# changelog

author: yaoxin <yao_xin001@hoperun.com> - 1.2.24-1
changelog:
  - Update to 1.2.24:
    * Fixed formatting of ipsec.conf snippet. This is a security
    issue with severity of "Important." (CVE-2024-9050)
    * Added support for "require-id-on-certificate" setting.
    * Updated Georgian, Slovenian and Ukrainian translations.


author: gaihuiying <eaglegai@163.com> - 2.0.31-2
changelog:
  - Type:bugfix
  - CVE:
  - SUG:NA
  - DESC:Add the judgment on the validity of length in emu_cmd.c and session in lanserv_ipmi.c


author: wangkerong <wangkerong@huawei.com> - 1.13.0-3
changelog:
  - Fix OOM during fuzz test
  - We don't run some testcase,because the patch of fuzz test will lead to the failure of testcase


author: liequan che <cheliequan@inspur.com> - 1.1-4
changelog:
  - add bcache-export-cached to export CACHED_UUID and CACHED_LABEL,so that 69-bcache.rules
  udev rules can correctly create uuid and label links for bcache devices


author: zhanghao<zhanghao383@huawei.com> - 32:9.16.23-14
changelog:
  - Type:CVE
  - CVE:CVE-2022-3736 CVE-2022-3924 CVE-2022-3094
  - SUG:NA
  - DESC:fix CVE-2022-3736 CVE-2022-3924 CVE-2022-3094


author: zhanghao<zhanghao383@huawei.com> - 32:9.16.23-15
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix output expected information when install bing-sdborbind-sdb-chroot


author: zhanghao <zhanghao383@huawei.com> - 32:9.16.23-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Don't perform arithmetic on NULL pointers
  Accept 'in=NULL' with 'inlen=0' in isc_{half}siphash24
  Fix a use-after-free bug in dns_zonemgr_releasezone()
  Fix dns_fwdtable_addfwd() error path cleanup bug
  Detach the views in zone_shutdown(), not in zone_free()
  Detach the zone views outside of the zone lock
  delay trust anchor management until zones are loaded
  In hmac_createctx free ctx on isc_hmac_init failure
  Fix dns_kasp_attach / dns_kasp_detach usage
  Fix backport error in 84929d1c
  Fix a cleanup bug when isc_task_create() fails in dns_catz_new_zones()
  Searching catzs->zones requires a read lock
  Fix view's zones reverting bug during reconfiguration


author: chengyechun <chengyechun1@huawei.com> - 32:9.16.23-21
changelog:
  - Type:CVE
  - CVE:CVE-2023-6516 CVE-2023-4408 CVE-2023-5517 CVE-2023-5680 CVE-2023-5679 CVE-50387 CVE-2023-50868
  - SUG:NA
  - DESC:fix CVE-2023-6516 CVE-2023-4408 CVE-2023-5517 CVE-2023-5680 CVE-2023-5679 CVE-50387 CVE-2023-50868 and sync some patches from upstream


author: chengyechun <chengyechun1@huawei.com> - 32:9.16.23-23
changelog:
  - Type:CVE
  - CVE:CVE-2024-1975,CVE-2024-4076,CVE-2024-1737
  - SUG:NA
  - DESC:fix CVE-2024-1975 CVE-2024-4076 CVE-2024-1737


author: yeqinglong <yeqinglong@kylinsec.com.cn> - 2.37-24
changelog:
  - DESC:Add sw_64 support
  - DESC:Add LoongArch support
  - DESC:Fix LoongArch PLT entry generate bug
  - DESC:Add .equ support for LoongArch and fix some bugs


author: lingsheng <lingsheng1@h-partners.com> - 3.5.2-9
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: xiechengliang <xiechengliang1@huawei.com> - 1:1.33.1-12
changelog:
  - Type:CVE
  - Id:NA
  - SUG:NA
  - DESC:fix CVE-2021-42378 CVE-2021-42379 CVE-2021-42380 CVE-2021-42381 CVE-2021-42382 CVE-2021-42383 CVE-2021-42384 CVE-2021-42385 and CVE-2021-42386


author: liuxu <liuxu156@huawei.com> - 1:1.34.1-21
changelog:
  - Type:CVE
  - Id:NA
  - SUG:NA
  - DESC:revert fix CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 CVE-2023-42363


author: shixuantong <shixuantong1@huawei.com> - 21.4-28
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:disable use-dns for secondary nics
         Make duplicate route add succeed
         Fix predictable interface rename issue


author: dongyuzhen <dongyuzhen@h-partners.com> - 21.4-29
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix(net): klibc ipconfig PROTO compatibility
         fix(openstack): Fix bond mac_address


author: shixuantong <shixuantong1@huawei.com> - 21.4-32
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:chore: set recursive=False for ensure_dir if parent path is "/"
         test(openstack): Test bond mac address
         fix: Ensure properties for bonded interfaces are properly translated


author: Linux_zhang <zhangruifang@h-partners.com> - 21.4-33
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         skip some test if there are multiple NICs with the MAC address 'ee:ee:ee:ee:ee:ee'


author: zhongjiawei<zhongjiawei1@huawei.com> - 1.2.0-318
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:disable Transparent HugePage for shim process if SHIM_DISABLE_THP is set


author: fuanan <fuanan3@h-partners.com> - 9.0-11
changelog:
  - sync patches from community
  - add backport-who-fix-only-theoretical-overflow.patch
        backport-tac-handle-short-reads-on-input.patch
        backport-setenv-Don-t-crash-if-malloc-returns-NULL.patch
        backport-who-don-t-crash-if-clock-gyrates.patch
        backport-doc-od-strings-clarify-operation.patch
        backport-wc-port-to-kernels-that-disable-XSAVE-YMM.patch


author: jiangchuangang <jiangchuangang@huawei.com> - 9.0-12
changelog:
  - skip testcase for overlay filesystem because of no inotify_add_watch
    add test-skip-overlay-filesystem-because-of-no-inotify_add_watch.patch


author: huyubiao <huyubiao@huawei.com> - 9.0-16
changelog:
  - sync patches from community
  - add backport-pinky-fix-string-size-calculation.patch
        backport-cksum-consistently-validate-length-attributes.patch
        backport-timeout-fix-race-where-we-might-kill-arbitrary-proce.patch
        backport-timeout-fix-narrow-race-in-failing-to-kill-processes.patch
        backport-maint-basenc-consistently-check-buffer-bounds-when-e.patch
        backport-coreutils-df-direct.patch
        backport-df-fix-memory-leak.patch
        backport-ls-avoid-triggering-automounts.patch
        backport-pr-don-t-use-uninitialized-var.patch
        backport-stat-only-automount-with-cached-never.patch
        backport-touch-fix-aliasing-bug.patch
        backport-putenv-Don-t-crash-upon-out-of-memory.patch
        backport-head-off_t-not-uintmax_t-for-file-offset.patch
        backport-shuf-avoid-integer-overflow-on-huge-inputs.patch
        backport-shuf-fix-randomness-bug.patch


author: huyubiao <huyubiao@huawei.com> - 9.0-18
changelog:
  - sync patches from community
  - add backport-numfmt-don-t-require-a-suffix-with-from-iec-i.patch
        backport-sort-fix-debug-buffer-overrun.patch
        backport-tac-avoid-out-of-bounds-access.patch
        backport-yes-avoid-failure-on-CHERI-protected-systems.patch


author: zhouyihang <zhouyihang3@h-partners.com> - 7.79.1-26
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:tool_progress: avoid division by zero in parallel progress
         digest: pass over leading spaces in qop values
         Curl_close: call Curl_resolver_cancel to avoid memory-leak
         easy: fix the altsvc init for curl_easy_duphandle
         libssh: if sftp_init fails, don't get the sftp error code
         url: move back the IDN conversion of proxy names
         ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH
         http: fix the ::1 comparison for IPv6 localhost for cookies
         multi: free up more data earleier in DONE
         curl_path: bring back support for SFTP path ending in /~
         transfer: refuse POSTFIELDS + RESUME_FROM combo
         tool_operate: refuse (--data or --form) and --continue-at
         http: free the url before storing a new copy
         url: fix null dispname for --connect-to option
         vtls: avoid memory leak if sha256 call fails
         urlapi: make sure zoneid is also duplicated in curl_url_dup


author: zhouyihang <zhouyihang3@h-partners.com> - 7.79.1-27
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:transfer: also stop the sending on closed connection
         openssl: avoid BN_num_bits() NULL pointer derefs


author: zhouyihang <zhouyihang3@h-partners.com> - 7.79.1-29
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:paramhlp: fix CRLF-stripping files with "-d @file"
         libssh2: set length to 0 if strdup failed
         openldap: create ldap URLs correctly for IPv6 addresses
         multi: avoid memory-leak risk
         tool_cb_rea: limit rate unpause for -T . uploads
         tool_cfgable: free {proxy_}cipher13_list on exit


author: zhouyihang <zhouyihang3@h-partners.com> - 7.79.1-34
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:multi: check that the multi handle is valid in curl_multi_assign


author: xingwei <xingwei14@h-partners.com> - 7.79.1-38
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:altsvc: avoid integer overflow in expire calculation
         test391: verify --path-as-is with redirect
         urlapi: fix redirect to a new fragment or query (only)
         tool_getparam: clear sensitive arguments better


author: zhouyihang <zhouyihang3@h-partners.com> - 7.79.1-39
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix freeing of resources in disconnect
         openssl: fix crash on missing cert password


author: renmingshuai <renmingshuai@huawei.com> - 12:4.4.3-4
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:delete report url added by other upstream patch to keep pace with DHCP


author: renmingshuai <renmingshuai@huawei.com> - 12:4.4.3-5
changelog:
  - Type:CVE
  - ID:CVE-2022-2795,CVE-2022-38177,CVE-2022-38178
  - SUG:restart
  - DESC:fix CVE-2022-2795,CVE-2022-38177 and CVE-2022-38178


author: renmingshuai <renmingshuai@huawei.com> - 2.86-3
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Fix parsing of IPv6 addresses with peer from netlink
         Fix bad interaction between --address=/#/<ip> and
              --server=/some.domain/#
         Fix --address=/#/...... which was lost in 2.86


author: renmingshuai <renmingshuai@huawei.com> - 2.86-7
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Fix memory leak when using --dhcp-optsfile with DHCPv6 options


author: chenjiji <chenjiji09@163.com> - 21.11-55
changelog:
  Sync some patchs from upstreaming about add FDIR VLAN match
   mode runtime config and fix doc format for hns3 pmd. Patchs
   are as follow:
   - doc: unify sections of networking drivers guide
   - net/hns3: delete duplicate macro definition
   - net/hns3: add FDIR VLAN match mode runtime config
   - doc: fix kernel patch link in hns3 guide
   - doc: fix syntax in hns3 guide
   - doc: fix number of leading spaces in hns3 guide


author: huangdengdui <huangdengui@huawei.com> - 21.11-58
changelog:
  Sync some patchs from upstreaming and modifies are as follow:
   - maintainers: update for hns3 driver
   - app/testpmd: add command to flush multicast MAC addresses
   - app/testpmd: fix help string
   - app/testpmd: fix multicast address pool leak
   - net/hns3: optimize SVE Rx performance
   - net/hns3: optimize rearm mbuf for SVE Rx
   - net/hns3: optimize free mbuf for SVE Tx
   - net/hns3: fix order in NEON Rx
   - net/hns3: fix traffic management dump text alignment
   - net/hns3: fix traffic management thread safety
   - net/hns3: fix flushing multicast MAC address
   - net/hns3: fix error code for multicast resource
   - net/hns3: fix VF default MAC modified when set failed
   - net/hns3: fix index to look up table in NEON Rx
   - net/hns3: fix non-zero weight for disabled TC
   - config/arm: add HiSilicon HIP10


author: huangdengdui <huangdengui@huawei.com> - 21.11-59
changelog:
  Sync some patchs from upstreaming and modifies are as follow:
   - net/hns3: fix mailbox sync
   - net/hns3: report maximum buffer size
   - ethdev: add maximum Rx buffer size
   - app/procinfo: show RSS hash algorithm
   - ethdev: get RSS algorithm names
   - app/procinfo: adjust format of RSS info
   - app/procinfo: fix RSS info
   - net/hns3: support setting and querying RSS hash function
   - net/hns3: report RSS hash algorithms capability
   - ethdev: set and query RSS hash algorithm
   - ethdev: clarify RSS related fields usage
   - net/hns3: fix uninitialized hash algo value
   - net/hns3: keep set/get algo key functions local
   - net/hns3: fix some error logs
   - net/hns3: fix some return values
   - net/hns3: fix LRO offload to report
   - net/hns3: fix setting DCB capability
   - app/testpmd: ease configuring all offloads
   - net/hns3: refactor interrupt state query
   - net/hns3: fix IMP or global reset
   - net/hns3: fix multiple reset detected log
   - net/hns3: remove reset log in secondary
   - net/hns3: fix double stats for IMP and global reset
   - net/hns3: fix crash for NEON and SVE
   - net/hns3: fix unchecked Rx free threshold
   - net/hns3: fix typo in function name
   - net/hns3: fix build warning
   - telemetry: fix repeat display when callback don't init dict


author: huangdengdui <huangdengui@huawei.com> - 21.11-60
changelog:
  Sync some bugfix from upstreaming about hns3 reset and modifies
   are as follow:
   - net/hns3: fix VF reset handler interruption
   - net/hns3: fix reset event status
   - net/hns3: fix ignored reset event


author: huangdengdui <huangdengui@huawei.com> - 21.11-61
changelog:
  Sync some bugfix from upstreaming about testpmd and doc, modifies
   are as follow:
   - support set RSS hash algorithm
   - ethdev: add new API to get RSS hash algorithm by name
   - doc: fix description of RSS features
   - doc: fix RSS flow description in hns3 guide
   - doc: update features in hns3 guide
   - doc: fix hns3 build option about max queue number
   - app/testpmd: check port and queue Rx/Tx offloads
   - app/testpmd: fix Tx offload command
   - app/testpmd: allow offload config for all ports
   - app/testpmd: fix tunnel TSO configuration
   - app/testpmd: add explicit check for tunnel TSO
   - app/testpmd: fix tunnel TSO capability check
   - app/testpmd: remove useless check in TSO command


author: huangdengdui <huangdengui@huawei.com> - 21.11-62
changelog:
  Sync some patches for hns3 about refactor mailbox and bugfix, modifies
   are as follow:
   - net/hns3: fix reset level comparison
   - net/hns3: fix disable command with firmware
   - net/hns3: fix VF multiple count on one reset
   - net/hns3: refactor handle mailbox function
   - net/hns3: refactor send mailbox function
   - net/hns3: refactor PF mailbox message struct
   - net/hns3: refactor VF mailbox message struct


author: chenyi <chenyi211@huawei.com> - 21.11-78
changelog:
  Sync some patches from upstream about bugfix, modifies are as follow:
  - bus/pci: fix UIO resource mapping in secondary process


author: lvxiangcong<lvxiangcong@kylinos.cn> - 3.4.14-7
changelog:
  - Type:CVE
  - CVE:CVE-2022-24675 CVE-2022-28327 CVE-2022-24921 CVE-2021-44717 CVE-2021-33195
  - SUG:NA
  - DESC: Batch fix cve through rebuild and sync release


author: lvxiangcong<lvxiangcong@kylinos.cn> - 3.4.14-9
changelog:
  - Type:CVES
  - CVES:CVE-2022-41723 CVE-2022-34038  CVE-2023-32082 CVE-2021-28235 CVE-2023-39325
  - SUG:NA
  - DESC: Batch fix sync failed cves for openEuler-22.03-LTS-SP1 branch


author: happyworker <208suo@208suo.com> - 4.2.4-23
changelog:
  - Fix CVE-2020-22026/CVE-2020-22019/CVE-2020-22021/CVE-2020-22038/CVE-2020-22039/CVE-2020-22044/CVE-2020-22043


author: happyworker <208suo@208suo.com> - 4.2.4-24
changelog:
  - Fix CVE-2021-38090/CVE-2020-21697/CVE-2020-22042/CVE-2020-21688/CVE-2020-22037/CVE-2020-22051/CVE-2020-22020/CVE-2025-22921/CVE-2025-22919


author: baizhonggui <baizhonggui@huawei.com> - 3.0.21-7
changelog:
  - Fix building error: configure: error: no acceptable C compiler found in $PATH
  - Add gcc in BuildRequires


author: liyuxiang <liyuxiang@ncti-gba.cn> - 2:2.8.1-2
changelog:
  - Fix CVE-2022-39316
  - Fix CVE-2022-39318
  - Fix CVE-2022-39319
  - Fix CVE-2022-39347
  - Fix CVE-2022-41877


author: Funda Wang <fundawang@yeah.net> - 2:2.11.1-1
changelog:
  - 2.11.1
  - Fix CVE-2023-40567
  - Fix CVE-2023-40569
  - Fix CVE-2023-40188
  - Fix CVE-2023-40186
  - Fix CVE-2023-40181
  - Fix CVE-2023-39353
  - Fix CVE-2023-39352
  - Fix CVE-2023-39356
  - Fix CVE-2023-39350
  - Fix CVE-2023-39351
  - Fix CVE-2023-39354
  - Fix CVE-2023-40589


author: wangkai <13474090681@163.com> - 2:2.11.7-1
changelog:
  - Update to 2.11.7 for fix CVE-2024-32039,CVE-2024-32040,
    CVE-2024-32041,CVE-2024-32458,CVE-2024-32459,CVE-2024-32460,
    CVE-2024-32658,CVE-2024-32659 and CVE-2024-32660


author: Funda Wang <fundawang@yeah.net> - 9.55.0-18
changelog:
  - Type:CVE
  - ID:NA
  - SUG:NA
  - DECS: Fix CVE-2025-27830, CVE-2025-27832, CVE-2025-27834, CVE-2025-27835, CVE-2025-27836


author: hdliu <dev03108@linx-info.com> - 9.55.0-19
changelog:
  - Add font mappings so that the PS interpreter can rasterize Chinese content using the two fonts STKaiti-Regular and STheiti-Regular.


author: fuanan <fuanan3@h-partners.com> - 2.33.0-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Modify parameter in backport-CVE-2022-23521-attr-fix-silently-splitting-up-lines-longer-than-204.patch


author: fuanan <fuanan3@h-partners.com> - 2.33.0-10
changelog:
  - Type:CVE
  - ID:CVE-2023-25652 CVE-2023-29007 CVE-2023-25815
  - SUG:NA
  - DESC:Fix CVE-2023-25652 CVE-2023-29007 CVE-2023-25815


author: fuanan <fuanan3@h-partners.com> - 2.33.0-11
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:enable multithreading compilation and installation,
         move Git.3pm.gz to perl-Git,avoid installation conflicts,
         change BuildRequires from pcre-devel to pcre2-devel.


author: huyubiao <huyubiao@huawei.com> - 2.33.0-13
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Specifying Obsoletes and Provides version numbers, prevent upgrade conflicts.
         Delete git-core-doc from git, git-core-doc is provided by git-help.


author: fuanan <fuanan3@h-partners.com> - 2.33.0-14
changelog:
  - Type:CVE
  - ID:CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465
  - SUG:NA
  - DESC:Fix CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465


author: fuanan <fuanan3@h-partners.com> - 2.33.0-19
changelog:
  - Type:CVE
  - ID:CVE-2025-27613 CVE-2025-46334 CVE-2025-46835
  - SUG:NA 
  - DESC:Fix CVE-2025-27613 CVE-2025-46334 CVE-2025-46835


author: Qingqing Li <liqingqing3@huawei.com> - 2.34-145
changelog:
  - elf: Add a way to check if tunable is set (BZ 27069)
  - malloc: Improve MAP_HUGETLB with glibc.malloc.hugetlb=2


author: chengyechun <chengyechun1@huawei.com> - 2.34-148
changelog:
  - Type:CVE
  - ID:CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602
  - SUG:NA
  - DESC:fix CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602


author: chengyechun <chengyechun1@huaiwe.com> - 2.34-149
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:nscd: Use errval, not errno to guide cache update
         nsce :Skip unusable entries in first pass in prune_cache


author: shixuantong <shixuantong1@huawei.com> - 2.34-150
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:elf: Add TLS modid reuse test for bug 29039
         elf: Fix TLS modid reuse generation assignment
         elf: Check objname before calling fatal_error
         elf: Fix _dl_debug_vdprintf to work before self-relocation
         elf: ldconfig should skip temporary files created by package managers
         ldconfig: Fixes for skipping temporary files.


author: shixuantong <shixuantong1@huawei.com> - 2.34-157
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:enable shared library use huge page for aarch64 architecture
         revert "elf/ld.so: use special mmap for hugepage to get symbols"
         hugepageedit: static-link build
         elf: the hugepage feature of dynamic library keep compatible with llvm lld
         elf: add some debug info for dynamic library hugepage feature


author: chengyechun <chengyechun1@huawei.com> - 2.34-160
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:resolv: Track single-request fallback via _res._flags
         resolv: Allow short error responses to match any query


author: shixuantong <shixuantong1@huawei.com> - 2.34-162
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:elf: avoid jumping over a needed declaration
         elf: Move __rtld_malloc_init_stubs call into _dl_start_final


author: shixuantong <shixuantong1@huawei.com> - 2.34-163
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:elf: Handle static PIE with non-zero load address
         elf: Introduce _dl_relocate_object_no_relro
         elf: Switch to main malloc after final ld.so self-relocation


author: liumingran <liumr1@chinatelecom.cn> 2.34-169
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fnmatch: Fix memory leak problem by backport from glibc 2.35
    https://sourceware.org/git/?p=glibc.git;a=commit;h=4e32c8f5682004d0571395fe9fa1bc1b73b40f4c


author: luoyujie <luoyujie5@huawei.com> - 1.17.3-23
changelog:
  - Type:CVE
  - CVE:CVE-2023-39318,CVE-2023-39319
  - SUG:NA
  - DESC:fix CVE-2023-39318 and CVE-2023-39319


author: hanchao <hanchao63@huawei.com> - 1.17.3-28
changelog:
  - Type:CVE
  - CVE:CVE-2024-24783,CVE-2024-24785,CVE-2023-45290,CVE-2023-45289
  - SUG:NA
  - DESC:fix CVE-2024-24783,CVE-2024-24785,CVE-2023-45290,CVE-2023-45289


author: wangshuo <wangshuo@kylinos.cn> - 1.17.3-31
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport the upstream patch, fix the overflow issue in runtime.netpollWaiters


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-37
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fs/udf: Fix out of bounds access
         lib/relocator: Fix OOB write when initializing lo->freebytes[]
         util/grub-mount: Fix memory leak in fuse_getattr()


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-38
changelog:
  - Type:CVE
  - CVE:CVE-2023-4692 CVE-2023-4693
  - SUG:NA
  - DESC:fs/ntfs: Make code more readable
         fs/ntfs: Fix an OOB read when parsing a volume label
         fs/ntfs: Fix an OOB read when parsing bitmaps for index attributes
         fs/ntfs: Fix an OOB read when parsing directory entries from resident and non-resident index attributes
         fs/ntfs: Fix an OOB read when reading data from the resident $DATA attribute
         fs/ntfs: Fix an OOB write when parsing the $ATTRIBUTE_LIST attribute for the $MFT file


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-44
changelog:
  - Type:CVE
  - CVE:CVE-2024-1048
  - SUG:NA
  - DESC:grub-set-bootflag: Fix for CVE-2024-1048
         commands/acpi: Fix calculation of ACPI tables addresses when processing RSDT and XSDT
         kern/acpi: Skip NULL entries in RSDT and XSDT
         util/grub-mount: Check file path sanity


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-46
changelog:
  - Type:CVE
  - CVE:CVE-2021-46848
  - SUG:NA
  - DESC:lib/libtasn1: Fix ETYPE_OK off by one array size check


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-47
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix log printing in tpcm_kunpeng moddule
         osdep/linux/hostdisk: Use stat() instead of udevadm for partition lookup
         osdep: Introduce include/grub/osdep/major.h and use it
         disk/mdraid1x_linux: Prevent infinite recursion
         disk: Generalize MD_MAX_DISKS to GRUB_MDRAID_MAX_DISKS


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-49
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:commands/legacycfg: Avoid closing file twice
         disk/lvm: GRUB fails to detect LVM volumes due to an incorrect computation of mda_end


author: sunhai <sunhai10@huawei.com> - 1:2.06-51
changelog:
  - Type:CVE
  - CVE:CVE-2024-45781,CVE-2024-45782,CVE-2024-56737,CVE-2024-45780,CVE-2024-45783,CVE-2024-49504,CVE-2025-0624,CVE-20
  24-45774,CVE-2024-45775,CVE-2025-0622,CVE-2025-0622,CVE-2025-0622,CVE-2024-45776,CVE-2024-45777,CVE-2025-0690,CVE-20
  25-1118,CVE-2024-45778,CVE-2024-45779,CVE-2025-0677,CVE-2025-0684,CVE-2025-0685,CVE-2025-0686,CVE-2025-0689,CVE-2025
  -0678,CVE-2025-1125
  - SUG:NA
  - DESC:fix the vulnerabilities announced on February 18th, 2025


author: wujie <wujie@nj.iscas.ac.cn> - 2.4-10
changelog:
  - Disable FMA on riscv64 from http://fedora.riscv.rocks/koji/buildinfo?buildID=189607
    Author is David Abdurachmanov <david.abdurachmanov@sifive.com>


author: Funda Wang <fundawang@yeah.net> - 1.18.4-8
changelog:
  - fix CVE-2024-47538, CVE-2024-47541, CVE-2024-47542, CVE-2024-47600,
    CVE-2024-47607, CVE-2024-47615, CVE-2024-47835


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 3.24.30-8
changelog:
  - Fix the problem that the prompt information of network icon volume icon is not displayed
  - update xscreen size when x11 screen size change
  - always send the monitors changed signal when screen size change
  - Add function definition of gtk_image_set_from_pixbuf_with_scale


author: xinghe <xinghe2@h-partners.com> - 2.6.6-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:connection: Clear flags when a conn is removed
         connection: Preserve flags when a conn is removed
         stream: do not try to free a failed stream-conn
         http_ana/txn: don't re-initialize txn and req var
         mworker: prevent incorrect values in uptime
         protocol: fix minor memory leak in protocol_bind_all()
         stream: Perform errors handling in right order in stream_new()


author: xinghe <xinghe2@h-partners.com> - 2.6.6-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:backport to fix potential coredump:
         errors: handle malloc failure in usermsgs_put
         ssl_sock: add check for ha_meth
         thread: add a check for pthread_creat


author: xinghe <xinghe2@h-partners.com> - 2.6.6-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:server: add missing free for server->rdr_pfx
         server: do not leak default-server in defaults


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-11
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:change default value of HeartbeatMaxServers
         fix setting and comparison of IPs fileds
         avoid voerflow in case of indecently large session
         make ap_escape_quotes() work correctly
         fix lua_request with cast first
         Handle children killed pathologically
         mod_md do not interfere with requests if challenge type http-01


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-12
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:reduce the dependency of httpd on system-logos installation


author: seuzw <930zhaowei@163.com> - 2.4.51-13
changelog:
  - Type:cves
  - ID:CVE-2022-36760,CVE-2006-20001,CVE-2022-37436
  - SUG:restart
  - DESC:fix CVE-2022-36760,CVE-2006-20001,CVE-2022-37436


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-15
changelog:
  - Type:CVE
  - ID:CVE-2023-27522, CVE-2023-25690
  - SUG:restart
  - DESC:fix CVE-2023-27522, CVE-2023-25690


author: chengyechun <chengyehcun1@huawei.com> - 2.4.51-16
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:Report an error if the AJP backend sends an invalid number of headers
         handled a negative value when parsing the config
         avoid delimiting the query with a backreference
         fix missing APLOGNO


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-17
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:Fix double encoding of the uri-path of the request
         Do not match the extention against possible query string
         Do not double encode slashes
         Check before forwarding that a nocanon path has not been rewriteen


author: panchenbo <panchenbo@kylinsec.com.cn> - 2.4.51-18
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:add sw_64 support,optimize sw build patch,add loongarch64 support


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-21
changelog:
  - Type:CVE
  - ID:CVE-2024-24795,CVE-2023-38709,CVE-2024-27316
  - SUG:NA
  - DESC:fix CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 and sync some patches from upstream


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-22
changelog:
  - Type:CVE
  - ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573
  - SUG:NA
  - DSEC:fix some CVEs


author: xingwei <xingwei14@h-partners.com> - 2.4.51-24
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:mod_log_config: Fix LogFormat directive merging
         Fix X509 leak and Increase MAX_CONCURRENCY hard limit
         mod_proxy_balancer: Fix the handling of the stickysession
         mod_cache_socache: Fix possible crash on error path
         mod_ssl: Check SSL_CTX_new() return value
         core: Report invalid Options argument when parsing AllowOverride directives


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 72.1-7
changelog:
  - icu already supports loongarch64 architecture
  - Remove loongarch64 patch and modify sw_64 support patch to use all arch


author: wangkai <wangkai385@huawei.com> - 8.2.4-9
changelog:
  - This package depends on log4j.After the log4j vulnerability CVE-2021-44228 is fixed,the version needs to be rebuild.


author: yaoxin <yaoxin30@huawei.com> - 8.2.4-10
changelog:
  - This package depends on log4j.After the log4j vulnerability CVE-2021-45105 is fixed,the version needs to be rebuild.


author: zhangxingrong <zhangxingrong@uniontech.com> - 3.16-4
changelog:
  - iperf3 now builds correctly on architectures without native support for 64-bit atomic types, by linking with the libatomic library


author: wangkai <13474090681@163.com> - 3.17.1-1
changelog:
  - Update to 3.17.1
  - iperf3 no longer changes its current working directory in --daemon mode. This results in more 
    predictable behavior with relative paths, in particular finding key and credential files for authentication.
  - A new --json-stream option has been added to enable a streaming output format, consisting of 
    a series of JSON objects (for the start of the test, each measurement interval, and the end of the test) separated by newlines
  - UDP tests now work correctly between different endian hosts
  - The --fq-rate parameter now works for --reverse tests
  - The statistics reporting interval is now available in the --json start test object


author: eaglegai <eaglegai@163.com> - 20210722-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport to fix no reply when ping6 from Subnet-Router anycast address


author: zengweifeng <zwfeng@huawei.com> - 20210722-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: fix ping2 bingding to VRF and address
          Avoid binding to non-VRF
          Fix ARP protocol field for AX.25 and NETROM


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-193.0.0.106
changelog:
  - !5521  md/raid5: fix atomicity violation in raid5_cache_count
  - !5494  mm/sparsemem: fix race in accessing memory_section->usage
  - !5516  netfilter: nf_tables: disallow timeout for anonymous sets
  - !5441  net/sched: act_ct: fix skb leak and crash on ooo frags
  - !5519  scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan()
  - !5445  KVM: x86/mmu: Don't advance iterator after restart due to yielding
  - !5510  bus: mhi: host: Drop chan lock before queuing buffers
  - !5466  wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - !5491  CVE-2024-26640
  - md/raid5: fix atomicity violation in raid5_cache_count
  - scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan()
  - netfilter: nf_tables: disallow timeout for anonymous sets
  - !5495  llc: Drop support for ETH_P_TR_802_2.
  - !5496  llc: make llc_ui_sendmsg() more robust against bonding changes
  - !5266  llc: call sock_orphan() at release time
  - bus: mhi: host: Drop chan lock before queuing buffers
  - !5500  pstore/ram: Fix crash when setting number of cpus to an odd number
  - !5460 v2  crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
  - pstore/ram: Fix crash when setting number of cpus to an odd number
  - !5368  media: pvrusb2: fix use after free on context disconnection
  - llc: make llc_ui_sendmsg() more robust against bonding changes
  - llc: Drop support for ETH_P_TR_802_2.
  - mm/sparsemem: fix race in accessing memory_section->usage
  - tcp: add sanity checks to rx zerocopy
  - net-zerocopy: Refactor frag-is-remappable test.
  - !5269  printk: avoid deadlock in panic
  - !5316 v2  iomap: add support to track dirty state of sub pages
  - !5075  x86/reboot: VMCLEAR active VMCSes before emergency reboot
  - !5385 v3  enable arm64_pbha by default
  - !5093  wifi: mac80211: fix potential key use-after-free
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - !5327  UBSAN: array-index-out-of-bounds in dtSplitRoot
  - !5322  jfs: fix slab-out-of-bounds Read in dtSearch
  - crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
  - !5308  FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - KVM: x86/mmu: Don't advance iterator after restart due to yielding
  - net/sched: act_ct: fix skb leak and crash on ooo frags
  - !5286  serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
  - !5232  jfs: fix cve issue
  - !5348  s390/ptrace: handle setting of fpc register correctly
  - !5317  KVM: s390: fix setting of fpc register
  - !5259  CVE-2024-26627​
  - config: Enable ARM64_PBHA by default
  - arm64: mm: pagemap: Export pbha bit0 info
  - arm64: mm: Hide pbha_bit0 in procfs if pbha is not enabled
  - arm64: mm: Do not show info during startup if pbha is not enabled
  - mm: cpufeature: Make update_pbha_perf_only_bit static
  - arm64: mm: Cleanup in pbha_bit0_pte_range
  - proc: introduce proc_hide_ents to hide proc files
  - !5339  binder: fix race between mmput() and do_exit()
  - !5253  tomoyo: fix UAF write bug in tomoyo_write_control()
  - media: pvrusb2: fix use after free on context disconnection
  - s390/ptrace: handle setting of fpc register correctly
  - binder: fix race between mmput() and do_exit()
  - UBSAN: array-index-out-of-bounds in dtSplitRoot
  - jfs: fix slab-out-of-bounds Read in dtSearch
  - KVM: s390: fix setting of fpc register
  - iomap: add support to track dirty state of sub pages
  - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
  - printk: avoid deadlock in panic
  - llc: call sock_orphan() at release time
  - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
  - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
  - tomoyo: fix UAF write bug in tomoyo_write_control()
  - jfs: fix array-index-out-of-bounds in diNewExt
  - jfs: fix uaf in jfs_evict_inode
  - wifi: mac80211: fix potential key use-after-free
  - x86/reboot: VMCLEAR active VMCSes before emergency reboot


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-194.0.0.107
changelog:
  - !5684 Backport 5.10.200 LTS patches from upstream
  - ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
  - tty: 8250: Add support for Intashield IS-100
  - tty: 8250: Add support for Brainboxes UP cards
  - tty: 8250: Add support for additional Brainboxes UC cards
  - tty: 8250: Remove UC-257 and UC-431
  - usb: raw-gadget: properly handle interrupted requests
  - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
  - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
  - can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior
  - can: isotp: isotp_bind(): do not validate unused address information
  - can: isotp: add local echo tx processing and tx without FC
  - can: isotp: handle wait_event_interruptible() return values
  - can: isotp: check CAN address family in isotp_bind()
  - can: isotp: isotp_bind(): return -EINVAL on incorrect CAN ID formatting
  - can: isotp: set max PDU size to 64 kByte
  - can: isotp: Add error message if txqueuelen is too small
  - can: isotp: add symbolic error message to isotp_module_init()
  - can: isotp: change error format from decimal to symbolic error names
  - powerpc/mm: Fix boot crash with FLATMEM
  - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
  - platform/mellanox: mlxbf-tmfifo: Fix a warning message
  - scsi: mpt3sas: Fix in error path
  - fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
  - ASoC: rt5650: fix the wrong result of key button
  - netfilter: nfnetlink_log: silence bogus compiler warning
  - spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
  - fbdev: atyfb: only use ioremap_uc() on i386 and ia64
  - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
  - dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
  - irqchip/stm32-exti: add missing DT IRQ flag translation
  - net: sched: cls_u32: Fix allocation size in u32_init()
  - x86: Fix .brk attribute in linker script
  - objtool/x86: add missing embedded_insn check
  - x86/mm: Fix RESERVE_BRK() for older binutils
  - x86/mm: Simplify RESERVE_BRK()
  - smbdirect: missing rc checks while waiting for rdma events
  - x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility
  - iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds
  - iio: adc: xilinx: use more devres helpers and remove remove()
  - iio: adc: xilinx: use devm_krealloc() instead of kfree() + kcalloc()
  - iio: adc: xilinx: use helper variable for &pdev->dev
  - clk: Sanitize possible_parent_show to Handle Return Value of of_clk_get_parent_name
  - sparc32: fix a braino in fault handling in csum_and_copy_..._user()
  - nvmem: imx: correct nregs for i.MX6UL
  - nvmem: imx: correct nregs for i.MX6SLL
  - nvmem: imx: correct nregs for i.MX6ULL
  - misc: fastrpc: Clean buffers on remote invocation failures
  - tracing/kprobes: Fix the description of variable length arguments
  - i2c: aspeed: Fix i2c bus hang in slave read
  - i2c: stm32f7: Fix PEC handling in case of SMBUS transfers
  - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
  - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()
  - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
  - iio: exynos-adc: request second interupt only when touchscreen mode is used
  - kasan: print the original fault addr when access invalid shadow
  - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR
  - gtp: fix fragmentation needed check with gso
  - gtp: uapi: fix GTPA_MAX
  - tcp: fix wrong RTO timeout when received SACK reneging
  - r8152: Release firmware if we have an error in probe
  - r8152: Cancel hw_phy_work if we have an error in probe
  - r8152: Run the unload routine if we have errors during probe
  - r8152: Increase USB control msg timeout to 5000ms as per spec
  - net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg
  - net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show()
  - igc: Fix ambiguity in the ethtool advertising
  - neighbour: fix various data-races
  - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry
  - treewide: Spelling fix in comment
  - r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1
  - r8169: fix the KCSAN reported data-race in rtl_tx while reading TxDescArray[entry].opts1
  - mmc: renesas_sdhi: use custom mask for TMIO_MASK_ALL
  - mm/page_alloc: correct start page when guard page debug is enabled
  - virtio-mmio: fix memory leak of vm_dev
  - virtio_balloon: Fix endless deflation and inflation on arm64
  - mcb-lpc: Reallocate memory region to avoid memory overlapping
  - mcb: Return actual parsed size when reading chameleon table
  - selftests/ftrace: Add new test case which checks non unique symbol
  - !5580  CVE-2023-52622
  - !5617 v4  Fix I/O high when memory almost met memcg limit
  - !5518  dm: revert partial fix for redundant bio-based IO accounting
  - !5493  arm64/mpam: Fix repeated enabling in mpam_enable()
  - !5566  tracing: Ensure visibility when inserting an element into tracing_map
  - !5606  mm/mlock: return EINVAL for illegal user memory range in mlock
  - mm/readahead: don't decrease mmap_miss when folio has workingset flags
  - mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM
  - !5499 Backport 5.10.199 LTS patches from upstream
  - mm/mlock: return EINVAL for illegal user memory range in mlock
  - ext4: avoid online resizing failures due to oversized flex bg
  - ext4: unify the type of flexbg_size to unsigned int
  - ext4: remove unnecessary check from alloc_flex_gd()
  - !5473  jfs: fix array-index-out-of-bounds in dbAdjTree
  - !5553  mm: ksm: fix use-after-free kasan report in ksm_might_need_to_copy
  - tracing: Ensure visibility when inserting an element into tracing_map
  - !5431  block/rnbd-srv: Check for unlikely string overflow
  - !5537  netfilter: nf_tables: disallow anonymous set with timeout flag
  - !5527  netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
  - mm: ksm: fix use-after-free kasan report in ksm_might_need_to_copy
  - netfilter: nf_tables: disallow anonymous set with timeout flag
  - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
  - dm: revert partial fix for redundant bio-based IO accounting
  - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
  - Bluetooth: hci_sock: fix slab oob read in create_monitor_event
  - phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins
  - phy: mapphone-mdm6600: Fix runtime PM for remove
  - phy: mapphone-mdm6600: Fix runtime disable on probe
  - ASoC: pxa: fix a memory leak in probe()
  - gpio: vf610: set value before the direction to avoid a glitch
  - platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events
  - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e
  - s390/pci: fix iommu bitmap allocation
  - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
  - USB: serial: option: add entry for Sierra EM9191 with new firmware
  - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
  - nvme-rdma: do not try to stop unallocated queues
  - nvme-pci: add BOGUS_NID for Intel 0a54 device
  - ACPI: irq: Fix incorrect return value in acpi_register_gsi()
  - pNFS: Fix a hang in nfs4_evict_inode()
  - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
  - mmc: core: Capture correct oemid-bits for eMMC cards
  - mmc: core: sdio: hold retuning if sdio in 1-bit mode
  - mtd: physmap-core: Restore map_rom fallback
  - mtd: spinand: micron: correct bitmask for ecc status
  - mtd: rawnand: arasan: Ensure program page operations are successful
  - mtd: rawnand: marvell: Ensure program page operations are successful
  - mtd: rawnand: qcom: Unmap the right resource upon probe failure
  - Bluetooth: hci_event: Fix using memcmp when comparing keys
  - net/mlx5: Handle fw tracer change ownership event based on MTRC
  - platform/x86: touchscreen_dmi: Add info for the Positivo C4128B
  - HID: multitouch: Add required quirk for Synaptics 0xcd7e device
  - btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
  - drm: panel-orientation-quirks: Add quirk for One Mix 2S
  - sky2: Make sure there is at least one frag_addr available
  - regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()"
  - wifi: cfg80211: avoid leaking stack data into trace
  - wifi: mac80211: allow transmitting EAPOL frames with tainted key
  - wifi: cfg80211: Fix 6GHz scan configuration
  - Bluetooth: hci_core: Fix build warnings
  - Bluetooth: Avoid redundant authentication
  - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
  - tracing: relax trace_event_eval_update() execution with cond_resched()
  - ata: libata-eh: Fix compilation warning in ata_eh_link_report()
  - gpio: timberdale: Fix potential deadlock on &tgpio->lock
  - overlayfs: set ctime when setting mtime and atime
  - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
  - btrfs: initialize start_slot in btrfs_log_prealloc_extents
  - btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1
  - ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone
  - serial: 8250_omap: Fix errors with no_console_suspend
  - serial: 8250: omap: Fix imprecise external abort for omap_8250_pm()
  - xhci: track port suspend state correctly in unsuccessful resume cases
  - xhci: decouple usb2 port resume and get_port_status request handling
  - xhci: clear usb2 resume related variables in one place.
  - xhci: rename resume_done to resume_timestamp
  - xhci: move port specific items such as state completions to port structure
  - xhci: cleanup xhci_hub_control port references
  - usb: core: Track SuperSpeed Plus GenXxY
  - selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error
  - selftests/vm: make charge_reserved_hugetlb.sh work with existing cgroup setting
  - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA
  - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA
  - ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
  - ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
  - ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA
  - ACPI: resource: Add ASUS model S5402ZA to quirks
  - ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA
  - ACPI: resources: Add DMI-based legacy IRQ override quirk
  - thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge
  - net: pktgen: Fix interface flags printing
  - netfilter: nft_set_rbtree: .deactivate fails if element has expired
  - neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section
  - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
  - net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register()
  - i40e: prevent crash on probe if hw registers have invalid values
  - net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
  - ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr
  - tun: prevent negative ifindex
  - tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb
  - tcp: fix excessive TLP and RACK timeouts from HZ rounding
  - net: rfkill: gpio: prevent value glitch during probe
  - net: ipv6: fix return value check in esp_remove_trailer
  - net: ipv4: fix return value check in esp_remove_trailer
  - qed: fix LL2 RX buffer allocation
  - drm/i915: Retry gtt fault when out of fence registers
  - netfilter: nft_payload: fix wrong mac header matching
  - tcp: check mptcp-level constraints for backlog coalescing
  - KVM: x86: Mask LVTPC when handling a PMI
  - regmap: fix NULL deref on lookup
  - ice: reset first in crash dump kernels
  - ice: fix over-shifted variable
  - Bluetooth: avoid memcmp() out of bounds warning
  - Bluetooth: hci_event: Fix coding style
  - Bluetooth: vhci: Fix race when opening vhci device
  - Bluetooth: Fix a refcnt underflow problem for hci_conn
  - Bluetooth: Reject connection with the device which has same BD_ADDR
  - Bluetooth: hci_event: Ignore NULL link key
  - usb: hub: Guard against accesses to uninitialized BOS descriptors
  - Documentation: sysctl: align cells in second content column
  - mm/memory_hotplug: rate limit page migration warnings
  - lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default
  - dev_forward_skb: do not scrub skb mark within the same name space
  - RDMA/srp: Fix srp_abort()
  - RDMA/srp: Set scmnd->result only when scmnd is not NULL
  - x86/alternatives: Disable KASAN in apply_alternatives()
  - powerpc/64e: Fix wrong test in __ptep_test_and_clear_young()
  - powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE
  - dmaengine: mediatek: Fix deadlock caused by synchronize_irq()
  - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
  - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
  - counter: microchip-tcb-capture: Fix the use of internal GCLK logic
  - pinctrl: avoid unsafe code pattern in find_pinctrl()
  - cgroup: Remove duplicates in cgroup v1 tasks file
  - tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
  - Input: goodix - ensure int GPIO is in input for gpio_count == 1 && gpio_int_idx == 0 case
  - Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table
  - Input: xpad - add PXN V900 support
  - Input: psmouse - fix fast_reconnect function for PS/2 mode
  - ceph: fix type promotion bug on 32bit systems
  - ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
  - libceph: use kernel_connect()
  - thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding
  - mcb: remove is_added flag from mcb_device struct
  - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
  - iio: pressure: dps310: Adjust Timeout Settings
  - iio: pressure: bmp280: Fix NULL pointer exception
  - usb: musb: Modify the "HWVers" register address
  - usb: musb: Get the musb_qh poniter after musb_giveback
  - usb: dwc3: Soft reset phy on probe for host
  - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
  - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
  - dmaengine: stm32-mdma: abort resume if no ongoing transfer
  - media: mtk-jpeg: Fix use after free bug due to uncanceled work
  - Revert "spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe"
  - Revert "spi: zynqmp-gqspi: fix clock imbalance on probe failure"
  - pinctrl: renesas: rzn1: Enable missing PINMUX
  - ixgbe: fix crash with empty VF macvlan list
  - net: phy: mscc: macsec: reject PN update requests
  - net: macsec: indicate next pn update when offloading
  - drm/vmwgfx: fix typo of sizeof argument
  - riscv, bpf: Sign-extend return values
  - riscv, bpf: Factor out emit_call for kernel and bpf context
  - xen-netback: use default TX queue size for vifs
  - mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type
  - ravb: Fix up dma_free_coherent() call in ravb_remove()
  - drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow
  - drm/msm/dsi: skip the wait for video mode done if not applicable
  - drm/msm/dp: do not reinitialize phy unless retry during link training
  - net: prevent address rewrite in kernel_bind()
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
  - lib/test_meminit: fix off-by-one error in test_pages()
  - perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7
  - RDMA/cxgb4: Check skb value for failure to allocate
  - RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent
  - arm64/mpam: Fix repeated enabling in mpam_enable()
  - jfs: fix array-index-out-of-bounds in dbAdjTree
  - block/rnbd-srv: Check for unlikely string overflow


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-195.0.0.108
changelog:
  - !5831  fbdev: sis: Error out if pixclock equals zero
  - !5861  ksmbd: fix uaf in smb20_oplock_break_ack
  - !5911  CVE-2023-52484
  - !5895  i2c: i801: Fix block process call transactions
  - !5870  drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - !5863  CVE-2024-26788
  - iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range
  - iommu/arm-smmu-v3: Fix size calculation in arm_smmu_mm_invalidate_range()
  - !5811  Fixed CVE-2021-47037
  - !5808  nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - i2c: i801: Fix block process call transactions
  - !5845 [OLK 5.10] bugfixes of vf id of mailbox and port duplex configure
  - !5747  ksmbd: fix global oob in ksmbd_nl_policy
  - !5832  CVE-2023-52467
  - !5795  netfilter: nft_limit: reject configurations that cause integer overflow
  - !5751  net: atlantic: Fix DMA mapping for PTP hwts ring
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - dmaengine: fsl-qdma: init irq after reg initialization
  - ksmbd: fix uaf in smb20_oplock_break_ack
  - net: hns3: fix port duplex configure error in IMP reset
  - net: hns3: add checking for vf id of mailbox
  - mfd: syscon: Fix null pointer dereference in of_syscon_register()
  - fbdev: sis: Error out if pixclock equals zero
  - !5785  net: qualcomm: rmnet: fix global oob in rmnet_policy
  - !5789  perf/x86/lbr: Filter vsyscall addresses
  - !5780  bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  - !5787  bpf: fix check for attempt to corrupt spilled pointer
  - !5770 v2  scsi: hisi_sas: Fixed some issues in the SAS
  - ASoC: q6afe-clocks: fix reprobing of the driver
  - ASoC: q6afe-clocks: fix warning on symbol scope
  - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - !5794  um: time-travel: fix time corruption
  - !5773  patches for CVE-2023-52617
  - !5772  firmware: arm_scmi: Check mailbox/SMT channel for consistency
  - !5788 v2  Patches to Fix CVE-2023-52454
  - netfilter: nft_limit: reject configurations that cause integer overflow
  - um: time-travel: fix time corruption
  - perf/x86/lbr: Filter vsyscall addresses
  - nvmet-tcp: Fix the H2C expected PDU len calculation
  - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
  - bpf: fix check for attempt to corrupt spilled pointer
  - net: qualcomm: rmnet: fix global oob in rmnet_policy
  - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  - !5724  ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
  - PCI: switchtec: Fix stdev_release() crash after surprise hot remove
  - firmware: arm_scmi: Check mailbox/SMT channel for consistency
  - !5738 [OLK 5.10] net: hns3: fix port vlan filter not disabled problem in dynamic vlan mode
  - !5757  inet: read sk->sk_family once in inet_recv_error()
  - scsi: hisi_sas: Add cond_resched() to cq_thread_v3_hw()
  - scsi: hisi_sas: Default enable interrupt coalescing
  - inet: read sk->sk_family once in inet_recv_error()
  - !5745 v2  iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol
  - net: atlantic: Fix DMA mapping for PTP hwts ring
  - ksmbd: fix global oob in ksmbd_nl_policy
  - iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol
  - net: hns3: fix port vlan filter not disabled problem in dynamic vlan mode
  - !5698  sr9800: Add check for usbnet_get_endpoints
  - !5711 Backport 5.10.201 LTS patches from upstream
  - !5728  fix CVE-2021-47101
  - btrfs: use u64 for buffer sizes in the tree search ioctls
  - Revert "mmc: core: Capture correct oemid-bits for eMMC cards"
  - tracing/kprobes: Fix the order of argument descriptions
  - fbdev: fsl-diu-fb: mark wr_reg_wa() static
  - fbdev: imsttfb: fix a resource leak in probe
  - fbdev: imsttfb: Fix error path of imsttfb_probe()
  - spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies
  - drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE
  - x86/sev-es: Allow copy_from_kernel_nofault() in earlier boot
  - x86: Share definition of __is_canonical_address()
  - netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses
  - netfilter: nft_redir: use `struct nf_nat_range2` throughout and deduplicate eval call-backs
  - netfilter: xt_recent: fix (increase) ipv6 literal buffer length
  - r8169: respect userspace disabling IFF_MULTICAST
  - tg3: power down device only on SYSTEM_POWER_OFF
  - net/smc: put sk reference if close work was canceled
  - net/smc: allow cdc msg send rather than drop it with NULL sndbuf_desc
  - net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs
  - Fix termination state for idr_for_each_entry_ul()
  - net: r8169: Disable multicast filter for RTL8168H and RTL8107E
  - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
  - dccp: Call security_inet_conn_request() after setting IPv4 addresses.
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
  - hsr: Prevent use after free in prp_create_tagged_frame()
  - llc: verify mac len before reading mac header
  - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
  - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume
  - pwm: sti: Reduce number of allocations and drop usage of chip_data
  - pwm: sti: Avoid conditional gotos
  - regmap: prevent noinc writes from clobbering cache
  - media: dvb-usb-v2: af9035: fix missing unlock
  - media: cedrus: Fix clock/reset sequence
  - media: vidtv: mux: Add check and kfree for kstrdup
  - media: vidtv: psi: Add check for kstrdup
  - media: s3c-camif: Avoid inappropriate kfree()
  - media: bttv: fix use after free error due to btv->timeout timer
  - media: i2c: max9286: Fix some redundant of_node_put() calls
  - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add()
  - pcmcia: ds: fix refcount leak in pcmcia_device_add()
  - pcmcia: cs: fix possible hung task and memory leak pccardd()
  - rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call
  - i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs
  - perf hist: Add missing puts to hist__account_cycles
  - perf machine: Avoid out of bounds LBR memory read
  - usb: host: xhci-plat: fix possible kernel oops while resuming
  - xhci: Loosen RPM as default policy to cover for AMD xHC 1.1
  - powerpc/pseries: fix potential memory leak in init_cpu_associativity()
  - powerpc/imc-pmu: Use the correct spinlock initializer.
  - powerpc/xive: Fix endian conversion size
  - powerpc/40x: Remove stale PTE_ATOMIC_UPDATES macro
  - modpost: fix tee MODULE_DEVICE_TABLE built on big-endian host
  - f2fs: fix to initialize map.m_pblk in f2fs_precache_extents()
  - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc()
  - USB: usbip: fix stub_dev hub disconnect
  - tools: iio: iio_generic_buffer ensure alignment
  - tools: iio: iio_generic_buffer: Fix some integer type and calculation
  - tools: iio: privatize globals and functions in iio_generic_buffer.c file
  - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave()
  - dmaengine: ti: edma: handle irq_of_parse_and_map() errors
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
  - livepatch: Fix missing newline character in klp_resolve_symbols()
  - leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu'
  - leds: pwm: Don't disable the PWM when the LED should be off
  - ASoC: ams-delta.c: use component after check
  - padata: Fix refcnt handling in padata_free_shell()
  - padata: Convert from atomic_t to refcount_t on parallel_data->refcnt
  - ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails
  - HID: logitech-hidpp: Move get_wireless_feature_index() check to hidpp_connect_event()
  - HID: logitech-hidpp: Revert "Don't restart communication if not necessary"
  - HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only
  - HID: logitech-hidpp: Remove HIDPP_QUIRK_NO_HIDINPUT quirk
  - Revert "HID: logitech-hidpp: add a module parameter to keep firmware gestures"
  - sh: bios: Revive earlyprintk support
  - hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip
  - RDMA/hfi1: Workaround truncation compilation error
  - scsi: ufs: core: Leave space for '0' in utf8 desc string
  - ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe
  - IB/mlx5: Fix rdma counter binding for RAW QP
  - ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member not described
  - ext4: move 'ix' sanity check to corrent position
  - ARM: 9321/1: memset: cast the constant byte to unsigned char
  - hid: cp2112: Fix duplicate workqueue initialization
  - crypto: qat - increase size of buffers
  - crypto: qat - mask device capabilities with soft straps
  - crypto: caam/jr - fix Chacha20 + Poly1305 self test failure
  - crypto: caam/qi2 - fix Chacha20 + Poly1305 self test failure
  - nd_btt: Make BTT lanes preemptible
  - libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return value
  - hwrng: geode - fix accessing registers
  - selftests/resctrl: Ensure the benchmark commands fits to its array
  - selftests/pidfd: Fix ksft print formats
  - clk: scmi: Free scmi_clk allocated when the clocks with invalid info are skipped
  - firmware: ti_sci: Mark driver as non removable
  - xen-pciback: Consider INTx disabled when MSI/MSI-X is enabled
  - drm/rockchip: Fix type promotion bug in rockchip_gem_iommu_map()
  - drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe()
  - drm/mediatek: Fix iommu fault during crtc enabling
  - drm/bridge: tc358768: Fix bit updates
  - drm/bridge: tc358768: Disable non-continuous clock mode
  - drm/bridge: tc358768: Fix use of uninitialized variable
  - drm/rockchip: vop: Fix call to crtc reset helper
  - drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs
  - hwmon: (coretemp) Fix potentially truncated sysfs attribute name
  - hwmon: (axi-fan-control) Fix possible NULL pointer dereference
  - hwmon: (axi-fan-control) Support temperature vs pwm points
  - platform/x86: wmi: Fix opening of char device
  - platform/x86: wmi: remove unnecessary initializations
  - platform/x86: wmi: Fix probe failure when failing to register WMI devices
  - clk: qcom: config IPQ_APSS_6018 should depend on QCOM_SMEM
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
  - clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
  - clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
  - clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data
  - clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data
  - clk: npcm7xx: Fix incorrect kfree
  - clk: ti: fix double free in of_ti_divider_clk_setup()
  - clk: ti: change ti_clk_register[_omap_hw]() API
  - clk: ti: Update component clocks to use ti_dt_clk_name()
  - clk: ti: Update pll and clockdomain clocks to use ti_dt_clk_name()
  - clk: ti: Add ti_dt_clk_name() helper to use clock-output-names
  - clk: keystone: pll: fix a couple NULL vs IS_ERR() checks
  - spi: nxp-fspi: use the correct ioremap function
  - clk: linux/clk-provider.h: fix kernel-doc warnings and typos
  - clk: asm9260: use parent index to link the reference clock
  - clk: imx: imx8mq: correct error handling path
  - clk: imx: Select MXC_CLK for CLK_IMX8QXP
  - clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src
  - clk: qcom: gcc-sm8150: use ARRAY_SIZE instead of specifying num_parents
  - clk: qcom: mmcc-msm8998: Fix the SMMU GDSC
  - clk: qcom: mmcc-msm8998: Set bimc_smmu_gdsc always on
  - clk: qcom: mmcc-msm8998: Don't check halt bit on some branch clks
  - clk: qcom: mmcc-msm8998: Add hardware clockgating registers to some clks
  - clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies
  - regmap: debugfs: Fix a erroneous check after snprintf()
  - ipv6: avoid atomic fragment on GSO packets
  - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias()
  - tcp: fix cookie_init_timestamp() overflows
  - chtls: fix tp->rcv_tstamp initialization
  - r8169: fix rare issue with broken rx after link-down on RTL8125
  - r8169: use tp_to_dev instead of open code
  - thermal: core: prevent potential string overflow
  - PM / devfreq: rockchip-dfi: Make pmu regmap mandatory
  - can: dev: can_restart(): fix race condition between controller restart and netif_carrier_on()
  - can: dev: can_restart(): don't crash kernel if carrier is OK
  - wifi: rtlwifi: fix EDCA limit set by BT coexistence
  - tcp_metrics: do not create an entry from tcp_init_metrics()
  - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics()
  - tcp_metrics: add missing barriers on delete
  - wifi: mt76: mt7603: rework/fix rx pse hang check
  - wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
  - net: spider_net: Use size_add() in call to struct_size()
  - tipc: Use size_add() in calls to struct_size()
  - mlxsw: Use size_mul() in call to struct_size()
  - gve: Use size_add() in call to struct_size()
  - overflow: Implement size_t saturating arithmetic helpers
  - tcp: call tcp_try_undo_recovery when an RTOd TFO SYNACK is ACKed
  - udp: add missing WRITE_ONCE() around up->encap_rcv
  - i40e: fix potential memory leaks in i40e_remove()
  - genirq/matrix: Exclude managed interrupts in irq_matrix_allocated()
  - pstore/platform: Add check for kstrdup
  - x86/boot: Fix incorrect startup_gdt_descr.size
  - futex: Don't include process MM in futex key on no-MMU
  - x86/srso: Fix SBPB enablement for (possible) future fixed HW
  - vfs: fix readahead(2) on block devices
  - asix: fix wrong return value in asix_check_host_enable()
  - asix: fix uninit-value in asix_mdio_read()
  - net: asix: fix uninit value bugs
  - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - !5642  btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - !5712 [sync] PR-5672:  arm64/mpam_ctrlmon: Update ctrl group config with rdtgrp's partid
  - !5189 vhost_vdpa: Fix the error of not executing atomic_dec
  - !5530  net: Fix CVE-2024-26641
  - !5532  ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  - arm64/mpam: Allocate new partid for the created ctrl group
  - arm64/mpam_ctrlmon: Update ctrl group config with rdtgrp's partid
  - !5670  cpufreq: CPPC: Eliminate the impact of cpc_read() latency error
  - !5506  ext4: dio: Put endio under irq context for overwrite
  - !5507  ext4: Validate inode pa before using preallocation blocks
  - sr9800: Add check for usbnet_get_endpoints
  - cpufreq: CPPC: Eliminate the impact of cpc_read() latency error
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - vhost_vdpa: Fix the error of not executing atomic_dec
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
  - ip6_tunnel: use dev_sw_netstats_rx_add()
  - ext4: Validate inode pa before using preallocation blocks
  - ext4: Optimize endio process for DIO overwrites
  - iomap: Add a IOMAP_DIO_MAY_INLINE_COMP flag
  - iomap: pass a flags argument to iomap_dio_rw
  - iomap: rename the flags variable in __iomap_dio_rw
  - iomap: add IOMAP_DIO_INLINE_COMP
  - iomap: use an unsigned type for IOMAP_DIO_* defines
  - iomap: cleanup up iomap_dio_bio_end_io()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-196.0.0.109
changelog:
  - !6074  Fix CVE-2024-26787
  - !6193  uio_hv_generic: Fix another memory leak in error handling paths
  - !6192  arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
  - !6178  CVE-2024-26812
  - !6112  cifs: Fix UAF in cifs_demultiplex_thread()
  - uio_hv_generic: Fix another memory leak in error handling paths
  - arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
  - vfio/pci: Create persistent INTx handler
  - vfio: Introduce interface to flush virqfd inject workqueue
  - !6124  xen/events: close evtchn after mapping cleanup
  - !6137  vfio/pci: Lock external INTx masking ops
  - !6161 Backport 5.10.203 LTS patches from upstream
  - driver core: Release all resources during unbind before updating device links
  - r8169: fix deadlock on RTL8125 in jumbo mtu mode
  - r8169: disable ASPM in case of tx timeout
  - mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled
  - mmc: core: add helpers mmc_regulator_enable/disable_vqmmc
  - mmc: block: Retry commands in CQE error recovery
  - mmc: core: convert comma to semicolon
  - mmc: cqhci: Fix task clearing in CQE error recovery
  - mmc: cqhci: Warn of halt or task clear failure
  - mmc: cqhci: Increase recovery halt timeout
  - cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily
  - cpufreq: imx6q: don't warn for disabling a non-existing frequency
  - scsi: qla2xxx: Fix system crash due to bad pointer access
  - scsi: qla2xxx: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
  - scsi: core: Introduce the scsi_cmd_to_rq() function
  - smb3: fix caching of ctime on setxattr
  - fs: add ctime accessors infrastructure
  - ima: annotate iint mutex to avoid lockdep false positive warnings
  - fbdev: stifb: Make the STI next font pointer a 32-bit signed offset
  - misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support
  - misc: pci_endpoint_test: Add deviceID for AM64 and J7200
  - s390/cmma: fix detection of DAT pages
  - s390/mm: fix phys vs virt confusion in mark_kernel_pXd() functions family
  - ASoC: SOF: sof-pci-dev: Fix community key quirk detection
  - ASoC: SOF: sof-pci-dev: don't use the community key on APL Chromebooks
  - ASoC: SOF: sof-pci-dev: add parameter to override topology filename
  - ASoC: SOF: sof-pci-dev: use community key on all Up boards
  - ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header
  - smb3: fix touch -h of symlink
  - net: ravb: Start TX queues after HW initialization succeeded
  - net: ravb: Use pm_runtime_resume_and_get()
  - r8169: prevent potential deadlock in rtl8169_close
  - Revert "workqueue: remove unused cancel_work()"
  - octeontx2-pf: Fix adding mbox work queue entry when num_vfs > 64
  - net: stmmac: xgmac: Disable FPE MMC interrupts
  - selftests/net: mptcp: fix uninitialized variable warnings
  - selftests/net: ipsec: fix constant out of range
  - dpaa2-eth: increase the needed headroom to account for alignment
  - usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
  - USB: core: Change configuration warnings to notices
  - hv_netvsc: fix race of netvsc and VF register_netdevice
  - Input: xpad - add HyperX Clutch Gladiate Support
  - btrfs: make error messages more clear when getting a chunk map
  - btrfs: send: ensure send_fd is writable
  - btrfs: fix off-by-one when checking chunk map includes logical address
  - btrfs: ref-verify: fix memory leaks in btrfs_ref_tree_mod()
  - btrfs: add dmesg output for first mount and last unmount of a filesystem
  - parisc: Drop the HP-UX ENOSYM and EREMOTERELEASE error codes
  - powerpc: Don't clobber f0/vs0 during fp|altivec register save
  - iommu/vt-d: Add MTL to quirk list to skip TE disabling
  - bcache: revert replacing IS_ERR_OR_NULL with IS_ERR
  - dm verity: don't perform FEC for failed readahead IO
  - dm-verity: align struct dm_verity_fec_io properly
  - ALSA: hda/realtek: Add supported ALC257 for ChromeOS
  - ALSA: hda/realtek: Headset Mic VREF to 100%
  - ALSA: hda: Disable power-save on KONTRON SinglePC
  - mmc: block: Do not lose cache flush during CQE error recovery
  - firewire: core: fix possible memory leak in create_units()
  - pinctrl: avoid reload of p state in list iteration
  - io_uring: fix off-by one bvec index
  - USB: dwc3: qcom: fix wakeup after probe deferral
  - usb: dwc3: set the dma max_seg_size
  - usb: dwc3: Fix default mode initialization
  - USB: dwc2: write HCINT with INTMASK applied
  - USB: serial: option: don't claim interface 4 for ZTE MF290
  - USB: serial: option: fix FM101R-GL defines
  - USB: serial: option: add Fibocom L7xx modules
  - bcache: fixup lock c->root error
  - bcache: fixup init dirty data errors
  - bcache: prevent potential division by zero error
  - bcache: check return value from btree_node_alloc_replacement()
  - dm-delay: fix a race between delay_presuspend and delay_bio
  - hv_netvsc: Mark VF as slave before exposing it to user-mode
  - hv_netvsc: Fix race of register_netdevice_notifier and VF register
  - USB: serial: option: add Luat Air72*U series products
  - s390/dasd: protect device queue against concurrent access
  - bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race
  - bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce()
  - swiotlb-xen: provide the "max_mapping_size" method
  - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA
  - ASoC: simple-card: fixup asoc_simple_probe() error handling
  - nfsd: lock_rename() needs both directories to live on the same fs
  - ext4: using nofail preallocation in ext4_es_insert_extent()
  - ext4: using nofail preallocation in ext4_es_insert_delayed_block()
  - ext4: use pre-allocated es in __es_remove_extent()
  - ext4: use pre-allocated es in __es_insert_extent()
  - ext4: factor out __es_alloc_extent() and __es_free_extent()
  - ext4: add a new helper to check if es must be kept
  - MIPS: KVM: Fix a build warning about variable set but not used
  - media: ccs: Correctly initialise try compose rectangle
  - lockdep: Fix block chain corruption
  - USB: dwc3: qcom: fix ACPI platform device leak
  - USB: dwc3: qcom: fix resource leaks on probe deferral
  - afs: Fix file locking on R/O volumes to operate in local mode
  - afs: Return ENOENT if no cell DNS record can be found
  - net: axienet: Fix check for partial TX checksum
  - amd-xgbe: propagate the correct speed and duplex status
  - amd-xgbe: handle the corner-case during tx completion
  - amd-xgbe: handle corner-case during sfp hotplug
  - arm/xen: fix xen_vcpu_info allocation alignment
  - net/smc: avoid data corruption caused by decline
  - net: usb: ax88179_178a: fix failed operations during ax88179_reset
  - ipv4: Correct/silence an endian warning in __ip_do_redirect
  - HID: fix HID device resource race between HID core and debugging support
  - HID: core: store the unique system identifier in hid_device
  - drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full
  - ata: pata_isapnp: Add missing error check for devm_ioport_map()
  - wireguard: use DEV_STATS_INC()
  - drm/panel: simple: Fix Innolux G101ICE-L01 timings
  - drm/panel: simple: Fix Innolux G101ICE-L01 bus flags
  - drm/panel: auo,b101uan08.3: Fine tune the panel power sequence
  - drm/panel: boe-tv101wum-nl6: Fine tune the panel power sequence
  - afs: Make error on cell lookup failure consistent with OpenAFS
  - afs: Fix afs_server_list to be cleaned up with RCU
  - PCI: keystone: Drop __init from ks_pcie_add_pcie_{ep,port}()
  - !5612 【OLK-5.10】Add Chengdu BeiZhongWangXin Technology N5/N6 Series Network Card Driver
  - !5736 Backport 5.10.202 LTS patches from upstream
  - !6033  gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  - !6003  KVM: s390: vsie: fix race during shadow creation
  - !6103  riscv: Sparse-Memory/vmemmap out-of-bounds fix
  - !6065 v4  arm64 bpf trampoline for olk-5.10
  - !6116  wifi: rt2x00: restart beacon queue when hardware reset
  - !6047  hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  - vfio/pci: Lock external INTx masking ops
  - !6108 udma: optimize latency for non-share-jfr mode
  - !6101  vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - !5486 [OLK-5.10] support the AMD Zen5 Turin
  - !5717 v2  fix CVE-2023-52587
  - !6050  wifi: mac80211: fix race condition on enabling fast-xmit
  - !4923  mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
  - xen/events: close evtchn after mapping cleanup
  - wifi: rt2x00: restart beacon queue when hardware reset
  - cifs: Fix UAF in cifs_demultiplex_thread()
  - hns3 udma: optimize latency for non-share-jfr mode
  - riscv: Sparse-Memory/vmemmap out-of-bounds fix
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - !6016  btrfs: don't drop extent_map for free space inode on write error
  - !6031  nilfs2: fix potential bug in end_buffer_async_write
  - !5847  ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - mmc: mmci: stm32: fix DMA API overlapping mappings warning
  - mmc: mmci: stm32: use a buffer for unaligned DMA requests
  - !5803  fs/ntfs3: Fix an NULL dereference bug
  - !5977  btrfs: dev-replace: properly validate device names
  - !5921  ext4: fix double-free of blocks due to wrong extents moved_len
  - !6029  ceph: prevent use-after-free in encode_cap_msg()
  - !5973  EDAC/thunderx: Fix possible out-of-bounds string access
  - !6052  fs/ntfs3: fix lbk-CVE-2023-52640
  - !6037  fix-CVE-2024-26706
  - !6040  nilfs2: fix data corruption in dsync block recovery for small block sizes
  - config: Enable DYNAMIC_FTRACE_WITH_DIRECT_CALLS
  - arm64: ftrace: Support direct call for no literal module functions
  - arm64: ftrace: Add ftrace direct call support
  - arm64: ftrace: Support long jump for ftrace direct call
  - ftrace: Allow users to disable ftrace direct call
  - bpf, arm64: Fix BTI type used for freplace attached functions
  - bpf, arm64: Fixed a BTI error on returning to patched function
  - bpf, arm64: Fix bpf trampoline instruction endianness
  - bpf, arm64: Fix compile error in dummy_tramp()
  - bpf, arm64: Mark dummy_tramp as global
  - bpf, arm64: Add bpf trampoline for arm64
  - bpf, arm64: Implement bpf_arch_text_poke() for arm64
  - arm64: Add LDR (literal) instruction
  - bpf, arm64: Adjust the offset of str/ldr(immediate) to positive number
  - bpf, arm64: Optimize BPF store/load using arm64 str/ldr(immediate offset)
  - arm64, insn: Add ldr/str with immediate offset
  - x86/ibt,ftrace: Search for __fentry__ location
  - !6017  drm/amdgpu: fix use-after-free bug
  - fs/ntfs3: Fix oob in ntfs_listxattr
  - fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea()
  - ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
  - wifi: mac80211: fix race condition on enabling fast-xmit
  - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  - !6020  net/sched: act_mirred: use the backlog for mirred ingress
  - !5995  mm/swap: fix race when skipping swapcache
  - nilfs2: fix data corruption in dsync block recovery for small block sizes
  - !6006  fix CVE-2024-26669
  - parisc/unaligned: Fix emulate_ldw() breakage
  - parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd()
  - parisc: Fix random data corruption from exception handler
  - parisc/unaligned: Rewrite 32-bit inline assembly of emulate_sth()
  - parisc/unaligned: Rewrite 32-bit inline assembly of emulate_ldd()
  - parisc/unaligned: Rewrite inline assembly of emulate_ldw()
  - parisc: Mark ex_table entries 32-bit aligned in uaccess.h
  - parisc: Fix some apparent put_user() failures
  - parisc: Implement __get/put_kernel_nofault()
  - parisc: Drop strnlen_user() in favour of generic version
  - parisc: Switch user access functions to signal errors in r29 instead of r8
  - parisc/unaligned: Rewrite inline assembly of emulate_ldh()
  - parisc/unaligned: Use EFAULT fixup handler in unaligned handlers
  - !5969  fbdev: savage: Error out if pixclock equals zero
  - drivers: add Chengdu BeiZhongWangXin Technology N5/N6 Series Network Card Driver
  - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  - !5976  dm-crypt: don't modify the data when using authenticated encryption
  - objtool/x86: Use asm/nops.h
  - !6011 udma: fix a bug in udma dfx
  - nilfs2: fix potential bug in end_buffer_async_write
  - !6018 v2  IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
  - ceph: prevent use-after-free in encode_cap_msg()
  - !5979  mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  - !5970  fixup CVE-2024-26751
  - net/sched: act_mirred: use the backlog for mirred ingress
  - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
  - drm/amdgpu: fix use-after-free bug
  - !5950  RDMA/qedr: Fix qedr_create_user_qp error flow
  - btrfs: don't drop extent_map for free space inode on write error
  - !5998  net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
  - !5996  mptcp: fix double-free on socket dismantle
  - !5993  ipv6: sr: fix possible use-after-free and null-ptr-deref
  - !5763  CVE-2024-26684 bugfix for OLK-5.10
  - hns3 udma: fix the dfx structure is deleted concurrently.
  - !5975 udma: fix a bug in QP creation
  - net/sched: flower: Fix kabi change
  - net/sched: flower: Fix chain template offload
  - KVM: s390: vsie: fix race during shadow creation
  - net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
  - mptcp: fix double-free on socket dismantle
  - mm/swap: fix race when skipping swapcache
  - ipv6: sr: fix possible use-after-free and null-ptr-deref
  - !5901  CVE-2024-26695
  - !5853  dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - !5930  RDMA/srpt: Support specifying the srpt_service_guid parameter
  - !5758  tunnels: fix out of bounds access when building IPv6 PMTU error
  - !5812  afs: Increase buffer size in afs_update_volume_status()
  - !5852  CVE-2024-26809
  - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  - btrfs: dev-replace: properly validate device names
  - dm-crypt: don't modify the data when using authenticated encryption
  - hns3 udma: modify the process of create qp
  - EDAC/thunderx: Fix possible out-of-bounds string access
  - !5943  CVE-2021-46926
  - interconnect: qcom: Add support for mask-based BCMs
  - netfilter: nf_tables: disable toggling dormant table state more than once
  - netfilter: nf_tables: fix table flag updates
  - netfilter: nftables: update table flags from the commit phase
  - drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox
  - drm/amdgpu: fix error handling in amdgpu_bo_list_get()
  - drm/amd/pm: Handle non-terminated overdrive commands.
  - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
  - ext4: correct the start block of counting reserved clusters
  - ext4: correct offset of gdb backup in non meta_bg group to update_backups
  - ext4: apply umask if ACL support is disabled
  - Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"
  - media: qcom: camss: Fix vfe_get() error jump
  - mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors
  - nfsd: fix file memleak on client_opens_release
  - media: venus: hfi: add checks to handle capabilities from firmware
  - media: venus: hfi: fix the check to handle session buffer requirement
  - media: venus: hfi_parser: Add check to keep the number of codecs within range
  - media: sharp: fix sharp encoding
  - media: lirc: drop trailing space from scancode transmit
  - f2fs: avoid format-overflow warning
  - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
  - net: phylink: initialize carrier state at creation
  - net: dsa: lan9303: consequently nested-lock physical MDIO
  - i2c: designware: Disable TX_EMPTY irq while waiting for block length byte
  - lsm: fix default return value for inode_getsecctx
  - lsm: fix default return value for vm_enough_memory
  - Revert ncsi: Propagate carrier gain/loss events to the NCSI controller
  - arm64: dts: qcom: ipq6018: Fix tcsr_mutex register size
  - arm64: dts: qcom: ipq6018: switch TCSR mutex to MMIO
  - PCI: exynos: Don't discard .remove() callback
  - Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE
  - Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables
  - bluetooth: Add device 13d3:3571 to device tables
  - bluetooth: Add device 0bda:887b to device tables
  - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559
  - cpufreq: stats: Fix buffer overflow detection in trans_stats()
  - tty: serial: meson: fix hard LOCKUP on crtscts mode
  - serial: meson: Use platform_get_irq() to get the interrupt
  - tty: serial: meson: retrieve port FIFO size from DT
  - serial: meson: remove redundant initialization of variable id
  - ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC
  - ALSA: hda/realtek - Add Dell ALC295 to pin fall back table
  - ALSA: info: Fix potential deadlock at disconnection
  - xhci: Enable RPM on controllers that support low-power states
  - parisc/pgtable: Do not drop upper 5 address bits of physical address
  - parisc: Prevent booting 64-bit kernels on PA1.x machines
  - i3c: master: cdns: Fix reading status register
  - mtd: cfi_cmdset_0001: Byte swap OTP info
  - mm/memory_hotplug: use pfn math in place of direct struct page manipulation
  - mm/cma: use nth_page() in place of direct struct page manipulation
  - dmaengine: stm32-mdma: correct desc prep when channel running
  - mcb: fix error handling for different scenarios when parsing
  - i2c: core: Run atomic i2c xfer when !preemptible
  - kernel/reboot: emergency_restart: Set correct system_state
  - quota: explicitly forbid quota files from being encrypted
  - PCI: keystone: Don't discard .probe() callback
  - PCI: keystone: Don't discard .remove() callback
  - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
  - mmc: meson-gx: Remove setting of CMD_CFG_ERROR
  - wifi: ath11k: fix htt pktlog locking
  - wifi: ath11k: fix dfs radar event locking
  - wifi: ath11k: fix temperature event locking
  - ima: detect changes to the backing overlay file
  - firmware: qcom_scm: use 64-bit calling convention only when client is 64-bit
  - btrfs: don't arbitrarily slow down delalloc if we're committing
  - rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects
  - PM: hibernate: Clean up sync_read handling in snapshot_write_next()
  - PM: hibernate: Use __get_safe_page() rather than touching the list
  - arm64: dts: qcom: ipq6018: Fix hwlock index for SMEM
  - PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common()
  - mmc: sdhci_am654: fix start loop index for TAP value parsing
  - mmc: vub300: fix an error code
  - clk: qcom: ipq6018: drop the CLK_SET_RATE_PARENT flag from PLL clocks
  - clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks
  - parisc/pdc: Add width field to struct pdc_model
  - arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
  - ACPI: resource: Do IRQ override on TongFang GMxXGxx
  - watchdog: move softlockup_panic back to early_param
  - PCI/sysfs: Protect driver's D3cold preference from user space
  - hvc/xen: fix error path in xen_hvc_init() to always register frontend driver
  - hvc/xen: fix console unplug
  - tty/sysrq: replace smp_processor_id() with get_cpu()
  - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
  - audit: don't take task_lock() in audit_exe_compare() code path
  - KVM: x86: Ignore MSR_AMD64_TW_CFG access
  - KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space
  - scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for selected registers
  - scsi: mpt3sas: Fix loop logic
  - bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
  - bpf: Fix check_stack_write_fixed_off() to correctly spill imm
  - randstruct: Fix gcc-plugin performance mode to stay in group
  - powerpc/perf: Fix disabling BHRB and instruction sampling
  - media: venus: hfi: add checks to perform sanity on queue pointers
  - cifs: fix check of rc in function generate_smb3signingkey
  - cifs: spnego: add ';' in HOST_KEY_LEN
  - tools/power/turbostat: Fix a knl bug
  - macvlan: Don't propagate promisc change to lower dev in passthru
  - net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors
  - net/mlx5_core: Clean driver version and name
  - net/mlx5e: fix double free of encap_header
  - net: stmmac: fix rx budget limit check
  - netfilter: nf_conntrack_bridge: initialize err to 0
  - net: ethernet: cortina: Fix MTU max setting
  - net: ethernet: cortina: Handle large frames
  - net: ethernet: cortina: Fix max RX frame define
  - bonding: stop the device in bond_setup_by_slave()
  - ptp: annotate data-race around q->head and q->tail
  - xen/events: fix delayed eoi list handling
  - ppp: limit MRU to 64K
  - tipc: Fix kernel-infoleak due to uninitialized TLV value
  - tty: Fix uninit-value access in ppp_sync_receive()
  - gfs2: Silence "suspicious RCU usage in gfs2_permission" warning
  - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
  - NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO
  - SUNRPC: Add an IS_ERR() check back to where it was
  - SUNRPC: ECONNRESET might require a rebind
  - xhci: turn cancelled td cleanup to its own function
  - wifi: iwlwifi: Use FW rate for non-data frames
  - pwm: Fix double shift bug
  - drm/amdgpu: fix software pci_unplug on some chips
  - ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
  - kgdb: Flush console before entering kgdb on panic
  - drm/amd/display: Avoid NULL dereference of timing generator
  - media: imon: fix access to invalid resource for the second interface
  - media: cobalt: Use FIELD_GET() to extract Link Width
  - gfs2: fix an oops in gfs2_permission
  - gfs2: ignore negated quota changes
  - media: vivid: avoid integer overflow
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker
  - i2c: sun6i-p2wi: Prevent potential division by zero
  - 9p/trans_fd: Annotate data-racy writes to file::f_flags
  - usb: gadget: f_ncm: Always set current gadget in ncm_bind()
  - tty: vcc: Add check for kstrdup() in vcc_probe()
  - exfat: support handle zero-size directory
  - HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W
  - misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
  - atm: iphase: Do PCI error checks on own line
  - PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream
  - ARM: 9320/1: fix stack depot IRQ stack filter
  - HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround
  - jfs: fix array-index-out-of-bounds in diAlloc
  - jfs: fix array-index-out-of-bounds in dbFindLeaf
  - fs/jfs: Add validity check for db_maxag and db_agpref
  - fs/jfs: Add check for negative db_l2nbperpage
  - RDMA/hfi1: Use FIELD_GET() to extract Link Width
  - ASoC: soc-card: Add storage for PCI SSID
  - selftests/efivarfs: create-read: fix a resource leak
  - drm/panel: st7703: Pick different reset sequence
  - drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
  - drm/panel: fix a possible null pointer dereference
  - drm/amdgpu: Fix potential null pointer derefernce
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
  - drm/msm/dp: skip validity check for DP CTS EDID checksum
  - drm/komeda: drop all currently held locks if deadlock happens
  - platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
  - Bluetooth: Fix double free in hci_conn_cleanup
  - Bluetooth: btusb: Add date->evt_skb is NULL check
  - wifi: ath10k: Don't touch the CE interrupt registers after power up
  - net: annotate data-races around sk->sk_dst_pending_confirm
  - net: annotate data-races around sk->sk_tx_queue_mapping
  - wifi: ath10k: fix clang-specific fortify warning
  - wifi: ath9k: fix clang-specific fortify warnings
  - bpf: Detect IP == ksym.end as part of BPF program
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
  - wifi: mac80211_hwsim: fix clang-specific fortify warning
  - x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size
  - clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware
  - clocksource/drivers/timer-imx-gpt: Fix potential memory leak
  - perf/core: Bail out early if the request AUX area is out of bound
  - locking/ww_mutex/test: Fix potential workqueue corruption
  - ARM: ep93xx: Add terminator to gpiod_lookup_table
  - fbdev: savage: Error out if pixclock equals zero
  - !5781  ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - !5884  KVM: arm64: vgic-its: Fix CVE-2024-26598 fix patch issue
  - RDMA/qedr: Fix qedr_create_user_qp error flow
  - ALSA: hda: intel-sdw-acpi: harden detection of controller
  - RDMA/srpt: Support specifying the srpt_service_guid parameter
  - ext4: fix double-free of blocks due to wrong extents moved_len
  - crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
  - KVM: arm64: vgic-its: Fix CVE-2024-26598 fix patch issue
  - dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - netfilter: nft_set_pipapo: release elements in clone only from destroy path
  - netfilter: nft_set_pipapo: remove scratch_aligned pointer
  - netfilter: nft_set_pipapo: add helper to release pcpu scratch area
  - netfilter: nft_set_pipapo: store index in scratch maps
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - afs: Increase buffer size in afs_update_volume_status()
  - fs/ntfs3: Fix an NULL dereference bug
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - net: stmmac: xgmac: fix a typo of register name in DPP safety handling
  - net: stmmac: xgmac: use #define for string constants
  - net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
  - tunnels: fix out of bounds access when building IPv6 PMTU error
  - IB/ipoib: Fix mcast list locking
  - RDMA/IPoIB: Fix error code return in ipoib_mcast_join
  - x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled
  - x86/CPU/AMD: Check vendor in the AMD microcode callback
  - x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5
  - x86/CPU/AMD: Add X86_FEATURE_ZEN5
  - x86/cpu: Support AMD Automatic IBRS
  - Documentation/hw-vuln: Update spectre doc
  - x86: Remove dynamic NOP selection
  - x86/CPU/AMD: Add X86_FEATURE_ZEN1
  - x86/CPU/AMD: Drop now unused CPU erratum checking function
  - x86/CPU/AMD: Get rid of amd_erratum_1485[]
  - x86/CPU/AMD: Get rid of amd_erratum_400[]
  - x86/CPU/AMD: Get rid of amd_erratum_383[]
  - x86/CPU/AMD: Get rid of amd_erratum_1054[]
  - x86/CPU/AMD: Move the DIV0 bug detection to the Zen1 init function
  - x86/CPU/AMD: Move Zenbleed check to the Zen2 init function
  - x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common()
  - x86/CPU/AMD: Call the spectral chicken in the Zen2 init function
  - x86/CPU/AMD: Move erratum 1076 fix into the Zen1 init function
  - x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function
  - x86/CPU/AMD: Carve out the erratum 1386 fix
  - x86/CPU/AMD: Add ZenX generations flags
  - x86/CPU/AMD: Make sure EFER[AIBRSE] is set
  - x86: Fix comment for X86_FEATURE_ZEN
  - x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
  - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-197.0.0.110
changelog:
  - !5273  net/smc: fix illegal rmb_desc access in SMC-D connection dump
  - !6486  devlink: fix possible use-after-free and memory leaks in devlink_init()
  - !6515  fix CVE-2023-52498
  - !5468  media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
  - !6314  fixup CVE-2024-26908
  - PM: sleep: Fix error handling in dpm_prepare()
  - PM: sleep: Fix possible deadlocks in core system-wide PM code
  - PM: core: Remove unnecessary (void *) conversions
  - PM: sleep: Avoid calling put_device() under dpm_list_mtx
  - PM: sleep: Use dev_printk() when possible
  - async: Introduce async_schedule_dev_nocall()
  - async: Split async_schedule_node_domain()
  - !6316  scsi: fnic: Move fnic_fnic_flush_tx() to a work queue
  - !6399  wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces
  - !6407  wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - !6455  CVE-2021-47182
  - devlink: fix possible use-after-free and memory leaks in devlink_init()
  - !6423  tracing/trigger: Fix to return error if failed to alloc snapshot
  - scsi: core: Fix scsi_mode_sense() buffer length handling
  - scsi: core: Reshuffle response handling in scsi_mode_sense()
  - !6281 v2  net/mlx5: Update error handler for UCTX and UMEM
  - !6428  net/sched: flower: Fix unable to handle page fault bug in fl_init
  - !6267  wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
  - !6279  Bluetooth: Avoid potential use-after-free in hci_error_reset
  - !6259  arp: Prevent overflow in arp_req_get().
  - !6312  fix CVE-2024-24861 for 5.10
  - !6308 v3  ima: Avoid blocking in RCU read-side critical section
  - net/sched: flower: Fix unable to handle page fault bug in fl_init
  - tracing/trigger: Fix to return error if failed to alloc snapshot
  - !6291  aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces
  - !6295 hns3 udma: adjustment of the maximum number of Jettys
  - !6202  ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  - scsi: fnic: Move fnic_fnic_flush_tx() to a work queue
  - !6294 [sync] PR-6177:  arm64/mpam: Not allowed setting 0 to cache portion bit mask
  - !6293 [sync] PR-6176:  arm64/mpam: return EOPNOTSUPP when changing rmid of monitor group or resource group with monitor
  - !6284  net/mlx5e: CT, Fix multiple allocations and memleak of mod acts
  - x86/xen: Add some null pointer checking to smp.c
  - media: xc4000: Fix atomicity violation in xc4000_get_frequency
  - ima: Avoid blocking in RCU read-side critical section
  - !6076  Fix CVE-2024-26764
  - arm64/mpam: Not allowed setting 0 to cache portion bit mask
  - arm64/mpam: return EOPNOTSUPP when changing rmid of monitor group or resource group with monitor
  - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  - hns3 udma: adjustment of the maximum number of Jettys
  - !6263 udma: fix a bug of jfr record_db
  - net/mlx5e: CT, Fix multiple allocations and memleak of mod acts
  - net/mlx5: Update error handler for UCTX and UMEM
  - Bluetooth: Avoid potential use-after-free in hci_error_reset
  - !6262 scsi: hisi_sas: Remove hisi_hba->timer for v3 hw
  - !5965  Fix CVE-2023-52441 and integrate the pre-patch
  - !6086  netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
  - !6085  netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
  - scsi: hisi_sas: Remove hisi_hba->timer for v3 hw
  - hns3 udma: fixes errors related to jfr RECORD_DB.
  - arp: Prevent overflow in arp_req_get().
  - !6199  writeback fix softlockup
  - !6087  net/sched: act_mirred: don't override retval if we already lost the skb
  - !6082  can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  - !6058  net: ip_tunnel: prevent perpetual headroom growth
  - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  - cgroup_writeback: fix softlockup for blkcg->memcg_list
  - net/sched: act_mirred: don't override retval if we already lost the skb
  - netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
  - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  - can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
  - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
  - net: ip_tunnel: prevent perpetual headroom growth
  - ksmbd: fix out of bounds in init_smb2_rsp_hdr()
  - ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr
  - ksmbd: return unsupported error on smb1 mount
  - ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect
  - media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-198.0.0.111
changelog:
  - !6904  bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
  - !6918  bpf: Fix hashtab overflow check on 32-bit arches
  - !6928  firmware: arm_scmi: Harden accesses to the reset domains
  - !6924  bpf: Fix stackmap overflow check on 32-bit arches
  - !6861  media: dvb-frontends: avoid stack overflow warnings with clang
  - !6840  CVE-2023-52650
  - !6851  serial/pmac_zilog: Remove flawed mitigation for rx irq flood
  - !6826  fat: fix uninitialized field in nostale filehandles
  - !6838  fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - !6808  CVE-2024-26923
  - firmware: arm_scmi: Harden accesses to the reset domains
  - bpf: Fix stackmap overflow check on 32-bit arches
  - bpf: Fix hashtab overflow check on 32-bit arches
  - !6846  perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling
  - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
  - !6849  erofs: fix pcluster use-after-free on UP platforms
  - !6740  V2 cpuset: fix race between rebuild scheduler domains and hotplug work
  - !6473  nvme-fc: do not wait in vain when unloading module
  - media: dvb-frontends: avoid stack overflow warnings with clang
  - !6802  x86,static_call: Fix __static_call_return0 for i386
  - serial/pmac_zilog: Remove flawed mitigation for rx irq flood
  - !6835  kprobes: Fix check for probe enabled in kill_kprobe()
  - erofs: fix pcluster use-after-free on UP platforms
  - perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling
  - drm/tegra: dsi: Add missing check for of_find_device_by_node
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - !6799  rtmutex: Add acquire semantics for rtmutex lock acquisition slow path
  - kprobes: Fix check for probe enabled in kill_kprobe()
  - !6797  scsi: target: core: Add TMF to tmr_list handling
  - fat: fix uninitialized field in nostale filehandles
  - !6798  media: ir_toy: fix a memleak in irtoy_tx
  - af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
  - af_unix: Fix garbage collector racing against connect()
  - !6756  vfio/fsl-mc: Block calling interrupt handler without trigger
  - x86,static_call: Fix __static_call_return0 for i386
  - !6704  x86/thermal: Fix LVT thermal setup for SMI delivery mode
  - !6702  static_call: Don't make __static_call_return0 static
  - rtmutex: Add acquire semantics for rtmutex lock acquisition slow path
  - !6700  PCI/IOV: Enlarge virtfn sysfs name buffer
  - !5905 [OLK 5.10] RDMA/hns: Fix incorrect iteration number of DCA umem sg entries and error return in hns_roce_v2_modify_srq()
  - media: ir_toy: fix a memleak in irtoy_tx
  - scsi: target: core: Add TMF to tmr_list handling
  - !6684  infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver
  - !6755  binder: check offset alignment in binder_get_object()
  - !6729  PCI/IOV: Improve performance of creating VFs concurrently
  - !6669  NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - !6680  cifs: fix underflow in parse_server_interfaces()
  - !6719  drm/amdgpu: validate the parameters of bo mapping operations more clearly
  - vfio/fsl-mc: Block calling interrupt handler without trigger
  - binder: check offset alignment in binder_get_object()
  - !6739 v2  Apply patches of ses from stable
  - !6677 v3  olk-5.10: bugfix for mm
  - !6654  net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
  - !6683 v2  CVE-2024-26921
  - cpuset: fix race between rebuild scheduler domains and hotplug work
  - scsi: ses: Handle enclosure with just a primary component gracefully
  - Revert "scsi: ses: Handle enclosure with just a primary component gracefully"
  - Revert "scsi: ses: Fix crash caused by kfree an invalid pointer"
  - scsi: ses: Fix possible desc_ptr out-of-bounds accesses
  - Revert "scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process"
  - !6501  cachefiles: fix memory leak in cachefiles_add_cache()
  - PCI/IOV: Improve performance of creating VFs concurrently
  - drm/amdgpu: validate the parameters of bo mapping operations more clearly
  - !6676  cvm feature patches
  - x86/thermal: Fix LVT thermal setup for SMI delivery mode
  - static_call: Don't make __static_call_return0 static
  - PCI/IOV: Enlarge virtfn sysfs name buffer
  - !6567  CVE-2024-26896
  - !6580  drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  - infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver
  - net/ethernet/huawei/hinic3: Add the CQM on which the RDMA depends
  - sk_buff: Fix KABI break for the modification of struct sk_buff
  - inet: inet_defrag: prevent sk release while still in use
  - net: Fix KABI break for introducing is_skb_wmem()
  - skb_expand_head() adjust skb->truesize incorrectly
  - skbuff: introduce skb_expand_head()
  - cifs: fix underflow in parse_server_interfaces()
  - mm/madvise: fix potential pte_unmap_unlock pte error
  - mm/page_alloc: always attempt to allocate at least one page during bulk allocation
  - gicv3: add lpi support for cvm guest
  - config: modify arm64 defconfig for cvm feature
  - mm: enable swiotlb alloc for cvm share mem
  - swiotlb: add swiotlb io_tlb_list release slots methd
  - swiotlb: Add restricted DMA alloc/free support
  - kvm: add support for multi-numa and fix kabi change
  - pmu: enable pmu phys irq inject for cvm
  - kvm: add cvm host feature
  - !6660 udma: fix bugs of record_db
  - !6640  hsr: Fix uninit-value access in hsr_get_node()
  - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
  - !6620  packet: annotate data-races around ignore_outgoing
  - !6618  net/bnx2x: Prevent access to a freed page in page_pool
  - !6592  net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  - !6619  Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - !6635 backport RDMA/hns: Fix DCA's dependence on ib_uverbs from OLK-6.6
  - hns3 udma: addressing stage adaptation
  - !6257 HNS3: Do some optimizing job and support fast path
  - !6623  amdkfd: use calloc instead of kzalloc to avoid integer overflow
  - hns3 udma: unified coding style
  - hns3 udma: Interface for adding a user ctrl.
  - hsr: Fix uninit-value access in hsr_get_node()
  - !6561  md: fix kmemleak of rdev->serial
  - !6631 Backport 5.10.205 LTS patches from upstream
  - powerpc/ftrace: Fix stack teardown in ftrace_no_trace
  - powerpc/ftrace: Create a dummy stackframe to fix stack unwind
  - tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf()
  - tty: n_gsm, remove duplicates of parameters
  - tty: n_gsm: fix tty registration before control channel open
  - USB: gadget: core: adjust uevent timing on gadget unbind
  - ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs
  - ring-buffer: Fix writing to the buffer with max_data_size
  - ring-buffer: Have saved event hold the entire event
  - tracing: Update snapshot buffer on resize if it is allocated
  - ring-buffer: Fix memory leak of free page
  - team: Fix use-after-free when an option instance allocation fails
  - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify
  - soundwire: stream: fix NULL pointer dereference for multi_link
  - HID: hid-asus: add const to read-only outgoing usb buffer
  - net: usb: qmi_wwan: claim interface 4 for ZTE MF290
  - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation
  - HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad
  - HID: hid-asus: reset the backlight brightness level on resume
  - HID: add ALWAYS_POLL quirk for Apple kb
  - HID: glorious: fix Glorious Model I HID report
  - platform/x86: intel_telemetry: Fix kernel doc descriptions
  - bcache: avoid NULL checking to c->root in run_cache_set()
  - bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc()
  - bcache: remove redundant assignment to variable cur_idx
  - bcache: avoid oversize memory allocation by small stripe_size
  - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!"
  - usb: aqc111: check packet for fixup for true limit
  - drm/mediatek: Add spinlock for setting vblank event in atomic_begin
  - Revert "PCI: acpiphp: Reassign resources on bridge if necessary"
  - ALSA: hda/realtek: Apply mute LED quirk for HP15-db
  - ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants
  - fuse: dax: set fc->dax to NULL in fuse_dax_conn_free()
  - net: atlantic: fix double free in ring reinit logic
  - net: stmmac: Handle disabled MDIO busses from devicetree
  - net: stmmac: use dev_err_probe() for reporting mdio bus registration failure
  - vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space()
  - sign-file: Fix incorrect return values check
  - net: ena: Fix XDP redirection error
  - net: ena: Destroy correct number of xdp queues upon failure
  - net: Remove acked SYN flag from packet in the transmit queue correctly
  - qed: Fix a potential use-after-free in qed_cxt_tables_alloc
  - net: fec: correct queue selection
  - net: vlan: introduce skb_vlan_eth_hdr()
  - atm: solos-pci: Fix potential deadlock on &tx_queue_lock
  - atm: solos-pci: Fix potential deadlock on &cli_queue_lock
  - qca_spi: Fix reset behavior
  - qca_debug: Fix ethtool -G iface tx behavior
  - qca_debug: Prevent crash on TX ring changes
  - HID: lenovo: Restrict detection of patched firmware only to USB cptkbd
  - afs: Fix refcount underflow from error handling race
  - netfilter: nf_tables: fix 'exist' matching on bigendian arches
  - !6485  CVE-2024-26843
  - HNS3: Support debugfs dump fastpath info
  - Support configuration of fastpath feature
  - !6247  ubi: Check for too small LEB size in VTBL code
  - amdkfd: use calloc instead of kzalloc to avoid integer overflow
  - packet: annotate data-races around ignore_outgoing
  - !6539 Backport 5.10.204 LTS patches from upstream
  - !6546 v2  CVE-2024-26907
  - Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - net/bnx2x: Prevent access to a freed page in page_pool
  - !6597 v3  Fix CVE-2024-26869
  - !6401  btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
  - !6555 udma: fix bugs in non-share jfr and remove rm mode
  - !6568  IB/hfi1: Fix a memleak in init_credit_return
  - !6579  media: rc: bpf attach/detach requires write permission
  - !6543  net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  - !6520  firmware: arm_scmi: Fix double free in SMC transport cleanup path
  - !6584  ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  - f2fs: fix to truncate meta inode pages forcely
  - f2fs: invalidate meta pages only for post_read required inode
  - f2fs: fix to invalidate META_MAPPING before DIO write
  - f2fs: invalidate META_MAPPING before IPU/DIO write
  - !6566  nfc: nci: free rx_data_reassembly skb on NCI device cleanup
  - !6588  Add hugetlb MADV_DONTNEED support
  - !6437  dm: call the resume method on internal suspend
  - !6442  scsi: pm80xx: Fix memory leak during rmmod
  - !6474  do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  - hugetlb: don't delete vma_lock in hugetlb MADV_DONTNEED processing
  - madvise: use zap_page_range_single for madvise dontneed
  - mm,madvise,hugetlb: fix unexpected data loss with MADV_DONTNEED on hugetlbfs
  - mm: enable MADV_DONTNEED for hugetlb mappings
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  - media: rc: bpf attach/detach requires write permission
  - !6417  media: pvrusb2: fix uaf in pvr2_context_set_notify
  - !6493  RDMA/srpt: Do not register event handler until srpt device is fully setup
  - IB/hfi1: Fix a memleak in init_credit_return
  - wifi: wfx: fix memory leak when starting AP
  - nfc: nci: free rx_data_reassembly skb on NCI device cleanup
  - !6458  CVE-2024-26813
  - md: fix kmemleak of rdev->serial
  - hns3 udma: modifying the sge address offset in RC Mode.
  - RDMA/mlx5: Fix fortify source warning while accessing Eth segment
  - uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++
  - stddef: Introduce DECLARE_FLEX_ARRAY() helper
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  - hns3 udma: Code clipping related to RM mode.
  - hns3 udma: Modify qpn alloc function when share jfr is disabled.
  - r8169: fix rtl8125b PAUSE frames blasting when suspended
  - devcoredump: Send uevent once devcd is ready
  - devcoredump : Serialize devcd_del work
  - smb: client: fix potential NULL deref in parse_dfs_referrals()
  - cifs: Fix non-availability of dedup breaking generic/304
  - Revert "btrfs: add dmesg output for first mount and last unmount of a filesystem"
  - mmc: block: Be sure to wait while busy in CQE error recovery
  - platform/x86: asus-wmi: Document the dgpu_disable sysfs attribute
  - tools headers UAPI: Sync linux/perf_event.h with the kernel sources
  - platform/x86: asus-wmi: Fix kbd_dock_devid tablet-switch reporting
  - MIPS: Loongson64: Enable DMA noncoherent support
  - MIPS: Loongson64: Reserve vgabios memory on boot
  - KVM: s390/mm: Properly reset no-dat
  - serial: 8250_omap: Add earlycon support for the AM654 UART controller
  - serial: 8250: 8250_omap: Do not start RX DMA on THRI interrupt
  - serial: 8250: 8250_omap: Clear UART_HAS_RHR_IT_DIS bit
  - serial: sc16is7xx: address RX timeout interrupt errata
  - ARM: PL011: Fix DMA support
  - usb: typec: class: fix typec_altmode_put_partner to put plugs
  - Revert "xhci: Loosen RPM as default policy to cover for AMD xHC 1.1"
  - parport: Add support for Brainboxes IX/UC/PX parallel cards
  - usb: gadget: f_hid: fix report descriptor allocation
  - gpiolib: sysfs: Fix error handling on failed export
  - tracing: Stop current tracer when resizing buffer
  - tracing: Set actual size after ring buffer resize
  - ring-buffer: Force absolute timestamp on discard of event
  - misc: mei: client.c: fix problem of return '-EOVERFLOW' in mei_cl_write
  - misc: mei: client.c: return negative error code in mei_cl_write
  - arm64: dts: mediatek: mt8183: Fix unit address for scp reserved memory
  - arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names
  - arm64: dts: mediatek: mt7622: fix memory node warning check
  - packet: Move reference count in packet_sock to atomic_long_t
  - tracing: Fix a possible race when disabling buffered events
  - tracing: Fix incomplete locking when disabling buffered events
  - tracing: Disable snapshot buffer when stopping instance tracers
  - tracing: Always update snapshot buffer size
  - checkstack: fix printed address
  - nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
  - nilfs2: fix missing error check for sb_set_blocksize call
  - ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
  - ALSA: pcm: fix out-of-bounds in snd_pcm_state_names
  - riscv: fix misaligned access handling of C.SWSP and C.SDSP
  - ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt
  - ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init
  - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle()
  - tracing: Fix a warning when allocating buffered events fails
  - ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate
  - hwmon: (acpi_power_meter) Fix 4.29 MW bug
  - RDMA/bnxt_re: Correct module description string
  - RDMA/rtrs-clt: Remove the warnings for req in_use check
  - arm64: dts: rockchip: Expand reg size of vdec node for RK3399
  - tee: optee: Fix supplicant based device enumeration
  - bpf: sockmap, updating the sg structure should also update curr
  - tcp: do not accept ACK of bytes we never sent
  - netfilter: xt_owner: Fix for unsafe access of sk->sk_socket
  - ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit()
  - ionic: Fix dim work handling in split interrupt mode
  - ionic: fix snprintf format length warning
  - net: bnxt: fix a potential use-after-free in bnxt_init_tc
  - i40e: Fix unexpected MFS warning message
  - arcnet: restoring support for multiple Sohard Arcnet cards
  - net: arcnet: com20020 fix error handling
  - mlxbf-bootctl: correctly identify secure boot with development keys
  - hv_netvsc: rndis_filter needs to select NLS
  - octeontx2-pf: Add missing mutex lock in otx2_get_pauseparam
  - ipv6: fix potential NULL deref in fib6_add()
  - of: dynamic: Fix of_reconfig_get_state_change() return value documentation
  - of: Add missing 'Return' section in kerneldoc comments
  - of: Fix kerneldoc output formatting
  - of: base: Fix some formatting issues and provide missing descriptions
  - platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code
  - platform/x86: asus-wmi: Simplify tablet-mode-switch handling
  - platform/x86: asus-wmi: Simplify tablet-mode-switch probing
  - platform/x86: asus-wmi: Add support for ROG X13 tablet mode
  - platform/x86: asus-wmi: Adjust tablet/lidflip handling to use enum
  - asus-wmi: Add dgpu disable method
  - platform/x86: asus-nb-wmi: Add tablet_mode_sw=lid-flip quirk for the TP200s
  - platform/x86: asus-nb-wmi: Allow configuring SW_TABLET_MODE method with a module option
  - platform/x86: asus-wmi: Add support for SW_TABLET_MODE on UX360
  - kconfig: fix memory leak from range properties
  - tg3: Increment tx_dropped in tg3_tso_bug()
  - tg3: Move the [rt]x_dropped counters to tg3_napi
  - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test
  - i2c: designware: Fix corrupted memory seen in the ISR
  - firmware: arm_scmi: Fix double free in SMC transport cleanup path
  - cachefiles: fix memory leak in cachefiles_add_cache()
  - RDMA/hns: Fix DCA's dependence on ib_uverbs
  - RDMA/srpt: Do not register event handler until srpt device is fully setup
  - efi: runtime: Fix potential overflow of soft-reserved region size
  - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  - nvme-fc: do not wait in vain when unloading module
  - vfio/platform: Create persistent IRQ handlers
  - vfio/platform: Disable virqfds on cleanup
  - HNS3: Solve the problem that the tc qdisc configuration in the hardware registration cannot be cleared
  - HNS3: Modify the io process of unic to improve bandwidth
  - HNS3: Do some cleancode job to eliminate warnings
  - HNS3: Change the function name from ubn to ubl
  - HNS3: fix up magic numbers and impertinent judge position
  - scsi: pm80xx: Fix memory leak during rmmod
  - dm: call the resume method on internal suspend
  - media: pvrusb2: fix uaf in pvr2_context_set_notify
  - btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
  - RDMA/hns: Fix incorrect iteration number of DCA umem sg entries
  - RDMA/hns: fix error return in hns_roce_v2_modify_srq()
  - ubi: Check for too small LEB size in VTBL code


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-199.0.0.112
changelog:
  - !7018  fix CVE-2024-26865
  - !7226  x86/fpu: Invalidate FPU state correctly on exec()
  - !7128 Backport 5.10.206 LTS patches from upstream
  - x86/fpu: Invalidate FPU state correctly on exec()
  - !7213 v2  cpufreq/cppc: fix perf_to_khz/khz_to_perf conversion
  - smb3: Replace smb2pdu 1-element arrays with flex-arrays
  - !7204 udma: fix bugs of DCA and record db
  - cpufreq/cppc: fix perf_to_khz/khz_to_perf conversion
  - !6744  cpufreq/cppc: changing highest_perf to nominal_perf in cppc_cpufreq_cpu_init()
  - !7048  nilfs2: prevent kernel bug at submit_bh_wbc()
  - !7174  CVE-2022-48689
  - !6783 [OLK-5.10] fix HEST memory usage is too high
  - !6685 v2  char: imx-rngc: fix clk_disable_unprepare missing in error path
  - !7189  NTB: fix possible name leak in ntb_register_device()
  - hns3 udma: resolve the problem when resources are reclaimed.
  - hns3 udma: fixed a bug when enabling DCA.
  - NTB: fix possible name leak in ntb_register_device()
  - !7177  ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  - !7122 v2  clk: zynq: Prevent null pointer dereference caused by kmalloc failure
  - !7031  Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
  - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  - tcp: TX zerocopy should not sense pfmemalloc status
  - net: skbuff: update comment about pfmemalloc propagating
  - net: introduce __skb_fill_page_desc_noacc
  - tcp: factor out tcp_build_frag()
  - !6972  ksmbd: validate payload size in ipc response
  - !7143  media: usbtv: Remove useless locks in usbtv_video_free()
  - !6809  memcg: fix possible use-after-free in memcg_write_event_control()
  - !7148  scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - !7139  SUNRPC: fix some memleaks in gssx_dec_option_array
  - !7129  SUNRPC: fix a memleak in gss_import_v2_context
  - scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - spi: atmel: Fix PDC transfer setup bug
  - Bluetooth: SMP: Fix crash when receiving new connection when debug is enabled
  - Revert "MIPS: Loongson64: Enable DMA noncoherent support"
  - dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
  - netfilter: nf_tables: skip set commit for deleted/destroyed sets
  - tracing: Fix blocked reader of snapshot buffer
  - ring-buffer: Fix wake ups when buffer_percent is set to 100
  - spi: atmel: Fix CS and initialization bug
  - spi: atmel: Switch to transfer_one transfer method
  - smb: client: fix OOB in SMB2_query_info_init()
  - usb: fotg210-hcd: delete an incorrect bounds test
  - Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE
  - Bluetooth: use inclusive language in SMP
  - Bluetooth: SMP: Convert BT_ERR/BT_DBG to bt_dev_err/bt_dev_dbg
  - ARM: dts: Fix occasional boot hang for am3 usb
  - 9p/net: fix possible memory leak in p9_check_errors()
  - x86/alternatives: Sync core before enabling interrupts
  - lib/vsprintf: Fix %pfwf when current node refcount == 0
  - bus: ti-sysc: Flush posted write only after srst_udelay
  - tracing / synthetic: Disable events after testing in synth_event_gen_test_init()
  - dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp
  - net: ks8851: Fix TX stall caused by TX buffer overrun
  - net: rfkill: gpio: set GPIO direction
  - net: 9p: avoid freeing uninit memory in p9pdu_vreadf
  - Input: soc_button_array - add mapping for airplane mode button
  - Bluetooth: L2CAP: Send reject on command corrupted request
  - Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
  - USB: serial: option: add Quectel RM500Q R13 firmware support
  - USB: serial: option: add Foxconn T99W265 with new baseline
  - USB: serial: option: add Quectel EG912Y module support
  - USB: serial: ftdi_sio: update Actisense PIDs constant names
  - wifi: cfg80211: fix certs build to not depend on file order
  - wifi: cfg80211: Add my certificate
  - iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma()
  - iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
  - scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
  - Input: ipaq-micro-keys - add error handling for devm_kmemdup
  - iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
  - interconnect: Treat xlate() returning NULL node as an error
  - btrfs: do not allow non subvolume root targets for snapshot
  - smb: client: fix NULL deref in asn1_ber_decoder()
  - ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB
  - ALSA: hda/hdmi: Add quirk to force pin connectivity on NUC10
  - pinctrl: at91-pio4: use dedicated lock class for IRQ
  - i2c: aspeed: Handle the coalesced stop conditions with the start conditions.
  - afs: Fix overwriting of result of DNS query
  - keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry
  - net: check dev->gso_max_size in gso_features_check()
  - net: warn if gso_type isn't set for a GSO SKB
  - afs: Fix dynamic root lookup DNS check
  - afs: Fix the dynamic root's d_delete to always delete unused dentries
  - net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
  - net/rose: fix races in rose_kill_by_device()
  - ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
  - net: sched: ife: fix potential use-after-free
  - net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors
  - net/mlx5: Fix fw tracer first block check
  - net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list()
  - Revert "net/mlx5e: fix double free of encap_header"
  - wifi: mac80211: mesh_plink: fix matches_local logic
  - s390/vx: fix save/restore of fpu kernel context
  - reset: Fix crash when freeing non-existent optional resets
  - ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init
  - smb: client: fix OOB in smb2_query_reparse_point()
  - ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE
  - media: usbtv: Remove useless locks in usbtv_video_free()
  - SUNRPC: fix some memleaks in gssx_dec_option_array
  - !7044 v2  nfs: fix UAF in direct writes
  - !7092  Squashfs: check the inode number is not the invalid value of zero
  - SUNRPC: fix a memleak in gss_import_v2_context
  - clk: zynq: Prevent null pointer dereference caused by kmalloc failure
  - !6965 v2  memcg: fix incorrect value of sysctl_memcg_swap_qos_stat
  - !7054  CVE-2024-27024
  - !7047  backport patch for thp deferred list
  - !7080  drm: nv04: Fix out of bounds access
  - !7086  media: ttpci: fix two memleaks in budget_av_attach
  - !7042  CVE-2024-27034
  - !6818  mm: memcg: fix stale protection of reclaim target memcg
  - Squashfs: check the inode number is not the invalid value of zero
  - media: ttpci: fix two memleaks in budget_av_attach
  - !7013  media: edia: dvbdev: fix a use-after-free
  - !6994 v2  net/mlx5e: Prevent deadlock while disabling aRFS
  - drm: nv04: Fix out of bounds access
  - !7039  USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - !6655 [OLK-5.10] mucse rnpm driver fw mailbox maybe failed to communicate with PF for mucse N10/N400 chips
  - !5964 drivers: close default yusur KPU FLEXFLOW-2100P driver support
  - !6954 [OLK-5.10]Fix some bugs of the Mini-IO module
  - !7056  scsi: qla2xxx: Fix command flush on cable pull
  - !7006  wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - !7003  wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
  - !7041  netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  - scsi: qla2xxx: Fix command flush on cable pull
  - net/rds: fix possible cp null dereference
  - net/rds: fix WARNING in rds_conn_connect_if_down
  - nilfs2: prevent kernel bug at submit_bh_wbc()
  - THP: avoid lock when check whether THP is in deferred list
  - mm/mmu_gather: limit free batch count and add schedule point in tlb_batch_pages_flush
  - nfs: fix UAF in direct writes
  - f2fs: compress: fix to cover normal cluster write with cp_rwsem
  - f2fs: reduce stack memory cost by using bitfield in struct f2fs_io_info
  - f2fs: replace congestion_wait() calls with io_schedule_timeout()
  - f2fs: fix to stop filesystem update once CP failed
  - !6990  netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  - !7000  fix CVE-2024-27010
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
  - !6843 v2  scsi: core: Fix unremoved procfs host directory regression
  - !6939  USB: core: Fix deadlock in usb_deauthorize_interface()
  - !6906  drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  - !6977  wireguard: netlink: access device through ctx instead of peer
  - !6956  netfilter: nf_tables: fix memleak in map from abort path
  - !6988  clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - !6914  usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
  - !6855  KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
  - tcp: Clean up kernel listener's reqsk in inet_twsk_purge()
  - media: edia: dvbdev: fix a use-after-free
  - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
  - net/sched: fix kabi change in struct Qdisc
  - net/sched: Fix mirred deadlock on device recursion
  - net/mlx5e: Prevent deadlock while disabling aRFS
  - !6943  speakup: Avoid crash on very long word
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - !6959  mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - !6932  net: enetc: deny offload of tc-based TSN features on VF interfaces
  - !6689  quota: Fix potential NULL pointer dereference
  - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - !6964 v2  CVE-2024-27000
  - wireguard: netlink: access device through ctx instead of peer
  - !6891  ima: fix deadlock when traversing "ima_default_rules".
  - ksmbd: validate payload size in ipc response
  - !6872  pstore: inode: Only d_invalidate() is needed
  - !6882  f2fs: compress: fix to guarantee persisting compressed blocks by CP
  - !6895  tun: limit printing rate when illegal packet received by tun dev
  - !6879  net/smc: Fix possible access to freed memory in link clear
  - !6736  add LTS patches to OLK-5.10
  - memcg: fix incorrect value of sysctl_memcg_swap_qos_stat
  - serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
  - serial: mxs-auart: add spinlock around changing cts state
  - serial: core: Provide port lock wrappers
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - netfilter: nf_tables: fix memleak in map from abort path
  - spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
  - i2c: hisi: Correct the description comment for PIN_MUX METHOD
  - i2c: hisi: Add I2C controller reset and initialization proccess in bus recovery action
  - speakup: Avoid crash on very long word
  - USB: core: Fix deadlock in usb_deauthorize_interface()
  - net: enetc: deny offload of tc-based TSN features on VF interfaces
  - usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
  - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  - tun: limit printing rate when illegal packet received by tun dev
  - ima: fix deadlock when traversing "ima_default_rules".
  - f2fs: compress: fix to guarantee persisting compressed blocks by CP
  - net/smc: Fix possible access to freed memory in link clear
  - pstore: inode: Only d_invalidate() is needed
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - scsi: core: Fix unremoved procfs host directory regression
  - mm: memcg: fix stale protection of reclaim target memcg
  - ACPI: APEI: Skip initialization of GHES_ASSIST structures for Machine Check Architecture
  - memcg: fix possible use-after-free in memcg_write_event_control()
  - cpufreq/cppc: changing highest_perf to nominal_perf in cppc_cpufreq_cpu_init()
  - net: fix kabi in struct ipv6_devconf
  - net: release reference to inet6_dev pointer
  - net: change accept_ra_min_rtr_lft to affect all RA lifetimes
  - net: add sysctl accept_ra_min_rtr_lft
  - genetlink: fix kabi change in struct genl_multicast_group
  - genetlink: Use internal flags for multicast groups
  - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group
  - genetlink: add CAP_NET_ADMIN test for multicast bind
  - quota: Fix potential NULL pointer dereference
  - char: imx-rngc: fix clk_disable_unprepare missing in error path
  - mucse: rnpm fw mailbox maybe failed to communicate with PF
  - drivers: close default yusur KPU FLEXFLOW-2100P driver support


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-200.0.0.113
changelog:
  - !7644  hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - !7705  pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
  - !7749 v2  wifi: iwlwifi: dbg-tlv: ensure NUL termination
  - !7651 fix the SPI driver failed to obtain the GPIO pin
  - !7655 v3  KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
  - !7675  bpf: Guard stack limits against 32bit overflow
  - !7732 HNS3: Fixed a deadlock issue caused by concurrent VF deactivation and PF reset
  - !7722 urma: fix bugs of urma and udma
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination
  - !7686  ext4: fix corruption during on-line resize
  - !7599  irqchip/gic-v3-its: Prevent double free on error
  - !7674  net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
  - HNS3: Fixed a deadlock issue caused by concurrent VF deactivation and PF reset
  - hns3 udma: support user-mode TP connection API
  - urma: upload kernel patch for 20240516_day
  - urma: upload kernel patch for 20240511_mig
  - urma: upload kernel patch for 20240318_happy_birthday
  - urma: upload kernel patch for 20240224_rain
  - urma: upload kernel patch for 20240219_Spring
  - !7579  powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  - !7665 [sync] PR-7586:  powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - !7661 [sync] PR-7590:  drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
  - pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
  - ext4: fix corruption during on-line resize
  - !7574  pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match
  - driver core: Provide device_match_acpi_handle() helper
  - bpf: Guard stack limits against 32bit overflow
  - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
  - !7601  cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  - powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
  - !7588  mm/swapfile: fix infinite loop in get_swap_pages after set memory.swapfile
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
  - !7563 udma: fix a bug of segment
  - !7385  CVE-2024-27002
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - !7577 spi: hisi-kunpeng：backport some bugfixes
  - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  - irqchip/gic-v3-its: Prevent double free on error
  - !7548  btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - mm/swapfile: fix infinite loop in get_swap_pages after set memory.swapfile
  - powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
  - spi: Add verification for the max_frequency provided by the firmware
  - spi: hisi-kunpeng: switch to use modern name
  - spi: hisi-kunpeng: Fix error checking
  - !7520  drm/i915/gt: Reset queue_priority_hint on parking
  - hns3 udma: the SEG registration failure is rectified.
  - !7538 v2  rcu: shorten the critical section that rnp->lock protects in rcu_dump_cpu_stacks
  - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - !5557 [OLK-5.10]Add support for Mont-TSSE
  - !4642 Add support for Hygon family 18h model 5h HD-Audio
  - !4640 Add support for Hygon model 6h L3 PMU
  - !4639 Some fixes for Hygon model 4h~6h processors
  - !4641 Add support for Hygon model 4h QoS
  - !2583 [OLK-5.10] Driver for Zhaoxin AES and SHA algorithm
  - !6801  block: fix discard
  - rcu: shorten the critical section that rnp->lock protects in rcu_dump_cpu_stacks
  - !7515 [sync] PR-7483:  Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - !7356  blk-iocost: Fix an UBSAN shift-out-of-bounds warning
  - !7351  PM / devfreq: Synchronize devfreq_monitor_[start/stop
  - !7361  sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - drm/i915/gt: Reset queue_priority_hint on parking
  - !7484  fix CVE-2024-26661
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - !7402  scsi: lpfc: Fix possible file string name overflow when updating firmware
  - !7404  scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - !7403  scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  - !7400  net/tg3: fix race condition in tg3_reset_task()
  - !7401  nvme-core: check for too small lba shift
  - !7396  drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
  - !7397  drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  - !7398  drm/amd/display: Fix memory leak in dm_sw_fini()
  - !7399  drm/amd/pm: fix a double-free in si_dpm_init
  - drm/amd/display: Fix && vs || typos
  - drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
  - !7476  firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - !7456  netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !6524  Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - !7424  net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - !7346  ppp_async: limit MRU to 64K
  - !5793  um: time-travel: fix time corruption
  - !7315  CVE-2024-26686
  - firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - !7297  powerpc/kasan: Fix addr error caused by page alignment
  - !7229  s390/zcrypt: fix reference counting on zcrypt card objects
  - !7234  SUNRPC: Fix a suspicious RCU usage warning
  - !7235  bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  - !7394 v2  scsi: sr: Do not leak information in ioctl
  - !7308  iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !7420  x86/CPU/AMD: Update the Zenbleed microcode revisions
  - !7426  net: gtp: Fix Use-After-Free in gtp_dellink
  - !7437  x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  - !7368  bugfix from mainline
  - !7416  cpu/SMT: Make SMT control more robust against enumeration failures
  - net: gtp: Fix Use-After-Free in gtp_dellink
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - x86/CPU/AMD: Update the Zenbleed microcode revisions
  - !7414  clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
  - !7218  CVE-2024-27017
  - cpu/SMT: Make SMT control more robust against enumeration failures
  - clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
  - !7223  major bugfix before 2023
  - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  - scsi: lpfc: Fix possible file string name overflow when updating firmware
  - nvme-core: check for too small lba shift
  - net/tg3: fix race condition in tg3_reset_task()
  - drm/amd/pm: fix a double-free in si_dpm_init
  - drm/amd/display: Fix memory leak in dm_sw_fini()
  - drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  - drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
  - scsi: sr: Do not leak information in ioctl
  - !5469  wifi: iwlwifi: fix a memory corruption
  - clk: mediatek: Do a runtime PM get on controllers during probe
  - x86/srso: Fix vulnerability reporting for missing microcode
  - x86/srso: Don't probe microcode in a guest
  - x86/srso: Set CPUID feature bits independently of bug or mitigation status
  - sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - blk-iocost: Fix an UBSAN shift-out-of-bounds warning
  - PM / devfreq: Synchronize devfreq_monitor_[start/stop]
  - ppp_async: limit MRU to 64K
  - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
  - fs/proc: do_task_stat: use __for_each_thread()
  - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand()
  - exit: Use the correct exit_code in /proc/<pid>/stat
  - iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  - powerpc/kasan: Fix addr error caused by page alignment
  - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  - SUNRPC: Fix a suspicious RCU usage warning
  - s390/zcrypt: fix reference counting on zcrypt card objects
  - powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()
  - irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling
  - genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
  - netfilter: nf_tables: missing iterator type in lookup walk
  - netfilter: nft_set_pipapo: walk over current view on netlink dump
  - block: check io size before submit discard
  - block: fix overflow in blk_ioctl_discard()
  - Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - um: time-travel: fix time corruption
  - add support for Mont-TSSE Driver
  - wifi: iwlwifi: fix a memory corruption
  - EDAC/amd64: Adjust UMC channel for Hygon family 18h model 6h
  - x86/amd_nb: Get DF ID from F5 device for Hygon family 18h model 6h
  - EDAC/amd64: Fix intlv_num_chan for Hygon family 18h model 4h
  - EDAC/amd64: Revert hi_addr_offset for Hygon family 18h model 4h
  - ALSA: hda: Fix single byte write failure issue for Hygon
  - ALSA: hda: Add Hygon HD-Audio support
  - x86/resctrl: Add Hygon QoS support
  - perf/x86/uncore: Add L3 PMU support for Hygon family 18h model 6h
  - configs: Add Zhaoxin aes/sha items in openeuler_config
  - Zhaoxin: Driver for Zhaoxin SHA algorithm
  - Zhaoxin: Driver for Zhaoxin AES algorithm


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-201.0.0.114
changelog:
  - !7870  CVE-2024-35995
  - !7810  net-memcg: Fix scope of sockmem pressure indicators
  - !8159 v3  iommu: Reserve kabi for iommu and memory related functions
  - !7207 cgroup1_writeback:bind blkcg and memcg
  - !8067 irqchip: gic: some bugfix of hip09
  - iommu: Reserve kabi for iommu and memory related functions
  - !8057 v8  arm64: Allow CPU0 to be nohz_full
  - !7744 v3  Port livepatch related patches
  - !8042  xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  - !8060  soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  - !8023  fs/ntfs3: Fixed overflow check in mi_enum_attr()
  - !7947 【OLK-5.10】Fix BUILD REGRESSION warnings in bzwx N5/N6 series NIC drivers
  - !7413 Backport Intel VT-d critical fix to olk-5.10
  - !7985  cvm_tsi: add cvm tsi interface
  - !7395  smart_grid: introducing rebuild_affinity_domain
  - !7993  HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  - !8008 【OLK-5.10】backport PCC patches to support shared interrupt for multiple subspaces and platform notification handling
  - !7886  drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
  - !5483 [OLK-5.10] Add support for Mucse Virtual Function Network Adapter(N10/N400)
  - !7980  Fix CVE-2021-47455
  - !8019  pstore/zone: Add a null pointer check to the psz_kmsg_read
  - !7912 RDMA/hns: Some bugfixes for openeuler 22.03 sp4
  - !7693  Bluetooth: af_bluetooth: Fix deadlock
  - !8029  mm: introduce vm_swap_extension sysctl
  - !8039 v2  dynamic_hugetlb: backport some bugfix
  - !7813  kobject: Fix global-out-of-bounds in kobject_action_type()
  - !7940  fix crypto_queue backlog handling
  - !3736 Add nokaslr memory region avoid support
  - !8030  netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  - irqchip/gic-v4.1:Check whether indirect table is supported in allocate_vpe_l1_table
  - irqchip: gicv3: Add workaround for hip09 erratum 162200806
  - irqchip: gicv3: Add workaround for hip09 erratum 162200803
  - soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  - arm64: defconfig: Enable CONFIG_ARCH_SUSPEND_NONZERO_CPU and CONFIG_ARCH_SUSPEND_NONZERO_CPU
  - arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default
  - isolation: Check whether there exists a housekeeping CPU online
  - isolation: Do not check whether housekeeping CPUs are present
  - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  - mm/dynamic_hugetlb: refine error info in the destruction
  - mm/dynamic_hugetlb: make free_huge_page_to_dhugetlb_pool irq safe
  - mm/dynamic_hugetlb: check NULL pointer for early parameter
  - mm/dynamic_hugetlb: add lru_add_drain_all() before migration
  - mm/dynamic_hugetlb: add cond_resched() in hpool_merge_page()
  - mm/dynamic_hugetlb: reduce the number of migration attempts
  - mm/dpool: Use helper function to lock/unlock
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  - openeuler_defconfig: enable swap_extension for x86 and arm64
  - mm/vmscan: introduce vm_swap_extension sysctl
  - fs/ntfs3: Fixed overflow check in mi_enum_attr()
  - pstore/zone: Add a null pointer check to the psz_kmsg_read
  - drivers: initial support for rnpvf drivers from Mucse Technology
  - !7961  net: atlantic: eliminate double free in error handling logic
  - !7970  fbmon: prevent division by zero in fb_videomode_from_videomode()
  - mailbox: pcc: Support shared interrupt for multiple subspaces
  - mailbox: pcc: Add support for platform notification handling
  - mailbox: pcc: Use mbox_bind_client
  - !7903  virtio_ring : keep used_wrap_counter in
  - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  - mailbox: omap: Use mbox_bind_client
  - mailbox: Allow direct registration to a channel
  - mailbox: pcc: Fix kernel doc warnings
  - !7983 v2  Enhance memcg KSM feature.
  - !7960  ipv6: Fix infinite recursion in fib6_dump_done().
  - !7934  fix CVE-2024-35839
  - cvm_tsi: add cvm tsi interface
  - !5118  [OLK-5.10] Add support for Mucse Network Adapter(N500/N210)
  - !7452 v2  ip: Treat IPv4 segment's lowest address as unicast
  - !7801  netfilter: nft_flow_offload: reset dst in route object after setting up flow
  - !7758  netfilter: nf_tables: discard table flag update with pending basechain deletion
  - !7959 v2  Add network relationship for NUMA isolation and consolidation
  - mm/memcontrol: enable KSM for tasks moving to new memcg
  - mm/memcontrol: add ksm state for memcg
  - mm/ksm: fix ksm exec support for prctl
  - mm/ksm: support fork/exec for prctl
  - !7224 [OLK-5.10] Fixed display error for ps23xx when using ast and pe2201 bmc card
  - ptp: fix code indentation issues
  - ptp: Fix possible memory leak in ptp_clock_register()
  - !7949  drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
  - fbmon: prevent division by zero in fb_videomode_from_videomode()
  - !7943 v2  netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  - !7955 v3  sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED
  - net: atlantic: eliminate double free in error handling logic
  - ipv6: Fix infinite recursion in fib6_dump_done().
  - drivers: initial support for rnpgbe drivers from Mucse Technology
  - config: Add new config entry to default config file to fix CI warning
  - net: add some bpf hooks in tcp stack for network numa relationship
  - net: add one bpf prog type for network numa relationship
  - net: retrieve netns cookie via getsocketopt
  - net: fix kabi breakage in struct net
  - net: initialize net->net_cookie at netns setup
  - !5484 [OLK-5.10] Add support for Mucse Virtual Function Network Adapter(N500/N210)
  - sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED
  - Revert "sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED"
  - drivers: Fix BUILD REGRESSION warning in bzwx N5/N6 series NIC drivers
  - !6106  SCSI: hisi_raid: add sg_raw command feature
  - drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
  - !7923  Fix allmodconfig build error
  - !7645  ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
  - netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  - crypto: engine - fix crypto_queue backlog handling
  - !7916 v5  Introduce NUMA isolation and consolidation
  - netfilter: bridge: replace physindev with physinif in nf_bridge_info
  - netfilter: propagate net to nf_bridge_get_physindev
  - netfilter: nfnetlink_log: use proper helper for fetching physinif
  - !7911  ACPI: LPIT: Avoid u32 multiplication overflow
  - net/ethernet/huawei/hiroce3: Fix allmodconfig build error
  - !7865  netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
  - RDMA/hns: Fix allocating POE channels after IB device registeration
  - RDMA/hns : Fix scc delay_work to execute after sysfs shutdown
  - RDMA/hns: Fix missing resetting notify
  - RDMA/hns: Use mutex to protect uconctext
  - config: Enable NUMA isolation and consolidation by default
  - sched: Introduce CONFIG_QOS_SCHED_NUMA_ICON
  - bpf:programmable: Add helper to set preferred node
  - sched: Update numa group preferred node periodically
  - sched: Add ioctl to get relationship
  - bpf:programmable: Add helper to get memory and net relationship
  - sched: Introduce task relationship by net and memory
  - bpf:programmable: Add nodemask operation collection
  - sched: Some fixes for select_rq hook
  - sched: Add can_migrate_task hook
  - sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE
  - ACPI: LPIT: Avoid u32 multiplication overflow
  - !7877 v4  eeprom: at24: fix memory corruption race condition
  - !7741  ipv4: check for NULL idev in ip_route_use_hint()
  - !7731  sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED
  - !7689 [sync] PR-7370: v2  sched: smart_grid: silence complier error
  - virtio_ring : keep used_wrap_counter in vq->last_used_idx
  - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
  - eeprom: at24: fix memory corruption race condition
  - !7733 backport some bugfix of HiSilicon PCIe PMU driver
  - !7691 net: hns3: backport some bugfixes
  - !7853  net/mlx5e: fix a double-free in arfs_create_groups
  - ACPI: CPPC: Fix access width used for PCC registers
  - ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
  - ACPI: CPPC: Use access_width over bit_width for system memory accesses
  - ACPI: CPPC: Fix up I/O port access in cpc_read()
  - ACPI: CPPC: Implement support for SystemIO registers
  - !5545 backport dirty-ring feature
  - netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
  - !7846  netrom: Fix a data-race around sysctl_netrom_transport_timeout
  - !7773  Fix CVE-2023-52698
  - net/mlx5e: fix a double-free in arfs_create_groups
  - net: hns3: use appropriate barrier function after setting a bit value
  - net: hns3: release PTP resources if pf initialization failed
  - !7841  cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter()
  - !7062 [openEuler-22.03-SP4]drivers: support Yunsilicon's metaScale/metaVisor series NICs
  - !6300 【OLK-5.10】fix compiling problem in bzwx N5/N6 series NIC drivers
  - netrom: Fix a data-race around sysctl_netrom_transport_timeout
  - !7816  f2fs: fix to wait on block writeback for post_read case
  - !7576  f2fs: compress: fix reserve_cblocks counting error when out of space
  - !7757  Fix CVE-2023-52656
  - cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter()
  - !7681  xfs: three bug fix recently
  - !7779  LoongArch: Define the __io_aw() hook as mmiowb()
  - !7714  CVE-2024-35936
  - drivers: fix compiling problem in bzwx N5/N6 series NIC drivers
  - drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
  - drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
  - drivers/perf: hisi_pcie: Merge find_related_event() and get_event_idx()
  - drivers/perf: hisi_pcie: Relax the check on related events
  - drivers/perf: hisi_pcie: Check the target filter properly
  - drivers/perf: hisi_pcie: Add more events for counting TLP bandwidth
  - drivers/perf: hisi_pcie: Fix incorrect counting under metric mode
  - drivers/perf: hisi_pcie: Introduce hisi_pcie_pmu_get_event_ctrl_val()
  - drivers/perf: hisi_pcie: Rename hisi_pcie_pmu_{config,clear}_filter()
  - !7684  dm snapshot: fix lockup in dm_exception_table_exit
  - iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
  - PCI: Make pci_dev_is_disconnected() helper public for other drivers
  - f2fs: fix to wait on block writeback for post_read case
  - kobject: Fix global-out-of-bounds in kobject_action_type()
  - net-memcg: Fix scope of sockmem pressure indicators
  - netfilter: nft_flow_offload: reset dst in route object after setting up flow
  - !7743  netrom: Fix data-races around sysctl_net_busy_read
  - !7734  mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
  - LoongArch: Define the __io_aw() hook as mmiowb()
  - calipso: fix memory leak in netlbl_calipso_add_pass()
  - netlabel: remove unused parameter in netlbl_netlink_auditinfo()
  - net: netlabel: Fix kerneldoc warnings
  - !7753  wifi: ath11k: decrease MHI channel buffer length to 8KB
  - netfilter: nf_tables: discard table flag update with pending basechain deletion
  - io_uring: drop any code related to SCM_RIGHTS
  - io_uring/unix: drop usage of io_uring socket
  - wifi: ath11k: decrease MHI channel buffer length to 8KB
  - livepatch: Update related configs in openeuler_defconfig
  - arm64: Recover kretprobe modified return address in stacktrace
  - x86/unwind: Compile kretprobe fixup code only if CONFIG_KRETPROBES=y
  - x86/unwind: Recover kretprobe trampoline entry
  - kprobes: Add kretprobe_find_ret_addr() for searching return address
  - livepatch: Avoid patching conflicts with kprobes
  - kprobes: Fix possible use-after-free issue on kprobe registration
  - ftrace: Fix possible use-after-free issue in ftrace_location()
  - livepatch: Reduce duplicate definition of 'struct walk_stackframe_args'
  - livepatch: Fix warning C_RULE_ID_SINGLE_BRANCH_IF_AND_LOOP_BRACKET
  - livepatch/core: Make several functions to be static
  - livepatch: Use func->func_node directly
  - livepatch: Fix huge_depth in arch_klp_check_activeness_func()
  - livepatch: Organize active functions with struct 'list_head'
  - livepatch: Check calltrace of idle tasks
  - livepatch: Complete check calltrace for running tasks
  - livepatch/core: No stop machine in KLP_STACK_OPTIMIZE mode
  - livepatch/ppc64: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode
  - livepatch/ppc32: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode
  - livepatch/arm64: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode
  - livepatch/arm: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode
  - livepatch/x86: Ajust instruction replace order for KLP_STACK_OPTIMIZE mode
  - livepatch/ppc64: Implement arch_klp_check_task_calltrace()
  - livepatch/ppc32: Implement arch_klp_check_task_calltrace()
  - livepatch/arm64: Implement arch_klp_check_task_calltrace()
  - livepatch/arm: Implement arch_klp_check_task_calltrace()
  - livepatch/x86: Implement arch_klp_check_task_calltrace()
  - livepatch/ppc64: Remove duplicate 'struct klp_func_list' related codes
  - livepatch/ppc32: Remove duplicate 'struct klp_func_list' related codes
  - livepatch/arm64: Remove duplicate 'struct klp_func_list' related codes
  - livepatch/arm: Remove duplicate 'struct klp_func_list' related codes
  - livepatch/x86: Move 'struct klp_func_list' related codes out of arch
  - livepatch: Move 'struct klp_func_list' out of arch
  - netrom: Fix data-races around sysctl_net_busy_read
  - ipv4: check for NULL idev in ip_route_use_hint()
  - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
  - sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED
  - net: hns3: change type of numa_node_mask as nodemask_t
  - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
  - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
  - net: hns3: direct return when receive a unknown mailbox message
  - net: hns3: using user configure after hardware reset
  - net: hns3: fix kernel crash problem in concurrent scenario
  - Bluetooth: af_bluetooth: Fix deadlock
  - net: hns3: add cond_resched() to hns3 ring buffer init process
  - net: hns3: move constants from hclge_debugfs.h to hclge_debugfs.c
  - net: hns3: add 
  - net: hns3: don't need to check an unsigned number is less than 0
  - net: hns3: set irq affinity directly
  - net: hns3: using cpumask_copy when set value to cpumask_t
  - net: hns3: mark unexcuted loopback test result as UNEXECUTED
  - net: hns3: fix index limit to support all queue stats
  - sched: smart_grid: silence complier error
  - dm snapshot: fix lockup in dm_exception_table_exit
  - xfs: update dir3 leaf block metadata after swap
  - xfs: ensure logflagsp is initialized in xfs_bmap_del_extent_real
  - iomap: fix warning in xfs_iomap_write_delalloc_release()
  - KVM: selftests: Add dirty ring buffer test
  - KVM: selftests: Introduce after_vcpu_run hook for dirty log test
  - KVM: Don't allocate dirty bitmap if dirty ring is enabled
  - KVM: Make dirty ring exclusive to dirty bitmap log
  - KVM: X86: Implement ring-based dirty memory tracking
  - KVM: Pass in kvm pointer into mark_page_dirty_in_slot()
  - KVM: X86: Don't track dirty for KVM_SET_[TSS_ADDR|IDENTITY_MAP_ADDR]
  - ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
  - f2fs: compress: fix reserve_cblocks counting error when out of space
  - drm/ast: Fixed display error for ps23xx when using ast bmc card
  - drm/phytium: Bugfix Xorg startup for ps23xx when using pe2201 bmc card
  - ip: Treat IPv4 segment's lowest address as unicast
  - smart_grid: introducing rebuild_affinity_domain
  - cgroup_writeback: bind blkcg and memcg
  - drivers: support Yunsilicon's MS and MV series NICs
  - SCSI: hisi_raid: add sg_raw command feature
  - drivers: initial support for rnpgbevf drivers from Mucse Technology
  - kaslr: enable CONFIG_NOKASLR_MEM_RANGE in openeuler_defconfig
  - x86/boot: add x86 nokaslr memory regions
  - efi/libstub: add arm64 nokaslr memory regions
  - kaslr: add nokaslr memory region Kconfig support

   at the end when print msg


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-202.0.0.115
changelog:
  - !8425  CVE-2023-52677
  - !8519  mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq
  - !8545 v2  arm64 mpam fix patch
  - !8468 v2  CVE-2024-35808
  - !8046  block: prevent division by zero in blk_rq_stat_sum()
  - !8605  smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  - !7670  btrfs: send: handle path ref underflow in header iterate_inode_ref()
  - !8513  net: ena: Fix incorrect descriptor free behavior
  - !8535 v4  Fix soft lockup in stress test
  - !8561  mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
  - !8497  Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
  - smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  - !7803 v2  selinux: avoid dereference of garbage after mount failure
  - !6393  crypto: xilinx - call finalize with bh disabled
  - !8539 v2  iommu/arm-smmu-v3: Reducing the CMD_SYNC times
  - !8504  CVE: CVE-2024-36015
  - !8261  tty: fix hang on tty device with no_room set
  - !8110  drm/client: Fully protect modes[
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
  - !8472  fix CVE-2024-27415
  - !8527 v8  Add support for l0
  - !8395  5.10: fix CVE-2024-35978
  - !8541 v2  iommu/iova: move depot up to avoid cache conflict
  - !8407  pinctrl: core: delete incorrect free in pinctrl_enable()
  - !8240 v2  dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
  - arm64/mpam: Fix softlockup when reading mondata
  - arm64/mpam: Fix wrong seconds to jiffies conversion
  - arm64/mpam: change allocation mode from GFP_KERNEL to GFP_NOWAIT
  - mpam/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup
  - mpam/resctrl: Clean up resctrl_group_rmdir_[ctrl/mon]()
  - mpam/resctrl: Clean up unused function parameter in mkdir path
  - mpam/resctrl: Fix a deadlock due to inaccurate reference
  - iommu/iova: move depot up to avoid cache conflict
  - iommu/arm-smmu-v3: Reducing the CMD_SYNC times
  - iommu/iova: Try to schedule out when free iova too long
  - iommu/iova: free iovas on each cpu in flush queue
  - arm64: config: Enable hisi l3t & l0 by default
  - hisi: l0: Add support for l0
  - hisi: l3t: Add L3 cache driver for hisi
  - mm/mempolicy: Add and export get_vma_policy_node
  - arm64: export cpu_logical_map
  - export symbol alloc_contig_pages
  - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq
  - net: ena: Fix incorrect descriptor free behavior
  - ppdev: Add an error check in register_device
  - ppdev: Remove usage of the deprecated ida_simple_xx() API
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
  - !8397  mm/hugetlb: fix missing hugetlb_lock for resv uncharge
  - !8373  dma-direct: Leak pages on dma_set_decrypted() failure
  - !8428  drm/amdgpu: Fix even more out of bound writes from debugfs
  - !8339  soc: qcom: llcc: Handle a second device without data corruption
  - !8368  efi/capsule-loader: fix incorrect allocation size
  - netfilter: br_netfilter: skip conntrack input hook for promisc packets
  - netfilter: bridge: confirm multicast packets before passing them up the stack
  - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen
  - md/dm-raid: don't call md_reap_sync_thread() directly
  - !8454 v3  net: Bacport hulk patches
  - !8069  CVE-2021-47427
  - !8299  xfs: Fix file creation failure
  - !8426 Backport 5.10.209 LTS patches from upstream
  - !8416  iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
  - net: xfrm: skip policies marked as dead while reinserting policies
  - tcp_comp: modify default value of TCP_COMP to n
  - bpf: socketmap: add Kconfig for customized socketmap
  - bpf: fix magic numbers in bpf_get_sockops_uid_gid()
  - netfilter: make return-type and function-name in the same line
  - bpf: fix type incompatible warning
  - bpf: fix format type mismatch warning
  - !8342  net/mlx5: Properly link new fs rules into the tree
  - drm/amdgpu: Fix even more out of bound writes from debugfs
  - arm64: dts: armada-3720-turris-mox: set irq type for RTC
  - i2c: s3c24xx: fix transferring more than one message in polling mode
  - i2c: s3c24xx: fix read transfers in polling mode
  - selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes
  - selftests: mlxsw: qos_pfc: Convert to iproute2 dcb
  - ethtool: netlink: Add missing ethnl_ops_begin/complete
  - kdb: Fix a potential buffer overflow in kdb_local()
  - ipvs: avoid stat macros calls from preemptible context
  - netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description
  - netfilter: nf_tables: skip dead set elements in netlink dump
  - netfilter: nf_tables: do not allow mismatch field size and set key length
  - net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe
  - net: ravb: Fix dma_addr_t truncation in error case
  - net: phy: micrel: populate .soft_reset for KSZ9131
  - net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames
  - s390/pci: fix max size calculation in zpci_memcpy_toio()
  - PCI: keystone: Fix race condition when initializing PHYs
  - serial: imx: Correct clock error message in function probe()
  - perf env: Avoid recursively taking env->bpf_progs.lock
  - nvmet-tcp: fix a crash in nvmet_req_complete()
  - usb: cdc-acm: return correct error code on unsupported break
  - tty: use 'if' in send_break() instead of 'goto'
  - tty: don't check for signal_pending() in send_break()
  - tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK
  - tty: change tty_write_lock()'s ndelay parameter to bool
  - perf genelf: Set ELF program header addresses properly
  - iio: adc: ad9467: fix scale setting
  - iio: adc: ad9467: don't ignore error codes
  - iio: adc: ad9467: fix reset gpio handling
  - iio: adc: ad9467: Benefit from devm_clk_get_enabled() to simplify
  - software node: Let args be NULL in software_node_get_reference_args
  - acpi: property: Let args be NULL in __acpi_node_get_property_reference
  - libapi: Add missing linux/types.h header to get the __u64 type on io.h
  - power: supply: cw2015: correct time_to_empty units in sysfs
  - MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()
  - MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()
  - mips: Fix incorrect max_low_pfn adjustment
  - mips: dmi: Fix early remap on MIPS32
  - leds: aw2013: Select missing dependency REGMAP_I2C
  - HID: wacom: Correct behavior when processing some confidence == false touches
  - iio: adc: ad7091r: Pass iio_dev to event handler
  - x86/kvm: Do not try to disable kvmclock if it was not enabled
  - wifi: mwifiex: configure BSSID consistently when starting AP
  - wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
  - wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
  - iommu/arm-smmu-qcom: Add missing GMU entry to match table
  - io_uring/rw: ensure io->bytes_done is always initialized
  - pwm: jz4740: Don't use dev_err_probe() in .request()
  - fbdev: flush deferred work in fb_deferred_io_fsync()
  - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx
  - ALSA: oxygen: Fix right channel of capture volume mixer
  - serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock
  - usb: mon: Fix atomicity violation in mon_bin_vma_fault
  - usb: typec: class: fix typec_altmode_put_partner to put plugs
  - Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
  - usb: chipidea: wait controller resume finished for wakeup irq
  - Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only"
  - Revert "usb: dwc3: Soft reset phy on probe for host"
  - usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
  - usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()
  - tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
  - net: ethernet: mtk_eth_soc: remove duplicate if statements
  - kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
  - Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek"
  - virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session()
  - virtio-crypto: fix memory-leak
  - dma-mapping: Fix build error unused-value
  - Input: atkbd - use ab83 as id when skipping the getid command
  - binder: fix unused alloc->free_async_space
  - binder: fix async space check for 0-sized buffers
  - keys, dns: Fix size check of V1 server-list header
  - of: unittest: Fix of_count_phandle_with_args() expected value message
  - of: Fix double free in of_parse_phandle_with_args_map
  - IB/iser: Prevent invalidating wrong MR
  - mmc: sdhci_omap: Fix TI SoC dependencies
  - mmc: sdhci_am654: Fix TI SoC dependencies
  - pwm: stm32: Fix enable count for clk in .probe()
  - pwm: stm32: Use hweight32 in stm32_pwm_detect_channels
  - pwm: stm32: Use regmap_clear_bits and regmap_set_bits where applicable
  - clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw
  - clk: fixed-rate: add devm_clk_hw_register_fixed_rate
  - clk: si5341: fix an error code problem in si5341_output_clk_set_rate
  - watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused
  - watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
  - watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
  - watchdog: set cdev owner before adding
  - drivers: clk: zynqmp: update divider round rate logic
  - clk: zynqmp: Add a check for NULL pointer
  - clk: zynqmp: make bestdiv unsigned
  - drivers: clk: zynqmp: calculate closest mux rate
  - clk: qcom: videocc-sm8150: Add missing PLL config property
  - clk: qcom: videocc-sm8150: Update the videocc resets
  - dt-bindings: clock: Update the videocc resets for sm8150
  - gpu/drm/radeon: fix two memleaks in radeon_vm_init
  - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
  - media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe()
  - media: dvbdev: drop refcount on error path in dvb_device_open()
  - f2fs: fix to update iostat correctly in f2fs_filemap_fault()
  - f2fs: fix to check compress file in f2fs_move_file_range()
  - media: rkisp1: Disable runtime PM in probe error path
  - clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config
  - media: cx231xx: fix a memleak in cx231xx_init_isoc
  - drm/bridge: tc358767: Fix return value on error case
  - drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
  - drm/radeon/dpm: fix a memleak in sumo_parse_power_table
  - drm/drv: propagate errors from drm_modeset_register_all()
  - drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
  - drm/msm/mdp4: flush vblank event on disable
  - ASoC: cs35l34: Fix GPIO name and drop legacy include
  - ASoC: cs35l33: Fix GPIO name and drop legacy include
  - drm/radeon: check return value of radeon_ring_lock()
  - drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
  - drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
  - drm/bridge: Fix typo in post_disable() description
  - drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer
  - rcu: Create an unrcu_pointer() to remove __rcu from a pointer
  - drm/panel-elida-kd35t133: hold panel in reset for unprepare
  - RDMA/usnic: Silence uninitialized symbol smatch warnings
  - ARM: davinci: always select CONFIG_CPU_ARM926T
  - Bluetooth: btmtkuart: fix recv_buf() return value
  - Bluetooth: Fix bogus check for re-auth no supported with non-ssp
  - netfilter: nf_tables: mark newset as dead on transaction abort
  - wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
  - wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
  - wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
  - rtlwifi: rtl8192de: make arrays static const, makes object smaller
  - wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
  - wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
  - wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
  - wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
  - wifi: rtlwifi: add calculate_bit_shift()
  - dma-mapping: clear dev->dma_mem to NULL after freeing it
  - dma-mapping: Add dma_release_coherent_memory to DMA API
  - virtio/vsock: fix logic which reduces credit update messages
  - selftests/net: fix grep checking for fib_nexthop_multiprefix
  - arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
  - arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator
  - scsi: fnic: Return error if vmalloc() failed
  - arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type
  - wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
  - firmware: meson_sm: populate platform devices from sm device tree data
  - firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
  - net/ncsi: Fix netlink major/minor version numbers
  - ncsi: internal.h: Fix a spello
  - ARM: dts: qcom: apq8064: correct XOADC register address
  - wifi: libertas: stop selecting wext
  - wifi: ath11k: Defer on rproc_get failure
  - bpf: Add crosstask check to __bpf_get_stack
  - bpf, lpm: Fix check prefixlen before walking trie
  - wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
  - NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
  - blocklayoutdriver: Fix reference leak of pnfs_device_node
  - crypto: scomp - fix req->dst buffer overflow
  - crypto: sahara - do not resize req->src when doing hash operations
  - crypto: sahara - fix processing hash requests with req->nbytes < sg->length
  - crypto: sahara - improve error handling in sahara_sha_process()
  - crypto: sahara - fix wait_for_completion_timeout() error handling
  - crypto: sahara - fix ahash reqsize
  - crypto: sahara - handle zero-length aes requests
  - crypto: sahara - avoid skcipher fallback code duplication
  - gfs2: Also reflect single-block allocations in rgd->rd_extfail_pt
  - Revert "gfs2: Don't reject a supposedly full bitmap if we have blocks reserved"
  - fs: indicate request originates from old mount API
  - crypto: sahara - fix error handling in sahara_hw_descriptor_create()
  - crypto: sahara - fix processing requests with cryptlen < sg->length
  - crypto: sahara - fix ahash selftest failure
  - crypto: sahara - fix cbc selftest failure
  - crypto: sahara - remove FLAGS_NEW_KEY logic
  - crypto: af_alg - Disallow multiple in-flight AIO requests
  - crypto: ccp - fix memleak in ccp_init_dm_workarea
  - crypto: sa2ul - Return crypto_aead_setkey to transfer the error
  - crypto: virtio - Handle dataq logic with tasklet
  - virtio-crypto: wait ctrl queue instead of busy polling
  - virtio-crypto: use private buffer for control request
  - virtio-crypto: change code style
  - virtio-crypto: implement RSA algorithm
  - virtio-crypto: introduce akcipher service
  - virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC
  - selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
  - ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error
  - spi: sh-msiof: Enforce fixed DTDL for R-Car H3
  - cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()
  - cpufreq: Use of_property_present() for testing DT property presence
  - of: Add of_property_present() helper
  - of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
  - ACPI: video: check for error while searching for backlight device parent
  - mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response
  - spi: spi-zynqmp-gqspi: fix driver kconfig dependencies
  - powerpc/powernv: Add a null pointer check in opal_powercap_init()
  - powerpc/powernv: Add a null pointer check in opal_event_init()
  - selftests/powerpc: Fix error handling in FPU/VMX preemption tests
  - powerpc/44x: select I2C for CURRITUCK
  - powerpc: Remove in_kernel_text()
  - powerpc: add crtsavres.o to always-y instead of extra-y
  - x86/lib: Fix overflow when counting digits
  - coresight: etm4x: Fix width of CCITMIN field
  - PCI: Add ACS quirk for more Zhaoxin Root Ports
  - parport: parport_serial: Add Brainboxes device IDs and geometry
  - parport: parport_serial: Add Brainboxes BAR details
  - binder: fix comment on binder_alloc_new_buf() return value
  - binder: fix trivial typo of binder_free_buf_locked()
  - binder: use EPOLLERR from eventpoll.h
  - ACPI: resource: Add another DMI match for the TongFang GMxXGxx
  - drm/crtc: fix uninitialized variable use
  - ARM: sun9i: smp: fix return code check of of_property_match_string
  - net: qrtr: ns: Return 0 if server port is not present
  - i2c: rk3x: fix potential spinlock recursion on poll
  - Input: xpad - add Razer Wolverine V2 support
  - ARC: fix spare error
  - s390/scm: fix virtual vs physical address confusion
  - Input: i8042 - add nomux quirk for Acer P459-G2-M
  - Input: atkbd - skip ATKBD_CMD_GETID in translated mode
  - reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
  - ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI
  - tracing: Add size check when printing trace_marker output
  - tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
  - neighbour: Don't let neigh_forced_gc() disable preemption for long
  - drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
  - jbd2: correct the printing of write_flags in jbd2_write_superblock()
  - clk: rockchip: rk3128: Fix HCLK_OTG gate register
  - drm/exynos: fix a wrong error checking
  - drm/exynos: fix a potential error pointer dereference
  - nvme: introduce helper function to get ctrl state
  - ASoC: da7219: Support low DC impedance headset
  - nouveau/tu102: flush all pdbs on vmm flush
  - ASoC: rt5650: add mutex to avoid the jack detection failure
  - ASoC: cs43130: Fix incorrect frame delay configuration
  - ASoC: cs43130: Fix the position of const qualifier
  - ASoC: Intel: Skylake: mem leak in skl register function
  - ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16
  - ASoC: Intel: Skylake: Fix mem leak in few functions
  - ASoC: wm8974: Correct boost mixer inputs
  - debugfs: fix automount d_fsdata usage
  - mptcp: fix uninit-value in mptcp_incoming_options
  - ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
  - pinctrl: lochnagar: Don't build on MIPS
  - riscv: Check if the code to patch lies in the exit section
  - !8221 Backport 5.10.207- 5.10.208 LTS patches from upstream
  - !8140  i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  - iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
  - pinctrl: core: delete incorrect free in pinctrl_enable()
  - !7471  x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
  - !8367  cvm: clean code for cvm init
  - mm/hugetlb: fix missing hugetlb_lock for resv uncharge
  - Bluetooth: Fix memory leak in hci_req_sync_complete()
  - !8300  ipvlan: add ipvlan_route_v6_outbound() helper
  - !8271  netfilter: nf_tables: reject new basechain after table flag update
  - !8212  fix CVE-2024-35877
  - dma-direct: Leak pages on dma_set_decrypted() failure
  - !8306  mptcp: ensure tx skbs always have the MPTCP ext
  - efi/capsule-loader: fix incorrect allocation size
  - cvm: clean code for cvm init
  - !8195  CVE-2024-35956
  - !8153  cpu/hotplug: Don't offline the last non-isolated CPU
  - net/mlx5: Properly link new fs rules into the tree
  - soc: qcom: llcc: Handle a second device without data corruption
  - !8254  sysv: don't call sb_bread() with pointers_lock held
  - !8275  usb: udc: remove warning when queue disabled ep
  - !8263 [sync] PR-8228:  ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  - !8243 【OLK 5.10】RDMA/hns some bugfix
  - mptcp: ensure tx skbs always have the MPTCP ext
  - ipvlan: add ipvlan_route_v6_outbound() helper
  - xfs: Fix file creation failure
  - !7831 IMA: Support the measurement extending of TSI TMM
  - !8230  Remove redundants code for proc_cgroupstats_show
  - !8255  IMA: Introduce a config for fix on IMA with Overlayfs issue
  - !8250  Control KABI reservation codes with config
  - !7889  vt: fix unicode buffer corruption when deleting characters
  - !8220  improve security for cvm host feature
  - !8150  mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
  - !8127  mlxsw: spectrum_acl_tcam: Fix warning during rehash
  - !8063  wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  - !8258 v5  can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
  - !8133  fix CVE-2021-47265
  - usb: udc: remove warning when queue disabled ep
  - netfilter: nf_tables: reject new basechain after table flag update
  - ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  - tty: fix hang on tty device with no_room set
  - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
  - !8238  arm: unwinder: Fix pc off-by-one in arm unwinder
  - !8237  x86: profiling: Using generic unwinding in profile_pc
  - !8236  x86: profiling: Check prof_buffer in profile_tick()
  - !8229  LLVM fix compile warning options
  - RDMA/hns: Add max_ah and cq moderation capacities in query_device()
  - RDMA/hns: Fix return value in hns_roce_map_mr_sg
  - RDMA/hns: Fix deadlock on SRQ async events.
  - IMA: Introduce a config for fix on IMA with Overlayfs issue
  - RDMA/hns: Fix UAF for cq async event
  - RDMA/hns: Fix mismatch exception rollback
  - sysv: don't call sb_bread() with pointers_lock held
  - RDMA/hns: Fix GMV table pagesize
  - RDMA/hns: Add mutex_destroy()
  - Control KABI reservation codes with config
  - RDMA/hns: Modify the print level of CQE error
  - !8109  vhost-vdpa: fix use after free in vhost_vdpa_probe()
  - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
  - arm: unwinder: Fix pc off-by-one in arm unwinder
  - x86: profiling: Using generic unwinding in profile_pc
  - x86: profiling: Check prof_buffer in profile_tick()
  - Remove redundants code for proc_cgroupstats_show
  - kbuild: Fix grep -q waring
  - Makefile: Exclude false positive warning options for Clang
  - !8054  CVE-2023-52669
  - !8190  crypto: jitter - change module_init(jent_mod_init) to subsys_initcall(jent_mod_init)
  - !8203  efi/libstub: arm64: Add macro isolation memmap detection code
  - PCI: Disable ATS for specific Intel IPU E2000 devices
  - PCI: Extract ATS disabling to a helper function
  - net: tls, update curr on splice as well
  - powerpc: update ppc_save_regs to save current r1 in pt_regs
  - mmc: sdhci-sprd: Fix eMMC init failure after hw reset
  - mmc: core: Cancel delayed work before releasing host
  - mmc: rpmb: fixes pause retune on all RPMB partitions.
  - mmc: meson-mx-sdhc: Fix initialization frozen issue
  - mm: fix unmap_mapping_range high bits shift bug
  - i2c: core: Fix atomic xfer check for non-preempt config
  - firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards
  - mm/memory-failure: check the mapcount of the precise page
  - net: Implement missing SO_TIMESTAMPING_NEW cmsg support
  - bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters()
  - asix: Add check for usbnet_get_endpoints
  - net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues
  - net/qla3xxx: switch from 'pci_' to 'dma_' API
  - i40e: Restore VF MSI-X state during PCI reset
  - ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux
  - ASoC: meson: g12a-toacodec: Fix event generation
  - ASoC: meson: g12a-tohdmitx: Validate written enum values
  - ASoC: meson: g12a-toacodec: Validate written enum values
  - i40e: fix use-after-free in i40e_aqc_add_filters()
  - net: Save and restore msg_namelen in sock_sendmsg
  - netfilter: nft_immediate: drop chain reference counter on error
  - netfilter: nftables: add loop check helper function
  - net: bcmgenet: Fix FCS generation for fragmented skbuffs
  - sfc: fix a double-free bug in efx_probe_filters
  - ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init
  - net: sched: em_text: fix possible memory leak in em_text_destroy()
  - i40e: Fix filter input checks to prevent config with invalid values
  - drm/i915/dp: Fix passing the correct DPCD_REV for drm_dp_set_phy_test_pattern
  - octeontx2-af: Fix marking couple of structure as __packed
  - nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP ProBook 440 G6
  - block: Don't invalidate pagecache for invalid falloc modes
  - keys, dns: Fix missing size check of V1 server-list header
  - cvm: improve security for cvm host feature
  - cvm: add secure memory query method
  - cvm: enable secure memory alloc on multiple numa nodes
  - x86/mm/pat: fix VM_PAT handling in COW mappings
  - !7110 [22.03-LTS-SP4] KVM TDP MMU new refactors
  - !8143  add kconfig for OLK-5.10
  - efi/libstub: arm64: Add macro isolation memmap detection code
  - btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations
  - btrfs: fix anon_dev leak in create_subvol()
  - crypto: jitter - change module_init(jent_mod_init) to subsys_initcall(jent_mod_init)
  - cpu/hotplug: Don't offline the last non-isolated CPU
  - mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
  - memcg: Introduce CONFIG_MEMCG_V1_THRESHOLD_QOS
  - kabi: use CONFIG_KABI_RESERVE to isolate bpf cgroup reserve flags
  - cgroup: add config isolation for cgroup_kill in cgroupv1
  - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  - RDMA: Verify port when creating flow rule
  - IB/mlx4: Use port iterator and validation APIs
  - mlxsw: spectrum_acl_tcam: Fix warning during rehash
  - drm/client: Fully protect modes[] with dev->mode_config.mutex
  - vhost-vdpa: fix use after free in vhost_vdpa_probe()
  - KVM: x86/mmu: Make KVM parameter tdp_mmu writeable
  - KVM: x86/mmu: Stop zapping invalidated TDP MMU roots asynchronously
  - kvm: x86: Do proper cleanup if kvm_x86_ops->vm_init() fails
  - KVM: x86/mmu: Do not filter address spaces in for_each_tdp_mmu_root_yield_safe()
  - KVM: x86/mmu: Open code leaf invalidation from mmu_notifier
  - KVM: x86/mmu: Include mmu.h in spte.h
  - KVM: x86/mmu: Harden TDP MMU iteration against root w/o shadow page
  - KVM: x86/mmu: Move the lockdep_assert of mmu_lock to inside clear_dirty_pt_masked()
  - KVM: x86/mmu: Add "never" option to allow sticky disabling of nx_huge_pages
  - KVM: x86/mmu: Use kstrtobool() instead of strtobool()
  - KVM: x86/mmu: Grab memslot for correct address space in NX recovery worker
  - KVM: x86/mmu: Add comment on try_cmpxchg64 usage in tdp_mmu_set_spte_atomic
  - KVM: x86: Preserve TDP MMU roots until they are explicitly invalidated
  - KVM: x86/mmu: Refresh CR0.WP prior to checking for emulated permission faults
  - KVM: x86/mmu: Merge all handle_changed_pte*() functions
  - KVM: x86/mmu: Remove handle_changed_spte_dirty_log()
  - KVM: x86/mmu: Remove "record_acc_track" in __tdp_mmu_set_spte()
  - KVM: x86/mmu: Bypass __handle_changed_spte() when aging TDP MMU SPTEs
  - KVM: x86/mmu: Drop unnecessary dirty log checks when aging TDP MMU SPTEs
  - KVM: x86/mmu: Clear only A-bit (if enabled) when aging TDP MMU SPTEs
  - KVM: x86/mmu: Remove "record_dirty_log" in __tdp_mmu_set_spte()
  - KVM: x86/mmu: Bypass __handle_changed_spte() when clearing TDP MMU dirty bits
  - KVM: x86/mmu: Drop access tracking checks when clearing TDP MMU dirty bits
  - KVM: x86/mmu: Atomically clear SPTE dirty state in the clear-dirty-log flow
  - KVM: x86/mmu: Consolidate Dirty vs. Writable clearing logic in TDP MMU
  - KVM: x86/mmu: Use kvm_ad_enabled() to determine if TDP MMU SPTEs need wrprot
  - KVM: x86/mmu: Add a helper function to check if an SPTE needs atomic write
  - KVM: VMX: Make CR0.WP a guest owned bit
  - KVM: x86: Make use of kvm_read_cr*_bits() when testing bits
  - KVM: x86: Ignore CR0.WP toggles in non-paging mode
  - KVM: x86: Do not unload MMU roots when only toggling CR0.WP with TDP enabled
  - KVM: x86/mmu: Fix comment typo
  - KVM: x86/mmu: Avoid indirect call for get_cr3
  - KVM: x86/mmu: Use gfn_t in kvm_flush_remote_tlbs_range()
  - KVM: x86/mmu: Rename kvm_flush_remote_tlbs_with_address()
  - KVM: x86/mmu: Collapse kvm_flush_remote_tlbs_with_{range,address}() together
  - KVM: x86/mmu: Make tdp_mmu_allowed static
  - KVM: x86/mmu: Cleanup range-based flushing for given page
  - KVM: x86/mmu: Fix wrong gfn range of tlb flushing in validate_direct_spte()
  - KVM: x86/mmu: Fix wrong start gfn of tlb flushing with range
  - KVM: x86/mmu: Reduce gfn range of tlb flushing in tdp_mmu_map_handle_target_level()
  - KVM: x86/mmu: Fix wrong gfn range of tlb flushing in kvm_set_pte_rmapp()
  - KVM: x86/mmu: Move round_gfn_for_level() helper into mmu_internal.h
  - KVM: x86/mmu: fix an incorrect comment in kvm_mmu_new_pgd()
  - kvm: x86/mmu: Rename SPTE_TDP_AD_ENABLED_MASK to SPTE_TDP_AD_ENABLED
  - KVM: x86/mmu: Pivot on "TDP MMU enabled" when handling direct page faults
  - KVM: x86/mmu: Pivot on "TDP MMU enabled" to check if active MMU is TDP MMU
  - KVM: x86/mmu: Replace open coded usage of tdp_mmu_page with is_tdp_mmu_page()
  - KVM: x86/mmu: Rename __direct_map() to direct_map()
  - KVM: x86/mmu: Stop needlessly making MMU pages available for TDP MMU faults
  - KVM: x86/mmu: Split out TDP MMU page fault handling
  - KVM: x86/mmu: Initialize fault.{gfn,slot} earlier for direct MMUs
  - KVM: x86/mmu: Handle no-slot faults in kvm_faultin_pfn()
  - KVM: x86/mmu: Avoid memslot lookup during KVM_PFN_ERR_HWPOISON handling
  - KVM: x86/mmu: Handle error PFNs in kvm_faultin_pfn()
  - KVM: x86/mmu: Grab mmu_invalidate_seq in kvm_faultin_pfn()
  - KVM: x86/mmu: Move TDP MMU VM init/uninit behind tdp_mmu_enabled
  - KVM: x86/mmu: Change tdp_mmu to a read-only parameter
  - KVM: x86/mmu: Don't install TDP MMU SPTE if SP has unexpected level
  - KVM: x86/mmu: Re-check under lock that TDP MMU SP hugepage is disallowed
  - KVM: x86/mmu: Map TDP MMU leaf SPTE iff target level is reached
  - KVM: x86/mmu: Don't attempt to map leaf if target TDP MMU SPTE is frozen
  - KVM: x86/mmu: Fix race condition in direct_page_fault
  - KVM: x86/mmu: Do not recover dirty-tracked NX Huge Pages
  - KVM: x86/mmu: simplify kvm_tdp_mmu_map flow when guest has to retry
  - KVM: x86/mmu: Split huge pages mapped by the TDP MMU on fault
  - KVM: x86/mmu: Block all page faults during kvm_zap_gfn_range()
  - KVM: x86/mmu: WARN if TDP MMU SP disallows hugepage after being zapped
  - KVM: x86/mmu: explicitly check nx_hugepage in disallowed_hugepage_adjust()
  - KVM: x86/mmu: Add helper to convert SPTE value to its shadow page
  - KVM: x86/mmu: Track the number of TDP MMU pages, but not the actual pages
  - KVM: x86/mmu: Set disallowed_nx_huge_page in TDP MMU before setting SPTE
  - KVM: x86/mmu: Properly account NX huge page workaround for nonpaging MMUs
  - KVM: x86/mmu: Rename NX huge pages fields/functions for consistency
  - KVM: x86/mmu: Tag disallowed NX huge pages even if they're not tracked
  - KVM: x86/mmu: add missing update to max_mmu_rmap_size
  - KVM: X86: avoid uninitialized 'fault.async_page_fault' from fixed-up #PF
  - KVM: x86/mmu: remove unused variable
  - KVM, x86/mmu: Fix the comment around kvm_tdp_mmu_zap_leafs()
  - KVM: x86/mmu: Don't bottom out on leafs when zapping collapsible SPTEs
  - KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level()
  - KVM: x86/mmu: Don't require refcounted "struct page" to create huge SPTEs
  - KVM: x86/mmu: Remove underscores from __pte_list_remove()
  - KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs
  - KVM: x86/mmu: Rename rmap zap helpers to eliminate "unmap" wrapper
  - KVM: x86/mmu: Rename __kvm_zap_rmaps() to align with other nomenclature
  - KVM: x86/mmu: Drop the "p is for pointer" from rmap helpers
  - KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps
  - KVM: x86/mmu: Return a u64 (the old SPTE) from mmu_spte_clear_track_bits()
  - KVM: x86/mmu: Fix typo and tweak comment for split_desc_cache capacity
  - KVM: x86/mmu: Expand quadrant comment for PG_LEVEL_4K shadow pages
  - KVM: x86/mmu: Add optimized helper to retrieve an SPTE's index
  - KVM: x86/mmu: Replace UNMAPPED_GVA with INVALID_GPA for gva_to_gpa()
  - KVM: x86/mmu: Buffer nested MMU split_desc_cache only by default capacity
  - KVM: x86/mmu: Use "unsigned int", not "u32", for SPTEs' @access info
  - KVM: x86/mmu: Avoid unnecessary flush on eager page split
  - KVM: x86/mmu: Extend Eager Page Splitting to nested MMUs
  - KVM: Allow for different capacities in kvm_mmu_memory_cache structs
  - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page()
  - KVM: x86/mmu: Zap collapsible SPTEs in shadow MMU at all possible levels
  - KVM: x86/mmu: Extend make_huge_page_split_spte() for the shadow MMU
  - KVM: x86/mmu: Cache the access bits of shadowed translations
  - KVM: x86/mmu: Update page stats in __rmap_add()
  - KVM: x86/mmu: Decouple rmap_add() and link_shadow_page() from kvm_vcpu
  - KVM: x86/mmu: Allow NULL @vcpu in kvm_mmu_find_shadow_page()
  - KVM: x86/mmu: Pass kvm pointer separately from vcpu to kvm_mmu_find_shadow_page()
  - KVM: x86/mmu: Replace vcpu with kvm in kvm_mmu_alloc_shadow_page()
  - KVM: x86/mmu: Pass memory caches to allocate SPs separately
  - KVM: x86/mmu: Move guest PT write-protection to account_shadowed()
  - KVM: x86/mmu: Rename shadow MMU functions that deal with shadow pages
  - KVM: x86/mmu: Consolidate shadow page allocation and initialization
  - KVM: x86/mmu: Decompose kvm_mmu_get_page() into separate functions
  - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes
  - KVM: x86/mmu: Derive shadow MMU page role from parent
  - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root()
  - KVM: x86/mmu: Use a bool for direct
  - KVM: x86/mmu: Optimize MMU page cache lookup for all direct SPs
  - KVM: X86/MMU: Fix shadowing 5-level NPT for 4-level NPT L1 guest
  - KVM: X86/MMU: Add sp_has_gptes()
  - KVM: Do not zero initialize 'pfn' in hva_to_pfn()
  - KVM: x86/mmu: Shove refcounted page dependency into host_pfn_mapping_level()
  - KVM: Rename/refactor kvm_is_reserved_pfn() to kvm_pfn_to_refcounted_page()
  - KVM: Take a 'struct page', not a pfn in kvm_is_zone_device_page()
  - KVM: Remove kvm_vcpu_gfn_to_page() and kvm_vcpu_gpa_to_page()
  - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page
  - KVM: Don't WARN if kvm_pfn_to_page() encounters a "reserved" pfn
  - KVM: Avoid pfn_to_page() and vice versa when releasing pages
  - KVM: x86/mmu: Use common logic for computing the 32/64-bit base PA mask
  - KVM: x86/mmu: Truncate paging32's PT_BASE_ADDR_MASK to 32 bits
  - KVM: x86/mmu: Use common macros to compute 32/64-bit paging masks
  - KVM: x86/mmu: Use separate namespaces for guest PTEs and shadow PTEs
  - KVM: x86/mmu: Dedup macros for computing various page table masks
  - KVM: x86/mmu: Bury 32-bit PSE paging helpers in paging_tmpl.h
  - KVM: VMX: Refactor 32-bit PSE PT creation to avoid using MMU macro
  - KVM: X86/MMU: Remove unused PT32_DIR_BASE_ADDR_MASK from mmu.c
  - KVM: x86/MMU: Zap non-leaf SPTEs when disabling dirty logging
  - KVM: x86/mmu: Check every prev_roots in __kvm_mmu_free_obsolete_roots()
  - KVM: x86/mmu: Use IS_ENABLED() to avoid RETPOLINE for TDP page faults
  - KVM: x86/mmu: Make all page fault handlers internal to the MMU
  - KVM: x86/mmu: Add RET_PF_CONTINUE to eliminate bool+int* "returns"
  - KVM: x86/mmu: Drop exec/NX check from "page fault can be fast"
  - KVM: x86/mmu: Don't attempt fast page fault just because EPT is in use
  - KVM: x86/mmu: Use atomic XCHG to write TDP MMU SPTEs with volatile bits
  - KVM: x86/mmu: Move shadow-present check out of spte_has_volatile_bits()
  - KVM: x86/mmu: Don't treat fully writable SPTEs as volatile (modulo A/D)
  - KVM: x86/mmu: replace direct_map with root_role.direct
  - KVM: x86/mmu: replace root_level with cpu_role.base.level
  - KVM: x86/mmu: replace shadow_root_level with root_role.level
  - KVM: x86/mmu: pull CPU mode computation to kvm_init_mmu
  - KVM: x86/mmu: simplify and/or inline computation of shadow MMU roles
  - KVM: x86/mmu: remove redundant bits from extended role
  - KVM: x86/mmu: rename kvm_mmu_role union
  - KVM: x86/mmu: remove extended bits from mmu_role, rename field
  - KVM: x86/mmu: store shadow EFER.NX in the MMU role
  - KVM: x86/mmu: cleanup computation of MMU roles for shadow paging
  - KVM: x86/mmu: cleanup computation of MMU roles for two-dimensional paging
  - KVM: x86/mmu: remove kvm_calc_shadow_root_page_role_common
  - KVM: x86/mmu: remove ept_ad field
  - KVM: x86/mmu: do not recompute root level from kvm_mmu_role_regs
  - KVM: x86/mmu: split cpu_role from mmu_role
  - KVM: x86/mmu: remove "bool base_only" arguments
  - KVM: x86/mmu: rephrase unclear comment
  - KVM: x86/mmu: pull computation of kvm_mmu_role_regs to kvm_init_mmu
  - KVM: x86/mmu: constify uses of struct kvm_mmu_role_regs
  - KVM: x86/mmu: nested EPT cannot be used in SMM
  - KVM: x86/mmu: include EFER.LMA in extended mmu role
  - KVM: x86/mmu: fix potential races when walking host page table
  - KVM: x86/mmu: Do not create SPTEs for GFNs that exceed host.MAXPHYADDR
  - KVM: x86/mmu: Derive EPT violation RWX bits from EPTE RWX bits
  - KVM: VMX: replace 0x180 with EPT_VIOLATION_* definition
  - KVM: x86/mmu: remove unnecessary flush_workqueue()
  - KVM: x86/mmu: Don't rebuild page when the page is synced and no tlb flushing is required
  - KVM: x86: mmu: trace kvm_mmu_set_spte after the new SPTE was set
  - KVM: x86/mmu: Zap only TDP MMU leafs in zap range and mmu_notifier unmap
  - KVM: MMU: propagate alloc_workqueue failure
  - Revert "KVM: x86/mmu: Zap only TDP MMU leafs in kvm_zap_gfn_range()"
  - kvm: x86/mmu: Flush TLB before zap_gfn_range releases RCU
  - KVM: x86/mmu: WARN on any attempt to atomically update REMOVED SPTE
  - KVM: x86/mmu: Check for a REMOVED leaf SPTE before making the SPTE
  - KVM: x86/mmu: Zap defunct roots via asynchronous worker
  - KVM: x86/mmu: Zap roots in two passes to avoid inducing RCU stalls
  - KVM: x86/mmu: Allow yielding when zapping GFNs for defunct TDP MMU root
  - KVM: x86/mmu: Zap invalidated roots via asynchronous worker
  - KVM: x86/mmu: Defer TLB flush to caller when freeing TDP MMU shadow pages
  - KVM: x86/mmu: Do remote TLB flush before dropping RCU in TDP MMU resched
  - KVM: x86/mmu: Zap only TDP MMU leafs in kvm_zap_gfn_range()
  - KVM: x86/mmu: Require mmu_lock be held for write to zap TDP MMU range
  - KVM: x86/mmu: Add dedicated helper to zap TDP MMU root shadow page
  - KVM: x86/mmu: Skip remote TLB flush when zapping all of TDP MMU
  - KVM: x86/mmu: Zap only the target TDP MMU shadow page in NX recovery
  - KVM: x86/mmu: Refactor low-level TDP MMU set SPTE helper to take raw values
  - KVM: x86/mmu: Add helpers to read/write TDP MMU SPTEs and document RCU
  - KVM: x86/mmu: Drop RCU after processing each root in MMU notifier hooks
  - KVM: x86/mmu: Batch TLB flushes from TDP MMU for MMU notifier change_spte
  - KVM: x86/mmu: Check for !leaf=>leaf, not PFN change, in TDP MMU SP removal
  - KVM: x86/mmu: do not allow readers to acquire references to invalid roots
  - KVM: x86/mmu: only perform eager page splitting on valid roots
  - KVM: x86/mmu: Require mmu_lock be held for write in unyielding root iter
  - KVM: x86/mmu: Document that zapping invalidated roots doesn't need to flush
  - KVM: x86/mmu: Formalize TDP MMU's (unintended?) deferred TLB flush logic
  - KVM: WARN if is_unsync_root() is called on a root without a shadow page
  - KVM: s390: Replace KVM_REQ_MMU_RELOAD usage with arch specific request
  - KVM: x86/mmu: Zap only obsolete roots if a root shadow page is zapped
  - KVM: Drop kvm_reload_remote_mmus(), open code request in x86 users
  - KVM: x86: Invoke kvm_mmu_unload() directly on CR4.PCIDE change
  - KVM: x86: flush TLB separately from MMU reset
  - KVM: x86/mmu: clear MMIO cache when unloading the MMU
  - KVM: x86/mmu: load new PGD after the shadow MMU is initialized
  - KVM: x86/mmu: look for a cached PGD when going from 32-bit to 64-bit
  - KVM: x86/mmu: do not pass vcpu to root freeing functions
  - KVM: x86/mmu: do not consult levels when freeing roots
  - KVM: x86: use struct kvm_mmu_root_info for mmu->root
  - KVM: x86: do not deliver asynchronous page faults if CR0.PG=0
  - KVM: x86: Reinitialize context if host userspace toggles EFER.LME
  - KVM: x86: Retry page fault if MMU reload is pending and root has no sp
  - KVM: x86/mmu: Remove MMU auditing
  - KVM: x86/mmu: Add tracepoint for splitting huge pages
  - KVM: x86/mmu: Split huge pages mapped by the TDP MMU during KVM_CLEAR_DIRTY_LOG
  - KVM: x86/mmu: Split huge pages mapped by the TDP MMU when dirty logging is enabled
  - KVM: x86/mmu: Separate TDP MMU shadow page allocation and initialization
  - KVM: x86/mmu: Derive page role for TDP MMU shadow pages from parent
  - KVM: x86/mmu: Remove redundant role overrides for TDP MMU shadow pages
  - KVM: x86/mmu: Refactor TDP MMU iterators to take kvm_mmu_page root
  - KVM: x86/mmu: Move restore_acc_track_spte() to spte.h
  - KVM: x86/mmu: Drop new_spte local variable from restore_acc_track_spte()
  - KVM: x86/mmu: Remove unnecessary warnings from restore_acc_track_spte()
  - KVM: x86/mmu: Consolidate logic to atomically install a new TDP MMU page table
  - KVM: x86/mmu: Rename handle_removed_tdp_mmu_page() to handle_removed_pt()
  - KVM: x86/mmu: Rename TDP MMU functions that handle shadow pages
  - KVM: x86/mmu: Change tdp_mmu_{set,zap}_spte_atomic() to return 0/-EBUSY
  - KVM: x86/mmu: Automatically update iter->old_spte if cmpxchg fails
  - KVM: x86/mmu: Rename __rmap_write_protect() to rmap_write_protect()
  - KVM: x86/mmu: Rename rmap_write_protect() to kvm_vcpu_write_protect_gfn()
  - KVM: x86/mmu: Consolidate comments about {Host,MMU}-writable
  - KVM: x86/mmu: Rename DEFAULT_SPTE_MMU_WRITEABLE to DEFAULT_SPTE_MMU_WRITABLE
  - KVM: x86/mmu: Move is_writable_pte() to spte.h
  - KVM: x86/mmu: Check SPTE writable invariants when setting leaf SPTEs
  - KVM: x86/mmu: Move SPTE writable invariant checks to a helper function
  - KVM: x86/mmu_audit: Remove unused "level" of audit_spte_after_sync()
  - KVM: x86/tdp_mmu: Remove unused "kvm" of kvm_tdp_mmu_get_root()
  - KVM: x86/mmu: Remove unused "kvm" of __rmap_write_protect()
  - KVM: x86/mmu: Remove unused "kvm" of kvm_mmu_unlink_parents()
  - KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU
  - KVM: x86/mmu: Move "invalid" check out of kvm_tdp_mmu_get_root()
  - KVM: x86/mmu: Use common TDP MMU zap helper for MMU notifier unmap hook
  - KVM: remove async parameter of hva_to_pfn_remapped()
  - KVM: x86/mmu: Improve TLB flush comment in kvm_mmu_slot_remove_write_access()
  - KVM: x86/mmu: Document and enforce MMU-writable and Host-writable invariants
  - KVM: x86/mmu: Clear MMU-writable during changed_pte notifier
  - KVM: x86/MMU: Simplify flow of vmx_get_mt_mask
  - KVM: x86/mmu: Remove need for a vcpu from mmu_try_to_unsync_pages
  - KVM: x86/mmu: Remove need for a vcpu from kvm_slot_page_track_is_active
  - KVM: x86/mmu: Use shadow page role to detect PML-unfriendly pages for L2
  - KVM: x86/mmu: Retry page fault if root is invalidated by memslot update
  - KVM: x86/mmu: Handle "default" period when selectively waking kthread
  - KVM: x86/mmu: Remove spurious TLB flushes in TDP MMU zap collapsible path
  - KVM: x86/mmu: Use yield-safe TDP MMU root iter in MMU notifier unmapping
  - KVM: X86: Rename gpte_is_8_bytes to has_4_byte_gpte and invert the direction
  - KVM: MMU: update comment on the number of page role combinations
  - KVM: X86: Add parameter huge_page_level to kvm_init_shadow_ept_mmu()
  - KVM: X86: Add huge_page_level to __reset_rsvds_bits_mask_ept()
  - KVM: X86: Remove mmu->translate_gpa
  - KVM: x86: Subsume nested GPA read helper into load_pdptrs()
  - KVM: X86: Add parameter struct kvm_mmu *mmu into mmu->gva_to_gpa()
  - KVM: X86: Calculate quadrant when !role.gpte_is_8_bytes
  - KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct
  - KVM: X86: Remove unused declaration of __kvm_mmu_free_some_pages()
  - KVM: X86: Fix comment in __kvm_mmu_create()
  - KVM: X86: Skip allocating pae_root for vcpu->arch.guest_mmu when !tdp_enabled
  - KVM: x86: Forbid KVM_SET_CPUID{,2} after KVM_RUN
  - KVM: x86/mmu: Pass parameter flush as false in kvm_tdp_mmu_zap_collapsible_sptes()
  - KVM: x86/mmu: Skip tlb flush if it has been done in zap_gfn_range()
  - kvm: mmu: Use fast PF path for access tracking of huge pages when possible
  - KVM: x86/mmu: Properly dereference rcu-protected TDP MMU sptep iterator
  - KVM: x86/mmu: Extract zapping of rmaps for gfn range to separate helper
  - KVM: x86/mmu: Drop a redundant remote TLB flush in kvm_zap_gfn_range()
  - KVM: x86/mmu: Drop a redundant, broken remote TLB flush
  - KVM: X86: Don't unload MMU in kvm_vcpu_flush_tlb_guest()
  - KVM: x86/mmu: Unexport MMU load/unload functions
  - KVM: X86: pair smp_wmb() of mmu_try_to_unsync_pages() with smp_rmb()
  - KVM: X86: Cache CR3 in prev_roots when PCID is disabled
  - KVM: X86: Fix tlb flush for tdp in kvm_invalidate_pcid()
  - KVM: X86: Don't reset mmu context when toggling X86_CR4_PGE
  - KVM: X86: Don't reset mmu context when X86_CR4_PCIDE 1->0
  - kvm: x86: mmu: Make NX huge page recovery period configurable
  - KVM: x86/mmu: Rename slot_handle_leaf to slot_handle_level_4k
  - KVM: x86/mmu: clean up prefetch/prefault/speculative naming
  - KVM: cleanup allocation of rmaps and page tracking data
  - KVM: X86: fix lazy allocation of rmaps
  - KVM: x86/mmu: kvm_faultin_pfn has to return false if pfh is returned
  - KVM: x86: only allocate gfn_track when necessary
  - KVM: x86: add config for non-kvm users of page tracking
  - KVM: x86/mmu: Avoid memslot lookup in make_spte and mmu_try_to_unsync_pages
  - KVM: x86/mmu: Avoid memslot lookup in rmap_add
  - KVM: MMU: pass struct kvm_page_fault to mmu_set_spte
  - KVM: MMU: pass kvm_mmu_page struct to make_spte
  - KVM: MMU: set ad_disabled in TDP MMU role
  - KVM: MMU: remove unnecessary argument to mmu_set_spte
  - KVM: MMU: clean up make_spte return value
  - KVM: MMU: inline set_spte in FNAME(sync_page)
  - KVM: MMU: inline set_spte in mmu_set_spte
  - KVM: x86/mmu: Avoid memslot lookup in page_fault_handle_page_track
  - KVM: x86/mmu: Pass the memslot around via struct kvm_page_fault
  - KVM: MMU: unify tdp_mmu_map_set_spte_atomic and tdp_mmu_set_spte_atomic_no_dirty_log
  - KVM: MMU: mark page dirty in make_spte
  - KVM: x86/mmu: Fold rmap_recycle into rmap_add
  - KVM: x86/mmu: Verify shadow walk doesn't terminate early in page faults
  - KVM: MMU: change tracepoints arguments to kvm_page_fault
  - KVM: MMU: change disallowed_hugepage_adjust() arguments to kvm_page_fault
  - KVM: MMU: change kvm_mmu_hugepage_adjust() arguments to kvm_page_fault
  - KVM: MMU: change fast_page_fault() arguments to kvm_page_fault
  - KVM: MMU: change tdp_mmu_map_handle_target_level() arguments to kvm_page_fault
  - KVM: MMU: change kvm_tdp_mmu_map() arguments to kvm_page_fault
  - KVM: MMU: change FNAME(fetch)() arguments to kvm_page_fault
  - KVM: MMU: change __direct_map() arguments to kvm_page_fault
  - KVM: MMU: change handle_abnormal_pfn() arguments to kvm_page_fault
  - KVM: MMU: change kvm_faultin_pfn() arguments to kvm_page_fault
  - KVM: MMU: change page_fault_handle_page_track() arguments to kvm_page_fault
  - KVM: MMU: change direct_page_fault() arguments to kvm_page_fault
  - KVM: MMU: change mmu->page_fault() arguments to kvm_page_fault
  - KVM: MMU: Introduce struct kvm_page_fault
  - KVM: MMU: pass unadulterated gpa to direct_page_fault
  - KVM: X86: Remove FNAME(update_pte)
  - KVM: X86: Zap the invalid list after remote tlb flushing
  - KVM: X86: Change kvm_sync_page() to return true when remote flush is needed
  - KVM: X86: Remove kvm_mmu_flush_or_zap()
  - KVM: X86: Don't flush current tlb on shadow page modification
  - KVM: X86: Don't unsync pagetables when speculative
  - KVM: x86/mmu: Complete prefetch for trailing SPTEs for direct, legacy MMU
  - KVM: Remove tlbs_dirty
  - KVM: X86: Synchronize the shadow pagetable before link it
  - KVM: X86: Fix missed remote tlb flush in rmap_write_protect()
  - KVM: x86/mmu: Move lpage_disallowed_link further "down" in kvm_mmu_page
  - KVM: x86/mmu: Relocate kvm_mmu_page.tdp_mmu_page for better cache locality
  - KVM: x86/mmu: Remove unused field mmio_cached in struct kvm_mmu_page
  - KVM: x86: clamp host mapping level to max_level in kvm_mmu_max_mapping_level
  - KVM: x86/mmu: Drop 'shared' param from tdp_mmu_link_page()
  - KVM: x86/mmu: Add detailed page size stats
  - KVM: x86/mmu: Avoid collision with !PRESENT SPTEs in TDP MMU lpage stats
  - KVM: x86/mmu: Remove redundant spte present check in mmu_set_spte
  - KVM: x86/mmu: allow kvm_faultin_pfn to return page fault handling code
  - KVM: x86/mmu: rename try_async_pf to kvm_faultin_pfn
  - KVM: x86/mmu: add comment explaining arguments to kvm_zap_gfn_range
  - KVM: x86/mmu: fix parameters to kvm_flush_remote_tlbs_with_address
  - Revert "KVM: x86/mmu: Allow zap gfn range to operate under the mmu read lock"
  - KVM: X86: Introduce kvm_mmu_slot_lpages() helpers
  - KVM: x86/mmu: Don't step down in the TDP iterator when zapping all SPTEs
  - KVM: x86/mmu: Don't leak non-leaf SPTEs when zapping all SPTEs
  - KVM: x86/mmu: Rename __gfn_to_rmap to gfn_to_rmap
  - KVM: x86/mmu: Leverage vcpu->last_used_slot for rmap_add and rmap_recycle
  - KVM: x86/mmu: Leverage vcpu->last_used_slot in tdp_mmu_map_handle_target_level
  - KVM: Cache the last used slot index per vCPU
  - KVM: Move last_used_slot logic out of search_memslots
  - KVM: Rename lru_slot to last_used_slot
  - KVM: X86: Optimize zapping rmap
  - KVM: X86: Optimize pte_list_desc with per-array counter
  - KVM: X86: MMU: Tune PTE_LIST_EXT to be bigger
  - KVM: Don't take mmu_lock for range invalidation unless necessary
  - KVM: Block memslot updates across range_start() and range_end()
  - KVM: Introduce kvm_get_kvm_safe()
  - KVM: X86: Add per-vm stat for max rmap list size
  - KVM: x86/mmu: Return old SPTE from mmu_spte_clear_track_bits()
  - KVM: x86/mmu: Refactor shadow walk in __direct_map() to reduce indentation
  - KVM: x86/mmu: Mark VM as bugged if page fault returns RET_PF_INVALID
  - KVM: x86: Use KVM_BUG/KVM_BUG_ON to handle bugs that are fatal to the VM
  - KVM: Export kvm_make_all_cpus_request() for use in marking VMs as bugged
  - KVM: x86: Do not write protect huge page in initially-all-set mode
  - KVM: x86: Support write protecting only large pages
  - KVM: x86/mmu: Remove a variety of unnecessary exports
  - KVM: x86: Fold "write-protect large" use case into generic write-protect
  - KVM: x86/mmu: Don't set dirty bits when disabling dirty logging w/ PML
  - KVM: VMX: Dynamically enable/disable PML based on memslot dirty logging
  - KVM: x86: Move MMU's PML logic to common code
  - KVM: x86/mmu: Make dirty log size hook (PML) a value, not a function
  - KVM: x86/mmu: Let guest use GBPAGES if supported in hardware and TDP is on
  - KVM: x86/mmu: Get CR4.SMEP from MMU, not vCPU, in shadow page fault
  - KVM: x86/mmu: Get CR0.WP from MMU, not vCPU, in shadow page fault
  - KVM: x86/mmu: Drop redundant rsvd bits reset for nested NPT
  - KVM: x86/mmu: Optimize and clean up so called "last nonleaf level" logic
  - KVM: x86: Enhance comments for MMU roles and nested transition trickiness
  - KVM: x86/mmu: WARN on any reserved SPTE value when making a valid SPTE
  - KVM: x86/mmu: Add helpers to do full reserved SPTE checks w/ generic MMU
  - KVM: x86/mmu: Use MMU's role to determine PTTYPE
  - KVM: x86/mmu: Collapse 32-bit PAE and 64-bit statements for helpers
  - KVM: x86/mmu: Add a helper to calculate root from role_regs
  - KVM: x86/mmu: Add helper to update paging metadata
  - KVM: x86/mmu: Don't update nested guest's paging bitmasks if CR0.PG=0
  - KVM: x86/mmu: Consolidate reset_rsvds_bits_mask() calls
  - KVM: x86/mmu: Use MMU role_regs to get LA57, and drop vCPU LA57 helper
  - KVM: x86/mmu: Get nested MMU's root level from the MMU's role
  - KVM: x86/mmu: Drop "nx" from MMU context now that there are no readers
  - KVM: x86/mmu: Use MMU's role to get EFER.NX during MMU configuration
  - KVM: x86/mmu: Use MMU's role/role_regs to compute context's metadata
  - KVM: x86/mmu: Use MMU's role to detect EFER.NX in guest page walk
  - KVM: x86/mmu: Use MMU's roles to compute last non-leaf level
  - KVM: x86/mmu: Use MMU's role to compute PKRU bitmask
  - KVM: x86/mmu: Use MMU's role to compute permission bitmask
  - KVM: x86/mmu: Drop vCPU param from reserved bits calculator
  - KVM: x86/mmu: Use MMU's role to get CR4.PSE for computing rsvd bits
  - KVM: x86/mmu: Don't grab CR4.PSE for calculating shadow reserved bits
  - KVM: x86/mmu: Always set new mmu_role immediately after checking old role
  - KVM: x86/mmu: Set CR4.PKE/LA57 in MMU role iff long mode is active
  - KVM: x86/mmu: Do not set paging-related bits in MMU role if CR0.PG=0
  - KVM: x86/mmu: Add accessors to query mmu_role bits
  - KVM: x86/mmu: Rename "nxe" role bit to "efer_nx" for macro shenanigans
  - KVM: x86/mmu: Use MMU's role_regs, not vCPU state, to compute mmu_role
  - KVM: x86/mmu: Ignore CR0 and CR4 bits in nested EPT MMU role
  - KVM: x86/mmu: Consolidate misc updates into shadow_mmu_init_context()
  - KVM: x86/mmu: Add struct and helpers to retrieve MMU role bits from regs
  - KVM: x86/mmu: Grab shadow root level from mmu_role for shadow MMUs
  - KVM: x86/mmu: Move nested NPT reserved bit calculation into MMU proper
  - KVM: x86: Read and pass all CR0/CR4 role bits to shadow MMU helper
  - KVM: x86: Introduce kvm_post_set_cr4 to post handle the CR4 emulation
  - KVM: x86: Introduce kvm_post_set_cr0 to post handle the CR0 emulation
  - KVM: x86: Add more protection against undefined behavior in rsvd_bits()
  - KVM: x86/mmu: Drop smep_andnot_wp check from "uses NX" for shadow MMUs
  - KVM: x86: Fix sizes used to pass around CR0, CR4, and EFER
  - KVM: x86/mmu: Rename unsync helper and update related comments
  - KVM: x86/mmu: Drop the intermediate "transient" __kvm_sync_page()
  - KVM: x86/mmu: comment on kvm_mmu_get_page's syncing of pages
  - KVM: x86/mmu: WARN and zap SP when sync'ing if MMU role mismatches
  - KVM: x86/mmu: Use MMU role to check for matching guest page sizes
  - KVM: x86/mmu: Unconditionally zap unsync SPs when creating >4k SP at GFN
  - Revert "KVM: MMU: record maximum physical address width in kvm_mmu_extended_role"
  - KVM: x86: Alert userspace that KVM_SET_CPUID{,2} after KVM_RUN is broken
  - KVM: x86: Force all MMUs to reinitialize if guest CPUID is modified
  - KVM: nVMX: WARN if subtly-impossible VMFUNC conditions occur
  - KVM: x86: Drop pointless @reset_roots from kvm_init_mmu()
  - KVM: x86: Defer MMU sync on PCID invalidation
  - KVM: nVMX: Use fast PGD switch when emulating VMFUNC[EPTP_SWITCH]
  - KVM: x86: Use KVM_REQ_TLB_FLUSH_GUEST to handle INVPCID(ALL) emulation
  - KVM: nVMX: Consolidate VM-Enter/VM-Exit TLB flush and MMU sync logic
  - KVM: x86: Drop skip MMU sync and TLB flush params from "new PGD" helpers
  - KVM: nSVM: Move TLB flushing logic (or lack thereof) to dedicated helper
  - KVM: x86: Uncondtionally skip MMU sync/TLB flush in MOV CR3's PGD switch
  - KVM: x86: Invalidate all PGDs for the current PCID on MOV CR3 w/ flush
  - KVM: nVMX: Free only guest_mode (L2) roots on INVVPID w/o EPT
  - scsi: iscsi: Fix iscsi_task use after free
  - scsi: iscsi: Have abort handler get ref to conn
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  - crypto: s390/aes - Fix buffer overread in CTR mode
  - block: prevent division by zero in blk_rq_stat_sum()
  - IMA: Support the measurement extending of TSI TMM
  - vt: fix unicode buffer corruption when deleting characters
  - selinux: avoid dereference of garbage after mount failure
  - btrfs: send: handle path ref underflow in header iterate_inode_ref()
  - x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
  - crypto: xilinx - call finalize with bh disabled


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-207.0.0.116
changelog:
  - !8599  Bluetooth: hci_core: Fix possible buffer overflow
  - !8949  CVE-2022-48652
  - !8602  netfilter: nf_tables: set dormant flag on hook register failure
  - !8867  ipv6: prevent NULL dereference in ip6_output()
  - !8779  smb: client: fix UAF in smb2_reconnect_server()
  - !8893 [sync] PR-8531:  gpiolib: cdev: fix uninitialised kfifo
  - !8985  cvm_tsi: Fix security issue for Confidential cVM TSI
  - !8686  mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  - !8711  ubifs: Set page uptodate in the correct place
  - !8860  blk-iocost: do not WARN if iocg was already offlined
  - !8639  s390/qeth: Fix kernel panic after setting hsuid
  - !8946  usb: typec: ucsi: Limit read size on v1.2
  - !8969  Fix CVE-2024-36949
  - cvm_tsi: Fix security issue for Confidential cVM TSI
  - !8216  ACPI: video: check for error while searching for backlight device parent
  - !8903  ALSA: scarlett2: Add missing error checks to *_ctl_get()
  - !8584  virtio-blk: fix implicit overflow on virtio_max_dma_size
  - !8838  blk-iocost: avoid out of bounds shift
  - !8856  PCI/PM: Drain runtime-idle callbacks before driver removal
  - amd/amdkfd: sync all devices to wait all processes being evicted
  - drm/amdkfd: Rework kfd_locked handling
  - !8906  net/mlx5e: Fix use-after-free of encap entry in neigh update handler
  - !8910  gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - ice: Fix crash by keep old cfg when update TCs more than queues
  - ice: ethtool: Prohibit improper channel config for DCB
  - !8879  net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - !6695  netfilter: nft_set_pipapo: do not free live element
  - usb: typec: ucsi: Limit read size on v1.2
  - !8891  net: fix out-of-bounds access in ops_init
  - !8871 add sdma-dae for openeuler 22.03 SP4
  - !8762  tipc: fix UAF in error path
  - !8742  octeontx2-af: avoid off-by-one read from userspace
  - !8734  mptcp: ensure snd_nxt is properly initialized on connect
  - !8634  batman-adv: Avoid infinite loop trying to resize local TT
  - !8736  net: hns3: fix kernel crash when devlink reload during initialization
  - !8745  afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
  - !3547  fs: mitigatin cacheline false sharing in struct file
  - !8887  nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - net/mlx5e: Fix use-after-free of encap entry in neigh update handler
  - ALSA: scarlett2: Add missing error checks to *_ctl_get()
  - !8785  tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  - drivers: misc: sdma-dae: enable sdma_dae for arm64
  - drivers: misc: sdma-dae: support page fault preprocess
  - gpiolib: cdev: fix uninitialised kfifo
  - !8849  ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - net: fix out-of-bounds access in ops_init
  - !8666  phonet/pep: fix racy skb_queue_empty() use
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - drivers: misc: sdma-dae: support interrupt init and handle
  - drivers: misc: sdma-dae: support sqe task send and execute
  - drivers: misc: sdma-dae: support channel management
  - drivers: misc: sdma-dae: support getting streamID
  - drivers: misc: sdma-dae: support initializ sdma driver
  - ipv6: prevent NULL dereference in ip6_output()
  - blk-iocost: do not WARN if iocg was already offlined
  - PCI/PM: Drain runtime-idle callbacks before driver removal
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - !8684  tcp: properly terminate timers for kernel sockets
  - !8629  erspan: make sure erspan_base_hdr is present in skb->head
  - blk-iocost: avoid out of bounds shift
  - !8635  ipv6: Fix potential uninit-value access in __ip6_make_skb()
  - !8550  tipc: fix a possible memleak in tipc_buf_append
  - !8726  tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - !8808 v2  Add support for PCC Operation Region
  - !8623  fs/9p: only translate RWX permissions for plain 9P2000
  - !8479  scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - !8770 IMA: Check cvm world before call smc function
  - !8797 kvm: arm64: Fix a compilation error
  - !8782 drivers: net: ub: dev: network_mgmt: Modify the dguid of network control packets.
  - arm64: config: Enable ACPI_PCC
  - ACPI: PCC: Setup PCC Opregion handler only if platform interrupt is available
  - ACPI: PCC: Fix unintentional integer overflow
  - ACPI: PCC: Fix Tx acknowledge in the PCC address space handler
  - ACPI: PCC: replace wait_for_completion()
  - ACPI: PCC: Release resources on address space setup failure path
  - ACPI: PCC: pcc_ctx can be static
  - ACPI: PCC: Implement OperationRegion handler for the PCC Type 3 subtype
  - ACPICA: Add support for PCC Opregion special context data
  - kvm: arm64: Fix a compilation error
  - network_mgmt: Modify the dguid of network control packets.
  - !8781 HNS3: Supports the configuration of default mc guid
  - !8789  Bluetooth: SCO: Fix not validating setsockopt user input
  - !8658  usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
  - !8673 IMA: Support uid and gid tamplate
  - IMA: Check cvm world before call smc function
  - Bluetooth: SCO: Fix not validating setsockopt user input
  - !8679  rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  - !8558  xen-netfront: Add missing skb_mark_for_recycle
  - !8725 v6  Fix CVE-2023-52732
  - !8222  Fix CVE-2023-52672
  - !8590  geneve: fix header validation in geneve[6
  - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  - HNS3: Supports the configuration of default mc guid
  - smb: client: fix UAF in smb2_reconnect_server()
  - !8355  powerpc: defconfig: Disable CONFIG_DW_EDMA and CONFIG_DW_EDMA_PCIE
  - tipc: fix UAF in error path
  - !8749  ubifs: Check @c->dirty_[n|p
  - ubifs: Check @c->dirty_[n|p]n_cnt and @c->nroot state under @c->lp_mutex
  - afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
  - octeontx2-af: avoid off-by-one read from userspace
  - !8723 crypto: hisilicon/qm - change function type to void
  - !8536  livepatch: Fix find wrong ftrace entry
  - !8682  ACPI: bus: Ensure that notify handlers are not running after removal
  - !8688  x86/signal: Fix the value returned by strict_sas_size()
  - !8618  CVE-2024-35896
  - net: hns3: fix kernel crash when devlink reload during initialization
  - !8607  CVE-2024-35895
  - mptcp: ensure snd_nxt is properly initialized on connect
  - !8586  fix CVE-2021-47558
  - !8548  fix CVE-2024-36906
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - ceph: blocklist the kclient when receiving corrupted snap trace
  - ceph: shut down access to inode when async create fails
  - ceph: refactor remove_session_caps_cb
  - ceph: fix auth cap handling logic in remove_session_caps_cb
  - ceph: drop private list from remove_session_caps_cb
  - crypto: hisilicon/qm - change function type to void
  - !7930  bpf: Protect against int overflow for stack access size
  - !8581 22.03-SP4-ACC patch
  - !8396 RDMA/hns: A set of bugfixes for openeuler 22.03 SP4
  - !8613  CVE-2024-35854
  - !8583  mmc: sdhci-msm: pervent access to suspended controller
  - ubifs: Set page uptodate in the correct place
  - !8693 【OLK-5.10】Fix some problems about patch "net: hns3: release PTP resources if pf initialization failed"
  - net: hns3: release PTP resources if pf initialization failed
  - Revert "net: hns3: release PTP resources if pf initialization failed"
  - x86/signal: Fix the value returned by strict_sas_size()
  - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  - tcp: properly terminate timers for kernel sockets
  - ACPI: bus: Ensure that notify handlers are not running after removal
  - crypto: hisilicon/qm - Add the default processing branch
  - crypto: hisilicon/debugfs - Resolve the problem of applying for redundant space in sq dump
  - crypto: hisilicon/sec - Fix memory leak for sec resource release
  - crypto: hisilicon - Adjust debugfs creation and release order
  - crypto: hisilicon/debugfs - Fix the processing logic issue in the debugfs creation
  - crypto: hisilicon/sgl - Delete redundant parameter verification
  - crypto: hisilicon/debugfs - Fix debugfs uninit process issue
  - crypto: hisilicon/sec - Add the condition for configuring the sriov function
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  - crypto: hisilicon/zip - fix the missing CRYPTO_ALG_ASYNC in cra_flags
  - !8646  Fix vf init and common user permissions issue
  - crypto: hisilicon - Fix smp_processor_id() warnings
  - !8534  riscv: process: Fix kernel gp leakage
  - !8542  octeontx2-af: Fix possible null pointer dereference.
  - phonet/pep: fix racy skb_queue_empty() use
  - !8642 v9  Memory access profiler(SPE) driven NUMA balancing
  - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
  - !8483 KVM: arm64: Translate logic cluster id to physical cluster id when updating lsudvmbm
  - net/ethernet/huawei/hiroce3: Fix vf init and common user permissions issue
  - !8461  i2c: smbus: fix NULL function pointer dereference
  - config: Enable memory sampling based pmu for numa balance by default
  - samples/bpf: Add program for memory access by spe
  - tracing, mem-sampling-sample: Adding tracking events to hardware-sampled page access
  - driver/arm/spe: making mem_sampling and perf mutually exclusive with spe driver
  - tracing, numa balance: add trace events for numa data caused by mem_sampling
  - mm/mem_sampling.c: Add controlling interface for mem_sampling on numa balance
  - mm/mem_sampling.c: Drive NUMA balancing via mem_sampling access data
  - sched: Enable per-process mem_sampling from sched switch path
  - mm/mem_sampling.c: Add controlling interface for mem_sampling
  - mm: Add PMU based memory sampling abstract layer
  - drivers/arm/spe: In-kernel SPE driver for page access profiling
  - !8555  rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
  - s390/qeth: Fix kernel panic after setting hsuid
  - ipv6: Fix potential uninit-value access in __ip6_make_skb()
  - batman-adv: Avoid infinite loop trying to resize local TT
  - erspan: make sure erspan_base_hdr is present in skb->head
  - fs/9p: only translate RWX permissions for plain 9P2000
  - netfilter: complete validation of user input
  - netfilter: validate user input for expected length
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
  - Revert "bpf, sockmap: Prevent lock inversion deadlock in map delete elem"
  - bpf: Allow delete from sockmap/sockhash only if update is allowed
  - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
  - netfilter: nf_tables: set dormant flag on hook register failure
  - Bluetooth: hci_core: Fix possible buffer overflow
  - geneve: fix header validation in geneve[6]_xmit_skb
  - net: stmmac: Disable Tx queues when reconfiguring the interface
  - virtio-blk: fix implicit overflow on virtio_max_dma_size
  - mmc: sdhci-msm: pervent access to suspended controller
  - xen-netfront: Add missing skb_mark_for_recycle
  - rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
  - tipc: fix a possible memleak in tipc_buf_append
  - ARM: 9381/1: kasan: clear stale stack poison
  - octeontx2-af: Fix possible null pointer dereference.
  - livepatch: Fix find wrong ftrace entry
  - riscv: process: Fix kernel gp leakage
  - KVM: arm64: Translate logic cluster id to physical cluster id when updating lsudvmbm
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - i2c: smbus: fix NULL function pointer dereference
  - RDMA/hns: Fix missing list_del in hns_roce_hem
  - RDMA/hns: Fix deadlock when using DCA debugfs.
  - RDMA/hns: Set NULL after mtr_node is freed
  - RDMA/hns: Fix missing validation check of DCA mem size
  - RDMA/hns: directly read the scc parameters in the driver instead of the firmware
  - RDMA/hns: Fix missing default values of scc parameters
  - RDMA/hns: Fix fmt output error
  - RDMA/hns: Fix cpu stuck by printings during reset
  - RDMA/hns: Fix CPU stuck due to read polling during reset
  - powerpc: defconfig: Disable CONFIG_DW_EDMA and CONFIG_DW_EDMA_PCIE
  - pipe: wakeup wr_wait after setting max_usage
  - fs/pipe: move check to pipe_has_watch_queue()
  - ACPI: video: check for error while searching for backlight device parent
  - ima: Define new template fields iuid and igid
  - ima: Add ima_show_template_uint() template library function
  - bpf: Protect against int overflow for stack access size
  - netfilter: nft_set_pipapo: do not free live element
  - fs: enable CONFIG_FILE_MITIGATION_FALSE_SHARING by default on arm64
  - fs: mitigatin cacheline false sharing in struct file


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-209.0.0.117
changelog:
  - !9092 v2  ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
  - !9030  bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - !9112  Backport some optimizing patches for kunpeng920
  - !9099  Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - !9166  A Solution to Re-enable hugetlb vmemmap optimize on ARM64
  - !9163  genirq: introduce handle_fasteoi_edge_irq flow handler
  - ARM: 9278/1: kfence: only handle translation faults
  - arm64: mm: HVO: support BBM of vmemmap pgtable safely
  - arm64: mm: kfence: only handle translation faults
  - mm: HVO: introduce helper function to update and flush pgtable
  - genirq: introduce handle_fasteoi_edge_irq for phytium
  - genirq: introduce handle_fasteoi_edge_irq flow handler
  - !8753  memcg: fix input of try_to_free_mem_cgroup_pages
  - !9149 [sync] PR-9054:  soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !9125  arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
  - !9138 v2  CVE-2024-36971
  - !8494  rpmsg: virtio: Free driver_override when rpmsg_remove()
  - !9073 v2  Fix UAF problem of hpool
  - soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !9131  mm: swap: fix race between free_swap_and_cache() and swapoff()
  - !9129  ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
  - !9068  Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - !8700  wifi: cfg80211: check A-MSDU format more carefully
  - net: fix kabi breakage in struct dst_ops
  - net: fix __dst_negative_advice() race
  - mm: swap: fix race between free_swap_and_cache() and swapoff()
  - ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
  - arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
  - !8999  scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - !8938  clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - arm64: syscall: unmask DAIF for tracing status
  - arm64: Snapshot thread flags
  - sched: Snapshot thread flags
  - entry: Snapshot thread flags
  - x86: Snapshot thread flags
  - thread_info: Add helpers to snapshot thread flags
  - irqchip/gic-v3: Use dsb(ishst) to order writes with ICC_SGI1R_EL1 accesses
  - sched/fair: Optimize test_idle_cores() for !SMT
  - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - !8940  firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - !8747  dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
  - !9074 [sync] PR-8963:  Fix CVE-2024-35915
  - !9083  Bluetooth: L2CAP: Fix not validating setsockopt user input
  - !9081 v2  arm64: mm: Replace global variable in pbha with static key
  - !9084 v5  xfs: atomic writes for xfs
  - block: fix kabi in struct queue_limits
  - xfs: make bunmapi observe forcealigin
  - xfs: Only free full extents for forcealign
  - xfs: Update xfs_is_falloc_aligned() mask for forcealign
  - xfs: fix set xflags fail when inode has extent hit
  - xfs: support atomic write ioctl
  - fs: xfs: Support setting FMODE_CAN_ATOMIC_WRITE
  - fs: xfs: Validate atomic writes
  - fs: xfs: Support FS_XFLAG_ATOMICWRITES for forcealign
  - fs: iomap: Atomic write support
  - fs: Add FS_XFLAG_ATOMICWRITES flag
  - fs: xfs: iomap: Sub-extent zeroing
  - fs: iomap: Sub-extent zeroing
  - fs: xfs: Do not free EOF blocks for forcealign
  - fs: xfs: Make file data allocations observe the 'forcealign' flag
  - fs: xfs: Enable file data forcealign feature
  - fs: xfs: Introduce FORCEALIGN inode flag
  - nvme: Atomic write support
  - block: Add core atomic write support
  - fs: Initial atomic write support
  - block: get atomic write max sectors
  - Bluetooth: L2CAP: Fix not validating setsockopt user input
  - arm64: mm: Replace global variable in pbha with static key
  - !9064 drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - !9067  config: enable CONFIG_BLK_CGROUP_IOCOST by default
  - !9063 v3  block: support to dispatch bio asynchronously
  - !9066 change sdma-dae default mode to n
  - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_rx_work
  - nfc: nci: Fix kcov check in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
  - !8827 v2  iomap: fix sub-page not set dirty state
  - mm/dynamic_hugetlb: use rcu lock to protect hpool
  - mm/dynamic_hugetlb: simplify the refcount code
  - drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - !9059 roh/hns3: Add ROH client case in hclgevf_init_client_instance.
  - !9055  CVE-2024-36020
  - !9015  CVE-2024-36953
  - !9014  drm/vc4: don't check if plane->state->fb == state->fb
  - Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - config: enable CONFIG_BLK_CGROUP_IOCOST by default
  - drivers: misc: sdma-dae: not compile sdma-dae by default
  - block: fix kabi broken in struct request_queue about CONFIG_BLK_BIO_DISPATCH_ASYNC
  - block: support to dispatch bio asynchronously
  - !9050  CVE-2024-35796
  - roh/hns3: Add ROH client case in hclgevf_init_client_instance.
  - i40e: fix vf may be used uninitialized in this function warning
  - !9020  wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - net: ll_temac: platform_get_resource replaced by wrong function
  - !7205  mm: memcontrol: do not miss MEMCG_MAX events for enforced allocations
  - !8908  Refactor hbmdev a bit
  - !9001 roh/hns3: Fix IMP reset vlan unusable.
  - !8774  CVE-2024-36914
  - !9027  tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - !8828  drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
  - !8719  CVE-2024-35887
  - !8872  drm/vmwgfx: Fix invalid reads in fence signaled events
  - !8882  scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - !8921  hugetlbfs: fix hugetlbfs_statfs() locking
  - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
  - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
  - drm/vc4: don't check if plane->state->fb == state->fb
  - roh/hns3: Fix IMP reset vlan unusable.
  - !8965  cvm: enhance security for cvm host feature
  - !8982  fix CVE-2024-36905
  - !8996  pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
  - net: relax socket state check at accept time.
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
  - cvm: enhance security for cvm host feature
  - firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - hugetlbfs: fix hugetlbfs_statfs() locking
  - arm64: config: Open the hbmdev related config
  - soc: hisilicon: Don't poweroff if memblocks don't offlined
  - soc: hisilicon: hisi_hbmdev: Notify the device in the ACPI
  - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - drm/vmwgfx: Fix invalid reads in fence signaled events
  - drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
  - iomap: Ensure sub-page dirty state is set during mmap writes
  - Revert "iomap: Don't create iomap_page objects in iomap_page_mkwrite_actor"
  - drm/amd/display: Skip on writeback when it's not applicable
  - memcg: fix input of try_to_free_mem_cgroup_pages
  - dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - ax25: fix use-after-free bugs caused by ax25_ds_del_timer
  - wifi: cfg80211: check A-MSDU format more carefully
  - rpmsg: virtio: Free driver_override when rpmsg_remove()
  - mm: memcontrol: do not miss MEMCG_MAX events for enforced allocations


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-215.0.0.119
changelog:
  - !8098  netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  - !5860  ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
  - !9421 v3  block: fix WARNING in init_blk_queue_async_dispatch
  - block: fix WARNING in init_blk_queue_async_dispatch
  - !9391  fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
  - fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
  - !9327  af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - !9264  ring-buffer: Fix a race between readers and resize checks
  - !9305  CVE-2024-26661 following bugfix
  - !9246  ksmbd: no response from compound read
  - !9350  tracing: Fix permissions for the buffer_percent file
  - tracing: Fix permissions for the buffer_percent file
  - !9347  sched: ARM64 enables SIS_PROP and disables SIS_UTIL"
  - sched: ARM64 enables SIS_PROP and disables SIS_UTIL"
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - !9318  Revert "sched/fair:ARM64 enables SIS_UTIL and disables SIS_PROP"
  - Revert "sched/fair:ARM64 enables SIS_UTIL and disables SIS_PROP"
  - drm/amd/display: Fix && vs || typos
  - drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'
  - Revert "drm/amd/display: Fix && vs || typos"
  - !9268  net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - !9103  ksmbd: no response from compound read
  - !9186  spi: Fix deadlock when adding SPI controllers on SPI buses
  - !9283 hns3 udma: support non share jfr mode in UM
  - !9277 ima: Fix violation digests extending issue in cvm
  - hns3 udma: kernel support non share jfr mode in UM mode
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - ring-buffer: Fix a race between readers and resize checks
  - !9244 urma: cannot uninstall uburma driver
  - !9250  Fix token error issue when concurrent calls
  - !9241 v2  Bugfix backport for rcu
  - urma: cannot uninstall uburma driver
  - Fix token error issue when concurrent calls
  - !9180  wifi: wilc1000: fix RCU usage in connect path
  - !9212  drm/amd/display: Fix division by zero in setup_dsc_config
  - ksmbd: no response from compound read
  - ima: Fix violation digests extending issue in cvm
  - !9239  Fix allmodconfig build frame size error
  - !9207 v2  sched: smart_grid: fix potential NULL pointer dereference
  - srcu: Fix callbacks acceleration mishandling
  - entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up
  - rcu: Defer RCU kthreads wakeup when CPU is dying
  - RDMA/hiroce3: Fix allmodconfig build frame size error
  - !7729  loop: use lo->lo_disk for kobject_uevent
  - !9211  memcg: attach memcg async reclaim worker to curcpu
  - !9168  UBIFS: fixes a series of issues that caused by power cut
  - !9000  media: tc358743: register v4l2 async device only after successful setup
  - !9087  fs/9p: fix uninitialized values during inode evict
  - drm/amd/display: Fix division by zero in setup_dsc_config
  - memcg: attach memcg async reclaim worker to curcpu
  - sched: smart_grid: fix potential NULL pointer dereference
  - spi: fix kabi breakage in struct spi_controller
  - spi: fix use-after-free of the add_lock mutex
  - spi: Fix deadlock when adding SPI controllers on SPI buses
  - wifi: wilc1000: fix RCU usage in connect path
  - ubifs: dbg_orphan_check: Fix missed key type checking
  - ubifs: Fix unattached inode when powercut happens in creating
  - ubifs: Fix space leak when powercut happens in linking tmpfile
  - ubifs: Move ui->data initialization after initializing security
  - ubifs: Fix adding orphan entry twice for the same inode
  - ubifs: Remove insert_dead_orphan from replaying orphan process
  - ubifs: Don't add xattr inode into orphan area
  - ubifs: Fix unattached xattr inode if powercut happens after deleting
  - ubifs: Fix some kernel-doc comments
  - ubifs: Fix spelling mistakes
  - ksmbd: no response from compound read
  - fs/9p: fix uninitialized values during inode evict
  - media: tc358743: register v4l2 async device only after successful setup
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  - loop: use lo->lo_disk for kobject_uevent
  - ksmbd: fix UAF issue in ksmbd_tcp_new_connection()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-217.0.0.120
changelog:
  - !9160  xfs: don't use current->journal_info
  - !9429  usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  - !9644  fix uaf when proc_cpuset_show
  - !9532  CVE-2024-37356
  - !9496  netrom: fix possible dead-lock in nr_rt_ioctl()
  - cgroup: fix uaf when proc_cpuset_show
  - !9514  RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - !9559  CVE-2024-38597
  - !9039 [OLK-5.10] drm/phytium: Replace default efi fb0 with dc fb
  - !9595  drm/arm/malidp: fix a possible null pointer dereference
  - !9593  ARM: 9170/1: fix panic when kasan and kprobe are enabled
  - !9504  um: Add winch to winch_handlers before registering winch IRQ
  - drm/arm/malidp: fix a possible null pointer dereference
  - ARM: 9170/1: fix panic when kasan and kprobe are enabled
  - !9587  s390/ap: Fix crash in AP internal function modify_bitmap()
  - s390/ap: Fix crash in AP internal function modify_bitmap()
  - !9569  net: fec: remove .ndo_poll_controller to avoid deadlocks
  - !9540  net/mlx5e: Avoid field-overflowing memcpy()
  - !9577 v2  btrfs: fix crash on racing fsync and size-extending write into prealloc
  - !9563  fs/ntfs3: Check 'folio' pointer for NULL
  - !9383  serial: max3100: Update uart_driver_registered on driver removal
  - btrfs: fix crash on racing fsync and size-extending write into prealloc
  - !8744  ext4 bugfix from mainline
  - !9499  ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - !9500  netfilter: nf_tables: flush pending destroy work before exit_net release
  - !9453  jffs2: prevent xattr node from overflowing the eraseblock
  - !9202  dyndbg: fix old BUG_ON in >control parser
  - !9193  wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  - !9201  ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  - !9190  clk: Fix clk_core_get NULL dereference
  - !9188  net: phy: fix phy_get_internal_delay accessing an empty array
  - !9462 v2  CVE-2024-27032
  - !9408  drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - !9447  rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - !9425  ASoC: SOF: Fix DSP oops stack dump output contents
  - !9321  drm/amd/display: Fix potential index out of bounds in color transformation function
  - !9297  CVE-2021-47599
  - !9401  Fix CVE-2024-31076
  - !9434  cvm: delete dead code and resolve macro definition holes
  - !9395  CVE-2024-38587
  - !9386  vfio/pci: fix potential memory leak in vfio_intx_enable()
  - !9199  init/main.c: Fix potential static_command_line memory overflow
  - !8683 v4  Fix CVE-2024-35879
  - !9339  serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - !9470  net/mlx5: Add a timeout to acquire the command queue semaphore
  - !9442  net/mlx5: Discard command completions in internal error
  - !9290  net: bridge: xmit: make sure we have at least eth header len bytes
  - !9284  of: module: add buffer overflow check in of_modalias()
  - !9477  watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - !9544  ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - !9483  fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - !9558  CVE-2024-39362
  - !9456  bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - !9527  media: lgdt3306a: Add a check against null-pointer-def
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
  - fs/ntfs3: Check 'folio' pointer for NULL
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
  - i2c: acpi: Unbind mux adapters before delete
  - i2c: add fwnode APIs
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - net/mlx5e: Avoid field-overflowing memcpy()
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
  - params: lift param_set_uint_minmax to common code
  - media: lgdt3306a: Add a check against null-pointer-def
  - !9511  blk-throttle: check for overflow in calculate_bytes_allowed
  - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - blk-throttle: check for overflow in calculate_bytes_allowed
  - blk-throttle: use calculate_io/bytes_allowed() for throtl_trim_slice()
  - blk-throttle: factor out code to calculate ios/bytes_allowed
  - !9507  Enable SIS_UTIL for arm64 and optimize load_balance
  - !9508  Revert "fs: Use CHECK_DATA_CORRUPTION() when
  - Revert "fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected"
  - config: Disable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64
  - sched/numa: Fix numa imbalance in load_balance()
  - Revert "Revert "sched/fair:ARM64 enables SIS_UTIL and disables SIS_PROP""
  - Revert "sched: ARM64 enables SIS_PROP and disables SIS_UTIL""
  - !9333  net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - um: Add winch to winch_handlers before registering winch IRQ
  - netfilter: nf_tables: flush pending destroy work before exit_net release
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - netrom: fix possible dead-lock in nr_rt_ioctl()
  - fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - net/mlx5: Add a timeout to acquire the command queue semaphore
  - f2fs: fix to avoid potential panic during recovery
  - f2fs: fix to check return value of f2fs_reserve_new_block()
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - jffs2: prevent xattr node from overflowing the eraseblock
  - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - net/mlx5: Discard command completions in internal error
  - cvm: delete dead code and resolve macro definition holes
  - usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  - ASoC: SOF: Fix DSP oops stack dump output contents
  - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
  - speakup: Fix sizeof() vs ARRAY_SIZE() bug
  - vfio/pci: fix potential memory leak in vfio_intx_enable()
  - serial: max3100: Update uart_driver_registered on driver removal
  - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - drm/amd/display: Fix potential index out of bounds in color transformation function
  - btrfs: remove stale comment about the btrfs_show_devname
  - btrfs: update latest_dev when we create a sprout device
  - btrfs: use latest_dev in btrfs_show_devname
  - btrfs: convert latest_bdev type to btrfs_device and rename
  - net: bridge: xmit: make sure we have at least eth header len bytes
  - of: module: add buffer overflow check in of_modalias()
  - dyndbg: fix old BUG_ON in >control parser
  - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  - init/main.c: Fix potential static_command_line memory overflow
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  - clk: Fix clk_core_get NULL dereference
  - net: phy: fix phy_get_internal_delay accessing an empty array
  - xfs: don't use current->journal_info
  - drm/phytium: Replace default efi fb0 with dc fb
  - ext4: fix warning in ext4_dio_write_end_io()
  - ext4: properly sync file size update after O_SYNC direct IO
  - iomap: update ki_pos a little later in iomap_dio_complete
  - driver core: Fix kabi broken
  - of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
  - driver core: Introduce device_link_wait_removal()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-218.0.0.121
changelog:
  - !9851  net/sched: act_skbmod: prevent kernel-infoleak
  - !9853  nilfs2: fix use-after-free of timer for log writer thread
  - !9831  mmc: davinci: Don't strip remove function when driver is builtin
  - !8096  Fix CVE-2024-35988
  - nilfs2: fix use-after-free of timer for log writer thread
  - net/sched: act_skbmod: prevent kernel-infoleak
  - mmc: davinci: Don't strip remove function when driver is builtin
  - !9643  f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
  - !9820  kdb: Fix buffer overflow during tab-complete
  - kdb: Fix buffer overflow during tab-complete
  - !9799  null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
  - !9783  CVE-2024-38598
  - !9772  btrfs: fix use-after-free after failure to create a snapshot
  - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
  - !9792 v3  net: fix one NULL pointer dereference bug in net_rship module
  - !9795  drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
  - !9363  fs/ntfs3: Use variable length array instead of fixed size
  - !9712  fix CVE-2024-38540
  - drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
  - net: fix one NULL pointer dereference bug in net_rship module
  - md: fix resync softlockup when bitmap size is less than array size
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
  - Revert "md/raid10: fix slab-out-of-bounds in md_bitmap_get_counter"
  - !9373  ALSA: core: Fix NULL module pointer assignment at card init
  - !9616 v2  wifi: carl9170: add a proper sanity check for endpoints
  - !9538  virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - !9766  f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
  - !9768  iomap: Don't finish dio under irq when there exists pages
  - !9753 v2  arm64: arm_pmuv3: Correctly extract and check the PMUVer
  - !9731 v2  Backport bpf bugfixes
  - btrfs: fix use-after-free after failure to create a snapshot
  - iomap: Don't finish dio under irq when there exists pages
  - !9719  KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
  - !9764  wifi: ar5523: enable proper endpoint verification
  - !9711  fix CVE-2024-38615
  - !9761  CVE-2024-26816
  - !9756  net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
  - wifi: ar5523: enable proper endpoint verification
  - !9716  ax25: Fix reference count leak issues of ax25_dev
  - x86/boot: Ignore relocations in .notes sections in walk_relocs() too
  - x86, relocs: Ignore relocations in .notes section
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - arm64: arm_pmuv3: Correctly extract and check the PMUVer
  - !9672  ax25: Fix reference count leak issue of net_device
  - !9735  net/9p: fix uninit-value in p9_client_rpc()
  - !9572  dma-mapping: benchmark: handle NUMA_NO_NODE correctly
  - !9571  media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
  - net/9p: fix uninit-value in p9_client_rpc()
  - bpf: ensure main program has an extable
  - bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen
  - bpf: Fix __reg_bound_offset 64->32 var_off subreg propagation
  - bpf: Clobber stack slot when writing over spilled PTR_TO_BTF_ID
  - bpf: Fix memory leaks in __check_func_call
  - !9440  fix CVE-2024-38621
  - !9705  net/hinic3: Add pcie device ID adaption for DPU_NIC card
  - KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
  - ax25: Fix reference count leak issues of ax25_dev
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
  - cpufreq: exit() callback is optional
  - cpufreq: Rearrange locking in cpufreq_remove_dev()
  - cpufreq: Split cpufreq_offline()
  - cpufreq: Reorganize checks in cpufreq_offline()
  - !9701  dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - net/hinic3: Add pcie device ID adaption for DPU_NIC card
  - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - !9640  CVE-2024-38582
  - !9662  tls: fix missing memory barrier in tls_init
  - !9657 v2  CVE-2024-38586
  - !9686  greybus: lights: check return of get_channel_from_mode
  - !9675  crypto: bcm - Fix pointer arithmetic
  - greybus: lights: check return of get_channel_from_mode
  - crypto: bcm - Fix pointer arithmetic
  - ax25: Fix reference count leak issue of net_device
  - tls: fix missing memory barrier in tls_init
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets.
  - r8169: remove nr_frags argument from rtl_tx_slots_avail
  - r8169: improve rtl8169_start_xmit
  - r8169: improve rtl_tx
  - r8169: use READ_ONCE in rtl_tx_slots_avail
  - r8169: remove unneeded memory barrier in rtl_tx
  - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
  - nilfs2: fix potential hang in nilfs_detach_log_writer()
  - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
  - wifi: carl9170: add a proper sanity check for endpoints
  - dma-mapping: benchmark: handle NUMA_NO_NODE correctly
  - media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
  - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - media: stk1160: fix bounds checking in stk1160_copy_video()
  - ALSA: core: Fix NULL module pointer assignment at card init
  - fs/ntfs3: Use variable length array instead of fixed size
  - riscv: Fix TASK_SIZE on 64-bit NOMMU
  - riscv: fix VMALLOC_START definition


author: Li Nan <linan122@huawei.com> - 5.10.0-219.0.0.122
changelog:
  - !9850  power: supply: bq27xxx-i2c: Do not free non existing IRQ
  - !10031  ipv6: prevent possible NULL dereference in rt6_probe()
  - !10060  ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  - !9984  nilfs2: fix potential kernel bug due to lack of writeback flag waiting
  - !9990  netpoll: Fix race condition in netpoll_owner_active
  - !10040  lib/generic-radix-tree.c: Don't overflow in peek()
  - !9950  f2fs: remove clear SB_INLINECRYPT flag in default_options
  - !9968  CVE-2024-40972
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  - !9926  ocfs2: fix races between hole punching and AIO+DIO
  - !9910  arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
  - !9908  sock_map: avoid race between sock_map_close and sk_psock_put
  - !9946  ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
  - !9936  fix CVE-2024-40934
  - !9953  drm/komeda: check for error-valued pointer
  - lib/generic-radix-tree.c: Don't overflow in peek()
  - ipv6: prevent possible NULL dereference in rt6_probe()
  - netpoll: Fix race condition in netpoll_owner_active
  - nilfs2: fix potential kernel bug due to lack of writeback flag waiting
  - ext4: do not create EA inode under buffer lock
  - ext4: fold quota accounting into ext4_xattr_inode_lookup_create()
  - !9871  cifs: Fix deadlock in cifs_writepages during reconnect
  - drm/komeda: check for error-valued pointer
  - !9897  ionic: fix use after netif_napi_del()
  - !9924  drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
  - !9905  mptcp: ensure snd_una is properly initialized on connect
  - f2fs: remove clear SB_INLINECRYPT flag in default_options
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
  - !9893  bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  - HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()
  - ocfs2: fix races between hole punching and AIO+DIO
  - drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
  - !9884 roh/core: Support macvlan in roh.
  - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
  - !9827  ksmbd: fix slab out of bounds write in smb_inherit_dacl()
  - !9825  smb: client: fix potential deadlock when releasing mids
  - !9839  cgroup: Fix AA deadlock caused by cgroup_bpf_release
  - !9889  ipv6: sr: fix memleak in seg6_hmac_init_algo
  - sock_map: avoid race between sock_map_close and sk_psock_put
  - mptcp: ensure snd_una is properly initialized on connect
  - ionic: fix use after netif_napi_del()
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  - ipv6: sr: fix memleak in seg6_hmac_init_algo
  - !9368  CVE-2024-27416
  - !9879  fs: improve dump_mapping() robustness
  - !9872  CVE-2024-38570
  - !9881 v2  iommu/arm-smmu-v3: Change the style to identify the the hisi_platform
  - iommu/arm-smmu-v3: Change the style to identify the the hisi_platform
  - fs: improve dump_mapping() robustness
  - roh/core: Support macvlan in roh.
  - gfs2: Fix potential glock use-after-free on unmount
  - gfs2: Rename sd_{ glock => kill }_wait
  - cifs: Fix deadlock in cifs_writepages during reconnect
  - !9745  CVE-2024-39469
  - !9843  xfs: fix log recovery buffer allocation for the legacy h_size fixup
  - power: supply: bq27xxx-i2c: Do not free non existing IRQ
  - xfs: fix log recovery buffer allocation for the legacy h_size fixup
  - cgroup: Fix AA deadlock caused by cgroup_bpf_release
  - ksmbd: fix slab out of bounds write in smb_inherit_dacl()
  - smb: client: fix potential deadlock when releasing mids
  - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
  - nilfs2: return the mapped address from nilfs_get_page()
  - Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST


author: Li Nan <linan122@huawei.com> - 5.10.0-220.0.0.123
changelog:
  - !9035  keys: Fix overwrite of key expiration on instantiation
  - !9182  netfilter: nf_tables: restore set elements when delete set fails
  - !10184 [RoCE]从社区回合patch到openEuler（OLK-5.10）
  - !10303  netfilter: nf_tables: do not compare internal table flags on updates
  - !10258  batman-adv: bypass empty buckets in batadv_purge_orig_ref()
  - !10280 v2  CVE-2022-48816
  - !9780  ksmbd: fix wrong DataOffset validation of create context
  - !10278  usb-storage: alauda: Check whether the media is initialized
  - netfilter: nf_tables: do not compare internal table flags on updates
  - !10262  media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
  - !10290 Backport 5.10.210 LTS patches from upstream
  - PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq()
  - net: bcmgenet: Fix EEE implementation
  - drm/msm/dsi: Enable runtime PM
  - PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
  - PM: runtime: add devm_pm_runtime_enable helper
  - nilfs2: replace WARN_ONs for invalid DAT metadata block requests
  - sched/membarrier: reduce the ability to hammer on sys_membarrier
  - Revert "arm64: Stash shadow stack pointer in the task struct on interrupt"
  - hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range()
  - scripts/decode_stacktrace.sh: optionally use LLVM utilities
  - scripts: decode_stacktrace: demangle Rust symbols
  - scripts/decode_stacktrace.sh: support old bash version
  - scripts/decode_stacktrace.sh: silence stderr messages from addr2line/nm
  - serial: 8250_exar: Set missing rs485_supported flag
  - serial: 8250_exar: Fill in rs485_supported
  - serial: Add rs485_supported to uart_port
  - mips: Fix max_mapnr being uninitialized on early stages
  - PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support
  - bus: moxtet: Add spi device table
  - Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
  - tracing: Inform kmemleak of saved_cmdlines allocation
  - pmdomain: core: Move the unused cleanup to a _sync initcall
  - of: property: fix typo in io-channels
  - s390/qeth: Fix potential loss of L3-IP@ in case of network issues
  - irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update
  - irqchip/irq-brcmstb-l2: Add write memory barrier before exit
  - wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()
  - nfp: flower: prevent re-adding mac index for bonded port
  - nfp: use correct macro for LengthSelect in BAR config
  - ALSA: hda/conexant: Add quirk for SWS JS201D
  - mmc: slot-gpio: Allow non-sleeping GPIO ro
  - x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
  - x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
  - serial: max310x: improve crystal stable clock detection
  - serial: max310x: set default value when reading clock ready bit
  - ring-buffer: Clean ring_buffer_poll_wait() error return
  - iio: accel: bma400: Fix a compilation problem
  - staging: iio: ad5933: fix type mismatch regression
  - tracing: Fix wasted memory in saved_cmdlines logic
  - misc: fastrpc: Mark all sessions as invalid in cb_remove
  - ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
  - xen-netback: properly sync TX responses
  - kbuild: Fix changing ELF file type for output of gen_btf for big endian
  - firewire: core: correct documentation of fw_csr_string() kernel API
  - lsm: fix the logic in security_inode_getsecctx()
  - scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
  - modpost: trim leading spaces when processing source files list
  - usb: f_mass_storage: forbid async queue when shutdown happen
  - USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
  - usb: ucsi_acpi: Fix command completion handling
  - HID: wacom: Do not register input devices until after hid_hw_start
  - HID: wacom: generic: Avoid reporting a serial of '0' to userspace
  - ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx
  - ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift 1 SF114-32
  - i40e: Fix waiting for queues of all VSIs to be disabled
  - MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
  - net: sysfs: Fix /sys/class/net/<iface> path for statistics
  - ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
  - spi: ppc4xx: Drop write-only variable
  - of: unittest: Fix compile in the non-dynamic case
  - btrfs: send: return EOPNOTSUPP on unknown flags
  - btrfs: forbid deleting live subvol qgroup
  - btrfs: forbid creating subvol qgroups
  - Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
  - Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
  - usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK
  - USB: serial: cp210x: add ID for IMST iM871A-USB
  - USB: serial: option: add Fibocom FM101-GL variant
  - USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
  - net/af_iucv: clean up a try_then_request_module()
  - netfilter: nft_ct: reject direction for ct id
  - netfilter: nft_compat: restrict match/target protocol to u16
  - netfilter: nft_compat: reject unused compat flag
  - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
  - rxrpc: Fix response to PING RESPONSE ACKs to a dead call
  - hwmon: (coretemp) Fix bogus core_id to attr name mapping
  - hwmon: (coretemp) Fix out-of-bounds memory access
  - hwmon: (aspeed-pwm-tacho) mutex for tach reading
  - atm: idt77252: fix a memleak in open_card_ubr0
  - selftests: net: avoid just another constant wait
  - drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case
  - dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
  - phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
  - dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
  - dmaengine: ti: k3-udma: Report short packet errors
  - dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools
  - bonding: remove print in bond_verify_device_path
  - HID: apple: Add 2021 magic keyboard FN key mapping
  - HID: apple: Add support for the 2021 Magic Keyboard
  - net: sysfs: Fix /sys/class/net/<iface> path
  - net: ipv4: fix a memleak in ip_setup_cork
  - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
  - netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
  - ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
  - ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
  - ixgbe: Refactor overtemp event handling
  - ixgbe: Refactor returning internal error codes
  - ixgbe: Remove non-inclusive language
  - scsi: isci: Fix an error code problem in isci_io_request_build()
  - drm: using mul_u32_u32() requires linux/math64.h
  - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
  - perf: Fix the nr_addr_filters fix
  - drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
  - drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()'
  - virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
  - libsubcmd: Fix memory leak in uniq()
  - PCI/AER: Decode Requester ID when no error info found
  - fs/kernfs/dir: obey S_ISGID
  - tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
  - usb: hub: Replace hardcoded quirk value with BIT() macro
  - PCI: Only override AMD USB controller if required
  - mfd: ti_am335x_tscadc: Fix TI SoC dependencies
  - xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
  - i3c: master: cdns: Update maximum prescaler value for i2c clock
  - um: net: Fix return type of uml_net_start_xmit()
  - um: Don't use vfprintf() for os_info()
  - um: Fix naming clash between UML and scheduler
  - leds: trigger: panic: Don't register panic notifier if creating the trigger failed
  - drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
  - drm/amdgpu: Let KFD sync with VM fences
  - watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
  - clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
  - clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
  - drm/msm/dpu: Ratelimit framedone timeout msgs
  - media: ddbridge: fix an error code problem in ddb_probe
  - drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
  - ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL
  - ALSA: hda: Intel: add HDA_ARL PCI ID support
  - PCI: add INTEL_HDA_ARL to pci_ids.h
  - media: rockchip: rga: fix swizzling for RGB formats
  - media: stk1160: Fixed high volume of stk1160_dbg messages
  - drm/mipi-dsi: Fix detach call without attach
  - drm/framebuffer: Fix use of uninitialized variable
  - drm/drm_file: fix use of uninitialized variable
  - f2fs: fix write pointers on zoned device after roll forward
  - drm/amd/display: Fix tiled display misalignment
  - fast_dput(): handle underflows gracefully
  - ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
  - ALSA: hda: Refer to correct stream index at loops
  - i40e: Fix VF disable behavior to block all traffic
  - Bluetooth: L2CAP: Fix possible multiple reject send
  - Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
  - wifi: cfg80211: free beacon_ies when overridden from hidden BSS
  - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
  - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
  - arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
  - arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
  - md: Whenassemble the array, consult the superblock of the freshest device
  - block: prevent an integer overflow in bvec_try_merge_hw_page
  - net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
  - ARM: dts: imx23/28: Fix the DMA controller node name
  - ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
  - ARM: dts: imx27-apf27dev: Fix LED name
  - ARM: dts: imx25/27: Pass timing0
  - ARM: dts: imx25: Fix the iim compatible string
  - ionic: pass opcode to devcmd_wait
  - ARM: dts: imx1: Fix sram node
  - ARM: dts: imx27: Fix sram node
  - ARM: dts: imx: Use flash@0,0 pattern
  - ARM: dts: imx25/27-eukrea: Fix RTC node name
  - ARM: dts: rockchip: fix rk3036 hdmi ports node
  - bpf: Set uattr->batch.count as zero before batched update or deletion
  - scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
  - scsi: libfc: Don't schedule abort twice
  - ARM: dts: imx7s: Fix nand-controller #size-cells
  - ARM: dts: imx7s: Fix lcdif compatible
  - ARM: dts: imx7d: Fix coresight funnel ports
  - scsi: arcmsr: Support new PCI device IDs 1883 and 1886
  - bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
  - PCI: Add no PM reset quirk for NVIDIA Spectrum devices
  - selftests/bpf: Fix pyperf180 compilation failure with clang18
  - selftests/bpf: satisfy compiler by having explicit return in btf test
  - ext4: fix inconsistent between segment fstrim and full fstrim
  - ecryptfs: Reject casefold directory inodes
  - rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
  - afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
  - afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
  - crypto: stm32/crc32 - fix parsing list of devices
  - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - ACPI: extlog: fix NULL pointer dereference check
  - PNP: ACPI: fix fortify warning
  - ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
  - audit: Send netlink ACK before setting connection in auditd_set
  - regulator: core: Only increment use_count when enable_count changes
  - debugobjects: Stop accessing objects after releasing hash bucket lock
  - perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
  - x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
  - powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
  - powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
  - powerpc: Fix build error due to is_valid_bugaddr()
  - drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
  - x86/entry/ia32: Ensure s32 is sign extended to s64
  - tick/sched: Preserve number of idle sleeps across CPU hotplug events
  - mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
  - spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
  - gpio: eic-sprd: Clear interrupt after set the interrupt type
  - drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
  - drm/exynos: fix accidental on-stack copy of exynos_drm_plane
  - drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
  - arm64: dts: qcom: sc7180: fix USB wakeup interrupt types
  - arm64: dts: qcom: sc7180: Use pdc interrupts for USB instead of GIC interrupts
  - ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12
  - drm/bridge: nxp-ptn3460: simplify some error checking
  - drm/tidss: Fix atomic_flush check
  - drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
  - gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
  - exec: Fix error handling in begin_new_exec()
  - rbd: don't move requests to the running list on errors
  - btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
  - btrfs: don't warn if discard range is not aligned to sector
  - btrfs: tree-checker: fix inline ref size in error messages
  - btrfs: ref-verify: free ref cache before clearing mount opt
  - net: fec: fix the unhandled context fault from smmu
  - fjes: fix memleaks in fjes_hw_setup
  - selftests: netdevsim: fix the udp_tunnel_nic test
  - net: mvpp2: clear BM pool before initialization
  - netfilter: nf_tables: validate NFPROTO_* family
  - netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
  - net/mlx5: DR, Use the right GVMI number for drop action
  - tcp: Add memory barrier to tcp_push()
  - afs: Hide silly-rename files from userspace
  - vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
  - bnxt_en: Wait for FLR to complete during probe
  - mm: vmalloc: introduce array allocation functions
  - block: Remove special-casing of compound pages
  - nouveau/vmm: don't set addr on the fail path to avoid warning
  - rtc: Adjust failure return code for cmos_set_alarm()
  - mmc: mmc_spi: remove custom DMA mapped buffers
  - mmc: core: Use mrq.sbc in close-ended ffu
  - scripts/get_abi: fix source path leak
  - lsm: new security_file_ioctl_compat() hook
  - arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
  - arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
  - parisc/firmware: Fix F-extend for PDC addresses
  - PM: hibernate: Enforce ordering during image compression/decompression
  - crypto: api - Disallow identical driver names
  - ext4: allow for the last group to be marked as trimmed
  - iio:adc:ad7091r: Move exports into IIO_AD7091R namespace.
  - iio: adc: ad7091r: Enable internal vref if external vref is not supplied
  - iio: adc: ad7091r: Allow users to configure device events
  - iio: adc: ad7091r: Set alert bit in config register
  - serial: sc16is7xx: add check for unsupported SPI modes during probe
  - spi: introduce SPI_MODE_X_MASK macro
  - serial: sc16is7xx: set safe default SPI clock frequency
  - units: add the HZ macros
  - units: change from 'L' to 'UL'
  - PCI: mediatek: Clear interrupt status before dispatching handler
  - usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled
  - usb: cdns3: fix iso transfer error when mult is not zero
  - usb: cdns3: fix incorrect calculation of ep_buf_size when more than one config
  - usb: cdns3: fix uvc failure work since sg support enabled
  - usb: cdns3: Fixes for sparse warnings
  - !10246  ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
  - !10224  scsi: ufs: Fix a deadlock in the error handler
  - SUNRPC: Do not dereference non-socket transports in sysfs
  - SUNRPC: lock against ->sock changing during sysfs read
  - !10245  Bluetooth: hci_core: Fix leaking sent_cmd skb
  - usb-storage: alauda: Check whether the media is initialized
  - !10232  fix CVE-2024-41007
  - !10202  net: dsa: seville: register the mdiobus under devres
  - !10266  USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - !9430  CVE-2022-48703
  - !10255  dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
  - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
  - !10189  fix CVE-2024-40915
  - !10187  fix CVE-2021-47205
  - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
  - RDMA/hns: Fix mbx timing out before CMD execution is completed
  - RDMA/hns: Fix insufficient extend DB for VFs.
  - RDMA/hns: Fix undifined behavior caused by invalid max_sge
  - RDMA/hns: Fix shift-out-bounds when max_inline_data is 0
  - RDMA/hns: Fix missing pagesize and alignment check in FRMR
  - RDMA/hns: Fix unmatch exception handling when init eq table fails
  - RDMA/hns: Check atomic wr length
  - ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
  - !10210 hns3 udma: functions related to CQ bank IDs are supported.
  - !10194  sched/fair: Take the scheduling domain into account in select_idle_core()
  - Bluetooth: hci_core: Fix leaking sent_cmd skb
  - !10179 [22.03-LTS-SP3]net:openvswitch: Before calling ovs_vport_send, check the link status of vport->dev
  - !9913  powerpc/pseries: Enforce hcall result buffer validity and size
  - !10217  CVE-2024-35931
  - !10061 Backport bugfixes for RDMA/hns from mainline linux
  - !10046  nfs: Ensure that the NFS client returns a correct writeback error code
  - tcp: avoid too many retransmit packets
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
  - !10222  bpf: Fix overrunning reservations in ringbuf
  - !10203  dma-mapping: benchmark: fix node id validation
  - !9817  arm64: mm: Pass pbha-performance-only bit under chosen node
  - !10019  drm/exynos/vidi: fix memory leak in .get_modes()
  - !10178  ima: Fix use-after-free on a dentry's dname.name
  - scsi: ufs: Fix a deadlock in the error handler
  - bpf: Fix overrunning reservations in ringbuf
  - drm/amdgpu: Fix kabi breakage in struct amdgpu_hive_info
  - drm/amdgpu: Skip do PCI error slot reset during RAS recovery
  - drm/amdgpu : Add hive ras recovery check
  - hns3 udma: functions related to CQ bank IDs are supported.
  - !10135  ALSA: timer: Set lower bound of start tick time
  - !10104  ecryptfs: Fix buffer size for tag 66 packet
  - dma-mapping: benchmark: fix node id validation
  - net: dsa: seville: register the mdiobus under devres
  - !10138 [sync] PR-10095:  CVE-2024-40968
  - sched/fair: Take the scheduling domain into account in select_idle_core()
  - !10107  tracing: Build event generation tests only as modules
  - riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context
  - clk: sunxi-ng: Unregister clocks/resets when unbinding
  - !10156 v2  wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - !9836  fpga: manager: add owner module and take its refcount
  - net: openvswitch: fix race on port output
  - ima: Fix use-after-free on a dentry's dname.name
  - !10165  drop_monitor: replace spin_lock by raw_spin_lock
  - !10162  RDMA/mlx5: Add check for srq max_sge attribute
  - !10048  tipc: force a dst refcount before doing decryption
  - !10022  liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - !10150  mips: bmips: BCM6358: make sure CBR is correctly set
  - drop_monitor: replace spin_lock by raw_spin_lock
  - RDMA/mlx5: Add check for srq max_sge attribute
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - mips: bmips: BCM6358: make sure CBR is correctly set
  - MIPS: Octeon: Add PCIe link status check
  - !10041  Fix CVE-2024-36939
  - !10128  wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - ALSA: timer: Set lower bound of start tick time
  - !10118  wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - !10079  drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - !10052  vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - !10009  xfs: fix mount hung while sb recover fail
  - !10088  fix CVE-2024-40995
  - !9992  io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - !9901  ipv6: fix possible race in __fib6_drop_pcpu_from()
  - !10096 [sync] PR-9741:  scsi: qedf: Ensure the copied buf is NUL terminated
  - !9931  nvdimm: Backport some bugfixs
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - tracing: Build event generation tests only as modules
  - ecryptfs: Fix buffer size for tag 66 packet
  - scsi: qedf: Ensure the copied buf is NUL terminated
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
  - net/sched: act_api: rely on rcu in tcf_idr_check_alloc
  - drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - RDMA/hns: Fix UAF for cq async event
  - RDMA/hns: Add mutex_destroy()
  - Revert "RDMA/hns: Fix UAF for cq async event"
  - Revert "RDMA/hns: Add mutex_destroy()"
  - vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - tipc: force a dst refcount before doing decryption
  - nfs: Ensure write and flush consume writeback errors
  - NFS: Don't report ENOSPC write errors twice
  - NFS: Use of mapping_set_error() results in spurious errors
  - nfs: ensure correct writeback errors are returned on close()
  - nfs: nfs_file_write() should check for writeback errors
  - sunrpc: fix KABI broken in struct rpc_create_args
  - nfs: Handle error of rpc_proc_register() in nfs_net_init().
  - nfs: make the rpc_stat per net namespace
  - nfs: expose /proc/net/sunrpc/nfs in net namespaces
  - sunrpc: add a struct rpc_stats arg to rpc_create_args
  - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - drm/exynos/vidi: fix memory leak in .get_modes()
  - xfs: fix mount hung while sb recover fail
  - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - dax: alloc_dax() return ERR_PTR(-EOPNOTSUPP) for CONFIG_DAX=n
  - nvdimm/pmem: use add_disk() error handling
  - powerpc/pseries: Enforce hcall result buffer validity and size
  - ipv6: fix possible race in __fib6_drop_pcpu_from()
  - fpga: manager: add owner module and take its refcount
  - arm64: mm: Pass pbha-performance-only bit under chosen node
  - ksmbd: fix wrong DataOffset validation of create context
  - thermal: int340x_thermal: Consolidate priv->data_vault checks
  - thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR
  - netfilter: nf_tables: restore set elements when delete set fails
  - keys: Fix overwrite of key expiration on instantiation


author: Li Nan <linan122@huawei.com> - 5.10.0-221.0.0.124
changelog:
  - !10436  CVE-2024-39476
  - !10418  net: move to_gnet_bpf_attach_type() to filter.c
  - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING
  - Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
  - !10065  iommu: Return right value in iommu_sva_bind_device()
  - net: move to_gnet_bpf_attach_type() to filter.c
  - !10334  fix CVE-2024-36479 for olk-5.10
  - !10408  iommu/arm-smmu-v3: Fix the compile warning
  - !10363  drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
  - !10058  net: mvpp2: clear BM pool before initialization
  - !10057  udp: do not accept non-tunnel GSO skbs landing in a tunnel
  - iommu/arm-smmu-v3: Fix the compile warning
  - !10339  net/sched: initialize noop_qdisc owner
  - !10366 v2  jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
  - !10336 v2  mm: numa-affinity: support THP migration
  - !10321  media: i2c: et8ek8: Don't strip remove function when driver is builtin
  - !10318 【OLK 5.10】net: hns3: add set_loopback interface to realtek phy driver
  - !10342  CVE-2024-39471
  - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
  - drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
  - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
  - drm/amdgpu: add error handle to avoid out-of-bounds
  - net/sched: initialize noop_qdisc owner
  - mm,do_huge_pmd_numa_page: remove unnecessary TLB flushing code
  - mm: numa-affinity: delete the duplicate numa_migrate_prep
  - mm: numa-affinity: backport some migrate policy from AutoNuma
  - mm: numa-affinity: support THP migration
  - mm: thp: skip make PMD PROT_NONE if THP migration is not supported
  - mm: migrate: check mapcount for THP instead of refcount
  - mm: migrate: don't split THP for misplaced NUMA page
  - mm/migrate: fix NR_ISOLATED corruption on 64-bit
  - mm: migrate: account THP NUMA migration counters correctly
  - mm: thp: refactor NUMA fault handling
  - mm: memory: make numa_migrate_prep() non-static
  - mm: fix KABI broken in struct vm_fault
  - mm: memory: add orig_pmd to struct vm_fault
  - !10333  BMA: Fix DMA reset problem and change the version
  - fpga: bridge: add owner module and take its refcount
  - fpga: remove redundant checks for bridge ops
  - fpga: bridge: properly initialize bridge device before populating children
  - fpga: bridge: Use standard dev_release for class driver
  - fpga: bridge: Rename dev to parent for parent device
  - BMA/kbox_drv: Change the version number.
  - BMA/veth_drv: Change the version number.
  - BMA/cdev_drv: Change the version number.
  - BMA/edma_drv: Fix DMA reset problem and change the version number.
  - !9362  macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
  - media: i2c: et8ek8: Don't strip remove function when driver is builtin
  - net: phy: add set_loopback interface to realtek phy driver
  - !10316  sched: Add cfs_preferred_nid_init hook
  - !9976  KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
  - !10073  serial: imx: Introduce timeout when waiting on transmitter empty
  - !10172  netrom: Fix a memory leak in nr_heartbeat_expiry()
  - sched: Add cfs_preferred_nid_init hook
  - !10295 sdma-dae: fix interrupt handle logic
  - !10253  fbdev: savage: Handle err return when savagefb_check_var failed
  - !10309  net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr
  - !10304 Backport 5.10.211 LTS patches from upstream
  - net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr
  - block: ataflop: more blk-mq refactoring fixes
  - drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
  - drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
  - tls: rx: drop pointless else after goto
  - s390: use the correct count for __iowrite64_copy()
  - ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
  - ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
  - nouveau: fix function cast warnings
  - scsi: jazz_esp: Only build if SCSI core is builtin
  - bpf, scripts: Correct GPL license name
  - RDMA/srpt: fix function pointer cast warnings
  - arm64: dts: rockchip: set num-cs property for spi on px30
  - RDMA/bnxt_re: Return error for SRQ resize
  - mptcp: fix lockless access in subflow ULP diag
  - usb: roles: don't get/set_role() when usb_role_switch is unregistered
  - usb: roles: fix NULL pointer issue when put module's reference
  - usb: cdns3: fix memory double free when handle zero packet
  - usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
  - x86/alternative: Make custom return thunk unconditional
  - Revert "x86/alternative: Make custom return thunk unconditional"
  - x86/returnthunk: Allow different return thunks
  - x86/ftrace: Use alternative RET encoding
  - x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch()
  - x86/text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR
  - Revert "x86/ftrace: Use alternative RET encoding"
  - PCI/MSI: Prevent MSI hardware interrupt number truncation
  - KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
  - KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
  - s390/cio: fix invalid -EBUSY on ccw_device_start
  - erofs: fix lz4 inplace decompression
  - x86: drop bogus "cc" clobber from __try_cmpxchg_user_asm()
  - iwlwifi: mvm: write queue_sync_state only for sync
  - iwlwifi: mvm: do more useful queue sync accounting
  - platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC
  - lan743x: fix for potential NULL pointer dereference with bare card
  - btrfs: do not pin logs too early during renames
  - btrfs: unify lookup return value when dir entry is missing
  - btrfs: introduce btrfs_lookup_match_dir
  - btrfs: tree-checker: check for overlapping extent items
  - task_stack, x86/cea: Force-inline stack helpers
  - ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use
  - ASoC: Intel: boards: get codec device with ACPI instead of bus search
  - ASoC: Intel: boards: harden codec property handling
  - mtd: spinand: macronix: Add support for MX35LFxGE4AD
  - cifs: add a warning when the in-flight count goes negative
  - powerpc/watchpoints: Annotate atomic context in more places
  - powerpc/watchpoint: Workaround P10 DD1 issue with VSX-32 byte instructions
  - block: ataflop: fix breakage introduced at blk-mq refactoring
  - seccomp: Invalidate seccomp mode to catch death failures
  - x86/uaccess: Implement macros for CMPXCHG on user addresses
  - hsr: Avoid double remove of a node.
  - hvc/xen: prevent concurrent accesses to the shared ring
  - media: av7110: prevent underflow in write_ts_to_decoder()
  - ASoC: fsl_micfil: register platform component before registering cpu dai
  - ARM: dts: imx: Set default tuning step for imx6sx usdhc
  - irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable
  - ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger
  - pmdomain: renesas: r8a77980-sysc: CR7 must be always on
  - virtio-blk: Ensure no requests in virtqueues before deleting vqs.
  - firewire: core: send bus reset promptly on gap count error
  - scsi: lpfc: Use unsigned type for num_sge
  - hwmon: (coretemp) Enlarge per package core count limit
  - efi: Don't add memblocks for soft-reserved memory
  - Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table
  - ext4: correct the hole length returned by ext4_map_blocks()
  - nvmet-fc: abort command when there is no binding
  - nvmet-fc: release reference on target port
  - nvmet-fcloop: swap the list_add_tail arguments
  - netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
  - spi: sh-msiof: avoid integer overflow in constants
  - ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
  - nvmet-tcp: fix nvme tcp ida memory leak
  - regulator: pwm-regulator: Add validity checks in continuous .get_voltage
  - ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
  - ahci: asm1166: correct count of reported ports
  - wifi: cfg80211: fix missing interfaces when dumping
  - dmaengine: fsl-qdma: increase size of 'irq_name'
  - dmaengine: shdma: increase size of 'dev_id'
  - sched/rt: Fix sysctl_sched_rr_timeslice intial value
  - zonefs: Improve error handling
  - userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
  - sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
  - smb: client: fix parsing of SMB3.1.1 POSIX create context
  - smb: client: fix potential OOBs in smb2_parse_contexts()
  - net/sched: Retire dsmark qdisc
  - net/sched: Retire ATM qdisc
  - net/sched: Retire CBQ qdisc
  - drivers: misc: sdma-dae: fix interrupt handle logic
  - fbdev: savage: Handle err return when savagefb_check_var failed
  - netrom: Fix a memory leak in nr_heartbeat_expiry()
  - serial: imx: Introduce timeout when waiting on transmitter empty
  - iommu: Return right value in iommu_sva_bind_device()
  - net: mvpp2: clear BM pool before initialization
  - udp: do not accept non-tunnel GSO skbs landing in a tunnel
  - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
  - macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"


author: Li Nan <linan122@huawei.com> - 5.10.0-222.0.0.125
changelog:
  - !10787  NFSD: Fix the behavior of READ near OFFSET_MAX
  - !10764  CVE-2024-41027
  - !10666 v2  ASoC: fsl-asoc-card: set priv->pdev before using it
  - !10624  ata: libata-core: Fix double free on error
  - !10652  nvme: avoid double free special payload
  - NFSD: Fix the behavior of READ near OFFSET_MAX
  - !10785  fix CVE-2024-42155
  - s390/pkey: Wipe copies of protected- and secure-keys
  - Revert "s390/pkey: Wipe copies of protected- and secure-keys"
  - !10742  irqchip/mbigen: Fix mbigen node address layout
  - !10737  net/dpaa2: Avoid explicit cpumask var allocation on stack
  - Fix userfaultfd_api to return EINVAL as expected
  - mm/userfaultfd: fail uffd-wp registration if not supported
  - !10743  media: mediatek: vcodec: Only free buffer VA that is not NULL
  - !10759  Fix CVE-2024-42160
  - !10530  ftruncate: pass a signed offset
  - !10679  ibmvnic: Add tx check to prevent skb leak
  - !10725  scsi: qedf: Make qedf_execute_tmf() non-preemptible
  - f2fs: Add inline to f2fs_build_fault_attr() stub
  - f2fs: check validation of fault attrs in f2fs_build_fault_attr()
  - !10582 v2  bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
  - !10489  backport mainline patches
  - !10717  CVE-2024-42101
  - !10713  CVE-2024-41079
  - media: mediatek: vcodec: Only free buffer VA that is not NULL
  - irqchip/mbigen: Fix mbigen node address layout
  - !10727  net/iucv: Avoid explicit cpumask var allocation on stack
  - !10694 v2  drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
  - !10715  gve: Account for stopped queues when reading NIC stats
  - !10691  Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
  - net/dpaa2: Avoid explicit cpumask var allocation on stack
  - !10621  fix CVE-2024-42129
  - !9682  drm: vc4: Fix possible null pointer dereference
  - !10427  net: stmmac: move the EST lock to struct stmmac_priv
  - net/iucv: Avoid explicit cpumask var allocation on stack
  - scsi: qedf: Make qedf_execute_tmf() non-preemptible
  - !10697  mm: prevent derefencing NULL ptr in pfn_section_valid()
  - !10589 v2  ax25: Fix refcount imbalance on inbound connections
  - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
  - gve: Account for stopped queues when reading NIC stats
  - nvmet: always initialize cqe.result
  - !10683  ocfs2: fix DIO failure due to insufficient transaction credits
  - !10566  gpio: davinci: Validate the obtained number of IRQs
  - !10670  net: can: j1939: Initialize unused data in j1939_send_one()
  - !10661  fix CVE-2024-41062
  - !10519  xfs: add bounds checking to xlog_recover_process_data
  - !10650  xfs: don't walk off the end of a directory data block
  - mm: prevent derefencing NULL ptr in pfn_section_valid()
  - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
  - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
  - !10654  KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
  - !10630  sched/deadline: Fix task_struct reference leak
  - ocfs2: fix DIO failure due to insufficient transaction credits
  - ibmvnic: Add tx check to prevent skb leak
  - !10391  pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
  - net: can: j1939: Initialize unused data in j1939_send_one()
  - ASoC: fsl-asoc-card: set priv->pdev before using it
  - !10642  usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  - !10644  inet_diag: Initialize pad field in struct inet_diag_req_v2
  - !10636  RDMA/restrack: Fix potential invalid address access
  - !10648  net: dsa: mv88e6xxx: Correct check for empty list
  - !10598  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  - Bluetooth: L2CAP: Fix deadlock
  - bluetooth/l2cap: sync sock recv cb and release
  - !10503  fix CVE-2024-42155
  - KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
  - nvme: avoid double free special payload
  - xfs: don't walk off the end of a directory data block
  - net: dsa: mv88e6xxx: Correct check for empty list
  - inet_diag: Initialize pad field in struct inet_diag_req_v2
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  - !10557  CVE-2024-42105
  - RDMA/restrack: Fix potential invalid address access
  - sched/deadline: Fix task_struct reference leak
  - !10600  ppp: reject claimed-as-LCP but actually malformed packets
  - !10612  wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
  - !10603  IB/core: Implement a limit on UMAD receive List
  - ata: libata-core: Fix double free on error
  - leds: mlxreg: Use devm_mutex_init() for mutex initialization
  - locking/mutex: Introduce devm_mutex_init()
  - !10554  skmsg: Skip zero length skb in sk_msg_recvmsg
  - !10536  CVE-2024-42082
  - !10594  fix CVE-2024-41046
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
  - !10569  ila: block BH in ila_output()
  - !10564  net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
  - IB/core: Implement a limit on UMAD receive List
  - ppp: reject claimed-as-LCP but actually malformed packets
  - !10586  filelock: Fix fcntl/close race recovery compat path
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  - net: ethernet: lantiq_etop: fix double free in detach
  - net: lantiq_etop: add blank line after declaration
  - !10541  tap: add missing verification for short frame
  - !10540  tun: add missing verification for short frame
  - !10534  ipv6: prevent possible NULL deref in fib6_nh_init()
  - !10544  bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
  - ax25: Fix refcount imbalance on inbound connections
  - filelock: Fix fcntl/close race recovery compat path
  - !10548  powerpc/eeh: avoid possible crash when edev->pdev changes
  - !10527  Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
  - !10420  stm class: Fix a double free in stm_register_device()
  - !10475  ALSA: emux: improve patch ioctl data validation
  - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
  - ila: block BH in ila_output()
  - gpio: davinci: Validate the obtained number of IRQs
  - net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
  - nilfs2: fix inode number range checks
  - skmsg: Skip zero length skb in sk_msg_recvmsg
  - !10465  null_blk: fix validation of block size
  - powerpc/eeh: avoid possible crash when edev->pdev changes
  - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
  - tap: add missing verification for short frame
  - tun: add missing verification for short frame
  - xdp: xdp_mem_allocator can be NULL in trace_mem_connect().
  - xdp: Remove WARN() from __xdp_reg_mem_model()
  - xdp: Allow registering memory model without rxq reference
  - xdp: Move the rxq_info.mem clearing to unreg_mem_model()
  - !10476  jffs2: Fix potential illegal address access in jffs2_free_inode
  - !10467  io_uring: fix possible deadlock in io_register_iowq_max_workers()
  - !10454  fs/ntfs3: Validate ff offset
  - ipv6: prevent possible NULL deref in fib6_nh_init()
  - ftruncate: pass a signed offset
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
  - !10383  filelock: fix potential use-after-free in posix_lock_inode
  - xfs: add bounds checking to xlog_recover_process_data
  - !10460  udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
  - !10493  drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - !10417 Backport 5.10.212 LTS patches from upstream
  - !10487  fix CVE-2024-42086
  - !10384  drm/radeon: fix UBSAN warning in kv_dpm.c
  - s390/pkey: Wipe copies of protected- and secure-keys
  - !10425  kunit: Fix kthread reference
  - !10424  kunit: Fix kthread reference
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - irqdomain: Fixed unbalanced fwnode get and put
  - iio: chemical: bme680: Fix overflows in compensate() functions
  - !10361  PCI/ROM: Fix PCI ROM header check bug
  - mtd: spinand: gigadevice: fix Quad IO for GD5F1GQ5UExxG
  - gpio: fix resource unwinding order in error path
  - gpiolib: Fix the error path order in gpiochip_add_data_with_key()
  - gpio: 74x164: Enable output pins after registers are reset
  - ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks()
  - mptcp: fix possible deadlock in subflow diag
  - pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation
  - mmc: sdhci-xenon: fix PHY init clock stability
  - mmc: sdhci-xenon: add timeout for PHY init complete
  - mmc: core: Fix eMMC initialization with 1-bit bus connection
  - dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
  - wifi: nl80211: reject iftype change with mesh ID change
  - gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
  - afs: Fix endless loop in directory parsing
  - ALSA: Drop leftover snd-rtctimer stuff from Makefile
  - netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
  - Bluetooth: Enforce validation on max value of connection interval
  - Bluetooth: hci_event: Fix wrongly recorded wakeup BD_ADDR
  - net: usb: dm9601: fix wrong return value in dm9601_mdio_read
  - lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected
  - tun: Fix xdp_rxq_info's queue_index when detaching
  - mtd: spinand: gigadevice: Fix the get ecc status issue
  - mtd: spinand: gigadevice: Support GD5F1GQ5UExxG
  - crypto: virtio/akcipher - Fix stack overflow on memcpy
  - platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names
  - !10458  xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
  - !10404  Fix CVE-2024-41069
  - jffs2: Fix potential illegal address access in jffs2_free_inode
  - ALSA: emux: improve patch ioctl data validation
  - !10352  fix CVE-2024-40976
  - !10406  usb: gadget: ncm: Fix handling of zero block length packets
  - !10271  HID: core: remove unnecessary WARN_ON() in implement()
  - !10431  s390/qeth: fix deadlock during failing recovery
  - !10440  net/sched: Fix UAF when resolving a clash
  - !10328  net/smc: enable smcrv1 when RNIC supports rocev2
  - !10449  net: ena: Add validation for completion descriptors consistency
  - io_uring: fix possible deadlock in io_register_iowq_max_workers()
  - null_blk: fix validation of block size
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
  - fs/ntfs3: Validate ff offset
  - net: ena: Add validation for completion descriptors consistency
  - net/sched: Fix UAF when resolving a clash
  - s390/qeth: fix deadlock during failing recovery
  - net: stmmac: move the EST lock to struct stmmac_priv
  - kunit: Fix kthread reference
  - kunit: Fix kthread reference
  - stm class: Fix a double free in stm_register_device()
  - usb: gadget: ncm: Fix handling of zero block length packets
  - ASoC: topology: Fix route memory corruption
  - ASoC: topology: Fix references to freed memory
  - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
  - drm/radeon: fix UBSAN warning in kv_dpm.c
  - filelock: fix potential use-after-free in posix_lock_inode
  - PCI/ROM: Fix PCI ROM header check bug
  - drm/lima: mask irqs in timeout path before hard reset
  - drm/lima: add mask irq callback to gp and pp
  - net/smc: enable smcrv1 when RNIC supports rocev2
  - HID: core: remove unnecessary WARN_ON() in implement()
  - drm: vc4: Fix possible null pointer dereference


author: Li Nan <linan122@huawei.com> - 5.10.0-223.0.0.126
changelog:
  - !10877  drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - !10878  orangefs: fix out-of-bounds fsid access
  - !10876  drm/i915/gt: Fix potential UAF by revoke of fence registers
  - !10788 [OLK-5.10]sync some patch from upstream for Mini-OS
  - !10523 [OLK-5.10] drivers: add GDR support
  - !10885  crypto: aead,cipher - zeroize key buffer after use
  - !10888  s390/pkey: Wipe copies of clear-key structures on failure
  - !10820  powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - drivers: Fix kabi check failure
  - drivers: Add GDR(GPU Direct RDMA) support
  - !10842  netfilter: nf_tables: prefer nft_chain_validate
  - !10869 v2  net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
  - !10873  USB: serial: mos7840: fix crash on resume
  - !10887 v3  sched/fair: Prefer physical cores when migrating tasks
  - s390/pkey: Wipe copies of clear-key structures on failure
  - sched/fair: Prefer physical cores when migrating tasks
  - crypto: aead,cipher - zeroize key buffer after use
  - orangefs: fix out-of-bounds fsid access
  - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - drm/i915/gt: Fix potential UAF by revoke of fence registers
  - USB: serial: mos7840: fix crash on resume
  - !10831  wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
  - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
  - !10862 v2  ext4: flexibly control whether to enable dioread_nolock by default
  - !10849  wireguard: allowedips: avoid unaligned 64-bit memory accesses
  - !10817  media: dvb-frontends: tda10048: Fix integer overflow
  - !10616  USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  - !10801  fix CVE-2024-42095
  - !10514  powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
  - !10704  x86: stop playing stack games in profile_pc()
  - ext4: flexibly control whether to enable dioread_nolock by default
  - wireguard: allowedips: avoid unaligned 64-bit memory accesses
  - !10836  wifi: mt76: replace skb_put with skb_put_zero
  - !10839  bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - netfilter: nf_tables: prefer nft_chain_validate
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - wifi: mt76: replace skb_put with skb_put_zero
  - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
  - !10814  sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
  - !10807  wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
  - !10810  tcp_metrics: validate source addr length
  - !10766 Backport 5.10.213 LTS patches from upstream
  - powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - !10752  btrfs: qgroup: fix quota root leak after quota disable failure
  - media: dvb-frontends: tda10048: Fix integer overflow
  - sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
  - !10781  nilfs2: fix kernel bug on rename operation of broken directory
  - tcp_metrics: validate source addr length
  - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
  - !10733  filelock: Remove locks reliably when fcntl/close race is detected
  - !10765 mbigen: add kvm dependency
  - !10761  leds: an30259a: Use devm_mutex_init() for mutex initialization
  - !10681  crypto: ecdh - explicitly zeroize private_key
  - !10798  s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
  - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
  - serial: 8250_omap: Implementation of Errata i2310
  - s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
  - mbigen: add kvm dependency
  - !10778  Fix CVE-2021-47582
  - !10784  s390/pkey: Wipe sensitive data on failure
  - serial: max310x: implement I2C support
  - serial: max310x: make accessing revision id interface-agnostic
  - Drivers: hv: vmbus: Drop error message when 'No request id available'
  - serial: max310x: Unprepare and disable clock in error path
  - getrusage: use sig->stats_lock rather than lock_task_sighand()
  - getrusage: use __for_each_thread()
  - getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand()
  - getrusage: add the "signal_struct *sig" local variable
  - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
  - hv_netvsc: use netif_is_bond_master() instead of open code
  - hv_netvsc: Make netvsc/VF binding check both MAC and serial number
  - hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove
  - hv_netvsc: Wait for completion on request SWITCH_DATA_PATH
  - hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening
  - Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening
  - ext4: convert to exclusive lock while inserting delalloc extents
  - ext4: refactor ext4_da_map_blocks()
  - ext4: make ext4_es_insert_extent() return void
  - lsm: fix default return value of the socket_getpeersec_*() hooks
  - lsm: make security_socket_getpeersec_stream() sockptr_t safe
  - bpf: net: Change sk_getsockopt() to take the sockptr_t argument
  - net: Change sock_getsockopt() to take the sk ptr instead of the sock ptr
  - serial: max310x: prevent infinite while() loop in port startup
  - serial: max310x: use a separate regmap for each port
  - serial: max310x: use regmap methods for SPI batch operations
  - serial: max310x: Make use of device properties
  - serial: max310x: fail probe if clock crystal is unstable
  - serial: max310x: Try to get crystal clock rate from property
  - serial: max310x: Use devm_clk_get_optional() to get the input clock
  - xhci: handle isoc Babble and Buffer Overrun events properly
  - xhci: process isoc TD properly when there was a transaction error mid TD.
  - xhci: prevent double-fetch of transfer and transfer event TRBs
  - xhci: remove extra loop in interrupt context
  - um: allow not setting extra rpaths in the linux binary
  - selftests: mm: fix map_hugetlb failure on 64K page size systems
  - selftests/mm: switch to bash from sh
  - netrom: Fix a data-race around sysctl_netrom_link_fails_count
  - netrom: Fix a data-race around sysctl_netrom_routing_control
  - netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
  - netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
  - netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
  - netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
  - netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
  - netrom: Fix a data-race around sysctl_netrom_default_path_quality
  - netfilter: nft_ct: fix l3num expectations with inet pseudo family
  - geneve: make sure to pull inner header in geneve_rx()
  - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string
  - i40e: disable NAPI right after disabling irqs when handling xsk_pool
  - ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
  - net: lan78xx: fix runtime PM count underflow on link stop
  - lan78xx: Fix race conditions in suspend/resume handling
  - lan78xx: Fix partial packet errors on suspend/resume
  - lan78xx: Add missing return code checks
  - lan78xx: Fix white space and style issues
  - vhost: Add smp_rmb() in vhost_enable_notify()
  - vhost: Add smp_rmb() in vhost_vq_avail_empty()
  - s390/pkey: Wipe sensitive data on failure
  - nilfs2: fix kernel bug on rename operation of broken directory
  - usb: core: Don't hold the device lock while sleeping in do_proc_control()
  - USB: core: Make do_proc_control() and do_proc_bulk() killable
  - leds: an30259a: Use devm_mutex_init() for mutex initialization
  - btrfs: qgroup: fix quota root leak after quota disable failure
  - filelock: Remove locks reliably when fcntl/close race is detected
  - x86: stop playing stack games in profile_pc()
  - crypto: ecdh - explicitly zeroize private_key
  - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  - powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.


author: Li Nan <linan122@huawei.com> - 5.10.0-224.0.0.127
changelog:
  - !9573 [OLK-5.10] Intel: backport RAPL bugfixes up to v6.9
  - !11007  mm: avoid overflows in dirty throttling logic
  - !10979  CVE-2024-42304
  - !10968  bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
  - mm: avoid overflows in dirty throttling logic
  - !10982  drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
  - !10797 Intel: Backport SPR/EMR CXL and HBM support to kernel 5.10
  - !10799 Intel: Backport 3 core PMU bugfixes to kernel 5.10
  - !10958  bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
  - !10963  sched: fix numa_group uninitialized in show_numa_stats()
  - !10614  can: mcp251xfd: fix infinite loop when xmit fails
  - !10951  Fix CVE-2024-36880
  - drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
  - ext4: make sure the first directory block is not a hole
  - ext4: check dot and dotdot of dx_root before making dir indexed
  - !10956  leds: trigger: Unregister sysfs attributes before calling deactivate()
  - bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
  - sched: fix numa_group uninitialized in show_numa_stats()
  - !10931  drm/lima: fix shared irq handling on driver remove
  - !10947  net: nexthop: Initialize all fields in dumped nexthops
  - !10945 v4  Some clean up and bugfix for hisi_hbmdev
  - bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
  - leds: trigger: Unregister sysfs attributes before calling deactivate()
  - Bluetooth: qca: fix firmware check error path
  - Bluetooth: qca: add missing firmware sanity checks
  - net: nexthop: Initialize all fields in dumped nexthops
  - soc/hisilicon: Remove the memdev kobj
  - soc/hisilicon: Clean the hbmcache state show sysfs
  - soc: hisilicon: Setting the demand_offline in sysfs interface
  - Revert "soc: hisilicon: hisi_hbmdev: Provide extra memory topology information"
  - Revert "soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods"
  - !10928  libceph: fix race between delayed_work() and ceph_monc_stop()
  - drm/lima: fix shared irq handling on driver remove
  - !10745  jfs: xattr: fix buffer overflow for invalid xattr
  - libceph: fix race between delayed_work() and ceph_monc_stop()
  - !10912  Fix CVE-2024-40966
  - !10689 sdma: fix input validate problems
  - !10914  usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
  - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
  - tty: vt device use only n_tty ldisc
  - tty: add the option to have a tty reject a new ldisc
  - !10846  netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
  - !10813 ima: dont disable digest_list if the file is not processed
  - !10901 scsi: hisi_sas: Modify the deadline for ata_wait_after_reset()
  - scsi: hisi_sas: Modify the deadline for ata_wait_after_reset()
  - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
  - perf/x86/intel: Add a distinct name for Granite Rapids
  - perf/x86/intel/ds: Fix non 0 retire latency on Raptorlake
  - perf/x86/intel: Hide Topdown metrics events if the feature is not enumerated
  - perf/x86/intel/uncore: Support HBM and CXL PMON counters
  - perf/x86/uncore: Cleanup unused unit structure
  - perf/x86/uncore: Apply the unit control RB tree to PCI uncore units
  - perf/x86/uncore: Apply the unit control RB tree to MSR uncore units
  - perf/x86/uncore: Apply the unit control RB tree to MMIO uncore units
  - perf/x86/uncore: Retrieve the unit ID from the unit control RB tree
  - perf/x86/uncore: Support per PMU cpumask
  - perf/x86/uncore: Save the unit control address of all units
  - ima: dont disable digest_list if the file is not processed
  - drivers: misc: sdma-dae: fix input validate problems
  - jfs: xattr: fix buffer overflow for invalid xattr
  - can: mcp251xfd: fix infinite loop when xmit fails
  - powercap: intel_rapl_tpmi: Fix System Domain probing
  - powercap: intel_rapl_tpmi: Fix a register bug
  - powercap: intel_rapl: Fix locking in TPMI RAPL
  - powercap: intel_rapl: Fix a NULL pointer dereference
  - powercap: intel_rapl: Fix a sparse warning in TPMI interface


author: Li Nan <linan122@huawei.com> - 5.10.0-225.0.0.128
changelog:
  - !11079 Backport 5.10.214 - 5.10.215 LTS patches from upstream
  - !11123  fix CVE-2024-42288
  - !11163  btrfs: get rid of warning on transaction commit when using flushoncommit
  - !11151  protect the fetch of ->fd[fd
  - !10113  Fixed two memory leak issues of the Perf tool
  - !11092  mISDN: Fix a use after free in hfcmulti_tx()
  - btrfs: get rid of warning on transaction commit when using flushoncommit
  - !11071 【olk 5.10】net: hns3: add some feature patches
  - !11085  f2fs: fix to don't dirty inode for readonly filesystem
  - !11138 v2  drm/amd/display: Check for NULL pointer
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions
  - !10925 [openEuler-22.03-LTS-SP4]UNIC: fixup the problem of print and free mguid'memory after init failed
  - !11099  exec: Fix ToCToU between perm check and set-uid/gid usage
  - !11070 IP notify code optimization
  - !11118  PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
  - !11028  remoteproc: imx_rproc: Skip over memory region when node value is NULL
  - !11075  wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
  - !11003  tipc: Return non-zero value from tipc_udp_addr2str() on error
  - !10985  RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
  - !11115  net/iucv: fix use after free in iucv_sock_close()
  - drm/amd/display: Check for NULL pointer
  - !11054  m68k: Fix spinlock race in kernel thread creation
  - !11055  phonet: fix rtm_phonet_notify() skb allocation
  - !11126  drm/amd/display: Check pipe offset before setting vblank
  - network_mgmt: Security check and modification.
  - Fix the issue that the debugfs query inconsistency.
  - UNIC: Fix the issue that RPS cannot hash sw irq to multiple cores.
  - ubl: correct comments and delete unused EXPORT_SYMBOL
  - unic: fix issue that return value is not processed
  - unic: deleted redundant code and added default processing
  - drm/amd/display: Check pipe offset before setting vblank
  - scsi: qla2xxx: Fix for possible memory corruption
  - !11091  net/mlx5: Always drain health in shutdown callback
  - PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
  - net/iucv: fix use after free in iucv_sock_close()
  - exec: Fix ToCToU between perm check and set-uid/gid usage
  - !11027  landlock: Don't lose track of restrictions on cred_transfer
  - mISDN: Fix a use after free in hfcmulti_tx()
  - net/mlx5: Always drain health in shutdown callback
  - f2fs: fix to don't dirty inode for readonly filesystem
  - x86/head/64: Re-enable stack protection
  - x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk
  - kbuild: dummy-tools: adjust to stricter stackprotector check
  - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()
  - Bluetooth: btintel: Fixe build regression
  - virtio: reenable config if freezing device failed
  - drivers/nvme: Add quirks for device 126f:2262
  - fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
  - usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
  - usb: typec: tcpci: add generic tcpci fallback compatible
  - tools: iio: replace seekdir() in iio_generic_buffer
  - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment
  - ktest: force $buildonly = 1 for 'make_warnings_file' test type
  - platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet
  - Input: allocate keycode for Display refresh rate toggle
  - RDMA/cm: add timeout to cm_destroy_id wait
  - libperf evlist: Avoid out-of-bounds access
  - Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
  - SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int
  - drm/amd/display: Fix nanosec stat overflow
  - ext4: forbid commit inconsistent quota data when errors=remount-ro
  - ext4: add a hint for block bitmap corrupt state in mb_groups
  - media: sta2x11: fix irq handler cast
  - isofs: handle CDs with bad root inode but good Joliet root directory
  - pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs
  - Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
  - Bluetooth: btintel: Fix null ptr deref in btintel_read_version
  - btrfs: export: handle invalid inode or root reference in btrfs_get_parent()
  - tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()
  - ionic: set adminq irq affinity
  - arm64: dts: rockchip: fix rk3399 hdmi ports node
  - arm64: dts: rockchip: fix rk3328 hdmi ports node
  - panic: Flush kernel log buffer at the end
  - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
  - wifi: ath9k: fix LNA selection in ath_ant_try_scan()
  - mptcp: don't account accept() of non-MPC client as fallback to TCP
  - x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO
  - x86/bugs: Fix the SRSO mitigation on Zen3/4
  - riscv: Fix spurious errors from __get/put_kernel_nofault
  - s390/entry: align system call table on 8 bytes
  - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
  - ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone
  - ata: sata_mv: Fix PCI device ID table declaration compilation warning
  - scsi: mylex: Fix sysfs buffer lengths
  - ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
  - ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
  - arm64: dts: qcom: sc7180-trogdor: mark bluetooth address as broken
  - arm64: dts: qcom: sc7180: Remove clock for bluetooth on Trogdor
  - net: ravb: Always process TX descriptor ring
  - Revert "usb: phy: generic: Get the vbus supply"
  - scsi: qla2xxx: Update manufacturer detail
  - scsi: qla2xxx: Update manufacturer details
  - i40e: fix i40e_count_filters() to count only active/new filters
  - octeontx2-pf: check negative error code in otx2_open()
  - udp: do not transition UDP GRO fraglist partial checksums to unnecessary
  - selftests: reuseaddr_conflict: add missing new line at the end of the output
  - net: stmmac: fix rx queue priority assignment
  - vboxsf: Avoid an spurious warning if load_nls_xxx() fails
  - mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations
  - Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."
  - io_uring: ensure '0' is returned on file registration success
  - Bluetooth: Fix TOCTOU in HCI debugfs implementation
  - Bluetooth: hci_event: set the conn encrypted before conn establishes
  - r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
  - dm integrity: fix out-of-range warning
  - Octeontx2-af: fix pause frame configuration in GMP mode
  - ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields()
  - usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset
  - usb: typec: ucsi: Ack unsupported commands
  - usb: dwc2: gadget: LPM flow fix
  - usb: dwc2: host: Fix ISOC flow in DDMA mode
  - usb: dwc2: host: Fix hibernation flow
  - usb: dwc2: host: Fix remote wakeup from hibernation
  - USB: core: Add hub_get() and hub_put() routines
  - staging: vc04_services: fix information leak in create_component()
  - staging: vc04_services: changen strncpy() to strscpy_pad()
  - usb: cdc-wdm: close race between read and workqueue
  - mmc: core: Avoid negative index with array access
  - mmc: core: Initialize mmc_blk_ioc_data
  - hexagon: vmlinux.lds.S: handle attributes section
  - exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
  - init: open /initrd.image with O_LARGEFILE
  - mm/migrate: set swap entry values of THP tail pages properly.
  - mm/memory-failure: fix an incorrect use of tail pages
  - powerpc: xor_vmx: Add '-mhard-float' to CFLAGS
  - efivarfs: Request at most 512 bytes for variable names
  - btrfs: allocate btrfs_ioctl_defrag_range_args on stack
  - printk: Update @console_may_schedule in console_trylock_spinning()
  - tee: optee: Fix kernel panic caused by incorrect error handling
  - mei: me: add arrow lake point H DID
  - mei: me: add arrow lake point S DID
  - tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
  - usb: port: Don't try to peer unused USB ports based on location
  - ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform
  - xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
  - Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory
  - netfilter: nf_tables: reject constant set with timeout
  - comedi: comedi_test: Prevent timers rescheduling during deletion
  - scripts: kernel-doc: Fix syntax error due to undeclared args variable
  - x86/pm: Work around false positive kmemleak report in msr_build_context()
  - x86/stackprotector/32: Make the canary into a regular percpu variable
  - vxge: remove unnecessary cast in kfree()
  - drm/amd/display: Fix noise issue on HDMI AV mute
  - drm/amd/display: Return the correct HDCP error code
  - ahci: asm1064: asm1166: don't limit reported ports
  - ahci: asm1064: correct count of reported ports
  - wireguard: netlink: check for dangling peer via is_dead instead of empty list
  - net: hns3: tracing: fix hclgevf trace event strings
  - cpufreq: dt: always allocate zeroed cpumask
  - nilfs2: fix failure to detect DAT corruption in btree and direct mappings
  - memtest: use {READ,WRITE}_ONCE in memory scanning
  - drm/vc4: hdmi: do not return negative values from .get_modes()
  - drm/imx/ipuv3: do not return negative values from .get_modes()
  - drm/exynos: do not return negative values from .get_modes()
  - drm/panel: do not return negative error codes from drm_panel_get_modes()
  - ring-buffer: Fix full_waiters_pending in poll
  - ring-buffer: Fix resetting of shortest_full
  - ring-buffer: Do not set shortest_full when full target is hit
  - ring-buffer: Fix waking up ring buffer readers
  - PCI: dwc: endpoint: Fix advertised resizable BAR size
  - kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
  - PCI/AER: Block runtime suspend when handling errors
  - speakup: Fix 8bit characters from direct synth
  - usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic
  - usb: gadget: tegra-xudc: Use dev_err_probe()
  - phy: tegra: xusb: Add API to retrieve the port number of phy
  - slimbus: core: Remove usage of the deprecated ida_simple_xx() API
  - nvmem: meson-efuse: fix function pointer type mismatch
  - hwmon: (amc6821) add of_match table
  - drm/etnaviv: Restore some id values
  - mmc: core: Fix switch on gp3 partition
  - dm-raid: fix lockdep waring in "pers->hot_add_disk"
  - btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
  - serial: Lock console when calling into driver before registration
  - printk/console: Split out code that enables default console
  - usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros
  - fuse: don't unhash root
  - fuse: fix root lookup with nonzero generation
  - mmc: tmio: avoid concurrent runs of mmc_request_done()
  - PM: sleep: wakeirq: fix wake irq warning in system suspend
  - USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
  - USB: serial: option: add MeiG Smart SLM320 product
  - USB: serial: cp210x: add ID for MGP Instruments PDS100
  - USB: serial: add device ID for VeriFone adapter
  - USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
  - powerpc/fsl: Fix mfpmr build errors with newer binutils
  - clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
  - clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
  - PM: suspend: Set mem_sleep_current during kernel command line setup
  - parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
  - parisc: Fix csum_ipv6_magic on 64-bit systems
  - parisc: Fix csum_ipv6_magic on 32-bit systems
  - parisc: Fix ip_fast_csum
  - parisc: Avoid clobbering the C/B bits in the PSW with tophys and tovirt macros
  - mtd: rawnand: meson: fix scrambling mode value in command macro
  - ubi: correct the calculation of fastmap size
  - ext4: correct best extent lstart adjustment logic
  - selftests/mqueue: Set timeout to 180 seconds
  - crypto: qat - resolve race condition during AER recovery
  - crypto: qat - fix double free during reset
  - sparc: vDSO: fix return value of __setup handler
  - sparc64: NMI watchdog: fix return value of __setup handler
  - serial: max310x: fix NULL pointer dereference in I2C instantiation
  - arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
  - smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
  - smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
  - clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
  - media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
  - x86/bugs: Use sysfs_emit()
  - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
  - net: hns3: add support for vf get dscp configuration from pf
  - net: hns3: add support for vf multiple tcs
  - !11045  bpf: Fix a segment issue when downgrading gso_size
  - net: hns3: add support to query tc map info of VF queues
  - net: hns3: fixed vf get max channels bug
  - net: hns3: merge rss tc configuration
  - net: hns3: add ieee_setmaxrate and ieee_getmaxrate support for pf
  - !11038  PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()
  - phonet: fix rtm_phonet_notify() skb allocation
  - m68k: Fix spinlock race in kernel thread creation
  - !11036 v2  Some bugfix for HNS RoCE
  - !10999  media: venus: fix use after free in vdec_close
  - !11013  media: mediatek: vcodec: Handle invalid decoder vsi
  - !10971  ext4: fix infinite loop when replaying fast_commit
  - !11022  udf: Avoid using corrupted block bitmap buffer
  - bpf: Fix a segment issue when downgrading gso_size
  - !11012  hfsplus: fix uninit-value in copy_name
  - !10993  ipvs: properly dereference pe in ip_vs_add_service
  - PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()
  - RDMA/hns: Fix integer overflow in calc_loading_percent()
  - RDMA/hns: Fix creating sysfs before allocating resources
  - RDMA/hns: Fix concurrency between sysfs store and FW configuration of scc params
  - RDMA/hns: Fix wrong output of sysfs scc pram when configuration failed
  - RDMA/hns: Fix mixed use of u32 and __le32 in sysfs
  - RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
  - RDMA/hns: Fix HW UAF when destroy context timeout
  - RDMA/hns: Fix different dgids mapping to the same dip_idx
  - RDMA/hns: Fix soft lockup under heavy CEQE load
  - RDMA/hns: Fix sleeping in spin_lock critical section
  - RDMA/hns: Fix a potential Sleep-in-Atomic-Context
  - RDMA/hns: Fix long waiting cmd event when reset
  - RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
  - RDMA/hns: Use one CQ bank per context
  - !10976  CVE-2024-42126
  - !10990  drm/amd/display: Add NULL pointer check for kzalloc
  - !11019  net: usb: qmi_wwan: fix memory leak for not ip packets
  - !11006  kvm: s390: Reject memory region operations for ucontrol VMs
  - !11023  ocfs2: add bounds checking to ocfs2_check_dir_entry()
  - !10991  s390/sclp: Fix sclp_init() cleanup on failure
  - remoteproc: imx_rproc: Skip over memory region when node value is NULL
  - !10962  drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
  - landlock: Don't lose track of restrictions on cred_transfer
  - !10453 v2  ipv6: sr: fix missing sk_buff release in seg6_input_core
  - ocfs2: add bounds checking to ocfs2_check_dir_entry()
  - udf: Avoid using corrupted block bitmap buffer
  - net: usb: qmi_wwan: fix memory leak for not ip packets
  - !11010 roh/rdma: Support rdma_cm and cnp configure
  - !10995  CVE-2024-42290
  - !10965  perf: Optimize perf_pmu_migrate_context()
  - [PATCH OLK-5.10] RDMA/hns: Support getting GRH for UD in RoH mode when NLP = 0
  - media: mediatek: vcodec: Handle invalid decoder vsi
  - hfsplus: fix uninit-value in copy_name
  - [PATCH OLK-5.10] Revert "RDMA/hns: Support RDMA_CM in ROH mode"
  - [PATCH OLK-5.10] RDMA/hns: Support configure and query the CNP DSCP through sysfs
  - [PATCH OLK-5.10] RDMA/hns: Support query FW cap bit
  - kvm: s390: Reject memory region operations for ucontrol VMs
  - tipc: Return non-zero value from tipc_udp_addr2str() on error
  - media: venus: fix use after free in vdec_close
  - irqchip/imx-irqsteer: Handle runtime power management correctly
  - ipvs: properly dereference pe in ip_vs_add_service
  - s390/sclp: Fix sclp_init() cleanup on failure
  - drm/amd/display: Add NULL pointer check for kzalloc
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
  - powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
  - Revert "powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt."
  - ext4: fix infinite loop when replaying fast_commit
  - perf: Optimize perf_pmu_migrate_context()
  - drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
  - UNIC: bugfix for mguid's memory not be free after netdev init fail
  - UNIC: Solve the problem of redundant print in ub mode
  - ipv6: sr: fix missing sk_buff release in seg6_input_core
  - perf stat: Fix memory leakage when trying perf on an offline CPU
  - perf parse-events: Fix one memory leakage issue


author: Li Nan <linan122@huawei.com> - 5.10.0-226.0.0.129
changelog:
  - !11372  xdp: fix invalid wait context of page_pool_destroy()
  - !11376  drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
  - !11356  f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
  - !11347 v2  ext4: sanity check for NULL pointer after ext4_force_shutdown
  - !11368  nilfs2: handle inconsistent state in nilfs_btnode_create_block()
  - !11358  kcm: Serialise kcm_sendmsg() for the same socket.
  - !11327  CPU inspect bugfix
  - !11340  soc: hisilicon: Support memory repair driver
  - !10970  PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
  - !11324  drm/amd/display: Add null checker before passing variables
  - !11320 [olk 5.10] hns3驱动支持rx/tx配置 tc buffer
  - !11284  fix CVE-2024-43905
  - !11343  netfilter: ctnetlink: use helper function to calculate expect ID
  - !11330  jbd2: avoid mount failed when commit block is partial submitted
  - !11190  fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
  - !11201  ibmvnic: don't release napi in __ibmvnic_open()
  - !11306 hns3 udma: fix bugs of invalid input check and remove dependency of ubl
  - !10748 v2  CVE-2024-41016
  - !11295  padata: Fix possible divide-by-0 panic in padata_mt_helper()
  - !11313  nvme-fabrics: use reserved tag for reg read/write command
  - !11310  drm/radeon: check bo_va->bo is non-NULL before using it
  - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
  - xdp: fix invalid wait context of page_pool_destroy()
  - nilfs2: handle inconsistent state in nilfs_btnode_create_block()
  - kcm: Serialise kcm_sendmsg() for the same socket.
  - f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
  - ext4: sanity check for NULL pointer after ext4_force_shutdown
  - netfilter: ctnetlink: use helper function to calculate expect ID
  - config: enable CONFIG_HISI_MEM_RAS by default
  - docs: ABI: add ABI document for driver hisi_mem_ras
  - soc: hisilicon: Support memory repair driver on Kunpeng SoC
  - !11337 v3  Some features and fixs for hbmdev and hbm cache
  - ACPI/HMAT: Add missing locality information for hot-added device
  - hisilicon/hisi_hbmdev: Add lock to protect pcc operation region
  - hisilicon/hisi_hbmcache: Add a lock to protect pcc operation region
  - soc:hisilicon: Use _ON and _OFF in hbmcache
  - jbd2: avoid mount failed when commit block is partial submitted
  - cpuinspect: fix [stop/start]_inspect_threads return type
  - cpuinspect: make inspector unregister reliable
  - drm/amd/display: Add null checker before passing variables
  - nvme-fabrics: use reserved tag for reg read/write command
  - hns3 udma: remove UBL dependency.
  - hns3 udma: add verify udata and in/out addr.
  - hns3 udma: fix bugs of code review.
  - hns3 udma: fixed some bugs.
  - drm/radeon: check bo_va->bo is non-NULL before using it
  - net: hns3: add dcbnl_setbuffer and dcbnl_getbuffer support for pf
  - !11058  drm/amdgpu: change vm->task_info handling
  - !11057  scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
  - padata: Fix possible divide-by-0 panic in padata_mt_helper()
  - !11221  apparmor: Fix null pointer deref when receiving skb during sock creation
  - drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
  - !11246 [olk 5.10] hns3驱动一些bugfix patch
  - !11247 [openEuler-22.03-LTS-SP4]UNIC: Using UBL-related macros to isolate UB header files
  - !11273  serial: core: check uartclk for zero to avoid divide by zero
  - net: hns3: Resolved the issue that the debugfs query result is inconsistent.
  - net: hns3: fixed reset failure issues caused by the incorrect reset type
  - net: hns3: fix missing features due to dev->features configuration too early
  - net: hns3: fix a deadlock problem when config TC during resetting
  - net: hns3: add sync command to sync io-pgtable
  - net: hns3: default enable tx bounce buffer when smmu enabled
  - net: hns3: don't add the len of vlan head if skb_vlan_pop failed
  - net: hns3: void array out of bound when loop tnl_num
  - !11211  drm/amdgpu: Fix the null pointer dereference to ras_manager
  - !11275  wifi: cfg80211: Avoid Wdiscarded-qualifiers warning
  - !11271 roh/core: Avoid null pointer access and optimize code.
  - UNIC: Use the macro CONFIG_HNS3_UBL to isolate debugfs dentry
  - UNIC: Using UBL-related macros to isolate UB header files
  - roh/core: Avoid null pointer access and optimize code.
  - wifi: cfg80211: Avoid Wdiscarded-qualifiers warning
  - !11267  net: bridge: mcast: wait for previous gc cycles when removing port
  - serial: core: check uartclk for zero to avoid divide by zero
  - net: hns3: use correct release function during uninitialization
  - net: hns3: delete redundant enabling actions for Layer 2 fowarding
  - net: hns3: use the user's cfg after reset
  - net: hns3: fix delete tc fail issue
  - net: bridge: mcast: wait for previous gc cycles when removing port
  - !11241  CVE-2024-43892
  - !11217  scsi: qla2xxx: validate nvme_local_port correctly
  - !11181  block: initialize integrity buffer to zero before writing it to media
  - !11111  sysctl: always initialize i_uid/i_gid
  - !11194  Fix mainline patchs
  - !11230  Bluetooth: MGMT: Add error handling to pair_device()
  - !11210  jfs: Fix shift-out-of-bounds in dbDiscardAG
  - !11171  tracing: Fix overflow in get_free_elt()
  - !11169  CVE-2024-42267
  - memcg: protect concurrent access to mem_cgroup_idr
  - !11174  md: restore 'noio_flag' for the last mddev_resume()
  - Bluetooth: MGMT: Add error handling to pair_device()
  - apparmor: Fix null pointer deref when receiving skb during sock creation
  - !11182  CVE-2024-42287
  - scsi: qla2xxx: validate nvme_local_port correctly
  - !11159  usb: vhci-hcd: Do not drop references before new references are gained
  - !11184 【OLK 5.10】spi: spidev some bugfix
  - drm/amdgpu: Fix the null pointer dereference to ras_manager
  - !11140  i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
  - !11147  powerpc/pseries: Fix scv instruction crash with kexec
  - jfs: Fix shift-out-of-bounds in dbDiscardAG
  - !11187  Bugfix patches for hns RoCE
  - ibmvnic: don't release napi in __ibmvnic_open()
  - perf/x86/amd/core: Fix overflow reset on hotplug
  - perf/x86/amd/core: Always clear status for idx
  - spi: spidev: fix a recursive locking error
  - fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
  - spi: spidev: fix a race condition when accessing spidev->spi
  - RDMA/hns: Fix list_*_careful() not being used in pairs
  - RDMA/hns: Fix a meaningless loop in active_dca_pages_proc()
  - RDMA/hns: Fix possible RAS when DCA is not attached
  - RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS
  - RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler
  - scsi: qla2xxx: Complete command early within lock
  - block: initialize integrity buffer to zero before writing it to media
  - md: restore 'noio_flag' for the last mddev_resume()
  - tracing: Fix overflow in get_free_elt()
  - riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
  - usb: vhci-hcd: Do not drop references before new references are gained
  - powerpc/pseries: Fix scv instruction crash with kexec
  - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
  - sysctl: always initialize i_uid/i_gid
  - drm/amdgpu: change vm->task_info handling
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
  - PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
  - ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
  - ocfs2: add bounds checking to ocfs2_xattr_find_entry()


author: Li Nan <linan122@huawei.com> - 5.10.0-228.0.0.130
changelog:
  - !11504 sdma-dae support debugfs and fast mode
  - !10195  xfs: Fix agf_longest update error
  - !11505  Misc minor bugfix for HNS RoCE
  - RDMA/hns: Fix endian issues
  - RDMA/hns: Fix ah error counter in sw stat not increasing when sl is invalid
  - RDMA/hns: Fix "Should it be static?" warnings
  - RDMA/hns: Fix dereference of noderef expression
  - RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci
  - drivers:misc:sdma-dae: add fast mode
  - !11479 【OLK 5.10】some bugfixes for hns3 driver
  - driver:misc:sdma-dae: not expose sq_tail write and add validation of cq_head
  - driver:misc:sdma-dae: add debugfs of sdma-dae
  - !11490 RDMA/hns: Fix missing unlock of scc_mutex in error path
  - !11478  coresight: etm4x: Fix CPU idle PM support for ETE
  - net: hns3: fix concurrent setting vlan filter issue
  - net: hns3: fix snprintf() is printing too much problem
  - net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error
  - net: hns3: fix spelling mistake "reg_um" -> "reg_num"
  - net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
  - net: hns3:support enable or disable pfc strom prevent
  - !11491  Fix CVE-2022-48887
  - net: hns3: fix wrong use of semaphore up
  - !11463  net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
  - !11462  mptcp: pm: avoid possible UaF when selecting endp
  - !11470 OLK-5.10 Rever gpiolib bugfix
  - drm/vmwgfx: Remove rcu locks from user resources
  - drm/vmwgfx: Remove vmw_user_bo_noref_release
  - drm/vmwgfx: Introduce ttm reference object find function
  - RDMA/hns: Fix missing unlock of scc_mutex in error path
  - !11487  bna: ensure the copied buf is NUL terminated
  - bna: ensure the copied buf is NUL terminated
  - coresight: etm4x: Fix access to resource selector registers
  - coresight: etm4x: Safe access for TRCQCLTR
  - coresight: etm4x: Do not save/restore Data trace control registers
  - coresight: etm4x: Do not hardcode IOMEM access for register restore
  - coresight: etm4x: add CPU hotplug support for probing
  - !11276 [OLK-5.10]perf: Support event alias in form foo-bar-baz
  - gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match
  - Revert "gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match"
  - !11467 [sync] PR-11465: 【olk 6.6】net: hns3: some bugfixes for netdev
  - !11466 OLK-5.10 Rever spi bugfix
  - net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
  - net: hns3: initialize reset_timer before hclgevf_misc_irq_init()
  - net: hns3: don't auto enable misc vector
  - spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
  - spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware
  - Revert "spi: hisi-kunpeng: Add validation for the minimum value of speed_hz"
  - Revert "spi: Add verification for the max_frequency provided by the firmware"
  - !11104  soc: qcom: pdr: protect locator_addr with the main mutex
  - !11453  nfs: fix memory leak in error path of nfs4_do_reclaim
  - !11447  zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
  - net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
  - mptcp: pm: avoid possible UaF when selecting endp
  - !11282  CVE-2024-44935
  - !11450  ACPI/HMAT: Fix compile error when CONFIG_ACPI_HMAT is not enabled
  - !11435  cifs: Fix pages leak when cifs_writedata allocate fails in cifs_writedata_direct_alloc()
  - !11437 sdma-dae:fix code review problems
  - nfs: fix memory leak in error path of nfs4_do_reclaim
  - ACPI/HMAT: Fix compile error when CONFIG_ACPI_HMAT is not enabled
  - !11041 coresight: etm4x: Fix unbalanced pm_runtime_enable()
  - zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
  - !11439 v2  drm/amd/display: Fix null pointer deref in dcn20_resource.c
  - !11015  nvme-pci: add missing condition check for existence of mapped data
  - !11432 v2  mm/block: add bdi sysfs knobs
  - !11316  block: fix pin count management when merging same-page segments
  - drm/amd/display: Fix null pointer deref in dcn20_resource.c
  - drivers:misc:sdma-dae: fix icsl code check problems
  - coresight: etm4x: Fix unbalanced pm_runtime_enable()
  - cifs: Fix pages leak when cifs_writedata allocate fails in cifs_writedata_direct_alloc()
  - mm: fix arithmetic for bdi min_ratio
  - mm: fix arithmetic for max_prop_frac when setting max_ratio
  - mm: document /sys/class/bdi/<bdi>/min_ratio_fine knob
  - mm: add /sys/class/bdi/<bdi>/min_ratio_fine knob
  - mm: add bdi_set_min_ratio_no_scale() function
  - mm: document /sys/class/bdi/<bdi>/max_ratio_fine knob
  - mm: add /sys/class/bdi/<bdi>/max_ratio_fine knob
  - mm: add bdi_set_max_ratio_no_scale() function
  - mm: document /sys/class/bdi/<bdi>/min_bytes knob
  - mm: add /sys/class/bdi/<bdi>/min_bytes knob
  - mm: add bdi_set_min_bytes() function
  - mm: split off __bdi_set_min_ratio() function
  - mm: add bdi_get_min_bytes() function
  - mm: document /sys/class/bdi/<bdi>/max_bytes knob
  - mm: add knob /sys/class/bdi/<bdi>/max_bytes
  - mm: add bdi_set_max_bytes() function
  - mm: split off __bdi_set_max_ratio() function
  - mm: add bdi_get_max_bytes() function
  - mm: use part per 1000000 for bdi ratios
  - mm: rework calculation of bdi_min_ratio in bdi_set_min_ratio
  - mm: document /sys/class/bdi/<bdi>/strict_limit knob
  - mm: add knob /sys/class/bdi/<bdi>/strict_limit
  - mm: add bdi_set_strict_limit() function
  - !11417  md/raid5: avoid BUG_ON() while continue reshape after reassembling
  - !11207  kprobe support %pd/%pD type
  - !11430  Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
  - !11391  fix CVE-2023-45896
  - !11405  dma: fix call order in dmam_free_coherent
  - !11237  CVE-2024-43907
  - !11409  btrfs: do not start relocation until in progress drops are done
  - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
  - !10904 Incorporate some bonding patches as follows(OLK_5.10):
  - !11341  nfsd: map the EBADMSG to nfserr_io to avoid warning
  - !11390  hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - md/raid5: avoid BUG_ON() while continue reshape after reassembling
  - btrfs: do not start relocation until in progress drops are done
  - !11398  fuse: Initialize beyond-EOF page contents before setting uptodate
  - !11403  btrfs: do not WARN_ON() if we have PageError set
  - dma: fix call order in dmam_free_coherent
  - !11394  dmaengine: idxd: Prevent use after free on completion memory
  - btrfs: do not WARN_ON() if we have PageError set
  - fuse: Initialize beyond-EOF page contents before setting uptodate
  - dmaengine: idxd: Prevent use after free on completion memory
  - fs/ntfs3: Add more attributes checks in mi_enum_attr()
  - hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - nfsd: map the EBADMSG to nfserr_io to avoid warning
  - block: fix pin count management when merging same-page segments
  - sctp: Fix null-ptr-deref in reuseport_add_sock().
  - sctp: move hlist_node and hashent out of sctp_ep_common
  - perf parse-event bugfix merge
  - perf test: Add parse-events test for aliases with hyphens
  - perf test: Add pmu-events test for aliases with hyphens
  - perf parse-events: Support event alias in form foo-bar-baz
  - drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules
  - RDMA/hns: Fix concurrency issue between bond work and bond event
  - RDMA/hns: Fix UAF in clear bond printing
  - RDMA/hns: Encapsulate upper event and lowerstate event handlers
  - RDMA/hns: Register notifier block of bonding events in bond_grp
  - selftests/ftrace: add kprobe test cases for VFS type "%pd" and "%pD"
  - Documentation: tracing: add new type '%pd' and '%pD' for kprobe
  - tracing/probes: support '%pD' type for print struct file's name
  - tracing/probes: support '%pd' type for print struct dentry's name
  - soc: qcom: pdr: protect locator_addr with the main mutex
  - nvme-pci: add missing condition check for existence of mapped data
  - xfs: Fix agf_longest update error
  - Fix x86 provides error symbol


author: Li Nan <linan122@huawei.com> - 5.10.0-229.0.0.131
changelog:
  - !11565 ip_notify:Clean up redundant import files
  - network_mgmt: Clean up redundant import files for ip_notify.c.
  - !11521  ipv6: prevent UAF in ip6_send_skb()
  - !11517  ipv6: fix possible UAF in ip6_finish_output2()
  - !11514  fix CVE-2024-44988
  - !11526 IP notify code optimization
  - !11552  mm/hugetlb: fix pgtable lock on pmd sharing
  - network_mgmt: Add ip_notify timer print.
  - !11548  ata: libata: Fix memory leak for error path in ata_host_alloc()
  - !11553  mm: fix failure to unmap pte on highmem systems
  - !11488  wifi: nl80211: don't free NULL coalescing rule
  - mm: fix failure to unmap pte on highmem systems
  - mm/hugetlb: fix pgtable lock on pmd sharing
  - ata: libata: Fix memory leak for error path in ata_host_alloc()
  - !11456 Backport 5.10.216 LTS patches from upstream
  - !11484  drm/qxl: Add check for drm_cvt_mode
  - !11457  usb: gadget: core: Check for unset descriptor
  - !11475  Fix CVE-2023-52916
  - !11510  x86/mtrr: Check if fixed MTRRs exist before saving them
  - ipv6: prevent UAF in ip6_send_skb()
  - ipv6: fix possible UAF in ip6_finish_output2()
  - net: dsa: mv88e6xxx: Fix out-of-bound access
  - net: dsa: mv88e6xxx: replace ATU violation prints with trace points
  - net: dsa: mv88e6xxx: read FID when handling ATU violations
  - x86/mtrr: Check if fixed MTRRs exist before saving them
  - !11507  mm: backing-dev: set variables dev_attr_min,max_bytes storage-class-specifier to static
  - mm: backing-dev: set variables dev_attr_min,max_bytes storage-class-specifier to static
  - wifi: nl80211: don't free NULL coalescing rule
  - drm/qxl: Add check for drm_cvt_mode
  - media: aspeed: Fix memory overwrite if timing is 1600x900
  - media: aspeed: Fix no complete irq for non-64-aligned width
  - usb: gadget: core: Check for unset descriptor
  - udp: preserve the connected status if only UDP cmsg
  - dma: xilinx_dpdma: Fix locking
  - idma64: Don't try to serve interrupts when device is powered off
  - dmaengine: owl: fix register access functions
  - mtd: diskonchip: work around ubsan link failure
  - stackdepot: respect __GFP_NOLOCKDEP allocation flag
  - net: b44: set pause params only when interface is up
  - ethernet: Add helper for assigning packet type when dest address does not match device address
  - drm/amdgpu: Fix leak when GPU memory allocation fails
  - drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3
  - arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
  - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
  - Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
  - PM / devfreq: Fix buffer overflow in trans_stat_show
  - tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together
  - tracing: Show size of requested perf buffer
  - Revert "crypto: api - Disallow identical driver names"
  - net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets
  - iavf: Fix TC config comparison with existing adapter TC config
  - i40e: Report MFS in decimal base instead of hex
  - netfilter: nf_tables: honor table dormant flag from netdev release event path
  - mlxsw: spectrum_acl_tcam: Rate limit error message
  - mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
  - ipvs: Fix checksumming on GSO of SCTP packets
  - net: usb: ax88179_178a: stop lying about skb->truesize
  - NFC: trf7970a: disable all regulators on removal
  - mlxsw: core: Unregister EMAD trap using FORWARD action
  - vxlan: drop packets from invalid src-address
  - wifi: iwlwifi: mvm: remove old PASN station when adding a new one
  - ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
  - arm64: dts: mediatek: mt2712: fix validation errors
  - arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
  - arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
  - arm64: dts: mediatek: mt7622: fix IR nodename
  - arm64: dts: mediatek: mt7622: fix clock controllers
  - arm64: dts: mediatek: mt7622: introduce nodes for Wireless Ethernet Dispatch
  - arm64: dts: mediatek: mt7622: add support for coherent DMA
  - arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro dts
  - arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
  - arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
  - nilfs2: fix OOB in nilfs_set_de_type
  - nouveau: fix instmem race condition around ptr stores
  - mei: me: disable RPL-S on SPS and IGN firmwares
  - usb: Disable USB3 LPM at shutdown
  - usb: dwc2: host: Fix dereference issue in DDMA completion flow.
  - Revert "usb: cdc-wdm: close race between read and workqueue"
  - USB: serial: option: add Telit FN920C04 rmnet compositions
  - USB: serial: option: add Rolling RW101-GL and RW135-GL support
  - USB: serial: option: support Quectel EM060K sub-models
  - USB: serial: option: add Lonsung U8300/U9300 product
  - USB: serial: option: add support for Fibocom FM650/FG650
  - USB: serial: option: add Fibocom FM135-GL variants
  - comedi: vmk80xx: fix incomplete endpoint checking
  - thunderbolt: Fix wake configurations after device unplug
  - thunderbolt: Avoid notify PM core about runtime PM resume
  - clk: Get runtime PM before walking tree during disable_unused
  - clk: Initialize struct clk_core kref earlier
  - clk: Print an info line before disabling unused clocks
  - clk: remove extra empty line
  - clk: Mark 'all_lists' as const
  - clk: Remove prepare_lock hold assertion in __clk_release()
  - drm/panel: visionox-rm69299: don't unregister DSI device
  - RDMA/mlx5: Fix port number for counter query in multi-port configuration
  - RDMA/cm: Print the old state when cm_destroy_id gets timeout
  - RDMA/rxe: Fix the problem "mutex_destroy missing"
  - selftests/ftrace: Limit length in subsystem-enable tests
  - btrfs: record delayed inode root in transaction
  - irqflags: Explicitly ignore lockdep_hrtimer_exit() argument
  - x86/apic: Force native_apic_mem_read() to use the MOV instruction
  - selftests: timers: Fix abs() warning in posix_timers test
  - x86/cpu: Actually turn off mitigations by default for SPECULATION_MITIGATIONS=n
  - btrfs: qgroup: correctly model root qgroup rsv in convert
  - mailbox: imx: fix suspend failue
  - iommu/vt-d: Allocate local memory for page request queue
  - net: ena: Wrong missing IO completions check order
  - net: ena: Fix potential sign extension issue
  - ipv4/route: avoid unused-but-set-variable warning
  - ipv6: fib: hide unused 'pn' variable
  - octeontx2-af: Fix NIX SQ mode and BP config
  - u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
  - net: openvswitch: fix unwanted error log on timeout policy probing
  - nouveau: fix function cast warning
  - media: cec: core: remove length check of Timer Status


author: Li Nan <linan122@huawei.com> - 5.10.0-230.0.0.132
changelog:
  - !11771  tools: move alignment-related macros to new <linux/align.h>
  - !11729  scsi: qedi: Fix crash while reading debugfs attribute
  - tools: move alignment-related macros to new <linux/align.h>
  - !11706  btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
  - !11707  btrfs: fix qgroup reserve leaks in cow_file_range
  - !11723 v2  Squashfs: sanity check symbolic link size
  - !11708  CVE-2024-46751
  - !11728  lib: objagg: Fix general protection fault
  - !11727  jfs: fix null ptr deref in dtInsertEntry
  - !11726  drm/vmwgfx: Fix a deadlock in dma buf fence polling
  - !11690  sch/netem: fix use after free in netem_dequeue
  - !11693  Fix CVE-2024-39501
  - !11625  smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
  - !11701  userfaultfd: fix checks for huge PMDs
  - !11698  x86/mm: Fix pti_clone_pgtable() alignment assumption
  - scsi: qedi: Fix crash while reading debugfs attribute
  - lib: objagg: Fix general protection fault
  - jfs: fix null ptr deref in dtInsertEntry
  - drm/vmwgfx: Fix a deadlock in dma buf fence polling
  - Squashfs: sanity check symbolic link size
  - btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()
  - btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info()
  - btrfs: remove superfluous metadata check at btrfs_lookup_extent_info()
  - btrfs: fix qgroup reserve leaks in cow_file_range
  - btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
  - userfaultfd: fix checks for huge PMDs
  - x86/mm: Fix pti_clone_pgtable() alignment assumption
  - driver core: Fix uevent_show() vs driver detach race
  - selftests: forwarding: devlink_lib: Wait for udev events after reloading
  - drivers: core: synchronize really_probe() and dev_uevent()
  - !9476 [22.03-LTS-SP3]enable CONFIG_BPF_LSM option by default to use safegurad
  - !8831 Add support for Hygon model 7h processors
  - !11665  drm/amd/pm: fix the Out-of-bounds read warning
  - sch/netem: fix use after free in netem_dequeue
  - !11640  HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
  - !11649  fix CVE-2024-46714
  - drm/amd/pm: fix the Out-of-bounds read warning
  - !11632  fix CVE-2024-46723
  - !11555 v2  Fix CVE-2024-45025
  - !11588  drm/amd/display: Skip finding free audio for unknown engine_id
  - !11586  jfs: don't walk off the end of ealist
  - !11579  kobject_uevent: Fix OOB access within zap_modalias_env()
  - !11637  netfilter: tproxy: bail out if IP has been disabled on the device
  - !11562  Backport bugfix from mainline
  - drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
  - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
  - netfilter: tproxy: bail out if IP has been disabled on the device
  - !11628 [OLK-5.10]Add description for HiSilicon PCIe PMU driver,Some updates for HiSilicon PCIe PMU
  - !11612  Input: uinput - reject requests with unreasonable number of slots
  - drm/amdgpu: fix ucode out-of-bounds read
  - !11615  mmc: mmc_test: Fix NULL dereference on allocation failure
  - drivers/perf: hisi_pcie: Export supported Root Ports [bdf_min, bdf_max]
  - drivers/perf: hisi_pcie: Fix TLP headers bandwidth counting
  - drivers/perf: hisi_pcie: Record hardware counts correctly
  - docs: fix 'make htmldocs' warning in perf
  - docs: perf: Fix build warning of hisi-pcie-pmu.rst
  - docs: perf: Update usage for target filter of hisi-pcie-pmu
  - drivers/perf: hisi: Add TLP filter support
  - Documentation: perf: Indent filter options list of hisi-pcie-pmu
  - docs: perf: Fix PMU instance name of hisi-pcie-pmu
  - docs: perf: Add description for HiSilicon PCIe PMU driver
  - smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
  - !11606  Fix iBMA bug and change version
  - mmc: mmc_test: Fix NULL dereference on allocation failure
  - Input: uinput - reject requests with unreasonable number of slots
  - !11592  CVE-2024-36915
  - !10933  drm/amd/display: Check index msg_id before read or write
  - !10936  ata: libata-core: Fix null pointer dereference on error
  - !11604 hns3 udma: add resource allocation and change name of struct
  - BMA: Fix edma driver initialization problem and change the version number.
  - !11593  gtp: pull network headers in gtp_dev_xmit()
  - hns3 udma: add prefix hns3 for udma.
  - !11583  nfs: always check dreq->error after a commit
  - !11584  vfs: Don't evict inode under the inode lru traversing context
  - !11577  tcp: fix one compile error in __inet_hash_connect()
  - !11578  net: fix one compile error in net_rship_refresh_timeout()
  - gtp: pull network headers in gtp_dev_xmit()
  - nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
  - net: add copy_safe_from_sockptr() helper
  - drm/amd/display: Skip finding free audio for unknown engine_id
  - !11574  nilfs2: add missing check for inode numbers on directory entries
  - jfs: don't walk off the end of ealist
  - vfs: Don't evict inode under the inode lru traversing context
  - nfs: always check dreq->error after a commit
  - kobject_uevent: Fix OOB access within zap_modalias_env()
  - net: fix one compile error in net_rship_refresh_timeout()
  - tcp: fix one compile error in __inet_hash_connect()
  - nilfs2: add missing check for inode numbers on directory entries
  - !11570  NFSD: Fix ia_size underflow
  - NFSD: Fix ia_size underflow
  - mm/compaction: correctly return failure with bogus compound_order in strict mode
  - mm/hugetlb: fix nodes huge page allocation when there are surplus pages
  - mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes
  - bootmem: use kmemleak_free_part_phys in free_bootmem_page
  - bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page
  - mm: migrate: fix THP's mapcount on isolation
  - mm/huge_memory: use pfn_to_online_page() in split_huge_pages_all()
  - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
  - s390/cio: rename bitmap_size() -> idset_bitmap_size()
  - bitmap: introduce generic optimized bitmap_size()
  - fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64()
  - enable CONFIG_BPF_LSM option by default to use safegurad
  - ata: libata-core: Fix null pointer dereference on error
  - drm/amd/display: Check index msg_id before read or write
  - perf/x86/uncore: Add L3 PMU support for Hygon family 18h model 7h
  - EDAC/amd64: Add support for Hygon family 18h model 7h
  - x86/amd_nb: Add support for Hygon family 18h model 7h
  - Fix error kernel provides


author: Li Nan <linan122@huawei.com> - 5.10.0-231.0.0.133
changelog:
  - !11964  drm/amd/pm: Fix negative array index read
  - !12073  kprobes: Fix deadlock issue with kmemleak
  - !12062  CVE-2024-46857
  - kprobes: Fix deadlock issue with kmemleak
  - !12050  um: line: always fill *error_out in setup_one_line()
  - !11958 [OLK-5.10] Intel: Enable CONFIG_PCIE_EDR in openeuler_defconfig for x86 to enable PCIe eDPC
  - !12020  drm/amd/display: Check gpio_id before used as array index
  - !12024  ASoC: meson: axg-card: fix 'use-after-free'
  - !12034  ksmbd: discard write access to the directory open
  - !12038  drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
  - !11942  sbitmap: backport bugfix patches
  - net/mlx5: Fix bridge mode operations when there are no VFs
  - net/mlx5: E-switch, Introduce flag to indicate if fdb table is created
  - !11998  drm/amd/display: Add array index check for hdcp ddc access
  - !12011  rtmutex: Drop rt_mutex::wait_lock before scheduling
  - um: line: always fill *error_out in setup_one_line()
  - !11940 【OLK 5.10】RDMA/hns backport some bugfix from mainline linux
  - !12015  perf/x86/intel: Limit the period on Haswell
  - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
  - !12028  Fix CVE-2024-44958 for olk-5.10
  - !12032  serial: sc16is7xx: fix invalid FIFO access with special register set
  - !12002  drm/amd/display: Assign linear_pitch_alignment even for VM
  - ksmbd: discard write access to the directory open
  - serial: sc16is7xx: fix invalid FIFO access with special register set
  - sched/smt: Fix unbalance sched_smt_present dec/inc
  - sched/smt: Introduce sched_smt_present_inc/dec() helper
  - sched: Revert fix unbalance sched_smt_present dec/inc
  - ASoC: meson: axg-card: fix 'use-after-free'
  - drm/amd/display: Check gpio_id before used as array index
  - !11999  nvmet-tcp: fix kernel crash if commands allocation fails
  - perf/x86/intel: Limit the period on Haswell
  - !12006 v3  add steal_task for cgroup
  - rtmutex: Drop rt_mutex::wait_lock before scheduling
  - sched/core: Add mutex lock to protect steal_task
  - sched/debug: Add h_nr_running/steal_h_nr_running in sched_debug
  - sched/fair: Set the maximum number of steal attempts
  - sched/fair: Count the number of tasks marked as steal_task on cfs_rq
  - sched/topology: Remove SCHED_STEAL_NODE_LIMIT_DEFAULT
  - sched/core: Add cpu.steal_task in cgroup v1 cpu subsystem
  - sched/fair: Add group_steal in cmdline to enable STEAL for cgroup
  - Revert "sched: add mutex lock to protect qos_level"
  - !11907  ksmbd: unset the binding mark of a reused connection
  - drm/amd/display: Assign linear_pitch_alignment even for VM
  - nvmet-tcp: fix kernel crash if commands allocation fails
  - drm/amd/display: Add array index check for hdcp ddc access
  - !11976  CVE-2024-46814
  - !11941  usb: typec: ucsi: Fix null pointer dereference in trace
  - !11939  of/irq: Prevent device address out-of-bounds read in interrupt map walk
  - !11938  KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
  - drm/amd/display: Check msg_id before processing transcation
  - drm/amd/pm: Fix negative array index read
  - Enable CONFIG_PCIE_EDR in openeuler_defconfig for x86
  - !11946  btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
  - !11916  ethtool: check device is present when getting link settings
  - !11935  btrfs: remove NULL transaction support for btrfs_lookup_extent_info()
  - !11922  hwmon: (lm95234) Fix underflows seen when writing limit attributes
  - !11928  Some bug fix patches for OLK-5.10 hns RoCE
  - btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
  - blk-mq: Fix potential io hung for shared sbitmap per tagset
  - blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
  - sbitmap: fix lockup while swapping
  - sbitmap: Avoid leaving waitqueue in invalid state in __sbq_wake_up()
  - sbitmap: fix possible io hung due to lost wakeup
  - block: Fix lockdep warning in blk_mq_mark_tag_wait
  - blk-mq: fix potential io hang by wrong 'wake_batch'
  - sbitmap: correct wake_batch recalculation to avoid potential IO hung
  - blk-mq: Fix wrong wakeup batch configuration which will cause hang
  - blk-mq: fix tag_get wait task can't be awakened
  - usb: typec: ucsi: Fix null pointer dereference in trace
  - of/irq: Prevent device address out-of-bounds read in interrupt map walk
  - KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
  - RDMA/hns: Fix restricted __le16 degrades to integer issue
  - RDMA/hns: Optimize hem allocation performance
  - btrfs: remove NULL transaction support for btrfs_lookup_extent_info()
  - !11925  nilfs2: protect references to superblock parameters exposed in sysfs
  - !11914  sched: fix a deadlock in task_net_group()
  - !11843  CVE-2024-46771
  - RDMA/hns: Fix ah error counter in sw stat not increasing
  - Revert "RDMA/hns: Fix ah error counter in sw stat not increasing when sl is invalid"
  - RDMA/hns: Fix RoCEE hang when multiple QP banks use EXT_SGE
  - RDMA/hns: Use one CQ bank per context for HIP09
  - RDMA/hns: Fix the inconsistency between input max_send_sge and output max_send_sge
  - nilfs2: protect references to superblock parameters exposed in sysfs
  - !11896 [sync] PR-11831:  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  - hwmon: (lm95234) Fix underflows seen when writing limit attributes
  - ethtool: check device is present when getting link settings
  - !11900 [sync] PR-11851:  usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
  - !11899 [sync] PR-11849:  bcache: fix variable length array abuse in btree_iter
  - !11898 [sync] PR-11833:  scsi: bfa: Ensure the copied buf is NUL terminated
  - !11897 [sync] PR-11832:  enic: Validate length of nl attributes in enic_set_vf_port
  - !11895 [sync] PR-11830:  ALSA: usb-audio: Stop parsing channels bits when all channels are found.
  - sched: fix a deadlock in task_net_group()
  - !11867  pktgen: use cpus_read_lock() in pg_net_init()
  - !11890  hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
  - ksmbd: unset the binding mark of a reused connection
  - !11864  VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  - !11903  scsi: aacraid: Fix double-free on probe failure
  - !11875  btrfs: handle errors from btrfs_dec_ref() properly
  - scsi: aacraid: Fix double-free on probe failure
  - !11887  pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
  - bcache: fix variable length array abuse in btree_iter
  - scsi: bfa: Ensure the copied buf is NUL terminated
  - enic: Validate length of nl attributes in enic_set_vf_port
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  - ALSA: usb-audio: Stop parsing channels bits when all channels are found.
  - !11881  PCI: Add missing bridge lock to pci_bus_lock()
  - !11882  usb: dwc3: st: fix probed platform device ref count on probe error path
  - !11871  NFSD: Reset cb_seq_status after NFS4ERR_DELAY
  - !11866 v2  drm/amd/display: Ensure index calculation will not overflow
  - !11791  nilfs2: fix missing cleanup on rollforward recovery error
  - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
  - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  - !11828 v2  drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
  - usb: dwc3: st: fix probed platform device ref count on probe error path
  - PCI: Add missing bridge lock to pci_bus_lock()
  - btrfs: handle errors from btrfs_dec_ref() properly
  - !11767 [sync] PR-11733:  Input: MT - limit max slots
  - !11847  bpf: verifier: prevent userspace memory access
  - !11749  ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
  - !11817  uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  - NFSD: Reset cb_seq_status after NFS4ERR_DELAY
  - pktgen: use cpus_read_lock() in pg_net_init()
  - drm/amd/display: Ensure index calculation will not overflow
  - VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  - !11494  ext4: Fix race in buffer_head read fault injection
  - !11677  wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
  - !11673  netem: fix return value if duplicate enqueue fails
  - !11810  apparmor: fix possible NULL pointer dereference
  - !11805  drm/amdgpu: Fix out-of-bounds write warning
  - !11678  udf: Avoid excessive partition lengths
  - !11680  binder: fix UAF caused by offsets overwrite
  - !11784  perf/x86: Serialize set_attr_rdpmc()
  - !11815  selinux,smack: don't bypass permissions check in inode_setsecctx hook
  - bpf: verifier: prevent userspace memory access
  - can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
  - can: bcm: Remove proc entry when dev is unregistered.
  - drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
  - !11741  powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
  - !11788 The ip_notify_sysfs_create function logs are recorded using the netdev_err interface.
  - !11801  can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
  - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  - selinux,smack: don't bypass permissions check in inode_setsecctx hook
  - apparmor: fix possible NULL pointer dereference
  - drm/amdgpu: Fix out-of-bounds write warning
  - modify for ICSL.
  - can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
  - nilfs2: fix missing cleanup on rollforward recovery error
  - perf/x86: Serialize set_attr_rdpmc()
  - !11730  media: xc2028: avoid use-after-free in load_firmware_cb()
  - !11738  hwmon: (adc128d818) Fix underflows seen when writing limit attributes
  - !11752  driver: iio: add missing checks on iio_info's callback access
  - !11773  A group of optimization and bug fix for numa-affinity
  - mm: numa-affinity: fix build error when !CONFIG_PROC_SYSCTL
  - mm: numa-affinity: adapt for task_numa_placement
  - mm: numa-affinity: adapt for should_numa_migrate_memory
  - mm: numa-affinity: add helper numa_affinity_sampling_enabled()
  - mm: thp: support to control numa migration
  - Input: MT - limit max slots
  - driver: iio: add missing checks on iio_info's callback access
  - ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
  - powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
  - hwmon: (adc128d818) Fix underflows seen when writing limit attributes
  - media: xc2028: avoid use-after-free in load_firmware_cb()
  - binder: fix UAF caused by offsets overwrite
  - udf: Avoid excessive partition lengths
  - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
  - netem: fix return value if duplicate enqueue fails
  - ext4: Fix race in buffer_head read fault injection


author: Li Nan <linan122@huawei.com> - 5.10.0-232.0.0.134
changelog:
  - !12102  Fix CVE-2024-46826
  - !12219 v7  xfs: some fix for forcealign
  - !12121  CVE-2024-43855
  - !12204  Backport "ima: Avoid blocking in RCU read-side critical section"
  - xfs: correct the truncate blocksize of forcealign
  - xfs: refactor the truncating order
  - iomap: pass blocksize to iomap_truncate_page()
  - math64: add rem_u64() to just return the remainder
  - xfs: only bunmap align in datafork for forcealign
  - xfs: forcealign not compatible with reflink and realtime device
  - xfs: simplify extent allocation alignment
  - xfs: don't attempting non-aligned fallbacks alloc for forcealign
  - xfs: Don't revert allocated offset for forcealign
  - xfs: align args->minlen for forced allocation alignment
  - xfs: always tail align maxlen allocations
  - xfs: only allow minlen allocations when near ENOSPC
  - !12136 Backport some SAS patches to OLK-5.10
  - !12215  net/hinic3: fix version showed in ethtool
  - !12166  crypto: stm32/cryp - call finalize with bh disabled
  - !12207 v2  atm: idt77252: prevent use after free in dequeue_rx()
  - net/hinic3: fix version showed in ethtool
  - !12142  nfc: pn533: Add poll mod list filling check
  - !12149  wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  - !12139  arm64/mpam: Be compatible with MPAM architecture v1.x
  - atm: idt77252: prevent use after free in dequeue_rx()
  - !12172  fou: remove warn in gue_gro_receive on unsupported protocol
  - !12170  xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
  - ima: Avoid blocking in RCU read-side critical section
  - Revert "ima: Avoid blocking in RCU read-side critical section"
  - !12163  bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
  - !12133  ALSA: line6: Fix racy access to midibuf
  - fou: remove warn in gue_gro_receive on unsupported protocol
  - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
  - crypto: stm32/cryp - call finalize with bh disabled
  - bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
  - !12127  sched: sch_cake: fix bulk flow accounting logic for host fairness
  - !12126  ice: Add netif_device_attach/detach into PF reset flow
  - !12125  bpf: Remove tst_run from lwt_seg6local_prog_ops.
  - !12135 Backport 5.10.217 LTS patches from upstream
  - regulator: core: fix debugfs creation regression
  - hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
  - mei: me: add lunar lake point M DID
  - ASoC: tegra: Fix DSPK 16-bit playback
  - net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
  - iio: accel: mxc4005: Interrupt handling fixes
  - iio:imu: adis16475: Fix sync mode setting
  - ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
  - usb: dwc3: core: Prevent phy suspend during init
  - usb: xhci-plat: Don't include xhci.h
  - usb: gadget: f_fs: Fix a race condition when processing setup packets.
  - usb: gadget: composite: fix OS descriptors w_value logic
  - usb: ohci: Prevent missed ohci interrupts
  - usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device
  - usb: typec: ucsi: Fix connector check on init
  - usb: typec: ucsi: Check for notifications after init
  - arm64: dts: qcom: Fix 'interrupt-map' parent address cells
  - btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send()
  - net: bridge: fix corrupted ethernet header on multicast-to-unicast
  - kcov: Remove kcov include from sched.h and move it to its users.
  - hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
  - hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event()
  - hwmon: (corsair-cpro) Use a separate buffer for sending commands
  - net:usb:qmi_wwan: support Rolling modules
  - drm/nouveau/dp: Don't probe eDP ports twice harder
  - fs/9p: drop inodes immediately on non-.L too
  - clk: Don't hold prepare_lock when calling kref_put()
  - gpio: crystalcove: Use -ENOTSUPP consistently
  - gpio: wcove: Use -ENOTSUPP consistently
  - 9p: explicitly deny setlease attempts
  - fs/9p: translate O_TRUNC into OTRUNC
  - selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
  - MIPS: scall: Save thread_info.syscall unconditionally on entry
  - gpu: host1x: Do not setup DMA for virtual devices
  - scsi: target: Fix SELinux error when systemd-modules loads the target module
  - btrfs: always clear PERTRANS metadata during commit
  - btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
  - tools/power turbostat: Fix Bzy_MHz documentation typo
  - tools/power turbostat: Fix added raw MSR output
  - ata: sata_gemini: Check clk_enable() result
  - net: bcmgenet: Reset RBUF on first open
  - ALSA: line6: Zero-initialize message buffers
  - btrfs: return accurate error code on open failure in open_fs_devices()
  - net: mark racy access on sk->sk_rcvbuf
  - wifi: cfg80211: fix rdev_dump_mpp() arguments order
  - wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
  - gfs2: Fix invalid metadata access in punch_hole
  - scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
  - net: gro: add flush check in udp_gro_receive_segment
  - net: bridge: fix multicast-to-unicast with fraglist GSO
  - net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
  - cxgb4: Properly lock TX queue for the selftest.
  - ASoC: meson: cards: select SND_DYNAMIC_MINORS
  - ASoC: Fix 7/8 spaces indentation in Kconfig
  - net: qede: use return from qede_parse_actions()
  - net: qede: use return from qede_parse_flow_attr() for flow_spec
  - net: qede: use return from qede_parse_flow_attr() for flower
  - net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
  - s390/vdso: Add CFI for RA register to asm macro vdso_func
  - net l2tp: drop flow hash on forward
  - s390/mm: Fix clearing storage keys for huge pages
  - s390/mm: Fix storage key clearing for guest huge pages
  - wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  - nfc: pn533: Add poll mod list filling check
  - arm64/mpam: Be compatible with MPAM architecture v1.x
  - scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed
  - scsi: libsas: Fix the failure of adding phy with zero-address to port
  - scsi: libsas: Set port when ex_phy is added or deleted
  - scsi: libsas: Move sas_add_parent_port() to sas_expander.c
  - scsi: libsas: Add helper for port add ex_phy
  - ALSA: line6: Fix racy access to midibuf
  - sched: sch_cake: fix bulk flow accounting logic for host fairness
  - ice: Add netif_device_attach/detach into PF reset flow
  - bpf: Remove tst_run from lwt_seg6local_prog_ops.
  - !12045  s390/dasd: fix error recovery leading to data corruption on ESE devices
  - !12043  s390/sclp: Prevent release of buffer in I/O
  - md: ensure child flush IO does not affect origin bio->bi_status
  - md: Remove flush handling
  - !8834 Add support for Hygon model 10h processors
  - !12105  sched/fair: Fix the condition in overload_clear
  - !12103  sched/debug: Fix h_nr_running/steal_h_nr_running in sched_debug
  - !12003  perf cpumap: Wrapper for CPU map indices
  - !12096  CVE-2024-46858
  - !12095  net: dpaa: Pad packets to ETH_ZLEN
  - !12094  netfilter: nft_socket: fix sk refcount leaks
  - !12089  USB: usbtmc: prevent kernel-usb-infoleak
  - sched/fair: Fix the condition in overload_clear
  - sched/debug: Fix h_nr_running/steal_h_nr_running in sched_debug
  - ELF: Fix mixed declarations and code of "snapshot_randomize_va_space"
  - ELF: fix kernel.randomize_va_space double read
  - mptcp: pm: Fix uaf in __timer_delete_sync
  - mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer
  - mptcp: export lookup_anno_list_by_saddr
  - net: dpaa: Pad packets to ETH_ZLEN
  - netfilter: nft_socket: fix sk refcount leaks
  - !12088  tracing: Have tracing_max_latency inc the trace array ref count
  - USB: usbtmc: prevent kernel-usb-infoleak
  - tracing: Have tracing_max_latency inc the trace array ref count
  - !11856  acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - !12084  drm/i915/gt: Cleanup partial engine discovery failures
  - !12048  Add generic xdp xsk multi-buffer recv for ipvlan
  - !12078  btrfs: clean up our handling of refs == 0 in snapshot delete
  - !12053  drm/amdgpu: the warning dereferencing obj for nbio_v7_4
  - drm/i915/gt: Cleanup partial engine discovery failures
  - !11558  mm/ksm: fix possible UAF of stable_node
  - !11889 UNIC: Invoke the hns3_unic_set_default_cc in advance and modify ublhdr struct
  - btrfs: clean up our handling of refs == 0 in snapshot delete
  - drm/amdgpu: the warning dereferencing obj for nbio_v7_4
  - xsk: Add generic xdp multi-buffer recv support
  - ipvlan: support use xdp native mode
  - s390/dasd: fix error recovery leading to data corruption on ESE devices
  - s390/sclp: Prevent release of buffer in I/O
  - perf cpumap: Wrapper for CPU map indices
  - UNIC: The ublhdr structure and UBL_HLEN macro are modified
  - UNIC: Invoke the hns3_unic_set_default_cc in advance
  - acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - ALSA: hda: Add support for Hygon family 18h model 10h HD-Audio
  - hwmon/k10temp: Add support for Hygon family 18h model 10h
  - x86/amd_nb: Add support for Hygon family 18h model 10h
  - x86/amd_nb: Add support for Hygon family 18h model 10h
  - x86/cpu: Get LLC ID for Hygon family 18h model 10h
  - x86/amd_nb: Get DF ID for Hygon family 18h model 7h
  - mm/ksm: fix possible UAF of stable_node


author: Li Nan <linan122@huawei.com> - 5.10.0-233.0.0.135
changelog:
  - !12315 perf pmu: resolve CPU map for "cpu" PMUs
  - perf arm: Workaround ARM PMUs cpu maps having offline cpus
  - perf pmu: Add CPU map for "cpu" PMUs
  - !12072 sdma-dae: fix possible mremap error
  - perf cpumap: Add intersect function
  - perf cpumap: Add is_subset function
  - Revert "perf cpumap: Add is_subset function"
  - Revert "perf cpumap: Add intersect function"
  - Revert "perf pmu: Add CPU map for "cpu" PMUs"
  - Revert "perf arm: Workaround ARM PMUs cpu maps having offline cpus"
  - !12298  CVE-2024-46822
  - drivers:misc:sdma-dae: add vma_ops to avoid mremap error
  - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
  - arm64: acpi: Move get_cpu_for_acpi_id() to a header
  - !12261  drm/lima: fix a memleak in lima_heap_alloc
  - !12262  media: go7007: fix a memleak in go7007_load_encoder
  - !12257  octeontx2-af: Use separate handlers for interrupts
  - !12264  drm/amd/display: Avoid overflow from uint32_t to uint8_t
  - drm/amd/display: Avoid overflow from uint32_t to uint8_t
  - !12244 v2  net/mlx5e: Fix netif state handling
  - !12245 v2  netfilter: nf_tables: use timestamp to check for set element timeout
  - media: go7007: fix a memleak in go7007_load_encoder
  - drm/lima: fix a memleak in lima_heap_alloc
  - octeontx2-af: Use separate handlers for interrupts
  - !12254  greybus: Fix use-after-free bug in gb_interface_release due to race condition.
  - !12164 Backport 5.10.218 LTS patches from upstream
  - greybus: Fix use-after-free bug in gb_interface_release due to race condition.
  - !12155  bonding: Fix CVE-2024-44990
  - !12153  bonding: fix xfrm real_dev null pointer dereference
  - !12250  xfs: atomic write file dio convert to mark IOCB_ATOMIC
  - !11299  gpio: prevent potential speculation leaks in gpio_device_get_desc()
  - xfs: atomic write file dio convert to mark IOCB_ATOMIC
  - !12115  md/raid1: don't free conf on raid0_run failure
  - !12234  drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
  - !12236  dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
  - netfilter: nf_tables: use timestamp to check for set element timeout
  - net/mlx5e: Fix netif state handling
  - !12185  mlxsw: spectrum_acl_erp: Fix object nesting warning
  - !12182  netns: Make get_net_ns() handle zero refcount net
  - !12179  net/sched: Fix CVE-2024-36244
  - !12176  ipv6: sr: fix invalid unregister error path
  - !12186 v2  ipv4: Fix uninit-value access in __ip_make_skb()
  - !12197  net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
  - !12213  scsi: qla2xxx: During vport delete send async logout explicitly
  - !12212  platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - !12227  nbd: Fix signal handling
  - ACPI/IORT: Add PMCG platform information for HiSilicon HIP10/11
  - dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
  - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
  - !12208  Some bugfixs for ubi/fs
  - nbd: Fix signal handling
  - nbd: Improve the documentation of the locking assumptions
  - !11910  ext4: dax: Fix inconsistent isize during writing
  - !12075  blk-mq: fix lockdep hardirq warning in __blk_mq_tag_idle()
  - !12162 【OLK-5.10】Workaround ARM PMUs cpu maps having offline cpus
  - scsi: qla2xxx: During vport delete send async logout explicitly
  - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - locks: fix TOCTOU race when granting write lease
  - ubi: block: fix null-pointer-dereference in ubiblock_create()
  - ubi: block: Remove in vain semicolon
  - net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
  - ipv4: Fix uninit-value access in __ip_make_skb()
  - mlxsw: spectrum_acl_erp: Fix object nesting warning
  - netns: Make get_net_ns() handle zero refcount net
  - net/sched: taprio: extend minimum interval restriction to entire cycle too
  - net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX.
  - ipv6: sr: fix invalid unregister error path
  - docs: kernel_include.py: Cope with docutils 0.21
  - serial: kgdboc: Fix NMI-safety problems from keyboard reset code
  - usb: typec: ucsi: displayport: Fix potential deadlock
  - drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()
  - KVM: x86: Clear "has_error_code", not "error_code", for RM exception injection
  - netlink: annotate lockless accesses to nlk->max_recvmsg_len
  - net: bcmgenet: synchronize UMAC_CMD access
  - net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
  - Revert "selftests: mm: fix map_hugetlb failure on 64K page size systems"
  - pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin()
  - perf arm: Workaround ARM PMUs cpu maps having offline cpus
  - perf pmu: Add CPU map for "cpu" PMUs
  - bonding: fix null pointer deref in bond_ipsec_offload_ok
  - bonding: fix bond_ipsec_offload_ok return type
  - bonding: fix xfrm real_dev null pointer dereference
  - perf cpumap: Add intersect function
  - perf cpumap: Add is_subset function
  - md/raid1: don't free conf on raid0_run failure
  - blk-mq: fix lockdep hardirq warning in __blk_mq_tag_idle()
  - ext4: dax: keep orphan list before truncate overflow allocated blocks
  - ext4: dax: fix overflowing extents beyond inode size when partially writing
  - gpio: prevent potential speculation leaks in gpio_device_get_desc()


author: Li Nan <linan122@huawei.com> - 5.10.0-234.0.0.136
changelog:
  - !12672  ocfs2: remove unreasonable unlock in ocfs2_read_blocks
  - !12670  drm/amd/display: Fix index out of bounds in degamma hardware format translation
  - !12248  nilfs2: fix state management in error path of log writing function
  - !12641  tcp: check skb is non-NULL in tcp_rto_delta_us()
  - !12640  sock_map: Add a cond_resched() in sock_hash_free()
  - !12642  RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
  - !12639  net: do not delay dst_entries_add() in dst_release()
  - !12621  apparmor: fix policy_unpack_test on big endian systems
  - ocfs2: remove unreasonable unlock in ocfs2_read_blocks
  - drm/amd/display: Fix index out of bounds in degamma hardware format translation
  - !12275  blk-mq: fix blk_mq_hw_ctx active request accounting
  - !12611  drm/amd/display: Check null pointer before dereferencing se
  - !12596  scsi: fnic: Move flush_work initialization out of if block
  - !12505  ocfs2: cancel dqi_sync_work before freeing oinfo
  - !12615  writeback: Fix inode->i_io_list not be protected by inode->i_lock error
  - !12620  PCI: mt7621: Add sentinel to quirks table
  - RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
  - tcp: check skb is non-NULL in tcp_rto_delta_us()
  - sock_map: Add a cond_resched() in sock_hash_free()
  - net: do not delay dst_entries_add() in dst_release()
  - !12556  NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
  - apparmor: fix policy_unpack_test on big endian systems
  - !12571 v2  Randomized Kmalloc 5.10 Backport V2
  - PCI: mt7621: Add sentinel to quirks table
  - !12109 [OLK-5.10] mptcp: pm: only decrement add_addr_accepted for MPJ req
  - !12605  fix CVE-2024-46802
  - !12445  nilfs2: fix potential oob read in nilfs_btree_check_delete()
  - init: Initialize noop_backing_dev_info early
  - writeback: Fix inode->i_io_list not be protected by inode->i_lock error
  - !8925  ext4: avoid deadlock in fs reclaim with page writeback
  - drm/amd/display: Check null pointer before dereferencing se
  - !12466  drm/amd/display: Initialize get_bytes_per_element's default to 1
  - !12581  drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
  - !12460  NFSD: Limit the number of concurrent async COPY operations
  - !12560  fix CVE-2024-49900
  - !12569  fix CVE-2024-47667
  - drm/amd/display: fix mixed declarations warning
  - drm/amd/display: added NULL check at start of dc_validate_stream
  - !12459  drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
  - !12453  drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
  - !12442  drm/amd/display: Fix index out of bounds in DCN30 color transformation
  - scsi: fnic: Move flush_work initialization out of if block
  - drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
  - !12402  drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
  - Randomized slab caches for kmalloc()
  - mm/slab: introduce kmem_cache flag SLAB_NO_MERGE
  - !12536  kabi: use CONFIG_KABI_RESERVE to control reservation in ucount_type and user_table
  - !12424  jfs: check if leafidx greater than num leaves per dmap tree
  - !12425  jfs: Fix uaf in dbFreeBits
  - !12422  btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
  - !12423  btrfs: wait for fixup workers before stopping cleaner kthread during umount
  - !12523  netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
  - PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
  - PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
  - !12542  media: pci: cx23885: check cx23885_vdev_init() return
  - jfs: Fix uninit-value access of new_ea in ea_buffer
  - NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
  - !12369  x86/ioapic: Handle allocation failures gracefully
  - media: pci: cx23885: check cx23885_vdev_init() return
  - kabi: use CONFIG_KABI_RESERVE to control reservation in ucount_type and user_table
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
  - !12511  jfs: Fix array-index-out-of-bounds in diFree
  - !12510  devres: Fix memory leakage caused by driver API devm_free_percpu()
  - !12509  exfat: fix potential deadlock on __exfat_get_dentry_set
  - !12252  KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
  - !12387  spi: nxp-fspi: fix the KASAN report out-of-bounds bug
  - !12385  drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
  - !12382  fix CVE-2024-46675
  - !12360  hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
  - !12451  iommu/vt-d: Fix double list_add when enabling VMD in scalable mode
  - !12467  fix CVE-2024-42301
  - !12310  fix CVE-2024-40965
  - !12484  CVE-2024-38667
  - !12480  CVE-2024-36286
  - !12454  soundwire: cadence: fix invalid PDI offset
  - jfs: Fix array-index-out-of-bounds in diFree
  - devres: Fix memory leakage caused by driver API devm_free_percpu()
  - exfat: fix potential deadlock on __exfat_get_dentry_set
  - ocfs2: cancel dqi_sync_work before freeing oinfo
  - !12411  CVE-2024-43894
  - riscv: prevent pt_regs corruption for secondary idle threads
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
  - !12391  mm/swapfile: skip HugeTLB pages for unuse_vma
  - !12350  i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
  - parport: Proper fix for array out-of-bounds access
  - dev/parport: fix the array out-of-bounds risk
  - drm/amd/display: Initialize get_bytes_per_element's default to 1
  - NFSD: Limit the number of concurrent async COPY operations
  - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
  - soundwire: cadence: fix invalid PDI offset
  - drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
  - iommu/vt-d: Fix double list_add when enabling VMD in scalable mode
  - nilfs2: fix potential oob read in nilfs_btree_check_delete()
  - drm/amd/display: Fix index out of bounds in DCN30 color transformation
  - !12272  drm/amdgpu: fix mc_data out-of-bounds read warning
  - !12395  tracing/timerlat: Fix a race during cpuhp processing
  - !12406  fix CVE-2024-43841
  - jfs: Fix uaf in dbFreeBits
  - jfs: check if leafidx greater than num leaves per dmap tree
  - btrfs: wait for fixup workers before stopping cleaner kthread during umount
  - btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
  - drm/client: fix null pointer dereference in drm_client_modeset_probe
  - wifi: virt_wifi: don't use strlen() in const context
  - wifi: virt_wifi: avoid reporting connection success with wrong SSID
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
  - tracing/timerlat: Fix a race during cpuhp processing
  - mm/swapfile: skip HugeTLB pages for unuse_vma
  - spi: nxp-fspi: fix the KASAN report out-of-bounds bug
  - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
  - usb: dwc3: core: Prevent USB core invalid event buffer address access
  - usb: dwc3: core: Skip setting event buffers for host only controllers
  - !12349  neighbour: fix data-races around n->output
  - !12294  nfsd: return -EINVAL when namelen is 0
  - x86/ioapic: Handle allocation failures gracefully
  - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
  - !12318  nfsd: call cache_put if xdr_reserve_space returns NULL
  - !12344  of: module: prevent NULL pointer dereference in vsnprintf()
  - !12342  nvmet: fix a possible leak when destroy a ctrl during qp establishment
  - !12334  drm/nouveau: prime: fix refcount underflow
  - i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
  - neighbour: fix data-races around n->output
  - !12336  ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
  - !12305  soc: qcom: cmd-db: Map shared memory as WC, not WB
  - !12332 hns3 udma: delete irrl and trrl table
  - of: module: prevent NULL pointer dereference in vsnprintf()
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment
  - hns3 udma: delete irrl and trrl table.
  - ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
  - drm/nouveau: prime: fix refcount underflow
  - mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow
  - nfsd: call cache_put if xdr_reserve_space returns NULL
  - i2c: lpi2c: Avoid calling clk_get_rate during transfer
  - i2c: imx-lpi2c: return -EINVAL when i2c peripheral clk doesn't work
  - i2c: imx-lpi2c: use bulk clk API
  - clk: Provide !COMMON_CLK dummy for devm_clk_rate_exclusive_get()
  - clk: Add a devm variant of clk_rate_exclusive_get()
  - soc: qcom: cmd-db: Map shared memory as WC, not WB
  - nfsd: return -EINVAL when namelen is 0
  - blk-mq: fix blk_mq_hw_ctx active request accounting
  - drm/amdgpu: fix mc_data out-of-bounds read warning
  - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
  - nilfs2: fix state management in error path of log writing function
  - mptcp: pm: only decrement add_addr_accepted for MPJ req
  - ext4: avoid deadlock in fs reclaim with page writeback


author: Li Nan <linan122@huawei.com> - 5.10.0-235.0.0.137
changelog:
  - !13009  CVE-2024-49950
  - !12984 [OLK-5.10] Backport scsi bugfix and cleancode from upstream
  - !13003  CVE-2024-50064
  - !13051  ext4: fix CVE-2024-47701
  - !12680  smb: client: fix UAF in async decryption
  - !13039  static_call: Handle module init failure correctly in static_call_del_module()
  - !13017  f2fs: fix to wait dio completion
  - !13016  f2fs: fix to check atomic_file in f2fs ioctl interfaces
  - !13015  drm/amd/display: Check stream before comparing them
  - !13019  l2tp: prevent possible tunnel refcount underflow
  - !13022  wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
  - ext4: avoid OOB when system.data xattr changes underneath the filesystem
  - ext4: explicitly exit when ext4_find_inline_entry returns an error
  - ext4: return error on ext4_find_inline_entry
  - ext4: ext4_search_dir should return a proper error
  - !13034  efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
  - !12992  igb: Do not bring the device up after non-fatal error
  - !12994  drm/amd/display: Check BIOS images before it is used
  - !12878 UNIC: Eliminate compile warnings when the option CONFIG_HNS3_UBL is not set
  - !12901  ext4: fix double brelse() the buffer of the extents path
  - !12897  ext4: aovid use-after-free in ext4_ext_insert_extent()
  - !12958  ext4: update orig_path in ext4_find_extent()
  - static_call: Handle module init failure correctly in static_call_del_module()
  - !12449  scsi: core: Avoid leaving shost->last_reset with stale value if EH does not run
  - efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
  - l2tp: prevent possible tunnel refcount underflow
  - f2fs: fix to wait dio completion
  - !12884  CVE-2024-50016
  - !12844  ACPI: sysfs: validate return type of _STR method
  - f2fs: fix to check atomic_file in f2fs ioctl interfaces
  - drm/amd/display: Check stream before comparing them
  - !12998  f2fs: get rid of online repaire on corrupted directory
  - !12911  fsnotify: fix CVE-2024-47660
  - !12908  io_uring: fix CVE-2024-50060
  - !12879  drm/stm: Avoid use-after-free issues with crtc and plane
  - !12915  CVE-2022-48961
  - Bluetooth: L2CAP: Fix uaf in l2cap_connect
  - Bluetooth: Return whether a connection is outbound
  - !12944  fix CVE-2024-47723
  - !12950  drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
  - !12954  memcg_write_event_control(): fix a user-triggerable oops
  - !12824  f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
  - !12548  fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
  - !12870  Fix CVE-2024-47703
  - !12893  ext4: avoid use-after-free in ext4_ext_show_leaf()
  - zram: don't free statically defined names
  - zram: free secondary algorithms names
  - [Backport]scsi: libsas: Fix disk not being scanned in after being removed
  - [Backport]scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type()
  - f2fs: get rid of online repaire on corrupted directory
  - [Backport]scsi: libsas: Introduce struct smp_disc_resp
  - !12934  gpiolib: fix memory leak in gpiochip_setup_dev()
  - !12686  security/keys: fix slab-out-of-bounds in key_task_permission
  - drm/amd/display: Check BIOS images before it is used
  - igb: Do not bring the device up after non-fatal error
  - !12831  lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
  - !12689  ocfs2: reserve space for inline xattr before attaching reflink tree
  - !12920  ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
  - !12890  drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
  - !12875  tipc: guard against string buffer overrun
  - ext4: update orig_path in ext4_find_extent()
  - memcg_write_event_control(): fix a user-triggerable oops
  - !12781  uprobes: fix kernel info leak via "[uprobes
  - drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
  - !12928  tcp: fix mptcp DSS corruption due to large pmtu xmit
  - jfs: Fix sanity check in dbMount
  - jfs: fix out-of-bounds in dbNextAG() and diAlloc()
  - !12926  gso: fix udp gso fraglist segmentation after pull from frag_list
  - !12927  RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
  - gpiolib: fix memory leak in gpiochip_setup_dev()
  - tcp: fix mptcp DSS corruption due to large pmtu xmit
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
  - gso: fix udp gso fraglist segmentation after pull from frag_list
  - !12812  serial: protect uart_port_dtr_rts() in uart_shutdown() too
  - !12790  slip: make slhc_remember() more robust against malicious packets
  - !12801  ext4: fix slab-use-after-free in ext4_split_extent_at()
  - !12737  r8169: add tally counter fields added with RTL8125
  - !12741  net/xen-netback: prevent UAF in xenvif_flush_hash()
  - !12407  padata: use integer wrap around to prevent deadlock on seq_nr overflow
  - !12778  riscv: Sync efi page table's kernel mappings before switching
  - !12867  hisilicon/hisi_hbmdev: prevent NULL pointer dereference when corrently
  - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
  - net: mdio: fix unbalanced fwnode reference count in mdio_device_release()
  - net: mdio: use device_set_node() to setup both fwnode and of
  - fsnotify: clear PARENT_WATCHED flags lazily
  - fsnotify: remove unused declaration
  - fsnotify: Fix comment typo
  - io_uring: check if we need to reschedule during overflow flush
  - io_uring: always lock __io_cqring_overflow_flush
  - ext4: fix double brelse() the buffer of the extents path
  - ext4: aovid use-after-free in ext4_ext_insert_extent()
  - ext4: avoid use-after-free in ext4_ext_show_leaf()
  - drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
  - drm/amd/display: Avoid overflow assignment in link_dp_cts
  - UNIC: Eliminate compile warnings
  - drm/stm: Avoid use-after-free issues with crtc and plane
  - tipc: guard against string buffer overrun
  - bpf, lsm: Add check for BPF LSM return value
  - bpf, lsm: Add disabled BPF LSM hook list
  - hisilicon/hisi_hbmdev: prevent NULL pointer dereference when corrently
  - !12525  powercap: intel_rapl: Fix off by one in get_rpi()
  - !12818  media: venus: fix use after free bug in venus_remove due to race condition
  - !12825  drm/amd/display: Check null pointers before using them
  - !12798  uprobe: avoid out-of-bounds memory access of fetching args
  - ACPI: sysfs: validate return type of _STR method
  - !12764  thermal: core: Reference count the zone in thermal_zone_get_by_id()
  - !12658  nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
  - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
  - !12794  platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
  - !12754  CVE-2024-50063
  - !12488  gtp: fix a potential NULL pointer dereference
  - !12762  smack: tcp: ipv4, fix incorrect labeling
  - drm/amd/display: Check null pointers before using them
  - f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
  - media: venus: fix use after free bug in venus_remove due to race condition
  - serial: protect uart_port_dtr_rts() in uart_shutdown() too
  - !12758  selinux: add the processing of the failure of avc_add_xperms_decision()
  - ext4: fix slab-use-after-free in ext4_split_extent_at()
  - uprobe: avoid out-of-bounds memory access of fetching args
  - platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
  - !12770 v2  hisilicon/hisi_hbmcache: Use mutex_trylock to prevent hung task
  - slip: make slhc_remember() more robust against malicious packets
  - uprobes: fix kernel info leak via "[uprobes]" vma
  - riscv: Sync efi page table's kernel mappings before switching
  - hisilicon/hisi_hbmcache: Use mutex_trylock to prevent hung task
  - !12551  cifs: Fix buffer overflow when parsing NFS reparse points
  - !12713  drm: omapdrm: Add missing check for alloc_ordered_workqueue
  - thermal: core: Reference count the zone in thermal_zone_get_by_id()
  - !12723  ppp: fix ppp_async_encode() illegal access
  - smack: tcp: ipv4, fix incorrect labeling
  - !12733  CVE-2024-50059
  - !12373  fix CVE-2024-49954
  - !12705  fix CVE-2024-49924
  - !12517  fix CVE-2024-47742
  - selinux: add the processing of the failure of avc_add_xperms_decision()
  - selftests/bpf: Add test for lsm tail call
  - bpf: Prevent tail call between progs attached to different hooks
  - !12665 v2  CVE-2024-49955
  - !12685  block: fix potential invalid pointer dereference in blk_add_partition
  - net/xen-netback: prevent UAF in xenvif_flush_hash()
  - !12697  mm: memcg: don't periodically flush stats when memcg is disabled
  - !12694  crypto: xor - fix template benchmarking
  - !12701  vhost_vdpa: assign irq bypass producer token correctly
  - r8169: add tally counter fields added with RTL8125
  - ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
  - ppp: fix ppp_async_encode() illegal access
  - !12678  CVE-2024-47673
  - !12676  IB/core: Fix ib_cache_setup_one error flow cleanup
  - drm: omapdrm: Add missing check for alloc_ordered_workqueue
  - fbdev: pxafb: Fix possible use after free in pxafb_task()
  - vhost_vdpa: assign irq bypass producer token correctly
  - !12629  blk-mq: Fix kmemleak in blk_mq_init_allocated_queue
  - !12667  randomize_kstack: Improve entropy diffusion
  - !12668  selinux: fix potential counting error in avc_add_xperms_decision()
  - !12499  nbd: fix race between timeout and normal completion
  - mm: memcg: don't periodically flush stats when memcg is disabled
  - !12610  blk_iocost: fix more out of bound shifts
  - crypto: xor - fix template benchmarking
  - crypto: xor - Fix typo of optimization
  - !12633  ALSA: asihpi: Fix potential OOB array access
  - !12354 Backport important bugfix from the kernel-5.10.y
  - ocfs2: reserve space for inline xattr before attaching reflink tree
  - security/keys: fix slab-out-of-bounds in key_task_permission
  - block: fix potential invalid pointer dereference in blk_add_partition
  - smb: client: fix UAF in async decryption
  - wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
  - iwlwifi: mvm: move iwl_mvm_stop_device() out of line
  - IB/core: Fix ib_cache_setup_one error flow cleanup
  - selinux: fix potential counting error in avc_add_xperms_decision()
  - randomize_kstack: Improve entropy diffusion
  - ACPI: battery: Fix possible crash when unregistering a battery hook
  - ACPI: battery: Simplify battery hook locking
  - nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
  - scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
  - ALSA: asihpi: Fix potential OOB array access
  - blk-mq: Fix kmemleak in blk_mq_init_allocated_queue
  - blk_iocost: fix more out of bound shifts
  - cifs: Fix buffer overflow when parsing NFS reparse points
  - fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
  - powercap: intel_rapl: Fix off by one in get_rpi()
  - firmware_loader: Block path traversal
  - nbd: fix race between timeout and normal completion
  - gtp: fix a potential NULL pointer dereference
  - scsi: fix kabi broken
  - scsi: core: Avoid leaving shost->last_reset with stale value if EH does not run
  - padata: use integer wrap around to prevent deadlock on seq_nr overflow
  - static_call: Replace pointless WARN_ON() in static_call_module_notify()
  - scsi: mpt3sas: Remove scsi_dma_map() error messages


