# changelog

author: yinbin6 <yinbin8@huawei.com> - 1.0.2-47
changelog:
  - fix coredump when get empty from udp sendring
  - [virtio]: distribute pkg by dst_port
  - parse packages type in rx_poll
  - [virtio]: cfg ipv4 and ipv6 addr
  - fix build failed in 2003sp4
  - fix dpdk_bond_primary_set bug
  - cfg: del unnecessary logs
  - perftool: add latency tool


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-48
changelog:
  - add flow_bifurcation switch in lstack_cfg file
  - virtio: dfx data of virtio
  - virtio: update g_rule_port by reg_ring_type enum
  - virtio: mode actual_queue_num
  - fix poll init not clear old fd


author: seuzw <930zhaowei@163.com> - 2.4.51-13
changelog:
  - Type:cves
  - ID:CVE-2022-36760,CVE-2006-20001,CVE-2022-37436
  - SUG:restart
  - DESC:fix CVE-2022-36760,CVE-2006-20001,CVE-2022-37436


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-15
changelog:
  - Type:CVE
  - ID:CVE-2023-27522, CVE-2023-25690
  - SUG:restart
  - DESC:fix CVE-2023-27522, CVE-2023-25690


author: chengyechun <chengyehcun1@huawei.com> - 2.4.51-16
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:Report an error if the AJP backend sends an invalid number of headers
         handled a negative value when parsing the config
         avoid delimiting the query with a backreference
         fix missing APLOGNO


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-17
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:Fix double encoding of the uri-path of the request
         Do not match the extention against possible query string
         Do not double encode slashes
         Check before forwarding that a nocanon path has not been rewriteen


author: panchenbo <panchenbo@kylinsec.com.cn> - 2.4.51-18
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:add sw_64 support,optimize sw build patch,add loongarch64 support


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-21
changelog:
  - Type:CVE
  - ID:CVE-2024-24795,CVE-2023-38709,CVE-2024-27316
  - SUG:NA
  - DESC:fix CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 and sync some patches from upstream


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-22
changelog:
  - Type:CVE
  - ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573
  - SUG:NA
  - DSEC:fix some CVEs


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-199.0.0.112
changelog:
  - !7018  fix CVE-2024-26865
  - !7226  x86/fpu: Invalidate FPU state correctly on exec()
  - !7128 Backport 5.10.206 LTS patches from upstream
  - x86/fpu: Invalidate FPU state correctly on exec()
  - !7213 v2  cpufreq/cppc: fix perf_to_khz/khz_to_perf conversion
  - smb3: Replace smb2pdu 1-element arrays with flex-arrays
  - !7204 udma: fix bugs of DCA and record db
  - cpufreq/cppc: fix perf_to_khz/khz_to_perf conversion
  - !6744  cpufreq/cppc: changing highest_perf to nominal_perf in cppc_cpufreq_cpu_init()
  - !7048  nilfs2: prevent kernel bug at submit_bh_wbc()
  - !7174  CVE-2022-48689
  - !6783 [OLK-5.10] fix HEST memory usage is too high
  - !6685 v2  char: imx-rngc: fix clk_disable_unprepare missing in error path
  - !7189  NTB: fix possible name leak in ntb_register_device()
  - hns3 udma: resolve the problem when resources are reclaimed.
  - hns3 udma: fixed a bug when enabling DCA.
  - NTB: fix possible name leak in ntb_register_device()
  - !7177  ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  - !7122 v2  clk: zynq: Prevent null pointer dereference caused by kmalloc failure
  - !7031  Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
  - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  - tcp: TX zerocopy should not sense pfmemalloc status
  - net: skbuff: update comment about pfmemalloc propagating
  - net: introduce __skb_fill_page_desc_noacc
  - tcp: factor out tcp_build_frag()
  - !6972  ksmbd: validate payload size in ipc response
  - !7143  media: usbtv: Remove useless locks in usbtv_video_free()
  - !6809  memcg: fix possible use-after-free in memcg_write_event_control()
  - !7148  scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - !7139  SUNRPC: fix some memleaks in gssx_dec_option_array
  - !7129  SUNRPC: fix a memleak in gss_import_v2_context
  - scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - spi: atmel: Fix PDC transfer setup bug
  - Bluetooth: SMP: Fix crash when receiving new connection when debug is enabled
  - Revert "MIPS: Loongson64: Enable DMA noncoherent support"
  - dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
  - netfilter: nf_tables: skip set commit for deleted/destroyed sets
  - tracing: Fix blocked reader of snapshot buffer
  - ring-buffer: Fix wake ups when buffer_percent is set to 100
  - spi: atmel: Fix CS and initialization bug
  - spi: atmel: Switch to transfer_one transfer method
  - smb: client: fix OOB in SMB2_query_info_init()
  - usb: fotg210-hcd: delete an incorrect bounds test
  - Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE
  - Bluetooth: use inclusive language in SMP
  - Bluetooth: SMP: Convert BT_ERR/BT_DBG to bt_dev_err/bt_dev_dbg
  - ARM: dts: Fix occasional boot hang for am3 usb
  - 9p/net: fix possible memory leak in p9_check_errors()
  - x86/alternatives: Sync core before enabling interrupts
  - lib/vsprintf: Fix %pfwf when current node refcount == 0
  - bus: ti-sysc: Flush posted write only after srst_udelay
  - tracing / synthetic: Disable events after testing in synth_event_gen_test_init()
  - dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp
  - net: ks8851: Fix TX stall caused by TX buffer overrun
  - net: rfkill: gpio: set GPIO direction
  - net: 9p: avoid freeing uninit memory in p9pdu_vreadf
  - Input: soc_button_array - add mapping for airplane mode button
  - Bluetooth: L2CAP: Send reject on command corrupted request
  - Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
  - USB: serial: option: add Quectel RM500Q R13 firmware support
  - USB: serial: option: add Foxconn T99W265 with new baseline
  - USB: serial: option: add Quectel EG912Y module support
  - USB: serial: ftdi_sio: update Actisense PIDs constant names
  - wifi: cfg80211: fix certs build to not depend on file order
  - wifi: cfg80211: Add my certificate
  - iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma()
  - iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
  - scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
  - Input: ipaq-micro-keys - add error handling for devm_kmemdup
  - iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
  - interconnect: Treat xlate() returning NULL node as an error
  - btrfs: do not allow non subvolume root targets for snapshot
  - smb: client: fix NULL deref in asn1_ber_decoder()
  - ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB
  - ALSA: hda/hdmi: Add quirk to force pin connectivity on NUC10
  - pinctrl: at91-pio4: use dedicated lock class for IRQ
  - i2c: aspeed: Handle the coalesced stop conditions with the start conditions.
  - afs: Fix overwriting of result of DNS query
  - keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry
  - net: check dev->gso_max_size in gso_features_check()
  - net: warn if gso_type isn't set for a GSO SKB
  - afs: Fix dynamic root lookup DNS check
  - afs: Fix the dynamic root's d_delete to always delete unused dentries
  - net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
  - net/rose: fix races in rose_kill_by_device()
  - ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
  - net: sched: ife: fix potential use-after-free
  - net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors
  - net/mlx5: Fix fw tracer first block check
  - net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list()
  - Revert "net/mlx5e: fix double free of encap_header"
  - wifi: mac80211: mesh_plink: fix matches_local logic
  - s390/vx: fix save/restore of fpu kernel context
  - reset: Fix crash when freeing non-existent optional resets
  - ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init
  - smb: client: fix OOB in smb2_query_reparse_point()
  - ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE
  - media: usbtv: Remove useless locks in usbtv_video_free()
  - SUNRPC: fix some memleaks in gssx_dec_option_array
  - !7044 v2  nfs: fix UAF in direct writes
  - !7092  Squashfs: check the inode number is not the invalid value of zero
  - SUNRPC: fix a memleak in gss_import_v2_context
  - clk: zynq: Prevent null pointer dereference caused by kmalloc failure
  - !6965 v2  memcg: fix incorrect value of sysctl_memcg_swap_qos_stat
  - !7054  CVE-2024-27024
  - !7047  backport patch for thp deferred list
  - !7080  drm: nv04: Fix out of bounds access
  - !7086  media: ttpci: fix two memleaks in budget_av_attach
  - !7042  CVE-2024-27034
  - !6818  mm: memcg: fix stale protection of reclaim target memcg
  - Squashfs: check the inode number is not the invalid value of zero
  - media: ttpci: fix two memleaks in budget_av_attach
  - !7013  media: edia: dvbdev: fix a use-after-free
  - !6994 v2  net/mlx5e: Prevent deadlock while disabling aRFS
  - drm: nv04: Fix out of bounds access
  - !7039  USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - !6655 [OLK-5.10] mucse rnpm driver fw mailbox maybe failed to communicate with PF for mucse N10/N400 chips
  - !5964 drivers: close default yusur KPU FLEXFLOW-2100P driver support
  - !6954 [OLK-5.10]Fix some bugs of the Mini-IO module
  - !7056  scsi: qla2xxx: Fix command flush on cable pull
  - !7006  wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - !7003  wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
  - !7041  netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  - scsi: qla2xxx: Fix command flush on cable pull
  - net/rds: fix possible cp null dereference
  - net/rds: fix WARNING in rds_conn_connect_if_down
  - nilfs2: prevent kernel bug at submit_bh_wbc()
  - THP: avoid lock when check whether THP is in deferred list
  - mm/mmu_gather: limit free batch count and add schedule point in tlb_batch_pages_flush
  - nfs: fix UAF in direct writes
  - f2fs: compress: fix to cover normal cluster write with cp_rwsem
  - f2fs: reduce stack memory cost by using bitfield in struct f2fs_io_info
  - f2fs: replace congestion_wait() calls with io_schedule_timeout()
  - f2fs: fix to stop filesystem update once CP failed
  - !6990  netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  - !7000  fix CVE-2024-27010
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
  - !6843 v2  scsi: core: Fix unremoved procfs host directory regression
  - !6939  USB: core: Fix deadlock in usb_deauthorize_interface()
  - !6906  drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  - !6977  wireguard: netlink: access device through ctx instead of peer
  - !6956  netfilter: nf_tables: fix memleak in map from abort path
  - !6988  clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - !6914  usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
  - !6855  KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
  - tcp: Clean up kernel listener's reqsk in inet_twsk_purge()
  - media: edia: dvbdev: fix a use-after-free
  - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
  - net/sched: fix kabi change in struct Qdisc
  - net/sched: Fix mirred deadlock on device recursion
  - net/mlx5e: Prevent deadlock while disabling aRFS
  - !6943  speakup: Avoid crash on very long word
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - !6959  mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - !6932  net: enetc: deny offload of tc-based TSN features on VF interfaces
  - !6689  quota: Fix potential NULL pointer dereference
  - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - !6964 v2  CVE-2024-27000
  - wireguard: netlink: access device through ctx instead of peer
  - !6891  ima: fix deadlock when traversing "ima_default_rules".
  - ksmbd: validate payload size in ipc response
  - !6872  pstore: inode: Only d_invalidate() is needed
  - !6882  f2fs: compress: fix to guarantee persisting compressed blocks by CP
  - !6895  tun: limit printing rate when illegal packet received by tun dev
  - !6879  net/smc: Fix possible access to freed memory in link clear
  - !6736  add LTS patches to OLK-5.10
  - memcg: fix incorrect value of sysctl_memcg_swap_qos_stat
  - serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
  - serial: mxs-auart: add spinlock around changing cts state
  - serial: core: Provide port lock wrappers
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - netfilter: nf_tables: fix memleak in map from abort path
  - spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
  - i2c: hisi: Correct the description comment for PIN_MUX METHOD
  - i2c: hisi: Add I2C controller reset and initialization proccess in bus recovery action
  - speakup: Avoid crash on very long word
  - USB: core: Fix deadlock in usb_deauthorize_interface()
  - net: enetc: deny offload of tc-based TSN features on VF interfaces
  - usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
  - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  - tun: limit printing rate when illegal packet received by tun dev
  - ima: fix deadlock when traversing "ima_default_rules".
  - f2fs: compress: fix to guarantee persisting compressed blocks by CP
  - net/smc: Fix possible access to freed memory in link clear
  - pstore: inode: Only d_invalidate() is needed
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - scsi: core: Fix unremoved procfs host directory regression
  - mm: memcg: fix stale protection of reclaim target memcg
  - ACPI: APEI: Skip initialization of GHES_ASSIST structures for Machine Check Architecture
  - memcg: fix possible use-after-free in memcg_write_event_control()
  - cpufreq/cppc: changing highest_perf to nominal_perf in cppc_cpufreq_cpu_init()
  - net: fix kabi in struct ipv6_devconf
  - net: release reference to inet6_dev pointer
  - net: change accept_ra_min_rtr_lft to affect all RA lifetimes
  - net: add sysctl accept_ra_min_rtr_lft
  - genetlink: fix kabi change in struct genl_multicast_group
  - genetlink: Use internal flags for multicast groups
  - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group
  - genetlink: add CAP_NET_ADMIN test for multicast bind
  - quota: Fix potential NULL pointer dereference
  - char: imx-rngc: fix clk_disable_unprepare missing in error path
  - mucse: rnpm fw mailbox maybe failed to communicate with PF
  - drivers: close default yusur KPU FLEXFLOW-2100P driver support


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-200.0.0.113
changelog:
  - !7644  hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - !7705  pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
  - !7749 v2  wifi: iwlwifi: dbg-tlv: ensure NUL termination
  - !7651 fix the SPI driver failed to obtain the GPIO pin
  - !7655 v3  KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
  - !7675  bpf: Guard stack limits against 32bit overflow
  - !7732 HNS3: Fixed a deadlock issue caused by concurrent VF deactivation and PF reset
  - !7722 urma: fix bugs of urma and udma
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination
  - !7686  ext4: fix corruption during on-line resize
  - !7599  irqchip/gic-v3-its: Prevent double free on error
  - !7674  net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
  - HNS3: Fixed a deadlock issue caused by concurrent VF deactivation and PF reset
  - hns3 udma: support user-mode TP connection API
  - urma: upload kernel patch for 20240516_day
  - urma: upload kernel patch for 20240511_mig
  - urma: upload kernel patch for 20240318_happy_birthday
  - urma: upload kernel patch for 20240224_rain
  - urma: upload kernel patch for 20240219_Spring
  - !7579  powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  - !7665 [sync] PR-7586:  powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - !7661 [sync] PR-7590:  drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
  - pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
  - ext4: fix corruption during on-line resize
  - !7574  pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match
  - driver core: Provide device_match_acpi_handle() helper
  - bpf: Guard stack limits against 32bit overflow
  - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
  - !7601  cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  - powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
  - !7588  mm/swapfile: fix infinite loop in get_swap_pages after set memory.swapfile
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
  - !7563 udma: fix a bug of segment
  - !7385  CVE-2024-27002
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - !7577 spi: hisi-kunpeng：backport some bugfixes
  - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  - irqchip/gic-v3-its: Prevent double free on error
  - !7548  btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - mm/swapfile: fix infinite loop in get_swap_pages after set memory.swapfile
  - powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
  - spi: Add verification for the max_frequency provided by the firmware
  - spi: hisi-kunpeng: switch to use modern name
  - spi: hisi-kunpeng: Fix error checking
  - !7520  drm/i915/gt: Reset queue_priority_hint on parking
  - hns3 udma: the SEG registration failure is rectified.
  - !7538 v2  rcu: shorten the critical section that rnp->lock protects in rcu_dump_cpu_stacks
  - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - !5557 [OLK-5.10]Add support for Mont-TSSE
  - !4642 Add support for Hygon family 18h model 5h HD-Audio
  - !4640 Add support for Hygon model 6h L3 PMU
  - !4639 Some fixes for Hygon model 4h~6h processors
  - !4641 Add support for Hygon model 4h QoS
  - !2583 [OLK-5.10] Driver for Zhaoxin AES and SHA algorithm
  - !6801  block: fix discard
  - rcu: shorten the critical section that rnp->lock protects in rcu_dump_cpu_stacks
  - !7515 [sync] PR-7483:  Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - !7356  blk-iocost: Fix an UBSAN shift-out-of-bounds warning
  - !7351  PM / devfreq: Synchronize devfreq_monitor_[start/stop
  - !7361  sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - drm/i915/gt: Reset queue_priority_hint on parking
  - !7484  fix CVE-2024-26661
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - !7402  scsi: lpfc: Fix possible file string name overflow when updating firmware
  - !7404  scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - !7403  scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  - !7400  net/tg3: fix race condition in tg3_reset_task()
  - !7401  nvme-core: check for too small lba shift
  - !7396  drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
  - !7397  drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  - !7398  drm/amd/display: Fix memory leak in dm_sw_fini()
  - !7399  drm/amd/pm: fix a double-free in si_dpm_init
  - drm/amd/display: Fix && vs || typos
  - drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
  - !7476  firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - !7456  netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !6524  Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - !7424  net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - !7346  ppp_async: limit MRU to 64K
  - !5793  um: time-travel: fix time corruption
  - !7315  CVE-2024-26686
  - firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - !7297  powerpc/kasan: Fix addr error caused by page alignment
  - !7229  s390/zcrypt: fix reference counting on zcrypt card objects
  - !7234  SUNRPC: Fix a suspicious RCU usage warning
  - !7235  bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  - !7394 v2  scsi: sr: Do not leak information in ioctl
  - !7308  iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !7420  x86/CPU/AMD: Update the Zenbleed microcode revisions
  - !7426  net: gtp: Fix Use-After-Free in gtp_dellink
  - !7437  x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  - !7368  bugfix from mainline
  - !7416  cpu/SMT: Make SMT control more robust against enumeration failures
  - net: gtp: Fix Use-After-Free in gtp_dellink
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - x86/CPU/AMD: Update the Zenbleed microcode revisions
  - !7414  clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
  - !7218  CVE-2024-27017
  - cpu/SMT: Make SMT control more robust against enumeration failures
  - clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
  - !7223  major bugfix before 2023
  - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  - scsi: lpfc: Fix possible file string name overflow when updating firmware
  - nvme-core: check for too small lba shift
  - net/tg3: fix race condition in tg3_reset_task()
  - drm/amd/pm: fix a double-free in si_dpm_init
  - drm/amd/display: Fix memory leak in dm_sw_fini()
  - drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  - drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
  - scsi: sr: Do not leak information in ioctl
  - !5469  wifi: iwlwifi: fix a memory corruption
  - clk: mediatek: Do a runtime PM get on controllers during probe
  - x86/srso: Fix vulnerability reporting for missing microcode
  - x86/srso: Don't probe microcode in a guest
  - x86/srso: Set CPUID feature bits independently of bug or mitigation status
  - sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - blk-iocost: Fix an UBSAN shift-out-of-bounds warning
  - PM / devfreq: Synchronize devfreq_monitor_[start/stop]
  - ppp_async: limit MRU to 64K
  - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
  - fs/proc: do_task_stat: use __for_each_thread()
  - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand()
  - exit: Use the correct exit_code in /proc/<pid>/stat
  - iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  - powerpc/kasan: Fix addr error caused by page alignment
  - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  - SUNRPC: Fix a suspicious RCU usage warning
  - s390/zcrypt: fix reference counting on zcrypt card objects
  - powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()
  - irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling
  - genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
  - netfilter: nf_tables: missing iterator type in lookup walk
  - netfilter: nft_set_pipapo: walk over current view on netlink dump
  - block: check io size before submit discard
  - block: fix overflow in blk_ioctl_discard()
  - Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - um: time-travel: fix time corruption
  - add support for Mont-TSSE Driver
  - wifi: iwlwifi: fix a memory corruption
  - EDAC/amd64: Adjust UMC channel for Hygon family 18h model 6h
  - x86/amd_nb: Get DF ID from F5 device for Hygon family 18h model 6h
  - EDAC/amd64: Fix intlv_num_chan for Hygon family 18h model 4h
  - EDAC/amd64: Revert hi_addr_offset for Hygon family 18h model 4h
  - ALSA: hda: Fix single byte write failure issue for Hygon
  - ALSA: hda: Add Hygon HD-Audio support
  - x86/resctrl: Add Hygon QoS support
  - perf/x86/uncore: Add L3 PMU support for Hygon family 18h model 6h
  - configs: Add Zhaoxin aes/sha items in openeuler_config
  - Zhaoxin: Driver for Zhaoxin SHA algorithm
  - Zhaoxin: Driver for Zhaoxin AES algorithm


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-201.0.0.114
changelog:
  - !7870  CVE-2024-35995
  - !7810  net-memcg: Fix scope of sockmem pressure indicators
  - !8159 v3  iommu: Reserve kabi for iommu and memory related functions
  - !7207 cgroup1_writeback:bind blkcg and memcg
  - !8067 irqchip: gic: some bugfix of hip09
  - iommu: Reserve kabi for iommu and memory related functions
  - !8057 v8  arm64: Allow CPU0 to be nohz_full
  - !7744 v3  Port livepatch related patches
  - !8042  xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  - !8060  soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  - !8023  fs/ntfs3: Fixed overflow check in mi_enum_attr()
  - !7947 【OLK-5.10】Fix BUILD REGRESSION warnings in bzwx N5/N6 series NIC drivers
  - !7413 Backport Intel VT-d critical fix to olk-5.10
  - !7985  cvm_tsi: add cvm tsi interface
  - !7395  smart_grid: introducing rebuild_affinity_domain
  - !7993  HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  - !8008 【OLK-5.10】backport PCC patches to support shared interrupt for multiple subspaces and platform notification handling
  - !7886  drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
  - !5483 [OLK-5.10] Add support for Mucse Virtual Function Network Adapter(N10/N400)
  - !7980  Fix CVE-2021-47455
  - !8019  pstore/zone: Add a null pointer check to the psz_kmsg_read
  - !7912 RDMA/hns: Some bugfixes for openeuler 22.03 sp4
  - !7693  Bluetooth: af_bluetooth: Fix deadlock
  - !8029  mm: introduce vm_swap_extension sysctl
  - !8039 v2  dynamic_hugetlb: backport some bugfix
  - !7813  kobject: Fix global-out-of-bounds in kobject_action_type()
  - !7940  fix crypto_queue backlog handling
  - !3736 Add nokaslr memory region avoid support
  - !8030  netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  - irqchip/gic-v4.1:Check whether indirect table is supported in allocate_vpe_l1_table
  - irqchip: gicv3: Add workaround for hip09 erratum 162200806
  - irqchip: gicv3: Add workaround for hip09 erratum 162200803
  - soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  - arm64: defconfig: Enable CONFIG_ARCH_SUSPEND_NONZERO_CPU and CONFIG_ARCH_SUSPEND_NONZERO_CPU
  - arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default
  - isolation: Check whether there exists a housekeeping CPU online
  - isolation: Do not check whether housekeeping CPUs are present
  - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  - mm/dynamic_hugetlb: refine error info in the destruction
  - mm/dynamic_hugetlb: make free_huge_page_to_dhugetlb_pool irq safe
  - mm/dynamic_hugetlb: check NULL pointer for early parameter
  - mm/dynamic_hugetlb: add lru_add_drain_all() before migration
  - mm/dynamic_hugetlb: add cond_resched() in hpool_merge_page()
  - mm/dynamic_hugetlb: reduce the number of migration attempts
  - mm/dpool: Use helper function to lock/unlock
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  - openeuler_defconfig: enable swap_extension for x86 and arm64
  - mm/vmscan: introduce vm_swap_extension sysctl
  - fs/ntfs3: Fixed overflow check in mi_enum_attr()
  - pstore/zone: Add a null pointer check to the psz_kmsg_read
  - drivers: initial support for rnpvf drivers from Mucse Technology
  - !7961  net: atlantic: eliminate double free in error handling logic
  - !7970  fbmon: prevent division by zero in fb_videomode_from_videomode()
  - mailbox: pcc: Support shared interrupt for multiple subspaces
  - mailbox: pcc: Add support for platform notification handling
  - mailbox: pcc: Use mbox_bind_client
  - !7903  virtio_ring : keep used_wrap_counter in
  - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  - mailbox: omap: Use mbox_bind_client
  - mailbox: Allow direct registration to a channel
  - mailbox: pcc: Fix kernel doc warnings
  - !7983 v2  Enhance memcg KSM feature.
  - !7960  ipv6: Fix infinite recursion in fib6_dump_done().
  - !7934  fix CVE-2024-35839
  - cvm_tsi: add cvm tsi interface
  - !5118  [OLK-5.10] Add support for Mucse Network Adapter(N500/N210)
  - !7452 v2  ip: Treat IPv4 segment's lowest address as unicast
  - !7801  netfilter: nft_flow_offload: reset dst in route object after setting up flow
  - !7758  netfilter: nf_tables: discard table flag update with pending basechain deletion
  - !7959 v2  Add network relationship for NUMA isolation and consolidation
  - mm/memcontrol: enable KSM for tasks moving to new memcg
  - mm/memcontrol: add ksm state for memcg
  - mm/ksm: fix ksm exec support for prctl
  - mm/ksm: support fork/exec for prctl
  - !7224 [OLK-5.10] Fixed display error for ps23xx when using ast and pe2201 bmc card
  - ptp: fix code indentation issues
  - ptp: Fix possible memory leak in ptp_clock_register()
  - !7949  drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
  - fbmon: prevent division by zero in fb_videomode_from_videomode()
  - !7943 v2  netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  - !7955 v3  sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED
  - net: atlantic: eliminate double free in error handling logic
  - ipv6: Fix infinite recursion in fib6_dump_done().
  - drivers: initial support for rnpgbe drivers from Mucse Technology
  - config: Add new config entry to default config file to fix CI warning
  - net: add some bpf hooks in tcp stack for network numa relationship
  - net: add one bpf prog type for network numa relationship
  - net: retrieve netns cookie via getsocketopt
  - net: fix kabi breakage in struct net
  - net: initialize net->net_cookie at netns setup
  - !5484 [OLK-5.10] Add support for Mucse Virtual Function Network Adapter(N500/N210)
  - sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED
  - Revert "sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED"
  - drivers: Fix BUILD REGRESSION warning in bzwx N5/N6 series NIC drivers
  - !6106  SCSI: hisi_raid: add sg_raw command feature
  - drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
  - !7923  Fix allmodconfig build error
  - !7645  ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
  - netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  - crypto: engine - fix crypto_queue backlog handling
  - !7916 v5  Introduce NUMA isolation and consolidation
  - netfilter: bridge: replace physindev with physinif in nf_bridge_info
  - netfilter: propagate net to nf_bridge_get_physindev
  - netfilter: nfnetlink_log: use proper helper for fetching physinif
  - !7911  ACPI: LPIT: Avoid u32 multiplication overflow
  - net/ethernet/huawei/hiroce3: Fix allmodconfig build error
  - !7865  netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
  - RDMA/hns: Fix allocating POE channels after IB device registeration
  - RDMA/hns : Fix scc delay_work to execute after sysfs shutdown
  - RDMA/hns: Fix missing resetting notify
  - RDMA/hns: Use mutex to protect uconctext
  - config: Enable NUMA isolation and consolidation by default
  - sched: Introduce CONFIG_QOS_SCHED_NUMA_ICON
  - bpf:programmable: Add helper to set preferred node
  - sched: Update numa group preferred node periodically
  - sched: Add ioctl to get relationship
  - bpf:programmable: Add helper to get memory and net relationship
  - sched: Introduce task relationship by net and memory
  - bpf:programmable: Add nodemask operation collection
  - sched: Some fixes for select_rq hook
  - sched: Add can_migrate_task hook
  - sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE
  - ACPI: LPIT: Avoid u32 multiplication overflow
  - !7877 v4  eeprom: at24: fix memory corruption race condition
  - !7741  ipv4: check for NULL idev in ip_route_use_hint()
  - !7731  sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED
  - !7689 [sync] PR-7370: v2  sched: smart_grid: silence complier error
  - virtio_ring : keep used_wrap_counter in vq->last_used_idx
  - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
  - eeprom: at24: fix memory corruption race condition
  - !7733 backport some bugfix of HiSilicon PCIe PMU driver
  - !7691 net: hns3: backport some bugfixes
  - !7853  net/mlx5e: fix a double-free in arfs_create_groups
  - ACPI: CPPC: Fix access width used for PCC registers
  - ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
  - ACPI: CPPC: Use access_width over bit_width for system memory accesses
  - ACPI: CPPC: Fix up I/O port access in cpc_read()
  - ACPI: CPPC: Implement support for SystemIO registers
  - !5545 backport dirty-ring feature
  - netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
  - !7846  netrom: Fix a data-race around sysctl_netrom_transport_timeout
  - !7773  Fix CVE-2023-52698
  - net/mlx5e: fix a double-free in arfs_create_groups
  - net: hns3: use appropriate barrier function after setting a bit value
  - net: hns3: release PTP resources if pf initialization failed
  - !7841  cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter()
  - !7062 [openEuler-22.03-SP4]drivers: support Yunsilicon's metaScale/metaVisor series NICs
  - !6300 【OLK-5.10】fix compiling problem in bzwx N5/N6 series NIC drivers
  - netrom: Fix a data-race around sysctl_netrom_transport_timeout
  - !7816  f2fs: fix to wait on block writeback for post_read case
  - !7576  f2fs: compress: fix reserve_cblocks counting error when out of space
  - !7757  Fix CVE-2023-52656
  - cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter()
  - !7681  xfs: three bug fix recently
  - !7779  LoongArch: Define the __io_aw() hook as mmiowb()
  - !7714  CVE-2024-35936
  - drivers: fix compiling problem in bzwx N5/N6 series NIC drivers
  - drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
  - drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
  - drivers/perf: hisi_pcie: Merge find_related_event() and get_event_idx()
  - drivers/perf: hisi_pcie: Relax the check on related events
  - drivers/perf: hisi_pcie: Check the target filter properly
  - drivers/perf: hisi_pcie: Add more events for counting TLP bandwidth
  - drivers/perf: hisi_pcie: Fix incorrect counting under metric mode
  - drivers/perf: hisi_pcie: Introduce hisi_pcie_pmu_get_event_ctrl_val()
  - drivers/perf: hisi_pcie: Rename hisi_pcie_pmu_{config,clear}_filter()
  - !7684  dm snapshot: fix lockup in dm_exception_table_exit
  - iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
  - PCI: Make pci_dev_is_disconnected() helper public for other drivers
  - f2fs: fix to wait on block writeback for post_read case
  - kobject: Fix global-out-of-bounds in kobject_action_type()
  - net-memcg: Fix scope of sockmem pressure indicators
  - netfilter: nft_flow_offload: reset dst in route object after setting up flow
  - !7743  netrom: Fix data-races around sysctl_net_busy_read
  - !7734  mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
  - LoongArch: Define the __io_aw() hook as mmiowb()
  - calipso: fix memory leak in netlbl_calipso_add_pass()
  - netlabel: remove unused parameter in netlbl_netlink_auditinfo()
  - net: netlabel: Fix kerneldoc warnings
  - !7753  wifi: ath11k: decrease MHI channel buffer length to 8KB
  - netfilter: nf_tables: discard table flag update with pending basechain deletion
  - io_uring: drop any code related to SCM_RIGHTS
  - io_uring/unix: drop usage of io_uring socket
  - wifi: ath11k: decrease MHI channel buffer length to 8KB
  - livepatch: Update related configs in openeuler_defconfig
  - arm64: Recover kretprobe modified return address in stacktrace
  - x86/unwind: Compile kretprobe fixup code only if CONFIG_KRETPROBES=y
  - x86/unwind: Recover kretprobe trampoline entry
  - kprobes: Add kretprobe_find_ret_addr() for searching return address
  - livepatch: Avoid patching conflicts with kprobes
  - kprobes: Fix possible use-after-free issue on kprobe registration
  - ftrace: Fix possible use-after-free issue in ftrace_location()
  - livepatch: Reduce duplicate definition of 'struct walk_stackframe_args'
  - livepatch: Fix warning C_RULE_ID_SINGLE_BRANCH_IF_AND_LOOP_BRACKET
  - livepatch/core: Make several functions to be static
  - livepatch: Use func->func_node directly
  - livepatch: Fix huge_depth in arch_klp_check_activeness_func()
  - livepatch: Organize active functions with struct 'list_head'
  - livepatch: Check calltrace of idle tasks
  - livepatch: Complete check calltrace for running tasks
  - livepatch/core: No stop machine in KLP_STACK_OPTIMIZE mode
  - livepatch/ppc64: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode
  - livepatch/ppc32: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode
  - livepatch/arm64: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode
  - livepatch/arm: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode
  - livepatch/x86: Ajust instruction replace order for KLP_STACK_OPTIMIZE mode
  - livepatch/ppc64: Implement arch_klp_check_task_calltrace()
  - livepatch/ppc32: Implement arch_klp_check_task_calltrace()
  - livepatch/arm64: Implement arch_klp_check_task_calltrace()
  - livepatch/arm: Implement arch_klp_check_task_calltrace()
  - livepatch/x86: Implement arch_klp_check_task_calltrace()
  - livepatch/ppc64: Remove duplicate 'struct klp_func_list' related codes
  - livepatch/ppc32: Remove duplicate 'struct klp_func_list' related codes
  - livepatch/arm64: Remove duplicate 'struct klp_func_list' related codes
  - livepatch/arm: Remove duplicate 'struct klp_func_list' related codes
  - livepatch/x86: Move 'struct klp_func_list' related codes out of arch
  - livepatch: Move 'struct klp_func_list' out of arch
  - netrom: Fix data-races around sysctl_net_busy_read
  - ipv4: check for NULL idev in ip_route_use_hint()
  - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
  - sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED
  - net: hns3: change type of numa_node_mask as nodemask_t
  - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
  - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
  - net: hns3: direct return when receive a unknown mailbox message
  - net: hns3: using user configure after hardware reset
  - net: hns3: fix kernel crash problem in concurrent scenario
  - Bluetooth: af_bluetooth: Fix deadlock
  - net: hns3: add cond_resched() to hns3 ring buffer init process
  - net: hns3: move constants from hclge_debugfs.h to hclge_debugfs.c
  - net: hns3: add 
  - net: hns3: don't need to check an unsigned number is less than 0
  - net: hns3: set irq affinity directly
  - net: hns3: using cpumask_copy when set value to cpumask_t
  - net: hns3: mark unexcuted loopback test result as UNEXECUTED
  - net: hns3: fix index limit to support all queue stats
  - sched: smart_grid: silence complier error
  - dm snapshot: fix lockup in dm_exception_table_exit
  - xfs: update dir3 leaf block metadata after swap
  - xfs: ensure logflagsp is initialized in xfs_bmap_del_extent_real
  - iomap: fix warning in xfs_iomap_write_delalloc_release()
  - KVM: selftests: Add dirty ring buffer test
  - KVM: selftests: Introduce after_vcpu_run hook for dirty log test
  - KVM: Don't allocate dirty bitmap if dirty ring is enabled
  - KVM: Make dirty ring exclusive to dirty bitmap log
  - KVM: X86: Implement ring-based dirty memory tracking
  - KVM: Pass in kvm pointer into mark_page_dirty_in_slot()
  - KVM: X86: Don't track dirty for KVM_SET_[TSS_ADDR|IDENTITY_MAP_ADDR]
  - ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
  - f2fs: compress: fix reserve_cblocks counting error when out of space
  - drm/ast: Fixed display error for ps23xx when using ast bmc card
  - drm/phytium: Bugfix Xorg startup for ps23xx when using pe2201 bmc card
  - ip: Treat IPv4 segment's lowest address as unicast
  - smart_grid: introducing rebuild_affinity_domain
  - cgroup_writeback: bind blkcg and memcg
  - drivers: support Yunsilicon's MS and MV series NICs
  - SCSI: hisi_raid: add sg_raw command feature
  - drivers: initial support for rnpgbevf drivers from Mucse Technology
  - kaslr: enable CONFIG_NOKASLR_MEM_RANGE in openeuler_defconfig
  - x86/boot: add x86 nokaslr memory regions
  - efi/libstub: add arm64 nokaslr memory regions
  - kaslr: add nokaslr memory region Kconfig support

   at the end when print msg


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-202.0.0.115
changelog:
  - !8425  CVE-2023-52677
  - !8519  mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq
  - !8545 v2  arm64 mpam fix patch
  - !8468 v2  CVE-2024-35808
  - !8046  block: prevent division by zero in blk_rq_stat_sum()
  - !8605  smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  - !7670  btrfs: send: handle path ref underflow in header iterate_inode_ref()
  - !8513  net: ena: Fix incorrect descriptor free behavior
  - !8535 v4  Fix soft lockup in stress test
  - !8561  mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
  - !8497  Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
  - smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  - !7803 v2  selinux: avoid dereference of garbage after mount failure
  - !6393  crypto: xilinx - call finalize with bh disabled
  - !8539 v2  iommu/arm-smmu-v3: Reducing the CMD_SYNC times
  - !8504  CVE: CVE-2024-36015
  - !8261  tty: fix hang on tty device with no_room set
  - !8110  drm/client: Fully protect modes[
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
  - !8472  fix CVE-2024-27415
  - !8527 v8  Add support for l0
  - !8395  5.10: fix CVE-2024-35978
  - !8541 v2  iommu/iova: move depot up to avoid cache conflict
  - !8407  pinctrl: core: delete incorrect free in pinctrl_enable()
  - !8240 v2  dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
  - arm64/mpam: Fix softlockup when reading mondata
  - arm64/mpam: Fix wrong seconds to jiffies conversion
  - arm64/mpam: change allocation mode from GFP_KERNEL to GFP_NOWAIT
  - mpam/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup
  - mpam/resctrl: Clean up resctrl_group_rmdir_[ctrl/mon]()
  - mpam/resctrl: Clean up unused function parameter in mkdir path
  - mpam/resctrl: Fix a deadlock due to inaccurate reference
  - iommu/iova: move depot up to avoid cache conflict
  - iommu/arm-smmu-v3: Reducing the CMD_SYNC times
  - iommu/iova: Try to schedule out when free iova too long
  - iommu/iova: free iovas on each cpu in flush queue
  - arm64: config: Enable hisi l3t & l0 by default
  - hisi: l0: Add support for l0
  - hisi: l3t: Add L3 cache driver for hisi
  - mm/mempolicy: Add and export get_vma_policy_node
  - arm64: export cpu_logical_map
  - export symbol alloc_contig_pages
  - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq
  - net: ena: Fix incorrect descriptor free behavior
  - ppdev: Add an error check in register_device
  - ppdev: Remove usage of the deprecated ida_simple_xx() API
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
  - !8397  mm/hugetlb: fix missing hugetlb_lock for resv uncharge
  - !8373  dma-direct: Leak pages on dma_set_decrypted() failure
  - !8428  drm/amdgpu: Fix even more out of bound writes from debugfs
  - !8339  soc: qcom: llcc: Handle a second device without data corruption
  - !8368  efi/capsule-loader: fix incorrect allocation size
  - netfilter: br_netfilter: skip conntrack input hook for promisc packets
  - netfilter: bridge: confirm multicast packets before passing them up the stack
  - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen
  - md/dm-raid: don't call md_reap_sync_thread() directly
  - !8454 v3  net: Bacport hulk patches
  - !8069  CVE-2021-47427
  - !8299  xfs: Fix file creation failure
  - !8426 Backport 5.10.209 LTS patches from upstream
  - !8416  iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
  - net: xfrm: skip policies marked as dead while reinserting policies
  - tcp_comp: modify default value of TCP_COMP to n
  - bpf: socketmap: add Kconfig for customized socketmap
  - bpf: fix magic numbers in bpf_get_sockops_uid_gid()
  - netfilter: make return-type and function-name in the same line
  - bpf: fix type incompatible warning
  - bpf: fix format type mismatch warning
  - !8342  net/mlx5: Properly link new fs rules into the tree
  - drm/amdgpu: Fix even more out of bound writes from debugfs
  - arm64: dts: armada-3720-turris-mox: set irq type for RTC
  - i2c: s3c24xx: fix transferring more than one message in polling mode
  - i2c: s3c24xx: fix read transfers in polling mode
  - selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes
  - selftests: mlxsw: qos_pfc: Convert to iproute2 dcb
  - ethtool: netlink: Add missing ethnl_ops_begin/complete
  - kdb: Fix a potential buffer overflow in kdb_local()
  - ipvs: avoid stat macros calls from preemptible context
  - netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description
  - netfilter: nf_tables: skip dead set elements in netlink dump
  - netfilter: nf_tables: do not allow mismatch field size and set key length
  - net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe
  - net: ravb: Fix dma_addr_t truncation in error case
  - net: phy: micrel: populate .soft_reset for KSZ9131
  - net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames
  - s390/pci: fix max size calculation in zpci_memcpy_toio()
  - PCI: keystone: Fix race condition when initializing PHYs
  - serial: imx: Correct clock error message in function probe()
  - perf env: Avoid recursively taking env->bpf_progs.lock
  - nvmet-tcp: fix a crash in nvmet_req_complete()
  - usb: cdc-acm: return correct error code on unsupported break
  - tty: use 'if' in send_break() instead of 'goto'
  - tty: don't check for signal_pending() in send_break()
  - tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK
  - tty: change tty_write_lock()'s ndelay parameter to bool
  - perf genelf: Set ELF program header addresses properly
  - iio: adc: ad9467: fix scale setting
  - iio: adc: ad9467: don't ignore error codes
  - iio: adc: ad9467: fix reset gpio handling
  - iio: adc: ad9467: Benefit from devm_clk_get_enabled() to simplify
  - software node: Let args be NULL in software_node_get_reference_args
  - acpi: property: Let args be NULL in __acpi_node_get_property_reference
  - libapi: Add missing linux/types.h header to get the __u64 type on io.h
  - power: supply: cw2015: correct time_to_empty units in sysfs
  - MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()
  - MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()
  - mips: Fix incorrect max_low_pfn adjustment
  - mips: dmi: Fix early remap on MIPS32
  - leds: aw2013: Select missing dependency REGMAP_I2C
  - HID: wacom: Correct behavior when processing some confidence == false touches
  - iio: adc: ad7091r: Pass iio_dev to event handler
  - x86/kvm: Do not try to disable kvmclock if it was not enabled
  - wifi: mwifiex: configure BSSID consistently when starting AP
  - wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
  - wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
  - iommu/arm-smmu-qcom: Add missing GMU entry to match table
  - io_uring/rw: ensure io->bytes_done is always initialized
  - pwm: jz4740: Don't use dev_err_probe() in .request()
  - fbdev: flush deferred work in fb_deferred_io_fsync()
  - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx
  - ALSA: oxygen: Fix right channel of capture volume mixer
  - serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock
  - usb: mon: Fix atomicity violation in mon_bin_vma_fault
  - usb: typec: class: fix typec_altmode_put_partner to put plugs
  - Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
  - usb: chipidea: wait controller resume finished for wakeup irq
  - Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only"
  - Revert "usb: dwc3: Soft reset phy on probe for host"
  - usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
  - usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()
  - tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
  - net: ethernet: mtk_eth_soc: remove duplicate if statements
  - kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
  - Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek"
  - virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session()
  - virtio-crypto: fix memory-leak
  - dma-mapping: Fix build error unused-value
  - Input: atkbd - use ab83 as id when skipping the getid command
  - binder: fix unused alloc->free_async_space
  - binder: fix async space check for 0-sized buffers
  - keys, dns: Fix size check of V1 server-list header
  - of: unittest: Fix of_count_phandle_with_args() expected value message
  - of: Fix double free in of_parse_phandle_with_args_map
  - IB/iser: Prevent invalidating wrong MR
  - mmc: sdhci_omap: Fix TI SoC dependencies
  - mmc: sdhci_am654: Fix TI SoC dependencies
  - pwm: stm32: Fix enable count for clk in .probe()
  - pwm: stm32: Use hweight32 in stm32_pwm_detect_channels
  - pwm: stm32: Use regmap_clear_bits and regmap_set_bits where applicable
  - clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw
  - clk: fixed-rate: add devm_clk_hw_register_fixed_rate
  - clk: si5341: fix an error code problem in si5341_output_clk_set_rate
  - watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused
  - watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
  - watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
  - watchdog: set cdev owner before adding
  - drivers: clk: zynqmp: update divider round rate logic
  - clk: zynqmp: Add a check for NULL pointer
  - clk: zynqmp: make bestdiv unsigned
  - drivers: clk: zynqmp: calculate closest mux rate
  - clk: qcom: videocc-sm8150: Add missing PLL config property
  - clk: qcom: videocc-sm8150: Update the videocc resets
  - dt-bindings: clock: Update the videocc resets for sm8150
  - gpu/drm/radeon: fix two memleaks in radeon_vm_init
  - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
  - media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe()
  - media: dvbdev: drop refcount on error path in dvb_device_open()
  - f2fs: fix to update iostat correctly in f2fs_filemap_fault()
  - f2fs: fix to check compress file in f2fs_move_file_range()
  - media: rkisp1: Disable runtime PM in probe error path
  - clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config
  - media: cx231xx: fix a memleak in cx231xx_init_isoc
  - drm/bridge: tc358767: Fix return value on error case
  - drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
  - drm/radeon/dpm: fix a memleak in sumo_parse_power_table
  - drm/drv: propagate errors from drm_modeset_register_all()
  - drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
  - drm/msm/mdp4: flush vblank event on disable
  - ASoC: cs35l34: Fix GPIO name and drop legacy include
  - ASoC: cs35l33: Fix GPIO name and drop legacy include
  - drm/radeon: check return value of radeon_ring_lock()
  - drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
  - drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
  - drm/bridge: Fix typo in post_disable() description
  - drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer
  - rcu: Create an unrcu_pointer() to remove __rcu from a pointer
  - drm/panel-elida-kd35t133: hold panel in reset for unprepare
  - RDMA/usnic: Silence uninitialized symbol smatch warnings
  - ARM: davinci: always select CONFIG_CPU_ARM926T
  - Bluetooth: btmtkuart: fix recv_buf() return value
  - Bluetooth: Fix bogus check for re-auth no supported with non-ssp
  - netfilter: nf_tables: mark newset as dead on transaction abort
  - wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
  - wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
  - wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
  - rtlwifi: rtl8192de: make arrays static const, makes object smaller
  - wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
  - wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
  - wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
  - wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
  - wifi: rtlwifi: add calculate_bit_shift()
  - dma-mapping: clear dev->dma_mem to NULL after freeing it
  - dma-mapping: Add dma_release_coherent_memory to DMA API
  - virtio/vsock: fix logic which reduces credit update messages
  - selftests/net: fix grep checking for fib_nexthop_multiprefix
  - arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
  - arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator
  - scsi: fnic: Return error if vmalloc() failed
  - arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type
  - wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
  - firmware: meson_sm: populate platform devices from sm device tree data
  - firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
  - net/ncsi: Fix netlink major/minor version numbers
  - ncsi: internal.h: Fix a spello
  - ARM: dts: qcom: apq8064: correct XOADC register address
  - wifi: libertas: stop selecting wext
  - wifi: ath11k: Defer on rproc_get failure
  - bpf: Add crosstask check to __bpf_get_stack
  - bpf, lpm: Fix check prefixlen before walking trie
  - wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
  - NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
  - blocklayoutdriver: Fix reference leak of pnfs_device_node
  - crypto: scomp - fix req->dst buffer overflow
  - crypto: sahara - do not resize req->src when doing hash operations
  - crypto: sahara - fix processing hash requests with req->nbytes < sg->length
  - crypto: sahara - improve error handling in sahara_sha_process()
  - crypto: sahara - fix wait_for_completion_timeout() error handling
  - crypto: sahara - fix ahash reqsize
  - crypto: sahara - handle zero-length aes requests
  - crypto: sahara - avoid skcipher fallback code duplication
  - gfs2: Also reflect single-block allocations in rgd->rd_extfail_pt
  - Revert "gfs2: Don't reject a supposedly full bitmap if we have blocks reserved"
  - fs: indicate request originates from old mount API
  - crypto: sahara - fix error handling in sahara_hw_descriptor_create()
  - crypto: sahara - fix processing requests with cryptlen < sg->length
  - crypto: sahara - fix ahash selftest failure
  - crypto: sahara - fix cbc selftest failure
  - crypto: sahara - remove FLAGS_NEW_KEY logic
  - crypto: af_alg - Disallow multiple in-flight AIO requests
  - crypto: ccp - fix memleak in ccp_init_dm_workarea
  - crypto: sa2ul - Return crypto_aead_setkey to transfer the error
  - crypto: virtio - Handle dataq logic with tasklet
  - virtio-crypto: wait ctrl queue instead of busy polling
  - virtio-crypto: use private buffer for control request
  - virtio-crypto: change code style
  - virtio-crypto: implement RSA algorithm
  - virtio-crypto: introduce akcipher service
  - virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC
  - selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
  - ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error
  - spi: sh-msiof: Enforce fixed DTDL for R-Car H3
  - cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()
  - cpufreq: Use of_property_present() for testing DT property presence
  - of: Add of_property_present() helper
  - of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
  - ACPI: video: check for error while searching for backlight device parent
  - mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response
  - spi: spi-zynqmp-gqspi: fix driver kconfig dependencies
  - powerpc/powernv: Add a null pointer check in opal_powercap_init()
  - powerpc/powernv: Add a null pointer check in opal_event_init()
  - selftests/powerpc: Fix error handling in FPU/VMX preemption tests
  - powerpc/44x: select I2C for CURRITUCK
  - powerpc: Remove in_kernel_text()
  - powerpc: add crtsavres.o to always-y instead of extra-y
  - x86/lib: Fix overflow when counting digits
  - coresight: etm4x: Fix width of CCITMIN field
  - PCI: Add ACS quirk for more Zhaoxin Root Ports
  - parport: parport_serial: Add Brainboxes device IDs and geometry
  - parport: parport_serial: Add Brainboxes BAR details
  - binder: fix comment on binder_alloc_new_buf() return value
  - binder: fix trivial typo of binder_free_buf_locked()
  - binder: use EPOLLERR from eventpoll.h
  - ACPI: resource: Add another DMI match for the TongFang GMxXGxx
  - drm/crtc: fix uninitialized variable use
  - ARM: sun9i: smp: fix return code check of of_property_match_string
  - net: qrtr: ns: Return 0 if server port is not present
  - i2c: rk3x: fix potential spinlock recursion on poll
  - Input: xpad - add Razer Wolverine V2 support
  - ARC: fix spare error
  - s390/scm: fix virtual vs physical address confusion
  - Input: i8042 - add nomux quirk for Acer P459-G2-M
  - Input: atkbd - skip ATKBD_CMD_GETID in translated mode
  - reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
  - ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI
  - tracing: Add size check when printing trace_marker output
  - tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
  - neighbour: Don't let neigh_forced_gc() disable preemption for long
  - drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
  - jbd2: correct the printing of write_flags in jbd2_write_superblock()
  - clk: rockchip: rk3128: Fix HCLK_OTG gate register
  - drm/exynos: fix a wrong error checking
  - drm/exynos: fix a potential error pointer dereference
  - nvme: introduce helper function to get ctrl state
  - ASoC: da7219: Support low DC impedance headset
  - nouveau/tu102: flush all pdbs on vmm flush
  - ASoC: rt5650: add mutex to avoid the jack detection failure
  - ASoC: cs43130: Fix incorrect frame delay configuration
  - ASoC: cs43130: Fix the position of const qualifier
  - ASoC: Intel: Skylake: mem leak in skl register function
  - ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16
  - ASoC: Intel: Skylake: Fix mem leak in few functions
  - ASoC: wm8974: Correct boost mixer inputs
  - debugfs: fix automount d_fsdata usage
  - mptcp: fix uninit-value in mptcp_incoming_options
  - ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
  - pinctrl: lochnagar: Don't build on MIPS
  - riscv: Check if the code to patch lies in the exit section
  - !8221 Backport 5.10.207- 5.10.208 LTS patches from upstream
  - !8140  i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  - iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
  - pinctrl: core: delete incorrect free in pinctrl_enable()
  - !7471  x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
  - !8367  cvm: clean code for cvm init
  - mm/hugetlb: fix missing hugetlb_lock for resv uncharge
  - Bluetooth: Fix memory leak in hci_req_sync_complete()
  - !8300  ipvlan: add ipvlan_route_v6_outbound() helper
  - !8271  netfilter: nf_tables: reject new basechain after table flag update
  - !8212  fix CVE-2024-35877
  - dma-direct: Leak pages on dma_set_decrypted() failure
  - !8306  mptcp: ensure tx skbs always have the MPTCP ext
  - efi/capsule-loader: fix incorrect allocation size
  - cvm: clean code for cvm init
  - !8195  CVE-2024-35956
  - !8153  cpu/hotplug: Don't offline the last non-isolated CPU
  - net/mlx5: Properly link new fs rules into the tree
  - soc: qcom: llcc: Handle a second device without data corruption
  - !8254  sysv: don't call sb_bread() with pointers_lock held
  - !8275  usb: udc: remove warning when queue disabled ep
  - !8263 [sync] PR-8228:  ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  - !8243 【OLK 5.10】RDMA/hns some bugfix
  - mptcp: ensure tx skbs always have the MPTCP ext
  - ipvlan: add ipvlan_route_v6_outbound() helper
  - xfs: Fix file creation failure
  - !7831 IMA: Support the measurement extending of TSI TMM
  - !8230  Remove redundants code for proc_cgroupstats_show
  - !8255  IMA: Introduce a config for fix on IMA with Overlayfs issue
  - !8250  Control KABI reservation codes with config
  - !7889  vt: fix unicode buffer corruption when deleting characters
  - !8220  improve security for cvm host feature
  - !8150  mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
  - !8127  mlxsw: spectrum_acl_tcam: Fix warning during rehash
  - !8063  wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  - !8258 v5  can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
  - !8133  fix CVE-2021-47265
  - usb: udc: remove warning when queue disabled ep
  - netfilter: nf_tables: reject new basechain after table flag update
  - ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  - tty: fix hang on tty device with no_room set
  - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
  - !8238  arm: unwinder: Fix pc off-by-one in arm unwinder
  - !8237  x86: profiling: Using generic unwinding in profile_pc
  - !8236  x86: profiling: Check prof_buffer in profile_tick()
  - !8229  LLVM fix compile warning options
  - RDMA/hns: Add max_ah and cq moderation capacities in query_device()
  - RDMA/hns: Fix return value in hns_roce_map_mr_sg
  - RDMA/hns: Fix deadlock on SRQ async events.
  - IMA: Introduce a config for fix on IMA with Overlayfs issue
  - RDMA/hns: Fix UAF for cq async event
  - RDMA/hns: Fix mismatch exception rollback
  - sysv: don't call sb_bread() with pointers_lock held
  - RDMA/hns: Fix GMV table pagesize
  - RDMA/hns: Add mutex_destroy()
  - Control KABI reservation codes with config
  - RDMA/hns: Modify the print level of CQE error
  - !8109  vhost-vdpa: fix use after free in vhost_vdpa_probe()
  - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
  - arm: unwinder: Fix pc off-by-one in arm unwinder
  - x86: profiling: Using generic unwinding in profile_pc
  - x86: profiling: Check prof_buffer in profile_tick()
  - Remove redundants code for proc_cgroupstats_show
  - kbuild: Fix grep -q waring
  - Makefile: Exclude false positive warning options for Clang
  - !8054  CVE-2023-52669
  - !8190  crypto: jitter - change module_init(jent_mod_init) to subsys_initcall(jent_mod_init)
  - !8203  efi/libstub: arm64: Add macro isolation memmap detection code
  - PCI: Disable ATS for specific Intel IPU E2000 devices
  - PCI: Extract ATS disabling to a helper function
  - net: tls, update curr on splice as well
  - powerpc: update ppc_save_regs to save current r1 in pt_regs
  - mmc: sdhci-sprd: Fix eMMC init failure after hw reset
  - mmc: core: Cancel delayed work before releasing host
  - mmc: rpmb: fixes pause retune on all RPMB partitions.
  - mmc: meson-mx-sdhc: Fix initialization frozen issue
  - mm: fix unmap_mapping_range high bits shift bug
  - i2c: core: Fix atomic xfer check for non-preempt config
  - firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards
  - mm/memory-failure: check the mapcount of the precise page
  - net: Implement missing SO_TIMESTAMPING_NEW cmsg support
  - bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters()
  - asix: Add check for usbnet_get_endpoints
  - net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues
  - net/qla3xxx: switch from 'pci_' to 'dma_' API
  - i40e: Restore VF MSI-X state during PCI reset
  - ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux
  - ASoC: meson: g12a-toacodec: Fix event generation
  - ASoC: meson: g12a-tohdmitx: Validate written enum values
  - ASoC: meson: g12a-toacodec: Validate written enum values
  - i40e: fix use-after-free in i40e_aqc_add_filters()
  - net: Save and restore msg_namelen in sock_sendmsg
  - netfilter: nft_immediate: drop chain reference counter on error
  - netfilter: nftables: add loop check helper function
  - net: bcmgenet: Fix FCS generation for fragmented skbuffs
  - sfc: fix a double-free bug in efx_probe_filters
  - ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init
  - net: sched: em_text: fix possible memory leak in em_text_destroy()
  - i40e: Fix filter input checks to prevent config with invalid values
  - drm/i915/dp: Fix passing the correct DPCD_REV for drm_dp_set_phy_test_pattern
  - octeontx2-af: Fix marking couple of structure as __packed
  - nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP ProBook 440 G6
  - block: Don't invalidate pagecache for invalid falloc modes
  - keys, dns: Fix missing size check of V1 server-list header
  - cvm: improve security for cvm host feature
  - cvm: add secure memory query method
  - cvm: enable secure memory alloc on multiple numa nodes
  - x86/mm/pat: fix VM_PAT handling in COW mappings
  - !7110 [22.03-LTS-SP4] KVM TDP MMU new refactors
  - !8143  add kconfig for OLK-5.10
  - efi/libstub: arm64: Add macro isolation memmap detection code
  - btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations
  - btrfs: fix anon_dev leak in create_subvol()
  - crypto: jitter - change module_init(jent_mod_init) to subsys_initcall(jent_mod_init)
  - cpu/hotplug: Don't offline the last non-isolated CPU
  - mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
  - memcg: Introduce CONFIG_MEMCG_V1_THRESHOLD_QOS
  - kabi: use CONFIG_KABI_RESERVE to isolate bpf cgroup reserve flags
  - cgroup: add config isolation for cgroup_kill in cgroupv1
  - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  - RDMA: Verify port when creating flow rule
  - IB/mlx4: Use port iterator and validation APIs
  - mlxsw: spectrum_acl_tcam: Fix warning during rehash
  - drm/client: Fully protect modes[] with dev->mode_config.mutex
  - vhost-vdpa: fix use after free in vhost_vdpa_probe()
  - KVM: x86/mmu: Make KVM parameter tdp_mmu writeable
  - KVM: x86/mmu: Stop zapping invalidated TDP MMU roots asynchronously
  - kvm: x86: Do proper cleanup if kvm_x86_ops->vm_init() fails
  - KVM: x86/mmu: Do not filter address spaces in for_each_tdp_mmu_root_yield_safe()
  - KVM: x86/mmu: Open code leaf invalidation from mmu_notifier
  - KVM: x86/mmu: Include mmu.h in spte.h
  - KVM: x86/mmu: Harden TDP MMU iteration against root w/o shadow page
  - KVM: x86/mmu: Move the lockdep_assert of mmu_lock to inside clear_dirty_pt_masked()
  - KVM: x86/mmu: Add "never" option to allow sticky disabling of nx_huge_pages
  - KVM: x86/mmu: Use kstrtobool() instead of strtobool()
  - KVM: x86/mmu: Grab memslot for correct address space in NX recovery worker
  - KVM: x86/mmu: Add comment on try_cmpxchg64 usage in tdp_mmu_set_spte_atomic
  - KVM: x86: Preserve TDP MMU roots until they are explicitly invalidated
  - KVM: x86/mmu: Refresh CR0.WP prior to checking for emulated permission faults
  - KVM: x86/mmu: Merge all handle_changed_pte*() functions
  - KVM: x86/mmu: Remove handle_changed_spte_dirty_log()
  - KVM: x86/mmu: Remove "record_acc_track" in __tdp_mmu_set_spte()
  - KVM: x86/mmu: Bypass __handle_changed_spte() when aging TDP MMU SPTEs
  - KVM: x86/mmu: Drop unnecessary dirty log checks when aging TDP MMU SPTEs
  - KVM: x86/mmu: Clear only A-bit (if enabled) when aging TDP MMU SPTEs
  - KVM: x86/mmu: Remove "record_dirty_log" in __tdp_mmu_set_spte()
  - KVM: x86/mmu: Bypass __handle_changed_spte() when clearing TDP MMU dirty bits
  - KVM: x86/mmu: Drop access tracking checks when clearing TDP MMU dirty bits
  - KVM: x86/mmu: Atomically clear SPTE dirty state in the clear-dirty-log flow
  - KVM: x86/mmu: Consolidate Dirty vs. Writable clearing logic in TDP MMU
  - KVM: x86/mmu: Use kvm_ad_enabled() to determine if TDP MMU SPTEs need wrprot
  - KVM: x86/mmu: Add a helper function to check if an SPTE needs atomic write
  - KVM: VMX: Make CR0.WP a guest owned bit
  - KVM: x86: Make use of kvm_read_cr*_bits() when testing bits
  - KVM: x86: Ignore CR0.WP toggles in non-paging mode
  - KVM: x86: Do not unload MMU roots when only toggling CR0.WP with TDP enabled
  - KVM: x86/mmu: Fix comment typo
  - KVM: x86/mmu: Avoid indirect call for get_cr3
  - KVM: x86/mmu: Use gfn_t in kvm_flush_remote_tlbs_range()
  - KVM: x86/mmu: Rename kvm_flush_remote_tlbs_with_address()
  - KVM: x86/mmu: Collapse kvm_flush_remote_tlbs_with_{range,address}() together
  - KVM: x86/mmu: Make tdp_mmu_allowed static
  - KVM: x86/mmu: Cleanup range-based flushing for given page
  - KVM: x86/mmu: Fix wrong gfn range of tlb flushing in validate_direct_spte()
  - KVM: x86/mmu: Fix wrong start gfn of tlb flushing with range
  - KVM: x86/mmu: Reduce gfn range of tlb flushing in tdp_mmu_map_handle_target_level()
  - KVM: x86/mmu: Fix wrong gfn range of tlb flushing in kvm_set_pte_rmapp()
  - KVM: x86/mmu: Move round_gfn_for_level() helper into mmu_internal.h
  - KVM: x86/mmu: fix an incorrect comment in kvm_mmu_new_pgd()
  - kvm: x86/mmu: Rename SPTE_TDP_AD_ENABLED_MASK to SPTE_TDP_AD_ENABLED
  - KVM: x86/mmu: Pivot on "TDP MMU enabled" when handling direct page faults
  - KVM: x86/mmu: Pivot on "TDP MMU enabled" to check if active MMU is TDP MMU
  - KVM: x86/mmu: Replace open coded usage of tdp_mmu_page with is_tdp_mmu_page()
  - KVM: x86/mmu: Rename __direct_map() to direct_map()
  - KVM: x86/mmu: Stop needlessly making MMU pages available for TDP MMU faults
  - KVM: x86/mmu: Split out TDP MMU page fault handling
  - KVM: x86/mmu: Initialize fault.{gfn,slot} earlier for direct MMUs
  - KVM: x86/mmu: Handle no-slot faults in kvm_faultin_pfn()
  - KVM: x86/mmu: Avoid memslot lookup during KVM_PFN_ERR_HWPOISON handling
  - KVM: x86/mmu: Handle error PFNs in kvm_faultin_pfn()
  - KVM: x86/mmu: Grab mmu_invalidate_seq in kvm_faultin_pfn()
  - KVM: x86/mmu: Move TDP MMU VM init/uninit behind tdp_mmu_enabled
  - KVM: x86/mmu: Change tdp_mmu to a read-only parameter
  - KVM: x86/mmu: Don't install TDP MMU SPTE if SP has unexpected level
  - KVM: x86/mmu: Re-check under lock that TDP MMU SP hugepage is disallowed
  - KVM: x86/mmu: Map TDP MMU leaf SPTE iff target level is reached
  - KVM: x86/mmu: Don't attempt to map leaf if target TDP MMU SPTE is frozen
  - KVM: x86/mmu: Fix race condition in direct_page_fault
  - KVM: x86/mmu: Do not recover dirty-tracked NX Huge Pages
  - KVM: x86/mmu: simplify kvm_tdp_mmu_map flow when guest has to retry
  - KVM: x86/mmu: Split huge pages mapped by the TDP MMU on fault
  - KVM: x86/mmu: Block all page faults during kvm_zap_gfn_range()
  - KVM: x86/mmu: WARN if TDP MMU SP disallows hugepage after being zapped
  - KVM: x86/mmu: explicitly check nx_hugepage in disallowed_hugepage_adjust()
  - KVM: x86/mmu: Add helper to convert SPTE value to its shadow page
  - KVM: x86/mmu: Track the number of TDP MMU pages, but not the actual pages
  - KVM: x86/mmu: Set disallowed_nx_huge_page in TDP MMU before setting SPTE
  - KVM: x86/mmu: Properly account NX huge page workaround for nonpaging MMUs
  - KVM: x86/mmu: Rename NX huge pages fields/functions for consistency
  - KVM: x86/mmu: Tag disallowed NX huge pages even if they're not tracked
  - KVM: x86/mmu: add missing update to max_mmu_rmap_size
  - KVM: X86: avoid uninitialized 'fault.async_page_fault' from fixed-up #PF
  - KVM: x86/mmu: remove unused variable
  - KVM, x86/mmu: Fix the comment around kvm_tdp_mmu_zap_leafs()
  - KVM: x86/mmu: Don't bottom out on leafs when zapping collapsible SPTEs
  - KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level()
  - KVM: x86/mmu: Don't require refcounted "struct page" to create huge SPTEs
  - KVM: x86/mmu: Remove underscores from __pte_list_remove()
  - KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs
  - KVM: x86/mmu: Rename rmap zap helpers to eliminate "unmap" wrapper
  - KVM: x86/mmu: Rename __kvm_zap_rmaps() to align with other nomenclature
  - KVM: x86/mmu: Drop the "p is for pointer" from rmap helpers
  - KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps
  - KVM: x86/mmu: Return a u64 (the old SPTE) from mmu_spte_clear_track_bits()
  - KVM: x86/mmu: Fix typo and tweak comment for split_desc_cache capacity
  - KVM: x86/mmu: Expand quadrant comment for PG_LEVEL_4K shadow pages
  - KVM: x86/mmu: Add optimized helper to retrieve an SPTE's index
  - KVM: x86/mmu: Replace UNMAPPED_GVA with INVALID_GPA for gva_to_gpa()
  - KVM: x86/mmu: Buffer nested MMU split_desc_cache only by default capacity
  - KVM: x86/mmu: Use "unsigned int", not "u32", for SPTEs' @access info
  - KVM: x86/mmu: Avoid unnecessary flush on eager page split
  - KVM: x86/mmu: Extend Eager Page Splitting to nested MMUs
  - KVM: Allow for different capacities in kvm_mmu_memory_cache structs
  - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page()
  - KVM: x86/mmu: Zap collapsible SPTEs in shadow MMU at all possible levels
  - KVM: x86/mmu: Extend make_huge_page_split_spte() for the shadow MMU
  - KVM: x86/mmu: Cache the access bits of shadowed translations
  - KVM: x86/mmu: Update page stats in __rmap_add()
  - KVM: x86/mmu: Decouple rmap_add() and link_shadow_page() from kvm_vcpu
  - KVM: x86/mmu: Allow NULL @vcpu in kvm_mmu_find_shadow_page()
  - KVM: x86/mmu: Pass kvm pointer separately from vcpu to kvm_mmu_find_shadow_page()
  - KVM: x86/mmu: Replace vcpu with kvm in kvm_mmu_alloc_shadow_page()
  - KVM: x86/mmu: Pass memory caches to allocate SPs separately
  - KVM: x86/mmu: Move guest PT write-protection to account_shadowed()
  - KVM: x86/mmu: Rename shadow MMU functions that deal with shadow pages
  - KVM: x86/mmu: Consolidate shadow page allocation and initialization
  - KVM: x86/mmu: Decompose kvm_mmu_get_page() into separate functions
  - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes
  - KVM: x86/mmu: Derive shadow MMU page role from parent
  - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root()
  - KVM: x86/mmu: Use a bool for direct
  - KVM: x86/mmu: Optimize MMU page cache lookup for all direct SPs
  - KVM: X86/MMU: Fix shadowing 5-level NPT for 4-level NPT L1 guest
  - KVM: X86/MMU: Add sp_has_gptes()
  - KVM: Do not zero initialize 'pfn' in hva_to_pfn()
  - KVM: x86/mmu: Shove refcounted page dependency into host_pfn_mapping_level()
  - KVM: Rename/refactor kvm_is_reserved_pfn() to kvm_pfn_to_refcounted_page()
  - KVM: Take a 'struct page', not a pfn in kvm_is_zone_device_page()
  - KVM: Remove kvm_vcpu_gfn_to_page() and kvm_vcpu_gpa_to_page()
  - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page
  - KVM: Don't WARN if kvm_pfn_to_page() encounters a "reserved" pfn
  - KVM: Avoid pfn_to_page() and vice versa when releasing pages
  - KVM: x86/mmu: Use common logic for computing the 32/64-bit base PA mask
  - KVM: x86/mmu: Truncate paging32's PT_BASE_ADDR_MASK to 32 bits
  - KVM: x86/mmu: Use common macros to compute 32/64-bit paging masks
  - KVM: x86/mmu: Use separate namespaces for guest PTEs and shadow PTEs
  - KVM: x86/mmu: Dedup macros for computing various page table masks
  - KVM: x86/mmu: Bury 32-bit PSE paging helpers in paging_tmpl.h
  - KVM: VMX: Refactor 32-bit PSE PT creation to avoid using MMU macro
  - KVM: X86/MMU: Remove unused PT32_DIR_BASE_ADDR_MASK from mmu.c
  - KVM: x86/MMU: Zap non-leaf SPTEs when disabling dirty logging
  - KVM: x86/mmu: Check every prev_roots in __kvm_mmu_free_obsolete_roots()
  - KVM: x86/mmu: Use IS_ENABLED() to avoid RETPOLINE for TDP page faults
  - KVM: x86/mmu: Make all page fault handlers internal to the MMU
  - KVM: x86/mmu: Add RET_PF_CONTINUE to eliminate bool+int* "returns"
  - KVM: x86/mmu: Drop exec/NX check from "page fault can be fast"
  - KVM: x86/mmu: Don't attempt fast page fault just because EPT is in use
  - KVM: x86/mmu: Use atomic XCHG to write TDP MMU SPTEs with volatile bits
  - KVM: x86/mmu: Move shadow-present check out of spte_has_volatile_bits()
  - KVM: x86/mmu: Don't treat fully writable SPTEs as volatile (modulo A/D)
  - KVM: x86/mmu: replace direct_map with root_role.direct
  - KVM: x86/mmu: replace root_level with cpu_role.base.level
  - KVM: x86/mmu: replace shadow_root_level with root_role.level
  - KVM: x86/mmu: pull CPU mode computation to kvm_init_mmu
  - KVM: x86/mmu: simplify and/or inline computation of shadow MMU roles
  - KVM: x86/mmu: remove redundant bits from extended role
  - KVM: x86/mmu: rename kvm_mmu_role union
  - KVM: x86/mmu: remove extended bits from mmu_role, rename field
  - KVM: x86/mmu: store shadow EFER.NX in the MMU role
  - KVM: x86/mmu: cleanup computation of MMU roles for shadow paging
  - KVM: x86/mmu: cleanup computation of MMU roles for two-dimensional paging
  - KVM: x86/mmu: remove kvm_calc_shadow_root_page_role_common
  - KVM: x86/mmu: remove ept_ad field
  - KVM: x86/mmu: do not recompute root level from kvm_mmu_role_regs
  - KVM: x86/mmu: split cpu_role from mmu_role
  - KVM: x86/mmu: remove "bool base_only" arguments
  - KVM: x86/mmu: rephrase unclear comment
  - KVM: x86/mmu: pull computation of kvm_mmu_role_regs to kvm_init_mmu
  - KVM: x86/mmu: constify uses of struct kvm_mmu_role_regs
  - KVM: x86/mmu: nested EPT cannot be used in SMM
  - KVM: x86/mmu: include EFER.LMA in extended mmu role
  - KVM: x86/mmu: fix potential races when walking host page table
  - KVM: x86/mmu: Do not create SPTEs for GFNs that exceed host.MAXPHYADDR
  - KVM: x86/mmu: Derive EPT violation RWX bits from EPTE RWX bits
  - KVM: VMX: replace 0x180 with EPT_VIOLATION_* definition
  - KVM: x86/mmu: remove unnecessary flush_workqueue()
  - KVM: x86/mmu: Don't rebuild page when the page is synced and no tlb flushing is required
  - KVM: x86: mmu: trace kvm_mmu_set_spte after the new SPTE was set
  - KVM: x86/mmu: Zap only TDP MMU leafs in zap range and mmu_notifier unmap
  - KVM: MMU: propagate alloc_workqueue failure
  - Revert "KVM: x86/mmu: Zap only TDP MMU leafs in kvm_zap_gfn_range()"
  - kvm: x86/mmu: Flush TLB before zap_gfn_range releases RCU
  - KVM: x86/mmu: WARN on any attempt to atomically update REMOVED SPTE
  - KVM: x86/mmu: Check for a REMOVED leaf SPTE before making the SPTE
  - KVM: x86/mmu: Zap defunct roots via asynchronous worker
  - KVM: x86/mmu: Zap roots in two passes to avoid inducing RCU stalls
  - KVM: x86/mmu: Allow yielding when zapping GFNs for defunct TDP MMU root
  - KVM: x86/mmu: Zap invalidated roots via asynchronous worker
  - KVM: x86/mmu: Defer TLB flush to caller when freeing TDP MMU shadow pages
  - KVM: x86/mmu: Do remote TLB flush before dropping RCU in TDP MMU resched
  - KVM: x86/mmu: Zap only TDP MMU leafs in kvm_zap_gfn_range()
  - KVM: x86/mmu: Require mmu_lock be held for write to zap TDP MMU range
  - KVM: x86/mmu: Add dedicated helper to zap TDP MMU root shadow page
  - KVM: x86/mmu: Skip remote TLB flush when zapping all of TDP MMU
  - KVM: x86/mmu: Zap only the target TDP MMU shadow page in NX recovery
  - KVM: x86/mmu: Refactor low-level TDP MMU set SPTE helper to take raw values
  - KVM: x86/mmu: Add helpers to read/write TDP MMU SPTEs and document RCU
  - KVM: x86/mmu: Drop RCU after processing each root in MMU notifier hooks
  - KVM: x86/mmu: Batch TLB flushes from TDP MMU for MMU notifier change_spte
  - KVM: x86/mmu: Check for !leaf=>leaf, not PFN change, in TDP MMU SP removal
  - KVM: x86/mmu: do not allow readers to acquire references to invalid roots
  - KVM: x86/mmu: only perform eager page splitting on valid roots
  - KVM: x86/mmu: Require mmu_lock be held for write in unyielding root iter
  - KVM: x86/mmu: Document that zapping invalidated roots doesn't need to flush
  - KVM: x86/mmu: Formalize TDP MMU's (unintended?) deferred TLB flush logic
  - KVM: WARN if is_unsync_root() is called on a root without a shadow page
  - KVM: s390: Replace KVM_REQ_MMU_RELOAD usage with arch specific request
  - KVM: x86/mmu: Zap only obsolete roots if a root shadow page is zapped
  - KVM: Drop kvm_reload_remote_mmus(), open code request in x86 users
  - KVM: x86: Invoke kvm_mmu_unload() directly on CR4.PCIDE change
  - KVM: x86: flush TLB separately from MMU reset
  - KVM: x86/mmu: clear MMIO cache when unloading the MMU
  - KVM: x86/mmu: load new PGD after the shadow MMU is initialized
  - KVM: x86/mmu: look for a cached PGD when going from 32-bit to 64-bit
  - KVM: x86/mmu: do not pass vcpu to root freeing functions
  - KVM: x86/mmu: do not consult levels when freeing roots
  - KVM: x86: use struct kvm_mmu_root_info for mmu->root
  - KVM: x86: do not deliver asynchronous page faults if CR0.PG=0
  - KVM: x86: Reinitialize context if host userspace toggles EFER.LME
  - KVM: x86: Retry page fault if MMU reload is pending and root has no sp
  - KVM: x86/mmu: Remove MMU auditing
  - KVM: x86/mmu: Add tracepoint for splitting huge pages
  - KVM: x86/mmu: Split huge pages mapped by the TDP MMU during KVM_CLEAR_DIRTY_LOG
  - KVM: x86/mmu: Split huge pages mapped by the TDP MMU when dirty logging is enabled
  - KVM: x86/mmu: Separate TDP MMU shadow page allocation and initialization
  - KVM: x86/mmu: Derive page role for TDP MMU shadow pages from parent
  - KVM: x86/mmu: Remove redundant role overrides for TDP MMU shadow pages
  - KVM: x86/mmu: Refactor TDP MMU iterators to take kvm_mmu_page root
  - KVM: x86/mmu: Move restore_acc_track_spte() to spte.h
  - KVM: x86/mmu: Drop new_spte local variable from restore_acc_track_spte()
  - KVM: x86/mmu: Remove unnecessary warnings from restore_acc_track_spte()
  - KVM: x86/mmu: Consolidate logic to atomically install a new TDP MMU page table
  - KVM: x86/mmu: Rename handle_removed_tdp_mmu_page() to handle_removed_pt()
  - KVM: x86/mmu: Rename TDP MMU functions that handle shadow pages
  - KVM: x86/mmu: Change tdp_mmu_{set,zap}_spte_atomic() to return 0/-EBUSY
  - KVM: x86/mmu: Automatically update iter->old_spte if cmpxchg fails
  - KVM: x86/mmu: Rename __rmap_write_protect() to rmap_write_protect()
  - KVM: x86/mmu: Rename rmap_write_protect() to kvm_vcpu_write_protect_gfn()
  - KVM: x86/mmu: Consolidate comments about {Host,MMU}-writable
  - KVM: x86/mmu: Rename DEFAULT_SPTE_MMU_WRITEABLE to DEFAULT_SPTE_MMU_WRITABLE
  - KVM: x86/mmu: Move is_writable_pte() to spte.h
  - KVM: x86/mmu: Check SPTE writable invariants when setting leaf SPTEs
  - KVM: x86/mmu: Move SPTE writable invariant checks to a helper function
  - KVM: x86/mmu_audit: Remove unused "level" of audit_spte_after_sync()
  - KVM: x86/tdp_mmu: Remove unused "kvm" of kvm_tdp_mmu_get_root()
  - KVM: x86/mmu: Remove unused "kvm" of __rmap_write_protect()
  - KVM: x86/mmu: Remove unused "kvm" of kvm_mmu_unlink_parents()
  - KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU
  - KVM: x86/mmu: Move "invalid" check out of kvm_tdp_mmu_get_root()
  - KVM: x86/mmu: Use common TDP MMU zap helper for MMU notifier unmap hook
  - KVM: remove async parameter of hva_to_pfn_remapped()
  - KVM: x86/mmu: Improve TLB flush comment in kvm_mmu_slot_remove_write_access()
  - KVM: x86/mmu: Document and enforce MMU-writable and Host-writable invariants
  - KVM: x86/mmu: Clear MMU-writable during changed_pte notifier
  - KVM: x86/MMU: Simplify flow of vmx_get_mt_mask
  - KVM: x86/mmu: Remove need for a vcpu from mmu_try_to_unsync_pages
  - KVM: x86/mmu: Remove need for a vcpu from kvm_slot_page_track_is_active
  - KVM: x86/mmu: Use shadow page role to detect PML-unfriendly pages for L2
  - KVM: x86/mmu: Retry page fault if root is invalidated by memslot update
  - KVM: x86/mmu: Handle "default" period when selectively waking kthread
  - KVM: x86/mmu: Remove spurious TLB flushes in TDP MMU zap collapsible path
  - KVM: x86/mmu: Use yield-safe TDP MMU root iter in MMU notifier unmapping
  - KVM: X86: Rename gpte_is_8_bytes to has_4_byte_gpte and invert the direction
  - KVM: MMU: update comment on the number of page role combinations
  - KVM: X86: Add parameter huge_page_level to kvm_init_shadow_ept_mmu()
  - KVM: X86: Add huge_page_level to __reset_rsvds_bits_mask_ept()
  - KVM: X86: Remove mmu->translate_gpa
  - KVM: x86: Subsume nested GPA read helper into load_pdptrs()
  - KVM: X86: Add parameter struct kvm_mmu *mmu into mmu->gva_to_gpa()
  - KVM: X86: Calculate quadrant when !role.gpte_is_8_bytes
  - KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct
  - KVM: X86: Remove unused declaration of __kvm_mmu_free_some_pages()
  - KVM: X86: Fix comment in __kvm_mmu_create()
  - KVM: X86: Skip allocating pae_root for vcpu->arch.guest_mmu when !tdp_enabled
  - KVM: x86: Forbid KVM_SET_CPUID{,2} after KVM_RUN
  - KVM: x86/mmu: Pass parameter flush as false in kvm_tdp_mmu_zap_collapsible_sptes()
  - KVM: x86/mmu: Skip tlb flush if it has been done in zap_gfn_range()
  - kvm: mmu: Use fast PF path for access tracking of huge pages when possible
  - KVM: x86/mmu: Properly dereference rcu-protected TDP MMU sptep iterator
  - KVM: x86/mmu: Extract zapping of rmaps for gfn range to separate helper
  - KVM: x86/mmu: Drop a redundant remote TLB flush in kvm_zap_gfn_range()
  - KVM: x86/mmu: Drop a redundant, broken remote TLB flush
  - KVM: X86: Don't unload MMU in kvm_vcpu_flush_tlb_guest()
  - KVM: x86/mmu: Unexport MMU load/unload functions
  - KVM: X86: pair smp_wmb() of mmu_try_to_unsync_pages() with smp_rmb()
  - KVM: X86: Cache CR3 in prev_roots when PCID is disabled
  - KVM: X86: Fix tlb flush for tdp in kvm_invalidate_pcid()
  - KVM: X86: Don't reset mmu context when toggling X86_CR4_PGE
  - KVM: X86: Don't reset mmu context when X86_CR4_PCIDE 1->0
  - kvm: x86: mmu: Make NX huge page recovery period configurable
  - KVM: x86/mmu: Rename slot_handle_leaf to slot_handle_level_4k
  - KVM: x86/mmu: clean up prefetch/prefault/speculative naming
  - KVM: cleanup allocation of rmaps and page tracking data
  - KVM: X86: fix lazy allocation of rmaps
  - KVM: x86/mmu: kvm_faultin_pfn has to return false if pfh is returned
  - KVM: x86: only allocate gfn_track when necessary
  - KVM: x86: add config for non-kvm users of page tracking
  - KVM: x86/mmu: Avoid memslot lookup in make_spte and mmu_try_to_unsync_pages
  - KVM: x86/mmu: Avoid memslot lookup in rmap_add
  - KVM: MMU: pass struct kvm_page_fault to mmu_set_spte
  - KVM: MMU: pass kvm_mmu_page struct to make_spte
  - KVM: MMU: set ad_disabled in TDP MMU role
  - KVM: MMU: remove unnecessary argument to mmu_set_spte
  - KVM: MMU: clean up make_spte return value
  - KVM: MMU: inline set_spte in FNAME(sync_page)
  - KVM: MMU: inline set_spte in mmu_set_spte
  - KVM: x86/mmu: Avoid memslot lookup in page_fault_handle_page_track
  - KVM: x86/mmu: Pass the memslot around via struct kvm_page_fault
  - KVM: MMU: unify tdp_mmu_map_set_spte_atomic and tdp_mmu_set_spte_atomic_no_dirty_log
  - KVM: MMU: mark page dirty in make_spte
  - KVM: x86/mmu: Fold rmap_recycle into rmap_add
  - KVM: x86/mmu: Verify shadow walk doesn't terminate early in page faults
  - KVM: MMU: change tracepoints arguments to kvm_page_fault
  - KVM: MMU: change disallowed_hugepage_adjust() arguments to kvm_page_fault
  - KVM: MMU: change kvm_mmu_hugepage_adjust() arguments to kvm_page_fault
  - KVM: MMU: change fast_page_fault() arguments to kvm_page_fault
  - KVM: MMU: change tdp_mmu_map_handle_target_level() arguments to kvm_page_fault
  - KVM: MMU: change kvm_tdp_mmu_map() arguments to kvm_page_fault
  - KVM: MMU: change FNAME(fetch)() arguments to kvm_page_fault
  - KVM: MMU: change __direct_map() arguments to kvm_page_fault
  - KVM: MMU: change handle_abnormal_pfn() arguments to kvm_page_fault
  - KVM: MMU: change kvm_faultin_pfn() arguments to kvm_page_fault
  - KVM: MMU: change page_fault_handle_page_track() arguments to kvm_page_fault
  - KVM: MMU: change direct_page_fault() arguments to kvm_page_fault
  - KVM: MMU: change mmu->page_fault() arguments to kvm_page_fault
  - KVM: MMU: Introduce struct kvm_page_fault
  - KVM: MMU: pass unadulterated gpa to direct_page_fault
  - KVM: X86: Remove FNAME(update_pte)
  - KVM: X86: Zap the invalid list after remote tlb flushing
  - KVM: X86: Change kvm_sync_page() to return true when remote flush is needed
  - KVM: X86: Remove kvm_mmu_flush_or_zap()
  - KVM: X86: Don't flush current tlb on shadow page modification
  - KVM: X86: Don't unsync pagetables when speculative
  - KVM: x86/mmu: Complete prefetch for trailing SPTEs for direct, legacy MMU
  - KVM: Remove tlbs_dirty
  - KVM: X86: Synchronize the shadow pagetable before link it
  - KVM: X86: Fix missed remote tlb flush in rmap_write_protect()
  - KVM: x86/mmu: Move lpage_disallowed_link further "down" in kvm_mmu_page
  - KVM: x86/mmu: Relocate kvm_mmu_page.tdp_mmu_page for better cache locality
  - KVM: x86/mmu: Remove unused field mmio_cached in struct kvm_mmu_page
  - KVM: x86: clamp host mapping level to max_level in kvm_mmu_max_mapping_level
  - KVM: x86/mmu: Drop 'shared' param from tdp_mmu_link_page()
  - KVM: x86/mmu: Add detailed page size stats
  - KVM: x86/mmu: Avoid collision with !PRESENT SPTEs in TDP MMU lpage stats
  - KVM: x86/mmu: Remove redundant spte present check in mmu_set_spte
  - KVM: x86/mmu: allow kvm_faultin_pfn to return page fault handling code
  - KVM: x86/mmu: rename try_async_pf to kvm_faultin_pfn
  - KVM: x86/mmu: add comment explaining arguments to kvm_zap_gfn_range
  - KVM: x86/mmu: fix parameters to kvm_flush_remote_tlbs_with_address
  - Revert "KVM: x86/mmu: Allow zap gfn range to operate under the mmu read lock"
  - KVM: X86: Introduce kvm_mmu_slot_lpages() helpers
  - KVM: x86/mmu: Don't step down in the TDP iterator when zapping all SPTEs
  - KVM: x86/mmu: Don't leak non-leaf SPTEs when zapping all SPTEs
  - KVM: x86/mmu: Rename __gfn_to_rmap to gfn_to_rmap
  - KVM: x86/mmu: Leverage vcpu->last_used_slot for rmap_add and rmap_recycle
  - KVM: x86/mmu: Leverage vcpu->last_used_slot in tdp_mmu_map_handle_target_level
  - KVM: Cache the last used slot index per vCPU
  - KVM: Move last_used_slot logic out of search_memslots
  - KVM: Rename lru_slot to last_used_slot
  - KVM: X86: Optimize zapping rmap
  - KVM: X86: Optimize pte_list_desc with per-array counter
  - KVM: X86: MMU: Tune PTE_LIST_EXT to be bigger
  - KVM: Don't take mmu_lock for range invalidation unless necessary
  - KVM: Block memslot updates across range_start() and range_end()
  - KVM: Introduce kvm_get_kvm_safe()
  - KVM: X86: Add per-vm stat for max rmap list size
  - KVM: x86/mmu: Return old SPTE from mmu_spte_clear_track_bits()
  - KVM: x86/mmu: Refactor shadow walk in __direct_map() to reduce indentation
  - KVM: x86/mmu: Mark VM as bugged if page fault returns RET_PF_INVALID
  - KVM: x86: Use KVM_BUG/KVM_BUG_ON to handle bugs that are fatal to the VM
  - KVM: Export kvm_make_all_cpus_request() for use in marking VMs as bugged
  - KVM: x86: Do not write protect huge page in initially-all-set mode
  - KVM: x86: Support write protecting only large pages
  - KVM: x86/mmu: Remove a variety of unnecessary exports
  - KVM: x86: Fold "write-protect large" use case into generic write-protect
  - KVM: x86/mmu: Don't set dirty bits when disabling dirty logging w/ PML
  - KVM: VMX: Dynamically enable/disable PML based on memslot dirty logging
  - KVM: x86: Move MMU's PML logic to common code
  - KVM: x86/mmu: Make dirty log size hook (PML) a value, not a function
  - KVM: x86/mmu: Let guest use GBPAGES if supported in hardware and TDP is on
  - KVM: x86/mmu: Get CR4.SMEP from MMU, not vCPU, in shadow page fault
  - KVM: x86/mmu: Get CR0.WP from MMU, not vCPU, in shadow page fault
  - KVM: x86/mmu: Drop redundant rsvd bits reset for nested NPT
  - KVM: x86/mmu: Optimize and clean up so called "last nonleaf level" logic
  - KVM: x86: Enhance comments for MMU roles and nested transition trickiness
  - KVM: x86/mmu: WARN on any reserved SPTE value when making a valid SPTE
  - KVM: x86/mmu: Add helpers to do full reserved SPTE checks w/ generic MMU
  - KVM: x86/mmu: Use MMU's role to determine PTTYPE
  - KVM: x86/mmu: Collapse 32-bit PAE and 64-bit statements for helpers
  - KVM: x86/mmu: Add a helper to calculate root from role_regs
  - KVM: x86/mmu: Add helper to update paging metadata
  - KVM: x86/mmu: Don't update nested guest's paging bitmasks if CR0.PG=0
  - KVM: x86/mmu: Consolidate reset_rsvds_bits_mask() calls
  - KVM: x86/mmu: Use MMU role_regs to get LA57, and drop vCPU LA57 helper
  - KVM: x86/mmu: Get nested MMU's root level from the MMU's role
  - KVM: x86/mmu: Drop "nx" from MMU context now that there are no readers
  - KVM: x86/mmu: Use MMU's role to get EFER.NX during MMU configuration
  - KVM: x86/mmu: Use MMU's role/role_regs to compute context's metadata
  - KVM: x86/mmu: Use MMU's role to detect EFER.NX in guest page walk
  - KVM: x86/mmu: Use MMU's roles to compute last non-leaf level
  - KVM: x86/mmu: Use MMU's role to compute PKRU bitmask
  - KVM: x86/mmu: Use MMU's role to compute permission bitmask
  - KVM: x86/mmu: Drop vCPU param from reserved bits calculator
  - KVM: x86/mmu: Use MMU's role to get CR4.PSE for computing rsvd bits
  - KVM: x86/mmu: Don't grab CR4.PSE for calculating shadow reserved bits
  - KVM: x86/mmu: Always set new mmu_role immediately after checking old role
  - KVM: x86/mmu: Set CR4.PKE/LA57 in MMU role iff long mode is active
  - KVM: x86/mmu: Do not set paging-related bits in MMU role if CR0.PG=0
  - KVM: x86/mmu: Add accessors to query mmu_role bits
  - KVM: x86/mmu: Rename "nxe" role bit to "efer_nx" for macro shenanigans
  - KVM: x86/mmu: Use MMU's role_regs, not vCPU state, to compute mmu_role
  - KVM: x86/mmu: Ignore CR0 and CR4 bits in nested EPT MMU role
  - KVM: x86/mmu: Consolidate misc updates into shadow_mmu_init_context()
  - KVM: x86/mmu: Add struct and helpers to retrieve MMU role bits from regs
  - KVM: x86/mmu: Grab shadow root level from mmu_role for shadow MMUs
  - KVM: x86/mmu: Move nested NPT reserved bit calculation into MMU proper
  - KVM: x86: Read and pass all CR0/CR4 role bits to shadow MMU helper
  - KVM: x86: Introduce kvm_post_set_cr4 to post handle the CR4 emulation
  - KVM: x86: Introduce kvm_post_set_cr0 to post handle the CR0 emulation
  - KVM: x86: Add more protection against undefined behavior in rsvd_bits()
  - KVM: x86/mmu: Drop smep_andnot_wp check from "uses NX" for shadow MMUs
  - KVM: x86: Fix sizes used to pass around CR0, CR4, and EFER
  - KVM: x86/mmu: Rename unsync helper and update related comments
  - KVM: x86/mmu: Drop the intermediate "transient" __kvm_sync_page()
  - KVM: x86/mmu: comment on kvm_mmu_get_page's syncing of pages
  - KVM: x86/mmu: WARN and zap SP when sync'ing if MMU role mismatches
  - KVM: x86/mmu: Use MMU role to check for matching guest page sizes
  - KVM: x86/mmu: Unconditionally zap unsync SPs when creating >4k SP at GFN
  - Revert "KVM: MMU: record maximum physical address width in kvm_mmu_extended_role"
  - KVM: x86: Alert userspace that KVM_SET_CPUID{,2} after KVM_RUN is broken
  - KVM: x86: Force all MMUs to reinitialize if guest CPUID is modified
  - KVM: nVMX: WARN if subtly-impossible VMFUNC conditions occur
  - KVM: x86: Drop pointless @reset_roots from kvm_init_mmu()
  - KVM: x86: Defer MMU sync on PCID invalidation
  - KVM: nVMX: Use fast PGD switch when emulating VMFUNC[EPTP_SWITCH]
  - KVM: x86: Use KVM_REQ_TLB_FLUSH_GUEST to handle INVPCID(ALL) emulation
  - KVM: nVMX: Consolidate VM-Enter/VM-Exit TLB flush and MMU sync logic
  - KVM: x86: Drop skip MMU sync and TLB flush params from "new PGD" helpers
  - KVM: nSVM: Move TLB flushing logic (or lack thereof) to dedicated helper
  - KVM: x86: Uncondtionally skip MMU sync/TLB flush in MOV CR3's PGD switch
  - KVM: x86: Invalidate all PGDs for the current PCID on MOV CR3 w/ flush
  - KVM: nVMX: Free only guest_mode (L2) roots on INVVPID w/o EPT
  - scsi: iscsi: Fix iscsi_task use after free
  - scsi: iscsi: Have abort handler get ref to conn
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  - crypto: s390/aes - Fix buffer overread in CTR mode
  - block: prevent division by zero in blk_rq_stat_sum()
  - IMA: Support the measurement extending of TSI TMM
  - vt: fix unicode buffer corruption when deleting characters
  - selinux: avoid dereference of garbage after mount failure
  - btrfs: send: handle path ref underflow in header iterate_inode_ref()
  - x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
  - crypto: xilinx - call finalize with bh disabled


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-207.0.0.116
changelog:
  - !8599  Bluetooth: hci_core: Fix possible buffer overflow
  - !8949  CVE-2022-48652
  - !8602  netfilter: nf_tables: set dormant flag on hook register failure
  - !8867  ipv6: prevent NULL dereference in ip6_output()
  - !8779  smb: client: fix UAF in smb2_reconnect_server()
  - !8893 [sync] PR-8531:  gpiolib: cdev: fix uninitialised kfifo
  - !8985  cvm_tsi: Fix security issue for Confidential cVM TSI
  - !8686  mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  - !8711  ubifs: Set page uptodate in the correct place
  - !8860  blk-iocost: do not WARN if iocg was already offlined
  - !8639  s390/qeth: Fix kernel panic after setting hsuid
  - !8946  usb: typec: ucsi: Limit read size on v1.2
  - !8969  Fix CVE-2024-36949
  - cvm_tsi: Fix security issue for Confidential cVM TSI
  - !8216  ACPI: video: check for error while searching for backlight device parent
  - !8903  ALSA: scarlett2: Add missing error checks to *_ctl_get()
  - !8584  virtio-blk: fix implicit overflow on virtio_max_dma_size
  - !8838  blk-iocost: avoid out of bounds shift
  - !8856  PCI/PM: Drain runtime-idle callbacks before driver removal
  - amd/amdkfd: sync all devices to wait all processes being evicted
  - drm/amdkfd: Rework kfd_locked handling
  - !8906  net/mlx5e: Fix use-after-free of encap entry in neigh update handler
  - !8910  gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - ice: Fix crash by keep old cfg when update TCs more than queues
  - ice: ethtool: Prohibit improper channel config for DCB
  - !8879  net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - !6695  netfilter: nft_set_pipapo: do not free live element
  - usb: typec: ucsi: Limit read size on v1.2
  - !8891  net: fix out-of-bounds access in ops_init
  - !8871 add sdma-dae for openeuler 22.03 SP4
  - !8762  tipc: fix UAF in error path
  - !8742  octeontx2-af: avoid off-by-one read from userspace
  - !8734  mptcp: ensure snd_nxt is properly initialized on connect
  - !8634  batman-adv: Avoid infinite loop trying to resize local TT
  - !8736  net: hns3: fix kernel crash when devlink reload during initialization
  - !8745  afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
  - !3547  fs: mitigatin cacheline false sharing in struct file
  - !8887  nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - net/mlx5e: Fix use-after-free of encap entry in neigh update handler
  - ALSA: scarlett2: Add missing error checks to *_ctl_get()
  - !8785  tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  - drivers: misc: sdma-dae: enable sdma_dae for arm64
  - drivers: misc: sdma-dae: support page fault preprocess
  - gpiolib: cdev: fix uninitialised kfifo
  - !8849  ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - net: fix out-of-bounds access in ops_init
  - !8666  phonet/pep: fix racy skb_queue_empty() use
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - drivers: misc: sdma-dae: support interrupt init and handle
  - drivers: misc: sdma-dae: support sqe task send and execute
  - drivers: misc: sdma-dae: support channel management
  - drivers: misc: sdma-dae: support getting streamID
  - drivers: misc: sdma-dae: support initializ sdma driver
  - ipv6: prevent NULL dereference in ip6_output()
  - blk-iocost: do not WARN if iocg was already offlined
  - PCI/PM: Drain runtime-idle callbacks before driver removal
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - !8684  tcp: properly terminate timers for kernel sockets
  - !8629  erspan: make sure erspan_base_hdr is present in skb->head
  - blk-iocost: avoid out of bounds shift
  - !8635  ipv6: Fix potential uninit-value access in __ip6_make_skb()
  - !8550  tipc: fix a possible memleak in tipc_buf_append
  - !8726  tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - !8808 v2  Add support for PCC Operation Region
  - !8623  fs/9p: only translate RWX permissions for plain 9P2000
  - !8479  scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - !8770 IMA: Check cvm world before call smc function
  - !8797 kvm: arm64: Fix a compilation error
  - !8782 drivers: net: ub: dev: network_mgmt: Modify the dguid of network control packets.
  - arm64: config: Enable ACPI_PCC
  - ACPI: PCC: Setup PCC Opregion handler only if platform interrupt is available
  - ACPI: PCC: Fix unintentional integer overflow
  - ACPI: PCC: Fix Tx acknowledge in the PCC address space handler
  - ACPI: PCC: replace wait_for_completion()
  - ACPI: PCC: Release resources on address space setup failure path
  - ACPI: PCC: pcc_ctx can be static
  - ACPI: PCC: Implement OperationRegion handler for the PCC Type 3 subtype
  - ACPICA: Add support for PCC Opregion special context data
  - kvm: arm64: Fix a compilation error
  - network_mgmt: Modify the dguid of network control packets.
  - !8781 HNS3: Supports the configuration of default mc guid
  - !8789  Bluetooth: SCO: Fix not validating setsockopt user input
  - !8658  usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
  - !8673 IMA: Support uid and gid tamplate
  - IMA: Check cvm world before call smc function
  - Bluetooth: SCO: Fix not validating setsockopt user input
  - !8679  rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  - !8558  xen-netfront: Add missing skb_mark_for_recycle
  - !8725 v6  Fix CVE-2023-52732
  - !8222  Fix CVE-2023-52672
  - !8590  geneve: fix header validation in geneve[6
  - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  - HNS3: Supports the configuration of default mc guid
  - smb: client: fix UAF in smb2_reconnect_server()
  - !8355  powerpc: defconfig: Disable CONFIG_DW_EDMA and CONFIG_DW_EDMA_PCIE
  - tipc: fix UAF in error path
  - !8749  ubifs: Check @c->dirty_[n|p
  - ubifs: Check @c->dirty_[n|p]n_cnt and @c->nroot state under @c->lp_mutex
  - afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
  - octeontx2-af: avoid off-by-one read from userspace
  - !8723 crypto: hisilicon/qm - change function type to void
  - !8536  livepatch: Fix find wrong ftrace entry
  - !8682  ACPI: bus: Ensure that notify handlers are not running after removal
  - !8688  x86/signal: Fix the value returned by strict_sas_size()
  - !8618  CVE-2024-35896
  - net: hns3: fix kernel crash when devlink reload during initialization
  - !8607  CVE-2024-35895
  - mptcp: ensure snd_nxt is properly initialized on connect
  - !8586  fix CVE-2021-47558
  - !8548  fix CVE-2024-36906
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - ceph: blocklist the kclient when receiving corrupted snap trace
  - ceph: shut down access to inode when async create fails
  - ceph: refactor remove_session_caps_cb
  - ceph: fix auth cap handling logic in remove_session_caps_cb
  - ceph: drop private list from remove_session_caps_cb
  - crypto: hisilicon/qm - change function type to void
  - !7930  bpf: Protect against int overflow for stack access size
  - !8581 22.03-SP4-ACC patch
  - !8396 RDMA/hns: A set of bugfixes for openeuler 22.03 SP4
  - !8613  CVE-2024-35854
  - !8583  mmc: sdhci-msm: pervent access to suspended controller
  - ubifs: Set page uptodate in the correct place
  - !8693 【OLK-5.10】Fix some problems about patch "net: hns3: release PTP resources if pf initialization failed"
  - net: hns3: release PTP resources if pf initialization failed
  - Revert "net: hns3: release PTP resources if pf initialization failed"
  - x86/signal: Fix the value returned by strict_sas_size()
  - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  - tcp: properly terminate timers for kernel sockets
  - ACPI: bus: Ensure that notify handlers are not running after removal
  - crypto: hisilicon/qm - Add the default processing branch
  - crypto: hisilicon/debugfs - Resolve the problem of applying for redundant space in sq dump
  - crypto: hisilicon/sec - Fix memory leak for sec resource release
  - crypto: hisilicon - Adjust debugfs creation and release order
  - crypto: hisilicon/debugfs - Fix the processing logic issue in the debugfs creation
  - crypto: hisilicon/sgl - Delete redundant parameter verification
  - crypto: hisilicon/debugfs - Fix debugfs uninit process issue
  - crypto: hisilicon/sec - Add the condition for configuring the sriov function
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  - crypto: hisilicon/zip - fix the missing CRYPTO_ALG_ASYNC in cra_flags
  - !8646  Fix vf init and common user permissions issue
  - crypto: hisilicon - Fix smp_processor_id() warnings
  - !8534  riscv: process: Fix kernel gp leakage
  - !8542  octeontx2-af: Fix possible null pointer dereference.
  - phonet/pep: fix racy skb_queue_empty() use
  - !8642 v9  Memory access profiler(SPE) driven NUMA balancing
  - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
  - !8483 KVM: arm64: Translate logic cluster id to physical cluster id when updating lsudvmbm
  - net/ethernet/huawei/hiroce3: Fix vf init and common user permissions issue
  - !8461  i2c: smbus: fix NULL function pointer dereference
  - config: Enable memory sampling based pmu for numa balance by default
  - samples/bpf: Add program for memory access by spe
  - tracing, mem-sampling-sample: Adding tracking events to hardware-sampled page access
  - driver/arm/spe: making mem_sampling and perf mutually exclusive with spe driver
  - tracing, numa balance: add trace events for numa data caused by mem_sampling
  - mm/mem_sampling.c: Add controlling interface for mem_sampling on numa balance
  - mm/mem_sampling.c: Drive NUMA balancing via mem_sampling access data
  - sched: Enable per-process mem_sampling from sched switch path
  - mm/mem_sampling.c: Add controlling interface for mem_sampling
  - mm: Add PMU based memory sampling abstract layer
  - drivers/arm/spe: In-kernel SPE driver for page access profiling
  - !8555  rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
  - s390/qeth: Fix kernel panic after setting hsuid
  - ipv6: Fix potential uninit-value access in __ip6_make_skb()
  - batman-adv: Avoid infinite loop trying to resize local TT
  - erspan: make sure erspan_base_hdr is present in skb->head
  - fs/9p: only translate RWX permissions for plain 9P2000
  - netfilter: complete validation of user input
  - netfilter: validate user input for expected length
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
  - Revert "bpf, sockmap: Prevent lock inversion deadlock in map delete elem"
  - bpf: Allow delete from sockmap/sockhash only if update is allowed
  - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
  - netfilter: nf_tables: set dormant flag on hook register failure
  - Bluetooth: hci_core: Fix possible buffer overflow
  - geneve: fix header validation in geneve[6]_xmit_skb
  - net: stmmac: Disable Tx queues when reconfiguring the interface
  - virtio-blk: fix implicit overflow on virtio_max_dma_size
  - mmc: sdhci-msm: pervent access to suspended controller
  - xen-netfront: Add missing skb_mark_for_recycle
  - rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
  - tipc: fix a possible memleak in tipc_buf_append
  - ARM: 9381/1: kasan: clear stale stack poison
  - octeontx2-af: Fix possible null pointer dereference.
  - livepatch: Fix find wrong ftrace entry
  - riscv: process: Fix kernel gp leakage
  - KVM: arm64: Translate logic cluster id to physical cluster id when updating lsudvmbm
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - i2c: smbus: fix NULL function pointer dereference
  - RDMA/hns: Fix missing list_del in hns_roce_hem
  - RDMA/hns: Fix deadlock when using DCA debugfs.
  - RDMA/hns: Set NULL after mtr_node is freed
  - RDMA/hns: Fix missing validation check of DCA mem size
  - RDMA/hns: directly read the scc parameters in the driver instead of the firmware
  - RDMA/hns: Fix missing default values of scc parameters
  - RDMA/hns: Fix fmt output error
  - RDMA/hns: Fix cpu stuck by printings during reset
  - RDMA/hns: Fix CPU stuck due to read polling during reset
  - powerpc: defconfig: Disable CONFIG_DW_EDMA and CONFIG_DW_EDMA_PCIE
  - pipe: wakeup wr_wait after setting max_usage
  - fs/pipe: move check to pipe_has_watch_queue()
  - ACPI: video: check for error while searching for backlight device parent
  - ima: Define new template fields iuid and igid
  - ima: Add ima_show_template_uint() template library function
  - bpf: Protect against int overflow for stack access size
  - netfilter: nft_set_pipapo: do not free live element
  - fs: enable CONFIG_FILE_MITIGATION_FALSE_SHARING by default on arm64
  - fs: mitigatin cacheline false sharing in struct file


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-209.0.0.117
changelog:
  - !9092 v2  ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
  - !9030  bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - !9112  Backport some optimizing patches for kunpeng920
  - !9099  Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - !9166  A Solution to Re-enable hugetlb vmemmap optimize on ARM64
  - !9163  genirq: introduce handle_fasteoi_edge_irq flow handler
  - ARM: 9278/1: kfence: only handle translation faults
  - arm64: mm: HVO: support BBM of vmemmap pgtable safely
  - arm64: mm: kfence: only handle translation faults
  - mm: HVO: introduce helper function to update and flush pgtable
  - genirq: introduce handle_fasteoi_edge_irq for phytium
  - genirq: introduce handle_fasteoi_edge_irq flow handler
  - !8753  memcg: fix input of try_to_free_mem_cgroup_pages
  - !9149 [sync] PR-9054:  soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !9125  arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
  - !9138 v2  CVE-2024-36971
  - !8494  rpmsg: virtio: Free driver_override when rpmsg_remove()
  - !9073 v2  Fix UAF problem of hpool
  - soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !9131  mm: swap: fix race between free_swap_and_cache() and swapoff()
  - !9129  ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
  - !9068  Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - !8700  wifi: cfg80211: check A-MSDU format more carefully
  - net: fix kabi breakage in struct dst_ops
  - net: fix __dst_negative_advice() race
  - mm: swap: fix race between free_swap_and_cache() and swapoff()
  - ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
  - arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
  - !8999  scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - !8938  clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - arm64: syscall: unmask DAIF for tracing status
  - arm64: Snapshot thread flags
  - sched: Snapshot thread flags
  - entry: Snapshot thread flags
  - x86: Snapshot thread flags
  - thread_info: Add helpers to snapshot thread flags
  - irqchip/gic-v3: Use dsb(ishst) to order writes with ICC_SGI1R_EL1 accesses
  - sched/fair: Optimize test_idle_cores() for !SMT
  - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - !8940  firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - !8747  dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
  - !9074 [sync] PR-8963:  Fix CVE-2024-35915
  - !9083  Bluetooth: L2CAP: Fix not validating setsockopt user input
  - !9081 v2  arm64: mm: Replace global variable in pbha with static key
  - !9084 v5  xfs: atomic writes for xfs
  - block: fix kabi in struct queue_limits
  - xfs: make bunmapi observe forcealigin
  - xfs: Only free full extents for forcealign
  - xfs: Update xfs_is_falloc_aligned() mask for forcealign
  - xfs: fix set xflags fail when inode has extent hit
  - xfs: support atomic write ioctl
  - fs: xfs: Support setting FMODE_CAN_ATOMIC_WRITE
  - fs: xfs: Validate atomic writes
  - fs: xfs: Support FS_XFLAG_ATOMICWRITES for forcealign
  - fs: iomap: Atomic write support
  - fs: Add FS_XFLAG_ATOMICWRITES flag
  - fs: xfs: iomap: Sub-extent zeroing
  - fs: iomap: Sub-extent zeroing
  - fs: xfs: Do not free EOF blocks for forcealign
  - fs: xfs: Make file data allocations observe the 'forcealign' flag
  - fs: xfs: Enable file data forcealign feature
  - fs: xfs: Introduce FORCEALIGN inode flag
  - nvme: Atomic write support
  - block: Add core atomic write support
  - fs: Initial atomic write support
  - block: get atomic write max sectors
  - Bluetooth: L2CAP: Fix not validating setsockopt user input
  - arm64: mm: Replace global variable in pbha with static key
  - !9064 drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - !9067  config: enable CONFIG_BLK_CGROUP_IOCOST by default
  - !9063 v3  block: support to dispatch bio asynchronously
  - !9066 change sdma-dae default mode to n
  - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_rx_work
  - nfc: nci: Fix kcov check in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
  - !8827 v2  iomap: fix sub-page not set dirty state
  - mm/dynamic_hugetlb: use rcu lock to protect hpool
  - mm/dynamic_hugetlb: simplify the refcount code
  - drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - !9059 roh/hns3: Add ROH client case in hclgevf_init_client_instance.
  - !9055  CVE-2024-36020
  - !9015  CVE-2024-36953
  - !9014  drm/vc4: don't check if plane->state->fb == state->fb
  - Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - config: enable CONFIG_BLK_CGROUP_IOCOST by default
  - drivers: misc: sdma-dae: not compile sdma-dae by default
  - block: fix kabi broken in struct request_queue about CONFIG_BLK_BIO_DISPATCH_ASYNC
  - block: support to dispatch bio asynchronously
  - !9050  CVE-2024-35796
  - roh/hns3: Add ROH client case in hclgevf_init_client_instance.
  - i40e: fix vf may be used uninitialized in this function warning
  - !9020  wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - net: ll_temac: platform_get_resource replaced by wrong function
  - !7205  mm: memcontrol: do not miss MEMCG_MAX events for enforced allocations
  - !8908  Refactor hbmdev a bit
  - !9001 roh/hns3: Fix IMP reset vlan unusable.
  - !8774  CVE-2024-36914
  - !9027  tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - !8828  drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
  - !8719  CVE-2024-35887
  - !8872  drm/vmwgfx: Fix invalid reads in fence signaled events
  - !8882  scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - !8921  hugetlbfs: fix hugetlbfs_statfs() locking
  - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
  - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
  - drm/vc4: don't check if plane->state->fb == state->fb
  - roh/hns3: Fix IMP reset vlan unusable.
  - !8965  cvm: enhance security for cvm host feature
  - !8982  fix CVE-2024-36905
  - !8996  pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
  - net: relax socket state check at accept time.
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
  - cvm: enhance security for cvm host feature
  - firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - hugetlbfs: fix hugetlbfs_statfs() locking
  - arm64: config: Open the hbmdev related config
  - soc: hisilicon: Don't poweroff if memblocks don't offlined
  - soc: hisilicon: hisi_hbmdev: Notify the device in the ACPI
  - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - drm/vmwgfx: Fix invalid reads in fence signaled events
  - drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
  - iomap: Ensure sub-page dirty state is set during mmap writes
  - Revert "iomap: Don't create iomap_page objects in iomap_page_mkwrite_actor"
  - drm/amd/display: Skip on writeback when it's not applicable
  - memcg: fix input of try_to_free_mem_cgroup_pages
  - dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - ax25: fix use-after-free bugs caused by ax25_ds_del_timer
  - wifi: cfg80211: check A-MSDU format more carefully
  - rpmsg: virtio: Free driver_override when rpmsg_remove()
  - mm: memcontrol: do not miss MEMCG_MAX events for enforced allocations


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-215.0.0.119
changelog:
  - !8098  netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  - !5860  ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
  - !9421 v3  block: fix WARNING in init_blk_queue_async_dispatch
  - block: fix WARNING in init_blk_queue_async_dispatch
  - !9391  fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
  - fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
  - !9327  af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - !9264  ring-buffer: Fix a race between readers and resize checks
  - !9305  CVE-2024-26661 following bugfix
  - !9246  ksmbd: no response from compound read
  - !9350  tracing: Fix permissions for the buffer_percent file
  - tracing: Fix permissions for the buffer_percent file
  - !9347  sched: ARM64 enables SIS_PROP and disables SIS_UTIL"
  - sched: ARM64 enables SIS_PROP and disables SIS_UTIL"
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - !9318  Revert "sched/fair:ARM64 enables SIS_UTIL and disables SIS_PROP"
  - Revert "sched/fair:ARM64 enables SIS_UTIL and disables SIS_PROP"
  - drm/amd/display: Fix && vs || typos
  - drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'
  - Revert "drm/amd/display: Fix && vs || typos"
  - !9268  net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - !9103  ksmbd: no response from compound read
  - !9186  spi: Fix deadlock when adding SPI controllers on SPI buses
  - !9283 hns3 udma: support non share jfr mode in UM
  - !9277 ima: Fix violation digests extending issue in cvm
  - hns3 udma: kernel support non share jfr mode in UM mode
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - ring-buffer: Fix a race between readers and resize checks
  - !9244 urma: cannot uninstall uburma driver
  - !9250  Fix token error issue when concurrent calls
  - !9241 v2  Bugfix backport for rcu
  - urma: cannot uninstall uburma driver
  - Fix token error issue when concurrent calls
  - !9180  wifi: wilc1000: fix RCU usage in connect path
  - !9212  drm/amd/display: Fix division by zero in setup_dsc_config
  - ksmbd: no response from compound read
  - ima: Fix violation digests extending issue in cvm
  - !9239  Fix allmodconfig build frame size error
  - !9207 v2  sched: smart_grid: fix potential NULL pointer dereference
  - srcu: Fix callbacks acceleration mishandling
  - entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up
  - rcu: Defer RCU kthreads wakeup when CPU is dying
  - RDMA/hiroce3: Fix allmodconfig build frame size error
  - !7729  loop: use lo->lo_disk for kobject_uevent
  - !9211  memcg: attach memcg async reclaim worker to curcpu
  - !9168  UBIFS: fixes a series of issues that caused by power cut
  - !9000  media: tc358743: register v4l2 async device only after successful setup
  - !9087  fs/9p: fix uninitialized values during inode evict
  - drm/amd/display: Fix division by zero in setup_dsc_config
  - memcg: attach memcg async reclaim worker to curcpu
  - sched: smart_grid: fix potential NULL pointer dereference
  - spi: fix kabi breakage in struct spi_controller
  - spi: fix use-after-free of the add_lock mutex
  - spi: Fix deadlock when adding SPI controllers on SPI buses
  - wifi: wilc1000: fix RCU usage in connect path
  - ubifs: dbg_orphan_check: Fix missed key type checking
  - ubifs: Fix unattached inode when powercut happens in creating
  - ubifs: Fix space leak when powercut happens in linking tmpfile
  - ubifs: Move ui->data initialization after initializing security
  - ubifs: Fix adding orphan entry twice for the same inode
  - ubifs: Remove insert_dead_orphan from replaying orphan process
  - ubifs: Don't add xattr inode into orphan area
  - ubifs: Fix unattached xattr inode if powercut happens after deleting
  - ubifs: Fix some kernel-doc comments
  - ubifs: Fix spelling mistakes
  - ksmbd: no response from compound read
  - fs/9p: fix uninitialized values during inode evict
  - media: tc358743: register v4l2 async device only after successful setup
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  - loop: use lo->lo_disk for kobject_uevent
  - ksmbd: fix UAF issue in ksmbd_tcp_new_connection()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-217.0.0.120
changelog:
  - !9160  xfs: don't use current->journal_info
  - !9429  usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  - !9644  fix uaf when proc_cpuset_show
  - !9532  CVE-2024-37356
  - !9496  netrom: fix possible dead-lock in nr_rt_ioctl()
  - cgroup: fix uaf when proc_cpuset_show
  - !9514  RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - !9559  CVE-2024-38597
  - !9039 [OLK-5.10] drm/phytium: Replace default efi fb0 with dc fb
  - !9595  drm/arm/malidp: fix a possible null pointer dereference
  - !9593  ARM: 9170/1: fix panic when kasan and kprobe are enabled
  - !9504  um: Add winch to winch_handlers before registering winch IRQ
  - drm/arm/malidp: fix a possible null pointer dereference
  - ARM: 9170/1: fix panic when kasan and kprobe are enabled
  - !9587  s390/ap: Fix crash in AP internal function modify_bitmap()
  - s390/ap: Fix crash in AP internal function modify_bitmap()
  - !9569  net: fec: remove .ndo_poll_controller to avoid deadlocks
  - !9540  net/mlx5e: Avoid field-overflowing memcpy()
  - !9577 v2  btrfs: fix crash on racing fsync and size-extending write into prealloc
  - !9563  fs/ntfs3: Check 'folio' pointer for NULL
  - !9383  serial: max3100: Update uart_driver_registered on driver removal
  - btrfs: fix crash on racing fsync and size-extending write into prealloc
  - !8744  ext4 bugfix from mainline
  - !9499  ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - !9500  netfilter: nf_tables: flush pending destroy work before exit_net release
  - !9453  jffs2: prevent xattr node from overflowing the eraseblock
  - !9202  dyndbg: fix old BUG_ON in >control parser
  - !9193  wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  - !9201  ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  - !9190  clk: Fix clk_core_get NULL dereference
  - !9188  net: phy: fix phy_get_internal_delay accessing an empty array
  - !9462 v2  CVE-2024-27032
  - !9408  drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - !9447  rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - !9425  ASoC: SOF: Fix DSP oops stack dump output contents
  - !9321  drm/amd/display: Fix potential index out of bounds in color transformation function
  - !9297  CVE-2021-47599
  - !9401  Fix CVE-2024-31076
  - !9434  cvm: delete dead code and resolve macro definition holes
  - !9395  CVE-2024-38587
  - !9386  vfio/pci: fix potential memory leak in vfio_intx_enable()
  - !9199  init/main.c: Fix potential static_command_line memory overflow
  - !8683 v4  Fix CVE-2024-35879
  - !9339  serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - !9470  net/mlx5: Add a timeout to acquire the command queue semaphore
  - !9442  net/mlx5: Discard command completions in internal error
  - !9290  net: bridge: xmit: make sure we have at least eth header len bytes
  - !9284  of: module: add buffer overflow check in of_modalias()
  - !9477  watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - !9544  ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - !9483  fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - !9558  CVE-2024-39362
  - !9456  bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - !9527  media: lgdt3306a: Add a check against null-pointer-def
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
  - fs/ntfs3: Check 'folio' pointer for NULL
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
  - i2c: acpi: Unbind mux adapters before delete
  - i2c: add fwnode APIs
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - net/mlx5e: Avoid field-overflowing memcpy()
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
  - params: lift param_set_uint_minmax to common code
  - media: lgdt3306a: Add a check against null-pointer-def
  - !9511  blk-throttle: check for overflow in calculate_bytes_allowed
  - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - blk-throttle: check for overflow in calculate_bytes_allowed
  - blk-throttle: use calculate_io/bytes_allowed() for throtl_trim_slice()
  - blk-throttle: factor out code to calculate ios/bytes_allowed
  - !9507  Enable SIS_UTIL for arm64 and optimize load_balance
  - !9508  Revert "fs: Use CHECK_DATA_CORRUPTION() when
  - Revert "fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected"
  - config: Disable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64
  - sched/numa: Fix numa imbalance in load_balance()
  - Revert "Revert "sched/fair:ARM64 enables SIS_UTIL and disables SIS_PROP""
  - Revert "sched: ARM64 enables SIS_PROP and disables SIS_UTIL""
  - !9333  net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - um: Add winch to winch_handlers before registering winch IRQ
  - netfilter: nf_tables: flush pending destroy work before exit_net release
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - netrom: fix possible dead-lock in nr_rt_ioctl()
  - fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - net/mlx5: Add a timeout to acquire the command queue semaphore
  - f2fs: fix to avoid potential panic during recovery
  - f2fs: fix to check return value of f2fs_reserve_new_block()
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - jffs2: prevent xattr node from overflowing the eraseblock
  - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - net/mlx5: Discard command completions in internal error
  - cvm: delete dead code and resolve macro definition holes
  - usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  - ASoC: SOF: Fix DSP oops stack dump output contents
  - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
  - speakup: Fix sizeof() vs ARRAY_SIZE() bug
  - vfio/pci: fix potential memory leak in vfio_intx_enable()
  - serial: max3100: Update uart_driver_registered on driver removal
  - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - drm/amd/display: Fix potential index out of bounds in color transformation function
  - btrfs: remove stale comment about the btrfs_show_devname
  - btrfs: update latest_dev when we create a sprout device
  - btrfs: use latest_dev in btrfs_show_devname
  - btrfs: convert latest_bdev type to btrfs_device and rename
  - net: bridge: xmit: make sure we have at least eth header len bytes
  - of: module: add buffer overflow check in of_modalias()
  - dyndbg: fix old BUG_ON in >control parser
  - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  - init/main.c: Fix potential static_command_line memory overflow
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  - clk: Fix clk_core_get NULL dereference
  - net: phy: fix phy_get_internal_delay accessing an empty array
  - xfs: don't use current->journal_info
  - drm/phytium: Replace default efi fb0 with dc fb
  - ext4: fix warning in ext4_dio_write_end_io()
  - ext4: properly sync file size update after O_SYNC direct IO
  - iomap: update ki_pos a little later in iomap_dio_complete
  - driver core: Fix kabi broken
  - of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
  - driver core: Introduce device_link_wait_removal()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-218.0.0.121
changelog:
  - !9851  net/sched: act_skbmod: prevent kernel-infoleak
  - !9853  nilfs2: fix use-after-free of timer for log writer thread
  - !9831  mmc: davinci: Don't strip remove function when driver is builtin
  - !8096  Fix CVE-2024-35988
  - nilfs2: fix use-after-free of timer for log writer thread
  - net/sched: act_skbmod: prevent kernel-infoleak
  - mmc: davinci: Don't strip remove function when driver is builtin
  - !9643  f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
  - !9820  kdb: Fix buffer overflow during tab-complete
  - kdb: Fix buffer overflow during tab-complete
  - !9799  null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
  - !9783  CVE-2024-38598
  - !9772  btrfs: fix use-after-free after failure to create a snapshot
  - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
  - !9792 v3  net: fix one NULL pointer dereference bug in net_rship module
  - !9795  drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
  - !9363  fs/ntfs3: Use variable length array instead of fixed size
  - !9712  fix CVE-2024-38540
  - drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
  - net: fix one NULL pointer dereference bug in net_rship module
  - md: fix resync softlockup when bitmap size is less than array size
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
  - Revert "md/raid10: fix slab-out-of-bounds in md_bitmap_get_counter"
  - !9373  ALSA: core: Fix NULL module pointer assignment at card init
  - !9616 v2  wifi: carl9170: add a proper sanity check for endpoints
  - !9538  virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - !9766  f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
  - !9768  iomap: Don't finish dio under irq when there exists pages
  - !9753 v2  arm64: arm_pmuv3: Correctly extract and check the PMUVer
  - !9731 v2  Backport bpf bugfixes
  - btrfs: fix use-after-free after failure to create a snapshot
  - iomap: Don't finish dio under irq when there exists pages
  - !9719  KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
  - !9764  wifi: ar5523: enable proper endpoint verification
  - !9711  fix CVE-2024-38615
  - !9761  CVE-2024-26816
  - !9756  net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
  - wifi: ar5523: enable proper endpoint verification
  - !9716  ax25: Fix reference count leak issues of ax25_dev
  - x86/boot: Ignore relocations in .notes sections in walk_relocs() too
  - x86, relocs: Ignore relocations in .notes section
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - arm64: arm_pmuv3: Correctly extract and check the PMUVer
  - !9672  ax25: Fix reference count leak issue of net_device
  - !9735  net/9p: fix uninit-value in p9_client_rpc()
  - !9572  dma-mapping: benchmark: handle NUMA_NO_NODE correctly
  - !9571  media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
  - net/9p: fix uninit-value in p9_client_rpc()
  - bpf: ensure main program has an extable
  - bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen
  - bpf: Fix __reg_bound_offset 64->32 var_off subreg propagation
  - bpf: Clobber stack slot when writing over spilled PTR_TO_BTF_ID
  - bpf: Fix memory leaks in __check_func_call
  - !9440  fix CVE-2024-38621
  - !9705  net/hinic3: Add pcie device ID adaption for DPU_NIC card
  - KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
  - ax25: Fix reference count leak issues of ax25_dev
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
  - cpufreq: exit() callback is optional
  - cpufreq: Rearrange locking in cpufreq_remove_dev()
  - cpufreq: Split cpufreq_offline()
  - cpufreq: Reorganize checks in cpufreq_offline()
  - !9701  dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - net/hinic3: Add pcie device ID adaption for DPU_NIC card
  - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - !9640  CVE-2024-38582
  - !9662  tls: fix missing memory barrier in tls_init
  - !9657 v2  CVE-2024-38586
  - !9686  greybus: lights: check return of get_channel_from_mode
  - !9675  crypto: bcm - Fix pointer arithmetic
  - greybus: lights: check return of get_channel_from_mode
  - crypto: bcm - Fix pointer arithmetic
  - ax25: Fix reference count leak issue of net_device
  - tls: fix missing memory barrier in tls_init
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets.
  - r8169: remove nr_frags argument from rtl_tx_slots_avail
  - r8169: improve rtl8169_start_xmit
  - r8169: improve rtl_tx
  - r8169: use READ_ONCE in rtl_tx_slots_avail
  - r8169: remove unneeded memory barrier in rtl_tx
  - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
  - nilfs2: fix potential hang in nilfs_detach_log_writer()
  - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
  - wifi: carl9170: add a proper sanity check for endpoints
  - dma-mapping: benchmark: handle NUMA_NO_NODE correctly
  - media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
  - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - media: stk1160: fix bounds checking in stk1160_copy_video()
  - ALSA: core: Fix NULL module pointer assignment at card init
  - fs/ntfs3: Use variable length array instead of fixed size
  - riscv: Fix TASK_SIZE on 64-bit NOMMU
  - riscv: fix VMALLOC_START definition


author: zouzhimin <zouzhimin@kylinos.cn> - 1:2.2.3.1-4
changelog:
  - Type:CVES
  - ID:CVE-2024-26141 CVE-2024-26146 CVE-2024-25126
  - SUG:NA
  - DESC:CVE-2024-26141 CVE-2024-26146 CVE-2024-25126


author: zouzhimin <zouzhimin@kylinos.cn> - 1:2.2.3.1-5
changelog:
  - Type:CVES
  - ID:CVE-2022-44570 CVE-2022-44571 CVE-2022-44572
  - SUG:NA
  - DESC:CVE-2022-44570 CVE-2022-44571 CVE-2022-44572


