2: Fix error path in gadget registration (Marek Szyprowski)   
  - MIPS: OCTEON: add missing put_device() call in dwc3_octeon_device_init() (Yu Kuai)   
  - coresight: tmc: Fix TMC mode read in tmc_read_unprepare_etb() (Sai Prakash Ranjan)   
  - thermal: ti-soc-thermal: Fix reversed condition in ti_thermal_expose_sensor() (Dan Carpenter)   
  - USB: serial: iuu_phoenix: fix led-activity helpers (Johan Hovold)   
  - drm/imx: tve: fix regulator_disable error path (Marco Felsch)   
  - PCI/ASPM: Add missing newline in sysfs 'policy' (Xiongfeng Wang)   
  - staging: rtl8192u: fix a dubious looking mask before a shift (Colin Ian King)   
  - powerpc/vdso: Fix vdso cpu truncation (Milton Miller)   
  - mwifiex: Prevent memory corruption handling keys (Dan Carpenter)   
  - scsi: scsi_debug: Add check for sdebug_max_queue during module init (John Garry)   
  - drm/bridge: sil_sii8620: initialize return of sii8620_readb (Tom Rix)   
  - drm: panel: simple: Fix bpc for LG LB070WV8 panel (Laurent Pinchart)   
  - leds: core: Flush scheduled work for system suspend (Kai-Heng Feng)   
  - PCI: Fix pci_cfg_wait queue locking problem (Bjorn Helgaas)   
  - xfs: fix reflink quota reservation accounting error (Darrick J. Wong)   
  - media: exynos4-is: Add missed check for pinctrl_lookup_state() (Chuhong Yuan)   
  - media: firewire: Using uninitialized values in node_probe() (Dan Carpenter)   
  - ipvs: allow connection reuse for unconfirmed conntrack (Julian Anastasov)   
  - scsi: eesox: Fix different dev_id between request_irq() and free_irq() (Christophe JAILLET)   
  - scsi: powertec: Fix different dev_id between request_irq() and free_irq() (Christophe JAILLET)   
  - drm/radeon: fix array out-of-bounds read and write issues (Colin Ian King)   
  - cxl: Fix kobject memleak (Wang Hai)   
  - drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline (Emil Velikov)   
  - scsi: cumana_2: Fix different dev_id between request_irq() and free_irq() (Christophe JAILLET)   
  - ASoC: Intel: bxt_rt298: add missing .owner field (Pierre-Louis Bossart)   
  - media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities() (Chuhong Yuan)   
  - leds: lm355x: avoid enum conversion warning (Arnd Bergmann)   
  - drm/arm: fix unintentional integer overflow on left shift (Colin Ian King)   
  - iio: improve IIO_CONCENTRATION channel type description (Tomasz Duszynski)   
  - video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call (Christophe JAILLET)   
  - console: newport_con: fix an issue about leak related system resources (Dejin Zheng)   
  - video: fbdev: sm712fb: fix an issue about iounmap for a wrong address (Dejin Zheng)   
  - agp/intel: Fix a memory leak on module initialisation failure (Qiushi Wu)   
  - ACPICA: Do not increment operation_region reference counts for field units (Erik Kaneda)   
  - bcache: fix super block seq numbers comparision in register_cache_set() (Coly Li)   
  - dyndbg: fix a BUG_ON in ddebug_describe_flags (Jim Cromie)   
  - usb: bdc: Halt controller on suspend (Danesh Petigara)   
  - bdc: Fix bug causing crash after multiple disconnects (Sasi Kumar)   
  - usb: gadget: net2280: fix memory leak on probe error handling paths (Evgeny Novikov)   
  - gpu: host1x: debug: Fix multiple channels emitting messages simultaneously (Dmitry Osipenko)   
  - iwlegacy: Check the return value of pcie_capability_read_*() (Bolarinwa Olayemi Saheed)   
  - brcmfmac: set state of hanger slot to FREE when flushing PSQ (Wright Feng)   
  - brcmfmac: To fix Bss Info flag definition Bug (Prasanna Kerekoppa)   
  - mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls (Paul E. McKenney)   
  - irqchip/irq-mtk-sysirq: Replace spinlock with raw_spinlock (Bartosz Golaszewski)   
  - drm/debugfs: fix plain echo to connector "force" attribute (Michael Tretter)   
  - drm/nouveau: fix multiple instances of reference count leaks (Aditya Pakki)   
  - arm64: dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT binding (Ricardo Cañuelo)   
  - md-cluster: fix wild pointer of unlock_all_bitmaps() (Zhao Heming)   
  - video: fbdev: neofb: fix memory leak in neo_scan_monitor() (Evgeny Novikov)   
  - drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync (Aditya Pakki)   
  - fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls (Paul E. McKenney)   
  - Bluetooth: add a mutex lock to avoid UAF in do_enale_set (Lihong Kou)   
  - drm/tilcdc: fix leak & null ref in panel_connector_get_modes (Tomi Valkeinen)   
  - ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh() (Yu Kuai)   
  - spi: lantiq: fix: Rx overflow error in full duplex mode (Dilip Kota)   
  - ARM: at91: pm: add missing put_device() call in at91_pm_sram_init() (yu kuai)   
  - platform/x86: intel-vbtn: Fix return value check in check_acpi_dev() (Lu Wei)   
  - platform/x86: intel-hid: Fix return value check in check_acpi_dev() (Lu Wei)   
  - m68k: mac: Fix IOP status/control register writes (Finn Thain)   
  - m68k: mac: Don't send IOP message until channel is idle (Finn Thain)   
  - arm64: dts: exynos: Fix silent hang after boot on Espresso (Alim Akhtar)   
  - arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property (Stephan Gerhold)   
  - EDAC: Fix reference count leaks (Qiushi Wu)   
  - arm64: dts: rockchip: fix rk3399-puma gmac reset gpio (Heiko Stuebner)   
  - arm64: dts: rockchip: fix rk3399-puma vcc5v0-host gpio (Heiko Stuebner)   
  - sched: correct SD_flags returned by tl->sd_flags() (Peng Liu)   
  - x86/mce/inject: Fix a wrong assignment of i_mce.status (Zhenzhong Duan)   
  - cgroup: add missing skcd->no_refcnt check in cgroup_sk_clone() (Yang Yingliang)   
  - HID: input: Fix devices that return multiple bytes in battery report (Grant Likely)   
  - tracepoint: Mark __tracepoint_string's __used (Nick Desaulniers)   
  - Smack: fix use-after-free in smk_write_relabel_self() (Eric Biggers)   
  - rxrpc: Fix race between recvmsg and sendmsg on immediate call failure (David Howells)   
  - usb: hso: check for return value in hso_serial_common_create() (Rustam Kovhaev)   
  - selftests/net: relax cpu affinity requirement in msg_zerocopy test (Willem de Bruijn)   
  - Revert "vxlan: fix tos value before xmit" (Hangbin Liu)   
  - openvswitch: Prevent kernel-infoleak in ovs_ct_put_key() (Peilin Ye)   
  - net: gre: recompute gre csum for sctp over gre tunnels (Lorenzo Bianconi)   
  - hv_netvsc: do not use VF device if link is down (Stephen Hemminger)   
  - net: lan78xx: replace bogus endpoint lookup (Johan Hovold)   
  - vxlan: Ensure FDB dump is performed under RCU (Ido Schimmel)   
  - net: ethernet: mtk_eth_soc: fix MTU warnings (Landen Chao)   
  - ipv6: fix memory leaks on IPV6_ADDRFORM path (Cong Wang)   
  - ipv4: Silence suspicious RCU usage warning (Ido Schimmel)   
  - xattr: break delegations in {set,remove}xattr (Frank van der Linden)   
  - Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23) (Dexuan Cui)   
  - tools lib traceevent: Fix memory leak in process_dynamic_array_len (Philippe Duplessis-Guindon)   
  - atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent (Xin Xiong)   
  - igb: reinit_locked() should be called with rtnl_lock (Francesco Ruggeri)   
  - cfg80211: check vendor command doit pointer before use (Julian Squires)   
  - i2c: slave: add sanity check when unregistering (Wolfram Sang)   
  - i2c: slave: improve sanity check when registering (Wolfram Sang)   
  - drm/nouveau/fbcon: zero-initialise the mode_cmd2 structure (Ben Skeggs)   
  - drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason (Ben Skeggs)   
  - net/9p: validate fds in p9_fd_open (Christoph Hellwig)   
  - leds: 88pm860x: fix use-after-free on unbind (Johan Hovold)   
  - leds: lm3533: fix use-after-free on unbind (Johan Hovold)   
  - leds: da903x: fix use-after-free on unbind (Johan Hovold)   
  - leds: wm831x-status: fix use-after-free on unbind (Johan Hovold)   
  - mtd: properly check all write ioctls for permissions (Greg Kroah-Hartman)   
  - binder: Prevent context manager from incrementing ref 0 (Jann Horn)   
  - omapfb: dss: Fix max fclk divider for omap36xx (Adam Ford)   
  - Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt() (Peilin Ye)   
  - Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt() (Peilin Ye)   
  - Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() (Peilin Ye)   
  - staging: android: ashmem: Fix lockdep warning for write operation (Suren Baghdasaryan)   
  - ALSA: seq: oss: Serialize ioctls (Takashi Iwai)   
  - usb: xhci: Fix ASMedia ASM1142 DMA addressing (Forest Crossman)   
  - usb: xhci: define IDs for various ASMedia host controllers (Forest Crossman)   
  - USB: iowarrior: fix up report size handling for some devices (Greg Kroah-Hartman)   
  - net/mlx5e: Don't support phys switch id if not in switchdev mode (Roi Dayan)   
  - USB: serial: qcserial: add EM7305 QDL product ID (Erik Ekman)   
  - Linux 4.14.193 (Greg Kroah-Hartman)   
  - ARM: 8702/1: head-common.S: Clear lr before jumping to start_kernel() (Geert Uytterhoeven)   
  - ext4: fix direct I/O read error (Jiang Ying)   
  - random32: move the pseudo-random 32-bit definitions to prandom.h (Linus Torvalds)   
  - random32: remove net_rand_state from the latent entropy gcc plugin (Linus Torvalds)   
  - random: fix circular include dependency on arm64 after addition of percpu.h (Willy Tarreau)   
  - ARM: percpu.h: fix build error (Grygorii Strashko)   
  - Revert "scsi: libsas: direct call probe and destruct" (Greg Kroah-Hartman)   
  - Linux 4.14.192 (Greg Kroah-Hartman)   
  - x86/i8259: Use printk_deferred() to prevent deadlock (Thomas Gleixner)   
  - KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled (Wanpeng Li)   
  - xen-netfront: fix potential deadlock in xennet_remove() (Andrea Righi)   
  - cxgb4: add missing release on skb in uld_send() (Navid Emamdoost)   
  - x86/unwind/orc: Fix ORC for newly forked tasks (Josh Poimboeuf)   
  - Revert "i2c: cadence: Fix the hold bit setting" (Raviteja Narayanam)   
  - net: ethernet: ravb: exit if re-initialization fails in tx timeout (Yoshihiro Shimoda)   
  - parisc: add support for cmpxchg on u8 pointers (Liam Beguin)   
  - nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame (Navid Emamdoost)   
  - qed: Disable "MFW indication via attention" SPAM every 5 minutes (Laurence Oberman)   
  - usb: hso: Fix debug compile warning on sparc32 (Geert Uytterhoeven)   
  - arm64: csum: Fix handling of bad packets (Robin Murphy)   
  - mac80211: mesh: Free pending skb when destroying a mpath (Remi Pommarel)   
  - mac80211: mesh: Free ie data when leaving mesh (Remi Pommarel)   
  - bpf: Fix map leak in HASH_OF_MAPS map (Andrii Nakryiko)   
  - ibmvnic: Fix IRQ mapping disposal in error path (Thomas Falcon)   
  - mlxsw: core: Free EMAD transactions using kfree_rcu() (Ido Schimmel)   
  - mlxsw: core: Increase scope of RCU read-side critical section (Ido Schimmel)   
  - mlx4: disable device on shutdown (Jakub Kicinski)   
  - net: lan78xx: fix transfer-buffer memory leak (Johan Hovold)   
  - net: lan78xx: add missing endpoint sanity check (Johan Hovold)   
  - sh: Fix validation of system call number (Michael Karcher)   
  - selftests/net: rxtimestamp: fix clang issues for target arch PowerPC (Tanner Love)   
  - net/x25: Fix null-ptr-deref in x25_disconnect (YueHaibing)   
  - net/x25: Fix x25_neigh refcnt leak when x25 disconnect (Xiyu Yang)   
  - xfs: fix missed wakeup on l_flush_wait (Rik van Riel)   
  - x86, vmlinux.lds: Page-align end of ..page_aligned sections (Joerg Roedel)   
  - x86/build/lto: Fix truncated .bss with -fdata-sections (Sami Tolvanen)   
  - 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work (Wang Hai)   
  - 9p/trans_fd: abort p9_read_work if req status changed (Dominique Martinet)   
  - f2fs: check if file namelen exceeds max value (Sheng Yong)   
  - f2fs: check memory boundary by insane namelen (Jaegeuk Kim)   
  - drm: hold gem reference until object is no longer accessed (Steve Cohen)   
  - drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl() (Peilin Ye)   
  - ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints (Will Deacon)   
  - wireless: Use offsetof instead of custom macro. (Pi-Hsun Shih)   
  - PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge (Robert Hancock)   
  - iio: imu: adis16400: fix memory leak (Sasha Levin)   
  - crypto: ccp - Release all allocated memory if sha type is invalid (Navid Emamdoost)   
  - scsi: libsas: direct call probe and destruct (Jason Yan)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2048.el7uek]
changelog:
  - RDMA/umem: Move to allocate SG table from pages (Maor Gottlieb)  [Orabug: 32005755]  
  - lib/scatterlist: Add support in dynamic allocation of SG table from pages (Maor Gottlieb)  [Orabug: 32005755]  
  - lib/scatterlist: Add SG_CHAIN and SG_END macros for LSB encodings (Anshuman Khandual)  [Orabug: 32005755]  
  - lib/scatterlist: Avoid potential scatterlist entry overflow (Tvrtko Ursulin)  [Orabug: 32005755]  
  - lib/scatterlist: Fix offset type in sg_alloc_table_from_pages (Tvrtko Ursulin)  [Orabug: 32005755]  
  - ACPI: NFIT: Add runtime firmware activate support (Dan Williams)  [Orabug: 32082058]  
  - PM, libnvdimm: Add runtime firmware activation support (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Convert to DEVICE_ATTR_ADMIN_RO() (Dan Williams)  [Orabug: 32082058]  
  - driver-core: Introduce DEVICE_ATTR_ADMIN_{RO,RW} (Dan Williams)  [Orabug: 32082058]  
  - tools/testing/nvdimm: Emulate firmware activation commands (Dan Williams)  [Orabug: 32082058]  
  - tools/testing/nvdimm: Prepare nfit_ctl_test() for ND_CMD_CALL emulation (Dan Williams)  [Orabug: 32082058]  
  - tools/testing/nvdimm: Add command debug messages (Dan Williams)  [Orabug: 32082058]  
  - tools/testing/nvdimm: Cleanup dimm index passing (Dan Williams)  [Orabug: 32082058]  
  - ACPI: NFIT: Define runtime firmware activation commands (Dan Williams)  [Orabug: 32082058]  
  - ACPI: NFIT: Move bus_dsm_mask out of generic nvdimm_bus_descriptor (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Validate command family indices (Dan Williams)  [Orabug: 32082058]  
  - hibernation_availablePM: hibernate: Incorporate concurrency handling (Domenico Andreoli)  [Orabug: 32082058]  
  - libnvdimm: Move nvdimm_bus_attribute_group to device_type (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm/of_pmem: Provide a unique name for bus provider (Aneesh Kumar K.V)  [Orabug: 32082058]  
  - libnvdimm: Move nvdimm_attribute_group to device_type (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Move nd_mapping_attribute_group to device_type (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Move nd_region_attribute_group to device_type (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Move nd_numa_attribute_group to device_type (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Move nd_device_attribute_group to device_type (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Move region attribute group definition (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm/region: Rewrite _probe_success() to _advance_seeds() (Dan Williams)  [Orabug: 32082058]  
  - libnvdimm: Move attribute groups to device type (Dan Williams)  [Orabug: 32082058]  
  - acpi/nfit: improve bounds checking for 'func' (Dan Carpenter)  [Orabug: 32082058]  
  - ACPI/nfit: delete the function to_acpi_nfit_desc (Xiaochun Lee)  [Orabug: 32082058]  
  - ocfs2: initialize ip_next_orphan (Wengang Wang)  [Orabug: 32159054]  
  - lockdown: make lockdown mode available in securityfs (Alan Maguire)  [Orabug: 32164650]  
  - uek-rpm: Don't build emb2 kernel for mips (Dave Kleikamp)  [Orabug: 32176894]  
  - page_frag: Recover from memory pressure (Dongli Zhang)  [Orabug: 32177980]  
  - rds: fix out-of-tree build broken by tracepoints (Alan Maguire)  [Orabug: 32180549]


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2049.el7uek]
changelog:
  - scsi: qla2xxx: Update version to 10.02.00.103-k (Nilesh Javali)  [Orabug: 32214187]  
  - qla2xxx: back port upstream patch (Quinn Tran)  [Orabug: 32214187]  
  - scsi: scsi_transport_fc: Add FPIN fc event codes (James Smart)  [Orabug: 32214187]  
  - scsi: scsi_transport_fc: refactor event posting routines (James Smart)  [Orabug: 32214187]  
  - Revert "scsi: qla2xxx: Disable T10-DIF feature with FC-NVMe during probe" (Quinn Tran)  [Orabug: 32214187]  
  - Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" (Saurav Kashyap)  [Orabug: 32214187]  
  - scsi: qla2xxx: Check if FW supports MQ before enabling (Saurav Kashyap)  [Orabug: 32214187]  
  - scsi: qla2xxx: Allow ql2xextended_error_logging special value 1 to be set anytime (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Reduce noisy debug message (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Reduce duplicate code in reporting speed (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Indicate correct supported speeds for Mezz card (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Flush I/O on zone disable (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Flush all sessions on zone disable (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: remove incorrect sparse #ifdef (Linus Torvalds)  [Orabug: 32214187]  
  - scsi: qla2xxx: Return EBUSY on fcport deletion (Daniel Wagner)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix return of uninitialized value in rval (Colin Ian King)  [Orabug: 32214187]  
  - scsi: qla2xxx: Initialize variable in qla8044_poll_reg() (Tom Rix)  [Orabug: 32214187]  
  - scsi: qla2xxx: Do not consume srb greedily (Daniel Wagner)  [Orabug: 32214187]  
  - scsi: qla2xxx: Use constant when it is known (Pavel Machek (CIP))  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix null pointer access during disconnect from subsystem (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix inconsistent format argument type in qla_dbg.c (Ye Bin)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix inconsistent format argument type in qla_os.c (Ye Bin)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix inconsistent format argument type in tcm_qla2xxx.c (Ye Bin)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix point-to-point (N2N) device discovery issue (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix crash on session cleanup with unload (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix reset of MPI firmware (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix MPI reset needed message (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix buffer-buffer credit extraction error (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix WARN_ON in qla_nvme_register_hba (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Correct the check for sscanf() return value (Saurav Kashyap)  [Orabug: 32214187]  
  - scsi: qla2xxx: Update version to 10.02.00.102-k (Nilesh Javali)  [Orabug: 32214187]  
  - scsi: qla2xxx: Add SLER and PI control support (Saurav Kashyap)  [Orabug: 32214187]  
  - scsi: qla2xxx: Add IOCB resource tracking (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Add rport fields in debugfs (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Make tgt_port_database available in initiator mode (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix I/O errors during LIP reset tests (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Performance tweak (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix memory size truncation (Quinn Tran)  [Orabug: 32214187]  
  - scsi: qla2xxx: Honor status qualifier in FCP_RSP per spec (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Allow dev_loss_tmo setting for FC-NVMe devices (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Setup debugfs entries for remote ports (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix I/O failures during remote port toggle testing (Arun Easi)  [Orabug: 32214187]  
  - scsi: qla2xxx: Remove unneeded variable 'rval' (Jason Yan)  [Orabug: 32214187]  
  - scsi: qla2xxx: Handle incorrect entry_type entries (Daniel Wagner)  [Orabug: 32214187]  
  - scsi: qla2xxx: Log calling function name in qla2x00_get_sp_from_handle() (Daniel Wagner)  [Orabug: 32214187]  
  - scsi: qla2xxx: Simplify return value logic in qla2x00_get_sp_from_handle() (Daniel Wagner)  [Orabug: 32214187]  
  - scsi: qla2xxx: Warn if done() or free() are called on an already freed srb (Daniel Wagner)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix the return value (Xianting Tian)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba() (Tianjia Zhang)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix wrong return value in qlt_chk_unresolv_exchg() (Tianjia Zhang)  [Orabug: 32214187]  
  - scsi: qla2xxx: Remove redundant variable initialization (Tianjia Zhang)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix the size used in a 'dma_free_coherent()' call (Christophe JAILLET)  [Orabug: 32214187]  
  - scsi: qla2xxx: Remove pci-dma-compat wrapper API (Suraj Upadhyay)  [Orabug: 32214187]  
  - scsi: qla2xxx: Remove superfluous memset() (Li Heng)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix regression on sparc64 (René Rebe)  [Orabug: 32214187]  
  - scsi: qla2xxx: Use MBX_TOV_SECONDS for mailbox command timeout values (Enzo Matsumiya)  [Orabug: 32214187]  
  - scsi: qla2xxx: Address a set of sparse warnings (Shyam Sundar)  [Orabug: 32214187]  
  - scsi: qla2xxx: SAN congestion management implementation (Shyam Sundar)  [Orabug: 32214187]  
  - scsi: qla2xxx: Change in PUREX to handle FPIN ELS requests (Shyam Sundar)  [Orabug: 32214187]  
  - scsi: qla2xxx: Introduce a function for computing the debug message prefix (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Make qla2x00_restart_isp() easier to read (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Fix a Coverity complaint in qla2100_fw_dump() (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Make __qla2x00_alloc_iocbs() initialize 32 bits of request_t.handle (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Remove a superfluous cast (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Initialize 'n' before using it (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Make qla82xx_flash_wait_write_finish() easier to read (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Remove the __packed annotation from struct fcp_hdr and fcp_hdr_le (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: qla2xxx: Check the size of struct fcp_hdr at compile time (Bart Van Assche)  [Orabug: 32214187]  
  - scsi: fc: Update Descriptor definition and add RDF and Link Integrity FPINs (James Smart)  [Orabug: 32214187]  
  - scsi: fc: add FPIN ELS definition (James Smart)  [Orabug: 32214187]  
  - hv_netvsc: make recording RSS hash depend on feature flag (Stephen Hemminger)  [Orabug: 32159974]  
  - hv_netvsc: record hardware hash in skb (Stephen Hemminger)  [Orabug: 32159974]  
  - staging: rts5208: rename SG_END macro (Arnd Bergmann)  [Orabug: 32218535]  
  - misc: rtsx: rename SG_END macro (Arnd Bergmann)  [Orabug: 32218535]  
  - Linux 4.14.209 (Greg Kroah-Hartman)   
  - x86/microcode/intel: Check patch signature before saving microcode for early loading (Chen Yu)   
  - s390/dasd: fix null pointer dereference for ERP requests (Stefan Haberland)   
  - s390/cpum_sf.c: fix file permission for cpum_sfb_size (Thomas Richter)   
  - mac80211: free sta in sta_info_insert_finish() on errors (Johannes Berg)   
  - mac80211: minstrel: fix tx status processing corner case (Felix Fietkau)   
  - mac80211: minstrel: remove deferred sampling code (Felix Fietkau)   
  - xtensa: disable preemption around cache alias management calls (Max Filippov)   
  - regulator: workaround self-referent regulators (Michał Mirosław)   
  - regulator: avoid resolve_supply() infinite recursion (Michał Mirosław)   
  - regulator: fix memory leak with repeated set_machine_constraints() (Michał Mirosław)   
  - iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode (Hans de Goede)   
  - iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum (Hans de Goede)   
  - ext4: fix bogus warning in ext4_update_dx_flag() (Jan Kara)   
  - staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids (Brian O'Keefe)   
  - efivarfs: fix memory leak in efivarfs_create() (Vamshi K Sthambamkadi)   
  - tty: serial: imx: keep console clocks always on (Fugang Duan)   
  - ALSA: mixart: Fix mutex deadlock (Takashi Iwai)   
  - ALSA: ctl: fix error path at adding user-defined element set (Takashi Sakamoto)   
  - speakup: Do not let the line discipline be used several times (Samuel Thibault)   
  - powerpc/uaccess-flush: fix missing includes in kup-radix.h (Daniel Axtens)   
  - libfs: fix error cast of negative value in simple_attr_write() (Yicong Yang)   
  - xfs: revert "xfs: fix rmap key and record comparison functions" (Darrick J. Wong)   
  - regulator: ti-abb: Fix array out of bound read access on the first transition (Nishanth Menon)   
  - MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu (Zhang Qilong)   
  - ASoC: qcom: lpass-platform: Fix memory leak (Srinivasa Rao Mandadapu)   
  - can: m_can: m_can_handle_state_change(): fix state change (Wu Bo)   
  - can: peak_usb: fix potential integer overflow on shift of a int (Colin Ian King)   
  - can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() (Marc Kleine-Budde)   
  - can: ti_hecc: Fix memleak in ti_hecc_probe (Zhang Qilong)   
  - can: dev: can_restart(): post buffer from the right context (Alejandro Concepcion Rodriguez)   
  - can: af_can: prevent potential access of uninitialized member in canfd_rcv() (Anant Thazhemadam)   
  - can: af_can: prevent potential access of uninitialized member in can_rcv() (Anant Thazhemadam)   
  - perf lock: Don't free "lock_seq_stat" if read_count isn't zero (Leo Yan)   
  - ARM: dts: imx50-evk: Fix the chip select 1 IOMUX (Fabio Estevam)   
  - arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy (Sergey Matyukevich)   
  - MIPS: export has_transparent_hugepage() for modules (Randy Dunlap)   
  - Input: adxl34x - clean up a data type in adxl34x_probe() (Dan Carpenter)   
  - vfs: remove lockdep bogosity in __sb_start_write (Darrick J. Wong)   
  - arm64: psci: Avoid printing in cpu_psci_cpu_die() (Will Deacon)   
  - pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq (Jianqun Xu)   
  - net: ftgmac100: Fix crash when removing driver (Joel Stanley)   
  - tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate (Ryan Sharpelletti)   
  - net: usb: qmi_wwan: Set DTR quirk for MR400 (Filip Moc)   
  - net/mlx5: Disable QoS when min_rates on all VFs are zero (Vladyslav Tarasiuk)   
  - sctp: change to hold/put transport for proto_unreach_timer (Xin Long)   
  - qlcnic: fix error return code in qlcnic_83xx_restart_hw() (Zhang Changzhong)   
  - net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request (Xie He)   
  - net/mlx4_core: Fix init_hca fields offset (Aya Levin)   
  - netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist() (Paul Moore)   
  - netlabel: fix our progress tracking in netlbl_unlabel_staticlist() (Paul Moore)   
  - net: Have netpoll bring-up DSA management interface (Florian Fainelli)   
  - net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 (Tobias Waldekranz)   
  - net: bridge: add missing counters to ndo_get_stats64 callback (Heiner Kallweit)   
  - net: b44: fix error return code in b44_init_one() (Zhang Changzhong)   
  - mlxsw: core: Use variable timeout for EMAD retries (Ido Schimmel)   
  - inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() (Wang Hai)   
  - devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() (Wang Hai)   
  - bnxt_en: read EEPROM A2h address using page 0 (Edwin Peer)   
  - atm: nicstar: Unmap DMA on send error (Sebastian Andrzej Siewior)   
  - ah6: fix error return code in ah6_input() (Zhang Changzhong)   
  - Linux 4.14.208 (Greg Kroah-Hartman)   
  - ACPI: GED: fix -Wformat (Nick Desaulniers)   
  - KVM: x86: clflushopt should be treated as a no-op by emulation (David Edmondson)   
  - can: proc: can_remove_proc(): silence remove_proc_entry warning (Zhang Changzhong)   
  - mac80211: always wind down STA state (Johannes Berg)   
  - Input: sunkbd - avoid use-after-free in teardown paths (Dmitry Torokhov)   
  - powerpc/8xx: Always fault when _PAGE_ACCESSED is not set (Christophe Leroy)   
  - gpio: mockup: fix resource leak in error path (Bartosz Golaszewski)   
  - i2c: imx: Fix external abort on interrupt in exit paths (Krzysztof Kozlowski)   
  - i2c: imx: use clk notifier for rate changes (Lucas Stach)   
  - powerpc/64s: flush L1D after user accesses (Nicholas Piggin)   {CVE-2020-4788} 
  - powerpc/uaccess: Evaluate macro arguments once, before user access is allowed (Nicholas Piggin)   
  - powerpc: Fix __clear_user() with KUAP enabled (Andrew Donnellan)   
  - powerpc: Implement user_access_begin and friends (Christophe Leroy)   
  - powerpc: Add a framework for user access tracking (Christophe Leroy)   
  - powerpc/64s: flush L1D on kernel entry (Nicholas Piggin)   {CVE-2020-4788} 
  - powerpc/64s: move some exception handlers out of line (Daniel Axtens)   
  - powerpc/64s: Define MASKABLE_RELON_EXCEPTION_PSERIES_OOL (Daniel Axtens)   
  - Linux 4.14.207 (Greg Kroah-Hartman)   
  - mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race (Nicholas Piggin)   
  - Convert trailing spaces and periods in path components (Boris Protopopov)   
  - reboot: fix overflow parsing reboot cpu number (Matteo Croce)   
  - Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" (Matteo Croce)   
  - perf/core: Fix race in the perf_mmap_close() function (Jiri Olsa)   
  - xen/events: block rogue events for some time (Juergen Gross)   
  - xen/events: defer eoi in case of excessive number of events (Juergen Gross)   
  - xen/events: use a common cpu hotplug hook for event channels (Juergen Gross)   
  - xen/events: switch user event channels to lateeoi model (Juergen Gross)   
  - xen/pciback: use lateeoi irq binding (Juergen Gross)   
  - xen/pvcallsback: use lateeoi irq binding (Juergen Gross)   
  - xen/scsiback: use lateeoi irq binding (Juergen Gross)   
  - xen/netback: use lateeoi irq binding (Juergen Gross)   
  - xen/blkback: use lateeoi irq binding (Juergen Gross)   
  - xen/events: add a new "late EOI" evtchn framework (Juergen Gross)   
  - xen/events: fix race in evtchn_fifo_unmask() (Juergen Gross)   
  - xen/events: add a proper barrier to 2-level uevent unmasking (Juergen Gross)   
  - xen/events: avoid removing an event channel while handling it (Juergen Gross)   
  - perf/core: Fix crash when using HW tracing kernel filters (Mathieu Poirier)   
  - x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP (Anand K Mistry)   
  - random32: make prandom_u32() output unpredictable (George Spelvin)   
  - net: Update window_clamp if SOCK_RCVBUF is set (Mao Wenan)   
  - r8169: fix potential skb double free in an error path (Heiner Kallweit)   
  - vrf: Fix fast path output packet handling with async Netfilter rules (Martin Willi)   
  - net/x25: Fix null-ptr-deref in x25_connect (Martin Schiller)   
  - net/af_iucv: fix null pointer dereference on shutdown (Ursula Braun)   
  - IPv6: Set SIT tunnel hard_header_len to zero (Oliver Herms)   
  - swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb" (Stefano Stabellini)   
  - pinctrl: amd: fix incorrect way to disable debounce filter (Coiby Xu)   
  - pinctrl: amd: use higher precision for 512 RtcClk (Coiby Xu)   
  - drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] (Thomas Zimmermann)   
  - don't dump the threads that had been already exiting when zapped. (Al Viro)   
  - selinux: Fix error return code in sel_ib_pkey_sid_slow() (Chen Zhou)   
  - futex: Don't enable IRQs unconditionally in put_pi_state() (Dan Carpenter)   
  - mei: protect mei_cl_mtu from null dereference (Alexander Usyskin)   
  - usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode (Chris Brandt)   
  - uio: Fix use-after-free in uio_unregister_device() (Shin'ichiro Kawasaki)   
  - thunderbolt: Add the missed ida_simple_remove() in ring_request_msix() (Jing Xiangfeng)   
  - ext4: unlock xattr_sem properly in ext4_inline_data_truncate() (Joseph Qi)   
  - ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA (Kaixu Xia)   
  - perf: Fix get_recursion_context() (Peter Zijlstra)   
  - cosa: Add missing kfree in error path of cosa_write (Wang Hai)   
  - of/address: Fix of_node memory leak in of_dma_is_coherent (Evan Nimmo)   
  - xfs: fix a missing unlock on error in xfs_fs_map_blocks (Christoph Hellwig)   
  - xfs: fix rmap key and record comparison functions (Darrick J. Wong)   
  - xfs: fix flags argument to rmap lookup when converting shared file rmaps (Darrick J. Wong)   
  - nbd: fix a block_device refcount leak in nbd_release (Christoph Hellwig)   
  - pinctrl: aspeed: Fix GPI only function problem. (Billy Tsai)   
  - ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template (Andrew Jeffery)   
  - pinctrl: intel: Set default bias in case no particular value given (Andy Shevchenko)   
  - iommu/amd: Increase interrupt remapping table limit to 512 entries (Suravee Suthikulpanit)   
  - scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() (Hannes Reinecke)   
  - cfg80211: regulatory: Fix inconsistent format argument (Ye Bin)   
  - mac80211: fix use of skb payload instead of header (Johannes Berg)   
  - drm/amdgpu: perform srbm soft reset always on SDMA resume (Evan Quan)   
  - scsi: hpsa: Fix memory leak in hpsa_init_one() (Keita Suzuki)   
  - gfs2: check for live vs. read-only file system in gfs2_fitrim (Bob Peterson)   
  - gfs2: Add missing truncate_inode_pages_final for sd_aspace (Bob Peterson)   
  - gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free (Bob Peterson)   
  - usb: gadget: goku_udc: fix potential crashes in probe (Evgeny Novikov)   
  - ath9k_htc: Use appropriate rs_datalen type (Masashi Honma)   
  - Btrfs: fix missing error return if writeback for extent buffer never started (Filipe Manana)   
  - xfs: flush new eof page on truncate to avoid post-eof corruption (Brian Foster)   
  - can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on (Stephane Grosjean)   
  - can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping (Stephane Grosjean)   
  - can: peak_usb: add range checking in decode operations (Dan Carpenter)   
  - can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() (Oleksij Rempel)   
  - can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames (Oliver Hartkopp)   
  - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context (Vincent Mailhol)   
  - can: rx-offload: don't call kfree_skb() from IRQ context (Marc Kleine-Budde)   
  - ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (Dan Carpenter)   
  - perf tools: Add missing swap for ino_generation (Jiri Olsa)   
  - net: xfrm: fix a race condition during allocing spi (zhuoliang zhang)   
  - hv_balloon: disable warning when floor reached (Olaf Hering)   
  - genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY (Marc Zyngier)   
  - btrfs: reschedule when cloning lots of extents (Johannes Thumshirn)   
  - btrfs: sysfs: init devices outside of the chunk_mutex (Josef Bacik)   
  - nbd: don't update block size after device is started (Ming Lei)   
  - time: Prevent undefined behaviour in timespec64_to_ns() (Zeng Tao)   
  - mm: mempolicy: fix potential pte_unmap_unlock pte error (Shijie Luo)   
  - ring-buffer: Fix recursion protection transitions between interrupt context (Steven Rostedt (VMware))   
  - regulator: defer probe when trying to get voltage from unresolved supply (Michał Mirosław)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2050.el7uek]
changelog:
  - bnxt_en: Release PCI regions when DMA mask setup fails during probe. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: fix error return code in bnxt_init_board() (Zhang Changzhong)  [Orabug: 32223710]  
  - bnxt_en: Fix counter overflow logic. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Re-write PCI BARs after PCI fatal error. (Vasundhara Volam)  [Orabug: 32223710]  
  - bnxt_en: Set driver default message level. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Enable online self tests for multi-host/NPAR mode. (Vasundhara Volam)  [Orabug: 32223710]  
  - bnxt_en: Eliminate unnecessary RX resets. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Reduce unnecessary message log during RX errors. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Add a software counter for RX ring reset. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Implement RX ring reset in response to buffer errors. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Refactor bnxt_init_one_rx_ring(). (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Refactor bnxt_free_rx_skbs(). (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Update firmware interface spec to 1.10.1.68. (Vasundhara Volam)  [Orabug: 32223710]  
  - bnxt_en: Improve preset max value for ethtool -l. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Handle ethernet link being disabled by firmware. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: add basic infrastructure to support PAM4 link speeds (Edwin Peer)  [Orabug: 32223710]  
  - bnxt_en: refactor bnxt_get_fw_speed() (Edwin Peer)  [Orabug: 32223710]  
  - bnxt_en: refactor code to limit speed advertising (Edwin Peer)  [Orabug: 32223710]  
  - bnxt_en: Update firmware interface spec to 1.10.1.65. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Fix wrong flag value passed to HWRM_PORT_QSTATS_EXT fw call. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Fix HWRM_FUNC_QSTATS_EXT firmware call. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Return -EOPNOTSUPP for ETHTOOL_GREGS on VFs. (Vasundhara Volam)  [Orabug: 32223710]  
  - bnxt_en: return proper error codes in bnxt_show_temp (Edwin Peer)  [Orabug: 32223710]  
  - bnxt_en: Setup default RSS map in all scenarios. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: init RSS table for Minimal-Static VF reservation (Edwin Peer)  [Orabug: 32223710]  
  - bnxt_en: fix HWRM error when querying VF temperature (Edwin Peer)  [Orabug: 32223710]  
  - bnxt_en: Fix ethtool -S statitics with XDP or TCs enabled. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Don't query FW when netif_running() is false. (Pavan Chebbi)  [Orabug: 32223710]  
  - bnxt_en: Add support for 'ethtool -d' (Vasundhara Volam)  [Orabug: 32223710]  
  - bnxt_en: Switch over to use the 64-bit software accumulated counters. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Accumulate all counters. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Retrieve hardware masks for port counters. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Retrieve hardware counter masks from firmware if available. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Allocate additional memory for all statistics blocks. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Refactor statistics code and structures. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Use macros to define port statistics size and offset. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Update firmware interface to 1.10.1.54. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Remove PCIe non-counters from ethtool statistics (Vasundhara Volam)  [Orabug: 32223710]  
  - net: bnxt: don't complain if TC flower can't be supported (Jakub Kicinski)  [Orabug: 32223710]  
  - bnxt_en: Fix completion ring sizing with TPA enabled. (Michael Chan)  [Orabug: 32223710]  
  - bnxt_en: Init ethtool link settings after reading updated PHY configuration. (Vasundhara Volam)  [Orabug: 32223710]  
  - scsi: mpt3sas: Update driver version to 36.100.00.00 (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Handle trigger page after firmware update (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add persistent MPI trigger page (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add persistent SCSI sense trigger page (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add persistent Event trigger page (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add persistent Master trigger page (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add persistent trigger pages support (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Sync time periodically between driver and firmware (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Bump driver version to 35.101.00.00 (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add module parameter multipath_on_hba (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Handle vSES vphy object during HBA reset (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add bypass_dirty_port_flag parameter (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Handling HBA vSES device (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Set valid PhysicalPort in SMPPassThrough (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Update hba_port objects after host reset (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Get sas_device objects using device's rphy (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Rename transport_del_phy_from_an_existing_port() (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Get device objects using sas_address & portID (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Update hba_port's sas_address & phy_mask (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Rearrange _scsih_mark_responding_sas_device() (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Allocate memory for hba_port objects (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Define hba_port structure (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Fix ioctl timeout (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: A small correction in _base_process_reply_queue (Tomas Henzl)  [Orabug: 32242280]  
  - scsi: mpt3sas: Fix sync irqs (Tomas Henzl)  [Orabug: 32242280]  
  - scsi: mpt3sas: Detect tampered Aero and Sea adapters (Sreekanth Reddy)  [Orabug: 32242280]  
  - scsi: mpt3sas: Don't call disable_irq from IRQ poll handler (Tomas Henzl)  [Orabug: 32242280]  
  - scsi: mpt3sas: Remove pci-dma-compat wrapper API (Suraj Upadhyay)  [Orabug: 32242280]  
  - scsi: mpt3sas: Remove superfluous memset() (Li Heng)  [Orabug: 32242280]  
  - scsi: mpt3sas: Update driver version to 35.100.00.00 (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Postprocessing of target and LUN reset (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Add functions to check if any cmd is outstanding on Target and LUN (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Rename and export interrupt mask/unmask functions (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Cancel the running work during host reset (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Dump system registers for debugging (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Memset config_cmds.reply buffer with zeros (Suganath Prabu S)  [Orabug: 32242280]  
  - scsi: mpt3sas: Fix kdoc comments format (Damien Le Moal)  [Orabug: 32242280]  
  - scsi: mpt3sas: Fix set but unused variable (Damien Le Moal)  [Orabug: 32242280]  
  - scsi: mpt3sas: Fix error returns in BRM_status_show (Johannes Thumshirn)  [Orabug: 32242280]  
  - scsi: mpt3sas: Fix unlock imbalance (Damien Le Moal)  [Orabug: 32242280]  
  - scsi: mpt3sas: Fix spelling mistake (Flavio Suligoi)  [Orabug: 32242280]  
  - dm crypt: Allow unaligned bio buffer lengths for skcipher devices (Sudhakar Panneerselvam)  [Orabug: 31208895]  
  - vhost scsi: fix lun reset completion handling (Mike Christie)  [Orabug: 31782538]  
  - vhost scsi: Add support for LUN resets. (Mike Christie)  [Orabug: 31782538]  
  - vhost/scsi: Use copy_to_iter() to send control queue response (Bijan Mottahedeh)  [Orabug: 31782538]  
  - vhost scsi: add lun parser helper (Mike Christie)  [Orabug: 31782538]  
  - vhost scsi: fix cmd completion race (Mike Christie)  [Orabug: 31782538]  
  - vhost scsi: alloc cmds per vq instead of session (Mike Christie)  [Orabug: 31782538]  
  - vhost: add helper to check if a vq has been setup (Mike Christie)  [Orabug: 31782538]  
  - scsi: sd: Allow user to configure command retries (Mike Christie)  [Orabug: 31782538]  
  - scsi: core: Add limitless cmd retry support (Mike Christie)  [Orabug: 31782538]  
  - intel_idle: Customize IceLake server support (Chen Yu)  [Orabug: 32213908]  
  - qla2xxx: Add missing module version banner (John Donnelly)  [Orabug: 32249004]  
  - Linux 4.14.210 (Greg Kroah-Hartman)   
  - USB: core: Fix regression in Hercules audio card (Alan Stern)   
  - USB: core: add endpoint-blacklist quirk (Johan Hovold)   
  - x86/resctrl: Add necessary kernfs_put() calls to prevent refcount leak (Xiaochen Shen)   
  - x86/resctrl: Remove superfluous kernfs_get() calls to prevent refcount leak (Xiaochen Shen)   
  - usb: gadget: Fix memleak in gadgetfs_fill_super (Zhang Qilong)   
  - usb: gadget: f_midi: Fix memleak in f_midi_alloc (Zhang Qilong)   
  - USB: core: Change %pK for __user pointers to %px (Alan Stern)   
  - perf probe: Fix to die_entrypc() returns error correctly (Masami Hiramatsu)   
  - can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 (Marc Kleine-Budde)   
  - platform/x86: toshiba_acpi: Fix the wrong variable assignment (Kaixu Xia)   
  - can: gs_usb: fix endianess problem with candleLight firmware (Marc Kleine-Budde)   
  - efivarfs: revert "fix memory leak in efivarfs_create()" (Ard Biesheuvel)   
  - ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq (Lijun Pan)   
  - ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues (Lijun Pan)   
  - net: ena: set initial DMA width to avoid intel iommu issue (Shay Agroskin)   
  - nfc: s3fwrn5: use signed integer for parsing GPIO numbers (Krzysztof Kozlowski)   
  - IB/mthca: fix return value of error branch in mthca_init_cq() (Xiongfeng Wang)   
  - bnxt_en: Release PCI regions when DMA mask setup fails during probe. (Michael Chan)   
  - video: hyperv_fb: Fix the cache type when mapping the VRAM (Dexuan Cui)   
  - bnxt_en: fix error return code in bnxt_init_board() (Zhang Changzhong)   
  - bnxt_en: fix error return code in bnxt_init_one() (Zhang Changzhong)   
  - scsi: ufs: Fix race between shutdown and runtime resume flow (Stanley Chu)   
  - batman-adv: set .owner to THIS_MODULE (Taehee Yoo)   
  - phy: tegra: xusb: Fix dangling pointer on probe failure (Marc Zyngier)   
  - perf/x86: fix sysfs type mismatches (Sami Tolvanen)   
  - scsi: target: iscsi: Fix cmd abort fabric stop race (Mike Christie)   
  - scsi: libiscsi: Fix NOP race condition (Lee Duncan)   
  - dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size (Sugar Zhang)   
  - nvme: free sq/cq dbbuf pointers when dbbuf set fails (Minwoo Im)   
  - proc: don't allow async path resolution of /proc/self components (Jens Axboe)   
  - HID: Add Logitech Dinovo Edge battery quirk (Hans de Goede)   
  - x86/xen: don't unbind uninitialized lock_kicker_irq (Brian Masney)   
  - dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant (Marc Ferland)   
  - HID: hid-sensor-hub: Fix issue with devices with no report ID (Pablo Ceballos)   
  - Input: i8042 - allow insmod to succeed on devices without an i8042 controller (Hans de Goede)   
  - HID: cypress: Support Varmilo Keyboards' media hotkeys (Frank Yang)   
  - ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close (Kai Vehmanen)   
  - ALSA: hda/hdmi: Use single mutex unlock in error paths (Takashi Iwai)   
  - arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() (Will Deacon)   
  - arm64: pgtable: Fix pte_accessible() (Will Deacon)   
  - btrfs: adjust return values of btrfs_inode_by_name (Su Yue)   
  - btrfs: tree-checker: Enhance chunk checker to validate chunk profile (Qu Wenruo)   
  - PCI: Add device even if driver attach failed (Rajat Jain)   
  - wireless: Use linux/stddef.h instead of stddef.h (Hauke Mehrtens)   
  - btrfs: fix lockdep splat when reading qgroup config on mount (Filipe Manana)   
  - mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() (Gerald Schaefer)   
  - perf event: Check ref_reloc_sym before using it (Igor Lubashev)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2051.el7uek]
changelog:
  - Linux 4.14.212 (Greg Kroah-Hartman)   
  - x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes (Masami Hiramatsu)   
  - Input: i8042 - fix error return code in i8042_setup_aux() (Luo Meng)   
  - i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc() (Zhihao Cheng)   
  - gfs2: check for empty rgrp tree in gfs2_ri_update (Bob Peterson)   
  - tracing: Fix userstacktrace option for instances (Steven Rostedt (VMware))   
  - spi: bcm2835: Release the DMA channel if probe fails after dma_init (Peter Ujfalusi)   
  - spi: bcm2835: Fix use-after-free on unbind (Lukas Wunner)   
  - spi: bcm-qspi: Fix use-after-free on unbind (Lukas Wunner)   
  - spi: Introduce device-managed SPI controller allocation (Lukas Wunner)   
  - iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs (Suravee Suthikulpanit)   
  - speakup: Reject setting the speakup line discipline outside of speakup (Samuel Thibault)   
  - i2c: imx: Check for I2SR_IAL after every byte (Christian Eggers)   
  - i2c: imx: Fix reset of I2SR_IAL flag (Christian Eggers)   
  - mm/swapfile: do not sleep with a spin lock held (Qian Cai)   
  - cifs: fix potential use-after-free in cifs_echo_request() (Paulo Alcantara)   
  - ftrace: Fix updating FTRACE_FL_TRAMP (Naveen N. Rao)   
  - ALSA: hda/generic: Add option to enforce preferred_dacs pairs (Takashi Iwai)   
  - ALSA: hda/realtek - Add new codec supported for ALC897 (Kailang Yang)   
  - tty: Fix ->session locking (Jann Horn)   
  - tty: Fix ->pgrp locking in tiocspgrp() (Jann Horn)   
  - USB: serial: option: fix Quectel BG96 matching (Bjørn Mork)   
  - USB: serial: option: add support for Thales Cinterion EXS82 (Giacinto Cifelli)   
  - USB: serial: option: add Fibocom NL668 variants (Vincent Palatin)   
  - USB: serial: ch341: sort device-id entries (Johan Hovold)   
  - USB: serial: ch341: add new Product ID for CH341A (Jan-Niklas Burfeind)   
  - USB: serial: kl5kusb105: fix memleak on open (Johan Hovold)   
  - usb: gadget: f_fs: Use local copy of descriptors for userspace copy (Vamsi Krishna Samavedam)   
  - vlan: consolidate VLAN parsing code and limit max parsing depth (Toke Høiland-Jørgensen)   
  - pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(..., GPIOD_OUT_HIGH) (Hans de Goede)   
  - pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq pin to output (Hans de Goede)   
  - Linux 4.14.211 (Greg Kroah-Hartman)   
  - RDMA/i40iw: Address an mmap handler exploit in i40iw (Shiraz Saleem)   
  - Input: i8042 - add ByteSpeed touchpad to noloop table (Po-Hsu Lin)   
  - Input: xpad - support Ardwiino Controllers (Sanjay Govind)   
  - ALSA: usb-audio: US16x08: fix value count for level meters (Hector Martin)   
  - dt-bindings: net: correct interrupt flags in examples (Krzysztof Kozlowski)   
  - net/mlx5: Fix wrong address reclaim when command interface is down (Eran Ben Elisha)   
  - net: pasemi: fix error return code in pasemi_mac_open() (Zhang Changzhong)   
  - cxgb3: fix error return code in t3_sge_alloc_qset() (Zhang Changzhong)   
  - net/x25: prevent a couple of overflows (Dan Carpenter)   
  - ibmvnic: Fix TX completion error handling (Thomas Falcon)   
  - ibmvnic: Ensure that SCRQ entry reads are correctly ordered (Thomas Falcon)   
  - ipv4: Fix tos mask in inet_rtm_getroute() (Guillaume Nault)   
  - netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal (Antoine Tenart)   
  - bonding: wait for sysfs kobject destruction before freeing struct slave (Jamie Iles)   
  - usbnet: ipheth: fix connectivity with iOS 14 (Yves-Alexis Perez)   
  - tun: honor IOCB_NOWAIT flag (Jens Axboe)   
  - tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control (Alexander Duyck)   
  - sock: set sk_err to ee_errno on dequeue from errq (Willem de Bruijn)   
  - rose: Fix Null pointer dereference in rose_send_frame() (Anmol Karn)   
  - net/af_iucv: set correct sk_protocol for child sockets (Julian Wiedmann)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2052.el7uek]
changelog:
  - xenbus/xenbus_backend: Disallow pending watch messages (SeongJae Park)  [Orabug: 32253410]  {CVE-2020-29568} 
  - xen/xenbus: Count pending messages for each watch (SeongJae Park)  [Orabug: 32253410]  {CVE-2020-29568} 
  - xen/xenbus/xen_bus_type: Support will_handle watch callback (SeongJae Park)  [Orabug: 32253410]  {CVE-2020-29568} 
  - xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path() (SeongJae Park)  [Orabug: 32253410]  {CVE-2020-29568} 
  - xen/xenbus: Allow watches discard events before queueing (SeongJae Park)  [Orabug: 32253410]  {CVE-2020-29568} 
  - xen-blkback: set ring->xenblkd to NULL after kthread_stop() (Pawel Wieczorkiewicz)  [Orabug: 32260254]  {CVE-2020-29569} 
  - partitions/efi: Enable no warning option for the GPT warnings related to alternative header (Saeed Mirzamohammadi)  [Orabug: 32302137]  
  - net/rds: Only yield with a valid "i_connecting_ts" timestamp (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Only increment rdma_resolve_route timeout on error (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Don't block workqueues "cma_wq" and "cm.wq" (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Don't drop neighbor loopback connection (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Take the GID offset into account for IB devices (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Leave the neighbor cache alone (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Give each connection its own workqueue (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Disassociate ic and cm_id before rdma_destroy_id (Gerd Rausch)  [Orabug: 32306094]  
  - Revert "rds: ib: Implement proper cm_id compare" (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Add a rdma_cm watchdog timer (Gerd Rausch)  [Orabug: 32306094]  
  - Revert "RDS: IB: fix panic with handlers running post teardown" (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Release all resources allocated by "rds_ib_setup_qp" (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Change the "rds_aux_wq" workqueue to loose order (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Don't sleep inside worker threads (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Fix a few race conditions (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Execute "rdma_destroy_id" in the background (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Delay reconnects from passive side by 3 seconds (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Drop connections when peers perform failover (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Yield to incoming connection requests (Gerd Rausch)  [Orabug: 32306094]  
  - net/rds: Remove stale comments about random backoff (Gerd Rausch)  [Orabug: 32306094]


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2101.el7uek]
changelog:
  - x86/process: Mark cpu inactive before offlining (Mridula Shastry)  [Orabug: 32245070]  
  - mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start (Zhang Xiaohui)  [Orabug: 32349204]  {CVE-2020-36158} 
  - add license checking to kABI checker (Dan Duval)  [Orabug: 32355207]  
  - Linux 4.14.213 (Greg Kroah-Hartman)   
  - PCI: Fix pci_slot_release() NULL pointer dereference (Jubin Zhong)   
  - libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels (Dan Williams)   
  - clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9 (Terry Zhou)   
  - md/cluster: fix deadlock when node is doing resync job (Zhao Heming)   
  - iio:imu:bmi160: Fix too large a buffer. (Jonathan Cameron)   
  - iio:pressure:mpl3115: Force alignment of buffer (Jonathan Cameron)   
  - iio:light:rpr0521: Fix timestamp alignment and prevent data leak. (Jonathan Cameron)   
  - iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume (Qinglang Miao)   
  - iio: buffer: Fix demux update (Nuno Sá)   
  - mtd: parser: cmdline: Fix parsing of part-names with colons (Sven Eckelmann)   
  - soc: qcom: smp2p: Safely acquire spinlock without IRQs (Evan Green)   
  - spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path (Lukas Wunner)   
  - spi: sc18is602: Don't leak SPI master in probe error path (Lukas Wunner)   
  - spi: rb4xx: Don't leak SPI master in probe error path (Lukas Wunner)   
  - spi: pic32: Don't leak DMA channels in probe error path (Lukas Wunner)   
  - spi: davinci: Fix use-after-free on unbind (Lukas Wunner)   
  - spi: spi-sh: Fix use-after-free on unbind (Lukas Wunner)   
  - drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() (Zwane Mwaikambo)   
  - jfs: Fix array index bounds check in dbAdjTree (Dave Kleikamp)   
  - jffs2: Fix GC exit abnormally (Zhe Li)   
  - ceph: fix race in concurrent __ceph_remove_cap invocations (Luis Henriques)   
  - ima: Don't modify file descriptor mode on the fly (Roberto Sassu)   
  - powerpc/powernv/memtrace: Don't leak kernel memory to user space (David Hildenbrand)   
  - powerpc/xmon: Change printk() to pr_cont() (Christophe Leroy)   
  - powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter (Tyrel Datwyler)   
  - ARM: dts: at91: sama5d2: fix CAN message ram offset and size (Nicolas Ferre)   
  - KVM: arm64: Introduce handling of AArch32 TTBCR2 traps (Marc Zyngier)   
  - ext4: fix deadlock with fs freezing and EA inodes (Jan Kara)   
  - ext4: fix a memory leak of ext4_free_data (Chunguang Xu)   
  - USB: serial: keyspan_pda: fix write unthrottling (Johan Hovold)   
  - USB: serial: keyspan_pda: fix tx-unthrottle use-after-free (Johan Hovold)   
  - USB: serial: keyspan_pda: fix write-wakeup use-after-free (Johan Hovold)   
  - USB: serial: keyspan_pda: fix stalled writes (Johan Hovold)   
  - USB: serial: keyspan_pda: fix write deadlock (Johan Hovold)   
  - USB: serial: keyspan_pda: fix dropped unthrottle interrupts (Johan Hovold)   
  - USB: serial: mos7720: fix parallel-port state restore (Johan Hovold)   
  - EDAC/amd64: Fix PCI component registration (Borislav Petkov)   
  - crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() (Ard Biesheuvel)   
  - powerpc/perf: Exclude kernel samples while counting events in user space. (Athira Rajeev)   
  - staging: comedi: mf6x4: Fix AI end-of-conversion detection (Ian Abbott)   
  - s390/dasd: fix list corruption of lcu list (Stefan Haberland)   
  - s390/dasd: fix list corruption of pavgroup group list (Stefan Haberland)   
  - s390/dasd: prevent inconsistent LCU device data (Stefan Haberland)   
  - s390/smp: perform initial CPU reset also for SMT siblings (Sven Schnelle)   
  - ALSA: usb-audio: Disable sample read check if firmware doesn't give back (Takashi Iwai)   
  - ALSA: pcm: oss: Fix a few more UBSAN fixes (Takashi Iwai)   
  - ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (Chris Chiu)   
  - ACPI: PNP: compare the string length in the matching_id() (Hui Wang)   
  - Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" (Daniel Scally)   
  - PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() (Rafael J. Wysocki)   
  - Input: cyapa_gen6 - fix out-of-bounds stack access (Arnd Bergmann)   
  - media: netup_unidvb: Don't leak SPI master in probe error path (Lukas Wunner)   
  - media: sunxi-cir: ensure IR is handled when it is continuous (Sean Young)   
  - media: gspca: Fix memory leak in probe (Alan Stern)   
  - Input: goodix - add upside-down quirk for Teclast X98 Pro tablet (Simon Beginn)   
  - Input: cros_ec_keyb - send 'scancodes' in addition to key events (Dmitry Torokhov)   
  - fix namespaced fscaps when !CONFIG_SECURITY (Serge Hallyn)   
  - cfg80211: initialize rekey_data (Sara Sharon)   
  - clk: sunxi-ng: Make sure divider tables have sentinel (Jernej Skrabec)   
  - clk: s2mps11: Fix a resource leak in error handling paths in the probe function (Christophe JAILLET)   
  - qlcnic: Fix error code in probe (Dan Carpenter)   
  - perf record: Fix memory leak when using '--user-regs=?' to list registers (Zheng Zengkai)   
  - pwm: lp3943: Dynamically allocate PWM chip base (Lokesh Vutla)   
  - pwm: zx: Add missing cleanup in error path (Uwe Kleine-König)   
  - clk: ti: Fix memleak in ti_fapll_synth_setup (Zhang Qilong)   
  - watchdog: coh901327: add COMMON_CLK dependency (Arnd Bergmann)   
  - watchdog: qcom: Avoid context switch in restart handler (Manivannan Sadhasivam)   
  - net: korina: fix return value (Vincent Stehlé)   
  - net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function (Christophe JAILLET)   
  - net: bcmgenet: Fix a resource leak in an error handling path in the probe functin (Christophe JAILLET)   
  - checkpatch: fix unescaped left brace (Dwaipayan Ray)   
  - powerpc/ps3: use dma_mapping_error() (Vincent Stehlé)   
  - nfc: s3fwrn5: Release the nfc firmware (Bongsu Jeon)   
  - um: chan_xterm: Fix fd leak (Anton Ivanov)   
  - watchdog: sirfsoc: Add missing dependency on HAS_IOMEM (Guenter Roeck)   
  - irqchip/alpine-msi: Fix freeing of interrupts on allocation error path (Marc Zyngier)   
  - ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control() (Dan Carpenter)   
  - extcon: max77693: Fix modalias string (Marek Szyprowski)   
  - clk: tegra: Fix duplicated SE clock entry (Dmitry Osipenko)   
  - x86/kprobes: Restore BTF if the single-stepping is cancelled (Masami Hiramatsu)   
  - nfs_common: need lock during iterate through the list (Cheng Lin)   
  - nfsd: Fix message level for normal termination (kazuo ito)   
  - speakup: fix uninitialized flush_lock (Yang Yingliang)   
  - usb: oxu210hp-hcd: Fix memory leak in oxu_create (Zhang Qilong)   
  - usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe (Zhang Qilong)   
  - powerpc/pseries/hibernation: remove redundant cacheinfo update (Nathan Lynch)   
  - powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops (Nathan Lynch)   
  - scsi: fnic: Fix error return code in fnic_probe() (Zhang Changzhong)   
  - scsi: pm80xx: Fix error return in pm8001_pci_probe() (Zhang Qilong)   
  - scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe (Qinglang Miao)   
  - cpufreq: scpi: Add missing MODULE_ALIAS (Pali Rohár)   
  - cpufreq: loongson1: Add missing MODULE_ALIAS (Pali Rohár)   
  - cpufreq: st: Add missing MODULE_DEVICE_TABLE (Pali Rohár)   
  - cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE (Pali Rohár)   
  - cpufreq: highbank: Add missing MODULE_DEVICE_TABLE (Pali Rohár)   
  - clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI (Keqian Zhu)   
  - dm ioctl: fix error return code in target_message (Qinglang Miao)   
  - ASoC: jz4740-i2s: add missed checks for clk_get() (Chuhong Yuan)   
  - net/mlx5: Properly convey driver version to firmware (Leon Romanovsky)   
  - memstick: r592: Fix error return in r592_probe() (Jing Xiangfeng)   
  - arm64: dts: rockchip: Fix UART pull-ups on rk3328 (Chen-Yu Tsai)   
  - pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() (Yu Kuai)   
  - ARM: dts: at91: sama5d2: map securam as device (Claudiu Beznea)   
  - clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent() (Yu Kuai)   
  - media: saa7146: fix array overflow in vidioc_s_audio() (Dan Carpenter)   
  - vfio-pci: Use io_remap_pfn_range() for PCI IO memory (Jason Gunthorpe)   
  - NFS: switch nfsiod to be an UNBOUND workqueue. (NeilBrown)   
  - lockd: don't use interval-based rebinding over TCP (Calum Mackay)   
  - SUNRPC: xprt_load_transport() needs to support the netid "rdma6" (Trond Myklebust)   
  - NFSv4.2: condition READDIR's mask for security label based on LSM state (Olga Kornievskaia)   
  - ath10k: Release some resources in an error handling path (Christophe JAILLET)   
  - ath10k: Fix an error handling path (Christophe JAILLET)   
  - ARM: dts: at91: at91sam9rl: fix ADC triggers (Alexandre Belloni)   
  - PCI: iproc: Fix out-of-bound array accesses (Bharat Gooty)   
  - genirq/irqdomain: Don't try to free an interrupt that has no mapping (Marc Zyngier)   
  - power: supply: bq24190_charger: fix reference leak (Zhang Qilong)   
  - ARM: dts: Remove non-existent i2c1 from 98dx3236 (Chris Packham)   
  - HSI: omap_ssi: Don't jump to free ID in ssi_add_controller() (Jing Xiangfeng)   
  - media: max2175: fix max2175_set_csm_mode() error code (Dan Carpenter)   
  - mips: cdmm: fix use-after-free in mips_cdmm_bus_discover (Qinglang Miao)   
  - samples: bpf: Fix lwt_len_hist reusing previous BPF map (Daniel T. Lee)   
  - media: siano: fix memory leak of debugfs members in smsdvb_hotplug (Keita Suzuki)   
  - cw1200: fix missing destroy_workqueue() on error in cw1200_init_common (Qinglang Miao)   
  - orinoco: Move context allocation after processing the skb (Sebastian Andrzej Siewior)   
  - ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host (Cristian Birsan)   
  - ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host (Cristian Birsan)   
  - memstick: fix a double-free bug in memstick_check (Qinglang Miao)   
  - RDMA/cxgb4: Validate the number of CQEs (Kamal Heib)   
  - Input: omap4-keypad - fix runtime PM error handling (Zhang Qilong)   
  - drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe (Zhihao Cheng)   
  - soc: ti: Fix reference imbalance in knav_dma_probe (Zhang Qilong)   
  - soc: ti: knav_qmss: fix reference leak in knav_queue_probe (Zhang Qilong)   
  - crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe (Zhang Qilong)   
  - powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 (Christophe Leroy)   
  - Input: ads7846 - fix unaligned access on 7845 (Dmitry Torokhov)   
  - Input: ads7846 - fix integer overflow on Rt calculation (Oleksij Rempel)   
  - Input: ads7846 - fix race that causes missing releases (David Jander)   
  - drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() (Yang Yingliang)   
  - media: solo6x10: fix missing snd_card_free in error handling case (Qinglang Miao)   
  - scsi: core: Fix VPD LUN ID designator priorities (Martin Wilck)   
  - media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm() (Yu Kuai)   
  - staging: greybus: codecs: Fix reference counter leak in error handling (Zhang Qilong)   
  - MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA (Necip Fazil Yildiran)   
  - RDMa/mthca: Work around -Wenum-conversion warning (Arnd Bergmann)   
  - ASoC: arizona: Fix a wrong free in wm8997_probe (Zhang Qilong)   
  - ASoC: wm8998: Fix PM disable depth imbalance on error (Zhang Qilong)   
  - mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure (Tsuchiya Yuto)   
  - spi: tegra114: fix reference leak in tegra spi ops (Zhang Qilong)   
  - spi: tegra20-sflash: fix reference leak in tegra_sflash_resume (Zhang Qilong)   
  - spi: tegra20-slink: fix reference leak in slink ops of tegra20 (Zhang Qilong)   
  - spi: spi-ti-qspi: fix reference leak in ti_qspi_setup (Zhang Qilong)   
  - Bluetooth: Fix null pointer dereference in hci_event_packet() (Anmol Karn)   
  - arm64: dts: exynos: Correct psci compatible used on Exynos7 (Paweł Chmiel)   
  - selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling (Paul Moore)   
  - ASoC: pcm: DRAIN support reactivation (Cezary Rojewski)   
  - spi: img-spfi: fix reference leak in img_spfi_resume (Zhang Qilong)   
  - crypto: talitos - Fix return type of current_desc_hdr() (Christophe Leroy)   
  - sched: Reenable interrupts in do_sched_yield() (Thomas Gleixner)   
  - sched/deadline: Fix sched_dl_global_validate() (Peng Liu)   
  - ARM: p2v: fix handling of LPAE translation in BE mode (Ard Biesheuvel)   
  - x86/mm/ident_map: Check for errors from ident_pud_init() (Arvind Sankar)   
  - RDMA/rxe: Compute PSN windows correctly (Bob Pearson)   
  - selinux: fix error initialization in inode_doinit_with_dentry() (Tianyue Ren)   
  - RDMA/bnxt_re: Set queue pair state when being queried (Kamal Heib)   
  - soc: mediatek: Check if power domains can be powered on at boot time (Nicolas Boichat)   
  - soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains() (Dan Carpenter)   
  - drm/gma500: fix double free of gma_connector (Tom Rix)   
  - Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() (Peilin Ye)   
  - md: fix a warning caused by a race between concurrent md_ioctl()s (Dae R. Jeong)   
  - crypto: af_alg - avoid undefined behavior accessing salg_name (Eric Biggers)   
  - media: msi2500: assign SPI bus number dynamically (Antti Palosaari)   
  - quota: Sanity-check quota file headers on load (Jan Kara)   
  - serial_core: Check for port state when tty is in error state (Alexey Kardashevskiy)   
  - HID: i2c-hid: add Vero K147 to descriptor override (Julian Sax)   
  - ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU (Krzysztof Kozlowski)   
  - ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 (Krzysztof Kozlowski)   
  - ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU (Krzysztof Kozlowski)   
  - usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul (Fabio Estevam)   
  - USB: gadget: f_rndis: fix bitrate for SuperSpeed and above (Will McVicker)   
  - usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus (Jack Pham)   
  - USB: gadget: f_midi: setup SuperSpeed Plus descriptors (Will McVicker)   
  - USB: gadget: f_acm: add support for SuperSpeed Plus (taehyun.cho)   
  - USB: serial: option: add interface-number sanity check to flag handling (Johan Hovold)   
  - soc/tegra: fuse: Fix index bug in get_process_id (Nicolin Chen)   
  - dm table: Remove BUG_ON(in_interrupt()) (Thomas Gleixner)   
  - scsi: mpt3sas: Increase IOCInit request timeout to 30s (Sreekanth Reddy)   
  - vxlan: Copy needed_tailroom from lowerdev (Sven Eckelmann)   
  - vxlan: Add needed_headroom for lower device (Sven Eckelmann)   
  - drm/tegra: sor: Disable clocks on error in tegra_sor_init() (Qinglang Miao)   
  - kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling (Nicholas Piggin)   
  - RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait (Leon Romanovsky)   
  - can: softing: softing_netdev_open(): fix error handling (Zhang Qilong)   
  - scsi: bnx2i: Requires MMU (Randy Dunlap)   
  - gpio: mvebu: fix potential user-after-free on probe (Baruch Siach)   
  - ARM: dts: sun8i: v3s: fix GIC node memory range (Icenowy Zheng)   
  - pinctrl: baytrail: Avoid clearing debounce value when turning it off (Andy Shevchenko)   
  - pinctrl: merrifield: Set default bias in case no particular value given (Andy Shevchenko)   
  - drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi (Xin Xiong)   
  - serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access (Alexander Sverdlin)   
  - ALSA: pcm: oss: Fix potential out-of-bounds shift (Takashi Iwai)   
  - USB: sisusbvga: Make console support depend on BROKEN (Thomas Gleixner)   
  - USB: UAS: introduce a quirk to set no_write_same (Oliver Neukum)   
  - xhci: Give USB2 ports time to enter U3 in bus suspend (Li Jun)   
  - ALSA: usb-audio: Fix control 'access overflow' errors from chmap (Takashi Iwai)   
  - ALSA: usb-audio: Fix potential out-of-bounds shift (Takashi Iwai)   
  - USB: add RESET_RESUME quirk for Snapscan 1212 (Oliver Neukum)   
  - USB: dummy-hcd: Fix uninitialized array use in init() (Bui Quang Minh)   
  - mac80211: mesh: fix mesh_pathtbl_init() error path (Eric Dumazet)   
  - net: bridge: vlan: fix error return code in __vlan_add() (Zhang Changzhong)   
  - net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux (Martin Blumenstingl)   
  - net: stmmac: delete the eee_ctrl_timer after napi disabled (Fugang Duan)   
  - net/mlx4_en: Handle TX error CQE (Moshe Shemesh)   
  - net/mlx4_en: Avoid scheduling restart task if it is already running (Moshe Shemesh)   
  - tcp: fix cwnd-limited bug for TSO deferral where we send nothing (Neal Cardwell)   
  - net: stmmac: free tx skb buffer in stmmac_resume() (Fugang Duan)   
  - PCI: qcom: Add missing reset for ipq806x (Ansuel Smith)   
  - x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP (Arvind Sankar)   
  - scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()" (Dan Carpenter)   
  - kbuild: avoid static_assert for genksyms (Arnd Bergmann)   
  - pinctrl: amd: remove debounce filter setting in IRQ type setting (Coiby Xu)   
  - Input: i8042 - add Acer laptops to the i8042 reset list (Chris Chiu)   
  - Input: cm109 - do not stomp on control URB (Dmitry Torokhov)   
  - platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE (Timo Witte)   
  - soc: fsl: dpio: Get the cpumask through cpumask_of(cpu) (Hao Si)   
  - scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE (Can Guo)   
  - ARC: stack unwinding: don't assume non-current task is sleeping (Vineet Gupta)   
  - iwlwifi: mvm: fix kernel panic in case of assert during CSA (Sara Sharon)   
  - arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards. (Markus Reichl)   
  - iwlwifi: pcie: limit memory read spin time (Johannes Berg)   
  - spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe (Nathan Chancellor)   
  - spi: bcm2835aux: Fix use-after-free on unbind (Lukas Wunner)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-2102.el7uek]
changelog:
  - net/rds: Fix gfp_t parameter (Hans Westgaard Ry)  [Orabug: 32372159]  
  - uek-rpm: update kABI lists for new symbol (Dan Duval)  [Orabug: 32378207]  
  - A/A Bonding: Fix a one-byte-off kmalloc (Håkon Bugge)  [Orabug: 32380825]  
  - net/mlx5: Use a single MSIX vector for all control EQs in VFs (Ariel Levkovich)  [Orabug: 31785236]  
  - net/mlx5: Fix available EQs FW used to reserve (Denis Drozdov)  [Orabug: 31785236]  
  - net/mlx5: Use max_num_eqs for calculation of required MSIX vectors (Denis Drozdov)  [Orabug: 31785236]  
  - net/mlx5: Expose DEVX specification (Yishai Hadas)  [Orabug: 31785236]  
  - A/A Bonding: Introduce selective interface name inclusion (Håkon Bugge)  [Orabug: 32321059]  
  - Linux 4.14.215 (Greg Kroah-Hartman)   
  - scsi: target: Fix XCOPY NAA identifier lookup (David Disseldorp)   {CVE-2020-28374} 
  - KVM: x86: fix shift out of bounds reported by UBSAN (Paolo Bonzini)   
  - x86/mtrr: Correct the range check before performing MTRR type lookups (Ying-Tsun Huang)   
  - netfilter: xt_RATEEST: reject non-null terminated string from userspace (Florian Westphal)   
  - netfilter: ipset: fix shift-out-of-bounds in htable_bits() (Vasily Averin)   
  - Revert "device property: Keep secondary firmware node secondary by type" (Bard Liao)   
  - ALSA: hda/realtek - Fix speaker volume control on Lenovo C940 (Kailang Yang)   
  - ALSA: hda/conexant: add a new hda codec CX11970 (bo liu)   
  - x86/mm: Fix leak of pmd ptlock (Dan Williams)   
  - USB: serial: keyspan_pda: remove unused variable (Johan Hovold)   
  - usb: gadget: configfs: Fix use-after-free issue with udc_name (Eddie Hung)   
  - usb: gadget: configfs: Preserve function ordering after bind failure (Chandana Kishori Chiluveru)   
  - usb: gadget: Fix spinlock lockup on usb_function_deactivate (Sriharsha Allenki)   
  - USB: gadget: legacy: fix return error code in acm_ms_bind() (Yang Yingliang)   
  - usb: gadget: function: printer: Fix a memory leak for interface descriptor (Zqiang)   
  - usb: gadget: f_uac2: reset wMaxPacketSize (Jerome Brunet)   
  - usb: gadget: select CONFIG_CRC32 (Arnd Bergmann)   
  - ALSA: usb-audio: Fix UBSAN warnings for MIDI jacks (Takashi Iwai)   
  - USB: usblp: fix DMA to stack (Johan Hovold)   
  - USB: yurex: fix control-URB timeout handling (Johan Hovold)   
  - USB: serial: option: add Quectel EM160R-GL (Bjørn Mork)   
  - USB: serial: option: add LongSung M5710 module support (Daniel Palmer)   
  - USB: serial: iuu_phoenix: fix DMA from stack (Johan Hovold)   
  - usb: uas: Add PNY USB Portable SSD to unusual_uas (Thinh Nguyen)   
  - usb: usbip: vhci_hcd: protect shift size (Randy Dunlap)   
  - USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set (Michael Grzeschik)   
  - usb: chipidea: ci_hdrc_imx: add missing put_device() call in usbmisc_get_init_data() (Yu Kuai)   
  - usb: dwc3: ulpi: Use VStsDone to detect PHY regs access completion (Serge Semin)   
  - USB: cdc-acm: blacklist another IR Droid device (Sean Young)   
  - usb: gadget: enable super speed plus (taehyun.cho)   
  - crypto: ecdh - avoid buffer overflow in ecdh_set_secret() (Ard Biesheuvel)   
  - video: hyperv_fb: Fix the mmap() regression for v5.4.y and older (Dexuan Cui)   
  - net: systemport: set dev->max_mtu to UMAC_MAX_MTU_SIZE (Florian Fainelli)   
  - net: mvpp2: Fix GoP port 3 Networking Complex Control configurations (Stefan Chulski)   
  - net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc (Antoine Tenart)   
  - net: sched: prevent invalid Scell_log shift count (Randy Dunlap)   
  - vhost_net: fix ubuf refcount incorrectly when sendmsg fails (Yunjian Wang)   
  - net: usb: qmi_wwan: add Quectel EM160R-GL (Bjørn Mork)   
  - CDC-NCM: remove "connected" log message (Roland Dreier)   
  - net: hdlc_ppp: Fix issues when mod_timer is called while timer is running (Xie He)   
  - net: hns: fix return value check in __lb_other_process() (Yunjian Wang)   
  - ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst() (Guillaume Nault)   
  - net: ethernet: ti: cpts: fix ethtool output when no ptp_clock registered (Grygorii Strashko)   
  - net-sysfs: take the rtnl lock when storing xps_cpus (Antoine Tenart)   
  - net: ethernet: Fix memleak in ethoc_probe (Dinghao Liu)   
  - net/ncsi: Use real net-device for response handler (John Wang)   
  - virtio_net: Fix recursive call to cpus_read_lock() (Jeff Dike)   
  - qede: fix offload for IPIP tunnel packets (Manish Chopra)   
  - atm: idt77252: call pci_disable_device() on error path (Dan Carpenter)   
  - ethernet: ucc_geth: set dev->max_mtu to 1518 (Rasmus Villemoes)   
  - ethernet: ucc_geth: fix use-after-free in ucc_geth_remove() (Rasmus Villemoes)   
  - depmod: handle the case of /sbin/depmod without /sbin in PATH (Linus Torvalds)   
  - lib/genalloc: fix the overflow when size is too big (Huang Shijie)   
  - scsi: ide: Do not set the RQF_PREEMPT flag for sense requests (Bart Van Assche)   
  - scsi: ufs-pci: Ensure UFS device is in PowerDown mode for suspend-to-disk ->poweroff() (Adrian Hunter)   
  - workqueue: Kick a worker based on the actual activation of delayed works (Yunfeng Ye)   
  - kbuild: don't hardcode depmod path (Dominique Martinet)   
  - Linux 4.14.214 (Greg Kroah-Hartman)   
  - iio:magnetometer:mag3110: Fix alignment and data leak issues. (Jonathan Cameron)   
  - iio:imu:bmi160: Fix alignment and data leak issues (Jonathan Cameron)   
  - kdev_t: always inline major/minor helper functions (Josh Poimboeuf)   
  - dm verity: skip verity work if I/O error when system is shutting down (Hyeongseok Kim)   
  - ALSA: pcm: Clear the full allocated memory at hw_params (Takashi Iwai)   
  - module: delay kobject uevent until after module init call (Jessica Yu)   
  - powerpc: sysdev: add missing iounmap() on error in mpic_msgr_probe() (Qinglang Miao)   
  - quota: Don't overflow quota file offsets (Jan Kara)   
  - module: set MODULE_STATE_GOING state when a module fails to load (Miroslav Benes)   
  - rtc: sun6i: Fix memleak in sun6i_rtc_clk_init (Dinghao Liu)   
  - ALSA: seq: Use bool for snd_seq_queue internal flags (Takashi Iwai)   
  - media: gp8psk: initialize stats at power control logic (Mauro Carvalho Chehab)   
  - misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() (Anant Thazhemadam)   
  - reiserfs: add check for an invalid ih_entry_count (Rustam Kovhaev)   
  - of: fix linker-section match-table corruption (Johan Hovold)   
  - uapi: move constants from <linux/kernel.h> to <linux/const.h> (Petr Vorel)   
  - powerpc/bitops: Fix possible undefined behaviour with fls() and fls64() (Christophe Leroy)   
  - USB: serial: digi_acceleport: fix write-wakeup deadlocks (Johan Hovold)   
  - s390/dasd: fix hanging device offline processing (Stefan Haberland)   
  - vfio/pci: Move dummy_resources_list init in vfio_pci_probe() (Eric Auger)   
  - mm: memcontrol: implement lruvec stat functions on top of each other (Johannes Weiner)   
  - mm: memcontrol: eliminate raw access to stat and event counters (Johannes Weiner)   
  - ALSA: usb-audio: fix sync-ep altsetting sanity check (Johan Hovold)   
  - ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk (Alberto Aguirre)   
  - ALSA: hda/ca0132 - Fix work handling in delayed HP detection (Takashi Iwai)   
  - md/raid10: initialize r10_bio->read_slot before use. (Kevin Vigor)   
  - x86/entry/64: Add instruction suffix (Jan Beulich)


