# changelog

author: Li Nan <linan122@huawei.com> - 5.10.0-239.0.0.141
changelog:
  - !14040  hwpoison, memory_hotplug: lock page before unmap for hwpoisoned page
  - !10939  filelock: Correct the file lock owner in fcntl_setlk64
  - !11339  Fix xfs fsmap error
  - !11338  xfs: fix log recovery when unknown rocompat bits are set
  - !12547 [OLK-5.10] drivers: update yunsilicon drivers to version rel_2406_rc16.2
  - hwpoison, memory_hotplug: lock page before unmap for hwpoisoned page
  - !13234  xfs: Fix missing interval for missing_owner in xfs fsmap
  - !14036  xfs: Fix data overflow in xfs_mod_fdblocks()
  - !14014  *** CVE-2024-53063 ***
  - !13956  fs: Fix uninitialized value issue in from_kuid and from_kgid
  - !14021 [revert][2024.12.2]bugfix rdma to OLK-5.10
  - xfs: Fix data overflow in xfs_mod_fdblocks()
  - !13337  fix CVE-2024-50135
  - !13982 [OLK-5.10]ipvlan: fix UAF after skb has been consumed by xdp generic
  - Revert "RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci"
  - Revert "RDMA/hns: Fix cpu stuck caused by printings during reset"
  - !13937  ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
  - !13936  wifi: rtw88: always wait for both firmware loading attempts
  - !13935  Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
  - !13934  net/sched: accept TCA_STAB only for root qdisc
  - !13933  net: ethernet: lantiq_etop: fix memory disclosure
  - !13932  net: Fix an unsafe loop on the list
  - !13931  net: stmmac: Fix zero-division error when disabling tc cbs
  - !13930  sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
  - !13929  wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
  - !13928  wifi: ath11k: fix array out-of-bound access in SoC stats
  - ipvlan: fix UAF after skb has been consume by xdp generic
  - media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
  - media: dvbdev: prevent the risk of out of memory access
  - !13839  afs: Fix lock recursion
  - !13860 [2024.12.2]bugfix rdma to OLK-5.10
  - !13844  crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
  - !13921  wifi: ath10k: Fix memory leak in management tx
  - !13920  RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
  - !13967  bpf: Check validity of link->type in bpf_link_show_fdinfo()
  - !13966  blk-mq/scsi: tracking device queue depth via sbitmap
  - bpf: Check validity of link->type in bpf_link_show_fdinfo()
  - !13964 v3  arm64: mm: Stop use spinlock during pbha early init
  - scsi: core: Increase max device queue_depth to 4096
  - sbitmap: fix kabi broken in struct scsi_device
  - sbitmap: fix kabi broken in struct blk_mq_ops and struct scsi_cmnd
  - sbitmap: fix kabi broken by adding struct sbitmap_extend
  - scsi: core: Fix scsi_device_max_queue_depth()
  - scsi: blk-mq: Fix build warning when making htmldocs
  - scsi: sbitmap: Silence a debug kernel warning triggered by sbitmap_put()
  - scsi: core: Replace sdev->device_busy with sbitmap
  - scsi: core: Make sure sdev->queue_depth is <= max(shost->can_queue, 1024)
  - scsi: core: Add scsi_device_busy() wrapper
  - scsi: megaraid_sas: Replace sdev_busy with local counter
  - scsi: blk-mq: Return budget token from .get_budget callback
  - scsi: blk-mq: Add callbacks for storing & retrieving budget token
  - scsi: sbitmap: Add sbitmap_calculate_shift() helper
  - scsi: sbitmap: Export sbitmap_weight
  - scsi: sbitmap: Move allocation hint into sbitmap
  - scsi: sbitmap: Add helpers for updating allocation hint
  - scsi: sbitmap: Maintain allocation round_robin in sbitmap
  - sbitmap: optimise sbitmap_deferred_clear()
  - scsi: sbitmap: Remove sbitmap_clear_bit_unlock
  - arm64: mm: Stop use spinlock during pbha early init
  - fs: Fix uninitialized value issue in from_kuid and from_kgid
  - !13802  pinctrl: ocelot: fix system hang on level based interrupts
  - ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
  - wifi: rtw88: always wait for both firmware loading attempts
  - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
  - net/sched: accept TCA_STAB only for root qdisc
  - net: ethernet: lantiq_etop: fix memory disclosure
  - net: Fix an unsafe loop on the list
  - net: stmmac: Fix zero-division error when disabling tc cbs
  - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
  - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
  - wifi: ath11k: fix array out-of-bound access in SoC stats
  - wifi: ath10k: Fix memory leak in management tx
  - RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
  - !13890  ipmi: Use regspacings passed as a module parameter
  - !13898  drm/amd/display: Check link_index before accessing dc->links[
  - !13905  NFSD: Never decrement pending_async_copies on error
  - NFSD: Never decrement pending_async_copies on error
  - !13887  CVE-2024-49891
  - !13862  net: systemport: fix potential memory leak in bcm_sysport_xmit()
  - !13864  Bluetooth: bnep: fix wild-memory-access in proto_unregister
  - !13867  wifi: iwlegacy: Clear stale interrupts before resuming device
  - !13881  RDMA/bnxt_re: Add a check for memory allocation
  - drm/amd/display: Check link_index before accessing dc->links[]
  - !13878  Fix problems of mounting nfs
  - ipmi: Use regspacings passed as a module parameter
  - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths
  - !13854  CVE-2024-53059
  - !13853  sctp: properly validate chunk size in sctp_sf_ootb()
  - RDMA/bnxt_re: Add a check for memory allocation
  - nfs: ignore SB_RDONLY when mounting nfs
  - nfs: pass flags to second superblock
  - wifi: iwlegacy: Clear stale interrupts before resuming device
  - Bluetooth: bnep: fix wild-memory-access in proto_unregister
  - net: systemport: fix potential memory leak in bcm_sysport_xmit()
  - RDMA/hns: Fix cpu stuck caused by printings during reset
  - RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci
  - mac80211: always have ieee80211_sta_restart()
  - wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
  - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
  - mac80211: Add support to trigger sta disconnect on hardware restart
  - mac80211: do drv_reconfig_complete() before restarting all
  - sctp: properly validate chunk size in sctp_sf_ootb()
  - crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
  - afs: Fix lock recursion
  - pinctrl: ocelot: fix system hang on level based interrupts
  - nvme-pci: fix race condition between reset and nvme_dev_disable()
  - nvme-pci: refactor the tagset handling in nvme_reset_work
  - nvme-pci: split nvme_dev_add
  - xfs: Fix missing interval for missing_owner in xfs fsmap
  - drivers: update Yunsilicon driver to version 2406_rc16.2
  - xfs: fix an agbno overflow in __xfs_getfsmap_datadev
  - xfs: fix interval filtering in multi-step fsmap queries
  - xfs: fix log recovery when unknown rocompat bits are set
  - filelock: Correct the file lock owner in fcntl_setlk64


author: Li Nan <linan122@huawei.com> - 5.10.0-240.0.0.142
changelog:
  - !14129  bus: integrator-lm: fix OF node leak in probe()
  - !14132 v2  ACPI: APEI: handle synchronous errors in task work
  - !14046  smb: client: Fix use-after-free of network namespace.
  - ACPI: APEI: handle synchronous exceptions in task work
  - mm: memory-failure: move return value documentation to function declaration
  - ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered
  - ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events
  - !13903  Script execution control
  - !14119  bpf: sync_linked_regs() must preserve subreg_def
  - bus: integrator-lm: fix OF node leak in probe()
  - !14124  media: cx24116: prevent overflows on SNR calculus
  - !14121 [PATCH OLK-5.10] perf: Add PMCG platform information for HiSilicon HIP09A
  - media: cx24116: prevent overflows on SNR calculus
  - ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A
  - bpf: sync_linked_regs() must preserve subreg_def
  - !13917 intel: backport TPMI base driver and PMT fix and update for 5.10
  - !14104  nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
  - !14114  media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
  - !14086  ocfs2: uncache inode which has failed entering the group
  - nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
  - !13401 IMA: Fix hungtask issue of digestlist importing
  - !14033  fix CVE-2024-50278
  - !14087 v2  drivers/perf: hisi: Add support for HiSilicon DDRC v3 PMU driver
  - !14057  ACPI: Fix Generic Initiator Affinity _OSC bit
  - !14092  USB: serial: io_edgeport: fix use after free in debug printk
  - !14064  vp_vdpa: fix id_table array not null terminated error
  - !14073  HID: core: zero-initialize the report buffer
  - !14030  drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
  - !14027  drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
  - !14024  iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
  - !14062  CVE-2024-53054
  - !14055  wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
  - !14054  net: sched: fix use-after-free in taprio_change()
  - !14006  filemap: Fix bounds checking in filemap_read()
  - !14007  vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
  - !14008  drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
  - !14009  drm/vc4: Stop the active perfmon before being destroyed
  - !14010  nilfs2: fix kernel bug due to missing clearing of buffer delay flag
  - USB: serial: io_edgeport: fix use after free in debug printk
  - drivers/perf: hisi: Add support for HiSilicon DDRC v3 PMU driver
  - ocfs2: uncache inode which has failed entering the group
  - !13871  ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
  - !14018  ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
  - HID: core: zero-initialize the report buffer
  - vp_vdpa: fix id_table array not null terminated error
  - cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction
  - Revert "cgroup: Fix AA deadlock caused by cgroup_bpf_release"
  - !13327 cpufreq: Add SEEP governor for hardware-managed P-states
  - !13995  drm/radeon: Fix encoder->possible_clones
  - !13948  fix CVE-2024-49906
  - cpufreq: Add SEEP governor for hardware-managed P-states
  - !13988  CVE-2024-49861
  - ACPI: bus: Indicate support for IRQ ResourceSource thru _OSC
  - ACPI: Fix Generic Initiator Affinity _OSC bit
  - !14043 v2  CVE-2024-40927
  - !14041 sdma-dae: bugfix of channel operation
  - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
  - net: sched: fix use-after-free in taprio_change()
  - smb: client: Fix use-after-free of network namespace.
  - Support for auto_act_window and energy_perf in cppc_cpufreq
  - usb: xhci: Fix TD invalidation under pending Set TR Dequeue
  - xhci: Handle TD clearing for multiple streams case
  - xhci: Fix failure to give back some cached cancelled URBs.
  - xhci: introduce a new move_dequeue_past_td() function to replace old code.
  - xhci: Fix 5.12 regression of missing xHC cache clearing command after a Stall
  - xhci: fix giving back URB with incorrect status regression in 5.12
  - xhci: split handling halted endpoints into two steps
  - xhci: use xhci_td_cleanup() helper when giving back cancelled URBs
  - drivers:misc:sdma-dae: bugfix of channel operation
  - dm cache: fix potential out-of-bounds access on the first resume
  - dm cache: optimize dirty bit checking with find_next_bit when resizing
  - dm cache: fix out-of-bounds access to the dirty bitset when resizing
  - drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
  - ACPI: CPPC: Add three register ABIs
  - drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
  - iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
  - ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
  - nilfs2: fix kernel bug due to missing clearing of buffer delay flag
  - drm/vc4: Stop the active perfmon before being destroyed
  - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
  - vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
  - filemap: Fix bounds checking in filemap_read()
  - drm/radeon: Fix encoder->possible_clones
  - bpf: Fix kabi breakage in enum bpf_type_flag
  - selftests/bpf: Rename ARG_PTR_TO_LONG test description
  - selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test
  - bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
  - bpf: Fix helper writes to read-only maps
  - bpf: Remove truncation test in bpf_strtol and bpf_strtoul helpers
  - bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
  - bpf: Allow helpers to accept pointers with a fixed size
  - bpf: Add MEM_UNINIT as a bpf_type_flag
  - drm/amd/display: Check null pointer before try to access it
  - drm/amd/display: Check null pointer before try to access it
  - fix kabi breakage due to exec is_check
  - IMA support script execution check
  - exec: Add a new AT_CHECK flag to execveat(2)
  - uselib: remove use of __FMODE_EXEC
  - exec: Check __FMODE_EXEC instead of in_execve for LSMs
  - execve: open the executable file before doing anything else
  - platform/x86/intel/pmt: telemetry: Export API to read telemetry
  - platform/x86/intel/pmt: Add header to struct intel_pmt_entry
  - platform/x86/intel/tpmi: Add additional TPMI header fields
  - platform/x86/intel/tpmi: Align comments in kernel-doc
  - platform/x86/intel/tpmi: Check major version change for TPMI Information
  - platform/x86/intel/tpmi: Handle error from tpmi_process_info()
  - platform/x86/intel/tpmi: Change vsec offset to u64
  - platform/x86/intel/tpmi: Move TPMI ID definition
  - platform/x86/intel/tpmi: Modify external interface to get read/write state
  - platform/x86/intel/tpmi: Don't create devices for disabled features
  - platform/x86/intel/vsec: Remove nuisance message
  - platform/x86/intel/vsec: Add base address field
  - platform/x86/intel/vsec: Add intel_vsec_register
  - platform/x86/intel/vsec: Assign auxdev parent by argument
  - platform/x86/intel/vsec: remove platform_info from vsec device structure
  - platform/x86/intel/vsec: Move structures to header
  - platform/x86/intel/vsec: Remove unnecessary return
  - ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
  - IMA: Fix hungtask issue of digestlist importing


author: Li Nan <linan122@huawei.com> - 5.10.0-241.0.0.143
changelog:
  - !14146 Intel: backport intel uncore frequency driver update and bugfix from 6.11
  - !14145 Intel: backport ISST driver update and bugfix from 6.11
  - !14196  watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
  - !13896 RDMA/hns: Fix flush cqe error when racing with destroy qp
  - !14193  nfs: fix the loss of superblock's initialized flags
  - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
  - nfs: fix the loss of superblock's initialized flags
  - RDMA/hns: Fix flush cqe error when racing with destroy qp
  - !14180  xfs: allow inode inactivation during a ro mount log recovery
  - !14149  CVE-2024-53142
  - xfs: allow inode inactivation during a ro mount log recovery
  - !14123  mm: only enforce minimum stack gap size if it's sensible
  - !14172  dmaengine: idxd: Let probe fail when workqueue cannot be enabled
  - dmaengine: idxd: Let probe fail when workqueue cannot be enabled
  - !12309 [OLK-5.10] AMD Genoa and Turin Crypto and Edac patches backport for OLK-5.10
  - !14148 v2  xfs: revert fix patchs about attr inactive
  - initramfs: avoid filename buffer overrun
  - Revert "xfs: factor out __xfs_da3_node_read()"
  - Revert "xfs: atomic drop extent entries when inactiving attr"
  - platform/x86: ISST: Simplify isst_misc_reg() and isst_misc_unreg()
  - platform/x86: ISST: Fix return value on last invalid resource
  - platform/x86: ISST: Use only TPMI interface when present
  - platform/x86: ISST: Avoid some SkyLake server models
  - platform/x86: ISST: Add model specific loading for common module
  - platform/x86: ISST: fix use-after-free in tpmi_sst_dev_remove()
  - !12266 [OLK-5.10] AMD Genoa and Turin iommu patches backport for OLK-5.10
  - !12311 [OLK-5.10] AMD Genoa and Turin Perf patches backport for OLK-5.10
  - mm: only enforce minimum stack gap size if it's sensible
  - config: enable CONFIG_I2C_DESIGNWARE_AMDPSP by default on x86
  - platform/x86/intel-uncore-freq: Don't present root domain on error
  - platform/x86/intel-uncore-freq: Increase minor number support
  - platform/x86: intel-uncore-freq: Fix types in sysfs callbacks
  - platform/x86/intel-uncore-freq: Process read/write blocked feature status
  - platform/x86: ISST: Add Grand Ridge to HPM CPU list
  - platform/x86: ISST: Add Granite Rapids-D to HPM CPU list
  - platform/x86: ISST: Support SST-BF and SST-TF per level
  - platform/x86: ISST: Add missing MODULE_DESCRIPTION
  - platform/x86: ISST: Add dev_fmt
  - platform/x86: ISST: Support partitioned systems
  - platform/x86: ISST: Shorten the assignments for power_domain_info
  - platform/x86: ISST: Use local variable for auxdev->dev
  - platform/x86: ISST: Allow reading core-power state on HWP disabled systems
  - platform/x86: ISST: Process read/write blocked feature status
  - EDAC/amd64: Add support for AMD family 1Ah models 00h-1Fh and 40h-4Fh
  - hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models
  - x86/amd_nb: Add PCI IDs for AMD Family 1Ah-based models
  - EDAC/amd64: Rework hw_info_{get,put}
  - EDAC/amd64: Merge struct amd64_family_type into struct amd64_pvt
  - EDAC/amd64: Issue probing messages only on properly detected hardware
  - EDAC/amd64: Drop dbam_to_cs() for Family 17h and later
  - EDAC/amd64: Rename debug_display_dimm_sizes()
  - EDAC/amd64: Remove early_channel_count()
  - EDAC/amd64: Remove PCI Function 0
  - EDAC/amd64: Remove PCI Function 6
  - EDAC/amd64: Remove scrub rate control for Family 17h and later
  - EDAC/amd64: Don't set up EDAC PCI control on Family 17h+
  - x86/amd_nb, EDAC/amd64: Move DF Indirect Read to AMD64 EDAC
  - x86/microcode/AMD: Remove unused PATCH_MAX_SIZE macro
  - x86/microcode/AMD: Rip out static buffers
  - x86/microcode/AMD: Fix mixed steppings support
  - x86/microcode/AMD: Add a @cpu parameter to the reloading functions
  - x86/microcode/AMD: Rename a couple of functions
  - crypto: ccp - Add support for PCI device 0x156E
  - crypto: ccp - Add support for PCI device 0x17E0
  - crypto: ccp - Add support for ringing a platform doorbell
  - crypto: ccp - Enable platform access interface on client PSP parts
  - crypto: ccp - Avoid discarding errors in psp_send_platform_access_msg()
  - crypto: ccp - Add support for an interface for platform features
  - crypto: ccp - Move some PSP mailbox bit definitions into common header
  - crypto: ccp - Add a header for multiple drivers to use `__psp_pa`
  - crypto: ccp - Add support for new CCP/PSP device ID
  - i2c: designware: Fix improper usage of readl
  - i2c: designware: Add AMD PSP I2C bus support
  - genirq/msi: Fix KABI breakage in struct msi_msg and struct apic
  - iommu/amd: Set iommu->int_enabled consistently when interrupts are set up
  - iommu/amd: Remove useless irq affinity notifier
  - x86/msi: Fix msi message data shadow struct
  - perf script: Fix PERF_SAMPLE_WEIGHT_STRUCT support
  - perf/x86/amd/core: Define a proper ref-cycles event for Zen 4 and later
  - perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later
  - perf script ibs: Support new IBS bits in raw trace dump
  - perf tool ibs: Sync AMD IBS header file
  - perf report: Add support to print a textual representation of IBS raw sample data
  - perf evlist: Use the right prefix for 'struct evlist' sample id lookup methods
  - perf evlist: Use the right prefix for 'struct evlist' sample parsing methods
  - perf evlist: Use the right prefix for 'struct evlist' raw samples methods
  - perf report: Add tools/arch/x86/include/asm/amd-ibs.h
  - perf header: Record non-CPU PMU capabilities
  - perf inject: Keep some features sections from input file
  - libperf: Add preadn()
  - perf header: Add ability to keep feature sections
  - perf header: Store PMU caps in an array of strings
  - perf header: Pass "cpu" pmu name while printing caps
  - perf header: Support HYBRID_CPU_PMU_CAPS feature
  - perf header: Support HYBRID_TOPOLOGY feature
  - perf pmu: Add hybrid helper functions
  - perf pmu: Save detected hybrid pmus to a global pmu list
  - perf env: Conditionally compile BPF support code on having HAVE_LIBBPF_SUPPORT
  - perf pmu: Parse pmu caps sysfs only once
  - perf record ibs: Warn about sampling period skew
  - perf evsel: Make evsel__env() always return a valid env
  - perf env: Add perf_env__cpuid, perf_env__{nr_}pmu_mappings
  - perf tools: Support PERF_SAMPLE_WEIGHT_STRUCT
  - perf record: Add support for PERF_SAMPLE_CODE_PAGE_SIZE
  - perf evsel: Emit warning about kernel not supporting the data page size sample_type bit
  - perf record: Support new sample type for data page size
  - perf/x86/amd/core: Avoid register reset when CPU is dead
  - perf/x86/amd: Do not WARN() on every IRQ
  - iommu/amd: Fix IOMMU interrupt generation in X2APIC mode
  - iommu/amd: Don't register interrupt remapping irqdomain when IR is disabled
  - iommu/amd: Fix union of bitfields in intcapxt support
  - iommu/amd: Use msi_msg shadow structs
  - iommu/intel: Use msi_msg shadow structs
  - x86/msi: Provide msi message shadow structs
  - genirq/msi: Allow shadow declarations of msi_msg:: $member
  - x86/apic: Always provide irq_compose_msi_msg() method for vector domain
  - x86/apic: Cleanup destination mode
  - x86/apic: Get rid of apic:: Dest_logical
  - x86/apic: Replace pointless apic:: Dest_logical usage
  - x86/apic: Cleanup delivery mode defines
  - x86/msi: Only use high bits of MSI address for DMAR unit


author: Li Nan <linan122@huawei.com> - 5.10.0-242.0.0.144
changelog:
  - !14216 perf cs-etm: Use evlist__event2evsel() in cs-etm.c
  - !14142  x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client
  - perf cs-etm: Use evlist__event2evsel() in cs-etm.c
  - !14109  RDMA/hns: backport some bugfix from maillist linux
  - !14137  ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
  - x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client
  - ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
  - RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci
  - Revert "RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci"
  - RDMA/hns: Fix flush cqe error when racing with destroy qp


author: Li Nan <linan122@huawei.com> - 5.10.0-243.0.0.145
changelog:
  - !14246  soc: hisilicon: hbmdev: Only support built-in
  - !14242  sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
  - !14241  sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
  - soc: hisilicon: hbmdev: Only support built-in
  - !14060  etmem : fix page_ref count leak and head missing useing problem
  - !14205  crypto: arm64/sm4 - simplify sm4_ce_expand_key() of CE implementation
  - sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
  - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
  - crypto: arm64/sm4 - simplify sm4_ce_expand_key() of CE implementation
  - etmem : fix page_ref count leak and head missing useing problem


author: Li Nan <linan122@huawei.com> - 5.10.0-244.0.0.146
changelog:
  - !14314  x86/sgx: Fix deadlock in SGX NUMA node search
  - !14315  media: v4l2-tpg: prevent the risk of a division by zero
  - !14293  Fix the incorrect definition and use of IMA_FIX_OVERLAYFS_DETECTION
  - !14289 v2  erofs: add ondemand mode support
  - !14269  iomap: fix zero padding data issue in concurrent append writes
  - !14235  xfs: fix attr inactive issue
  - !14339  ocfs2: free inode when ocfs2_get_init_inode() fails
  - !14331  mm: avoid unconditional one-tick sleep when swapcache_prepare fails
  - !14330  mm/khugepaged: fix ->anon_vma race
  - !14305  RDMA/hns: Some patches are integrated into OLK-5.10
  - !14333  ALSA: usb-audio: Fix out of bounds reads when finding clock sources
  - ocfs2: free inode when ocfs2_get_init_inode() fails
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources
  - mm: avoid unconditional one-tick sleep when swapcache_prepare fails
  - mm/khugepaged: fix ->anon_vma race
  - !13006  Fix CVE-2024-50086
  - !14309  printk: Fix the qspinlock deadloop caused by zap_locks()
  - !14252 【OLK-5.10】backport some bugfix of hisi_sas module from upstream
  - media: v4l2-tpg: prevent the risk of a division by zero
  - x86/sgx: Fix deadlock in SGX NUMA node search
  - printk: Fix the qspinlock deadloop caused by zap_locks()
  - RDMA/hns: Don't query *except on hip10*
  - RDMA/hns: Fix creating GSI QP in non-extended SGE QP bank
  - RDMA/hns: Fix bonding failure due to wrong reset_state
  - config: Enable IMA_FIX_OVERLAYFS_DETECTION in openeuler defconfigs
  - IMA: Fix the incorrect definition and use of IMA_FIX_OVERLAYFS_DETECTION
  - !14208 Fix perf coredump and refcnt inccoret
  - cachefiles: modify inappropriate error return value in cachefiles_daemon_secctx
  - fscache: modify fscache_hash_cookie() to enhance security
  - cachefiles: prefault in user pages to aovid ABBA deadlock
  - fscache/cachefiles: add a memory barrier for page_write
  - fscache/cachefiles: add a memory barrier for waking and waiting
  - fscache: add a memory barrier for FSCACHE_COOKIE_LOOKING_UP
  - wait_on_bit: Add wait_on_bit_acquire() to provide memory barrier
  - s390: provide arch_test_bit_acquire() for architecture s390
  - wait_on_bit: add an acquire memory barrier
  - erofs: unify anonymous inodes for blob
  - erofs: remove unused device mapping in meta routine
  - fscache: fix assertion failure in cachefiles_put_object()
  - cachefiles: cyclic allocation of msg_id to avoid reuse
  - fscache: fix op leak due to abort init after parent ready
  - cachefiles: Set object to close if ondemand_id < 0 in copen
  - erofs: correct the blknr/blkoff calculation in erofs_read_raw_page()
  - cachefiles: Change the mark inactive sequence in erofs ondemand mode
  - cachefiles: clear FSCACHE_COOKIE_NO_DATA_YET for the new ondemand object
  - cachefiles: Add restrictions to cachefiles_daemon_cull()
  - cachefiles: disallow to complete open requests with uninitialised ondemand_id
  - cachefiles: defer exposing anon_fd until after copy_to_user() succeeds
  - fscache: Add the unhash_cookie mechanism to fscache_drop_object()
  - cachefiles: call cachefiles_ondemand_init_object() out of dir inode lock
  - cachefiles: Fix cookie reference count leakage error
  - cachefiles: Restrict monitor calls to read_page
  - cachefiles: flush all requests after setting CACHEFILES_DEAD
  - fscache: set the default value of object_max_active to 256
  - cachefiles: Fix NULL pointer dereference in object->file
  - cachefiles: make on-demand read killable
  - cachefiles: never get a new anon fd if ondemand_id is valid
  - cachefiles: add spin_lock for cachefiles_ondemand_info
  - cachefiles: flush ondemand_object_worker during clean object
  - fscache: limit fscache_object_max_active to avoid blocking
  - cachefiles: flush all requests for the object that is being dropped
  - cachefiles: stop sending new request when dropping object
  - cachefiles: add consistency check for copen/cread
  - cachefiles: add output string to cachefiles_obj_[get|put]_ondemand_fd
  - cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()
  - cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd()
  - cachefiles: remove err_put_fd tag in cachefiles_ondemand_daemon_read()
  - fscache: Fix trace UAF in fscache_cookie_put()
  - erofs: fix order >= MAX_ORDER warning due to crafted negative i_size
  - cachefiles: use mainline xattr in ondemand mode
  - fscache: rename new_location to new_version
  - erofs: switch to use new location
  - erofs: remove erofs_fscache_netfs
  - cachefiles: handle the unprintable case for new location in cachefiles_cook_key()
  - cachefiles: use key_hash as csum for new location
  - cachefiles: skip volum csum cachefiles_cook_key() for new location
  - cachefiles: skip acc in cachefiles_cook_key() for new location
  - cachefiles: use volume key directly in cachefiles_cook_key() for new location
  - cachefiles: factor out helper to generate csum from cachefiles_cook_key()
  - cachefiles: factor out helper to generate acc from cachefiles_cook_key()
  - fscache: generate new key_hash for new location
  - fscache: add new helper to determine cachefile location
  - fscache: add a waiting mechanism when duplicate cookies are detected
  - erofs: maintain cookies of share domain in self-contained list
  - fscache: fix kernel BUG at __fscache_read_or_alloc_page
  - erofs: fix handling kern_mount() failure
  - erofs: fix lockdep false positives on initializing erofs_pseudo_mnt
  - erofs: check the uniqueness of fsid in shared domain in advance
  - fscache: fix assertion failure in fscache_put_object()
  - fscache: fix reference count leakage during abort init
  - cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode
  - erofs: relinquish volume with mutex held
  - erofs: add erofs_ondemand switch
  - erofs: add erofs switch to better control it
  - erofs: fix page unlock advance during readahead
  - openeuler_defconfig: enable erofs ondemand for x86 and arm64
  - anolis: cachefiles: fix potential NULL in error path
  - anolis: cachefiles: add missing lock protection when polling
  - anolis: cachefiles: reset object->private to NULL when it's freed
  - anolis: cachefiles: add restore command to recover inflight ondemand read requests
  - anolis: cachefiles: narrow the scope of triggering EPOLLIN events in ondemand mode
  - anolis: cachefiles: resend an open request if the read request's object is closed
  - anolis: cachefiles: extract ondemand info field from cachefiles_object
  - anolis: cachefiles: introduce object ondemand state
  - anolis: fscache: export fscache_object_wq
  - anolis: cachefiles: optimize on-demand IO path with buffer IO
  - erofs: remove unused EROFS_GET_BLOCKS_RAW flag
  - erofs: fix use-after-free of fsid and domain_id string
  - erofs: protect s_inodes with s_inode_list_lock for fscache
  - erofs: introduce 'domain_id' mount option
  - erofs: Support sharing cookies in the same domain
  - erofs: introduce a pseudo mnt to manage shared cookies
  - erofs: introduce fscache-based domain
  - erofs: code clean up for fscache
  - anolis: erofs: implement fscache-based data readahead
  - anolis: fscache,cachefiles: add fscache_prepare_read() helper
  - anolis: cachefiles: maintain a file descriptor to the backing file
  - erofs: leave compressed inodes unsupported in fscache mode for now
  - anolis: erofs: fix the name of erofs_fscache_super_index_def
  - erofs: use kill_anon_super() to kill super in fscache mode
  - erofs: scan devices from device table
  - erofs: add 'fsid' mount option
  - erofs: implement fscache-based data read for inline layout
  - erofs: implement fscache-based data read for non-inline layout
  - erofs: implement fscache-based metadata read
  - erofs: register fscache context for extra data blobs
  - erofs: register fscache context for primary data blob
  - erofs: add anonymous inode caching metadata for data blobs
  - erofs: add fscache context helper functions
  - erofs: register fscache volume
  - erofs: add fscache mode check helper
  - erofs: make erofs_map_blocks() generally available
  - cachefiles: make on-demand request distribution fairer
  - anolis: cachefiles: refactor cachefiles_ondemand_daemon_read()
  - cachefiles: fix error return code in cachefiles_ondemand_copen()
  - anolis: cachefiles: fix volume key setup for cachefiles_open
  - anolis: cachefiles: replace BUG_ON() with WARN_ON()
  - cachefiles: narrow the scope of flushed requests when releasing fd
  - anolis: cachefiles: skip check for n_children in on-demand mode
  - cachefiles: enable on-demand read mode
  - cachefiles: implement on-demand read
  - cachefiles: notify the user daemon when withdrawing cookie
  - cachefiles: unbind cachefiles gracefully in on-demand mode
  - cachefiles: notify the user daemon when looking up cookie
  - erofs: fix misbehavior of unsupported chunk format check
  - erofs: use meta buffers for erofs_read_superblock()
  - erofs: use meta buffers for zmap operations
  - erofs: use meta buffers for xattr operations
  - erofs: use meta buffers for super operations
  - erofs: use meta buffers for inode operations
  - erofs: introduce meta buffer operations
  - erofs: clean up erofs_map_blocks tracepoints
  - erofs: add multiple device support
  - erofs: decouple basic mount options from fs_context
  - erofs: introduce erofs_sb_has_xxx() helpers
  - erofs: fix double free of 'copied'
  - erofs: support reading chunk-based uncompressed files
  - erofs: introduce chunk-based file on-disk format
  - erofs: clean up file headers & footers
  - erofs: don't use erofs_map_blocks() any more
  - [Backport]scsi: hisi_sas: Enable force phy when SATA disk directly connected
  - [Backport]scsi: hisi_sas: Add latest_dump for the debugfs dump
  - [Backport]scsi: hisi_sas: Create all dump files during debugfs initialization
  - [Backport]scsi: hisi_sas: Update v3 hw STP_LINK_TIMER setting
  - [Backport]scsi: hisi_sas: Add time interval between two H2D FIS following soft reset spec
  - [Backport]scsi: hisi_sas: Update disk locked timeout to 7 seconds
  - [Backport]scsi: hisi_sas: Reset PHY again if phyup timeout
  - [Backport]scsi: hisi_sas: Enable all PHYs that are not disabled by user during controller reset
  - [Backport]scsi: hisi_sas: Add firmware information check
  - [Backport]scsi: hisi_sas: Create trigger_dump at the end of the debugfs initialization
  - [Backport]scsi: hisi_sas: Adjust priority of registering and exiting debugfs for security
  - iomap: fix zero padding data issue in concurrent append writes
  - xfs: handle attr node/leaf blocks atomically during inactive
  - xfs: factor out xfs_attr3_leaf_init
  - xfs: factor out xfs_da3_node_entry_remove
  - perf addr_location: Add init/exit/copy functions
  - perf maps: Use a pointer for kmaps
  - ksmbd: fix user-after-free from session log off
  - ksmbd: fix race condition between session lookup and expire


author: Li Nan <linan122@huawei.com> - 5.10.0-245.0.0.147
changelog:
  - !14742  rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
  - !14751  mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
  - !14679  drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
  - !14572  PCI: Fix use-after-free of slot->bus on hot remove
  - !14758  media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
  - !14755  i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
  - !14777  tracing: Prevent bad count for tracing_cpumask_write
  - !14496  ovl: Filter invalid inodes with missing lookup function
  - !14497  nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
  - !14498  f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
  - !14495  ocfs2: fix uninitialized value in ocfs2_file_read_iter()
  - !14606  scsi: qla2xxx: Fix use after free on unload
  - !14579  io_uring: check for overflows in io_pin_pages
  - !14530  sched/deadline: Fix warning in migrate_enable for boosted tasks
  - !14526  drm/amdgpu: set the right AMDGPU sg segment limitation
  - !14734  Fix iBMA bug and change version
  - !14713  Fix CVE-2024-56705
  - tracing: Prevent bad count for tracing_cpumask_write
  - !14604  scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
  - !14601  nvme-pci: fix freeing of the HMB descriptor table
  - !14575  etmem: fix use-after-free of mm in the scan release process
  - !14381  virtiofs: use pages instead of pointer for kernel direct IO
  - !14668  Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
  - !14209  gpiolib: fix memory use-after-free in gpiochip_setup_dev()
  - !14651  backport mainline bugfix patch
  - media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
  - i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
  - !14629  net/mlx5: Fix error path in multi-packet WQE transmit
  - !14627  crypto: hisilicon/qm - inject error before stopping queue
  - !14626  drm/amd/display: Check null pointers before using dc->clk_mgr
  - !14623  staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
  - !14598  blk-cgroup: Fix UAF in blkcg_unpin_online()
  - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
  - rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
  - !14704  bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
  - BMA: Fix Oops and spin lock deadlock problem, and change the version number.
  - !14700  CVE-2024-53158
  - !14457  cgroup: Fix potential overflow issue when checking max_depth
  - !14620  drm: zynqmp_kms: Unplug DRM device before removal
  - !14616  scsi: sg: Fix slab-use-after-free read in sg_release()
  - media: atomisp: Add check for rgby_data memory allocation failure
  - media: atomisp: remove #ifdef HAS_NO_HMEM
  - !14456  f2fs: fix race in concurrent f2fs_stop_gc_thread
  - !14481  jfs: fix array-index-out-of-bounds in jfs_readdir
  - !14470  ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
  - bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
  - soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
  - !14440  sh: intc: Fix use-after-free bug in register_intc_controller()
  - !14535  RDMA/mlx5: Move events notifier registration to be after device registration
  - !14450  apparmor: test: Fix memory leak for aa_unpack_strdup()
  - !14636  CVE-2024-56604_OLK-5.10
  - !14547  media: wl128x: Fix atomicity violation in fmc_send_cmd()
  - !14563  f2fs: fix to do sanity check on node blkaddr in truncate_node()
  - !14460  sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
  - !14523  The bugfix for LPM trie
  - !14650  memcg: fix soft lockup in the OOM process
  - drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
  - Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
  - !14436  crypto: bcm - add error check in the ahash_hmac_init function
  - genirq/msi: Fix off-by-one error in msi_domain_alloc()
  - memcg: fix soft lockup in the OOM process
  - !14473  smb: client: fix NULL ptr deref in crypto_aead_setkey()
  - !14467  io_uring/tctx: work around xa_store() allocation error issue
  - !14503  net: phy: dp83869: fix memory corruption when enabling fiber
  - !14515  hfsplus: don't query the device logical block size multiple times
  - !14513  scsi: bfa: Fix use-after-free in bfad_im_module_exit()
  - !14512  f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
  - !14388  CVE-2024-53173
  - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
  - Bluetooth: Consolidate code around sk_alloc into a helper function
  - net/mlx5: Fix error path in multi-packet WQE transmit
  - crypto: hisilicon/qm - inject error before stopping queue
  - drm/amd/display: Check null pointers before using dc->clk_mgr
  - staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
  - drm: zynqmp_kms: Unplug DRM device before removal
  - scsi: sg: Fix slab-use-after-free read in sg_release()
  - scsi: qla2xxx: Fix use after free on unload
  - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
  - nvme-pci: fix freeing of the HMB descriptor table
  - blk-cgroup: Fix UAF in blkcg_unpin_online()
  - io_uring: check for overflows in io_pin_pages
  - etmem: fix use-after-free of mm in the scan release process
  - PCI: Fix use-after-free of slot->bus on hot remove
  - f2fs: fix to do sanity check on node blkaddr in truncate_node()
  - !14366  EDAC/bluefield: Fix potential integer overflow
  - media: wl128x: Fix atomicity violation in fmc_send_cmd()
  - RDMA/mlx5: Move events notifier registration to be after device registration
  - sched/deadline: Fix warning in migrate_enable for boosted tasks
  - drm/amdgpu: set the right AMDGPU sg segment limitation
  - !14380  io_uring: check if iowq is killed before queuing
  - !14354  btrfs: ref-verify: fix use-after-free after invalid ref action
  - !14351  jfs: array-index-out-of-bounds fix in dtReadFirst
  - bpf: Handle in-place update for full LPM trie correctly
  - bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
  - !14344  drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
  - hfsplus: don't query the device logical block size multiple times
  - scsi: bfa: Fix use-after-free in bfad_im_module_exit()
  - f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
  - !14371 [OLK-5.10] update AMD Zen5 Turin feature
  - net: phy: dp83869: fix memory corruption when enabling fiber
  - f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
  - nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
  - ovl: Filter invalid inodes with missing lookup function
  - ocfs2: fix uninitialized value in ocfs2_file_read_iter()
  - jfs: fix array-index-out-of-bounds in jfs_readdir
  - smb: client: fix NULL ptr deref in crypto_aead_setkey()
  - ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
  - io_uring/tctx: work around xa_store() allocation error issue
  - sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
  - cgroup: Fix potential overflow issue when checking max_depth
  - f2fs: fix race in concurrent f2fs_stop_gc_thread
  - apparmor: test: Fix memory leak for aa_unpack_strdup()
  - !14409  bpf: fix OOB devmap writes when deleting elements
  - !14419  HID: wacom: fix when get product name maybe null pointer
  - sh: intc: Fix use-after-free bug in register_intc_controller()
  - crypto: bcm - add error check in the ahash_hmac_init function
  - !14268  Revert "unicode: Don't special case ignorable code points"
  - !14397  backport some patches from upstream about HCCS low power
  - !14392  arm64: stacktrace: Handle 'lr' in interrupt context
  - !14317  exfat: fix out-of-bounds access of directory entries
  - !14402  gpio: grgpio: Add NULL check in grgpio_probe
  - !14396  scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
  - !14363  CVE-2024-53217
  - HID: wacom: fix when get product name maybe null pointer
  - !14097  vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
  - !14407  NFSD: Prevent a potential integer overflow
  - !14378  ftrace: Fix regression with module command in stack_trace_filter
  - bpf: fix OOB devmap writes when deleting elements
  - !14375  fix CVE-2024-53197
  - NFSD: Prevent a potential integer overflow
  - gpio: grgpio: Add NULL check in grgpio_probe
  - soc: hisilicon: kunpeng_hccs: Support low power feature for the specified HCCS type
  - soc: hisilicon: kunpeng_hccs: Add used HCCS types sysfs
  - soc: hisilicon: kunpeng_hccs: Fix the 'lane_mode' field name in port info structure to 'max_lane_num'
  - soc: hisilicon: kunpeng_hccs: Add the check for base address and size of shared memory
  - soc: hisilicon: kunpeng_hccs: Return failure on having not die or port information
  - soc: hisilicon: kunpeng_hccs: Fix a PCC typo
  - scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
  - arm64: stacktrace: Handle 'lr' in interrupt context
  - NFSv4.0: Fix a use-after-free problem in the asynchronous open()
  - NFSv4.0: Fix the wake up of the next waiter in nfs_release_seqid()
  - Revert "NFSv4: release seqid when open failed for nfs4.0"
  - Revert "nfs: fix rpc_task use-after-free when open and close different files concurrently"
  - virtiofs: use pages instead of pointer for kernel direct IO
  - io_uring: check if iowq is killed before queuing
  - ftrace: Fix regression with module command in stack_trace_filter
  - ALSA: usb-audio: Fix a DMA to stack memory bug
  - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
  - x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range
  - x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range
  - EDAC/bluefield: Fix potential integer overflow
  - nfsd: restore callback functionality for NFSv4.0
  - NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
  - btrfs: ref-verify: fix use-after-free after invalid ref action
  - jfs: array-index-out-of-bounds fix in dtReadFirst
  - drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
  - exfat: fix out-of-bounds access of directory entries
  - Revert "unicode: Don't special case ignorable code points"
  - gpiolib: fix memory use-after-free in gpiochip_setup_dev()
  - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans


author: Li Nan <linan122@huawei.com> - 5.10.0-246.0.0.148
changelog:
  - !14844  merge mainline patch into OLK-5.10
  - !14838 v2  fs: Filter specific inodes to prevent UAF issues
  - fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP
  - mm: kfence: fix using kfence_metadata without initialization in show_object()
  - x86/mm: Do not shuffle CPU entry areas without KASLR
  - fs: Filter specific inodes to prevent UAF issues
  - !14599  CVE-2024-56701
  - !14560  CVE-2024-56567
  - !14801  CVE-2024-53237
  - !14793  jfs: fix shift-out-of-bounds in dbSplit
  - !14815  OLK-5.10
  - !14790  acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
  - !14583  ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
  - !14582  jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
  - !14822  ALSA: 6fire: Release resources at card release
  - !14539 RDMA/hns backport some bugfix from maillist-v6.13 2025/01/03
  - ALSA: 6fire: Release resources at card release
  - RDMA/hns: Fix missing flush CQE for DWQE
  - RDMA/hns: Fix warning storm caused by invalid input in IO path
  - RDMA/hns: Fix mapping error of zero-hop WQE buffer
  - wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures
  - !14795  btrfs: fix use-after-free when COWing tree bock and tracing is enabled
  - !14768  tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
  - driver core: Introduce device_find_any_child() helper
  - Bluetooth: fix use-after-free in device_for_each_child()
  - btrfs: fix use-after-free when COWing tree bock and tracing is enabled
  - jfs: fix shift-out-of-bounds in dbSplit
  - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
  - tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
  - powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore
  - ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
  - jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
  - ad7780: fix division by zero in ad7780_write_raw()


author: Li Nan <linan122@huawei.com> - 5.10.0-247.0.0.149
changelog:
  - !14414 sdma-dae: add print in exceptional branch
  - !14870  quota: flush quota_release_work upon quota writeback
  - !14862  drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
  - !14866  NFS: Fix up nfs_ctx_key_to_expire()
  - !14853  drm/i915/hdcp: Add encoder check in hdcp2_get_capability
  - !14852  octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
  - !14851  nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
  - quota: flush quota_release_work upon quota writeback
  - !14663  xsk: Add generic xdp multi-buffer send support
  - NFS: Fix up nfs_ctx_key_to_expire()
  - !14803  net: hsr: avoid potential out-of-bound access in fill_frame_info()
  - !14829  ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
  - !14854  btrfs: check folio mapping after unlock in relocate_one_folio()
  - drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
  - !14857  sched: psi: fix bogus pressure spikes from aggregation race
  - sched: psi: fix bogus pressure spikes from aggregation race
  - btrfs: check folio mapping after unlock in relocate_one_folio()
  - drm/i915/hdcp: Add encoder check in hdcp2_get_capability
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
  - nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
  - ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
  - net: hsr: avoid potential out-of-bound access in fill_frame_info()
  - xsk: Add generic xdp multi-buffer send support
  - drivers:misc:sdma-dae: add print in exceptional branch


author: Li Nan <linan122@huawei.com> - 5.10.0-248.0.0.150
changelog:
  - !14995  mm/compaction: fix UBSAN shift-out-of-bounds warning
  - mm/compaction: fix UBSAN shift-out-of-bounds warning
  - !14894  btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
  - !14875  *** jffs2: Prevent rtime decompress memory corruption ***
  - !14960  mainline to olk-5.10 RDMA/hns: Check atomic wr length
  - !14937 v2  Two CVE fixes for ksmbd
  - !14966  memcg: fix memcg_swapmax_read() not declared warning
  - memcg: fix memcg_swapmax_read() not declared warning
  - RDMA/hns: Check atomic wr length
  - Revert "RDMA/hns: Fix a missing check of atomic wr length"
  - Revert "RDMA/hns: Check atomic wr length"
  - !14943  fix CVE-2024-57892
  - !14954  zram: fix NULL pointer in comp_algorithm_show()
  - !14948 Mainline patch to olk-5.10 v3
  - zram: fix NULL pointer in comp_algorithm_show()
  - !14247 [OLK-5.10] fix wangxun 1G/10G drivers hardware tx unit hang.
  - !14947  mm/slub: Reduce memory consumption in extreme scenarios
  - RDMA/hns: Fix different dgids mapping to the same dip_idx
  - Revert "RDMA/hns: Fix different dgids mapping to the same dip_idx"
  - RDMA/hns: Fix flush cqe error when racing with destroy qp
  - Revert "RDMA/hns: Fix flush cqe error when racing with destroy qp"
  - mm/slub: Reduce memory consumption in extreme scenarios
  - !14917  merge CVE patches into OLK-5.10
  - ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
  - ocfs2: correct return value of ocfs2_local_free_info()
  - ksmbd: fix potencial out-of-bounds when buffer offset is invalid
  - ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
  - net: wangxun: change netdev uc addr num maxmium
  - net: wangxun: fix resolving ipv6 pakets extension header errors
  - net: wangxun: fix tx csum by soft except tcp udp sctp
  - drm/i915: Fix potential context UAFs
  - arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning
  - arm64: probes: Fix uprobes for big-endian kernels
  - arm64:uprobe fix the uprobe SWBP_INSN in big-endian
  - dm cache: fix flushing uninitialized delayed_work on cache_ctr error
  - mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM
  - kcsan: Turn report_filterlist_lock into a raw_spinlock
  - media: uvcvideo: Require entities to have a non-zero unique ID
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
  - um: net: Do not use drvdata in release
  - xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
  - 9p/xen: fix release of IRQ
  - fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
  - fbdev/sh7760fb: Alloc DMA memory from hardware device
  - ionic: Fix netdev notifier unregister on failure
  - btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
  - jffs2: Fix rtime decompressor
  - jffs2: Prevent rtime decompress memory corruption


author: Li Nan <linan122@huawei.com> - 5.10.0-249.0.0.151
changelog:
  - !15061  ALSA: seq: oss: Fix races at processing SysEx messages
  - ALSA: seq: oss: Fix races at processing SysEx messages
  - !14286 [OLK-5.10] SCSI: Support Linkdata HBA/RAID Controllers
  - !15059  RDMA/hns: Fix free_mr_qp not assigning qp->device in error flow
  - RDMA/hns: Fix free_mr_qp not assigning qp->device in error flow
  - !15051  iio: light: vcnl4035: fix information leak in triggered buffer
  - !9883 AMD QoS new features BMEC and SMBA
  - iio: light: vcnl4035: fix information leak in triggered buffer
  - !14956  nbd: don't allow reconnect after disconnect
  - !15046  pinmux: Use sequential access to access desc->pinmux data
  - !15015  spi: mpc52xx: Add cancel_work_sync before module remove
  - !14865  fs/dirty_pages: Add exclusive open lock to prevent null pointer dereference
  - [PATCH] SCSI: Linkdata: Supports Linkdata HBA/RAID Controllers
  - pinmux: Use sequential access to access desc->pinmux data
  - !15044 [sync] PR-15042:  drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
  - !15024  net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg
  - !14991  usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
  - !14891  s390/cpum_sf: Handle CPU hotplug remove during sampling
  - !15014 v2  nilfs2: prevent use of deleted inode
  - drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
  - net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg
  - !15010  nvme-rdma: unquiesce admin_q before destroy it
  - spi: mpc52xx: Add cancel_work_sync before module remove
  - nilfs2: prevent use of deleted inode
  - nvme-rdma: unquiesce admin_q before destroy it
  - usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
  - tools headers cpufeatures: Sync with the kernel sources
  - tools arch x86: Sync the msr-index.h copy with the kernel sources
  - tools arch x86: Sync the msr-index.h copy with the kernel sources
  - x86/resctrl: Read supported bandwidth sources from CPUID
  - x86/resctrl: Remove redundant variable in mbm_config_write_domain()
  - x86/resctrl: Add per-rmid arch private storage for overflow and chunks
  - x86/resctrl: Group struct rdt_hw_domain cleanup
  - x86/resctrl: Add domain online callback for resctrl work
  - x86/resctrl: Merge mon_capable and mon_enabled
  - x86/resctrl: Fix kfree() of the wrong type in domain_add_cpu()
  - x86/resctrl: Split struct rdt_domain
  - x86/resctrl: Add interface to write mbm_local_bytes_config
  - x86/resctrl: Add interface to write mbm_total_bytes_config
  - x86/resctrl: Add interface to read mbm_local_bytes_config
  - x86/resctrl: Add interface to read mbm_total_bytes_config
  - x86/resctrl: Support monitor configuration
  - x86/resctrl: Add __init attribute to rdt_get_mon_l3_config()
  - x86/resctrl: Detect and configure Slow Memory Bandwidth Allocation
  - x86/resctrl: Move MSR defines into msr-index.h
  - x86/resctrl: Include new features in command line options
  - x86/cpufeatures: Add Bandwidth Monitoring Event Configuration feature flag
  - x86/resctrl: Add a new resource type RDT_RESOURCE_SMBA
  - x86/cpufeatures: Add Slow Memory Bandwidth Allocation feature flag
  - x86/resctrl: Replace smp_call_function_many() with on_each_cpu_mask()
  - x86/resctrl: Split struct rdt_resource
  - x86/resctrl: Fix kernel-doc in internal.h
  - x86/resctrl: Correct MBM total and local values
  - nbd: don't allow reconnect after disconnect
  - s390/cpum_sf: Handle CPU hotplug remove during sampling
  - fs/dirty_pages: Add exclusive open lock to prevent null pointer dereference


author: Li Nan <linan122@huawei.com> - 5.10.0-250.0.0.153
changelog:
  - !15099  sched: sch_cake: add bounds checks to host bulk flow fairness counts
  - !15087  netfilter: ipset: add missing range check in bitmap_ip_uadt
  - !15085  ila: call nf_unregister_net_hooks() sooner
  - !15100  ila: serialize calls to nf_register_net_hooks()
  - !15097  net: inet6: do not leave a dangling sk pointer in inet6_create()
  - !15096  net: inet: do not leave a dangling sk pointer in inet_create()
  - !15098  netfilter: conntrack: clamp maximum hashtable size to INT_MAX
  - !15089  net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
  - !15086  net: Fix CVE-2024-50125
  - !15117 v3  net: Fix CVE-2024-56658
  - !15095  wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
  - !15124 v2  fix CVE-2024-53056 for olk-5.10
  - !15129  comedi: Flush partial mappings in error case
  - !15127  iomap: avoid avoid truncating 64-bit offset to 32 bits
  - comedi: Flush partial mappings in error case
  - iomap: avoid avoid truncating 64-bit offset to 32 bits
  - mm: resolve faulty mmap_region() error path behaviour
  - mm: unconditionally close VMAs on error
  - mm: avoid unsafe VMA hook invocation when error arises on mmap hook
  - !15081  usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()
  - !15079  drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
  - net: Fix kabi breakage in struct net
  - net: defer final 'struct net' free in netns dismantle
  - ila: serialize calls to nf_register_net_hooks()
  - sched: sch_cake: add bounds checks to host bulk flow fairness counts
  - netfilter: conntrack: clamp maximum hashtable size to INT_MAX
  - net: inet6: do not leave a dangling sk pointer in inet6_create()
  - net: inet: do not leave a dangling sk pointer in inet_create()
  - wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
  - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
  - netfilter: ipset: add missing range check in bitmap_ip_uadt
  - Bluetooth: SCO: Fix UAF on sco_sock_timeout
  - Bluetooth: call sock_hold earlier in sco_conn_del
  - ila: call nf_unregister_net_hooks() sooner
  - usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()
  - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error


author: Li Nan <linan122@huawei.com> - 5.10.0-251.0.0.154
changelog:
  - !14327 [OLK-5.10] Enhanced Hygon processor's processing capabilities for large memory copying
  - !15137  net/mlx5: Fix variable not being completed when function returns
  - !15136  crypto: caam - Fix the pointer passed to caam_qi_shutdown()
  - !15134  usb: typec: altmode should keep reference to parent
  - !15198  CVE-2024-57857
  - !15196  iio: pressure: zpa2326: fix information leak in triggered buffer
  - !15199  power: supply: gpio-charger: Fix set charge current limits
  - power: supply: gpio-charger: Fix set charge current limits
  - RDMA/siw: Remove direct link to net_device
  - RDMA/siw: Fabricate a GID on tun and loopback devices
  - RDMA/siw: Use helper function to set sys_image_guid
  - RDMA/siw: Enable siw on tunnel devices
  - iio: pressure: zpa2326: fix information leak in triggered buffer
  - !15186  CVE-2024-57795
  - !15177  iio: imu: kmx61: fix information leak in triggered buffer
  - RDMA/rxe: Remove the direct link to net_device
  - RDMA: Export ib_device_get_netdev()
  - iio: imu: kmx61: fix information leak in triggered buffer
  - !14910 KVM:arm64:Add a kvm parameter to control guest wfi trapping
  - KVM:arm64:Add a kvm parameter to control guest wfi trapping
  - !15139  apparmor: fix 'Do simple duplicate message elimination'
  - !15094  netfilter: x_tables: fix LED ID check in led_tg_check()
  - !15146  Revert "media: uvcvideo: Require entities to have a non-zero unique ID"
  - !15077  kasan: fix incorrect return type of quarantine_put()
  - Revert "media: uvcvideo: Require entities to have a non-zero unique ID"
  - apparmor: fix 'Do simple duplicate message elimination'
  - net/mlx5: Fix variable not being completed when function returns
  - crypto: caam - Fix the pointer passed to caam_qi_shutdown()
  - usb: typec: altmode should keep reference to parent
  - netfilter: x_tables: fix LED ID check in led_tg_check()
  - kasan: fix incorrect return type of quarantine_put()
  - mm: Enhanced copy capabilities for Hygon processor


author: Li Nan <linan122@huawei.com> - 5.10.0-252.0.0.155
changelog:
  - !15293 ras: ACPI: HED: Always initialize before evged
  - !15269 [OLK-5.10]Intel: Backport to fix EDAC driver for GNR platform
  - !15269 [OLK-5.10]Intel: Backport to fix EDAC driver for GNR platform
  - ras: ACPI: HED: Always initialize before evged
  - EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator
  - EDAC/skx_common: Differentiate memory error sources
  - EDAC/{skx_common,skx,i10nm}: Move the common debug code to skx_common
  - EDAC, i10nm: make skx_common.o a separate module
  - !15246  UBI/UBIFS mainline patch backport
  - !10860 [OLK-5.10] perf/x86/uncore: Add support for Hygon family 18h model 4h-7h   and 10h DF PMU
  - ubi: Add a check for ubi_num
  - ubifs: skip dumping tnc tree when zroot is null
  - !15228 EDAC/amd64: Add support family types for hygon family 4h~5h and 7h.
  - !14810  af_packet: avoid erroring out after sock_init_data() in packet_create()
  - EDAC/amd64: Add support family types for hygon family 4h~5h and 7h.
  - af_packet: avoid erroring out after sock_init_data() in packet_create()
  - perf/x86/uncore: Add support for Hygon family 18h model 4h-7h and 10h DF PMU


author: Li Nan <linan122@huawei.com> - 5.10.0-253.0.0.156
changelog:
  - !15447  Some bug fix patches for RDMA/hns to olk-5.10
  - !15429 mailbox: pcc: Fix the possible race in updation of chan_in_use flag
  - RDMA/hns: Fix default congestion control algorithm not set for kernel QP
  - RDMA/hns: Fix udca not unregistered when reset entry allocation failed
  - RDMA/hns: Fix wrong value of max_sge_rd
  - RDMA/hns: Fix missing xa_destroy()
  - RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common()
  - RDMA/hns: Fix invalid sq params not being blocked
  - RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db()
  - RDMA/hns: Fix DCA error path in alloc_wqe_buf()
  - mailbox: pcc: Fix the possible race in updation of chan_in_use flag
  - !15419  NFC: nci: Add bounds checking in nci_hci_create_pipe()
  - !15419  NFC: nci: Add bounds checking in nci_hci_create_pipe()
  - !15300 net: hns3: some bugfixes for hns3 driver
  - !15300 net: hns3: some bugfixes for hns3 driver
  - !15422  ocfs2: handle a symlink read error correctly
  - !15426 Some bug fix patches for OLK-5.10 hns RoCE
  - !15426 Some bug fix patches for OLK-5.10 hns RoCE
  - !15428  ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty
  - ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty
  - RDMA/hns: Fix ifnullfree static warning
  - RDMA/hns: Fix soft lockup by adding cond_resched() to bt pages loop
  - RDMA/hns: Fix unmatched kmalloc and kvfree
  - RDMA/hns: Fix delay-destruction mechanism not processing kernel db
  - RDMA/hns: Fix delayed destruction of db not taking effect
  - RDMA/hns: Move mtr_node into the mtr struct
  - RDMA/hns: Change mtr member to pointer in hns QP/CQ/MR/SRQ/EQ struct
  - net: hns3: add command queue trace for hns3
  - net: hns3: Revert "net: hns3: add command queue trace for hns3"
  - ocfs2: handle a symlink read error correctly
  - net: hns3: add mac tunnel number query
  - NFC: nci: Add bounds checking in nci_hci_create_pipe()
  - !15053  try to backport "block: fix rq-qos breakage from skipping rq_qos_done_bio"
  - !15053  try to backport "block: fix rq-qos breakage from skipping rq_qos_done_bio"
  - !15403  ipmr: do not call mr_mfc_uses_dev() for unres entries
  - !15403  ipmr: do not call mr_mfc_uses_dev() for unres entries
  - !15413  CVE-2025-21756
  - !15413  CVE-2025-21756
  - vsock: Orphan socket after transport release
  - vsock: Keep the binding until socket destruction
  - !15397  Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
  - !15295  netfilter: nf_set_pipapo: fix initial map fill
  - !15295  netfilter: nf_set_pipapo: fix initial map fill
  - ipmr: do not call mr_mfc_uses_dev() for unres entries
  - net: hns3: fix oops when unload drivers paralleling
  - !15382  srcu: Tighten cleanup_srcu_struct() GP checks
  - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
  - !15387  crypto: qat - add param check for DH
  - !15389  orangefs: fix a oob in orangefs_debug_write
  - !15373  KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel
  - !15241 KVM: arm64: pvsched bugfix and module param
  - orangefs: fix a oob in orangefs_debug_write
  - crypto: qat - add param check for DH
  - !15226 Fix northbridge init warning in guest for Hygon family 18h model 4h
  - !15226 Fix northbridge init warning in guest for Hygon family 18h model 4h
  - !15217 Add device HID for Hygon GPIO controller
  - !15217 Add device HID for Hygon GPIO controller
  - srcu: Tighten cleanup_srcu_struct() GP checks
  - !15232  smb: client: Fix netns refcount imbalance
  - !15232  smb: client: Fix netns refcount imbalance
  - !15348  Mainline Patch
  - KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel
  - bpf: Use preempt_count() directly in bpf_send_signal_common()
  - bpf: Send signals asynchronously if !preemptible
  - KVM:arm64:Add a module param to enable/disable pv_preempted dynamically
  - !15307  net: sfc: add missing xdp queue reinitialization
  - !15279 [OLK-5.10]:update patches for sw64 architecture
  - !15279 [OLK-5.10]:update patches for sw64 architecture
  - net: sfc: add missing xdp queue reinitialization
  - netfilter: nf_set_pipapo: fix initial map fill
  - sw64: pci: add new files to help support ACPI-based PCI initialization
  - sw64: acpi: disable INTC initialization via ACPI MADT table
  - sw64: pci: bypass legacy PCI initialization when ACPI enabled
  - sw64: acpi: use early param to control whether ACPI is enabled
  - sw64: acpi: disable all ACPI features by default
  - pci: let pcibios_root_bridge_prepare() access bridge->windows
  - sw64: fix kernel crash caused by unaligned access exception
  - sw64: iommu: adjust iova map space
  - sw64: msi: split the msi file
  - sw64: use generic dma_direct_ops
  - sw64: fix cpu reduction bug in cpuautoplug
  - sw64: use generated macro in vrt_sigreturn.S
  - sw64: do not allow assembler reorder in __copy_user()
  - sw64: expand vmemmap
  - sw64: iommu: fix dma_supported of dma_ops
  - sw64: add support for TIF_NOTIFY_SIGNAL
  - sw64: fix stack trace error
  - sw64: register suspend entry for cpu 0 only
  - sw64: do not discard exit text at link time
  - sw64: fix syscall restart
  - sw64: usb: redefine some macros
  - sw64: iommu: upgrade sunway_iommu_v2 driver to make it work
  - sw64: fix syscall sigreturn and rt_sigreturn
  - sw64: optimize hmcall rdusp() and wrusp()
  - sw64: rewrite syscall invocation in C
  - sw64: expand struct pt_regs
  - sw64: kvm: delete kvm_sw64_ops structure
  - sw64: add imemb at the end of fixup_hmcall()
  - sw64: c3b: get MCLK rate dynamically according to specification
  - sw64: fix default short clock rate
  - sw64: use call and br in kernel entry
  - sw64: modify do_[rt_]sigreturn
  - sw64: modify fixup_exception()
  - sw64: rewrite struct pt_regs
  - sw64: simplify pt_regs related code
  - sw64: fix pt_regs related code
  - sw64: avoid using wrusp()
  - sw64: use sp in pt_regs
  - sw64: kvm: move bind vcpu init code into kvm_core3.c
  - sw64: add arch/sw_64/Kbuild
  - sw64: Kconfig: clean up out-of-date deep sleep options
  - sw64: Kconfig: rename BUILTIN_DTB option
  - sw64: optimize C4 compilation
  - sw64: kprobe: allow kprobe in atomic sequence on C4
  - sw64: lib: optimize lib functions for C4
  - sw64: optimize __fpstate_save on C4
  - sw64: add new match interface for C4
  - sw64: add C4 FPE_INTDIV support
  - sw64: update default FPCR value
  - sw64: defconfig: add junzhang_defconfig for C4 serials
  - sw64: add basic support for C4 ISA
  - sw64: use PAGE_OFFSET as ktext address head
  - sw64: dts: add an empty dts to support SW8A temporarily
  - sw64: kconfig: add SW8A platform support
  - sw64: kvm: rebuild Core3 and Core4 virtualization
  - sw64: kvm: add support for Core4 memory virtualization
  - sw64: kvm: add config guard for C3B implementation
  - sw64: kvm: add C4 vcpu support
  - sw64: iommu: add new iommu v2 support
  - sw64: pci: add C4 PCI_MSI support
  - sw64: pci: add C4 PCI support
  - sw64: irq: add basic C4 irq support
  - sw64: timer: add C4 timer support
  - sw64: unify io operations interface for C3B and C4
  - sw64: add SW8A io addresses
  - sw64: mm: add C4 hugetlb support
  - sw64: mm: add C4 MMU support
  - sw64: topology: add C4 topology info
  - sw64: add C4 CSRs
  - sw64: add C4 barriers support
  - sw64: add C4 xchg operations support
  - sw64: add C4 bit operations support
  - sw64: add C4 atomic operations support
  - sw64: redesign __cpu_to_rcid initialization
  - sw64: topology: modify topology defines
  - sw64: rename some fields of struct vcpucb
  - sw64: mm: use static ZERO_PAGE
  - sw64: mm: unify _PAGE_CHG_MASK and _HPAGE_CHG_MASK
  - sw64: mm: add more helpers to pgtable.h
  - sw64: mm: fix _PFN_MASK
  - sw64: mm: add _PAGE_CONT helpers
  - sw64: pci: rename PCI_DEVICE_ID_CHIP3
  - sw64: mm: rename _PAGE_PHU and _PAGE_PSE
  - sw64: remove unused file
  - sw64: remove out-of-date LOCK_FIXUP
  - sw64: fix compile error when CONFIG_PM is not set
  - sw64: kconfig: fix config error when PCI_MSI is not set
  - sw64: cpufreq: fix clockevents update method
  - sw64: fix excessive timer interrupts
  - sw64: simplify PMC interfaces
  - sw64: remove sw64_platform_ops
  - sw64: remove chip directory
  - sw64: reorganize pci setup related code
  - sw64: reorganize chip setup code
  - sw64: reorganize msi related code
  - sw64: reorganize basic irq handling code
  - sw64: reorganize pci related quirks
  - sw64: reorganize usb quirks related code
  - sw64: reorganize i2c related code
  - sw64: reorganize timer related code
  - sw64: reorganize cpu frequency related code
  - i2c: designware: add parameter MODEL_SUNWAY
  - sw64: fix compile warnings
  - sw64: cleanup hugetlb code
  - sw64: drop fpga and simulator support
  - sw64: fix indent of inline assembly
  - sw64: fix header include guards
  - sw64: add missing fallthrough
  - sw64: add missing break
  - sw64: Kconfig: remove out-of-date rwsem options
  - sw64: fix frequency in cpufreq_frequency_table
  - sw64: fix incorrect hmcalls in the virtual machine
  - sw64: remove arch overridden RLIM_INFINITY
  - sw64: do not set __ARCH_SI_TRAPNO
  - sw64: remove C3A support
  - sw64: fix s4 sleep bug
  - sw64: reorganize dependency of devmap helpers
  - i2c: sunway: do some cleanup for old i2c driver
  - i2c: designware: add sunway system I2C support
  - sw64: pci: use pci_has_flag to define pcibios_assign_all_busses
  - sw64: modify lock instruction
  - sw64: update openeuler_defconfig
  - sw64: add save_stack_trace_regs()
  - sw64: tools: fix selftests/sigaltstack for sw64
  - sw64: determine external clock according to specification
  - sw64: fix uretprobe implementation
  - sw64: fix some cpu autoplug bugs
  - sw64: kvm: add support for cpu offline and online in guest
  - fbdev: sw64 use __raw I/O memory api
  - sw64: correct the definition of MAX_DMA_ADDRESS
  - sw64: remove S3 flag
  - sw64: rename ptrace macros
  - sw64: fix audit_syscall_exit()
  - sw64: fix some include format
  - sw64: update cpufreq's info when cpu frequency changed
  - sw64: fix a compile error with CONFIG_TRANSPARENT_HUGEPAGE=n
  - sw64: selftests/ftrace: add sw64 support for kprobe args tests
  - sw64: hibernation: update ktp to vcpucb after restoring it
  - sw64: fix CONFIG_GENERIC_SCHED_CLOCK=y
  - sw64: kvm: fix memory hotplug support for guest
  - sw64: hugetlbfs: add arch_hugetlb_valid_size
  - sw64: kvm: fix some build errors for KVM module
  - sw64: perf: add libbfd-buildid and disassembler-four-args support
  - sw64: fix a compile error for headers_install
  - sw64: fix shared_cpu_map of tcache's cacheinfo
  - sw64: kvm: fix an error with non-8MB aligned guest RAM size
  - sw64: selftests/vm: fix virtual address range mapping test
  - sw64: fix KBUILD_DEFCONFIG
  - sw64: send a fake signal to all blocking tasks
  - sw64: clean up useless cpu_idle wrap
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free
  - smb: client: fix TCP timers deadlock after rmmod
  - x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h
  - pinctrl: Add device HID for Hygon GPIO controller
  - block: fix kabi broken due to removing bip_slab
  - block: fix kabi broken
  - block: fix rq-qos breakage from skipping rq_qos_done_bio()
  - block: only mark bio as tracked if it really is tracked
  - block: add a BUILD_BUG_ON() for adding more bio flags than we have space
  - block: use bi_max_vecs to find the bvec pool
  - md/raid10: remove dead code in reshape_request
  - block: mark the bio as cloned in bio_iov_bvec_set
  - block: turn the nr_iovecs argument to bio_alloc* into an unsigned short
  - block: remove the 1 and 4 vec bvec_slabs entries
  - block: streamline bvec_alloc
  - block: factor out a bvec_alloc_gfp helper
  - block: move struct biovec_slab to bio.c
  - block: reuse BIO_INLINE_VECS for integrity bvecs


author: Li Nan <linan122@huawei.com> - 5.10.0-254.0.0.157
changelog:
  - !15460 v2  soc: hisilicon: Add checks against NULL pointer reference
  - !15456  soc: hisilicon: Fix one printing issue and simplify some printing
  - !15454  RDMA/hns: Fix mbox timing out by adding retry mechanism
  - soc: hisilicon: Add checks against NULL pointer reference
  - soc: hisilicon: Fix one printing issue and simplify some printing
  - !15391  backport mainline bugfix patch
  - RDMA/hns: Fix mbox timing out by adding retry mechanism
  - irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
  - genirq: Make handle_enforce_irqctx() unconditionally available


author: Li Nan <linan122@huawei.com> - 5.10.0-256.0.0.158
changelog:
  - !15379  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
  - !15606  Fix instance dir use-after-free in tracefs
  - !15272 [Intel-SIG] 5.10-x86/cpu: Clearwater Forest new model and ISAs support.
  - tracing: Fix illegal address access of trace_event_file in tracing_release_file_tr()
  - tracing: Avoid use-after-free in tracing_open_file_tr()
  - !15591 【olk 5.10】revert and backport a bugfix
  - net: hns3: add mac tunnel number query
  - Revert "net: hns3: add mac tunnel number query"
  - !15501  module: fix [e_shstrndx
  - !14905 [OLK-5.10] backport important bugfix from the kernel-5.10.y
  - !14918 [OLK-5.10] backport important bugfix from the kernel-5.10.y
  - module: fix [e_shstrndx].sh_size=0 OOB access
  - !2893 igc: add default intel igc driver module support
  - bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
  - x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest
  - x86/cpu: Add model number for Intel Clearwater Forest processor
  - scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load time
  - bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down
  - igc:add default intel igc driver support


author: Li Nan <linan122@huawei.com> - 5.10.0-257.0.0.159
changelog:
  - !15643 drivers:misc:sdma-dae: sync code to openEuler
  - drivers:misc:sdma-dae: remove unnecessary return in void function
  - drivers:misc:sdma-dae fix incorrect resource release
  - drivers:misc:sdma-dae remove lock while pausing channels
  - drivers:misc:sdma-dae add mmu_notifier
  - drivers:misc:sdma-dae: add MODULE_VERSION to control version


author: Li Nan <linan122@huawei.com> - 5.10.0-258.0.0.160
changelog:
  - !15699  Push 2 self-developed patches to OLK-5.10
  - !15671  ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
  - !15669  arm64: mm: add mc support for __buffer_migrate_page
  - !15630  Fix CVE-2022-49553
  - !15627  fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()'
  - printk: Skip log flush in NMI context when logbuf_lock is held
  - x86: reboot: Initialize the printk locks to avoid deadlock
  - !15675  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
  - !15646  nilfs2: do not force clear folio if buffer is referenced
  - !15676  sched/fair: Optimize the dynamic smt
  - !15330 [OLK-5.10]:update patches for sw64 architecture
  - sched/fair: Optimize the dynamic smt
  - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
  - ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
  - arm64: mm: add mc support for __buffer_migrate_page
  - !15595  io_uring: prevent opcode speculation
  - nilfs2: do not force clear folio if buffer is referenced
  - fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst()
  - fs/ntfs3: validate BOOT sectors_per_clusters
  - fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()'
  - io_uring: prevent opcode speculation
  - sw64: distribute intx interrupts by hose
  - sw64: kvm: use generic kvm mmu memory caches
  - sw64: fix msi interrupt for guest os
  - sw64: acpi: remove constraint that cid of boot core must be zero
  - sw64: pci: get register base address from firmware
  - sw64: fix compile warning of do_entUna()
  - sw64: fix save_ktp compatibility for C3
  - sw64: fix PTBR save/restore for hibernation
  - sw64: kvm: remove some unused codes
  - sw64: add syscall pfh_ops
  - sw64: fix broken rdfpcr()
  - sw64: force kernel stack to be 16 bytes aligned
  - sw64: match platform device by acpi method
  - sw64: iommu: support acpi init
  - sw64: spi: update spi controller driver
  - sw64: irqchip: fix compatibility with old dts
  - sw64: kvm: fix pmd_trans_cont
  - sw64: add -fno-sw-unalign-byte to cflags for C4
  - sw64: define cpu_relax() as imb()
  - sw64: kvm: fix size of struct kvm_regs for C3B
  - sw64: fix the .endm in hibernate_asm.S
  - sw64: fix compile error of efi.systab
  - sw64: pci: adjust the maximum number of RC per node
  - sw64: get mclk and external clk from firmware
  - sw64: fix compile error of MMSIZE
  - sw64: acpi: disable ACPI for xuelang
  - sw64: ahci: disable parallel bus scan
  - sw64: redesign run mode setup method
  - sw64: rename static key and related simd libraries
  - sw64: fix secondary cpu bring up bug
  - sw64: acpi: fix coding style and typos
  - sw64: irq: fix compilation error
  - sw64: improve the verification logic of DTB
  - sw64: kvm: add the member of the vcpucb structure
  - sw64: kvm: fix the check for THP
  - sw64: kvm: fix page walk error of unmap_apt_range()
  - sw64: apply new boot params from DTB chosen node
  - sw64: receive new boot params from firmware
  - sw64: setup stackframe at kernel entry point
  - sw64: save and restore CSR_WR_FREGS for SIMD libs
  - sw64: rename copy and set lib functions
  - sw64: rename copy and set lib files
  - sw64: choose lib at compile time
  - sw64: perf: add core4 pmu support
  - sw64: redesign struct kvm_regs for C4
  - sw64: store topology and numa info by each cpu itself
  - sw64: kvm: fix live migration bug
  - sw64: kvm: fix APT fault handler
  - sw64: work around suspend for C4
  - sw64: employ trick on regs.pc for specific exception
  - sw64: enable CONFIG_FRAME_POINTER by default for junzhang
  - sw64: fix syscall_fallback() for vdso gettimeofday
  - sw64: dts: add Junzhang
  - sw64: lpc: work around hardware flaws
  - sw64: improve cpu bring up method
  - sw64: introduce new entry framework for C4
  - sw64: irq: update the initial value of nr_irqs
  - sw64: msi: fix sw64_set_affinity function in msi-v2
  - sw64: dynamically switch between lib implementation
  - sw64: kvm: fix unmap_apt_{ptes, pmds}
  - sw64: msi: remove redundant interrupt enables
  - sw64: add unaligned access support for C4 new instructions
  - sw64: fix compilation warning
  - sw64: fix kconfig selections
  - sw64: iommu: adjust iova range
  - sw64: iommu: introduce generic DMA ops to iommu_v2
  - sw64: iommu: fix iommu_v2 compile problems
  - sw64: acpi: fix missed upper bits of rcid for junzhang
  - sw64: pci: remove duplicate pcie operations
  - sw64: irq: remove unnecessary initialization
  - sw64: acpi: enable generic GSI
  - sw64: irqchip: support ACPI-based interrupt controller initialization
  - sw64: acpi: support MADT entry print for SW PINTC, MSIC and LPC-INTC
  - sw64: acpi: add ACPI-style structures for SW PINTC, MSIC and LPC-INTC
  - sw64: mm: fix PTE bits check
  - sw64: use a new wrap_asid hmcall when asid wraps
  - sw64: rewrite fpcr and swcr conversion
  - sw64: enable hardware denorm by default
  - sw64: add four-socket system support
  - sw64: add a new kernel parameter to override mclk
  - sw64: improve sw64_printk()
  - sw64: msi: fix bugs in multi-msi interrupts allocation and release
  - sw64: pci: change pci transaction ordering rule settings
  - sw64: irqchip: fix virtual PINTC not working properly
  - sw64: dts: improve properties for PINTC
  - sw64: dts: improve properties for LPC-INTC
  - sw64: dts: fix interrupt related properties for GPIO
  - sw64: dts: add chosen node
  - sw64: dts: fix properties for spi controller device node
  - sw64: fix coding style and typos
  - sw64: acpi: fix function acpi_numa_processor_affinity_init()
  - sw64: fix rd_f compatibility issue for C4
  - sw64: export mclk for guest os
  - sw64: refactor device interrupt domain
  - sw64: kvm: fix clock sync of CORE4 live migration
  - sw64: kvm: delete memory hotplug codes for CORE3B
  - sw64: add missing c4 legacy power management code
  - sw64: add missing c4 intc kconfig
  - sw64: fix macro definition compilation error
  - i2c: designware: Do not complete i2c read without RX_FULL interrupt
  - sw64: add macros for mother board config info
  - sw64: kvm: scale up the range of target vcpu parsed by hypervisor
  - sw64: pci: reset dma mask for devices on zx200
  - sw64: kvm: fix return value of vmem_mmap
  - sw64: msi: make vector_irq_t and sw64_msi_chip_data cache line aligned
  - sw64: iommu: add default DMA ops for passthrough domains
  - sw64: iommu: recognize potential multiple aliases for devices
  - sw64: iommu: fix group allocation semantics
  - sw64: iommu: rename sunway iommu filenames
  - sw64: iommu: remove unnecessary locking for sunway iommu driver
  - sw64: fix dtb address validity check
  - sw64: iommu: use a generic implementation of DMA ops
  - sw64: pci: fix compile error when CONFIG_ACPI=n
  - sw64: smp: suppress function setup_smp() when ACPI enabled
  - sw64: acpi: parse SW CINTC for SMP initialization
  - sw64: acpi: support MADT entry print for SW CINTC
  - sw64: acpi: add ACPI-style structures for SW CINTC
  - sw64: smp: add new structure to record rcid information
  - sw64: smp: modify function smp_rcb_init() to receive base address
  - sw64: pci: synchronize the OEM table ID of MCFG with BIOS
  - sw64: kvm: add trace kvm function
  - sw64: iommu: fix the bug when vfio_iommu unpin pages
  - sw64: use rvpcr() to setup run mode
  - sw64: kgdb: add single-step debug support
  - sw64: fix lockdep error
  - sw64: perf: do all event checks in sw64_pmu_event_init()
  - sw64: numa: fix compile error when CONFIG_ACPI_NUMA=n
  - sw64: pci: export some pci functions
  - sw64: uapi: fix a compile error for headers_install
  - sw64: perf: hide hardware performance events in guest os
  - sw64: fix hugepage support
  - sw64: extern vdso_start and vdso_end as char[]
  - sw64: remove useless current_policy
  - sw64: make sure _PAGE_LEAF is zero for swap pte
  - sw64: get cpufreq_policy with standard interface
  - sw64: mm: fix function numa_clear_node()
  - sw64: acpi: enable upgrade acpi tables via initrd
  - sw64: acpi: suppress the function cpu_set_node() when CONFIG_ACPI_NUMA=y
  - sw64: acpi: fix the function for parsing CPU affinity
  - sw64: acpi: use common functions about parsing SRAT and SLIT
  - sw64: acpi: enable CONFIG_ACPI_NUMA
  - sw64: move function setup_smp() before NUMA initialization
  - sw64: acpi: move ACPI initialization before NUMA initialization
  - sw64: pci: adjust the directory structure of PCI-related source files
  - sw64: pci: move some common functions from kernel/pci.c to pci/pci.c
  - sw64: pci: support ACPI-based PCI initialization
  - sw64: iommu: apply subsys_initcall_sync for function sunway_iommu_init()
  - sw64: iommu: register iommu_cpu_syscore_ops in function sunway_iommu_init()
  - sw64: pci: use pci_bus_to_pci_controller to get pci_controller
  - sw64: pci: add quirks for ACPI-based ECAM


author: Li Nan <linan122@huawei.com> - 5.10.0-259.0.0.161
changelog:
  - !15773  drm/drm_vma_manager: Add drm_vma_node_allow_once()
  - !15794  Revert "arm64: mm: add mc support for __buffer_migrate_page"
  - !15802  hrtimers: Handle CPU state correctly on hotplug
  - hrtimers: Handle CPU state correctly on hotplug
  - !15679  list: fix a data-race around ep->rdllist
  - !15683  CVE-2025-21726
  - !15682  padata: fix UAF in padata_reorder
  - !15728  *** CVE-2025-21823 ***
  - !15782 sdma-dae: modify ttl_processes reduce logic
  - Revert "arm64: mm: add mc support for __buffer_migrate_page"
  - !15409  CVE-2025-21715
  - sdma-dae: modify ttl_processes reduce logic
  - !15760  uprobes: Reject the shared zeropage in uprobe_write_opcode()
  - !15766  bpf, sockmap: Fix race between element replace and close()
  - !15765  CVE-2024-56642
  - drm/drm_vma_manager: Add drm_vma_node_allow_once()
  - !15769  gpio: aggregator: protect driver attr handlers against module unload
  - !15753  x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
  - gpio: aggregator: protect driver attr handlers against module unload
  - bpf, sockmap: Fix race between element replace and close()
  - tipc: fix NULL deref in cleanup_bearer()
  - tipc: Fix use-after-free of kernel socket in cleanup_bearer().
  - uprobes: Reject the shared zeropage in uprobe_write_opcode()
  - x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
  - !15365 mm/init: Add quirk for phytium ps23064 SoC
  - !15690  net: rose: fix timer races against user threads
  - !15716  CVE-2022-49513
  - !15733  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
  - tracing: Fix use-after-free in print_graph_function_flags during tracer switching
  - !15449  vrf: use RCU protection in l3mdev_l3_out()
  - batman-adv: Drop unmanaged ELP metric worker
  - batman-adv: Ignore neighbor throughput metrics in error case
  - batman-adv: fix panic during interface removal
  - batman-adv: Drop initialization of flexible ethtool_link_ksettings
  - batman-adv: Add new include for min/max helpers
  - !15701  usb: gadget: f_tcm: Don't free command immediately
  - !15510 v3  CVE-2025-21816
  - !15480  PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
  - mm/init: Add quirk for phytium ps23064 SoC
  - cpufreq: governor: Use kobject release() method to free dbs_data
  - cpufreq: Move to_gov_attr_set() to cpufreq.h
  - usb: gadget: f_tcm: Don't free command immediately
  - net: rose: fix timer races against user threads
  - padata: avoid UAF for reorder_work
  - padata: add pd get/put refcnt helper
  - padata: fix UAF in padata_reorder
  - list: fix a data-race around ep->rdllist
  - hrtimer: Fix kabi broken of struct hrtimer_cpu_base
  - hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
  - hrtimer: Report offline hrtimer enqueue
  - PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
  - vrf: use RCU protection in l3mdev_l3_out()
  - net: davicom: fix UAF in dm9000_drv_remove


author: Li Nan <linan122@huawei.com> - 5.10.0-260.0.0.162
changelog:
  - !15841  HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
  - !15837  CVE-2025-21858
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
  - geneve: Suppress list corruption splat in geneve_destroy_tunnels().
  - geneve: Fix use-after-free in geneve_find_dev().
  - !15828  mt76: fix use-after-free by removing a non-RCU wcid pointer
  - !15717  media: uvcvideo: Fix double free in error path
  - !15759  Fix kmemleak false positive
  - mt76: fix use-after-free by removing a non-RCU wcid pointer
  - !15378  ASoC: atmel: Fix error handling in snd_proto_probe
  - !15696  fs/dcache: fix bad unlock balance in shrink_dentry_list()
  - !15816 perf: Configure BRBE correctly on VHE host
  - perf: Configure BRBE correctly on VHE host
  - efi/arm64: Fix kmemleak false positive in arm64_efi_rt_init()
  - media: uvcvideo: Fix double free in error path
  - fs/dcache: fix bad unlock balance in shrink_dentry_list()
  - ASoC: atmel: Fix error handling in snd_proto_probe


author: Li Nan <linan122@huawei.com> - 5.10.0-261.0.0.163
changelog:
  - !15959  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
  - !15956  drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
  - !15956  drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
  - !15791  CVE-2025-21877
  - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
  - drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
  - !15894  ftrace: Avoid potential division by zero in function_stat_show()
  - !15892  bnxt: Do not read past the end of test names
  - !15840  block: fix bugs in blk_register_queue()
  - !15867  soc: hisilicon: Serialize the online and onfline the acpi devices
  - !15883 v2  iommu/arm-smmu-v3: Fix the extra atc tlb flush
  - !15811  rapidio: add check for rio_add_net() in rio_scan_alloc_net()
  - !15756  powerpc: Fix save r13 on kprobe/ftrace entry
  - ftrace: Avoid potential division by zero in function_stat_show()
  - bnxt: Do not read past the end of test names
  - iommu/arm-smmu-v3: Fix the extra atc tlb flush
  - soc: hisilicon: Serialize the online and onfline the acpi devices
  - block: fix lock ordering in blk_register_queue() error path
  - block: fix resource leak in elevator registration error path
  - rapidio: add check for rio_add_net() in rio_scan_alloc_net()
  - usbnet: gl620a: fix endpoint checking in genelink_bind()
  - powerpc: Fix save r13 on kprobe/ftrace entry


author: Eibz-Chan <chenbingzhao@huawei.com> - 590-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:[add] backport patches from upstream
  	Fix-memory-leak-when-using-corrupt-lesshst-file.patch
  	Fix-crash-when-enter-invaid-pattern-in-command.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-23
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         [add]backport-scriptreplay-support-ctrl-s-and-ctrl-g.patch
         backport-login-use-correct-terminal-fd-during-setup.patch
         backport-login-prevent-undefined-ioctl-and-tcsetattr-calls.patch
         backport-libblkid-avoid-memory-leak-of-cachefile-path.patch
         backport-more-avoid-out-of-bound-access.patch
         backport-lslogins-fix-realloc-loop-allocation-size.patch
         backport-ldattach-don-t-call-exit-from-signal-handler.patch
         backport-libblkid-ntfs-validate-that-sector_size-is-a-power-o.patch
         backport-blkid-fix-call-to-err_exclusive_options.patch
         backport-libblkid-reset-errno-before-calling-probefuncs.patch
         backport-lib-path-fix-possible-out-of-boundary-access.patch
         backport-libmount-improve-mnt_table_next_child_fs.patch
         backport-libmount-fix-possible-NULL-dereference-coverity-scan.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-24
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
  	[add]backport-libsmartcols-drop-spourious-newline-in-between-strea.patch
  	backport-libsmartcols-flush-correct-stream.patch
  	backport-libsmartcols-only-recognize-closed-object-as-final-e.patch
  	backport-cal-avoid-out-of-bound-write.patch
  	backport-libfdisk-sun-properly-initialize-partition-data.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-25
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:solve the issue of ext4 is incorrectly probed as drbd
          [add]backport-include-c.h-add-helpers-for-unaligned-structure-acce.patch
          backport-libblkid-probe-read-data-in-chunks.patch
          backport-libblkid-avoid-aligning-out-of-probing-area.patch
          backport-libblkid-drbd-validate-zero-padding.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-26
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         backport-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-receive.patch
         backport-libblkid-hfsplus-reduce-false-positive.patch
         backport-wall-fix-calloc-cal-Werror-calloc-transposed-args.patch
         backport-libblkid-drbd-reduce-false-positive.patch
         backport-lib-cpuset-exit-early-from-cpulist_parse.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-27
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         backport-sys-utils-lscpu-Unblock-SIGSEGV-before-vmware_bdoor.patch
         backport-libblkid-Check-offset-in-LUKS2-header.patch
         backport-more-fix-poll-use.patch


author: cenhuilin <cenhuilin@kylinos.cn> - 2.37.2-29
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         backport-uuidd-fix-open-lock-state-issue.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-30
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add provides and support enable-raw
         The current version of the kernel also supports the raw driver.
         To keep consistent with the previous version, roll back the modification.


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-31
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix lscpu core dump
         backport-lscpu-don-t-use-NULL-sharedmap.patch
         backport-lscpu-use-topology-maps-in-more-robust-way.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-32
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         backport-hexdump-check-blocksize-when-display-data.patch
         backport-lslocks-fix-buffer-overflow.patch
         backport-last-avoid-out-of-bounds-array-access.patch
         backport-lsipc-fix-semaphore-USED-counter.patch


author: yanglongkang <yanglongkang@h-partners.com> - 2.61-7
changelog:
  - backport upstream patches:
    getcpcaps: fix program name in help message
    Stop using _pam_overwrite() in pam_cap.c


author: xinghe <xinghe2@h-partners.com> - 2.74.2-5
changelog:
  - Type:cves
  - ID:CVE-2024-52530 CVE-2024-52531 CVE-2024-52532
  - SUG:NA
  - DESC:fix CVE-2024-52530 CVE-2024-52531 CVE-2024-52532


author: zhangpan <zhangpan103@h-partners.com> - 2.74.2-6
changelog:
  - Type:cves
  - ID:CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784
  - SUG:NA
  - DESC:fix CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784


author: zhangpan <zhangpan103@h-partners.com> - 2.74.2-7
changelog:
  - Type:cves
  - ID:CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913
  - SUG:NA
  - DESC:fix CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913


author: Funda Wang <fundawang@yeah.net> - 2.9.14-15
changelog:
  - Type:CVE
  - CVE:CVE-2024-56171
  - CVE:CVE-2025-24928
  - CVE:CVE-2025-27113
  - SUG:NA
  - DESC: fix CVE-2024-56171, CVE-2025-24928, CVE-2025-27113


author: cuixucui <cuixucui1@h-partner.com> - 1.1.3-2
changelog:
  - Fix code issue and update log print in network
  - Cancel deleting the IP that automatically configured on the server
  - Fix cdrom bug


author: liqiang <liqiang332@h-partner.com> - 1.1.3-3
changelog:
  - Fix libswsds.so not stripped
  - Fix the value of kernel.src obtained by the kabi test case is incorrect
  - Add board infomation and fix memory bug
  - Fix the block size fails to be obtained during the NVME test
  - Judge whether to support kabi testing by architecture
  - Update readme and dev_design


author: cuixucui <cuixucui1@h-partner.com> - 1.1.4-0
changelog:
  - Add board information in the test report
  - Add spdk test case
  - Add dpdk test case
  - Update pci.ids file


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-0
changelog:
  - Add support for openEuler 20.03 LTS SP4, openEuler 22.03 LTS SP2, openEuler 22.03 LTS SP3
  - Add modifications to Kylinsec with oec-hardware
  - Add support for Loongson and SW architectures
  - Bugfix


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Add virtual cases
  - Resolve IB startup IB_Read_BW service failure issue
  - Delete redundant references
  - Resolve incorrect type in vgpu result data
  - Resolve the issue of getting the kernel source rpm


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Resolve kdump\watchdog\cpufreq\kabiwhitelist\network test failure issue 
  - Add fio test cases:read,write,randread,randwrite
  - Solve the nvme line break issue in the command line interface
  - Fix compilation errors in the make command
  - Add Vulkan testcase for nvida GPU
  - Resolve the issue of oech server startup failure on version 24.03


author: xiaochn <xiaochuannan@inspur.com> - 1.1.5-3
changelog:
  - Resolve the issue of different kernel source download locations in kabi test case
  - Resolve the issue that kabiwhitelist still passes when the ko and rpm file does not exist
  - Add the way for manually adding kabiwhitelist file
  - For custom vendors, refer to the method of obtaining openEuler os information
  - Supports custom vendor


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-0
changelog:
  - Add new test suite srpm and intel
  - Add virtual branch of test suite
  - Add support for Kylin and UOS
  - Bugfix


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-3
changelog:
  - Update the pci.ids file
  - Remove unused variable in cdrom test suite
  - Update test_guide doc
  - Unify the location for downloading kernel source RPMs
  - Optimize kabiwhitelist and system test


author: renmingshuai<renmingshuai@huawei.com> - 8.8p1-25
changelog:
  - Type:CVE
  - CVE:CVE-2023-48795,CVE-2023-51385
  - SUG:NA
  - DESC:fix CVE-2023-48795 and CVE-2023-51385


author: xinsheng <xinsheng3@huawei.com> - 3.9.9-30
changelog:
  - Type:CVE
  - CVE:NA
  - SUG:NA
  - DESC:fix CVE-2024-6923,CVE-2024-7592,CVE-2024-8088
      - Encode newlines in headers, and verify headers are sound
      - Fix quadratic complexity in parsing quoted cookie values with backslashes
      - Replaced SanitizedNames with a more surgical fix


author: xinsheng <xinsheng3@huawei.com> - 3.9.9-31
changelog:
  - Type:CVE
  - CVE:CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597,CVE-2024-4032
  - SUG:NA
  - DESC:fix CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597,CVE-2024-4032
      - rename all CVE patch name
      - CVE-2024-6232: Remove backtracking when parsing tarfile headers
      - CVE-2024-3219: patch1 Authenticate socket connection for `socket.socketpair()` fallback
      - CVE-2024-3219: patch2 Rework pure Python socketpair tests to avoid use of importlib.reload.
      - CVE-2024-0450: Protect zipfile from "quoted-overlap" zipbomb
      - CVE-2023-6597: tempfile.TemporaryDirectory: fix symlink bug in cleanup
      - CVE-2024-4032: Fix "private" (non-global) IP address ranges


author: wangshuo <wangshuo@kylinos.cn> - 3.9.9-32
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport upstream patch, fix the bug introduced by the fix for CVE-2007-4559
  -      gh-107845: Fix symlink handling for tarfile.data_filter


author: Funda Wang <fundawang@yeah.net> - 3.9.9-34
changelog:
  - Type:CVE
  - CVE:CVE-2024-9287
  - SUG:NA
  - DESC:fix CVE-2024-9287
    - Quote template strings in venv activation scripts


author: xinsheng <xinsheng3@huawei.com> - 3.9.9-36
changelog:
  - Type:CVE
  - CVE:CVE-2024-11168
  - SUG:NA
  - DESC:fix CVE-2024-11168
         - Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format


author: gaihuiying <eaglegai@163.com> - 1.13.2-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:change run directory from /var/run to /run to fix "/usr/lib/tmpfiles.d/unbound.conf:1: xxxx"


author: chenhaixing <chenhaixing@huawei.com> - 1.26.8-2
changelog:
  - delete patch Bump-RECENT_DATE.patch and modify RECENT_DATE in python-urllib3.spec to adapt time change


author: chenhaixing <chenhaixing@huawei.com> - 1.26.12-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix socket timeout value when HTTPConnect is reused
         remove Exclamation mark character from the unreserved characters
         fix _idna_encode handling of x80


author: chengyechun <chengyechun1@huawei.com> - 1.26.12-7
changelog:
  - Type:CVE
  - CVE:CVE-2024-37891
  - SUG:NA
  - DESC:fix CVE-2024-37891 Strip Proxy-Authorization header on redirects


author: <fengjiabo1@huawei.com> - 10:6.2.0-92
changelog:
  - s390x/sclp: Simplify get_sclp_device() 
  - target/ppc: Remove msr_pr macro
  - docs/system/target-arm: Re-alphabetize board list
  - migration: Extend query-migrate to provide dirty page limit info
  - migration: Implement dirty-limit convergence algo
  - migration: Put the detection logic before auto-converge checking
  - migration: Refactor auto-converge capability logic
  - migration: Introduce dirty-limit capability
  - qapi/migration: Introduce vcpu-dirty-limit parameters
  - qapi/migration: Introduce x-vcpu-dirty-limit-period parameter
  - Change the value of no_ged from true to false
  - Allow UNIX socket option for VNC websocket
  - tpm_emulator: Avoid double initialization during
  - chardev/char-socket: Update AF_UNIX for Windows
  - KVM: dirty ring: add missing memory barrier
  - i386: reset KVM nested state upon CPU reset
  - esp: Handle CMD_BUSRESET by resetting the SCSI bus
  - dbus-vmstate: Restrict error checks to registered proxies in dbus_get_proxies
  - vfio/pci: Add Ascend310b scend910b support
  - target/i386: Export RFDS bit to guests
  - target/i386: Add new CPU model SierraForest
  - target/i386: Introduce Icelake-Server-v7 to enable TSX
  - hw/virtio: handle un-configured shutdown in virtio-pci
  - target/s390x: display deprecation status in '-cpu  help'
  - target/i386: display deprecation status in '-cpu  help'
  - pc-bios/s390-ccw: Fix booting with logical block size < physical block size


author: <fengjiabo1@huawei.com> - 10:6.2.0-93
changelog:
  - cvm: bug-fix for macro isolation
  - tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fix CVE-2023-5088)
  - hw/ide: reset: cancel async DMA operation before resetting state (Fix CVE-2023-5088)
  - Add support for the virtcca cvm feature.


author: <fengjiabo1@huawei.com> - 10:6.2.0-96
changelog:
  - vdpa: Fix bug where vdpa appliance migration does not resume after rollback
  - block: Parse filenames only when explicitly requested (CVE-2024-4467)
  - block: introduce bdrv_open_file_child() helper
  - iotests/270: Don't store data-file with json: prefix in image (CVE-2024-4467)
  - iotests/244: Don't store data-file with protocol in image (CVE-2024-4467)
  - qcow2: Don't open data_file with BDRV_O_NO_IO (CVE-2024-4467)
  - qcow2: Do not reopen data_file in invalidate_cache
  - hw/intc/arm_gic: Fix deactivation of SPI lines chery-pick from 7175a562f157d39725ab396e39c1e8e410d206b3
  - vhost-user: Skip unnecessary duplicated VHOST_USER_SET_LOG_BASE requests
  - target/ppc: Split off common embedded TLB init cheery-pick from 581eea5d656b73c6532109f4ced4c73fd4e5fd47`
  - vdpa: fix vdpa device migrate rollback wrong when suspend device failed 1. 
  - hw/virtio/virtio-pci:Support shadow device for virtio-net/blk/scsi devices


author: <fengjiabo1@huawei.com> - 10:6.2.0-97
changelog:
  - nbd/server: CVE-2024-7409: Close stray clients at server-stop
  - main-loop.h: introduce qemu_in_main_thread()
  - aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED
  - nbd/server: CVE-2024-7409: Drop non-negotiating clients
  - nbd/server: CVE-2024-7409: Cap default max-connections to 100
  - nbd/server: Plumb in new args to nbd_client_add()
  - nbd: Minor style and typo fixes


author: <fengjiabo1@huawei.com> - 10:6.2.0-98
changelog:
  - pci-host: designware: Limit value range of iATU viewport register
  - hmat acpi: Fix out of bounds access due to missing use of indirection
  - migration: Skip only empty block devices
  - aspeed/hace: Initialize g_autofree pointer
  - hw/net/vmxnet3: Fix guest-triggerable assert()
  - qxl: don't assert() if device isn't yet initialized
  - Avoid unaligned fetch in ladr_match()
  - linux-user: Fix waitid return of siginfo_t and rusage
  - hw/net/lan9118: Replace magic '2048' value by MIL_TXFIFO_SIZE definition
  - stdvga: fix screen blanking
  - virtio-net: drop too short packets early
  - ebpf: replace deprecated bpf_program__set_socket_filter
  - vhsot-user: only read reply of SET_LOG_BASE from vq 0
  - cpu: add Tengyun S5000C cpu support
  - hw/virtio: Fix obtain the buffer id from the last descriptor
  - hw/core: ensure kernel_end never gets used undefined


author: <fengjiabo1@huawei.com> - 10:6.2.0-99
changelog:
  - target/i386: Introduce SapphireRapids-v3 to add missing features
  - qtest/fuzz-lsi53c895a-test: set guest RAM to 2G
  - hw/net/lan9118: Signal TSFL_INT flag when TX FIFO reaches specified level
  - target/arm: Fix alignment for VLD4.32
  - hw/microblaze: pass random seed to fdt
  - tests/qtest: npcm7xx-emc-test: Skip checking MAC
  - tests: mark io-command test as skipped if socat is missing
  - tests: unit: add NULL-pointer check
  - tests: test-qga: close socket on failure to connect
  - vdpa:block device capacity expansion online support vdpa block device update capacity.
  - virtio-net: Ensure queue index fits with RSS(CVE-2024-6505)
  - nbd/server: CVE-2024-7409: Avoid use-after-free when closing server
  - ppc/vof: Fix unaligned FDT property access
  - vvfat: Fix reading files with non-continuous clusters
  - vvfat: Fix bug in writing to middle of file
  - savevm: Fix load_snapshot error path crash
  - hw/dma/xilinx_axidma: Use semicolon at end of statement, not comma
  - hw/remote/message.c: Don't directly invoke DeviceClass:reset
  - crypto/tlscredspsk: Free username on finalize
  - hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()
  - virtio: remove virtio_tswap16s() call in vring_packed_event_read()
  - char-stdio: Restore blocking mode of stdout on exit
  - hw/ppc: spapr: Use qemu_vfree() to free spapr->htab
  - smbios: sanitize type from external type before checking have_fields_bitmap
  - spapr_pci: fix leak in spapr_phb_vfio_get_loc_code
  - KVM: use store-release to mark dirty pages as harvested
  - monitor/hmp: print trace as option in help for log command
  - tpm_crb: Avoid backend startup just before shutdown under Xen
  - crypto/block-luks: make range overlap check more readable
  - spapr: Free stdout path
  - target/rx: Use target_ulong for address in LI
  - virtio-pci: Fix the use of an uninitialized irqfd
  - rtl8139: Fix behaviour for old kernels.
  - virtio-rng: block max-bytes=0 MIME-Version: 1.0
  - hw/audio/es1370: Clean up comment
  - vhost-user-server: do not set memory fd non-blocking
  - ui: reject extended clipboard message if not activated
  - virtio-net: Fix vhost virtqueue notifiers for RSS
  - hw/misc/applesmc: Fix memory leak in reset() handler


author: <fengjiabo1@huawei.com> - 10:6.2.0-100
changelog:
  - mac_dbdma: Remove leftover `dma_memory_unmap` calls(CVE-2024-8612)
  - softmmu: Support concurrent bounce buffers(CVE-2024-8612)
  - system/physmem: Per-AddressSpace bounce buffering
  - system/physmem: Propagate AddressSpace to MapClient helpers


author: <fengjiabo1@huawei.com> - 10:6.2.0-101
changelog:
  - python/aqmp: use absolute import statement
  - sysemu: Cleanup qemu_run_machine_init_done_notifiers()
  - vhost-backend: avoid overflow on memslots_limit
  - hw/i386/vmmouse: Require 'i8042' property to be set
  - hw/scsi/megasas: Fails command if SGL buffer overflows
  - target/i386/kvm: Replace use of __u32 type
  - hw/avr: Realize AVRCPU qdev object using qdev_realize()
  - qemu-keymap: Add license in generated files
  - configure: Symlink binaries using .exe suffix with MinGW
  - ui: remove break after g_assert_not_reached()
  - io/channel-websock: Replace strlen(const_str) by sizeof(const_str) - 1
  - target/ppc: Add HASHKEYR and HASHPKEYR SPRs
  - tests: Fix error strings
  - Hexagon (target/hexagon) remove unused encodings
  - target/i386: introduce insn_get_addr
  - target/i386: REPZ and REPNZ are mutually exclusive
  - target/i386: correctly mask SSE4a bit indices in register operands
  - bios-tables-test: Make oem-fields tests be consistent
  - tests/vm: update NetBSD to 9.3
  - monitor/hmp-cmds: Avoid displaying bogus size in 'info pci' When BAR aren't mapped, we get:
  - virtio-mem: don't warn about THP sizes on a kernel without THP Support
  - Subject: [PATCH] kvm: Use 'unsigned long' for request argument in functions  wrapping ioctl()


author: <fengjiabo1@huawei.com> - 10:6.2.0-87
changelog:
  - vdpa: suspend function return 0 when the vdpa device is stopped
  - vdpa: don't suspend/resume device when vdpa device not started
  - vdpa: support vdpa device suspend/resume
  - vdpa: correct param passed in when unregister save
  - vdpa: set vring enable only if the vring address has already been set
  - shadow_dev: introduce shadow dev for virtio-net device
  - revert "tcg/loongarch64: Fix tcg_out_mov() Aborted"
  - migration: Set downtime_start even for postcopy
  - gdb-xml: fix duplicate register in arm-neon.xml
  - iotests: fix default machine type detection
  - migration: fix RAMBlock add NULL check
  - s390x: Fix spelling errors
  - ppc: spelling fixes
  - hw/scsi/vhost-scsi: don't double close vhostfd on error
  - virtio/vhost-vsock: don't double close vhostfd, remove redundant cleanup
  - hw/scsi/vhost-scsi: don't leak vqs on error
  - hw/i386/pc: Add missing property descriptions
  - pcie_aer: Don't trigger a LSI if none are defined
  - pci: Export the pci_intx() function
  - hw/qdev: Cosmetic around documentation
  - tests/unit: fix a -Wformat-truncation warning
  - tests/avocado: mark ReplayKernelNormal.test_mips64el_malta as flaky
  - i386/sev: Avoid SEV-ES crash due to missing MSR_EFER_LMA bit
  - ui/vnc-clipboard: fix inflate_buffer
  - hw/usb/hcd-xhci.c: spelling: tranfer


author: <fengjiabo1@huawei.com> - 10:6.2.0-88
changelog:
  - ui/vnc.c: Fixed a deadlock bug.
  - hw/i386: Fix comment style in topology.h
  - migration/multifd: Remove unnecessary usage of local Error
  - linux-user: fix sockaddr_in6 endianness
  - vhost_vdpa: fix the input in trace_vhost_vdpa_listener_region_del()
  - iotests: fix 194: filter out racy postcopy-active event
  - tests/avocado: fix waiting for vm shutdown in replay_linux
  - ui/vnc: fix debug output for invalid audio message


author: <fengjiabo1@huawei.com> - 10:6.2.0-89
changelog:
  - qga-win: Fix guest-get-fsinfo multi-disks collection
  - hw/timer: fix systick trace message
  - virtio-net: correctly copy vnet header when flushing TX (CVE-2023-6693)
  - ui/clipboard: mark type as not available when there is no data (CVE-2023-6683)
  - esp: restrict non-DMA transfer length to that of available data (CVE-2024-24474)
  - hw/scsi/lsi53c895a: add missing decrement of reentrancy counter
  - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330)
  - net: Update MemReentrancyGuard for NIC (CVE-2023-3019)
  - net: Provide MemReentrancyGuard * to qemu_new_nic()


author: <fengjiabo1@huawei.com> - 10:6.2.0-90
changelog:
  - i386/cpuid: Move leaf 7 to correct group
  - i386/cpuid: Decrease cpuid_i when skipping CPUID leaf 1F
  - i386/cpu: Mask with XCR0/XSS mask for FEAT_XSAVE_XCR0_HI and FEAT_XSAVE_XSS_HI leafs
  - i386/cpu: Clear FEAT_XSAVE_XSS_LO/HI leafs when CPUID_EXT_XSAVE is not available
  - target/i386: Change wrong XFRM value in SGX CPUID leaf
  - target/i386: Enable support for XSAVES based features
  - target/i386: Add kvm_get_one_msr helper
  - hw/block/hd-geometry: Do not override specified bios-chs-trans mainline inclusion commit fd8a68ad6823d33bedeba20a22857867a1c3890e category: bugfix
  - linux-user/riscv: Align signal frame to 16 bytes mainline inclusion commit 1eaa63429a9944265c92efdb94c02fabb231f564 category: bugfix
  - ipmi:smbus: Add a check around a memcpy mainline inclusion commit 3fde641e7286f9b968bdb3b4b922c6465f2a9abc category: bugfix
  - tests/tcg/linux-test: Fix random hangs in test_socket mainline inclusion commit b9e6074fc5b429b1e956e9c60db7e284a91e0f3d category: bugfix
  - qemu-options.hx: Don't claim "-serial" has limit of 4 serial ports Before v2.12, the implementation of serial ports was limited to a value of MAX_SERIAL_PORTS = 4. We now dynamically allocate the data structures for serial ports, so this limit is no longer present, but the documentation for the -serial options still reads:
  - target/ppc: Modify the uncorrect value irq to n_IRQ
  - block-migration: Ensure we don't crash during migration cleanup
  - target/s390x: fix handling of zeroes in vfmin/vfmax mainline inclusion commit 13c59eb09bd6d1fbc13f08b708226421f14a232b category: bugfix
  - hw/virtio/virtio-iommu: Enforce power-of-two notify for both MAP and UNMAP mainline inclusion commit 0522be9a0c0094088ccef7aab352c57f483ca250 category: bugfix
  - configure: Add missing POSIX-required space mainline inclusion commit 35a7a6fc5624b1df828d82f2dfa74d0e4188b3b2 category: bugfix
  - vga: fix incorrect line height in 640x200x2 mode mainline inclusion commit 37e7b86766244b62a406747bb78e049390d0b528 category: bugfix
  - hw/ide/core: set ERR_STAT in unsupported command completion
  - linux-user/flatload.c: Fix setting of  image_info::end_code mainline inclusion commit 734a659ad264ac080457167e845ffabbaaa66d0e category: bugfix
  - load_elf: fix iterator's type for elf file processing
  - hw/misc/mps2-scc: Free MPS2SCC::oscclk[] array on finalize()
  - hw/nvram/xlnx-efuse: Free XlnxEFuse::ro_bits[] array on finalize()
  - hw/nvram/xlnx-efuse-ctrl: Free XlnxVersalEFuseCtrl[] "pg0-lock" array
  - chardev/char.c: fix "abstract device type" error message
  - block/rbd: fix handling of holes in .bdrv_co_block_status
  - qga: treat get-guest-fsinfo as "best effort" mainline inclusion commit bbb0151cf2e82489120a15df5e2eb9653312b0ec category: bugfix
  - usb/hcd-xhci: check slotid in  xhci_wakeup_endpoint() mainline inclusion commit 84218892f05515d20347fde4506e1944eb11cb25 category: bugfix
  - hw/display/bcm2835_fb: Fix framebuffer allocation  address mainline inclusion commit 5865d99fe88d8c8fa437c18c6b63fb2a8165634f category: bugfix
  - block/parallels: Fix buffer-based write call mainline inclusion commit eba088f91d21d9e42a81bef847173da30c5da961 category: bugfix
  - vl: Improve error message for conflicting -incoming and -loadvm
  - hw/smbios: Fix OEM strings table option validation


author: <fengjiabo1@huawei.com> - 10:6.2.0-91
changelog:
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/virtio: Introduce virtio_bh_new_guarded() helper
  - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded
  - checkpatch: add qemu_bh_new/aio_bh_new checks
  - async: avoid use-after-free on re-entrancy guard
  - async: Add an optional reentrancy guard to the BH API
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set(CVE-2024-3447)
  - rtl8139: Remove unused variable
  - tulip: Remove unused variable
  - virtio-mem: Fix the bitmap index of the section offset
  - virtio-mem: Fix the iterator variable in a vmem->rdl_list loop
  - system/memory: use ldn_he_p/stn_he_p
  - block: Fix crash when loading snapshot on inactive node
  - smmu: Clear SMMUPciBus pointer cache when system reset
  - block/mirror: Fix NULL s->job in active writes
  - amd_iommu: Fix APIC address check
  - virtio-crypto: fix NULL pointer dereference in virtio_crypto_free_reques
  - libqos/virtio.c: Correct 'flags' reading in qvirtqueue_kick
  - ivshmem-test.c: enable test_ivshmem_server for ppc64 arch
  - ivshmem.c: change endianness to LITTLE_ENDIAN
  - hw/ppc/mac.h: Remove MAX_CPUS macro
  - configure: remove dead variables
  - virtio-gpu: do not byteswap padding
  - hw/intc: clean-up error reporting for failed ITS cmd
  - qemu-iotests: Discard stderr when probing devices
  - linux-user: un-parent OBJECT(cpu) when closing thread
  - hw/net/rocker: Avoid undefined shifts with more than 31 ports
  - contrib/vhost-user-blk: Clean up deallocation of VuVirtqElement
  - scsi-disk: fix overflow when block size is not a multiple of BDRV_SECTOR_SIZE


author: huyubiao <huyubiao@huawei.com> - 249-70
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add backport-basic-fix-overflow-detection-in-sigbus_pop.patch
         backport-busctl-avoid-asserting-on-NULL-message.patch
         backport-resolve-don-t-add-sockets-to-the-graveyard-on-shutdo.patch
         backport-sd-journal-check-sd-event-state-before-setting-up-po.patch


author: huyubiao <huyubiao@huawei.com> - 249-73
changelog:
  - move the architecture patches after Patch9800 (excluding Patch9800)
    delete the duplicate systemd-coredump.socket


author: huyubiao <huyubiao@huawei.com> - 249-75
changelog:
  - DESC:add backport-core-exec-do-not-crash-with-UtmpMode-user-without-Us.patch
         backport-resolved-limit-the-number-of-signature-validations-i.patch
         backport-resolved-reduce-the-maximum-nsec3-iterations-to-100.patch


author: huyubiao <huyubiao@huawei.com> - 249-78
changelog:
  - add backport-login-user-runtime-dir-properly-check-for-mount-poin.patch
        backport-user-util-validate-the-right-field.patch


author: Liu Chao <liuchao173@huawei.com> - 2.24.1-1
changelog:
  - Upgrade to 2.24.1:
    - fixed privileged execution of arbitrary scripts by active local user. (CVE-2024-52336)
    - added sanity checks for API methods parameters. (CVE-2024-52337)


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-22
changelog:
  - Type:CVE
  - ID:CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237
  - SUG:NA
  - DESC:fix CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237


