# changelog

author: fuanan <fuanan3@h-partners.com> - 2.33.0-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Modify parameter in backport-CVE-2022-23521-attr-fix-silently-splitting-up-lines-longer-than-204.patch


author: fuanan <fuanan3@h-partners.com> - 2.33.0-10
changelog:
  - Type:CVE
  - ID:CVE-2023-25652 CVE-2023-29007 CVE-2023-25815
  - SUG:NA
  - DESC:Fix CVE-2023-25652 CVE-2023-29007 CVE-2023-25815


author: fuanan <fuanan3@h-partners.com> - 2.33.0-11
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:enable multithreading compilation and installation,
         move Git.3pm.gz to perl-Git,avoid installation conflicts,
         change BuildRequires from pcre-devel to pcre2-devel.


author: huyubiao <huyubiao@huawei.com> - 2.33.0-13
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Specifying Obsoletes and Provides version numbers, prevent upgrade conflicts.
         Delete git-core-doc from git, git-core-doc is provided by git-help.


author: fuanan <fuanan3@h-partners.com> - 2.33.0-14
changelog:
  - Type:CVE
  - ID:CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465
  - SUG:NA
  - DESC:Fix CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465


author: Qingqing Li <liqingqing3@huawei.com> - 2.34-145
changelog:
  - elf: Add a way to check if tunable is set (BZ 27069)
  - malloc: Improve MAP_HUGETLB with glibc.malloc.hugetlb=2


author: chengyechun <chengyechun1@huawei.com> - 2.34-148
changelog:
  - Type:CVE
  - ID:CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602
  - SUG:NA
  - DESC:fix CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602


author: chengyechun <chengyechun1@huaiwe.com> - 2.34-149
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:nscd: Use errval, not errno to guide cache update
         nsce :Skip unusable entries in first pass in prune_cache


author: shixuantong <shixuantong1@huawei.com> - 2.34-150
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:elf: Add TLS modid reuse test for bug 29039
         elf: Fix TLS modid reuse generation assignment
         elf: Check objname before calling fatal_error
         elf: Fix _dl_debug_vdprintf to work before self-relocation
         elf: ldconfig should skip temporary files created by package managers
         ldconfig: Fixes for skipping temporary files.


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-191.0.0.104
changelog:
  - !5152  arm64/mpam: Remove warning about no msc corresponding to the online cpu
  - arm64/mpam: Remove warning about no msc corresponding to the online cpu
  - !5145  arm64/mpam: Expand the monitor number of the resctrl root
  - !5144  arm64/mpam: Fix use-after-free when deleting resource groups
  - arm64/mpam: Expand the monitor number of the resctrl root
  - arm64/mpam: Fix use-after-free when deleting resource groups
  - !5117  fix CVE-2023-52527
  - !4648 [OLK-5.10] Intel: backport TPMI RAPL driver for GNR/SRF
  - !4842 Intel-sig: intel_idle: add Sierra Forest SoC support on 5.10
  - !5113  fix CVE-2023-52578
  - !5031 Backport 5.10.196 -5.10.197 LTS patches from upstream
  - l2tp: pass correct message length to ip6_append_data
  - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
  - net: fix kabi check warning
  - net: Fix unwanted sign extension in netdev_stats_to_stats64()
  - net: bridge: use DEV_STATS_INC()
  - net: add atomic_long_t to net_device_stats fields
  - !5063  dccp: fix dccp_v4_err()/dccp_v6_err() again
  - !5062  team: fix null-ptr-deref when team device type is changed
  - !5096  wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
  - !5044  bugfix for pbha
  - !5078  RDMA/rxe: Return CQE error if invalid lkey was supplied
  - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
  - !4261 [22.03-LTS-SP3] Fix crash on platfoms using legacy KVM MMU Notifier APIs
  - !4966 [sync] PR-4934:  arm64: head.S: always initialize PSTATE
  - RDMA/rxe: Return CQE error if invalid lkey was supplied
  - !5051  dm: limit the number of targets and parameter size area
  - !4933  scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
  - !5064  net: rds: Fix possible NULL-pointer dereference
  - !5058  net: fix possible store tearing in neigh_periodic_work()
  - !4968  sched: migtate user interface from smart grid to sched bpf
  - !5033 v3  Remove WQ_FLAG_BOOKMARK flag
  - !5032  net/sched: act_ct: fix wild memory access when clearing fragments
  - net: rds: Fix possible NULL-pointer dereference
  - dccp: fix dccp_v4_err()/dccp_v6_err() again
  - team: fix null-ptr-deref when team device type is changed
  - net: fix possible store tearing in neigh_periodic_work()
  - dm: limit the number of targets and parameter size area
  - arm64: mm: Use subsequent bits to improve future compatibility for pbha
  - arm64: mm: Use corrent pte val in arch_vm_get_page_prot
  - sched: remove wait bookmarks
  - filemap: remove use of wait bookmarks
  - net/sched: act_ct: fix wild memory access when clearing fragments
  - !5004  nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
  - scsi: pm8001: Setup IRQs on resume
  - scsi: megaraid_sas: Fix deadlock on firmware crashdump
  - i2c: aspeed: Reset the i2c controller when timeout occurs
  - tracefs: Add missing lockdown check to tracefs_create_dir()
  - nfsd: fix change_info in NFSv4 RENAME replies
  - tracing: Have option files inc the trace array ref count
  - tracing: Have current_trace inc the trace array ref count
  - drm/amd/display: enable cursor degamma for DCN3+ DRM legacy gamma
  - drm/amdgpu: fix amdgpu_cs_p1_user_fence
  - btrfs: release path before inode lookup during the ino lookup ioctl
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items
  - ovl: fix incorrect fdput() on aio completion
  - attr: block mode changes of symlinks
  - md/raid1: fix error: ISO C90 forbids mixed declarations
  - samples/hw_breakpoint: fix building without module unloading
  - x86/boot/compressed: Reserve more memory for page tables
  - scsi: lpfc: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
  - selftests: tracing: Fix to unmount tracefs for recovering environment
  - scsi: qla2xxx: Fix NULL vs IS_ERR() bug for debugfs_create_dir()
  - drm: gm12u320: Fix the timeout usage for usb_bulk_msg()
  - btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super
  - btrfs: add a helper to read the superblock metadata_uuid
  - btrfs: move btrfs_pinned_by_swapfile prototype into volumes.h
  - mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller
  - mtd: rawnand: brcmnand: Allow SoC to provide I/O operations
  - kobject: Add sanity check for kset->kobj.ktype in kset_register()
  - media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning
  - serial: cpm_uart: Avoid suspicious locking
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
  - usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
  - media: pci: cx23885: replace BUG with error return
  - media: tuners: qt1010: replace BUG_ON with a regular error
  - media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
  - media: anysee: fix null-ptr-deref in anysee_master_xfer
  - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
  - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
  - powerpc/pseries: fix possible memory leak in ibmebus_bus_init()
  - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
  - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()
  - md: raid1: fix potential OOB in raid1_remove_disk()
  - bus: ti-sysc: Configure uart quirks for k3 SoC
  - drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
  - ALSA: hda: intel-dsp-cfg: add LunarLake support
  - samples/hw_breakpoint: Fix kernel BUG 'invalid opcode: 0000'
  - drm/bridge: tc358762: Instruct DSI host to generate HSE packets
  - wifi: mac80211_hwsim: drop short frames
  - netfilter: ebtables: fix fortify warnings in size_entry_mwt()
  - alx: fix OOB-read compiler warning
  - mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450
  - tpm_tis: Resend command to recover from data transfer errors
  - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
  - wifi: wil6210: fix fortify warnings
  - wifi: mwifiex: fix fortify warning
  - wifi: ath9k: fix printk specifier
  - wifi: ath9k: fix fortify warnings
  - crypto: lrw,xts - Replace strlcpy with strscpy
  - devlink: remove reload failed checks in params get/set callbacks
  - hw_breakpoint: fix single-stepping when using bpf_overflow_handler
  - ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2
  - ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470
  - scftorture: Forgive memory-allocation failure if KASAN
  - rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle()
  - kernel/fork: beware of __put_task_struct() calling context
  - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer
  - locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock
  - btrfs: output extra debug info if we failed to find an inline backref
  - autofs: fix memory leak of waitqueues in autofs_catatonic_mode
  - !4987  net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
  - !4991  CVE-2023-52568
  - !4994  mpam/mpam_ctrlmon: update monitor config with its parent's ctrl_val
  - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
  - !4988  ieee802154: ca8210: Fix a potential UAF in ca8210_probe
  - !4979  CVE-2021-47028
  - mpam/mpam_ctrlmon: update monitor config with its parent's ctrl_val
  - x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race
  - ieee802154: ca8210: Fix a potential UAF in ca8210_probe
  - !4925 v2  btrfs: do not ASSERT() if the newly created subvolume already got read
  - !4905 Backport 5.10.195 LTS patches from upstream
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
  - !4339 修复pmem_legacy_device未被编译问题
  - mt76: mt7915: fix txrate reporting
  - mt76: mt7915: rename mt7915_mcu_get_rate_info to mt7915_mcu_get_tx_rate
  - sched: migtate user interface from smart grid to sched bpf
  - arm64: head.S: always initialize PSTATE
  - drm/mediatek: Fix backport issue in mtk_drm_gem_prime_vmap()
  - scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
  - parisc: Drop loops_per_jiffy from per_cpu struct
  - drm/amd/display: Fix a bug when searching for insert_above_mpcc
  - kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
  - ixgbe: fix timestamp configuration code
  - ipv6: fix ip6_sock_set_addr_preferences() typo
  - platform/mellanox: mlxbf-tmfifo: Drop jumbo frames
  - platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors
  - kcm: Fix memory leak in error path of kcm_sendmsg()
  - r8152: check budget for r8152_poll()
  - hsr: Fix uninit-value access in fill_frame_info()
  - net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all()
  - net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc()
  - net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add
  - kselftest/runner.sh: Propagate SIGTERM to runner child
  - selftests/kselftest/runner/run_one(): allow running non-executable files
  - bus: mhi: host: Skip MHI reset if device is in RDDM
  - ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2
  - ARM: dts: samsung: exynos4210-i9100: Fix LCD screen's physical size
  - scsi: qla2xxx: Flush mailbox commands on chip reset
  - scsi: qla2xxx: Fix crash in PCIe error handling
  - scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe
  - scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry
  - arm64: sdei: abort running SDEI handlers during crash
  - ACPI: APEI: explicit init of HEST and GHES in apci_init()
  - perf hists browser: Fix the number of entries for 'e' key
  - perf tools: Handle old data in PERF_RECORD_ATTR
  - perf hists browser: Fix hierarchy mode header
  - drm/amd/display: prevent potential division by zero errors
  - mtd: rawnand: brcmnand: Fix potential false time out warning
  - mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
  - mtd: rawnand: brcmnand: Fix crash during the panic_write
  - btrfs: use the correct superblock to compare fsid in btrfs_validate_super
  - btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART
  - fuse: nlookup missing decrement in fuse_direntplus_link
  - ata: pata_ftide010: Add missing MODULE_DESCRIPTION
  - ata: sata_gemini: Add missing MODULE_DESCRIPTION
  - ext4: add correct group descriptors and reserved GDT blocks to system zone
  - sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory()
  - net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times
  - net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload
  - idr: fix param name in idr_alloc_cyclic() doc
  - s390/zcrypt: don't leak memory if dev_set_name() fails
  - igb: Change IGB_MIN to allow set rx/tx value between 64 and 80
  - igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80
  - igc: Change IGC_MIN to allow set rx/tx value between 64 and 80
  - kcm: Destroy mutex in kcm_exit_net()
  - af_unix: Fix data race around sk->sk_err.
  - af_unix: Fix data-races around sk->sk_shutdown.
  - af_unix: Fix data-race around unix_tot_inflight.
  - af_unix: Fix data-races around user->unix_inflight.
  - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
  - veth: Fixing transmit return status for dropped packets
  - igb: disable virtualization features on 82580
  - drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt()
  - drm/i915/gvt: Save/restore HW status to support GVT suspend/resume
  - net: read sk->sk_family once in sk_mc_loop()
  - ipv4: annotate data-races around fi->fib_dead
  - sctp: annotate data-races around sk->sk_wmem_queued
  - net/sched: fq_pie: avoid stalls in fq_pie_timer()
  - pwm: lpc32xx: Remove handling of PWM channels
  - watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load
  - perf top: Don't pass an ERR_PTR() directly to perf_session__delete()
  - x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm()
  - perf annotate bpf: Don't enclose non-debug code with an assert()
  - backlight: gpio_backlight: Drop output GPIO direction check for initial power state
  - kconfig: fix possible buffer overflow
  - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
  - NFS: Fix a potential data corruption
  - soc: qcom: qmi_encdec: Restrict string length in decode
  - clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
  - clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz
  - dt-bindings: clock: xlnx,versal-clk: drop select:false
  - pinctrl: cherryview: fix address_space_handler() argument
  - parisc: led: Reduce CPU overhead for disk & lan LED computation
  - parisc: led: Fix LAN receive and transmit LEDs
  - lib/test_meminit: allocate pages up to order MAX_ORDER
  - drm/ast: Fix DRAM init on AST2200
  - fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
  - scsi: qla2xxx: Remove unsupported ql2xenabledif option
  - scsi: qla2xxx: Turn off noisy message log
  - scsi: qla2xxx: Fix erroneous link up failure
  - scsi: qla2xxx: fix inconsistent TMF timeout
  - scsi: qla2xxx: Fix deletion race condition
  - io_uring: break iopolling on signal
  - io_uring: break out of iowq iopoll on teardown
  - io_uring: always lock in io_apoll_task_func
  - net/ipv6: SKB symmetric hash should incorporate transport ports
  - udf: initialize newblock to 0
  - md/md-bitmap: remove unnecessary local variable in backlog_store()
  - usb: typec: tcpci: clear the fault status bit
  - usb: typec: bus: verify partner exists in typec_altmode_attention
  - cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug
  - crypto: stm32 - fix loop iterating through scatterlist for DMA
  - s390/ipl: add missing secure/has_secure file to ipl type 'unknown'
  - pstore/ram: Check start of empty przs during init
  - fsverity: skip PKCS#7 parser when keyring is empty
  - net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
  - X.509: if signature is unsupported skip validation
  - dccp: Fix out of bounds access in DCCP error handler
  - dlm: fix plock lookup when using multiple lockspaces
  - parisc: Fix /proc/cpuinfo output for lscpu
  - procfs: block chmod on /proc/thread-self/comm
  - Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset"
  - ntb: Fix calculation ntb_transport_tx_free_entry()
  - ntb: Clean up tx tail index on link down
  - ntb: Drop packets when qp link is down
  - Revert "scsi: qla2xxx: Fix buffer overrun"
  - media: dvb: symbol fixup for dvb_attach()
  - arm64: csum: Fix OoB access in IP checksum code for negative lengths
  - xtensa: PMU: fix base address for the newer hardware
  - backlight/lv5207lp: Compare against struct fb_info.device
  - backlight/bd6107: Compare against struct fb_info.device
  - backlight/gpio_backlight: Compare against struct fb_info.device
  - ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch()
  - scsi: core: Fix the scsi_set_resid() documentation
  - ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl
  - PM / devfreq: Fix leak in devfreq_dev_release()
  - skbuff: skb_segment, Call zero copy functions before using skbuff frags
  - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
  - virtio_ring: fix avail_wrap_counter in virtqueue_add_packed
  - cpufreq: Fix the race condition while updating the transition_task of policy
  - dmaengine: ste_dma40: Add missing IRQ check in d40_probe
  - um: Fix hostaudio build errors
  - mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume()
  - mtd: spi-nor: Check bus width while setting QE bit
  - rpmsg: glink: Add check for kstrdup
  - phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write
  - phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate
  - phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328
  - mtd: rawnand: brcmnand: Fix mtd oobsize
  - x86/speculation: Mark all Skylake CPUs as vulnerable to GDS
  - HID: multitouch: Correct devm device reference for hidinput input_dev name
  - HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()
  - RDMA/siw: Correct wrong debug message
  - RDMA/siw: Balance the reference of cep->kref in the error path
  - Revert "IB/isert: Fix incorrect release of isert connection"
  - amba: bus: fix refcount leak
  - serial: tegra: handle clk prepare error in tegra_uart_hw_init()
  - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock
  - cgroup:namespace: Remove unused cgroup_namespaces_init()
  - media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors
  - media: ov2680: Fix vflip / hflip set functions
  - media: ov2680: Fix ov2680_bayer_order()
  - media: ov2680: Remove auto-gain and auto-exposure controls
  - media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips
  - media: ov5640: Enable MIPI interface in ov5640_set_power_mipi()
  - USB: gadget: f_mass_storage: Fix unused variable warning
  - media: go7007: Remove redundant if statement
  - iommu/vt-d: Fix to flush cache of PASID directory table
  - iommu/qcom: Disable and reset context bank before programming
  - fsi: aspeed: Reset master errors after CFAM reset
  - IB/uverbs: Fix an potential error pointer dereference
  - driver core: test_async: fix an error code
  - dma-buf/sync_file: Fix docs syntax
  - coresight: tmc: Explicit type conversions to prevent integer overflow
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly
  - x86/APM: drop the duplicate APM_MINOR_DEV macro
  - serial: sprd: Fix DMA buffer leak issue
  - serial: sprd: Assign sprd_port after initialized to avoid wrong access
  - scsi: qla4xxx: Add length check when parsing nlattrs
  - scsi: be2iscsi: Add length check when parsing nlattrs
  - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
  - scsi: iscsi: Add length check for nlattr payload
  - scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param()
  - scsi: RDMA/srp: Fix residual handling
  - usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
  - media: mediatek: vcodec: Return NULL if no vdec_fb is found
  - media: rkvdec: increase max supported height for H.264
  - media: cx24120: Add retval check for cx24120_message_send()
  - media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
  - media: dib7000p: Fix potential division by zero
  - drivers: usb: smsusb: fix error handling code in smsusb_init_device
  - media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()
  - media: i2c: tvp5150: check return value of devm_kasprintf()
  - media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables
  - NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ
  - NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN
  - NFSD: da_addr_body field missing in some GETDEVICEINFO replies
  - fs: lockd: avoid possible wrong NULL parameter
  - jfs: validate max amount of blocks before allocation.
  - powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
  - nfs/blocklayout: Use the passed in gfp flags
  - powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT
  - powerpc: Don't include lppaca.h in paca.h
  - wifi: ath10k: Use RMW accessors for changing LNKCTL
  - net/mlx5: Use RMW accessors for changing LNKCTL
  - drm/radeon: Use RMW accessors for changing LNKCTL
  - drm/amdgpu: Use RMW accessors for changing LNKCTL
  - powerpc/perf: Convert fsl_emb notifier to state machine callbacks
  - powerpc/fadump: reset dump area size if fadump memory reserve fails
  - vfio/type1: fix cap_migration information leak
  - clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op
  - clk: imx8mp: fix sai4 clock
  - PCI/ASPM: Use RMW accessors for changing LNKCTL
  - PCI: pciehp: Use RMW accessors for changing LNKCTL
  - pinctrl: mcp23s08: check return value of devm_kasprintf()
  - PCI: Mark NVIDIA T4 GPUs to avoid bus reset
  - clk: qcom: reset: Use the correct type of sleep/delay based on length
  - clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src
  - clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents
  - ext4: correct grp validation in ext4_mb_good_group
  - clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src
  - clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents
  - clk: sunxi-ng: Modify mismatched function name
  - drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
  - ipmi:ssif: Fix a memory leak when scanning for an adapter
  - ipmi:ssif: Add check for kstrdup
  - ALSA: ac97: Fix possible error value of *rac97
  - of: unittest: Fix overlay type in apply/revert check
  - bus: ti-sysc: Fix cast to enum warning
  - drm/mediatek: Fix potential memory leak if vmap() fail
  - bus: ti-sysc: Fix build warning for 64-bit build
  - drm/msm/a2xx: Call adreno_gpu_init() earlier
  - drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create()
  - smackfs: Prevent underflow in smk_set_cipso()
  - firmware: meson_sm: fix to avoid potential NULL pointer dereference
  - drm/msm/mdp5: Don't leak some plane state
  - drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask
  - ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig
  - drm/panel: simple: Add missing connector type and pixel format for AUO T215HVN01
  - drm/armada: Fix off-by-one error in armada_overlay_get_property()
  - of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()
  - drm/tegra: dpaux: Fix incorrect return value of platform_get_irq
  - drm/tegra: Remove superfluous error messages around platform_get_irq()
  - md/md-bitmap: hold 'reconfig_mutex' in backlog_store()
  - md/bitmap: don't set max_write_behind if there is no write mostly device
  - drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl'
  - arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk"
  - arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC
  - ARM: dts: BCM53573: Fix Ethernet info for Luxul devices
  - drm: adv7511: Fix low refresh rate register for ADV7533/5
  - ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)
  - ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210
  - ARM: dts: s5pv210: adjust node names to DT spec
  - ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)
  - ARM: dts: s3c64xx: align pinctrl with dtschema
  - x86/mm: Fix PAT bit missing from page protection modify mask
  - drm/etnaviv: fix dumping of active MMU context
  - ARM: dts: BCM53573: Use updated "spi-gpio" binding properties
  - ARM: dts: BCM53573: Add cells sizes to PCIe node
  - ARM: dts: BCM53573: Drop nonexistent #usb-cells
  - ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
  - ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name
  - drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar()
  - arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller
  - soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros
  - soc: qcom: ocmem: Add OCMEM hardware version print
  - ASoC: stac9766: fix build errors with REGMAP_AC97
  - drm/bridge: tc358764: Fix debug print parameter order
  - netrom: Deny concurrent connect().
  - hwmon: (tmp513) Fix the channel number in tmp51x_is_visible()
  - mlxsw: i2c: Limit single transaction buffer size
  - mlxsw: i2c: Fix chunk size setting in output mailbox buffer
  - net: arcnet: Do not call kfree_skb() under local_irq_disable()
  - wifi: ath9k: use IS_ERR() with debugfs_create_dir()
  - Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave()
  - wifi: mwifiex: avoid possible NULL skb pointer dereference
  - wifi: ath9k: protect WMI command response buffer replacement with a lock
  - wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx
  - samples/bpf: fix broken map lookup probe
  - wifi: mwifiex: Fix missed return in oob checks failed path
  - wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
  - fs: ocfs2: namei: check return value of ocfs2_add_entry()
  - lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
  - lwt: Fix return values of BPF xmit ops
  - hwrng: iproc-rng200 - Implement suspend and resume calls
  - crypto: caam - fix unchecked return value error
  - ice: ice_aq_check_events: fix off-by-one check when filling buffer
  - selftests/bpf: Clean up fmod_ret in bench_rename test script
  - net: tcp: fix unexcepted socket die when snd_wnd is 0
  - Bluetooth: Fix potential use-after-free when clear keys
  - Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
  - crypto: stm32 - Properly handle pm_runtime_get failing
  - selftests/bpf: fix static assert compilation issue for test_cls_*.c
  - wifi: mwifiex: fix error recovery in PCIE buffer descriptor management
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets
  - can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM
  - spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe()
  - wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH
  - bpf: reject unhashed sockets in bpf_sk_assign
  - udp: re-score reuseport groups when connected sockets are present
  - regmap: rbtree: Use alloc_flags for memory allocations
  - hwrng: nomadik - keep clock enabled while hwrng is registered
  - tcp: tcp_enter_quickack_mode() should be static
  - bpf: Clear the probe_addr for uprobe
  - bpftool: Use a local bpf_perf_event_value to fix accessing its fields
  - cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit()
  - x86/efistub: Fix PCI ROM preservation in mixed mode
  - s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs
  - s390/pkey: fix/harmonize internal keyblob headers
  - perf/imx_ddr: don't enable counter0 if none of 4 counters are used
  - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved
  - selftests/resctrl: Close perf value read fd on errors
  - selftests/resctrl: Unmount resctrl FS if child fails to run benchmark
  - selftests/resctrl: Don't leak buffer in fill_cache()
  - OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd()
  - refscale: Fix uninitalized use of wait_queue_head_t
  - selftests/harness: Actually report SKIP for signal tests
  - tmpfs: verify {g,u}id mount options correctly
  - eventfd: prevent underflow for eventfd semaphores
  - eventfd: Export eventfd_ctx_do_read()
  - reiserfs: Check the return value from __getblk()
  - Revert "net: macsec: preserve ingress frame ordering"
  - udf: Handle error when adding extent to a file
  - udf: Check consistency of Space Bitmap Descriptor
  - net: Avoid address overwrite in kernel_connect
  - platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications
  - ALSA: seq: oss: Fix racy open/close of MIDI devices
  - scsi: storvsc: Always set no_report_opcodes
  - sctp: handle invalid error codes without calling BUG()
  - bnx2x: fix page fault following EEH recovery
  - netlabel: fix shift wrapping bug in netlbl_catmap_setlong()
  - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
  - idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM
  - net: usb: qmi_wwan: add Quectel EM05GV2
  - vmbus_testing: fix wrong python syntax for integer value comparison
  - clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM
  - kprobes: Prohibit probing on CFI preamble symbol
  - security: keys: perform capable check only on privileged operations
  - ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer()
  - ovl: Always reevaluate the file signature for IMA
  - platform/x86: huawei-wmi: Silence ambient light sensor
  - platform/x86: intel: hid: Always call BTNL ACPI method
  - ASoC: atmel: Fix the 8K sample parameter in I2SC master
  - ASoc: codecs: ES8316: Fix DMIC config
  - fs/nls: make load_nls() take a const parameter
  - s390/dasd: fix hanging device after request requeue
  - s390/dasd: use correct number of retries for ERP requests
  - m68k: Fix invalid .section syntax
  - vxlan: generalize vxlan_parse_gpe_hdr and remove unused args
  - ethernet: atheros: fix return value check in atl1c_tso_csum()
  - ASoC: da7219: Check for failure reading AAD IRQ events
  - ASoC: da7219: Flush pending AAD IRQ when suspending
  - 9p: virtio: make sure 'offs' is initialized in zc_request
  - media: pci: cx23885: fix error handling for cx23885 ATSC boards
  - media: pulse8-cec: handle possible ping error
  - phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code
  - ARM: dts: imx: Set default tuning step for imx7d usdhc
  - ARM: dts: imx: Adjust dma-apbh node name
  - ARM: dts: imx7s: Drop dma-apb interrupt-names
  - ARM: dts: imx: update sdma node name format
  - ASoC: rt5682: Fix a problem with error handling in the io init function of the soundwire
  - pinctrl: amd: Don't show `Invalid config param` errors
  - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
  - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
  - fsi: master-ast-cf: Add MODULE_FIRMWARE macro
  - firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
  - serial: sc16is7xx: fix bug when first setting GPIO direction
  - serial: sc16is7xx: fix broken port 0 uart init
  - serial: qcom-geni: fix opp vote on shutdown
  - staging: rtl8712: fix race condition
  - HID: wacom: remove the battery when the EKR is off
  - usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0
  - usb: dwc3: meson-g12a: do post init to fix broken usb after resumption
  - USB: serial: option: add FOXCONN T99W368/T99W373 product
  - USB: serial: option: add Quectel EM05G variant (0x030e)
  - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
  - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
  - net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index
  - mmc: au1xmmc: force non-modular build and remove symbol_get usage
  - ARM: pxa: remove use of symbol_get()
  - erofs: ensure that the post-EOF tails are all zeroed
  - btrfs: fix double free of anonymous device after snapshot creation failure
  - btrfs: do not ASSERT() if the newly created subvolume already got read
  - intel_idle: add Sierra Forest SoC support
  - config: update Intel RAPL on TPMI to openeuler_defconfig for x86
  - powercap: intel_rapl: Downgrade BIOS locked limits pr_warn() to pr_debug()
  - powercap: intel_rapl: Fix invalid setting of Power Limit 4
  - powercap: RAPL: Fix a NULL vs IS_ERR() bug
  - powercap: intel_rapl: Introduce RAPL TPMI interface driver
  - powercap: intel_rapl: Introduce core support for TPMI interface
  - powercap: intel_rapl: Introduce RAPL I/F type
  - powercap: intel_rapl: Make cpu optional for rapl_package
  - powercap: intel_rapl: Use topology interface in rapl_init_domains()
  - powercap: intel_rapl: Remove redundant cpu parameter
  - powercap: intel_rapl: Add support for lock bit per Power Limit
  - powercap: intel_rapl: Cleanup Power Limits support
  - powercap: intel_rapl: Use bitmap for Power Limits
  - thermal: int340x: processor_thermal: Refactor MMIO interface
  - powercap: intel_rapl: Change primitive order
  - powercap: intel_rapl: Use index to initialize primitive information
  - powercap: intel_rapl: Support per domain energy/power/time unit
  - powercap: intel_rapl: remove redundant store to value after multiply
  - powercap: intel_rapl: Support per Interface primitive information
  - powercap: intel_rapl: Support per Interface rapl_defaults
  - powercap: intel_rapl: Replace deprecated CPU-hotplug functions
  - powercap: intel_rapl: Use topology interface in rapl_add_package()
  - powercap: intel_rapl: Allow probing without CPUID match
  - powercap: intel_rapl: Remove unused field in struct rapl_if_priv
  - KVM: mmu: increase the mmu_notifier_count for legacy APIs
  - pmem: compile pmem legacy device while libnvdimm as a module


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-192.0.0.105
changelog:
  - !5342  CVE-2023-52447
  - !5364 v2  CVE-2023-52452
  - !5313  bus: mhi: host: Add alignment check for event ring read pointer
  - !5355  CVE-2023-52593
  - bpf: Fix accesses to uninit stack slots
  - bpf: Fix verification of indirect var-off stack access
  - bpf: Allow reads from uninit stack
  - bpf: expose bpf_strtol and bpf_strtoul to all program types
  - bpf, verifier: Fix memory leak in array reallocation for stack state
  - bpf: verifier: Use copy_array for jmp_history
  - bpf: verifier: Improve function state reallocation
  - wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()
  - bpf: Fix kabi breakage in struct bpf_map and struct bpf_map_ops
  - bpf: Defer the free of inner map when necessary
  - bpf: Set need_defer as false when clearing fd array during map free
  - bpf: Add map and need_defer parameters to .map_fd_put_ptr()
  - !4632 [OLK-5.10] drivers: update yunsilicon drivers to version 1.1.0.375
  - !5307  drm/msm/dpu: Add mutex lock in control vblank irq
  - bus: mhi: host: Add alignment check for event ring read pointer
  - drm/msm/dpu: Add mutex lock in control vblank irq
  - !5242  Revert two stable patches to keep binary compatible
  - !5188 Backport 5.10.198 LTS patches from upstream
  - !5229  iommu/arm-smmu-v3: Disable ECMDQ before reset
  - !5240  powerpc/lib: Validate size for vector operations
  - !5231  af_unix: fix lockdep positive in sk_diag_dump_icons()
  - !5222  powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  - !5245  ceph: fix deadlock or deadcode of misusing dget()
  - mmc: renesas_sdhi: only reset SCC when its pointer is populated
  - netfilter: nftables: exthdr: fix 4-byte stack OOB write
  - netfilter: nf_tables: fix kdoc warnings after gc rework
  - parisc: Restore __ldcw_align for PA-RISC 2.0 processors
  - RDMA/mlx5: Fix NULL string error
  - RDMA/siw: Fix connection failure handling
  - RDMA/uverbs: Fix typo of sizeof argument
  - RDMA/cma: Fix truncation compilation warning in make_cma_ports
  - RDMA/cma: Initialize ib_sa_multicast structure to 0 when join
  - gpio: pxa: disable pinctrl calls for MMP_GPIO
  - gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config()
  - IB/mlx4: Fix the size of a buffer in add_port_entries()
  - of: dynamic: Fix potential memory leak in of_changeset_action()
  - RDMA/core: Require admin capabilities to set system parameters
  - dm zoned: free dmz->ddev array in dmz_put_zoned_devices
  - cpupower: add Makefile dependencies for install targets
  - sctp: update hb timer immediately after users change hb_interval
  - sctp: update transport state when processing a dupcook packet
  - tcp: fix delayed ACKs for MSS boundary condition
  - tcp: fix quick-ack counting to count actual ACKs of new data
  - net: stmmac: dwmac-stm32: fix resume on STM32 MCU
  - net: ethernet: ti: am65-cpsw: Fix error code in am65_cpsw_nuss_init_tx_chns()
  - net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent
  - modpost: add missing else to the "of" check
  - NFSv4: Fix a nfs4_state_manager() race
  - scsi: target: core: Fix deadlock due to recursive locking
  - ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig
  - regmap: rbtree: Fix wrong register marked as in-cache when creating new node
  - wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling
  - drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close()
  - bpf: Fix tr dereferencing
  - wifi: iwlwifi: dbg_ini: fix structure packing
  - arm64: Add Cortex-A520 CPU part definition
  - net: prevent rewrite of msg_name in sock_sendmsg()
  - net: replace calls to sock->ops->connect() with kernel_connect()
  - wifi: mwifiex: Fix tlv_buf_left calculation
  - qed/red_ll2: Fix undefined behavior bug in struct qed_ll2_info
  - scsi: zfcp: Fix a double put in zfcp_port_enqueue()
  - Revert "PCI: qcom: Disable write access to read only registers for IP v2.3.3"
  - Revert "clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz"
  - rbd: take header_rwsem in rbd_dev_refresh() only when updating
  - rbd: decouple parent info read-in from updating rbd_dev
  - rbd: decouple header read-in from updating rbd_dev->header
  - rbd: move rbd_dev_refresh() definition
  - ring-buffer: Fix bytes info in per_cpu buffer stats
  - ring-buffer: remove obsolete comment for free_buffer_page()
  - NFSv4: Fix a state manager thread deadlock regression
  - NFS: rename nfs_client_kset to nfs_kset
  - NFS: Cleanup unused rpc_clnt variable
  - spi: zynqmp-gqspi: fix clock imbalance on probe failure
  - spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe
  - fs: binfmt_elf_efpic: fix personality for ELF-FDPIC
  - ata: libata-sata: increase PMP SRST timeout to 10s
  - ata: libata-core: Do not register PM operations for SAS ports
  - ata: libata-core: Fix port and device removal
  - ata: libata-core: Fix ata_port_request_pm() locking
  - net: thunderbolt: Fix TCPv6 GSO checksum calculation
  - bpf: Fix BTF_ID symbol generation collision in tools/
  - bpf: Fix BTF_ID symbol generation collision
  - btrfs: properly report 0 avail for very full file systems
  - ring-buffer: Update "shortest_full" in polling
  - proc: nommu: /proc/<pid>/maps: release mmap read lock
  - Revert "SUNRPC dont update timeout value on connection reset"
  - i2c: i801: unregister tco_pdev in i801_probe() error path
  - ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES
  - ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q
  - serial: 8250_port: Check IRQ data before use
  - Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
  - Smack:- Use overlay inode label in smack_inode_copy_up()
  - smack: Retrieve transmuting information in smack_inode_getsecurity()
  - smack: Record transmuting in smk_transmuted
  - nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev
  - netfilter: nft_exthdr: Fix for unsafe packet data read
  - netfilter: nft_exthdr: Search chunks in SCTP packets only
  - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running
  - watchdog: iTCO_wdt: No need to stop the timer in probe
  - nvme-pci: do not set the NUMA node of device if it has none
  - nvme-pci: factor out a nvme_pci_alloc_dev helper
  - nvme-pci: factor the iod mempool creation into a helper
  - ACPI: Check StorageD3Enable _DSD property in ACPI code
  - cgroup: Fix suspicious rcu_dereference_check() usage warning
  - perf build: Define YYNOMEM as YYNOABORT for bison < 3.81
  - fbdev/sh7760fb: Depend on FB=y
  - ncsi: Propagate carrier gain/loss events to the NCSI controller
  - powerpc/watchpoints: Disable preemption in thread_change_pc()
  - media: vb2: frame_vector.c: replace WARN_ONCE with a comment
  - bpf: Clarify error expectations from bpf_clone_redirect
  - spi: nxp-fspi: reset the FLSHxCR1 registers
  - scsi: pm80xx: Use phy-specific SAS address when sending PHY_START command
  - platform/mellanox: mlxbf-bootctl: add NET dependency into Kconfig
  - selftests: fix dependency checker script
  - ring-buffer: Avoid softlockup in ring_buffer_resize()
  - selftests/ftrace: Correctly enable event in instance-event.tc
  - scsi: qedf: Add synchronization between I/O completions and abort
  - parisc: irq: Make irq_stack_union static to avoid sparse warning
  - parisc: drivers: Fix sparse warning
  - parisc: iosapic.c: Fix sparse warnings
  - parisc: sba: Fix compile warning wrt list of SBA devices
  - dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
  - i2c: npcm7xx: Fix callback completion ordering
  - gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip
  - xtensa: boot/lib: fix function prototypes
  - xtensa: boot: don't add include-dirs
  - xtensa: iss/network: make functions static
  - xtensa: add default definition for XCHAL_HAVE_DIV32
  - power: supply: ucs1002: fix error code in ucs1002_get_property()
  - bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart wake-up
  - ARM: dts: ti: omap: motorola-mapphone: Fix abe_clkctrl warning on boot
  - ARM: dts: Unify pwm-omap-dmtimer node names
  - ARM: dts: am335x: Guardian: Update beeper label
  - ARM: dts: motorola-mapphone: Drop second ti,wlcore compatible value
  - ARM: dts: motorola-mapphone: Add 1.2GHz OPP
  - ARM: dts: motorola-mapphone: Configure lower temperature passive cooling
  - ARM: dts: ti: omap: Fix bandgap thermal cells addressing for omap3/4
  - ARM: dts: omap: correct indentation
  - clk: tegra: fix error return case for recalc_rate
  - bus: ti-sysc: Fix missing AM35xx SoC matching
  - bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset()
  - MIPS: Alchemy: only build mmc support helpers if au1xmmc is enabled
  - btrfs: reset destination buffer when read_extent_buffer() gets invalid range
  - ata: ahci: Add Elkhart Lake AHCI controller
  - ata: ahci: Rename board_ahci_mobile
  - ata: ahci: Add support for AMD A85 FCH (Hudson D4)
  - ata: libata: Rename link flag ATA_LFLAG_NO_DB_DELAY
  - netfilter: nft_exthdr: Fix non-linear header modification
  - netfilter: exthdr: add support for tcp option removal
  - netfilter: nft_exthdr: break evaluation if setting TCP option fails
  - netfilter: nf_tables: add and use nft_thoff helper
  - netfilter: nf_tables: add and use nft_sk helper
  - netfilter: nft_exthdr: Support SCTP chunks
  - netfilter: use actual socket sk for REJECT action
  - media: venus: hfi_venus: Write to VIDC_CTRL_INIT after unmasking interrupts
  - media: venus: hfi: Add a 6xx boot logic
  - media: venus: core: Add differentiator IS_V6(core)
  - media: venus: hfi: Define additional 6xx registers
  - media: venus: hfi,pm,firmware: Convert to block relative addressing
  - media: venus: core: Add io base variables for each block
  - mmc: renesas_sdhi: register irqs before registering controller
  - mmc: tmio: support custom irq masks
  - mmc: renesas_sdhi: populate SCC pointer at the proper place
  - mmc: renesas_sdhi: probe into TMIO after SCC parameters have been setup
  - Input: i8042 - add quirk for TUXEDO Gemini 17 Gen1/Clevo PD70PN
  - Input: i8042 - rename i8042-x86ia64io.h to i8042-acpipnpio.h
  - netfilter: nf_tables: double hook unregistration in netns path
  - netfilter: nf_tables: unregister flowtable hooks on netns exit
  - i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()
  - gpio: tb10x: Fix an error handling path in tb10x_gpio_probe()
  - bnxt_en: Flush XDP for bnxt_poll_nitroa0()'s NAPI
  - locking/seqlock: Do the lockdep annotation before locking in do_write_seqcount_begin_nested()
  - seqlock: Prefix internal seqcount_t-only macros with a "do_"
  - seqlock: Rename __seqprop() users
  - netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
  - x86/srso: Fix SBPB enablement for spec_rstack_overflow=off
  - x86/srso: Fix srso_show_state() side effect
  - platform/x86: intel_scu_ipc: Fail IPC send if still busy
  - platform/x86: intel_scu_ipc: Don't override scu in intel_scu_ipc_dev_simple_command()
  - platform/x86: intel_scu_ipc: Check status upon timeout in ipc_wait_for_interrupt()
  - platform/x86: intel_scu_ipc: Check status after timeout in busy_loop()
  - powerpc/perf/hv-24x7: Update domain value check
  - i40e: Fix VF VLAN offloading when port VLAN is configured
  - ASoC: imx-audmix: Fix return error with devm_clk_get()
  - selftests: tls: swap the TX and RX sockets in some tests
  - bpf: Avoid deadlock when using queue and stack maps from NMI
  - netfilter: nf_tables: disallow element removal on anonymous sets
  - ASoC: meson: spdifin: start hw on dai probe
  - netfilter: nf_tables: fix memleak when more than 255 elements expired
  - netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
  - netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails
  - netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
  - netfilter: nf_tables: defer gc run if previous batch is still pending
  - netfilter: nf_tables: use correct lock to protect gc_list
  - netfilter: nf_tables: GC transaction race with abort path
  - netfilter: nf_tables: GC transaction race with netns dismantle
  - netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
  - netfilter: nf_tables: don't fail inserts if duplicate has expired
  - netfilter: nf_tables: remove busy mark and gc batch API
  - netfilter: nft_set_hash: mark set element as dead when deleting from packet path
  - netfilter: nf_tables: adapt set backend to use GC transaction API
  - netfilter: nf_tables: GC transaction API to avoid race with control plane
  - netfilter: nf_tables: don't skip expired elements during walk
  - netfilter: nf_tables: integrate pipapo into commit protocol
  - ext4: do not let fstrim block system suspend
  - ext4: move setting of trimmed bit into ext4_try_to_trim_range()
  - ext4: replace the traditional ternary conditional operator with with max()/min()
  - ext4: mark group as trimmed only if it was fully scanned
  - ext4: change s_last_trim_minblks type to unsigned long
  - ext4: scope ret locally in ext4_try_to_trim_range()
  - ext4: add new helper interface ext4_try_to_trim_range()
  - ext4: remove the 'group' parameter of ext4_trim_extent
  - SUNRPC: Mark the cred for revalidation if the server rejects it
  - NFS/pNFS: Report EINVAL errors from connect() to the server
  - NFS: Use the correct commit info in nfs_join_page_group()
  - ceph: fix deadlock or deadcode of misusing dget()
  - Revert "modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules"
  - Revert "media: dvb: symbol fixup for dvb_attach()"
  - powerpc/lib: Validate size for vector operations
  - af_unix: fix lockdep positive in sk_diag_dump_icons()
  - iommu/arm-smmu-v3: Disable ECMDQ before reset
  - !3297 [OLK-5.10] Add drivers support for Mucse Network Adapter(N10/N400)
  - !3308 [OLK-5.10] initial support for KPU FLEXFLOW-2100P driver from Yusur Technology
  - !5195  dmaengine: fix NULL pointer in channel unregistration function
  - !5171  net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  - !5197  drm: Don't unref the same fb many times by mistake due to deadlock handling
  - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  - drm: Don't unref the same fb many times by mistake due to deadlock handling
  - !5178  net: nfc: llcp: Add lock when modifying device list
  - dmaengine: fix NULL pointer in channel unregistration function
  - !5164  nfc: nci: assert requested protocol is valid
  - drivers: initial support for KPU FLEXFLOW-2100P driver from Yusur Technology
  - !5156  RDMA/srp: Do not call scsi_done() from srp_abort()
  - !5038 [OLK-5.10] Do not serialize MSR accesses on AMD
  - net: nfc: llcp: Add lock when modifying device list
  - net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  - nfc: nci: assert requested protocol is valid
  - RDMA/srp: Do not call scsi_done() from srp_abort()
  - x86/barrier: Do not serialize MSR accesses on AMD
  - drivers: update yunsilicon drivers to version 1.1.0.375
  - drivers: support for rnpm drivers from Mucse Technology N10/N400


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-193.0.0.106
changelog:
  - !5521  md/raid5: fix atomicity violation in raid5_cache_count
  - !5494  mm/sparsemem: fix race in accessing memory_section->usage
  - !5516  netfilter: nf_tables: disallow timeout for anonymous sets
  - !5441  net/sched: act_ct: fix skb leak and crash on ooo frags
  - !5519  scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan()
  - !5445  KVM: x86/mmu: Don't advance iterator after restart due to yielding
  - !5510  bus: mhi: host: Drop chan lock before queuing buffers
  - !5466  wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - !5491  CVE-2024-26640
  - md/raid5: fix atomicity violation in raid5_cache_count
  - scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan()
  - netfilter: nf_tables: disallow timeout for anonymous sets
  - !5495  llc: Drop support for ETH_P_TR_802_2.
  - !5496  llc: make llc_ui_sendmsg() more robust against bonding changes
  - !5266  llc: call sock_orphan() at release time
  - bus: mhi: host: Drop chan lock before queuing buffers
  - !5500  pstore/ram: Fix crash when setting number of cpus to an odd number
  - !5460 v2  crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
  - pstore/ram: Fix crash when setting number of cpus to an odd number
  - !5368  media: pvrusb2: fix use after free on context disconnection
  - llc: make llc_ui_sendmsg() more robust against bonding changes
  - llc: Drop support for ETH_P_TR_802_2.
  - mm/sparsemem: fix race in accessing memory_section->usage
  - tcp: add sanity checks to rx zerocopy
  - net-zerocopy: Refactor frag-is-remappable test.
  - !5269  printk: avoid deadlock in panic
  - !5316 v2  iomap: add support to track dirty state of sub pages
  - !5075  x86/reboot: VMCLEAR active VMCSes before emergency reboot
  - !5385 v3  enable arm64_pbha by default
  - !5093  wifi: mac80211: fix potential key use-after-free
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - !5327  UBSAN: array-index-out-of-bounds in dtSplitRoot
  - !5322  jfs: fix slab-out-of-bounds Read in dtSearch
  - crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
  - !5308  FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - KVM: x86/mmu: Don't advance iterator after restart due to yielding
  - net/sched: act_ct: fix skb leak and crash on ooo frags
  - !5286  serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
  - !5232  jfs: fix cve issue
  - !5348  s390/ptrace: handle setting of fpc register correctly
  - !5317  KVM: s390: fix setting of fpc register
  - !5259  CVE-2024-26627​
  - config: Enable ARM64_PBHA by default
  - arm64: mm: pagemap: Export pbha bit0 info
  - arm64: mm: Hide pbha_bit0 in procfs if pbha is not enabled
  - arm64: mm: Do not show info during startup if pbha is not enabled
  - mm: cpufeature: Make update_pbha_perf_only_bit static
  - arm64: mm: Cleanup in pbha_bit0_pte_range
  - proc: introduce proc_hide_ents to hide proc files
  - !5339  binder: fix race between mmput() and do_exit()
  - !5253  tomoyo: fix UAF write bug in tomoyo_write_control()
  - media: pvrusb2: fix use after free on context disconnection
  - s390/ptrace: handle setting of fpc register correctly
  - binder: fix race between mmput() and do_exit()
  - UBSAN: array-index-out-of-bounds in dtSplitRoot
  - jfs: fix slab-out-of-bounds Read in dtSearch
  - KVM: s390: fix setting of fpc register
  - iomap: add support to track dirty state of sub pages
  - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
  - printk: avoid deadlock in panic
  - llc: call sock_orphan() at release time
  - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
  - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
  - tomoyo: fix UAF write bug in tomoyo_write_control()
  - jfs: fix array-index-out-of-bounds in diNewExt
  - jfs: fix uaf in jfs_evict_inode
  - wifi: mac80211: fix potential key use-after-free
  - x86/reboot: VMCLEAR active VMCSes before emergency reboot


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-194.0.0.107
changelog:
  - !5684 Backport 5.10.200 LTS patches from upstream
  - ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
  - tty: 8250: Add support for Intashield IS-100
  - tty: 8250: Add support for Brainboxes UP cards
  - tty: 8250: Add support for additional Brainboxes UC cards
  - tty: 8250: Remove UC-257 and UC-431
  - usb: raw-gadget: properly handle interrupted requests
  - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
  - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
  - can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior
  - can: isotp: isotp_bind(): do not validate unused address information
  - can: isotp: add local echo tx processing and tx without FC
  - can: isotp: handle wait_event_interruptible() return values
  - can: isotp: check CAN address family in isotp_bind()
  - can: isotp: isotp_bind(): return -EINVAL on incorrect CAN ID formatting
  - can: isotp: set max PDU size to 64 kByte
  - can: isotp: Add error message if txqueuelen is too small
  - can: isotp: add symbolic error message to isotp_module_init()
  - can: isotp: change error format from decimal to symbolic error names
  - powerpc/mm: Fix boot crash with FLATMEM
  - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
  - platform/mellanox: mlxbf-tmfifo: Fix a warning message
  - scsi: mpt3sas: Fix in error path
  - fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
  - ASoC: rt5650: fix the wrong result of key button
  - netfilter: nfnetlink_log: silence bogus compiler warning
  - spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
  - fbdev: atyfb: only use ioremap_uc() on i386 and ia64
  - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
  - dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
  - irqchip/stm32-exti: add missing DT IRQ flag translation
  - net: sched: cls_u32: Fix allocation size in u32_init()
  - x86: Fix .brk attribute in linker script
  - objtool/x86: add missing embedded_insn check
  - x86/mm: Fix RESERVE_BRK() for older binutils
  - x86/mm: Simplify RESERVE_BRK()
  - smbdirect: missing rc checks while waiting for rdma events
  - x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility
  - iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds
  - iio: adc: xilinx: use more devres helpers and remove remove()
  - iio: adc: xilinx: use devm_krealloc() instead of kfree() + kcalloc()
  - iio: adc: xilinx: use helper variable for &pdev->dev
  - clk: Sanitize possible_parent_show to Handle Return Value of of_clk_get_parent_name
  - sparc32: fix a braino in fault handling in csum_and_copy_..._user()
  - nvmem: imx: correct nregs for i.MX6UL
  - nvmem: imx: correct nregs for i.MX6SLL
  - nvmem: imx: correct nregs for i.MX6ULL
  - misc: fastrpc: Clean buffers on remote invocation failures
  - tracing/kprobes: Fix the description of variable length arguments
  - i2c: aspeed: Fix i2c bus hang in slave read
  - i2c: stm32f7: Fix PEC handling in case of SMBUS transfers
  - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
  - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()
  - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
  - iio: exynos-adc: request second interupt only when touchscreen mode is used
  - kasan: print the original fault addr when access invalid shadow
  - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR
  - gtp: fix fragmentation needed check with gso
  - gtp: uapi: fix GTPA_MAX
  - tcp: fix wrong RTO timeout when received SACK reneging
  - r8152: Release firmware if we have an error in probe
  - r8152: Cancel hw_phy_work if we have an error in probe
  - r8152: Run the unload routine if we have errors during probe
  - r8152: Increase USB control msg timeout to 5000ms as per spec
  - net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg
  - net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show()
  - igc: Fix ambiguity in the ethtool advertising
  - neighbour: fix various data-races
  - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry
  - treewide: Spelling fix in comment
  - r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1
  - r8169: fix the KCSAN reported data-race in rtl_tx while reading TxDescArray[entry].opts1
  - mmc: renesas_sdhi: use custom mask for TMIO_MASK_ALL
  - mm/page_alloc: correct start page when guard page debug is enabled
  - virtio-mmio: fix memory leak of vm_dev
  - virtio_balloon: Fix endless deflation and inflation on arm64
  - mcb-lpc: Reallocate memory region to avoid memory overlapping
  - mcb: Return actual parsed size when reading chameleon table
  - selftests/ftrace: Add new test case which checks non unique symbol
  - !5580  CVE-2023-52622
  - !5617 v4  Fix I/O high when memory almost met memcg limit
  - !5518  dm: revert partial fix for redundant bio-based IO accounting
  - !5493  arm64/mpam: Fix repeated enabling in mpam_enable()
  - !5566  tracing: Ensure visibility when inserting an element into tracing_map
  - !5606  mm/mlock: return EINVAL for illegal user memory range in mlock
  - mm/readahead: don't decrease mmap_miss when folio has workingset flags
  - mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM
  - !5499 Backport 5.10.199 LTS patches from upstream
  - mm/mlock: return EINVAL for illegal user memory range in mlock
  - ext4: avoid online resizing failures due to oversized flex bg
  - ext4: unify the type of flexbg_size to unsigned int
  - ext4: remove unnecessary check from alloc_flex_gd()
  - !5473  jfs: fix array-index-out-of-bounds in dbAdjTree
  - !5553  mm: ksm: fix use-after-free kasan report in ksm_might_need_to_copy
  - tracing: Ensure visibility when inserting an element into tracing_map
  - !5431  block/rnbd-srv: Check for unlikely string overflow
  - !5537  netfilter: nf_tables: disallow anonymous set with timeout flag
  - !5527  netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
  - mm: ksm: fix use-after-free kasan report in ksm_might_need_to_copy
  - netfilter: nf_tables: disallow anonymous set with timeout flag
  - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
  - dm: revert partial fix for redundant bio-based IO accounting
  - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
  - Bluetooth: hci_sock: fix slab oob read in create_monitor_event
  - phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins
  - phy: mapphone-mdm6600: Fix runtime PM for remove
  - phy: mapphone-mdm6600: Fix runtime disable on probe
  - ASoC: pxa: fix a memory leak in probe()
  - gpio: vf610: set value before the direction to avoid a glitch
  - platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events
  - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e
  - s390/pci: fix iommu bitmap allocation
  - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
  - USB: serial: option: add entry for Sierra EM9191 with new firmware
  - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
  - nvme-rdma: do not try to stop unallocated queues
  - nvme-pci: add BOGUS_NID for Intel 0a54 device
  - ACPI: irq: Fix incorrect return value in acpi_register_gsi()
  - pNFS: Fix a hang in nfs4_evict_inode()
  - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
  - mmc: core: Capture correct oemid-bits for eMMC cards
  - mmc: core: sdio: hold retuning if sdio in 1-bit mode
  - mtd: physmap-core: Restore map_rom fallback
  - mtd: spinand: micron: correct bitmask for ecc status
  - mtd: rawnand: arasan: Ensure program page operations are successful
  - mtd: rawnand: marvell: Ensure program page operations are successful
  - mtd: rawnand: qcom: Unmap the right resource upon probe failure
  - Bluetooth: hci_event: Fix using memcmp when comparing keys
  - net/mlx5: Handle fw tracer change ownership event based on MTRC
  - platform/x86: touchscreen_dmi: Add info for the Positivo C4128B
  - HID: multitouch: Add required quirk for Synaptics 0xcd7e device
  - btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
  - drm: panel-orientation-quirks: Add quirk for One Mix 2S
  - sky2: Make sure there is at least one frag_addr available
  - regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()"
  - wifi: cfg80211: avoid leaking stack data into trace
  - wifi: mac80211: allow transmitting EAPOL frames with tainted key
  - wifi: cfg80211: Fix 6GHz scan configuration
  - Bluetooth: hci_core: Fix build warnings
  - Bluetooth: Avoid redundant authentication
  - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
  - tracing: relax trace_event_eval_update() execution with cond_resched()
  - ata: libata-eh: Fix compilation warning in ata_eh_link_report()
  - gpio: timberdale: Fix potential deadlock on &tgpio->lock
  - overlayfs: set ctime when setting mtime and atime
  - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
  - btrfs: initialize start_slot in btrfs_log_prealloc_extents
  - btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1
  - ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone
  - serial: 8250_omap: Fix errors with no_console_suspend
  - serial: 8250: omap: Fix imprecise external abort for omap_8250_pm()
  - xhci: track port suspend state correctly in unsuccessful resume cases
  - xhci: decouple usb2 port resume and get_port_status request handling
  - xhci: clear usb2 resume related variables in one place.
  - xhci: rename resume_done to resume_timestamp
  - xhci: move port specific items such as state completions to port structure
  - xhci: cleanup xhci_hub_control port references
  - usb: core: Track SuperSpeed Plus GenXxY
  - selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error
  - selftests/vm: make charge_reserved_hugetlb.sh work with existing cgroup setting
  - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA
  - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA
  - ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
  - ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
  - ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA
  - ACPI: resource: Add ASUS model S5402ZA to quirks
  - ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA
  - ACPI: resources: Add DMI-based legacy IRQ override quirk
  - thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge
  - net: pktgen: Fix interface flags printing
  - netfilter: nft_set_rbtree: .deactivate fails if element has expired
  - neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section
  - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
  - net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register()
  - i40e: prevent crash on probe if hw registers have invalid values
  - net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
  - ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr
  - tun: prevent negative ifindex
  - tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb
  - tcp: fix excessive TLP and RACK timeouts from HZ rounding
  - net: rfkill: gpio: prevent value glitch during probe
  - net: ipv6: fix return value check in esp_remove_trailer
  - net: ipv4: fix return value check in esp_remove_trailer
  - qed: fix LL2 RX buffer allocation
  - drm/i915: Retry gtt fault when out of fence registers
  - netfilter: nft_payload: fix wrong mac header matching
  - tcp: check mptcp-level constraints for backlog coalescing
  - KVM: x86: Mask LVTPC when handling a PMI
  - regmap: fix NULL deref on lookup
  - ice: reset first in crash dump kernels
  - ice: fix over-shifted variable
  - Bluetooth: avoid memcmp() out of bounds warning
  - Bluetooth: hci_event: Fix coding style
  - Bluetooth: vhci: Fix race when opening vhci device
  - Bluetooth: Fix a refcnt underflow problem for hci_conn
  - Bluetooth: Reject connection with the device which has same BD_ADDR
  - Bluetooth: hci_event: Ignore NULL link key
  - usb: hub: Guard against accesses to uninitialized BOS descriptors
  - Documentation: sysctl: align cells in second content column
  - mm/memory_hotplug: rate limit page migration warnings
  - lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default
  - dev_forward_skb: do not scrub skb mark within the same name space
  - RDMA/srp: Fix srp_abort()
  - RDMA/srp: Set scmnd->result only when scmnd is not NULL
  - x86/alternatives: Disable KASAN in apply_alternatives()
  - powerpc/64e: Fix wrong test in __ptep_test_and_clear_young()
  - powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE
  - dmaengine: mediatek: Fix deadlock caused by synchronize_irq()
  - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
  - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
  - counter: microchip-tcb-capture: Fix the use of internal GCLK logic
  - pinctrl: avoid unsafe code pattern in find_pinctrl()
  - cgroup: Remove duplicates in cgroup v1 tasks file
  - tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
  - Input: goodix - ensure int GPIO is in input for gpio_count == 1 && gpio_int_idx == 0 case
  - Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table
  - Input: xpad - add PXN V900 support
  - Input: psmouse - fix fast_reconnect function for PS/2 mode
  - ceph: fix type promotion bug on 32bit systems
  - ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
  - libceph: use kernel_connect()
  - thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding
  - mcb: remove is_added flag from mcb_device struct
  - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
  - iio: pressure: dps310: Adjust Timeout Settings
  - iio: pressure: bmp280: Fix NULL pointer exception
  - usb: musb: Modify the "HWVers" register address
  - usb: musb: Get the musb_qh poniter after musb_giveback
  - usb: dwc3: Soft reset phy on probe for host
  - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
  - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
  - dmaengine: stm32-mdma: abort resume if no ongoing transfer
  - media: mtk-jpeg: Fix use after free bug due to uncanceled work
  - Revert "spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe"
  - Revert "spi: zynqmp-gqspi: fix clock imbalance on probe failure"
  - pinctrl: renesas: rzn1: Enable missing PINMUX
  - ixgbe: fix crash with empty VF macvlan list
  - net: phy: mscc: macsec: reject PN update requests
  - net: macsec: indicate next pn update when offloading
  - drm/vmwgfx: fix typo of sizeof argument
  - riscv, bpf: Sign-extend return values
  - riscv, bpf: Factor out emit_call for kernel and bpf context
  - xen-netback: use default TX queue size for vifs
  - mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type
  - ravb: Fix up dma_free_coherent() call in ravb_remove()
  - drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow
  - drm/msm/dsi: skip the wait for video mode done if not applicable
  - drm/msm/dp: do not reinitialize phy unless retry during link training
  - net: prevent address rewrite in kernel_bind()
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
  - lib/test_meminit: fix off-by-one error in test_pages()
  - perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7
  - RDMA/cxgb4: Check skb value for failure to allocate
  - RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent
  - arm64/mpam: Fix repeated enabling in mpam_enable()
  - jfs: fix array-index-out-of-bounds in dbAdjTree
  - block/rnbd-srv: Check for unlikely string overflow


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-195.0.0.108
changelog:
  - !5831  fbdev: sis: Error out if pixclock equals zero
  - !5861  ksmbd: fix uaf in smb20_oplock_break_ack
  - !5911  CVE-2023-52484
  - !5895  i2c: i801: Fix block process call transactions
  - !5870  drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - !5863  CVE-2024-26788
  - iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range
  - iommu/arm-smmu-v3: Fix size calculation in arm_smmu_mm_invalidate_range()
  - !5811  Fixed CVE-2021-47037
  - !5808  nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - i2c: i801: Fix block process call transactions
  - !5845 [OLK 5.10] bugfixes of vf id of mailbox and port duplex configure
  - !5747  ksmbd: fix global oob in ksmbd_nl_policy
  - !5832  CVE-2023-52467
  - !5795  netfilter: nft_limit: reject configurations that cause integer overflow
  - !5751  net: atlantic: Fix DMA mapping for PTP hwts ring
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - dmaengine: fsl-qdma: init irq after reg initialization
  - ksmbd: fix uaf in smb20_oplock_break_ack
  - net: hns3: fix port duplex configure error in IMP reset
  - net: hns3: add checking for vf id of mailbox
  - mfd: syscon: Fix null pointer dereference in of_syscon_register()
  - fbdev: sis: Error out if pixclock equals zero
  - !5785  net: qualcomm: rmnet: fix global oob in rmnet_policy
  - !5789  perf/x86/lbr: Filter vsyscall addresses
  - !5780  bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  - !5787  bpf: fix check for attempt to corrupt spilled pointer
  - !5770 v2  scsi: hisi_sas: Fixed some issues in the SAS
  - ASoC: q6afe-clocks: fix reprobing of the driver
  - ASoC: q6afe-clocks: fix warning on symbol scope
  - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - !5794  um: time-travel: fix time corruption
  - !5773  patches for CVE-2023-52617
  - !5772  firmware: arm_scmi: Check mailbox/SMT channel for consistency
  - !5788 v2  Patches to Fix CVE-2023-52454
  - netfilter: nft_limit: reject configurations that cause integer overflow
  - um: time-travel: fix time corruption
  - perf/x86/lbr: Filter vsyscall addresses
  - nvmet-tcp: Fix the H2C expected PDU len calculation
  - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
  - bpf: fix check for attempt to corrupt spilled pointer
  - net: qualcomm: rmnet: fix global oob in rmnet_policy
  - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  - !5724  ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
  - PCI: switchtec: Fix stdev_release() crash after surprise hot remove
  - firmware: arm_scmi: Check mailbox/SMT channel for consistency
  - !5738 [OLK 5.10] net: hns3: fix port vlan filter not disabled problem in dynamic vlan mode
  - !5757  inet: read sk->sk_family once in inet_recv_error()
  - scsi: hisi_sas: Add cond_resched() to cq_thread_v3_hw()
  - scsi: hisi_sas: Default enable interrupt coalescing
  - inet: read sk->sk_family once in inet_recv_error()
  - !5745 v2  iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol
  - net: atlantic: Fix DMA mapping for PTP hwts ring
  - ksmbd: fix global oob in ksmbd_nl_policy
  - iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol
  - net: hns3: fix port vlan filter not disabled problem in dynamic vlan mode
  - !5698  sr9800: Add check for usbnet_get_endpoints
  - !5711 Backport 5.10.201 LTS patches from upstream
  - !5728  fix CVE-2021-47101
  - btrfs: use u64 for buffer sizes in the tree search ioctls
  - Revert "mmc: core: Capture correct oemid-bits for eMMC cards"
  - tracing/kprobes: Fix the order of argument descriptions
  - fbdev: fsl-diu-fb: mark wr_reg_wa() static
  - fbdev: imsttfb: fix a resource leak in probe
  - fbdev: imsttfb: Fix error path of imsttfb_probe()
  - spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies
  - drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE
  - x86/sev-es: Allow copy_from_kernel_nofault() in earlier boot
  - x86: Share definition of __is_canonical_address()
  - netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses
  - netfilter: nft_redir: use `struct nf_nat_range2` throughout and deduplicate eval call-backs
  - netfilter: xt_recent: fix (increase) ipv6 literal buffer length
  - r8169: respect userspace disabling IFF_MULTICAST
  - tg3: power down device only on SYSTEM_POWER_OFF
  - net/smc: put sk reference if close work was canceled
  - net/smc: allow cdc msg send rather than drop it with NULL sndbuf_desc
  - net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs
  - Fix termination state for idr_for_each_entry_ul()
  - net: r8169: Disable multicast filter for RTL8168H and RTL8107E
  - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
  - dccp: Call security_inet_conn_request() after setting IPv4 addresses.
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
  - hsr: Prevent use after free in prp_create_tagged_frame()
  - llc: verify mac len before reading mac header
  - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
  - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume
  - pwm: sti: Reduce number of allocations and drop usage of chip_data
  - pwm: sti: Avoid conditional gotos
  - regmap: prevent noinc writes from clobbering cache
  - media: dvb-usb-v2: af9035: fix missing unlock
  - media: cedrus: Fix clock/reset sequence
  - media: vidtv: mux: Add check and kfree for kstrdup
  - media: vidtv: psi: Add check for kstrdup
  - media: s3c-camif: Avoid inappropriate kfree()
  - media: bttv: fix use after free error due to btv->timeout timer
  - media: i2c: max9286: Fix some redundant of_node_put() calls
  - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add()
  - pcmcia: ds: fix refcount leak in pcmcia_device_add()
  - pcmcia: cs: fix possible hung task and memory leak pccardd()
  - rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call
  - i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs
  - perf hist: Add missing puts to hist__account_cycles
  - perf machine: Avoid out of bounds LBR memory read
  - usb: host: xhci-plat: fix possible kernel oops while resuming
  - xhci: Loosen RPM as default policy to cover for AMD xHC 1.1
  - powerpc/pseries: fix potential memory leak in init_cpu_associativity()
  - powerpc/imc-pmu: Use the correct spinlock initializer.
  - powerpc/xive: Fix endian conversion size
  - powerpc/40x: Remove stale PTE_ATOMIC_UPDATES macro
  - modpost: fix tee MODULE_DEVICE_TABLE built on big-endian host
  - f2fs: fix to initialize map.m_pblk in f2fs_precache_extents()
  - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc()
  - USB: usbip: fix stub_dev hub disconnect
  - tools: iio: iio_generic_buffer ensure alignment
  - tools: iio: iio_generic_buffer: Fix some integer type and calculation
  - tools: iio: privatize globals and functions in iio_generic_buffer.c file
  - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave()
  - dmaengine: ti: edma: handle irq_of_parse_and_map() errors
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
  - livepatch: Fix missing newline character in klp_resolve_symbols()
  - leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu'
  - leds: pwm: Don't disable the PWM when the LED should be off
  - ASoC: ams-delta.c: use component after check
  - padata: Fix refcnt handling in padata_free_shell()
  - padata: Convert from atomic_t to refcount_t on parallel_data->refcnt
  - ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails
  - HID: logitech-hidpp: Move get_wireless_feature_index() check to hidpp_connect_event()
  - HID: logitech-hidpp: Revert "Don't restart communication if not necessary"
  - HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only
  - HID: logitech-hidpp: Remove HIDPP_QUIRK_NO_HIDINPUT quirk
  - Revert "HID: logitech-hidpp: add a module parameter to keep firmware gestures"
  - sh: bios: Revive earlyprintk support
  - hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip
  - RDMA/hfi1: Workaround truncation compilation error
  - scsi: ufs: core: Leave space for '0' in utf8 desc string
  - ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe
  - IB/mlx5: Fix rdma counter binding for RAW QP
  - ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member not described
  - ext4: move 'ix' sanity check to corrent position
  - ARM: 9321/1: memset: cast the constant byte to unsigned char
  - hid: cp2112: Fix duplicate workqueue initialization
  - crypto: qat - increase size of buffers
  - crypto: qat - mask device capabilities with soft straps
  - crypto: caam/jr - fix Chacha20 + Poly1305 self test failure
  - crypto: caam/qi2 - fix Chacha20 + Poly1305 self test failure
  - nd_btt: Make BTT lanes preemptible
  - libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return value
  - hwrng: geode - fix accessing registers
  - selftests/resctrl: Ensure the benchmark commands fits to its array
  - selftests/pidfd: Fix ksft print formats
  - clk: scmi: Free scmi_clk allocated when the clocks with invalid info are skipped
  - firmware: ti_sci: Mark driver as non removable
  - xen-pciback: Consider INTx disabled when MSI/MSI-X is enabled
  - drm/rockchip: Fix type promotion bug in rockchip_gem_iommu_map()
  - drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe()
  - drm/mediatek: Fix iommu fault during crtc enabling
  - drm/bridge: tc358768: Fix bit updates
  - drm/bridge: tc358768: Disable non-continuous clock mode
  - drm/bridge: tc358768: Fix use of uninitialized variable
  - drm/rockchip: vop: Fix call to crtc reset helper
  - drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs
  - hwmon: (coretemp) Fix potentially truncated sysfs attribute name
  - hwmon: (axi-fan-control) Fix possible NULL pointer dereference
  - hwmon: (axi-fan-control) Support temperature vs pwm points
  - platform/x86: wmi: Fix opening of char device
  - platform/x86: wmi: remove unnecessary initializations
  - platform/x86: wmi: Fix probe failure when failing to register WMI devices
  - clk: qcom: config IPQ_APSS_6018 should depend on QCOM_SMEM
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
  - clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
  - clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
  - clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data
  - clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data
  - clk: npcm7xx: Fix incorrect kfree
  - clk: ti: fix double free in of_ti_divider_clk_setup()
  - clk: ti: change ti_clk_register[_omap_hw]() API
  - clk: ti: Update component clocks to use ti_dt_clk_name()
  - clk: ti: Update pll and clockdomain clocks to use ti_dt_clk_name()
  - clk: ti: Add ti_dt_clk_name() helper to use clock-output-names
  - clk: keystone: pll: fix a couple NULL vs IS_ERR() checks
  - spi: nxp-fspi: use the correct ioremap function
  - clk: linux/clk-provider.h: fix kernel-doc warnings and typos
  - clk: asm9260: use parent index to link the reference clock
  - clk: imx: imx8mq: correct error handling path
  - clk: imx: Select MXC_CLK for CLK_IMX8QXP
  - clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src
  - clk: qcom: gcc-sm8150: use ARRAY_SIZE instead of specifying num_parents
  - clk: qcom: mmcc-msm8998: Fix the SMMU GDSC
  - clk: qcom: mmcc-msm8998: Set bimc_smmu_gdsc always on
  - clk: qcom: mmcc-msm8998: Don't check halt bit on some branch clks
  - clk: qcom: mmcc-msm8998: Add hardware clockgating registers to some clks
  - clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies
  - regmap: debugfs: Fix a erroneous check after snprintf()
  - ipv6: avoid atomic fragment on GSO packets
  - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias()
  - tcp: fix cookie_init_timestamp() overflows
  - chtls: fix tp->rcv_tstamp initialization
  - r8169: fix rare issue with broken rx after link-down on RTL8125
  - r8169: use tp_to_dev instead of open code
  - thermal: core: prevent potential string overflow
  - PM / devfreq: rockchip-dfi: Make pmu regmap mandatory
  - can: dev: can_restart(): fix race condition between controller restart and netif_carrier_on()
  - can: dev: can_restart(): don't crash kernel if carrier is OK
  - wifi: rtlwifi: fix EDCA limit set by BT coexistence
  - tcp_metrics: do not create an entry from tcp_init_metrics()
  - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics()
  - tcp_metrics: add missing barriers on delete
  - wifi: mt76: mt7603: rework/fix rx pse hang check
  - wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
  - net: spider_net: Use size_add() in call to struct_size()
  - tipc: Use size_add() in calls to struct_size()
  - mlxsw: Use size_mul() in call to struct_size()
  - gve: Use size_add() in call to struct_size()
  - overflow: Implement size_t saturating arithmetic helpers
  - tcp: call tcp_try_undo_recovery when an RTOd TFO SYNACK is ACKed
  - udp: add missing WRITE_ONCE() around up->encap_rcv
  - i40e: fix potential memory leaks in i40e_remove()
  - genirq/matrix: Exclude managed interrupts in irq_matrix_allocated()
  - pstore/platform: Add check for kstrdup
  - x86/boot: Fix incorrect startup_gdt_descr.size
  - futex: Don't include process MM in futex key on no-MMU
  - x86/srso: Fix SBPB enablement for (possible) future fixed HW
  - vfs: fix readahead(2) on block devices
  - asix: fix wrong return value in asix_check_host_enable()
  - asix: fix uninit-value in asix_mdio_read()
  - net: asix: fix uninit value bugs
  - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - !5642  btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - !5712 [sync] PR-5672:  arm64/mpam_ctrlmon: Update ctrl group config with rdtgrp's partid
  - !5189 vhost_vdpa: Fix the error of not executing atomic_dec
  - !5530  net: Fix CVE-2024-26641
  - !5532  ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  - arm64/mpam: Allocate new partid for the created ctrl group
  - arm64/mpam_ctrlmon: Update ctrl group config with rdtgrp's partid
  - !5670  cpufreq: CPPC: Eliminate the impact of cpc_read() latency error
  - !5506  ext4: dio: Put endio under irq context for overwrite
  - !5507  ext4: Validate inode pa before using preallocation blocks
  - sr9800: Add check for usbnet_get_endpoints
  - cpufreq: CPPC: Eliminate the impact of cpc_read() latency error
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - vhost_vdpa: Fix the error of not executing atomic_dec
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
  - ip6_tunnel: use dev_sw_netstats_rx_add()
  - ext4: Validate inode pa before using preallocation blocks
  - ext4: Optimize endio process for DIO overwrites
  - iomap: Add a IOMAP_DIO_MAY_INLINE_COMP flag
  - iomap: pass a flags argument to iomap_dio_rw
  - iomap: rename the flags variable in __iomap_dio_rw
  - iomap: add IOMAP_DIO_INLINE_COMP
  - iomap: use an unsigned type for IOMAP_DIO_* defines
  - iomap: cleanup up iomap_dio_bio_end_io()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-196.0.0.109
changelog:
  - !6074  Fix CVE-2024-26787
  - !6193  uio_hv_generic: Fix another memory leak in error handling paths
  - !6192  arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
  - !6178  CVE-2024-26812
  - !6112  cifs: Fix UAF in cifs_demultiplex_thread()
  - uio_hv_generic: Fix another memory leak in error handling paths
  - arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
  - vfio/pci: Create persistent INTx handler
  - vfio: Introduce interface to flush virqfd inject workqueue
  - !6124  xen/events: close evtchn after mapping cleanup
  - !6137  vfio/pci: Lock external INTx masking ops
  - !6161 Backport 5.10.203 LTS patches from upstream
  - driver core: Release all resources during unbind before updating device links
  - r8169: fix deadlock on RTL8125 in jumbo mtu mode
  - r8169: disable ASPM in case of tx timeout
  - mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled
  - mmc: core: add helpers mmc_regulator_enable/disable_vqmmc
  - mmc: block: Retry commands in CQE error recovery
  - mmc: core: convert comma to semicolon
  - mmc: cqhci: Fix task clearing in CQE error recovery
  - mmc: cqhci: Warn of halt or task clear failure
  - mmc: cqhci: Increase recovery halt timeout
  - cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily
  - cpufreq: imx6q: don't warn for disabling a non-existing frequency
  - scsi: qla2xxx: Fix system crash due to bad pointer access
  - scsi: qla2xxx: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
  - scsi: core: Introduce the scsi_cmd_to_rq() function
  - smb3: fix caching of ctime on setxattr
  - fs: add ctime accessors infrastructure
  - ima: annotate iint mutex to avoid lockdep false positive warnings
  - fbdev: stifb: Make the STI next font pointer a 32-bit signed offset
  - misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support
  - misc: pci_endpoint_test: Add deviceID for AM64 and J7200
  - s390/cmma: fix detection of DAT pages
  - s390/mm: fix phys vs virt confusion in mark_kernel_pXd() functions family
  - ASoC: SOF: sof-pci-dev: Fix community key quirk detection
  - ASoC: SOF: sof-pci-dev: don't use the community key on APL Chromebooks
  - ASoC: SOF: sof-pci-dev: add parameter to override topology filename
  - ASoC: SOF: sof-pci-dev: use community key on all Up boards
  - ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header
  - smb3: fix touch -h of symlink
  - net: ravb: Start TX queues after HW initialization succeeded
  - net: ravb: Use pm_runtime_resume_and_get()
  - r8169: prevent potential deadlock in rtl8169_close
  - Revert "workqueue: remove unused cancel_work()"
  - octeontx2-pf: Fix adding mbox work queue entry when num_vfs > 64
  - net: stmmac: xgmac: Disable FPE MMC interrupts
  - selftests/net: mptcp: fix uninitialized variable warnings
  - selftests/net: ipsec: fix constant out of range
  - dpaa2-eth: increase the needed headroom to account for alignment
  - usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
  - USB: core: Change configuration warnings to notices
  - hv_netvsc: fix race of netvsc and VF register_netdevice
  - Input: xpad - add HyperX Clutch Gladiate Support
  - btrfs: make error messages more clear when getting a chunk map
  - btrfs: send: ensure send_fd is writable
  - btrfs: fix off-by-one when checking chunk map includes logical address
  - btrfs: ref-verify: fix memory leaks in btrfs_ref_tree_mod()
  - btrfs: add dmesg output for first mount and last unmount of a filesystem
  - parisc: Drop the HP-UX ENOSYM and EREMOTERELEASE error codes
  - powerpc: Don't clobber f0/vs0 during fp|altivec register save
  - iommu/vt-d: Add MTL to quirk list to skip TE disabling
  - bcache: revert replacing IS_ERR_OR_NULL with IS_ERR
  - dm verity: don't perform FEC for failed readahead IO
  - dm-verity: align struct dm_verity_fec_io properly
  - ALSA: hda/realtek: Add supported ALC257 for ChromeOS
  - ALSA: hda/realtek: Headset Mic VREF to 100%
  - ALSA: hda: Disable power-save on KONTRON SinglePC
  - mmc: block: Do not lose cache flush during CQE error recovery
  - firewire: core: fix possible memory leak in create_units()
  - pinctrl: avoid reload of p state in list iteration
  - io_uring: fix off-by one bvec index
  - USB: dwc3: qcom: fix wakeup after probe deferral
  - usb: dwc3: set the dma max_seg_size
  - usb: dwc3: Fix default mode initialization
  - USB: dwc2: write HCINT with INTMASK applied
  - USB: serial: option: don't claim interface 4 for ZTE MF290
  - USB: serial: option: fix FM101R-GL defines
  - USB: serial: option: add Fibocom L7xx modules
  - bcache: fixup lock c->root error
  - bcache: fixup init dirty data errors
  - bcache: prevent potential division by zero error
  - bcache: check return value from btree_node_alloc_replacement()
  - dm-delay: fix a race between delay_presuspend and delay_bio
  - hv_netvsc: Mark VF as slave before exposing it to user-mode
  - hv_netvsc: Fix race of register_netdevice_notifier and VF register
  - USB: serial: option: add Luat Air72*U series products
  - s390/dasd: protect device queue against concurrent access
  - bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race
  - bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce()
  - swiotlb-xen: provide the "max_mapping_size" method
  - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA
  - ASoC: simple-card: fixup asoc_simple_probe() error handling
  - nfsd: lock_rename() needs both directories to live on the same fs
  - ext4: using nofail preallocation in ext4_es_insert_extent()
  - ext4: using nofail preallocation in ext4_es_insert_delayed_block()
  - ext4: use pre-allocated es in __es_remove_extent()
  - ext4: use pre-allocated es in __es_insert_extent()
  - ext4: factor out __es_alloc_extent() and __es_free_extent()
  - ext4: add a new helper to check if es must be kept
  - MIPS: KVM: Fix a build warning about variable set but not used
  - media: ccs: Correctly initialise try compose rectangle
  - lockdep: Fix block chain corruption
  - USB: dwc3: qcom: fix ACPI platform device leak
  - USB: dwc3: qcom: fix resource leaks on probe deferral
  - afs: Fix file locking on R/O volumes to operate in local mode
  - afs: Return ENOENT if no cell DNS record can be found
  - net: axienet: Fix check for partial TX checksum
  - amd-xgbe: propagate the correct speed and duplex status
  - amd-xgbe: handle the corner-case during tx completion
  - amd-xgbe: handle corner-case during sfp hotplug
  - arm/xen: fix xen_vcpu_info allocation alignment
  - net/smc: avoid data corruption caused by decline
  - net: usb: ax88179_178a: fix failed operations during ax88179_reset
  - ipv4: Correct/silence an endian warning in __ip_do_redirect
  - HID: fix HID device resource race between HID core and debugging support
  - HID: core: store the unique system identifier in hid_device
  - drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full
  - ata: pata_isapnp: Add missing error check for devm_ioport_map()
  - wireguard: use DEV_STATS_INC()
  - drm/panel: simple: Fix Innolux G101ICE-L01 timings
  - drm/panel: simple: Fix Innolux G101ICE-L01 bus flags
  - drm/panel: auo,b101uan08.3: Fine tune the panel power sequence
  - drm/panel: boe-tv101wum-nl6: Fine tune the panel power sequence
  - afs: Make error on cell lookup failure consistent with OpenAFS
  - afs: Fix afs_server_list to be cleaned up with RCU
  - PCI: keystone: Drop __init from ks_pcie_add_pcie_{ep,port}()
  - !5612 【OLK-5.10】Add Chengdu BeiZhongWangXin Technology N5/N6 Series Network Card Driver
  - !5736 Backport 5.10.202 LTS patches from upstream
  - !6033  gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  - !6003  KVM: s390: vsie: fix race during shadow creation
  - !6103  riscv: Sparse-Memory/vmemmap out-of-bounds fix
  - !6065 v4  arm64 bpf trampoline for olk-5.10
  - !6116  wifi: rt2x00: restart beacon queue when hardware reset
  - !6047  hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  - vfio/pci: Lock external INTx masking ops
  - !6108 udma: optimize latency for non-share-jfr mode
  - !6101  vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - !5486 [OLK-5.10] support the AMD Zen5 Turin
  - !5717 v2  fix CVE-2023-52587
  - !6050  wifi: mac80211: fix race condition on enabling fast-xmit
  - !4923  mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
  - xen/events: close evtchn after mapping cleanup
  - wifi: rt2x00: restart beacon queue when hardware reset
  - cifs: Fix UAF in cifs_demultiplex_thread()
  - hns3 udma: optimize latency for non-share-jfr mode
  - riscv: Sparse-Memory/vmemmap out-of-bounds fix
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - !6016  btrfs: don't drop extent_map for free space inode on write error
  - !6031  nilfs2: fix potential bug in end_buffer_async_write
  - !5847  ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - mmc: mmci: stm32: fix DMA API overlapping mappings warning
  - mmc: mmci: stm32: use a buffer for unaligned DMA requests
  - !5803  fs/ntfs3: Fix an NULL dereference bug
  - !5977  btrfs: dev-replace: properly validate device names
  - !5921  ext4: fix double-free of blocks due to wrong extents moved_len
  - !6029  ceph: prevent use-after-free in encode_cap_msg()
  - !5973  EDAC/thunderx: Fix possible out-of-bounds string access
  - !6052  fs/ntfs3: fix lbk-CVE-2023-52640
  - !6037  fix-CVE-2024-26706
  - !6040  nilfs2: fix data corruption in dsync block recovery for small block sizes
  - config: Enable DYNAMIC_FTRACE_WITH_DIRECT_CALLS
  - arm64: ftrace: Support direct call for no literal module functions
  - arm64: ftrace: Add ftrace direct call support
  - arm64: ftrace: Support long jump for ftrace direct call
  - ftrace: Allow users to disable ftrace direct call
  - bpf, arm64: Fix BTI type used for freplace attached functions
  - bpf, arm64: Fixed a BTI error on returning to patched function
  - bpf, arm64: Fix bpf trampoline instruction endianness
  - bpf, arm64: Fix compile error in dummy_tramp()
  - bpf, arm64: Mark dummy_tramp as global
  - bpf, arm64: Add bpf trampoline for arm64
  - bpf, arm64: Implement bpf_arch_text_poke() for arm64
  - arm64: Add LDR (literal) instruction
  - bpf, arm64: Adjust the offset of str/ldr(immediate) to positive number
  - bpf, arm64: Optimize BPF store/load using arm64 str/ldr(immediate offset)
  - arm64, insn: Add ldr/str with immediate offset
  - x86/ibt,ftrace: Search for __fentry__ location
  - !6017  drm/amdgpu: fix use-after-free bug
  - fs/ntfs3: Fix oob in ntfs_listxattr
  - fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea()
  - ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
  - wifi: mac80211: fix race condition on enabling fast-xmit
  - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  - !6020  net/sched: act_mirred: use the backlog for mirred ingress
  - !5995  mm/swap: fix race when skipping swapcache
  - nilfs2: fix data corruption in dsync block recovery for small block sizes
  - !6006  fix CVE-2024-26669
  - parisc/unaligned: Fix emulate_ldw() breakage
  - parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd()
  - parisc: Fix random data corruption from exception handler
  - parisc/unaligned: Rewrite 32-bit inline assembly of emulate_sth()
  - parisc/unaligned: Rewrite 32-bit inline assembly of emulate_ldd()
  - parisc/unaligned: Rewrite inline assembly of emulate_ldw()
  - parisc: Mark ex_table entries 32-bit aligned in uaccess.h
  - parisc: Fix some apparent put_user() failures
  - parisc: Implement __get/put_kernel_nofault()
  - parisc: Drop strnlen_user() in favour of generic version
  - parisc: Switch user access functions to signal errors in r29 instead of r8
  - parisc/unaligned: Rewrite inline assembly of emulate_ldh()
  - parisc/unaligned: Use EFAULT fixup handler in unaligned handlers
  - !5969  fbdev: savage: Error out if pixclock equals zero
  - drivers: add Chengdu BeiZhongWangXin Technology N5/N6 Series Network Card Driver
  - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  - !5976  dm-crypt: don't modify the data when using authenticated encryption
  - objtool/x86: Use asm/nops.h
  - !6011 udma: fix a bug in udma dfx
  - nilfs2: fix potential bug in end_buffer_async_write
  - !6018 v2  IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
  - ceph: prevent use-after-free in encode_cap_msg()
  - !5979  mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  - !5970  fixup CVE-2024-26751
  - net/sched: act_mirred: use the backlog for mirred ingress
  - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
  - drm/amdgpu: fix use-after-free bug
  - !5950  RDMA/qedr: Fix qedr_create_user_qp error flow
  - btrfs: don't drop extent_map for free space inode on write error
  - !5998  net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
  - !5996  mptcp: fix double-free on socket dismantle
  - !5993  ipv6: sr: fix possible use-after-free and null-ptr-deref
  - !5763  CVE-2024-26684 bugfix for OLK-5.10
  - hns3 udma: fix the dfx structure is deleted concurrently.
  - !5975 udma: fix a bug in QP creation
  - net/sched: flower: Fix kabi change
  - net/sched: flower: Fix chain template offload
  - KVM: s390: vsie: fix race during shadow creation
  - net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
  - mptcp: fix double-free on socket dismantle
  - mm/swap: fix race when skipping swapcache
  - ipv6: sr: fix possible use-after-free and null-ptr-deref
  - !5901  CVE-2024-26695
  - !5853  dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - !5930  RDMA/srpt: Support specifying the srpt_service_guid parameter
  - !5758  tunnels: fix out of bounds access when building IPv6 PMTU error
  - !5812  afs: Increase buffer size in afs_update_volume_status()
  - !5852  CVE-2024-26809
  - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  - btrfs: dev-replace: properly validate device names
  - dm-crypt: don't modify the data when using authenticated encryption
  - hns3 udma: modify the process of create qp
  - EDAC/thunderx: Fix possible out-of-bounds string access
  - !5943  CVE-2021-46926
  - interconnect: qcom: Add support for mask-based BCMs
  - netfilter: nf_tables: disable toggling dormant table state more than once
  - netfilter: nf_tables: fix table flag updates
  - netfilter: nftables: update table flags from the commit phase
  - drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox
  - drm/amdgpu: fix error handling in amdgpu_bo_list_get()
  - drm/amd/pm: Handle non-terminated overdrive commands.
  - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
  - ext4: correct the start block of counting reserved clusters
  - ext4: correct offset of gdb backup in non meta_bg group to update_backups
  - ext4: apply umask if ACL support is disabled
  - Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"
  - media: qcom: camss: Fix vfe_get() error jump
  - mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors
  - nfsd: fix file memleak on client_opens_release
  - media: venus: hfi: add checks to handle capabilities from firmware
  - media: venus: hfi: fix the check to handle session buffer requirement
  - media: venus: hfi_parser: Add check to keep the number of codecs within range
  - media: sharp: fix sharp encoding
  - media: lirc: drop trailing space from scancode transmit
  - f2fs: avoid format-overflow warning
  - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
  - net: phylink: initialize carrier state at creation
  - net: dsa: lan9303: consequently nested-lock physical MDIO
  - i2c: designware: Disable TX_EMPTY irq while waiting for block length byte
  - lsm: fix default return value for inode_getsecctx
  - lsm: fix default return value for vm_enough_memory
  - Revert ncsi: Propagate carrier gain/loss events to the NCSI controller
  - arm64: dts: qcom: ipq6018: Fix tcsr_mutex register size
  - arm64: dts: qcom: ipq6018: switch TCSR mutex to MMIO
  - PCI: exynos: Don't discard .remove() callback
  - Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE
  - Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables
  - bluetooth: Add device 13d3:3571 to device tables
  - bluetooth: Add device 0bda:887b to device tables
  - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559
  - cpufreq: stats: Fix buffer overflow detection in trans_stats()
  - tty: serial: meson: fix hard LOCKUP on crtscts mode
  - serial: meson: Use platform_get_irq() to get the interrupt
  - tty: serial: meson: retrieve port FIFO size from DT
  - serial: meson: remove redundant initialization of variable id
  - ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC
  - ALSA: hda/realtek - Add Dell ALC295 to pin fall back table
  - ALSA: info: Fix potential deadlock at disconnection
  - xhci: Enable RPM on controllers that support low-power states
  - parisc/pgtable: Do not drop upper 5 address bits of physical address
  - parisc: Prevent booting 64-bit kernels on PA1.x machines
  - i3c: master: cdns: Fix reading status register
  - mtd: cfi_cmdset_0001: Byte swap OTP info
  - mm/memory_hotplug: use pfn math in place of direct struct page manipulation
  - mm/cma: use nth_page() in place of direct struct page manipulation
  - dmaengine: stm32-mdma: correct desc prep when channel running
  - mcb: fix error handling for different scenarios when parsing
  - i2c: core: Run atomic i2c xfer when !preemptible
  - kernel/reboot: emergency_restart: Set correct system_state
  - quota: explicitly forbid quota files from being encrypted
  - PCI: keystone: Don't discard .probe() callback
  - PCI: keystone: Don't discard .remove() callback
  - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
  - mmc: meson-gx: Remove setting of CMD_CFG_ERROR
  - wifi: ath11k: fix htt pktlog locking
  - wifi: ath11k: fix dfs radar event locking
  - wifi: ath11k: fix temperature event locking
  - ima: detect changes to the backing overlay file
  - firmware: qcom_scm: use 64-bit calling convention only when client is 64-bit
  - btrfs: don't arbitrarily slow down delalloc if we're committing
  - rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects
  - PM: hibernate: Clean up sync_read handling in snapshot_write_next()
  - PM: hibernate: Use __get_safe_page() rather than touching the list
  - arm64: dts: qcom: ipq6018: Fix hwlock index for SMEM
  - PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common()
  - mmc: sdhci_am654: fix start loop index for TAP value parsing
  - mmc: vub300: fix an error code
  - clk: qcom: ipq6018: drop the CLK_SET_RATE_PARENT flag from PLL clocks
  - clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks
  - parisc/pdc: Add width field to struct pdc_model
  - arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
  - ACPI: resource: Do IRQ override on TongFang GMxXGxx
  - watchdog: move softlockup_panic back to early_param
  - PCI/sysfs: Protect driver's D3cold preference from user space
  - hvc/xen: fix error path in xen_hvc_init() to always register frontend driver
  - hvc/xen: fix console unplug
  - tty/sysrq: replace smp_processor_id() with get_cpu()
  - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
  - audit: don't take task_lock() in audit_exe_compare() code path
  - KVM: x86: Ignore MSR_AMD64_TW_CFG access
  - KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space
  - scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for selected registers
  - scsi: mpt3sas: Fix loop logic
  - bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
  - bpf: Fix check_stack_write_fixed_off() to correctly spill imm
  - randstruct: Fix gcc-plugin performance mode to stay in group
  - powerpc/perf: Fix disabling BHRB and instruction sampling
  - media: venus: hfi: add checks to perform sanity on queue pointers
  - cifs: fix check of rc in function generate_smb3signingkey
  - cifs: spnego: add ';' in HOST_KEY_LEN
  - tools/power/turbostat: Fix a knl bug
  - macvlan: Don't propagate promisc change to lower dev in passthru
  - net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors
  - net/mlx5_core: Clean driver version and name
  - net/mlx5e: fix double free of encap_header
  - net: stmmac: fix rx budget limit check
  - netfilter: nf_conntrack_bridge: initialize err to 0
  - net: ethernet: cortina: Fix MTU max setting
  - net: ethernet: cortina: Handle large frames
  - net: ethernet: cortina: Fix max RX frame define
  - bonding: stop the device in bond_setup_by_slave()
  - ptp: annotate data-race around q->head and q->tail
  - xen/events: fix delayed eoi list handling
  - ppp: limit MRU to 64K
  - tipc: Fix kernel-infoleak due to uninitialized TLV value
  - tty: Fix uninit-value access in ppp_sync_receive()
  - gfs2: Silence "suspicious RCU usage in gfs2_permission" warning
  - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
  - NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO
  - SUNRPC: Add an IS_ERR() check back to where it was
  - SUNRPC: ECONNRESET might require a rebind
  - xhci: turn cancelled td cleanup to its own function
  - wifi: iwlwifi: Use FW rate for non-data frames
  - pwm: Fix double shift bug
  - drm/amdgpu: fix software pci_unplug on some chips
  - ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
  - kgdb: Flush console before entering kgdb on panic
  - drm/amd/display: Avoid NULL dereference of timing generator
  - media: imon: fix access to invalid resource for the second interface
  - media: cobalt: Use FIELD_GET() to extract Link Width
  - gfs2: fix an oops in gfs2_permission
  - gfs2: ignore negated quota changes
  - media: vivid: avoid integer overflow
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker
  - i2c: sun6i-p2wi: Prevent potential division by zero
  - 9p/trans_fd: Annotate data-racy writes to file::f_flags
  - usb: gadget: f_ncm: Always set current gadget in ncm_bind()
  - tty: vcc: Add check for kstrdup() in vcc_probe()
  - exfat: support handle zero-size directory
  - HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W
  - misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
  - atm: iphase: Do PCI error checks on own line
  - PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream
  - ARM: 9320/1: fix stack depot IRQ stack filter
  - HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround
  - jfs: fix array-index-out-of-bounds in diAlloc
  - jfs: fix array-index-out-of-bounds in dbFindLeaf
  - fs/jfs: Add validity check for db_maxag and db_agpref
  - fs/jfs: Add check for negative db_l2nbperpage
  - RDMA/hfi1: Use FIELD_GET() to extract Link Width
  - ASoC: soc-card: Add storage for PCI SSID
  - selftests/efivarfs: create-read: fix a resource leak
  - drm/panel: st7703: Pick different reset sequence
  - drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
  - drm/panel: fix a possible null pointer dereference
  - drm/amdgpu: Fix potential null pointer derefernce
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
  - drm/msm/dp: skip validity check for DP CTS EDID checksum
  - drm/komeda: drop all currently held locks if deadlock happens
  - platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
  - Bluetooth: Fix double free in hci_conn_cleanup
  - Bluetooth: btusb: Add date->evt_skb is NULL check
  - wifi: ath10k: Don't touch the CE interrupt registers after power up
  - net: annotate data-races around sk->sk_dst_pending_confirm
  - net: annotate data-races around sk->sk_tx_queue_mapping
  - wifi: ath10k: fix clang-specific fortify warning
  - wifi: ath9k: fix clang-specific fortify warnings
  - bpf: Detect IP == ksym.end as part of BPF program
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
  - wifi: mac80211_hwsim: fix clang-specific fortify warning
  - x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size
  - clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware
  - clocksource/drivers/timer-imx-gpt: Fix potential memory leak
  - perf/core: Bail out early if the request AUX area is out of bound
  - locking/ww_mutex/test: Fix potential workqueue corruption
  - ARM: ep93xx: Add terminator to gpiod_lookup_table
  - fbdev: savage: Error out if pixclock equals zero
  - !5781  ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - !5884  KVM: arm64: vgic-its: Fix CVE-2024-26598 fix patch issue
  - RDMA/qedr: Fix qedr_create_user_qp error flow
  - ALSA: hda: intel-sdw-acpi: harden detection of controller
  - RDMA/srpt: Support specifying the srpt_service_guid parameter
  - ext4: fix double-free of blocks due to wrong extents moved_len
  - crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
  - KVM: arm64: vgic-its: Fix CVE-2024-26598 fix patch issue
  - dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - netfilter: nft_set_pipapo: release elements in clone only from destroy path
  - netfilter: nft_set_pipapo: remove scratch_aligned pointer
  - netfilter: nft_set_pipapo: add helper to release pcpu scratch area
  - netfilter: nft_set_pipapo: store index in scratch maps
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - afs: Increase buffer size in afs_update_volume_status()
  - fs/ntfs3: Fix an NULL dereference bug
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - net: stmmac: xgmac: fix a typo of register name in DPP safety handling
  - net: stmmac: xgmac: use #define for string constants
  - net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
  - tunnels: fix out of bounds access when building IPv6 PMTU error
  - IB/ipoib: Fix mcast list locking
  - RDMA/IPoIB: Fix error code return in ipoib_mcast_join
  - x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled
  - x86/CPU/AMD: Check vendor in the AMD microcode callback
  - x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5
  - x86/CPU/AMD: Add X86_FEATURE_ZEN5
  - x86/cpu: Support AMD Automatic IBRS
  - Documentation/hw-vuln: Update spectre doc
  - x86: Remove dynamic NOP selection
  - x86/CPU/AMD: Add X86_FEATURE_ZEN1
  - x86/CPU/AMD: Drop now unused CPU erratum checking function
  - x86/CPU/AMD: Get rid of amd_erratum_1485[]
  - x86/CPU/AMD: Get rid of amd_erratum_400[]
  - x86/CPU/AMD: Get rid of amd_erratum_383[]
  - x86/CPU/AMD: Get rid of amd_erratum_1054[]
  - x86/CPU/AMD: Move the DIV0 bug detection to the Zen1 init function
  - x86/CPU/AMD: Move Zenbleed check to the Zen2 init function
  - x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common()
  - x86/CPU/AMD: Call the spectral chicken in the Zen2 init function
  - x86/CPU/AMD: Move erratum 1076 fix into the Zen1 init function
  - x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function
  - x86/CPU/AMD: Carve out the erratum 1386 fix
  - x86/CPU/AMD: Add ZenX generations flags
  - x86/CPU/AMD: Make sure EFER[AIBRSE] is set
  - x86: Fix comment for X86_FEATURE_ZEN
  - x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
  - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-197.0.0.110
changelog:
  - !5273  net/smc: fix illegal rmb_desc access in SMC-D connection dump
  - !6486  devlink: fix possible use-after-free and memory leaks in devlink_init()
  - !6515  fix CVE-2023-52498
  - !5468  media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
  - !6314  fixup CVE-2024-26908
  - PM: sleep: Fix error handling in dpm_prepare()
  - PM: sleep: Fix possible deadlocks in core system-wide PM code
  - PM: core: Remove unnecessary (void *) conversions
  - PM: sleep: Avoid calling put_device() under dpm_list_mtx
  - PM: sleep: Use dev_printk() when possible
  - async: Introduce async_schedule_dev_nocall()
  - async: Split async_schedule_node_domain()
  - !6316  scsi: fnic: Move fnic_fnic_flush_tx() to a work queue
  - !6399  wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces
  - !6407  wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - !6455  CVE-2021-47182
  - devlink: fix possible use-after-free and memory leaks in devlink_init()
  - !6423  tracing/trigger: Fix to return error if failed to alloc snapshot
  - scsi: core: Fix scsi_mode_sense() buffer length handling
  - scsi: core: Reshuffle response handling in scsi_mode_sense()
  - !6281 v2  net/mlx5: Update error handler for UCTX and UMEM
  - !6428  net/sched: flower: Fix unable to handle page fault bug in fl_init
  - !6267  wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
  - !6279  Bluetooth: Avoid potential use-after-free in hci_error_reset
  - !6259  arp: Prevent overflow in arp_req_get().
  - !6312  fix CVE-2024-24861 for 5.10
  - !6308 v3  ima: Avoid blocking in RCU read-side critical section
  - net/sched: flower: Fix unable to handle page fault bug in fl_init
  - tracing/trigger: Fix to return error if failed to alloc snapshot
  - !6291  aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces
  - !6295 hns3 udma: adjustment of the maximum number of Jettys
  - !6202  ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  - scsi: fnic: Move fnic_fnic_flush_tx() to a work queue
  - !6294 [sync] PR-6177:  arm64/mpam: Not allowed setting 0 to cache portion bit mask
  - !6293 [sync] PR-6176:  arm64/mpam: return EOPNOTSUPP when changing rmid of monitor group or resource group with monitor
  - !6284  net/mlx5e: CT, Fix multiple allocations and memleak of mod acts
  - x86/xen: Add some null pointer checking to smp.c
  - media: xc4000: Fix atomicity violation in xc4000_get_frequency
  - ima: Avoid blocking in RCU read-side critical section
  - !6076  Fix CVE-2024-26764
  - arm64/mpam: Not allowed setting 0 to cache portion bit mask
  - arm64/mpam: return EOPNOTSUPP when changing rmid of monitor group or resource group with monitor
  - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  - hns3 udma: adjustment of the maximum number of Jettys
  - !6263 udma: fix a bug of jfr record_db
  - net/mlx5e: CT, Fix multiple allocations and memleak of mod acts
  - net/mlx5: Update error handler for UCTX and UMEM
  - Bluetooth: Avoid potential use-after-free in hci_error_reset
  - !6262 scsi: hisi_sas: Remove hisi_hba->timer for v3 hw
  - !5965  Fix CVE-2023-52441 and integrate the pre-patch
  - !6086  netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
  - !6085  netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
  - scsi: hisi_sas: Remove hisi_hba->timer for v3 hw
  - hns3 udma: fixes errors related to jfr RECORD_DB.
  - arp: Prevent overflow in arp_req_get().
  - !6199  writeback fix softlockup
  - !6087  net/sched: act_mirred: don't override retval if we already lost the skb
  - !6082  can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  - !6058  net: ip_tunnel: prevent perpetual headroom growth
  - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  - cgroup_writeback: fix softlockup for blkcg->memcg_list
  - net/sched: act_mirred: don't override retval if we already lost the skb
  - netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
  - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  - can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
  - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
  - net: ip_tunnel: prevent perpetual headroom growth
  - ksmbd: fix out of bounds in init_smb2_rsp_hdr()
  - ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr
  - ksmbd: return unsupported error on smb1 mount
  - ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect
  - media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-198.0.0.111
changelog:
  - !6904  bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
  - !6918  bpf: Fix hashtab overflow check on 32-bit arches
  - !6928  firmware: arm_scmi: Harden accesses to the reset domains
  - !6924  bpf: Fix stackmap overflow check on 32-bit arches
  - !6861  media: dvb-frontends: avoid stack overflow warnings with clang
  - !6840  CVE-2023-52650
  - !6851  serial/pmac_zilog: Remove flawed mitigation for rx irq flood
  - !6826  fat: fix uninitialized field in nostale filehandles
  - !6838  fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - !6808  CVE-2024-26923
  - firmware: arm_scmi: Harden accesses to the reset domains
  - bpf: Fix stackmap overflow check on 32-bit arches
  - bpf: Fix hashtab overflow check on 32-bit arches
  - !6846  perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling
  - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
  - !6849  erofs: fix pcluster use-after-free on UP platforms
  - !6740  V2 cpuset: fix race between rebuild scheduler domains and hotplug work
  - !6473  nvme-fc: do not wait in vain when unloading module
  - media: dvb-frontends: avoid stack overflow warnings with clang
  - !6802  x86,static_call: Fix __static_call_return0 for i386
  - serial/pmac_zilog: Remove flawed mitigation for rx irq flood
  - !6835  kprobes: Fix check for probe enabled in kill_kprobe()
  - erofs: fix pcluster use-after-free on UP platforms
  - perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling
  - drm/tegra: dsi: Add missing check for of_find_device_by_node
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - !6799  rtmutex: Add acquire semantics for rtmutex lock acquisition slow path
  - kprobes: Fix check for probe enabled in kill_kprobe()
  - !6797  scsi: target: core: Add TMF to tmr_list handling
  - fat: fix uninitialized field in nostale filehandles
  - !6798  media: ir_toy: fix a memleak in irtoy_tx
  - af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
  - af_unix: Fix garbage collector racing against connect()
  - !6756  vfio/fsl-mc: Block calling interrupt handler without trigger
  - x86,static_call: Fix __static_call_return0 for i386
  - !6704  x86/thermal: Fix LVT thermal setup for SMI delivery mode
  - !6702  static_call: Don't make __static_call_return0 static
  - rtmutex: Add acquire semantics for rtmutex lock acquisition slow path
  - !6700  PCI/IOV: Enlarge virtfn sysfs name buffer
  - !5905 [OLK 5.10] RDMA/hns: Fix incorrect iteration number of DCA umem sg entries and error return in hns_roce_v2_modify_srq()
  - media: ir_toy: fix a memleak in irtoy_tx
  - scsi: target: core: Add TMF to tmr_list handling
  - !6684  infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver
  - !6755  binder: check offset alignment in binder_get_object()
  - !6729  PCI/IOV: Improve performance of creating VFs concurrently
  - !6669  NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - !6680  cifs: fix underflow in parse_server_interfaces()
  - !6719  drm/amdgpu: validate the parameters of bo mapping operations more clearly
  - vfio/fsl-mc: Block calling interrupt handler without trigger
  - binder: check offset alignment in binder_get_object()
  - !6739 v2  Apply patches of ses from stable
  - !6677 v3  olk-5.10: bugfix for mm
  - !6654  net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
  - !6683 v2  CVE-2024-26921
  - cpuset: fix race between rebuild scheduler domains and hotplug work
  - scsi: ses: Handle enclosure with just a primary component gracefully
  - Revert "scsi: ses: Handle enclosure with just a primary component gracefully"
  - Revert "scsi: ses: Fix crash caused by kfree an invalid pointer"
  - scsi: ses: Fix possible desc_ptr out-of-bounds accesses
  - Revert "scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process"
  - !6501  cachefiles: fix memory leak in cachefiles_add_cache()
  - PCI/IOV: Improve performance of creating VFs concurrently
  - drm/amdgpu: validate the parameters of bo mapping operations more clearly
  - !6676  cvm feature patches
  - x86/thermal: Fix LVT thermal setup for SMI delivery mode
  - static_call: Don't make __static_call_return0 static
  - PCI/IOV: Enlarge virtfn sysfs name buffer
  - !6567  CVE-2024-26896
  - !6580  drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  - infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver
  - net/ethernet/huawei/hinic3: Add the CQM on which the RDMA depends
  - sk_buff: Fix KABI break for the modification of struct sk_buff
  - inet: inet_defrag: prevent sk release while still in use
  - net: Fix KABI break for introducing is_skb_wmem()
  - skb_expand_head() adjust skb->truesize incorrectly
  - skbuff: introduce skb_expand_head()
  - cifs: fix underflow in parse_server_interfaces()
  - mm/madvise: fix potential pte_unmap_unlock pte error
  - mm/page_alloc: always attempt to allocate at least one page during bulk allocation
  - gicv3: add lpi support for cvm guest
  - config: modify arm64 defconfig for cvm feature
  - mm: enable swiotlb alloc for cvm share mem
  - swiotlb: add swiotlb io_tlb_list release slots methd
  - swiotlb: Add restricted DMA alloc/free support
  - kvm: add support for multi-numa and fix kabi change
  - pmu: enable pmu phys irq inject for cvm
  - kvm: add cvm host feature
  - !6660 udma: fix bugs of record_db
  - !6640  hsr: Fix uninit-value access in hsr_get_node()
  - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
  - !6620  packet: annotate data-races around ignore_outgoing
  - !6618  net/bnx2x: Prevent access to a freed page in page_pool
  - !6592  net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  - !6619  Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - !6635 backport RDMA/hns: Fix DCA's dependence on ib_uverbs from OLK-6.6
  - hns3 udma: addressing stage adaptation
  - !6257 HNS3: Do some optimizing job and support fast path
  - !6623  amdkfd: use calloc instead of kzalloc to avoid integer overflow
  - hns3 udma: unified coding style
  - hns3 udma: Interface for adding a user ctrl.
  - hsr: Fix uninit-value access in hsr_get_node()
  - !6561  md: fix kmemleak of rdev->serial
  - !6631 Backport 5.10.205 LTS patches from upstream
  - powerpc/ftrace: Fix stack teardown in ftrace_no_trace
  - powerpc/ftrace: Create a dummy stackframe to fix stack unwind
  - tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf()
  - tty: n_gsm, remove duplicates of parameters
  - tty: n_gsm: fix tty registration before control channel open
  - USB: gadget: core: adjust uevent timing on gadget unbind
  - ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs
  - ring-buffer: Fix writing to the buffer with max_data_size
  - ring-buffer: Have saved event hold the entire event
  - tracing: Update snapshot buffer on resize if it is allocated
  - ring-buffer: Fix memory leak of free page
  - team: Fix use-after-free when an option instance allocation fails
  - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify
  - soundwire: stream: fix NULL pointer dereference for multi_link
  - HID: hid-asus: add const to read-only outgoing usb buffer
  - net: usb: qmi_wwan: claim interface 4 for ZTE MF290
  - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation
  - HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad
  - HID: hid-asus: reset the backlight brightness level on resume
  - HID: add ALWAYS_POLL quirk for Apple kb
  - HID: glorious: fix Glorious Model I HID report
  - platform/x86: intel_telemetry: Fix kernel doc descriptions
  - bcache: avoid NULL checking to c->root in run_cache_set()
  - bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc()
  - bcache: remove redundant assignment to variable cur_idx
  - bcache: avoid oversize memory allocation by small stripe_size
  - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!"
  - usb: aqc111: check packet for fixup for true limit
  - drm/mediatek: Add spinlock for setting vblank event in atomic_begin
  - Revert "PCI: acpiphp: Reassign resources on bridge if necessary"
  - ALSA: hda/realtek: Apply mute LED quirk for HP15-db
  - ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants
  - fuse: dax: set fc->dax to NULL in fuse_dax_conn_free()
  - net: atlantic: fix double free in ring reinit logic
  - net: stmmac: Handle disabled MDIO busses from devicetree
  - net: stmmac: use dev_err_probe() for reporting mdio bus registration failure
  - vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space()
  - sign-file: Fix incorrect return values check
  - net: ena: Fix XDP redirection error
  - net: ena: Destroy correct number of xdp queues upon failure
  - net: Remove acked SYN flag from packet in the transmit queue correctly
  - qed: Fix a potential use-after-free in qed_cxt_tables_alloc
  - net: fec: correct queue selection
  - net: vlan: introduce skb_vlan_eth_hdr()
  - atm: solos-pci: Fix potential deadlock on &tx_queue_lock
  - atm: solos-pci: Fix potential deadlock on &cli_queue_lock
  - qca_spi: Fix reset behavior
  - qca_debug: Fix ethtool -G iface tx behavior
  - qca_debug: Prevent crash on TX ring changes
  - HID: lenovo: Restrict detection of patched firmware only to USB cptkbd
  - afs: Fix refcount underflow from error handling race
  - netfilter: nf_tables: fix 'exist' matching on bigendian arches
  - !6485  CVE-2024-26843
  - HNS3: Support debugfs dump fastpath info
  - Support configuration of fastpath feature
  - !6247  ubi: Check for too small LEB size in VTBL code
  - amdkfd: use calloc instead of kzalloc to avoid integer overflow
  - packet: annotate data-races around ignore_outgoing
  - !6539 Backport 5.10.204 LTS patches from upstream
  - !6546 v2  CVE-2024-26907
  - Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - net/bnx2x: Prevent access to a freed page in page_pool
  - !6597 v3  Fix CVE-2024-26869
  - !6401  btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
  - !6555 udma: fix bugs in non-share jfr and remove rm mode
  - !6568  IB/hfi1: Fix a memleak in init_credit_return
  - !6579  media: rc: bpf attach/detach requires write permission
  - !6543  net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  - !6520  firmware: arm_scmi: Fix double free in SMC transport cleanup path
  - !6584  ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  - f2fs: fix to truncate meta inode pages forcely
  - f2fs: invalidate meta pages only for post_read required inode
  - f2fs: fix to invalidate META_MAPPING before DIO write
  - f2fs: invalidate META_MAPPING before IPU/DIO write
  - !6566  nfc: nci: free rx_data_reassembly skb on NCI device cleanup
  - !6588  Add hugetlb MADV_DONTNEED support
  - !6437  dm: call the resume method on internal suspend
  - !6442  scsi: pm80xx: Fix memory leak during rmmod
  - !6474  do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  - hugetlb: don't delete vma_lock in hugetlb MADV_DONTNEED processing
  - madvise: use zap_page_range_single for madvise dontneed
  - mm,madvise,hugetlb: fix unexpected data loss with MADV_DONTNEED on hugetlbfs
  - mm: enable MADV_DONTNEED for hugetlb mappings
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  - media: rc: bpf attach/detach requires write permission
  - !6417  media: pvrusb2: fix uaf in pvr2_context_set_notify
  - !6493  RDMA/srpt: Do not register event handler until srpt device is fully setup
  - IB/hfi1: Fix a memleak in init_credit_return
  - wifi: wfx: fix memory leak when starting AP
  - nfc: nci: free rx_data_reassembly skb on NCI device cleanup
  - !6458  CVE-2024-26813
  - md: fix kmemleak of rdev->serial
  - hns3 udma: modifying the sge address offset in RC Mode.
  - RDMA/mlx5: Fix fortify source warning while accessing Eth segment
  - uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++
  - stddef: Introduce DECLARE_FLEX_ARRAY() helper
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  - hns3 udma: Code clipping related to RM mode.
  - hns3 udma: Modify qpn alloc function when share jfr is disabled.
  - r8169: fix rtl8125b PAUSE frames blasting when suspended
  - devcoredump: Send uevent once devcd is ready
  - devcoredump : Serialize devcd_del work
  - smb: client: fix potential NULL deref in parse_dfs_referrals()
  - cifs: Fix non-availability of dedup breaking generic/304
  - Revert "btrfs: add dmesg output for first mount and last unmount of a filesystem"
  - mmc: block: Be sure to wait while busy in CQE error recovery
  - platform/x86: asus-wmi: Document the dgpu_disable sysfs attribute
  - tools headers UAPI: Sync linux/perf_event.h with the kernel sources
  - platform/x86: asus-wmi: Fix kbd_dock_devid tablet-switch reporting
  - MIPS: Loongson64: Enable DMA noncoherent support
  - MIPS: Loongson64: Reserve vgabios memory on boot
  - KVM: s390/mm: Properly reset no-dat
  - serial: 8250_omap: Add earlycon support for the AM654 UART controller
  - serial: 8250: 8250_omap: Do not start RX DMA on THRI interrupt
  - serial: 8250: 8250_omap: Clear UART_HAS_RHR_IT_DIS bit
  - serial: sc16is7xx: address RX timeout interrupt errata
  - ARM: PL011: Fix DMA support
  - usb: typec: class: fix typec_altmode_put_partner to put plugs
  - Revert "xhci: Loosen RPM as default policy to cover for AMD xHC 1.1"
  - parport: Add support for Brainboxes IX/UC/PX parallel cards
  - usb: gadget: f_hid: fix report descriptor allocation
  - gpiolib: sysfs: Fix error handling on failed export
  - tracing: Stop current tracer when resizing buffer
  - tracing: Set actual size after ring buffer resize
  - ring-buffer: Force absolute timestamp on discard of event
  - misc: mei: client.c: fix problem of return '-EOVERFLOW' in mei_cl_write
  - misc: mei: client.c: return negative error code in mei_cl_write
  - arm64: dts: mediatek: mt8183: Fix unit address for scp reserved memory
  - arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names
  - arm64: dts: mediatek: mt7622: fix memory node warning check
  - packet: Move reference count in packet_sock to atomic_long_t
  - tracing: Fix a possible race when disabling buffered events
  - tracing: Fix incomplete locking when disabling buffered events
  - tracing: Disable snapshot buffer when stopping instance tracers
  - tracing: Always update snapshot buffer size
  - checkstack: fix printed address
  - nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
  - nilfs2: fix missing error check for sb_set_blocksize call
  - ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
  - ALSA: pcm: fix out-of-bounds in snd_pcm_state_names
  - riscv: fix misaligned access handling of C.SWSP and C.SDSP
  - ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt
  - ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init
  - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle()
  - tracing: Fix a warning when allocating buffered events fails
  - ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate
  - hwmon: (acpi_power_meter) Fix 4.29 MW bug
  - RDMA/bnxt_re: Correct module description string
  - RDMA/rtrs-clt: Remove the warnings for req in_use check
  - arm64: dts: rockchip: Expand reg size of vdec node for RK3399
  - tee: optee: Fix supplicant based device enumeration
  - bpf: sockmap, updating the sg structure should also update curr
  - tcp: do not accept ACK of bytes we never sent
  - netfilter: xt_owner: Fix for unsafe access of sk->sk_socket
  - ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit()
  - ionic: Fix dim work handling in split interrupt mode
  - ionic: fix snprintf format length warning
  - net: bnxt: fix a potential use-after-free in bnxt_init_tc
  - i40e: Fix unexpected MFS warning message
  - arcnet: restoring support for multiple Sohard Arcnet cards
  - net: arcnet: com20020 fix error handling
  - mlxbf-bootctl: correctly identify secure boot with development keys
  - hv_netvsc: rndis_filter needs to select NLS
  - octeontx2-pf: Add missing mutex lock in otx2_get_pauseparam
  - ipv6: fix potential NULL deref in fib6_add()
  - of: dynamic: Fix of_reconfig_get_state_change() return value documentation
  - of: Add missing 'Return' section in kerneldoc comments
  - of: Fix kerneldoc output formatting
  - of: base: Fix some formatting issues and provide missing descriptions
  - platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code
  - platform/x86: asus-wmi: Simplify tablet-mode-switch handling
  - platform/x86: asus-wmi: Simplify tablet-mode-switch probing
  - platform/x86: asus-wmi: Add support for ROG X13 tablet mode
  - platform/x86: asus-wmi: Adjust tablet/lidflip handling to use enum
  - asus-wmi: Add dgpu disable method
  - platform/x86: asus-nb-wmi: Add tablet_mode_sw=lid-flip quirk for the TP200s
  - platform/x86: asus-nb-wmi: Allow configuring SW_TABLET_MODE method with a module option
  - platform/x86: asus-wmi: Add support for SW_TABLET_MODE on UX360
  - kconfig: fix memory leak from range properties
  - tg3: Increment tx_dropped in tg3_tso_bug()
  - tg3: Move the [rt]x_dropped counters to tg3_napi
  - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test
  - i2c: designware: Fix corrupted memory seen in the ISR
  - firmware: arm_scmi: Fix double free in SMC transport cleanup path
  - cachefiles: fix memory leak in cachefiles_add_cache()
  - RDMA/hns: Fix DCA's dependence on ib_uverbs
  - RDMA/srpt: Do not register event handler until srpt device is fully setup
  - efi: runtime: Fix potential overflow of soft-reserved region size
  - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  - nvme-fc: do not wait in vain when unloading module
  - vfio/platform: Create persistent IRQ handlers
  - vfio/platform: Disable virqfds on cleanup
  - HNS3: Solve the problem that the tc qdisc configuration in the hardware registration cannot be cleared
  - HNS3: Modify the io process of unic to improve bandwidth
  - HNS3: Do some cleancode job to eliminate warnings
  - HNS3: Change the function name from ubn to ubl
  - HNS3: fix up magic numbers and impertinent judge position
  - scsi: pm80xx: Fix memory leak during rmmod
  - dm: call the resume method on internal suspend
  - media: pvrusb2: fix uaf in pvr2_context_set_notify
  - btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
  - RDMA/hns: Fix incorrect iteration number of DCA umem sg entries
  - RDMA/hns: fix error return in hns_roce_v2_modify_srq()
  - ubi: Check for too small LEB size in VTBL code


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-199.0.0.112
changelog:
  - !7018  fix CVE-2024-26865
  - !7226  x86/fpu: Invalidate FPU state correctly on exec()
  - !7128 Backport 5.10.206 LTS patches from upstream
  - x86/fpu: Invalidate FPU state correctly on exec()
  - !7213 v2  cpufreq/cppc: fix perf_to_khz/khz_to_perf conversion
  - smb3: Replace smb2pdu 1-element arrays with flex-arrays
  - !7204 udma: fix bugs of DCA and record db
  - cpufreq/cppc: fix perf_to_khz/khz_to_perf conversion
  - !6744  cpufreq/cppc: changing highest_perf to nominal_perf in cppc_cpufreq_cpu_init()
  - !7048  nilfs2: prevent kernel bug at submit_bh_wbc()
  - !7174  CVE-2022-48689
  - !6783 [OLK-5.10] fix HEST memory usage is too high
  - !6685 v2  char: imx-rngc: fix clk_disable_unprepare missing in error path
  - !7189  NTB: fix possible name leak in ntb_register_device()
  - hns3 udma: resolve the problem when resources are reclaimed.
  - hns3 udma: fixed a bug when enabling DCA.
  - NTB: fix possible name leak in ntb_register_device()
  - !7177  ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  - !7122 v2  clk: zynq: Prevent null pointer dereference caused by kmalloc failure
  - !7031  Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
  - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  - tcp: TX zerocopy should not sense pfmemalloc status
  - net: skbuff: update comment about pfmemalloc propagating
  - net: introduce __skb_fill_page_desc_noacc
  - tcp: factor out tcp_build_frag()
  - !6972  ksmbd: validate payload size in ipc response
  - !7143  media: usbtv: Remove useless locks in usbtv_video_free()
  - !6809  memcg: fix possible use-after-free in memcg_write_event_control()
  - !7148  scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - !7139  SUNRPC: fix some memleaks in gssx_dec_option_array
  - !7129  SUNRPC: fix a memleak in gss_import_v2_context
  - scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - spi: atmel: Fix PDC transfer setup bug
  - Bluetooth: SMP: Fix crash when receiving new connection when debug is enabled
  - Revert "MIPS: Loongson64: Enable DMA noncoherent support"
  - dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
  - netfilter: nf_tables: skip set commit for deleted/destroyed sets
  - tracing: Fix blocked reader of snapshot buffer
  - ring-buffer: Fix wake ups when buffer_percent is set to 100
  - spi: atmel: Fix CS and initialization bug
  - spi: atmel: Switch to transfer_one transfer method
  - smb: client: fix OOB in SMB2_query_info_init()
  - usb: fotg210-hcd: delete an incorrect bounds test
  - Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE
  - Bluetooth: use inclusive language in SMP
  - Bluetooth: SMP: Convert BT_ERR/BT_DBG to bt_dev_err/bt_dev_dbg
  - ARM: dts: Fix occasional boot hang for am3 usb
  - 9p/net: fix possible memory leak in p9_check_errors()
  - x86/alternatives: Sync core before enabling interrupts
  - lib/vsprintf: Fix %pfwf when current node refcount == 0
  - bus: ti-sysc: Flush posted write only after srst_udelay
  - tracing / synthetic: Disable events after testing in synth_event_gen_test_init()
  - dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp
  - net: ks8851: Fix TX stall caused by TX buffer overrun
  - net: rfkill: gpio: set GPIO direction
  - net: 9p: avoid freeing uninit memory in p9pdu_vreadf
  - Input: soc_button_array - add mapping for airplane mode button
  - Bluetooth: L2CAP: Send reject on command corrupted request
  - Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
  - USB: serial: option: add Quectel RM500Q R13 firmware support
  - USB: serial: option: add Foxconn T99W265 with new baseline
  - USB: serial: option: add Quectel EG912Y module support
  - USB: serial: ftdi_sio: update Actisense PIDs constant names
  - wifi: cfg80211: fix certs build to not depend on file order
  - wifi: cfg80211: Add my certificate
  - iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma()
  - iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
  - scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
  - Input: ipaq-micro-keys - add error handling for devm_kmemdup
  - iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
  - interconnect: Treat xlate() returning NULL node as an error
  - btrfs: do not allow non subvolume root targets for snapshot
  - smb: client: fix NULL deref in asn1_ber_decoder()
  - ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB
  - ALSA: hda/hdmi: Add quirk to force pin connectivity on NUC10
  - pinctrl: at91-pio4: use dedicated lock class for IRQ
  - i2c: aspeed: Handle the coalesced stop conditions with the start conditions.
  - afs: Fix overwriting of result of DNS query
  - keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry
  - net: check dev->gso_max_size in gso_features_check()
  - net: warn if gso_type isn't set for a GSO SKB
  - afs: Fix dynamic root lookup DNS check
  - afs: Fix the dynamic root's d_delete to always delete unused dentries
  - net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
  - net/rose: fix races in rose_kill_by_device()
  - ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
  - net: sched: ife: fix potential use-after-free
  - net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors
  - net/mlx5: Fix fw tracer first block check
  - net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list()
  - Revert "net/mlx5e: fix double free of encap_header"
  - wifi: mac80211: mesh_plink: fix matches_local logic
  - s390/vx: fix save/restore of fpu kernel context
  - reset: Fix crash when freeing non-existent optional resets
  - ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init
  - smb: client: fix OOB in smb2_query_reparse_point()
  - ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE
  - media: usbtv: Remove useless locks in usbtv_video_free()
  - SUNRPC: fix some memleaks in gssx_dec_option_array
  - !7044 v2  nfs: fix UAF in direct writes
  - !7092  Squashfs: check the inode number is not the invalid value of zero
  - SUNRPC: fix a memleak in gss_import_v2_context
  - clk: zynq: Prevent null pointer dereference caused by kmalloc failure
  - !6965 v2  memcg: fix incorrect value of sysctl_memcg_swap_qos_stat
  - !7054  CVE-2024-27024
  - !7047  backport patch for thp deferred list
  - !7080  drm: nv04: Fix out of bounds access
  - !7086  media: ttpci: fix two memleaks in budget_av_attach
  - !7042  CVE-2024-27034
  - !6818  mm: memcg: fix stale protection of reclaim target memcg
  - Squashfs: check the inode number is not the invalid value of zero
  - media: ttpci: fix two memleaks in budget_av_attach
  - !7013  media: edia: dvbdev: fix a use-after-free
  - !6994 v2  net/mlx5e: Prevent deadlock while disabling aRFS
  - drm: nv04: Fix out of bounds access
  - !7039  USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - !6655 [OLK-5.10] mucse rnpm driver fw mailbox maybe failed to communicate with PF for mucse N10/N400 chips
  - !5964 drivers: close default yusur KPU FLEXFLOW-2100P driver support
  - !6954 [OLK-5.10]Fix some bugs of the Mini-IO module
  - !7056  scsi: qla2xxx: Fix command flush on cable pull
  - !7006  wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - !7003  wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
  - !7041  netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  - scsi: qla2xxx: Fix command flush on cable pull
  - net/rds: fix possible cp null dereference
  - net/rds: fix WARNING in rds_conn_connect_if_down
  - nilfs2: prevent kernel bug at submit_bh_wbc()
  - THP: avoid lock when check whether THP is in deferred list
  - mm/mmu_gather: limit free batch count and add schedule point in tlb_batch_pages_flush
  - nfs: fix UAF in direct writes
  - f2fs: compress: fix to cover normal cluster write with cp_rwsem
  - f2fs: reduce stack memory cost by using bitfield in struct f2fs_io_info
  - f2fs: replace congestion_wait() calls with io_schedule_timeout()
  - f2fs: fix to stop filesystem update once CP failed
  - !6990  netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  - !7000  fix CVE-2024-27010
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
  - !6843 v2  scsi: core: Fix unremoved procfs host directory regression
  - !6939  USB: core: Fix deadlock in usb_deauthorize_interface()
  - !6906  drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  - !6977  wireguard: netlink: access device through ctx instead of peer
  - !6956  netfilter: nf_tables: fix memleak in map from abort path
  - !6988  clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - !6914  usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
  - !6855  KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
  - tcp: Clean up kernel listener's reqsk in inet_twsk_purge()
  - media: edia: dvbdev: fix a use-after-free
  - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
  - net/sched: fix kabi change in struct Qdisc
  - net/sched: Fix mirred deadlock on device recursion
  - net/mlx5e: Prevent deadlock while disabling aRFS
  - !6943  speakup: Avoid crash on very long word
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - !6959  mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - !6932  net: enetc: deny offload of tc-based TSN features on VF interfaces
  - !6689  quota: Fix potential NULL pointer dereference
  - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - !6964 v2  CVE-2024-27000
  - wireguard: netlink: access device through ctx instead of peer
  - !6891  ima: fix deadlock when traversing "ima_default_rules".
  - ksmbd: validate payload size in ipc response
  - !6872  pstore: inode: Only d_invalidate() is needed
  - !6882  f2fs: compress: fix to guarantee persisting compressed blocks by CP
  - !6895  tun: limit printing rate when illegal packet received by tun dev
  - !6879  net/smc: Fix possible access to freed memory in link clear
  - !6736  add LTS patches to OLK-5.10
  - memcg: fix incorrect value of sysctl_memcg_swap_qos_stat
  - serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
  - serial: mxs-auart: add spinlock around changing cts state
  - serial: core: Provide port lock wrappers
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - netfilter: nf_tables: fix memleak in map from abort path
  - spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
  - i2c: hisi: Correct the description comment for PIN_MUX METHOD
  - i2c: hisi: Add I2C controller reset and initialization proccess in bus recovery action
  - speakup: Avoid crash on very long word
  - USB: core: Fix deadlock in usb_deauthorize_interface()
  - net: enetc: deny offload of tc-based TSN features on VF interfaces
  - usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
  - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  - tun: limit printing rate when illegal packet received by tun dev
  - ima: fix deadlock when traversing "ima_default_rules".
  - f2fs: compress: fix to guarantee persisting compressed blocks by CP
  - net/smc: Fix possible access to freed memory in link clear
  - pstore: inode: Only d_invalidate() is needed
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - scsi: core: Fix unremoved procfs host directory regression
  - mm: memcg: fix stale protection of reclaim target memcg
  - ACPI: APEI: Skip initialization of GHES_ASSIST structures for Machine Check Architecture
  - memcg: fix possible use-after-free in memcg_write_event_control()
  - cpufreq/cppc: changing highest_perf to nominal_perf in cppc_cpufreq_cpu_init()
  - net: fix kabi in struct ipv6_devconf
  - net: release reference to inet6_dev pointer
  - net: change accept_ra_min_rtr_lft to affect all RA lifetimes
  - net: add sysctl accept_ra_min_rtr_lft
  - genetlink: fix kabi change in struct genl_multicast_group
  - genetlink: Use internal flags for multicast groups
  - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group
  - genetlink: add CAP_NET_ADMIN test for multicast bind
  - quota: Fix potential NULL pointer dereference
  - char: imx-rngc: fix clk_disable_unprepare missing in error path
  - mucse: rnpm fw mailbox maybe failed to communicate with PF
  - drivers: close default yusur KPU FLEXFLOW-2100P driver support


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-200.0.0.113
changelog:
  - !7644  hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - !7705  pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
  - !7749 v2  wifi: iwlwifi: dbg-tlv: ensure NUL termination
  - !7651 fix the SPI driver failed to obtain the GPIO pin
  - !7655 v3  KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
  - !7675  bpf: Guard stack limits against 32bit overflow
  - !7732 HNS3: Fixed a deadlock issue caused by concurrent VF deactivation and PF reset
  - !7722 urma: fix bugs of urma and udma
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination
  - !7686  ext4: fix corruption during on-line resize
  - !7599  irqchip/gic-v3-its: Prevent double free on error
  - !7674  net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
  - HNS3: Fixed a deadlock issue caused by concurrent VF deactivation and PF reset
  - hns3 udma: support user-mode TP connection API
  - urma: upload kernel patch for 20240516_day
  - urma: upload kernel patch for 20240511_mig
  - urma: upload kernel patch for 20240318_happy_birthday
  - urma: upload kernel patch for 20240224_rain
  - urma: upload kernel patch for 20240219_Spring
  - !7579  powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  - !7665 [sync] PR-7586:  powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - !7661 [sync] PR-7590:  drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
  - pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
  - ext4: fix corruption during on-line resize
  - !7574  pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match
  - driver core: Provide device_match_acpi_handle() helper
  - bpf: Guard stack limits against 32bit overflow
  - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
  - !7601  cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  - powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
  - !7588  mm/swapfile: fix infinite loop in get_swap_pages after set memory.swapfile
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
  - !7563 udma: fix a bug of segment
  - !7385  CVE-2024-27002
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - !7577 spi: hisi-kunpeng：backport some bugfixes
  - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  - irqchip/gic-v3-its: Prevent double free on error
  - !7548  btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - mm/swapfile: fix infinite loop in get_swap_pages after set memory.swapfile
  - powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
  - spi: Add verification for the max_frequency provided by the firmware
  - spi: hisi-kunpeng: switch to use modern name
  - spi: hisi-kunpeng: Fix error checking
  - !7520  drm/i915/gt: Reset queue_priority_hint on parking
  - hns3 udma: the SEG registration failure is rectified.
  - !7538 v2  rcu: shorten the critical section that rnp->lock protects in rcu_dump_cpu_stacks
  - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - !5557 [OLK-5.10]Add support for Mont-TSSE
  - !4642 Add support for Hygon family 18h model 5h HD-Audio
  - !4640 Add support for Hygon model 6h L3 PMU
  - !4639 Some fixes for Hygon model 4h~6h processors
  - !4641 Add support for Hygon model 4h QoS
  - !2583 [OLK-5.10] Driver for Zhaoxin AES and SHA algorithm
  - !6801  block: fix discard
  - rcu: shorten the critical section that rnp->lock protects in rcu_dump_cpu_stacks
  - !7515 [sync] PR-7483:  Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - !7356  blk-iocost: Fix an UBSAN shift-out-of-bounds warning
  - !7351  PM / devfreq: Synchronize devfreq_monitor_[start/stop
  - !7361  sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - drm/i915/gt: Reset queue_priority_hint on parking
  - !7484  fix CVE-2024-26661
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - !7402  scsi: lpfc: Fix possible file string name overflow when updating firmware
  - !7404  scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - !7403  scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  - !7400  net/tg3: fix race condition in tg3_reset_task()
  - !7401  nvme-core: check for too small lba shift
  - !7396  drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
  - !7397  drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  - !7398  drm/amd/display: Fix memory leak in dm_sw_fini()
  - !7399  drm/amd/pm: fix a double-free in si_dpm_init
  - drm/amd/display: Fix && vs || typos
  - drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
  - !7476  firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - !7456  netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !6524  Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - !7424  net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - !7346  ppp_async: limit MRU to 64K
  - !5793  um: time-travel: fix time corruption
  - !7315  CVE-2024-26686
  - firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - !7297  powerpc/kasan: Fix addr error caused by page alignment
  - !7229  s390/zcrypt: fix reference counting on zcrypt card objects
  - !7234  SUNRPC: Fix a suspicious RCU usage warning
  - !7235  bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  - !7394 v2  scsi: sr: Do not leak information in ioctl
  - !7308  iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !7420  x86/CPU/AMD: Update the Zenbleed microcode revisions
  - !7426  net: gtp: Fix Use-After-Free in gtp_dellink
  - !7437  x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  - !7368  bugfix from mainline
  - !7416  cpu/SMT: Make SMT control more robust against enumeration failures
  - net: gtp: Fix Use-After-Free in gtp_dellink
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - x86/CPU/AMD: Update the Zenbleed microcode revisions
  - !7414  clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
  - !7218  CVE-2024-27017
  - cpu/SMT: Make SMT control more robust against enumeration failures
  - clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
  - !7223  major bugfix before 2023
  - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  - scsi: lpfc: Fix possible file string name overflow when updating firmware
  - nvme-core: check for too small lba shift
  - net/tg3: fix race condition in tg3_reset_task()
  - drm/amd/pm: fix a double-free in si_dpm_init
  - drm/amd/display: Fix memory leak in dm_sw_fini()
  - drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  - drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
  - scsi: sr: Do not leak information in ioctl
  - !5469  wifi: iwlwifi: fix a memory corruption
  - clk: mediatek: Do a runtime PM get on controllers during probe
  - x86/srso: Fix vulnerability reporting for missing microcode
  - x86/srso: Don't probe microcode in a guest
  - x86/srso: Set CPUID feature bits independently of bug or mitigation status
  - sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - blk-iocost: Fix an UBSAN shift-out-of-bounds warning
  - PM / devfreq: Synchronize devfreq_monitor_[start/stop]
  - ppp_async: limit MRU to 64K
  - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
  - fs/proc: do_task_stat: use __for_each_thread()
  - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand()
  - exit: Use the correct exit_code in /proc/<pid>/stat
  - iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  - powerpc/kasan: Fix addr error caused by page alignment
  - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  - SUNRPC: Fix a suspicious RCU usage warning
  - s390/zcrypt: fix reference counting on zcrypt card objects
  - powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()
  - irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling
  - genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
  - netfilter: nf_tables: missing iterator type in lookup walk
  - netfilter: nft_set_pipapo: walk over current view on netlink dump
  - block: check io size before submit discard
  - block: fix overflow in blk_ioctl_discard()
  - Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - um: time-travel: fix time corruption
  - add support for Mont-TSSE Driver
  - wifi: iwlwifi: fix a memory corruption
  - EDAC/amd64: Adjust UMC channel for Hygon family 18h model 6h
  - x86/amd_nb: Get DF ID from F5 device for Hygon family 18h model 6h
  - EDAC/amd64: Fix intlv_num_chan for Hygon family 18h model 4h
  - EDAC/amd64: Revert hi_addr_offset for Hygon family 18h model 4h
  - ALSA: hda: Fix single byte write failure issue for Hygon
  - ALSA: hda: Add Hygon HD-Audio support
  - x86/resctrl: Add Hygon QoS support
  - perf/x86/uncore: Add L3 PMU support for Hygon family 18h model 6h
  - configs: Add Zhaoxin aes/sha items in openeuler_config
  - Zhaoxin: Driver for Zhaoxin SHA algorithm
  - Zhaoxin: Driver for Zhaoxin AES algorithm


author: ningyu<ningyu9@huawei.com> - 1.2.1-3
changelog:
  - upatch-hijacker: fix compile bug
  - daemon: fix 'cannot get file selinux xattr when selinux is not enforcing' issue
  - syscared: fix 'syscare check command does not check symbol confiliction' issue
  - syscared: fix 'cannot find process of dynlib patch' issue
  - Change uuid type from string to uuid bytes
  - syscared: optimize patch error logic
  - syscared: optimize transaction creation logic
  - upatch-manage: optimize output
  - syscared: optimize patch error logic
  - syscared: optimize transaction creation logic
  - spec: fix "cannot find syscare service after upgrade" bug


author: ningyu<ningyu9@huawei.com> - 1.2.1-4
changelog:
  - syscared: stop activating ignored process on new process start
  - syscared: adapt upatch-manage exit code change
  - upatch-manage: change exit code
  - upatch-manage: change the way to calculate frozen time


author: renoseven<dev@renoseven.net> - 1.2.1-6
changelog:
  - upatch-diff: fix 'lookup_elf failed' issue
  - upatch-manage: fixed the core dump issue after applying hot patches to nginx on x86_64 architecture
  - security: change daemon socket permission
  - security: change directory permission
  - upatch-build: fix 'file detection cause build failure' issue
  - syscared: stop activating ignored process on new process start


author: ningyu<ningyu9@huawei.com> - 1.2.1-7
changelog:
  - upatch-diff: remove rela check while build rebuilding .eh_frame
  - upatch-diff: only check changed file symbols


