# changelog

author: Li Nan <linan122@huawei.com> - 6.6.0-137.0.0.131
changelog:
  - !20552 ub: udma: fix some code issues.
  - !20313 Fix CVE-2025-40220
  - !20321  nvme: fix admin request_queue lifetime
  - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling
  - !20544 Fix CVE-2025-71147
  - !20548 v4  net: LTS-6.6 backport
  - !20503 Fix CVE-2025-39713
  - !20133 Fix CVE-2025-39721
  - !20438 Fix CVE-2025-38659
  - !20264 Fix CVE-2025-40277
  - !20340 Fix CVE-2025-40271
  - !20319 Fix CVE-2025-40237
  - !20392  vfs: Don't leak disconnected dentries on umount
  - !20554  iommu/s390: Implement blocking domain
  - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches
  - !20513 ACPI: PCC: Fix race condition by removing static qualifier
  - !20468  drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
  - !20483  rcu: Protect ->defer_qs_iw_pending from data race
  - !20510 drivers/ub/sentry: fix primary eid index value
  - !20553 ub: cdma: support separated page table feature
  - ub: udma: fix some code issues.
  - !20480 iommu/ummu-core: fix error invalidate tid
  - !20561 iommu/ummu: Add ummu sva independent page table parameter
  - ub: udma: bugfix related to 2m_hugepage.
  - ub: udma: support for separate page tables
  - ub: udma: delete debugfs code.
  - ub: udma: bugfix related to ctrlq function.
  - ub: udma: verify get cqe/ae aux info out addr and len.
  - ub: cdma: support separated page table feature
  - iommu/ummu: Add ummu sva independent page table parameter
  - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant'
  - !20505 Fix CVE-2026-23035
  - iommu/s390: Implement blocking domain
  - drivers/ub/sentry: fix primary eid index value
  - !20535  libceph: make decode_pool() more resilient against corrupted osdmaps
  - !20536  mm/page_alloc: change all pageblocks migrate type on coalescing
  - !20537  mm/secretmem: fix use-after-free race in fault handler
  - !20538  wifi: avoid kernel-infoleak from struct iw_point
  - !20539  net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
  - !20440  PCI/AER: Fix NULL pointer access by aer_info
  - !20262 Fix CVE-2025-68176
  - netfilter: nf_reject: don't leak dst refcount for loopback packets
  - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
  - page_pool: always add GFP_NOWARN for ATOMIC allocations
  - virtio-net: fix received length check in big packets
  - net: bridge: fix use-after-free due to MST port state bypass
  - vsock: Ignore signal/timeout on connect() if already established
  - tls: make sure to abort the stream if headers are bogus
  - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
  - xfrm: Duplicate SPI Handling
  - tls: handle data disappearing from under the TLS ULP
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush()
  - KEYS: trusted: Fix a memory leak in tpm2_load_cmd
  - !20237 Fix CVE-2025-68724
  - !20459 Fix CVE-2025-71131
  - !20525 Fix CVE-2025-68816
  - !20529  CVE-2025-68172
  - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
  - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback""
  - wifi: avoid kernel-infoleak from struct iw_point
  - mm/secretmem: fix use-after-free race in fault handler
  - mm/page_alloc: change all pageblocks migrate type on coalescing
  - libceph: make decode_pool() more resilient against corrupted osdmaps
  - pps: Fix kabi breakage of struct pps_device for last_fetched_ev
  - sched: Fix kabi breakage of struct task_struct for saved_state
  - crypto: aspeed - fix double free caused by devm
  - !20515  Bluetooth: bcsp: receive data only if registered
  - !20507 Fix CVE-2025-40358
  - !20450 ub: ubase&unic: Fix some bug in concurrent process
  - !20452 iommu/ummu: Fix some bugs and optimize the code implementation
  - !20451 iommu/ummu: Add the function of creating devices with SVA-separated
  - !20500 mm: fix the inaccurate memory statistics issue for users
  - net/mlx5: fw_tracer, Validate format string parameters
  - Bluetooth: bcsp: receive data only if registered
  - ACPI: PCC: Fix race condition by removing static qualifier
  - ACPI: CPPC: Fix missing PCC check for guaranteed_perf
  - iommu/ummu: Add the function of creating devices with SVA-separated
  - iommu/ummu-core: fix error invalidate tid
  - riscv: stacktrace: Disable KASAN checks for non-current tasks
  - !20497  arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
  - !20496  drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
  - !20495  iommu/amd: Avoid stack buffer overflow from kernel cmdline
  - !20494  HID: core: Harden s32ton() against conversion to 0 bits
  - !20493  iommu: Fix two issues in iommu_copy_struct_from_user()
  - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
  - PM / devfreq: hisi: Fix potential UAF in OPP handling
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
  - !20487  interference: Fix uninitialized ifs_clock compiling issue
  - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
  - MIPS: mm: Prevent a TLB shutdown on initial uniquification
  - mm: fix the inaccurate memory statistics issue for users
  - mm: add config option for atomic mode in mm counter
  - Revert "mm: fix the inaccurate memory statistics issue for users"
  - !20444  net/mlx5e: Fix crash on profile change rollback failure
  - !20442  net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
  - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
  - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
  - iommu/amd: Avoid stack buffer overflow from kernel cmdline
  - HID: core: Harden s32ton() against conversion to 0 bits
  - iommu: Fix two issues in iommu_copy_struct_from_user()
  - SUNRPC: call xs_sock_process_cmsg for all cmsg
  - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
  - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO.
  - !20227  Rename leapioraid to leapraid and release v2.0
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init
  - x86/fpu: Delay instruction pointer fixup until after warning
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
  - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
  - x86/sev: Evict cache lines during SNP memory validation
  - net: usbnet: Fix the wrong netif_carrier_on() call
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
  - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
  - sched,freezer: Remove unnecessary warning in __thaw_task
  - freezer,sched: Clean saved_state when restoring it during thaw
  - freezer,sched: Do not restore saved_state of a thawed task
  - freezer,sched: Use saved_state to reduce some spurious wakeups
  - sched/core: Remove ifdeffery for saved_state
  - i2c: stm32f7: unmap DMA mapped buffer
  - i2c: stm32f7: simplify status messages in case of errors
  - i2c: stm32f7: perform most of irq job in threaded handler
  - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq
  - i2c: stm32f7: Use devm_clk_get_enabled()
  - USB: serial: option: add Foxconn T99W709
  - smb: server: Fix extension string in ksmbd_extract_shortname()
  - ksmbd: fix corrupted mtime and ctime in smb2_open
  - ksmbd: fix Preauh_HashValue race condition
  - ksmbd: fix null pointer dereference error in generate_encryptionkey
  - vsock: Do not allow binding to VMADDR_PORT_ANY
  - selftests/perf_events: Add a mmap() correctness test
  - smb: client: return an error if rdma_connect does not return within 5 seconds
  - smb: client: let recv_done() cleanup before notifying the callers.
  - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
  - smb: client: make use of common smbdirect_socket
  - smb: smbdirect: add smbdirect_socket.h
  - smb: client: Correct typos in multiple comments across various files
  - smb: client: Use min() macro
  - smb: server: let recv_done() avoid touching data_transfer after cleanup/move
  - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
  - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
  - irqchip: Build IMX_MU_MSI only on ARM
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
  - sunrpc: fix client side handling of tls alerts
  - net/sched: taprio: enforce minimum value for picos_per_byte
  - net: drop UFO packets in udp_rcv_segment()
  - ipv6: reject malicious packets in ipv6_gso_segment()
  - net/mlx5: Correctly set gso_segs when LRO is used
  - netlink: specs: ethtool: fix module EEPROM input/output arguments
  - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
  - phy: mscc: Fix parsing of unicast frames
  - netpoll: prevent hanging NAPI when netcons gets enabled
  - md/md-cluster: handle REMOVE message earlier
  - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
  - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
  - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up()
  - pNFS/flexfiles: don't attempt pnfs on fatal DS errors
  - PCI: pnv_php: Fix surprise plug detection and recovery
  - powerpc/eeh: Export eeh_unfreeze_pe()
  - PCI: pnv_php: Work around switches with broken presence detection
  - kconfig: qconf: fix ConfigList::updateListAllforAll()
  - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
  - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume
  - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
  - scsi: mpt3sas: Fix a fw_event memory leak
  - vfio/pci: Separate SR-IOV VF dev_set
  - vfio/pds: Fix missing detach_ioas op
  - vfio: Prevent open_count decrement to negative
  - vfio: Fix unbalanced vfio_df_close call in no-iommu mode
  - f2fs: fix to calculate dirty data during has_not_enough_free_secs()
  - f2fs: fix to update upper_p in __get_secs_required() correctly
  - f2fs: vm_unmap_ram() may be called from an invalid context
  - f2fs: fix to avoid out-of-boundary access in devs.path
  - f2fs: doc: fix wrong quota mount option description
  - f2fs: fix KMSAN uninit-value in extent_info usage
  - rtc: rv3028: fix incorrect maximum clock rate handling
  - rtc: pcf8563: fix incorrect maximum clock rate handling
  - rtc: pcf85063: fix incorrect maximum clock rate handling
  - rtc: nct3018y: fix incorrect maximum clock rate handling
  - rtc: hym8563: fix incorrect maximum clock rate handling
  - rtc: ds1307: fix incorrect maximum clock rate handling
  - ucount: fix atomic_long_inc_below() argument type
  - module: Restore the moduleparam prefix length check
  - apparmor: fix loop detection used in conflicting attachment resolution
  - apparmor: ensure WB_HISTORY_SIZE value is a power of 2
  - bpf: Check netfilter ctx accesses are aligned
  - bpf: Check flow_dissector ctx accesses are aligned
  - vhost-scsi: Fix log flooding with target does not exist errors
  - mtd: rawnand: atmel: set pmecc data setup time
  - mtd: rawnand: rockchip: Add missing check after DMA map
  - mtd: rawnand: atmel: Fix dma_mapping_error() address
  - jfs: fix metapage reference count leak in dbAllocCtl
  - crypto: qat - fix seq_file position update in adf_ring_next()
  - crypto: qat - fix DMA direction for compression on GEN2 devices
  - perf tools: Remove libtraceevent in .gitignore
  - sh: Do not use hyphen in exported variable name
  - ASoC: fsl_xcvr: get channel status data when PHY is not exists
  - dmaengine: nbpfaxi: Add missing check after DMA map
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
  - fs/orangefs: Allow 2 more characters in do_c_string()
  - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
  - soundwire: stream: restore params when prepare ports fail
  - crypto: img-hash - Fix dma_unmap_sg() nents value
  - crypto: keembay - Fix dma_unmap_sg() nents value
  - hwrng: mtk - handle devm_pm_runtime_enable errors
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
  - scsi: isci: Fix dma_unmap_sg() nents value
  - scsi: mvsas: Fix dma_unmap_sg() nents value
  - scsi: elx: efct: Fix dma_unmap_sg() nents value
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
  - clk: sunxi-ng: v3s: Fix de clock definition
  - perf tests bp_account: Fix leaked file descriptor
  - kernel: trace: preemptirq_delay_test: use offstack cpu mask
  - crypto: inside-secure - Fix `dma_unmap_sg()` nents value
  - perf sched: Fix memory leaks in 'perf sched latency'
  - perf sched: Fix memory leaks for evsel->priv in timehist
  - perf sched: Free thread->priv using priv_destructor
  - perf dso: Add missed dso__put to dso__load_kcore
  - perf tools: Fix use-after-free in help_unknown_cmd()
  - Fix dma_unmap_sg() nents value
  - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
  - fanotify: sanitize handle_type values when reporting fid
  - pinctrl: sunxi: Fix memory leak on krealloc failure
  - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails
  - crypto: arm/aes-neonbs - work around gcc-15 warning
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
  - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
  - clk: xilinx: vcu: unregister pll_post only if registered correctly
  - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
  - mtd: fix possible integer overflow in erase_xfer()
  - crypto: marvell/cesa - Fix engine load inaccuracy
  - crypto: qat - use unmanaged allocation for dc_data
  - crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
  - PCI: rockchip-host: Fix "Unexpected Completion" log message
  - bpf/preload: Don't select USERMODE_DRIVER
  - ipv6: annotate data-races around rt->fib6_nsiblings
  - ipv6: fix possible infinite loop in fib6_info_uses_dev()
  - vrf: Drop existing dst reference in vrf_ip6_input_dst
  - selftests: rtnetlink.sh: remove esp4_offload after test
  - net/mlx5e: Clear Read-Only port buffer size in PBMC before update
  - netfilter: xt_nfacct: don't assume acct name is null-terminated
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index
  - can: kvaser_pciefd: Store device channel index
  - can: peak_usb: fix USB FD devices potential malfunction
  - tools/rv: Do not skip idle in trace
  - Bluetooth: hci_event: Mask data status from LE ext adv reports
  - kcsan: test: Initialize dummy variable
  - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
  - wifi: ath12k: fix endianness handling while accessing wmi service bit
  - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key()
  - wifi: mac80211: Don't call fq_flow_idx() for management frames
  - wifi: mac80211: Do not schedule stopped TXQs
  - wifi: plfxlc: Fix error handling in usb driver probe
  - wifi: mac80211: reject TDLS operations when station is not associated
  - iommu/amd: Fix geometry.aperture_end for V2 tables
  - mwl8k: Add missing check after DMA map
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
  - tcp: call tcp_measure_rcv_mss() for ooo packets
  - xen/gntdev: remove struct gntdev_copy_batch from stack
  - net_sched: act_ctinfo: use atomic64_t for three counters
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree
  - um: rtc: Avoid shadowing err in uml_rtc_start()
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
  - netfilter: nf_tables: adjust lockdep assertions handling
  - netfilter: nf_tables: Drop dead code from fill_*_info routines
  - fbcon: Fix outdated registered_fb reference in comment
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
  - m68k: Don't unregister boot console needlessly
  - drm/msm/dpu: Fill in min_prefill_lines for SC8180X
  - kselftest/arm64: Fix check for setting new VLs in sve-ptrace
  - net: dst: annotate data-races around dst->input
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
  - wifi: ath11k: clear initialized flag for deinit-ed srng lists
  - iwlwifi: Add missing check for alloc_ordered_workqueue
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
  - wifi: rtl818x: Kill URBs before clearing tx status queue
  - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band
  - caif: reduce stack size, again
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
  - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
  - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
  - selftests/bpf: fix signedness bug in redir_partial()
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
  - bpf, sockmap: Fix psock incorrectly pointing to sk
  - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
  - staging: nvec: Fix incorrect null termination of battery manufacturer
  - interconnect: qcom: sc8180x: specify num_nodes
  - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
  - soc: qcom: pmic_glink: fix OF node leak
  - samples: mei: Fix building on musl libc
  - cpufreq: Initialize cpufreq-based frequency-invariance later
  - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
  - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
  - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
  - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
  - arm: dts: ti: omap: Fixup pinheader typo
  - usb: early: xhci-dbc: Fix early_ioremap leak
  - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
  - pps: fix poll support
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
  - spi: stm32: Check for cfg availability in stm32_spi_probe
  - usb: misc: apple-mfi-fastcharge: Make power supply names unique
  - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe()
  - ARM: dts: vfxxx: Correctly use two tuples for timer address
  - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
  - arm64: dts: qcom: sc7180: Expand IMEM region
  - arm64: dts: qcom: sdm845: Expand IMEM region
  - soc: qcom: QMI encoding/decoding for big endian
  - selftests: Fix errno checking in syscall_user_dispatch test
  - ASoC: mediatek: use reserved memory or enable buffer pre-allocation
  - gfs2: No more self recovery
  - Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
  - hfs: make splice write available again
  - hfsplus: make splice write available again
  - ublk: use vmalloc for ublk_device's __queues
  - fs_context: fix parameter name in infofc() macro
  - audit,module: restore audit logging in load failure case
  - ASoC: amd: yc: add DMI quirk for ASUS M6501RM
  - ASoC: Intel: fix SND_SOC_SOF dependencies
  - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
  - ethernet: intel: fix building with large NR_CPUS
  - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
  - interference: Fix uninitialized ifs_clock compiling issue
  - iommu/ummu: optimize log printing
  - !20455 Fix compilation failure caused by PR#20174
  - !20302  CVE-2026-22980
  - !20142  CVE-2025-68803
  - !20261  ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
  - !20435  fix CVE-2026-22998
  - !20433  scsi: target: Reset t_task_cdb pointer in error case
  - !20432  scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
  - !20431  block: Use RCU in blk_mq_[un
  - !20307  tpm: Cap the number of PCR banks
  - !20062  xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read
  - !20157 v2  md: backport from mainline
  - rcu: Protect ->defer_qs_iw_pending from data race
  - platform/x86/intel/pmt: fix compilation failure caused by PR#20174
  - iommu/ummu: optimize kv cache memory management
  - iommu/ummu: optimize permission table management
  - iommu/ummu: remove check for eid_type while del eid
  - iommu/ummu: optimize the code implementation
  - drivers/perf: fix ummu-pmu data reading exception
  - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct
  - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
  - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
  - net: unic: Notify mami of the bond ip change.
  - ub: ubase: Support for UE link by ctrlq message
  - ub: ubase: send a deactivate req in removing
  - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode.
  - ub: ubase: Use an independent thread for the ctrlq workqueue.
  - !20368 ubcore: fix logging and permission for route query.
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
  - !20344  ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
  - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios
  - ub: ubase: Add KABI compatibility
  - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration
  - ub: ubase: add PMU IDEV interrupt supported abilities.
  - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context
  - ub: ubase: Set the completion event interrupt to auto
  - net: unic: fix poll tx read old skb cause a UAF bug
  - !20249 Fix CVE-2025-38489
  - !20250 Fix CVE-2025-38480
  - !20378 Fix CVE-2025-39838
  - !20430  Fix CVE-2025-39942
  - !20351 Fix CVE-2025-71149
  - !20375 Fix CVE-2025-71150
  - !20323 Fix CVE-2025-38730
  - !20320 Fix CVE-2025-68814
  - !20314 Fix CVE-2025-71072
  - !20315 Fix CVE-2025-68794
  - !20403  bpf: Check skb->transport_header is set in bpf_skb_check_mtu
  - !20402  bpf: Do not let BPF test infra emit invalid GSO types to stack
  - !20401  tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
  - !20400  netfilter: nft_ct: add seqadj extension for natted connections
  - !20399  net: xfrm: Fix CVE-2025-40215
  - !20398  net/sched: sch_qfq: Fix null-deref in agg_dequeue
  - !20397  bpf: Reject narrower access to pointer ctx fields
  - !20396  Bluetooth: eir: Fix possible crashes on eir_create_adv_data
  - !20394  IB/mlx5: Fix potential deadlock in MR deregistration
  - !20367 ub: cdma: cdma uaf bugfix
  - net/mlx5e: Fix crash on profile change rollback failure
  - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
  - PCI/AER: Fix NULL pointer access by aer_info
  - gfs2: No more self recovery
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
  - crypto: qat - flush misc workqueue during device shutdown
  - !20174 Backport PMT spec 3.0 support
  - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts
  - !19814 [OLK-6.6] Batch flushing user memory encrytion status change
  - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
  - nvmet-tcp: remove boilerplate code
  - scsi: target: Reset t_task_cdb pointer in error case
  - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
  - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock
  - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
  - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
  - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection
  - smb: server: remove separate empty_recvmsg_queue
  - !20384 ub:ubus: Fix ubus link message and pool device error
  - !20389  gfs2: Prevent recursive memory reclaim
  - !20388  *** fix CVE-2025-38062 ***
  - !20387  KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
  - !20386  pinctrl: check the return value of pinmux_ops::get_function_name()
  - !20385  iommu/amd/pgtbl: Fix possible race while increase page table level
  - ub:ubus: Not cfg access during surprise down
  - ub:hisi-ubus: Delete validate_pa err print
  - PCI: cadence: Check for the existence of cdns_pcie::ops before using it
  - can: netlink: can_changelink(): allow disabling of automatic restart
  - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test"
  - drm/sched: Remove optimization that causes hang when killing dependent jobs
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
  - bpf: Check skb->transport_header is set in bpf_skb_check_mtu
  - bpf: Do not let BPF test infra emit invalid GSO types to stack
  - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
  - netfilter: nft_ct: add seqadj extension for natted connections
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
  - xfrm: delete x->tunnel as we delete x
  - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation.
  - net/sched: sch_qfq: Fix null-deref in agg_dequeue
  - bpf: Reject narrower access to pointer ctx fields
  - Bluetooth: eir: Fix possible crashes on eir_create_adv_data
  - IB/mlx5: Fix potential deadlock in MR deregistration
  - ub:ubus: Fix ubus link message and pool device error
  - ub:hisi-ubus: cq poller maximum handle 64 cqe per time
  - ub:hisi-ubus:Fix vdm message print error
  - ub:ubus:Fix ubus interrupt release issue
  - wifi: mt76: mt7921: prevent decap offload config before STA initialization
  - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec()
  - iio: hid-sensor-prox: Restore lost scale assignments
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation
  - crypto: powerpc/poly1305 - add depends on BROKEN for now
  - erofs: address D-cache aliasing
  - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
  - ALSA: hda: Add missing NVIDIA HDA codec IDs
  - ALSA: hda/tegra: Add Tegra264 support
  - comedi: comedi_test: Fix possible deletion of uninitialized timers
  - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach
  - usb: typec: tcpm: allow switching to mode accessory to mux properly
  - usb: typec: tcpm: allow to use sink in accessory mode
  - drm/amdkfd: Don't call mmput from MMU notifier callback
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
  - selftests: mptcp: connect: also cover checksum
  - selftests: mptcp: connect: also cover alt modes
  - resource: fix false warning in __request_region()
  - gve: Fix stuck TX queue for DQ queue format
  - e1000e: ignore uninitialized checksum word on tgp
  - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
  - dpaa2-switch: Fix device reference count leak in MAC endpoint handling
  - dpaa2-eth: Fix device reference count leak in MAC endpoint handling
  - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
  - sprintf.h requires stdarg.h
  - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint()
  - i2c: virtio: Avoid hang by using interruptible completion wait
  - i2c: tegra: Fix reset error handling with ACPI
  - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots
  - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
  - can: dev: can_restart(): move debug message and stats after successful restart
  - can: dev: can_restart(): reverse logic to remove need for goto
  - i40e: When removing VF MAC filters, only check PF-set MAC
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards
  - i40e: Add rx_missed_errors for buffer exhaustion
  - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
  - net/mlx5: Fix memory leak in cmd_exec()
  - staging: vchiq_arm: Make vchiq_shutdown never fail
  - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
  - regmap: fix potential memory leak of regmap_bus
  - iio: adc: ad7949: use spi_is_bpw_supported()
  - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node
  - RDMA/core: Rate limit GID cache warning messages
  - virtio_ring: Fix error reporting in virtqueue_resize
  - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches
  - !20346  tracing: Fix crash on synthetic stacktrace field usage
  - vfs: Don't leak disconnected dentries on umount
  - !20334 Fix CVE-2025-68780
  - gfs2: Prevent recursive memory reclaim
  - amd/amdkfd: enhance kfd process check in switch partition
  - drm/amdkfd: allow compute partition mode switch with cgroup exclusions
  - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
  - pinctrl: check the return value of pinmux_ops::get_function_name()
  - iommu/amd/pgtbl: Fix possible race while increase page table level
  - !19966  nvme-fc: use lock accessing port_state and rport state
  - ASoC: fsl_sai: replace regmap_write with regmap_update_bits
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  - cifs: prevent NULL pointer dereference in UTF16 conversion
  - ksmbd: Fix refcount leak when invalid session is found on session lookup
  - ubcore: fix logging and permission for route query.
  - !20232 driver/coda: VirtCCA supports MSI device DA
  - Revert "Revert "RDMA/hns: Fix mismatch exception rollback""
  - !20197 ub: udma&ubase: fix a bug that caused long reboot time
  - x86: Resolve FPU state corruption between atomic and non-atomic contexts
  - ub: cdma: cdma uaf bugfix
  - ub: cdma: jfs call trace bugfix
  - !20353  x86/fpu: Clear XSTATE_BV[i
  - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
  - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls
  - nvmem: layouts: u-boot-env: remove crc32 endianness conversion
  - i2c: omap: fix deprecated of_property_read_bool() use
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode
  - regulator: pwm-regulator: Manage boot-on with disabled PWM channels
  - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs
  - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
  - i2c: omap: Fix an error handling path in omap_i2c_probe()
  - i2c: omap: Add support for setting mux
  - usb: dwc3: qcom: Don't leave BCR asserted
  - usb: hub: Don't try to recover devices lost during warm reset.
  - usb: hub: Fix flushing of delayed work used for post resume purposes
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs
  - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented
  - ipv6: make addrconf_wq single threaded
  - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling
  - sched/deadline: only set free_cpus for online runqueues
  - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling
  - io_uring/poll: correctly handle io_poll_add() return value on update
  - shmem: fix recovery on rename failures
  - io_uring: fix filename leak in __io_openat_prep()
  - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
  - rxrpc: Fix transmission of an abort in response to an abort
  - rxrpc: Fix recv-recv race of completed call
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
  - net: bridge: Do not offload IGMP/MLD messages
  - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
  - net/mlx5: Correctly set gso_size when LRO is used
  - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
  - Bluetooth: SMP: If an unallowed command is received consider it a failure
  - Bluetooth: hci_sync: fix connectable extended advertising when using static random address
  - hwmon: (corsair-cpro) Validate the size of the received input buffer
  - selftests: net: increase inter-packet timeout in udpgro.sh
  - wifi: cfg80211: remove scan request n_channels counted_by
  - nvme: fix misaccounting of nvme-mpath inflight I/O
  - net: phy: Don't register LEDs for genphy
  - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
  - rpl: Fix use-after-free in rpl_do_srh_inline().
  - block: fix kobject leak in blk_unregister_queue
  - net: emaclite: Fix missing pointer increment in aligned_read()
  - soundwire: amd: fix for clearing command status register
  - soundwire: amd: fix for handling slave alerts after link is down
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  - comedi: Fix some signed shift left operations
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
  - comedi: das6402: Fix bit shift out of bounds
  - comedi: das16m1: Fix bit shift out of bounds
  - comedi: aio_iiro_16: Fix bit shift out of bounds
  - comedi: pcl812: Fix bit shift out of bounds
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler
  - iio: adc: max1363: Reorder mode_list[] entries
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
  - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order
  - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
  - net: libwx: properly reset Rx ring descriptor
  - net: libwx: remove duplicate page_pool_put_full_page()
  - mmc: sdhci_am654: Workaround for Errata i2312
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
  - mmc: bcm2835: Fix dma_unmap_sg() nents value
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
  - isofs: Verify inode mode when loading from disk
  - dmaengine: nbpfaxi: Fix memory corruption in probe()
  - af_packet: fix soft lockup issue caused by tpacket_snd()
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
  - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck
  - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
  - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
  - net/mlx5: Update the list of the PCI supported devices
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
  - io_uring/poll: fix POLLERR handling
  - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
  - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
  - tracing/osnoise: Fix crash in timerlat_dump_stack()
  - spi: Add check for 8-bit transfer with 8 IO mode support
  - pch_uart: Fix dma_sync_sg_for_device() nents value
  - thunderbolt: Fix bit masking in tb_dp_port_set_hops()
  - i2c: stm32: fix the device used for the DMA map
  - tracing: Fix crash on synthetic stacktrace field usage
  - usb: musb: fix gadget state on disconnect
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
  - USB: serial: option: add Foxconn T99W640
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
  - phy: tegra: xusb: Disable periodic tracking on Tegra234
  - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode
  - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
  - fs/proc: fix uaf in proc_readdir_de()
  - io_uring/net: commit partial buffers on retry
  - nvme: fix admin request_queue lifetime
  - fs/notify: call exportfs_encode_fid with s_umount
  - iomap: adjust read range correctly for non-block-aligned positions
  - fuse: fix livelock in synchronous file put from fuseblk workers
  - tpm: Cap the number of PCR banks
  - nfsd: provide locking for v4_end_grace
  - Revert "nfsd: provide locking for v4_end_grace"
  - config: enable config for PMT discovery driver
  - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe
  - platform/x86/intel/pmt: Fix kobject memory leak on init failure
  - platform/x86/intel/pmt: fix a crashlog NULL pointer access
  - platform/x86/intel/pmt: fix build dependency for kunit test
  - platform/x86/intel/pmt/discovery: fix format string warning
  - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit
  - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API
  - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature
  - platform/x86/intel/pmt/discovery: Get telemetry attributes
  - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI
  - platform/x86/intel/vsec: Set OOBMSM to CPU mapping
  - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h
  - docs: Add ABI documentation for intel_pmt feature directories
  - platform/x86/intel/pmt: Add PMT Discovery driver
  - sysfs: Fix crash on empty group attributes array
  - sysfs: Introduce a mechanism to hide static attribute_groups
  - platform/x86/intel/vsec: Add new Discovery feature
  - platform/x86/intel/vsec: Skip driverless features
  - platform/x86/intel/vsec: Skip absent features during initialization
  - platform/x86/intel/vsec: Add device links to enforce dependencies
  - platform/x86/intel/vsec: Create wrapper to walk PCI config space
  - platform/x86/intel/vsec: Add private data for per-device data
  - MAINTAINERS: Add link to documentation of Intel PMT ABI
  - platform/x86/intel/pmt: allow user offset for PMT callbacks
  - driver/coda: VirtCCA supports MSI device DA
  - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
  - Rename leapioraid to leapraid and release v2.0
  - ub: udma: fix a bug that caused long reboot time.
  - ub: ubase: Accelerate when ctrl node is shutting down
  - platform/x86/intel/pmt: Use PMT callbacks
  - platform/x86/intel/vsec: Add PMT read callbacks
  - platform/x86/intel/vsec.h: Move to include/linux
  - md: prevent incorrect update of resync/recovery offset
  - md/raid1: Fix data corruption for degraded array with slow disk
  - md/raid1: set max_sectors during early return from choose_slow_rdev()
  - md-cluster: fix no recovery job when adding/re-adding a disk
  - md-cluster: fix hanging issue while a new disk adding
  - md/raid5: recheck if reshape has finished with device_lock held
  - md-cluster: Constify struct md_cluster_operations
  - md: Remove unneeded semicolon
  - md/raid5: fix spares errors about rcu usage
  - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume
  - md: pass in max_sectors for pers->sync_request()
  - md: factor out helpers for different sync_action in md_do_sync()
  - md: replace last_sync_action with new enum type
  - md: use new helpers in md_do_sync()
  - md: don't fail action_store() if sync_thread is not registered
  - md: remove parameter check_seq for stop_sync_thread()
  - md: replace sysfs api sync_action with new helpers
  - md: factor out helper to start reshape from action_store()
  - md: add new helpers for sync_action
  - md: add a new enum type sync_action
  - md: rearrange recovery_flags
  - md/raid0: don't free conf on raid0_run failure
  - md: make md_flush_request() more readable
  - md: change the return value type of md_write_start to void
  - md: Revert "md: Fix overflow in is_mddev_idle"
  - md: don't account sync_io if iostats of the disk is disabled
  - md: Fix overflow in is_mddev_idle
  - md: add check for sleepers in md_wakeup_thread()
  - md: add a mddev_is_dm helper
  - md: add a mddev_add_trace_msg helper
  - md: add a mddev_trace_remap helper
  - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape
  - dm-raid: add a new helper prepare_suspend() in md_personality
  - dm-raid: really frozen sync_thread during suspend
  - md: add a new helper reshape_interrupted()
  - md: export helper md_is_rdwr()
  - md: export helpers to stop sync_thread
  - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume
  - md/raid1: factor out helpers to choose the best rdev from read_balance()
  - md/raid1: factor out the code to manage sequential IO
  - md/raid1: factor out choose_bb_rdev() from read_balance()
  - md/raid1: factor out choose_slow_rdev() from read_balance()
  - md/raid1: factor out read_first_rdev() from read_balance()
  - md/raid1-10: factor out a new helper raid1_should_read_first()
  - md/raid1-10: add a helper raid1_check_read_range()
  - md/raid1: fix choose next idle in read_balance()
  - md/raid1: record nonrot rdevs while adding/removing rdevs to conf
  - md/raid1: factor out helpers to add rdev to conf
  - md: add a new helper rdev_has_badblock()
  - md: check mddev->pers before calling md_set_readonly()
  - md: clean up openers check in do_md_stop() and md_set_readonly()
  - md: sync blockdev before stopping raid or setting readonly
  - md: factor out a helper to sync mddev
  - md: return directly before setting did_set_md_closing
  - md: changed the switch of RAID_VERSION to if
  - md: merge the check of capabilities into md_ioctl_valid()
  - md: Don't suspend the array for interrupted reshape
  - md: Don't register sync_thread for reshape directly
  - md: Make sure md_do_sync() will set MD_RECOVERY_DONE
  - md: Don't ignore read-only array in md_check_recovery()
  - md: Don't ignore suspended array in md_check_recovery()
  - md: get rdev->mddev with READ_ONCE()
  - md: remove redundant md_wakeup_thread()
  - md: remove redundant check of 'mddev->sync_thread'
  - md: fix a suspicious RCU usage warning
  - raid: Remove now superfluous sentinel element from ctl_table array
  - NFSD: NFSv4 file creation neglects setting ACL
  - nfsd: set security label during create operations
  - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read
  - nvme-fc: use lock accessing port_state and rport state
  - x86/mm: Batch flushing user memory encrytion status change


author: Li Nan <linan122@huawei.com> - 6.6.0-138.0.0.132
changelog:
  - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3"
  - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3"
  - !20576  media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
  - !20575  RDMA/cm: Fix leaking the multicast GID table reference
  - !20580  RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
  - !20551  Fix CVE-2025-68785
  - !20478  f2fs: fix to avoid potential deadlock
  - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y
  - !20520 Fix CVE-2026-23038
  - !20424  net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
  - !20425  mlx5: Fix default values in create CQ
  - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
  - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
  - RDMA/cm: Fix leaking the multicast GID table reference
  - net: openvswitch: fix middle attribute validation in push_nsh() action
  - net: openvswitch: remove never-working support for setting nsh fields
  - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
  - bnxt_en: Fix potential data corruption with HW GRO/LRO
  - f2fs: fix to avoid potential deadlock
  - mlx5: Fix default values in create CQ
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup


author: Li Nan <linan122@huawei.com> - 6.6.0-139.0.0.133
changelog:
  - !20727 v2  bpf: sockmap fixes
  - !20741  scsi: qla2xxx: Sanitize payload size to prevent member overflow
  - !20744  fix CVE-2025-38449
  - !20763  net: usb: asix: validate PHY address before use
  - !20762  smc91x: fix broken irq-context in PREEMPT_RT
  - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors
  - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h
  - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h
  - !20245 KVM: arm64: Refactor exit handlers
  - !20246 KVM: arm64: Mark some header functions as inline
  - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS
  - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch
  - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors
  - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches
  - !20667  fix CVE-2024-50102
  - !20736  netfilter: nf_tables: remove redundant chain validation on register store
  - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition.
  - !20721 obmm: reduce log noise for successful export/import/preimport
  - net: usb: asix: validate PHY address before use
  - smc91x: fix broken irq-context in PREEMPT_RT
  - !20731  devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
  - !20732  libceph: return the handler error from mon_handle_auth_done()
  - !20743  mm: slub: avoid wake up kswapd in set_track_prepare
  - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition.
  - !20750 ub: cdma: adapted to UMMU interface changes
  - !20713 urma: DFX of log in kernel
  - urma: optimize log levels for kernel space
  - ub: cdma: adapted to UMMU interface changes
  - wifi: ath11k: avoid bit operation on key flags
  - drm/mediatek: fix potential OF node use-after-free
  - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes
  - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
  - !20708 ub:hisi-ubus: Add create bus instance ummu bypass
  - drm: fix kabi for struct drm_framebuffer
  - drm/framebuffer: Acquire internal references on GEM handles
  - drm/gem: Acquire references on GEM handles for framebuffers
  - mm: slub: avoid wake up kswapd in set_track_prepare
  - scsi: qla2xxx: Sanitize payload size to prevent member overflow
  - netfilter: nf_tables: remove redundant chain validation on register store
  - libceph: return the handler error from mon_handle_auth_done()
  - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
  - Documentation/hw-vuln: Add VMSCAPE documentation
  - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
  - riscv: use lw when reading int cpu in asm_per_cpu
  - mm: slub: avoid wake up kswapd in set_track_prepare
  - tools: gpio: remove the include directory on make clean
  - tools: gpio: rm .*.cmd on make clean
  - drm/amd/amdgpu: Fix missing error return on kzalloc failure
  - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c
  - perf bpf-event: Fix use-after-free in synthesis
  - drm/bridge: ti-sn65dsi86: fix REFCLK setting
  - spi: spi-fsl-lpspi: Clear status register after disabling the module
  - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
  - spi: spi-fsl-lpspi: Set correct chip-select polarity bit
  - spi: spi-fsl-lpspi: Fix transmissions when using CONT
  - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
  - pcmcia: omap: Add missing check for platform_get_resource
  - Revert "drm/amdgpu: Avoid extra evict-restore process."
  - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
  - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
  - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv
  - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm
  - drm/mediatek: Add crtc path enum for all_drm_priv array
  - vmxnet3: update MTU after device quiesce
  - net: dsa: microchip: linearize skb for tail-tagging switches
  - net: dsa: microchip: update tag_ksz masks for KSZ9477 family
  - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
  - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
  - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA
  - iio: pressure: mprls0025pa: use aligned_s64 for timestamp
  - iio: chemical: pms7003: use aligned_s64 for timestamp
  - iio: imu: inv_mpu6050: align buffer for timestamp
  - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold
  - nouveau: fix disabling the nonstall irq due to storm code
  - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
  - net: pcs: rzn1-miic: Correct MODCTRL register offset
  - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list
  - drm/amdgpu: drop hw access in non-DC audio fini
  - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
  - wifi: mwifiex: Initialize the chan_stats array to zero
  - tcp_bpf: Fix copied value in tcp_bpf_sendmsg
  - skmsg: Return copied bytes in sk_msg_memcopy_from_iter
  - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection
  - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap"
  - ALSA: usb-audio: Add mute TLV for playback volumes on some devices
  - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
  - selftest: net: Fix weird setsockopt() in bind_bhash.c.
  - net: atm: fix memory leak in atm_register_sysfs when device_register fail
  - ax25: properly unshare skbs in ax25_kiss_rcv()
  - mctp: return -ENOPROTOOPT for unknown getsockopt options
  - net/smc: Remove validation of reserved bits in CLC Decline message
  - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
  - net: thunder_bgx: decrement cleanup index before use
  - net: thunder_bgx: add a missing of_node_put
  - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
  - wifi: libertas: cap SSID len in lbs_associate()
  - wifi: cw1200: cap SSID length in cw1200_do_join()
  - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
  - wifi: ath11k: fix group data packet drops during rekey
  - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay()
  - wifi: ath11k: rename ath11k_start_vdev_delay()
  - wifi: ath11k: Introduce and use ath11k_sta_to_arsta()
  - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
  - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
  - netlink: add variable-length / auto integers
  - net: macb: Fix tx_ptr_lock locking
  - icmp: fix icmp_ndo_send address translation for reply direction
  - mISDN: Fix memory leak in dsp_hwec_enable()
  - xirc2ps_cs: fix register access when enabling FullDuplex
  - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
  - wifi: cfg80211: fix use-after-free in cmp_bss()
  - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC
  - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM
  - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
  - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
  - Bluetooth: hci_sync: Avoid adding default advertising on startup
  - cpupower: Fix a bug where the -t option of the set subcommand was not working.
  - drm/amd/display: Don't warn when missing DCE encoder caps
  - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
  - LoongArch: Save LBT before FPU in setup_sigcontext()
  - btrfs: avoid load/store tearing races when checking if an inode was logged
  - btrfs: fix race between setting last_dir_index_offset and inode logging
  - btrfs: fix race between logging inode and checking if it was logged before
  - bpf: Fix oob access in cgroup local storage
  - !20556 urma: fix update topo logic
  - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches
  - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers
  - !20560  *** fix CVE-2025-38062 ***
  - !20662  pNFS: Fix a deadlock when returning a delegation during open()
  - ub:hisi-ubus: Add create bus instance ummu bypass
  - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
  - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
  - HID: mcp2221: Handle reads greater than 60 bytes
  - HID: mcp2221: Don't set bus speed on every transfer
  - net/mlx5: SF, Fix add port error handling
  - drm/nouveau/disp: Always accept linear modifier
  - smb3 client: fix return code mapping of remap_file_range
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
  - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
  - HID: wacom: Add a new Art Pen 2
  - HID: logitech: Add ids for G PRO 2 LIGHTSPEED
  - HID: quirks: add support for Legion Go dual dinput modes
  - net: stmmac: Set CIC bit only for TX queues with COE
  - net: stmmac: xgmac: Correct supported speed modes
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
  - net/mlx5e: Set local Xoff after FW update
  - net/mlx5e: Update and set Xon/Xoff upon port speed set
  - net/mlx5e: Update and set Xon/Xoff upon MTU set
  - net/mlx5: Nack sync reset when SFs are present
  - net/mlx5: Convert SF port_indices xarray to function_ids xarray
  - net/mlx5: Use devlink port pointer to get the pointer of container SF struct
  - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc()
  - phy: mscc: Fix when PTP clock is register and unregister
  - net: dlink: fix multicast stats being counted incorrectly
  - dt-bindings: display/msm: qcom,mdp5: drop lut clock
  - drm/nouveau: remove unused memory target test
  - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
  - Bluetooth: hci_sync: fix set_local_name race condition
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
  - Bluetooth: hci_event: Mark connection as closed during suspend disconnect
  - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
  - HID: input: report battery status changes immediately
  - HID: input: rename hidinput_set_battery_charge_status()
  - powerpc/kvm: Fix ifdef to remove build warning
  - drm/msm: Defer fd_install in SUBMIT ioctl
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
  - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
  - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
  - ASoC: codecs: tx-macro: correct tx_macro_component_drv name
  - smb: client: fix race with concurrent opens in unlink(2)
  - scsi: core: sysfs: Correct sysfs attributes access rights
  - of: dynamic: Fix use after free in of_changeset_add_prop_helper()
  - of: Add a helper to free property struct
  - mips: lantiq: xway: sysctrl: rename the etop node
  - mips: dts: lantiq: danube: add missing burst length property
  - pinctrl: STMFX: add missing HAS_IOMEM dependency
  - of: dynamic: Fix memleak when of_pci_add_properties() failed
  - !20684 urma: adjust urma log format
  - !20355  udp: Deal with race between UDP socket address change and rehash
  - !20627  Fixes CVE-2025-38627
  - !20702  CVE-2025-39948
  - !20701  netfilter: ctnetlink: remove refcounting in expectation dumpers
  - !20700  CVE-2025-38678
  - !20703  CVE-2025-38491
  - !20690  tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
  - obmm: reduce log noise for successful export/import/preimport
  - mptcp: avoid deadlock on fallback while reinjecting
  - mptcp: plug races between subflow fail and subflow creation
  - mptcp: make fallback action and fallback decision atomic
  - ice: fix Rx page leak on multi-buffer frames
  - ice: fix incorrect counter for buffer allocation failures
  - ice: stop storing XDP verdict within ice_rx_buf
  - ice: gather page_count()'s of each frag right before XDP prog call
  - ice: Introduce ice_xdp_buff
  - netfilter: ctnetlink: remove refcounting in expectation dumpers
  - netfilter: nf_tables: reject duplicate device on updates
  - netfilter: nf_tables: Introduce functions freeing nft_hook objects
  - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c
  - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
  - !20498 Fix CVE-2025-71118
  - !20608  pmdomain: arm: scmi: Fix genpd leak on provider registration failure
  - !20679  x86/CPU/AMD: Add RDSEED fix for Zen5
  - !20650  fix cve-2025-40300
  - !20661  Input: alps - fix use-after-free bugs caused by dev3_register_work
  - !20664  backport some net bugfix from 6.6 lts
  - urma: adjust urma log format
  - !20678 ub: udma: close debug switch load parameters.
  - ub: udma: close debug switch load parameters.
  - x86/CPU/AMD: Add RDSEED fix for Zen5
  - !20630  net: LTS-6.6 bugfix backport
  - !20632  net/sched: sch_qfq: do not free existing class in qfq_change_class()
  - !20631  macvlan: fix possible UAF in macvlan_forward_source()
  - !20628  Fix CVE-2025-39910
  - !20659 v2  Fix CVE-2025-22090
  - !20506  XSched: Update XSched manual
  - !20647  media: imon: make send_packet() more robust
  - !20646  ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
  - !20645  fbcon: Set fb_display[i
  - !20648  parse_longname(): strrchr() expects NUL-terminated string
  - !20621 urma: modify log level
  - !20602 urma: fix the jfe uaf issue that occurred during the killall process.
  - !20567 urma:change log level and pass status 9
  - !20640  iio: common: st_sensors: Fix use of uninitialize device structs
  - !20634  usb: gadget: udc: fix use-after-free in usb_gadget_state_work
  - !20633  net: dsa: properly keep track of conduit reference
  - !20635  fix CVE-2025-68231
  - !20651  mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  - !20649  drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
  - !20652  mm/vmalloc: fix data race in show_numa_info()
  - x86: uaccess: don't use runtime-const rewriting in modules
  - x86: fix off-by-one in access_ok()
  - x86: fix user address masking non-canonical speculation issue
  - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit
  - x86/uaccess: Improve the 8-byte getuser() case
  - x86: fix whitespace in runtime-const assembler output
  - dcache: keep dentry_hashtable or d_hash_shift even when not used
  - runtime constants: add x86 architecture support
  - runtime constants: deal with old decrepit linkers
  - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address()
  - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
  - libceph: replace BUG_ON with bounds check for map->max_osd
  - libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
  - libceph: fix potential use-after-free in have_mon_and_osd_map()
  - sctp: Hold sock lock while iterating over address list
  - sctp: Prevent TOCTOU out-of-bounds write
  - sctp: Hold RCU read lock while iterating over address list
  - tipc: Fix use-after-free in tipc_mon_reinit_self().
  - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
  - sctp: avoid NULL dereference when chunk data buffer is missing
  - bpf: Explicitly check accesses to bpf_sock_addr
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup
  - nexthop: Forbid FDB status change while nexthop is in a group
  - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
  - sctp: initialize more fields in sctp_v6_from_sk()
  - pNFS: Fix a deadlock when returning a delegation during open()
  - Input: alps - fix use-after-free bugs caused by dev3_register_work
  - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors
  - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork()
  - mm: (un)track_pfn_copy() fix + doc improvements
  - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
  - !20642  mtdchar: fix integer overflow in read/write ioctls
  - mm/vmalloc: fix data race in show_numa_info()
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86
  - x86/vmscape: Enable the mitigation
  - x86/vmscape: Enumerate VMSCAPE bug
  - x86/vmscape: Add conditional IBPB mitigation
  - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
  - parse_longname(): strrchr() expects NUL-terminated string
  - media: imon: make send_packet() more robust
  - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
  - fbcon: Set fb_display[i]->mode to NULL when the mode is released
  - !20569  CVE-2024-35808
  - mtdchar: fix integer overflow in read/write ioctls
  - !20619 Fix CVE-2026-22991
  - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits
  - LoongArch: Add more instruction opcodes and emit_* helpers
  - iio: common: st_sensors: Fix use of uninitialize device structs
  - !20581  null_blk: fix kmemleak by releasing references to fault configfs items
  - mm/mempool: fix poisoning order>0 pages with HIGHMEM
  - mm/page_poison: replace kmap_atomic() with kmap_local_page()
  - mm/mempool: replace kmap_atomic() with kmap_local_page()
  - usb: gadget: udc: fix use-after-free in usb_gadget_state_work
  - net: dsa: properly keep track of conduit reference
  - net/sched: sch_qfq: do not free existing class in qfq_change_class()
  - macvlan: fix possible UAF in macvlan_forward_source()
  - netfilter: nft_objref: validate objref and objrefmap expressions
  - arp: do not assume dev_hard_header() does not change skb->head
  - ip6_gre: make ip6gre_header() robust
  - netfilter: nf_tables: avoid chain re-validation if possible
  - netfilter: nf_tables: drop unused 3rd argument from validate callback ops
  - Revert "netfilter: nft_objref: validate objref and objrefmap expressions"
  - bpf: Fix reference count leak in bpf_prog_test_run_xdp()
  - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
  - ethtool: Avoid overflowing userspace buffer on stats query
  - ipvs: fix ipv4 null-ptr-deref in route error path
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
  - !20596  mm/page_alloc: prevent pcp corruption with SMP=n
  - !20598  team: fix check for port enabled in team_queue_override_port_prio_changed()
  - !18823  hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
  - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
  - kasan: avoid sleepable page allocation from atomic context
  - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
  - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi
  - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches
  - !20460  fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - urma:fix log level and pass status 9
  - urma: modify log level
  - !20592  CVE-2025-71141 fixup
  - !20594  CVE-2025-39744 fixup
  - !20607  powerpc/64s/slb: Fix SLB multihit issue during SLB preload
  - !20606  mm/huge_memory: fix NULL pointer deference when splitting folio
  - !20604 Fix CVE-2026-22984
  - !20603 Fix CVE-2026-23021
  - !20600 Fix CVE-2026-22990
  - urma: fix the jfe uaf issue that occurred during the killall process.
  - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD
  - libceph: make free_choose_arg_map() resilient to partial allocation
  - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET
  - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits
  - net: hns3: extend HCLGE_FD_AD_QID to 11 bits
  - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
  - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
  - Revert "net: hns3: add support for FD counter"
  - !20587  dmaengine: stm32: dmamux: fix device leak on route allocation
  - pmdomain: arm: scmi: Fix genpd leak on provider registration failure
  - powerpc/64s/slb: Fix SLB multihit issue during SLB preload
  - mm/huge_memory: fix NULL pointer deference when splitting folio
  - !20562  LoongArch: BPF: Sign extend kfunc call arguments
  - !20470  ipv4: Fix reference count leak when using error routes with nexthop objects
  - !20471  net: sock: fix hardened usercopy panic in sock_recv_errqueue
  - !20472  net: fix memory leak in skb_segment_list for GRO packets
  - !20473  ipv4: ip_gre: make ipgre_header() robust
  - !20469  SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
  - !20476  ipv6: Fix use-after-free in inet6_addr_del().
  - !20477  svcrdma: bound check rq_pages index in inline path
  - !20578  ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
  - !20579  fix CVE-2025-68768
  - !20542  Fix NFS deadlock
  - USB: storage: Remove subclass and protocol overrides from Novatek quirk
  - cpuidle: governors: menu: Select polling state in some more cases
  - cpuidle: governors: menu: Rearrange main loop in menu_select()
  - cpuidle: menu: Update documentation after previous changes
  - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader"
  - parisc: Remove spurious if statement from raw_copy_from_user()
  - ata: libata-scsi: Fix system suspend for a security locked drive
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo"
  - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present
  - drm/amd/display: use udelay rather than fsleep
  - sched/fair: Revert max_newidle_lb_cost bump
  - net: ipv4: fix regression in local-broadcast routes
  - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
  - PM: runtime: Do not clear needs_force_resume with enabled runtime PM
  - usb: typec: ucsi: psy: Set max current to zero when disconnected
  - io_uring/rw: cast rw->flags assignment to rwf_t
  - Documentation: ACPI: i2c-muxes: fix I2C device references
  - s390/hypfs: Enable limited access during lockdown
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
  - net/mlx5e: Preserve shared buffer capacity during headroom updates
  - net/mlx5: Base ECVF devlink port attrs from 0
  - Octeontx2-af: Skip overlap check for SPI field
  - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU
  - bonding: Add independent control state machine
  - bonding: update LACP activity flag after setting lacp_active
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
  - gve: prevent ethtool ops after shutdown
  - phy: mscc: Fix timestamping for vsc8584
  - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
  - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3()
  - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
  - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
  - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
  - scsi: qla4xxx: Prevent a potential error pointer dereference
  - RDMA/bnxt_re: Fix to initialize the PBL array
  - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
  - RDMA/bnxt_re: Fix to do SRQ armena by default
  - RDMA/erdma: Fix ignored return value of init_kernel_qp
  - iosys-map: Fix undefined behavior in iosys_map_clear()
  - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key
  - spi: spi-fsl-lpspi: Clamp too high speed_hz
  - usb: typec: maxim_contaminant: disable low power mode when reading comparator values
  - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean
  - iio: imu: inv_icm42600: change invalid data error to -EBUSY
  - iio: imu: inv_icm42600: Convert to uXX and sXX integer types
  - iio: imu: inv_icm42600: use = { } instead of memset()
  - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64
  - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
  - iio: light: as73211: Ensure buffer holes are zeroed
  - tls: fix handling of zero-length records on the rx_list
  - powerpc/boot: Fix build with gcc 15
  - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
  - compiler: remove __ADDRESSABLE_ASM{_STR,}() again
  - drm/amd/display: Don't overclock DCE 6 by 15%
  - usb: dwc3: pci: add support for the Intel Wildcat Lake
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
  - usb: renesas-xhci: Fix External ROM access timeouts
  - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test
  - comedi: Make insn_rw_emulate_bits() do insn->n samples
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
  - cdx: Fix off-by-one error in cdx_rpmsg_probe()
  - most: core: Drop device reference after usage in get_channel()
  - iio: proximity: isl29501: fix buffered read on big-endian systems
  - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
  - cpuidle: governors: menu: Avoid selecting states with too much latency
  - cpuidle: menu: Remove iowait influence
  - mmc: sdhci-pci-gli: Add a new function to simplify the code
  - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values
  - mptcp: disable add_addr retransmission when timeout is 0
  - mptcp: remove duplicate sk_reset_timer call
  - use uniform permission checks for all mount propagation changes
  - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support
  - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
  - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
  - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
  - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features
  - PCI: imx6: Delay link start until configfs 'start' written
  - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
  - PCI: rockchip: Use standard PCIe definitions
  - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
  - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
  - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6
  - mm/debug_vm_pgtable: clear page table entries at destroy_args()
  - squashfs: fix memory leak in squashfs_fill_super
  - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
  - memstick: Fix deadlock by moving removing flag earlier
  - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix
  - sched/fair: Fix frequency selection for non-invariant case
  - kbuild: userprogs: use correct linker when mixing clang and GNU ld
  - ata: libata-scsi: Return aborted command when missing sense and result TF
  - PM: runtime: Take active children into account in pm_runtime_get_if_in_use()
  - PM: runtime: Simplify pm_runtime_get_if_active() usage
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
  - usb: dwc3: imx8mp: fix device leak at unbind
  - wifi: mac80211: check basic rates validity in sta_link_apply_parameters
  - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
  - s390/mm: Remove possible false-positive warning in pte_free_defer()
  - btrfs: send: make fs_path_len() inline and constify its argument
  - btrfs: send: use fallocate for hole punching with send stream v2
  - btrfs: send: avoid path allocation for the current inode when issuing commands
  - btrfs: send: keep the current inode's path cached
  - btrfs: send: add and use helper to rename current inode when processing refs
  - btrfs: send: only use boolean variables at process_recorded_refs()
  - btrfs: send: factor out common logic when sending xattrs
  - btrfs: populate otime when logging an inode item
  - btrfs: constify more pointer parameters
  - btrfs: fix ssd_spread overallocation
  - btrfs: open code timespec64 in struct btrfs_inode
  - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
  - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
  - btrfs: always abort transaction on failure to add block group to free space tree
  - btrfs: move transaction aborts to the error site in add_block_group_free_space()
  - btrfs: qgroup: fix race between quota disable and quota rescan ioctl
  - usb: typec: fusb302: cache PD RX state
  - block: Make REQ_OP_ZONE_FINISH a write operation
  - block: reject invalid operation in submit_bio_noacct
  - leds: flash: leds-qcom-flash: Fix registry access after re-bind
  - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition
  - selftests/memfd: add test for mapping write-sealed memfd read-only
  - mm: update memfd seal write check to include F_SEAL_WRITE
  - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
  - mptcp: drop skb if MPTCP skb extension allocation fails
  - ipv6: sr: Fix MAC comparison to be constant-time
  - drm/amd/display: Don't overwrite dce60_clk_mgr
  - drm/amd/display: Add primary plane to commits for correct VRR handling
  - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
  - drm/amdgpu: update mmhub 3.0.1 client id mappings
  - drm/amdgpu: Avoid extra evict-restore process.
  - drm/amd: Restore cached power limit during resume
  - media: venus: venc: Clamp param smaller than 1fps and bigger than 240
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
  - media: venus: protect against spurious interrupts during probe
  - media: venus: hfi: explicitly release IRQ during teardown
  - media: qcom: camss: cleanup media device allocated resource on error path
  - media: ov2659: Fix memory leaks in ov2659_probe()
  - media: usbtv: Lock resolution while streaming
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
  - media: verisilicon: Fix AV1 decoder clock frequency
  - media: vivid: fix wrong pixel_array control size
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
  - media: hi556: correct the test pattern configuration
  - media: gspca: Add bounds checking to firmware parser
  - parisc: Update comments in make_insert_tlb
  - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault()
  - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c
  - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers
  - parisc: Define and use set_pte_at()
  - parisc: Check region is readable by user in raw_copy_from_user()
  - soc/tegra: pmc: Ensure power-domains are in a known state
  - f2fs: fix to avoid out-of-boundary access in dnode page
  - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence
  - vhost/vsock: Avoid allocating arbitrarily-sized SKBs
  - PCI: endpoint: Fix configfs group removal on driver teardown
  - PCI: endpoint: Fix configfs group list head handling
  - mtd: rawnand: renesas: Add missing check after DMA map
  - mtd: rawnand: fsmc: Add missing check after DMA map
  - mtd: spinand: propagate spinand_wait() errors from spinand_write_page()
  - mtd: spi-nor: Fix spi_nor_try_unlock_all()
  - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
  - pwm: mediatek: Fix duty and period setting
  - pwm: mediatek: Handle hardware enable and clock enable separately
  - pwm: imx-tpm: Reset counter if CMOD is 0
  - wifi: ath11k: fix dest ring-buffer corruption when ring is full
  - wifi: ath11k: fix source ring-buffer corruption
  - wifi: ath11k: fix dest ring-buffer corruption
  - wifi: ath12k: fix dest ring-buffer corruption when ring is full
  - wifi: ath12k: fix source ring-buffer corruption
  - wifi: ath12k: fix dest ring-buffer corruption
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
  - iio: adc: ad_sigma_delta: change to buffer predisable
  - zynq_fpga: use sgtable-based scatterlist wrappers
  - scsi: ufs: ufs-pci: Fix default runtime and system PM levels
  - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers
  - ata: libata-scsi: Fix ata_to_sense_error() status handling
  - scsi: mpi3mr: Fix race between config read submit and interrupt completion
  - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints
  - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
  - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses
  - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1
  - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default
  - btrfs: zoned: fix write time activation failure for metadata block group
  - ext4: fix hole length calculation overflow in non-extent inodes
  - ext4: don't try to clear the orphan_present feature block device is r/o
  - ext4: fix reserved gdt blocks handling in fsmap
  - ext4: fix fsmap end of range reporting with bigalloc
  - ext4: check fast symlink for ea_inode correctly
  - tracing: fprobe-event: Sanitize wildcard for fprobe event name
  - crypto: qat - lower priority for skcipher and aead algorithms
  - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap
  - vt: defkeymap: Map keycodes above 127 to K_HOLE
  - vt: keyboard: Don't process Unicode characters in K_OFF mode
  - bus: mhi: host: Fix endianness of BHI vector table
  - usb: dwc3: meson-g12a: fix device leaks at unbind
  - usb: musb: omap2430: fix device leak at unbind
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
  - m68k: Fix lost column on framebuffer debug console
  - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
  - rcu: Fix racy re-initialization of irq_work causing hangs
  - HID: apple: avoid setting up battery timer for devices without battery
  - HID: magicmouse: avoid setting up battery timer when not needed
  - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
  - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros
  - media: uvcvideo: Do not mark valid metadata as invalid
  - media: venus: Fix OOB read due to missing payload bound check
  - parisc: Makefile: fix a typo in palo.conf
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - btrfs: do not allow relocation of partially dropped subvolumes
  - btrfs: zoned: do not select metadata BG as finish target
  - btrfs: clear dirty status from extent buffer on error at insert_new_root()
  - btrfs: zoned: do not remove unwritten non-data block group
  - btrfs: abort transaction during log replay if walk_log_tree() failed
  - btrfs: zoned: use filesystem size not disk size for reclaim decision
  - cdc-acm: fix race between initial clearing halt and open
  - thunderbolt: Fix copy+paste error in match_service_id()
  - usb: typec: ucsi: Update power_supply on power role change
  - misc: rtsx: usb: Ensure mmc child device is active when card is present
  - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range
  - cifs: reset iface weights when we cannot find a candidate
  - drm/amdgpu: fix incorrect vm flags to map bo
  - scsi: lpfc: Remove redundant assignment to avoid memory leak
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
  - pNFS: Handle RPC size limit for layoutcommits
  - pNFS: Fix disk addr range check in block/scsi layout
  - pNFS: Fix stripe mapping in block/scsi layout
  - ASoC: Intel: avs: Fix uninitialized pointer error in probe()
  - net: phy: smsc: add proper reset flags for LAN8710A
  - ipmi: Fix strcpy source and destination the same
  - kconfig: lxdialog: fix 'space' to (de)select options
  - kconfig: gconf: fix potential memory leak in renderer_edited()
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings
  - vfio/mlx5: fix possible overflow in tracking max message size
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY
  - scsi: target: core: Generate correct identifiers for PR OUT transport IDs
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
  - kconfig: nconf: Ensure null termination where strncpy is used
  - vfio/type1: conditional rescheduling while pinning
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
  - f2fs: check the generic conditions first
  - exfat: add cluster chain loop check for dir
  - i2c: Force DLL0945 touchpad i2c freq to 100khz
  - apparmor: use the condition in AA_BUG_FMT even with debug disabled
  - dm-table: fix checking for rq stackable devices
  - dm-mpath: don't print the "loaded" message if registering fails
  - i3c: master: Initialize ret in i3c_i2c_notifier_call()
  - i3c: don't fail if GETHDRCAP is unsupported
  - apparmor: shift ouid when mediating hard links in userns
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
  - i3c: add missing include to internal header
  - module: Prevent silent truncation of module name in delete_module(2)
  - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use
  - soundwire: Move handle_nested_irq outside of sdw_dev_lock
  - soundwire: amd: serialize amd manager resume sequence during pm_prepare
  - crypto: octeontx2 - add timeout for load_fvc completion poll
  - media: uvcvideo: Fix bandwidth issue for Alcor camera
  - media: usb: hdpvr: disable zero-length read messages
  - media: tc358743: Increase FIFO trigger level to 374
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
  - media: tc358743: Check I2C succeeded during probe
  - pinctrl: stm32: Manage irq affinity settings
  - scsi: mpi3mr: Correctly handle ATA device errors
  - scsi: mpt3sas: Correctly handle ATA device errors
  - power: supply: qcom_battmgr: Add lithium-polymer entry
  - RDMA/core: reduce stack using in nldev_stat_get_doit()
  - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs
  - leds: leds-lp50xx: Handle reg to get correct multi_index
  - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control
  - MIPS: lantiq: falcon: sysctrl: fix request memory check logic
  - crypto: jitter - fix intermediary handling
  - watchdog: iTCO_wdt: Report error if timeout configuration fails
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
  - clk: qcom: ipq5018: keep XO clock always on
  - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state
  - watchdog: dw_wdt: Fix default timeout
  - fs/orangefs: use snprintf() instead of sprintf()
  - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal
  - mfd: axp20x: Set explicit ID for AXP313 regulator
  - clk: tegra: periph: Fix error handling and resolve unsigned compare warning
  - fbdev: fix potential buffer overflow in do_register_framebuffer()
  - cifs: Fix calling CIFSFindFirst() for root path without msearch
  - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition
  - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported
  - drm/amd/display: Only finalize atomic_obj if it was initialized
  - vhost: fail early when __vhost_add_used() fails
  - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
  - rcu: Fix rcu_read_unlock() deadloop due to IRQ work
  - drm/amd/display: Avoid trying AUX transactions on disconnected ports
  - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size
  - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP
  - uapi: in6: restore visibility of most IPv6 socket options
  - drm/ttm: Should to return the evict error
  - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range
  - net: ncsi: Fix buffer overflow in fetching version id
  - ionic: clean dbpage in de-init
  - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc()
  - ptp: Use ratelimite for freerun error message
  - bpftool: Fix JSON writer resource leak in version command
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
  - net: dsa: b53: prevent DIS_LEARNING access on BCM5325
  - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
  - gve: Return error for unknown admin queue command
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
  - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured
  - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual
  - dpaa_eth: don't use fixed_phy_change_carrier
  - wifi: iwlegacy: Check rate_idx range after addition
  - netmem: fix skb_frag_address_safe with unreadable skbs
  - powerpc: floppy: Add missing checks after DMA map
  - wifi: ath12k: Decrement TID on RX peer frag setup error handling
  - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
  - wifi: mac80211: update radar_required in channel context after channel switch
  - drm/amd/display: Fix 'failed to blank crtc!'
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
  - wifi: ath12k: Add memset and update default rate value in wmi tx completion
  - drm/amd/display: Separate set_gsl from set_gsl_source_select
  - net: fec: allow disable coalescing
  - net: atlantic: add set_power to fw_ops for atl2 to fix wol
  - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
  - net: thunderbolt: Enable end-to-end flow control also in transmit
  - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace
  - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch
  - wifi: rtw89: Disable deep power saving for USB/SDIO
  - wifi: rtw89: Fix rtw89_mac_power_switch() for USB
  - drm/msm: use trylock for debugfs
  - wifi: mac80211: fix rx link assignment for non-MLO stations
  - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc().
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
  - wifi: mac80211: don't complete management TX on SAE commit
  - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
  - s390/stp: Remove udelay from stp_sync_clock()
  - wifi: iwlwifi: mvm: fix scan request validation
  - um: Re-evaluate thread flags repeatedly
  - wifi: iwlwifi: mvm: set gtk id also in older FWs
  - perf/cxlpmu: Remove unintended newline from IRQ name format string
  - net: phy: micrel: Add ksz9131_resume()
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
  - net: ipv4: fix incorrect MTU in broadcast routes
  - wifi: cfg80211: Fix interface type validation
  - net: mctp: Prevent duplicate binds
  - arm64: Mark kernel as tainted on SAE and SError panic
  - net/mlx5e: Properly access RCU protected qdisc_sleeping variable
  - net: ag71xx: Add missing check after DMA map
  - et131x: Add missing check after DMA map
  - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
  - be2net: Use correct byte order and format string for TCP seq and ack_seq
  - s390/time: Use monotonic clock in get_cycles()
  - wifi: cfg80211: reject HTC bit for management frames
  - ktest.pl: Prevent recursion of default variable options
  - wifi: ath12k: Correct tid cleanup when tid setup fails
  - net: usb: cdc-ncm: check for filtering capability
  - xen/netfront: Fix TX response spurious interrupts
  - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie()
  - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64
  - ASoC: qcom: use drvdata instead of component to keep id
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification
  - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
  - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
  - platform/chrome: cros_ec_typec: Defer probe on missing EC parent
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
  - soc: qcom: mdt_loader: Actually use the e_phoff
  - imx8m-blk-ctrl: set ISI panic write hurry level
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
  - usb: core: usb_submit_urb: downgrade type check
  - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
  - ALSA: hda: Disable jack polling at shutdown
  - ALSA: hda: Handle the jack polling always via a work
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
  - mei: bus: Check for still connected devices in mei_cl_bus_dev_release()
  - char: misc: Fix improper and inaccurate error code returned by misc_init()
  - reset: brcmstb: Enable reset drivers for ARCH_BCM2835
  - pps: clients: gpio: fix interrupt handling order in remove path
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
  - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
  - ACPI: processor: fix acpi_object initialization
  - PM: sleep: console: Fix the black screen issue
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
  - firmware: tegra: Fix IVC dependency problems
  - ACPI: PRM: Reduce unnecessary printing to avoid user confusion
  - selftests: tracing: Use mutex_unlock for testing glob filter
  - tools/build: Fix s390(x) cross-compilation with clang
  - gpio: tps65912: check the return value of regmap_update_bits()
  - iio: adc: ad_sigma_delta: don't overallocate scan buffer
  - tools/nolibc: define time_t in terms of __kernel_old_time_t
  - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
  - EDAC/synopsys: Clear the ECC counters on init
  - gpio: wcd934x: check the return value of regmap_update_bits()
  - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
  - soc: qcom: rpmh-rsc: Add RSC version 4 support
  - usb: xhci: Avoid showing errors during surprise removal
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
  - usb: xhci: Avoid showing warnings for dying controller
  - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
  - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
  - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
  - usb: xhci: print xhci->xhc_state when queue_command failed
  - tracefs: Add d_delete to remove negative dentries
  - securityfs: don't pin dentries twice, once is enough...
  - fix locking in efi_secret_unlink()
  - ext2: Handle fiemap on empty files to prevent EINVAL
  - fs/ntfs3: correctly create symlink for relative path
  - fs/ntfs3: Add sanity check for file name
  - better lockdep annotations for simple_recursive_removal()
  - hfs: fix not erasing deleted b-tree node issue
  - drbd: add missing kref_get in handle_write_conflicts
  - udf: Verify partition map count
  - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
  - nvme-pci: try function level reset on init failure
  - smb/server: avoid deadlock when linking with ReplaceIfExists
  - arm64: Handle KCOV __init vs inline mismatches
  - ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
  - intel_idle: Allow loading ACPI tables for any family
  - net: ti: icss-iep: Fix incorrect type for return value in extts_enable()
  - netfilter: ctnetlink: fix refcount leak on table dump
  - udp: also consider secpath when evaluating ipsec use for checksumming
  - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
  - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
  - KVM: VMX: Extract checking of guest's DEBUGCTL into helper
  - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
  - KVM: VMX: Handle forced exit due to preemption timer in fastpath
  - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits
  - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint
  - libceph: prevent potential out-of-bounds reads in handle_auth_done()
  - net: usb: pegasus: fix memory leak in update_eth_regs_async()
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
  - !20540 urma: added support for ipoverurma
  - team: fix check for port enabled in team_queue_override_port_prio_changed()
  - mm/page_alloc: prevent pcp corruption with SMP=n
  - !20528 Fix CVE-2025-71083
  - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
  - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
  - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow
  - smb: client: don't wait for info->send_pending == 0 on error
  - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()
  - ACPI: processor: perflib: Move problematic pr->performance check
  - ACPI: processor: perflib: Fix initial _PPC limit application
  - Documentation: ACPI: Fix parent device references
  - fs: Prevent file descriptor table allocations exceeding INT_MAX
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check
  - PCI: Extend isolated function probing to LoongArch
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op
  - net: dpaa: fix device leak when querying time stamp info
  - net: ti: icss-iep: fix device and OF node leaks at probe
  - net: mtk_eth_soc: fix device leak at probe
  - net: enetc: fix device and OF node leak at probe
  - net: gianfar: fix device leak when querying time stamp info
  - net: phy: micrel: fix KSZ8081/KSZ8091 cable test
  - gpio: mlxbf3: use platform_get_irq_optional()
  - gpio: mlxbf2: use platform_get_irq_optional()
  - gpio: virtio: Fix config space reading.
  - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
  - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors
  - rcu: Fix racy re-initialization of irq_work causing hangs
  - rcu: Fix rcu_read_unlock() deadloop due to IRQ work
  - drm/tilcdc: Fix removal actions in case of failed probe
  - drm/tilcdc: request and mapp iomem with devres
  - urma: fix update topo logic
  - dmaengine: stm32: dmamux: fix device leak on route allocation
  - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD
  - null_blk: fix kmemleak by releasing references to fault configfs items
  - inet: frags: flush pending skbs in fqdir_pre_exit()
  - inet: frags: add inet_frag_queue_flush()
  - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
  - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen
  - md/dm-raid: don't call md_reap_sync_thread() directly
  - ACPICA: Avoid walking the Namespace if start_node is NULL
  - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS
  - LoongArch: BPF: Sign extend kfunc call arguments
  - genirq/msi:: Fix kabi break of struct msi_desc
  - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie
  - NFS: Fix a deadlock involving nfs_release_folio()
  - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page""
  - urma: added support for ipoverurma
  - drm/ttm: Avoid NULL pointer deref for evicted BOs
  - XSched: Update XSched manual
  - svcrdma: bound check rq_pages index in inline path
  - ipv6: Fix use-after-free in inet6_addr_del().
  - ipv4: ip_gre: make ipgre_header() robust
  - net: fix memory leak in skb_segment_list for GRO packets
  - net: sock: fix hardened usercopy panic in sock_recv_errqueue
  - ipv4: Fix reference count leak when using error routes with nexthop objects
  - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - udp: Deal with race between UDP socket address change and rehash
  - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors
  - x86/tsc: Use topology_max_packages() to get package number
  - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register
  - EDAC/amd64: Correct the address translation for hygon family 18h model 4h
  - KVM: arm64: Mark some header functions as inline
  - KVM: arm64: Refactor exit handlers
  - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs
  - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio


author: Li Nan <linan122@huawei.com> - 6.6.0-140.0.0.134
changelog:
  - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes
  - ub/obmm: fix wrong pxm_numa parameter validation
  - ub/obmm: Remove unused parameters from obmm_addr_check.c
  - ub/obmm: Enhance mem_allocator_granu validation
  - ub/obmm: simplify allocator naming scheme
  - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory
  - ub/obmm: add sysfs interface with fine-grained memory statistics
  - !20804  net: hv_netvsc: reject RSS hash key programming without RX indirection table
  - !20813  migrate: correct lock ordering for hugetlb file folios
  - !20812  libceph: make calc_target() set t->paused, not just clear it
  - !20719 drivers/ub/sentry: some bugfix
  - !20798 urma: log should not retrieve eid_idx from uctx
  - !20808 urma: support triple bonding device
  - urma: log should not retrieve eid_idx from uctx
  - migrate: correct lock ordering for hugetlb file folios
  - libceph: make calc_target() set t->paused, not just clear it
  - !20745 vfio platform VFIO support for hisi05a1 devices
  - urma: support triple bonding device
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table
  - !20789  gic: Add hip09 support for HISILICON_ERRATUM_165010801
  - !20726  tracing: Add recursion protection in kernel stack trace recording
  - !20668  irqchip/gic-v3-its: Avoid truncating memory addresses
  - !20795 ub: udma: support query and set qos info.
  - !20791 Migration/urma:optimize performance in live migration.
  - ub: udma: Support for UE link establishment message.
  - Migration/urma: optimize performance in live migration.
  - !20787 ub: cdma: modify the method of assigning values to the structure
  - !20759 ubcore: hotfix route query for port eid on the same node.
  - ub: udma: support query and set qos info.
  - Revert "ub: ubase: Support for RC saved by queue granularity"
  - ubcore: hotfix route query for port eid on the same node.
  - !20676 urma: set/get sl
  - !20765 urma: bugfix of UAF and double free in ubcm
  - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability
  - gic: Add hip09 support for HISILICON_ERRATUM_165010801
  - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default
  - vfio/platform: VFIO support for hisi05a1 devices
  - ub: cdma: modify the method of assigning values to the structure
  - urma: set/get sl
  - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth
  - ub: ubase: Support for RC saved by queue granularity
  - ub: ubase: Traverse mailbox AE events using interrupts and polling.
  - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages
  - net: unic: The function of dumping himac registers is added.
  - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style
  - ub: ubase: Retain the initial tm qset configuration and restore it
  - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs.
  - ub: ubase: Add a retransmission function to improve reliability.
  - net: unic: Increase the readability and reliability of loopback code
  - net: unic: Synchronize the code modify for ip management and deactivation
  - net: unic: Increase the readability and reliability of VLAN feature.
  - net: unic: Added unic DFX log information.
  - ub: ubase: Add and correct comments for some functions and data structures
  - net: unic: Notify MAMI when the bond port status changes
  - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset
  - !20768 iommu/ummu-core: Fix separate page table compatibility
  - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3
  - !20764 net: hns3: fix double free issue for tx spare buffer
  - urma: bugfix of UAF and double free in ubcm
  - iommu/ummu-core: Fix separate page table compatibility
  - net: hns3: fix double free issue for tx spare buffer
  - drivers/ub/sentry: fix memory leak in sentry_msg_helper
  - drivers/ub/sentry: initialize some variables
  - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg()
  - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm
  - drivers/ub/sentry: add input parameter verification for exported symbols
  - tracing: Add recursion protection in kernel stack trace recording
  - x86/csv: Enhance CMA memory usage reporting for CSV3
  - irqchip/gic-v3-its: Avoid truncating memory addresses


author: Li Nan <linan122@huawei.com> - 6.6.0-141.0.0.135
changelog:
  - !20704 kernel support hisi-cca-da
  - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration
  - !20905 v2  KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
  - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization
  - !20964 iommu/ummu: Support TID and EID Granularity for MPAM
  - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver
  - hisi-cca-da: Start dev by rsi call
  - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV
  - hisi-cca-da: Support swiotlb and realm memory use
  - hisi-cca-da: Add smmu info when dev attach
  - hisi-cca-da: Transfer realm msix access to rmm
  - hisi-cca-da: Support pcipc sriov capability
  - hisi-cca-da: Delay realm memory release to kvm_destroy_realm
  - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm
  - hisi-cca-da: Add cca realm s2 pgtable framework
  - hisi-cca-da: Use bitmap to determine whether the command can be forwarded
  - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only
  - hisi-cca-da: Add cmd forward mechanism in realm smmu
  - hisi-cca-da: Add realm smmu event and gerror irq initialization
  - hisi-cca-da: Add realm smmu stream table initialization
  - hisi-cca-da: Add realm smmu cmdq and evtq initialization
  - hisi-cca-da: Add realm smmu initialization
  - hisi-cca-da: Add relam iommu support to iommufd
  - hisi-cca-da: Add realm iommu support for vfio-iommu-type1
  - hisi-cca-da: Support dev map and unmap
  - hisi-cca-da: Support dev validate and dev start
  - hisi-cca-da: VFIO support ccada
  - hisi-cca-da: Support dev delegate and dev attach
  - hisi-cca-da: Support root dev delegate and dev init
  - hisi-cca-da: Add hisilicon extension smc and ccada cmd
  - hisi-cca-da: Add hisi ccada feature config
  - !20751 ARM CCA supports hugepage
  - !20944 ub: ubmempfd: supports for D2H mapping and demapping
  - !20888  HiSock Enhancement
  - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver.
  - net: unic: Resolve the residual MAC address problem
  - net: unic: Optimized the code for the cmd structure and FEC function.
  - ub: ubase: add log for post mailbox timeout
  - ub: ubus: Remove black box header file to include dir
  - rme: Remove the secret bit of the vring desc addr
  - rme: improve hisi-cca data mmap and destroy method
  - !20943 uvb: fix wd_obtain logic err
  - !20942 urma: fix bond device id not release
  - !20892  dcache: Limit the minimal number of bucket to two
  - rme: isolate page when do delegation to avoid migration
  - rme: hisi-cca supports different levels for mapping ram
  - rme: rename ccal to hisi-cca
  - rme: support set ripas for ccal realm vm
  - rme: support destroy ram data for ccal realm vm
  - rme: support populate region for ccal realm vm
  - rme: support map ram for ccal realm vm
  - rme: support config ccal realm vm
  - rme: support ccal RMI calls
  - rme: realm vm supports wfx handler
  - !20952 urma: introduce ipourma module
  - iommu/ummu-core: Simplifies tdev initialization resources
  - iommu/ummu: Optimized log printing
  - iommu/ummu: Use passed gfp_mask in map_pages callback
  - uvb: fix wd_obtain logic err
  - !20949 ub: udma: support user ctl function.
  - urma: fix bond device id not release
  - !20901 drivers/ub/sentry: some bugfix
  - ub: ubmempfd: supports for D2H mapping and demapping
  - ub: ubmempfd: supports providing services to the QEMU process through file nodes
  - [virtCCA Live Migration 2]virtcca secure cvm supports live migration
  - urma: query priority and enable bit, support ring size configuration
  - urma: implement debugfs, improve boundary checks and error handling logic
  - urma: implement data plane interaction and statistics
  - urma: implement ipourma network device operations
  - urma: ipourma resource management
  - urma: ipourma resource management and err code
  - urma: introduce ipourma main module
  - iommu/ummu: Optimized the TID invalidation configuration
  - iommu/ummu: Optimized SVA permission table memory allocation approach
  - iommu/ummu: Adapt UMMU SVA interface adjustment
  - iommu/ummu: Support TID and EID Granularity for MPAM
  - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y
  - !20847 urma: sl resource query error
  - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches
  - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption
  - !20929  PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug
  - drivers/ub/sentry: fix check input parameters
  - ub: udma: support user ctl function.
  - ub: udma: support uboe function.
  - ub: udma: bugfix related to query aux info.
  - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs
  - drivers/ub/sentry: do not use magic numbers
  - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface
  - urma: sl resource query error
  - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4
  - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time
  - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs
  - ub: ubmem_vmmu: supports parsing and configuring the hardware node information
  - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation
  - !20806 Fix CVE-2025-71225
  - !20896  scsi: qla2xxx: Free sp in error path to fix system crash
  - !20894  scsi: qla2xxx: Delay module unload while fabric scan in progress
  - !20893  scsi: qla2xxx: Validate sp before freeing associated memory
  - !20802 Fix CVE-2026-23110
  - urma: Kernel-mode specific implementations file for Jetty extension interface
  - drivers/ub/sentry: fix memory leak in process_urma_data()
  - drivers/ub/sentry: initialize some variables
  - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug
  - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory
  - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
  - mm: consider non-anon swap cache folios in folio_expected_ref_count()
  - mm: simplify folio_expected_ref_count()
  - ASoC: qcom: audioreach: fix potential null pointer dereference
  - gcc-plugins: Remove TODO_verify_il for GCC >= 16
  - crypto: sha256 - fix crash at kexec
  - drm/i915/backlight: Return immediately when scale() finds invalid parameters
  - minmax.h: remove some #defines that are only expanded once
  - minmax.h: simplify the variants of clamp()
  - minmax.h: move all the clamp() definitions after the min/max() ones
  - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
  - minmax.h: reduce the #define expansion of min(), max() and clamp()
  - minmax.h: update some comments
  - minmax.h: add whitespace around operators and after commas
  - minmax: fix up min3() and max3() too
  - minmax: improve macro expansion and type checking
  - minmax: don't use max() in situations that want a C constant expression
  - minmax: simplify min()/max()/clamp() implementation
  - minmax: make generic MIN() and MAX() macros available everywhere
  - drm/ast: Use msleep instead of mdelay for edid read
  - gpiolib: Extend software-node support to support secondary software-nodes
  - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB
  - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b
  - kmsan: fix out-of-bounds access to shadow memory
  - afs: Fix potential null pointer dereference in afs_put_server
  - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
  - i40e: improve VF MAC filters accounting
  - i40e: add mask to apply valid bits for itr_idx
  - HID: asus: add support for missing PX series fn keys
  - drm/gma500: Fix null dereference in hdmi teardown
  - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
  - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
  - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
  - net: dsa: lantiq_gswip: do also enable or disable cpu port
  - selftests: fib_nexthops: Fix creation of non-FDB nexthops
  - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
  - bnxt_en: correct offset handling for IPv6 destination address
  - vhost: Take a reference on the task in struct vhost_task.
  - Bluetooth: hci_sync: Fix hci_resume_advertising_sync
  - ethernet: rvu-af: Remove slash from the driver name
  - can: peak_usb: fix shift-out-of-bounds issue
  - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
  - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
  - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
  - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
  - bpf: Reject bpf_timer for PREEMPT_RT
  - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
  - wifi: virt_wifi: Fix page fault on connect
  - cpufreq: Initialize cpufreq-based invariance before subsys
  - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
  - arm64: dts: imx8mp: Correct thermal sensor index
  - mm: folio_may_be_lru_cached() unless folio_test_large()
  - mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
  - mm/gup: check ref_count instead of lru before migration
  - mm: add folio_expected_ref_count() for reference count calculation
  - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
  - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
  - ALSA: usb-audio: Add mute TLV for playback volumes on more devices
  - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
  - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
  - i2c: designware: Add quirk for Intel Xe
  - mmc: sdhci-cadence: add Mobileye eyeQ support
  - usb: core: Add 0x prefix to quirks debug output
  - ALSA: usb-audio: Fix build with CONFIG_INPUT=n
  - ALSA: usb-audio: Convert comma to semicolon
  - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
  - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
  - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
  - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
  - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
  - ALSA: usb-audio: Fix block comments in mixer_quirks
  - firewire: core: fix overlooked update of subsystem ABI version
  - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
  - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches
  - !20869 ub:hisi-ubus: fix bug of security smatch
  - !20861  CVE-2026-23163
  - ub: ubdevshm: supports the memory user to obtain and release shared memory
  - ub: ubdevshm: supports granting and revoking shared memory permissions
  - ub: ubdevshm: supports the registration and deregistration of shared memory segments
  - ub: ubdevshm: supports the registration and deregistration
  - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
  - !20886  Fix CVE-2026-23205
  - !20803 Fix CVE-2026-23112
  - !20868  sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure
  - !20811  smb/server: fix refcount leak in smb2_open()
  - !20810  smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
  - !20809  smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
  - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4
  - sunrpc: fix race in cache cleanup causing stale nextcheck time
  - scsi: qla2xxx: Free sp in error path to fix system crash
  - scsi: qla2xxx: Delay module unload while fabric scan in progress
  - scsi: qla2xxx: Validate sp before freeing associated memory
  - dcache: Limit the minimal number of bucket to two
  - !20872 Fix CVE-2026-23220
  - !20846 Fix CVE-2026-23193
  - !20815 Fix CVE-2026-23216
  - !20859 Fix CVE-2026-23179
  - !20871  CVE-2026-23096
  - !20858 ub: ubase: resolve the cmdq crq overflow problem
  - bpf: Deprecate hisock unused kfuncs and orig ingress logic
  - bpf: Add local connect support for hisock
  - bpf: Add ipv4-mapped ipv6 addr support for hisock
  - bpf: Add target comm parse to hisock_cmd
  - bpf: Add multi port parse to hisock_cmd
  - bpf: Only deploy hisock in server
  - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress
  - bpf: Add bpf_handle_ingress/egress_ptype kfunc
  - bpf: Add bpf_get_skb_ethhdr kfunc
  - bpf: Add bpf_set_ingress/egress_dev kfunc
  - bpf: Add bpf_set_ingress_dst kfunc
  - bpf: Add BPF_HISOCK_INGRESS attach type
  - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted
  - smb: client: fix potential UAF and double free in smb2_open_file()
  - smb/client: fix memory leak in smb2_open_file()
  - !20852  ASoC: amd: fix memory leak in acp3x pdm dma ops
  - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths
  - uacce: fix cdev handling in the cleanup path
  - Revert "uacce: fix for cdev memory leak"
  - ub:hisi-ubus: fix bug of security smatch
  - ub:ubus: injected route event
  - ub:ubus: Black Box Development
  - !20865 urma: urma support uboe
  - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure
  - urma: urma support uboe
  - !20857 ub_fwctl driver adds support for querying some functions
  - ub:ub_fwctl:Add illegal verification for scc
  - ub:ub_fwctl:Support querying the historical status of port links
  - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove
  - drm/amdkfd: Don't use sw fault filter if retry cam enabled
  - ub:ub_fwctl:Support querying firmware version numbers
  - ub: ub_fwctl: Support querying real-time bandwidth statistics
  - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels
  - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  - !20854 [URMA] add ping server for urma_ping
  - urma: add ping server
  - ub: ubase: resolve the cmdq crq overflow problem
  - ub: ubase: Optimized the QoS code naming to improve code readability.
  - ub: ubase&unic: optimizing code and configuration settings.
  - net: unic: not support query and configure ip by control plane in UBoE
  - net: unic: fix the automatically enable uc guid promisc mode.
  - !20844 urma:kernel header of userctl
  - urma: Kernel-mode header file for Jetty extension interface
  - ASoC: amd: fix memory leak in acp3x pdm dma ops
  - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
  - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
  - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
  - !20835 Fix CVE-2026-23084
  - minmax: add a few more MIN_T/MAX_T users
  - minmax: simplify and clarify min_t()/max_t() implementation
  - minmax: avoid overly complicated constant expressions in VM code
  - rtc: pcf2127: fix SPI command byte for PCF2131 backport
  - xhci: dbc: Fix full DbC transfer ring after several reconnects
  - xhci: dbc: decouple endpoint allocation from initialization
  - phy: ti: omap-usb2: fix device leak at unbind
  - phy: Use device_get_match_data()
  - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
  - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
  - ASoC: wm8974: Correct PLL rate rounding
  - ASoC: wm8940: Correct typo in control name
  - ASoC: wm8940: Correct PLL rate rounding
  - io_uring: include dying ring in task_work "should cancel" state
  - io_uring: backport io_should_terminate_tw()
  - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
  - selftests: mptcp: avoid spurious errors on TCP disconnect
  - selftests: mptcp: connect: catch IO errors on listen side
  - rds: ib: Increment i_fastreg_wrs before bailing out
  - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
  - mmc: mvsdio: Fix dma_unmap_sg() nents value
  - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
  - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface
  - btrfs: tree-checker: fix the incorrect inode ref size check
  - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page()
  - LoongArch: Check the return value when creating kobj
  - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled
  - LoongArch: Update help info of ARCH_STRICT_ALIGN
  - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
  - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
  - net: liquidio: fix overflow in octeon_init_instr_queue()
  - bonding: don't set oif to bond dev when getting NS target destination
  - net/mlx5e: Consider aggregated port speed during rate configuration
  - i40e: remove redundant memory barrier when cleaning Tx descs
  - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
  - selftests: mptcp: sockopt: fix error messages
  - mptcp: tfo: record 'deny join id0' info
  - mptcp: set remote_deny_join_id0 on SYN recv
  - dpaa2-switch: fix buffer pool seeding for control traffic
  - btrfs: fix invalid extref key setup when replaying dentry
  - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
  - wifi: mac80211: fix incorrect type for ret
  - wifi: mac80211: increase scan_ies_len for S1G
  - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
  - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches
  - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
  - !20776 ub:ubfi: Release the chosen node
  - !20817  CVE-2026-23094
  - !20819  dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
  - ub:ubus: Add port num check
  - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer
  - !20830  sched/soft_domain: Increasing NR_MAX_CLUSTER to 32
  - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32
  - btrfs: fix incorrect readahead expansion length
  - x86: disable image size check for test builds
  - drm/i915/power: fix size for for_each_set_bit() in abox iteration
  - drm/amdgpu: fix a memory leak in fence cleanup when unloading
  - net: mdiobus: release reset_gpio in mdiobus_unregister_device()
  - phy: ti-pipe3: fix device leak at unbind
  - phy: tegra: xusb: fix device and OF node leak at probe
  - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate
  - usb: gadget: midi2: Fix MIDI2 IN EP max packet size
  - usb: gadget: midi2: Fix missing UMP group attributes initialization
  - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
  - RISC-V: Remove unnecessary include from compat.h
  - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active()
  - hrtimer: Remove unused function
  - regulator: sy7636a: fix lifecycle of power good gpio
  - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
  - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
  - hsr: use rtnl lock when iterating over ports
  - net: hsr: Add VLAN CTAG filter support
  - net: hsr: Add support for MC filtering at the slave device
  - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
  - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
  - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
  - igb: fix link test skipping when interface is admin down
  - docs: networking: can: change bcm_msg_head frames member to support flexible array
  - tunnels: reset the GSO metadata before reusing the skb
  - net: bridge: Bounce invalid boolopts
  - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
  - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
  - USB: serial: option: add Telit Cinterion FN990A w/audio compositions
  - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
  - serial: sc16is7xx: fix bug in flow control levels init
  - tty: hvc_console: Call hvc_kick in hvc_write unconditionally
  - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups"
  - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
  - Input: iqs7222 - avoid enabling unused interrupts
  - mm/khugepaged: fix the address passed to notifier on testing young
  - btrfs: fix corruption reading compressed range when block size is smaller than page size
  - btrfs: use readahead_expand() on compressed extents
  - mm/damon/sysfs: fix use-after-free in state_show()
  - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
  - mtd: nand: raw: atmel: Fix comment in timings preparation
  - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
  - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
  - mm/damon/core: set quota->charged_from to jiffies at first charge window
  - fuse: prevent overflow in copy_file_range return value
  - fuse: check if copy_file_range() returns larger than requested size
  - mtd: rawnand: stm32_fmc2: fix ECC overwrite
  - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
  - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups
  - i2c: i801: Hide Intel Birch Stream SoC TCO WDT
  - ocfs2: fix recursive semaphore deadlock in fiemap call
  - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
  - compiler-clang.h: define __SANITIZE_*__ macros only when undefined
  - EDAC/altera: Delete an inappropriate dma_free_coherent() call
  - rcu-tasks: Maintain real-time response in rcu_tasks_postscan()
  - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks
  - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks
  - s390/cpum_cf: Deny all sampling events by counter PMU
  - NFSv4/flexfiles: Fix layout merge mirror check.
  - NFSv4.2: Serialise O_DIRECT i/o and copy range
  - NFSv4.2: Serialise O_DIRECT i/o and clone range
  - NFSv4.2: Serialise O_DIRECT i/o and fallocate()
  - NFS: Serialise O_DIRECT i/o and truncate()
  - fs/nfs/io: make nfs_start_io_*() killable
  - ftrace/samples: Fix function size computation
  - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
  - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
  - media: i2c: imx214: Fix link frequency validation
  - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs()
  - nfsd: Fix a regression in nfsd_setattr()
  - kasan: fix GCC mem-intrinsic prefix with sw tags
  - kunit: kasan_test: disable fortify string checker on kasan_strings() test
  - io_uring: fix kabi broken in struct io_ring_ctx
  - io_uring: Support forcing sq thread to be idle and woken up by hrtimer
  - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
  - uacce: fix isolate sysfs check condition
  - Revert "uacce: fix isolate sysfs check condition"
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
  - smb/server: fix refcount leak in smb2_open()
  - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
  - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
  - md: suspend array while updating raid_disks via sysfs
  - scsi: core: Wake up the error handler when final completions race against each other
  - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
  - ub:ubfi: Release the chosen node
  - ub:ubus: Delete unused functions
  - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption


author: Li Nan <linan122@huawei.com> - 6.6.0-142.0.0.136
changelog:
  - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise.
  - !21192 urma: bugfix of ubagg&ubcore&uburma
  - !21183  platform/x86: classmate-laptop: Add missing NULL pointer checks
  - urma: bugfix of ubagg&ubcore&uburma
  - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise.
  - platform/x86: classmate-laptop: Add missing NULL pointer checks
  - !21167 urma: fix kernel codecheck issues.
  - !21174 urma: change return value for provider err
  - !21127 urma: copy linked ports when importing bond jetty/seg
  - !20247 ubcore: query primary eid in ipourma loopback mode.
  - !21077 Fix hisi cca bugs
  - ubcore: route query refine and ipo loopback adapt.
  - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device.
  - hisi-cca-da: Write NS STE for PF drivers.
  - hisi-cca-da: Provide IO interfaces
  - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices
  - !21045  scsi: hisi_sas: Fix NULL pointer exception when do user_scan()
  - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe.
  - !21165  tools/interference: add ifstool utility for kernel interference statistics
  - !21166 urma: fix jfce uaf in batch cleanup
  - !21043 urma: fix tjetty ref in ping server
  - urma: change return value for provider err
  - !21128  sched/rt: Skip currently executing CPU in rto_next_cpu()
  - !21129  procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  - urma: fix jfce uaf in batch cleanup
  - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver
  - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches
  - urma: fix kernel codecheck issues.
  - tools/interference: add ifstool utility for kernel interference statistics
  - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor
  - !21092  kexec: derive purgatory entry from symbol
  - !21154  sched: Add SOFT_DOMAIN feature interface for cgroup2
  - !21153  fix CVE-2025-39981
  - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm"
  - urma: fix tjetty ref in ping server
  - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA
  - hisi-cca-da: Improve hisi cca dev validate and delegate
  - hisi-cca-da: Fix smmu enable rme problem
  - hisi-cca-da: Fix msi region shared problem
  - sched: Add SOFT_DOMAIN feature interface for cgroup2
  - Bluetooth: MGMT: Fix memory leak in set_ssp_complete
  - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
  - overflow: Introduce __DEFINE_FLEX for having no initializer
  - overflow: Fix direct struct member initialization in _DEFINE_FLEX()
  - overflow: Change DEFINE_FLEX to take __counted_by member
  - overflow: add DEFINE_FLEX() for on-stack allocs
  - Bluetooth: MGMT: Fix possible UAFs
  - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete()
  - !21103  Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()"
  - !21104 v2  vsock/virtio: cap TX credit to local buffer size
  - !21070  Fixes CVE-2026-23100
  - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs
  - !21088  ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
  - RDMA/hns: Support configure and query the CNP DSCP through sysfs
  - RDMA/hns: Support query FW cap bit
  - RDMA/hns: Support query HW ID.
  - !20934  smb/server: fix refcount leak in parse_durable_handle_context()
  - !21004  regmap: Fix race condition in hwspinlock irqsave routine
  - !19568 [OLK-6.6]fix txgbe clang compile warning
  - urma: copy linked ports when importing bond jetty/seg
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  - sched/rt: Skip currently executing CPU in rto_next_cpu()
  - !21073  scsi: qla2xxx: Fix bsg_done() causing double free
  - !21114  CVE-2024-57979
  - !21113  iommu: disable SVA when CONFIG_X86 is set
  - !20957  dmaengine: xilinx: xdma: Fix regmap max_register
  - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset
  - pps: Fix a use-after-free - fix kabi
  - pps: Fix a use-after-free
  - !21078  of: unittest: Fix memory leak in unittest_data_add()
  - !21079  *** fix CVE-2026-23208 ***
  - !21082  ALSA: aloop: Fix racy access at PCM trigger
  - !21083  bus: fsl-mc: fix use-after-free in driver_override_show()
  - iommu: disable SVA when CONFIG_X86 is set
  - vsock/virtio: cap TX credit to local buffer size
  - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()"
  - !20983 Fix CVE-2026-23139
  - !20878 Fix CVE-2026-23230
  - kexec: derive purgatory entry from symbol
  - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
  - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
  - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"
  - rtc: interface: Alarm race handling should not discard preceding error
  - perf test stat tests: Fix for virtualized machines
  - perf test stat: Update test expectations and events
  - perf test stat: Avoid hybrid assumption when virtualized
  - writeback: Avoid excessively long inode switching times
  - writeback: Avoid softlockup when switching many inodes
  - cramfs: Verify inode mode when loading from disk
  - fs: Add 'initramfs_options' to set initramfs mount options
  - minixfs: Verify inode mode when loading from disk
  - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume
  - irqchip/sifive-plic: Make use of __assign_bit()
  - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled
  - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
  - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
  - s390/bpf: Describe the frame using a struct instead of constants
  - s390/bpf: Centralize frame offset calculations
  - s390/bpf: Change seen_reg to a mask
  - ACPI: property: Do not pass NULL handles to acpi_attach_data()
  - ACPI: property: Add code comments explaining what is going on
  - ACPI: property: Disregard references in data-only subnode lists
  - ACPI: battery: Add synchronization between interface updates
  - ACPI: battery: Check for error code from devm_mutex_init() call
  - ACPI: battery: initialize mutexes through devm_ APIs
  - ACPI: battery: allocate driver data through devm_ APIs
  - arm64: mte: Do not flag the zero page as PG_mte_tagged
  - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
  - !20790  dm: use bio_clone_blkg_association
  - ipmi: Add HiSilicon IPMI Page Soft Offline driver
  - net: unic: Resolve network unavailability caused by concurrent activation and reset
  - net: unic: Provide the DFX capability for querying MNG table
  - net: unic: Delete the elr reset process after the tx timeout
  - bus: fsl-mc: fix use-after-free in driver_override_show()
  - ALSA: aloop: Fix racy access at PCM trigger
  - ALSA: usb-audio: Use the right limit for PCM OOB check
  - ALSA: usb-audio: Prevent excessive number of frames
  - of: unittest: Fix memory leak in unittest_data_add()
  - !21034  CVE-2026-23140
  - !21016  net: fix segmentation of forwarding fraglist GRO
  - !21017  mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
  - !21018  CVE-2026-23209
  - !21019  ipv6: annotate data-race in ndisc_router_discovery()
  - !20881  ipvlan: Make the addrs_lock be per port
  - rme: Imporve range delegate
  - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
  - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release
  - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan()
  - misc: fastrpc: Save actual DMA size in fastrpc_map structure
  - misc: fastrpc: Add missing dev_err newlines
  - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
  - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
  - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
  - media: mc: Clear minor number before put device
  - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
  - ACPICA: Allow to skip Global Lock initialization
  - ext4: validate ea_ino and size in check_xattrs
  - ext4: correctly handle queries for metadata mappings
  - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
  - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
  - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
  - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
  - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0
  - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
  - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
  - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
  - selftests: mptcp: join: validate C-flag + def limit
  - spi: cadence-quadspi: Flush posted register writes before DAC access
  - spi: cadence-quadspi: Flush posted register writes before INDAC access
  - PCI: tegra194: Handle errors in BPMP response
  - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
  - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
  - PCI: rcar-host: Drop PMSR spinlock
  - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
  - PCI/AER: Support errors introduced by PCIe r6.0
  - PCI/AER: Fix missing uevent on recovery when a reset is requested
  - PCI/ERR: Fix uevent on failure to recover
  - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
  - PCI/sysfs: Ensure devices are powered for config reads
  - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock
  - rseq/selftests: Use weak symbol reference, not definition, to link with glibc
  - rtc: interface: Fix long-standing race when setting alarm
  - rtc: interface: Ensure alarm irq is enabled when UIE is enabled
  - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
  - mmc: core: SPI mode remove cmd7
  - mtd: rawnand: fsmc: Default to autodetect buswidth
  - xtensa: simdisk: add input size check in proc_write_simdisk
  - sparc: fix error handling in scan_one_device()
  - sparc64: fix hugetlb for sun4u
  - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
  - sched/deadline: Fix race in push_dl_task()
  - pwm: berlin: Fix wrong register in suspend/resume
  - powerpc/pseries/msi: Fix potential underflow and leak issue
  - powerpc/powernv/pci: Fix underflow and leak issue
  - power: supply: max77976_charger: fix constant current reporting
  - pinctrl: samsung: Drop unused S3C24xx driver data
  - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
  - parisc: don't reference obsolete termio struct for TC* constants
  - openat2: don't trigger automounts with RESOLVE_NO_XDEV
  - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify
  - lib/genalloc: fix device leak in of_gen_pool_get()
  - KEYS: trusted_tpm1: Compare HMAC values in constant time
  - iommu/vt-d: PRS isn't usable if PDS isn't supported
  - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
  - init: handle bootloader identifier in kernel parameters
  - iio: xilinx-ams: Unmask interrupts after updating alarms
  - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK
  - iio: frequency: adf4350: Fix prescaler usage.
  - iio: dac: ad5421: use int type to store negative error codes
  - iio: dac: ad5360: use int type to store negative error codes
  - fs/ntfs3: Fix a resource leak bug in wnd_extend()
  - fbdev: Fix logic error in "offb" name match
  - crypto: rockchip - Fix dma_unmap_sg() nents value
  - crypto: atmel - Fix dma_unmap_sg() direction
  - crypto: aspeed - Fix dma_unmap_sg() direction
  - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
  - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
  - bus: mhi: ep: Fix chained transfer handling in read path
  - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
  - blk-crypto: fix missing blktrace bio split events
  - drm/nouveau: fix bad ret code in nouveau_bo_move_prep
  - drm/rcar-du: dsi: Fix 1/2/3 lane support
  - media: lirc: Fix error handling in lirc_register()
  - media: venus: firmware: Use correct reset sequence for IRIS2
  - media: pci: ivtv: Add missing check after DMA map
  - media: mc: Fix MUST_CONNECT handling for pads with no links
  - media: i2c: mt9v111: fix incorrect type for ret
  - media: cx18: Add missing check after DMA map
  - firmware: meson_sm: fix device leak at probe
  - xen/events: Update virq_to_irq on migration
  - xen/events: Return -EEXIST for bound VIRQs
  - xen/manage: Fix suspend error path
  - xen/events: Cleanup find_virq() return codes
  - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
  - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
  - arm64: dts: ti: k3-am62a-main: Fix main padcfg length
  - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
  - arm64: dts: qcom: msm8939: Add missing MDSS reset
  - arm64: dts: qcom: msm8916: Add missing MDSS reset
  - ACPI: debug: fix signedness issues in read/write helpers
  - ACPI: property: Fix buffer properties extraction for subnodes
  - gpio: wcd934x: mark the GPIO controller as sleeping
  - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
  - smb: client: fix missing timestamp updates after utime(2)
  - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
  - drm/amd/display: Properly disable scaling on DCE6
  - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
  - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
  - drm/amdgpu: Add additional DCE6 SCL registers
  - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
  - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
  - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
  - perf python: split Clang options when invoking Popen
  - tools build: Align warning options with perf
  - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
  - drm/vmwgfx: Fix copy-paste typo in validation
  - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
  - LoongArch: Init acpi_gbl_use_global_lock to false
  - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init()
  - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
  - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
  - clk: tegra: do not overallocate memory for bpmp clocks
  - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
  - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
  - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags()
  - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
  - perf evsel: Ensure the fallback message is always written to
  - perf tools: Add fallback for exclude_guest
  - perf test: Add a test for default perf stat command
  - perf test: Don't leak workload gopipe in PERF_RECORD_*
  - perf session: Fix handling when buffer exceeds 2 GiB
  - perf arm_spe: Correct memory level for remote access
  - perf arm_spe: Correct setting remote access
  - rtc: optee: fix memory leak on driver removal
  - rtc: x1205: Fix Xicor X1205 vendor prefix
  - perf util: Fix compression checks returning -1 as bool
  - clk: at91: peripheral: fix return value
  - libperf event: Ensure tracing data is multiple of 8 sized
  - perf evsel: Avoid container_of on a NULL leader
  - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
  - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
  - clocksource/drivers/clps711x: Fix resource leaks in error paths
  - fscontext: do not consume log entries when returning -EMSGSIZE
  - fs: always return zero on success from replace_fd()
  - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches
  - scsi: qla2xxx: Fix bsg_done() causing double free
  - !21065 Fix CVE-2026-23069
  - !21062 v4  Support multi-level cgroup
  - !20987 Fix CVE-2026-23212
  - !20982 Fix CVE-2026-23119
  - !20979 Fix CVE-2026-23111
  - !20974 Fix CVE-2026-23099
  - !20973 Fix CVE-2026-23105
  - !20972 Fix CVE-2026-23074
  - !20884  ksmbd: add chann_lock to protect ksmbd_chann_list xarray
  - !20947 Fix CVE-2026-23101
  - ext4: clear i_state_flags when alloc inode
  - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
  - Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
  - fs/ntfs3: fix mount failure for sparse runs in run_unpack()
  - !20825  efivarfs: fix error propagation in efivar_entry_get()
  - !20824  io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem
  - mm/rmap: fix two comments related to huge_pmd_unshare()
  - mm/hugetlb: fix two comments related to huge_pmd_unshare()
  - mm/hugetlb: fix hugetlb_pmd_shared()
  - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
  - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers
  - vsock/virtio: fix potential underflow in virtio_transport_get_credit()
  - !21001 Fix CVE-2026-23229
  - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
  - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode
  - !20999 Fix CVE-2026-23173
  - usb: typec: tipd: Clear interrupts first
  - bus: fsl-mc: Check return value of platform_get_resource()
  - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()
  - Input: atmel_mxt_ts - allow reset GPIO to sleep
  - misc: fastrpc: Skip reference for DMA handles
  - misc: fastrpc: fix possible map leak in fastrpc_put_args
  - misc: fastrpc: Fix fastrpc_map_lookup operation
  - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
  - ext4: fix checks for orphan inodes
  - ksmbd: fix error code overwriting in smb2_get_info_filesystem()
  - LoongArch: Automatically disable kaslr if boot from kexec_file
  - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
  - mfd: rz-mtu3: Fix MTU5 NFCR register offset
  - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down
  - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
  - vhost: vringh: Modify the return value check
  - net/mlx5: fw reset, add reset timeout work
  - net/mlx5: pagealloc: Fix reclaim race during command interface teardown
  - net/mlx5: Stop polling for command response if interface goes down
  - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
  - nfp: fix RSS hash key size when RSS is not supported
  - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands
  - drivers/base/node: fix double free in register_one_node()
  - hwrng: ks-sa - fix division by zero in ks_sa_rng_init
  - KEYS: X.509: Fix Basic Constraints CA flag parsing
  - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
  - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
  - vhost: vringh: Fix copy_to_iter return value check
  - RDMA/siw: Always report immediate post SQ errors
  - usb: vhci-hcd: Prevent suspending virtually attached devices
  - NFSv4.1: fix backchannel max_resp_sz verification check
  - coresight: trbe: Return NULL pointer for allocation failures
  - coresight: etm4x: Support atclk
  - coresight-etm4x: Conditionally access register TRCEXTINSELR
  - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
  - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert()
  - vfio/pds: replace bitmap_free with vfree
  - sparc: fix accurate exception reporting in copy_{from,to}_user for M7
  - sparc: fix accurate exception reporting in copy_to_user for Niagara 4
  - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
  - wifi: mac80211: fix Rx packet handling when pubsta information is not available
  - wifi: ath10k: avoid unnecessary wait for service ready message
  - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
  - IB/sa: Fix sa_local_svc_timeout_ms read race
  - RDMA/core: Resolve MAC of next-hop device without ARP support
  - f2fs: fix zero-sized extent for precache extents
  - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
  - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
  - scsi: qla2xxx: edif: Fix incorrect sign of error code
  - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
  - f2fs: fix to truncate first page in error path of f2fs_truncate()
  - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
  - wifi: mt76: fix potential memory leak in mt76_wmac_probe()
  - RDMA/cm: Rate limit destroy CM ID timeout error message
  - drivers/base/node: handle error properly in register_one_node()
  - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
  - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
  - iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
  - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed()
  - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
  - fs: ntfs3: Fix integer overflow in run_unpack()
  - drm/msm/dpu: fix incorrect type for ret
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
  - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
  - misc: genwqe: Fix incorrect cmd field being reported in error
  - usb: gadget: configfs: Correctly set use_os_string at bind
  - usb: phy: twl6030: Fix incorrect type for ret
  - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
  - tcp: fix __tcp_close() to only send RST when required
  - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
  - wifi: mwifiex: send world regulatory domain to driver
  - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
  - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
  - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
  - drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
  - drm/amd/pm: Fix si_upload_smc_data (v3)
  - drm/amd/pm: Disable ULV even if unsupported (v3)
  - drm/amdgpu: Power up UVD 3 for FW validation (v2)
  - coresight: Only register perf symlink for sinks with alloc_buffer
  - inet: ping: check sock_net() in ping_get_port() and ping_lookup()
  - media: st-delta: avoid excessive stack usage
  - ALSA: lx_core: use int type to store negative error codes
  - media: rj54n1cb0c: Fix memleak in rj54n1_probe()
  - scsi: myrs: Fix dma_alloc_coherent() error check
  - hwrng: nomadik - add ARM_AMBA dependency
  - crypto: keembay - Add missing check after sg_nents_for_len()
  - drm/amd/display: Remove redundant semicolons
  - serial: max310x: Add error checking in probe()
  - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
  - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
  - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
  - media: zoran: Remove zoran_fh structure
  - drm/bridge: it6505: select REGMAP_I2C
  - f2fs: fix condition in __allow_reserved_blocks()
  - drm/radeon/r600_cs: clean up of dead code in r600_cs
  - drm/panel: novatek-nt35560: Fix invalid return value
  - bpf: Enforce expected_attach_type for tailcall compatibility
  - i2c: designware: Add disabling clocks when probe fails
  - i2c: designware: Fix clock issue when PM is disabled
  - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
  - thermal/drivers/qcom/lmh: Add missing IRQ includes
  - thermal/drivers/qcom: Make LMH select QCOM_SCM
  - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems
  - once: fix race by moving DO_ONCE to separate section
  - smp: Fix up and expand the smp_call_function_many() kerneldoc
  - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
  - i3c: master: svc: Recycle unused IBI slot
  - i3c: master: svc: Use manual response for IBI events
  - ACPICA: Fix largest possible resource descriptor index
  - pwm: tiehrpwm: Fix corner case in clock divisor calculation
  - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
  - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
  - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names
  - cpuidle: qcom-spm: fix device and OF node leaks at probe
  - firmware: firmware: meson-sm: fix compile-test default
  - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0
  - null_blk: Fix the description of the cache_size module argument
  - pinctrl: renesas: Use int type to store negative error codes
  - power: supply: cw2015: Fix a alignment coding style issue
  - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()
  - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property
  - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS
  - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax
  - block: use int to store blk_stack_limits() return value
  - selftests/nolibc: fix EXPECT_NZ macro
  - regulator: scmi: Use int type to store negative error codes
  - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
  - ARM: at91: pm: fix MCKx restore routine
  - pinctrl: meson-gxl: add missing i2c_d pinmux
  - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
  - leds: flash: leds-qcom-flash: Update torch current clamp setting
  - ARM: dts: renesas: porter: Fix CAN pin group
  - libbpf: Fix reuse of DEVMAP
  - bpf: Remove migrate_disable in kprobe_multi_link_prog_run
  - bpf/selftests: Fix test_tcpnotify_user
  - regmap: Remove superfluous check for !config in __regmap_init()
  - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
  - x86/vdso: Fix output operand size of RDPID
  - smb: server: fix IRD/ORD negotiation with the client
  - coresight: trbe: Prevent overflow in PERF_IDX2OFF()
  - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
  - selftests: arm64: Check fread return value in exec_target
  - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
  - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
  - filelock: add FL_RECLAIM to show_fl_flags() macro
  - !21022  KVM: Don't clobber irqfd routing type when deassigning irqfd
  - !20998  ceph: fix oops due to invalid pointer for kfree() in parse_longname()
  - !21023  l2tp: avoid one data-race in l2tp_tunnel_del_work()
  - xsched: fix potential NULL dereference in xsched_quota_timeout_update
  - xsched: remove the standalone xcu_cfs_cg_deinit() helper
  - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle
  - xsched: simplify root group check by direct comparison with root_xcg
  - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length
  - xsched/core: immediate cleanup of remaining operators on task exit
  - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization
  - xsched: modify xcu_cg_initialize_components helper
  - xsched: refactor xsched_entity initialization
  - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq
  - xsched: harden and clarify xcu_move_task() logic
  - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs
  - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling
  - xsched/quota: support multi-level cgroup
  - xsched: remove redundant xcu parameter from dequeue_ctx
  - xsched: update group shares using xcu_grp_shares_add/sub helpers
  - xsched: delete unused code
  - xsched/cfs: propagate group activation/deactivation up the hierarchy
  - xsched/cfs: move xruntime updates to pick/put paths
  - xsched: add has_running hook to xsched classes for wake-up eligibility check
  - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches
  - scsi: hisi_sas: Fix NULL pointer exception when do user_scan()
  - !21013  CVE-2026-23177
  - !21007  bonding: fix use-after-free due to enslave fail after slave array update
  - !21006  net: Fix CVE-2026-23204
  - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path
  - bpf, test_run: Subtract size of xdp_frame from allowed metadata size
  - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN
  - bpf: Make variables in bpf_prog_test_run_xdp less confusing
  - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K
  - !21015  libceph: reset sparse-read state in osd_fault()
  - !21024 ub: udma: bugfix related to print messages.
  - !20980 Fix CVE-2026-23126
  - !20922 Fix CVE-2026-23133
  - ub: udma: bugfix related to print messages.
  - l2tp: avoid one data-race in l2tp_tunnel_del_work()
  - KVM: Don't clobber irqfd routing type when deassigning irqfd
  - ipv6: annotate data-race in ndisc_router_discovery()
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path
  - macvlan: fix error recovery in macvlan_common_newlink()
  - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
  - net: fix segmentation of forwarding fraglist GRO
  - can: rcar_canfd: Fix CAN-FD mode as default
  - libceph: reset sparse-read state in osd_fault()
  - !21008 uvb: fix cis call return value and obtain
  - mm, shmem: prevent infinite loop on truncate race
  - mm/shmem, swap: fix race of truncate and swap entry split
  - net/9p: fix double req put in p9_fd_cancelled
  - riscv: mm: Do not restrict mmap address based on hint
  - riscv: mm: Use hint address in mmap if available
  - driver core/PM: Set power.no_callbacks along with power.no_pm
  - serial: stm32: allow selecting console when the driver is module
  - hid: fix I2C read buffer overflow in raw_event() for mcp2221
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
  - ALSA: usb-audio: Kill timer properly at removal
  - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list
  - can: rcar_canfd: Fix controller mode setting
  - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled
  - btrfs: ref-verify: handle damaged extent root tree
  - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
  - perf subcmd: avoid crash in exclude_cmds when excludes is empty
  - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list
  - dm-integrity: limit MAX_TAG_SIZE to 255
  - ASoC: amd: acp: Adjust pdm gain value
  - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
  - USB: serial: option: add SIMCom 8230C compositions
  - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
  - !20931 Fix CVE-2026-23060
  - uvb: fix cis call return value and obtain
  - bonding: fix use-after-free due to enslave fail after slave array update
  - net/sched: cls_u32: use skb_header_pointer_careful()
  - net: add skb_header_pointer_careful() helper
  - regmap: Fix race condition in hwspinlock irqsave routine
  - crypto: virtio - Add spinlock protection with virtqueue notification
  - net/mlx5e: TC, delete flows only for existing peers
  - !20967 net: hns3: modify code of judging if SMMU DMA is enabled
  - ceph: fix oops due to invalid pointer for kfree() in parse_longname()
  - !20969 Fix CVE-2026-23125
  - !20948 v4  arm64: Add memory poison recovery support for various paths
  - !20975  CVE-2026-23102
  - !20977 v4  support apei_page_offline_policy
  - bonding: annotate data-races around slave->last_rx
  - netfilter: nf_conncount: update last_gc only when GC has been performed
  - bonding: provide a net pointer to __skb_flow_dissect()
  - netdevsim: fix a race issue related to the operation on bpf_bound_progs list
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
  - apei/ghes: Add sysctl interface to control soft-offline page isolation
  - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages"
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
  - arm64/fpsimd: signal: Fix restoration of SVE context
  - arm64/fpsimd: signal: Consistently read FPSIMD context
  - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state
  - bonding: limit BOND_MODE_8023AD to Ethernet devices
  - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
  - net/sched: Enforce that teql can only be used as root qdisc
  - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
  - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers
  - net: hns3: modify code of judging if SMMU DMA is enabled
  - dmaengine: xilinx: xdma: Fix regmap max_register
  - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem
  - ub:ubus: Avoid getting empty uent from ubc
  - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory
  - arm64: send sig fault for user task when apei_claim_sea fails
  - arm64: add ras log during do_sea
  - arm64: move getting valid siaddr to the top of do_sea
  - arm64: mm: shmem: support poison recovery from shmem_file_read_iter()
  - arm64: fs: support poison recovery from __kernel_read()
  - iov_iter: add mc support for copy_page_to_iter
  - arm64: mm: support recovery from copy_{from/to}_user_page()
  - iov_iter: get rid of 'copy_mc' flag
  - leds: led-class: Only Add LED to leds_list when it is fully ready
  - wifi: ath10k: fix dma_free_coherent() pointer
  - smb/server: fix refcount leak in parse_durable_handle_context()
  - ksmbd: add chann_lock to protect ksmbd_chann_list xarray
  - ipvlan: Make the addrs_lock be per port
  - smb: client: split cached_fid bitfields to avoid shared-byte RMW races
  - efivarfs: fix error propagation in efivar_entry_get()
  - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  - dm: use bio_clone_blkg_association
  - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor
  - net: txgbe: fix clang compile warning


author: Li Nan <linan122@huawei.com> - 6.6.0-143.0.0.137
changelog:
  - !21258 ub:hisi-ubus: Review of Readability Modifications
  - !21293 urma: update urma_admin agg expose flag
  - urma: update urma_admin agg expose
  - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches
  - !21270  l2tp: fix double dst_release() on sk_dst_cache race
  - !21272  mptcp: fix soft lockup in mptcp_recvmsg()
  - !20994 urma: support comm endpoint
  - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo'
  - !21271 urma: fix useless copy_logic_device and use expose instead.
  - urma: support non-root execute in containers
  - urma: fix useless copy_logic_device and use expose instead.
  - ub:hisi-ubus: Review of Readability Modifications
  - mptcp: fix soft lockup in mptcp_recvmsg()
  - mptcp: fix MSG_PEEK stream corruption
  - l2tp: fix double dst_release() on sk_dst_cache race
  - urma: update urma_admin agg expose
  - !21252  arm64: Set __nocfi on swsusp_arch_resume()
  - !21226 hisi-cca-da: Fix potential data overflow.
  - !19706 [OLK-6.6]:update patches for sw64 architecture
  - !21253  xattr: switch to CLASS(fd)
  - !21255 ub: cdma: cdma bug fix
  - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq
  - ub: cdma: cdma bug fix
  - xattr: switch to CLASS(fd)
  - arm64: Set __nocfi on swsusp_arch_resume()
  - hisi-cca-da: Fix error where multiple devices share the same SMMU domain.
  - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq
  - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist
  - !21237 urma: change warn log into info for topo query
  - hisi-cca-da: Fix potential data overflow.
  - !21210 urma: fix tjetty tp type in ping server
  - !21224  arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc()
  - !21240 urma: update urma_admin agg expose
  - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS
  - urma: update urma_admin agg expose
  - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS
  - !21238 urma: delete ubcm_genl implementation
  - urma: delete ubcm_genl implementation
  - urma: change warn log into info for topo query
  - tcpm: allow looking for role_sw device in the main node
  - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
  - most: usb: fix double free on late probe failure
  - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
  - net: enetc: fix build warning when PAGE_SIZE is greater than 128K
  - gpio: ljca: Initialize num before accessing item in ljca_gpio_config
  - s390/cio: Update purge function to unregister the unused subchannels
  - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
  - xfs: always warn about deprecated mount options
  - devcoredump: Fix circular locking dependency with devcd->mutex.
  - serial: 8250_mtk: Enable baud clock and manage in runtime PM
  - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018
  - serial: 8250_dw: handle reset control deassert error
  - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
  - tcpm: switch check for role_sw device with fw_node
  - most: usb: hdm_probe: Fix calling put_device() before device initialization
  - most: usb: Fix use-after-free in hdm_disconnect
  - mei: me: add wildcat lake P DID
  - comedi: fix divide-by-zero in comedi_buf_munge()
  - binder: remove "invalid inc weak" check
  - x86/microcode: Fix Entrysign revision check for Zen1/Naples
  - xhci: dbc: enable back DbC in resume if it was enabled before suspend
  - usb: raw-gadget: do not limit transfer length
  - usb/core/quirks: Add Huawei ME906S to wakeup quirk
  - USB: serial: option: add Telit FN920C04 ECM compositions
  - USB: serial: option: add Quectel RG255C
  - USB: serial: option: add UNISOC UIS7720
  - sched: Remove never used code in mm_cid_get()
  - io_uring: correct __must_hold annotation in io_install_fixed_file
  - gpio: ljca: Fix duplicated IRQ mapping
  - gpio: update Intel LJCA USB GPIO driver
  - hwmon: (sht3x) Fix error handling
  - RISC-V: Don't print details of CPUs disabled in DT
  - RISC-V: Define pgprot_dmacoherent() for non-coherent devices
  - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode
  - spi: spi-nxp-fspi: add extra delay after dll locked
  - selftests: mptcp: join: mark implicit tests as skipped if not supported
  - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported
  - net: ravb: Ensure memory write completes before ringing TX doorbell
  - net: ravb: Enforce descriptor type ordering
  - net: usb: rtl8150: Fix frame padding
  - net: stmmac: dwmac-rk: Fix disabling set_clock_selection
  - ocfs2: clear extent cache after moving/defragmenting extents
  - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
  - cifs: Fix TCP_Server_Info::credits to be signed
  - gpio: 104-idio-16: Define maximum valid register address offset
  - gpio: pci-idio-16: Define maximum valid register address offset
  - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
  - net: bonding: fix possible peer notify event loss or dup issue
  - arm64, mm: avoid always making PTE dirty in pte_mkwrite()
  - !21236  Fix TLBI broadcast optimization loss and incorrect dvmbm handling
  - KVM: arm64: Fix CCA guest panic when dvmbm is enabled
  - !21228 ub:ubus: add reset function
  - !21220  selftests/bpf: Add cross-build support for urandom_read et al
  - !21214  optimize lightweight load balancing
  - ub:ubus: add reset function
  - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios
  - !21221 iommu/ummu: Modify the ummu/tid permission
  - selftests: net: fix server bind failure in sctp_vrf.sh
  - selftests/net: convert sctp_vrf.sh to run it in unique namespace
  - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb()
  - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
  - net: enetc: correct the value of ENETC_RXB_TRUESIZE
  - net: enetc: fix the deadlock of enetc_mdio_lock
  - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush().
  - rtnetlink: Allow deleting FDB entries in user namespace
  - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size()
  - Unbreak 'make tools/*' for user-space targets
  - smb: server: let smb_direct_flush_send_list() invalidate a remote key first
  - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure
  - m68k: bitops: Fix find_*_bit() signatures
  - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure
  - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
  - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
  - dlm: check for defined force value in dlm_lockspace_release
  - hfs: validate record offset in hfsplus_bmap_alloc
  - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
  - hfs: make proper initalization of struct hfs_find_data
  - hfs: clear offset and space out of valid records in b-tree node
  - nios2: ensure that memblock.current_limit is set when setting pfn limits
  - exec: Fix incorrect type for ret
  - !21222 ub: ubase: Added the interface for obtaining hardware version information
  - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing
  - !21216  Fix RT priority Setting
  - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc()
  - iommu/ummu: Modify the ummu/tid permission
  - ub: ubase&unic: Optimize the code for log information
  - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long
  - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset
  - ub:ub_fwctl:Add a mutex lock
  - ub:ub_fwctl:Add interception and validation for unsupported environment commands
  - ub: ubase: Added the interface for obtaining hardware version information.
  - selftests/bpf: Add cross-build support for urandom_read et al
  - !21217  Revert "drivers: core: synchronize really_probe() and dev_uevent()"
  - !21205  arm64/mpam: Fix wrong closid config access when CDP is enabled
  - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches
  - Revert "drivers: core: synchronize really_probe() and dev_uevent()"
  - !21213 ub:ubus: alter nl ssu credit ras recover
  - iommu/ummu: Optimize the duplicate code
  - xsched: initialize tgid before configuring RT priority
  - xsched: fix typo in xcu cgroup subsys released callback name
  - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness
  - sched: expand sysctl_sched_features to unsigned long
  - sched: Fix kabi breakage of struct sched_domain for newidle_stats
  - sched/fair: Proportional newidle balance
  - ub:ubus: alter nl ssu credit ras recover
  - ub:ubus add some missing code to openeuler
  - change bus instance create EID_BYPASS
  - urma: fix tjetty tp type in ping server
  - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info'
  - iommu/ummu: Delete the unused interface of the UMMU
  - arm64/mpam: Fix wrong closid config access when CDP is enabled
  - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled"
  - iommu/ummu: Remove the constraint that l_tid must be valid
  - iommu/ummu: Remove redundant read register operations
  - iommu/ummu: Optimize the UMMU instance matching logic
  - iommu/ummu: Improve the reliability of ummu initialization
  - iommu/ummu: Modify parameter for separated page table
  - drm/amd: Fix suspend failure with secure display TA
  - PCI: tegra194: Reset BARs when running in PCIe endpoint mode
  - PCI: j721e: Fix programming sequence of "strap" settings
  - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists
  - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL
  - PCI/sysfs: Ensure devices are powered for config reads (part 2)
  - nfsd: decouple the xprtsec policy check from check_nfsd_access()
  - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine
  - xfs: use deferred intent items for reaping crosslinked blocks
  - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
  - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure
  - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling
  - phy: cdns-dphy: Store hs_clk_rate and return it
  - iio: imu: inv_icm42600: Simplify pm_runtime setup
  - PM: runtime: Add new devm functions
  - xfs: fix log CRC mismatches between i386 and other architectures
  - xfs: rename the old_crc variable in xlog_recover_process
  - NFSD: Fix last write offset handling in layoutcommit
  - NFSD: Minor cleanup in layoutcommit processing
  - NFSD: Rework encoding and decoding of nfsd4_deviceid
  - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
  - block: fix race between set_blocksize and read paths
  - arm64: errata: Apply workarounds for Neoverse-V3AE
  - arm64: cputype: Add Neoverse-V3AE definitions
  - selftests: arg_parsing: Ensure data is flushed to disk before reading.
  - HID: multitouch: fix name of Stylus input devices
  - HID: hid-input: only ignore 0 battery events for digitizers
  - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
  - selftests/bpf: make arg_parsing.c more robust to crashes
  - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
  - drm/rockchip: vop2: use correct destination rectangle height check
  - drm/amd/powerplay: Fix CIK shutdown temperature
  - drm/i915/guc: Skip communication warning on reset in progress
  - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
  - ASoC: nau8821: Generalize helper to clear IRQ status
  - ASoC: nau8821: Cancel jdet_work before handling jack ejection
  - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec
  - drm/bridge: lt9211: Drop check for last nibble of version register
  - riscv: kprobes: Fix probe address validation
  - nvme-multipath: Skip nr_active increments in RETRY disposition
  - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset
  - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
  - tls: don't rely on tx_work during send()
  - tls: always set record_type in tls_process_cmsg
  - tls: wait for async encrypt in case of error during latter iterations of sendmsg
  - net: tls: wait for async completion on last message
  - tls: trim encrypted message to match the plaintext on short splice
  - tg3: prevent use of uninitialized remote_adv and local_adv variables
  - tcp: fix tcp_tso_should_defer() vs large RTT
  - amd-xgbe: Avoid spurious link down messages during interface toggle
  - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
  - doc: fix seg6_flowlabel path
  - net: dlink: handle dma_map_single() failure properly
  - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
  - dax: skip read lock assertion for read-only filesystems
  - HID: multitouch: fix sticky fingers
  - usb: gadget: f_rndis: Refactor bind path to use __free()
  - usb: gadget: f_ncm: Refactor bind path to use __free()
  - usb: gadget: f_acm: Refactor bind path to use __free()
  - usb: gadget: f_ecm: Refactor bind path to use __free()
  - usb: gadget: Introduce free_usb_request helper
  - usb: gadget: Store endpoint pointer in usb_request
  - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release
  - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain()
  - drm/exynos: exynos7_drm_decon: remove ctx->suspended
  - drm/exynos: exynos7_drm_decon: properly clear channels during bind
  - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions
  - drm/msm/a6xx: Fix PDC sleep sequence
  - drm/msm/adreno: De-spaghettify the use of memory barriers
  - eventpoll: Replace rwlock with spinlock
  - epoll: Remove ep_scan_ready_list() in comments
  - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
  - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
  - drm/amd: Check whether secure display TA loaded successfully
  - drm/amdgpu: use atomic functions with memory barriers for vm fault info
  - cifs: parse_dfs_referrals: prevent oob on malformed input
  - can: gs_usb: increase max interface to U8_MAX
  - can: gs_usb: gs_make_candev(): populate net_device->dev_port
  - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running
  - ext4: wait for ongoing I/O to complete before freeing blocks
  - jbd2: ensure that all ongoing I/O complete before freeing blocks
  - f2fs: fix wrong block mapping for multi-devices
  - r8152: add error handling in rtl8152_driver_init
  - sw64: ebpf: port arch_prepare_bpf_trampoline()
  - sw64: fix random mmap base range
  - sw64: paravirt: add pv steal_time support in guest side
  - sw64: kvm: add pv steal time support
  - sw64: pci: remove redundant debug control


author: Li Nan <linan122@huawei.com> - 6.6.0-144.0.0.139
changelog:
  - !21367 ub: udma: bugfix related to jfr id.
  - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot
  - !21357 urma: fix add obj type compile error
  - ub: udma: bugfix related to jfr id.
  - urma: fix add obj type compile error
  - ub: ubase: optimized reboot time required
  - !21350 urma: add obj type in ubcore delete uobj error
  - !21343 urma: support ubp methods
  - !21351  arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled
  - urma: support ubp methods;
  - !21320 urma: decrease session creation max timeout
  - !21323 urma: tp reuse in RC transmode
  - !21319 urma: remove legacy bonding dev create/delete
  - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces
  - ub: ubase: Improving the reliability of CtrlQ.
  - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled
  - urma: add obj type in ubcore delete uobj error
  - urma: Kernel-mode file for tp reuse in RC transmode
  - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam.
  - ub:ubfi: Delete device load debug logs
  - iommu/ummu-core: Fix kref imbalance in VMA split scenario
  - iommu/ummu-core: Prevent FREE_TID while mmap is active
  - iommu/ummu: Add deprecation markers for ummu SVA APIs
  - !21324 mfs: fix mfsd_prefetch.cpp compile error
  - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE
  - !20936 gmem: fix several issues
  - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy
  - !21333 v4  hugetlb: drain pcp for movable zone before alloc
  - drivers/ub/sentry: set the priority
  - hugetlb: drain pcp for movable zone before alloc
  - !21325  mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb
  - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true
  - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference
  - gmem: hold mmap_read lock while executing gmem_unmap_region
  - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm()
  - gmem: fix hmemcpy src/dest conflict deadlock under concurrency
  - gmem: fix NULL ptr deference in vm_object_merge
  - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb
  - mfs: fix mfsd_prefetch.cpp compile error
  - !21310 CCA: Add the RSI interface for obtaining the device certificate.
  - urma: remove legacy bonding dev create/delete
  - urma: Decrease session creation max timeout
  - !21316 ub: udma: Move the request for RC context from UDMA to UBASE
  - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE
  - ub: ubase: Move the request for RC context from UDMA to UBASE
  - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode
  - !21302 [OLK-6.6]:update patches for sw64 architecture
  - ub: udma: bugfix related to deactivate tp.
  - ub: udma: bugfix related to jetty group.
  - !21311  mm/shrinker: Implementation of register_shrinker() and unregister_shrinker()
  - !21312 urma: support remove ubagg & uburma ko
  - !21223 kvm: add skip vmovp feature support
  - CCA: Add the RSI interface for obtaining the device certificate.
  - urma: support remove ubagg & uburma ko
  - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group
  - !21276 ub/ubdevshm: Fix some issues
  - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches
  - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations
  - ub/ubmem-mmu: Fix some issues
  - ub/ubmempfd: Add module author
  - ub/ubdevshm: Fix some issues
  - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker()
  - gpio: regmap: Fix memleak in error path in gpio_regmap_register()
  - perf: sched: Fix perf crash with new is_user_task() helper
  - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times
  - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports
  - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection
  - net: unic: correct DMA direction for TX path
  - net: unic: Fix the bug that could cause nconsistent resource state or double-free
  - net: unic: optimize MAC address deletion to avoid sleeping in spinlock
  - ub: ubase: Resolve integer wraparound
  - ub: ubase: Resolve cache coherence and set smp_rmb
  - ub: ubase&unic: adjust the encoding format of the ubase&unic driver.
  - ub: ubase: Support udma get ue msg info.
  - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver.
  - ub: ubase: The debugfs function supports querying the Ethernet port rate.
  - sw64: adapt arch_tlbbatch_add_pending according to upstream
  - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled
  - sw64: add support for batched TLB flushing during unmap
  - sw64: fix the parameter passing logic of memblock_mark_nomap
  - sw64: add HUGE_VMAP support for c4
  - sw64: define get_cycles macro
  - sw64: cpuidle: refine C6 state stability
  - sw64: add barriers and tlb flush for set_atc
  - sw64: adapt kernel page table for kdump
  - sw64: adapt kernel page table for memory hotplug
  - sw64: set PTBR_SYS before accessing vmalloc area
  - sw64: set execute permission for virtual machine's hmcode text section
  - sw64: adjust the marking and definitions of some kernel mapping functions
  - sw64: adapt kernel page table for S4
  - sw64: fix an inappropriate lock in __set_memory
  - sw64: enable kernel page table
  - sw64: use ioremap to map IO address in functions like __get_cpu_nums()
  - sw64: move non-boot core's kernel page table enabling logic to hmcode
  - sw64: use ioremap to map IO address
  - sw64: map legacy I/O to K segment
  - sw64: setup early_ioremap
  - sw64: reset ATC for kvm
  - sw64: setup mapping for efi_mm
  - sw64: set protection for kernel page table
  - sw64: modify codes with fixmap
  - sw64: map the early and the final page table
  - sw64: add fixmap support
  - sw64: fix mmap_base exceeding Java assertion address
  - sw64: add memb before/after atomic
  - sw64: add EDAC support with dynamic node and MC detection
  - sw64: fix: getcpu passed a null pointer error
  - sw64: iommu: refactor iommu v2 initialization
  - sw64: cache: fix shared_cpu_map when PPTT is invalid
  - sw64: add alternative runtime patching
  - sw64: pci: fix IO_BASE if numa_off
  - sw64: use ioremap to map spaces for cpufreq and S3
  - sw64: pci: add sunway pci controller for Command Completed errata
  - sw64: add definitions for kernel-required CPU capabilities
  - sw64: kvm: add qemu-gdb watchpoint support
  - sw64: kvm: fix srcu lock leak in pv steal time
  - gpio: idio-16: Define fixed direction of the GPIO lines
  - gpio: regmap: add the .fixed_direction_output configuration parameter
  - gpio: regmap: Allow to allocate regmap-irq device
  - bits: introduce fixed-type GENMASK_U*()
  - bits: add comments and newlines to #if, #else and #endif directives
  - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event
  - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.
  - xhci: dbc: Improve performance by removing delay in transfer event polling.
  - xhci: dbc: Allow users to modify DbC poll interval via sysfs
  - xhci: dbc: poll at different rate depending on data transfer activity
  - serial: sc16is7xx: reorder code to remove prototype declarations
  - serial: sc16is7xx: remove unused to_sc16is7xx_port macro
  - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported
  - selftests: mptcp: disable add_addr retrans in endpoint_tests
  - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
  - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
  - btrfs: use level argument in log tree walk callback replay_one_buffer()
  - btrfs: always drop log root tree reference in btrfs_replay_log()
  - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io()
  - btrfs: zoned: refine extent allocator hint selection
  - btrfs: zoned: return error from btrfs_zone_finish_endio()
  - EDAC/mc_sysfs: Increase legacy channel support to 16
  - x86/bugs: Fix reporting of LFENCE retpoline
  - x86/bugs: Report correct retbleed mitigation status
  - perf: Skip user unwind if the task is a kernel thread
  - perf: Have get_perf_callchain() return NULL if crosstask and user are set
  - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL
  - audit: record fanotify event regardless of presence of rules
  - sched/topology,x86: Fix build warning
  - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode
  - sched: Create architecture specific sched domain distances


author: Li Nan <linan122@huawei.com> - 6.6.0-145.0.0.140
changelog:
  - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty
  - urma: Kernel-mode file for bugfix of kerf of tjetty
  - !21456  time/jiffies: Mark jiffies_64_to_clock_t() notrace
  - !21393 Fix CVE-2026-23268
  - !21446  i40e: Fix preempt count leak in napi poll tracepoint
  - !21441  ext4: fix generic/363 failure in iomap buffered I/O mode
  - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes
  - !21450 Fix CVE-2026-23317
  - !21429 urma: add workqueue for well_know_jetty
  - !21439 urma: userctl fuction about fix mode.
  - !21458 urma: adjust log level to info for get_dev_name
  - !21425 urma: fix the double free issue of import_cb
  - !21408 urma: ipourma default sl configuration
  - urma: usrctrl function about fix mode.
  - urma: adjust log level to info for get_dev_name
  - !21436  bpf: Release module BTF IDR before module unload
  - !21440 v2  CVE-2026-23319
  - !21438  bpf: Fix stack-out-of-bounds write in devmap
  - time/jiffies: Mark jiffies_64_to_clock_t() notrace
  - !21426  RDMA/umad: Reject negative data_len in ib_umad_write
  - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
  - !21421 v3  CVE-2026-23352
  - !21380  perf: HiSilicon: Support uncore ITS PMU
  - !21379  drivers/perf: hisi: Add new function for HiSilicon MN PMU driver
  - !21391  quota: fix livelock between quotactl and freeze_super
  - !21390  ext4: fix dirtyclusters double decrement on fs shutdown
  - !21389  fat: avoid parent link count underflow in rmdir
  - !21388  ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
  - !21387  ext4: fix memory leak in ext4_ext_shift_extents()
  - !21386  blktrace: fix __this_cpu_read/write in preemptible context
  - !21434 Fix CVE-2026-23388
  - i40e: Fix preempt count leak in napi poll tracepoint
  - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed
  - urma: add workqueue for well_know_jetty
  - ext4: zero post EOF partial block before iomap appending write
  - ext4: move pagecache_isize_extended() out of active handle
  - ext4: remove ctime/mtime update from ext4_alloc_file_blocks()
  - ext4: unify SYNC mode checks in fallocate paths
  - ext4: ensure zeroed partial blocks are persisted in SYNC mode
  - ext4: move zero partial block range functions out of active handle
  - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks()
  - ext4: remove handle parameters from zero partial block functions
  - ext4: move ordered data handling out of ext4_block_do_zero_range()
  - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range()
  - ext4: factor out journalled block zeroing range
  - ext4: rename and extend ext4_block_truncate_page()
  - iomap: make zero range flush conditional on unwritten mappings
  - iomap: fix handling of dirty folios over unwritten extents
  - ub/obmm: minor bugfixes
  - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
  - bpf: export bpf_link_inc_not_zero.
  - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs
  - crypto: hisilicon/qm - support querying the hardware fault status through VFs
  - urma: ipourma default sl configuration
  - bpf: Fix stack-out-of-bounds write in devmap
  - bpf: Release module BTF IDR before module unload
  - Squashfs: check metadata block offset is within range
  - !21346 Revert "net: hns3: add sync command to sync io-pgtable"
  - !21372  nvme: fix memory allocation in nvme_pr_read_keys()
  - apparmor: fix unprivileged local user can do privileged policy management
  - !21423  nvme: fix admin queue leak on controller reset
  - !21422  scsi: target: Fix recursive locking in __configfs_open_file()
  - RDMA/umad: Reject negative data_len in ib_umad_write
  - !21402  CVE-2026-23296
  - !21403  fix queue start/stop imbalance under race
  - urma: fix the double free issue of bind_cb
  - nvme: fix admin queue leak on controller reset
  - scsi: target: Fix recursive locking in __configfs_open_file()
  - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
  - x86/efi: defer freeing of boot services memory
  - !21405 Fix CVE-2025-71239
  - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0
  - !21410 urma: disallow user-mode calls for some ubagg userctl ops
  - !21371 urma: remote all logic device when set dev ns
  - urma: disallow user-mode calls for some ubagg userctl ops
  - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes
  - drivers/ub/sentry: skip memory_failure if pfn is 0x0
  - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches
  - audit: add fchmodat2() to change attributes class
  - urma: remote all logic device when set dev ns
  - !21348 uvb: support communication in VM
  - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM
  - dm: fix queue start/stop imbalance under remove/resume races
  - dm: fix queue start/stop imbalance under suspend/load/resume races
  - scsi: core: Fix error handling for scsi_alloc_sdev()
  - scsi: core: Fix refcount leak for tagset_refcnt
  - uvb: support communication in VM
  - !21313  bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
  - !21334  prevent SEA storms on critical RAS
  - !21375 urma: Kernel-mode file for tp reuse in RC transmode
  - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state
  - quota: fix livelock between quotactl and freeze_super
  - ext4: fix dirtyclusters double decrement on fs shutdown
  - fat: avoid parent link count underflow in rmdir
  - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
  - ext4: fix memory leak in ext4_ext_shift_extents()
  - blktrace: fix __this_cpu_read/write in preemptible context
  - !21354  media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  - perf: HiSilicon: Support uncore ITS PMU
  - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver
  - net/ipv4:scmtcp: fix no dmi_uuid in VM
  - !21355  perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
  - !21249  arm64/xcall: add research papers reference in file headers
  - !21322  nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
  - !21369 drivers/ub/sentry: add some log for event report
  - mm/filemap: restrict pagecache to non-cpuless NUMA nodes
  - mm/mempolicy: add mpol_update_interleave_stats() helper
  - !21328 genirq: Get rid of global lock in irq_do_set_affinity()
  - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - nvme: fix memory allocation in nvme_pr_read_keys()
  - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter
  - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization"
  - drivers/ub/sentry: add some log for event report
  - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
  - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  - iommu: Revert to using .domain_alloc_user without kvm parameter
  - Revert "net: hns3: add sync command to sync io-pgtable"
  - regulator: fixed: Rely on the core freeing the enable GPIO
  - net/mlx5e: Fix validation logic in rate limiting
  - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling
  - ntfs3: init run lock for extend inode
  - scsi: ufs: host: mediatek: Require CONFIG_PM
  - wifi: rtw88: limit indirect IO under powered off for RTL8822CS
  - pinctrl: keembay: fix double free in keembay_build_functions()
  - block: fix comment for op_is_zone_mgmt() to include RESET_ALL
  - mptcp: schedule rtx timer only after pushing data
  - ACPI: HMAT: Remove register of memory node for generic target
  - mm/memory-tier: fix abstract distance calculation overflow
  - mm/truncate: unmap large folio on split failure
  - mm: memcg: change flush_next_time to flush_last_time
  - mm: memcg: add per-memcg zswap writeback stat
  - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL
  - scsi: ufs: core: Add a quirk to suppress link_startup_again
  - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register
  - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT
  - scsi: ufs: core: Add fill_crypto_prdt variant op
  - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE
  - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller
  - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE
  - f2fs: fix to avoid overflow while left shift operation
  - mm, percpu: do not consider sleepable allocations atomic
  - iommufd: Don't overflow during division for dirty tracking
  - btrfs: ensure no dirty metadata is written back for an fs with errors
  - Revert "perf dso: Add missed dso__put to dso__load_kcore"
  - selftests: mptcp: connect: trunc: read all recv data
  - selftests: mptcp: join: rm: set backup flag
  - selftests: mptcp: connect: fix fallback note due to OoO
  - pmdomain: samsung: plug potential memleak during probe
  - btrfs: do not update last_log_commit when logging inode due to a new name
  - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe()
  - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
  - EDAC/altera: Handle OCRAM ECC enable after warm reset
  - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY
  - selftests/user_events: fix type cast for write_index packed member in perf_test
  - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
  - spi: Try to get ACPI GPIO IRQ earlier
  - smb: client: fix cifs_pick_channel when channel needs reconnect
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
  - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
  - mm/mm_init: fix hash table order logging in alloc_large_system_hash()
  - wifi: mac80211: reject address change while connecting
  - selftests/tracing: Run sample events to clear page cache events
  - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY
  - LoongArch: Use correct accessor to read FWPC/MWPC
  - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
  - strparser: Fix signed/unsigned mismatch bug
  - ksmbd: close accepted socket when per-IP limit rejects connection
  - gcov: add support for GCC 15
  - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
  - HID: uclogic: Fix potential memory leak in error path
  - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY
  - HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
  - ARM: dts: imx51-zii-rdu1: Fix audmux node names
  - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1
  - mtd: onenand: Pass correct pointer to IRQ handler
  - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
  - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
  - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops
  - acpi/hmat: Fix lockdep warning for hmem_register_resource()
  - base/node / ACPI: Enumerate node access class for 'struct access_coordinate'
  - acpi: numa: Add setting of generic port system locality attributes
  - acpi: Break out nesting for hmat_parse_locality()
  - acpi: numa: Add genport target allocation to the HMAT parsing
  - acpi: numa: Create enum for memory_target access coordinates indexing
  - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates'
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
  - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
  - NFS: sysfs: fix leak when nfs_client kobject add fails
  - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
  - NFS: enable nconnect for RDMA
  - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
  - ASoC: tas2781: fix getting the wrong device number
  - ASoC: codecs: va-macro: fix resource leak in probe error path
  - ASoC: cs4271: Fix regulator leak on probe failure
  - regulator: fixed: fix GPIO descriptor leak on register failure
  - acpi,srat: Fix incorrect device handle check for Generic Initiator
  - cifs: Fix uncached read into ITER_KVEC iterator
  - cifs: stop writeback extension when change of size is detected
  - Bluetooth: L2CAP: export l2cap_chan_hold for modules
  - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
  - ACPI: CPPC: Check _CPC validity for only the online CPUs
  - hsr: Fix supervision frame sending on HSRv0
  - virtio-net: fix incorrect flags recording in big mode
  - net_sched: limit try_bulk_dequeue_skb() batches
  - net/mlx5e: Fix potentially misleading debug message
  - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
  - net/mlx5e: Fix maxrate wraparound in threshold between units
  - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
  - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
  - net_sched: act_connmark: use RCU in tcf_connmark_dump()
  - wifi: mac80211: skip rate verification for not captured PSDUs
  - net: mdio: fix resource leak in mdiobus_register_device()
  - net/handshake: Fix memory leak in tls_handshake_accept()
  - net/smc: fix mismatch between CLC header and proposal
  - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
  - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
  - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
  - net: fec: correct rx_bytes statistic for the case SHIFT16 is set
  - selftests: net: local_termination: Wait for interfaces to come up
  - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
  - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
  - smb/server: fix possible refcount leak in smb2_sess_setup()
  - smb/server: fix possible memory leak in smb2_read()
  - NFS: check if suid/sgid was cleared after a write as needed
  - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
  - NFS4: Fix state renewals missing after boot
  - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
  - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
  - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used
  - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors
  - compiler_types: Move unused static inline functions warning to W=2
  - iommufd: Make vfio_compat's unmap succeed if the range is already empty
  - smb: client: fix refcount leak in smb2_set_path_attr
  - drm/i915: Fix conversion between clock ticks and nanoseconds
  - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
  - selftests: netdevsim: set test timeout to 10 minutes
  - riscv: stacktrace: fix backtracing through exceptions
  - drm/amd/display: Fix black screen with HDMI outputs
  - drm/amdgpu: Fix function header names in amdgpu_connectors.c
  - extcon: adc-jack: Cleanup wakeup source only if it was enabled
  - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
  - x86/microcode/AMD: Add more known models to entry sign checking
  - drm/amd/display: Enable mst when it's detected but yet to be initialized
  - net: bridge: fix MST static key usage
  - lan966x: Fix sleeping in atomic context
  - net: dsa: microchip: Fix reserved multicast address table programming
  - net/mlx5e: SHAMPO, Fix skb size check for 64K pages
  - net/mlx5e: Fix return value in case of module EEPROM read error
  - net/mlx5e: Use extack in get module eeprom by page callback
  - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup
  - net: dsa: b53: stop reading ARL entries if search is done
  - net: dsa: b53: fix enabling ip multicast
  - net: dsa: b53: fix resetting speed and pause on forced link
  - net: vlan: sync VLAN features with lower device
  - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh
  - netdevsim: add Makefile for selftests
  - selftests/net: use destination options instead of hop-by-hop
  - selftests/net: fix GRO coalesce test and add ext header coalesce tests
  - selftests/net: fix out-of-order delivery of FIN in gro:tcp test
  - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx
  - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
  - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro
  - riscv: stacktrace: Disable KASAN checks for non-current tasks
  - riscv: Improve exception and system call latency
  - net: libwx: fix device bus LAN ID
  - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
  - ceph: refactor wake_up_bit() pattern of calling
  - ceph: add checking of wait_for_completion_killable() return value
  - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
  - kbuild: uapi: Strip comments before size type check
  - rtc: pcf2127: fix watchdog interrupt mask on pcf2131
  - tools: lib: thermal: use pkg-config to locate libnl3
  - tools: lib: thermal: don't preserve owner in install
  - tools bitmap: Add missing asm-generic/bitsperlong.h include
  - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
  - 9p: sysfs_init: don't hardcode error to ENOMEM
  - cpufreq: tegra186: Initialize all cores to max frequencies
  - 9p: fix /sys/fs/9p/caches overwriting itself
  - NTB: epf: Allow arbitrary BAR mapping
  - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
  - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register
  - clk: at91: clk-master: Add check for divide by 3
  - ARM: at91: pm: save and restore ACR during PLL disable/enable
  - rtc: pcf2127: clear minute/second interrupt
  - clk: sunxi-ng: sun6i-rtc: Add A523 specifics
  - um: Fix help message for ssl-non-raw
  - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
  - btrfs: mark dirty extent range for out of bound prealloc extents
  - RDMA/irdma: Set irdma_cq cq_num field during CQ create
  - RDMA/irdma: Remove unused struct irdma_cq fields
  - RDMA/irdma: Fix SD index calculation
  - ACPICA: Update dsmethod.c to get rid of unused variable warning
  - char: misc: restrict the dynamic range to exclude reserved minors
  - smb: client: transport: avoid reconnects triggered by pending task work
  - ksmbd: use sock_create_kern interface to create kernel socket
  - orangefs: fix xattr related buffer overflow...
  - page_pool: Clamp pool size to max 16K pages
  - 6pack: drop redundant locking and refcounting
  - exfat: limit log print for IO error
  - ALSA: usb-audio: add mono main switch to Presonus S1824c
  - Bluetooth: SCO: Fix UAF on sco_conn_free
  - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames
  - net: macb: avoid dealing with endianness in macb_set_hwaddr()
  - arm64: openeuler_defconfig: enable ras critical related configs by default
  - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS
  - futex: avoid memory access during exit_robust_list if task facing critical RAS
  - mm: avoid memory access during __access_remote_vm if task facing critical RAS
  - coredump: skip coredump during critical error if task facing critical RAS
  - exit: terminate process on critical RAS events to prevent further damage
  - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct
  - ACPI: APEI: Add vendor specific error info handling for ARM Processor
  - mm: memory_failure: fix UAF in memory_failure_cb
  - genirq: Get rid of global lock in irq_do_set_affinity()
  - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
  - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
  - ASoC: stm32: sai: manage context in set_sysclk callback
  - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
  - ext4: increase IO priority of fastcommit
  - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state
  - accel/habanalabs: return ENOMEM if less than requested pages were pinned
  - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
  - accel/habanalabs/gaudi2: fix BMON disable configuration
  - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
  - net: bridge: Install FDB for bridge MAC on VLAN 0
  - NFSv4.1: fix mount hang after CREATE_SESSION failure
  - NFSv4: handle ERR_GRACE on delegation recalls
  - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream
  - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
  - remoteproc: qcom: q6v5: Avoid handling handover twice
  - PCI/PM: Skip resuming to D0 if device is disconnected
  - vfio: return -ENOTTY for unsupported device feature
  - sparc64: fix prototypes of reads[bwl]()
  - sparc/module: Add R_SPARC_UA64 relocation handling
  - r8169: set EEE speed down ratio to 1
  - net: intel: fm10k: Fix parameter idx set but not used
  - wifi: ath10k: Fix connection after GTK rekeying
  - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot()
  - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X
  - net: phy: clear link parameters on admin link down
  - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup()
  - jfs: fix uninitialized waitqueue in transaction manager
  - jfs: Verify inode mode when loading from disk
  - ipv6: np->rxpmtu race annotation
  - f2fs: fix infinite loop in __insert_extent_tree()
  - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
  - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
  - allow finish_no_open(file, ERR_PTR(-E...))
  - scsi: lpfc: Define size of debugfs entry for xri rebalancing
  - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup
  - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
  - scsi: ufs: core: Disable timestamp functionality if not supported
  - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
  - drm/amdgpu: reject gang submissions under SRIOV
  - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
  - ethernet: Extend device_get_mac_address() to use NVMEM
  - drm/amd/display: Disable VRR on DCE 6
  - drm/amd/display: Fix DVI-D/HDMI adapters
  - drm/amd: Avoid evicting resources at S5
  - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
  - ALSA: serial-generic: remove shared static buffer
  - wifi: mt76: mt7996: Temporarily disable EPCS
  - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device
  - net/cls_cgroup: Fix task_get_classid() during qdisc run
  - crypto: caam - double the entropy delay interval for retry
  - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
  - crypto: sun8i-ce - remove channel timeout field
  - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
  - HID: asus: add Z13 folio to generic group for multitouch to work
  - selftests: Replace sleep with slowwait
  - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
  - selftests: Disable dad for ipv6 in fcnal-test.sh
  - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT
  - netfilter: nf_reject: don't reply to icmp error messages
  - selftests: traceroute: Use require_command()
  - media: redrat3: use int type to store negative error codes
  - selftests: net: replace sleeps in fcnal-test with waits
  - net: sh_eth: Disable WoL if system can not suspend
  - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0
  - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet
  - phy: cadence: cdns-dphy: Enable lower resolutions in dphy
  - wifi: mac80211: Fix HE capabilities element check
  - ntfs3: pretend $Extend records as regular files
  - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes
  - net: phy: marvell: Fix 88e1510 downshift counter errata
  - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure
  - scsi: ufs: host: mediatek: Enhance recovery on resume failure
  - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer
  - media: ov08x40: Fix the horizontal flip control
  - char: Use list_del_init() in misc_deregister() to reinitialize list pointer
  - drm/msm: make sure to not queue up recovery more than once
  - usb: gadget: f_hid: Fix zero length packet transfer
  - drm/amdgpu: add support for cyan skillfish gpu_info
  - drm/amdgpu: don't enable SMU on cyan skillfish
  - drm/amd: add more cyan skillfish PCI ids
  - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs
  - iommu/amd: Skip enabling command/event buffers for kdump
  - smsc911x: add second read of EEPROM mac when possible corruption seen
  - net: call cond_resched() less often in __release_sock()
  - ALSA: usb-audio: apply quirk for MOONDROP Quark2
  - media: verisilicon: Explicitly disable selection api ioctls for decoders
  - media: adv7180: Only validate format in querystd
  - media: adv7180: Do not write format to device in set_fmt
  - media: adv7180: Add missing lock in suspend callback
  - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
  - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
  - drm/amdgpu: Allow kfd CRIU with no buffer objects
  - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
  - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
  - dmaengine: dw-edma: Set status for callback_result
  - dmaengine: mv_xor: match alloc_wc and free_wc
  - dmaengine: sh: setup_xref error handling
  - ptp: Limit time setting of PTP clocks
  - scsi: pm8001: Use int instead of u32 to store error codes
  - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
  - mips: lantiq: danube: rename stp node on EASY50712 reference board
  - mips: lantiq: xway: sysctrl: rename stp clock
  - mips: lantiq: danube: add missing device_type in pci node
  - mips: lantiq: danube: add model to EASY50712 dts
  - mips: lantiq: danube: add missing properties to cpu node
  - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
  - media: fix uninitialized symbol warnings
  - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
  - drm/amdkfd: fix vram allocation failure for a special case
  - fuse: zero initialize inode private data
  - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
  - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
  - extcon: adc-jack: Fix wakeup source leaks on device unbind
  - scsi: pm80xx: Fix race condition caused by static variables
  - scsi: mpi3mr: Fix controller init failure on fault during queue creation
  - rds: Fix endianness annotation for RDS_MPATH_HASH
  - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
  - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
  - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
  - net: stmmac: Correctly handle Rx checksum offload errors
  - net: When removing nexthops, don't call synchronize_net if it is not necessary
  - char: misc: Does not request module for miscdevice with dynamic minor
  - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor
  - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
  - iio: adc: imx93_adc: load calibrated values even calibration failed
  - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
  - drm/amdkfd: Handle lack of READ permissions in SVM mapping
  - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
  - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling
  - scsi: ufs: host: mediatek: Change reset sequence for improved stability
  - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change
  - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration
  - bridge: Redirect to backup port when port is administratively down
  - s390/pci: Use pci_uevent_ers() in PCI recovery
  - powerpc/eeh: Use result of error_detected() in uevent
  - ice: Don't use %pK through printk or tracepoints
  - net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
  - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
  - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR
  - drm/tidss: Set crtc modesetting parameters with adjusted mode
  - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST
  - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value
  - drm/tidss: Use the crtc_* timings when programming the HW
  - media: amphion: Delete v4l2_fh synchronously in .release()
  - media: pci: ivtv: Don't create fake v4l2_fh
  - drm/amdkfd: return -ENOTTY for unsupported IOCTLs
  - wifi: rtw88: sdio: use indirect IO for device registers before power-on
  - selftests/net: Ensure assert() triggers in psock_tpacket.c
  - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
  - PCI: Disable MSI on RDC PCI to PCIe bridges
  - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
  - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
  - drm/amd/pm: Use cached metrics data on arcturus
  - drm/amd/pm: Use cached metrics data on aldebaran
  - drm/amd/display: update dpp/disp clock from smu clock table
  - drm/amd/display: add more cyan skillfish devices
  - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
  - drm/amd/display: ensure committing streams is seamless
  - mfd: da9063: Split chip variant reading in two bus transactions
  - mfd: madera: Work around false-positive -Wininitialized warning
  - mfd: stmpe-i2c: Add missing MODULE_LICENSE
  - mfd: stmpe: Remove IRQ domain upon removal
  - tools/power x86_energy_perf_policy: Prefer driver HWP limits
  - tools/power x86_energy_perf_policy: Enhance HWP enable
  - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
  - tools/cpupower: Fix incorrect size in cpuidle_state_disable()
  - hwmon: (dell-smm) Add support for Dell OptiPlex 7040
  - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
  - uprobe: Do not emulate/sstep original instruction when ip is changed
  - nvme: Use non zero KATO for persistent discovery connections
  - bpf: Clear pfmemalloc flag when freeing all fragments
  - riscv: bpf: Fix uninitialized symbol 'retval_off'
  - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
  - spi: rpc-if: Add resume support for RZ/G3E
  - cpuidle: Fail cpuidle device registration if there is one already
  - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
  - power: supply: qcom_battmgr: handle charging state change notifications
  - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"
  - tools/cpupower: fix error return value in cpupower_write_sysfs()
  - video: backlight: lp855x_bl: Set correct EPROM start for LP8556
  - tee: allow a driver to allocate a tee_device without a pool
  - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
  - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
  - ARM: tegra: transformer-20: fix audio-codec interrupt
  - ARM: tegra: transformer-20: add missing magnetometer interrupt
  - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
  - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106
  - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller
  - hwmon: sy7636a: add alias
  - power: supply: sbs-charger: Support multiple devices
  - pinctrl: keembay: release allocated memory in detach path
  - hwmon: (sbtsi_temp) AMD CPU extended temperature range support
  - power: supply: qcom_battmgr: add OOI chemistry
  - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
  - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
  - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
  - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
  - arc: Fix __fls() const-foldability via __builtin_clzl()
  - cpufreq/longhaul: handle NULL policy in longhaul_exit
  - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
  - irqchip/sifive-plic: Respect mask state when setting affinity
  - memstick: Add timeout to prevent indefinite waiting
  - mmc: host: renesas_sdhi: Fix the actual clock
  - pinctrl: single: fix bias pull up/down handling in pin_config_set
  - bpf: Don't use %pK through printk
  - spi: loopback-test: Don't use %pK through printk
  - soc: qcom: smem: Fix endian-unaware access of num_entries
  - soc: aspeed: socinfo: Add AST27xx silicon IDs
  - usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
  - drm/sched: Fix race in drm_sched_entity_select_rq()
  - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
  - sched/fair: Use all little CPUs for CPU-bound workloads
  - sched/pelt: Avoid underestimation of task utilization
  - net: phy: dp83867: Disable EEE support as not implemented
  - s390/pci: Restore IRQ unconditionally for the zPCI device
  - regmap: slimbus: fix bus_context pointer in regmap init calls
  - block: make REQ_OP_ZONE_OPEN a write operation
  - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
  - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
  - sfc: fix potential memory leak in efx_mae_process_mport()
  - drm/etnaviv: fix flush sequence logic
  - Bluetooth: hci_core: Fix tracking of periodic advertisement
  - Bluetooth: ISO: Fix another instance of dst_type handling
  - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
  - libbpf: Fix powerpc's stack register definition in bpf_tracing.h
  - ASoC: fsl_sai: fix bit order for DSD format
  - ASoC: Intel: avs: Unprepare a stream when XRUN occurs
  - scsi: ufs: core: Initialize value of an attribute returned by uic cmd
  - ALSA: usb-audio: fix control pipe direction
  - drm/msm/a6xx: Fix GMU firmware parser
  - wifi: ath12k: free skb during idr cleanup callback
  - wifi: ath10k: Fix memory leak on unsupported WMI command
  - ASoC: qdsp6: q6asm: do not sleep while atomic
  - mptcp: restore window probe
  - mptcp: drop bogus optimization in __mptcp_check_push()
  - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
  - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
  - Bluetooth: rfcomm: fix modem control handling
  - ACPI: button: Call input_free_device() on failing input device registration
  - fbdev: atyfb: Check if pll_ops->init_pll failed
  - net: usb: asix_devices: Check return value of usbnet_get_endpoints
  - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
  - arm64/xcall: add research papers reference in file headers


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.1.141
changelog:
  - !21670 urma: change well-known jetty to UM
  - !21669 urma: adjust netlink log level of ipourma
  - urma: change well-known jetty to UM
  - urma: adjust netlink log level of ipourma
  - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0
  - f2fs: fix to detect potential corrupted nid in free_nid_list
  - ntfs3: Fix uninit buffer allocated by __getname()
  - nvme-pci: Fix race bug in nvme_poll_irqdisable()
  - tls: Purge async_hold in tls_decrypt_async_wait()
  - clsact: Fix use-after-free in init/destroy rollback asymmetry
  - nf_tables: nft_dynset: fix possible stateful expression memleak in error path
  - xdp: produce a warning when calculated tailroom is negative
  - xdp: use modulo operation to calculate XDP frag tailroom
  - apparmor: fix race between freeing data and fs accessing it
  - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks"
  - riscv: Replace function-like macro by static inline function
  - sched/fair: scale wake_wide() threshold by SMT width
  - sched/core: fix SCHED_FEAT overflow on 32-bit architectures
  - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid()
  - urma: fix race condition in async event causing kfree of invalid pointer
  - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid
  - apparmor: replace recursive profile removal with iterative approach
  - apparmor: fix: limit the number of levels of policy namespaces
  - nfnetlink_osf: validate individual option lengths in fingerprints
  - tls: Fix race condition in tls_sw_cancel_work_tx()
  - urma: Kernel-mode file for bugfix of vtpn of empty pointer
  - xen/privcmd: add boot control for restricted usage in domU
  - xen/privcmd: unregister xenstore notifier on module exit
  - xen/privcmd: restrict usage in unprivileged domU
  - af_unix: Give up GC if MSG_PEEK intervened.
  - urma: Kernel-mode file for bugfix to move hashtable from alloc to active
  - apparmor: fix differential encoding verification
  - ub:hisi-ubus: Synchronize the missing code
  - apparmor: Fix double free of ns_name in aa_replace_profiles()
  - mptcp: pm: in-kernel: always mark signal+subflow endp as used
  - bridge: cfm: Fix race condition in peer_mep deletion
  - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
  - apparmor: fix race on rawdata dereference
  - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
  - net/sched: act_gate: snapshot parameters with RCU on replace
  - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
  - netfilter: nf_tables: always walk all pending catchall elements
  - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
  - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
  - netfilter: nf_tables: unconditionally bump set->nelems before insertion
  - netfilter: nf_tables: release flowtable after rcu grace period on error
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks
  - netfilter: xt_CT: drop pending enqueued packets on template removal
  - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
  - apparmor: fix memory leak in verify_header
  - wifi: libertas: fix use-after-free in lbs_free_adapter()
  - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
  - urma: Kernel-mode file for bugfix deactivate to apply pid in udma
  - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback
  - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
  - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
  - can: bcm: fix locking for bcm_op runtime updates
  - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
  - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
  - net: prevent NULL deref in ip[6]tunnel_xmit()
  - net: add xmit recursion limit to tunnel xmit functions
  - net: gro: fix outer network offset
  - net: annotate data-races around sk->sk_{data_ready,write_space}
  - net: add proper RCU protection to /proc/net/ptype
  - urma: fix potential deadlock risk in urma_ping
  - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
  - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
  - net: usb: kalmia: validate USB endpoints
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
  - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair()
  - urma: use user-specified dev_name when creating agg dev
  - mm: thp: deny THP for files on anonymous inodes
  - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
  - smb: client: Don't log plaintext credentials in cifs_set_cifscreds
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
  - xhci: dbgtty: fix device unregister: fixup
  - tty: introduce and use tty_port_tty_vhangup() helper
  - net: dsa: microchip: Fix error path in PTP IRQ setup
  - can: ucan: Fix infinite loop from zero-length messages
  - net: dsa: microchip: Free previously initialized ports on init failures
  - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}()
  - selftests: mptcp: join: properly kill background tasks
  - staging: rtl8712: Remove driver using deprecated API wext
  - net: macb: fix unregister_netdev call order in macb_remove()
  - iio: adc: rtq6056: Correct the sign bit index
  - nfsd: Replace clamp_t in nfsd4_get_drc_mem()
  - net: dsa: microchip: ptp: Fix checks on irq_find_mapping()
  - net: dsa: microchip: common: Fix checks on irq_find_mapping()
  - drm/amd/display: Check NULL before accessing
  - drm: sti: fix device leaks at component probe
  - USB: serial: option: add support for Rolling RW101R-GL
  - USB: serial: ftdi_sio: add support for u-blox EVK-M101
  - xhci: dbgtty: fix device unregister
  - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
  - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
  - usb: dwc3: pci: Sort out the Intel device IDs
  - usb: dwc3: pci: add support for the Intel Nova Lake -S
  - usb: renesas_usbhs: Fix synchronous external abort on unbind
  - usb: gadget: f_eem: Fix memory leak in eem_unwrap
  - usb: cdns3: Fix double resource release in cdns3_pci_probe
  - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking
  - mptcp: clear scheduled subflows on retransmit
  - firmware: stratix10-svc: fix bug in saving controller data
  - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
  - thunderbolt: Add support for Intel Wildcat Lake
  - drivers/usb/dwc3: fix PCI parent check
  - dm-verity: fix unreliable memory allocation
  - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
  - can: sja1000: fix max irq loop handling
  - atm/fore200e: Fix possible data race in fore200e_open()
  - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line
  - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230
  - iio: adc: ad7280a: fix ad7280_store_balance_timer()
  - iio: accel: fix ADXL355 startup race condition
  - iio: accel: bmc150: Fix irq assumption regression
  - iio:common:ssp_sensors: Fix an error handling path ssp_probe()
  - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
  - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
  - spi: bcm63xx: fix premature CS deassertion on RX-only transactions
  - spi: nxp-fspi: Propagate fwnode in ACPI case as well
  - spi: nxp-fspi: Support per spi-mem operation frequency switches
  - spi: spi-mem: Add a new controller capability
  - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency
  - spi: spi-mem: Allow specifying the byte order in Octal DTR mode
  - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors
  - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA
  - mailbox: pcc: don't zero error register
  - mailbox: mailbox-test: Fix debugfs_create_dir error checking
  - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors
  - iio: st_lsm6dsx: Fixed calibrated timestamp calculation
  - net: fec: do not register PPS event for PEROUT
  - net: fec: do not allow enabling PPS and PEROUT simultaneously
  - net: fec: do not update PEROUT if it is enabled
  - net: fec: cancel perout_timer when PEROUT is disabled
  - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic
  - net: dsa: sja1105: simplify static configuration reload
  - net: sxgbe: fix potential NULL dereference in sxgbe_rx()
  - net: lan966x: Fix the initialization of taprio
  - net: aquantia: Add missing descriptor cache invalidation on ATL2
  - platform/x86: intel: punit_ipc: fix memory corruption
  - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY
  - Bluetooth: SMP: Fix not generating mackey and ltk when repairing
  - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data
  - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header
  - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs
  - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.2.142
changelog:
  - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove
  - !21695 urma: Create jetty with kernel thread
  - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove
  - urma: Create jetty with kernel thread


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.3.143
changelog:
  - !21778 urma: implement share TP for RM mode
  - urma: implement share TP for RM mode
  - !21768 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-146.0.0 to 6.6.0-147.0.0
  - ub:hisi-ubus: Adjust the order of the message struct
  - ub:ubus: Fix find error ubc_num of local ras
  - ub:ubus: Fix null message workqueue issue
  - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().
  - net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work
  - urma: fix Clos networking and add a new interface get_path_set.
  - sched/debug: Fix avg_vruntime() usage
  - sched/fair: Fix zero_vruntime tracking fix
  - sched/fair: Fix vruntime drift by preventing double lag scaling during reweight
  - sched/eevdf: Update se->vprot in reweight_entity()
  - sched/fair: Only set slice protection at pick time
  - sched: Fix struct sched_entity kabi broken
  - sched/fair: Fix NO_RUN_TO_PARITY case
  - sched/fair: Use protect_slice() instead of direct comparison
  - sched: Cancel the slice protection of the idle entity
  - sched/eevdf: Fix wakeup-preempt by checking cfs_rq->nr_running
  - sched/eevdf: Disable shorter slices to wakeup-preempt
  - sched/eevdf: Allow shorter slices to wakeup-preempt
  - sched: Unify more update_curr*()
  - sched: Remove vruntime from trace_sched_stat_runtime()
  - sched: fix kabi broken in struct sched_statistics
  - sched: Unify runtime accounting across classes
  - sched/fair: Adhere to place_entity() constraints
  - sched/fair: Fix EEVDF entity placement bug causing scheduling lag
  - sched/fair: Fix zero_vruntime tracking
  - sched: Fix kabi breakage of struct cfs_rq for sum_w_vruntime
  - sched/fair: Rename cfs_rq::avg_vruntime to ::sum_w_vruntime, and helper functions
  - sched: Fix kabi breakage of struct cfs_rq for sum_weight
  - sched/fair: Rename cfs_rq::avg_load to cfs_rq::sum_weight
  - sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups
  - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer
  - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer
  - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one
  - spi: tegra210-quad: Move curr_xfer read inside spinlock
  - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer
  - tools: Fix bitfield dependency failure
  - iomap: allocate s_dio_done_wq for async reads as well
  - i3c: Move device name assignment after i3c_bus_init
  - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
  - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
  - selftests: bonding: Add more missing config options
  - selftests: bonding: add missing build configs
  - mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors
  - net: stmmac: fix rx limit check in stmmac_rx_zc()
  - netfilter: flowtable: check for maximum number of encapsulations in bridge vlan
  - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"
  - resource: introduce is_type_match() helper and use it
  - resource: replace open coded resource_intersection()
  - resource: Reuse for_each_resource() macro
  - ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend
  - ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend
  - ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend
  - ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend
  - ASoC: Intel: catpt: Fix error path in hw_params()
  - vdpa/pds: use %pe for ERR_PTR() in event handler registration
  - virtio: fix virtqueue_set_affinity() docs
  - virtio: fix whitespace in virtio_config_ops
  - virtio: fix typo in virtio_device_ready() comment
  - virtio_vdpa: fix misleading return in void function
  - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation
  - ext4: remove unused return value of __mb_check_buddy
  - ublk: prevent invalid access with DEBUG
  - ublk: complete command synchronously on error
  - ublk: make sure io cmd handled in submitter task context
  - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
  - hwmon: sy7636a: Fix regulator_enable resource leak on error path
  - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1()
  - ASoC: fsl_xcvr: clear the channel status control memory
  - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY
  - RDMA/irdma: Add support to re-register a memory region
  - RDMA/irdma: Fix data race in irdma_free_pble
  - RDMA/irdma: Fix data race in irdma_sc_ccq_arm
  - iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal
  - backlight: lp855x: Fix lp855x.h kernel-doc warnings
  - backlight: led-bl: Add devlink to supplier LEDs
  - wifi: ieee80211: correct FILS status codes
  - iomap: always run error completions in user context
  - iomap: factor out a iomap_dio_done helper
  - drm/nouveau: restrict the flush page to a 32-bit address
  - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
  - btrfs: fix leaf leak in an error path in btrfs_del_items()
  - staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
  - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc
  - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
  - RDMA/bnxt_re: Fix the inline size for GenP7 devices
  - RISC-V: KVM: Fix guest page fault within HLV* instructions
  - crypto: ccree - Correctly handle return of sg_nents_for_len
  - crypto: starfive - Correctly handle return of sg_nents_for_len
  - selftests/bpf: Improve reliability of test_perf_branches_no_hw()
  - selftests/bpf: skip test_perf_branches_hw() on unsupported platforms
  - usb: dwc2: fix hang during suspend if set as peripheral
  - usb: dwc2: fix hang during shutdown if set as peripheral
  - usb: dwc2: disable platform lowlevel hw resources during shutdown
  - usb: chaoskey: fix locking for O_NONBLOCK
  - cpuset: Treat cpusets in attaching as populated
  - net: phy: adin1100: Fix software power-down ready condition
  - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
  - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
  - wifi: mac80211: fix CMAC functions not handling errors
  - wifi: mac80211: remove RX_DROP_UNUSABLE
  - pwm: bcm2835: Make sure the channel is enabled after pwm_request()
  - perf arm_spe: Fix memset subclass in operation
  - perf arm-spe: Extend branch operations
  - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
  - fs/ntfs3: Prevent memory leaks in add sub record
  - fs/ntfs3: out1 also needs to put mi
  - powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format
  - powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit
  - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
  - drm/msm/a2xx: stop over-complaining about the legacy firmware
  - NFSD/blocklayout: Fix minlength check in proc_layoutget
  - tracefs: fix a leak in eventfs_create_events_dir()
  - watchdog: starfive: Fix resource leak in probe error path
  - watchdog: wdat_wdt: Fix ACPI table leak in probe function
  - selftests/bpf: Fix failure paths in send_signal test
  - bpf: Handle return value of ftrace_set_filter_ip in register_fentry
  - ps3disk: use memcpy_{from,to}_bvec index
  - arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A
  - arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A
  - PCI: keystone: Exit ks_pcie_probe() for invalid mode
  - leds: netxbig: Fix GPIO descriptor leak in error paths
  - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
  - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()
  - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
  - lib/vsprintf: Check pointer before dereferencing in time_and_date()
  - clk: renesas: r9a06g032: Fix memory leak in error path
  - coresight: etm4x: Add context synchronization before enabling trace
  - coresight: etm4x: Extract the trace unit controlling
  - coresight: etm4x: Correct polling IDLE bit
  - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
  - powerpc/32: Fix unpaired stwcx. on interrupt exit
  - cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs
  - scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc()
  - ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties
  - RDMA/rtrs: server: Fix error handling in get_or_create_srv
  - dt-bindings: PCI: amlogic: Fix the register name of the DBI region
  - staging: most: remove broken i2c driver
  - staging: most: i2c: Drop explicit initialization of struct i2c_device_id::driver_data to 0
  - scsi: stex: Fix reboot_notifier leak in probe error path
  - regulator: core: disable supply if enabling main regulator fails
  - perf/x86/intel: Correct large PEBS flag check
  - ext4: correct the checking of quota files before moving extents
  - mfd: da9055: Fix missing regmap_del_irq_chip() in error path
  - efi/libstub: Fix page table access in 5-level to 4-level paging transition
  - x86/boot: Fix page table access in 5-level to 4-level paging transition
  - ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible
  - ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible
  - ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels
  - spi: tegra210-quad: Fix timeout handling
  - fs/9p: Don't open remote file with APPEND mode when writeback cache is used
  - scsi: target: Do not write NUL characters into ASCII configfs output
  - power: supply: apm_power: only unset own apm_get_power_status
  - power: supply: wm831x: Check wm831x_set_bits() return value
  - power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges()
  - power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges()
  - power: supply: cw2015: Check devm_delayed_work_autocancel() return code
  - perf record: skip synthesize event when open evsel failed
  - perf lock contention: Load kernel map before lookup
  - perf maps: Add maps__load_first()
  - interconnect: debugfs: Fix incorrect error handling for NULL path
  - arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller
  - interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS
  - i3c: master: svc: Prevent incomplete IBI transaction
  - i3c: fix refcount inconsistency in i3c_master_register
  - i3c: master: Inherit DMA masks and parameters from parent device
  - pinctrl: stm32: fix hwspinlock resource leak in probe function
  - soc: qcom: smem: fix hwspinlock resource leak in probe error paths
  - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
  - mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove
  - mtd: nand: relax ECC parameter validation check
  - Revert "mtd: rawnand: marvell: fix layouts"
  - ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties
  - ARM: dts: renesas: gose: Remove superfluous port property
  - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
  - phy: mscc: Fix PTP for VSC8574 and VSC8572
  - arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider
  - firmware: imx: scu-irq: fix OF node leak in
  - arm64: dts: ti: k3-am62p: Fix memory ranges for GPU
  - s390/ap: Don't leak debug feature files if AP instructions are not available
  - s390/smp: Fix fallback CPU detection
  - wifi: ath11k: fix peer HE MCS assignment
  - clk: qcom: camcc-sm6350: Fix PLL config of PLL2
  - clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other
  - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
  - PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2
  - arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1
  - arm64: dts: imx8mp-venice-gw702x: remove off-board uart
  - arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
  - arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props
  - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member
  - inet: Avoid ehash lookup race in inet_ehash_insert()
  - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
  - ntfs3: fix uninit memory after failed mi_read in mi_format_new
  - crypto: authenc - Correctly pass EINPROGRESS back up to the caller
  - irqchip/qcom-irq-combiner: Fix section mismatch
  - irqchip/imx-mu-msi: Fix section mismatch
  - irqchip/irq-brcmstb-l2: Fix section mismatch
  - irqchip/irq-bcm7120-l2: Fix section mismatch
  - irqchip/irq-bcm7038-l1: Fix section mismatch
  - objtool: Fix weak symbol detection
  - objtool: Fix standalone --hacks=jump_label
  - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync()
  - clk: renesas: cpg-mssr: Read back reset registers to assure values latched
  - clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register
  - clk: renesas: Use str_on_off() helper
  - clk: renesas: rzg2l: Use %x format specifier to print CLK_ON_R()
  - clk: renesas: rzg2l: Remove critical area
  - clk: renesas: rzg2l: Simplify the logic in rzg2l_mod_clock_endisable()
  - clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback
  - USB: Fix descriptor count when handling invalid MBIM extended descriptor
  - drm/vgem-fence: Fix potential deadlock on release
  - drm/panel: visionox-rm69299: Don't clear all mode flags
  - gpu: host1x: Fix race in syncpt alloc/free
  - smack: fix bug: unprivileged task can create labels
  - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
  - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
  - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
  - comedi: check device's attached status in compat ioctls
  - comedi: multiq3: sanitize config options in multiq3_attach()
  - comedi: c6xdigio: Fix invalid PNP driver unregistration
  - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1
  - samples: work around glibc redefining some of our defines wrong
  - HID: elecom: Add support for ELECOM M-XT3URBK (018F)
  - platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
  - platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
  - platform/x86: huawei-wmi: add keys for HONOR models
  - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
  - platform/x86: acer-wmi: Ignore backlight event
  - pinctrl: qcom: msm: Fix deadlock in pinmux configuration
  - HID: hid-input: Extend Elan ignore battery quirk to USB
  - bfs: Reconstruct file type when loading from disk
  - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
  - smb: fix invalid username check in smb3_fs_context_parse_param()
  - Bluetooth: btrtl: Avoid loading the config file on security chips
  - drm/vmwgfx: Use kref in vmw_bo_dirty
  - spi: imx: keep dma request disabled before dma transfer setup
  - spi: xilinx: increase number of retries before declaring stall
  - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
  - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
  - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
  - serial: add support of CPCI cards
  - USB: serial: ftdi_sio: match on interface number for jtag
  - USB: serial: option: move Telit 0x10c7 composition in the right place
  - USB: serial: option: add Telit Cinterion FE910C04 new compositions
  - USB: serial: option: add Foxconn T99W760
  - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()
  - locking/spinlock/debug: Fix data-race in do_raw_write_lock
  - ksmbd: ipc: fix use-after-free in ipc_msg_send_request
  - Documentation: process: Also mention Sasha Levin as stable tree maintainer
  - leds: spi-byte: Use devm_led_classdev_register_ext()
  - fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error
  - Solve kernel ABI issue introduced by x86_max_cores updates
  - x86/acpi/boot: Correct acpi_is_processor_usable() check again
  - x86/xen: mark boot CPU of PV guest in MSR_IA32_APICBASE
  - x86/topology: Handle the !APIC case gracefully
  - x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI
  - x86/cpu/topology: Remove limit of CPUs due to disabled IO/APIC
  - x86/topology: Handle bogus ACPI tables correctly
  - x86/xen/smp_pv: Register the boot CPU APIC properly
  - x86/topology: Don't update cpu_possible_map in topo_set_cpuids()
  - x86/topology: Don't evaluate logical IDs during early boot
  - x86/topology: Ignore non-present APIC IDs in a present package
  - x86/cpu/topology: Get rid of cpuinfo::x86_max_cores
  - x86/cpu/topology: Provide __num_[cores|threads]_per_package
  - x86/cpu/topology: Rename topology_max_die_per_package()
  - x86/cpu/topology: Rename smp_num_siblings
  - x86/cpu/topology: Retrieve cores per package from topology bitmaps
  - x86/cpu/topology: Use topology logical mapping mechanism
  - x86/cpu/topology: Provide logical pkg/die mapping
  - x86/cpu/topology: Simplify cpu_mark_primary_thread()
  - x86/cpu/topology: Mop up primary thread mask handling
  - x86/cpu/topology: Use topology bitmaps for sizing
  - x86/cpu/topology: Let XEN/PV use topology from CPUID/MADT
  - x86/xen/smp_pv: Count number of vCPUs early
  - x86/cpu/topology: Assign hotpluggable CPUIDs during init
  - x86/cpu/topology: Reject unknown APIC IDs on ACPI hotplug
  - x86/topology: Add a mechanism to track topology via APIC IDs
  - x86/cpu: Detect real BSP on crash kernels
  - x86/cpu/topology: Rework possible CPU management
  - x86/cpu/topology: Sanitize the APIC admission logic
  - x86/smpboot: Make error message actually useful
  - x86/cpu/topology: Use a data structure for topology info
  - x86/cpu/topology: Simplify APIC registration
  - x86/cpu/topology: Confine topology information
  - x86/xen/smp_pv: Register fake APICs
  - x86/acpi: Dont invoke topology_register_apic() for XEN PV
  - x86/mpparse: Use new APIC registration function
  - x86/of: Use new APIC registration functions
  - x86/jailhouse: Use new APIC registration function
  - x86/acpi: Use new APIC registration functions
  - x86/cpu/topology: Provide separate APIC registration functions
  - x86/cpu/topology: Move registration out of APIC code
  - x86/of: Set the parse_smp_cfg for all the DeviceTree platforms by default
  - x86/hyperv/vtl: Correct x86_init.mpparse.parse_smp_cfg assignment
  - x86/of: Move the x86_flattree_get_config() call out of x86_dtb_init()
  - x86/apic: Use a proper define for invalid ACPI CPU ID
  - x86/apic: Remove yet another dubious callback
  - x86/apic: Remove the pointless writeback of boot_cpu_physical_apicid
  - x86/mpparse: Remove the physid_t bitmap wrapper
  - x86/mm/numa: Move early mptable evaluation into common code
  - x86/mpparse: Switch to new init callbacks
  - x86/hyperv/vtl: Prepare for separate mpparse callbacks
  - x86/xen/smp_pv: Prepare for separate mpparse callbacks
  - x86/jailhouse: Prepare for separate mpparse callbacks
  - x86/platform/intel-mid: Prepare for separate mpparse callbacks
  - x86/platform/ce4100: Prepare for separate mpparse callbacks
  - x86/dtb: Rename x86_dtb_init()
  - x86/mpparse: Prepare for callback separation
  - x86/mpparse: Provide separate early/late callbacks
  - x86/mpparse: Rename default_find_smp_config()
  - x86/apic: Remove check_apicid_used() and ioapic_phys_id_map()
  - x86/ioapic: Simplify setup_ioapic_ids_from_mpc_nocheck()
  - x86/ioapic: Make io_apic_get_unique_id() simpler
  - x86/apic: Get rid of get_physical_broadcast()
  - x86/ioapic: Replace some more set bit nonsense
  - x86/platform/ce4100: Dont override x86_init.mpparse.setup_ioapic_ids
  - x86/xen: return a sane initial apic id when running as PV guest
  - x86/cpu/topology: Make the APIC mismatch warnings complete
  - Solve kernel ABI issues introduced by x86_coreid_bits updates
  - x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON
  - x86/apic/uv: Remove the private leaf 0xb parser
  - x86/xen/smp_pv: Remove cpudata fiddling
  - x86/apic: Remove unused phys_pkg_id() callback
  - x86/cpu: Remove x86_coreid_bits
  - x86/cpu: Remove topology.c
  - x86/cpu: Make topology_amd_node_id() use the actual node info
  - x86/mm/numa: Use core domain size on AMD
  - x86/cpu: Use common topology code for HYGON
  - x86/cpu: Use common topology code for AMD
  - x86/smpboot: Teach it about topo.amd_node_id
  - x86/topology/amd: Evaluate SMT in CPUID leaf 0x8000001e only on family 0x17 and greater
  - x86/topology/amd: Ensure that LLC ID is initialized
  - x86/cpu/amd: Move TOPOEXT enablement into the topology parser
  - x86/cpu/amd: Make the NODEID_MSR union actually work
  - x86/cpu/amd: Make the CPUID 0x80000008 parser correct
  - x86/cpu: Provide an AMD/HYGON specific topology parser
  - x86/cpu/amd: Provide a separate accessor for Node ID
  - x86/topology/intel: Unlock CPUID before evaluating anything
  - x86/cpu: Use common topology code for Intel
  - x86/cpu: Provide a sane leaf 0xb/0x1f parser
  - x86/cpu: Move __max_die_per_package to common.c
  - x86/cpu: Use common topology code for Centaur and Zhaoxin
  - x86/cpu: Add legacy topology parser
  - x86/cpu: Provide cpu_init/parse_topology()
  - x86/cpuid: Include <linux/build_bug.h> in <asm/cpuid.h>
  - x86/cpu: Provide cpuid_read() et al.
  - Revert "RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor"
  - Solve kernel ABI issues introduced by cpuinfo_x86 updates
  - x86/cpu: Provide debug interface
  - x86/cpu/topology: Cure the abuse of cpuinfo for persisting logical ids
  - x86/apic, x86/hyperv: Use u32 in hv_snp_boot_ap() too
  - x86/apic: Use u32 for wakeup_secondary_cpu[_64]()
  - x86/apic: Use u32 for [gs]et_apic_id()
  - x86/apic: Use u32 for phys_pkg_id()
  - x86/apic: Use u32 for cpu_present_to_apicid()
  - x86/apic: Use u32 for check_apicid_used()
  - x86/apic: Use u32 for APIC IDs in global data
  - x86/apic: Use BAD_APICID consistently
  - x86/cpu: Move cpu_l[l2]c_id into topology info
  - x86/cpu: Move logical package and die IDs into topology info
  - x86/cpu: Move cu_id into topology info
  - x86/cpu: Move cpu_core_id into topology info
  - hwmon: (fam15h_power) Use topology_core_id()
  - scsi: lpfc: Use topology_core_id()
  - x86/cpu: Move cpu_die_id into topology info
  - x86/cpu: Move phys_proc_id into topology info
  - x86/cpu: Encapsulate topology information in cpuinfo_x86
  - urma: fix bonding udata exchange for imported seg/jetty objects.
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
  - urma: fix log error in connect
  - urma: fix kmod log format error
  - x86/uprobes: Fix XOL allocation failure for 32-bit tasks
  - pstore/ram: fix buffer overflow in persistent_ram_save_old()
  - urma: fix ubcore connect error
  - urma: fix error for setting conn timeout
  - ub: udma: change return value format.
  - drivers/ub/sentry: add some log for sent_cnt and remote_recv_cnt
  - drivers/ub/sentry: Refactor the message data format sent via UVB/URMA
  - net/mlx5e: Fix race condition during IPSec ESN update
  - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario
  - nvdimm/bus: Fix potential use after free in asynchronous initialization
  - urma: fix bind jetty compat error
  - net/mlx5e: Prevent concurrent access to IPSec ASO context
  - urma: change urma kmod errno
  - urma:delete redundant sub_trans_mode_cap in urma
  - RDMA/hns: Fix config the CNP DSCP
  - RDMA/hns: Fix the panic caused by a large number of print
  - media: dvb-net: fix OOB access in ULE extension header tables
  - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
  - urma: bonding support health check
  - xSched: update xSched manual for xcu cmdline enable option
  - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig
  - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16
  - xSched/cgroup: make xcu.stat invisible at root cgroup
  - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI
  - apparmor: validate DFA start states are in bounds in unpack_pdb
  - tcp: secure_seq: add back ports to TS offset
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
  - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
  - ice: Fix memory leak in ice_set_ringparam()
  - bpf: Fix regsafe() for pointers to packet
  - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-64.0.0.68
changelog:
  - !14106 uacce: some bugfix and cleanup
  - migration: modify dfx error type without VM driver
  - crypto: hisilicon_qm - fix the uacce_alloc return value check
  - crypto: hisilicon_zip - correct the wrong word in the printed information
  - uacce: add mutex for check qfr
  - uacce: add stop_queue to replace put_queue in ioctl
  - uacce: check the qfr address before releasing the qfr
  - uacce: add error number for the unsupported mremap
  - !14117  mm/page_alloc: Separate THP PCP into movable and non-movable categories
  - mm: fix kabi breakage due to struct per_cpu_pages
  - mm/page_alloc: Separate THP PCP into movable and non-movable categories
  - !14120  bpf: sync_linked_regs() must preserve subreg_def
  - bpf: sync_linked_regs() must preserve subreg_def
  - !14128  sched: Optimize the latency of select_task_rq and pick_next_task.
  - sched: Optimize the latency of select_task_rq and pick_next_task.
  - !13991  virtio-fs: introduce multi-queue support
  - virtio-fs: add multi-queue support
  - virtio-fs: limit number of request queues
  - virtiofs: include a newline in sysfs tag
  - virtiofs: emit uevents on filesystem events
  - virtiofs: export filesystem tags through sysfs
  - !14126 [OLK-6.6]perf:Add PMCG platform information for HiSilicon HIP09A
  - ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A
  - Revert "perf: Add PMCG platform information for HiSilicon HIP09A"
  - !14103  nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
  - nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
  - !13841 Fix livepatch selftest
  - selftests/livepatch: fix selftest execution error
  - !14069 MPTCP Upstream part 23
  - tcp: socket option to check for MPTCP fallback to TCP
  - mptcp: fix typos in comments
  - !13970  LoongArch: fix AVEC related issue
  - drivers/irqchip: Disable pci_irq_limit when using AVEC interrupt controller
  - irqchip/avec: Support AVEC for 3C6000 multi-node machine
  - !13981  LoongArch: backport ptw&set_pte patches from upstream
  - LoongArch: Set initial pte entry with PAGE_GLOBAL for kernel space
  - LoongArch: Improve hardware page table walker
  - LoongArch: Use accessors to page table entries instead of direct dereference
  - LoongArch: Remove superfluous flush_dcache_page() definition
  - !14107 ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf()
  - ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf()
  - !14101 [sync] PR-14087: v2  drivers/perf: hisi: Add support for HiSilicon DDRC v3 PMU driver
  - drivers/perf: hisi: Add support for HiSilicon DDRC v3 PMU driver
  - !14095 ima: Fix violation digests extending issue in virtcca
  - ima: Fix violation digests extending issue in virtcca
  - !14079 v3  irqchip: gic: some bugfix of hip10
  - irqchip/gic-v4.1:Check whether indirect table is supported in allocate_vpe_l1_table
  - KVM: arm64: vgic-v3: Fix a issue of hip10 erratum 162200806
  - irqchip/gic-v3: Exclude GICv4.1 for hip10 erratum 162200803
  - !14085  ocfs2: uncache inode which has failed entering the group
  - ocfs2: uncache inode which has failed entering the group
  - !13837 update patches for sw64 architecture
  - sw64: wrap frequency workaround into standalone functions
  - sw64: remove redudant save_ktp
  - sw64: fix compile warning of smp_callin()
  - sw64: distribute intx interrupts by hose
  - sw64: acpi: remove constraint that cid of boot core must be zero
  - sw64: pci: get register base address from firmware
  - sw64: fix compile warning of do_entUna()
  - sw64: fix save_ktp compatibility for C3
  - sw64: fix PTBR save/restore for hibernation
  - sw64: add syscall pfh_ops
  - sw64: fix broken rdfpcr()
  - sw64: force kernel stack to be 16 bytes aligned
  - sw64: match platform device by acpi method
  - sw64: spi: update spi controller driver
  - sw64: add -fno-sw-unalign-byte to cflags for C4
  - sw64: define cpu_relax() as imb()
  - sw64: fix the .endm in hibernate_asm.S
  - sw64: fix compile error of efi.systab
  - sw64: pci: adjust the maximum number of RC per node
  - sw64: get mclk and external clk from firmware
  - sw64: fix compile error of MMSIZE
  - sw64: acpi: disable ACPI for xuelang
  - sw64: ahci: disable parallel bus scan
  - sw64: redesign run mode setup method
  - sw64: rename static key and related simd libraries
  - sw64: fix secondary cpu bring up bug
  - sw64: irq: fix compile error when PINTC or LPC-INTC is not set
  - sw64: improve the verification logic of DTB
  - sw64: apply new boot params from DTB chosen node
  - sw64: receive new boot params from firmware
  - sw64: setup stackframe at kernel entry point
  - sw64: save and restore CSR_WR_FREGS for SIMD libs
  - sw64: rename copy and set lib functions
  - sw64: rename copy and set lib files
  - sw64: choose lib at compile time
  - sw64: store topology and numa info by each cpu itself
  - sw64: work around suspend for C4
  - sw64: employ trick on regs.pc for specific exception
  - sw64: enable CONFIG_FRAME_POINTER by default for junzhang
  - sw64: fix syscall_fallback() for vdso gettimeofday
  - sw64: dts: add Junzhang
  - sw64: lpc: work around hardware flaws
  - sw64: improve cpu bring up method
  - sw64: introduce new entry framework for C4
  - sw64: irq: update the initial value of nr_irqs
  - sw64: dynamically switch between lib implementation
  - sw64: msi: remove redundant interrupt enables
  - sw64: add unaligned access support for C4 new instructions
  - sw64: acpi: fix missed upper bits of rcid for junzhang
  - sw64: pci: remove duplicate pcie operations
  - sw64: irq: remove unnecessary initialization
  - sw64: acpi: enable generic GSI
  - sw64: irqchip: support ACPI-based interrupt controller initialization
  - sw64: acpi: support MADT entry print for SW PINTC, MSIC and LPC-INTC
  - sw64: acpi: add ACPI-style structures for SW PINTC, MSIC and LPC-INTC
  - sw64: fix compilation warning
  - sw64: fix kconfig selections
  - sw64: use a new wrap_asid hmcall when asid wraps
  - sw64: rewrite fpcr and swcr conversion
  - sw64: enable hardware denorm by default
  - sw64: add four-socket system support
  - sw64: add a new kernel parameter to override mclk
  - sw64: improve sw64_printk()
  - sw64: msi: fix bugs in multi-msi interrupts allocation and release
  - sw64: pci: change pci transaction ordering rule settings
  - sw64: irqchip: fix virtual PINTC not working properly
  - sw64: dts: improve properties for PINTC
  - sw64: dts: improve properties for LPC-INTC
  - sw64: dts: fix interrupt related properties for GPIO
  - sw64: dts: add chosen node
  - sw64: dts: fix properties for spi controller device node
  - sw64: acpi: fix coding style and typos
  - sw64: fix rd_f compatibility issue for C4
  - sw64: refactor device interrupt domain
  - sw64: fix macro definition compilation error
  - USB: xHCI: fix resume issue of some ZHAOXIN hosts
  - USB: Fix ehci infinite suspend-resume loop issue in zhaoxin
  - sw64: pci: fix compile error when CONFIG_ACPI=n
  - sw64: smp: suppress function setup_smp() when ACPI enabled
  - sw64: acpi: parse SW CINTC for SMP initialization
  - sw64: acpi: support MADT entry print for SW CINTC
  - sw64: acpi: add ACPI-style structures for SW CINTC
  - sw64: smp: add new structure to record rcid information
  - sw64: smp: modify function smp_rcb_init() to receive base address
  - sw64: pci: synchronize the OEM table ID of MCFG with BIOS
  - sw64: iommu: fix the bug when vfio_iommu unpin pages
  - sw64: use rvpcr() to setup run mode
  - sw64: kgdb: add single-step debug support
  - sw64: fix lockdep error
  - sw64: perf: do all event checks in sw64_pmu_event_init()
  - sw64: numa: fix compile error when CONFIG_ACPI_NUMA=n
  - sw64: pci: export some pci functions
  - sw64: uapi: fix a compile error for headers_install
  - sw64: perf: hide hardware performance events in guest os
  - sw64: fix hugepage support
  - sw64: extern vdso_start and vdso_end as char[]
  - sw64: remove useless current_policy
  - sw64: add arch-specific SYM_END definition
  - !13151 [OLK-6.6] arm64: errata: Unify and expand speculative SSBS workaround
  - openeuler_defconfig: Enable CONFIG_ARM64_ERRATUM_3194386 by default
  - arm64: Subscribe Microsoft Azure Cobalt 100 to erratum 3194386
  - arm64: errata: Expand speculative SSBS workaround once more
  - arm64: errata: Expand speculative SSBS workaround (again)
  - arm64: errata: Expand speculative SSBS workaround
  - arm64: errata: Unify speculative SSBS errata logic
  - arm64: errata: Add workaround for Arm errata 3194386 and 3312417


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-66.0.0.70
changelog:
  - !13846 [OLK-6.6] cpufreq: acpi-cpufreq: Zhaoxin: fix incorrect max-freq issue
  - cpufreq: acpi-cpufreq: Zhaoxin: fix incorrect max-freq issue
  - !9184 [OLK-6.6] i2c: smbus: Add support for Zhaoxin SMBUS controller
  - configs: Add Zhaoxin i2c smbus items in openeuler_config
  - i2c: smbus: Add support for Zhaoxin SMBUS controller
  - !9223 [OLK-6.6] x86/hpet: Read HPET directly if panic in progress
  - x86/hpet: Read HPET directly if panic in progress
  - !14088 ACPI: CPPC: Introduce new EPP capabilities and update auto selection functions
  - ACPI: CPPC: Introduce new EPP capabilities and update auto selection functions
  - !14112  xfs: Fix data overflow
  - xfs: Fix data overflow in xfs_mod_fdblocks()
  - Revert "xfs: split xfs_mod_freecounter"
  - !14099 [6.6] [Feature] : update patches for sw64 architecture
  - sw64: pci: fix compile error when CONFIG_PCI_MSI=n
  - sw64: pci: fix unable to get node ID when numa_off is set
  - sw64: add uapi reg.h
  - sw64: pciehp: remove useless code
  - sw64: dts: support online-capable property for cpu device node
  - sw64: kvm: resolve a compile warning
  - sw64: pciehp: update code
  - sw64: kvm: fix mmio GPA for C4
  - sw64: handle null MSI irq in guest os
  - sw64: fix guest memory and cpu hotplug function
  - sw64: kvm: walk host page tables to find THP mapping size
  - sw64: kvm: convert to the gfn-based MMU notifier callbacks
  - sw64: kvm: rename mmu_notifier_* to mmu_invalidate_*
  - sw64: kvm: fix compiler errors caused by mismatched parameters
  - sw64: kvm: use get_page() instead of kvm_get_pfn()
  - sw64: kvm: fix the handling when the live migration fails
  - sw64: kvm: fix NULL poniter access in kvm_arch_prepare_memory_region
  - sw64: kvm: fix link error with CONFIG_KVM=m
  - sw64: kvm: fix build failure about KVM
  - sw64: add dependency for sunway-ged driver
  - sw64: fix compile error with CONFIG_SUNWAY_GED=m
  - sw64: remove unused sunway_memory_get_meminfo()
  - sw64: Kconfig: activate ARCH_KEEP_MEMBLOCK
  - sw64: add cpu hotplug support for C4 guest
  - sw64: kvm: support up to 256 vCPUs for C4
  - sw64: kvm: fix inconsistent vcpucb of C4
  - sw64: kvm: implement kvm_arch_set_irq_inatomic()
  - sw64: fix guest send ipi target
  - sw64: kvm: add numa support for memory hotplug
  - sw64: kvm: fix bug when vcpu disable irq
  - sw64: kvm: acpi: match sunway_ged by acpi method
  - sw64: kvm: use generic kvm mmu memory caches
  - sw64: kvm: remove some unused codes
  - sw64: kvm: fix pmd_trans_cont
  - sw64: kvm: fix size of struct kvm_regs for C3B
  - sw64: kvm: add the member of the vcpucb structure
  - sw64: kvm: fix the check for THP
  - sw64: kvm: fix page walk error of unmap_apt_range()
  - sw64: redesign struct kvm_regs for C4
  - sw64: kvm: fix live migration bug
  - sw64: kvm: fix APT fault handler
  - sw64: kvm: fix unmap_apt_{ptes, pmds}
  - sw64: kvm: fix clock sync of CORE4 live migration
  - sw64: kvm: delete memory hotplug codes for CORE3B
  - sw64: add missing c4 legacy power management code
  - sw64: kvm: scale up the range of target vcpu parsed by hypervisor
  - sw64: kvm: fix return value of vmem_mmap
  - sw64: kvm: add trace kvm function
  - sw64: fix rc resource setup
  - sw64: 6.6 update: sunway_pciehp_reset_slot()
  - sw64: 6.6 update: arch_remove_memory()
  - sw64: bypass sunway pcie hotplug driver in non-physical scenario
  - sw64: defconfig: update defconfig for kata-containers
  - sw64: add HARDLOCKUP_DETECTOR support
  - sw64: fix bugs in decreasing frequency
  - sw64: add NMI support
  - sw64: add CSR_CAUSE into pt_regs
  - sw64: optimize the code in do_entInt()
  - sw64: seperate IRQ_MSI configs for sub-architectures
  - sw64: handle null MSI irq
  - sw64: fix a compilation warning
  - sw64: fix a base address of msiaddr register
  - sw64: fix some S3 CSRs problems for C4
  - sw64: fix io resource remapping
  - sw64: amdgpu/radeon: correct low-level mmio memset/memcpy direct calls
  - sw64: fix pci resource assignment bug
  - sw64: fix MSI compilation warnings
  - sw64: 6.6 io.h fixup
  - sw64: iommu: support SW64 IOMMU on 6.6 kernel
  - sw64: fix msi interrupt for guest os
  - sw64: msi: update code
  - sw64: gpio: fix compile error of sunway_gpio_add_port
  - sw64: fdt: map physical node ID to logical node ID
  - sw64: fix regs.pc on single-step with ptrace
  - sw64: modify some interrupt target core to logic 0 core
  - sw64: fix sw64_is_fake_mcount() of recordmcount
  - sw64: remove some unused module init/exit/license
  - sw64: numa: support NUMA initialization based on device tree
  - sw64: smp: support SMP initialization based on device tree
  - sw64: dtb: disable built-in DTB for junzhang
  - sw64: ata: add ata_hrst_delay cmdline option
  - sw64: kconfig: add I2C and SPI defconfig for junzhang
  - sw64: kconfig: set default y for GPIO if ACPI enabled
  - sw64: fix a bug in gpio-sunway.c
  - sw64: pci: use readq/writeq to read/write RC and PIU IO registers
  - sw64: gpu: memset_io and memcpy_toio/fromio for iomem on AMD swsmu
  - sw64: pciehp: add pcie hotplug driver support for C4
  - sw64: remove redundant intx code
  - sw64: irq: support interrupt for virtual GPIO
  - sw64: acpi: enable ACPI by default
  - sw64: mm: fix mem=xxx command line invalid in some cases
  - sw64: use generic page_is_ram()
  - sw64: mm: take memory information from firmware
  - sw64: lpc: fix compile error with CONFIG_SUNWAY_SUPERIO_AST2400=y
  - sw64: fix typo in gpio-sunway
  - sw64: fix compile warning of handle_pci_msi_interrupt
  - sw64: fix usage of __add_memory() in sunway-ged driver
  - sw64: change FORCE_MAX_ZONEORDER default value
  - sw64: perf: fix event check order


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-67.0.0.71
changelog:
  - !14144 [6.6] [Feature] : update patches for sw64 architecture
  - sw64: fix compile errors
  - sw64: work around gcc bugs with 'asm goto' with output
  - libbpf: add sw64 support
  - sw64: rename mmap protection_map
  - sw64: ptrace: add NT_SW64_SYSTEM_CALL regset
  - sw64 bpf: Add missing uapi header for BPF_PROG_TYPE_PERF_EVENT programs
  - sw64 bpf: add BPF_NOSPEC jit
  - sw64: rename _PFN_BITS to __PFN_BITS
  - sw64: update defconfig
  - sw64: kvm: declare KVM_CAP_SET_GUEST_DEBUG
  - sw64: implementing VDSO with generic code
  - sw64: irqchip: fix irq_enable/disable callback for MCU controller
  - sw64: kvm: remove unused argument 'addr' of apt_dissolve_pud/pmd()
  - sw64: acpi: support reset and S5
  - sw64: kvm: use vma_lookup() instead of find_vma_intersection()
  - sw64: refactor reset routines with new API
  - sw64: kvm: remove unused kvm_arch_flush_remote_tlbs_memslot()
  - sw64: kvm: optimize the calling and implementation of functions in mmu.c
  - sw64: irqchip: remove fallback after kzalloc_node()
  - sw64: irqchip: improve intx implementation
  - sw64: pci: remove function fix_jm585_reset()
  - sw64: fix mmap protection_map
  - sw64: show CPU feature UNA in /proc/cpuinfo
  - sw64: fix the error of cpufreq update
  - sw64: fix compilation issues on match.c
  - sw64: mm: fix PFN of PMDs for 512M hugepage
  - sw64: kvm: fix an error when unmapping 512M hugepages
  - sw64: modify sys_pfh_ops
  - sw64: fix set_huge_pte_at for C4
  - sw64: add the missed clear_flush()
  - sw64: fix compilation issues
  - sw64: add arch_hugetlb_valid_size for C4
  - sw64: kvm: adjust interrupt priority for guest
  - sw64: compatible with suspend implementation
  - sw64: add junzhang_v1/2/3_key
  - sw64: fix numa setup when acpi is disabled
  - sw64: fix setup_mem_size()
  - sw64: fix the register bug in do_entUna
  - sw64: add unaligned access handling code for SIMD in kernel mode (5.10)
  - sw64: select different MUX to read cpu frequency
  - sw64: lpc: fix ast2400 driver error for C4
  - sw64: improve lib performance for new archs
  - sw64: remove unnecessary parameter passing
  - sw64: add __vdso_getcpu support
  - sw64: kexec: fix kernel crashdump bugs
  - sw64: bpf: fix BPF_CALL address
  - sw64: fix irq work
  - sw64: reset the CSR:PTBR_USR
  - sw64: kvm: add KVM_CAP_READONLY_MEM support
  - sw64: pci: fix incorrect pointer of struct pci_controller
  - sw64: perf: add core4 pmu support
  - sw64: mm: support fdt memory reservation
  - sw64: provide a cleaner raw_smp_processor_id()
  - sw64: remove deprecated annotation in irq.h
  - sw64: introduce a fine-grained intx mask/unmask system
  - sw64: move handle_intx() into pci-intx handle
  - sw64: iommu: fix NULL hose check
  - sw64: fix judgements about legacy pci support
  - sw64: cacheinfo: give preference to cache information from PPTT table
  - sw64: cache: fix shared_cpu_map of cacheinfo
  - sw64: cpu: refactor cpuinfo related code
  - sw64: cache: refactor cacheinfo related code
  - sw64: cpu: move cpu related code to the newly created cpu.c
  - sw64: topology: support initializing topology via DT or ACPI
  - sw64: spi: convert SPI_MASTER_GPIO_SS to SPI_CONTROLLER_GPIO_SS
  - sw64: defconfig: fix SPI related configuration items
  - sw64: irqchip: add version 3 for PINTC
  - sw64: fix null pointer issue when CONFIG_BUILTIN_DTB=y
  - sw64: acpi: suppress log of function acpi_numa_x2apic_affinity_init()
  - sw64: clk: further fix the clock frequency of SPI and I2C
  - sw64: smp: fix function fdt_setup_smp()
  - Revert "sw64: fdt: map physical node ID to logical node ID"
  - sw64: pci: remove legacy io reservation
  - sw64: fix LPC legacy IO space on chip junzhang and junzhang_v2
  - sw64: 6.6 upgrade
  - sw64: mm: remove legacy memory detection for JunZhang platform
  - sw64: iommu: improve iommu initialization
  - sw64: clk: fix the clock frequency of SPI and I2C
  - sw64: fix a bug in huge_pte_offset()
  - sw64: pci: rename some functions
  - sw64: pci: support PCIe controller driver based on device tree
  - sw64: remove sw64_io related functions
  - sw64: platform: add misc platform driver
  - sw64: add basic frequency scaling support for JunZhang
  - sw64: remove redundant link options
  - sw64: kvm: enable ring-based dirty page tracking
  - sw64: kvm: fix invalid memslot flags checking during dirty logging
  - sw64: pciehp: fix compile error when CONFIG_PCIE_DPC=y
  - sw64: kvm: don't retrieve memory slot again in page fault handler
  - sw64: kexec: remove code for compatibility with builtin DTB
  - sw64: smp: allow NR_CPUS less than the number detected by firmware
  - sw64: fix C4 INTx configuration
  - !14166  Align per_cpu osq_node to 64 Byte size cacheline
  - Align per_cpu osq_node to 64 Byte size cacheline
  - !14130 [virtcca] delete unused interfaces: tmi_data_destroy and tmi_ttt_unmap_range
  - virtCCA Feature: remove unused interfaces and add cpumask check
  - !14152  crypto: hisilicon/sec2 - the aead algorithm of sec2 is fixed.
  - crypto: hisilicon/trng - support to obtain random numbers from soft algorithm
  - crypto: hisilicon/sec2 - fix for aead invalid authsize
  - crypto: hisilicon/sec2 - fix for aead icv error
  - crypto: hisilicon/qm - disable error report before flr
  - !13824 mm: some mTHPs improve
  - mm: fix docs for the kernel parameter ``thp_anon=``
  - mm: count the number of anonymous THPs per size
  - mm: tidy up shmem mTHP controls and stats
  - mm: cleanup count_mthp_stat() definition
  - mm: huge_mm: fix undefined reference to `mthp_stats' for CONFIG_SYSFS=n
  - mm: override mTHP "enabled" defaults at kernel cmdline
  - !10305 [OLK-6.6] Backport bugfixes for mm LRU from Linux upstream
  - mm: vmscan.c: fix OOM on swap stress test
  - mm/gup: clear the LRU flag of a page before adding to LRU batch


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-68.0.0.72
changelog:
  - !14161  drm/rockchip: vop: Fix a dereferenced before check warning
  - drm/rockchip: vop: Fix a dereferenced before check warning
  - !14143 KVM:arm64:Add a kvm parameter to control guest wfi trapping
  - KVM:arm64:Add a kvm parameter to control guest wfi trapping
  - !14177 v2  kabi: restrict the KABI fix to a specific architecture and dist
  - kabi: enable KABI_COMPAT series by default on x86_64 & ARM64
  - kabi: restrict the KABI fix to a specific architecture and dist
  - !14151  CVE-2024-53142
  - initramfs: avoid filename buffer overrun
  - !14183  mm/dynamic_pool: use __GENKSYMS__ to revert the kabi change
  - mm/dynamic_pool: use __GENKSYMS__ to revert the kabi change
  - !13999 add iommu support for loongarch
  - LoongArch: add iommu support
  - LoongArch: Fix cpu hotplug issue
  - !13998 Synchronization with patch for loongarch virtualization
  - LoongArch: Fix AP booting issue in VM mode
  - LoongArch: KVM: Remove unnecessary CSR register saving during enter guest
  - LoongArch: KVM: Remove undefined a6 argument comment for kvm_hypercall()
  - LoongArch: KVM: Add vcpu mapping from physical cpuid
  - LoongArch: KVM: Remove unnecessary definition of KVM_PRIVATE_MEM_SLOTS
  - LoongArch: KVM: Add cpucfg area for kvm hypervisor
  - LoongArch: KVM: Add KVM hypercalls documentation for LoongArch
  - LoongArch: KVM: Implement function kvm_para_has_feature()
  - LoongArch: KVM: Enable paravirt feature control from VMM
  - LoongArch: KVM: Add PMU support for guest
  - LoongArch: KVM: Add vm migration support for LBT registers
  - LoongArch: KVM: Add Binary Translation extension support
  - LoongArch: KVM: Add VM feature detection function
  - LoongArch: Revert qspinlock to test-and-set simple lock on VM
  - LoongArch: KVM: Invalidate guest steal time address on vCPU reset
  - KVM: Discard zero mask with function kvm_dirty_ring_reset
  - perf kvm: Add kvm-stat for loongarch64
  - LoongArch: KVM: Add PV steal time support in guest side
  - LoongArch: KVM: Add PV steal time support in host side
  - LoongArch: KVM: always make pte young in page map's fast path
  - LoongArch: KVM: Mark page accessed and dirty with page ref added
  - LoongArch: KVM: Add dirty bitmap initially all set support
  - LoongArch: KVM: Add memory barrier before update pmd entry
  - LoongArch: KVM: Discard dirty page tracking on readonly memslot
  - LoongArch: KVM: Select huge page only if secondary mmu supports it
  - LoongArch: KVM: Delay secondary mmu tlb flush until guest entry
  - LoongArch: KVM: Sync pending interrupt when getting ESTAT from user mode
  - LoongArch: KVM: Add mmio trace events support
  - LoongArch: KVM: Add software breakpoint support
  - LoongArch: KVM: Add PV IPI support on guest side
  - LoongArch: KVM: Add PV IPI support on host side
  - !14163  LeapIOraid： Remove Unnecessary header file references: version.h
  - LeapIOraid： Remove Unnecessary header file references: version.h
  - !13997 Add interrupt controller emulation in the kernel
  - LoongArch: KVM: Add irqfd support
  - LoongArch: KVM: Add PCHPIC user mode read and write functions
  - LoongArch: KVM: Add PCHPIC read and write functions
  - LoongArch: KVM: Add PCHPIC device support
  - LoongArch: KVM: Add EXTIOI user mode read and write functions
  - LoongArch: KVM: Add EXTIOI read and write functions
  - LoongArch: KVM: Add EXTIOI device support
  - LoongArch: KVM: Add IPI user mode read and write function
  - LoongArch: KVM: Add IPI read and write function
  - LoongArch: KVM: Add IPI device support
  - LoongArch: KVM: Add iocsr and mmio bus simulation in kernel
  - !14111  LeapIOraid： Fix the compilation warnings in LeapIOraid driver in loongarch64
  - LeapIOraid： Fix the compilation warnings in LeapIOraid driver in loongarch64
  - !14162  LeapIOraid： Fix too many invalid interruptes in arm64
  - LeapIOraid： Fix too many invalid interruptes in arm64
  - !11509 [OLK-6.6] Enhanced Hygon processor's processing capabilities for large memory copying
  - mm: Enhanced copy capabilities for Hygon processor
  - !14155  drm/amd/display: Adjust VSDB parser for replay feature
  - drm/amd/display: Adjust VSDB parser for replay feature


author: Xie XiuQi <xiexiuqi@huawei.com> - 6.6.0-68.0.0.73
changelog:
  - kabi: add kabi_ext1 list for checking
  - check-kabi: fix kabi check failed when no namespace
  - kernel.spec: fix with_kabichk on non-arm64 platform


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-69.0.0.75
changelog:
  - !14221  KABI for cgroup
  - cgroup: add more reserve kabi
  - cgroup/cpuset: Prevent UAF in proc_cpuset_show()
  - cgroup: Move rcu_head up near the top of cgroup_root
  - cgroup: Make operations on the cgroup root_list RCU safe
  - Revert "cgroup: fix uaf when proc_cpuset_show"
  - !14220  fs: Allow fine-grained control of folio sizes
  - fs: Allow fine-grained control of folio sizes
  - !12108  include/msi: modify kabi size of msi_desc
  - include/msi: modify kabi size of msi_desc
  - !14195 [OLK-6.6]Hygon: Enable CONFIG_CMA by default on X86 architecture
  - x86/Kconfig: Select CONFIG_CMA if CONFIG_HYGON_CSV=y
  - x86/config: Enable CONFIG_CMA by default in openeuler_defconfig
  - !14215  iommu: Reserve extra KABI entry for struct iopf_group
  - iommu: Reserve extra KABI entry for struct iopf_group
  - !14223 v2  kabi: net: reserve space for xdp subsystem related structure
  - kabi: net: reserve space for xdp subsystem related structure
  - !14224  net/kabi: Reserve space for net structures
  - net/kabi: Reserve space for net structures
  - !14236 v2  statx: kabi: KABI reservation for kstat
  - statx: kabi: KABI reservation for kstat
  - !14218  seq_file: kabi: KABI reservation for seq_file
  - seq_file: kabi: KABI reservation for seq_file
  - !14203  tcp: Fix use-after-free of nreq in reqsk_timer_handler().
  - tcp: Fix use-after-free of nreq in reqsk_timer_handler().
  - !14191  nfs: fix the loss of superblock's initialized flags
  - nfs: fix the loss of superblock's initialized flags


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-72.0.0.76
changelog:
  - !14213 v2  bpf: Add kabi reserve padding for uapi struct bpf_link_info
  - bpf: Add kabi reserve padding for uapi struct bpf_link_info
  - !14225  kabi OLK-6.6 reverve space
  - kabi: reserve space for uprobes.h
  - kabi: reserve space for internal.h
  - kabi: reserve space for perf_event.h
  - !14259 【OLK-6.6】 Hygon  family 18h model 6h~fh L3 PMU config incorrect issue fix
  - perf/x86/uncore: Correct the L3 PMU config for Hygon processors
  - !14251  kabi reserver space for i2c
  - kabi reserver space for i2c
  - !14258 v2  scsi: hisi_sas: Enable force phy when SATA disk directly connected
  - scsi: hisi_sas: Enable force phy when SATA disk directly connected


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-73.0.0.77
changelog:
  - !14618  drm: zynqmp_kms: Unplug DRM device before removal
  - drm: zynqmp_kms: Unplug DRM device before removal
  - !14621  brd: defer automatic disk creation until module initialization succeeds
  - brd: defer automatic disk creation until module initialization succeeds
  - !14617  block: fix uaf for flush rq while iterating tags
  - block: fix uaf for flush rq while iterating tags
  - !14614  scsi: sg: Fix slab-use-after-free read in sg_release()
  - scsi: sg: Fix slab-use-after-free read in sg_release()
  - !14519  bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
  - bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
  - !14593  CVE-2024-56702
  - bpf: Augment raw_tp arguments with PTR_MAYBE_NULL
  - bpf: Revert "bpf: Mark raw_tp arguments with PTR_MAYBE_NULL"
  - bpf: Mark raw_tp arguments with PTR_MAYBE_NULL
  - !14415  ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
  - ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
  - !14439  sh: intc: Fix use-after-free bug in register_intc_controller()
  - sh: intc: Fix use-after-free bug in register_intc_controller()
  - !14635  Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
  - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
  - !14648  memcg: fix soft lockup in the OOM process
  - memcg: fix soft lockup in the OOM process
  - !14562  f2fs: fix to do sanity check on node blkaddr in truncate_node()
  - f2fs: fix to do sanity check on node blkaddr in truncate_node()
  - !14524  The bugfix for LPM trie
  - bpf: Handle in-place update for full LPM trie correctly
  - bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
  - !14459  sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
  - sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
  - !14454  drm/vc4: hdmi: Avoid hang with debug registers when suspended
  - drm/vc4: hdmi: Avoid hang with debug registers when suspended
  - !14385  media: imx-jpeg: Ensure power suppliers be suspended before detach them
  - media: imx-jpeg: Ensure power suppliers be suspended before detach them
  - !14546  media: wl128x: Fix atomicity violation in fmc_send_cmd()
  - media: wl128x: Fix atomicity violation in fmc_send_cmd()
  - !14244  sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
  - sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
  - !14243  sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
  - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
  - !14504  apparmor: test: Fix memory leak for aa_unpack_strdup()
  - apparmor: test: Fix memory leak for aa_unpack_strdup()
  - !14418  LoongArch: Add CPU HWMon platform driver
  - LoongArch: Add CPU HWMon platform driver
  - !14387  LoongArch: compile loongson drm driver as module
  - drm/loongson: compile loongson drm driver as module
  - LoongArch: cleanup loongson3 defconfig
  - !14441  crypto: bcm - add error check in the ahash_hmac_init function
  - crypto: bcm - add error check in the ahash_hmac_init function
  - !14438  media: imx-jpeg: Set video drvdata before register video device
  - media: imx-jpeg: Set video drvdata before register video device
  - !14389  CVE-2024-53173
  - NFSv4.0: Fix a use-after-free problem in the asynchronous open()
  - NFSv4.0: Fix the wake up of the next waiter in nfs_release_seqid()
  - Revert "NFSv4: release seqid when open failed for nfs4.0"
  - Revert "nfs: fix rpc_task use-after-free when open and close different files concurrently"
  - !14469  io_uring/tctx: work around xa_store() allocation error issue
  - io_uring/tctx: work around xa_store() allocation error issue
  - !14447  Fix CVE-2024-56744
  - f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason()
  - !14394  scsi: ufs: qcom: Only free platform MSIs when ESI is enabled
  - scsi: ufs: qcom: Only free platform MSIs when ESI is enabled
  - !14518  hfsplus: don't query the device logical block size multiple times
  - hfsplus: don't query the device logical block size multiple times
  - !14517  scsi: bfa: Fix use-after-free in bfad_im_module_exit()
  - scsi: bfa: Fix use-after-free in bfad_im_module_exit()
  - !14516  f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
  - f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
  - !14475  ext4: correct behaviors under errors=remount-ro mode
  - Revert "ext4: drop EXT4_MF_FS_ABORTED flag"
  - Revert "ext4: warn on read-only filesystem in ext4_journal_check_start()"
  - Revert "ext4: drop read-only check in ext4_init_inode_table()"
  - Revert "ext4: drop read-only check in ext4_write_inode()"
  - Revert "ext4: drop read-only check from ext4_force_commit()"
  - Revert "ext4: replace read-only check for shutdown check in mmp code"
  - Revert "ext4: don't set SB_RDONLY after filesystem errors"
  - sb_writers: fix kabi broken
  - fs: fix a hungtask problem when freeze/unfreeze fs
  - !14506  iommufd: Fix out_fput in iommufd_fault_alloc()
  - iommufd: Fix out_fput in iommufd_fault_alloc()
  - !14369  crypto: qat/qat_420xx - fix off by one in uof_get_name()
  - crypto: qat/qat_420xx - fix off by one in uof_get_name()
  - !14417 v2  drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new()
  - drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new()
  - !14423 v2  EDAC/igen6: Avoid segmentation fault on module unload
  - EDAC/igen6: Avoid segmentation fault on module unload
  - !14365  EDAC/bluefield: Fix potential integer overflow
  - EDAC/bluefield: Fix potential integer overflow
  - !14364  clk: clk-apple-nco: Add NULL check in applnco_probe
  - clk: clk-apple-nco: Add NULL check in applnco_probe
  - !14408  bpf: fix OOB devmap writes when deleting elements
  - bpf: fix OOB devmap writes when deleting elements
  - !14367  io_uring: check if iowq is killed before queuing
  - io_uring: check if iowq is killed before queuing
  - !14355  btrfs: ref-verify: fix use-after-free after invalid ref action
  - btrfs: ref-verify: fix use-after-free after invalid ref action
  - !14350  jfs: array-index-out-of-bounds fix in dtReadFirst
  - jfs: array-index-out-of-bounds fix in dtReadFirst
  - !14348  ksmbd: fix use-after-free in SMB request handling
  - ksmbd: fix use-after-free in SMB request handling
  - !14102  OLK-6.6-fix-CVE-2024-49906
  - drm/amd/display: Check null pointer before try to access it
  - drm/amd/display: Check null pointer before try to access it
  - !14346  drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
  - drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
  - !14420  HID: wacom: fix when get product name maybe null pointer
  - HID: wacom: fix when get product name maybe null pointer
  - !14301  Revert "unicode: Don't special case ignorable code points"
  - Revert "unicode: Don't special case ignorable code points"
  - !14332  mm: avoid unconditional one-tick sleep when swapcache_prepare fails
  - mm: avoid unconditional one-tick sleep when swapcache_prepare fails
  - !14362  CVE-2024-53217
  - nfsd: restore callback functionality for NFSv4.0
  - NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
  - !14319  exfat: fix out-of-bounds access of directory entries
  - exfat: fix out-of-bounds access of directory entries
  - !14405  NFSD: Prevent a potential integer overflow
  - NFSD: Prevent a potential integer overflow
  - !14395  scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
  - scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
  - !14401  gpio: grgpio: Add NULL check in grgpio_probe
  - gpio: grgpio: Add NULL check in grgpio_probe
  - !14400  bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
  - bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
  - !14329  svcrdma: Address an integer overflow
  - svcrdma: Address an integer overflow
  - !14376  fix CVE-2024-53197
  - ALSA: usb-audio: Fix a DMA to stack memory bug
  - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
  - !14206 v4  erofs/fscache/cachefiles: Add ondemand loading support
  - cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter()
  - cachefiles: Fix incorrect length return value in cachefiles_ondemand_fd_write_iter()
  - cachefiles: Clean up in cachefiles_commit_tmpfile()
  - cachefiles: Fix NULL pointer dereference in object->file
  - cachefiles: add support for buffer I/O in ondemand mode
  - fscache: clean up for fscache_clear_volume_priv
  - fscache: Add the synchronous waiting mechanism for the volume unhash in erofs ondemand mode
  - cachefiles: Introduce "dir_has_put" in cachefiles_volume
  - erofs: remove EXPERIMENTAL feature warning for fscache-based
  - cachefiles: Add restrictions to cachefiles_daemon_cull()
  - erofs: add erofs_ondemand switch
  - erofs: add erofs switch to better control it
  - fscache: modify the waiting mechanism with duplicate volumes
  - cachefiles: modify inappropriate error return value in cachefiles_daemon_secctx
  - fscache: add a memory barrier for FSCACHE_VOLUME_CREATING
  - !14377  ftrace: Fix regression with module command in stack_trace_filter
  - ftrace: Fix regression with module command in stack_trace_filter
  - !14373 [OLK-6.6]Hygon: Fix objtool warning cause by csv3_active()
  - x86: mm: Fix objtool warning about bool noinstr csv3_active()
  - !14358  firmware_loader: Fix possible resource leak in fw_log_firmware_info()
  - firmware_loader: Fix possible resource leak in fw_log_firmware_info()
  - !14342  hwmon: (nct6775-core) Fix overflows seen when writing limit attributes
  - hwmon: (nct6775-core) Fix overflows seen when writing limit attributes
  - !14271  iomap: fix zero padding data issue in concurrent append writes
  - iomap: fix zero padding data issue in concurrent append writes
  - !14340  ocfs2: free inode when ocfs2_get_init_inode() fails
  - ocfs2: free inode when ocfs2_get_init_inode() fails
  - !14312 OLK-6.6: Some patches of RDMA/hns from Linux to olk-6.6 v2
  - RDMA/hns: Fix missing flush CQE for DWQE
  - RDMA/hns: Fix warning storm caused by invalid input in IO path
  - RDMA/hns: Fix accessing invalid dip_ctx during destroying QP
  - Revert "RDMA/hns: Fix accessing invalid dip_ctx during destroying QP"
  - RDMA/hns: Fix mapping error of zero-hop WQE buffer
  - !14338  CVE-2024-53230
  - cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost()
  - cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()
  - !14336  mm: Backport mainline patch
  - mm: don't install PMD mappings when THPs are disabled by the hw/process/vma
  - mm: huge_memory: add vma_thp_disabled() and thp_disabled_by_hw()
  - mm: fix arithmetic for max_prop_frac when setting max_ratio
  - mm: fix arithmetic for bdi min_ratio
  - mm/kmemleak: fix partially freeing unknown object warning
  - mm: kmemleak: add __find_and_remove_object()
  - mm: kmemleak: use mem_pool_free() to free object
  - mm: kmemleak: split __create_object into two functions
  - mm/hugetlb: fix nodes huge page allocation when there are surplus pages
  - !14337  ALSA: usb-audio: Fix out of bounds reads when finding clock sources
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources
  - !14322  back some mainline patches for damon
  - mm/damon/core: fix return value from damos_wmark_metric_value
  - mm/damon/core: remove unnecessary si_meminfo invoke.
  - !14323  zram: fix NULL pointer in comp_algorithm_show()
  - zram: fix NULL pointer in comp_algorithm_show()
  - !14201 【OLK-6.6】  drivers: arch_topology: Refactor do-while loops
  - drivers: arch_topology: Refactor do-while loops
  - !14295  pmdomain: imx93-blk-ctrl: correct remove path
  - pmdomain: imx93-blk-ctrl: correct remove path
  - !14190  Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
  - Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
  - !14134  x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client
  - x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client
  - !14214  mm: revert "mm: shmem: fix data-race in shmem_getattr()"
  - mm: revert "mm: shmem: fix data-race in shmem_getattr()"
  - !14229 Fix extioi restart issue in vm
  - LoongArch: arch/loongarch/kvm: Fix extioi restart issue
  - !14127 MPTCP Upstream part 24
  - mptcp: refer to 'MPTCP' socket in comments
  - mptcp: add mptcp_space_from_win helper
  - mptcp: use mptcp_win_from_space helper
  - doc: new 'mptcp' page in 'networking'
  - doc: mptcp: alphabetical order
  - doc: mptcp: add missing 'available_schedulers' entry
  - selftests: mptcp: join: mark 'fastclose' tests as flaky
  - selftests: mptcp: lib: support flaky subtests
  - selftests: mptcp: export ip_mptcp to mptcp_lib
  - !13359 [OLK-6.6] [Backport] individual submission
  - MIPS: RB532: Declare prom_setup_cmdline() and rb532_gpio_init() static
  - MIPS: BCM47XX: Declare early_tlb_init() static
  - MIPS: BCM47XX: include header for bcm47xx_prom_highmem_init() prototype
  - ocfs2: spelling fix
  - !14291  vdpa: solidrun: Fix UB bug with devres
  - vdpa: solidrun: Fix UB bug with devres
  - !14256  RDMA/hns: Fix creating GSI QP in non-extended SGE QP bank
  - RDMA/hns: Fix creating GSI QP in non-extended SGE QP bank


author: Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-73.0.0.78
changelog:
  - riscv kernel upgrade to 6.6.0-73.0.0
  - Backport RISC-V AIA driver from mainline linux
  - Fix kernel-mode FPU support on riscv
  - Add cache info for SG2042 dts


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-75.0.0.79
changelog:
  - !14904  net: renesas: rswitch: avoid use-after-put for a device tree node
  - net: renesas: rswitch: avoid use-after-put for a device tree node
  - !14898  Revert "Revert "driver core: Fix uevent_show() vs driver detach race""
  - Revert "Revert "driver core: Fix uevent_show() vs driver detach race""
  - !14741  io_uring: check for overflows in io_pin_pages
  - io_uring: check for overflows in io_pin_pages
  - !14863  drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
  - drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
  - !14882  usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
  - usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
  - !14879  CVE-2024-57872
  - scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()
  - scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove()
  - scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers
  - scsi: ufs: Convert all platform drivers to return void
  - !14880  pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
  - pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
  - !14873 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.62-6.6.63 LTS Patches
  - mm/damon/core: copy nr_accesses when splitting region
  - mm/damon/core: handle zero schemes apply interval
  - mm/damon/core: check apply interval in damon_do_apply_schemes()
  - mm: refactor map_deny_write_exec()
  - mm: unconditionally close VMAs on error
  - drm/amd/pm: Vangogh: Fix kernel memory out of bounds write
  - mptcp: pm: use _rcu variant under rcu_read_lock
  - mptcp: hold pm lock when deleting entry
  - NFSD: initialize copy->cp_clp early in nfsd4_copy for use by trace point
  - lib/buildid: Fix build ID parsing logic
  - staging: vchiq_arm: Use devm_kzalloc() for vchiq_arm_state allocation
  - staging: vchiq_arm: Get the rid off struct vchiq_2835_state
  - mm/damon/core: handle zero {aggregation,ops_update} intervals
  - mm/damon/core: implement scheme-specific apply interval
  - drm/amd: Fix initialization mistake for NBIO 7.7.0
  - nouveau: fw: sync dma after setup is called.
  - drm/bridge: tc358768: Fix DSI command tx
  - mmc: sunxi-mmc: Fix A100 compatible description
  - LoongArch: Make KASAN work with 5-level page-tables
  - LoongArch: Disable KASAN if PGDIR_SIZE is too large for cpu_vabits
  - ocfs2: fix UBSAN warning in ocfs2_verify_volume()
  - ALSA: hda/realtek: fix mute/micmute LEDs for a HP EliteBook 645 G10
  - ALSA: hda/realtek - Fixed Clevo platform headset Mic issue
  - nommu: pass NULL argument to vma_iter_prealloc()
  - KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN
  - KVM: x86: Unconditionally set irr_pending when updating APICv state
  - KVM: nVMX: Treat vpid01 as current if L2 is active, but with VPID disabled
  - vdpa/mlx5: Fix PA offset with unaligned starting iotlb map
  - mm: fix NULL pointer dereference in alloc_pages_bulk_noprof
  - x86/mm: Fix a kdump kernel failure on SME system when CONFIG_IMA_KEXEC=y
  - tools/mm: fix compile error
  - ARM: 9419/1: mm: Fix kernel memory mapping for xip kernels
  - bonding: add ns target multicast address to slave device
  - net: ti: icssg-prueth: Fix 1 PPS sync
  - stmmac: dwmac-intel-plat: fix call balance of tx_clk handling routines
  - net: stmmac: rename stmmac_pltfr_remove_no_dt to stmmac_pltfr_remove
  - net: stmmac: dwmac-visconti: use devm_stmmac_probe_config_dt()
  - net: stmmac: dwmac-intel-plat: use devm_stmmac_probe_config_dt()
  - net: Make copy_safe_from_sockptr() match documentation
  - net: stmmac: dwmac-mediatek: Fix inverted handling of mediatek,mac-wol
  - samples: pktgen: correct dev to DEV
  - net: sched: cls_u32: Fix u32's systematic failure to free IDR entries for hnodes.
  - net/sched: cls_u32: replace int refcounts with proper refcounts
  - Bluetooth: btintel: Direct exception event to bluetooth stack
  - Bluetooth: hci_core: Fix calling mgmt_device_connected
  - Revert "RDMA/core: Fix ENODEV error for iWARP test over vlan"
  - virtio/vsock: Fix accept_queue memory leak
  - net/mlx5e: CT: Fix null-ptr-deref in add rule err flow
  - net/mlx5e: clear xdp features on non-uplink representors
  - net/mlx5e: kTLS, Fix incorrect page refcounting
  - net/mlx5: fs, lock FTE when checking if active
  - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
  - mptcp: error out earlier on disconnect
  - net: vertexcom: mse102x: Fix tx_bytes calculation
  - sctp: fix possible UAF in sctp_v6_available()
  - netlink: terminate outstanding dump on socket close
  - !14856  sched: psi: fix bogus pressure spikes from aggregation race
  - sched: psi: fix bogus pressure spikes from aggregation race
  - !14861  drm/sti: avoid potential dereference of error pointers
  - drm/sti: avoid potential dereference of error pointers
  - !14846  net: stmmac: fix TSO DMA API usage causing oops
  - net: stmmac: fix TSO DMA API usage causing oops
  - !14789  erofs: handle NONHEAD !delta[1
  - erofs: handle NONHEAD !delta[1] lclusters gracefully
  - !14848  LoongArch: Fix sleeping in atomic context for PREEMPT_RT
  - LoongArch: Fix sleeping in atomic context for PREEMPT_RT
  - !14840 [OLK-6.6][bugfix]Hygon: Remove 'CONFIG_' prefix under Kconfig entry HYGON_CSV
  - x86/config: Remove 'CONFIG_' prefix under Kconfig entry HYGON_CSV
  - !14690 Improve the tmpfs large folio read performance
  - mm: shmem: fallback to page size splice if large folio has poisoned pages
  - mm: shmem: improve the tmpfs large folio read performance
  - mm: shmem: update iocb->ki_pos directly to simplify tmpfs read logic
  - !14466  bpf: Call free_htab_elem() after htab_unlock_bucket()
  - bpf: Call free_htab_elem() after htab_unlock_bucket()
  - !14818  olk-6.6
  - cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()
  - !14738  LoongArch: fix some dwmac/pci/SE/i2c/interrupt issues
  - LoongArch: adjust the calc method of number of packages.
  - LoongArch: eiointc: fix ext irq route error
  - drivers/char: add ACPI firmware support for Loongson SE driver
  - LoongArch: fix i2c related issues
  - net: stmmac: dwmac-loongson: fix Mac DMA reset
  - pci/quirks: LS7A2000: fix pm transition of devices under pcie port
  - !14573  RDMA/rxe: Fix the qp flush warnings in req
  - RDMA/rxe: Fix the qp flush warnings in req
  - !14574  ALSA: pcm: Add sanity NULL check for the default mmap fault handler
  - ALSA: pcm: Add sanity NULL check for the default mmap fault handler
  - !14035  Backport fs optimizing patch from mainline
  - fs/file.c: conditionally clear full_fds
  - !14828  cgroup/cpuset: remove kernfs active break
  - cgroup/cpuset: remove kernfs active break
  - !14589  ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
  - ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
  - !14800  Bluetooth: fix use-after-free in device_for_each_child()
  - Bluetooth: fix use-after-free in device_for_each_child()
  - !14792  jfs: fix shift-out-of-bounds in dbSplit
  - jfs: fix shift-out-of-bounds in dbSplit
  - !14791  scsi: ufs: core: sysfs: Prevent div by zero
  - scsi: ufs: core: sysfs: Prevent div by zero
  - !14787  acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
  - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
  - !14786  x86/xen: don't do PV iret hypercall through hypercall page
  - x86/xen: don't do PV iret hypercall through hypercall page
  - !14785  drm/i915: Fix NULL pointer dereference in capture_engine
  - drm/i915: Fix NULL pointer dereference in capture_engine
  - !14817  olk-6.6
  - wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures
  - !14784  wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
  - wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
  - !14807  btrfs: fix use-after-free in btrfs_encoded_read_endio()
  - btrfs: fix use-after-free in btrfs_encoded_read_endio()
  - !14591  ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
  - ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
  - !14587  jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
  - jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
  - !14747  net: enetc: Do not configure preemptible TCs if SIs do not support
  - net: enetc: Do not configure preemptible TCs if SIs do not support
  - !14796  btrfs: fix use-after-free when COWing tree bock and tracing is enabled
  - btrfs: fix use-after-free when COWing tree bock and tracing is enabled
  - !14655  vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages()
  - vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages()
  - !14656  iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
  - iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
  - !14659  firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
  - firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
  - !14712  CVE-2024-56654
  - Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
  - Bluetooth: ISO: Reassociate a socket with an active BIS
  - !14761  Add Huawei Intelligent Network Card Driver:hibifur
  - Add Huawei Intelligent Network Card Driver:hibifur
  - !14772  tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
  - tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
  - !14769  svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init()
  - svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init()
  - !14770  bpf, sockmap: Several fixes to bpf_msg_pop_data
  - bpf, sockmap: Several fixes to bpf_msg_pop_data
  - !14730  sched: Fix bpf cpustats refcount leak
  - sched: Fix bpf cpustats refcount leak
  - !14739  mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
  - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
  - !14731  octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c
  - !14759  wifi: ath12k: Skip Rx TID cleanup for self peer
  - wifi: ath12k: Skip Rx TID cleanup for self peer
  - !14757  media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
  - media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
  - !14605  scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
  - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
  - !14490  nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
  - nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
  - !14489  f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
  - f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
  - !14488  ovl: Filter invalid inodes with missing lookup function
  - ovl: Filter invalid inodes with missing lookup function
  - !14486  ocfs2: fix uninitialized value in ocfs2_file_read_iter()
  - ocfs2: fix uninitialized value in ocfs2_file_read_iter()
  - !14754  i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
  - i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
  - !14776  tracing: Prevent bad count for tracing_cpumask_write
  - tracing: Prevent bad count for tracing_cpumask_write
  - !14766  drm/i915/hdcp: Add encoder check in hdcp2_get_capability
  - drm/i915/hdcp: Add encoder check in hdcp2_get_capability
  - !14765  nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
  - nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
  - !14764  octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
  - !14729  KVM: arm64: Don't retire aborted MMIO instruction
  - KVM: arm64: Don't retire aborted MMIO instruction
  - !14763  usb: musb: Fix hardware lockup on first Rx endpoint request
  - usb: musb: Fix hardware lockup on first Rx endpoint request
  - !14762  sched/numa: fix memory leak due to the overwritten vma->numab_state
  - sched/numa: fix memory leak due to the overwritten vma->numab_state
  - !14749  net/mlx5: DR, prevent potential error pointer dereference
  - net/mlx5: DR, prevent potential error pointer dereference
  - !14746  nvme-pci: fix freeing of the HMB descriptor table
  - nvme-pci: fix freeing of the HMB descriptor table
  - !14722  Bluetooth: MGMT: Fix possible deadlocks
  - Bluetooth: MGMT: Fix possible deadlocks
  - !14670  Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
  - Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
  - !14608  scsi: qla2xxx: Fix use after free on unload
  - scsi: qla2xxx: Fix use after free on unload
  - !14724  etmem: fix use-after-free of mm in the scan release process
  - etmem: fix use-after-free of mm in the scan release process
  - !14384  virtiofs: use pages instead of pointer for kernel direct IO
  - virtiofs: use pages instead of pointer for kernel direct IO
  - !14673  ALSA: 6fire: Release resources at card release
  - ALSA: 6fire: Release resources at card release
  - !14666  Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
  - Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
  - !14634  backport mainline bugfix patch
  - genirq/msi: Fix off-by-one error in msi_domain_alloc()
  - !14611  merge mainline patches into OLK-6.6
  - mm/vmscan: wake up flushers conditionally to avoid cgroup OOM
  - mm/mglru: reset page lru tier bits when activating
  - tmpfs: don't enable large folios if not supported
  - mm: migrate: annotate data-race in migrate_folio_unmap()
  - mm: Kconfig: fixup zsmalloc configuration
  - mm: ignore data-race in __swap_writepage
  - !14602  blk-cgroup: Fix UAF in blkcg_unpin_online()
  - blk-cgroup: Fix UAF in blkcg_unpin_online()
  - !14720  rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
  - rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
  - !14719  rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu
  - rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu
  - !14718  PCI: Fix reset_method_store() memory leak
  - PCI: Fix reset_method_store() memory leak
  - !14455  f2fs: fix race in concurrent f2fs_stop_gc_thread
  - f2fs: fix race in concurrent f2fs_stop_gc_thread
  - !14542  net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
  - net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
  - !14531  sched/deadline: Fix warning in migrate_enable for boosted tasks
  - sched/deadline: Fix warning in migrate_enable for boosted tasks
  - !14528  drm/amdgpu: set the right AMDGPU sg segment limitation
  - drm/amdgpu: set the right AMDGPU sg segment limitation
  - !14525  CVE-2024-56609
  - wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
  - wifi: mac80211: export ieee80211_purge_tx_queue() for drivers
  - !14667  sched: fix warning in sched_setaffinity
  - sched: fix warning in sched_setaffinity
  - !14412 [OLK-6.6]Workaround ARM PMUs cpu maps having offline cpus
  - perf arm: Workaround ARM PMUs cpu maps having offline cpus
  - !14698  bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
  - bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
  - !14694  arm64: probes: Disable kprobes/uprobes on MOPS instructions
  - arm64: probes: Disable kprobes/uprobes on MOPS instructions
  - !14677  drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
  - drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
  - !14569  PCI: Fix use-after-free of slot->bus on hot remove
  - PCI: Fix use-after-free of slot->bus on hot remove
  - !14568  wifi: ath12k: fix warning when unbinding
  - wifi: ath12k: fix warning when unbinding
  - !14424  octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c
  - !14714  Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
  - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
  - !14715  media: atomisp: Add check for rgby_data memory allocation failure
  - media: atomisp: Add check for rgby_data memory allocation failure
  - !14699  CVE-2024-53158
  - soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
  - !14710  CVE-2024-56546
  - drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend()
  - !14507  sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
  - sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
  - !14511  netfilter: nft_inner: incorrect percpu area handling under softirq
  - netfilter: nft_inner: incorrect percpu area handling under softirq
  - !14472  jfs: fix array-index-out-of-bounds in jfs_readdir
  - jfs: fix array-index-out-of-bounds in jfs_readdir
  - !14664 v2  CVE-2024-53224
  - RDMA/mlx5: Move events notifier registration to be after device registration
  - IB/mlx5: Allocate resources just before first QP/SRQ is created


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-76.0.0.80
changelog:
  - !14997  wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
  - wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
  - !14941  CVE-2024-57906
  - iio: adc: ti-ads8688: fix information leak in triggered buffer
  - !14990  mainline patches
  - cgroup/bpf: only cgroup v2 can be attached by bpf programs
  - Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"
  - cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains
  - !14993  arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
  - arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
  - !14952  drm/mediatek: Set private->all_drm_private[i
  - drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err
  - !14835 v2  media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
  - media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
  - !14994  mm/compaction: fix UBSAN shift-out-of-bounds warning
  - mm/compaction: fix UBSAN shift-out-of-bounds warning
  - !14893  btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
  - btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
  - !14876  *** jffs2: Prevent rtime decompress memory corruption ***
  - jffs2: Fix rtime decompressor
  - jffs2: Prevent rtime decompress memory corruption
  - !14833  btrfs: check folio mapping after unlock in relocate_one_folio()
  - btrfs: check folio mapping after unlock in relocate_one_folio()
  - !14588  smb: Initialize cfid->tcon before performing network ops
  - smb: Initialize cfid->tcon before performing network ops
  - !14977  PCI: imx6: Fix suspend/resume support on i.MX6QDL
  - PCI: imx6: Fix suspend/resume support on i.MX6QDL
  - !14984  vsock/bpf: return early if transport is not assigned
  - vsock/bpf: return early if transport is not assigned
  - !14976  x86/fpu: Ensure shadow stack is active before "getting" registers
  - x86/fpu: Ensure shadow stack is active before "getting" registers
  - !14682  CVE-2024-56701
  - powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore
  - !14780  CVE-2024-56677
  - powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()
  - powerpc/fadump: Refactor and prepare fadump_cma_init for late init
  - !14681  CVE-2024-56567
  - ad7780: fix division by zero in ad7780_write_raw()
  - !14981  nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
  - nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
  - !14916  CVE-2024-56641
  - net/smc: initialize close_work early to avoid warning
  - net/smc: refactoring initialization of smc sock
  - !14914  bnxt_en: Fix receive ring space parameters when XDP is active
  - bnxt_en: Fix receive ring space parameters when XDP is active
  - !14915  net/smc: protect link down work from execute after lgr freed
  - net/smc: protect link down work from execute after lgr freed
  - !14913  xsk: fix OOB map writes when deleting elements
  - xsk: fix OOB map writes when deleting elements
  - !14911  net/smc: fix LGR and link use-after-free issue
  - net/smc: fix LGR and link use-after-free issue
  - !14912  net: fix data-races around sk->sk_forward_alloc
  - net: fix data-races around sk->sk_forward_alloc
  - !14907  ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
  - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
  - !14908  net: dsa: improve shutdown sequence
  - net: dsa: improve shutdown sequence
  - !14877  sched: qos sched support online task to preempt offline task
  - sched: qos sched support online task to preempt offline task
  - !14974  BMA: Fix Oops and spin lock deadlock problem, and change the version number.
  - BMA: Fix Oops and spin lock deadlock problem, and change the version number.
  - !14973 v2  fix CVE-2024-54193
  - accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()
  - accel/ivpu: Move set autosuspend delay to HW specific code
  - !14901  Fix CVE-2024-47794
  - bpf: Fix kabi breakage in struct bpf_prog_aux
  - selftests/bpf: Add test to verify tailcall and freplace restrictions
  - selftests/bpf: Add testcase for updating attached freplace prog to prog_array map
  - bpf: Prevent tailcall infinite loop caused by freplace
  - !14874  bpf: Check size for BTF-based ctx access of pointer members
  - bpf: Check size for BTF-based ctx access of pointer members
  - !14847  bpf: put bpf_link's program when link is safe to be deallocated
  - bpf: put bpf_link's program when link is safe to be deallocated
  - !14945  btrfs: avoid NULL pointer dereference if no valid extent tree
  - btrfs: avoid NULL pointer dereference if no valid extent tree
  - !14823 mm：some shmem bugfix
  - mm: shmem: fix ShmemHugePages at swapout
  - mm: shmem: extend shmem_unused_huge_shrink() to all sizes
  - mm: shmem: fix minor off-by-one in shrinkable calculation
  - docs: mm: fix the incorrect 'FileHugeMapped' field
  - mm: shmem: fix the update of 'shmem_falloc->nr_unswapped'
  - mm: shmem: fix incorrect index alignment for within_size policy
  - !14970  drm/amd/display: Add check for granularity in dml ceil/floor helpers
  - drm/amd/display: Add check for granularity in dml ceil/floor helpers
  - !14969  topology: Keep the cpumask unchanged when printing cpumap
  - topology: Keep the cpumask unchanged when printing cpumap
  - !14935  Two CVE fixes for ksmbd
  - ksmbd: fix potencial out-of-bounds when buffer offset is invalid
  - ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
  - !14930  tracing/kprobe: Make trace_kprobe's module callback called after jump_label update
  - tracing/kprobe: Make trace_kprobe's module callback called after jump_label update
  - !14931  bpf: Fix theoretical prog_array UAF in __uprobe_perf_func()
  - bpf: Fix theoretical prog_array UAF in __uprobe_perf_func()
  - !14953  mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma
  - mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma
  - !14767 mm: shmem: control THP support through the kernel command line
  - mm: shmem: remove __shmem_huge_global_enabled()
  - mm: shmem: override mTHP shmem default with a kernel parameter
  - mm: move ``get_order_from_str()`` to internal.h
  - mm: shmem: control THP support through the kernel command line
  - !14962  memcg: fix memcg_swapmax_read() not declared warning
  - memcg: fix memcg_swapmax_read() not declared warning
  - !14944  ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
  - ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
  - !14946  swiotlb: fix swiotlb_bounce() to do partial sync's correctly
  - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices
  - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single()
  - swiotlb: fix swiotlb_bounce() to do partial sync's correctly
  - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary
  - !14897  perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG
  - perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG
  - !14920  iio: light: vcnl4035: fix information leak in triggered buffer
  - iio: light: vcnl4035: fix information leak in triggered buffer
  - !14964 v2  fix BUG: unable to handle kernel paging request in build_id_parse
  - lib/buildid: Handle memfd_secret() files in build_id_parse()
  - mm: merge folio_is_secretmem() and folio_fast_pin_allowed() into gup_fast_folio_allowed()
  - !14951  Mainline patch to olk-6.6
  - RDMA/hns: Fix UAF for cq async event
  - Revert "RDMA/hns: Fix UAF for cq async event"
  - RDMA/hns: Check atomic wr length
  - Revert "RDMA/hns: Fix a missing check of atomic wr length"
  - Revert "RDMA/hns: Check atomic wr length"
  - !14925  RDMA/hns: Fix unmatch exception handling when request_irq() fails
  - RDMA/hns: Fix unmatch exception handling when request_irq() fails
  - !14884  um: Fix potential integer overflow during physmem setup
  - um: Fix potential integer overflow during physmem setup
  - !14886  Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
  - Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
  - !14889  clk: ralink: mtmips: clock fixes for Ralink SoCs
  - clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs
  - clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883
  - !14888  usb: dwc3: gadget: Fix looping of queued SG entries
  - usb: dwc3: gadget: Fix looping of queued SG entries
  - !14924  soc: imx8m: Probe the SoC driver as platform driver
  - soc: imx8m: Probe the SoC driver as platform driver
  - !14813  drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
  - drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-77.0.0.81
changelog:
  - !15062  gpio: xilinx: Convert gpio_lock to raw spinlock
  - gpio: xilinx: Convert gpio_lock to raw spinlock
  - !15060  RDMA/hns: Fix mbox timing out by adding retry mechanism
  - RDMA/hns: Fix mbox timing out by adding retry mechanism
  - !15052 [OLK-6.6] Intel: Backport KVM Fix for Clearing SGX EDECCSSA to OLK-6.6
  - KVM: VMX: Also clear SGX EDECCSSA in KVM CPU caps when SGX is disabled
  - !15048 net: hns3: add sync command to sync io-pgtable
  - net: hns3: add sync command to sync io-pgtable
  - Revert "net: hns3: add sync command to sync io-pgtable"
  - net: hns3: fix oops when unload drivers paralleling
  - !15031  nbd: don't allow reconnect after disconnect
  - nbd: don't allow reconnect after disconnect
  - !15002  riscv: Fix sleeping in invalid context in die()
  - riscv: Fix sleeping in invalid context in die()
  - !14989  ksmbd: fix a missing return value check bug
  - ksmbd: fix a missing return value check bug
  - !15027  pinmux: Use sequential access to access desc->pinmux data
  - pinmux: Use sequential access to access desc->pinmux data
  - !14321 [OLK-6.6] rcu: Provide a boot time parameter to control lazy RCU
  - rcu: Provide a boot time parameter to control lazy RCU
  - rcu/tree: Remove superfluous return from void call_rcu* functions
  - !14900  LeapIOraid: update leapioraid driver version
  - LeapIOraid: update leapioraid driver version
  - !14325  LeapIOraid: Fix hiding ugood disk problem
  - LeapIOraid: Fix hiding ugood disk problem
  - !15016  spi: mpc52xx: Add cancel_work_sync before module remove
  - spi: mpc52xx: Add cancel_work_sync before module remove
  - !15041  gve: guard XDP xmit NDO on existence of xdp queues
  - gve: guard XDP xmit NDO on existence of xdp queues
  - !15040  gve: guard XSK operations on the existence of queues
  - gve: guard XSK operations on the existence of queues
  - !15039  mptcp: fix TCP options overflow.
  - mptcp: fix TCP options overflow.
  - !15038  net: fix memory leak in tcp_conn_request()
  - net: fix memory leak in tcp_conn_request()
  - !15037  net/smc: check smcd_v2_ext_offset when receiving proposal msg
  - net/smc: check smcd_v2_ext_offset when receiving proposal msg
  - !15036  net/smc: check return value of sock_recvmsg when draining clc data
  - net/smc: check return value of sock_recvmsg when draining clc data
  - !15025  net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg
  - net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg
  - !15019  platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it
  - platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it
  - !15020  drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
  - drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
  - !14979  igb: Fix potential invalid memory access in igb_init_module()
  - igb: Fix potential invalid memory access in igb_init_module()
  - !14963  exfat: fix the infinite loop in exfat_readdir()
  - exfat: fix the infinite loop in exfat_readdir()
  - !14988  net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
  - net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
  - !14987  workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker
  - workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker
  - !14985  i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
  - i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
  - !14892  s390/cpum_sf: Handle CPU hotplug remove during sampling
  - s390/cpum_sf: Handle CPU hotplug remove during sampling
  - !15013 v2  nilfs2: prevent use of deleted inode
  - nilfs2: prevent use of deleted inode
  - !14845  merge HULK-6.6 patches into OLK-6.6
  - mm: refactor map_deny_write_exec()
  - drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()
  - nommu: pass NULL argument to vma_iter_prealloc()
  - mm: page_alloc: move mlocked flag clearance into free_pages_prepare()
  - cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU
  - kcsan: Turn report_filterlist_lock into a raw_spinlock
  - ionic: Fix netdev notifier unregister on failure
  - !15018  misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
  - misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
  - !15009  i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
  - i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
  - !15008  nvme-rdma: unquiesce admin_q before destroy it
  - nvme-rdma: unquiesce admin_q before destroy it


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-78.0.0.83
changelog:
  - !15076 [olk 6.6] backport some feature patches for hibmcge driver
  - net: hibmcge: Add nway_reset supported in this module
  - net: hibmcge: Add reset supported in this module
  - net: hibmcge: Add pauseparam supported in this module
  - net: hibmcge: Add register dump supported in this module
  - net: hibmcge: Add unicast frame filter supported in this module
  - net: hibmcge: Add irq_info file to debugfs
  - net: hibmcge: Add debugfs supported in this module
  - lib/string_choices: Add str_true_false()/str_false_true() helper
  - !15109  net: Fix icmp host relookup triggering ip_rt_bug
  - net: Fix icmp host relookup triggering ip_rt_bug
  - !15105  ipv6: Fix soft lockups in fib6_select_path under high next hop churn
  - ipv6: Fix soft lockups in fib6_select_path under high next hop churn
  - !15106  netfilter: conntrack: clamp maximum hashtable size to INT_MAX
  - netfilter: conntrack: clamp maximum hashtable size to INT_MAX
  - !15101  net/mlx5e: Don't call cleanup on profile rollback failure
  - net/mlx5e: Don't call cleanup on profile rollback failure
  - !15103  ethtool: fail closed if we can't get max channel used in indirection tables
  - ethtool: fail closed if we can't get max channel used in indirection tables
  - !15102 v2  net: Fix CVE-2024-56658
  - net: Fix kabi breakage in struct net
  - net: defer final 'struct net' free in netns dismantle
  - !15107  netfilter: IDLETIMER: Fix for possible ABBA deadlock
  - netfilter: IDLETIMER: Fix for possible ABBA deadlock
  - !15110  net/mlx5e: Skip restore TC rules for vport rep without loaded flag
  - net/mlx5e: Skip restore TC rules for vport rep without loaded flag
  - !15111  net: wwan: t7xx: Fix FSM command timeout issue
  - net: wwan: t7xx: Fix FSM command timeout issue
  - !15112  net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
  - net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
  - !15113  sched: sch_cake: add bounds checks to host bulk flow fairness counts
  - sched: sch_cake: add bounds checks to host bulk flow fairness counts
  - !15119  mm: resolve faulty mmap_region() error path behaviour
  - mm: resolve faulty mmap_region() error path behaviour
  - !15118  iio: adc: at91: call input_free_device() on allocated iio_dev
  - iio: adc: at91: call input_free_device() on allocated iio_dev
  - !15123  mm, madvise: fix potential workingset node list_lru leaks
  - mm, madvise: fix potential workingset node list_lru leaks
  - mm: move mapping_set_update out of <linux/swap.h>
  - !15055  iomap: avoid avoid truncating 64-bit offset to 32 bits
  - iomap: avoid avoid truncating 64-bit offset to 32 bits
  - !15128  ALSA: seq: oss: Fix races at processing SysEx messages
  - ALSA: seq: oss: Fix races at processing SysEx messages
  - !14972  selinux: ignore unknown extended permissions
  - selinux: ignore unknown extended permissions
  - !15121  KVM: arm64: Get rid of userspace_irqchip_in_use
  - KVM: arm64: Get rid of userspace_irqchip_in_use
  - !13446 [OLK-6.6]crypto: montage - fix variable 'device_handle' is uninitialized warning for Mont-TSSE driver
  - crypto: montage - fix variable 'device_handle' is unintialized warning for Mont-TSSE driver
  - !15133 Upgrade Hygon HCT driver to version 0.6
  - hct: remove the unused variables from hct shared structure.
  - hct: add write support for node use of MDEV devices.
  - hct: fix vm_start issue caused by pre allocated vma changes.
  - hct: compatible with hct.ko modules in versions 0.5 and earlier.
  - hct: update pasid type from int to long.
  - hct: sharing CCP resources between host and virtual machines.
  - hct: adding node to identifies hct mdev device usage status.
  - !15083  mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation
  - mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation
  - !15080 [OLK-6.6] crypto: zhaoxin - Fix incorrect parameter in sm4 driver
  - crypto: zhaoxin - Fix incorrect parameter in sm4 driver
  - !15078 [OLK-6.6] crypto: zhaoxin - Optimize the assembly code in the SM3 driver
  - crypto: zhaoxin - Optimize the assembly code in the SM3 driver
  - !15068 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.64-6.6.66 LTS Patches
  - i3c: master: svc: fix possible assignment of the same address to two devices
  - i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin
  - serial: amba-pl011: fix build regression
  - platform/x86: asus-wmi: Fix thermal profile initialization
  - ALSA: usb-audio: Update UMP group attributes for GTB blocks, too
  - usb: dwc3: ep0: Don't reset resource alloc flag
  - drm/amdgpu: rework resume handling for display (v2)
  - ASoC: Intel: avs: Fix return status of avs_pcm_hw_constraints_init()
  - ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"
  - btrfs: add cancellation points to trim loops
  - iio: invensense: fix multiple odr switch when FIFO is off
  - xhci: dbc: Fix STALL transfer event handling
  - mm/damon/vaddr: fix issue in damon_va_evenly_split_region()
  - KVM: x86/mmu: Ensure that kvm_release_pfn_clean() takes exact pfn from kvm_faultin_pfn()
  - vfio/mlx5: Align the page tracking max message size with the device capability
  - x86: Fix build regression with CONFIG_KEXEC_JUMP enabled
  - tracing/eprobe: Fix to release eprobe when failed to add dyn_event
  - clk: en7523: Initialize num before accessing hws in en7523_register_clocks()
  - btrfs: fix missing snapshot drew unlock when root is dead during swap activation
  - setlocalversion: work around "git describe" performance
  - smb: client: don't try following DFS links in cifs_tree_connect()
  - serial: 8250_dw: Add Sophgo SG2044 quirk
  - rtc: cmos: avoid taking rtc_lock for extended period of time
  - misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
  - powerpc/prom_init: Fixup missing powermac #size-cells
  - ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 21M1CTO1WW
  - MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a
  - drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3
  - ASoC: amd: yc: fix internal mic on Redmi G 2022
  - iio: light: ltr501: Add LTER0303 to the supported devices
  - usb: chipidea: udc: handle USB Error Interrupt if IOC not set
  - fs/ntfs3: Fix case when unmarked clusters intersect with zone
  - ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[]
  - ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840
  - f2fs: fix to shrink read extent node in batches
  - f2fs: print message if fscorrupted was found in f2fs_new_node_page()
  - PCI: Add ACS quirk for Wangxun FF5xxx NICs
  - PCI: Add 'reset_subordinate' to reset hierarchy below bridge
  - PCI: Detect and trust built-in Thunderbolt chips
  - PCI: vmd: Set devices to D0 before enabling PM L1 Substates
  - PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs
  - PCI: qcom: Add support for IPQ9574
  - KMSAN: uninit-value in inode_go_dump (5)
  - verification/dot2: Improve dot parser robustness
  - smb: client: memcpy() with surrounding object base address
  - nvdimm: rectify the illogical code within nd_dax_probe()
  - thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens
  - pinctrl: qcom: spmi-mpp: Add PM8937 compatible
  - pinctrl: qcom-pmic-gpio: add support for PM8937
  - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
  - scsi: st: Don't modify unknown block number in MTIOCGET
  - leds: class: Protect brightness_show() with led_cdev->led_access mutex
  - clk: qcom: tcsrcc-sm8550: add SAR2130P support
  - clk: qcom: rpmh: add support for SAR2130P
  - clk: qcom: rcg2: add clk_rcg2_shared_floor_ops
  - scsi: lpfc: Call lpfc_sli4_queue_unset() in restart and rmmod paths
  - scsi: ufs: core: Make DMA mask configuration more flexible
  - rtla/timerlat: Make timerlat_top_cpu->*_count unsigned long long
  - tools/rtla: fix collision with glibc sched_attr/sched_set_attr
  - tracing: Use atomic64_inc_return() in trace_clock_counter()
  - tracing/ftrace: disable preemption in syscall probe
  - pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU
  - netpoll: Use rcu_access_pointer() in __netpoll_setup
  - net/neighbor: clear error in case strict check is not set
  - rocker: fix link status detection in rocker_carrier_init()
  - ASoC: hdmi-codec: reorder channel allocation list
  - Bluetooth: Set quirks for ATS2851
  - Bluetooth: Support new quirks for ATS2851
  - Bluetooth: Add new quirks for ATS2851
  - Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
  - dsa: qca8k: Use nested lock to avoid splat
  - wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
  - wifi: ipw2x00: libipw_rx_any(): fix bad alignment
  - ALSA: usb-audio: Make mic volume workarounds globally applicable
  - virtio-net: fix overflow inside virtnet_rq_alloc
  - drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov
  - fsl/fman: Validate cell-index value obtained from Device Tree
  - dma-debug: fix a possible deadlock on radix_lock
  - drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr
  - netlink: specs: Add missing bitset attrs to ethtool spec
  - drm/amdgpu: Dereference the ATCS ACPI buffer
  - drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih
  - drm/sched: memset() 'job' in drm_sched_job_init()
  - net: stmmac: Programming sequence for VLAN packets with split header
  - net: sfp: change quirks for Alcatel Lucent G-010S-P
  - drm/panel: simple: Add Microchip AC69T88A LVDS Display panel
  - fanotify: allow reporting errors on failure to open fd
  - wifi: ath5k: add PCI ID for Arcadyan devices
  - wifi: ath5k: add PCI ID for SX76X
  - net: inet6: do not leave a dangling sk pointer in inet6_create()
  - net: inet: do not leave a dangling sk pointer in inet_create()
  - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
  - net: af_can: do not leave a dangling sk pointer in can_create()
  - af_packet: avoid erroring out after sock_init_data() in packet_create()
  - net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
  - net: ethernet: fs_enet: Use %pa to format resource_size_t
  - net: fec_mpc52xx_phy: Use %pa to format resource_size_t
  - samples/bpf: Fix a resource leak
  - r8169: don't apply UDP padding quirk on RTL8126A
  - drm/display: Fix building with GCC 15
  - dlm: fix possible lkb_resource null dereference
  - drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
  - drm/mcde: Enable module autoloading
  - drm/bridge: it6505: Enable module autoloading
  - drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK
  - drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition
  - drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
  - drm/vc4: hvs: Set AXI panic modes for the HVS
  - drm/vc4: hdmi: Avoid log spam for audio start failure
  - HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support
  - selftests/resctrl: Protect against array overflow when reading strings
  - regmap: maple: Provide lockdep (sub)class for maple tree's internal lock
  - mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED
  - mmc: core: Add SD card quirk for broken poweroff notification
  - media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
  - media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
  - media: uvcvideo: RealSense D421 Depth module metadata
  - HID: add per device quirk to force bind to hid-generic
  - spi: spi-fsl-lpspi: Adjust type of scldiv
  - perf/x86/amd: Warn only on new bits set
  - ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID
  - hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list
  - kselftest/arm64: Don't leak pipe fds in pac.exec_sign_all()
  - btrfs: do not clear read-only when adding sprout device
  - btrfs: avoid unnecessary device path update for the same device
  - btrfs: don't take dev_replace rwsem on task already holding it
  - kselftest/arm64: Log fp-stress child startup errors to stdout
  - epoll: annotate racy check
  - x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables
  - kasan: make report_lock a raw spinlock
  - lib: stackinit: hide never-taken branch from compiler
  - ocfs2: update seq_file index in ocfs2_dlm_seq_next
  - mmc: core: Further prevent card detect during shutdown
  - mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet
  - regmap: detach regmap from dev on regmap_exit
  - dma-fence: Use kernel's sort for merging fences
  - dma-fence: Fix reference leak on fence merge failure path
  - dma-buf: fix dma_fence_array_signaled v4
  - x86/kexec: Restore GDT on return from ::preserve_context kexec
  - modpost: Add .irqentry.text to OTHER_SECTIONS
  - drm/amdgpu/hdp5.2: do a posting read when flushing HDP
  - drm/dp_mst: Fix resetting msg rx state after topology removal
  - drm/dp_mst: Verify request type in the corresponding down message reply
  - drm/dp_mst: Fix MST sideband message body length check
  - bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
  - smb3.1.1: fix posix mounts to older servers
  - fs/smb/client: cifs_prime_dcache() for SMB3 POSIX reparse points
  - fs/smb/client: Implement new SMB3 POSIX type
  - fs/smb/client: avoid querying SMB2_OP_QUERY_WSL_EA for SMB3 POSIX
  - scsi: ufs: core: Add missing post notify for power mode change
  - scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
  - scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
  - scsi: qla2xxx: Fix NVMe and NPIV connect issue
  - scsi: qla2xxx: Fix abort in bsg timeout
  - ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360 (NP730QFG)
  - ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook 430 G8
  - ALSA: usb-audio: add mixer mapping for Corsair HS80
  - arm64: Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit ASIDs
  - tracing: Fix cmp_entries_dup() to respect sort() comparison rules
  - can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum DS80000789E 6.
  - can: dev: can_set_termination(): allow sleeping GPIOs
  - watchdog: rti: of: honor timeout-sec property
  - LoongArch: Add architecture specific huge_pte_clear()
  - x86/CPU/AMD: WARN when setting EFER.AUTOIBRS if and only if the WRMSR fails
  - bpf: Fix exact match conditions in trie_get_next_key()
  - iio: magnetometer: yas530: use signed integer type for clamp limits
  - scatterlist: fix incorrect func name in kernel-doc
  - drm/v3d: Enable Performance Counters before clearing them
  - ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
  - scsi: scsi_debug: Fix hrtimer support for ndelay
  - ASoC: SOF: ipc3-topology: fix resource leaks in sof_ipc3_widget_setup_comp_dai()
  - ASoC: SOF: ipc3-topology: Convert the topology pin index to ALH dai index
  - tools: Override makefile ARCH variable if defined, but empty
  - ALSA: usb-audio: Notify xrun for low-latency mode
  - ALSA: seq: ump: Fix seq port updates per FB info notify
  - ALSA: ump: Update substream name from assigned FB names
  - ALSA: seq: ump: Use automatic cleanup of kfree()
  - drm/sti: Add __iomem for mixer_dbg_mxn's parameter
  - bpftool: fix potential NULL pointer dereferencing in prog_dump()
  - xsk: always clear DMA mapping information when unmapping the pool
  - bpf, vsock: Invoke proto::close on close()
  - bpf, vsock: Fix poll() missing a queue
  - scsi: ufs: core: Add ufshcd_send_bsg_uic_cmd() for UFS BSG
  - scsi: ufs: core: Always initialize the UIC done completion
  - drm/bridge: it6505: Fix inverted reset polarity
  - drm/bridge: it6505: update usleep_range for RC circuit charge time
  - i3c: master: Fix dynamic address leak when 'assigned-address' is present
  - i3c: master: Extend address status bit to 4 and add I3C_ADDR_SLOT_EXT_DESIRED
  - i3c: master: Replace hard code 2 with macro I3C_ADDR_SLOT_STATUS_BITS
  - i3c: master: svc: Modify enabled_events bit 7:0 to act as IBI enable counter
  - i3c: master: svc: use slow speed for first broadcast address
  - i3c: master: support to adjust first broadcast address speed
  - i3c: master: fix kernel-doc check warning
  - i3c: master: svc: add hot join support
  - i3c: master: add enable(disable) hot join in sys entry
  - f2fs: fix to drop all discards after creating snapshot on lvm device
  - driver core: fw_devlink: Stop trying to optimize cycle detection logic
  - driver core: Add FWLINK_FLAG_IGNORE to completely ignore a fwnode link
  - driver core: fw_devlink: Improve logs for cycle detection
  - ntp: Remove invalid cast in time offset math
  - powerpc/vdso: Drop -mstack-protector-guard flags in 32-bit files with clang
  - powerpc/vdso: Refactor CFLAGS for CVDSO build
  - mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting
  - mmc: mtk-sd: fix devm_clk_get_optional usage
  - mmc: mtk-sd: Fix error handle of probe function
  - mmc: mtk-sd: use devm_mmc_alloc_host
  - usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED
  - usb: dwc3: ep0: Don't reset resource alloc flag (including ep0)
  - usb: dwc3: gadget: Rewrite endpoint allocation flow
  - soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure
  - soc: fsl: cpm1: qmc: Introduce qmc_{init,exit}_xcc() and their CPM1 version
  - soc: fsl: cpm1: qmc: Introduce qmc_init_resource() and its CPM1 version
  - soc: fsl: cpm1: qmc: Re-order probe() operations
  - soc: fsl: cpm1: qmc: Fix blank line and spaces
  - soc/fsl: cpm: qmc: Convert to platform remove callback returning void
  - serial: amba-pl011: Fix RX stall when DMA is used
  - serial: amba-pl011: Use port lock wrappers
  - xhci: Fix control transfer error on Etron xHCI host
  - xhci: Don't issue Reset Device command to Etron xHCI host
  - xhci: Combine two if statements for Etron xHCI host
  - xhci: remove XHCI_TRUST_TX_LENGTH quirk
  - xhci: Allow RPM on the USB controller (1022:43f7) by default
  - net: avoid potential UAF in default_operstate()
  - net/mlx5e: Remove workaround to avoid syndrome for internal port
  - geneve: do not assume mac header is set in geneve_xmit_skb()
  - mlxsw: spectrum_acl_flex_keys: Use correct key block on Spectrum-4
  - mlxsw: spectrum_acl_flex_keys: Constify struct mlxsw_afk_element_inst
  - mlxsw: Mark high entropy key blocks
  - mlxsw: Edit IPv6 key blocks to use one less block for multicast forwarding
  - mlxsw: spectrum_acl_flex_keys: Add 'ipv4_5b' flex key
  - mlxsw: Add 'ipv4_5' flex key
  - ethtool: Fix wrong mod state in case of verbose and no_mask bitset
  - netfilter: nft_set_hash: skip duplicated elements pending gc run
  - netfilter: ipset: Hold module reference while requesting a module
  - net: sched: fix erspan_opt settings in cls_flower
  - ixgbe: downgrade logging of unsupported VF API version to debug
  - ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5
  - net/qed: allow old cards not supporting "num_images" to work
  - tipc: Fix use-after-free of kernel socket in cleanup_bearer().
  - dccp: Fix memory leak in dccp_feat_change_recv
  - net/ipv6: release expired exception dst cached in socket
  - ipv6: introduce dst_rt6_info() helper
  - net-timestamp: make sk_tskey more predictable in error path
  - platform/x86: asus-wmi: Ignore return value when writing thermal policy
  - platform/x86: asus-wmi: Fix inconsistent use of thermal policies
  - platform/x86: asus-wmi: add support for vivobook fan profiles
  - can: j1939: j1939_session_new(): fix skb reference counting
  - net: hsr: avoid potential out-of-bound access in fill_frame_info()
  - net/sched: tbf: correct backlog statistic for GSO packets
  - ptp: Add error handling for adjfine callback in ptp_clock_adjtime
  - selftests: hid: fix typo and exit code
  - netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level
  - netfilter: x_tables: fix LED ID check in led_tg_check()
  - ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
  - can: f81604: f81604_handle_can_bus_errors(): fix {rx,tx}_errors statistics
  - can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
  - can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
  - can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
  - can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
  - can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics
  - can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics
  - can: hi311x: hi3110_can_ist(): fix potential use-after-free
  - can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL
  - can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails
  - can: gs_usb: add usb endpoint address detection at driver probe step
  - can: gs_usb: add VID/PID for Xylanta SAINT3 product family
  - watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart()
  - watchdog: apple: Actually flush writes after requesting watchdog restart
  - watchdog: xilinx_wwdt: Calculate max_hw_heartbeat_ms using clock frequency
  - iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
  - openrisc: Use asm-generic's version of fix_to_virt() & virt_to_fix()
  - Revert "x86/pvh: Set phys_base when calling xen_prepare_pvh()"
  - Revert "x86/pvh: Call C code via the kernel virtual mapping"
  - !15069  fs/proc: fix softlockup in __read_vmcore (part 2)
  - fs/proc: fix softlockup in __read_vmcore (part 2)
  - !15067  irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
  - irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
  - !15065  fix CVE-2025-21668
  - pmdomain: imx8mp-blk-ctrl: add missing loop break condition
  - !15056 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.63-6.6.64 LTS Patches
  - posix-timers: Target group sigqueue to current task only if not exiting
  - drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7
  - drm/amdgpu: fix usage slab after free
  - drm/amdkfd: Use the correct wptr size
  - drm: xlnx: zynqmp_dpsub: fix hotplug detection
  - drm/etnaviv: flush shader L1 cache after user commandstream
  - drm/mediatek: Fix child node refcount handling in early exit
  - drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check
  - udmabuf: use vmf_insert_pfn and VM_PFNMAP for handling mmap
  - powerpc: Adjust adding stack protector flags to KBUILD_CLAGS for clang
  - powerpc: Fix stack protector Kconfig test for clang
  - iio: gts: fix infinite loop for gain_to_scaletables()
  - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name()
  - iio: accel: kx022a: Fix raw read format
  - nfsd: make sure exp active before svc_export_show
  - PCI: rockchip-ep: Fix address translation unit programming
  - PCI: of_property: Assign PCI instead of CPU bus address to dynamic PCI nodes
  - dm thin: Add missing destroy_work_on_stack()
  - dm: Fix typo in error message
  - ovl: properly handle large files in ovl_security_fileattr
  - leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error paths
  - thermal: int3400: Fix reading of current_uuid for active policy
  - fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful iov_iter_zero
  - PCI: endpoint: Clear secondary (not primary) EPC in pci_epc_remove_epf()
  - PCI: keystone: Add link up check to ks_pcie_other_map_bus()
  - PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatible
  - i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled
  - scsi: ufs: exynos: Fix hibern8 notify callbacks
  - util_macros.h: fix/rework find_closest() macros
  - ceph: extract entity name from device id
  - mm/slub: Avoid list corruption when removing a slab from the full list
  - ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire()
  - ARM: 9430/1: entry: Do a dummy read from VMAP shadow
  - s390/entry: Mark IRQ entries to fix stack depot warnings
  - ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadow
  - clk: qcom: gcc-qcs404: fix initial rate of GPLL3
  - leds: lp55xx: Remove redundant test for invalid channel number
  - iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables
  - zram: clear IDLE flag after recompression
  - vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event
  - maple_tree: refine mas_store_root() on storing NULL
  - media: uvcvideo: Require entities to have a non-zero unique ID
  - media: uvcvideo: Stop stream during unregister
  - media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
  - media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
  - media: amphion: Fix pm_runtime_set_suspended() with runtime pm enabled
  - efi/libstub: Free correct pointer on failure
  - media: platform: exynos4-is: Fix an OF node reference leak in fimc_md_is_isp_available
  - media: ts2020: fix null-ptr-deref in ts2020_probe()
  - media: verisilicon: av1: Fix reference video buffer pointer assignment
  - media: i2c: tc358743: Fix crash in the probe error path when using polling
  - arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay
  - media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled
  - media: mtk-jpeg: Fix null-ptr-deref during unload module
  - media: amphion: Set video drvdata before register video device
  - arm64: dts: ti: k3-am62-verdin: Fix SD regulator startup delay
  - arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay
  - arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer
  - md/md-bitmap: Add missing destroy_work_on_stack()
  - btrfs: add a sanity check for btrfs root in btrfs_search_slot()
  - btrfs: don't loop for nowait writes when checking for cross references
  - quota: flush quota_release_work upon quota writeback
  - xfs: remove unknown compat feature check in superblock write validation
  - SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT
  - cifs: unlock on error in smb3_reconfigure()
  - cifs: during remount, make sure passwords are in sync
  - modpost: remove incorrect code in do_eisa_entry()
  - Rename .data.once to .data..once to fix resetting WARN*_ONCE
  - Rename .data.unlikely to .data..unlikely
  - init/modpost: conditionally check section mismatch to __meminit*
  - modpost: squash ALL_{INIT,EXIT}_TEXT_SECTIONS to ALL_TEXT_SECTIONS
  - modpost: use ALL_INIT_SECTIONS for the section check from DATA_SECTIONS
  - modpost: disallow the combination of EXPORT_SYMBOL and __meminit*
  - modpost: remove EXIT_SECTIONS macro
  - modpost: remove MEM_INIT_SECTIONS macro
  - modpost: disallow *driver to reference .meminit* sections
  - modpost: remove ALL_EXIT_DATA_SECTIONS macro
  - rtc: ab-eoz9: don't fail temperature reads on undervoltage notification
  - cifs: Fix parsing reparse point with native symlink in SMB1 non-UNICODE session
  - cifs: Fix parsing native symlinks relative to the export
  - smb: client: disable directory caching when dir_cache_timeout is zero
  - perf/arm-cmn: Ensure port and device id bits are set properly
  - perf/arm-smmuv3: Fix lockdep assert in ->event_init()
  - 9p/xen: fix release of IRQ
  - 9p/xen: fix init sequence
  - block: return unsigned int from bdev_io_min
  - nvme/multipath: Fix RCU list traversal to use SRCU primitive
  - nvme-multipath: avoid hang on inaccessible namespaces
  - nvme-multipath: implement "queue-depth" iopolicy
  - nvme-multipath: prepare for "queue-depth" iopolicy
  - rtc: rzn1: fix BCD to rtc_time conversion errors
  - jffs2: fix use of uninitialized variable
  - ubi: fastmap: Fix duplicate slab cache names while attaching
  - ubifs: Correct the total block count by deducting journal reservation
  - ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty
  - rtc: abx80x: Fix WDT bit position of the status register
  - rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq()
  - um: Always dump trace for specified task in show_stack
  - um: Fix the return value of elf_core_copy_task_fpregs
  - SUNRPC: make sure cache entry active before cache_show
  - ipc: fix memleak if msg_init_ns failed in create_ipc_ns
  - lib: string_helpers: silence snprintf() output truncation warning
  - ublk: fix error code for unsupported command
  - usb: dwc3: gadget: Fix checking for number of TRBs left
  - smb: During unmount, ensure all cached dir instances drop their dentry
  - smb: prevent use-after-free due to open_cached_dir error paths
  - smb: Don't leak cfid when reconnect races with open_cached_dir
  - smb: client: handle max length for SMB symlinks
  - smb3: request handle caching when caching directories
  - ALSA: hda/realtek: Apply quirk for Medion E15433
  - ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max
  - ALSA: hda/realtek: Set PCBeep to default value for ALC274
  - ALSA: hda/realtek: Update ALC225 depop procedure
  - ALSA: ump: Fix evaluation of MIDI 1.0 FB info
  - media: v4l2-core: v4l2-dv-timings: check cvt/gtf result
  - soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting()
  - HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
  - blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long
  - block: fix ordering between checking BLK_MQ_S_STOPPED request adding
  - block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding
  - block: fix missing dispatching request when queue is started or unquiesced
  - arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
  - ublk: fix ublk_ch_mmap() for 64K page size
  - iio: gts: Fix uninitialized symbol 'ret'
  - um: vector: Do not use drvdata in release
  - serial: 8250: omap: Move pm_runtime_get_sync
  - serial: 8250_fintek: Add support for F81216E
  - dt-bindings: serial: rs485: Fix rs485-rts-delay property
  - um: net: Do not use drvdata in release
  - um: ubd: Do not use drvdata in release
  - ubi: wl: Put source PEB into correct list if trying locking LEB failed
  - platform/chrome: cros_ec_typec: fix missing fwnode reference decrement
  - smb: client: fix NULL ptr deref in crypto_aead_setkey()
  - parisc/ftrace: Fix function graph tracing disablement
  - cifs: support mounting with alternate password to allow password rotation
  - cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power()
  - mtd: spi-nor: core: replace dummy buswidth from addr to data
  - spi: Fix acpi deferred irq probe
  - netfilter: ipset: add missing range check in bitmap_ip_uadt
  - gpio: exar: set value when external pull-up or pull-down is present
  - Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit"
  - serial: sh-sci: Clean sci_ports[0] after at earlycon exit
  - Revert "usb: gadget: composite: fix OS descriptors w_value logic"
  - wifi: brcmfmac: release 'root' node in all execution paths
  - wifi: ath12k: fix crash when unbinding
  - ARM: dts: omap36xx: declare 1GHz OPP as turbo again
  - usb: xhci: Fix TD invalidation under pending Set TR Dequeue
  - Compiler Attributes: disable __counted_by for clang < 19.1.3
  - Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
  - exfat: fix uninit-value in __exfat_get_dentry_set
  - dt-bindings: iio: dac: ad3552r: fix maximum spi speed
  - pinctrl: qcom: spmi: fix debugfs drive strength
  - tools/nolibc: s390: include std.h
  - locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass()
  - tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
  - comedi: Flush partial mappings in error case
  - fsnotify: fix sending inotify event with unexpected filename
  - KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status
  - KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR
  - powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector
  - KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE
  - crypto: x86/aegis128 - access 32-bit arguments as 32-bit
  - perf/x86/intel/pt: Fix buffer full but size is 0 case
  - ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
  - ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00
  - jfs: xattr: check invalid xattr size more strictly
  - ext4: fix FS_IOC_GETFSMAP handling
  - ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
  - soc: qcom: socinfo: fix revision check in qcom_socinfo_probe()
  - ASoC: Intel: sst: Fix used of uninitialized ctx to log an error
  - arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled
  - Revert "arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled"
  - btrfs: do not BUG_ON() when freeing tree block after error
  - dm-bufio: fix warnings about duplicate slab caches
  - dm-cache: fix warnings about duplicate slab caches
  - closures: Change BUG_ON() to WARN_ON()
  - usb: ehci-spear: fix call balance of sehci clk handling routines
  - xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
  - nvme: fix metadata handling in nvme-passthrough
  - mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable()
  - f2fs: fix fiemap failure issue when page size is 16KB
  - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru
  - ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry
  - apparmor: fix 'Do simple duplicate message elimination'
  - drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp
  - drm/radeon: Fix spurious unplug event on radeon HDMI
  - drm/radeon: change rdev->ddev to rdev_to_drm(rdev)
  - drm/radeon: add helper rdev_to_drm(rdev)
  - ALSA: hda/realtek: Update ALC256 depop procedure
  - counter: ti-ecap-capture: Add check for clk_enable()
  - counter: stm32-timer-cnt: Add check for clk_enable()
  - misc: apds990x: Fix missing pm_runtime_disable()
  - USB: chaoskey: Fix possible deadlock chaoskey_list_lock
  - USB: chaoskey: fail open after removal
  - usb: yurex: make waiting on yurex_write interruptible
  - usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
  - iio: light: al3010: Fix an error handling path in al3010_probe()
  - ipmr: fix tables suspicious RCU usage
  - ip6mr: fix tables suspicious RCU usage
  - rxrpc: Improve setsockopt() handling of malformed user input
  - llc: Improve setsockopt() handling of malformed user input
  - bnxt_en: Unregister PTP during PCI shutdown and suspend
  - bnxt_en: Refactor bnxt_ptp_init()
  - bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down
  - net: hsr: fix hsr_init_sk() vs network/transport headers.
  - spi: atmel-quadspi: Fix register name in verbose logging function
  - octeontx2-af: Quiesce traffic before NIX block reset
  - octeontx2-af: RPM: fix stale FCFEC counters
  - octeontx2-af: RPM: fix stale RSFEC counters
  - octeontx2-pf: Reset MAC stats during probe
  - octeontx2-af: RPM: Fix low network performance
  - octeontx2-af: RPM: Fix mismatch in lmac type
  - net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
  - marvell: pxa168_eth: fix call balance of pep->clk handling routines
  - net: mdio-ipq4019: add missing error check
  - net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged
  - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
  - net: microchip: vcap: Add typegroup table terminators in kunit tests
  - net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration
  - tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
  - net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
  - power: supply: rt9471: Use IC status regfield to report real charger status
  - power: supply: rt9471: Fix wrong WDT function regfield declaration
  - power: supply: bq27xxx: Fix registers of bq27426
  - power: supply: core: Remove might_sleep() from power_supply_put()
  - LoongArch: BPF: Sign-extend return values
  - LoongArch: Fix build failure with GCC 15 (-std=gnu23)
  - fs_parser: update mount_api doc to match function signature
  - vfio/pci: Properly hide first-in-list PCIe extended capability
  - gpio: zevio: Add missed label initialisation
  - selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels
  - vdpa/mlx5: Fix suboptimal range on iotlb iteration
  - hwmon: (tps23861) Fix reporting of negative temperatures
  - NFSD: Fix nfsd4_shutdown_copy()
  - nfsd: release svc_expkey/svc_export with rcu_work
  - NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
  - NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
  - PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio'
  - remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region
  - rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
  - remoteproc: qcom: pas: add minidump_id to SM8350 resources
  - perf trace: Avoid garbage when not printing a syscall's arguments
  - perf trace: Do not lose last events in a race
  - perf trace: Fix tracing itself, creating feedback loops
  - perf list: Fix topic and pmu_name argument order
  - m68k: coldfire/device.c: only build FEC when HW macros are defined
  - m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
  - perf trace: avoid garbage when not printing a trace event's arguments
  - f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode
  - PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds
  - PCI: j721e: Add suspend and resume support
  - PCI: j721e: Use T_PERST_CLK_US macro
  - PCI: j721e: Add reset GPIO to struct j721e_pcie
  - PCI: cadence: Set cdns_pcie_host_init() global
  - PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup()
  - PCI: j721e: Add PCIe 4x lane selection support
  - PCI: j721e: Add per platform maximum lane settings
  - PCI: Add T_PVPERL macro
  - f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID
  - f2fs: check curseg->inited before write_sum_page in change_curseg
  - f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block
  - perf ftrace latency: Fix unit on histogram first entry when using --use-nsec
  - PCI: cpqphp: Fix PCIBIOS_* return value confusion
  - PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
  - rust: macros: fix documentation of the paste! macro
  - perf probe: Correct demangled symbols in C++ program
  - perf probe: Fix libdw memory leak
  - f2fs: fix to account dirty data in __get_secs_required()
  - f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks
  - perf test attr: Add back missing topdown events
  - perf trace: Keep exited threads for summary
  - perf stat: Fix affinity memory leaks on error path
  - perf stat: Close cork_fd when create_perf_stat_counter() failed
  - gfs2: Allow immediate GLF_VERIFY_DELETE work
  - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE
  - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw
  - perf cs-etm: Don't flush when packet_queue fills up
  - mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb()
  - smb: cached directories can be more than root file handle
  - pinctrl: k210: Undef K210_PC_DEFAULT
  - arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to cpufreq-hw
  - clk: clk-axi-clkgen: make sure to enable the AXI bus clock
  - dt-bindings: clock: axi-clkgen: include AXI clk
  - fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
  - powerpc/kexec: Fix return of uninitialized variable
  - powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
  - KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending doorbells
  - KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests
  - dax: delete a stale directory pmem
  - cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power()
  - x86/tdx: Dynamically disable SEPT violations from causing #VEs
  - x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup()
  - x86/tdx: Introduce wrappers to read and write TD metadata
  - x86/tdx: Pass TDCALL/SEAMCALL input/output registers via a structure
  - x86/tdx: Rename __tdx_module_call() to __tdcall()
  - x86/tdx: Make macros of TDCALLs consistent with the spec
  - x86/tdx: Skip saving output regs when SEAMCALL fails with VMFailInvalid
  - scsi: fusion: Remove unused variable 'rc'
  - fs/proc/kcore.c: fix coccinelle reported ERROR instances
  - mfd: rt5033: Fix missing regmap_del_irq_chip()
  - checkpatch: always parse orig_commit in fixes tag
  - checkpatch: check for missing Fixes tags
  - iommu/vt-d: Fix checks and print in pgtable_walk()
  - iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes()
  - clk: imx: imx8-acm: Fix return value check in clk_imx_acm_attach_pm_domains()
  - clk: imx: clk-scu: fix clk enable state save and restore
  - clk: imx: fracn-gppll: fix pll power up
  - clk: imx: fracn-gppll: correct PLL initialization flow
  - clk: imx: lpcg-scu: SW workaround for errata (e10858)
  - RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation
  - RDMA/rxe: Set queue pair cur_qp_state when being queried
  - clk: renesas: rzg2l: Fix FOUTPOSTDIV clk
  - clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset
  - RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
  - mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in RD_ANY_REG_OP
  - powerpc/mm/fault: Fix kfence page fault reporting
  - mtd: rawnand: atmel: Fix possible memory leak
  - mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE
  - mtd: hyperbus: rpc-if: Convert to platform remove callback returning void
  - cpufreq: loongson2: Unregister platform_driver on failure
  - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
  - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
  - mfd: da9052-spi: Change read-mask to write-mask
  - mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
  - powerpc/vdso: Flag VDSO64 entry points as functions
  - pinctrl: zynqmp: drop excess struct member description
  - trace/trace_event_perf: remove duplicate samples on the first tracepoint event
  - clk: mediatek: drop two dead config options
  - unicode: Fix utf8_load() error path
  - bpf: fix recursive lock when verdict program return SK_PASS
  - wireguard: selftests: load nf_conntrack if not present
  - netpoll: Use rcu_access_pointer() in netpoll_poll_lock
  - ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
  - ALSA: us122l: Use snd_card_free_when_closed() at disconnection
  - ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
  - net: rfkill: gpio: Add check for clk_enable()
  - bpf: Force uprobe bpf program to always return 0
  - drm/amdkfd: Fix wrong usage of INIT_WORK()
  - selftests: net: really check for bg process completion
  - ipv6: release nexthop on device removal
  - net: use unrcu_pointer() helper
  - sock_diag: allow concurrent operation in sock_diag_rcv_msg()
  - sock_diag: allow concurrent operations
  - sock_diag: add module pointer to "struct sock_diag_handler"
  - bpf, sockmap: Fix sk_msg_reset_curr
  - bpf, sockmap: Several fixes to bpf_msg_push_data
  - selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap
  - selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap
  - selftests/bpf: Fix SENDPAGE data logic in test_sockmap
  - selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap
  - netlink: typographical error in nlmsg_type constants definition
  - netfilter: nf_tables: must hold rcu read lock while iterating object type list
  - netfilter: nf_tables: skip transaction if update object is not implemented
  - netfilter: nf_tables: must hold rcu read lock while iterating expression type list
  - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion
  - netfilter: nf_tables: Introduce nf_tables_getrule_single()
  - netfilter: nf_tables: Open-code audit log call in nf_tables_getrule()
  - drm: use ATOMIC64_INIT() for atomic64_t
  - drm/vkms: Drop unnecessary call to drm_crtc_cleanup()
  - bpf, bpftool: Fix incorrect disasm pc
  - drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk()
  - wifi: wfx: Fix error handling in wfx_core_init()
  - drm/etnaviv: hold GPU lock across perfmon sampling
  - drm/etnaviv: Request pages from DMA32 zone on addressing_limited
  - drm/msm/gpu: Check the status of registration to PM QoS
  - drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
  - bpf, arm64: Remove garbage frame for struct_ops trampoline
  - drm/panfrost: Remove unused id_mask from struct panfrost_model
  - selftests/bpf: fix test_spin_lock_fail.c's global vars usage
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c
  - drm/msm/dpu: drop LM_3 / LM_4 on MSM8998
  - drm/msm/dpu: drop LM_3 / LM_4 on SDM845
  - drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block
  - drm: fsl-dcu: enable PIXCLK on LS1021A
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
  - selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap
  - selftests/bpf: Fix msg_verify_data in test_sockmap
  - drm/bridge: tc358767: Fix link properties discovery
  - netdevsim: copy addresses for both in and out paths
  - libbpf: never interpret subprogs in .text as entry programs
  - ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c
  - libbpf: fix sym_is_subprog() logic for weak global subprogs
  - drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush
  - ice: consistently use q_idx in ice_vc_cfg_qs_msg()
  - ice: Support FCS/CRC strip disable for VF
  - virtchnl: Add CRC stripping capability
  - wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR
  - bpf: Fix the xdp_adjust_tail sample prog issue
  - libbpf: Fix expected_attach_type set handling in program load callback
  - drm/bridge: it6505: Drop EDID cache on bridge power off
  - drm/bridge: anx7625: Drop EDID cache on bridge power off
  - ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode
  - ASoC: fsl_micfil: fix regmap_write_bits usage
  - dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
  - wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2
  - wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1
  - drm/v3d: Address race-condition in MMU flush
  - drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
  - drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq()
  - wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
  - wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
  - drm/omap: Fix locking in omap_gem_new_dmabuf()
  - drm/omap: Fix possible NULL dereference
  - wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
  - drm/vc4: hvs: Correct logic on stopping an HVS channel
  - drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function
  - drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer
  - drm/vc4: hvs: Don't write gamma luts on 2711
  - drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
  - platform/x86: panasonic-laptop: Return errno correctly in show callback
  - HID: hyperv: streamline driver probe to avoid devres issues
  - arm64: dts: rockchip: correct analog audio name on Indiedroid Nova
  - selftests/resctrl: Protect against array overrun during iMC config parsing
  - selftests/resctrl: Fix memory overflow due to unhandled wraparound
  - selftests/resctrl: Refactor fill_buf functions
  - selftests/resctrl: Split fill_buf to allow tests finer-grained control
  - arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed regulators
  - arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names
  - arm64: dts: mediatek: mt6358: fix dtbs_check error
  - arm64: dts: mediatek: Add ADC node on MT6357, MT6358, MT6359 PMICs
  - arm64: dts: renesas: hihope: Drop #sound-dai-cells
  - regmap: irq: Set lockdep class for hierarchical IRQ domains
  - spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time​
  - spi: tegra210-quad: Avoid shift-out-of-bounds
  - pmdomain: ti-sci: Add missing of_node_put() for args.np
  - of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify
  - x86/of: Unconditionally call unflatten_and_copy_device_tree()
  - um: Unconditionally call unflatten_device_tree()
  - arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances
  - arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances
  - arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances
  - arm64: dts: ti: k3-j7200: Fix register map for main domain pmx
  - arm64: dts: ti: k3-j7200: use ti,j7200-padconf compatible
  - ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
  - pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle
  - arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns
  - arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns
  - arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns
  - arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns
  - regulator: rk808: Restrict DVS GPIOs to the RK808 variant only
  - arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad
  - arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4
  - arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4
  - media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call
  - tpm: fix signed/unsigned bug when checking event logs
  - efi/libstub: fix efi_parse_options() ignoring the default command line
  - openrisc: Implement fixmap to fix earlycon
  - mmc: mmc_spi: drop buggy snprintf()
  - ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode
  - arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins
  - soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
  - arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node
  - arm64: dts: mt8195: Fix dtbs_check error for mutex node
  - microblaze: Export xmb_manager functions
  - spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()
  - clocksource/drivers/timer-ti-dm: Fix child node refcount handling
  - clocksource/drivers:sp804: Make user selectable
  - kcsan, seqlock: Fix incorrect assumption in read_seqbegin()
  - kcsan, seqlock: Support seqcount_latch_t
  - time: Fix references to _msecs_to_jiffies() handling of values
  - time: Partially revert cleanup on msecs_to_jiffies() documentation
  - x86/unwind/orc: Fix unwind for newly forked tasks
  - thermal/lib: Fix memory leak on error in thermal_genl_auto()
  - tools/lib/thermal: Make more generic the command encoding function
  - rcuscale: Do a proper cleanup if kfree_scale_init() fails
  - crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
  - crypto: caam - add error check to caam_rsa_set_priv_key_form
  - hwmon: (pmbus/core) clear faults after setting smbalert mask
  - hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK
  - doc: rcu: update printed dynticks counter bits
  - crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init()
  - amd-pstate: Set min_perf to nominal_perf for active mode performance gov
  - crypto: cavium - Fix the if condition to exit loop after timeout
  - EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator
  - EDAC/skx_common: Differentiate memory error sources
  - EDAC/fsl_ddr: Fix bad bit shift operations
  - thermal: core: Initialize thermal zones before registering them
  - crypto: qat - remove faulty arbiter config reset
  - firmware: google: Unregister driver_info on failure
  - crypto: qat/qat_4xxx - fix off by one in uof_get_name()
  - crypto: qat - remove check after debugfs_create_dir()
  - crypto: caam - Fix the pointer passed to caam_qi_shutdown()
  - virtio_blk: reverse request order in virtio_queue_rqs
  - nvme-pci: reverse request order in nvme_queue_rqs
  - ext4: remove calls to to set/clear the folio error flag
  - s390/syscalls: Avoid creation of arch/arch/ directory
  - block: fix bio_split_rw_at to take zone_write_granularity into account
  - acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
  - arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG
  - m68k: mvme147: Reinstate early console
  - m68k: mvme16x: Add and use "mvme16x.h"
  - m68k: mvme147: Fix SCSI controller IRQ numbers
  - mips: asm: fix warning when disabling MIPS_FP_SUPPORT
  - x86/pvh: Call C code via the kernel virtual mapping
  - x86/pvh: Set phys_base when calling xen_prepare_pvh()
  - s390/pageattr: Implement missing kernel_page_present()
  - s390/cio: Do not unregister the subchannel based on DNV
  - kselftest/arm64: mte: fix printf type warnings about longs
  - kselftest/arm64: mte: fix printf type warnings about __u64
  - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
  - drm/amd/display: Don't refer to dc_sink in is_dsc_need_re_compute
  - x86/stackprotector: Work around strict Clang TLS symbol requirements
  - ipmr: Fix access to mfc_cache_list without lock held
  - ARM: 9420/1: smp: Fix SMP for xip kernels
  - ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry
  - LoongArch: Define a default value for VM_DATA_DEFAULT_FLAGS
  - ASoC: audio-graph-card2: Purge absent supplies for device tree nodes
  - proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
  - drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict
  - ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div()
  - ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate()
  - ASoC: amd: yc: Support dmic on another model of Lenovo Thinkpad E14 Gen 6
  - platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect fan speed
  - can: j1939: fix error in J1939 documentation.
  - tools/lib/thermal: Remove the thermal.h soft link when doing make clean
  - ASoC: tas2781: Add new driver version for tas2563 & tas2781 qfn chip
  - platform/x86: dell-wmi-base: Handle META key Lock/Unlock events
  - platform/x86: dell-smbios-base: Extends support to Alienware products
  - regulator: rk808: Add apply_bit for BUCK3 on RK809
  - firmware: arm_scmi: Reject clear channel request on A2P
  - soc: qcom: Add check devm_kasprintf() returned value
  - net: usb: qmi_wwan: add Quectel RG650V
  - bpf: fix filed access without lock
  - x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
  - ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
  - usb: typec: use cleanup facility for 'altmodes_node'
  - usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver
  - mac80211: fix user-power when emulating chanctx
  - wifi: iwlwifi: mvm: Use the sync timepoint API in suspend
  - ASoC: Intel: sst: Support LPE0F28 ACPI HID
  - ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
  - ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec
  - ASoC: codecs: rt5640: Always disable IRQs from rt5640_cancel_work()
  - wifi: radiotap: Avoid -Wflex-array-member-not-at-end warnings


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-79.0.0.84
changelog:
  - !15203  usb: cdc-acm: Check control transfer buffer size before access
  - usb: cdc-acm: Check control transfer buffer size before access
  - !15214  USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
  - USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
  - !15178 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.53-6.6.54 LTS Conflicts Patches
  - perf time-utils: Fix 32-bit nsec parsing
  - perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time
  - perf stat: Display iostat headers correctly
  - perf sched timehist: Fix missing free of session in perf_sched__timehist()
  - perf report: Fix --total-cycles --stdio output error
  - perf ui/browser/annotate: Use global annotation_options
  - perf annotate: Move some source code related fields from 'struct annotation' to 'struct annotated_source'
  - perf annotate: Split branch stack cycles info from 'struct annotation'
  - perf inject: Fix leader sampling inserting additional samples
  - perf mem: Free the allocated sort string, fixing a leak
  - !14179 [OLK-6.6] update ITMT support patch for Zhaoxin CPUs
  - cpufreq: acpi-cpufreq: Zhaoxin: fix incorrect max-freq issue
  - cpufreq: ACPI: add ITMT support when CPPC enabled
  - Revert "cpufreq: ACPI: add ITMT support when CPPC enabled"
  - !15200  arm64/mpam: Try reading again if monitor instance returns not ready
  - arm64/mpam: Try reading again if monitor instance returns not ready
  - !15197 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.68-6.6.69 LTS Patches
  - block: avoid to reuse `hctx` not removed from cpuhp callback list
  - ALSA: hda/realtek: Fix spelling mistake "Firelfy" -> "Firefly"
  - ALSA: sh: Fix wrong argument order for copy_from_iter()
  - btrfs: sysfs: fix direct super block member reads
  - btrfs: avoid monopolizing a core when activating a swap file
  - power: supply: gpio-charger: Fix set charge current limits
  - drm/amdkfd: pause autosuspend when creating pdd
  - drm/amdkfd: Use device based logging for errors
  - drm/amdkfd: drop struct kfd_cu_info
  - drm/amdkfd: reduce stack size in kfd_topology_add_device()
  - drm/amdgpu/hdp6.0: do a posting read when flushing HDP
  - drm/amdgpu/hdp5.0: do a posting read when flushing HDP
  - drm/amdgpu/hdp4.0: do a posting read when flushing HDP
  - drm/amd/amdgpu: allow use kiq to do hdp flush under sriov
  - pmdomain: core: Add missing put_device()
  - ALSA: hda/realtek: fix micmute LEDs don't work on HP Laptops
  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook X G1i
  - MIPS: mipsregs: Set proper ISA level for virt extensions
  - MIPS: Probe toolchain support of -msym32
  - blk-mq: move cpuhp callback registering out of q->sysfs_lock
  - blk-mq: register cpuhp callback after hctx is added to xarray table
  - drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()
  - spi: omap2-mcspi: Fix the IS_ERR() bug for devm_clk_get_optional_enabled()
  - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error
  - scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load time
  - spi: intel: Add Panther Lake SPI controller support
  - platform/x86: asus-nb-wmi: Ignore unknown event 0xCF
  - LoongArch: BPF: Adjust the parameter of emit_jirl()
  - LoongArch: Fix reserving screen info memory for above-4G firmware
  - regmap: Use correct format specifier for logging range errors
  - smb: server: Fix building with GCC 15
  - ALSA: sh: Use standard helper for buffer accesses
  - ALSA: hda/conexant: fix Z60MR100 startup pop issue
  - udf: Skip parent dir link count update if corrupted
  - scsi: qla1280: Fix hw revision numbering for ISP1020/1040
  - watchdog: mediatek: Add support for MT6735 TOPRGU/WDT
  - watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04
  - stddef: make __struct_group() UAPI C++-friendly
  - powerpc/pseries/vas: Add close() callback in vas_vm_ops struct
  - mtd: rawnand: fix double free in atmel_pmecc_create_user()
  - dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
  - dmaengine: apple-admac: Avoid accessing registers in probe
  - dmaengine: fsl-edma: implement the cleanup path of fsl_edma3_attach_pd()
  - dmaengine: tegra: Return correct DMA status when paused
  - dmaengine: dw: Select only supported masters for ACPI devices
  - dmaengine: mv_xor: fix child node refcount handling in early exit
  - phy: rockchip: naneng-combphy: fix phy reset
  - phy: usb: Toggle the PHY power during init
  - phy: core: Fix that API devm_phy_destroy() fails to destroy the phy
  - phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider
  - phy: core: Fix that API devm_phy_put() fails to release the phy
  - phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup()
  - phy: core: Fix an OF node refcount leakage in _of_phy_get()
  - phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP
  - mtd: rawnand: arasan: Fix missing de-registration of NAND
  - mtd: rawnand: arasan: Fix double assertion of chip-select
  - mtd: diskonchip: Cast an operand to prevent potential overflow
  - nfsd: restore callback functionality for NFSv4.0
  - nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work"
  - bpf: Check negative offsets in __bpf_skb_min_len()
  - tcp_bpf: Charge receive socket buffer in bpf_tcp_ingress()
  - mm/vmstat: fix a W=1 clang compiler warning
  - ceph: allocate sparse_ext map only for sparse reads
  - ceph: fix memory leak in ceph_direct_read_write()
  - ceph: try to allocate a smaller extent map for sparse read
  - !15190 v2  fs/resctrl: Adapt to the hardware topology structures of RDT and MPAM
  - arm64/mpam: Add write memory barrier to guarantee monitor results
  - arm64/mpam: Improve conversion accuracy between percent and fixed-point fraction
  - arm64/mpam: Fix out-of-bound access of cfg array
  - arm64/mpam: fix bug in percent_to_mbw_max()
  - arm64/mpam: fix MBA granularity conversion formula
  - arm64/mpam: Fix out-of-bound access of mbwu_state array
  - arm64/mpam: Add judgment to distinguish MSMON_MBWU_CAPTURE definition
  - arm64/mpam: Support MATA monitor feature for MPAM
  - fs/resctrl: Adapt to the hardware topology structures of RDT and MPAM
  - !15192  scsi: megaraid_sas: Fix for a potential deadlock
  - scsi: megaraid_sas: Fix for a potential deadlock
  - !15191  gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
  - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
  - !15170  The QoS feature adapts to the cfs bandwidth throttling
  - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug
  - sched/qos: Fix qos throttling in SMT expelled
  - hungtask: fixed offline group hung task issue under high load scenarios
  - !15176  virtio-blk: don't keep queue frozen during system suspend
  - virtio-blk: don't keep queue frozen during system suspend
  - !15175  block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
  - block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
  - !15167  Backport tracing fix patch
  - trace: Fix kabi breakage for trace_event_fields
  - tracing: Check "%s" dereference via the field and not the TP_printk format
  - !15181  kobject: Fix global-out-of-bounds in kobject_action_type()
  - kobject: Fix global-out-of-bounds in kobject_action_type()
  - !15184  binfmt_flat: Fix integer overflow bug on 32 bit systems
  - binfmt_flat: Fix integer overflow bug on 32 bit systems
  - !15161 Revert "irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.0"
  - Revert "irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.0"
  - !15166  tracing: Have process_string() also allow arrays
  - tracing: Have process_string() also allow arrays
  - !14939 Fix  the performance monitor  relates to core for Hygon family 18h processor
  - perf/x86/amd/core: Fix performance monitor for Hygon family 18h processor
  - !15159  mm/thp: fix deferred split unqueue naming and locking
  - mm/thp: fix deferred split unqueue naming and locking
  - !15142 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.66-6.6.68 LTS Patches
  - dt-bindings: net: fec: add pps channel property
  - drm/amdgpu: Handle NULL bo->tbo.resource (again) in amdgpu_vm_bo_update
  - net: fec: make PPS channel configurable
  - net: fec: refactor PPS channel configuration
  - io_uring/rw: avoid punting to io-wq directly
  - io_uring/rw: treat -EOPNOTSUPP for IOCB_NOWAIT like -EAGAIN
  - io_uring/rw: split io_read() into a helper
  - epoll: Add synchronous wakeup support for ep_poll_callback
  - ceph: fix memory leaks in __ceph_sync_read()
  - ceph: improve error handling and short/overflow-read logic in __ceph_sync_read()
  - ceph: validate snapdirname option length when mounting
  - of: Fix refcount leakage for OF node returned by __of_get_dma_parent()
  - of: Fix error path in of_parse_phandle_with_args_map()
  - udmabuf: also check for F_SEAL_FUTURE_WRITE
  - nilfs2: fix buffer head leaks in calls to truncate_inode_pages()
  - of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one()
  - of/irq: Fix interrupt-map cell length check in of_irq_parse_imap_parent()
  - NFS/pnfs: Fix a live lock between recalled layouts and layoutget
  - io_uring: Fix registered ring file refcount leak
  - selftests/bpf: Use asm constraint "m" for LoongArch
  - selftests/memfd: run sysctl tests when PID namespace support is enabled
  - tracing: Add "%s" check in test_event_printk()
  - tracing: Add missing helper functions in event pointer dereference check
  - tracing: Fix test_event_printk() to process entire print argument
  - smb: client: fix TCP timers deadlock after rmmod
  - Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
  - btrfs: tree-checker: reject inline extent items with 0 ref count
  - vmalloc: fix accounting with i915
  - zram: fix uninitialized ZRAM not releasing backing device
  - zram: refuse to use zero sized block device as backing device
  - hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers
  - hwmon: (tmp513) Fix Current Register value interpretation
  - hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers
  - hwmon: (tmp513) Use SI constants from units.h
  - hwmon: (tmp513) Simplify with dev_err_probe()
  - hwmon: (tmp513) Don't use "proxy" headers
  - drm/amdgpu: don't access invalid sched
  - i915/guc: Accumulate active runtime on gt reset
  - i915/guc: Ensure busyness counter increases motonically
  - i915/guc: Reset engine utilization buffer before registration
  - drm/panel: novatek-nt35950: fix return value check in nt35950_probe()
  - thunderbolt: Improve redrive mode handling
  - USB: serial: option: add Telit FE910C04 rmnet compositions
  - USB: serial: option: add MediaTek T7XX compositions
  - USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready
  - USB: serial: option: add MeiG Smart SLM770A
  - USB: serial: option: add TCL IK512 MBIM & ECM
  - hexagon: Disable constant extender optimization for LLVM prior to 19.1.0
  - efivarfs: Fix error on non-existent file
  - i2c: riic: Always round-up when calculating bus period
  - chelsio/chtls: prevent potential integer overflow on 32bit
  - net: tun: fix tun_napi_alloc_frags()
  - KVM: x86: Cache CPUID.0xD XSTATE offsets+sizes during module init
  - EDAC/amd64: Simplify ECC check on unified memory controllers
  - mmc: mtk-sd: disable wakeup in .remove() and in the error path of .probe()
  - mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk
  - net: mdiobus: fix an OF node reference leak
  - selftests: openvswitch: fix tcpdump execution
  - netfilter: ipset: Fix for recursive locking warning
  - ipvs: Fix clamp() of ip_vs_conn_tab on small memory systems
  - net: ethernet: bgmac-platform: fix an OF node reference leak
  - ksmbd: fix broken transfers when exceeding max simultaneous operations
  - ksmbd: count all requests in req_running counter
  - net: renesas: rswitch: rework ts tags management
  - ionic: use ee->offset when returning sprom data
  - netdevsim: prevent bad user input in nsim_dev_health_break_write()
  - net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()
  - net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
  - cxl/region: Fix region creation for greater than x2 switches
  - cxl/pci: Fix potential bogus return value upon successful probing
  - tools: hv: change permissions of NetworkManager configuration file
  - xfs: reset rootdir extent size hint after growfsrt
  - xfs: take m_growlock when running growfsrt
  - xfs: Fix the owner setting issue for rmap query in xfs fsmap
  - xfs: conditionally allow FS_XFLAG_REALTIME changes if S_DAX is set
  - xfs: attr forks require attr, not attr2
  - xfs: remove unused parameter in macro XFS_DQUOT_LOGRES
  - xfs: fix file_path handling in tracepoints
  - xfs: convert comma to semicolon
  - xfs: Fix xfs_prepare_shift() range for RT
  - xfs: Fix xfs_flush_unmap_range() range for RT
  - xfs: create a new helper to return a file's allocation unit
  - xfs: declare xfs_file.c symbols in xfs_file.h
  - xfs: use consistent uid/gid when grabbing dquots for inodes
  - xfs: verify buffer, inode, and dquot items every tx commit
  - xfs: fix the contact address for the sysfs ABI documentation
  - i2c: pnx: Fix timeout in wait functions
  - p2sb: Do not scan and remove the P2SB device when it is unhidden
  - p2sb: Move P2SB hide and unhide code to p2sb_scan_and_cache()
  - p2sb: Introduce the global flag p2sb_hidden_by_bios
  - p2sb: Factor out p2sb_read_from_cache()
  - platform/x86: p2sb: Make p2sb_get_devfn() return void
  - usb: cdns3: Add quirk flag to enable suspend residency
  - PCI/AER: Disable AER service on suspend
  - PCI: Use preserve_config in place of pci_flags
  - ASoC: Intel: sof_sdw: add quirk for Dell SKU 0B8C
  - ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP
  - MIPS: Loongson64: DTS: Fix msi node for ls7a
  - usb: cdns3-ti: Add workaround for Errata i2409
  - PCI: Add ACS quirk for Broadcom BCM5760X NIC
  - PCI: vmd: Create domain symlink before pci_bus_add_devices()
  - usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with iommu enabled
  - net: sched: fix ordering of qlen adjustment
  - x86/static-call: fix 32-bit build
  - x86/xen: remove hypercall page
  - x86/xen: use new hypercall functions instead of hypercall page
  - x86/xen: add central hypercall functions
  - x86/static-call: provide a way to do very early static-call updates
  - objtool/x86: allow syscall instruction
  - x86: make get_cpu_vendor() accessible from Xen code
  - xen/netfront: fix crash when removing device
  - net: rswitch: Avoid use-after-free in rswitch_poll()
  - selftests/bpf: remove use of __xlated()
  - tracing/kprobes: Skip symbol counting logic for module symbols in create_local_trace_kprobe()
  - kselftest/arm64: abi: fix SVCR detection
  - blk-iocost: Avoid using clamp() on inuse in __propagate_weights()
  - net: dsa: microchip: KSZ9896 register regmap alignment to 32 bit boundaries
  - net: renesas: rswitch: fix initial MPIC register setting
  - Bluetooth: SCO: Add support for 16 bits transparent voice setting
  - Bluetooth: iso: Fix recursive locking warning
  - ACPICA: events/evxfregn: don't release the ContextMutex that was never acquired
  - team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
  - bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
  - net/sched: netem: account for backlog updates from child qdisc
  - net: dsa: felix: fix stuck CPU-injected packets with short taprio windows
  - netfilter: nf_tables: do not defer rule destruction via call_rcu
  - net: renesas: rswitch: handle stop vs interrupt race
  - net: renesas: rswitch: fix leaked pointer on error path
  - net: renesas: rswitch: fix race window between tx start and complete
  - net: rswitch: Add jumbo frames handling for TX
  - net: rswitch: Add a setting ext descriptor function
  - net: rswitch: Add unmap_addrs instead of dma address in each desc
  - net: rswitch: Use build_skb() for RX
  - net: rswitch: Use unsigned int for desc related array index
  - net: rswitch: Drop unused argument/return value
  - Documentation: PM: Clarify pm_runtime_resume_and_get() return value
  - ASoC: amd: yc: Fix the wrong return value
  - ALSA: control: Avoid WARN() for symlink errors
  - qca_spi: Make driver probing reliable
  - qca_spi: Fix clock speed for multiple QCA7000
  - cxgb4: use port number to set mac addr
  - ACPI: resource: Fix memory resource type union access
  - net: sparx5: fix the maximum frame length register
  - net: sparx5: fix FDMA performance issue
  - spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user()
  - net: mscc: ocelot: perform error cleanup in ocelot_hwstamp_set()
  - net: mscc: ocelot: be resilient to loss of PTP packets during transmission
  - net: mscc: ocelot: ocelot->ts_id_lock and ocelot_port->tx_skbs.lock are IRQ-safe
  - net: mscc: ocelot: improve handling of TX timestamp for unknown skb
  - net: mscc: ocelot: fix memory leak on ocelot_port_add_txtstamp_skb()
  - net: lapb: increase LAPB_HEADER_LEN
  - ptp: kvm: x86: Return EOPNOTSUPP instead of ENODEV from kvm_arch_ptp_init()
  - selftests: mlxsw: sharedbuffer: Ensure no extra packets are counted
  - selftests: mlxsw: sharedbuffer: Remove duplicate test cases
  - selftests: mlxsw: sharedbuffer: Remove h1 ingress test case
  - wifi: cfg80211: sme: init n_channels before channels[] access
  - tipc: fix NULL deref in cleanup_bearer()
  - batman-adv: Do not let TT changes list grows indefinitely
  - batman-adv: Remove uninitialized data in full table TT response
  - batman-adv: Do not send uninitialized TT changes
  - amdgpu/uvd: get ring reference from rq scheduler
  - wifi: mac80211: fix station NSS capability initialization order
  - wifi: mac80211: clean up 'ret' in sta_link_apply_parameters()
  - wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon
  - rtla/timerlat: Make timerlat_hist_cpu->*_count unsigned long long
  - bpf, sockmap: Fix update element with same
  - bpf, sockmap: Fix race between element replace and close()
  - xfs: only run precommits once per transaction object
  - xfs: fix scrub tracepoints when inode-rooted btrees are involved
  - xfs: return from xfs_symlink_verify early on V4 filesystems
  - xfs: don't drop errno values when we fail to ficlone the entire range
  - xfs: update btree keys correctly when _insrec splits an inode root block
  - drm/i915: Fix memory leak by correcting cache object name in error handler
  - usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode
  - usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
  - usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe()
  - usb: typec: anx7411: fix fwnode_handle reference leak
  - usb: ehci-hcd: fix call balance of clocks handling routines
  - usb: gadget: midi2: Fix interpretation of is_midi1 bits
  - scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe
  - usb: dwc2: Fix HCD port connection race
  - usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature
  - usb: dwc2: Fix HCD resume
  - ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys()
  - usb: host: max3421-hcd: Correctly abort a USB request.
  - riscv: Fix IPIs usage in kfence_protect_page()
  - ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5
  - riscv: Fix wrong usage of __pa() on a fixmap address
  - tcp: check space before adding MPTCP SYN options
  - splice: do not checksum AF_UNIX sockets
  - ksmbd: fix racy issue from session lookup and expire
  - !15144  hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
  - hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
  - !15143  scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
  - scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
  - !15132  CVE-2024-56607 fix
  - wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask()
  - wifi: mac80211: Add non-atomic station iterator
  - !15140  iio: adc: rockchip_saradc: fix information leak in triggered buffer
  - iio: adc: rockchip_saradc: fix information leak in triggered buffer


