diff options
Diffstat (limited to 'kernel.spec')
| -rw-r--r-- | kernel.spec | 54062 |
1 files changed, 54062 insertions, 0 deletions
diff --git a/kernel.spec b/kernel.spec new file mode 100644 index 0000000..dfb9f89 --- /dev/null +++ b/kernel.spec @@ -0,0 +1,54062 @@ +%ifarch sw_64 +%define with_signmodules 0 +%define with_kabichk 0 +%else +%define with_signmodules 1 +%define with_kabichk 1 +%endif + +# Default without toolchain_clang +%bcond_with toolchain_clang + +%if %{with toolchain_clang} +%global toolchain clang +%endif + +%bcond_with clang_lto + +%if %{with clang_lto} && "%{toolchain}" != "clang" +{error:clang_lto requires --with toolchain_clang} +%endif + +%define modsign_cmd %{SOURCE10} + +%if 0%{?openEuler_sign_rsa} +# Use the open-source signature when the EBS permission is insufficient. +# Now only the admin user in EBS can send the signature request. But the +# user triggering the acces control build task and the personal build +# task is non-admin. Inorder to avoid build failures caused by failed +# signing, use the open-source signature. +# The flag_openEuler_has_sign_perm used in the rpm execution phase +# The openEuler_has_sign_perm used in the rpm execution phase + +%define openEuler_check_EBS_perm openEuler_has_sign_perm=0 \ +echo "" >> test_openEuler_sign.ko \ +sh /usr/lib/rpm/brp-ebs-sign --module test_openEuler_sign.ko || \ +[ $? -ne 2 ] && openEuler_has_sign_perm=1 \ +%global flag_openEuler_has_sign_perm $openEuler_has_sign_perm \ +rm -f test_openEuler_sign.ko test_openEuler_sign.ko.sig +%endif + +%global Arch $(echo %{_host_cpu} | sed -e s/i.86/x86/ -e s/x86_64/x86/ -e s/aarch64.*/arm64/ -e s/riscv.*/riscv/ -e s/powerpc64le/powerpc/ -e s/loongarch64/loongarch/) + +%global KernelVer %{version}-%{release}.%{_target_cpu} +%global debuginfodir /usr/lib/debug + +%global upstream_version 6.6 +%global upstream_sublevel 0 +%global devel_release 182 +%global maintenance_release .0.0 +%global pkg_release .162.20261109.3da4ab8e61ab + +%global openeuler_lts 1 +%global openeuler_major 2403 +%global openeuler_minor 1 + +# +# Support input parameter to overwrite the preceding version numbers. +# + +%bcond_with openeuler_version + +%if %{with openeuler_version} +%global openeuler_lts %{?_openeuler_lts} %{?!_openeuler_lts: 0} +%global openeuler_major %{?_openeuler_major} %{?!_openeuler_major: 0} +%global openeuler_minor %{?_openeuler_minor} %{?!_openeuler_minor: 0} +%endif + +%define with_debuginfo 1 +# Do not recompute the build-id of vmlinux in find-debuginfo.sh +%global _missing_build_ids_terminate_build 1 +%global _no_recompute_build_ids 1 +%undefine _include_minidebuginfo +%undefine _include_gdb_index +%undefine _unique_build_ids + +%define with_source 1 + +%define with_python2 0 + +# failed if there is new config options +%define listnewconfig_fail 0 + +%ifarch aarch64 +%define with_64kb %{?_with_64kb: 1} %{?!_with_64kb: 0} +%if %{with_64kb} +%global package64kb -64k +%define with_kabichk 0 +%endif +%else +%define with_64kb 0 +%endif + +#default is enabled. You can disable it with --without option +%define with_perf %{?_without_perf: 0} %{?!_without_perf: 1} + +Name: kernel%{?package64kb} +Version: %{upstream_version}.%{upstream_sublevel} +Release: %{devel_release}%{?maintenance_release}%{?pkg_release} +Summary: Linux Kernel +License: GPLv2 +URL: http://www.kernel.org/ +%global _disable_source_fetch 0 +Source0: https://raw.atomgit.com/openeuler/kernel/archive/refs/heads/%{version}-%{devel_release}%{?maintenance_release}.tar.gz#/kernel-%{version}-%{devel_release}%{?maintenance_release}.tar.gz +Source10: sign-modules +Source11: x509.genkey +Source12: extra_certificates + +%if 0%{?openEuler_sign_rsa} +Source15: openeuler_kernel_cert.cer +Source16: sign-modules-openeuler +%endif + +%if 0%{?with_kabichk} +Source18: check-kabi +Source20: Module.kabi_aarch64 +Source21: Module.kabi_x86_64 +Source22: Module.kabi_ext1_aarch64 +Source23: Module.kabi_ext1_x86_64 +Source24: Module.kabi_ext2_aarch64 +Source25: Module.kabi_ext2_x86_64 +%endif + +Source200: mkgrub-menu-aarch64.sh +Source300: extra-modules_x86_64.list +Source301: extra-modules_aarch64.list + +Source2000: cpupower.service +Source2001: cpupower.config + +%if 0%{?with_patch} +Source9000: apply-patches +Source9001: guards +Source9002: series.conf +Source9998: patches.tar.bz2 +%endif + +Patch0001: 0001-riscv-kernel.patch +Patch0002: 0002-cpupower-clang-compile-support.patch +Patch0003: 0003-x86_energy_perf_policy-clang-compile-support.patch +Patch0004: 0004-turbostat-clang-compile-support.patch + +#BuildRequires: +BuildRequires: module-init-tools, patch >= 2.5.4, bash >= 2.03, tar +BuildRequires: bzip2, xz, findutils, gzip, m4, perl, make >= 3.78, diffutils, gawk +BuildRequires: libcap-devel, libcap-ng-devel, rsync +BuildRequires: gcc >= 3.4.2, binutils >= 2.12 +BuildRequires: hostname, net-tools, bc +BuildRequires: xmlto, asciidoc +BuildRequires: openssl-devel openssl +BuildRequires: hmaccalc +BuildRequires: ncurses-devel +#BuildRequires: pesign >= 0.109-4 +BuildRequires: elfutils-libelf-devel +BuildRequires: rpm >= 4.14.2 +#BuildRequires: sparse >= 0.4.1 +%if 0%{?with_python2} +BuildRequires: python-devel +%endif + +BuildRequires: elfutils-devel zlib-devel binutils-devel newt-devel perl(ExtUtils::Embed) bison +BuildRequires: audit-libs-devel libpfm-devel libtraceevent-devel +BuildRequires: pciutils-devel gettext +BuildRequires: rpm-build, elfutils +BuildRequires: numactl-devel python3-devel glibc-static python3-docutils +BuildRequires: perl-generators perl(Carp) libunwind-devel gtk2-devel libbabeltrace-devel java-1.8.0-openjdk java-1.8.0-openjdk-devel perl-devel + +AutoReq: no +AutoProv: yes + +Conflicts: device-mapper-libs < 1.02.63-2 e2fsprogs < 1.37-4 initscripts < 7.23 iptables < 1.3.2-1 +Conflicts: ipw2200-firmware < 2.4 isdn4k-utils < 3.2-32 iwl4965-firmware < 228.57.2 jfsutils < 1.1.7-2 +Conflicts: mdadm < 3.2.1-5 nfs-utils < 1.0.7-12 oprofile < 0.9.1-2 ppp < 2.4.3-3 procps < 3.2.5-6.3 +Conflicts: reiserfs-utils < 3.6.19-2 selinux-policy-targeted < 1.25.3-14 squashfs-tools < 4.0 +Conflicts: udev < 063-6 util-linux < 2.12 wireless-tools < 29-3 xfsprogs < 2.6.13-4 + +Provides: %{name}-%{_target_cpu} = %{version}-%{release} %{name}-drm = 4.3.0 %{name}-drm-nouveau = 16 %{name}-modeset = 1 +Provides: %{name}-uname-r = %{KernelVer} %{name}=%{KernelVer} + +Requires: dracut >= 001-7 grubby >= 8.28-2 initscripts >= 8.11.1-1 linux-firmware >= 20100806-2 module-init-tools >= 3.16-2 + +ExclusiveArch: noarch aarch64 i686 x86_64 riscv64 ppc64le loongarch64 sw_64 +ExclusiveOS: Linux + +%if %{with_perf} +BuildRequires: flex xz-devel libzstd-devel +BuildRequires: java-devel +%ifarch aarch64 +BuildRequires: OpenCSD +%endif +%endif + +BuildRequires: dwarves +BuildRequires: clang >= 10.0.0 +BuildRequires: llvm +BuildRequires: llvm-devel +%if %{with clang_lto} +BuildRequires: lld +%endif + +%description +The Linux Kernel, the operating system core itself. + +%package headers +Summary: Header files for the Linux kernel for use by glibc +Obsoletes: glibc-kernheaders < 3.0-46 +Provides: glibc-kernheaders = 3.0-46 +%description headers +Kernel-headers includes the C header files that specify the interface +between the Linux kernel and userspace libraries and programs. The +header files define structures and constants that are needed for +building most standard programs and are also needed for rebuilding the +glibc package. + + +%package devel +Summary: Development package for building kernel modules to match the %{KernelVer} kernel +AutoReqProv: no +Provides: %{name}-devel-uname-r = %{KernelVer} +Provides: %{name}-devel-%{_target_cpu} = %{version}-%{release} +Requires: perl findutils + +%description devel +This package provides kernel headers and makefiles sufficient to build modules +against the %{KernelVer} kernel package. + +%package tools +Summary: Assortment of tools for the Linux kernel +Provides: %{name}-tools-libs +Obsoletes: %{name}-tools-libs +Provides: cpufreq-utils = 1:009-0.6.p1 +Provides: cpufrequtils = 1:009-0.6.p1 +Obsoletes: cpufreq-utils < 1:009-0.6.p1 +Obsoletes: cpufrequtils < 1:009-0.6.p1 +Obsoletes: cpuspeed < 1:1.5-16 +%description tools +This package contains the tools/ directory from the kernel source +and the supporting documentation. + +%package tools-devel +Summary: Assortment of tools for the Linux kernel +Requires: %{name}-tools = %{version}-%{release} +Requires: %{name}-tools-libs = %{version}-%{release} +Provides: %{name}-tools-libs-devel = %{version}-%{release} +Obsoletes: %{name}-tools-libs-devel +%description tools-devel +This package contains the development files for the tools/ directory from +the kernel source. + +%ifarch x86_64 aarch64 +%package extra-modules +Summary: Extra kernel modules to match the kernel +AutoReqProv: no +Provides: %{name}-extra-modules = %{version}-%{release} +%description extra-modules +This package contains optional modules that may be dynamically loaded but not needed for base system operation. +%endif + +%if %{with_perf} +%package -n perf +Summary: Performance monitoring for the Linux kernel +%description -n perf +This package contains the perf tool, which enables performance monitoring +of the Linux kernel. + +%if 0%{?with_python2} +%package -n python2-perf +Provides: python-perf = %{version}-%{release} +Obsoletes: python-perf +Summary: Python bindings for apps which will manipulate perf events + +%description -n python2-perf +A Python module that permits applications written in the Python programming +language to use the interface to manipulate perf events. +%endif + +%package -n python3-perf +Summary: Python bindings for apps which will manipulate perf events +%description -n python3-perf +A Python module that permits applications written in the Python programming +language to use the interface to manipulate perf events. +# with_perf +%endif + +%package -n bpftool +Summary: Inspection and simple manipulation of eBPF programs and maps +%description -n bpftool +This package contains the bpftool, which allows inspection and simple +manipulation of eBPF programs and maps. + +%package source +Summary: the kernel source +%description source +This package contains vaious source files from the kernel. + +%if 0%{?with_debuginfo} +%define _debuginfo_template %{nil} +%define _debuginfo_subpackages 0 + +%define debuginfo_template(n:) \ +%package -n %{-n*}-debuginfo\ +Summary: Debug information for package %{-n*}\ +Group: Development/Debug\ +AutoReq: 0\ +AutoProv: 1\ +%description -n %{-n*}-debuginfo\ +This package provides debug information for package %{-n*}.\ +Debug information is useful when developing applications that use this\ +package or when debugging this package.\ +%{nil} + +%debuginfo_template -n %{name} +%files -n %{name}-debuginfo -f kernel-debugfiles.list -f debugfiles.list +%{expand:%%global _find_debuginfo_opts %{?_find_debuginfo_opts} --keep-section '.BTF' -p '.*/%{KernelVer}/.*|.*/vmlinux|XXX' -o kernel-debugfiles.list} + +%debuginfo_template -n bpftool +%files -n bpftool-debuginfo -f bpftool-debugfiles.list +%{expand:%%global _find_debuginfo_opts %{?_find_debuginfo_opts} -p '.*%{_sbindir}/bpftool.*(\.debug)?|XXX' -o bpftool-debugfiles.list} + +%debuginfo_template -n %{name}-tools +%files -n %{name}-tools-debuginfo -f kernel-tools-debugfiles.list +%{expand:%%global _find_debuginfo_opts %{?_find_debuginfo_opts} -p '.*%{_bindir}/centrino-decode.*(\.debug)?|.*%{_bindir}/powernow-k8-decode.*(\.debug)?|.*%{_bindir}/cpupower.*(\.debug)?|.*%{_libdir}/libcpupower.*|.*%{_libdir}/libcpupower.*|.*%{_bindir}/turbostat.(\.debug)?|.*%{_bindir}/.*gpio.*(\.debug)?|.*%{_bindir}/.*iio.*(\.debug)?|.*%{_bindir}/tmon.*(.debug)?|XXX' -o kernel-tools-debugfiles.list} + +%if %{with_perf} +%debuginfo_template -n perf +%files -n perf-debuginfo -f perf-debugfiles.list +%{expand:%%global _find_debuginfo_opts %{?_find_debuginfo_opts} -p '.*%{_bindir}/perf.*(\.debug)?|.*%{_libexecdir}/perf-core/.*|.*%{_libdir}/traceevent/.*|XXX' -o perf-debugfiles.list} + +%if 0%{?with_python2} +%debuginfo_template -n python2-perf +%files -n python2-perf-debuginfo -f python2-perf-debugfiles.list +%{expand:%%global _find_debuginfo_opts %{?_find_debuginfo_opts} -p '.*%{python2_sitearch}/perf.*(.debug)?|XXX' -o python2-perf-debugfiles.list} +%endif + +%debuginfo_template -n python3-perf +%files -n python3-perf-debuginfo -f python3-perf-debugfiles.list +%{expand:%%global _find_debuginfo_opts %{?_find_debuginfo_opts} -p '.*%{python3_sitearch}/perf.*(.debug)?|XXX' -o python3-perf-debugfiles.list} +#with_perf +%endif + +%endif + +%prep +%setup -q -n %{name}-%{version} -c + +%if 0%{?with_patch} +tar -xjf %{SOURCE9998} +%endif + +mv kernel-%{version}-%{devel_release}%{?maintenance_release} linux-%{KernelVer} +cd linux-%{KernelVer} + +%if 0%{?with_patch} +cp %{SOURCE9000} . +cp %{SOURCE9001} . +cp %{SOURCE9002} . + +if [ ! -d patches ];then + mv ../patches . +fi + +Applypatches() +{ + set -e + set -o pipefail + local SERIESCONF=$1 + local PATCH_DIR=$2 + sed -i '/^#/d' $SERIESCONF + sed -i '/^[\s]*$/d' $SERIESCONF + ( + echo "trap 'echo \"*** patch \$_ failed ***\"' ERR" + echo "set -ex" + cat $SERIESCONF | \ + sed "s!^!patch -s -F0 -E -p1 --no-backup-if-mismatch -i $PATCH_DIR/!" \ + ) | sh +} + +Applypatches series.conf %{_builddir}/%{name}-%{version}/linux-%{KernelVer} +%endif + +# riscv-kernel patch +%ifarch riscv64 +%patch0001 -p1 +%endif + +%if "%toolchain" == "clang" +%patch0002 -p1 +%patch0003 -p1 +%patch0004 -p1 +%endif + +find . \( -name "*.orig" -o -name "*~" \) -exec rm -f {} \; >/dev/null +find . -name .gitignore -exec rm -f {} \; >/dev/null + +%if 0%{?with_signmodules} + cp %{SOURCE11} certs/. +%endif + +%if 0%{?with_source} +# Copy directory backup for kernel-source +cp -a ../linux-%{KernelVer} ../linux-%{KernelVer}-source +find ../linux-%{KernelVer}-source -type f -name "\.*" -exec rm -rf {} \; >/dev/null +%endif + +cp -a tools/perf tools/python3-perf + +%build +cd linux-%{KernelVer} + +perl -p -i -e "s/^EXTRAVERSION.*/EXTRAVERSION = -%{release}.%{_target_cpu}/" Makefile +perl -p -i -e "s/^OPENEULER_LTS.*/OPENEULER_LTS = %{openeuler_lts}/" Makefile.oever +perl -p -i -e "s/^OPENEULER_MAJOR.*/OPENEULER_MAJOR = %{openeuler_major}/" Makefile.oever +perl -p -i -e "s/^OPENEULER_MINOR.*/OPENEULER_MINOR = %{openeuler_minor}/" Makefile.oever +perl -p -i -e "s/^OPENEULER_RELEASE.*/OPENEULER_RELEASE = \"%{release}\"/" Makefile.oever + +## make linux +make mrproper %{_smp_mflags} + +%if %{with_64kb} +sed -i arch/arm64/configs/openeuler_defconfig -e 's/^CONFIG_ARM64_4K_PAGES.*/CONFIG_ARM64_64K_PAGES=y/' +%endif + +%if "%toolchain" == "clang" + +%ifarch s390x ppc64le +%global llvm_ias 0 +%else +%global llvm_ias 1 +%endif + +%global clang_make_opts HOSTCC=clang CC=clang LLVM_IAS=%{llvm_ias} + +%if %{with clang_lto} +%global clang_make_opts %{clang_make_opts} HOSTLD=ld.lld LD=ld.lld AR=llvm-ar NM=llvm-nm HOSTAR=llvm-ar HOSTNM=llvm-nm +%endif + +%endif + +%global make %{__make} %{?clang_make_opts} HOSTCFLAGS="%{?build_cflags}" HOSTLDFLAGS="%{?build_ldflags}" + +%ifarch loongarch64 + +%if 0%{with_signmodules} +echo "CONFIG_MODULE_SIG=y" >>arch/loongarch/configs/loongson3_defconfig +%endif + +%if 0%{with_debuginfo} +echo "CONFIG_DEBUG_INFO=y" >>arch/loongarch/configs/loongson3_defconfig +%endif + +make ARCH=%{Arch} loongson3_defconfig + +%else +%{make} ARCH=%{Arch} openeuler_defconfig +%endif + +%if %{with clang_lto} +scripts/config -e LTO_CLANG_FULL +sed -i 's/# CONFIG_LTO_CLANG_FULL is not set/CONFIG_LTO_CLANG_FULL=y/' .config +sed -i 's/CONFIG_LTO_NONE=y/# CONFIG_LTO_NONE is not set/' .config +%endif + +%if 0%{?openEuler_sign_rsa} + %{openEuler_check_EBS_perm} + if [ $openEuler_has_sign_perm -eq 1 ]; then + cp %{SOURCE15} ./certs/openeuler-cert.pem + # close kernel native signature + sed -i 's/CONFIG_MODULE_SIG_KEY=.*$/CONFIG_MODULE_SIG_KEY=""/g' .config + sed -i 's/CONFIG_SYSTEM_TRUSTED_KEYS=.*$/CONFIG_SYSTEM_TRUSTED_KEYS="certs\/openeuler-cert.pem"/g' .config + sed -i 's/CONFIG_MODULE_SIG_ALL=y$/CONFIG_MODULE_SIG_ALL=n/g' .config + fi +%endif + +TargetImage=$(basename $(make -s image_name)) + +%ifarch sw_64 +%{make} ARCH=%{Arch} %{?_smp_mflags} +cp vmlinux ./arch/sw_64/boot/ +cp vmlinux ./arch/sw_64/boot/vmlinux.bin +%else +%{make} ARCH=%{Arch} $TargetImage %{?_smp_mflags} +%ifarch loongarch64 +%{make} ARCH=%{Arch} vmlinuz.efi %{?_smp_mflags} +%endif +%{make} ARCH=%{Arch} modules %{?_smp_mflags} +%endif + +%if 0%{?with_kabichk} + chmod 0755 %{SOURCE18} + if [ -e $RPM_SOURCE_DIR/Module.kabi_%{_target_cpu} ]; then + %{SOURCE18} -k $RPM_SOURCE_DIR/Module.kabi_%{_target_cpu} -s Module.symvers || exit 1 + %{SOURCE18} -k $RPM_SOURCE_DIR/Module.kabi_ext1_%{_target_cpu} -s Module.symvers || exit 1 + %{SOURCE18} -k $RPM_SOURCE_DIR/Module.kabi_ext2_%{_target_cpu} -s Module.symvers || exit 1 + else + echo "**** NOTE: Cannot find reference Module.kabi file. ****" + fi +%endif + +# aarch64 make dtbs +%ifarch aarch64 riscv64 + %{make} ARCH=%{Arch} dtbs +%endif + +## make tools +%if %{with_perf} +# perf +%ifarch aarch64 +# aarch64 make perf with CORESIGHT=1 +%global perf_make \ + make %{?clang_make_opts} EXTRA_LDFLAGS="%[ "%{toolchain}" == "clang" ? "-z now" : "" ]" EXTRA_CFLAGS="%[ "%{toolchain}" == "clang" ? "" : "-Wl,-z,now" ] -g -Wall -fstack-protector-strong -fPIC" EXTRA_PERFLIBS="-fpie -pie" %{?_smp_mflags} -s V=1 WERROR=0 NO_LIBUNWIND=1 HAVE_CPLUS_DEMANGLE=1 NO_GTK2=1 NO_LIBNUMA=1 NO_STRLCPY=1 CORESIGHT=1 prefix=%{_prefix} +%else +%global perf_make \ + make %{?clang_make_opts} EXTRA_LDFLAGS="%[ "%{toolchain}" == "clang" ? "-z now" : "" ]" EXTRA_CFLAGS="%[ "%{toolchain}" == "clang" ? "" : "-Wl,-z,now" ] -g -Wall -fstack-protector-strong -fPIC" EXTRA_PERFLIBS="-fpie -pie" %{?_smp_mflags} -s V=1 WERROR=0 NO_LIBUNWIND=1 HAVE_CPLUS_DEMANGLE=1 NO_GTK2=1 NO_LIBNUMA=1 NO_STRLCPY=1 prefix=%{_prefix} +%endif +%if 0%{?with_python2} +%global perf_python2 -C tools/perf PYTHON=%{__python2} +%global perf_python3 -C tools/python3-perf PYTHON=%{__python3} +%else +%global perf_python3 -C tools/perf PYTHON=%{__python3} +%endif + +chmod +x tools/perf/check-headers.sh +# perf +%if 0%{?with_python2} +%{perf_make} %{perf_python2} all +%endif + +# make sure check-headers.sh is executable +chmod +x tools/python3-perf/check-headers.sh +%{perf_make} %{perf_python3} all + +pushd tools/perf/Documentation/ +%{make} %{?_smp_mflags} man +popd +%endif + +# bpftool +pushd tools/bpf/bpftool +%{make} +popd + +# cpupower +chmod +x tools/power/cpupower/utils/version-gen.sh +%{make} %{?_smp_mflags} -C tools/power/cpupower CPUFREQ_BENCH=false +%ifarch %{ix86} + pushd tools/power/cpupower/debug/i386 + %{make} %{?_smp_mflags} centrino-decode powernow-k8-decode + popd +%endif +%ifarch x86_64 + pushd tools/power/cpupower/debug/x86_64 + %{make} %{?_smp_mflags} centrino-decode powernow-k8-decode + popd +%endif +%ifarch %{ix86} x86_64 + pushd tools/power/x86/x86_energy_perf_policy/ + %{make} + popd + pushd tools/power/x86/turbostat + %{make} + popd +%endif +# thermal +pushd tools/thermal/tmon/ +%{make} +popd +# iio +pushd tools/iio/ +%{make} +popd +# gpio +pushd tools/gpio/ +%{make} +popd +# kvm +pushd tools/kvm/kvm_stat/ +%{make} %{?_smp_mflags} man +popd +# libbpf.a and bpf_helper_defs.h +pushd tools/lib/bpf +%{make} +popd +# netacc +pushd tools/netacc +%{make} BPFTOOL=../../tools/bpf/bpftool/bpftool +popd + +%install +%if 0%{?with_source} + %define _python_bytecompile_errors_terminate_build 0 + mkdir -p $RPM_BUILD_ROOT/usr/src/ + mv linux-%{KernelVer}-source $RPM_BUILD_ROOT/usr/src/linux-%{KernelVer} + cp linux-%{KernelVer}/.config $RPM_BUILD_ROOT/usr/src/linux-%{KernelVer}/ +%endif + +cd linux-%{KernelVer} + +## install linux + +# deal with kernel-source, now we don't need kernel-source +#mkdir $RPM_BUILD_ROOT/usr/src/linux-%{KernelVer} +#tar cf - --exclude SCCS --exclude BitKeeper --exclude .svn --exclude CVS --exclude .pc --exclude .hg --exclude .git --exclude=.tmp_versions --exclude=*vmlinux* --exclude=*.o --exclude=*.ko --exclude=*.cmd --exclude=Documentation --exclude=.config.old --exclude=.missing-syscalls.d --exclude=patches . | tar xf - -C %{buildroot}/usr/src/linux-%{KernelVer} + +mkdir -p $RPM_BUILD_ROOT/boot +dd if=/dev/zero of=$RPM_BUILD_ROOT/boot/initramfs-%{KernelVer}.img bs=1M count=20 + +%ifarch loongarch64 +strip -s vmlinux -o vmlinux.elf +install -m 755 vmlinux.elf $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer} +install -m 755 arch/loongarch/boot/vmlinuz.efi $RPM_BUILD_ROOT/boot/efi-vmlinuz-%{KernelVer} +%else +install -m 755 $(make -s image_name) $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer} +%endif + +%if 0%{?openEuler_sign_rsa} + %{openEuler_check_EBS_perm} + if [ $openEuler_has_sign_perm -eq 1 ]; then + echo "start sign" + %ifarch %arm aarch64 + gunzip -c $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}>$RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip.efi + sh /usr/lib/rpm/brp-ebs-sign --efi $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip.efi + mv $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip.efi.sig $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip.efi + mv $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip.efi $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip + gzip -c $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip>$RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer} + rm -f $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip + %endif + %ifarch x86_64 + mv $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer} $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.efi + sh /usr/lib/rpm/brp-ebs-sign --efi $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.efi + mv $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.efi.sig $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.efi + mv $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.efi $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer} + %endif + %ifarch loongarch64 + sh /usr/lib/rpm/brp-ebs-sign --efi $RPM_BUILD_ROOT/boot/efi-vmlinuz-%{KernelVer} + mv $RPM_BUILD_ROOT/boot/efi-vmlinuz-%{KernelVer}.sig $RPM_BUILD_ROOT/boot/efi-vmlinuz-%{KernelVer} + %endif + fi +%endif + +pushd $RPM_BUILD_ROOT/boot +sha512hmac ./vmlinuz-%{KernelVer} >./.vmlinuz-%{KernelVer}.hmac +popd + +install -m 644 .config $RPM_BUILD_ROOT/boot/config-%{KernelVer} +install -m 644 System.map $RPM_BUILD_ROOT/boot/System.map-%{KernelVer} + +gzip -c9 < Module.symvers > $RPM_BUILD_ROOT/boot/symvers-%{KernelVer}.gz + +mkdir -p $RPM_BUILD_ROOT%{_sbindir} +install -m 755 %{SOURCE200} $RPM_BUILD_ROOT%{_sbindir}/mkgrub-menu-%{version}-%{devel_release}%{?maintenance_release}%{?pkg_release}.sh + + +%if 0%{?with_debuginfo} + mkdir -p $RPM_BUILD_ROOT%{debuginfodir}/lib/modules/%{KernelVer} + cp vmlinux $RPM_BUILD_ROOT%{debuginfodir}/lib/modules/%{KernelVer} +%endif + +# deal with module, if not kdump +%{make} ARCH=%{Arch} INSTALL_MOD_PATH=$RPM_BUILD_ROOT modules_install KERNELRELEASE=%{KernelVer} mod-fw= +######## to collect ko to module.filelist about netwoking. block. drm. modesetting ############### +# 1. Generates extra-module.list by: +# - Processing predefined extra-modules_%{_target_cpu}.list +# 2. Creates core-module.list by comparing installed modules with extra modules +# Final output: Generates kernel-modules-filelist (core) and kernel-extra-modules-filelist +# for RPM package specification, while ensuring proper path mapping to /lib/modules/%{KernelVer}/ + +pushd $RPM_BUILD_ROOT/lib/modules/%{KernelVer} +%ifnarch x86_64 aarch64 +find -type f -name "*.ko" >modnames +%else +sed 's!^!kernel/!; s!\.ko$!!' %{_sourcedir}/extra-modules_%{_target_cpu}.list > modules-extra.list + +find -type f -name "*.ko" | sort >modnames + +grep -vFf modules-extra.list modnames > modules-core.list || true + +sed -e 's!^\.\/kernel/!/lib/modules/%{KernelVer}/kernel/!; s!\.ko$!.ko.xz!' \ + modules-core.list > %{_builddir}/%{name}-%{version}/kernel-modules-filelist + +if [ -s modules-extra.list ]; then + sed 's!^kernel/!!; s!$!.ko.xz!; s!^!/lib/modules/%{KernelVer}/kernel/!' modules-extra.list > %{_builddir}/%{name}-%{version}/kernel-extra-modules-filelist +else + echo "%ghost /nonexistent/dummy/file" > %{_builddir}/%{name}-%{version}/kernel-extra-modules-filelist +fi +%endif + +# mark modules executable so that strip-to-file can strip them +xargs --no-run-if-empty chmod u+x < modnames + +# Generate a list of modules for block and networking. + +grep -F /drivers/ modnames | xargs --no-run-if-empty nm -upA | +sed -n 's,^.*/\([^/]*\.ko\): *U \(.*\)$,\1 \2,p' > drivers.undef + +collect_modules_list() +{ + sed -r -n -e "s/^([^ ]+) \\.?($2)\$/\\1/p" drivers.undef | + LC_ALL=C sort -u > modules.$1 + if [ ! -z "$3" ]; then + sed -r -e "/^($3)\$/d" -i modules.$1 + fi +} + +collect_modules_list networking \ + 'register_netdev|ieee80211_register_hw|usbnet_probe|phy_driver_register|rt2x00(pci|usb)_probe|register_netdevice' +collect_modules_list block \ + 'ata_scsi_ioctl|scsi_add_host|scsi_add_host_with_dma|blk_alloc_queue|blk_init_queue|register_mtd_blktrans|scsi_esp_register|scsi_register_device_handler|blk_queue_physical_block_size|ahci_platform_get_resources' 'pktcdvd.ko|dm-mod.ko' +collect_modules_list drm \ + 'drm_open|drm_init' +collect_modules_list modesetting \ + 'drm_crtc_init' + +# detect missing or incorrect license tags +rm -f modinfo +while read i +do + echo -n "$i " >> modinfo + /sbin/modinfo -l $i >> modinfo +done < modnames + +grep -E -v \ + 'GPL( v2)?$|Dual BSD/GPL$|Dual MPL/GPL$|GPL and additional rights$' \ + modinfo && exit 1 + +rm -f modinfo modnames drivers.undef +%ifarch x86_64 aarch64 +rm -f modules-extra.list modules-core.list modules.list +%endif + +for i in alias alias.bin builtin.bin ccwmap dep dep.bin ieee1394map inputmap isapnpmap ofmap pcimap seriomap symbols symbols.bin usbmap +do + rm -f $RPM_BUILD_ROOT/lib/modules/$KernelVer/modules.$i +done +popd +# modsign module ko;need after find-debuginfo,strip +%define __modsign_install_post \ + if [ "%{with_signmodules}" -eq "1" ];then \ + cp certs/signing_key.pem . \ + cp certs/signing_key.x509 . \ + chmod 0755 %{modsign_cmd} \ + %{modsign_cmd} $RPM_BUILD_ROOT/lib/modules/%{KernelVer} || exit 1 \ + fi \ + find $RPM_BUILD_ROOT/lib/modules/ -type f -name '*.ko' | xargs -n1 -P`nproc --all` xz; \ +%{nil} + +%if 0%{?openEuler_sign_rsa} +%define __modsign_install_post \ + if [ "%{with_signmodules}" -eq "1" ];then \ + if [ %flag_openEuler_has_sign_perm -eq 1 ]; then \ + sh %{SOURCE16} $RPM_BUILD_ROOT/lib/modules/%{KernelVer} || exit 1 \ + else \ + cp certs/signing_key.pem . \ + cp certs/signing_key.x509 . \ + chmod 0755 %{modsign_cmd} \ + %{modsign_cmd} $RPM_BUILD_ROOT/lib/modules/%{KernelVer} || exit 1 \ + fi \ + fi \ + find $RPM_BUILD_ROOT/lib/modules/ -type f -name '*.ko' | xargs -n1 -P`nproc --all` xz; \ +%{nil} +%endif + +# deal with header +%{make} ARCH=%{Arch} INSTALL_HDR_PATH=$RPM_BUILD_ROOT/usr KBUILD_SRC= headers_install +find $RPM_BUILD_ROOT/usr/include -name "\.*" -exec rm -rf {} \; + +# dtbs install +%ifarch aarch64 + mkdir -p $RPM_BUILD_ROOT/boot/dtb-%{KernelVer} + install -m 644 $(find arch/%{Arch}/boot -name "*.dtb") $RPM_BUILD_ROOT/boot/dtb-%{KernelVer}/ + rm -f $(find arch/$Arch/boot -name "*.dtb") +%endif + +%ifarch riscv64 + %{make} ARCH=%{Arch} INSTALL_DTBS_PATH=$RPM_BUILD_ROOT/boot/dtb-%{KernelVer} dtbs_install +%endif + +# deal with vdso +%ifnarch ppc64le sw_64 +%{make} -s ARCH=%{Arch} INSTALL_MOD_PATH=$RPM_BUILD_ROOT vdso_install KERNELRELEASE=%{KernelVer} +%endif +if [ ! -s ldconfig-kernel.conf ]; then + echo "# Placeholder file, no vDSO hwcap entries used in this kernel." >ldconfig-kernel.conf +fi +install -D -m 444 ldconfig-kernel.conf $RPM_BUILD_ROOT/etc/ld.so.conf.d/kernel-%{KernelVer}.conf + +# deal with /lib/module/ path- sub path: build source kernel +rm -f $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build +rm -f $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/source +mkdir -p $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build +mkdir -p $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/extra +mkdir -p $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/updates +mkdir -p $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/weak-updates +############ to do collect devel file ######### +# 1. Makefile And Kconfig, .config sysmbol +# 2. scrpits dir +# 3. .h file +find -type f \( -name "Makefile*" -o -name "Kconfig*" \) -exec cp --parents {} $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build \; +for f in Module.symvers System.map Module.markers .config;do + test -f $f || continue + cp $f $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build +done + +cp -a scripts $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build +if [ -d arch/%{Arch}/scripts ]; then + cp -a arch/%{Arch}/scripts $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/arch/%{_arch} || : +fi +if [ -f arch/%{Arch}/*lds ]; then + cp -a arch/%{Arch}/*lds $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/arch/%{_arch}/ || : +fi +find $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/scripts/ -name "*.o" -exec rm -rf {} \; + +if [ -d arch/%{Arch}/include ]; then + cp -a --parents arch/%{Arch}/include $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/ +fi +cp -a include $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/include + +if [ -f arch/%{Arch}/kernel/module.lds ]; then + cp -a --parents arch/%{Arch}/kernel/module.lds $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/ +fi + +# module.lds is moved to scripts by commit 596b0474d3d9 in linux 5.10. +if [ -f scripts/module.lds ]; then + cp -a --parents scripts/module.lds $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/ +fi + +%ifarch aarch64 + cp -a --parents arch/arm/include/asm $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/ +%endif + +# copy objtool for kernel-devel (needed for building external modules) +if grep -q CONFIG_OBJTOOL=y .config; then + mkdir -p $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/tools/objtool + cp -a tools/objtool/objtool $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/tools/objtool +fi + +# Make sure the Makefile and version.h have a matching timestamp so that +# external modules can be built +touch -r $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/Makefile $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/include/generated/uapi/linux/version.h +touch -r $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/.config $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/include/generated/autoconf.h +# for make prepare +if [ ! -f $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/include/config/auto.conf ];then + cp .config $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build/include/config/auto.conf +fi + +mkdir -p %{buildroot}/usr/src/kernels +mv $RPM_BUILD_ROOT/lib/modules/%{KernelVer}/build $RPM_BUILD_ROOT/usr/src/kernels/%{KernelVer} + +find $RPM_BUILD_ROOT/usr/src/kernels/%{KernelVer} -name ".*.cmd" -exec rm -f {} \; + +pushd $RPM_BUILD_ROOT/lib/modules/%{KernelVer} +ln -sf /usr/src/kernels/%{KernelVer} build +ln -sf build source +popd + + +# deal with doc , now we don't need + + +# deal with kernel abi whitelists. now we don't need + + +## install tools +%if %{with_perf} +# perf +# perf tool binary and supporting scripts/binaries +%if 0%{?with_python2} +%{perf_make} %{perf_python2} DESTDIR=%{buildroot} lib=%{_lib} install-bin +%else +%{perf_make} %{perf_python3} DESTDIR=%{buildroot} lib=%{_lib} install-bin +%endif +# remove the 'trace' symlink. +rm -f %{buildroot}%{_bindir}/trace + +# remove examples +rm -rf %{buildroot}/usr/lib/perf/examples +# remove the stray header file that somehow got packaged in examples +rm -rf %{buildroot}/usr/lib/perf/include/bpf/ + +# python-perf extension +%{perf_make} %{perf_python3} DESTDIR=%{buildroot} install-python_ext +%if 0%{?with_python2} +%{perf_make} %{perf_python2} DESTDIR=%{buildroot} install-python_ext +%endif + +# perf man pages (note: implicit rpm magic compresses them later) +install -d %{buildroot}/%{_mandir}/man1 +install -pm0644 tools/kvm/kvm_stat/kvm_stat.1 %{buildroot}/%{_mandir}/man1/ +install -pm0644 tools/perf/Documentation/*.1 %{buildroot}/%{_mandir}/man1/ +%endif + +# bpftool +pushd tools/bpf/bpftool +%{make} DESTDIR=%{buildroot} prefix=%{_prefix} bash_compdir=%{_sysconfdir}/bash_completion.d/ mandir=%{_mandir} install doc-install +popd + +# resolve_btfids +mkdir -p %{buildroot}/usr/src/kernels/%{KernelVer}/tools/bpf/resolve_btfids +cp tools/bpf/resolve_btfids/resolve_btfids %{buildroot}/usr/src/kernels/%{KernelVer}/tools/bpf/resolve_btfids + +# cpupower +%{make} -C tools/power/cpupower DESTDIR=%{buildroot} libdir=%{_libdir} mandir=%{_mandir} CPUFREQ_BENCH=false install +rm -f %{buildroot}%{_libdir}/*.{a,la} +%find_lang cpupower +mv cpupower.lang ../ +%ifarch %{ix86} + pushd tools/power/cpupower/debug/i386 + install -m755 centrino-decode %{buildroot}%{_bindir}/centrino-decode + install -m755 powernow-k8-decode %{buildroot}%{_bindir}/powernow-k8-decode + popd +%endif +%ifarch x86_64 + pushd tools/power/cpupower/debug/x86_64 + install -m755 centrino-decode %{buildroot}%{_bindir}/centrino-decode + install -m755 powernow-k8-decode %{buildroot}%{_bindir}/powernow-k8-decode + popd +%endif +chmod 0755 %{buildroot}%{_libdir}/libcpupower.so* +mkdir -p %{buildroot}%{_unitdir} %{buildroot}%{_sysconfdir}/sysconfig +install -m644 %{SOURCE2000} %{buildroot}%{_unitdir}/cpupower.service +install -m644 %{SOURCE2001} %{buildroot}%{_sysconfdir}/sysconfig/cpupower +%ifarch %{ix86} x86_64 + mkdir -p %{buildroot}%{_mandir}/man8 + pushd tools/power/x86/x86_energy_perf_policy + %{make} DESTDIR=%{buildroot} install + popd + pushd tools/power/x86/turbostat + %{make} DESTDIR=%{buildroot} install + popd +%endif +# thermal +pushd tools/thermal/tmon +%{make} INSTALL_ROOT=%{buildroot} install +popd +# iio +pushd tools/iio +%{make} DESTDIR=%{buildroot} install +popd +# gpio +pushd tools/gpio +%{make} DESTDIR=%{buildroot} install +popd +# kvm +pushd tools/kvm/kvm_stat +%{make} INSTALL_ROOT=%{buildroot} install-tools +popd +# netacc +pushd tools/netacc +%{make} INSTALL_ROOT=%{buildroot} install +popd + +%define __spec_install_post\ +%{?__debug_package:%{__debug_install_post}}\ +%{__arch_install_post}\ +%{__os_install_post}\ +%{__modsign_install_post}\ +%{nil} + +%post +%{_sbindir}/new-kernel-pkg --package kernel --install %{KernelVer} || exit $? + +%preun +%ifarch loongarch64 +if command -v grubby > /dev/null; then + grubby --remove-kernel=/boot/efi-vmlinuz-%{KernelVer} >/dev/null 2>&1 || : +fi +%endif +if [ `uname -i` == "aarch64" ] && + [ -f /boot/EFI/grub2/grub.cfg ]; then + /usr/bin/sh %{_sbindir}/mkgrub-menu-%{version}-%{devel_release}%{?maintenance_release}%{?pkg_release}.sh %{version}-%{release}.aarch64 /boot/EFI/grub2/grub.cfg remove +fi +if [ `uname -i` == "sw_64" ] && + [ -f /boot/EFI/grub2/grub.cfg ]; then + /usr/bin/sh %{_sbindir}/mkgrub-menu-%{version}-%{devel_release}%{?maintenance_release}%{?pkg_release}.sh %{version}-%{release}.aarch64 /boot/EFI/grub2/grub.cfg remove +fi + +%postun +%{_sbindir}/new-kernel-pkg --rminitrd --rmmoddep --remove %{KernelVer} || exit $? +if [ -x %{_sbindir}/weak-modules ] +then + %{_sbindir}/weak-modules --remove-kernel %{KernelVer} || exit $? +fi + +# remove empty directory +if [ -d /lib/modules/%{KernelVer} ] && [ "`ls -A /lib/modules/%{KernelVer}`" = "" ]; then + rm -rf /lib/modules/%{KernelVer} +fi +if [ `uname -i` == "loongarch64" ];then + [ -f /etc/grub2.cfg ] && GRUB_CFG=`readlink -f /etc/grub2.cfg` + [ "x${GRUB_CFG}" == "x" ] && [ -f /etc/grub2-efi.cfg ] && GRUB_CFG=`readlink -f /etc/grub2-efi.cfg` + [ "x${GRUB_CFG}" == "x" ] && [ -f /boot/efi/EFI/openEuler/grub.cfg ] && GRUB_CFG=/boot/efi/EFI/openEuler/grub.cfg + [ "x${GRUB_CFG}" != "x" ] && grub2-mkconfig -o ${GRUB_CFG} +fi +if [ `uname -i` == "sw_64" ];then + grub2-mkconfig -o /boot/efi/EFI/openEuler/grub.cfg +fi + +%posttrans +%{_sbindir}/new-kernel-pkg --package kernel --mkinitrd --dracut --depmod --update %{KernelVer} || exit $? +%{_sbindir}/new-kernel-pkg --package kernel --rpmposttrans %{KernelVer} || exit $? +if [ `uname -i` == "aarch64" ] && + [ -f /boot/EFI/grub2/grub.cfg ]; then + /usr/bin/sh %{_sbindir}/mkgrub-menu-%{version}-%{devel_release}%{?maintenance_release}%{?pkg_release}.sh %{version}-%{release}.aarch64 /boot/EFI/grub2/grub.cfg update +fi +if [ `uname -i` == "loongarch64" ];then + [ -f /etc/grub2.cfg ] && GRUB_CFG=`readlink -f /etc/grub2.cfg` + [ "x${GRUB_CFG}" == "x" ] && [ -f /etc/grub2-efi.cfg ] && GRUB_CFG=`readlink -f /etc/grub2-efi.cfg` + [ "x${GRUB_CFG}" == "x" ] && [ -f /boot/efi/EFI/openEuler/grub.cfg ] && GRUB_CFG=/boot/efi/EFI/openEuler/grub.cfg + [ "x${GRUB_CFG}" != "x" ] && grub2-mkconfig -o ${GRUB_CFG} + grubby --set-default=/boot/vmlinuz-%{KernelVer} +fi +if [ -x %{_sbindir}/weak-modules ] +then + %{_sbindir}/weak-modules --add-kernel %{KernelVer} || exit $? +fi +%{_sbindir}/new-kernel-pkg --package kernel --mkinitrd --dracut --depmod --update %{KernelVer} || exit $? +%{_sbindir}/new-kernel-pkg --package kernel --rpmposttrans %{KernelVer} || exit $? + +%post devel +if [ -f /etc/sysconfig/kernel ] +then + . /etc/sysconfig/kernel || exit $? +fi +if [ "$HARDLINK" != "no" -a -x /usr/sbin/hardlink ] +then + (cd /usr/src/kernels/%{KernelVer} && + /usr/bin/find . -type f | while read f; do + hardlink -c /usr/src/kernels/*.oe*.*/$f $f + done) +fi + +%post -n %{name}-tools +/sbin/ldconfig +%systemd_post cpupower.service + +%preun -n %{name}-tools +%systemd_preun cpupower.service + +%postun -n %{name}-tools +/sbin/ldconfig +%systemd_postun cpupower.service + +%ifnarch x86_64 aarch64 +%files +%else +%files -f kernel-modules-filelist +%endif +%defattr (-, root, root) +%doc +/boot/config-* +%ifarch aarch64 riscv64 +/boot/dtb-* +%endif +/boot/symvers-* +/boot/System.map-* +/boot/vmlinuz-* +%ifarch loongarch64 +/boot/efi-vmlinuz-%{KernelVer} +%endif +%ghost /boot/initramfs-%{KernelVer}.img +/boot/.vmlinuz-*.hmac +/etc/ld.so.conf.d/* +%ifnarch x86_64 aarch64 +/lib/modules/%{KernelVer}/ +%else +/lib/modules/%{KernelVer}/vdso/ +/lib/modules/%{KernelVer}/modules.* +%endif +%exclude /lib/modules/%{KernelVer}/source +%exclude /lib/modules/%{KernelVer}/build +%{_sbindir}/mkgrub-menu*.sh + +%ifarch x86_64 aarch64 +%files extra-modules -f kernel-extra-modules-filelist +%defattr(-,root,root) +%endif + +%files devel +%defattr (-, root, root) +%doc +/lib/modules/%{KernelVer}/source +/lib/modules/%{KernelVer}/build +/usr/src/kernels/%{KernelVer} + +%files headers +%defattr (-, root, root) +/usr/include/* +%exclude %{_includedir}/cpufreq.h +%exclude %{_includedir}/cpuidle.h + +%if %{with_perf} +%files -n perf +%{_bindir}/perf +%{_libdir}/libperf-jvmti.so +%{_libexecdir}/perf-core +%{_datadir}/perf-core/ +%{_mandir}/man[1-8]/perf* +%{_sysconfdir}/bash_completion.d/perf +%doc linux-%{KernelVer}/tools/perf/Documentation/examples.txt +%dir %{_datadir}/doc/perf-tip +%{_datadir}/doc/perf-tip/* +%license linux-%{KernelVer}/COPYING + +%if 0%{?with_python2} +%files -n python2-perf +%license linux-%{KernelVer}/COPYING +%{python2_sitearch}/* +%endif + +%files -n python3-perf +%license linux-%{KernelVer}/COPYING +%{python3_sitearch}/* +%endif + +%files -n %{name}-tools -f cpupower.lang +%{_bindir}/cpupower +%ifarch %{ix86} x86_64 +%{_bindir}/centrino-decode +%{_bindir}/powernow-k8-decode +%endif +%{_unitdir}/cpupower.service +%{_datadir}/bash-completion/completions/cpupower +%{_mandir}/man[1-8]/cpupower* +%config(noreplace) %{_sysconfdir}/sysconfig/cpupower +%ifarch %{ix86} x86_64 +%{_bindir}/x86_energy_perf_policy +%{_mandir}/man8/x86_energy_perf_policy* +%{_bindir}/turbostat +%{_mandir}/man8/turbostat* +%endif +%{_bindir}/tmon +%{_bindir}/iio_event_monitor +%{_bindir}/iio_generic_buffer +%{_bindir}/lsiio +%{_bindir}/lsgpio +%{_bindir}/gpio-hammer +%{_bindir}/gpio-event-mon +%{_bindir}/gpio-watch +%{_mandir}/man1/kvm_stat* +%{_bindir}/kvm_stat +%{_sbindir}/net-acc +%{_sbindir}/tuned_acc/netacc +%{_libdir}/libcpupower.so.1 +%{_libdir}/libcpupower.so.0.0.1 +%license linux-%{KernelVer}/COPYING + +%files -n %{name}-tools-devel +%{_libdir}/libcpupower.so +%{_includedir}/cpufreq.h +%{_includedir}/cpuidle.h + +%files -n bpftool +%{_sbindir}/bpftool +%{_sysconfdir}/bash_completion.d/bpftool +%{_mandir}/man8/bpftool-cgroup.8.gz +%{_mandir}/man8/bpftool-map.8.gz +%{_mandir}/man8/bpftool-prog.8.gz +%{_mandir}/man8/bpftool-perf.8.gz +%{_mandir}/man8/bpftool.8.gz +%{_mandir}/man8/bpftool-btf.8.gz +%{_mandir}/man8/bpftool-feature.8.gz +%{_mandir}/man8/bpftool-gen.8.gz +%{_mandir}/man8/bpftool-iter.8.gz +%{_mandir}/man8/bpftool-link.8.gz +%{_mandir}/man8/bpftool-net.8.gz +%{_mandir}/man8/bpftool-struct_ops.8.gz +%license linux-%{KernelVer}/COPYING + +%if 0%{?with_source} +%files source +%defattr(-,root,root) +/usr/src/linux-%{KernelVer}/* +/usr/src/linux-%{KernelVer}/.config +%endif + +%changelog +* Mon Nov 09 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-182.0.0.162.20261109.3da4ab8e61ab +- !30597 [CVEAgent@OLK-6.6] Fix CVE-2026-99239 +- !30582 v5 MOC bypass cache +- !30610 iommu/io-pgtable-arm: Add support for contiguous hint +- !30523 drivers:misc:sdma-dae: Open source sdma-dae driver to OLK-6.6 (already supported on olk-5.10) +- !28122 [CVEAgent@OLK-6.6] Fix CVE-2026-89802 +- !29350 [CVEAgent@OLK-6.6] Fix CVE-2026-97988 +- !30473 Fix CVE-2026-97992 +- !30150 [OLK-6.6] Fix CVE-2026-74527 +- !30576 net: wangxun: nse: sync OOT nse-1.0.3 fixes and optimizations +- !30544 [OLK-6.6] Fix CVE-2026-90057 +- !30476 [OLK-6.6] fix CVE-2026-98936 +- !30474 [OLK-6.6] fix CVE-2026-99059 +- !30144 [OLK-6.6] Fix CVE-2026-64190 +- !30311 [OLK-6.6]nser: add support for wangxun RDMA driver +- iommu/io-pgtable-arm: Add support for contiguous hint +- Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn +- openeuler: configs: arm64: Enable PBHA by default +- arm64: mm: Introduce kernel param pbha +- arm64: mm: Introduce prctl to control pbha behavior +- arm64: mm: Set flag VM_PBHA_BIT0 for global init task +- arm64: mm: Introduce procfs interface to update PBHA0 bit +- arm64: mm: Set PBHA0 bit for VM_PBHA_BIT0 +- arm64: mm: Introduce VM_PBHA_BIT0 to enable pbha bit0 for single vma +- arm64: mm: Show PBHA bit 59 as PBHA0 in ptdump +- arm64: mm: Update kernel pte entries if pbha bit0 enabled +- arm64: mm: Detect and enable PBHA bit0 at early startup +- arm64: cpufeature: Enable PBHA for stage1 early via FDT +- Documentation: arm64: Describe the support and expectations for PBHA +- KVM: arm64: Configure PBHA bits for stage2 +- arm64: mm: Add pgprot_pbha() to allow drivers to request PBHA values +- arm64: cpufeature: Enable PBHA bits for stage1 +- dt-bindings: arm: Add binding for Page Based Hardware Attributes +- dt-bindings: Rename the description of cpu nodes cpu.yaml +- KVM: arm64: Detect and enable PBHA for stage2 +- net: wangxun: nse: sync OOT nse-1.0.3 fixes and optimizations +- slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() +- drivers:misc:sdma-dae: adapt driver interfaces for OLK-6.6 +- net: team: fix NULL pointer dereference in team_xmit during mode change +- net: team: Rename port_disabled team mode op to port_tx_disabled +- net: team: Remove unused team_mode_op, port_enabled +- wifi: ath11k: reset ar->num_stations on hardware start +- wireguard: noise: reject response consumption after intermediate initiation +- vhost-vdpa: protect config_ctx from being freed under the config callback +- x86/arm64: config: enable the Wangxun nser RDMA driver +- net: wangxun: nser: add RDMA support for 100GbE NICs +- octeontx2-af: Block VFs from clobbering special CGX PKIND state +- vhost: invalidate vring access on IOTLB transitions +- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op +- drivers:misc:sdma-dae: Remove redundant print during mm exit and resume. +- drivers:misc:sdma-dae: Revert optimize kernel code +- drivers:misc:sdma-dae: Revert add channel depth info in debugfs +- drivers:misc:sdma-dae: Revert Write the CQ head pointer correctly. +- drivers:misc:sdma-dae: Write the CQ head pointer correctly. +- drivers:misc:sdma-dae: Remove interference print. +- drivers:misc:sdma-dae: Checking the address alignment +- drivers:misc:sdma-dae: add NULL judgement of global variables +- drivers:misc:sdma-dae: add channel depth info in debugfs +- drivers:misc:sdma-dae: optimize kernel code +- drivers:misc:sdma-dae: fix incorrect debugfs print +- drivers:misc:sdma-dae: sdma fix uncorrect sleep time +- drivers:misc:sdma-dae: fix incorrect kmalloc flag +- drivers:misc:sdma-dae: sdma fix PUAF problem fork risk +- drivers:misc:sdma-dae: modify ttl_processes reduce logic +- drivers:misc:sdma-dae: remove unnecessary return in void function +- drivers:misc:sdma-dae: fix incorrect resource release +- drivers:misc:sdma-dae: remove lock while pausing channels +- drivers:misc:sdma-dae: add mmu_notifier +- drivers:misc:sdma-dae: add MODULE_VERSION to control version +- drivers:misc:sdma-dae: add print in exceptional branch +- drivers:misc:sdma-dae: bugfix of channel operation +- drivers:misc:sdma-dae: change authority of sdma device +- drivers:misc:sdma-dae: add channel ida validation +- drivers:misc:sdma-dae: add vma_ops to avoid mremap error +- drivers:misc:sdma-dae: add fast mode +- drivers:misc:sdma-dae: not expose sq_tail write and add validation of cq_head +- drivers:misc:sdma-dae: add debugfs of sdma-dae +- drivers:misc:sdma-dae: fix icsl code check problems +- drivers:misc:sdma-dae: fix input validate problems +- drivers:misc:sdma-dae: fix interrupt handle logic +- drivers:misc:sdma-dae: not compile sdma-dae by default +- drivers:misc:sdma-dae: enable sdma_dae for arm64 +- drivers:misc:sdma-dae: support page fault preprocess +- drivers:misc:sdma-dae: support interrupt init and handle +- drivers:misc:sdma-dae: support sqe task send and execute +- drivers:misc:sdma-dae: support channel management +- drivers:misc:sdma-dae: support getting streamID +- drivers:misc:sdma-dae: support initializ sdma driver + +* Sun Nov 08 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-182.0.0.162.20261108.7ee308f05890 +- !30602 [CVEAgent@OLK-6.6] Fix CVE-2026-99117 +- !30605 [CVEAgent@OLK-6.6] Fix CVE-2026-99211 +- !30604 [CVEAgent@OLK-6.6] Fix CVE-2026-99201 +- netlink: reset skb headers before unicast and multicast filtering +- netlink: avoid hashing the network namespace pointer +- net: bridge: mcast: don't truncate the port group walk on teardown + +* Sat Nov 07 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-182.0.0.162.20261107.3b7e79834650 +- !30591 [CVEAgent@OLK-6.6] Fix CVE-2026-99142 +- !30590 [CVEAgent@OLK-6.6] Fix CVE-2026-99219 +- !30594 [CVEAgent@OLK-6.6] Fix CVE-2026-99233 +- !30600 urma: warn on slow TP driver callbacks +- urma: warn on slow TP driver callbacks +- tracing/histograms: Verify event_call identity when updating synth_event refcount +- tracing: Check operator stack capacity before pushing +- ftrace: Initialize modname and offset in print_rec() + +* Fri Nov 06 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-182.0.0.162.20261106.ce70a5164a87 +- !30530 [CVEAgent@OLK-6.6] Fix CVE-2026-99163 +- !30532 [CVEAgent@OLK-6.6] Fix CVE-2026-99235 +- !29765 Fix CVE-2026-98289 +- !30230 Fix CVE-2026-97615 +- !29790 Fix CVE-2026-93250 +- !30510 [CVEAgent@OLK-6.6] Fix CVE-2026-99005 +- !30506 [CVEAgent@OLK-6.6] Fix CVE-2026-98871 +- !30307 feat/obmm-unified-switch-split-v4 +- !30064 [CVEAgent@OLK-6.6] Fix CVE-2026-98972 +- !30507 [CVEAgent@OLK-6.6] Fix CVE-2026-98883 +- !30450 BBML3 bugfix +- !30156 [OLK-6.6] Fix CVE-2026-68258 +- !30154 [OLK-6.6] Fix CVE-2026-74729 +- !30151 [OLK-6.6] Fix CVE-2026-74273 +- !27793 [OLK-6.6] Fix CVE-2026-68421 +- !27512 [OLK-6.6] Fix CVE-2026-64259 +- !30146 [OLK-6.6] Fix CVE-2026-53109 +- !30575 arm64: configs: fix duplicate Hisilicon SoC drivers block in openeuler_defconfig +- !30567 scsi: hisi_sas: Clear PHY error counts on phyup +- arm64: configs: fix duplicate Hisilicon SoC drivers block in openeuler_defconfig +- !30472 [CVEAgent@OLK-6.6] Fix CVE-2026-99243 +- scsi: hisi_sas: Clear PHY error counts on phyup +- scsi:hisi_sas:Sync upstream timer_delete API changes in hisi_sas_v3_hw.c +- tracing: Save the event file instead of the compatible histogram +- tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields +- drm/i915/gt: Unmask interrupts only when ACTIVE is true +- serial: 8250_port: recognize UPIO_AU +- crypto: ccp - Fix possible deadlock in SEV init failure path +- obmm: pack the internal structs by field ordering +- obmm: sysfs views over the switch: attributes, identity, lockless reads +- obmm: generalized dual-backend gap mmap +- obmm: export switch target wrap-up and validation consolidation +- obmm: unified two-phase switch core (import target) +- obmm: install mappings lazily from the backend fault paths +- obmm: fix the pxm bound, the open TOCTOU and the teardown release +- obmm: split the region shell from the memory backends +- obmm: depend on TRANSPARENT_HUGEPAGE for the PMD fault paths +- io-wq: order the exit bit against worker creation task work +- mm/pfn_range_alloc: split block mappings in linear map updates +- arm64/mm: make pte_present() recognize present-invalid entries +- net: bridge: use option bits for CFM/MRP frame handlers +- drm/amdkfd: Check bounds on CRIU restore queue type and mqd size +- soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read +- cxl/region: Block region delete during region creation +- powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy +- cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() +- vxlan: mdb: Fix use-after-free in vxlan_mdb_flush() +- af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). +- sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() +- fuse-uring: make a fuse_req on SQE commit only findable after memcpy + +* Thu Nov 05 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-182.0.0.162.20261105.38633498fb6d +- !30553 tracing: Reject incomplete event filter expressions +- !30498 nfsd: split nfsd4_copy into transient and durable async copy objects +- !30000 [CVEAgent@OLK-6.6] Fix CVE-2026-98822 +- !30497 cdma: ratelimit hot-path error logs in kernel driver and header file code synchronization +- tracing: Reject incomplete event filter expressions +- !30546 [OLK-6.6] ub: fix UBASE port reporting and UNIC reset and DMA handling +- !30481 [CVEAgent@OLK-6.6] Fix CVE-2026-99080 +- !30483 [CVEAgent@OLK-6.6] Fix CVE-2026-99206 +- !30388 Fix CVE-2026-99153 +- !30390 Fix CVE-2026-99152 +- !30387 Fix CVE-2026-99110 +- !30391 Fix CVE-2026-99109 +- !30479 [CVEAgent@OLK-6.6] Fix CVE-2026-99254 +- !30538 scsi: libsas: Fix SMP IO deadlock during HA resume +- !30537 ACPI: OSL: Use usleep_range() in acpi_os_sleep() +- !30536 scsi: libsas: Add linkrate and sas_addr change detection in rediscover；scsi: libsas: Add sas_ex_phy_to_dev() helper +- !30486 [CVEAgent@OLK-6.6] Fix CVE-2026-99247 +- !30454 [OLK-6.6] Fix CVE-2026-97566 +- !30453 [OLK-6.6] Fix CVE-2026-97432 +- !30444 [OLK-6.6] Fix CVE-2026-43234 +- !30403 x86/hygon: Fix FPDSS on Hygon +- !30269 [OLK-6.6] update rnpvf driver to 1.2.0. +- !30155 [OLK-6.6] Fix CVE-2026-74695 +- !30153 [OLK-6.6] Fix CVE-2026-72494 +- !30149 [OLK-6.6] Fix CVE-2026-74368 +- !30092 [CVEAgent@OLK-6.6] Fix CVE-2026-99052 +- !30090 [CVEAgent@OLK-6.6] Fix CVE-2026-99040 +- !30057 [CVEAgent@OLK-6.6] Fix CVE-2026-98948 +- !30086 [CVEAgent@OLK-6.6] Fix CVE-2026-99025 +- !30105 [CVEAgent@OLK-6.6] Fix CVE-2026-99078 +- !30106 [CVEAgent@OLK-6.6] Fix CVE-2026-99079 +- ub: ubase: skip bandwidth queries on next-generation chips +- net: unic: Fix TX/RX DMA ordering and cache sync +- net: unic: serialize port deactivation with reset +- ub: ubase: add ub port events handling and statistics +- scsi: libsas: Fix SMP IO deadlock during HA resume +- scsi: libsas: Add sas_ex_phy_to_dev() helper +- scsi: libsas: Add linkrate and sas_addr change detection in rediscover +- !30430 v8 arm64: Allow CPU0 to be nohz_full +- ACPI: OSL: Use usleep_range() in acpi_os_sleep() +- !30300 mm/gup: allow movable memory pinnable +- !30487 urma: limit opt buf length in uburma ioctl commands +- !29931 [CVEAgent@OLK-6.6] Fix CVE-2026-98570 +- nfsd: split nfsd4_copy into transient and durable async copy objects +- ub: cdma: header file code synchronization +- ub: cdma: ratelimit hot-path error logs in kernel driver +- x86: hygon: Fix FPDSS on Hygon +- tracing: Do not initialize tracefs work if tracing is disabled +- scsi: target: iscsi: Fix race in discovery auth updates +- fs: Free any excess xarray nodes in clear_inode() +- io_uring: don't flood a cancelling task with task_work +- urma: limit opt buf length in uburma ioctl commands +- mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 +- wifi: iwlwifi: mvm: fix P2P-Device binding handling +- team: avoid NETDEV_CHANGEMTU event when unregistering slave +- arm64: defconfig: Enable CONFIG_PM_SLEEP_SMP_NONZERO_CPU and CONFIG_ARCH_SUSPEND_NONZERO_CPU +- arm64: Allow boot CPU nohz_full to coexist with suspend and kexec +- isolation: Check whether there exists a housekeeping CPU online +- isolation: Do not check whether housekeeping CPUs are present +- smb: client: reject SetEA requests that do not fit the request buffer +- scsi: libiscsi: Validate the task named by a management response +- scsi: libiscsi: Validate the ITT reflected in a Reject PDU +- smb: client: fix heap overflow in cifs_do_set_acl() +- rnpvf: update rnpvf driver to 1.2.0. +- mm/gup: allow movable memory pinnable +- rnpvf: update rnpvf driver to 1.2.0. +- netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() +- RDMA/irdma: Replace waitqueue and flag with completion +- wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() +- net/mlx5e: Prevent stale XSK buffer release on refill retry +- net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry +- selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts +- KEYS: Fix add_key() race with keyring restriction +- openvswitch: fix soft lockup in the netlink flow dump +- mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() +- wifi: mac80211: prevent AP VLAN tx from other interfaces +- net: ipv6: keep room for the mac header in dst_dev_overhead() + +* Wed Nov 04 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-182.0.0.162 +- !30459 [CVEAgent@OLK-6.6] Fix CVE-2026-99234 +- !30468 [CVEAgent@OLK-6.6] Fix CVE-2026-99143 +- !30322 urma: fix ipourma eid handler and register work concurrency +- !30455 arm64: tlb: Enable local TLBI on systems without FEAT_TLBID +- !30491 [OLK-6.6] AMD Venice additional patches for openEuler - 2 +- EDAC/amd64: Avoid a -Wformat-security warning +- EDAC/amd64: Generate ctl_name string at runtime +- !29993 [CVEAgent@OLK-6.6] Fix CVE-2026-98807 +- !29964 [CVEAgent@OLK-6.6] Fix CVE-2026-98747 +- !30393 ub/ubmem-vmmu: Remove the support_attr callback mechanism. +- !30447 wifi: mac80211: minstrel_ht: validate fixed rate index +- !30446 net: ena: fix MMIO read buffer leak on probe failure +- tracing: Keep the predicate limit separate from program capacity +- !30013 [CVEAgent@OLK-6.6] Fix CVE-2026-98855 +- !30431 fix CVE-2026-98490 for OLK-6.6 +- !30425 fix CVE-2026-98722 for OLK-6.6 +- !30410 nvdimm: pmem: keep PREFLUSH before data writes +- !30406 Fix CVE-2026-97480 for OLK-6.6 +- !30204 x86/cpu/hygon: Report S5 reset status during boot +- tracing: Unregister field variable histograms when the command fails +- !30395 tty: fix saved termios reset race +- arm64: tlb: Enable local TLBI on systems without FEAT_TLBID +- !30031 drm/amdkfd: fix SMI event cross-process information leak +- wifi: mac80211: minstrel_ht: validate fixed rate index +- net: ena: fix MMIO read buffer leak on probe failure +- net: openvswitch: conntrack: fix helper UAF due to extensions realloc +- net: openvswitch: conntrack: remove 'add_helper' dead code +- openvswitch: prepare for stolen verdict coming from conntrack and nat engine +- net/sched: act_ct: avoid modifying shared unconfirmed ct entry +- net/sched: act_ct: fix helper UAF due to extensions realloc +- ub/ubmem-vmmu: Remove the support_attr callback mechanism. +- mtd: block2mtd: Fix divide error when erase_size is zero +- block2mtd: prevent direct access of bd_inode +- nvdimm: pmem: keep PREFLUSH before data writes +- tty: serial: 8250: protect against NULL uart->port.dev in register +- serial: 8250: invert serial8250_register_8250_port() CIR condition +- urma: fix ipourma eid handler and register work concurrency +- tty: fix saved termios reset race +- x86/cpu/hygon: Report S5 reset status during boot +- drm/amdkfd: fix SMI event cross-process information leak +- of/overlay: put property on deadprops only after changeset add succeeds +- net/mlx5: Fix slab-out-of-bounds when handling team device events +- serial: core: fix NULL pointer dereference in serial_core_unregister_port() + +* Tue Nov 03 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-181.0.0.161.20261103.07a990b933d5 +- !30256 [Backport] ext4: defer unwritten splitting until I/O completion +- !30394 urma: Fix the assignment before null check +- !30003 [CVEAgent@OLK-6.6] Fix CVE-2026-98831 +- !29516 [CVEAgent@OLK-6.6] Fix CVE-2026-98198 +- !30220 drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM +- !30082 [CVEAgent@OLK-6.6] Fix CVE-2026-99012 +- !30071 [CVEAgent@OLK-6.6] Fix CVE-2026-98983 +- !30262 [CVEAgent] Fix CVE-2026-99091 +- !30294 Fix CVE-2026-99011 +- !30293 Fix CVE-2026-99008 +- !30290 Fix CVE-2026-98663 +- !30289 Fix CVE-2026-98664 +- !30288 Fix CVE-2026-98666 +- !30234 [PATCH 00/11] KVM: arm64: pvm: Add software VGICv3 and virtual timer support +- ext4: prevent sleeping allocation in NOWAIT write path +- !30367 Revert "net/hinic5:Fix the missing rollback in the hinic5 XDP" +- ext4: remove EXT4_GET_BLOCKS_IO_CREATE_EXT +- ext4: simplify the mapping query logic in ext4_iomap_begin() +- ext4: skip overwrite check for aligned non-extending DIO writes +- ext4: remove unused unwritten parameter in ext4_dio_write_iter() +- ext4: remove useless ext4_iomap_overwrite_ops +- ext4: avoid starting handle when dio writing an unwritten extent +- ext4: don't split extent before submitting I/O +- !30233 Fix CVE-2026-98917 +- !30235 Fix CVE-2026-98930 +- !30368 wifi: mac80211: validate TX status rate metadata +- !30378 tty: tty_port: restore TTY_IO_ERROR on activation failure +- !30380 tty: port: fix tty_port_tty_vhangup() race +- !30371 mtd: core: avoid double-free of OTP NVMEM device +- urma: Fix the assignment before null check +- !30386 RDMA/hns: Fix UAF when late CQE arrives after drain QP timeout +- Revert "net/hinic5:Fix the missing rollback in the hinic5 XDP" +- !30270 [OLK-6.6] AMD Venice additional patches for openEuler +- !28385 [OLK-6.6] crypto: ccp: fix vpsp cmd ctx leak +- !30382 fs/dirty_pages: Fix fix UAF caused by unbalanced lock release in proc_buffer_open() +- RDMA/hns: Fix UAF when late CQE arrives after drain QP timeout +- !30365 bpf: Fix out-of-bounds btf->types write for split BTF +- fs/dirty_pages: Fix fix UAF caused by unbalanced lock release in proc_buffer_open() +- !30313 kabi: fix include helpers broken by the predefined 'linux' macro +- tty: port: fix tty_port_tty_vhangup() race +- tty: tty_port: restore TTY_IO_ERROR on activation failure +- mtd: core: avoid double-free of OTP NVMEM device +- wifi: mac80211: validate TX status rate metadata +- bpf: Fix out-of-bounds btf->types write for split BTF +- kabi: fix include helpers broken by the predefined 'linux' macro +- KVM: arm64: pvm: Handle counter reads in the hyp path +- KVM: arm64: pvm: Trap guest timer accesses and enforce EL0 permissions +- KVM: arm64: pvm: Align timer capabilities and counter handling with RV timers +- KVM: arm64: pvm: Wire RV timers into the KVM timer entry points +- KVM: arm64: pvm: Add the software RV timer implementation +- KVM: arm64: pvm: Deliver VGIC interrupts without hardware LRs +- KVM: arm64: pvm: Emulate VGIC active priority registers +- KVM: arm64: pvm: Route ICC accesses through register descriptors +- KVM: arm64: pvm: Emulate the GICv3 CPU interface +- KVM: arm64: Handle pending EL1 IRQ exceptions +- KVM: arm64: pvm: Constrain virtual interrupt capabilities +- Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() +- Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown +- iio: imu: adis16480: fix unprotected debugfs reads +- iio: imu: adis16400: fix unprotected debugfs reads +- iio: gyro: adis16136: fix unprotected debugfs reads +- Bluetooth: MGMT: Fix status of pending commands flushed on power off +- EDAC/amd64: Mask UMC chip select to the four implemented selects +- x86/mce: Fix hardware debug register corruption on task migration +- x86/MCE/AMD: Fix inverted interrupt enablement during storm handling +- x86/amd_node: Avoid divide by zero on virtualized systems +- RAS/AMD/ATL, EDAC/amd64: Only load ATL when needed +- x86/mce: Set up the polling timer before CMCI discovery +- x86/mce: Restore MCA polling interval halving +- EDAC/amd64: Remove NUM_CONTROLLERS macro +- x86/mce/inject: Remove call to mce_notify_irq() +- x86/mce: Remove the redundant mce_hygon_feature_init() +- x86/mce/threshold: Remove the redundant this_cpu_dec_return() +- crypto: ccp: fix vpsp cmd ctx leak +- KVM: s390: Fix IRQ injection with SIGP Stop and Store Status +- parisc: Increase kernel stack size to 32kb +- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM +- Bluetooth: ISO: Serialize concurrent connect calls +- unshare: don't drop active namespace references that were never taken +- of/overlay: don't leak fragment references when changeset init fails +- hwmon: (pwm-fan) Stop RPM timer before freeing tach data + +* Mon Nov 02 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-181.0.0.161.20261102.2d7bb7543c26 +- !30029 CODEOWNERS: add kernel module ownership rules +- !30291 [OLK-6.6] mm/swapfile: reject duplicated bad pages in swap header +- !30201 filescgroup: migrate files resources of every task, not just the first +- !30306 Fix CVE-2026-98799 +- bpf: Fix kabi breakage in struct bpf_tramp_image and bpf_trampoline +- bpf: Skip detached progs in trampoline images that are still in use +- mm/swapfile: reject duplicated bad pages in swap header +- filescgroup: migrate files resources of every task, not just the first +- scripts: add get_codeowner.py to look up CODEOWNERS owners +- CODEOWNERS: add kernel module ownership rules + +* Sun Nov 01 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-181.0.0.161.20261101.a233c75ea23f +- !30268 ub: udma: solving internal code review issues +- !30305 bpf: Mark syscall helpers as sleepable +- !30113 fix/CVE-2026-98103 +- !30061 [CVEAgent@OLK-6.6] Fix CVE-2026-98966 +- !30099 [CVEAgent@OLK-6.6] Fix CVE-2026-99070 +- !30087 [CVEAgent@OLK-6.6] Fix CVE-2026-99031 +- !30100 [CVEAgent@OLK-6.6] Fix CVE-2026-99071 +- !30101 [CVEAgent@OLK-6.6] Fix CVE-2026-99072 +- !30102 [CVEAgent@OLK-6.6] Fix CVE-2026-99074 +- !30091 [CVEAgent@OLK-6.6] Fix CVE-2026-99041 +- !30088 [CVEAgent@OLK-6.6] Fix CVE-2026-99033 +- !30043 seg6: ensure packet data is writable before modifying SRH and IPv6 DA +- !30197 CVE-2026-98503 +- bpf: Mark syscall helpers as sleepable +- ub: udma: support dwqe with a few wqebbs +- ub: udma: solving internal code review issues +- seg6: ensure packet data is writable before modifying SRH and IPv6 DA +- igmp: fix kabi breakage of struct ip_sf_list +- packet: use ubuf_info completion for TX_RING packets +- virtio_net: copy zerocopy frags in start_xmit without NAPI +- igmp: convert struct ip_sf_list to RCU +- ipv4: stop PMTU walk when nexthop group shrinks +- ipv4: stop route notification sizing when nexthop group shrinks +- ipv4: do not warn on route notification size race +- ipv6: do not warn on route notification size race +- ip6_gre: remove obsolete ERSPAN PMTU update +- net/packet: guard the ll header push in packet_rcv_spkt() +- net: bridge: avoid recursive multicast port cleanup +- bonding: fix the program leak when XDP is replaced + +* Sat Oct 31 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-181.0.0.161.20261031.8bf5cc49c73d +- !30253 neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. +- !29554 [CVEAgent@OLK-6.6] Fix CVE-2026-98286 +- !30263 RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() +- !30258 v10 net: dynthread: dynamic threaded NAPI +- !30208 Fix CVE-2026-98044 +- !30280 bpf: Make post-verification instruction rewrites killable +- !30184 blk-mq: set RQF_USE_SCHED when the operation is known +- !30267 sched/fair: Avoid overflow in place_entity() +- !30236 configfs: unhash the dentry before dropping the item in rmdir +- !30276 virtcca_cvm: fix mmap with uninitialized pfn in migvm queue +- !29584 [CVEAgent@OLK-6.6] Fix CVE-2026-98364 +- !29906 [CVEAgent@OLK-6.6] Fix CVE-2026-98443 +- !30046 net: cap skb->queue_mapping when the tx queue is picked +- !30223 bpf: Reject pkt arguments in mutating subprogs +- !29932 [CVEAgent@OLK-6.6] Fix CVE-2026-98598 +- !30044 net: restrict SO_RESERVE_MEM to TCP sockets and cap max value +- bpf: Make post-verification instruction rewrites killable +- virtcca_cvm: fix mmap with uninitialized pfn in migvm queue +- RDMA/umem: avoid ib_umem_find_best_pgsz ABI breakage +- sched/fair: Avoid overflow in place_entity() +- RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() +- net: dynthread: Add debug switch and instrumentation +- net: dynthread: Scale the number of NAPI thread CPUs +- net: dynthread: Switch NAPI to threads on spare CPUs +- net: dynthread: Steer the RX queue IRQs away from the target tasks +- net: dynthread: Monitor the load of the target tasks +- net: dynthread: Add dynamic threaded NAPI scheduler framework +- net/mlx5e: Do not block on RTNL while recovering an SQ +- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover +- net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation +- net/mlx5e: link NAPI instances to queues and IRQs +- net: Fix napi irq KABI breakage +- net: Add NAPI IRQ support +- net: Fix KABI breakage for queue napi association +- net: Add queue and napi association +- neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. +- configfs: unhash the dentry before dropping the item in rmdir +- bpf: Reject pkt arguments in mutating subprogs +- bpf: Fix kabi breakage in struct bpf_subprog_info +- bpf: Reject legacy packet loads from callbacks +- blk-mq: set RQF_USE_SCHED when the operation is known +- net: cap skb->queue_mapping when the tx queue is picked +- net: restrict SO_RESERVE_MEM to TCP sockets and cap max value +- ipv6: Prevent rt6_insert_exception() for dying fib6_info. +- xfs: fix cursor and pointer handling when recovering iunlink buckets +- xfrm: hold net_device reference under RCU in bundle creation +- drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown + +* Fri Oct 30 2026 Yanteng Si <siyanteng@iscas.ac.cn> - 6.6.0-181.0.0.161.20261030.ce0ca5642c6d +- The RISC-V architecture features have been updated. +- For more details, refer to the rvck-olk repository. + +* Fri Oct 30 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-181.0.0.160.20261030.ce0ca5642c6d +- !29210 [CVEAgent@OLK-6.6] Fix CVE-2026-93230 +- !29974 iommu/arm-smmu-v3: Manage teardown with devm +- !30238 ACPI/HMAT: Fix compile error when CONFIG_ACPI_HMAT is not enabled +- !30009 [CVEAgent@OLK-6.6] Fix CVE-2026-98850 +- !30093 [CVEAgent@OLK-6.6] Fix CVE-2026-99053 +- !30062 [CVEAgent@OLK-6.6] Fix CVE-2026-98968 +- !30249 bpf: Fix u32 overflow issue in map batch operations +- !30251 eventfs: Free the eventfs_inode after an rcu grace period too +- !30199 Fix CVE-2026-97605 +- !30228 OLK-6.6 fix CVE-2026-89929 +- !30041 resolve hungtask +- !29905 [CVEAgent@OLK-6.6] Fix CVE-2026-98427 +- !29394 [CVEAgent@OLK-6.6] Fix CVE-2026-98097 +- !29590 [CVEAgent@OLK-6.6] Fix CVE-2026-98373 +- !30052 [CVEAgent@OLK-6.6] Fix CVE-2026-98929 +- !29542 [CVEAgent@OLK-6.6] Fix CVE-2026-98254 +- !30056 [CVEAgent@OLK-6.6] Fix CVE-2026-98947 +- !30096 [CVEAgent@OLK-6.6] Fix CVE-2026-99057 +- !29902 [CVEAgent@OLK-6.6] Fix CVE-2026-98375 +- !29566 [CVEAgent@OLK-6.6] Fix CVE-2026-98321 +- eventfs: Free the eventfs_inode after an rcu grace period too +- bpf: Fix u32 overflow issue in map batch operations +- !29819 [OLK-6.6] Fix CVE-2026-98266 +- !29756 [OLK-6.6] Fix CVE-2025-22037 +- !29824 [OLK-6.6] Fix CVE-2026-80980 +- !28774 ntfs: fix off-by-one in mapping pairs decoding bounds checks +- !29851 [OLK-6.6] Fix CVE-2026-90116 +- !30159 net: flush skb_defer_nodes in dev_cpu_dead() +- ACPI/HMAT: Fix compile error when CONFIG_ACPI_HMAT is not enabled +- !30161 fix/CVE-2026-98073 +- !30066 tcp: prevent collapsing skbs across boundary in rtx queue +- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU +- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 +- erofs: preserve LZMA decoders on resize failure +- net: flush skb_defer_nodes in dev_cpu_dead() +- net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). +- net: plumb extack in __dev_change_net_namespace() +- tcp: prevent collapsing skbs across boundary in rtx queue +- xen/netfront: don't leak the skb when xennet_fill_frags() fails +- tipc: hold a reference to nodes found by link name +- amt: send the relay's General Query directly from the receive path +- vsock: Fix memory leak in vmci_transport_recv_dgram_cb() +- macsec: initialize SecY before registering the netdevice +- sched: Fix struct sched_entity kabi broken +- sched/fair: Separate se->vlag from se->vprot +- net/packet: prevent TX_RING byte count overflow +- ksmbd: fix null pointer dereference in alloc_preauth_hash() +- iommu/arm-smmu-v3: Manage teardown with devm +- net/sched: codel: bound the dropping loop per dequeue call +- xen/netfront: drop RX packets with a short Ethernet header +- ALSA: mtpav: shut down output timer before card teardown +- ALSA: mtpav: Use guard() for spin locks +- net/smc: stop killed, freed and out_of_sync sharing a byte +- ALSA: core: Fix potential UAF after asynchronous card release +- mm/hugetlb: preserve mremap address delta when skipping page tables +- netfilter: nf_nat: unregister and release hooks on error +- swiotlb: use the adjusted address for the highmem page lookup +- tipc: Dont send random pad bytes in RESET/ACTIVATE messages +- mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier +- ntfs: fix off-by-one in mapping pairs decoding bounds checks + +* Thu Oct 29 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-181.0.0.160.20261029.417801bef380 +- !29917 [CVEAgent@OLK-6.6] Fix CVE-2026-98477 +- !29936 [CVEAgent@OLK-6.6] Fix CVE-2026-98655 +- !30147 FIX CVE-2026-98453 +- !30145 FIX CVE-2026-98452 +- !30140 smb: client: use finish_no_open() for non-regular inodes +- !30138 smb: client: close completed creates on compound wait errors +- !30163 Fix CVE-2026-98386 +- !30042 scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking +- !30117 ipourma: fix ipourma crash +- !26676 [OLK-6.6]Linkdata: update Linkdata HBA/RAID controller driver +- !30182 [3/3] [OLK-6.6] Backport CPPC Performance Priority and AMD P-State modernization patches to openEuler v6.6 kernel +- urma: fix ipourma crash +- !30118 CVE-2026-98800 +- !29894 net: ipv4: Fix UDP length overflow with PMTU discover and big MTU +- !30172 fix/CVE-2026-97984 +- !30122 Fix CVE-2026-98725 +- !29907 [CVEAgent@OLK-6.6] Fix CVE-2026-98449 +- !30211 smb: client: use i_size_read instead of old i_size +- smb: client: use i_size_read instead of old i_size +- !29948 [CVEAgent@OLK-6.6] Fix CVE-2026-98695 +- !29844 vlan: require the MAC header to be present in __vlan_insert_inner_tag() +- !30128 net: reject oversized tx_queue_len at netlink parse time +- !30187 [PATCH 00/20] KVM: arm64: pvm: Emulate guest instructions and system registers +- !29945 [CVEAgent@OLK-6.6] Fix CVE-2026-98686 +- !29990 [CVEAgent@OLK-6.6] Fix CVE-2026-98794 +- KVM: arm64: pvm: Deliver guest SVCs in the hypervisor +- KVM: arm64: pvm: Share the exception entry computation +- KVM: arm64: pvm: Emulate guest ERET in the hypervisor +- KVM: arm64: pvm: Emulate hot exception-entry sysregs in the hypervisor +- KVM: arm64: pvm: Present sanitized ID registers to the guest +- KVM: arm64: pvm: Emulate TPIDRRO_EL0 writes +- KVM: arm64: pvm: Emulate SPSel and SP_EL0 +- KVM: arm64: pvm: Emulate CurrentEL +- KVM: arm64: pvm: Emulate context and debug system registers +- KVM: arm64: pvm: Emulate EL1 exception state registers +- KVM: arm64: pvm: Emulate IC IALLU and IALLUIS +- KVM: arm64: pvm: Emulate DC set/way operations +- KVM: arm64: pvm: Emulate MMU and cache system registers +- KVM: arm64: pvm: Virtualize DAIF for the guest kernel +- KVM: arm64: pvm: Emulate HVC +- KVM: arm64: pvm: Emulate ERET +- KVM: arm64: pvm: Deliver guest SVCs as synchronous exceptions +- KVM: arm64: pvm: Emulate trapped MRS/MSR instructions +- KVM: arm64: pvm: Capture trapped guest instructions +- Linkdata: update HBA/RAID controller driver +- net: ipv6: Fix UDP length overflow with PMTU discover and big MTU +- ipv6: lockless IPV6_MTU implementation +- ipv6: lockless IPV6_MULTICAST_HOPS implementation +- ipv6: lockless IPV6_MULTICAST_LOOP implementation +- ipv6: lockless IPV6_UNICAST_HOPS implementation +- x86/configs: make ACPI_PLATFORM_PROFILE built-in in openeuler_defconfig +- cpufreq/amd-pstate: Skip auto_sel write when it already matches the mode +- cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks +- cpufreq/amd-pstate: Cache the firmware programmed EPP value +- cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems +- cpufreq/amd-pstate: Fix EPP return type and handle errors during initialization +- cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active +- cpufreq/amd-pstate: Fix setting EPP in performance mode +- cpufreq/amd-pstate: drop stale @epp_cached kdoc +- cpufreq/amd-pstate-ut: Disable dynamic_epp after the mode switch +- cpufreq/amd-pstate-ut: Drop policy reference before driver switch +- cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled +- cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset +- cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified +- cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name +- cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp +- cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP +- MAINTAINERS: amd-pstate: Step down as maintainer, add Prateek as reviewer +- cpufreq: Pass the policy to cpufreq_driver->adjust_perf() +- cpufreq/amd-pstate: Pass the policy to amd_pstate_update() +- cpufreq/amd-pstate-ut: Add a unit test for raw EPP +- cpufreq/amd-pstate: Add support for raw EPP writes +- cpufreq/amd-pstate: Add support for platform profile class +- cpufreq/amd-pstate: Add static asserts for EPP indices +- ACPI: CPPC: Detect preferred core availability on online CPUs +- ACPI: platform_profile: Avoid initializing on non-ACPI platforms +- ACPI: platform_profile: Optimize _aggregate_choices() +- platform/x86/amd: pmf: Add balanced-performance to hidden choices +- platform/x86/amd: pmf: Add 'quiet' to hidden choices +- ACPI: platform_profile: Add support for hidden choices +- ACPI: platform_profile: Fix memory leak in profile_class_is_visible() +- ACPI: platform_profile: Improve platform_profile_unregister() +- platform/x86: thinkpad_acpi: Fix registration of tpacpi platform driver +- platform/x86: ideapad-laptop: pass a correct pointer to the driver data +- ACPI: platform_profile: Add a prefix to log messages +- ACPI: platform_profile: Add documentation +- ACPI: platform_profile: Clean platform_profile_handler +- ACPI: platform_profile: Move platform_profile_handler +- ACPI: platform_profile: Remove platform_profile_handler from exported symbols +- platform/x86: thinkpad_acpi: Use devm_platform_profile_register() +- platform/x86: hp-wmi: Use devm_platform_profile_register() +- platform/x86: ideapad-laptop: Use devm_platform_profile_register() +- platform/x86: asus-wmi: Use devm_platform_profile_register() +- platform/x86: amd: pmf: sps: Use devm_platform_profile_register() +- platform/surface: surface_platform_profile: Use devm_platform_profile_register() +- ACPI: platform_profile: Add `probe` to platform_profile_ops +- ACPI: platform_profile: Add `ops` member to handlers +- ACPI: platform_profile: Remove platform_profile_handler from callbacks +- ACPI: platform_profile: Let drivers set drvdata to the class device +- ACPI: platform_profile: Replace *class_dev member with class_dev +- ACPI: platform_profile: Add devm_platform_profile_register() +- ACPI: platform_profile: Allow multiple handlers +- ACPI: platform_profile: Notify class device from platform_profile_notify() +- ACPI: platform_profile: Check all profile handler to calculate next +- ACPI: platform_profile: Make sure all profile handlers agree on profile +- ACPI: platform_profile: Add concept of a "custom" profile +- ACPI: platform_profile: Only show profiles common for all handlers +- scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot +- scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs +- smb: client: close handle after create-context parsing failure +- smb/client: pass cifs_open_info_data to SMB2_open() +- smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() +- smb: client: clean up failed cached directory opens +- smb: move SMB2 Status code to common header file +- smb: client: use finish_no_open() for non-regular inodes +- smb: client: close completed creates on compound wait errors +- KVM: arm64: pvm: Add PVM-specific sysreg access callbacks +- net: reject oversized tx_queue_len at netlink parse time +- nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() +- bpf: Fix kabi breakage in struct bpf_prog_aux +- bpf: Wait for an RCU tasks grace period before freeing trampoline progs +- vlan: require the MAC header to be present in __vlan_insert_inner_tag() +- scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking +- ipvs: filter some flags received in the backup server +- USB: serial: fix ioctl hangup race +- smb: client: discard post-EOF pagecache when extending a file via zero range +- perf: Require kernel access for text poke events +- perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() +- smb: client: delete compound mids on send failure before unlock +- net: ipv4: Fix UDP length overflow with PMTU discover and big MTU + +* Wed Oct 28 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-181.0.0.160 +- !30180 ub: ub_fwctl: Supports the query of DFX registers of the UMMU in different versions. +- !30167 Fix CVE-2026-98857 +- !30166 Fix CVE-2026-98493 +- !30165 Fix CVE-2026-97901 +- !30164 Fix CVE-2026-97965 +- !30132 Fix CVE-2026-98853 +- !30190 v2 md: fix null-ptr-deref in md_check_no_bitmap() +- !30160 smb: client: flush and commit data before querying allocated ranges +- !30028 drivers/ub/sentry: fix torn read of g_link_event_enable in proc show +- md: fix null-ptr-deref in md_check_no_bitmap() +- !29942 [CVEAgent@OLK-6.6] Fix CVE-2026-98683 +- !25021 phytium inclusion： Fix bugs in Phytium's cross-socket DMA write optimization patch for S5000C series servers (Issue: ICBHX3) +- !29731 openEuler:driver:drm:engiant: optimize egt display driver +- !30020 iommu/amd: Do not reallocate GA log buffers on resume +- !30162 smb: client: drain and invalidate before server-side copy/clone +- !29980 [CVEAgent@OLK-6.6] Fix CVE-2026-98771 +- !29971 [CVEAgent@OLK-6.6] Fix CVE-2026-98763 +- !29498 [OLK-6.6]nse: add support for wangxun nse driver +- !29940 [CVEAgent@OLK-6.6] Fix CVE-2026-98681 +- !29233 [CVEAgent@OLK-6.6] Fix CVE-2026-93801 +- !29240 [CVEAgent@OLK-6.6] Fix CVE-2026-93827 +- !29250 [CVEAgent@OLK-6.6] Fix CVE-2026-97441 +- !29655 netlink: do not free nlk->groups while lockless readers can use it +- !29994 [CVEAgent@OLK-6.6] Fix CVE-2026-98809 +- !30081 [CVEAgent@OLK-6.6] Fix CVE-2026-99009 +- !30083 [CVEAgent@OLK-6.6] Fix CVE-2026-99014 +- !30084 [CVEAgent@OLK-6.6] Fix CVE-2026-99015 +- !30143 nvmet: fix max_qid race between configfs and controller allocation +- !29928 [CVEAgent@OLK-6.6] Fix CVE-2026-98551 +- !29986 [CVEAgent@OLK-6.6] Fix CVE-2026-98789 +- !29973 [CVEAgent@OLK-6.6] Fix CVE-2026-98767 +- !30120 sme-re-enable-v3 +- ub: ub_fwctl: Supports the query of DFX registers of the UMMU in different versions. +- !30055 [CVEAgent@OLK-6.6] Fix CVE-2026-98935 +- !30133 some fixes to xSched +- !30054 [CVEAgent@OLK-6.6] Fix CVE-2026-98933 +- x86/arm64: config: enable the Wangxun NSE Ethernet driver +- net: wangxun: nse: add support for 100GbE NICs +- ipvs: bound LBLCR and LBLC cache growth +- ipvs: fix missing counter decrement in lblc +- net: ipconfig: bound DHCP option construction +- net: ipconfig: Remove outdated comment and indent code block +- genetlink: pin family module during policy dump +- vxlan: initialize _md in vxlan_xmit_one() +- smb: client: drain and invalidate before server-side copy/clone +- smb: client: flush and commit data before querying allocated ranges +- nvmet: fix max_qid race between configfs and controller allocation +- xsched: make vstream_hbm_free tolerate a missing context +- xsched: add debug log for picked entity +- xsched: fix use-after-free in vstream lookup by user stream id +- net: gso: limit recursive IP-in-IP segmentation +- net: increase IP_TUNNEL_RECURSION_LIMIT to 5 +- drivers/ub/sentry: serialize link_event on/off writes against exit +- drivers/ub/sentry: fix torn read of g_link_event_enable in proc show +- arm64/fpsimd: Allow CONFIG_ARM64_SME to be selected +- arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems +- arm64/fpsimd: ptrace: Fix SVE writes on !SME systems +- arm64/fpsimd: ptrace: Gracefully handle errors +- kselftest/arm64: Fix test for streaming FPSIMD write in sve-ptrace +- arm64/fpsimd: ptrace: Mandate SVE payload for streaming-mode state +- arm64/fpsimd: ptrace: Fix inactive SVE and SSVE regsets +- arm64/fpsimd: ptrace: Do not present register data for inactive mode +- arm64/fpsimd: ptrace: Save task state before generating SVE header +- arm64/fpsimd: ptrace/prctl: Ensure VL changes leave task in a valid state +- arm64/fpsimd: Factor out {sve,sme}_state_size() helpers +- arm64/fpsimd: ptrace/prctl: Ensure VL changes do not resurrect stale data +- arm64/fpsimd: Make clone() compatible with ZA lazy saving +- arm64/fpsimd: Clear PSTATE.SM during clone() +- arm64/fpsimd: Consistently preserve FPSIMD state during clone() +- arm64/fpsimd: Remove redundant task->mm check +- arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's +- arm64/fpsimd: ptrace: Consistently handle partial writes to NT_ARM_(S)SVE +- arm64/fpsimd: signal: Clear PSTATE.SM when restoring FPSIMD frame only +- arm64/fpsimd: Remove opportunistic freeing of SME state +- Bluetooth: hci_sock: Serialize dead-device detachment +- Bluetooth: hci_sync: Fix command skb lifetime during scan setup +- Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex +- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak +- usb: hub: use shorter 120ms post resume hold for SS root hubs +- pswiotlb: Fix cross-socket DMA write optimization on Phytium S5000C +- iommu/amd: Do not reallocate GA log buffers on resume +- Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister +- bpf: Fix objects stuck in free_by_rcu_ttrace +- bpf: Factor out __do_call_rcu_ttrace() +- usb: storage: sierra_ms: reject short SWoC info transfers +- usb: dwc3: gadget: fix IRQ storm on invalid event buffer count +- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints +- smb: client: flush dirty data before zeroing a range +- smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races +- perf/core: Fill branch entries with a single assignment +- drm-engiant: optimize driver code +- netlink: do not free nlk->groups while lockless readers can use it +- ata: ahci: fail probe if BAR too small for claimed ports +- virtio-fs: avoid double-free on failed queue setup +- smb/client: zero-initialize stack-allocated cifs_open_info_data + +* Tue Oct 27 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-180.0.0.159.20261027.42bfd53eeb41 +- !30108 [CVEAgent@OLK-6.6] Fix CVE-2026-99082 +- !30111 ipv6: mcast: use rcu_assign_pointer() for __rcu list updates +- !29650 ipv6: flowlabel: cap duplicate leases per socket +- !30004 [CVEAgent@OLK-6.6] Fix CVE-2026-98833 +- !30006 [CVEAgent@OLK-6.6] Fix CVE-2026-98838 +- !29998 [CVEAgent@OLK-6.6] Fix CVE-2026-98816 +- !30123 ice: fix metadata_dst refcount handling on representor teardown +- !30022 io_uring/rw: end write accounting from ->ki_complete +- !30023 smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() +- !29996 [CVEAgent@OLK-6.6] Fix CVE-2026-98813 +- !29529 [CVEAgent@OLK-6.6] Fix CVE-2026-98229 +- !29922 [2/3] [OLK-6.6] Backport CPPC Performance Priority and AMD P-State modernization patches to openEuler v6.6 kernel +- !30047 nfs/enfs: fix memory reference count leak and debug information +- !29553 [CVEAgent@OLK-6.6] Fix CVE-2026-98285 +- !29314 [CVEAgent@OLK-6.6] Fix CVE-2026-97616 +- ice: fix metadata_dst refcount handling on representor teardown +- ipv6: mcast: use rcu_assign_pointer() for __rcu list updates +- ipv6: flowlabel: cap duplicate leases per socket +- KVM: x86: Use active memslots for the per-vCPU MMIO cache +- nfs/enfs: release RPC references after DNS work +- nfs/enfs: free multipath client subobjects +- nfs/enfs: unlock RCU on missing transport context +- nfs/enfs: stop DNS work setup after refcount failure +- nfs/enfs: assign slots for periodic DNS refresh +- nfs/enfs: free replaced DNS mount options +- nfs/enfs: log NFSD links and allow runtime export debug toggling +- smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() +- io_uring/rw: end write accounting from ->ki_complete +- vt: skip screen update for DEC alignment test on backgroup consoles +- mtd: core: call _get_device() with the master MTD +- bpf: Fix overflow of jump offset in constant blinding +- bpf: Hold map BTF for the memory allocator destructor record +- x86/configs: set amd-pstate dynamic EPP in openeuler_defconfig +- ACPI: platform_profile: Notify change events on register and unregister +- ACPI: platform_profile: Add profile attribute for class interface +- ACPI: platform_profile: Add choices attribute for class interface +- ACPI: platform_profile: Add name attribute to class interface +- ACPI: platform_profile: Create class for ACPI platform profile +- ACPI: platform_profile: Use `scoped_cond_guard` +- ACPI: platform_profile: Use guard(mutex) for register/unregister +- ACPI: platform_profile: Move matching string for new profile out of mutex +- ACPI: platform_profile: Move sanity check out of the mutex +- ACPI: platform_profile: Pass the profile handler into platform_profile_notify() +- ACPI: platform_profile: Add platform handler argument to platform_profile_remove() +- ACPI: platform_profile: Add device pointer into platform profile handler +- ACPI: platform-profile: Add a name member to handlers +- ACPI: processor: Move arch_init_invariance_cppc() call later +- ACPI: add missing MODULE_DESCRIPTION() macros +- ACPI: platform-profile: add platform_profile_cycle() +- cpufreq/amd-pstate: add kernel command line to override dynamic epp +- Documentation: amd-pstate: introduce amd-pstate preferred core +- Documentation: introduce amd-pstate preferrd core mode kernel command line options +- cpufreq/amd-pstate: Add dynamic energy performance preference +- cpufreq/amd-pstate: Use sysfs_match_string() for epp +- Documentation: amd-pstate: fix dead links in the reference section +- cpufreq/amd-pstate: Cache the max frequency in cpudata +- Documentation/amd-pstate: Add documentation for amd_pstate_floor_{freq,count} +- Documentation/amd-pstate: List amd_pstate_prefcore_ranking sysfs file +- Documentation/amd-pstate: List amd_pstate_hw_prefcore sysfs file +- amd-pstate-ut: Add a testcase to validate the visibility of driver attributes +- amd-pstate-ut: Add module parameter to select testcases +- amd-pstate: Introduce a tracepoint trace_amd_pstate_cppc_req2() +- amd-pstate: Add sysfs support for floor_freq and floor_count +- amd-pstate: Add support for CPPC_REQ2 and FLOOR_PERF +- x86/cpufeatures: Add AMD CPPC Performance Priority feature. +- amd-pstate: Make certain freq_attrs conditionally visible +- x86/cpufeatures: Make X86_FEATURE leaf 17 Linux-specific +- cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate +- cpufreq/amd-pstate: Fix a regression leading to EPP 0 after resume +- cpufreq/amd-pstate: Disable preferred cores on designs with workload classification +- bitfield: Add FIELD_MODIFY() helper +- cpufreq/amd-pstate: Avoid shadowing ret in amd_pstate_ut_check_driver() +- amd-pstate-ut: Reset amd-pstate driver mode after running selftests +- ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel() +- x86/cpufeatures: Add X86_FEATURE_AMD_WORKLOAD_CLASS feature bit +- cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf +- cpufreq: intel_pstate: Fix crash during turbo disable +- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible +- cpufreq/amd-pstate: Add comment explaining nominal_perf usage for performance policy +- cpufreq: intel_pstate: Rearrange variable declaration involving __free() +- cpufreq/amd-pstate: Add support for the "Requested CPU Min frequency" BIOS option +- cpufreq/amd-pstate: Add offline, online and suspend callbacks for amd_pstate_driver +- cpufreq/amd-pstate: Move max_perf limiting in amd_pstate_update +- cpufreq/amd-pstate: Update asym_prefer_cpu when core rankings change +- sched/topology: Introduce sched_update_asym_prefer_cpu() +- cpufreq/amd-pstate: Enable ITMT support after initializing core rankings +- cpufreq: Pass policy pointer to ->update_limits() +- cpufreq: intel_pstate: Rearrange max frequency updates handling code +- cpufreq: Add and use cpufreq policy locking guards +- cpufreq: Split cpufreq_online() +- cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF() +- cpufreq/amd-pstate: Fix setting of CPPC.min_perf in active mode for performance governor +- cpufreq: Consolidate some code in cpufreq_online() +- cpufreq/amd-pstate: Fix min_limit perf and freq updation for performance governor +- cpufreq/amd-pstate: Drop actions in amd_pstate_epp_cpu_offline() +- cpufreq/amd-pstate: Stop caching EPP +- cpufreq/amd-pstate-ut: Adjust variable scope +- cpufreq/amd-pstate-ut: Run on all of the correct CPUs +- cpufreq/amd-pstate-ut: Drop SUCCESS and FAIL enums +- cpufreq/amd-pstate-ut: Allow lowest nonlinear and lowest to be the same +- cpufreq/amd-pstate-ut: Use _free macro to free put policy +- cpufreq: intel_pstate: Rearrange locking in hybrid_init_cpu_capacity_scaling() +- cpufreq: intel_pstate: Update asym capacity for CPUs that were offline initially +- cpufreq: intel_pstate: Clear hybrid_max_perf_cpu before driver registration +- cpufreq: intel_pstate: Set asymmetric CPU capacity on hybrid systems +- x86/sched: Add basic support for CPU capacity scaling +- cpufreq/amd-pstate: Rework CPPC enabling +- cpufreq/amd-pstate: Drop debug statements for policy setting +- cpufreq/amd-pstate: Update cppc_req_cached for shared mem EPP writes +- cpufreq/amd-pstate: Move all EPP tracing into *_update_perf and *_set_epp functions +- cpufreq/amd-pstate: Cache CPPC request in shared mem case too +- cpufreq/amd-pstate: Replace all AMD_CPPC_* macros with masks +- cpufreq/amd-pstate: Drop `cppc_cap1_cached` +- cpufreq/amd-pstate: Overhaul locking +- cpufreq/amd-pstate: Move perf values into a union +- cpufreq/amd-pstate: Drop min and max cached frequencies +- cpufreq/amd-pstate: Show a warning when a CPU fails to setup +- cpufreq/amd-pstate: Invalidate cppc_req_cached during suspend +- cpufreq/amd-pstate: Fix the clamping of perf values +- cpufreq/amd-pstate: Remove the unncecessary driver_lock in amd_pstate_update_limits +- cpufreq/amd-pstate: Use scope based cleanup for cpufreq_policy refs +- amd-pstate: Update cppc_req_cached in fast_switch case +- amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() +- cpufreq: amd: Set policy->boost_supported +- cpufreq: Introduce policy->boost_supported flag +- cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost +- cpufreq/amd-pstate: Remove the unnecessary cpufreq_update_policy call +- cpufreq/amd-pstate: Modularize perf<->freq conversion +- net: bridge: vlan: fix bugs caused by switchdev deletion errors +- xfrm: save input state data before secpath resets +- net/sched: act_api: release all action references on NEWACTION failure + +* Mon Oct 26 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-180.0.0.159.20261026.32679896bcc2 +- !30016 [CVEAgent@OLK-6.6] Fix CVE-2026-98862 +- !29528 [CVEAgent@OLK-6.6] Fix CVE-2026-98222 +- !29891 ASoC: Intel: boards: select HDA_DSP_COMMON only when SOF HDA codec is enabled +- !29979 [CVEAgent@OLK-6.6] Fix CVE-2026-98720 +- audit: fix exe mark UAF in kill_rules() +- KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified +- ASoC: Intel: boards: select HDA_DSP_COMMON only when SOF HDA codec is enabled +- KEYS: encrypted: fix integer overflow of datablob_len + +* Sat Oct 24 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-180.0.0.159.20261024.d32b3f9da300 +- !28148 [CVEAgent@OLK-6.6] Fix CVE-2026-90228 +- !29648 ipmr: account multicast table and route memory +- !29437 NBL support S2000 +- !29975 net/hinic5:Fix the missing rollback in the hinic5 XDP +- !29956 [CVEAgent@OLK-6.6] Fix CVE-2026-98734 +- !29938 [CVEAgent@OLK-6.6] Fix CVE-2026-98668 +- !29981 smb: client: zero the post-EOF pagecache on writeback +- !29921 [CVEAgent@OLK-6.6] Fix CVE-2026-98502 +- !29957 [CVEAgent@OLK-6.6] Fix CVE-2026-98735 +- !29913 [CVEAgent@OLK-6.6] Fix CVE-2026-98462 +- !29955 [CVEAgent@OLK-6.6] Fix CVE-2026-98733 +- !30015 [CVEAgent@OLK-6.6] Fix CVE-2026-98859 +- !29959 [CVEAgent@OLK-6.6] Fix CVE-2026-98737 +- !29912 [CVEAgent@OLK-6.6] Fix CVE-2026-98458 +- !29939 [CVEAgent@OLK-6.6] Fix CVE-2026-98669 +- !29960 [CVEAgent@OLK-6.6] Fix CVE-2026-98738 +- !29958 [CVEAgent@OLK-6.6] Fix CVE-2026-98736 +- !29937 [CVEAgent@OLK-6.6] Fix CVE-2026-98656 +- !29961 [CVEAgent@OLK-6.6] Fix CVE-2026-98739 +- Add Nebula-Matrix S1000/S2000 series net driver supports RDMA +- net/hinic5:Fix the missing rollback in the hinic5 XDP +- HID: multitouch: stop the release timer from being rearmed on remove +- smb: client: zero the post-EOF pagecache on writeback +- Bluetooth: RFCOMM: Fix initial port reference race +- Bluetooth: Serialize SMP remote OOB data access +- Bluetooth: hci_sync: Fix inquiry cache use-after-free +- Bluetooth: hci_conn: Lock parent access during enhanced SCO setup +- Bluetooth: hci_core: Serialize ACL scheduling with channel deletion +- Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown +- Bluetooth: hci_core: Serialize fragmented ISO packet queueing +- iio: buffer: serialize buffer teardown with mode claims +- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. +- iio: trigger: cancel reenable_work before freeing trigger +- HID: alps: unregister DualPoint Stick input device on remove +- Bluetooth: hci_conn: fix CIS hold ownership on reuse +- Bluetooth: ISO: release unused CIS holds after channel attach +- ipmr: account multicast table and route memory +- nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() + +* Fri Oct 23 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-180.0.0.159.20261023.2bc092fdab76 +- !29871 [PATCH 0/24] KVM: arm64:KVM: arm64: pvm: Adapt the vCPU run path for EL0 guest execution +- !29283 [CVEAgent@OLK-6.6] Fix CVE-2026-97532 +- !30017 smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() +- !29285 [CVEAgent@OLK-6.6] Fix CVE-2026-97536 +- !29284 [CVEAgent@OLK-6.6] Fix CVE-2026-97535 +- !29282 [CVEAgent@OLK-6.6] Fix CVE-2026-97531 +- !29281 [CVEAgent@OLK-6.6] Fix CVE-2026-97530 +- !29280 [CVEAgent@OLK-6.6] Fix CVE-2026-97529 +- !29278 [CVEAgent@OLK-6.6] Fix CVE-2026-97527 +- !29933 [CVEAgent@OLK-6.6] Fix CVE-2026-98599 +- !29728 ALSA: pcm: set timer->private_data before registering the PCM timer +- !30032 ub: ub_fwctl: Remove the dependency of the ub_fwctl driver on the ubcore driver. +- !29264 [CVEAgent@OLK-6.6] Fix CVE-2026-97477 +- ub: ub_fwctl: Remove the dependency of the ub_fwctl driver on the ubcore driver. +- !30018 hisilicon: HBM dev/cache fixes and sysfs cleanup +- !28724 Fix CVE-2026-93266 +- !29148 Fix CVE-2026-93093 +- !30019 ACPI: APEI: Handle repeated SEA error storms +- !30007 [CVEAgent@OLK-6.6] Fix CVE-2026-98840 +- ACPI: APEI: Handle repeated SEA error storms +- KVM: arm64: pvm: Avoid EL2 register reads in panic diagnostics +- soc/hisilicon: Remove the memdev kobj +- soc/hisilicon: Clean the hbmcache state show sysfs +- Revert "soc: hisilicon: hisi_hbmdev: Provide extra memory topology information" +- Revert "soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods" +- soc: hisilicon: Serialize the online and onfline the acpi devices +- soc: hisilicon: hbmdev: Only support built-in +- arm64: config: Open the hbmdev related config +- arm64: openeuler_defconfig: add Kunpeng HCCS config +- hisilicon/hisi_hbmdev: prevent NULL pointer dereference when corrently +- soc: hisilicon: Setting the demand_offline in sysfs interface +- soc: hisilicon: hisi_hbmdev: Notify the device in the ACPI +- soc: hisilicon: Don't poweroff if memblocks don't offlined +- hisilicon/hisi_hbmcache: Use mutex_trylock to prevent hung task +- ACPI/HMAT: Add missing locality information for hot-added device +- hisilicon/hisi_hbmdev: Add lock to protect pcc operation region +- hisilicon/hisi_hbmcache: Add a lock to protect pcc operation region +- soc:hisilicon: Use _ON and _OFF in hbmcache +- smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() +- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF +- KVM: arm64: pvm: Trap guest DAIF accesses +- KVM: arm64: pvm: Preserve guest FPSIMD state +- KVM: arm64: pvm: Context-switch CPACR_EL1 +- KVM: arm64: pvm: Context-switch TCR_EL1 +- KVM: arm64: pvm: Context-switch SCTLR_EL1 +- KVM: arm64: pvm: Preserve virtual PSTATE across instruction skips +- KVM: arm64: pvm: Virtualize the L2 DAIF bits +- KVM: arm64: pvm: Keep the virtual SP_EL1 in sp_el0 +- KVM: arm64: pvm: Project the L2 pstate to EL0 and back +- KVM: arm64: pvm: Use EL1 state for exception recovery +- KVM: arm64: pvm: Install the PVM vector for the L2 run +- KVM: arm64: pvm: Use dedicated EL1 exception vectors +- KVM: arm64: pvm: Skip VGIC hardware state switching +- KVM: arm64: pvm: Skip the VHE guest debug switch +- KVM: arm64: pvm: Skip the MTE and pointer-auth switches at EL1 +- KVM: arm64: pvm: Add dedicated guest context-switch assembly +- bpf: Reject non-negative offsets in stack_slot_obj_get_spi() +- KVM: arm64: pvm: Skip the common state swap +- KVM: arm64: pvm: Skip the stage-2 regime load +- KVM: arm64: pvm: Keep the vCPU sysreg accessors memory-backed +- KVM: arm64: pvm: Adapt the VHE sysreg load/put paths to PVM +- KVM: arm64: pvm: Select the per-CPU offset register at runtime +- KVM: arm64: pvm: Allocate the VM like a VHE host +- KVM: arm64: pvm: Skip hyp memory sharing +- ALSA: pcm: set timer->private_data before registering the PCM timer +- scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown +- scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size +- scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path +- scsi: qla2xxx: Skip vport under deletion in report ID acquisition +- scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature +- scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] +- scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock +- scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error +- RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() +- firmware: arm_scmi: Publish channel state before callbacks +- arm64: RSI: fix field-spanning write warning in attestation token init + +* Thu Oct 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-180.0.0.159.20261022.3f89f2d87dff +- !29881 [OLK-6.6] ub: Fix mailbox sequencing, reset handling and debugfs queries +- !29897 ub: ub_fwctl: Modify the interception and validation of abnormal data when obtaining real-time bandwidth. +- ub: ubase&udma: Resolve debugfs query devices in client drivers +- ub: ubase: replace ras port reset with elr reset +- ub: ubase&unic&ubaseproxy: Validate messages and channel lifetime +- ub: ubase: Unify the state bits into the device state word +- net: unic: Simplify vlan table locking with a single mutex +- ub: ubase: fix seq_num and resp registration for mbox over cmdq +- !29880 [OLK-6.6] ub: Fix VLAN races, control responses and resource cleanup +- !29892 PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() +- !29890 Fix CVE-2026-89654 +- ub: ubase: Use unsafe_memcpy for cross-field command descriptors +- ub: ubase: Fix DTU context leaks and repeated buffer frees +- !29879 [OLK-6.6] ub: Fix context lifetime, stale responses and parameter checks +- ub: ub_fwctl: Modify the interception and validation of abnormal data when obtaining real-time bandwidth. +- !29695 Fix CVE-2026-90186 +- !29779 ALSA: usb-audio: caiaq: validate EP1 reply lengths +- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() +- ceph: fix use-after-free in check_new_map() after early session put +- ceph: fix UAF in check_new_map() on session freed during unlock +- ub: ubase&unic: Serialize VLAN updates against deferred deletion +- ub: ubase: Fix dma pool leak in safe model +- ub: ubase: reject stale ctrlq response on reused msg queue slot +- net: unic: The MTU is modified without checking the network port status +- ub: ubase: Add branch to determine whether imp returns abnormal value +- ub: ubaseproxy: Fix SEID bounds and clean up logs and formatting +- ub: ubase: Serialize activation requests and response matching +- ub: ubase&unic&ubaseproxy: fix OOB read, resource leak and several defects +- ub: ubase: release unpublished context pages +- ub: ubaseproxy: Fixed the issue of jfc CQE count +- ALSA: usb-audio: caiaq: validate EP1 reply lengths +- null_blk: reject per-device queue resize for shared tag set + +* Wed Oct 21 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-180.0.0.159 +- !29133 fix CVE-2026-90421 +- !29865 v2 mm/hugetlb: fix gigantic hugetkb reservation for remote NUMA +- !29435 drivers/ub/sentry: fix NULL deref when UVB msg arrives during reboot teardown +- !29874 v3 CVE-2026-89642 +- !29827 v2 CVE-2026-89642 +- !29766 [OLK-6.6] fix CVE-2026-97978 +- !27889 [1/3] [OLK-6.6] Backport CPPC Performance Priority and AMD P-State modernization patches to openEuler v6.6 kernel +- !29753 [OLK-6.6] Fix CVE-2026-97946 +- !29754 [OLK-6.6] Fix CVE-2026-97947 +- !29806 Fix CVE-2026-98124 +- !29875 kprobes: Skip disarmed probes when checking optkprobe overlap +- !29545 [CVEAgent@OLK-6.6] Fix CVE-2026-98261 +- !29536 [CVEAgent@OLK-6.6] Fix CVE-2026-98248 +- !29514 [CVEAgent@OLK-6.6] Fix CVE-2026-98175 +- !29513 [CVEAgent@OLK-6.6] Fix CVE-2026-98173 +- !29512 [CVEAgent@OLK-6.6] Fix CVE-2026-98172 +- !29509 [CVEAgent@OLK-6.6] Fix CVE-2026-98170 +- !29508 [CVEAgent@OLK-6.6] Fix CVE-2026-98169 +- !29507 [CVEAgent@OLK-6.6] Fix CVE-2026-98168 +- !29506 [CVEAgent@OLK-6.6] Fix CVE-2026-98167 +- !29265 [CVEAgent@OLK-6.6] Fix CVE-2026-97479 +- !29876 [OLK-6.6][linux-6.6.y sync] Backport 6.6.158-6.6.159 LTS Conflict Patches +- !29349 [CVEAgent@OLK-6.6] Fix CVE-2026-97987 +- kprobes: Skip disarmed probes when checking optkprobe overlap +- ipv4: validate checksum_start before completing checksum +- netfilter: nfnetlink_queue: unbreak SCTP traffic +- smb: client: clear post-EOF pagecache when extending a file via truncate +- cifs: call pagecache_isize_extended() in cifs_setsize() when extending +- !29390 [CVEAgent@OLK-6.6] Fix CVE-2026-98088 +- !29377 [CVEAgent@OLK-6.6] Fix CVE-2026-98056 +- !29270 [CVEAgent@OLK-6.6] Fix CVE-2026-97494 +- !29336 [CVEAgent@OLK-6.6] Fix CVE-2026-97950 +- mm, hugetlb: restrict __GFP_MEMALLOC to non-gigantic pages +- mm, hugetlb: implement movable_gigantic_pages sysctl +- drivers/ub/sentry: fix NULL deref when UVB msg arrives during reboot teardown +- smb: client: clear post-EOF pagecache when extending a file via truncate +- cifs: call pagecache_isize_extended() in cifs_setsize() when extending +- smb/client: invalidate fscache for fallocate range operations +- eth: ice: don't dereference pointers from TP_printk() +- x86/amd_node: Fix potential NULL pointer dereference +- x86/amd_node: Fix PCI device reference counting in amd_smn_init() +- x86/configs: enable amd-pstate in openeuler_defconfig +- cifs: Fix server use-after-free in cifs_chan_skip_or_disable() +- arm64: percpu: Fix LSE operations on {8,16}-bit types +- smb: client: cancel reconnect work in clean_demultiplex_info() +- smb: client: fix use-after-free of iface in cifs_try_adding_channels() +- smb: client: fix smbd_connection leak on cifs_get_tcp_session() error +- smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() +- smb: client: fix potential OOB read in smb3_enum_snapshots() +- smb: client: fix reparse buffer bounds in cifs_query_reparse_point() +- smb: client: fix server->total_read for compound encrypted PDUs +- scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() +- nvme: remove stale namespaces by NSID range during scan +- virtio_input: reset device if input_register_device() fails +- configfs: pin the symlink target's dirent instead of chasing ->ci_dentry +- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw +- driver core: Avoid warning when removing a device while its supplier is unbinding +- PCI: Fix UAF when probe runs concurrent to dyn ID removal +- PCI: Fix dyn_id add TOCTOU +- PCI: Make pci_match_one_device() match on ID instead of device +- agp/amd-k7: Don't rely on address of pci_device_id +- agp/via: Don't rely on address of pci_device_id +- mlxsw: pci: Don't store pci_device_id +- ipack: tpci200: Don't store pci_device_id +- scsi: nsp32: Don't store pci_device_id +- ata: ata_generic: Don't store pci_device_id +- cpufreq/amd-pstate: Convert all perf values to u8 +- cpufreq/amd-pstate: Pass min/max_limit_perf as min/max_perf to amd_pstate_update +- cpufreq/amd-pstate: Remove the redundant des_perf clamping in adjust_perf +- cpufreq/amd-pstate: Modify the min_perf calculation in adjust_perf callback +- cpufreq/amd-pstate: Fix cpufreq_policy ref counting +- cpufreq/amd-pstate: Fix max_perf updation with schedutil +- cpufreq/amd-pstate: Remove the goto label in amd_pstate_update_limits +- cpufreq/amd-pstate: Refactor max frequency calculation +- cpufreq/amd-pstate: Fix prefcore rankings +- cpufreq/amd-pstate: Drop boost_state variable +- cpufreq/amd-pstate: Set different default EPP policy for Epyc and Ryzen +- cpufreq/amd-pstate: Drop ret variable from amd_pstate_set_energy_pref_index() +- cpufreq/amd-pstate: Always write EPP value when updating perf +- cpufreq/amd-pstate: Cache EPP value and use that everywhere +- cpufreq/amd-pstate: Move limit updating code +- cpufreq/amd-pstate: Change amd_pstate_update_perf() to return an int +- cpufreq/amd-pstate: store all values in cpudata struct in khz +- cpufreq/amd-pstate: Only update the cached value in msr_set_epp() on success +- cpufreq/amd-pstate: Use FIELD_PREP and FIELD_GET macros +- cpufreq/amd-pstate: Drop cached epp_policy variable +- cpufreq/amd-pstate: convert mutex use to guard() +- cpufreq/amd-pstate: Add trace event for EPP perf updates +- cpufreq/amd-pstate: Merge amd_pstate_epp_cpu_offline() and amd_pstate_epp_offline() +- cpufreq/amd-pstate: Remove the cppc_state check in offline/online functions +- cpufreq/amd-pstate: Refactor amd_pstate_epp_reenable() and amd_pstate_epp_offline() +- cpufreq/amd-pstate: Move the invocation of amd_pstate_update_perf() +- cpufreq/amd-pstate: Convert the amd_pstate_get/set_epp() to static calls +- cpufreq/amd-pstate: Use boost numerator for upper bound of frequencies +- cpufreq/amd-pstate: Store the boost numerator as highest perf again +- cpufreq/amd-pstate: Detect preferred core support before driver registration +- cpufreq/amd-pstate: Push adjust_perf vfunc init into cpu_init +- cpufreq/amd-pstate: Align offline flow of shared memory and MSR based systems +- cpufreq/amd-pstate: Call cppc_set_epp_perf in the reenable function +- cpufreq/amd-pstate: Do not attempt to clear MSR_AMD_CPPC_ENABLE +- cpufreq/amd-pstate: Rename functions that enable CPPC +- amd-pstate: Add missing documentation for `amd_pstate_prefcore_ranking` +- cpufreq: amd-pstate: Add documentation for `amd_pstate_hw_prefcore` +- cpufreq/amd-pstate: Move registration after static function call update +- cpufreq/amd-pstate-ut: Add fix for min freq unit test +- cpufreq/amd-pstate: Remove the redundant amd_pstate_set_driver() call +- cpufreq/amd-pstate: Remove the switch case in amd_pstate_init() +- cpufreq/amd-pstate: Call amd_pstate_set_driver() in amd_pstate_register_driver() +- cpufreq/amd-pstate: Call amd_pstate_register() in amd_pstate_init() +- cpufreq/amd-pstate: Set the initial min_freq to lowest_nonlinear_freq +- cpufreq/amd-pstate: Remove the redundant verify() function +- cpufreq/amd-pstate: Drop needless EPP initialization +- cpufreq/amd-pstate: Use amd_pstate_update_min_max_limit() for EPP limits +- cpufreq/amd-pstate: Rename MSR and shared memory specific functions +- x86/cpufeatures: Rename X86_FEATURE_FAST_CPPC to have AMD prefix +- cpufreq/amd-pstate: Use nominal perf for limits when boost is disabled +- cpufreq/amd-pstate-ut: Fix an "Uninitialized variables" issue +- cpufreq/amd-pstate-ut: Add test case for mode switches +- cpufreq/amd-pstate: Export symbols for changing modes +- cpufreq: amd-pstate: Optimize amd_pstate_update_limits() +- cpufreq: amd-pstate: Merge amd_pstate_highest_perf_set() into amd_get_boost_ratio_numerator() +- x86/amd: Detect preferred cores in amd_get_boost_ratio_numerator() +- x86/amd: Move amd_get_highest_perf() out of amd-pstate +- x86/amd: Rename amd_get_highest_perf() to amd_get_boost_ratio_numerator() +- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update +- cpufreq/amd-pstate: Fix per-policy boost flag incorrect when fail +- cpufreq/amd-pstate: Don't update CPPC request in amd_pstate_cpu_boost_update() +- cpufreq/amd-pstate: Fix non kerneldoc comment +- ACPI: CPPC: Adjust return code for inline functions in !CONFIG_ACPI_CPPC_LIB +- x86/amd: Move amd_get_highest_perf() from amd.c to cppc.c +- cpufreq/amd-pstate: Catch failures for amd_pstate_epp_update_limit() +- cpufreq/amd-pstate: Use topology_logical_package_id() instead of logical_die_id() +- cpufreq: Make cpufreq_driver->exit() return void +- x86/CPU/AMD: Always inline amd_clear_divider() +- cpufreq/amd-pstate: Add the missing cpufreq_cpu_put() +- cpufreq/amd-pstate: Remove warning for X86_FEATURE_CPPC on certain Zen models +- cpufreq: amd-pstate: Fix uninitialized variable in amd_pstate_cpu_boost_update() +- cpufreq/amd-pstate-ut: Convert nominal_freq to khz during comparisons +- cpufreq: pcc: Remove empty exit() callback +- cpufreq: amd-pstate: Cap the CPPC.max_perf to nominal_perf if CPB is off +- cpufreq: amd-pstate: initialize core precision boost state +- cpufreq: acpi: move MSR_K7_HWCR_CPB_DIS_BIT into msr-index.h +- cpufreq: amd-pstate: Don't create attributes when registration fails +- cpufreq/amd-pstate: fix setting policy current frequency value +- cpufreq/amd-pstate-ut: Don't check for highest perf matching on prefcore +- cpufreq: amd-pstate: auto-load pstate driver by default +- cpufreq: amd-pstate: add debug message while CPPC is supported and disabled by SBIOS +- cpufreq: amd-pstate: show CPPC debug message if CPPC is not supported +- cpufreq: amd-pstate: remove unused variable nominal_freq +- cpufreq: amd-pstate: optimize the initial frequency values verification +- cpufreq: amd-pstate: Allow users to write 'default' EPP string +- cpufreq: amd-pstate: change cpu freq transition delay for some models +- x86/cpufeatures: Add AMD FAST CPPC feature flag +- cpufreq: amd-pstate: Fix the inconsistency in max frequency units +- cpufreq: amd-pstate: remove global header file +- cpufreq: amd-pstate: remove unused variable lowest_nonlinear_freq +- cpufreq: amd-pstate: fix code format problems +- cpufreq: amd-pstate: get transition delay and latency value from ACPI tables +- cpufreq: amd-pstate: Bail out if min/max/nominal_freq is 0 +- cpufreq: amd-pstate: Remove amd_get_{min,max,nominal,lowest_nonlinear}_freq() +- cpufreq: amd-pstate: Document the units for freq variables in amd_cpudata +- cpufreq: amd-pstate: Document *_limit_* fields in struct amd_cpudata +- cpufreq: amd-pstate: adjust min/max limit perf +- cpufreq: amd-pstate: Update amd-pstate preferred core ranking dynamically + +* Tue Oct 20 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-179.0.0.158.20261020.d82cf2fdc406 +- !29856 CVE-2026-98011 +- !26090 [OLK-6.6] wifi: iwlwifi: mvm: init vif works only once +- !29859 [OLK-6.6][linux-6.6.y sync] Backport 6.6.158-6.6.159 LTS Patches +- ipv4: free inet_opt and ireq_opt after an RCU grace period +- net/sched: hhf: clamp quantum in change and init paths +- !29296 [CVEAgent@OLK-6.6] Fix CVE-2026-97561 +- !29297 [CVEAgent@OLK-6.6] Fix CVE-2026-97562 +- !29295 [CVEAgent@OLK-6.6] Fix CVE-2026-97560 +- !29293 [CVEAgent@OLK-6.6] Fix CVE-2026-97558 +- !29292 [CVEAgent@OLK-6.6] Fix CVE-2026-97557 +- !29291 [CVEAgent@OLK-6.6] Fix CVE-2026-97556 +- !29290 [CVEAgent@OLK-6.6] Fix CVE-2026-97555 +- !29241 [CVEAgent@OLK-6.6] Fix CVE-2026-93829 +- !29197 [CVEAgent@OLK-6.6] Fix CVE-2026-90150 +- !29231 [CVEAgent@OLK-6.6] Fix CVE-2026-93794 +- Revert "net/sched: hhf: clamp quantum in change and init paths" +- !29230 [CVEAgent@OLK-6.6] Fix CVE-2026-93787 +- !29229 [CVEAgent@OLK-6.6] Fix CVE-2026-93785 +- !29211 [CVEAgent@OLK-6.6] Fix CVE-2026-93231 +- !29209 [CVEAgent@OLK-6.6] Fix CVE-2026-93228 +- !29199 [CVEAgent@OLK-6.6] Fix CVE-2026-90154 +- !29196 [CVEAgent@OLK-6.6] Fix CVE-2026-90149 +- !29188 [CVEAgent@OLK-6.6] Fix CVE-2026-90104 +- !29791 [OLK-6.6][linux-6.6.y sync] Backport 6.6.157-6.6.158 LTS Patches +- !28233 [CVEAgent@OLK-6.6] Fix CVE-2026-92499 +- !28234 [CVEAgent@OLK-6.6] Fix CVE-2026-92500 +- !28219 [CVEAgent@OLK-6.6] Fix CVE-2026-90400 +- drm/amdkfd: Unwind debug trap enable on copy_to_user failure +- drm/amdkfd: fix UAF race in destroy_queue_cpsch +- drm/amdkfd: Check bounds on allocate_doorbell +- drm/amdkfd: Fix OOB memory exposure in get_wave_state() +- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id +- Input: synaptics - limit T440p InterTouch quirk to LEN0036 +- i2c: at91: release DMA channels when probe defers +- net/sched: cls_route: reject change with no routing attribute +- tools headers: Update the linux/unaligned.h copy with the kernel sources +- Revert "wifi: libertas: reject short monitor TX frames" +- drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info +- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC +- drm/amd/pm/si: Fix updating clock limits on AC/DC +- minix: release the sb buffer_head when setting the v3 block size fails +- ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices +- crypto: atmel-ecc - avoid stale fallback key after set_secret failure +- crypto: virtio - Drop superfluous [as]kcipher_ctx pointer +- crypto: virtio - Less function calls in __virtio_crypto_akcipher_do_req() after error detection +- gtp: serialize PDP context updates +- usb: xhci: use cached HCSPARAMS1 value +- usb: xhci: implement USB Port Register Set struct +- usb: xhci: add USB Port Register Set struct +- usb: xhci: add helper to read PORTSC register +- usb: xhci: add tracing for PORTSC register writes +- ALSA: hda: Fix missing pointer check in hda_component_manager_init function +- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() +- lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected +- lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected +- tools/thermal/tmon: Fix compilation warning for wrong format +- perf test: Change all remaining #!/bin/sh to #!/bin/bash +- drm/amd/display: Ensure array index tg_inst won't be -1 +- drm/amd/display: Add a dc_state NULL check in dc_state_release +- net: tls: fix silent data drop under pipe back-pressure +- xfs: fix blockgc group quota scanning when usrquota isn't enforced +- smb: client: validate POSIX create context length +- smb: client: fix create context out-of-bounds reads +- Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO +- Bluetooth: mgmt: fix race in read_unconf_index_list() +- Bluetooth: L2CAP: validate frame length before control and FCS access +- Bluetooth: ISO: balance the parent hold in hci_bind_bis() +- Bluetooth: hci_sock: reject out-of-range OCF values +- Bluetooth: hci_sock: validate event length before filtering +- RISC-V: KVM: Fix HSM hart status error propagation +- RISC-V: KVM: Synchronize hrtimer callback during teardown +- s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() +- pinctrl: single: free the IRQ on domain creation failure +- scsi: libiscsi_tcp: Check the data direction of a Data-In PDU +- nfc: port100: reject frames whose declared length exceeds the received data +- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() +- nfc: fix use-after-free in nfc_get_local_general_bytes +- netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read +- netfilter: ip6t_rpfilter: reject routes without inet6_dev +- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() +- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist +- net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read +- net: atl1c: fix soft lockup on out-of-range tpd_cons read +- net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry +- net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() +- net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read +- net: arp: terminate device name before lookup +- net/sched: reject IDR error pointers when deleting actions +- net/mlx5e: advertise MACsec offload only when supported +- net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() +- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() +- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard +- HID: alps: fix use-after-free on input2 registration failure +- PCI: of_property: Omit bus properties without a subordinate bus +- gpio: tps65219: Fix GPIO input value reads +- drm/virtio: fix NULL pointer dereference on fence allocation failure +- drm/virtio: fix memory leak of fence event on execbuffer failure +- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() +- drm/nouveau: Fix gem reference leak in validate_init() +- drm/nouveau: fix double-free in nvif_vmm_dtor +- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() +- drm/nouveau: fix autosuspend cleanup during teardown +- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() +- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() +- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() +- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() +- drm/i915: fix incorrect RCU teardown order +- rds: ib: Clear the sg list when mapping an MR fails +- llc: reserve device headroom for allocated frames +- gpio: zynq: fix runtime PM leak on request error path +- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() +- ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST +- ipv6: do not let ipv6_find_hdr() return an offset past the packet end +- fsl/fman: Fix clk reference leak in read_dts_node() +- writeback: report a Tasks-RCU quiescent state per cgwb drain pass +- workqueue: Fix NULL current_pwq deref in flush dependency check +- writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes +- fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT +- ata: libata-scsi: bound the ATA passthru sense descriptor writes +- af_packet: fix integer overflow in prb_calc_retire_blk_tmo() +- sctp: discard the rest of the packet on a stale-cookie error +- tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow +- x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 +- mptcp: return sk_wait_data() errors from recvmsg() +- perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs() +- perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused +- perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED +- perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits +- autofs: fix sbi->pipe file reference leak in autofs_kill_sb() +- vlan: ensure sufficient headroom in vlan_dev_hard_header() +- net/sched: sch_teql: fix shadowed err in __teql_resolve() +- bridge: check llc_mac_hdr_init() return value in br_send_bpdu() +- llc: fix skb UAF and leaks on llc_mac_hdr_init() failure +- net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails +- tipc: Fix a data race on mon->peer_cnt in mon_timeout() +- net/smc: fix UAF on lgr list traversal in smcr_port_err() +- nfp: hold IPsec RX state under the XArray lock +- net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 +- bonding: crypto offload enabled, non-offload slave failover, rekey failed +- net: xps: reject an out of range traffic class +- vxlan: use one headroom snapshot for neighbour replies +- ip_gre: Reject enabling collect metadata through changelink +- net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT +- net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr +- net: bcmgenet: do not skip WoL power up on GENET V1 +- net: bcmgenet: allow return of power up status +- net: bcmgenet: move bcmgenet_power_up into resume_noirq +- net: bcmgenet: initialize u64 stats seq counter for all queues +- net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems +- tg3: use random MAC address when tg3_get_device_address fails +- driver core: Add device probe log helper dev_warn_probe() +- driver core: Make dev_err_probe() silent for -ENOMEM +- driver core: Better advertise dev_err_probe() +- bpf: Fix BSWAP 32 and 16 on MIPS64 +- bpf: Fix immediate JMP JEQ/JNE on MIPS32 +- vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets +- net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() +- veth: manage XDP program pointers during channel resize +- net/sched: act_gate: budget the per-entry list in get_fill_size +- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() +- nfc: llcp: fix slab-out-of-bounds reads when logging service names +- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() +- nfc: llcp: fix -ENOMEM on connect with zero-length service name +- nfc: st21nfca: validate ISO15693 inventory length +- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure +- nfc: virtual_ncidev: Add missing ioctl compat handler +- selftests/nci: Fix out-of-bounds store on thread join +- selftests: nci: Fix uninitialized family ID on missing attribute +- nfc: llcp: Fix race condition in accept_queue lifecycle +- selftests: nci: Correct pthread_create return value check +- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() +- nfc: st21nfca: validate received frame size +- nfc: nfcmrvl: validate helper command length before pull +- net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K +- net: stmmac: selftests: Capture all packets for vlan checks +- net: stmmac: selftests: Check the dev->features for S-TAG offload testing +- net: stmmac: selftests: Support running selftests on DSA conduits +- sctp: hold asoc or transport before mod_timer() in timer handlers +- net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports +- net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports +- bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc +- bpf: Fix bpf_sock context code generation +- bpf: Fix bounds check for skb-backed dynptrs +- genetlink: report the real command id for dump-only ops in policy dumps +- net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error +- s390/debug: Fix NULL pointer dereference in debug_info_copy() +- s390/debug: Do not register views for failed static debug areas +- tg3: clean up PHYLIB resources on probe failure +- net: usb: sr9700: include receive overhead in the length check +- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() +- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough +- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach +- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors +- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() +- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() +- drm/virtio: fix object leak when drm_gem_handle_create() fails +- net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget +- net: usb: catc: bound the RX packet length in catc_rx_done() +- sctp: avoid livelock while updating retransmit path +- ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). +- net: core: Fix documentation +- net: gue: reject invalid REMCSUM offsets +- net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure +- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan +- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update +- netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name +- ipvs: revalidate ihl before icmp_send +- netfilter: nft_synproxy: use the family-aware checksum helper +- netfilter: nfnetlink_queue: hold nfnl mutex in event notifier +- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation +- libbpf: Reject truncated ldimm64 CO-RE relocations +- bpf: Restrict CO-RE poisoning to relocatable instructions +- net/sched: cls_u32: fix manual hash table handle IDR aliasing +- bpf: Skip unsettled links in link iterator +- xsk: Use a 32-bit compare in xsk_map_gen_lookup +- s390/cio: Guard PMCW field accesses with dnv check +- s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points +- s390/cio: Fix cio_update_schib() to not cache invalid schib +- s390/pci/docs: Fix sriov_numvfs attribute name +- docs: s390/pci: Improve and update PCI documentation +- scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume() +- selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode +- cgroup: selftests: Move memcontrol specific helpers out of common cgroup_util.c +- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel +- Bluetooth: SMP: reject Security Request over BR/EDR +- squashfs: Add dictionary size range check to prevent shift-out-of-bounds +- KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0 +- KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save +- HID: amd_sfh: Validate PCI BAR size before mapping +- pinctrl: meson: Fix typo in s4 group name +- bpf, sockmap: Fix self-redirect copied_seq double-counting +- bpf: Fix out-of-bounds read of rtt_min in sock_ops +- bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() +- HID: elecom: fix bus type for M-XGL20DLBK +- tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context +- bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() +- bpf: Fix divide-by-zero in btf_struct_walk() +- selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc +- bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL +- bpf: Fix bpf_skb_change_tail wrt csum partial skbs +- remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage +- erofs: fix large folio race in erofs_fscache_req_complete +- spi: zynqmp-gqspi: Use devm_spi_alloc_host() +- selftests/landlock: Add layout1.refer_mount_root +- spi: spi-zynqmp-gqspi: stop the controller on shutdown +- ksmbd: fix partial normalized name responses +- ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() +- ipv6: mcast: Don't hold RTNL for MCAST_ socket options. +- ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP. +- ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP. +- ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec(). +- smb: client: fix missing iov bounds check in parse_posix_sids() +- smb: client: fix missing lower-bound check on DFS referral string offsets +- smb: client: fix server->total_read for compound encrypted PDUs +- smb: client: fix potential OOB read in smb3_enum_snapshots() +- smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs +- smb: client: fix smbd_connection leak on cifs_get_tcp_session() error +- smb: client: reject short Next offsets in parse_server_interfaces() +- smb: client: fix rlist race and missing initialization +- smb: client: cancel reconnect work in clean_demultiplex_info() +- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure +- drm/msm/adreno: fix autosuspend cleanup during teardown +- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() +- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver +- wifi: mwifiex: validate action frame fixed fields +- wifi: mwifiex: validate scan response extents +- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length +- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST +- wifi: p54: validate curve data length in the calibration curve converters +- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() +- wifi: wilc1000: fix out-of-bounds read in P2P public action frames +- wifi: wlcore: release runtime PM ref on regdomain config failure +- wifi: rsi: fix heap OOB write on key removal +- wifi: libertas_tf: fix UAF in lbtf_free_adapter() +- wifi: iwlegacy: fix broadcast stations deallocation +- wifi: brcmsmac: fix UAF in brcms_free_timer() +- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() +- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() +- watchdog: rtd119x: Avoid division by zero +- watchdog: msc313e: Propagate error code in resume() +- watchdog: msc313e: Fix premature reset during timeout update +- watchdog: digicolor: Avoid division by zero +- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog +- hwmon: (w83793) release probe data through kref +- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove +- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 +- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding +- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() +- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound +- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) +- Input: soc_button_array - check btns_desc->package.count +- Input: soc_button_array - fix MS Surface Pro 11 probe failure +- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() +- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P +- Input: cyttsp5 - clamp the HID report size before memcpy +- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 +- Input: adp5588-keys - cache GPIO state before registering the gpiochip +- mmc: sdhci_am654: Reset command and data lines on failed tuning +- mmc: spi: reset bytes_xfered before retrying CRC failures +- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt +- mmc: sdio_uart: fix xmit_fifo leak when the port table is full +- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources +- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 +- mmc: mxcmmc: cancel data work and watchdog on remove +- mmc: hsq: Fix use-after-free in retry work +- mmc: core: Fix OF node reference leak on card add failure +- mmc: core: Cancel SDIO IRQ work before freeing host +- selinux: always fill AVC decision in avc_has_perm_noaudit() +- selinux: recheck intermediate backing files on mprotect() +- selinux: preserve user SID across nested backing files +- i2c: imx: disable autosuspend on remove +- i2c: imx: release DMA channels on probe error +- i2c: atr: fix dangling adapter pointer on add failure +- i2c: at91: release DMA channels on remove and probe error +- KEYS: trusted: Fix tpm2_load_cmd() boundary check +- keys: translate request_key_auth pid for the reading procfs instance +- mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio() +- memstick: ms_block: destroy io_queue workqueue on removal +- scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() +- net/packet: avoid truncating TPACKET_V3 private size +- net/sched: hhf: cap hh_flows_limit at change time +- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value +- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain +- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() +- net: lan743x: fix RX checksum use-after-free +- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() +- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status +- dmaengine: sun6i: fix non-atomic read of DMA position registers +- Bluetooth: eir: validate service data length before reading UUID +- Bluetooth: btusb: fix NXP IW610 composite device handling +- arm64: percpu: Fix this_cpu_and() mask generation +- arm64: percpu: Fix this_cpu_write() casting +- arm64: dts: renesas: r8a779f0: Set UFS lane count +- kselftest/arm64: Fix size of thread_data values for pthread_join() +- HID: logitech-hidpp: fix race condition when accessing stale stack pointer +- net: xfrm: reject unrepresentable espintcp transport headers +- openvswitch: avoid reallocating confirmed conntrack labels +- rds: ib: use rds_conn_drop() on protocol version mismatch +- exec: Cleanup POSIX timers right after de_thread() +- cifs: Fix server use-after-free in cifs_chan_skip_or_disable() +- ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY +- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type +- ALSA: virtio: reset device before deleting virtqueues +- Input: xpad - fix PDP Marvel Xbox 360 controller +- Input: xpad - add support for Azeron devices +- Input: xpad - add support for Victrix Pro BFG Controller +- wifi: rtw88: Fix the random "error beacon valid" messages for USB +- wifi: rtw88: TX QOS Null data the same way as Null data +- net: cpsw: Execute ndo_set_rx_mode callback in a work queue +- net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue +- btrfs: abort transaction on failure to update inode for hole punching and reflinking +- btrfs: remove redundant root argument from btrfs_update_inode() +- btrfs: simplify error check condition at btrfs_dirty_inode() +- drm/amdgpu: check ras and obj before dereference +- net: mvpp2: prevent buffer overflow in page_pool allocation +- net: macb: fix ordering around PTP timestamp read +- net: ethernet: cortina: Ack RX overrun interrupt correctly +- net: netsec: fix device_node reference leak on phy_np +- ASoC: hdmi-codec: Report a change when the channel status moves +- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments +- powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba +- KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure +- KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() +- drop_monitor: fix out-of-bounds write in reset_per_cpu_data() +- drop_monitor: synchronize tracepoint unregistration on error path +- pppoatm: ensure a writable skb header and linear data +- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup +- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown +- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() +- ksmbd: keep compound responses on query info errors +- ksmbd: fix partial file information responses +- ksmbd: return buffer overflow for partial filesystem info +- wifi: brcmfmac: fix lost 802.1x TX completion wakeup +- net: fddi: skfp: fix NULL deref when setting the MAC address while down +- seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation +- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL +- btrfs: tree-checker: print dev extent offset in error message +- ALSA: hda: trace PCM open only after assigning a stream +- drm/vc4: Use managed KMS polling to fix UAF on unbind +- drm/ast: Automatically clean up poll helper +- wifi: virt_wifi: don't transfer operstate before register +- ALSA: 6fire: fix OOB write from device-reported iso length +- ALSA: usb: 6fire: Avoid embedded URBs +- ALSA: 6fire: Clean ups with guard() +- Input: trackpoint - fix the inertia attribute name in the ABI document +- ALSA: pcm: set timer->private_data before registering the PCM timer +- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting +- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow +- keys: fix lost wakeup when reaping a dead key type +- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr +- perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations +- netfilter: flowtable: hold reference on ct until flow is released +- RDMA/siw: Bound fragmented header copies by the remaining length +- RDMA/efa: Keep EQ resources alive while IRQ is registered +- RDMA/efa: Keep admin queues alive while IRQ is registered +- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA +- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order +- scsi: qla2xxx: Fix the ql2xfc2target parameter description +- mm: memblock: show all region flags in debugfs +- wifi: mac80211: set up the TX info early to fix failure paths +- wifi: mac80211: rework ack_frame_id handling a bit +- wifi: mac80211: mesh: release the channel if start fails +- wifi: mac80211: add HE 6 GHz capability in the scan elems len +- wifi: mac80211: don't access the TSF of a down interface +- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set +- wifi: mac80211: don't allow link changes when iface is down +- wifi: mac80211: require a peer station for TDLS setup confirm +- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown +- wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping +- wifi: mac80211: unlist vifs when their netdev is unregistered +- wifi: mac80211: suppress chanctx warning for debugfs reset +- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces +- wifi: cfg80211: don't filter by BSS type when removing stale entries +- wifi: cfg80211: only group hidden BSSes with beacon entries +- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() +- dma-coherent: report a failed reserved memory assignment +- dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask +- MIPS: Octeon: apply USB FDT fixups also when USB is modular +- soundwire: cadence_master: wait and cancel cdns->work before clock stop +- wifi: cfg80211: check IP header size in cfg80211_classify8021d() +- wifi: libipw: reject too-short association responses +- wifi: libipw: reject too-short beacon and probe responses +- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path +- wifi: virt_wifi: free skb when disconnected +- dmaengine: sprd: Fix runtime PM reference leak in probe +- RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted +- RDMA/irdma: Enforce local fence for IB_WR_REG_MR +- RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept +- RDMA/siw: Cleanup siw_accept +- RDMA/siw: Introduce siw_cep_set_free_and_put +- ARM: socfpga: select the PL310 erratum 753970 workaround +- xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() +- xfrm: fix compat ALLOCSPI request use-after-free +- xfrm: avoid RCU warnings around the per-netns netlink socket +- ipv6: Honor oif when choosing nexthop for locally generated traffic +- ipv6: Select best matching nexthop object in fib6_table_lookup() +- media: video-i2c: fix buffer queue ordering +- sunvdc: fix -EIO issue due to lack of retries +- selftests/landlock: Add tests for whiteout object creation +- Revert "alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally" +- Revert "alpha: don't leak hardware-fabricated FP exception bits to user space" +- selftests/landlock: Add disconnected leafs and branch test suites +- selftests/landlock: Add tests for access through disconnected paths +- Revert "hwmon: (emc1403) Rely on subsystem locking" +- Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature" +- mptcp: close race between scheduler and state change +- mptcp: fix bad accounting in __mptcp_subflow_push_pending() +- Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config +- workqueue: Update documentation as per system_percpu_wq naming +- netfilter: nft_set_pipapo_avx2: add missing vzeroupper +- crypto: sun8i-ce - Remove crypto_rng interface +- crypto: sun8i-ss - Remove crypto_rng interface +- fou: Fix use-after-free in fou_create() +- net: appletalk: fix NULL pointer dereference in aarp_send_ddp() +- i2c: smbus: reject oversized block transfers in the common path +- ALSA: us122l: Prevent write upgrades for read mappings +- net: usb: pegasus: don't rely on id table pointer arithmetic +- media: as102: do not rely on id table address comparison +- usb: serial: spcp8x5: don't store usb_device_id +- usb: usbtmc: don't store usb_device_id +- wifi: ath9k_htc: don't store usb_device_id +- usb: xusbatm: don't rely on id table pointer arithmetic +- perf evsel: Add per-thread warning for EOPNOTSUPP open failues +- Revert "selftests/mm: report unique test names for each cow test" +- Revert "selftests/mm: skip COW tmpfile cases when fallocate() is unsupported" +- Revert "nvme: apple: Add Apple A11 support" +- Revert "nvme-apple: Drop the PRP null check chicken bit" +- Revert "nvme-apple: Prevent shared tags across queues on Apple A11" +- Revert "nvme-apple: Reset q->sq_tail during queue init" +- Revert "arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries" +- Revert "arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries" +- Revert "arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries" +- Revert "arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries" +- Revert "arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries" +- Revert "arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries" +- Revert "arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries" +- xfs: bail out on bitmap errors in xrep_agfl_fill +- xfs: count escaped corruption errors in scrub stats +- xfs: signal inode btree xref error if get_rec returns an error +- xfs: snapshot old AGFL before rewriting it +- xfs: snapshot scrub stats when rendering them +- smb: client: avoid leaking refcount when cifs_sb_tlink() fails +- smb: client: avoid leaking refcount in cifs_queue_oplock_break() +- smb: client: fix file type corruption in wsl_to_fattr() +- smb: client: fix file type corruption in cifs_reparse_point_to_fattr() +- smb: client: fix one-byte OOB read in smb2_parse_native_symlink() +- smb: client: pin DFS superblock in iterator callback +- selftests: mptcp: fix an UAF in mptcp_connect.c +- mptcp: subflow: no need to copy thmac during ulp_clone +- mptcp: options: handle MPC data + csum reqd + no csum +- bnxt_en: Propagate RX ring init failures in bnxt_init_nic() +- bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() +- bnxt_en: Only restore LRO if the device supports TPA +- media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity +- media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer +- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison +- media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity +- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity +- media: hevc: add bounded tile-count helpers +- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS +- hwmon: (gpio-fan) Fix use-after-free in alarm work +- hwmon: (applesmc) fix key backlight workqueue leak on register failure +- s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm +- s390/qeth: allow bridgeport queries despite OS_MISMATCH +- KVM: PPC: Book3S HV: Set irqfd->producer only on success +- mac802154: fix use-after-free of sdata via queued RX frames +- ipv4: fib: bound automatic table ID allocation +- ieee802154: hwsim: serialize pib updates to fix double-free +- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink +- fbdev: vfb: defer cleanup until the last reference +- scripts/sorttable: Mark long_size as __maybe_unused +- vdpa: solidrun: Free IRQs after request failure +- vdpa: ifcvf: Put device on unsupported feature error +- netfilter: report NLM_F_DUMP_FILTERED when all is filtered out +- netfilter: nf_log: unregister loggers before per-net teardown +- net: openvswitch: fix use-after-free of the flow table mask array +- net: mpls: clear inner_protocol when the last label is popped +- net: mana: Reserve extra CQ slot for the fence completion CQE +- net: hso: fix TIOCMIWAIT race +- drm/i915: Fix memory leak in query_perf_config_list() +- drm/drm_exec: fix up contended obj when num_objects is 0 +- exec: do_close_on_exec() before taking exec_update_lock +- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 +- ASoC: sti: initialize IRQ lock before requesting IRQ +- ASoC: sprd: validate compress buffer sizes against fixed allocations +- tracing: Let histogram values keep the percent and graph modifiers +- tracing/user_events: Don't destroy fields when event removal fails +- tunnels: Drop stale dst when building an ICMP error for PMTUD +- ufs: validate cylinder group metadata before caching it +- ufs: create the root dentry after loading cylinder metadata +- watchdog: sunxi_wdt: preserve boot-enabled watchdog +- dm/amdgpu: fix malformed link_settings debugfs output +- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough +- x86/mm: Fix user-space data loss with MADV_FREE and THP +- crypto: x86/aria - add missing vzeroupper in AVX-512 code +- crypto: x86/aria - add missing vzeroupper in AVX2 code +- powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver +- powerpc/ps3: Fix repository.c build failure +- ksmbd: prevent out-of-bounds reads in share config responses +- scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands +- sunvdc: unmap LDC cookies when the descriptor send fails +- openvswitch: fix wrong flag value in get_ipv6_ext_hdrs() +- net/rds: fix tcp stream corruption with large pages +- octeontx2-af: fix PF/CGX debugfs PCI bus lookup +- net: sun4i-emac: fix missing of_node_put() for phy_node +- net/sched: cls_route: Fix in-place replace +- net/sched: cls_route: make netlink errors meaningful +- net/sched: cls_route: Reject handle aliasing +- perf/x86/intel: Correct pt_regs->flags update for PEBS path +- selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value +- net: stmmac: initialize ptp_lock at probe time +- ppp_synctty: ensure a writeable skb header +- octeontx2-pf: reset HTB scheduler topology before freeing queues +- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors +- hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() +- net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down +- net/micrel: Fix typos in micrel driver code comments +- watchdog: msc313e: Sync timeout value if WDT was running at boot +- watchdog: msc313e: Fix undefined behavior +- watchdog: msc313e: Fix spurious reset on suspend +- watchdog: msc313e: Enable clock before accessing hardware registers +- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() +- watchdog: msc313e: Avoid division by zero +- watchdog: fix hrtimer start when pretimeout is zero +- net: macb: destroy the phylink instance on the probe error path +- Bluetooth: btusb: Fix UAF of btusb_data by rx_work +- ALSA: hda: Report a change when only the channel status bytes move +- ALSA: hda/common: Use guard() for mutex locks +- ALSA: hda/common: Use cleanup macros for PM controls +- ALSA: hda: Introduce auto cleanup macros for PM +- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER +- net: ethernet: cortina: Count RX descriptors for freeq refill +- net: ethernet: cortina: Count RX drops once per frame +- net: ethernet: cortina: Count dropped frames as NAPI work +- net: ethernet: cortina: Finish RX updates before NAPI completion +- net: ethernet: cortina: Fix budget accounting +- net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward +- virtio_input: stop callbacks before unregistering input device +- virtio_input: reset device if input_register_device() fails +- virtio-pci: return IRQ_HANDLED after non-zero ISR +- vdpa_sim_net: check TX pull result before RX copy +- vdpa_sim_blk: reject out-of-range sector starts +- vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx +- vhost-vdpa: introduce IOTLB_PERSIST backend feature bit +- vdpa: introduce .reset_map operation callback +- vhost-vdpa: introduce descriptor group backend feature +- vdpa: introduce dedicated descriptor group for virtqueue +- ASoC: mt6351: Publish the OF module alias +- netfilter: ip6_tables: set F_PROTO when proto value is nonzero +- ASoC: Intel: SST: Publish the PCI module aliases +- ASoC: bcm: bcm63xx: Publish the OF module aliases +- net: macb: fix NULL pointer dereference on unbind with fixed-link +- net: macb: rename bp->sgmii_phy field to bp->phy +- net/sched: drr: clamp quantum in change class +- net/sched: pie: clamp psched_mtu in pie_drop_early +- !29613 [OLK-6.6]net/ngbe: Sync ngbe out-of-tree driver v1.2.8 to in-tree ngbe +- !29359 [CVEAgent@OLK-6.6] Fix CVE-2026-98010 +- !29262 [CVEAgent@OLK-6.6] Fix CVE-2026-97456 +- !28588 [PATCH 0/8] KVM: arm64: Add PVM mode +- !29745 mm/huge_memory: fix unconditional pgtable deposit/withdraw for special huge PMD +- !29588 [CVEAgent@OLK-6.6] Fix CVE-2026-98369 +- !29814 Fix CVE-2026-98109 +- net/sched: sfq: clamp quantum in change path +- net/sched: fq_pie: clamp quantum in change path +- net_sched: sch_fq_pie: implement lockless fq_pie_dump() +- net/mlx5: E-Switch, prevent mc_list repopulation during vport disable +- net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put +- net/mlx5e: Fix use-after-free race in sample_restore_put() +- net/mlx5e: Fix ETS zero BW reporting when one TC holds 100% +- net/mlx5e: Fix setting RS FEC after remapping +- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() +- pds_core: fix cmd_regs access racing BAR unmap on reset +- net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations +- vxlan: reject dynamic fdb entries that reference a nexthop id +- s390/ism: folio_put() after error +- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow +- octeontx2-af: mcs: Clear stale X2P calibration state before calibration +- net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size +- net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size +- bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit() +- selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0 +- selftests/bpf: Update tests for new ct zone opts for nf_conntrack kfuncs +- net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times +- net: bcmasp: clear txcb->last before writing each descriptor +- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails +- ALSA: caiaq: Fix potential double-free at error path +- selftests/alsa: Fix the step check for INTEGER controls +- net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset +- net/rds: don't let rds_conn_shutdown() consume a concurrent drop +- net/rds: acquire the fastpath locks in rds_conn_shutdown() +- net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() +- net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown +- net/rds: clear cp_flags bits individually in rds_conn_path_reset() +- net/rds: use clear_bit_unlock() in release_refill() +- net/rds: use wq_has_sleeper() in release_in_xmit() +- btrfs: do not force reloc root creation during qgroup_account_snapshot() +- btrfs: send: fix lost error return value in will_overwrite_ref() +- btrfs: fix transaction use-after-free in raid stripe insertion +- ASoC: ux500: Program the MSP FIFO watermarks +- ASoC: ux500: Request the MSP MMIO resource +- mfd: db8500-prcmu: Fold dbx500 header into db8500 +- arm: Handle KCOV __init vs inline mismatches +- mfd: db8500-prcmu: Remove needless return in three void APIs +- ASoC: ux500: Validate MSP DAI configuration +- ASoC: ux500: Correct MSP frame and bit clock setup +- ASoC: ux500: Propagate MSP setup errors +- ASoC: ux500: Fix MSP stream lifecycle handling +- ALSA: ump: do not touch legacy_rmidi before it exists +- ALSA: ump: Update rawmidi name per EP name update +- ALSA: ump: Copy safe string name to rawmidi +- ALSA: ump: Copy FB name string more safely +- ALSA: rawmidi: Show substream activity in info ioctl +- ALSA: rawmidi: Expose the tied device number in info ioctl +- locking/lockdep: Invalidate stale class_cache entries for zapped classes +- perf/core: Skip empty AUX records with only format flags +- scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() +- btrfs: restore active device pointers after failed sprout +- btrfs: detach failed sprout device from transaction update list +- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() +- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits +- s390/boot: Fix physical memory search range +- ALSA: hda: restore MFG widget enumeration after core split +- ALSA: hda/core: Use guard() for mutex locks +- staging: fbtft: make dirty_lock IRQ-safe +- tipc: fix NULL deref in tipc_named_node_up() on empty publication list +- ppp: ppp_async: simplify tty disc_data access +- ASoC: ab8500: Validate and program TDM slots correctly +- ASoC: ab8500: Correct digital interface format setup +- ASoC: ab8500: Repair the DAPM capture graph +- ASoC: ab8500: Reset the audio block before configuring it +- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() +- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM +- Bluetooth: hci_core: Fix race condition during device registration +- Bluetooth: btintel: validate version TLV value lengths +- Bluetooth: btintel: Export few static functions +- Bluetooth: btintel: Print firmware SHA1 +- workqueue: reject watchdog thresholds that overflow jiffies +- workqueue: replace use of system_wq with system_percpu_wq +- s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block +- s390/ipl: Fix NULL deref in kdump without re-IPL parm block +- s390/os_info: Introduce value entries +- s390/checksum: provide and use cksm() inline assembly +- s390/checksum: call instrument_read() instead of kasan_check_read() +- ksmbd: rate limit unmapped SID errors +- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF +- OPP: of: Fix potential multiplication overflow when calculating freq +- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks +- vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() +- net: amd-xgbe: discard rx packets with bad FCS +- raw: annotate disconnect-side IPv4 match writers +- sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration +- smb: client: transport: Fix debug printing in __release_mid() +- smb/client: mark file sparse before emulating insert range +- scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() +- scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() +- sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START +- net/sched: act_api: fix skb sizing and action leak on reoffload delete +- net/sched: act_api: conditional notification of events +- net/sched: act_api: don't open code max() +- rtnl: add helper to send if skb is not null +- net/sched: act_api: size the RTM_GETACTION reply from the actions +- net/sched: act_api: budget all shared attributes in notify skbs +- net: icmp: avoid invalid transport header access in icmp_send tracepoint +- drm/cirrus-qemu: Validate BAR0 size during probe +- drm/cirrus: Use video aperture helpers +- ufs: do not treat unreadable directory blocks as empty +- ufs: Convert ufs_get_page() to ufs_get_folio() +- ufs: Convert ufs_get_page() to use a folio +- ufs: convert to new timestamp accessors +- selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter +- nvme-rdma: fix -EIO cleanup order in queue_rq +- accel/qaic: Address potential out-of-bounds read in resp_worker() +- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() +- EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation +- EDAC/igen6: Fix channel address decode for non-hash mode +- EDAC/igen6: Fix channel selection hash +- EDAC/igen6: Fix interleave boundary condition +- ARM: ensure interrupts are enabled in __do_user_fault() +- ARM: 9484/1: enable interrupts when unhandled user faults are triggered +- Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU" +- Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU" +- mm/damon/core: avoid infinite kdamond_merge_regions() internal loop +- ksmbd: use memcmp() to compare ClientGUIDs +- ASoC: meson: aiu: Validate written enum values +- coresight: platform: defer connection counter increment until alloc succeeds +- ppp_async: drop the errored frame instead of resetting its headroom +- wifi: mt76: mt7921: skip unknown CLC firmware records +- wifi: mt76: mt7921: validate CLC firmware records +- tracing/histograms: Simplify last_cmd_set() +- ksmbd: remove stale channels from all sessions on teardown +- firmware: stratix10-svc: fix FCS SMC call kernel-doc +- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx +- scsi: core: Do not block on tag allocation in scsi_eh_lock_door() +- ASoC: rt5645: Perform the initial jack detect at probe +- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume +- hwmon: (corsair-psu) Fix linear11 calculation +- vhost-scsi: flush backend after device ioctls +- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx +- Drivers: hv: vmbus: add VTL2 redirect connection ID +- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) +- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame +- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() +- cifs: validate idmap key payload length +- powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash +- ice: pass the return value of skb_checksum_help() +- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx +- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 +- phonet: check register_netdevice_notifier() error in phonet_device_init() +- drm/gma500: return errors from Oaktrail HDMI I2C reads +- ksmbd: preserve VFS inherited POSIX ACL mask +- wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO +- regulator: core: clamp voltage constraints before applying apply_uV +- smb: client: bound dirent name against end of SMB response in cifs_filldir +- wifi: mwifiex: replace one-element arrays with flexible array members +- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE +- wifi: iwlwifi: acpi: validate WGDS table revision index +- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless +- wifi: iwlwifi: bound aligned TLV advance in FW parser +- ALSA: hda/realtek: Add quirk for HP Pavilion x360 +- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized +- arm64: kprobes: Allow reentering kprobes while single-stepping +- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif +- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware +- arm64: fixmap: Allow 256K early_ioremap() at any offset +- wifi: iwlwifi: mvm: fix a possible underflow +- blk-cgroup: fix leaks and online flag on radix_tree_insert failure +- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs +- wifi: iwlwifi: mvm: fix sched scan IE sizing +- wifi: iwlwifi: mvm: fix an off-by-1 boundary check +- btrfs: fix reloc root cleanup in merge_reloc_roots() +- wifi: iwlwifi: mvm: validate sta_id in BA window status notif +- spi: dw-dma: Wait for controller idle before completing Tx +- btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() +- btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr() +- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series +- smb/client: reduce fallocate zero buffer allocation +- wifi: rsi: validate beacon length before fixed buffer copy +- netfilter: ipset: mark the rcu locked areas properly +- wifi: libipw: fix key index receive bound checks +- gpio: dwapb: Mask interrupts at hardware initialization +- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access +- ksmbd: validate SID namespace before mapping IDs +- ksmbd: mark invalid session responses as signed +- ksmbd: find bound sessions during reauthentication +- wifi: cfg80211: validate assoc response length before status and IE access +- wifi: libertas: reject short monitor TX frames +- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers +- wifi: mac80211: validate deauth frame length before reason access +- wifi: ralink: RT2X00: init EEPROM properly +- ALSA: usb-audio: caiaq: validate EP1 reply lengths +- ksmbd: fix credit charge calculation for SMB2 QUERY_INFO +- drm/amdgpu: flush pending RCU callbacks on module unload +- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table +- cachefiles: Fix double fput +- xen/gntalloc: validate grant count before allocation +- freevxfs: don't BUG() on unknown typed-extent type +- xen/front-pgdir-shbuf: free grant reference head on errors +- ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling +- ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr +- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers +- ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr +- netfilter: nf_conntrack_expect: zero at allocation time +- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend +- spi: core: Abort active target transfer on controller suspend +- fbdev: pm2fb: unwind WC setup on probe failure +- eth: mlx5: fix macsec dependency +- rtc: bq32000: add delay between RTC reads +- blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat() +- net: au1000: move free_irq out of the close-time spinlocked section +- regulator: da9121: Use subvariant ids in the I2C table +- PCI/sysfs: Use kstrtobool() to parse the ROM attribute input +- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() +- ksmbd: treat read-control opens as stat opens only for leases +- ksmbd: break RH leases before delete-on-close +- ksmbd: start file id allocation at 1 +- ksmbd: apply create security descriptor first +- ksmbd: treat unnamed DATA stream as base file +- ksmbd: use connection ClientGUID for lease lookup +- ksmbd: align SMB2 oplock break ack handling +- ksmbd: validate SMB2 lease create contexts +- ksmbd: fix lease break and ack state handling +- rtc: aspeed: add AST2700 compatible +- f2fs: validate inline dentry name lengths before conversion +- md/raid5: let stripe batch bm_seq comparison wrap-safe +- md/raid5: account discard IO +- PCI: mediatek: Protect root bus removal with rescan lock +- PCI: rockchip: Protect root bus removal with rescan lock +- PCI: altera: Protect root bus removal with rescan lock +- PCI: iproc: Protect root bus removal with rescan lock +- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 +- drm/amdgpu: Use system unbound workqueue for soft IH ring +- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap +- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl +- mfd: rsmu: Add 8a34002 support +- mfd: tps65219: Make poweroff handler conditional on system-power-controller +- leds: pca9532: Don't stop blinking for non-zero brightness +- leds: uleds: Return -EFAULT on copy_to_user() failure +- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 +- ALSA: usb-audio: Add quirk flags for SC13A +- gpio: pisosr: Read "ngpios" as u32 +- scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() +- fuse: set ff->flock only on success +- HID: hidpp: fix potential UAF in hidpp_connect_event() +- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT +- sparc: Disable compat support with LLD +- i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA +- smb: client: fix races in cifsd thread creation +- net/sched: act_csum: don't mangle UDP tunnel GSO packets +- e1000e: limit endianness conversion to boundary words +- vsock: use sk_acceptq_is_full() helper in all transports +- ptp: ocp: add shutdown callback +- net: stmmac: xgmac2: disable RBUE in default RX interrupt mask +- sparc64: uprobes: add missing break +- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV +- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure +- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence +- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt +- Bluetooth: btusb: Add support for TP-Link TL-UB250 +- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV +- spi: xilinx: let transfers timeout in case of no IRQ +- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i +- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc +- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems +- sctp: Unwind address notifier registration on failure +- nvme-fc: Do not cancel requests in io target before it is initialized +- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table +- ata: libata-pmp: add JMicron JMS562 quirk +- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 +- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC +- vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add() +- net: dsa: qca8k: Add support for force mode for fixed link topology +- hwmon: (adt7462) Add of_match_table to support devicetree +- btrfs: protect sb_write_pointer() with invalidate lock +- wifi: mt76: transform aspm_conf for pci_disable_link_state +- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table +- net: ibm: emac: mal: fix potential system hang in mal_remove() +- configfs_depend_prep(): pass configfs_dirent instead of dentry +- xprtrdma: Add request-pool slack for delayed recycling +- RDMA/rtrs-srv: Fix integer underflow in process_read and process_write +- NFS: fix eof updates after NFSv4.2 fallocate/zero-range +- btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF +- btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() +- ALSA: es18xx: check control allocation before private data setup +- net: microchip: sparx5: clean up PSFP resources on flower setup failure +- hsr: broadcast netlink notifications in the device's net namespace +- net: cpsw_new: unregister devlink on port registration failure +- RDMA/mlx5: Fix state and counter desync on loopback enable failure +- wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications +- ipmi: si: Use platform_get_irq_optional() to retrieve interrupt +- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP +- clk: keystone: don't cache clock rate +- net/mlx5: E-Switch, align disable sequence with switchdev-to-legacy transition +- RDMA/irdma: Fix typo in SQ completions generation +- drm/amdgpu: fix buffer overflow during vBIOS update +- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy +- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries +- dpaa2-switch: fix handling of NAPI on the remove path +- net: dsa: sja1105: flower: reject cross-chip redirect +- dpaa2-switch: fix the error path in dpaa2_switch_rx() +- dpaa2-switch: rework FDB management on the bridge leave path +- ALSA: seq: oss: Reject reads that cannot fit the next event +- ASoC: codecs: rk3328: Use managed GPIO and clock helpers +- ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() +- fs/ntfs3: validate index entry key bounds +- fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib +- iommu/rockchip: disable fetch dte time limit +- net: wwan: t7xx: Add delay between MD and SAP suspend +- net: qrtr: fix node refcount leak on ctrl packet alloc failure +- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach +- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive +- ASoC: qcom: q6apm: return error code to consumers on failures +- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi +- net: ibm: emac: Reserve VLAN header in MJS limit +- libbpf: Also reset {insn,data}_cur on realloc failure +- iio: accel: mma8452: switch to non-devm request_threaded_irq() +- perf/ftrace: Fix WARNING in __unregister_ftrace_function +- iio: light: stk3310: Deal with the ps interrupt issue in PM +- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC +- tracing: Disable KCOV instrumentation for trace_irqsoff.o +- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC +- mmc: davinci: fix mmc_add_host order in probe +- soundwire: only handle alert events when the peripheral is attached +- gfs2: page poisoning fix +- soundwire: dmi-quirks: Disable ghost Realtek devices +- ASoC: Intel: catpt: Complete coredump handling +- drm/nouveau/gsp: add SEC2 to GA100 chip table +- scripts: modpost: detect and report truncated buf_printf() output +- host1x: bus: Fix missing ops null check in error teardown +- pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP +- hfs: rework hfsplus_readdir() logic +- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() +- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() +- ACPICA: Fix condition check in acpi_ps_parse_loop() +- drm/amd/pm/si: Fix updating clock limits from power states +- net: thunderx: fix PTP device ref leak in nicvf_probe() +- net: hsr: require valid EOT supervision TLV +- ALSA: usb-audio: Add quirk for Novation Mininova +- irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed +- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind +- mips: cps: Assemble jr.hb with an R2 ISA level +- drm/panel: simple: Add AM-1280800W8TZQW-T00H +- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration +- clk: socfpga: agilex: implement l3_main_free_clk +- s390/zcore: Removed unused variables +- rds: annotate data-race around rs_seen_congestion +- rds: filter RDS_INFO_* getsockopt by caller's netns +- netlabel: fix IPv6 unlabeled address add error handling +- wifi: rtw89: pci: enable LTR based on pcie control register +- rcu-tasks: Fix possible boot-time tests failed for the call_rcu_tasks() +- char/nvram: Remove redundant nvram_mutex +- usb: host: add ARCH_AIROHA in XHCI MTK dependency +- serial: 8250: fix possible ISR soft lockup +- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue +- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set +- usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log +- usbip: vhci_hcd: fix NULL deref in status_show_vhci +- isofs: handle set_blocksize failures +- omfs: handle set_blocksize failures +- hpfs: handle set_blocksize failures +- jfs: handle set_blocksize failures +- qnx4: handle set_blocksize failures +- minix: handle set_blocksize failures +- bfs: handle set_blocksize failures +- ntfs3: handle set_blocksize failures +- befs: handle set_blocksize failures +- net/rds: Don't sleep inside rds_ib_conn_path_shutdown +- net/sched: sch_drr: make cl->quantum lockless +- net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() +- net: usb: qmi_wwan: add MeiG SRM813Q +- nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl +- bitfield: wire __bf_shf to __builtin_ctzll +- thunderbolt: Verify Router Ready bit is set after router enumeration +- thunderbolt: Increase timeout for Configuration Ready bit +- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size +- firmware: arm_scmi: Validate SENSOR_UPDATE payload size +- thunderbolt: Improve multi-display DisplayPort tunnel allocation +- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() +- 9p: use kvzalloc for readdir buffer +- arm64/daifflags: Make local_daif_*() helpers __always_inline +- 9p: invalidate readdir buffer on seek +- sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity +- ALSA: usx2y: Drain pending US-428 pipe-4 output commands +- KVM: arm64: pvm: Skip the host debug register setup +- KVM: arm64: pvm: Prepare GICv3 initialization for PVM +- KVM: arm64: pvm: Skip the nVHE CPU hyp setup +- KVM: arm64: pvm: Skip host timer interrupt setup +- KVM: arm64: pvm: Reuse the VHE symbols and call paths +- KVM: arm64: pvm: Initialize PVM mode without EL2 +- KVM: arm64: pvm: Add the kvm_pvm_is_available static key +- KVM: arm64: Add PVM mode +- Bluetooth: hci_core: Fix race condition during device registration +- PCI: Wait for device readiness after D3hot -> D0uninitialized transition +- mailbox: Make mbox_send_message() return error code when tx fails +- RDMA/mlx5: Use QP port when decoding responder CQEs +- media: imon: Add iMON VFD HID OEM v1.2 key mappings +- crypto: atmel-ecc - add support for atecc608b +- crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y +- scsi: pm8001: Reject non-fatal dump when controller is crashed +- scsi: pm8001: Reject firmware update in fatal error state +- clk: samsung: exynos850: mark APM I3C clocks as critical +- soundwire: intel: Move suspend tracking from trigger to pm suspend +- drivers/of: validate status properties in reconfig state changes +- integrity: Check for NULL returned by asymmetric_key_public_key +- net: dsa: realtek: rtl8365mb: add support for RTL8367SB +- wifi: rtw89: phy: check length before parsing PHY status IE +- media: video-i2c: use vb2_video_unregister_device on driver removal +- drm/gud: Add RCade Display Adapter VID/PID pair +- net: phy: motorcomm: use device properties for firmware tuning +- hfsplus: rework hfsplus_readdir() logic +- PCI: intel-gw: Enable clock before PHY init +- drm/amd/display: Fix CRC open failure during active rendering +- mmc: davinci: avoid NULL deref of host->data in IRQ handler +- mmc: core: Add validation for host-provided max_segs +- ASoC: ti: omap3pandora: update board check to use DT compatible +- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order +- clk: renesas: cpg-mssr: Add number of clock cells check +- crypto: omap - add omap_des_unregister_algs helper +- crypto: ixp4xx - fix buffer chain unwind on allocation failure +- media: em28xx-video: fix missing res_free() on init_usb_xfer failure +- net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family +- net: dsa: mv88e6xxx: define .pot_clear() for 6321 +- PCI: switchtec: Add Gen6 Device IDs +- net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family +- thunderbolt: Don't create multiple DMA tunnels on firmware connection manager +- thunderbolt: Set tb->root_switch to NULL when domain is stopped +- thunderbolt: Keep the domain reference while processing hotplug +- thunderbolt: Keep XDomain reference during the lifetime of a service +- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() +- media: rc: mceusb: Add support for 04eb:e033 +- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM +- soundwire: validate DT compatible before parsing it +- firmware: stratix10-svc: change get provision data to async SMC call +- kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() +- wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() +- wifi: mac80211: always allow transmitting null-data on TXQs +- wifi: nl80211: reject beacons with bad HE operation +- hfsplus: fix issue of direct writes beyond end-of-file +- PCI: Stop setting cached power state to 'unknown' on unbind +- tools/nolibc: avoid call to wcslen() in _start_c() inserted by clang +- tee: optee: Allow MT_NORMAL_TAGGED shared memory +- usb: gadget: udc: skip pullup() if already connected +- ima: return error early if file xattr cannot be changed +- ALSA: usb-audio: Propagate write errors in generic mixer put callbacks +- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity +- drm/panel: jadard-jd9365da-h3: set prepare_prev_first +- drm/amd/display: Fix DPMS using partially updated pipe context +- bus: fsl-mc: wait for the MC firmware to complete its boot +- drm/gem: Consider GEM object reclaimable if shrinking fails +- ksmbd: fix use-after-free in oplock break notification +- mm/huge_memory: fix unconditional pgtable deposit/withdraw for special huge PMD +- net: wangxun: ngbe: update to 1.2.8 +- xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() +- net/sched: drr: clamp quantum in change class +- smb: client: pin DFS superblock in iterator callback +- smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid +- smb: client: fix one-byte OOB read in smb2_parse_native_symlink() +- smb: client: fix cifsFileInfo reference leak in deferred close +- smb: client: avoid leaking refcount in cifs_queue_oplock_break() +- smb: client: avoid leaking refcount when cifs_sb_tlink() fails +- smb: client: fix heap overflow in DACL owner/group rewrite +- ACPICA: Fix condition check in acpi_ps_parse_loop() +- smb: client: fix races in cifsd thread creation +- smb/client: flush dirty data before punching a hole +- smb: client: bound dirent name against end of SMB response in cifs_filldir +- cifs: validate idmap key payload length +- lockd: fix swapped arguments in nlmsvc_match_ip() +- svcrdma: Reject Write/Reply chunks with segcount 0 +- ksmbd: scope session state changes to bound connections +- pnfs/blocklayout: Fix device leaks on parse failure +- NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers +- NFSv4.1: zero referring call lists before decoding +- ext4: use fsdata to track inline data write state and fix race +- ext4: validate readdir offset before accessing dirent +- md: recheck spare changes before starting sync +- wifi: iwlwifi: mvm: init vif works only once + +* Mon Oct 19 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-179.0.0.158.20261019.09d4640accfa +- !28788 Fix: CVE-2026-89530 +- !29742 v2 net/mlx5e: Move representor vnic reporter to eswitch devlink port +- !29526 [CVEAgent@OLK-6.6] Fix CVE-2026-98216 +- !29736 v2 Add support for vTLBID +- net/mlx5e: Move representor vnic reporter to eswitch devlink port +- KVM: arm64: Add tracepoints for TLBID vDomain load events +- KVM: arm64: Enable TLBIDIDR_EL1 access trap in guest +- KVM: arm64: Conditionally expose ID_AA64MMFR4_EL1.TLBID to guest +- KVM: arm64: Emulate TLBIDIDR_EL1 with virtual domain counts +- KVM: arm64: Ensure DVMBM is disabled when TLBID is enabled +- KVM: arm64: Wire up TLBID vDomain configuration ioctls +- KVM: arm64: Add VTLBID sysregs and update VTLBID(n) on vCPU load +- KVM: arm64: Introduce TLBID virtualization infrastructure +- IB/hfi1: Fix the PIO_CRED credit-return mmap +- svcrdma: Reject inline replies that overflow the pull-up buffer +- svcrdma: Eliminate allocation of recv_ctxt objects in backchannel +- svcrdma: Fix retry loop in svc_rdma_send() +- svcrdma: Prevent a UAF in svc_rdma_send() +- svcrdma: Fix SQ wake-ups +- svcrdma: SQ error tracepoints should report completion IDs + +* Sun Oct 18 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-179.0.0.158.20261018.d0d1b5bfe6cb +- !29549 [CVEAgent@OLK-6.6] Fix CVE-2026-98271 +- net: skbuff: do not leave stale header offsets after pskb_carve() + +* Sat Oct 17 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-179.0.0.158.20261017.ef4553e532c3 +- !29763 perf/x86/intel: Prevent drain_pebs() reentry +- !29762 v2 procfs: move dropping pde and pid from ->evict_inode() to ->free_inode() +- !29758 v2 Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc +- !29518 [CVEAgent@OLK-6.6] Fix CVE-2026-98201 +- !29519 [CVEAgent@OLK-6.6] Fix CVE-2026-98205 +- !29306 [CVEAgent@OLK-6.6] Fix CVE-2026-97596 +- perf/x86/intel: Prevent drain_pebs() reentry +- procfs: move dropping pde and pid from ->evict_inode() to ->free_inode() +- md/raid1: remove struct pool_info and related code +- md/raid1: change r1conf->r1bio_pool to a pointer type +- Input: evdev - zero absinfo before partial copy in EVIOCSABS +- Input: zero ff_effect before compat copy in input_ff_effect_from_user +- ipvs: reject invalid states in connection template sync records + +* Fri Oct 16 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-179.0.0.158.20261016.4cc3c2f0868f +- !29527 [CVEAgent@OLK-6.6] Fix CVE-2026-98217 +- !29534 [CVEAgent@OLK-6.6] Fix CVE-2026-98246 +- !29535 [CVEAgent@OLK-6.6] Fix CVE-2026-98247 +- !29540 [CVEAgent@OLK-6.6] Fix CVE-2026-98252 +- !29541 [CVEAgent@OLK-6.6] Fix CVE-2026-98253 +- !29556 [CVEAgent@OLK-6.6] Fix CVE-2026-98293 +- !29558 [CVEAgent@OLK-6.6] Fix CVE-2026-98297 +- !29574 [CVEAgent@OLK-6.6] Fix CVE-2026-98347 +- !29576 [CVEAgent@OLK-6.6] Fix CVE-2026-98354 +- !29578 [CVEAgent@OLK-6.6] Fix CVE-2026-98357 +- !29579 [CVEAgent@OLK-6.6] Fix CVE-2026-98358 +- !29580 [CVEAgent@OLK-6.6] Fix CVE-2026-98359 +- !29581 [CVEAgent@OLK-6.6] Fix CVE-2026-98360 +- !29585 [CVEAgent@OLK-6.6] Fix CVE-2026-98365 +- !26200 [CVEAgent@OLK-6.6] Fix CVE-2026-72315 +- !29644 bpf: mark a NULL call argument precise +- !28082 [CVEAgent@OLK-6.6] Fix CVE-2026-89685 +- !28079 [CVEAgent@OLK-6.6] Fix CVE-2026-89680 +- !28036 [CVEAgent@OLK-6.6] Fix CVE-2026-89545 +- !28034 [CVEAgent@OLK-6.6] Fix CVE-2026-89543 +- !27810 [CVEAgent@OLK-6.6] Fix CVE-2025-37750 +- !29689 Fix CVE-2026-98125 +- !29722 nfs/enfs: wrap some functions and patch formatting +- !29430 nfs/enfs: Fix incorrect IP and state of the link +- !29699 nfs:enfs: Fix some bugs +- !29370 [CVEAgent@OLK-6.6] Fix CVE-2026-98031 +- !29714 vfio:ubus: Add validation for resource address legitimacy +- !29309 [CVEAgent@OLK-6.6] Fix CVE-2026-97602 +- !29586 [CVEAgent@OLK-6.6] Fix CVE-2026-98366 +- !29402 [CVEAgent@OLK-6.6] Fix CVE-2026-98108 +- !29354 [CVEAgent@OLK-6.6] Fix CVE-2026-97995 +- !29273 [CVEAgent@OLK-6.6] Fix CVE-2026-97507 +- !29243 [CVEAgent@OLK-6.6] Fix CVE-2026-97408 +- !29311 [CVEAgent@OLK-6.6] Fix CVE-2026-97609 +- !29303 [CVEAgent@OLK-6.6] Fix CVE-2026-97575 +- !29729 [OLK-6.6] Backported Perf IBS test patch +- !29226 [CVEAgent@OLK-6.6] Fix CVE-2026-93288 +- !29339 [CVEAgent@OLK-6.6] Fix CVE-2026-97959 +- !29238 [CVEAgent@OLK-6.6] Fix CVE-2026-93825 +- !29364 [CVEAgent@OLK-6.6] Fix CVE-2026-98017 +- !27457 scsi: leapraid: update driver to v2.00.01.10 +- !29587 [CVEAgent@OLK-6.6] Fix CVE-2026-98368 +- !29730 kabi: Add a Python3 port of check-kabi +- !29561 [CVEAgent@OLK-6.6] Fix CVE-2026-98301 +- !29360 [CVEAgent@OLK-6.6] Fix CVE-2026-98011 +- !29374 [CVEAgent@OLK-6.6] Fix CVE-2026-98043 +- !29531 [CVEAgent@OLK-6.6] Fix CVE-2026-98233 +- !29369 [CVEAgent@OLK-6.6] Fix CVE-2026-98026 +- !28022 [CVEAgent@OLK-6.6] Fix CVE-2026-89528 +- !29338 [CVEAgent@OLK-6.6] Fix CVE-2026-97958 +- kabi: Add a Python3 port of check-kabi +- perf test amd ibs: Fix spelling mistake "Asssuming" -> "Assuming" +- nfs/enfs: wrap some functions and patch formatting +- nfs/enfs: preserve iostat locks when resetting counters +- nfs/enfs: validate LS cache lookup results +- nfs/enfs: stop lookup cache work after reference failure +- nfs/enfs: validate extended RPC reply counts +- ub:ubus: fix races in direct_link_show +- vfio:ubus: Add validation for resource address legitimacy +- ub:ubus: Fix some code reliability issues +- smb/client: fix stale page cache in insert/collapse range +- nfs/enfs: pin main transport to its local address +- bpf: mark a NULL call argument precise +- esp: downgrade zerocopy managed frags before mutating skb frags +- RDMA/rxe: validate access flags before swapping the MR's PD +- RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access +- RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds +- RDMA/core: Reject unregistering netdevs in ib_get_eth_speed +- IB/iser: reject a remote invalidation of an unregistered direction +- IB/isert: wait for deferred control PDU completions before releasing the connection +- RDMA/mad: Fix receive buffer leak when PKey enforcement fails +- IB/IPoIB: Avoid restoring OPER_UP after multicast flush +- net: bridge: mst: move switchdev call outside rcu +- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained +- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() +- RDMA/ucma: Serialize join and leave on copy_to_user failure +- RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() +- Bluetooth: hci_codec: validate vendor codec count length +- Bluetooth: hci_sync: Serialize local codec list cleanup +- net/packet: clear RX owner on VNET header error +- IB/mlx4: Fix use-after-free on pkey sysfs registration failure +- nfs/enfs: fix proc path local address after link down +- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan +- bpf: Don't infer non-NULL from a pointer with an unbounded offset +- nexthop: Initialize extack in remove_nh_grp_entry() +- net: bridge: mcast: properly convert mglist to rcu +- net/sched: defer qdisc freeing after failed creation +- net/sched: hhf: clamp quantum in change and init paths +- virtio_console: do not free control-out buffers on remove +- net/sched: cls_route: free emptied bucket on filter move +- net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). +- netfilter: cttimeout: prevent UAF during module unload +- inet: frags: invalidate queues before flushing them +- media: v4l2-ctrls: validate AV1 tile counts +- media: dm1105: fix missing error check for dma_alloc_coherent +- Bluetooth: L2CAP: validate connectionless PSM length +- spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() +- netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state +- nfsd: fix clock domain mismatch in clients_still_reclaiming() +- nfsd: fix nfsd_file leak on inter-server COPY setup failure +- sunrpc: defer rq_argp and rq_resp free until after RCU grace period +- sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir +- svcrdma: Reject Read lists that exceed the page budget +- smb: client: fix UAF in decryption with multichannel +- scsi: leapraid: update driver to v2.00.01.10 +- smb: client: fix busy dentry warning on unmount after DIO + +* Thu Oct 15 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-179.0.0.158.20261015.bd48d00f97c9 +- !28458 [OLK-6.6] Fix CVE-2026-64260 +- !27413 [OLK-6.6] Fix CVE-2026-53401 +- !29718 KVM: arm64: Fix kernel panic due to uninitialized fpmr pointer +- !29573 [CVEAgent@OLK-6.6] Fix CVE-2026-98344 +- !29571 [CVEAgent@OLK-6.6] Fix CVE-2026-98342 +- !29304 [CVEAgent@OLK-6.6] Fix CVE-2026-97576 +- !29344 [CVEAgent@OLK-6.6] Fix CVE-2026-97975 +- !29401 [CVEAgent@OLK-6.6] Fix CVE-2026-98107 +- !29517 [CVEAgent@OLK-6.6] Fix CVE-2026-98199 +- !28767 Fix CVE-2026-90115 +- !28495 Fix CVE-2026-90061 +- !29614 nfsd: fix UAF in async copy cancel and shutdown +- !29522 [CVEAgent@OLK-6.6] Fix CVE-2026-98211 +- !29298 [CVEAgent@OLK-6.6] Fix CVE-2026-97564 +- !29405 [CVEAgent@OLK-6.6] Fix CVE-2026-98126 +- !29299 [CVEAgent@OLK-6.6] Fix CVE-2026-97565 +- !29406 [CVEAgent@OLK-6.6] Fix CVE-2026-98127 +- !29333 [CVEAgent@OLK-6.6] Fix CVE-2026-97940 +- !29543 [CVEAgent@OLK-6.6] Fix CVE-2026-98255 +- !29551 [CVEAgent@OLK-6.6] Fix CVE-2026-98276 +- !29346 [CVEAgent@OLK-6.6] Fix CVE-2026-97979 +- !29327 [CVEAgent@OLK-6.6] Fix CVE-2026-97930 +- !29357 [CVEAgent@OLK-6.6] Fix CVE-2026-98006 +- !29548 [CVEAgent@OLK-6.6] Fix CVE-2026-98265 +- KVM: arm64: Fix kernel panic due to uninitialized fpmr pointer +- nfsd: fix UAF in async copy cancel and shutdown +- dmaengine: Fix device kref underflow in dma_chan_put() +- dmaengine: wait for RCU readers before releasing dma_device +- net: lock the socket in sock_gettstamp() +- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity +- tcp: exclude old ACKs from tcp fast path +- mmc: mmci: Fix use-after-free in busy-timeout work +- hwmon: (pmbus/core) increase number of phases and add new mask +- smb/client: validate new EOF for insert range +- smb/client: validate new EOF for zero range +- Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect +- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev +- ice: add missing xa_destroy for sched_node_ids +- Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() +- ipv6: fix fib6 walker UAF on seq stop +- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf +- media: v4l2-ctrls: validate HEVC tile counts +- smb: client: reject short READ responses in CIFSSMBRead() +- smb: client: reject userspace cifs.idmap descriptions +- xsk: fix NULL pointer dereference in __xsk_rcv() +- xsk: avoid double checking against rx queue being full +- fbdev: omap2: fix use-after-free in omapfb_mmap +- netfilter: nf_tables: skip double clone set expressions on element insert +- fuse-uring: Avoid queue->stopped races and set/read that value under lock +- fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues +- fbdev: omap2: fix inconsistent lock returns in omapfb_mmap + +* Wed Oct 14 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-179.0.0.158 +- !29557 [CVEAgent@OLK-6.6] Fix CVE-2026-98295 +- !29577 [CVEAgent@OLK-6.6] Fix CVE-2026-98355 +- !29449 Fix CVE-2026-98087 +- !29686 bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks +- !29671 CVE-2026-100074 +- !29687 bpf: check_cond_jmp_op(): properly infer if register is null +- !29685 urma: not free vtpn if reuse process active tp failed +- !29562 [CVEAgent@OLK-6.6] Fix CVE-2026-98303 +- !29559 [CVEAgent@OLK-6.6] Fix CVE-2026-98299 +- !29384 [CVEAgent@OLK-6.6] Fix CVE-2026-98077 +- bpf: check_cond_jmp_op(): properly infer if register is null +- bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks +- urma: not free vtpn if reuse process active tp failed +- bpf: Mark bpf_refcount field as unique +- bpf: refactor special field-type detection +- RDMA/rtrs: guard against null kobj name +- ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup +- tcp: do not let tcp_rmem be set below 4096 +- Bluetooth: coredump: Quiesce dump work on unregister +- sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate +- netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() + +* Tue Oct 13 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-176.0.0.157.20261013.cdc744567ddd +- extra-modules: add i2c-hid-acpi-prp0001 module to avoid rpm build error. + +* Tue Oct 13 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-176.0.0.156.20261013.cdc744567ddd +- !29676 Fix the perf tool cs-etm-decoder compilation issue +- !29468 [OLK-6.6]net/txgbe:Sync txgbe out-of-tree driver v2.2.0.1 to in-tree txgbe +- !26471 openEuler:driver:drm:engiant: optimize egt display driver +- Revert "perf cs-etm: Queue context packets for frontend" +- Revert "perf cs-etm: Fix thread leaks on trace queue init failure" +- !29666 [OLK-6.6] Add FEAT_TLBID support (v4) +- !29356 [CVEAgent@OLK-6.6] Fix CVE-2026-97998 +- !29567 [CVEAgent@OLK-6.6] Fix CVE-2026-98322 +- !29533 [CVEAgent@OLK-6.6] Fix CVE-2026-98241 +- !29382 [CVEAgent@OLK-6.6] Fix CVE-2026-98074 +- !29640 net: hns3: use txqueue parameter directly in ndo_tx_timeout +- !29659 Fix CVE-2026-98067 +- !29583 [CVEAgent@OLK-6.6] Fix CVE-2026-98363 +- !28515 Fix CVE-2026-89527 +- !29591 [CVEAgent@OLK-6.6] Fix CVE-2026-98374 +- arm64/defconfig: enable CONFIG_ARM64_TLBID +- arm64: tlbflush: Optimize flush_tlb_page() by using TLBIP +- arm64: tlbflush: Optimize flush_tlb_range() by using TLBIP +- arm64: tlbflush: Optimize flush_tlb_mm() by using TLBID +- arm64: mm: Track CPUs that a task has run on for TLBID optimization +- arm64: Add kunit testsuit for TLBID related interfaces +- arm64: Scan sparse table to select target TLBI domain +- acpi: arm64: Parse TLBID and CPUs topology based on ACPI table +- arm64: cpufeature: Add TLBID (Domain-based TLB Invalidation) detection +- !29383 [CVEAgent@OLK-6.6] Fix CVE-2026-98075 +- erofs: disable LZ4 rolling decompression for now +- !29560 [CVEAgent@OLK-6.6] Fix CVE-2026-98300 +- !28341 [Intel][6.6] Backport PMU core event bugfixes for x86/Intel platforms +- !29431 nfs/enfs: Fix defects in sub-health feature +- !29617 arm64: Fix NMI/DAIF handling in hibernate, suspend and kprobes +- !29330 [CVEAgent@OLK-6.6] Fix CVE-2026-97936 +- !29322 [CVEAgent@OLK-6.6] Fix CVE-2026-97920 +- !29325 [CVEAgent@OLK-6.6] Fix CVE-2026-97923 +- !29168 [CVEAgent@OLK-6.6] Fix CVE-2026-89982 +- !29501 ub: udma: changes the lock_buffer_jetty solution +- !29371 [CVEAgent@OLK-6.6] Fix CVE-2026-98033 +- !29372 [CVEAgent@OLK-6.6] Fix CVE-2026-98034 +- !29246 [CVEAgent@OLK-6.6] Fix CVE-2026-97420 +- !29629 bpf: Reject dev-bound-only programs on other devices +- net: hns3: use txqueue parameter directly in ndo_tx_timeout +- net: hns3: add missing const qualifier to hclge_log_error() reg parameter +- net: hns3: set msg->desc to NULL after kfree in hclge_query_reg_info() +- Revert "net: hns3: set the freed pointer to NULL" +- Revert "net: hns3: Clear the static alarm about discarding the 'const' qualifier" +- net: hns3: Use netif_xmit_timeout_ms() helper +- net/mlx5e: Refine TX timeout handling to skip non-timed-out SQ +- net: Introduce netif_xmit_timeout_ms() helper +- hns3: fix arp proxy vlan tag extraction for non-hwaccel case +- !29452 [OLK-6.6][linux-6.6.y sync] Backport 6.6.156-6.6.157 LTS Patches +- !29263 [CVEAgent@OLK-6.6] Fix CVE-2026-97472 +- nvmet-rdma: fix queue leak when connect backlog is exceeded +- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error +- pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init() +- tools/build: Use SYSTEM_BPFTOOL for system bpftool +- ALSA: control: Fix unannotated kfree() cleanup +- net: hsr: Use the seqnr lock for frames received via interlink port. +- net: hsr: enable promiscuous mode on interlink port with fwd offload +- wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event() +- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() +- firmware: arm_scmi: Roll back partial protocol table registration +- nvme: target: rdma: fix ndev refcount leak on queue connect +- kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c +- kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings +- nvme-apple: Reset q->sq_tail during queue init +- nvme-apple: Prevent shared tags across queues on Apple A11 +- ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver() +- pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers +- pinctrl: mediatek: Fix new design debounce issue +- pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask() +- usb: atm: usbatm: fix invalid ci_range initialization +- net: fec: only stop PTP if it was initialized +- net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup +- net: stmmac: selftests: Account for the UC filter list for filtering tests +- net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering +- net: stmmac: dwmac4: Account for the primary MAC address for UC filtering +- net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering +- net: stmmac: selftests: Check multiple MMC counters +- selftests/arm64: Treat KSM merge_across_nodes as optional +- selftests/arm64: Print missing MTE TAP headers +- selftests: arm64: add hugetlb mte tests +- netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() +- netfilter: xt_HL: add pr_fmt and checkentry validation +- netfilter: xt_cgroup: Make it independent from net_cls +- virtio-net: Ensure that TCP packets don't overflow gso_segs +- net: stmmac: selftests: Pass the IP proto mask in the TC selftest +- net: ethernet: sun4i-emac: Fix IRQ error handling +- samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify +- samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify +- libceph: validate banner payload length +- ASoC: dapm: Fix off-by-one check on the second enum channel +- apparmor: policy_int make sure list heads are initialized before fail path +- apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init +- tpm: st33zp24: Validate locality read result +- tpm: st33zp24: Return zero on status read failure +- net/sched: sch_teql: restore skb->dev on the slave failure path +- net/sched: sfq: clamp quantum to avoid signed overflow soft lockup +- net/sched: hhf: clamp quantum before hhf_change() to avoid overflow +- net/sched: act_skbmod: fix length calculations and avoid invalid header warnings +- maple_tree: fix argument name in header +- selftests/mm: skip COW tmpfile cases when fallocate() is unsupported +- selftests/mm: report unique test names for each cow test +- selftests/mm/cow: modify the incorrect checking parameters +- selftests: mm: cow: flag vmsplice() hugetlb tests as XFAIL +- cifs: fix clearing stats for fastest execution of each smb2 command +- net/rds: use wq_has_sleeper() in rds_cong_map_updated() +- octeontx2-af: Fix TL3/TL2 link config ENA clearing +- net: qualcomm: rmnet: restore skb->dev on deaggregated frames +- gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free +- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop +- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path +- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX +- Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference +- erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic +- scsi: qla2xxx: Fix an loop timeout test +- rtc: pcf85363: Add error checking to regmap calls in probe() +- NFSv4.2: fix LAYOUTSTATS send buffer exhaustion +- net/smc: free pending qentry in smc_llc_flow_stop() before memset +- net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition +- net: add missing ref_tracker_dir_exit() to net_passive_dec() +- net: ipa: balance runtime PM reference on remove error +- net: ipa: Convert to platform remove callback returning void +- forcedeth: stop the tx_timeout register dump past the requested window +- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes +- RDMA/ucma: Allow path records to exactly fit the output buffer +- clk: visconti: Make sure clk_init_data is fully initialized +- clk: ti: Make sure clk_init_data is fully initialized +- prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator +- rtc: gamecube: check return value of devm_rtc_register_device() +- i2c: ocores: Disable clock on failed resume +- irqchip/renesas-rzg2l: Fix loss of interrupt +- rtc: zynqmp: Return optional clock lookup errors +- smb: client: fix request buffer leak in smb2_new_read_req() +- vdpa/mlx5: fix wrong list iterated in add_direct_chain error path +- vdpa_sim: fix cleanup after worker creation failure +- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() +- i3c: mipi-i3c-hci: Quieten initialization messages +- i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 +- i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes +- bonding: initialize err for empty target lists +- mlxbf-bootctl: fix the build error with FIELD_PREP() +- platform/x86: hp-bioscfg: fix password encoding bounds check +- vsock: use sock_error() to consume sk_err after a failed connect +- platform/x86: dell-wmi-sysman: Fix instance ID bounds +- net/smc: hash socket only after full initialisation in smc_sk_init() +- 8139cp: fix Rx and Tx not being disabled in cp_suspend +- bridge: add MDB get uAPI attributes +- vxlan: mdb: Factor out a helper for remote entry size calculation +- vxlan: mdb: Adjust function arguments +- ALSA: hda: Fix connection list comparison in proc output +- fuse: convert readdir to use folios +- fuse: support folios in struct fuse_args_pages and fuse_copy_pages() +- fuse: use FUSE_ROOT_ID in fuse_get_root_inode() +- fuse: convert to new timestamp accessors +- fs/ntfs3: validate ef->size covers the record's name and value +- fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() +- net: bridge: vlan: fix inverted default vlan notification +- tls: fix RX desync on overlapping skbs +- net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error +- net: hsr: Use full string description when opening HSR network device +- pppox: drain queued packets on channel handoff +- net: dsa: b53: fix error propagation from b53_fdb_dump() +- net: kcm: Hold RCU read lock while running BPF parser +- octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap() +- clk: ti: mux: resolve parent clocks by DT index, not by name +- clk: ti: use kcalloc() instead of kzalloc() +- NFSv4: remove callback IDR entry on client allocation failure +- nfs: refactor pNFS functions using clear_and_wake_up_bit +- nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper +- ksmbd: disconnect on SMB3 decryption failure +- m68k: nfcon: Do not call console_is_registered() in nfcon_device() +- smb/server: preserve error status in smb2_handle_negotiate() +- smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger() +- ksmbd: free preauth sessions on connection teardown +- ksmbd: do not advertise unimplemented CA support +- ksmbd: validate ipc response length before dereferencing its fields +- smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer +- ksmbd: Do not skip lock checks for single-byte ranges +- hwmon: (emc1403) Drop hysteresis for low limit temperature +- hwmon: (emc1403) Rely on subsystem locking +- hwmon: (emc1403) Add support for EMC1428 and EMC1438. +- hwmon: (emc1403) Support 11 bit accuracy +- hwmon: (emc1403) Convert to with_info API +- hwmon: (emc1403) Add support for EMC1442 +- block: mtip32xx: synchronize ioctls with device removal +- mailbox: pcc: Fix command timeout due to missed interrupt +- Revert "mailbox/pcc: support mailbox management of the shared buffer" +- mailbox/pcc: support mailbox management of the shared buffer +- mailbox: rockchip: disable pclk on probe failure and unbind +- perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() +- perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() +- ASoC: SOF: validate topology volume range before allocation +- tracing: Have trace_event_update_all() only handle module that is loading +- tracing: Remove "__attribute__()" from the type field of event format +- ALSA: core: Fix use-after-free in snd_card_do_free() +- fs/ntfs3: reject out-of-range evcn in mi_enum_attr() +- fs/ntfs3: fix integer overflow in MFT cluster validation +- scsi: ufs: core: Set task state before io_schedule_timeout() +- scsi: ufs: core: Remove redundant host_lock calls around UTMRLDBR +- scsi: ufs: core: Remove unnecessary wmb() after ringing doorbell +- selftests/bpf: Fix for veristat file/prog filters processing +- Squashfs: check block offset is not negative +- bpftool: Fix double close in map dump +- x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported +- ALSA: seq: midi: Serialize input teardown with event_input +- ALSA: seq: midi: Optimize event_input locking with RCU +- clocksource/drivers/armada: Unwind timer clock on init failure +- clocksource/drivers/clps711x: Do not unmap clocksource MMIO +- s390/debug: Fix deadlock during unregister +- xenbus: Unregister reboot notifier on init failure +- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address +- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address +- power: supply: bq27xxx: bq27520g4: fix REG_TTES address +- power: supply: bd99954: Drop bad register fields +- spi: img-spfi: don't disable runtime PM on DMA deferred probe +- selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM +- selftests/bpf: Add description for running vmtest on RV64 +- selftests/bpf: Support local rootfs image for vmtest +- selftests/bpf: Limit URLS parsing logic to actual scope in vmtest +- kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix +- UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC +- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error +- UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs +- UBI: Preserve torture flag when rescheduling failed erasures +- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready +- ASoC: pxa: Use devm_clk_get_optional() for extclk clock +- ice: clear the default forwarding VSI rule when releasing a VSI +- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal +- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing +- nfc: digital: Do not dump a NULL response in command completion +- nfc: pn533: hold a reference to the request skb during send_frame +- nfc: llcp: bound SNL TLV parsing to the skb and add length checks +- nfc: nci: fix double completion race in nci_data_exchange_complete +- nfc: llcp: read llcp_sock->local under the socket lock in getsockopt +- nfc: llcp: avoid userspace overflow on invalid optlen +- nvme: reject passthrough of driver-managed Set Features +- nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() +- nvme-apple: Drop the PRP null check chicken bit +- nvme: apple: Add Apple A11 support +- nvme-apple: Never set the opcode in the NVMMU TCB +- nvme-apple: Don't set a DMA direction for commands without a data transfer +- nvme-apple: Destroy the admin queue on removal +- nvme: Add the DHCHAP maximum HD IDs +- nvme: introduce change ptpl and iekey definition +- nvme: add reservation command's defines +- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP +- spi: sprd-adi: Fix probe succeeding without registering the controller +- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs +- powerpc/configs: enable CONFIG_RAS to fix EDAC support +- arm64: Disable KCSAN instrumentation in delay.o +- m68k: Fix backtraces for non-running tasks +- iommu/vt-d: Fix UCTP context table slot when copying root entries +- fbdev: kyro: Validate overlay viewport coordinates +- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() +- perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads +- perf synthetic-events: Fix uninitialized pthread_join +- perf stat: Fix evsel_list leak in cmd_stat +- ARM: dts: helios4: add SATA regulator supplies +- ARM: dts: helios4: add vcc-supply to GPIO expander +- ARM: dts: helios4: add vcc-supply to EEPROM +- arm64: dts: turris-mox: fix usb3 phys +- riscv: cpufeature: Clarify ISA spec version for canonical order +- iio: light: gp2ap002: re-enable irq if runtime suspend fails +- iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes +- Bluetooth: MSFT: validate evt_prefix_len against the response length +- Bluetooth: btintel: Fix diagnostics event detection +- Bluetooth: virtio_bt: avoid OOB read of build info string +- btrfs: retry verity reads for not-uptodate Merkle folios +- scsi: sd: Fix sd_done() sense handling condition +- perf trace-event: Fix integer truncation in do_read() and skip() +- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices +- Bluetooth: btusb: Record matched usb_device_id into btusb_data +- Bluetooth: btusb: refactor endpoint lookup +- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() +- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event +- sched/fair: Check CPU capacity before comparing group types during load balance +- ACPI: video: Release PCI device reference after lookup +- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling +- coresight: etm4x: fix leaked trace id +- coresight: etm4x: fix underflow for usage of (nrseqstate - 1) +- coresight: Change syncfreq to be a u8 +- coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() +- md/raid1: don't set array_frozen in raid1_takeover() +- md: avoid stale clone I/O accounting timestamps +- phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend +- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend +- phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend +- phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads +- phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*() +- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() +- pinctrl: rockchip: Reset the pin count when recalculating SoC data +- firmware_loader: do not queue completed sysfs fallback requests +- scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path +- perf trace-event: Fix buffer overflow in read_string() +- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table +- phy: sunplus: fix error handling in sp_uphy_init() +- arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node +- ext4: fix spurious message about orphan cleanup on RO fs +- drm/amdgpu/gfx6: Fixup emit_cntxcntl() +- mfd: iqs62x: Reject zero-length firmware records +- mfd: rave-sp: validate received frame payload lengths +- arm64: hibernate: mask DAIF before restoring hibernated kernel +- wifi: mac80211: skip default WMM setup for AP_VLAN links +- RDMA/erdma: restrict the driver to little-endian systems +- RDMA/siw: Fix use-after-free in siw_accept() +- RDMA/siw: Introduce siw_free_cm_id +- cpufreq: imx6q: fix out-of-bounds write when probed more than once +- cpufreq: imx6q: fix devres accumulation across driver rebind +- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz +- drm/sun4i: dw-hdmi: Drop TCON TOP port reference +- drm/sun4i: tcon: Drop remote endpoint reference +- drm/sun4i: crtc: Propagate layer initialization error +- drm/sun4i: tcon: Drop TCON TOP device reference +- drm/sun4i: tcon: Set output mux for DSI and LVDS +- of: property: add of_graph_get_next_port_endpoint() +- of: property: add of_graph_get_next_port() +- of: property: use unsigned int return on of_graph_get_endpoint_count() +- of: property: add missing kerneldoc for of_graph_get_endpoint_count() +- drm/sun4i: vi scaler: Fix coefficient selection +- ocfs2: synchronize heartbeat callbacks with o2net teardown +- modpost: prevent leak when early return no suffix .o in read_symbols() +- scripts/tags.sh: Prevent binary files appearing in cscope.files +- arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies +- selftests/mm: fix ternary operator precedence in ksm_tests +- selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes +- selftests/mm: ksm_tests: use kselftest framework +- ksm_tests: skip hugepage test when Transparent Hugepages are disabled +- selftests/mm: add new test cases to the migration test +- remoteproc: Move resource table data structure to its own header +- drm/omap: dsi: Do not copy isr table +- fat: release buffer head after rebuilding parent +- rapidio: clear mport->net when rio_add_net() fails +- pps-gpio: remove dead capture_clear code +- pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler +- pps: clients: gpio: Bypass edge's direction check when not needed +- pps: don't try to wait for negative timeouts in PPS_FETCH +- lib/string: fix memchr_inv() for large ranges +- ublk: check for ublk_unmap_io() returning 0 +- block/kyber-iosched: flush per-cpu latency buckets over possible CPUs +- block/blk-iocost: collect per-cpu latency stats over possible CPUs +- block/blk-stat: drain per-cpu callback stats over possible CPUs +- phonet: pep: do not write beyond optlen in getsockopt +- iio: light: tsl2583: return zero in write_raw() on success +- iio: light: isl29028: return zero in write_raw() on success +- iio: light: tsl2772: fix ALS calibscale readback +- perf intel-bts: Fix off-by-one in auxtrace_info minimum size check +- perf intel-pt: Fix off-by-one in auxtrace_info minimum size check +- perf auxtrace: Fix queue grow overflow and old array leak +- perf thread-stack: Fix heap buffer overflow on branch stack wrap copy +- HID: lg4ff: validate report length before fixed offsets +- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure +- HID: i2c-hid: Fix "(null)" output when reading report descriptor fails +- HID: i2c-hid: Revert to await reset ACK before reading report descriptor +- HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor +- HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling +- HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions +- HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() +- HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver +- serial: amba-pl011: unprepare console clock on unregister +- MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL +- powerpc/irq: Fix missing r2 clobber in PCREL inline assembly +- powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass +- firmware: coreboot: Validate table bounds +- firmware: google: Add bounds checks in coreboot_table_populate() +- wifi: mac80211: skip unused probe response countdown offsets +- wifi: zd1211rw: reject secondary interfaces to prevent conflicts +- wifi: mac80211: send TWT teardown to peer after setup TX failure +- perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register +- iommu/arm-smmu-v3: Convert to use atomic poll timeout +- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump +- wifi: mt76: mt7915: report RX chain signal for all RX paths +- wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 +- wifi: mt76: mt7996: fix reg addr remap when addr is 0 +- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure +- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path +- wifi: mt76: mt7915: fix double hif2 init on the non-WED path +- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement +- perf machine: Check snprintf truncation for guest kallsyms path +- perf machine: Free scandir entries in guest kernel map creation +- perf machine: Reset errno before strtol in guest kernel map creation +- perf machine: Don't abort guest map creation on first inaccessible dir +- perf machine: Check snprintf truncation in machines__findnew() +- perf machine: Use snprintf() for guestmount path construction +- perf machine: Guard against NULL strlist in machines__findnew() +- perf machine: Fix NULL parent dereference in fork event processing +- regulator: core: use system_freezable_wq for init complete work +- wifi: ath11k: fix leak in ath11k_service_ready_ext_event() +- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) +- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) +- perf: arm_spe: Make wakeup range check overflow safe +- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields +- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV +- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config +- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie +- wifi: mt76: mt7996: don't report a zero TX bitrate +- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss +- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset +- wifi: mt76: mt792x: Fix memory leak in SDIO TX path +- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 +- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length +- fanotify: report full event length for FIONREAD +- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() +- locking/lockdep: Fix NULL pointer dereference in __lock_set_class() +- i3c: master: Fix device_register() error path +- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices +- clk: qcom: Return expected ENOMEM error on dynamic allocation failure +- lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone +- power: supply: sc2731_charger: cancel work on remove +- power: supply: sc2731_charger: Convert to platform remove callback returning void +- power: supply: isp1704_charger: cancel work on remove +- arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries +- arm64: dts: qcom: sm8550: Fix the msi-map entries +- arm64: dts: qcom: sm8550: Use GIC-ITS for PCIe0 and PCIe1 +- arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries +- arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries +- arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries +- arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries +- arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries +- arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries +- arm64: dts: qcom: sc8180x: drop duplicated PCI iommus property +- arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID +- arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en +- clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration +- arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property +- arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep +- rcu: Remove unused function declaration rcu_eqs_special_set() +- selftests/zram: fix kernel_gte() for POSIX sh +- tools/nolibc/powerpc: mark ctr and xer as clobbered by system call +- md/raid5-ppl: fix use-after-free in ppl_do_flush() +- md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency +- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET +- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() +- platform/chrome: cros_ec_debugfs: Unregister panic notifier +- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure +- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() +- wifi: ath11k: implement handling of P2P NoA event +- wifi: ath11k: refactor ath11k_wmi_tlv_parse_alloc() +- wifi: ath11k: add firmware-2.bin support +- wifi: ath11k: qmi: refactor ath11k_qmi_m3_load() +- spi: davinci: switch to managed controller allocation +- spi: davinci: Unset POWERDOWN bit when releasing resources +- spi: davinci: Use helper function devm_clk_get_enabled() +- nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request +- RDMA/mlx5: Send cong param changes to the resolved port mdev +- scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. +- nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch +- nilfs2: convert nilfs_page_bug() to nilfs_folio_bug() +- nilfs2: convert nilfs_btnode_commit_change_key to use a folio +- nilfs2: convert nilfs_btnode_prepare_change_key to use a folio +- nilfs2: convert to nilfs_folio_buffers_clean() +- nilfs2: convert nilfs_forget_buffer to use a folio +- nilfs2: add nilfs_end_folio_io() +- nilfs2: prevent out-of-bounds read in super root block parsing +- nilfs2: fix infinite loop in nilfs_clean_segments() +- clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs +- clk: mediatek: mt8135: Fix inverted gate control for devapc_ck +- clk/x86: pmc_atom: add kasprintf return value check +- clk: palmas: Manage external-control prepare with devm +- clk: tegra: tegra124-emc: put EMC node on register failure +- arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix +- RDMA/efa: Fix PBL chunk length computation +- fs/ntfs3: reject restart table growth beyond U16_MAX entries +- staging: rtl8723bs: use kfree_sensitive() for key material +- remoteproc: Allow shutdown of crashed processors +- remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown() +- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() +- isofs: release zisofs block pointer buffer head +- crypto: keembay - publish OF module alias for OCS AES/SM4 +- crypto: keembay - Initialize completion before requesting IRQ +- scsi: ufs: debugfs: Reserve space for a string terminator +- power: supply: sbs-battery: Use a per-device serial number buffer +- tools/build: Allow versioning of all LLVM tools defined in Makefile.include +- tools/build: Add bpftool-skeletons feature test +- pinctrl: mediatek: free EINT resources on unbind +- pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms +- pinctrl: mediatek: Fix the invalid conditions +- pinctrl: mediatek: Add EINT support for multiple addresses +- pinctrl: mediatek: Use C99 initializers in PINCTRL_PIN_GROUP() +- cxl/region: Fix use-after-free in find_pos_and_ways() error path +- selftests/bpf: Fix memory leak on subtest_states reallocation +- selftests/bpf: Fix incorrect error checking for pthread_create +- ARM: lpc32xx: only run SoC init on LPC32xx hardware +- arm64: dts: rockchip: Fix Gru WLAN sideband interrupt +- fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init +- netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet +- drm/tve200: add OF module alias for autoloading +- leds: pca9532: Fix phantom device registration on missing hardware +- PM: hibernate: Fix memory leak in snapshot_write_next() error path +- perf cs-etm: Avoid truncating AUX buffer sizes to int +- perf cs-etm: Flush thread stacks after decoder reset +- firmware: arm_scmi: Unrequest devices if driver registration fails +- firmware: arm_scmi: Add multiple protocols registration support +- ARM: dts: allwinner: a10: Fix PMU interrupt +- ext4: fix buffer_head leak in ext4_init_orphan_info +- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() +- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() +- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request +- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request +- wifi: ath6kl: avoid buffer overreads in WMI event handlers +- ext4: drain in-flight DIO before buffered write fallback +- ext4: clear stale xarray tags on folios skipped during writeback +- iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() +- iommu/qcom: Remove sysfs device on probe failure path +- RDMA/erdma: Fix CEQ tasklet use-after-free on removal +- PCI: j721e: Fix incorrect max_lanes for J7200 +- RDMA/srpt: Pass the mapped task attribute to target_init_cmd() +- libbpf: Search /lib64 and /lib in resolve_full_path() +- ext4: skip extra isize expansion during mount to prevent deadlock +- ext4: fix circular lock dependency in ext4_ext_migrate +- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root +- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer +- selftests/bpf: Silence array bounds warning in global_map_resize +- kcsan: avoid unintended access checking in NMIs +- RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters +- RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] +- RDMA/hfi1: Propagate sdma_txinit_ahg() errors +- arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe +- phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe +- ASoC: meson: Keep link pointers valid on realloc failure +- dmaengine: dw-edma: Clear stale requests on termination +- dmaengine: dw-edma: Serialize channel state checks +- dmaengine: dw-edma: Serialize abort state updates +- dmaengine: dw-edma: Terminate all descriptors without callbacks +- driver core: soc: Unregister bus on early device registration failure +- software node: Fix software_node_get_reference_args() with index -1 +- perf ui hists: Fix uninitialized stack memory free on pstack allocation failure +- mtd: mtdswap: Avoid freeing registered blktrans device twice +- vfio/pci: clear vdev->msi_perm after freeing it on init failure +- char: xilinx_hwicap: unregister class on init errors +- ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove +- tty: ipoctal: convert to u8 and size_t +- ppdev: prevent overflow when setting port timeout +- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) +- misc: ad525x_dpot: use driver core groups for sysfs files +- misc: rtsx: add missing write register handling +- misc: bcm-vk: Use acquire/release for msgq_inited +- speakup: keyhelp: guard letter_offsets possible out-of-range indexing +- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() +- uio: Fix stale info pointer in failed registration path +- UDF symlink pathComponent header OOB read +- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 +- ACPI: processor: idle: Expand _LPI package sanity checks +- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping +- drm/msm/a6xx: Fix stale rpmh votes after suspend +- gpu: host1x: Avoid stack over-read in debug output helpers +- gpu: host1x: Fix offset calculation in trace_write_gather +- wifi: iwlwifi: mei: pass correct argument to function +- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments +- wifi: iwlwifi: mei: check SAP message length before reading it +- wifi: iwlwifi: mei: add support for SAP version 4 +- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser +- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs +- perf jevents: Add more components to the metric sorting order +- arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table +- arm64: dts: qcom: sm8250: sort out Iris power domains +- arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO +- drm/bridge: tc358767: clamp the reported AUX read size to the request +- remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev +- cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() +- cpufreq: intel_pstate: Fix setting minimum P-state at init time +- media: i2c: rdacm21: Fix missing media_entity_cleanup() +- irqdomain: Handle domain hierarchy parent in irq_domain_instantiate() +- irqdomain: Handle additional domain flags in irq_domain_instantiate() +- irqdomain: Introduce irq_domain_instantiate() +- irqdomain: Introduce irq_domain_free() +- PCI: xgene: Drop unnecessary OF node reference +- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN +- cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() +- libnvdimm/labels: Bound the on-media label size before the shift +- firmware: arm_scmi: Protect device request lookup with RCU +- firmware: arm_scmi: Use channel ID for transport teardown +- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate +- fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() +- fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list +- cxl/pci: Honor -EPROBE_DEFER from component register setup +- cxl/mbox: Break poison list loop on an empty payload +- rpmsg: glink: fix deadlock in endpoint destroy during driver detach +- rpmsg: glink: remove duplicate code for rpmsg device remove +- media: v4l2-async: Unregister sub-device if asc_list is empty +- media: v4l: async: Drop useless list move operation +- ASoC: apple: mca: increase SERDES reset delay +- RDMA/hfi1: Initialize debugfs after probe completes +- RDMA/hfi1: Stop flushing the global IB workqueue +- RDMA/hfi1: Create workqueues before device initialization +- RDMA/hfi1: Remove redundant PCI device ID validation +- RDMA/hfi1: Free RX data on late probe failure +- misc: rtsx_usb: avoid USB I/O in runtime autosuspend +- pmdomain: bcm: bcm2835: handle genpd provider registration errors +- ALSA: hpi: Check transport errors during HPI6000 adapter initialization +- xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full +- hwrng: ks-sa - Fix runtime PM cleanup on registration failure +- hwrng: ks-sa - access private data via struct hwrng +- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE +- bus: qcom-ebi2: use managed resources for clocks and children +- soc: qcom: rpmh-rsc: manage PM notifiers with devres +- perf metricgroup: Fix metric expression copy leaks +- drm/panel: samsung-s6d16d0: Power off on prepare failure +- usb: renesas_usbhs: Fix power-off ordering on unbind +- usb: mtu3: allow system suspend during active gadget connection +- platform/surface: acpi-notify: Check ACPI companion before use +- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL +- USB: core: Use device_driver directly in struct usb_driver and usb_device_driver +- usb: gadget: aspeed_udc: check endpoint DMA allocation +- usb: gadget: aspeed_udc: Convert to platform remove callback returning void +- serial: ma35d1: Fix OF node reference leaks in console init +- hwspinlock: propagate errno when registering single lock +- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node +- platform/x86: dell-wmi-base: Fix resource leak on module load failure +- platform/x86: dell-privacy: Fix race condition +- leds: pca9532: Fix inverted GPIO output polarity +- iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors +- iommu/msm: Return -ENOMEM on memory allocation failure in probe +- iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX +- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation +- efi: fix stale reference to efi_recover_from_page_fault() +- udf: Mark LVID buffer as uptodate before marking it dirty +- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path +- usb: typec: ucsi: unregister debugfs entries on teardown +- thermal/drivers/rcar: Fix error checking in probe() +- perf data convert json: Fix trace_seq memory leak in process_sample_event() +- arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes +- arm64: dts: qcom: sc8180x: Enable the power key +- arm64: dts: qcom: sc8180x-lenovo-flex-5g: move pinctrl to appropriate nodes +- arm64: dts: qcom: sc8180x-primus: Rename regulator nodes +- clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains +- clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status +- timekeeping: Account for monotonicity adjustment in ntp_error +- y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 +- clocksource: Unregister subsystem on device registration failure +- selftests: timers: leap-a-day: Fix -w option and update usage comment +- irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its() +- irqchip/gic-v3-its: Fix memleak in its_probe_one() +- selftests/bpf: Fix memory leak in msg_alloc_iov +- selftests/bpf: Fix memory leak in msg_alloc_iov error path +- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() +- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() +- staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown +- staging: octeon: replace pr_warn with dev_warn in fill and rx paths +- staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions +- staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown +- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown +- staging: fbtft: Use sysfs_emit_at() to print to sysfs file +- greybus: audio: bound the topology section sizes against the fetched size +- staging: sm750fb: gate dualview dataflow using g_dualview +- staging: greybus: audio: correct sscanf() return value check +- wifi: mac80211_hwsim: avoid NULL skb in stop queue drain +- bus: qcom-ebi2: Fix clock leak on probe failure +- bus: qcom-ebi2: Simplify with scoped for each OF child loop +- arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name +- PM: sleep: Fix off-by-one in wakelocks number limit check +- bus: ti-sysc: Fix /chosen node reference leak +- nvmet-rdma: fix response resource leak on queue teardown +- nvmet-rdma: factor out response resource cleanup +- nvmet-rdma: use sbitmap to replace rsp free list +- nvmet-rdma: avoid circular locking dependency on install_queue() +- nvme-apple: Use acquire/release for queue enabled state +- crypto: keembay - Fix AEAD unregister count in error path +- crypto: rk3288 - fail ahash requests on HASH idle timeout +- crypto: sa2ul - stop probe if context pool creation fails +- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure +- crypto: atmel-ecc - reject hardware ECDH without a public key +- crypto: atmel-ecc - clean up and improve ECDH comments +- crypto: atmel-ecc - replace min_t with min +- perf/x86/amd/uncore: Add group validation +- perf cs-etm: Fix thread leaks on trace queue init failure +- perf cs-etm: Queue context packets for frontend +- perf cs-etm: Create decoders after both AUX and HW_ID search passes +- perf cs-etm: Fix incorrect or missing decoder for raw trace +- wifi: rtw89: fix HE extended capability length check +- platform/chrome: sensorhub: Fix memory overread in ring handler +- selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check +- csky: Fix a4/a5 restoration in syscall trace path +- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure +- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports +- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe +- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers +- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure +- tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands +- tools/bpf/bpftool: Reset vmlinux BTF after map commands +- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup +- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup +- regulator: tps6594: Fix device node reference leaks in multiphase loop +- regulator: tps6594-regulator: refactor variant descriptions +- regulator: tps6594-regulator: remove hardcoded buck config +- regulator: tps6594-regulator: remove interrupt_count +- regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type +- regulator: tps6594-regulator: Fix the number of irqs for TPS65224 and TPS6594 +- regulator: tps6594-regulator: Add TI TPS65224 PMIC regulators +- mfd: tps6594: Add register definitions for TI TPS65224 PMIC +- perf test: Fix perf stat --bpf-counters on hybrid machines +- perf tests: Skip metrics validation if system-wide recording lacks permission +- perf test: Do not skip when some metrics tests succeeded +- perf test all metrics: Fully ignore Default metric failures +- perf test metrics: Update all metrics for possibly failing default metrics +- perf tests metrics: Permission related fixes +- perf test stat_all_metrics: Ensure missing events fail test +- perf test: Update all metrics test like metricgroups test +- perf test: Simplify metric value validation test final report +- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define +- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define +- pinctrl: bcm2835: Don't remove an unregistered GPIO chip +- mm/mm_init: fix incorrect node_spanned_pages +- drm/lima: call drm_mm_init() with a valid allocation range +- clk: imx: scu: drop redundant init.ops variable assignment +- ARM: imx: fix device_node refcount leaks in imx7_src_init() +- ARM: imx: fix device_node refcount leak in imx_src_init() +- clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller +- ASoC: rt700-sdw: always drain jack work on remove +- clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic +- clk: nuvoton: ma35d1-pll: convert from round_rate() to determine_rate() +- clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc +- clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation +- clk: moxart: remove unused variables, fix refcount leak +- clk: versaclock7: Fix APLL clock leak on probe failure +- media: cec-pin: Fix event FIFO ordering +- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() +- HID: roccat: bound device-supplied profile index +- HID: nintendo: Fix imu_timestamp_us double increment per report +- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count +- x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE() +- smack: restrict smackfs/{direct,mapped} values to 0-255 +- smack: deduplicate smackfs/{direct,mapped} file_operations +- smack: simplify write handlers of sysfs entries +- smack: fix incorrect task context in smack_msg_queue_msgrcv +- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure +- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format +- drm: lcdif: Wait for vblank before disabling DMA +- drm: Remove unused header in drm_dumb_buffers.c +- mm/damon/core: skip aging from repeated aggressive merging +- usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion +- clk: meson: align gxbb_32k_clk_sel number of parents with actual count +- batman-adv: bla: avoid CRC corruption due to parallel claim add +- batman-adv: dat: atomically update mac addresses +- netfilter: nft_counter: serialize reset with spinlock +- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" +- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb +- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path +- mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() +- mm/damon/core-kunit: handle region split failure in filter_out() +- mm/damon/vaddr-kunit: check region count in three_regions test +- mm/damon/paddr: drop last same folio access check reuse optimization +- mm/damon/vaddr: drop last same folio access check optimization +- mm/damon/core-kunit: check region count before testing in split_at() +- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE +- drm/nouveau: Use write-combined maps for coherent +- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving +- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT +- drm/amdgpu: fix autosuspend cleanup during removal +- drm/amdgpu: check thunderbolt before switcheroo registration +- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used +- drm/gud: validate TV mode names before creating enum property +- drm/gud: NUL-terminate TV mode names read from the device +- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check +- drm/hibmc: Use drm_atomic_helper_check_plane_state() +- drm/hibmc: Fix list of formats on the primary plane +- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() +- drm/i915: Guard against NULL driver_data in i915_pci_probe() +- drm/panel-edp: fix i2c adapter leak on probe failure +- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure +- f2fs: fix to zero post-EOF data when extending file size +- f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page() +- f2fs: fix i_size when pinned fallocate partially fails +- f2fs: return writeback error from collapse range +- f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() +- f2fs: reject overlapping move range after len expansion +- f2fs: return symlink writeback errors +- scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics +- scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort +- scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() +- scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() +- scsi: qla2xxx: Initialize NVMe abort_work once at submission +- scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters +- scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check +- media: zoran: Avoid freeing a registered video_device twice +- media: vimc: fix pixel format lookup in enum_framesizes +- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure +- media: venus: fix payload size calculation in parse_raw_formats() +- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() +- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance +- media: v4l2-async: avoid deleting unlinked ASC entry on link error +- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure +- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak +- media: rc: sunxi-cir: Unregister rc device on probe failure +- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks +- media: nxp: imx8-isi: Correct color map between V4L2 and ISI +- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing +- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common +- media: i2c: ov7740: fix use-after-destroy in remove +- media: i2c: ov02a10: fix endpoint parsing use-after-free +- media: go7007: defer the ALSA v4l2 put until card release +- media: em28xx: fix use-after-free of dev_next->devlist on disconnect +- media: em28xx: defer audio-only extension registration +- media: cx23885: cancel NetUP CI work before teardown +- media: cobalt: Avoid freeing ALSA private data twice +- media: cedrus: fix memory leak in cedrus_init_ctrls() +- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash +- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref +- LoongArch: Do not save/restore percpu base register in rethook trampoline +- KVM: s390: Restore sigset on error path +- KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP +- KVM: s390: Zero initialize irq in reinject_machine_check +- KVM: s390: Take srcu when importing watchpoint data +- KVM: s390: Free guest debug data on vcpu destroy +- KVM: s390: Fix old_data leak in guest debug error path +- KVM: s390: Fix memory leak in guest debug handling +- KVM: s390: Fix length check __import_wp_info() +- iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask +- iio: light: opt4001: Reject integration times with a non-zero seconds part +- iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() +- iio: light: opt4001: Fix power down clearing bits of the wrong register +- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() +- iio: srf04: fix pm_runtime handling on probe error path +- iio: pressure: mpl115: Fix runtime PM cleanup +- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe +- iio: light: gp2ap002: Disable regulators on resume failure +- iio: light: cm32181: return zero after writing calibscale +- iio: gyro: mpu3050: fix sign of raw angular velocity readings +- iio: dac: m62332: Fix regulator reference count imbalance +- iio: chemical: sgp30: Handle IAQ thread creation failure +- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF +- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable +- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get +- AsoC: intel: sst: fix PCI device reference leak on probe failure +- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure +- ASoC: cs35l34: drain threaded IRQ before runtime suspend +- ASoC: cs35l33: drain threaded IRQ before runtime suspend +- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure +- clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks +- clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk +- clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk +- clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src +- clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src +- clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src +- clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk +- clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk +- batman-adv: bla: prevent CRC corruptions after claim flush +- batman-adv: bla: fix freeing of claims on meshif deletion +- batman-adv: dat: avoid unaligned fault in IP extraction +- batman-adv: fix stale receive device on merged fragments +- mtd: mtdoops: free page bitmap when the backing MTD is removed +- mtd: afs: validate v2 image info bounds +- s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object +- s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap +- s390/vfio-ap: Fix NULL deref in status_show() during queue probe +- s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed +- s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL +- s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove +- s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove +- s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() +- powerpc/crash: stop watchdogs before booting kdump kernel +- powerpc/pseries: Move H_WATCHDOG definitions to a common header +- powerpc/pseries: Handle and log pseries-wdt registration failures +- powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population +- parisc: Fix alignment of asm statements in head.S +- parisc: eisa: Fix infinite loop when parsing invalid IRQ value +- mm/hugetlb: fix missing migratable flag on same-node hugetlb migration +- ALSA: pcm: Fix race between non-atomic ops and trigger-start +- ALSA: harmony: initialize locks before requesting IRQ +- arm64: mm: Fix the lockless page-table walk in show_pte() +- i2c: mux: Fix channel node leak on adapter add failure +- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers +- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary +- Input: aiptek - validate raw macro indices before updating state +- ata: ahci: work around lost interrupts on Marvell 88SE61xx +- block: flag zoned disks with GENHD_FL_NO_PART +- cpuidle: dt_idle_genpd: kfree() the original name allocation +- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs +- dmaengine: dw-edma: Complete descriptors before pausing +- dmaengine: dw-edma: Fix HDMA channel status register access +- dm: fix resume-vs-remove race +- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq +- HID: rmi: fix OOB access with undersized RMI reports +- futex: Prevent rcuwait use-after-free during requeue PI +- mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs +- mm/damon/sysfs: kobject_del() region and target (error) dirs +- mm/damon/sysfs-schemes: kobject_del() scheme region dirs +- mm/damon/sysfs-schemes: kobject_del() scheme filter dirs +- mm/damon/sysfs-schemes: kobject_del() scheme dirs +- scsi: pm8001: Use rollback index when freeing MSI-X vectors +- spi: bcmbca-hsspi: disable clocks on resume failure +- spi: bcm63xx: disable clock on resume failure +- spi: bcm63xx-hsspi: disable clocks on resume failure +- ublk: clear VM_MAYWRITE on read-only ublk char device mmap +- thermal/drivers/qoriq: Disable clock on resume failure +- thermal/drivers/imx: Disable clock on runtime resume failure +- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() +- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() +- usb: gadget: fix null pointer dereference in usb_put_function_instance() +- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() +- usb: gadget: f_midi2: fix use-after-free in string attribute show path +- usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs +- usb: typec: qcom-pmic: cancel reset_work on stop +- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() +- media: usbtv: keep device alive while ALSA card exists +- clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset +- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() +- drm/amd/display: fix division by zero in get_estimated_bw() +- tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions +- tracing/mmiotrace: Remove reference to unused per CPU data pointer +- net: ntb_netdev: Fix TX busy and drop handling +- wifi: mt76: mt7996: validate default EEPROM firmware size +- landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation +- platform/chrome: sensorhub: Fix dropped timestamp events and log spam +- udf: Fix i_lenExtents truncation on 32-bit kernels +- timer: Keep debugobjects state consistent in migrate_timer_list() +- taskstats: fix cpumask parsing cutting off the last character +- smack: fix cred UAF in smack_file_send_sigiotask() +- signal: avoid shared siginfo namespace rewrites +- sticon/parisc: Detect default STI graphics card for console output +- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout +- w1: ds28e17: reject an oversize length on an I2C block read +- vsock/virtio: flush works in dependency order +- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex +- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() +- wifi: rtl818x: initialize eeprom_93cx6 struct to zero +- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() +- i3c: master: svc: bound IBI payload to the requested max_payload_len +- i3c: master: Fix info leak and UAF in device unregister path +- dm-switch: use WRITE_ONCE() in switch_region_table_write() +- dm-stats: fix a crash if allocation of per-cpu data fails +- arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() +- x86/tdx: Fix zero-extension for 32-bit port I/O +- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip +- cgroup/cpuset: Fix misplaced DL migration reset +- ALSA: virmidi: Check card index validity at probe +- ALSA: serial-u16550: Check card index validity at probe +- ALSA: portman2x4: Check card index validity at probe +- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ +- ALSA: mts64: Check card index validity at probe +- ALSA: mpu401: Check card index validity at probe +- ub: udma: changes the lock_buffer_jetty solution +- arm64: kprobes: Disable NMIs +- arm64: suspend: Always initialise PSTATE.ALLINT +- arm64: hibernate: mask DAIF before restoring hibernated kernel +- ALSA: aloop: Check card index validity at probe +- ALSA: 6fire: bound the MIDI event length from the device +- net: fix spurious TX timeout after dev_activate() +- net/smc: unregister the connection before draining the rx tasklet +- net/smc: fix use-after-free in smc_rx_pipe_buf_release() +- net/smc: fix socket refcount leak in smc_switch_conns() +- net: ntb_netdev: Count packets dropped on RX refill failure +- net: ntb_netdev: Avoid double-accounting netif_rx() drops +- NTB: ntb_transport: Reject oversized TX buffers +- NTB: ntb_transport: Fail TX enqueue when the QP link is down +- NTB: ntb_transport: Recycle TX entries before client callbacks +- net: ravb: avoid dereferencing an invalid PTP clock +- net: openvswitch: fix nf_connlabels leak in ovs_ct_init +- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition +- slip: fix use-after-free in sl_sync() +- net/iucv: filter frames in afiucv_hs_rcv() by ingress device +- ipmi: ipmb: validate write message length +- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() +- platform/x86: hp-bioscfg: warn on element type mismatch instead of failing +- platform/x86: hp-bioscfg: pass validated element count to package parsers +- platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed +- platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() +- platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password +- platform/x86: hp-bioscfg: fix heap OOB read on empty password write +- platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() +- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count +- platform/x86: hp-bioscfg: advance elem past consumed array elements +- platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS +- platform/chrome: sensorhub: Bound the EC-reported sensor number +- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path +- platform/x86: ISST: Validate logical CPU id and clos id +- platform/x86: ISST: Validate socket ID in clos_assoc ioctl +- platform/x86: ISST: Validate level in perf mask ioctls +- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer +- iommu/vt-d: Force requesting ACS when tboot is enabled +- iommu/vt-d: Fix no_iommu to disable platform opt-in +- PCI/proc: Warn on writes to kernel-exclusive config space regions +- PCI/proc: Use file_ns_capable() when checking config space read access +- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses +- PCI/MSI: Enable memory decoding before restoring MSI-X messages +- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses +- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] +- PCI: meson: Fix GPIO state while requesting PERST# +- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk +- s390/dasd: Propagate partial completion length across ERP recovery +- s390/dasd: Guard sysfs discipline callbacks against unallocated private data +- s390/dasd: Do not complete a failed ESE read as successful +- s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks +- power: supply: max17040: synchronize work cancellation on suspend +- power: supply: max17040: drop incorrect I2C functionality check +- power: supply: ucs1002: fix use-after-free on remove +- power: supply: twl4030_charger: cancel workers via devm +- power: supply: rt9455: quiesce delayed work before teardown +- power: supply: qcom_battmgr: terminate the strings from firmware +- power: supply: lp8727: fix use-after-free in lp8727_release_irq() +- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS +- power: supply: cros_usbpd-charger: bound the EC-reported port count +- power: supply: bq25890: Fix power_supply reference leak +- power: supply: bq256xx: drain usb_work before freeing the charger +- power: supply: bq24257: fix use-after-free on remove +- sctp: fix stream->outcnt underflow on duplicate RECONF responses +- sctp: distinguish sequence zero from wildcard in reconf lookup +- nvme-pci: disable controller on admin queue IRQ setup failure +- nvme: zero the discard fallback page +- nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path +- hwmon: (max6621) fix temperature clamp range +- hwmon: (max6621) fix negative temperature offset and crit readings +- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC +- arm64: compat: Fix decrementing LDM/STM alignment emulation +- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion +- openrisc: fix arbitrary kernel memory access via or1k_atomic syscall +- ocfs2: fix readdir position truncation on 32-bit kernels +- ocfs2: cluster: fix o2hb_dependent_users leak on pin failure +- ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item +- ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() +- ocfs2: validate rl_used against rl_count in refcount block validator +- ocfs2: validate lengths in dlm_mig_lockres_handler +- ocfs2: bound namelen in dlm_migrate_request_handler +- ocfs2: always run deallocs on copy-on-write completion +- orangefs: skip leading spaces before parsing client debug masks +- orangefs: fix double-free of trailer_buf on readdir copy failure +- regulator: qcom-refgen: correct the regulator type to CURRENT +- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata +- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer +- remoteproc: scp: Fix device reference leak on failed lookup +- arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio +- arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck +- rpmsg: glink: smem: order FIFO read after availability check +- staging: media: tegra-video: vi: fix probe failure on skipped last port +- staging: media: tegra-video: fix of_node_put() on VIP parse errors +- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets +- SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat +- SUNRPC: svcauth_gss: enforce krb5 token minimum length +- SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry +- nouveau/gem: reserve the bo in the info ioctl around the vma lookup +- mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction +- mailbox: qcom-ipcc: fix duplicate channel allocation across holes +- ipv6: use RCU iterator to dump route exceptions +- kasan: fix cache shrink race with CPU hotplug +- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request +- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative +- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative +- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection +- Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb +- Bluetooth: hci_conn: re-enable advertising only for peripheral role +- Bluetooth: RFCOMM: serialize security confirmation handling +- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() +- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative +- cxl/pmem: Format the nvdimm serial number as unsigned decimal +- cpufreq: schedutil: Fix rate limit overflow +- dm array: reject an array block whose value size is not the caller's +- bnx2x: fix double free in bnx2x_init_firmware() error path +- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU +- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU +- block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() +- auxdisplay: charlcd: cancel backlight work on registration failure +- ARM: 9477/1: Disable broken eBPF JIT on the Risc PC +- alpha: marvel: Fix lock ordering in init_io7_irqs() +- alpha: marvel: Fix irq_set_status_flags to use correct IRQ number +- alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() +- ACPI: pfr_update: fix stack buffer overflow in query_capability() +- hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device +- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration +- forcedeth: fix off-by-one when saving/restoring non-PCI config space +- fbdev: uvesafb: unregister connector callback on init failure +- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer +- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display +- fat: restore original value when fat_ent_write failed +- ecryptfs: show filename encryption options +- ecryptfs: release message context on send failure +- ecryptfs: reject too-small tag 70 packets +- ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet +- ecryptfs: pass packet set buffer size to parser +- ecryptfs: hold msg ctx list lock when cleaning daemon queue +- ecryptfs: fix tag 11 packet exact-fit size check +- eCryptfs: bound the packet-length peek to the user buffer +- fs/ntfs3: bound page_lcns[] index by the log record +- fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() +- fs/ntfs3: validate dirty page table on log replay +- HID: mcp2221: validate report size in mcp2221_raw_event() +- HID: mcp2221: stop device IO before hid_hw_stop +- HID: roccat: free buffered reports when destroying device +- HID: picolcd: clamp eeprom debugfs read to bytes actually received +- smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV +- nfsd: reject reclaim LOCK after RECLAIM_COMPLETE +- nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE +- nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo +- nfsd: fix version mismatch loops in nfsd_acl_init_request() +- nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref +- nfsd: add filehandle match check to nfsd4_delegreturn() +- nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() +- nfsd: sample writeback error cursor before async COPY loop +- nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types +- nfsd: Reset write verifier when async COPY writeback fails +- nfsd: release path refs on follow_down() error +- NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock +- NFSD: Fix off-by-one in DRC bucket pruning limit +- NFSD: Encode only the status in NFS-ACL v2 GETACL error replies +- ubifs: fix out-of-bounds read in signature length check +- of: fix out-of-bounds read in of_alias_scan() stem parser +- nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation +- media: vicodec: fix out-of-bounds write in FWHT encoder +- media: cec: stm32: prevent out-of-bounds write on RX overflow +- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write +- usb: gadget: f_fs: Prevent deadlock during ep0 read loop +- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() +- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() +- usb: gadget: midi2: remove default configfs groups on teardown +- usb: gadget: snps_udc_plat: clean up PHY on probe deferral +- usb: gadget: u_audio: Fix use-after-free on sound card disconnect +- USB: phy: fsl-usb: fix missing static keywords +- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up +- staging: greybus: hid: fix SET_REPORT return value +- rapidio: mport_cdev: fix use-after-free in dma_req_free() +- powerpc/powermac: fix OF node refcount +- device property: fix infinite loop in fwnode_for_each_child_node() +- tracing/user_events: Clear copied tracing state before fork duplication +- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() +- x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() +- x86/tdx: Fix off-by-one in port I/O handling +- tools/compiler: match glibc 2.42 definition of __attribute_const__ +- mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() +- include/linux/list.h: mark list_add and __list_add as __always_inline +- powerpc/pseries/iommu: switch to Default DMA window during kdump +- clocksource/drivers/timer-sun4i: Advertise a real minimum delta +- alpha: don't leak hardware-fabricated FP exception bits to user space +- alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally +- ALSA: aloop: Fix peer runtime UAF during format-change stop +- Revert "arm64: mm: Don't remap pgtables for allocate vs populate" +- bpf: Reject dev-bound-only programs on other devices +- svcrdma: Use svc_xprt_put to free listener on create failure +- tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() +- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS +- netfilter: nft_nat: fully initialise new_addr in netmap setup +- tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). +- ipv6: xfrm: use full sockets in local error paths +- net: txgbe: fix not sync uc address for macvlan +- net: txgbe: fix lldp change failed with old firmware +- net: txgbe: fix pcie pending bit with aux power after reboot +- net: txgbe: fix XDP_TX calltrace due to xdp.frame_sz and offset calculation +- net: txgbe: fix mac setup_link init and Huawei optical module identification +- net: txgbe: use napi_complete_done() +- net: txgbe: fix kernel panic when shrinking MTU with SR-IOV enabled +- net: txgbe: fix qsfp module i2c access and 25G dac tx ffe settings +- net: txgbe: add page-pool private flag to control rx buffer mode +- net: txgbe: fix swfw_mask init and move configure defaults to txgbe_osdep.h +- net: txgbe: fix LRO panic on systems with >4K page sizes +- net: txgbe: fix XDP memleak, link setup, ethtool and laser control +- net: txgbe: various fixes for VF, backplane AN, FEC and debug +- net: txgbe: support rx build_skb in pagepool mode +- net: txgbe: fix set fec param flow +- net: txgbe: fix phy init and adapt XDP for kernel 6.0 +- net: txgbe: fix ffe rewrite and hw control timing +- net: txgbe: fix aer recovery and improve pcie recovery strategy +- net: txgbe: add support for page pool +- net: txgbe: fix vf spoof check and irq clear in legacy mode +- net: txgbe: fix ethtool set link ksetting and lldp flag +- net: txgbe: fix autoneg status and ethtool advertised speed +- net: txgbe: only show autoneg info when link up and fix vfta +- net: txgbe: fix rate limiting accuracy for SP and AML NICs +- net: txgbe: add storm control support and fix rx statistics +- net: txgbe: add SW_CTRL_EPHY_FORCE and fix e56 phy config +- net: txgbe: add oem ephy config support and fix ethtool fec +- net: txgbe: refactor reset flow and update ethtool ksetting api +- net: txgbe: clean up reset flow and remove pre-production checks +- net: txgbe: modified pci quirks set in probe and fix lldp cmd +- net: txgbe: fix vlan parsing when xmit and triple vlan support +- net: txgbe: fix vf xcast vlan and sriov related issues +- net: txgbe: aml support get_module_eeprom_by_page +- net: txgbe: fix some compile warnings and errors +- net: txgbe: fix when lldp is on tx_unidir_mode can not close +- net: txgbe: aml add fw control phy flow support +- net: txgbe: support RX-ALL feature flag +- net: txgbe: add support for 25G OCP LED +- net: txgbe: support FDIR flex bytes +- net: txgbe: move init flow to get invariants +- net: txgbe: add VF request FDIR filter support +- net: txgbe: fix calltrace when rmmod txgbe without rmmod txgbevf +- net: txgbe: remove some defined but not used functions +- net: txgbe: refactor hardware ops +- net: txgbe: refactor code +- net: txgbe: fix support dac cable without AN73 +- net: txgbe: move backplane api to bp_base +- net: txgbe: fix to toggle UDP RSS in VT mode +- net: txgbe: add support for 100G modules +- net: txgbe: fix can't read rx_pb_n_pxoff rx_pb_n_pxon in amlite +- net: txgbe: fix link up was still reported after the high-tempe alarm +- net: txgbe: add support flow control xon for amlite +- nfs/enfs: test recovered path state transitions +- nfs/enfs: keep recovered path normal below reconnect limit +- bpf: reject BPF_PSEUDO_FUNC reference to the main program +- bonding: do not clear curr_active_slave prematurely when releasing all slaves +- bpf: Mark NULL kptr stores precise +- bpf: Preserve inner map identity in callback frames +- netfilter: nfnetlink_log: cope with concurrent instance destruction +- tracing: Fix memory corruption from the histogram stacktrace modifier +- tracing: Free histogram the var ref when its initialization fails +- tracing: Keep the entry count when the histogram stats allocation fails +- ipv6: addrconf: fix temp address generation after prefix deprecation +- bpf: NUL-terminate replaced sysctl value +- i2c: mux: Fix channel node leak on adapter add failure +- arm64: cpufeature: Add SYSINSTR128 (128-bit System instructions) detection +- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock +- arm64: sysreg: Update ID_AA64MMFR4_EL1 description +- arm64: cpufeatures: Add missing ID_AA64MMFR4_EL1 to __read_sysreg_by_encoding() +- arm64: sysreg: Add layout for ID_AA64MMFR4_EL1 +- arm64: cpufeature: Add ID_AA64MMFR4_EL1 handling +- perf/x86: Optimize ACR handling in match_prev_assignment() +- perf/x86/intel: Fix intel_cap handling on hybrid PMUs +- perf/x86: Remove stale fixed counter helper and fix hybrid PMU access +- perf/x86/intel: Unwind cpuc state if PEBS buffer setup fails +- perf/x86: Guard intel_pmu_cpu_dead() against invalid hybrid PMU casts +- perf/x86: Free hybrid state on PMU init failure +- perf/x86: Unregister PMI handler on PMU init failure +- perf/core: Check kernel access when kernel callchains are requested +- perf/core: Fix kernel register info leak via hardware skid +- perf/x86/intel: Drop fixed-counter PEBS constraints for baseline PEBS +- perf/x86/intel: Validate the return value of intel_pmu_init_hybrid() +- perf/x86/intel: Fallback to sw branch type decoding if no hw decoding +- perf/x86/intel: Keep cap_user_rdpmc in sync with RDPMC user-disable state +- perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities +- perf/core: Correct perf sampling with guest VMs +- perf/x86: Refactor misc flag assignments +- perf/powerpc: Use perf_arch_instruction_pointer() +- perf/core: Hoist perf_instruction_pointer() and perf_misc_flags() +- perf/arm: Drop unused functions +- drm-engiant: optimize driver code +- sunrpc: xprtrdma: Use ERR_CAST() to return +- svcrdma: Refactor the creation of listener CMA ID +- svcrdma: Add lockdep class keys for transport locks + +* Sun Oct 11 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-176.0.0.156.20261011.fbe8a0a46ab0 +- !29180 [CVEAgent@OLK-6.6] Fix CVE-2026-90073 +- !29237 [CVEAgent@OLK-6.6] Fix CVE-2026-93824 +- !29300 [CVEAgent@OLK-6.6] Fix CVE-2026-97568 +- !29277 [CVEAgent@OLK-6.6] Fix CVE-2026-97524 +- !29385 [CVEAgent@OLK-6.6] Fix CVE-2026-98078 +- !29245 [CVEAgent@OLK-6.6] Fix CVE-2026-97417 +- !29392 [CVEAgent@OLK-6.6] Fix CVE-2026-98095 +- !29205 [CVEAgent@OLK-6.6] Fix CVE-2026-93207 +- !29400 [CVEAgent@OLK-6.6] Fix CVE-2026-98104 +- !29376 [CVEAgent@OLK-6.6] Fix CVE-2026-98047 +- !29398 [CVEAgent@OLK-6.6] Fix CVE-2026-98102 +- !29174 [CVEAgent@OLK-6.6] Fix CVE-2026-90053 +- !29391 [CVEAgent@OLK-6.6] Fix CVE-2026-98089 +- !29179 [CVEAgent@OLK-6.6] Fix CVE-2026-90072 +- !29393 [CVEAgent@OLK-6.6] Fix CVE-2026-98096 +- !29379 [CVEAgent@OLK-6.6] Fix CVE-2026-98063 +- !29380 [CVEAgent@OLK-6.6] Fix CVE-2026-98064 +- !29389 [CVEAgent@OLK-6.6] Fix CVE-2026-98085 +- !29373 [CVEAgent@OLK-6.6] Fix CVE-2026-98041 +- !29175 [CVEAgent@OLK-6.6] Fix CVE-2026-90058 +- !29375 [CVEAgent@OLK-6.6] Fix CVE-2026-98046 +- !29582 [CVEAgent@OLK-6.6] Fix CVE-2026-98362 +- !29550 [CVEAgent@OLK-6.6] Fix CVE-2026-98273 +- !29538 [CVEAgent@OLK-6.6] Fix CVE-2026-98249 +- !28188 [CVEAgent@OLK-6.6] Fix CVE-2026-90336 +- !29167 [CVEAgent@OLK-6.6] Fix CVE-2026-68185 +- !29203 [CVEAgent@OLK-6.6] Fix CVE-2026-90208 +- !29212 [CVEAgent@OLK-6.6] Fix CVE-2026-93237 +- !29218 [CVEAgent@OLK-6.6] Fix CVE-2026-93251 +- !29220 [CVEAgent@OLK-6.6] Fix CVE-2026-93256 +- !29249 [CVEAgent@OLK-6.6] Fix CVE-2026-97430 +- !29251 [CVEAgent@OLK-6.6] Fix CVE-2026-97444 +- !29252 [CVEAgent@OLK-6.6] Fix CVE-2026-97445 +- !29260 [CVEAgent@OLK-6.6] Fix CVE-2026-97454 +- !29253 [CVEAgent@OLK-6.6] Fix CVE-2026-97446 +- !29261 [CVEAgent@OLK-6.6] Fix CVE-2026-97455 +- !29254 [CVEAgent@OLK-6.6] Fix CVE-2026-97448 +- !29255 [CVEAgent@OLK-6.6] Fix CVE-2026-97449 +- !29256 [CVEAgent@OLK-6.6] Fix CVE-2026-97450 +- !29257 [CVEAgent@OLK-6.6] Fix CVE-2026-97451 +- !29258 [CVEAgent@OLK-6.6] Fix CVE-2026-97452 +- !29259 [CVEAgent@OLK-6.6] Fix CVE-2026-97453 +- !29268 [CVEAgent@OLK-6.6] Fix CVE-2026-97483 +- !29269 [CVEAgent@OLK-6.6] Fix CVE-2026-97490 +- !29271 [CVEAgent@OLK-6.6] Fix CVE-2026-97503 +- !29318 [CVEAgent@OLK-6.6] Fix CVE-2026-97905 +- !29319 [CVEAgent@OLK-6.6] Fix CVE-2026-97906 +- !29326 [CVEAgent@OLK-6.6] Fix CVE-2026-97925 +- !29386 [CVEAgent@OLK-6.6] Fix CVE-2026-98081 +- !29387 [CVEAgent@OLK-6.6] Fix CVE-2026-98082 +- !29415 [CVEAgent@OLK-6.6] Fix CVE-2026-100072 +- !29417 [CVEAgent@OLK-6.6] Fix CVE-2026-100079 +- !29317 [CVEAgent@OLK-6.6] Fix CVE-2026-97904 +- clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate +- x86/kprobes: Fix crash when probing CS CALL instructions +- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc +- usb: typec: ucsi: unregister debugfs entries on teardown +- ACPI: platform: Use acpi_bus_get_primary_device() +- ACPI: bus: Introduce acpi_bus_get_primary_device() +- net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted +- ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() +- ipv6: sr: restore network header before routing and forwarding +- af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). +- bonding: alb: fix uninitialized transport header access in alb_determine_nd() +- bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge +- btrfs: fix the possible bioc_list memory leak during error +- btrfs: zoned: finish active block group cleanup if call_zone_finish() fails +- ipvs: fix reversed sequence option serialization +- bpf: Fix NULL-ptr-deref when showing a void BTF type +- bpf: Fix NULL-ptr-deref in btf_var_show() +- bpf: Check ancestor frames for rbtree callbacks +- bpf: Mark bpf_btf_find_by_name_kind() as sleepable +- bpf: Don't predict JMP32 pointer vs zero comparisons +- tick/broadcast: Plug clockevents replacement race +- bootconfig: Fix integer overflow in initrd size check +- cpufreq: zero-initialize policy cpumask before sysfs publication +- cpufreq: initialize policy rwsem before sysfs publication +- mptcp: syncookies: remember the request backup flag +- mptcp: avoid unneeded actions on subflow reset +- genirq/proc: Size interrupt directory names for 10-digit interrupt numbers +- affs: handle set_blocksize failures +- usb: core: hcd: fix possible deadlock in rh control transfers +- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() +- ACPICA: add boundary checks in acpi_ps_get_next_field() +- ACPICA: validate byte_count in acpi_ps_get_next_package_length() +- ACPICA: Prevent adding invalid references +- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) +- ACPICA: validate handler object type in two places +- ACPICA: Add package limit checks in parser functions +- ACPICA: Add validation for node in acpi_ns_build_normalized_path() +- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() +- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() +- ACPICA: add boundary checks in two places +- xhci: Prevent queuing new commands if xhci is inaccessible +- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() +- tls: reject the combination of TLS and sockmap +- arm64: hibernate: mask DAIF before restoring hibernated kernel +- ACPI: bus: Introduce acpi_bus_get_primary_device() +- LoongArch: Add DIRECT_MAP_PHYSMEM_END definition +- SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry +- clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type +- net/sched: hhf: clamp quantum before hhf_change() to avoid overflow +- net/sched: sfq: clamp quantum to avoid signed overflow soft lockup +- net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup +- net/sched: sch_htb: limit htb_classify inner-class filter hops +- LoongArch: Move jump_label_init() before parse_early_param() +- serial: core: clear freed pointers on uart_register_driver() failure + +* Sat Oct 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-176.0.0.156.20261010.632302ede40e +- !29447 nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE +- !29444 nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo +- !29340 [CVEAgent@OLK-6.6] Fix CVE-2026-97961 +- !29150 bpf: Reject bpf_obj_drop() from tracing progs +- !29329 [CVEAgent@OLK-6.6] Fix CVE-2026-97935 +- !29324 [CVEAgent@OLK-6.6] Fix CVE-2026-97922 +- !29323 [CVEAgent@OLK-6.6] Fix CVE-2026-97921 +- !29321 [CVEAgent@OLK-6.6] Fix CVE-2026-97918 +- !29236 [CVEAgent@OLK-6.6] Fix CVE-2026-93817 +- !28207 [CVEAgent@OLK-6.6] Fix CVE-2026-90364 +- !28100 [CVEAgent@OLK-6.6] Fix CVE-2026-89722 +- !27117 obmm: free region memory in the device release callback +- !29504 [CVEAgent@OLK-6.6] Fix CVE-2026-92511 +- !29503 [CVEAgent@OLK-6.6] Fix CVE-2026-92507 +- !29193 [CVEAgent@OLK-6.6] Fix CVE-2026-90139 +- !28218 [CVEAgent@OLK-6.6] Fix CVE-2026-90397 +- !28269 [CVEAgent@OLK-6.6] Fix CVE-2026-93056 +- !27808 [CVEAgent@OLK-6.6] Fix CVE-2025-23135 +- RDMA/core: Fix potential use after free in ib_destroy_cq_user() +- !29436 mm: memcg: stop reclaim when a limit update is superseded +- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() +- !28149 [CVEAgent@OLK-6.6] Fix CVE-2026-90234 +- !29446 CVE-2026-90148 +- !29445 CVE-2026-90140 +- nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE +- NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() +- cuse: wait for pending RCU callbacks on module exit +- nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo +- mm: memcg: stop reclaim when a limit update is superseded +- perf/core: Allow list_del during perf_event_overflow() +- tracing: Set the trace clock before registering the histogram trigger +- tracing: Free histogram var refs regardless of how often they are referenced +- tracing: Free histogram the field rejected for a bad modifier +- tracing: Undo the registration when enabling the histogram trigger fails +- perf: Fix addr_filter_ranges lifetime +- fuse: check for NULL root inode in fuse_fill_super_submount +- bpf: Reject bpf_obj_drop() from tracing progs +- usb: gadget: f_uac1_legacy: remove broken string configfs attributes +- firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published +- ACPI: processor: Unregister cpufreq notifier on init failure +- NFS: Return a delegation the client fails to record +- PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() +- RISC-V: KVM: Teardown riscv specific bits after kvm_exit +- obmm: drop two set-but-unused variables +- obmm: fix UAF read in deactivate failure log +- obmm: free region memory in the device release callback + +* Fri Oct 09 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-176.0.0.156.20261009.118822b459c8 +- !29432 drm/amd/display: avoid divide-by-zero in __is_lut_linear() +- !29154 drivers/ub/sentry: fix heap overflow and truncation in format_client_info_show_str +- !29442 ftrace: Synchronize the initialization of ftrace_ops +- !28061 [CVEAgent@OLK-6.6] Fix CVE-2026-89626 +- !28228 [CVEAgent@OLK-6.6] Fix CVE-2026-90435 +- !28240 [CVEAgent@OLK-6.6] Fix CVE-2026-92508 +- !28241 [CVEAgent@OLK-6.6] Fix CVE-2026-92509 +- !28092 [CVEAgent@OLK-6.6] Fix CVE-2026-89708 +- !29170 [CVEAgent@OLK-6.6] Fix CVE-2026-89995 +- !29461 net/hinic5:Fix incorrect version in the sdk +- !29141 Backport AMD Zen 6 core event table fixes to openEuler OLK-6.6 +- net/hinic5:Fix incorrect version in the sdk +- !29424 tracing: Fix hist trigger timestamps for buffered events +- !28601 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers +- !29157 Backport tracing mainline patches +- !29423 ub:ubus: add port reset handler +- ftrace: Synchronize the initialization of ftrace_ops +- !28271 [CVEAgent@OLK-6.6] Fix CVE-2026-93073 +- !27958 [CVEAgent@OLK-6.6] Fix CVE-2026-89477 +- !28094 [CVEAgent@OLK-6.6] Fix CVE-2026-89710 +- !28508 Fix CVE-2026-90146 +- ub:ubus: add port reset handler +- !28125 [CVEAgent@OLK-6.6] Fix CVE-2026-89823 +- !28121 [CVEAgent@OLK-6.6] Fix CVE-2026-89801 +- drm/amd/display: avoid divide-by-zero in __is_lut_linear() +- tracing: Fix hist trigger timestamps for buffered events +- drivers/ub/sentry: fix heap overflow and truncation in format_client_info_show_str +- dma-direct: return struct page from dma_direct_alloc_from_pool() +- tracing: tracing: Fix KABI breakage from trace_options nr_topts field +- tracing: Take trace_array reference when opening a tracer options file +- perf vendor events amd: Update Zen 6 core events +- scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers +- bpf, xdp: move offload check into dev_xdp_install() +- dax: read holder_ops once in dax_holder_notify_failure() +- RDMA/core: Fix potential use after free in counter_release() +- RDMA/core: Fix potential use after free in ib_free_cq() +- RDMA/mlx5: Fix integer overflow of user QP buffer size +- drm: fix race between partial drm_dev_register() failure and ioctl +- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE +- NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path +- nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown +- HID: sensor: custom: Fix field sysfs group cleanup on failure +- sctp: fix NULL deref on untransmitted RECONF completion + +* Thu Oct 08 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-176.0.0.156.20261008.5cd3e2469c12 +- !28570 Fix CVE-2026-89861 +- !28761 bpf backport +- !28571 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers +- !29422 nfsd: fix redeclaration of 'clp' in nfs4_laundromat() +- nfsd: fix redeclaration of 'clp' in nfs4_laundromat() +- !28189 [CVEAgent@OLK-6.6] Fix CVE-2026-90337 +- !28661 mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish +- !27920 [CVEAgent@OLK-6.6] Fix CVE-2026-80866 +- !27923 [OLK-6.6] Fix CVE-2026-80925 +- !27921 [OLK-6.6] Fix CVE-2026-80905 +- !27915 [OLK-6.6] Fix CVE-2026-80847 +- !27912 [OLK-6.6] Fix CVE-2026-80837 +- !27914 [OLK-6.6] Fix CVE-2026-80841 +- !27759 [OLK-6.6] Fix CVE-2026-68245 +- !27422 [OLK-6.6] Fix CVE-2025-37833 +- !28072 [OLK-6.6] Fix CVE-2026-89666 +- !27535 kallsyms: prevent module removal when printing module name and buildid +- !28574 tracing: Fix memory corruption from a "STACKTRACE" histogram key +- !28885 ipvs: fix integer overflow in ftp helper port/address parsing +- !28881 net: bridge: Reject descending VLAN tunnel ranges +- !28878 ip6mr: do not clone dst in ip6mr_cache_report() +- !28900 inetpeer: randomize RB-tree node comparison using SipHash +- !28875 vxlan: fix reading neigh ha +- !28872 tcp: fix corruption of urgent data on multi-segment retransmit +- !28071 [OLK-6.6] Fix CVE-2026-89663 +- !28783 ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() +- !28073 [OLK-6.6] Fix CVE-2026-89669 +- !27875 Fix CVE-2026-89756 +- !28088 [OLK-6.6] Fix CVE-2026-89702 +- !28746 Fix CVE-2026-92506 +- !28422 Fix CVE-2026-89763 +- !28869 eventpoll: use spinlock under CONFIG_PREEMPT_RT, rwlock otherwise +- !28080 [OLK-6.6] Fix CVE-2026-89682 +- !28187 [OLK-6.6] Fix CVE-2026-90335 +- !28087 [OLK-6.6] Fix CVE-2026-89699 +- !28045 [OLK-6.6] Fix CVE-2026-89555 +- !28795 *** CVE-2026-68081 *** +- !28784 cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 +- !28054 [OLK-6.6] Fix CVE-2026-89567 +- !28773 udf: reject VAT indexes equal to the entry count +- !28150 [OLK-6.6] Fix CVE-2026-90235 +- !28723 Fix CVE-2026-90160 +- !28729 Fix CVE-2026-90062 +- !27950 [OLK-6.6] Fix CVE-2026-81005 +- !27952 [OLK-6.6] Fix CVE-2026-89440 +- !27953 [OLK-6.6] Fix CVE-2026-89441 +- !28014 [OLK-6.6] Fix CVE-2026-89488 +- !28017 [OLK-6.6] Fix CVE-2026-89511 +- !28046 [OLK-6.6] Fix CVE-2026-89559 +- !28069 [OLK-6.6] Fix CVE-2026-89659 +- !28070 [OLK-6.6] Fix CVE-2026-89662 +- !28285 [OLK-6.6] Fix CVE-2026-93150 +- !28289 [OLK-6.6] Fix CVE-2026-93172 +- inetpeer: randomize RB-tree node comparison using SipHash +- ipvs: fix integer overflow in ftp helper port/address parsing +- net: bridge: Reject descending VLAN tunnel ranges +- ip6mr: do not clone dst in ip6mr_cache_report() +- vxlan: fix reading neigh ha +- tcp: fix corruption of urgent data on multi-segment retransmit +- eventpoll: use spinlock under CONFIG_PREEMPT_RT, rwlock otherwise +- Revert "eventpoll: Replace rwlock with spinlock" +- !28500 net: bridge: arp/nd proxy: fix reading neigh ha +- !28230 [OLK-6.6] Fix CVE-2026-92489 +- !28785 drivers/ub/sentry: add missing NULL checks before pointer dereferences +- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state +- KVM: nVMX: Add helper to put (unmap) vmcs12 pages +- !28616 KVM: SVM: CSV: Fix CPU hang by reordering 1G hugepage release in vm_destroy +- !28779 Fix CVE-2026-93145 +- !28778 Fix CVE-2026-93120 +- !28772 Fix CVE-2026-89857 +- drivers/ub/sentry: add missing NULL checks before pointer dereferences +- cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 +- ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() +- !28766 Fix CVE-2026-89851 +- !28771 rtc: pcf8563: fix clock provider leak on unbind +- !28751 nfsd: gate nfs2 setacl by argp->mask +- !28749 ubi: Fix rollback for explicit UBI device numbers +- clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() +- usb: gadget: configfs: fix out-of-bounds read of qw_sign +- !28739 Fix CVE-2026-89912 +- udf: reject VAT indexes equal to the entry count +- scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject +- rtc: pcf8563: fix clock provider leak on unbind +- !28018 [OLK-6.6] Fix CVE-2026-89515 +- !28140 [OLK-6.6] Fix CVE-2026-89858 +- !28757 usb: storage: realtek_cr: fix use-after-free on disconnect +- !28754 usb: image: mdc800: change kmalloc() to kzalloc() +- !28759 usb: typec: ucsi: displayport: Fix OOB altmode array index +- scsi: qla2xxx: Fix FCE trace enable parsing in debugfs +- !28758 scsi: qla2xxx: Quiesce response IRQ before freeing request queue +- !28756 usb-storage: ene_ub6250: fix race between scan work and probe +- !28131 [OLK-6.6] Fix CVE-2026-89849 +- !28750 ACPI: processor: Unregister cpufreq notifier on init failure +- !28136 [OLK-6.6] Fix CVE-2026-89854 +- !28701 apparmor: fix deadlock in complain-mode change_hat +- !28074 [OLK-6.6] Fix CVE-2026-89671 +- selftests/bpf: Add tests for fault prone loads out of RCU pointers +- bpf: Rewrite any fault prone load out of a mem or btf_id pointer +- usb: typec: ucsi: displayport: Fix OOB altmode array index +- scsi: qla2xxx: Quiesce response IRQ before freeing request queue +- usb: storage: realtek_cr: fix use-after-free on disconnect +- usb-storage: ene_ub6250: fix race between scan work and probe +- usb: image: mdc800: change kmalloc() to kzalloc() +- !28191 [OLK-6.6] Fix CVE-2026-90358 +- nfsd: gate nfs2 setacl by argp->mask +- !28735 Fix CVE-2026-93084 +- !28737 Fix CVE-2026-93086 +- ACPI: processor: Unregister cpufreq notifier on init failure +- !28730 Fix CVE-2026-90161 +- !28734 Fix CVE-2026-93081 +- !28736 Fix CVE-2026-93085 +- ubi: Fix rollback for explicit UBI device numbers +- !28732 Fix CVE-2026-90263 +- firmware: arm_scmi: Fix requested device removal race +- !28731 arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry +- !28116 [OLK-6.6] Fix CVE-2026-89786 +- !28238 [OLK-6.6] Fix CVE-2026-92504 +- !28260 [OLK-6.6] Fix CVE-2026-92524 +- !28114 [OLK-6.6] Fix CVE-2026-89778 +- !28028 [OLK-6.6] Fix CVE-2026-89537 +- !28186 [OLK-6.6] Fix CVE-2026-90334 +- !28075 [OLK-6.6] Fix CVE-2026-89674 +- !28053 [OLK-6.6] Fix CVE-2026-89566 +- !28287 [OLK-6.6] Fix CVE-2026-93161 +- !28265 [OLK-6.6] Fix CVE-2026-93048 +- !28615 CVE-2026-89713 +- !28720 io_uring: defer eventfd signaling when queued from a wakeup handler +- !28598 fs: fix user path of nested backing files +- KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save +- !27911 [OLK-6.6] Fix CVE-2026-80836 +- firmware: arm_scmi: Avoid IDR updates while cleaning channels +- firmware: arm_scmi: Reject out of range DT protocol IDs +- firmware: arm_scmi: Drop handle on protocol bind failures +- firmware: arm_scmi: Fix SCMI device destroy lifetimes +- btrfs: check if root is readonly when setting posix acl +- arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry +- erofs: fix interlaced ztailpacking pclusters +- !28691 Fix CVE-2026-89711 +- netfilter: nf_tables: move hardware offload step after building the chain blob +- !28708 Fix CVE-2026-89932 +- !28166 [OLK-6.6] Fix CVE-2026-90290 +- !28702 Fix CVE-2026-90040 +- !28059 [OLK-6.6] Fix CVE-2026-89588 +- !28250 [OLK-6.6] Fix CVE-2026-92522 +- !27494 v2 md/raid1,raid10: fix bio accounting for split md cloned bios +- !28705 Fix CVE-2026-89930 +- lwt_bpf: Restore reserved headroom after xmit program +- io_uring: defer eventfd signaling when queued from a wakeup handler +- !28703 Fix CVE-2026-89927 +- !28707 Fix CVE-2026-89931 +- !28558 nvme-fabrics: fix DHCHAP secret leak on parse failure +- !28523 nvme-tcp: check the data direction of a C2HData PDU +- !28007 [OLK-6.6] Fix CVE-2026-89480 +- !28008 [OLK-6.6] Fix CVE-2026-89481 +- !28681 md/raid5: round bitmap stripes with sector division +- KVM: SVM: CSV: Fix CPU hang by reordering 1G hugepage release in vm_destroy +- !28680 mtd: rawnand: validate ONFI extended parameter page sections +- !28677 nvdimm/btt: reject an arena whose nfree is below the lane count +- KVM: nVMX: Always flush vpid02 on first use +- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit +- !28051 [OLK-6.6] Fix CVE-2026-89564 +- KVM: nVMX: Service local TLB flushes on failed nested VM-Enter +- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock +- KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped +- !28682 Fix CVE-2026-89676 +- !28501 net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() +- !28498 Fix CVE-2026-90049 +- !28113 [OLK-6.6] Fix CVE-2026-89776 +- apparmor: fix deadlock in complain-mode change_hat +- !28666 Fix CVE-2026-90102 +- !28489 Fix CVE-2026-89878 +- !28693 Fix CVE-2026-93092 +- !28493 Fix CVE-2026-90330 +- !28488 Fix CVE-2026-89879 +- !28453 Fix CVE-2026-89531 +- !28672 Fix CVE-2026-93089 +- !27860 Fix CVE-2026-89638 +- firmware: arm_scmi: Unregister device notifier before IDR teardown +- NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check +- !28669 Fix CVE-2026-90213 +- !28668 Fix CVE-2026-90194 +- !28673 Fix CVE-2026-93090 +- !28671 Fix CVE-2026-90311 +- !28663 Fix CVE-2026-90015 +- !28272 [OLK-6.6] Fix CVE-2026-93091 +- !28600 KVM: SVM: CSV: Flush the cache before memory areas are marked CSV3-isolated +- !28613 KVM: SVM: CSV: Remove non-functional get_user_pages_unlocked() +- !28278 [OLK-6.6] Fix CVE-2026-93117 +- !28135 [OLK-6.6] Fix CVE-2026-89853 +- !27624 KVM: SVM: CSV: Defer SMR memory release until CSV3 VM is decommissioned +- !28138 [OLK-6.6] Fix CVE-2026-89856 +- !28137 [OLK-6.6] Fix CVE-2026-89855 +- !28134 [OLK-6.6] Fix CVE-2026-89852 +- !28132 [OLK-6.6] Fix CVE-2026-89850 +- !28117 [OLK-6.6] Fix CVE-2026-89787 +- !28636 ub: udma: Revise internal review comments. +- !27792 KVM: SVM: CSV: Retry PF from CSV3 guest if GPA is not MMIO +- !27946 [OLK-6.6] Fix CVE-2026-80994 +- !28012 [OLK-6.6] Fix CVE-2026-89485 +- nfsd: fix stale s2s_cp_stateids IDR entry for async COPY +- md/raid5: round bitmap stripes with sector division +- !28288 [OLK-6.6] Fix CVE-2026-93162 +- mtd: rawnand: validate ONFI extended parameter page sections +- nvdimm/btt: reject an arena whose nfree is below the lane count +- firmware: arm_scmi: Clean up channels on setup failure +- firmware: arm_scmi: Free transport channel on IDR failure +- !28652 RDMA/erdma: Hold QP references for AE and CM processing +- thermal: hwmon: Remove hwmon class device along with its parent +- !28099 [OLK-6.6] Fix CVE-2026-89718 +- firewire: core: fix memory leak in error path of build_tree() +- !28543 lockd: fix NULL dereference on lockowner allocation failure +- ACPI: scan: fix bus ID cleanup on device_add() failures +- NFSv4/pnfs: key the data server cache on the NFS version +- xhci: fix lost bounce buffers on TDs spanning several ring segments +- !28657 Fix CVE-2026-80990 +- !27996 Fix CVE-2026-93116 +- mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish +- net: thunderbolt: Release the Rx HopID that was handed out on mismatch +- RDMA/erdma: Hold QP references for AE and CM processing +- ub: udma: Fix Issues Related to ICSL +- KVM: SVM: CSV: Flush the cache before memory areas are marked CSV3-isolated +- NFSD: check truncate permission under inode lock +- nfsd: Pass 'cred' instead of 'rqstp' to some functions. +- KVM: SVM: CSV: Remove non-functional get_user_pages_unlocked() +- KVM: SVM: CSV: Defer SMR memory release until CSV3 VM is decommissioned +- KVM: SVM: CSV: Retry PF from CSV3 guest if GPA is not MMIO +- fs: fix user path of nested backing files +- tracing: Fix memory corruption from a "STACKTRACE" histogram key +- scsi: qla2xxx: Bound i2c->length in I2C bsg handlers +- scsi: qla2xxx: Drop vport reference under lock in report ID acquisition +- scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() +- nvme-fabrics: fix DHCHAP secret leak on parse failure +- lockd: fix NULL dereference on lockowner allocation failure +- nvme-tcp: check the data direction of a C2HData PDU +- net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() +- net: bridge: arp/nd proxy: fix reading neigh ha +- net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() +- openvswitch: only skb_tx_error() a packet we are about to drop +- HID: logitech-hidpp: Fix FF device cleanup on init failure +- media: s2255: check firmware size before reading trailing marker +- media: s2255: bound JPEG frame size before copying into the buffer +- svcrdma: Reject connection when transport allocation fails +- KEYS: trusted: Fix TPM teardown ordering +- drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() +- mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug +- crypto: qat - cancel work on re-enable SR-IOV timeout +- crypto: qat - clear AES key schedule from stack +- cgroup/cpuset: Make nr_deadline_tasks an atomic_t +- usb: fix UAF when probe runs concurrent to dyn ID removal +- firmware: arm_scmi: Quiesce notifications before teardown +- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() +- irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() +- ACPI: processor: validate MADT IOAPIC entry bounds +- thermal: intel: int3400: clean up ODVP on probe failures +- xfrm: Fix skb double-free in xfrm_dev_direct_output() +- bpf, x86: Fix trampoline stack size for 128-bit arguments +- serial: core: do fallible allocations before the console can be registered +- tty: skip cdev_del() when no cdev is registered +- tty: clear cdev pointer after cdev_add() failure +- arm64: hibernate: Restore DAIF state on error +- sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE +- scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() +- scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation +- scsi: qla2xxx: Serialize flash version read in reset handler +- scsi: qla2xxx: Fix cs84xx use-after-free on host teardown +- scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump +- scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() +- scsi: qla2xxx: Don't query firmware state while chip is down +- scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path +- ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() +- ext4: fix out-of-bounds read in ext4_read_inline_dir() +- isofs: fix out-of-bounds page array access on empty zisofs block +- vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes +- zram: fix out-of-bounds access in writeback_store() +- nfsd: size fh_verify server sockaddr slot by xpt_locallen +- nfsd: validate symlink target length in NFSv4 CREATE +- nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net +- nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget +- nfsd: gate nfs3 setacl by argp->mask +- nfsd: initialize copy-notify stateid before publishing it +- nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops +- nfsd: revoke copy-notify stateids before dropping their reference +- NFSD: Prevent lock owner use-after-free during client teardown +- NFSD: Prevent client use-after-free during delegation revoke +- ACPI: APEI: GHES: fix ARM section length accounting after header +- jbd2: bound shrinker scans by examined checkpoint buffers +- jbd2: check need_resched() when skipping busy checkpoint buffers +- ip: orphan prefetched skbs before multicast forwarding +- libnvdimm/labels: Prevent integer overflow in __nd_label_validate() +- mpls: reload header after pskb_may_pull() +- SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 +- scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() +- qede: Fix NULL pointer dereference in TPA fragment processing +- openvswitch: Fix CT limit teardown use-after-free +- lockd: pin next file across nlm_inspect_file lock-drop +- nvme-tcp: fix host memory disclosure on R2T for a read command +- nvme-tcp: reject a read that transferred too few bytes +- platform/x86: asus-wmi: fix resource leaks on probe failure +- mmc: via-sdmmc: cancel card-detect work on remove +- mmc: via-sdmmc: stop card-detect handling on probe failure +- ipmi: si: Fix NULL pointer dereference after failed registration +- net: openvswitch: fix flow mask use-after-free on flow deletion +- vlan: fix skb_under_panic and races when toggling HW VLAN offload +- net: tap: fix wrong transport_header when sending VLAN-tagged frame +- tipc: avoid busy looping in tipc_exit_net() +- tcp: clamp route advmss to TCP_MIN_MSS +- net/packet: defer vmalloc TX_RING free until skbs finish +- netfilter: nf_tables: don't queue packet path object notifications +- crypto: virtio - bound the akcipher result length +- mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() +- smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions +- kallsyms: prevent module removal when printing module name and buildid +- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads +- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads +- md/raid1,raid10: fix bio accounting for split md cloned bios + +* Fri Sep 25 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-176.0.0.156.20260925.9c770f673dd4 +- !28270 [OLK-6.6] Fix CVE-2026-93058 +- !28653 urma: allow partial segment imports in ubagg +- !28579 Bluetooth: MGMT: free the mesh send cancel command when it is cancelled +- !28581 Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths +- !28599 media: cec: core: Fix kmemleak due to missed rc_free_device() call +- urma: allow partial segment imports in ubagg +- !28491 timers/itimer: Zero-init old itimerval before copy to userspace +- !28620 mm: fix bad page state in remap_try_huge_pmd() on non-empty PMD entry +- mm: fix bad page state in remap_try_huge_pmd() on non-empty PMD entry +- !27935 [OLK-6.6] Fix CVE-2026-80989 +- !28490 Fix CVE-2026-89877 +- !28593 Bluetooth: do not leak an hci_conn when a second LE connect is rejected +- !28594 Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind +- !28592 RDMA/erdma: Hold CQ references when processing EQ events +- media: cec: core: Fix kmemleak due to missed rc_free_device() call +- Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind +- Bluetooth: do not leak an hci_conn when a second LE connect is rejected +- RDMA/erdma: Hold CQ references when processing EQ events +- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths +- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled +- timers/itimer: Zero-init old itimerval before copy to userspace +- media: saa7164: fix cleanup on resource allocation failure +- drm/msm: Only fini scheduler after successful init +- net: thunderbolt: Mark the connection down when bringing it up fails + +* Thu Sep 24 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-176.0.0.156.20260924.97f3dbf79516 +- !28473 nvmet-tcp: reject unsolicited H2CData PDUs +- !27919 [OLK-6.6] Fix CVE-2026-80861 +- !27966 urma: reclaim ipv6 address on ifdown for ipourma +- !28110 [OLK-6.6] Fix CVE-2026-89761 +- !27488 arm_mpam: Introduce Narrow-PARTID feature +- !28591 Fix CVE-2026-90042 OLK-6.6 +- !28596 bpf: Invalidate RCU pointers after final spin unlock +- !28469 nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU +- !27345 urma: fix positive return value in uburma_open +- !28427 Fix CVE-2026-89762 +- urma: reclaim ipv6 address on ifdown for ipourma +- !28585 Fix CVE-2026-90189 +- !27984 Fix CVE-2026-90185 +- !28000 Fix CVE-2026-90187 +- !27983 Fix CVE-2026-90184 +- bpf: Invalidate RCU pointers after final spin unlock +- ceph: properly decrypt filenames in vmalloc() buffers +- ceph: pass fscrypt `tname` buffers directly +- !28587 CVE-2026-90247 +- !28580 Bluetooth: hci_conn: fix the SCO setup context lifetime +- !28584 bpf backport +- bpf: Fix mmap_lock leak in irq_work path +- bpf: Factor out stack_map build ID helpers +- null_blk: register configfs subsystem after creating default devices +- !28192 [OLK-6.6] Fix CVE-2026-90359 +- !27428 KVM: SVM: CSV: Support SET_GUEST_PRIVATE_MEMORY_EX and UPDATE_NPT_EX APIs +- !27054 x86/CPU/AMD: Add additional fixed RDSEED microcode revisions +- !27989 Fix CVE-2026-90190 +- bpf: Reject a store through a fault prone pointer +- bpf: Mark signal tracepoint siginfo arguments as scalar +- bpf: Mark sched_process_wait argument as nullable +- !27798 urma: add EAGAIN when reuse tpid fail +- Bluetooth: hci_conn: fix the SCO setup context lifetime +- !28542 ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters() +- !28549 v5 bpf: Disable preemption in __bpf_get_stack +- !28484 [OLK-6.6] Fix CVE-2026-90387 +- !28539 Fix CVE-2026-90303 +- !28551 Fix CVE-2026-89478 +- !28067 [OLK-6.6] Fix CVE-2026-89656 +- !28467 nvmet-auth: Synchronize timeout work during SQ teardown +- !28476 nvme: add missing SRCU grace period in error path +- !28511 seg6: reset IP6CB after IPv6 decapsulation +- !28066 [OLK-6.6] Fix CVE-2026-89648 +- !28497 89563 +- !28496 Fix CVE-2026-89561 +- !28481 arm64: support BBML2 noabort feature +- sctp: drop a chunk if its transport was removed +- !28065 [OLK-6.6] Fix CVE-2026-89647 +- bpf: Disable preemption in __bpf_get_stack +- !28529 Fix CVE-2026-90097 +- !28528 Fix CVE-2026-89986 +- !28533 Fix CVE-2026-89757 +- !28534 Fix CVE-2026-89731 +- !28482 CVE-2026-80978 +- ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters() +- ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults +- KVM: SVM: CSV: Support SET_GUEST_PRIVATE_MEMORY_EX and UPDATE_NPT_EX APIs +- KVM: X86: Introduce KVM_CAP_EXIT_CSV3_SECURE_CALL and KVM_CAP_HYGON_COCO_EXT_CSV3_NPT_EX +- crypto: ccp: Define CSV3 SET_GUEST_PRIVATE_MEMORY_EX and UPDATE_NPT_EX command ids +- crypto: ccp: Introduce CSV_EXT_CSV3_NPT_EX extension flag +- cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read +- mm/mglru: fix and remove redundant unevictable folio handling +- Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition +- mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() +- seg6: reset IP6CB after IPv6 decapsulation +- ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit +- ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() +- ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() +- ipv6: annotate data-races around devconf->rpl_seg_enabled +- net: cap advertised IP tunnel headroom +- ip6_gre: fix hardware header length for NBMA tunnels +- arm64: cpufeature: add HISI_HIP13 to BBML3 allow list +- arm64: cpufeature: Detect BBML3 based on ID_AA64MMFR2_EL1.BBM +- arm64: cpufeature: Rename BBML2_NOABORT as BBML3 +- arm64: sysreg: Add BBM_3 +- arm64: mm: Handle invalid large leaf mappings correctly +- arm64/mm: Rename pte_mkpresent() as pte_mkvalid() +- arm64/mm: generalize PMD_PRESENT_INVALID for all levels +- arm64: mm: Fix rodata=full block mapping support for realm guests +- arm64: mm: Simplify check in arch_kfence_init_pool() +- arm64/pageattr: Propagate return value from __change_memory_common +- arm64: mm: Tidy up force_pte_mapping() +- arm64: mm: Optimize range_split_to_ptes() +- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context +- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs +- arm64: mm: support large block mapping when rodata=full +- arm64: Enable permission change on arm64 kernel block mappings +- mm/pagewalk: split walk_page_range_novma() into kernel/user parts +- mm: pagewalk: assert write mmap lock only for walking the user page tables +- arm64/mm: Elide tlbi in contpte_convert() under BBML2 +- arm64: Add BBM Level 2 cpu feature +- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type +- arm64: cpufeature: Display the set of cores with a feature +- arm64: Avoid enabling KPTI unnecessarily +- arm64: Split kpti_install_ng_mappings() +- nvme: add missing SRCU grace period in error path +- nvmet-tcp: reject unsolicited H2CData PDUs +- nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU +- nvmet-auth: Synchronize timeout work during SQ teardown +- x86/CPU/AMD: Add additional fixed RDSEED microcode revisions +- apparmor: fix cred UAF caused by begin_current_label_crit_section() +- swiotlb: Preserve allocation virtual address for dynamic pools +- bpf: Reject >8 byte return values on return-reading trampoline paths +- apparmor: fix out-of-bounds write when null terminating a label vec +- libceph: reject buckets with mismatched CRUSH ids +- ceph: cap delegated inode count in ceph_parse_deleg_inos() +- ceph: do not repeat ceph_trim_dentries() if no progress possible +- urma: add EAGAIN when reuse tpid fail +- null_blk: free zones array on device power-off +- null_blk: use DEFINE_MUTEX for the file-scope mutex +- null_blk: serialize configfs attribute stores with the lock +- null_blk: serialize configfs attribute updates with device setup +- usb: xhci: bail out of setup if the controller is inaccessible +- arm_mpam: Fix percpu memory leak in __setup_ppi() error path +- arm_mpam: Wait for SRCU grace period before destroying RIS +- arm_mpam: Fix NULL pointer dereference after freeing comp->cfg +- fs/resctrl: Fix iommu_group and kobject reference leaks +- Revert "fs/resctrl: Re-allocate rmid for the monitor when migrating across control groups" +- iommu/arm-smmu-v3: Add debug logging for MPAM STE configuration +- arm64/mpam: Add debugfs entries to show the MSC/RIS the driver discovered +- debugfs: Add helpers for creating cpumask entries in debugfs +- arm64/mpam: Add MBM_TOTAL_EVENT configurability check +- fs/resctrl: Introduce resctrl_arch_mbm_update() for arch-specific MBM event handling +- resctrl: Remove unused mbm_core field from rdt_domain +- arm64/mpam: Add MBOPT (Memory Bandwidth Optimal) feature +- arm64/mpam: Adapt SMMU IOMMU interface for Narrow PARTID support +- arm64/mpam: Allow zero-bit CPBM for L2 cache +- arm64/mpam: Add MBM overflow handling for HIP13 +- arm64/mpam: Add selective L2 MBM overflow checking +- fs/resctrl: Add arch-specific MBM overflow setup helpers +- fs/resctrl: Introduce per-resource MBM enable check +- arm64/mpam: Add HISI_HIP13 support +- arm64/mpam: Fix wd boundary check and GENMASK range in percent-mbw conversion +- arm_mpam: Add MBWU counter scaling support +- arm_mpam: Disable reqPARTID expansion when Narrow-PARTID is unavailable +- fs/resctrl: Prevent rmid parsing errors by flushing limbo on umount +- arm64/mpam: Add mpam_sync_config() for dynamic rmid expansion +- fs/resctrl: Wire up rmid expansion and reclaim functions +- arm_mpam: Implement dynamic reqPARTID allocation for monitoring groups +- fs/resctrl: Add rmid_entry state helpers +- arm_mpam: Propagate control group config to sub-monitoring groups +- arm_mpam: Set INTERNAL as needed when setting MSC controls +- arm_mpam: Refactor rmid to reqPARTID/PMG mapping +- arm_mpam: Add intPARTID and reqPARTID support for narrow PARTID feature +- urma: fix positive return value in uburma_open + +* Wed Sep 23 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-176.0.0.156 +- !27359 HISI-CCA and HISI-CCA-DA bugfixs +- !28526 CVE-2026-89799 +- !28468 arm: kvm feat feature +- !28514 drivers/ub/sentry: fix kfree of non-head pointer in parse_config_string +- bpf: Disable preemption in bpf_get_stackid +- bpf: Use stack id functions instead of __bpf_get_stackid +- bpf: Factor stackid_new_bucket from __bpf_get_stackid +- bpf: Factor stackid_fastpath function from __bpf_get_stackid +- bpf: Factor stackid_init function from __bpf_get_stackid +- bpf: decouple stack_map_get_build_id_offset() from perf_callchain_entry +- !28455 LoongArch: Avoid preempt count underflow without probe +- KVM: arm64: Allow control of dpISA extensions in ID_AA64ISAR3_EL1 +- KVM: arm64: Expose ID_AA64PFR2_EL1 to userspace and guests +- KVM: arm64: Enable FP8 support when available and configured +- KVM: arm64: Expose ID_AA64FPFR0_EL1 as a writable ID reg +- KVM: arm64: Add save/restore support for FPMR +- KVM: arm64: Add predicate for FPMR support in a VM +- KVM: arm64: Add CONFIG_ENABLE_KVM_FPMR to support for fpmr in KVM +- drivers/ub/sentry: fix kfree of non-head pointer in parse_config_string +- !28214 [OLK-6.6] Fix CVE-2026-90388 +- !27961 [OLK-6.6] Fix CVE-2026-89479 +- !28068 [OLK-6.6] Fix CVE-2026-89657 +- !28163 [OLK-6.6] Fix CVE-2026-90283 +- !28462 xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() +- !28465 RDMA/cxgb4: Free debugfs on registration failure +- !28463 params: fix charp corruption on allocation failure +- !28063 [OLK-6.6] Fix CVE-2026-89643 +- !27955 [OLK-6.6] Fix CVE-2026-89451 +- !28058 [OLK-6.6] Fix CVE-2026-89583 +- !28232 [OLK-6.6] Fix CVE-2026-92495 +- !28242 [OLK-6.6] Fix CVE-2026-92510 +- !28244 [OLK-6.6] Fix CVE-2026-92512 +- !28255 [OLK-6.6] Fix CVE-2026-92523 +- !28276 [OLK-6.6] Fix CVE-2026-93107 +- !28167 [OLK-6.6] Fix CVE-2026-90293 +- !28460 media: tda18250: fix possible integer overflow +- !28461 media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link +- !28102 [OLK-6.6] Fix CVE-2026-89726 +- !28105 [OLK-6.6] Fix CVE-2026-89729 +- !28171 [OLK-6.6] Fix CVE-2026-90307 +- !28183 [OLK-6.6] Fix CVE-2026-90329 +- !28221 [OLK-6.6] Fix CVE-2026-90413 +- !28222 [OLK-6.6] Fix CVE-2026-90414 +- !28223 [OLK-6.6] Fix CVE-2026-90415 +- !28224 [OLK-6.6] Fix CVE-2026-90416 +- !28216 [OLK-6.6] Fix CVE-2026-90392 +- !28126 [OLK-6.6] Fix CVE-2026-89842 +- !28127 [OLK-6.6] Fix CVE-2026-89843 +- !28128 [OLK-6.6] Fix CVE-2026-89844 +- !28129 [OLK-6.6] Fix CVE-2026-89845 +- !28217 [OLK-6.6] Fix CVE-2026-90393 +- !28459 perf/x86/intel: Fix kernel address leakages in LBR stack +- !28449 ACPI: CPPC: Power Management Controller feature +- !28466 v2 arm64: smt: Introduce VIP-SMT QoS mode for SMT +- !27947 [OLK-6.6] Fix CVE-2026-80996 +- !27888 urma: fix memory usage of ubcore of node0 is too large +- !27980 Fix CVE-2026-90182 +- !28123 [OLK-6.6] Fix CVE-2026-89803 +- !28396 Fix CVE-2026-90093 +- !27931 [OLK-6.6] Fix CVE-2026-80977 +- !28280 [OLK-6.6] Fix CVE-2026-93137 +- !28037 [OLK-6.6] Fix CVE-2026-89547 +- !28442 Fix CVE-2026-90092 +- !27787 KVM: SVM: CSV: Support 256MB dirty pages in CSV3 migration +- KVM: arm64: Move FPMR into the sysreg array +- arm64: configs: Enable ARM64_VIP_SMT in openeuler_defconfig +- arm64: smt: Add novipsmt kernel command line parameter +- arm64: smt: Introduce VIP-SMT a QoS Mode for SMT +- arm64: idle: make arch_cpu_idle_{enter,exit} more refactorable +- RDMA/cxgb4: Free debugfs on registration failure +- params: fix charp corruption on allocation failure +- xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() +- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link +- media: tda18250: fix possible integer overflow +- perf/x86/intel: Fix kernel address leakages in LBR stack +- LoongArch: Avoid preempt count underflow without probe +- KVM: SVM: CSV: Support 256MB dirty pages in CSV3 migration +- x86/csv: Add function to get SMR size of CSV3 memory +- x86/mm: Reserve 520MB memory for CSV3 migration +- Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN +- cpufreq: cppc: Expose Resource Priority attributes via sysfs +- ACPI: CPPC: Add Resource Priority accessors +- ACPI: CPPC: Factor out cpc_read_reg() and cpc_write_reg() +- ACPI: CPPC: Store optional flag in cpc_register_resource +- ACPI: CPPC: Parse Resource Priority Register entries from _CPC package +- ACPI: CPPC: Refactor resource cleanup into free_reg_resource() +- ACPI: CPPC: Refactor element parsing into parse_cpc_element() +- ACPI: CPPC: Prepare cpc_register_resource for Package-type entries +- ACPI: CPPC: Refactor register value get and set ABIs +- ACPI: CPPC: Add cppc_set_reg_val() +- ACPI: CPPC: Extract cppc_get_reg_val_in_pcc() +- ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val() +- ACPI: CPPC: Optimize cppc_get_perf() +- ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional +- rme: fix device unassign and unmap rollback +- rme: fix io-pgtable and device attach defects +- rme: fix CCA dispatcher NULL deref and folio refcount +- rme: fix swiotlb free of shared pages +- rme: hisi-cca-da: use spin_lock_irqsave for g_dev_protected +- rme: hisi-cca-da: protect PAR_EL1 from interrupt clobber +- rme: hisi-cca-da: init MSI fields and skip non-S2_TRANS STE +- rme: pass virtual CLIDR_EL1 to REC entry +- Bluetooth: L2CAP: access chan->conn safely in get/setsockopt +- bpf: Fix use-after-free on mm_struct in bpf_find_vma() +- RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state +- RDMA/nldev: validate dynamic counter attribute length +- RDMA/core: Fix use after free in ib_query_qp() +- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations +- RDMA/core: Fix potential use after free in ib_destroy_srq_user() +- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations +- RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap +- RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs +- RDMA/cxgb4: free STAG index when TPT entry write fails +- IB/isert: reject PDUs declaring more data than was received +- IB/isert: reject login PDUs declaring more data than was received +- bpf: Fix potential UAF in bpf_netns_link_update_prog +- bpf: Fix potential UAF when reading bpf link info +- iommu/dma: Check atomic pool allocation result directly +- HID: synchronize input before cleaning up a failed probe +- RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ +- IB/isert: post the full-feature receive buffers after session registration +- IB/isert: delay the final Login Response until the session is registered +- hugetlbfs: release subpool on fill_super failure +- scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() +- scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition +- scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak +- scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started +- drm/nouveau: unsubscribe the channel-kill event before the fence context +- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature +- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() +- libceph: validate OSD extent maps before cursor advance +- audit: avoid dropping live tree ref on fsnotify rule autoremove +- Bluetooth: eir: Fix OOB read in eir_get_service_data() +- SUNRPC: Check svc pool percpu counter allocation +- blk-iocost: clear delay state when freeing policy data +- sctp: stop processing a packet once its association is deleted +- iommu/sva: Set handle->dev before the SVA handle is visible +- net: l2tp: do not propagate multicast notification errors +- net: skbuff: don't touch shared zerocopy state in skb_tx_error() +- urma: fix memory usage of ubcore of node0 is too large +- rme: hisi-cca-da: undelegate device on realm create failure + +* Tue Sep 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-173.0.0.155.20260922.19dbc5fe10e8 +- !28225 [OLK-6.6] Fix CVE-2026-90417 +- !28371 [OLK-6.6] ub: ubaseproxy: Fix context validation and risk statistics +- !28370 [OLK-6.6] ub/unic: Fix reset, ctrlq completion, RX and doorbell handling +- !28419 powerpc/kexec_file: Prevent kexec range truncation +- !28281 [OLK-6.6] Fix CVE-2026-93138 +- !28407 bpf: Compare iterator types during state pruning +- !28273 [OLK-6.6] Fix CVE-2026-93095 +- !28456 v4 bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed +- !28418 kprobes: Protect kprobe_blacklist with RCU +- !28413 ftrace: Take trace_array reference before accessing its ftrace_ops +- !28428 CVE-2026-90036 and CVE-2026-90037 +- bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed +- !28405 net: hns3: differentiate autoneg default values between copper and fiber +- !28391 Fix CVE-2026-90091 +- !27675 urma: change tpid uobj deatch to the front of import jetty ex +- !27948 [OLK-6.6] Fix CVE-2026-81000 +- !28400 bpf: Reject non-scalar bpf_loop iteration counts +- !27934 [OLK-6.6] Fix CVE-2026-80984 +- !27949 [OLK-6.6] Fix CVE-2026-81002 +- !28019 [OLK-6.6] Fix CVE-2026-89520 +- !25831 Support cpupower tool on Intel platforms +- !28354 Fix CVE-2026-90218 +- !28352 Fix CVE-2026-89894 +- !28350 Fix CVE-2026-89897 +- !28016 [OLK-6.6] Fix CVE-2026-89510 +- !28015 [OLK-6.6] Fix CVE-2026-89508 +- !28346 Fix CVE-2026-89899 +- !28279 [OLK-6.6] Fix CVE-2026-93125 +- !25832 sync turbostat to release 2025.12.02 +- !28176 [OLK-6.6] Fix CVE-2026-90314 +- !28318 Fix CVE-2026-93189 +- !27994 Fix CVE-2026-93163 +- !27992 Fix CVE-2026-93146 +- !27991 Fix CVE-2026-93110 +- !27972 Fix CVE-2026-93109 +- !27990 Fix CVE-2026-93108 +- !27969 Fix CVE-2026-93104 +- !25830 Sync intel-speed-select to v1.26 +- !27967 Fix CVE-2026-93103 +- net: hns3: fix speed configuration residue after driver reload +- net: hns3: differentiate autoneg default values between copper and fiber +- net: hns3: fix permanent link down deadlock after reset +- net: hns3: refactor MAC autoneg and speed configuration +- net: hns3: unify copper port ksettings configuration path +- Revert "net: hns3: use user configure after hardware reset when using kernel PHY." +- Revert "net: hns3: `req_autoneg` for fiber is initialized to `support_autoneg` instead of OFF." +- !27878 Fix CVE-2026-89998 +- !28024 [OLK-6.6] Fix CVE-2026-89532 +- !28284 [OLK-6.6] Fix CVE-2026-93148 +- !28026 [OLK-6.6] Fix CVE-2026-89536 +- !28039 [OLK-6.6] Fix CVE-2026-89549 +- !28033 [OLK-6.6] Fix CVE-2026-89542 +- !28029 [OLK-6.6] Fix CVE-2026-89538 +- !28283 [OLK-6.6] Fix CVE-2026-93144 +- !28025 [OLK-6.6] Fix CVE-2026-89533 +- !28032 [OLK-6.6] Fix CVE-2026-89541 +- !28031 [OLK-6.6] Fix CVE-2026-89540 +- NFSD: Prevent client use-after-free during close_lru reaping +- NFSD: Prevent client use-after-free during blocked-lock reaping +- !27796 nvmet-tcp: bound SGL data length before allocating command buffers +- powerpc/kexec_file: Prevent kexec range truncation +- kprobes: Protect kprobe_blacklist with RCU +- !27851 Fix CVE-2026-90011 +- ftrace: Take trace_array reference before accessing its ftrace_ops +- bpf: Compare iterator types during state pruning +- !27706 mm/dpool: block huge orders via thp_vma_allowable +- !28041 [OLK-6.6] Fix CVE-2026-89551 +- !28038 [OLK-6.6] Fix CVE-2026-89548 +- !28052 [OLK-6.6] Fix CVE-2026-89565 +- bpf: Reject non-scalar bpf_loop iteration counts +- Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan +- RDMA/cma: Fix WARNING in res_to_rt +- media: cx231xx: reject geometry changes while the VBI queue is busy +- media: cec: Serialize exclusive follower delivery +- media: cec: disable delayed work before freeing an interrupted transmit +- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free +- bpf: Reject MEM_ALLOC BTF accesses past object bounds +- bpf: Reject writes through untrusted BTF pointers +- bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux +- bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max +- hfsplus: validate thread record before delete key rebuild +- RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() +- remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() +- ipip: fix skb leak in collect_md mode when metadata_dst allocation fails +- SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow +- sunrpc: route to a populated pool in svc_pool_for_cpu() +- SUNRPC: always drain cache_cleaner before destroying a cache_detail +- SUNRPC: harden gss_krb5_unwrap_v2 against short tokens +- SUNRPC: harden gss_unwrap_resp_priv length checks +- sunrpc: init gssp_lock before publishing proc entry +- SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field +- SUNRPC: wait for in-flight client TLS handshake callback +- svcrdma: Fix offset arithmetic in read_chunk_range +- svcrdma: Fix pcl_for_each_segment for empty chunks +- sched/core: Make core-sched flips wait for in-flight selections +- RDMA/cxgb4: Cancel reg_work before freeing device on remove +- RDMA/ucma: Lock the handler in ucma_set_ib_path() +- hwrng: core - fix rng list on registration error +- time/namespace: Validate nanosecond field in proc_timens_set_offset() +- RDMA/core: Wait for RCU callbacks before unloading ib_core +- RDMA/ipoib: Drain RCU callbacks during module teardown +- tools/power turbostat: AMD: msr offset 0x611 read failed: Input/output error +- tools/power turbostat: version 2025.12.02 +- tools/power turbostat: Print wide names only for RAW 64-bit columns +- tools/power turbostat: Print percentages in 8-columns +- tools/power turbostat: Print "nan" for out of range percentages +- tools/power turbostat: Validate APERF access for VMWARE +- tools/power turbostat: Enhance perf probe +- tools/power turbostat: Validate RAPL MSRs for AWS Nitro Hypervisor +- tools/power turbostat: Add run-time MSR driver probe +- tools/power turbostat: Set per_cpu_msr_sum to NULL after free +- tools/power turbostat: Add LLC stats +- tools/power turbostat: Remove dead code +- tools/power turbostat: Refactor floating point printout code +- tools/power turbostat.8: Update example +- tools/power turbostat: Refactor added-counter value printing code +- tools/power turbostat: Refactor added column header printing +- tools/power turbostat: Add Wildcat Lake and Nova Lake support +- tools/power turbostat: Regression fix Uncore MHz printed in hex +- tools/power turbostat: Fix incorrect sorting of PMT telemetry +- tools/power turbostat: version 2025.09.09 +- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions +- tools/power turbostat: standardize PER_THREAD_PARAMS +- tools/power turbostat: Fix DMR support +- tools/power turbostat: add format "average" for external attributes +- tools/power turbostat: delete GET_PKG() +- tools/power turbostat: probe and display L3 cache topology +- tools/power turbostat: Support more than 64 built-in-counters +- tools/power turbostat.8: Document Totl%C0, Any%C0, GFX%C0, CPUGFX% columns +- tools/power turbostat: Fix bogus SysWatt for forked program +- tools/power turbostat: Handle cap_get_proc() ENOSYS +- tools/power turbostat: Fix build with musl +- tools/power turbostat: verify arguments to params --show and --hide +- x86/cpu: Add new Intel CPU model numbers for Wildcatlake and Novalake +- tools/power turbostat: regression fix: --show C1E% +- tools/power turbostat: version 2025.06.08 +- tools/power turbostat: Add initial support for BartlettLake +- tools/power turbostat: Add initial support for DMR +- tools/power turbostat: Dump RAPL sysfs info +- tools/power turbostat: Avoid probing the same perf counters +- tools/power turbostat: Allow probing RAPL with platform_features->rapl_msrs cleared +- tools/power turbostat: Clean up add perf/msr counter logic +- tools/power turbostat: Introduce add_msr_counter() +- tools/power turbostat: Remove add_msr_perf_counter_() +- tools/power turbostat: Remove add_cstate_perf_counter_() +- tools/power turbostat: Remove add_rapl_perf_counter_() +- tools/power turbostat: Quit early for unsupported RAPL counters +- tools/power turbostat: Always check rapl_joules flag +- tools/power turbostat: Fix AMD package-energy reporting +- tools/power turbostat: Fix RAPL_GFX_ALL typo +- tools/power turbostat: Add Android support for MSR device handling +- tools/power turbostat.8: pm_domain wording fix +- tools/power turbostat.8: fix typo: idle_pct should be pct_idle +- tools/power turbostat: v2025.05.06 +- tools/power turbostat: disable "cpuidle" invocation counters, by default +- tools/power turbostat: re-factor sysfs code +- tools/power turbostat: Restore GFX sysfs fflush() call +- tools/power turbostat: Document GNR UncMHz domain convention +- tools/power turbostat: report CoreThr per measurement interval +- tools/power turbostat: Increase CPU_SUBSET_MAXCPUS to 8192 +- tools/power turbostat: Add idle governor statistics reporting +- tools/power turbostat: Fix names matching +- tools/power turbostat: Allow Zero return value for some RAPL registers +- tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options +- x86/cpu: Fix #define name for Intel CPU model 0x5A +- tools/power turbostat: version 2025.02.02 +- tools/power turbostat: Add CPU%c1e BIC for CWF +- tools/power turbostat: Harden one-shot mode against cpu offline +- tools/power turbostat: Fix forked child affinity regression +- tools/power turbostat: Add tcore clock PMT type +- tools/power turbostat: version 2025.01.14 +- tools/power turbostat: Allow adding PMT counters directly by sysfs path +- tools/power turbostat: Allow mapping multiple PMT files with the same GUID +- tools/power turbostat: Add PMT directory iterator helper +- tools/power turbostat: Extend PMT identification with a sequence number +- tools/power turbostat: Return default value for unmapped PMT domains +- tools/power turbostat: Check for non-zero value when MSR probing +- tools/power turbostat: Enhance turbostat self-performance visibility +- tools/power turbostat: Add fixed RAPL PSYS divisor for SPR +- tools/power turbostat: Fix PMT mmaped file size rounding +- tools/power turbostat: Remove SysWatt from DISABLED_BY_DEFAULT +- tools/power turbostat: Add an NMI column +- tools/power turbostat: add Busy% to "show idle" +- tools/power turbostat: Introduce --force parameter +- tools/power turbostat: Improve --help output +- tools/power turbostat: Exit on unsupported Vendors +- tools/power turbostat: Exit on unsupported Intel models +- tools/power turbostat: update turbostat(8) +- tools/power turbostat: Add initial support for ClearwaterForest +- tools/power turbostat: Add initial support for PantherLake +- tools/power turbostat: 2024.11.30 +- tools/power turbostat: Add RAPL psys as a built-in counter +- tools/power turbostat: Fix child's argument forwarding +- tools/power turbostat: Force --no-perf in --dump mode +- tools/power turbostat: Add support for /sys/class/drm/card1 +- tools/power turbostat: Cache graphics sysfs file descriptors during probe +- tools/power turbostat: Consolidate graphics sysfs access +- tools/power turbostat: Remove unnecessary fflush() call +- tools/power turbostat: Enhance platform divergence description +- tools/power turbostat: Add initial support for GraniteRapids-D +- tools/power turbostat: Remove PC3 support on Lunarlake +- tools/power turbostat: Rename arl_features to lnl_features +- tools/power turbostat: Add back PC8 support on Arrowlake +- tools/power turbostat: Remove PC7/PC9 support on MTL +- tools/power turbostat: Honor --show CPU, even when even when num_cpus=1 +- tools/power turbostat: Fix trailing ' +- tools/power turbostat: Allow using cpu device in perf counters on hybrid platforms +- tools/power turbostat: Fix column printing for PMT xtal_time counters +- tools/power turbostat: fix GCC9 build regression +- tools/power turbostat: version 2024.07.26 +- tools/power turbostat: Include umask=%x in perf counter's config +- tools/power turbostat: Document PMT in turbostat.8 +- tools/power turbostat: Add MTL's PMT DC6 builtin counter +- tools/power turbostat: Add early support for PMT counters +- tools/power turbostat: Move verbose counter messages to level 2 +- tools/power turbostat: Move debug prints from stdout to stderr +- tools/power turbostat: Fix typo in turbostat.8 +- tools/power turbostat: Add perf added counter example to turbostat.8 +- tools/power turbostat: Fix formatting in turbostat.8 +- tools/power turbostat: Extend --add option with perf counters +- tools/power turbostat: Group SMI counter with APERF and MPERF +- tools/power turbostat: Add ZERO_ARRAY for zero initializing builtin array +- tools/power turbostat: Replace enum rapl_source and cstate_source with counter_source +- tools/power turbostat: Remove anonymous union from rapl_counter_info_t +- tools/power turbostat: Add local build_bug.h header for snapshot target +- tools/power/turbostat: Switch to new Intel CPU model defines +- tools/power turbostat: Fix unc freq columns not showing with '-q' or '-l' +- tools/power turbostat: option '-n' is ambiguous +- tools/power turbostat: version 2024.05.10 +- tools/power turbostat: Ignore pkg_cstate_limit when it is not available +- tools/power turbostat: Fix order of strings in pkg_cstate_limit_strings +- tools/power turbostat: Read Package-cstates via perf +- tools/power turbostat: Read Core-cstates via perf +- tools/power turbostat: Avoid possible memory corruption due to sparse topology IDs +- tools/power turbostat: Add columns for clustered uncore frequency +- tools/power turbostat: Enable non-privileged users to read sysfs counters +- tools/power turbostat: Replace _Static_assert with BUILD_BUG_ON +- tools/power turbostat: Add ARL-H support +- tools/power turbostat: Enhance ARL/LNL support +- tools/power turbostat: Survive sparse die_id +- tools/power turbostat: Harden probe_intel_uncore_frequency() +- tools/power turbostat: Add "snapshot:" Makefile target +- tools/power turbostat: v2024.04.10 +- tools/power turbostat: Add selftests +- tools/power/turbostat: Add support for Xe sysfs knobs +- tools/power/turbostat: Add support for new i915 sysfs knobs +- tools/power/turbostat: Introduce BIC_SAM_mc6/BIC_SAMMHz/BIC_SAMACTMHz +- tools/power/turbostat: Unify graphics sysfs snapshots +- tools/power/turbostat: Cache graphics sysfs path +- tools/power/turbostat: Enable MSR_CORE_C1_RES support for ICX +- tools/power turbostat: read RAPL counters via perf +- tools/power turbostat: Add proper re-initialization for perf file descriptors +- tools/power turbostat: Clear added counters when in no-msr mode +- tools/power turbostat: add early exits for permission checks +- tools/power turbostat: detect and disable unavailable BICs at runtime +- tools/power turbostat: Add reading aperf and mperf via perf API +- tools/power turbostat: Add --no-perf option +- tools/power turbostat: Add --no-msr option +- tools/power turbostat: enhance -D (debug counter dump) output +- tools/power turbostat: Read base_hz and bclk from CPUID.16H if available +- tools/power turbostat: Expand probe_intel_uncore_frequency() +- tools/power turbostat: Do not print negative LPI residency +- tools/power turbostat: version 2023.11.07 +- tools/power/turbostat: bugfix "--show IPC" +- tools/power/turbostat: Add initial support for LunarLake +- tools/power/turbostat: Add initial support for ArrowLake +- tools/power/turbostat: Add initial support for GrandRidge +- tools/power/turbostat: Add initial support for SierraForest +- tools/power/turbostat: Add initial support for GraniteRapids +- tools/power/turbostat: Add MSR_CORE_C1_RES support for spr_features +- tools/power/turbostat: Move process to root cgroup +- tools/power/turbostat: Handle cgroup v2 cpu limitation +- tools/power/turbostat: Abstrct function for parsing cpu string +- tools/power/turbostat: Handle offlined CPUs in cpu_subset +- tools/power/turbostat: Obey allowed CPUs for system summary +- tools/power/turbostat: Obey allowed CPUs for primary thread/core detection +- tools/power/turbostat: Abstract several functions +- tools/power/turbostat: Obey allowed CPUs during startup +- tools/power/turbostat: Obey allowed CPUs when accessing CPU counters +- tools/power/turbostat: Introduce cpu_allowed_set +- tools/power/turbostat: Remove PC7/PC9 support on ADL/RPL +- tools/power/turbostat: Enable MSR_CORE_C1_RES on recent Intel client platforms +- tools/power/turbostat: Introduce probe_pm_features() +- tools/power/turbostat: Relocate more probing related code +- tools/power/turbostat: Reorder some functions +- tools/power/turbostat: Relocate thermal probing code +- tools/power/turbostat: Relocate lpi probing code +- tools/power/turbostat: Relocate graphics probing code +- tools/power/turbostat: Rename rapl probing function +- tools/power/turbostat: Rename uncore probing function +- tools/power/turbostat: Relocate pstate probing code +- tools/power/turbostat: Relocate cstate probing code +- tools/power/turbostat: Improve probe_platform_features() logic +- tools/power/turbostat: Delete intel_model_duplicates() +- tools/power/turbostat: Abstract cstate prewake bit support +- tools/power/turbostat: Abstract aperf/mperf multiplier support +- tools/power/turbostat: Abstract extended cstate MSRs support +- tools/power/turbostat: Abstract MSR_KNL_CORE_C6_RESIDENCY support +- tools/power/turbostat: Abstract MSR_ATOM_PKG_C6_RESIDENCY support +- tools/power/turbostat: Abstract MSR_CC6/MC6_DEMOTION_POLICY_CONFIG support +- tools/power/turbostat: Abstract MSR_MODULE_C6_RES_MS support +- tools/power/turbostat: Abstract MSR_CORE_C1_RES support +- tools/power/turbostat: Abstract IRTL support +- tools/power/turbostat: Use fine grained IRTL output +- tools/power/turbostat: Adjust cstate for is_slm()/is_knl()/is_cnl()/is_ehl() models +- tools/power/turbostat: Adjust cstate for has_c8910_msrs() models +- tools/power/turbostat: Adjust cstate for is_bdx() models +- tools/power/turbostat: Adjust cstate for is_skx()/is_icx()/is_spr() models +- tools/power/turbostat: Adjust cstate for is_dnv() models +- tools/power/turbostat: Adjust cstate for is_jvl() models +- tools/power/turbostat: Adjust cstate for has_slv_msrs() models +- tools/power/turbostat: Adjust cstate for has_snb_msrs() models +- tools/power/turbostat: Adjust cstate for models with .cst_limit set +- tools/power/turbostat: Adjust cstate for has_snb_msrs() models +- tools/power/turbostat: Adjust cstate for models with .has_nhm_msrs set +- tools/power/turbostat: Add skeleton support for cstate enumeration +- tools/power/turbostat: Abstract TSC tweak support +- tools/power/turbostat: Remove unused family/model parameters for RAPL functions +- tools/power/turbostat: Abstract hardcoded TDP value +- tools/power/turbostat: Abstract fixed DRAM Energy unit support +- tools/power/turbostat: Abstract RAPL divisor support +- tools/power/turbostat: Abstract Per Core RAPL support +- tools/power/turbostat: Abstract RAPL MSRs support +- tools/power/turbostat: Simplify the logic for RAPL enumeration +- tools/power/turbostat: Redefine RAPL macros +- tools/power/turbostat: Abstract hardcoded Crystal Clock frequency +- tools/power/turbostat: Abstract Automatic Cstate Conversion support +- tools/power/turbostat: Abstract Perf Limit Reasons MSRs support +- tools/power/turbostat: Abstract TCC Offset bits support +- tools/power/turbostat: Abstract Config TDP MSRs support +- tools/power/turbostat: Rename some TRL functions +- tools/power/turbostat: Abstract Turbo Ratio Limit MSRs support +- tools/power/turbostat: Rename some functions +- tools/power/turbostat: Remove a redundant check +- tools/power/turbostat: Abstract Nehalem MSRs support +- tools/power/turbostat: Abstract Package cstate limit decoding support +- tools/power/turbostat: Abstract BCLK frequency support +- tools/power/turbostat: Abstract MSR_MISC_PWR_MGMT support +- tools/power/turbostat: Abstract MSR_MISC_FEATURE_CONTROL support +- tools/power/turbostat: Add skeleton support for table driven feature enumeration +- tools/power/turbostat: Remove pseudo check for two models +- tools/power/turbostat: Remove redundant duplicates +- tools/power/turbostat: Replace raw value cpu model with Macro +- tools/power/turbostat: Support alternative graphics sysfs knobs +- tools/power/turbostat: Enable TCC Offset on more models +- tools/power/turbostat: Fix failure with new uncore sysfs +- RDMA/mlx5: Drain RCU callbacks during module teardown +- RDMA/rvt: Return NULL after port allocation failure +- RDMA/hfi1: Preserve unit 0 on allocation failure +- xdp: fix zero-copy frame layout +- net: tun: bound receive headroom +- net/smc: do not dereference an unset send buffer on the SMC-D teardown path +- ub: ubaseproxy: add sqe_position field verification for jetty ctx creation +- ub: ubaseproxy: optimize jetty group ctx verification handling +- ub: ubaseproxy: Fix JFS modify ctx length check and mask offset +- ub: ubaseproxy: The risk stats only print active UEs +- ub: ubaseproxy: Fix risk_stats statistics in abnormal scenarios +- ub: ubaseproxy: print info only when ue is registered +- ub: ubaseproxy: modify the minimum value of rce_shift +- ub: ubaseproxy: Count jfs_check_jfr_not_exists errors in risk_stats +- ub: ubaseproxy: ubaseproxy encoding format adjustment +- ub: ubase: Change the doorbell mapping attribute from Normal NC to Device +- net: unic: Avoid page-pool double put on RX errors +- ub: ubase: Fix ctrlq duplicate completion, wait timing, and endian cleanup +- ub: ubase: Retry reset after preparation timeout +- urma: change tpid uobj deatch to the front of import jetty ex +- dm: fix race when loading and unloading a table +- scsi: target: iscsi: Reserve a terminator byte for the login payload +- mm/dpool: block huge orders via thp_vma_allowable +- nvmet-tcp: bound SGL data length before allocating command buffers +- cpupower: Add intel_pstate turbo boost support for Intel platforms +- cpupower: Allow control of boost feature on non-x86 based systems with boost support. +- tools/power/cpupower: Add documentation for some recently introduced options +- tools/power/x86/intel-speed-select: v1.26 release +- tools/power/x86/intel-speed-select: Fix output when running on unsupported CLX platforms +- tools/power/x86/intel-speed-select: Print Version info when Incompatible API version is detected +- tools/power/x86/intel-speed-select: Fix some program return value +- tools/power/x86/intel-speed-select: Fix cpu extended family ID decoding +- tools/power/x86/intel-speed-select: Avoid current base freq as maximum +- tools/power/x86/intel-speed-select: v1.25 release +- tools/power/x86/intel-speed-select: Use pkg-config for libnl-3.0 detection +- tools/power/x86/intel-speed-select: Allow non root users +- tools/power/x86/intel-speed-select: v1.24 release +- tools/power/x86/intel-speed-select: Reset isst_turbo_freq_info for invalid buckets +- tools/power/x86/intel-speed-select: Check feature status +- tools/power/x86/intel-speed-select: v1.23 release +- tools/power/x86/intel-speed-select: Skip uncore frequency update +- tools/power/x86/intel-speed-select: Support SST PP revision 2 fields +- tools/power/x86/intel-speed-select: v1.22 release +- tools/power/x86/intel-speed-select: Prefix header search path with sysroot +- tools/power/x86/intel-speed-select: Die ID for IO dies +- tools/power/x86/intel-speed-select: Fix the condition to check multi die system +- tools/power/x86/intel-speed-select: Prevent increasing MAX_DIE_PER_PACKAGE +- tools/power/x86/intel-speed-select: v1.21 release +- tools/power/x86/intel-speed-select: Fix TRL restore after SST-TF disable +- tools/power/x86/intel-speed-select: v1.20 release +- tools/power/x86/intel-speed-select: Set TRL MSR in 100 MHz units +- tools/power/x86/intel-speed-select: v1.19 release +- tools/power/x86/intel-speed-select: Display CPU as None for -1 +- tools/power/x86/intel-speed-select: SST BF/TF support per level +- tools/power/x86/intel-speed-select: Increase number of CPUs displayed +- tools/power/x86/intel-speed-select: Present all TRL levels for turbo-freq +- tools/power/x86/intel-speed-select: Fix display for unsupported levels +- tools/power/x86/intel-speed-select: Support multiple dies +- tools/power/x86/intel-speed-select: Increase die count +- tools/power/x86/intel-speed-select: v1.18 release +- tools/power/x86/intel-speed-select: Use cgroup isolate for CPU 0 +- tools/power/x86/intel-speed-select: Increase max CPUs in one request +- tools/power/x86/intel-speed-select: Display error for core-power support +- tools/power/x86/intel-speed-select: No TRL for non compute domains +- tools/power/x86/intel-speed-select: turbo-mode enable disable swapped +- tools/power/x86/intel-speed-select: Update help for TRL +- tools/power/x86/intel-speed-select: Sanitize integer arguments + +' parsing +* Mon Sep 21 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-173.0.0.155.20260921.a1f45a9bad6b +- !27813 urma: use single jetty per device for ipourma +- !27844 Fix CVE-2026-89859 +- !27841 Fix CVE-2026-89847 +- !27832 Fix CVE-2026-80974 +- !27863 [OLK-6.6] Fix CVE-2026-89719 +- !27838 Fix CVE-2026-89846 +- !27720 CVE-2026-89636 +- !27723 Fix CVE-2026-89633 +- !27795 x86/mm/csv3: Fix CPU hang during conversion between secure and shared memory +- !27628 swiotlb: Align swiotlb base address to 128M boundary in CSV3 guest +- !27549 swiotlb: reserve in high mem with guest encrypted backport from anolis +- !27945 ub: cdma: disable fence flag in common WR to match chip constraint +- !27699 urma: fix module ref leak on uburma file release +- !27900 tracing: Take trace_array reference when opening options file +- !24847 mfs: handle open event in user-space side +- !27928 urma: fix incomplete authentication of segment requests +- urma: use single jetty per device for ipourma +- urma: fix module ref leak on uburma file release +- !27987 urma: sync cfg.id with driver-assigned id in ubcore_create_jetty/jfr +- !27871 ub: ub_fwctl: Adds query for storm frequency limit status and historical frequency limit count for UE. +- !28005 ub: udma: bugfix related to log limit. +- ub: udma: bugfix related to log limit. +- urma: sync cfg.id with driver-assigned id in ubcore_create_jetty/jfr +- x86/mm/csv3: Fix CPU hang during conversion between secure and shared memory +- swiotlb: Align swiotlb base address to 128M boundary in CSV3 guest +- ub: cdma: disable fence flag in common WR to match chip constraint +- urma: fix incomplete authentication of segment requests +- tracing: Take trace_array reference when opening options file +- ub: ub_fwctl: Adds query for storm frequency limit status and historical frequency limit count for UE. +- zram: fix out-of-bounds access in read_block_state() +- scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak +- scsi: qla2xxx: Avoid double completion in async IOCB timeout +- scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read +- mfd: sm501: Fix potential memory leaks during remove +- smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() +- smb: client: clear ce->tgthint in free_tgts() +- smb: client: harden DFS cache against invalid target hints +- urma: configure SL/MTU/buffer sizing from device capability for ipourma +- swiotlb: reserve in high mem with guest encrypted +- mfs: handle open event in user-space side +- mfs: post open event to user-space side + +* Sun Sep 20 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-173.0.0.155.20260920.aff0ee0487a3 +- !27750 bpf: Harden bloom filter sizing and indexing on 32-bit kernels +- !27744 ceph: bound xattr value length in __build_xattrs() +- !27731 ceph: bound num_export_targets array for mds info v2/v3 +- !27729 ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode +- !27660 Fix CVE-2026-89575 +- !27671 Fix CVE-2026-89576 +- !27640 Fix CVE-2026-89557 +- !27643 Fix CVE-2026-89586 +- !27645 Fix CVE-2026-89595 +- !27647 Fix CVE-2026-89604 +- !27652 Fix CVE-2026-89631 +- !27649 Fix CVE-2026-89632 +- !27733 PTT add support for PCIe 6.0 TLP format +- perf hisi-ptt: Pass pattern version to decoder for compatibility +- bpf: Harden bloom filter sizing and indexing on 32-bit kernels +- ceph: bound xattr value length in __build_xattrs() +- ceph: bound num_export_targets array for mds info v2/v3 +- hwtracing: hisi_ptt: Add pattern PMU config for trace format selection +- perf hisi-ptt: Add field-level parsing for header DW0/DW1/DW2/DW3 +- perf hisi-ptt: Add parsing of supported message types and proto length +- perf hisi-ptt: Merge 4DW and 8DW HEAD0 printing +- perf hisi-ptt: Extract the raw data printing part +- perf hisi-ptt: Complete the field names for 4DW and 8DW packets +- perf hisi-ptt: Abstract trace data buf and offset +- ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode +- dm-era: fix shadowed superblock leak on take-snap failure +- dm raid1: reserve space for NUL-terminator in build_constructor_string() +- smb: client: reject a tree connect response whose byte count is too small +- smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() +- efivarfs: Rate limit statfs() handler +- fsnotify: Fix stale object mask after concurrent mark updates +- ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes +- md: do overflow check for sb->bblog_shift in super_1_load() + +* Sat Sep 19 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-173.0.0.155.20260919.48b9cae6c1a3 +- !27691 net/hinic5: Update hinic5 SDK and NIC features +- !27829 backport minios part4 patches from linux mainline on September 18th. +- !27709 [olk-6.6] netfilter: nft_set_pipapo: CVE-2026-72252 fix +- !27539 remoteproc: Prevent crash handling to race with rproc_del() +- arm64/fpsimd: Add task_smstop_sm() +- arm64/fpsimd: signal: Use SMSTOP behaviour in setup_return() +- arm64/fpsimd: signal: Clear TPIDR2 when delivering signals +- arm64/idreg: Add support "arm64.nocnp" for start option +- arm64/fpsimd: Do not discard modified SVE state +- KVM: arm64: Kill HCRX_HOST_FLAGS +- KVM: arm64: Properly save/restore HCRX_EL2 +- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused +- arm64/fpsimd: signal: Always save+flush state early +- arm64/fpsimd: signal32: Always save+flush state early +- arm64/fpsimd: Reset FPMR upon exec() +- arm64/fpsimd: Add fpsimd_save_and_flush_current_state() +- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes +- arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR +- arm64/ptrace: Expose FPMR via ptrace +- arm64/signal: Add FPMR signal handling +- arm64/fpsimd: Fix fpmr KABI breakage +- arm64/fpsimd: Support FEAT_FPMR +- arm64/fpsimd: Enable host kernel access to FPMR +- arm64/sysreg: Update HCRX_EL2 definition for DDI0601 2023-09 +- !27657 Fix CVE-2026-89634 +- !27667 Fix CVE-2026-89637 +- !27715 ub:ubus: adapt ub memory event for new chip +- !27490 tracing/probes: Fix use-after-free on field name/type of events with multiple probes +- net/hinic5: update hinic5 SDK and NIC features +- !27821 urma: Fixing the compatibility of the structure size +- !27698 urma: fix UAF in ubcore_alloc_jfs/jfr failed +- !27824 md: use bio_alloc when sync_set is not initialized in md_super_write +- !27826 Revert "iomap: guard io_size EOF trim against concurrent truncate underflow" +- !27806 urma: avoid UAF when deleting user-mode objects concurrently +- !27721 ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock +- urma: fix UAF in ubcore_alloc_jfs/jfr failed +- !27779 ceph: bound copied dentry name length in NFS export get_name +- !25736 urma: fix insufficient rqe distribution when alloc rx skb failed +- Revert "iomap: guard io_size EOF trim against concurrent truncate underflow" +- md: use bio_alloc when sync_set is not initialized in md_super_write +- urma: Fixing the compatibility of the structure size +- !27785 [Backport] RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp +- !27650 KVM: arm64: Fix uninitialised level in kvm_pgtable_stage2_relax_perms() +- !27801 urma: fix UAF in free_token_id +- !27663 [6.6][Intel-SIG] pmu uncore correctness fixes +- !27693 [OLK-6.6] backport important bugfix for mpt3sas driver from upstream linux-6.6.y +- !27697 x86/mm: Increase the value of the macro MIN_SMR_ENTRY_SHIFT +- !27637 Fix CVE-2026-80783 +- urma: avoid UAF when deleting user-mode objects concurrently +- !27534 [OLK-6.6][linux-6.6.y sync] Backport 6.6.155-6.6.156 LTS Patches +- !27449 urma: fix eid validation for user space create paths +- urma: fix UAF in free_token_id +- !27783 ub/ubmempfd: fix TOCTOU, and randon return value，log opt. +- RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp +- !27751 urma: make ubcore_set_vtp_param return int on invalid eid +- ub/ubmem_vmmu: fix the issue of returning random values. +- ub/ubmempfd: log optimization. +- ub/ubmempfd: bugfix of TOCTOU issue in copy_from_user. +- KVM: arm64: Fix uninitialised level in kvm_pgtable_stage2_relax_perms() +- ceph: bound copied dentry name length in NFS export get_name +- urma: make ubcore_set_vtp_param return int on invalid eid +- ub:ubus: adapt ub memory event for new chip +- ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock +- x86/mm: Increase the value of the macro MIN_SMR_ENTRY_SHIFT +- netfilter: nft_set_pipapo: remove dirty flag +- netfilter: nft_set_pipapo: prepare destroy function for on-demand clone +- usb: usbfs: fix use-after-free of usb_device in usbdev_release() +- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() +- USB: serial: spcp8x5: drop broken carrier detect support +- USB: serial: option: fix slab OOB read in interrupt URB callback +- ALSA: usb-audio: Complete cleanup after system-resume errors +- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() +- usb: core: Strengthen error handling in hub_hub_status() +- usb: core: Add lock to usb_wakeup_notification() +- KVM: s390: vsie: zero stale crypto bits +- crypto: qce - Remove unsafe/deprecated algorithms +- crypto: mxs-dcp - fix source scatterlist length access +- crypto: qce - fix CCM AAD buffer underallocation +- crypto: atmel-tdes - use scatterlist length before DMA mapping +- mm/swap: reject swapon() on filesystem-level encrypted files +- ipv6: seg6: clear IPv4 control block on IPIP decapsulation +- net: bridge: mcast: fix use-after-free of a master VLAN's multicast context +- xfrm: fix xfrm_state_construct() auth-trunc leak +- xfrm: ah6: validate routing header segments_left +- xfrm: drop ESP-in-TCP packets with no ingress device +- xfrm: espintcp: fix UAF during close +- x86/CPU/AMD: Carve out a Zen5 models range +- x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range +- tls: device: fix out-of-bounds write in tls_append_frag() +- usb: gadget: f_tcm: keep port count until LUN teardown completes +- usb: usbtest: disable dynamic ID support +- fuse: fix invalidate lock leak on open O_TRUNC DAX failure +- fuse: fix invalidate lock leak on setattr writeback failure +- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure +- xhci: dbgtty: Fix unregister on tty_register_driver() failure +- usb: xhci: Handle USB3 port events when there is one roothub +- accessibility: speakup: unregister tty ldisc on later init failures +- fpga: dfl: fme: add error handling +- xfs: remove file_path tracepoint data +- HID: pidff: fix OOB write when hid->inputs is empty +- HID: pidff: clang-format pass +- HID: pidff: Support device error response from PID_BLOCK_LOAD +- HID: uclogic: fix use-after-free of inrange_timer on remove +- HID: ft260: fix stack-use-after-return write in I2C read race +- HID: ft260: validate i2c input report length +- HID: nintendo: stop device IO before hid_hw_stop on probe failure +- nvme: fix status magic numbers +- nvme: rename nvme_sc_to_pr_err to nvme_status_to_pr_err +- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() +- HID: magicmouse: re-enable multitouch after reset-resume +- nfc: nci: add data_len bound checks to activation parameter extractors +- nilfs2: reject invalid block index in GC ioctl +- nilfs2: correct return value kernel-doc descriptions for ioctl functions +- ext4: propagate errors from fast commit range replay +- ext4: make some fast commit functions reuse extents path +- ext4: make state in ext4_mb_mark_bb to be bool +- ksmbd: harden file lifetime during session teardown +- net/sched: initialize noop_qdisc owner +- selinux: switch two allocations to use kzalloc_objs() +- smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). +- Revert "PM: sleep: Use complete() in device_pm_sleep_init()" +- smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). +- smc: Fix use-after-free in __pnet_find_base_ndev(). +- can: j1939: make j1939_sk_bind() fail if device is no longer registered +- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() +- Revert "usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal" +- io_uring/io-wq: fix worker accounting when canceling creation callbacks +- ext4: don't enable DAX on new encrypted files +- KVM: x86/mmu: Check write tracking in all address spaces +- scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers +- smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 +- smb: client: fix ALIGN() overflow in symlink_data() error context loop +- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() +- perf/x86/intel/uncore: Implement lazy setup for MSR/MMIO PMUs +- perf/x86/intel/uncore: Fix uncore_box ref/unref ordering +- perf/x86/intel/uncore: Introduce PMU flags and broken state +- perf/x86/intel/uncore: Factor out box setup code +- perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails +- perf/x86/intel/uncore: Let init_box() callback report failures +- perf/x86/intel/uncore: Fix refcnt and other cleanups +- perf/x86/intel/uncore: Fix PCI PMU cleanup on setup failure +- perf/x86/intel/uncore: Implement global init callback for GNR uncore +- perf/x86/intel/uncore: Fix uncore_die_to_cpu() for offline dies +- perf/x86/intel/uncore: Move die_to_cpu() to uncore.c +- perf/x86/intel/uncore: Guard against invalid box control address +- perf/x86/intel/uncore: Fix discovery unit lookup for multi-die systems +- perf/x86/intel/uncore: Factor out topology_gidnid_map() +- remoteproc: Prevent crash handling to race with rproc_del() +- RDMA/rxe: Fix OOB in free_rd_atomic_resources() +- tracing/probes: Fix use-after-free on field name/type of events with multiple probes +- urma: fix eid validation for user space create paths +- urma: fix insufficient rqe distribution when alloc rx skb failed + +* Thu Sep 17 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-173.0.0.155.20260917.28052a913f54 +- !27766 drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty +- !27739 Fix CVE-2026-89598 +- !27736 Fix CVE-2026-80914 +- !27730 Fix CVE-2026-80863 +- !27240 ub: obmm: fix exit UAF, allocator access/leak and ownership counter overflow. +- drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty +- !27625 mm: fix double initialization race in mm_counter_try_switch_to_pcpu +- fbdev: ssd1307fb: defer I2C transfers from damage callbacks +- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready +- !27568 ub: ub_fwctl: Modify some issues related to validation types. +- RDMA/rxe: Fix OOB in free_rd_atomic_resources() +- !27682 xsched: fix build failure without CONFIG_XCU_SCHEDULER +- !25659 mm: reliable: vmscan: bail out early for MOVABLE-bound direct reclaim +- !27701 urma: restore jetty references when set_jetty_opt fails +- !27700 urma: fix token reference count on segment unregister failure +- urma: restore jetty references when set_jetty_opt fails +- urma: fix token reference count on segment unregister failure +- !27437 urma: fix authentication of ubagg exchange messages +- mm: reliable: forbid swapon when mem-reliable is enabled +- mm: reliable: bail out early for MOVABLE-bound direct reclaim +- xsched: fix build failure without CONFIG_XCU_SCHEDULER +- !27424 mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() +- mm: fix double initialization race in mm_counter_try_switch_to_pcpu +- ub: ub_fwctl: Modify some issues related to validation types. +- hugetlb: only adjust reservation during unmapping if mapcount is 0 +- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() +- mm/hugetlb: do not call vma_add_reservation upon ENOMEM +- mm/hugetlb: restore the reservation if needed +- urma: fix authentication of ubagg exchange messages +- ub: obmm: fix ownership counter overflow and asymmetric rollback. +- ub: obmm: fix exit UAF and allocator access/leak. + +* Wed Sep 16 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-173.0.0.155 +- !27315 urma: add kabi-reserve +- !27570 urma: eagerly create well-known jetty on device attach +- urma: eagerly create well-known jetty on device attach +- !27066 [OLK-6.6] Venice ATL support patches for openEuler OLK-6.6 +- !26842 [OLK-6.6] Backport IBS Enhancements and tooling updates +- !27347 x86/cpu: Hygon: Rename X86_FEATURE_HV_INUSE_WR_ALLOWED to csv3 in /proc/cpuinfo +- !27533 KVM: arm64: vgic-v3: Restrict ICH_AP1Rn_EL2 accesses to 64-bit only with vNMI +- KVM: arm64: vgic-v3: Restrict ICH_AP1Rn_EL2 accesses to 64-bit only with vNMI +- urma: add reserve field +- x86/cpu: Hygon: Rename X86_FEATURE_HV_INUSE_WR_ALLOWED to csv3 in /proc/cpuinfo +- perf test: Change all remaining #!/bin/sh to #!/bin/bash +- perf test amd ibs: avoid using executable heap +- perf doc: Document new IBS capabilities in man page +- perf amd ibs: Decode Streaming-store flag in IBS OP raw dump +- perf amd ibs: Decode Remote-Socket flag in IBS OP raw dump +- perf amd ibs: Make Fetch status bits dependent on PhyAddrValid for newer platforms +- perf amd ibs: Suppress bogus TlbRefillLat and DCPhysAd on Zen4+ +- perf amd ibs: Incorporate Zen5 DTLB and PageSize information +- perf amd ibs: Add Load Latency bits in raw dump +- perf doc: Add AMD IBS usage document +- perf test ibs: Skip privilege test on Zen6 and newer platforms +- perf test: AMD IBS swfilt skip kernel tests if paranoia is >1 +- perf test: Add AMD IBS sw filter test +- perf tool ibs: Sync AMD IBS header file +- perf/x86/amd/ibs: Fix comment typo in ibs_op_data +- perf test amd ibs: Add sample period unit test +- perf/amd/ibs: Advertise remote socket capability +- perf/amd/ibs: Enable streaming store filter +- perf/amd/ibs: Enable RIP bit63 hardware filtering +- perf/amd/ibs: Enable fetch latency filtering +- perf/amd/ibs: Support IBS_{FETCH|OP}_CTL2[Dis] to eliminate RMW race +- perf/amd/ibs: Add new MSRs and CPUID bits definitions +- perf/amd/ibs: Define macro for ldlat mask and shift +- perf/amd/ibs: Avoid race between event add and NMI +- perf/amd/ibs: Preserve PhyAddrVal bit when clearing PhyAddr MSR +- perf/amd/ibs: Limit ldlat->l3missonly dependency to Zen5 +- perf/amd/ibs: Account interrupt for discarded samples +- RAS/AMD/ATL: Require PRM support for future systems +- RAS/AMD/ATL: Translate normalized to system physical addresses using PRM +- ACPI: PRM: Add acpi_prm_handler_available() +- RAS/AMD/ATL: Return error codes from helper functions + +* Tue Sep 15 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-171.0.0.154.20260915.851f72ee48a0 +- !27396 [OLK-6.6] Fix CVE-2026-80761 +- !27398 [OLK-6.6] Fix CVE-2026-80762 +- !27495 ub: udma: fix a bug of set cqe_base_addr. +- !27386 urma: remove mutex_destroy before hw unimport in ubcore_unimport_jetty/jfr +- !27375 urma: add lock and valid check for eid table in ubcore_set_vtp_param +- !27390 urma: check use_cnt before deactivating jfc in ubcore_deactive_jfc +- urma: destroy and re-initialize tjetty/tjfr mutex around hardware unimport +- !27478 eventfs: Initialize ei->children and ei->list in init_ei() +- !27484 tracing: Fix use-after-free with same-name named triggers +- !27489 tracing: Fix crash passing ERR_PTR to kthread_stop() +- !27198 sched/fair: Fix overflow in update_tg_cfs_runnable() +- !27388 urma: fix uobj refcount leak on error path in batch delete interfaces +- urma: check use_cnt before deactivating jfc in ubcore_deactive_jfc +- !27459 cgroup/cpuset: Backport upstream remote partition accounting fixes +- !27392 urma: fix UAF of jfs/jfr/jetty context in async event callbacks +- ub: udma: fix a bug of set cqe_base_addr. +- !27471 [OLK-6.6][linux-6.6.y sync] Backport 6.6.153-6.6.154 LTS Patches +- cgroup/cpuset: Fix incorrect change to effective_xcpus in partition_xcpus_del() +- cgroup/cpuset: Consistently compute effective_xcpus in update_cpumasks_hier() +- cpuset: fix warning when disabling remote partition +- cpuset: remove global remote_children list +- cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition +- urma: fix uobj refcount leak on error path in batch delete interfaces +- urma: fix UAF of jfs/jfr/jetty context in async event callbacks +- cgroup/cpuset: Fix error handling in remote_partition_disable() +- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() +- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation +- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" +- cgroup/cpuset: remove use_parent_ecpus of cpuset +- cgroup/cpuset: Correct invalid remote parition prs +- cgroup/cpuset: remove child_ecpus_count +- cgroup/cpuset: Eliminate unncessary sched domains rebuilds in hotplug +- cgroup/cpuset: Keep track of CPUs in isolated partitions +- !27391 urma: guard is_actived before memcpy in uburma_cmd_active_jfc +- ACPI: HMAT: Mark hmat_set_default_dram_perf() as __init +- tracing: Fix crash passing ERR_PTR to kthread_stop() +- tracing: Fix use-after-free with same-name named triggers +- eventfs: Initialize ei->children and ei->list in init_ei() +- Bluetooth: hci_event: validate LE Set CIG Parameters response +- Bluetooth: hci_event: fix LE list UAF on reset +- HID: hyperv: validate initial device info bounds +- HID: sensor: custom: Fix use-after-free in enable_sensor +- HID: core: fix number/pointer type confusion on long items +- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() +- mptcp: pm: fix memory leak from alloc-during-teardown race +- HID: core: fix OOB read of field->usage in hid_set_field() +- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID +- HID: magicmouse: do not keep a stale msc->input if no input is claimed +- HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C +- mptcp: pm: fix data race in add_addr timer callback +- ASoC: SOF: pcm: Move period/buffer configuration print after platform open +- ASoC: SOF: Relocate and rework functionality for PCM stream freeing +- ASoC: sof: pcm: use snd_pcm_direction_name() +- nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations +- nvmet-fc: fix invalid free in LS IOD error path +- nvmet-auth: zero the AUTH_RECEIVE response buffer +- ipv6: fix use-after-free in ip6_finish_output2() +- ipv4: reject undersized MTUs in ip_do_fragment() +- Input: byd - synchronize timer deletion before freeing private data +- ndisc: ndisc_send_redirect() cleanup +- nfc: nci: free destination parameters when closing a connection +- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers +- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() +- nfc: st21nfca: validate ATR_REQ length against the received frame +- nfc: pn533: purge fragmented skbs during cleanup +- nfc: llcp: reject PDUs shorter than the LLCP header +- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers +- nfc: llcp: bound the connect_sn TLV walk to the skb +- nfc: microread: validate target discovery payload lengths +- nfc: fdp: bound the device-reported read length and fix an skb leak +- nfc: digital: clamp SENSF_RES length to the destination buffer +- drm/amdgpu: check ASPM on the dGPU host link +- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix +- drm/amd/display: Fix BT2020 YCbCr limited/full range input +- drm/amd/amdgpu: disable ASPM in some situations +- s390/vfio_ccw: Implement a crw lock +- s390/vfio_ccw: Calculate idal length based on idaw type +- s390/vfio_ccw: Free all memory if cp_init() fails +- gpio: ml-ioh: use raw_spinlock_t for the register lock +- xfs: validate attr entry pointer before field access +- ext4: clear error before retrying inode xattr space fallback +- ext4: stop retrying saturated xattr cache entries +- kcov: fix data corruption and race conditions on PREEMPT_RT +- null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows +- ocfs2: fix missing metadata reservation for large xattrs +- ALSA: dummy: Check card index validity at probe +- serial: sc16is7xx: convert bitmask definitions to use BIT() macro +- serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants +- serial: qcom-geni: fix TX DMA buffer flush +- NTB: ntb_netdev: Preserve RX queue depth on allocation failure +- rndis_host: add overflow check in rndis_rx_fixup() +- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept +- PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems +- urma: add lock and valid check for eid table in ubcore_set_vtp_param +- Bluetooth: hci_sync: Fix accept list UAF during suspend +- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() +- Bluetooth: ISO: zero the sockaddr before returning it in getname +- urma: guard is_actived before memcpy in uburma_cmd_active_jfc +- sched/fair: Fix overflow in update_tg_cfs_runnable() + +* Mon Sep 14 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-171.0.0.154.20260914.abbb6dbfc651 +- !27475 bpf: Reject key-less BTF for hash maps +- !27468 RDMA/hns: Fix GID capacity loss in 64K system +- RDMA/hns: Fix GID capacity loss in 64K system +- RDMA/hns: Limit gmv_entry_num to avoid memory waste +- RDMA/hns: Use u32 for gid_table_len +- bpf: Reject key-less BTF for hash maps +- !27438 urma: fix uobj UAF on partial batch destroy failure +- !27453 bugfix for dpool +- !27348 Fix CVE-2026-80786 +- !27259 [bugfix]:Fix CSV3 boot failure +- mm: skip mTHP swapin in dpool +- mm/dpool: hide dpool related files if not enabled +- mm/dpool: allow longterm pin for dpool +- dpool: fix compile error for CONFIG_MEMORY_RELIABLE +- mm/dpool: fix race between fill_pool and page_in_dynamic_pool +- dpool: Fix refcount leak when page not in dpagelist +- urma: fix uobj UAF on partial batch destroy failure +- fbdev: Wrap user-invoked calls to fb_set_var() in helper +- KVM: SVM: CSV: Explicitly enable LBR Virtualization after succeed to RECEIVE_ENCRYPT_CONTEXT +- KVM: SVM: CSV: Explicitly enable LBR Virtualization after succeed to LAUNCH_ENCRYPT_VMCB +- KVM: SVM: CSV: Explicitly enable LBR Virtualization after succeed to RECEIVE_UPDATE_VMSA + +* Sun Sep 13 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-171.0.0.154.20260913.71147aafe0b9 +- !27443 KVM: arm64: virtcca: support passing RPV to cVM +- feat(kvm): support passing RPV to virtcca cVM + +* Sat Sep 12 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-171.0.0.154.20260912.f72428526704 +- !27423 urma: drop jfe lock around fasync_helper calls +- !27433 urma: allow NO order type for UM with CTP +- urma: allow NO order type for UM with CTP +- !27420 KVM: arm64/x86: Merge multiple bugfixes (MTE tag ref leak, stale vcpu->mode read, stage2 MMU dangling pointer, etc.) +- urma: drop jfe lock around fasync_helper calls +- KVM: arm64: Don't leave mmu->pgt dangling on kvm_init_stage2_mmu() error +- KVM: x86: Ensure vcpu->mode is loaded from memory in kvm_vcpu_exit_request() +- KVM: x86: Retry to-be-emulated insn in "slow" unprotect path iff sp is zapped +- KVM: arm64: Release pfn, i.e. put page, if copying MTE tags hits ZONE_DEVICE +- KVM: arm64: Fix double-free following kvm_pgtable_stage2_free_unlinked() +- KVM: x86/mmu: Check for leaf SPTE when clearing dirty bit in the TDP MMU +- KVM: arm64: Always invalidate TLB for stage-2 permission faults + +* Fri Sep 11 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-171.0.0.154.20260911.094a9774dc69 +- !27372 mm: zram_reclaim: reject malformed enable input +- !27322 workqueue: Make flush_workqueue() cost scale with active pwqs +- !27335 [OLK-6.6][linux-6.6.y sync] Backport 6.6.152-6.6.153 LTS Patches +- drm/amdgpu: Fix VCE 3 ring align_mask +- vxlan: Do not alloc tstats manually +- binfmt_misc: use exe_file_deny_write_access() for the interpreter clone +- net/x25: fix use-after-free of the socket by its timers +- net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG +- m68k: Define NR_CPUS to 1 +- m68k: use the coherent DMA code for coldfire without data cache +- dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol +- af_packet: Don't send zero-byte data in tpacket_snd(). +- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers +- net/tls: Fail tls_sw_splice_read() after a failed async decrypt +- net: packet: fix wrong transport_header when sending VLAN-tagged frame +- netfilter: ipset: let destroy callbacks adjust ext mem size +- netfilter: ipset: fix list type element drift bug +- netfilter: flowtable: publish GC-visible tuple last +- netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path +- crypto: ccm - Set rfc4309 maxauthsize from child +- arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 +- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini +- drm/amd/pm: fix pptable use-after-free +- drm/amd/pm: fix torn gpu metrics reads +- can: rcar_canfd: change the initializing flow for clocks and resets +- i2c: iproc: reset bus after timeout if START_BUSY is stuck +- i2c: bcm-iproc: remove printout on handled timeouts +- ice: fix VF interrupts cleanup +- fs: don't block write during exec on pre-content watched files +- ksmbd: reject repeated SMB2 NEGOTIATE requests +- ksmbd: conn lock to serialize smb2 negotiate +- igc: remove napi_synchronize() in igc_down() +- ASoC: tas2562: Validate values for volume writes +- btrfs: zoned: fix missing chunk metadata reservation +- btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg() +- btrfs: add space_info argument to btrfs_chunk_alloc() +- btrfs: add debug build only WARN +- tcp: fast path functions later +- ksmbd: validate minimum PDU size for transform requests +- smb/server: fix minimum SMB2 PDU size +- smb/server: fix minimum SMB1 PDU size +- ksmbd: rename smb2_get_msg to smb_get_msg +- smb/server: rename include guard in smb_common.h +- smb: move get_rfc1002_len() to common/smbglob.h +- smb: move smb_version_values to common/smbglob.h +- super: fix emergency thaw deadlock on frozen block devices +- userfaultfd: prevent registration of special VMAs +- userfaultfd: move vma_can_userfault out of line +- mm: userfaultfd: add pgtable_supports_uffd_wp() +- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP +- ceph: Use a folio in ceph_page_mkwrite() +- ceph: Remove ceph_writepage() +- RISC-V: Provide pgtable_l5_enabled on rv32 +- xfs: check v5 superblock features early +- xfs: only check mergeability of bnobt records +- drm/amdgpu: disallow multiple FENCE chunks in one submit +- drm/amdgpu: Fix UVD dpb min size calculation for H264 +- drm/amdgpu: Fix UVD min buffer sizes +- drm/amdgpu: Implement insert_end for VCE 3 +- drm/amdgpu: Reject UVD message with dimensions above 4096 +- drm/amdgpu: Reject UVD message with invalid number of h265 refs +- s390/vfio_ccw: Selectively expand io_mutex +- s390/vfio_ccw: Fix out of bounds check on CCW array +- s390/vfio_ccw: Ensure index for read/write regions are within range +- drm/radeon: fix autosuspend cleanup during teardown +- mmc: sdhci: make tuning_err a signed int +- mmc: sdhci: unmap the bounce buffer before device release +- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit +- libceph: tolerate addrvecs with multiple entries of the same type +- ceph: fix MDS random selection readiness predicate +- Input: sur40 - fix V4L error path cleanup +- Input: sur40 - fix input device registration ordering +- ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() +- ftrace: Protect direct_functions in ftrace_find_rec_direct +- crypto: qce - fix error path in devm_qce_register_algs +- Input: hynitron_cstxxx - validate touch count and finger IDs +- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue +- powerpc/pseries: lparcfg - fix kbuf[] underflow +- Input: iforce - validate input packet lengths +- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard +- Input: psxpad-spi - set driver data before use +- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet +- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo +- powerpc/pseries: pci - logic bug +- Input: xpad - add support for ZENAIM LEVERLESS +- drm/amdgpu: fix aperture iounmap skipped on device removal +- fbdev: core: Fix pointer desynchronization in fb_io_read() +- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses +- ASoC: cs35l41: sort the register default table +- ASoC: cs35l45: sort the register default table +- ASoC: cs4265: sort the register default table +- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() +- s390/qeth: validate user buffer length in SNMP and ARP query ioctls +- mptcp: options: reset DSS fields in case of unexpected size +- selftests: mptcp: join: mark tests with data corruption as failed +- selinux: reject an unclaimed class value in security_get_classes() +- selinux: require every boolean value to be defined +- net: mana: Fix EQ leak in mana_remove on NULL port +- ipvs: separate destination availability state +- f2fs: fix UAF issue in f2fs_merge_page_bio() +- !27353 Ethernet: Linkdata: Add dependencies to the SXE2RDMA Kconfig file to resolve ARM64 build issues. +- !27242 [OLK-6.6] Fix CVE-2026-80694 +- !27161 [OLK-6.6] Fix CVE-2026-80540 +- !27160 [OLK-6.6] Fix CVE-2026-80541 +- !27175 [OLK-6.6] Fix CVE-2026-80568 +- !27191 [OLK-6.6] Fix CVE-2026-80569 +- !26606 [OLK-6.6] fix CVE-2026-72200 +- !27245 [OLK-6.6] Fix CVE-2026-80576 +- !27184 [OLK-6.6] Fix CVE-2026-80570 +- !27182 [OLK-6.6] Fix CVE-2026-80581 +- !27179 [OLK-6.6] Fix CVE-2026-80583 +- !27178 [OLK-6.6] Fix CVE-2026-80585 +- !26610 [OLK-6.6] fix CVE-2026-74571 +- !27010 [OLK-6.6] fix CVE-2026-64588 +- !27323 iommufd: Fix race during abort for file descriptors +- Ethernet: Linkdata: Add dependencies to the SXE2RDMA Kconfig file to resolve ARM64 build issues. +- !26286 [OLK-6.6] Fix CVE-2026-74560 +- !27370 urma: reject zero-length batch delete requests +- !27350 CVE-2026-80747 +- iommufd: Fix race during abort for file descriptors +- urma: reject zero-length batch delete requests +- mm: zram_reclaim: reject malformed enable input +- drm/amdkfd: Add bounds check for CRAT subtype length +- drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length +- workqueue: Make flush_workqueue() visit only pwqs active since the last flush +- workqueue: Maintain pwq->total_in_flight +- drm/amdgpu: reject oversized IBs with per-ring packet limits +- drm/amdgpu: add VPE RING TYPE definition +- drm/amdgpu: add VPE HW IP definition +- net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller +- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer +- mptcp: fastopen: only mark MPTFO subflows with SYN data +- Input: synaptics-rmi4 - zero report size on F54 work error +- ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout +- ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses +- Input: synaptics-rmi4 - block s_input when F54 queue is busy +- drm/amdgpu: Fix UVD decode image min size calculation +- drm/amdgpu: validate GEM_CREATE domain combinations +- fuse-uring: fix data races on ring->ready +- ntfs: detect mapping-pairs LCN accumulator overflow +- btrfs: skip global block reserve accounting for rescue mounts +- xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx + +* Thu Sep 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-171.0.0.154.20260910.6b19f31977cc +- !27349 urma: validate opt buffer length in uburma set/get opt commands +- !27033 backport cpufreq patches from linux mainline on August 31st. +- urma: validate opt buffer length in uburma set/get opt commands +- !27339 Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero +- !27210 Revert "media: v4l2-dev: fix error handling in __video_register_device()" +- Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero +- !27334 Bluetooth: ISO: hold sk properly in iso_conn_ready +- !27331 CVE-2026-74534 && CVE-2026-74535 +- !27329 md/raid1,raid10: fix error-path detection with md_cloned_bio() +- !27328 netfilter: nf_tables: Fix CVE-2026-72252 +- !27325 net/sched: cls_bpf: reject dev-bound programs bound to a different device +- !27330 net: sched: Fix CVE-2026-74700 +- !27333 net: Fix CVE-2026-53091 +- !27326 urma: fix use-after-free in bind_jetty error path +- Bluetooth: ISO: hold sk properly in iso_conn_ready +- net: iptunnel: fix stale transport header during tunnel decapsulation +- xfrm: Don't clobber inner headers when already set +- net: pull headers in qdisc_pkt_len_segs_init() +- net: qdisc_pkt_len_segs_init() cleanup +- net: account for encap headers in qdisc pkt len +- Bluetooth: ISO: fix refcounting of iso_conn +- net/sched: preserve kABI for tcf_proto and tcf_block +- net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers +- net: sched: refine software bypass handling in tc_run +- net: sched: cls_api: fix slab-use-after-free in fl_dump_key +- net: sched: make skip_sw actually skip software +- net: sched: cls_api: add filter counter +- net: sched: cls_api: add skip_sw counter +- md/raid1,raid10: fix error-path detection with md_cloned_bio() +- Bluetooth: ISO: avoid deadlocks in iso_sock_timeout +- !27167 iommu/ummu: Optimize MAPT for multi block_base_size +- netfilter: nf_tables: clone set on flush only +- netfilter: nft_set_pipapo: don't leak bad clone into future transaction +- netfilter: nft_set_pipapo: move cloning of match info to insert/removal path +- netfilter: nft_set_pipapo: merge deactivate helper into caller +- urma: fix use-after-free in bind_jetty error path +- netfilter: nft_set_pipapo: prepare walk function for on-demand clone +- netfilter: nft_set_pipapo: make pipapo_clone helper return NULL +- netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR +- netfilter: nf_tables: missing objects with no memcg accounting +- !26215 [OLK-6.6] Fix CVE-2026-74257 +- !27320 xfrm: fix sk_dst_cache double-free in xfrm_user_policy() +- !27285 Fix CVE-2026-80738 +- !27261 nbd: boost nbd setup +- !27297 urma: fix tpid_uobj leak on import error path +- net/sched: cls_bpf: reject dev-bound programs bound to a different device +- cpufreq: userspace: Fix read behavior of scaling_setspeed +- ACPI:processor_idle: Clear per-CPU cpuidle_device pointer before kfree +- ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+ +- ACPI: CPPC: Add support for CPPC v4 +- urma: fix tpid_uobj leak on import error path +- xfrm: fix sk_dst_cache double-free in xfrm_user_policy() +- cpufreq: CPPC: Optimize feedback counter sampling based on BIOS FFH capability +- arm64: topology: read CPPC FFH feedback counters in one operation +- ACPI: CPPC: add paired FFH feedback-counter read hook +- bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie +- nbd: add pre_defined_connections module parameter for pre-created devices +- nbd: remove queue freeze for newly created nbd from netlink path +- nbd: factor out a nbd_genl_foreach_sock +- nbd: remove queue freeze in nbd_add_socket +- nbd: disallow NBD_SET_SOCK on an active device +- Revert "nbd: simplify find_fallback() by removing redundant logic" +- Revert "nbd: replace socks pointer array with xarray" +- Revert "nbd: remove redundant num_connections boundary checks" +- Revert "nbd: remove queue freeze in nbd_add_socket" +- iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect +- iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID +- iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency +- iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get +- iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB +- Revert "media: v4l2-dev: fix error handling in __video_register_device()" +- cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged +- iommu/ummu: Fix permission leak after software state update failure +- iommu/ummu: Optimize MAPT for multi block_base_size +- iommu/ummu: Fix unit mismatch and unmap leak in map_pages +- Revert "cpufreq: CPPC: Keep the target core awake when reading its cpufreq rate" +- sockmap: Fix use-after-free in udp_bpf_recvmsg() + +* Wed Sep 09 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-171.0.0.154 +- !27229 urma: fix concurrent issue of device unregister and netns exit +- !26207 [OLK-6.6] Fix CVE-2026-72469 +- !26192 [OLK-6.6] Fix CVE-2026-72434 +- !22228 Add Nebula-matrix S1000 series RDMA driver +- !27252 ub:ubus: ub_static_bus_instance_uninit will do nothing if ubc->bi is null +- !26049 [OLK-6.6][Intel-SIG] PMU core event update for Intel platforms +- !26725 [OLK-6.6] Fix CVE-2026-74592 +- !26846 [OLK-6.6] Fix CVE-2026-74735 +- !26140 [OLK-6.6] Fix CVE-2026-72073 +- !26659 [OLK-6.6] ub: ubaseproxy: support chip anti-attack protection +- !26984 [OLK-6.6] Fix CVE-2026-80676 +- !27283 sctp: fix addr_wq_timer race in sctp_free_addr_wq() +- !27284 net: usb: ipheth: fix carrier_work UAF on disconnect +- !27293 libceph: fix multiple unsafe decodes in decode_locker() +- !27286 mm/huge_memory: fix huge_zero_pfn race +- !27291 Fix CVE-2026-68096 +- !26998 vhost_iotlb: bound map allocation in add_range +- !26211 [OLK-6.6] Fix CVE-2026-72495 +- !26226 [OLK-6.6] Fix CVE-2026-74334 +- !27280 media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work +- !27065 *** fix CVE-2026-72454 *** +- libceph: fix multiple unsafe decodes in decode_locker() +- !26954 [OLK-6.6] net: LTS-6.6.90 backport +- audit: fix recursive locking deadlock in audit_dupe_exe() +- audit: use 'unsigned int' instead of 'unsigned' +- audit: widen ino fields to u64 +- VFS/audit: introduce kern_path_parent() for audit +- !27269 urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty +- !27274 【CVE-2026-80692】Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks +- !26257 [OLK-6.6] Fix CVE-2026-74482 +- mm/huge_memory: fix huge_zero_pfn race +- net: usb: ipheth: fix carrier_work UAF on disconnect +- sctp: fix addr_wq_timer race in sctp_free_addr_wq() +- !26787 [OLK-6.6] Fix CVE-2026-74725 +- !26809 Fix CVE-2026-68289 +- !26201 [OLK-6.6] Fix CVE-2026-72440 +- !26194 [OLK-6.6] Fix CVE-2026-72438 +- !26195 [OLK-6.6] Fix CVE-2026-72439 +- media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work +- ub:ubus: Fix msn is reclaimed twice after msg ageing issue +- urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty +- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks +- ub:ubus: ub_static_bus_instance_uninit will do nothing if ubc->bi is null +- urma: fix concurrent issue of device unregister and netns exit +- ub: ubase&ubaseproxy: support cmdq rate-limit +- i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() +- i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler +- i3c: mipi-i3c-hci: Consolidate spinlocks +- vhost_iotlb: bound map allocation in add_range +- Drivers: hv: vmbus: use generic driver_override infrastructure +- net: Fix kabi breakage of struct sk_buff and inet_frag_queue +- Bluetooth: L2CAP: copy RX timestamp to new fragments +- net: Rename mono_delivery_time to tstamp_type for scalabilty +- l2tp: fix tunnel and session refcount leak on seq_file release +- tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() +- enic: fix tx_hang_reset use-after-free on device removal +- ima: Instantiate file_truncate and path_truncate hooks +- Add Nebula-matrix S1000 series RDMA driver +- mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios +- RDMA/nldev: Fix locking when accessing mr->pd +- RDMA/core: Add an option to display driver-specific QPs in the rdmatool +- RDMA/bnxt_re: Avoid repeated requests to allocate WC pages +- xprtrdma: Fix ep kref imbalance on ADDR_CHANGE +- md/raid1: fix writes_pending and barrier reference leaks on write failures +- md/raid10: fix writes_pending leak on write request failures +- md/raid10: fix writes_pending and barrier reference leaks on discard failures +- netfilter: ipset: make sure gc is properly stopped +- mmc: vub300: fix use-after-free on probe failure +- perf/x86/intel: Update event constraints and cache_extra_regsfor CWF +- perf/x86/intel: Update event constraints and cache_extra_regsfor SRF +- perf/x86/intel: Update event constraints for PTL +- perf/x86/intel: Update event constraints and cache_extra_regsfor ARL +- perf/x86/intel: Add Panther Lake support +- perf/x86/intel: Update event constraints and cache_extra_regsfor LNL +- perf/x86/intel: Update event constraints and cache_extra_regsfor MTL +- perf/x86/intel: Update event constraints and cache_extra_regsfor ADL +- perf/x86/intel: Move intel_grt_event_constraints +- ub: ubaseproxy: add debugfs support for querying +- ub: ubaseproxy: Add debugfs support for querying SEID +- ub: ubaseproxy: Support verification of seid idx when +- ub: ubaseproxy: SL verification is supported during +- ub: ubaseproxy: implement UE jetty group context +- ub: ubaseproxy: Add UE Jetty context parameter +- ub: ubase&ubaseproxy: Add reset notification handling +- ub: ubaseproxy: Add JFR context lifecycle management +- ub: ubaseproxy: Support ue enabling and disabling +- ub: ubaseproxy: add debugfs support for ubaseproxy +- ub: ubaseproxy: Support for UE context VA management in +- ub: ubaseproxy: implement UE RC context lifecycle +- ub: ubaseproxy: implement UE EQ context lifecycle +- ub: ubaseproxy: implement UE JFR context lifecycle +- ub: ubaseproxy: implement UE JFS context lifecycle +- ub: ubaseproxy: implement UE JFC context management +- ub: ubaseproxy: Supports forwarding of crq and sqe +- ub: ubaseproxy: supports ue context specification +- ub: ubaseproxy: supports installation and + +* Tue Sep 08 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-170.0.0.153.20260908.10c6d570091f +- !27270 bpf: Fix NMI/tracepoint re-entry deadlock on lru locks +- !26181 [OLK-6.6] Fix CVE-2026-72370 +- !26223 [OLK-6.6] Fix CVE-2026-74307 +- !27201 ovl: check access to copy_file_range source with src mounter creds +- !27200 iomap: guard io_size EOF trim against concurrent truncate underflow +- !27137 KVM: arm64: Fix kvm_vcpu_initialized() macro parameter +- !26978 [OLK-6.6] Fix CVE-2026-80666 +- !26985 [OLK-6.6] Fix CVE-2026-80683 +- bpf: Fix NMI/tracepoint re-entry deadlock on lru locks +- !26899 Fix CVE-2026-74672 +- !27228 bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk +- !26218 [OLK-6.6] Fix CVE-2026-74269 +- !27258 net/mlx5: LAG, Fix off-by-one in single-FDB error rollback +- !27214 netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag +- !27263 CVE-2026-72397 +- !27254 urma: verify the maximum value of a config +- hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() +- !27235 PCI: Check ROM header and data structure addr before accessing +- !27230 [olk-6.6] zram_reclaim +- !26981 [OLK-6.6] Fix CVE-2026-80670 +- !27169 bpf: keep RVI cpumask kfunc separate +- !27256 ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD +- net/mlx5: LAG, Fix off-by-one in single-FDB error rollback +- !26841 [OLK-6.6] Fix CVE-2026-80521 +- urma: verify the maximum value of a config +- !27247 serial: amba-pl011: synchronize DMA teardown +- !27246 selinux: reject a permission value exceeding the class permission count +- ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD +- serial: amba-pl011: synchronize DMA teardown +- selinux: reject a permission value exceeding the class permission count +- PCI: Check ROM header and data structure addr before accessing +- PCI: Introduce named defines for PCI ROM +- bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk +- arm64/defconfig: enable CONFIG_ZRAM_RECLAIM +- mm: add per-memcg reclaim policy for compressed-swap environments +- netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag +- bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs +- bpf: Add bpf_cpumask_weight() kfunc +- bpf: keep RVI cpumask kfunc separate +- ovl: check access to copy_file_range source with src mounter creds +- iomap: guard io_size EOF trim against concurrent truncate underflow +- KVM: arm64: Fix kvm_vcpu_initialized() macro parameter +- Bluetooth: SCO: give the socket its own sco_conn reference +- perf tools: Use perf_env__get_cpu_topology() in machine__resolve() +- perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu +- Bluetooth: sco: Fix a race condition in sco_sock_timeout() +- mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF +- af_unix: Unlink scc_entry in unix_del_edge(). +- mm/zsmalloc: change back to per-size_class lock +- mm/zsmalloc: remove get_zspage_mapping() +- mm/zsmalloc: remove_zspage() don't need fullness parameter +- mm/zsmalloc: remove set_zspage_mapping() +- mm/zsmalloc: remove unused zspage->isolated +- mm/zsmalloc: remove migrate_write_lock_nested() +- mm/zsmalloc: fix migrate_write_lock() when !CONFIG_COMPACTION +- ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT +- bnxt: fix head underflow on XDP head-grow +- iomap: release pages on atomic dio size mismatch + +* Mon Sep 07 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-170.0.0.153.20260907.19669cca8c22 +- !26779 [OLK-6.6] Fix CVE-2026-74711 +- !26180 [OLK-6.6] Fix CVE-2026-72341 +- !27146 smb: client: backport fixes for CVE-2026-72031 +- !27218 Fix CVE-2026-80756 +- !27216 Fix CVE-2026-80757 +- !26019 urma: add check type in free driver obj +- !27180 cputype: add cputype for HIP13 +- urma: remove GENL_ADMIN_PERM for show system command +- !27171 netfilter: nft_lookup: fix catchall element handling with inverted lookups +- !27212 drivers/ub/sentry: fix binary msg printed as string in UVB callback +- selinux: do not cancel a policy conversion that never started +- selinux: reject a class permission count below its inherited common +- drivers/ub/sentry: fix binary msg printed as string in UVB callback +- !27074 net: mana: Backport fixes for current Azure MANA hosts +- !26136 [OLK-6.6] Fix CVE-2026-72242 +- cputype: add cputype for HIP13 +- netfilter: nft_lookup: fix catchall element handling with inverted lookups +- cifs: fix time_last_write stamp placement in setattr/truncate paths +- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() +- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths +- cifs: prevent readdir from changing file size due to stale directory metadata +- net: mana: Support holes in device list reply msg +- net: mana: Allow variable size indirection table +- net: mana: Avoid open coded arithmetic +- RDMA/mana_ib: Prefer struct_size over open coded arithmetic +- net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 +- hwmon: (pmbus) Fix type confusion in notification logic +- net/mlx5e: Fix publication race for priv->channel_stats[] +- selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() + +* Sun Sep 06 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-170.0.0.153.20260906.dc46c7a0b8e2 +- !26983 [OLK-6.6] Fix CVE-2026-80671 +- !27209 Fix CVE-2026-74264 +- !26227 [OLK-6.6] Fix CVE-2026-74347 +- net: watchdog: fix kabi breakage of struct net_device +- net: do not acquire dev->tx_global_lock in netdev_watchdog_up() +- net: watchdog: fix refcount tracking races +- net: watchdog: rename __dev_watchdog_up() and dev_watchdog_down() +- perf sched: Fix register_pid() overflow, strcpy, and BUG_ON +- netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount + +* Sat Sep 05 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-170.0.0.153.20260905.8f75644388e6 +- !27080 net/sched: serialize qdisc_rtab_list against concurrent get/put +- !27181 Bluetooth: ISO: ensure no dangling hcon references in iso_conn +- !27126 [OLK-6.6] Fix CVE-2026-74605 +- !26288 [OLK-6.6] Fix CVE-2026-74565 +- !26906 Fix CVE-2026-80536 +- Bluetooth: ISO: ensure no dangling hcon references in iso_conn +- eventfs: Use children field for rcu head and add memory barriers +- net/sched: serialize qdisc_rtab_list against concurrent get/put +- xfs: bounds-check buffer log item's dirty bitmap +- netfilter: nf_tables: make nft_object rhltable per table + +* Fri Sep 04 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-170.0.0.153.20260904.3bfa7af22e06 +- !27092 Fix CVE-2026-74543 +- !26190 [OLK-6.6] Fix CVE-2026-72420 +- !27152 [OLK-6.6] ub: ubase: 6 related changes +- !27134 urma: add topology query user control op +- urma: fix ubagg topology lookup for primary and port EIDs +- !26234 [OLK-6.6] Fix CVE-2026-74404 +- !27139 net/mlx5: Fix MCIA register buffer overflow on 32 dword reads +- ub: ubase: Modify timeout interval for waiting IMP and +- !27143 urma: enable uburma irq handle threshold by default +- urma: enable uburma irq handle threshold by default +- !26146 [OLK-6.6] Fix CVE-2026-72098 +- !27099 Fix CVE-2026-74747 +- !27109 Fix CVE-2026-80637 +- !27044 Fix CVE-2026-74715 +- !27047 Fix CVE-2026-74714 +- net/mlx5: Fix MCIA register buffer overflow on 32 dword reads +- bpf: Fix netns reference imbalance in conntrack kfuncs +- netfilter: synproxy: fix unaligned memory access in timestamp adjustment +- ipvs: revalidate ihl to prevent out-of-bounds access +- net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() +- bpf: tcp: fix double sock release on batch realloc +- bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() +- bpf: tcp: Avoid socket skips and repeats during iteration +- bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items +- bpf: tcp: Get rid of st_bucket_done +- bpf: tcp: Make sure iter->batch always contains a full bucket snapshot +- bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch +- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one +- md/raid5: avoid R5_Overlap races while breaking stripe batches +- dm-verity: fix buffer overflow in FEC calculation +- net: unic: Next generation Flush JFS CQE Process +- ub: ubase&unic: Fix encoding alarm issues in the ubase +- ub: ubase: Mailbox interface encoding adjustment +- ub: ubase: Fix the UAF issue +- ub: ubase: Remove the inline modifier from functions + +* Thu Sep 03 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-170.0.0.153.20260903.d44cd7e724ee +- !27128 tcp: clear sock_ops cb flags before force-closing a child socket +- tcp: clear sock_ops cb flags before force-closing a child socket +- !26994 [OLK-6.6] Fix CVE-2026-80725 +- !26228 [OLK-6.6] Fix CVE-2026-74356 +- !26951 vhost: reset the vring metadata cache on vring reconfiguration +- !27104 ub:ub_fwctl:Modifying issues during environment startup. +- ub:ub_fwctl:Modifying issues during environment startup. +- !27076 Bluetooth: hci_sync: Fix advertising data UAFs +- !27055 openeuler_defconfig: Enable Landlock +- !27013 Fix CVE-2026-74691 +- !26137 [OLK-6.6] Fix CVE-2026-72247 +- Bluetooth: hci_sync: add conditional locking annotations +- !27078 workqueue: Reduce expensive locks for unbound workqueue +- workqueue: Reduce expensive locks for unbound workqueue +- Bluetooth: hci_sync: Fix advertising data UAFs +- openeuler_defconfig: Enable Landlock +- net: thunderbolt: Tear down DMA paths before stopping the rings +- net: gro: properly validate BIG TCP aggregation criteria +- vhost: reset the vring metadata cache on vring reconfiguration +- vhost: fix vhost_get_avail_idx for a non empty ring +- netfilter: nf_conncount: fix zone comparison in tuple dedup + +* Wed Sep 02 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-170.0.0.153 +- !27067 Fix CVE-2026-72501 +- !27071 Fix CVE-2026-72496 +- !27073 ub:ubus: check int type cap bit before get vector num +- !26232 [OLK-6.6] Fix CVE-2026-74375 +- !27062 dmaengine: idxd: fix double free of wq, engine, and group structs +- !27070 fs/proc/etmem: drop the x86-only guard around kvm_flush_remote_tlbs() +- !26280 [OLK-6.6] Fix CVE-2026-74544 +- !26729 [OLK-6.6] Fix CVE-2026-74604 +- !26732 [OLK-6.6] Fix CVE-2026-74607 +- !26221 [OLK-6.6] Fix CVE-2026-74291 +- !27077 urma: support stable uburma device numbers +- !26688 [OLK-6.6] x86/mce/amd, EDAC/mce_amd: Backport SMCA new bank types to openEuler OLK-6.6 +- urma: support stable uburma device numbers +- !26709 [OLK-6.6]sched: Fix sparsemask_next() wrap-around termination +- !26808 [OLK-6.6][linux-6.6.y sync] Backport 6.6.151-6.6.152 LTS Patches +- !27068 CVE-2026-74653 +- ub:ubus: check int type cap bit before get vector num +- ub:ubus: Adapt new chip submodule ID +- ub:ubus: The validity of the token response packet length is verified +- !27043 net: fix hard_header_len races in packet send paths +- !26903 tcp: challenge ACK for non-exact RST in SYN-RECEIVED +- !27042 net: pktgen: fix proc entry use-after-free +- RDMA/bnxt_re: Proper rollback if the ioremap fails +- fs/proc/etmem: drop the x86-only guard around kvm_flush_remote_tlbs() +- config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 +- net/sched: fix kabi breakage in struct Qdisc +- regulator: devres: fix devm_regulator_get_enable_read_voltage() return +- net/tcp_sigpool: Use kref_get_unless_zero() +- net/tcp_sigpool: Fix some off by one bugs +- bpf: tcp: fix double sock release on batch realloc +- thunderbolt: Bound the DROM dual link port number before indexing sw->ports +- scsi: scsi_debug: Negate wrapped memcmp() result +- fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() +- ptp: ocp: Fix board ID over-read +- Revert "thermal/drivers/hwmon: Cleanup coding style a bit" +- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page +- vhost: reset the vring metadata cache on vring reconfiguration +- vsock/virtio: avoid refilling the RX queue after teardown +- ovl: don't warn when the mount is completed from another user namespace +- net/sched: act_ct: fix sk_buff leak when the header checks reject a packet +- net: atlantic: free RX pages of consumed but not refilled buffers +- netfilter: bridge: release template ct on non-IP path +- net: smc: fix splice entry lifetime imbalance in smc_rx_splice +- fbdev: bitblit: bound-check glyph index in bit_cursor() +- ALSA: usx2y: bound the hwdep mmap fault offset +- ring-buffer: Fix crash passing ERR_PTR to kthread_stop() +- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free +- misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke +- misc: fastrpc: Remove buffer from list prior to unmap operation +- misc: fastrpc: fix channel ctx ref leak when session alloc fails +- staging: rtl8723bs: validate monitor transmit frame lengths +- staging: rtl8723bs: fix missing shared-key auth challenge length check +- staging: rtl8723bs: fix OOB read in WMM_param_handler() +- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() +- serial: 8250_dma: Clear stale RX state on shutdown +- mei: pull kvfree out of spinlock +- ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops +- selftests/bpf: Adapt sockmap update error handling +- fscrypt: Replace mk_users keyring with simple list +- pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP +- fortify: Disable -Wstringop-overread in tests +- fortify: refactor test_fortify Makefile to fix some build problems +- futex: Prevent robust futex exit race some more +- dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk +- KVM: s390: pci: Fix aisb calculation +- KVM: s390: pci: Fix resource leak on IRQ registration failure +- KVM: s390: pci: Fix missing error codes and memory unaccounting +- net: bridge: mrp: fix uninitialised bytes on the wire +- mac802154: fix netdev use-after-free in beacon worker +- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header +- net: octeontx2-pf: Fix UB in shift operation +- net/sched: reject overly deep qdisc hierarchies +- net: openvswitch: reallocate update replies for mismatched IDs +- packet: use consistent hard_header_len in TX_RING send path +- packet: use consistent hard_header_len in non-ring send paths +- ipvs: properly update the overload flag on dest edit +- ipvs: add totalconns for dest +- ima: fix out-of-bounds read in xattr_verify() +- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get +- vt: add permission check for KDSKBMETA ioctl +- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() +- usb: gadget: f_ncm: Use unsigned int for ndp_index +- usb: cdnsp: fix incorrect endian conversions for APB timeout register +- thunderbolt: icm: Preserve USB4 proxy data-valid bit +- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() +- ALSA: usb-audio: fix OOB write on Type II inbound URBs +- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers +- net: fec: do not release NULL pages when RX buffer allocation fails +- hwmon: (ads7828) Fix external VREF regulator handling +- regulator: devres: add API for reference voltage supplies +- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination +- tls: don't abort the connection on signal-interrupted sends +- net/atm: fix slab-out-of-bounds read in vcc_setsockopt() +- net/tcp: Add TCP-AO config and structures +- net/tcp: Prepare tcp_md5sig_pool for TCP-AO +- ata: pata_sl82c105: fix bridge revision use-after-free +- net: thunderbolt: Tear down DMA paths before stopping the rings +- net/smc: fix TOCTOU race between smc_listen_out() and listener close +- net: remove WARN_ON_ONCE() from sk_mc_loop() +- net: prestera: validate firmware header length +- net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length +- sctp: fix addip_serial increment on ASCONF_ACK allocation failure +- bnxt_en: Fix PTP PPS setting bug +- bnxt_en: Disable EOP for TPA on all chips to prevent data corruption +- bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips +- selftests/ftrace: refactor eprobes test to fix argument checks +- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations +- hwmon: (lm25066) Use i2c_get_match_data() +- hwmon: (nzxt-smart2) Check return value of init_device() in probe +- RDMA/bnxt_re: Initialize dpi variable to zero +- serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx +- serial: 8250: dispatch SysRq character in serial8250_handle_irq() +- serial: 8250: Add serial8250_handle_irq_locked() +- dmaengine: idxd: fix double free of wq, engine, and group structs +- packet: use consistent hard_header_len in TX_RING send path +- packet: use consistent hard_header_len in non-ring send paths +- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header +- net: pktgen: fix proc entry use-after-free +- net/openvswitch: check Ethernet header length in key_extract() +- net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter +- tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() +- vhost/vdpa: reject overflowing PA map page counts on 32-bit +- bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() +- bpf: tcp: Avoid socket skips and repeats during iteration +- bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items +- bpf: tcp: Get rid of st_bucket_done +- bpf: tcp: Make sure iter->batch always contains a full bucket snapshot +- bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch +- counter: microchip-tcb-capture: Fix DT channel validation +- net/mlx5: fw_tracer, return NULL on create error +- devlink: fix net namespace reference leak in reload +- net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete +- net/sched: cls_route: fix fastmap use-after-free on filter +- net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() +- btrfs: fix memory leak in btrfs_do_encoded_write() +- netfilter: ipset: switch ext_size to atomic64_t +- net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock +- Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" +- drm/bridge: ps8640: propagate AUX transfer register errors +- ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt +- ARM: npcm: Fix OF node refcount leaks in SMP setup +- s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() +- selftests/bpf: Fail unbound UDP on sockmap update +- mount: honour SB_NOUSER in the new mount API +- tcp: challenge ACK for non-exact RST in SYN-RECEIVED +- sched: Fix sparsemask_next() wrap-around termination +- KVM: SVM: Serialize accesses to the owner and mirror list with separate lock +- Revert "thermal/drivers/hwmon: Cleanup coding style a bit" +- x86/mce, EDAC/mce_amd: Add new SMCA bank types +- x86/mce, EDAC/mce_amd: Update CS bank type naming +- x86/mce, EDAC/mce_amd: Reorder SMCA bank type enums +- x86/MCE/AMD: Add new MA_LLC, USR_DP, and USR_CP bank types +- x86/mce/amd, EDAC/mce_amd: Move long names to decoder module +- net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds +- md/raid1,raid10: fix deadlock in read error recovery path +- ASoC: topology: Check PCM and DAI name strings before use + +* Tue Sep 01 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-168.0.0.152.20260901.bc7e2c801d2b +- !27064 entry: Fix seccomp bypass after ptrace with TSYNC +- !27057 bpf: Simplify sanitize_err() signature +- !27020 v4 CVE-2026-74314 +- !26861 [OLK-6.6] Fix CVE-2026-80534 +- entry: Fix seccomp bypass after ptrace with TSYNC +- !26908 mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier +- !27021 mainline patch submission for OLK-6.6 +- !27039 CVE-2026-68095 +- !27037 iomap: fix out-of-bounds bitmap_set() with zero-length range +- bpf: Simplify sanitize_err() signature +- !26843 [OLK-6.6] Fix CVE-2026-74734 +- !26970 [OLK-6.6] Fix CVE-2026-80611 +- !26865 [OLK-6.6] Fix CVE-2026-80549 +- !26870 [OLK-6.6] Fix CVE-2026-80560 +- !26963 [OLK-6.6] Fix CVE-2026-80551 +- !26958 iommu/iommufd: Fix IOPF group ownership UAF +- !26219 [OLK-6.6] Fix CVE-2026-74289 +- !27029 ub: udma: fix a bug of log type. +- fuse-uring: check connection abort during ring creation +- fuse-uring: fix race between registration and connection abortion +- iomap: fix out-of-bounds bitmap_set() with zero-length range +- ub: udma: fix a bug of log type. +- bpf: Fix WARNING in bpf_tracing_link_release +- bpf: Zero queue and stack outputs on lock failure +- bpf: Clear buf on error in __bpf_get_task_stack +- bpf: Reject negative optlen in cgroup getsockopt hook +- bpf: Fix kabi breakage for struct bpf_mem_alloc +- bpf: Cancel special fields on map value recycle +- bpf: Register dtor for freeing special fields +- bpf: Extract internal structs validation logic into helpers +- bpf: htab: extract helper for freeing special structs +- bpf: Factor out htab_elem_value helper() +- bpf: Do not walk twice the hash map on free +- ACPI: processor_idle: Mark LPI enter functions as __cpuidle +- s390/vfio_ccw: Ensure first IDAW remains constant +- iommu/iommufd: Fix IOPF group ownership UAF +- mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier +- memory tier: fix deadlock warning while onlining pages +- memory tier: consolidate the initialization of memory tiers +- memory tier: create CPUless memory tiers after obtaining HMAT info +- memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types +- mm/demotion: print demotion targets +- acpi,mm: fix typo sibiling -> sibling +- openrisc: signal: do not restore privileged SR bits on sigreturn +- s390/vfio_ccw: Move cp cleanup out of not operational +- s390/vfio_ccw: Cancel existing workqueues +- xfs: fix ilock leak on error in xfs_dq_get_next_id +- firewire: ohci: fix NULL pointer dereference in ar_context_release +- ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). + +* Mon Aug 31 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-168.0.0.152.20260831.4a1b6c57d72e +- !26904 [OLK-6.6][linux-6.6.y sync] Backport 6.6.154-6.6.155 LTS Patches +- !26812 Fix CVE-2026-72413 +- !26997 CVE-2026-74730 +- !26941 ub:ubus: Enhance the validation of UE MAP in VDM +- NFS: Decrement refcounts if allocating nfs_free_stateid_data fails +- NFS: Pin the 'struct nfs_server' during a FREE_STATEID call +- !26832 bpf: Preserve pointer state for commuted arithmetic +- !26953 tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg +- tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg +- ub:ubus: Enhance the validation of UE MAP in VDM +- ub:ubus: Fix the issue of insufficient kfifo in routing +- ub:ubus: Roll back the cna_maps of the port +- ub:ubus: The validity of the queue depth of the IO decoder is checked +- ub:ubus: Fix the interrupt_id leak in usi +- ub:ubus: Fix rx_msg_wq teardown race by reversing ub_host_remove order +- ub:ubus: solve UAF issue for ub_ioctl_bus_instance_destroy +- inet: frags: strip GSO state from fragments before reassembly +- bpf: Preserve pointer state for commuted arithmetic +- sctp: fix err_chunk memory leaks in INIT handling + +* Sun Aug 30 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-168.0.0.152.20260830.9dbe52cd302d +- !26989 Backport patches from 6.6 lts to fix network cve +- !26952 tls: rx: restore msg_iter before TLS 1.3 optimistic retry +- inet: frags: publish queues before arming timer +- inet: frags: save a pair of atomic operations in reassembly +- inet: frags: change inet_frag_kill() to defer refcount updates +- ipv4: frags: remove ipq_put() +- !26473 urma: fix ipourma to be a proper L3 device and reset skb headers on rx +- !26979 urma: defer uburma jfce heavy work out of irq top-half to tasklet +- inet: frags: add inet_frag_putn() helper +- ipvs: clear IPv4 options after rebasing tunnel ICMP errors +- !26962 Fix CVE-2026-72329 +- !26840 [OLK-6.6] Fix CVE-2026-80589 +- veth: convert frag_list skbs before running XDP +- !26973 Fix CVE-2026-80557 +- !26786 [OLK-6.6] Fix CVE-2026-74724 +- !26654 [OLK-6.6] Fix CVE-2026-74589 +- !26771 [OLK-6.6] Fix CVE-2026-74684 +- !26764 [OLK-6.6] Fix CVE-2026-74670 +- !26945 perf: Reject exited events as group leaders +- !26853 [OLK-6.6] Fix CVE-2026-74748 +- !26734 [OLK-6.6] Fix CVE-2026-74610 +- !26745 [OLK-6.6] Fix CVE-2026-74624 +- !26739 [OLK-6.6] Fix CVE-2026-74615 +- urma: defer uburma jfce heavy work out of irq top-half to tasklet +- !26753 [OLK-6.6] Fix CVE-2026-74656 +- libceph: fix OOB read in decode_watchers() via missing bounds check +- net/liquidio: drop cached VF pci_dev LUT +- tls: rx: restore msg_iter before TLS 1.3 optimistic retry +- perf: Reject exited events as group leaders +- urma: fix ipourma to be a proper L3 device and reset skb headers on rx +- netfilter: ipset: fix refcount race between list:set GC and swap +- block: stop the timeout timer when releasing a never added disk +- ipvs: avoid out-of-bounds write in ip_vs_nat_icmp +- net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() +- ipvs: stop estimator after disabled calc phase +- ipv4: fix use-after-free in fib_nhc_update_mtu() +- netfilter: nf_conntrack: defer invalid log until after unlock +- vxlan: do not arm the ageing timer on a device that is down +- tls: don't leave a full plaintext sk_msg ring unpushed +- bpf, sockmap: Fix sk_redir use-after-free in send verdict + +* Sat Aug 29 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-168.0.0.152.20260829.016815a9e1a4 +- !26778 [OLK-6.6] Fix CVE-2026-74705 +- !26834 ceph: avoid fs reclaim while using current->journal_info +- !26942 [Backport] sctp: add INIT verification after cookie unpacking +- !26929 sctp: clear control chunk transport if it is being removed +- !24935 urma: prevent JFC event UAF after delete failure +- !26044 KVM: arm64:Add pvqspinlock +- !26914 ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path +- !26761 [OLK-6.6] Fix CVE-2026-74667 +- !26746 [OLK-6.6] Fix CVE-2026-74630 +- !26727 [OLK-6.6] Fix CVE-2026-74598 +- !26851 [OLK-6.6] Fix CVE-2026-74744 +- !26944 Fix CVE-2026-74587 +- !26937 [OLK-6.6] Fix CVE-2026-68082 +- !26926 libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE +- !26935 tipc: read le->link under the node lock in tipc_node_link_down() +- !26927 sctp: clear new_transport when removing a peer +- !26655 [OLK-6.6] Fix CVE-2026-74591 +- !26869 [OLK-6.6] Fix CVE-2026-80558 +- sctp: add INIT verification after cookie unpacking +- !26897 Fix CVE-2026-74588 +- !26862 [OLK-6.6] ub: ubase&unic: Fix some issues in running driver +- !26855 [OLK-6.6] Fix CVE-2026-74752 +- sctp: fix use-after-free of cached ASCONF chunk +- !26653 [OLK-6.6] Fix CVE-2026-74588 +- !26738 [OLK-6.6] Fix CVE-2026-74614 +- libceph: fix two unsafe bare decodes in decode_lockers() +- tipc: read le->link under the node lock in tipc_node_link_down() +- sctp: clear control chunk transport if it is being removed +- sctp: clear new_transport when removing a peer +- libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE +- libceph: Amend checking to fix `make W=1` build breakage +- !26716 Fix CVE-2026-74608 +- !26859 [OLK-6.6] Fix CVE-2026-80527 +- !26788 [OLK-6.6] Fix CVE-2026-74726 +- ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path +- !26760 [OLK-6.6] Fix CVE-2026-74666 +- !26847 [OLK-6.6] Fix CVE-2026-74739 +- !26873 [OLK-6.6] Fix CVE-2026-80587 +- !26756 [OLK-6.6] Fix CVE-2026-74660 +- !26742 [OLK-6.6] Fix CVE-2026-74620 +- !26774 [OLK-6.6] Fix CVE-2026-74696 +- !26850 [OLK-6.6] Fix CVE-2026-74743 +- !26860 [OLK-6.6] Fix CVE-2026-80529 +- sctp: keep chunk->transport in step with the list it is queued on +- mptcp: avoid combining some incoming suboptions +- libceph: Avoid using invalid osd indices from primary_temp +- xfs: don't swallow dquot recovery verification errors +- ceph: fix hanging __ceph_get_caps() with stale mds_wanted +- sctp: validate cookie AUTH state before use +- ipvlan: inherit needed_headroom and needed_tailroom from phy_dev +- macvlan: inherit needed_headroom and needed_tailroom from lowerdev +- net/sched: cls_u32: skip hash tables in u32_bind_class() +- ceph: avoid fs reclaim while using current->journal_info +- config: Enable CONFIG_PARAVIRT_SPINLOCKS +- KVM: arm64: Fix KABI break introduced by the PV spinlock pv field +- arm64: Add tracepoints for the PV qspinlock backend +- arm64: Add the PV queued spinlock KVM backend +- KVM: arm64: Add tracepoint for PV qspinlock vCPU kick +- KVM: arm64: Implement the PV spinlock vCPU kick service +- KVM: arm64: Add the PV spinlock state and vendor control bit +- arm64: Add SMCCC VENDOR_KICK_CPU hypercall ID +- arm64: Introduce PARAVIRT_SPINLOCKS and the pv_lock_ops framework +- bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor +- udp: fix potential use-after-free in tunnel segmentation +- tcp: fix TFO max_qlen accounting across reuseport migration +- net/packet: reset the MAC header on the packet-socket transmit path +- packet: synchronize pressure clearing with ring reconfiguration +- netfilter: ebt_nflog: pin the NFLOG backend +- ipv6: prevent in6_dev_get() from resurrecting inet6_dev +- net/sched: act_gact, act_police: range check the fallback control action +- vsock/virtio: read virtqueues under worker locks +- ipv6: fix Route Information option length validation +- smb: client: Fix use-after-free in cifs_try_adding_channels() +- mm/filemap: __filemap_add_folio() restore index before retrying +- sctp: keep chunk->transport in step with the list it is queued on +- urma: prevent JFC event UAF after delete failure +- ub: ubase: Fix mbox-over-cmdq seq reuse across driver +- ub: ubase: Fix failure exception branch in UBASE cmd crq +- ub: ubase: Recover the cmdq queue after reset failure +- ub: ubase: fix probabilistic reset failure issue in +- ub: ubase&udma: Add ubase forwarding tp flush done +- net: unic: Reduce the wait time for loopback connection +- net: unic: Add DMA cache sync for RX SGE buffers + +* Fri Aug 28 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-168.0.0.152.20260828.c9108013ad26 +- !26902 nvmet-tcp: fix page fragment cache leak in error path +- nvmet-tcp: fix page fragment cache leak in error path +- !26710 [OLK-6.6] crypto: hisilicon/sec2 - backport sec2 fixes and cleanup from mainline +- !26736 [OLK-6.6] Fix CVE-2026-74612 +- !26740 [OLK-6.6] Fix CVE-2026-74616 +- !26877 Fix CVE-2026-68136 +- !26674 Fix CVE-2026-72423 +- !26726 [OLK-6.6] Fix CVE-2026-74597 +- !26669 Fix CVE-2026-74475 +- !26816 Fix CVE-2026-72213 +- !26225 [OLK-6.6] Fix CVE-2026-74317 +- !26237 [OLK-6.6] Fix CVE-2026-74439 +- !26005 [OLK-6.6] Fix CVE-2026-68426 +- !26875 [OLK-6.6] ub: ubase&udma: Support UTP SL configure +- !26615 [OLK-6.6] fix CVE-2026-74499 +- !26614 [OLK-6.6] fix CVE-2026-72188 +- net: gro: fix double aggregation of flush-marked skbs +- net: move skb_gro_receive_list from udp to core +- !26744 [OLK-6.6] Fix CVE-2026-74623 +- ub: udma: support query um sl from ubase. +- ub: ubase: Separate utp_sL from shared unic_sl +- mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch +- net: atlantic: free stranded TX buffers on ring deinit +- xdp: reject clones that overrun skb_shared_info tailroom +- veth: fix skb length accounting after XDP frag adjustment +- ip6_tunnel: clear skb2->cb[] in ip6ip6_err() +- crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num +- crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx +- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure +- vxlan: re-fetch eth header after route_shortcircuit() +- bpf: Guard conntrack opts error writes +- vxlan: use neigh_ha_snapshot() in route_shortcircuit() +- vxlan: unclone skb head before modifying eth header in route_shortcircuit() +- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() +- ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name() +- iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry +- ixgbe: do not configure xps for XDP queues +- xfrm: fix stale skb->prev after async crypto steals a GSO segment + +* Thu Aug 27 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-168.0.0.152.20260827.2f12b4c73461 +- !26683 Fix CVE-2026-74683 +- !26701 Fix CVE-2026-74302 +- !26827 ub: unic: handle all ports link‑down event +- !26805 Fix CVE-2026-74594 +- !26790 perf/core: Fix group leader use-after-free after sibling detach +- ub: unic: handle all ports link‑down event +- !26616 [OLK-6.6] fix CVE-2026-68471 +- !26723 eventfs: Fix use-after-free in eventfs_remove_rec() +- !26724 tracing: Fix race between update_event_fields and, event_define_fields +- sched/psi: Shut down rtpoll_timer in psi_cgroup_free() +- perf/core: Fix group leader use-after-free after sibling detach +- tracing: Fix race between update_event_fields and, event_define_fields +- eventfs: Fix use-after-free in eventfs_remove_rec() +- Bluetooth: hci_core: Fix UAF in hci_unregister_dev() +- Input: evdev - sanitize event type index when fetching event masks +- wifi: ieee80211: validate MLE common info length + +* Wed Aug 26 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-168.0.0.152 +- !26719 perf hisi-ptt: Fix header file reference error +- perf hisi-ptt: Fix header file reference error +- perf tools: Add get_unaligned_leNN() +- !26188 [OLK-6.6] Fix CVE-2026-72405 +- !26148 [OLK-6.6] Fix CVE-2026-72111 +- !26179 [OLK-6.6] Fix CVE-2026-72321 +- !26699 bpf: Reset register bounds before narrowing retval range in check_mem_access() +- !26159 [OLK-6.6] Fix CVE-2026-72286 +- ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() +- bpf: Reset register bounds before narrowing retval range in check_mem_access() +- !26681 Fix CVE-2026-74673 +- !26472 media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() +- !26275 [OLK-6.6] Fix CVE-2026-74536 +- !26459 backport minios part3 patches from linux mainline +- !26260 [OLK-6.6] Fix CVE-2026-74487 +- !26570 binfmt_misc: reject a flag character as the field delimiter +- !26344 [OLK-6.6][linux-6.6.y sync] Backport 6.6.150-6.6.151 LTS Patches +- !26235 nfs: use nfsi->rwsem to protect traversal of the file lock list +- !26172 cifs: Fix busy dentry used during umounting +- Input: evdev - fix information leak in evdev_pass_values() +- !26658 Fix the issue where the endianness of TLP packets captured by PTT for 8DW does not match the expected value. +- perf hisi-ptt: Fix spelling and abbreviation errors +- perf hisi-ptt: Strengthen auxtrace event handling and packet type detection +- perf hisi-ptt: Fix PTT trace TLP header parsing +- perf hisi-ptt: remove unused struct 'hisi_ptt_queue' +- !25984 [OLK-6.6] Fix CVE-2026-68323 +- !26187 [OLK-6.6] Fix CVE-2026-72404 +- !26129 [OLK-6.6] Fix CVE-2026-72027 +- !26421 bpf: Mask pseudo pointer values in verifier logs +- !26255 [OLK-6.6] Fix CVE-2026-74481 +- !25903 RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE +- binfmt_misc: reject a flag character as the field delimiter +- erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms +- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs +- ipvs: return the csum validation for forward hook +- Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release +- sysctl: fix kabi breakage of ctl_table_header constification +- media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() +- media: v4l: async: Set owner for async sub-devices +- selftests/arm64: Implement cmpbr_sigill() to hwcap test +- kselftest/arm64: Add 2024 dpISA extensions to hwcap test +- kselftest/arm64: Fix encoding for SVE B16B16 test +- kselftest/arm64: Verify HWCAP2_SVE_B16B16 +- arm64: Add missing registrations of hwcaps +- arm64/hwcap: Remove stray references to SF8MMx +- arm64/hwcap: Describe 2024 dpISA extensions to userspace +- arm64/sysreg: Update ID_AA64SMFR0_EL1 to DDI0601 2024-12 +- arm64/sysreg: Update ID_AA64ISAR2_EL1 to DDI0601 2024-09 +- arm64/sysreg: Update ID_AA64ZFR0_EL1 to DDI0601 2024-09 +- arm64/sysreg: Update ID_AA64FPFR0_EL1 to DDI0601 2024-09 +- arm64/sve: Report FEAT_SVE_B16B16 to userspace +- kselftest/arm64: hwcap: fix f8dp2 cpuinfo name +- kselftest/arm64: Add 2023 DPISA hwcap test coverage +- kselftest/arm64: Add basic FPMR test +- kselftest/arm64: Handle FPMR context in generic signal frame parser +- usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path +- drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info +- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change +- drm/i915/hdcp: check streams[] bounds before overflow +- drm/i915/hdcp: require monotonically increasing seq_num_v +- drm/i915/hdcp: Move to using intel_display in intel_hdcp +- drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind +- drm/i915/fbc: Extract intel_fbc_has_fences() +- sctp: close UDP tunnel sockets during netns teardown +- mptcp: pm: avoid code duplication to lookup endp +- libceph: add doutc and *_client debug macros support +- sctp: avoid auth_enable sysctl UAF during netns teardown +- sysctl: treewide: constify ctl_table_header::ctl_table_arg +- wifi: brcmfmac: drain bus_reset work on device removal +- wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 +- wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) +- wifi: ath6kl: fix use-after-free in aggr_reset_state() +- media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() +- media: v4l: async: Set owner for async sub-devices +- media: i2c: imx219: Group functions by purpose +- media: i2c: imx219: Drop IMX219_VTS_* macros +- media: i2c: imx219: Don't store the current mode in the imx219 structure +- media: i2c: imx219: Access height from active format in imx219_set_ctrl +- drm/i915/vrr: require valid min/max vfreq for VRR +- drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() +- drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions +- usb: typec: ucsi: Fix race condition and ordering in port unregistration +- usb: typec: ucsi: split connector lock classes +- usb: typec: ucsi: Only enable supported notifications +- usb: gadget: f_tcm: synchronize delayed set_alt with teardown +- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay +- drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du +- usb: musb: omap2430: Do not put borrowed of_node in probe +- usb: musb: omap2430: clean up probe error handling +- Revert "ia64: Make acpi_cpufreq_cpu_exit return void" +- bpf: Mask pseudo pointer values in verifier logs +- firmware: stratix10-svc: fix memory leaks and list corruption bugs +- mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() +- ata: ahci: Make ahci_ignore_port() handle empty mask_port_map +- ata: libahci_platform: Do not set mask_port_map when not needed +- HID: logitech-dj: Fix maxfield check in DJ short report validation +- spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX +- drm/vmwgfx: validate external BO copy bounds for both stride paths +- drm/vmwgfx: use check_add_overflow for shader size+offset bound +- drm/vmwgfx: bound DMA command body size against suffix pointer +- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division +- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import +- drm/vmwgfx: reject DX_BIND_QUERY without a DX context +- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size +- drm/amdkfd: hold event_mutex while checkpointing CRIU events +- drm/amdkfd: Handle invalid event type in CRIU event restore +- drm/amdkfd: fix QID bit leak in pqm_create_queue() +- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE +- drm/amdgpu: cap GTT size to physical RAM on APUs +- drm/amdgpu: restore UMD profile pstate after runtime resume +- drm/mediatek: ovl_adaptor: balance component registrations +- drm/vc4: Zero the tile state data array before each BIN job +- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size +- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs +- can: ctucanfd: mark error-active controller status valid +- can: ctucanfd: handle bus error interrupts +- can: ctucanfd: unmap BAR0 using base address +- can: ctucanfd: use self-test mode for PRESUME_ACK +- can: ctucanfd: add missing MODULE_DEVICE_TABLE() +- can: peak_usb: validate uCAN receive record lengths +- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error +- can: peak_usb: add bounds check for USB channel index +- can: softing: fw_parse(): validate firmware record spans +- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents +- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() +- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking +- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer +- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure +- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure +- can: ems_usb: validate CPC message lengths +- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured +- i2c: imx: Cancel hrtimer before clearing slave pointer +- i2c: imx: Fix slave registration race and error handling +- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock +- ice: fix memory leak in ice_lbtest_prepare_rings() +- ice: wait for reset completion in ice_resume() +- net: openvswitch: fix skb leak on flow key update failure during ct +- net: openvswitch: fix skb leak on flow key update failure during recirculation +- net: openvswitch: fix potential UAF on meter attach failure +- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB +- phy: zynqmp: use read-modify-write for SERDES scrambler bypass +- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask +- s390/zcrypt: Validate length for CCA ECC private key requests +- s390/zcrypt: Validate length for CCA AES cipher key requests +- s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs +- s390/dasd: Fix undersized format-check buffer +- s390/dasd: Fix potential NULL pointer dereference +- s390/qeth: Check CAP_NET_ADMIN for private ioctls +- power: supply: bq25890: fix the -10 C NTC lookup entry +- cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() +- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure +- i2c: amd-mp2: Unregister callback on adapter add failure +- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client +- hwmon: (npcm750-pwm-fan): stop fan timer on device detach +- sctp: prevent peer transport count overflow +- sctp: reject stale cookies with mismatched verification tags +- scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write +- selftests/clone3: fix wild pointer access of getline due to missing init +- selftests/mm: fix potential wild pointer access of getline due to missing init +- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure +- tracing/filters: Fix false positive match in regex_match_full() +- ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() +- vxlan: use pskb_network_may_pull() in route_shortcircuit() +- vxlan: use neigh_ha_snapshot() in route_shortcircuit() +- vxlan: unclone skb head before modifying eth header in route_shortcircuit() +- vxlan: re-fetch eth header after route_shortcircuit() +- um: vector: fix use-after-free in vector_mmsg_rx() +- powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() +- mm/page_reporting: use system_freezable_wq to fix UAF during suspend +- binfmt_misc: reject a flag character as the field delimiter +- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames +- tipc: avoid use-after-free in poll trace queue dumps +- netfilter: ipset: do not update comments from kernel-side hash adds +- net/smc: fix socket use-after-free during link group termination +- ipvs: do not propagate one-packet flag to synced conns +- e1000: fix memory leak in e1000_probe() +- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ +- ALSA: usb-audio: Clamp frame size in implicit-feedback mode +- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set +- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() +- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() +- ata: libata-eh: Increase STANDBY IMMEDIATE timeout +- ASoC: tas2562: fix broken entries in the volume lookup table +- ASoC: tas2562: fix DVC coefficient write order +- ALSA: ump: fix double free of out_cvts on rawmidi error +- ALSA: pcm: wake linked drain waiters on unlink +- ALSA: lx6464es: fix period byte count for 16-bit streams +- ALSA: 6fire: Fix UAF at error handling during probe +- bpf: lwt: Fix dst reference leak on reroute failure +- Bluetooth: HIDP: validate numbered report payloads +- Bluetooth: HIDP: reject frames without a transaction header +- Bluetooth: mgmt: fix UAF in pair command cancellation +- Bluetooth: mgmt: fix pending command UAF in EIR updates +- audit: fix potential use-after-free in audit_del_rule() +- audit: fix potential integer overflow in audit_log_n_string() +- sctp: validate Adaptation Indication parameter length +- KVM: s390: pci: Validate AIBV and AISB before pinning guest pages +- KVM: s390: pci: Fix NULL dereference on AIBV allocation failure +- KVM: s390: pci: Reject adapter interrupt forwarding if already enabled +- KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active +- tracing/probes: Reject $arg0 in meta argument expansion +- mm/vmstat: fold stranded per-cpu node stats when a node comes online +- mm/hugetlb: fix list corruption in allocate_file_region_entries() +- mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() +- pinctrl: bm1880: add missing select GENERIC_PINCONF +- erofs: cap LZMA stream pool size +- pinctrl: devicetree: don't free uninitialized dev_name on error path +- pinctrl: microchip-sgpio: add missing select REGMAP_MMIO +- ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump +- ksmbd: fix use-after-free in __close_file_table_ids() +- ksmbd: return success for deferred final close +- qede: sync udp_tunnel ports outside qede_lock in the recovery path +- octeontx2-pf: Set correct sequence for carrier off and tx queue stop +- net: dsa: mt7530: error out on failed reads in MT7531 PHY polling +- accel/qaic: use sizeof(*trans_hdr) for transaction length check +- tracing/mmiotrace: Reset dropped_count in mmio_reset_data() +- can: isotp: check register_netdevice_notifier() error in module init +- net: sxgbe: check descriptor ring allocation failures +- net: sxgbe: free TX rings on RX allocation failure +- scsi: target: Clear cmd_cnt when initial counter enrollment fails +- scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req +- scsi: ufs: core: Cancel RTC work in active-active suspend +- scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE +- net: phylink: put link_gpio if phylink_create fails +- Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync +- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() +- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists +- Bluetooth: btintel: Validate length before parsing diagnostics TLV +- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos +- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp +- Bluetooth: ISO: clear iso_data always when detaching conn from hcon +- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() +- wifi: mac80211: validate individual TWT params before driver setup +- powerpc/boot: Fix treeboot-akebono CPU node lookup check +- powerpc/boot: Fix treeboot-currituck CPU node lookup check +- powerpc/boot: Fix simpleboot CPU node lookup check +- hwmon: (adt7470) Fix PWM auto temp state array and bounds check +- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read +- hwmon: (adt7470) Use cached PWM frequency value +- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks +- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() +- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread +- hwmon: (adt7470) Fix cache updated before hardware write on I2C error +- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors +- forcedeth: fix UAF of txrx_stats in nv_remove +- net: bridge: mrp: fix Option TLV length in MRP_Test frames +- hwmon: (nct6775-core) Prevent access to unsupported weight registers +- net: do not send ICMP/NDISC Redirects when peer allocation fails +- hwmon: (nzxt-smart2) DMA-align output buffer +- hwmon: (lm90) Only report alarms if driver is ready +- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 +- spi: spi-cadence: Move TX FIFO full busy-wait into FIFO +- spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 +- smb: client: fix buffer leaks in SMB1 read and write +- scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race +- scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer +- scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer +- pinctrl-amd: Don't clear S4 wake bits at probe +- rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() +- rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled +- netfilter: nft_payload: fix mask build for partial field offload +- ipvs: do not mangle ICMP replies for non-first fragments +- ipvs: fix places with wrong packet offsets +- ipvs: fix the checksum validations +- netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH +- assoc_array: trim the final shortcut word using the current chunk end +- keys: make keyring key-chunk byte order agree with keyring_diff_objects() +- keys: fix out-of-bounds read in keyring_get_key_chunk() +- drm/mediatek: Check CRTC state before freeing +- netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() +- phy: zynqmp: fix runtime PM leak on probe allocation failure +- phy: zynqmp: fix clock error handling in xpsgtr_phy_init() +- phy-zynqmp: Postpone getting clock rate until actually needed +- btrfs: zoned: fix deadlock between metadata writeback and transaction commit +- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup +- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup +- ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() +- ahci: Introduce ahci_ignore_port() helper +- ata: libahci_platform: support non-consecutive port numbers +- ata: sata_mv: accept 1 or 2 resources in platform probe +- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() +- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA +- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 +- thunderbolt: Prevent XDomain delayed work use-after-free on disconnect +- soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE +- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report +- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write +- HID: logitech-dj: Standardise hid_report_enum variable nomenclature +- gve: fix Rx queue stall on alloc failure +- net: mpls: initialize rtm_tos in mpls_getroute() +- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() +- Bluetooth: ISO: fix leaking sk after socket release +- binfmt_misc: restore write access when removing an entry +- mm/page_reporting: use system_freezable_wq to fix UAF during suspend +- nfs: use nfsi->rwsem to protect traversal of the file lock list +- net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync +- tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() +- cifs: Fix busy dentry used during umounting +- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs +- bpf: Reset register bounds before narrowing retval range in check_mem_access() +- mm/compaction: handle free_pages_prepare() properly in compaction_free() +- tipc: serialize udp bearer replicast list updates +- RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE + +* Sat Aug 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-167.0.0.151.20260822.ce060e39d6b1 +- !26443 [OLK-6.6] Backported Zen6 JSON Perf events +- tools headers x86: Remove duplicate MSR_AMD64_RMP_CFG definition +- perf vendor events amd: Add Zen 6 mapping +- perf vendor events amd: Add Zen 6 metrics +- perf vendor events amd: Add Zen 6 uncore events +- perf vendor events amd: Add Zen 6 core events + +* Fri Aug 21 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-167.0.0.151.20260821.07eaeb78fee6 +- !26176 [OLK-6.6] Fix CVE-2026-72288 +- !26177 [OLK-6.6] Fix CVE-2026-72294 +- !26300 urma: reject set_opt when object is already activated +- !26267 [OLK-6.6] Fix CVE-2026-74514 +- !26043 [OLK-6.6] Fix CVE-2026-64523 +- !25983 Fix CVE-2026-64082 +- !26046 [OLK-6.6] Fix CVE-2026-64573 +- !26430 ub: ubdevshm: Bugfix for unregister segment +- urma: reject set_opt when object is already activated +- ub/ubdevshm: Bugfix for unregister segment +- KVM: s390: pci: Fix memory accounting for pinned/unpinned pages +- LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() +- KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling +- riscv: Fix register corruption from uninitialized cregs on error +- Bluetooth: qca: fix NVM tag length underflow in TLV parser +- net/handshake: Take a long-lived file reference at submit + +* Thu Aug 20 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-167.0.0.151.20260820.2fe2673b28ed +- !25962 [OLK-6.6] Fix CVE-2026-68286 +- !26248 [OLK-6.6] Fix CVE-2026-74473 +- !25971 [OLK-6.6] Fix CVE-2026-68288 +- !25963 [OLK-6.6] Fix CVE-2026-68287 +- !26268 [OLK-6.6] Fix CVE-2026-74515 +- !26270 [OLK-6.6] Fix CVE-2026-74519 +- !26292 [OLK-6.6] Fix CVE-2026-74572 +- !26249 [OLK-6.6] Fix CVE-2026-74474 +- !25091 [OLK-6.6] Fix CVE-2024-42151 +- !26281 [OLK-6.6] Fix CVE-2026-74550 +- btrfs: zoned: fix deadlock between metadata writeback and transaction commit +- net: do not send ICMP/NDISC Redirects when peer allocation fails +- pinctrl: devicetree: don't free uninitialized dev_name on error path +- KVM: s390: pci: Reject adapter interrupt forwarding if already enabled +- vxlan: use pskb_network_may_pull() for transmit path header pulls +- vxlan: use pskb_network_may_pull() in route_shortcircuit() +- net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD +- drop_monitor: fix size calculations for 64-bit attributes +- drop_monitor: perform u64_stats updates under IRQ-disabled section +- bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable + +* Wed Aug 19 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-167.0.0.151 +- !26321 v4 irqbypass: Cleanups and a perf improvement +- irqbypass: Require producers to pass in Linux IRQ number during registration +- irqbypass: Use xarray to track producers and consumers +- irqbypass: Use guard(mutex) in lieu of manual lock+unlock +- irqbypass: Use paired consumer/producer to disconnect during unregister +- irqbypass: Explicitly track producer and consumer bindings +- irqbypass: Take ownership of producer/consumer token tracking +- irqbypass: Drop superfluous might_sleep() annotations +- irqbypass: Drop pointless and misleading THIS_MODULE get/put +- !26256 [OLK-6.6][linux-6.6.y sync] Backport 6.6.148-6.6.150 LTS Patches +- !26193 iommu/ummu: Move the mmu notifier TLBi to driver layer +- !25930 etmem: fix page reference leak in add_page_for_swap() +- !26205 ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code +- !26254 [OLK-6.6] Fix CVE-2026-74480 +- x86/bugs: Make Safe-RET robust against interrupt injection +- Revert "x86/bugs: Make Safe-RET robust against interrupt injection" +- x86/bugs: Make Safe-RET robust against interrupt injection +- net: bridge: stop fast-leave after deleting a port group +- ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check +- !26204 ub: ub_fwctl: Provide a user interface for ubase query function. +- !26042 [OLK-6.6][linux-6.6.y sync] Backport 6.6.147-6.6.148 LTS Patches +- ub: ub_fwctl: Provide a user interface for ubase query function. +- !25994 [OLK-6.6] Fix CVE-2026-68365 +- ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code +- ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning +- ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path +- ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc +- iommu/ummu: Move the mmu notifier TLBi to driver layer +- iommu/ummu: Add ummu platform erratum mechanism +- iommu/ummu: Move ioplb_sync to flush.c +- rxrpc: Fix irq-disabled in local_bh_enable() +- Revert "drm/amdgpu: fix aperture mapping leak" +- can: isotp: fix timer drain order, wakeup handling and tx_gen ordering +- can: use skb hash instead of private variable in headroom +- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug +- rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link +- udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() +- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() +- ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link +- mm/damon/core: disallow overlapping input ranges for damon_set_regions() +- mm/damon/core: validate ranges in damon_set_regions() +- net: ipa: fix SMEM state handle leaks in SMP2P init +- net: macb: drop in-flight Tx SKBs on close +- ata: libata-core: Reject an invalid concurrent positioning ranges count +- octeontx2-pf: fix SQB pointer leak on init failure +- ipmi: fix refcount leak in i_ipmi_request() +- bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() +- bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c +- bootconfig: do not put quotes on cmdline items unless necessary +- octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF +- gpio: mt7621: avoid corruption of shared interrupt trigger state +- net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink +- net: mana: Validate the packet length reported by the NIC +- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() +- wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() +- tracing/user_events: Fix use-after-free in user_event_mm_dup() +- workqueue: Add system_percpu_wq and system_dfl_wq +- workqueue: Factor out init_cpu_worker_pool() +- Input: ims-pcu - fix firmware leak in async update +- firmware_loader: introduce __free() cleanup hanler +- dm-verity: make error counter atomic +- dm-verity: avoid double increment of &use_bh_wq_enabled +- ovl: use linked upper dentry in copy-up tmpfile +- NFS: Charge unstable writes by request size, not folio size +- nfs: remove dead code for the old swap over NFS implementation +- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) +- i2c: imx: separate atomic, dma and non-dma use case +- platform/x86: dell-laptop: fix missing cleanups in init error path +- platform/x86: dell-smbios: Move request functions for reuse +- dmaengine: dw-edma-pcie: Reject devices without driver data +- dmaengine: dw-edma: Fix confusing cleanup.h syntax +- dma: dw-edma: Fix build warning in dw_edma_pcie_probe() +- taskstats: retain dead thread stats in TGID queries +- taskstats: fill_stats_for_tgid: use for_each_thread() +- mtd: rawnand: Pause continuous reads at block boundaries +- mtd: rawnand: Ensure all continuous terms are always in sync +- mtd: rawnand: Add a helper for calculating a page index +- mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages +- SUNRPC: Return an error from xdr_buf_to_bvec() on overflow +- SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists +- sunrpc: allocate a separate bvec array for socket sends +- NFSD: pass nfsd_file to nfsd_iter_read() +- netfilter: nft_fib: reject fib expression on the netdev egress hook +- netfilter: nf_tables: remove register tracking infrastructure +- netfilter: nf_tables: Remove unused nft_reduce_is_readonly() +- netfilter: nf_conntrack_sip: validate skb_dst() before accessing it +- netfilter: nf_conntrack_sip: remove net variable shadowing +- netfilter: nft_set_pipapo: move prove_locking helper around +- netfilter: nft_set_pipapo: use GFP_KERNEL for insertions +- ASoC: mediatek: mt8183: Check runtime resume during probe +- ASoC: mediatek: mt8192: Check runtime resume during probe +- ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable +- ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb +- ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() +- ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() +- ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link +- fbdev: efifb: fix memory leak in efifb_probe() +- fbdev/efifb: Replace references to global screen_info by local pointer +- octeontx2-vf: clear stale mailbox IRQ state before request_irq() +- octeontx2-pf: clear stale mailbox IRQ state before request_irq() +- octeontx2: Annotate mmio regions as __iomem +- VDUSE: avoid leaking information to userspace +- vduse: take out allocations from vduse_dev_alloc_coherent +- vduse: remove unused vaddr parameter of vduse_domain_free_coherent +- vduse: Use fixed 4KB bounce pages for non-4KB page size +- rxrpc: Fix socket notification race +- rxrpc: Fix notification vs call-release vs recvmsg +- rxrpc: Use irq-disabling spinlocks between app and I/O thread +- rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack +- tipc: restrict socket queue dumps in enqueue tracepoints +- fbcon: Use correct type for vc_resize() return value +- fbcon: Rename struct fbcon_ops to struct fbcon_par +- rxrpc: serialize kernel accept preallocation with socket teardown +- rxrpc: Pull out certain app callback funcs into an ops table +- afs: Turn the afs_addr_list address array into an array of structs +- afs: Annotate struct afs_addr_list with __counted_by +- serial: max310x: implement gpio_chip::get_direction() +- serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) +- ALSA: hda: Fix cached processing coefficient verbs +- ALSA: hda: conexant: Remove mic bias threshold override +- i2c: davinci: Unregister cpufreq notifier on probe failure +- fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() +- dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning +- udmabuf: Do not create malformed scatterlists +- net: pcs: xpcs: fix SGMII state reading +- io_uring/rw: fix missing ERESTARTSYS conversion in read paths +- drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources +- exfat: validate cluster allocation bits of the allocation bitmap +- openvswitch: fix GSO userspace truncation underflow +- ksmbd: validate ACE size against SID sub-authorities +- ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL +- ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl +- net: qrtr: ns: Raise node count limit to 512 +- drm/amdgpu: fix aperture mapping leak +- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd +- drm/amdgpu: fix division by zero with invalid uvd dimensions +- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() +- drm/amdgpu/vcn4: avoid rereading IB param length +- drm/amdgpu/vce: fix integer overflow in image size +- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() +- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() +- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() +- drm/amdgpu/gfx8: drop unecessary BUG_ON() +- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() +- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() +- drm/amd/pm: make pp_features read-only when scpm is enabled +- vxlan: mdb: Fix source list corruption on a failed replace +- tipc: clear sock->sk on the failed-insert path in tipc_sk_create() +- pppoe: reload header pointer after dev_hard_header() +- mctp: serial: handle zero-length frames to prevent rx buffer overflow +- mac802154: llsec: reject frames shorter than the authentication tag +- mac802154: hold an interface reference across the scan worker +- ila: reload IPv6 header after pskb_may_pull in checksum adjust +- ice: use READ_ONCE() to access cached PHC time +- ksmbd: defer destroy_previous_session() until after NTLM authentication +- rbd: Reset positive result codes to zero in object map update path +- net: hip04: fix RX buffer leak on build_skb failure +- net/x25: fix use-after-free in x25_kill_by_neigh() +- net/iucv: fix use-after-free of a severed iucv_path +- net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() +- geneve: require CAP_NET_ADMIN in the device netns for changelink +- net: slip: serialize receive against buffer reallocation +- vxlan: require CAP_NET_ADMIN in the device netns for changelink +- phonet: pep: fix use-after-free in pep_get_sb() +- iommu/vt-d: Disallow SVA if page walk is not coherent +- fscrypt: Add missing superblock check in find_or_insert_direct_key() +- fs: preserve ACL_DONT_CACHE state in forget_cached_acl() +- binfmt_elf_fdpic: only honour the first PT_INTERP +- libceph: remove debugfs files before client teardown +- libceph: reject zero bucket types in crush_decode +- libceph: Reject monmaps advertising zero monitors +- libceph: refresh auth->authorizer_buf{,_len} after authorizer update +- libceph: guard missing CRUSH type name lookup +- libceph: Fix multiplication overflow in decode_new_up_state_weight() +- libceph: bound get_version reply decode to front len +- ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() +- sctp: don't free the ASCONF's own transport in DEL-IP processing +- mptcp: only set DATA_FIN when a mapping is present +- mptcp: decrement subflows counter on failed passive join +- Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" +- arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates +- tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() +- tracing/probes: Fix potential underflow in LEN_OR_ZERO macro +- tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() +- tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() +- tracing: Fix resource leak on mmiotrace trace_pipe close +- tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev +- intel_th: fix MSC output device reference leak +- mei: bus: access mei_device under device_lock on cleanup +- serial: sc16is7xx: implement gpio get_direction() callback +- comedi: comedi_parport: deal with premature interrupt +- x86/boot/compressed: Disable jump tables +- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL +- LoongArch: Fix oops during single-step debugging +- platform/loongarch: laptop: Explicitly reset bl_powered state when suspend +- exec: fix unsigned loop counter wrap in transfer_args_to_stack() +- Bluetooth: RFCOMM: Fix session UAF in set_termios +- Bluetooth: hci_sync: Protect UUID list traversal +- staging: rtl8723bs: fix inverted HT40 secondary channel offset +- staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() +- wifi: brcmfmac: make release_scratchbuffers idempotent +- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses +- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses +- wifi: wilc1000: validate assoc response length before subtracting header +- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper +- wifi: ath6kl: fix OOB access from firmware ADDBA window size +- ALSA: seq: close a re-opened queue timer in the destructor +- media: vpif_capture: fix OF node reference imbalance +- media: vivid: check for vb2_is_busy() when toggling caps +- media: vivid: add vivid_update_reduced_fps() +- media: vimc: fix reference leak on failed device registration +- media: vidtv: fix reference leak on failed device registration +- media: vb2: use ssize_t for vb2_read/vb2_write +- media: v4l2-ctrls: validate HEVC active reference counts +- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() +- media: ti: vpe: unwind v4l2 device registration on probe error +- media: tegra-video: vi: fix invalid u32 return value in format lookup +- media: sun4i-csi: Return queued buffers on start_streaming() failure +- media: stm32: dcmi: unregister notifier on probe failure +- media: saa7134: Fix a possible memory leak in saa7134_video_init1 +- media: rtl2832_sdr: Return queued buffers on start_streaming() failure +- media: rtl2832: fix use-after-free in rtl2832_remove() +- media: radio-si476x: Unregister v4l2_device on probe failure +- media: pwc: Return queued buffers on start_streaming() failure +- media: pwc: Drain fill_buf on start_streaming() failure +- media: pci: dm1105: Free allocated workqueue +- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding +- media: nxp: imx8-isi: Fix potential out-of-bounds issues +- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path +- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure +- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe +- media: msi2500: Return queued buffers on start_streaming() failure +- media: meson: vdec: Fix memory leak in error path of vdec_open +- media: marvell-cam: fix missing pci_disable_device() on remove +- media: cx23885: add ioremap return check and cleanup +- media: cx231xx: fix devres lifetime +- media: cedrus: skip invalid H.264 reference list entries +- media: cedrus: Fix missing cleanup in error path +- media: cedrus: clean up media device on probe failure +- media: cec: seco: unregister adapter on IR probe failure +- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure +- media: airspy: Return queued buffers on start_streaming() failure +- drm/vc4: Prevent shader BO mappings from becoming writable +- drm/vmwgfx: Validate vmw_surface_metadata::array_size +- drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved +- drm/amd/display: set new_stream to NULL after release +- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) +- drm/amdgpu: Fix VFCT bus number matching with soft filter +- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU +- drm/i915/gem: Do not leak siblings[] on proto context error +- drm/i915: Return NULL on error in active_instance +- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() +- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() +- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() +- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference +- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips +- drm/amdkfd: Check bounds in allocate_event_notification_slot +- drm/radeon: fix r100_copy_blit for large BOs +- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() +- drm/i915/gem: Add missing nospec on parallel submit slot +- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 +- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT +- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older +- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) +- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers +- drm/dp/mst: fix buffer overflows in sideband chunk accumulation +- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers +- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() +- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() +- bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() +- ice: fix LAG recipe to profile association +- net: ipv6: fix dif and sdif mismatch in raw6_icmp_error +- net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation +- net/mlx5e: Report zero bandwidth for non-ETS traffic classes +- net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule +- net: qrtr: restrict socket creation to the initial network namespace +- ppp: annotate data races in ppp_generic +- ppp: enable TX scatter-gather +- ppp: convert to percpu netstats +- ppp: use IFF_NO_QUEUE in virtual interfaces +- ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup +- octeontx2-vf: set TC flower flag on MCAM entry allocation +- net: stmmac: enable the MAC on link up for all supported speeds +- net: stmmac: reset residual action in L3L4 filters on delete +- net: stmmac: fix l3l4 filter rejecting unsupported offload requests +- tipc: fix u16 MTU truncation in media and bearer MTU validation +- vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets +- sctp: auth: verify auth requirement when auth_chunk is NULL +- net: dpaa: fix mode setting +- net: hsr: fix memory leak on slave unregistration by removing synced VLANs +- net: bridge: vlan: fix vlan range dumps starting with pvid +- amt: make the head writable before rewriting the L2 header +- amt: re-read skb header pointers after every pull +- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning +- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() +- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() +- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() +- wifi: mt76: mt7915: guard HE capability lookups +- tipc: fix infinite loop in __tipc_nl_compat_dumpit +- nexthop: initialize extack in nh_res_bucket_migrate() +- gtp: check skb_pull_data() return in gtp1u_send_echo_resp() +- selftests: openvswitch: add config file +- selftests: af_unix: add USER_NS config +- tls: device: push pending open record on splice EOF +- sctp: validate stream count in sctp_process_strreset_inreq() +- pds_core: check for workqueue allocation failure +- pds_core: order completion reads after the ownership check +- pds_core: yield the CPU while waiting for the adminq to drain +- sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid +- amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN +- pds_core: reject component parameter in legacy firmware update +- wifi: mac80211: recalculate TIM when a station enters power save +- iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() +- iommu/amd: Bound the early ACPI HID map +- wifi: mwifiex: bound uAP association event IEs to the event buffer +- wan: wanxl: Only reset hardware after BAR mapping +- nfp: Check resource mutex allocation +- wifi: mac80211: tear down new links on vif update error path +- iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() +- dpaa2-eth: put MAC endpoint device on disconnect +- dpaa2-switch: put MAC endpoint device on disconnect +- rds: drop incoming messages that cross network namespace boundaries +- bonding: fix devconf_all NULL dereference when IPv6 is disabled +- net/packet: avoid fanout hook re-registration after unregister +- Bluetooth: btusb: validate Realtek vendor event length +- hwmon: occ: validate poll response sensor blocks +- smb: client: validate DFS referral PathConsumed +- hwmon: (asus-ec-sensors) add missed handle for ENOMEM +- hwmon: (asus-ec-sensors) fix EC read intervals +- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC +- wifi: iwlwifi: mvm: fix read in wake packet notification handler +- wifi: iwlwifi: mvm: validate SAR GEO response payload size +- ASoC: cs35l56: Use complete_all() to signal init_completion +- ASoC: cs35l56: Fix potential probe() deadlock +- ASoC: cs35l56: Don't use devres to unregister component +- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI +- ASoC: tas2781: bound firmware description string parsing +- btrfs: free mapping node on duplicate reloc root insert +- btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 +- wifi: carl9170: fix buffer overflow in rx_stream failover path +- wifi: carl9170: fix OOB read from off-by-two in TX status handler +- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read +- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event +- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler +- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET +- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET +- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() +- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() +- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop +- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop +- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop +- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin +- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request +- usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits +- RISC-V: KVM: Serialize virtual interrupt pending state updates +- Revert "drm/amd/display: Add missing kdoc for ALLM parameters" +- crypto: rsa-pkcs1pad: Don't WARN on an empty digest +- USB: serial: option: add TDTECH MT5710-CN +- USB: serial: keyspan_pda: fix data loss on receive throttling +- USB: serial: io_edgeport: cap received transmit credits +- USB: serial: ftdi_sio: add support for E+H FXA291 +- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer +- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown +- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() +- USB: gadget: fsl-udc: fix device name leak on probe failure +- USB: gadget: snps-udc: fix device name leak on probe failure +- usb: gadget: printer: fix infinite loop in printer_read() +- usb: gadget: f_midi: cancel pending IN work before freeing the midi object +- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback +- usb: chipidea: fix usage_count leak when autosuspend_delay is negative +- USB: storage: add NO_ATA_1X quirk for Longmai USB Key +- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() +- mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n +- net/sched: act_tunnel_key: Defer dst_release to RCU callback +- drm/i915/selftests: Fix GT PM sort comparators +- ksmbd: validate compound request size before reading StructureSize2 +- ksmbd: pin conn during async oplock break notification +- can: j1939: fix lockless local-destination check +- bpf, sockmap: Reject unhashed UDP sockets on sockmap update +- powerpc/vtime: Initialize starttime at boot for native accounting +- powerpc/time: Prepare to stop elapsing in dynticks-idle +- sched/vtime: Get rid of generic vtime_task_switch() implementation +- drm/i915/gt: use correct selftest config symbol +- smb/client: handle overlapping allocated ranges in fallocate +- Bluetooth: hci_qca: Clear memdump state on invalid dump size +- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds +- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync +- Bluetooth: qca: fix NVM tag length underflow in TLV parser +- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC +- ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning +- ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts +- ata: sata_dwc_460ex: use platform_get_irq() +- ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered +- net/iucv: take a reference on the socket found in afiucv_hs_rcv() +- ipv4: fib: free fib_alias with kfree_rcu() on insert error path +- ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF +- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context +- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup +- ASoC: cs42l43: Correct report for forced microphone jack +- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() +- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop +- wifi: cfg80211: bound element ID read when checking non-inheritance +- wifi: brcmfmac: initialize SDIO data work before cleanup +- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock +- wifi: cfg80211: reject unsupported PMSR FTM location requests +- wifi: cfg80211: validate PMSR FTM preamble range +- wifi: cfg80211: validate PMSR measurement type data +- wifi: nl80211: validate nested MBSSID IE blobs +- wifi: nl80211: free RNR data on MBSSID mismatch +- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() +- wifi: libertas: fix memory leak in helper_firmware_cb() +- wifi: mac80211_hwsim: clamp virtio RX length before skb_put +- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() +- wifi: cfg80211: cancel sched scan results work on unregister +- xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert +- xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() +- RDMA/irdma: Prevent overflows in memory contiguity checks +- selftests/alsa: Fix memory leak in find_controls error path +- mtd: fix double free and WARN_ON in add_mtd_device() error paths +- RDMA/siw: publish QP after initialization +- RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp +- RDMA/hns: Fix potential integer overflow in mhop hem cleanup +- RDMA/erdma: initialize ret for empty receive WR lists +- RDMA/irdma: Prevent rereg_mr for non-mem regions +- RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper +- RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device +- RDMA/cma: Fix hardware address comparison length in netevent callback +- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() +- btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() +- btrfs: reject free space cache with more entries than pages +- mtd: nand: mtk-ecc: stop on ECC idle timeouts +- mtd: mtdswap: remove debugfs stats file on teardown +- IB/mad: Drop unmatched RMPP responses before reassembly +- arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 +- Input: ims-pcu - fix logic error in packet reset +- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() +- xprtrdma: Clear receive-side ownership pointers on release +- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings +- accel/ivpu: Reject firmware log with size smaller than header +- dmaengine: sh: rz-dmac: Move interrupt request after everything is set up +- can: isotp: serialize TX state transitions under so->rx_lock +- can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER +- can: bcm: track a single source interface for ANYDEV timeout/throttle ops +- can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() +- can: bcm: fix stale rx/tx ops after device removal +- can: bcm: add missing device refcount for CAN filter removal +- can: bcm: validate frame length in bcm_rx_setup() for RTR replies +- can: bcm: extend bcm_tx_lock usage for data and timer updates +- can: bcm: fix CAN frame rx/tx statistics +- can: bcm: add locking when updating filter and timer values +- KVM: x86/mmu: Fix use-after-free on vendor module reload +- seqlock: Allow UBSAN_ALIGNMENT to fail optimizing +- seqlock: Allow KASAN to fail optimizing +- seqlock: Cure some more scoped_seqlock() optimization fails +- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker +- USB: serial: io_edgeport: cap received transmit credits +- etmem: fix page reference leak in add_page_for_swap() + +* Tue Aug 18 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-165.0.0.150.20260818.891e2121139a +- !26166 cdrom: fix stack out-of-bounds read in CDROMVOLCTRL +- !26169 ub: udma: use memory pool to manage reserved va. +- !26070 iommu/ummu: Move the path of the hisi_ummu.h file +- !26067 iommu/ummu: Write UMAU mem attr bits into ATE start_addr +- !26069 iommu/ummu: Refactor EID bypass tecte construction +- !26131 ub:ubus: add vport disable completion notify +- !26135 [OLK-6.6] ub: ubase: 5 related changes +- !26133 ub: ub_fwctl: Support SDC fault detection for switching chips. +- ub: udma: use memory pool to manage reserved va. +- ub: udma: fix safe mode related problem. +- ub: udma: Adapt the SVM to query the PASpace interface. +- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL +- !26112 perf tools: Fix config4 support in PMU event parsing +- !25935 [OLK-6.6] Fix CVE-2026-68160 +- perf tools: Fix config4 support in PMU event parsing +- !26123 tracing: Check return value of __register_event() in trace_module_add_events() +- !26086 urma: support dev/eid sharing mode +- ub: ub_fwctl: Support SDC fault detection for switching chips. +- !26062 ub:ubus: Fix UAF in ub_cancel_retry_work_sync by draining retry_list from head +- !25728 virtio_balloon: add memop virtqueue for host-initiated memory operations +- ub: ubase: support firmware using PA address to access +- !25692 urma: allow set priority for urma_ping +- tracing: Check return value of __register_event() in trace_module_add_events() +- ub: ubase: Supports debugfs interfaces for querying +- ub: ubase: Supports version compatibility +- urma: support dev/eid sharing mode +- !26110 libceph: reject zero bucket types in crush_decode +- !26055 Fix CVE-2026-64563 +- libceph: reject zero bucket types in crush_decode +- !26084 ub: ub_fwctl: Enhance network communication maintenance information. +- ub:ubus: add vport disable completion notify +- ub: ub_fwctl: Enhance network communication maintenance information. +- !26051 Ethernet: Linkdata: enable SXE2 Ethernet and RDMA driver modules on ARM64 +- !25958 [OLK-6.6] Fix CVE-2026-68255 +- !25960 [OLK-6.6] Fix CVE-2026-68271 +- !26047 ub/obmm: add per-node max_total cap for pooled memory +- ub/obmm: fix max_total empty write silently clearing the cap +- ub/obmm: add per-node max_total cap for pooled memory +- !26050 ub/ubmem-vmmu: Fix parameter validation and initialization issues. +- virtio_balloon: add memop virtqueue for host-initiated memory operations +- !26054 ub: udma: fix log print problem. +- !26061 smb/client: fix chown/chgrp with SMB3 POSIX Extensions +- !26058 CVE-2026-64137 +- !26017 backport minios part2 patches from linux mainline. +- iommu/ummu: Move the path of the hisi_ummu.h file +- iommu/ummu: Refactor EID bypass tecte construction +- mm: export reclaim/compaction interfaces and buddy stats for proactive memory management +- vifo ub:ubus: vfio-ub: protect resmap lazymapping with resmap_lock mutex +- ub:ubus: Fix UAF in ub_cancel_retry_work_sync by draining retry_list from head +- ub:ubus: Clear TBA_L/H on ub_eu_table_init_common write failure before dma_free +- ub:ubus: Fix concurrency UAF in ub_enum_bfs_route_cal by localizing BFS scratch +- ub:ubus: Fix ub_intr_map_region offset+size winding risk +- ub:ubus: debug ub_ioctl_bus_instance_bind +- ub:ubus: Limit the frequency of log output +- ub:ubus: Fix ubhp_put_slot not called if work is pending duing cancel_work issue +- ub:ubus: Fix ub_route_sync_dev route_table_entry bit number not enough issue +- ub:ubus: Test then assign priv flag are two steps not atomic +- smb/client: fix chown/chgrp with SMB3 POSIX Extensions +- ub:ubus: Fix configuration access concurrency hard dog panic issue +- !25787 [OLK-6.6] Additional Venice Essential patches for openEuler OLK-6.6 +- iommu/ummu: Write UMAU mem attr bits into ATE start_addr +- iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check +- iommu/ummu: Update page table granule handling for UMAU +- smb: client: require net admin for CIFS SWN netlink +- genetlink: Use internal flags for multicast groups +- !26053 ub:ubus: Implement the UBUS-FIRMWARE version exchange function. +- urma: allow to set priority for urma_ping +- rhashtable: clear stale iter->p on table restart +- ub: udma: fix log print problem. +- Ethernet: Linkdata: enable SXE2 Ethernet and RDMA driver modules on ARM64 +- ub:ubus: Implement the UBUS-FIRMWARE version exchange function. +- ub/ubmem-vmmu: Fix parameter validation and initialization issues. +- !26008 [OLK-6.6] net: ipv6: clear suppressed fib6 rule result +- !26011 [OLK-6.6] backport important bugfix for igbvf driver from upstream linux-6.6.y +- !26023 sctp: fix auth_hmacs array size in struct sctp_cookie +- !25919 [OLK-6.6] Fix CVE-2026-68147 +- arm64: Kconfig: Add support for LSUI +- arm64: armv8_deprecated: Disable swp emulation when FEAT_LSUI present +- arm64: futex: Support futex with FEAT_LSUI +- arm64: futex: Refactor futex atomic operation +- arm64: cpufeature: Add FEAT_LSUI +- !25944 [OLK-6.6] Fix CVE-2026-68186 +- !26026 urma: fix pointer API return value comments +- sctp: fix auth_hmacs array size in struct sctp_cookie +- !25978 urma: ratelimit JFC cleanup error logs +- arm64/sysreg: Update ID_AA64ISAR3_EL1 to DDI0601 2024-09 +- arm64: sysreg: Add missing ID_AA64ISAR[13]_EL1 fields and variants +- !25936 erofs: fix stack-out-of-bounds in erofs_put_metabuf +- !26015 sctp: validate embedded INIT chunk and address list lengths in cookie +- !26010 i2c: core: fix adapter deregistration race +- sctp: validate embedded INIT chunk and address list lengths in cookie +- !25881 net Fix CVE-2026-45905 +- i2c: core: fix adapter deregistration race +- igbvf: Fix leak in TX DMA error cleanup +- !24350 perf arm-spe: Extend branch operations +- net: ipv6: clear suppressed fib6 rule result +- !25885 netfilter: nf_tables: add hook transactions for device deletions +- !25884 netfilter: Fix CVE-2026-64078 +- !25889 v2 bonding: Fix CVE-2026-52975 +- !25992 [OLK-6.6] Fix CVE-2026-68354 +- !24758 [OLK-6.6] KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235) +- urma: fix pointer API return value comments +- firewire: net: Fix fragmented datagram reassembly +- urma: ratelimit JFC cleanup error logs +- drm/nouveau: fix reversed error cleanup order in ucopy functions +- drm/virtio: bound EDID block reads to the response buffer +- !25940 v2 mm/memory: fix spurious warning when unmapping device-private/exclusive pages +- !24883 scsi: hst2dr: Add driver for Sage HL3210 SAS HBA +- binfmt_misc: set have_execfd only once the interpreter is opened +- mm/memory: fix spurious warning when unmapping device-private/exclusive pages +- erofs: fix stack-out-of-bounds in erofs_put_metabuf +- ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() +- fscrypt: Avoid dynamic allocation in fscrypt_get_devices() +- scsi: hst2dr: Fix sas_port cleanup in transport_port_add error path +- bonding: annotate data-races arcound churn variables +- bonding: fix NULL pointer dereference in actor_port_prio setting +- bonding: 3ad: implement proper RCU rules for port->aggregator +- bonding: print churn state via netlink +- bonding: add support for per-port LACP actor priority +- net: bonding: add broadcast_neighbor option for 802.3ad +- netfilter: nf_tables: add hook transactions for device deletions +- netfilter: x_tables: add and use xtables_unregister_table_exit +- netfilter: x_tables: add and use xt_unregister_table_pre_exit +- netfilter: x_tables: allocate hook ops while under mutex +- netfilter: x_tables: allow initial table replace without emitting audit log message +- net: Use __GENKSYMS__ to fix kabi breakage of icmp +- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path +- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers +- ipv4: Convert ip_route_input() to dscp_t. +- ipv4: Convert icmp_route_lookup() to dscp_t. +- ipv4: icmp: Unmask upper DSCP bits in icmp_route_lookup() +- ipv4: icmp: Pass full DS field to ip_route_input() +- net/ipv4: add tracepoint for icmp_send +- scsi: hst2dr: Fix sas_port handling in transport_port_add +- scsi: hst2dr: Fix multiple stability and correctness issues +- scsi: hst2dr: reorder config entries for SCSI drivers +- arm-spe: Fix config4 KABI breakage +- scsi:hst2dr:Modify some grammar formats +- scsi: hst2dr: Add driver for Sage HL3210 SAS HBA +- perf/x86/amd/uncore: Use Node ID to identify DF and UMC domains +- perf/x86/amd/uncore: Fix DF and UMC domain identification +- x86/amd_nb: Clean up early_is_amd_nb() +- ub: ubase: add interface to query uboe_type UMV entries +- ub: ubase: support to query a group of ub dl pkt stats +- KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235) +- KVM: SVM: Disable (x2)AVIC IPI virtualization if CPU has erratum #1235 +- KVM: SVM: Add enable_ipiv param, never set IsRunning if disabled +- KVM: VMX: Move enable_ipiv knob to common x86 +- ARM: pmuv3: Add missing write_pmuacr() +- perf: arm_pmu: Remove event index to counter remapping +- perf/arm: Move 32-bit PMU drivers to drivers/perf/ +- ARM: Delete ARM11MPCore perf leftovers +- ARM: Delete ARM11MPCore (ARM11 ARMv6K SMP) support +- perf: arm_pmu: Use of_property_present() +- arm64: sysreg: Update PMSIDR_EL1 description +- perf docs: arm-spe: Document new SPE filtering features +- perf tools: Add support for perf_event_attr::config4 +- tools headers UAPI: Sync linux/perf_event.h with the kernel sources +- perf: arm_spe: Add support for filtering on data source +- perf: Add perf_event_attr::config4 +- KVM: arm64: Add trap configs for PMSDSFR_EL1 +- KVM: arm64: nv: Add include containing the VNCR_EL2 offsets +- arm64/boot: Enable EL2 requirements for SPE_FEAT_FDS +- arm64/boot: Factor out a macro to check SPE version +- perf: arm_spe: Add support for FEAT_SPE_EFT extended filtering +- perf: arm_spe: Expose event filter +- perf: arm_spe: Support FEAT_SPEv1p4 filters +- arm64: sysreg: Add new PMSFCR_EL1 fields and PMSDSFR_EL1 register +- perf: arm_spe: Add format option for discard mode +- arm64: sysreg: Add registers trapped by HDFG{R,W}TR2_EL2 +- arm64/sysreg: Allow a 'Mapping' descriptor for system registers +- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 +- perf/arm_pmuv3: Add PMUv3.9 per counter EL0 access control +- arm64/sysreg: Update ID_DFR0_EL1 register fields +- arm64/sysreg: Add register fields for HFGWTR2_EL2 +- arm64/sysreg: Add register fields for HFGRTR2_EL2 +- arm64/sysreg: Add register fields for HFGITR2_EL2 +- arm64/sysreg: Add register fields for HDFGWTR2_EL2 +- arm64/sysreg: Add register fields for HDFGRTR2_EL2 +- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 +- arm64: Handle BRBE booting requirements +- arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again +- arm64: el2_setup.h: Rename some labels to be more diff-friendly +- Revert "arm64/boot: Enable EL2 requirements for BRBE" +- KVM: arm64: Shave a few bytes from the EL2 idmap code + +* Tue Aug 11 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-165.0.0.150.20260811.329ccfac7afe +- !25880 net: core: synchronize link-watch when carrier is queried +- !25883 x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled +- !25194 [OLK-6.6] Fix CVE-2026-63950 +- !25710 [OLK-6.6] Fix CVE-2026-64562 +- !25709 [OLK-6.6] Fix CVE-2026-64561 +- x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled +- !25795 Backport CVE-2026-64361 fixes from 6.6 LTS +- net: sysfs: fix locking in carrier read +- net: core: synchronize link-watch when carrier is queried +- !25850 sched: Add the qos scheduler's cgroup v2 interface +- !25852 Fix ringbuffer swap cpu buffer issue +- !25785 CVE-2026-53120 +- sched: Add the qos scheduler's cgroup v2 interface +- ring-buffer: Use current_context for safe per-CPU buffer swap +- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() +- hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length +- hfs/hfsplus: prevent getting negative values of offset/length +- PCI: Initialize temporary device in new_id_store() +- PCI: fix kabi breakage due to driver_override removal +- PCI: use generic driver_override infrastructure +- KVM: nVMX: Hide shadow VMCS right after VMCLEAR +- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available +- mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one + +* Mon Aug 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-165.0.0.150.20260810.0c12d91f028e +- !25828 mm: refactor mm_access() to not return NULL +- !25834 bpf, cgroup: Fix storage null-ptr-deref after replacing prog +- bpf, cgroup: Fix storage null-ptr-deref after replacing prog +- !24789 [OLK-6.6][linux-6.6.y sync] Backport 6.6.78-6.6.79 LTS conflict Patches +- mm: refactor mm_access() to not return NULL +- md/raid5: implement pers->bitmap_sector() +- nvme: move error logging from nvme_end_req() to __nvme_end_req() +- block: change blk_mq_add_to_batch() third argument type to bool +- block: cleanup and fix batch completion adding conditions + +* Sun Aug 09 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-165.0.0.150.20260809.62211c5707a3 +- !25111 Fix CVE-2026-63872 +- !25823 Fix CVE-2026-64116 +- ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() +- ipv6/addrconf: annotate data-races around devconf fields (II) +- esp: fix page frag reference leak on skb_to_sgvec failure +- Revert "esp: fix page frag reference leak on skb_to_sgvec failure" +- esp: fix page frag reference leak on skb_to_sgvec failure + +* Sat Aug 08 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-165.0.0.150.20260808.48b7ad3037cd +- !25810 x86/bugs: Enable IBPB flush on BPF JIT allocation +- !24886 arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected +- x86/bugs: Enable IBPB flush on BPF JIT allocation +- !25205 [OLK-6.6] Fix CVE-2026-63963 +- !25202 Fix CVE-2026-64424 +- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers +- netpoll: fix a use-after-free on shutdown path +- arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected + +* Fri Aug 07 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-165.0.0.150.20260807.7863d54f9740 +- !25766 obmm: fix few potential problems by code scan +- !25777 [OLK-6.6] ub: ubase&unic: 8 related changes +- !25784 CVE-2026-64405 fixes +- !25537 ub: cdma: fix UAF in mmu notifier release/unregister path +- !24200 【OLK-6.6】drm: add display driver for NEW H3C SEMI EG210 chip +- !25621 Fix CVE-2026-64540 +- !25620 Fix CVE-2026-64553 +- !24839 ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL +- !23915 [OLK-6.6] Fix CVE-2026-46275 +- !23148 [OLK-6.6] Fix CVE-2026-31462 +- !20584 [OLK-6.6] Fix CVE-2025-68736 +- !25778 ethtool: rss: fix indir_table and hkey leak on get_rxfh failure +- !25141 [OLK-6.6] Fix CVE-2026-63807 +- !25073 [OLK-6.6] Fix CVE-2026-64146 +- !25260 [OLK-6.6] Fix CVE-2026-64284 +- !25262 [OLK-6.6] Fix CVE-2026-64287 +- Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() +- Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle +- Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state +- Bluetooth: separate CIS_LINK and BIS_LINK link types +- ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope +- ub: cdma: revert cdma_ioctl to pre-security-fix version +- obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES +- obmm: register /dev/obmm after subsystem init +- obmm: mirror selected helpers' Kconfig dependencies +- obmm: log preimport rollback and resource-release failures +- obmm: accumulate nr_freed across reclaim notifiers +- obmm: fix use-after-free in conti_free_memory debug print +- ethtool: rss: fix indir_table and hkey leak on get_rxfh failure +- !25765 fix amdgpu_hmm_range_get_pages +- !25774 crypto: qat - remove unused character device and IOCTLs +- !25723 irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group +- !25216 [OLK-6.6] Fix CVE-2026-64036 +- crypto: qat - remove unused character device and IOCTLs +- irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group +- !25742 l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname +- !25768 sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online +- sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online +- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages +- drm/amdgpu: fix amdgpu_hmm_range_get_pages +- l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname +- drm-engiant: fix: correct formatting issues reported by checkpatch +- usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() +- net: psample: fix info leak in PSAMPLE_ATTR_DATA +- ub: cdma: fix UAF in mmu notifier release/unregister path +- ub: cdma: fix security vulnerabilities in event/ioctl paths +- ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths +- ub: cdma: add a process to update the adev status in cdma_probe +- KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU +- KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits +- erofs: fix metabuf leak in inode xattr initialization +- cgroup/rstat: validate cpu before css_rstat_cpu() access +- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level +- ub: ubase&unic: fix an issue where logs are printed in +- ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL +- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled +- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths +- ub: ubase: Resolve the EQ destruction timeout issue +- ub: ubase: Resolved the issue that the cmdq resources are +- net: unic: Error scenarios in the IP management need to +- net: unic: Abnormal cqe debugfs does not show status 0x0 +- ub: ubase: Add UNIC/CDMA support for DTU init +- ub: ubase: Resolve working queue may be scheduled after +- net: unic: JFC Destroy Process Adaptation +- drm: Add build config to compile H3C SEMI display drivers +- drm: add H3C SEMI display drivers, including Display Controller and DisplayPort phy driver +- drm/amdgpu: replace PASID IDR with XArray +- drm/amdgpu: fix the idr allocation flags +- drm/amdgpu: prevent immediate PASID reuse case +- drm/amdgpu: Remove usage of the deprecated ida_simple_xx() API +- landlock: Fix handling of disconnected directories +- landlock: Fix cosmetic change +- landlock: Optimize file path walks and prepare for audit support +- landlock: Optimize the number of calls to get_access_mask slightly +- selftests/landlock: Add tests for FS topology changes with network rules +- landlock: Refactor layer helpers +- landlock: Refactor landlock_find_rule/insert_rule helpers +- landlock: Move and rename layer helpers +- landlock: Allow FS topology changes for domains without such rule type +- landlock: Make ruleset's access masks more generic + +* Thu Aug 06 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-165.0.0.150.20260806.8a97fe374529 +- !25764 KVM: SEV: Ignore Port I/O requests of length '0' +- !25624 firmware_loader: fix device reference leak in firmware_upload_register() +- !25741 net/mlx5e: xsk: Fix unlocked writing to ICOSQ +- KVM: SEV: Ignore Port I/O requests of length '0' +- !25744 Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls +- !25734 *** CVE-2026-64513 *** +- !25563 [OLK-6.6] Fix CVE-2026-64542 +- !25712 Fix CVE-2026-64435 +- !25743 bpf: Copy per-CPU map value padding in copy_map_value_long() +- !25243 [OLK-6.6] Fix CVE-2026-64265 +- !25120 [OLK-6.6] Fix CVE-2026-53393 +- !25121 [OLK-6.6] Fix CVE-2026-53399 +- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls +- !25735 nbd: skip the capacity-change printk on device bringup and release +- bpf: Copy per-CPU map value padding in copy_map_value_long() +- net/mlx5e: xsk: Fix unlocked writing to ICOSQ +- !25721 ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser +- !25714 vfio: Remove device debugfs before releasing devres +- !25647 i2c: i801: fix hardware state machine corruption in error path +- !25244 [OLK-6.6] Fix CVE-2026-64266 +- !25558 [OLK-6.6] Fix CVE-2026-64537 +- !25387 [OLK-6.6] Fix CVE-2026-64411 +- !25069 [OLK-6.6] Fix CVE-2026-64189 +- !25566 [OLK-6.6] Fix CVE-2026-64545 +- !25569 [OLK-6.6] Fix CVE-2026-64548 +- !25575 [OLK-6.6] Fix CVE-2026-64554 +- !25394 [OLK-6.6] Fix CVE-2026-64422 +- !25573 [OLK-6.6] Fix CVE-2026-64552 +- !25396 [OLK-6.6] Fix CVE-2026-64424 +- !25388 [OLK-6.6] Fix CVE-2026-64412 +- !25470 [OLK-6.6] Fix CVE-2026-64530 +- !25404 [OLK-6.6] Fix CVE-2026-64436 +- !25395 [OLK-6.6] Fix CVE-2026-64423 +- !25559 [OLK-6.6] Fix CVE-2026-64538 +- nbd: skip the capacity-change printk on device bringup and release +- KVM: x86: Unconditionally recompute CR8 intercept on PPR update +- KVM: x86: Move update_cr8_intercept() to lapic.c +- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser +- vfio: Remove device debugfs before releasing devres +- audit: Fix data races of skb_queue_len() readers on audit_queue +- i2c: i801: fix hardware state machine corruption in error path +- firmware_loader: fix device reference leak in firmware_upload_register() +- netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() +- virtio-net: fix len check in receive_big() +- bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() +- net, bpf: check master for NULL in xdp_master_redirect() +- ipv6: ndisc: fix NULL deref in accept_untracked_na() +- ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). +- bridge: cfm: reject invalid CCM interval at configuration time +- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle +- net: af_key: initialize alg_key_len for IPComp states +- netpoll: fix a use-after-free on shutdown path +- ipv4: igmp: remove multicast group from hash table on device destruction +- net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes +- netfilter: ebtables: module names must be null-terminated +- netfilter: ebtables: terminate table name before find_table_lock() +- fuse: re-lock request before returning from fuse_ref_folio() +- fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req +- netfilter: ipset: fix race between dump and ip_set_list resize +- nfsd: release layout stid on setlease failure +- nfsd: reset write verifier on deferred writeback errors + +* Wed Aug 05 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-165.0.0.150 +- !25666 Fix some security issues +- !24043 ACPI: CPPC: Move reference performance to capabilities +- !25230 [OLK-6.6] Fix CVE-2026-64226 +- !25678 Fix: adapt DYNAMIC_AFFINITY for cgroup v2 +- !25683 Fix CVE-2026-64206 +- !25703 crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() +- !25615 [OLK-6.6][linux-6.6.y sync] Backport 6.6.144-6.6.145 LTS Patches +- usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect +- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms +- proc: Fix broken error paths for namespace links +- selftests/bpf: Add simple strscpy() implementation +- tools/testing: add linux/args.h header and fix radix, VMA tests +- jiffies: Cast to unsigned long in secs_to_jiffies() conversion +- jiffies: Define secs_to_jiffies() +- xfs: fix stupid compiler warning +- Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder +- selftests/hid: ensure CKI can compile our new tests on old kernels +- Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev +- ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd +- seqlock: fix scoped_seqlock_read kernel-doc +- KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers +- !25686 Subject: [PATCH] x86/cpu/hygon: fix performance regression for hygon platform +- x86/cpu/hygon: fix performance regression for hygon platform +- !25218 [OLK-6.6] Fix CVE-2026-64076 +- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() +- Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO +- exfat: preserve benign secondary entries during rename and move +- exfat: move exfat_chain_set() out of __exfat_resolve_path() +- exfat: add exfat_get_dentry_set_by_ei() helper +- exfat: rename argument name for exfat_move_file and exfat_rename_file +- exfat: remove unnecessary read entry in __exfat_rename() +- exfat: move free cluster out of exfat_init_ext_entry() +- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() +- regulator: scmi: Simplify with scoped for each OF child loop +- audit: fix potential integer overflow in audit_log_n_hex() +- audit: add audit_log_nf_skb helper function +- crypto: qat - fix restarting state leak on allocation failure +- btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC +- usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile +- nvmet: remove superfluous initialization +- usb: gadget: f_fs: initialize reset_work at allocation time +- crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A +- crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 +- usb: typec: tcpm: Fix VDM type for Enter Mode commands +- usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() +- serial: 8250_mid: Disable DMA for selected platforms +- serial: 8250_mid: Remove 8250_pci usage +- HID: appleir: fix UAF on pending key_up_timer in remove() +- treewide: Switch/rename to timer_delete[_sync]() +- proc: protect ptrace_may_access() with exec_update_lock (part 1) +- seqlock: Change do_task_stat() to use scoped_seqlock_read() +- seqlock: Introduce scoped_seqlock_read() +- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled +- HID: add haptics page defines +- perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() +- ksmbd: track the connection owning a byte-range lock +- ksmbd: centralize ksmbd_conn final release to plug transport leak +- ksmbd: use opener credentials for FSCTL mutations +- smb: client: resolve SWN tcon from live registrations +- smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() +- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() +- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister +- netfilter: ebtables: zero chainstack array +- netfilter: ebtables: Use vmalloc_array() to improve code +- media: nxp: imx8-isi: Fix use-after-free on remove +- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code +- media: nxp: imx8-isi: Convert to platform remove callback returning void +- gpio: sch: use raw_spinlock_t in the irq startup path +- coresight: etb10: restore atomic_t for shared reading state +- mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() +- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() +- staging: rtl8723bs: fix spaces around binary operators +- staging: rtl8723bs: core: move constants to right side in comparison +- PCI: Free saved list without holding pci_bus_sem +- PCI: Prevent resource tree corruption when BAR resize fails +- PCI: mediatek: Fix IRQ domain leak when port fails to enable +- PCI: mediatek: Use generic MACRO for TPVPERL delay +- PCI: mediatek: Convert bool to single quirks entry and bitmap +- PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() +- PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling +- vfio/mlx5: Fix racy bitfields and tighten struct layout +- PCI: altera: Fix resource leaks on probe failure +- ALSA: aoa: check snd_ctl_new1() return value +- iio: common: st_sensors: honour channel endianness in read_axis_data +- iio: pressure: mpl115: fix runtime PM leak on read error +- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading +- iio: imu: inv_icm42600: stabilized timestamp in interrupt +- iio: invensense: fix timestamp glitches when switching frequency +- iio: invensense: remove redundant initialization of variable period +- iio: hid-sensor-rotation: Fix stale or zero output when reading raw values +- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ +- ACPI: NFIT: core: Fix possible deadlock and missing notifications +- ACPI: NFIT: core: Use devm_acpi_install_notify_handler() +- ACPI: bus: Introduce devm_acpi_install_notify_handler() +- ACPI: driver: Check ACPI_COMPANION() against NULL during probe +- ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup +- perf/x86/amd/brs: Fix kernel address leakage +- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout +- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout +- mtd: rawnand: fsl_ifc: return errors for failed page reads +- mmc: vub300: defer reset until cmd_mutex is unlocked +- mtd: mchp23k256: use SPI match data for chip caps +- mtd: onenand: samsung: report DMA completion timeouts +- wifi: mwifiex: fix permanently busy scans after multiple roam iterations +- wifi: mac80211: free ack status frame on TX header build failure +- powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() +- reset: sunxi: fix memory region leak on ioremap failure +- ipvs: reload ip header after head reallocation +- ipvs: fix more places with wrong ipv6 transport offsets +- memstick: ms_block: reject a card that reports too many blocks +- macsec: fix promiscuity refcount leak in macsec_dev_open() +- llc: fix SAP refcount leak when creating incoming sockets +- Bluetooth: btrtl: validate firmware patch bounds +- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets +- wifi: mac80211: fix memory leak in ieee80211_register_hw() +- wifi: rt2x00: avoid full teardown before work setup in probe +- powerpc/pseries: fix memory leak on krealloc failure in papr_init +- pmdomain: imx: Fix i.MX8MP VC8000E power up sequence +- pmdomain: imx: Fix i.MX8MP power notifier +- cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed +- tracing/osnoise: Call synchronize_rcu() when unregistering +- riscv: Prevent NULL pointer dereference in machine_kexec_prepare() +- drbd: reject data replies with an out-of-range payload size +- macsec: don't read an unset MAC header in macsec_encrypt() +- ipvs: reset full ip_vs_seq structs in ip_vs_conn_new +- ipvs: use parsed transport offset in SCTP state lookup +- llc: fix SAP refcount leak in llc_ui_autobind() +- mac802154: remove interfaces with RCU list deletion +- s390/monwriter: Reject buffer reuse with different data length +- riscv: probes: save original sp in rethook trampoline +- hwmon: (asus_atk0110) Check package count before accessing element +- net: wwan: iosm: bound device offsets in the MUX downlink decoder +- ata: pata_pxa: Fix DMA channel leak on probe error +- orangefs: keep the readdir entry size 64-bit in fill_from_part() +- tracing/probes: Fix double addition of offset for @+FOFFSET +- net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked +- net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked +- net: lan743x: Initialize eth_syslock spinlock before use +- fsl/fman: Free init resources on KeyGen failure in fman_init() +- hwmon: (occ) unregister sysfs devices outside occ lock +- net: liquidio: fix BAR resource leak on PF number failure +- hwmon: (w83793) remove vrm sysfs file on probe failure +- hwmon: (w83627hf) remove VID sysfs files on error and remove +- rtc: mpfs: fix counter upload completion condition +- bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() +- espintcp: use sk_msg_free_partial to fix partial send +- LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() +- batman-adv: clean untagged VLAN on netdev registration failure +- batman-adv: ensure minimal ethernet header on TX +- batman-adv: retrieve ethhdr after potential skb realloc on RX +- net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants +- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit +- ieee802154: ca8210: fix cas_ctl leak on spi_async failure +- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation +- ieee802154: admin-gate legacy LLSEC dump operations +- net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink +- net: ipip: require CAP_NET_ADMIN in the device netns for changelink +- net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink +- net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink +- net: ena: clean up XDP TX queues when regular TX setup fails +- net/sched: act_ct: preserve tc_skb_cb across defragmentation +- net: ixp4xx_hss: fix duplicate HDLC netdev allocation +- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure +- net: sit: require CAP_NET_ADMIN in the device netns for changelink +- gpios: palmas: add .get_direction() op +- gpio-f7188x: Add support for NCT6126D version B +- cpu: hotplug: Bound hotplug states sysfs output +- cpu: hotplug: Preserve per instance callback errors +- posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() +- net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete +- Input: ims-pcu - fix type confusion in CDC union descriptor parsing +- Input: ims-pcu - fix race condition in reset_device sysfs callback +- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing +- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging +- Input: ims-pcu - fix DMA mapping violation in line setup +- Input: ims-pcu - add response length checks +- Input: ims-pcu - validate control endpoint type +- Input: ims-pcu - release data interface on disconnect +- Input: ims-pcu - fix use-after-free and double-free in disconnect +- scsi: elx: efct: Fix I/O leak on unsupported additional CDB +- scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() +- scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE +- scsi: target: Bound PR-OUT TransportID parsing to the received buffer +- scsi: xen: scsiback: Free unsubmitted command instead of double-putting it +- scsi: xen: scsiback: Free the command tag on the TMR submit-failure path +- scsi: sg: Report request-table problems when any status is set +- scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() +- scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path +- dm-verity: increase sprintf buffer size +- dm-verity: fix a possible NULL pointer dereference +- dm-integrity: don't increment hash_offset twice +- dm_early_create: fix freeing used table on dm_resume failure +- dm-stats: fix merge accounting +- dm-stats: fix dm_jiffies_to_msec64 +- dm-log: fix a bitset_size overflow on 32bit machines +- dm-ioctl: fix a possible overflow in list_version_get_info +- dm-bufio: fix wrong count calculation in dm_bufio_issue_discard +- dm era: fix out-of-bounds memory access for non-zero start sector +- dm thin metadata: fix metadata snapshot consistency on commit failure +- dm thin metadata: fix superblock refcount leak on snapshot shadow failure +- net: sparx5: unregister blocking notifier on init failure +- bpf: Add missing access_ok call to copy_user_syms +- can: bcm: add missing rcu list annotations and operations +- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure +- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF +- can: isotp: use unconditional synchronize_rcu() in isotp_release() +- can: esd_usb: kill anchored URBs before freeing netdevs +- nvmet-rdma: handle inline data with a nonzero offset +- sctp: validate STALE_COOKIE cause length before reading staleness +- spi: uniphier: Fix completion initialization order before devm_request_irq() +- tpm: Make the TPM character devices non-seekable +- tpm: fix event_size output in tpm1_binary_bios_measurements_show +- xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink +- xfrm: use compat translator only for u64 alignment mismatch +- xen/gntdev: fix error handling in ioctl +- ice: fix ice_init_link() error return preventing probe +- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() +- i2c: mediatek: fix WRRD for SoCs without auto_restart option +- hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig +- ksmbd: fix integer overflow in set_file_allocation_info() +- smb: client: use kvzalloc() for megabyte buffer in simple fallocate +- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops +- platform/x86/amd/pmc: Check for intermediate wakeup in function +- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK +- dmaengine: tegra: Fix burst size calculation +- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() +- irqchip/crossbar: Use correct index in crossbar_domain_free() +- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization +- mtd: spi-nor: swp: Improve locking user experience +- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() +- net: thunderbolt: Fix frags[] overflow by bounding frame_count +- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path +- fpga: dfl: add bounds check in dfh_get_param_size() +- ocfs2: reject non-inline dinodes with i_size and zero i_clusters +- ocfs2: reject dinodes whose i_rdev disagrees with the file type +- ocfs2: reject dinodes with non-canonical i_mode type +- ocfs2: add journal NULL check in ocfs2_checkpoint_inode() +- ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits +- ocfs2: avoid moving extents to occupied clusters +- mtd: rawnand: fix condition in 'nand_select_target()' +- net/9p: fix infinite loop in p9_client_rpc on fatal signal +- mtd: rawnand: pl353: fix probe resource allocation +- ocfs2: use kzalloc for quota recovery bitmap allocation +- scsi: sas: Skip opt_sectors when DMA reports no real optimization hint +- scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() +- 9p: skip nlink update in cacheless mode to fix WARN_ON +- mtd: slram: remove failed entries from the device list +- mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE +- proc: only bump parent nlink when registering directories +- mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error +- mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() +- riscv: cacheinfo: Fix node reference leak in populate_cache_leaves +- mips: sched: Fix CPUMASK_OFFSTACK memory corruption +- power: supply: charger-manager: fix refcount leak in is_full_charged() +- ntfs3: fix out-of-bounds read in decompress_lznt +- ntfs3: validate split-point offset in indx_insert_into_buffer +- ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head +- ntfs3: cap RESTART_TABLE free-chain walker at rt->used +- fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} +- fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow +- fs/ntfs3: validate lcns_follow in log_replay conversion +- fs/ntfs3: bound attr_off in UpdateResidentValue against data_off +- fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass +- fs/ntfs3: bound DeleteIndexEntryAllocation memmove length +- fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename +- mm/damon/core: make charge_addr_from aware of end-address exclusivity +- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak +- MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() +- MIPS: ip22-gio: fix device reference leak in probe +- MIPS: ip22-gio: fix kfree() of static object +- MIPS: ip22-gio: fix gio device memory leak +- remoteproc: qcom: Fix leak when custom dump_segments addition fails +- SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing +- lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure +- lockd: Plug nlm_file leak when nlm_do_fopen() fails +- sunrpc: wait for in-flight TLS handshake callback when cancel loses race +- sunrpc: pin svc_xprt across the asynchronous TLS handshake callback +- nvdimm/btt: Free arena sub-allocations on discover_arenas() error path +- nvdimm/btt: Free arenas on btt_init() error paths +- jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() +- Bluetooth: SCO: hold sk properly in sco_conn_ready +- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready +- HID: playstation: validate num_touch_reports in DualShock 4 reports +- mfd: tps6586x: Fix OF node refcount +- cifs: invalidate cfid on unlink/rename/rmdir +- batman-adv: tt: prevent TVLV OOB check overflow +- batman-adv: frag: fix primary_if leak on failed linearization +- batman-adv: frag: free unfragmentable packet +- batman-adv: fix VLAN priority offset +- batman-adv: tt: avoid request storms during pending request +- batman-adv: dat: fix tie-break for candidate selection +- batman-adv: dat: ensure accessible eth_hdr proto field +- batman-adv: bla: reacquire gw address after skb realloc +- batman-adv: dat: acquire ARP hw source only after skb realloc +- batman-adv: access unicast_ttvn skb->data only after skb realloc +- batman-adv: gw: acquire ethernet header only after skb realloc +- s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() +- perf/x86/amd/lbr: Fix kernel address leakage +- x86/boot: Reject too long acpi_rsdp= values +- x86/boot: Validate console=uart8250 baud rate to fix early boot hang +- tools/power/x86/intel-speed-select: Harden daemon pidfile open +- mfd: sm501: Fix reference leak on failed device registration +- leds: uleds: Fix potential buffer overread +- selinux: fix incorrect execmem checks on overlayfs +- selinux: check connect-related permissions on TCP Fast Open +- soc: fsl: qe: panic on ioremap() failure in qe_reset() +- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy +- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path +- netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() +- netfilter: xt_nat: reject unsupported target families +- netfilter: ecache: fix inverted time_after() check +- netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag +- netfilter: nf_nat_sip: reload possible stale data pointer +- netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst +- netfilter: xt_cluster: reject template conntracks in hash match +- netfilter: nfnl_cthelper: apply per-class values when updating policies +- netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read +- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback +- ASoC: mediatek: mt8183: Release reserved memory on cleanup +- ASoC: mediatek: mt8192: Release reserved memory on cleanup +- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control +- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get +- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() +- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() +- fbdev: vesafb: fix memory leak in vesafb_probe() +- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() +- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() +- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() +- fbdev: s3fb: fix potential memory leak in s3_pci_probe() +- fbdev: i740fb: fix potential memory leak in i740fb_probe() +- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() +- fbdev: sm712: Fix operator precedence in big_swap macro +- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() +- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() +- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() +- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs +- KVM: s390: pci: Fix handling of AIF enable without AISB +- KVM: arm64: vgic: Check the interrupt is still ours before migrating it +- KVM: s390: pci: Fix GISC refcount leak on AIF enable failure +- arm64: dts: qcom: sdm630: describe adsp_mem region properly +- arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() +- net: ife: require ETH_HLEN to be pullable in ife_decode() +- net: atm: reject out-of-range traffic classes in QoS validation +- net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() +- ASoC: SOF: topology: validate vendor array size before parsing +- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get +- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc +- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put +- vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter +- mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() +- mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() +- smb: client: fix overflow in passthrough ioctl bounds check +- octeontx2-af: fix VF bringup affecting PF promiscuous state +- net/mlx5: Fix L3 tunnel entropy refcount leak +- selftests/net: fix EVP_MD_CTX leak in tcp_mmap +- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK +- dm era: fix NULL pointer dereference in metadata_open() +- SUNRPC: pin upper rpc_clnt across the TLS connect_worker +- SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED +- cifs: validate DFS referral string offsets +- s390/zcrypt: Remove the empty file +- ipvs: ensure inner headers in ICMP errors are in headroom +- ipvs: fix PMTU for GUE/GRE tunnel ICMP errors +- ipvs: use parsed transport offset in TCP state lookup +- ipvs: pass parsed transport offset to state handlers +- ipv6: mcast: Fix potential UAF in MLD delayed work +- ipv6: mcast: Replace locking comments with lockdep annotations. +- ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() +- octeontx2-pf: check DMAC extraction support before filtering +- net/sched: cake: reject overhead values that underflow length +- net: usb: lan78xx: disable VLAN filter in promiscuous mode +- net: usb: lan78xx: move functions to avoid forward definitions +- net/tls: Consume empty data records in tls_sw_read_sock() +- ring-buffer: Fix event length with forced 8-byte alignment +- Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() +- Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length +- Bluetooth: MGMT: Fix adv monitor add failure cleanup +- Bluetooth: 6lowpan: hold L2CAP conn across debugfs control +- amt: fix size calculation in amt_get_size() +- net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket +- net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload +- net: qualcomm: rmnet: validate MAP frame length before ingress parsing +- qede: fix off-by-one in BD ring consumption on build_skb failure +- net: microchip: vcap: fix races on the shared Super VCAP block +- net/mlx5e: Fix HV VHCA stats agent registration race +- net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation +- netfilter: xt_connmark: reject invalid shift parameters +- netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop +- netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() +- netfilter: xt_u32: reject invalid shift counts +- gue: validate REMCSUM private option length +- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup +- selftests/hid: Cover hid_bpf_get_data() size overflow +- selftests/hid: convert the hid_bpf selftests with struct_ops +- selftests/hid: force using our compiled libbpf headers +- selftests/hid: do not manually call headers_install +- selftests/hid: ensure we can compile the tests on kernels pre-6.3 +- HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() +- ata: sata_gemini: unwind clocks on IDE pinctrl errors +- minix: avoid overflow in bitmap block count calculation +- afs: Fix unchecked-length string display in debug statement +- afs: Fix the volume AFS_VOLUME_RM_TREE is set on +- afs: Fix vllist leak +- afs: Fix callback service message parsers to pass through -EAGAIN +- afs: use kvfree() to free memory allocated by kvcalloc() +- afs: Fix error code in afs_extract_vl_addrs() +- fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid +- net/sched: hhf: clear heavy-hitter state on reset +- pinctrl: meson: restore non-sleeping GPIO access +- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe +- ksmbd: fix use-after-free of fp->owner.name in durable handle owner check +- smb: move some duplicate definitions to common/cifsglob.h +- net/sched: act_bpf: use rcu_dereference_bh() to read the filter +- cxgb4: Fix decode strings dump for T6 adapters +- virtio_net: disable cb when NAPI is busy-polled +- irqchip/ts4800: Fix missing chained handler cleanup on remove +- irqchip/gic-v3-its: Fix OF node reference leak +- tracing: eprobe: read the complete FILTER_PTR_STRING pointer +- tracing/events: Fix to check the simple_tsk_fn creation +- bridge: stp: Fix a potential use-after-free when deleting a bridge +- net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF +- net: gianfar: dispose irq mappings on probe failure and device removal +- net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy +- usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() +- hwmon: (pmbus) Fix passing events to regulator core +- hwmon: adm1275: Prevent reading uninitialized stack +- MIPS: DEC: Ensure RTC platform device deregistration upon failure +- sctp: fix SCTP_RESET_STREAMS stream list length limit +- net: enetc: check the number of BDs needed for xdp_frame +- qede: fix out-of-bounds check for cqe->len_list[] +- seg6: validate SRH length before reading fixed fields +- gpio: htc-egpio: use managed gpiochip registration +- gpio: mvebu: fail probe if gpiochip registration fails +- spi: sh-msiof: abort transfers when reset times out +- tracing: probes: fix typo in a log message +- dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback +- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count +- net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove +- net: sungem: fix probe error cleanup +- net: mvneta: re-enable percpu interrupt on resume +- rtc: cmos: unregister HPET IRQ handler on probe failure +- rtc: ds1307: Fix off-by-one issue with wday for rx8130 +- smb/client: preserve errors from smb2_set_sparse() +- ipv6: fix error handling in disable_policy sysctl +- ipv6: fix error handling in forwarding sysctl +- ipv6: fix error handling in ignore_routes_with_linkdown sysctl +- ipv6: fix error handling in disable_ipv6 sysctl +- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle +- veth: fix NAPI leak in XDP enable error path +- net: dsa: sja1105: round up PTP perout pin duration +- net, bpf: check master for NULL in xdp_master_redirect() +- alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs +- alpha/PCI: Add security_locked_down() check to pci_mmap_resource() +- NTB: epf: Fix doorbell bitmask and IRQ vector handling +- NTB: epf: Report 0-based doorbell vector via ntb_db_event() +- NTB: epf: Make db_valid_mask cover only real doorbell bits +- netfilter: nft_compat: ebtables emulation must reject non-bridge targets +- netfilter: nft_synproxy: stop bypassing the priv->info snapshot +- netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() +- ipv4: fib: Don't ignore error route in local/main tables. +- ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). +- ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE +- rtc: msc313: fix NULL deref in shared IRQ handler at probe +- i40e: Fix i40e_debug() to use struct i40e_hw argument +- ice: fix AQ error code comparison in ice_set_pauseparam() +- ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() +- PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 +- PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 +- bpf: zero-initialize the fib lookup flow struct +- bpf: Fix stack slot index in nospec checks +- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 +- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags +- octeontx2-pf: mcs: Fix mcs resources free on PF shutdown +- octeontx2-pf: Clear stats of all resources when freeing resources +- octeontx2-af: mcs: Fix unsupported secy stats read +- net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths +- tipc: fix use-after-free of the discoverer in tipc_disc_rcv() +- net: marvell: prestera: initialize err in prestera_port_sfp_bind +- selftests/mm: fix exclusive_cow test fork() handling +- selftests/mm: allow PUD-level entries in compound testcase of hmm tests +- selftests/mm: clarify alternate unmapping in compaction_test +- irqchip/crossbar: Fix parent domain resource leak +- netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak +- netfilter: nf_reject: skip iphdr options when looking for icmp header +- netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() +- netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types +- netfilter: ipset: annotate "pos" for concurrent readers/writers +- netfilter: ipset: Fix data race between add and dump in all hash types +- md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry +- ieee802154: fix kernel-infoleak in dgram_recvmsg() +- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() +- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() +- ACPI: resource: Amend kernel-doc style +- thermal: intel: Fix dangling resources on thermal_throttle_online() failure +- arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS +- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints +- flow_dissector: check device type before reading ETH_ADDRS +- devlink: Fix parent ref leak in devl_rate_node_create() +- dpaa2-switch: fix VLAN upper check not rejecting bridge join +- virtio-net: fix len check in receive_big() +- spi: rpc-if: Use correct device for hardware reinitialization on resume +- PCI: iproc: Restore .map_irq() for the platform bus driver +- sctp: hold socket lock when dumping endpoints in sctp_diag +- net: psample: fix info leak in PSAMPLE_ATTR_DATA +- octeontx2-pf: Fix leak of SQ timestamp buffer on teardown +- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm +- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free +- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode +- xfrm: validate selector family and prefixlen during match +- xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] +- xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path +- xfrm: Use the XFRM_GRO to indicate a GRO call on input +- spi: dw: fix wrong BAUDR setting after resume +- gpio: mlxbf3: fail probe if gpiochip registration fails +- sparc: led: avoid trimming a newline from empty writes +- apparmor: fix label can not be immediately before a declaration +- i3c: master: Prevent reuse of dynamic address on device add failure +- apparmor: put secmark label after secid lookup +- apparmor: aa_getprocattr free procattr leak on format failure +- apparmor: fix potential UAF in aa_replace_profiles +- apparmor: grab ns lock and refresh when looking up changehat child profiles +- apparmor: fix rawdata_f_data implicit flex array +- apparmor: aa_label_alloc use aa_label_free on alloc failure +- apparmor: check label build before no_new_privs test +- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() +- Revert "PCI/MSI: Unmap MSI-X region on error" +- PCI: mediatek: Use actual physical address instead of virt_to_phys() +- PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() +- tools lib api: Fix mount_overload() snprintf truncation and toupper range +- tools lib api: Fix filename__write_int() writing uninitialized stack data +- tools lib api: Fix missing null termination in filename__read_int/ull() +- xprtrdma: Return sendctx slot after Send preparation failure +- xprtrdma: Repost Receive buffers for malformed replies +- xprtrdma: Sanitize the reply credit grant after parsing +- xprtrdma: Fix bcall rep leak and unbounded peek +- xprtrdma: Resize reply buffers before reposting receives +- xprtrdma: Document and assert reply-handler invariants +- xprtrdma: Check frwr_wp_create() during connect +- PCI: rcar-host: Remove unused LIST_HEAD(res) +- fs/ntfs3: resize log->one_page_buf when adopting on-disk page size +- PCI: meson: Propagate devm_add_action_or_reset() failure +- PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro +- NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write +- NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors +- nfs: keep PG_UPTODATE clear after read errors in page groups +- NFSv4/pnfs: defer return_range callbacks until after inode unlock +- xprtrdma: Decouple req recycling from RPC completion +- xprtrdma: Use sendctx DMA state for Send signaling +- xprtrdma: Post receive buffers after RPC completion +- xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot +- xprtrdma: Avoid 250 ms delay on backlog wakeup +- xprtrdma: Remove temp allocation of rpcrdma_rep objects +- pNFS/filelayout: fix cheking if a layout is striped +- clk: qcom: a53: Corrected frequency multiplier for 1152MHz +- dmaengine: Fix possible use after free +- dmaengine: qcom: gpi: set DMA_PRIVATE capability +- perf: Fix off-by-one stack buffer overflow in kallsyms__parse() +- dmaengine: imx-sdma: Refine spba bus searching in probe +- drm/amd/display: Add missing kdoc for ALLM parameters +- fs/ntfs3: fix mount failure on 64K page-size kernels +- fs/ntfs3: add bounds check to run_get_highest_vcn() +- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter +- clk: at91: keep securam node alive while mapping it +- iio: tcs3472: power down chip on probe failure +- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() +- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling +- iio: magnetometer: ak8975: fix potential kernel stack memory leak +- iio: light: si1133: prevent race condition on timeout +- iio: light: si1133: reset counter to prevent race condition +- char: tlclk: fix use-after-free in tlclk_cleanup() +- usb: host: max3421: Reject hub port requests for non-existent ports +- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() +- staging: most: video: avoid double free on video register failure +- mailbox: mtk-adsp: fix UAF during device teardown +- phy: phy-can-transceiver: Check driver match and driver data against NULL +- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() +- platform/x86: xo15-ebook: Fix wakeup source and GPE handling +- x86/platform/olpc: xo15: Drop wakeup source on driver removal +- PCI/ASPM: Don't reconfigure ASPM entering low-power state +- coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore +- coresight: cti: Fix DT filter signals silently ignored +- staging: nvec: fix use-after-free in nvec_rx_completed() +- net/9p: fix race condition on rdma->state in trans_rdma.c +- ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write +- mfd: cs42l43: Sanity check firmware size +- ksmbd: fix use-after-free in same_client_has_lease() +- ionic: Fix check in ionic_get_link_ext_stats +- tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) +- tipc: fix UAF in tipc_l2_send_msg() +- KEYS: Use acquire when reading state in keyring search +- powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus +- powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down +- MIPS: mm: Fix out-of-bounds write in maar_res_walk() +- bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check +- bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() +- bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket +- selftests/bpf: Initialize operation name before use +- smb/client: always return a value for FS_IOC_GETFLAGS +- cifs: remove all cifs files before kill super +- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() +- netfilter: nf_conncount: callers must hold rcu read lock +- kcm: use WRITE_ONCE() when changing lower socket callbacks +- net: bcmgenet: Use weighted round-robin TX DMA arbitration +- net: wwan: t7xx: check skb_clone in control TX +- net/mlx5: Check max_macs devlink param value against max capability +- bpf: Run generic devmap egress prog on private skb +- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check +- net: mana: initialize gdma queue id to INVALID_QUEUE_ID +- net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen +- net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen +- handshake: Require admin permission for DONE command +- power: supply: core: fix supplied_from allocations +- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO +- spi: xilinx: use FIFO occupancy register to determine buffer size +- crypto: rng - Free default RNG on module exit +- crypto: cavium/cpt - fix DMA cleanup using wrong loop index +- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index +- cxl/test: Add check after kzalloc() memory in alloc_mock_res() +- tipc: reject inverted service ranges from peer bindings +- tipc: prevent snt_unacked underflow on CONN_ACK +- tipc: require net admin for TIPCv2 netlink mutators +- net/sched: sch_hfsc: Don't make class passive twice +- sctp: validate embedded address parameter length +- bridge: cfm: reject invalid CCM interval at configuration time +- net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). +- net/sched: cls_flow: Dont expose folded kernel pointers +- ASoC: tegra: tegra210_ahub: Validate written enum value +- ASoC: fsl: fsl_audmix: Validate written enum values +- ASoC: codecs: hdac_hdmi: Validate written enum value +- RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one +- RDMA/mlx5: Fix undefined shift of user RQ WQE size +- RDMA/mlx5: Remove raw RSS QP restrack tracking +- fs: efs: remove unneeded debug prints +- Bluetooth: vhci: validate devcoredump state before side effects +- Bluetooth: hci: validate codec capability element length +- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device +- s390/process: Fix kernel thread function pointer type +- bpf: Tighten cgroup storage cookie checks for prog arrays +- of: cpu: add check in __of_find_n_match_cpu_property() +- cxl/test: Zero out LSA backing memory to avoid leaking to user +- cxl/test: Fix integer overflow in mock LSA bounds checks +- selftests/bpf: Fix bpf_iter/task_vma test +- ext4: fix kernel BUG in ext4_write_inline_data_end +- bonding: 3ad: fix mux port state on oper down +- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails +- tools/virtio: check mmap return value in vringh_test +- vhost/net: complete zerocopy ubufs only once +- vduse: Requeue failed read to send_list head +- vhost/vdpa: validate virtqueue index in mmap and fault paths +- vduse: hold vduse_lock across IDR lookup in open path +- ASoC: codecs: aw88261: fix incorrect masks for boost regs +- spi: meson-spifc: fix runtime PM leak on remove +- IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified +- btrfs: zoned: don't account data relocation space-info in statfs free space +- hwmon: (it87) Clamp negative values to zero in set_fan() +- fbdev: sm501fb: Fix buffer errors in OF binding code +- btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() +- wifi: mt76: mt7921: fix potential tx_retries underflow +- wifi: mt76: mt7915: fix potential tx_retries underflow +- wifi: mt76: fix argument to ieee80211_is_first_frag() +- hwspinlock: qcom: avoid uninitialized struct members +- vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() +- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 +- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 +- scsi: target: Remove tcm_loop target reset handling +- watchdog: unregister PM notifier on watchdog unregister +- configfs: fix lockless traversals of ->s_children +- firmware_loader: Fix recursive lock in device_cache_fw_images() +- spi: ep93xx: fix double-free of zeropage on DMA setup failure +- IB/mlx5: Properly support implicit ODP rereg_mr +- IB/mlx5: Don't take the rereg_mr fallback without a new translation +- ACPI: IPMI: Fix message kref handling on dead device +- ALSA: seq: Clear variable event pointer on read +- riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe +- ALSA: seq: Fix partial userptr event expansion +- wifi: wcn36xx: fix OOB read from short trigger BA firmware response +- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication +- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response +- bpf: Update transport_header when encapsulating UDP tunnel in lwt +- arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well +- RDMA/irdma: Initialize iwmr->access during MR registration +- RDMA/irdma: Fix OOB read during CQ MR registration +- IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() +- netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp +- netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock +- netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures +- ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() +- ocfs2/dlm: require a ref for locking_state debugfs open +- ocfs2: reject FITRIM ranges shorter than a cluster +- ocfs2: fix buffer head management in ocfs2_read_blocks() +- ocfs2: rebase copied fsdlm LVB pointers in locking_state +- perf/x86/amd/core: Always use the NMI latency mitigation +- bpftool: Use libbpf error code for flow dissector query +- drm/amdgpu: set sub_block_index for mca ras sub-blocks +- configfs_lookup(): don't leave ->s_dentry dangling on failure +- lib/test_meminit: use && for bools +- sched: restore timer_slack_ns when resetting RT policy on fork +- ext2: fix ignored return value of generic_write_sync() +- mm/fake-numa: fix under-allocation detection in uniform split +- scsi: ufs: Fix wrong value printed in unexpected UPIU response case +- scsi: pm8001: Fix error code in non_fatal_log_show() +- scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" +- nvdimm/btt: Handle preemption in BTT lane acquisition +- ARM: imx31: Fix IIM mapping leak in revision check +- ata: libata: Fix ata_exec_internal() +- HID: wiimote: Fix table layout and whitespace errors +- ARM: imx3: Fix CCM node reference leak +- ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble +- ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback +- md/raid10: reset read_slot when reusing r10bio for discard +- rpmsg: use generic driver_override infrastructure +- media: qcom: venus: relax encoder frame/blur step size on v6 +- media: qcom: venus: relax encoder frame/blur dimension steps on v4 +- media: qcom: venus: drop extra padding in NV12 raw size calculation +- RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path +- RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe +- EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info +- drm/msm/dp: Fix the ISR_* enum values +- drm/msm/dp: fix HPD state status bit shift value +- ocfs2: kill osb->system_file_mutex lock +- ocfs2: don't BUG_ON an invalid journal dinode +- rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() +- dax/kmem: account for partial discontiguous resource upon removal +- libbpf: Fix UAF in strset__add_str() +- libbpf: Harden parse_vma_segs() path parsing +- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada +- drm/tegra: Fix iommu_map_sgtable() return value check +- gpu: host1x: Fix iommu_map_sgtable() return value check +- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() +- gpu: host1x: Allow entries in BO caches to be freed +- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove +- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered +- net/sched: cls_bpf: prevent unbounded recursion in offload rollback +- ipv6: guard against possible NULL deref in __in6_dev_stats_get() +- workqueue: drop spurious '*' from print_worker_info() fn declaration +- nvme-multipath: fix flex array size in struct nvme_ns_head +- pinctrl: cs42l43: Fix polarity on debounce +- ALSA: seq: midi: Serialize output teardown with event_input +- mtd: spi-nor: Drop duplicate Kconfig dependency +- mips: n64: add __iomem for writel call +- mips: ralink: mt7621: add missing __iomem +- MIPS: DEC: Remove do_IRQ() call indirection +- MIPS: Fix big-endian stack argument fetching in o32 wrapper +- PM: sleep: Use complete() in device_pm_sleep_init() +- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup +- IB/mlx4: Fix refcount leak in add_port() error path +- RDMA/rxe: Fix a use-after-free problem in rxe_mmap +- RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs +- bus: sunxi-rsb: Always check register address validity +- pwm: imx27: Fix variable truncation in .apply() +- device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() +- arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node +- firmware: arm_scmi: Fix OOB in scmi_power_name_get() +- media: rockchip: rga: fix too small buffer size +- net/sched: sch_drr: annotate data-races around cl->deficit +- regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions +- bitops: use common function parameter names +- sysfs: clamp show() return value in sysfs_kf_read() +- firmware: arm_scmi: Read sensor config as 32-bit value +- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() +- RDMA/srpt: fix integer overflow in immediate data length check +- RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference +- RDMA/hns: Fix arithmetic overflow in calc_hem_config() +- IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier +- ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD +- net/sched: sch_htb: annotate data-races (I) +- net/sched: sch_htb: do not change sch->flags in htb_dump() +- crypto: ccp - Treat zero-length cert chain as query for blob lengths +- net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() +- clk: scpi: Unregister child clock providers on remove +- thermal: hwmon: Fix critical temperature attribute removal +- evm: terminate and bound the evm_xattrs read buffer +- drm/hisilicon/hibmc: use clock to look up the PLL value +- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() +- arm64: dts: qcom: sm8450: Fix ICE reg size +- clk: scmi: Fix clock rate rounding +- arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host +- iommu/amd: Fix a stale comment about which legacy mode is user visible +- nilfs2: fix backing_dev_info reference leak +- dlm: fix add msg handle in send_queue ordered +- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents +- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve +- crypto: atmel-sha204a - fix blocking and non-blocking rng logic +- vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). +- arm64: dts: imx8x-colibri: Correct SODIMM PAD settings +- arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc +- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path +- media: v4l2-common: Add YUV24 format info +- media: cedrus: Fix failure to clean up hardware on probe failure +- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure +- watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 +- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH +- ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint +- wifi: ath9k: fix OOB access from firmware tx status queue ID +- kconfig: fix potential NULL pointer dereference in conf_askvalue +- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer +- wifi: rtw89: Correct data type for scan index to avoid infinite loop +- driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() +- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc +- dt-bindings: pinctrl: nvidia,tegra234: Add missing required block +- arm64: tegra: Fix Tegra234 MGBE PTP clock +- wifi: cfg80211: fix grammar in MLO group key error message +- arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning +- arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S +- Documentation: proc: fix section numbering in table of contents +- libbpf: Report error when a negative kprobe offset is specified +- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure +- drm/radeon: fix integer overflow in radeon_align_pitch() +- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() +- drm/tidss: Drop extra drm_mode_config_reset() call +- drm/rockchip: Test for imported buffers with drm_gem_is_imported() +- clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() +- afs: Fix further netns teardown to cancel the preallocation charger +- afs: fix NULL pointer dereference in afs_get_tree() +- afs: Fix netns teardown to cancel the preallocation charger +- rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) +- serial: 8250_omap: clear rx_running on zero-length DMA completes +- serial: msm: Disable DMA for kernel console UART +- dt-bindings: power: imx93: Add MIPI PHY power domain +- dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties +- media: uvcvideo: Fix sequence number when no EOF +- media: uvcvideo: Fix buffer sequence in frame gaps +- media: uvcvideo: Avoid partial metadata buffers +- crypto: crypto4xx - Remove insecure and unused rng_alg +- crypto: crypto4xx - Remove ahash-related code +- crypto: sun4i-ss - Remove insecure and unused rng_alg +- nvmet-tcp: Fix potential UAF when ddgst mismatch +- KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU +- crypto: algif_skcipher - force synchronous processing on trees without ctx->state +- fuse: re-lock request before returning from fuse_ref_folio() +- fuse: fix device node leak in cuse_process_init_reply() +- RDMA/siw: bound Read Response placement to the RREAD length +- RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg +- Input: maplecontrol - set driver data before registering input device +- Input: maplemouse - set driver data before registering input device +- Input: maple_keyb - set driver data before registering input device +- Input: mms114 - fix multi-touch slot corruption +- Input: maplemouse - fix NULL pointer dereference in open() +- Input: mms114 - reject an oversized device packet size +- Input: touchwin - reset the packet index on every complete packet +- Input: mms114 - fix touch indexing for MMS134S and MMS136 +- Input: iforce - bound the device-reported force-feedback effect index +- Input: goodix - clamp the device-reported contact count +- Input: elan_i2c - prevent division by zero and arithmetic underflow +- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count +- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count +- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure +- i2c: stm32f7: truncate clock period instead of rounding it +- i2c: mpc: Fix timeout calculations +- udmabuf: fix DMA direction mismatch in release_udmabuf() +- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode +- KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs +- NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() +- exfat: bound uniname advance in exfat_find_dir_entry() +- module: decompress: check return value of module_extend_max_pages() +- watchdog: apple: Add "apple,t8103-wdt" compatible +- EDAC/i10nm: Don't fail probing if ADXL is missing +- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path +- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() +- arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() +- crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation +- crypto: talitos/hash - remove useless wrapper +- crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request +- crypto: talitos/hash - drop workqueue mechanism for SEC1 +- crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue +- crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor +- crypto: talitos - move code in current_desc_hdr() into a standalone function +- crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function +- crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function +- crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 +- crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header +- crypto: drbg - Fix the fips_enabled priority boost +- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels +- crypto: caam - use print_hex_dump_devel to guard key hex dumps again +- crypto: caam - use print_hex_dump_devel to guard key hex dumps +- crypto: af_alg - Remove zero-copy support from skcipher and aead +- partitions: aix: bound the pp_count scan to the ppe array +- btrfs: do not trim a device which is not writeable +- nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks +- dm-ioctl: report an error if a device has no table +- hwrng: jh7110 - fix refcount leak in starfive_trng_read() +- iio: temperature: ltc2983: Fix n_wires default bypassing rotation check +- usb: typec: ucsi: cancel pending work on system suspend +- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove +- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode +- usb: typec: ucsi: Invert DisplayPort role assignment +- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() +- usb: typec: class: drop PD lookup reference +- usb: typec: anx7411: use devm_pm_runtime_enable() +- usbip: vudc: fix NULL deref in vep_dequeue() +- usbip: tools: support SuperSpeedPlus devices +- USB: usb-storage: ene_ub6250: restore media-ready check +- USB: ulpi: fix memory leak on registration failure +- USB: serial: digi_acceleport: fix write buffer corruption +- USB: serial: digi_acceleport: fix hard lockup on disconnect +- USB: serial: digi_acceleport: fix broken rx after throttle +- USB: serial: option: add Telit Cinterion FE990D50 compositions +- USB: serial: keyspan_pda: fix information leak +- usb: mtu3: unmap request DMA on queue failure +- USB: misc: uss720: unregister parport on probe failure +- USB: storage: include US_FL_NO_SAME in quirks mask +- usb: sl811-hcd: disable controller wakeup on remove +- USB: legousbtower: fix use-after-free on disconnect race +- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD +- USB: ldusb: fix use-after-free on disconnect race +- USB: idmouse: fix use-after-free on disconnect race +- usb: gadget: f_printer: take kref only for successful open +- usb: gadget: udc: Fix use-after-free in gadget_match_driver +- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler +- usb: free iso schedules on failed submit +- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() +- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub +- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() +- usb: cdc_acm: Add quirk for Uniden BC125AT scanner +- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() +- bpf: Restore sysctl new-value from 1 to 0 +- xfs: fix unreachable BIGTIME check in dquot flush validation +- xfs: use null daddr for unset first bad log block +- media: mtk-jpeg: cancel workqueue on release for supported platforms only +- nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers +- hfs/hfsplus: zero-initialize buffer in hfs_bnode_read +- HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads +- HID: letsketch: fix UAF on inrange_timer at driver unbind +- HID: wacom: stop hardware after post-start probe failures +- tools/mm/slabinfo: fix total_objects attribute name +- tools/mm/slabinfo: Fix trace disable logic inversion +- X.509: Fix validation of ASN.1 certificate header +- clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances +- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path +- cpufreq: pcc: fix use-after-free and double free in _OSC evaluation +- cpufreq: Fix hotplug-suspend race during reboot +- cpufreq: intel_pstate: Sync policy->cur during CPU offline +- firmware_loader: fix device reference leak in firmware_upload_register() +- OPP: of: Fix potential memory leak in opp_parse_supplies() +- smb: client: use unaligned reads in parse_posix_ctxt() +- smb: client: fix query directory replay double-free +- ksmbd: use opener credentials for delete-on-close +- ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION +- ksmbd: run set info with opener credentials +- ksmbd: require source read access for duplicate extents +- ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation +- ksmbd: serialize QUERY_DIRECTORY requests per file +- ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE +- smb/client: Fix error code in smb2_aead_req_alloc() +- coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() +- fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() +- fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() +- fs/ntfs3: handle attr_set_size() errors when truncating files +- fs/ntfs3: fsync files by syncing parent inodes +- Bluetooth: L2CAP: validate option length before reading conf opt value +- Bluetooth: fix UAF in bt_accept_dequeue() +- Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() +- Bluetooth: bnep: pin L2CAP connection during netdev registration +- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() +- netfilter: ebtables: terminate table name before find_table_lock() +- netfilter: ebtables: module names must be null-terminated +- mm: shrinker: fix NULL pointer dereference in debugfs +- mfd: cros_ec: Delay dev_set_drvdata() until probe success +- net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes +- ipv4: igmp: remove multicast group from hash table on device destruction +- gpio: eic-sprd: use raw_spinlock_t in the irq startup path +- NTB: epf: Avoid calling pci_irq_vector() from hardirq context +- fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns +- debugobjects: Plug race against a concurrent OOM disable +- Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete +- audit: Fix data races of skb_queue_len() readers on audit_queue +- net: af_key: initialize alg_key_len for IPComp states +- crypto: amlogic - avoid double cleanup in meson_crypto_probe() +- staging: rtl8723bs: fix OOB write in HT_caps_handler() +- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop +- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() +- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop +- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop +- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() +- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() +- staging: media: atomisp: reduce load_primary_binaries() stack usage +- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe +- staging: vme_user: fix location monitor leak in tsi148 bridge +- staging: vme_user: fix location monitor leak in fake bridge +- staging: vme_user: bound slave read/write to the kern_buf size +- tipc: fix out-of-bounds read in broadcast Gap ACK blocks +- 6lowpan: fix NHC entry use-after-free on error path +- usb: dwc3: run gadget disconnect from sleepable suspend context +- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() +- virtio-mmio: fix device release warning on module unload +- netfilter: ipset: fix race between dump and ip_set_list resize +- mm/damon/ops-common: handle extreme intervals in damon_hot_score() +- PCI: host-common: Request bus reassignment when not probe-only +- PCI: altera: Do not dispose parent IRQ mapping +- usb: typec: tcpci_rt1711h: unregister TCPCI port with devres +- usb: xhci: Fix sleep in atomic context in xhci_free_streams() +- binder: fix UAF in binder_free_transaction() +- binder: fix UAF in binder_thread_release() +- Bluetooth: btusb: fix wakeup source leak on probe failure +- Bluetooth: btusb: fix use-after-free on marvell probe failure +- Bluetooth: btusb: fix use-after-free on registration failure +- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB +- vfio/pci: Release the VGA arbiter client on register_device() failure +- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes +- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes +- ALSA: usb-audio: Roll back quirk control caches on write errors +- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks +- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() +- ALSA: usb-audio: avoid kobject path lookup in DualSense match +- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() +- ALSA: ice1712: check snd_ctl_new1() return value +- ALSA: gus: check snd_ctl_new1() return value +- ALSA: firewire: isight: bound the sample count to the packet payload +- ALSA: es1938: check snd_ctl_new1() return value +- ALSA: cmipci: check snd_ctl_new1() return value +- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser +- ALSA: ymfpci: check snd_ctl_new1() return value +- ALSA: virtio: Add missing 384 kHz PCM rate mapping +- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start +- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call +- iio: light: veml6030: fix channel type when pushing events +- iio: light: tsl2591: return actual error from probe IRQ failure +- iio: light: opt3001: fix missing state reset on timeout +- iio: light: gp2ap002: fix runtime PM leak on read error +- iio: light: al3010: fix incorrect scale for the highest gain range +- iio: imu: st_lsm6dsx: deselect shub page before reading whoami +- iio: imu: inv_icm42600: fix timestamp clock period by using lower value +- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ +- iio: gyro: bmg160: wait full startup time after mode change at probe +- iio: gyro: bmg160: bail out when bandwidth/filter is not in table +- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug +- iio: adc: ti-ads124s08: Return reset GPIO lookup errors +- iio: adc: spear: Initialize completion before requesting IRQ +- iio: adc: lpc32xx: Initialize completion before requesting IRQ +- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error +- iio: accel: bmc150: clamp the device-reported FIFO frame count +- usb: gadget: function: rndis: add length check for header +- usb: gadget: function: rndis: add length check to response query +- !25689 backport minios patches from linux mainline +- !25661 Fix CVE-2026-64544 +- ACPI: CPPC: Fix uninitialized ref variable in cppc_get_perf_caps() +- ACPI: CPPC: Move reference performance to capabilities +- crypto: talitos - rename first/last to first_desc/last_desc +- crypto: talitos - fix SEC1 32k ahash request limitation +- crypto: talitos - stop using crypto_ahash::init +- Revert "crypto: talitos - fix SEC1 32k ahash request limitation" +- Revert "crypto: talitos - rename first/last to first_desc/last_desc" +- ACPI: NFIT: core: Fix possible NULL pointer dereference +- ACPI: CPPC: Suppress UBSAN warning caused by field misuse +- perf trace beauty fcntl: Fix build with older kernel headers +- Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID +- xfs: move ->iop_recover to xfs_defer_op_type +- xfs: use xfs_defer_finish_one to finish recovered work items +- xfs: dump the recovered xattri log item if corruption happens +- xfs: recreate work items when recovering intent items +- net: add a common function to compute features for upper devices +- bonding: Correctly support GSO ESP offload +- bonding: add ESP offload features when slaves support +- bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features +- net, team, bonding: Add netdev_base_features helper +- net: team: rename team to team_core for linking +- nfsd: change nfs4_client_to_reclaim() to allocate data +- nfsd: move name lookup out of nfsd4_list_rec_dir() +- apparmor: advertise the tcp fast open fix is applied +- nfsd: Don't reset the write verifier on a commit EAGAIN +- NFSv4/flexfiles: reject zero filehandle version count +- fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() +- i2c: core: fix irq domain leak on adapter registration failure +- block: Avoid mounting the bdev pseudo-filesystem in userspace +- f2fs: fix listxattr handling of corrupted xattr entries +- f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() +- f2fs: fix potential deadlock in f2fs_balance_fs() +- f2fs: bound i_inline_xattr_size for non-inline-xattr inodes +- f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode +- f2fs: validate orphan inode entry count +- device property: initialize the remaining fields of fwnode_handle in fwnode_init() +- drm/amd: Fix set but not used warnings +- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd +- slimbus: Convert to platform remove callback returning void +- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership +- slimbus: qcom-ngd-ctrl: Fix probe error path ordering +- userfaultfd: gate must_wait writability check on pte_present() +- Bluetooth: btusb: mediatek: return error for failed reg access +- Bluetooth: btusb: mediatek: remove the unnecessary goto tag +- Bluetooth: btusb: mediatek: add MT7922 subsystem reset +- Bluetooth: btusb: mediatek: reset the controller before downloading the fw +- Bluetooth: btmtk: apply the common btmtk_fw_get_filename +- nfsd: reset write verifier on deferred writeback errors +- nfsd: release layout stid on setlease failure +- bpf, arm64: Reject out-of-range B.cond targets +- ia64: Make acpi_cpufreq_cpu_exit return void +- drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() +- drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler +- arm64/hwcap: Define hwcaps for 2023 DPISA features +- arm64/cpufeature: Hook new identification registers up to cpufeature +- arm64/sysreg: Update ID_AA64SMFR0_EL1 definition for DDI0601 2023-09 +- arm64/sysreg: Update ID_AA64ISAR2_EL1 defintion for DDI0601 2023-09 +- arm64/sysreg: Update SCTLR_EL1 for DDI0601 2023-09 +- arm64/sysreg: Add definition for FPMR +- arm64/sysreg: Add definition for ID_AA64FPFR0_EL1 +- arm64/sysreg: Add definition for ID_AA64ISAR3_EL1 +- arm64/sysreg: Add definition for ID_AA64PFR2_EL1 +- !25080 netfilter: ebtables: move to two-stage removal scheme +- !25685 nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path +- !25631 crypto: qat - protect service table iterations with service_lock +- nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path +- Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock +- drivers/ub/sentry: add count == 0 check in proc write handlers +- drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() +- drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path +- cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 +- cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals +- cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus +- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents +- crypto: qat - protect service table iterations with service_lock +- sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path +- netfilter: bridge: eb_tables: close module init race +- netfilter: ebtables: move to two-stage removal scheme + +* Tue Aug 04 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-164.0.0.149.20260804.9e43d70e7ad5 +- !25627 Fix CVE-2026-64539 +- !25567 [OLK-6.6] Fix CVE-2026-64546 +- !25641 proc: protect ptrace_may_access() with exec_update_lock (FD links) +- !25637 vfio/pci: Latch disable_idle_d3 per device +- !25649 mainline bpf +- bpf: Fix UAF in sock clone early bailouts +- bpf: Disable xfrm_decode_session hook attachment +- bpf,fork: wipe ->bpf_storage before bailouts that access it +- !25048 KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() +- !25593 Fix CVE-2026-64304 +- proc: protect ptrace_may_access() with exec_update_lock (FD links) +- vfio/pci: Latch disable_idle_d3 per device +- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD +- crypto: qat - validate RSA CRT component lengths +- drm/edid: fix OOB read in drm_parse_tiled_block() +- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() + +* Mon Aug 03 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-164.0.0.149.20260803.145abda29400 +- !25632 v2 bpf mainline +- !24961 i2c: core: fix adapter registration race +- !25633 ALSA: hda/cs35l41: Fix firmware load work teardown +- !25635 vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc +- !25636 iommufd: Break the loop on failure in iommufd_fault_fops_read() +- !25605 posix-cpu-timers: Prevent UAF caused by non-leader exec() race +- !25600 Fix CVE-2026-64496 +- !25602 Fix CVE-2026-64456 +- iommufd: Break the loop on failure in iommufd_fault_fops_read() +- vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc +- !25272 [OLK-6.6] Fix CVE-2026-64306 +- !25274 [OLK-6.6] Fix CVE-2026-64313 +- !25273 [OLK-6.6] Fix CVE-2026-64312 +- !25472 [OLK-6.6] Fix CVE-2026-64531 +- ALSA: hda/cs35l41: Fix firmware load work teardown +- bpf: Clear rb node linkage when freeing bpf_rb_root +- bpf: Add validation for bpf_set_retval argument +- bpf: Reject sleepable BPF_LSM_CGROUP programs at load time +- bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno +- bpf: Guard __get_user acesss with access_ok for uprobe_multi data +- !25608 nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page +- !25490 e1000e: Fix out-of-bounds MMIO access by validating BAR0 size +- !25619 v2 bpf: Support for hardening against JIT spraying +- !25618 sched/xsched: fix permission issues +- !25504 i2c: stub: Reject I2C block transfers with invalid length +- !25625 rme: use DMA API for virtio in realm world +- !25612 udf: validate sparing table length as an entry count, not a byte count +- !25611 smb: client: harden POSIX SID length parsing +- !25610 smb: client: mask server-provided mode to 07777 in modefromsid +- !25609 smb: client: Fix next buffer leak in receive_encrypted_standard() +- !25607 nvmet-auth: validate reply message payload bounds against transfer length +- !25131 bpf: Reject fragmented frames in devmap +- !25064 bpf: use kvfree() for replaced sysctl write buffer +- !25074 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized +- !24412 [OLK-6.6] Fix CVE-2026-53189 +- !24427 [OLK-6.6] Fix CVE-2026-53225 +- !24471 [OLK-6.6] Fix CVE-2026-53154 +- !24540 [OLK-6.6] Fix CVE-2026-52929 +- rme: use DMA API for virtio in realm world +- !25429 Fix CVE-2026-64448 +- !25229 Fix CVE-2026-64425 +- !25416 v2 Fix CVE-2026-64378 +- !25179 Fix CVE-2026-64326 +- !25178 Fix CVE-2026-64294 +- !25584 tracing: Bound synthetic-field strings with seq_buf +- !25517 perf/core: Detach event groups during remove_on_exec +- bpf: Support for hardening against JIT spraying +- xsched: enforce permissions on attribute access +- xsched: restrict vstream management to privileged users +- udf: validate sparing table length as an entry count, not a byte count +- smb: client: harden POSIX SID length parsing +- smb: client: mask server-provided mode to 07777 in modefromsid +- smb: client: Fix next buffer leak in receive_encrypted_standard() +- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page +- nvmet-auth: validate reply message payload bounds against transfer length +- posix-cpu-timers: Prevent UAF caused by non-leader exec() race +- hwrng: virtio: clamp device-reported used.len at copy_data() +- iio: event: Fix event FIFO reset race +- tracing: Bound synthetic-field strings with seq_buf +- perf/core: Detach event groups during remove_on_exec +- i2c: stub: Reject I2C block transfers with invalid length +- e1000e: Fix out-of-bounds MMIO access by validating BAR0 size +- net: openvswitch: reject oversized nested action attrs +- smb: client: reject overlapping data areas in SMB2 responses +- smb: client: restrict implied bcc[0] exemption to responses without data area +- writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() +- writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() +- writeback: Fix use after free in inode_switch_wbs_work_fn() +- writeback: Avoid contention on wb->list_lock when switching inodes +- crypto: ecc - Fix carry overflow in vli multiplication +- crypto: pcrypt - restore callback for non-parallel fallback +- crypto: drbg - Fix returning success on failure in CTR_DRBG +- io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item +- block: skip sync_blockdev() on surprise removal in bdev_mark_dead() +- mm: do file ownership checks with the proper mount idmap +- bpf: Reject fragmented frames in devmap +- bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized +- bpf: use kvfree() for replaced sysctl write buffer +- i2c: core: fix adapter registration race +- sctp: stream: fully roll back denied add-stream state +- mm/hugetlb: restore reservation on error in hugetlb folio copy paths +- sctp: fix uninit-value in __sctp_rcv_asconf_lookup() +- mm/huge_memory: update file PMD counter before folio_put() + +* Fri Jul 31 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-164.0.0.149.20260731.c5db09427020 +- !25529 Fix CVE-2026-64352 +- !25524 NFSv4: include MAY_WRITE in open permission mask for O_TRUNC +- !25523 udf: validate VAT header length against the VAT inode size +- !25521 isofs: bound Rock Ridge symlink components to the SL record +- !25520 udf: validate free block extents against the partition length +- !25188 [OLK-6.6][linux-6.6.y sync] Backport 6.6.143-6.6.144 LTS Patches +- !25519 iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() +- !25511 ub: ub_fwctl: Support providing universal semantic interfaces. +- bpf: Allow LPM map access from sleepable BPF programs +- bpf: Consistently use bpf_rcu_lock_held() everywhere +- config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set +- crypto: qat - Return pointer directly in adf_ctl_alloc_resources +- crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() +- drivers/base/memory: set mem->altmap after successful device registration +- serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails +- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero +- NFS: Prevent resource leak in nfs_alloc_server() +- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr +- nfsd: check get_user() return when reading princhashlen +- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode +- fbdev: modedb: fix a possible UAF in fb_find_mode() +- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var +- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() +- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path +- KVM: x86: hyper-v: Bound the bank index when querying sparse banks +- 9p: avoid putting oldfid in p9_client_walk() error path +- ocfs2: reject oversized group bitmap descriptors +- rpmsg: char: Fix use-after-free on probe error path +- fpga: region: fix use-after-free in child_regions_with_firmware() +- irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove +- pNFS: Fix use-after-free in pnfs_update_layout() +- tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done +- hdlc_ppp: sync per-proto timers before freeing hdlc state +- gfs2: fix use-after-free in gfs2_qd_dealloc +- exfat: fix potential use-after-free in exfat_find_dir_entry() +- MIPS: DEC: Prevent initial console buffer from landing in XKPHYS +- bpf: use kvfree() for replaced sysctl write buffer +- f2fs: keep atomic write retry from zeroing original data +- f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() +- f2fs: validate ACL entry sizes in f2fs_acl_from_disk() +- f2fs: fix to round down start offset of fallocate for pin file +- f2fs: validate compress cache inode only when enabled +- wifi: iwlwifi: mvm: fix race condition in PTP removal +- wifi: rtw88: usb: fix memory leaks on USB write failures +- wifi: rtw88: increase TX report timeout to fix race condition +- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor +- wifi: ath11k: fix warning when unbinding +- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S +- keys: Pin request_key_auth payload in instantiate paths +- KEYS: fix overflow in keyctl_pkey_params_get_2() +- err.h: use __always_inline on all error pointer helpers +- fbdev: fix use-after-free in store_modes() +- NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR +- apparmor: mediate the implicit connect of TCP fast open sendmsg +- net: skmsg: preserve sg.copy across SG transforms +- mac802154: llsec: add skb_cow_data() before in-place crypto +- af_unix: Set gc_in_progress to true in unix_gc(). +- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC +- udf: validate VAT header length against the VAT inode size +- isofs: bound Rock Ridge symlink components to the SL record +- udf: validate free block extents against the partition length +- iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() +- ub: ub_fwctl: Support providing universal semantic interfaces. +- ntfs3: reject direct userspace writes to reserved $LX* xattrs +- ipv4: account for fraggap on the paged allocation path +- inet: add indirect call wrapper for getfrag() calls +- ipv6: account for fraggap on the paged allocation path +- batman-adv: tvlv: avoid race of cifsnotfound handler state +- batman-adv: tvlv: enforce 2-byte alignment +- batman-adv: dat: prevent false sharing between VLANs +- batman-adv: tt: track roam count per VID +- batman-adv: tt: don't merge change entries with different VIDs +- batman-adv: tp_meter: handle overlapping packets +- batman-adv: tp_meter: prevent parallel modifications of last_recv +- batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE +- batman-adv: tp_meter: restrict number of unacked list entries +- batman-adv: v: prevent OGM aggregation on disabled hardif +- batman-adv: frag: avoid underflow of TTL +- batman-adv: frag: ensure fragment is writable before modifying TTL +- batman-adv: fix (m|b)cast csum after decrementing TTL +- batman-adv: ensure bcast is writable before modifying TTL +- batman-adv: tp_meter: initialize last_recv_time during init +- batman-adv: prevent ELP transmission interval underflow +- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE +- batman-adv: tp_meter: add only finished tp_vars to lists +- batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection +- batman-adv: tp_meter: fix fast recovery precondition +- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd +- batman-adv: tp_meter: avoid window underflow +- batman-adv: tp_meter: initialize dec_cwnd explicitly +- batman-adv: tp_meter: initialize dup_acks explicitly +- batman-adv: tp_meter: keep unacked list in ascending ordered +- eventpoll: rename ep_remove_safe() back to ep_remove() +- file: add fput() cleanup helper +- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si +- ksmbd: reject non-VALID session in compound request branch +- scripts/sorttable: Fix endianness handling in build-time mcount sort +- scripts/sorttable: Allow matches to functions before function entry +- scripts/sorttable: Use normal sort if theres no relocs in the mcount section +- ftrace: Check against is_kernel_text() instead of kaslr_offset() +- ftrace: Test mcount_loc addr before calling ftrace_call_addr() +- ftrace: Do not over-allocate ftrace memory +- ftrace: Have ftrace pages output reflect freed pages +- ftrace: Update the mcount_loc check of skipped entries +- scripts/sorttable: Zero out weak functions in mcount_loc table +- scripts/sorttable: Always use an array for the mcount_loc sorting +- scripts/sorttable: Have mcount rela sort use direct values +- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 +- scripts/sorttable: Use a structure of function pointers for elf helpers +- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly +- scripts/sorttable: Move code from sorttable.h into sorttable.c +- scripts/sorttable: Use uint64_t for mcount sorting +- scripts/sorttable: Add helper functions for Elf_Sym +- scripts/sorttable: Add helper functions for Elf_Shdr +- scripts/sorttable: Add helper functions for Elf_Ehdr +- scripts/sorttable: Convert Elf_Sym MACRO over to a union +- scripts/sorttable: Replace Elf_Shdr Macro with a union +- scripts/sorttable: Convert Elf_Ehdr to union +- scripts/sorttable: Make compare_extable() into two functions +- scripts/sorttable: Have the ORC code use the _r() functions to read +- scripts/sorttable: Remove unneeded Elf_Rel +- scripts/sorttable: Remove unused write functions +- scripts/sorttable: Remove unused macro defines +- fuse: re-lock request before replacing page cache folio +- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD +- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration +- rxrpc: Fix the ACK parser to extract the SACK table for parsing +- net: phonet: free phonet_device after RCU grace period +- phonet: Pass net and ifindex to phonet_address_notify(). +- phonet: Pass ifindex to fill_addr(). +- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs +- hv: utils: handle and propagate errors in kvp_register +- regulator: core: fix locking in regulator_resolve_supply() error path +- ring-buffer: Remove ring_buffer_read_prepare_sync() +- selftests/bpf: Update comments find_equal_scalars->sync_linked_regs +- af_unix: Reject SIOCATMARK on non-stream sockets +- selftests/bpf: Add test to ensure kprobe_multi is not sleepable +- agp/amd64: Fix broken error propagation in agp_amd64_probe() +- net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() +- i2c: stub: Reject I2C block transfers with invalid length +- RDMA/bnxt_re: zero shared page before exposing to userspace +- KVM: VMX: Update SVI during runtime APICv activation +- ARM: fix branch predictor hardening +- ARM: fix hash_name() fault +- ARM: allow __do_kernel_fault() to report execution of memory faults +- ARM: group is_permission_fault() with is_translation_fault() +- debugobjects: Dont call fill_pool() in early boot hardirq context +- debugobjects: Do not fill_pool() if pi_blocked_on +- debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP +- debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING +- batman-adv: tt: prevent TVLV entry number overflow +- drm/v3d: Skip CSD when it has zeroed workgroups +- drm/v3d: Store the active job inside the queue's state + +* Thu Jul 30 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-164.0.0.149.20260730.f6ad2a54456d +- !25527 cgroup/rstat: avoid disabling irqs for O(num_cpu) +- !25489 urma: add check type in free driver obj +- cgroup/rstat: avoid disabling irqs for O(num_cpu) +- !25482 smb: client: fix double-free in SMB2_close() replay +- !25477 smb: client: fix double-free in SMB2_flush() replay +- !25481 smb: client: fix query_info() replay double-free +- !25480 smb: client: fix query directory replay double-free +- !25479 smb: client: fix double-free in SMB2_open() replay +- !25478 smb: client: fix double-free in SMB2_ioctl() replay +- !25476 smb: client: fix change notify replay double-free +- !25496 fbcon: fix NULL pointer dereference for a console without vc_data +- !25352 Fix CVE-2026-64362 +- !25351 Fix CVE-2026-64364 +- !25358 Fix CVE-2026-64299 +- !25354 Fix CVE-2026-64374 +- fbcon: fix NULL pointer dereference for a console without vc_data +- urma: add check type in free driver obj +- smb: client: fix double-free in SMB2_close() replay +- smb: client: fix query_info() replay double-free +- smb: client: fix query directory replay double-free +- smb: client: fix double-free in SMB2_open() replay +- smb: client: fix double-free in SMB2_ioctl() replay +- smb: client: fix double-free in SMB2_flush() replay +- smb: client: fix change notify replay double-free +- tracing: Prevent out-of-bounds read in glob matching +- sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT +- HID: lg-g15: cancel pending work on remove to fix a use-after-free +- HID: multitouch: fix out-of-bounds bit access on mt_io_flags + +* Wed Jul 29 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-164.0.0.149 +- !24950 config:x86: enable CONFIG_NETFILTER_XT_MATCH_NFACCT +- !25290 Fix CVE-2026-64247 +- !25252 Fix CVE-2026-64252 +- !25009 Fix CVE-2026-63944 +- !24828 drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 +- !24677 [OLK-6.6] Fix CVE-2026-53010 +- !24504 [OLK-6.6] Fix CVE-2026-52922 +- !25213 ftrace: Add global mutex to serialize trace_parser access +- !24510 [OLK-6.6] Fix CVE-2026-52916 +- KVM: x86: hyper-v: Bound the bank index when querying sparse banks +- MIPS: DEC: Prevent initial console buffer from landing in XKPHYS +- ftrace: Add global mutex to serialize trace_parser access +- config:x86: enable CONFIG_NETFILTER_XT_MATCH_NFACCT +- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync +- ksmbd: fix durable reconnect error path file lifetime +- ksmbd: fix use-after-free in smb2_open during durable reconnect +- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 +- batman-adv: fix batadv_skb_is_frag() kernel-doc +- batman-adv: frag: disallow unicast fragment in fragment +- batman-adv: dat: handle forward allocation error + +* Tue Jul 28 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-163.0.0.148.20260728.27a401f5bf5b +- !23473 [OLK-6.6] Fix CVE-2026-43199 +- !23421 [OLK-6.6] Fix CVE-2026-43459 +- !25077 RDMA/umem: Fix truncation for block sizes >= 4G +- !25036 xfs: fail recovery on a committed log item with no regions +- !25035 fuse: re-lock request before replacing page cache folio +- !25103 CVE: CVE-2026-64341 +- USB: iowarrior: fix use-after-free on disconnect race +- usb: iowarrior: remove inherent race with minor number +- USB: iowarrior: fix use-after-free on disconnect +- RDMA/umem: Fix truncation for block sizes >= 4G +- xfs: fail recovery on a committed log item with no regions +- fuse: re-lock request before replacing page cache folio +- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query +- ASoC: soc-core: flush delayed work before removing DAIs and widgets + +* Mon Jul 27 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-163.0.0.148.20260727.bc589d00e221 +- !24996 Fix CVE-2026-63827 +- !25104 mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() +- !25041 [OLK-6.6] smb/server: do not require delete access for non-replacing links +- !24970 acc: sync mainline patches and add doorbell enable support +- !25047 ub: ub_fwctl: Supports users to use query function in non root scenarios. +- !24916 [OLK-6.6] Fix CVE-2026-53232 +- !24892 [OLK-6.6] Fix CVE-2026-52937 +- !24912 [OLK-6.6] Fix CVE-2026-53078 +- !24907 [OLK-6.6] Fix CVE-2026-52942 +- !24885 [OLK-6.6] Fix CVE-2026-52927 +- mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() +- ub: ub_fwctl: Supports users to use query function in non root scenarios. +- smb/server: do not require delete access for non-replacing links +- apparmor: fix use-after-free in rawdata dedup loop +- crypto: hisilicon/qm - support doorbell enable control +- crypto: hisilicon - mask all error type when removing driver +- Revert "crypto: hisilicon - mask all error type when uninit" +- crypto: hisilicon/qm - support function-level error reset +- crypto: hisilicon/qm - place the interrupt status interface after the PM usage counter +- Revert "crypto: hisilicon/qm - place the interrupt status interface after the PM usage counter" +- Revert "crypto: hisilicon/qm - increment PM usage counter when handling the aeq interrupt" +- crypto: hisilicon/qm - allow VF devices to query hardware isolation status +- Revert "crypto: hisilicon/qm - support querying the hardware fault status through VFs" +- uacce: ensure safe queue release with state management +- Revert "uacce: add stop_queue to replace put_queue in ioctl" +- Revert "misc: uacce - fix a null pointer access issue when poweroff" +- uacce: implement mremap in uacce_vm_ops to return -EPERM +- Revert "uacce: add error number for the unsupported mremap" +- hisi_acc_vfio_pci: simplify the command for reading device information +- hisi_acc_vfio_pci: fix the queue parameter anomaly issue +- hisi_acc_vfio_pci: update function return values. +- Revert "hisi_acc_vfio_pci: update function return values" +- hisi_acc_vfio_pci: update status after RAS error +- hisi_acc_vfio_pci: fix VF reset timeout issue +- hisi_acc_vfio_pci: resolve duplicate migration states +- Revert "migration: resolve duplicate migration states" +- Revert "migration: update status after RAS error" +- Revert "migration: fix VF reset timeout issue" +- net: phy: clean the sfp upstream if phy probing fails +- bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops +- netfilter: nf_log: validate MAC header was set before dumping it +- tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR +- netfilter: ebtables: fix OOB read in compat_mtw_from_user + +* Sat Jul 25 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-163.0.0.148.20260725.db45fc6f09a0 +- !25007 Fix CVE-2026-63946 +- !25010 Fix CVE-2026-63945 +- !25004 Fix CVE-2026-64112 +- !24973 Fix CVE-2026-63802 +- !24199 [6.6][Intel-SIG] Support PMU uncore events for Intel DMR platform +- !24904 net: Fix CVE-2026-53264 +- !24903 bonding: Fix CVE-2026-43456 +- !25022 xfs: resample the data fork mapping after cycling ILOCK +- !25001 NFSD: Fix SECINFO_NO_NAME decode error cleanup +- !25000 nfsd: fix posix_acl leak on SETACL decode failure +- !24999 virtiofs: fix UAF on submount umount +- xfs: resample the data fork mapping after cycling ILOCK +- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock +- Bluetooth: ISO: fix UAF in iso_recv_frame +- rbd: eliminate a race in lock_dwork draining on unmap +- NFSD: Fix SECINFO_NO_NAME decode error cleanup +- nfsd: fix posix_acl leak on SETACL decode failure +- virtiofs: fix UAF on submount umount +- perf/x86/intel/uncore: Remove extra double quote mark +- perf/x86/intel/uncore: Fix iounmap() leak on global_init failure +- perf pmu: Relax uncore wildcard matching to allow numeric suffix +- perf pmu: Don't de-duplicate core PMUs +- perf pmus: Sort/merge/aggregate PMUs like mrvl_ddr_pmu +- perf list: Give more details about raw event encodings +- perf/x86/intel/uncore: Update DMR uncore constraints preliminarily +- perf/x86/intel/uncore: Support uncore constraint ranges +- perf/x86/intel/uncore: Support IIO free-running counters on DMR +- perf/x86/intel/uncore: Add freerunning event descriptor helper macro +- perf/x86/intel/uncore: Add domain global init callback +- perf/x86/intel/uncore: Add CBB PMON support for Diamond Rapids +- perf/x86/intel/uncore: Add IMH PMON support for Diamond Rapids +- perf/x86/intel/uncore: Remove has_generic_discovery_table() +- perf/x86/intel/uncore: Support per-platform discovery base devices +- perf/x86/intel/uncore: Move uncore discovery init struct to header +- perf/x86/intel/uncore: Add Panther Lake support +- perf/x86/intel/uncore: Add Lunar Lake support +- perf/x86/intel/uncore: Factor out common MMIO init and ops functions +- perf/x86/intel/uncore: Switch to new Intel CPU model defines +- blk-cgroup: fix UAF in __blkcg_rstat_flush() +- net: Fix kabi breakage of struct tc_action +- net/sched: act_api: use RCU with deferred freeing for action lifecycle +- net: Fix kabi breakage of struct header_ops +- bonding: prevent potential infinite loop in bond_header_parse() +- bonding: fix type confusion in bond_setup_by_slave() + +* Fri Jul 24 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-163.0.0.148.20260724.9c9b201cb216 +- !25003 urma: fill vtpn param in import jetty +- !24927 urma: add check when RC jetty bind not RC tp_handle +- !24976 ub:ubus: Modify UBUS review comments +- !24984 [OLK-6.6][linux-6.6.y sync] Backport 6.6.142-6.6.143 LTS Patches +- !17555 [OLK-6.6] Revert "f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()" +- !20845 [OLK-6.6] io_uring: fix testcase io-wq-unused-exit.t failure in liburing-2.14 +- !24251 mm/slab: Fix a kmemleak in kmem_cache_destroy() +- urma: fill vtpn param in import jetty +- urma: add check when RC jetty bind not RC tp_handle +- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc +- ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL +- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() +- time: Fix off-by-one in compat settimeofday() usec validation +- scsi: target: Fix hexadecimal CHAP_I handling +- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink +- ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY +- ksmbd: add a permission check for FSCTL_SET_ZERO_DATA +- ksmbd: add per-handle permission check to FILE_LINK_INFORMATION +- mptcp: fix missing wakeups in edge scenarios +- mptcp: add-addr: always drop other suboptions +- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 +- RDMA/umem: fix kernel-doc warnings +- mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio +- usb: typec: ucsi: Don't update power_supply on power role change if not connected +- serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ +- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() +- thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() +- usb: typec: ucsi: Check if power role change actually happened before handling +- usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind +- usb: dwc3: xilinx: fix error handling in zynqmp init error paths +- usb: musb: omap2430: Fix use-after-free in omap2430_probe() +- tty: serial: samsung: Remove redundant port lock acquisition in rx helpers +- tty: serial: samsung: use u32 for register interactions +- serial: samsung_tty: Use port lock wrappers +- ALSA: firewire-motu: Protect register DSP event queue positions +- memfd: deny writeable mappings when implying SEAL_WRITE +- iio: dac: ad5686: fix ref bit initialization for single-channel parts +- usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure +- iio: chemical: scd30: fix division by zero in write_raw +- iio: chemical: scd30: Use guard(mutex) to allow early returns +- iio: gyro: adis16260: fix division by zero in write_raw +- Bluetooth: hci_qca: Convert timeout from jiffies to ms +- Bluetooth: hci_qca: Migrate to serdev specific shutdown function +- serdev: Provide a bustype shutdown function +- serdev: make serdev_bus_type const +- mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() +- mptcp: do not drop partial packets +- mptcp: introduce the mptcp_init_skb helper +- iio: adc: npcm: fix unbalanced clk_disable_unprepare() +- iio: adc: npcm: Convert to platform remove callback returning void +- octeontx2-pf: avoid double free of pool->stack on AQ init failure +- af_unix: Fix UAF read of tail->len in unix_stream_data_wait() +- af_unix: Cache state->msg in unix_stream_read_generic(). +- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg +- net: hsr: defer node table free until after RCU readers +- mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient +- ice: fix VF queue configuration with low MTU values +- mptcp: reset rcv wnd on disconnect +- mptcp: cleanup fallback dummy mapping generation +- octeontx2-af: CGX: add bounds check to cgx_speed_mbps index +- octeontx2-af: replace deprecated strncpy with strscpy +- cgroup/cpuset: Reset DL migration state on can_attach() failure +- fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros +- soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() +- driver core: reject devices with unregistered buses +- drm/amd/display: Use krealloc_array() in dal_vector_reserve() +- drm/amdgpu: restart the CS if some parts of the VM are still invalidated +- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 +- drm/amdkfd: fix NULL dereference in get_queue_ids() +- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock +- slimbus: qcom-ngd-ctrl: fix OF node refcount +- thunderbolt: Limit XDomain response copy to actual frame size +- sctp: stream: fully roll back denied add-stream state +- mmc: sdhci: add signal voltage switch in sdhci_resume_host +- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC +- mmc: litex_mmc: Set mandatory idle clocks before CMD0 +- mmc: core: Fix host controller programming for fixed driver type +- mm/hugetlb: restore reservation on error in hugetlb folio copy paths +- octeontx2-af: fix memory leak in rvu_setup_hw_resources() +- nvmem: layouts: onie-tlv: fix hang on unknown types +- net: rds: clear i_sends on setup unwind +- net: mv643xx: fix OF node refcount +- net/mlx5: Reorder completion before putting command entry in cmd_work_handler +- misc: fastrpc: fix use-after-free race in fastrpc_map_create +- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context +- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard +- i2c: tegra: Fix NOIRQ suspend/resume +- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter +- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() +- pidfd: refuse access to tasks that have started exiting harder +- ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write +- vsock/vmci: fix sk_ack_backlog leak on failed handshake +- wifi: nl80211: reject oversized EMA RNR lists +- selftests: mptcp: add test for extra_subflows underflow on userspace PM +- mptcp: sockopt: check timestamping ret value +- mptcp: allow subflow rcv wnd to shrink +- mptcp: close TOCTOU race while computing rcv_wnd +- mptcp: fix retransmission loop when csum is enabled +- ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow +- ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O +- ARM: socfpga: Fix OF node refcount leak in SMP setup +- mm/damon/ops-common: call folio_test_lru() after folio_get() +- drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() +- ALSA: timer: Fix UAF at snd_timer_user_params() +- USB: serial: option: add usb-id for Dell Wireless DW5826e-m +- xfrm: espintcp: do not reuse an in-progress partial send +- ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL +- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation +- tracing/probes: Point the error offset correctly for eprobe argument error +- netfilter: nft_tunnel: fix use-after-free on object destroy +- clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time +- net: mvpp2: build skb from XDP-adjusted data on XDP_PASS +- net: mvpp2: refill RX buffers before XDP or skb use +- net: mvpp2: Add metadata support for xdp mode +- netfilter: nf_log: validate MAC header was set before dumping it +- rds: mark snapshot pages dirty in rds_info_getsockopt() +- net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion +- r8152: handle the return value of usb_reset_device() +- net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove +- net: phy: clean the sfp upstream if phy probing fails +- net/mlx4: avoid GCC 10 __bad_copy_from() false positive +- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls +- arm64: tlb: Allow XZR argument to TLBI ops +- KVM: arm64: Remove VPIPT I-cache handling +- tools/rv: Fix cleanup after failed trace setup +- time: Fix off-by-one in settimeofday() usec validation +- ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp +- ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() +- vxlan: vnifilter: fix spurious notification on VNI update +- vxlan: vnifilter: send notification on VNI add +- octeontx2-af: npc: Fix CPT channel mask in npc_install_flow +- net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown +- ptp: vclock: Switch from RCU to SRCU +- net: fec: fix pinctrl default state restore order on resume +- net: lan743x: permit VLAN-tagged packets up to configured MTU +- net: garp: fix unsigned integer underflow in garp_pdu_parse_attr +- hsr: Remove WARN_ONCE() in hsr_addr_is_self(). +- net: Annotate sk->sk_write_space() for UDP SOCKMAP. +- pcnet32: stop holding device spin lock during napi_complete_done +- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c +- 6lowpan: fix off-by-one in multicast context address compression +- ub:ubus: Modify UBUS review comments +- !20757 [OLK-6.6] Merge dinghai eth&rdma code to OLK-6.6 +- !24873 ub: udma: Adaptation Flush Done flag +- ub: udma: Adaptation Flush Done flag +- netfilter: xt_NFQUEUE: prefer raw_smp_processor_id +- tee: optee: prevent use-after-free when the client exits before the supplicant +- net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS +- Disable -Wattribute-alias for clang-23 and newer +- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug +- USB: serial: mct_u232: fix memory corruption with small endpoint +- usb: core: Fix SuperSpeed root hub wMaxPacketSize +- serial: zs: Convert to use a platform device +- serial: dz: Convert to use a platform device +- serial: dz: Fix bootconsole handover lockup +- xhci: tegra: Fix ghost USB device on dual-role port unplug +- USB: serial: digi_acceleport: fix memory corruption with small endpoints +- landlock: Fix handling of disconnected directories +- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync +- USB: serial: cypress_m8: fix memory corruption with small endpoint +- serial: zs: Switch to using channel reset +- serial: zs: Fix bootconsole handover lockup +- serial: dz: Fix bootconsole message clobbering at chip reset +- drm/amdkfd: Check for pdd drm file first in CRIU restore path +- drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger +- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr +- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma +- serial: zs: Fix swapped RI/DSR modem line transition counting +- serial: sh-sci: fix memory region release in error path +- serial: qcom-geni: fix UART_RX_PAR_EN bit position +- serial: altera_jtaguart: handle uart_add_one_port() failures +- drm/amd/pm/si: Disregard vblank time when no displays are connected +- drm/i915: Fix potential UAF in TTM object purge +- drm/hyperv: validate VMBus packet size in receive callback +- drm/hyperv: validate resolution_count and fix WIN8 fallback +- scsi: target: iscsi: Validate CHAP_R length before base64 decode +- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf +- scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 +- scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker +- thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow +- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() +- usb: gadget: f_fs: copy only received bytes on short ep0 read +- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports +- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling +- usb: gadget: f_hid: fix device reference leak in hidg_alloc() +- usb: gadget: net2280: Fix double free in probe error path +- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check +- USB: serial: mxuport: fix memory corruption with small endpoint +- USB: serial: keyspan: fix missing indat transfer sanity check +- USB: serial: cypress_m8: validate interrupt packet headers +- USB: serial: belkin_sa: validate interrupt status length +- USB: serial: option: add MeiG SRM813Q +- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize +- usb: usbtmc: check URB actual_length for interrupt-IN notifications +- usbip: vudc: Fix use after free bug in vudc_remove due to race condition +- usb: storage: Add quirks for PNY Elite Portable SSD +- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers +- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval +- usb: chipidea: core: convert ci_role_switch to local variable +- tty: serial: pch_uart: add check for dma_alloc_coherent() +- counter: Fix refcount leak in counter_alloc() error path +- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() +- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() +- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 +- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem +- Input: xpad - add support for ASUS ROG RAIKIRI II +- Input: xpad - add "Nova 2 Lite" from GameSir +- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks +- ASoC: qcom: q6asm-dai: close stream only when running +- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check +- xfrm: ah: use skb_to_full_sk in async output callbacks +- xfrm: route MIGRATE notifications to caller's netns +- nfc: hci: fix out-of-bounds read in HCP header parsing +- iommu, debugobjects: avoid gcc-16.1 section mismatch warnings +- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() +- ip6: vti: Use ip6_tnl.net in vti6_changelink(). +- xfrm: input: hold netns during deferred transport reinjection +- ipv6: validate extension header length before copying to cmsg +- ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). +- ipv6: exthdrs: refresh nh after handling HAO option +- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params +- ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() +- macsec: fix replay protection at XPN lower-PN wrap +- bpf: sockmap: fix tail fragment offset in bpf_msg_push_data +- Input: elan_i2c - validate firmware size before use +- usb: dwc2: Fix use after free in debug code +- usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles +- usb: cdns3: gadget: fix request skipping after clearing halt +- USB: serial: omninet: fix memory corruption with small endpoint +- iio: buffer: hw-consumer: fix use-after-free in error path +- iio: light: cm3323: fix reg_conf not being initialized correctly +- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL +- iio: temperature: tsys01: fix broken PROM checksum validation +- iio: ssp_sensors: cancel delayed work_refresh on remove +- iio: gyro: itg3200: fix i2c read into the wrong stack location +- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw +- iio: dac: ad5686: acquire lock when doing powerdown control +- iio: dac: ad5686: fix input raw value check +- iio: dac: max5821: fix return value check in powerdown sync +- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux +- wireguard: send: append trailer after expanding head +- KVM: arm64: PMU: Preserve AArch32 counter low bits +- parport: Fix race between port and client registration +- Input: xpad - fix out-of-bounds access for Share button +- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock +- Bluetooth: ISO: fix UAF in iso_recv_frame +- Bluetooth: HIDP: fix missing length checks in hidp_input_report() +- auxdisplay: line-display: fix OOB read on zero-length message_store() +- hpfs: fix a crash if hpfs_map_dnode_bitmap fails +- Bluetooth: btusb: Allow firmware re-download when version matches +- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse +- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() +- USB: serial: safe_serial: fix memory corruption with small endpoint +- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT +- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() +- usb: typec: altmodes/displayport: validate count before reading Status Update VDO +- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO +- usb: typec: ucsi: ccg: reject firmware images without a ':' record header +- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer +- soc/tegra: pmc: Fix unsafe generic_handle_irq() call +- hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock +- hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock +- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() +- phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X +- drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used +- drm/dp: Add eDP 1.5 bit definition +- drm/i915/psr: Read Intel DPCD workaround register +- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register +- media: rc: fix race between unregister and urb/irq callbacks +- batman-adv: bla: avoid double decrement of bla.num_requests +- batman-adv: tt: avoid empty VLAN responses +- batman-adv: tt: fix TOCTOU race for reported vlans +- batman-adv: tp_meter: directly shut down timer on cleanup +- batman-adv: tp_meter: avoid role confusion in tp_list +- batman-adv: iv: recover OGM scheduling after forward packet error +- batman-adv: tvlv: reject oversized TVLV packets +- batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface +- batman-adv: tt: reject oversized local TVLV buffers +- batman-adv: tvlv: abort OGM send on tvlv append failure +- net: skbuff: fix pskb_carve leaking zcopy pages +- ipv6: fix possible infinite loop in fib6_select_path() +- ipv6: fix possible infinite loop in rt6_fill_node() +- sctp: fix race between sctp_wait_for_connect and peeloff +- net: mana: Add NULL guards in teardown path to prevent panic on attach failure +- gpio: rockchip: convert bank->clk to devm_clk_get_enabled() +- Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success +- ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() +- ethtool: eeprom: add more safeties to EEPROM Netlink fallback +- ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback +- bonding: refuse to enslave CAN devices +- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() +- ASoC: codecs: simple-mux: Fix enum control bounds check +- ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE +- tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() +- vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() +- tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() +- gpio: mxc: fix irq_high handling +- net: hsr: fix potential OOB access in supervision frame handling +- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors +- ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() +- scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues +- net/iucv: fix locking in .getsockopt +- net/smc: Do not re-initialize smc hashtables +- net: netlink: don't set nsid on local notifications +- net: netlink: fix sending unassigned nsid after assigned one +- vsock: keep poll shutdown state consistent +- netfilter: nf_tables: fix dst corruption in same register operation +- netfilter: bitwise: add support for doing AND, OR and XOR directly +- netfilter: bitwise: rename some boolean operation functions +- netfilter: ebtables: fix OOB read in compat_mtw_from_user +- netfilter: xt_cpu: prefer raw_smp_processor_id +- netfilter: synproxy: refresh tcphdr after skb_ensure_writable +- xfrm: Check for underflow in xfrm_state_mtu +- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() +- nfc: llcp: Fix use-after-free in llcp_sock_release() +- net: cpsw_new: Fix potential unregister of netdev that has not been registered yet +- drm: Remove plane hsub/vsub alignment requirement for core helpers +- net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked +- net: mctp: ensure our nlmsg responses are initialised +- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size +- net: Merge dinghai Ethernet and RDMA driver code to OLK-6.6 +- mm/slab: Fix a kmemleak in kmem_cache_destroy() +- io_uring: allow io-wq workers to exit when unused +- io_uring/io-wq: add exit-on-idle state +- Revert "f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()" + +* Thu Jul 23 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-163.0.0.148.20260723.6331a3c04fb7 +- !24981 ub: ub_fwctl: Modify the log printing in the code. +- !24962 Fix CVE-2026-64136 +- !24980 CVE-2026-64073 +- !24968 KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits +- !24966 USB: serial: mct_u232: fix missing interrupt-in transfer sanity check +- !24958 USB: serial: omninet: fix memory corruption with small endpoint +- !24955 USB: serial: cypress_m8: validate interrupt packet headers +- ub: ub_fwctl: Modify the log printing in the code. +- MIPS: smp: report dying CPU to RCU in stop_this_cpu() +- LoongArch: Report dying CPU to RCU in stop_this_cpu() +- irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT +- !24940 [OLK-6.6][linux-6.6.y sync] Backport 6.6.141-6.6.142 LTS Patches +- !24939 test_kprobes: clear kprobes between test runs +- KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits +- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check +- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() +- USB: serial: omninet: fix memory corruption with small endpoint +- USB: serial: cypress_m8: validate interrupt packet headers +- !24929 gcov: use atomic counter updates to fix concurrent access crashes +- !24917 ixgbevf: fix use-after-free in VEPA multicast source pruning +- tls: Flush backlog before waiting for a new record +- net: ethernet: cortina: No mapping is a dropped rx +- batman-adv: fix batadv_skb_is_frag() kernel-doc +- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled +- Bluetooth: ISO: fix malformed ISO_END/CONT handling +- Bluetooth: MGMT: Fix backward compatibility with userspace +- security/keys: fix missed RCU read section on lookup +- LoongArch: kprobes: Fix handling of fatal unrecoverable recursions +- pds_core: ensure null-termination for firmware version strings +- pds_core: add an error code check in pdsc_dl_info_get +- net: mana: validate rx_req_idx to prevent out-of-bounds array access +- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() +- gpio: cdev: check if uAPI v2 config attributes are correctly zeroed +- gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) +- string: add mem_is_zero() helper to check if memory area is all zeros +- bpf, skmsg: fix verdict sk_data_ready racing with ktls rx +- net: ag71xx: check error for platform_get_irq +- Bluetooth: btmtk: rename btmediatek_data +- Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset +- Bluetooth: btmtk: add the function to get the fw name +- ALSA: seq: Serialize UMP output teardown with event_input +- ALSA: seq: ump: Use guard() for locking +- pds_core: fix debugfs_lookup dentry leak and error handling +- pds_core: fix error handling in pdsc_devcmd_wait +- bridge: mcast: Fix a possible use-after-free when removing a bridge port +- net: bridge: Flush multicast groups when snooping is disabled +- RDMA/rtrs: Fix use-after-free in path file creation cleanup +- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL +- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL +- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL +- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL +- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer +- net: dsa: mt7530: preserve VLAN tags on trapped link-local frames +- net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw +- net: dsa: mt7530: fix FDB entries not aging out with short timeout +- wifi: ath11k: fix peer resolution on rx path when peer_id=0 +- drm/msm/snapshot: fix dumping of the unaligned regions +- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() +- net/mlx5: Do not restore destination-less TC rules +- tls: Preserve sk_err across recvmsg() when data has been copied +- x86/xen: Fix xen_e820_swap_entry_with_ram() +- net: phy: DP83TC811: add reading of abilities +- net: phy: c45: add genphy_c45_pma_read_ext_abilities() function +- net: tls: prevent chain-after-chain in plain text SG +- net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring +- net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot +- powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() +- drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN +- drm/msm/dsi: don't dump registers past the mapped region +- ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics +- net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint +- accel/qaic: Add overflow check to remap_pfn_range during mmap +- HID: quirks: really enable the intended work around for appledisplay +- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() +- wifi: ath11k: fix error path leaks in some WMI WOW calls +- net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference +- net: ethernet: cortina: Carry over frag counter +- net: ethernet: cortina: Drop half-assembled SKB +- net: ethernet: cortina: Make RX SKB per-port +- netfs: Fix overrun check in netfs_extract_user_iter() +- zonefs: handle integer overflow in zonefs_fname_to_fno +- !24930 mainline patch +- irqchip/ath79-cpu: Remove unused function +- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access +- net: lan966x: avoid unregistering netdev on register failure +- ice: fix locking in ice_dcb_rebuild() +- tcp: Fix imbalanced icsk_accept_queue count. +- test_kprobes: clear kprobes between test runs +- kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() +- netfilter: x_tables: unregister the templates first +- ALSA: hda: cs35l56: Put ACPI device after setting companion +- ARM: integrator: Fix early initialization +- pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 +- kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS +- kunit: config: Enable KUNIT_DEBUGFS by default +- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure +- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration +- HID: uclogic: Fix regression of input name assignment +- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors +- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() +- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() +- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple +- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR +- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer +- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer +- hwmon: (pmbus/adm1266) reject implausible blackbox record_count +- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock +- batman-adv: tt: fix negative tt_buff_len +- batman-adv: tt: fix negative last_changeset_len +- batman-adv: tp_meter: fix race condition in send error reporting +- batman-adv: tp_meter: avoid use of uninit sender vars +- batman-adv: bla: fix report_work leak on backbone_gw purge +- batman-adv: frag: disallow unicast fragment in fragment +- batman-adv: fix fragment reassembly length accounting +- batman-adv: dat: handle forward allocation error +- batman-adv: clear current gateway during teardown +- batman-adv: mcast: fix use-after-free in orig_node RCU release +- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async +- drm/amd/display: Validate GPIO pin LUT table size before iterating +- drm/amd/display: Fix integer overflow in bios_get_image() +- drm/bridge: megachips: remove bridge when irq request fails +- drm/bridge: it66121: acquire reset GPIO in probe +- drm/virtio: use uninterruptible resv lock for plane updates +- device property: set fwnode->secondary to NULL in fwnode_init() +- LoongArch: Remove unused code to avoid build warning +- RDMA/siw: Reject MPA FPDU length underflow before signed receive math +- spi: ti-qspi: fix use-after-free after DMA setup failure +- spi: sprd: fix error pointer deref after DMA setup failure +- scsi: isci: Fix use-after-free in device removal path +- phy: tegra: xusb: Fix per-pad high-speed termination calibration +- spi: qup: fix error pointer deref after DMA setup failure +- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe +- KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits +- arm64: probes: Handle probes on hinted conditional branch instructions +- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() +- ice: fix setting promisc mode while adding VID filter +- ixgbevf: fix use-after-free in VEPA multicast source pruning +- ipv4: raw: reject IP_HDRINCL packets with ihl < 5 +- wifi: ath11k: clear shared SRNG pointer state on restart +- vsock/vmci: fix UAF when peer resets connection during handshake +- ring-buffer: Fix reporting of missed events in iterator +- qed: fix double free in qed_cxt_tables_alloc() +- netfilter: ipset: stop hash:* range iteration at end +- netfilter: nf_queue: hold bridge skb->dev while queued +- netfilter: ip6t_hbh: reject oversized option lists +- net: ifb: report ethtool stats over num_tx_queues +- net: bcmgenet: keep RBUF EEE/PM disabled +- phonet/pep: disable BH around forwarded sk_receive_skb() +- Bluetooth: MGMT: validate Add Extended Advertising Data length +- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths +- Bluetooth: bnep: Fix UAF read of dev->name +- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START +- net: wwan: iosm: fix potential memory leaks in ipc_imem_init() +- drivers/base/memory: fix memory block reference leak in poison accounting +- efi: Allocate runtime workqueue before ACPI init +- ALSA: asihpi: Fix potential OOB array access at reading cache +- ALSA: pcm: Don't setup bogus iov_iter for silencing +- ALSA: ua101: Reject too-short USB descriptors +- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX +- smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close +- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() +- ksmbd: fix null pointer dereference in compare_guid_key() +- mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() +- sysfs: don't remove existing directory on update failure +- Revert "af_unix: Reject SIOCATMARK on non-stream sockets" +- Revert "s390/cio: Update purge function to unregister the unused subchannels" +- Revert "ice: Remove jumbo_remove step from TX path" +- Revert "ice: fix double-free of tx_buf skb" +- Revert "x86/vdso: Fix output operand size of RDPID" +- wifi: mac80211: check tdls flag in ieee80211_tdls_oper +- s390/debug: Reject zero-length input before trimming a newline +- mptcp: pm: ADD_ADDR rtx: free sk if last +- mptcp: sync the msk->sndbuf at accept() time +- test_kprobes: clear kprobes between test runs +- powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del +- perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery +- gcov: use atomic counter updates to fix concurrent access crashes +- ixgbevf: fix use-after-free in VEPA multicast source pruning + +* Tue Jul 21 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-163.0.0.148.20260721.b31f9a6ebd8d +- !24938 urma: drop param_set_uint_minmax for ratelimit burst setters +- urma: drop param_set_uint_minmax for ratelimit burst setters +- !24932 Fix CVE-2026-63974 +- !24906 [OLK-6.6] Fix CVE-2026-53220 +- !24931 Fix CVE-2026-63975 +- !24901 [OLK-6.6] Fix CVE-2026-53337 +- !24902 [OLK-6.6] Fix CVE-2026-53349 +- !24413 [OLK-6.6] Fix CVE-2026-53239 +- !24898 [OLK-6.6] Fix CVE-2026-53184 +- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close +- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp +- !24856 hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated +- hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated +- netfilter: revalidate bridge ports +- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister +- net: bonding: fix NULL pointer dereference in bond_do_ioctl() +- udp: clear skb->dev before running a sockmap verdict +- xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() + +* Mon Jul 20 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-163.0.0.148.20260720.0975f6fca167 +- !24887 uvb: modify memremap in cis +- !24884 iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA +- !24782 [OLK-6.6][linux-6.6.y sync] Backport 6.6.139-6.6.140 LTS conflict Patches +- !24589 af_unix: Drop all SCM attributes for SOCKMAP. +- !24878 bpf: Free reuseport cBPF prog after RCU grace period. +- !24815 mm: mem_reliable: bugfixes +- uvb: modify memremap in cis +- iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA +- bpf: Free reuseport cBPF prog after RCU grace period. +- !24855 urma: fix uobj_put race in uobj remove commit +- !24415 [OLK-6.6] Fix CVE-2026-53228 +- !24429 [OLK-6.6] Fix CVE-2026-53223 +- !24431 [OLK-6.6] Fix CVE-2026-53221 +- !24433 [OLK-6.6] Fix CVE-2026-53219 +- !24434 [OLK-6.6] Fix CVE-2026-53218 +- !24458 [OLK-6.6] Fix CVE-2026-53175 +- !24395 [OLK-6.6] Fix CVE-2026-53131 +- !24468 [OLK-6.6] Fix CVE-2026-53134 +- urma: fix uobj_put race in uobj remove commit +- !24829 urma: fix ubcore_import_jetty_ex not dec vtpn use cnt +- crypto: nx - Fix packed layout in struct nx842_crypto_header +- crypto: nx - Use static_assert() to check struct sizes +- batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown +- Revert "ALSA: pcmtest: fix reference leak on failed device registration" +- media: rc: ttusbir: fix inverted error logic +- media: rc: igorplugusb: fix control request setup packet +- batman-adv: tp_meter: fix tp_num leak on kmalloc failure +- batman-adv: stop tp_meter sessions during mesh teardown +- ALSA: seq: Fix UMP group 16 filtering +- ALSA: seq: Notify client and port info changes +- ALSA: core: Serialize deferred fasync state checks +- ALSA: misc: Use guard() for spin locks +- ALSA: hda: cs35l56: Propagate ASP TX source control errors +- crypto: nx - Avoid -Wflex-array-member-not-at-end warning +- ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() +- media: rc: igorplugusb: heed coherency rules +- ALSA: aoa: Skip devices with no codecs in i2sbus_resume() +- media: rc: ttusbir: respect DMA coherency rules +- ALSA: aoa: i2sbus: clear stale prepared state +- ALSA: aoa: Use guard() for mutex locks +- f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally +- ksmbd: replace connection list with hash table +- ksmbd: use msleep instaed of schedule_timeout_interruptible() +- f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() +- smb: move some duplicate definitions to common/smbacl.h +- iommu/amd: serialize sequence allocation under concurrent TLB invalidations +- x86/shstk: Prevent deadlock during shstk sigreturn +- ALSA: pcmtest: Fix resource leaks in module init error paths +- ALSA: pcmtest: fix reference leak on failed device registration +- ALSA: 6fire: Fix input volume change detection +- ALSA: caiaq: Fix control_put() result and cache rollback +- ALSA: core: Fix potential data race at fasync handling +- Revert "ALSA: usb-audio: Cap the packet size pre-calculations" +- urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid +- !24836 Documentation/ub/ummu: Describe that iommu.passthrough is not supported +- !24820 ub/ubdevshm: Support for acquiring va is a sub-range of registered va +- Documentation/ub/ummu: Describe that iommu.passthrough is not supported +- !23831 [Intel-SIG] Support PMU core events for Intel DMR platform +- !24824 fix CVE-2026-53132 +- !24806 [OLK-6.6] Fix the build error and warning when CONFIG_QOS_SCHED is not set +- !24209 [OLK-6.6] Support mm/mempolicy weighted interleave auto-tuning +- !23886 [OLK-6.6] Fix CVE-2026-46158 +- !24437 [OLK-6.6] Fix CVE-2026-53271 +- !23541 [OLK-6.6] Fix CVE-2026-43115 +- !24185 [OLK-6.6] Fix CVE-2026-43500 +- !23538 [OLK-6.6] Fix CVE-2026-43172 +- !23954 [OLK-6.6] Fix CVE-2026-43109 +- !24435 [OLK-6.6] Fix CVE-2026-53217 +- !24445 [OLK-6.6] Fix CVE-2026-53216 +- !24511 [OLK-6.6] Fix CVE-2026-52919 +- !24506 [OLK-6.6] Fix CVE-2026-52913 +- !23834 [OLK-6.6] Fix CVE-2026-46157 +- !23795 [OLK-6.6] Fix CVE-2026-46200 +- ub/ubdevshm: Support for acquiring va is a sub-range of registered va +- vsock/virtio: reset connection on receiving queue overflow +- vsock/virtio: fix skb overhead accounting to preserve full buf_alloc +- vsock/virtio: fix potential unbounded skb queue +- !24801 urma: use xarray for ubagg/ubcore session lookup +- !24562 KVM: arm64: vgic: refactor vgic_v3_dispatch_sgi non-broadcast path +- urma: use xarray for ubagg/ubcore session lookup +- KVM: arm64: vgic-v3: Optimize affinity-based SGI injection +- mm: mem_reliable: treat folio from dpool as unreliable +- mm: reliable: remove the per-mm reliable page counter +- mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD +- mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations +- !24797 zram: fix use-after-free in zram_bvec_write_partial() +- !24779 [OLK-6.6] crypto: ccp: Add new PSP device id for Hygon C86-4G +- !24660 [OLK-6.6] arm64/acpi/gpio/i2c/spi： Add ACPI ID for LECARC SoCs. +- !24799 iommu/ummu: Fix build issues for DKMS support +- !24807 urma: make ratelimit burst configurable for ubcore/uburma/ubagg +- !24813 thunderbolt: Validate XDomain request packet size before type cast +- !24812 sctp: fix uninit-value in __sctp_rcv_asconf_lookup() +- !24811 hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf +- !24810 sctp: diag: reject stale associations in dump_one path +- iommu/ummu: Fix build issues for DKMS support +- urma: make ratelimit burst configurable for ubcore/uburma/ubagg +- thunderbolt: Validate XDomain request packet size before type cast +- sctp: fix uninit-value in __sctp_rcv_asconf_lookup() +- hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf +- sctp: diag: reject stale associations in dump_one path +- sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set +- sched/fair: Fix build error when CONFIG_QOS_SCHED is not set +- zram: fix use-after-free in zram_bvec_write_partial() +- crypto: ccp: Add new PSP device id for Hygon C86-4G +- perf: Fix kabi in perf_mem_data_src +- perf/x86/intel: Update event constraints for DMR +- perf/x86/intel: Update event constraints and cache_extra_regsfor SPR +- perf/x86/intel: Update event constraints and cache_extra_regsfor ICX +- perf/x86/intel: Extend the ref-cycles event to GP counters +- perf/x86/intel: Consolidate MSR_IA32_PERF_CFG_C tracking +- tools arch x86: Sync msr-index.h to pick MSR_{OMR_[0-3],CORE_PERF_GLOBAL_STATUS_SET} +- mptcp: pm: ADD_ADDR rtx: always decrease sk refcount +- mptcp: pm: ADD_ADDR rtx: allow ID 0 +- I2C: designware: Add ACPI ID LECA0003 for LECARC SoCs. +- SPI: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs +- GPIO: dwapb: Add ACPI ID LECA0001 for LECARC SoCs +- af_unix: Drop all SCM attributes for SOCKMAP. +- netfilter: require Ethernet MAC header before using eth_hdr() +- netfilter: x_tables: avoid leaking percpu counter pointers +- ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() +- net: guard timestamp cmsgs to real error queue skbs +- ipv6: sit: reload inner IPv6 header after GSO offloads +- netfilter: nft_fib: fix stale stack leak via the OIFNAME register +- inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush +- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag +- batman-adv: fix tp_meter counter underflow during shutdown +- batman-adv: v: stop OGMv2 on disabled interface +- net: mvpp2: limit XDP frame size to the RX buffer +- ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers +- net: mvpp2: sync RX data at the hardware packet offset +- mm/mempolicy: fix weighted interleave auto sysfs name +- mm/mempolicy: fix memory leaks in weighted_interleave_auto_store() +- mm/mempolicy: skip unnecessary synchronize_rcu() +- mm/mempolicy: fix incorrect freeing of wi_kobj +- mm/mempolicy: Weighted Interleave Auto-tuning +- mm/mempolicy: support memory hotplug in weighted interleave +- perf/x86/intel: Enable auto counter reload for DMR +- perf/x86/intel: Disable PMI for self-reloaded ACR events +- perf/x86/intel: Always reprogram ACR events to prevent stale masks +- perf/x86/intel: Improve validation and configuration of ACR masks +- perf/x86/intel: Only check GP counters for PEBS constraints validation +- perf/x86/intel: Fix OMR snoop information parsing issues +- perf/x86/intel: Add support for rdpmc user disable feature +- perf/x86: Use macros to replace magic numbers in attr_rdpmc +- perf/x86/intel: Add core PMU support for DMR +- perf/x86/intel: Add support for PEBS memory auxiliary info field in DMR +- perf/x86/intel: Support the 4 new OMR MSRs introduced in DMR and NVL +- perf/x86/intel: Switch to new Intel CPU model defines +- mm/mempolicy: prepare weighted interleave sysfs for memory hotplug +- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer +- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present +- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets +- x86: shadow stacks: proper error handling for mmap lock +- wifi: iwlwifi: fix 22000 series SMEM parsing +- wifi: iwlwifi: allow IWL_FW_CHECK() with just a string +- srcu: Use irq_work to start GP in tiny SRCU +- irqwork: Move data struct to a types header +- types: move struct rcuwait into types.h +- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger +- spi: mpc52xx: fix controller deregistration + +* Tue Jul 14 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-163.0.0.148.20260714.e16e9abef9c1 +- !24794 Fix CVE-2026-53149 +- !24780 net/hinic5: fix code logic bug in the nic +- !24796 urma: use vzalloc for ubmad tjetty and ini_rtbuffer +- !24650 gtp: disable BH before calling udp_tunnel_xmit_skb() +- !24651 sctp: purge outqueue on stale COOKIE-ECHO handling +- !24652 thunderbolt: Reject zero-length property entries in validator +- !24716 drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs +- !24788 perf/x86/amd/core: Avoid enabling BRS from the SVM reload path +- !24722 Fix CVE-2026-46054 +- urma: use vzalloc for ubmad tjetty and ini_rtbuffer +- net/hinic5: fix code logic bug in the nic +- thunderbolt: Bound root directory content to block size +- !24698 arm64: stacktrace: Don't WARN when unwinding other tasks +- !24784 urma: fix UAF of accessing jfs/jetty in log. +- !24773 drivers/ub/sentry: move smh_common_type.h to the include/uapi directory +- perf/x86/amd/core: Avoid enabling BRS from the SVM reload path +- urma: fix UAF of accessing jfs/jetty in log. +- drivers/ub/sentry: move smh_common_type.h to the include/uapi directory +- selinux: fix overlayfs mmap() and mprotect() access checks +- lsm: add backing_file LSM hooks +- fs: constify file ptr in backing_file accessor helpers +- fs: prepare for adding LSM blob to backing_file +- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs +- arm64: stacktrace: Don't WARN when unwinding other tasks +- thunderbolt: Reject zero-length property entries in validator +- sctp: purge outqueue on stale COOKIE-ECHO handling +- gtp: disable BH before calling udp_tunnel_xmit_skb() + +* Mon Jul 13 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-163.0.0.148.20260713.fe0800799d8e +- !24765 urma: fix tpid uobj used by ubcore_get_tp_list +- !24718 drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() +- !24721 ub:ubus: Update ubus documetation to match latest code +- !24768 urma: ratelimit import jetty/jfr error logs +- urma: ratelimit import jetty/jfr error logs +- urma: fix tpid uobj used by ubcore_get_tp_list +- ub:ubus: Update ubus documetation to match latest code +- ub:ubus: move ub memory event definition to uapi +- ub:ubus: Support DKMS +- drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() + +* Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-163.0.0.148.20260710.b1293be5552c +- !24752 urma: drain jfe event lists in batches to avoid soft-lockup +- urma: drain jfe event lists in batches to avoid soft-lockup +- !24750 urma: reduce ubagg topo log noise +- urma: reduce ubagg topo log noise +- !24389 feat(tsm): add measurement extend support with rem0-rem3 configfs interface +- !24747 urma: free jfe events outside lock +- !24740 urma: free completion events outside jfe lock +- urma: free jfe events outside lock +- urma: free completion events outside jfe lock +- !24733 urma: fix UAF of accessing token_id in log. +- !24726 urma: fix get tp list from ops to single group id +- !24705 urma: free tpid by uobj +- feat(tsm): add measurement extend support with rem0-rem3 configfs interface +- !24730 urma: Fix the issue of inaccurate timing for some functions in DFX +- urma: fix get tp list from ops to single group id +- !24731 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity +- urma: fix UAF of accessing token_id in log. +- mm/numa_remote: limit remote NUMA linear mapping to PMD granularity +- urma: Fix the issue of inaccurate timing for some functions in DFX +- urma: free tpid by uobj + +* Thu Jul 09 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-163.0.0.148.20260709.2b076cc36d6f +- !24728 urma: fix tpid_reuse attached to vtpn causes use_after_free +- urma: fix tpid_reuse attached to vtpn causes use_after_free +- !24701 [OLK-6.6]: SEV-SNP Fix for QEMU startup failure +- !24684 Bluetooth: serialize accept_q access +- sw_64/kvm: select HAVE_KVM_READONLY_MEM +- kvm: replace __KVM_HAVE_READONLY_MEM with Kconfig symbol +- Bluetooth: serialize accept_q access + +* Wed Jul 08 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-163.0.0.148 +- !24706 l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() +- !24709 v2 CVE-2026-53090 +- !24683 [OLK-6.6] Fix CVE-2026-53359 +- !24710 Ethernet: Linkdata: remove mistakenly committed binary file +- Ethernet: Linkdata: remove mistakenly committed binary file +- selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs +- bpf: Fix ld_{abs,ind} failure path analysis in subprogs +- l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() +- !20350 Backport EDAC support for DMR and regression for CWF +- !24696 urma: retry import jetty/jfr on EIO from tpid reuse failure +- !24700 urma: limit ubagg connect exchange logs +- urma: retry import jetty/jfr on EIO from tpid reuse failure +- urma: limit ubagg connect exchange logs +- !24692 USB: serial: io_ti: fix heap overflow in get_manuf_info() +- !24690 drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED +- !24689 drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths +- !24648 locking/rtmutex: Skip remove_waiter() when waiter is not enqueued +- USB: serial: io_ti: fix heap overflow in get_manuf_info() +- drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED +- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths +- KVM: x86: Fix shadow paging use-after-free due to unexpected role +- !24667 CVE-2026-53358 +- !24664 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise +- mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise +- Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref +- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn +- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() +- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued +- EDAC/i10nm: Add back CWF support +- config: enable DMR EDAC driver +- EDAC/imh: Setup 'imh_test' debugfs testing node +- EDAC/{skx_comm,imh}: Detect 2-level memory configuration +- EDAC/skx_common: Extend the maximum number of DRAM chip row bits +- EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers +- EDAC/skx_common: Prepare for skx_set_hi_lo() +- EDAC/skx_common: Prepare for skx_get_edac_list() +- EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev +- EDAC/{skx_common,skx}: Use configuration data, not global macros + +* Tue Jul 07 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-162.0.0.147.20260707.c74a44b14e49 +- !24642 [OLK-6.6] ub: ubase: Modify the log for receiving the ctrlq message +- !24600 fix CVE-2026-53003 +- !24378 ipc/shm: serialize orphan cleanup with shm_nattch updates +- !24635 drm/virtio: Fix driver removal with disabled KMS +- !24616 Fix CVE-2026-53000 +- !24621 urma: limit ubcore logs in reuse paths +- drm/virtio: Fix driver removal with disabled KMS +- urma: limit ubcore logs in reuse paths +- netfilter: nat: use kfree_rcu to release ops +- fix kabi for ppp_defs.h +- pppoe: drop PFC frames +- ub: ubase: Modify the log for receiving the ctrlq message +- ipc/shm: serialize orphan cleanup with shm_nattch updates + +* Mon Jul 06 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-162.0.0.147.20260706.39a914671550 +- !24627 Fix CVE-2026-53356 +- !24091 Fix CVE-2026-46302 +- !24390 [OLK-6.6] Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" +- !24392 [OLK-6.6][linux-6.6.y sync] Backport 6.6.135-6.6.136 LTS conflict Patches +- !24602 Fix CVE-2026-53345 +- drm/i915/gem: Fix phys BO pread/pwrite with offset +- !24567 v2 erofs: unify lcn as u64 for 32-bit platforms +- !24340 padata: fix kabi breakage +- !24609 Fix CVE-2026-53357 +- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() +- !24579 Fix CVE-2026-53246 +- !24576 Fix CVE-2026-53207 +- !24575 Fix CVE-2026-53148 +- !24606 CVE-2026-53084 and CVE-2026-53085 +- !24577 iommu/vt-d: Fix oops due to out of scope access +- !24087 x86/hw-vuln:Adjust CPU mitigations MSR handling for newer models +- bpf: return VMA snapshot from task_vma iterator +- bpf: switch task_vma iterator from mmap_lock to per-VMA locks +- bpf: fix mm lifecycle in open-coded task_vma iterator +- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying +- sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing +- iommu/vt-d: Fix oops due to out of scope access +- mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison +- thunderbolt: Clamp XDomain response data copy to allocation size +- erofs: unify lcn as u64 for 32-bit platforms +- ksmbd: make ksmbd thread names distinct by client IP +- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path +- ALSA: caiaq: Don't abort when no input device is available +- ALSA: caiaq: fix usb_dev refcount leak on probe failure +- ALSA: caiaq: Handle probe errors properly +- ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow +- USB: cdc-acm: Fix bit overlap and move quirk definitions to header +- ALSA: caiaq: take a reference on the USB device in create_card() +- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu +- ksmbd: use check_add_overflow() to prevent u16 DACL size overflow +- ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment +- smb: server: fix max_connections off-by-one in tcp accept path +- smb: server: fix active_num_conn leak on transport allocation failure +- usb: port: add delay after usb_hub_set_port_power() +- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen +- usb: storage: Expand range of matched versions for VL817 quirks entry +- xfrm: Wait for RCU readers during policy netns exit +- Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" +- x86/hw-vuln:Adjust CPU mitigations MSR handling for newer models +- padata: fix kabi breakage +- padata: Put CPU offline callback in ONLINE section to allow failure +- padata: Remove cpu online check from cpu add and removal +- selinux: allow multiple opens of /sys/fs/selinux/policy + +* Sun Jul 05 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-162.0.0.147.20260705.9186ff790f08 +- !24601 ub: udma: Optimize udma jetty id access logic. +- ub: udma: Optimize udma jetty id access logic. +- !24585 urma: fix workqueue use-after-free in ubagg_exit teardown sequence +- ubagg: fix workqueue use-after-free in ubagg_exit teardown sequence + +* Sat Jul 04 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-162.0.0.147.20260704.a927b975a5e9 +- !24309 Fix CVE-2026-53267 +- !24583 Optimize wake_soft_domain() fast path +- sched/fair: Optimize wake_soft_domain() fast path +- Revert "sched/fair: Record per-LLC utilization to guide cache-aware scheduling decisions" +- Revert "kabi: Protect new sched_domain_shared fields with KABI_EXTEND" +- Revert "sched: Inhibit soft domain scheduling when overutil" +- Revert "sched/fair: Optimize wake_soft_domain() fast path" +- Revert "sched/fair: Filter soft domain candidates in find_idlest_group/cpu" +- !24573 Optimize soft domain +- !24470 [OLK-6.6] Fix CVE-2026-53138 +- !24469 [OLK-6.6] Fix CVE-2026-53137 +- !24460 [OLK-6.6] Fix CVE-2026-53190 +- !24453 [OLK-6.6] Fix CVE-2026-53208 +- !24452 [OLK-6.6] Fix CVE-2026-53268 +- !24448 [OLK-6.6] Fix CVE-2026-53213 +- !24531 [OLK-6.6] Fix CVE-2026-53072 +- !24523 [OLK-6.6] Fix CVE-2026-53073 +- !24515 [OLK-6.6] Fix CVE-2026-53017 +- !24456 [OLK-6.6] Fix CVE-2026-53177 +- !24440 [OLK-6.6] Fix CVE-2026-53275 +- !24436 [OLK-6.6] Fix CVE-2026-53270 +- !24430 [OLK-6.6] Fix CVE-2026-53269 +- !24424 [OLK-6.6] Fix CVE-2026-53230 +- !24418 [OLK-6.6] Fix CVE-2026-53245 +- !24417 [OLK-6.6] Fix CVE-2026-53238 +- !24407 [OLK-6.6] Fix CVE-2026-53266 +- !24406 [OLK-6.6] Fix CVE-2026-53236 +- !24405 [OLK-6.6] Fix CVE-2026-53249 +- sched/fair: Filter soft domain candidates in find_idlest_group/cpu +- sched/fair: Optimize wake_soft_domain() fast path +- !24351 [OLK-6.6] Fix CVE-2026-53136 +- sched: Inhibit soft domain scheduling when overutil +- kabi: Protect new sched_domain_shared fields with KABI_EXTEND +- sched/fair: Record per-LLC utilization to guide cache-aware scheduling decisions +- !24369 ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size +- ipv6: mcast: Fix use-after-free when processing MLD queries +- netfilter: bridge: make ebt_snat ARP rewrite writable +- tcp: restrict SO_ATTACH_FILTER to priv users +- ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options +- netfilter: conntrack_irc: fix possible out-of-bounds read +- ipvs: clear the svc scheduler ptr early on edit +- netfilter: synproxy: add mutex to guard hook reference counting +- net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr +- netlabel: validate unlabeled address and mask attribute lengths +- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER +- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error +- f2fs: fix data loss caused by incorrect use of nat_entry flag +- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list +- drm/amd/display: Bound VBIOS record-chain walk loops +- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size +- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() +- bnxt_en: Fix NULL pointer dereference +- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size +- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig +- drm/vc4: fix krealloc() memory leak +- ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size +- netfilter: nft_ct: bail out on template ct in get eval + +* Fri Jul 03 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-162.0.0.147.20260703.39b7a750c01c +- !24494 i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl +- !24491 bus: fsl-mc: use generic driver_override infrastructure +- !24356 vdpa: use generic driver_override infrastructure +- !24483 urma: kref_get in find_add_tpid_reuse +- !24564 iommu/amd: Fix clone_alias() to use the original device's devid +- iommu/amd: Fix clone_alias() to use the original device's devid +- !24475 urma: create resources in ubmad_post_send before the ack message returns +- !24533 iommu/ummu: Fix use-after-free in ummu_core_alloc_separate_tdev +- !24520 urma: change log level to rl in ubagg_import_jetty and ubagg_import_seg +- iommu/ummu: Fix use-after-free in ummu_core_alloc_separate_tdev +- urma: create resources in ubmad_post_send before the ack message returns +- !24252 Fix CVE-2026-53072 +- !24341 kernel/fork: clear PF_BLOCK_TS in copy_process() +- !24335 Fix CVE-2026-53186 +- !24311 Fix CVE-2026-53208 +- !24343 Bluetooth: fix memory leak in error path of hci_alloc_dev() +- urma: change log level to rl in ubagg_import_jetty and ubagg_import_seg +- urma: kref_get in find_add_tpid_reuse +- !24401 [OLK-6.6] Fix CVE-2026-53159 +- !24402 [OLK-6.6] Fix CVE-2026-53158 +- !24421 [OLK-6.6] Fix CVE-2026-53237 +- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl +- bus: fsl-mc: use generic driver_override infrastructure +- gpio: mvebu: fix NULL pointer dereference in suspend/resume +- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback +- misc: fastrpc: fix DMA address corruption due to find_vma misuse +- vdpa: use generic driver_override infrastructure +- Bluetooth: fix memory leak in error path of hci_alloc_dev() +- kernel/fork: clear PF_BLOCK_TS in copy_process() +- RDMA/srp: bound SRP_RSP sense copy by the received length +- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig +- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER + +* Thu Jul 02 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-162.0.0.147.20260702.e78715948e81 +- !24379 urma: fix nullptr in ubcore_remove_jetty_from_jetty_grp +- !24478 ub: udma: Adjust the order of delete global variables. +- !24473 cgroup/psi: Set of->priv to NULL upon file release +- !24409 [OLK-6.6] Fix CVE-2026-53252 +- !24411 [OLK-6.6] Fix CVE-2026-53253 +- !24414 [OLK-6.6] Fix CVE-2026-53254 +- !24416 [OLK-6.6] Fix CVE-2026-53255 +- !24419 [OLK-6.6] Fix CVE-2026-53256 +- !24442 [OLK-6.6] Fix CVE-2026-53242 +- !24451 [OLK-6.6] Fix CVE-2026-53209 +- urma: fix nullptr in ubcore_remove_jetty_from_jetty_grp +- ub: udma: Adjust the order of delete global variables. +- !24461 [OLK-6.6] Fix CVE-2026-53186 +- !24457 [OLK-6.6] Fix CVE-2026-53176 +- !24370 Fix CVE-2026-53229 +- !24359 Fix CVE-2026-52991 +- cgroup/psi: Set of->priv to NULL upon file release +- !24283 Fix CVE-2026-52988 +- !24266 Fix CVE-2026-52943 +- !24262 Fix CVE-2026-52909 +- RDMA/srp: bound SRP_RSP sense copy by the received length +- IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN +- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend +- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams +- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() +- Bluetooth: MGMT: validate advertising TLV before type checks +- Bluetooth: RFCOMM: validate skb length in MCC handlers +- Bluetooth: bnep: reject short frames before parsing +- Bluetooth: fix memory leak in error path of hci_alloc_dev() +- !24354 urma: fix several tp state and adapter disconnect cleanup bugs +- !23535 [OLK-6.6] Fix CVE-2025-71273 +- !24365 ipc: limit next_id allocation to the valid ID range +- !24364 urma: split tpid_reuse from vtpn to avoid use_after_free +- urma: fix several tp state and adapter disconnect cleanup bugs +- urma: split tpid_reuse from vtpn to avoid use_after_free +- net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure +- ipc: limit next_id allocation to the valid ID range +- sched/psi: fix race between file release and pressure write +- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase +- rculist: add list_splice_rcu() for private lists +- net: skbuff: fix missing zerocopy reference in pskb_carve helpers +- ip6_vti: set netns_immutable on the fallback device. +- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() +- wifi: rtw88: debugfs: support multiple adapters debugging + +* Wed Jul 01 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-162.0.0.147 +- !24366 USB: serial: kl5kusb105: fix bulk-out buffer overflow +- !24275 signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() +- !24357 drivers/ub/sentry: move msgid/timestamp init to callers and improve logging +- !22605 arm64: Set io memory s2 pte as normalnc for vfio pci device +- !24367 Fix CVE-2026-53272 +- !24352 Fix CVE-2026-53227 +- erofs: fix use-after-free on sbi->sync_decompress +- USB: serial: kl5kusb105: fix bulk-out buffer overflow +- drivers/ub/sentry: move msgid/timestamp init to callers and improve logging +- net: openvswitch: fix possible kfree_skb of ERR_PTR +- !24172 mem/memcontrol: support memory.qos_level for cgroup-v2 +- !24277 net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use +- !21196 [OLK-6.6] Enable SEV SNP kernel patches +- !24338 Fix CVE-2026-53195 +- !24264 Fix CVE-2026-53123 +- !24245 Fix CVE-2026-53265 +- !21064 drivers/ub/sentry: merge sentry_urma_comm and sentry_uvb_comm into sentry_remote_reporter +- !24344 urma: fix UAF in uburma_open and uburma_close +- urma: fix file lifetime race between open, close and device removal +- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() +- net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use +- signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() +- md: wake raid456 reshape waiters before suspend +- dm cache policy smq: check allocation under invalidate lock +- drivers/ub/sentry: merge sentry_urma_comm and sentry_uvb_comm into sentry_remote_reporter +- docs: memcg: document memory.qos_level and memcg_qos_enable +- mem/memcontrol: support memory.qos_level for cgroup-v2 +- arm64: Notify the QEMU related BAR that the NC attribute is set +- vfio: Convey kvm that the vfio-pci device is wc safe +- KVM: arm64: Set io memory s2 pte as normalnc for vfio pci device +- mm: Introduce new flag to indicate wc safe +- KVM: arm64: Introduce new flag for non-cacheable IO memor +- KVM: SEV: Compute the correct max length of the in-GHCB scratch area +- KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests +- KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer +- KVM: SEV: Check PSC request indices against the actual size of the buffer +- KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() +- KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ +- KVM: SVM: Provide helpers to set the error code +- KVM: SVM: Convert plain error code numbers to defines +- KVM: SEV: Ignore MMIO requests of length '0' +- KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use +- KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API +- config: arm64: add KVM_GENERIC_MMU_NOTIFIER=y for SNP backport +- rtmutex_api: provide correct extern functions +- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish +- KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU +- locking/mutex: implement mutex_lock_killable_nest_lock +- locking/mutex: implement mutex_trylock_nested +- KVM: add kvm_lock_all_vcpus and kvm_trylock_all_vcpus +- crypto: ccp - narrow scope of snp_range_list +- KVM: SVM: Drop the module param to control SEV-ES DebugSwap +- KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() +- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot +- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying +- KVM: Explicitly mark KVM_GUEST_MEMFD as depending on KVM_GENERIC_MMU_NOTIFIER +- KVM: guest_memfd: Remove RCU-protected attribute from slot->gmem.file +- crypto: ccp: Make snp_range_list static +- config: x86: enable KVM guest_memfd/CoCo configs for SEV-SNP backport +- KABI fixes for x86/kvm. +- crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length +- KVM: SEV: Enforce minimum GHCB version requirement for SEV-SNP guests +- KVM: SEV: Drop GHCB_VERSION_DEFAULT and open code it +- crypto: ccp - Fix locking on alloc failure handling +- KVM: x86: Check that the high 32bits are clear in kvm_arch_vcpu_ioctl_run() +- tools headers: Update the x86 headers with the kernel sources +- x86/kexec: Export e820_table_kexec[] to sysfs +- KVM: x86: don't fall through case statements without annotations +- KVM: x86: Only advertise KVM_CAP_READONLY_MEM when supported by VM +- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure +- KVM: Allow CPU to reschedule while setting per-page memory attributes +- KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing +- KVM: Add member to struct kvm_gfn_range to indicate private/shared +- KVM: x86/mmu: Check and free obsolete roots in kvm_mmu_reload() +- KVM: SVM: Fix SNP AP destroy race with VMRUN +- crypto: ccp - Fix uAPI definitions of PSP errors +- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected +- KVM: selftests: Fix printf() format goof in SEV smoke test +- KVM: SVM: Simplify request+kick logic in SNP AP Creation handling +- KVM: SVM: Require AP's "requested" SEV_FEATURES to match KVM's view +- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error +- KVM: SVM: Refuse to attempt VRMUN if an SEV-ES+ guest has an invalid VMSA +- KVM: SVM: Save host DR masks on CPUs with DebugSwap +- x86/sev: Fix broken SNP support with KVM module built-in +- KVM: SEV: Use to_kvm_sev_info() for fetching kvm_sev_info struct +- iommu/amd: remove return value of amd_iommu_detect +- KVM: SVM: Disable AVIC on SNP-enabled system without HvInUseWrAllowed feature +- KVM: SVM: Macrofy SEV=n versions of sev_xxx_guest() +- x86/sev: Add full support for a segmented RMP table +- x86/sev: Treat the contiguous RMP table as a single RMP segment +- x86/sev: Map only the RMP table entries instead of the full RMP range +- x86/sev: Move the SNP probe routine out of the way +- x86/sev: Add support for the RMPREAD instruction +- x86/sev: Prepare for using the RMPREAD instruction to access the RMP +- kvm: svm: Fix gctx page leak on invalid inputs +- KVM: SVM: Propagate error from snp_guest_req_init() to userspace +- KVM: selftests: fix unintentional noop test in guest_memfd_test.c +- Documentation: Improve crash_kexec_post_notifiers description +- x86/sev: Ensure that RMP table fixups are reserved +- crypto: ccp - do not request interrupt on cmd completion when irqs disabled +- KVM: x86: Exit to userspace if fastpath triggers one on instruction skip +- KVM: x86: Dedup fastpath MSR post-handling logic +- KVM: x86: Re-enter guest if WRMSR(X2APIC_ICR) fastpath is successful +- KVM: SEV: Update KVM_AMD_SEV Kconfig entry and mention SEV-SNP +- KVM: x86/mmu: Check that root is valid/loaded when pre-faulting SPTEs +- KVM: x86: Disallow read-only memslots for SEV-ES and SEV-SNP (and TDX) +- KVM: SVM: Fix an error code in sev_gmem_post_populate() +- KVM: SVM: Fix uninitialized variable bug +- KVM: x86/mmu: fix determination of max NPT mapping level for private pages +- x86/sev: Do RMP memory coverage check after max_pfn has been set +- KVM: SEV-ES: Fix svm_get_msr()/svm_set_msr() for KVM_SEV_ES_INIT guests +- crypto: ccp - Fix null pointer dereference in __sev_snp_shutdown_locked +- KVM: selftests: Fix shift of 32 bit unsigned int more than 32 bits +- tools headers UAPI: Sync kvm headers with the kernel sources +- KVM: x86: Fully re-initialize supported_vm_types on vendor module load +- KVM: x86/mmu: Move private vs. shared check above slot validity checks +- KVM: fix documentation for KVM_CREATE_GUEST_MEMFD +- iommu/amd: Change log message severity +- iommu/amd: Do not enable SNP when V2 page table is enabled +- KVM: SEV: use u64_to_user_ptr throughout +- x86/sev: Add callback to apply RMP table fixups for kexec +- x86/sev: Move sev_setup_arch() to mem_encrypt.c +- x86/e820: Add a new e820 table update helper +- tools/include: Sync x86 asm/msr-index.h with the kernel sources +- tools/include: Sync uapi/linux/kvm.h and asm/kvm.h with the kernel sources +- x86/kexec: Do not update E820 kexec table for setup_data +- KVM: selftests: Explicitly close guest_memfd files in some gmem tests +- KVM: selftests: Create GUEST_MEMFD for relevant invalid flags testcases +- KVM: Make KVM_MEM_GUEST_MEMFD mutually exclusive with KVM_MEM_READONLY +- crypto: ccp - Have it depend on AMD_IOMMU +- iommu/amd: Fix failure return from snp_lookup_rmpentry() +- Documentation: virt: Fix up pre-formatted text block for SEV ioctls +- tools headers UAPI: Sync kvm headers with the kernel sources +- LoongArch: KVM: Fix build due to API changes +- selftests/kvm: fix compilation on non-x86_64 platforms +- KVM: guest_memfd: abstract how prepared folios are recorded +- KVM: guest_memfd: let kvm_gmem_populate() operate only on private gfns +- KVM: extend kvm_range_has_memory_attributes() to check subset of attributes +- KVM: cleanup and add shortcuts to kvm_range_has_memory_attributes() +- KVM: guest_memfd: move check for already-populated page to common code +- KVM: remove kvm_arch_gmem_prepare_needed() +- KVM: guest_memfd: make kvm_gmem_prepare_folio() operate on a single struct kvm +- KVM: guest_memfd: delay kvm_gmem_prepare_folio() until the memory is passed to the guest +- KVM: guest_memfd: return locked folio from __kvm_gmem_get_pfn +- KVM: rename CONFIG_HAVE_KVM_GMEM_* to CONFIG_HAVE_KVM_ARCH_GMEM_* +- KVM: guest_memfd: do not go through struct page +- KVM: guest_memfd: delay folio_mark_uptodate() until after successful preparation +- KVM: guest_memfd: return folio from __kvm_gmem_get_pfn() +- KVM: x86: disallow pre-fault for SNP VMs before initialization +- crypto: ccp: Add the SNP_VLEK_LOAD command +- KVM: SEV: Provide support for SNP_EXTENDED_GUEST_REQUEST NAE event +- x86/sev: Move sev_guest.h into common SEV header +- KVM: selftests: Explicitly ucall pool from shared memory +- KVM: selftests: Add support for protected vm_vaddr_* allocations +- KVM: SEV: Provide support for SNP_GUEST_REQUEST NAE event +- KVM: x86: Implement kvm_arch_vcpu_pre_fault_memory() +- KVM: x86/mmu: Make kvm_mmu_do_page_fault() return mapped level +- KVM: x86/mmu: Account pf_{fixed,emulate,spurious} in callers of "do page fault" +- KVM: Add KVM_PRE_FAULT_MEMORY vcpu ioctl to pre-populate guest memory +- KVM: Document KVM_PRE_FAULT_MEMORY ioctl +- KVM: interrupt kvm_gmem_populate() on signals +- virt: guest_memfd: fix reference leak on hwpoisoned page +- KVM: SNP: Fix LBR Virtualization for SNP guest +- KVM: x86/mmu: check for invalid async page faults involving private memory +- KVM: x86/mmu: Pass full 64-bit error code when handling page faults +- KVM: guest-memfd: fix unused-function warning +- KVM: SEV-ES: Delegate LBR virtualization to the processor +- KVM: SEV-ES: Disallow SEV-ES guests when X86_FEATURE_LBRV is absent +- KVM: SEV-ES: Prevent MSR access post VMSA encryption +- KVM: SVM: Remove the need to trigger an UNBLOCK event on AP creation +- KVM: SEV: Don't WARN() if RMP lookup fails when invalidating gmem pages +- KVM: SEV: Automatically switch reclaimed pages to shared +- KVM: SVM: Add module parameter to enable SEV-SNP +- KVM: SEV: Avoid WBINVD for HVA-based MMU notifications for SNP +- KVM: x86: Implement hook for determining max NPT mapping level +- KVM: SEV: Implement gmem hook for invalidating private pages +- KVM: SEV: Implement gmem hook for initializing private pages +- hugetlbfs: convert to new timestamp accessors +- KVM: SEV: Support SEV-SNP AP Creation NAE event +- KVM: SEV: Add support to handle RMP nested page faults +- KVM: SEV: Add support to handle Page State Change VMGEXIT +- KVM: SEV: Add support to handle MSR based Page State Change VMGEXIT +- KVM: SEV: Add support to handle GHCB GPA register VMGEXIT +- KVM: SEV: Add KVM_SEV_SNP_LAUNCH_FINISH command +- KVM: SEV: Add KVM_SEV_SNP_LAUNCH_UPDATE command +- KVM: SEV: Add KVM_SEV_SNP_LAUNCH_START command +- KVM: SEV: Add initial SEV-SNP support +- KVM: SEV: Select KVM_GENERIC_PRIVATE_MEM when CONFIG_KVM_AMD_SEV=y +- KVM: MMU: Disable fast path if KVM_EXIT_MEMORY_FAULT is needed +- KVM: x86: Add hook for determining max NPT mapping level +- KVM: guest_memfd: Add hook for invalidating memory +- KVM: guest_memfd: Add interface for populating gmem pages with user data +- KVM: guest_memfd: extract __kvm_gmem_get_pfn() +- mm, virt: merge AS_UNMOVABLE and AS_INACCESSIBLE +- KVM: guest_memfd: Add hook for initializing memory +- KVM: x86/mmu: Use synthetic page fault error code to indicate private faults +- KVM: x86: Move synthetic PFERR_* sanity checks to SVM's #NPF handler +- KVM: x86: Define more SEV+ page fault error bits/flags for #NPF +- KVM: x86: Remove separate "bit" defines for page fault error code masks +- KVM: guest_memfd: limit overzealous WARN +- KVM: guest_memfd: pass error up from filemap_grab_folio +- KVM: guest_memfd: Use AS_INACCESSIBLE when creating guest_memfd inode +- mm: Introduce AS_INACCESSIBLE for encrypted/confidential memory +- KVM: SEV: Allow per-guest configuration of GHCB protocol version +- KVM: SEV: Add GHCB handling for termination requests +- KVM: SEV: Add GHCB handling for Hypervisor Feature Support requests +- KVM: SEV: Add support to handle AP reset MSR protocol +- x86/sev: Make the VMPL0 checking more straight forward +- x86/sev: Rename snp_init() in boot/compressed/sev.c +- x86/sev: Shorten struct name snp_secrets_page_layout to snp_secrets_page +- selftests: kvm: add test for transferring FPU state into VMSA +- selftests: kvm: split "launch" phase of SEV VM creation +- selftests: kvm: switch to using KVM_X86_*_VM +- KVM: selftests: Add a basic SEV-ES smoke test +- KVM: selftests: Add a basic SEV smoke test +- KVM: selftests: Add library for creating and interacting with SEV guests +- KVM: selftests: Allow tagging protected memory in guest page tables +- KVM: selftests: Add support for allocating/managing protected guest memory +- KVM: selftests: Add a macro to iterate over a sparsebit range +- KVM: selftests: Make sparsebit structs const where appropriate +- KVM: selftests: Extend VM creation's @shape to allow control of VM subtype +- KVM: selftests: Add logic to detect if ioctl() failed because VM was killed +- KVM: selftests: Drop the single-underscore ioctl() helpers +- selftests: kvm: add tests for KVM_SEV_INIT2 +- KVM: SEV: allow SEV-ES DebugSwap again +- KVM: SEV: introduce KVM_SEV_INIT2 operation +- KVM: SEV: sync FPU and AVX state at LAUNCH_UPDATE_VMSA time +- KVM: SEV: define VM types for SEV and SEV-ES +- KVM: SEV: introduce to_kvm_sev_info +- KVM: x86: Add supported_vm_types to kvm_caps +- KVM: x86/mmu: Restrict KVM_SW_PROTECTED_VM to the TDP MMU +- KVM: x86: add fields to struct kvm_arch for CoCo features +- KVM: x86: Remove 'return void' expression for 'void function' +- KVM: SEV: store VMSA features in kvm_sev_info +- KVM: SEV: publish supported VMSA features +- KVM: introduce new vendor op for KVM_GET_DEVICE_ATTR +- KVM: x86: use u64_to_user_ptr() +- KVM: SVM: Compile sev.c if and only if CONFIG_KVM_AMD_SEV=y +- x86/CPU/AMD: Track SNP host status with cc_platform_*() +- x86/cc: Add cc_platform_set/_clear() helpers +- x86/kvm/Kconfig: Have KVM_AMD_SEV select ARCH_HAS_CC_PLATFORM +- Documentation: kvm/sev: clarify usage of KVM_MEMORY_ENCRYPT_OP +- Documentation: kvm/sev: separate description of firmware +- KVM: SEV: fix compat ABI for KVM_MEMORY_ENCRYPT_OP +- KVM: x86: move x86-specific structs to uapi/asm/kvm.h +- KVM: remove more traces of device assignment UAPI +- KVM x86/xen: add an override for PVCLOCK_TSC_STABLE_BIT +- x86/sev: Dump SEV_STATUS +- crypto: ccp: Add the SNP_SET_CONFIG command +- crypto: ccp: Add the SNP_COMMIT command +- crypto: ccp: Add the SNP_PLATFORM_STATUS command +- x86/cpufeatures: Enable/unmask SEV-SNP CPU feature +- KVM: SEV: Make AVIC backing, VMSA and VMCB memory allocation SNP safe +- crypto: ccp: Add panic notifier for SEV/SNP firmware shutdown on kdump +- iommu/amd: Clean up RMP entries for IOMMU pages during SNP shutdown +- crypto: ccp: Handle legacy SEV commands when SNP is enabled +- crypto: ccp: Handle non-volatile INIT_EX data when SNP is enabled +- crypto: ccp: Handle the legacy TMR allocation when SNP is enabled +- x86/sev: Introduce an SNP leaked pages list +- crypto: ccp: Provide an API to issue SEV and SNP commands +- crypto: ccp: Add support to initialize the AMD-SP for SEV-SNP +- crypto: ccp: Define the SEV-SNP commands +- x86/sev: Adjust the directmap to avoid inadvertent RMP faults +- virt: sevguest: Add TSM_REPORTS support for SNP_GET_EXT_REPORT +- virt: sevguest: Prep for kernel internal get_ext_report() +- x86/sev: Add helper functions for RMPUPDATE and PSMASH instruction +- x86/fault: Dump RMP table information when RMP page faults occur +- x86/traps: Define RMP violation #PF error code +- x86/fault: Add helper for dumping RMP entries +- x86/sev: Add RMP entry lookup helpers +- x86/mtrr: Don't print errors if MtrrFixDramModEn is set when SNP enabled +- x86/sev: Add SEV-SNP host initialization support +- iommu/amd: Don't rely on external callers to enable IOMMU SNP support +- x86/speculation: Do not enable Automatic IBRS if SEV-SNP is enabled +- x86/cpufeatures: Add SEV-SNP CPU feature +- x86/mm: Fix memory encryption features advertisement +- KVM: selftests: Add a memory region subtest to validate invalid flags +- KVM: selftests: Test KVM exit behavior for private memory/access +- KVM: selftests: Add basic selftest for guest_memfd() +- KVM: selftests: Expand set_memory_region_test to validate guest_memfd() +- KVM: selftests: Add KVM_SET_USER_MEMORY_REGION2 helper +- KVM: selftests: Add x86-only selftest for private memory conversions +- KVM: selftests: Add GUEST_SYNC[1-6] macros for synchronizing more data +- KVM: selftests: Introduce VM "shape" to allow tests to specify the VM type +- KVM: selftests: Add helpers to do KVM_HC_MAP_GPA_RANGE hypercalls (x86) +- KVM: selftests: Add helpers to convert guest memory b/w private and shared +- KVM: selftests: Add support for creating private memslots +- KVM: selftests: Convert lib's mem regions to KVM_SET_USER_MEMORY_REGION2 +- KVM: selftests: Drop unused kvm_userspace_memory_region_find() helper +- KVM: x86: Add support for "protected VMs" that can utilize private memory +- KVM: Allow arch code to track number of memslot address spaces per VM +- KVM: x86/mmu: Handle page fault for private memory +- KVM: x86: "Reset" vcpu->run->exit_reason early in KVM_RUN +- KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory +- KVM: Drop .on_unlock() mmu_notifier hook +- KVM: Use gfn instead of hva for mmu_notifier_retry +- fs: Rename anon_inode_getfile_secure() and anon_inode_getfd_secure() +- mm: Add AS_UNMOVABLE to mark mapping as completely unmovable +- KVM: Introduce per-page memory attributes +- KVM: Add a dedicated mmu_notifier flag for reclaiming freed memory +- KVM: Tweak kvm_hva_range and hva_handler_t to allow reusing for gfn ranges +- KVM: Add KVM_EXIT_MEMORY_FAULT exit to report faults to userspace +- KVM: Introduce KVM_SET_USER_MEMORY_REGION2 +- KVM: x86/pmu: Add documentation for fixed ctr on PMU filter +- KVM: Correct kvm_vcpu_event(s) typo in KVM API documentation +- KVM: Convert KVM_ARCH_WANT_MMU_NOTIFIER to CONFIG_KVM_GENERIC_MMU_NOTIFIER +- KVM: PPC: Return '1' unconditionally for KVM_CAP_SYNC_MMU +- KVM: PPC: Drop dead code related to KVM_ARCH_WANT_MMU_NOTIFIER +- KVM: WARN if there are dangling MMU invalidations at VM destruction + +* Tue Jun 30 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-161.0.0.146.20260630.3455503931b7 +- !24324 urma: fix urma ping server cleanup paths +- !24318 Fix CVE-2026-53255 +- !24254 Fix CVE-2026-53209 +- urma: fix urma ping server cleanup paths +- !24288 [OLK-6.6][linux-6.6.y sync] Backport 6.6.133-6.6.134 LTS conflict Patches +- Bluetooth: MGMT: validate advertising TLV before type checks +- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL +- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam +- USB: serial: option: add support for Rolling Wireless RW135R-GL +- USB: serial: io_edgeport: add support for Blackbox IC135A +- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr +- netfilter: flowtable: strictly check for maximum number of actions +- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend + +* Mon Jun 29 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-161.0.0.146.20260629.70b8b70f8ce1 +- !24284 powerpc/hv-gpci: fix preempt count leak in sysfs show paths +- powerpc/hv-gpci: fix preempt count leak in sysfs show paths +- !24258 mainline bpf for olk-6.6 +- !24281 urma: fix call trace during JFR deletion +- urma: fix call trace during JFR deletion +- bpf: Fix s16 truncation for large bpf-to-bpf call offsets +- bpf: Fix out-of-bounds read in bpf_patch_call_args() + +* Sun Jun 28 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-161.0.0.146.20260628.6ead7247f712 +- !24278 iommu/ummu: Fix NULL pointer dereference in logic_ummu_tlb_inv_walk +- iommu/ummu: Fix nested TLB invalidation commands +- iommu/ummu: Fix NULL pointer dereference in logic_ummu_tlb_inv_walk + +* Sat Jun 27 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-161.0.0.146.20260627.89ed8e0b6881 +- !24259 urma: free vtpn after free tpid reuse +- urma: free vtpn after free tpid reuse +- !24257 urma: Support user mode to obtain statistical results of kernel interrupt times +- urma: Support user mode to obtain statistical results of kernel interrupt times +- !24229 Fix CVE-2026-53168 +- !24230 fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios +- !24235 Fix CVE-2026-53129 +- !24211 fsnotify: fix inode reference leak in fsnotify_recalc_mask() +- !24202 Fix CVE-2026-52967 +- !24204 Fix CVE-2026-52946 +- !21759 drivers/ub/sentry: replace per-message kthread with workqueue to fix thread leak +- !24246 urma: delete whether head is null in select tpid +- urma: delete whether head is null in select tpid +- drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism +- fs/mbcache: cancel shrink work before destroying the cache +- fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios +- fuse: reject fuse_notify() pagecache ops on directories +- fsnotify: fix inode reference leak in fsnotify_recalc_mask() +- fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling +- smb/client: fix possible infinite loop and oob read in symlink_data() + +* Fri Jun 26 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-161.0.0.146.20260626.bb1c7321d5c8 +- !24237 Fix CVE-2026-53071 +- !24221 bpf: Tighten cgroup storage cookie checks for prog arrays +- !24236 perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler +- !24234 ub: ubase: clear FE reset status register during probe +- !24231 ub:ubus: Always invalidate tlb during decoder unmap +- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp +- ub: ubase: clear FE reset status register during probe +- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler +- !24197 urma: fix isref send no rsp to confirm state +- !24225 tracing: Do not call map->ops->elt_free() if elt_alloc() fails +- ub:ubus: Always invalidate tlb during decoder unmap +- !24206 urma: add huge lock in create tpid +- urma: fix isref send no rsp to confirm state +- !24215 urma: fix ref in ubmad and fix UAF in ubmad_rt_work_handler +- tracing: Do not call map->ops->elt_free() if elt_alloc() fails +- urma: add huge lock in create tpid +- bpf: Tighten cgroup storage cookie checks for prog arrays +- !24141 drivers/ub/sentry: add SMH_VERSION_CHECK ioctl for kernel-userspace ABI version query +- !24188 vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write +- urma: fix ref in ubmad and fix UAF in ubmad_rt_work_handler +- !24213 urma: optimize sleep and logging in TPID reuse and rate-limited logs +- urma: optimize sleep and logging in TPID reuse and rate-limited logs +- !24210 ub: udma: Optimize the process of refcount_inc +- !24198 net: hns3: support set/get VxLAN rule of rx flow director by ethtool +- ub: udma: Optimize the process of refcount_inc +- net: hns3: support set/get VxLAN rule of rx flow director by ethtool +- net: hns3: support tc flow for vf +- net: hns3: move fd code to a separate file +- net: hns3: debugfs support for dumping fd rules +- net: hns3: support IP and tunnel VNI dissectors for tc flow +- net: hns3: support two more actions for tc flow +- net: hns3: improve the unused_tuple parameter setting +- net: hns3: refactor add_cls_flower to prepare for multiple actions +- net: hns3: Use ipv6_addr_{cpu_to_be32,be32_to_cpu} helpers +- ipv6: Add ipv6_addr_{cpu_to_be32,be32_to_cpu} helpers +- net: hns3: flower: validate control flags +- flow_offload: add control flag checking helpers +- Revert "net: hns3: support set/get VxLAN rule of rx flow director by ethtool" +- Revert "net: hns3: adjust add_cls_flower() for support more action" +- Revert "net: hns3: Improved the unused_tuple parameter setting." +- Revert "net: hns3: support two more actions for tc flow" +- Revert "net: hns3: support FLOW_DISSECTOR_KEY_IP and FLOW_DISSECTOR_KEY_ENC_KEYID for tc flow" +- Revert "net: hns3: support tc flow for vf" +- Revert "net: hns3: debugfs support for dumping fd rules" +- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write +- drivers/ub/sentry: add SMH_VERSION_CHECK ioctl for kernel-userspace ABI version query + +* Thu Jun 25 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-161.0.0.146.20260625.7f038e3d942a +- !24196 mm/numa_remote: fix variable undeclared error when CONFIG_MEMORY_RELIABLE isn't enabled +- mm/numa_remote: fix variable undeclared error when CONFIG_MEMORY_RELIABLE isn't enabled +- !24181 urma: fix flush done event dispatch +- !24131 mfs: refactor the event post check function +- !24176 Fix CVE-2026-45855 +- !24177 ub: udma: Intercept unsupported operations. +- urma: fix flush done event dispatch +- !24179 urma: fix ubcore device attr sl flag error +- urma: fix ubcore device attr sl flag error +- !24170 ub:ubus: Optimize the initialization performance of USI INT_TYPE2 +- ub: udma: Intercept unsupported operations. +- ata: libata-scsi: do not needlessly defer commands when using PMP with FBS +- ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS +- ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT +- ata: libata-scsi: improve readability of ata_scsi_qc_issue() +- ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands +- ata: libata-eh: Fix detection of deferred qc timeouts +- ata: libata: cancel pending work after clearing deferred_qc +- ata: libata-core: fix cancellation of a port deferred qc work +- ata: libata-scsi: rename and improve ata_qc_done() +- ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() +- ata: libata-sata: simplify ata_sas_queuecmd() +- ata: libata-core: improve tag checks in ata_qc_issue() +- ata: libata-eh: correctly handle deferred qc timeouts +- ata: libata-scsi: avoid Non-NCQ command starvation +- ata: libata: Introduce ata_port_eh_scheduled() +- ub:ubus: Optimize the initialization performance of USI INT_TYPE2 +- ub:ubus: Resolve the link change message is not reported before sending notify message +- mfs: refactor the event post check function + +* Wed Jun 24 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-161.0.0.146 +- !24130 RDMA: During rereg_mr ensure that REREG_ACCESS is compatible +- !24168 urma: fix tpid status and state reset +- urma: fix tpid status and state reset +- !24166 Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" +- !24154 urma: fix reuse use cnt not balance cause dead lock +- !24153 v2 Fix CVE-2026-45899 +- !24075 xfs: remove xfs_attr_leaf_hasname +- Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" +- urma: fix reuse use cnt not balance cause dead lock +- !24158 urma: add order_type conversion for jfs/jfr/jetty/tjetty config +- urma: add order_type conversion for jfs/jfr/jetty/tjetty config +- !24156 urma: fix ubcore device attr sl flag +- !24155 v2 netfilter: nf_tables: use list_del_rcu for netlink hooks +- urma: fix ubcore device attr sl flag +- !24112 net: Fix CVE-2026-45859 +- !24149 xfrm: Fix CVE-2026-31663 +- !24142 net: netfilter: Fix CVE-2026-43025 +- !24054 urma: urma: use ctp+um to support large-scale D2D communications +- !24151 ub: ub_fwctl: Modify the way ub_fwctl obtains device type and port type. +- !24152 urma: set tpid_status after deactive tp failed +- netfilter: nf_tables: use list_del_rcu for netlink hooks +- ext4: handle wraparound when searching for blocks for indirect mapped blocks +- ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() +- ext4: always allocate blocks only from groups inode can use +- ext4: fix e4b bitmap inconsistency reports +- ext4: convert bd_buddy_page to bd_buddy_folio +- ext4: convert bd_bitmap_page to bd_bitmap_folio +- Revert "ext4: fix e4b bitmap inconsistency reports" +- ext4: cleanup for ext4_map_blocks +- ext4: rename EXT4_GET_BLOCKS_PRE_IO +- ext4: drop extent cache when splitting extent fails +- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout +- ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O +- ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT +- ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() +- ext4: get rid of ppath in ext4_ext_convert_to_initialized() +- ext4: get rid of ppath in ext4_split_convert_extents() +- ext4: get rid of ppath in ext4_split_extent() +- ext4: get rid of ppath in ext4_force_split_extent_at() +- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 +- !24147 nvmet-tcp: fix race between ICReq handling and queue teardown +- ext4: subdivide EXT4_EXT_DATA_VALID1 +- Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" +- ext4: get rid of ppath in ext4_split_extent_at() +- ext4: get rid of ppath in ext4_ext_insert_extent() +- ext4: get rid of ppath in get_ext_path() +- ext4: add new ext4_ext_path_brelse() helper +- urma: set tpid_status after deactive tp failed +- !24146 urma: fix tpid reuse ref wrong +- ub: ub_fwctl: Modify the way ub_fwctl obtains device type and port type. +- !24145 urma: fix jfr nullptr in ubcore_delete_jfr_batch +- urma: fix tpid reuse ref wrong +- !24119 CVE-2025-10263 +- xfrm: Fix dev use-after-free in xfrm async resumption +- xfrm: hold dev ref until after transport_finish NF_HOOK +- xfrm: hold device only for the asynchronous decryption +- !24039 Fix CVE-2026-43309 +- !24111 urma: fix ubagg topo bonding device name +- nvmet-tcp: fix race between ICReq handling and queue teardown +- urma: fix jfr nullptr in ubcore_delete_jfr_batch +- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump +- net: Fix kabi breakage of struct nf_conntrack_expect +- netfilter: nf_conntrack_expect: restore helper propagation via expectation +- netfilter: ctnetlink: ignore explicit helper on new expectations +- netfilter: nf_conntrack_expect: store netns and zone in expectation +- RDMA: During rereg_mr ensure that REREG_ACCESS is compatible +- !24066 Fix CVE-2026-31453 +- urma: fix ubagg topo bonding device name +- !24108 perf: arm_pmuv3: Use BR_RETIRED for HW branch event if enabled +- config: Enable ARM64_ERRATUM_4193714 ARM64_ERRATUM_4118414 +- !24107 urma: ubcore restrict CNA-level shared-CTP to RM CTP mode only +- !24123 urma: fix solves the UAF issue in the uburma_release_comp_event +- !22893 Intel-SIG: DiamondRapids (DMR) new ISAs enabling +- !21068 Backport SST support for DMR +- urma: fix solves the UAF issue in the uburma_release_comp_event +- !24114 [OLK-6.6]net: unic: 2 bugfixes +- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU +- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU +- !24110 ub: ub_fwctl: Modify the index for retrieving port historical status in ub_fwctl. +- net: unic: Fix the DSCP-TC mapping is reset by the UNIC driver when the UNIC driver is reloaded +- net: unic: Fix the issue of the first up network port reporting the netdev_change event +- net: Fix kabi breakage of struct nf_queue_entry +- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation +- ub: ub_fwctl: Modify the index for retrieving port historical status in ub_fwctl. +- urma: ubcore restrict CNA-level shared-CTP to RM+CTP only +- !24096 urma: fix mm_struct leakage under concurrent mmu_notifier release scenarios. +- !24097 urma: fix obj_arr memory leak +- perf: arm_pmuv3: Use BR_RETIRED for HW branch event if enabled +- urma: fix obj_arr memory leak +- urma: fix mm_struct leakage in concurrent mmu_notifier release +- arm64: errata: Mitigate TLBI errata on various Arm CPUs +- arm64: cputype: Add C1-Premium definitions +- arm64: cputype: Add C1-Ultra definitions +- arm64: cputype: Add NVIDIA Olympus definitions +- xfs: remove xfs_attr_leaf_hasname +- xfs: avoid dereferencing log items after push callbacks +- xfs: save ailp before dropping the AIL lock in push callbacks +- Revert "xfs: fix a UAF when inode item push" +- urma: urma: use ctp+um to support large-scale D2D communications +- md raid: fix hang when stopping arrays with metadata through dm-raid +- tools headers x86 cpufeatures: Sync with the kernel sources +- KVM: x86: Advertise AVX10_VNNI_INT CPUID to userspace +- KVM: x86: Advertise AVX10.2 CPUID to userspace +- KVM: x86: Advertise AMX CPUIDs in subleaf 0x1E.0x1 to userspace +- KVM: x86: Advertise MOVRS CPUID to userspace +- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps +- platform/x86: ISST: Support SST-PP revision 2 +- platform/x86: ISST: Update minor version +- platform/x86: ISST: Support SST-TF revision 2 + +* Mon Jun 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-160.0.0.145.20260622.82cd6f191b97 +- !24093 ub: udma: Resolve the issue of repeated va not being recognized. +- !24046 ub: cdma: replace ummu_alloc_tdev_separated with ummu_core_alloc_separate_tdev +- !24086 urma: fix tpid memory leak +- ub: udma: Resolve the issue of repeated va not being recognized. +- !23983 riscv: traps: Add missing linux/nospec.h include +- !24088 urma: move ubagg failback req/result to user_ctl +- urma: fix tpid memory leak +- urma: move ubagg failback req/result to user_ctl +- ub: cdma: replace ummu_alloc_tdev_separated with ummu_core_alloc_separate_tdev +- riscv: traps: Add missing linux/nospec.h include + +* Fri Jun 19 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-160.0.0.145.20260619.f62b82d8268d +- !24082 urma: fix exist tpid reuse use cnt +- !24079 urma: fix ubagg failback device lookup and teardown +- !24081 urma: fix deadlock when using loopback mode +- urma: fix exist tpid reuse use cnt +- urma: fix ubagg failback device lookup and teardown +- urma: fix deadlock when using loopback mode + +* Thu Jun 18 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-160.0.0.145.20260618.6582498dfcd8 +- !21352 Backport intel_pstate OOB mode support for DMR +- !21353 Backport cstate PMU for DMR +- !24059 [OLK-6.6] CVE-2026-46331 +- net/sched: fix pedit partial COW leading to page cache corruption +- !23952 [OLK-6.6][linux-6.6.y sync] Backport 6.6.129-6.6.130 LTS conflict Patches +- !24049 urma: ubcore fix potential null pointer dereference on cnas +- urma: ubcore fix potential null pointer dereference on cnas +- ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() +- cifs: Fix busy dentry used after unmounting +- wifi: cw1200: Revert "Fix locking in error paths" +- drm/ssd130x: Fix atomic_check for disabled planes +- cifs: open files should not hold ref on superblock +- mm/kfence: disable KFENCE upon KASAN HW tags enablement +- regulator: pca9450: Make IRQ optional +- ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays +- ASoC: simple-card-utils: use __free(device_node) for device node +- ASoC: soc-core: flush delayed work before removing DAIs and widgets +- ASoC: soc-core: drop delayed_work_pending() check before flush +- wifi: cw1200: Fix locking in error paths +- drm/solomon: Fix page start when updating rectangle in page addressing mode +- drm/ssd130x: Replace .page_height field in device info with a constant +- drm/ssd130x: Store the HW buffer in the driver-private CRTC state +- drm/ssd130x: Use bool for ssd130x_deviceinfo flags +- ALSA: usb-audio: Cap the packet size pre-calculations +- perf/x86/intel/cstate: Add Diamond Rapids support +- cpufreq: intel_pstate: Add Diamond Rapids OOB mode support + +* Wed Jun 17 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-160.0.0.145.20260617.db140f117c3b +- !24035 urma: add new query information of TP +- !24041 urma: fix the incorrect reference count of tpid_list +- urma: add new query information of TP +- !24034 urma: add order_type validation for UM+CTP in import functions +- !24037 ub: udma: fix the bug in the eid update process. +- urma: fix the incorrect reference count of tpid_list +- !23876 net/hinic5: Fix high-risk interfaces in the sdk +- ub: udma: fix the bug in the eid update process. +- !24030 [OLK-6.6] Fix CVE-2026-43350 +- net/hinic5: Fix high-risk interfaces in the sdk +- urma: add order_type validation for UM+CTP in import functions +- !24019 urma: Fix the issue of missing timing logic in the delete_jfc path +- !24015 [OLK-6.6] Fix CVE-2026-46244 +- !24016 urma: fix missing lock when query tp_reuse info +- smb: client: require a full NFS mode SID before reading mode bits +- urma: Fix the issue of missing timing logic in the delete_jfc path +- !19261 sched: fix cpu check logic in soft domain +- !24020 urma: no error reported when failed to query host EID during shared-ctp +- netfilter: nft_inner: Fix IPv6 inner_thoff desync +- !23998 Fix CVE-2026-46321 +- !23996 Fix CVE-2026-46323 +- urma: no error reported when failed to query host EID during shared-ctp +- urma: fix missing lock when query tp_reuse info +- !23771 hungtask fix patch and mainline backport +- !23892 urma: support failback notification in 1:N and N:1 scenarios +- !23999 urma: ubcore fix missing topo CNA field in topology structs +- !23905 x86/kexec: Disable KCOV instrumentation after load_segments() +- !23997 urma: add multi-transport types,FLUSH_DMA opcode,device config extensions +- !23993 urma: using nlattr to query tp information +- urma: using nlattr to query tp information +- urma: add multi-transport types,FLUSH_DMA opcode,device config extensions +- urma: ubcore fix missing topo CNA field in topology structs +- tun: free page on short-frame rejection in tun_xdp_one() +- net: gro: don't merge zcopy skbs +- urma: support failback notification in 1:N and N:1 scenarios +- x86/kexec: Disable KCOV instrumentation after load_segments() +- sched: Fix kabi broken of struct sched_entity +- sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") +- sched/fair: Fix lag clamp +- sched/fair: Fix math notation errors in avg_vruntime comment +- sched: fix cpu check logic in soft domain + +* Tue Jun 16 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-160.0.0.145 +- !23995 Revert "!20376 [OLK-6.6] Support 1G hugetlb for CSV3 and other CSV3 optimizations." +- Revert "!20376 [OLK-6.6] Support 1G hugetlb for CSV3 and other CSV3 optimizations." +- !23948 KVM: arm64: Reject HDBSS enable when dirty ring is active +- !23979 iommu/ummu: Add dedicated Kconfig for GFP_HIGHUSER_MOVABLE support +- !23978 iommu/ummu: Fix the problem of the shared identity page and disable DVM +- !23935 iommu/ummu: Mask the impact of the iommu.passthrough=1 configuration +- !23871 [OLK-6.6] sched/fair: Only update stats for allowed CPUs when looking for dst group +- !23945 irqchip/gic-v3-its: Add DT cache clear count +- !23927 [OLK-6.6] ub: ubase & net: unic: 3 bugfixes +- !23966 ub:ubus: modify ub virt notify +- !20376 [OLK-6.6] Support 1G hugetlb for CSV3 and other CSV3 optimizations. +- !22855 Support 1G hugetlb for CSV3 and other CSV3 optimizations. +- iommu/ummu: Add dedicated Kconfig for GFP_HIGHUSER_MOVABLE support +- iommu/ummu: Fix the problem of the shared identity page +- iommu/ummu: Mask the impact of the iommu.passthrough=1 configuration +- iommu/ummu: Fix the adapt disable DVM issue +- net:unic:Fixed the problem of storage device hardware version error +- ub:ubase:Fixed the problem of CDMA Entity has not using USC +- ub:ubase:Fixed the problem of storage device hardware version error +- ub:ubus: modify ub virt notify +- KVM: arm64: Reject HDBSS enable when dirty ring is active +- irqchip/gic-v3-its: Add DT cache clear count +- sched/fair: Only update stats for allowed CPUs when looking for dst group +- KVM: SVM: CSV: Support 1G hugetlb for CSV3 +- crypto: ccp: Extend CSV3 CMD to support multiple SMCR regions +- x86/mm: Global reservation of CSV3 meta memory +- x86/mm: csv: Rename CSV3 CMA-related variables and functions +- x86/mm: csv: Increase the maximum value of `csv_mem_percentage` from 80 to 95 +- KVM: SVM: CSV: Enhance shared page manager for CSV3 VM +- KVM: SVM: CSV: Handle #NPF gracefully for CSV3 VM +- x86/csv: Allocate memory cyclically from different csv_cma +- crypto: ccp: Fix the update decision logic when upgrading Hygon CSV firmware +- KVM: SVM: CSV: Add KVM_CSV3_LAUNCH_FINISH_EX command +- crypto: ccp: Introduce CSV_EXT_CSV3_LFINISH_EX extension flag +- crypto: ccp: Define CSV3 LAUNCH_FINISH_EX command id +- KVM: SVM: CSV: Support 1G hugetlb for CSV3 +- crypto: ccp: Extend CSV3 CMD to support multiple SMCR regions +- x86/mm: Global reservation of CSV3 meta memory +- x86/mm: csv: Rename CSV3 CMA-related variables and functions +- x86/mm: csv: Increase the maximum value of `csv_mem_percentage` from 80 to 95 +- KVM: SVM: CSV: Enhance shared page manager for CSV3 VM +- KVM: SVM: CSV: Handle #NPF gracefully for CSV3 VM +- x86/csv: Allocate memory cyclically from different csv_cma +- crypto: ccp: Fix the update decision logic when upgrading Hygon CSV firmware +- KVM: SVM: CSV: Add KVM_CSV3_LAUNCH_FINISH_EX command +- crypto: ccp: Introduce CSV_EXT_CSV3_LFINISH_EX extension flag +- crypto: ccp: Define CSV3 LAUNCH_FINISH_EX command id + +* Tue Jun 16 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-157.0.0.144.20260616.f395d7443069 +- !23929 urma: add CNA-level shared-CTP +- !23925 urma: move topo query api from ubcore to ubagg +- !23975 urma: fix post send failure when msn cfg is different +- urma: ubcore add CNA-level shared-CTP +- !23939 urma: ubagg add GET_RJETTY and GET_SEG_CTX ioctl handlers +- !23958 ub: udma: fix issues of safe mode +- !23953 urma: fix err log to info and change query to create +- urma: move topo query api from ubcore to ubagg +- urma: fix post send failure when msn cfg is different +- urma: ubagg add GET_RJETTY and GET_SEG_CTX ioctl handlers +- !23955 urma: add multi-transport types, FLUSH_DMA opcode and rework CC algorithms +- !23940 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p2 +- ub: udma: Optimize the duplicate registration +- urma: add multi-transport types,FLUSH_DMA opcode,device config extensions +- !23960 urma: Optimize the adaptability of the ubagg NL commands +- !23957 ub: ub_fwctl: Modify TA layer to obtain WQE delay related registers. +- !23965 Fix CVE-2026-46330 +- !23921 net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) +- !23936 iommu/ummu: Improve code quality and fix potential issues +- Revert "net/smc: Introduce TCP ULP support" +- !23890 CVE-2026-46320 +- !23877 urma: Fix the issue of DFX functionality missing some header files during compilation +- !23280 KVM: arm64: Add a module param to enable/disable pv_preempted dynamically +- ub: ub_fwctl: Modify TA layer to obtain WQE delay related registers. +- urma: Optimize the adaptability of the ubagg NL commands +- urma: fix err log to info and change query to create +- iommu/ummu: Improve code quality and fix potential issues +- ub: udma: fix issues of safe mode +- !23934 iommu/ummu: Add the tect cache synchronization operation +- !23947 urma: move v2p resource query api from ubcore to ubagg +- !23833 CVE-2026-46174 +- urma: Fix the issue of DFX functionality missing some header files during compilation +- !22892 scsi: leapraid: update driver to v2.0.1.2 +- !22243 rnpm: update rnpm driver to version 1.2.0 +- !23230 drivers: Update Yunsilicon NIC drivers to version 25.12.1230.1.H580. +- urma: move v2p resource query api from ubcore to ubagg +- !21805 [OLK-6.6] ata: ahci: Fix Zhaoxin SATA LED quirk for KH-50000 +- Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req +- nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems +- wifi: libertas: don't kill URBs in interrupt context +- wifi: libertas: use USB anchors for tracking in-flight URBs +- x86/kexec: add a sanity check on previous kernel's ima kexec buffer +- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ +- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ +- Bluetooth: hci_qca: Cleanup on all setup failures +- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ +- nfc: nxp-nci: remove interrupt trigger type +- PCI: Enable ACS after configuring IOMMU for OF platforms +- !23930 urma: Optimize the adaptability of the NL commands +- wifi: libertas: fix WARNING in usb_tx_block +- !23926 urma: remove uvs_get_route_list and standardize uvs tlv formats +- !23928 urma: change the enum in ubcore_cmd.h for set_sl and genl_pid +- !23938 KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang +- !23932 ub: ub_fwctl: Correct spenlling issues in the document +- KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang +- iommu/ummu: Add the tect cache synchronization operation +- urma: Optimize the adaptability of the NL commands +- urma: remove uvs_get_route_list and standardize uvs tlv formats +- ub: ub_fwctl: Correct spenlling issues in the document +- urma: change the enum in ubcore_cmd.h for set_sl and genl_pid +- net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) +- tap: free page on error paths in tap_get_user_xdp() +- x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache +- drivers: Update Yunsilicon NIC drivers to version 25.12.1230.1.H580. +- KVM: arm64: Add a module param to enable/disable pv_preempted dynamically +- scsi: leapraid: update driver to v2.0.1.2 +- ata: ahci: Fix Zhaoxin SATA LED quirk for KH-50000 +- rnpm: update rnpm driver to version 1.2.0 + +* Mon Jun 15 2026 Ming Wang <wangming01@loongson.cn> - 6.6.0-157.0.0.144 +- LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation + +* Sun Jun 14 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-157.0.0.143.20260614.ba6ab2982f30 +- !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration +- !23907 urma: fix log error print wrong place +- !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. +- !23923 urma: refactor ubagg connect and message handling +- urma: refactor ubagg connect and message handling +- ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. +- !23696 urma: enable shared-CTP +- urma: ubcore enable shared-ctp +- urma: fix log error print wrong place +- ub: unic: separate DSCP-TC and prio-TC mapping configuration + +* Sat Jun 13 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-157.0.0.143.20260613.6e2f4a7f3c6f +- !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error +- !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes +- !23910 iommu/ummu: Fix null pointer problem during permission table expansion +- !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources +- iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error +- !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent +- !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit +- !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg +- !23855 ub:udma:fix the bug in the eid update process. +- iommu/ummu: Fix null pointer problem during permission table expansion +- !23867 urma: add set_share_topo host EID programming path +- !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 +- urma: add set_share_topo host EID programming path +- ub: udma: fix the bug in the eid update process. +- ub:ubus: Resolve the issue of msgq consuming CPU resources +- !23640 [OLK-6.6] Fix CVE-2026-46103 +- !23333 ntfs3: fix circular locking dependency in run_unpack_ex +- !23347 ksmbd: close durable scavenger races against m_fp_list lookups +- !23719 [OLK-6.6] Fix CVE-2026-31580 +- !23630 [OLK-6.6] Fix CVE-2026-31725 +- !20853 [OLK-6.6] Fix CVE-2025-39932 +- !23611 [OLK-6.6] Fix CVE-2026-43295 +- !23604 [OLK-6.6] Fix CVE-2026-43296 +- !23315 [OLK-6.6] Fix CVE-2025-71272 +- !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer +- !22397 [OLK-6.6] Fix CVE-2025-71203 +- !23713 ubcore: Add host info lookup trie for CTP reuse +- !23844 urma: add dfx for ns mode +- !23882 ub: udma: resolve the issue of false verification. +- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent +- ub: ubase: optimize activate dev request handling in +- ub: ubase: process change for querying SL through the +- !23875 ub:ubus: Add new chip information into ubus_error_table +- !23874 CVE-2026-46322 +- ub: udma: resolve the issue of false verification. +- !23868 [OLK-6.6] ub: ubase: 5 related changes +- ub:ubus: Add new chip information into ubus_error_table +- ub:ubus: ras adapter of the new chips +- urma: Add host info lookup trie for CTP reuse +- urma: add dfx for ns mode +- tun: free page on build_skb failure in tun_xdp_one() +- !23869 ub: udma: resolve issues of create ccu_jetty. +- ub: ubase: set the delay processing time for ctrlq crq to +- ub: udma: resolve issues of create ccu_jetty. +- ub: udma: set the jetty type by id +- net: unic: resolve environment panic caused by alloc page +- ASoC: nau8821: Cancel delayed work on component remove +- ASoC: nau8821: Cancel pending work before suspend +- octeon_ep: initialise control mbox tasks before using APIs +- ub: ubase: increase reset task scheduling delay to avoid +- octeon_ep: ensure dbell BADDR updation +- octeon_ep: set backpressure watermark for RX queues +- octeon_ep: disable per ring interrupts +- octeon_ep: support Octeon CN10K devices +- octeon_ep: restructured interrupt handlers +- octeon_ep: support to fetch firmware info +- ASoC: nau8821: Fixup nau8821_enable_jack_detect() +- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler +- ASoC: nau8821: Consistently clear interrupts before unmasking +- bpf: Fix bpf_xdp_store_bytes proto for read-only arg +- bpf, sockmap: Fix incorrect copied_seq calculation +- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit +- xfrm: Wait for RCU readers during policy netns exit +- most: core: fix leak on early registration failure +- most: core: fix resource leak in most_register_interface error paths +- most: remove usage of the deprecated ida_simple_xx() API +- bpf: Fix bpf_xdp_store_bytes proto for read-only arg +- MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 +- bcache: fix uninitialized closure object +- bcache: fix cached_dev.sb_bio use-after-free and crash +- can: ucan: fix devres lifetime +- ksmbd: close durable scavenger races against m_fp_list lookups +- ksmbd: validate owner of durable handle on reconnect +- ksmbd: add durable scavenger timer +- ksmbd: avoid reclaiming expired durable opens by the client +- usb: gadget: f_ecm: Fix net_device lifecycle with device_move +- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() +- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky +- net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer +- ub: ubase: adapt to the API of alloc memory of ummu +- ntfs3: fix circular locking dependency in run_unpack_ex +- net: unic: Fix JFC context domain segment fields and +- net: unic: Add statistics on abnormal cqe +- ub:ubase:anti-attack feature adaptation +- ub: ubase: Add execution statistics for the software +- ub: ubase: Add retry when ctrlq e2e msg send fail during +- riscv: Sanitize syscall table indexing under speculation +- smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) + +* Fri Jun 12 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-157.0.0.143.20260612.1ba379218f1a +- !23864 urma: add command to query TP information +- !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap +- !23859 ub: cdma: refactor naming conventions and code cleanup +- !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() +- !23814 ub:ubus: Eliminate some compilation warnings on the code review platform +- urma: add command to query TP information +- !23863 urma: fix target_reuse_tpid connect waiting times +- urma: fix target_reuse_tpid connect waiting times +- drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() +- vfio:ubus: Corrected the English errors of vfio +- ub:ubfi: Corrected the English errors of ubfi +- ub:ubus: Corrected the English errors of ubus +- ub:ubus: add module_version for udev modules +- ub:ubus: Eliminate some compilation warnings on the code review platform +- !23554 Add Hygon NB driver support and update the interface used by other driver +- ub: cdma: refactor naming conventions and code cleanup +- !23838 urma: fix tpid reuse start up link error and ref cnt +- urma: fix tpid reuse start up link error and ref cnt +- iommu/ummu: Fix TLB invalidation flow in map/unmap +- EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC +- hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp +- x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration + +* Thu Jun 11 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-157.0.0.143.20260611.6a83b25aa018 +- !23212 urma: add eid sharing mode +- urma: add eid sharing mode +- !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma +- !23773 obmm: fix vma access check for PROT_WRITE-only mappings +- obmm: fix vma access check for PROT_WRITE-only mappings +- !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type +- !23813 netconsole: avoid OOB reads, msg is not nul-terminated +- ub: cdma: fix some code errors detected by AI in the kernel cdma +- !23829 CVE-2026-31588 +- !23799 scsi/hiraid: Support new RAID features and bug fixes +- !23828 RDMA/hns: Return actual error code instead of fixed EINVAL +- !23724 urma: validate ubcore message version for compatibility +- !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device +- fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue +- KVM: x86: Use scratch field in MMIO fragment to hold small write values +- RDMA/hns: Return actual error code instead of fixed EINVAL +- RDMA/hns: Fix RoCEv1 failure due to DSCP +- urma: validate ubcore message version for compatibility +- netconsole: avoid OOB reads, msg is not nul-terminated +- scsi/hiraid: Support new RAID features and bug fixes +- urma: change the enum in ubcore_cmd.h for netlink msg_type +- urma: fix panic issue when ifconfig up/down ipourma device + +* Wed Jun 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-157.0.0.143 +- !23816 netfilter: x_tables: ensure names are nul-terminated +- !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs +- netfilter: x_tables: ensure names are nul-terminated +- !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork +- !23323 iommu/ummu: Enable separated SVA page table by default +- bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs +- !22670 [OLK-6.6] Fix CVE-2026-31607 +- !22632 [OLK-6.6] Fix CVE-2026-31606 +- !23792 urma: fix dev cap struct length by reserved +- !23725 urma: publish ipourma eid after setup +- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork +- urma: fix dev cap struct length by reserved +- !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration +- !23787 crypto: hisilicon - add backlog support +- !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently +- !23753 iommu/vt-d: Clear Present bit before tearing down context entry +- ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration +- !22947 Fix CVE-2026-43024 +- !22884 Fix CVE-2026-43107 +- !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" +- !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL +- !23634 backport cpufreq patches from linux mainline. +- crypto: hisilicon/hpre: implement full backlog support for hpre driver +- crypto: hisilicon/sec2 - restore iv for ctr mode +- crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode +- crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog +- crypto: hisilicon/zip - add backlog support for zip +- !22664 update rnpgbe driver to version 1.0.10 +- !23651 cpufreq: Documentation: fix sampling_down_factor documentation range +- !23764 Fix livepatch and kretprobe conflict warning +- !23763 virtcca inclusion: add msk_encrypted field +- ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently +- !23760 Fix CVE-2026-46243 +- bug fix for virtcca huk-based key encryption +- rethook: Use tsk->on_cpu to check task execution state +- rethook: Remove warning messages printed for finding return address of a frame. +- smb: client: reject userspace cifs.spnego descriptions +- urma: fix ipourma eid setup ordering +- iommu/vt-d: Clear Present bit before tearing down context entry +- drivers/iommu: Revise IOMMU memory reservation interface call timing +- LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" +- LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" +- LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" +- mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL +- cpufreq: Documentation: fix freq_step description +- cpufreq: Documentation: fix sampling_down_factor documentation range +- cpufreq: conservative: Simplify frequency limit handling +- cpufreq: Avoid redundant target() calls for unchanged limits +- cpufreq: Fix typo in comment +- arm64: smp: Do not mark secondary CPUs possible under nosmp +- iommu/ummu: Enable separated SVA page table by default +- rnpgbe: update rnpgbe driver to version 1.0.10 +- netfilter: nf_tables: reject immediate NF_QUEUE verdict +- xfrm: account XFRMA_IF_ID in aevent size calculation +- usbip: validate number_of_packets in usbip_pack_ret_submit() +- usb: gadget: f_hid: don't call cdev_init while cdev in use + +* Tue Jun 09 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-156.0.0.142.20260609.c1fb4bef6ed7 +- !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 +- !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support +- !23743 urma: remove the redundant update of the tx_ring in error branch +- !23738 virtcca huk-based data key interface +- !22962 Fix CVE-2026-43089 +- !22990 netfilter: ctnetlink: ensure safe access to master conntrack +- virtcca huk-based key encryption +- !23686 CVE-2026-46065 +- irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support +- Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" +- !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() +- !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry +- urma: remove the redundant update of the tx_ring in error branch +- !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS +- !23632 Fix CVE-2026-43465 +- !23688 urma: fix cm payload and async bind callback +- !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock +- !23692 ub: udma: modify the UDMA document. +- !23667 udma: optimizing the scheme for separating page +- iommu/vt-d: Clear Present bit before tearing down PASID entry +- spi: spidev: fix lock inversion between spi_lock and buf_lock +- mm: make SPLIT_PTE_PTLOCKS depend on SMP +- powerpc/8xx: document and enforce that split PT locks are not used +- mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options +- ub: udma: modify the UDMA document. +- ub: udma: optimizing the scheme for separating page +- urma: fix cm payload and async bind callback +- fbdev: defio: Remove unused variable 'fbdefio' to fix build warning +- fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info +- fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info +- fbdev/deferred-io: Always call get_page() for framebuffer pages +- fbdev/deferred-io: Clean up pageref on lastclose +- x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 +- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ +- xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() +- netfilter: ctnetlink: ensure safe access to master conntrack +- xfrm_user: fix info leak in build_mapping() + +* Sun Jun 07 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-156.0.0.142.20260607.d00c77839db7 +- !23712 Fix CVE-2026-43198 +- !23722 8021q: use RCU for egress QoS mappings +- !23412 Fix CVE-2026-43088 +- !23706 vhost: move vdpa group bound check to vhost_vdpa +- 8021q: delete cleared egress QoS mappings +- 8021q: use RCU for egress QoS mappings +- tcp: restore kABI for syn_recv_sock() backport +- !23419 Fix CVE-2026-43073 +- vhost: move vdpa group bound check to vhost_vdpa +- tcp: fix potential race in tcp_v6_syn_recv_sock() +- x86-64: rename misleadingly named '__copy_user_nocache()' function +- net: af_key: zero aligned sockaddr tail in PF_KEY exports + +* Sat Jun 06 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-156.0.0.142.20260606.59733ebaf9a9 +- !23227 Fix CVE-2026-45850 +- !23672 drm/amd/display: Fix dc_link NULL handling in HPD init +- !23537 Fix CVE-2026-31709 +- !23520 Fix CVE-2026-46242 +- !23370 mm/page_alloc: clear page->private in free_pages_prepare() +- !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs +- !23687 urma: fix unimport jetty function call and remove debug logs +- !23606 Fix CVE-2026-43216 +- !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT +- KVM: SVM: Add missing save/restore handling of LBR MSRs +- urma: fix unimport jetty function call and remove debug logs +- !23417 Fix CVE-2026-43059 +- !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support +- irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support +- !23402 mm: fix CMA folio mempolicy and migration +- drm/amd/display: Fix dc_link NULL handling in HPD init +- KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT +- !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp +- !23636 urma: fix well-known jetty create/delete hook up with main ue eid event +- !23428 dlm: validate length in dlm_search_rsb_tree +- !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() +- urma: enhance the reliability of the kernel-mode wk_jetty retransmission +- mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() +- urma: fix well-known jetty create/delete hook up with main ue eid event +- mm: fix CMA folio migration problems +- mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass +- net: Drop the lock in skb_may_tx_timestamp() +- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl +- smb: client: validate the whole DACL before rewriting it in cifsacl +- eventpoll: fix ep_remove struct eventpoll / struct file UAF +- eventpoll: move epi_fget() up +- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() +- eventpoll: kill __ep_remove() +- eventpoll: split __ep_remove() +- eventpoll: use hlist_is_singular_node() in __ep_remove() +- dlm: validate length in dlm_search_rsb_tree +- Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers +- mm/page_alloc: clear page->private in free_pages_prepare() +- ipvs: skip ipv6 extension headers for csum checks + +* Fri Jun 05 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-156.0.0.142.20260605.571f65a01cef +- !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes +- !23237 Fix CVE-2026-45917 +- !22921 [OLK-6.6] Fix CVE-2026-23361 +- !22672 [OLK-6.6] Fix CVE-2026-23262 +- !22639 [OLK-6.6] Fix CVE-2026-23239 +- !22332 [OLK-6.6] Fix CVE-2026-23214 +- !22350 [OLK-6.6] Fix CVE-2026-23213 +- !20711 [OLK-6.6] Fix CVE-2025-71109 +- !23499 RDMA/hns: Fix log flood after cmd_mbox failure +- !23530 CVEs +- !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 +- !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time +- urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time +- !23500 fix CVE-2026-45893 +- !23424 Fix HWPSIRT-2026-70484 +- !23484 urma: fix uburma ioctl error handling for connection +- !23048 Fix CVE-2026-43101 +- hwrng: core - use RCU and work_struct to fix race condition +- hwrng: core - Allow runtime disabling of the HW RNG +- RDMA/mlx5: Fix UMR hang in LAG error state unload +- x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 +- apparmor: Fix & Optimize table creation from possibly unaligned memory +- AppArmor: Allow apparmor to handle unaligned dfa tables +- xfrm: esp: restore combined single-frag length gate +- urma: fix uburma ioctl error handling for connection +- RDMA/hns: Fix log flood after cmd_mbox failure +- ipvs: do not keep dest_dst if dev is going down +- net: ioam6: fix OOB and missing lock +- ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() +- net: unic: Fix the issue of system suspend when the fe +- ub: ubase: Resolved the issue of printing logs in spin +- ub: ubase: Ctrlq code optimization +- net: unic: Added logging related to the Jetty context +- ub: ubase: Adjust the macro definition for querying chip +- PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry +- gve: Fix stats report corruption on queue count change +- espintcp: Fix race condition in espintcp_close() +- btrfs: reject new transactions if the fs is fully read-only +- drm/amdgpu: ensure no_hw_access is visible before MMIO +- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset +- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits + +* Thu Jun 04 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-156.0.0.142 +- !23508 v2 bpf: Remove smap argument from bpf_selem_free() +- !23457 v2 bpf mainline +- !23442 ub: udma&ubase: add get tp list function. +- !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change +- ub: udma: add get tp list function. +- !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA +- !23416 urma: implement kernel-space get tp list with hash table. +- bpf: Remove smap argument from bpf_selem_free() +- urma: implement kernel-space get tp list with hash table. +- !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister +- drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change +- !23229 obmm: add feature-based enable control +- !23362 CVE-2026-43201 +- !23351 Fix CVE-2026-43292 +- !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches +- !23228 obmm: fix VMA access for ptrace/GDB on export regions +- selftests/bpf: Add test for stale pkt range after scalar arithmetic +- bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken +- obmm: add feature-based enable control +- !23374 urma: increase topo max node limit to 1024 +- !23403 urma: add v2p function in kernel for dfx such as urma_admin +- netfs: Fix potential uninitialised var in netfs_extract_user_iter() +- net/rds: reset op_nents when zerocopy page pin fails +- mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker +- mptcp: pm: ADD_ADDR rtx: fix potential data-race +- spi: sifive: fix controller deregistration +- spi: sifive: Simplify clock handling with devm_clk_get_enabled() +- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 +- spi: st-ssc4: fix controller deregistration +- spi: st-ssc4: switch to use modern name +- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() +- f2fs: fix false alarm of lockdep on cp_global_sem lock +- f2fs: fix incorrect file address mapping when inline inode is unwritten +- mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 +- mptcp: pm: prio: skip closed subflows +- mptcp: fix rx timestamp corruption on fastopen +- mptcp: drop __mptcp_fastopen_gen_msk_ackseq() +- RDMA/mana: Validate rx_hash_key_len +- btrfs: fix missing last_unlink_trans update when removing a directory +- btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() +- btrfs: use inode already stored in local variable at btrfs_rmdir() +- smb: client: Use FullSessionKey for AES-256 encryption key derivation +- drm/v3d: Reject empty multisync extension to prevent infinite loop +- eventfs: Use list_add_tail_rcu() for SRCU-protected children list +- pmdomain: core: Fix detach procedure for virtual devices in genpd +- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init +- drm/gma500/oaktrail_lvds: fix hang on init failure +- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup +- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() +- drm/i915: skip __i915_request_skip() for already signaled requests +- iommu/vt-d: Disable DMAR for Intel Q35 IGFX +- libceph: handle rbtree insertion error in decode_choose_args() +- libceph: Fix potential out-of-bounds access in crush_decode() +- libceph: Fix potential null-ptr-deref in decode_choose_args() +- libceph: Fix potential out-of-bounds access in osdmap_decode() +- netfs: fix error handling in netfs_extract_user_iter() +- powerpc/warp: Fix error handling in pika_dtm_thread +- io-wq: check that the predecessor is hashed in io_wq_remove_pending() +- ceph: fix a buffer leak in __ceph_setxattr() +- ALSA: usb-audio: Bound MIDI endpoint descriptor scans +- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans +- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats +- ASoC: SOF: Intel: hda: Fix NULL pointer dereference +- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio +- ASoC: SOF: Intel: hda-dai: remove dspless special case +- KVM: x86: Fix Xen hypercall tracepoint argument assignment +- KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic +- KVM: Reject wrapped offset in kvm_reset_dirty_gfn() +- audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV +- net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled +- netfilter: nft_ct: fix missing expect put in obj eval +- audit: fix incorrect inheritable capability in CAPSET records +- netfilter: nf_conntrack_sip: get helper before allocating expectation +- workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path +- i40e: Cleanup PTP pins on probe failure +- crypto: af_alg - Cap AEAD AD length to 0x80000000 +- netconsole: avoid out-of-bounds access on empty string in trim_newline() +- net/sched: sch_pie: annotate more data-races in pie_dump_stats() +- ksmbd: validate response sizes in ipc_validate_msg() +- net: bcmgenet: fix leaking free_bds +- net: bcmgenet: Initialize u64 stats seq counter +- crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx +- ntfs: ->d_compare() must not block +- net/sched: cls_flower: revert unintended changes +- sfc: fix error code in efx_devlink_info_running_versions() +- net: tls: fix strparser anchor skb leak on offload RX setup failure +- ice: fix NULL pointer dereference in ice_reset_all_vfs() +- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler +- iavf: wait for PF confirmation before removing VLAN filters +- iavf: stop removing VLAN filters from PF on interface down +- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING +- bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner +- drm/amd/display: Read EDID from VBIOS embedded panel info +- drm/amd/display: Allow DCE link encoder without AUX registers +- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup +- ALSA: hda/conexant: Fix missing error check for jack detection +- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 +- ALSA: hda/conexant: fix some typos +- netconsole: propagate device name truncation in dev_name_store() +- net: netconsole: move newline trimming to function +- net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) +- bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() +- ipv6: rename and move ip6_dst_lookup_tunnel() +- ipv4: add new arguments to udp_tunnel_dst_lookup() +- ipv4: remove "proto" argument from udp_tunnel_dst_lookup() +- ipv4: rename and move ip_route_output_tunnel() +- sctp: discard stale INIT after handshake completion +- netfilter: skip recording stale or retransmitted INIT +- ASoC: codecs: ab8500: Fix casting of private data +- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring +- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring +- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring +- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring +- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring +- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring +- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings +- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings +- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings +- net: phy: dp83869: fix setting CLK_O_SEL field. +- net: mctp i2c: check length before marking flow active +- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams +- neigh: let neigh_xmit take skb ownership +- neighbour: add RCU protection to neigh_tables[] +- net/sched: taprio: fix NULL pointer dereference in class dump +- NFC: trf7970a: Ignore antenna noise when checking for RF field +- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit +- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() +- vrf: Fix a potential NPD when removing a port from a VRF +- net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() +- net/sched: sch_choke: annotate data-races in choke_dump_stats() +- net/sched: netem: check for negative latency and jitter +- net/sched: netem: fix slot delay calculation overflow +- net/sched: netem: validate slot configuration +- net/sched: netem: only reseed PRNG when seed is explicitly provided +- net/sched: netem: fix queue limit check to include reordered packets +- net/sched: netem: fix probability gaps in 4-state loss model +- netdevsim: zero initialize struct iphdr in dummy sk_buff +- cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() +- arm64/scs: Fix potential sign extension issue of advance_loc4 +- drm/sysfb: ofdrm: fix PCI device reference leaks +- spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ +- netfilter: nf_conntrack_sip: don't use simple_strtoul +- netfilter: xt_policy: fix strict mode inbound policy matching +- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) +- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated +- drm/amdgpu: fix spelling typos +- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG +- nvme-pci: fix missed admin queue sq doorbell write +- netfilter: arp_tables: fix IEEE1394 ARP payload parsing +- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers +- btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() +- mailbox: mailbox-test: make data_ready a per-instance variable +- mailbox: mailbox-test: initialize struct earlier +- mailbox: mailbox-test: don't free the reused channel +- mailbox: add sanity check for channel array +- cgroup/rdma: fix integer overflow in rdmacg_try_charge() +- mailbox: mailbox-test: free channels on probe error +- fbdev: offb: fix PCI device reference leak on probe failure +- rtc: abx80x: Disable alarm feature if no interrupt attached +- fs/adfs: validate nzones in adfs_validate_bblk() +- vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() +- tipc: fix double-free in tipc_buf_append() +- nfp: fix swapped arguments in nfp_encode_basic_qdr() calls +- net: dsa: realtek: rtl8365mb: fix mode mask calculation +- net/sched: sch_sfb: annotate data-races in sfb_dump_stats() +- net/sched: sch_red: annotate data-races in red_dump_stats() +- net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() +- net/sched: sch_pie: annotate data-races in pie_dump_stats() +- net_sched: sch_hhf: annotate data-races in hhf_dump_stats() +- net/rds: zero per-item info buffer before handing it to visitors +- ksmbd: scope conn->binding slowpath to bound sessions only +- ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open +- ksmbd: destroy async_ida in ksmbd_conn_free() +- ksmbd: add support for supplementary groups +- ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() +- ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() +- arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number +- slip: bound decode() reads against the compressed packet length +- slip: reject VJ receive packets on instances with no rstate array +- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check +- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching +- ipvs: fix MTU check for GSO packets in tunnel mode +- netfilter: xtables: restrict several matches to inet family +- netfilter: conntrack: remove sprintf usage +- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO +- netfilter: nft_osf: restrict it to ipv4 +- openvswitch: cap upcall PID array size and pre-size vport replies +- sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks +- ipv6: fix possible UAF in icmpv6_rcv() +- e1000e: Unroll PTP in probe error handling +- i40e: don't advertise IFF_SUPP_NOFCS +- ice: fix double-free of tx_buf skb +- ice: Remove jumbo_remove step from TX path +- tcp: annotate data-races around tp->plb_rehash +- tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) +- tcp: annotate data-races around tp->dsack_dups +- tcp: annotate data-races around tp->bytes_retrans +- tcp: annotate data-races around tp->bytes_sent +- tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans +- net/sched: taprio: fix use-after-free in advance_sched() on schedule switch +- nexthop: fix IPv6 route referencing IPv4 nexthop +- net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys +- macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF +- arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT +- arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT +- arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT +- PCMCIA: Fix garbled log messages for KERN_CONT +- arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT +- arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT +- arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT +- arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT +- arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT +- crypto: ccp - copy IV using skcipher ivsize +- crypto: sa2ul - Fix AEAD fallback algorithm names +- drm/i915/wm: Verify the correct plane DDB entry +- drm/i915: Loop over all active pipes in intel_mbus_dbox_update +- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() +- drm/i915: Simplify watermark state checker calling convention +- drm/i915: Constify watermark state checker +- f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() +- f2fs: Use sysfs_emit_at() to simplify code +- clk: visconti: pll: initialize clk_init_data to zero +- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() +- clk: qcom: dispcc-sc7180: Add missing MDSS resets +- dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets +- clk: xgene: Fix mapping leak in xgene_pllclk_init() +- clk: qoriq: avoid format string warning +- clk: imx8mq: Correct the CSI PHY sels +- clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() +- clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() +- clk: qcom: dispcc-sm8250: Enable parents for pixel clocks +- clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk +- clk: qcom: gcc-sc8180x: Use retention for PCIe power domains +- clk: qcom: gcc-sc8180x: Use retention for USB power domains +- clk: qcom: gcc-sc8180x: Add missing GDSCs +- dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs +- scsi: target: core: Fix integer overflow in UNMAP bounds check +- clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers +- scsi: sg: Resolve soft lockup issue when opening /dev/sgX +- scsi: sg: Fix sysctl sg-big-buff register during sg_init() +- scsi: sg: Make sg_sysfs_class constant +- clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source +- RDMA/core: Prefer NLA_NUL_STRING +- platform/x86: dell-wmi-sysman: bound enumeration string aggregation +- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() +- fs/ntfs3: terminate the cached volume label after UTF-8 conversion +- nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() +- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() +- platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup +- tty: hvc_iucv: fix off-by-one in number of supported devices +- leds: lgm-sso: Remove duplicate assignments for priv->mmap +- platform/surface: surfacepro3_button: Drop wakeup source on remove +- backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() +- dev_printk: add new dev_err_probe() helpers +- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status +- perf util: Kill die() prototype, dead for a long time +- ipmi: ssif_bmc: change log level to dbg in irq callback +- ipmi: ssif_bmc: fix message desynchronization after truncated response +- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure +- perf expr: Return -EINVAL for syntax error in expr__find_ids() +- perf lock: Fix option value type in parse_max_stack +- pinctrl: abx500: Fix type of 'argument' variable +- perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace +- perf branch: Avoid incrementing NULL +- pinctrl: cy8c95x0: Avoid returning positive values to user space +- pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() +- pinctrl: cy8c95x0: remove duplicate error message +- pinctrl: pinctrl-pic32: Fix resource leak +- bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT +- bpf: allow UTF-8 literals in bpf_bprintf_prepare() +- bpf: Fix precedence bug in convert_bpf_ld_abs alignment check +- bpf, sockmap: Take state lock for af_unix iter +- bpf, sockmap: Fix af_unix null-ptr-deref in proto update +- bpf, sockmap: Fix af_unix iter deadlock +- HID: usbhid: fix deadlock in hid_post_reset() +- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob +- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions +- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path +- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask +- mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation +- mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook +- mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook +- mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations +- dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range +- mtd: physmap_of_gemini: Fix disabled pinctrl state check +- HID: asus: do not abort probe when not necessary +- HID: asus: make asus_resume adhere to linux kernel coding standards +- ima: check return value of crypto_shash_final() in boot aggregate +- soundwire: cadence: Clear message complete before signaling waiting thread +- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() +- soundwire: bus: demote UNATTACHED state warnings to dev_dbg() +- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function +- ocfs2: validate group add input before caching +- ocfs2: validate bg_bits during freefrag scan +- ocfs2: fix listxattr handling when the buffer is full +- ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended +- arm64/xor: fix conflicting attributes for xor_block_template +- ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX +- arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP +- soc: qcom: aoss: compare against normalized cooling state +- soc: qcom: llcc: fix v1 SB syndrome register offset +- ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison +- ocfs2/dlm: validate qr_numregions in dlm_match_regions() +- unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure +- soc/tegra: cbb: Set ERD on resume for err interrupt +- arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual +- arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot +- arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl +- arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes +- arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes +- arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller +- arm64: dts: qcom: sm8550: Fix GIC_ITS range length +- arm64: dts: qcom: sm8450: Fix GIC_ITS range length +- soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available +- soc: qcom: ocmem: register reasons for probe deferrals +- soc: qcom: ocmem: use scoped device node handling to simplify error paths +- soc: qcom: ocmem: make the core clock optional +- arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight +- arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value +- arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count +- arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count +- arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) +- arm64: dts: imx8-apalis: Fix LEDs name collision +- memory: tegra30-emc: Fix dll_change check +- memory: tegra124-emc: Fix dll_change check +- ARM: dts: mediatek: mt7623: fix efuse fallback compatible +- ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine +- efi/capsule-loader: fix incorrect sizeof in phys array reallocation +- gfs2: prevent NULL pointer dereference during unmount +- gfs2: add some missing log locking +- quota: Fix race of dquot_scan_active() with quota deactivation +- ktest: Run POST_KTEST hooks on failure and cancellation +- ktest: Honor empty per-test option overrides +- ktest: Avoid undef warning when WARNINGS_FILE is unset +- gfs2: Call unlock_new_inode before d_instantiate +- crypto: jitterentropy - replace long-held spinlock with mutex +- dm cache: fix missing return in invalidate_committed's error path +- ALSA: sc6000: Keep the programmed board state in card-private data +- ALSA: sc6000: Use standard print API +- spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback +- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well +- PCI: tegra194: Use DWC IP core version +- PCI: tegra194: Allow system suspend when the Endpoint link is not up +- PCI: tegra194: Disable direct speed change for Endpoint mode +- PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" +- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode +- PCI: tegra194: Don't force the device into the D0 state before L2 +- PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() +- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down +- PCI: tegra194: Increase LTSSM poll time on surprise link down +- PCI: tegra194: Fix polling delay for L2 state +- ASoC: SOF: compress: return the configured codec from get_params +- ALSA: scarlett2: Add missing sentinel initializer field +- selftest: memcg: skip memcg_sock test if address family not supported +- Documentation: fix a hugetlbfs reservation statement +- selftests/mm: skip migration tests if NUMA is unavailable +- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found +- PCI: Enable AtomicOps only if Root Port supports them +- ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] +- crypto: qat - use swab32 macro +- ASoC: qcom: qdsp6: topology: check widget type before accessing data +- ASoC: fsl_easrc: Change the type for iec958 channel status controls +- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() +- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() +- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() +- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() +- ASoC: fsl_micfil: Fix event generation in micfil_quality_set() +- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() +- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() +- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() +- ASoC: fsl_micfil: Add access property for "VAD Detected" +- pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() +- pmdomain: ti: omap_prm: Fix a reference leak on device node +- drm/msm/a6xx: Use barriers while updating HFI Q headers +- drm/msm/shrinker: Fix can_block() logic +- drm/msm/a6xx: Fix HLSQ register dumping +- ASoC: SOF: Intel: hda: Place check before dereference +- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') +- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board +- drm/amd/pm/ci: Fill DW8 fields from SMC +- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels +- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 +- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock +- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs +- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled +- ALSA: core: Validate compress device numbers without dynamic minors +- drm/panel: simple: Correct G190EAN01 prepare timing +- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first +- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 +- drm/msm/dsi: add the missing parameter description +- drm/msm/dpu: fix mismatch between power and frequency +- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo +- drm/amdgpu/gfx10: look at the right prop for gfx queue priority +- crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs +- crypto: atmel - Use unregister_{aeads,ahashes,skciphers} +- crypto: atmel - Remove cfb and ofb +- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break +- dm init: ensure device probing has finished in dm-mod.waitfor= +- drm/amdgpu: Add default case in DVI mode validation +- drm/sun4i: Fix resource leaks +- spi: fsl-qspi: Use reinit_completion() for repeated operations +- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check +- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs +- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() +- dm log: fix out-of-bounds write due to region_count overflow +- dm cache metadata: fix memory leak on metadata abort retry +- platform/chrome: chromeos_tbmc: Drop wakeup source on remove +- dm cache: fix dirty mapping checking in passthrough mode switching +- dm cache: support shrinking the origin device +- dm cache: fix concurrent write failure in passthrough mode +- dm cache policy smq: fix missing locks in invalidating cache blocks +- dm cache: fix write hang in passthrough mode +- dm cache: fix write path cache coherency in passthrough mode +- dm cache: fix null-deref with concurrent writes in passthrough mode +- ASoC: sti: use managed regmap_field allocations +- ASoC: sti: Return errors from regmap_field_alloc() +- drm/sun4i: backend: fix error pointer dereference +- drm/komeda: fix integer overflow in AFBC framebuffer size check +- net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master +- sctp: fix missing encap_port propagation for GSO fragments +- net: phy: qcom: at803x: Use the correct bit to disable extended next page +- net: phy: move at803x PHY driver to dedicated directory +- net: phy: add Rust Asix PHY driver +- net: phy: aquantia: move to separate directory +- bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb +- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() +- net/mlx5e: Fix features not applied during netdev registration +- dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 +- net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ +- net: ipa: Fix programming of QTIME_TIMESTAMP_CFG +- ppp: require CAP_NET_ADMIN in target netns for unattached ioctls +- net/rds: Restrict use of RDS/IB to the initial network namespace +- net/rds: Optimize rds_ib_laddr_check +- net/sched: act_ct: Only release RCU read lock after ct_ft +- net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf +- 6pack: propagage new tty types +- netfilter: nft_fwd_netdev: check ttl/hl before forwarding +- netfilter: xt_socket: enable defrag after all other checks +- net: bcmgenet: fix racing timeout handler +- net: bcmgenet: switch to use 64bit statistics +- net: bcmgenet: support reclaiming unsent Tx packets +- net: bcmgenet: move DESC_INDEX flow to ring 0 +- net: bcmgenet: add bcmgenet_has_* helpers +- net: bcmgenet: Remove custom ndo_poll_controller() +- net: bcmgenet: fix off-by-one in bcmgenet_put_txcb +- arm64: kexec: Remove duplicate allocation for trans_pgd +- ACPI: AGDI: fix missing newline in error message +- bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() +- wifi: brcmfmac: Fix error pointer dereference +- macvlan: annotate data-races around port->bc_queue_len_used +- selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 +- selftests/powerpc: Re-order *FLAGS to follow lib.mk +- powerpc/crash: fix backup region offset update to elfcorehdr +- r8152: fix incorrect register write to USB_UPHY_XTAL +- wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() +- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() +- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event +- arm64: cpufeature: Make PMUVer and PerfMon unsigned +- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor +- wifi: mt76: mt7915: fix use_cts_prot support +- wifi: mt76: mt7615: fix use_cts_prot support +- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() +- module: Fix freeing of charp module parameters when CONFIG_SYSFS=n +- params: Replace __modinit with __init_or_module +- s390/bpf: Zero-extend bpf prog return values and kfunc arguments +- dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n +- dpaa2: add independent dependencies for FSL_DPAA2_SWITCH +- bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap +- bpf: Add CHECKSUM_COMPLETE to bpf test progs +- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet +- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() +- firmware: dmi: Correct an indexing error in dmi.h +- locking: Fix rwlock support in <linux/spinlock_up.h> +- hrtimer: Reduce trace noise in hrtimer_start() +- hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() +- hrtimers: Update the return type of enqueue_hrtimer() +- irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter +- s390/cio: use generic driver_override infrastructure +- s390/cio: convert sprintf()/snprintf() to sysfs_emit() +- s390/cio: make sch->lock spinlock pointer a member +- debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() +- debugfs: check for NULL pointer in debugfs_create_str() +- thermal/drivers/spear: Fix error condition for reading st,thermal-flags +- devres: fix missing node debug info in devm_krealloc() +- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver +- ACPI: x86: cmos_rtc: Clean up address space handler driver +- blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() +- nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() +- loop: fix partition scan race between udev and loop_reread_partitions() +- drbd: Balance RCU calls in drbd_adm_dump_devices() +- fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START +- blk-cgroup: wait for blkcg cleanup before initializing new disk +- smb: client: use kzalloc to zero-initialize security descriptor buffer +- mtd: spi-nor: sst: Fix SST write failure +- drm/amdgpu/vcn4: Avoid overflow on msg bound check +- drm/amdgpu/vcn3: Avoid overflow on msg bound check +- vsock/virtio: fix length and offset in tap skb for split packets +- vsock: fix buffer size clamping order +- KVM: arm64: Wake-up from WFI when iqrchip is in userspace +- usb: dwc3: Move GUID programming after PHY initialization +- tracing/probes: Limit size of event probe to 3K +- btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak +- pwm: imx-tpm: Count the number of enabled channels in probe +- mtd: spi-nor: sst: Fix write enable before AAI sequence +- mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` +- ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger +- mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values +- usb: typec: tcpm: reset internal port states on soft reset AMS +- mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values +- mm/damon/core: implement damon_kdamond_pid() +- mm/damon/core: disallow time-quota setting zero esz +- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() +- fbcon: Avoid OOB font access if console rotation fails +- spi: microchip-core-qspi: fix controller deregistration +- spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() +- mm/hugetlb_cma: round up per_node before logging it +- spi: uniphier: fix controller deregistration +- spi: uniphier: Simplify clock handling with devm_clk_get_enabled() +- spi: uniphier: switch to use modern name +- spi: tegra20-sflash: fix controller deregistration +- spi: tegra114: fix controller deregistration +- spi: sun6i: fix controller deregistration +- spi: sun6i: switch to use modern name +- spi: zynq-qspi: fix controller deregistration +- spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() +- spi: zynq-qspi: switch to use modern name +- spi: ti-qspi: fix controller deregistration +- spi: spi-ti-qspi: switch to use modern name +- spi: spi-ti-qspi: Convert to platform remove callback returning void +- spi: sun4i: fix controller deregistration +- spi: sun4i: switch to use modern name +- spi: syncuacer: fix controller deregistration +- spi: synquacer: switch to use modern name +- Bluetooth: hci_conn: fix potential UAF in create_big_sync +- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete +- xfrm: ah: account for ESN high bits in async callbacks +- net: ipv6: stop checking crypto_ahash_alignmask +- net: ipv4: stop checking crypto_ahash_alignmask +- net: stmmac: Prevent NULL deref when RX memory exhausted +- net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() +- net: stmmac: avoid shadowing global buf_sz +- crypto: caam - guard HMAC key hex dumps in hash_digest_key +- printk: add print_hex_dump_devel() +- wifi: rtl8xxxu: fix potential use of uninitialized value +- hfsplus: fix held lock freed on hfsplus_fill_super() +- hfsplus: fix uninit-value by validating catalog record size +- xfs: fix a resource leak in xfs_alloc_buftarg() +- mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs +- udf: fix partition descriptor append bookkeeping +- firmware: google: framebuffer: Do not unregister platform device +- spi: fix resource leaks on device setup failure +- net: qrtr: ns: Limit the total number of nodes +- net: qrtr: ns: Limit the maximum number of lookups +- net: qrtr: ns: Limit the maximum server registration per node +- net: bridge: use a stable FDB dst snapshot in RCU readers +- net: mctp: fix don't require received header reserved bits to be zero +- RDMA/mana_ib: Disable RX steering on RSS QP destroy +- sched: Use u64 for bandwidth ratio calculations +- block: relax pgmap check in bio_add_page for compatible zone device pages +- PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete +- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling +- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor +- wifi: mt76: connac: introduce helper for mt7925 chipset +- lib: test_hmm: evict device pages on file close to avoid use-after-free +- wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() +- batman-adv: bla: put backbone reference on failed claim hash insert +- batman-adv: bla: only purge non-released claims +- batman-adv: bla: prevent use-after-free when deleting claims +- batman-adv: stop caching unowned originator pointers in BAT IV +- batman-adv: reject new tp_meter sessions during teardown +- batman-adv: fix integer overflow on buff_pos +- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL +- drm/amdgpu/pm: align Hawaii mclk workaround with radeon +- drm/amdgpu/pm: add missing revision check for CI +- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission +- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ +- drm/amdgpu: zero-initialize GART table on allocation +- drm/radeon: add missing revision check for CI +- drm/amdkfd: validate SVM ioctl nattr against buffer size +- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() +- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg +- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg +- drm/amdgpu/vce: Prevent partial address patches +- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB +- drm/amdgpu: Add bounds checking to ib_{get,set}_value +- drm/amdkfd: Add upper bound check for num_of_nodes +- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure +- spi: cadence: fix unclocked access on unbind +- spi: cadence: fix controller deregistration +- spi: mpc52xx: fix use-after-free on unbind +- spi: orion: fix clock imbalance on registration failure +- spi: orion: fix runtime pm leak on unbind +- spi: imx: fix runtime pm leak on probe deferral +- spi: img-spfi: fix controller deregistration +- spi: rspi: fix controller deregistration +- spi: sprd: fix controller deregistration +- spi: coldfire-qspi: fix controller deregistration +- spi: bcmbca-hsspi: fix controller deregistration +- spi: fsl: fix controller deregistration +- spi: sh-hspi: fix controller deregistration +- spi: mtk-nor: fix controller deregistration +- spi: omap2-mcspi: fix controller deregistration +- spi: fsl-espi: fix controller deregistration +- spi: s3c64xx: fix controller deregistration +- spi: dln2: fix controller deregistration +- media: omap3isp: drop the use count of v4l2 pipeline +- media: i2c: ov08d10: fix image vertical start setting +- media: staging: imx: request mbus_config in csi_start +- media: i2c: imx412: Assert reset GPIO during probe +- media: dib8000: avoid division by 0 in dib8000_set_dds() +- media: pci: zoran: fix potential memory leak in zoran_probe() +- platform/x86: hp-wmi: Ignore backlight and FnLock events +- media: saa7164: add ioremap return checks and cleanups +- spi: at91-usart: fix controller deregistration +- spi: qup: fix controller deregistration +- spi: lantiq-ssc: fix controller deregistration +- regulator: bd9571mwv: fix OF node reference imbalance +- regulator: act8945a: fix OF node reference imbalance +- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap +- regulator: rk808: fix OF node reference imbalance +- media: rc: streamzap: Error handling in probe +- media: rc: xbox_remote: heed DMA restrictions +- regulator: max77650: fix OF node reference imbalance +- regulator: mt6357: fix OF node reference imbalance +- staging: media: atomisp: Disallow all private IOCTLs +- spi: atmel: fix controller deregistration +- spi: bcm63xx: fix controller deregistration +- media: i2c: ov8856: free control handler on error in ov8856_init_controls() +- media: uvcvideo: Enable VB2_DMABUF for metadata stream +- HID: playstation: Clamp num_touch_reports +- exit: Sleep at TASK_IDLE when waiting for application core dump +- LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup +- LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() +- KVM: arm64: Fix initialisation order in __pkvm_init_finalise() +- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value +- f2fs: fix node_cnt race between extent node destroy and writeback +- f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() +- f2fs: fix fiemap boundary handling when read extent cache is incomplete +- f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() +- mptcp: fix scheduling with atomic in timestamp sockopt +- mptcp: sockopt: set timestamp flags on subflow socket, not msk +- mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure +- mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure +- mptcp: fastclose msk when linger time is 0 +- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path +- RDMA/rxe: Reject unknown opcodes before ICRC processing +- RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads +- RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() +- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() +- power: supply: max17042: avoid overflow when determining health +- PCI/AER: Stop ruling out unbound devices as error source +- PCI/AER: Clear only error bits in PCIe Device Status +- KVM: x86: check for nEPT/nNPT in slow flush hypercalls +- smb: client: validate dacloffset before building DACL pointers +- smb/client: fix out-of-bounds read in symlink_data() +- smb/client: fix out-of-bounds read in smb2_compound_op() +- s390/debug: Reject zero-length input in debug_input_flush_fn() +- RDMA/hns: Fix unlocked call to hns_roce_qp_remove() +- nvme-apple: drop invalid put of admin queue reference count +- md/raid10: fix divide-by-zero in setup_geo() with zero far_copies +- libceph: Fix slab-out-of-bounds access in auth message processing +- lib/scatterlist: fix temp buffer in extract_user_to_sg() +- lib/scatterlist: fix length calculations in extract_kvec_to_sg +- isofs: validate block number from NFS file handle in isofs_export_iget +- isofs: validate Rock Ridge CE continuation extent against volume size +- dm-verity-fec: correctly reject too-small hash devices +- dm-verity-fec: correctly reject too-small FEC devices +- dm: fix a buffer overflow in ioctl processing +- dm: don't report warning when doing deferred remove +- dm-thin: fix metadata refcount underflow +- ASoC: qcom: q6apm: remove child devices when apm is removed +- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens +- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop +- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error +- ASoC: fsl_easrc: fix comment typo +- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table +- cpuidle: powerpc: avoid double clear when breaking snooze +- clk: microchip: mpfs-ccc: fix out of bounds access during output registration +- clk: imx: imx8-acm: fix flags for acm clocks +- spi: topcliff-pch: fix use-after-free on unbind +- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp +- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata +- udf: reject descriptors with oversized CRC length +- ibmveth: Disable GSO for packets with small MSS +- hv_sock: fix ARM64 support +- gpio: of: clear OF_POPULATED on hog nodes in remove path +- extcon: ptn5150: handle pending IRQ events during system resume +- cifs: change_conf needs to be called for session setup +- cifs: abort open_cached_dir if we don't request leases +- block: add pgmap check to biovec_phys_mergeable +- af_unix: Reject SIOCATMARK on non-stream sockets +- hwmon: (corsair-psu) Close HID device on probe errors +- clk: rk808: fix OF node reference imbalance +- hwmon: (ltc2992) Fix u32 overflow in power read path +- hwmon: (ltc2992) Clamp threshold writes to hardware range +- parisc: Fix IRQ leak in LASI driver +- net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler +- net/rds: handle zerocopy send cleanup before the message is queued +- ip6_gre: Use cached t->net in ip6erspan_changelink(). +- net: libwx: fix VF illegal register access +- sound: ua101: fix division by zero at probe +- net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo +- fanotify: fix false positive on permission events +- staging: vme_user: fix root device leak on init failure +- spi: s3c64xx: fix NULL-deref on driver unbind +- spi: zynqmp-gqspi: fix controller deregistration +- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() +- Bluetooth: virtio_bt: validate rx pkt_type header length +- Bluetooth: virtio_bt: clamp rx length before skb_put +- selinux: prune /sys/fs/selinux/disable +- selinux: shrink critical section in sel_write_load() +- selinux: don't reserve xattr slot when we won't fill it +- ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() +- xfrm: provide message size for XFRM_MSG_MAPPING +- powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o +- ALSA: firewire-tascam: Do not drop unread control events +- USB: serial: option: add Telit Cinterion LE910Cx compositions +- USB: omap_udc: DMA: Don't enable burst 4 mode +- ALSA: usb-audio: Fix UAC3 cluster descriptor size check +- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() +- ALSA: usb-audio: midi2: Restart output URBs on resume +- wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task +- wifi: b43: enforce bounds check on firmware key index in b43_rx() +- wifi: mac80211: remove station if connection prep fails +- wifi: ath5k: do not access array OOB +- wifi: mac80211: drop stray 'static' from fast-RX rx_result +- wifi: b43legacy: enforce bounds check on firmware key index in RX path +- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work +- wifi: mt76: mt7921: fix a potential clc buffer length underflow +- exit: prevent preemption of oopsing TASK_DEAD task +- selftests/bpf: validate fake register spill/fill precision backtracking logic +- selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros +- selftests/bpf: validate zero preservation for sub-slot loads +- selftests/bpf: validate STACK_ZERO is preserved on subreg spill +- net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked +- KVM: SVM: check validity of VMCB controls when returning from SMM +- flow_dissector: do not dissect PPPoE PFC frames +- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN +- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets +- rxrpc: Fix potential UAF after skb_unshare() failure +- spi: meson-spicc: Fix double-put in remove path +- drm/amd/display: Do not skip unrelated mode changes in DSC validation +- spi: rockchip: fix controller deregistration +- ASoC: SOF: Don't allow pointer operations on unconfigured streams +- iommufd: Fix a race with concurrent allocation and unmap +- ACPI: video: force native backlight on HP OMEN 16 (8A44) +- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug +- ACPI: scan: Use acpi_dev_put() in object add error paths +- fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free +- ipmi:si: Return state to normal if message allocation fails +- ipmi: Check event message buffer response for bad data +- ipmi: Add limits to event and receive message requests +- scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() +- netfilter: reject zero shift in nft_bitwise +- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels +- drm/amdgpu: fix zero-size GDS range init on RDNA4 +- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows +- seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode +- scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails +- rtmutex: Use waiter::task instead of current in remove_waiter() +- ntfs3: fix integer overflow in run_unpack() volume boundary check +- ntfs3: add buffer boundary checks to run_unpack() +- ktest: Fix the month in the name of the failure directory +- IB/core: Fix zero dmac race in neighbor resolution +- dm mirror: fix integer overflow in create_dirty_log() +- crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path +- crypto: atmel-tdes - fix DMA sync direction +- crypto: ccree - fix a memory leak in cc_mac_digest() +- crypto: hisilicon - Fix dma_unmap_single() direction +- crypto: atmel-ecc - Release client on allocation failure +- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup +- crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit +- can: ucan: fix devres lifetime +- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers +- taskstats: set version in TGID exit notifications +- tcp: call sk_data_ready() after listener migration +- inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails +- md/raid5: validate payload size before accessing journal metadata +- ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() +- ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access +- mtd: docg3: fix use-after-free in docg3_release() +- mtd: docg3: Convert to platform remove callback returning void +- KVM: nSVM: Add missing consistency check for nCR3 validity +- KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS +- KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT +- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT +- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) +- KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN +- KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT +- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode +- KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts +- KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 +- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state +- KVM: x86: Defer non-architectural deliver of exception payload to userspace read +- userfaultfd: allow registration of ranges below mmap_min_addr +- mm/damon/core: use time_in_range_open() for damos quota window start +- rtc: ntxec: fix OF node reference imbalance +- tpm: tpm_tis: stop transmit if retries are exhausted +- tpm: tpm_tis: add error logging for data transfer +- crypto: talitos - rename first/last to first_desc/last_desc +- crypto: talitos - fix SEC1 32k ahash request limitation +- arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins +- mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration +- mmc: block: use single block write in retry +- power: supply: axp288_charger: Do not cancel work before initializing it +- LoongArch: Show CPU vulnerabilites correctly +- tpm: avoid -Wunused-but-set-variable +- extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' +- libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() +- ipv4: icmp: validate reply type before using icmp_pointers +- RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv +- drm/arcpgu: fix device node leak +- net: ks8851: Avoid excess softirq scheduling +- net: ks8851: Reinstate disabling of BHs around IRQ handler +- net/smc: avoid early lgr access in smc_clc_wait_msg +- net: rds: fix MR cleanup on copy error +- net: qrtr: ns: Free the node during ctrl_cmd_bye() +- tools/accounting: handle truncated taskstats netlink messages +- rxrpc: Fix re-decryption of RESPONSE packets +- rxrpc: Fix rxkad crypto unalignment handling +- rxrpc: Fix memory leaks in rxkad_verify_response() +- iio: adc: ad7768-1: fix one-shot mode data acquisition +- io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE +- io_uring/poll: fix signed comparison in io_poll_get_ownership() +- iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() +- io_uring/timeout: check unused sqe fields +- rbd: fix null-ptr-deref when device_add_disk() fails +- selftests/mqueue: Fix incorrectly named file +- remoteproc: xlnx: Only access buffer information if IPI is buffered +- parisc: _llseek syscall is only available for 32-bit userspace +- nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set +- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 +- mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused +- md/raid10: fix deadlock with check operation and nowait requests +- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes +- ALSA: ctxfi: Add fallback to default RSR for S/PDIF +- ALSA: aoa: i2sbus: fix OF node lifetime handling +- ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() +- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() +- lib/ts_kmp: fix integer overflow in pattern length calculation +- PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown +- media: mtk-jpeg: fix use-after-free in release path due to uncancelled work +- net: strparser: fix skb_head leak in strp_abort_strp() +- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() +- media: amphion: Fix race between m2m job_abort and device_run +- of: unittest: fix use-after-free in testdrv_probe() +- spi: imx: fix use-after-free on unbind +- um: drivers: call kernel_strrchr() explicitly in cow_user.c +- wifi: rtw88: check for PCI upstream bridge existence +- zram: do not forget to endio for partial discard requests +- LoongArch: Add spectre boundry for syscall dispatch table +- ocfs2: split transactions in dio completion to avoid credit exhaustion +- regset: use kvzalloc() for regset_get_alloc() +- drm/amdgpu: Limit BO list entry count to prevent resource exhaustion +- drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array +- padata: Remove comment for reorder_work +- firmware: google: framebuffer: Do not mark framebuffer as busy +- ibmasm: fix heap over-read in ibmasm_send_i2o_message() +- ibmasm: fix OOB reads in command_file_write due to missing size checks +- misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() +- leds: qcom-lpg: Check for array overflow when selecting the high resolution +- ALSA: usb-audio: Evaluate packsize caps at the right place +- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change +- usb: chipidea: otg: not wait vbus drop if use role_switch +- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() +- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch +- ALSA: usb-audio: Avoid false E-MU sample-rate notifications +- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES +- Buffer overflow in drivers/xen/sys-hypervisor.c +- md/raid1: fix data lost for writemostly rdev +- rxrpc: Fix missing validation of ticket length in non-XDR key preparsing +- crypto: testmgr - Hide ENOENT errors better +- crypto: testmgr - Hide ENOENT errors +- net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() +- f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() +- fuse: quiet down complaints in fuse_conn_limit_write +- fuse: Check for large folio with SPLICE_F_MOVE +- fuse: reject oversized dirents in page cache +- f2fs: fix to avoid memory leak in f2fs_rename() +- fs/ntfs3: validate rec->used in journal-replay file record check +- rxrpc: only handle RESPONSE during service challenge +- rxrpc: Fix anonymous key handling +- scripts/dtc: Remove unused dts_version in dtc-lexer.l +- Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" +- ocfs2: fix out-of-bounds write in ocfs2_write_end_inline +- ocfs2: validate inline data i_size during inode read +- ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() +- rxrpc: Fix key quota calculation for multitoken keys +- scripts: generate_rust_analyzer.py: define scripts +- net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers +- PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown +- Revert "perf unwind-libdw: Fix invalid reference counts" +- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() +- media: vidtv: fix pass-by-value structs causing MSAN warnings +- nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map +- media: as102: fix to not free memory after the device is registered in as102_usb_probe() +- ALSA: 6fire: fix use-after-free on disconnect +- media: em28xx: fix use-after-free in em28xx_v4l2_open() +- media: mediatek: vcodec: fix use-after-free in encoder release path +- media: vidtv: fix nfeeds state corruption on start_streaming failure +- mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() +- mm/kasan: fix double free for kasan pXds +- ASoC: qcom: q6apm: move component registration to unmanaged version +- checkpatch: add support for Assisted-by tag +- nfc: nci: complete pending data exchange on device close +- net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() +- KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() +- btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() +- ocfs2: handle invalid dinode in ocfs2_group_extend +- ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY +- ocfs2: fix possible deadlock between unlink and dio_end_io_write +- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections +- Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race +- USB: serial: option: add Telit Cinterion FN990A MBIM composition +- staging: sm750fb: fix division by zero in ps_to_hz() +- wifi: rtw88: fix device leak on probe failure +- scripts: generate_rust_analyzer.py: avoid FD leak +- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO +- ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc +- ksmbd: require 3 sub-authorities before reading sub_auth[2] +- ksmbd: validate EaNameLength in smb2_get_ea() +- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers +- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() +- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() +- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO +- ALSA: fireworks: bound device-supplied status before string array lookup +- drm/vc4: platform_get_irq_byname() returns an int +- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler +- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() +- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() +- i2c: s3c24xx: check the size of the SMBUS message before using it +- nfc: llcp: add missing return after LLCP_CLOSED checks +- drm/i915/psr: Do not use pipe_src as borders for SU area +- objtool: Remove max symbol name length limitation +- ALSA: usb-audio: Improve Focusrite sample rate filtering +- gpio: tegra: fix irq_release_resources calling enable instead of disable +- l2tp: Drop large packets with UDP encap +- net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ +- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator +- ipvs: fix NULL deref in ip_vs_add_service error path +- selftests: net: bridge_vlan_mcast: wait for h1 before querier check +- xsk: validate MTU against usable frame size on bind +- xsk: fix XDP_UMEM_SG_FLAG issues +- xsk: respect tailroom for ZC setups +- xsk: tighten UMEM headroom validation to account for tailroom and min frame +- e1000: check return value of e1000_read_eeprom +- dt-bindings: net: Fix Tegra234 MGBE PTP clock +- net: stmmac: Fix PTP ref clock for Tegra234 +- nfc: s3fwrn5: allocate rx skb before consuming bytes +- net: lapbether: handle NETDEV_PRE_TYPE_CHANGE +- eventpoll: defer struct eventpoll free to RCU grace period +- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock +- drm/vc4: Fix a memory leak in hang state error path +- drm/vc4: Fix memory leak of BO array in hang state +- drm/vc4: Release runtime PM reference after binding V3D +- PCI: hv: Set default NUMA node to 0 for devices without affinity info +- arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency +- soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching +- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J +- wifi: brcmfmac: validate bsscfg indices in IF events +- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 +- HID: roccat: fix use-after-free in roccat_report_event +- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 +- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 +- platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug +- pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) +- ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx +- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath +- ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex +- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list +- wifi: wl1251: validate packet IDs before indexing tx_frames +- ALSA: hda/realtek: add quirk for Framework F111:000F +- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry +- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx +- can: mcp251x: add error handling for power enable in open and resume +- ASoC: SOF: topology: reject invalid vendor array size in token parser +- ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF +- ALSA: asihpi: avoid write overflow check warning +- media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() +- ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC +- ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk +- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA +- RDMA/irdma: Fix double free related to rereg_user_mr +- Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" +- rxrpc: Fix missing error checks for rxkad encryption/decryption failure +- rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) +- rxrpc: fix reference count leak in rxrpc_server_keyring() +- rxrpc: reject undecryptable rxkad response tickets +- rxrpc: Only put the call ref if one was acquired +- rxrpc: Fix key reference count leak from call->key +- rxrpc: Fix call removal to use RCU safe deletion +- net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() +- net: stmmac: fix integer underflow in chain mode +- net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure +- pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled +- net/mlx5: Update the list of the PCI supported devices +- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat +- batman-adv: hold claim backbone gateways by reference +- net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() +- batman-adv: reject oversized global TT response buffers +- nfc: pn533: allocate rx skb before consuming bytes +- arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges +- arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity +- arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V +- Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" +- wifi: brcmsmac: Fix dma_free_coherent() size +- Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" +- usb: gadget: f_hid: move list and spinlock inits from bind to alloc +- virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN +- MIPS: mm: Rewrite TLB uniquification for the hidden bit feature +- MIPS: mm: Suppress TLB uniquification on EHINV hardware +- MIPS: Always record SEGBITS in cpu_data.vmbits +- Input: uinput - take event lock when submitting FF request "event" +- mptcp: fix slab-use-after-free in __inet_lookup_established +- net: rfkill: prevent unlimited numbers of rfkill events from being created +- wifi: rt2x00usb: fix devres lifetime +- net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta +- MPTCP: fix lock class name family in pm_nl_create_listen_socket +- dmaengine: fsl-edma: fix channel parameter config for fixed channel requests +- dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() +- x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() +- net: mana: fix use-after-free in add_adev() error path +- net: macb: Move devm_{free,request}_irq() out of spin lock area +- iio: imu: inv_icm42600: fix odr switch when turning buffer off +- wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free +- usb: gadget: f_uac1_legacy: validate control request size +- usb: gadget: f_rndis: Protect RNDIS options with mutex +- usb: gadget: f_subset: Fix unbalanced refcnt in geth_free +- usb: gadget: uvc: fix NULL pointer dereference during unbind race +- usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop +- btrfs: do not free data reservation in fallback from inline due to -ENOSPC +- btrfs: fix the qgroup data free range for inline data extents +- usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer +- USB: dummy-hcd: Fix interrupt synchronization error +- USB: dummy-hcd: Fix locking/synchronization error +- thunderbolt: Fix property read in nhi_wake_supported() +- misc: fastrpc: possible double-free of cctx->remote_heap +- thermal: core: Fix thermal zone device registration error path +- gpio: mxc: map Both Edge pad wakeup to Rising Edge +- net: ftgmac100: fix ring allocation unwind on open failure +- counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member +- counter: rz-mtu3-cnt: prevent counter from being toggled multiple times +- nvmem: imx: assign nvmem_cell_info::raw_len +- dt-bindings: connector: add pd-disable dependency +- comedi: me4000: Fix potential overrun of firmware buffer +- comedi: me_daq: Fix potential overrun of firmware buffer +- comedi: ni_atmio16d: Fix invalid clean-up after failed attach +- comedi: Reinit dev->spinlock between attachments to low-level drivers +- comedi: dt2815: add hardware detection to prevent crash +- cdc-acm: new quirk for EPSON HMD +- usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() +- usb: ehci-brcm: fix sleep during atomic +- usb: usbtmc: Flush anchored URBs in usbtmc_release +- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive +- iio: gyro: mpu3050: Fix out-of-sequence free_irq() +- iio: gyro: mpu3050: Move iio_device_register() to correct location +- iio: gyro: mpu3050: Fix irq resource leak +- iio: gyro: mpu3050: Fix incorrect free_irq() variable +- iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only +- iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() +- iio: light: vcnl4035: fix scan buffer on big-endian +- iio: dac: ad5770r: fix error return in ad5770r_read_raw() +- iio: accel: fix ADXL355 temperature signature value +- Input: xpad - add support for Razer Wolverine V3 Pro +- Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode +- Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table +- Input: synaptics-rmi4 - fix a locking bug in an error path +- iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() +- drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP +- drm/ast: dp501: Fix initialization of SCU2C +- iio: adc: ti-adc161s626: fix buffer read on big-endian +- mips: mm: Allocate tlb_vpn array atomically +- hwmon: (occ) Fix division by zero in occ_show_power_1() +- MIPS: Fix the GCC version check for `__multi3' workaround +- ALSA: ctxfi: Fix missing SPDIFI1 index handling +- ALSA: caiaq: fix stack out-of-bounds read in init_card +- USB: serial: option: add MeiG Smart SRM825WN +- wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation +- riscv: kgdb: fix several debug register assignment bugs +- mips: ralink: update CPU clock index +- hwmon: (occ) Fix missing newline in occ_show_extended() +- hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() +- dt-bindings: gpio: fix microchip #interrupt-cells +- hwmon: (pxe1610) Check return value of page-select write in probe +- accel/qaic: Handle DBC deactivation if the owner went away +- iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one +- net: hsr: fix VLAN add unwind on slave errors +- net/x25: Fix overflow when accumulating packets +- net/x25: Fix potential double free of skb +- net/mlx5: Avoid "No data available" when FW version queries fail +- net: macb: properly unregister fixed rate clocks +- net: macb: fix clk handling on PCI glue driver removal +- bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). +- rds: ib: reject FRMR registration before IB connection is established +- Bluetooth: SCO: fix race conditions in sco_sock_connect() +- Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate +- net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec +- NFC: pn533: bound the UART receive buffer +- net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak +- ipv6: prevent possible UaF in addrconf_permanent_addr() +- ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure +- tg3: Fix race for querying speed/duplex +- net/ipv6: ioam6: prevent schema length wraparound in trace fill +- net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak +- net: fec: fix the PTP periodic output sysfs interface +- crypto: caam - fix overflow on long hmac keys +- crypto: caam - fix DMA corruption on long hmac keys +- wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session +- wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation +- wifi: ath11k: skip status ring entry processing +- dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning +- spi: geni-qcom: Check DMA interrupts early in ISR +- btrfs: reject root items with drop_progress and zero drop_level +- i2c: tegra: Don't mark devices with pins as IRQ safe +- objtool: Fix Clang jump table detection +- tg3: replace placeholder MAC address with device property +- btrfs: don't take device_list_mutex when querying zone info +- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq +- arm64/scs: Fix handling of advance_loc4 +- Revert "rust: pin-init: add references to previously initialized fields" +- Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" +- dmaengine: idxd: Fix freeing the allocated ida too late +- btrfs: fix lost error when running device stats on multiple devices fs +- btrfs: fix super block offset in error message in btrfs_validate_super() +- dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA +- dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction +- dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA +- dmaengine: xilinx: xilinx_dma: Fix dma_device directions +- dmaengine: xilinx: xdma: Fix regmap init error handling +- dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. +- phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() +- erofs: fix "BUG: Bad page state in z_erofs_do_read_page" +- mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] +- mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode +- mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode +- rust: pin-init: internal: init: document load-bearing fact of field accessors +- rust: pin-init: add references to previously initialized fields +- tracing: Fix potential deadlock in cpu hotplug with osnoise +- tracing: Switch trace_osnoise.c code over to use guard() and __free() +- ksmbd: fix memory leaks and NULL deref in smb2_lock() +- ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() +- powerpc64/bpf: do not increment tailcall count when prog is NULL +- arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off +- ext4: always drain queued discard work in ext4_mb_release() +- ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths +- ext4: fix the might_sleep() warnings in kvfree() +- ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() +- ext4: make recently_deleted() properly work with lazy itable initialization +- ext4: fix fsync(2) for nojournal mode +- ext4: fix stale xarray tags after writeback +- ext4: fix journal credit check when setting fscrypt context +- xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 +- xfs: stop reclaim before pushing AIL during unmount +- LoongArch: Workaround LS2K/LS7A GPU DMA hang bug +- dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock +- dmaengine: sh: rz-dmac: Protect the driver specific lists +- irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment +- jbd2: gracefully abort on checkpointing state corruptions +- net: macb: Use dev_consume_skb_any() to free TX SKBs +- scsi: ses: Handle positive SCSI error from ses_recv_diag() +- scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() +- alarmtimer: Fix argument order in alarm_timer_forward() +- s390/entry: Scrub r12 register on kernel entry +- hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() +- hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature +- hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes +- KVM: arm64: Discard PC update state on vcpu reset +- platform/x86: ISST: Correct locked bit width +- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() +- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload +- ALSA: firewire-lib: fix uninitialized local variable +- ksmbd: do not expire session on binding failure +- ksmbd: fix potencial OOB in get_file_all_info() for compound requests +- ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() +- s390/barrier: Make array_index_mask_nospec() __always_inline +- s390/syscalls: Add spectre boundary for syscall dispatch table +- spi: spi-fsl-lpspi: fix teardown order issue (UAF) +- ASoC: adau1372: Fix clock leak on PLL lock failure +- ASoC: adau1372: Fix unchecked clk_prepare_enable() return value +- sysctl: fix uninitialized variable in proc_do_large_bitmap +- hwmon: (adm1177) fix sysfs ABI violation and current unit conversion +- ASoC: Intel: catpt: Fix the device initialization +- spi: sn-f-ospi: Fix resource leak in f_ospi_probe() +- PM: hibernate: Drain trailing zero pages on userspace restore +- PM: hibernate: Don't ignore return from set_memory_ro() +- drm/i915/gmbus: fix spurious timeout on 512-byte burst reads +- scsi: scsi_transport_sas: Fix the maximum channel scanning issue +- RDMA/irdma: Return EINVAL for invalid arp index error +- RDMA/irdma: Fix deadlock during netdev reset with active connections +- RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() +- RDMA/irdma: Clean up unnecessary dereference of event->cm_node +- RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() +- RDMA/irdma: Update ibqp state to error if QP is already in error state +- RDMA/irdma: Initialize free_qp completion before using it +- RDMA/rw: Fall back to direct SGE on MR pool exhaustion +- regmap: Synchronize cache for the page selector +- Bluetooth: btusb: clamp SCO altsetting table indices +- Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock +- Bluetooth: hci_sync: Remove remaining dependencies of hci_request +- Bluetooth: Remove 3 repeated macro definitions +- Bluetooth: L2CAP: Fix send LE flow credits in ACL link +- dma-mapping: add missing `inline` for `dma_free_attrs` +- net: enetc: fix the output issue of 'ethtool --show-ring' +- ice: use ice_update_eth_stats() for representor stats +- platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen +- rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size +- net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer +- nfc: nci: fix circular locking dependency in nci_close_device +- ionic: fix persistent MAC address override on PF +- pinctrl: mediatek: common: Fix probe failure for devices without EINT +- Bluetooth: hci_ll: Fix firmware leak on error path +- can: statistics: add missing atomic access in hot path +- dma: swiotlb: add KMSAN annotations to swiotlb_bounce() +- xfrm: call xdo_dev_state_delete during state update +- spi: intel-pci: Add support for Nova Lake mobile SPI flash +- usb: core: new quirk to handle devices with zero configurations +- objtool: Handle Clang RSP musical chairs +- ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 +- ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk +- btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create +- dma-buf: Include ioctl.h in UAPI header +- ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() +- ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() +- HID: asus: add xg mobile 2023 external hardware support +- HID: mcp2221: cancel last I2C command on read error +- net: usb: r8152: add TRENDnet TUC-ET2G +- HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 +- platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 +- platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 +- nvme-fabrics: use kfree_sensitive() for DHCHAP secrets +- nvme-pci: cap queue creation to used queues +- platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list +- HID: asus: avoid memory leak in asus_report_fixup() +- sh: platform_early: remove pdev->driver_override check +- hwmon: (axi-fan-control) Use device firmware agnostic API +- cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled +- tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure +- lib/bootconfig: check xbc_init_node() return in override path +- ksmbd: fix use-after-free in durable v2 replay of active file handles +- ksmbd: fix use-after-free of share_conf in compound request +- drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() +- mtd: rawnand: brcmnand: skip DMA during panic write +- mtd: rawnand: serialize lock/unlock against other NAND operations +- i2c: cp2615: fix serial string NULL-deref at probe +- i2c: cp2615: replace deprecated strncpy with strscpy +- i2c: pxa: defer reset on Armada 3700 when recovery is used +- i2c: fsi: Fix a potential leak in fsi_i2c_probe() +- USB: serial: f81232: fix incomplete serial port generation +- drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug +- hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() +- hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value +- net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths +- net: mvpp2: guard flow control update with global_tx_fc in buffer switching +- netfilter: bpf: defer hook memory release until rcu readers are done +- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle +- net: macb: fix uninitialized rx_fs_lock +- wifi: mac80211: fix NULL deref in mesh_matches_local() +- iavf: fix VLAN filter lost on add/delete race +- igc: fix missing update of skb->tail in igc_xmit_frame() +- net: usb: aqc111: Do not perform PM inside suspend callback +- sched: idle: Consolidate the handling of two special cases +- net: bcmgenet: increase WoL poll timeout +- netfilter: xt_time: use unsigned int for monthday bit shift +- netfilter: nft_ct: drop pending enqueued packets on removal +- net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect +- firmware: arm_scpi: Fix device_node reference leak in probe path +- wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down +- soc: fsl: qbman: fix race condition in qman_destroy_fq +- cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() +- btrfs: tree-checker: fix misleading root drop_level error message +- btrfs: log new dentries when logging parent dir of a conflicting inode +- drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} +- drm/amdgpu: apply state adjust rules to some additional HAINAN vairants +- drm/radeon: apply state adjust rules to some additional HAINAN vairants +- drm/amdgpu/mmhub3.0: add bounds checking for cid +- drm/amdgpu/mmhub3.0.2: add bounds checking for cid +- drm/amdgpu/mmhub3.0.1: add bounds checking for cid +- drm/amdgpu/mmhub2.3: add bounds checking for cid +- drm/amdgpu/mmhub2.0: add bounds checking for cid +- drm/amdgpu/gmc9.0: add bounds checking for cid +- serial: uartlite: fix PM runtime usage count underflow on probe +- serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY +- serial: 8250_pci: add support for the AX99100 +- iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry +- mtd: Avoid boot crash in RedBoot partition table parser +- mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() +- mtd: rawnand: pl353: make sure optimal timings are applied +- pmdomain: bcm: bcm2835-power: Increase ASB control timeout +- mmc: sdhci: fix timing selection for 1-bit bus width +- mmc: sdhci-pci-gli: fix GL9750 DMA write corruption +- batman-adv: avoid OGM aggregation when skb tailroom is insufficient +- iio: light: bh1780: fix PM runtime leak on error path +- btrfs: fix transaction abort on file creation due to name hash collision +- btrfs: fix transaction abort on set received ioctl due to item overflow +- btrfs: fix transaction abort when snapshotting received subvolumes +- kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() +- kprobes: Remove unneeded goto +- ksmbd: unset conn->binding on failed binding request +- Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() +- parisc: Flush correct cache in cacheflush() syscall +- net: macb: fix use-after-free access to PTP clock +- NFC: nxp-nci: allow GPIOs to sleep +- LoongArch: Give more information if kmem access failed +- s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute +- s390/stackleak: Fix __stackleak_poison() inline assembly constraint +- s390/xor: Fix xor_xc_2() inline assembly constraints +- mptcp: pm: in-kernel: always set ID as avail when rm endp +- rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access +- drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free +- drm/exynos: vidi: fix to avoid directly dereferencing user pointer +- drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() +- drm/amdgpu: Add basic validation for RAS header +- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() +- drm/amd/display: Add pixel_clock to amd_pp_display_configuration +- btrfs: do not strictly require dirty metadata threshold for metadata writepages +- rxrpc: Fix data-race warning and potential load/store tearing +- x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler +- x86/sev: Harden #VC instruction emulation somewhat +- dm-verity: disable recursive forward error correction +- rxrpc: Fix recvmsg() unconditional requeue +- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() +- btrfs: fix NULL dereference on root when tracing inode eviction +- arm64: mm: Don't remap pgtables for allocate vs populate +- arm64: mm: Don't remap pgtables per-cont(pte|pmd) block +- net/tcp-md5: Fix MAC comparison to be constant-time +- ksmbd: Compare MACs in constant time +- smb: client: Compare MACs in constant time +- xfs: ensure dquot item is deleted from AIL only after log shutdown +- xfs: fix integer overflow in bmap intent sort comparator +- crypto: atmel-sha204a - Fix OOM ->tfm_count leak +- drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output +- drm/msm: Fix dma_free_attrs() buffer size +- ksmbd: Don't log keys in SMB3 signing and encryption key generation +- KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids +- usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling +- can: gs_usb: gs_can_open(): always configure bitrates before starting device +- kbuild: Leave objtool binary around with 'make clean' +- mptcp: pm: avoid sending RM_ADDR over same subflow +- drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink +- gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL +- x86/sev: Allow IBPB-on-Entry feature for SNP guests +- platform/x86: hp-bioscfg: Support allocations of larger data +- ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths +- gve: defer interrupt enabling until NAPI registration +- drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD +- i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor +- i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort +- i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors +- iio: imu: inv_icm42600: fix odr switch to the same value +- iio: gyro: mpu3050-i2c: fix pm_runtime error handling +- iio: gyro: mpu3050-core: fix pm_runtime error handling +- iio: buffer: Fix wait_queue not being removed +- iio: chemical: bme680: Fix measurement wait duration calculation +- iio: potentiometer: mcp4131: fix double application of wiper shift +- iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() +- iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() +- iio: frequency: adf4377: Fix duplicated soft reset mask +- iio: dac: ds4424: reject -128 RAW value +- btrfs: abort transaction on failure to update root in the received subvol ioctl +- smb: client: fix iface port assignment in parse_server_interfaces +- smb: client: fix in-place encryption corruption in SMB2_write() +- lib/bootconfig: check bounds before writing in __xbc_open_brace() +- lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() +- lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error +- s390/dasd: Copy detected format information to secondary device +- s390/dasd: Move quiesce state with pprc swap +- xfs: fix undersized l_iclog_roundoff values +- cifs: make default value of retrans as zero +- tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G +- drm/i915: Fix potential overflow of shmem scatterlist length +- drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding +- drm/amd: Set num IP blocks to 0 if discovery fails +- drm/amdgpu: Fix use-after-free race in VM acquire +- net: ethernet: arc: emac: quiesce interrupts before requesting IRQ +- net: ncsi: fix skb leak in error paths +- ksmbd: fix use-after-free by using call_rcu() for oplock_info +- smb: server: fix use-after-free in smb2_open() +- ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() +- pmdomain: bcm: bcm2835-power: Fix broken reset status read +- parisc: Check kernel mapping earlier at bootup +- parisc: Fix initial page table creation for boot +- hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read +- parisc: Increase initial mapping to 64 MB with KALLSYMS +- batman-adv: Avoid double-rtnl_lock ELP metric worker +- tracing: Fix syscall events activation by ensuring refcount hits zero +- ice: fix retry for AQ command 0x06EE +- net: mana: Ring doorbell at 4 CQ wraparounds +- staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie +- ixgbevf: fix link setup issue +- ice: reintroduce retry mechanism for indirect AQ +- irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports +- device property: Allow secondary lookup in fwnode_get_next_child_node() +- drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used +- drm/bridge: samsung-dsim: Fix memory leak in error path +- Revert "tcpm: allow looking for role_sw device in the main node" +- scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend +- i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach +- libceph: admit message frames only in CEPH_CON_S_OPEN state +- libceph: Use u32 for non-negative values in ceph_monmap_decode() +- libceph: reject preamble if control segment is empty +- tipc: fix divide-by-zero in tipc_sk_filter_connect() +- ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start +- mmc: core: Avoid bitfield RMW for claim/retune flags +- mm/kfence: disable KFENCE upon KASAN HW tags enablement +- mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() +- mm/tracing: rss_stat: ensure curr is false from kthread context +- usb: image: mdc800: kill download URB on timeout +- usb: mdc800: handle signal and read racing +- usb: renesas_usbhs: fix use-after-free in ISR during device removal +- usb: roles: get usb role switch from parent only for usb-b-connector +- usb: cdc-acm: Restore CAP_BRK functionnality to CH343 +- usb: core: don't power off roothub PHYs if phy_set_mode() fails +- usb: misc: uss720: properly clean up reference in uss720_probe() +- usb: dwc3: pci: add support for the Intel Nova Lake -H +- usb: yurex: fix race in probe +- usb: xhci: Fix memory leak in xhci_disable_slot() +- USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed +- usb/core/quirks: Add Huawei ME906S-device to wakeup quirk +- USB: add QUIRK_NO_BOS for video capture several devices +- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC +- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA +- net: usb: lan78xx: skip LTM configuration for LAN7850 +- net: usb: lan78xx: fix TX byte statistics for small packets +- net: usb: lan78xx: fix silent drop of packets with checksum errors +- ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces +- ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() +- cgroup: fix race between task migration and iteration +- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" +- usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() +- octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status +- octeontx2-af: devlink health: use retained error fmsg API +- octeontx2-af: devlink: fix NIX RAS reporter recovery condition +- net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled +- ASoC: detect empty DMI strings +- ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition +- ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() +- i40e: fix src IP mask checks and memcpy argument names in cloud filter +- nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set +- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() +- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path +- netfilter: x_tables: guard option walkers against 1-byte tail reads +- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() +- amd-xgbe: prevent CRC errors during RX adaptation with AN disabled +- amd-xgbe: fix link status handling in xgbe_rx_adaptation +- mctp: route: hold key->lock in mctp_flow_prepare_output() +- can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value +- mctp: i2c: fix skb memory leak in receive path +- serial: caif: hold tty->link reference in ldisc_open and ser_release +- net: sfp: improve Huawei MA5671a fixup +- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick +- net: sfp: improve Nokia GPON sfp fixup +- net: sfp: re-implement ignoring the hardware TX_FAULT signal +- net/mlx5: IFC updates for disabled host PF +- bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states +- drm/msm/dsi: fix pclk rate calculation for bonded dsi +- drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations +- net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets +- xprtrdma: Decrement re_receiving on the early exit paths +- smb/server: Fix another refcount leak in smb2_open() +- powerpc: 83xx: km83xx: Fix keymile vendor prefix +- remoteproc: mediatek: Unprepare SCP clock during system suspend +- remoteproc: sysmon: Correct subsys_name_len type in QMI request +- powerpc/uaccess: Fix inline assembly for clang build on PPC32 +- ALSA: usb-audio: Check max frame size for implicit feedback mode, too +- ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 +- scsi: ufs: core: Fix shift out of bounds when MAXQ=32 +- scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() +- ASoC: cs42l43: Report insert for exotic peripherals +- ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table +- scsi: ses: Fix devices attaching to different hosts +- ACPI: OSI: Add DMI quirk for Acer Aspire One D255 +- wifi: mac80211: set default WMM parameters on all links +- scsi: mpi3mr: Add NULL checks when resetting request and reply queues +- ACPI: PM: Save NVS memory on Lenovo G70-35 +- net: tcp: accept old ack during closing +- tracing: Add NULL pointer check to trigger_data_free() +- selftest/arm64: Fix sve2p1_sigill() to hwcap test +- i40e: use xdp.frame_sz as XDP RxQ info frag_size +- i40e: fix registering XDP RxQ info +- net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() +- net: stmmac: Fix error handling in VLAN add and delete paths +- nfc: rawsock: cancel tx_work before socket teardown +- nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback +- nfc: nci: free skb on nci_transceive early error paths +- net: nfc: nci: Fix zero-length proprietary notifications +- drm/sched: Fix kernel-doc warning for drm_sched_job_done() +- amd-xgbe: fix sleep while atomic on suspend/resume +- smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() +- smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() +- xen/acpi-processor: fix _CST detection using undersized evaluation buffer +- net/rds: Fix circular locking dependency in rds_tcp_tune +- indirect_call_wrapper: do not reevaluate function pointer +- wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() +- wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() +- wifi: wlcore: Fix a locking bug +- octeon_ep: avoid compiler and IQ/OQ reordering +- octeon_ep: Relocate counter updates before NAPI +- net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value +- kunit: tool: copy caller args in run_kernel to prevent mutation +- rust: kunit: fix warning when !CONFIG_PRINTK +- can: mcp251x: fix deadlock in error path of mcp251x_open +- amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds +- atm: lec: fix null-ptr-deref in lec_arp_clear_vccs +- net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table +- e1000e: clear DPG_EN after reset to avoid autonomous power-gating +- hwmon: (it87) Check the it87_lock() return value +- platform/x86: thinkpad_acpi: Fix errors reading battery thresholds +- pinctrl: equilibrium: fix warning trace on load +- pinctrl: equilibrium: rename irq_chip function callbacks +- hwmon: (aht10) Fix initialization commands for AHT20 +- hwmon: (aht10) Add support for dht20 +- ARM: clean up the memset64() C wrapper +- selftests: mptcp: join: check removing signal+subflow endp +- selftests: mptcp: more stable simult_flows tests +- smb: client: fix broken multichannel with krb5+signing +- smb: client: fix cifs_pick_channel when channels are equally loaded +- drbd: fix null-pointer dereference on local read error +- drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() +- net/sched: ets: fix divide by zero in the offload path +- RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() +- IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() +- wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() +- wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration +- wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() +- wifi: radiotap: reject radiotap with unknown bits +- ALSA: usb-audio: Use correct version for UAC3 header validation +- platform/x86: dell-wmi: Add audio/mic mute key codes +- platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data +- HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them +- can: usb: f81604: handle bulk write errors properly +- can: usb: f81604: handle short interrupt urb messages properly +- can: usb: f81604: correctly anchor the urb in the read bulk callback +- can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message +- nfc: pn533: properly drop the usb interface reference on disconnect +- eventpoll: Fix integer overflow in ep_loop_check_proc() +- drm/amdgpu: keep vga memory on MacBooks with switchable graphics +- drm/amd: Drop special case for yellow carp without discovery +- net: arcnet: com20020-pci: fix support for 2.5Mbit cards +- ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 +- ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 +- usb: cdns3: remove redundant if branch +- clk: tegra: tegra124-emc: fix device leak on set_rate() +- arm64: dts: rockchip: Fix rk356x PCIe range mappings +- mfd: omap-usb-host: Fix OF populate on driver rebind +- mfd: omap-usb-host: Convert to platform remove callback returning void +- mfd: qcom-pm8xxx: Fix OF populate on driver rebind +- mfd: qcom-pm8xxx: Convert to platform remove callback returning void +- ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() +- mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() +- mailbox: Allow controller specific mapping using fwnode +- mailbox: Use guard/scoped_guard for con_mutex +- mailbox: Use dev_err when there is error +- mailbox: remove unused header files +- mailbox: sort headers alphabetically +- mailbox: don't protect of_parse_phandle_with_args with con_mutex +- mailbox: Use of_property_match_string() instead of open-coding +- ext4: get rid of ppath in ext4_ext_create_new_leaf() +- ext4: get rid of ppath in ext4_find_extent() +- bus: omap-ocp2scp: fix OF populate on driver rebind +- bus: omap-ocp2scp: Convert to platform remove callback returning void +- drm/tegra: dsi: fix device leak on probe +- media: tegra-video: Fix memory leak in __tegra_channel_try_format() +- media: tegra-video: Use accessors for pad config 'try_*' fields +- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR +- KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED +- PCI: Use resource_set_range() that correctly sets ->end +- resource: Add resource set range and size helpers +- PCI: Use resource names in PCI log messages +- PCI: Update BAR # and window messages +- memory: mtk-smi: fix device leak on larb probe +- memory: mtk-smi: fix device leaks on common probe +- memory: mtk-smi: Convert to platform remove callback returning void +- PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value +- btrfs: fix compat mask in error messages in btrfs_check_features() +- btrfs: fix warning in scrub_verify_one_metadata() +- btrfs: fix objectid value in error message in check_extent_data_ref() +- btrfs: fix incorrect key offset in error message in check_dev_extent_item() +- btrfs: add support for inserting raid stripe extents +- btrfs: read raid stripe tree from disk +- btrfs: add raid stripe tree definitions +- btrfs: move btrfs_extref_hash into inode-item.h +- btrfs: remove btrfs_crc32c wrapper +- btrfs: move btrfs_crc32c_final into free-space-cache.c +- ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() +- ALSA: pci: hda: use snd_kcontrol_chip() +- ALSA: usb-audio: Use inclusive terms +- ALSA: usb-audio: Cap the packet size pre-calculations +- scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume +- rseq: Clarify rseq registration rseq_size bound check comment +- ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices +- scsi: pm8001: Fix use-after-free in pm8001_queue_command() +- scsi: lpfc: Properly set WC for DPP mapping +- irqchip/sifive-plic: Fix frozen interrupt due to affinity setting +- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" +- arm64: Fix sampling the "stable" virtual counter in preemptible section +- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros +- NTB: ntb_transport: Fix too small buffer for debugfs_name +- net: nfc: nci: Fix parameter validation for packet data +- arm64: Force the use of CNTVCT_EL0 in __delay() +- x86/kexec: Copy ACPI root pointer address from config table +- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() +- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle +- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR +- fbcon: Remove struct fbcon_display.inverse +- fbdev: ffb: fix corrupted video output on Sun FFB1 +- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() +- fbdev: vt8500lcdfb: fix missing dma_free_coherent() +- atm: fore200e: fix use-after-free in tasklets during device removal +- net: intel: fix PCI device ID conflict between i40e and ipw2200 +- io_uring/filetable: clamp alloc_hint to the configured alloc range +- tracing: Fix to set write permission to per-cpu buffer_size_kb +- octeontx2-af: CGX: fix bitmap leaks +- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() +- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID +- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT +- LoongArch: Prefer top-down allocation after arch_mem_init() +- MIPS: rb532: Fix MMIO UART resource registration +- staging: rtl8723bs: fix null dereference in find_network +- parisc: kernel: replace kfree() with put_device() in create_tree_node() +- PCI: Fix pci_slot_trylock() error handling +- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path +- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() +- tipc: fix RCU dereference race in tipc_aead_users_dec() +- mtd: rawnand: pl353: Fix software ECC support +- usb: dwc2: fix resume failure if dr_mode is host +- scsi: ufs: core: Flush exception handling work when RPM level is zero +- perf/arm-cmn: Reject unsupported hardware configurations +- remoteproc: imx_rproc: Fix invalid loaded resource table detection +- btrfs: continue trimming remaining devices on failure +- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y +- ocfs2: fix reflink preserve cleanup issue +- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() +- mm/highmem: fix __kmap_to_page() build error +- iio: gyro: itg3200: Fix unchecked return value in read_raw +- dm mpath: make pg_init_delay_msecs settable +- bus: fsl-mc: fix an error handling in fsl_mc_device_add() +- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN +- nvmem: Drop OF node reference on nvmem_add_one_cell() failure +- nfsd: fix return error code for nfsd_map_name_to_[ug]id +- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions +- xfs: fix remote xattr valuelblk check +- xfs: fix freemap adjustments when adding xattrs to leaf blocks +- xfs: delete attr leaf freemap entries when empty +- mfd: core: Add locking around 'mfd_of_node_list' +- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode +- media: verisilicon: AV1: Fix tile info buffer size +- xfs: mark data structures corrupt on EIO and ENODATA +- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs +- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations +- drm: of: drm_of_panel_bridge_remove(): fix device_node leak +- media: venus: vdec: restrict EOS addr quirk to IRIS2 only +- media: venus: vdec: fix error state assignment for zero bytesused +- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro +- dm-unstripe: fix mapping bug when there are multiple targets in a table +- dm-integrity: fix recalculation in bitmap mode +- s390/pci: Handle futile config accesses of disabled devices directly +- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() +- media: i2c: ov01a10: Fix digital gain range +- clk: clk-apple-nco: Add "apple,t8103-nco" compatible +- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation +- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() +- soc: ti: k3-socinfo: Fix regmap leak on probe failure +- dm-integrity: fix a typo in the code for write/discard race +- media: i2c: ov5647: use our own mutex for the ctrl lock +- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode +- media: i2c: ov5647: Sensor should report RAW color space +- media: i2c: ov5647: Correct minimum VBLANK value +- media: i2c: ov5647: Correct pixel array offset +- media: i2c: ov5647: Initialize subdev before controls +- media: ccs: Avoid possible division by zero +- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() +- media: i2c: ov01a10: Fix test-pattern disabling +- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls +- media: i2c: ov01a10: Fix analogue gain range +- media: i2c: ov01a10: Fix reported pixel-rate value +- media: i2c: ov01a10: Fix the horizontal flip control +- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() +- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() +- media: cx25821: Add missing unmap in snd_cx25821_hw_params() +- media: cx23885: Add missing unmap in snd_cx23885_hw_params() +- media: cx88: Add missing unmap in snd_cx88_hw_params() +- media: radio-keene: fix memory leak in error path +- media: verisilicon: AV1: Set IDR flag for intra_only frame type +- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on +- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() +- HID: prodikeys: Check presence of pm->input_ep82 +- HID: magicmouse: Do not crash on missing msc->input +- HID: hid-pl: handle probe errors +- arm64: Disable branch profiling for all arm64 code +- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding +- ARM: omap2: Fix reference count leaks in omap_control_init() +- media: verisilicon: AV1: Fix tx mode bit setting +- media: verisilicon: AV1: Fix enable cdef computation +- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() +- media: mtk-mdp: Fix error handling in probe function +- media: mediatek: encoder: Fix uninitialized scalar variable issue +- dm-verity: correctly handle dm_bufio_client_create() failure +- fpga: dfl: use subsys_initcall to allow built-in drivers to be added +- ASoC: SOF: ipc4-control: Keep the payload size up to date +- ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data +- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls +- ASoC: SOF: ipc4-control: If there is no data do not send bytes update +- clk: renesas: rzg2l: Select correct div round macro +- clk: renesas: rzg2l: Fix intin variable size +- rpmsg: core: fix race in driver_override_show() and use core helper +- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() +- dpaa2-switch: validate num_ifs to prevent out-of-bounds write +- net/mlx5: Fix missing devlink lock in SRIOV enable error path +- net/mlx5: DR, Fix circular locking dependency in dump +- RDMA/umem: Fix double dma_buf_unpin in failure path +- RDMA/efa: Fix typo in efa_alloc_mr() +- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets +- RDMA/core: Fix stale RoCE GIDs during netdev events at registration +- tipc: fix duplicate publication key in tipc_service_insert_publ() +- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option +- wifi: cfg80211: wext: fix IGTK key ID off-by-one +- net: ethernet: xscale: Check for PTP support properly +- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() +- net: usb: lan78xx: scan all MDIO addresses on LAN7801 +- xfrm: always flush state and policy upon NETDEV_UNREGISTER event +- ipmi: ipmb: initialise event handler read bytes +- xfrm: skip templates check for packet offload tunnel mode +- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() +- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut +- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access +- rtc: zynqmp: correct frequency value +- drm/amd/display: Remove conditional for shaper 3DLUT power-on +- btrfs: replace BUG() with error handling in __btrfs_balance() +- ALSA: usb-audio: Add sanity check for OOB writes at silencing +- drm/radeon: Add HAINAN clock adjustment +- drm/amdgpu: Add HAINAN clock adjustment +- ALSA: usb-audio: Update the number of packets properly at receiving +- drm/amdgpu: Adjust usleep_range in fence wait +- drm/amd/display: Avoid updating surface with the same surface under MPO +- ARM: 9467/1: mm: Don't use %pK through printk +- include: uapi: netfilter_bridge.h: Cover for musl libc +- thermal: int340x: Fix sysfs group leak on DLVR registration failure +- ceph: supply snapshot context in ceph_uninline_data() +- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() +- fs/ntfs3: drop preallocated clusters for sparse and compressed files +- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST +- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata +- fs: ntfs3: check return value of indx_find to avoid infinite loop +- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE +- iio: magnetometer: Remove IRQF_ONESHOT +- iio: Use IRQF_NO_THREAD +- Revert "mfd: da9052-spi: Change read-mask to write-mask" +- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature +- phy: mvebu-cp110-utmi: fix dr_mode property read from dts +- watchdog: imx7ulp_wdt: handle the nowayout option +- binder: don't use %pK through printk +- fix it87_wdt early reboot by reporting running timer +- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done +- staging: rtl8723bs: fix memory leak on failure path +- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 +- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() +- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings +- dmaengine: sun6i: Choose appropriate burst length under maxburst +- fpga: of-fpga-region: Fail if any bridge is missing +- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs +- serial: 8250_dw: handle clock enable errors in runtime_resume +- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure +- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) +- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 +- clk: microchip: core: correct return value on *_get_parent() +- mailbox: sprd: clear delivery flag before handling TX done +- remoteproc: mediatek: Break lock dependency to `prepare_lock` +- mailbox: sprd: mask interrupts that are not handled +- mailbox: imx: Skip the suspend flag for i.MX7ULP +- mailbox: pcc: Remove spurious IRQF_ONESHOT usage +- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized +- tracing: Fix false sharing in hwlat get_sample() +- vhost: fix caching attributes of MMIO regions by setting them explicitly +- scsi: buslogic: Reduce stack usage +- ata: libata: avoid long timeouts on hot-unplugged SATA DAS +- RDMA/rtrs-clt: For conn rejection use actual err number +- myri10ge: avoid uninitialized variable use +- PCI: Mark Nvidia GB10 to avoid bus reset +- PCI: Add ACS quirk for Qualcomm Hamoa & Glymur +- PCI: Enable ACS after configuring IOMMU for OF platforms +- PCI: Fix pci_slot_lock () device locking +- net/rds: Clear reconnect pending bit +- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 +- net: usb: sr9700: remove code to drive nonexistent multicast filter +- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() +- wifi: rtw89: pci: restore LDO setting after device resume +- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky +- Bluetooth: btusb: Add device ID for Realtek RTL8761BU +- Bluetooth: btusb: Add new VID/PID for RTL8852CE +- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout +- Bluetooth: hci_conn: Set link_policy on incoming ACL connections +- ipv4: fib: Annotate access to struct fib_alias.fa_state. +- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() +- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() +- gro: change the BUG_ON() in gro_pull_from_frag0() +- net/rds: No shortcut out of RDS_CONN_ERROR +- wifi: iwlwifi: mvm: check the validity of noa_len +- net: usb: r8152: fix transmit queue timeout +- openrisc: define arch-specific version of nop() +- netfilter: xt_tcpmss: check remaining length before reading optlen +- netfilter: nf_conntrack: Add allow_clash to generic protocol handler +- ext4: mark group extend fast-commit ineligible +- ext4: mark group add fast-commit ineligible +- ipv6: exthdrs: annotate data-race over multiple sysctl +- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() +- wifi: ath12k: fix preferred hardware mode calculation +- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 +- PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port +- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode +- iommu/amd: move wait_on_sem() out of spinlock +- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency +- dm: remove fake timeout to avoid leak request +- dm: replace -EEXIST with -EBUSY +- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H +- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() +- wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero +- jfs: nlink overflow in jfs_rename +- jfs: Add missing set_freezable() for freezable kthread +- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio +- modpost: Amend ppc64 save/restfpr symnames for -Os build +- ASoC: es8328: Add error unwind in resume +- hwmon: (f71882fg) Add F81968 support +- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE +- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() +- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end +- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio +- gpio: aspeed-sgpio: Change the macro to support deferred probe +- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro +- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK +- HID: multitouch: add eGalaxTouch EXC3188 support +- media: rkisp1: Fix filter mode register configuration +- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release +- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts +- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback +- virt: vbox: uapi: Mark inner unions in packed structs as packed +- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed +- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() +- media: v4l2-async: Fix error handling on steps after finding a match +- media: cx25821: Fix a resource leak in cx25821_dev_setup() +- media: solo6x10: Check for out of bounds chip_id +- media: adv7180: fix frame interval in progressive mode +- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START +- spi: spi-mem: Limit octal DTR constraints to octal DTR situations +- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug +- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask +- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards +- drm/amdgpu: avoid a warning in timedout job handler +- drm/amdgpu: add support for HDP IP version 6.1.1 +- media: mediatek: vcodec: Don't try to decode 422/444 VP9 +- media: omap3isp: set initial format +- media: omap3isp: isppreview: always clamp in preview_try_format() +- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes +- drm/v3d: Set DMA segment size to avoid debug warnings +- spi: stm32: fix Overrun issue at < 8bpw +- media: dvb-core: dmxdevfilter must always flush bufs +- spi-geni-qcom: use xfer->bits_per_word for can_dma() +- spi-geni-qcom: initialize mode related registers to 0 +- drm/display/dp_mst: Add protection against 0 vcpi +- parisc: Prevent interrupts during reboot +- arm64: tegra: smaug: Add usb-role-switch support +- char: tpm: cr50: Remove IRQF_ONESHOT +- mailbox: bcm-ferxrm-mailbox: Use default primary handler +- PCI/MSI: Unmap MSI-X region on error +- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF +- clocksource/drivers/sh_tmu: Always leave device running after probe +- bpf: verifier improvement in 32bit shift sign extension pattern +- sparc: don't reference obsolete termio struct for TC* constants +- sparc: Synchronize user stack on fork and clone +- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() +- xenbus: Use .freeze/.thaw to handle xenbus devices +- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD +- s390/perf: Disable register readout on sampling events +- cpufreq: dt-platdev: Block the driver from probing on more QC platforms +- md-cluster: fix NULL pointer dereference in process_metadata_update +- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP +- EFI/CPER: don't go past the ARM processor CPER record buffer +- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set +- rnbd-srv: Zero the rsp buffer before using it +- perf/arm-cmn: Support CMN-600AE +- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS +- tools/power cpupower: Reset errno before strtoull() +- smb: client: add proper locking around ses->iface_last_update +- btrfs: handle user interrupt properly in btrfs_trim_fs() +- minix: Add required sanity checking to minix_check_superblock() +- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() +- hfsplus: pretend special inodes as regular files +- audit: add missing syscalls to read class +- fs/buffer: add alert in try_to_free_buffers() for folios without buffers +- hfsplus: fix volume corruption issue for generic/498 +- libperf build: Always place libperf includes first +- libperf: Don't remove -g when EXTRA_CFLAGS are used +- libsubcmd: Fix null intersection case in exclude_cmds() +- perf callchain: Fix srcline printing with inlines +- perf unwind-libdw: Fix invalid reference counts +- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names +- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names +- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false +- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path +- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths +- ata: libata-scsi: refactor ata_scsi_translate() +- ata: pata_ftide010: Fix some DMA timings +- ext4: use optimized mballoc scanning regardless of inode format +- ext4: don't cache extent during splitting extent +- MIPS: Work around LLVM bug when gp is used as global register variable +- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats +- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk +- x86/hyperv: Fix error pointer dereference +- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found +- efi: Fix reservation of unaccepted memory table +- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n +- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() +- spi: wpcm-fiu: Simplify with dev_err_probe() +- spi: wpcm-fiu: Fix uninitialized res +- spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() +- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 +- drm/amdkfd: fix debug watchpoints for logical devices +- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init +- drm/i915/acpi: free _DSM package when no connectors +- drm/amdgpu: Fix memory leak in amdgpu_ras_init() +- apparmor: fix invalid deref of rawdata when export_binary is unset +- apparmor: provide separate audit messages for file and policy checks +- apparmor: use passed in gfp flags in aa_alloc_null() +- apparmor: fix rlimit for posix cpu timers +- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure +- apparmor: fix NULL sock in aa_sock_file_perm +- net/mlx5: Fix multiport device check over light SFs +- bonding: alb: fix UAF in rlb_arp_recv during bond up/down +- octeontx2-af: Fix default entries mcam entry action +- cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) +- cache: enforce cache groups +- ping: annotate data-races in ping_lookup() +- bpftool: Fix truncated netlink dumps +- ipv6: fix a race in ip6_sock_set_v6only() +- net: remove WARN_ON_ONCE when accessing forward path array +- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value +- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled +- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled +- net: bridge: mcast: always update mdb_n_entries for vlan contexts +- net/rds: rds_sendmsg should not discard payload_len +- net: usb: catc: enable basic endpoint checking +- net: sparx5/lan969x: fix PTP clock max_adj value +- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() +- net: mscc: ocelot: split xmit into FDMA and register injection paths +- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper +- net: sparx5/lan969x: fix DWRR cost max to match hardware register width +- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 +- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO +- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT +- selftests/memfd: delete unused declarations +- kbuild: Add objtool to top-level clean target +- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check +- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs +- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot +- fs/ntfs3: prevent infinite loops caused by the next valid being the same +- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data +- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() +- dmaengine: fsl-edma-main: Convert to platform remove callback returning void +- backlight: qcom-wled: Change PM8950 WLED configurations +- backlight: qcom-wled: Support ovp values for PMI8994 +- leds: qcom-lpg: Check the return value of regmap_bulk_write() +- pinctrl: single: fix refcount leak in pcs_add_gpio_func() +- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition +- iio: sca3000: Fix a resource leak in sca3000_probe() +- ovl: Fix uninit-value in ovl_fill_real +- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() +- usb: bdc: fix sleep during atomic +- drivers: iio: mpu3050: use dev_err_probe for regulator request +- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support +- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order +- mfd: simple-mfd-i2c: Add SpacemiT P1 support +- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA +- mfd: simple-mfd-i2c: Add MAX77705 support +- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure +- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" +- coresight: etm3x: Fix cpulocked warning on cpuhp +- watchdog: starfive-wdt: Fix PM reference leak in probe error path +- iio: pressure: mprls0025pa: fix scan_type struct +- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms +- serial: SH_SCI: improve "DMA support" prompt +- serial: imx: change SERIAL_IMX_CONSOLE to bool +- staging: greybus: lights: avoid NULL deref +- dma: dma-axi-dmac: fix SW cyclic transfers +- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX +- clk: mediatek: Fix error handling in runtime PM setup +- clk: qcom: gfx3d: add parent to parent request map +- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks +- clk: Move clk_{save,restore}_context() to COMMON_CLK section +- clk: qcom: gcc-ipq5018: flag sleep clock as critical +- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc +- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc +- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops +- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops +- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops +- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs +- clk: qcom: rcg2: compute 2d using duty fraction directly +- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs +- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() +- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() +- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros +- tracing: Properly process error handling in event_hist_trigger_parse() +- fs/nfs: Fix readdir slow-start regression +- nvdimm: virtio_pmem: serialize flush requests +- scsi: csiostor: Fix dereference of null pointer rn +- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() +- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN +- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc +- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer +- mtd: spinand: Fix kernel doc +- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() +- cxl: Fix premature commit_end increment on decoder commit failure +- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing +- svcrdma: Reduce the number of rdma_rw contexts per-QP +- svcrdma: Increase the per-transport rw_ctx count +- svcrdma: Clean up comment in svc_rdma_accept() +- svcrdma: Remove queue-shortening warnings +- RDMA/core: Fix a couple of obvious typos in comments +- RDMA/rxe: Fix race condition in QP timer handlers +- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send +- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() +- crypto: ccp - Add an S4 restore flow +- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper +- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() +- RDMA/rxe: Fix double free in rxe_srq_from_init +- RDMA/rtrs-srv: fix SG mapping +- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() +- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported +- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write +- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() +- power: supply: rt9455: Fix use-after-free in power_supply_changed() +- power: supply: goldfish: Fix use-after-free in power_supply_changed() +- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() +- power: supply: bq25980: Fix use-after-free in power_supply_changed() +- power: supply: bq256xx: Fix use-after-free in power_supply_changed() +- power: supply: act8945a: Fix use-after-free in power_supply_changed() +- power: supply: ab8500: Fix use-after-free in power_supply_changed() +- IB/cache: update gid cache on client reregister event +- RDMA/rtrs: server: remove dead code +- octeontx2-pf: Unregister devlink on probe failure +- ionic: Rate limit unknown xcvr type messages +- serial: caif: fix use-after-free in caif_serial ldisc_close() +- net: Add skb_dstref_steal and skb_dstref_restore +- net: sunhme: Fix sbus regression +- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() +- smb: client: correct value for smbd_max_fragmented_recv_size +- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] +- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets +- netfilter: nft_counter: fix reset of counters on 32bit archs +- netfilter: nft_set_hash: fix get operation on big endian +- nfc: hci: shdlc: Stop timers and work before freeing context +- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP +- bonding: only set speed/duplex to unknown, if getting speed failed +- octeontx2-af: Fix PF driver crash with kexec kernel booting +- mptcp: fix receive space timestamp initialization +- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() +- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() +- ipc: don't audit capability check in ipc_permissions() +- PCI/ACPI: Restrict program_hpx_type2() to AER bits +- PCI: Add defines for bridge window indexing +- PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros +- PCI: Log bridge info when first enumerating bridge +- PCI: Log bridge windows conditionally +- PCI: Supply bridge device, not secondary bus, to read window details +- PCI: Move pci_read_bridge_windows() below individual window accessors +- PCI: Initialize RCB from pci_configure_device() +- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() +- tcp: tcp_tx_timestamp() must look at the rtx queue +- nfsd: never defer requests during idmap lookup +- iommu/vt-d: Flush cache for PASID table before using it +- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken +- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() +- module: add helper function for reading module_buildid() +- netfilter: nft_compat: add more restrictions on netlink attributes +- netfilter: nf_conncount: increase the connection clean up limit to 64 +- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH +- netfilter: nf_tables: reset table validation state on abort +- wifi: cfg80211: stop NAN and P2P in cfg80211_leave +- mctp i2c: initialise event handler read bytes +- net: mctp-i2c: fix duplicate reception of old data +- PCI/portdrv: Fix potential resource leak +- PCI: Do not attempt to set ExtTag for VFs +- Documentation: tracing: Add PCI tracepoint documentation +- Documentation: trace: Refactor toctree +- docs: fix WARNING document not included in any toctree +- Documentation: tracing: Add ring-buffer mapping +- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails +- PCI/PM: Avoid redundant delays on D3hot->D3cold +- Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors +- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails +- spi: tools: Add include folder to .gitignore +- platform/chrome: cros_ec_lightbar: Fix response size initialization +- media: uvcvideo: Fix allocation for small frame sizes +- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev +- drm/msm/a2xx: fix pixel shader start on A225 +- media: ccs: Accommodate C-PHY into the calculation +- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x +- HID: playstation: Add missing check for input_ff_create_memless +- regulator: core: move supply check earlier in set_machine_constraints() +- drm/msm/disp/dpu: add merge3d support for sc7280 +- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init +- smack: /smack/doi: accept previously used values +- smack: /smack/doi must be > 0 +- workqueue: Process rescuer work items one-by-one using a cursor +- workqueue: Only assign rescuer work when really needed +- workqueue: Factor out assign_rescuer_work() +- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions +- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 +- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 +- arm64: dts: amlogic: g12: assign the MMC A signal clock +- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks +- arm64: dts: amlogic: gx: assign the MMC signal clocks +- arm64: dts: amlogic: axg: assign the MMC signal clocks +- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node +- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells +- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling +- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() +- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe +- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() +- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property +- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on +- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on +- arm64: dts: qcom: sdm630: fix gpu_speed_bin size +- clk: qcom: Return correct error code in qcom_cc_probe_by_index() +- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings +- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() +- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() +- soc: qcom: smem: handle ENOMEM error during probe +- mfd: wm8350-core: Use IRQF_ONESHOT +- EDAC/altera: Remove IRQF_ONESHOT +- scsi: efct: Use IRQF_ONESHOT and default primary handler +- hrtimer: Fix trace oddity +- crypto: octeontx - fix dma_free_coherent() size +- crypto: cavium - fix dma_free_coherent() size +- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable +- libbpf: Fix OOB read in btf_dump_get_bitfield_value +- selftests/bpf: veristat: fix printing order in output_stats() +- crypto: qat - fix warning on adf_pfvf_pf_proto.c +- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() +- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races +- perf: arm_spe: Properly set hw.state on failures +- PM: wakeup: Handle empty list in wakeup_sources_walk_start() +- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" +- x86/xen: make some functions static +- ublk: Validate SQE128 flag before accessing the cmd +- iomap: fix submission side handling of completion side errors +- md/raid10: fix any_working flag handling in raid10_sync_request +- cpuidle: governors: menu: Always check timers with tick stopped +- cpuidle: menu: Cleanup after loadavg removal +- io_uring/sync: validate passed in offset +- xen/virtio: Don't use grant-dma-ops when running as Dom0 +- btrfs: fix block_group_tree dirty_list corruption +- btrfs: qgroup: return correct error when deleting qgroup relation item +- tpm: st33zp24: Fix missing cleanup on get_burstcount() error +- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure +- i3c: dw: Initialize spinlock to avoid upsetting lockdep +- gfs2: Retries missing in gfs2_{rename,exchange} +- i3c: master: Update hot-join flag only on success +- fs: add <linux/init_task.h> for 'init_fs' +- audit: move the compat_xxx_class[] extern declarations to audit_arch.h +- rcu: Fix rcu_read_unlock() deadloop due to softirq +- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() +- rcu: Refactor expedited handling check in rcu_read_unlock_special() +- rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() +- rcu: s/boost_kthread_mutex/kthread_mutex +- hfsplus: return error when node already exists in hfs_bnode_create +- auxdisplay: arm-charlcd: fix release_mem_region() size +- RDMA/siw: Fix potential NULL pointer dereference in header processing +- !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev +- bpf: Avoid soft lockup in bpf_uprobe_unregister +- !23394 Fix CVE-2026-45911 +- !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec +- !23388 Fix CVE-2026-45982 +- usb: cdns3: fix role switching during resume +- urma: add v2p function in kernel for dfx such as urma_admin +- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() +- !23392 Fix CVE-2026-46171 +- !23176 Fix CVE-2026-46082 +- !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 +- !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. +- !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() +- !22644 Fix CVE-2026-43366 +- !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() +- !22645 Fix CVE-2026-43288 +- !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check +- !22714 Fix CVE-2026-43163 +- !22610 Fix CVE-2026-43061 +- !23361 CVE-2026-46181 +- !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch +- !23317 add min_slice and sched_runtime +- !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability +- !23309 ub: ubase: Correct the statistics on ELR reset failures +- urma: increase topo max node limit to 1024 +- ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. +- drivers/ub/sentry: enhance sentry module error handling and logging observability +- riscv: kvm: fix vector context allocation leak +- !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid +- !23288 Fix CVE-2026-46093 +- !23294 Fix CVE-2026-43406 +- ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch +- urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap +- APEI/GHES: ARM processor Error: don't go past allocated memory +- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() +- refcount: provide ops for cases when object's memory can be reused +- !23316 sched/cputime: Fix time overflow in cputime_adjust() +- !23346 ub: udma: change default value of set dev name +- !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter +- !23330 Fix CVE-2026-46165 +- !23326 Fix CVE-2026-43466 +- !23328 Fix CVE-2026-46033 +- !23325 Fix CVE-2026-43468 +- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node +- iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec +- !23125 Fix CVE-2026-46051 +- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() +- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check +- !23188 CVE-2026-46044 +- ub: udma: change default value of set dev name +- soc: hisilicon: kunpeng_hccs: Remove unused input parameter +- soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier +- !23028 bugfixs for sched_ext +- !22886 net: yt6801: fix link info for yt6801 +- !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations +- openvswitch: vport: fix self-deadlock on release of tunnel ports +- crypto: authencesn - reject short ahash digests during instance creation +- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery +- net/mlx5: Fix deadlock between devlink lock and esw->wq +- iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev +- iommu/ummu: Fix incorrect xarray index in map_pages error path +- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks +- sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash +- sched: Fix kabi breakage in struct sched_entity +- sched/eevdf: Propagate min_slice up the cgroup hierarchy +- sched/fair: Re-organize dequeue_task_fair() +- sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion +- sched/cputime: Fix time overflow in cputime_adjust() +- libceph: prevent potential out-of-bounds reads in process_message_header() +- iommu/amd: serialize sequence allocation under concurrent TLB invalidations +- mm/vmalloc: take vmap_purge_lock in shrinker +- KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 +- obmm: validate VMA identity via vm_ops before accessing vm_file +- obmm: add PMD huge entry support for ptrace/GDB vma access +- obmm: fix VMA access for ptrace/GDB on export regions +- obmm: fix page table walk for ownership permission updates +- obmm: reject MAP_PRIVATE +- md/raid5: fix soft lockup in retry_aligned_read() +- ipmi:ssif: NULL thread on error +- ipmi:ssif: Clean up kthread on errors +- ub: ubase: Correct the statistics on ELR reset failures +- ub: ubase&unic: Improve driver code readability +- ub: ubase: Discard ctrlq request with non-zero ret value +- ub: ubase: Add abort handling for non-timeout ELR failures +- net: unic: Log rectification for the wildfire project +- ub: ubase/unic/cdma: Clear adev_status when probe succeeds +- net: unic: Filter out IPv6 link-local address in bond IP notification +- KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 +- sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next +- sched_ext: fix flag check for deferred callbacks +- sched_ext: defer queue_balance_callback() until after ops.dispatch +- sched_ext: Keep bypass on between enable failure and scx_disable_workfn() +- urma: fix RNR ERR under CTP mode in IPoURMA +- net: yt6801: fix link info for yt6801 +- md/bitmap: fix GPF in write_page caused by resize race +- ext4: move ext4_percpu_param_init() before ext4_mb_init() +- io_uring/kbuf: check if target buffer list is still legacy on recycle +- io_uring: validate user-controlled cq.head in io_cqe_cache_refill() +- serial: 8250: Fix TX deadlock when using DMA + +* Tue Jun 02 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-155.0.0.141.20260602.b35be856065b +- !22507 urma: refactor connect_bonding from ubcore to ubagg +- !23300 urma: fix main_ue_eid flush ioctl argument +- !23298 net: usb: pegasus: enable basic endpoint checking +- !23295 mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock +- urma: fix main_ue_eid flush ioctl argument +- !22496 bpf-rvi: Fix possible AA deadlock pidns_list_lock +- !23192 RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() +- !23181 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() +- !23175 Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt +- !23247 CVE-2026-31759 +- net: usb: pegasus: enable basic endpoint checking +- !23208 CVE-2026-43240 +- !23184 APEI/GHES: ensure that won't go past CPER allocated record +- !23267 Fix CVE-2026-46151 +- !23269 Fix CVE-2026-46167 +- mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock +- !23259 Fix CVE-2026-46190 +- urma: refactor connect_bonding from ubcore to ubagg +- !23217 drivers/ub/sentry: remove send/recv counter-based tjetty rebuild mechanism +- !23244 Fix CVE-2026-46187 +- !23243 Fix CVE-2026-46214 +- !23242 Fix CVE-2026-46098 +- !23200 Fix CVE-2026-46047 +- !23201 Fix CVE-2026-45890 +- !23276 Disable userswap by default +- !23203 ceph: only d_add() negative dentries when they are unhashed +- openeuler_defconfig: disable CONFIG_USERSWAP by default +- mm/userswap: remove boot param +- !23248 net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path +- !23207 CVE-2026-43421 +- !23172 thermal: core: Fix thermal zone governor cleanup issues +- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl +- usb: usblp: fix heap leak in IEEE 1284 device ID via short response +- !23147 backport soc cache patches from linux mainline. +- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() +- !23167 change wk1 to wk2 to send data and add responsibility for transmission +- !23049 urma: fix device change namespace calltrace +- !22837 urma: redefine links field as bool connectivity matrix. +- !22861 urma: refactor main_primary_eid lookup and support ue-granularity batch configuration +- !23093 mainline for bpf +- wifi: rsi: fix kthread lifetime race between self-exit and external-stop +- net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path +- net: hibmcge: disable Relaxed Ordering to fix RX packet corruption +- usb: ulpi: fix memory leak on ulpi_register() error paths +- usb: ulpi: fix double free in ulpi_register_interface() error path +- vsock/virtio: fix accept queue count leak on transport mismatch +- soc cache: Fix unsafe shift left +- drivers/ub/sentry: remove send/recv counter-based tjetty rebuild mechanism +- net: caif: clear client service pointer on teardown +- !23187 eventfs: Hold eventfs_mutex and SRCU when remount walks events +- !23091 mfs: update mfs doc for adding sysfs part +- urma: change wk1 to wk2 to send data and add responsibility +- x86/kexec: add a sanity check on previous kernel's ima kexec buffer +- ima: verify the previous kernel's IMA buffer lies in addressable RAM +- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo +- usb: gadget: f_ncm: Fix net_device lifecycle with device_move +- cleanup: Provide retain_and_null_ptr() +- usb: gadget: ncm: Fix indentations in documentation of NCM section +- usb: gadget: ncm: Fix endianness of wMaxSegmentSize variable in ecm_desc +- usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs +- ceph: only d_add() negative dentries when they are unhashed +- xen-netback: reject zero-queue configuration from guest +- net: qrtr: ns: Fix use-after-free in driver remove() +- urma: fix main_ue_eid query table configuration path +- urma: topology supports parallel planes +- RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() +- eventfs: Hold eventfs_mutex and SRCU when remount walks events +- APEI/GHES: ensure that won't go past CPER allocated record +- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() +- Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt +- thermal: core: Fix thermal zone governor cleanup issues +- urma: fix device change namespace calltrace +- bpf: Fix variable length stack write over spilled pointers +- bpf: Do not allow deleting local storage in NMI +- bpf: Convert bpf_selem_unlink to failable +- bpf: Convert bpf_selem_link_map to failable +- bpf: Convert bpf_selem_unlink_map to failable +- bpf: Select bpf_local_storage_map_bucket based on bpf_local_storage +- mfs: update mfs doc for adding sysfs part +- mfs: handle close event in user-space side +- mfs: post close event to user-space side +- mfs: add file operation event filtering +- mfs: add sysfs interface to configure event +- bpf-rvi: Fix possible AA deadlock pidns_list_lock + +* Sun May 31 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-155.0.0.141.20260531.5c5d740fe786 +- !23193 Fix CVE-2026-45984 +- !23179 kvm: arm64: Fix NULL pointer dereference in kvm_destroy_cvm() with timer early inject +- gfs2: Fix use-after-free in iomap inline data write path +- gfs2: Add metapath_dibh helper +- !23139 Fix CVE-2026-45943 +- !23072 Fix CVE-2026-45861 +- !23055 Fix CVE-2026-45961 +- !23047 Fix CVE-2026-45999 +- !23039 Fix CVE-2026-46078 +- !23050 Fix CVE-2026-43099 +- !22987 Fix CVE-2026-43186 +- !22988 Fix CVE-2026-43194 +- kvm: arm64: Fix NULL pointer dereference in kvm_destroy_cvm() with timer early inject +- !23121 ub:ubfi: add numa node get from firmware mode +- !23102 ub:ubus: optimize error print for ubus and hisi_ubus +- !23090 vfio:ubus: add vfio ub cfg0 and cfg1 basic attr perm +- erofs: fix inline data read failure for ztailpacking pclusters +- ub:ubus: optimize error print for ubus and hisi_ubus +- ub:ubfi: add numa node get from firmware mode +- vfio:ubus: add vfio ub cfg0 and cfg1 basic attr perm +- gfs2: Fix slab-use-after-free in qd_put +- gfs2: fix memory leaks in gfs2_fill_super error path +- ipv4: icmp: fix null-ptr-deref in icmp_build_probe() +- erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() +- erofs: fix the out-of-bounds nameoff handling for trailing dirents +- net: consume xmit errors of GSO frames +- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() + +* Sat May 30 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-155.0.0.141.20260530.691966fd0b26 +- !22508 urma: General Msg Handler Interface +- !22806 ACPI: processor: idle: Reset cpuidle on C-state list changes +- !23013 CVE-2026-45968 +- !23092 udma: optimize log format. +- !23088 v4 Support open_tree OPEN_TREE_NAMESPACE +- !22425 ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() +- urma: fix the scenario-specific message processing interface +- !22739 backport cpuidle patches from linux mainline +- !23089 urma: fix resource leaks in uburma and ubcore error paths +- !22550 ub:ubfi: fix the resource maintenance issue in the ubfi ummu node parsing +- !23052 cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path +- !23070 tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG +- !23051 Bluetooth: SMP: force responder MITM requirements before building the pairing response +- ub: udma: optimize log format. +- !22049 AMD Turin iommu support patches for openEuler 6.6 kernel +- !22443 nbd: replace socks pointer array with xarray to eliminate queue freeze +- !22558 arch/x86/mm: reserve memblock for CSV3 guest +- !22675 update rnpgbevf driver to version 1.0.1 +- !23022 ub: cdma: inline cdma_id_find_ctp into cdma_delete_ctp +- !23046 ub:ubus: Optimize error log and add mutex lock for ub memory ras +- mount: hold namespace_sem across copy in create_new_namespace() +- mount: add OPEN_TREE_NAMESPACE +- tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG +- !22877 Fix CVE-2026-43503 +- !22873 Fix CVE-2026-46300 +- !22839 mm: fix some minor per-VMA lock issues in userfaultfd +- update rnpgbevf driver to version 1.0.1. +- ub:ubus: Optimize error log and add mutex lock for ub memory ras +- ub:ubus: add mutex lock for port local ras +- !22910 ub/ubdevshm: Fix spelling errors and optimize prints +- cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path +- Bluetooth: SMP: force responder MITM requirements before building the pairing response +- !22492 urma: Introduce EID radix tree for primary EID lookup +- !22418 urma: move capability of querying physical devices from ubcore to ubagg +- !22975 ub:ubus: add error return when send config message +- !22841 backport dma map and smmu patches from linux mainline +- mm: fix some minor per-VMA lock issues in userfaultfd +- userfaultfd: use per-vma locks in userfaultfd operations +- mm: add vma_assert_locked() for !CONFIG_PER_VMA_LOCK +- userfaultfd: protect mmap_changing with rw_sem in userfaulfd_ctx +- userfaultfd: fix operator precedence bug in UFFDIO_COPY mode check +- !22149 bnxt_en: Update firmware interface to 1.10.2.171 +- ub: cdma: inline cdma_id_find_ctp into cdma_delete_ctp +- sched: idle: Make skipping governor callbacks more consistent +- cpuidle: Skip governor when only one idle state is available +- !22902 arm64/ACPI: fix build error when CONFIG_ACPI_APEI_GHES is disabled +- !22945 KVM: arm64: fix vtimer WARN and CVM conflict +- !22979 drivers/ub/sentry: use fixed short interval for ACK wait loop polling +- !22474 Fix CVE-2026-43148 +- !22897 libceph: define and enforce CEPH_MAX_KEY_LEN +- !22899 scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT +- !22846 net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode +- !22702 net/oenetcls: validate module params and reject zero table sizes +- !22937 oenetcls: fix worker-context locking, async add/del race, and runtime policy toggles +- !22950 sched: Fix bpf_sched_set_task_prefer_nid() build error +- sched: Fix bpf_sched_set_task_prefer_nid() build error +- !22802 arm64: kernel: fix Clang integrated assembler errors in entry.S +- bnxt_en: Update VNIC resource calculation for VFs +- bnxt_en: Do not call sleeping hwmon_notify_event() from NAPI +- bnxt_en: Support QOS and TPID settings for the SRIOV VLAN +- Revert "bnxt_en: Support QOS and TPID settings for the SRIOV VLAN" +- bnxt_en: Support QOS and TPID settings for the SRIOV VLAN +- bnxt_en: Event handler for Thermal event +- bnxt_en: Use non-standard attribute to expose shutdown temperature +- bnxt_en: Expose threshold temperatures through hwmon +- bnxt_en: Modify the driver to use hwmon_device_register_with_info +- bnxt_en: Move hwmon functions into a dedicated file +- bnxt_en: Enhance hwmon temperature reporting +- eth: bnxt: fix backward compatibility with older devices +- bnxt_en: Fix 2 stray ethtool -S counters +- urma: move capability of querying physical devices from ubcore to ubagg +- !22901 RDMA/hns: Fix hung task when drain qp failed. +- drivers/ub/sentry: use fixed short interval for ACK wait loop polling +- !22944 drm: Account property blob allocations to memcg +- !22680 Fix CVE-2026-31738 +- !22683 Fix CVE-2026-43036 +- !22655 Fix fair build error with !CONFIG_SMP +- !22938 bugfixs for sched_ext and soft_quota in idle.c +- !22889 lib/crypto: chacha: Zeroize permuted_state before it leaves scope +- !22927 drivers/ub/sentry: delete unimportant logs and optimize some log content +- !22940 [OLK-6.6][linux-6.6.y sync] Backport 6.6.126-6.6.127 LTS Patches +- ub:ubus: add error return when send config message +- sched/idle: Fall back to idle after failed soft quota repick +- sched/idle: Update SCX idle mask only when picking idle +- urma: Introduce EID patricia trie for primary EID lookup +- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() +- KVM: arm64: reuse vgic_write_guest_lock to suppress spurious WARN_ON when no vCPU is running +- KVM: arm64: add CVM VM check when initializing union to avoid corrupting KABI isolation +- drm: Account property blob allocations to memcg +- net/oenetcls: make rps policy module params read-only +- net/oenetcls: fix async delete race with pending rule add +- net/oenetcls: move listen-time tuple resolution to worker context +- USB: serial: option: add Telit FN920C04 RNDIS compositions +- f2fs: fix to avoid mapping wrong physical block for swapfile +- f2fs: fix zoned block device information initialization +- f2fs: fix to avoid UAF in f2fs_write_end_io() +- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes +- f2fs: fix out-of-bounds access in sysfs attribute read/write +- f2fs: fix to add gc count stat in f2fs_gc_range +- fbdev: smscufx: properly copy ioctl memory to kernelspace +- fbdev: rivafb: fix divide error in nv3_arb() +- Revert "wireguard: device: enable threaded NAPI" +- gpiolib: acpi: Fix gpio count with string references +- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() +- ASoC: cs42l43: Correct handling of 3-pole jack load detection +- platform/x86: panasonic-laptop: Fix sysfs group leak in error path +- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro +- ASoC: amd: yc: Add quirk for HP 200 G2a 16 +- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 +- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used +- romfs: check sb_set_blocksize() return value +- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel +- ALSA: hda/realtek: Add quirk for Inspur S14-G1 +- gpio: sprd: Change sprd_gpio lock to raw_spin_lock +- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list +- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU +- PCI: endpoint: Avoid creating sub-groups asynchronously +- PCI: endpoint: Remove unused field in struct pci_epf_group +- drivers/ub/sentry: delete unimportant logs and optimize some log content +- ub/ubmem-vmmu: optimize prints +- ub/ubmempfd: update note and optimize format +- ub/ubdevshm: Fix spelling errors and optimize prints +- arm64/ACPI: fix build error when CONFIG_ACPI_APEI_GHES is disabled +- RDMA/hns: Fix hung task when drain qp failed. +- RDMA/hns: Support drain SQ and RQ +- RDMA/hns: Fix WQ_MEM_RECLAIM warning +- ub:ubfi: fix the resource maintenance issue in the ubfi ummu node parsing +- scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT +- libceph: define and enforce CEPH_MAX_KEY_LEN +- update rnpgbevf driver to version 1.0.1. +- lib/crypto: chacha: Zeroize permuted_state before it leaves scope +- net: skbuff: preserve shared-frag marker during coalescing +- net: skbuff: propagate shared-frag marker through frag-transfer helpers +- RDMA/hns: Notify ULP of remaining soft-WCs during reset +- RDMA/hns: Fix udca not unregistered when reset entry allocation failed +- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode +- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains +- tools/dma: Add dma_map_sg support +- dma-mapping: benchmark: add support for dma_map_sg +- dma-mapping: benchmark: modify the framework to adapt to more map modes +- urma: fix resource leaks in uburma and ubcore error paths +- ACPI: processor: idle: Reset cpuidle on C-state list changes +- cpuidle: Extract and export no-lock variants of cpuidle_unregister_device() +- cpuidle: Simplify cpuidle_register_device() with guard() +- ACPI: processor: idle: Fix NULL pointer dereference in hotplug path +- ACPI: processor: idle: Reset power_setup_done flag on initialization failure +- ACPI: processor: idle: Remove redundant static variable and rename cstate check function +- ACPI: processor: idle: Move max_cstate update out of the loop +- ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init +- ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states +- ACPI: processor: idle: Rework the handling of acpi_processor_ffh_lpi_probe() +- ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_dev() to void +- ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_states() to void +- ACPI: processor: idle: Add debug log for states with invalid entry methods +- ACPI: processor: idle: Replace strlcat() with better alternative +- ACPI: processor: idle: Add missing bounds check in flatten_lpi_states() +- ACPI: processor: Do not expose global variable acpi_idle_driver +- ACPI: processor: Update cpuidle driver check in __acpi_processor_start() +- ACPI: processor: idle: Redefine two functions as void +- ACPI: processor: idle: Rearrange declarations in header file +- ACPI: processor: Remove unused empty stubs of some functions +- ACPI: processor: idle: Optimize ACPI idle driver registration +- ACPI: processor: idle: Drop redundant C-state count checks +- ACPI: processor: idle: Relocate state flags initialization +- ACPI: processor: idle: Eliminate static variable flat_state_cnt +- sched/fair: fix !CONFIG_SMP build errors +- net/oenetcls: validate module params and reject zero table sizes +- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() +- arm64: kernel: fix Clang integrated assembler errors in entry.S +- update rnpgbevf driver to version 1.0.1. +- arm64: topology: Fix false warning in counters_read_on_cpu() for same-CPU reads +- cpufreq: CPPC: Update FIE arch_freq_scale in ticks for non-PCC regs +- cpufreq: CPPC: Factor out cppc_fie_kworker_init() +- ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() +- cpufreq: CPPC: Don't warn if FIE init fails to read counters +- Revert "cpufreq: CPPC: Don't warn on failing to read perf counters on offline cpus" +- PM / devfreq: use _visible attribute to replace create/remove_sysfs_files() +- cpufreq: Replace magic number +- cpufreq: Update sscanf() to kstrtouint() +- update to sysfs_emit() for safer buffer handling +- net: use skb_header_pointer() for TCPv4 GSO frag_off check +- vxlan: validate ND option lengths in vxlan_na_create +- iommu/pages: Make iommu_put_pages_list() work with high order allocations +- iommu/amd: Fix alias device DTE setting +- iommu/amd: Fix error path in amd_iommu_probe_device() +- iommu/amd: Remove unused PPR_* macros +- iommu/amd: Fix header file +- iommu/amd: Preserve default DTE fields when updating Host Page Table Root +- iommu/amd: Modify set_dte_entry() to use 256-bit DTE helpers +- iommu/amd: Introduce struct ivhd_dte_flags to store persistent DTE flags +- mm: delete the unused put_pages_list() +- iommu/amd/pgtbl_v2: Take protection domain lock before invalidating TLB +- iommu/amd: Fix argument order in amd_iommu_dev_flush_pasid_all() +- iommu/amd: Handle error path in amd_iommu_probe_device() +- iommu/amd: Remove unused DTE_GCR3_INDEX_* macros +- iommu/amd: Invalidate cache before removing device from domain list +- iommu/amd: Introduce per device DTE update function +- configs/hardening: Fix disabling UBSAN configurations +- iommu/amd: use page allocation function provided by iommu-pages.h +- iommu/dma: use iommu_put_pages_list() to releae freelist +- iommu/amd: Fix possible irq lock inversion dependency issue +- iommu/amd: Fix sleeping in atomic context +- iommu/amd: Introduce per-device domain ID to fix potential TLB aliasing issue +- iommu/amd: Refactor GCR3 table helper functions +- iommu/amd: Refactor protection_domain helper functions +- iommu/amd: Refactor attaching / detaching device functions +- iommu/amd: Refactor helper function for setting / clearing GCR3 +- iommu/amd: Rearrange GCR3 table setup code +- iommu/amd: Add support for device based TLB invalidation +- iommu/amd: Introduce per-device GCR3 table +- iommu/amd: Introduce struct protection_domain.pd_mode +- iommu/amd: Introduce get_amd_iommu_from_dev() +- iommu/amd/pgtbl_v2: Invalidate updated page ranges only +- iommu/amd: Make domain_flush_pages as global function +- iommu/amd: Consolidate amd_iommu_domain_flush_complete() call +- iommu/amd: Refactor device iotlb invalidation code +- iommu/amd: Refactor IOMMU tlb invalidation code +- iommu/amd: Add support to invalidate multiple guest pages +- iommu/amd: Remove redundant passing of PDE bit +- iommu/amd: Remove redundant domain flush from attach_device() +- hardening: x86: drop reference to removed config AMD_IOMMU_V2 +- iommu/amd: Miscellaneous clean up when free domain +- iommu/amd: Consolidate logic to allocate protection domain +- hardening: Provide Kconfig fragments for basic options +- iommu/amd: Enable support for up to 2K interrupts per function +- iommu/amd: Rename DTE_INTTABLEN* and MAX_IRQS_PER_TABLE macro +- iommu/amd: Lock DTE before updating the entry with WRITE_ONCE() +- iommu/amd: Introduce helper function get_dte256() +- iommu/amd: Introduce helper function to update 256-bit DTE +- iommu/amd: Update PASID, GATS, GLX, SNPAVICSUP feature related macros +- iommu/amd: Introduce iommu_dev_data.max_pasids +- iommu/amd: Rename amd_iommu_v2_supported() as amd_iommu_pasid_supported() +- iommu/amd: Pass struct iommu_dev_data to set_dte_entry() +- iommu/amd: Remove unused EXPORT_SYMBOLS +- iommu/amd: Remove amd_iommu_device_info() +- iommu/amd: Introduce iommu_dev_data.flags to track device capabilities +- iommu/amd: Introduce iommu_dev_data.ppr +- iommu/amd: Rename ats related variables +- iommu/amd: Modify logic for checking GT and PPR features +- iommu/amd: Replace slab cache allocator with page allocator +- iommu/vt-d: add wrapper functions for page allocations +- iommu/amd: Introduce generic function to set multibit feature value +- iommu/amd: Move PPR-related functions into ppr.c +- iommu/amd: Remove PPR support +- iommu/amd: Remove iommu_v2 module +- iommu/amd: Consolidate feature detection and reporting logic +- iommu/amd: Introduce helper functions for managing GCR3 table +- iommu/amd: Consolidate timeout pre-define to amd_iommu_type.h +- arch/x86/mm: reserve memblock for CSV3 guest +- nbd: remove queue freeze in nbd_add_socket +- nbd: remove redundant num_connections boundary checks +- nbd: replace socks pointer array with xarray +- nbd: simplify find_fallback() by removing redundant logic +- ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() +- bnxt_en: Update firmware interface to 1.10.2.171 + +* Wed May 27 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-155.0.0.141 +- !22935 iommu/ummu: Adapt disable DVM +- !22522 [OLK-6.6]LoongArch: KVM:update patches from upstream +- !22468 [OLK-6.6] x86/microcode: Add Zhaoxin cpu microcode update driver +- iommu/ummu: Adapt disable DVM +- !22925 Fix hist_field_name issue +- !22864 drivers/ub/sentry: Add timestamp logging and optimize ACK wait loop +- !22735 drivers/ub/sentry: support link up/down event +- !22874 urma: zero-initialize cg_obj to prevent uninitialized memory access +- tracing: Avoid NULL return from hist_field_name() on truncation +- tracing: Fix fully-qualified variable reference printing in histograms +- tracing: Rebuild full_name on each hist_field_name() call +- !22868 tracing/probe: reject non-closed empty immediate strings +- !22867 tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() +- !22862 tracing: branch: Fix inverted check on stat tracer registration +- !22817 PCI/IOV: Fix use-after-free in pci_iov_remove_virtfn() +- !22543 netkit, bpf: Add bpf programmable net device +- drivers/ub/sentry: Add timestamp logging and optimize ACK wait loop +- !22860 ub:ubus: bugfix for QEMU'addr 8byte check +- !22891 sched: Remove redundant rcu_read_lock() in build_soft_domain() +- !22838 [OLK-6.6][linux-6.6.y sync] Backport 6.6.124-6.6.125 LTS Patches +- !22828 sched/idle: Preserve prev task for soft quota fair repick +- sched: Remove redundant rcu_read_lock() in build_soft_domain() +- !22859 ub: cdma: move cleanup helper to event and remove unused include +- !22244 Fix CVE-2026-31729 +- !22469 LoongArch: KVM: fix vm start failed +- !22129 [Hygon][6.6][Feature] KVM: x86: Add support for CPUID leaf 0x8C860000 +- PCI/IOV: Fix use-after-free in pci_iov_remove_virtfn() +- !22800 Fix CVE-2026-43381 +- !22849 pstore/ram: fix resource leak when ioremap() fails +- !22815 【OLK-6.6】crypto：Fix panic caused by OFB and CFB self-test failure when starting in FIPS mode. +- !22666 Fix CVE-2026-43037 +- !22627 Fix CVE-2026-43038 +- !22626 Fix CVE-2026-43040 +- !22638 Fix CVE-2026-43057 +- sched/idle: Fix soft quota fair repick state handling +- !22697 x86/sev: Fix potential sign extension in amd_enc_status_change_finish() +- drivers/ub/sentry: add link down/up event detection and reporting +- !22740 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y +- !22779 [OLK-6.6] PCI: Fix PCIe unplug Enumeration Long Blocking Issue +- urma: zero-initialize cg_obj to prevent uninitialized memory access +- !22539 mm: introduce CMA-based folio allocation +- ub:ubus: bugfix for QEMU'addr 8byte check +- tracing/probe: reject non-closed empty immediate strings +- tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() +- tracing: branch: Fix inverted check on stat tracer registration +- x86/microcode: Add Zhaoxin cpu microcode update driver +- ub:ubus: bugfix for UE probe without MUE'lock +- ub:ubus: Fixing the bug of concurrent hotplug and device reset +- ub: cdma: move cleanup helper to event and remove unused include +- !22798 sched/fair: Do not send IPI if WFI timeout is 0 +- pstore/ram: fix resource leak when ioremap() fails +- !22790 v2 Fix NULL pointer dereference +- !22816 Fix CVE-2026-43492 +- Revert "driver core: enforce device_lock for driver_match_device()" +- gpio: omap: do not register driver in probe() +- mm/cma_folio: make CMA folio allocation per-task opt-in via procfs +- mm: introduce CMA-based folio allocation +- ub: cdma: fix multiple code quality and potential bug issues +- !22772 Fix CVE-2026-43493 +- vsock/test: verify socket options after setting them +- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module +- scsi: qla2xxx: Query FW again before proceeding with login +- scsi: qla2xxx: Allow recovery for tape devices +- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() +- nilfs2: Fix potential block overflow that cause system hang +- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req +- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly +- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store +- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB +- driver core: enforce device_lock for driver_match_device() +- !22758 bpf mainline for olk-6.6 +- !22463 net/hinic5: Add Huawei Intelligent Network Card Driver: hinic5 +- !21813 [OLK-6.6] cpufreq: Add CPU frequency policy change notification support +- !21806 [OLK-6.6] efi/cper: Print correctable AER information +- !22016 [OLK-6.6] Loongarch: Fixed warning about legacy_boot.h when build kernel +- !22708 libbpf: Fix -Wdiscarded-qualifiers under C23 +- net/hinic5: Add Huawei Intelligent Network Card Driver: hinic5 +- !22821 config: x86: Restore CONFIG_INIT_STACK_ALL_{PATTERN,ZERO} in openeuler_defconfig +- config: x86: Restore CONFIG_INIT_STACK_ALL_{PATTERN,ZERO} in openeuler_defconfig +- !21802 [OLK-6.6] pinctrl/zhaoxin: Refactor KH50000 pinctrl to support multi‑socket +- !22730 [OLK-6.6] Backport Upstream patches of Hygon Platform QoS +- !22781 ipmi: hisi_pso: fix atomic sleep and use-after-free via async workqueue +- !22752 Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists +- lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() +- crypto：Fix panic caused by OFB and CFB self-test failure when starting in FIPS mode. +- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels +- config: Enable NETKIT +- set BPF_NETKIT_PRIMARY=54, BPF_NETKIT_PEER=55 +- add __GENKSYMS__ in uapi bpf.h and if_link.h +- !22799 ub: udma: alloc jfc_id avoid the ccu/starts type. +- !22547 iommu/ummu: Use non mirror mem. +- !22548 iommu/ummu: Introduce struct ummu_device_event +- nouveau/dpcd: return EBUSY for aux xfer if the device is asleep +- LoongArch: KVM: Move unconditional delay into timer clear scenery +- LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software +- LoongArch: KVM: Move AVEC interrupt injection into switch loop +- LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() +- LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() +- LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS +- LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry +- LoongArch: KVM: Compile switch.S directly into the kernel +- LoongArch: KVM: Add DMSINTC inject msi to vCPU +- LoongArch: KVM: Add DMSINTC device support +- LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function +- LoongArch: KVM: Move host CSR_GSTAT save and restore in context switch +- LoongArch: KVM: Move host CSR_EENTRY save and restore in context switch +- LoongArch: KVM: Check kvm_request_pending() in kvm_late_check_requests() +- LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel() +- LoongArch: KVM: Handle the case that EIOINTC's coremap is empty +- LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust +- LoongArch: KVM: Fix typo issue in kvm_vm_init_features() +- LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side +- LoongArch: KVM: Add paravirt preempt feature in hypervisor side +- LoongArch: KVM: Set default return value in KVM IO bus ops +- LoongArch: KVM: Add FPU/LBT delay load support +- LoongArch: KVM: Move LBT capability check in exception handler +- LoongArch: KVM: Move LASX capability check in exception handler +- LoongArch: KVM: Move LSX capability check in exception handler +- LoongArch: KVM: Handle LOONGARCH_CSR_IPR during vCPU context switch +- LoongArch: KVM: Check VM msgint feature during interrupt handling +- LoongArch: KVM: Add msgint registers in kvm_init_gcsr_flag() +- LoongArch: KVM: Move feature detection in kvm_vm_init_features() +- LoongArch: KVM: Add more CPUCFG mask bits +- LoongArch: Complete CPUCFG registers definition +- crypto: virtio - Replace package id with numa node id +- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req +- ACPICA: iASL: Add definitions for the IOVT table +- LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy() +- LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy() +- LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy() +- LoongArch: Add and use some macros for AVEC +- LoongArch: KVM: Fix the compatibility issue between eioint and the upstream qemu +- LoongArch: KVM: Add AVEC basic support +- LoongArch: KVM: Get VM PMU capability from HW GCFG register +- LoongArch: KVM: Register perf callbacks for guest +- LoongArch: KVM: Implement arch-specific functions for guest perf +- LoongArch: KVM: Remove PGD saving during VM context switch +- LoongArch: KVM: Rework pch_pic_update_batch_irqs() +- LoongArch: KVM: Add different length support in loongarch_pch_pic_write() +- LoongArch: KVM: Add different length support in loongarch_pch_pic_read() +- LoongArch: KVM: Add IRR and ISR register read emulation +- LoongArch: KVM: Set version information at initial stage +- LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_pch_pic_regs_access() +- LoongArch: KVM: Add address alignment check in pch_pic register access +- LoongArch: KVM: Add stat information with kernel irqchip +- LoongArch: KVM: sync pch_pic to upstream +- LoongArch: KVM: Access mailbox directly in mail_send() +- LoongArch: KVM: Add implementation with IOCSR_IPI_SET +- CVE-2025-39704: LoongArch: KVM: Fix stack protector issue in send_ipi_data() +- LoongArch: KVM: sync kvm_ipi to upstream +- LoongArch: KVM: Ensure that kvm eiointc is compatible with older versions +- LoongArch: KVM: Use 64-bit register definition for EIOINTC +- LoongArch: KVM: Fix max supported vCPUs set with EIOINTC +- LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_sw_status_access() +- LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_ctrl_access() +- LoongArch: KVM: Replace eiointc_enable_irq() with eiointc_update_irq() +- LoongArch: KVM: Use generic function loongarch_eiointc_write() +- LoongArch: KVM: Use generic function loongarch_eiointc_read() +- LoongArch: KVM: Use standard bitops API with eiointc +- LoongArch: KVM: Remove never called default case statement +- LoongArch: KVM: Remove unused parameter len +- LoongArch: KVM: Remove unnecessary local variable +- LoongArch: KVM: Disable updating of "num_cpu" and "feature" +- CVE-2025-38366: LoongArch: KVM: Check validity of "num_cpu" from user space +- LoongArch: KVM: Check interrupt route from physical CPU +- LoongArch: KVM: Fix interrupt route update with EIOINTC +- LoongArch: KVM: Add address alignment check for IOCSR emulation +- drivers/iommu: Fixed the problem that some network cards in dpdk could not work properly with iommu +- sched/fair: Do not send IPI if WFI timeout is 0 +- ub: udma: alloc jfc_id avoid the ccu/starts type. +- ub: udma: optimize the remove process. +- CVE-2025-38367: LoongArch: KVM: Avoid overflow with array index +- LoongArch: KVM: sync eiointc to upstream +- LoongArch: KVM: Delete the kvm mmu interfaces that are no longer in use +- LoongArch: KVM: Fix VM migration failure with PTW enabled +- LoongArch: KVM: Do not flush tlb if HW PTW supported +- LoongArch: KVM: Skip PMU checking on vCPU context switch +- LoongArch: KVM: Add sign extension with kernel IOCSR read emulation +- LoongArch: KVM: Add sign extension with kernel MMIO read emulation +- irqchip/loongson-eiointc: Add multiple interrupt pin routing support +- irqchip/loongson-eiointc: Add virt extension support +- irqchip/loongson-eiointc: Route interrupt parsed from bios table +- LoongArch: KVM: Protect kvm_io_bus_{read,write}() with SRCU +- LoongArch: config: enable paravirt feature +- x86/sev: Fix potential sign extension in amd_enc_status_change_finish() +- ipmi: hisi_pso: fix atomic sleep and use-after-free via async workqueue +- bpf: Fix tcx/netkit detach permissions when prog fd isn't given +- bpf: align CAP_NET_ADMIN checks with bpf_capable() approach +- rtnetlink: add needed_{head,tail}room attributes +- bpftool: Fix cgroup command to only show cgroup bpf programs +- netkit: Allow for configuring needed_{head,tail}room +- selftests/bpf: Extend netkit tests to validate skb meta data +- tools: Sync if_link.h uapi tooling header +- netkit: Simplify netkit mode over to use NLA_POLICY_MAX +- netkit: Add option for scrubbing skb meta data +- netkit: Disable netpoll support +- bpftool: Query only cgroup-related attach types +- selftests/bpf: Add netkit test for pkt_type +- selftests/bpf: Add netkit tests for mac address +- netkit: Fix pkt_type override upon netkit pass verdict +- netkit: Fix setting mac address in l2 mode +- bpf, docs: Fix bpf_redirect_peer header doc +- bpf: Add missing BPF_LINK_TYPE invocations +- netkit: Reject IFLA_NETKIT_PEER_INFO in netkit_change_link +- selftests/bpf: Add netkit to tc_redirect selftest +- bpf, netkit: Add indirect call wrapper for fetching peer dev +- netkit: Add tstats per-CPU traffic counters +- netkit: Remove explicit active/peer ptr initialization +- selftests/bpf: Add selftests for netkit +- bpftool: Extend net dump with netkit progs +- bpftool: Implement link show support for netkit +- libbpf: Add link-based API for netkit +- tools: Sync if_link uapi header +- netkit, bpf: Add bpf programmable net device +- !22738 tracepoints: get correct superblock from dentry in event btrfs_sync_file() +- !22649 e1000/e1000e: Fix leak in DMA error cleanup +- xSched: fix NULL pointer dereference in cfs_rq during class switch +- xSched/dmem: memory allocation size must larger than 0 +- xSched: prevent HBM allocation for non-AI tasks +- xSched: fix incorrect error returns in vstream allocation +- xSched/cgroup: remove legacy cftypes due to cgroup v1 incompatibility +- !22546 iommu/ummu: Optimized ubmem register compatibility +- !22545 iommu/ummu: Support pplb. +- !22732 urma: add rate limit for modify jetty error logs +- !22467 rme: add debugfs nodes for rme firmware log control +- PCI: Fix PCIe unplug Enumeration Long Blocking Issue +- !22766 mfs: fix inode resource leak when cache object fd is zero +- urma: add rate limit for modify error logs +- crypto: pcrypt - Fix handling of MAY_BACKLOG requests +- mfs: fix inode resource leak when cache object fd is zero +- !22656 [OLK-6.6][linux-6.6.y sync] Backport 6.6.123-6.6.124 LTS Patches +- bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path +- bpf: Use copy_map_value_locked() in alloc_htab_elem() for BPF_F_LOCK +- bpf: Fix OOB in pcpu_init_value +- bpf: Fix stale offload->prog pointer after constant blinding +- bpf: fix end-of-list detection in cgroup_storage_get_next_key() +- bpf: Fix RCU stall in bpf_fd_array_map_clear() +- bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks +- bpf: Fix use-after-free in offloaded map/prog info fill +- bpf, arm64: Fix off-by-one in check_imm signed range check +- bpf: Fix NULL deref in map_kptr_match_type for scalar regs +- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists +- !22268 vsock driver add translate cid and gpa interface +- rme: add debugfs nodes for rme firmware log control +- !22613 [OLK-6.6] Fix CVE-2026-31668 +- rme: reorder hisi_ext_cmd enum values by numeric order +- nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free +- btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() +- btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() +- !22659 mm/userswap: Fix NULL pointer dereference with unaligned small mremap length +- !22706 drivers/ub/sentry: Reduce the sleep time of sentry_urma_kthread thread +- x86/resctrl: Fix memory bandwidth counter width for Hygon +- x86/resctrl: Add missing resctrl initialization for Hygon +- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper +- x86/cpu/hygon: Clean up out-of-tree resctrl code +- libbpf: Fix -Wdiscarded-qualifiers under C23 +- drivers/ub/sentry: Reduce the sleep time of sentry_urma_kthread thread +- ub: cdma: specify log and add hardware version +- ub: cdma: reconstruct the event reporting module +- ip6_tunnel: clear skb2->cb[] in ip4ip6_err() +- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler +- dpaa2-switch: do not clear any interrupts automatically +- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom +- mm/userswap: Fix NULL pointer dereference with unaligned small mremap length +- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. +- spi: tegra114: Preserve SPI mode bits in def_command1_reg +- spi: tegra: Fix a memory leak in tegra_slink_probe() +- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() +- hwmon: (occ) Mark occ_init_attribute() as __printf +- drm/mgag200: fix mgag200_bmc_stop_scanout() +- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() +- tipc: use kfree_sensitive() for session key material +- net: don't touch dev->stats in BPF redirect paths +- dpaa2-switch: add bounds check for if_id in IRQ handler +- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup +- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup +- net: liquidio: Initialize netdev pointer before queue setup +- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero +- platform/x86: hp-bioscfg: Skip empty attribute names +- platform/x86: intel_telemetry: Fix PSS event register mask +- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines +- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice +- wifi: mac80211: correctly check if CSA is active +- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU +- wifi: cfg80211: Fix bitrate calculation overflow for HE rates +- ASoC: tlv320adcx140: Propagate error codes during probe +- ASoC: amd: yc: Fix microphone on ASUS M6500RE +- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe +- wifi: mac80211: collect station statistics earlier when disconnect +- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free +- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) +- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() +- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list +- netfilter: replace -EEXIST with -EBUSY +- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk +- HID: playstation: Center initial joystick axes to prevent spurious events +- HID: intel-ish-hid: Reset enum_devices_done before enumeration +- btrfs: fix reservation leak in some error paths when inserting inline extent +- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL +- HID: intel-ish-hid: Update ishtp bus match to support device ID table +- LoongArch: Enable exception fixup for specific ADE subcode +- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED +- block,bfq: fix aux stat accumulation destination +- net: usb: sr9700: support devices with virtual driver CD +- wifi: wlcore: ensure skb headroom before skb_push +- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined +- tracing: Fix ftrace event field alignments +- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures +- binderfs: fix ida_alloc_max() upper bound +- binder: fix BR_FROZEN_REPLY error log +- ublk: fix deadlock when reading partition table +- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" +- ARM: 9468/1: fix memset64() on big-endian +- rbd: check for EOD after exclusive lock is ensured to be held +- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains +- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup +- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset +- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup +- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state +- platform/x86: intel_telemetry: Fix swapped arrays in PSS output +- e1000/e1000e: Fix leak in DMA error cleanup +- iommu/ummu: Support pplb. +- net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback +- ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() +- net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak +- net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels +- seg6: separate dst_cache for input and output paths in seg6 lwtunnel +- net: ipv6: fix dst ref loop on input in rpl lwt +- net: ipv6: rpl_iptunnel: mitigate 2-realloc issue +- net: ipv6: fix dst ref loop on input in seg6 lwt +- net: ipv6: seg6_iptunnel: mitigate 2-realloc issue +- iommu/ummu: Introduce struct ummu_device_event +- iommu/ummu: Use non mirror mem. +- iommu/ummu: Optimized ubmem register compatibility +- iommu/ummu: Support free_bit. +- iommu/ummu: Optimized stage2 bypass support +- pinctrl/zhaoxin: Refactor KH50000 pinctrl to support multi‑socket +- LoongArch: KVM: fix vm start fail +- vsock driver add translate cid and gpa interface +- efi/cper: Print correctable AER information +- pinctrl: zhaoxin: kx7000: Fix logic error in GPIO type mapping +- usb: typec: ucsi: skip connector validation before init +- usb: typec: ucsi: validate connector number in ucsi_notify_common() +- KVM: x86: Add support for CPUID leaf 0x8C860000 +- Loongarch: Fixed warning about legacy_boot.h when build kernel +- cpufreq: Add CPU frequency policy change notification support + +* Wed May 20 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-154.0.0.140 +- !22660 Fix CVE-2026-43119 +- !22696 CVEs +- !22652 Fix CVE-2026-43223 +- !22651 Fix CVE-2026-43472 +- !22329 Fix CVE-2026-31752 +- !22709 config: x86: Fix CI "checkdefconfig" warning by updating defconfig +- config: x86: Fix CI "checkdefconfig" warning by updating defconfig +- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ +- fbcon: check return value of con2fb_acquire_newinfo() +- !22646 obmm: implement 64K pagesize support +- !22580 obmm: fix GDB/ptrace support and enhance ownership tracking on device-based memory +- !22542 ub: cdma: add software TLB invalidation for KSVA memory +- !22661 USB: core: Limit the length of unkillable synchronous timeouts +- !22124 CVE-2026-31503 +- !22567 Fix CVE-2026-43170 +- !22475 Fix CVE-2026-43427 +- !22643 KVM: arm64: Fix timer_early_inject conflict with CVM +- USB: core: Limit the length of unkillable synchronous timeouts +- !22599 Fix dup panic +- Bluetooth: hci_sync: annotate data-races around hdev->req_status +- !21825 [OLK-6.6] Decouple resctrl x86 with mpam and backport Intel RDT-SNC and AET +- media: pvrusb2: fix URB leak in pvr2_send_request_ex +- unshare: fix unshare_fs() handling +- !22479 crypto: hisilicon - turn mainline patch +- !22561 virtCCA-Live-Migration: Add host agent support for CVM live migration +- !22563 fix migvm_queue_dev_mmap buffer check +- !22449 [OLK-6.6][linux-6.6.y sync] Backport 6.6.122-6.6.123 LTS Patches +- !21130 [OLK-6.6] Hygon: Update ccp-crypto driver, to support SM4-XTS/GCM and model 10h cpu +- KVM: arm64: Fix timer_early_inject conflict with CVM +- virtCCA-Live-Migration: Add host agent support for CVM live migration +- !22600 sched_ext: Sync openeuler_defconfig for sched_ext +- fix migvm_queue_dev_mmap buffer check +- !22530 KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated +- !22535 usb: xhci: Prevent interrupt storm on host controller error (HCE) +- ub/obmm: set OBMM_BASIC_GRANU to 2M rather than PMD_SIZE +- obmm: relax contig_mem_pool restriction for 64KB pages +- obmm: add VMA access for ptrace/GDB on PFNMAP regions +- obmm: support VMA split with ownership-aligned attributes +- !22560 net/oenetcls: Limit rxqs against combined_channels +- !22523 net/oenetcls: free sk entry hash on ntuple cleanup +- !22315 sched/fair: Fix overflow in vruntime_eligible() +- obmm: refactor ownership tracking for PMD-granularity support +- !22564 Fix CVE-2026-43212 +- !22514 ceph: add a bunch of missing ceph_path_info initializers +- !22559 blk-cgroup: skip dying blkg in blkcg_activate_policy() +- x86: config: Enable resctrl related configs +- !22055 urma: fix the panic when ipourma module is repeatedly loaded +- sched_ext: Sync openeuler_defconfig for sched_ext +- alloc_fdtable(): change calling conventions. +- fs: consistently deref the files table with rcu_dereference_raw() +- !22462 net: ipa: fix event ring index not programmed for IPA v5.0+ +- !22551 net/oenetcls: RPS enhancements and bug fixes +- !22182 Fix CVE-2026-31755 +- !22576 arm64: entry: Fix missing sync_sei in irq_ventry +- obmm: fix PTE protection bits for READWRITE mappings +- arm64: entry: Fix missing sync_sei in irq_ventry +- crypto: hisilicon - remove unused and non-public APIs for qm and sec +- crypto: hisilicon/qm - drop redundant variable initialization +- crypto: hisilicon/qm - remove else after return +- crypto: hisilicon/qm - add const qualifier to info_name in struct qm_cmd_dump_item +- crypto: hisilicon - fix the format string type error +- crypto: hisilicon/sec2 - prevent req used-after-free for sec +- crypto: hisilicon - add device load query functionality to debugfs +- crypto: hisilicon/qm - increase wait time for mailbox +- crypto: hisilicon/qm - obtain the mailbox configuration at one time +- crypto: hisilicon/qm - remove unnecessary code in qm_mb_write() +- Revert "crypto: hisilicon/qm - obtain the mailbox configuration at one time" +- Revert "hisi_acc_vfio_pci: obtain the mailbox configuration at one time" +- crypto: hisilicon/qm - move the barrier before writing to the mailbox register +- crypto: hisilicon/zip - add lz4 algorithm for hisi_zip +- !22287 patchset for sched_ext +- usb: dwc3: gadget: Move vbus draw to workqueue context +- !22504 dm: clear cloned request bio pointer when last clone bio completes +- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE +- !22554 CVE-2026-46333 +- net/oenetcls: Limit rxqs against combined_channels +- blk-cgroup: skip dying blkg in blkcg_activate_policy() +- ptrace: Fix kabi breakage in struct task_struct +- ptrace: slightly saner 'get_dumpable()' logic +- net/oenetcls: remove duplicated linux/inet.h include +- config: Enable SMT_QOS +- arm64: Add arch code for SMT QoS +- sched/fair: Add SMT QoS sched core code +- sched/fair: Move dynamic affinity helper functions to sched.h +- sched: Add qos_sched_enabled() helper for future expansion +- sched: Split out QOS_LEVEL from QOS_SCHED for reuse +- sched_ext: Update comments replacing breather with aborting mechanism +- sched_ext: Pass held rq to SCX_CALL_OP() for core_sched_before +- sched_ext: Pass held rq to SCX_CALL_OP() for dump_cpu/dump_task +- sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed iter_new +- sched_ext: Use WRITE_ONCE() for the write side of scx_enable helper pointer +- tools/sched_ext: update scx_show_state.py for scx_aborting change +- scx_central: Defer timer start to central dispatch to fix init error +- sched_ext: Fix ops.cgroup_move() invocation kf_mask and rq tracking +- sched_ext: Track @p's rq lock across set_cpus_allowed_scx -> ops.set_cpumask +- sched_ext: Fix stale direct dispatch state in ddsp_dsq_id +- sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback +- selftests/sched_ext: Add missing error check for exit__load() +- sched_ext: Fix enqueue_task_scx() truncation of upper enqueue flags +- sched_ext: Fix starvation of scx_enable() under fair-class saturation +- sched_ext: Disable preemption between scx_claim_exit() and kicking helper work +- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() +- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() +- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() +- sched_ext: Fix bypass depth leak on scx_enable() failure +- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks +- sched_ext: Exit dispatch and move operations immediately when aborting +- sched_ext: Simplify breather mechanism with scx_aborting flag +- sched_ext: Use per-CPU DSQs instead of per-node global DSQs in bypass mode +- sched_ext: Refactor do_enqueue_task() local and global DSQ paths +- sched_ext: Fix SCX_KICK_WAIT to work reliably +- tools/sched_ext: Provide a compatible helper for scx_bpf_events() +- tools/sched_ext: Sync with scx repo +- sched_ext: Add scx_bpf_events() and scx_read_event() for BPF schedulers +- sched_ext: Use SCX_TASK_READY test instead of tryget_task_struct() during class switch +- sched_ext: Fix unsafe locking in the scx_dump_state() +- sched_ext: Don't kick CPUs running higher classes +- sched_ext: Always use SMP versions in kernel/sched/ext.c +- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU +- sched_ext: Drop kfuncs marked for removal in 6.15 +- sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl() +- sched/ext: Prevent update_locked_rq() calls with NULL rq +- sched_ext: Fix rq lock state in hotplug ops +- sched_ext: Remove duplicate BTF_ID_FLAGS definitions +- rhashtable: Fix rhashtable_try_insert test +- sched_ext: Make scx_kf_allowed_if_unlocked() available outside ext.c +- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() +- sched_ext: Make scx_group_set_weight() always update tg->scx.weight +- sched/ext: Fix invalid task state transitions on class switch +- sched/fair: Fix sched_can_stop_tick() for fair tasks +- sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator +- sched_ext: Fix missing rq lock in scx_bpf_cpuperf_set() +- sched_ext: Make scx_locked_rq() inline +- sched_ext: Track currently locked rq +- sched_ext: Move built-in idle CPU selection policy to a separate file +- sched_ext: Implement SCX_OPS_ALLOW_QUEUED_WAKEUP +- selftests/sched_ext: Fix exit selftest hang on UP +- sched_ext: Use kvzalloc for large exit_dump allocation +- sched_ext: create_dsq: Return -EEXIST on duplicate request +- rhashtable: Fix potential deadlock by moving schedule_work outside lock +- tools include UAPI: Sync linux/sched.h copy with the kernel sources +- sched/doc: Update documentation after renames and synchronize Chinese version +- sched/fair: Remove stale FREQUENCY_UTIL comment +- <linux/cleanup.h>: Allow the passing of both iomem and non-iomem pointers to no_free_ptr() +- file: add take_fd() cleanup helper +- sched/ext: Remove sched_fork() hack +- sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance() +- sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx +- sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h. +- sched_ext: selftests: Fix grammar in tests description +- sched_ext: Fix incorrect assumption about migration disabled tasks in task_can_run_on_remote_rq() +- sched_ext: Fix migration disabled handling in targeted dispatches +- sched_ext: Implement auto local dispatching of migration disabled tasks +- sched_ext: Fix incorrect time delta calculation in time_delta() +- sched_ext: Fix lock imbalance in dispatch_to_local_dsq() +- sched_ext: selftests/dsp_local_on: Fix selftest on UP systems +- tools/sched_ext: Add helper to check task migration state +- sched_ext: Fix incorrect autogroup migration detection +- sched_ext: selftests/dsp_local_on: Fix sporadic failures +- selftests/sched_ext: Fix enum resolution +- sched_ext: Include task weight in the error state dump +- sched_ext: Fixes typos in comments +- sched_ext: fix kernel-doc warnings +- sched_ext: Use time helpers in BPF schedulers +- sched_ext: Replace bpf_ktime_get_ns() to scx_bpf_now() +- sched_ext: Add time helpers for BPF schedulers +- sched_ext: Add scx_bpf_now() for BPF scheduler +- sched_ext: Implement scx_bpf_now() +- sched_ext: Relocate scx_enabled() related code +- sched_ext: Add option -l in selftest runner to list all available tests +- sched_ext: Include remaining task time slice in error state dump +- sched_ext: update scx_bpf_dsq_insert() doc for SCX_DSQ_LOCAL_ON +- sched_ext: idle: small CPU iteration refactoring +- sched_ext: idle: introduce check_builtin_idle_enabled() helper +- sched_ext: idle: clarify comments +- sched_ext: idle: use assign_cpu() to update the idle cpumask +- cpumask: introduce assign_cpu() macro +- sched_ext: Use str_enabled_disabled() helper in update_selcpu_topology() +- sched_ext: Use sizeof_field for key_len in dsq_hash_params +- tools/sched_ext: Receive updates from SCX repo +- sched_ext: Use the NUMA scheduling domain for NUMA optimizations +- sched_ext: keep running prev when prev->scx.slice != 0 +- sched_ext: idle: Refresh idle masks during idle-to-idle transitions +- sched_ext: switch class when preempted by higher priority scheduler +- sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass() +- sched_ext: Fix dsq_local_on selftest +- sched_ext: initialize kit->cursor.flags +- sched_ext: Fix invalid irq restore in scx_ops_bypass() +- MAINTAINERS: add me as reviewer for sched_ext +- MAINTAINERS: add self as reviewer for sched_ext +- scx: Fix maximal BPF selftest prog +- sched_ext: fix application of sizeof to pointer +- selftests/sched_ext: fix build after renames in sched_ext API +- sched_ext: Add __weak to fix the build errors +- sched_ext: Replace scx_next_task_picked() with switch_class() in comment +- sched_ext: Rename scx_bpf_dispatch[_vtime]_from_dsq*() -> scx_bpf_dsq_move[_vtime]*() +- sched_ext: Rename scx_bpf_consume() to scx_bpf_dsq_move_to_local() +- sched_ext: Rename scx_bpf_dispatch[_vtime]() to scx_bpf_dsq_insert[_vtime]() +- sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked context +- sched_ext: add a missing rcu_read_lock/unlock pair at scx_select_cpu_dfl() +- sched_ext: Clarify sched_ext_ops table for userland scheduler +- sched_ext: Enable the ops breather and eject BPF scheduler on softlockup +- watchdog/softlockup: Report the most frequent interrupts +- watchdog/softlockup: Low-overhead detection of interrupt storm +- genirq: Provide a snapshot mechanism for interrupt statistics +- genirq: Fix kabi for kstat_irqs in struct irq_desc +- genirq: Convert kstat_irqs to a struct +- genirq: Deduplicate interrupt descriptor initialization +- sched_ext: Avoid live-locking bypass mode switching +- sched_ext: Fix incorrect use of bitwise AND +- sched_ext: Do not enable LLC/NUMA optimizations when domains overlap +- sched_ext: Introduce NUMA awareness to the default idle selection policy +- sched_ext: Replace set_arg_maybe_null() with __nullable CFI stub tags +- sched_ext: Rename CFI stubs to names that are recognized by BPF +- sched_ext: Introduce LLC awareness to the default idle selection policy +- sched_ext: Clarify ops.select_cpu() for single-CPU tasks +- sched_ext: improve WAKE_SYNC behavior for default idle CPU selection +- sched_ext: Use btf_ids to resolve task_struct +- sched/ext: Use tg_cgroup() to elieminate duplicate code +- sched/ext: Fix unmatch trailing comment of CONFIG_EXT_GROUP_SCHED +- sched_ext: Factor out move_task_between_dsqs() from scx_dispatch_from_dsq() +- sched_ext: ops.cpu_acquire() should be called with SCX_KF_REST +- sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx() +- sched_ext: Update scx_show_state.py to match scx_ops_bypass_depth's new type +- sched_ext: Add a missing newline at the end of an error message +- sched_ext: Fix enq_last_no_enq_fails selftest +- sched_ext: Make cast_mask() inline +- scx: Fix raciness in scx_ops_bypass() +- scx: Fix exit selftest to use custom DSQ +- sched_ext: Fix function pointer type mismatches in BPF selftests +- selftests/sched_ext: add order-only dependency of runner.o on BPFOBJ +- sched: Pass correct scheduling policy to __setscheduler_class +- sched: Add __setscheduler_class() for sched_ext +- sched_ext: Remove unnecessary cpu_relax() +- sched_ext: Don't hold scx_tasks_lock for too long +- sched_ext: Move scx_tasks_lock handling into scx_task_iter helpers +- sched_ext: bypass mode shouldn't depend on ops.select_cpu() +- sched_ext: Move scx_buildin_idle_enabled check to scx_bpf_select_cpu_dfl() +- sched_ext: Start schedulers with consistent p->scx.slice values +- Revert "sched_ext: Use shorter slice while bypassing" +- sched_ext: use correct function name in pick_task_scx() warning message +- selftests: sched_ext: Add sched_ext as proper selftest target +- sched_ext: Documentation: Update instructions for running example schedulers +- sched_ext, scx_qmap: Add and use SCX_ENQ_CPU_SELECTED +- sched/core: Add ENQUEUE_RQ_SELECTED to indicate whether ->select_task_rq() was called +- sched/core: Make select_task_rq() take the pointer to wake_flags instead of value +- sched_ext: scx_cgroup_exit() may be called without successful scx_cgroup_init() +- sched_ext: Improve error reporting during loading +- sched_ext: Add __weak markers to BPF helper function decalarations +- sched_ext: Remove redundant p->nr_cpus_allowed checker +- sched_ext: Decouple locks in scx_ops_enable() +- sched_ext: Decouple locks in scx_ops_disable_workfn() +- sched_ext: Add scx_cgroup_enabled to gate cgroup operations and fix scx_tg_online() +- sched_ext: Enable scx_ops_init_task() separately +- sched_ext: Fix SCX_TASK_INIT -> SCX_TASK_READY transitions in scx_ops_enable() +- sched_ext: Initialize in bypass mode +- sched_ext: Remove SCX_OPS_PREPPING +- sched_ext: Relocate check_hotplug_seq() call in scx_ops_enable() +- sched_ext: Use shorter slice while bypassing +- sched_ext: Split the global DSQ per NUMA node +- sched_ext: Relocate find_user_dsq() +- sched_ext: Allow only user DSQs for scx_bpf_consume(), scx_bpf_dsq_nr_queued() and bpf_iter_scx_dsq_new() +- scx_flatcg: Use a user DSQ for fallback instead of SCX_DSQ_GLOBAL +- tools/sched_ext: Receive misc updates from SCX repo +- sched_ext: Add __COMPAT helpers for features added during v6.12 devel cycle +- sched_ext: Build fix for !CONFIG_SMP +- sched_ext: Provide a sysfs enable_seq counter +- sched_ext: Fix build when !CONFIG_STACKTRACE +- sched_ext: Don't trigger ops.quiescent/runnable() on migrations +- sched_ext: Synchronize bypass state changes with rq lock +- scx_qmap: Implement highpri boosting +- sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq() +- sched_ext: Compact struct bpf_iter_scx_dsq_kern +- sched_ext: Replace consume_local_task() with move_local_task_to_local_dsq() +- sched_ext: Move consume_local_task() upward +- sched_ext: Move sanity check and dsq_mod_nr() into task_unlink_from_dsq() +- sched_ext: Reorder args for consume_local/remote_task() +- sched_ext: Restructure dispatch_to_local_dsq() +- sched_ext: Fix processs_ddsp_deferred_locals() by unifying DTL_INVALID handling +- sched_ext: Make find_dsq_for_dispatch() handle SCX_DSQ_LOCAL_ON +- sched_ext: Refactor consume_remote_task() +- sched_ext: Rename scx_kfunc_set_sleepable to unlocked and relocate +- sched_ext: Add missing static to scx_dump_data +- sched_ext: Add missing static to scx_has_op[] +- sched_ext: Temporarily work around pick_task_scx() being called without balance_scx() +- sched: Add dummy version of sched_group_set_idle() +- sched: Fix kabi for int idle in struct task_group +- sched: Put task_group::idle under CONFIG_GROUP_SCHED_WEIGHT +- sched_ext: Add a cgroup scheduler which uses flattened hierarchy +- sched_ext: Fix kabi for scx_flags and scx_weight in struct task_group +- sched_ext: Add cgroup support +- sched: Introduce CONFIG_GROUP_SCHED_WEIGHT +- sched: Make cpu_shares_read_u64() use tg_weight() +- sched: Expose css_tg() +- sched_ext: TASK_DEAD tasks must be switched into SCX on ops_enable +- sched_ext: TASK_DEAD tasks must be switched out of SCX on ops_disable +- sched_ext: Remove sched_class->switch_class() +- sched_ext: Remove switch_class_scx() +- sched_ext: Relocate functions in kernel/sched/ext.c +- sched_ext: Unify regular and core-sched pick task paths +- sched_ext: Replace SCX_TASK_BAL_KEEP with SCX_RQ_BAL_KEEP +- sched_ext: Don't call put_prev_task_scx() before picking the next task +- sched: Fix kabi for put_prev_task in struct sched_class +- sched: Add put_prev_task(.next) +- sched: Combine the last put_prev_task() and the first set_next_task() +- sched: Fix kabi pick_task in struct sched_class +- sched: Rework pick_next_task() +- sched: Split up put_prev_task_balance() +- sched: Fixup set_next_task() implementations +- sched/fair: Unify pick_{,next_}_task_fair() +- sched/fair: Cleanup pick_task_fair()'s curr +- sched/fair: Cleanup pick_task_fair() vs throttle +- sched/fair: Remove unused 'curr' argument from pick_next_entity() +- sched: Use set_next_task(.first) where required +- sched_ext: Use sched_clock_cpu() instead of rq_clock_task() in touch_core_sched() +- sched_ext: Use task_can_run_on_remote_rq() test in dispatch_to_local_dsq() +- sched_ext: Add missing cfi stub for ops.tick +- scx_central: Fix smatch checker warning +- sched_ext: Don't use double locking to migrate tasks across CPUs +- sched_ext: define missing cfi stubs for sched_ext +- sched_ext: Improve logging around enable/disable +- sched_ext: Make scx_rq_online() also test cpu_active() in addition to SCX_RQ_ONLINE +- sched_ext: Fix unsafe list iteration in process_ddsp_deferred_locals() +- sched_ext: Enable CONFIG_SCHED_CLASS_EXT on ARM64 +- sched_ext: Make task_can_run_on_remote_rq() use common task_allowed_on_cpu() +- sched_ext: Improve comment on idle_sched_class exception in scx_task_iter_next_locked() +- sched_ext: Fix kabi for balance in struct sched_class +- sched_ext: Simplify UP support by enabling sched_class->balance() in UP +- sched_ext: Use update_curr_common() in update_curr_scx() +- sched_ext: Add scx_enabled() test to @start_class promotion in put_prev_task_balance() +- sched_ext: Simplify scx_can_stop_tick() invocation in sched_can_stop_tick() +- sched_ext: Allow p->scx.disallow only while loading +- sched_ext: Build fix on !CONFIG_STACKTRACE[_SUPPORT] +- scx/selftests: Verify we can call create_dsq from prog_run +- scx: Allow calling sleepable kfuncs from BPF_PROG_TYPE_SYSCALL +- sched_ext: Fixes incorrect type in bpf_scx_init() +- sched_ext/scx_qmap: Pick idle CPU for direct dispatch on !wakeup enqueues +- sched_ext: Allow SCX_DSQ_LOCAL_ON for direct dispatches +- sched_ext: s/SCX_RQ_BALANCING/SCX_RQ_IN_BALANCE/ and add SCX_RQ_IN_WAKEUP +- sched_ext: Unpin and repin rq lock from balance_scx() +- sched: Move struct balance_callback definition upward +- sched_ext: Make scx_bpf_reenqueue_local() skip tasks that are being migrated +- sched_ext: Reimplement scx_bpf_reenqueue_local() +- sched_ext/scx_qmap: Add an example usage of DSQ iterator +- sched_ext: Implement DSQ iterator +- sched_ext: Take out ->priq and ->flags from scx_dsq_node +- sched, sched_ext: Move some declarations from kernel/sched/ext.h to sched.h +- sched, sched_ext: Open code for_balance_class_range() +- sched_ext: Minor cleanups in kernel/sched/ext.h +- sched_ext: Disallow loading BPF scheduler if isolcpus= domain isolation is in effect +- sched_ext: Account for idle policy when setting p->scx.weight in scx_ops_enable_task() +- sched, sched_ext: Simplify dl_prio() case handling in sched_fork() +- sched/ext: Add BPF function to fetch rq +- sched_ext: Documentation: Remove mentions of scx_bpf_switch_all +- sched_ext: Swap argument positions in kcalloc() call to avoid compiler warning +- sched_ext: add CONFIG_DEBUG_INFO_BTF dependency +- sched_ext: fix typo in set_weight() description +- sched_ext: Fix spelling mistake: "intead" -> "instead" +- sched_ext: Drop tools_clean target from the top-level Makefile +- sched_ext: Make scx_bpf_cpuperf_set() @cpu arg signed +- sched_ext: Add cpuperf support +- cpufreq_schedutil: Refactor sugov_cpu_is_busy() +- sched_ext: Fix kabi for switch_class in struct sched_class +- sched, sched_ext: Replace scx_next_task_picked() with sched_class->switch_class() +- sched_ext: Add selftests +- sched_ext: Documentation: scheduler: Document extensible scheduler class +- sched_ext: Add vtime-ordered priority queue to dispatch_q's +- sched_ext: Implement core-sched support +- sched_ext: Bypass BPF scheduler while PM events are in progress +- sched_ext: Implement sched_ext_ops.cpu_online/offline() +- sched_ext: Implement sched_ext_ops.cpu_acquire/release() +- sched_ext: Implement SCX_KICK_WAIT +- sched_ext: Track tasks that are subjects of the in-flight SCX operation +- sched_ext: Implement tickless support +- sched_ext: Add task state tracking operations +- sched_ext: Make watchdog handle ops.dispatch() looping stall +- sched_ext: Add a central scheduler which makes all scheduling decisions on one CPU +- sched_ext: Implement scx_bpf_kick_cpu() and task preemption support +- tools/sched_ext: Add scx_show_state.py +- sched_ext: Print debug dump after an error exit +- sched_ext: Print sched_ext info when dumping stack +- sched_ext: Allow BPF schedulers to disallow specific tasks from joining SCHED_EXT +- sched_ext: Implement runnable task stall watchdog +- sched_ext: Add sysrq-S which disables the BPF scheduler +- sched_ext: Add scx_simple and scx_example_qmap example schedulers +- sched_ext: Allow dequeue_task_scx to fail +- sched_ext: Fix kabi for scx in struct task_struct +- sched_ext: Implement BPF extensible scheduler class +- sched: Fix kabi for dequeue_task in struct sched_class +- sched: Allow sched_class::dequeue_task() to fail +- sched/deadline: Move bandwidth accounting into {en,de}queue_dl_entity +- sched/fair: Fix kabi for check_preempt_curr and wakeup_preempt in struct sched_class +- sched/fair: Rename check_preempt_curr() to wakeup_preempt() +- sched/fair: Rename check_preempt_wakeup() to check_preempt_wakeup_fair() +- sched_ext: Add boilerplate for extensible scheduler class +- sched: Add normal_policy() +- sched: Factor out update_other_load_avgs() from __update_blocked_others() +- sched: Factor out cgroup weight conversion functions +- sched: Fix kabi for switching_to in struct sched_class +- sched: Add sched_class->switching_to() and expose check_class_changing/changed() +- sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting +- sched/syscalls: Fix kabi for EXPORT_SYMBOL moved from core.c to syscalls.c +- sched/syscalls: Split out kernel/sched/syscalls.c from kernel/sched/core.c +- sched/cpufreq: Rework schedutil governor performance estimation +- Reapply "sched: Fix kabi breakage of struct task_struct for saved_state" +- sched/core: Remove ifdeffery for saved_state +- sched: Misc cleanups +- Revert "sched/core: Remove ifdeffery for saved_state" +- Revert "sched: Fix kabi breakage of struct task_struct for saved_state" +- sched: Simplify sched_move_task() +- sched: Simplify sched_rr_get_interval() +- sched: Simplify yield_to() +- sched: Simplify sched_{set,get}affinity() +- sched: Simplify syscalls +- Revert "sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting" +- sched: Simplify set_user_nice() +- cleanup: Make no_free_ptr() __must_check +- sched: Fix kabi for reweight_task in struct sched_class +- sched: Add sched_class->reweight_task() +- sched: Allow sched_cgroup_fork() to fail and introduce sched_cancel_fork() +- sched: Restructure sched_class order sanity checks in sched_init() +- Revert "sched: Split out QOS_LEVEL from QOS_SCHED for reuse" +- Revert "sched: Add qos_sched_enabled() helper for future expansion" +- Revert "sched/fair: Move dynamic affinity helper functions to sched.h" +- Revert "sched/fair: Add SMT QoS sched core code" +- Revert "arm64: Add arch code for SMT QoS" +- Revert "config: Enable SMT_QOS" +- ub: cdma: add software TLB invalidation for KSVA memory +- !22510 ub: udma: code optimization about safe mode +- !21986 urma: Enable RH2D streaming by IPoURMA +- !22521 v12 SMT QOS +- usb: xhci: Prevent interrupt storm on host controller error (HCE) +- !21948 urma: fix spinlock usage in ubagg_get_seg_info function +- net/oenetcls: fix mode-0 init rollback for ntuple resources +- !22501 smb: client: prevent races in ->query_interfaces() +- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated +- !22482 cifs: some missing initializations on replay +- !22472 smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path +- !22426 smb: client: prevent races in ->query_interfaces() +- net/oenetcls: fix RPS CPU index scaling bias +- ub: udma: code optimization +- net/oenetcls: free sk entry hash on ntuple cleanup +- !22511 apei: use blocking notifier for page offline policy chain +- config: Enable SMT_QOS +- arm64: Add arch code for SMT QoS +- sched/fair: Add SMT QoS sched core code +- sched/fair: Move dynamic affinity helper functions to sched.h +- sched: Add qos_sched_enabled() helper for future expansion +- sched: Split out QOS_LEVEL from QOS_SCHED for reuse +- !22442 v5 ext4 hardware atomic write support +- urma: Enable RH2D streaming by IPoURMA +- !22503 ub: ub_fwctl: add querying the peak bandwidth. +- !22500 ub:ubus: Bugfix control software restart features +- ceph: add a bunch of missing ceph_path_info initializers +- apei: use blocking notifier for page offline policy chain +- urma: fix spinlock usage in ubagg_get_seg_info function +- ub: udma: resolve legacy issues of shared page tables. +- ub: udma: support dtu function. +- ub: udma: support jetty_opt. +- ub: udma: support ucp & udp. +- ub: udma: support sharing JFC. +- ub: udma: supports write with atomic. +- ub: udma: Supports Safe Mode. +- !22256 urma: fix reference count imbalance in ubagg and uburma modules +- Fix kabi breakage in kernfs_node, kernfs_ops and bin_attribute +- x86: config: Enable Intel Application Energy Telemetry (AET) +- perf/x86/intel/uncore: Add per-scheduler IMC CAS count events +- x86,fs/resctrl: Update documentation for telemetry events +- x86/resctrl: Enable RDT_RESOURCE_PERF_PKG +- fs/resctrl: Move RMID initialization to first mount +- x86,fs/resctrl: Compute number of RMIDs as minimum across resources +- fs/resctrl: Move allocation/free of closid_num_dirty_rmid[] +- x86/resctrl: Handle number of RMIDs supported by RDT_RESOURCE_PERF_PKG +- x86/resctrl: Add energy/perf choices to rdt boot option +- x86,fs/resctrl: Handle domain creation/deletion for RDT_RESOURCE_PERF_PKG +- fs/resctrl: Refactor rmdir_mondata_subdir_allrdtgrp() +- fs/resctrl: Refactor mkdir_mondata_subdir() +- x86/resctrl: Read telemetry events +- x86/resctrl: Find and enable usable telemetry events +- x86,fs/resctrl: Add architectural event pointer +- x86,fs/resctrl: Fill in details of events for performance and energy GUIDs +- x86/resctrl: Discover hardware telemetry events +- fs/resctrl: Emphasize that L3 monitoring resource is required for summing domains +- x86,fs/resctrl: Add and initialize a resource for package scope monitoring +- x86,fs/resctrl: Add an architectural hook called for first mount +- x86,fs/resctrl: Support binary fixed point event counters +- x86,fs/resctrl: Handle events that can be read from any CPU +- fs/resctrl: Make event details accessible to functions when reading events +- x86,fs/resctrl: Rename some L3 specific functions +- x86,fs/resctrl: Rename struct rdt_mon_domain and rdt_hw_mon_domain +- x86,fs/resctrl: Use struct rdt_domain_hdr when reading counters +- fs/resctrl: Split L3 dependent parts out of __mon_event_count() +- x86,fs/resctrl: Refactor domain create/remove using struct rdt_domain_hdr +- x86/resctrl: Clean up domain_remove_cpu_ctrl() +- x86/resctrl: Refactor domain_remove_cpu_mon() ready for new domain types +- x86/resctrl: Move L3 initialization into new helper function +- x86,fs/resctrl: Improve domain type checking +- fs/resctrl: Consider sparse masks when initializing new group's allocation +- x86,fs/resctrl: Fix NULL pointer dereference with events force-disabled in mbm_event mode +- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID +- fs/resctrl: Fix counter auto-assignment on mkdir with mbm_event enabled +- MAINTAINERS: resctrl: Add myself as reviewer +- x86/resctrl: Configure mbm_event mode if supported +- fs/resctrl: Introduce the interface to switch between monitor modes +- fs/resctrl: Disable BMEC event configuration when mbm_event mode is enabled +- fs/resctrl: Introduce the interface to modify assignments in a group +- fs/resctrl: Introduce mbm_L3_assignments to list assignments in a group +- fs/resctrl: Auto assign counters on mkdir and clean up on group removal +- fs/resctrl: Introduce mbm_assign_on_mkdir to enable assignments on mkdir +- fs/resctrl: Provide interface to update the event configurations +- fs/resctrl: Add event configuration directory under info/L3_MON/ +- fs/resctrl: Support counter read/reset with mbm_event assignment mode +- x86/resctrl: Implement resctrl_arch_reset_cntr() and resctrl_arch_cntr_read() +- x86/resctrl: Refactor resctrl_arch_rmid_read() +- fs/resctrl: Introduce counter ID read, reset calls in mbm_event mode +- fs/resctrl: Pass struct rdtgroup instead of individual members +- fs/resctrl: Add the functionality to unassign MBM events +- fs/resctrl: Add the functionality to assign MBM events +- x86,fs/resctrl: Implement resctrl_arch_config_cntr() to assign a counter with ABMC +- fs/resctrl: Introduce event configuration field in struct mon_evt +- x86/resctrl: Add data structures and definitions for ABMC assignment +- fs/resctrl: Introduce interface to display number of free MBM counters +- fs/resctrl: Introduce mbm_cntr_cfg to track assignable counters per domain +- fs/resctrl: Add resctrl file to display number of assignable counters +- fs/resctrl: Introduce the interface to display monitoring modes +- x86/resctrl: Add support to enable/disable AMD ABMC feature +- x86,fs/resctrl: Detect Assignable Bandwidth Monitoring feature details +- x86,fs/resctrl: Consolidate monitoring related data from rdt_resource +- x86/resctrl: Add ABMC feature in the command line options +- x86/cpufeatures: Add support for Assignable Bandwidth Monitoring Counters (ABMC) +- x86,fs/resctrl: Prepare for more monitor events +- x86/resctrl: Remove the rdt_mon_features global variable +- x86,fs/resctrl: Replace architecture event enabled checks +- x86,fs/resctrl: Consolidate monitor event descriptions +- x86/resctrl: Support Sub-NUMA Cluster (SNC) mode on Clearwater Forest +- fs/resctrl: Optimize code in rdt_get_tree() +- fs/resctrl: Eliminate false positive lockdep warning when reading SNC counters +- resctrl: get rid of pointless debugfs_file_{get,put}() +- x86,fs/resctrl: Remove inappropriate references to cacheinfo in the resctrl subsystem +- fs/resctrl: Restore the rdt_last_cmd_clear() calls after acquiring rdtgroup_mutex +- MAINTAINERS: Add reviewers for fs/resctrl +- x86,fs/resctrl: Move the resctrl filesystem code to live in /fs/resctrl +- x86/resctrl: Fix rdtgroup_mkdir()'s unlocked use of kernfs_node::name +- x86/resctrl: Always initialise rid field in rdt_resources_all[] +- x86/resctrl: Relax some asm #includes +- x86/resctrl: Prefer alloc(sizeof(*foo)) idiom in rdt_init_fs_context() +- x86/resctrl: Squelch whitespace anomalies in resctrl core code +- x86/resctrl: Move pseudo lock prototypes to include/linux/resctrl.h +- x86/resctrl: Fix types in resctrl_arch_mon_ctx_{alloc,free}() stubs +- x86/resctrl: Move enum resctrl_event_id to resctrl.h +- x86/resctrl: Move the filesystem bits to headers visible to fs/resctrl +- fs/resctrl: Add boiler plate for external resctrl code +- !22506 ub: ubase&unic&cdma&udma: Supporting the restart optimization of the management and control process +- x86/resctrl: Add 'resctrl' to the title of the resctrl documentation +- x86/resctrl: Split trace.h +- x86/resctrl: Expand the width of domid by replacing mon_data_bits +- x86/resctrl: Add end-marker to the resctrl_event_id enum +- x86/resctrl: Move is_mba_sc() out of core.c +- x86/resctrl: Drop __init/__exit on assorted symbols +- x86/resctrl: Resctrl_exit() teardown resctrl but leave the mount point +- x86/resctrl: Check all domains are offline in resctrl_exit() +- x86/resctrl: Rename resctrl_sched_in() to begin with "resctrl_arch_" +- x86/resctrl: Remove the limit on the number of CLOSID +- x86/resctrl: Optimize cpumask_any_housekeeping() +- kernfs: Move dput() outside of the RCU section. +- kernfs: Drop kernfs_rwsem while invoking lookup_positive_unlocked(). +- kernfs: annotate different lockdep class for of->mutex of writable files +- kernfs: Use RCU to access kernfs_node::name. +- kernfs: Use RCU to access kernfs_node::parent. +- kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to strscpy() +- kernfs: Acquire kernfs_rwsem in kernfs_node_dentry(). +- kernfs: Acquire kernfs_rwsem in kernfs_get_parent_dentry(). +- kernfs: Acquire kernfs_rwsem in kernfs_notify_workfn(). +- kernfs: mount: Remove unnecessary ‘NULL’ values from knparent +- kernfs: Convert kernfs_name_locked() from strlcpy() to strscpy() +- kernfs: Convert kernfs_walk_ns() from strlcpy() to strscpy() +- kernfs: sysfs: support custom llseek method for sysfs entries +- ptrace: Convert ptrace_attach() to use lock guards +- cpumask: Add cpumask_{first,next}_andnot() API +- find: Add find_first_andnot_bit() +- cpumask: Relax cpumask_any_but() +- cpumask: Switch from inline to __always_inline +- cpumask: Introduce cpumask_first_and_and() +- cpumask: add cpumask_weight_andnot() +- cpumask: add cpumask_any_and_but() +- cpumask: kernel-doc cleanups and additions +- x86/resctrl: Move get_{mon,ctrl}_domain_from_cpu() to live with their callers +- x86/resctrl: Move get_config_index() to a header +- x86/resctrl: Handle throttle_mode for SMBA resources +- x86/resctrl: Move RFTYPE flags to be managed by resctrl +- x86/resctrl: Make resctrl_arch_pseudo_lock_fn() take a plr +- x86/resctrl: Make prefetch_disable_bits belong to the arch code +- x86/resctrl: Allow an architecture to disable pseudo lock +- x86/resctrl: Add resctrl_arch_ prefix to pseudo lock functions +- x86/resctrl: Move mbm_cfg_mask to struct rdt_resource +- x86/resctrl: Move mba_mbps_default_event init to filesystem code +- x86/resctrl: Change mon_event_config_{read,write}() to be arch helpers +- x86/resctrl: Add resctrl_arch_is_evt_configurable() to abstract BMEC +- x86/resctrl: Move the is_mbm_*_enabled() helpers to asm/resctrl.h +- x86/resctrl: Rewrite and move the for_each_*_rdt_resource() walkers +- x86/resctrl: Move monitor init work to a resctrl init call +- x86/resctrl: Move monitor exit work to a resctrl exit call +- x86/resctrl: Add an arch helper to reset one resource +- x86/resctrl: Move resctrl types to a separate header +- x86/resctrl: Move rdt_find_domain() to be visible to arch and fs code +- x86/resctrl: Expose resctrl fs's init function to the rest of the kernel +- x86/resctrl: Remove rdtgroup from update_cpu_closid_rmid() +- x86/resctrl: Add helper for setting CPU default properties +- x86/resctrl: Generate default_ctrl instead of sharing it +- x86/resctrl: Add max_bw to struct resctrl_membw +- x86/resctrl: Remove data_width and the tabular format +- x86/resctrl: Use schema type to determine the schema format string +- x86/resctrl: Use schema type to determine how to parse schema values +- x86/resctrl: Remove fflags from struct rdt_resource +- x86/resctrl: Add a helper to avoid reaching into the arch code resource list +- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors +- x86/resctrl: Document the new "mba_MBps_event" file +- x86/resctrl: Add write option to "mba_MBps_event" file +- x86/resctrl: Add "mba_MBps_event" file to CTRL_MON directories +- x86/resctrl: Make mba_sc use total bandwidth if local is not supported +- x86/resctrl: Compute memory bandwidth for all supported events +- x86/resctrl: Modify update_mba_bw() to use per CTRL_MON group event +- x86/resctrl: Prepare for per-CTRL_MON group mba_MBps control +- x86/resctrl: Introduce resctrl_file_fflags_init() to initialize fflags +- x86/resctrl: Use kthread_run_on_cpu() +- x86/resctrl: Support Sub-NUMA cluster mode SNC6 +- x86/resctrl: Slightly clean-up mbm_config_show() +- x86/resctrl: Annotate get_mem_config() functions as __init +- x86/resctrl: Avoid overflow in MB settings in bw_validate() +- x86/resctrl: Fix arch_mbm_* array overrun on SNC +- x86/resctrl: Update documentation with Sub-NUMA cluster changes +- x86/resctrl: Detect Sub-NUMA Cluster (SNC) mode +- x86/resctrl: Enable shared RMID mode on Sub-NUMA Cluster (SNC) systems +- x86/resctrl: Make __mon_event_count() handle sum domains +- x86/resctrl: Fill out rmid_read structure for smp_call*() to read a counter +- x86/resctrl: Handle removing directories in Sub-NUMA Cluster (SNC) mode +- x86/resctrl: Create Sub-NUMA Cluster (SNC) monitor files +- x86/resctrl: Allocate a new field in union mon_data_bits +- x86/resctrl: Refactor mkdir_mondata_subdir() with a helper function +- x86/resctrl: Initialize on-stack struct rmid_read instances +- x86/resctrl: Add a new field to struct rmid_read for summation of domains +- x86/resctrl: Prepare for new Sub-NUMA Cluster (SNC) monitor files +- x86/resctrl: Block use of mba_MBps mount option on Sub-NUMA Cluster (SNC) systems +- x86/resctrl: Introduce snc_nodes_per_l3_cache +- x86/resctrl: Add node-scope to the options for feature scope +- x86/resctrl: Split the rdt_domain and rdt_hw_domain structures +- x86/resctrl: Prepare for different scope for control/monitor operations +- x86/resctrl: Prepare to split rdt_domain structure +- x86/resctrl: Prepare for new domain scope +- x86/resctrl: Replace open coded cacheinfo searches +- cacheinfo: Add function to get cacheinfo for a given CPU and cache level +- cpu: Drop "extern" from function declarations in cpuhplock.h +- cpu: Move CPU hotplug function declarations into their own header +- x86/resctrl: Don't try to free nonexistent RMIDs +- x86/resctrl: Add tracepoint for llc_occupancy tracking +- x86/resctrl: Rename pseudo_lock_event.h to trace.h +- x86/resctrl: Simplify call convention for MSR update functions +- x86/resctrl: Pass domain to target CPU +- x86/resctrl: Switch to new Intel CPU model defines +- x86/resctrl: Fix uninitialized memory read when last CPU of domain goes offline +- Documentation/x86: Fix title underline length +- Documentation/x86: Document that resctrl bandwidth control units are MiB +- x86/resctrl: Remove lockdep annotation that triggers false positive +- x86/resctrl: Separate arch and fs resctrl locks +- x86/resctrl: Move domain helper migration into resctrl_offline_cpu() +- x86/resctrl: Add CPU offline callback for resctrl work +- x86/resctrl: Allow overflow/limbo handlers to be scheduled on any-but CPU +- x86/resctrl: Add CPU online callback for resctrl work +- x86/resctrl: Add helpers for system wide mon/alloc capable +- x86/resctrl: Make rdt_enable_key the arch's decision to switch +- x86/resctrl: Move alloc/mon static keys into helpers +- x86/resctrl: Make resctrl_mounted checks explicit +- x86/resctrl: Allow arch to allocate memory needed in resctrl_arch_rmid_read() +- x86/resctrl: Allow resctrl_arch_rmid_read() to sleep +- x86/resctrl: Queue mon_event_read() instead of sending an IPI +- x86/resctrl: Add cpumask_any_housekeeping() for limbo/overflow +- x86/resctrl: Move CLOSID/RMID matching and setting to use helpers +- x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid +- x86/resctrl: Use __set_bit()/__clear_bit() instead of open coding +- x86/resctrl: Track the number of dirty RMID a CLOSID has +- x86/resctrl: Allow RMID allocation to be scoped by CLOSID +- x86/resctrl: Access per-rmid structures by index +- x86/resctrl: Track the closid with the rmid +- x86/resctrl: Move RMID allocation out of mkdir_rdt_prepare() +- x86/resctrl: Create helper for RMID allocation and mondata dir creation +- x86/resctrl: Free rmid_ptrs from resctrl_exit() +- x86/resctrl: Remove redundant variable in mbm_config_write_domain() +- x86/resctrl: Implement new mba_MBps throttling heuristic +- x86/resctrl: Read supported bandwidth sources from CPUID +- x86/resctrl: Remove hard-coded memory bandwidth limit +- x86/resctrl: Fix unused variable warning in cache_alloc_hsw_probe() +- x86: Decouple resctrl with resctrl-mpam +- ub: ub_fwctl: add querying the peak bandwidth. +- ub: ubase&unic&cdma&udma: Supporting the restart optimization of the management and control process +- dm: clear cloned request bio pointer when last clone bio completes +- net/oenetcls: Add rps policy switch for phy NIC +- net/oenetcls: Make OENETCLS default as module +- net/oenetcls: Support ipv6 for ntuple mode +- net/oenetcls: Supports rxq multiplexing +- net/oenetcls: Add local flow NUMA-aware rps +- net/oenetcls: Fix possible hash collision issue +- net/oenetcls: Prioritize oenetcls hooks over rps +- net/oenetcls: Add mode 2 for rps numa affinity +- smb: client: prevent races in ->query_interfaces() +- ub:ubus: Bugfix control software restart features +- !22481 v3 optimize copy_from_user +- !22490 ub: ubase&unic: Advanced Features for issue #9110 +- !22424 powerpc, perf: Check that current->mm is alive before getting user callchain +- gpiolib: acpi: Fix potential out-of-boundary left shift +- ub: ubase: Provide interface for obtaining ub feature +- ub: ubase&unic: ubase & unic use non mirror mem +- !22359 linkdata: fix compile error +- ub: ubase: Supports real-time traffic control functions such as enabling, querying, and disabling only +- ub: ubase: The ubase supports the configuration of QoS priority mapping using the hccn_tool +- !22456 ub:ubus: change the condition of io decoder creating page table or not +- !22470 ub/unic: bugfix for ubase&unic driver +- !22436 iommu/ummu-core: fix uaf in ummu_core_invalidate_cfg() +- !22310 iommu: Optimize the iommu PLBI Framework +- !22437 iommu/ummu: remove swap operation when ungrant +- cifs: some missing initializations on replay +- !22438 iommu/ummu-core: ummu_fill_pages interface provides GFP flags for memory allocation +- arm64: uaccess: add CONFIG control for copy_from_user_opt +- arm64: uaccess: add optimized copy_from_user for Hisilicon platforms +- arm64: cputype: Add CPU type for HISI_CPU_PART_HIP11 +- usb: class: cdc-wdm: fix reordering issue in read code path +- !22427 perf/x86/intel/uncore: Fix die ID init and look up bugs +- smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path +- ub: ubase: reinitialize cmdq in uninit flow to resolve UE deregistration failure after ELR reset failure +- ub: ubase: Resolve the issue of insufficient ctrlq sequences +- ub: ubase: Modify the log rate limiting interface, add frequency-limited logs, and add maintenance logs +- ub: ubase: Locking is performed on the seq_tbl processing in the proxy response +- net: unic: Fixed the problem of being unable to replenish rqe to the chip in time +- ub: ubase: Solve the mailbox processing times out in abnormal scenarios +- net: unic: Fixed the issue of memory overwriting in unic traffic flow +- ub: ubase&unic: encoding alarm rectification +- ub: ubase: Fix the issue where the mailbox buffer is not released after a cmdq submission failure +- net: unic: Supports querying of the Ethernet port's NL-layer register +- ub: ubase: Fix the problem of frequent log printing +- ub: ubase: Adjustment of conditions for creating ubase proxy auxiliary devices +- ub: ubase: Delete residual DTU window of the UDMA during reset +- ub: ubase: Add DTU capability bit printing +- net: unic: The unsupported VL rate limit value is displayed as 0 +- net: unic: Notify MAMI when the LACP status changes +- net: unic: adapt to the change for ETS tsa and bw configuration permission +- !22413 ub: ub_fwctl: query port link status add construct first link data +- bpf/selftests: test_select_reuseport_kern: Remove unused header +- Revert "net: Remove conditional threaded-NAPI wakeup based on task state." +- Revert "net: Allow to use SMP threads for backlog NAPI." +- ksmbd: fix recursive locking in RPC handle list access +- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins +- mptcp: avoid dup SUB_CLOSED events after disconnect +- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 +- drm/msm/a6xx: fix bogus hwcg register updates +- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver +- ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check +- net/sched: act_ife: convert comma to semicolon +- btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() +- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock +- wifi: mac80211: move TDLS work to wiphy work +- ksmbd: Fix race condition in RPC handle list access +- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV +- ksmbd: smbd: fix dma_unmap_sg() nents +- mei: trace: treat reg parameter as string +- mm/kfence: randomize the freelist on initialization +- drm/amdgpu/gfx11: fix wptr reset in KGQ init +- drm/amdgpu/gfx10: fix wptr reset in KGQ init +- drm/amdgpu/soc21: fix xclk for APUs +- drm/imx/tve: fix probe device leak +- scripts: generate_rust_analyzer: Add compiler_builtins -> core dep +- flex_proportions: make fprop_new_period() hardirq safe +- selftests: mptcp: join: fix local endp not being tracked +- mptcp: only reset subflow errors when propagated +- scsi: qla2xxx: edif: Fix dma_free_coherent() size +- gpio: pca953x: mask interrupts in irq shutdown +- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO +- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() +- ASoC: fsl: imx-card: Do not force slot width to sample width +- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target +- riscv: compat: fix COMPAT_UTS_MACHINE definition +- pinctrl: meson: mark the GPIO controller as sleeping +- dma/pool: distinguish between missing and exhausted atomic pools +- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler +- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion +- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() +- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload +- net: bridge: fix static key check +- nfc: nci: Fix race between rfkill and nci_unregister_device(). +- net/mlx5e: Account for netdev stats in ndo_get_stats64 +- net/mlx5e: Report rx_discards_phy via rx_dropped +- ice: stop counting UDP csum mismatch as rx_errors +- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). +- rocker: fix memory leak in rocker_world_port_post_fini() +- net: wwan: t7xx: fix potential skb->frags overflow in RX path +- ipv6: use the right ifindex when replying to icmpv6 from localhost +- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() +- octeon_ep: Fix memory leak in octep_device_setup() +- net: bcmasp: fix early exit leak with fixed phy +- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() +- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work +- !22370 scsi: target: tcm_loop: Drain commands in target_reset handler +- !22364 cifs: Fix locking usage for tcon fields +- net: ipa: fix event ring index not programmed for IPA v5.0+ +- !22458 ub:ubus: Add control software restart features +- !22447 v4 arm64/ras: Firmware-first SEI error handling with ESB synchronization +- iommu/ummu: remove swap operation when ungrant +- Linkdata: fix build failure due to missing IPsec configs in defconfig +- ub:ubus: Add control software restart features +- ub: ub_fwctl: supports the configuration and query of packet statistics on the UBOE interface based on the NL-layer VL. +- ub: ub_fwctl: query port link status add construct first link data +- !22395 ub:ubus: support getting supported features data +- iommu/ummu-core: ummu_fill_pages interface provides GFP flags for memory allocation +- !22453 Revert "!21796 [OLK-6.6] x86/mce/zhaoxin: Enable mcelog to decode PCIE, ZDI/ZPI, and DRAM errors" +- ub:ubus: Add KABI_RESERVE to struct ub_decoder and message_device +- ub:ubus: Will not enable decoder if matt jurisdiction is UBFM +- ub:ubus: change the condition of io decoder creating page table or not +- Revert "!21796 [OLK-6.6] x86/mce/zhaoxin: Enable mcelog to decode PCIE, ZDI/ZPI, and DRAM errors" +- arm64: openeuler_defconfig: enable CONFIG_ARM64_SYNC_SEI by default +- ACPI/APEI/arm64: add vendor SEI handling for firmware-first RAS +- arm64: Add runtime switch to control ESB for SEI synchronization +- arm64/entry: Add support to synchronize SEI at the exception boundary +- !22417 iommu/ummu-core: support TID sharing within same mm +- urma: fix reference count imbalance in ubagg and uburma modules +- !22432 spi: use generic driver_override infrastructure +- Documentation: ext4: Convert includes into toctrees +- Documentation: ext4: atomic_writes: Demote last three sections +- block: Don't allow an atomic write be truncated in blkdev_write_iter() +- nvme: stop using AWUPF +- ext4: Simplify last in leaf check in ext4_map_query_blocks +- ext4: Unwritten to written conversion requires EXT4_EX_NOCACHE +- block: Fix blk_validate_atomic_write_limits() build for arm32 +- block: fix kabi broken in enum req_flag_bits +- iomap: Lift blocksize restriction on atomic writes +- ext4: Add atomic block write documentation +- ext4: Enable support for ext4 multi-fsblock atomic write using bigalloc +- ext4: Add multi-fsblock atomic write support with bigalloc +- ext4: Add support for EXT4_GET_BLOCKS_QUERY_LEAF_BLOCKS +- ext4: Make ext4_meta_trans_blocks() non-static for later use +- ext4: Check if inode uses extents in ext4_inode_can_atomic_write() +- ext4: Document an edge case for overwrites +- ext4: Do not fallback to buffered-io for DIO atomic write +- ext4: Support setting FMODE_CAN_ATOMIC_WRITE +- ext4: Check for atomic writes support in write iter +- ext4: Add statx support for atomic writes +- fs: fix kabi broken in struct kstat +- fs: Add initial atomic write support info to statx +- fs: iomap: Atomic write support +- fs: Export generic_atomic_write_valid() +- nvme: Atomic write support +- block: Add bdev atomic write limits helpers +- fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid() +- block/fs: Pass an iocb to generic_atomic_write_valid() +- block: Add fops atomic write support +- block: Call blkdev_dio_unaligned() from blkdev_direct_IO() +- block: fix kabi broken in struct queue_limits +- block: Add core atomic write support +- fs: Initial atomic write support +- block: Generalize chunk_sectors support as boundary support +- block: Pass blk_queue_get_max_sectors() a request pointer +- iommu/ummu-core: fix uaf in ummu_core_invalidate_cfg() +- !21810 [OLK-6.6] apei/ghes: Add Zhaoxin platform support for ghes_edac +- !21807 [OLK-6.6] x86/cpu: detect extended topology for Zhaoxin CPUs +- !21804 [OLK-6.6] x86/delay: Update support for Zhaoxin PAUSEOPT instruction +- !21803 [OLK-6.6] ALSA: HDA: Add Centaur HDMI Controller and Codec support +- !21797 [OLK-6.6] iommu/vt-d: fix NULL pointer issue in acpi_rmrr_andd_probe +- !21796 [OLK-6.6] x86/mce/zhaoxin: Enable mcelog to decode PCIE, ZDI/ZPI, and DRAM errors +- !21795 [OLK-6.6] efi/cper: Add Zhaoxin mem error decode for KH-50000 +- !21794 [OLK-6.6] hwmon: zhaoxin-cputemp: Update for KX-8000 +- !21793 [OLK-6.6] zhaoxin: Update hardware random number generator driver +- !21792 [OLK-6.6] ALSA: hda: Add support for Zhaoxin SB HDAC controller +- spi: use generic driver_override infrastructure +- iommu/ummu-core: support TID sharing within same mm +- perf/x86/intel/uncore: Fix die ID init and look up bugs +- smb: client: prevent races in ->query_interfaces() +- powerpc, perf: Check that current->mm is alive before getting user callchain +- iommu: Optimize the iommu PLBI Framework +- ub:ubus: support getting supported features data +- iommu/vt-d: fix NULL pointer issue in acpi_rmrr_andd_probe +- scsi: target: tcm_loop: Drain commands in target_reset handler +- cifs: Fix locking usage for tcon fields +- bridge: br_nd_send: validate ND option lengths +- sched/fair: Fix overflow in vruntime_eligible() +- sched/fair: Introduce and use the vruntime_cmp() and vruntime_op() wrappers for wrapped-signed aritmetics +- sched/fair: Mark m*_vruntime() with __maybe_unused +- sched/fair: Clear rel_deadline when initializing forked entities +- Revert "sched/fair: Clear rel_deadline when initializing forked entities" +- usb: cdns3: gadget: fix NULL pointer dereference in ep_queue +- udp: Fix wildcard bind conflict check when using hash2 +- tcp: Rearrange tests in inet_csk_bind_conflict(). +- x86/delay: add support for Zhaoxin PAUSEOPT instruction +- urma: fix the panic when ipourma module is repeatedly loaded +- apei/ghes: Add Zhaoxin platform support for ghes_edac +- x86/cpu: detect extended topology for Zhaoxin CPUs +- ALSA: HDA: Add Centaur HDMI Controller and Codec support +- x86/mce/zhaoxin: Enable mcelog to decode PCIE, ZDI/ZPI, and DRAM errors +- efi/cper: Add Zhaoxin mem error decode for KH-50000 +- efi/cper: Add Zhaoxin cache error decode +- efi/cper: Add Zhaoxin micro-architectural error decode +- efi/cper: Add Zhaoxin non standard cper error decode +- efi/cper: Add Zhaoxin ZDI ZPI error decode for KH-50000 +- efi: cper: Update Zhaoxin/Centaur ZDI/ZPI error decode +- hwmon: zhaoxin-cputemp: Update for KX-8000 +- zhaoxin: Update hardware random number generator driver +- ALSA: hda: Add support for Zhaoxin SB HDAC controller +- crypto: ccp: fix build issue like redefined RI_XXX_PRESENT +- crypto: ccp: SM2 ccp encryption support Hygon model 10h +- crypto: ccp: check if ccp supports sm4-xts/sm4-gcm +- mm: export split_vma for module use +- crypto: ccp: Support SM4-GCM for hygon ccp +- crypto: ccp: Support SM4-XTS for hygon ccp + +* Wed May 13 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-153.0.0.139 +- !22406 CVE +- !22327 ceph: fix i_nlink underrun during async unlink +- !22400 bpf, x86: Fix missing BTF_SET8_KFUNCS flag for arch kfuncs +- !22401 Fix CVE-2026-31486 +- !22383 dmaengine: idxd: Fix not releasing workqueue on .release() +- !22394 *** fix CVE-2026-31527 *** +- !22335 ceph: fix memory leaks in ceph_mdsc_build_path() +- !22351 ixgbevf: add missing negotiate_features op to Hyper-V ops table +- !22333 ceph: supply snapshot context in ceph_zero_partial_object() +- HID: core: Mitigate potential OOB by removing bogus memset() +- HID: core: Add printk_ratelimited variants to hid_warn() etc +- HID: multitouch: Check to ensure report responses match the request +- Bluetooth: MGMT: validate LTK enc_size on load +- hwmon: (pmbus/core) Protect regulator operations with mutex +- hwmon: (pmbus/core) Declare regulator notification function as void +- bpf, x86: Fix missing BTF_SET8_KFUNCS flag for arch kfuncs +- !22336 HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure +- !22345 Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync +- !22346 Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt +- !22353 Bluetooth: SMP: derive legacy responder STK authentication from MITM state +- !22347 Bluetooth: MGMT: validate mesh send advertising payload length +- !22367 Bluetooth: hci_event: move wake reason storage into validated event handlers +- driver/core: Fix kabi broken of platform_device/bus_type/device +- driver core: platform: use generic driver_override infrastructure +- hwmon: axi-fan: don't use driver_override as IRQ name +- driver core: generalize driver_override in struct device +- dmaengine: idxd: Fix not releasing workqueue on .release() +- !22275 CVE-2026-43313 +- !22272 EFI/CPER: don't dump the entire memory region +- !22267 KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() +- !22266 v2 CVE-2026-43265 +- !22355 5 CVE fix patches +- !22224 mm/userfaultfd: fix hugetlb fault mutex hash calculation +- !22206 net: make CONFIG_UB_SOCKET_HANDSHAKE independent of CONFIG_UB_UMS +- !22342 rxrpc: proc: size address buffers for %pISpc output +- !22363 dmaengine: idxd: Fix leaking event log memory +- !22356 dmaengine: idxd: Fix memory leak when a wq is reset +- Bluetooth: hci_event: move wake reason storage into validated event handlers +- !22321 Fix CVE-2026-43013 +- !22278 Fix CVE-2026-31699 +- !22269 Fix CVE-2026-31698 +- dmaengine: idxd: Fix leaking event log memory +- dmaengine: idxd: Fix memory leak when a wq is reset +- HID: core: clamp report_size in s32ton() to avoid undefined shift +- HID: alps: fix NULL pointer dereference in alps_raw_event() +- Input: uinput - fix circular locking dependency with ff-core +- HID: apple: avoid memory leak in apple_report_fixup() +- HID: magicmouse: avoid memory leak in magicmouse_report_fixup() +- Bluetooth: SMP: derive legacy responder STK authentication from MITM state +- ixgbevf: add missing negotiate_features op to Hyper-V ops table +- net: make CONFIG_UB_SOCKET_HANDSHAKE independent of CONFIG_UB_UMS +- Bluetooth: MGMT: validate mesh send advertising payload length +- Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt +- Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync +- rxrpc: proc: size address buffers for %pISpc output +- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure +- ceph: fix memory leaks in ceph_mdsc_build_path() +- ceph: supply snapshot context in ceph_zero_partial_object() +- !22204 cgroupv2 io bugfix patches +- !22264 Fix CVE-2026-43262 +- !22307 Fix CVE-2026-43363 +- !22320 Fix CVE-2026-43429 +- !20492 scsi: leapraid: add RAID disk hide/show events and fix misc issues +- ceph: fix i_nlink underrun during async unlink +- !22306 dmaengine: idxd: Fix possible invalid memory access after FLR +- !22304 module: Fix kernel panic when a symbol st_shndx is out of bounds +- !22317 drm/ioc32: stop speculation on the drm_compat_ioctl path +- !22226 kvm: arm64: Add HIP13 cpu type definition for detecting virtualization features +- !22112 Revert "cpufreq: Fix re-boost issue after hotplugging a CPU" +- !22105 cpufreq: conservative: Reset requested_freq on limits change +- net/mlx5: lag: Check for LAG device before creating debugfs +- !22313 drivers/ub/sentry: change the ub_mem_ras_handler function to always return 0 +- USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts +- USB: usbcore: Introduce usb_bulk_msg_killable() +- !22037 Fix CVE-2026-31469 +- !22292 Fix CVE-2026-43407 +- drm/ioc32: stop speculation on the drm_compat_ioctl path +- drivers/ub/sentry: change the ub_mem_ras_handler function to always return 0 +- !22296 urma: fix potential parameter overflow in initialization +- !22290 mm/numa_remote: avoid numa_remote lock when onlining pre-onlined memory +- !22262 net: hns3: add dcbnl_setbuffer and dcbnl_getbuffer support for pf +- x86/apic: Disable x2apic on resume if the kernel expects so +- dmaengine: idxd: Fix possible invalid memory access after FLR +- module: Fix kernel panic when a symbol st_shndx is out of bounds +- libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() +- !22276 crypto: af-alg - fix NULL pointer dereference in scatterwalk +- mm/numa_remote: avoid numa_remote lock when onlining pre-onlined memory +- urma: fix potential parameter overflow in initialization +- !20782 tracing: Fix soft lockup when lseeking trace file +- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed +- !21650 urma: query resource options by id. +- !22260 CVE-2026-31419 +- crypto: af-alg - fix NULL pointer dereference in scatterwalk +- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix +- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() +- !22217 Fix CVE-2026-31697 +- !22234 Fix CVE-2026-31422 +- !22076 Fix CVE-2026-31684 +- !22074 Fix CVE-2026-31685 +- EFI/CPER: don't dump the entire memory region +- !22127 rnpvf: update rnpvf driver to version 1.1.10. +- !22170 rnp: update rnp driver to version 1.1.14. +- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed +- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() +- KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() +- KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject +- gfs2: fiemap page fault fix +- bonding: remove unused bond_is_first_slave and bond_is_last_slave macros +- net: bonding: fix use-after-free in bond_xmit_broadcast() +- bonding: do not set usable_slaves for broadcast mode +- net: bonding: update the slave array for broadcast mode +- net: hns3: add dcbnl_setbuffer and dcbnl_getbuffer support for pf +- !22242 [OLK-6.6] ub: ubase: Add S Device ID, USC/UCP, DTU, and proxy support +- !22241 Fix CVE-2026-31779 +- !22240 atm: lec: fix use-after-free in sock_def_readable() +- !21958 Ethernet: Linkdata: Supports Linkdata ethernet Controllers +- !22249 [OLK-6.6] Fix CVE-2026-43284 +- Ethernet: Linkdata: Supports Linkdata ethernet Controllers +- xfrm: esp: avoid in-place decrypt on shared skb frags +- ub: ubase: Added proxy functions to ubase +- ub: ubase: support DTU feature +- ub: ubase: add USC and UCP +- ub: ubase: Add Ubase S Device ID +- !22184 Fix CVE-2026-31675 +- !22220 net: Fix CVE-2026-31518 +- !22219 net/sched: Fix CVE-2026-31421 +- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed +- wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() +- atm: lec: fix use-after-free in sock_def_readable() +- net: sched: act_csum: validate nested VLAN headers +- net/sched: cls_flow: fix NULL pointer dereference on shared blocks +- netfilter: ip6t_eui64: reject invalid MAC header for all packets +- kvm: arm64: Add HIP13 cpu type definition for detecting virtualization features +- mm/userfaultfd: fix hugetlb fault mutex hash calculation +- urma: query resource options by id. +- esp: fix skb leak with espintcp and async crypto +- xfrm: Fix the usage of skb->sk +- net/sched: cls_fw: fix NULL dereference of "old" filters before change() +- net/sched: cls_fw: fix NULL pointer dereference on shared blocks +- blk-iocost: fix busy_level reset when no IOs complete +- block: use min() instead of min_t() +- blk-throttle: fix lower bps rate by throtl_trim_slice() +- block: flush all throttled bios when deleting the cgroup +- jbd2: increase IO priority of checkpoint +- blk-throttle: don't take carryover for prioritized processing of metadata +- blk-throttle: support prioritized processing of metadata +- blk-throttle: fix lower control under super low iops limit +- rnp: update rnp driver to version 1.1.14. +- net/sched: sch_netem: fix out-of-bounds access in packet corruption +- rnpvf: update rnpvf driver to version 1.1.10. +- Revert "cpufreq: Fix re-boost issue after hotplugging a CPU" +- cpufreq: conservative: Reset requested_freq on limits change +- virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false +- tracing: Fix soft lockup when lseeking trace file +- scsi: leapraid: add RAID disk hide/show events and fix misc issues + +* Fri May 08 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-152.0.0.138 +- !22246 Revert "efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs" +- Revert "efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs" +- !22187 support mempool and NUMA.remote for 64KB page +- !22201 mm: memcontrol: don't throttle dying tasks on memory.high +- !22213 futex: Clear stale exiting pointer in futex_lock_pi() retry path +- !22212 drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib +- !22221 EDAC/mc: Fix error path ordering in edac_mc_alloc() +- EDAC/mc: Fix error path ordering in edac_mc_alloc() +- !22202 pstore: ram_core: fix incorrect success return when vmap() fails +- !22203 perf/x86/intel/uncore: Skip discovery table for offline dies +- !22215 usb: cdns3: gadget: fix state inconsistency on gadget init failure +- !22078 Fix CVE-2026-31681 +- !22041 Fix CVE-2026-31664 +- !22082 Fix CVE-2026-31671 +- !22079 [OLK-6.6][linux-6.6.y sync] Backport 6.6.121-6.6.122 LTS Patches +- !22199 CVE-2026-31414 +- !22185 Fix CVE-2026-31679 +- !22164 Fix CVE-2026-31551 +- usb: cdns3: gadget: fix state inconsistency on gadget init failure +- futex: Clear stale exiting pointer in futex_lock_pi() retry path +- drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib +- !22173 Fix CVE-2026-31592 +- !22021 smb: client: fix off-by-8 bounds check in check_wsl_eas() +- !22022 smb: client: fix OOB reads parsing symlink error response +- !21926 nvme-pci: ensure we're polling a polled queue +- !21924 ext4: avoid infinite loops caused by residual data +- !21922 ksmbd: fix OOB write in QUERY_INFO for compound requests +- !22171 xen/privcmd: fix double free via VMA splitting +- !22167 *** fix CVE-2026-31443 *** +- !22166 spi: spi-dw-dma: fix print error log when wait finish transaction +- perf/x86/intel/uncore: Skip discovery table for offline dies +- pstore: ram_core: fix incorrect success return when vmap() fails +- mm: memcontrol: don't throttle dying tasks on memory.high +- netfilter: nf_conntrack_expect: use expect->helper +- netfilter: nf_conntrack_expect: honor expectation helper field +- netfilter: nf_conntrack_helper: pass helper to expect cleanup +- mm/numa_remote: remove depends on ARM64_4K_PAGES +- mm/pfn_range_alloc: add support for CONFIG_ARM64_64K_PAGES +- openvswitch: validate MPLS set/set_masked payload length +- xfrm_user: fix info leak in build_report() +- KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock +- xen/privcmd: fix double free via VMA splitting +- dmaengine: idxd: Fix crash when the event log is disabled +- dmaengine: idxd: Delete unnecessary NULL check +- spi: spi-dw-dma: fix print error log when wait finish transaction +- wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. +- netfilter: xt_multiport: validate range encoding in checkentry +- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size +- btrfs: fix double free in create_space_info_sub_group() error path +- btrfs: fix double free in create_space_info() error path +- interconnect: debugfs: fix devm_kstrdup and kfree mismatch +- Revert "ALSA: usb: Increase volume range that triggers a warning" +- x86/kfence: fix booting on 32bit non-PAE systems +- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message +- drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() +- btrfs: fix leak of kobject name for sub-group space_info +- net: phy: fix phy_uses_state_machine() +- fs/ntfs3: Initialize allocated memory before use +- nvme: fix PCIe subsystem reset controller state transition +- nvme-pci: do not directly handle subsys reset fallout +- nvme-fc: rename free_ctrl callback to match name pattern +- ASoC: codecs: wsa883x: fix unnecessary initialisation +- ASoC: codecs: wsa881x: fix unnecessary initialisation +- ASoC: codecs: wsa881x: Drop unused version readout +- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() +- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path +- mm: kmsan: fix poisoning of high-order non-compound pages +- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure +- iio: adc: exynos_adc: fix OF populate on driver rebind +- ALSA: scarlett2: Fix buffer overflow in config retrieval +- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s +- iio: core: add separate lockdep class for info_exist_lock +- iio: core: add missing mutex_destroy in iio_dev_release() +- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure +- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure +- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak +- selftests/bpf: Check for timeout in perf_link test +- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak +- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak +- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak +- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak +- perf/x86/intel: Do not enable BTS for guests +- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu +- platform/x86: hp-bioscfg: Fix automatic module loading +- netrom: fix double-free in nr_route_frame() +- slimbus: core: fix device reference leak on report present +- slimbus: core: fix runtime PM imbalance on report present +- octeontx2: Fix otx2_dma_map_page() error return code +- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA +- wifi: rsi: Fix memory corruption due to not set vif driver data size +- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() +- wifi: ath12k: fix dma_free_coherent() pointer +- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode +- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function +- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() +- ALSA: ctxfi: Fix potential OOB access in audio mixer handling +- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl +- iio: chemical: scd4x: fix reported channel endianness +- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver +- iio: adc: ad9467: fix ad9434 vref mask +- iio: accel: iis328dq: fix gain values +- of: platform: Use default match table for /firmware +- of: fix reference count leak in of_alias_scan() +- x86: make page fault handling disable interrupts properly +- vsock/test: fix seqpacket message bounds test +- net: openvswitch: fix data race in ovs_vport_get_upcall_stats +- octeontx2-af: Fix error handling +- net: dsa: fix off-by-one in maximum bridge ID determination +- selftests: net: amt: wait longer for connection before sending packets +- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) +- drm/amd/pm: Don't clear SI SMC table when setting power limit +- usbnet: limit max_mtu based on device's hard_mtu +- mISDN: annotate data-race around dev->work +- be2net: fix data race in be_get_new_eqd +- net: hns3: fix data race in hns3_fetch_stats +- ALSA: usb: Increase volume range that triggers a warning +- riscv: clocksource: Fix stimecmp update hazard on RV32 +- kconfig: fix static linking of nconf +- spi: spi-sprd-adi: Fix double free in probe error path +- spi: sprd-adi: switch to use spi_alloc_host() +- spi: sprd: adi: Use devm_register_restart_handler() +- interconnect: debugfs: initialize src_node and dst_node to empty strings +- iio: adc: ad7280a: handle spi_setup() errors in probe() +- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection +- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro +- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names +- comedi: Fix getting range information for subdevices 16 to 255 +- x86/kfence: avoid writing L1TF-vulnerable PTEs +- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro +- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 +- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() +- scsi: storvsc: Process unsupported MODE_SENSE_10 +- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA +- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro +- Revert "nfc/nci: Add the inconsistency check between the input data length and count" +- w1: fix redundant counter decrement in w1_attach_slave_device() +- w1: therm: Fix off-by-one buffer overflow in alarms_store +- comedi: dmm32at: serialize use of paged registers +- serial: 8250_pci: Fix broken RS485 for F81504/508/512 +- octeontx2: cn10k: fix RX flowid TCAM mask handling +- veth: fix data race in veth_get_ethtool_stats +- fou: Don't allow 0 for FOU_ATTR_IPPROTO. +- tools: ynl: Specify --no-line-number in ynl-regen.sh. +- gue: Fix skb memleak with inner IP protocol 0. +- amd-xgbe: avoid misleading per-packet error log +- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error +- selftests: net: fib-onlink-tests: Convert to use namespaces by default +- selftests/net: convert fib-onlink-tests.sh to run it in unique namespace +- net: usb: dm9601: remove broken SR9700 support +- igc: fix race condition in TX timestamp read for register 0 +- ice: Avoid detrimental cleanup for bond during interface stop +- ice: initialize ring_stats->syncp +- ata: libata: Print features also for ATAPI devices +- ata: libata: Call ata_dev_config_lpm() for ATAPI devices +- ata: libata-core: Introduce ata_dev_config_lpm() +- ata: libata: Add cpr_log to ata_dev_print_features() early return +- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP +- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO +- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions +- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner +- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains +- dt-bindings: power: rpmpd: Update part number to X1E80100 +- dt-bindings: power: qcom,rpmpd: document the SM8650 RPMh Power Domains +- dt-bindings: power: rpmpd: Add MSM8917, MSM8937 and QM215 +- dt-bindings: power: qcom,rpmpd: Add SM7150 +- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE +- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() +- hyperv-tlfs: Change prefix of generic HV_REGISTER_* MSRs to HV_MSR_* +- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links +- io_uring: move local task_work in exit cancel loop +- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type +- dmaengine: ti: k3-udma: fix device leak on udma lookup +- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation +- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation +- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() +- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() +- dmaengine: lpc18xx-dmamux: fix device leak on route allocation +- dmaengine: idxd: fix device leaks on compat bind and unbind +- dmaengine: dw: dmamux: fix OF node leak on route allocation failure +- dmaengine: bcm-sba-raid: fix device leak on probe +- dmaengine: at_hdmac: fix device leak on of_dma_xlate() +- dmaengine: apple-admac: Add "apple,t8103-admac" compatible +- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() +- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel +- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare +- drm/amdkfd: fix a memory leak in device_queue_manager_init() +- drm/amd: Clean up kfd node on surprise disconnect +- drm/amd/display: Bump the HDMI clock to 340MHz +- LoongArch: Fix PMU counter allocation for mixed-type event groups +- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure +- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free +- EDAC/i3200: Fix a resource leak in i3200_probe1() +- EDAC/x38: Fix a resource leak in x38_probe1() +- hrtimer: Fix softirq base check in update_needs_ipi() +- nvme-pci: disable secondary temp for Wodposit WPBSNM8 +- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable +- USB: serial: option: add Telit LE910 MBIM composition +- USB: OHCI/UHCI: Add soft dependencies on ehci_platform +- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor +- usb: dwc3: Check for USB4 IP_NAME +- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 +- phy: rockchip: inno-usb2: fix disconnection in gadget mode +- phy: freescale: imx8m-pcie: assert phy reset during power on +- phy: rockchip: inno-usb2: fix communication disruption in gadget mode +- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers +- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts +- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. +- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak +- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer +- HID: usbhid: paper over wrong bNumDescriptor field +- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA +- dmaengine: omap-dma: fix dma_pool resource leak in error paths +- phy: stm32-usphyc: Fix off by one in probe() +- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend +- phy: drop probe registration printks +- phy: phy-snps-eusb2: refactor constructs names +- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it +- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing +- dmaengine: tegra-adma: Fix use-after-free +- mm, kfence: describe @slab parameter in __kfence_obj_info() +- textsearch: describe @list member in ts_ops search +- ASoC: tlv320adcx140: fix word length +- ASoC: tlv320adcx140: fix null pointer +- selftests: drv-net: fix RPS mask handling for high CPU numbers +- btrfs: fix memory leaks in create_space_info() error paths +- btrfs: introduce btrfs_space_info sub-group +- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() +- btrfs: factor out init_space_info() from create_space_info() +- btrfs: store fs_info in space_info +- net/mlx5e: Restore destroying state bit after profile cleanup +- vsock/test: add a final full barrier after run all tests +- net: update netdev_lock_{type,name} +- net: bridge: annotate data-races around fdb->{updated,used} +- net: bridge: Set BR_FDB_ADDED_BY_USER early in fdb_add_entry +- btrfs: send: check for inline extents in range_is_hole_in_parent() +- can: etas_es58x: allow partial RX URB allocation to succeed +- ASoC: codecs: wsa884x: fix codec initialisation +- firmware: imx: scu-irq: Set mu_resource_id before get handle +- xfrm: clear trailing padding in build_polexpire() +- smb: client: fix OOB reads parsing symlink error response +- smb: client: fix off-by-8 bounds check in check_wsl_eas() +- nvme-pci: ensure we're polling a polled queue +- ext4: avoid infinite loops caused by residual data +- ksmbd: fix OOB write in QUERY_INFO for compound requests + +* Thu May 07 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-151.0.0.137 +- !20821 [OLK-6.6] Intel: Backport Architectual PEBS for Intel platforms +- !22197 dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() +- !21790 Fix CVE-2026-31407 +- !22090 Fix CVE-2026-31424 +- !22088 Fix CVE-2026-31423 +- !22086 Fix CVE-2026-31420 +- !22085 Fix CVE-2026-31418 +- !22083 Fix CVE-2026-31516 +- !22084 Fix CVE-2026-31665 +- !22056 Fix CVE-2026-31590 +- !21974 Fix CVE-2026-31542 +- !22042 Fix CVE-2026-31628 +- !22189 Revert "KVM: arm64: Add a module param to enable/disable pv_preempted dynamically" +- dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() +- !22179 Fix CVE-2026-31532 +- !22177 Fix CVE-2026-31533 +- !22180 Fix CVE-2026-31429 +- !22153 iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() +- Revert "KVM: arm64: Add a module param to enable/disable pv_preempted dynamically" +- !22172 PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup +- !21260 bfq: Lock when clearing the q->elevator entry +- !22024 nvmet: move async event work off nvmet-wq +- !21972 Fix CVE-2026-31451 +- !21942 Fix CVE-2026-31450 +- !22015 Fix CVE-2026-31449 +- !21937 Fix CVE-2026-31447 +- !21941 Fix CVE-2026-31446 +- net: skb: fix cross-cache free of KFENCE-allocated skb head +- can: raw: fix ro->uniq use-after-free in raw_rcv() +- !21089 [OLK-6.6] Fix CVE-2025-68345 +- !21115 [OLK-6.6] Fix CVE-2025-68334 +- !21116 [OLK-6.6] Fix CVE-2025-68320 +- !21119 [OLK-6.6] Fix CVE-2025-68765 +- !21117 [OLK-6.6] Fix CVE-2025-68340 +- !21139 [OLK-6.6] Fix CVE-2025-68753 +- net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption +- !22158 perf/x86: Fix potential bad container_of in intel_pmu_hw_config +- PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup +- !21771 [OLK-6.6][Intel-SIG] Backport upstream x86/topo: SNC Divination patch series +- !22156 drm/i915/gt: Check set_default_submission() before deferencing +- !22155 urma: change kzalloc into vzalloc for ubcore +- !22044 ALSA: ctxfi: Limit PTP to a single page +- urma: change kzalloc into vzalloc for ubcore +- perf/x86: Fix potential bad container_of in intel_pmu_hw_config +- !22154 A set of CVE fixes for Bluetooth +- !21931 Fix CVE-2026-31452 +- drm/i915/gt: Check set_default_submission() before deferencing +- Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() +- Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete +- Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb +- Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() +- Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop +- iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() +- !22071 CVE-2026-31673 +- !22050 Fix CVE-2026-31674 +- !22069 CVE-2026-31680 +- !22025 Fix CVE-2026-31682 +- !22002 Fix CVE-2026-31546 +- !22011 Fix CVE-2026-31570 +- !22000 Fix CVE-2026-31495 +- !21999 Fix CVE-2026-31496 +- KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION +- netfilter: conntrack: add missing netlink policy validations +- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP +- net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() +- bridge: mrp: reject zero test interval to avoid OOM panic +- netfilter: ipset: drop logically empty buckets in mtype_del +- netfilter: nft_ct: fix use-after-free in timeout object destroy +- xfrm: prevent policy_hthresh.work from racing with netns teardown +- af_unix: read UNIX_DIAG_VFS data under unix_state_lock +- net: ipv6: flowlabel: defer exclusive option free until RCU teardown +- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() +- ALSA: ctxfi: Limit PTP to a single page +- x86/CPU: Fix FPDSS on Zen1 +- bridge: br_nd_send: linearize skb before parsing ND options +- nvmet: move async event work off nvmet-wq +- ext4: validate p_idx bounds in ext4_ext_correct_indexes +- ext4: prevent partial update of the extents path +- ext4: refactor ext4_ext_rm_idx() to index 'path' +- can: gw: fix OOB heap access in cgw_csum_crc8_rel() +- net: bonding: fix NULL deref in bond_debug_rlb_hash_show +- netfilter: ctnetlink: use netlink policy range checks +- netfilter: nf_conntrack_expect: skip expectations in other netns via proc +- x86/platform/uv: Handle deconfigured sockets +- ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio +- ext4: publish jinode after initialization +- ext4: fix use-after-free in update_super_work when racing with umount +- ext4: reject mount if bigalloc with s_first_data_block != 0 +- ext4: convert inline data to extents when truncate exceeds inline size +- x86/topo: Fix SNC topology mess +- x86/topo: Replace x86_has_numa_in_package +- x86/topo: Add topology_num_nodes_per_package() +- x86/numa: Store extra copy of numa_nodes_parsed +- x86/smpboot: avoid SMT domain attach/destroy if SMT is not enabled +- x86/smpboot: moves x86_topology to static initialize and truncate +- x86/smpboot: remove redundant CONFIG_SCHED_SMT +- smpboot: introduce SDTL_INIT() helper to tidy sched topology setup +- sched: Move sched domain name out of CONFIG_SCHED_DEBUG +- x86/topology: Remove x86_smt_flags and use cpu_smt_flags directly +- x86/mm: Don't print out SRAT table information +- powerpc/smp: Dynamically build Powerpc topology +- powerpc/smp: Avoid asym packing within thread_group of a core +- powerpc/smp: Add __ro_after_init attribute +- powerpc/smp: Disable MC domain for shared processor +- powerpc/smp: Enable Asym packing for cores on shared processor +- bfq: Lock when clearing the q->elevator entry +- ALSA: firewire-motu: add bounds check in put_user loop for DSP events +- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() +- team: Move team device type change at the end of team_port_add +- lan966x: Fix sleeping in atomic context +- platform/x86/amd/pmc: Add support for Van Gogh SoC +- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() +- tools headers: Sync x86 headers with kernel sources +- perf/x86: Add PERF_CAP_PEBS_TIMING_INFO flag +- perf/x86/intel: Use early_initcall() to hook bts_init() +- perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common() +- perf/x86/intel: Fix and clean up intel_pmu_drain_arch_pebs() type use +- perf/x86/intel: Optimize PEBS extended config +- perf/x86/intel: Check PEBS dyn_constraints +- perf/x86/intel: Add a check for dynamic constraints +- perf/x86/intel: Add counter group support for arch-PEBS +- perf/x86/intel: Setup PEBS data configuration and enable legacy groups +- perf/x86/intel: Update dyn_constraint base on PEBS event precise level +- perf/x86/intel: Allocate arch-PEBS buffer and initialize PEBS_BASE MSR +- perf/x86/intel: Process arch-PEBS records or record fragments +- perf/x86/intel/ds: Factor out PEBS group processing code to functions +- perf/x86/intel/ds: Factor out PEBS record processing code to functions +- perf/x86/intel: Initialize architectural PEBS +- perf/x86/intel: Correct large PEBS flag check +- perf/x86/intel: Replace x86_pmu.drain_pebs calling with static call +- perf/x86: Fix NULL event access and potential PEBS record loss +- perf/x86: Remove redundant is_x86_event() prototype +- perf/core: Check sample_type in perf_sample_save_brstack +- perf/core: Check sample_type in perf_sample_save_callchain +- perf/x86/intel/ds: Remove redundant assignments to sample.period +- perf/x86/intel: Introduce pairs of PEBS static calls +- perf/x86/intel: Rename x86_pmu.pebs to x86_pmu.ds_pebs +- perf/x86/intel: Decouple BTS initialization from PEBS initialization + +* Thu May 07 2026 zhangqiumiao <zhangqiumiao1@h-partners.com> - 6.6.0-150.0.0.136 +- kernel.spec: fix symbol conflicts between 4K and 64K page packages + +* Fri May 01 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-150.0.0.135 +- !22147 Fix CVE-2026-31431 +- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl +- crypto: authencesn - Fix src offset when decrypting in-place +- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption +- crypto: authenc - use memcpy_sglist() instead of null skcipher +- crypto: algif_aead - snapshot IV for async AEAD requests +- crypto: algif_aead - Revert to operating out-of-place +- crypto: algif_aead - use memcpy_sglist() instead of null skcipher +- crypto: scatterwalk - Backport memcpy_sglist() +- crypto: algif_aead - Fix minimum RX size check for decryption +- !22111 Fix CVE-2026-31651 +- !22095 Fix CVE-2026-31430 +- !21996 Fix CVE-2026-31504 +- !21997 Fix CVE-2026-31515 +- !22098 Fix CVE-2026-31678 +- !22113 Bluetooth: hci_sync: fix double unlock in hci_discovery_filter_clear() +- !21769 [OLK-6.6] [Intel-SIG]: Support for Intel Microcode Staging Feature +- !20823 [Intel-SIG] DMR APX support - kernel-host part +- Bluetooth: hci_sync: fix double unlock in hci_discovery_filter_clear() +- mmc: vub300: fix NULL-deref on disconnect +- !22006 Fix CVE-2026-31677 +- X.509: Fix out-of-bounds access when parsing extensions +- !21918 perf/x86/intel: Add missing branch counters constraint apply +- crypto: af_alg - limit RX SG extraction by receive buffer budget +- !21987 ub/ubdevshm: Remove KABI for compatible with Ubuntu x86, add version verification interface. +- ub/ubdevshm: Remove KABI for compatible with Ubuntu x86, add version verification interface. +- !21992 urma: move variable initialization before use in error branch +- openvswitch: defer tunnel netdev_put to RCU release +- !22077 bpf: Fix the use of prog->axu->sleepable +- bpf: Fix the use of prog->axu->sleepable +- !21981 Fix CVE-2026-31415 +- !21980 Fix CVE-2026-31416 +- !21984 Fix CVE-2026-31427 +- !21979 Fix CVE-2026-31428 +- urma: move variable initialization before use in error branch +- !21885 AMD Venice Machine Check Exception (MCE) rework patches backport to openEuler 6.6 kernel. +- !21876 [Hygon][6.6][Feature] pwm: dwc: Add support for Hygon pwm controller +- !21537 [Hygon][6.6][Feature]EDAC/amd64: Adjust the maximum number of memory controllers per node to 1 for Hygon family 18h model 18h +- !21358 [Hygon][6.6][Feature] EDAC/amd64: Add support for Hygon family 18h model 18h +- !21818 update rnpm driver to version 1.0.0. +- !22035 v3 critical err extend +- !21882 v2 mainline bpf patch +- !22020 ub: udma: fix a bug related to free rcu mem +- !21940 [OLK-6.6] ub: ubase: 4 bugfix changes +- numa: add critical_err sysfs interface for remote node recovery +- mm: mark node as critical_err on remote RAS error +- !21916 Fix CVE-2026-31528 +- !21990 KVM: arm64: Add a module param to enable/disable pv_preempted dynamically +- !21962 bugfixes for vtimer-irqbypass & HIP12 vtimer support +- ub: udma: fix a bug related to free rcu mem +- ub: ubase: Add a soft dependency declaration for the ubase driver +- ub: ubase: Rectify the problem that the shutdown process ends and logs are printed +- ub: ubase: Verify the length of ctrlq rq msg +- !21971 net: hns3: set the freed pointer to NULL +- !21995 bpf: Load vmlinux btf for any struct_ops map +- !21994 [OLK-6.6][linux-6.6.y sync] Backport 6.6.120-6.6.121 LTS Patches +- !20877 [OLK-6.6][LoongArch] Loongarch 架构下 CPU 离线时存在 vCPU 线程高 CPU 使用率问题。 +- !21296 [OLK-6.6][LoongArch] LoongArch ACPI/cpufreq 子系统问题修复合集 +- !21686 AMD Venice ZEN6, EDAC and HWMON support patches for openEuler 6.6 kernel +- gpio: rockchip: Stop calling pinctrl for set_direction +- ub: ubase: debugfs supports tpg context query +- af_key: validate families in pfkey_send_migrate() +- net: fix fanout UAF in packet_release() via NETDEV_UP race +- bpf: Load vmlinux btf for any struct_ops map +- gpio: pca953x: fix wrong error probe return value +- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout +- ASoC: fsl_sai: Add missing registers to cache default +- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 +- ALSA: usb-audio: Update for native DSD support quirks +- can: j1939: make j1939_session_activate() fail if device is no longer registered +- drm/amd/display: Fix DP no audio issue +- powercap: fix sscanf() error return value handling +- powercap: fix race condition in register_control_type() +- NFS: trace: show TIMEDOUT instead of 0x6e +- ALSA: ac97: fix a double free in snd_ac97_controller_register() +- ALSA: ac97bus: Use guard() for mutex locks +- HID: quirks: work around VID/PID conflict for appledisplay +- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() +- net/mlx5e: Don't print error message due to invalid module +- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates +- inet: ping: Fix icmp out counting +- net: mscc: ocelot: Fix crash when adding interface under a lag +- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress +- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure +- netfilter: nf_tables: fix memory leak in nf_tables_newrule() +- gpio: pca953x: handle short interrupt pulses on PCAL devices +- gpio: pca953x: Add support for level-triggered interrupts +- gpio: pca953x: Utilise temporary variable for struct device +- gpio: pca953x: Utilise dev_err_probe() where it makes sense +- netfilter: nft_synproxy: avoid possible data-race on update operation +- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM +- ARM: dts: imx6q-ba16: fix RTC interrupt level +- arm64: dts: add off-on-delay-us for usdhc2 regulator +- scsi: ufs: core: Fix EH failure after W-LUN resume error +- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset +- smb/client: fix NT_STATUS_NO_DATA_DETECTED value +- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value +- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value +- NFS: Fix up the automount fs_context to use the correct cred +- NFSv4: ensure the open stateid seqid doesn't go backwards +- dm-snapshot: fix 'scheduling while atomic' on real-time kernels +- alpha: don't reference obsolete termio struct for TC* constants +- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels +- csky: fix csky_cmpxchg_fixup not working +- nfsd: convert to new timestamp accessors +- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping +- gpio: rockchip: mark the GPIO controller as sleeping +- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] +- drm/pl111: Fix error handling in pl111_amba_probe +- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag +- counter: 104-quad-8: Fix incorrect return value in IRQ handler +- lib/crypto: aes: Fix missing MMU protection for AES S-box +- mei: me: add nova lake point S DID +- btrfs: always detect conflicting inodes when logging inode refs +- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() +- atm: Fix dma_free_coherent() size +- NFSD: Fix permission check for read access to executable-only files +- KVM: arm64: fix build without VIRT_VTIMER_PV_STATUS +- irqchip/mbigen: hardcode gicr_base for HIP12 +- irqchip/mbigen: add HIP12 support for vtimer irq bypass +- irqchip/gic-v3-its: Read ITS_VERSION with vendor checking +- KVM: arm64: fix mbigen vtimer interrupt loss in save/restore +- irqchip/mbigen: add check for GICv4.1 before enabling vtimer +- netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp +- KVM: arm64: Add a module param to enable/disable pv_preempted dynamically +- !21970 urma: add rate limit for high-frequency error logs in ubmad and ubcm +- ipv6: avoid overflows in ip6_datagram_send_ctl() +- netfilter: nfnetlink_log: account for netlink header size +- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD +- !21935 ub:hisi-ubus: add soft dep of ummu for hisi_ubus +- !21969 kprobes: avoid crash when rmmod/insmod after ftrace killed +- net: hns3: set the freed pointer to NULL +- net: hns3: add support to query/set pfc_prevention_tout for ethtool +- urma: add rate limit for high-frequency error logs in ubmad and ubcm +- net: hns3: debugfs support for dumping fd rules +- net: hns3: support tc flow for vf +- net: hns3: support FLOW_DISSECTOR_KEY_IP and FLOW_DISSECTOR_KEY_ENC_KEYID for tc flow +- net: hns3: support two more actions for tc flow +- net: hns3: Improved the unused_tuple parameter setting. +- net: hns3: adjust add_cls_flower() for support more action +- net: hns3: Clear the static alarm about 'no previous prototype' +- net: hns3: Clear the static alarm about discarding the 'const' qualifier +- !21819 Support sched ext bpf-part +- kprobes: avoid crash when rmmod/insmod after ftrace killed +- !21857 hwtracing: hisi_ptt: Add an error handling when pcim_iomap_table fails +- !21903 ptt: Adapt the PTT tune event name in the document match to the actual +- !21852 scsi: hisi_sas: Correct the printing format issues +- !21914 bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN +- !21960 udma：fix ub udma set dev name style +- !21955 urma: check driver and wq duration for conn_err +- !21956 urma: rate-limit error logs across ubcore +- udma：fix ub udma set dev name style +- urma: rate-limit error logs across ubcore +- !21932 urma: fix ubcore_get_device_by_eid without put. +- ub:hisi-ubus: add soft dep of ummu for hisi_ubus +- !21396 KVM: arm64: Add Support for MBIGEN vtimer's pv active status +- urma: fix ubcore_get_device_by_eid without put. +- kvm: arm64: set default early time for HIP12 +- openeuler_defconfig: Enable CONFIG_VIRT_TIMER_EARLY_INJECT by default +- KVM: arm64: Add KVM_CAP_ARM_TIMER_EARLY_INJECT capability +- clocksource/drivers/arm_arch_timer: Use PV timer early inject interface +- arm64: paravirt: Implement timer early inject PV guest support +- kvm: arm64: Implement timer early inject PV hypcall handling +- kvm: arm64: Add VIRT_TIMER_EARLY_INJECT configuration and SMCCC definitions +- openeuler_defconfig: Enable CONFIG_VIRT_VTIMER_PV_STATUS by default +- KVM: arm64: Add KVM_CAP_ARM_HISI_PVTIMER_STATUS capability +- !21915 drivers/ub/sentry: fix sscanf buffer overflow in proc_client_info_write and fix input length validation in proc_oom_rate_limit_write +- !21929 urma: use user-specified ue_idx for bonding import exchange +- urma: use user-specified ue_idx for bonding import exchange +- !21701 urma: fix ubcore_get_device_by_eid uaf. +- !21706 urma: fix double put ubagg_dev. +- !21919 sched/fair: Clear rel_deadline when initializing forked entities +- KVM: arm64: Implement vtimer active status MMIO handling +- KVM: arm64: vgic: Add is_uaccess parameter for active state handling +- irqchip/gic-v3: Report vtimer active status to hypervisor +- arm64: paravirt: Add pvtimer status support for guest +- KVM: arm64: Provide VCPU attributes for pvtimer status +- KVM: arm64: Add vCPU pvtimer_status structure and initialization +- !21883 urma: Fix UAF risk in the ubagg_dev_exists function +- !21899 [Hygon][6.6][bugfix] Fix switch_kernel_fpu_prepare in Hygon non-atomic NT copy path +- urma: fix double put ubagg_dev. +- !21906 mfs: handle file system umount event +- urma: fix ubcore_get_device_by_eid uaf. +- sched/fair: Clear rel_deadline when initializing forked entities +- perf/x86/intel: Add missing branch counters constraint apply +- !21889 urma: ubcore_get_tp_list log ratelimit +- perf: Make sure to use pmu_ctx->pmu for groups +- perf: Fix kabi breakage of perf_output_handle +- perf: Avoid the read if the count is already updated +- perf: Extract a few helpers +- scsi: hisi_sas: Fix the risk of overflow in bitwise logical operations +- !21908 ub/ubmempfd: Fix issues from AI and ub/ubdevshm: Bugfix for multi-Ops with same va, optimize print format and correct boundary check and reference count misused +- EDAC/amd64: Adjust the maximum number of memory controllers per node to 1 for Hygon family 18h model 18h +- drivers/ub/sentry: fix sscanf buffer overflow in proc_client_info_write +- drivers/ub/sentry: fix input length validation in proc_oom_rate_limit_write +- urma: Add rate limiting to loggin within ubcore_get_tp_list and connection related error routines to mitigate soft lockup risks from excessive printk output, and resolve orthographic errors +- ub/ubmempfd: Fix issues from AI +- ub/ubdevshm: Optimize print format +- ub/ubdevshm: Fix issues from AI. +- scsi: hisi_sas: Correct printing format issues +- !21898 Fix CVE-2026-31473 +- EDAC/amd64: Add support for Hygon family 18h model 18h +- EDAC/amd64: Convert Hygon family 18h model checks to switch-case +- bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN +- !21910 urma: switch to acalloc for large memory allocation +- !21891 urma: fix wk-jetty send implementation +- urma: switch to acalloc for large memory allocation +- urma: fix wk-jetty send implementation +- !21894 sched/ebpf: Fix bpf_sched_set_task_prefer_nid() +- ub/ubdevshm: Bugfix for multi-Ops with same va. +- ub/ubdevshm: Optimize functions to improve readability. +- mfs: handle file system umount event +- mfs: notify user-space programs when it is being unmounted +- !21755 AMD Venice NB & SMN patches backport to OpenEuler 6.6 kernel +- ptt: Adapt the PTT tune event name in the document match to the actual names in the code. +- !21030 [OLK-6.6][LoongArch] LoongArch 下 KVM 在 MMU 映射变更时存在 LLBCTL 寄存器未清除问题。 +- !21031 [OLK-6.6][LoongArch] Loongarch 下 KVM 在用户模式 VMM 中存在无法处理特殊 hypercall 服务的现象。 +- !21294 [OLK-6.6][LoongArch] LoongArch KVM 子系统问题修复合集 +- x86/fpu: fix wrong thread_flag check in switch_kernel_fpu_prepare +- x86/copy_user_avx2: add sfence before vzeroupper in fixup path +- media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex +- !21895 Fix CVE-2026-31467 +- erofs: add GFP_NOIO in the bio completion if needed +- sched/ebpf: Fix bpf_sched_set_task_prefer_nid() +- !21884 v2 fix CVE-2026-31398 +- Euler: configs: enable AMD NODE and HSMP drivers in x86 defconfig +- !21890 ub: udma: Delete the mailbox memory allocation and release in UDMA +- LoongArch: Add cpuhotplug hooks to fix high cpu usage of vCPU threads +- LoongArch: KVM: Clear LLBCTL if secondary mmu mapping is changed +- LoongArch: KVM: rename extioi to eiointc +- LoongArch: KVM: Remove duplicated cache attribute setting +- LoongArch: KVM: Set page with write attribute if dirty track disabled +- LoongArch: KVM: Simplify kvm_deliver_intr() +- LoongArch: KVM: Rework kvm_send_pv_ipi() +- LoongArch: KVM: Restore guest PMU if it is enabled +- LoongArch: KVM: Add delay until timer interrupt injected +- LoongArch: KVM: Move kvm_iocsr tracepoint out of generic code +- LoongArch: KVM: Add PTW feature detection on new hardware +- LoongArch: KVM: Remove unused returns and semicolons +- LoongArch: KVM: Add tracepoints for CPUCFG and CSR emulation exits +- LoongArch: KVM: Add ecode parameter for exception handlers +- LoongArch: KVM: Fully clear some CSRs when VM reboot +- LoongArch: KVM: Fix multiple typos of KVM code +- LoongArch: KVM: Add stub for kvm_arch_vcpu_preempted_in_kernel() +- LoongArch: KVM: Remove unnecessary header include path +- LoongArch: KVM: Set host with kernel mode when switch to VM mode +- LoongArch: KVM: Fix typo issue about GCFG feature detection +- LoongArch: KVM: Protect kvm_check_requests() with SRCU +- LoongArch: KVM: Fix GPA size issue about VM +- LoongArch: KVM: Adapt pch_pic alignment check +- LoongArch: KVM: Use kvm_get_vcpu_by_id() instead of kvm_get_vcpu() +- LoongArch: KVM: Adapt send_ipi_data() stack protector fix +- LoongArch: KVM: Make function kvm_own_lbt() robust +- ub: udma: Delete the mailbox memory allocation and release in UDMA +- ub: ubase: Release the MAILBOX memory when AE is received +- x86/mce/amd: Filter bogus hardware errors on Zen3 clients +- x86/mce/amd: Check SMCA feature bit before accessing SMCA MSRs +- mm/rmap: fix incorrect pte restoration for lazyfree folios +- mm: introduce FPB_RESPECT_WRITE for PTE batching infrastructure +- mm: remove boolean output parameters from folio_pte_batch_ext() +- mm: split folio_pte_batch() into folio_pte_batch() and folio_pte_batch_flags() +- mm: smaller folio_pte_batch() improvements +- mm: convert FPB_IGNORE_* into FPB_RESPECT_* +- mm: fix folio_pte_batch() on XEN PV +- x86/mce: Handle AMD threshold interrupt storms +- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems +- x86/mce: Add support for physical address valid bit +- x86/mce: Save and use APEI corrected threshold limit +- x86/mce/amd: Define threshold restart function for banks +- x86/mce/amd: Remove redundant reset_block() +- x86/mce/amd: Support SMCA Corrected Error Interrupt +- x86/mce/amd: Enable interrupt vectors once per-CPU on SMCA systems +- x86/mce: Unify AMD DFR handler with MCA Polling +- x86/mce: Unify AMD THR handler with MCA Polling +- x86/mce: Add a clear_bank() helper +- x86/msr: Rename 'mce_wrmsrl()' to 'mce_wrmsrq()' +- x86/msr: Rename 'mce_rdmsrl()' to 'mce_rdmsrq()' +- x86/MCE/AMD: Add support for new MCA_SYND{1,2} registers +- tracing: Add __print_dynamic_array() helper +- x86/mce: Move machine_check_poll() status checks to helper functions +- x86/mce: Separate global and per-CPU quirks +- x86/mce: Convert family/model mixed checks to VFM-based checks +- x86/cpu/intel: Replace PAT erratum model/family magic numbers with symbolic IFM references +- x86/mce: Cleanup bank processing on init +- x86/mce: Do 'UNKNOWN' vendor check early +- x86/mce: Break up __mcheck_cpu_apply_quirks() +- x86/mce: Make four functions return bool +- x86/mce: Make several functions return bool +- x86/mce: Add wrapper for struct mce to export vendor specific info +- x86/mce: Use mce_prep_record() helpers for apei_smca_report_x86_error() +- x86/mce: Define mce_prep_record() helpers for common and per-CPU fields +- x86/mce: Rename mce_setup() to mce_prep_record() +- x86/mce: Remove unused variable and return value in machine_check_poll() +- x86/mce: Switch to new Intel CPU model defines +- x86/mce: Dynamically size space for machine check records +- x86/mce: Remove redundant check from mce_device_create() +- x86/mce: Cleanup mce_usable_address() +- x86/mce: Define amd_mce_usable_address() +- x86/MCE/AMD: Split amd_mce_is_memory_error() +- x86/cpu: Clear SVM feature if disabled by BIOS +- x86/mce: Define BSP-only SMCA init +- x86/mce: Define BSP-only init +- x86/mce: Set CR4.MCE last during init +- x86/mce: Remove __mcheck_cpu_init_early() +- x86/mce/amd: Put list_head in threshold_bank +- x86/mce/amd: Remove shared threshold bank plumbing +- x86/mce/amd: Remove smca_banks_map +- x86/mce/amd: Remove return value for mce_threshold_{create,remove}_device() +- x86/mce/amd: Rename threshold restart function +- x86/mce: Ensure user polling settings are honored when restarting timer +- x86/mce: Add per-bank CMCI storm mitigation +- x86/mce: Remove old CMCI storm mitigation code +- tools headers x86 cpufeatures: Sync with the kernel sources to pick ZEN6 and Indirect Target Selection (ITS) bits +- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models +- EDAC/amd64: Add support for AMD family 1Ah-based newer models +- x86/CPU/AMD: Add X86_FEATURE_ZEN6 +- x86/cpufeatures: Free up unused feature bits +- urma: Fix UAF risk in the ubagg_dev_exists function +- bpf: Fix incorrect pruning due to atomic fetch precision tracking +- bpf: reject direct access to nullable PTR_TO_BUF pointers +- bpf: Reject sleepable kprobe_multi programs at attach time +- cpufreq: loongson3-acpi-cpufreq: Expand cpu id field for 3C6000 +- LoongArch: Adapt upstream backport for openEuler +- !20267 [OLK-6.6] Backported Turin readiness patches for openEuler Phase-1 +- !21332 AMD Turin PREFETCHI support patches for openEuler 6.6 kernel +- !21867 urma: fix kernel irq profiling +- !21868 urma: fix peer reconnection notification after ubagg failover +- pwm: dwc: Add support for Hygon pwm controller +- urma: fix kernel irq profiling +- !21746 xSched dmem +- !21824 v2 Introduce xSched dmem +- !21865 urma: fix the panic issue caused by ipourma abnormal exit +- !21866 urma: add configurable retransmission count limit +- urma: fix peer reconnection notification after ubagg failover +- urma: add configurable retransmission count limit +- !21859 net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check +- !21837 [OLK-6.6][linux-6.6.y sync][Part 3/3] Backport 6.6.119-6.6.120 LTS Patches +- !21858 ub: udma: fix a bug related to get tp list. +- urma: fix the panic issue caused by ipourma abnormal exit +- hwtracing: hisi_ptt: Add an error handling when pcim_iomap_table fails to obtain the device's I/O map table. +- hwtracing: hisi_ptt: Add an error handler when the PTT device returns an incorrect size. +- hwtracing: hisi_ptt: Corrcet some spelling mistakes in hisi_ptt driver +- net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check +- !21855 perf/core: Fix race between perf_event_exit_task and perf_pending_task +- ub: udma: fix a bug related to get tp list. +- !21176 v4 Fix CVE-2025-21696. +- !21844 mm/numa_remote: set default distance between remote nodes to 255 +- !21839 urma: add timeout mechanism for TP state waiting loop +- !21840 ub: udma: bugfix related to stars jfc db. +- !21856 net: usb: kaweth: validate USB endpoints +- !21854 arm64: mm: fix pass user prot to ioremap_prot in generic_access_phys +- !21845 RDMA/hns: Support setting GSI QP SL +- net: usb: kaweth: validate USB endpoints +- perf/core: Fix race between perf_event_exit_task and perf_pending_task +- !21846 ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz +- !21851 drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() +- arm64: mm: fix pass user prot to ioremap_prot in generic_access_phys +- urma: add timeout mechanism for TP state waiting loop +- !21847 urma: fix log implementation in urma kmod +- !21848 urma: fix deactivate tp failure under RM share TP mode +- urma: fix log implementation in urma kmod +- !21849 urma: fix tjetty creation anomaly in the first connection creation +- drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() +- urma: fix tjetty creation anomaly in the first connection creation +- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume +- net: macb: Introduce gem_init_rx_ring() +- net: macb: queue tie-off or disable during WOL suspend +- net: macb: Shuffle the tx ring before enabling tx +- net: macb: Fix tx/rx malfunction after phy link down and up +- hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race +- net: openvswitch: Avoid releasing netdev before teardown completes +- ext4: fix error message when rejecting the default hash +- ext4: filesystems without casefold feature cannot be mounted with siphash +- Revert "iommu/amd: Skip enabling command/event buffers for kdump" +- firmware: arm_scmi: Fix unused notifier-block in unregister +- tty: fix tty_port_tty_*hangup() kernel-doc +- pwm: stm32: Always program polarity +- virtio_console: fix order of fields cols and rows +- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() +- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() +- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() +- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() +- mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out() +- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() +- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() +- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() +- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() +- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() +- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() +- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() +- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() +- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() +- net: Allow to use SMP threads for backlog NAPI. +- net: Remove conditional threaded-NAPI wakeup based on task state. +- sched/fair: Small cleanup to sched_balance_newidle() +- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() +- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() +- media: mediatek: vcodec: Use spinlock for context list protection lock +- media: amphion: Remove vpu_vb_is_codecconfig +- media: amphion: Make some vpu_v4l2 functions static +- media: amphion: Add a frame flush mode for decoder +- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit +- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages +- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() +- mm/balloon_compaction: we cannot have isolated pages in the balloon list +- media: verisilicon: Fix CPU stalls on G2 bus error +- media: verisilicon: g2: Use common helpers to compute chroma and mv offsets +- media: verisilicon: Store chroma and motion vectors offset +- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() +- f2fs: use global inline_xattr_slab instead of per-sb slab cache +- f2fs: fix to propagate error from f2fs_enable_checkpoint() +- f2fs: fix to avoid updating compression context during writeback +- f2fs: drop inode from the donation list when the last file is closed +- f2fs: keep POSIX_FADV_NOREUSE ranges +- f2fs: remove unused GC_FAILURE_PIN +- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() +- powerpc/64s/radix/kfence: map __kfence_pool at page granularity +- drm/mediatek: Fix probe resource leaks +- drm/mediatek: Fix probe memory leak +- drm/amdgpu: Forward VMID reservation errors +- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration +- pmdomain: imx: Fix reference count leak in imx_gpc_probe() +- pmdomain: Use device_get_match_data() +- wifi: mac80211: Discard Beacon frames to non-broadcast address +- lockd: fix vfs_test_lock() calls +- mptcp: fallback earlier on simult connection +- PCI: brcmstb: Fix disabling L0s capability +- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 +- gpiolib: acpi: Add quirk for Dell Precision 7780 +- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap +- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error +- usb: ohci-nxp: fix device leak on probe failure +- usb: ohci-nxp: Use helper function devm_clk_get_enabled() +- mm/ksm: fix exec/fork inheritance support for prctl +- wifi: mt76: Fix DTS power-limits on little endian systems +- btrfs: don't rewrite ret from inode_permission +- gfs2: fix freeze error handling +- jbd2: fix the inconsistency between checksum and data in memory for journal sb +- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() +- ALSA: wavefront: Clear substream pointers on close +- ALSA: wavefront: Use guard() for spin locks +- ALSA: wavefront: Fix integer overflow in sample size validation +- ALSA: wavefront: Use standard print API +- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb +- drm/msm/dpu: Add missing NULL pointer check for pingpong interface +- drm/mgag200: Fix big-endian support +- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() +- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() +- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers +- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma +- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() +- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write +- net: usb: sr9700: fix incorrect command used to write single register +- nfsd: Drop the client reference in client_states_open() +- LoongArch: BPF: Zero-extend bpf_tail_call() index +- fjes: Add missing iounmap in fjes_hw_init() +- samples/ftrace: Adjust LoongArch register restore order in direct calls +- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting +- idr: fix idr_alloc() returning an ID out of range +- kasan: refactor pcpu kasan vmalloc unpoison +- compiler_types.h: add "auto" as a macro for "__auto_type" +- LoongArch: Use unsigned long for _end and _text +- LoongArch: Use __pmd()/__pte() for swap entry conversions +- LoongArch: Fix build errors for CONFIG_RANDSTRUCT +- LoongArch: Add new PCI ID for pci_fixup_vgadev() +- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() +- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe +- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe +- media: amphion: Cancel message work before releasing the VPU core +- media: vpif_display: fix section mismatch +- media: vpif_capture: fix section mismatch +- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path +- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index +- media: TDA1997x: Remove redundant cancel_delayed_work in probe +- media: samsung: exynos4-is: fix potential ABBA deadlock on init +- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled +- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() +- media: cec: Fix debugfs leak on bus_register() failure +- fbdev: tcx.c fix mem_map to correct smem_start offset +- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing +- fbdev: gbefb: fix to use physical address instead of dma address +- dm-bufio: align write boundary on physical block size +- dm-ebs: Mark full buffer dirty even on partial write +- firmware: stratix10-svc: Add mutex in stratix10 memory management +- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() +- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION +- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() +- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace +- media: rc: st_rc: Fix reset control resource leak +- mfd: max77620: Fix potential IRQ chip conflict when probing two devices +- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup +- clk: samsung: exynos-clkout: Assign .num before accessing .hws +- leds: leds-lp50xx: Enable chip before any communication +- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs +- leds: leds-lp50xx: Allow LED 0 to be added to module bank +- powerpc, mm: Fix mprotect on book3s 32-bit +- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths +- HID: logitech-dj: Remove duplicate error logging +- iommu: disable SVA when CONFIG_X86 is set +- iommu/tegra: fix device leak on probe_device() +- iommu/sun50i: fix device leak on of_xlate() +- iommu/qcom: fix device leak on of_xlate() +- iommu/omap: fix device leaks on probe_device() +- iommu/mediatek: fix device leak on of_xlate() +- iommu/mediatek-v1: fix device leaks on probe() +- iommu/mediatek-v1: fix device leak on probe_device() +- iommu/ipmmu-vmsa: fix device leak on of_xlate() +- iommu/exynos: fix device leak on of_xlate() +- iommu/apple-dart: fix device leak on of_xlate() +- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() +- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. +- ASoC: qcom: q6adm: the the copp device only during last instance +- ASoC: qcom: q6asm-dai: perform correct state check before closing +- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr +- ASoC: stm32: sai: fix OF node leak on probe +- ASoC: stm32: sai: fix clk prepare imbalance on probe failure +- ASoC: stm32: sai: fix device leak on probe +- ntfs: Do not overwrite uptodate pages +- selftests/ftrace: traceonoff_triggers: strip off names +- !21826 Fix CVE-2026-23448 +- urma: fix deactivate tp failure under RM share TP mode +- !21834 net: add sockopt TCP_UBS_HANDSHAKE +- !21760 Fix CVE-2026-31392 +- !21833 FIX CVE-2026-23473 +- ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz +- xsk: introduce helper to determine rxq->frag_size +- RDMA/hns: Support setting GSI QP SL +- RDMA/hns: Fix warning in poll cq direct mode +- RDMA/hns: Fix missing CQE when UD QP use different SL +- mm/numa_remote: set default distance between remote nodes to 255 +- !21295 [OLK-6.6][LoongArch] LoongArch EFI 子系统问题修复合集 +- !21297 [OLK-6.6][LoongArch] LoongArch KASAN 相关问题修复合集 +- !21298 [OLK-6.6][LoongArch] LoongArch 架构及杂项问题修复合集 +- ub: udma: bugfix related to stars jfc db. +- !21822 urma: fix of adapt to bondp_import +- net: add sockopt TCP_UBS_HANDSHAKE +- !21827 Fix CVE-2026-31426 +- !21835 ACPI: APEI: GHES: Don't send SIGBUS to kernel threads on ARM HW errors +- !21836 jfs: add dmapctl integrity check to prevent invalid operations +- RDMA/bnxt_re: fix dma_free_coherent() pointer +- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation +- ksmbd: Fix memory leak in get_file_all_info() +- RDMA/bnxt_re: Fix to use correct page size for PDE table +- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send +- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() +- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() +- RDMA/efa: Remove possible negative shift +- RDMA/irdma: avoid invalid read in irdma_net_event +- net: rose: fix invalid array index in rose_kill_by_device() +- net: stmmac: fix the crash issue for zero copy XDP_TX action +- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" +- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing +- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct +- net: dsa: b53: skip multicast entries for fdb_dump() +- firewire: nosy: Fix dma_free_coherent() size +- genalloc.h: fix htmldocs warning +- selftests: net: fix "buffer overflow detected" for tap.c +- amd-xgbe: reset retries and mode on RX adapt failures +- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic +- platform/x86: msi-laptop: add missing sysfs_remove_group() +- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy +- net: mdio: aspeed: add dummy read to avoid read-after-write issue +- Bluetooth: btusb: revert use of devm_kzalloc in btusb +- i40e: fix scheduling in set_rx_mode +- wifi: mac80211: do not use old MBSSID elements +- iommu/mediatek: fix use-after-free on probe deferral +- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 +- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU +- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU +- hwmon: (max16065) Use local variable to avoid TOCTOU +- i2c: amd-mp2: fix reference leak in MP2 PCI device +- platform/x86: intel: chtwc_int33fe: don't dereference swnode args +- rpmsg: glink: fix rpmsg device leak +- jfs: add dmapctl integrity check to prevent invalid operations +- ACPI: APEI: GHES: Don't send SIGBUS to kernel threads on ARM HW errors +- rnpm: update rnpm driver to version 1.0.0. +- io_uring/poll: fix multishot recv missing EOF on wakeup race +- io_uring/poll: improve readability of poll reference decrementing +- urma: fix of adapt to bondp_import +- !21788 Fix CVE-2026-23455 +- !21789 Fix CVE-2026-23449 +- !21815 Fix CVE-2026-23456 +- !21787 Fix CVE-2026-23457 +- !21785 Fix CVE-2026-23458 +- !21781 Fix CVE-2026-23439 +- !21786 Fix CVE-2026-23442 +- !21777 Fix CVE-2026-23450 +- !21780 Fix CVE-2026-31400 +- !21821 urma: fix psn exchange anomaly when import jfr +- LoongArch: efi: avoid double calling set_virtual_map() +- LoongArch: Fix the improper handling of the set_virtual_map's return value +- ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() +- LoongArch: Disable instrumentation for setup_ptwalker() +- !21817 mfs: remove anon_file item from struct mfs_cache_object +- net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check +- LoongArch: Remove some code if kasan_arch_is_ready() is false +- !21689 spi: fix statistics allocation +- !21624 mfs: fix race condition issue in try_hook_fd() +- !21299 [OLK-6.6][LoongArch] LoongArch 驱动子系统问题修复合集 +- !21745 [OLK-6.6] LoongArch: config: Revert CONFIG_RTC_DRV_EFI back to 'm' +- !21776 arm64/cpufeature: Fix unused enable_pseudo_nmi variable warning +- xSched/dmem: introduce xsched_dmem_cleanup() +- xSched/dmem: introduce xsched_dmem_free() +- xSched/dmem: introduce xsched_dmem_alloc() +- xSched/dmem: add support for XPU devices to register/unregister dmem regions +- urma: fix psn exchange anomaly when import jfr +- !21798 urma: fix psn exchange anomaly under share_tp mode +- !19506 [OLK-6.6]Update mucse rnp driver to 1.0.0 +- !19633 [OLK-6.6]RNPGBE: NET: Update driver to 1.0.0 +- bpf, docs: Fix broken link to renamed bpf_iter_task_vmas.c +- selftests/bpf: Add file_read_pattern to gitignore +- selftests/bpf: Add distilled BTF test about marking BTF_IS_EMBEDDED +- libbpf: Fix incorrect traversal end type ID when marking BTF_IS_EMBEDDED +- libbpf: Fix return zero when elf_begin failed +- selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill test +- bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing +- selftests/bpf: Use -4095 as the bad address for bits iterator +- selftests/bpf: Add three test cases for bits_iter +- bpf: Use __u64 to save the bits in bits iterator +- bpf: Check the validity of nr_words in bpf_iter_bits_new() +- bpf: Add bpf_mem_alloc_check_size() helper +- bpf: Free dynamically allocated bits in bpf_iter_bits_destroy() +- selftests/bpf: Check if distilled base inherits source endianness +- libbpf: Ensure new BTF objects inherit input endianness +- bpf: Fix a crash when btf_parse_base() returns an error pointer +- selftests/bpf: test passing iterator to a kfunc +- bpf: allow passing struct bpf_iter_<type> as kfunc arguments +- bpf: extract iterator argument type and name validation logic +- libbpf: Fix license for btf_relocate.c +- riscv, bpf: Fix out-of-bounds issue when preparing trampoline image +- libbpf: Fix error handling in btf__distill_base() +- bpf: fix build when CONFIG_DEBUG_INFO_BTF[_MODULES] is undefined +- selftests/bpf: Add kfunc_call test for simple dtor in bpf_testmod +- kbuild,bpf: Add module-specific pahole flags for distilled base BTF +- libbpf,bpf: Share BTF relocate-related code with kernel +- libbpf: Split field iter code into its own file kernel +- bpf: Fix kabi breakage in struct module +- module, bpf: Store BTF base pointer in struct module +- libbpf: BTF relocation followup fixing naming, loop logic +- resolve_btfids: Handle presence of .BTF.base section +- libbpf: Make btf_parse_elf process .BTF.base transparently +- selftests/bpf: Extend distilled BTF tests to cover BTF relocation +- libbpf: Split BTF relocation +- selftests/bpf: Test distilled base, split BTF generation +- libbpf: Add btf__distill_base() creating split BTF with distilled base BTF +- libbpf: Remove callback-based type/string BTF field visitor helpers +- bpftool: Use BTF field iterator in btfgen +- libbpf: Make use of BTF field iterator in BTF handling code +- libbpf: Make use of BTF field iterator in BPF linker code +- libbpf: Add BTF field iterator +- selftests/bpf: modify test_loader that didn't support running bpf_prog_type_syscall programs +- selftests/bpf: Add selftest for bits iter +- bpf: Add bits iterator +- kbuild, bpf: Use test-ge check for v1.25-only pahole +- kbuild,bpf: Switch to using --btf_features for pahole v1.26 and later +- bitops: make BYTES_TO_BITS() treewide-available +- bpf: Check return from set_memory_rox() +- bpf: Remove arch_unprotect_bpf_trampoline() +- bpf: Remove unnecessary err < 0 check in bpf_struct_ops_map_update_elem +- bpf: Fix kabi for bpf_prog_aux and bpf_prog +- bpf: move sleepable flag from bpf_prog_aux to bpf_prog +- selftests/bpf: Test struct_ops maps with a large number of struct_ops program. +- bpf: struct_ops supports more than one page for trampolines. +- bpf, net: validate struct_ops when updating value. +- selftests/bpf: Test if shadow types work correctly. +- bpftool: Add an example for struct_ops map and shadow type. +- bpftool: Generated shadow variables for struct_ops maps. +- libbpf: Convert st_ops->data to shadow type. +- libbpf: Set btf_value_type_id of struct bpf_map for struct_ops. +- bpf: introduce in_sleepable() helper +- selftests/bpf: Test PTR_MAYBE_NULL arguments of struct_ops operators. +- bpf: Create argument information for nullable arguments. +- bpf: Move __kfunc_param_match_suffix() to btf.c. +- bpf: Fix kabi for bpf_ctx_arg_aux +- bpf: add btf pointer to struct bpf_ctx_arg_aux. +- bpf, btf: Check btf for register_bpf_struct_ops +- selftests/bpf: Add tests for RCU lock transfer between subprogs +- bpf: Transfer RCU lock state between subprog calls +- selftests/bpf: Add test for static subprog call in lock cs +- bpf: Allow calling static subprogs while holding a bpf_spin_lock +- selftests/bpf: Suppress warning message of an unused variable. +- bpf: Remove an unnecessary check. +- libbpf: Add btf__new_split() API that was declared but not implemented +- bpf: treewide: Annotate BPF kfuncs in BTF +- bpf: btf: Add BTF_KFUNCS_START/END macro pair +- bpf: btf: Support flags for BTF_SET8 sets +- bpf: Fix error checks against bpf_get_btf_vmlinux(). +- libbpf: Ensure undefined bpf_attr field stays 0 +- selftests/bpf: test case for register_bpf_struct_ops(). +- bpf: export btf_ctx_access to modules. +- libbpf: Find correct module BTFs for struct_ops maps and progs. +- bpf, net: switch to dynamic registration +- bpf: validate value_type +- bpf_verifier: Fix kabi for bpf_verifier_env +- bpf: hold module refcnt in bpf_struct_ops map creation and prog verification. +- bpf: Fix kabi for bpf_attr +- bpf: pass attached BTF to the bpf_struct_ops subsystem +- bpf: lookup struct_ops types from a given module BTF. +- bpf: pass btf object id in bpf_map_info. +- bpf: make struct_ops_map support btfs other than btf_vmlinux. +- bpf: add struct_ops_tab to btf. +- bpf, net: introduce bpf_struct_ops_desc. +- bpf: get type information with BTF_ID_LIST +- bpf: refactory struct_ops type initialization to a function. +- riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops +- bpf: Introduce "volatile compare" macros +- s390/bpf: Fix indirect trampoline generation +- bpf: Fix dtor CFI +- cfi: Add CFI_NOSEAL() +- x86/cfi,bpf: Fix bpf_struct_ops CFI +- x86/cfi,bpf: Fix bpf_callback_t CFI +- x86/cfi,bpf: Fix BPF JIT call +- cfi: Flip headers +- x86, bpf: Use bpf_prog_pack for bpf trampoline +- bpf: Fix kabi-breakage for bpf_tramp_image +- bpf: Use arch_bpf_trampoline_size +- bpf: Add arch_bpf_trampoline_size() +- bpf, x86: Adjust arch_prepare_bpf_trampoline return value +- bpf: Add helpers for trampoline image management +- bpf: Adjust argument names of arch_prepare_bpf_trampoline() +- bpf: Let bpf_prog_pack_free handle any pointer +- selftests/bpf: Add lazy global subprog validation tests +- bpf: Fix kabi-breakage for bpf_func_info_aux +- bpf: Validate global subprogs lazily +- bpf: Emit global subprog name in verifier logs +- selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly +- bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg +- selftests/bpf: Add test for using css_task iter in sleepable progs +- selftests/bpf: Add tests for css_task iter combining with cgroup iter +- bpf: Relax allowlist for css_task iter +- bpf: Add __bpf_hook_{start,end} macros +- bpf: Add __bpf_kfunc_{start,end}_defs macros +- bpf: fix compilation error without CGROUPS +- kbuild: avoid too many execution of scripts/pahole-flags.sh +- selftests/bpf: Add tests for open-coded task and css iter +- selftests/bpf: rename bpf_iter_task.c to bpf_iter_tasks.c +- bpf: Let bpf_iter_task_new accept null task ptr +- bpf: teach the verifier to enforce css_iter and task_iter in RCU CS +- bpf: Introduce css open-coded iterator kfuncs +- bpf: Introduce task open coded iterator kfuncs +- bpf: Introduce css_task open-coded iterator kfuncs +- cgroup: Prepare for using css_task_iter_*() in BPF +- selftests/bpf: Add tests for open-coded task_vma iter +- bpf: Introduce task_vma open-coded iterator kfuncs +- selftests/bpf: Rename bpf_iter_task_vma.c to bpf_iter_task_vmas.c +- bpf: Don't explicitly emit BTF for struct btf_iter_num +- selftests/bpf: Test pinning bpf timer to a core +- bpf: Add ability to pin bpf timer to calling CPU +- bpf: Charge modmem for struct_ops trampoline +- !21791 Fix CVE-2026-23454 +- !21779 [OLK-6.6][linux-6.6.y sync][Part 2/3] Backport 6.6.119-6.6.120 LTS Patches +- !21816 [OLK-6.6]:update patches for sw64 architecture +- LoongArch: entry: Migrate ret_from_fork() to C +- LoongArch: Clarify 3 MSG interrupt features +- LoongArch: Always select HAVE_VIRT_CPU_ACCOUNTING_GEN +- drivers/amdgpu: amd rx550 should emit 10 fences after run a command +- LoongArch: Fix AP booting issue in VM mode +- LoongArch: Increase COMMAND_LINE_SIZE up to 4096 +- LoongArch: Relax memory ordering for atomic operations +- pci/quirks: 2k3000: set discrete GPU as default boot device if present +- drm/amdgpu: Make eleven EOP packet for GFX10_0/GFX11_0 have real content +- !21744 nfsd: fix heap overflow in NFSv4.0 LOCK replay cache +- !21740 NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd +- mfs: remove anon_file item from struct mfs_cache_object +- sw64: fix compile error with missing header file +- sw64: update openeuler_defconfig and remove junzhang_defconfig +- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case +- intel_th: fix device leak on output open() +- usb: gadget: lpc32xx_udc: fix clock imbalance in error path +- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" +- efi/cper: Fix cper_bits_to_str buffer handling and return value +- soc: amlogic: canvas: fix device leak on lookup +- soc: qcom: ocmem: fix device leak on lookup +- tracing: Fix fixed array of synthetic event +- amba: tegra-ahb: Fix device leak on SMMU enable +- crypto: caam - Add check for kcalloc() in test_len() +- selftests: openvswitch: Fix escape chars in regexp. +- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() +- s390/ipl: Clear SBP flag when bootprog is set +- btrfs: don't log conflicting inode if it's a dir moved in the current transaction +- svcrdma: return 0 on success from svc_rdma_copy_inline_range +- nfsd: Mark variable __maybe_unused to avoid W=1 build break +- net/handshake: restore destructor on submit failure +- r8169: fix RTL8117 Wake-on-Lan in DASH mode +- xfs: fix a memory leak in xfs_buf_item_init() +- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits +- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) +- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN +- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation +- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN +- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE +- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() +- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 +- parisc: Do not reprogram affinitiy on ASP chip +- scs: fix a wrong parameter in __scs_magic +- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver +- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) +- ocfs2: fix kernel BUG in ocfs2_find_victim_chain +- media: vidtv: initialize local pointers upon transfer of memory ownership +- tools/testing/nvdimm: Use per-DIMM device handle +- f2fs: fix return value of f2fs_recover_fsync_data() +- f2fs: fix age extent cache insertion skip on counter overflow +- f2fs: invalidate dentry cache on failed whiteout creation +- f2fs: fix to avoid updating zero-sized extent in extent cache +- f2fs: ensure node page reads complete before f2fs_put_super() finishes +- NFSD: use correct reservation type in nfsd4_scsi_fence_client +- scsi: aic94xx: fix use-after-free in device removal path +- cpufreq: nforce2: fix reference count leak in nforce2 +- cpuidle: governors: teo: Drop misguided target residency check +- intel_th: Fix error handling in intel_th_output_open +- char: applicom: fix NULL pointer dereference in ac_ioctl +- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() +- usb: dwc3: keep susphy enabled during exit to avoid controller faults +- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe +- usb: phy: isp1301: fix non-OF device reference imbalance +- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal +- USB: lpc32xx_udc: Fix error handling in probe +- phy: broadcom: bcm63xx-usbh: fix section mismatches +- media: pvrusb2: Fix incorrect variable used in trace message +- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. +- media: v4l2-mem2mem: Fix outdated documentation +- jbd2: use a weaker annotation in journal handling +- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key +- ext4: fix incorrect group number assertion in mb_check_buddy +- ktest.pl: Fix uninitialized var in config-bisect.pl +- kallsyms: Fix wrong "big" kernel symbol type read from procfs +- floppy: fix for PAGE_SIZE != 4KB +- block: rate-limit capacity change info log +- s390/dasd: Fix gendisk parent after copy pair swap +- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit +- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition +- vhost/vsock: improve RCU read sections around vhost_vsock_get() +- block: rnbd-clt: Fix signedness bug in init_dev() +- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks +- nvme-fc: don't hold rport lock when putting ctrl +- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware +- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map +- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready +- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. +- usb: xhci: limit run_graceperiod for only usb 3.0 devices +- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains +- usbip: Fix locking bug in RT-enabled kernels +- exfat: fix remount failure in different process environments +- reset: fix BIT macro reference +- via_wdt: fix critical boot hang due to unnamed resource allocation +- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write +- fuse: Always flush the page cache before FOPEN_DIRECT_IO write +- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp +- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive +- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled +- powerpc/addnote: Fix overflow on 32-bit builds +- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 +- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx +- firmware: imx: scu-irq: Init workqueue before request mbox channel +- ipmi: Fix __scan_channels() failing to rescan channels +- ipmi: Fix the race between __scan_channels() and deliver_response() +- ALSA: usb-mixer: us16x08: validate meter packet indices +- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path +- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path +- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() +- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml +- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig +- spi: fsl-cpm: Check length parity before switching to 16 bit mode +- can: gs_usb: gs_can_open(): fix error handling +- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table +- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation +- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen +- ksmbd: fix buffer validation by including null terminator size in EA length +- ksmbd: skip lock-range check on equal size to avoid size==0 underflow +- block: rnbd-clt: Fix leaked ID in init_dev() +- spi: cadence-quadspi: Fix clock disable on probe failure path +- x86/xen: Fix sparse warning in enlighten_pv.c +- x86/xen: Move Xen upcall handler +- drm/panel: sony-td4353-jdi: Enable prepare_prev_first +- MIPS: Fix a reference leak bug in ip22_check_gio() +- hwmon: (tmp401) fix overflow caused by default conversion rate value +- hwmon: (ibmpex) fix use-after-free in high/low store +- net: enetc: do not transmit redirected XDP frames when the link is down +- net/handshake: duplicate handshake cancellations leak socket +- net/mlx5: Serialize firmware reset with devlink +- net/mlx5: Skip HotPlug check on sync reset using hot reset +- net/mlx5: fw_tracer, Handle escaped percent properly +- net/mlx5: Drain firmware reset in shutdown callback +- net/mlx5: fw reset, clear reset requested on drain_fw_reset +- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED +- netfilter: nf_tables: pass context structure to nft_parse_register_load +- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() +- caif: fix integer underflow in cffrml_receive() +- broadcom: b44: prevent uninitialized value usage +- mlxsw: spectrum_router: Fix possible neighbour reference count leak +- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() +- netrom: Fix memory leak in nr_sendmsg() +- net: fec: ERR007885 Workaround for XDP TX path +- arm64/cpufeature: Fix unused enable_pseudo_nmi variable warning +- urma: fix psn exchange anomaly under share_tp mode +- net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown +- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE +- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV +- ksmbd: vfs: fix race on m_flags in vfs_cache +- gfs2: fix remote evict for read-only filesystems +- btrfs: scrub: always update btrfs_scrub_progress::last_physical +- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet +- hfsplus: fix volume corruption issue for generic/073 +- hfsplus: Verify inode mode when loading from disk +- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create +- hfsplus: fix volume corruption issue for generic/070 +- ntfs: set dummy blocksize to read boot_block when mounting +- kbuild: Use objtree for module signing key path +- fs/ntfs3: Support timestamps prior to epoch +- livepatch: Match old_sympos 0 and 1 in klp_find_func() +- cpuidle: menu: Use residency threshold in polling state override decisions +- cpufreq: s5pv210: fix refcount leak +- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist +- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only +- x86/ptrace: Always inline trivial accessors +- iomap: account for unaligned end offsets when truncating read range +- btrfs: fix memory leak of fs_devices in degraded seed device path +- btrfs: fix a potential path leak in print_data_reloc_error() +- btrfs: do not skip logging new dentries when logging a new name +- net/sched: teql: Fix double-free in teql_master_xmit +- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() +- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() +- ipv6: add NULL checks for idev in SRv6 paths +- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() +- sunrpc: fix cache_request leak in cache_release +- udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n +- !21770 hisi-cca-da: Fix compile warnings when CONFIG_HISI_CCA=n. +- net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() +- ALSA: dice: fix buffer overflow in detect_stream_formats() +- usb: phy: Initialize struct usb_phy list_head +- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt +- net: lan743x: Allocate rings outside ZONE_DMA +- ocfs2: fix memory leak in ocfs2_merge_rec_left() +- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() +- efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs +- efi/cper: Adjust infopfx size to accept an extra space +- efi/cper: Add a new helper function to print bitmasks +- dm log-writes: Add missing set_freezable() for freezable kthread +- dm-raid: fix possible NULL dereference with undefined raid type +- ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() +- ALSA: firewire-motu: add bounds check in put_user loop for DSP events +- rtc: gamecube: Check the return value of ioremap() +- ALSA: uapi: Fix typo in asound.h comment +- dma/pool: eliminate alloc_pages warning in atomic_pool_expand +- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events +- nvme-auth: use kvfree() for memory allocated with kvcalloc() +- ASoC: ak5558: Disable regulator when error happens +- ASoC: ak4458: Disable regulator when error happens +- ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() +- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led +- fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() +- NFS: Fix inheritance of the block sizes when automounting +- Expand the type of nfs_fattr->valid +- Revert "nfs: clear SB_RDONLY before getting superblock" +- Revert "nfs: ignore SB_RDONLY when remounting nfs" +- NFS: Initialise verifiers for visible dentries in nfs_atomic_open() +- NFS: Initialise verifiers for visible dentries in readdir and lookup +- fs/nls: Fix utf16 to utf8 conversion +- NFS: Avoid changing nlink when file removes and attribute updates race +- 9p: fix cache/debug options printing in v9fs_show_options +- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() +- pinctrl: single: Fix incorrect type for error return variable +- pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling +- perf tools: Fix split kallsyms DSO counting +- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop +- clk: keystone: fix compile testing +- md/raid5: fix IO hang when array is broken with IO inflight +- remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs +- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds +- selftests: bonding: add delay before each xvlan_over_bond connectivity check +- selftests: bonding: add ipvlan over bond testing +- !21764 ub: cdma: fix cdma code format issue +- hisi-cca-da: Fix compile warnings when CONFIG_HISI_CCA=n. +- ub: cdma: cdma code format issue bugfix +- x86/microcode/intel: Enable staging when available +- x86/microcode/intel: Support mailbox transfer +- x86/microcode/intel: Implement staging handler +- x86/microcode/intel: Define staging state struct +- x86/microcode/intel: Establish staging control logic +- x86/microcode: Introduce staging step to reduce late-loading time +- x86/cpu/topology: Make primary thread mask available with SMP=n +- platform/x86/amd: Fix memory leak in wbrf_record() +- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers +- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused +- platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL +- x86/amd_node: Fix AMD root device caching +- x86/amd_node: Add support for debugfs access to SMN registers +- x86/amd_node: Add SMN offsets to exclusive region access +- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE +- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global +- platform/x86/amd/hsmp: Use dev_groups in the driver structure +- platform/x86/amd/hsmp: Use name space while exporting module symbols +- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers +- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev +- platform/x86/amd/hsmp: Move ACPI code to acpi.c +- platform/x86/amd/hsmp: Move platform device specific code to plat.c +- platform/x86/amd/hsmp: Move structure and macros to header file +- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer +- platform/x86/amd/hsmp: Create wrapper function init_acpi() +- platform/x86/amd/hsmp: Create hsmp/ directory +- platform/x86/amd/hsmp: Check HSMP support on AMD family of processors +- platform/x86/amd/hsmp: switch to use device_add_groups() +- platform/x86/amd/hsmp: Change devm_kzalloc() to devm_kcalloc() +- platform/x86/amd/hsmp: Remove extra parenthesis and add a space +- platform/x86/amd/hsmp: Check num_sockets against MAX_AMD_SOCKETS +- platform/x86/amd/hsmp: Non-ACPI support for AMD F1A_M00~0Fh +- platform/x86/amd/hsmp: Add support for ACPI based probing +- platform/x86/amd/hsmp: Restructure sysfs group creation +- platform/x86/amd/hsmp: Move dev from platdev to hsmp_socket +- platform/x86/amd/hsmp: Define a struct to hold mailbox regs +- platform/x86/amd/hsmp: Create static func to handle platdev +- platform/x86/amd/hsmp: Cache pci_dev in struct hsmp_socket +- platform/x86/amd/hsmp: Move hsmp_test to probe +- platform/x86/amd: Add support for AMD ACPI based Wifi band RFI mitigation feature +- platform/x86/amd/hsmp: Fix iomem handling +- platform/x86/amd/hsmp: improve the error log +- platform/x86/amd/hsmp: add support for metrics tbl +- platform/x86/amd/hsmp: create plat specific struct +- x86/amd_node: Use defines for SMN register offsets +- x86/amd_node: Remove dependency on AMD_NB +- x86/amd_node: Update __amd_smn_rw() error paths +- x86/amd_nb: Move SMN access code to a new amd_node driver +- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() +- x86/amd_nb: Enhance SMN access error checking +- EDAC/amd64: Check return value of amd_smn_read() +- EDAC/amd64: Remove unused register accesses +- x86/amd_nb: Simplify function 3 search +- x86/amd_nb: Use topology info to get AMD node count +- x86/amd_nb: Simplify root device search +- x86/amd_nb: Simplify function 4 search +- x86/amd_nb: Add new PCI ID for AMD family 1Ah model 20h +- x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h-70h +- x86/amd_nb: Add AMD Family MI300 PCI IDs +- x86: Start moving AMD node functionality out of AMD_NB +- crypto: ccp - Add support for PCI device 0x17D8 +- KVM: arm64: Add SMCCC interface for pvtimer status +- KVM: arm64: Export vtimer_is_irqbypass for external use +- !21754 ub:hisi-ubus: fix issue of message +- !21565 urma: implement share tp for RM mode +- !20616 [OLK-6.6] Fix CVE-2025-68291 +- !20915 [OLK-6.6] fix CVE-2025-40003 +- urma: implement share TP for RM mode +- smb: client: fix krb5 mount with username option +- ub:hisi-ubus: Adjust the order of the message struct +- ub:ubus: Fix find error ubc_num of local ras +- ub:ubus: Fix null message workqueue issue +- !21752 urma: fix Clos networking and add a new interface get_path_set. +- !21715 OLK-6.6 mainline or LTS patches sync +- urma: fix Clos networking and add a new interface get_path_set. +- !21664 [OLK-6.6][linux-6.6.y sync][Part 1/3] Backport 6.6.119-6.6.120 LTS Patches +- !21750 fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error +- !19935 [Intel-SIG] new CPU topology series - 4/4: x86/apic: Rework APIC registration +- !21721 urma: fix bonding udata exchange for imported seg/jetty objects. +- !21743 urma: bugfix ubagg get physical dev info acquisition +- !21747 Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user +- !21741 urma: fix log error in connect +- fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error +- urma: bugfix ubagg get physical dev info acquisition +- Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user +- xSched: remove redundant lookup in alloc_ctx_from_vstream to enforce allocation semantics +- xSched/cgroup: prevent to init xse when xcu cgroup is disabled +- LoongArch: config: Revert CONFIG_RTC_DRV_EFI back to 'm' +- urma: fix bonding udata exchange for imported seg/jetty objects. +- urma: fix log error in connect +- !21729 urma: fix kmod log format error +- !21592 x86/uprobes: Fix XOL allocation failure for 32-bit tasks +- !21599 pstore/ram: fix buffer overflow in persistent_ram_save_old() +- !21733 urma: fix ubcore connect error +- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache +- urma: fix ubcore connect error +- !21718 urma: fix error for setting conn timeout +- urma: fix error for setting conn timeout +- !21737 ub: udma: change return value format. +- ub: udma: change return value format. +- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer +- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer +- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one +- spi: tegra210-quad: Move curr_xfer read inside spinlock +- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer +- tools: Fix bitfield dependency failure +- iomap: allocate s_dio_done_wq for async reads as well +- i3c: Move device name assignment after i3c_bus_init +- staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() +- drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release +- selftests: bonding: Add more missing config options +- selftests: bonding: add missing build configs +- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors +- net: stmmac: fix rx limit check in stmmac_rx_zc() +- netfilter: flowtable: check for maximum number of encapsulations in bridge vlan +- Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" +- resource: introduce is_type_match() helper and use it +- resource: replace open coded resource_intersection() +- resource: Reuse for_each_resource() macro +- ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend +- ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend +- ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend +- ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend +- ASoC: Intel: catpt: Fix error path in hw_params() +- vdpa/pds: use %pe for ERR_PTR() in event handler registration +- virtio: fix virtqueue_set_affinity() docs +- virtio: fix whitespace in virtio_config_ops +- virtio: fix typo in virtio_device_ready() comment +- virtio_vdpa: fix misleading return in void function +- ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation +- ext4: remove unused return value of __mb_check_buddy +- ublk: prevent invalid access with DEBUG +- ublk: complete command synchronously on error +- ublk: make sure io cmd handled in submitter task context +- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 +- hwmon: sy7636a: Fix regulator_enable resource leak on error path +- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() +- ASoC: fsl_xcvr: clear the channel status control memory +- RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY +- RDMA/irdma: Add support to re-register a memory region +- RDMA/irdma: Fix data race in irdma_free_pble +- RDMA/irdma: Fix data race in irdma_sc_ccq_arm +- iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal +- backlight: lp855x: Fix lp855x.h kernel-doc warnings +- backlight: led-bl: Add devlink to supplier LEDs +- wifi: ieee80211: correct FILS status codes +- iomap: always run error completions in user context +- iomap: factor out a iomap_dio_done helper +- drm/nouveau: restrict the flush page to a 32-bit address +- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition +- btrfs: fix leaf leak in an error path in btrfs_del_items() +- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() +- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc +- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() +- RDMA/bnxt_re: Fix the inline size for GenP7 devices +- RISC-V: KVM: Fix guest page fault within HLV* instructions +- crypto: ccree - Correctly handle return of sg_nents_for_len +- crypto: starfive - Correctly handle return of sg_nents_for_len +- selftests/bpf: Improve reliability of test_perf_branches_no_hw() +- selftests/bpf: skip test_perf_branches_hw() on unsupported platforms +- usb: dwc2: fix hang during suspend if set as peripheral +- usb: dwc2: fix hang during shutdown if set as peripheral +- usb: dwc2: disable platform lowlevel hw resources during shutdown +- usb: chaoskey: fix locking for O_NONBLOCK +- cpuset: Treat cpusets in attaching as populated +- net: phy: adin1100: Fix software power-down ready condition +- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path +- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path +- wifi: mac80211: fix CMAC functions not handling errors +- wifi: mac80211: remove RX_DROP_UNUSABLE +- pwm: bcm2835: Make sure the channel is enabled after pwm_request() +- perf arm_spe: Fix memset subclass in operation +- perf arm-spe: Extend branch operations +- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue +- fs/ntfs3: Prevent memory leaks in add sub record +- fs/ntfs3: out1 also needs to put mi +- powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format +- powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit +- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() +- drm/msm/a2xx: stop over-complaining about the legacy firmware +- NFSD/blocklayout: Fix minlength check in proc_layoutget +- tracefs: fix a leak in eventfs_create_events_dir() +- watchdog: starfive: Fix resource leak in probe error path +- watchdog: wdat_wdt: Fix ACPI table leak in probe function +- selftests/bpf: Fix failure paths in send_signal test +- bpf: Handle return value of ftrace_set_filter_ip in register_fentry +- ps3disk: use memcpy_{from,to}_bvec index +- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A +- arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A +- PCI: keystone: Exit ks_pcie_probe() for invalid mode +- leds: netxbig: Fix GPIO descriptor leak in error paths +- scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls +- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() +- ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() +- lib/vsprintf: Check pointer before dereferencing in time_and_date() +- clk: renesas: r9a06g032: Fix memory leak in error path +- coresight: etm4x: Add context synchronization before enabling trace +- coresight: etm4x: Extract the trace unit controlling +- coresight: etm4x: Correct polling IDLE bit +- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() +- powerpc/32: Fix unpaired stwcx. on interrupt exit +- cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs +- scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() +- ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties +- RDMA/rtrs: server: Fix error handling in get_or_create_srv +- dt-bindings: PCI: amlogic: Fix the register name of the DBI region +- staging: most: remove broken i2c driver +- staging: most: i2c: Drop explicit initialization of struct i2c_device_id::driver_data to 0 +- scsi: stex: Fix reboot_notifier leak in probe error path +- regulator: core: disable supply if enabling main regulator fails +- perf/x86/intel: Correct large PEBS flag check +- ext4: correct the checking of quota files before moving extents +- mfd: da9055: Fix missing regmap_del_irq_chip() in error path +- efi/libstub: Fix page table access in 5-level to 4-level paging transition +- x86/boot: Fix page table access in 5-level to 4-level paging transition +- ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible +- ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible +- ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels +- spi: tegra210-quad: Fix timeout handling +- fs/9p: Don't open remote file with APPEND mode when writeback cache is used +- scsi: target: Do not write NUL characters into ASCII configfs output +- power: supply: apm_power: only unset own apm_get_power_status +- power: supply: wm831x: Check wm831x_set_bits() return value +- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() +- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() +- power: supply: cw2015: Check devm_delayed_work_autocancel() return code +- perf record: skip synthesize event when open evsel failed +- perf lock contention: Load kernel map before lookup +- perf maps: Add maps__load_first() +- interconnect: debugfs: Fix incorrect error handling for NULL path +- arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller +- interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS +- i3c: master: svc: Prevent incomplete IBI transaction +- i3c: fix refcount inconsistency in i3c_master_register +- i3c: master: Inherit DMA masks and parameters from parent device +- pinctrl: stm32: fix hwspinlock resource leak in probe function +- soc: qcom: smem: fix hwspinlock resource leak in probe error paths +- tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set +- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove +- mtd: nand: relax ECC parameter validation check +- Revert "mtd: rawnand: marvell: fix layouts" +- ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties +- ARM: dts: renesas: gose: Remove superfluous port property +- sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). +- phy: mscc: Fix PTP for VSC8574 and VSC8572 +- arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider +- firmware: imx: scu-irq: fix OF node leak in +- arm64: dts: ti: k3-am62p: Fix memory ranges for GPU +- s390/ap: Don't leak debug feature files if AP instructions are not available +- s390/smp: Fix fallback CPU detection +- wifi: ath11k: fix peer HE MCS assignment +- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 +- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other +- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe +- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 +- arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 +- arm64: dts: imx8mp-venice-gw702x: remove off-board uart +- arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl +- arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props +- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member +- inet: Avoid ehash lookup race in inet_ehash_insert() +- rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() +- ntfs3: Fix uninit buffer allocated by __getname() +- ntfs3: fix uninit memory after failed mi_read in mi_format_new +- crypto: authenc - Correctly pass EINPROGRESS back up to the caller +- irqchip/qcom-irq-combiner: Fix section mismatch +- irqchip/imx-mu-msi: Fix section mismatch +- irqchip/irq-brcmstb-l2: Fix section mismatch +- irqchip/irq-bcm7120-l2: Fix section mismatch +- irqchip/irq-bcm7038-l1: Fix section mismatch +- objtool: Fix weak symbol detection +- objtool: Fix standalone --hacks=jump_label +- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() +- clk: renesas: cpg-mssr: Read back reset registers to assure values latched +- clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register +- clk: renesas: Use str_on_off() helper +- clk: renesas: rzg2l: Use %x format specifier to print CLK_ON_R() +- clk: renesas: rzg2l: Remove critical area +- clk: renesas: rzg2l: Simplify the logic in rzg2l_mod_clock_endisable() +- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback +- USB: Fix descriptor count when handling invalid MBIM extended descriptor +- drm/vgem-fence: Fix potential deadlock on release +- drm/panel: visionox-rm69299: Don't clear all mode flags +- gpu: host1x: Fix race in syncpt alloc/free +- smack: fix bug: unprivileged task can create labels +- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing +- staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing +- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser +- comedi: check device's attached status in compat ioctls +- comedi: multiq3: sanitize config options in multiq3_attach() +- comedi: c6xdigio: Fix invalid PNP driver unregistration +- wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 +- samples: work around glibc redefining some of our defines wrong +- HID: elecom: Add support for ELECOM M-XT3URBK (018F) +- platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally +- platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list +- platform/x86: huawei-wmi: add keys for HONOR models +- HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list +- platform/x86: acer-wmi: Ignore backlight event +- pinctrl: qcom: msm: Fix deadlock in pinmux configuration +- HID: hid-input: Extend Elan ignore battery quirk to USB +- bfs: Reconstruct file type when loading from disk +- ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series +- smb: fix invalid username check in smb3_fs_context_parse_param() +- Bluetooth: btrtl: Avoid loading the config file on security chips +- drm/vmwgfx: Use kref in vmw_bo_dirty +- spi: imx: keep dma request disabled before dma transfer setup +- spi: xilinx: increase number of retries before declaring stall +- ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() +- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC +- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC +- serial: add support of CPCI cards +- USB: serial: ftdi_sio: match on interface number for jtag +- USB: serial: option: move Telit 0x10c7 composition in the right place +- USB: serial: option: add Telit Cinterion FE910C04 new compositions +- USB: serial: option: add Foxconn T99W760 +- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() +- locking/spinlock/debug: Fix data-race in do_raw_write_lock +- ksmbd: ipc: fix use-after-free in ipc_msg_send_request +- Documentation: process: Also mention Sasha Levin as stable tree maintainer +- leds: spi-byte: Use devm_led_classdev_register_ext() +- NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd +- !21366 [Hygon][6.6][Feature]spi: dw: Add device HID for Hygon SPI controller +- !21365 [Hygon][6.6][Feature] mmc: sdhci-acpi: Add device HID for Hygon eMMC controller +- !21364 [Hygon][6.6][Feature] mmc: sdhci-pci: Add support for Hygon SD controller +- !21363 [Hygon][6.6][Feature] perf/x86/uncore: Add DF PMU support for Hygon family 18h model 18h +- !21362 [Hygon][6.6][Feature] iommu/hygon: Add support for Hygon family 18h model 18h IOAPIC +- !21361 [Hygon][6.6][Feature] hwmon/k10temp: Add support for Hygon family 18h model 18h +- !21360 [Hygon][6.6][Feature] x86/amd_nb: Add Hygon family 18h model 18h PCI IDs +- !21359 [Hygon][6.6][Feature] ALSA: hda: Add support for Hygon family 18h model 18h HD-Audio +- !21694 drivers/ub/sentry: Refactor the message data format sent via UVB/URMA +- drivers/ub/sentry: add some log for sent_cnt and remote_recv_cnt +- drivers/ub/sentry: Refactor the message data format sent via UVB/URMA +- urma: fix kmod log format error +- x86/fpu: Rename fpu_reset_fpregs() to fpu_reset_fpstate_regs() +- x86/fpu: Remove export of mxcsr_feature_mask +- x86/pkeys: Simplify PKRU update in signal frame +- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE +- x86/fpu: Log XSAVE disablement consistently +- selftests/x86/apx: Add APX test +- x86/fpu/apx: Enable APX state support +- x86/fpu/apx: Disallow conflicting MPX presence +- x86/fpu/apx: Define APX state component +- tools headers x86 cpufeatures: Sync with the kernel sources +- x86/cpufeatures: Add X86_FEATURE_APX +- x86/fpu/xstate: Adjust xstate copying logic for user ABI +- x86/fpu/xstate: Adjust XSAVE buffer size calculation +- x86/fpu/xstate: Introduce xfeature order table and accessor macro +- x86/fpu/xstate: Remove xstate offset check +- x86/fpu/xstate: Simplify print_xstate_features() +- selftests/x86/avx: Add AVX tests +- selftests/x86/xstate: Clarify supported xstates +- selftests/x86/xstate: Consolidate test invocations into a single entry +- selftests/x86/xstate: Introduce signal ABI test +- selftests/x86/xstate: Refactor ptrace ABI test +- selftests/x86/xstate: Refactor context switching test +- selftests/x86/xstate: Enumerate and name xstate components +- selftests/x86/xstate: Refactor XSAVE helpers for general use +- selftests/x86: Consolidate redundant signal helper functions +- x86/pkeys: Ensure updated PKRU value is XRSTOR'd +- x86/pkeys: Change caller of update_pkru_in_sigframe() +- x86/pkeys: Update PKRU to enable all pkeys before XSAVE +- x86/pkeys: Add helper functions to update PKRU on the sigframe +- selftests/x86: fix Makefile dependencies to work with clang +- selftests/x86: remove (or use) unused variables and functions +- sched/debug: Fix avg_vruntime() usage +- sched/fair: Fix zero_vruntime tracking fix +- sched/fair: Fix vruntime drift by preventing double lag scaling during reweight +- sched/eevdf: Update se->vprot in reweight_entity() +- sched/fair: Only set slice protection at pick time +- sched: Fix struct sched_entity kabi broken +- sched/fair: Fix NO_RUN_TO_PARITY case +- sched/fair: Use protect_slice() instead of direct comparison +- sched: Cancel the slice protection of the idle entity +- sched/eevdf: Fix wakeup-preempt by checking cfs_rq->nr_running +- sched/eevdf: Disable shorter slices to wakeup-preempt +- sched/eevdf: Allow shorter slices to wakeup-preempt +- sched: Unify more update_curr*() +- sched: Remove vruntime from trace_sched_stat_runtime() +- sched: fix kabi broken in struct sched_statistics +- sched: Unify runtime accounting across classes +- sched/fair: Adhere to place_entity() constraints +- sched/fair: Fix EEVDF entity placement bug causing scheduling lag +- sched/fair: Fix zero_vruntime tracking +- sched: Fix kabi breakage of struct cfs_rq for sum_w_vruntime +- sched/fair: Rename cfs_rq::avg_vruntime to ::sum_w_vruntime, and helper functions +- sched: Fix kabi breakage of struct cfs_rq for sum_weight +- sched/fair: Rename cfs_rq::avg_load to cfs_rq::sum_weight +- sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups +- drivers/loongson-pwm: sync master patch to fix pwm driver +- LoongArch:stmmac:fix mdc too high issues. +- LoongArch: gpio: read/write mode to 8bit in BIT_CTRL_MODE +- drivers/pwm: export symbol for pwm_add_table +- LoongArch: KVM: Add hypercall service support for usermode VMM +- urma: check driver and wq duration for conn_err +- spi: fix statistics allocation +- KVM: arm64: vgic: Remove redundant vtimer irq bypass workaround +- tools headers x86 cpufeatures: Sync with the kernel sources +- Documentation: KVM: KVM_GET_SUPPORTED_CPUID now exposes TSC_DEADLINE +- KVM: x86: Advertise support for AMD's PREFETCHI +- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps +- KVM: x86: Explicitly track feature flags that are enabled at runtime +- KVM: x86: Explicitly track feature flags that require vendor enabling +- KVM: x86: Rename "SF" macro to "SCATTERED_F" +- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed +- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data +- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID +- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID +- KVM: x86: Add a macro to init CPUID features that KVM emulates in software +- KVM: x86: Add a macro to init CPUID features that ignore host kernel support +- KVM: x86: Harden CPU capabilities processing against out-of-scope features +- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions +- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper +- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features +- KVM: x86: Add a macro to init CPUID features that are 64-bit only +- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code +- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID +- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() +- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID +- KVM: x86: Advertise AMD_IBPB_RET to userspace +- KVM: SVM: Invert handling of SEV and SEV_ES feature flags +- x86: KVM: Add feature flag for CPUID.80000021H:EAX[bit 1] +- KVM: x86: Add SBPB support +- KVM: x86: Add IBPB_BRTYPE support +- perf/x86/uncore: Add DF PMU support for Hygon family 18h model 18h +- hwmon/k10temp: Add support for Hygon family 18h model 18h +- mmc: sdhci-pci: Add support for Hygon SD controller +- x86/amd_nb: Add Hygon family 18h model 18h PCI IDs +- mfs: fix race condition issue in try_hook_fd() +- pstore/ram: fix buffer overflow in persistent_ram_save_old() +- x86/uprobes: Fix XOL allocation failure for 32-bit tasks +- mmc: sdhci-acpi: Add device HID for Hygon eMMC controller +- spi: dw: Add device HID for Hygon SPI controller +- iommu/hygon: Add support for Hygon family 18h model 18h IOAPIC +- ALSA: hda: Add support for Hygon family 18h model 18h HD-Audio +- Solve kernel ABI issue introduced by x86_max_cores updates +- x86/acpi/boot: Correct acpi_is_processor_usable() check again +- x86/xen: mark boot CPU of PV guest in MSR_IA32_APICBASE +- x86/topology: Handle the !APIC case gracefully +- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI +- x86/cpu/topology: Remove limit of CPUs due to disabled IO/APIC +- x86/topology: Handle bogus ACPI tables correctly +- x86/xen/smp_pv: Register the boot CPU APIC properly +- x86/topology: Don't update cpu_possible_map in topo_set_cpuids() +- x86/topology: Don't evaluate logical IDs during early boot +- x86/topology: Ignore non-present APIC IDs in a present package +- x86/cpu/topology: Get rid of cpuinfo::x86_max_cores +- x86/cpu/topology: Provide __num_[cores|threads]_per_package +- x86/cpu/topology: Rename topology_max_die_per_package() +- x86/cpu/topology: Rename smp_num_siblings +- x86/cpu/topology: Retrieve cores per package from topology bitmaps +- x86/cpu/topology: Use topology logical mapping mechanism +- x86/cpu/topology: Provide logical pkg/die mapping +- x86/cpu/topology: Simplify cpu_mark_primary_thread() +- x86/cpu/topology: Mop up primary thread mask handling +- x86/cpu/topology: Use topology bitmaps for sizing +- x86/cpu/topology: Let XEN/PV use topology from CPUID/MADT +- x86/xen/smp_pv: Count number of vCPUs early +- x86/cpu/topology: Assign hotpluggable CPUIDs during init +- x86/cpu/topology: Reject unknown APIC IDs on ACPI hotplug +- x86/topology: Add a mechanism to track topology via APIC IDs +- x86/cpu: Detect real BSP on crash kernels +- x86/cpu/topology: Rework possible CPU management +- x86/cpu/topology: Sanitize the APIC admission logic +- x86/smpboot: Make error message actually useful +- x86/cpu/topology: Use a data structure for topology info +- x86/cpu/topology: Simplify APIC registration +- x86/cpu/topology: Confine topology information +- x86/xen/smp_pv: Register fake APICs +- x86/acpi: Dont invoke topology_register_apic() for XEN PV +- x86/mpparse: Use new APIC registration function +- x86/of: Use new APIC registration functions +- x86/jailhouse: Use new APIC registration function +- x86/acpi: Use new APIC registration functions +- x86/cpu/topology: Provide separate APIC registration functions +- x86/cpu/topology: Move registration out of APIC code +- x86/of: Set the parse_smp_cfg for all the DeviceTree platforms by default +- x86/hyperv/vtl: Correct x86_init.mpparse.parse_smp_cfg assignment +- x86/of: Move the x86_flattree_get_config() call out of x86_dtb_init() +- x86/apic: Use a proper define for invalid ACPI CPU ID +- x86/apic: Remove yet another dubious callback +- x86/apic: Remove the pointless writeback of boot_cpu_physical_apicid +- x86/mpparse: Remove the physid_t bitmap wrapper +- x86/mm/numa: Move early mptable evaluation into common code +- x86/mpparse: Switch to new init callbacks +- x86/hyperv/vtl: Prepare for separate mpparse callbacks +- x86/xen/smp_pv: Prepare for separate mpparse callbacks +- x86/jailhouse: Prepare for separate mpparse callbacks +- x86/platform/intel-mid: Prepare for separate mpparse callbacks +- x86/platform/ce4100: Prepare for separate mpparse callbacks +- x86/dtb: Rename x86_dtb_init() +- x86/mpparse: Prepare for callback separation +- x86/mpparse: Provide separate early/late callbacks +- x86/mpparse: Rename default_find_smp_config() +- x86/apic: Remove check_apicid_used() and ioapic_phys_id_map() +- x86/ioapic: Simplify setup_ioapic_ids_from_mpc_nocheck() +- x86/ioapic: Make io_apic_get_unique_id() simpler +- x86/apic: Get rid of get_physical_broadcast() +- x86/ioapic: Replace some more set bit nonsense +- x86/platform/ce4100: Dont override x86_init.mpparse.setup_ioapic_ids +- x86/xen: return a sane initial apic id when running as PV guest +- x86/cpu/topology: Make the APIC mismatch warnings complete +- Solve kernel ABI issues introduced by x86_coreid_bits updates +- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON +- x86/apic/uv: Remove the private leaf 0xb parser +- x86/xen/smp_pv: Remove cpudata fiddling +- x86/apic: Remove unused phys_pkg_id() callback +- x86/cpu: Remove x86_coreid_bits +- x86/cpu: Remove topology.c +- x86/cpu: Make topology_amd_node_id() use the actual node info +- x86/mm/numa: Use core domain size on AMD +- x86/cpu: Use common topology code for HYGON +- x86/cpu: Use common topology code for AMD +- x86/smpboot: Teach it about topo.amd_node_id +- x86/topology/amd: Evaluate SMT in CPUID leaf 0x8000001e only on family 0x17 and greater +- x86/topology/amd: Ensure that LLC ID is initialized +- x86/cpu/amd: Move TOPOEXT enablement into the topology parser +- x86/cpu/amd: Make the NODEID_MSR union actually work +- x86/cpu/amd: Make the CPUID 0x80000008 parser correct +- x86/cpu: Provide an AMD/HYGON specific topology parser +- x86/cpu/amd: Provide a separate accessor for Node ID +- x86/topology/intel: Unlock CPUID before evaluating anything +- x86/cpu: Use common topology code for Intel +- x86/cpu: Provide a sane leaf 0xb/0x1f parser +- x86/cpu: Move __max_die_per_package to common.c +- x86/cpu: Use common topology code for Centaur and Zhaoxin +- x86/cpu: Add legacy topology parser +- x86/cpu: Provide cpu_init/parse_topology() +- x86/cpuid: Include <linux/build_bug.h> in <asm/cpuid.h> +- x86/cpu: Provide cpuid_read() et al. +- Revert "RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor" +- Solve kernel ABI issues introduced by cpuinfo_x86 updates +- KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes +- perf/amd/ibs: Prevent leaking sensitive data to userspace +- perf/x86: Check data address for IBS software filter +- perf/x86: Relax privilege filter restriction on AMD IBS +- perf/core: Export perf_exclude_event() +- KVM: x86: Disallow hugepages when memory attributes are mixed +- KVM: Drop superfluous __KVM_VCPU_MULTIPLE_ADDRESS_SPACE macro +- fs: Rename anon_inode_getfile_secure() and anon_inode_getfd_secure() +- x86/bugs: Add RSB mitigation document +- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() +- x86/bugs: Rename entry_ibpb() to write_ibpb() +- perf amd ibs: Sync arch/x86/include/asm/amd-ibs.h header with the kernel +- perf/amd/ibs: Update DTLB/PageSize decode logic +- perf/amd/ibs: Add support for OP Load Latency Filtering +- perf/amd/ibs: Ceil sample_period to min_period +- perf/amd/ibs: Add ->check_period() callback +- perf/amd/ibs: Add PMU specific minimum period +- perf/amd/ibs: Don't allow freq mode event creation through ->config interface +- perf/amd/ibs: Remove pointless sample period check +- perf/amd/ibs: Remove IBS_{FETCH|OP}_CONFIG_MASK macros +- amd-pstate: Switch to amd-pstate by default on some Server platforms +- cpufreq: amd-pstate: enable shared memory type CPPC by default +- cpufreq: amd-pstate: switch boot_cpu_has() to cpu_feature_enabled() +- cpufreq: amd-pstate: Add quirk for the pstate CPPC capabilities missing +- cpufreq: amd-pstate: Unify computation of {max,min,nominal,lowest_nonlinear}_freq +- x86/cpu: Provide debug interface +- x86/cpu/topology: Cure the abuse of cpuinfo for persisting logical ids +- x86/apic, x86/hyperv: Use u32 in hv_snp_boot_ap() too +- x86/apic: Use u32 for wakeup_secondary_cpu[_64]() +- x86/apic: Use u32 for [gs]et_apic_id() +- x86/apic: Use u32 for phys_pkg_id() +- x86/apic: Use u32 for cpu_present_to_apicid() +- x86/apic: Use u32 for check_apicid_used() +- x86/apic: Use u32 for APIC IDs in global data +- x86/apic: Use BAD_APICID consistently +- x86/cpu: Move cpu_l[l2]c_id into topology info +- x86/cpu: Move logical package and die IDs into topology info +- x86/cpu: Move cu_id into topology info +- x86/cpu: Move cpu_core_id into topology info +- hwmon: (fam15h_power) Use topology_core_id() +- scsi: lpfc: Use topology_core_id() +- x86/cpu: Move cpu_die_id into topology info +- x86/cpu: Move phys_proc_id into topology info +- x86/cpu: Encapsulate topology information in cpuinfo_x86 +- userfaultfd: fix kabi breakage due to struct userfaultfd_ctx +- mm/mremap: fix WARN with uffd that has remap events disabled +- mm: clear uffd-wp PTE/PMD state on mremap() +- userfaultfd: move userfaultfd_ctx struct to header file +- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work +- mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). +- RNPGBE: NET: Update driver to 1.0.0 +- RNP: NET: Update driver to 1.0.0 + +* Tue Apr 14 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-147.0.0.134 +- !21713 Fix CVE-2026-23440 +- !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario +- !21682 Fix CVE-2026-31399 +- !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() +- !21720 urma: fix bind jetty compat error +- !21693 Introduce dmem cgroup +- net/mlx5e: Fix race condition during IPSec ESN update +- !21712 Fix CVE-2026-23441 +- urma: fix bind jetty compat error +- !21630 urma: change urma kmod errno +- sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() +- net/mlx5e: Prevent concurrent access to IPSec ASO context +- urma: change urma kmod errno +- !21690 urma:delete redundant sub_trans_mode_cap in urma +- !21648 RDMA/hns: Fix config the CNP DSCP +- !21632 media: dvb-net: fix OOB access in ULE extension header tables +- !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN +- urma:delete redundant sub_trans_mode_cap in urma +- !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove +- !21695 urma: Create jetty with kernel thread +- netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove +- !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure +- urma: Create jetty with kernel thread +- !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove +- !21685 urma: Create jetty with kernel thread +- !21502 urma: bonding support health check +- dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig +- cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI +- cgroup/dmem: avoid pool UAF +- cgroup/dmem: avoid rcu warning when unregister region +- cgroup/dmem: fix NULL pointer dereference when setting max +- cgroup/dmem: Don't open-code css_for_each_descendant_pre +- cgroup/rdma: Drop bogus PAGE_COUNTER select +- doc/cgroup: Fix title underline length +- cgroup/dmem: Fix parameters documentation +- kernel/cgroup: Remove the unused variable climit +- cgroup/dmem: Select PAGE_COUNTER +- kernel/cgroup: Add "dmem" memory accounting cgroup +- mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG +- mm/page_counter: move calculating protection values to page_counter +- serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN +- urma: Create jetty with kernel thread +- urma: bonding support health check +- !21520 urma: add software reliability for create and destroy connection +- netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove +- urma: add software reliability for create and destroy connection +- !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI +- wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure +- ub/ubdevshm: Fix register segment failed issue in multi-thread scenario +- nvdimm/bus: Fix potential use after free in asynchronous initialization +- !21671 Fix CVE-2026-23269 +- !21526 tcp: secure_seq: add back ports to TS offset +- !21602 Fix CVE-2026-31408 +- !21593 Fix CVE-2026-31393 +- !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression +- !21606 ice: Fix memory leak in ice_set_ringparam() +- !21645 bpf: Fix regsafe() for pointers to packet +- !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables +- !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel +- !21662 [OLK-6.6]:update patches for sw64 architecture +- !21670 urma: change well-known jetty to UM +- !21669 urma: adjust netlink log level of ipourma +- apparmor: validate DFA start states are in bounds in unpack_pdb +- urma: change well-known jetty to UM +- urma: adjust netlink log level of ipourma +- !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() +- !21636 v2 net/sched: Fix CVE-2026-23378 +- xSched: update xSched manual for xcu cmdline enable option +- xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig +- cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 +- xSched/cgroup: make xcu.stat invisible at root cgroup +- xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI +- !21641 Fix CVE-2026-23407 +- !21651 spi: fix use-after-free on controller registration failure +- !21652 PM: runtime: Fix a race condition related to device removal +- !21639 Fix CVE-2026-23406 +- !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 +- drivers/ub/sentry: add lock for update global variables and change some global variables to local variables +- f2fs: fix to detect potential corrupted nid in free_nid_list +- ntfs3: Fix uninit buffer allocated by __getname() +- nvme-pci: Fix race bug in nvme_poll_irqdisable() +- tls: Purge async_hold in tls_decrypt_async_wait() +- clsact: Fix use-after-free in init/destroy rollback asymmetry +- nf_tables: nft_dynset: fix possible stateful expression memleak in error path +- xdp: produce a warning when calculated tailroom is negative +- xdp: use modulo operation to calculate XDP frag tailroom +- apparmor: fix race between freeing data and fs accessing it +- Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" +- riscv: Replace function-like macro by static inline function +- sched/fair: scale wake_wide() threshold by SMT width +- sched/core: fix SCHED_FEAT overflow on 32-bit architectures +- drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() +- urma: fix race condition in async event causing kfree of invalid pointer +- urma: check for null topo map in ubcore_get_topo_info_by_agg_eid +- apparmor: replace recursive profile removal with iterative approach +- apparmor: fix: limit the number of levels of policy namespaces +- nfnetlink_osf: validate individual option lengths in fingerprints +- tls: Fix race condition in tls_sw_cancel_work_tx() +- urma: Kernel-mode file for bugfix of vtpn of empty pointer +- xen/privcmd: add boot control for restricted usage in domU +- xen/privcmd: unregister xenstore notifier on module exit +- xen/privcmd: restrict usage in unprivileged domU +- af_unix: Give up GC if MSG_PEEK intervened. +- urma: Kernel-mode file for bugfix to move hashtable from alloc to active +- apparmor: fix differential encoding verification +- ub:hisi-ubus: Synchronize the missing code +- apparmor: Fix double free of ns_name in aa_replace_profiles() +- mptcp: pm: in-kernel: always mark signal+subflow endp as used +- bridge: cfm: Fix race condition in peer_mep deletion +- ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() +- apparmor: fix race on rawdata dereference +- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase +- net/sched: act_gate: snapshot parameters with RCU on replace +- bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded +- netfilter: nf_tables: always walk all pending catchall elements +- netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels +- net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs +- netfilter: nf_tables: unconditionally bump set->nelems before insertion +- netfilter: nf_tables: release flowtable after rcu grace period on error +- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks +- netfilter: xt_CT: drop pending enqueued packets on template removal +- net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit +- apparmor: fix memory leak in verify_header +- wifi: libertas: fix use-after-free in lbs_free_adapter() +- can: usb: etas_es58x: correctly anchor the urb in the read bulk callback +- urma: Kernel-mode file for bugfix deactivate to apply pid in udma +- urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback +- net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop +- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled +- can: bcm: fix locking for bcm_op runtime updates +- net: phy: register phy led_triggers during probe to avoid AB-BA deadlock +- net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled +- net: prevent NULL deref in ip[6]tunnel_xmit() +- net: add xmit recursion limit to tunnel xmit functions +- net: gro: fix outer network offset +- net: annotate data-races around sk->sk_{data_ready,write_space} +- net: add proper RCU protection to /proc/net/ptype +- urma: fix potential deadlock risk in urma_ping +- Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ +- sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting +- net: usb: kalmia: validate USB endpoints +- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE +- cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() +- urma: use user-specified dev_name when creating agg dev +- mm: thp: deny THP for files on anonymous inodes +- mm/huge_memory: fix folio isn't locked in softleaf_to_folio() +- smb: client: Don't log plaintext credentials in cifs_set_cifscreds +- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() +- xhci: dbgtty: fix device unregister: fixup +- tty: introduce and use tty_port_tty_vhangup() helper +- net: dsa: microchip: Fix error path in PTP IRQ setup +- can: ucan: Fix infinite loop from zero-length messages +- net: dsa: microchip: Free previously initialized ports on init failures +- net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() +- selftests: mptcp: join: properly kill background tasks +- staging: rtl8712: Remove driver using deprecated API wext +- net: macb: fix unregister_netdev call order in macb_remove() +- iio: adc: rtq6056: Correct the sign bit index +- nfsd: Replace clamp_t in nfsd4_get_drc_mem() +- net: dsa: microchip: ptp: Fix checks on irq_find_mapping() +- net: dsa: microchip: common: Fix checks on irq_find_mapping() +- drm/amd/display: Check NULL before accessing +- drm: sti: fix device leaks at component probe +- USB: serial: option: add support for Rolling RW101R-GL +- USB: serial: ftdi_sio: add support for u-blox EVK-M101 +- xhci: dbgtty: fix device unregister +- xhci: dbgtty: Fix data corruption when transmitting data form DbC to host +- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths +- usb: dwc3: pci: Sort out the Intel device IDs +- usb: dwc3: pci: add support for the Intel Nova Lake -S +- usb: renesas_usbhs: Fix synchronous external abort on unbind +- usb: gadget: f_eem: Fix memory leak in eem_unwrap +- usb: cdns3: Fix double resource release in cdns3_pci_probe +- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking +- mptcp: clear scheduled subflows on retransmit +- firmware: stratix10-svc: fix bug in saving controller data +- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves +- thunderbolt: Add support for Intel Wildcat Lake +- drivers/usb/dwc3: fix PCI parent check +- dm-verity: fix unreliable memory allocation +- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling +- can: sja1000: fix max irq loop handling +- atm/fore200e: Fix possible data race in fore200e_open() +- ARM: dts: nxp: imx6ul: correct SAI3 interrupt line +- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 +- iio: adc: ad7280a: fix ad7280_store_balance_timer() +- iio: accel: fix ADXL355 startup race condition +- iio: accel: bmc150: Fix irq assumption regression +- iio:common:ssp_sensors: Fix an error handling path ssp_probe() +- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields +- Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" +- spi: bcm63xx: fix premature CS deassertion on RX-only transactions +- spi: nxp-fspi: Propagate fwnode in ACPI case as well +- spi: nxp-fspi: Support per spi-mem operation frequency switches +- spi: spi-mem: Add a new controller capability +- spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency +- spi: spi-mem: Allow specifying the byte order in Octal DTR mode +- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors +- spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA +- mailbox: pcc: don't zero error register +- mailbox: mailbox-test: Fix debugfs_create_dir error checking +- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors +- iio: st_lsm6dsx: Fixed calibrated timestamp calculation +- net: fec: do not register PPS event for PEROUT +- net: fec: do not allow enabling PPS and PEROUT simultaneously +- net: fec: do not update PEROUT if it is enabled +- net: fec: cancel perout_timer when PEROUT is disabled +- net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic +- net: dsa: sja1105: simplify static configuration reload +- net: sxgbe: fix potential NULL dereference in sxgbe_rx() +- net: lan966x: Fix the initialization of taprio +- net: aquantia: Add missing descriptor cache invalidation on ATL2 +- platform/x86: intel: punit_ipc: fix memory corruption +- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY +- Bluetooth: SMP: Fix not generating mackey and ltk when repairing +- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data +- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header +- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs +- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers +- !20531 [OLK-6.6] Fix CVE-2025-68315 +- !20546 [OLK-6.6] Fix CVE-2025-68727 +- !21588 smb/server: fix return values of smb2_0_server_cmds proc +- !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y +- !21551 Fix CVE-2026-23414 +- !21549 Fix CVE-2026-23413 +- !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path +- !21610 xdp: Fix CVE-2026-23343 +- !21625 Fix CVE-2026-23411 +- sw64: fix compile error with missing arch-specific header file +- sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default +- !21627 Fix riscv check-build warning +- !21412 urma: change well-known jetty to UM +- !21623 sched/fair: scale wake_wide() threshold by SMT width +- PM: runtime: Fix a race condition related to device removal +- spi: fix use-after-free on controller registration failure +- !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() +- !21629 urma: fix race condition in async event causing kfree of invalid pointer +- !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid +- !21618 apparmor: replace recursive profile removal with iterative approach +- !21617 apparmor: fix: limit the number of levels of policy namespaces +- !21484 Fix CVE-2026-23397 +- !21499 Fix CVE-2026-23240 +- RDMA/hns: Fix config the CNP DSCP +- RDMA/hns: Fix the panic caused by a large number of print +- sched/fair: scale wake_wide() threshold by SMT width +- sched/core: fix SCHED_FEAT overflow on 32-bit architectures +- icmp: fix NULL pointer dereference in icmp_tag_validation() +- bpf: Fix regsafe() for pointers to packet +- !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer +- !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue +- apparmor: fix missing bounds check on DEFAULT table in verify_dfa() +- apparmor: fix side-effect bug in match_char() macro usage +- urma: fix race condition in async event causing kfree of invalid pointer +- urma: Kernel-mode file for bugfix of vtpn of empty pointer +- net/sched: act_ife: Fix metalist update behavior +- net/sched: act_ife: avoid possible NULL deref +- !21522 af_unix: Give up GC if MSG_PEEK intervened. +- !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active +- media: dvb-net: fix OOB access in ULE extension header tables +- !21582 Fix CVE-2026-23409 +- urma: change well-known jetty to UM +- !21600 ub:hisi-ubus: Synchronize the missing code +- !21528 Fix CVE-2026-23408 +- Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" +- riscv: Replace function-like macro by static inline function +- drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() +- apparmor: fix race between freeing data and fs accessing it +- ub:hisi-ubus: Synchronize the missing code +- !21477 Fix CVE-2026-23321 +- !21533 Fix CVE-2026-23393 +- !21470 Fix CVE-2026-23304 +- !21338 drivers/ub/sentry: add oom rate limit +- !21517 Fix CVE-2026-23410 +- !21550 Fix CVE-2026-23351 +- !21560 Fix CVE-2026-23245 +- xen/privcmd: add boot control for restricted usage in domU +- xen/privcmd: unregister xenstore notifier on module exit +- xen/privcmd: restrict usage in unprivileged domU +- apparmor: replace recursive profile removal with iterative approach +- apparmor: fix: limit the number of levels of policy namespaces +- nf_tables: nft_dynset: fix possible stateful expression memleak in error path +- xdp: produce a warning when calculated tailroom is negative +- xdp: use modulo operation to calculate XDP frag tailroom +- ice: Fix memory leak in ice_set_ringparam() +- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold +- !21547 Fix CVE-2026-23310 +- !21558 Fix CVE-2026-23278 +- !21538 Fix CVE-2026-23274 +- !21548 Fix CVE-2026-23340 +- !21561 Fix CVE-2026-23272 +- !21543 Fix CVE-2026-23392 +- !21541 Fix CVE-2026-23270 +- !21542 Fix CVE-2026-23391 +- !21536 Fix CVE-2026-23277 +- Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access +- !21531 ACPI/IORT: Add PMCG platform information for 162001900 +- smb/server: update some misguided comment of smb2_0_server_cmds proc +- smb/server: fix return value of smb2_oplock_break() +- smb/server: fix return value of smb2_ioctl() +- smb/server: fix return value of smb2_query_dir() +- smb/server: fix return value of smb2_notify() +- smb/server: fix return value of smb2_read() +- !21500 regmap: maple: free entry on mas_store_gfp() failure +- drivers/ub/sentry: add oom rate limit +- apparmor: fix differential encoding verification +- !21511 Fix CVE-2026-23403 +- !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() +- !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback +- urma: check for null topo map in ubcore_get_topo_info_by_agg_eid +- !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma +- !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback +- urma: Kernel-mode file for bugfix deactivate to apply pid in udma +- netfilter: nf_tables: unconditionally bump set->nelems before insertion +- !21476 Fix CVE-2026-23300 +- !21475 Fix CVE-2026-23381 +- !21472 Fix CVE-2026-23362 +- !21474 Fix CVE-2026-23368 +- !21471 Fix CVE-2026-23293 +- !21527 CVE-2026-23276 +- !21525 net: gro: fix outer network offset +- !21524 net: annotate data-races around sk->sk_{data_ready,write_space} +- !21523 net: add proper RCU protection to /proc/net/ptype +- net/sched: act_gate: snapshot parameters with RCU on replace +- wifi: libertas: fix use-after-free in lbs_free_adapter() +- netfilter: nf_tables: always walk all pending catchall elements +- !21552 nvme-fc: release admin tagset if init fails +- ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change +- net: tunnel: make skb_vlan_inet_prepare() return drop reasons +- urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback +- !21544 urma: fix potential deadlock risk in urma_ping +- can: usb: etas_es58x: correctly anchor the urb in the read bulk callback +- !21486 Fix CVE-2026-23395 +- !21480 Fix CVE-2026-23371 +- !21507 net: usb: kalmia: validate USB endpoints +- nvme-fc: release admin tagset if init fails +- tls: Purge async_hold in tls_decrypt_async_wait() +- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase +- clsact: Fix use-after-free in init/destroy rollback asymmetry +- net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs +- bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded +- urma: Kernel-mode file for bugfix to move hashtable from alloc to active +- urma: fix potential deadlock risk in urma_ping +- !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE +- netfilter: nf_tables: release flowtable after rcu grace period on error +- netfilter: xt_CT: drop pending enqueued packets on template removal +- netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels +- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks +- net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit +- bridge: cfm: Fix race condition in peer_mep deletion +- !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() +- ACPI/IORT: Add PMCG platform information for 162001900 +- arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata +- !21530 urma: use user-specified dev_name when creating agg dev +- urma: use user-specified dev_name when creating agg dev +- apparmor: Fix double free of ns_name in aa_replace_profiles() +- net: prevent NULL deref in ip[6]tunnel_xmit() +- net: add xmit recursion limit to tunnel xmit functions +- tcp: secure_seq: add back ports to TS offset +- net: gro: fix outer network offset +- net: annotate data-races around sk->sk_{data_ready,write_space} +- net: add proper RCU protection to /proc/net/ptype +- af_unix: Give up GC if MSG_PEEK intervened. +- apparmor: fix race on rawdata dereference +- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE +- apparmor: fix memory leak in verify_header +- net: usb: kalmia: validate USB endpoints +- !21492 mm: thp: deny THP for files on anonymous inodes +- !21491 net: usb: pegasus: validate USB endpoints +- nvme-pci: Fix race bug in nvme_poll_irqdisable() +- !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() +- regmap: maple: free entry on mas_store_gfp() failure +- tls: Fix race condition in tls_sw_cancel_work_tx() +- !21447 Fix CVE-2026-23303 +- !21120 Fix CVE-2026-23231 +- !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches +- mm: thp: deny THP for files on anonymous inodes +- net: usb: pegasus: validate USB endpoints +- cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() +- !21488 urma: adjust netlink log level of ipourma +- !21433 urma: adjust the payload length in the ubcore_cm_send_to function +- urma: adjust netlink log level of ipourma +- xhci: dbgtty: fix device unregister: fixup +- tty: introduce and use tty_port_tty_vhangup() helper +- net: dsa: microchip: Fix error path in PTP IRQ setup +- can: ucan: Fix infinite loop from zero-length messages +- net: dsa: microchip: Free previously initialized ports on init failures +- net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() +- tools headers: Update the x86 headers with the kernel sources +- Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ +- nfnetlink_osf: validate individual option lengths in fingerprints +- selftests: mptcp: join: properly kill background tasks +- staging: rtl8712: Remove driver using deprecated API wext +- net: macb: fix unregister_netdev call order in macb_remove() +- iio: adc: rtq6056: Correct the sign bit index +- nfsd: Replace clamp_t in nfsd4_get_drc_mem() +- net: dsa: microchip: ptp: Fix checks on irq_find_mapping() +- net: dsa: microchip: common: Fix checks on irq_find_mapping() +- drm/amd/display: Check NULL before accessing +- drm: sti: fix device leaks at component probe +- USB: serial: option: add support for Rolling RW101R-GL +- USB: serial: ftdi_sio: add support for u-blox EVK-M101 +- xhci: dbgtty: fix device unregister +- xhci: dbgtty: Fix data corruption when transmitting data form DbC to host +- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths +- usb: dwc3: pci: Sort out the Intel device IDs +- usb: dwc3: pci: add support for the Intel Nova Lake -S +- usb: renesas_usbhs: Fix synchronous external abort on unbind +- usb: gadget: f_eem: Fix memory leak in eem_unwrap +- usb: cdns3: Fix double resource release in cdns3_pci_probe +- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking +- mptcp: clear scheduled subflows on retransmit +- firmware: stratix10-svc: fix bug in saving controller data +- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves +- thunderbolt: Add support for Intel Wildcat Lake +- drivers/usb/dwc3: fix PCI parent check +- dm-verity: fix unreliable memory allocation +- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling +- can: sja1000: fix max irq loop handling +- atm/fore200e: Fix possible data race in fore200e_open() +- ARM: dts: nxp: imx6ul: correct SAI3 interrupt line +- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 +- iio: adc: ad7280a: fix ad7280_store_balance_timer() +- iio: accel: fix ADXL355 startup race condition +- iio: accel: bmc150: Fix irq assumption regression +- iio:common:ssp_sensors: Fix an error handling path ssp_probe() +- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields +- Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" +- spi: bcm63xx: fix premature CS deassertion on RX-only transactions +- spi: nxp-fspi: Propagate fwnode in ACPI case as well +- spi: nxp-fspi: Support per spi-mem operation frequency switches +- spi: spi-mem: Add a new controller capability +- spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency +- spi: spi-mem: Allow specifying the byte order in Octal DTR mode +- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors +- spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA +- mailbox: pcc: don't zero error register +- mailbox: mailbox-test: Fix debugfs_create_dir error checking +- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors +- iio: st_lsm6dsx: Fixed calibrated timestamp calculation +- net: fec: do not register PPS event for PEROUT +- net: fec: do not allow enabling PPS and PEROUT simultaneously +- net: fec: do not update PEROUT if it is enabled +- net: fec: cancel perout_timer when PEROUT is disabled +- net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic +- net: dsa: sja1105: simplify static configuration reload +- net: sxgbe: fix potential NULL dereference in sxgbe_rx() +- net: lan966x: Fix the initialization of taprio +- net: aquantia: Add missing descriptor cache invalidation on ATL2 +- platform/x86: intel: punit_ipc: fix memory corruption +- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY +- Bluetooth: SMP: Fix not generating mackey and ltk when repairing +- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data +- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header +- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs +- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers +- !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches +- !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself +- sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting +- mptcp: pm: in-kernel: always mark signal+subflow endp as used +- net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop +- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled +- net: phy: register phy led_triggers during probe to avoid AB-BA deadlock +- can: bcm: fix locking for bcm_op runtime updates +- net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself +- net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled +- ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() +- mm/huge_memory: fix folio isn't locked in softleaf_to_folio() +- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation +- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo +- pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() +- mptcp: fix a race in mptcp_pm_del_add_timer() +- HID: amd_sfh: Stop sensor before starting +- pmdomain: imx: Fix reference count leak in imx_gpc_remove +- pmdomain: imx-gpc: Convert to platform remove callback returning void +- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() +- uio_hv_generic: Set event for all channels on the device +- tracing/tools: Fix incorrcet short option in usage text for --threads +- ALSA: usb-audio: fix uac2 clock source at terminal parser +- s390/mm: Fix __ptep_rdp() inline assembly +- kconfig/nconf: Initialize the default locale at startup +- kconfig/mconf: Initialize the default locale at startup +- net: tls: Cancel RX async resync request on rcd_delta overflow +- selftests: net: use BASH for bareudp testing +- x86/microcode/AMD: Limit Entrysign signature checking to known generations +- scsi: core: Fix a regression triggered by scsi_host_busy() +- cifs: fix typo in enable_gcm_256 module parameter +- bcma: don't register devices disabled in OF +- LoongArch: Use UAPI types in ptrace UAPI header +- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() +- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc +- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos +- s390/ctcm: Fix double-kfree +- net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() +- net: dsa: hellcreek: fix missing error handling in LED registration +- drm/tegra: Add call to put_pid() +- mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() +- pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() +- xfrm: Prevent locally generated packets from direct output in tunnel mode +- xfrm: Determine inner GSO type from packet inner protocol +- drm/amd/display: Move sleep into each retry for retrieve_link_cap() +- drm/amd/display: Increase DPCD read retries +- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled +- drm/tegra: dc: Fix reference leak in tegra_dc_couple() +- mptcp: do not fallback when OoO is present +- mptcp: avoid unneeded subflow-level drops +- mptcp: fix premature close in case of fallback +- mptcp: fix ack generation for fallback msk +- mptcp: fix race condition in mptcp_schedule_work() +- LoongArch: Don't panic if no valid cache info for PCI +- dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups +- MIPS: Malta: Fix !EVA SOC-it PCI MMIO +- Input: pegasus-notetaker - fix potential out-of-bounds access +- Input: imx_sc_key - fix memory corruption on unload +- Input: goodix - add support for ACPI ID GDIX1003 +- Input: cros_ec_keyb - fix an invalid memory access +- net: dsa: microchip: lan937x: Fix RGMII delay tuning +- smb: client: introduce close_cached_dir_locked() +- mptcp: Disallow MPTCP subflows from sockmap +- exfat: check return value of sb_min_blocksize in exfat_read_boot_sector +- shmem: fix tmpfs reconfiguration (remount) when noswap is set +- mtd: rawnand: cadence: fix DMA device NULL pointer dereference +- smb: client: Don't log plaintext credentials in cifs_set_cifscreds +- urma: adjust the payload length in the ubcore_cm_send_to function +- tools headers: Update the KVM headers with the kernel sources +- KVM: SVM: Add Idle HLT intercept support +- x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept +- perf vendor events amd: Update Zen 5 data cache fill events +- perf vendor events amd: Add Zen 5 data fabric metrics +- perf vendor events amd: Add Zen 5 data fabric events +- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() +- ntfs3: Fix uninit buffer allocated by __getname() +- f2fs: fix to detect potential corrupted nid in free_nid_list + +* Fri Apr 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.2.133 +- !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove +- !21695 urma: Create jetty with kernel thread +- netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove +- urma: Create jetty with kernel thread + +* Wed Apr 08 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.1.132 +- !21670 urma: change well-known jetty to UM +- !21669 urma: adjust netlink log level of ipourma +- urma: change well-known jetty to UM +- urma: adjust netlink log level of ipourma +- !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 +- f2fs: fix to detect potential corrupted nid in free_nid_list +- ntfs3: Fix uninit buffer allocated by __getname() +- nvme-pci: Fix race bug in nvme_poll_irqdisable() +- tls: Purge async_hold in tls_decrypt_async_wait() +- clsact: Fix use-after-free in init/destroy rollback asymmetry +- nf_tables: nft_dynset: fix possible stateful expression memleak in error path +- xdp: produce a warning when calculated tailroom is negative +- xdp: use modulo operation to calculate XDP frag tailroom +- apparmor: fix race between freeing data and fs accessing it +- Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" +- riscv: Replace function-like macro by static inline function +- sched/fair: scale wake_wide() threshold by SMT width +- sched/core: fix SCHED_FEAT overflow on 32-bit architectures +- drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() +- urma: fix race condition in async event causing kfree of invalid pointer +- urma: check for null topo map in ubcore_get_topo_info_by_agg_eid +- apparmor: replace recursive profile removal with iterative approach +- apparmor: fix: limit the number of levels of policy namespaces +- nfnetlink_osf: validate individual option lengths in fingerprints +- tls: Fix race condition in tls_sw_cancel_work_tx() +- urma: Kernel-mode file for bugfix of vtpn of empty pointer +- xen/privcmd: add boot control for restricted usage in domU +- xen/privcmd: unregister xenstore notifier on module exit +- xen/privcmd: restrict usage in unprivileged domU +- af_unix: Give up GC if MSG_PEEK intervened. +- urma: Kernel-mode file for bugfix to move hashtable from alloc to active +- apparmor: fix differential encoding verification +- ub:hisi-ubus: Synchronize the missing code +- apparmor: Fix double free of ns_name in aa_replace_profiles() +- mptcp: pm: in-kernel: always mark signal+subflow endp as used +- bridge: cfm: Fix race condition in peer_mep deletion +- ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() +- apparmor: fix race on rawdata dereference +- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase +- net/sched: act_gate: snapshot parameters with RCU on replace +- bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded +- netfilter: nf_tables: always walk all pending catchall elements +- netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels +- net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs +- netfilter: nf_tables: unconditionally bump set->nelems before insertion +- netfilter: nf_tables: release flowtable after rcu grace period on error +- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks +- netfilter: xt_CT: drop pending enqueued packets on template removal +- net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit +- apparmor: fix memory leak in verify_header +- wifi: libertas: fix use-after-free in lbs_free_adapter() +- can: usb: etas_es58x: correctly anchor the urb in the read bulk callback +- urma: Kernel-mode file for bugfix deactivate to apply pid in udma +- urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback +- net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop +- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled +- can: bcm: fix locking for bcm_op runtime updates +- net: phy: register phy led_triggers during probe to avoid AB-BA deadlock +- net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled +- net: prevent NULL deref in ip[6]tunnel_xmit() +- net: add xmit recursion limit to tunnel xmit functions +- net: gro: fix outer network offset +- net: annotate data-races around sk->sk_{data_ready,write_space} +- net: add proper RCU protection to /proc/net/ptype +- urma: fix potential deadlock risk in urma_ping +- Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ +- sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting +- net: usb: kalmia: validate USB endpoints +- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE +- cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() +- urma: use user-specified dev_name when creating agg dev +- mm: thp: deny THP for files on anonymous inodes +- mm/huge_memory: fix folio isn't locked in softleaf_to_folio() +- smb: client: Don't log plaintext credentials in cifs_set_cifscreds +- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() +- xhci: dbgtty: fix device unregister: fixup +- tty: introduce and use tty_port_tty_vhangup() helper +- net: dsa: microchip: Fix error path in PTP IRQ setup +- can: ucan: Fix infinite loop from zero-length messages +- net: dsa: microchip: Free previously initialized ports on init failures +- net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() +- selftests: mptcp: join: properly kill background tasks +- staging: rtl8712: Remove driver using deprecated API wext +- net: macb: fix unregister_netdev call order in macb_remove() +- iio: adc: rtq6056: Correct the sign bit index +- nfsd: Replace clamp_t in nfsd4_get_drc_mem() +- net: dsa: microchip: ptp: Fix checks on irq_find_mapping() +- net: dsa: microchip: common: Fix checks on irq_find_mapping() +- drm/amd/display: Check NULL before accessing +- drm: sti: fix device leaks at component probe +- USB: serial: option: add support for Rolling RW101R-GL +- USB: serial: ftdi_sio: add support for u-blox EVK-M101 +- xhci: dbgtty: fix device unregister +- xhci: dbgtty: Fix data corruption when transmitting data form DbC to host +- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths +- usb: dwc3: pci: Sort out the Intel device IDs +- usb: dwc3: pci: add support for the Intel Nova Lake -S +- usb: renesas_usbhs: Fix synchronous external abort on unbind +- usb: gadget: f_eem: Fix memory leak in eem_unwrap +- usb: cdns3: Fix double resource release in cdns3_pci_probe +- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking +- mptcp: clear scheduled subflows on retransmit +- firmware: stratix10-svc: fix bug in saving controller data +- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves +- thunderbolt: Add support for Intel Wildcat Lake +- drivers/usb/dwc3: fix PCI parent check +- dm-verity: fix unreliable memory allocation +- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling +- can: sja1000: fix max irq loop handling +- atm/fore200e: Fix possible data race in fore200e_open() +- ARM: dts: nxp: imx6ul: correct SAI3 interrupt line +- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 +- iio: adc: ad7280a: fix ad7280_store_balance_timer() +- iio: accel: fix ADXL355 startup race condition +- iio: accel: bmc150: Fix irq assumption regression +- iio:common:ssp_sensors: Fix an error handling path ssp_probe() +- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields +- Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" +- spi: bcm63xx: fix premature CS deassertion on RX-only transactions +- spi: nxp-fspi: Propagate fwnode in ACPI case as well +- spi: nxp-fspi: Support per spi-mem operation frequency switches +- spi: spi-mem: Add a new controller capability +- spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency +- spi: spi-mem: Allow specifying the byte order in Octal DTR mode +- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors +- spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA +- mailbox: pcc: don't zero error register +- mailbox: mailbox-test: Fix debugfs_create_dir error checking +- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors +- iio: st_lsm6dsx: Fixed calibrated timestamp calculation +- net: fec: do not register PPS event for PEROUT +- net: fec: do not allow enabling PPS and PEROUT simultaneously +- net: fec: do not update PEROUT if it is enabled +- net: fec: cancel perout_timer when PEROUT is disabled +- net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic +- net: dsa: sja1105: simplify static configuration reload +- net: sxgbe: fix potential NULL dereference in sxgbe_rx() +- net: lan966x: Fix the initialization of taprio +- net: aquantia: Add missing descriptor cache invalidation on ATL2 +- platform/x86: intel: punit_ipc: fix memory corruption +- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY +- Bluetooth: SMP: Fix not generating mackey and ltk when repairing +- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data +- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header +- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs +- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers + +* Wed Apr 01 2026 Li Nan <linan122@huawei.com> - 6.6.0-145.0.0.131 +- !21462 urma: Kernel-mode file for bugfix of kerf of tjetty +- urma: Kernel-mode file for bugfix of kerf of tjetty +- !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace +- !21393 Fix CVE-2026-23268 +- !21446 i40e: Fix preempt count leak in napi poll tracepoint +- !21441 ext4: fix generic/363 failure in iomap buffered I/O mode +- !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes +- !21450 Fix CVE-2026-23317 +- !21429 urma: add workqueue for well_know_jetty +- !21439 urma: userctl fuction about fix mode. +- !21458 urma: adjust log level to info for get_dev_name +- !21425 urma: fix the double free issue of import_cb +- !21408 urma: ipourma default sl configuration +- urma: usrctrl function about fix mode. +- urma: adjust log level to info for get_dev_name +- !21436 bpf: Release module BTF IDR before module unload +- !21440 v2 CVE-2026-23319 +- !21438 bpf: Fix stack-out-of-bounds write in devmap +- time/jiffies: Mark jiffies_64_to_clock_t() notrace +- !21426 RDMA/umad: Reject negative data_len in ib_umad_write +- drm/vmwgfx: Return the correct value in vmw_translate_ptr functions +- !21421 v3 CVE-2026-23352 +- !21380 perf: HiSilicon: Support uncore ITS PMU +- !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver +- !21391 quota: fix livelock between quotactl and freeze_super +- !21390 ext4: fix dirtyclusters double decrement on fs shutdown +- !21389 fat: avoid parent link count underflow in rmdir +- !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O +- !21387 ext4: fix memory leak in ext4_ext_shift_extents() +- !21386 blktrace: fix __this_cpu_read/write in preemptible context +- !21434 Fix CVE-2026-23388 +- i40e: Fix preempt count leak in napi poll tracepoint +- ub/obmm: delay conti_clear_thread when conti_clear_memseg failed +- urma: add workqueue for well_know_jetty +- ext4: zero post EOF partial block before iomap appending write +- ext4: move pagecache_isize_extended() out of active handle +- ext4: remove ctime/mtime update from ext4_alloc_file_blocks() +- ext4: unify SYNC mode checks in fallocate paths +- ext4: ensure zeroed partial blocks are persisted in SYNC mode +- ext4: move zero partial block range functions out of active handle +- ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() +- ext4: remove handle parameters from zero partial block functions +- ext4: move ordered data handling out of ext4_block_do_zero_range() +- ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() +- ext4: factor out journalled block zeroing range +- ext4: rename and extend ext4_block_truncate_page() +- iomap: make zero range flush conditional on unwritten mappings +- iomap: fix handling of dirty folios over unwritten extents +- ub/obmm: minor bugfixes +- bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim +- bpf: export bpf_link_inc_not_zero. +- !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs +- crypto: hisilicon/qm - support querying the hardware fault status through VFs +- urma: ipourma default sl configuration +- bpf: Fix stack-out-of-bounds write in devmap +- bpf: Release module BTF IDR before module unload +- Squashfs: check metadata block offset is within range +- !21346 Revert "net: hns3: add sync command to sync io-pgtable" +- !21372 nvme: fix memory allocation in nvme_pr_read_keys() +- apparmor: fix unprivileged local user can do privileged policy management +- !21423 nvme: fix admin queue leak on controller reset +- !21422 scsi: target: Fix recursive locking in __configfs_open_file() +- RDMA/umad: Reject negative data_len in ib_umad_write +- !21402 CVE-2026-23296 +- !21403 fix queue start/stop imbalance under race +- urma: fix the double free issue of bind_cb +- nvme: fix admin queue leak on controller reset +- scsi: target: Fix recursive locking in __configfs_open_file() +- x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size +- x86/efi: defer freeing of boot services memory +- !21405 Fix CVE-2025-71239 +- !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 +- !21410 urma: disallow user-mode calls for some ubagg userctl ops +- !21371 urma: remote all logic device when set dev ns +- urma: disallow user-mode calls for some ubagg userctl ops +- !21109 filemap: restrict pagecache to non-cpuless NUMA nodes +- drivers/ub/sentry: skip memory_failure if pfn is 0x0 +- !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches +- audit: add fchmodat2() to change attributes class +- urma: remote all logic device when set dev ns +- !21348 uvb: support communication in VM +- !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM +- dm: fix queue start/stop imbalance under remove/resume races +- dm: fix queue start/stop imbalance under suspend/load/resume races +- scsi: core: Fix error handling for scsi_alloc_sdev() +- scsi: core: Fix refcount leak for tagset_refcnt +- uvb: support communication in VM +- !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing +- !21334 prevent SEA storms on critical RAS +- !21375 urma: Kernel-mode file for tp reuse in RC transmode +- urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state +- quota: fix livelock between quotactl and freeze_super +- ext4: fix dirtyclusters double decrement on fs shutdown +- fat: avoid parent link count underflow in rmdir +- ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O +- ext4: fix memory leak in ext4_ext_shift_extents() +- blktrace: fix __this_cpu_read/write in preemptible context +- !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen +- perf: HiSilicon: Support uncore ITS PMU +- drivers/perf: hisi: Add new function for HiSilicon MN PMU driver +- net/ipv4:scmtcp: fix no dmi_uuid in VM +- !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race +- !21249 arm64/xcall: add research papers reference in file headers +- !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir +- !21369 drivers/ub/sentry: add some log for event report +- mm/filemap: restrict pagecache to non-cpuless NUMA nodes +- mm/mempolicy: add mpol_update_interleave_stats() helper +- !21328 genirq: Get rid of global lock in irq_do_set_affinity() +- !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization +- nvme: fix memory allocation in nvme_pr_read_keys() +- !21339 iommu: Revert to using .domain_alloc_user without kvm parameter +- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization +- Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" +- drivers/ub/sentry: add some log for event report +- perf: Fix __perf_event_overflow() vs perf_remove_from_context() race +- media: dvb-core: fix wrong reinitialization of ringbuffer on reopen +- iommu: Revert to using .domain_alloc_user without kvm parameter +- Revert "net: hns3: add sync command to sync io-pgtable" +- regulator: fixed: Rely on the core freeing the enable GPIO +- net/mlx5e: Fix validation logic in rate limiting +- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling +- ntfs3: init run lock for extend inode +- scsi: ufs: host: mediatek: Require CONFIG_PM +- wifi: rtw88: limit indirect IO under powered off for RTL8822CS +- pinctrl: keembay: fix double free in keembay_build_functions() +- block: fix comment for op_is_zone_mgmt() to include RESET_ALL +- mptcp: schedule rtx timer only after pushing data +- ACPI: HMAT: Remove register of memory node for generic target +- mm/memory-tier: fix abstract distance calculation overflow +- mm/truncate: unmap large folio on split failure +- mm: memcg: change flush_next_time to flush_last_time +- mm: memcg: add per-memcg zswap writeback stat +- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL +- scsi: ufs: core: Add a quirk to suppress link_startup_again +- scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register +- scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT +- scsi: ufs: core: Add fill_crypto_prdt variant op +- scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE +- scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller +- scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE +- f2fs: fix to avoid overflow while left shift operation +- mm, percpu: do not consider sleepable allocations atomic +- iommufd: Don't overflow during division for dirty tracking +- btrfs: ensure no dirty metadata is written back for an fs with errors +- Revert "perf dso: Add missed dso__put to dso__load_kcore" +- selftests: mptcp: connect: trunc: read all recv data +- selftests: mptcp: join: rm: set backup flag +- selftests: mptcp: connect: fix fallback note due to OoO +- pmdomain: samsung: plug potential memleak during probe +- btrfs: do not update last_log_commit when logging inode due to a new name +- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() +- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection +- EDAC/altera: Handle OCRAM ECC enable after warm reset +- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY +- selftests/user_events: fix type cast for write_index packed member in perf_test +- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev +- spi: Try to get ACPI GPIO IRQ earlier +- smb: client: fix cifs_pick_channel when channel needs reconnect +- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer +- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 +- mm/mm_init: fix hash table order logging in alloc_large_system_hash() +- wifi: mac80211: reject address change while connecting +- selftests/tracing: Run sample events to clear page cache events +- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY +- LoongArch: Use correct accessor to read FWPC/MWPC +- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent +- strparser: Fix signed/unsigned mismatch bug +- ksmbd: close accepted socket when per-IP limit rejects connection +- gcov: add support for GCC 15 +- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated +- HID: uclogic: Fix potential memory leak in error path +- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY +- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() +- ARM: dts: imx51-zii-rdu1: Fix audmux node names +- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 +- mtd: onenand: Pass correct pointer to IRQ handler +- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' +- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN +- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops +- acpi/hmat: Fix lockdep warning for hmem_register_resource() +- base/node / ACPI: Enumerate node access class for 'struct access_coordinate' +- acpi: numa: Add setting of generic port system locality attributes +- acpi: Break out nesting for hmat_parse_locality() +- acpi: numa: Add genport target allocation to the HMAT parsing +- acpi: numa: Create enum for memory_target access coordinates indexing +- base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' +- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd +- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() +- NFS: sysfs: fix leak when nfs_client kobject add fails +- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS +- NFS: enable nconnect for RDMA +- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() +- ASoC: tas2781: fix getting the wrong device number +- ASoC: codecs: va-macro: fix resource leak in probe error path +- ASoC: cs4271: Fix regulator leak on probe failure +- regulator: fixed: fix GPIO descriptor leak on register failure +- acpi,srat: Fix incorrect device handle check for Generic Initiator +- cifs: Fix uncached read into ITER_KVEC iterator +- cifs: stop writeback extension when change of size is detected +- Bluetooth: L2CAP: export l2cap_chan_hold for modules +- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs +- ACPI: CPPC: Check _CPC validity for only the online CPUs +- hsr: Fix supervision frame sending on HSRv0 +- virtio-net: fix incorrect flags recording in big mode +- net_sched: limit try_bulk_dequeue_skb() batches +- net/mlx5e: Fix potentially misleading debug message +- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps +- net/mlx5e: Fix maxrate wraparound in threshold between units +- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak +- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak +- net_sched: act_connmark: use RCU in tcf_connmark_dump() +- wifi: mac80211: skip rate verification for not captured PSDUs +- net: mdio: fix resource leak in mdiobus_register_device() +- net/handshake: Fix memory leak in tls_handshake_accept() +- net/smc: fix mismatch between CLC header and proposal +- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions +- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion +- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path +- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF +- net: fec: correct rx_bytes statistic for the case SHIFT16 is set +- selftests: net: local_termination: Wait for interfaces to come up +- wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() +- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down +- smb/server: fix possible refcount leak in smb2_sess_setup() +- smb/server: fix possible memory leak in smb2_read() +- NFS: check if suid/sgid was cleared after a write as needed +- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug +- NFS4: Fix state renewals missing after boot +- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices +- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks +- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used +- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors +- compiler_types: Move unused static inline functions warning to W=2 +- iommufd: Make vfio_compat's unmap succeed if the range is already empty +- smb: client: fix refcount leak in smb2_set_path_attr +- drm/i915: Fix conversion between clock ticks and nanoseconds +- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD +- selftests: netdevsim: set test timeout to 10 minutes +- riscv: stacktrace: fix backtracing through exceptions +- drm/amd/display: Fix black screen with HDMI outputs +- drm/amdgpu: Fix function header names in amdgpu_connectors.c +- extcon: adc-jack: Cleanup wakeup source only if it was enabled +- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers +- x86/microcode/AMD: Add more known models to entry sign checking +- drm/amd/display: Enable mst when it's detected but yet to be initialized +- net: bridge: fix MST static key usage +- lan966x: Fix sleeping in atomic context +- net: dsa: microchip: Fix reserved multicast address table programming +- net/mlx5e: SHAMPO, Fix skb size check for 64K pages +- net/mlx5e: Fix return value in case of module EEPROM read error +- net/mlx5e: Use extack in get module eeprom by page callback +- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup +- net: dsa: b53: stop reading ARL entries if search is done +- net: dsa: b53: fix enabling ip multicast +- net: dsa: b53: fix resetting speed and pause on forced link +- net: vlan: sync VLAN features with lower device +- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh +- netdevsim: add Makefile for selftests +- selftests/net: use destination options instead of hop-by-hop +- selftests/net: fix GRO coalesce test and add ext header coalesce tests +- selftests/net: fix out-of-order delivery of FIN in gro:tcp test +- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx +- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() +- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro +- riscv: stacktrace: Disable KASAN checks for non-current tasks +- riscv: Improve exception and system call latency +- net: libwx: fix device bus LAN ID +- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again +- ceph: refactor wake_up_bit() pattern of calling +- ceph: add checking of wait_for_completion_killable() return value +- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity +- kbuild: uapi: Strip comments before size type check +- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 +- tools: lib: thermal: use pkg-config to locate libnl3 +- tools: lib: thermal: don't preserve owner in install +- tools bitmap: Add missing asm-generic/bitsperlong.h include +- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS +- 9p: sysfs_init: don't hardcode error to ENOMEM +- cpufreq: tegra186: Initialize all cores to max frequencies +- 9p: fix /sys/fs/9p/caches overwriting itself +- NTB: epf: Allow arbitrary BAR mapping +- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled +- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register +- clk: at91: clk-master: Add check for divide by 3 +- ARM: at91: pm: save and restore ACR during PLL disable/enable +- rtc: pcf2127: clear minute/second interrupt +- clk: sunxi-ng: sun6i-rtc: Add A523 specifics +- um: Fix help message for ssl-non-raw +- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink +- btrfs: mark dirty extent range for out of bound prealloc extents +- RDMA/irdma: Set irdma_cq cq_num field during CQ create +- RDMA/irdma: Remove unused struct irdma_cq fields +- RDMA/irdma: Fix SD index calculation +- ACPICA: Update dsmethod.c to get rid of unused variable warning +- char: misc: restrict the dynamic range to exclude reserved minors +- smb: client: transport: avoid reconnects triggered by pending task work +- ksmbd: use sock_create_kern interface to create kernel socket +- orangefs: fix xattr related buffer overflow... +- page_pool: Clamp pool size to max 16K pages +- 6pack: drop redundant locking and refcounting +- exfat: limit log print for IO error +- ALSA: usb-audio: add mono main switch to Presonus S1824c +- Bluetooth: SCO: Fix UAF on sco_conn_free +- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames +- net: macb: avoid dealing with endianness in macb_set_hwaddr() +- arm64: openeuler_defconfig: enable ras critical related configs by default +- rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS +- futex: avoid memory access during exit_robust_list if task facing critical RAS +- mm: avoid memory access during __access_remote_vm if task facing critical RAS +- coredump: skip coredump during critical error if task facing critical RAS +- exit: terminate process on critical RAS events to prevent further damage +- ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct +- ACPI: APEI: Add vendor specific error info handling for ARM Processor +- mm: memory_failure: fix UAF in memory_failure_cb +- genirq: Get rid of global lock in irq_do_set_affinity() +- nfs: return EISDIR on nfs3_proc_create if d_alias is a dir +- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 +- ASoC: stm32: sai: manage context in set_sysclk callback +- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw +- ext4: increase IO priority of fastcommit +- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state +- accel/habanalabs: return ENOMEM if less than requested pages were pinned +- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate +- accel/habanalabs/gaudi2: fix BMON disable configuration +- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() +- net: bridge: Install FDB for bridge MAC on VLAN 0 +- NFSv4.1: fix mount hang after CREATE_SESSION failure +- NFSv4: handle ERR_GRACE on delegation recalls +- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream +- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 +- remoteproc: qcom: q6v5: Avoid handling handover twice +- PCI/PM: Skip resuming to D0 if device is disconnected +- vfio: return -ENOTTY for unsupported device feature +- sparc64: fix prototypes of reads[bwl]() +- sparc/module: Add R_SPARC_UA64 relocation handling +- r8169: set EEE speed down ratio to 1 +- net: intel: fm10k: Fix parameter idx set but not used +- wifi: ath10k: Fix connection after GTK rekeying +- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() +- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X +- net: phy: clear link parameters on admin link down +- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() +- jfs: fix uninitialized waitqueue in transaction manager +- jfs: Verify inode mode when loading from disk +- ipv6: np->rxpmtu race annotation +- f2fs: fix infinite loop in __insert_extent_tree() +- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices +- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs +- allow finish_no_open(file, ERR_PTR(-E...)) +- scsi: lpfc: Define size of debugfs entry for xri rebalancing +- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup +- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET +- scsi: ufs: core: Disable timestamp functionality if not supported +- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency +- drm/amdgpu: reject gang submissions under SRIOV +- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 +- ethernet: Extend device_get_mac_address() to use NVMEM +- drm/amd/display: Disable VRR on DCE 6 +- drm/amd/display: Fix DVI-D/HDMI adapters +- drm/amd: Avoid evicting resources at S5 +- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl +- ALSA: serial-generic: remove shared static buffer +- wifi: mt76: mt7996: Temporarily disable EPCS +- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device +- net/cls_cgroup: Fix task_get_classid() during qdisc run +- crypto: caam - double the entropy delay interval for retry +- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() +- crypto: sun8i-ce - remove channel timeout field +- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger +- HID: asus: add Z13 folio to generic group for multitouch to work +- selftests: Replace sleep with slowwait +- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP +- selftests: Disable dad for ipv6 in fcnal-test.sh +- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT +- netfilter: nf_reject: don't reply to icmp error messages +- selftests: traceroute: Use require_command() +- media: redrat3: use int type to store negative error codes +- selftests: net: replace sleeps in fcnal-test with waits +- net: sh_eth: Disable WoL if system can not suspend +- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 +- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet +- phy: cadence: cdns-dphy: Enable lower resolutions in dphy +- wifi: mac80211: Fix HE capabilities element check +- ntfs3: pretend $Extend records as regular files +- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes +- net: phy: marvell: Fix 88e1510 downshift counter errata +- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure +- scsi: ufs: host: mediatek: Enhance recovery on resume failure +- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer +- media: ov08x40: Fix the horizontal flip control +- char: Use list_del_init() in misc_deregister() to reinitialize list pointer +- drm/msm: make sure to not queue up recovery more than once +- usb: gadget: f_hid: Fix zero length packet transfer +- drm/amdgpu: add support for cyan skillfish gpu_info +- drm/amdgpu: don't enable SMU on cyan skillfish +- drm/amd: add more cyan skillfish PCI ids +- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs +- iommu/amd: Skip enabling command/event buffers for kdump +- smsc911x: add second read of EEPROM mac when possible corruption seen +- net: call cond_resched() less often in __release_sock() +- ALSA: usb-audio: apply quirk for MOONDROP Quark2 +- media: verisilicon: Explicitly disable selection api ioctls for decoders +- media: adv7180: Only validate format in querystd +- media: adv7180: Do not write format to device in set_fmt +- media: adv7180: Add missing lock in suspend callback +- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms +- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled +- drm/amdgpu: Allow kfd CRIU with no buffer objects +- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate +- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL +- dmaengine: dw-edma: Set status for callback_result +- dmaengine: mv_xor: match alloc_wc and free_wc +- dmaengine: sh: setup_xref error handling +- ptp: Limit time setting of PTP clocks +- scsi: pm8001: Use int instead of u32 to store error codes +- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() +- mips: lantiq: danube: rename stp node on EASY50712 reference board +- mips: lantiq: xway: sysctrl: rename stp clock +- mips: lantiq: danube: add missing device_type in pci node +- mips: lantiq: danube: add model to EASY50712 dts +- mips: lantiq: danube: add missing properties to cpu node +- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) +- media: fix uninitialized symbol warnings +- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption +- drm/amdkfd: fix vram allocation failure for a special case +- fuse: zero initialize inode private data +- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device +- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper +- extcon: adc-jack: Fix wakeup source leaks on device unbind +- scsi: pm80xx: Fix race condition caused by static variables +- scsi: mpi3mr: Fix controller init failure on fault during queue creation +- rds: Fix endianness annotation for RDS_MPATH_HASH +- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units +- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call +- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. +- net: stmmac: Correctly handle Rx checksum offload errors +- net: When removing nexthops, don't call synchronize_net if it is not necessary +- char: misc: Does not request module for miscdevice with dynamic minor +- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor +- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet +- iio: adc: imx93_adc: load calibrated values even calibration failed +- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register +- drm/amdkfd: Handle lack of READ permissions in SVM mapping +- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts +- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling +- scsi: ufs: host: mediatek: Change reset sequence for improved stability +- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change +- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration +- bridge: Redirect to backup port when port is administratively down +- s390/pci: Use pci_uevent_ers() in PCI recovery +- powerpc/eeh: Use result of error_detected() in uevent +- ice: Don't use %pK through printk or tracepoints +- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() +- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall +- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR +- drm/tidss: Set crtc modesetting parameters with adjusted mode +- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST +- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value +- drm/tidss: Use the crtc_* timings when programming the HW +- media: amphion: Delete v4l2_fh synchronously in .release() +- media: pci: ivtv: Don't create fake v4l2_fh +- drm/amdkfd: return -ENOTTY for unsupported IOCTLs +- wifi: rtw88: sdio: use indirect IO for device registers before power-on +- selftests/net: Ensure assert() triggers in psock_tpacket.c +- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 +- PCI: Disable MSI on RDC PCI to PCIe bridges +- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() +- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff +- drm/amd/pm: Use cached metrics data on arcturus +- drm/amd/pm: Use cached metrics data on aldebaran +- drm/amd/display: update dpp/disp clock from smu clock table +- drm/amd/display: add more cyan skillfish devices +- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration +- drm/amd/display: ensure committing streams is seamless +- mfd: da9063: Split chip variant reading in two bus transactions +- mfd: madera: Work around false-positive -Wininitialized warning +- mfd: stmpe-i2c: Add missing MODULE_LICENSE +- mfd: stmpe: Remove IRQ domain upon removal +- tools/power x86_energy_perf_policy: Prefer driver HWP limits +- tools/power x86_energy_perf_policy: Enhance HWP enable +- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage +- tools/cpupower: Fix incorrect size in cpuidle_state_disable() +- hwmon: (dell-smm) Add support for Dell OptiPlex 7040 +- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex +- uprobe: Do not emulate/sstep original instruction when ip is changed +- nvme: Use non zero KATO for persistent discovery connections +- bpf: Clear pfmemalloc flag when freeing all fragments +- riscv: bpf: Fix uninitialized symbol 'retval_off' +- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel +- spi: rpc-if: Add resume support for RZ/G3E +- cpuidle: Fail cpuidle device registration if there is one already +- bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 +- power: supply: qcom_battmgr: handle charging state change notifications +- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" +- tools/cpupower: fix error return value in cpupower_write_sysfs() +- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 +- tee: allow a driver to allocate a tee_device without a pool +- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() +- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card +- ARM: tegra: transformer-20: fix audio-codec interrupt +- ARM: tegra: transformer-20: add missing magnetometer interrupt +- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups +- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 +- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller +- hwmon: sy7636a: add alias +- power: supply: sbs-charger: Support multiple devices +- pinctrl: keembay: release allocated memory in detach path +- hwmon: (sbtsi_temp) AMD CPU extended temperature range support +- power: supply: qcom_battmgr: add OOI chemistry +- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] +- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA +- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment +- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh +- arc: Fix __fls() const-foldability via __builtin_clzl() +- cpufreq/longhaul: handle NULL policy in longhaul_exit +- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 +- irqchip/sifive-plic: Respect mask state when setting affinity +- memstick: Add timeout to prevent indefinite waiting +- mmc: host: renesas_sdhi: Fix the actual clock +- pinctrl: single: fix bias pull up/down handling in pin_config_set +- bpf: Don't use %pK through printk +- spi: loopback-test: Don't use %pK through printk +- soc: qcom: smem: Fix endian-unaware access of num_entries +- soc: aspeed: socinfo: Add AST27xx silicon IDs +- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. +- drm/sched: Fix race in drm_sched_entity_select_rq() +- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP +- sched/fair: Use all little CPUs for CPU-bound workloads +- sched/pelt: Avoid underestimation of task utilization +- net: phy: dp83867: Disable EEE support as not implemented +- s390/pci: Restore IRQ unconditionally for the zPCI device +- regmap: slimbus: fix bus_context pointer in regmap init calls +- block: make REQ_OP_ZONE_OPEN a write operation +- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL +- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland +- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji +- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() +- sfc: fix potential memory leak in efx_mae_process_mport() +- drm/etnaviv: fix flush sequence logic +- Bluetooth: hci_core: Fix tracking of periodic advertisement +- Bluetooth: ISO: Fix another instance of dst_type handling +- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset +- libbpf: Fix powerpc's stack register definition in bpf_tracing.h +- ASoC: fsl_sai: fix bit order for DSD format +- ASoC: Intel: avs: Unprepare a stream when XRUN occurs +- scsi: ufs: core: Initialize value of an attribute returned by uic cmd +- ALSA: usb-audio: fix control pipe direction +- drm/msm/a6xx: Fix GMU firmware parser +- wifi: ath12k: free skb during idr cleanup callback +- wifi: ath10k: Fix memory leak on unsupported WMI command +- ASoC: qdsp6: q6asm: do not sleep while atomic +- mptcp: restore window probe +- mptcp: drop bogus optimization in __mptcp_check_push() +- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init +- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS +- Bluetooth: rfcomm: fix modem control handling +- ACPI: button: Call input_free_device() on failing input device registration +- fbdev: atyfb: Check if pll_ops->init_pll failed +- net: usb: asix_devices: Check return value of usbnet_get_endpoints +- bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing +- arm64/xcall: add research papers reference in file headers + +* Wed Mar 25 2026 Li Nan <linan122@huawei.com> - 6.6.0-144.0.0.130 +- !21367 ub: udma: bugfix related to jfr id. +- !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot +- !21357 urma: fix add obj type compile error +- ub: udma: bugfix related to jfr id. +- urma: fix add obj type compile error +- ub: ubase: optimized reboot time required +- !21350 urma: add obj type in ubcore delete uobj error +- !21343 urma: support ubp methods +- !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled +- urma: support ubp methods; +- !21320 urma: decrease session creation max timeout +- !21323 urma: tp reuse in RC transmode +- !21319 urma: remove legacy bonding dev create/delete +- !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces +- ub: ubase: Improving the reliability of CtrlQ. +- arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled +- urma: add obj type in ubcore delete uobj error +- urma: Kernel-mode file for tp reuse in RC transmode +- iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. +- ub:ubfi: Delete device load debug logs +- iommu/ummu-core: Fix kref imbalance in VMA split scenario +- iommu/ummu-core: Prevent FREE_TID while mmap is active +- iommu/ummu: Add deprecation markers for ummu SVA APIs +- !21324 mfs: fix mfsd_prefetch.cpp compile error +- !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE +- !20936 gmem: fix several issues +- !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy +- !21333 v4 hugetlb: drain pcp for movable zone before alloc +- drivers/ub/sentry: set the priority +- hugetlb: drain pcp for movable zone before alloc +- !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb +- gmem: only create vma->vm_obj when peer_va_alloc_fixed return true +- gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference +- gmem: hold mmap_read lock while executing gmem_unmap_region +- gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() +- gmem: fix hmemcpy src/dest conflict deadlock under concurrency +- gmem: fix NULL ptr deference in vm_object_merge +- mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb +- mfs: fix mfsd_prefetch.cpp compile error +- !21310 CCA: Add the RSI interface for obtaining the device certificate. +- urma: remove legacy bonding dev create/delete +- urma: Decrease session creation max timeout +- !21316 ub: udma: Move the request for RC context from UDMA to UBASE +- net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE +- ub: ubase: Move the request for RC context from UDMA to UBASE +- !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode +- !21302 [OLK-6.6]:update patches for sw64 architecture +- ub: udma: bugfix related to deactivate tp. +- ub: udma: bugfix related to jetty group. +- !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() +- !21312 urma: support remove ubagg & uburma ko +- !21223 kvm: add skip vmovp feature support +- CCA: Add the RSI interface for obtaining the device certificate. +- urma: support remove ubagg & uburma ko +- KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group +- !21276 ub/ubdevshm: Fix some issues +- !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches +- !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations +- ub/ubmem-mmu: Fix some issues +- ub/ubmempfd: Add module author +- ub/ubdevshm: Fix some issues +- mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() +- gpio: regmap: Fix memleak in error path in gpio_regmap_register() +- perf: sched: Fix perf crash with new is_user_task() helper +- ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times +- ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports +- !21307 ub: ubase&unic: Stability and Functionality Fixes Collection +- net: unic: correct DMA direction for TX path +- net: unic: Fix the bug that could cause nconsistent resource state or double-free +- net: unic: optimize MAC address deletion to avoid sleeping in spinlock +- ub: ubase: Resolve integer wraparound +- ub: ubase: Resolve cache coherence and set smp_rmb +- ub: ubase&unic: adjust the encoding format of the ubase&unic driver. +- ub: ubase: Support udma get ue msg info. +- net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. +- ub: ubase: The debugfs function supports querying the Ethernet port rate. +- sw64: adapt arch_tlbbatch_add_pending according to upstream +- sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled +- sw64: add support for batched TLB flushing during unmap +- sw64: fix the parameter passing logic of memblock_mark_nomap +- sw64: add HUGE_VMAP support for c4 +- sw64: define get_cycles macro +- sw64: cpuidle: refine C6 state stability +- sw64: add barriers and tlb flush for set_atc +- sw64: adapt kernel page table for kdump +- sw64: adapt kernel page table for memory hotplug +- sw64: set PTBR_SYS before accessing vmalloc area +- sw64: set execute permission for virtual machine's hmcode text section +- sw64: adjust the marking and definitions of some kernel mapping functions +- sw64: adapt kernel page table for S4 +- sw64: fix an inappropriate lock in __set_memory +- sw64: enable kernel page table +- sw64: use ioremap to map IO address in functions like __get_cpu_nums() +- sw64: move non-boot core's kernel page table enabling logic to hmcode +- sw64: use ioremap to map IO address +- sw64: map legacy I/O to K segment +- sw64: setup early_ioremap +- sw64: reset ATC for kvm +- sw64: setup mapping for efi_mm +- sw64: set protection for kernel page table +- sw64: modify codes with fixmap +- sw64: map the early and the final page table +- sw64: add fixmap support +- sw64: fix mmap_base exceeding Java assertion address +- sw64: add memb before/after atomic +- sw64: add EDAC support with dynamic node and MC detection +- sw64: fix: getcpu passed a null pointer error +- sw64: iommu: refactor iommu v2 initialization +- sw64: cache: fix shared_cpu_map when PPTT is invalid +- sw64: add alternative runtime patching +- sw64: pci: fix IO_BASE if numa_off +- sw64: use ioremap to map spaces for cpufreq and S3 +- sw64: pci: add sunway pci controller for Command Completed errata +- sw64: add definitions for kernel-required CPU capabilities +- sw64: kvm: add qemu-gdb watchpoint support +- sw64: kvm: fix srcu lock leak in pv steal time +- gpio: idio-16: Define fixed direction of the GPIO lines +- gpio: regmap: add the .fixed_direction_output configuration parameter +- gpio: regmap: Allow to allocate regmap-irq device +- bits: introduce fixed-type GENMASK_U*() +- bits: add comments and newlines to #if, #else and #endif directives +- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event +- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. +- xhci: dbc: Improve performance by removing delay in transfer event polling. +- xhci: dbc: Allow users to modify DbC poll interval via sysfs +- xhci: dbc: poll at different rate depending on data transfer activity +- serial: sc16is7xx: reorder code to remove prototype declarations +- serial: sc16is7xx: remove unused to_sc16is7xx_port macro +- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported +- selftests: mptcp: disable add_addr retrans in endpoint_tests +- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c +- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() +- btrfs: use level argument in log tree walk callback replay_one_buffer() +- btrfs: always drop log root tree reference in btrfs_replay_log() +- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() +- btrfs: zoned: refine extent allocator hint selection +- btrfs: zoned: return error from btrfs_zone_finish_endio() +- EDAC/mc_sysfs: Increase legacy channel support to 16 +- x86/bugs: Fix reporting of LFENCE retpoline +- x86/bugs: Report correct retbleed mitigation status +- perf: Skip user unwind if the task is a kernel thread +- perf: Have get_perf_callchain() return NULL if crosstask and user are set +- perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL +- audit: record fanotify event regardless of presence of rules +- sched/topology,x86: Fix build warning +- sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode +- sched: Create architecture specific sched domain distances + +* Wed Mar 18 2026 zhangqiumiao <zhangqiumiao1@h-partners.com> - 6.6.0-143.0.0.129 +- fix build failure with 64K page + +* Wed Mar 18 2026 Li Nan <linan122@huawei.com> - 6.6.0-143.0.0.128 +- !21258 ub:hisi-ubus: Review of Readability Modifications +- !21293 urma: update urma_admin agg expose flag +- urma: update urma_admin agg expose +- !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches +- !21270 l2tp: fix double dst_release() on sk_dst_cache race +- !21272 mptcp: fix soft lockup in mptcp_recvmsg() +- !20994 urma: support comm endpoint +- !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' +- !21271 urma: fix useless copy_logic_device and use expose instead. +- urma: support non-root execute in containers +- urma: fix useless copy_logic_device and use expose instead. +- ub:hisi-ubus: Review of Readability Modifications +- mptcp: fix soft lockup in mptcp_recvmsg() +- mptcp: fix MSG_PEEK stream corruption +- l2tp: fix double dst_release() on sk_dst_cache race +- urma: update urma_admin agg expose +- !21252 arm64: Set __nocfi on swsusp_arch_resume() +- !21226 hisi-cca-da: Fix potential data overflow. +- !19706 [OLK-6.6]:update patches for sw64 architecture +- !21253 xattr: switch to CLASS(fd) +- !21255 ub: cdma: cdma bug fix +- !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq +- ub: cdma: cdma bug fix +- xattr: switch to CLASS(fd) +- arm64: Set __nocfi on swsusp_arch_resume() +- hisi-cca-da: Fix error where multiple devices share the same SMMU domain. +- net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq +- net/ipv4:scmtcp: fix panic caused by file_htable_del_flist +- !21237 urma: change warn log into info for topo query +- hisi-cca-da: Fix potential data overflow. +- !21210 urma: fix tjetty tp type in ping server +- !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() +- !21240 urma: update urma_admin agg expose +- !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS +- urma: update urma_admin agg expose +- net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS +- !21238 urma: delete ubcm_genl implementation +- urma: delete ubcm_genl implementation +- urma: change warn log into info for topo query +- tcpm: allow looking for role_sw device in the main node +- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE +- most: usb: fix double free on late probe failure +- arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation +- net: enetc: fix build warning when PAGE_SIZE is greater than 128K +- gpio: ljca: Initialize num before accessing item in ljca_gpio_config +- s390/cio: Update purge function to unregister the unused subchannels +- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID +- xfs: always warn about deprecated mount options +- devcoredump: Fix circular locking dependency with devcd->mutex. +- serial: 8250_mtk: Enable baud clock and manage in runtime PM +- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 +- serial: 8250_dw: handle reset control deassert error +- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp +- tcpm: switch check for role_sw device with fw_node +- most: usb: hdm_probe: Fix calling put_device() before device initialization +- most: usb: Fix use-after-free in hdm_disconnect +- mei: me: add wildcat lake P DID +- comedi: fix divide-by-zero in comedi_buf_munge() +- binder: remove "invalid inc weak" check +- x86/microcode: Fix Entrysign revision check for Zen1/Naples +- xhci: dbc: enable back DbC in resume if it was enabled before suspend +- usb: raw-gadget: do not limit transfer length +- usb/core/quirks: Add Huawei ME906S to wakeup quirk +- USB: serial: option: add Telit FN920C04 ECM compositions +- USB: serial: option: add Quectel RG255C +- USB: serial: option: add UNISOC UIS7720 +- sched: Remove never used code in mm_cid_get() +- io_uring: correct __must_hold annotation in io_install_fixed_file +- gpio: ljca: Fix duplicated IRQ mapping +- gpio: update Intel LJCA USB GPIO driver +- hwmon: (sht3x) Fix error handling +- RISC-V: Don't print details of CPUs disabled in DT +- RISC-V: Define pgprot_dmacoherent() for non-coherent devices +- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode +- spi: spi-nxp-fspi: add extra delay after dll locked +- selftests: mptcp: join: mark implicit tests as skipped if not supported +- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported +- net: ravb: Ensure memory write completes before ringing TX doorbell +- net: ravb: Enforce descriptor type ordering +- net: usb: rtl8150: Fix frame padding +- net: stmmac: dwmac-rk: Fix disabling set_clock_selection +- ocfs2: clear extent cache after moving/defragmenting extents +- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering +- cifs: Fix TCP_Server_Info::credits to be signed +- gpio: 104-idio-16: Define maximum valid register address offset +- gpio: pci-idio-16: Define maximum valid register address offset +- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC +- net: bonding: fix possible peer notify event loss or dup issue +- arm64, mm: avoid always making PTE dirty in pte_mkwrite() +- !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling +- KVM: arm64: Fix CCA guest panic when dvmbm is enabled +- !21228 ub:ubus: add reset function +- !21220 selftests/bpf: Add cross-build support for urandom_read et al +- !21214 optimize lightweight load balancing +- ub:ubus: add reset function +- !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios +- !21221 iommu/ummu: Modify the ummu/tid permission +- selftests: net: fix server bind failure in sctp_vrf.sh +- selftests/net: convert sctp_vrf.sh to run it in unique namespace +- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() +- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path +- net: enetc: correct the value of ENETC_RXB_TRUESIZE +- net: enetc: fix the deadlock of enetc_mdio_lock +- net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). +- rtnetlink: Allow deleting FDB entries in user namespace +- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() +- Unbreak 'make tools/*' for user-space targets +- smb: server: let smb_direct_flush_send_list() invalidate a remote key first +- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure +- m68k: bitops: Fix find_*_bit() signatures +- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure +- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() +- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() +- dlm: check for defined force value in dlm_lockspace_release +- hfs: validate record offset in hfsplus_bmap_alloc +- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() +- hfs: make proper initalization of struct hfs_find_data +- hfs: clear offset and space out of valid records in b-tree node +- nios2: ensure that memblock.current_limit is set when setting pfn limits +- exec: Fix incorrect type for ret +- !21222 ub: ubase: Added the interface for obtaining hardware version information +- !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing +- !21216 Fix RT priority Setting +- arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() +- iommu/ummu: Modify the ummu/tid permission +- ub: ubase&unic: Optimize the code for log information +- ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long +- ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset +- ub:ub_fwctl:Add a mutex lock +- ub:ub_fwctl:Add interception and validation for unsupported environment commands +- ub: ubase: Added the interface for obtaining hardware version information. +- selftests/bpf: Add cross-build support for urandom_read et al +- !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" +- !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled +- !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches +- Revert "drivers: core: synchronize really_probe() and dev_uevent()" +- !21213 ub:ubus: alter nl ssu credit ras recover +- iommu/ummu: Optimize the duplicate code +- xsched: initialize tgid before configuring RT priority +- xsched: fix typo in xcu cgroup subsys released callback name +- xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness +- sched: expand sysctl_sched_features to unsigned long +- sched: Fix kabi breakage of struct sched_domain for newidle_stats +- sched/fair: Proportional newidle balance +- ub:ubus: alter nl ssu credit ras recover +- ub:ubus add some missing code to openeuler +- change bus instance create EID_BYPASS +- urma: fix tjetty tp type in ping server +- iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' +- iommu/ummu: Delete the unused interface of the UMMU +- arm64/mpam: Fix wrong closid config access when CDP is enabled +- Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" +- iommu/ummu: Remove the constraint that l_tid must be valid +- iommu/ummu: Remove redundant read register operations +- iommu/ummu: Optimize the UMMU instance matching logic +- iommu/ummu: Improve the reliability of ummu initialization +- iommu/ummu: Modify parameter for separated page table +- drm/amd: Fix suspend failure with secure display TA +- PCI: tegra194: Reset BARs when running in PCIe endpoint mode +- PCI: j721e: Fix programming sequence of "strap" settings +- PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists +- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL +- PCI/sysfs: Ensure devices are powered for config reads (part 2) +- nfsd: decouple the xprtsec policy check from check_nfsd_access() +- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine +- xfs: use deferred intent items for reaping crosslinked blocks +- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended +- iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure +- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling +- phy: cdns-dphy: Store hs_clk_rate and return it +- iio: imu: inv_icm42600: Simplify pm_runtime setup +- PM: runtime: Add new devm functions +- xfs: fix log CRC mismatches between i386 and other architectures +- xfs: rename the old_crc variable in xlog_recover_process +- NFSD: Fix last write offset handling in layoutcommit +- NFSD: Minor cleanup in layoutcommit processing +- NFSD: Rework encoding and decoding of nfsd4_deviceid +- nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() +- block: fix race between set_blocksize and read paths +- arm64: errata: Apply workarounds for Neoverse-V3AE +- arm64: cputype: Add Neoverse-V3AE definitions +- selftests: arg_parsing: Ensure data is flushed to disk before reading. +- HID: multitouch: fix name of Stylus input devices +- HID: hid-input: only ignore 0 battery events for digitizers +- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card +- selftests/bpf: make arg_parsing.c more robust to crashes +- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings +- drm/rockchip: vop2: use correct destination rectangle height check +- drm/amd/powerplay: Fix CIK shutdown temperature +- drm/i915/guc: Skip communication warning on reset in progress +- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit +- ASoC: nau8821: Generalize helper to clear IRQ status +- ASoC: nau8821: Cancel jdet_work before handling jack ejection +- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec +- drm/bridge: lt9211: Drop check for last nibble of version register +- riscv: kprobes: Fix probe address validation +- nvme-multipath: Skip nr_active increments in RETRY disposition +- net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset +- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address +- tls: don't rely on tx_work during send() +- tls: always set record_type in tls_process_cmsg +- tls: wait for async encrypt in case of error during latter iterations of sendmsg +- net: tls: wait for async completion on last message +- tls: trim encrypted message to match the plaintext on short splice +- tg3: prevent use of uninitialized remote_adv and local_adv variables +- tcp: fix tcp_tso_should_defer() vs large RTT +- amd-xgbe: Avoid spurious link down messages during interface toggle +- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H +- doc: fix seg6_flowlabel path +- net: dlink: handle dma_map_single() failure properly +- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() +- dax: skip read lock assertion for read-only filesystems +- HID: multitouch: fix sticky fingers +- usb: gadget: f_rndis: Refactor bind path to use __free() +- usb: gadget: f_ncm: Refactor bind path to use __free() +- usb: gadget: f_acm: Refactor bind path to use __free() +- usb: gadget: f_ecm: Refactor bind path to use __free() +- usb: gadget: Introduce free_usb_request helper +- usb: gadget: Store endpoint pointer in usb_request +- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release +- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() +- drm/exynos: exynos7_drm_decon: remove ctx->suspended +- drm/exynos: exynos7_drm_decon: properly clear channels during bind +- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions +- drm/msm/a6xx: Fix PDC sleep sequence +- drm/msm/adreno: De-spaghettify the use of memory barriers +- eventpoll: Replace rwlock with spinlock +- epoll: Remove ep_scan_ready_list() in comments +- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 +- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay +- drm/amd: Check whether secure display TA loaded successfully +- drm/amdgpu: use atomic functions with memory barriers for vm fault info +- cifs: parse_dfs_referrals: prevent oob on malformed input +- can: gs_usb: increase max interface to U8_MAX +- can: gs_usb: gs_make_candev(): populate net_device->dev_port +- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running +- ext4: wait for ongoing I/O to complete before freeing blocks +- jbd2: ensure that all ongoing I/O complete before freeing blocks +- f2fs: fix wrong block mapping for multi-devices +- r8152: add error handling in rtl8152_driver_init +- sw64: ebpf: port arch_prepare_bpf_trampoline() +- sw64: fix random mmap base range +- sw64: paravirt: add pv steal_time support in guest side +- sw64: kvm: add pv steal time support +- sw64: pci: remove redundant debug control + +* Thu Mar 12 2026 Li Nan <linan122@huawei.com> - 6.6.0-142.0.0.127 +- !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. +- !21192 urma: bugfix of ubagg&ubcore&uburma +- !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks +- urma: bugfix of ubagg&ubcore&uburma +- hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. +- platform/x86: classmate-laptop: Add missing NULL pointer checks +- !21167 urma: fix kernel codecheck issues. +- !21174 urma: change return value for provider err +- !21127 urma: copy linked ports when importing bond jetty/seg +- !20247 ubcore: query primary eid in ipourma loopback mode. +- !21077 Fix hisi cca bugs +- ubcore: route query refine and ipo loopback adapt. +- hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. +- hisi-cca-da: Write NS STE for PF drivers. +- hisi-cca-da: Provide IO interfaces +- hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices +- !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() +- hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. +- !21165 tools/interference: add ifstool utility for kernel interference statistics +- !21166 urma: fix jfce uaf in batch cleanup +- !21043 urma: fix tjetty ref in ping server +- urma: change return value for provider err +- !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() +- !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() +- urma: fix jfce uaf in batch cleanup +- !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver +- !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches +- urma: fix kernel codecheck issues. +- tools/interference: add ifstool utility for kernel interference statistics +- !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor +- !21092 kexec: derive purgatory entry from symbol +- !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 +- !21153 fix CVE-2025-39981 +- Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" +- urma: fix tjetty ref in ping server +- rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA +- hisi-cca-da: Improve hisi cca dev validate and delegate +- hisi-cca-da: Fix smmu enable rme problem +- hisi-cca-da: Fix msi region shared problem +- sched: Add SOFT_DOMAIN feature interface for cgroup2 +- Bluetooth: MGMT: Fix memory leak in set_ssp_complete +- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete +- overflow: Introduce __DEFINE_FLEX for having no initializer +- overflow: Fix direct struct member initialization in _DEFINE_FLEX() +- overflow: Change DEFINE_FLEX to take __counted_by member +- overflow: add DEFINE_FLEX() for on-stack allocs +- Bluetooth: MGMT: Fix possible UAFs +- Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() +- !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" +- !21104 v2 vsock/virtio: cap TX credit to local buffer size +- !21070 Fixes CVE-2026-23100 +- !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs +- !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref +- RDMA/hns: Support configure and query the CNP DSCP through sysfs +- RDMA/hns: Support query FW cap bit +- RDMA/hns: Support query HW ID. +- !20934 smb/server: fix refcount leak in parse_durable_handle_context() +- !21004 regmap: Fix race condition in hwspinlock irqsave routine +- !19568 [OLK-6.6]fix txgbe clang compile warning +- urma: copy linked ports when importing bond jetty/seg +- procfs: fix missing RCU protection when reading real_parent in do_task_stat() +- sched/rt: Skip currently executing CPU in rto_next_cpu() +- !21073 scsi: qla2xxx: Fix bsg_done() causing double free +- !21114 CVE-2024-57979 +- !21113 iommu: disable SVA when CONFIG_X86 is set +- !20957 dmaengine: xilinx: xdma: Fix regmap max_register +- !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset +- pps: Fix a use-after-free - fix kabi +- pps: Fix a use-after-free +- !21078 of: unittest: Fix memory leak in unittest_data_add() +- !21079 *** fix CVE-2026-23208 *** +- !21082 ALSA: aloop: Fix racy access at PCM trigger +- !21083 bus: fsl-mc: fix use-after-free in driver_override_show() +- iommu: disable SVA when CONFIG_X86 is set +- vsock/virtio: cap TX credit to local buffer size +- Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" +- !20983 Fix CVE-2026-23139 +- !20878 Fix CVE-2026-23230 +- kexec: derive purgatory entry from symbol +- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC +- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug +- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" +- rtc: interface: Alarm race handling should not discard preceding error +- perf test stat tests: Fix for virtualized machines +- perf test stat: Update test expectations and events +- perf test stat: Avoid hybrid assumption when virtualized +- writeback: Avoid excessively long inode switching times +- writeback: Avoid softlockup when switching many inodes +- cramfs: Verify inode mode when loading from disk +- fs: Add 'initramfs_options' to set initramfs mount options +- minixfs: Verify inode mode when loading from disk +- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume +- irqchip/sifive-plic: Make use of __assign_bit() +- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled +- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG +- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL +- s390/bpf: Describe the frame using a struct instead of constants +- s390/bpf: Centralize frame offset calculations +- s390/bpf: Change seen_reg to a mask +- ACPI: property: Do not pass NULL handles to acpi_attach_data() +- ACPI: property: Add code comments explaining what is going on +- ACPI: property: Disregard references in data-only subnode lists +- ACPI: battery: Add synchronization between interface updates +- ACPI: battery: Check for error code from devm_mutex_init() call +- ACPI: battery: initialize mutexes through devm_ APIs +- ACPI: battery: allocate driver data through devm_ APIs +- arm64: mte: Do not flag the zero page as PG_mte_tagged +- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref +- !20790 dm: use bio_clone_blkg_association +- ipmi: Add HiSilicon IPMI Page Soft Offline driver +- net: unic: Resolve network unavailability caused by concurrent activation and reset +- net: unic: Provide the DFX capability for querying MNG table +- net: unic: Delete the elr reset process after the tx timeout +- bus: fsl-mc: fix use-after-free in driver_override_show() +- ALSA: aloop: Fix racy access at PCM trigger +- ALSA: usb-audio: Use the right limit for PCM OOB check +- ALSA: usb-audio: Prevent excessive number of frames +- of: unittest: Fix memory leak in unittest_data_add() +- !21034 CVE-2026-23140 +- !21016 net: fix segmentation of forwarding fraglist GRO +- !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() +- !21018 CVE-2026-23209 +- !21019 ipv6: annotate data-race in ndisc_router_discovery() +- !20881 ipvlan: Make the addrs_lock be per port +- rme: Imporve range delegate +- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() +- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release +- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() +- misc: fastrpc: Save actual DMA size in fastrpc_map structure +- misc: fastrpc: Add missing dev_err newlines +- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag +- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type +- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value +- media: mc: Clear minor number before put device +- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older +- ACPICA: Allow to skip Global Lock initialization +- ext4: validate ea_ino and size in check_xattrs +- ext4: correctly handle queries for metadata mappings +- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() +- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry +- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() +- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success +- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 +- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations +- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 +- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again +- selftests: mptcp: join: validate C-flag + def limit +- spi: cadence-quadspi: Flush posted register writes before DAC access +- spi: cadence-quadspi: Flush posted register writes before INDAC access +- PCI: tegra194: Handle errors in BPMP response +- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() +- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock +- PCI: rcar-host: Drop PMSR spinlock +- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit +- PCI/AER: Support errors introduced by PCIe r6.0 +- PCI/AER: Fix missing uevent on recovery when a reset is requested +- PCI/ERR: Fix uevent on failure to recover +- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV +- PCI/sysfs: Ensure devices are powered for config reads +- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock +- rseq/selftests: Use weak symbol reference, not definition, to link with glibc +- rtc: interface: Fix long-standing race when setting alarm +- rtc: interface: Ensure alarm irq is enabled when UIE is enabled +- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe +- mmc: core: SPI mode remove cmd7 +- mtd: rawnand: fsmc: Default to autodetect buswidth +- xtensa: simdisk: add input size check in proc_write_simdisk +- sparc: fix error handling in scan_one_device() +- sparc64: fix hugetlb for sun4u +- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() +- sched/deadline: Fix race in push_dl_task() +- pwm: berlin: Fix wrong register in suspend/resume +- powerpc/pseries/msi: Fix potential underflow and leak issue +- powerpc/powernv/pci: Fix underflow and leak issue +- power: supply: max77976_charger: fix constant current reporting +- pinctrl: samsung: Drop unused S3C24xx driver data +- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk +- parisc: don't reference obsolete termio struct for TC* constants +- openat2: don't trigger automounts with RESOLVE_NO_XDEV +- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify +- lib/genalloc: fix device leak in of_gen_pool_get() +- KEYS: trusted_tpm1: Compare HMAC values in constant time +- iommu/vt-d: PRS isn't usable if PDS isn't supported +- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume +- init: handle bootloader identifier in kernel parameters +- iio: xilinx-ams: Unmask interrupts after updating alarms +- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK +- iio: frequency: adf4350: Fix prescaler usage. +- iio: dac: ad5421: use int type to store negative error codes +- iio: dac: ad5360: use int type to store negative error codes +- fs/ntfs3: Fix a resource leak bug in wnd_extend() +- fbdev: Fix logic error in "offb" name match +- crypto: rockchip - Fix dma_unmap_sg() nents value +- crypto: atmel - Fix dma_unmap_sg() direction +- crypto: aspeed - Fix dma_unmap_sg() direction +- copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) +- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() +- bus: mhi: ep: Fix chained transfer handling in read path +- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() +- blk-crypto: fix missing blktrace bio split events +- drm/nouveau: fix bad ret code in nouveau_bo_move_prep +- drm/rcar-du: dsi: Fix 1/2/3 lane support +- media: lirc: Fix error handling in lirc_register() +- media: venus: firmware: Use correct reset sequence for IRIS2 +- media: pci: ivtv: Add missing check after DMA map +- media: mc: Fix MUST_CONNECT handling for pads with no links +- media: i2c: mt9v111: fix incorrect type for ret +- media: cx18: Add missing check after DMA map +- firmware: meson_sm: fix device leak at probe +- xen/events: Update virq_to_irq on migration +- xen/events: Return -EEXIST for bound VIRQs +- xen/manage: Fix suspend error path +- xen/events: Cleanup find_virq() return codes +- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required +- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init +- arm64: dts: ti: k3-am62a-main: Fix main padcfg length +- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees +- arm64: dts: qcom: msm8939: Add missing MDSS reset +- arm64: dts: qcom: msm8916: Add missing MDSS reset +- ACPI: debug: fix signedness issues in read/write helpers +- ACPI: property: Fix buffer properties extraction for subnodes +- gpio: wcd934x: mark the GPIO controller as sleeping +- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single +- smb: client: fix missing timestamp updates after utime(2) +- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() +- drm/amd/display: Properly disable scaling on DCE6 +- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 +- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs +- drm/amdgpu: Add additional DCE6 SCL registers +- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes +- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call +- tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() +- perf python: split Clang options when invoking Popen +- tools build: Align warning options with perf +- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe +- drm/vmwgfx: Fix copy-paste typo in validation +- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() +- LoongArch: Init acpi_gbl_use_global_lock to false +- LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() +- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size +- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue +- clk: tegra: do not overallocate memory for bpmp clocks +- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver +- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() +- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() +- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m +- perf evsel: Ensure the fallback message is always written to +- perf tools: Add fallback for exclude_guest +- perf test: Add a test for default perf stat command +- perf test: Don't leak workload gopipe in PERF_RECORD_* +- perf session: Fix handling when buffer exceeds 2 GiB +- perf arm_spe: Correct memory level for remote access +- perf arm_spe: Correct setting remote access +- rtc: optee: fix memory leak on driver removal +- rtc: x1205: Fix Xicor X1205 vendor prefix +- perf util: Fix compression checks returning -1 as bool +- clk: at91: peripheral: fix return value +- libperf event: Ensure tracing data is multiple of 8 sized +- perf evsel: Avoid container_of on a NULL leader +- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled +- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE +- clocksource/drivers/clps711x: Fix resource leaks in error paths +- fscontext: do not consume log entries when returning -EMSGSIZE +- fs: always return zero on success from replace_fd() +- !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches +- scsi: qla2xxx: Fix bsg_done() causing double free +- !21065 Fix CVE-2026-23069 +- !21062 v4 Support multi-level cgroup +- !20987 Fix CVE-2026-23212 +- !20982 Fix CVE-2026-23119 +- !20979 Fix CVE-2026-23111 +- !20974 Fix CVE-2026-23099 +- !20973 Fix CVE-2026-23105 +- !20972 Fix CVE-2026-23074 +- !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray +- !20947 Fix CVE-2026-23101 +- ext4: clear i_state_flags when alloc inode +- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup +- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" +- fs/ntfs3: fix mount failure for sparse runs in run_unpack() +- !20825 efivarfs: fix error propagation in efivar_entry_get() +- !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop +- !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem +- mm/rmap: fix two comments related to huge_pmd_unshare() +- mm/hugetlb: fix two comments related to huge_pmd_unshare() +- mm/hugetlb: fix hugetlb_pmd_shared() +- mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count +- !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers +- vsock/virtio: fix potential underflow in virtio_transport_get_credit() +- !21001 Fix CVE-2026-23229 +- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call +- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode +- !20999 Fix CVE-2026-23173 +- usb: typec: tipd: Clear interrupts first +- bus: fsl-mc: Check return value of platform_get_resource() +- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() +- Input: atmel_mxt_ts - allow reset GPIO to sleep +- misc: fastrpc: Skip reference for DMA handles +- misc: fastrpc: fix possible map leak in fastrpc_put_args +- misc: fastrpc: Fix fastrpc_map_lookup operation +- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() +- ext4: fix checks for orphan inodes +- ksmbd: fix error code overwriting in smb2_get_info_filesystem() +- LoongArch: Automatically disable kaslr if boot from kexec_file +- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() +- mfd: rz-mtu3: Fix MTU5 NFCR register offset +- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down +- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() +- vhost: vringh: Modify the return value check +- net/mlx5: fw reset, add reset timeout work +- net/mlx5: pagealloc: Fix reclaim race during command interface teardown +- net/mlx5: Stop polling for command response if interface goes down +- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable +- nfp: fix RSS hash key size when RSS is not supported +- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands +- drivers/base/node: fix double free in register_one_node() +- hwrng: ks-sa - fix division by zero in ks_sa_rng_init +- KEYS: X.509: Fix Basic Constraints CA flag parsing +- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements +- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO +- vhost: vringh: Fix copy_to_iter return value check +- RDMA/siw: Always report immediate post SQ errors +- usb: vhci-hcd: Prevent suspending virtually attached devices +- NFSv4.1: fix backchannel max_resp_sz verification check +- coresight: trbe: Return NULL pointer for allocation failures +- coresight: etm4x: Support atclk +- coresight-etm4x: Conditionally access register TRCEXTINSELR +- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice +- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() +- vfio/pds: replace bitmap_free with vfree +- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 +- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 +- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara +- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III +- wifi: mac80211: fix Rx packet handling when pubsta information is not available +- wifi: ath10k: avoid unnecessary wait for service ready message +- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram +- IB/sa: Fix sa_local_svc_timeout_ms read race +- RDMA/core: Resolve MAC of next-hop device without ARP support +- f2fs: fix zero-sized extent for precache extents +- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() +- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() +- scsi: qla2xxx: edif: Fix incorrect sign of error code +- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message +- f2fs: fix to truncate first page in error path of f2fs_truncate() +- f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() +- wifi: mt76: fix potential memory leak in mt76_wmac_probe() +- RDMA/cm: Rate limit destroy CM ID timeout error message +- drivers/base/node: handle error properly in register_one_node() +- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog +- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable +- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() +- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() +- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist +- fs: ntfs3: Fix integer overflow in run_unpack() +- drm/msm/dpu: fix incorrect type for ret +- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping +- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping +- misc: genwqe: Fix incorrect cmd field being reported in error +- usb: gadget: configfs: Correctly set use_os_string at bind +- usb: phy: twl6030: Fix incorrect type for ret +- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() +- tcp: fix __tcp_close() to only send RST when required +- PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation +- wifi: mwifiex: send world regulatory domain to driver +- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) +- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) +- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) +- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) +- drm/amd/pm: Fix si_upload_smc_data (v3) +- drm/amd/pm: Disable ULV even if unsupported (v3) +- drm/amdgpu: Power up UVD 3 for FW validation (v2) +- coresight: Only register perf symlink for sinks with alloc_buffer +- inet: ping: check sock_net() in ping_get_port() and ping_lookup() +- media: st-delta: avoid excessive stack usage +- ALSA: lx_core: use int type to store negative error codes +- media: rj54n1cb0c: Fix memleak in rj54n1_probe() +- scsi: myrs: Fix dma_alloc_coherent() error check +- hwrng: nomadik - add ARM_AMBA dependency +- crypto: keembay - Add missing check after sg_nents_for_len() +- drm/amd/display: Remove redundant semicolons +- serial: max310x: Add error checking in probe() +- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls +- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup +- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 +- media: zoran: Remove zoran_fh structure +- drm/bridge: it6505: select REGMAP_I2C +- f2fs: fix condition in __allow_reserved_blocks() +- drm/radeon/r600_cs: clean up of dead code in r600_cs +- drm/panel: novatek-nt35560: Fix invalid return value +- bpf: Enforce expected_attach_type for tailcall compatibility +- i2c: designware: Add disabling clocks when probe fails +- i2c: designware: Fix clock issue when PM is disabled +- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD +- thermal/drivers/qcom/lmh: Add missing IRQ includes +- thermal/drivers/qcom: Make LMH select QCOM_SCM +- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems +- once: fix race by moving DO_ONCE to separate section +- smp: Fix up and expand the smp_call_function_many() kerneldoc +- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported +- i3c: master: svc: Recycle unused IBI slot +- i3c: master: svc: Use manual response for IBI events +- ACPICA: Fix largest possible resource descriptor index +- pwm: tiehrpwm: Fix corner case in clock divisor calculation +- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible +- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value +- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names +- cpuidle: qcom-spm: fix device and OF node leaks at probe +- firmware: firmware: meson-sm: fix compile-test default +- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 +- null_blk: Fix the description of the cache_size module argument +- pinctrl: renesas: Use int type to store negative error codes +- power: supply: cw2015: Fix a alignment coding style issue +- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() +- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property +- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS +- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax +- block: use int to store blk_stack_limits() return value +- selftests/nolibc: fix EXPECT_NZ macro +- regulator: scmi: Use int type to store negative error codes +- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map +- ARM: at91: pm: fix MCKx restore routine +- pinctrl: meson-gxl: add missing i2c_d pinmux +- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS +- leds: flash: leds-qcom-flash: Update torch current clamp setting +- ARM: dts: renesas: porter: Fix CAN pin group +- libbpf: Fix reuse of DEVMAP +- bpf: Remove migrate_disable in kprobe_multi_link_prog_run +- bpf/selftests: Fix test_tcpnotify_user +- regmap: Remove superfluous check for !config in __regmap_init() +- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 +- x86/vdso: Fix output operand size of RDPID +- smb: server: fix IRD/ORD negotiation with the client +- coresight: trbe: Prevent overflow in PERF_IDX2OFF() +- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote +- selftests: arm64: Check fread return value in exec_target +- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast +- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD +- filelock: add FL_RECLAIM to show_fl_flags() macro +- !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd +- !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() +- !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() +- xsched: fix potential NULL dereference in xsched_quota_timeout_update +- xsched: remove the standalone xcu_cfs_cg_deinit() helper +- xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle +- xsched: simplify root group check by direct comparison with root_xcg +- xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length +- xsched/core: immediate cleanup of remaining operators on task exit +- xsched: add init_fair_xsched_group() for XCU-specific fair group initialization +- xsched: modify xcu_cg_initialize_components helper +- xsched: refactor xsched_entity initialization +- xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq +- xsched: harden and clarify xcu_move_task() logic +- xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs +- xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling +- xsched/quota: support multi-level cgroup +- xsched: remove redundant xcu parameter from dequeue_ctx +- xsched: update group shares using xcu_grp_shares_add/sub helpers +- xsched: delete unused code +- xsched/cfs: propagate group activation/deactivation up the hierarchy +- xsched/cfs: move xruntime updates to pick/put paths +- xsched: add has_running hook to xsched classes for wake-up eligibility check +- !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches +- scsi: hisi_sas: Fix NULL pointer exception when do user_scan() +- !21013 CVE-2026-23177 +- !21007 bonding: fix use-after-free due to enslave fail after slave array update +- !21006 net: Fix CVE-2026-23204 +- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path +- bpf, test_run: Subtract size of xdp_frame from allowed metadata size +- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN +- bpf: Make variables in bpf_prog_test_run_xdp less confusing +- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K +- !21015 libceph: reset sparse-read state in osd_fault() +- !21024 ub: udma: bugfix related to print messages. +- !20980 Fix CVE-2026-23126 +- !20922 Fix CVE-2026-23133 +- ub: udma: bugfix related to print messages. +- l2tp: avoid one data-race in l2tp_tunnel_del_work() +- KVM: Don't clobber irqfd routing type when deassigning irqfd +- ipv6: annotate data-race in ndisc_router_discovery() +- macvlan: observe an RCU grace period in macvlan_common_newlink() error path +- macvlan: fix error recovery in macvlan_common_newlink() +- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() +- net: fix segmentation of forwarding fraglist GRO +- can: rcar_canfd: Fix CAN-FD mode as default +- libceph: reset sparse-read state in osd_fault() +- !21008 uvb: fix cis call return value and obtain +- mm, shmem: prevent infinite loop on truncate race +- mm/shmem, swap: fix race of truncate and swap entry split +- net/9p: fix double req put in p9_fd_cancelled +- riscv: mm: Do not restrict mmap address based on hint +- riscv: mm: Use hint address in mmap if available +- driver core/PM: Set power.no_callbacks along with power.no_pm +- serial: stm32: allow selecting console when the driver is module +- hid: fix I2C read buffer overflow in raw_event() for mcp2221 +- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free +- ALSA: usb-audio: Kill timer properly at removal +- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list +- can: rcar_canfd: Fix controller mode setting +- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled +- btrfs: ref-verify: handle damaged extent root tree +- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue +- perf subcmd: avoid crash in exclude_cmds when excludes is empty +- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list +- dm-integrity: limit MAX_TAG_SIZE to 255 +- ASoC: amd: acp: Adjust pdm gain value +- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 +- USB: serial: option: add SIMCom 8230C compositions +- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe +- !20931 Fix CVE-2026-23060 +- uvb: fix cis call return value and obtain +- bonding: fix use-after-free due to enslave fail after slave array update +- net/sched: cls_u32: use skb_header_pointer_careful() +- net: add skb_header_pointer_careful() helper +- regmap: Fix race condition in hwspinlock irqsave routine +- crypto: virtio - Add spinlock protection with virtqueue notification +- net/mlx5e: TC, delete flows only for existing peers +- !20967 net: hns3: modify code of judging if SMMU DMA is enabled +- ceph: fix oops due to invalid pointer for kfree() in parse_longname() +- !20969 Fix CVE-2026-23125 +- !20948 v4 arm64: Add memory poison recovery support for various paths +- !20975 CVE-2026-23102 +- !20977 v4 support apei_page_offline_policy +- bonding: annotate data-races around slave->last_rx +- netfilter: nf_conncount: update last_gc only when GC has been performed +- bonding: provide a net pointer to __skb_flow_dissect() +- netdevsim: fix a race issue related to the operation on bpf_bound_progs list +- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() +- apei/ghes: Add sysctl interface to control soft-offline page isolation +- Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" +- crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec +- arm64/fpsimd: signal: Fix restoration of SVE context +- arm64/fpsimd: signal: Consistently read FPSIMD context +- arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state +- bonding: limit BOND_MODE_8023AD to Ethernet devices +- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag +- net/sched: Enforce that teql can only be used as root qdisc +- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT +- drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers +- net: hns3: modify code of judging if SMMU DMA is enabled +- dmaengine: xilinx: xdma: Fix regmap max_register +- ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem +- ub:ubus: Avoid getting empty uent from ubc +- ub:hisi-ubus: Use GFP_ATOMIC when alloc memory +- arm64: send sig fault for user task when apei_claim_sea fails +- arm64: add ras log during do_sea +- arm64: move getting valid siaddr to the top of do_sea +- arm64: mm: shmem: support poison recovery from shmem_file_read_iter() +- arm64: fs: support poison recovery from __kernel_read() +- iov_iter: add mc support for copy_page_to_iter +- arm64: mm: support recovery from copy_{from/to}_user_page() +- iov_iter: get rid of 'copy_mc' flag +- leds: led-class: Only Add LED to leds_list when it is fully ready +- wifi: ath10k: fix dma_free_coherent() pointer +- smb/server: fix refcount leak in parse_durable_handle_context() +- ksmbd: add chann_lock to protect ksmbd_chann_list xarray +- ipvlan: Make the addrs_lock be per port +- smb: client: split cached_fid bitfields to avoid shared-byte RMW races +- efivarfs: fix error propagation in efivar_entry_get() +- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop +- dm: use bio_clone_blkg_association +- RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor +- net: txgbe: fix clang compile warning + +* Tue Mar 10 2026 wuzx<wuzx1226@qq.com> - 6.6.0-141.0.0.126 +- Add sw64 support in kernel.spec + +* Wed Mar 04 2026 Li Nan <linan122@huawei.com> - 6.6.0-141.0.0.125 +- !20704 kernel support hisi-cca-da +- !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration +- !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence +- !20965 iommu/ummu: Optimized TID invalidation and tdev initialization +- !20964 iommu/ummu: Support TID and EID Granularity for MPAM +- !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver +- hisi-cca-da: Start dev by rsi call +- hisi-cca-da: Set ripas of the bar region as RIPAS_DEV +- hisi-cca-da: Support swiotlb and realm memory use +- hisi-cca-da: Add smmu info when dev attach +- hisi-cca-da: Transfer realm msix access to rmm +- hisi-cca-da: Support pcipc sriov capability +- hisi-cca-da: Delay realm memory release to kvm_destroy_realm +- hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm +- hisi-cca-da: Add cca realm s2 pgtable framework +- hisi-cca-da: Use bitmap to determine whether the command can be forwarded +- hisi-cca-da: Restrict Realm SMMU to stage-2 domain only +- hisi-cca-da: Add cmd forward mechanism in realm smmu +- hisi-cca-da: Add realm smmu event and gerror irq initialization +- hisi-cca-da: Add realm smmu stream table initialization +- hisi-cca-da: Add realm smmu cmdq and evtq initialization +- hisi-cca-da: Add realm smmu initialization +- hisi-cca-da: Add relam iommu support to iommufd +- hisi-cca-da: Add realm iommu support for vfio-iommu-type1 +- hisi-cca-da: Support dev map and unmap +- hisi-cca-da: Support dev validate and dev start +- hisi-cca-da: VFIO support ccada +- hisi-cca-da: Support dev delegate and dev attach +- hisi-cca-da: Support root dev delegate and dev init +- hisi-cca-da: Add hisilicon extension smc and ccada cmd +- hisi-cca-da: Add hisi ccada feature config +- !20751 ARM CCA supports hugepage +- !20944 ub: ubmempfd: supports for D2H mapping and demapping +- !20888 HiSock Enhancement +- ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. +- net: unic: Resolve the residual MAC address problem +- net: unic: Optimized the code for the cmd structure and FEC function. +- ub: ubase: add log for post mailbox timeout +- ub: ubus: Remove black box header file to include dir +- rme: Remove the secret bit of the vring desc addr +- rme: improve hisi-cca data mmap and destroy method +- !20943 uvb: fix wd_obtain logic err +- !20942 urma: fix bond device id not release +- !20892 dcache: Limit the minimal number of bucket to two +- rme: isolate page when do delegation to avoid migration +- rme: hisi-cca supports different levels for mapping ram +- rme: rename ccal to hisi-cca +- rme: support set ripas for ccal realm vm +- rme: support destroy ram data for ccal realm vm +- rme: support populate region for ccal realm vm +- rme: support map ram for ccal realm vm +- rme: support config ccal realm vm +- rme: support ccal RMI calls +- rme: realm vm supports wfx handler +- !20952 urma: introduce ipourma module +- iommu/ummu-core: Simplifies tdev initialization resources +- iommu/ummu: Optimized log printing +- iommu/ummu: Use passed gfp_mask in map_pages callback +- uvb: fix wd_obtain logic err +- !20949 ub: udma: support user ctl function. +- urma: fix bond device id not release +- !20901 drivers/ub/sentry: some bugfix +- ub: ubmempfd: supports for D2H mapping and demapping +- ub: ubmempfd: supports providing services to the QEMU process through file nodes +- [virtCCA Live Migration 2]virtcca secure cvm supports live migration +- urma: query priority and enable bit, support ring size configuration +- urma: implement debugfs, improve boundary checks and error handling logic +- urma: implement data plane interaction and statistics +- urma: implement ipourma network device operations +- urma: ipourma resource management +- urma: ipourma resource management and err code +- urma: introduce ipourma main module +- iommu/ummu: Optimized the TID invalidation configuration +- iommu/ummu: Optimized SVA permission table memory allocation approach +- iommu/ummu: Adapt UMMU SVA interface adjustment +- iommu/ummu: Support TID and EID Granularity for MPAM +- !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y +- !20847 urma: sl resource query error +- !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches +- !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption +- !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug +- drivers/ub/sentry: fix check input parameters +- ub: udma: support user ctl function. +- ub: udma: support uboe function. +- ub: udma: bugfix related to query aux info. +- !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs +- drivers/ub/sentry: do not use magic numbers +- !20876 urma: Kernel-mode specific implementations file for Jetty extension interface +- urma: sl resource query error +- !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 +- !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time +- ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs +- ub: ubmem_vmmu: supports parsing and configuring the hardware node information +- ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation +- !20806 Fix CVE-2025-71225 +- !20896 scsi: qla2xxx: Free sp in error path to fix system crash +- !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress +- !20893 scsi: qla2xxx: Validate sp before freeing associated memory +- !20802 Fix CVE-2026-23110 +- urma: Kernel-mode specific implementations file for Jetty extension interface +- drivers/ub/sentry: fix memory leak in process_urma_data() +- drivers/ub/sentry: initialize some variables +- PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug +- !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory +- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 +- mm: consider non-anon swap cache folios in folio_expected_ref_count() +- mm: simplify folio_expected_ref_count() +- ASoC: qcom: audioreach: fix potential null pointer dereference +- gcc-plugins: Remove TODO_verify_il for GCC >= 16 +- crypto: sha256 - fix crash at kexec +- drm/i915/backlight: Return immediately when scale() finds invalid parameters +- minmax.h: remove some #defines that are only expanded once +- minmax.h: simplify the variants of clamp() +- minmax.h: move all the clamp() definitions after the min/max() ones +- minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() +- minmax.h: reduce the #define expansion of min(), max() and clamp() +- minmax.h: update some comments +- minmax.h: add whitespace around operators and after commas +- minmax: fix up min3() and max3() too +- minmax: improve macro expansion and type checking +- minmax: don't use max() in situations that want a C constant expression +- minmax: simplify min()/max()/clamp() implementation +- minmax: make generic MIN() and MAX() macros available everywhere +- drm/ast: Use msleep instead of mdelay for edid read +- gpiolib: Extend software-node support to support secondary software-nodes +- ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB +- s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b +- kmsan: fix out-of-bounds access to shadow memory +- afs: Fix potential null pointer dereference in afs_put_server +- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address +- i40e: improve VF MAC filters accounting +- i40e: add mask to apply valid bits for itr_idx +- HID: asus: add support for missing PX series fn keys +- drm/gma500: Fix null dereference in hdmi teardown +- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() +- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port +- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() +- net: dsa: lantiq_gswip: do also enable or disable cpu port +- selftests: fib_nexthops: Fix creation of non-FDB nexthops +- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS +- bnxt_en: correct offset handling for IPv6 destination address +- vhost: Take a reference on the task in struct vhost_task. +- Bluetooth: hci_sync: Fix hci_resume_advertising_sync +- ethernet: rvu-af: Remove slash from the driver name +- can: peak_usb: fix shift-out-of-bounds issue +- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow +- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow +- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow +- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow +- bpf: Reject bpf_timer for PREEMPT_RT +- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI +- wifi: virt_wifi: Fix page fault on connect +- cpufreq: Initialize cpufreq-based invariance before subsys +- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients +- arm64: dts: imx8mp: Correct thermal sensor index +- mm: folio_may_be_lru_cached() unless folio_test_large() +- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() +- mm/gup: check ref_count instead of lru before migration +- mm: add folio_expected_ref_count() for reference count calculation +- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" +- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions +- ALSA: usb-audio: Add mute TLV for playback volumes on more devices +- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk +- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device +- i2c: designware: Add quirk for Intel Xe +- mmc: sdhci-cadence: add Mobileye eyeQ support +- usb: core: Add 0x prefix to quirks debug output +- ALSA: usb-audio: Fix build with CONFIG_INPUT=n +- ALSA: usb-audio: Convert comma to semicolon +- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 +- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks +- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks +- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks +- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks +- ALSA: usb-audio: Fix block comments in mixer_quirks +- firewire: core: fix overlooked update of subsystem ABI version +- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE +- !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches +- !20869 ub:hisi-ubus: fix bug of security smatch +- !20861 CVE-2026-23163 +- ub: ubdevshm: supports the memory user to obtain and release shared memory +- ub: ubdevshm: supports granting and revoking shared memory permissions +- ub: ubdevshm: supports the registration and deregistration of shared memory segments +- ub: ubdevshm: supports the registration and deregistration +- KVM: arm64: Fix softirq masking in FPSIMD register saving sequence +- !20886 Fix CVE-2026-23205 +- !20803 Fix CVE-2026-23112 +- !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure +- !20811 smb/server: fix refcount leak in smb2_open() +- !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() +- !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() +- sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 +- sunrpc: fix race in cache cleanup causing stale nextcheck time +- scsi: qla2xxx: Free sp in error path to fix system crash +- scsi: qla2xxx: Delay module unload while fabric scan in progress +- scsi: qla2xxx: Validate sp before freeing associated memory +- dcache: Limit the minimal number of bucket to two +- !20872 Fix CVE-2026-23220 +- !20846 Fix CVE-2026-23193 +- !20815 Fix CVE-2026-23216 +- !20859 Fix CVE-2026-23179 +- !20871 CVE-2026-23096 +- !20858 ub: ubase: resolve the cmdq crq overflow problem +- bpf: Deprecate hisock unused kfuncs and orig ingress logic +- bpf: Add local connect support for hisock +- bpf: Add ipv4-mapped ipv6 addr support for hisock +- bpf: Add target comm parse to hisock_cmd +- bpf: Add multi port parse to hisock_cmd +- bpf: Only deploy hisock in server +- bpf: Apply BPF_HISOCK_INGRESS to hisock ingress +- bpf: Add bpf_handle_ingress/egress_ptype kfunc +- bpf: Add bpf_get_skb_ethhdr kfunc +- bpf: Add bpf_set_ingress/egress_dev kfunc +- bpf: Add bpf_set_ingress_dst kfunc +- bpf: Add BPF_HISOCK_INGRESS attach type +- cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted +- smb: client: fix potential UAF and double free in smb2_open_file() +- smb/client: fix memory leak in smb2_open_file() +- !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops +- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths +- uacce: fix cdev handling in the cleanup path +- Revert "uacce: fix for cdev memory leak" +- ub:hisi-ubus: fix bug of security smatch +- ub:ubus: injected route event +- ub:ubus: Black Box Development +- !20865 urma: urma support uboe +- sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure +- urma: urma support uboe +- !20857 ub_fwctl driver adds support for querying some functions +- ub:ub_fwctl:Add illegal verification for scc +- ub:ub_fwctl:Support querying the historical status of port links +- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove +- drm/amdkfd: Don't use sw fault filter if retry cam enabled +- ub:ub_fwctl:Support querying firmware version numbers +- ub: ub_fwctl: Support querying real-time bandwidth statistics +- ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels +- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() +- !20854 [URMA] add ping server for urma_ping +- urma: add ping server +- ub: ubase: resolve the cmdq crq overflow problem +- ub: ubase: Optimized the QoS code naming to improve code readability. +- ub: ubase&unic: optimizing code and configuration settings. +- net: unic: not support query and configure ip by control plane in UBoE +- net: unic: fix the automatically enable uc guid promisc mode. +- !20844 urma:kernel header of userctl +- urma: Kernel-mode header file for Jetty extension interface +- ASoC: amd: fix memory leak in acp3x pdm dma ops +- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() +- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() +- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) +- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 +- !20835 Fix CVE-2026-23084 +- minmax: add a few more MIN_T/MAX_T users +- minmax: simplify and clarify min_t()/max_t() implementation +- minmax: avoid overly complicated constant expressions in VM code +- rtc: pcf2127: fix SPI command byte for PCF2131 backport +- xhci: dbc: Fix full DbC transfer ring after several reconnects +- xhci: dbc: decouple endpoint allocation from initialization +- phy: ti: omap-usb2: fix device leak at unbind +- phy: Use device_get_match_data() +- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path +- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message +- ASoC: wm8974: Correct PLL rate rounding +- ASoC: wm8940: Correct typo in control name +- ASoC: wm8940: Correct PLL rate rounding +- io_uring: include dying ring in task_work "should cancel" state +- io_uring: backport io_should_terminate_tw() +- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx +- selftests: mptcp: avoid spurious errors on TCP disconnect +- selftests: mptcp: connect: catch IO errors on listen side +- rds: ib: Increment i_fastreg_wrs before bailing out +- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active +- mmc: mvsdio: Fix dma_unmap_sg() nents value +- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S +- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface +- btrfs: tree-checker: fix the incorrect inode ref size check +- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() +- LoongArch: Check the return value when creating kobj +- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled +- LoongArch: Update help info of ARCH_STRICT_ALIGN +- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* +- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() +- net: liquidio: fix overflow in octeon_init_instr_queue() +- bonding: don't set oif to bond dev when getting NS target destination +- net/mlx5e: Consider aggregated port speed during rate configuration +- i40e: remove redundant memory barrier when cleaning Tx descs +- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure +- selftests: mptcp: sockopt: fix error messages +- mptcp: tfo: record 'deny join id0' info +- mptcp: set remote_deny_join_id0 on SYN recv +- dpaa2-switch: fix buffer pool seeding for control traffic +- btrfs: fix invalid extref key setup when replaying dentry +- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch +- wifi: mac80211: fix incorrect type for ret +- wifi: mac80211: increase scan_ies_len for S1G +- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported +- !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches +- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list +- !20776 ub:ubfi: Release the chosen node +- !20817 CVE-2026-23094 +- !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() +- ub:ubus: Add port num check +- !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer +- !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 +- sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 +- btrfs: fix incorrect readahead expansion length +- x86: disable image size check for test builds +- drm/i915/power: fix size for for_each_set_bit() in abox iteration +- drm/amdgpu: fix a memory leak in fence cleanup when unloading +- net: mdiobus: release reset_gpio in mdiobus_unregister_device() +- phy: ti-pipe3: fix device leak at unbind +- phy: tegra: xusb: fix device and OF node leak at probe +- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate +- usb: gadget: midi2: Fix MIDI2 IN EP max packet size +- usb: gadget: midi2: Fix missing UMP group attributes initialization +- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels +- RISC-V: Remove unnecessary include from compat.h +- hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() +- hrtimer: Remove unused function +- regulator: sy7636a: fix lifecycle of power good gpio +- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map +- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr +- hsr: use rtnl lock when iterating over ports +- net: hsr: Add VLAN CTAG filter support +- net: hsr: Add support for MC filtering at the slave device +- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB +- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails +- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed +- igb: fix link test skipping when interface is admin down +- docs: networking: can: change bcm_msg_head frames member to support flexible array +- tunnels: reset the GSO metadata before reusing the skb +- net: bridge: Bounce invalid boolopts +- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() +- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions +- USB: serial: option: add Telit Cinterion FN990A w/audio compositions +- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks +- serial: sc16is7xx: fix bug in flow control levels init +- tty: hvc_console: Call hvc_kick in hvc_write unconditionally +- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" +- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table +- Input: iqs7222 - avoid enabling unused interrupts +- mm/khugepaged: fix the address passed to notifier on testing young +- btrfs: fix corruption reading compressed range when block size is smaller than page size +- btrfs: use readahead_expand() on compressed extents +- mm/damon/sysfs: fix use-after-free in state_show() +- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing +- mtd: nand: raw: atmel: Fix comment in timings preparation +- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages +- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time +- mm/damon/core: set quota->charged_from to jiffies at first charge window +- fuse: prevent overflow in copy_file_range return value +- fuse: check if copy_file_range() returns larger than requested size +- mtd: rawnand: stm32_fmc2: fix ECC overwrite +- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer +- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups +- i2c: i801: Hide Intel Birch Stream SoC TCO WDT +- ocfs2: fix recursive semaphore deadlock in fiemap call +- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN +- compiler-clang.h: define __SANITIZE_*__ macros only when undefined +- EDAC/altera: Delete an inappropriate dma_free_coherent() call +- rcu-tasks: Maintain real-time response in rcu_tasks_postscan() +- rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks +- rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks +- s390/cpum_cf: Deny all sampling events by counter PMU +- NFSv4/flexfiles: Fix layout merge mirror check. +- NFSv4.2: Serialise O_DIRECT i/o and copy range +- NFSv4.2: Serialise O_DIRECT i/o and clone range +- NFSv4.2: Serialise O_DIRECT i/o and fallocate() +- NFS: Serialise O_DIRECT i/o and truncate() +- fs/nfs/io: make nfs_start_io_*() killable +- ftrace/samples: Fix function size computation +- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server +- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set +- media: i2c: imx214: Fix link frequency validation +- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() +- nfsd: Fix a regression in nfsd_setattr() +- kasan: fix GCC mem-intrinsic prefix with sw tags +- kunit: kasan_test: disable fortify string checker on kasan_strings() test +- io_uring: fix kabi broken in struct io_ring_ctx +- io_uring: Support forcing sq thread to be idle and woken up by hrtimer +- dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() +- uacce: fix isolate sysfs check condition +- Revert "uacce: fix isolate sysfs check condition" +- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() +- smb/server: fix refcount leak in smb2_open() +- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() +- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() +- md: suspend array while updating raid_disks via sysfs +- scsi: core: Wake up the error handler when final completions race against each other +- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec +- ub:ubfi: Release the chosen node +- ub:ubus: Delete unused functions +- Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption + +*Sat Feb 28 2026 zhangqiumiao <zhangqiumiao1@h-partners.com> - 6.6.0-140.0.0.124 +- change the package name of 64KB page size kernel to kernel-64k + +* Wed Feb 25 2026 Li Nan <linan122@huawei.com> - 6.6.0-140.0.0.123 +- !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes +- ub/obmm: fix wrong pxm_numa parameter validation +- ub/obmm: Remove unused parameters from obmm_addr_check.c +- ub/obmm: Enhance mem_allocator_granu validation +- ub/obmm: simplify allocator naming scheme +- ub/obmm: fix allow_slow logic and optimize conti_alloc_memory +- ub/obmm: add sysfs interface with fine-grained memory statistics +- !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table +- !20813 migrate: correct lock ordering for hugetlb file folios +- !20812 libceph: make calc_target() set t->paused, not just clear it +- !20719 drivers/ub/sentry: some bugfix +- !20798 urma: log should not retrieve eid_idx from uctx +- !20808 urma: support triple bonding device +- urma: log should not retrieve eid_idx from uctx +- migrate: correct lock ordering for hugetlb file folios +- libceph: make calc_target() set t->paused, not just clear it +- !20745 vfio platform VFIO support for hisi05a1 devices +- urma: support triple bonding device +- net: hv_netvsc: reject RSS hash key programming without RX indirection table +- !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 +- !20726 tracing: Add recursion protection in kernel stack trace recording +- !20668 irqchip/gic-v3-its: Avoid truncating memory addresses +- !20795 ub: udma: support query and set qos info. +- !20791 Migration/urma:optimize performance in live migration. +- ub: udma: Support for UE link establishment message. +- Migration/urma: optimize performance in live migration. +- !20787 ub: cdma: modify the method of assigning values to the structure +- !20759 ubcore: hotfix route query for port eid on the same node. +- ub: udma: support query and set qos info. +- Revert "ub: ubase: Support for RC saved by queue granularity" +- ubcore: hotfix route query for port eid on the same node. +- !20676 urma: set/get sl +- !20765 urma: bugfix of UAF and double free in ubcm +- !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability +- gic: Add hip09 support for HISILICON_ERRATUM_165010801 +- vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default +- vfio/platform: VFIO support for hisi05a1 devices +- ub: cdma: modify the method of assigning values to the structure +- urma: set/get sl +- ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth +- ub: ubase: Support for RC saved by queue granularity +- ub: ubase: Traverse mailbox AE events using interrupts and polling. +- ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages +- net: unic: The function of dumping himac registers is added. +- ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style +- ub: ubase: Retain the initial tm qset configuration and restore it +- net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. +- ub: ubase: Add a retransmission function to improve reliability. +- net: unic: Increase the readability and reliability of loopback code +- net: unic: Synchronize the code modify for ip management and deactivation +- net: unic: Increase the readability and reliability of VLAN feature. +- net: unic: Added unic DFX log information. +- ub: ubase: Add and correct comments for some functions and data structures +- net: unic: Notify MAMI when the bond port status changes +- ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset +- !20768 iommu/ummu-core: Fix separate page table compatibility +- !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 +- !20764 net: hns3: fix double free issue for tx spare buffer +- urma: bugfix of UAF and double free in ubcm +- iommu/ummu-core: Fix separate page table compatibility +- net: hns3: fix double free issue for tx spare buffer +- drivers/ub/sentry: fix memory leak in sentry_msg_helper +- drivers/ub/sentry: initialize some variables +- drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() +- drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm +- drivers/ub/sentry: add input parameter verification for exported symbols +- tracing: Add recursion protection in kernel stack trace recording +- x86/csv: Enhance CMA memory usage reporting for CSV3 +- irqchip/gic-v3-its: Avoid truncating memory addresses + +* Wed Feb 11 2026 Li Nan <linan122@huawei.com> - 6.6.0-139.0.0.122 +- !20727 v2 bpf: sockmap fixes +- !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow +- !20744 fix CVE-2025-38449 +- !20763 net: usb: asix: validate PHY address before use +- !20762 smc91x: fix broken irq-context in PREEMPT_RT +- !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors +- !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h +- !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h +- !20245 KVM: arm64: Refactor exit handlers +- !20246 KVM: arm64: Mark some header functions as inline +- !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS +- !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch +- !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors +- !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches +- !20667 fix CVE-2024-50102 +- !20736 netfilter: nf_tables: remove redundant chain validation on register store +- !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. +- !20721 obmm: reduce log noise for successful export/import/preimport +- net: usb: asix: validate PHY address before use +- smc91x: fix broken irq-context in PREEMPT_RT +- !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy +- !20732 libceph: return the handler error from mon_handle_auth_done() +- !20743 mm: slub: avoid wake up kswapd in set_track_prepare +- ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. +- !20750 ub: cdma: adapted to UMMU interface changes +- !20713 urma: DFX of log in kernel +- urma: optimize log levels for kernel space +- ub: cdma: adapted to UMMU interface changes +- wifi: ath11k: avoid bit operation on key flags +- drm/mediatek: fix potential OF node use-after-free +- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes +- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() +- !20708 ub:hisi-ubus: Add create bus instance ummu bypass +- drm: fix kabi for struct drm_framebuffer +- drm/framebuffer: Acquire internal references on GEM handles +- drm/gem: Acquire references on GEM handles for framebuffers +- mm: slub: avoid wake up kswapd in set_track_prepare +- scsi: qla2xxx: Sanitize payload size to prevent member overflow +- netfilter: nf_tables: remove redundant chain validation on register store +- libceph: return the handler error from mon_handle_auth_done() +- devlink: rate: Unset parent pointer in devl_rate_nodes_destroy +- Documentation/hw-vuln: Add VMSCAPE documentation +- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() +- riscv: use lw when reading int cpu in asm_per_cpu +- mm: slub: avoid wake up kswapd in set_track_prepare +- tools: gpio: remove the include directory on make clean +- tools: gpio: rm .*.cmd on make clean +- drm/amd/amdgpu: Fix missing error return on kzalloc failure +- drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c +- perf bpf-event: Fix use-after-free in synthesis +- drm/bridge: ti-sn65dsi86: fix REFCLK setting +- spi: spi-fsl-lpspi: Clear status register after disabling the module +- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort +- spi: spi-fsl-lpspi: Set correct chip-select polarity bit +- spi: spi-fsl-lpspi: Fix transmissions when using CONT +- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM +- pcmcia: omap: Add missing check for platform_get_resource +- Revert "drm/amdgpu: Avoid extra evict-restore process." +- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY +- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model +- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv +- drm/mediatek: Fix using wrong drm private data to bind mediatek-drm +- drm/mediatek: Add crtc path enum for all_drm_priv array +- vmxnet3: update MTU after device quiesce +- net: dsa: microchip: linearize skb for tail-tagging switches +- net: dsa: microchip: update tag_ksz masks for KSZ9477 family +- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() +- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup +- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA +- iio: pressure: mprls0025pa: use aligned_s64 for timestamp +- iio: chemical: pms7003: use aligned_s64 for timestamp +- iio: imu: inv_mpu6050: align buffer for timestamp +- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold +- nouveau: fix disabling the nonstall irq due to storm code +- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode +- net: pcs: rzn1-miic: Correct MODCTRL register offset +- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list +- drm/amdgpu: drop hw access in non-DC audio fini +- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() +- wifi: mwifiex: Initialize the chan_stats array to zero +- tcp_bpf: Fix copied value in tcp_bpf_sendmsg +- skmsg: Return copied bytes in sk_msg_memcopy_from_iter +- tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection +- Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" +- ALSA: usb-audio: Add mute TLV for playback volumes on some devices +- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock +- selftest: net: Fix weird setsockopt() in bind_bhash.c. +- net: atm: fix memory leak in atm_register_sysfs when device_register fail +- ax25: properly unshare skbs in ax25_kiss_rcv() +- mctp: return -ENOPROTOOPT for unknown getsockopt options +- net/smc: Remove validation of reserved bits in CLC Decline message +- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() +- net: thunder_bgx: decrement cleanup index before use +- net: thunder_bgx: add a missing of_node_put +- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() +- wifi: libertas: cap SSID len in lbs_associate() +- wifi: cw1200: cap SSID length in cw1200_do_join() +- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets +- wifi: ath11k: fix group data packet drops during rekey +- wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() +- wifi: ath11k: rename ath11k_start_vdev_delay() +- wifi: ath11k: Introduce and use ath11k_sta_to_arsta() +- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() +- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint +- netlink: add variable-length / auto integers +- net: macb: Fix tx_ptr_lock locking +- icmp: fix icmp_ndo_send address translation for reply direction +- mISDN: Fix memory leak in dsp_hwec_enable() +- xirc2ps_cs: fix register access when enabling FullDuplex +- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY +- wifi: cfg80211: fix use-after-free in cmp_bss() +- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC +- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM +- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" +- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro +- Bluetooth: hci_sync: Avoid adding default advertising on startup +- cpupower: Fix a bug where the -t option of the set subcommand was not working. +- drm/amd/display: Don't warn when missing DCE encoder caps +- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN +- LoongArch: Save LBT before FPU in setup_sigcontext() +- btrfs: avoid load/store tearing races when checking if an inode was logged +- btrfs: fix race between setting last_dir_index_offset and inode logging +- btrfs: fix race between logging inode and checking if it was logged before +- bpf: Fix oob access in cgroup local storage +- !20556 urma: fix update topo logic +- !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches +- !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers +- !20560 *** fix CVE-2025-38062 *** +- !20662 pNFS: Fix a deadlock when returning a delegation during open() +- ub:hisi-ubus: Add create bus instance ummu bypass +- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" +- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" +- HID: mcp2221: Handle reads greater than 60 bytes +- HID: mcp2221: Don't set bus speed on every transfer +- net/mlx5: SF, Fix add port error handling +- drm/nouveau/disp: Always accept linear modifier +- smb3 client: fix return code mapping of remap_file_range +- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions +- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted +- HID: wacom: Add a new Art Pen 2 +- HID: logitech: Add ids for G PRO 2 LIGHTSPEED +- HID: quirks: add support for Legion Go dual dinput modes +- net: stmmac: Set CIC bit only for TX queues with COE +- net: stmmac: xgmac: Correct supported speed modes +- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts +- net/mlx5e: Set local Xoff after FW update +- net/mlx5e: Update and set Xon/Xoff upon port speed set +- net/mlx5e: Update and set Xon/Xoff upon MTU set +- net/mlx5: Nack sync reset when SFs are present +- net/mlx5: Convert SF port_indices xarray to function_ids xarray +- net/mlx5: Use devlink port pointer to get the pointer of container SF struct +- net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() +- phy: mscc: Fix when PTP clock is register and unregister +- net: dlink: fix multicast stats being counted incorrectly +- dt-bindings: display/msm: qcom,mdp5: drop lut clock +- drm/nouveau: remove unused memory target test +- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr +- Bluetooth: hci_sync: fix set_local_name race condition +- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced +- Bluetooth: hci_event: Mark connection as closed during suspend disconnect +- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success +- HID: input: report battery status changes immediately +- HID: input: rename hidinput_set_battery_charge_status() +- powerpc/kvm: Fix ifdef to remove build warning +- drm/msm: Defer fd_install in SUBMIT ioctl +- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() +- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list +- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC +- ASoC: codecs: tx-macro: correct tx_macro_component_drv name +- smb: client: fix race with concurrent opens in unlink(2) +- scsi: core: sysfs: Correct sysfs attributes access rights +- of: dynamic: Fix use after free in of_changeset_add_prop_helper() +- of: Add a helper to free property struct +- mips: lantiq: xway: sysctrl: rename the etop node +- mips: dts: lantiq: danube: add missing burst length property +- pinctrl: STMFX: add missing HAS_IOMEM dependency +- of: dynamic: Fix memleak when of_pci_add_properties() failed +- !20684 urma: adjust urma log format +- !20355 udp: Deal with race between UDP socket address change and rehash +- !20627 Fixes CVE-2025-38627 +- !20702 CVE-2025-39948 +- !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers +- !20700 CVE-2025-38678 +- !20703 CVE-2025-38491 +- !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. +- obmm: reduce log noise for successful export/import/preimport +- mptcp: avoid deadlock on fallback while reinjecting +- mptcp: plug races between subflow fail and subflow creation +- mptcp: make fallback action and fallback decision atomic +- ice: fix Rx page leak on multi-buffer frames +- ice: fix incorrect counter for buffer allocation failures +- ice: stop storing XDP verdict within ice_rx_buf +- ice: gather page_count()'s of each frag right before XDP prog call +- ice: Introduce ice_xdp_buff +- netfilter: ctnetlink: remove refcounting in expectation dumpers +- netfilter: nf_tables: reject duplicate device on updates +- netfilter: nf_tables: Introduce functions freeing nft_hook objects +- netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c +- err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros +- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. +- !20498 Fix CVE-2025-71118 +- !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure +- !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 +- !20650 fix cve-2025-40300 +- !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work +- !20664 backport some net bugfix from 6.6 lts +- urma: adjust urma log format +- !20678 ub: udma: close debug switch load parameters. +- ub: udma: close debug switch load parameters. +- x86/CPU/AMD: Add RDSEED fix for Zen5 +- !20630 net: LTS-6.6 bugfix backport +- !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() +- !20631 macvlan: fix possible UAF in macvlan_forward_source() +- !20628 Fix CVE-2025-39910 +- !20659 v2 Fix CVE-2025-22090 +- !20506 XSched: Update XSched manual +- !20647 media: imon: make send_packet() more robust +- !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item +- !20645 fbcon: Set fb_display[i +- !20648 parse_longname(): strrchr() expects NUL-terminated string +- !20621 urma: modify log level +- !20602 urma: fix the jfe uaf issue that occurred during the killall process. +- !20567 urma:change log level and pass status 9 +- !20640 iio: common: st_sensors: Fix use of uninitialize device structs +- !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work +- !20633 net: dsa: properly keep track of conduit reference +- !20635 fix CVE-2025-68231 +- !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() +- !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb +- !20652 mm/vmalloc: fix data race in show_numa_info() +- x86: uaccess: don't use runtime-const rewriting in modules +- x86: fix off-by-one in access_ok() +- x86: fix user address masking non-canonical speculation issue +- x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit +- x86/uaccess: Improve the 8-byte getuser() case +- x86: fix whitespace in runtime-const assembler output +- dcache: keep dentry_hashtable or d_hash_shift even when not used +- runtime constants: add x86 architecture support +- runtime constants: deal with old decrepit linkers +- x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() +- !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS +- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). +- libceph: replace BUG_ON with bounds check for map->max_osd +- libceph: prevent potential out-of-bounds writes in handle_auth_session_key() +- libceph: fix potential use-after-free in have_mon_and_osd_map() +- sctp: Hold sock lock while iterating over address list +- sctp: Prevent TOCTOU out-of-bounds write +- sctp: Hold RCU read lock while iterating over address list +- tipc: Fix use-after-free in tipc_mon_reinit_self(). +- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto +- sctp: avoid NULL dereference when chunk data buffer is missing +- bpf: Explicitly check accesses to bpf_sock_addr +- ipvs: Defer ip_vs_ftp unregister during netns cleanup +- nexthop: Forbid FDB status change while nexthop is in a group +- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm +- tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). +- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer +- sctp: initialize more fields in sctp_v6_from_sk() +- pNFS: Fix a deadlock when returning a delegation during open() +- Input: alps - fix use-after-free bugs caused by dev3_register_work +- x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors +- kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() +- mm: (un)track_pfn_copy() fix + doc improvements +- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() +- !20642 mtdchar: fix integer overflow in read/write ioctls +- mm/vmalloc: fix data race in show_numa_info() +- mm/slub: avoid accessing metadata when pointer is invalid in object_err() +- config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 +- x86/vmscape: Enable the mitigation +- x86/vmscape: Enumerate VMSCAPE bug +- x86/vmscape: Add conditional IBPB mitigation +- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb +- parse_longname(): strrchr() expects NUL-terminated string +- media: imon: make send_packet() more robust +- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item +- fbcon: Set fb_display[i]->mode to NULL when the mode is released +- !20569 CVE-2024-35808 +- mtdchar: fix integer overflow in read/write ioctls +- !20619 Fix CVE-2026-22991 +- !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits +- LoongArch: Add more instruction opcodes and emit_* helpers +- iio: common: st_sensors: Fix use of uninitialize device structs +- !20581 null_blk: fix kmemleak by releasing references to fault configfs items +- mm/mempool: fix poisoning order>0 pages with HIGHMEM +- mm/page_poison: replace kmap_atomic() with kmap_local_page() +- mm/mempool: replace kmap_atomic() with kmap_local_page() +- usb: gadget: udc: fix use-after-free in usb_gadget_state_work +- net: dsa: properly keep track of conduit reference +- net/sched: sch_qfq: do not free existing class in qfq_change_class() +- macvlan: fix possible UAF in macvlan_forward_source() +- netfilter: nft_objref: validate objref and objrefmap expressions +- arp: do not assume dev_hard_header() does not change skb->head +- ip6_gre: make ip6gre_header() robust +- netfilter: nf_tables: avoid chain re-validation if possible +- netfilter: nf_tables: drop unused 3rd argument from validate callback ops +- Revert "netfilter: nft_objref: validate objref and objrefmap expressions" +- bpf: Fix reference count leak in bpf_prog_test_run_xdp() +- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset +- ethtool: Avoid overflowing userspace buffer on stats query +- ipvs: fix ipv4 null-ptr-deref in route error path +- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() +- !20596 mm/page_alloc: prevent pcp corruption with SMP=n +- !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() +- !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio +- mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() +- kasan: avoid sleepable page allocation from atomic context +- f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic +- f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi +- !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches +- !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit +- urma:fix log level and pass status 9 +- urma: modify log level +- !20592 CVE-2025-71141 fixup +- !20594 CVE-2025-39744 fixup +- !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload +- !20606 mm/huge_memory: fix NULL pointer deference when splitting folio +- !20604 Fix CVE-2026-22984 +- !20603 Fix CVE-2026-23021 +- !20600 Fix CVE-2026-22990 +- urma: fix the jfe uaf issue that occurred during the killall process. +- !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD +- libceph: make free_choose_arg_map() resilient to partial allocation +- drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET +- net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits +- net: hns3: extend HCLGE_FD_AD_QID to 11 bits +- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue +- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M +- Revert "net: hns3: add support for FD counter" +- !20587 dmaengine: stm32: dmamux: fix device leak on route allocation +- pmdomain: arm: scmi: Fix genpd leak on provider registration failure +- powerpc/64s/slb: Fix SLB multihit issue during SLB preload +- mm/huge_memory: fix NULL pointer deference when splitting folio +- !20562 LoongArch: BPF: Sign extend kfunc call arguments +- !20470 ipv4: Fix reference count leak when using error routes with nexthop objects +- !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue +- !20472 net: fix memory leak in skb_segment_list for GRO packets +- !20473 ipv4: ip_gre: make ipgre_header() robust +- !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf +- !20476 ipv6: Fix use-after-free in inet6_addr_del(). +- !20477 svcrdma: bound check rq_pages index in inline path +- !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() +- !20579 fix CVE-2025-68768 +- !20542 Fix NFS deadlock +- USB: storage: Remove subclass and protocol overrides from Novatek quirk +- cpuidle: governors: menu: Select polling state in some more cases +- cpuidle: governors: menu: Rearrange main loop in menu_select() +- cpuidle: menu: Update documentation after previous changes +- Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" +- parisc: Remove spurious if statement from raw_copy_from_user() +- ata: libata-scsi: Fix system suspend for a security locked drive +- Revert "drm/amdgpu: fix incorrect vm flags to map bo" +- mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present +- drm/amd/display: use udelay rather than fsleep +- sched/fair: Revert max_newidle_lb_cost bump +- net: ipv4: fix regression in local-broadcast routes +- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers +- PM: runtime: Do not clear needs_force_resume with enabled runtime PM +- usb: typec: ucsi: psy: Set max current to zero when disconnected +- io_uring/rw: cast rw->flags assignment to rwf_t +- Documentation: ACPI: i2c-muxes: fix I2C device references +- s390/hypfs: Enable limited access during lockdown +- s390/hypfs: Avoid unnecessary ioctl registration in debugfs +- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation +- net/mlx5e: Preserve shared buffer capacity during headroom updates +- net/mlx5: Base ECVF devlink port attrs from 0 +- Octeontx2-af: Skip overlap check for SPI field +- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU +- bonding: Add independent control state machine +- bonding: update LACP activity flag after setting lacp_active +- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate +- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc +- gve: prevent ethtool ops after shutdown +- phy: mscc: Fix timestamping for vsc8584 +- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path +- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add +- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM +- ALSA: usb-audio: Fix size validation in convert_chmap_v3() +- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP +- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() +- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established +- scsi: qla4xxx: Prevent a potential error pointer dereference +- RDMA/bnxt_re: Fix to initialize the PBL array +- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path +- RDMA/bnxt_re: Fix to do SRQ armena by default +- RDMA/erdma: Fix ignored return value of init_kernel_qp +- iosys-map: Fix undefined behavior in iosys_map_clear() +- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key +- spi: spi-fsl-lpspi: Clamp too high speed_hz +- usb: typec: maxim_contaminant: disable low power mode when reading comparator values +- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean +- iio: imu: inv_icm42600: change invalid data error to -EBUSY +- iio: imu: inv_icm42600: Convert to uXX and sXX integer types +- iio: imu: inv_icm42600: use = { } instead of memset() +- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 +- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() +- iio: light: as73211: Ensure buffer holes are zeroed +- tls: fix handling of zero-length records on the rx_list +- powerpc/boot: Fix build with gcc 15 +- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER +- compiler: remove __ADDRESSABLE_ASM{_STR,}() again +- drm/amd/display: Don't overclock DCE 6 by 15% +- usb: dwc3: pci: add support for the Intel Wildcat Lake +- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout +- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles +- usb: storage: realtek_cr: Use correct byte order for bcs->Residue +- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera +- usb: renesas-xhci: Fix External ROM access timeouts +- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test +- comedi: Make insn_rw_emulate_bits() do insn->n samples +- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive +- cdx: Fix off-by-one error in cdx_rpmsg_probe() +- most: core: Drop device reference after usage in get_channel() +- iio: proximity: isl29501: fix buffered read on big-endian systems +- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() +- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() +- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS +- cpuidle: governors: menu: Avoid selecting states with too much latency +- cpuidle: menu: Remove iowait influence +- mmc: sdhci-pci-gli: Add a new function to simplify the code +- mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values +- mptcp: disable add_addr retransmission when timeout is 0 +- mptcp: remove duplicate sk_reset_timer call +- use uniform permission checks for all mount propagation changes +- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support +- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems +- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers +- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE +- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features +- PCI: imx6: Delay link start until configfs 'start' written +- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining +- PCI: rockchip: Use standard PCIe definitions +- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs +- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs +- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. +- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 +- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 +- mm/debug_vm_pgtable: clear page table entries at destroy_args() +- squashfs: fix memory leak in squashfs_fill_super +- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency +- memstick: Fix deadlock by moving removing flag earlier +- KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix +- sched/fair: Fix frequency selection for non-invariant case +- kbuild: userprogs: use correct linker when mixing clang and GNU ld +- ata: libata-scsi: Return aborted command when missing sense and result TF +- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() +- PM: runtime: Simplify pm_runtime_get_if_active() usage +- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig +- usb: dwc3: imx8mp: fix device leak at unbind +- wifi: mac80211: check basic rates validity in sta_link_apply_parameters +- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer +- s390/mm: Remove possible false-positive warning in pte_free_defer() +- btrfs: send: make fs_path_len() inline and constify its argument +- btrfs: send: use fallocate for hole punching with send stream v2 +- btrfs: send: avoid path allocation for the current inode when issuing commands +- btrfs: send: keep the current inode's path cached +- btrfs: send: add and use helper to rename current inode when processing refs +- btrfs: send: only use boolean variables at process_recorded_refs() +- btrfs: send: factor out common logic when sending xattrs +- btrfs: populate otime when logging an inode item +- btrfs: constify more pointer parameters +- btrfs: fix ssd_spread overallocation +- btrfs: open code timespec64 in struct btrfs_inode +- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags +- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() +- btrfs: always abort transaction on failure to add block group to free space tree +- btrfs: move transaction aborts to the error site in add_block_group_free_space() +- btrfs: qgroup: fix race between quota disable and quota rescan ioctl +- usb: typec: fusb302: cache PD RX state +- block: Make REQ_OP_ZONE_FINISH a write operation +- block: reject invalid operation in submit_bio_noacct +- leds: flash: leds-qcom-flash: Fix registry access after re-bind +- leds: flash: leds-qcom-flash: Limit LED current based on thermal condition +- selftests/memfd: add test for mapping write-sealed memfd read-only +- mm: update memfd seal write check to include F_SEAL_WRITE +- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit +- mptcp: drop skb if MPTCP skb extension allocation fails +- ipv6: sr: Fix MAC comparison to be constant-time +- drm/amd/display: Don't overwrite dce60_clk_mgr +- drm/amd/display: Add primary plane to commits for correct VRR handling +- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq +- drm/amdgpu: update mmhub 3.0.1 client id mappings +- drm/amdgpu: Avoid extra evict-restore process. +- drm/amd: Restore cached power limit during resume +- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 +- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. +- media: venus: protect against spurious interrupts during probe +- media: venus: hfi: explicitly release IRQ during teardown +- media: qcom: camss: cleanup media device allocated resource on error path +- media: ov2659: Fix memory leaks in ov2659_probe() +- media: usbtv: Lock resolution while streaming +- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() +- media: verisilicon: Fix AV1 decoder clock frequency +- media: vivid: fix wrong pixel_array control size +- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() +- media: hi556: correct the test pattern configuration +- media: gspca: Add bounds checking to firmware parser +- parisc: Update comments in make_insert_tlb +- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() +- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c +- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers +- parisc: Define and use set_pte_at() +- parisc: Check region is readable by user in raw_copy_from_user() +- soc/tegra: pmc: Ensure power-domains are in a known state +- f2fs: fix to avoid out-of-boundary access in dnode page +- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence +- vhost/vsock: Avoid allocating arbitrarily-sized SKBs +- PCI: endpoint: Fix configfs group removal on driver teardown +- PCI: endpoint: Fix configfs group list head handling +- mtd: rawnand: renesas: Add missing check after DMA map +- mtd: rawnand: fsmc: Add missing check after DMA map +- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() +- mtd: spi-nor: Fix spi_nor_try_unlock_all() +- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions +- pwm: mediatek: Fix duty and period setting +- pwm: mediatek: Handle hardware enable and clock enable separately +- pwm: imx-tpm: Reset counter if CMOD is 0 +- wifi: ath11k: fix dest ring-buffer corruption when ring is full +- wifi: ath11k: fix source ring-buffer corruption +- wifi: ath11k: fix dest ring-buffer corruption +- wifi: ath12k: fix dest ring-buffer corruption when ring is full +- wifi: ath12k: fix source ring-buffer corruption +- wifi: ath12k: fix dest ring-buffer corruption +- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() +- iio: adc: ad_sigma_delta: change to buffer predisable +- zynq_fpga: use sgtable-based scatterlist wrappers +- scsi: ufs: ufs-pci: Fix default runtime and system PM levels +- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers +- ata: libata-scsi: Fix ata_to_sense_error() status handling +- scsi: mpi3mr: Fix race between config read submit and interrupt completion +- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints +- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints +- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses +- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 +- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default +- btrfs: zoned: fix write time activation failure for metadata block group +- ext4: fix hole length calculation overflow in non-extent inodes +- ext4: don't try to clear the orphan_present feature block device is r/o +- ext4: fix reserved gdt blocks handling in fsmap +- ext4: fix fsmap end of range reporting with bigalloc +- ext4: check fast symlink for ea_inode correctly +- tracing: fprobe-event: Sanitize wildcard for fprobe event name +- crypto: qat - lower priority for skcipher and aead algorithms +- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap +- vt: defkeymap: Map keycodes above 127 to K_HOLE +- vt: keyboard: Don't process Unicode characters in K_OFF mode +- bus: mhi: host: Fix endianness of BHI vector table +- usb: dwc3: meson-g12a: fix device leaks at unbind +- usb: musb: omap2430: fix device leak at unbind +- usb: gadget: udc: renesas_usb3: fix device leak at unbind +- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() +- m68k: Fix lost column on framebuffer debug console +- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() +- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() +- rcu: Fix racy re-initialization of irq_work causing hangs +- HID: apple: avoid setting up battery timer for devices without battery +- HID: magicmouse: avoid setting up battery timer when not needed +- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages +- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros +- media: uvcvideo: Do not mark valid metadata as invalid +- media: venus: Fix OOB read due to missing payload bound check +- parisc: Makefile: fix a typo in palo.conf +- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit +- btrfs: do not allow relocation of partially dropped subvolumes +- btrfs: zoned: do not select metadata BG as finish target +- btrfs: clear dirty status from extent buffer on error at insert_new_root() +- btrfs: zoned: do not remove unwritten non-data block group +- btrfs: abort transaction during log replay if walk_log_tree() failed +- btrfs: zoned: use filesystem size not disk size for reclaim decision +- cdc-acm: fix race between initial clearing halt and open +- thunderbolt: Fix copy+paste error in match_service_id() +- usb: typec: ucsi: Update power_supply on power role change +- misc: rtsx: usb: Ensure mmc child device is active when card is present +- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range +- cifs: reset iface weights when we cannot find a candidate +- drm/amdgpu: fix incorrect vm flags to map bo +- scsi: lpfc: Remove redundant assignment to avoid memory leak +- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe +- pNFS: Handle RPC size limit for layoutcommits +- pNFS: Fix disk addr range check in block/scsi layout +- pNFS: Fix stripe mapping in block/scsi layout +- ASoC: Intel: avs: Fix uninitialized pointer error in probe() +- net: phy: smsc: add proper reset flags for LAN8710A +- ipmi: Fix strcpy source and destination the same +- kconfig: lxdialog: fix 'space' to (de)select options +- kconfig: gconf: fix potential memory leak in renderer_edited() +- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() +- ipmi: Use dev_warn_ratelimited() for incorrect message warnings +- vfio/mlx5: fix possible overflow in tracking max message size +- scsi: aacraid: Stop using PCI_IRQ_AFFINITY +- scsi: target: core: Generate correct identifiers for PR OUT transport IDs +- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans +- kconfig: nconf: Ensure null termination where strncpy is used +- vfio/type1: conditional rescheduling while pinning +- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c +- f2fs: check the generic conditions first +- exfat: add cluster chain loop check for dir +- i2c: Force DLL0945 touchpad i2c freq to 100khz +- apparmor: use the condition in AA_BUG_FMT even with debug disabled +- dm-table: fix checking for rq stackable devices +- dm-mpath: don't print the "loaded" message if registering fails +- i3c: master: Initialize ret in i3c_i2c_notifier_call() +- i3c: don't fail if GETHDRCAP is unsupported +- apparmor: shift ouid when mediating hard links in userns +- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 +- i3c: add missing include to internal header +- module: Prevent silent truncation of module name in delete_module(2) +- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use +- soundwire: Move handle_nested_irq outside of sdw_dev_lock +- soundwire: amd: serialize amd manager resume sequence during pm_prepare +- crypto: octeontx2 - add timeout for load_fvc completion poll +- media: uvcvideo: Fix bandwidth issue for Alcor camera +- media: usb: hdpvr: disable zero-length read messages +- media: tc358743: Increase FIFO trigger level to 374 +- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt +- media: tc358743: Check I2C succeeded during probe +- pinctrl: stm32: Manage irq affinity settings +- scsi: mpi3mr: Correctly handle ATA device errors +- scsi: mpt3sas: Correctly handle ATA device errors +- power: supply: qcom_battmgr: Add lithium-polymer entry +- RDMA/core: reduce stack using in nldev_stat_get_doit() +- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs +- leds: leds-lp50xx: Handle reg to get correct multi_index +- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control +- MIPS: lantiq: falcon: sysctrl: fix request memory check logic +- crypto: jitter - fix intermediary handling +- watchdog: iTCO_wdt: Report error if timeout configuration fails +- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} +- clk: qcom: ipq5018: keep XO clock always on +- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state +- watchdog: dw_wdt: Fix default timeout +- fs/orangefs: use snprintf() instead of sprintf() +- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal +- mfd: axp20x: Set explicit ID for AXP313 regulator +- clk: tegra: periph: Fix error handling and resolve unsigned compare warning +- fbdev: fix potential buffer overflow in do_register_framebuffer() +- cifs: Fix calling CIFSFindFirst() for root path without msearch +- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition +- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported +- drm/amd/display: Only finalize atomic_obj if it was initialized +- vhost: fail early when __vhost_add_used() fails +- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page +- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 +- rcu: Fix rcu_read_unlock() deadloop due to IRQ work +- drm/amd/display: Avoid trying AUX transactions on disconnected ports +- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size +- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP +- uapi: in6: restore visibility of most IPv6 socket options +- drm/ttm: Should to return the evict error +- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range +- net: ncsi: Fix buffer overflow in fetching version id +- ionic: clean dbpage in de-init +- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() +- ptp: Use ratelimite for freerun error message +- bpftool: Fix JSON writer resource leak in version command +- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 +- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 +- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 +- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 +- gve: Return error for unknown admin queue command +- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs +- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured +- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual +- dpaa_eth: don't use fixed_phy_change_carrier +- wifi: iwlegacy: Check rate_idx range after addition +- netmem: fix skb_frag_address_safe with unreadable skbs +- powerpc: floppy: Add missing checks after DMA map +- wifi: ath12k: Decrement TID on RX peer frag setup error handling +- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 +- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. +- wifi: mac80211: update radar_required in channel context after channel switch +- drm/amd/display: Fix 'failed to blank crtc!' +- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect +- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() +- wifi: ath12k: Add memset and update default rate value in wmi tx completion +- drm/amd/display: Separate set_gsl from set_gsl_source_select +- net: fec: allow disable coalescing +- net: atlantic: add set_power to fw_ops for atl2 to fix wol +- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() +- net: thunderbolt: Enable end-to-end flow control also in transmit +- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace +- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch +- wifi: rtw89: Disable deep power saving for USB/SDIO +- wifi: rtw89: Fix rtw89_mac_power_switch() for USB +- drm/msm: use trylock for debugfs +- wifi: mac80211: fix rx link assignment for non-MLO stations +- ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). +- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer +- wifi: mac80211: don't complete management TX on SAE commit +- sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails +- s390/stp: Remove udelay from stp_sync_clock() +- wifi: iwlwifi: mvm: fix scan request validation +- um: Re-evaluate thread flags repeatedly +- wifi: iwlwifi: mvm: set gtk id also in older FWs +- perf/cxlpmu: Remove unintended newline from IRQ name format string +- net: phy: micrel: Add ksz9131_resume() +- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() +- net: ipv4: fix incorrect MTU in broadcast routes +- wifi: cfg80211: Fix interface type validation +- net: mctp: Prevent duplicate binds +- arm64: Mark kernel as tainted on SAE and SError panic +- net/mlx5e: Properly access RCU protected qdisc_sleeping variable +- net: ag71xx: Add missing check after DMA map +- et131x: Add missing check after DMA map +- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB +- be2net: Use correct byte order and format string for TCP seq and ack_seq +- s390/time: Use monotonic clock in get_cycles() +- wifi: cfg80211: reject HTC bit for management frames +- ktest.pl: Prevent recursion of default variable options +- wifi: ath12k: Correct tid cleanup when tid setup fails +- net: usb: cdc-ncm: check for filtering capability +- xen/netfront: Fix TX response spurious interrupts +- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() +- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 +- ASoC: qcom: use drvdata instead of component to keep id +- ASoC: codecs: rt5640: Retry DEVICE_ID verification +- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement +- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros +- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop +- platform/chrome: cros_ec_typec: Defer probe on missing EC parent +- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches +- soc: qcom: mdt_loader: Actually use the e_phoff +- imx8m-blk-ctrl: set ISI panic write hurry level +- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() +- usb: core: usb_submit_urb: downgrade type check +- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present +- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 +- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection +- ALSA: hda: Disable jack polling at shutdown +- ALSA: hda: Handle the jack polling always via a work +- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() +- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() +- char: misc: Fix improper and inaccurate error code returned by misc_init() +- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 +- pps: clients: gpio: fix interrupt handling order in remove path +- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path +- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed +- ACPI: processor: fix acpi_object initialization +- PM: sleep: console: Fix the black screen issue +- thermal: sysfs: Return ENODATA instead of EAGAIN for reads +- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() +- firmware: tegra: Fix IVC dependency problems +- ACPI: PRM: Reduce unnecessary printing to avoid user confusion +- selftests: tracing: Use mutex_unlock for testing glob filter +- tools/build: Fix s390(x) cross-compilation with clang +- gpio: tps65912: check the return value of regmap_update_bits() +- iio: adc: ad_sigma_delta: don't overallocate scan buffer +- tools/nolibc: define time_t in terms of __kernel_old_time_t +- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required +- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed +- EDAC/synopsys: Clear the ECC counters on init +- gpio: wcd934x: check the return value of regmap_update_bits() +- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU +- soc: qcom: rpmh-rsc: Add RSC version 4 support +- usb: xhci: Avoid showing errors during surprise removal +- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command +- usb: xhci: Avoid showing warnings for dying controller +- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default +- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t +- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag +- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list +- usb: xhci: print xhci->xhc_state when queue_command failed +- tracefs: Add d_delete to remove negative dentries +- securityfs: don't pin dentries twice, once is enough... +- fix locking in efi_secret_unlink() +- ext2: Handle fiemap on empty files to prevent EINVAL +- fs/ntfs3: correctly create symlink for relative path +- fs/ntfs3: Add sanity check for file name +- better lockdep annotations for simple_recursive_removal() +- hfs: fix not erasing deleted b-tree node issue +- drbd: add missing kref_get in handle_write_conflicts +- udf: Verify partition map count +- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops +- nvme-pci: try function level reset on init failure +- smb/server: avoid deadlock when linking with ReplaceIfExists +- arm64: Handle KCOV __init vs inline mismatches +- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() +- intel_idle: Allow loading ACPI tables for any family +- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() +- netfilter: ctnetlink: fix refcount leak on table dump +- udp: also consider secpath when evaluating ipsec use for checksumming +- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs +- KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter +- KVM: VMX: Extract checking of guest's DEBUGCTL into helper +- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported +- KVM: VMX: Handle forced exit due to preemption timer in fastpath +- KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits +- KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint +- libceph: prevent potential out-of-bounds reads in handle_auth_done() +- net: usb: pegasus: fix memory leak in update_eth_regs_async() +- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() +- !20540 urma: added support for ipoverurma +- team: fix check for port enabled in team_queue_override_port_prio_changed() +- mm/page_alloc: prevent pcp corruption with SMP=n +- !20528 Fix CVE-2025-71083 +- KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID +- KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() +- KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow +- smb: client: don't wait for info->send_pending == 0 on error +- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() +- ACPI: processor: perflib: Move problematic pr->performance check +- ACPI: processor: perflib: Fix initial _PPC limit application +- Documentation: ACPI: Fix parent device references +- fs: Prevent file descriptor table allocations exceeding INT_MAX +- sunvdc: Balance device refcount in vdc_port_mpgroup_check +- PCI: Extend isolated function probing to LoongArch +- NFSD: detect mismatch of file handle and delegation stateid in OPEN op +- net: dpaa: fix device leak when querying time stamp info +- net: ti: icss-iep: fix device and OF node leaks at probe +- net: mtk_eth_soc: fix device leak at probe +- net: enetc: fix device and OF node leak at probe +- net: gianfar: fix device leak when querying time stamp info +- net: phy: micrel: fix KSZ8081/KSZ8091 cable test +- gpio: mlxbf3: use platform_get_irq_optional() +- gpio: mlxbf2: use platform_get_irq_optional() +- gpio: virtio: Fix config space reading. +- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks +- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X +- ALSA: usb-audio: Validate UAC3 cluster segment descriptors +- rcu: Fix racy re-initialization of irq_work causing hangs +- rcu: Fix rcu_read_unlock() deadloop due to IRQ work +- drm/tilcdc: Fix removal actions in case of failed probe +- drm/tilcdc: request and mapp iomem with devres +- urma: fix update topo logic +- dmaengine: stm32: dmamux: fix device leak on route allocation +- pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD +- null_blk: fix kmemleak by releasing references to fault configfs items +- inet: frags: flush pending skbs in fqdir_pre_exit() +- inet: frags: add inet_frag_queue_flush() +- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() +- md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen +- md/dm-raid: don't call md_reap_sync_thread() directly +- ACPICA: Avoid walking the Namespace if start_node is NULL +- arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS +- LoongArch: BPF: Sign extend kfunc call arguments +- genirq/msi:: Fix kabi break of struct msi_desc +- genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie +- NFS: Fix a deadlock involving nfs_release_folio() +- Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" +- urma: added support for ipoverurma +- drm/ttm: Avoid NULL pointer deref for evicted BOs +- XSched: Update XSched manual +- svcrdma: bound check rq_pages index in inline path +- ipv6: Fix use-after-free in inet6_addr_del(). +- ipv4: ip_gre: make ipgre_header() robust +- net: fix memory leak in skb_segment_list for GRO packets +- net: sock: fix hardened usercopy panic in sock_recv_errqueue +- ipv4: Fix reference count leak when using error routes with nexthop objects +- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf +- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit +- udp: Deal with race between UDP socket address change and rehash +- EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors +- x86/tsc: Use topology_max_packages() to get package number +- EDAC/amd64: Use unicast instead of broadcast to access the cs_config register +- EDAC/amd64: Correct the address translation for hygon family 18h model 4h +- KVM: arm64: Mark some header functions as inline +- KVM: arm64: Refactor exit handlers +- x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs +- hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio + +* Thu Feb 05 2026 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-138.0.0.121 +- riscv: perf vendor events: fix lrw core PMU event mapping + +* Wed Feb 04 2026 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-138.0.0.120 +- riscv kernel upgrade to 6.6.0-138.0.0 +- Fixed system hang when boot systemd on spacemit k3 + +* Wed Feb 04 2026 Li Nan <linan122@huawei.com> - 6.6.0-138.0.0.119 +- !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" +- Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" +- !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() +- !20575 RDMA/cm: Fix leaking the multicast GID table reference +- !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly +- !20551 Fix CVE-2025-68785 +- !20478 f2fs: fix to avoid potential deadlock +- !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y +- !20520 Fix CVE-2026-23038 +- !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup +- !20425 mlx5: Fix default values in create CQ +- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly +- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() +- RDMA/cm: Fix leaking the multicast GID table reference +- net: openvswitch: fix middle attribute validation in push_nsh() action +- net: openvswitch: remove never-working support for setting nsh fields +- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() +- bnxt_en: Fix potential data corruption with HW GRO/LRO +- f2fs: fix to avoid potential deadlock +- mlx5: Fix default values in create CQ +- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup + +* Wed Feb 04 2026 Li Nan <linan122@huawei.com> - 6.6.0-137.0.0.118 +- !20552 ub: udma: fix some code issues. +- !20313 Fix CVE-2025-40220 +- !20321 nvme: fix admin request_queue lifetime +- !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling +- !20544 Fix CVE-2025-71147 +- !20548 v4 net: LTS-6.6 backport +- !20503 Fix CVE-2025-39713 +- !20133 Fix CVE-2025-39721 +- !20438 Fix CVE-2025-38659 +- !20264 Fix CVE-2025-40277 +- !20340 Fix CVE-2025-40271 +- !20319 Fix CVE-2025-40237 +- !20392 vfs: Don't leak disconnected dentries on umount +- !20554 iommu/s390: Implement blocking domain +- !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches +- !20513 ACPI: PCC: Fix race condition by removing static qualifier +- !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer +- !20483 rcu: Protect ->defer_qs_iw_pending from data race +- !20510 drivers/ub/sentry: fix primary eid index value +- !20553 ub: cdma: support separated page table feature +- ub: udma: fix some code issues. +- !20480 iommu/ummu-core: fix error invalidate tid +- !20561 iommu/ummu: Add ummu sva independent page table parameter +- ub: udma: bugfix related to 2m_hugepage. +- ub: udma: support for separate page tables +- ub: udma: delete debugfs code. +- ub: udma: bugfix related to ctrlq function. +- ub: udma: verify get cqe/ae aux info out addr and len. +- ub: cdma: support separated page table feature +- iommu/ummu: Add ummu sva independent page table parameter +- iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' +- !20505 Fix CVE-2026-23035 +- iommu/s390: Implement blocking domain +- drivers/ub/sentry: fix primary eid index value +- !20535 libceph: make decode_pool() more resilient against corrupted osdmaps +- !20536 mm/page_alloc: change all pageblocks migrate type on coalescing +- !20537 mm/secretmem: fix use-after-free race in fault handler +- !20538 wifi: avoid kernel-infoleak from struct iw_point +- !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure +- !20440 PCI/AER: Fix NULL pointer access by aer_info +- !20262 Fix CVE-2025-68176 +- netfilter: nf_reject: don't leak dst refcount for loopback packets +- net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error +- page_pool: always add GFP_NOWARN for ATOMIC allocations +- virtio-net: fix received length check in big packets +- net: bridge: fix use-after-free due to MST port state bypass +- vsock: Ignore signal/timeout on connect() if already established +- tls: make sure to abort the stream if headers are bogus +- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI +- xfrm: Duplicate SPI Handling +- tls: handle data disappearing from under the TLS ULP +- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing +- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls +- Bluetooth: hci_core: Fix use-after-free in vhci_flush() +- KEYS: trusted: Fix a memory leak in tpm2_load_cmd +- !20237 Fix CVE-2025-68724 +- !20459 Fix CVE-2025-71131 +- !20525 Fix CVE-2025-68816 +- !20529 CVE-2025-68172 +- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure +- !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" +- wifi: avoid kernel-infoleak from struct iw_point +- mm/secretmem: fix use-after-free race in fault handler +- mm/page_alloc: change all pageblocks migrate type on coalescing +- libceph: make decode_pool() more resilient against corrupted osdmaps +- pps: Fix kabi breakage of struct pps_device for last_fetched_ev +- sched: Fix kabi breakage of struct task_struct for saved_state +- crypto: aspeed - fix double free caused by devm +- !20515 Bluetooth: bcsp: receive data only if registered +- !20507 Fix CVE-2025-40358 +- !20450 ub: ubase&unic: Fix some bug in concurrent process +- !20452 iommu/ummu: Fix some bugs and optimize the code implementation +- !20451 iommu/ummu: Add the function of creating devices with SVA-separated +- !20500 mm: fix the inaccurate memory statistics issue for users +- net/mlx5: fw_tracer, Validate format string parameters +- Bluetooth: bcsp: receive data only if registered +- ACPI: PCC: Fix race condition by removing static qualifier +- ACPI: CPPC: Fix missing PCC check for guaranteed_perf +- iommu/ummu: Add the function of creating devices with SVA-separated +- iommu/ummu-core: fix error invalidate tid +- riscv: stacktrace: Disable KASAN checks for non-current tasks +- !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() +- !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies +- !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline +- !20494 HID: core: Harden s32ton() against conversion to 0 bits +- !20493 iommu: Fix two issues in iommu_copy_struct_from_user() +- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv +- PM / devfreq: hisi: Fix potential UAF in OPP handling +- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() +- !20487 interference: Fix uninitialized ifs_clock compiling issue +- MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow +- MIPS: mm: Prevent a TLB shutdown on initial uniquification +- mm: fix the inaccurate memory statistics issue for users +- mm: add config option for atomic mode in mm counter +- Revert "mm: fix the inaccurate memory statistics issue for users" +- !20444 net/mlx5e: Fix crash on profile change rollback failure +- !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv +- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() +- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies +- iommu/amd: Avoid stack buffer overflow from kernel cmdline +- HID: core: Harden s32ton() against conversion to 0 bits +- iommu: Fix two issues in iommu_copy_struct_from_user() +- SUNRPC: call xs_sock_process_cmsg for all cmsg +- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read +- !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. +- !20227 Rename leapioraid to leapraid and release v2.0 +- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery +- MIPS: mm: tlb-r4k: Uniquify TLB entries on init +- x86/fpu: Delay instruction pointer fixup until after warning +- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() +- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() +- x86/sev: Evict cache lines during SNP memory validation +- net: usbnet: Fix the wrong netif_carrier_on() call +- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event +- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano +- sched,freezer: Remove unnecessary warning in __thaw_task +- freezer,sched: Clean saved_state when restoring it during thaw +- freezer,sched: Do not restore saved_state of a thawed task +- freezer,sched: Use saved_state to reduce some spurious wakeups +- sched/core: Remove ifdeffery for saved_state +- i2c: stm32f7: unmap DMA mapped buffer +- i2c: stm32f7: simplify status messages in case of errors +- i2c: stm32f7: perform most of irq job in threaded handler +- i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq +- i2c: stm32f7: Use devm_clk_get_enabled() +- USB: serial: option: add Foxconn T99W709 +- smb: server: Fix extension string in ksmbd_extract_shortname() +- ksmbd: fix corrupted mtime and ctime in smb2_open +- ksmbd: fix Preauh_HashValue race condition +- ksmbd: fix null pointer dereference error in generate_encryptionkey +- vsock: Do not allow binding to VMADDR_PORT_ANY +- selftests/perf_events: Add a mmap() correctness test +- smb: client: return an error if rdma_connect does not return within 5 seconds +- smb: client: let recv_done() cleanup before notifying the callers. +- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already +- smb: client: make use of common smbdirect_socket +- smb: smbdirect: add smbdirect_socket.h +- smb: client: Correct typos in multiple comments across various files +- smb: client: Use min() macro +- smb: server: let recv_done() avoid touching data_transfer after cleanup/move +- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already +- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() +- irqchip: Build IMX_MU_MSI only on ARM +- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing +- sunrpc: fix client side handling of tls alerts +- net/sched: taprio: enforce minimum value for picos_per_byte +- net: drop UFO packets in udp_rcv_segment() +- ipv6: reject malicious packets in ipv6_gso_segment() +- net/mlx5: Correctly set gso_segs when LRO is used +- netlink: specs: ethtool: fix module EEPROM input/output arguments +- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() +- phy: mscc: Fix parsing of unicast frames +- netpoll: prevent hanging NAPI when netcons gets enabled +- md/md-cluster: handle REMOVE message earlier +- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY +- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() +- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() +- pNFS/flexfiles: don't attempt pnfs on fatal DS errors +- PCI: pnv_php: Fix surprise plug detection and recovery +- powerpc/eeh: Export eeh_unfreeze_pe() +- PCI: pnv_php: Work around switches with broken presence detection +- kconfig: qconf: fix ConfigList::updateListAllforAll() +- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately +- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume +- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" +- scsi: mpt3sas: Fix a fw_event memory leak +- vfio/pci: Separate SR-IOV VF dev_set +- vfio/pds: Fix missing detach_ioas op +- vfio: Prevent open_count decrement to negative +- vfio: Fix unbalanced vfio_df_close call in no-iommu mode +- f2fs: fix to calculate dirty data during has_not_enough_free_secs() +- f2fs: fix to update upper_p in __get_secs_required() correctly +- f2fs: vm_unmap_ram() may be called from an invalid context +- f2fs: fix to avoid out-of-boundary access in devs.path +- f2fs: doc: fix wrong quota mount option description +- f2fs: fix KMSAN uninit-value in extent_info usage +- rtc: rv3028: fix incorrect maximum clock rate handling +- rtc: pcf8563: fix incorrect maximum clock rate handling +- rtc: pcf85063: fix incorrect maximum clock rate handling +- rtc: nct3018y: fix incorrect maximum clock rate handling +- rtc: hym8563: fix incorrect maximum clock rate handling +- rtc: ds1307: fix incorrect maximum clock rate handling +- ucount: fix atomic_long_inc_below() argument type +- module: Restore the moduleparam prefix length check +- apparmor: fix loop detection used in conflicting attachment resolution +- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 +- bpf: Check netfilter ctx accesses are aligned +- bpf: Check flow_dissector ctx accesses are aligned +- vhost-scsi: Fix log flooding with target does not exist errors +- mtd: rawnand: atmel: set pmecc data setup time +- mtd: rawnand: rockchip: Add missing check after DMA map +- mtd: rawnand: atmel: Fix dma_mapping_error() address +- jfs: fix metapage reference count leak in dbAllocCtl +- crypto: qat - fix seq_file position update in adf_ring_next() +- crypto: qat - fix DMA direction for compression on GEN2 devices +- perf tools: Remove libtraceevent in .gitignore +- sh: Do not use hyphen in exported variable name +- ASoC: fsl_xcvr: get channel status data when PHY is not exists +- dmaengine: nbpfaxi: Add missing check after DMA map +- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap +- fs/orangefs: Allow 2 more characters in do_c_string() +- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute +- soundwire: stream: restore params when prepare ports fail +- crypto: img-hash - Fix dma_unmap_sg() nents value +- crypto: keembay - Fix dma_unmap_sg() nents value +- hwrng: mtk - handle devm_pm_runtime_enable errors +- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() +- scsi: isci: Fix dma_unmap_sg() nents value +- scsi: mvsas: Fix dma_unmap_sg() nents value +- scsi: elx: efct: Fix dma_unmap_sg() nents value +- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value +- clk: sunxi-ng: v3s: Fix de clock definition +- perf tests bp_account: Fix leaked file descriptor +- kernel: trace: preemptirq_delay_test: use offstack cpu mask +- crypto: inside-secure - Fix `dma_unmap_sg()` nents value +- perf sched: Fix memory leaks in 'perf sched latency' +- perf sched: Fix memory leaks for evsel->priv in timehist +- perf sched: Free thread->priv using priv_destructor +- perf dso: Add missed dso__put to dso__load_kcore +- perf tools: Fix use-after-free in help_unknown_cmd() +- Fix dma_unmap_sg() nents value +- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq +- fanotify: sanitize handle_type values when reporting fid +- pinctrl: sunxi: Fix memory leak on krealloc failure +- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails +- crypto: arm/aes-neonbs - work around gcc-15 warning +- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set +- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name +- clk: xilinx: vcu: unregister pll_post only if registered correctly +- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check +- mtd: fix possible integer overflow in erase_xfer() +- crypto: marvell/cesa - Fix engine load inaccuracy +- crypto: qat - use unmanaged allocation for dc_data +- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() +- PCI: rockchip-host: Fix "Unexpected Completion" log message +- bpf/preload: Don't select USERMODE_DRIVER +- ipv6: annotate data-races around rt->fib6_nsiblings +- ipv6: fix possible infinite loop in fib6_info_uses_dev() +- vrf: Drop existing dst reference in vrf_ip6_input_dst +- selftests: rtnetlink.sh: remove esp4_offload after test +- net/mlx5e: Clear Read-Only port buffer size in PBMC before update +- netfilter: xt_nfacct: don't assume acct name is null-terminated +- can: kvaser_usb: Assign netdev.dev_port based on device channel index +- can: kvaser_pciefd: Store device channel index +- can: peak_usb: fix USB FD devices potential malfunction +- tools/rv: Do not skip idle in trace +- Bluetooth: hci_event: Mask data status from LE ext adv reports +- kcsan: test: Initialize dummy variable +- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() +- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE +- wifi: ath12k: fix endianness handling while accessing wmi service bit +- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() +- wifi: mac80211: Don't call fq_flow_idx() for management frames +- wifi: mac80211: Do not schedule stopped TXQs +- wifi: plfxlc: Fix error handling in usb driver probe +- wifi: mac80211: reject TDLS operations when station is not associated +- iommu/amd: Fix geometry.aperture_end for V2 tables +- mwl8k: Add missing check after DMA map +- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled +- tcp: call tcp_measure_rcv_mss() for ooo packets +- xen/gntdev: remove struct gntdev_copy_batch from stack +- net_sched: act_ctinfo: use atomic64_t for three counters +- net/sched: Restrict conditions for adding duplicating netems to qdisc tree +- um: rtc: Avoid shadowing err in uml_rtc_start() +- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX +- netfilter: nf_tables: adjust lockdep assertions handling +- netfilter: nf_tables: Drop dead code from fill_*_info routines +- fbcon: Fix outdated registered_fb reference in comment +- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value +- m68k: Don't unregister boot console needlessly +- drm/msm/dpu: Fill in min_prefill_lines for SC8180X +- kselftest/arm64: Fix check for setting new VLs in sve-ptrace +- net: dst: annotate data-races around dst->input +- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range +- wifi: ath11k: clear initialized flag for deinit-ed srng lists +- iwlwifi: Add missing check for alloc_ordered_workqueue +- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() +- wifi: rtl818x: Kill URBs before clearing tx status queue +- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band +- caif: reduce stack size, again +- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure +- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel +- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain +- selftests/bpf: fix signedness bug in redir_partial() +- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls +- bpf, sockmap: Fix psock incorrectly pointing to sk +- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed +- staging: nvec: Fix incorrect null termination of battery manufacturer +- interconnect: qcom: sc8180x: specify num_nodes +- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg +- soc: qcom: pmic_glink: fix OF node leak +- samples: mei: Fix building on musl libc +- cpufreq: Initialize cpufreq-based frequency-invariance later +- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode +- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed +- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed +- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface +- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS +- arm: dts: ti: omap: Fixup pinheader typo +- usb: early: xhci-dbc: Fix early_ioremap leak +- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() +- pps: fix poll support +- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() +- spi: stm32: Check for cfg availability in stm32_spi_probe +- usb: misc: apple-mfi-fastcharge: Make power supply names unique +- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() +- ARM: dts: vfxxx: Correctly use two tuples for timer address +- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely +- arm64: dts: qcom: sc7180: Expand IMEM region +- arm64: dts: qcom: sdm845: Expand IMEM region +- soc: qcom: QMI encoding/decoding for big endian +- selftests: Fix errno checking in syscall_user_dispatch test +- ASoC: mediatek: use reserved memory or enable buffer pre-allocation +- gfs2: No more self recovery +- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" +- hfs: make splice write available again +- hfsplus: make splice write available again +- ublk: use vmalloc for ublk_device's __queues +- fs_context: fix parameter name in infofc() macro +- audit,module: restore audit logging in load failure case +- ASoC: amd: yc: add DMI quirk for ASUS M6501RM +- ASoC: Intel: fix SND_SOC_SOF dependencies +- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx +- ethernet: intel: fix building with large NR_CPUS +- ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx +- interference: Fix uninitialized ifs_clock compiling issue +- iommu/ummu: optimize log printing +- !20455 Fix compilation failure caused by PR#20174 +- !20302 CVE-2026-22980 +- !20142 CVE-2025-68803 +- !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency +- !20435 fix CVE-2026-22998 +- !20433 scsi: target: Reset t_task_cdb pointer in error case +- !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" +- !20431 block: Use RCU in blk_mq_[un +- !20307 tpm: Cap the number of PCR banks +- !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read +- !20157 v2 md: backport from mainline +- rcu: Protect ->defer_qs_iw_pending from data race +- platform/x86/intel/pmt: fix compilation failure caused by PR#20174 +- iommu/ummu: optimize kv cache memory management +- iommu/ummu: optimize permission table management +- iommu/ummu: remove check for eid_type while del eid +- iommu/ummu: optimize the code implementation +- drivers/perf: fix ummu-pmu data reading exception +- iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct +- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer +- crypto: seqiv - Do not use req->iv after crypto_aead_encrypt +- net: unic: Notify mami of the bond ip change. +- ub: ubase: Support for UE link by ctrlq message +- ub: ubase: send a deactivate req in removing +- ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. +- ub: ubase: Use an independent thread for the ctrlq workqueue. +- !20368 ubcore: fix logging and permission for route query. +- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id +- !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr +- net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios +- ub: ubase: Add KABI compatibility +- ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration +- ub: ubase: add PMU IDEV interrupt supported abilities. +- ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context +- ub: ubase: Set the completion event interrupt to auto +- net: unic: fix poll tx read old skb cause a UAF bug +- !20249 Fix CVE-2025-38489 +- !20250 Fix CVE-2025-38480 +- !20378 Fix CVE-2025-39838 +- !20430 Fix CVE-2025-39942 +- !20351 Fix CVE-2025-71149 +- !20375 Fix CVE-2025-71150 +- !20323 Fix CVE-2025-38730 +- !20320 Fix CVE-2025-68814 +- !20314 Fix CVE-2025-71072 +- !20315 Fix CVE-2025-68794 +- !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu +- !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack +- !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() +- !20400 netfilter: nft_ct: add seqadj extension for natted connections +- !20399 net: xfrm: Fix CVE-2025-40215 +- !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue +- !20397 bpf: Reject narrower access to pointer ctx fields +- !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data +- !20394 IB/mlx5: Fix potential deadlock in MR deregistration +- !20367 ub: cdma: cdma uaf bugfix +- net/mlx5e: Fix crash on profile change rollback failure +- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv +- PCI/AER: Fix NULL pointer access by aer_info +- gfs2: No more self recovery +- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE +- crypto: qat - flush misc workqueue during device shutdown +- !20174 Backport PMT spec 3.0 support +- !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts +- !19814 [OLK-6.6] Batch flushing user memory encrytion status change +- !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches +- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec +- nvmet-tcp: remove boilerplate code +- scsi: target: Reset t_task_cdb pointer in error case +- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" +- block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock +- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size +- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer +- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection +- smb: server: remove separate empty_recvmsg_queue +- !20384 ub:ubus: Fix ubus link message and pool device error +- !20389 gfs2: Prevent recursive memory reclaim +- !20388 *** fix CVE-2025-38062 *** +- !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced +- !20386 pinctrl: check the return value of pinmux_ops::get_function_name() +- !20385 iommu/amd/pgtbl: Fix possible race while increase page table level +- ub:ubus: Not cfg access during surprise down +- ub:hisi-ubus: Delete validate_pa err print +- PCI: cadence: Check for the existence of cdns_pcie::ops before using it +- can: netlink: can_changelink(): allow disabling of automatic restart +- Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" +- drm/sched: Remove optimization that causes hang when killing dependent jobs +- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS +- bpf: Check skb->transport_header is set in bpf_skb_check_mtu +- bpf: Do not let BPF test infra emit invalid GSO types to stack +- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() +- netfilter: nft_ct: add seqadj extension for natted connections +- xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added +- xfrm: delete x->tunnel as we delete x +- x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. +- net/sched: sch_qfq: Fix null-deref in agg_dequeue +- bpf: Reject narrower access to pointer ctx fields +- Bluetooth: eir: Fix possible crashes on eir_create_adv_data +- IB/mlx5: Fix potential deadlock in MR deregistration +- ub:ubus: Fix ubus link message and pool device error +- ub:hisi-ubus: cq poller maximum handle 64 cqe per time +- ub:hisi-ubus:Fix vdm message print error +- ub:ubus:Fix ubus interrupt release issue +- wifi: mt76: mt7921: prevent decap offload config before STA initialization +- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() +- iio: hid-sensor-prox: Restore lost scale assignments +- iio: hid-sensor-prox: Fix incorrect OFFSET calculation +- crypto: powerpc/poly1305 - add depends on BROKEN for now +- erofs: address D-cache aliasing +- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x +- ALSA: hda: Add missing NVIDIA HDA codec IDs +- ALSA: hda/tegra: Add Tegra264 support +- comedi: comedi_test: Fix possible deletion of uninitialized timers +- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach +- usb: typec: tcpm: allow switching to mode accessory to mux properly +- usb: typec: tcpm: allow to use sink in accessory mode +- drm/amdkfd: Don't call mmput from MMU notifier callback +- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n +- selftests: mptcp: connect: also cover checksum +- selftests: mptcp: connect: also cover alt modes +- resource: fix false warning in __request_region() +- gve: Fix stuck TX queue for DQ queue format +- e1000e: ignore uninitialized checksum word on tgp +- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set +- dpaa2-switch: Fix device reference count leak in MAC endpoint handling +- dpaa2-eth: Fix device reference count leak in MAC endpoint handling +- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx +- sprintf.h requires stdarg.h +- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() +- i2c: virtio: Avoid hang by using interruptible completion wait +- i2c: tegra: Fix reset error handling with ACPI +- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots +- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode +- can: dev: can_restart(): move debug message and stats after successful restart +- can: dev: can_restart(): reverse logic to remove need for goto +- i40e: When removing VF MAC filters, only check PF-set MAC +- i40e: report VF tx_dropped with tx_errors instead of tx_discards +- i40e: Add rx_missed_errors for buffer exhaustion +- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch +- net/mlx5: Fix memory leak in cmd_exec() +- staging: vchiq_arm: Make vchiq_shutdown never fail +- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu +- regmap: fix potential memory leak of regmap_bus +- iio: adc: ad7949: use spi_is_bpw_supported() +- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node +- RDMA/core: Rate limit GID cache warning messages +- virtio_ring: Fix error reporting in virtqueue_resize +- !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches +- !20346 tracing: Fix crash on synthetic stacktrace field usage +- vfs: Don't leak disconnected dentries on umount +- !20334 Fix CVE-2025-68780 +- gfs2: Prevent recursive memory reclaim +- amd/amdkfd: enhance kfd process check in switch partition +- drm/amdkfd: allow compute partition mode switch with cgroup exclusions +- KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced +- pinctrl: check the return value of pinmux_ops::get_function_name() +- iommu/amd/pgtbl: Fix possible race while increase page table level +- !19966 nvme-fc: use lock accessing port_state and rport state +- ASoC: fsl_sai: replace regmap_write with regmap_update_bits +- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() +- cifs: prevent NULL pointer dereference in UTF16 conversion +- ksmbd: Fix refcount leak when invalid session is found on session lookup +- ubcore: fix logging and permission for route query. +- !20232 driver/coda: VirtCCA supports MSI device DA +- Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" +- !20197 ub: udma&ubase: fix a bug that caused long reboot time +- x86: Resolve FPU state corruption between atomic and non-atomic contexts +- ub: cdma: cdma uaf bugfix +- ub: cdma: jfs call trace bugfix +- !20353 x86/fpu: Clear XSTATE_BV[i +- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again +- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls +- nvmem: layouts: u-boot-env: remove crc32 endianness conversion +- i2c: omap: fix deprecated of_property_read_bool() use +- ASoC: fsl_sai: Force a software reset when starting in consumer mode +- regulator: pwm-regulator: Manage boot-on with disabled PWM channels +- regulator: pwm-regulator: Calculate the output voltage for disabled PWMs +- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() +- i2c: omap: Fix an error handling path in omap_i2c_probe() +- i2c: omap: Add support for setting mux +- usb: dwc3: qcom: Don't leave BCR asserted +- usb: hub: Don't try to recover devices lost during warm reset. +- usb: hub: Fix flushing of delayed work used for post resume purposes +- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm +- usb: hub: fix detection of high tier USB3 devices behind suspended hubs +- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented +- ipv6: make addrconf_wq single threaded +- !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling +- sched/deadline: only set free_cpus for online runqueues +- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 +- cpufreq/sched: Explicitly synchronize limits_changed flag handling +- io_uring/poll: correctly handle io_poll_add() return value on update +- shmem: fix recovery on rename failures +- io_uring: fix filename leak in __io_openat_prep() +- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" +- rxrpc: Fix transmission of an abort in response to an abort +- rxrpc: Fix recv-recv race of completed call +- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree +- net: bridge: Do not offload IGMP/MLD messages +- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf +- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry +- ipv6: mcast: Delay put pmc->idev in mld_del_delrec() +- net/mlx5: Correctly set gso_size when LRO is used +- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID +- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout +- Bluetooth: SMP: If an unallowed command is received consider it a failure +- Bluetooth: hci_sync: fix connectable extended advertising when using static random address +- hwmon: (corsair-cpro) Validate the size of the received input buffer +- selftests: net: increase inter-packet timeout in udpgro.sh +- wifi: cfg80211: remove scan request n_channels counted_by +- nvme: fix misaccounting of nvme-mpath inflight I/O +- net: phy: Don't register LEDs for genphy +- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() +- rpl: Fix use-after-free in rpl_do_srh_inline(). +- block: fix kobject leak in blk_unregister_queue +- net: emaclite: Fix missing pointer increment in aligned_read() +- soundwire: amd: fix for clearing command status register +- soundwire: amd: fix for handling slave alerts after link is down +- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() +- comedi: Fix some signed shift left operations +- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large +- comedi: das6402: Fix bit shift out of bounds +- comedi: das16m1: Fix bit shift out of bounds +- comedi: aio_iiro_16: Fix bit shift out of bounds +- comedi: pcl812: Fix bit shift out of bounds +- iio: adc: stm32-adc: Fix race in installing chained IRQ handler +- iio: adc: max1363: Reorder mode_list[] entries +- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] +- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush +- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled +- soc: aspeed: lpc-snoop: Cleanup resources in stack-order +- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again +- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov +- net: libwx: properly reset Rx ring descriptor +- net: libwx: remove duplicate page_pool_put_full_page() +- mmc: sdhci_am654: Workaround for Errata i2312 +- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models +- mmc: bcm2835: Fix dma_unmap_sg() nents value +- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() +- isofs: Verify inode mode when loading from disk +- dmaengine: nbpfaxi: Fix memory corruption in probe() +- af_packet: fix soft lockup issue caused by tpacket_snd() +- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() +- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck +- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on +- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency +- net/mlx5: Update the list of the PCI supported devices +- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() +- io_uring/poll: fix POLLERR handling +- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS +- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume +- tracing/osnoise: Fix crash in timerlat_dump_stack() +- spi: Add check for 8-bit transfer with 8 IO mode support +- pch_uart: Fix dma_sync_sg_for_device() nents value +- thunderbolt: Fix bit masking in tb_dp_port_set_hops() +- i2c: stm32: fix the device used for the DMA map +- tracing: Fix crash on synthetic stacktrace field usage +- usb: musb: fix gadget state on disconnect +- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI +- USB: serial: option: add Foxconn T99W640 +- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition +- phy: tegra: xusb: Disable periodic tracking on Tegra234 +- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode +- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode +- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr +- fs/proc: fix uaf in proc_readdir_de() +- io_uring/net: commit partial buffers on retry +- nvme: fix admin request_queue lifetime +- fs/notify: call exportfs_encode_fid with s_umount +- iomap: adjust read range correctly for non-block-aligned positions +- fuse: fix livelock in synchronous file put from fuseblk workers +- tpm: Cap the number of PCR banks +- nfsd: provide locking for v4_end_grace +- Revert "nfsd: provide locking for v4_end_grace" +- config: enable config for PMT discovery driver +- platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe +- platform/x86/intel/pmt: Fix kobject memory leak on init failure +- platform/x86/intel/pmt: fix a crashlog NULL pointer access +- platform/x86/intel/pmt: fix build dependency for kunit test +- platform/x86/intel/pmt/discovery: fix format string warning +- platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit +- platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API +- platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature +- platform/x86/intel/pmt/discovery: Get telemetry attributes +- platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI +- platform/x86/intel/vsec: Set OOBMSM to CPU mapping +- platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h +- docs: Add ABI documentation for intel_pmt feature directories +- platform/x86/intel/pmt: Add PMT Discovery driver +- sysfs: Fix crash on empty group attributes array +- sysfs: Introduce a mechanism to hide static attribute_groups +- platform/x86/intel/vsec: Add new Discovery feature +- platform/x86/intel/vsec: Skip driverless features +- platform/x86/intel/vsec: Skip absent features during initialization +- platform/x86/intel/vsec: Add device links to enforce dependencies +- platform/x86/intel/vsec: Create wrapper to walk PCI config space +- platform/x86/intel/vsec: Add private data for per-device data +- MAINTAINERS: Add link to documentation of Intel PMT ABI +- platform/x86/intel/pmt: allow user offset for PMT callbacks +- driver/coda: VirtCCA supports MSI device DA +- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency +- Rename leapioraid to leapraid and release v2.0 +- ub: udma: fix a bug that caused long reboot time. +- ub: ubase: Accelerate when ctrl node is shutting down +- platform/x86/intel/pmt: Use PMT callbacks +- platform/x86/intel/vsec: Add PMT read callbacks +- platform/x86/intel/vsec.h: Move to include/linux +- md: prevent incorrect update of resync/recovery offset +- md/raid1: Fix data corruption for degraded array with slow disk +- md/raid1: set max_sectors during early return from choose_slow_rdev() +- md-cluster: fix no recovery job when adding/re-adding a disk +- md-cluster: fix hanging issue while a new disk adding +- md/raid5: recheck if reshape has finished with device_lock held +- md-cluster: Constify struct md_cluster_operations +- md: Remove unneeded semicolon +- md/raid5: fix spares errors about rcu usage +- dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume +- md: pass in max_sectors for pers->sync_request() +- md: factor out helpers for different sync_action in md_do_sync() +- md: replace last_sync_action with new enum type +- md: use new helpers in md_do_sync() +- md: don't fail action_store() if sync_thread is not registered +- md: remove parameter check_seq for stop_sync_thread() +- md: replace sysfs api sync_action with new helpers +- md: factor out helper to start reshape from action_store() +- md: add new helpers for sync_action +- md: add a new enum type sync_action +- md: rearrange recovery_flags +- md/raid0: don't free conf on raid0_run failure +- md: make md_flush_request() more readable +- md: change the return value type of md_write_start to void +- md: Revert "md: Fix overflow in is_mddev_idle" +- md: don't account sync_io if iostats of the disk is disabled +- md: Fix overflow in is_mddev_idle +- md: add check for sleepers in md_wakeup_thread() +- md: add a mddev_is_dm helper +- md: add a mddev_add_trace_msg helper +- md: add a mddev_trace_remap helper +- dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape +- dm-raid: add a new helper prepare_suspend() in md_personality +- dm-raid: really frozen sync_thread during suspend +- md: add a new helper reshape_interrupted() +- md: export helper md_is_rdwr() +- md: export helpers to stop sync_thread +- md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume +- md/raid1: factor out helpers to choose the best rdev from read_balance() +- md/raid1: factor out the code to manage sequential IO +- md/raid1: factor out choose_bb_rdev() from read_balance() +- md/raid1: factor out choose_slow_rdev() from read_balance() +- md/raid1: factor out read_first_rdev() from read_balance() +- md/raid1-10: factor out a new helper raid1_should_read_first() +- md/raid1-10: add a helper raid1_check_read_range() +- md/raid1: fix choose next idle in read_balance() +- md/raid1: record nonrot rdevs while adding/removing rdevs to conf +- md/raid1: factor out helpers to add rdev to conf +- md: add a new helper rdev_has_badblock() +- md: check mddev->pers before calling md_set_readonly() +- md: clean up openers check in do_md_stop() and md_set_readonly() +- md: sync blockdev before stopping raid or setting readonly +- md: factor out a helper to sync mddev +- md: return directly before setting did_set_md_closing +- md: changed the switch of RAID_VERSION to if +- md: merge the check of capabilities into md_ioctl_valid() +- md: Don't suspend the array for interrupted reshape +- md: Don't register sync_thread for reshape directly +- md: Make sure md_do_sync() will set MD_RECOVERY_DONE +- md: Don't ignore read-only array in md_check_recovery() +- md: Don't ignore suspended array in md_check_recovery() +- md: get rdev->mddev with READ_ONCE() +- md: remove redundant md_wakeup_thread() +- md: remove redundant check of 'mddev->sync_thread' +- md: fix a suspicious RCU usage warning +- raid: Remove now superfluous sentinel element from ctl_table array +- NFSD: NFSv4 file creation neglects setting ACL +- nfsd: set security label during create operations +- xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read +- nvme-fc: use lock accessing port_state and rport state +- x86/mm: Batch flushing user memory encrytion status change + +* Mon Feb 2 2026 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-136.0.0.117 +- riscv kernel upgrade to 6.6.0-136.0.0 +- Fixed kernel patch conflicts. + +* Fri Jan 30 2026 Hangfan Li <lihangfan@iscas.ac.cn> - 6.6.0-136.0.0.116 +- riscv: fix dtbs install + +* Wed Jan 28 2026 Li Nan <linan122@huawei.com> - 6.6.0-136.0.0.115 +- !20020 ext4: fix e4b bitmap inconsistency reports +- !20308 ext4: fix stale data issue on the iomap path +- !20347 Fix exception when umount with release dev fd +- mfs: Do not release the async event immediately when read failed +- mfs: Fix wild-memory-access error when mfs event is destroy. +- !20336 memcg: avoid the warning in mem_cgroup_migrate +- !20326 KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight +- !20059 net/mdiobus: Fix potential out-of-bounds read/write access +- !20057 net/mdiobus: Fix potential out-of-bounds clause 45 read/write access +- !20056 net: phy: clear phydev->devlink when the link is deleted +- !20055 netfilter: nft_set_pipapo: prevent overflow in lookup table allocation +- !20130 ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() +- !20327 s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump +- !20324 drm/mediatek: Disable AFBC support on Mediatek DRM driver +- !20276 ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params +- !20325 atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). +- !20330 [OLK-6.6][linux-6.6.y sync] Backport 6.6.98-6.6.99 LTS Patches +- Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard +- kasan: use vmalloc_dump_obj() for vmalloc error reports +- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 +- btrfs: don't ignore inode missing when replaying log tree +- btrfs: fix log tree replay failure due to file with 0 links and extents +- btrfs: do not assert we found block group item when creating free space tree +- vsock: fix lock inversion in vsock_assign_transport() +- ksmbd: fix potential use-after-free in oplock/lease break ack +- kasan: remove kasan_find_vm_area() to prevent possible deadlock +- smb: client: fix potential race in cifs_put_tcon() +- selftests/bpf: adapt one more case in test_lru_map to the new target_free +- Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID +- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY +- bpf: Adjust free target to avoid global starvation of LRU map +- vt: add missing notification when switching back to text mode +- btrfs: fix assertion when building free space tree +- net: mana: Record doorbell physical address in PF mode +- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 +- net: usb: qmi_wwan: add SIMCom 8230C composition +- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 +- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic +- io_uring: make fallocate be hashed work +- um: vector: Reduce stack usage in vector_eth_configure() +- atm: idt77252: Add missing `dma_map_error()` +- ublk: sanity check add_dev input for underflow +- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() +- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level +- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx +- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof +- net: appletalk: Fix device refcount leak in atrtr_create() +- drm/tegra: nvdec: Fix dma_alloc_coherent error check +- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() +- cifs: all initializations for tcon should happen in tcon_info_alloc +- smb: client: fix DFS interlink failover +- smb: client: avoid unnecessary reconnects when refreshing referrals +- usb: dwc3: Abort suspend on soft disconnect failure +- usb: cdnsp: Fix issue with CV Bad Descriptor test +- usb: cdnsp: Replace snprintf() with the safer scnprintf() variant +- usb:cdnsp: remove TRB_FLUSH_ENDPOINT command +- btrfs: fix inode lookup error handling during log replay +- btrfs: return a btrfs_inode from btrfs_iget_logging() +- btrfs: remove redundant root argument from fixup_inode_link_count() +- btrfs: remove redundant root argument from btrfs_update_inode_fallback() +- btrfs: remove noinline from btrfs_update_inode() +- erofs: fix to add missing tracepoint in erofs_read_folio() +- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() +- smb: server: make use of rdma_destroy_qp() +- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish +- mm/vmalloc: leave lazy MMU mode on PTE mapping error +- scripts/gdb: fix interrupts.py after maple tree conversion +- scripts/gdb: de-reference per-CPU MCE interrupts +- scripts/gdb: fix interrupts display after MCP on x86 +- mm: fix the inaccurate memory statistics issue for users +- maple_tree: fix mt_destroy_walk() on root leaf node +- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" +- drm/gem: Fix race in drm_gem_handle_create_tail() +- drm/ttm: fix error handling in ttm_buffer_object_transfer +- memcg: avoid the warning in mem_cgroup_migrate +- !17578 perf mem/c2c: Add load store event mapping for Hygon +- !19670 [OLK-6.6] Fix CVE-2025-39833 +- !19669 [OLK-6.6] Fix CVE-2025-39743 +- !19668 [OLK-6.6] Fix CVE-2025-38681 +- !18606 [0LK-6.6] Fix CVE-2025-38699 +- !20332 Fix CVE-2025-68371 +- !19666 [OLK-6.6] Fix CVE-2025-38650 +- !19665 [OLK-6.6] Fix CVE-2025-38578 +- !19649 [olk 6.6] 主线补丁同步，hugememory&khugepaged +- !20317 Fix CVE-2025-71108 +- scsi: smartpqi: Fix device resources accessed after device removal +- !20037 [Intel-SIG] DMR new CPU model support +- wifi: prevent A-MSDU attacks in mesh networks +- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight +- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. +- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel +- x86/mce: Don't remove sysfs if thresholding sysfs init fails +- x86/mce/amd: Fix threshold limit reset +- x86/mce/amd: Add default names for MCA banks and blocks +- rxrpc: Fix oops due to non-existence of prealloc backlog struct +- Bluetooth: HCI: Set extended advertising data synchronously +- perf: build: Setup PKG_CONFIG_LIBDIR for cross compilation +- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() +- rxrpc: Fix bug due to prealloc collision +- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() +- atm: clip: Fix infinite recursive call of clip_push(). +- atm: clip: Fix memory leak of struct clip_vcc. +- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). +- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX +- net: phy: smsc: Force predictable MDI-X state on LAN87xx +- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap +- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 +- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` +- !19995 net: netpoll: fix incorrect refcount handling causing incorrect cleanup +- vsock: Fix transport_* TOCTOU +- !19994 ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe +- vsock: Fix transport_{g2h,h2g} TOCTOU +- !19993 net: ipv6: fix field-spanning memcpy warning in AH output +- vsock: fix `vsock_proto` declaration +- !19988 udp_tunnel: use netdev_warn() instead of netdev_WARN() +- fix proc_sys_compare() handling of in-lookup dentries +- pinctrl: amd: Clear GPIO debounce for suspend +- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected +- Bluetooth: hci_sync: Fix not disabling advertising instance +- ASoC: cs35l56: probe() should fail if the device ID is not recognized +- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode +- !19146 Backport uncore freq driver fixes and support for agent_types and die_id sysfs attributes +- !20036 Backport CWF cstate PMU for 6.6 +- !20304 [OLK-6.6][linux-6.6.y sync] Backport 6.6.96-6.6.98 LTS Patches +- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump +- !20303 ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() +- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight +- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). +- drm/mediatek: Disable AFBC support on Mediatek DRM driver +- !20295 CVE-2025-68296 +- usb: typec: ucsi: Handle incorrect num_connectors capability +- Input: xpad - set correct controller type for Acer NGR200 +- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() +- smb: client: remove redundant lstrp update in negotiate protocol +- igc: fix disabling L1.2 PCI-E link substate on I226 on init +- platform/x86: Fix initialization order for firmware_attributes_class +- RDMA/mlx5: Fix vport loopback forcing for MPV device +- ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() +- ext4: fix stale data issue on the iomap path +- !20046 drm/sysfb: Do not dereference NULL pointer in plane reset +- !20045 binfmt_misc: restore write access before closing files opened by open_exec() +- f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault +- powerpc/kernel: Fix ppc_save_regs inclusion in build +- platform/x86: think-lmi: Fix sysfs group cleanup +- platform/x86: think-lmi: Fix kobject cleanup +- platform/x86: think-lmi: Create ksets consecutively +- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed +- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU +- Logitech C-270 even more broken +- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 +- smb: client: fix readdir returning wrong type with POSIX extensions +- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume +- usb: cdnsp: do not disable slot for disabled slot +- Input: iqs7222 - explicitly define number of external channels +- Input: xpad - support Acer NGR 200 Controller +- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS +- xhci: dbc: Flush queued requests before stopping dbc +- xhci: dbctty: disable ECHO flag by default +- usb: xhci: quirk for data loss in ISOC transfers +- NFSv4/flexfiles: Fix handling of NFS level errors in I/O +- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper +- platform/x86: hp-bioscfg: Fix class device unregistration +- platform/x86: hp-bioscfg: Directly use firmware_attributes_class +- rcu: Return early if callback is not specified +- wifi: mac80211: drop invalid source address OCB frames +- aoe: defer rexmit timer downdev work to workqueue +- regulator: fan53555: add enable_time support and soft-start times +- ASoC: amd: yc: update quirk data for HP Victus +- powerpc: Fix struct termio related ioctl macros +- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list +- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic +- ata: pata_cs5536: fix build on 32-bit UML +- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled +- ALSA: sb: Force to disable DMAs once when DMA mode is changed +- ALSA: sb: Don't allow changing the DMA mode during operations +- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read +- drm/simpledrm: Do not upcast in release helpers +- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore +- scsi: ufs: core: Add OPP support for scaling clocks and regulators +- scsi: ufs: core: Fix abnormal scale up after last cmd finish +- f2fs: fix to zero post-eof page +- f2fs: convert f2fs_vm_page_mkwrite() to use folio +- f2fs: prevent writing without fallocate() for pinned files +- f2fs: add tracepoint for f2fs_vm_page_mkwrite() +- x86/traps: Initialize DR6 by writing its architectural reset value +- wifi: mac80211: finish link init before RCU publish +- wifi: mac80211: Add link iteration macro for link data +- wifi: mac80211: chan: chandef is non-NULL for reserved +- smb: client: remove from TP_printk statements +- btrfs: fix qgroup reservation leak on failure to allocate ordered extent +- smb: client: fix race condition in negotiate timeout by using more precise timing +- amd-xgbe: do not double read link status +- nui: Fix dma_mapping_error() check +- enic: fix incorrect MTU comparison in enic_change_mtu() +- amd-xgbe: align CL37 AN sequence as per databook +- lib: test_objagg: Set error message in check_expect_hints_stats() +- igc: disable L1.2 PCI-E link substate to avoid performance issue +- drm/i915/gsc: mei interrupt top half should be in irq disabled context +- drm/i915/gt: Fix timeline left held on VMA alloc error +- platform/mellanox: mlxreg-lc: Fix logic error in power state check +- platform/x86: dell-wmi-sysman: Fix class device unregistration +- platform/x86: dell-sysman: Directly use firmware_attributes_class +- platform/x86: think-lmi: Fix class device unregistration +- platform/x86: think-lmi: Directly use firmware_attributes_class +- platform/x86: firmware_attributes_class: Simplify API +- platform/x86: firmware_attributes_class: Move include linux/device/class.h +- platform/x86: make fw_attr_class constant +- arm64: dts: qcom: sm8550: add UART14 nodes +- drm/i915/selftests: Change mock_request() to return error pointers +- spi: spi-fsl-dspi: Clear completion counter before initiating transfer +- drm/exynos: fimd: Guard display clock control with runtime PM calls +- dpaa2-eth: fix xdp_rxq_info leak +- ethernet: atl1: Add missing DMA mapping error checks and count errors +- btrfs: use btrfs_record_snapshot_destroy() during rmdir +- btrfs: propagate last_unlink_trans earlier when doing a rmdir +- btrfs: rename err to ret in btrfs_rmdir() +- btrfs: fix iteration of extrefs during log replay +- btrfs: fix missing error handling when searching for inode refs during log replay +- Bluetooth: Prevent unintended pause by checking if advertising is active +- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message +- RDMA/mlx5: Fix vport loopback for MPV device +- RDMA/mlx5: Fix CC counters query for MPV +- RDMA/mlx5: Fix HW counters query for non-representor devices +- scsi: ufs: core: Fix spelling of a sysfs attribute name +- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() +- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() +- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment +- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename +- mtk-sd: reset host->mrq on prepare_data() error +- mtk-sd: Prevent memory corruption from DMA map failure +- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data +- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising +- Bluetooth: MGMT: set_mesh: update LE scan interval and window +- Bluetooth: hci_sync: revert some mesh modifications +- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier +- mmc: sdhci: Add a helper function for dump register in dynamic debug mode +- vsock/vmci: Clear the vmci transport packet properly when initializing it +- s390/pci: Do not try re-enabling load/store if device is disabled +- rtc: cmos: use spin_lock_irqsave in cmos_interrupt +- rtc: pcf2127: fix SPI command byte for PCF2131 +- rtc: pcf2127: add missing semicolon after statement +- !20296 [OLK-6.6][linux-6.6.y sync] Backport 6.6.95-6.6.96 LTS Patches +- !20298 cifs: Fix memory and information leak in smb3_reconfigure() +- !20042 RDMA/rxe: Fix null deref on srq->rq.queue after resize failure +- !20041 Bluetooth: hci_sock: Prevent race in socket write iter and sock bind +- !19820 usbnet: Prevents free active kevent +- !20268 urma: fix dereference of null_ptr for uobj +- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" +- kallsyms: fix build without execinfo +- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() +- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU +- usb: typec: displayport: Fix potential deadlock +- NFSv4.2: another fix for listxattr +- ARM: 9354/1: ptrace: Use bitfield helpers +- firmware: arm_scmi: Ensure that the message-id supports fastchannel +- firmware: arm_scmi: Add a common helper to check if a message is supported +- nvme: always punt polled uring_cmd end_io work to task_work +- Revert "ipv6: save dontfrag in cork" +- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c +- Kunit to check the longest symbol length +- s390/entry: Fix last breaking event handling in case of stack corruption +- media: uvcvideo: Rollback non processed entities on error +- ksmbd: remove unsafe_memcpy use in session setup +- ksmbd: Use unsafe_memcpy() for ntlm_negotiate +- drm/amdgpu: switch job hw_fence to amdgpu_fence +- drm/amdgpu: Add kicker device detection +- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 +- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram +- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready +- drm/bridge: cdns-dsi: Check return value when getting default PHY config +- drm/bridge: cdns-dsi: Fix connecting to next bridge +- drm/bridge: cdns-dsi: Fix phy de-init and flag it so +- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() +- drm/amdkfd: Fix race in GWS queue scheduling +- drm/msm/gpu: Fix crash when throttling GPU immediately during boot +- drm/udl: Unregister device before cleaning up on disconnect +- drm/tegra: Assign plane type before registration +- drm/etnaviv: Protect the scheduler's pending list with its lock +- drm/cirrus-qemu: Fix pitch programming +- drm/ast: Fix comment on modeset lock +- HID: wacom: fix kobject reference count leak +- HID: wacom: fix memory leak on sysfs attribute creation failure +- HID: wacom: fix memory leak on kobject creation failure +- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only +- net: libwx: fix the creation of page_pool +- btrfs: update superblock's device bytes_used when dropping chunk +- btrfs: fix a race between renames and directory logging +- dm-raid: fix variable in journal device check +- Bluetooth: L2CAP: Fix L2CAP MTU negotiation +- serial: imx: Restore original RXTL for console to fix data loss +- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive +- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() +- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs +- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type +- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback +- drm/i915: fix build error some more +- net: selftests: fix TCP packet checksum +- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR +- net: enetc: Correct endianness handling in _enetc_rd_reg64 +- libbpf: Fix possible use-after-free for externs +- um: ubd: Add missing error check in start_io_thread() +- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors +- af_unix: Don't set -ECONNRESET for consumed OOB skb. +- wifi: mac80211: fix beacon interval calculation overflow +- attach_recursive_mnt(): do not lock the covering tree when sliding something under it +- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() +- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() +- s390/pkey: Prevent overflow in size calculation for memdup_user() +- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 +- i2c: robotfuzz-osif: disable zero-length read messages +- i2c: tiny-usb: disable zero-length read messages +- af_unix: Don't leave consecutive consumed OOB skbs. +- af_unix: Don't call skb_get() for OOB skb. +- af_unix: Define locking order for U_RECVQ_LOCK_EMBRYO in unix_collect_skb(). +- af_unix: Define locking order for U_LOCK_SECOND in unix_state_double_lock(). +- af_unix: Define locking order for unix_table_double_lock(). +- platform/x86: ideapad-laptop: use usleep_range() for EC polling +- platform/x86: ideapad-laptop: move ACPI helpers from header to source file +- platform/x86: ideapad-laptop: move ymc_trigger_ec from lenovo-ymc +- platform/x86: ideapad-laptop: introduce a generic notification chain +- dummycon: Trigger redraw when switching consoles with deferred takeover +- tty: vt: make consw::con_switch() return a bool +- tty: vt: sanitize arguments of consw::con_clear() +- tty: vt: make init parameter of consw::con_init() a bool +- PCI: apple: Set only available ports up +- PCI: apple: Use helper function for_each_child_of_node_scoped() +- !20288 memcg: avoid dead loop when setting memory.max +- cifs: Fix memory and information leak in smb3_reconfigure() +- !19975 Bluetooth: MGMT: cancel mesh send timer when hdev removed +- !19976 net/mlx5: Clean up only new IRQ glue on request_irq() failure +- !19977 net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() +- !19978 net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ +- uio_hv_generic: Query the ringbuffer size for device +- Drivers: hv: vmbus: Add utility function for querying ring size +- f2fs: don't over-report free space or inodes in statvfs +- btrfs: handle csum tree error with rescue=ibadroots correctly +- ovl: Check for NULL d_inode() in ovl_dentry_upper() +- scsi: ufs: core: Don't perform UFS clkscaling during host async scan +- ceph: fix possible integer overflow in ceph_zero_objects() +- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock +- ALSA: hda: Add new pci id for AMD GPU display HD audio controller +- ALSA: hda: Ignore unsol events for cards being shut down +- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set +- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode +- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s +- usb: Add checks for snprintf() calls in usb_alloc_dev() +- usb: common: usb-conn-gpio: use a unique name for usb connector device +- usb: potential integer overflow in usbg_make_tpg() +- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() +- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos +- usb: dwc2: also exit clock_gating when stopping udc while suspended +- coresight: Only check bottom two claim bits +- um: use proper care when taking mmap lock during segfault +- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h +- iio: pressure: zpa2326: Use aligned_s64 for the timestamp +- bcache: fix NULL pointer in cache_set_flush() +- amd/amdkfd: fix a kfd_process ref leak +- md/md-bitmap: fix dm-raid max_write_behind setting +- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port +- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane +- dmaengine: xilinx_dma: Set dma_device directions +- rust: module: place cleanup_module() in .exit.text section +- ksmbd: provide zero as a unique ID to the Mac client +- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension +- hwmon: (pmbus/max34440) Fix support for max34451 +- NFSv4: xattr handlers should check for absent nfs filehandles +- cxl/region: Add a dev_err() on missing target list entries +- fuse: fix race between concurrent setattrs from multiple nodes +- leds: multicolor: Fix intensity setting while SW blinking +- sunrpc: don't immediately retransmit on seqno miss +- mfd: max14577: Fix wakeup source leaks on device unbind +- mailbox: Not protect module_put with spin_lock_irqsave +- NFSv4.2: fix listxattr to return selinux security label +- NFSv4: Always set NLINK even if the server doesn't support it +- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode +- cifs: Fix cifs_query_path_info() for Windows NT servers +- cifs: Correctly set SMB1 SessionKey field in Session Setup Request +- !20282 [OLK-6.6][linux-6.6.y sync] Backport 6.6.94-6.6.95 LTS Patches +- drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup +- drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info +- Revert "gpio: mlxbf3: only get IRQ for device instance 0" +- smb: client: fix warning when reconnecting channel +- wifi: ath11k: Add missing platform IDs for quirk table +- power: supply: bq27xxx: restrict no-battery detection to bq27000 +- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery +- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() +- Revert "ACPI: battery: negate current when discharging" +- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" +- cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function +- gpio: mlxbf3: only get IRQ for device instance 0 +- perf evsel: Missed close() when probing hybrid core PMUs +- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs +- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls +- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() +- perf: Fix cgroup state vs ERROR +- s390/pci: Fix __pcilg_mio_inuser() inline assembly +- platform/loongarch: laptop: Add backlight power control support +- smb: client: fix first command failure during re-negotiation +- Revert "cpufreq: tegra186: Share policy per cluster" +- ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms +- ARM: dts: am335x-bone-common: Increase MDIO reset deassert time +- platform/x86: ideapad-laptop: add missing Ideapad Pro 5 fn keys +- serial: sh-sci: Increment the runtime usage counter for the earlycon device +- net: make for_each_netdev_dump() a little more bug-proof +- smb: Log an error when close_all_cached_dirs fails +- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties +- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh +- net: atm: fix /proc/net/atm/lec handling +- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() +- net: microchip: lan743x: Reduce PTP timeout on HW failure +- tcp: fix passive TFO socket having invalid NAPI ID +- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior +- ptp: allow reading of currently dialed frequency to succeed on free-running clocks +- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 +- net: ice: Perform accurate aRFS flow match +- pldmfw: Select CRC32 when PLDMFW is selected +- hwmon: (occ) fix unaligned accesses +- hwmon: (occ) Rework attribute registration for stack usage +- memcg: avoid dead loop when setting memory.max +- drm/nouveau/bl: increase buffer size to avoid truncate warning +- ionic: Prevent driver/fw getting out of sync on devcmd(s) +- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate +- drm/msm/disp: Correct porch timing for SDM845 +- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels +- erofs: remove unused trace event erofs_destroy_inode +- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE +- net: Fix checksum update for ILA adj-transport +- iio: accel: fxls8962af: Fix temperature calculation +- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged +- ALSA: hda/intel: Add Thinkpad E15 to PM deny list +- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card +- wifi: rtw89: pci: use DBI function for 8852AE/8852BE/8851BE +- Input: sparcspkr - avoid unannotated fall-through +- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL +- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len +- selftests/x86: Add a test to detect infinite SIGTRAP handler loop +- udmabuf: use sgtable-based scatterlist wrappers +- net_sched: sch_sfq: reject invalid perturb period +- scsi: s390: zfcp: Ensure synchronous unit_add +- scsi: storvsc: Increase the timeouts to storvsc_timeout +- smb: improve directory cache reuse for readdir operations +- cifs: do not disable interface polling on failure +- cifs: serialize other channels when query server interfaces is pending +- cifs: deal with the channel loading lag while picking channels +- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg +- platform/loongarch: laptop: Unregister generic_sub_drivers on exit +- platform/loongarch: laptop: Get brightness setting from EC on probe +- io_uring: fix task leak issue in io_wq_create() +- Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older +- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery +- powerpc/vdso: Fix build of VDSO32 with pcrel +- platform/x86: dell_rbu: Stop overwriting data buffer +- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" +- tee: Prevent size calculation wraparound on 32-bit kernels +- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY +- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value +- watchdog: da9052_wdt: respect TWDMIN +- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz +- wifi: ath12k: fix incorrect CE addresses +- wifi: ath12k: fix link valid field initialization in the monitor Rx +- wifi: ath11k: determine PM policy based on machine model +- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() +- bpf, sockmap: Fix data lost during EAGAIN retries +- f2fs: fix to set atomic write status more clear +- usbnet: asix AX88772: leave the carrier control to phylink +- ice: fix check for existing switch rule +- sock: Correct error checking condition for (assign|release)_proto_idx() +- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping +- pinctrl: mcp23s08: Reset all pins to input at probe +- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER +- vxlan: Do not treat dst cache initialization errors as fatal +- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions +- net: bridge: mcast: update multicast contex when vlan state is changed +- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 +- wifi: mac80211: VLAN traffic in multicast path +- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled +- wifi: iwlwifi: pcie: make sure to lock rxq->read +- iommu/amd: Ensure GA log notifier callbacks finish running before module unload +- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands +- libbpf: Add identical pointer detection to btf_dedup_is_equiv() +- clk: rockchip: rk3036: mark ddrphy as critical +- wifi: mac80211: do not offer a mesh path if forwarding is disabled +- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() +- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi +- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info +- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() +- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() +- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() +- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() +- net: atlantic: generate software timestamp just before the doorbell +- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT +- tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows +- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() +- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode +- wifi: ath11k: Fix QMI memory reuse logic +- wifi: ath12k: fix a possible dead lock caused by ab->base_lock +- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET +- net: dlink: add synchronization for stats update +- i2c: npcm: Add clock toggle recovery +- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs +- sctp: Do not wake readers in __sctp_write_space() +- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device +- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R +- emulex/benet: correct command version selection in be_cmd_get_stats() +- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA +- i2c: designware: Invoke runtime suspend on quick slave re-registration +- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx +- tipc: use kfree_sensitive() for aead cleanup +- net: macb: Check return value of dma_set_mask_and_coherent() +- ACPI: battery: negate current when discharging +- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() +- gpiolib: of: Add polarity quirk for s5m8767 +- ASoC: tegra210_ahub: Add check to of_device_get_match_data() +- ACPICA: utilities: Fix overflow check in vsnprintf() +- power: supply: bq27xxx: Retrieve again when busy +- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case +- ACPI: bus: Bail out if acpi_kobj registration fails +- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change +- ACPICA: Avoid sequence overread in call to strncmp() +- mmc: Add quirk to disable DDR50 tuning +- power: supply: collie: Fix wakeup source leaks on device unbind +- clocksource: Fix the CPUs' choice in the watchdog per CPU verification +- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 +- iio: adc: ad7606_spi: fix reg write value mask +- iio: imu: inv_icm42600: Fix temperature calculation +- iio: accel: fxls8962af: Fix temperature scan element sign +- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() +- PCI: Fix lock symmetry in pci_slot_unlock() +- PCI: cadence-ep: Correct PBA offset in .set_msix() callback +- uio_hv_generic: Use correct size for interrupt and monitor pages +- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary +- cifs: dns resolution is needed only for primary channel +- cifs: update dstaddr whenever channel iface is updated +- cifs: reset connections for all channels when reconnect requested +- remoteproc: core: Release rproc->clean_table after rproc_attach() fails +- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() +- regulator: max14577: Add error check for max14577_read_reg() +- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS +- staging: iio: ad5933: Correct settling cycles encoding per datasheet +- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY +- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() +- mtd: rawnand: qcom: Fix read len for onfi param page +- dm-verity: fix a memory leak if some arguments are specified multiple times +- dm-mirror: fix a tiny race condition +- KVM: VMX: Flush shadow VMCS on emergency reboot +- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs +- mtd: nand: sunxi: Add randomizer configuration before randomizer enable +- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk +- mm: fix ratelimit_pages update error in dirty_ratio_handler() +- clk: meson-g12a: add missing fclk_div2 to spicc +- parisc: fix building with gcc-15 +- vgacon: Add check for vc_origin address range in vgacon_scroll() +- parisc/unaligned: Fix hex output to show 8 hex chars +- EDAC/altera: Use correct write width with the INTTEST register +- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var +- net: ftgmac100: select FIXED_PHY +- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() +- ext4: ensure i_size is smaller than maxbytes +- ext4: factor out ext4_get_maxbytes() +- ext4: fix calculation of credits for extent tree modification +- bus: fsl-mc: fix GET/SET_TAILDROP command ids +- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device +- cgroup,freezer: fix incomplete freezing when attaching tasks +- ceph: set superblock s_magic for IMA fsmagic matching +- can: tcan4x5x: fix power regulator retrieval during probe +- bus: mhi: host: Fix conflict between power_up and SYSERR +- bus: mhi: ep: Update read pointer only after buffer is written +- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 +- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() +- arm64/mm: Close theoretical race where stale TLB entry remains valid +- media: uvcvideo: Fix deferred probing error +- media: uvcvideo: Send control events for partial succeeds +- media: uvcvideo: Return the number of processed controls +- media: imx-jpeg: Reset slot data pointers when freed +- media: imx-jpeg: Drop the first error frames +- media: videobuf2: use sgtable-based scatterlist wrappers +- media: venus: Fix probe error handling +- media: v4l2-dev: fix error handling in __video_register_device() +- media: omap3isp: use sgtable-based scatterlist wrappers +- media: mediatek: vcodec: Correct vsi_core framebuffer size +- media: gspca: Add error handling for stv06xx_read_sensor() +- media: davinci: vpif: Fix memory leak in probe error path +- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case +- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div +- media: ccs-pll: Start OP pre-PLL multiplier search from correct value +- media: ccs-pll: Start VT pre-PLL multiplier search from correct value +- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() +- media: nxp: imx8-isi: better handle the m2m usage_count +- media: ov5675: suppress probe deferral errors +- media: ov8856: suppress probe deferral errors +- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 +- wifi: rtw88: usb: Reduce control message timeout to 500 ms +- wifi: ath12k: fix ring-buffer corruption +- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls +- wifi: ath11k: fix ring-buffer corruption +- wifi: ath11k: fix rx completion meta data corruption +- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() +- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() +- regulator: max20086: Change enable gpio to optional +- regulator: max20086: Fix MAX200086 chip id +- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states +- io_uring/kbuf: account ring io_buffer_list memory +- io_uring: account drain memory to cgroup +- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing +- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() +- gfs2: move msleep to sleepable context +- crypto: marvell/cesa - Do not chain submitted requests +- configfs: Do not override creating attribute file failure in populate_attrs() +- !19787 ima: Handle error code returned by ima_filter_rule_match() +- !20207 *** fix CVE-2025-37800 *** +- !20248 sched/fair: Track idle balance interval with idle_stamp in balance_fair +- !20179 v3 oenetcls: add a switch to enable/disable checking NIC ntuple feature +- ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params +- !20263 Fix CVE-2025-40311 +- urma: fix dereference of null_ptr for uobj +- !19549 NFSD: free copynotify stateid in nfs4_free_ol_stateid() +- !20147 fuse: fix readahead reclaim deadlock +- !20146 fuse: fix io-uring list corruption for terminated non-committed requests +- !20145 fuse: missing copy_finish in fuse-over-io-uring argument copies +- !20144 fsnotify: do not generate ACCESS/MODIFY events on child for special files +- !19482 NFSD: Define a proc_layoutcommit for the FlexFiles layout type +- !19483 ksmbd: fix refcount leak causing resource not released +- !19484 NFSD: fix race between nfsd registration and exports_proc +- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory +- !19989 proc: fix missing pde_set_flags() for net proc files +- sched/fair: Track idle balance interval with idle_stamp in balance_fair +- !19990 Fix SDEI state machine issue during reboot process +- !20024 [OLK-6.6] backport irqchip/gic-v4.1: Use local 4_1 ITS to generate VSGI from upstream linux-6.16.rc1 +- !20217 [OLK-6.6][linux-6.6.y sync] Backport 6.6.93-6.6.94 LTS Patches +- !20070 [OLK-6.6] Merge continuous pages into a large range when notifying range enc status changes +- ACPI: CPPC: Perform fast check switch only for online CPUs +- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator +- serial: sh-sci: Check that the DMA cookie is valid +- thunderbolt: Fix wake on connect at runtime +- bonding: set random address only when slaves already exist +- drm/mediatek: Fix device use-after-free on unbind +- rtc: Optimize calculations in rtc_time64_to_tm() +- !20170 perf/x86/amd: Check event before enable to avoid GPF +- !20069 ub: cdma: jfs 64K page table memory adaptation +- !20224 crypto: af_alg - zero initialize memory allocated via sock_kmalloc +- !20027 [OLK-6.6]Enhance CMA memory usage reporting for CSV3 +- crypto: af_alg - zero initialize memory allocated via sock_kmalloc +- drm/meson: Use 1000ULL when operating with mode->clock +- regulator: dt-bindings: mt6357: Drop fixed compatible requirement +- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall +- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() +- usb: Flush altsetting 0 endpoints before reinitializating them after reset. +- usb: cdnsp: Fix issue with detecting USB 3.2 speed +- usb: cdnsp: Fix issue with detecting command completion event +- kbuild: Disable -Wdefault-const-init-unsafe +- Revert "io_uring: ensure deferred completions are posted for multishot" +- io_uring/rw: fix wrong NOWAIT check in io_rw_init_file() +- io_uring/rw: allow pollable non-blocking attempts for !FMODE_NOWAIT +- io_uring: add io_file_can_poll() helper +- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 +- tools/resolve_btfids: Fix build when cross compiling kernel with clang. +- block: Fix bvec_set_folio() for very large folios +- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP +- perf: Ensure bpf_perf_link path is properly serialized +- nvmet-fcloop: access fcpreq only when holding reqlock +- fs/filesystems: Fix potential unsigned integer underflow in fs_name() +- net_sched: tbf: fix a race in tbf_change() +- net/mlx5e: Fix leak of Geneve TLV option object +- net/mlx5: Fix return value when searching for existing flow group +- net/mlx5: Ensure fw pages are always allocated on same NUMA +- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance +- Bluetooth: Fix NULL pointer deference on eir_get_service_data +- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access +- net/mdiobus: Fix potential out-of-bounds read/write access +- macsec: MACsec SCI assignment for ES = 0 +- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used +- i40e: retry VFLR handling if there is ongoing VF reset +- i40e: return false from i40e_reset_vf if reset is in progress +- drm/meson: fix more rounding issues with 59.94Hz modes +- drm/meson: use vclk_freq instead of pixel_freq in debug print +- drm/meson: fix debug log statement when setting the HDMI clocks +- drm/meson: use unsigned long long / Hz for frequency types +- scsi: iscsi: Fix incorrect error path labels for flashnode operations +- pinctrl: qcom: pinctrl-qcm2290: Add missing pins +- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready +- wifi: ath11k: don't wait when there is no vdev started +- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() +- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() +- wifi: ath11k: convert timeouts to secs_to_jiffies() +- wifi: ath11k: fix soc_dp_stats debugfs file permission +- ath10k: snoc: fix unbalanced IRQ enable in crash recovery +- Bluetooth: hci_core: fix list_for_each_entry_rcu usage +- serial: sh-sci: Clean sci_ports[0] after at earlycon exit +- serial: sh-sci: Move runtime PM enable to sci_probe_single() +- serial: sh-sci: Check if TX data was written to device in .tx_empty() +- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators +- arm64: dts: ti: k3-j721e-sk: Add support for multiple CAN instances +- arm64: dts: ti: k3-j721e-sk: Model CSI2RX connector mux +- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 +- arm64: dts: ti: k3-am65-main: Fix sdhci node properties +- kasan: use unchecked __memset internally +- Input: synaptics-rmi - fix crash with unsupported versions of F34 +- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() +- ASoC: ti: omap-hdmi: Re-add dai_link->platform to fix card init +- ASoC: Intel: avs: Verify content returned by parse_int_array() +- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX +- ASoC: codecs: hda: Fix RPM usage count underflow +- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() +- wireguard: device: enable threaded NAPI +- net: dsa: b53: allow RGMII for bcm63xx RGMII ports +- net: dsa: b53: do not enable RGMII delay on bcm63xx +- netfilter: nf_nat: also check reverse tuple to obtain clashing entry +- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO +- vmxnet3: correctly report gso type for UDP tunnels +- net: wwan: t7xx: Fix napi rx poll issue +- net: dsa: tag_brcm: legacy: fix pskb_may_pull length +- ice: fix rebuilding the Tx scheduler tree for large queue counts +- ice: create new Tx scheduler nodes for new queues only +- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION +- spi: bcm63xx-hsspi: fix shared reset +- spi: bcm63xx-spi: fix shared reset +- net: lan966x: Make sure to insert the vlan tags also in host mode +- net/mlx4_en: Prevent potential integer overflow calculating Hz +- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue +- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt +- net: stmmac: platform: guarantee uniqueness of bus_id +- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() +- coresight: prevent deactivate active config while enabling the config +- counter: interrupt-cnt: Protect enable/disable OPs with mutex +- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a +- iio: adc: ad7124: Fix 3dB filter frequency reading +- iio: filter: admv8818: Support frequencies >= 2^32 +- iio: filter: admv8818: fix range calculation +- iio: filter: admv8818: fix integer overflow +- iio: filter: admv8818: fix band 4, state 15 +- thunderbolt: Fix a logic error in wake on connect +- rtc: loongson: Add missing alarm notifications for ACPI RTC events +- PCI/DPC: Initialize aer_err_info before using it +- PCI: apple: Use gpiod_set_value_cansleep in probe flow +- PCI: cadence: Fix runtime atomic count underflow +- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() +- rtc: sh: assign correct interrupts with DT +- cifs: Fix validation of SMB1 query reparse point response +- perf trace: Always print return value for syscalls returning a pid +- perf record: Fix incorrect --user-regs comments +- perf tests switch-tracking: Fix timestamp comparison +- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE +- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() +- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() +- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} +- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe +- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 +- perf intel-pt: Fix PEBS-via-PT data_src +- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() +- dm-flakey: make corrupting read bios work +- dm-flakey: error all IOs when num_features is absent +- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret +- dm: free table mempools if not used in __bind +- dm: don't change md if dm_table_set_restrictions() fails +- perf ui browser hists: Set actions->thread before calling do_zoom_thread() +- perf build: Warn when libdebuginfod devel files are not available +- randstruct: gcc-plugin: Fix attribute addition +- randstruct: gcc-plugin: Remove bogus void member +- soc: aspeed: lpc: Fix impossible judgment condition +- ARM: aspeed: Don't select SRAM +- arm64: dts: mt6359: Rename RTC node to match binding expectations +- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups +- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou +- arm64: defconfig: mediatek: enable PHY drivers +- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device +- ARM: dts: qcom: apq8064: add missing clocks to the timer node +- dt-bindings: vendor-prefixes: Add Liontron name +- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() +- nilfs2: add pointer check for nilfs_direct_propagate() +- ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery +- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E +- arm64: tegra: Drop remaining serial clock-names and reset-names +- arm64: dts: rockchip: Update eMMC for NanoPi R5 series +- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning +- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply +- arm64: dts: mt6359: Add missing 'compatible' property to regulators node +- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles +- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio +- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio +- arm64: dts: imx8mp-beacon: Fix RTC capacitive load +- arm64: dts: imx8mn-beacon: Fix RTC capacitive load +- arm64: dts: imx8mm-beacon: Fix RTC capacitive load +- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO +- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains +- ARM: dts: at91: at91sam9263: fix NAND chip selects +- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select +- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies +- arm64: dts: qcom: sm8250: Fix CPU7 opp table +- arm64: dts: qcom: sm8350: Reenable crypto & cryptobam +- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios +- arm64: dts: qcom: sdm845-starqltechn: refactor node order +- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake +- arm64: dts: qcom: sdm845-starqltechn: remove wifi +- f2fs: fix to correct check conditions in f2fs_cross_rename +- f2fs: use d_inode(dentry) cleanup dentry->d_inode +- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames +- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback +- net: phy: mscc: Fix memory leak when using one step timestamping +- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy +- net: phy: fix up const issues in to_mdio_device() and to_phy_device() +- net: phy: clear phydev->devlink when the link is deleted +- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 +- RISC-V: KVM: lock the correct mp_state during reset +- netfilter: nft_tunnel: fix geneve_opt dump +- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() +- vfio/type1: Fix error unwind in migration dirty bitmap allocation +- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy +- wifi: mt76: mt7996: fix RX buffer size of MCU event +- wifi: mt76: mt7996: set EHT max ampdu length capability +- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() +- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event +- iommu: remove duplicate selection of DMAR_TABLE +- s390/bpf: Store backchain even for leaf progs +- clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz +- libbpf: Use proper errno value in nlattr +- ktls, sockmap: Fix missing uncharge operation +- tracing: Fix error handling in event_trigger_parse() +- tracing: Rename event_trigger_alloc() to trigger_data_alloc() +- efi/libstub: Describe missing 'out' parameter in efi_load_initrd +- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs +- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs +- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs +- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs +- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ +- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction +- netfilter: nft_quota: match correctly when the quota just depleted +- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it +- libbpf: Use proper errno value in linker +- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() +- f2fs: clean up w/ fscrypt_is_bounce_page() +- bonding: assign random address if device address is same as bond +- iommu: Protect against overflow in iommu_pgsize() +- Use thread-safe function pointer in libbpf_print +- libbpf: Remove sample_period init in perf_buffer +- wifi: ath12k: Add MSDU length validation for TKIP MIC error +- wifi: rtw88: do not ignore hardware read error during DPK +- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally +- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT +- xfrm: Use xdo.dev instead of xdo.real_dev +- libbpf: Fix buffer overflow in bpf_object__init_prog +- net: ncsi: Fix GCPS 64-bit member variables +- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc +- selftests/bpf: Fix bpf_nf selftest failure +- IB/cm: use rwlock for MAD agent lock +- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err +- drm/mediatek: Fix kobject put for component sub-drivers +- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr +- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops +- x86/cpu: Rename and move CPU model entry for Diamond Rapids +- x86/cpu: Add two Intel CPU model numbers +- !20099 v2 xsched: Add XSched manual +- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES +- drm/tegra: rgb: Fix the unbound reference count +- drm/vkms: Adjust vkms_state->active_planes allocation type +- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() +- selftests/seccomp: fix syscall_restart test for arm compat +- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX +- firmware: psci: Fix refcount leak in psci_dt_init +- m68k: mac: Fix macintosh_config for Mac II +- watchdog: exar: Shorten identity name to fit correctly +- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() +- arm64/fpsimd: Fix merging of FPSIMD state during signal return +- arm64/fpsimd: Avoid RES0 bits in the SME trap handler +- media: rkvdec: Fix frame size enumeration +- drm/vc4: tests: Use return instead of assert +- drm/vmwgfx: Add seqno waiter for sync_files +- ASoC: apple: mca: Constrain channels according to TDM mask +- spi: sh-msiof: Fix maximum DMA transfer size +- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" +- PM: sleep: Print PM debug messages during hibernation +- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() +- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() +- ASoC: SOF: ipc4-pcm: Adjust pipeline_list->pipelines allocation type +- power: reset: at91-reset: Optimize at91_reset() +- spi: tegra210-quad: modify chip select (CS) deactivation +- spi: tegra210-quad: remove redundant error handling code +- !20076 smb3: fix for slab out of bounds on mount to ksmbd +- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers +- ASoC: tas2764: Enable main IRQs +- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading +- kunit: Fix wrong parameter to kunit_deactivate_static_stub() +- crypto: sun8i-ce - move fallback ahash_request to the end of the struct +- crypto: xts - Only add ecb if it is not already there +- crypto: lrw - Only add ecb if it is not already there +- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture +- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches +- btrfs: scrub: update device stats when an error is detected +- crypto: marvell/cesa - Avoid empty transfer descriptor +- x86/cpu: Sanitize CPUID(0x80000000) output +- x86/microcode/AMD: Do not return error when microcode update is not necessary +- powerpc: do not build ppc_save_regs.o always +- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions +- perf/core: Fix broken throttling when max_samples_per_tick=1 +- gfs2: gfs2_create_inode error handling fix +- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() +- tools/x86/kcpuid: Fix error handling +- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property +- dt-bindings: usb: cypress,hx3: Add support for all variants +- usb: usbtmc: Fix timeout value in get_stb +- Bluetooth: hci_qca: move the SoC type check to the right place +- usb: typec: ucsi: fix Clang -Wsign-conversion warning +- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB +- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device +- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE +- rtc: Fix offset calculation for .start_secs < 0 +- rtc: Make rtc_time64_to_tm() support dates before 1970 +- pinctrl: armada-37xx: set GPIO output value before setting direction +- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 +- !18475 [OLK-6.6] x86/kvm: expose CPUID 0xC000_0000 for Zhaoxin "Shanghai" vendor +- driver core: fix potential NULL pointer dereference in dev_uevent() +- Revert "Revert "Revert "driver core: Fix uevent_show() vs driver detach race""" +- !19893 nbd: defer config unlock in nbd_genl_connect +- !19892 nbd: defer config put in recv_work +- !19890 md: fix rcu protection in md_wakeup_thread +- !19889 nvme-multipath: fix lockdep WARN due to partition scan work +- !19835 blk-cgroup: fix possible deadlock while configuring policy +- !19815 scsi: sg: Do not sleep in atomic context +- !20162 tracing: Fix enabling of tracing on file release +- !20110 macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse +- !20164 powerpc/kexec: Enable SMT before waking offline CPUs +- !20149 tracing: Do not register unsupported perf events +- !20153 iavf: fix off-by-one issues in iavf_config_rss_reg() +- !20152 e1000: fix OOB in e1000_tbi_should_accept() +- !20140 mlxsw: spectrum_router: Fix neighbour use-after-free +- !20139 mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats +- !20118 [OLK-6.6][linux-6.6.y sync] Backport 6.6.92-6.6.93 LTS Patches +- !19756 erofs: avoid infinite loops due to corrupted subpage compact indexes +- !19107 mptcp: Fix proto fallback detection with BPF +- !20128 NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags +- !20000 cifs: fix memory leak in smb3_fs_context_parse_param error path +- !20001 smb: client: fix memory leak in cifs_construct_tcon() +- !20002 CVE-2025-40328 +- !19999 smb: client: fix potential cfid UAF in smb2_query_info_compound +- !19998 cifs: client: fix memory leak in smb3_fs_context_parse_param +- !20094 CVE-2025-40099 +- !20089 smb: client: Fix refcount leak for cifs_sb_tlink +- !20088 ceph: fix race condition validating r_parent before applying state +- !20086 smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path +- !20081 CVE-2025-39798 +- !20078 NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() +- !20077 NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN +- !20075 smb: client: fix potential deadlock when reconnecting channels +- !20074 smb: client: add NULL check in automount_fullpath +- !20071 smb: client: Avoid race in open_cached_dir with lease breaks +- !19945 fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds +- !19021 memcg: enable asynchronous reclaim for cgroup-v2 +- net/oenetcls: add a switch to enable/disable checking NIC ntuple feature +- net/oenetcls: Balancing softirq to improve performance +- perf/x86/amd: Check event before enable to avoid GPF +- af_unix: Initialise scc_index in unix_add_edge(). +- wifi: rtw89: avoid circular locking dependency in ser_state_run() +- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" +- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() +- Revert "cpuidle: menu: Avoid discarding useful information" +- cpuidle: governors: menu: Avoid using invalid recent intervals data +- ASoC: ops: dynamically allocate struct snd_ctl_elem_value +- cpufreq: tegra186: Set target frequency for all cpus in policy +- Revert "mmc: sdhci: Disable SD card clock before changing parameters" +- soc: qcom: smp2p: Fix fallback to qcom,ipc parse +- rpmsg: qcom_smd: Fix fallback to qcom,ipc parse +- Revert "SUNRPC: Don't allow waiting for exiting tasks" +- nvmem: imx-ocotp: fix MAC address byte length +- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() +- ksmbd: use list_first_entry_or_null for opinfo_get_list() +- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info +- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys +- NFS: Avoid flushing data while holding directory locks in nfs_rename() +- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro +- spi: spi-sun4i: fix early activation +- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure +- drm/amd/display: fix link_set_dpms_off multi-display MST corner case +- um: let 'make clean' properly clean underlying SUBARCH as well +- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS +- nfs: don't share pNFS DS connections between net namespaces +- HID: quirks: Add ADATA XPG alpha wireless mouse support +- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open +- coredump: fix error handling for replace_fd() +- perf/arm-cmn: Initialise cmn->cpu earlier +- perf/arm-cmn: Fix REQ2/SNP2 mixup +- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy +- arm64: dts: qcom: sm8550: Add missing properties for cryptobam +- arm64: dts: qcom: sm8450: Add missing properties for cryptobam +- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node +- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam +- af_unix: Fix uninit-value in __unix_walk_scc() +- af_unix: Fix garbage collection of embryos carrying OOB with SCM_RIGHTS +- af_unix: Add dead flag to struct scm_fp_list. +- af_unix: Don't access successor in unix_del_edges() during GC. +- af_unix: Try not to hold unix_gc_lock during accept(). +- af_unix: Remove lock dance in unix_peek_fds(). +- af_unix: Replace garbage collection algorithm. +- af_unix: Detect dead SCC. +- af_unix: Assign a unique index to SCC. +- af_unix: Avoid Tarjan's algorithm if unnecessary. +- af_unix: Skip GC if no cycle exists. +- af_unix: Save O(n) setup of Tarjan's algo. +- af_unix: Fix up unix_edge.successor for embryo socket. +- af_unix: Save listener for embryo socket. +- af_unix: Detect Strongly Connected Components. +- af_unix: Iterate all vertices by DFS. +- af_unix: Bulk update unix_tot_inflight/unix_inflight when queuing skb. +- af_unix: Link struct unix_edge when queuing skb. +- af_unix: Allocate struct unix_edge for each inflight AF_UNIX fd. +- af_unix: Allocate struct unix_vertex for each inflight AF_UNIX fd. +- af_unix: Remove CONFIG_UNIX_SCM. +- af_unix: Remove io_uring code for GC. +- af_unix: Replace BUG_ON() with WARN_ON_ONCE(). +- af_unix: Try to run GC async. +- af_unix: Run GC on only one CPU. +- af_unix: Return struct unix_sock from unix_get_socket(). +- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ +- drm/gem: Internally test import_attach for imported objects +- x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers +- i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() +- pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group() +- watchdog: aspeed: fix 64-bit division +- serial: sh-sci: Save and restore more registers +- highmem: add folio_test_partial_kmap() +- spi: spi-fsl-dspi: Reset SR flags before sending a new message +- spi: spi-fsl-dspi: Halt the module after a new message transfer +- spi: spi-fsl-dspi: restrict register range for regmap access +- Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection" +- Input: xpad - add more controllers +- smb: client: Reset all search buffer pointers when releasing buffer +- arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs +- smb: client: Fix use-after-free in cifs_fill_dirent +- drm/edid: fixed the bug that hdr metadata was not reset +- thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature +- can: kvaser_pciefd: Continue parsing DMA buf after dropped RX +- llc: fix data loss when reading from a socket in llc_ui_recvmsg() +- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 +- ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction +- ASoc: SOF: topology: connect DAI to a single DAI link +- ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext +- can: slcan: allow reception of short error messages +- clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe() +- octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG +- octeontx2-af: Set LMT_ENA bit for APR table entries +- octeontx2-pf: Add AF_XDP non-zero copy support +- io_uring: fix overflow resched cqe reordering +- net: lan743x: Restore SGMII CTRL register on resume +- net: dwmac-sun8i: Use parsed internal PHY address instead of 1 +- pinctrl: qcom: switch to devm_register_sys_off_handler() +- pinctrl: qcom/msm: Convert to platform remove callback returning void +- ice: Fix LACP bonds without SRIOV environment +- ice: fix vf->num_mac count with port representors +- bridge: netfilter: Fix forwarding of fragmented packets +- Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling +- dmaengine: fsl-edma: Fix return code for unhandled interrupts +- dmaengine: idxd: Fix ->poll() return value +- xfrm: Sanitize marks before insert +- clk: sunxi-ng: d1: Add missing divider for MMC mod clocks +- remoteproc: qcom_wcnss: Fix on platforms without fallback regulators +- dmaengine: idxd: Fix allowing write() from different address spaces +- soundwire: bus: Fix race on the creation of the IRQ domain +- xenbus: Allow PVH dom0 a non-local xenstore +- wifi: iwlwifi: add support for Killer on MTL +- tools: ynl-gen: validate 0 len strings from kernel +- cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function +- cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info() +- io_uring/fdinfo: annotate racy sq/cq head/tail reads +- nvme-pci: add quirks for WDC Blue SN550 15b7:5009 +- nvme-pci: add quirks for device 126f:1001 +- ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx +- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 +- ASoC: cs42l43: Disable headphone clamps during type detection +- pinctrl: meson: define the pull up/down resistor value as 60 kOhm +- book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n +- ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() +- drm: Add valid clones check +- drm/panel-edp: Add Starry 116KHD024006 +- drm/atomic: clarify the rules around drm_atomic_state->allow_modeset +- drm: bridge: adv7511: fill stream capabilities +- wifi: ath12k: Fix end offset bit definition in monitor ring descriptor +- wifi: ath9k: return by of_get_mac_address +- accel/qaic: Mask out SR-IOV PCI resources +- wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override +- regulator: ad5398: Add device tree support +- spi: zynqmp-gqspi: Always acknowledge interrupts +- wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet +- wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate +- wifi: rtl8xxxu: retry firmware download on error +- perf/amd/ibs: Fix ->config to sample period calculation for OP PMU +- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt +- firmware: arm_scmi: Relax duplicate name constraint across protocol ids +- bpftool: Fix readlink usage in get_fd_type +- drm/ast: Find VBIOS mode from regular display size +- ASoC: rt722-sdca: Add some missing readable registers +- ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode +- arm64: zynqmp: add clock-output-names property in clock nodes +- HID: usbkbd: Fix the bit shift number for LED_KANA +- wifi: ath12k: Avoid napi_sync() before napi_enable() +- scsi: st: Restore some drive settings after reset +- scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine +- net/mana: fix warning in the writer of client oob +- ice: count combined queues using Rx/Tx count +- rcu: fix header guard for rcu_all_qs() +- rcu: handle unstable rdp in rcu_read_unlock_strict() +- rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y +- ice: treat dyn_allowed only as suggestion +- bridge: mdb: Allow replace of a host-joined group +- r8169: don't scan PHY addresses > 0 +- ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only +- vxlan: Annotate FDB data races +- media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available +- f2fs: introduce f2fs_base_attr for global sysfs entries +- hwmon: (xgene-hwmon) use appropriate type for the latency value +- clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs +- wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU +- wifi: rtw88: Fix download_firmware_validate() for RTL8814AU +- ext4: remove writable userspace mappings before truncating page cache +- ext4: don't write back data before punch hole in nojournal mode +- leds: trigger: netdev: Configure LED blink interval for HW offload +- pstore: Change kmsg_bytes storage size to u32 +- r8152: add vendor/device ID pair for Dell Alienware AW1022z +- ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). +- arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src +- powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory +- net: fec: Refactor MAC reset to function +- wifi: mac80211: remove misplaced drv_mgd_complete_tx() call +- wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() +- drm/v3d: Add clock handling +- net/mlx5e: reduce the max log mpwrq sz for ECPF and reps +- net/mlx5e: reduce rep rxq depth to 256 for ECPF +- net/mlx5e: set the tx_queue_len for pfifo_fast +- net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB +- scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr() +- drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer() +- drm/amdgpu: enlarge the VBIOS binary size limit +- drm/amd/display: Initial psr_version with correct setting +- drm/amd/display: Update CR AUX RD interval interpretation +- drm/amdgpu: reset psp->cmd to NULL after releasing the buffer +- drm/amd/display: Don't try AUX transactions on disconnected link +- drm/amdgpu: Set snoop bit for SDMA for MI series +- soundwire: amd: change the soundwire wake enable/disable sequence +- phy: core: don't require set_mode() callback for phy_get_mode() to work +- serial: sh-sci: Update the suspend/resume support +- sched: Reduce the default slice to avoid tasks getting an extra tick +- x86/traps: Cleanup and robustify decode_bug() +- clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate +- clk: qcom: ipq5018: allow it to be bulid on arm32 +- net/mlx4_core: Avoid impossible mlx4_db_alloc() order value +- media: v4l: Memset argument to 0 before calling get_mbus_config pad op +- media: i2c: imx219: Correct the minimum vblanking value +- kunit: tool: Use qboot on QEMU x86_64 +- smack: Revert "smackfs: Added check catlen" +- smack: recognize ipv4 CIPSO w/o categories +- pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map +- ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() +- ASoC: tas2764: Power up/down amp on mute ops +- ASoC: tas2764: Mark SW_RESET as volatile +- ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG +- ASoC: ops: Enforce platform maximum on initial value +- firmware: arm_ffa: Reject higher major version as incompatible +- net/mlx5: Apply rate-limiting to high temperature warning +- net/mlx5: Modify LSB bitmask in temperature event to include only the first bit +- media: test-drivers: vivid: don't call schedule in loop +- vxlan: Join / leave MC group after remote changes +- PCI: Fix old_size lower bound in calculate_iosize() too +- eth: mlx4: don't try to complete XDP frames in netpoll +- bpf: don't do clean_live_states when state->loop_entry->branches > 0 +- can: c_can: Use of_property_present() to test existence of DT property +- pmdomain: imx: gpcv2: use proper helper for property detection +- RDMA/core: Fix best page size finding when it can cross SG entries +- drm/amd/display: Add support for disconnected eDP streams +- i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA) +- EDAC/ie31200: work around false positive build warning +- wifi: rtw89: fw: propagate error code from rtw89_h2c_tx() +- wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 +- wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU +- wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU +- scsi: mpt3sas: Send a diag reset if target reset fails +- clocksource: mips-gic-timer: Enable counter when CPUs start +- MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core +- MIPS: Use arch specific syscall name match function +- crypto: skcipher - Zap type in crypto_alloc_sync_skcipher +- x86/kaslr: Reduce KASLR entropy on most x86 systems +- net/mlx5: Change POOL_NEXT_SIZE define value and make it global +- libbpf: Fix out-of-bound read +- media: tc358746: improve calculation of the D-PHY timing registers +- media: adv7180: Disable test-pattern control on adv7180 +- cpuidle: menu: Avoid discarding useful information +- vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines +- vhost-scsi: Return queue full for page alloc failures during copy +- x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus() +- ASoC: mediatek: mt8188: Add reference for dmic clocks +- ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile +- drm/amd/display: handle max_downscale_src_width fail check +- x86/build: Fix broken copy command in genimage.sh when making isoimage +- Octeontx2-af: RPM: Register driver with PCI subsys IDs +- soc: ti: k3-socinfo: Do not use syscon helper to build regmap +- wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band +- bonding: report duplicate MAC address in all situations +- net: xgene-v2: remove incorrect ACPI_PTR annotation +- net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only +- leds: pwm-multicolor: Add check for fwnode_property_read_u32 +- drm/amdkfd: KFD release_work possible circular locking +- selftests/net: have `gro.sh -t` return a correct exit code +- net/mlx5: Avoid report two health errors on same syndrome +- firmware: arm_ffa: Set dma_mask for ffa devices +- PCI: brcmstb: Add a softdep to MIP MSI-X driver +- PCI: brcmstb: Expand inbound window size up to 64GB +- wifi: ath12k: Report proper tx completion status to mac80211 +- soc: apple: rtkit: Implement OSLog buffers properly +- soc: apple: rtkit: Use high prio work queue +- fpga: altera-cvp: Increase credit timeout +- drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence +- ARM: at91: pm: fix at91_suspend_finish for ZQ calibration +- hwmon: (gpio-fan) Add missing mutex locks +- x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 +- clk: imx8mp: inform CCF of maximum frequency of clocks +- media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value +- media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map +- drm/rockchip: vop2: Add uv swap for cluster window +- ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). +- ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7 +- perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type +- net: pktgen: fix mpls maximum labels list parsing +- net: ethernet: ti: cpsw_new: populate netdev of_node +- pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" +- drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination +- drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c +- remoteproc: qcom_wcnss: Handle platforms with only single power domain +- net: phylink: use pl->link_interface in phylink_expects_phy() +- drm/gem: Fix kabi-breakage for drm +- powerpc/kexec: Enable SMT before waking offline CPUs +- tracing: Fix enabling of tracing on file release +- iavf: fix off-by-one issues in iavf_config_rss_reg() +- e1000: fix OOB in e1000_tbi_should_accept() +- tracing: Do not register unsupported perf events +- fuse: fix readahead reclaim deadlock +- fuse: fix io-uring list corruption for terminated non-committed requests +- fuse: missing copy_finish in fuse-over-io-uring argument copies +- fsnotify: do not generate ACCESS/MODIFY events on child for special files +- mlxsw: spectrum_router: Fix neighbour use-after-free +- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats +- drm/gem: Test for imported GEM buffers with helper +- ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() +- NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags +- media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() +- ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 +- ieee802154: ca8210: Use proper setters and getters for bitwise types +- rtc: ds1307: stop disabling alarms on probe +- tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() +- ALSA: seq: Improve data consistency at polling +- powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 +- arm64: tegra: Resize aperture for the IGX PCIe C5 slot +- arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator +- drm/amdkfd: Set per-process flags only once cik/vi +- watchdog: aspeed: Update bootstatus handling +- cpufreq: tegra186: Share policy per cluster +- iommu/amd/pgtbl_v2: Improve error handling +- ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() +- auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" +- gfs2: Check for empty queue in run_queue +- drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch +- drm/amd/display: calculate the remain segments for all pipes +- drm/amd/display: remove minimum Dispclk and apply oem panel timing. +- ipv6: save dontfrag in cork +- printk: Check CON_SUSPEND when unblanking a console +- hwmon: (dell-smm) Increment the number of fans +- usb: xhci: Don't change the status of stalled TDs on failed Stop EP +- mmc: sdhci: Disable SD card clock before changing parameters +- mmc: dw_mmc: add exynos7870 DW MMC support +- arm64/mm: Check PUD_TYPE_TABLE in pud_bad() +- netfilter: conntrack: Bound nf_conntrack sysctl writes +- timer_list: Don't use %pK through printk() +- posix-timers: Add cond_resched() to posix_timer_add() search loop +- RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() +- ext4: do not convert the unwritten extents if data writeback fails +- ext4: reject the 'data_err=abort' option in nojournal mode +- ASoC: sun4i-codec: support hp-det-gpios property +- drm/amdgpu: Update SRIOV video codec caps +- mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check +- pinctrl-tegra: Restore SFSEL bit when freeing pins +- xen: Add support for XenServer 6.1 platform device +- net/smc: use the correct ndev to find pnetid by pnetid table +- dm: restrict dm device size to 2^63-512 bytes +- crypto: octeontx2 - suppress auth failure screaming due to negative tests +- kbuild: fix argument parsing in scripts/config +- ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect +- thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer +- objtool: Fix error handling inconsistencies in check() +- rtc: rv3032: fix EERD location +- tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() +- jbd2: do not try to recover wiped journal +- bpf: Return prog btf_id without capable check +- vfio/pci: Handle INTx IRQ_NOTCONNECTED +- scsi: st: ERASE does not change tape location +- scsi: st: Tighten the page format heuristics with MODE SELECT +- hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure +- ext4: reorder capability check last +- um: Update min_low_pfn to match changes in uml_reserved +- um: Store full CSGSFS and SS register from mcontext +- dlm: make tcp still work in multi-link env +- i3c: master: svc: Fix missing STOP for master request +- drm/amd/display: Guard against setting dispclk low for dcn31x +- btrfs: send: return -ENAMETOOLONG when attempting a path that is too long +- btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() +- btrfs: fix non-empty delayed iputs list on unmount due to async workers +- btrfs: run btrfs_error_commit_super() early +- btrfs: avoid linker error in btrfs_find_create_tree_block() +- btrfs: make btrfs_discard_workfn() block_group ref explicit +- i2c: pxa: fix call balance of i2c->clk handling routines +- i2c: qup: Vote for interconnect bandwidth to DRAM +- x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP +- wifi: mt76: mt7996: revise TXS size +- wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 +- mmc: host: Wait for Vdd to settle on card power off +- ext4: on a remount, only log the ro or r/w state when it has changed +- PCI: vmd: Disable MSI remapping bypass under Xen +- pNFS/flexfiles: Report ENETDOWN as a connection error +- tools/build: Don't pass test log files to linker +- PCI: dwc: ep: Ensure proper iteration over outbound map windows +- objtool: Properly disable uaccess validation +- lockdep: Fix wait context check on softirq for PREEMPT_RT +- dql: Fix dql->limit value when reset. +- thermal/drivers/qoriq: Power down TMU on system suspend +- SUNRPC: rpcbind should never reset the port to the value '0' +- SUNRPC: rpc_clnt_set_transport() must not change the autobind setting +- NFSv4: Treat ENETUNREACH errors as fatal for state recovery +- cifs: Fix establishing NetBIOS session for SMB2+ connection +- cifs: add validation check for the fields in smb_aces +- fbdev: core: tileblit: Implement missing margin clearing for tileblit +- fbcon: Use correct erase colour for clearing in fbcon +- fbdev: fsl-diu-fb: add missing device_remove_file() +- riscv: Allow NOMMU kernels to access all of RAM +- mailbox: use error ret code of of_parse_phandle_with_args() +- ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list +- tracing: Mark binary printing functions with __printf() attribute +- SUNRPC: Don't allow waiting for exiting tasks +- NFS: Don't allow waiting for exiting tasks +- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() +- fuse: Return EPERM rather than ENOSYS from link() +- cifs: Fix negotiate retry functionality +- cifs: Fix querying and creating MF symlinks over SMB1 +- cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES +- s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log +- kconfig: merge_config: use an empty file as initfile +- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora +- bpf: fix possible endless loop in BPF map iteration +- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure +- drm/amdgpu: Allow P2P access through XGMI +- ima: process_measurement() needlessly takes inode_lock() on MAY_READ +- net: enetc: refactor bulk flipping of RX buffers to separate function +- scsi: mpi3mr: Add level check to control event logging +- cgroup: Fix compilation issue due to cgroup_mutex not being exported +- dma-mapping: avoid potential unused data compilation warning +- intel_th: avoid using deprecated page->mapping, index fields +- scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices +- nvmem: qfprom: switch to 4-byte aligned reads +- nvmem: core: update raw_len if the bit reading is required +- nvmem: core: verify cell's raw_len +- nvmem: rockchip-otp: add rk3576 variant data +- nvmem: rockchip-otp: Move read-offset into variant-data +- cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist +- phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off +- phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data +- phy: renesas: rcar-gen3-usb2: Move IRQ request in probe +- phy: renesas: rcar-gen3-usb2: Add support to initialize the bus +- i2c: designware: Fix an error handling path in i2c_dw_pci_probe() +- i2c: designware: Use temporary variable for struct device +- i2c: designware: Remove ->disable() callback +- i2c: designware: Uniform initialization flow for polling mode +- gpio: pca953x: fix IRQ storm on system wake up +- gpio: pca953x: Simplify code with cleanup helpers +- gpio: pca953x: Split pca953x_restore_context() and pca953x_save_context() +- macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse +- xsched: Add XSched manual +- x86/sev: merge continuous pages into a large range when notifying range enc status changes +- cifs: parse_dfs_referrals: prevent oob on malformed input +- smb: client: fix return value of parse_dfs_referrals() +- smb: client: Fix refcount leak for cifs_sb_tlink +- ceph: fix race condition validating r_parent before applying state +- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path +- NFSv4: Don't clear capabilities that won't be reset +- NFS: Fix the setting of capabilities when automounting a new filesystem +- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() +- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN +- smb3: fix for slab out of bounds on mount to ksmbd +- smb: client: fix potential deadlock when reconnecting channels +- smb: client: add NULL check in automount_fullpath +- smb: client: Avoid race in open_cached_dir with lease breaks +- ub: cdma: jfs 64K page table memory adaptation +- ub: cdma: ELR code refactoring +- ub: cdma: add some log print +- net/mdiobus: Fix potential out-of-bounds read/write access +- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access +- net: phy: clear phydev->devlink when the link is deleted +- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation +- drm/sysfb: Do not dereference NULL pointer in plane reset +- binfmt_misc: restore write access before closing files opened by open_exec() +- RDMA/rxe: Fix null deref on srq->rq.queue after resize failure +- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind +- perf/x86/intel/cstate: Add Clearwater Forest support +- perf/x86/intel/cstate: Add pkg C2 residency counter for Sierra Forest +- perf/x86/intel: Add missing MODULE_DESCRIPTION() lines +- perf/x86/intel/cstate: Switch to new Intel CPU model defines +- irqchip/gic-v4.1: Use local 4_1 ITS to generate VSGI +- ext4: fix e4b bitmap inconsistency reports +- x86/csv: Enhance CMA memory usage reporting for CSV3 +- smb: client: fix incomplete backport in cfids_invalidation_worker() +- smb: client: fix potential UAF in smb2_close_cached_fid() +- smb: client: fix memory leak in cifs_construct_tcon() +- cifs: fix memory leak in smb3_fs_context_parse_param error path +- smb: client: fix potential cfid UAF in smb2_query_info_compound +- cifs: client: fix memory leak in smb3_fs_context_parse_param +- net: netpoll: fix incorrect refcount handling causing incorrect cleanup +- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe +- net: ipv6: fix field-spanning memcpy warning in AH output +- Fix SDEI state machine issue during reboot process +- Add sdei interface to check event status +- proc: fix type confusion in pde_set_flags() +- proc: fix missing pde_set_flags() for net proc files +- udp_tunnel: use netdev_warn() instead of netdev_WARN() +- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ +- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead +- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() +- net/mlx5: Clean up only new IRQ glue on request_irq() failure +- Bluetooth: MGMT: cancel mesh send timer when hdev removed +- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds +- nbd: defer config unlock in nbd_genl_connect +- nbd: defer config put in recv_work +- md: fix rcu protection in md_wakeup_thread +- nvme-multipath: fix lockdep WARN due to partition scan work +- blk-cgroup: fix possible deadlock while configuring policy +- usbnet: Prevents free active kevent +- scsi: sg: Do not sleep in atomic context +- ima: Handle error code returned by ima_filter_rule_match() +- erofs: avoid infinite loops due to corrupted subpage compact indexes +- scsi: bfa: Double-free fix +- mISDN: hfcpci: Fix warning when deleting uninitialized timer +- jfs: truncate good inode pages when hard link is 0 +- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() +- hfsplus: remove mutex_lock check in hfsplus_free_extents +- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() +- mm/khugepaged: use KMEM_CACHE() +- mm/ksm: cleanup mm_slot_entry() invocation +- mm/khugepaged: remove definition of struct khugepaged_mm_slot +- mm/ksm: get mm_slot by mm_slot_entry() when slot is !NULL +- mm/khugepaged: use list_xxx() helper to improve readability +- khugepaged: simplify the allocation of slab caches +- mm/khugepaged: fix comment for default scan sleep duration +- NFSD: free copynotify stateid in nfs4_free_ol_stateid() +- NFSD: fix race between nfsd registration and exports_proc +- ksmbd: fix refcount leak causing resource not released +- NFSD: Define a proc_layoutcommit for the FlexFiles layout type +- platform/x86: intel-uncore-freq: fix all header kernel-doc warnings +- platform/x86/intel: power-domains: Fix error code in tpmi_init() +- platform/x86/intel-uncore-freq: Present unique domain ID per package +- platform/x86/intel-uncore-freq: Fix warning in partitioned system +- platform/x86/intel-uncore-freq: avoid non-literal format string +- Documentation: admin-guide: pm: Add documentation for die_id +- platform/x86/intel-uncore-freq: Add attributes to show die_id +- platform/x86/intel: power-domains: Add interface to get Linux die ID +- Documentation: admin-guide: pm: Add documentation for agent_types +- platform/x86/intel-uncore-freq: Add attributes to show agent types +- mptcp: Fix proto fallback detection with BPF +- memcg: enable asynchronous reclaim for cgroup-v2 +- memcg: change CONFIG_MEMCG_V1_RECLAIM to CONFIG_MEMCG_QOS +- x86/kvm: expose CPUID 0xC000_0000 for Zhaoxin "Shanghai" vendor +- perf mem/c2c: Add load store event mapping for Hygon + +* Fri Jan 23 2026 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-135.0.0.114 +- riscv kernel upgrade to 6.6.0-135.0.0 +- Revert "mango pci hack:broadcast when no MSI source known" +- serial: 8250_core: Remove unneeded ->iotype assignment +- riscv: openeuler_defconfig: Enable PCIE_EDR +- iommu/riscv: Fix inconsistencies with the latest spec revision V2 +- Enable gade when iommu has AMO_HWAD cap +- riscv: openeuler_defconfig: Enable more ACPI_APEI configs +- Optimize uaccess for riscv +- Fix k1 boot failed with mmc error +- Add SDHCI and GMAC support for Spacemit K3 + +* Wed Jan 21 2026 Li Nan <linan122@huawei.com> - 6.6.0-135.0.0.113 +- !19710 [OLK-6.6] Batch BAR sizing operations +- !19952 mfs: Add prefetch demo +- !20138 net:nebula-matrix:add protection of consecutive write regs +- !20033 ceph: fix crash in process_v2_sparse_read() for encrypted directories +- !20032 net: atlantic: fix fragment overflow handling in RX path +- !20031 Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once +- !20014 xfs: do not propagate ENODATA disk errors into xattr code +- !20015 Fix CVE-2025-40242 +- !19960 wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() +- !20005 cifs: Fix establishing NetBIOS session for SMB2+ connection +- !20009 ftrace: Fix BPF fexit with livepatch +- !19983 regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex +- !19968 EEVDF null pointer +- !19773 bpf, arm64: Do not audit capability check in do_jit() +- !19997 mfs: remove FAROUND event for mfsd demo +- !19942 [virtCCA Live Migration 1]virtcca secure cvm supports live migration +- !20160 v3 CVE-2025-68304 +- !20141 urma: Fix the bug of exposing devices fails for host network +- !20148 ubcore: fix route query for container loopback. +- !20120 urma: fix urma_admin agg del eid failed. +- !20028 release urma source when the ub device is removed +- !20017 kernfs: Don't re-lock kernfs_root::kernfs_rwsem in kernfs_fop_readdir(). +- !20115 KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer +- !20109 uvb: change cis call default poll timeout +- urma: fix the bug for container. +- !20154 merge fix_is_err into OLK-6.6 +- Bluetooth: hci_core: lookup hci_conn on RX path on protocol side +- Bluetooth: ISO: don't leak skb in ISO_CONT RX +- Bluetooth: ISO: free rx_skb if not consumed +- Bluetooth: ISO: Use kref to track lifetime of iso_conn +- Bluetooth: SCO: fix sco_conn refcounting on sco_conn_ready +- Bluetooth: SCO: remove the redundant sco_conn_put +- Bluetooth: SCO: Use kref to track lifetime of sco_conn +- Bluetooth: hci_core: Fix not checking skb length on hci_scodata_packet +- urma: fix ubcore_cock NULL pointer check. +- ubcore: fix route query for container loopback. +- net:nebula-matrix:add protection of consecutive write regs +- urma: fix urma_admin agg del eid failed. +- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer +- !20100 merge OLK-6.6-v6.6.92-backport into OLK-6.6 +- uvb: change cis call default poll timeout +- dmaengine: idxd: Fix double free in idxd_setup_wqs() +- dmaengine: idxd: Fix refcount underflow on module unload +- dmaengine: idxd: Remove improper idxd_free +- fs/xattr.c: fix simple_xattr_list() +- firmware: arm_scmi: Account for failed debug initialization +- drm/amdgpu: fix pm notifier handling +- LoongArch: Explicitly specify code model in Makefile +- usb: typec: ucsi: displayport: Fix deadlock +- mm/page_alloc: fix race condition in unaccepted memory handling +- dmaengine: idxd: Refactor remove call with idxd_cleanup() helper +- dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe +- dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call +- dmaengine: idxd: Add missing cleanups in cleanup internals +- dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals +- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups +- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines +- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs +- dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy +- net: qede: Initialize qede_ll_ops with designated initializer +- smb: client: fix memory leak during error handling for POSIX mkdir +- scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer +- phy: renesas: rcar-gen3-usb2: Set timing registers only once +- phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind +- phy: Fix error handling in tegra_xusb_port_init +- phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking +- tracing: samples: Initialize trace_array_printk() with the correct function +- Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer() +- Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges +- hv_netvsc: Remove rmsg_pgcnt +- hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages +- ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera +- ALSA: usb-audio: Add sample rate quirk for Audioengine D1 +- ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() +- drm/amd/display: Avoid flooding unnecessary info messages +- drm/amd/display: Correct the reply value when AUX write incomplete +- LoongArch: Fix MAX_REG_OFFSET calculation +- udf: Make sure i_lenExtents is uptodate on inode eviction +- NFSv4/pnfs: Reset the layout state after a layoutreturn +- tsnep: fix timestamping with a stacked DSA driver +- tsnep: Inline small fragments within TX descriptor +- octeontx2-af: Fix CGX Receive counters +- net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability +- octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy +- qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() +- ALSA: sh: SND_AICA should depend on SH_DMA_API +- nvme-pci: make nvme_pci_npages_prp() __always_inline +- net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING +- ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info +- ALSA: seq: Fix delivery of UMP events to group ports +- net: mctp: Ensure keys maintain only one ref to corresponding dev +- tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing +- tools: ynl: ethtool.py: Output timestamping statistics from tsinfo-get operation +- Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags +- spi: loopback-test: Do not split 1024-byte hexdumps +- HID: thrustmaster: fix memory leak in thrustmaster_interrupts() +- iio: chemical: sps30: use aligned_s64 for timestamp +- iio: adc: ad7768-1: Fix insufficient alignment of timestamp. +- Revert "drm/amd: Stop evicting resources on APUs in suspend" +- drm/amd: Add Suspend/Hibernate notification callback support +- drm/amdgpu: trigger flr_work if reading pf2vf data failed +- drm/amdgpu: Fix the runtime resume failure issue +- drm/amd: Stop evicting resources on APUs in suspend +- iio: adc: ad7266: Fix potential timestamp alignment issue. +- firmware: arm_scmi: Fix timeout checks on polling path +- firmware: arm_scmi: Track basic SCMI communication debug metrics +- firmware: arm_scmi: Add support for debug metrics at the interface +- firmware: arm_scmi: Add message dump traces for bad and unexpected replies +- firmware: arm_scmi: Add helper to trace bad messages +- tpm: tis: Double the timeout B to 4s +- cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks +- platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection +- platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL) +- binfmt_elf: Move brk for static PIE even if ASLR disabled +- binfmt_elf: Honor PT_LOAD alignment for static PIE +- binfmt_elf: Calculate total_size earlier +- selftests/exec: Build both static and non-static load_address tests +- binfmt_elf: Leave a gap between .bss and brk +- selftests/exec: load_address: conform test to TAP format output +- binfmt_elf: elf_bss no longer used by load_elf_binary() +- binfmt_elf: Support segments with 0 filesz and misaligned starts +- fs/xattr.c: fix simple_xattr_list to always include security.* xattrs +- !20080 merge OLK-6.6 into OLK-6.6 +- ubcore: fix netdev size limit error. +- !19254 merge refs/pull/19254/head into OLK-6.6 +- drivers/ub/sentry: release urma source when the ub device is removed +- ceph: fix crash in process_v2_sparse_read() for encrypted directories +- net: atlantic: fix fragment overflow handling in RX path +- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once +- kernfs: Don't re-lock kernfs_root::kernfs_rwsem in kernfs_fop_readdir(). +- gfs2: Fix unlikely race in gdlm_put_lock +- gfs2: Add proper lockspace locking +- xfs: do not propagate ENODATA disk errors into xattr code +- ftrace: Fix BPF fexit with livepatch +- cifs: Fix establishing NetBIOS session for SMB2+ connection +- mfs: remove FAROUND event for mfsd demo +- [virtCCA Live Migration 1]virtcca secure cvm supports live migration +- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex +- sched: Fix kabi breakage of struct cfs_rq for zero_vruntime +- sched/eevdf: Fix min_vruntime vs avg_vruntime +- sched/core: Add comment explaining force-idle vruntime snapshots +- sched/fair: Forfeit vruntime on yield +- Revert "sched/fair: Only increment deadline once on yield" +- sched: Fix kabi breakage of struct cfs_rq for min_vruntime_copy +- sched/eevdf: Remove min_vruntime_copy +- sched: Fix kabi breakage of struct sched_entity for on_rq and rel_deadline +- sched/fair: Avoid re-setting virtual deadline on 'migrations' +- sched/balancing: Change comment formatting to not overlap Git conflict marker lines +- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() +- mfs: Add prefetch demo +- bpf, arm64: Do not audit capability check in do_jit() +- PCI: Batch BAR sizing operations +- bpf: Do not audit capability check in do_jit() +- usb: usbtmc: Fix read_stb function and get_stb ioctl +- staging: axis-fifo: fix TX handling on copy_from_user() failure +- staging: axis-fifo: flush RX FIFO on read errors +- staging: axis-fifo: fix maximum TX packet length check +- ksmbd: fix stream write failure +- netfilter: ipset: Remove unused htable_bits in macro ahash_region +- Documentation: x86/bugs/its: Add ITS documentation +- x86/speculation: Remove the extra #ifdef around CALL_NOSPEC +- x86/speculation: Add a conditional CS prefix to CALL_NOSPEC +- x86/speculation: Simplify and make CALL_NOSPEC consistent +- x86/bhi: Do not set BHI_DIS_S in 32-bit mode +- x86/bpf: Add IBHF call at end of classic BPF +- x86/bpf: Call branch history clearing sequence on exit +- io_uring: ensure deferred completions are posted for multishot +- io_uring: always arm linked timeouts prior to issue +- do_umount(): add missing barrier before refcount checks in sync case +- drm/panel: simple: Update timings for AUO G101EVN010 +- MIPS: Fix MAX_REG_OFFSET +- iio: adc: dln2: Use aligned_s64 for timestamp +- iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 +- types: Complement the aligned types with signed 64-bit one +- iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer. +- iio: accel: adxl367: fix setting odr for activity time update +- usb: usbtmc: Fix erroneous generic_read ioctl return +- usb: usbtmc: Fix erroneous wait_srq ioctl return +- usb: usbtmc: Fix erroneous get_stb ioctl error returns +- USB: usbtmc: use interruptible sleep in usbtmc_read +- usb: typec: ucsi: displayport: Fix NULL pointer access +- usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition +- usb: host: tegra: Prevent host controller crash when OTG port is used +- usb: gadget: Use get_status callback to set remote wakeup capability +- usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN +- usb: gadget: f_ecm: Add get_status callback +- usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version +- usb: cdnsp: Fix issue with resuming from L1 +- ocfs2: stop quota recovery before disabling quotas +- ocfs2: implement handshaking with ocfs2 recovery thread +- ocfs2: switch osb->disable_recovery to enum +- clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() +- xenbus: Use kref to track req lifetime +- xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it +- smb: client: Avoid race in open_cached_dir with lease breaks +- usb: uhci-platform: Make the clock really optional +- drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush +- drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush +- drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush +- drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush +- drm/amd/display: Copy AUX read reply data whenever length > 0 +- drm/amd/display: Fix wrong handling for AUX_DEFER case +- drm/amd/display: Remove incorrect checking in dmub aux handler +- drm/amd/display: Fix the checking condition in dmub aux handling +- iio: adis16201: Correct inclinometer channel resolution +- iio: adc: rockchip: Fix clock initialization sequence +- iio: adc: ad7606: fix serial register access +- drm/amd/display: Shift DMUB AUX reply command if necessary +- staging: axis-fifo: Correct handling of tx_fifo_depth for size validation +- staging: axis-fifo: Remove hardware resets for user errors +- staging: iio: adc: ad7816: Correct conditional logic for store mode +- Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 +- Input: synaptics - enable SMBus for HP Elitebook 850 G1 +- Input: synaptics - enable InterTouch on Dell Precision M3800 +- Input: synaptics - enable InterTouch on Dynabook Portege X30L-G +- Input: synaptics - enable InterTouch on Dynabook Portege X30-D +- Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller +- Input: xpad - fix Share button on Xbox One controllers +- Input: mtk-pmic-keys - fix possible null pointer dereference +- Input: cyttsp5 - fix power control issue on wakeup +- Input: cyttsp5 - ensure minimum reset pulse width +- net: dsa: b53: fix learning on VLAN unaware bridges +- net: dsa: b53: always rejoin default untagged VLAN on bridge leave +- net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave +- net: dsa: b53: fix flushing old pvid VLAN on pvid change +- net: dsa: b53: fix clearing PVID of a port +- net: dsa: b53: allow leaky reserved multicast +- netfilter: ipset: fix region locking in hash types +- can: gw: fix RCU/BH usage in cgw_create_job() +- can: mcp251xfd: fix TDC setting for low data bit rates +- net: ethernet: mtk_eth_soc: reset all TX queues on DMA free +- netdevice: add netdev_tx_reset_subqueue() shorthand +- sch_htb: make htb_deactivate() idempotent +- ksmbd: prevent out-of-bounds stream writes by validating *pos +- can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls +- wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation +- can: mcan: m_can_class_unregister(): fix order of unregistration calls +- arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2 +- dm: add missing unlock on in dm_keyslot_evict() + +* Wed Jan 14 2026 Li Nan <linan122@huawei.com> - 6.6.0-134.0.0.112 +- !20054 merge topo_kernel_merge_1_1 into OLK-6.6 +- !19916 merge OLK-6.6_new into OLK-6.6 +- !20030 merge topo_kernel_merge into OLK-6.6 +- urma: ubcore support expose/unexpose dev and eid set commands. +- urma: support uvs query chip_id. +- urma: add create, delete agg_dev and get name of agg_dev. +- urma: adapt to new topo info for ubcore/ubagg. +- !19992 merge patch-1767753584 into OLK-6.6 +- !19763 merge patch-1766378735 into OLK-6.6 +- Revert "NFS: fix up nfs_release_folio() to try to release the page" +- !19697 merge refs/pull/19697/head into OLK-6.6 +- !19844 merge patch-1766802317 into OLK-6.6 +- !19712 merge refs/pull/19712/head into OLK-6.6 +- !19653 merge refs/pull/19653/head into OLK-6.6 +- !19650 merge refs/pull/19650/head into OLK-6.6 +- !19809 merge patch-1766626818 into OLK-6.6 +- !19839 merge patch-1766740817 into OLK-6.6 +- !19924 merge patch-1767513707 into OLK-6.6 +- !19925 merge patch-1767513733 into OLK-6.6 +- !18476 merge refs/pull/18476/head into OLK-6.6 +- !19871 merge patch-1766998564 into OLK-6.6 +- !19870 merge patch-1766998524 into OLK-6.6 +- !19868 merge patch-1766998223 into OLK-6.6 +- !19831 merge patch-1766714417 into OLK-6.6 +- !19830 merge patch-1766713816 into OLK-6.6 +- !19829 merge patch-1766713004 into OLK-6.6 +- !19828 merge patch-1766712979 into OLK-6.6 +- !19827 merge patch-1766712955 into OLK-6.6 +- !19826 merge patch-1766712919 into OLK-6.6 +- !19711 merge refs/pull/19711/head into OLK-6.6 +- !19810 merge patch-1766626870 into OLK-6.6 +- !19843 merge patch-1766799391 into OLK-6.6 +- !19909 merge patch-1767491328 into OLK-6.6 +- !19799 merge patch-1766495417 into OLK-6.6 +- !19807 merge patch-1766567019 into OLK-6.6 +- !19895 merge patch-1767085921 into OLK-6.6 +- !19926 merge patch-1767515451 into OLK-6.6 +- !19656 merge refs/pull/19656/head into OLK-6.6 +- !19923 merge patch-1767513671 into OLK-6.6 +- !19928 merge patch-1767515719 into OLK-6.6 +- !19859 merge patch-1766977633 into OLK-6.6 +- !19860 merge patch-1766977668 into OLK-6.6 +- !19884 merge patch-1767076134 into OLK-6.6 +- !19913 merge patch-1767493335 into OLK-6.6 +- !19914 merge patch-1767493378 into OLK-6.6 +- !19915 merge patch-1767493397 into OLK-6.6 +- mfs: Avoid UAF on cache object when anon_file is release +- mfs: avoid deadlock when the cache layer is modified +- mfs: remove FAROUND event to avoid context switch during map_pages +- !19612 merge refs/pull/19612/head into OLK-6.6 +- !19733 merge refs/pull/19733/head into OLK-6.6 +- !19729 merge refs/pull/19729/head into OLK-6.6 +- !19720 merge refs/pull/19720/head into OLK-6.6 +- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer +- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot +- bpf: Free special fields when update [lru_,]percpu_hash maps +- !19846 merge patch-1766818825 into OLK-6.6 +- !19904 merge patch-1767162173 into OLK-6.6 +- !19845 merge patch-1766818524 into OLK-6.6 +- !19797 merge patch-1766494034 into OLK-6.6 +- !19796 merge patch-1766494001 into OLK-6.6 +- !19800 merge patch-1766541023 into OLK-6.6 +- !19847 merge patch-1766820323 into OLK-6.6 +- !19875 merge patch-1767010708 into OLK-6.6 +- !19761 merge patch-1766371001 into OLK-6.6 +- !19619 merge refs/pull/19619/head into OLK-6.6 +- !19912 merge patch-1767493281 into OLK-6.6 +- net_sched: prio: fix a race in prio_tune() +- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler +- can: j1939: implement NETDEV_UNREGISTER notification handler +- Bluetooth: hci_core: Disable works on hci_unregister_dev +- iomap: fix dirty range tracking in iomap_folio_mkwrite_iter +- mm: mem_reliable: prevent excessive direct reclaim loops +- mm: mem_reliable: use percise count during limit check +- mm: mem_reliable: fix task reliable counter during fork +- !19793 merge patch-1766492701 into OLK-6.6 +- !19823 merge tmp into OLK-6.6 +- !19888 merge ubase into OLK-6.6 +- !19898 merge OLK_6.6_velinux_1 into OLK-6.6 +- !19901 merge OLK-6.6 into OLK-6.6 +- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid +- obmm: Register resource for every memdev +- !19822 merge master into OLK-6.6 +- !19811 merge OLK-6.6 into OLK-6.6 +- !19818 merge OLK-6.6 into OLK-6.6 +- !19854 merge OLK-6.6 into OLK-6.6 +- !19886 merge OLK-6.6 into OLK-6.6 +- ub: ubase: fix ubase activate/deactivate resp timeout +- urma inclusion category: bugfix bugzilla: https://gitee.com/openeuler/release-management/issues/ID3WJX +- bpf: Fix stackmap overflow check in __bpf_get_stackid() +- bpf: Refactor stack map trace depth calculation into helper function +- net: unic: Fix ethtool configuration error issue. +- ub: ubase: Resolve mailbox timeout issue. +- scsi: qla2xxx: Clear cmds after chip reset +- ub: udma: bugfix related to rx close. +- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() +- !19763 ub: udma: bugfix related to spin lock. +- futex: Don't leak robust_list pointer on exec race +- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() +- ub: udma: bugfix related to spin lock. +- Bluetooth: hci_event: validate skb length for unknown CC opcode +- x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() +- tracing: Fix memory leaks in create_field_var() +- ub: udma: Bugfix related to 2M hugepage. +- ppp: fix race conditions in ppp_fill_forward_path +- scsi: qla2xxx: Fix improper freeing of purex item +- coresight: ETR: Fix ETR buffer use-after-free issue +- arm-spe: Fix typos in the arm_spe_to_htpg() +- mm/shmem: Fix order passing error in the shmem_alloc_folio() +- arm64/mpam: Synchronize MPAM Partid to kernel mode +- !19477 iommu: set the default iommu-dma mode as non-strict +- ext4: xattr: fix null pointer deref in ext4_raw_inode() +- jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted +- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock +- ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() +- ext4: refresh inline data size before write operations +- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() +- ub:ubfi:skipped address of subtable 0 in ubrt +- ub:ubus delete undefined class code +- !19760 ub:ubfi:skipped address of subtable 0 in ubrt +- !19758 ub: udma: bugfix related to rx close. +- !19759 ub: ubase: fix ubase activate/deactivate resp timeout +- ub:ubfi:skipped address of subtable 0 in ubrt +- ub: cdma: add ioctl logs and error codes +- ub: ubase: fix ubase activate/deactivate resp timeout +- ub:ubus: fix ub_get_bus_controller getting null +- ub:ubus: Move the decoder's queue operations to hisi-ubus +- ub:ubus: hi_msg_sync_wait first pull cq +- ub: udma: bugfix related to rx close. +- !19752 Repair driver reset work-q uaf +- perf/x86/intel: Fix KASAN global-out-of-bounds warning +- mm: migrate: add dma copy offloading for hugetlb +- !19755 obmm: Register resource for every memdev +- !19756 ub:ubus delete undefined class code +- !19754 ub:ubus: Move the decoder's queue operations to hisi-ubus +- !19757 ub: cdma: add ioctl logs and error codes +- !19750 ub: udma: Bugfix related to 2M hugepage. +- !19749 ub: unic & ubase: Fix ethtool configuration error issue and resolve mailbox timeout +- !19697 iomap: fix dirty range tracking in iomap_folio_mkwrite_iter +- nvmet-fc: avoid scheduling association deletion twice +- ub: cdma: add ioctl logs and error codes +- ub:ubus delete undefined class code +- obmm: Register resource for every memdev +- Repair driver reset work-q uaf +- bpf: Fix invalid prog->stats access when update_effective_progs fails +- ub:ubus: fix ub_get_bus_controller getting null +- ub:ubus: Move the decoder's queue operations to hisi-ubus +- ftrace: Fix softlockup in ftrace_module_enable +- ub:ubus: hi_msg_sync_wait first pull cq +- bpf: account for current allocated stack depth in widen_imprecise_scalars() +- bpf: Add bpf_prog_run_data_pointers() +- iommu: set the default iommu-dma mode as non-strict +- ub: udma: Bugfix related to 2M hugepage. +- net: unic: Fix ethtool configuration error issue. +- ub: ubase: Resolve mailbox timeout issue. +- 删除文件 .本项目已经正式迁移至AtomGit平台/README.md +- update README. +- timers: Fix NULL function pointer race in timer_shutdown_sync() +- x86/fpu: Ensure XFD state on signal delivery +- add migrate not +- usb: storage: Fix memory leak in USB bulk transport +- scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() +- nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing +- nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() +- usb: storage: sddr55: Reject out-of-bound new_pba +- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget +- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode +- be2net: pass wrb_params in case of OS2BMC +- driver/coda: Fix possible NULL pointer dereference error. +- VirtCCA supports Ascend 310P in CoDA scenarios +- NFSD: Fix crash in nfsd4_read_release() +- iommu: set the default iommu-dma mode as non-strict +- configs: Add bus lock detect config in openeuler_config +- x86/split_lock: Add support for Zhaoxin +- x86/split_lock: Simplify reenabling +- x86/split_lock: Fix the delayed detection logic +- x86/split_lock: Move Split and Bus lock code to a dedicated file + +* Mon Dec 29 2025 Li Nan <linan122@huawei.com> - 6.6.0-132.0.0.111 +- !19763 ub: udma: bugfix related to spin lock. +- ub: udma: bugfix related to spin lock. + +* Fri Dec 26 2025 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-132.0.0.110 +- riscv kernel upgrade to 6.6.0-132.0.0 +- Bugfix: iommu/riscv: Fix inconsistencies with the latest spec revision +- Bugfix: riscv: acpi: avoid errors caused by probing DT devices when ACPI is used +- Bugfix: Revert "drivers: Add ACPI support for thead-c900-aclint-sswi" + +* Fri Dec 26 2025 Li Nan <linan122@huawei.com> - 6.6.0-132.0.0.109 +- !19477 iommu: set the default iommu-dma mode as non-strict +- iommu: set the default iommu-dma mode as non-strict + +* Thu Dec 25 2025 Li Nan <linan122@huawei.com> - 6.6.0-131.0.0.108 +- !19760 ub:ubfi:skipped address of subtable 0 in ubrt +- !19758 ub: udma: bugfix related to rx close. +- !19759 ub: ubase: fix ubase activate/deactivate resp timeout +- ub:ubfi:skipped address of subtable 0 in ubrt +- ub: ubase: fix ubase activate/deactivate resp timeout +- ub: udma: bugfix related to rx close. +- !19752 Repair driver reset work-q uaf +- !19755 obmm: Register resource for every memdev +- !19756 ub:ubus delete undefined class code +- !19754 ub:ubus: Move the decoder's queue operations to hisi-ubus +- !19757 ub: cdma: add ioctl logs and error codes +- !19750 ub: udma: Bugfix related to 2M hugepage. +- !19749 ub: unic & ubase: Fix ethtool configuration error issue and resolve mailbox timeout +- !19697 iomap: fix dirty range tracking in iomap_folio_mkwrite_iter +- ub: cdma: add ioctl logs and error codes +- ub:ubus delete undefined class code +- obmm: Register resource for every memdev +- Repair driver reset work-q uaf +- ub:ubus: fix ub_get_bus_controller getting null +- ub:ubus: Move the decoder's queue operations to hisi-ubus +- ub:ubus: hi_msg_sync_wait first pull cq +- ub: udma: Bugfix related to 2M hugepage. +- net: unic: Fix ethtool configuration error issue. +- ub: ubase: Resolve mailbox timeout issue. +- 删除文件 .本项目已经正式迁移至AtomGit平台/README.md +- update README. +- add migrate not +- iomap: fix dirty range tracking in iomap_folio_mkwrite_iter + +* Fri Dec 19 2025 Li Nan <linan122@huawei.com> - 6.6.0-130.0.0.107 +- !19680 LoongArch: Mask all interrupts during kexec/kdump +- !19682 Loongarch: Enable CONFIG_RANDOMIZE_BASE default +- !19738 xsched: move xsched types to user-accessible headers +- !19717 obmm: Race condition fix, mmap rollback fix and export_user flag check. +- xsched: move xsched types to user-accessible headers +- obmm: Add FAST flag check for obmm_export_from_user +- obmm: Rollback mmap_granu when mmap failed +- !19735 add check ack msg and do sleep +- add check ack msg and do sleep +- !18003 [OLK-6.6] PCI: phytium: Add hotplug and hotreset workaround patch for phytium SoCs +- Loongarch: Enable CONFIG_RANDOMIZE_BASE default +- LoongArch: Mask all interrupts during kexec/kdump +- !19714 drm/hisilicon/hibmc: fix PCIe 64-bit bar support +- obmm: Fix race condition of region release and device release +- !19688 ub: ubase: CtrlQ retry message uses the same seq +- !19687 ub: udma: Bugfix related to crq event unregister. +- !19641 ub:hisi-ubus: fix MUE unreg msg rsp time +- !19677 ub: libcdma: add eid upi update response +- drm/hisilicon/hibmc: fix PCIe 64-bit bar support +- !19709 mm: try skipping pinned page before unmapping in migration +- mm: try skipping pinned page before unmapping in migration +- !19657 xsched: simplify logging macros by removing redundant pr_fmt usage +- !19702 XSched: List Corruption +- !19617 Handling Kunpeng Chip ARM Spectre-BHB (CVE-2022-23960) Issue +- xsched/cgroup: move list_del from css_free to css_offline to prevent corruption +- xsched: protect group member list with xcu_lock to prevent corruption +- !19696 i40e: remove read access to debugfs files +- i40e: remove read access to debugfs files +- ub: udma: Bugfix related to crq event unregister. +- !19674 obmm: bugfixes of log and race condition +- !19644 obmm: suppport unaligned PMD mapping +- ub:ubus: Change create device irq domain debug info +- !19683 xsched: prevent linked list corruption in RT priority updates +- ub: ubase: CtrlQ retry message uses the same seq +- net: unic: Fix the calltrace caused by modifying queue parameters in the MUE scenario +- xsched: prevent linked list corruption in RT priority updates +- ub: cdma: add eid upi update response +- obmm: Remove log pringts of physical address and kernelspace virtual address +- obmm: Fix race condition between unexport and addr_query_by_pa +- !19659 ubcore: fix route_list when no full match. +- !19661 Packet throughput decreases with multiple jetty streams +- xsched: simplify logging macros by removing redundant pr_fmt usage +- xsched: Fix compilation by adding xsched_attr to syscalls.h +- !19562 [OLK-6.6] virtcca: fix incorrect use of the percpu declare +- ubcore: fix route_list when no full match. +- obmm: display mmaped region's Pagesize +- obmm: fix for PMD mapping +- Packet throughput decreases with multiple jetty streams +- virtcca: Add missing includes for DECLARE_PER_CPU +- arm64: Add missing includes for mem_encrypt +- !19647 fbdev: bitblit: bound-check glyph index in bit_putcs* +- fbdev: bitblit: bound-check glyph index in bit_putcs* +- ub:hisi-ubus: fix MUE unreg msg rsp time +- config: Disable unprivileged BPF syscall by default +- arm64: Add support for TSV110 Spectre-BHB mitigation +- PCI: phytium: Add hotplug and hotreset workaround patch for phytium SoCs + +* Fri Dec 12 2025 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-128.0.0.106 +- RISC-V kernel upgrade to 6.6.0-128.0.0 +- Update Spacemit K3 DTS +- Fix LTP test on TH1520 +- Enable CONFIG_ACPI_APEI + +* Thu Dec 11 2025 Li Nan <linan122@huawei.com> - 6.6.0-128.0.0.105 +- !19097 scsi: mpi3mr: Clear ioctl blocking flag for an unresponsive controller +- !19095 scsi: mpi3mr: Set MPI request flags appropriately +- !19092 scsi: mpi3mr: Replace deprecated strncpy() with assignments +- !19086 scsi: mpi3mr: Fetch correct device dev handle for status reply descriptor +- !19636 Some bugfixes for interference +- !19639 ub: ubase: Fix spell error of month +- ub: ubase: Fix spell error of month +- !19637 ub: udma: bugfix related to print location. +- !19637 ub: udma: bugfix related to print location. +- !19638 ub:ubus: bugfix port reset in cluster mode +- !19623 iommu/ummu: Fix the issue of uninitialized resources in logic_ummu_viommu +- ub:ubus: bugfix port reset in cluster mode +- ub:ubus: add hotplug capability check +- ub:ubus: bugfix calltrace of killing qemu when rmmod hisi_ubus +- ub: udma: bugfix related to print location. +- iommu/ummu: Remove redundant CONFIG_UB_UBRT_PLAT_DEV and code +- interference: Add version compatibility check between subsystem and cgroup +- interference: Fix missing interference.stat file in v1 hierarchy +- interference: Add fallback to sched_clock when TSC is unavailable +- interference: Add dependency on CONFIG_SCHED_INFO to avoid build error +- interference: Resolve arm32 build error by restricting IFS to x86/arm64 +- interference: Avoid null pointer dereference in cgroup_ifs_add_files +- iommu/ummu-core: Duplicate EID are not allowed +- iommu/ummu: Move tid_type attr to logic ummu +- iommu/ummu: Fixing the issue of uninitialized resources in logic_ummu_viommu +- !19634 crypto: hisilicon - some bugfix +- !19628 ub:ubfi: Fix UBFI memory leak issue +- !19616 ub: ubase&unic: Fix some bug finding in running the driver +- !19553 perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12 +- crypto: hisilicon - lower priority for hisilicon crypto implementations +- crypto: hisilicon/zip - remove redundant callback validation and invocation in crypto_wait_req +- crypto: hisilicon/zip - add algorithm check before soft tfm allocation +- crypto: hisilicon/zip - fix a callback problem +- crypto: hisilicon/qm - place the interrupt status interface after the PM usage counter +- crypto: hisilicon/qm - increment PM usage counter when handling the aeq interrupt +- crypto: hisilicon/sgl - fix inconsistent map/unmap direction issue +- crypto: hisilicon/hpre - support curve25519 fallback for hardware queue unavailable +- crypto: hisilicon - mask all error type when uninit +- net: unic: Fixed the call trace issue triggered internally by the completion event interrupt +- !19624 xsched: XCU Partition +- !19621 ubagg: fix mismatched spin unlock. +- iommu/ummu: Optimize chip generational compatibility feature +- iommu/ummu: Fix VM multi-instance problem +- !19620 iommufd: Prevent ALIGN() overflow +- ubagg: fix mismatched spin unlock. +- net: unic: Restore tx and rx stats when setting coalesce parameters +- ub: ubase: obtain rc_max_cnt from MAMI +- ub: ubase: fix a issue of udma device's eid deleted when stop rx stream and reset concurrently +- ub: ubase: add opcode to query ub port_bitmap. +- net: unic: Restore default queue count per tc when tc number changes. +- ub: ubase: Fix the issue of mismatch between the ubase aeqe structure and the protocol. +- ub: ubase: add ip_over_urma API for udma. +- ub: ubase: optimize print format of fw_ver in debugfs. +- ub: ubase: Fix the issue of deadlock by quantities of log in the ctrlq crq task. +- ub: ubase: Remove non-cluster mode code. +- net: unic: Resolve the bandwidth jitter problem +- ub:ubfi: Fix UBFI memory leak issue +- ub:ubus: Matt and MMIO judgments are not performed in cluster +- ub:ubus: Delete ubc cfg0 config during cluster mode +- ub:hisi-ubus: Fix ue reg/unreg without lock bug +- xsched: fix infinite loop caused by invalid CFS group vruntime update +- xsched: prevent race between enqueue_ctx and xsched_task_free +- xsched: DEBUG log cleanup +- xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation +- xsched: prevent NULL deref by refcounting css and tracking offline state +- xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock +- xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class +- xsched: fix NULL pointer risk on attach entry allocation +- xsched: refactor CFS per-XCU rq init/deinit paths +- !19608 ub: ub_fwctl: Modify TP/TA/SCC register query process. +- !18634 [OLK-6.6]Fix CVE-2025-38706 +- iommufd: Prevent ALIGN() overflow +- !19400 smb: client: fix mid_q_entry memleak leak with per-mid locking +- iommu/ummu: NO plbi for grant, config permq need dma_wmb +- iommu/ummu: Fix compilation option configuration about CONFIG_ACPI +- iommu/ummu: UMMU doesn't send tect sync after delete eid +- iommu/ummu: Delete unnecessary commands +- !19601 net/packet: fix a race in packet_set_ring() and packet_notifier() +- !19598 ice: Fix a null pointer dereference in ice_copy_and_init_pkg() +- !19597 ipv6: prevent infinite loop in rt6_nlmsg_size() +- !19354 [OLK-6.6] Fix CVE-2025-37822 +- !19355 [OLK-6.6] Fix CVE-2025-38361 +- !19563 ub: cdma: fix the timing issue during flow-based deregistration. +- !19585 crypto: hisilicon/trng - Fix the issue where TRNG cannot be used by multiple threads. +- !19610 perf: Fix lastup for multi-CPU PG +- !19609 urma: fixed process exiting uburma driver's private memory UAF +- !19592 Fix incorrect use of cpuhp_remove_multi_state parameter +- perf: Fix lastup for multi-CPU PG +- urma: fixed process exiting uburma driver's private memory UAF +- !19607 Revert "RDMA/hns: Fix mismatch exception rollback" +- ub: cdma: modify the compatibility field according to the Linux KABI specification +- ub: cdma: fix the timing issue during flow-based deregistration. +- ub: cdma: fix kasan cdma jfae uaf +- ub: cdma: modify log level about en information +- ub: ub_fwctl: Modify TP/TA/SCC register query process. +- Revert "RDMA/hns: Fix mismatch exception rollback" +- !18664 [OLK-6.6] Fix CVE-2025-22039 +- net/packet: fix a race in packet_set_ring() and packet_notifier() +- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() +- ipv6: prevent infinite loop in rt6_nlmsg_size() +- !19558 obmm: sync obmm default params value to sysfs. +- !19560 obmm: set MAX Numa Distance to 255 +- !19589 ub:ubus: add active_mutex in ub_entity +- soc cache: Add compilation config for hisi_soc_l3c +- soc cache: Don't poll before removing all locks +- soc cache: Drop redundant vm_pgoff +- soc cache: fix walk page parameter and drop incorrect check +- soc cache: Check address while walking pages +- soc_cache: Fix component removal order to avoid race condition +- soc cache: cleanup: Remove the redundant check of vm_pgoff +- soc cache: cleanup: Change type of mnt_type +- soc cache: cleanup: avoid tag addr from interfering range validation +- soc cache: cleanup: move judgement of soc cache dev into lock protection +- soc cache: cleanup: fix memory leakage on error path +- soc_cache: Fix error code returning from hisi_soc_l3c_do_lock +- soc_cache: Fix incorrect use of cpuhp_remove_multi_state parameter +- soc cache: cleanup: replace dynamically allocated param with local variable +- ub:ubus: add active_mutex in ub_entity +- !19576 Bugfix for two issues +- crypto: hisilicon/trng - support tfms sharing the device +- crypto: hisilicon/trng - use DEFINE_MUTEX() and LIST_HEAD() +- Revert "crypto: hisilicon/trng - support to obtain random numbers from soft algorithm" +- Revert "crypto: hisilicon/trng - use DEFINE_MUTEX() for mutex lock" +- !19557 Fix UAF issue for mfs +- !19555 ub: bugfix of port, decoder and vfio +- !19561 obmm: fix granu checking in mmap +- zcopy: Fix softlockup while attach PUD-SIZE page +- zcopy: Fix NULL pointer dereference while attach conflict with free +- ub:unic Adaptation of the port reset interface +- !19521 uvb: change dir name +- !19532 net: hns3: add VLAN id validation before using +- !19271 Squashfs: fix uninit-value in squashfs_get_parent +- !19269 media: venus: Add a check for packet size after reading from shared memory +- !19268 eventpoll: Fix semi-unbounded recursion +- !19267 kernfs: Relax constraint in draining guard +- !19552 KVM: arm64: Check the untrusted offset in FF-A memory share +- !19551 add check ack_dono flag for reboot event +- obmm: sync obmm default params value to module sysfs. +- obmm: set MAX Numa Distance to 255 +- obmm: fix granu checking in mmap +- ub:ubus adapt port local ras +- vfio:ubus vfio-ub support ub entity enable +- mfs: Fix UAF problem on event object when enable tracepoint +- ub:ubus: fix bug of msg workqueue null +- ub:hisi-ubus ub:hisi-ubus: Move the decoder's page table operations to hisi-ubus +- add check ack_dono flag for reboot event +- !19517 gmem: fix several issues +- !19519 arm64/mpam: Reset mbwu_state while creating new monitor group +- perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12 +- perf arm-spe: Backport perf_cpu_map__new_online_cpus() +- perf arm-spe: Save per CPU information in metadata +- perf arm-spe: Calculate meta data size +- perf arm-spe: Define metadata header version 2 +- perf arm-spe: Prepare for adding data source packet implementations for other cores +- perf arm-spe: Use old behavior when opening old SPE files +- perf arm-spe: Set sample.addr to target address for instruction sample +- perf color: Add printf format checking and resolve issues +- perf arm-spe: Add Cortex CPUs to common data source encoding list +- perf arm-spe: Add Neoverse-V2 to common data source encoding list +- perf arm-spe: Remove the unused 'midr' field +- perf arm-spe: Use metadata to decide the data source feature +- perf arm-spe: Introduce arm_spe__is_homogeneous() +- perf arm-spe: Dump metadata with version 2 +- perf arm-spe: Support metadata version 2 +- perf arm-spe: Rename the common data source encoding +- perf arm-spe: Rename arm_spe__synth_data_source_generic() +- KVM: arm64: Check the untrusted offset in FF-A memory share +- !19530 Fix unexpected behavior in resctrl mounting +- Revert "perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12" +- !19520 ub: udma: bugfix related to init xa flags. +- !19205 [OLK-6.6] Fix CVE-2025-39732 +- !19156 [OLK-6.6] Fix CVE-2025-39684 +- !19157 [OLK-6.6] Fix CVE-2025-39675 +- net: hns3: add VLAN id validation before using +- !19526 mm/numa_remote: fix wild-memory-access in numa_remote_hugetlb_nowatermark +- fs/resctrl: Prevent mounting with unsupported options +- fs/resctrl: Fix resctrl mount options display in mount list +- ub: udma: bugfix related to init xa flags. +- ub: udma: bugfix for rx close. +- mm/numa_remote: fix wild-memory-access in numa_remote_hugetlb_nowatermark +- uvb: change dir name +- !19507 Fix some memory policy bugfix +- arm64/mpam: Need to reset MPAM component when umounting resctrl +- arm64/mpam: Remove the redundant prev_val member variable +- arm64/mpam: Reset mbwu_state while creating new monitor group +- !19508 ub: ub_fwctl: Modify the problem of incorret data when querying entry +- !19513 zcopy: fix two issues +- zcopy: Fix Bad rss-counter state while non-mapping pages attach +- zcopy: Fix null pointer dereference while attach transhugepage twice to same addr +- ub: ub_fwctl: Modify the problem of incorret data when querying entry information +- !19357 ubios_uvb: add msleep in poll thread +- ubios_uvb: add check for uvb window buffer size +- !19494 crypto: hisilicon - add reference counting to queues for tfm kernel reuse +- !19475 task_work: Fix NMI race condition +- mempolicy: restrict smart grid scheduling to vma_alloc_folio path +- mempolicy: fix missing mmap_read_unlock() in error path +- ubios_uvb: add check for cis message and senderid +- !19486 [OLK-6.6] fix possible crash caused by null pointer when hct get page. +- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable +- crypto: hisilicon/hpre - support the hpre algorithm fallback +- crypto: hisilicon/zip - support fallback for zip +- crypto: hisilicon/qm - optimize device selection priority based on queue ref count and NUMA distance +- crypto: hisilicon/qm - add reference counting to queues for tfm kernel reuse +- crypto: hisilicon - consolidate qp creation and start in hisi_qm_alloc_qps_node +- crypto: hisilicon/qm - centralize the sending locks of each module into qm +- crypto: hisilicon/qm - enhance the configuration of req_type in queue attributes +- Revert "crypto: hisilicon/hpre - support the hpre algorithm fallback" +- crypto: hisilicon/hpre: extend tag field to 64 bits for better performance +- crypto: hisilicon/sec - move backlog management to qp and store sqe in qp for callback +- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function +- ubios_uvb: add msleep in poll thread +- ccp/hct: fix possible crash caused by null pointer when hct get page. +- task_work: Fix NMI race condition +- scsi: mpi3mr: Clear ioctl blocking flag for an unresponsive controller +- scsi: mpi3mr: Set MPI request flags appropriately +- scsi: mpi3mr: Replace deprecated strncpy() with assignments +- scsi: mpi3mr: Fetch correct device dev handle for status reply descriptor +- smb: client: fix mid_q_entry memleak leak with per-mid locking +- drm/amd/display: Check dce_hwseq before dereferencing it +- riscv: uprobes: Add missing fence.i after building the XOL buffer +- Squashfs: fix uninit-value in squashfs_get_parent +- media: venus: Add a check for packet size after reading from shared memory +- eventpoll: Fix semi-unbounded recursion +- kernfs: Relax constraint in draining guard +- ksmbd: fix overflow in dacloffset bounds check +- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() +- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() +- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() +- comedi: Fix initialization of data for instructions that write to subdevice +- gmem: remove reduntant interfaces and use proper mmap flag +- gmem: gmem_reserve_vma should use vma_flag_clear to remove flag +- gmem: remove inpropre BUG_ON in do_peer_shared_anonymous_page +- gmem: hmemcpy should use dma for phy addr +- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() + +* Tue Dec 09 2025 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-126.0.0.104 +- Bugfix: Fix duplicate RISC-V SBI firmware event name +- Add lrw core JSON file with metric support +- Add support for Spacemit K3 + +* Thu Dec 04 2025 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-126.0.0.103 +- RISC-V kernel upgrade to 6.6.0-126.0.0 +- Add support for LRW, DP1000 +- Add IOMMU related support +- Backport mainline RISC-V features. + +* Thu Dec 04 2025 Li Nan <linan122@huawei.com> - 6.6.0-126.0.0.102 +- !19468 urma: Bugfix for ubcore_get_route_list implement +- urma: Bugfix for ubcore_get_route_list implement +- !19329 hisi_acc_vfio_pci: adapt to new migration configuration +- !19435 crypto: hisilicon/qm - fix incorrect judgment in qm_get_complete_eqe_num() +- !19383 [OLK-6.6] backport important bugfix for Broadcom NIC driver from upstream linux-6.6.y +- !19460 xsched: XCU Partition +- !19316 Fix cves CVE-2025-40040 & CVE-2025-40058 +- !19447 net: hns3: remove VF multi-TC compat bit +- xsched: add throttling statistics for xsched groups +- xsched: fix task stall when quota is disabled +- xsched: suppress excessive error logs during cgroup file retry +- xsched: fix shares misaccounting when multiple tasks run in one cgroup +- xsched: switch xcu cgroup subsystem from domain mode to thread mode +- !19439 obmm: remove redundant code and fix log issues +- !18481 [OLK-6.6] Add platform-specific quirks for ZX-200 device +- !19085 scsi: mpi3mr: Add support for status reply descriptor +- !19078 scsi: mpi3mr: Split off bus_reset function from host_reset +- !19416 kernfs: Fix UAF in polling when open file is released +- !19415 smb: client: fix race with concurrent opens in rename(2) +- !19446 net/mlx5: Fix ECVF vports unload on shutdown flow +- obmm: remove redundant code and fix log issues +- !19441 rv: Use strings in da monitors tracepoints +- !19411 CVE-2025-39697 +- !19442 CVE-2025-22022 +- net: hns3: remove VF multi-TC compat bit +- net/mlx5: Fix ECVF vports unload on shutdown flow +- usb: xhci: Apply the link chain quirk on NEC isoc endpoints +- usb: xhci: move link chain bit quirk checks into one helper function. +- !19429 net/sched: Abort __tc_modify_qdisc if parent class does not exist +- rv: Use strings in da monitors tracepoints +- !19438 drm/scheduler: signal scheduled fence when kill job +- !19410 Fix CVE-2025-39994 +- !17888 [OLK-6.6] Fix CVE-2025-37777 +- drm/scheduler: signal scheduled fence when kill job +- !19371 RDMA/rxe: Fix race in do_task() when draining +- !19393 usb: typec: ucsi: displayport: Fix NULL pointer access +- obmm: set up default mem allocator granule +- !19377 [OLK-6.6] Fix CVE-2025-23133 +- !18704 [OLK-6.6] Fix CVE-2024-58095 +- !19401 smb: client: fix crypto buffers in non-linear memory +- !19323 nfsd: don't ignore the return code of svc_proc_register() +- crypto: hisilicon/qm - fix incorrect judgment in qm_get_complete_eqe_num() +- crypto: hisilicon/qm - add missing default in switch in qm_vft_data_cfg +- crypto: hisilicon/sgl - remove unnecessary checks for curr_hw_sgl error +- crypto: hisilicon/qm - add concurrency protection for variable err_threshold +- crypto: hisilicon/qm - add the save operation of eqe and aeqe +- crypto: hisilicon/qm - restore original qos values +- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value +- !19386 x86/mm: Check return value from memblock_phys_alloc_range() +- !19433 urma: bugfix ubagg drivers refent error +- urma: bugfix ubagg drivers refent error +- !19391 urma: fixing ubcore hash table initialization failure. +- !19263 [OLK-6.6]Fix CVE-2025-37861 +- !19253 [OLK-6.6] Fix CVE-2025-37973 +- !19252 [OLK-6.6] Fix CVE-2025-37972 +- !19251 [OLK-6.6] Fix CVE-2025-37956 +- !19374 [OLK-6.6] Fix CVE-2025-37899 +- net/sched: Abort __tc_modify_qdisc if parent class does not exist +- kernfs: Fix UAF in polling when open file is released +- !19402 sched: Fix incorrect cluster mask +- smb: client: fix race with concurrent opens in rename(2) +- !19414 xsched: fix compile error when CONFIG_XCU_SCHEDULER is disabled +- !19398 v2 bugfix for xcall2.0 +- !19412 sunrpc: fix handling of server side tls alerts +- !19409 smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). +- !19405 [OLK-6.6]:update patches for sw64 architecture +- xsched: fix compile error when CONFIG_XCU_SCHEDULER is disabled +- !19266 __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock +- !19358 Fix CVE-2025-40016 +- sunrpc: fix handling of server side tls alerts +- NFS: Fix a race when updating an existing write +- nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests +- media: tuner: xc5000: Fix use-after-free in xc5000_release +- media: tunner: xc5000: Refactor firmware load +- urma: fixing ubcore hash table initialization failure. +- smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). +- !19365 net/mlx5e: Harden uplink netdev access against device unbind +- sw64: config: add initial openeuler_defconfig for sw64 +- sw64: fix compile error of pte_pgprot() +- sw64: add missing definition of MAP_PEER_SHARED +- sched: Fix incorrect cluster mask +- smb: client: fix crypto buffers in non-linear memory +- !19392 Fixes and cleanup of page cache limit +- !18760 CVE-2025-38501 +- !19390 v3 xsched: add xsched_{set,get}attr syscall +- xcall2.0: fix panic while detaching xcall found in DT case +- xcall2.0: prefetch: fix access NULL ptr in __do_sys_epoll_pwait() +- xcall2.0: prefetch: get prefetch_mm_data once in get_pfi() +- !19311 nbd: fix uaf in nbd_genl_connect() error path +- !19310 fs: writeback: fix use-after-free in __mark_inode_dirty() +- !19256 efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare +- !19237 nfsd: provide locking for v4_end_grace +- !19247 dmaengine: ti: k3-udma: Add missing locking +- !19220 NFSv4: Fix deadlock during the running of state manager +- !19248 nfsd: Initialize ssc before laundromat_work to prevent NULL dereference +- usb: typec: ucsi: displayport: Fix NULL pointer access +- !19378 net: hibmcge: add support for pagepool on rx +- mm: Add page cache limit check before queueing shrink worker +- mm: Move vm_cache_limit_mbytes check to page_cache_over_limit() +- mm: Replace deferrable timer with delay timer for shrink worker +- !19388 [sync] PR-19363: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" +- !19368 net/sched: Fix backlog accounting in qdisc_dequeue_internal +- !19367 net/sched: sch_qfq: Fix CVE-2025-38477 +- !19366 i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path +- !19364 ixgbevf: Fix CVE-2025-40104 +- xsched: add xsched_{set,get}attr syscall +- Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" +- x86/mm: Check return value from memblock_phys_alloc_range() +- bnxt_en: Fix a possible memory leak in bnxt_ptp_init +- net: hibmcge: add support for pagepool on rx +- net: hibmcge: reduce packet drop under stress testing +- net: hibmcge: add support for tracepoint to dump some fields of rx_desc +- Revert "net: hibmcge: reduce packet drop under stress testing" +- Revert "net: hibmcge: support pagepool for rx" +- wifi: ath11k: update channel list in reg notifier instead reg worker +- !18451 RDMA/bnxt_re: Fix budget handling of notification queue +- ksmbd: fix use-after-free in session logoff +- !18837 CVE-2025-37997 +- !19361 media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove +- RDMA/rxe: Fix race in do_task() when draining +- !19353 ubcore: fix query route list by eid pair. +- ubcore: fix query route list by eid pair. +- net/sched: Fix backlog accounting in qdisc_dequeue_internal +- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class +- net/sched: sch_qfq: Fix race condition on qfq_aggregate +- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path +- net/mlx5e: Harden uplink netdev access against device unbind +- ixgbevf: fix mailbox API compatibility by negotiating supported features +- ixgbevf: fix getting link speed data for E610 devices +- ixgbevf: Add support for Intel(R) E610 device +- PCI: Add PCI_VDEVICE_SUB helper macro +- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove +- media: uvcvideo: Use heuristic to find stream entity +- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID +- hisi_acc_vfio_pci: adapt to new migration configuration +- crypto: hisilicon - qm updates BAR configuration +- hisi_acc_vfio_pci: Fix reference leak in hisi_acc_vfio_debug_init +- Revert "migration: update BAR space size" +- Revert "migration: qm updates BAR configuration" +- Revert "migration: adapt to new migration configuration" +- nfsd: don't ignore the return code of svc_proc_register() +- iommu/vt-d: Disallow dirty tracking if incoherent page walk +- mm/ksm: fix flag-dropping behavior in ksm_madvise +- nbd: fix uaf in nbd_genl_connect() error path +- fs: writeback: fix use-after-free in __mark_inode_dirty() +- RDMA/bnxt_re: Remove unusable nq variable +- RDMA/bnxt_re: Fix budget handling of notification queue +- __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock +- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue +- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare +- wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation +- Input: mtk-pmic-keys - fix possible null pointer dereference +- ksmbd: prevent rename with empty string +- ksmbd: move leading slash check to smb2_get_name() +- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference +- dmaengine: ti: k3-udma: Add missing locking +- nfsd: provide locking for v4_end_grace +- NFSv4: Fix deadlock during the running of state manager +- scsi: mpi3mr: Add support for status reply descriptor +- scsi: mpi3mr: Split off bus_reset function from host_reset +- netfilter: ipset: Remove unused htable_bits in macro ahash_region +- netfilter: ipset: fix region locking in hash types +- Add platform-specific quirks for ZX-200 device +- ksmbd: add max ip connections parameter +- ksmbd: extend the connection limiting mechanism to support IPv6 +- ksmbd: limit repeated connections from clients with the same IP +- jfs: add check read-only before txBeginAnon() call +- ksmbd: add free_transport ops in ksmbd connection +- ksmbd: fix use-after-free in __smb2_lease_break_noti() + +* Sat Nov 29 2025 Li Nan <linan122@huawei.com> - 6.6.0-124.0.0.101 +- !19152 Fix CVE-2025-39810 fix CVE-2025-39810 +- !19359 ub: hisi-ubus: Fix ub memory decoder create +- !19346 sched: Fix race between yield_to() and try_to_wake_up() +- ub: hisi-ubus: Fix ub memory decoder create +- !19341 v7 bugfix for xcall2.0 +- sched: Fix race between yield_to() and try_to_wake_up() +- !17661 kvm: Only enable shadow mode for ioeventfd and Align the lifecycle of … +- !19334 bpf: Sync pending IRQ work before freeing ring buffer +- xcall2.0: prefetch: introduce struct prefetch_mm_data +- xcall2.0: Fix mem leak in proc_xcall_command +- xcall2.0: add xcall_subdir_create help to create subdir below /proc/xcall +- xcall2.0: prefetch: keep prefetch module name same with file name +- xcall2.0: prefetch: fix value name typos in __do_sys_epoll_pwait +- !19339 zcopy: Fix context switch within RCU read-side +- !19300 Add Support for Disabling Hugetlb in soft_offline_page +- zcopy: Fix context switch within RCU read-side error +- bpf: Sync pending IRQ work before freeing ring buffer +- kvm: Only enable shadow mode for ioeventfd and Align the lifecycle of KVM shadow with KVM +- mm/memory-failure: support disabling soft offline for HugeTLB pages +- mm/memory-failure: userspace controls soft-offlining pages +- bnxt_en: Fix memory corruption when FW resources change during ifdown +- bnxt_en: Fix possible crash after creating sw mqprio TCs + +* Thu Nov 27 2025 Li Nan <linan122@huawei.com> - 6.6.0-123.0.0.100 +- !19327 ub: ub_fwctl: add ub_fwctl driver-api documentation description +- !19338 iommu/ummu: Fix UMMU documentation error +- !19287 net: unic: Add support for uboe and ethernet related tools +- !19337 ub: udma: Support retrieving the migr field. +- ub: ub_fwctl: add ub_fwctl driver-api documentation description +- iommu/ummu: Fix UMMU documentation error +- !19332 ub: udma: add requirement about document and tp attr. +- !19330 iommu/ummu: Add UMMU documentation description +- ub: udma: Support retrieving the migr field. +- !18794 【OLK-6.6】fix CVE-2025-39801 +- ub: udma: Support eid and guid updates. +- ub: udma: bugfix for set and get tp attr. +- !18453 [OLK-6.6] ALSA: HDA: Add Zhaoxin HDMI Controller and Codec support +- !18483 [OLK-6.6] x86/hpet: Set dynamic IRQ feature for HPET for KH-50000 +- iommu/ummu: Add UMMU-PMU devicetree file +- iommu/ummu: Add UMMU devicetree file +- iommu/ummu: Add UMMU documentation description +- ub: udma: mask jetty context addr info. +- ub: udma: add udma driver module doc. +- ub: ubase: Remove non-cluster mode code +- net: unic: Add support for uboe reset +- net: unic: Add support for MAC statistics +- net: unic: Add pause frame support. +- net: unic: Add Priority Flow Control (PFC) support +- net: unic: Add debugfs support for dumping MAC tables. +- net: unic: Supports MAC filter, and allows users to add and delete MAC +- net: unic: Add debugfs support for dumping vlan table +- net: unic: Integrate valn filtering features with network device operations. +- net: unic: Add valn filtering support. +- net: unic: Add support for querying link diagnosis status +- net: unic: Extend loopback test support to include external loopback modes +- net: unic: Extend loopback test support to include serdes loopback modes. +- net: unic: Add loopback test support. +- net: unic: Add debugfs support for dumping hardware MAC tables. +- net: unic: Add support for setting link speed, duplex, and autonegotiation via ethtool. +- !19328 ub:hisi-ubus: Adding compatibility Interfaces for ub memory +- !19264 ub: cdma: add CDMA userspace-api documentation description +- ub:hisi-ubus: Adding compatibility Interfaces for ub memory +- ub: cdma: add CDMA userspace-api documentation description +- ub: cdma: add CDMA kernel driver design document specification +- ub: cdma: add CDMA driver-api documentation description +- !19305 ub:ubus: Add ubus and ubfi opensource document +- !19320 urma: added functions for getting and setting TP attribute fields. +- ub:ubus: Add ubus devicetree file +- urma: added functions for getting and setting TP attribute fields. +- ub:ubus: Add ubus and ubfi opensource document +- usb: dwc3: Remove WARN_ON for device endpoint command timeouts +- ALSA: HDA: Add Zhaoxin HDMI Controller and Codec support +- x86/hpet: Set dynamic IRQ feature for HPET for KH-50000 +- ALSA: HDA: Roll back the old version for consistency with the mainline + +* Thu Nov 27 2025 Li Nan <linan122@huawei.com> - 6.6.0-122.0.0.99 +- !19317 ub: ubase: Remove useless character '+' +- ub: ubase: Remove useless character '+' +- !18870 add sentry kmod +- drivers/ub/sentry: add sentry_remote_reporter module +- drivers/ub/sentry: add sentry_uvb_comm module +- drivers/ub/sentry: add sentry_urma_comm module +- drivers/ub/sentry: add sentry_reporter and sentry_msg_help +- !19306 net: Netdev use RCU protection +- !19290 urma: bugfix the issue of urma stream generation failure +- !19292 blk-ioinf: accumulate total latency properly across sampling periods +- !19230 drm/vmwgfx: Fix Use-after-free in validation +- !19291 usbnet: Fix using smp_processor_id() in preemptible code warnings +- net: use dst_dev_rcu() in sk_setup_caps() +- ipv4: use RCU protection in ip_dst_mtu_maybe_forward() +- ipv6: use RCU in ip6_output() +- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). +- net: dst: Fix kabi-breakage for struct dst_entry +- ipv6: use RCU in ip6_xmit() +- ipv4: start using dst_dev_rcu() +- tcp_metrics: use dst_dev_net_rcu() +- net: dst: introduce dst->dev_rcu +- net: Add locking to protect skb->dev access in ip_output +- net: dst: add four helpers to annotate data-races around dst->dev +- !19191 Fix CVE-2025-40200 +- urma: bugfix the issue of urma stream generation failure +- acpi: provides acpi power notifier chain +- !19303 pid: Add a judgment for ns null in pid_nr_ns +- !19282 fix cves +- !19211 ACPI: video: Fix use-after-free in acpi_video_switch_brightness() +- !19175 [OLK-6.6] Fix CVE-2025-38666 +- !18496 [OLK-6.6] Fix CVE-2025-22107 +- !18029 [OLK-6.6] Fix CVE-2025-37892 +- !19151 [OLK-6.6] Fix CVE-2025-40055 +- !19131 [OLK-6.6] Fix CVE-2025-40012 +- !19125 [OLK-6.6] Fix CVE-2025-39692 +- !19124 [OLK-6.6] Fix CVE-2025-39694 +- !19133 [OLK-6.6] Fix CVE-2025-40082 +- !19118 [OLK-6.6] Fix CVE-2025-39703 +- !19113 [OLK-6.6] Fix CVE-2025-39938 +- !19111 [OLK-6.6] Fix CVE-2025-40043 +- !19100 obmm: Ownership Based Memory Management framework +- pid: Add a judgment for ns null in pid_nr_ns +- !19285 xsched: XCU Partition +- !19293 sched/rt: Fix race in push_rt_task +- !19294 dm-stripe: fix a possible integer overflow +- !19278 ub: ubase: Improve performance and fix some bug +- dm-stripe: fix a possible integer overflow +- sched/rt: Fix race in push_rt_task +- blk-ioinf: accumulate total latency properly across sampling periods +- usbnet: Fix using smp_processor_id() in preemptible code warnings +- xsched: move stream_lock into xsched_vsm_add_tail() to avoid sleeping in atomic context +- xsched: rename vstream->id to vstream->sq_id +- xsched: add null check for sched in xsched_xse_set_class +- xsched: modify the logic for inc and dec the count value +- xsched: replace hard-coded numeric values +- xsched: unify root detection logic for cgroups +- xsched: remove parent->lock and rely on cgroup_mutex for shares update +- xsched: avoid sleeping while holding spinlock in xcu_move_task() +- xsched: add missing spin_unlock() in xcu_move_task() error path +- xsched: enforce valid xsched scheduler config dependencies +- xsched: unify log prefix format and remove duplicated prefix macros +- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() +- mm: zswap: move allocations during CPU init outside the lock +- mm: zswap: properly synchronize freeing resources during CPU hotunplug +- mm/zswap: change per-cpu mutex and buffer to per-acomp_ctx +- mm/hugetlb: unshare page tables during VMA split, not before +- !19194 ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping +- !19195 iommu/vt-d: debugfs: Fix legacy mode page table dump logic +- !19273 net/ip6_tunnel: Prevent perpetual tunnel growth +- !19272 tls: wait for pending async decryptions if tls_strp_msg_hold fails +- !19274 netfilter: nft_objref: validate objref and objrefmap expressions +- !19052 arm64/mpam: Add build dependencies for CONFIG_RESCTRL_IOMMU +- !19182 ALSA: ump: Fix buffer overflow at UMP SysEx message conversion +- !19179 x86/iopl: Cure TIF_IO_BITMAP inconsistencies +- !19178 fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var +- !19177 ACPICA: fix acpi parse and parseext cache leaks +- !19176 crypto: ccp - Fix crash when rebind ccp device for ccp.ko +- ub: ubase: change cmdq/mbx timeout val & fix spell error +- ub: ubase: adapt to response message structure change for ctrlq sl query +- net: unic: Fix UE deactivate message cleaning +- net: unic: Use copy instead of ummu map in tx +- netfilter: nft_objref: validate objref and objrefmap expressions +- net/ip6_tunnel: Prevent perpetual tunnel growth +- tls: wait for pending async decryptions if tls_strp_msg_hold fails +- !19257 init/Kconfig: Move ARCH_SUPPORTS_SCHED_SOFT_QUOTA to drop CGROUPS dependency +- obmm: Add resource management support for imported memory +- obmm: Add sysfs interface for configuration and monitoring +- obmm: Add low memory management support +- obmm: Add ownership management and transfer mechanisms +- obmm: Add mmap support for shared memory regions +- obmm: Add shared memory device interface +- obmm: Add pre-import support for performance optimization +- obmm: Add memory region import functionality +- obmm: Add address validation and checking +- obmm: Add user address export support +- obmm: Add memory region export functionality +- obmm: Implement memory pool allocator +- obmm: Add continuous memory allocator for OBMM framework +- obmm: Add cache maintenance helpers for inter-node consistency +- obmm: Add region definitions and core data structures +- obmm: Add Ownership Based Memory Management framework +- ub:hisi-ubus: Support for ub memory decoder ras handle +- ub:hisi-ubus: Support for UB Memory Decoder Initialization +- ub:ubus: Support for UB Memory Decoder general layer implementation +- !19227 bpf: Avoid RCU context warning when unpinning htab with internal structs +- !18830 mm: swap: check for stable address space before operating on the VMA +- init/Kconfig: Move ARCH_SUPPORTS_SCHED_SOFT_QUOTA to drop CGROUPS dependency +- !19165 Documentation: Add opensource document for ubase&unic&ubl +- !19243 Revert "net: hns3: add support for queue bonding mode of flow director" +- !19115 nvmet-fc: move lsop put work to nvmet_fc_ls_req_op +- !19222 sctp: Fix MAC comparison to be constant-time +- !19223 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() +- !19224 bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} +- !19226 sunrpc: fix null pointer dereference on zero-length checksum +- Revert "net: hns3: add support for queue bonding mode of flow director" +- Revert "net: hns3: add queue bonding mode support for VF" +- Revert "net: hns3: refactor the debugfs for dumping FD tcam" +- Revert "net: hns3: correct the logic of hclge_sync_vf_qb_mode()" +- Revert "net: hns3: allocate fd counter for queue bonding" +- !19166 [OLK-6.6][linux-6.6.y sync] Backport 6.6.89-6.6.90 LTS Patches +- !19116 Fix SPI registration failure logging level +- !19216 net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock +- drm/vmwgfx: Fix Use-after-free in validation +- Fix SPI registration failure logging level +- !19072 [OLK-6.6] Fix CVE-2025-39827 +- !18647 [OLK-6.6] Fix CVE-2025-38729 +- !19117 [OLK-6.6] Fix CVE-2025-40088 +- !19114 [OLK-6.6] Fix CVE-2025-40084 +- !19048 [OLK-6.6] Fix CVE-2025-39839 +- !18615 [OLK-6.6] Fix CVE-2025-39737 +- !18791 【OLK-6.6】fix CVE-2025-39736 +- !18644 [OLK-6.6] Fix CVE-2025-38717 +- !18653 [OLK-6.6] Fix CVE-2025-38705 +- !18780 【OLK-6.6】fix CVE-2025-38712 +- !18613 [OLK-6.6] Fix CVE-2025-38713 +- !18632 [OLK-6.6] Fix CVE-2025-38714 +- !18861 [OLK-6.6] Fix CVE-2025-38697 +- !18345 [OLK-6.6] Fix CVE-2025-38663 +- !18948 [OLK-6.6] Fix CVE-2025-38105 +- !18661 [OLK-6.6] Fix CVE-2025-39790 +- !18867 [OLK-6.6] Fix CVE-2025-39766 +- !18636 [OLK-6.6]Fix CVE-2025-39751 +- !19110 CVE-2025-40198 +- !19212 CVE-2025-40179 +- !19057 blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx +- !19213 Fix CVE-2025-39964 +- !19189 KVM: arm64: ipiv: change declaration argument +- bpf: Avoid RCU context warning when unpinning htab with internal structs +- sunrpc: fix null pointer dereference on zero-length checksum +- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} +- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() +- sctp: Fix MAC comparison to be constant-time +- !19214 ub: udma: recent bugfix for udma. +- !19209 Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak +- !19193 crypto: af_alg - Set merge to zero early in af_alg_sendmsg +- !19206 net: dlink: handle copy_thresh allocation failure +- !19207 net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast +- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock +- ub: ubase: Introduces the functions and data structures exposed by the ubase driver +- ub: ubase: Add ubase opensource document +- net: unic: Add a doc for unic driver +- ub: udma: Resolve issues related to stream logout and interrupt lock. +- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx +- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg +- ext4: align max orphan file size with e2fsprogs limit +- ext4: free orphan info with kvfree +- ext4: verify orphan file size is not too big +- ext4: use kmalloc_array() for array space allocation +- ub: udma: reset and segment permission issues are resolved. +- !19203 Fix CVE-2025-40202 +- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() +- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak +- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast +- net: dlink: handle copy_thresh allocation failure +- spi: tegra114: Use value to check for invalid delays +- platform/x86/amd: pmc: Clear metrics table at start of cycle +- dm: fix copying after src array boundaries +- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids +- drivers: base: handle module_kobject creation +- kernel: globalize lookup_or_create_module_kobject() +- kernel: param: rename locate_module_kobject +- xhci: split free interrupter into separate remove and free parts +- xhci: Clean up stale comment on ERST_SIZE macro +- xhci: Use more than one Event Ring segment +- xhci: Set DESI bits in ERDP register correctly +- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" +- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs +- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs +- ARM: dts: opos6ul: add ksz8081 phy properties +- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired +- firmware: arm_scmi: Balance device refcount when destroying devices +- sch_htb: make htb_qlen_notify() idempotent +- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties +- ASoC: Use of_property_read_bool() +- net: vertexcom: mse102x: Fix RX error handling +- net: vertexcom: mse102x: Add range check for CMD_RTS +- net: vertexcom: mse102x: Fix LEN_MASK +- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt +- net: fec: ERR007885 Workaround for conventional TX +- net: ipv6: fix UDPv6 GSO segmentation with NAT +- net: dsa: felix: fix broken taprio gate states after clock jump +- net: mdio: mux-meson-gxl: set reversed bit when using internal phy +- net: dlink: Correct endianness handling of led_mode +- nvme-pci: fix queue unquiesce check on slot_reset +- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion +- pds_core: make pdsc_auxbus_dev_del() void +- pds_core: delete VF dev on reset +- pds_core: check health in devcmd wait +- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised +- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID +- net: mscc: ocelot: treat 802.1ad tagged traffic as 802.1Q-untagged +- !19190 Revert "ipmi: fix msg stack when IPMI is disconnected" +- !19167 drm/vmwgfx: Fix a null-ptr access in the cursor snooper +- ipmi: Fix handling of messages with provided receive message pointer +- ipmi: Rework user message limit handling +- !19134 Bluetooth: ISO: Fix possible UAF on iso_conn_free +- !19119 dm: fix NULL pointer dereference in __dm_suspend() +- !19137 ext4: guard against EA inode refcount underflow in xattr update +- iommu/vt-d: debugfs: Fix legacy mode page table dump logic +- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping +- crypto: af_alg - Set merge to zero early in af_alg_sendmsg +- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() +- net/mlx5: E-switch, Fix error handling for enabling roce +- net/mlx5: E-Switch, Initialize MAC Address for Default GID +- powerpc/boot: Fix dash warning +- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' +- powerpc/boot: Check for ld-option support +- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence +- Squashfs: reject negative file sizes in squashfs_read_inode() +- Squashfs: add additional inode sanity checking +- Revert "ipmi: fix msg stack when IPMI is disconnected" +- KVM: arm64: ipiv: change declaration argument +- !19030 cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() +- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion +- !19045 net: fix the compile problem introduced by AF_UB +- x86/iopl: Cure TIF_IO_BITMAP inconsistencies +- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var +- ACPICA: fix acpi parse and parseext cache leaks +- crypto: ccp - Fix crash when rebind ccp device for ccp.ko +- net: appletalk: Fix use-after-free in AARP proxy probe +- net: ubl: Add a doc for ubl module +- !19161 uburma: add tp_type in urma ioctl operation. +- drm/vmwgfx: Fix a null-ptr access in the cursor snooper +- PCI: imx6: Skip controller_id generation logic for i.MX7D +- Revert "PCI: imx6: Skip controller_id generation logic for i.MX7D" +- selftests/bpf: extend changes_pkt_data with cases w/o subprograms +- selftests/bpf: validate that tail call invalidates packet pointers +- selftests/bpf: freplace tests for tracking of changes_packet_data +- cpufreq: Fix setting policy limits when frequency tables are used +- cpufreq: Avoid using inconsistent policy->min and policy->max +- smb: client: fix zero length for mkdir POSIX create context +- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug +- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles +- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) +- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid +- dm: always update the array size in realloc_argv on success +- dm-integrity: fix a warning on invalid table line +- dm-bufio: don't schedule in atomic context +- tracing: Do not take trace_event_sem in print_event_fields() +- spi: tegra114: Don't fail set_cs_timing when delays are zero +- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe +- mm/memblock: repeat setting reserved region nid if array is doubled +- mm/memblock: pass size instead of end to memblock_set_node() +- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload +- i2c: imx-lpi2c: Fix clock count when probe defers +- EDAC/altera: Set DDR and SDMMC interrupt mask before registration +- EDAC/altera: Test the correct error reg offset +- drm/fdinfo: Protect against driver unbind +- btrfs: fix COW handling in run_delalloc_nocow() +- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset +- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() +- !19143 [OLK-6.6][linux-6.6.y sync] Backport 6.6.88-6.6.89 LTS Patches +- uburma: add tp_type in urma ioctl operation. +- !19132 IPIV: fix bug in live migration +- ocfs2: fix double free in user_cluster_connect() +- !17056 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.68-6.6.69 LTS Conflicts Patches +- !18479 [OLK-6.6] xhci: fix memory leak regression when freeing xhci vdev devices depth first +- !19007 uio_hv_generic: Let userspace take care of interrupt mask +- ACPI: PPTT: Fix processor subtable walk +- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod +- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points +- dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" +- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" +- ata: libata-scsi: Fix CDL control +- net: fix the compile problem introduced by AF_UB +- objtool: Silence more KCOV warnings, part 2 +- objtool: Ignore end-of-section jumps for KCOV/GCOV +- nvme: fixup scan failure for non-ANA multipath controllers +- MIPS: cm: Fix warning if MIPS_CM is disabled +- net: dsa: mv88e6xxx: enable STU methods for 6320 family +- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family +- net: dsa: mv88e6xxx: enable PVT for 6321 switch +- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family +- comedi: jr3_pci: Fix synchronous deletion of timer +- driver core: introduce device_set_driver() helper +- x86/pvh: Call C code via the kernel virtual mapping +- md/raid1: Add check for missing source disk in process_checks() +- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores +- ubsan: Fix panic from test_ubsan_out_of_bounds +- spi: tegra210-quad: add rate limiting and simplify timeout error message +- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts +- loop: aio inherit the ioprio of original request +- riscv: Provide all alternative macros all the time +- iomap: skip unnecessary ifs_block_is_uptodate check +- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled +- scsi: pm80xx: Set phy_attached to zero when device is gone +- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() +- ext4: make block validity check resistent to sb bh corruption +- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 +- timekeeping: Add a lockdep override in tick_freeze() +- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode +- nvmet-fc: put ref when assoc->del_work is already scheduled +- nvmet-fc: take tgtport reference only once +- x86/bugs: Don't fill RSB on context switch with eIBRS +- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline +- x86/bugs: Use SBPB in write_ibpb() if applicable +- selftests/mincore: Allow read-ahead pages to reach the end of the file +- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment +- objtool: Stop UNRET validation on UD2 +- nvme: multipath: fix return value of nvme_available_path +- nvme: re-read ANA log page after ns scan completes +- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls +- ACPI: EC: Set ec_no_wakeup for Lenovo Go S +- nvme: requeue namespace scan on missed AENs +- xen: Change xen-acpi-processor dom0 dependency +- selftests: ublk: fix test_stripe_04 +- udmabuf: fix a buf size overflow issue during udmabuf creation +- KVM: s390: Don't use %pK through debug printing +- KVM: s390: Don't use %pK through tracepoints +- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP +- io_uring: always do atomic put from iowq +- rtc: pcf85063: do a SW reset if POR failed +- ntb_hw_amd: Add NTB PCI ID for new gen CPU +- ntb: reduce stack usage in idt_scan_mws +- objtool, lkdtm: Obfuscate the do_nothing() pointer +- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() +- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() +- objtool, panic: Disable SMAP in __stack_chk_fail() +- objtool: Silence more KCOV warnings +- thunderbolt: Scan retimers after device router has been enumerated +- usb: host: xhci-plat: mvebu: use ->quirks instead of ->init_quirk() func +- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() +- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running +- dmaengine: dmatest: Fix dmatest waiting less when interrupted +- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs +- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield +- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints +- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size +- usb: host: max3421-hcd: Add missing spi_device_id table +- bpf: Reject attaching fexit/fmod_ret to __noreturn functions +- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage +- bpf: bpftool: Setting error code in do_loader() +- s390/tty: Fix a potential memory leak bug +- s390/sclp: Add check for get_zeroed_page() +- parisc: PDT: Fix missing prototype warning +- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() +- crypto: ccp - Add support for PCI device 0x1134 +- MIPS: cm: Detect CM quirks from device tree +- pinctrl: renesas: rza2: Fix potential NULL pointer dereference +- USB: wdm: add annotation +- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context +- USB: wdm: close race between wdm_open and wdm_wwan_port_stop +- USB: wdm: handle IO errors in wdm_wwan_port_start +- USB: VLI disk crashes if LPM is used +- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive +- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive +- usb: dwc3: xilinx: Prevent spike in reset signal +- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) +- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling +- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines +- usb: cdns3: Fix deadlock when using NCM gadget +- USB: serial: simple: add OWON HDS200 series oscilloscope support +- USB: serial: option: add Sierra Wireless EM9291 +- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe +- serial: sifive: lock port in startup()/shutdown() callbacks +- serial: msm: Configure correct working mode before starting earlycon +- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack +- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration +- char: misc: register chrdev region with all possible minors +- KVM: x86: Explicitly treat routing entry type changes as changes +- mei: me: add panther lake H DID +- scsi: Improve CDL control +- USB: storage: quirk for ADATA Portable HDD CH94 +- ata: libata-scsi: Fix ata_msense_control_ata_feature() +- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type +- ata: libata-scsi: Improve CDL control +- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports +- KVM: SVM: Allocate IR data using atomic allocation +- io_uring: fix 'sync' handling of io_fallback_tw() +- LoongArch: Remove a bogus reference to ZONE_DMA +- drm/amd/display: Force full update in gpu reset +- drm/amd/display: Fix gpu reset in multidisplay config +- net: phy: microchip: force IRQ polling mode for lan88xx +- net: selftests: initialize TCP header and skb payload with zero +- crypto: atmel-sha204a - Set hwrng quality to lowest possible +- virtio_console: fix missing byte order handling for cols and rows +- LoongArch: Make do_xyz() exception handlers more robust +- LoongArch: Make regs_irqs_disabled() more clear +- LoongArch: Select ARCH_USE_MEMTEST +- splice: remove duplicate noinline from pipe_clear_nowait +- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE +- pds_core: Remove unnecessary check in pds_client_adminq_cmd() +- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants +- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration +- scsi: core: Clear flags for scsi_cmnd that did not complete +- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() +- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() +- dma/contiguous: avoid warning about unused size_bytes +- ceph: Fix incorrect flush end position calculation +- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get +- of: resolver: Fix device node refcount leakage in of_resolve_phandles() +- of: resolver: Simplify of_resolve_phandles() using __free() +- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five +- clk: renesas: r9a07g04[34]: Fix typo for sel_shdi variable +- clk: renesas: r9a07g04[34]: Use SEL_SDHI1_STS status configuration for SD1 mux +- clk: renesas: rzg2l: Refactor SD mux driver +- clk: renesas: rzg2l: Remove CPG_SDHI_DSEL from generic header +- clk: renesas: rzg2l: Add struct clk_hw_data +- clk: renesas: rzg2l: Use u32 for flag and mux_flags +- arm64: tegra: Remove the Orin NX/Nano suspend key +- iio: adc: ad7768-1: Fix conversion result sign +- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check +- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer +- ASoC: qcom: Fix trivial code style issues +- ASoC: qcom: lpass: Make asoc_qcom_lpass_cpu_platform_remove() return void +- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs +- ASoC: qcom: q6apm-dai: drop unused 'q6apm_dai_rtd' fields +- net: dsa: mv88e6xxx: fix VTU methods for 6320 family +- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family +- auxdisplay: hd44780: Fix an API misuse in hd44780.c +- auxdisplay: hd44780: Convert to platform remove callback returning void +- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get +- soc: qcom: ice: introduce devm_of_qcom_ice_get +- module: sign with sha512 instead of sha1 by default +- !18797 [OLK-6.6] Fix CVE-2025-38331 +- !18978 [OLK-6.6][linux-6.6.y sync] Backport 6.6.87-6.6.88 LTS Patches +- !19141 crash: fix crashkernel resource shrink +- !19136 ext4: detect invalid INLINE_DATA + EXTENTS flag combination +- crash: fix crashkernel resource shrink +- ext4: guard against EA inode refcount underflow in xattr update +- ext4: detect invalid INLINE_DATA + EXTENTS flag combination +- net: rose: fix a typo in rose_clear_routes() +- Bluetooth: ISO: Fix possible UAF on iso_conn_free +- net: nfc: nci: Add parameter validation for packet data +- KVM: arm64: ipiv: fix bug in live migration +- KVM: arm64: ipiv: Change parameter from vcpu to kvm +- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() +- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() +- net/smc: fix warning in smc_rx_splice() when calling get_page() +- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() +- s390/sclp: Fix SCCB present check +- net: rose: include node references in rose_neigh refcount +- net: rose: convert 'use' field to refcount_t +- net: rose: split remove and free operations in rose_remove_neigh() +- dm: fix NULL pointer dereference in __dm_suspend() +- net, hsr: reject HSR frame if skb can't hold tag +- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() +- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op +- ksmbd: transport_ipc: validate payload size before reading handle +- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed +- ext4: fix string copying in parse_apply_sb_mount_options() +- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() +- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx +- arm64/mpam: Add build dependencies for CONFIG_RESCTRL_IOMMU +- batman-adv: fix OOB read/write in network-coding decode +- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() +- md/md-bitmap: fix GPF in bitmap_get_stats() +- igc: fix lock order in igc_ptp_reset +- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" +- xen/x86: fix initial memory balloon target +- pwm: mediatek: Ensure to disable clocks in error path +- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model +- drm/tests: Build KMS helpers when DRM_KUNIT_TEST_HELPERS is enabled +- btrfs: fix the length of reserved qgroup to free +- MIPS: ds1287: Match ds1287_set_base_clock() function types +- MIPS: cevt-ds1287: Add missing ds1287.h include +- MIPS: dec: Declare which_prom() as static +- sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 +- sign-file,extract-cert: avoid using deprecated ERR_get_error_line() +- sign-file,extract-cert: move common SSL helper functions to a header +- nvmet-fc: Remove unused functions +- landlock: Add the errata interface +- wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit +- wifi: rtw89: pci: add pre_deinit to be called after probe complete +- LoongArch: Eliminate superfluous get_numa_distances_cnt() +- x86/split_lock: Fix the delayed detection logic +- x86/xen: fix memblock_reserve() usage on PVH +- x86/xen: move xen_reserve_extra_memory() +- Fix mmu notifiers for range-based invalidates +- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type +- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error +- kbuild: Add '-fno-builtin-wcslen' +- cpufreq: Reference count policy in cpufreq_update_limits() +- io_uring/net: fix accept multishot handling +- drm/i915/gvt: fix unterminated-string-initialization warning +- drm/sti: remove duplicate object names +- drm/amdgpu/dma_buf: fix page_link check +- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero +- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero +- drm/amd/pm/smu11: Prevent division by zero +- drm/amd/pm/powerplay: Prevent division by zero +- drm/amd/pm: Prevent division by zero +- drm/amd: Handle being compiled without SI or CIK support better +- drm/msm/a6xx: Fix stale rpmh votes from GPU +- drm/repaper: fix integer overflows in repeat functions +- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR +- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX +- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR +- perf/x86/intel: Allow to update user space GPRs from PEBS records +- scsi: ufs: exynos: Ensure consistent phy reference counts +- scsi: megaraid_sas: Block zero-length ATA VPD inquiry +- x86/boot/sev: Avoid shared GHCB page for early memory acceptance +- x86/cpu/amd: Fix workaround for erratum 1054 +- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches +- string: Add load_unaligned_zeropad() code path to sized_strscpy() +- smb3 client: fix open hardlink on deferred close file error +- selftests/mm: generate a temporary mountpoint for cgroup filesystem +- riscv: Avoid fortify warning in syscall_get_arguments() +- ksmbd: fix the warning from __kernel_write_iter +- ksmbd: Prevent integer overflow in calculation of deadtime +- ksmbd: fix use-after-free in smb_break_all_levII_oplock() +- ovl: don't allow datadir only +- mm: fix apply_to_existing_page_range() +- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() +- loop: LOOP_SET_FD: send uevents for partitions +- loop: properly send KOBJ_CHANGED uevent for disk device +- crypto: caam/qi - Fix drv_ctx refcount bug +- btrfs: correctly escape subvol in btrfs_show_options() +- Bluetooth: vhci: Avoid needless snprintf() calls +- Bluetooth: l2cap: Process valid commands in too long frame +- ftrace: fix incorrect hash size in register_ftrace_direct() +- i2c: atr: Fix wrong include +- nfs: add missing selections of CONFIG_CRC32 +- asus-laptop: Fix an uninitialized variable +- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels +- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate +- writeback: fix false warning in inode_to_wb() +- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS +- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break +- riscv: KGDB: Do not inline arch_kgdb_breakpoint() +- kunit: qemu_configs: SH: Respect kunit cmdline +- riscv: Properly export reserved regions in /proc/iomem +- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings +- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps +- ptp: ocp: fix start time alignment in ptp_ocp_signal_set +- net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails +- net: bridge: switchdev: do not notify new brentries as changed +- net: b53: enable BPDU reception for management port +- netlink: specs: rt-link: adjust mctp attribute naming +- netlink: specs: rt-link: add an attr layer around alt-ifname +- ata: libata-sata: Save all fields from sense data descriptor +- net: ethernet: ti: am65-cpsw: fix port_np reference counting +- net: ethernet: ti: am65-cpsw-nuss: rename phy_node -> port_np +- pds_core: fix memory leak in pdsc_debugfs_add_qcq() +- test suite: use %zu to print size_t +- igc: add lock preventing multiple simultaneous PTM transactions +- igc: cleanup PTP module if probe fails +- igc: handle the IGC_PTP_ENABLED flag correctly +- igc: move ktime snapshot into PTM retry loop +- igc: increase wait time before retrying PTM +- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" +- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address +- ASoC: cs42l43: Reset clamp override on jack removal +- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() +- ovl: remove unused forward declaration +- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() +- ASoC: dwc: always enable/disable i2s irqs +- md/md-bitmap: fix stats collection for external bitmaps +- md/raid10: fix missing discard IO accounting +- scsi: iscsi: Fix missing scsi_host_put() in error path +- wifi: wl1251: fix memory leak in wl1251_tx_work +- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() +- Bluetooth: hci_uart: Fix another race during initialization +- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline +- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() +- ACPI: platform-profile: Fix CFI violation when accessing sysfs files +- selftests: mptcp: fix incorrect fd checks in main_loop +- selftests: mptcp: close fd_in before returning in main_loop +- pinctrl: qcom: Clear latched interrupt status when changing IRQ type +- phy: freescale: imx8m-pcie: assert phy reset and perst in power off +- PCI: Fix reference leak in pci_alloc_child_bus() +- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() +- of/irq: Fix device node refcount leakages in of_irq_init() +- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() +- of/irq: Fix device node refcount leakages in of_irq_count() +- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() +- of/irq: Fix device node refcount leakage in API of_irq_parse_one() +- ntb: use 64-bit arithmetic for the MSI doorbell mask +- KVM: x86: Explicitly zero-initialize on-stack CPUID unions +- gve: handle overflow when reporting TX consumed descriptors +- gpio: zynq: Fix wakeup source leaks on device unbind +- gpio: tegra186: fix resource handling in ACPI probe path +- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' +- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' +- dm-verity: fix prefetch-vs-suspend race +- dm-integrity: set ti->error on memory allocation failure +- dm-ebs: fix prefetch-vs-suspend race +- crypto: ccp - Fix check for the primary ASP device +- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL +- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code +- clk: qcom: gdsc: Release pm subdomains in reverse add order +- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks +- cifs: fix integer overflow in match_server() +- cifs: avoid NULL pointer dereference in dbg call +- thermal/drivers/rockchip: Add missing rk3328 mapping entry +- x86/xen: fix balloon target initialization for PVH dom0 +- mm/hugetlb: move hugetlb_sysctl_init() to the __init section +- mm/userfaultfd: fix release hang over concurrent GUP +- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free +- ALSA: usb-audio: Kill timer properly at removal +- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() +- uio_hv_generic: Let userspace take care of interrupt mask +- mm/mremap: correctly handle partial mremap() of VMA starting at 0 +- mm: fix lazy mmu docs and usage +- mm: make page_mapped_in_vma() hugetlb walk aware +- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() +- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes +- sparc/mm: disable preemption in lazy mmu mode +- iommufd: Fix uninitialized rc in iommufd_access_rw() +- btrfs: zoned: fix zone finishing with missing devices +- btrfs: zoned: fix zone activation with missing devices +- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers +- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string +- arm64: mm: Correct the update of max_pfn +- mtd: rawnand: Add status chack in r852_ready() +- mtd: inftlcore: Add error check for inftl_read_oob() +- mptcp: only inc MPJoinAckHMacFailure for HMAC failures +- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets +- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() +- mailbox: tegra-hsp: Define dimensioning masks in SoC data +- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs +- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs +- jbd2: remove wrong sb->s_sequence check +- i3c: Add NULL pointer check in i3c_master_queue_ibi() +- i3c: master: svc: Use readsb helper for reading MDB +- smb311 client: fix missing tcon check when mounting with linux/posix extensions +- udf: Fix inode_getblk() return value +- vdpa/mlx5: Fix oversized null mkey longer than 32bit +- f2fs: fix to avoid atomicity corruption of atomic file +- ext4: fix off-by-one error in do_split +- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path +- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. +- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. +- ASoC: q6apm: add q6apm_get_hw_pointer helper +- io_uring/kbuf: reject zero sized provided buffers +- wifi: mac80211: fix integer overflow in hwmp_route_info_get() +- wifi: mt76: Add check for devm_kstrdup() +- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup +- mtd: Replace kcalloc() with devm_kcalloc() +- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family +- mtd: Add check for devm_kcalloc() +- mptcp: sockopt: fix getting IPV6_V6ONLY +- media: i2c: imx219: Rectify runtime PM handling in probe and remove +- media: venus: hfi_parser: add check to avoid out of bound access +- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO +- media: i2c: ov7251: Set enable GPIO low in probe +- media: i2c: ccs: Set the device's runtime PM status correctly in probe +- media: i2c: ccs: Set the device's runtime PM status correctly in remove +- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() +- media: platform: stm32: Add check for clk_enable() +- media: visl: Fix ERANGE error when setting enum controls +- media: streamzap: prevent processing IR data on URB failure +- tpm, tpm_tis: Fix timeout handling when waiting for TPM status +- spi: cadence-qspi: Fix probe on AM62A LP SK +- xenfs/xensyms: respect hypervisor's "next" indication +- media: siano: Fix error handling in smsdvb_module_init() +- media: vim2m: print device name after registering device +- media: venus: hfi: add check to handle incorrect queue size +- media: venus: hfi: add a check to handle OOB in sfr region +- media: i2c: adv748x: Fix test pattern selection mask +- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning +- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization +- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems +- ext4: don't treat fhandle lookup of ea_inode as FS corruption +- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags +- pwm: fsl-ftm: Handle clk_get_rate() returning 0 +- pwm: rcar: Improve register calculation +- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() +- tpm, tpm_tis: Workaround failed command reception on Infineon devices +- ktest: Fix Test Failures Due to Missing LOG_FILE Directories +- drm/amdgpu: grab an additional reference on the gang fence v2 +- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off +- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data +- drm/amdkfd: debugfs hang_hws skip GPU with MES +- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset +- drm/amdkfd: clamp queue size to minimum +- drivers: base: devres: Allow to release group on device release +- drm/bridge: panel: forbid initializing a panel with unknown connector type +- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) +- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 +- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide +- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB +- drm: panel-orientation-quirks: Add support for AYANEO 2S +- drm/amd/display: add workaround flag to link to force FFE preset +- drm/amd/display: Update Cursor request mode to the beginning prefetch always +- drm: allow encoder mode_set even when connectors change for crtc +- Bluetooth: qca: simplify WCN399x NVM loading +- Bluetooth: hci_uart: fix race during initialization +- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER +- net: vlan: don't propagate flags on open +- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table +- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk +- Revert "f2fs: rebuild nat_bits during umount" +- ext4: protect ext4_release_dquot against freezing +- ahci: add PCI ID for Marvell 88SE9215 SATA Controller +- net: sfp: add quirk for 2.5G OEM BX SFP +- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode +- jfs: add sanity check for agwidth in dbMount +- fs/jfs: cast inactags to s64 to prevent potential overflow +- net: usb: asix_devices: add FiberGecko DeviceID +- scsi: target: spc: Fix RSOC parameter data header size +- f2fs: don't retry IO for corrupted data scenario +- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process +- ASoC: amd: yc: update quirk data for new Lenovo model +- ASoC: amd: Add DMI quirk for ACP6X mic support +- ALSA: usb-audio: Fix CME quirk for UF series keyboards +- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves +- media: uvcvideo: Add quirk for Actions UVC05 +- ASoC: fsl_audmix: register card device depends on 'dais' property +- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist +- ALSA: hda: intel: Fix Optimus when GPU has no sound +- HID: pidff: Add FIX_WHEEL_DIRECTION quirk +- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol +- HID: pidff: Add PERMISSIVE_CONTROL quirk +- HID: pidff: Add MISSING_PBO quirk and its detection +- HID: pidff: Add MISSING_DELAY quirk and its detection +- HID: pidff: Do not send effect envelope if it's empty +- HID: pidff: Convert infinite length from Linux API to PID standard +- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() +- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault +- xen/mcelog: Add __nonstring annotations for unterminated strings +- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD +- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine +- x86/ia32: Leave NULL selector values 0~3 unchanged +- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW +- pm: cpupower: bench: Prevent NULL dereference on malloc failure +- umount: Allow superblock owners to force umount +- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group +- nft_set_pipapo: fix incorrect avx2 match of 5th field octet +- nvmet-fcloop: swap list_add_tail arguments +- ata: sata_sx4: Add error handling in pdc20621_i2c_read() +- drm/tests: probe-helper: Fix drm_display_mode memory leak +- drm/tests: modes: Fix drm_display_mode memory leak +- drm/tests: cmdline: Fix drm_display_mode memory leak +- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode +- drm/tests: helpers: Fix compiler warning +- drm/tests: helpers: Add helper for drm_display_mode_from_cea_vic() +- drm/tests: Add helper to create mock crtc +- drm/tests: Add helper to create mock plane +- drm/tests: helpers: Add atomic helpers +- drm/tests: modeset: Fix drm_display_mode memory leak +- net: ethtool: Don't call .cleanup_data when prepare_data fails +- tc: Ensure we have enough buffer space when sending filter netlink notifications +- net/sched: cls_api: conditional notification of events +- rtnl: add helper to check if a notification is needed +- rtnl: add helper to check if rtnl group has listeners +- octeontx2-pf: qos: fix VF root node parent queue index +- net: tls: explicitly disallow disconnect +- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() +- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() +- drm/i915: Disable RPG during live selftest +- drm/i915/dg2: wait for HuC load completion before running selftests +- drm/i915/xelpg: Extend driver code of Xe_LPG to Xe_LPG+ +- drm/i915/mocs: use to_gt() instead of direct &i915->gt +- selftests/futex: futex_waitv wouldblock test should fail +- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit +- jfs: upper bound check of tree index in dbAllocAG +- mm: swap: check for stable address space before operating on the VMA +- net: ethernet: cortina: Use TOE/TSO on all TCP +- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock +- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() +- bus: mhi: host: Detect events pointing to unexpected TREs +- drm/amd/pm: fix null pointer access +- ALSA: usb-audio: Validate UAC3 power domain descriptors, too +- net: kcm: Fix race condition in kcm_unattach() +- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control +- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() +- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() +- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() +- xhci: fix memory leak regression when freeing xhci vdev devices depth first +- usb: xhci: Fix slot_id resource race conflict +- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() +- nilfs2: reject invalid file types when reading inodes +- mtd: inftlcore: Add error check for inftl_read_oob() +- freezer, sched: Report frozen tasks as 'D' instead of 'R' +- io_uring/sqpoll: fix sqpoll error handling races +- i2c: microchip-core: actually use repeated sends +- PCI/MSI: Handle lack of irqdomain gracefully +- i2c: imx: add imx7d compatible string for applying erratum ERR007805 +- i2c: microchip-core: fix "ghost" detections + +* Fri Nov 21 2025 Liu Wang <1823363429@qq.com> - 6.6.0-120.0.0.98 +- Split kernel modules into kernel-extra-modules subpackage +- Prioritizes core kmod (networking/drm/block/modesetting) in main kernel package +- All extra modules and their dependencies are isolated to kernel-extra-modules +- Added module-filelist generation scripts for both packages +- Updated post-install scripts to handle extra modules dependency + +* Thu Nov 20 2025 Li Nan <linan122@huawei.com> - 6.6.0-120.0.0.97 +- !18976 ubagg: implement ubagg module with ioctl interface and topology management +- !19139 ub: ubase: Fix CTRLQ init process +- !18998 uburma: implement jetty linking features. +- ub: ubase: Fix CTRLQ init process +- !19123 ub: udma: Support udma basic transaction operations and advanced features. +- !19122 crypto: rng - Ensure set_ent is always present +- !19121 ub: ubase: Do some bugfix about cmdq/ctrlq message and debugfs +- urma: add ubagg ioctl interface and topology management +- ub: udma: jetty and rct support the hugepage buffer. +- ub: udma: Support 2M hugepage function. +- ub: udma: Support query ub memory info. +- ub: udma: Support query resource ratio. +- ub: udma: Support query entity information. +- ub: udma: Support create and destroy stars jfc. +- ub: udma: Support create and destroy stars jfs. +- ub: udma: Support tp context inquiry. +- ub: udma: Support entity index inquiry. +- ub: udma: Support device status inquiry. +- ub: udma: Support flush jfs and jetty. +- ub: udma: Support destroy jfs and jetty batch. +- ub: udma: Support bind and unbind jetty. +- ub: udma: Support dump ce aux info. +- ub: udma: Support dump ae aux info. +- ub: udma: Support query NPU info. +- ub: udma: Support deactivate tp. +- ub: udma: Support active tp. +- ub: udma: Support get tp list. +- ub: udma: Support rearm jfc and clean jfc. +- ub: udma: Support poll jfc. +- ub: udma: Support post jetty work request. +- ub: udma: Support post jfr work request. +- ub: udma: Support post jfs work request. +- !19103 Fix CVE-2025-40123 +- !19082 ub:ubus: call ub_host_probe inside register_ub_manage_subsystem_ops +- uburma: implement comprehensive jetty linking and transport features +- uburma: implement jetty resource control and command structures +- uburma: add uburma command and user object framework headers +- uburma: introduce uburma basic types and helper functions +- !19120 KVM: arm64: Fix access_actlr() build warning +- !18952 ubcore: implement memory and netlink features. +- ub: ubase: Fix the lose of HIMAC reset. +- ub: ubase: flush the work queue. +- net: unic: Fix lose vport_ctx and vport_buf information query in debugfs +- !19091 ub: ub_fwctl: Release rpc_out when kernel state return error +- ub: ubase: Fix link status timestamp information +- net: unic: Fix configure coal parameters without deactivate +- ub: ubase: Fix CTRLQ white list +- ub: ubase: Optimization of ubase_ctrlq_send_msg interface parameters +- ub: ubase: Fix verification to ctrlq message seq +- net: unic: Fix the ethtool stats and basic capability information query interface +- ub: ubase: add CMDQ&CTRLQ compatibility code +- ub: ubase: Fix priqos infomaton interface functions to query and check sl_bitmap +- !19058 ub: udma: udma driver TA layer resource control operation. +- crypto: rng - Ensure set_ent is always present +- KVM: arm64: Fix access_actlr() build warning +- !19081 ub:ubus: Fix X86 build error +- ub: ub_fwctl: Release rpc_out when kernel state return error +- fwctl:Change the CONFIG_FWCTL in the config options to m +- selftests/bpf: Add test case for different expected_attach_type +- bpf: Enforce expected_attach_type for tailcall compatibility +- ubagg: implement ubagg basic infrastructure components +- !19093 some minor bugfix about zcopy +- !19087 v2 Fix bugs +- !19064 iommu/ummu: Bugfix of ummu +- zcopy: Remove the dump_pagetable interface +- zcopy: Fix the incorrect mapping size passed in attach_pte_range +- ub: udma: Add and remove jetty to jetty group. +- ub: udma: Support import and unimport jfr and jetty. +- iommu/ummu: Fix builds under different kconfigs +- xcall2.0: Fix stack-out-of-bounds bug in xcall_write() +- xcall2.0: Fix the semantic changes in xcall_enable +- xcall2.0: Fix module unload issue by fixing refcount +- !19071 net:nebula-matrix:fix compile err +- !19080 KVM: arm64: ipiv: Fix compilation warning +- !19070 xsched: XCU Partition +- !18995 CVE-2025-40169 +- !19028 mm/slab: make __free(kfree) accept error pointers +- ub:ubus: call ub_host_probe inside register_ub_manage_subsystem_ops +- ub:ubus: Fix X86 build error +- KVM: arm64: ipiv: Fix compilation warning +- !19069 mm: hugetlb: avoid soft lockup when mprotect to large memory area +- !19066 arch_numa: make node_reclaim_distance_setup static +- !19053 blk-ioinf: fix default weight being reset to 0 for non-root cgroups +- ubcore: add ubcore_umem and ubcore_tp implementations +- net:nebula-matrix:fix compile err +- xsched: Add support for CFS quota for cgroups +- xsched: Add XCU control group implementation and its backend in xsched CFS +- xsched: Add xsched CFS class +- xsched: Add xsched RT class +- xsched: Add basic scheduler core support +- xsched: Introduce vstream management +- xcu: Add base NPU driver support +- xsched: Add base vstream support +- mm: hugetlb: avoid soft lockup when mprotect to large memory area +- ubcore: add ubcore_umem and ubcore_tp implementations +- ubcore: implement ubcore connection management and messaging feature. +- ubcore: add segment management support to ubcore module. +- ubcore: add genl, netlink and vtp support to ubcore module. +- arch_numa: make node_reclaim_distance_setup static +- ub: udma: Support modify jfc. +- ub: udma: Support modify jfr. +- ub: udma: Support modify jetty. +- ub: udma: Support modify jfs. +- ub: udma: Support destroy jetty group. +- ub: udma: Support create jetty group. +- ub: udma: Support destroy jetty. +- ub: udma: Support create jetty. +- ub: udma: Support destroy jfc. +- ub: udma: Support create jfc. +- ub: udma: Support destroy jfr. +- ub: udma: Support create jfr. +- ub: udma: Support destroy jfs. +- ub: udma: Support create jfs. +- ub: udma: Support query table item from hw. +- ub: udma: Support query jfr context from hw. +- ub: udma: Support query jfs and jetty context from hw. +- !19043 EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller +- iommu/ummu: Fix 2P virtualization error +- iommu/ummu: Fix ubmem unmap return value error +- !18348 Intel: Backport PMU support for Intel Clearwater Forest platform +- blk-ioinf: fix default weight being reset to 0 for non-root cgroups +- !18703 ub: udma: Support loading and unloading driver. +- !19031 v6 fuse:io_uring: support fuse over io_uring +- !19033 ub:ubus: Add ummu_map attribute in sysfs +- !18980 misc: uacce - fix a null pointer access issue when poweroff +- !18519 media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls +- !18518 iio: imu: bno055: fix OOB access of hw_xlate array +- !18515 s390/ism: fix concurrency management in ism_cmd() +- !18493 drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ +- !18506 Fix CVE-2025-39781 +- !18505 Fix CVE-2025-38696 +- !18504 Fix CVE-2025-38640 +- !18503 Fix CVE-2025-39716 +- !18502 Fix CVE-2025-39767 +- !18501 Fix CVE-2025-39693 +- !18494 Fix CVE-2025-39909 +- !18497 Fix CVE-2025-39952 +- !18492 Fix CVE-2025-39916 +- !18957 [OLK-6.6] Fix CVE-2025-39846 +- !18956 [OLK-6.6] Fix CVE-2025-39842 +- !18955 [OLK-6.6] Fix CVE-2025-39861 +- !18954 [OLK-6.6] Fix CVE-2025-39794 +- !18953 [OLK-6.6] Fix CVE-2025-39863 +- !18633 [OLK-6.6] Fix CVE-2025-38715 +- !18631 [OLK-6.6]Fix CVE-2025-38698 +- !18215 [OLK-6.6] Fix CVE-2025-38576 +- !18398 btrfs: avoid NULL pointer dereference if no valid csum tree +- !18876 Fix CVE-2025-38011 +- !18388 fs/ntfs3: handle hdr_first_de() return value +- !18369 usb: renesas_usbhs: Reorder clock handling and power management in probe +- !18367 clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() +- !18321 wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() +- !18310 net: usb: aqc111: debug info before sanitation +- !18309 coresight: fix indentation error in cscfg_remove_owned_csdev_configs() +- !18949 [OLK-6.6] Fix CVE-2025-38107 +- !18947 [OLK-6.6] Fix CVE-2025-38126 +- !18946 [OLK-6.6] Fix CVE-2025-38218 +- !18945 [OLK-6.6] Fix CVE-2025-38217 +- !18944 [OLK-6.6] Fix CVE-2025-38230 +- !18814 [OLK-6.6] Fix CVE-2025-38225 +- !18813 [OLK-6.6] Fix CVE-2025-38185 +- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller +- !18812 [OLK-6.6] Fix CVE-2025-38206 +- !18675 wifi: ath12k: Fix memory leak due to multiple rx_stats allocation +- !18432 [OLK-6.6] Fix CVE-2025-38259 +- !18244 eventpoll: don't decrement ep refcount while still holding the ep mutex +- !18245 wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() +- !18243 f2fs: fix to do sanity check on ino and xnid +- !18242 jffs2: check jffs2_prealloc_raw_node_refs() result in few other places +- !18246 aoe: clean device rq_list in aoedev_downdev() +- ub: udma: Support init and uninit dfx function. +- ub: udma: Support register and unregister segment function. +- ub: udma: Support set eid function. +- ub: udma: Support register and unregister ctrlq event. +- ub: udma: Support register and unregister ce and crq event. +- ub: udma: Support register and unregister ae event. +- ub: udma: Register and unregister debugfs. +- ub: udma: Create and destroy u-context. +- ub:ubus: Add ummu_map attribute in sysfs +- openeuler_defconfig: enable CONFIG_FUSE_IO_URING by default +- fuse: remove unneeded atomic set in uring creation +- fuse: removed unused function fuse_uring_create() from header +- fuse: {io-uring} Fix a possible req cancellation race +- fuse: fix possible deadlock if rings are never initialized +- fuse: fix uring race condition for null dereference of fc +- fuse: prevent disabling io-uring on active connections +- fuse: enable fuse-over-io-uring +- fuse: block request allocation until io-uring init is complete +- fuse: {io-uring} Prevent mount point hang on fuse-server termination +- fuse: Allow to queue bg requests through io-uring +- fuse: Allow to queue fg requests through io-uring +- fuse: {io-uring} Make fuse_dev_queue_{interrupt,forget} non-static +- fuse: {io-uring} Handle teardown of ring entries +- fuse: Add io-uring sqe commit and fetch support +- fuse: {io-uring} Make hash-list req unique finding functions non-static +- fuse: Add fuse-io-uring handling into fuse_copy +- fuse: Make fuse_copy non static +- fuse: {io-uring} Handle SQEs - register commands +- fuse: make args->in_args[0] to be always the header +- fuse: Add fuse-io-uring design documentation +- fuse: Move request bits +- fuse: Move fuse_get_dev to header file +- fuse: rename to fuse_dev_end_requests and make non-static +- io_uring: fix kabi broken for header file changed +- io_uring: fix kabi broken in struct io_submit_state +- io_uring: fix kabi broken in struct io_ring_ctx +- io_uring: fix kabi broken in struct io_tw_state +- io_uring: kill dead code in io_req_complete_post +- io_uring: remove dead struct io_submit_state member +- io_uring/cmd: let cmds to know about dying task +- io_uring: clean up io_lockdep_assert_cq_locked +- io_uring: refactor io_req_complete_post() +- io_uring: remove current check from complete_post +- io_uring: get rid of intermediate aux cqe caches +- io_uring: refactor io_fill_cqe_req_aux +- io_uring: remove struct io_tw_state::locked +- io_uring: force tw ctx locking +- io_uring/cmd: document some uring_cmd related helpers +- io_uring/cmd: fix tw <-> issue_flags conversion +- io_uring/cmd: kill one issue_flags to tw conversion +- io_uring/cmd: move io_uring_try_cancel_uring_cmd() +- io_uring/cmd: give inline space in request to cmds +- io_uring/cmd: expose iowq to cmds +- io_uring/cmd: inline io_uring_cmd_do_in_task_lazy +- io_uring: split out cmd api into a separate header +- io_uring: cancelable uring_cmd +- io_uring: retain top 8bits of uring_cmd flags for kernel internal use +- !19006 ub:ubus: Bugfix of ubus and ubfi +- mm/slab: make __free(kfree) accept error pointers +- Revert "mm/slab: make __free(kfree) accept error pointers" +- !18969 arm64/mpam: Add quirk to shrink MATA PMG range +- ub:ubus: Bugfix of ubus and ubfi +- ub: udma: Support loading and unloading driver. +- !18859 KVM: arm64: Deactivate the spurious vtimer interrupt +- !19009 v2 mm: Fix shmem build and numa fault counting errors +- !19019 media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() +- KVM: arm64: Deactivate the spurious vtimer interrupt +- !19026 accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() +- !19024 sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC +- !19027 v11 Add xcall 2.0 support +- xcall2.0: Introduce xcall epollwait prefetch feature +- openeuler_defconfig: Enable CONFIG_DYNAMIC_XCALL by default +- xcall2.0: Add a basic testcase +- xcall: Add debug mode to force fast syscall for all threads +- xcall: Rework the early exception vector of XCALL and SYNC +- xcall2.0: Support xcall1.0 for hardware xcall +- xcall2.0: Hajack syscall with dynamic instruciton replace +- xcall2.0: Add xcall_area +- xcall2.0: Add xcall module register interface +- xcall2.0: Add userspace proc interface +- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() +- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC +- !18988 zcopy: A zero-copy data transfer mechanism +- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() +- mm: fix nr_pages counting for folio in task_numa_fault +- mm: fix shmem build errors with CONFIG_SWAP disable +- !18970 net: unic: Support advanced functions of unic driver +- !18964 ub: add cdma driver code +- !18874 mm: introduce memalloc_flags_{save,restore} +- !18428 Add ccp-mdev feature into hygon ccp driver +- selftests/bpf: Add tests for rejection of ALU ops with negative offsets +- bpf: Reject negative offsets for ALU ops +- !18440 [OLK-6.6] pinctrl: Zhaoxin: Add KH-50000 support +- !18992 blk-ioinf: fix division by zero caused by inflight overflow in ioinf_qos_write() +- !18482 [OLK-6.6] ACPI: processor: idle: Set timer broadcast state on C3 for KH-50000 +- !18478 [OLK-6.6] hwmon: zhaoxin-cputemp: Update for KH-50000 +- !18477 [OLK-6.6] perf/zhaoxin/core: Tailor FMS for KH-50000 +- !18467 [OLK-6.6] Enhance SM3 SM4 drivers with optimizations and compatibility fixes +- !18450 [OLK-6.6] i2c: zhaoxin: Enhancements and Modifications to SMBus Driver +- !18449 [OLK-6.6] Optimize Zhaoxin CPU Temp Monitoring During Suspend/Resume +- !18447 RDMA/bnxt_re: Fix error recovery sequence +- !18448 bnxt_en: Fix ethtool -d byte order for 32-bit values +- !18452 bnxt_en: Fix DCB ETS validation +- !18961 mm: add huge pfnmap support for remap_pfn_range() +- blk-ioinf: fix division by zero caused by inflight overflow in ioinf_qos_write() +- !18950 urma: implement netlink and memory management features. +- !18930 ubcore: implement device registration and jetty management +- zcopy: enable ZCOPY module +- zcopy: Add ZCOPY documentation +- zcopy: Add debug inerface dump_pagetable +- zcopy: Add tracepoint for PageAttach +- zcopy: Extend PMD trans hugepage mapping ability +- zcopy: Introduce the pageattach interface +- zcopy: Initialize zcopy module +- ubcore: add genl, netlink and vtp support to ubcore module. +- !18960 KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid +- misc: uacce - fix a null pointer access issue when poweroff +- !18966 wakeup kswapd during node_reclaim +- !18857 Backport PLR (Power Limit Reasons) TPMI driver for 6.6 +- !17988 [OLK-6.6] Fix CVE-2025-38734 +- !18005 [OLK-6.6] Fix CVE-2025-38718 +- !18977 mm: migrate: Fix the compilation error caused by redundant semicolons +- mm: migrate: Fix the compilation error caused by redundant semicolons +- !18943 smb: client: validate change notify buffer before copy +- !18942 rtc: rx8025: fix incorrect register reference +- !18051 [OLK-6.6] [Bugfix] Bug fix for min_free_kbytes warning storms +- !18040 [OLK-6.6] Fix CVE-2025-39808 +- ub: cdma: support for cdma kernelspace north-south compatibility requirements +- ub: cdma: support reset function +- ub: cdma: support RX stop flow function +- ub: cdma: support debugfs interface +- ub: cdma: support dma faa semantic +- ub: cdma: support dma cas semantic +- ub: cdma: support dma read semantic +- ub: cdma: support dma write with notify semantic +- ub: cdma: support dma write semantic delivery +- ub: cdma: support dma write semantic configuration +- ub: cdma: support kernel resource reclamation +- !18892 CCA: Fix soft lockup bug while destroy realm +- ubcore: implement support for UVS commands +- ubcore: implement device registration and jetty management +- !18968 kvm: supports hugepages POD when migrate vm +- ubcore: add device management for character device and class operations +- kvm: supports hugepages POD when migrate vm +- net: unic: Debugfs supports querying IP specifications and IP entries. +- net: unic: support subscribes to the RX stream stop and recovery interface. +- net: unic: support config/query traffic class parameters +- net: unic: support config/query ets parameters +- net: unic: Add debugfs support for QoS configuration and query. +- net: unic: support config/query the mapping between dscp and tc +- net: unic: Support RAS +- net: unic: Drive supports ub entity reset. +- net: unic: Support to query and clear historical NIC link status information +- net: unic: support querying and configuring coalesce parameters. +- net: unic: Add debugfs for JFS/JFR/JFC context. +- net: unic: Support driver dump register. +- arm64/mpam: Merge redundant local static variables 'cpus' +- arm64/mpam: Add quirk to shrink MATA PMG range +- !18963 kvm: supports hugepages reclaime notify +- mm: node_reclaim: add wakeup kswapd mode +- mm: vmscan: wakeup kswapd during node_reclaim +- arch_numa: Make node reclaim distance adjustment always available +- kvm: supports hugepages reclaime notify +- !18940 [OLK-6.6][linux-6.6.y sync] Backport 6.6.86-6.6.87 LTS Patches +- arm64/x86: configs: Enable huge pfnmap support in openeuler defconfig +- mm: introduce remap_pfn_range_try_pmd() for PMD-level hugepage mapping +- pgtable: add pte_clrhuge() implementation for arm64 +- arm64: mm: Drop dead code for pud special bit handling +- mm/huge_memory: check pmd_special() only after pmd_present() +- mm/arm64: support large pfn mappings +- mm/x86: support large pfn mappings +- mm: always define pxx_pgprot() +- mm/fork: accept huge pfnmap entries +- mm/pagewalk: check pfnmap for folio_walk_start() +- mm/gup: detect huge pfnmap entries in gup-fast +- mm: allow THP orders for PFNMAPs +- mm: mark special bits for huge pfn mappings when inject +- mm: drop is_huge_zero_pud() +- mm: introduce ARCH_SUPPORTS_HUGE_PFNMAP and special bits to pmd/pud +- !18841 mm: add auxillary functions for folios and hugetlb +- !18896 kvm: add struct kvm if only CONFIG_KVM enabled +- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid +- mm: hugetlb: add putback_hugetlb_folio() +- mm: hugetlb: add get_hugetlb_folio_nodemask() mm: hugetlb: add filter function to dequeue hugetlb functions +- mm: migrate: add isolate_and_migrate_folios() +- kvm: add struct kvm if only CONFIG_KVM enabled +- !18908 [Backport] mm/hugetlb: declare hugetlbfs_pagecache_present() non-static +- !18376 net: wangxun: ngbe: add support for wangxun 1G +- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() +- ocfs2: prevent release journal inode after journal shutdown +- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early +- ARM: tegra: Use I/O memcpy to write to IRAM +- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work +- !18887 urma: implement ubcore sysfs interface and device management +- net_sched: ets: fix a race in ets_qdisc_change() +- [Backport] mm/hugetlb: declare hugetlbfs_pagecache_present() non-static +- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping +- f2fs: fix to do sanity check on sit_bitmap_size +- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() +- jfs: validate AG parameters in dbMount() to prevent crashes +- fs/jfs: consolidate sanity checking in dbMount +- jfs: add sanity check for agwidth in dbMount +- perf: Fix dangling cgroup pointer in cpuctx +- nfsd: decrease sc_count directly if fail to queue dl_recall +- tracing: Do not add length to print format in synthetic events +- ksmbd: fix memory leak in parse_lease_state() +- ipv6: Align behavior across nexthops during path selection +- gre: Fix IPv6 multicast route creation. +- gre: Fix again IPv6 link-local address generation. +- Revert "drm/amd: Keep display off while going into S4" +- Revert "rndis_host: Flag RNDIS modems as WWAN devices" +- Revert "PCI: Avoid reset when disabled via sysfs" +- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices +- tracing: Do not use PERF enums when perf is not defined +- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up +- nfsd: put dl_stid if fail to queue dl_recall +- exec: fix the racy usage of fs_struct->in_exec +- jfs: add index corruption check to DT_GETPAGE() +- ext4: fix OOB read when checking dotdot dir +- ext4: don't over-report free space or inodes in statvfs +- arm64: Don't call NULL in do_compat_alignment_fixup() +- tracing: Fix synth event printk format for str fields +- tracing: Ensure module defining synth event cannot be unloaded while tracing +- ksmbd: add bounds check for create lease context +- ksmbd: add bounds check for durable handle context +- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD +- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability +- mmc: omap: Fix memory leak in mmc_omap_new_slot +- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP +- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume +- kunit/overflow: Fix UB in overflow_allocation_test +- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() +- platform/x86: ISST: Correct command storage data length +- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers +- x86/hyperv: Fix check of return value from snp_set_vmsa() +- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC +- media: imx-jpeg: Cleanup after an allocation error +- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead +- smb: client: validate change notify buffer before copy +- rtc: rx8025: fix incorrect register reference +- perf/core: Fix child_total_time_enabled accounting bug at task exit +- drm/amdgpu/gfx11: fix num_mec +- ipv6: Do not consider link down nexthops in path selection +- ipv6: Start path selection from the first nexthop +- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy +- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS +- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). +- vsock: avoid timeout during connect() if the socket is closing +- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only +- e1000e: change k1 configuration on MTP and later platforms +- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte +- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() +- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs +- RISC-V: errata: Use medany for relocatable builds +- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA +- ntb: intel: Fix using link status DB's +- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra +- spufs: fix a leak in spufs_create_context() +- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} +- memory: omap-gpmc: drop no compatible check +- can: statistics: use atomic access in hot path +- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx +- drm/amd: Keep display off while going into S4 +- nvme-pci: fix stuck reset on concurrent DPC and HP +- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled +- x86/hyperv: Fix output argument to hypercall that changes page visibility +- locking/semaphore: Use wake_q to wake up processes outside lock critical section +- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state +- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory +- sched/deadline: Use online cpus for validating runtime +- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA +- HID: i2c-hid: improve i2c_hid_get_report error message +- platform/x86/intel/vsec: Add Diamond Rapids support +- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet +- cifs: fix incorrect validation for num_aces field of smb_acl +- perf/core: Fix perf_pmu_register() vs. perf_init_event() +- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 +- ALSA: hda/realtek: Fix Asus Z13 2025 audio +- affs: don't write overlarge OFS data block size fields +- affs: generate OFS sequence numbers starting at 1 +- wifi: brcmfmac: keep power during suspend if board requires it +- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA +- nvme-pci: clean up CMBMSC when registering CMB fails +- wifi: iwlwifi: mvm: use the right version of the rate API +- wifi: iwlwifi: fw: allocate chained SG tables for dump +- rcu-tasks: Always inline rcu_irq_work_resched() +- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() +- sched/smt: Always inline sched_smt_active() +- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set +- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq +- octeontx2-af: Fix mbox INTR handler when num VFs > 64 +- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid +- LoongArch: Rework the arch_kgdb_breakpoint() implementation +- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig +- objtool: Fix segfault in ignore_unreachable_insn() +- ring-buffer: Fix bytes_dropped calculation issue +- net/mlx5e: SHAMPO, Make reserved size independent of page size +- ksmbd: fix multichannel connection failure +- ksmbd: use aead_request_free to match aead_request_alloc +- rndis_host: Flag RNDIS modems as WWAN devices +- exfat: fix the infinite loop in exfat_find_last_cluster() +- NFS: Shut down the nfs_client only after all the superblocks +- perf tools: annotate asm_pure_loop.S +- fs/procfs: fix the comment above proc_pid_wchan() +- tty: n_tty: use uint for space returned by tty_write_room() +- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES +- perf python: Check if there is space to copy all the event +- perf python: Don't keep a raw_data pointer to consumed ring buffer space +- perf python: Decrement the refcount of just created event on failure +- perf python: Fixup description of sample.id event member +- i3c: master: svc: Fix missing the IBI rules +- um: hostfs: avoid issues on inode number reuse by host +- um: remove copy_from_kernel_nofault_allowed +- selftests/mm/cow: fix the incorrect error handling +- fuse: fix dax truncate/punch_hole fault path +- NFSv4: Don't trigger uneccessary scans for return-on-close delegations +- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig +- kexec: initialize ELF lowest address to ULONG_MAX +- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() +- perf units: Fix insufficient array space +- perf evlist: Add success path to evlist__create_syswide_maps +- iio: adc: ad7124: Fix comparison of channel configs +- iio: adc: ad4130: Fix comparison of channel setups +- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister +- fs/ntfs3: Prevent integer overflow in hdr_first_de() +- usb: xhci: correct debug message page size calculation +- perf bench: Fix perf bench syscall loop count +- perf arm-spe: Fix load-store operation checking +- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. +- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio +- ucsi_ccg: Don't show failed to get FW build information error +- perf pmu: Don't double count common sysfs and json events +- coresight-etm4x: add isb() before reading the TRCSTATR +- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint +- coresight: catu: Fix number of pages while using 64k pages +- soundwire: slave: fix an OF node reference leak in soundwire slave device +- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() +- perf stat: Fix find_stat for mixed legacy/non-legacy events +- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock +- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() +- leds: Fix LED_OFF brightness race +- mfd: sm501: Switch to BIT() to mitigate integer overflows +- pinctrl: renesas: rzv2m: Fix missing of_node_put() call +- crypto: nx - Fix uninitialised hv_nxc on error +- power: supply: max77693: Fix wrong conversion of charge input threshold value +- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 +- clk: amlogic: g12a: fix mmc A peripheral clock +- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents +- selftests/bpf: Select NUMA_NO_NODE to create map +- clk: amlogic: gxbb: drop non existing 32k clock parent +- clk: amlogic: g12b: fix cluster A parent data +- pinctrl: tegra: Set SFIO mode to Mux Register +- IB/mad: Check available slots before posting receive WRs +- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain +- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() +- RDMA/mlx5: Fix calculation of total invalidated pages +- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent +- pinctrl: renesas: rzg2l: Fix missing of_node_put() call +- pinctrl: renesas: rza2: Fix missing of_node_put() call +- lib: 842: Improve error handling in sw842_compress() +- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 +- RDMA/mana_ib: Ensure variable err is initialized +- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock +- clk: samsung: Fix UBSAN panic in samsung_clk_init() +- selftests/bpf: Fix string read in strncmp benchmark +- libbpf: Fix hypothetical STT_SECTION extern NULL deref case +- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust +- remoteproc: core: Clear table_sz when rproc_shutdown +- clk: amlogic: gxbb: drop incorrect flag on 32k clock +- fbdev: sm501fb: Add some geometry checks. +- mdacon: rework dependency list +- fbdev: au1100fb: Move a variable assignment behind a null pointer check +- PCI: pciehp: Don't enable HPIE when resuming in poll mode +- PCI: histb: Fix an error handling path in histb_pcie_probe() +- drm/amd/display: avoid NPD when ASIC does not support DMUB +- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() +- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe +- PCI: Remove stray put_device() in pci_register_host_bridge() +- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() +- PCI: Avoid reset when disabled via sysfs +- PCI/portdrv: Only disable pciehp interrupts early when needed +- PCI: brcmstb: Fix potential premature regulator disabling +- PCI: brcmstb: Use internal register to change link capability +- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload +- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' +- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host +- drm/msm/dsi: Use existing per-interface slice count in DSC timing +- drm/msm/dpu: don't use active in atomic_check() +- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member +- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure +- PCI: Use downstream bridges for distributing resources +- drm: xlnx: zynqmp: Fix max dma segment size +- drm/bridge: it6505: fix HDCP V match check is not performed correctly +- drm/dp_mst: Fix drm RAD print +- drm/bridge: ti-sn65dsi86: Fix multiple instances +- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible +- ALSA: hda/realtek: Always honor no_shutup_pins +- dt-bindings: vendor-prefixes: add GOcontroll +- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER +- ASoC: cs35l41: check the return value from spi_setup() +- platform/x86: dell-ddv: Fix temperature calculation +- media: platform: allgro-dvt: unregister v4l2_device on the error path +- media: verisilicon: HEVC: Initialize start_bit field +- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures +- x86/traps: Make exc_double_fault() consistently noreturn +- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll +- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() +- PM: sleep: Fix handling devices with direct_complete set on errors +- EDAC/ie31200: Fix the error path order of ie31200_init() +- EDAC/ie31200: Fix the DIMM size mask for several SoCs +- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer +- selinux: Chain up tool resolving errors in install_policy.sh +- RISC-V: KVM: Disable the kernel perf counter during configure +- PM: sleep: Adjust check before setting power.must_resume +- lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock +- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() +- x86/platform: Only allow CONFIG_EISA for 32-bit +- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() +- x86/fpu: Fix guest FPU state buffer allocation size +- smack: dont compile ipv6 code unless ipv6 is configured +- cpufreq: scpi: compare kHz instead of Hz +- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test +- watch_queue: fix pipe accounting mismatch +- urma: implement ubcore sysfs interface and device management +- mm: migrate: add isolate_folio_to_list() +- urma: implement ubcore basic connection and bonding support +- urma: add network framework facilities for ubcore. +- urma: add tp table support and related cmd header for ubcore. +- CCA: unmap state2 range can block to fix soft lockup while destroy realm +- config: enable config for PLR +- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID +- platform/x86/intel: power-domains: Add Clearwater Forest support +- platform/x86/intel/tpmi/plr: Fix output in plr_print_bits() +- platform/x86/intel/tpmi/plr: Add support for the plr mailbox +- platform/x86/intel/tpmi: Add new auxiliary driver for performance limits +- platform/x86/intel: TPMI domain id and CPU mapping +- platform/x86/intel/tpmi: Add API to get debugfs root +- platform/x86/intel/tpmi: Add support for performance limit reasons +- batman-adv: Switch to linux/array_size.h +- drm/amdgpu: csa unmap use uninterruptible lock +- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() +- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() +- ASoC: codecs: wcd9335: Fix missing free of regulator supplies +- ASoC: codec: wcd9335: Convert to GPIO descriptors +- ASoC: codecs: wcd9335: Handle nicer probe deferral and simplify with dev_err_probe() +- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap +- mm: introduce memalloc_flags_{save,restore} +- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO +- bpf: Disable migration in nf_hook_run_bpf(). +- parisc: Revise __get_user() to probe user read access +- LoongArch: Optimize module load time by optimizing PLT/GOT counting +- drm/amd/display: Avoid a NULL pointer dereference +- wifi: wilc1000: avoid buffer overflow in WID string configuration +- eventpoll: don't decrement ep refcount while still holding the ep mutex +- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() +- f2fs: fix to do sanity check on ino and xnid +- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places +- aoe: clean device rq_list in aoedev_downdev() +- kernel.h: Move ARRAY_SIZE() to a separate header +- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). +- exfat: fix double free in delayed_free +- configs: Add Zhaoxin GPIO pinctrl for kh-50000 in openeuler_config +- pinctrl: Zhaoxin: Add KH-50000 support +- wifi: ath12k: Fix memory leak due to multiple rx_stats allocation +- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls +- iio: imu: bno055: fix OOB access of hw_xlate array +- s390/ism: fix concurrency management in ism_cmd() +- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ +- btrfs: avoid NULL pointer dereference if no valid csum tree +- fs/ntfs3: handle hdr_first_de() return value +- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() +- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() +- net: usb: aqc111: debug info before sanitation +- net: usb: aqc111: fix error handling of usbnet read calls +- coresight: fix indentation error in cscfg_remove_owned_csdev_configs() +- coresight: holding cscfg_csdev_lock while removing cscfg from csdev +- coresight: change coresight_device lock type to raw_spinlock_t +- hfs: fix slab-out-of-bounds in hfs_bnode_read() +- jfs: Regular file corruption check +- net: wangxun: ngbe: add support for wangxun 1G +- RDMA/bnxt_re: Fix error recovery sequence +- bnxt_en: Fix ethtool -d byte order for 32-bit values +- bnxt_en: Fix DCB ETS validation +- Fix kabi for CWF PMU support +- crypto: sm4 - Refactor mode handling and optimize performance +- i2c: zhaoxin: Enhancements and Modifications to SMBus Driver +- ACPI: processor: idle: Set timer broadcast state on C3 for KH-50000 +- hwmon: zhaoxin-cputemp: Update for KH-50000 +- perf/zhaoxin/core: Tailor FMS for KH-50000 +- crypto: sm3 - Refactor code and harden security +- perf mem: Fix printing PERF_MEM_LVLNUM_{L2_MHB|MSC} +- perf/x86: Print PMU counters bitmap in x86_pmu_show_pmu_cap() +- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK +- KVM: x86/pmu: Manipulate FIXED_CTR_CTRL MSR with macros +- KVM: x86/pmu: Change ambiguous _mask suffix to _rsvd in kvm_pmu +- KVM: x86/pmu: Add common define to capture fixed counters offset +- perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error +- tools arch x86: Sync the msr-index.h copy with the kernel sources +- tools/include: Sync x86 headers with the kernel sources +- perf/x86/intel: Fix incorrect MSR index calculations in intel_pmu_config_acr() +- perf/x86/intel: Fix bitmask of OCR and FRONTEND events for LNC +- perf/x86/intel: Fix event constraints for LNC +- perf/x86/intel/ds: Fix counter backwards of non-precise events counters-snapshotting +- perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq +- perf vendor events: Add Clearwaterforest events +- perf/x86/intel/uncore: Support customized MMIO map size +- perf/x86/intel/uncore: Support MSR portal for discovery tables +- perf/x86/intel/uncore: Add Clearwater Forest support +- perf/uapi: Clean up <uapi/linux/perf_event.h> a bit +- tools headers: Update the uapi/linux/perf_event.h copy with the kernel sources +- tools/include: Sync uapi/linux/perf.h with the kernel sources +- perf/x86: Optimize the is_x86_event +- perf/x86/intel: Check the X86 leader for ACR group +- perf/x86/intel: Check the X86 leader for pebs_counter_event_group +- perf/x86/intel: Parse CPUID archPerfmonExt leaves for non-hybrid CPUs +- perf/x86/intel: Add PMU support for Clearwater Forest +- perf/x86/intel: Don't clear perf metrics overflow bit unconditionally +- perf/x86/intel: Support auto counter reload +- perf/x86/intel: Add CPUID enumeration for the auto counter reload +- perf: Extend the bit width of the arch-specific flag +- perf/x86/intel: Track the num of events needs late setup +- perf/x86: Add dynamic constraint +- perf: Extend per event callchain limit to branch stack +- perf/x86/intel: Fix ARCH_PERFMON_NUM_COUNTER_LEAF +- perf/x86/intel: Support PEBS counters snapshotting +- Optimize Zhaoxin CPU Temp Monitoring During Suspend/Resume +- Optimize VIA CPU Temp Monitoring During Suspend/Resume +- perf/x86/intel: Support RDPMC metrics clear mode +- perf/x86/intel/ds: Add PEBS format 6 +- perf/x86/intel/ds: Simplify the PEBS records processing for adaptive PEBS +- perf/x86/intel/ds: Factor out functions for PEBS records processing +- perf/x86/intel/ds: Clarify adaptive PEBS processing +- perf/x86/intel: Support Perfmon MSRs aliasing +- perf/x86/intel: Support PERFEVTSEL extension +- perf/x86: Add config_mask to represent EVENTSEL bitmask +- perf/x86/intel: Support new data source for Lunar Lake +- perf/x86/intel: Rename model-specific pebs_latency_data functions +- perf/x86: Add Lunar Lake and Arrow Lake support +- perf/x86: Support counter mask +- crypto: ccp: add ccp-mdev functionality to the ccp module. +- usb: renesas_usbhs: Reorder clock handling and power management in probe +- perf/x86/intel: Support the PEBS event mask +- tools headers UAPI: Sync include/uapi/linux/perf_event.h header with the kernel +- perf/x86/intel/uncore: Support more units on Granite Rapids +- perf/x86/intel/uncore: Clean up func_id +- powerpc/eeh: Make EEH driver device hotplug safe +- mm: Use pr_warn_once() for min_free_kbytes warning +- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() +- sctp: linearize cloned gso packets in sctp_rcv +- net/smc: fix UAF on smcsk after smc_listen_out() + +* Thu Nov 13 2025 Li Nan <linan122@huawei.com> - 6.6.0-118.0.0.96 +- !18685 ub: add cdma driver code +- !18684 ub: ub_fwctl:Add the ub_fwctl driver +- !18928 gmem: fix some warnings +- !18938 dma-mapping: benchmark: add support for UB devices +- ub: cdma: support register segment +- ub: cdma: support unregister segment +- ub: cdma: support reporting completed events +- ub: cdma: support reporting asynchronous events +- ub: cdma: support the creation of jfs +- ub: cdma: support the deletion of jfs +- ub: cdma: support the creation of ctp +- ub: cdma: support the deletion of ctp +- ub: cdma: support the creation of jfc +- ub: cdma: support the deletion of jfc +- ub: cdma: support for releasing queue +- ub: cdma: support for allocating queue +- ub: cdma: support for getting device by eid +- ub: cdma: support for getting device list +- ub: cdma: support querying sl information and updating eu +- ub: cdma: support the probe and remove processes +- !18906 v2 Add MFS Support +- !18920 perf: Fix tt_core mismatch over PG CPU +- !18934 mm/thp: Add a new sysfs knob for zero COW +- !18845 fs/resctrl: Fix the L3 CMAX conversion mechanism +- !18858 ub: ubase: Support debugs functions +- !18853 net: unic: add support of unic driver for ub network +- !18901 ub:hisi-ubus: Support HISI-UBUS driver framework +- !18927 mm: add nr_free_highatomic in show_free_areas +- !18929 v2:mm/swap: get the swap device offset directly +- ub: ub_fwctl: support ummu data processing +- ub: ub_fwctl: query the MSG queue information and entry details within UB. +- ub: ub_fwctl: support querying SCC and io_die related information. +- ub: ub_fwctl: support querying UB link trace information. +- ub: ub_fwctl: Support Dump register. +- ub: ub_fwctl: supports querying and configuring some scattered registers. +- ub: ub_fwctl: supports querying TP, BA related register information +- dma-mapping: benchmark: add support for UB devices +- ub: ub_fwctl: supports querying NL, TA, DL related register information +- ub: ub_fwctl: Add some simple common framework functions +- ub: ub_fwctl: Add the ub_fwctl driver and its basic features. +- mm/thp: Add a new sysfs knob for zero COW +- !18803 arm64/mpam: Add quirk to retrigger L3 CSU monitor +- net: unic: support querying and configuring queue parameters. +- net: unic: support querying and configuring the number of queues. +- net: unic: support querying and configuring simple RSS. +- net: unic: support querying and configuring promisc. +- net: unic: support querying and configuring MTU. +- net: unic: support querying and configuring FEC parameters. +- net: unic: add fec statistic support +- net: unic: add rack ip for unic +- net: unic: add io basic Rx/Tx functionality for unic +- net: unic: add support of unic driver for ub network +- !18914 misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error +- !18915 scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() +- !18916 software node: Correct a OOB check in software_node_get_reference_args() +- !18917 KVM: x86: use array_index_nospec with indices that come from guest +- !18877 iommu/ummu: Implement IOMMU ops and advanced capabilities. +- mm/swap: get the swap device offset directly +- mm: add nr_free_highatomic in show_free_areas +- ub:ubus: reserve space for ub subsystem related structure +- ub:hisi-ubus: Support UBUS configure EID-UPI table +- ub:hisi-ubus: Support UBUS vdm entity enable message +- ub:hisi-ubus: Support for MSGQ's debugging functionality +- !17926 spufs: fix a leak on spufs_new_file() failure +- !18393 platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() +- !18389 regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() +- !18381 f2fs: zone: fix to avoid inconsistence in between SIT and SSA +- !18370 dmaengine: ti: Add NULL check in udma_probe() +- !18674 jfs: fix array-index-out-of-bounds read in add_missing_indices +- !18438 jfs: Fix null-ptr-deref in jfs_ioc_trim +- !18435 ksmbd: fix null pointer dereference in destroy_previous_session +- !18434 tty: serial: uartlite: register uart driver in init +- !18404 mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write +- !18799 [OLK-6.6] Fix CVE-2025-38336 +- !18798 [OLK-6.6] Fix CVE-2025-38335 +- !18793 [OLK-6.6] Fix CVE-2025-38275 +- !18789 [OLK-6.6] Fix CVE-2025-38274 +- !18786 [OLK-6.6] Fix CVE-2025-38300 +- !18781 [OLK-6.6] Fix CVE-2025-38295 +- !18778 [OLK-6.6] Fix CVE-2025-38293 +- !18777 [OLK-6.6] Fix CVE-2025-38292 +- !18849 urma: introduce ubcore main module. +- !18842 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.85-6.6.86 LTS Patches +- !18484 btf: Avoid weak external references +- !18921 blk-ioinf: introduce inflight-based IO QoS controller +- blk-rq-qos: fix kabi broken in struct rq_qos +- blk-mq: fix kabi broken in struct request +- openeuler_defconfig: Enable CONFIG_BLK_CGROUP_IOINFLIGHT +- blk-io-hierarchy: support new bio based stage ioinf +- blk-ioinf: support percentile latency QoS for oneline workloads +- blk-ioinf: dynamically adjust inflight limit to balance workloads +- blk-ioinf: add rqos/inflight/stat debufs interface +- blk-ioinf: introduce inflight-based IO QoS controller +- perf: Fix tt_core mismatch over PG CPU +- iommu/ummu: Add UMMU trace log +- iommu/ummu: Support UMMU identity mapping +- iommu/ummu: Add UB Memory support +- iommu/ummu: Support UMMU iopf capability +- iommu/ummu: Support UMMU nested mode +- iommu/ummu: Add SVA API support to UMMU driver +- iommu/ummu: Implement iommu_ops and iommu_domain_ops for UMMU driver +- iommu/ummu: Implement domain and core ops in logic UMMU framework +- iommu/ummu: Implement MPAM for QoS +- iommu/ummu: Support UMMU attribute show and store operations +- iommu/ummu: Implement IOMMU ops forwarding in logic UMMU framework +- iommu/ummu: Support UMMU page table management +- iommu/ummu: Introduce logic UMMU framework +- iommu/ummu: Add UMMU permission queue +- iommu/ummu: Add grant and ungrant operations for permission table +- iommu/ummu: Add UMMU permission table memory management +- iommu/ummu: Add UMMU private implementation +- iommu/ummu: Add manager for UMMU permission table +- iommu/ummu: Add tct/tect ops for configuration table +- iommu/ummu: Support UMMU configuration table management +- !18863 drivers/perf: hisi: Add support for HiSilicon MN PMU driver +- ub: ubase: Support querying dev caps. +- ub: ubase: Supports the query of UBCL config. +- ub: ubase: add function that query aeq/ceq/tp/tpg context +- KVM: x86: use array_index_nospec with indices that come from guest +- software node: Correct a OOB check in software_node_get_reference_args() +- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() +- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error +- !18885 ub: ubase: Fix some compile warnings&fix pages free problem +- !18910 um: virtio_uml: Fix use-after-free after put_device in probe +- !18902 i2c: cros-ec-tunnel: defer probe if parent EC is not present +- urma: introduce ubcore main module. +- um: virtio_uml: Fix use-after-free after put_device in probe +- mfs: tool: Add mfs user space tool demo +- mfs: Optimize mfs syncer process and metadata ops +- mfs: enable MFS +- MAINTAINERS: Add maintainer for mfs +- mfs: Add MFS documentation +- mfs: Add tracepoint for MFS +- mfs: Add user command for handling events +- mfs: Add communication devie and event acquisition operations +- mfs: Add basic events framework +- mfs: Add basic cache framework: check method and control structure +- mfs: Add basic data operation for MFS +- mfs: Add basic metadata operation for MFS +- mfs: implement the mount procedure +- mfs: Initialize mfs module +- ub: ubase: Fix some compile warnings +- !18894 some bugfixes for NUMA.remote +- i2c: cros-ec-tunnel: defer probe if parent EC is not present +- ub:hisi-ubus: Support MSGQ queue exception handling +- ub:hisi-ubus: Support for processing CQ request messages +- ub:hisi-ubus: Provide callback functions for message devices +- ub:hisi-ubus: Support for MSGQ channel processing in SQ and CQ +- ub:hisi-ubus: Support for hisi MSGQ framework +- ub:hisi-ubus: Support UBUS local RAS interfaces +- ub:hisi-ubus: Support UBUS vdm pue/ue register and release +- ub:hisi-ubus: Support UBUS vendor defined message framework +- ub:hisi-ubus: Add HiSilicon ubus driver framework +- !18723 GMEM: General Memory Management +- !18852 vfio:ubus: Support Virtual Function I/O of UBUS +- !18788 ub: Support new features for UBUS +- !18701 ubios_uvb: support uvb driver +- mm/numa_remote: check if memory block is preonlined when undoing fake-online +- mm/numa_remote: fix restoring to preonline when failing to offline from preonline +- mm/numa_remote: fix memory leak of struct memory_block +- !18840 v2 Backport some memory policy feature and bugfix from mainline +- ub: ubase: Fix the problem that free pages when ubase driver destroy TA context +- ubios_uvb: support CIS framework receive function +- ubios_uvb: support CIS framework send function +- ubios_uvb: support parse ubios information by dtb +- ubios_uvb: support UBIOS object description specification parse +- vfio:ubus: support obtaining and configuring function entity information in user mode +- vfio:ubus: Support configuration for function entity interrupt +- vfio:ubus: Support access to function entity resource space +- vfio:ubus: Init vfio ub config space 1 perm and port perm bits during module init +- vfio:ubus: Init vfio ub config space 0 perm bits during module init +- vfio:ubus: Init vfio ub configuration space +- vfio:ubus: Support ub vfio config read and write +- vfio:ubus: Support for vfio ubus driver framework +- ub:ubus: Support UBUS driver host probe and remove +- ub:ubus: Add configuration and resource sysfs interfaces +- ub:ubus: Add basic System Filesystem attributes +- ub:ubus: Support processing protocol link messages +- ub:ubus: Support hotplug processing main workflow +- ub:ubus: Support for device enumeration during the hotplug phase +- ub:ubus: Support for slot register configuration +- ub:ubus: Support hotplug service driver +- ub:ubus: Add generic ub component driver +- ub:ubus: Add ub service driver framework +- ub:ubus: Add new UBUS pool device interfaces +- ub:ubus: Support UBUS pool devices register +- ub:ubfi: register ubc usi domain +- ub:ubus: Support for ub device resource space registration +- ub:ubus: Add UBUS receive message framework +- ub:ubus: Support device binding and unbinding bus instance +- ub:ubus: Support for static cluster bus instance +- ub:ubus: Support for dynamic bus instance +- ub:ubus: Support for bus instance framework +- ub:ubus: Support handle device link up and link down +- ub:ubus: Support enumerate port and route set/clear for port +- ub:ubus: Support route modify/delete function +- !18750 iommu/ummu: Add ummu driver basic capabilities. +- iommu/ummu: Add UMMU cache flush interfaces +- iommu/ummu: Support UMMU event handling +- iommu/ummu: Support UMMU global error handling +- iommu/ummu: Support UMMU command queue +- iommu/ummu: Support UMMU device +- !18748 ub: ubfi: Support ummu node in ubfi +- !18804 drivers/perf: hisi: Support UMMU pmu +- !18855 mm: do not install PMD mappings when handling a COW fault +- drivers/perf: hisi: Add support for HiSilicon MN PMU driver +- drivers/perf: hisi: Add support for HiSilicon NoC PMU +- Revert "drivers/perf: hisi: Add support for HiSilicon NoC PMU" +- Revert "drivers/perf: hisi: Add support for HiSilicon MN PMU driver" +- ub: ubfi: Parsing ummu node in the ubrt table +- ub: ubase: Added debug information query function for FST/FVT/RQMT entries +- ub: ubase: support debugfs for active dev stats. +- mm: do not install PMD mappings when handling a COW fault +- urma: implement workqueue management for ubcore module. +- urma: implement topology information management for ubcore module. +- urma: implement hash table utilities for ubcore module. +- urma: implement log module for ubcore subsystem. +- gmem: fix some warnings +- gmem: open CONFIG_GMEM for arm64 and x86 +- mm: implement hmemcpy API +- mm: implement hmadvise API +- mm: support mmap/unmap peer-shared memory area +- gmem: add gmem stat +- gmem: support pin/unpin device memory +- gmem: support swapping heterogeneous memory +- gmem: implement page faulting for peer-shared vma +- gmem: implement allocating/deallocating peer-shared vma. +- gmem: introduce hnode for free peer-shared free page management +- gmem: introduce vm_object for managing hetergoneous memory mapping +- gmem: prepare config, boot parameter, vma flag and basic GMEM related structs +- arm64/mpam: Add quirk for L3 CPBM validity check +- fs/resctrl: Fix the L3 CMAX conversion mechanism +- wifi: ath12k: fix invalid access to memory +- serial: 8250_dma: terminate correct DMA in tx_dma_flush() +- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove +- net: usb: usbnet: restore usb%d name exception for local mac addresses +- net: usb: qmi_wwan: add Telit Cinterion FE990B composition +- net: usb: qmi_wwan: add Telit Cinterion FN990B composition +- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers +- tty: serial: 8250: Add Brainboxes XC devices +- tty: serial: 8250: Add some more device IDs +- counter: microchip-tcb-capture: Fix undefined counter channel state on probe +- counter: stm32-lptimer-cnt: fix error handling when enabling +- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx +- mm/page_alloc: fix memory accept before watermarks gets initialized +- drm/amd/display: Don't write DP_MSTM_CTRL after LT +- drm/dp_mst: Add a helper to queue a topology probe +- drm/dp_mst: Factor out function to queue a topology probe work +- ARM: Remove address checking for MMUless devices +- ARM: 9351/1: fault: Add "cut here" line for prefetch aborts +- ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed() +- HID: hid-plantronics: Add mic mute mapping and generalize quirks +- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names +- mm/mempolicy: count MPOL_WEIGHTED_INTERLEAVE to "interleave_hit" +- mm/mempolicy: fix memory leaks in weighted interleave sysfs +- mempolicy: clean up minor dead code in queue_pages_test_walk() +- mm/mempolicy: protect task interleave functions with tsk->mems_allowed_seq +- mm/mempolicy: introduce MPOL_WEIGHTED_INTERLEAVE for weighted interleaving +- mm/mempolicy: refactor a read-once mechanism into a function for re-use +- mm/mempolicy: implement the sysfs-based weighted_interleave interface +- mempolicy: migration attempt to match interleave nodes +- mempolicy: mmap_lock is not needed while migrating folios +- mempolicy: alloc_pages_mpol() for NUMA policy without vma +- kernfs: drop shared NUMA mempolicy hooks +- mempolicy: remove confusing MPOL_MF_LAZY dead code +- mempolicy: mpol_shared_policy_init() without pseudo-vma +- mempolicy trivia: use pgoff_t in shared mempolicy tree +- mempolicy trivia: slightly more consistent naming +- mempolicy trivia: delete those ancient pr_debug()s +- mempolicy: fix migrate_pages(2) syscall return nr_failed +- Revert "mm/mempolicy.c: fix the out-of-bounds access issue in mpol_parse_str" +- arm64/mpam: Add quirk to retrigger L3 CSU monitor +- drivers/perf: hisi: Add the sysfs interface to configure pmu mpam +- drivers/perf: hisi: Implement ummu-pmu driver. +- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 +- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT +- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug +- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() +- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() +- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() +- wifi: ath11k: fix node corruption in ar->arvifs list +- jfs: fix array-index-out-of-bounds read in add_missing_indices +- platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() +- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() +- regulator: max20086: fix invalid memory access +- dmaengine: ti: Add NULL check in udma_probe() +- btf: Avoid weak external references +- vmlinux: Avoid weak reference to notes section +- kallsyms: Avoid weak references for kallsyms symbols +- jfs: Fix null-ptr-deref in jfs_ioc_trim +- ksmbd: fix null pointer dereference in destroy_previous_session +- tty: serial: uartlite: register uart driver in init +- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write +- f2fs: zone: fix to avoid inconsistence in between SIT and SSA +- spufs: fix a leak on spufs_new_file() failure + +* Fri Nov 07 2025 Li Nan <linan122@huawei.com> - 6.6.0-116.0.0.95 +- !18848 net:nebula-matrix:fix compile err +- net:nebula-matrix:fix compile err +- !18810 ub: ubase: support for advanced functions +- !18758 nbd: restrict sockets to TCP and UDP +- !18407 net:Add a new protocol family definition AF_UB to support UB Memory based Socket(UMS) +- !18839 rseq: Protect event mask against membarrier IPI +- ub: ubase: support for activate/deactivate dev interface +- ub: ubase: pf supports debugfs query port/vl current. +- ub: ubase: adds the function to get ub port stats for unic and other aux driver +- ub: ubase: support pre-alloc 2M pages. +- ub: ubase: support ras function +- ub: ubase: Support to port reset +- ub: ubase: Added QoS and traffic management debugging features +- ub: ubase: Support reset count information statistics. +- ub: ubase: Support for ELR and entity reset. +- ub: ubase: Provide an entity_list query interface. +- ub: ubase: support create and delete UM TP/TPG +- ub: ubase: Support to config and query the sl scheduling mode and weight in ETS and TM modes. +- ub: ubase: support querying sl information in initialization phase +- ub: ubase: Supports for ctrl queue management. +- rseq: Protect event mask against membarrier IPI +- !18820 [OLK-6.6] backport important bugfix for lpfc driver from upstream linux-6.6.y +- !18817 [OLK-6.6] backport important bugfix for mpt3sas driver from upstream linux-6.6.y +- scsi: lpfc: Fix buffer free/clear order in deferred receive path +- !18800 net: hibmcge: support pagepool for rx +- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() +- !18745 *** Mainline PATCH backport *** +- !18807 smb: client: fix wrong index reference in smb2_compound_op() +- !18711 Bluetooth: hci_conn: Use disable_delayed_work_sync +- !17268 LoongArch: fix nvme/megaraid/stmmac/uprobe/rtc/kdump problems +- !18500 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.82-6.6.83 LTS Conflicts Patches +- ub: ubase: adds the function that query oor caps +- ub: ubase: Support for virtual register and unregister. +- ub: ubase: Add trace events to aeqe and ceqe. +- ub: ubase: Add the cmdq trace event print at the ubase layer. +- ub: ubase: Support for timer/ext_dtb buffer management. +- !18784 padata: Reset next CPU when reorder sequence wraps around +- !18806 perf: fix ddrc redundant value set +- !18802 KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O +- !18739 fs: udf: fix OOB read in lengthAllocDescs handling +- !18710 ub: ubase: Add support of base driver for ub network +- smb: client: fix wrong index reference in smb2_compound_op() +- ub: ubase: Support for public Context memory allocation and release. +- ub: ubase: support for cdma auxiliary device +- ub: ubase: support for complete event process +- ub: ubase: support for async event process +- ub: ubase: add interrupt management framework and misc handler +- ub: ubase: add function to query device resource +- ub: ubase: add the function that query ueid +- ub: ubase: support debugfs public interface. +- ub: ubase: support for command process +- ub: ubase: add support of ubase driver for ub network +- perf: fix ddrc redundant value set +- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O +- net: hibmcge: support pagepool for rx +- net: hibmcge: reduce packet drop under stress testing +- padata: Reset next CPU when reorder sequence wraps around +- nbd: restrict sockets to TCP and UDP +- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) +- x86/umip: Check that the instruction opcode is at least two bytes +- PM: sleep: core: Clear power.must_resume in noirq suspend error path +- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT +- ACPI: processor: idle: Fix memory leak when register cpuidle device failed +- fs: udf: fix OOB read in lengthAllocDescs handling +- net: Add a new protocol family AF_UB +- Bluetooth: hci_conn: Use disable_delayed_work_sync +- selftests: net: test for lwtunnel dst ref loops +- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou +- arm64: dts: rockchip: Move uart5 pin configuration to px30 ringneck SoM +- net: ipv6: fix dst ref loop in ila lwtunnel +- net: ipv6: fix missing dst ref drop in ila lwtunnel +- arm64: dts: rockchip: add rs485 support on uart5 of px30-ringneck-haikou +- arm64: hugetlb: Fix huge_ptep_get_and_clear() for non-present ptes +- NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback +- net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size +- LoongArch: Support mem=<size> kernel parameter +- LoongArch: Reserve the EFI memory map region +- LoongArch: Add debugfs entries to switch SFB/TSO state +- LoongArch: uprobes: Remove redundant code about resume_era +- LoongArch: uprobes: Remove user_{en,dis}able_single_step() +- LoongArch: fix access mode of 7A2000 acpi gpio. +- LoongArch: configs: enable zstd compressed firmware support +- Loongarch: configs: Make EFI RTC built-in for correct vmcore timestamps +- megaraid: Add udelay to avoid data error caused by dma sequence +- nvme: Add udelay to avoid data error caused by dma sequence + +* Wed Nov 05 2025 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-115.0.0.94 +- RISC-V kernel upgrade to 6.6.0-115.0.0 +- Remove CI-related file changes +- riscv: Backport steal-time support for RISC-V +- riscv: RISC-V SBI debug console extension support +- riscv: Add support for kernel mode vector + +* Wed Nov 05 2025 Li Nan <linan122@huawei.com> - 6.6.0-115.0.0.93 +- !18713 iommu: Enabling Broadcast TLB Maintenance (BTM) for UMMU on ARM64 +- iommu: Fix kabi breakage due to opening KVM_PINNED_VMID +- vfio: Fix kabi breakage due to closing VFIO_CONTAINER +- iommu: Pass in kvm pointer to domain_alloc_user +- iommufd: Associate kvm pointer to iommufd ctx +- KVM: arm64: Introduce support to pin VMIDs +- KVM: Add generic infrastructure to support pinned VMIDs +- !18695 PCI: Run quirk_huawei_pcie_sva() before arm_smmu_probe_device() +- !18761 net: hns3: the multi-tcs VF can be configured only when the interface is down +- !18735 KVM: arm64: Prevent access to vCPU events before init +- !18598 arm64/watchdog_hld: Add a cpufreq notifier for update watchdog thresh +- net: hns3: the multi-tcs VF can be configured only when the interface is down +- net: hns3: remap vf's queue and qset when vport start +- net: hns3: support dpdk using vf multiple tcs +- net: hns3: add support for vf get dscp configuration from pf +- net: hns3: add support for vf multiple tcs +- !18597 iommu/ummu-core: Add ummu-core framework. +- !18316 jbd2: prevent softlockup in jbd2_log_do_checkpoint() +- KVM: arm64: Prevent access to vCPU events before init +- !18421 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.84-6.6.85 LTS Patches +- !18702 i40e: fix idx validation in i40e_validate_queue_map +- !18699 *** CVE-2025-39973 *** +- !18649 tty: n_gsm: Don't block input queue by waiting MSC +- PCI: Run quirk_huawei_pcie_sva() before arm_smmu_probe_device() +- iommu/ummu-core: core interfaces for ummu drivers +- iommu/ummu-core: impl ioctl interface for /dev/ummu device +- iommu/ummu-core: add pseudo Token Dev for Token ID abstraction +- iommu/ummu-core: add UMMU Token ID operation interfaces +- iommu/ummu-core: add UMMU EID operation interfaces +- iommu/ummu-core: support IOVA on demand mapping +- iommu/ummu-core: get iova_domain from iommu_domain +- !18659 ptp: Add a upper bound on max_vclocks +- !18680 futex: Prevent use-after-free during requeue-PI +- !18683 qed: Don't collect too many protection override GRC elements +- !18682 i40e: fix validation of VF state in get resources +- !18681 i40e: fix input validation logic for action_meta +- !18679 cnic: Fix use-after-free bugs in cnic_delete_task +- !18668 openvswitch: Fix unsafe attribute parsing in output_userspace() +- !18267 CVE-2025-39832 +- !18705 mm: fix compilation error due to MAX_PAGE_ORDER isn't declared +- arm64/watchdog_hld: Add a cpufreq notifier for update watchdog thresh +- watchdog/perf: Provide function for adjusting the event period +- Revert "watchdog/perf: Provide function for adjusting the event period" +- Revert "arm64/watchdog_hld: Add a cpufreq notifier for update watchdog thresh" +- !18690 [OLK-6.6] Fix CVE-2025-38290 +- !18672 [OLK-6.6] Fix CVE-2025-38286 +- !17950 net: atm: add lec_mutex +- iommu/ummu-core: introduce UMMU-CORE, basic configs +- iommu/ummu-core: support iommu ksva mode +- iommu/ummu-core: introduce iommu sva permission operation +- iommu/ummu-core: introduce iommu_sva_bind_isolated interface +- iommu/ummu-core: add the user invalidation type in iommufd file +- iommu/ummu-core: iommu_dev new min_pasids attribute +- mm: fix compilation error due to MAX_PAGE_ORDER isn't declared +- i40e: fix idx validation in i40e_validate_queue_map +- i40e: add validation for ring_len param +- i40e: increase max descriptors for XL710 +- !18372 sched/fair: remove qos_reweight logic under non-SMP scenario +- !18423 ext4: disambiguate the return value of ext4_dio_write_end_io() +- !18328 [OLK-6.6] fix txgbe link fec issues and enhance hot reset mechanism +- wifi: ath12k: fix node corruption in ar->arvifs list +- !18662 net: hibmcge: fix the inappropriate netif_device_detach() +- !18605 net: ubl: add depend to ARM64 and remove config in x86 +- qed: Don't collect too many protection override GRC elements +- i40e: fix validation of VF state in get resources +- i40e: fix input validation logic for action_meta +- futex: Prevent use-after-free during requeue-PI +- cnic: Fix use-after-free bugs in cnic_delete_task +- !18666 bpf-rvi: block: fix memleak issue in bpf_show_partitions_start() +- !18270 Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() +- !18271 libceph: fix invalid accesses to ceph_connection_v1_info +- !18272 CVE-2025-39889 +- !18273 ppp: fix memory leak in pad_compress_skb +- !18268 RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() +- openvswitch: Fix unsafe attribute parsing in output_userspace() +- pinctrl: at91: Fix possible out-of-boundary access +- !18646 tracing: Fix race condition in kprobe initialization causing NULL pointer dereference +- !18630 tracing: dynevent: Add a missing lockdown check on dynevent +- bpf-rvi: block: fix memleak issue in bpf_show_partitions_start() +- iommu/ummu-core: New ub bus added to the iommu framework +- !18525 ub: add UBUS and UBFI driver framework +- !18486 ACPI: pfr_update: Fix the driver update version check +- !18363 comedi: pcl726: Prevent invalid irq number +- net: hibmcge: fix the inappropriate netif_device_detach() +- net: hibmcge: remove unnecessary check for np_link_fail in scenarios without phy. +- net: hibmcge: fix rx buf avl irq is not re-enabled in irq_handle issue +- ptp: Add a upper bound on max_vclocks +- tty: n_gsm: Don't block input queue by waiting MSC +- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference +- tracing: dynevent: Add a missing lockdown check on dynevent +- ub:ubus: Supports decoder event processing +- ub:ubus: Support for sending decoder commands +- ub:ubus: Support for range table mapping and unmapping functions +- ub:ubus: Support for page-range table address mapping and unmapping +- ub:ubus: Support for Bus EID-UPI Table Configuration +- ub:ubus: Support for UB Character Device Driver +- ub:ubus: Support UBUS RAS capability +- ub:ubus: Creating and deleting ub decoder page table mappings +- ub:ubus: Adding a ue Creation Destruction Mechanism +- ub:ubus: Enable the ub decoder device support +- ub:ubus: Add UBUS RAS framework +- ub:ubus: Support configuration of device information interface +- ub:ubus: Support for enabling and disabling ue +- ub:ubus: Add MSI capability for UBUS driver +- ub:ubus: Add UBUS MSI basic functions +- ub:ubus: Support UBUS Interrupt framework +- ub:ubus: Add UBUS capability interfaces +- ub:ubus: Support device level and port level reset +- ub:ubus: Support for multiple mue enablement +- ub:ubus: Support UB device enabling basic interface +- ub:ubus: Supports device enumeration. +- ub:ubus: Support for UB Bus Controller Enumeration +- ub:ubus: Support for shortest path routing configuration +- ub:ubus: Supports network address configuration and querying +- ub:ubus: Support enumeration topology query commands +- ub:ubus: Add UBUS resource space basic functions +- ub:ubus: Add UBUS resource space framework +- ub:ubus: Support for UB bus enumeration message initialization +- ub:ubus: Support for UB routing table configuration function +- ub:ubus: Add CNA allocate and free interfaces by kernel +- ub:ubus: Add EID allocate and free interfaces by kernel +- ub:ubus: Support cc configuration and query +- ub:ubus: Supporting the UB Shared Port Function +- ub:ubus: Support for UB port sysfs attribute files +- ub:ubus: Support Ubus read/write configuration functions +- ub:ubus: Support for UB Bus Port Management Framework +- ub:ubus: Add Ubus setting configuration space function +- ub:ubus: Support for UB Bus DMA Configuration Function +- ub:ubfi: ubfi driver create ubc device +- ub:ubus: Support for ubus messaging communication framework +- ub:ubus: add ubus controller framework +- ub:ubfi: ubfi driver parse ubc information from ubrt +- ub:ubus: Support UB Bus Attribute Group +- ub:ubfi: Support ub firmware interface basic functions +- ub:ubus: Support for ub bus driver framework +- net: ubl: add depend to ARM64 and remove config in x86 +- net: ubl: modify the description in Kconfig of UB +- ACPI: pfr_update: Fix the driver update version check +- net: txgbe: fix invoke hot reset multi times unexpectedly +- net: txgbe: fix race condition when recover or close/suspend +- net: txgbe: fix fec mode issues +- net: txgbe: set pf promisc and vlan cannot receive packets +- net: txgbe: fix 25G link issues +- net: txgbe: change default tx queue depth +- net: txgbe: fix i2c issues +- net: txgbe: fix can't read rx_pb_n_pxoff +- ext4: disambiguate the return value of ext4_dio_write_end_io() +- net: lwtunnel: disable BHs when required +- netfilter: nft_counter: Use u64_stats_t for statistic. +- wifi: iwlwifi: mvm: ensure offloading TID queue exists +- wifi: iwlwifi: support BIOS override for 5G9 in CA also in LARI version 8 +- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S +- mptcp: Fix data stream corruption in the address announcement +- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP +- drm/amd/display: should support dmub hw lock on Replay +- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven +- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size +- drm/sched: Fix fence reference count leak +- batman-adv: Ignore own maximum aggregation size during RX +- efi/libstub: Avoid physical address 0x0 when doing random allocation +- ARM: shmobile: smp: Enforce shmobile_smp_* alignment +- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 +- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT +- mmc: atmel-mci: Add missing clk_disable_unprepare() +- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops +- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou +- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card +- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card +- accel/qaic: Fix integer overflow in qaic_validate_req() +- regulator: dummy: force synchronous probing +- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions +- drm/v3d: Don't run jobs that have errors flagged in its fence +- can: flexcan: disable transceiver during system PM +- can: flexcan: only change CAN state when link up in system PM +- can: ucan: fix out of bound read in strscpy() source +- can: rcar_canfd: Fix page entries in the AFL list +- i2c: omap: fix IRQ storms +- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES +- net: lwtunnel: fix recursion loops +- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). +- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX +- accel/qaic: Fix possible data corruption in BOs > 2G +- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters +- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path +- ARM: dts: bcm2711: Don't mark timer regs unconfigured +- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP +- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx +- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 +- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 +- soc: imx8m: Unregister cpufreq and soc dev in cleanup path +- soc: imx8m: Use devm_* to simplify probe failure handling +- soc: imx8m: Remove global soc_uid +- xfrm_output: Force software GSO only in tunnel mode +- xfrm: fix tunnel mode TX datapath in packet offload mode +- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply +- firmware: imx-scu: fix OF node leak in .probe() +- net: txgbe: fix bond port rate is unknown when linkup +- net: txgbe: fix VF multicast address removal not taking effect +- net: txgbe: fix missing PFC mask configuration on AML +- net: txgbe: fix pktgen cannot stop +- sched/fair: remove qos_reweight logic under non-SMP scenario +- comedi: pcl726: Prevent invalid irq number +- jbd2: prevent softlockup in jbd2_log_do_checkpoint() +- ppp: fix memory leak in pad_compress_skb +- Bluetooth: hci_event: Fix not using key encryption size when its known +- Bluetooth: L2CAP: Fix not checking l2cap_chan security level +- Bluetooth: l2cap: Check encryption key size on incoming connection +- libceph: fix invalid accesses to ceph_connection_v1_info +- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() +- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() +- net/mlx5: Fix lockdep assertion on sync reset unload event +- net/mlx5: Add support for sync reset using hot reset +- net/mlx5: Add device cap for supporting hot reset in sync reset flow +- net/mlx5: Reload auxiliary drivers on fw_activate +- net: txgbe: fix DAC cable link down +- net: txgbe: fix display of supports Wake-on in the ethtool +- net: atm: add lec_mutex + +* Fri Oct 31 2025 Li Nan <linan122@huawei.com> - 6.6.0-114.0.0.92 +- !18640 v3 Errata management for VM Live migration +- !18638 CVE-2025-39982 +- !18564 perf: arm_spe: Prevent overflow in PERF_IDX2OFF() +- !18639 net: hns3: fix null pointer in debugfs issue +- KVM: arm64: fix kvm kabi conflict +- smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI +- smccc: kvm_guest: Fix kernel builds for 32 bit arm +- smccc/kvm_guest: Enable errata based on implementation CPUs +- arm64: Make _midr_in_range_list() an exported function +- KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 +- KVM: arm64: Specify hypercall ABI for retrieving target implementations +- arm64: Modify _midr_range() functions to read MIDR/REVIDR internally +- KVM: arm64: Allow userspace to change the implementation ID registers +- KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value +- KVM: arm64: Maintain per-VM copy of implementation ID regs +- KVM: arm64: Set HCR_EL2.TID1 unconditionally +- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync +- !18624 tools headers arm64: Sync arm64's cputype.h with the kernel sources +- !18622 support mempool feature +- net: hns3: fix null pointer in debugfs issue +- net: hns3: avoid bitwise copy during RX buffer replace leg when page pool enabled +- net: hns3: fixed vf get max channels bug +- net: hns3: `req_autoneg` for fiber is initialized to `support_autoneg` instead of OFF. +- net: hns3: use user configure after hardware reset when using kernel PHY. +- net: hns3: Return error code when function fails. +- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx +- net: hns3: using the num_tqps in the vf driver to apply for resources +- net: hns3: add support to query tc map info of VF queues +- net: hns3: merge rss tc configuration +- net: hns3: add ieee_setmaxrate and ieee_getmaxrate support for pf +- !18550 cpu/SMT: recover global num_threads after disable smt switch fail +- !18589 net: hibmcge: support pci_driver.shutdown() +- !18579 regulator: core: fix NULL dereference on unbind due to stale coupling data +- !18415 sdei_watchdog: Add CPU_PM_ENTER_FAILED handling in sdei_watchdog_pm_notifier +- !18593 crypto: essiv - Check ssize for decryption and in-place encryption +- tools headers arm64: Sync arm64's cputype.h with the kernel sources +- tools headers arm64: Sync arm64's cputype.h with the kernel sources +- tools/include: Sync arm64 headers with the kernel sources +- tools/include: Sync arm64 asm/cputype.h with the kernel sources +- openeuler_defconfig: enable CONFIG_PFN_RANGE_ALLOC by default +- mm/pfn_range_alloc: check if folio is hwpoisoned in pfn_range_free +- mm/pfn_range_alloc: add a interface to show borrowable physical range +- mm/pfn_range_alloc: support update cachable attribue of linear mapping +- mm/pfn_range_alloc: introduce set_linear_mapping_invalid +- mm/pfn_range_alloc: introduce hugetlb_pool_alloc_size +- mm/pfn_range_alloc: add tracepoint for hugetlb_pool_alloc and hugetlb_pool_free +- mm/pfn_range_alloc: add tracepoint for pfn_range_alloc and pfn_range_free +- mm/pfn_range_alloc: support allocate and free from hugetlb pool +- mm/pfn_range_alloc: add interfaces to alloc/free for drivers +- mm/pfn_range_alloc: reserve memory for each node +- mm/contig_alloc: fix alloc_contig_range when __GFP_COMP and order < MAX_ORDER +- mm: page_alloc: speed up fallbacks in rmqueue_bulk() +- mm/page_alloc: clarify should_claim_block() commentary +- mm/page_alloc: clarify terminology in migratetype fallback code +- mm/page_alloc: add some detailed comments in can_steal_fallback +- mm: page_alloc: remove remnants of unlocked migratetype updates +- mm: page_alloc: don't steal single pages from biggest buddy +- mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy() +- mm/page_alloc: forward the gfp flags from alloc_contig_range() to post_alloc_hook() +- mm/page_alloc: sort out the alloc_contig_range() gfp flags mess +- mm/page_alloc: make __alloc_contig_migrate_range() static +- mm/page_isolation: don't pass gfp flags to isolate_single_pageblock() +- mm/contig_alloc: support __GFP_COMP +- mm: remove unused has_isolate_pageblock +- mm: page_alloc: simpify page del and expand +- mm: remove migration for HugePage in isolate_single_pageblock() +- mm/page_alloc: keep track of free highatomic +- mm: page_alloc: fix highatomic typing in multi-block buddies +- mm: page_alloc: batch vmstat updates in expand() +- mm: page_alloc: change move_freepages() to __move_freepages_block() +- mm: page_alloc: consolidate free page accounting +- mm: page_isolation: prepare for hygienic freelists +- mm: page_alloc: set migratetype inside move_freepages() +- mm: page_alloc: close migratetype race between freeing and stealing +- mm: page_alloc: fix freelist movement during block conversion +- mm: page_alloc: fix move_freepages_block() range error +- mm: page_alloc: move free pages when converting block during isolation +- mm: page_alloc: fix up block types when merging compatible blocks +- mm: page_alloc: optimize free_unref_folios() +- mm: page_alloc: remove pcppage migratetype caching +- mm: page_alloc: simplify __free_pages_ok() +- mm/page_alloc: remove unnecessary next_page in break_down_buddy_pages +- mm/page_alloc: remove unnecessary check in break_down_buddy_pages +- !18608 mm: fix __count_zid_vm_events when CONFIG_ZONE_EXTMEM is enabled +- !18588 add memory ras feature support +- mm: add memory reclaim notifier +- mm: fix __count_zid_vm_events when CONFIG_ZONE_EXTMEM is enabled +- panic: add notifier call before other cpu shutdown +- !18592 Make ID reg writable +- crypto: essiv - Check ssize for decryption and in-place encryption +- KVM: arm64: use KABI_EXTEND to revert struct kvm kabi change +- KVM: arm64: Make AA64PFR1_EL1.NMI writeable +- KVM: arm64: Expose S1PIE to guests +- KVM: arm64: Sanitise ID_AA64MMFR3_EL1 +- KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden +- KVM: arm64: Make ID_AA64MMFR1_EL1.{HCX, TWED} writable from userspace +- KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX +- KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace +- KVM: arm64: rename functions for invariant sys regs +- KVM: arm64: show writable masks for feature registers +- KVM: arm64: Treat CTR_EL0 as a VM feature ID register +- KVM: arm64: Add helper for writing ID regs +- KVM: arm64: Use read-only helper for reading VM ID registers +- KVM: arm64: Only reset vCPU-scoped feature ID regs once +- KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs() +- KVM: arm64: Rename is_id_reg() to imply VM scope +- KVM: arm64: Disable MPAM visibility by default and ignore VMM writes +- KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace +- KVM: arm64: Document vCPU feature selection UAPIs +- KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 +- KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 +- KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 +- KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 +- KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 +- KVM: arm64: Reject attempts to set invalid debug arch version +- KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version +- KVM: arm64: Use guest ID register values for the sake of emulation +- KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS +- KVM: arm64: Allow userspace to get the writable masks for feature ID registers +- net: hibmcge: support pci_driver.shutdown() +- net: hibmcge: select FIXED_PHY +- !18568 support NUMA.remote feature +- !18498 serial: 8250: fix panic due to PSLVERR +- regulator: core: fix NULL dereference on unbind due to stale coupling data +- !18409 crypto: hisilicon - support for new ZIP features +- !18545 HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() +- !18563 arm64/mpam: Fix L2 MBWU monitor multiplexing issue +- mm/numa_remote: add kernel doc for numa remote feature +- mm/numa_remote: extend cmdline numa_remote to limit the max number of remote node +- mm: memory-failure: use kill_accessing_process() in ghes +- mm: memory-failure: remove task_struct from kill_accessing_process() +- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn +- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages +- arm64: configs: enable NUMA_REMOTE by default +- mm/numa_remote: enable oom_kill_cpuless_numa_allocating_task when numa_remote is enabled +- mm/oom_kill: kill current in OOM when binding to cpu-less nodes +- mm/numa_rmeote: add preonline interface for each memory device +- mm/numa_remote: add pre-online count in meminfo +- mm/numa_remote: add sysfs to distinguish whether a remote node +- mm/numa_remote: introduce hugetlb_nowatermark mode for remote node +- mm/numa_remote: undo isolation of remote memory asynchronously +- mm/numa_remote: introduce pre-online mode to support hotplug unready memory +- mm/numa_remote: introduce nofallback mode for remote node +- mm/numa_remote: support to set node distance +- mm/numa_remote: support to hotplug/hotremove remote memory +- mm/numa_remote: prepare numa node for remote memory +- mm/memory_hotplug: support to hotplug memory on ZONE_EXTMEM +- mm/hugetlb: fix folio is still mapped when deleted +- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() +- arm64/mpam: Fix L2 MBWU monitor multiplexing issue +- !18559 arm64/mpam: Fix MBWU monitor overflow handling +- !18544 fs/resctrl: Re-allocate rmid for the monitor when migrating across control groups +- !18536 arm-smmu-v3: add 'HIP10C' for 162100602 errata +- !18130 Net: nebula_matrix: set nebula_matrix driver to a newer state +- !16777 RNPGBE: NET: Fix dmesg 'unknow speed' show when 1000M +- arm64/mpam: Print MPAM register operation for debug +- arm64/mpam: Fix MBWU monitor overflow handling +- cpu/SMT: recover global num_threads after disable smt switch fail +- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() +- fs/resctrl: Re-allocate rmid for the monitor when migrating across control groups +- !17676 [OLK-6.6] Backported patches of Transient Scheduler Attacks (TSA) +- arm-smmu-v3: add 'HIP10C' for 162100602 errata +- !18533 [OLK-6.6]:update patches for sw64 architecture +- !18516 arm64: Add support for HIP09 Spectre-BHB mitigation +- !18457 arm64: add cnp verification on Hisilicon erratum 162100125 +- !18513 Fix CVE-2025-39679 +- !18531 arm/syscalls: mark syscall invocation as likely in +- !11635 arm64/cpufeatures/kvm: Add ARMv8.9 FEAT_ECBHB bits in ID_AA64MMFR1 register +- !18507 Fix wrong CPU aff3 conversion between MPIDR and SYS_LSUDVMBM_EL2 +- sw64: add CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y to defconfig +- sw64: fix the condition for enabling hw_una_enabled +- sw64: efi: fix compile error when CONFIG_EFI=n +- sw64: powercap: fix misuse of an uninitialized temporary variable +- sw64: powercap: increase the interval of polling mode +- sw64: powercap: fix Kconfig dependency for SW64_POWERCAP +- sw64: powercap: avoid checking meaningless target freq +- sw64: smp: fix unaligned access before trap_init() +- sw64: irqchip: update effective affinity for INTx +- sw64: msi: fix affinity change of managed irq +- sw64: use orig_r0 as syscall nr +- sw64: revert ioremap() to __va() in ioport_map() +- sw64: fix unresolved reference error when close pci +- sw64: kvm: add the C4 kvm_regs structure to uapi kvm.h +- arm/syscalls: mark syscall invocation as likely in invoke_syscall +- !18517 media: rc: fix races with imon_disconnect() +- !18327 net: ubl: add CONFIG_UB_UBL definition and UBL interface +- !18488 RDMA/hns: Fix wrong WQE data when QP wraps around +- KVM: hisi_virt: tlbi: Fix wrong CPU aff3 conversion between MPIDR and SYS_LSUDVMBM_EL2 +- media: rc: fix races with imon_disconnect() +- arm64: Add support for HIP09 Spectre-BHB mitigation +- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). +- !18495 CVE-2025-39967 +- !18258 perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions and Don't use PMCCNTR_EL0 on SMT cores +- serial: 8250: fix panic due to PSLVERR +- fbcon: Fix OOB access in font allocation +- fbcon: fix integer overflow in fbcon_do_set_font +- !16738 perf vendor events arm64: Add N2, V2, N3, V3 events/metrics +- !18385 e1000e: fix heap overflow in e1000_set_eeprom +- !18395 scsi: target: target_core_configfs: Add length check to avoid buffer overflow +- config: enable CONFIG_MITIGATION_TSA and CONFIG_KVM_HYPERV by default on x86 +- x86/cpu: Shorten CPU matching macro +- platform/x86/intel/ifs: Switch to new Intel CPU model defines +- x86/microcode/AMD: Handle the case of no BIOS microcode +- KVM: SVM: Advertise TSA CPUID bits to guests +- tools headers: Sync x86 headers with the kernel source +- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value +- x86/microcode/AMD: Add some forgotten models to the SHA check +- x86/CPU/AMD: Terminate the erratum_1386_microcode array +- x86/microcode/AMD: Split load_microcode_amd() +- x86/microcode/AMD: Pay attention to the stepping dynamically +- KVM: x86: hyper-v: Remove unused inline function kvm_hv_free_pa_page() +- x86/microcode/intel: Set new revision only after a successful update +- x86/platform/atom: Switch to new Intel CPU model defines +- x86/process: Move the buffer clearing before MONITOR +- x86/microcode/AMD: Add TSA microcode SHAs +- x86/microcode/AMD: Load only SHA256-checksummed patches +- x86/microcode/AMD: Add get_patch_level() +- x86/microcode/AMD: Merge early_apply_microcode() into its single callsite +- x86/microcode/AMD: Remove unused save_microcode_in_initrd_amd() declarations +- x86/microcode/AMD: Remove ret local var in early_apply_microcode() +- x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID +- x86/microcode/AMD: Avoid -Wformat warning with clang-15 +- x86/microcode/AMD: Have __apply_microcode_amd() return bool +- x86/microcode/AMD: Flush patch buffer mapping after application +- x86/microcode: Rework early revisions reporting +- x86/bugs: Add a Transient Scheduler Attacks mitigation +- x86/bugs: Rename MDS machinery to something more generic +- x86/idle: Use MONITOR and MWAIT mnemonics in <asm/mwait.h> +- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 +- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup +- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() +- x86/cpu: Expose only stepping min/max interface +- x86/cpu: Introduce new microcode matching helper +- cpufreq: intel_pstate: Switch to new Intel CPU model defines +- cpufreq: Switch to new Intel CPU model defines +- EDAC/skx: Switch to new Intel CPU model defines +- EDAC/i10nm: Switch to new Intel CPU model defines +- x86/aperfmperf: Switch to new Intel CPU model defines +- x86/apic: Switch to new Intel CPU model defines +- x86/bugs: Switch to new Intel CPU model defines +- x86/CPU/AMD: Improve the erratum 1386 workaround +- cpufreq: intel_pstate: Update default EPPs for Meteor Lake +- cpufreq: intel_pstate: Update hybrid scaling factor for Meteor Lake +- KVM: x86: Make Hyper-V emulation optional +- KVM: nVMX: Split off helper for emulating VMCLEAR on Hyper-V eVMCS +- KVM: VMX: Split off hyperv_evmcs.{ch} +- net: ubl: add CONFIG_UB_UBL definition and UBL interface +- RDMA/hns: Fix wrong WQE data when QP wraps around +- !18464 i40e: add max boundary check for VF filters +- !18433 dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees +- !18256 Add EDAC basic support and RRL enhancement for CWF/SRF/GNR/GNR-D +- !18254 Add IFS support for ClearWater Forest +- !18455 KVM: arm64: vgic-v4: Restore pending state on host userspace write +- !18289 Expand scope of khugepaged anonymous collapse +- !18324 arm64: Enable vmalloc-huge with ptdump +- !18419 sched/core: Add sched_change_qos_group() in sched_cgroup_fork() +- i40e: add max boundary check for VF filters +- arm64: add cnp verification on Hisilicon erratum 162100125 +- !18151 ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr +- !18152 fs/buffer: fix use-after-free when call bh_read() helper +- !18312 ext4: preserve SB_I_VERSION on remount +- !18313 fs: quota: create dedicated workqueue for quota_release_work +- !18311 ext4: fix an off-by-one issue during moving extents +- !17401 fscrypt: Don't use problematic non-inline crypto engines +- KVM: arm64: vgic-v4: Restore pending state on host userspace write +- !18237 fuse: support sysfs api for flush and +- !18422 net/hinic3: Modify driver version +- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees +- !18425 Fix CVE-2025-39989 +- !18427 i40e: fix idx validation in config queues msg +- i40e: fix idx validation in config queues msg +- x86/mce: use is_copy_from_user() to determine copy-from-user context +- x86/extable: Remove unused fixup type EX_TYPE_COPY +- net/hinic3: Modify driver version +- net:nebula-matrix:Add S1000 SNIC driver support +- !18414 Fix add define COMPAT_ELF_HWCAP3 +- !18406 pcmcia: Add error handling for add_interval() in do_validate_mem() +- sched/core: Add sched_change_qos_group() in sched_cgroup_fork() +- !18401 Bluetooth: btrtl: Prevent potential NULL dereference +- !18241 ras: ACPI: HED: Always initialize before evged +- sdei_watchdog: Add CPU_PM_ENTER_FAILED handling in sdei_watchdog_pm_notifier +- Fix add define COMPAT_ELF_HWCAP3 +- !17928 bus: fsl-mc: fix double-free on mc_dev +- !17908 fix CVE-2025-38630 +- !18224 fix CVE-2025-38624 +- !17871 f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode +- !17877 fs/ntfs3: cancle set bad inode after removing name fails +- !17909 fix CVE-2025-38555 +- !17872 f2fs: fix to avoid panic in f2fs_evict_inode +- !17760 Fix CVE-2025-38414 +- !17611 net: ravb: Fix missing rtnl lock in suspend/resume path +- !17859 f2fs: fix to bail out in get_new_segment() +- !17354 net/atm/resources: Release atm_dev_mutex after removing procfs in atm_… +- !18032 [OLK-6.6] Fix CVE-2025-37897 +- !18030 [OLK-6.6] Fix CVE-2025-37914 +- !18037 [OLK-6.6] Fix CVE-2025-37917 +- !18036 [OLK-6.6] Fix CVE-2025-37922 +- !18035 [OLK-6.6] Fix CVE-2025-37935 +- !18034 [OLK-6.6] Fix CVE-2025-37931 +- !18033 [OLK-6.6] Fix CVE-2025-37901 +- !18028 [OLK-6.6] Fix CVE-2025-37987 +- !18027 [OLK-6.6] Fix CVE-2025-37983 +- crypto: hisilicon/qm - clear all VF configurations in the hardware +- Revert "crypto: hisilicon/qm - fix vfs_num error" +- crypto: hisilicon/qm - invalidate queues in use +- Revert "crypto: hisilicon/qm - invalidate queues in use" +- Revert "crypto: hisilicon/qm - clear the memory before enabling the device" +- crypto: hisilicon/zip - add hashjoin, gather, and UDMA data move features +- crypto: hisilicon/zip - add lz4 and lz77_only to algorithm sysfs +- crypto: hisilicon/sec2 - Fix false-positive warning of uninitialised qp_ctx +- !17807 Add workaround for HIP09/HIP10/HIP10C/HIP12 erratum 162100803/162200807/162400807/165010802 +- pcmcia: Add error handling for add_interval() in do_validate_mem() +- !18326 [OLK-6.6] Support Hygon TKM (Trusted Key Management) Guest live migration +- !18199 block: avoid possible overflow for chunk_sectors check in blk_stack_limits() +- !18131 loop: Avoid updating block size under exclusive owner +- !18006 scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated +- !18402 kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths +- !18249 enfs: add new path state PM_STATE_UNSTABLE +- kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths +- Bluetooth: btrtl: Prevent potential NULL dereference +- scsi: target: target_core_configfs: Add length check to avoid buffer overflow +- nfs/enfs: cleanups in pm_set_path_state() +- nfs/enfs: prefer normal rpc transport over unstable one +- nfs/enfs: introduce reconnect time KUnit tests +- nfs/enfs: set PM_STATE_UNSTABLE if path is unstable +- nfs/enfs: introduce enum PM_STATE_UNSTABLE +- !18357 *** OLK-6.6-fix-CVE-2025-39787 *** +- !18374 locking/qspinlock: Fix CNA NUMA node setup before numa_store_cpu_info() +- !18362 umount performance fix +- e1000e: fix heap overflow in e1000_set_eeprom +- locking/qspinlock: Fix CNA NUMA node setup before numa_store_cpu_info() +- do_make_slave(): choose new master sanely +- change_mnt_propagation(): do_make_slave() is a no-op unless IS_MNT_SHARED() +- change_mnt_propagation() cleanups, step 1 +- soc: qcom: mdt_loader: Deal with zero e_shentsize +- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() +- soc: qcom: mdt_loader: Ensure we don't read past the ELF header +- crypto: ccp: ensure kvm_bind_vtkm is only executed once for csv guest +- crypto: ccp: support vtkm live migration +- arm64: Enable vmalloc-huge with ptdump +- arm64: Restrict pagetable teardown to avoid false warning +- fs: quota: create dedicated workqueue for quota_release_work +- ext4: preserve SB_I_VERSION on remount +- ext4: fix an off-by-one issue during moving extents +- mm: drop all references of writable and SCAN_PAGE_RO +- mm: enable khugepaged anonymous collapse on non-writable regions +- khugepaged: pass folio instead of head page to trace events +- perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores +- perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions +- ras: ACPI: HED: Always initialize before evged +- fuse: fix issues in fuse_resend_pqueue() implementation +- fuse: Introduce sysfs API for resend pending requests +- fuse: Introduce sysfs API for flushing pending requests +- PCI: pnv_php: Clean up allocated IRQs on unplug +- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() +- EDAC/{skx_common,i10nm}: Use scnprintf() for safer buffer handling +- EDAC/i10nm: Add Intel Granite Rapids-D support +- EDAC/i10nm: Fix the bitwise operation between variables of different sizes +- EDAC/{skx_common,i10nm}: Add RRL support for Intel Granite Rapids server +- EDAC/{skx_common,i10nm}: Refactor show_retry_rd_err_log() +- EDAC/{skx_common,i10nm}: Refactor enable_retry_rd_err_log() +- EDAC/{skx_common,i10nm}: Structure the per-channel RRL registers +- EDAC/i10nm: Explicitly set the modes of the RRL register sets +- EDAC/{i10nm,skx,skx_common}: Support UV systems +- EDAC/i10nm: Add Intel Clearwater Forest server support +- EDAC/{skx_common,i10nm}: Remove the AMAP register for determing DDR5 +- EDAC/{skx_common,skx,i10nm}: Move the common debug code to skx_common +- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 +- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids +- EDAC/i10nm: Add Intel Grand Ridge micro-server support +- platform/x86/intel/ifs: Add Clearwater Forest to CPU support list +- fs/buffer: fix use-after-free when call bh_read() helper +- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr +- loop: Avoid updating block size under exclusive owner +- openeuler_defconfig: Add CONFIG_HISILICON_ERRATUM_162100803 +- irqchip/gicv3-its: Add workaround for HIP09/HIP10/HIP10C/HIP12 erratum 162100803/162200807/162400807/165010802 +- net/atm/resources: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). +- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll +- book3s64/radix : Align section vmemmap start address to PAGE_SIZE +- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM +- btrfs: adjust subpage bit start based on sectorsize +- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs +- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release +- net_sched: ets: Fix double list add in class with netem as child qdisc +- pds_core: Prevent possible adminq overflow/stuck condition +- qibfs: fix _another_ leak +- scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated +- bus: fsl-mc: fix double-free on mc_dev +- usb: gadget : fix use-after-free in composite_dev_cleanup() +- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref +- fs/ntfs3: cancle set bad inode after removing name fails +- f2fs: fix to bail out in get_new_segment() +- net: ravb: Fix missing rtnl lock in suspend/resume path +- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 +- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode +- f2fs: fix to avoid panic in f2fs_evict_inode +- fscrypt: Don't use problematic non-inline crypto engines +- RNPGBE: NET: Fix dmesg 'unknow speed' show when 1000M +- perf vendor events arm64: Add V3 events/metrics +- perf vendor events arm64: Add N3 events/metrics +- perf vendor events arm64: Add FUJITSU-MONAKA PMU event +- perf vendor events arm64: Update N2/V2 events from source +- arm64/cpufeatures/kvm: Add ARMv8.9 FEAT_ECBHB bits in ID_AA64MMFR1 register + +* Fri Oct 17 2025 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-112.0.0.91 +- RISC-V kernel upgrade to 6.6.0-112.0.0 +- Sync patches from the rvck-olk repository, including: + ACPI, IOMMU drivers; + Key RISC-V extensions support; + Add support for K1, SG2044, and DP1000. + +* Wed Oct 15 2025 Li Nan <linan122@huawei.com> - 6.6.0-112.0.0.90 +- !18320 workqueue: Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT +- !18336 soc cache: support L3 cache lock in framework +- !18352 net/oenetcls: Fix memleak when clean flow table +- !18306 vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects +- !18342 tracing: Silence warning when chunk allocation fails in trace_pid_write +- net/oenetcls: Fix memleak when clean flow table +- tracing: Silence warning when chunk allocation fails in trace_pid_write +- !18331 ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() +- !18330 cpufreq: Initialize cpufreq-based invariance before subsys +- soc cache: L3 cache lockdown support for HiSilicon SoC +- soc cache: support L3 cache lock in framework +- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() +- cpufreq: Initialize cpufreq-based invariance before subsys +- !18275 [OLK-6.6] Optimized the kernel driver of HYGON trusted functions +- !18322 Fix CVE-2025-39715 +- !18293 CVE-2025-39886 +- !18290 vxlan: Fix NPD when refreshing an FDB entry with a nexthop object +- parisc: Revise gateway LWS calls to probe user read access +- workqueue: Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT +- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects +- !18286 mm: shmem: fix the strategy for the tmpfs 'huge=' options +- !18282 v2: shmem cleanup +- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() +- memcg: skip cgroup_file_notify if spinning is not allowed +- !18291 CVE-2025-39844 +- !18031 Introduce fwctl subystem framework +- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() +- mm: introduce and use {pgd,p4d}_populate_kernel() +- mm: move page table sync declarations to linux/pgtable.h +- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object +- !18280 samples/bpf: fix cpuinfo_arm64 prog load issue +- crypto: ccp: optimize PSP driver code logic to reduce modifications to native code +- crypto: ccp: add "tdm_guard" as kernel and module parameter +- crypto: ccp: optimize TDM kernel driver +- mm: shmem: fix the strategy for the tmpfs 'huge=' options +- docs: update THP documentation to clarify sysfs "never" setting +- mm: shmem: drop the unnecessary folio_nr_pages() +- mm: shmem: use 'folio' for shmem_partial_swap_usage() +- samples/bpf: fix cpuinfo_arm64 prog load issue +- !18264 memory tiers: use default_dram_perf_ref_source in log message +- !18259 cgroup: split cgroup_destroy_wq into 3 workqueues +- !18231 ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). +- !18230 net: ch9200: fix uninitialised access during mii_nway_restart +- !18227 i40e: Fix potential invalid access when MAC list is empty +- memory tiers: use default_dram_perf_ref_source in log message +- !18250 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory +- !18253 samples/bpf: Fix print issue in bpf_rvi_diskstats +- !18234 samples/bpf: Fix print issue in dump_partitions() +- cgroup: split cgroup_destroy_wq into 3 workqueues +- fwctl: Fix repeated device word in log message +- fwctl: Add documentation +- fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware +- taint: Add TAINT_FWCTL +- fwctl: FWCTL_INFO to return basic information about the device +- fwctl: Basic ioctl dispatch for the character device +- fwctl: Add basic structure for a class subsystem with a cdev +- samples/bpf: Fix print issue in bpf_rvi_diskstats +- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory +- !18173 usb: core: config: Prevent OOB read in SS endpoint companion parsing +- samples/bpf: Fix print issue in dump_partitions() +- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). +- net: ch9200: fix uninitialised access during mii_nway_restart +- i40e: Fix potential invalid access when MAC list is empty +- !18179 Implement disable/enable for (delayed) work +- !18038 v3 arm64: Do not enable hardware xcall/xint in guest temporarily +- !18195 arm64/mpam: Update MB hardlimit and priority default value forcely +- !17636 [OLK-6.6] [Intel-SIG] crypto: iaa - Remove potential infinite loop in check_completion() +- !17858 [OLK-6.6] [Intel-SIG] Enable FLR for IDXD halt +- !17994 perf: backport community patches +- !18183 CVE-2025-38725 +- arm64/mpam: Update MB hardlimit and priority default value forcely +- dmaengine: idxd: Enable Function Level Reset (FLR) for halt +- dmaengine: idxd: Refactor halt handler +- dmaengine: idxd: Add idxd_device_config_save() and idxd_device_config_restore() helpers +- dmaengine: idxd: Binding and unbinding IDXD device and driver +- dmaengine: idxd: Add idxd_pci_probe_alloc() helper +- bitmap: Define a cleanup function for bitmaps +- !15977 use refcount+RCU method to implement lockless slab shrink +- !18166 Updates of HiSilicon Uncore L3C PMU +- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization +- net: usb: asix_devices: add phy_mask for ax88772 mdio bus +- !18156 ARM: rockchip: fix kernel hang during smp initialization +- workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() +- workqueue: Implement disable/enable for (delayed) work items +- workqueue: Preserve OFFQ bits in cancel[_sync] paths +- workqueue: Make @flags handling consistent across set_work_data() and friends +- workqueue: Remove clear_work_data() +- workqueue: Factor out work_grab_pending() from __cancel_work_sync() +- workqueue: Clean up enum work_bits and related constants +- workqueue: Introduce work_cancel_flags +- workqueue: Rename __cancel_work_timer() to __cancel_timer_sync() +- mm: add KABI_* macros to preserve KABI +- mm: shrinker add a copyright notice +- mm: shrinker: convert shrinker_rwsem to mutex +- mm: shrinker: hold write lock to reparent shrinker nr_deferred +- mm: shrinker: make memcg slab shrink lockless +- mm: shrinker: make global slab shrink lockless +- mm: shrinker: rename {prealloc|unregister}_memcg_shrinker() to shrinker_memcg_{alloc|remove}() +- mm: shrinker: add a secondary array for shrinker_info::{map, nr_deferred} +- mm: shrinker: remove old APIs +- mm: shrinker: vmalloc.c: use the new shrinker kAPI +- fs: super: dynamically allocate the s_shrink +- zsmalloc: dynamically allocate the mm-zspool shrinker +- xfs: dynamically allocate the xfs-qm shrinker +- xfs: dynamically allocate the xfs-inodegc shrinker +- xfs: dynamically allocate the xfs-buf shrinker +- nfsd: dynamically allocate the nfsd-reply shrinker +- nfsd: dynamically allocate the nfsd-client shrinker +- jbd2,ext4: dynamically allocate the jbd2-journal shrinker +- ext4: dynamically allocate the ext4-es shrinker +- mbcache: dynamically allocate the mbcache shrinker +- virtio_balloon: dynamically allocate the virtio-balloon shrinker +- vmw_balloon: dynamically allocate the vmw-balloon shrinker +- bcache: dynamically allocate the md-bcache shrinker +- md/raid5: dynamically allocate the md-raid5 shrinker +- dm zoned: dynamically allocate the dm-zoned-meta shrinker +- dm: dynamically allocate the dm-bufio shrinker +- drm/panfrost: dynamically allocate the drm-panfrost shrinker +- drm/msm: dynamically allocate the drm-msm_gem shrinker +- drm/i915: dynamically allocate the i915_gem_mm shrinker +- mm: workingset: dynamically allocate the mm-shadow shrinker +- sunrpc: dynamically allocate the sunrpc_cred shrinker +- mm: thp: dynamically allocate the thp-related shrinkers +- rcu: dynamically allocate the rcu-kfree shrinker +- rcu: dynamically allocate the rcu-lazy shrinker +- ubifs: dynamically allocate the ubifs-slab shrinker +- quota: dynamically allocate the dquota-cache shrinker +- nfsd: dynamically allocate the nfsd-filecache shrinker +- nfs: dynamically allocate the nfs-acl shrinker +- NFSv4.2: dynamically allocate the nfs-xattr shrinkers +- gfs2: dynamically allocate the gfs2-qd shrinker +- gfs2: dynamically allocate the gfs2-glock shrinker +- f2fs: dynamically allocate the f2fs-shrinker +- erofs: dynamically allocate the erofs-shrinker +- xenbus/backend: dynamically allocate the xen-backend shrinker +- drm/ttm: dynamically allocate the drm-ttm_pool shrinker +- binder: dynamically allocate the android-binder shrinker +- kvm: mmu: dynamically allocate the x86-mmu shrinker +- mm: shrinker: add infrastructure for dynamically allocating shrinker +- drm/ttm: introduce pool_shrink_rwsem +- mm: shrinker: remove redundant shrinker_rwsem in debugfs operations +- mm: vmscan: move shrinker-related code into a separate file +- mm: move some shrinker-related function declarations to mm/internal.h +- x86/boot: Compile boot code with -std=gnu11 too +- usb: core: config: Prevent OOB read in SS endpoint companion parsing +- !17949 crypto: hisilicon - some bugfix +- !18144 Backport fs/pipe performance optimization patches +- !17961 usb: gadget: configfs: Fix OOB read on empty string write +- !17960 drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initial… +- !17958 jfs: Prevent copying of nlink with value 0 from disk inode +- !17957 fs/ntfs3: Fix a couple integer overflows on 32bit systems +- !17956 drm/tegra: Fix a possible null pointer dereference +- !17954 mtd: spinand: fix memory leak of ECC engine conf +- !17953 regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods +- !17952 rose: fix dangling neighbour pointers in rose_rt_device_down() +- Documentation: hisi-pmu: Add introduction to HiSilicon V3 PMU +- Documentation: hisi-pmu: Fix of minor format error +- drivers/perf: hisi: Add support for L3C PMU v3 +- Revert "drivers/perf: hisi: Add support for L3C PMU v3" +- Revert "Documentation: hisi-pmu: Fix of minor format error" +- Revert "Documentation: hisi-pmu: Add introduction to HiSilicon V3 PMU" +- !17973 enfs: recreate shard info when re-adding enfs module +- !18114 tee: fix NULL pointer dereference in tee_shm_put +- ARM: rockchip: fix kernel hang during smp initialization +- !18133 iommu/arm-smmu-qcom: Add SM6115 MDSS compatible +- fs/pipe: use spinlock in pipe_read() only if there is a watch_queue +- fs/pipe: remove unnecessary spinlock from pipe_write() +- !18129 soc: hisilicon: kunpeng_hccs: Fix incorrect log information +- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible +- !18073 HID: asus: fix UAF via HID_CLAIMED_INPUT validation +- !18118 samples/bpf: Fix print issue in dump_swaps() +- soc: hisilicon: kunpeng_hccs: Fix incorrect log information +- !18123 arm64/mpam: Add quirk for hisi cpbm_wd field +- !18041 fs/smb: Fix inconsistent refcnt update +- !17932 [OLK-6.6] add support for WangXun 10G/25G/40G +- arm64/mpam: Add quirk for hisi cpbm_wd field +- !17665 cpufreq: intel_pstate: Support Clearwater Forest OOB mode +- !17663 platform/x86: ISST: Add Clearwater Forest to support list +- !17668 cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode +- !17681 cpufreq: intel_pstate: Update Balance-performance EPP for Granite Rapids +- !17468 [Intel-SIG] backporting KVM: x86: Advertise AVX10.1 CPUID to userspace +- !17571 [OLK-6.6] Intel-SIG: Add new Intel CPU# definition +- samples/bpf: Fix print issue in dump_swaps() +- !18024 trace/fgraph: Fix error handling +- !18061 net: bridge: fix soft lockup in br_multicast_query_expired() +- tee: fix NULL pointer dereference in tee_shm_put +- !18026 vsock/virtio: Validate length in packet header before skb_put() +- !18088 net/oenetcls: Fix crash when removing module +- net/oenetcls: Fix crash when removing module +- nfs/enfs: remove duplicate EOPNOTSUPP definition +- nfs/enfs: remove enfs_tp_common.h +- nfs/enfs: remove ping_execute_workq_lock +- nfs/enfs: remove lookupcache_workq_lock +- nfs/enfs: remove redundant flush_workqueue() before destroy_workqueue() +- nfs/enfs: return more nuanced error in NfsExtendProcInfoExtendEncode() and NfsExtendProcInfoExtendDecode() +- nfs/enfs: handle error returned by NfsExtendProcInfoExtendEncode() +- nfs/enfs: fix possible null-ptr-deref in exten_call.c +- nfs/enfs: free memory uniformly at the end of function in exten_call.c +- nfs/enfs: fix possible memory leak in exten_call.c +- nfs/enfs: reload config when re-adding enfs module +- nfs/enfs: recreate shard info when re-adding enfs module +- !18071 media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() +- HID: asus: fix UAF via HID_CLAIMED_INPUT validation +- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() +- net: bridge: fix soft lockup in br_multicast_query_expired() +- !18054 arm64 kvm: On the Adaptation of CCA and virtCCA. +- arm64 kvm: On the Adaptation of CCA and virtCCA. +- usb: gadget: configfs: Fix OOB read on empty string write +- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table +- jfs: Prevent copying of nlink with value 0 from disk inode +- fs/ntfs3: Fix a couple integer overflows on 32bit systems +- drm/tegra: Fix a possible null pointer dereference +- mtd: spinand: fix memory leak of ECC engine conf +- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods +- !17972 arm64/mpam: Add quirk for L3 CSU counters +- rose: fix dangling neighbour pointers in rose_rt_device_down() +- fs/smb: Fix inconsistent refcnt update +- !18016 media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() +- arm64: Do not enable hardware xcall/xint in guest temporarily +- !16579 Do not shatter hugezeropage on wp-fault +- !17839 [OLK-6.6] Fix CVE-2025-37838 +- !17887 [OLK-6.6] Fix CVE-2025-38637 +- !17889 [OLK-6.6] Fix CVE-2025-37840 +- !17850 [OLK-6.6] Fix CVE-2025-38173 +- !17854 [OLK-6.6] Fix CVE-2025-38143 +- !17861 [OLK-6.6] Fix CVE-2025-38194 +- vsock/virtio: Validate length in packet header before skb_put() +- arm64: cca_base: On the Adaptation of CCA and virtCCA. +- trace/fgraph: Fix error handling +- perf: Always feature test reallocarray +- perf comm str: Avoid sort during insert +- crypto: hisilicon - use kcalloc() instead of kzalloc() +- crypto: hisilicon/zip - enable literal length in stream mode compression +- crypto: hisilicon - check the sva module status while enabling or disabling address prefetch +- crypto: hisilicon - re-enable address prefetch after device resuming +- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations +- crypto: hisilicon/sec2 - implement full backlog mode for sec +- Revert "crypto: hisilicon/sec2 - fix memory use-after-free issue" +- Revert "crypto: hisilicon/sec2 - fix for gcm spec check" +- crypto: hisilicon - Use fine grained DMA mapping direction +- Revert "crypto: hisilicon - implement full backlog support for sec" +- crypto: hisilicon/qm - replace devm_kzalloc with devm_kcalloc +- crypto: hisilicon/qm - remove sizeof(char) +- !18015 arm64: cca_base: On the Adaptation of CCA and virtCCA. +- !18017 pNFS: Fix uninited ptr deref in block/scsi layout +- pNFS: Fix uninited ptr deref in block/scsi layout +- !18000 gfs2: Validate i_depth for exhash directories +- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() +- !17997 hv_netvsc: Fix panic during namespace deletion with VF +- !17947 migration/hisilicon: some bugfix +- !17919 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() +- perf comm: Fix comm_str__put() for reference count checking +- perf comm: Add reference count checking to 'struct comm_str' +- gfs2: Validate i_depth for exhash directories +- hv_netvsc: Fix panic during namespace deletion with VF +- !17985 Updates of HiSilicon Uncore L3C PMU +- !17977 media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar +- !17987 virtCCA CoDA: Prevent secure PFs/VFs load or probe native drivers. +- virtCCA CoDA: Prevent secure PFs/VFs load or probe native drivers. +- Documentation: hisi-pmu: Add introduction to HiSilicon V3 PMU +- Documentation: hisi-pmu: Fix of minor format error +- drivers/perf: hisi: Add support for L3C PMU v3 +- !17974 iommu: Fix the incorrect exception process of the failed memory allocation +- !17983 fix oenetcls bugs +- net/oenetcls: clean resource when init ntuple/flow fail +- net/oenetcls: use workqueue for ntuple cfg +- net/oenetcls: remove oenetcls trace hook +- net/oenetcls: use raw_smp_processor_id() instead of smp_processor_id() +- !17898 enfs: fix some bugs and optimize performance +- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar +- !17976 LoongArch: BPF: Fix jump offset calculation in tailcall +- iommu: Fix the incorrect exception process of the failed memory allocation +- LoongArch: BPF: Fix jump offset calculation in tailcall +- !17602 [OLK-6.6] drm/phytium: Fix make allmodconfig build fail +- jffs2: check that raw node were preallocated before writing summary +- net_sched: skbprio: Remove overly strict queue assertions +- crypto: marvell/cesa - Handle zero-length skcipher requests +- mtd: rawnand: brcmnand: fix PM resume warning +- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition +- backlight: pm8941: Add NULL check in wled_configure() +- !17792 virtCCA: Improve cvm performance. +- !17869 [OLK-6.6]Backport upstream CC Measurement support in the efi libstub +- !17862 [OLK-6.6]Hygon: Support RTMR and Attestation that includes RTMR for Hygon CSV3 VM +- !17946 mm/shmem, swap: bugfix and improvement of mTHP swap in +- arm64/mpam: Add quirk for L3 CSU counters +- !17969 arm64/mpam: Add quirk for cmax and cmin +- !17967 sched: Fix sched_numa_find_nth_cpu() if mask offline +- !17955 arm64: RME: handle RIPAS changes before kvm_rec_enter +- arm64: RME: handle RIPAS changes before kvm_rec_enter +- arm64: RME: Introduce kvm_rec_pre_enter() called before entering an atomic section +- !17962 tools/mpam: Add MPAM dynamic adjustment and sampling scripts +- arm64/mpam: Add quirk for cmax and cmin +- !17940 net/tls: fix kernel panic when alloc_page failed +- !17941 OLK-6.6-fix-CVE-2025-38147 +- sched: Fix sched_numa_find_nth_cpu() if mask offline +- tools/mpam: Add MPAM dynamic adjustment and sampling scripts +- !17939 pinctrl: qcom: msm: mark certain pins as invalid for interrupts +- !17945 Fix CVE-2025-38687 +- hisi_acc_vfio_pci: update device driver status +- migration: resolve duplicate migration states +- migration: fix VF reset timeout issue +- migration: bugfix live migration function without VF device driver +- mm/shmem, swap: fix major fault counting +- mm/shmem, swap: rework swap entry and index calculation for large swapin +- !17936 padata: Fix pd UAF once and for all +- mm/shmem, swap: simplify swapin path and result handling +- mm/shmem, swap: never use swap cache and readahead for SWP_SYNCHRONOUS_IO +- mm/shmem, swap: tidy up swap entry splitting +- !17879 sched: apply custom cpu range for idle cpu +- mm/shmem, swap: tidy up THP swapin checks +- mm/shmem, swap: avoid redundant Xarray lookup during swapin +- mm/shmem, swap: improve cached mTHP handling and fix potential hang +- mm/shmem, swap: fix softlockup with mTHP swapin +- x86/cpu/vfm: Fix x86_vfm kabi +- x86/cpu/vfm: Update arch/x86/include/asm/intel-family.h +- x86/cpu/vfm: Add/initialize x86_vfm field to struct cpuinfo_x86 +- x86/cpu: Add model number for another Intel Arrow Lake mobile processor +- net: wangxun: txgbe: add support for wangxun 10G/25G/40G +- comedi: fix race between polling and detaching +- !17937 clk: davinci: Add NULL check in davinci_lpsc_clk_register() +- Add IPI direct inject method for virtCCA CVM. +- Improve virtCCA CVM vtimer irq inject method. +- Add poll method for nfs for virtCCA CVM. +- calipso: unlock rcu before returning -EAFNOSUPPORT +- calipso: Don't call calipso functions for AF_INET sk. +- net/tls: fix kernel panic when alloc_page failed +- pinctrl: qcom: msm: mark certain pins as invalid for interrupts +- clk: davinci: Add NULL check in davinci_lpsc_clk_register() +- padata: Fix pd UAF once and for all +- !17853 v3 arm64: Fix actlr_el1 can not set problem in guest +- !17882 CVE-2025-38502 +- net: wangxun: remove wangxun txgbe inbox drivers +- !17922 x86/sgx: Prevent attempts to reclaim poisoned pages +- !17923 media: vidtv: Terminating the subsequent process of initialization failure +- !17924 [backport]KVM: arm64: Select default PMU in KVM_ARM_VCPU_INIT handler +- !17913 Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' +- !17915 arm64/mpam: Half the number of RMIDs for all resources under CDP mode +- [backport]KVM: arm64: Select default PMU in KVM_ARM_VCPU_INIT handler +- media: vidtv: Terminating the subsequent process of initialization failure +- x86/sgx: Prevent attempts to reclaim poisoned pages +- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() +- !17848 [OLK-6.6]:update patches for sw64 architecture +- nfs/enfs: remove duplicate definitions +- nfs/enfs: fix some cleanup issues +- nfs/enfs: fix finding root uuid issue +- nfs/enfs: introduce is_enfs_debug() +- nfs/enfs: get rpc procedure number from rpc_procinfo in get_uuid_from_task() +- sunrpc: do not set enfs transport in rpc_task_set_client() +- virtCCA CoDA: Expose I/O hook interfaces. +- !17731 arm64/mpam: Add mb_only boot option +- !17911 CVE-2025-38305 +- !17244 Fix netns reference count issue +- !17914 virtCCA CoDA: Expose I/O hook interfaces. +- arm64/mpam: Half the number of RMIDs for all resources under CDP mode +- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' +- ptp: fix breakage after ptp_vclock_in_use() rework +- ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() +- !17868 scsi: Remove scsi device no_start_on_resume flag +- !17866 md: make rdev_addable usable for rcu mode +- !17865 scsi: core: ufs: Fix a hang in the error handler +- !17842 [OLK-6.6] Fix CVE-2025-37924 +- !17836 [OLK-6.6] Fix CVE-2025-38312 +- !17902 [OLK-6.6] perf/zhaoxin/uncore: Enhance uncore support and fix related bugs +- !17880 [OLK-6.6] backport important bugfix for lpfc driver from upstream linux-6.6.y +- perf/zhaoxin/uncore: Enhance uncore support and fix related bugs +- !17890 LeapIOraid: fix strscpy size argument +- !17892 pptp: Fix skb length handling and error path in pptp_xmit() +- !17815 v2 ext4: better scalability for ext4 block allocation +- pptp: fix pptp_xmit() error path +- pptp: ensure minimal skb length in pptp_xmit() +- LeapIOraid: fix strscpy size argument +- !17883 net/mlx5e: Remove skb secpath if xfrm state is not found +- net/mlx5e: Remove skb secpath if xfrm state is not found +- Fix kabi breakage for bpf_map by using KABI_BROKEN_REPLACE and KABI_FILL_HOLE. +- bpf: Fix oob access in cgroup local storage +- bpf: Move cgroup iterator helpers to bpf.h +- bpf: Move bpf map owner out of common struct +- bpf: Add cookie object to bpf maps +- sched: apply custom cpu range for idle cpu +- !17756 [OLK-6.6] Provide host-side administrators/users with real-time access to the usage status of CSV3 CMA memory. +- !17846 VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify +- !17442 scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() +- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure +- !17813 net/mlx5: Check device memory pointer before usage +- scsi: fix kabi broken for no_start_on_resume flag in struct scsi_device +- scsi: Remove scsi device no_start_on_resume flag +- md: make rdev_addable usable for rcu mode +- scsi: core: ufs: Fix a hang in the error handler +- efi/libstub: Add get_event_log() support for CC platforms +- efi/libstub: Measure into CC protocol if TCG2 protocol is absent +- efi/libstub: Add Confidential Computing (CC) measurement typedefs +- efi/tpm: Use symbolic GUID name from spec for final events table +- efi/libstub: Use TPM event typedefs from the TCG PC Client spec +- !17835 v2 perf/aux: Fix pending disable flow when the AUX ring buffer overruns +- virt: csv-guest: Add support for extended attestation aware request in the CSV3 guest +- virt: csv-guest: Implement CSV RTMR ioctl interfaces +- virt: csv-guest: Introduce CSV RTMR uapi interface +- x86/csv: Introduce RTMR interfaces +- sw64: fix for userspace asking for syscall(-1) +- sw64: update junzhang default config file +- sw64: kvm: introduce pmd_thp_or_huge for PMD hugepage checking +- sw64: add cross-page check in software unaligned write handling +- sw64: ptrace: fail system calls on invalid address access in PEEKUSR +- sw64: ptrace: fix a bug in return value handling in PEEKUSR AND POKEUSR +- sw64: perf: Add support for get_cpuid_str function +- sw64: kvm: use read/write spin lock for KVM MMU +- sw64: rethook: fix a bug in rethook_trampoline +- sw64: perf unwind: Do not put libunwind-sw_64 in FEATURE_TESTS_BASIC +- !17856 sdei_watchdog: add percpu flag to fix sdei watchdog state in lpi mode +- !17635 mm: madvise: use per_vma lock for MADV_FREE +- sdei_watchdog: add percpu flag to fix sdei watchdog state in lpi mode +- !17841 fs/resctrl: Fix max_threshold_occupancy write operation +- !17844 CVE-2025-37752 +- !17845 xfrm: interface: fix use-after-free after changing collect_md xfrm interface +- !17733 proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al +- arm64: Fix actlr_el1 can not set problem in guest +- !17834 cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() +- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify +- xfrm: interface: fix use-after-free after changing collect_md xfrm interface +- net_sched: sch_sfq: move the limit validation +- net_sched: sch_sfq: use a temporary work area for validating configuration +- !17840 arm64/mpam: Fix num_rmids when enable CDP mode +- ksmbd: fix use-after-free in kerberos authentication +- ksmbd: Fix dangling pointer in krb_authenticate +- fs/resctrl: Fix max_threshold_occupancy write operation +- arm64/mpam: Fix num_rmids when enable CDP mode +- !17838 mm/hugetlb: fix set_max_huge_pages() when there are surplus pages +- mm/hugetlb: fix set_max_huge_pages() when there are surplus pages +- !17587 CVE-2025-38406: wifi: ath6kl: remove WARN on bad firmware input +- !17585 CVE-2025-38408： genirq/irq_sim: Initialize work context pointers properly +- !17586 CVE-2025-38409: drm/msm: Fix another leak in the submit error path +- !17584 CVE-2025-38410: drm/msm: Fix a fence leak in submit error path +- !17582 NFC: nci: uart: Set tty->disc_data only in success path +- !17590 wifi: carl9170: do not ping device which has failed to load firmware +- !17593 net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices +- !17594 CVE-2025-38425: i2c: tegra: check msg length in SMBUS block read +- !17595 Input: ims-pcu - check record size in ims_pcu_flash_firmware() +- !17596 usb: gadget: u_serial: Fix race condition in TTY wakeup +- !17583 CVE-2025-38467：drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling +- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() +- perf/aux: Fix pending disable flow when the AUX ring buffer overruns +- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() +- !17789 bpf, sockmap: Fix CVE-2025-38154 +- !17712 wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() +- !17790 page_pool: Fix use-after-free in page_pool_recycle_in_ring +- !17788 netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX +- !17786 net: xfrm: Fix CVE-2025-38097 +- !17784 bpf, sockmap: Fix panic when calling skb_linearize +- !17785 bpf: fix ktls panic with sockmap +- !17783 net/sched: fix use-after-free in taprio_dev_notifier +- !17781 mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices +- !17782 net/mlx5e: Disable MACsec offload for uplink representor profile +- !17780 RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem +- !17779 RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug +- !17778 phy: tegra: xusb: remove a stray unlock +- !17777 net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled +- !17776 dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn +- !17775 espintcp: fix skb leaks +- !17774 can: bcm: add locking for bcm_op runtime updates +- !17711 net: lan743x: Fix memleak issue when GSO enabled +- !17708 net: phy: Fix CVE-2025-37945 +- !17707 bpf: Scrub packet on bpf_redirect_peer +- !17703 9p/net: fix improper handling of bogus negative read/write replies +- !17699 netfilter: socket: Lookup orig tuple for IPv6 SNAT +- !17685 gtp: Fix CVE-2025-21678 +- !17816 vmci: Prevent the dispatching of uninitialized payloads +- !17824 tracing/probes: Avoid using params uninitialized in parse_btf_arg() +- !17609 cpufreq: Exit governor when failed to start old governor +- Add dynamic wfx trap method for virtCCA CVM. +- !17823 arm64/mpam: Fix the logic that determines whether an MPAM MSC should initialize +- tracing/probes: Avoid using params uninitialized in parse_btf_arg() +- !17821 mm/hugetlb: fix surplus pages in dissolve_free_huge_page() +- arm64/mpam: Fix the logic that determines whether an MPAM MSC should initialize +- mm/hugetlb: fix surplus pages in dissolve_free_huge_page() +- !17818 fix some CVEs +- !17798 benet: fix BUG when creating VFs +- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list +- mm/vmscan: don't try to reclaim hwpoison folio +- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks +- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race +- memblock: Accept allocated memory before use in memblock_double_array() +- KVM: x86: Reset IRTE to host control if *new* route isn't postable +- scsi: mpi3mr: Fix possible crash when setting up bsg fails +- Input: synaptics - use guard notation when pausing serio port +- vmci: Prevent the dispatching of uninitialized payloads +- ext4: fix potential null deref in ext4_mb_init() +- ext4: implement linear-like traversal across order xarrays +- ext4: refactor choose group to scan group +- ext4: open coding repeated check in next_linear_group +- ext4: use correct criteria name instead stale integer number in comment +- ext4: remove unused parameter ngroup in ext4_mb_choose_next_group_*() +- ext4: convert free groups order lists to xarrays +- ext4: factor out ext4_mb_scan_group() +- ext4: factor out ext4_mb_might_prefetch() +- ext4: keep "prefetch_grp" and "nr" consistent +- ext4: remove unused ext4_allocation_context::ac_groups_considered +- ext4: factor out __ext4_mb_scan_group() +- ext4: convert EXT4_B2C(sbi->s_stripe) users to EXT4_NUM_B2C +- ext4: fallback to complex scan if aligned scan doesn't work +- ext4: fix largest free orders lists corruption on mb_optimize_scan switch +- ext4: fix zombie groups in average fragment size lists +- ext4: merge freed extent with existing extents before insertion +- ext4: convert sbi->s_mb_free_pending to atomic_t +- ext4: make running and commit transaction have their own freed_data_list +- ext4: fix typo in CR_GOAL_LEN_SLOW comment +- ext4: get rid of some obsolete EXT4_MB_HINT flags +- ext4: utilize multiple global goals to reduce contention +- ext4: remove unnecessary s_md_lock on update s_mb_last_group +- ext4: remove unnecessary s_mb_last_start +- ext4: separate stream goal hits from s_bal_goals for better tracking +- Revert "ext4: move mb_last_[group|start] to ext4_inode_info" +- ext4: add ext4_try_lock_group() to skip busy groups +- net/mlx5: Check device memory pointer before usage +- !17804 pinmux: fix race causing mux_owner NULL with active mux_usecount +- !17800 gic: increase the arch_timer +- !17794 perf/core: Prevent VMA split of buffer mappings +- !17574 ROH: Add crc_err_cnt and retry_cnt mib statistics +- pinmux: fix race causing mux_owner NULL with active mux_usecount +- !17337 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.64-6.6.66 LTS Conflicts Patches +- !17797 v3 HiSock Redirect Framework +- gic: increase the arch_timer priority to avoid hardlockup +- benet: fix BUG when creating VFs +- !17768 net/oenetcls: introduce oenetcls for network optimization +- ROH: Add crc_err_cnt and retry_cnt mib statistics +- samples/bpf: Add HiSock Redirect sample +- openeuler_defconfig: Enable CONFIG_HISOCK +- bpf: Add bpf_*_change_dev kfunc +- bpf: Add bpf_xdp_set_ingress_dst kfunc +- bpf: Add hisock_xdp_buff wrapper for xdp_buff +- bpf: Add bpf_skops_get_ingress_dst kfunc +- bpf: Enable generic kfuncs for BPF_CGROUP_* programs +- bpf: Add HISOCK_EGRESS hook on network egress path +- bpf: Add BPF_PROG_TYPE_HISOCK prog type +- bpf: Add XDP_HISOCK_REDIRECT action +- bpf: Add CONFIG_HISOCK +- !17470 fix CVE-2025-38351 +- !17766 RDMA/hns: Fix bond not cleared when the configuration becomes invalid +- !17772 two CVE fix +- perf/core: Prevent VMA split of buffer mappings +- !17659 v2 sched: More flexible use of CPU quota when CPU is idle +- !17748 fix bug in hdbss +- page_pool: Fix use-after-free in page_pool_recycle_in_ring +- bpf, sockmap: Avoid using sk_socket after free when sending +- bpf, sockmap: fix duplicated data transmission +- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX +- net: xfrm: Fix kabi breakage of struct xfrm_state +- espintcp: remove encap socket caching to avoid reference leak +- x86/csv: Add function to get free size of CSV3 CMA +- !17294 [OLK-6.6] backport important bugfix for lpfc driver from upstream linux-6.6.y +- !17714 can: bcm: add missing rcu read protection for procfs content +- !17713 net: phy: leds: fix memory leak +- !17717 ipvs: fix uninit-value for saddr in do_output_route4 +- !17706 RDMA/cma: Fix CVE-2025-37772 +- !17709 bnxt_en: Fix CVE-2025-37911 +- !17705 igc: fix PTM cycle trigger logic +- !17718 ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() +- !17701 net: openvswitch: fix nested key length validation in the set() action +- !17702 net: ppp: Add bound checking for skb data on ppp_sync_txmung +- !17704 page_pool: avoid infinite loop to schedule delayed worker +- !17700 wifi: mac80211: Purge vif txq in ieee80211_do_stop() +- !17697 netfilter: nft_tunnel: fix geneve_opt type confusion addition +- !17715 netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets +- !17696 net: decrease cached dst counters in dst_release +- !17695 netfilter: nf_tables: don't unregister hook when table is dormant +- !17694 RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow +- !17693 drm/connector: Fix CVE-2025-22089 +- !17692 vmxnet3: unregister xdp rxq info in the reset path +- !17690 Bluetooth: Fix error code in chan_alloc_skb_cb() +- !17689 tcp: Fix CVE-2025-21864 +- !17741 Fix trace may OOB when trace_get_user failed +- !17742 i2c: qup: jump out of the loop in case of timeout +- !17678 dm cache: prevent BUG_ON by blocking retries on failed device resumes +- !17679 media: cx231xx: set device_caps for 417 +- bpf: fix ktls panic with sockmap +- bpf, sockmap: Fix panic when calling skb_linearize +- net/sched: fix use-after-free in taprio_dev_notifier +- net/mlx5e: Disable MACsec offload for uplink representor profile +- mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices +- RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem +- RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug +- phy: tegra: xusb: remove a stray unlock +- net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled +- dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn +- espintcp: fix skb leaks +- can: bcm: add locking for bcm_op runtime updates +- net: libwx: fix the using of Rx buffer DMA +- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras +- !9218 [OLK-6.6] i2c/zhaoxin: I2C controller driver enhancement and optimization +- !17755 arm64: perf: Add support for HIP12 hw metric +- !17763 mm/smaps: fix race between smaps_hugetlb_range and migration +- net/oenetcls: introduce oenetcls for network optimization +- RDMA/hns: Fix bond not cleared when the configuration becomes invalid +- !17744 trace/fgraph: Fix the warning caused by missing unregister notifier +- mm/smaps: fix race between smaps_hugetlb_range and migration +- fs/proc/task_mmu: convert smaps_hugetlb_range() to work on folios +- !17737 soc cache: Fix incorrect error path of ioctl +- !17660 cgroup/cpuset: Support dynamic affinity feature +- !17293 [OLK-6.6] backport important bugfix for Broadcom BCM57414 nic driver from upstream linux-6.6.y +- i2c: zhaoxin: Add support for Zhaoxin I2C controller +- !17747 fix some CVE +- !17751 iBMA: Fix veth soft lockup by adding DMA-pre-readl sync +- !17730 arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() +- !16545 KVM: arm64: fix memory leak in TLBI +- arm64: perf: Add support for HIP12 hw metric +- iBMA: Fix veth soft lockup by adding DMA-pre-readl sync +- !17716 hrtimers: Update new CPU's next event in hrtimers_cpu_dying() +- !17669 ftrace: Fix potential warning in trace_printk_seq during ftrace_dump +- !17674 ftrace: Also allocate and copy hash for reading of filter files +- !17725 perf/core: Don't leak AUX buffer refcount on allocation failure +- KVM: arm64: fix memory leak in HDBSS +- KVM: arm64: do not support hdbss in nvhe +- usb: xhci: Fix invalid pointer dereference in Etron workaround +- thunderbolt: Do not double dequeue a configuration request +- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap +- mm: memory-failure: update ttu flag inside unmap_poisoned_folio +- Bluetooth: btnxpuart: Fix kernel panic during FW release +- !17592 ice: add NULL check in eswitch lag check +- trace/fgraph: Fix the warning caused by missing unregister notifier +- i2c: qup: jump out of the loop in case of timeout +- tracing: Limit access to parser->buffer when trace_get_user failed +- tracing: Remove unneeded goto out logic +- !17720 crypto: lzo - Fix compression buffer overrun +- !17719 spi: spi-imx: Add check for spi_imx_setupxfer() +- !17687 ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() +- soc cache: Fix incorrect error path of ioctl +- soc cache: Fix incorrect size validation +- soc cache: Enforce maintain type check +- !17683 v2 Fix for bpf samples and selftests +- !17724 mm/dpool: mark dpool hugetlb page as dirty in free_huge_folio() +- !17438 [OLK-6.6]:update patches for sw64 architecture +- !17652 wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request +- !17728 CVE-2025-38006 +- !17677 v2 Fix static check warning reported by coccinelle +- !17633 dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using +- !17455 raid10: cleanup memleak at raid10_make_request +- !17453 md/raid1: Fix stack memory use after return in raid1_reshape +- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al +- arm64/mpam: Add mb_only boot option +- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() +- net: mctp: Don't access ifa_index when missing +- mctp: no longer rely on net->dev_index_head[] +- perf/core: Don't leak AUX buffer refcount on allocation failure +- mm/dpool: mark dpool hugetlb page as dirty in free_huge_folio() +- platform/x86: ISST: Add Clearwater Forest to support list +- cpufreq: intel_pstate: Support Clearwater Forest OOB mode +- cpufreq: intel_pstate: Support Granite Rapids and Sierra Forest OOB mode +- cpufreq: intel_pstate: Support Emerald Rapids OOB mode +- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode +- cpufreq: intel_pstate: Update Balance-performance EPP for Granite Rapids +- !17606 drm/sched: Increment job count before swapping tail spsc queue +- !17671 bpf-rvi: pidns: fix null-pointer-derefence in pidns_update_load_tasks +- crypto: lzo - Fix compression buffer overrun +- spi: spi-imx: Add check for spi_imx_setupxfer() +- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() +- ipvs: fix uninit-value for saddr in do_output_route4 +- hrtimers: Update new CPU's next event in hrtimers_cpu_dying() +- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets +- can: bcm: add missing rcu read protection for procfs content +- net: phy: leds: fix memory leak +- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() +- net: lan743x: Fix memleak issue when GSO enabled +- bnxt_en: Fix out-of-bound memcpy() during ethtool -w +- bnxt_en: Fix coredump logic to free allocated buffer +- genirq/irq_sim: Initialize work context pointers properly +- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY +- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() +- bpf: Scrub packet on bpf_redirect_peer +- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work +- RDMA/cma: Fix workqueue crash in cma_netevent_work_handler +- igc: fix PTM cycle trigger logic +- page_pool: avoid infinite loop to schedule delayed worker +- 9p/net: fix improper handling of bogus negative read/write replies +- net: ppp: Add bound checking for skb data on ppp_sync_txmung +- net: openvswitch: fix nested key length validation in the set() action +- wifi: mac80211: Purge vif txq in ieee80211_do_stop() +- netfilter: socket: Lookup orig tuple for IPv6 SNAT +- netfilter: nft_tunnel: fix geneve_opt type confusion addition +- net: decrease cached dst counters in dst_release +- !17632 perf/core: Exit early on perf_mmap() fail +- netfilter: nf_tables: don't unregister hook when table is dormant +- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow +- drm/connector: fix kabi broken in struct ib_device +- RDMA/core: Don't expose hw_counters outside of init net namespace +- vmxnet3: unregister xdp rxq info in the reset path +- Bluetooth: Fix error code in chan_alloc_skb_cb() +- net: use __GENKSYMS__ to revert the kabi change +- tcp: drop secpath at the same time as we currently drop dst +- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() +- gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). +- gtp: Destroy device along with udp socket's netns dismantle. +- samples/bpf: Move bpf_rvi_* progs to bpf_rvi directory +- selftests/bpf: fix perf_event link info name_len assertion +- Revert "selftests/bpf: Use bpf_link__destroy in fill_link_info tests" +- Revert "selftests/bpf: Add cookies check for perf_event fill_link_info test" +- Revert "selftests/bpf: fix perf_event link info name_len assertion" +- !17650 net: phy: motorcomm: Add support for PHY LEDs on YT8521 +- !17634 HID: pidff: Fix null pointer dereference in pidff_find_fields +- media: cx231xx: set device_caps for 417 +- dm cache: prevent BUG_ON by blocking retries on failed device resumes +- ACPI / MPAM: Fix wrong IS_ERR() check in _parse_table() +- hiroce3: Use IS_ERR() to check the return value of kthread_run() +- ftrace: Also allocate and copy hash for reading of filter files +- bpf-rvi: pidns: fix null-pointer-derefence in pidns_update_load_tasks +- !17642 tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer +- !17641 net: clear the dst when changing skb protocol +- !17653 wifi: iwlwifi: fix debug actions order +- !17651 wifi: mt76: disable napi on driver removal +- !17647 CVE-2025-38052 +- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump +- cgroup/cpuset: Support dynamic affinity feature +- sched: More flexible use of CPU quota when CPU is idle +- !17646 sunrpc: handle SVC_GARBAGE during svc auth processing as auth error +- !17648 CVE-2025-37920 +- !17643 net: Fix TOCTOU issue in sk_is_readable() +- !17644 bridge: mcast: Fix use-after-free during router port configuration +- !17645 CVE-2025-38465 +- !17600 two bugfix for arm64 support HVO +- !17649 Fix CVE-2025-21839 +- !17628 Fix CVE-2025-37780 +- !17629 Fix CVE-2025-37767 +- !17637 netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() +- !17638 tcp: Correct signedness in skb remaining space calculation +- !17639 tipc: Fix use-after-free in tipc_conn_close(). +- !17640 seg6: Fix validation of nexthop addresses +- wifi: iwlwifi: fix debug actions order +- wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request +- wifi: mt76: disable napi on driver removal +- net: phy: motorcomm: Add support for PHY LEDs on YT8521 +- !17608 mm/util: make memdup_user_nul() similar to memdup_user() +- net: hns3: change the function return type from int to bool +- KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop +- xsk: Fix kabi broken +- xsk: Fix race condition in AF_XDP generic RX path +- net: tipc: fix refcount warning in tipc_aead_encrypt +- net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done +- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error +- netlink: avoid infinite retry looping in netlink_unicast() +- netlink: make sure we allow at least one dump skb +- netlink: Fix rmem check in netlink_broadcast_deliver(). +- netlink: Fix wraparounds of sk->sk_rmem_alloc. +- bridge: mcast: Fix use-after-free during router port configuration +- net: Fix TOCTOU issue in sk_is_readable() +- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer +- net: clear the dst when changing skb protocol +- seg6: Fix validation of nexthop addresses +- tipc: Fix use-after-free in tipc_conn_close(). +- tcp: Correct signedness in skb remaining space calculation +- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() +- mm: fix the race between collapse and PT_RECLAIM under per-vma lock +- HID: pidff: Fix null pointer dereference in pidff_find_fields +- mm: madvise: use per_vma lock for MADV_FREE +- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using +- !17597 Delete PHYTIUM_CPU_PART_FTC862 macro +- perf/core: Exit early on perf_mmap() fail +- mm: use per_vma lock for MADV_DONTNEED +- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero +- isofs: Prevent the use of too small fid +- mm: madvise: use walk_page_range_vma() instead of walk_page_range() +- cpufreq: Exit governor when failed to start old governor +- cpufreq: Move the check of cpufreq_driver->get into cpufreq_verify_current_freq() +- cpufreq: Init policy->rwsem before it may be possibly used +- cpufreq: Initialize cpufreq-based frequency-invariance later +- cpufreq: Hold cpufreq_driver_lock when assigning cpufreq_driver->set_boost +- cpufreq: Remove duplicate check in __cpufreq_offline() +- cpufreq: Contain scaling_cur_freq.attr in cpufreq_attrs +- cpufreq: CPPC: Remove forward declaration of cppc_cpufreq_register_em() +- cpufreq: CPPC: Do not return a value from populate_efficiency_class() +- cpufreq: CPPC: Remove cpu_data_list +- cpufreq: CPPC: Remove forward declaration of hisi_cppc_cpufreq_get_rate() +- !17307 scsi: megaraid_sas: Fix invalid node index +- !17309 irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() +- mm/util: make memdup_user_nul() similar to memdup_user() +- drm/sched: Increment job count before swapping tail spsc queue +- !17575 net/sched: Fix CVE-2025-37890 +- cpufreq: cppc: Fix invalid return value in hisi_cppc_cpufreq_get_rate() +- cpufreq: cppc: Fix invalid return value in .get() callback +- drm/phytium: Fix Phytium DRM build fail +- arm64: mm: HVO: fix deadlock in split vmemmap pmd +- mm: HVO: fix hard lockup in split_vmemmap_huge_pmd under x86 +- cputype: phytium: Delete PHYTIUM_CPU_PART_FTC862 macro +- ice: add NULL check in eswitch lag check +- i2c: tegra: check msg length in SMBUS block read +- drm/msm: Fix another leak in the submit error path +- wifi: ath6kl: remove WARN on bad firmware input +- !16528 [OLK-6.6] dma: phytium: Add PSWIOTLB mechanism to improve DMA performance +- !17570 tracing: Add down_write(trace_event_sem) when adding trace event +- !17565 Enhance soft hwpoison handling and injection +- net/sched: ets: use old 'nbands' while purging unused classes +- net/sched: Always pass notifications when child class becomes empty +- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice +- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() +- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc +- !17569 drm/vkms: Fix use after free and double free on init error +- tracing: Add down_write(trace_event_sem) when adding trace event +- drm/vkms: Fix use after free and double free on init error +- !17564 bpf: Reject %p% format string in bprintf-like helpers +- !17510 PM / devfreq: Add HiSilicon uncore frequency scaling driver +- !17547 net_sched: drr: Fix double list add in class with netem as child qdisc +- !17556 filemap: move prefaulting out of hot write path +- mm/memory-failure: send SIGBUS in the event of thp split fail +- mm/memory-failure: move hwpoison_filter() higher up +- mm/memory-failure: improve memory failure action_result messages +- mm/madvise: add MF_ACTION_REQUIRED to madvise(MADV_HWPOISON) +- mm/memory-failure: try to send SIGBUS even if unmap failed +- PM / devfreq: Add HiSilicon uncore frequency scaling driver +- !17529 mm: optimize mremap() by PTE batching +- !17481 HID: core: fix __hid_request when no report ID is used +- bpf: Reject %p% format string in bprintf-like helpers +- crypto: iaa - Remove potential infinite loop in check_completion() +- !17495 v2 mm/mem_sampling: preserve kernel subsystem SPE state across perf sampling +- !17546 net_sched: qfq: Fix double list add in class with netem as child qdisc +- !17542 net: sch: Fix CVE-2025-37798 +- !17538 wifi: at76c50x: fix use after free access in at76_disconnect +- !17537 net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime +- !17553 RDMA/hns: Fix dip entries leak on devices newer than hip09 +- filemap: move prefaulting out of hot write path +- RDMA/hns: Fix dip entries leak on devices newer than hip09 +- RDMA/hns: Fix querying wrong SCC context for DIP algorithm +- !17479 fix some bugs of enfs +- !17530 sched/psi: change permissions of /proc/pressure/stat +- net_sched: drr: Fix double list add in class with netem as child qdisc +- net_sched: qfq: Fix double list add in class with netem as child qdisc +- mm/mremap: avoid expensive folio lookup on mremap folio pte batch +- codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() +- sch_htb: make htb_deactivate() idempotent +- sch_htb: make htb_qlen_notify() idempotent +- sch_drr: make drr_qlen_notify() idempotent +- sch_hfsc: make hfsc_qlen_notify() idempotent +- sch_qfq: make qfq_qlen_notify() idempotent +- sch_ets: make est_qlen_notify() idempotent +- wifi: at76c50x: fix use after free access in at76_disconnect +- net: vlan: Fix kabi breakage of struct vlan_info +- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime +- sched/psi: change permissions of /proc/pressure/stat +- mm: optimize mremap() by PTE batching +- !17526 v7 High Performance Container Resource View Isolation -- Stage 2 +- !17515 gpiolib: Get rid of never false gpio_is_valid() calls +- mm: call pointers to ptes as ptep +- !17519 CVE-2025-38473 +- !17524 CVE-2025-38375 +- !17517 CVE-2025-38251 +- !17523 CVE-2025-38211 +- samples/bpf: Add iterator program for meminfo +- bpf-rvi: Add bpf_x86_direct_pages kfunc +- bpf-rvi: Add bpf_mem_vmalloc_{used,total} kfunc +- bpf-rvi: Add bpf_mem_commit_limit & bpf_mem_committed kfunc +- bpf-rvi: Add bpf_mem_percpu kfunc +- bpf-rvi: Add bpf_mem_failure kfunc +- bpf-rvi: Add bpf_hugetlb_report_meminfo kfunc +- bpf-rvi: Add bpf_mem_{total,free}cma kfunc +- bpf-rvi: Add bpf_mem_{file_{hugepage,pmdmapped},kreclaimable} kfunc +- samples/bpf: Add iterator program for stat +- bpf-rvi: stat: Add stat iterator target +- bpf-rvi: Add kstat_ & kcpustat_ kfuncs +- bpf-rvi: Add cpu runqueue related kfuncs +- bpf-rvi: Add stat-related misc kfuncs +- bpf-rvi: Add bpf_seq_file_append() kfunc +- samples/bpf: Add iterator program for swaps +- bpf-rvi: Add bpf_page_counter_read() kfunc +- bpf-rvi: Add bpf_si_memswinfo() kfunc +- samples/bpf: Add iterator program for uptime +- bpf-rvi: cpuacct: Add bpf_task_ca_cpuusage() kfunc +- samples/bpf: Add iterator program for loadavg +- bpf-rvi: pidns: Add for_each_task_in_pidns and loadavg-related kfuncs +- bpf-rvi: pidns: Calculate loadavg for each pid namespace +- samples/bpf: Add iterator program for partitions +- bpf-rvi: block: Look up /dev in reaper's fs->root and filter partitions +- bpf-rvi: block: Add partitions iterator target +- samples/bpf: Add iterator program for diskstats +- bpf-rvi: blk-cgroup: Add bpf_blkcg_get_dev_iostat() kfunc +- bpf-rvi: block: Add diskstats iterator target +- samples/bpf: Add iterator program for cpuinfo_arm64 +- bpf-rvi: arm64: Add bpf_arch_flags kunc for arm64 +- bpf-rvi: arm64: Add cpuinfo_arm64 iterator target +- bpf-rvi: arm64: Add bpf_arm64_cpu_have_feature() kfunc +- bpf-rvi: cpuacct: Add task_cpuacct() +- bpf-rvi: cpuacct: Add bpf_cpuacct_kcpustat_cpu_fetch kfunc +- bpf-rvi: proc: add bpf_get_{idle,iowait}_time kfunc +- bpf-rvi: cgroup: Add cgroup_rstat_flush_atomic() kfunc +- bpf-rvi: Add bpf_mem_cgroup_from_task() kfunc +- bpf-rvi: cpuset: Fix missing of return for !tsk in task_effective_cpumask() +- virtio-net: ensure the received length does not exceed allocated size +- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction +- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() +- nfs/enfs: make some functions static in enfs_multipath_client.c +- nfs/enfs: remove enfs_init() and enfs_fini() +- nfs/enfs: format get_ip_to_str() in shard_route.c +- nfs/enfs: unlock uniformly at the end of function in shard_route.c +- nfs/enfs: support debugging ip and dns list +- nfs/enfs: fix error when showing dns list +- nfs/enfs: fix alignment between struct rpc_clnt and rpc_clnt_reserve +- nfs/enfs: set CONFIG_SUNRPC_ENFS=y by default +- nfs/enfs: fix memory leak of shard_view_ctrl when removing nfs module +- atm: clip: prevent NULL deref in clip_push() +- !17513 sched-ebpf-add-for-exec-init +- gpiolib: Get rid of never false gpio_is_valid() calls +- !17487 arm64/mpam: Support partial-core boot for MPAM +- !16844 LeapIOraid: add device and support fw log +- sched/bpf: Fix kabi breakage for including sched bpf header file +- sched/ebpf: Add kfunc to set the preferred NUMA node for the task +- sched/ebpf: Add bpf_sched_cfs_exec_set_cpumask hook +- !17512 CVE-2025-21868 +- !17498 sched: Support NUMA parallel scheduling for multiple processes +- !17508 Huawei iBMA: Added support for Hi1712 Chip +- hv_netvsc: Preserve contiguous PFN grouping in the page buffer array +- net: use __GENKSYMS__ to revert the kabi change +- net: allow small head cache usage with large MAX_SKB_FRAGS values +- Revert "PM / devfreq: Add HiSilicon uncore frequency scaling driver" +- Huawei iBMA: Added support for Hi1712 Chip +- !17501 net: hibmcge: fix rtnl deadlock issue +- net: hibmcge: fix rtnl deadlock issue +- net: hibmcge: fix the division by zero issue +- net: hibmcge: fix the np_link_fail error reporting issue +- !17459 ROH: fix variable type inconsistency issue +- sched: Support NUMA parallel scheduling for multiple processes +- !17183 rtnetlink: Allocate vfinfo size for VF GUIDs when supported +- !17180 atm: Fix NULL pointer dereference +- !16807 Support RME feature for CCA host +- mm/mem_sampling: preserve kernel subsystem SPE state across perf sampling +- !17488 arm64/mpam: Set 1 as the minimum setting value for CMAX +- arm64/mpam: Set 1 as the minimum setting value for CMAX +- arm64/mpam: Support partial-core boot for MPAM +- HID: core: do not bypass hid_hw_raw_request +- HID: core: ensure __hid_request reserves the report ID as the first byte +- HID: core: ensure the allocated report buffer can contain the reserved report ID +- !17440 sdei_watchdog: use lockup_detector_retry_init() to init sdei watchdog +- VirtCCA: Compatible with virtcca macro definitions +- CCA: Fix cca kabi conflict +- VirtCCA: Modify openeuler_defconfig +- Reapply "VirtCCA: cvm support UEFI boot" +- VirtCCA: Adapt virtcca operations by cca_base. +- VirtCCA: Adapt realm operations by cca_base. +- VirtCCA: Add CCA base operations. +- [v8-43-43]KVM: arm64: Allow activating realms +- [v8-42-43]KVM: arm64: Expose KVM_ARM_VCPU_REC to user space +- [v8-40-43]arm64: RME: Provide accurate register list +- [v8-39-43]arm64: RME: Provide register list for unfinalized RME RECs +- [v8-38-43]rm64: RME: Configure max SVE vector length for a Realm +- [v8-37-43]arm64: RME: Propagate max SVE vector length from RMM +- [v8-36-43]arm64: RME: Initialize PMCR.N with number counter supported by RMM +- [v8-35-43]arm64: RME: Set breakpoint parameters through SET_ONE_REG +- [v8-34-43]arm64: RME: Propagate number of breakpoints and watchpoints to userspace +- [v8-33-43]arm64: RME: Hide KVM_CAP_READONLY_MEM for realm guests +- [v8-32-43]arm64: rme: Enable PMU support with a realm guest +- [backport]KVM: arm64: PMU: Introduce helpers to set the guest's PMU +- [backport]KVM: arm64: PMU: Allow userspace to limit PMCR_EL0.N for the guest +- !17463 crypto: hisilicon/qm - clear the memory before enabling the device +- sw64: ptrace: return -EIO in invalid PEEKUSR/POKEUSR requests +- sw64: kvm: fix missing kvm_unregister_perf_callbacks +- sw64: kvm: fix compile error of kvm.ko +- sw64: kvm: remove the duplicated Kconfig selection of KVM +- sw64: cpuidle: add dedicated driver +- sw64: fix missing characters for sw64_rrk +- sw64: selftests/net: add sw64 support for io_uring_zerocopy_tx +- sw64: crypto: implement crc32 assembly optimization +- sw64: efi: remove meaningless code from asm/efi.h +- sw64: fix incorrect macro definitions for sw64 in bpf_tracing.h +- sw64: cpufreq: using PLL0 to provide clock for idle cores +- sw64: kvm: save the virtual address of irqs_pending in vcpucb +- sw64: kvm: fix undefined error with ftrace disabled +- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush +- KVM: x86: model canonical checks more precisely +- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks +- KVM: x86: Route non-canonical checks in emulator through emulate_ops +- KVM: x86: drop x86.h include from cpuid.h +- KVM: x86: Bury guest_cpuid_is_amd_or_hygon() in cpuid.c +- KVM: SVM: Emulate SYSENTER RIP/RSP behavior for all Intel compat vCPUs +- KVM: x86: Inhibit code #DBs in MOV-SS shadow for all Intel compat vCPUs +- KVM: x86: Apply Intel's TSC_AUX reserved-bit behavior to Intel compat vCPUs +- KVM: x86/pmu: Squash period for checkpointed events based on host HLE/RTM +- [backport]KVM: arm64: PMU: Set PMCR_EL0.N for vCPU based on the associated PMU +- [v8-31-43]arm_pmu: Provide a mechanism for disabling the physical IRQ +- [v8-30-43]arm64: RME: Prevent Device mappings for Realms +- [v8-29-43]arm64: RME: Always use 4k pages for realms +- [v8-28-43]arm64: RME: Allow checking SVE on VM instance +- [v8-27-43]arm64: RME: support RSI_HOST_CALL +- [v8-26-43]arm64: RME: allow userspace to inject aborts +- [v8-25-43]arm64: Don't expose stolen time for realm guests +- [v8-24-43]KVM: arm64: WARN on injected undef exceptions +- [v8-23-43]KVM: arm64: Handle Realm PSCI requests +- [v8-22-43]KVM: arm64: Validate register access for a Realm VM +- [v8-21-43]KVM: arm64: Handle realm VCPU load +- [v8-20-43]arm64: RME: Runtime faulting of memory +- [backport]KVM: arm64: Move pagetable definitions to common header +- [backport]rme: populate guest memory region without guest_memfd +- [v8-19-43]arm64: RME: Allow populating initial contents +- [v8-18-43]KVM: arm64: Handle realm MMIO emulation +- [v8-17-43]arm64: RME: Handle RMI_EXIT_RIPAS_CHANGE +- [v8-16-43]arm64: RME: Handle realm enter/exit +- [v8-15-43]arm64: RME: Allow VMM to set RIPAS +- [backport]KVM: Add member to struct kvm_gfn_range to indicate private/shared +- [v8-14-43]KVM: arm64: Support timers in realm RECs +- [v8-13-43]arm64: RME: Support for the VGIC in realms +- [backport]KVM: arm64: Force GICv3 trap activation when no irqchip is configured on VHE +- [v8-12-43]KVM: arm64: vgic: Provide helper for number of list registers +- [v8-11-43]arm64: RME: Allocate/free RECs to match vCPUs +- [backport]KVM: arm64: Add generic check for system-supported vCPU features +- !17467 arm-smmu-v3: adjust ecmdq log level +- KVM: x86: Advertise AVX10.1 CPUID to userspace +- arm-smmu-v3: adjust ecmdq log level +- crypto: hisilicon/qm - clear the memory before enabling the device +- [v8-10-43]arm64: RME: RTT tear down +- [v8-09-43]KVM: arm64: Allow passing machine type in KVM creation +- [v8-08-43]kvm: arm64: Don't expose debug capabilities for realm guests +- [v8-07-43]arm64: RME: ioctls to create and configure realms +- [v8-06-43]arm64: RME: Define the user ABI +- [v8-05-43]arm64: RME: Check for RME support at KVM init +- [v8-04-43]arm64: RME: Add wrappers for RMI calls +- [v8-03-43]arm64: RME: Add SMC definitions for calling the RMM +- [v8-02-43]arm64: RME: Handle Granule Protection Faults (GPFs) +- [v8-01-43]kvm: arm64: Include kvm_emulate.h in kvm/arm_psci.h +- Revert "kvm: add virtcca cvm host feature" +- Revert "VirtCCA: cvm support UEFI boot" +- Revert "pmu: enable pmu phys irq inject for cvm" +- !16720 [OLK-6.6] Not print information of SMMU 0x10 event and add phytium PS24080 SoC platform judgement +- !17458 v2 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() +- ROH: fix variable type inconsistency issue +- !17441 net: hibmcge: support for statistics of reset failures +- !17435 arm64/mm: Optimize loop to reduce redundant operations of contpte_ptep_get +- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() +- raid10: cleanup memleak at raid10_make_request +- md/raid1: Fix stack memory use after return in raid1_reshape +- !17385 mptcp: pm: only set fullmesh for subflow endp +- !17445 xdp: Reset bpf_redirect_info before running a xdp's BPF prog. +- !17444 Backport mainline patch +- !17395 Squashfs: check return result of sb_min_blocksize +- xdp: Reset bpf_redirect_info before running a xdp's BPF prog. +- bonding: check xdp prog when set bond mode +- bonding: return detailed error when loading native XDP fails +- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() +- net: hibmcge: support for statistics of reset failures +- sw64: kvm: enable dirty log gradually in small chunks for core4 +- sw64: fix guest kdump function +- sw64: ftrace: add HAVE_DYNAMIC_FTRACE_WITH_ARGS support +- sw64: use wait/complete for smp boot +- sw64: fix sw64_rrk_store() wrap handling +- sdei_watchdog: use lockup_detector_retry_init() to init sdei watchdog +- !17436 i2c/designware: Fix an initialization issue +- !17432 ACPICA: Refuse to evaluate a method if arguments are missing +- !17421 ACPICA: fix acpi operand cache leak in dswstate.c +- !17422 soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() +- !17423 net: stmmac: make sure that ptp_rate is not 0 before configuring EST +- !17301 fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() +- !17304 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request +- !17331 dm-bufio: fix sched in atomic context +- !17413 CVE-2025-37957 +- !17412 v3 livepatch: support for super-long symbol repositioning +- !16933 virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN +- !16932 dm: fix unconditional IO throttle caused by REQ_PREFLUSH +- !17430 drm/v3d: Disable interrupts before resetting the GPU +- i2c/designware: Fix an initialization issue +- !17254 irqchip/gic-v3-its: Remove DevID Pool's restriction +- !17406 usb: net: sierra: check for no status endpoint +- arm64/mm: Optimize loop to reduce redundant operations of contpte_ptep_get +- ACPICA: Refuse to evaluate a method if arguments are missing +- drm/v3d: Disable interrupts before resetting the GPU +- !17393 selftests/tracing: Fix false failure of subsystem event test +- net: stmmac: make sure that ptp_rate is not 0 before configuring EST +- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() +- ACPICA: fix acpi operand cache leak in dswstate.c +- KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception +- KVM: SVM: Update SEV-ES shutdown intercepts with more metadata +- livepatch: support for super-long symbol repositioning +- usb: net: sierra: check for no status endpoint +- !17380 bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT +- mptcp: pm: only set fullmesh for subflow endp +- !17115 xfs: fix attr inactive issue +- Squashfs: check return result of sb_min_blocksize +- selftests/tracing: Fix false failure of subsystem event test +- !17390 ipvlan: Fix out-of-bound bugs in ipvlan_xmit_mode_l2e() +- !17387 ipvlan: ensure network headers are in skb linear part +- ipvlan: Fix out-of-bound bugs in ipvlan_xmit_mode_l2e() +- !17205 fix some panic bugs and memory leak bugs of enfs +- ipvlan: ensure network headers are in skb linear part +- !17271 LoongArch: KVM: Solve the problem of starting up the upstream qemu +- !17251 migration: update status after RAS error +- !17278 nvme: update firmware version after commit +- !17330 livepatch: fix insn length check +- irqchip/gic-v3-its: Remove DevID Pool's restriction +- !17372 drm/amd/display: Add null pointer check for get_first_active_display() +- !17349 bnxt: properly flush XDP redirect lists +- !17375 RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert +- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT +- !17367 fd/proc: modify xcall proc file permissions to 640 +- !17346 calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). +- !17222 fs: Add additional checks for block devices during mount +- !17168 xfrm: state: fix out-of-bounds read during lookup +- RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert +- !17141 CVE-2025-37992：net_sched: Flush gso_skb list too during ->change() +- !17364 net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect +- !17167 eth: bnxt: always recalculate features after XDP clearing, fix null-deref +- !17371 ext4: inline: fix len overflow in ext4_prepare_inline_data +- !17362 ucounts: fix mq_perf test error. +- drm/amd/display: Add null pointer check for get_first_active_display() +- ext4: inline: fix len overflow in ext4_prepare_inline_data +- fd/proc: modify xcall proc file permissions to 640 +- !17361 scsi: lpfc: Use memcpy() for BIOS version +- !17360 net: Fix CVE-2025-21884 +- !17356 serial: jsm: fix NPE during jsm_uart_port_init +- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect +- ucounts: fix mq_perf test error. +- scsi: lpfc: Use memcpy() for BIOS version +- net: better track kernel sockets lifetime +- net: Add net_passive_inc() and net_passive_dec(). +- !17269 MPTCP UPTREAM PART26 +- !17358 serial: mctrl_gpio: split disable_ms into sync and no_sync APIs +- !17322 Fix CVE-2025-38424 +- serial: mctrl_gpio: split disable_ms into sync and no_sync APIs +- !17342 tls: always refresh the queue when reading sock +- !17343 Fix WARN in perf_cgroup_switch() +- !17080 serial: Fix potential null-ptr-deref in mlb_usio_probe() +- !17351 mm/dynamic_pool: Fix free_huge_pages undefflow problem +- !17319 mm/dpool: do not use uninitialized variable +- serial: jsm: fix NPE during jsm_uart_port_init +- nfs/enfs: remove unnecessary shard_should_stop in shard_route.c +- mm/dynamic_pool: Fix free_huge_pages undefflow problem +- !17345 net: hns3: use seq_file for files in tx_bd_info/ and rx_bd_info/ in debugfs +- bnxt: properly flush XDP redirect lists +- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). +- net: hns3: use seq_file for files in tx_bd_info/ and rx_bd_info/ in debugfs +- net: hns3: use seq_file for files in common/ of hclge layer +- net: hns3: use seq_file for files in fd/ in debugfs +- !17328 perf: Revert to requiring CAP_SYS_ADMIN for uprobes +- perf/core: Fix the WARN_ON_ONCE is out of lock protected region +- perf/core: Fix WARN in perf_cgroup_switch() +- !17324 video: screen_info: Relocate framebuffers behind PCI bridges +- tls: always refresh the queue when reading sock +- !17341 v7 arm64: Add hardware xcall framework support +- !17336 fs/resctrl: Enqueue mon_event_count() forcefully for MPAM +- !17308 arm64: Fix guest app segment fault when disable_sdei_nmi_watchdog +- nvme-host: fix the updating of the firmware version +- nvme: update firmware version after commit +- arm64: Add hardware xcall framework support +- arm64: Reserve a kabi in task_struct exclusively for xcall +- arm64: Refactor the xcall proc code +- !17259 mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). +- !17335 ROH: fix security issues and eliminate redundancies +- ROH: fix security issues and eliminate redundancies +- ALSA: hda: Fix build error without CONFIG_SND_DEBUG +- ALSA: hda/conexant: Use the new codec SSID matching +- ALSA: hda: Use own quirk lookup helper +- arm64/mpam: Ensure the err variable is initialized +- fs/resctrl: Enqueue mon_event_count() forcefully for MPAM +- net: hns3: use seq_file for files in reg/ in debugfs +- net: hns3: use seq_file for files in mac_list/ in debugfs +- net: hns3: use seq_file for files in tm/ in debugfs +- net: hns3: use seq_file for files in common/ of hns3 layer +- net: hns3: use seq_file for files in queue/ in debugfs +- net: hns3: clean up the build warning in debugfs by use seq file +- net: hns3: remove tx spare info from debugfs. +- net: hns3: use string choices helper +- dm-bufio: fix sched in atomic context +- livepatch: fix insn length check +- perf: Revert to requiring CAP_SYS_ADMIN for uprobes +- video: screen_info: Relocate framebuffers behind PCI bridges +- LoongArch: KVM: Enhance the robustness of extioi +- perf/core: Fix WARN in perf_sigtrap() +- perf: Fix sample vs do_exit() +- !17261 Fixed the wrong debugfs node name in hisi_spi debugfs initialization +- mm/dpool: do not use uninitialized variable +- !17296 nvmet-tcp: don't restore null sk_state_change +- !17299 dmaengine: idxd: fix memory leak in error handling path of idxd_alloc +- !17310 usb: typec: altmodes/displayport: do not index invalid pin_assignments +- usb: typec: altmodes/displayport: do not index invalid pin_assignments +- mptcp: sysctl: blackhole timeout: avoid using current->nsproxy +- mptcp: blackhole only if 1st SYN retrans w/o MPC is accepted +- doc: mptcp: sysctl: blackhole_timeout is per-netns +- mptcp: sysctl: avail sched: remove write access +- !17305 CVE-2025-38264 +- !17303 sched/fair: Only increment deadline once on yield +- mptcp: remove unneeded lock when listing scheds +- nfs/enfs: remove enfs_uuid_debug in shard_route.c +- nfs/enfs: remove usage of list_entry_is_head() in shard_route.c +- sunrpc: remove redundant rpc_task_release_xprt() of enfs +- nfs/enfs: remove judgement about enfs_option in nfs_multipath_client_info_init() +- nfs/enfs: remove nfs_multipath_client_info_free_work() +- nfs/enfs: fix typos in shard_route.c +- nfs/enfs: remove unused functions in shard_route.c +- nfs/enfs: make some functions static in shard_route.c +- nfs/enfs: introduce DEFINE_PARSE_FH_FUNC to define parse_fh() +- nfs/enfs: fix memory leak when free view_table +- nfs/enfs: use DEFINE_CLEAR_LIST_FUNC to define enfs_clear_shard_view() +- nfs/enfs: introduce DEFINE_CLEAR_LIST_FUNC to define enfs_clear_fs_info() +- nfs/enfs: fix memory leak in enfs_delete_fs_info() +- nfs/enfs: fix double free of multipath_client_info +- nfs/enfs: fix null-ptr-deref in shard_update_work() +- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() +- !17266 unify log function usage of enfs +- arm64: Fix guest app segment fault when disable_sdei_nmi_watchdog +- scsi: megaraid_sas: Fix invalid node index +- nvme-tcp: sanitize request list handling +- llist: add interface to check if a node is on a list. +- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request +- !17255 inspector: hold module refcnt when cpu inspector is running +- !17291 libbpf: Fix null pointer dereference in btf_dump__free on allocation failure +- sched/fair: Only increment deadline once on yield +- nfs/enfs: use enfs_log_error() instead of pr_err() in enfs +- nfs/enfs: use enfs_log_info() instead of pr_info() in enfs +- nfs/enfs: cleanups in enfs/shard_route.c +- nfs/enfs: use enfs_log_debug() instead of pr_debug() to debug enfs +- nfs/enfs: remove unused code in enfs/dns_internal.h +- nfs/enfs: use enfs_log_debug() instead of dfprintk() to debug enfs +- nfs: use dfprintk() to debug enfs +- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() +- !17262 v2 ifs: Defer cgroup ifs enable +- !17287 i40e: fix MMIO write access to an invalid page in i40e_clear_hw +- dmaengine: idxd: fix memory leak in error handling path of idxd_alloc +- nvmet-tcp: don't restore null sk_state_change +- scsi: lpfc: Use memcpy() for BIOS version +- bnxt: properly flush XDP redirect lists +- LoongArch: KVM: Solve the problem of starting up the upstream qemu +- drivers/iommu: Fix the initialization failure issue of the iommu module +- LoongArch: KVM: Fix the extioi simulation error +- dma: phyitum: enable CONFIG_PHYTIUM_ERRATUM_FT3386 +- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure +- dma: Fix kabi breakage due to "dma: pswiotlb: Move platform-identification to cpu errata" +- !17275 fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass +- i40e: fix MMIO write access to an invalid page in i40e_clear_hw +- !17273 atm: Revert atm_account_tx() if copy_from_iter_full() fails. +- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass +- atm: Revert atm_account_tx() if copy_from_iter_full() fails. +- netlink: specs: mptcp: fix port endianness +- mptcp: disable active MPTCP in case of blackhole +- mptcp: include inet_common in mib.h +- mptcp: move mptcp_pm_gen.h's include +- mptcp: remove unnecessary else statements +- mptcp: prefer strscpy over strcpy +- mptcp: add net.mptcp.available_schedulers +- mptcp: sockopt: info: stop early if no buffer +- mptcp: fallback to TCP after SYN+MPC drops +- mptcp: export mptcp_subflow_early_fallback() +- selftests: mptcp: connect: remove duplicated spaces in TAP output +- selftests: mptcp: diag: remove trailing whitespace +- selftests: mptcp: test last time mptcp_info +- mptcp: add last time fields in mptcp_info +- selftests: mptcp: reset the last TS before the first test +- selftests: mptcp: netlink: drop disable=SC2086 +- selftests: mptcp: ip_mptcp option for more scripts +- selftests: mptcp: use pm_nl endpoint ops +- selftests: mptcp: export pm_nl endpoint ops +- selftests: mptcp: join: update endpoint ops +- selftests: mptcp: netlink: add change_address helper +- selftests: mptcp: add {get,format}_endpoint(s) helpers +- selftests: mptcp: netlink: add 'limits' helpers +- selftests: mptcp: add tc check for check_tools +- selftests: mptcp: connect: remote time in TAP output +- selftests: mptcp: lib: add time per subtests in TAP output +- !17246 MPTCP UPTREAM PART25 +- ifs: Defer cgroup ifs enable +- Fixed the wrong debugfs node name in hisi_spi debugfs initialization +- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). +- inspector: hold module refcnt when cpu inspector is running +- selftests: mptcp: join: validate event numbers(part 2) +- selftests: mptcp: pm_nl_ctl: remove re-definition +- selftests: mptcp: join: simplify checksum_tests +- selftests: mptcp: join: mute errors when ran in the background +- selftests: mptcp: join: specify host being checked +- selftests: mptcp: join: more explicit check name +- selftests: mptcp: join: validate MPJ SYN TX MIB counters +- selftests: mptcp: join: one line for join check +- selftests: mptcp: join: reduce join_nr params +- mptcp: MIB counters for sent MP_JOIN +- mptcp: pm: reduce entries iterations on connect +- mptcp: pm: fix backup support in signal endpoints +- mptcp: pm: rename helpers linked to 'flush' +- mptcp: Remove unused declaration mptcp_sockopt_sync() +- !17250 arm64/mpam: Fix incorrect CPU-to-partid binding under CDP mode +- !17253 mm: fix uprobe pte be overwritten when expanding vma +- !16602 【OLK-6.6】修复虚拟机下使用海光TKM功能可能返回TKM_UNSUPPORTED_CMD错误 +- !16797 【OLK-6.6】修复psp_mutex_lock_timeout超时触发soft lockup警告的问题 +- mm: fix uprobe pte be overwritten when expanding vma +- arm64/mpam: Fix incorrect CPU-to-partid binding under CDP mode +- arm64/mpam: Fix typo in resctrl_arch_set_cdp_enabled() +- migration: update status after RAS error +- Revert "migration: update status after RAS error" +- !17076 smb: client: fix use-after-free in crypt_message when using async crypto +- !17102 smb: client: fix use-after-free in cifs_oplock_break +- smb: client: fix netns refcount leak after net_passive changes +- Revert "smb: client: fix TCP timers deadlock after rmmod" +- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" +- !17240 some fix for spe hotcold +- !17159 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.72-6.6.75 LTS Conflicts Patches +- !17206 driver core: Use kasprintf() instead of fixed buffer formatting +- mm_monitor/mm_spe: Embed boost events within SPE packets +- mm_monitor/mm_spe: Fix SPE boost enablement and continuation handling +- !17161 olk-6.6-backport-bugfix-for-dynamic-affinity +- !17150 HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() +- !17153 f2fs: prevent kernel warning due to negative i_nlink from corrupted image +- !17154 media: vivid: Change the siize of the composing +- !17238 v2 net: Fix kabi breakage for defer_free_list in struct net +- !17237 RDMA/hns: Fix HW configurations not cleared in error flow +- net: Fix kabi breakage for defer_free_list in struct net +- RDMA/hns: Fix HW configurations not cleared in error flow +- RDMA/hns: Fix -Wframe-larger-than issue +- RDMA/hns: Drop GFP_NOWARN +- RDMA/hns: Fix accessing uninitialized resources +- RDMA/hns: Remove redundant hnae3.h in bond and sysfs +- RDMA/hns: Use __free_page() to free pages allocated with alloc_page() +- RDMA/hns: Fix divide-by-zero error in dca debugfs +- RDMA/hns: Add check between dca_min_size and dca_max_size +- RDMA/hns: Get messgae length of ack_req from FW +- !17229 net: hns3: fix spelling mistake "reg_um" -> "reg_num" +- !17032 fbcon: Make sure modelist not set on unregistered console +- !16958 scsi: target: iscsi: Fix timeout on deleted connection +- drivers/crypto/ccp: fix soft lockup warning in psp_mutex_lock_timeout() +- net: hns3: fix spelling mistake "reg_um" -> "reg_num" +- net: hns3: add complete parentheses for some macros +- net: hns3: use hns3_get_ops() helper to reduce the unnecessary middle layer conversion +- net: hns3: use hns3_get_ae_dev() helper to reduce the unnecessary middle layer conversion +- net: hns3: delete redundant address before the array +- net: hns3: clear hns alarm: comparison of integer expressions of different signedness +- net: hns3: add +- Revert "net: hns3: add +- dma: pswiotlb: Move platform-identification to cpu errata +- !17201 net: hns3: reduce stack usage in hclge_dbg_dump_tm_pri() +- !17215 net_sched: sch_sfq: fix a potential crash on gso_skb handling +- !17214 netfilter: nf_set_pipapo_avx2: fix initial map fill +- !17213 net: fix udp gso skb_segment after pull from frag_list +- !17212 ice: fix Tx scheduler error handling in XDP callback +- !17207 net: pktgen: fix access outside of user given buffer in pktgen_thread_write() +- !17200 xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() +- !17199 tipc: fix NULL pointer dereference in tipc_mon_reinit_self() +- !17198 bpf: consider that tail calls invalidate packet pointers +- !17197 net: stmmac: Fix accessing freed irq affinity_hint +- !17196 mptcp: fix NULL pointer in can_accept_new_subflow +- !17194 tipc: fix memory leak in tipc_link_xmit +- !17193 net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered +- !17192 cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path +- !17184 sctp: add mutual exclusion in proc_sctp_do_udp_port() +- !17181 net: fix NULL pointer dereference in l3mdev_l3_rcv +- fs: Add additional checks for block devices during mount +- !17101 jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() +- !17191 net: mctp: Set SOCK_RCU_FREE +- !17190 usbnet:fix NPE during rx_complete +- !17189 net: ibmveth: make veth_pool_store stop hanging +- !17188 arcnet: Add NULL check in com20020pci_probe() +- !17187 net: fix geneve_opt length integer overflow +- !17186 udp: Fix memory accounting leak. +- !17185 net: mvpp2: Prevent parser TCAM memory corruption +- !17182 net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. +- !17179 net: dsa: free routing table on probe failure +- !17178 sctp: detect and prevent references to a freed transport in sendmsg +- !17177 net_sched: hfsc: Fix a UAF vulnerability in class handling +- !17176 net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too +- !17175 net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported +- !17174 net: dsa: clean up FDB, MDB, VLAN entries on unbind +- !17172 xsk: fix an integer overflow in xp_create_and_assign_umem() +- !17171 net: atm: fix use after free in lec_send() +- !17170 eth: bnxt: fix truesize for mb-xdp-pass case +- net_sched: sch_sfq: fix a potential crash on gso_skb handling +- netfilter: nf_set_pipapo_avx2: fix initial map fill +- net: fix udp gso skb_segment after pull from frag_list +- ice: fix Tx scheduler error handling in XDP callback +- net: pktgen: fix access outside of user given buffer in pktgen_thread_write() +- !17016 [OLK-6.6]:update patches for sw64 architecture +- driver core: Use kasprintf() instead of fixed buffer formatting +- !17074 ext4: only dirty folios when data journaling regular files +- !16951 wifi: ath9k_htc: Abort software beacon handling if disabled +- net: hns3: reduce stack usage in hclge_dbg_dump_tm_pri() +- net: hns3: Resolved the issue that the debugfs query result is inconsistent. +- Revert "net: hns3: Resolved the issue that the debugfs query result is inconsistent." +- net: hns3: initialize reset_timer before hclgevf_misc_irq_init() +- Revert "net: hns3: initialize reset_timer before hclgevf_misc_irq_init()" +- net: hns3: Use ARRAY_SIZE() to improve readability +- Revert "net: hns3: fix spelling mistake "reg_um" -> "reg_num"" +- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() +- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() +- bpf: consider that tail calls invalidate packet pointers +- net: stmmac: Fix accessing freed irq affinity_hint +- mptcp: fix NULL pointer in can_accept_new_subflow +- tipc: fix memory leak in tipc_link_xmit +- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered +- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path +- net: mctp: Set SOCK_RCU_FREE +- usbnet:fix NPE during rx_complete +- net: ibmveth: make veth_pool_store stop hanging +- arcnet: Add NULL check in com20020pci_probe() +- net: fix geneve_opt length integer overflow +- !16850 [OLK-6.6] Backport TDX HLT/SAFE-HLT fix +- udp: Fix memory accounting leak. +- net: mvpp2: Prevent parser TCAM memory corruption +- sctp: add mutual exclusion in proc_sctp_do_udp_port() +- rtnetlink: Allocate vfinfo size for VF GUIDs when supported +- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. +- net: fix NULL pointer dereference in l3mdev_l3_rcv +- atm: Fix NULL pointer dereference +- net: dsa: free routing table on probe failure +- sctp: detect and prevent references to a freed transport in sendmsg +- net_sched: hfsc: Fix a UAF vulnerability in class handling +- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too +- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported +- net: dsa: clean up FDB, MDB, VLAN entries on unbind +- Input: ims-pcu - check record size in ims_pcu_flash_firmware() +- usb: gadget: u_serial: Fix race condition in TTY wakeup +- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices +- wifi: carl9170: do not ping device which has failed to load firmware +- drm/msm: Fix a fence leak in submit error path +- !17137 [olk 6.6] net: hibmcge: backport some feature patches +- xsk: fix an integer overflow in xp_create_and_assign_umem() +- net: atm: fix use after free in lec_send() +- eth: bnxt: fix truesize for mb-xdp-pass case +- !17156 v3:add perpcu stock for kmem +- xfrm: state: fix out-of-bounds read during lookup +- eth: bnxt: always recalculate features after XDP clearing, fix null-deref +- scsi: ufs: core: Set default runtime/system PM levels before ufshcd_hba_init() +- libfs: Fix simple_offset_rename_exchange() +- shmem: Fix shmem_rename2() +- mac802154: check local interfaces before deleting sdata list +- hfs: Sanity check the root record +- !17109 efi: efi_get_memory_map -- increase map headroom +- !17148 Bluetooth: MGMT: Protect mgmt_pending list with its own lock +- sched/dynamic_affinity: Calculate cpu capacity in real time when realtime tasks are running on this cpu +- sched/dynamic_affinity: fix CI test alway select prefer_cpu problem +- sched/dynamic_affinity: fix preffered_cpu offline problem +- sched/fair: reset idlest_cpu if not meet the conditions for preferred CPU +- memcg: add stock for kmem [un]charging +- memcg: add CONFIG_MEMCG_KMEM_STOCK +- scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers +- selftests: tc-testing: reduce rshift value +- media: vivid: Change the siize of the composing +- f2fs: prevent kernel warning due to negative i_nlink from corrupted image +- !17124 crypto: algif_hash - fix double free in hash_accept +- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() +- Bluetooth: MGMT: Protect mgmt_pending list with its own lock +- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling +- NFC: nci: uart: Set tty->disc_data only in success path +- net: hibmcge: configure FIFO thresholds according to the MAC controller documentation +- net: hibmcge: adjust the burst len configuration of the MAC controller to improve TX performance. +- net: hibmcge: support scenario without PHY +- net: phy: fixed_phy: constify status argument where possible +- net: phy: fixed_phy: remove irq argument from fixed_phy_register +- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 +- net: phy: fixed_phy: remove irq argument from fixed_phy_add +- net: phy: fixed_phy: remove fixed_phy_register_with_gpiod +- !17140 v2 Cgroup-Based Interference Statistics followup +- net_sched: Flush gso_skb list too during ->change() +- !17041 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.70-6.6.72 LTS Conflicts Patches +- interference: Add distribution histogram support +- interference: Use hardware timer counter +- interference: Add mutex interference track support +- interference: Add spinlock interference track support +- interference: Add cgroup_ifs_enter/leave_lock helper +- interference: Disable irq track when irqtime disabled +- sw64: delete useless I/O access in VM and emulator +- sw64: kvm: fix perf kvm support +- sw64: Kconfig: enable HAS_IOPORT by default +- sw64: pci: remove zx200 dma mask reset +- sw64: fix for executing syscall(-1) +- sw64: acpi: select HAVE_ACPI_APEI when ACPI is set +- sw64: pci: add base address of devmn +- sw64: adjust the notrace in the code +- !17126 EDAC/skx_common: Fix general protection fault +- !17136 xcall xint 644 +- modify xcall proc file permissions to 640 +- modify xint proc file permissions to 640 +- dma: pswiotlb: Move pswiotlb dma functions behind dma_map_ops +- !17070 arm64/mpam: Add quirk for MPAM MSMON_MBWU monitor NRDY bit +- !17106 arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() +- !17120 v3 mm: batched unmap lazyfree large folios +- EDAC/skx_common: Fix general protection fault +- crypto: algif_hash - fix double free in hash_accept +- mm/rmap: fix potential out-of-bounds page table access during batched unmap +- mm: avoid splitting pmd for lazyfree pmd-mapped THP in try_to_unmap +- mm: support batched unmap for lazyfree large folios during reclamation +- mm: support tlbbatch flush for a range of PTEs +- mm: set folio swapbacked iff folios are dirty in try_to_unmap_one +- !16998 arm64/mpam: Fix L2 monitor issue under CDP mode +- xfs: handle attr node/leaf blocks atomically during inactive +- xfs: factor out xfs_attr3_leaf_init +- xfs: factor out xfs_da3_node_entry_remove +- Revert "xfs: factor out __xfs_da3_node_read()" +- Revert "xfs: atomic drop extent entries when inactiving attr" +- dma: phyitum: enable CONFIG_PSWIOTLB +- dma: Fix kabi breakage due to "dma: phytium: Add PSWIOTLB mechanism to improve DMA performance" +- dma: phytium: Add PSWIOTLB mechanism to improve DMA performance +- !17107 CVE-2025-38322 +- !16947 [OLK-6.6] Fix patches for X2avic to backport for OLK-6.6 +- !17092 drm/amd/display: Fix && vs || typos +- perf/x86/intel: Fix crash in icl_update_topdown_event() +- perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read +- perf/x86/intel: Apply static call for drain_pebs +- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() +- !16884 fs: Backport four namespace fix patches +- !17094 config: Set TSM_REPORTS=m and ARM_CCA_GUEST=m +- smb: client: fix use-after-free in cifs_oplock_break +- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() +- config: Set TSM_REPORTS=m and ARM_CCA_GUEST=m +- drm/amd/display: Fix && vs || typos +- !17071 usb: dwc3: gadget: check that event count does not exceed event buffer length +- !17068 mcb: fix a double free bug in chameleon_parse_gdd() +- !17062 bnxt_en: Mask the bd_cnt field in the TX BD properly +- serial: Fix potential null-ptr-deref in mlb_usio_probe() +- !16956 v3 config: Enable CONFIG_VIRT_DRIVERS +- smb: client: fix use-after-free in crypt_message when using async crypto +- !16950 perf: Add support for SPE Data Source packet on HiSilicon HIP12 +- ext4: only dirty folios when data journaling regular files +- usb: dwc3: gadget: check that event count does not exceed event buffer length +- arm64/mpam: Add quirk for MPAM MSMON_MBWU monitor NRDY bit +- mcb: fix a double free bug in chameleon_parse_gdd() +- bnxt_en: Mask the bd_cnt field in the TX BD properly +- !17055 bpf lts backport +- !17054 bpf verifier fixes +- !17049 platform/x86: dell_rbu: Fix list usage +- !17059 media: cxusb: no longer judge rbuf when the write fails +- !16462 fix CVE-2025-22101 +- media: cxusb: no longer judge rbuf when the write fails +- bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types +- bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit +- selftests/bpf: Add tests with stack ptr register in conditional jmp +- bpf: Do not include stack ptr register in precision backtracking bookkeeping +- selftests/bpf: precision tracking test for BPF_NEG and BPF_END +- Fix kabi for TDX halt/safe-halt +- !17003 net_sched: red: fix a race in __red_change() +- !16747 LoongArch: Fix bugs in huge_pte_offset/__alloc_pages_slowpath/iommu +- platform/x86: dell_rbu: Fix list usage +- !17026 CVE-2025-37842 +- !17022 spi-rockchip: Fix register out of bounds access +- !17039 iio: light: opt3001: fix deadlock due to concurrent flag access +- !17036 parisc: Fix double SIGFPE crash +- !17001 Fix CVE-2025-38182 +- fs/Kconfig: make hugetlbfs a menuconfig +- !17034 fix CVE-2025-38118 +- !17033 LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() +- !17035 drm/amdkfd: Fix mode1 reset crash issue +- workqueue: Update lock debugging code +- memblock: use numa_valid_node() helper to check for invalid node ID +- !16792 v3 Support CCA Guest +- iio: light: opt3001: fix deadlock due to concurrent flag access +- !17023 bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() +- parisc: Fix double SIGFPE crash +- drm/amdkfd: Fix mode1 reset crash issue +- Bluetooth: MGMT: Fix sparse errors +- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete +- perf mem: Count L2 HITM for c2c statistic +- perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12 +- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() +- arm64: cputype: Add cputype definition for HIP12 +- Revert "perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12" +- fbcon: Make sure modelist not set on unregistered console +- spi: fsl-qspi: Fix double cleanup in probe error path +- spi: fsl-qspi: use devm function instead of driver remove +- !16991 hwmon: (asus-ec-sensors) check sensor index in read_string() +- !17014 v2 CVE-2025-38099 +- !17013 crypto: null - Use spin lock instead of mutex +- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() +- spi-rockchip: Fix register out of bounds access +- !16983 crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() +- !16982 KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses +- !16957 f2fs: fix to do sanity check on sbi->total_valid_block_count +- !16999 octeon_ep: Fix host hang issue during device reboot +- !16995 f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() +- !17000 v2 mm: respect mmap hint address when aligning for THP +- !17006 drivers/rapidio/rio_cm.c: prevent possible heap overwrite +- sw64: irqchip: update effective affinity for PINTC +- sw64: irqchip: add support for PINTC on all NUMA nodes +- sw64: cpufreq: optimize the granularity of cpufreq +- sw64: ftrace: restore the register storing direct call address +- sw64: kvm: fix undefined compile issues for kvm module +- sw64: pintc: fix guest pintc init +- sw64: set module region to the 2GB space below vmalloc area +- Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers +- Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken +- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE +- Bluetooth: Add quirk for broken READ_VOICE_SETTING +- crypto: null - Use spin lock instead of mutex +- !16467 drm/virtio: implement virtio_gpu_shutdown +- !16565 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y +- !16743 [OLK-6.6] backport important bugfix for lpfc driver from upstream linux-6.6.y +- !16902 cachefiles: Fix the incorrect return value in cachefiles_ondemand_fd_write_iter() +- !16994 net: cadence: macb: Fix a possible deadlock in macb_halt_tx. +- !16996 wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds +- drivers/rapidio/rio_cm.c: prevent possible heap overwrite +- net_sched: red: fix a race in __red_change() +- ublk: santizize the arguments from userspace when adding a device +- mm: respect mmap hint address when aligning for THP +- octeon_ep: Fix host hang issue during device reboot +- arm64/mpam: Fix L2 monitor issue under CDP mode +- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds +- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() +- net: cadence: macb: Fix a possible deadlock in macb_halt_tx. +- !16988 Fix compile problem for psi_grained +- hwmon: (asus-ec-sensors) check sensor index in read_string() +- Fix compile problem for psi_grained +- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() +- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses +- !16969 Fix CVE-2025-38170 +- !16967 net: openvswitch: Fix the dead loop of MPLS parse +- !16964 dma-buf: insert memory barrier before updating num_fences +- arm64/fpsimd: Discard stale CPU state when handling SME traps +- !16891 fix some build errors of enfs +- KVM: x86: Fix a comment inside __kvm_set_or_clear_apicv_inhibit() +- net: openvswitch: Fix the dead loop of MPLS parse +- dma-buf: insert memory barrier before updating num_fences +- !16557 [OLK-6.6] PCI/P2PDMA: Add Zhaoxin Zhaoxin bridges to the whitelist +- !16919 Backport mainline patches +- scsi: target: iscsi: Fix timeout on deleted connection +- f2fs: fix to do sanity check on sbi->total_valid_block_count +- config: Enable CONFIG_VIRT_DRIVERS +- !16567 [OLK-6.6]:update patches for sw64 architecture +- wifi: ath9k_htc: Abort software beacon handling if disabled +- KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is enabled +- iommu/amd: Do not flush IRTE when only updating isRun and destination fields +- !16897 CVE-2025-37784 +- !16922 v2 irqchip/gic-v3: Fix xint sleeping function called from invalid context +- !16926 nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. +- !16912 Unbinding VF drivers in virtCCA CoDA SR-IOV scenarios. +- !16908 OLK-6.6 Bperf +- !16603 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.83-6.6.84 LTS Patches +- virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN +- dm: fix unconditional IO throttle caused by REQ_PREFLUSH +- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. +- irqchip/gic-v3: Fix xint sleeping function called from invalid context +- !16906 rseq: Fix segfault on registration when rseq_cs is non-zero +- xfrm: Clear low order bits of ->flowi4_tos in decode_session4(). +- xfrm: policy: fix layer 4 flowi decoding +- xfrm: policy: replace session decode with flow dissector +- xfrm: move mark and oif flowi decode into common code +- xfrm: pass struct net to xfrm_decode_session wrappers +- !16898 libnvdimm/labels: Fix divide error in nd_label_data_init() +- !16903 some optimization patches for inet_diag dump +- Unbinding VF drivers in virtCCA CoDA SR-IOV scenarios. +- !16895 virtCCA supports SR-IOV in CoDA scenarios. +- perf stat: Fix incorrect display of bperf when event count is 0 +- perf stat: Increase perf_attr_map entries +- perf test: Use sqrtloop workload to test bperf event +- perf test stat_bpf_counter.sh: Stabilize the test results +- perf test bpf-counters: Add test for BPF event modifier +- perf stat: Support inherit events during fork() for bperf +- !16896 drm/v3d: Add job to pending list if the reset was skipped +- rseq: Fix segfault on registration when rseq_cs is non-zero +- inet_diag: skip over empty buckets +- sock_diag: remove sock_diag_mutex +- inet_diag: allow concurrent operations +- inet_diag: add module pointer to "struct inet_diag_handler" +- cachefiles: Fix the incorrect return value in cachefiles_ondemand_fd_write_iter() +- !16780 v2 mm/mem_sampling: add trace event for spe based damon record +- !16781 v4 mm/mem_sampling: fix some mem sampling issues +- libnvdimm/labels: Fix divide error in nd_label_data_init() +- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request +- net: ti: icss-iep: Add phase offset configuration for perout signal +- net: ti: icss-iep: Add pwidth configuration for perout signal +- drm/v3d: Add job to pending list if the reset was skipped +- !16753 nfs: handle failure of nfs_get_lock_context in unlock path +- !16237 pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result +- virtCCA supports SR-IOV in CoDA scenarios. +- !16556 [OLK-6.6] PCI: Supplement ACS quirk for more Zhaoxin Root Ports +- !16559 mm: mincore: use pte_batch_hint() to batch process large folios +- !16689 mm/madvise: batch tlb flushes for MADV_DONTNEED and MADV_FREE +- !16426 FIX CVE-2025-40014 +- !16601 add virtcca capability and kae vf interface +- sunrpc, nfs: CONFIG_ENFS should select CONFIG_SUNRPC_ENFS +- sunrpc, nfs: fix build errors when CONFIG_SUNRPC_ENFS=m && CONFIG_ENFS=m && CONFIG_NFS=y +- !16866 v2 mempolicy: optimize queue_folios_pte_range by PTE batching +- nfs: fix build errors when CONFIG_ENFS=m && CONFIG_NFS_FS=y +- nfs: fix enfs mount failure when CONFIG_ENFS=y +- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns +- do_change_type(): refuse to operate on unmounted/not ours mounts +- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) +- path_overmount(): avoid false negatives +- !16865 pci:vga fix race condition in vga_arb_write +- !16770 [OLK-6.6] Intel: Backport to fix QuickAssist Technology(QAT) in-tree driver from v6.10 to v6.16 +- !16773 mm:userswap: change VM_USWAP_BIT to bit 61 +- x86/tdx: Fix arch_safe_halt() execution for TDX VMs +- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT +- sw64: adapt to the upstream changes in huge_ptep_get_and_clear +- sw64: sort arch/sw64/Kconfig +- sw64: iommu: implement map_pages/unmap_pages API +- !16820 v2 Fix some smmu bugs +- !16803 CVE-2025-38060 +- !16828 orangefs: Do not truncate file size +- !16812 perf hisi-ptt: Fix memory leak in lseek failure handling +- !16827 btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref +- !16775 [OLK-6.6]fix enfs bug +- !16861 arm64: kaslr: fix nokaslr cmdline parsing +- mempolicy: optimize queue_folios_pte_range by PTE batching +- !16804 HID: uclogic: Add NULL check in uclogic_input_configured() +- !16806 vhost-scsi: protect vq->log_used with vq->mutex +- !14552 [OLK-6.6]Arm64:KVM: Auto get the virtual_dev irq bypass's devid +- !16573 Backport 6.6.64-6.6.72 LTS +- !16757 objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() +- !16756 mm: pcp: increase pcp->free_count threshold to trigger free_high +- pci:vga fix race condition in vga_arb_write +- !16656 merge CVE patches into OLK-6.6 +- !16512 perf/x86/intel: Only check the group flag for X86 leader +- !16617 SELinux: Add check for the user data passed to kcalloc in hashtab_init +- !16748 arm64: xcall: Fix GPR touch as the original step +- !16778 drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() +- !16848 tracing: probes: Fix a possible race in trace_probe_log APIs +- !16842 ftrace: Fix UAF when lookup kallsym after ftrace disabled +- !16837 ftrace: Fix preemption accounting for stacktrace filter command +- !16845 bpf: Avoid __bpf_prog_ret0_warn when jit fails +- !16652 v2 CVE-2025-37948 +- !16791 ALSA: pcm: Fix race of buffer access at PCM OSS layer +- arm64: kaslr: fix nokaslr cmdline parsing +- !16851 drm/amd/display: Increase block_sequence array size +- drm/amd/display: Increase block_sequence array size +- tracing: probes: Fix a possible race in trace_probe_log APIs +- bpf: Avoid __bpf_prog_ret0_warn when jit fails +- LeapIOraid: add device and support fw log +- ftrace: Fix UAF when lookup kallsym after ftrace disabled +- ftrace: Fix preemption accounting for stacktrace filter command +- orangefs: Do not truncate file size +- btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref +- iommu/arm-smmu-v3: Fix the problematic platform detection logic +- iommu/arm-smmu-v3: Fix the extra atc tlb flush +- fix review issue +- vhost-scsi: protect vq->log_used with vq->mutex +- perf hisi-ptt: Fix memory leak in lseek failure handling +- HID: uclogic: Add NULL check in uclogic_input_configured() +- bpf: abort verification if env->cur_state->loop_entry != NULL +- bpf: copy_verifier_state() should copy 'loop_entry' field +- gicv3: add lpi support for virtcca cvm guest +- MAINTAINERS: Add CCA and pKVM CoCO guest support to the ARM64 entry +- configfs-tsm-report: Fix NULL dereference of tsm_ops +- arm64: Document Arm Confidential Compute +- virt: arm-cca-guest: TSM_REPORT support for realms +- mm/slab: Add __free() support for kvfree +- configfs-tsm: Introduce a shared ABI for attestation reports +- virt: coco: Add a coco/Makefile and coco/Kconfig +- arm64: realm: Use aliased addresses for device DMA to shared buffers +- dma: Introduce generic dma_addr_*crypted helpers +- dma: Fix encryption bit clearing for dma_to_phys +- rme: make sure realm guest map memory in page granularity +- arm64: realm: ioremap: Allow mapping memory as encrypted +- parisc: Delay write-protection until mark_rodata_ro() call +- jump_label,module: Don't alloc static_key_mod for __ro_after_init keys +- irqchip/gic-v3-its: Rely on genpool alignment +- irqchip/gic-v3-its: Fix over allocation in itt_alloc_pool() +- irqchip/gic-v3-its: Share ITS tables with a non-trusted hypervisor +- arm64: Enable memory encrypt for Realms +- arm64: mm: Avoid TLBI when marking pages as valid +- arm64: Enforce bounce buffers for realm DMA +- efi: arm64: Map Device with Prot Shared +- arm64: rsi: Map unprotected MMIO as decrypted +- arm64: rsi: Add support for checking whether an MMIO is protected +- arm64: realm: Query IPA size from the RMM +- arm64: Detect if in a realm and set RIPAS RAM +- arm64: rsi: Add RSI definitions +- arm64: mm: Add confidential computing hook to ioremap_prot() +- arm64: mm: Add top-level dispatcher for internal mem_encrypt API +- Revert "gicv3: add lpi support for cvm guest" +- Revert "virtcca feature : disable swiotlb for passthrough device" +- ALSA: pcm: Fix race of buffer access at PCM OSS layer +- fix enfs bug +- mm/mem_sampling: Fix inaccurate sampling for NUMA balancing and DAMON +- mm/mem_sampling: Prevent mem_sampling from being enabled if SPE init failed +- mm/mem_sampling: add trace event for spe based damon record +- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() +- mm:userswap: change VM_USWAP_BIT to bit 61 +- crypto: qat - switch to standard pattern for PCI IDs +- crypto: qat - remove BITS_IN_DWORD() +- crypto: qat - remove initialization in device class +- crypto: qat - add shutdown handler to qat_c3xxx +- crypto: qat - remove redundant prototypes in qat_c3xxx +- crypto: qat - add shutdown handler to qat_c62x +- crypto: qat - remove redundant prototypes in qat_c62x +- crypto: qat - add shutdown handler to qat_dh895xcc +- crypto: qat - remove redundant prototypes in qat_dh895xcc +- crypto: qat - add shutdown handler to qat_420xx +- crypto: qat - add shutdown handler to qat_4xxx +- crypto: qat - Remove dst_null support +- crypto: qat - remove access to parity register for QAT GEN4 +- crypto: qat - set parity error mask for qat_420xx +- crypto: qat - optimize allocations for fw authentication +- crypto: qat - remove redundant FW image size check +- crypto: qat - remove unused members in suof structure +- crypto: qat - introduce fuse array +- crypto: qat - add macro to write 64-bit values to registers +- crypto: qat - refactor service parsing logic +- crypto: qat - do not export adf_cfg_services +- crypto: qat - reorder objects in qat_common Makefile +- crypto: qat - fix object goals in Makefiles +- crypto: qat - set command ids as reserved +- crypto: drivers - Use str_enable_disable-like helpers +- vfio/qat: fix overflow check in qat_vf_resume_write() +- crypto: qat - Fix missing destroy_workqueue in adf_init_aer() +- crypto: qat - Fix typo "accelaration" +- crypto: qat - Constify struct pm_status_row +- crypto: qat - remove unused adf_devmgr_get_first +- lib/string_choices: Add str_up_down() helper +- crypto: qat - Remove trailing space after +- crypto: qat - fix "Full Going True" macro definition +- crypto: qat - Use static_assert() to check struct sizes +- crypto: qat - allow disabling SR-IOV VFs +- crypto: qat - ensure correct order in VF restarting handler +- crypto: qat - fix recovery flow for VFs +- crypto: qat - disable IOV in adf_dev_stop() +- crypto: qat - preserve ADF_GENERAL_SEC +- crypto: qat - initialize user_input.lock for rate_limiting +- crypto: qat - make adf_ctl_class constant +- crypto: qat - Fix typo +- crypto: qat - fix linking errors when PCI_IOV is disabled +- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() +- mm: pcp: increase pcp->free_count threshold to trigger free_high +- mm: page_alloc: remove redundant READ_ONCE +- nfs: handle failure of nfs_get_lock_context in unlock path +- arm64: xcall: Fix GPR touch as the original step +- iommu/loongarch: fix potential hung task when error occurred +- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() +- mm/page_alloc.c: avoid infinite retries caused by cpuset race +- LoongArch: Fix early_numa_add_cpu() usage for FDT systems +- !16740 KVM: arm64: check if IPIV is enabled in BIOS +- scsi: lpfc: Free phba irq in lpfc_sli4_enable_msi() when pci_irq_vector() fails +- !16737 drivers/perf: hisi: Add events and rename event "cycle" for pa_pmu +- KVM: arm64: check if IPIV is enabled in BIOS +- drivers/perf: hisi: Add events and rename event "cycle" for pa_pmu +- !16694 RDMA/hns: Fix double destruction of rsv_qp +- !16730 uacce: removal of the Shared Memory Feature for Queues +- !16727 perf: Remove unstable events for uncore L3C PMU +- !16732 drivers/perf: hisi: Fixes the incorrect bitmask limit for the CPA event sysfs interface +- !16728 drivers/perf: hisi: Add cacheable option for L3C PMU +- !16724 drivers/perf: hisi: Clarifying event names and fix event ID for pa_pmu +- !16723 perf iostat: hisi: Fix port range retrival +- mm/madvise: handle madvise_lock() failure during race unwinding +- mm/madvise: batch tlb flushes for MADV_DONTNEED[_LOCKED] +- mm/memory: split non-tlb flushing part from zap_page_range_single() +- mm/madvise: batch tlb flushes for MADV_FREE +- mm/madvise: define and use madvise_behavior struct for madvise_do_behavior() +- mm/madvise: remove len parameter of madvise_do_behavior() +- mm/madvise: remove redundant mmap_lock operations from process_madvise() +- mm/madvise: split out madvise() behavior execution +- mm/madvise: split out madvise input validity check +- mm/madvise: split out mmap locking operations for madvise() +- mm/madvise: unrestrict process_madvise() for current process +- !16729 arm64: Fix unmet direct dependencies for DEBUG_FEATURE_BYPASS +- drivers/perf: hisi: Fixes the incorrect bitmask limit for the CPA event sysfs interface +- crypto: hisilicon/qm - check whether the input parameters and device PF match +- uacce: removal of the Shared Memory Feature for Queues +- arm64: Fix unmet direct dependencies for DEBUG_FEATURE_BYPASS +- !16721 cpufreq: CPPC: Don't warn on failing to read perf counters on offline cpus +- drivers/perf: hisi: Add cacheable option for L3C PMU +- perf: Remove unstable events for uncore L3C PMU +- drivers/perf: hisi: Clarifying event names and fix event ID for pa_pmu +- perf iostat: hisi: Fix port range retrival +- !16701 Add HiSilicon uncore frequency scaling driver +- !16712 crypto: hisilicon - support algorithm fallback v2 +- iommu: smmuv3: Not print information of SMMU 0x10 event +- arm64: topology: Setup amu fie when cpu hotplugging +- cpufreq: CPPC: Fix error handling in cppc_scale_freq_workfn() +- cpufreq: CPPC: Don't warn on failing to read perf counters on offline cpus +- topology: Set capacity_freq_ref in all cases +- arm64/amu: Use capacity_ref_freq() to set AMU ratio +- cpufreq/cppc: Set the frequency used for computing the capacity +- energy_model: Use a fixed reference frequency +- cpufreq/schedutil: Use a fixed reference frequency +- cpufreq: Use the fixed and coherent frequency for scaling capacity +- !16717 Fix issues of nfs mounting +- !16714 v2 Fix file content inconsistency issue and incorporate subsequent fix patches +- sched/topology: Add a new arch_scale_freq_ref() method +- !16696 KVM: arm64: Check whether GICv4.0 is enabled +- nfs: ignore SB_RDONLY when remounting nfs +- nfs: clear SB_RDONLY before getting superblock +- vfs: generate FS_CREATE before FS_OPEN when ->atomic_open used. +- NFS: abort nfs_atomic_open_v23 if name is too long. +- NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly. +- !16680 Fix the problem of NFS client mount read/write permission failure +- crypto: hisilicon/qm - check the value obtained from the hardware +- crypto: hisilicon/hpre - support the hpre algorithm fallback +- crypto: hisilicon - implement full backlog support for sec +- uacce: add queue lock for uacce_get_ss_dma +- uacce: use WARN_ON_ONCE instead of WARN_ON +- !16705 fs/resctrl: Fix return value in rdtgroup_pseudo_locked_in_hierarchy() +- !16691 v3 Rewrite smt interference account logic +- mm/madvise: don't perform madvise VMA walk for MADV_POPULATE_(READ|WRITE) +- !16662 Fix watchdog false positive problem +- !16711 af_unix: Read 0 bytes with MSG_PEEK loops if last skb is OOB +- af_unix: Read 0 bytes with MSG_PEEK loops if last skb is OOB +- fs/resctrl: Fix return value in rdtgroup_pseudo_locked_in_hierarchy() +- !16287 Update the watchdog period according to real CPU frequency +- !16679 fs/resctrl: L2_MON does not support the limbo mechanism +- openeuler_defconfig: Enable devfreq and hisi_uncore_freq by default +- PM / devfreq: Add HiSilicon uncore frequency scaling driver +- PM / devfreq: Allow devfreq driver to add custom sysfs ABIs +- PM / devfreq: Check governor before using governor->name +- PM / devfreq: Remove redundant devfreq_get_freq_range() calling in devfreq_add_device() +- PM / devfreq: Limit max_freq with scaling_min_freq +- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() +- mailbox: pcc: Refactor and simplify check_and_ack() +- mailbox: pcc: Always map the shared memory communication address +- mailbox: pcc: Refactor error handling in irq handler into separate function +- mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() +- mailbox: pcc: Return early if no GAS register from pcc_mbox_cmd_complete_check +- mailbox: pcc: Drop unnecessary endianness conversion of pcc_hdr.flags +- !16653 [OLK-6.6] Revert "USB: xHCI: fix resume issue of some ZHAOXIN hosts" +- !16699 mm: provide vm_normal_(page|folio)_pmd() with CONFIG_PGTABLE_HAS_HUGE_LEAVES +- mm: provide vm_normal_(page|folio)_pmd() with CONFIG_PGTABLE_HAS_HUGE_LEAVES +- KVM: arm64: Check whether GICv4.0 is enabled +- RDMA/hns: Fix double destruction of rsv_qp +- interference: Rewrite smt interference account logic +- interference: Fix the compilation warning of sched_task_is_throttled() +- !16686 v2 Soft domain improves and bugfixes +- sched: Fix might sleep in atomic section issue +- sched: Consider task affinity in wake_soft_domain() +- sched: Fix soft domain group memleak +- sched: Rework cpu.soft_domain_nr_cpu +- sched: Add cmdline sched_soft_domain switch for soft domain feature +- !16639 arm64/mpam: Add MPAM manual +- Revert "nfs: ignore SB_RDONLY when mounting nfs" +- Revert "nfs: pass flags to second superblock" +- Revert "nfs: fix the loss of superblock's initialized flags" +- !16651 iommu/arm-smmu-v3: Fix global-out-of-bounds access in arm_smmu_group_get_mpam() +- fs/resctrl: L2_MON does not support the limbo mechanism +- !16670 mm/mm_spe.c: remove redundant checks and debug prints in mm_spe probe +- !16668 Remove useless file +- mm/mm_spe.c: remove redundant checks and debug prints in mm_spe probe +- Remove useless file +- !15819 [OLK-6.6]drm/phytium: Fix some Bugs in Phytium Display Engine +- watchdog: fix the SOFTLOCKUP_DETECTOR=n case +- watchdog: fix watchdog may detect false positive of softlockup +- crypto: iaa - Fix potential use after free bug +- mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() +- mm: migrate_device: use more folio in migrate_device_finalize() +- Revert "remoteproc: core: Clear table_sz when rproc_shutdown" +- remoteproc: core: Clear table_sz when rproc_shutdown +- jfs: fix slab-out-of-bounds read in ea_get() +- tpm: do not start chip while suspended +- KVM: arm64: Tear down vGIC on failed vCPU creation +- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() +- Revert "USB: xHCI: fix resume issue of some ZHAOXIN hosts" +- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation +- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users +- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs +- arm64: proton-pack: Expose whether the branchy loop k value +- arm64: proton-pack: Expose whether the platform is mitigated by firmware +- arm64: insn: Add support for encoding DSB +- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays +- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists +- arm64: cputype: Add MIDR_CORTEX_A76AE +- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list +- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB +- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list +- iommu/arm-smmu-v3: Fix global-out-of-bounds access in arm_smmu_group_get_mpam() +- fs/resctrl: Prevent idle RMIDs from not being released in time from limbo +- arm64/mpam: Update the chip condition judgment in resctrl_arch_would_mbm_overflow() +- add virtcca capability and kae vf interface +- arm64/watchdog_hld: Add a cpufreq notifier for update watchdog thresh +- watchdog/perf: Provide function for adjusting the event period +- !16627 fix move_pages return value +- arm64/mpam: Add MPAM manual +- ksmbd: fix r_count dec/increment mismatch +- Input: xpad - fix two controller table values +- cifs: Ensure that all non-client-specific reparse points are processed by the server +- nvme: unblock ctrl state transition for firmware update +- vboxsf: Add __nonstring annotations for unterminated strings +- netfilter: nf_tables: allow clone callbacks to sleep +- netfilter: nf_tables: bail out if stateful expression provides no .clone +- netfilter: nf_tables: use timestamp to check for set element timeout +- rust: lockdep: Remove support for dynamically allocated LockClassKeys +- HID: apple: disable Fn key handling on the Omoton KB066 +- nvme-fc: rely on state transitions to handle connectivity loss +- Bluetooth: L2CAP: Fix corrupted list in hci_chan_del +- smb: client: Fix match_session bug preventing session reuse +- smb3: add support for IAKerb +- i2c: sis630: Fix an error handling path in sis630_probe() +- i2c: ali15x3: Fix an error handling path in ali15x3_probe() +- i2c: ali1535: Fix an error handling path in ali1535_probe() +- cifs: Throw -EOPNOTSUPP error on unsupported reparse point type from parse_reparse_point() +- cifs: Validate content of WSL reparse point buffers +- cifs: Fix integer overflow while processing closetimeo mount option +- cifs: Fix integer overflow while processing actimeo mount option +- scripts: generate_rust_analyzer: add missing macros deps +- ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe() +- ASoC: rt722-sdca: add missing readable registers +- rust: init: add missing newline to pr_info! calls +- ASoC: cs42l43: Fix maximum ADC Volume +- drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data() +- rust: error: add missing newline to pr_warn! calls +- ASoC: ops: Consistently treat platform_max as control value +- smb: client: fix regression with guest option +- qlcnic: fix memory leak issues in qlcnic_sriov_common.c +- arm64: mm: Populate vmemmap at the page level if not section aligned +- ASoC: amd: yc: Support mic on another Lenovo ThinkPad E16 Gen 2 model +- clk: samsung: update PLL locktime for PLL142XX used on FSD platform +- ksmbd: prevent connection release during oplock break notification +- ksmbd: fix use-after-free in ksmbd_free_work_struct +- drm/amd/display: Fix slab-use-after-free on hdcp_work +- drm/amd/display: Assign normalized_pix_clk when color depth = 14 +- drm/amd/display: Restore correct backlight brightness after a GPU reset +- drm/amd/display: Disable unneeded hpd interrupts during dm_init +- drm/dp_mst: Fix locking when skipping CSN before topology probing +- drm/atomic: Filter out redundant DPMS calls +- drm/i915/cdclk: Do cdclk post plane programming later +- x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes +- USB: serial: option: match on interface class for Telit FN990B +- USB: serial: option: fix Telit Cinterion FE990A name +- USB: serial: option: add Telit Cinterion FE990B compositions +- USB: serial: ftdi_sio: add support for Altera USB Blaster 3 +- Input: i8042 - swap old quirk combination with new quirk for more devices +- Input: i8042 - swap old quirk combination with new quirk for several devices +- Input: i8042 - add required quirks for missing old boardnames +- Input: i8042 - swap old quirk combination with new quirk for NHxxRZQ +- Input: xpad - rename QH controller to Legion Go S +- Input: xpad - add support for TECNO Pocket Go +- Input: xpad - add support for ZOTAC Gaming Zone +- Input: xpad - add multiple supported devices +- Input: xpad - add 8BitDo SN30 Pro, Hyperkin X91 and Gamesir G7 SE controllers +- Input: iqs7222 - preserve system status register +- Input: ads7846 - fix gpiod allocation +- io_uring: use unpin_user_pages() where appropriate +- !16620 close_files(): don't bother with xchg() +- io_uring/kbuf: vmap pinned buffer ring +- io_uring: use vmap() for ring mapping +- io_uring: fix corner case forgetting to vunmap +- io_uring: don't attempt to mmap larger than what the user asks for +- io_uring: get rid of remap_pfn_range() for mapping rings/sqes +- mm: add nommu variant of vm_insert_pages() +- block: fix 'kmem_cache of name 'bio-108' already exists' +- net: Handle napi_schedule() calls from non-interrupt +- drm/nouveau: Do not override forced connector status +- mptcp: safety check before fallback +- x86/irq: Define trace events conditionally +- perf/x86/intel: Use better start period for frequency mode +- drm/vkms: Round fixp2int conversion in lerp_u16 +- fuse: don't truncate cached, mutated symlink +- ASoC: tas2764: Set the SDOUT polarity correctly +- ASoC: tas2764: Fix power control mask +- ASoC: tas2770: Fix volume scale +- nvme: only allow entering LIVE from CONNECTING state +- sctp: Fix undefined behavior in left shift operation +- cifs: Treat unhandled directory name surrogate reparse points as mount directory nodes +- apple-nvme: Release power domains when probe fails +- nvmet-rdma: recheck queue state is LIVE in state lock in recv done +- nvme-pci: quirk Acer FA100 for non-uniqueue identifiers +- io-wq: backoff when retrying worker creation +- net: wwan: mhi_wwan_mbim: Silence sequence number glitch errors +- ASoC: SOF: amd: Handle IPC replies before FW_BOOT_COMPLETE +- ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module +- ASoC: arizona/madera: use fsleep() in up/down DAPM event delays. +- ASoC: rsnd: adjust convert rate limitation +- ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime() +- ASoC: rsnd: indicate unsupported clock rate +- ALSA: hda/realtek: Limit mic boost on Positivo ARN50 +- ASoC: simple-card-utils.c: add missing dlc->of_node +- selftests/bpf: Fix invalid flag of recv() +- Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd +- Xen/swiotlb: mark xen_swiotlb_fixup() __init +- thermal/cpufreq_cooling: Remove structure member documentation +- s390/cio: Fix CHPID "configure" attribute caching +- platform/x86: thinkpad_acpi: Support for V9 DYTC platform profiles +- platform/x86: thinkpad_acpi: Fix invalid fan speed on ThinkPad X120e +- sched: Clarify wake_up_q()'s write to task->wake_q.next +- objtool: Ignore dangling jump table entries +- HID: apple: fix up the F6 key on the Omoton KB066 keyboard +- HID: hid-apple: Apple Magic Keyboard a3203 USB-C support +- HID: topre: Fix n-key rollover on Realforce R3S TKL boards +- usb: phy: generic: Use proper helper for property detection +- HID: ignore non-functional sensor in HP 5MP Camera +- HID: intel-ish-hid: Send clock sync message immediately after reset +- HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell +- vboxsf: fix building with GCC 15 +- alpha/elf: Fix misc/setarch test of util-linux by removing 32bit support +- smb: client: fix noisy when tree connecting to DFS interlink targets +- ACPI: resource: IRQ override for Eluktronics MECH-17 +- scsi: ufs: core: Fix error return with query response +- scsi: core: Use GFP_NOIO to avoid circular locking dependency +- platform/x86/intel: pmc: fix ltr decode in pmc_core_ltr_show() +- sched/debug: Provide slice length for fair tasks +- powercap: call put_device() on an error path in powercap_register_control_type() +- hrtimers: Mark is_migration_base() with __always_inline +- nvme-fc: do not ignore connectivity loss during connecting +- nvme-fc: go straight to connecting state when initializing +- net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices +- net/mlx5: Bridge, fix the crash caused by LAG state check +- net/mlx5: Lag, Check shared fdb before creating MultiPort E-Switch +- net: openvswitch: remove misbehaving actions length check +- netfilter: nft_exthdr: fix offset with ipv4_find_option() +- net_sched: Prevent creation of classes with TC_H_ROOT +- ipvs: prevent integer overflow in do_ip_vs_get_ctl() +- netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() +- bonding: fix incorrect MAC address setting to receive NS messages +- net: switchdev: Convert blocking notification chain to a raw one +- eth: bnxt: do not update checksum in bnxt_xdp_build_skb() +- net/mlx5: handle errors in mlx5_chains_create_table() +- Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio() +- netpoll: hold rcu read lock in __netpoll_send_skb() +- net: mctp i2c: Copy headers if cloned +- net: dsa: mv88e6xxx: Verify after ATU Load ops +- net/mlx5: Fill out devlink dev info only for PFs +- Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context" +- Bluetooth: hci_event: Fix enabling passive scanning +- sched: address a potential NULL pointer dereference in the GRED scheduler. +- netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around +- ice: fix memory leak in aRFS after reset +- netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template. +- pinctrl: bcm281xx: Fix incorrect regmap max_registers value +- fbdev: hyperv_fb: iounmap() the correct memory when removing a device +- tcp: fix forever orphan socket caused by tcp_abort +- tcp: fix races in tcp_abort() +- hrtimer: Use and report correct timerslack values for realtime tasks +- zram: fix NULL pointer in comp_algorithm_show() +- sched/isolation: Prevent boot crash when the boot CPU is nohz_full +- clockevents/drivers/i8253: Fix stop sequence for timer 0 +- !16604 pds_core: remove write-after-free of client_id +- !16434 ksmbd: fix use-after-free in ksmbd_session_rpc_open +- !16585 tracing: Fix oob write in trace_seq_to_buffer() +- mm/migrate: convert add_page_for_migration() from follow_page() to folio_walk +- mm/pagewalk: fix usage of pmd_leaf()/pud_leaf() without present check +- mm/pagewalk: introduce folio_walk_start() + folio_walk_end() +- mm: introduce vma_pgtable_walk_{begin|end}() +- mm/migrate: use folio_likely_mapped_shared() in add_page_for_migration() +- mm: allocate THP on hugezeropage wp-fault +- mm: abstract THP allocation +- !16537 md: fix mddev uaf while iterating all_mddevs list +- !16538 md/raid10: wait barrier before returning discard request with REQ_NOWAIT +- !16494 scsi: st: Fix array overflow in st_setup() +- !16582 module: ensure that kobject_put() is safe for module type kobjects +- !16605 iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo +- !16606 CVE-2024-58100 +- close_files(): don't bother with xchg() +- SELinux: Add check for the user data passed to kcalloc in hashtab_init +- !16609 migration: update status after RAS error +- !16586 dlm: prevent NPD when writing a positive value to event_done +- !16580 dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature +- bpf: Fix kabi breakage for changes_pkt_data in struct bpf_prog_aux +- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs +- bpf: check changes_pkt_data property for extension programs +- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo +- pds_core: remove write-after-free of client_id +- !16571 Fix erofs fid overflow +- !16574 cgroup/cpuset-v1: Add missing support for cpuset_v2_mode +- !16550 media: venus: hfi_parser: refactor hfi packet parsing logic +- !16549 soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() +- !16600 ftrace: Fix preemption accounting for stacktrace trigger command +- !16596 powerpc/crash: Fix non-smp kexec preparation +- !16562 platform/x86/intel-uncore-freq: Add efficiency latency control and other fix for 6.6 +- !16593 vxlan: vnifilter: Fix unlocked deletion of default FDB entry +- crypto: ccp: fix The high priority queue changes cmd_id of the queued elements +- finally take no_llseek out +- migration: update status after RAS error +- ftrace: Fix preemption accounting for stacktrace trigger command +- powerpc/crash: Fix non-smp kexec preparation +- !16588 ipc: fix to protect IPCS lookups using RCU +- vxlan: vnifilter: Fix unlocked deletion of default FDB entry +- ipc: fix to protect IPCS lookups using RCU +- dlm: prevent NPD when writing a positive value to event_done +- tracing: Fix compilation warning on arm32 +- tracing: Fix oob write in trace_seq_to_buffer() +- module: ensure that kobject_put() is safe for module type kobjects +- dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature +- !16492 arm64/watchdog: fix watchdog failure in low power scenarios +- PCI/P2PDMA: Add Zhaoxin Zhaoxin bridges to the whitelist +- PCI: Supplement ACS quirk for more Zhaoxin Root Ports +- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode +- seq_buf: Make DECLARE_SEQ_BUF() usable +- seq_buf: Introduce DECLARE_SEQ_BUF and seq_buf_str() +- !16482 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.69-6.6.70 LTS Conflicts Patches +- sw64: disable EFFICIENT_UNALIGNED_ACCESS for C3B +- sw64: optimize unaligned access +- sw64: ftrace: Add direct call trampoline samples support +- sw64: ftrace: Add direct call support +- sw64: ftrace: No need to save original function's temporary registers +- sw64: perf: fix perf test 'import perf' in python failed +- sw64: add support for function error injection +- sw64: add sw64 rethook implementation +- sw64: emit fixed-length instructions for BPF_PSEUDO_FUNC +- sw64: ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL +- sw64: mm: adjust userspace memory layout +- sw64: cpufreq: fix the frequency returned by cpufreq_driver->get() +- sw64: ioremap: map some IO space with ioremap +- sw64: ioremap: fix an overflow in pci_remap_cfgspace +- erofs: fix file handle encoding for 64-bit NIDs +- exportfs: define FILEID_INO64_GEN* file handle types +- !16211 [OLK-6.6] Fix CVE-2025-22028 +- !16210 [OLK-6.6] Fix CVE-2025-22109 +- !16209 [OLK-6.6] Fix CVE-2025-22127 +- !16207 [OLK-6.6] Fix CVE-2025-22104 +- !16563 Some random fixes and cleanup to shmem +- !16564 tracing: Fix filter string testing +- sw64: ioremap: support generic ioremap for C4 +- nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable +- mm/shmem: remove unneeded xa_is_value() check in shmem_unuse_swap_entries() +- mm/shmem: fix potential dead loop in shmem_unuse() +- mm: shmem: add missing shmem_unacct_size() in __shmem_file_setup() +- !16536 sched: fair: Use rq_clock_task to account rq->idle_avg +- tracing: Fix filter string testing +- mm: shmem: avoid unpaired folio_unlock() in shmem_swapin_folio() +- mm: mincore: use pte_batch_hint() to batch process large folios +- !16542 perf: Fix hang while freeing sigtrap event +- media: venus: hfi_parser: refactor hfi packet parsing logic +- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() +- !16313 PCI: Fix reference leak in pci_register_host_bridge() +- !16395 PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type +- !16246 backport mainline mm bugfix +- !16541 irqchip/gic: remove useless printing in pv sgi +- !16477 CVE-2024-50140 +- KVM: arm64: fix memory leak in TLBI +- !16435 fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() +- !16372 ksmbd: Fix UAF in __close_file_table_ids +- !16371 ext4: ignore xattrs past end +- perf: Fix hang while freeing sigtrap event +- irqchip/gic: remove useless printing in pv sgi +- md/raid10: wait barrier before returning discard request with REQ_NOWAIT +- md: fix mddev uaf while iterating all_mddevs list +- !16532 memcg: always call cond_resched() after fn() +- sched: fair: Use rq_clock_task to account rq->idle_avg +- memcg: always call cond_resched() after fn() +- !16524 v3 CVE-2024-27079 +- !16527 v2 some fix about ifs +- !16521 drm/amd/display: Fix slab-use-after-free in hdcp +- !16513 fs/resctrl: Restore default settings for all resctrl_res_level +- interference: Fix IFS cannot show in cgroup v1 sub-cgroup +- interference: Fix compilation issue +- !16523 v2 arm64: entry: Fix ACTLR_XCALL_XINT not set build problem +- platform/x86/intel-uncore-freq: Add efficiency latency control to sysfs interface +- platform/x86/intel-uncore-freq: Add support for efficiency latency control +- platform/x86/intel-uncore-freq: Do not present separate package-die domain +- iommu/vt-d: Fix NULL domain on device release +- iommu: Fix kabi breakage for release_domain in struct iommu_ops +- iommu: Add static iommu_ops->release_domain +- !16515 ASoC: qcom: Fix sc7280 lpass potential buffer overflow +- !16483 bugfix for hisilicon accelerator driver +- arm64: entry: Fix ACTLR_XCALL_XINT not set build problem +- drm/amd/display: Fix slab-use-after-free in hdcp +- ASoC: qcom: Fix sc7280 lpass potential buffer overflow +- fs/resctrl: Add missing rdt_last_cmd_clear() after rdtgroup_kn_lock_live() +- fs/resctrl: Restore default settings for all resctrl_res_level +- fs/resctrl: Free mbm_total and mbm_local when fails +- perf/x86/intel: Only check the group flag for X86 leader +- !16510 v5 Support soft domain +- !16509 v2 Support thp policy control per process +- !16479 wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi +- !16478 pds_core: make wait_context part of q_info +- !16476 drm/i915/huc: Fix fence not released on early probe errors +- !16499 padata: do not leak refcount in reorder_work +- config: Configurate CONFIG_SCHED_SOFT_DOMAIN +- sched: fair: Disable numa migrate for soft domian task +- sched: fair: Select idle cpu in soft domain +- sched: Attach task group to soft domain +- sched: topology: Build soft domain for LLC +- mm: tool: add task_thpctl to control thp per process +- mm: add thp process control interface module +- !16489 v5 Cgroup-Based Interference Statistics +- !16453 perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. +- !16458 v3 arm64: idle: Handle idle state for xcall/xint +- !16496 fbdev: omapfb: Add 'plane' value check +- !16459 fs/jfs: Prevent integer overflow in AG size calculation +- usb: typec: ucsi: Set orientation as none when connector is unplugged +- !16486 v10 High Performance Container Resource View Isolation +- padata: do not leak refcount in reorder_work +- !16461 net: hns3: add set_loopback interface to realtek phy driver +- !16414 drm/nouveau: prime: fix ttm_bo_delayed_delete oops +- !16413 bus: mhi: host: Fix race between unprepare and queue_buf +- !15156 Add IOAPIC support for Hygon family 18h model 10h +- fbdev: omapfb: Add 'plane' value check +- scsi: st: Fix array overflow in st_setup() +- arm64/watchdog: fix watchdog failure in low power scenarios +- !16449 [OLK-6.6]Hygon: Support to dec and enc userspace pages +- !16488 drm/hisilicon/hibmc: add HPD, getting EDID, colorbar features in DP function +- !16431 v5 IPIV-BUGFIX for HIP12 +- drm/hisilicon/hibmc: hibmc-drm bugfix for DP +- drm/hisilicon/hibmc:fix KVM is not displaying when GRUB VGA is on +- drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local +- drm/hisilicon/hibmc: fix HPD interrupts triggering the wrong behavior +- drm/hisilicon/hibmc: Add vga connector detect functions +- drm/hisilicon/hibmc: Add MSI irq getting and requesting for HPD +- drm/hisilicon/hibmc: Enable this hot plug detect of irq feature +- drm/hisilicon/hibmc: Add colorbar-cfg feature and its debugfs file +- drm/hisilicon/hibmc: Getting connector info and EDID by using AUX channel +- drm/hisilicon/hibmc: Refactor the member of drm_aux in struct hibmc_dp +- drm/hisilicon/hibmc: Add dp serdes cfg in dp process +- drm/hisilicon/hibmc: Add dp serdes cfg to adjust serdes rate, voltage and pre-emphasis +- drm/hisilicon/hibmc: Restructuring the header dp_reg.h +- drm/hisilicon/hibmc: select CONFIG_DRM_DISPLAY_DP_HELPER +- drm: Call drm_atomic_helper_shutdown() at shutdown time for misc drivers +- drm/ast: Implement polling for VGA and SIL164 connectors +- drm/sysfs: Register "ddc" symlink later +- openeuler_defconfig: Disable CGROUP_IFS config by default +- interference: Add cgroup v1 support for CGROUP_IFS +- interference: Add irq interference track support +- interference: Add sched wakelat interference track support +- interference: Exclude throttle time from rundelay +- interference: Add sched throttle interference track support +- interference: Add sched sleep interference track support +- interference: Add sched rundelay interference track support +- interference: Add smt interference track support +- interference: Add cgroup-based inteference statistics framework +- cgroup: Export cgroup_addrm_files as internal interface +- cgroup: Export cgroup_init_cftypes as internal interface +- interference: Add CGROUP_IFS_DEFAULT_ENABLED config +- interference: Add CGROUP_IFS config +- !16487 hisi_sas: Misc patches and cleanups +- scsi: hisi_sas: Fix warning detected by sparse +- scsi: hisi_sas: Wait until error handling is complete +- scsi: hisi_sas: Code style cleanup +- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk +- scsi: hisi_sas: Use macro instead of magic number +- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes +- scsi: hisi_sas: Enable force phy when SATA disk directly connected +- scsi: hisi_sas: Fixed failure to issue vendor specific commands +- Revert "Revert "scsi: hisi_sas: Disable SATA disk phy for severe I_T nexus reset failure"" +- Revert "scsi: hisi_sas: Enable force phy when SATA disk directly connected" +- !15150 correct address translation for Hygon family 18h model 4h~10h +- !16445 [OLK-6.6][Bugfix]hugetlb: Fix NULL pointer dereference BUG +- !16484 v5: ucounts: rlimit scalability issues +- !16481 net: tcp: scale connect() under pressure +- config: Turn on CONFIG_BPF_RVI for openeuler_defconfig +- samples/bpf: Add iterator program for cpu_online +- samples/bpf: Add iterator program for cpuinfo_x86 +- bpf: Add bpf_arch_flags kunc for x86 +- bpf: Add cpuinfo_x86 iterator target +- bpf: pidns: Add {bpf,get}_current_level1_reaper() +- bpf: Add bpf_cpumask_weight() kfunc +- cpuset: Add task_effective_cpumask() +- bpf: cpuset: Add bpf_cpuset_from_task() kfunc +- bpf: Add generic_single_iter +- bpf: Add CONFIG_BPF_RVI +- ucount: fix kabi for ucounts +- ucounts: reinplement rlimit with percpu_counter +- ucounts: add input for inc_rlimit_[get_]ucounts_limit +- ucounts: add CONFIG_UCOUNTS_PERCPU_COUNTER +- ucount: use rcuref_t for reference counting +- ucount: use RCU for ucounts lookups +- ucount: replace get_ucounts_or_wrap() with atomic_inc_not_zero() +- ucounts: move kfree() out of critical zone protected by ucounts_lock +- rcu: provide a static initializer for hlist_nulls_head +- !16473 RDMA/hns: Trace support and bugfixes +- !15148 Add hygon_set_guest_pat_wb parameter to enhance performance for non-passthrough application scenarios +- crypto: hisilicon/zip - do not expose hashagg algorithm when uacce mode is 2 +- crypto: hisilicon/trng - use DEFINE_MUTEX() for mutex lock +- crypto: hisilicon - enable error reporting again +- crypto: hisilicon/qm - alloc power of 2 interrupts +- crypto: hisilicon/qm - fix vfs_num error +- uacce: fix unsigned long print format +- uacce: delete some redundant code +- uacce: fix isolate sysfs check condition +- tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses. +- inet: call inet6_ehashfn() once from inet6_hash_connect() +- inet: change lport contribution to inet_ehashfn() and inet6_ehashfn() +- tcp: use RCU lookup in __inet_hash_connect() +- tcp: add RCU management to inet_bind_bucket +- tcp: optimize inet_use_bhash2_on_bind() +- tcp: Use bhash2 for v4-mapped-v6 non-wildcard address. +- tcp: use RCU in __inet{6}_check_established() +- usb: typec: ucsi: glink: fix off-by-one in connector_status +- usb: typec: ucsi: glink: be more precise on orientation-aware ports +- usb: typec: ucsi: glink: set orientation aware if supported +- usb: typec: ucsi: glink: move GPIO reading into connector_status callback +- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi +- pds_core: make wait_context part of q_info +- task_work: make TWA_NMI_CURRENT handling conditional on IRQ_WORK +- task_work: Fix kabi breakage in enum task_work_notify_mode +- sched/core: Disable page allocation in task_tick_mm_cid() +- task_work: Add TWA_NMI_CURRENT as an additional notify mode. +- drm/i915/huc: Fix fence not released on early probe errors +- drm/virtio: implement virtio_gpu_shutdown +- virtgpu: don't reset on shutdown +- virtio: break and reset virtio devices on device_shutdown() +- wifi: ath12k: Optimize the mac80211 hw data access +- !16422 v3 fuse: Backport Anolis Features and Performance patches +- RDMA/hns: Optimize HW performance by limiting ACK request frequency +- RDMA/hns: Fix scc_param failed logic judgments +- RDMA/hns: Fix congestion control algorithm parameter range +- RDMA/hns: Fix address information leakage of DCA memory +- RDMA/hns: Inappropriate format characters cleanup +- RDMA/hns: Add trace for CMDQ dumping +- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h +- RDMA/hns: Add trace for MR/MTR attribute dumping +- RDMA/hns: Add trace for AEQE dumping +- RDMA/hns: Add trace for WQE dumping +- RDMA/hns: Add trace for flush CQE +- !16448 [OLK-6.6]riscv: fix kprobe crash due to broken patch_text() API +- drm/phytium: Fix some Bugs in Phytium Display Engine +- LoongArch: sync kvm head file from upstream +- LoongArch: fix migrate issue +- LoongArch: Save and restore CSR.CNTC for hibernation +- !16447 Intel: Intel_idle add GNRD and CWF platform support for 6.6 +- !16441 ext4: better scalability for ext4 block allocation +- !16456 v5 xfs: support log grant track bytes +- !16346 yt6801: Add Motorcomm yt6801 PCIe driver +- !16028 [OLK-6.6][eNFS]add nfs feature to support multipath +- !16398 cachefiles: Parse the "secctx" immediately +- net: libwx: fix Tx L4 checksum +- net: hns3: add set_loopback interface to realtek phy driver +- !16363 [OLK-6.6]:update patches for sw64 architecture +- riscv: livepatch.c adapt patch_text() changes +- !15153 Get the correct instance id calculation for Hygon family 18h model 6h~10h +- fs/jfs: Prevent integer overflow in AG size calculation +- arm64: entry: Support hardware xcall and xint +- arm64/Kconfig: Add turbo features submenuconfig +- xfs: fix incorrect tail lsn tracking when AIL is empty +- xfs: revert AIL TASK_KILLABLE threshold +- xfs: skip flushing log items during push +- xfs: grant heads track byte counts, not LSNs +- xfs: pass the full grant head to accounting functions +- xfs: track log space pinned by the AIL +- xfs: collapse xlog_state_set_callback in caller +- xfs: l_last_sync_lsn is really AIL state +- xfs: ensure log tail is always up to date +- xfs: background AIL push should target physical space +- xfs: AIL doesn't need manual pushing +- xfs: move and rename xfs_trans_committed_bulk +- Revert "xfs: update the last_sync_lsn with ctx start lsn" +- !16404 FIX CVE-2024-58096 +- !16432 wifi: ath11k: fix RCU stall while reaping monitor destination ring +- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. +- !16433 Fix CVE-2025-21972 +- x86/mm: support to dec and enc userspace pages +- !16399 CVE-2025-37925 +- !16291 Fix CVE-2025-37773 +- !16317 Fix CVE-2025-37782 +- !16378 vdpa:Adding compilation macro to decouple the vdpa and iommufd modules +- riscv: Pass patch_text() the length in bytes +- intel_idle: add Clearwater Forest SoC support +- intel_idle: add Granite Rapids Xeon D support +- !16041 [OLK-6.6] 支持用户态通过hygon_psp_resource2设备节点mmap PSP设备的mmio内存 +- mm/hugetlb: fix kernel NULL pointer dereference when replacing free hugetlb folios +- ext4: move mb_last_[group|start] to ext4_inode_info +- ext4: add ext4_try_lock_group() to skip busy groups +- !16366 Backport 6.6.55-6.6.60 LTS +- !16389 mm: remove unnecessary calls to lru_add_drain +- !16388 cgroup: Eliminate the need for cgroup_mutex in proc_cgroup_show() +- mm/huge_memory: fix dereferencing invalid pmd migration entry +- selftests/mm: compaction_test: support platform with huge mount of memory +- vdpa:Adding compilation macro to decouple the vdpa and iommufd modules +- EDAC/amd64: Get intlv_num_dies from F0x60 for Hygon family 18h model 6h +- EDAC/amd64: Use u16 for some umc variables for Hygon family 18h model 4h +- EDAC/amd64: Fix the calculation of cs id for Hygon family 18h model 4h +- EDAC/amd64: Rename the address translation function for hygon family 18h model 4h +- crypto: ccp: Support userspace mmap psp mmio +- !16100 kvm:Optimize the processing performance of multiple eventfd and irqfd +- !16427 [OLK-6.6] 移除vpsp运行时对CSV功能的依赖 +- !16428 RDMA/core: Silence oversized kvmalloc() warning +- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() +- !16408 drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() +- ksmbd: fix use-after-free in ksmbd_session_rpc_open +- wifi: ath11k: fix RCU stall while reaping monitor destination ring +- !16423 arm64/mpam: Update QoS partition default value +- net: mctp: unshare packets when reassembling +- arm64/kabi: use KABI_EXTEND to skip KABI check +- kvm: hisi: print error for IPIV +- KVM: arm64: using kvm_vgic_global_state for ipiv +- kvm: hisi: Don't allow to change mpidr in IPIv +- kvm: hisi: make sure vcpu_id and vcpu_idx have same value in IPIv +- KVM: arm64: fix live migration bug of IPIv +- irqchip/gic: Add HiSilicon PV SGI support +- KVM: arm64: Implement PV_SGI related calls +- KVM: arm64: Document PV-sgi interface +- KVM: arm64: Introduce ipiv enable ioctl +- arm64/config: add config to control whether enable IPIV feature +- !15657 [OLK-6.6] perf/x86/uncore: Add DF PMU support for Hygon family 18h model 8h +- RDMA/core: Silence oversized kvmalloc() warning +- !16421 mm: fix VMA heap bounds checking +- crypto: ccp: support psp generic ringbuffer +- crypto: ccp: Remove vpsp's dependency on sev module +- objtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq() +- !15903 bcache: call force_wake_up_gc() if necessary in check_should_bypass() +- !16394 CVE-2025-37970 +- arm64/mpam: Update QoS partition default value +- x86/resctrl: Add max_bw to struct resctrl_membw +- x86/resctrl: Remove hard-coded memory bandwidth limit +- arm64/mpam: Set 1 as the minimum setting value for MBA +- arm64/mpam: Fix num_rmids information +- fs/resctrl: Fix the crash caused by mounting resctrl but not support RDT +- fuse: remove an unnecessary if statement +- fuse: use fuse_range_is_writeback() instead of iterating pages +- fuse: remove unneeded lock which protecting update of congestion_threshold +- fuse: clear FR_PENDING if abort is detected when sending request +- fuse: cleanup request queuing towards virtiofs +- fuse: add fast path for fuse_range_is_writeback +- fuse: enable dynamic configuration of fuse max pages limit (FUSE_MAX_MAX_PAGES) +- fuse: Add initial support for fs-verity +- anolis: fuse: introduce write alignment +- anolis: fuse: separate bg_queue for write and other requests +- fuse: check aborted connection before adding requests to pending list for resending +- fuse: clear FR_SENT when re-adding requests into pending list +- fuse: set FR_PENDING atomically in fuse_resend() +- fuse: Use the high bit of request ID for indicating resend requests +- fuse: Introduce a new notification type for resend pending requests +- fuse: add support for explicit export disabling +- config: enable FS_STACK at correct position +- mm: fix VMA heap bounds checking +- drm/nouveau: prime: fix ttm_bo_delayed_delete oops +- bus: mhi: host: Fix race between unprepare and queue_buf +- add enfs feature +- !16392 【olk 6.6】backport two bugfixes for hibmcge driver +- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() +- !16401 v7 Add FUSE Passthrough Support +- wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode +- fuse: config: enable FUSE_PASSTHROUGH and FS_STACK +- fs: use do_splice_direct() for nfsd/ksmbd server-side-copy +- fs: move file_start_write() into direct_splice_actor() +- fs: fork splice_file_range() from do_splice_direct() +- backing-file: convert to using fops->splice_write +- fuse: update inode size after extending passthrough write +- fs: pass offset and result to backing_file end_write() callback +- fuse: disable the combination of passthrough and writeback cache +- fs: fix __sb_write_started() kerneldoc formatting +- remap_range: merge do_clone_file_range() into vfs_clone_file_range() +- ovl: relax WARN_ON in ovl_verify_area() +- ovl: fix dentry reference leak after changes to underlying layers +- fuse: use exclusive lock when FUSE_I_CACHE_IO_MODE is set +- fuse: respect FOPEN_KEEP_CACHE on opendir +- fuse: verify zero padding in fuse_backing_map +- fuse: fix parallel dio write on file open in passthrough mode +- fuse: fix wrong ff->iomode state changes from parallel dio write +- fuse: implement passthrough for mmap +- fuse: implement splice read/write passthrough +- fuse: implement read/write passthrough +- fuse: implement open in passthrough mode +- fuse: prepare for opening file in passthrough mode +- fuse: implement ioctls to manage backing files +- fuse: introduce FUSE_PASSTHROUGH capability +- fuse: factor out helper for FUSE_DEV_IOC_CLONE +- fs: factor out backing_file_mmap() helper +- fs: factor out backing_file_splice_{read,write}() helpers +- fs: factor out backing_file_{read,write}_iter() helpers +- fs: prepare for stackable filesystems backing file helpers +- fs: create {sb,file}_write_not_started() helpers +- fs: create file_write_started() helper +- fs: create __sb_write_started() helper +- fs: move kiocb_start_write() into vfs_iocb_iter_write() +- fs: move permission hook out of do_iter_read() +- fs: move permission hook out of do_iter_write() +- fs: move file_start_write() into vfs_iter_write() +- coda: change locking order in coda_file_write_iter() +- btrfs: move file_start_write() to after permission hook +- remap_range: move file_start_write() to after permission hook +- remap_range: move permission hooks out of do_clone_file_range() +- splice: remove permission hook from iter_file_splice_write() +- splice: move permission hook out of splice_file_to_pipe() +- splice: move permission hook out of splice_direct_to_actor() +- splice: remove permission hook from do_splice_direct() +- ovl: add permission hooks outside of do_splice_direct() +- ovl: do not encode lower fh with upper sb_writers held +- ovl: do not open/llseek lower file with upper sb_writers held +- ovl: reorder ovl_want_write() after ovl_inode_lock() +- ovl: split ovl_want_write() into two helpers +- ovl: add helper ovl_file_modified() +- fs: store real path instead of fake path in backing file f_path +- fs: create helper file_user_path() for user displayed mapped file path +- fs: get mnt_writers count for an open backing file's real path +- ovl: protect copying of realinode attributes to ovl inode +- ovl: punt write aio completion to workqueue +- ovl: propagate IOCB_APPEND flag on writes to realfile +- ovl: use simpler function to convert iocb to rw flags +- fuse: allow parallel dio writes with FUSE_DIRECT_IO_ALLOW_MMAP +- fuse: introduce inode io modes +- fuse: prepare for failing open response +- fuse: break up fuse_open_common() +- fuse: allocate ff->release_args only if release is needed +- fuse: factor out helper fuse_truncate_update_attr() +- fuse: add fuse_dio_lock/unlock helper functions +- fuse: create helper function if DIO write needs exclusive lock +- fs: export mnt_{get,put}_write_access() to modules +- fs: rename __mnt_{want,drop}_write*() helpers +- jfs: reject on-disk inodes of an unsupported type +- cachefiles: Parse the "secctx" immediately +- PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type +- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo +- net: hibmcge: fix wrong ndo.open() after reset fail issue. +- net: hibmcge: fix incorrect statistics update issue +- sw64: adapt to the upstream changes in early_init_dt_(scan/verify) +- sw64: gpu: replace __sw_64__ with CONFIG_SW64 +- sw64: kprobe on ftrace: fix bug in restoring regs +- sw64: iommu: do real map on iova in 32bit mmio space +- mm: remove unnecessary calls to lru_add_drain +- cgroup: Eliminate the need for cgroup_mutex in proc_cgroup_show() +- !16374 LTS Conflicts Backport +- sw64: qspinlock: add CNA support for sw64 +- sw64: qspinlock: add PARAVIRT SPINLOCK support for sw64 +- sw64: gpu: memset_io and memcpy_toio/fromio for iomem on AMD swsmu +- Revert "sw64: gpu: memset_io and memcpy_toio/fromio for iomem on AMD swsmu" +- sw64: move syscall handling to sys_sw64.c +- sw64: improve sw64_rrk +- sw64: fix printing issue when using kprobe on ftrace +- sw64: add powercap driver +- sw64: clocksource: fix the issue of clockevents not being notified +- sw64: modify the interface for firmware to pass the running mode +- sw64: fix shared_cpu_map of L3 Cache +- sw64: fix SWVM_IRQS undeclared when enabling HIBERNATION +- sw64: kvm: optimize the compatibility of guest interrupt +- sw64: kvm: optimize the implementation of guest interrupt +- sw64: fix some compile issues for cpuautoplug.c +- sw64: cpufreq: fix for emulator that do not support cpufreq +- sw64: cpufreq: refactor cpufreq related code +- sw64: iommu: work around iova range check after resv_region +- sw64: gpu: fix SIMD IO access issues +- sw64: msi: fix guest msi interrupt handling +- sw64: msi: modify msi migration strategy +- sw64: msi: clear the residual vector_irq information of cpu +- sw64: ftrace: add notrace attribute to memset&memcpy +- sw64: ftrace: fix bug in restoring regs +- sw64: cpufreq: remove some meaningless code +- sw64: cpufreq: move cpufreq notifier to its user +- sw64: cpufreq: rename sw64_cpufreq.c to sunway-cpufreq.c +- sw64: cpufreq: remove debugfs code +- sw64: fix an error in BPF exception handling +- sw64: modify CPU autoplug initialization process +- sw64: iommu: print more info for interrupts +- sw64: msi: fix irq affinity setting during migration +- sw64: use CONFIG_HZ_PERIODIC by default +- sw64: fix specific performance counter error +- sw64: enable all HW PMUs for max sampling period events +- sw64: update exclusive counter handling +- sw64: fix perf event L1I cache write support +- sw64: locking/atomic: make atomic*_{cmp,}xchg optional +- sw64: sound: fix compile error when CONFIG_SND_DUMMY=y +- sw64: kexec: add support for crashkernel=size[KMG] +- sw64: bpf: add ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE to Kconfig +- sw64: ftrace: save&restore more stack frame in ftrace_caller +- sw64: enable -fsw-unalign-byte for new subarchs +- sw64: reduce jump instructions in entUna +- sw64: simplify GP handling for entUna +- sw64: fix secondary_cpu_start for CORE3B +- sw64: reimplement cmpxchg and xchg +- sw64: change condition of some cflags +- sw64: put cpu_set_node() in init text +- sw64: make sw64_(read/write)_csr always inline +- sw64: compile divide.S for c3b only +- sw64: vdso: add support for time namespaces +- sw64: rename PT_REGS_SP to PT_REGS_R30 +- sw64: modify parameters of the exception functions +- sw64: kvm: modify parameters of the exception functions +- sw64/vdso: Support mremap() for vDSO +- sw64/kvm: fix a bug for starting CORE3 VM +- sw64: ftrace: fix atomicity bugs in ftrace +- sw64: fix copy_oldmem_page according to upstream +- sw64: fix nmi_(enter/exit) error in CORE3B +- sw64: add a 1ms delay before CPU offline +- sw64: topology: discard topology information from PPTT +- sw64: iommu: implement resv_region APIs +- sw64: pci: fix secondary bus reset issue +- sw64: sound: avoid pagefault in pcm driver's memset +- sw64: flush TLB after modifying ptbr_sys +- sw64: fix an error when running no main() program +- sw64: cache: fix cache ID is not unique when ACPI disabled +- sw64: ftrace: implement ftrace_modify_call +- sw64: kvm: fix incorrect vm_flags in vmem_mmap() +- sw64: cpu: give preference to CPU information from SMBIOS +- sw64: irqchip: use sunway as vendor prefix in device tree +- sw64: irqchip: use pr_fmt instead of prefix string macro +- sw64: numa: decrease CONFIG_NODES_SHIFT to 3 +- sw64: acpi: suppress meaningless error log when acpi=off +- sw64: emulator: refactor shutdown and restart functions +- perf jitdump: Add SW64 support +- sw64: emulator: add shutdown and restart functions +- sw64: emulator: fix the multi-core boot issue +- sw64: fix bad address error for vfio +- sw64: acpi: add support for ACPI S3 +- sw64: iommu: restore iommu_map/unmap callbacks +- sw64: iommu: work around lazy translation initialization +- sw64: iommu: adjust def_domain_type +- sw64: iommu: fix iommu_v1 capability +- sw64: fix iommu commandline parameter +- sw64: iommu: remove unnecessary locking in map/unmap_pages +- sw64: fix no CONFIG_DYNAMIC_FTRACE_WITH_REGS error +- sw64: fix kprobe function +- sw64: perf: fix specific performance events can be sampled +- sw64: bpf: optimize JIT for load imm +- sw64: bpf: fix BPF_CALL JIT for multi-function programs +- sw64: bpf: optimize some instructions +- sw64: bpf: fix XADD32 and XADD64 +- sw64: kexec: fix a bug in menuconfig +- sw64: kexec: fix a compilation error +- sw64: iommu: mark hose->iommu_enable as true before probing +- sw64: iommu: fix work around of iommu interrupt remapping capability +- sw64: iommu: fix def_domain_type callback +- sw64: iommu: introduce PCI device check before iommu probing +- !16085 init/Kconfig: Add SMP to the dependencies of QOS_SCHED +- !16311 kernel: Remove signal hacks for vhost_tasks +- !16365 Add CFTYPE_NOT_ON_ROOT for qos_level +- !16364 gfp: include __GFP_NOWARN in GFP_NOWAIT +- eventfd:Introduce the eventfd batch processing interface +- !16369 ftrace: Add cond_resched() to ftrace_graph_set_hash() +- x86/ptrace: Fix kabi breakage in struct pt_regs +- x86/ptrace: Add FRED additional information to the pt_regs structure +- x86/ptrace: Cleanup the definition of the pt_regs structure +- ksmbd: Fix UAF in __close_file_table_ids +- ext4: ignore xattrs past end +- ftrace: Add cond_resched() to ftrace_graph_set_hash() +- !16367 scsi: sg: fix refcount underflow in +- scsi: sg: Enable runtime power management +- Revert "scsi: sg: Enable runtime power management" +- net: Fix kabi breakage in struct netlink_dump_control +- net: Fix kabi breakage in struct netlink_callback +- rtnetlink: add RTNL_FLAG_DUMP_UNLOCKED flag +- rtnetlink: change nlk->cb_mutex role +- Add CFTYPE_NOT_ON_ROOT for qos_level +- !16349 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.82-6.6.83 LTS Patches +- docs/core-api: memory-allocation: GFP_NOWAIT doesn't need __GFP_NOWARN +- gfp: include __GFP_NOWARN in GFP_NOWAIT +- !16359 net: hns3: some bugfixes for hns3 driver +- !16350 [OLK-6.6]Hygon: Address boot failures of CSV1/CSV2 VMs on Hygon 2g and C86-3g CPUs with firmware build ID below 1878 and 1810. +- !16281 【OLK-6.6】新增海光psp/ccp device id以及优化海光可信功能内核驱动 +- !16344 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y +- net: hns3: disable interrupt when ptp init failed +- net: hns3: avoid unnecessary checking when unmap buffer +- net: hns3: fix a use of uninitialized variable problem +- kbuild: userprogs: use correct lld when linking through clang +- pfifo_tail_enqueue: Drop new packet when sch->limit == 0 +- spi-mxs: Fix chipselect glitch +- x86/boot: Sanitize boot params before parsing command line +- x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' +- ima: Reset IMA_NONACTION_RULE_FLAGS after post_setattr +- x86/mm: Don't disable PCID when INVLPG has been fixed by microcode +- drm/i915/dsi: Use TRANS_DDI_FUNC_CTL's own port width macro +- ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage +- mm: hugetlb: Add huge page size param to huge_ptep_get_and_clear() +- iio: adc: at91-sama5d2_adc: fix sama7g5 realbits value +- iio: dac: ad3552r: clear reset status flag +- iio: filter: admv8818: Force initialization of SDO +- eeprom: digsy_mtc: Make GPIO lookup table match the device +- bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock +- drivers: core: fix device leak in __fw_devlink_relax_cycles() +- intel_th: pci: Add Panther Lake-P/U support +- intel_th: pci: Add Panther Lake-H support +- intel_th: pci: Add Arrow Lake support +- mei: me: add panther lake P DID +- cdx: Fix possible UAF error in driver_override_show() +- KVM: x86: Explicitly zero EAX and EBX when PERFMON_V2 isn't supported by KVM +- KVM: SVM: Suppress DEBUGCTL.BTF on AMD +- KVM: SVM: Drop DEBUGCTL[5:2] from guest's effective value +- usb: xhci: Enable the TRB overfetch quirk on VIA VL805 +- xhci: pci: Fix indentation in the PCI device ID definitions +- usb: gadget: Check bmAttributes only if configuration is valid +- usb: gadget: Fix setting self-powered state on suspend +- usb: gadget: Set self-powered based on MaxPower and bmAttributes +- usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality +- usb: typec: ucsi: increase timeout for PPM reset operations +- usb: dwc3: gadget: Prevent irq storm when TH re-executes +- usb: dwc3: Set SUSPENDENABLE soon after phy init +- usb: gadget: u_ether: Set is_suspend flag if remote wakeup fails +- usb: renesas_usbhs: Flush the notify_hotplug_work +- usb: typec: ucsi: Fix NULL pointer access +- usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader +- usb: hub: lack of clearing xHC resources +- usb: renesas_usbhs: Use devm_usb_get_phy() +- usb: renesas_usbhs: Call clk_put() +- gpio: rcar: Fix missing of_node_put() call +- net: dsa: mt7530: Fix traffic flooding for MMIO devices +- sched/fair: Fix potential memory corruption in child_cfs_rq_on_list +- ublk: set_params: properly check if parameters can be applied +- net-timestamp: support TCP GSO case for a few missing flags +- exfat: fix soft lockup in exfat_clear_bitmap +- x86/sgx: Fix size overflows in sgx_encl_create() +- vlan: enforce underlying device type +- ppp: Fix KMSAN uninit-value warning with bpf +- net: ipa: Enable checksum for IPA_ENDPOINT_AP_MODEM_{RX,TX} for v4.7 +- net: ipa: Fix QSB data for v4.7 +- net: ipa: Fix v4.7 resource group names +- be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink +- drm/sched: Fix preprocessor guard +- hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe() +- llc: do not use skb_get() before dev_queue_xmit() +- ALSA: usx2y: validate nrpacks module parameter on probe +- tracing: probe-events: Remove unused MAX_ARG_BUF_LEN macro +- hwmon: (ad7314) Validate leading zero bits and return error +- hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table +- hwmon: (pmbus) Initialise page count in pmbus_identify() +- caif_virtio: fix wrong pointer check in cfv_probe() +- net: gso: fix ownership in __udp_gso_segment +- bluetooth: btusb: Initialize .owner field of force_poll_sync_fops +- HID: google: fix unused variable warning under !CONFIG_ACPI +- wifi: iwlwifi: limit printed string from FW file +- mm: don't skip arch_sync_kernel_mappings() in error paths +- mm/page_alloc: fix uninitialized variable +- block: fix conversion of GPT partition name to 7-bit +- s390/traps: Fix test_monitor_call() inline assembly +- dma: kmsan: export kmsan_handle_dma() for modules +- rapidio: fix an API misues when rio_add_net() fails +- wifi: nl80211: reject cooked mode if it is set along with other flags +- Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected() +- Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name() +- mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr +- x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 +- x86/cpu: Validate CPUID leaf 0x2 EDX output +- x86/cacheinfo: Validate CPUID leaf 0x2 EDX output +- platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e +- drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M +- hwmon: (peci/dimmtemp) Do not provide fake thresholds data +- ALSA: hda/realtek: update ALC222 depop optimize +- ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform +- ALSA: hda: intel: Add Dell ALC3271 to power_save denylist +- ALSA: seq: Avoid module auto-load handling at event delivery +- gpio: rcar: Use raw_spinlock to protect register access +- ksmbd: fix bug on trap in smb2_lock +- ksmbd: fix use-after-free in smb2_lock +- ksmbd: fix type confusion via race condition when using ipc_msg_send_request +- LoongArch: Set max_pfn with the PFN of the last page +- LoongArch: Use polling play_dead() when resuming from hibernation +- LoongArch: Convert unreachable() to BUG() +- tracing: tprobe-events: Fix a memory leak when tprobe with $retval +- !16325 perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init +- !16326 mfd: ene-kb3930: Fix a potential NULL pointer dereference +- crypto: ccp: Fix for potential memory Out-of-Bounds access due to insufficient array size +- !16324 LoongArch: add PCA953X/2K3000 GMAC/IGC netcard/NR_CPUS=2048/SCHED_MC support +- !16352 [OLK-6.6] Fix sxe compile errors without CONFIG_PM_SLEEP +- Linkdata：net：fix sxe compile errors 'sxe_resume' defined but not used +- !16280 Add Loongson PWM controller support +- !16279 crypto: loongson: add wst se chip support +- riscv: cacheinfo: Use of_property_present() for non-boolean properties +- riscv: Prevent a bad reference count on CPU nodes +- riscv: cacheinfo: initialize cacheinfo's level and type from ACPI PPTT +- riscv: cacheinfo: remove the useless input parameter (node) of ci_leaf_init() +- NFS: O_DIRECT writes must check and adjust the file length +- x86/speculation: Add __update_spec_ctrl() helper +- net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC +- net: enetc: Replace ifdef with IS_ENABLED +- net: enetc: Remove setting of RX software timestamp +- drm/amdgpu: disable BAR resize on Dell G5 SE +- drm/amdgpu: Check extended configuration space register when system uses large bar +- smb: client: fix chmod(2) regression with ATTR_READONLY +- drm/i915/ddi: Fix HDMI port width programming in DDI_BUF_CTL +- drm/i915/xe2lpd: Move D2D enable/disable +- efi: Don't map the entire mokvar table to determine its size +- x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() +- !16342 v5 Memory access profiler(SPE) driven NUMA balancing and damon +- !16302 IMA: support virtcca extend assigned register +- !15384 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.63-6.6.64 LTS Conflicts Patches +- !16229 drivers/iommu: Enhance the robustness of the iommu module +- KVM: SVM: CSV is unsupported if both the firmware with a build ID < 1878 and SME is not in use +- KVM: SVM: The ASID range available for CSV2 guests vary across different firmware +- yt6801: Add Motorcomm yt6801 PCIe driver +- !16328 drm/amd/display: prevent hang on link training fail +- !16310 ocfs2: validate l_tree_depth to avoid out-of-bounds access +- IMA: support virtcca extend assigned register +- nvme-tcp: fix premature queue removal and I/O failover +- config: Enable memory sampling based pmu for numa balance and damon by default +- arm-spe: Export boost SPE sampling info via tracefs tracepoint +- arm-spe: Add kernel cmdline option to enable SPE boost +- arm-spe: Boost SPE add TLB hot page and remote access tracking +- mm/damon/vaddr: Add demotion interface for migrating cold pages to target nodemask +- mm/damon/vaddr: Extend mem_sampling sysctl to support DAMON +- mm/damon/vaddr: Support hardware-assisted memory access sampling +- mm/numa: Add tracepoints for access sampling and NUMA page migration +- mm/mem_sampling: Add sysctl control for NUMA balancing integration +- mm/numa: Enable mem_sampling-based access tracking for NUMA balancing +- mm/numa: Use mem_sampling framework for NUMA balancing +- mm/mem_sampling:: Add proc and cmdline interface to control sampling enable +- sched: Enable per-process mem_sampling from sched switch path +- mm/mem_sampling: Add sched switch hook to control sampling state +- mm/mem_sampling: Add eBPF interface for memory access tracing +- mm_monitor/mm_spe: Introduce arm_spe_user to abstract SPE usage +- mm_monitor/mm_spe: Add PMU based memory sampling abstract layer +- mm_monitor/mm_spe: Init per-CPU buffers and SPE state +- mm_monitor/mm_spe: Introduce standalone SPE profiling framework +- !16323 bpf: Fix WARN() in get_bpf_raw_tp_regs +- !16286 arm64: Add support for FEAT_{LS64, LS64_V}. +- !12573 [OLK-6.6] Fix rnpvf compile errors without CONFIG_MXGBEVF_FIX_VF_QUEUE +- !15434 Backport PRM update and bugfixes up to v6.14. +- !16278 drm: LoongArch: fix rx550/gfx6/gfx7/gfx8 error +- drm/amd/display: prevent hang on link training fail +- mfd: ene-kb3930: Fix a potential NULL pointer dereference +- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init +- LoongArch: Prevent cond_resched() occurring within kernel-fpu +- LoongArch: 2K3000 GMAC support. +- LoongArch: Add SCHED_MC (Multi-core scheduler) support +- LoongArch: Enable GPIO_PCA953X driver +- LoongArch: Enable IGC driver +- LoongArch: CONFIG_NR_CPUS expanded to 2048 +- bpf: Fix WARN() in get_bpf_raw_tp_regs +- !16298 v2 CVE-2024-58098 +- !16218 bpf: Fix kmemleak warning for percpu hashmap +- !16217 bpf: Fix deadlock between rcu_tasks_trace and event_mutex. +- PCI: Fix reference leak in pci_register_host_bridge() +- KVM: arm64: Enable FEAT_{LS64, LS64_V} in the supported guest +- Workaround the issue when compile with CONFIG_FUNCTION_ALIGNMENT_64B +- arm64: Add support for FEAT_{LS64, LS64_V} +- arm64: Provide basic EL2 setup for FEAT_{LS64, LS64_V} usage at EL0/1 +- !16300 【olk 6.6】 add two bugfixes for ptp_hisi driver +- binfmt_elf: Wire up AT_HWCAP3 at AT_HWCAP4 +- uapi/auxvec: Define AT_HWCAP3 and AT_HWCAP4 aux vector, entries +- arm64: Support AT_HWCAP3 +- kernel: Remove signal hacks for vhost_tasks +- ocfs2: validate l_tree_depth to avoid out-of-bounds access +- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key +- ptp: hisi: the print of element in ptp need protected by lock +- ptp: hisi: fix list not delete problem +- !15157 Add support edac for hygon family 18h model 10h +- !15155 Add LS and IF mce types for Hygon family 18h model 7h +- bpf: Fix kabi breakage in struct bpf_subprog_info +- selftests/bpf: test for changing packet data from global functions +- bpf: track changes_pkt_data property for global functions +- bpf: refactor bpf_helper_changes_pkt_data to use helper number +- bpf: add find_containing_subprog() utility function +- crypto: ccp: add new pci device id and modify psp_do_cmd() interface to not rely on sev device +- !16271 kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0 +- !16284 Sync from 6.6 for the sam kabi +- bcache: call force_wake_up_gc() if necessary in check_should_bypass() +- !15291 [Intel-SIG]dmaengine: idxd: Add a new DSA device ID for Granite Rapids-D platform +- !16277 Revert DP HPD module to fix the problem +- tracing: Return from tracing_buffers_read() if the file has been closed +- trace: Fix kabi breakage in struct trace_iterator +- ring-buffer: Make wake once of ring_buffer_wait() more robust +- tracing/ring-buffer: Fix wait_on_pipe() race +- !16192 drivers/yunsilicon: fix query/modify pkt_dst_info return error +- !16180 PINCTRL:ENABLE_CONFIG_PINCTRL for resolve Intel notebook touchpad issue; fw, net: wireless: Add RTW88 driver and compressed firmware support +- !16231 LoongArch: Return NULL from huge_pte_offset() for invalid PMD +- !16256 CVE-2025-21916 +- !16257 CVE-2025-21950 +- Revert "drm/sysfs: Register "ddc" symlink later" +- Revert "drm/ast: Implement polling for VGA and SIL164 connectors" +- Revert "drm: Call drm_atomic_helper_shutdown() at shutdown time for misc drivers" +- Revert "drm/hisilicon/hibmc: select CONFIG_DRM_DISPLAY_DP_HELPER" +- Revert "drm/hisilicon/hibmc: Restructuring the header dp_reg.h" +- Revert "drm/hisilicon/hibmc: Add dp serdes cfg to adjust serdes rate, voltage and pre-emphasis" +- Revert "drm/hisilicon/hibmc: Add dp serdes cfg in dp process" +- Revert "drm/hisilicon/hibmc: Refactor the member of drm_aux in struct hibmc_dp" +- Revert "drm/hisilicon/hibmc: Getting connector info and EDID by using AUX channel" +- Revert "drm/hisilicon/hibmc: Add colorbar-cfg feature and its debugfs file" +- Revert "drm/hisilicon/hibmc: Enable this hot plug detect of irq feature" +- Revert "drm/hisilicon/hibmc: Add MSI irq getting and requesting for HPD" +- Revert "drm/hisilicon/hibmc: Add vga connector detect functions" +- Revert "drm/hisilicon/hibmc: fix HPD interrupts triggering the wrong behavior" +- Revert "drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local" +- pwm: Add Loongson pwm driver support +- dt-bindings: pwm: Add Loongson PWM controller +- crypto: loongson: add wst se chip support +- drm/amdgpu: Fix RX550 pcie order dislocation. +- drm/amdgpu: make duplicated EOP packet for GFX6 have real content +- drm/amdgpu: make duplicated EOP packet for GFX7/8 have real content +- drm/radeon: repeat the same EOP packet for EOP workaround on CIK +- drm/amdgpu: Fix pcie order dislocation +- !16039 [OLK-6.6] 优化海光密钥管理虚拟化场景的性能 +- !16233 usb: chipidea: ci_hdrc_imx: fix usbmisc handling +- virtiofs: add filesystem context source name check +- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0 +- !16208 Fix CVE-2025-37860 +- !16189 jfs: Fix uninit-value access of imap allocated in the diMount() function +- drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl +- usb: atm: cxacru: fix a flaw in existing endpoint checks +- !16183 xhci: Limit time spent with xHC interrupts disabled during bus resume +- !16193 net: libwx: handle page_pool_dev_alloc_pages error +- !16224 backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() +- !16198 Fix CVE-2025-37830 +- sfc: fix NULL dereferences in ef100_process_design_param() +- !16174 Add gpio-hisi softdepend +- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result +- usb: chipidea: ci_hdrc_imx: fix usbmisc handling +- LoongArch: Return NULL from huge_pte_offset() for invalid PMD +- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() +- media: vimc: skip .s_stream() for stopped entities +- media: subdev: Add v4l2_subdev_is_streaming() +- media: subdev: Improve v4l2_subdev_enable/disable_streams_fallback +- media: subdev: Fix use of sd->enabled_streams in call_s_stream() +- drivers/iommu: Enhance the robustness of the iommu module +- driver/vfio: disable vfio pci intx +- drivers/iommu: Define the alias of the iommu device +- loongarch/configs: enable vfio mdev config +- drivers/iommu: Add the "iommu disable" probe +- !16196 net/hinic3: Synchronize new NIC features and bug fixes +- f2fs: fix potential deadloop in prepare_compress_overwrite() +- bpf: Fix kmemleak warning for percpu hashmap +- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. +- ax25: Remove broken autobind +- ibmvnic: Use kernel helpers for hex dumps +- !16165 vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp +- !12616 [OLK-6.6] fix bug：compiler error on loongarch64 for mucse rnpm driver +- !16186 【olk 6.6】net: hns3: backport some bugfixes +- !15158 Add support for Hygon family 18h model 8h +- !14328 Fixed multiple vfio devices not working properly +- !16081 Revert "LoongArch: Set hugetlb mmap base address aligned with pmd size" +- !16024 [OLK-6.6][bugfix]Hygon: Remove HYDCU fixup header driver from kernel source code +- !16026 [OLK-6.6]Hygon: In a CSV3 VM, the hypercall should notify real page enc/dec status +- !16025 [OLK-6.6][bugfix]Hygon：Avoid concurrent pinning shared pages at both KVM side and vfio side when passthrough device to CSV3 VM +- !16020 [OLK-6.6]Backport some mm related commits from Linux upstream +- !16019 [OLK-6.6][bugfix]Hygon: Return 0 at the beginning of csv_guest_hygon_coco_extension() for non-CSV3 VMs +- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() +- net/hinic3: Synchronize new NIC features and bug fixes +- drivers/yunsilicon: fix query/modify pkt_dst_info return error +- net: libwx: handle page_pool_dev_alloc_pages error +- jfs: Fix uninit-value access of imap allocated in the diMount() function +- xhci: Limit time spent with xHC interrupts disabled during bus resume +- Add gpio-hisi softdepend +- net: hns3: defer calling ptp_clock_register() +- net: hns3: fixed debugfs tm_qset size +- net: hns3: fix an interrupt residual problem +- net: hns3: store rx VLAN tag offload state for VF +- KVM: x86/svm: Add hygon_set_guest_pat_wb parameter for non-passthrough application scenarios +- !16087 CVE-2025-21979 +- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp +- !16102 V3:mm: shmem: skip swapcache for swapin of synchronous swap device +- !16144 [openEuler-24.03-LTS-SP2] drivers: update Yunsilicon drivers to 2412GA +- !16101 scsi: qla1280: Fix kernel oops when debug level > 2 +- !16103 md/raid1,raid10: don't ignore IO flags +- !16055 mailbox: pcc: Always clear the platform ack interrupt first +- !16143 Revert "tmpfs: fault in smaller chunks if large folio allocation not allowed" +- !16108 mm: zswap: handle incorrect attempts to load large folios +- !16075 mpage: fix softlockup in mpage_readahead() +- !16079 v2 tracing: Verify event formats that have "%*p.." +- Revert "tmpfs: fault in smaller chunks if large folio allocation not allowed" +- !16117 PCI: brcmstb: Fix error path after a call to regulator_bulk_get() +- !16116 spufs: fix gang directory lifetimes +- drivers: update Yunsilicon drivers to version rel_2412_std_card +- mailbox: pcc: Always clear the platform ack interrupt first +- mailbox: pcc: Fix the possible race in updation of chan_in_use flag +- !16099 fs/resctrl: Create l2 cache monitors +- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() +- spufs: fix gang directory lifetimes +- !15719 vdpa/iommufd: Support taking over vDPA devices' iommu groups through the iommufd API +- !14169 [OLK-6.6] Fix rnp errors dmesg show in hygon +- !14174 [OLK-6.6] Fix os crash when cat some sys interface when net down +- !14100 [OLK-6.6] mucse: rnpm ocp nic support hotplug and show sub-zero temperature +- !16080 PCI/ASPM: Fix link state exit during switch upstream function removal +- !16074 x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs +- !16073 acpi: nfit: fix narrowing conversion in acpi_nfit_ctl +- !15908 soc: qcom: pdr: Fix the potential deadlock +- !16094 ksmbd: fix session use-after-free in multichannel connection +- mm: zswap: handle incorrect attempts to load large folios +- md/raid1,raid10: don't ignore IO flags +- !16086 media: streamzap: fix race between device disconnection and urb callback +- mm: shmem: skip swapcache for swapin of synchronous swap device +- mm: swap: remove 'synchronous' argument to swap_read_folio() +- vhost/vdpa: Add support to bind and attach iommufd +- scsi: qla1280: Fix kernel oops when debug level > 2 +- !15897 Two backport bugfix patches +- !15948 mm/huge_memory: drop beyond-EOF folios with the right number of refs +- arm64/mpam: Refuse to enter powerdown state after L2 msc updated +- arm64/mpam: Refuse cpu offline when L2 msc is enabled +- fs/resctrl: Add l2 mount option to enable L2 msc +- arm64: mpam: Restore the expected MPAM sysregs on cpuhp +- arm64: mpam: Add cpu_pm notifier to restore MPAM sysregs +- fs/resctrl: Create l2 cache monitors +- x86/resctrl: Add a handling path of default label in get_arch_mbm_state() +- ksmbd: fix session use-after-free in multichannel connection +- !16034 swap-in support large folio +- !15994 ksmbd: fix use-after-free in ksmbd_sessions_deregister() +- !16066 rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy +- !16062 arm64/mpam: Expanding MPAM's QoS capability +- !16053 jfs: add check read-only before truncation in jfs_truncate_nolock() +- !16037 ext4: fix the logic to determine whether buffered IO can use iomap +- wifi: cfg80211: init wiphy_work before allocating rfkill fails +- wifi: cfg80211: cancel wiphy_work before freeing wiphy +- media: streamzap: fix race between device disconnection and urb callback +- !15986 RDMA/hns: Fix the compatibility between the kernel mode and user mode +- init/Kconfig: Add SMP to the dependencies of QOS_SCHED +- Revert "LoongArch: Set hugetlb mmap base address aligned with pmd size" +- PCI/ASPM: Fix link state exit during switch upstream function removal +- tracing: Verify event formats that have "%*p.." +- mpage: fix softlockup in mpage_readahead() +- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs +- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl +- !16045 irqchip/mbigen: add check before deference 'mgn_chip' +- rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy +- arm64/mpam: Add limit feature +- arm64/mpam: Add PRIO feature +- arm64/mpam: Add mbw_min and cmin features +- arm64/mpam: Add CMAX feature +- fs/resctrl: As a pre-patch for expanding MPAM's QoS capability +- perf/x86/uncore: Add DF PMU support for Hygon family 18h model 8h +- soc: hisilicon: kunpeng_hccs: Fix incorrect string assembly +- jfs: add check read-only before truncation in jfs_truncate_nolock() +- !15887 LoongArch: sync internal repository 20250414 +- !15937 md/raid1: fix memleak and double free in +- irqchip/mbigen: add check before deference 'mgn_chip' +- crypto: ccp: Support vpsp ringbuffer overcommit +- ext4: fix the logic to determine whether buffered IO can use iomap +- mm: add per-order mTHP swap-in fallback/fallback_charge counters +- mm: add per-order mTHP swpin counters +- mm: fix PSWPIN counter for large folios swap-in +- mm: remove unused stub for can_swapin_thp() +- mm: zswap: fix zswap_never_enabled() for CONFIG_ZSWAP==N +- mm: support large folios swap-in for sync io devices +- mm: add nr argument in mem_cgroup_swapin_uncharge_swap() helper to support large folios +- mm: zswap: add zswap_never_enabled() +- mm: convert swap_cluster_readahead and swap_vma_readahead to return a folio +- mm: return a folio from read_swap_cache_async() +- mm: remove page_swap_info() +- mm: convert swap_readpage() to swap_read_folio() +- mm: convert swap_page_sector() to swap_folio_sector() +- mm: pass a folio to swap_readpage_bdev_async() +- mm: pass a folio to swap_readpage_bdev_sync() +- mm: pass a folio to swap_readpage_fs() +- mm: pass a folio to swap_writepage_bdev_async() +- mm: pass a folio to swap_writepage_bdev_sync() +- mm: pass a folio to swap_writepage_fs() +- mm: pass a folio to __swap_writepage() +- mm: return the folio from __read_swap_cache_async() +- crypto: ccp: Use a workqueue to clean up the vpsp ringbuffer +- crypto: ccp: move vpsp-related functions to vpsp.c +- !15931 CVE-2025-22113 +- !16023 CVE-2025-22121 +- x86/kvm: Don't hypercall to enc all usable RAM on CSV3 platform +- KVM: SVM: CSV: fix CSV3 launch failures because of concurrent longterm pin +- Revert "drm/hygon: Add support to passthrough Hygon DCU to virtual machine" +- Revert "x86/config: Set CONFIG_HYDCU_FIXUP_HEADER=y by default" +- ext4: Restore the deleted check paths of the xattr. +- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() +- ext4: introduce ITAIL helper +- !15918 [OLK-6.6] 从上游linux-6.6.y回合nvme驱动重要bugfix +- !15589 [OLK-6.6] Ethernet: Supports Linkdata ethernet Controllers +- !15962 LoongArch: BPF: Don't override subprog's return value +- !16007 compile error: implicit declaration of +- mm/hugetlb: wait for hugetlb folios to be freed +- mm: replace free hugepage folios after migration +- mm/cma: using per-CMA locks to improve concurrent allocation performance +- KVM: SEV: Use long-term pin when registering encrypted memory regions +- Revert "KVM: SEV: Pin SEV guest memory out of CMA area" +- KVM: SVM: CSV: Return 0 at the beginning of csv_guest_hygon_coco_extension() for non-CSV3 VMs +- kvm: hisi_virt: Fix compilation error due to missing ACPI configuration +- !15981 LoongArch: BPF: Fix off-by-one error in build_prologue() +- !15935 HID: appleir: Fix potential NULL dereference at raw event handle +- !15988 fs/resctrl: Fix configuration to wrong control group when CDP is enabled +- ksmbd: fix use-after-free in ksmbd_sessions_deregister() +- !15970 erofs/cachefiles: Change the unmark inuse sequence in erofs ondemand mode +- !15987 v12 Add support for IPIv +- fs/resctrl: Fix configuration to wrong control group when CDP is enabled +- arm64/mpam: Add debugging information about CDP monitor value +- arm64/mpam: Fix allocated cache size information +- fs/resctrl: Fix kmemleak caused by closid_init() +- arm64/mpam: Correct the judgment condition of the CMAX feature +- arm64/mpam: Set the cpbm width of msc class with the minimum +- fs/resctrl: Determine whether the MBM monitors require overflow checking +- arm64/mpam: Optimize CSU/MBWU monitor multiplexing +- arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() +- arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() +- arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() +- kabi: Use KABI_EXTEND to perform kabi repair for IPIV +- kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 +- kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE +- kvm: hisi_virt: Register ipiv exception interrupt +- irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule +- kvm: arm64: avoid sending multi-SGIs in IPIV +- kvm: hisi_virt: Allocate VM table and save vpeid in it +- RDMA/hns: Fix the compatibility between the kernel mode and user mode +- !15980 ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans +- !15979 thermal: int340x: Add NULL check for adev +- !15921 Support SMT control on arm64. +- !15975 perf/x86: Fix open counting event error +- LoongArch: BPF: Fix off-by-one error in build_prologue() +- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans +- thermal: int340x: Add NULL check for adev +- !15968 v3 Backport mainline patches to avoid crash caused by rsize being 0 +- !15960 iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() +- !15974 RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers +- !15952 ksmbd: validate zero num_subauth before sub_auth is accessed +- !15950 drm/hyperv: Fix address space leak when Hyper-V DRM device is removed +- perf/x86: Fix open counting event error +- RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers +- erofs/cachefiles: Change the unmark inuse sequence in erofs ondemand mode +- smb: client: Update IO sizes after reconnection +- smb: client: Store original IO parameters and prevent zero IO sizes +- smb:client: smb: client: Add reverse mapping from tcon to superblocks +- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0" +- !15958 cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() +- !15916 LoongArch: Increase ARCH_DMA_MINALIGN up to 16 +- !15961 drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr +- !15945 crypto: hisilicon - some bugfix +- LoongArch: BPF: Don't override subprog's return value +- drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr +- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() +- !15929 arm_mpam: Add SMMU support for MPAM +- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() +- !15793 CVE-2025-21892 +- !15795 CVE-2025-21941 +- ksmbd: validate zero num_subauth before sub_auth is accessed +- drm/hyperv: Fix address space leak when Hyper-V DRM device is removed +- mm/huge_memory: drop beyond-EOF folios with the right number of refs +- !15871 v2 CVE-2024-57795 +- !15906 [OLK-6.6] drm/hisilicon/hibmc: some bugfixes for hibmc-drm driver +- !15834 uacce: fix for the numa distance calculation +- crypto: hisilicon/qm - disable error report before flr +- hisi_acc_vfio_pci: obtain the mailbox configuration at one time +- crypto: hisilicon/qm - obtain the mailbox configuration at one time +- crypto: hisilicon/qm - fix the pf2vf timeout when global reset +- crypto: hisilicon/qm - modify interrupt processing resource application +- crypto: hisilicon/qm - mask axi error before memory init +- crypto: hisilicon/qm - invalidate queues in use +- crypto: hisilicon/sec2 - fix memory use-after-free issue +- crypto: hisilicon/sec2 - fix for gcm spec check +- crypto: hisilicon/hpre - fix dma unmap sequence +- !15936 ASoC: imx-card: Add NULL check in imx_card_probe() +- !15922 mm: shmem: fix potential data corruption during shmem swapin +- !15924 mm/vmscan: drop checking if _deferred_list is empty before using TTU_SYNC +- !15913 block: fix resource leak in blk_register_queue() error path +- md/raid1: fix memory leak in raid1_run() if no active rdev +- md/raid1: don't free conf on raid0_run failure +- ASoC: imx-card: Add NULL check in imx_card_probe() +- !15923 RDMA/hns :Add some mainline patches to OLK-6.6 +- HID: appleir: Fix potential NULL dereference at raw event handle +- ext4: avoid journaling sb update on error if journal is destroying +- ext4: define ext4_journal_destroy wrapper +- iommu: Fix kabi broken of struct iommu_ops +- fs/resctrl: Move iommu_groups back when their associated RDT group is deleted +- fs/resctrl: Fix the iommu_group parsing process +- iommu/arm-smmu-v3: Check pointer valid before dereferencing it +- arm_mpam: Select CONFIG_RESCTRL_IOMMU on the ARM64 by default +- ACPI/MPAM: Parse the rest of the ACPI table +- fs/resctrl: Add support for assigning iommu_groups to resctrl groups +- arm_mpam: resctrl: Add iommu helpers to get/set the partid and pmg +- kobject: Add kset_get_next_obj() to allow a kset to be walked +- iommu: Add helper to retrieve iommu kset +- iommu: Add helpers to retrieve iommu_groups by id or kobject +- iommu: Add helpers to get and set the QoS state +- iommu/arm-smmu-v3: Add mpam helpers to query and set state +- iommu/arm-smmu-v3: Issue a batch of commands to the same cmdq +- iommu/arm-smmu-v3: Register SMMU capabilities with MPAM +- mm: fix filemap_get_folios_contig returning batches of identical folios +- mm: shmem: fix potential data corruption during shmem swapin +- mm/vmscan: drop checking if _deferred_list is empty before using TTU_SYNC +- RDMA/hns: Fix wrong maximum DMA segment size +- Revert "RDMA/hns: fix iommu_map_sg() failed when MR bigger than 4G" +- RDMA/hns: initialize db in update_srq_db() +- RDMA/hns: Remove unused parameters +- config: enable CONFIG_HOTPLUG_SMT for arm64 +- arm64: Kconfig: Enable HOTPLUG_SMT +- arm64: topology: Support SMT control on ACPI based system +- arch_topology: Support SMT control for OF based system +- cpu/SMT: Provide a default topology_is_primary_thread() +- Revert "arm64: Kconfig: Enable HOTPLUG_SMT" +- nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch +- nvme-tcp: fix possible UAF in nvme_tcp_poll +- !15904 v2 PCI: AER: fix deadlock in do_recovery +- !15910 v2 soc cache: Add support for HiSilicon L3 cache +- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 +- block: fix resource leak in blk_register_queue() error path +- drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local +- drm/hisilicon/hibmc: fix HPD interrupts triggering the wrong behavior +- !15909 coresight: tmc: Don't change the buffer size if it's in use +- soc cache: Modify default config to compile HiSilicon SoC cache driver +- soc cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent +- soc cache: Add framework driver for HiSilicon SoC cache +- coresight: tmc: Don't change the buffer size if it's in use +- soc: qcom: pdr: Fix the potential deadlock +- PCI: AER: fix deadlock in do_recovery +- !15863 Some mainline patches merged into olk-6.6: drivers/hwmon +- !15812 rapidio: add check for rio_add_net() in rio_scan_alloc_net() +- !15821 LoongArch: Set hugetlb mmap base address aligned with pmd size +- !15882 Updates for HiSilicon L3C PMU driver +- drivers/pci: Enable pci bridge acs capability +- driver/iommu: Set iommu driver buildin kernel +- LoongArch: Revert "LoongArch: Fix cpu hotplug issue" +- LoongArch: KVM: Repair the restart pressure test virtual machine hang dead problem +- LoongArch:config: enable pci host controller fdt driver +- selftests: mincore: fix tmpfs mincore test failure +- !15886 Add HPD, getting EDID, colorbar features in DP function +- !15851 migration: adapt to new migration configuration +- LoongArch: Export some signal functions +- LoongArch: Make some signal and ptrace functions non-static +- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols +- LoongArch: Preserve firmware configuration if ACPI requires. +- LoongArch: configs: enable some configs +- LoongArch: configs: set CONFIG_UNWINDER_ORC=y +- LoongArch: configs: Disable CONFIG_RT_GROUP_SCHED to prevent cgroup2 issues +- objtool: Fix C jump table annotations for Clang +- drm/hisilicon/hibmc: Add vga connector detect functions +- drm/hisilicon/hibmc: Add MSI irq getting and requesting for HPD +- drm/hisilicon/hibmc: Enable this hot plug detect of irq feature +- drm/hisilicon/hibmc: Add colorbar-cfg feature and its debugfs file +- drm/hisilicon/hibmc: Getting connector info and EDID by using AUX channel +- drm/hisilicon/hibmc: Refactor the member of drm_aux in struct hibmc_dp +- drm/hisilicon/hibmc: Add dp serdes cfg in dp process +- drm/hisilicon/hibmc: Add dp serdes cfg to adjust serdes rate, voltage and pre-emphasis +- drm/hisilicon/hibmc: Restructuring the header dp_reg.h +- drm/hisilicon/hibmc: select CONFIG_DRM_DISPLAY_DP_HELPER +- drm: Call drm_atomic_helper_shutdown() at shutdown time for misc drivers +- drm/ast: Implement polling for VGA and SIL164 connectors +- drm/sysfs: Register "ddc" symlink later +- !15612 Some trivial cleanups for shmem +- drivers/perf: hisi: Add support for L3C PMU v3 +- drivers/perf: hisi: Refactor the event configuration of L3C PMU +- drivers/perf: hisi: Extend the field of tt_core +- drivers/perf: hisi: Extract the event filter check of L3C PMU +- drivers/perf: hisi: Simplify the probe process of each L3C PMU version +- drivers/perf: hisi: Export hisi_uncore_pmu_isr() +- drivers/perf: hisi: Relax the event ID check in the framework +- !15872 【olk 6.6】backport some bugfixes for hibmcge driver +- !15852 Fix CVE-2025-22013 +- !15845 regulator: check that dummy regulator has been probed before using it +- !15854 perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12 +- !15838 General updates of HiSilicon PMU drivers +- hwmon: (acpi_power_meter) Replace the deprecated hwmon_device_register +- hwmon: Fix the missing of 'average' word in hwmon_power_attr_templates +- hwmon: (acpi_power_meter) Ensure IPMI space handler is ready on Dell systems +- ACPI: IPMI: Add helper to wait for when SMI is selected +- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests +- RDMA/rxe: Remove the direct link to net_device +- net: hibmcge: fix multiple phy_stop() issue +- net: hibmcge: fix not restore rx pause mac addr after reset issue +- net: hibmcge: fix the incorrect np_link fail state issue. +- net: hibmcge: fix wrong mtu log issue +- net: hibmcge: fix the share of irq statistics among different network ports issue +- net: hibmcge: fix incorrect multicast filtering issue +- net: hibmcge: fix incorrect pause frame statistics issue +- Ethernet: Linkdata: Supports Linkdata ethernet Controllers +- migration: adapt to new migration configuration +- migration: qm updates BAR configuration +- migration: update BAR space size +- hisi_acc_vfio_pci: update function return values +- hisi_acc_vfio_pci: bugfix live migration function without VF device driver +- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver +- hisi_acc_vfio_pci: bugfix cache write-back issue +- hisi_acc_vfio_pci: add eq and aeq interruption restore +- hisi_acc_vfio_pci: fix XQE dma address error +- !15839 ext4: Some zeroing fixes +- perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12 +- arm64/fpsimd: Remove unused declaration fpsimd_kvm_prepare() +- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state +- !15321 printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX +- regulator: check that dummy regulator has been probed before using it +- !15826 nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() +- !15754 v3 Support the FEAT_HDBSS introduced in Armv9.5 +- jbd2: fix off-by-one while erasing journal +- iomap: do not interrupt IOMAP_ZERO +- ext4: fix potential memory exposure issues during truncate in iomap mode. +- ext4: do not always order data when partial zeroing out a block +- mm: zero range of eof folio exposed by inode size extension +- mm: convert pagecache_isize_extended to use a folio +- ext4: goto right label 'out_mmap_sem' in ext4_setattr() +- drivers/perf: hisi: Add support for HiSilicon MN PMU driver +- drivers/perf: hisi: Add support for HiSilicon NoC PMU +- drivers/perf: hisi: Support PMUs with no interrupt +- drivers/perf: hisi: Relax the event number check of v2 PMUs +- drivers/perf: hisi: Add support for HiSilicon SLLC v3 PMU driver +- drivers/perf: hisi: Use ACPI driver_data to retrieve SLLC PMU information +- drivers/perf: hisi: Add support for HiSilicon DDRC v3 PMU driver +- drivers/perf: hisi: Simplify the probe process for each DDRC version +- drivers/perf: hisi: Delete redundant blank line of DDRC PMU +- drivers/perf: hisi: Fix incorrect variable name "hha_pmu" in DDRC PMU driver +- drivers/perf: hisi: Export associated CPUs of each PMU through sysfs +- drivers/perf: hisi: Provide a generic implementation of cpumask/identifier +- drivers/perf: hisi: Add a common function to retrieve topology from firmware +- drivers/perf: hisi: Extract topology information to a separate structure +- drivers/perf: hisi: Refactor the detection of associated CPUs +- drivers/perf: hisi: Migrate to one online CPU if no associated one online +- drivers/perf: hisi: Don't update the associated_cpus on CPU offline +- drivers/perf: hisi: Define a symbol namespace for HiSilicon Uncore PMUs +- !15827 perf stat: Enable iostat mode for HiSilicon PCIe PMU +- !15072 hisilicon: ACC Live Migration DFX Replacement Mainline Solution +- x86: openeuler_defconfig add CONFIG_VFIO_DEBUGFS=y +- arm64: openeuler_defconfig add CONFIG_VFIO_DEBUGFS=y +- PINCTRL:ENABLE_CONFIG_PINCTRL_AMD +- perf stat: Enable iostat mode for HiSilicon PCIe PMU +- LoongArch: KVM: Add interrupt checking with Loongson AVEC +- LoongArch: KVM: Reload guest CSR registers after S4 +- anolis: LoongArch: KVM: add virt extioi cpu encode support +- anolis: LoongArch: KVM: Fixed VM migration failure after ptw was enabled +- anolis: LoongArch: KVM: Add reset function for irqchip +- anolis: LoongArch: LSVZ: Clear LLBCTL if secondary mmu mapping is changed +- anolis: driver/iommu: Fixed multiple vfio devices not working properly +- anolis: LoongArch: KVM: enable ptw for kvm +- anolis: LoongArch: fix compile error when enable CONFIG_PARAVIRT +- vfio: fix kabi breakage due to struct vfio_device and enum vfio_device_mig_state +- Documentation: add debugfs description for vfio +- Documentation: add debugfs description for hisi migration +- MAINTAINERS: Add vfio debugfs interface doc link +- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() +- MAINTAINERS: add Baolin as shmem reviewer +- mm: shmem: factor out the within_size logic into a new helper +- mm: shmem: change the return value of shmem_find_swap_entries() +- mm: shmem: remove duplicate error validation +- mm: shmem: remove 'fadvise()' comments +- mm: shmem: drop the unused macro +- docs: tmpfs: drop 'fadvise()' from the documentation +- !15611 Minimize xa_node allocation during xarry split +- docs: tmpfs: update the large folios policy for tmpfs and shmem +- mm: shmem: add a kernel command line to change the default huge policy for tmpfs +- hisi_acc_vfio_pci: register debugfs for hisilicon migration driver +- hisi_acc_vfio_pci: create subfunction for data reading +- hisi_acc_vfio_pci: extract public functions for container_of +- hisi_acc_vfio_pci: Remove the deferred_reset logic +- vfio/migration: Add debugfs to live migration driver +- Revert "vfio/migration: added map length page alignment" +- Revert "vfio/migration: bugfix some driver code" +- Revert "vfio/migration: add eq and aeq interruption restore" +- Revert "vfio/migration: bugfix cache write-back issue" +- Revert "vfio/migration: remove unused local variable" +- Revert "hisi-acc-vfio-pci:add DFX for acc migration driver" +- Revert "hisi_acc_vfio_pci: add exception error handling" +- Revert "migration: fix reference counting exception issue" +- Revert "migration: modify dfx error type without VM driver" +- !15636 Kunpeng Accelerator Enables New Features +- LoongArch: Set hugetlb mmap base address aligned with pmd size +- crypto: hisilicon/sec2 - fix for sec spec check +- crypto: hisilicon/sec2 - fix for aead authsize alignment +- crypto: hisilicon/sec2 - fix for aead auth key length +- crypto: hisilicon/hpre - adapt ECDH for high-performance cores +- crypto: hisilicon/qm - support new function communication +- Revert "crypto: hisilicon/qm - fix the pf2vf timeout when global reset" +- Revert "crypto: hisilicon/qm - obtain the mailbox configuration at one time" +- crypto: hisilicon/sec2 - fix for aead invalid authsize +- crypto: hisilicon/sec2 - fix for aead icv error +- Revert "crypto: hisilicon/sec2: fix memory use-after-free issue" +- Revert "crypto: hisilicon/sec2 - fix for aead icv error" +- Revert "crypto: hisilicon/sec2 - fix for aead invalid authsize" +- crypto: hisilicon/zip - support new error report +- Revert "crypto: hisilicon/qm - check device status before sending mailbox" +- Revert "hisi_acc_vfio_pci: obtain the mailbox configuration at one time" +- Revert "crypto: hisilicon/qm - disable error report before flr" +- crypto: hisilicon/zip - add data aggregation feature +- !15783 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.80-6.6.81 LTS Patches +- !15650 PCI/DPC: Ignore Surprise Down error on hot removal +- !15813 fix CVE-2025-21883 +- ice: Fix deinitializing VF in error path +- ice: add E830 HW VF mailbox message limit support +- ice: Add E830 device IDs, MAC type and registers +- !15800 proc: fix UAF in proc_get_inode() +- !15799 ksmbd: fix incorrect validation for num_aces field of smb_acl +- !15798 ksmbd: fix out-of-bounds in parse_sec_desc() +- !15749 CVE-2025-21963 && CVE-2025-21964 +- !15680 scsi: ufs: core: Fix use-after free in init error and remove paths +- !15681 kernel: be more careful about dup_mmap() failures and uprobe registering +- rapidio: add check for rio_add_net() in rio_scan_alloc_net() +- !15772 tracing/osnoise: Fix possible recursive locking for cpus_read_lock() +- !15789 slimbus: messaging: Free transaction ID in delayed interrupt scenario +- !15788 wifi: cfg80211: regulatory: improve invalid hints checking +- !15787 i2c: npcm: disable interrupt enable bit before devm_request_irq +- !15786 ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers +- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success +- scsi: ufs: core: Cancel RTC work during ufshcd_remove() +- scsi: ufs: core: Start the RTC update work later +- scsi: ufs: core: Fix another deadlock during RTC update +- x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive +- scsi: ufs: core: Fix deadlock during RTC update +- x86/microcode/intel: Remove unnecessary cache writeback and invalidation +- arm64: dts: rockchip: Disable DMA for uart5 on px30-ringneck +- intel_idle: Handle older CPUs, which stop the TSC in deeper C states, correctly +- gve: set xdp redirect target only when it is available +- amdgpu/pm/legacy: fix suspend/resume issues +- riscv: signal: fix signal frame size +- riscv/futex: sign extend compare value in atomic cmpxchg +- rseq/selftests: Fix riscv rseq_offset_deref_addv inline asm +- sched/core: Prevent rescheduling when interrupts are disabled +- rcuref: Plug slowpath race in rcuref_put() +- vmlinux.lds: Ensure that const vars with relocations are mapped R/O +- mptcp: reset when MPTCP opts are dropped after join +- mptcp: always handle address removal under msk socket lock +- phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk +- phy: tegra: xusb: reset VBUS & ID OVERRIDE +- net: enetc: fix the off-by-one issue in enetc_map_tx_tso_buffs() +- net: enetc: correct the xdp_tx statistics +- net: enetc: update UDP checksum when updating originTimestamp field +- net: enetc: keep track of correct Tx BD count in enetc_map_tx_tso_buffs() +- net: enetc: fix the off-by-one issue in enetc_map_tx_buffs() +- usbnet: gl620a: fix endpoint checking in genelink_bind() +- i2c: npcm: disable interrupt enable bit before devm_request_irq +- drm/amd/display: Fix HPD after gpu reset +- drm/amd/display: Disable PSR-SU on eDP panels +- perf/core: Fix low freq setting via IOC_PERIOD +- perf/x86: Fix low freqency setting issue +- ALSA: usb-audio: Re-add sample rate quirk for Pioneer DJM-900NXS2 +- riscv: KVM: Fix SBI TIME error generation +- riscv: KVM: Fix SBI IPI error generation +- riscv: KVM: Fix hart suspend status check +- RISCV: KVM: Introduce mp_state_lock to avoid lock inversion +- phy: rockchip: naneng-combphy: compatible reset with old DT +- x86/CPU: Fix warm boot hang regression on AMD SC1100 SoC systems +- io_uring/net: save msg_control for compat +- net: ti: icss-iep: Reject perout generation request +- net: ti: icss-iep: Remove spinlock-based synchronization +- include: net: add static inline dst_dev_overhead() to dst.h +- net/mlx5: IRQ, Fix null string in debug print +- net: mvpp2: cls: Fixed Non IP flow, with vlan tag flow defination. +- net: Clear old fragment checksum value in napi_reuse_skb +- ice: Fix deinitializing VF in error path +- ice: add E830 HW VF mailbox message limit support +- ice: Add E830 device IDs, MAC type and registers +- firmware: cs_dsp: Remove async regmap writes +- ipvs: Always clear ipvs_property flag in skb_scrub_packet() +- ASoC: es8328: fix route from DAC to output +- net: set the minimum for net_hotdata.netdev_budget_usecs +- net: loopback: Avoid sending IP packets without an Ethernet header +- afs: Fix the server_list to unuse a displaced server rather than putting it +- afs: Make it possible to find the volumes that are using a server +- rxrpc: rxperf: Fix missing decoding of terminal magic cookie +- Bluetooth: L2CAP: Fix L2CAP_ECRED_CONN_RSP response +- ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports +- sunrpc: suppress warnings for unused procfs functions +- RDMA/mlx5: Fix bind QP error cleanup flow +- scsi: core: Clear driver private data when retrying request +- SUNRPC: Handle -ETIMEDOUT return from tlshd +- SUNRPC: Prevent looping due to rpc_signal_task() races +- SUNRPC: convert RPC_TASK_* constants to enum +- scsi: ufs: core: Fix ufshcd_is_ufs_dev_busy() and ufshcd_eh_timed_out() +- scsi: ufs: core: Prepare to introduce a new clock_gating lock +- scsi: ufs: core: Introduce ufshcd_has_pending_tasks() +- scsi: ufs: core: Add UFS RTC support +- scsi: ufs: core: Add ufshcd_is_ufs_dev_busy() +- RDMA/mana_ib: Allocate PAGE aligned doorbell index +- IB/mlx5: Set and get correct qp_num for a DCT QP +- !15807 RDMA/mlx5: Fix a WARN during dereg_mr for DM type +- RDMA/mlx5: Fix a WARN during dereg_mr for DM type +- !15338 partitions: mac: fix handling of bogus partition table +- PCI/DPC: Ignore Surprise Down error on hot removal +- !15771 bpf: Add tracepoints with null-able arguments +- !15775 v2 CVE-2024-57857 +- !15790 fix CVE-2025-21976 +- proc: fix UAF in proc_get_inode() +- ksmbd: fix incorrect validation for num_aces field of smb_acl +- ksmbd: fix out-of-bounds in parse_sec_desc() +- !15785 v2 HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() +- drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params +- RDMA/mlx5: Fix the recovery flow of the UMR QP +- fbdev: hyperv_fb: Allow graceful removal of framebuffer +- fbdev: hyperv_fb: Simplify hvfb_putmem +- fbdev: Introduce devm_register_framebuffer() +- !15757 Fix kmemleak false positive +- slimbus: messaging: Free transaction ID in delayed interrupt scenario +- wifi: cfg80211: regulatory: improve invalid hints checking +- i2c: npcm: disable interrupt enable bit before devm_request_irq +- ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers +- ASoC: SOF: topology: Parse DAI type token for dspless mode +- ASoC: SOF: topology: dynamically allocate and store DAI widget->private +- !15396 fix CVE-2024-57999 +- !15762 scsi: ufs: core: bsg: Fix crash when arpmb command fails +- !15410 CVE-2025-21715 +- !15408 CVE-2025-21744 +- HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() +- !15729 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.79-6.6.80 LTS Patches +- mtd: rawnand: cadence: fix unchecked dereference +- RDMA/siw: Remove direct link to net_device +- RDMA: Export ib_device_get_netdev() +- !15743 uprobes: Reject the shared zeropage in uprobe_write_opcode() +- ibmvnic: Inspect header requirements before using scrq direct +- ibmvnic: Perform tx CSO during send scrq direct +- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit +- nilfs2: handle errors that nilfs_prepare_chunk() may return +- nilfs2: eliminate staggered calls to kunmap in nilfs_rename +- nilfs2: move page release outside of nilfs_delete_entry and nilfs_set_link +- arm64: dts: rockchip: change eth phy mode to rgmii-id for orangepi r1 plus lts +- md: Fix md_seq_ops() regressions +- ftrace: Do not add duplicate entries in subops manager ops +- ftrace: Correct preemption accounting for function tracing. +- EDAC/qcom: Correct interrupt enable register configuration +- mtd: rawnand: cadence: fix incorrect device in dma_unmap_single +- mtd: rawnand: cadence: use dma_map_resource for sdma address +- mtd: rawnand: cadence: fix error code in cadence_nand_init() +- mm,madvise,hugetlb: check for 0-length range after end address adjustment +- ASoC: SOF: pcm: Clear the susbstream pointer to NULL on close +- ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED +- ALSA: hda: Add error check for snd_ctl_rename_id() in snd_hda_create_dig_out_ctls() +- ASoC: fsl_micfil: Enable default case in micfil_set_quality() +- ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() +- nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() +- lib/iov_iter: fix import_iovec_ubuf iovec management +- soc: loongson: loongson2_guts: Add check for devm_kstrdup() +- drop_monitor: fix incorrect initialization order +- tee: optee: Fix supplicant wait loop +- drm/i915/dp: Fix error handling during 128b/132b link training +- drm/i915: Make sure all planes in use by the joiner have their crtc included +- drm/msm/dpu: Disable dither in phys encoder cleanup +- arm64: dts: mediatek: mt8183: Disable DSI display output by default +- drm/nouveau/pmu: Fix gp10b firmware guard +- bpf: skip non exist keys in generic_map_lookup_batch +- nvme/ioctl: add missing space in err message +- drm/msm: Avoid rounding up to one jiffy +- nouveau/svm: fix missing folio unlock + put after make_device_exclusive_range() +- power: supply: da9150-fg: fix potential overflow +- bpf: Fix deadlock when freeing cgroup storage +- bpf: Disable non stream socket for strparser +- bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() +- drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit() +- drm/msm/gem: Demote userspace errors to DRM_UT_DRIVER +- drm/tidss: Fix race condition while handling interrupt registers +- drm/tidss: Add simple K2G manual reset +- !15768 gpio: aggregator: protect driver attr handlers against module unload +- !15755 x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment +- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() +- !15739 ftrace: Avoid potential division by zero in function_stat_show() +- !15748 tracing: Fix bad hist from corrupting named_triggers list +- !15750 perf/core: Fix pmus_lock vs. pmus_srcu ordering +- bpf: Add tracepoints with null-able arguments +- gpio: aggregator: protect driver attr handlers against module unload +- !15697 fs/dcache: fix bad unlock balance in shrink_dentry_list() +- scsi: ufs: core: bsg: Fix crash when arpmb command fails +- efi/arm64: Fix kmemleak false positive in arm64_efi_rt_init() +- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment +- arm64/kabi: use KABI_EXTEND to skip KABI check +- arm64/config: add config to control whether enable HDBSS feature +- arm64/kvm: support to handle the HDBSSF event +- arm64/kvm: using ioctl to enable/disable the HDBSS feature +- arm64/kvm: support set the DBM attr during memory abort +- arm64/sysreg: add HDBSS related register information +- perf/core: Fix pmus_lock vs. pmus_srcu ordering +- cifs: Fix integer overflow while processing acdirmax mount option +- cifs: Fix integer overflow while processing acregmax mount option +- tracing: Fix bad hist from corrupting named_triggers list +- !15613 CVE-2024-57952 +- !15724 CVE-2024-52560 +- !15277 drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode() +- uprobes: Reject the shared zeropage in uprobe_write_opcode() +- ftrace: Avoid potential division by zero in function_stat_show() +- !15641 block: don't revert iter for -EIOCBQUEUED +- !15515 media: uvcvideo: Fix crash during unbind if gpio unit is in use +- !15731 Some mainline patches merged into drivers/hwmon +- hwmon: (acpi_power_meter) Fix the fake power alarm reporting +- hwmon: (acpi_power_meter) Fix a check for the return value of read_domain_devices(). +- hwmon: (acpi_power_meter) Fix update the power trip points on failure +- hwmon: (acpi_power_meter) Fix uninitialized variables +- hwmon: (acpi_power_meter) Fix fail to load module on platform without _PMD method +- net: axienet: Set mac_managed_pm +- arp: switch to dev_getbyhwaddr() in arp_req_set_public() +- net: Add non-RCU dev_getbyhwaddr() helper +- flow_dissector: Fix port range key handling in BPF conversion +- flow_dissector: Fix handling of mixed port and port-range keys +- geneve: Suppress list corruption splat in geneve_destroy_tunnels(). +- tcp: adjust rcvq_space after updating scaling ratio +- vsock/bpf: Warn on socket without transport +- sockmap, vsock: For connectible sockets allow only connected +- ibmvnic: Don't reference skb after sending to VIOS +- ibmvnic: Add stat for tx direct vs tx batched +- ibmvnic: Introduce send sub-crq direct +- ibmvnic: Return error code on TX scrq flush fail +- ALSA: seq: Drop UMP events when no UMP-conversion is set +- net/sched: cls_api: fix error handling causing NULL dereference +- ALSA: hda/cirrus: Correct the full scale volume set logic +- geneve: Fix use-after-free in geneve_find_dev(). +- powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC +- ALSA: hda/realtek: Fixup ALC225 depop procedure +- powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline +- powerpc/64s/mm: Move __real_pte stubs into hash-4k.h +- ASoC: rockchip: i2s-tdm: fix shift config for SND_SOC_DAIFMT_DSP_[AB] +- USB: gadget: f_midi: f_midi_complete to call queue_work +- usb: gadget: core: flush gadget workqueue after device removal +- USB: gadget: core: create sysfs link between udc and gadget +- nvmem: imx-ocotp-ele: fix MAC address byte order +- nvmem: Move and rename ->fixup_cell_info() +- nvmem: Simplify the ->add_cells() hook +- nvmem: Create a header for internal sharing +- media: uvcvideo: Remove dangling pointers +- media: uvcvideo: Only save async fh if success +- media: uvcvideo: Refactor iterators +- soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove +- soc/mediatek: mtk-devapc: Convert to platform remove callback returning void +- arm64: dts: qcom: sm8550: Fix ADSP memory base and length +- arm64: dts: qcom: sm8550: add missing qcom,non-secure-domain property +- arm64: dts: qcom: sm8550: Add dma-coherent property +- arm64: dts: qcom: sm8450: Fix ADSP memory base and length +- arm64: dts: qcom: sm8450: add missing qcom,non-secure-domain property +- scsi: core: Do not retry I/Os during depopulation +- scsi: core: Handle depopulation and restoration in progress +- firmware: qcom: scm: Fix missing read barrier in qcom_scm_is_available() +- ASoC: renesas: rz-ssi: Add a check for negative sample_space +- Input: synaptics - fix crash when enabling pass-through port +- Input: serio - define serio_pause_rx guard to pause and resume serio ports +- Bluetooth: qca: Fix poor RF performance for WCN6855 +- Bluetooth: qca: Update firmware-name to support board specific nvm +- Bluetooth: qca: Support downloading board id specific NVM for WCN7850 +- cpufreq: fix using cpufreq-dt as module +- cpufreq: dt-platdev: add missing MODULE_DESCRIPTION() macro +- memcg: fix soft lockup in the OOM process +- mm: update mark_victim tracepoints fields +- md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime +- md/md-bitmap: add 'sync_size' into struct md_bitmap_stats +- md/md-cluster: fix spares warnings for __le64 +- md/md-bitmap: replace md_bitmap_status() with a new helper md_bitmap_get_stats() +- !15711 Some bug fix patches for RDMA/hns to olk-6.6 +- !15705 tracing: Fix use-after-free in print_graph_function_flags during tracer switching +- !15704 perf/core: Add RCU read lock protection to perf_iterate_ctx() +- !15672 ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up +- !15621 misc: fastrpc: Fix copy buffer page size +- !15620 s390/ism: add release function for struct device +- !15622 Fix UAF in acct(2) +- !15488 CVE-2025-21816 +- !15706 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.78-6.6.79 LTS Patches +- !14287 [OLK-6.6] SCSI: Support Linkdata HBA/RAID Controllers +- fs/ntfs3: Unify inode corruption marking with _ntfs_bad_inode() +- fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr() +- kbuild: hdrcheck: fix cross build with clang +- HID: hid-steam: Fix use-after-free when detaching device +- Revert "vfio/platform: check the bounds of read/write syscalls" +- x86/i8253: Disable PIT timer 0 when not in use +- vsock: Orphan socket after transport release +- vsock: Keep the binding until socket destruction +- io_uring/kbuf: reallocate buf lists on upgrade +- HID: hid-steam: Don't use cancel_delayed_work_sync in IRQ context +- alpha: replace hardcoded stack offsets with autogenerated ones +- mm: gup: fix infinite loop within __get_longterm_locked +- arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented +- md/md-bitmap: move bitmap_{start, end}write to md upper layer +- md: add a new callback pers->bitmap_sector() +- md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() +- md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() +- selftests: rtnetlink: update netdevsim ipsec output format +- netdevsim: print human readable IP address +- x86/static-call: Remove early_boot_irqs_disabled check to fix Xen PVH dom0 +- drm/v3d: Stop active perfmon if it is being destroyed +- drm/rcar-du: dsi: Fix PHY lock bit check +- drm/tidss: Clear the interrupt status for interrupts being disabled +- drm/tidss: Fix issue in irq handling causing irq-flood issue +- ipv6: mcast: add RCU protection to mld_newpack() +- ipv6: mcast: extend RCU protection in igmp6_send() +- ndisc: extend RCU protection in ndisc_send_skb() +- openvswitch: use RCU protection in ovs_vport_cmd_fill_info() +- arp: use RCU protection in arp_xmit() +- neighbour: use RCU protection in __neigh_notify() +- neighbour: delete redundant judgment statements +- ndisc: use RCU protection in ndisc_alloc_skb() +- HID: hid-steam: Move hidraw input (un)registering to work +- HID: hid-steam: Make sure rumble work is canceled on removal +- HID: hid-steam: Add Deck IMU support +- HID: hid-steam: Fix cleanup in probe() +- HID: hid-steam: remove pointless error message +- HID: hid-steam: Add gamepad-only mode switched to by holding options +- HID: hid-steam: Update list of identifiers from SDL +- HID: hid-steam: Clean up locking +- HID: hid-steam: Disable watchdog instead of using a heartbeat +- HID: hid-steam: Avoid overwriting smoothing parameter +- ipv6: icmp: convert to dev_net_rcu() +- ipv6: use RCU protection in ip6_default_advmss() +- flow_dissector: use RCU protection to fetch dev_net() +- ipv4: icmp: convert to dev_net_rcu() +- ipv4: use RCU protection in __ip_rt_update_pmtu() +- net: ipv4: Cache pmtu for all packet paths if multipath enabled +- ipv4: use RCU protection in inet_select_addr() +- ipv4: use RCU protection in rt_is_expired() +- ipv4: use RCU protection in ipv4_default_advmss() +- net: add dev_net_rcu() helper +- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() +- ipv4: add RCU protection to ip4_dst_hoplimit() +- btrfs: fix hole expansion when writing at an offset beyond EOF +- mlxsw: Add return value check for mlxsw_sp_port_get_stats_raw() +- igc: Set buffer type for empty frames in igc_init_empty_frame +- mmc: mtk-sd: Fix register settings for hs400(es) mode +- arm64: Handle .ARM.attributes section in linker scripts +- regmap-irq: Add missing kfree() +- regulator: qcom_smd: Add l2, l5 sub-node to mp5496 regulator +- partitions: mac: fix handling of bogus partition table +- gpio: stmpe: Check return value of stmpe_reg_read in stmpe_gpio_irq_sync_unlock +- gpiolib: acpi: Add a quirk for Acer Nitro ANV14 +- alpha: align stack for page fault and user unaligned trap handlers +- serial: 8250: Fix fifo underflow on flush +- efi: Avoid cold plugged memory for placing the kernel +- kbuild: userprogs: fix bitsize and target detection on clang +- wifi: ath12k: fix handling of 6 GHz rules +- alpha: make stack 16-byte aligned (most cases) +- can: etas_es58x: fix potential NULL pointer dereference on udev->serial +- can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero +- can: c_can: fix unbalanced runtime PM disable in error path +- can: ctucanfd: handle skb allocation failure +- USB: serial: option: drop MeiG Smart defines +- USB: serial: option: fix Telit Cinterion FN990A name +- USB: serial: option: add Telit Cinterion FN990B compositions +- USB: serial: option: add MeiG Smart SLM828 +- usb: cdc-acm: Fix handling of oversized fragments +- USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk +- usb: gadget: f_midi: fix MIDI Streaming descriptor lengths +- USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone +- USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist +- usb: core: fix pipe creation for get_bMaxPacketSize0 +- USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI +- usb: dwc2: gadget: remove of_node reference upon udc_stop +- usb: gadget: udc: renesas_usb3: Fix compiler warning +- usb: roles: set switch registered flag early on +- usb: dwc3: Fix timeout issue during controller enter/exit from halt state +- usb: gadget: f_midi: Fixing wMaxPacketSize exceeded issue during MIDI bind retries +- perf/x86/intel: Ensure LBRs are disabled when a CPU is starting +- KVM: nSVM: Enter guest mode before initializing nested NPT MMU +- KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel +- drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() +- batman-adv: Drop unmanaged ELP metric worker +- batman-adv: Ignore neighbor throughput metrics in error case +- batman-adv: fix panic during interface removal +- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V +- ACPI: x86: Add skip i2c clients quirk for Vexia EDU ATLA 10 tablet 5V +- selftests: gpio: gpio-sim: Fix missing chip disablements +- Grab mm lock before grabbing pt lock +- vfio/pci: Enable iowrite64 and ioread64 for vfio pci +- rtla/timerlat_top: Abort event processing on second signal +- rtla/timerlat_hist: Abort event processing on second signal +- scsi: ufs: bsg: Set bsg_queue to NULL after removal +- PCI: switchtec: Add Microchip PCI100X device IDs +- PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P +- media: uvcvideo: Add Kurokesu C1 PRO camera +- media: uvcvideo: Add new quirk definition for the Sonix Technology Co. 292a camera +- media: uvcvideo: Implement dual stream quirk to fix loss of usb packets +- media: i2c: ds90ub953: Add error handling for i2c reads/writes +- media: i2c: ds90ub913: Add error handling to ub913_hw_init() +- media: cxd2841er: fix 64-bit division on gcc-9 +- soc/tegra: fuse: Update Tegra234 nvmem keepout list +- fbdev: omap: use threaded IRQ for LCD DMA +- RDMA/efa: Reset device on probe failure +- tools: fix annoying "mkdir -p ..." logs when building tools in parallel +- RDMA/hns: Fix remove debugfs after device has been unregistered +- RDMA/hns: Reorder uctx deallocation +- RDMA/hns: Fix a meaningless loop in free_buffer_pages_proc() +- RDMA/hns: Fix DCA error path in alloc_wqe_buf() +- RDMA/hns: Fix mismatched kzalloc vs kvfree +- RDMA/hns: Fix delay-destruction mechanism not processing kernel db +- RDMA/hns: Fix delayed destruction of db not taking effect +- RDMA/hns: Move mtr_node into the mtr struct +- RDMA/hns: Change mtr member to pointer in hns QP/CQ/MR/SRQ/EQ struct +- x86/xen: allow larger contiguous memory regions in PV guests +- xen/swiotlb: relax alignment requirements +- drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode() +- gpio: bcm-kona: Add missing newline to dev_err format string +- gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ +- gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0 +- drm/i915/selftests: avoid using uninitialized context +- cgroup: Remove steal time from usage_usec +- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array +- team: better TEAM_OPTION_TYPE_STRING validation +- LoongArch: Fix idle VS timer enqueue +- vxlan: check vxlan_vnigroup_init() return value +- vrf: use RCU protection in l3mdev_l3_out() +- ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu() +- ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt +- spi: sn-f-ospi: Fix division by zero +- HID: multitouch: Add NULL check in mt_input_configured +- pinctrl: cy8c95x0: Respect IRQ trigger settings from firmware +- tracing: Fix use-after-free in print_graph_function_flags during tracer switching +- perf/core: Add RCU read lock protection to perf_iterate_ctx() +- !15686 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.76-6.6.78 LTS Patches +- fs/dcache: fix bad unlock balance in shrink_dentry_list() +- !15645 nilfs2: do not force clear folio if buffer is referenced +- char: misc: deallocate static minor in error path +- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA +- ALSA: hda/realtek: Fix wrong mic setup for ASUS VivoBook 15 +- ALSA: hda/realtek: Add quirks for ASUS ROG 2023 models +- ALSA: hda/realtek: Fix microphone regression on ASUS N705UD +- Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'" +- rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads +- rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads +- Revert "rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads" +- Revert "rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads" +- Revert "KVM: PPC: e500: Mark "struct page" dirty in kvmppc_e500_shadow_map()" +- Revert "KVM: PPC: e500: Mark "struct page" pfn accessed before dropping mmu_lock" +- Revert "KVM: PPC: e500: Use __kvm_faultin_pfn() to handle page faults" +- Revert "KVM: e500: always restore irqs" +- KVM: x86: Re-split x2APIC ICR into ICR+ICR2 for AMD (x2AVIC) +- KVM: x86: Make x2APIC ID 100% readonly +- tty: xilinx_uartps: split sysrq handling +- x86/mm/ident_map: Use gbpages only where full GB page should be mapped. +- mptcp: prevent excessive coalescing on receive +- btrfs: avoid monopolizing a core when activating a swap file +- Revert "btrfs: avoid monopolizing a core when activating a swap file" +- ocfs2: check dir i_size in ocfs2_find_entry +- net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling +- spi: atmel-qspi: Memory barriers after memory-mapped I/O +- spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC families +- MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static +- rtc: zynqmp: Fix optional clock name property +- pinctrl: samsung: fix fwnode refcount cleanup if platform_get_irq_optional() fails +- rtla/timerlat_top: Stop timerlat tracer on signal +- rtla/timerlat_hist: Stop timerlat tracer on signal +- rtla: Add trace_instance_stop +- rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads +- rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads +- rtla/osnoise: Distinguish missing workload option +- scripts/gdb: fix aarch64 userspace detection in get_current_task +- maple_tree: simplify split calculation +- net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset +- net/ncsi: wait for the last response to Deselect Package before configuring channel +- misc: fastrpc: Fix copy buffer page size +- misc: fastrpc: Fix registered buffer page address +- misc: fastrpc: Deregister device nodes properly in error scenarios +- misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors +- mtd: onenand: Fix uninitialized retlen in do_otp_read() +- irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so +- i3c: master: Fix missing 'ret' assignment in set_speed() +- NFC: nci: Add bounds checking in nci_hci_create_pipe() +- mailbox: tegra-hsp: Clear mailbox before using message +- ocfs2: fix incorrect CPU endianness conversion causing mount failure +- pnfs/flexfiles: retry getting layout segment for reads +- selftests: mptcp: connect: -f: no reconnect +- vfio/platform: check the bounds of read/write syscalls +- io_uring/rw: commit provided buffer state on async +- io_uring: fix io_req_prep_async with provided buffers +- io_uring/net: don't retry connect operation on EPOLLERR +- io_uring: fix multishots with selected buffers +- nvmem: imx-ocotp-ele: set word length to 1 +- nvmem: imx-ocotp-ele: fix reading from non zero offset +- nvmem: imx-ocotp-ele: simplify read beyond device check +- nvmem: core: improve range check for nvmem_cell_write() +- nvmem: qcom-spmi-sdam: Set size in struct nvmem_config +- crypto: qce - unregister previously registered algos in error path +- crypto: qce - fix goto jump in error path +- media: uvcvideo: Remove redundant NULL assignment +- media: uvcvideo: Support partial control reads +- media: uvcvideo: Fix event flags in uvc_ctrl_send_events +- media: uvcvideo: Fix crash during unbind if gpio unit is in use +- media: i2c: ds90ub960: Fix logging SP & EQ status only for UB9702 +- media: i2c: ds90ub960: Fix UB9702 VC map +- media: i2c: ds90ub960: Fix use of non-existing registers on UB9702 +- media: i2c: ds90ub9x3: Fix extra fwnode_handle_put() +- media: ccs: Fix cleanup order in ccs_probe() +- media: ccs: Fix CCS static data parsing for large block sizes +- media: ov5640: fix get_light_freq on auto +- media: imx296: Add standby delay during probe +- media: mc: fix endpoint iteration +- media: mmp: Bring back registration of the device +- soc: qcom: smem_state: fix missing of_node_put in error path +- soc: mediatek: mtk-devapc: Fix leaking IO map on error paths +- iio: light: as73211: fix channel handling in only-color triggered buffer +- media: ccs: Clean up parsed CCS static data on parse failure +- kfence: skip __GFP_THISNODE allocations on NUMA systems +- rv: Reset per-task monitors also for idle tasks +- tpm: Change to kvalloc() in eventlog/acpi.c +- ACPI: PRM: Remove unnecessary strict handler address checks +- xfs: Add error handling for xfs_reflink_cancel_cow_range +- xfs: Propagate errors from xfs_reflink_cancel_cow_range in xfs_dax_write_iomap_end +- pwm: microchip-core: fix incorrect comparison with max period +- arm64: tegra: Disable Tegra234 sce-fabric node +- arm64: tegra: Fix typo in Tegra234 dce-fabric compatible +- crypto: qce - fix priority to be less than ARMv8 CE +- arm64: dts: qcom: sm8550: correct MDSS interconnects +- arm64: dts: qcom: sm8550: Fix MPSS memory length +- arm64: dts: qcom: sm8550: Fix CDSP memory length +- arm64: dts: qcom: sm8450: Fix MPSS memory length +- arm64: dts: qcom: sm8450: Fix CDSP memory length +- arm64: dts: qcom: sm8350: Fix MPSS memory length +- arm64: dts: qcom: sm8350: Fix CDSP memory base and length +- arm64: dts: qcom: sm8350: Fix ADSP memory base and length +- arm64: dts: qcom: sm6375: Fix MPSS memory base and length +- arm64: dts: qcom: sm6375: Fix CDSP memory base and length +- arm64: dts: qcom: sm6375: Fix ADSP memory length +- arm64: dts: qcom: sm6350: Fix uart1 interconnect path +- arm64: dts: qcom: sm6350: Fix MPSS memory length +- arm64: dts: qcom: sm6350: Fix ADSP memory length +- arm64: dts: qcom: sm6115: Fix ADSP memory base and length +- arm64: dts: qcom: sm6115: Fix CDSP memory length +- arm64: dts: qcom: sm6115: Fix MPSS memory length +- ARM: dts: ti/omap: gta04: fix pm issues caused by spi module +- ARM: dts: dra7: Add bus_dma_limit for l4 cfg bus +- ubi: Add a check for ubi_num +- x86/boot: Use '-std=gnu11' to fix build with GCC 15 +- rust: init: use explicit ABI to clean warning in future compilers +- kbuild: Move -Wenum-enum-conversion to W=2 +- scsi: storvsc: Set correct data length for sending SCSI command without payload +- scsi: ufs: qcom: Fix crypto key eviction +- scsi: qla2xxx: Move FCE Trace buffer allocation to user control +- scsi: st: Don't set pos_unknown just after device recognition +- nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk +- nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk +- PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf() +- PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 +- arm64: tegra: Fix Tegra234 PCIe interrupt-map +- ALSA: hda: Fix headset detection failure due to unstable sort +- ALSA: hda/realtek: Enable headset mic on Positivo C6400 +- Revert "media: uvcvideo: Require entities to have a non-zero unique ID" +- block: don't revert iter for -EIOCBQUEUED +- mips/math-emu: fix emulation of the prefx instruction +- dm-crypt: track tag_offset in convert_context +- dm-crypt: don't update io->sector after kcryptd_crypt_write_io_submit() +- powerpc/pseries/eeh: Fix get PE state translation +- LoongArch: Extend the maximum number of watchpoints +- MIPS: Loongson64: remove ROM Size unit in boardinfo +- serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use +- serial: sh-sci: Drop __initdata macro for port_cfg +- soc: qcom: socinfo: Avoid out of bounds read of serial number +- ASoC: acp: Support microphone from Lenovo Go S +- usbnet: ipheth: document scope of NCM implementation +- usbnet: ipheth: fix DPE OoB read +- usbnet: ipheth: break up NCM header size computation +- usbnet: ipheth: refactor NCM datagram loop +- usbnet: ipheth: check that DPE points past NCM header +- usbnet: ipheth: use static NDP16 location in URB +- usb: gadget: f_tcm: Don't prepare BOT write request twice +- usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint +- usb: gadget: f_tcm: Decrement command ref count on cleanup +- usb: gadget: f_tcm: Translate error to sense +- wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916 +- wifi: rtw88: sdio: Fix disconnection after beacon loss +- wifi: mt76: mt7921u: Add VID/PID for TP-Link TXE50UH +- wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() +- wifi: rtlwifi: rtl8821ae: Fix media status report +- HID: hid-sensor-hub: don't use stale platform-data on remove +- of: reserved-memory: Fix using wrong number of cells to get property 'alignment' +- of: Fix of_find_node_opts_by_path() handling of alias+path+options +- of: Correct child specifier used as input of the 2nd nexus node +- scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions +- perf bench: Fix undefined behavior in cmpworker() +- efi: libstub: Use '-std=gnu11' to fix build with GCC 15 +- clk: mediatek: mt2701-mm: add missing dummy clk +- clk: mediatek: mt2701-img: add missing dummy clk +- clk: mediatek: mt2701-bdp: add missing dummy clk +- clk: mediatek: mt2701-aud: fix conversion to mtk_clk_simple_probe +- clk: mediatek: mt2701-vdec: fix conversion to mtk_clk_simple_probe +- clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate +- clk: qcom: gcc-mdm9607: Fix cmd_rcgr offset for blsp1_uart6 rcg +- clk: qcom: gcc-sm6350: Add missing parent_map for two clocks +- clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during gdsc_disable() +- clk: qcom: clk-alpha-pll: fix alpha mode configuration +- media: i2c: ds90ub960: Fix UB9702 refclk register access +- clk: sunxi-ng: a100: enable MMC clock reparenting +- Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection +- Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc +- drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes +- drm/komeda: Add check for komeda_get_layer_fourcc_list() +- drm/i915: Fix page cleanup on DMA remap failure +- drm/i915/guc: Debug print LRC state entries only if the context is pinned +- Revert "drm/amd/display: Use HW lock mgr for PSR1" +- drm/amdkfd: only flush the validate MES contex +- drm/amd/pm: Mark MM activity as unsupported +- ksmbd: fix integer overflows on 32 bit systems +- KVM: s390: vsie: fix some corner-cases when grabbing vsie pages +- KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() +- arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma +- drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event() +- KVM: arm64: timer: Always evaluate the need for a soft timer +- fs/proc: do_task_stat: Fix ESP not readable during coredump +- m68k: vga: Fix I/O defines +- s390/futex: Fix FUTEX_OP_ANDN implementation +- smb: client: change lease epoch type from unsigned int to __u16 +- smb: client: fix order of arguments of tracepoints +- drm/modeset: Handle tiled displays in pan_display_atomic. +- ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx +- leds: lp8860: Write full EEPROM, not only half of it +- cpufreq: s3c64xx: Fix compilation warning +- rxrpc: Fix call state set to not include the SERVER_SECURING state +- net: sched: Fix truncation of offloaded action statistics +- tun: revert fix group permission check +- netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() +- ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read() +- x86/xen: add FRAME_END to xen_hypercall_hvm() +- x86/xen: fix xen_hypercall_hvm() to not clobber %rbx +- net: rose: lock the socket in rose_bind() +- net: atlantic: fix warning during hot unplug +- gpio: pca953x: Improve interrupt support +- rxrpc: Fix the rxrpc_connection attend queue handling +- udp: gso: do not drop small packets when PMTU reduces +- tg3: Disable tg3 PCIe AER on system reboot +- vmxnet3: Fix tx queue race condition with XDP +- ice: Add check for devm_kzalloc() +- net: bcmgenet: Correct overlaying of PHY and MAC Wake-on-LAN +- nvme-fc: use ctrl state getter +- ice: put Rx buffers after being done with current frame +- gpu: drm_dp_cec: fix broken CEC adapter properties check +- firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry +- net/ncsi: fix locking in Get MAC Address handling +- net/ncsi: Add NC-SI 1.2 Get MC MAC Address command +- KVM: e500: always restore irqs +- KVM: PPC: e500: Use __kvm_faultin_pfn() to handle page faults +- KVM: PPC: e500: Mark "struct page" pfn accessed before dropping mmu_lock +- KVM: PPC: e500: Mark "struct page" dirty in kvmppc_e500_shadow_map() +- platform/x86: acer-wmi: Ignore AC events +- Input: allocate keycode for phone linking +- ASoC: amd: Add ACPI dependency to fix build error +- ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback +- platform/x86: int3472: Check for adev == NULL +- iommu/arm-smmu-v3: Clean up more on probe failure +- iommu/arm-smmu-qcom: add sdm670 adreno iommu compatible +- x86/kexec: Allocate PGD for x86_64 transition page tables separately +- selftests/net/ipsec: Fix Null pointer dereference in rtattr_pack() +- tipc: re-order conditions in tipc_crypto_key_rcv() +- mmc: sdhci-msm: Correctly set the load for the regulator +- net: wwan: iosm: Fix hibernation by re-binding the driver around it +- Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync +- APEI: GHES: Have GHES honor the panic= setting +- i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz +- wifi: iwlwifi: avoid memory leak +- net/mlx5: use do_aux_work for PHC overflow checks +- HID: Wacom: Add PCI Wacom device support +- clk: qcom: Make GCC_8150 depend on QCOM_GDSC +- mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id +- tomoyo: don't emit warning in tomoyo_write_control() +- wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() +- mmc: core: Respect quirk_max_rate for non-UHS SDIO card +- tun: fix group permission check +- wifi: rtw89: add crystal_cap check to avoid setting as overflow value +- safesetid: check size of policy writes +- drm/bridge: it6505: fix HDCP CTS KSV list wait timer +- drm/bridge: it6505: fix HDCP CTS compare V matching +- drm/bridge: it6505: fix HDCP encryption when R0 ready +- drm/bridge: it6505: fix HDCP Bstatus check +- drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT +- drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor +- printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX +- drm/virtio: New fence for every plane update +- x86/amd_nb: Restrict init function to AMD-based systems +- lockdep: Fix upper limit for LOCKDEP_*_BITS configs +- sched: Don't try to catch up excess steal time. +- btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling +- btrfs: fix data race when accessing the inode's disk_i_size at btrfs_drop_extents() +- s390/stackleak: Use exrl instead of ex in __stackleak_poison() +- arm64/mm: Ensure adequate HUGE_MAX_HSTATE +- btrfs: fix use-after-free when attempting to join an aborted transaction +- btrfs: fix assertion failure when splitting ordered extent after transaction abort +- Revert "hostfs: convert hostfs to use the new mount API" +- Revert "hostfs: fix string handling in __dentry_name()" +- Revert "hostfs: Add const qualifier to host_root in hostfs_fill_super()" +- Revert "hostfs: fix the host directory parse when mounting." +- kernel: be more careful about dup_mmap() failures and uprobe registering +- scsi: ufs: core: Fix use-after free in init error and remove paths +- !15660 v2 add support DVMBM in HIP12 +- ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up +- KVM: arm64: Add new HiSi CPU type to support DVMBM +- kvm: hisi_virt: Update TLBI broadcast feature for hip12 +- kvm: hisi_virt: fix kernel panic when enable DVMBM in nVHE +- uacce: fix for the numa distance calculation +- uacce: fixes the mutex repeatedly locking error +- !15593 io_uring: prevent opcode speculation +- !15644 ata: libata-sff: Ensure that we cannot write outside the allocated buffer +- nilfs2: do not force clear folio if buffer is referenced +- ata: libata-sff: Ensure that we cannot write outside the allocated buffer +- block: don't revert iter for -EIOCBQUEUED +- !15581 smb: client: Add check for next_buffer in receive_encrypted_standard() +- acct: block access to kernel internal filesystems +- acct: perform last write from workqueue +- misc: fastrpc: Fix copy buffer page size +- s390/ism: add release function for struct device +- mm/shmem: use xas_try_split() in shmem_split_large_entry() +- mm/filemap: use xas_try_split() in __filemap_add_folio() +- xarray: add xas_try_split() to split a multi-index entry +- KVM: arm64: vgic-its: Add stronger type-checking to the ITS entry sizes +- mptcp: fix possible integer overflow in mptcp_reset_tout_timer +- ext4: fix race in buffer_head read fault injection +- ext4: remove array of buffer_heads from mext_page_mkuptodate() +- ext4: pipeline buffer reads in mext_page_mkuptodate() +- Revert "ext4: Fix race in buffer_head read fault injection" +- scsi: sg: Enable runtime power management +- gfs2: Remove and replace gfs2_glock_queue_work +- gfs2: Fix unlinked inode cleanup +- gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async +- gfs2: No longer use 'extern' in function declarations +- KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* +- libfs: Fix duplicate directory entry in offset_dir_lookup +- libfs: Use d_children list to iterate simple_offset directories +- libfs: Replace simple_offset end-of-directory detection +- Revert "libfs: fix infinite directory reads for offset dir" +- Revert "libfs: Add simple_offset_empty()" +- libfs: Return ENOSPC when the directory offset range is exhausted +- SCSI: Linkdata: Supports Linkdata HBA/RAID Controllers +- mm: shmem: add large folio support for tmpfs +- mm: shmem: change shmem_huge_global_enabled() to return huge order bitmap +- mm: factor out the order calculation into a new helper +- Xarray: distinguish large entries correctly in xas_split_alloc() +- io_uring: prevent opcode speculation +- smb: client: Add check for next_buffer in receive_encrypted_standard() +- media: uvcvideo: Fix crash during unbind if gpio unit is in use +- hrtimer: Fix kabi broken of struct hrtimer_cpu_base +- hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING +- ACPI: PRM: Remove unnecessary strict handler address checks +- ACPI: PRM: Add PRM handler direct call support +- ACPI: PRM: Annotate struct prm_module_info with __counted_by +- net: davicom: fix UAF in dm9000_drv_remove +- wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() +- powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW +- KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE +- KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device +- partitions: mac: fix handling of bogus partition table +- printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX +- dmaengine: idxd: Add a new DSA device ID for Granite Rapids-D platform +- drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode() +- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h +- EDAC/amd64: Add support for Hygon family 18h model 8h +- x86/amd_nb: Add support for Hygon family 18h model 8h +- EDAC/amd64: Refactor the calculation of instance id for Hygon family 18h model 10h +- EDAC/amd64: Calculate instance id for hygon family 18h model 7h +- EDAC/amd64: Get correct memory type for Hygon family 18h model 10h +- EDAC/amd64: Check if umc channel is enabled for Hygon family 18h model 10h +- x86/amd_nb: Add helper function to identify Hygon family 18h model 10h +- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC +- EDAC/amd64: Fix the calculation of instance id for Hygon family 18h model 6h +- irqchip/gic-v3-its: Init reserved rsv_devid_pools use pci bus info +- irqchip/gic-v3-its: Move build_devid_pools from its to acpi iort init +- irqchip/gic-v3-its: Add ACPI_IORT as VIRT_PLAT_DEV's dependency +- acpi/iort: Add func to get used deviceid bitmap +- RNP: NET: Fix rnp errors dmesg show in hygon +- net: mucse: Fix os crash when cat some sys interface when net down +- mucse: rnpm ocp nic support hotplug and show sub-zero temperature +- mucse: rnpm compiler error on loongarch64 +- RNPVF: NET: Fix rnpvf compile errors without CONFIG_MXGBEVF_FIX_VF_QUEUE + +* Tue Mar 25 2025 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-84.0.0.89 +- !15625 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.75-6.6.76 LTS Patches +- HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints() +- Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection" +- selftests/landlock: Fix error message +- LoongArch: Change 8 to 14 for LOONGARCH_MAX_{BRP,WRP} +- s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS +- btrfs: output the reason for open_ctree() failure +- media: imx-jpeg: Fix potential error pointer dereference in detach_pm() +- staging: media: max96712: fix kernel oops when removing module +- usb: gadget: f_tcm: Don't free command immediately +- media: uvcvideo: Fix double free in error path +- remoteproc: core: Fix ida_free call while not allocated +- mptcp: handle fastopen disconnect correctly +- mptcp: consolidate suboption status +- usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR PPS +- usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE +- usb: dwc3: core: Defer the probe until USB power supply ready +- usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk() +- usb: gadget: f_tcm: Fix Get/SetInterface return value +- drivers/card_reader/rtsx_usb: Restore interrupt based detection +- net: usb: rtl8150: enable basic endpoint checking +- ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro +- ktest.pl: Check kernelrelease return in get_version +- selftests/rseq: Fix handling of glibc without rseq support +- netfilter: nf_tables: reject mismatching sum of field_len with set key length +- kbuild: switch from lz4c to lz4 for compression +- Revert "SUNRPC: Reduce thread wake-up rate when receiving large RPC messages" +- f2fs: Introduce linear search for dentries +- hexagon: Fix unbalanced spinlock in die() +- hexagon: fix using plain integer as NULL pointer warning in cmpxchg +- kconfig: fix memory leak in sym_warn_unmet_dep() +- kconfig: WERROR unmet symbol dependency +- kconfig: deduplicate code in conf_read_simple() +- kconfig: remove unused code for S_DEF_AUTO in conf_read_simple() +- kconfig: require a space after '#' for valid input +- kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST +- cifs: Fix getting and setting SACLs over SMB1 +- cifs: Validate EAs for WSL reparse points +- io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock() +- ASoC: rockchip: i2s_tdm: Re-add the set_sysclk callback +- RISC-V: Mark riscv_v_init() as __init +- hostfs: fix the host directory parse when mounting. +- hostfs: Add const qualifier to host_root in hostfs_fill_super() +- hostfs: fix string handling in __dentry_name() +- hostfs: convert hostfs to use the new mount API +- genksyms: fix memory leak when the same symbol is read from *.symref file +- genksyms: fix memory leak when the same symbol is added from source +- net: hsr: fix fill_frame_info() regression vs VLAN packets +- net: sh_eth: Fix missing rtnl lock in suspend/resume path +- net: xdp: Disallow attaching device-bound programs in generic mode +- tcp: correct handling of extreme memory squeeze +- bgmac: reduce max frame size to support just MTU 1500 +- vsock: Allow retrying on connect() failure +- Bluetooth: btnxpuart: Fix glitches seen in dual A2DP streaming +- perf trace: Fix runtime error of index out of bounds +- net: stmmac: Limit FIFO size by hardware capability +- net: stmmac: Limit the number of MTL queues to hardware capability +- ptp: Properly handle compat ioctls +- net: davicom: fix UAF in dm9000_drv_remove +- vxlan: Fix uninit-value in vxlan_vnifilter_dump() +- net: netdevsim: try to close UDP port harness races +- net: rose: fix timer races against user threads +- iavf: allow changing VLAN state without calling PF +- PM: hibernate: Add error handling for syscore_suspend() +- net: fec: implement TSO descriptor cleanup +- gpio: mxc: remove dead code after switch to DT-only +- regulator: core: Add missing newline character +- ubifs: skip dumping tnc tree when zroot is null +- xfrm: delete intermediate secpath entry in packet offload mode +- dmaengine: ti: edma: fix OF node reference leaks in edma_driver +- xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO +- tools/bootconfig: Fix the wrong format specifier +- NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE +- NFSv4.2: fix COPY_NOTIFY xdr buf size calculation +- serial: 8250: Adjust the timeout for FIFO mode +- driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() +- module: Extend the preempt disabled section in dereference_symbol_descriptor(). +- nilfs2: protect access to buffers with no active references +- nilfs2: convert nilfs_lookup_dirty_data_buffers to use folio_create_empty_buffers +- buffer: make folio_create_empty_buffers() return a buffer_head +- ocfs2: mark dquot as inactive if failed to start trans while releasing dquot +- scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails +- scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1 +- PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test +- PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error +- PCI: imx6: Skip controller_id generation logic for i.MX7D +- PCI: imx6: Simplify clock handling by using clk_bulk*() function +- media: dvb-usb-v2: af9035: fix ISO C90 compilation error on af9035_i2c_master_xfer +- staging: media: imx: fix OF node leak in imx_media_add_of_subdevs() +- watchdog: rti_wdt: Fix an OF node leak in rti_wdt_probe() +- media: nxp: imx8-isi: fix v4l2-compliance test errors +- mtd: hyperbus: hbmc-am654: fix an OF node reference leak +- mtd: hyperbus: hbmc-am654: Convert to platform remove callback returning void +- mtd: rawnand: brcmnand: fix status read of brcmnand_waitfunc +- media: uvcvideo: Propagate buf->error to userspace +- media: camif-core: Add check for clk_enable() +- media: mipi-csis: Add check for clk_enable() +- media: i2c: ov9282: Correct the exposure offset +- media: i2c: imx412: Add missing newline to prints +- media: i2c: imx290: Register 0x3011 varies between imx327 and imx290 +- media: marvell: Add check for clk_enable() +- PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy() +- media: lmedm04: Handle errors for lme2510_int_read +- media: rc: iguanair: handle timeouts +- spi: omap2-mcspi: Correctly handle devm_clk_get_optional() errors +- RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" +- efi: sysfb_efi: fix W=1 warnings when EFI is not set +- of: reserved-memory: Do not make kmemleak ignore freed address +- RDMA/mlx5: Fix indirect mkey ODP page count +- i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition +- i3c: dw: Add hot-join support. +- arm64: tegra: Fix DMA ID for SPI2 +- fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() +- ARM: dts: mediatek: mt7623: fix IR nodename +- arm64: dts: qcom: sm8250: Fix interrupt types of camss interrupts +- arm64: dts: qcom: sdm845: Fix interrupt types of camss interrupts +- arm64: dts: mediatek: add per-SoC compatibles for keypad nodes +- dts: arm64: mediatek: mt8195: Remove MT8183 compatible for OVL +- arm64: dts: qcom: sc8280xp: Fix up remoteproc register space sizes +- arm64: dts: qcom: sm8150-microsoft-surface-duo: fix typos in da7280 properties +- arm64: dts: qcom: sc7180: fix psci power domain node names +- arm64: dts: qcom: sc7180: change labels to lower-case +- arm64: dts: qcom: Add SM7125 device tree +- arm64: dts: qcom: sc7180-trogdor-pompom: rename 5v-choke thermal zone +- arm64: dts: qcom: sc7180-*: Remove thermal zone polling delays +- arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply +- arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: remove disabled ov7251 camera +- arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: Convert mezzanine riser to dtso +- ARM: omap1: Fix up the Retu IRQ on Nokia 770 +- RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error +- arm64: dts: allwinner: a64: explicitly assign clock parent for TCON0 +- arm64: dts: ti: k3-am62a: Remove duplicate GICR reg +- arm64: dts: ti: k3-am62: Remove duplicate GICR reg +- ARM: dts: microchip: sama5d27_wlsom1_ek: Add no-1-8-v property to sdmmc0 node +- ARM: dts: microchip: sama5d27_wlsom1_ek: Remove mmc-ddr-3_3v property from sdmmc0 node +- arm64: dts: qcom: sm8450: correct sleep clock frequency +- arm64: dts: qcom: sm8350: correct sleep clock frequency +- arm64: dts: qcom: sm8250: correct sleep clock frequency +- arm64: dts: qcom: sm6375: correct sleep clock frequency +- arm64: dts: qcom: sm6125: correct sleep clock frequency +- arm64: dts: qcom: sm4450: correct sleep clock frequency +- arm64: dts: qcom: sdx75: correct sleep clock frequency +- arm64: dts: qcom: sc7280: correct sleep clock frequency +- arm64: dts: qcom: qrb4210-rb2: correct sleep clock frequency +- arm64: dts: qcom: q[dr]u1000: correct sleep clock frequency +- arm64: dts: qcom: qcs404: correct sleep clock frequency +- arm64: dts: qcom: msm8994: correct sleep clock frequency +- arm64: dts: qcom: msm8939: correct sleep clock frequency +- arm64: dts: qcom: msm8916: correct sleep clock frequency +- arm64: dts: qcom: sm7225-fairphone-fp4: Drop extra qcom,msm-id value +- arm64: dts: qcom: msm8994: Describe USB interrupts +- arm64: dts: qcom: msm8996: Fix up USB3 interrupts +- arm64: dts: qcom: sa8775p: Update sleep_clk frequency +- arm64: dts: qcom: move common parts for sa8775p-ride variants into a .dtsi +- arm64: dts: qcom: sa8775p-ride: enable pmm8654au_0_pon_resin +- arm64: dts: qcom: sa8775p-ride: Describe sgmii_phy1 irq +- arm64: dts: qcom: sa8775p-ride: Describe sgmii_phy0 irq +- arm64: dts: qcom: msm8996-xiaomi-gemini: Fix LP5562 LED1 reg property +- arm64: dts: mediatek: mt8183-kukui-jacuzzi: Drop pp3300_panel voltage settings +- memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() +- ARM: dts: stm32: Swap USART3 and UART8 alias on STM32MP15xx DHCOM SoM +- ARM: dts: stm32: Deduplicate serial aliases and chosen node for STM32MP15xx DHCOM SoM +- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie1 +- RDMA/srp: Fix error handling in srp_add_port +- arm64: dts: mediatek: mt8183: willow: Support second source touchscreen +- arm64: dts: mediatek: mt8183: kenzo: Support second source touchscreen +- RDMA/rxe: Fix mismatched max_msg_sz +- RDMA/rxe: Improve newline in printing messages +- arm: dts: socfpga: use reset-name "stmmaceth-ocp" instead of "ahb" +- ARM: dts: aspeed: yosemite4: correct the compatible string for max31790 +- ARM: dts: aspeed: yosemite4: Add required properties for IOE on fan boards +- ARM: dts: aspeed: yosemite4: correct the compatible string of adm1272 +- arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names +- arm64: dts: mediatek: mt8173-elm: Fix MT6397 PMIC sub-node names +- arm64: dts: mediatek: mt8195-demo: Drop regulator-compatible property +- arm64: dts: mediatek: mt8195-cherry: Drop regulator-compatible property +- arm64: dts: mediatek: mt8192-asurada: Drop regulator-compatible property +- arm64: dts: mediatek: mt8173-elm: Drop regulator-compatible property +- arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property +- rdma/cxgb4: Prevent potential integer overflow on 32bit +- RDMA/mlx4: Avoid false error about access to uninitialized gids array +- ARM: dts: stm32: Fix IPCC EXTI declaration on stm32mp151 +- arm64: dts: mediatek: mt8516: reserve 192 KiB for TF-A +- arm64: dts: mediatek: mt8516: add i2c clock-div property +- arm64: dts: mediatek: mt8516: fix wdt irq type +- arm64: dts: mediatek: mt8516: fix GICv2 range +- arm64: dts: mt8183: set DMIC one-wire mode on Damu +- arm64: dts: mediatek: mt8186: Move wakeup to MTU3 to get working suspend +- ARM: at91: pm: change BU Power Switch to automatic mode +- soc: atmel: fix device_node release in atmel_soc_device_init() +- cifs: Use cifs_autodisable_serverino() for disabling CIFS_MOUNT_SERVER_INUM in readdir.c +- smb: client: fix oops due to unset link speed +- padata: avoid UAF for reorder_work +- padata: add pd get/put refcnt helper +- padata: fix UAF in padata_reorder +- perf lock: Fix parse_lock_type which only retrieve one lock flag +- ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire A115-31 laptop +- bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write +- pinctrl: amd: Take suspend type into consideration which pins are non-wake +- pinctrl: stm32: Add check for clk_enable() +- perf report: Fix misleading help message about --demangle +- ASoC: Intel: avs: Fix theoretical infinite loop +- ASoC: Intel: avs: Do not readq() u32 registers +- ASoC: Intel: avs: Abstract IPC handling +- ASoC: Intel: avs: Prefix SKL/APL-specific members +- perf namespaces: Fixup the nsinfo__in_pidns() return type, its bool +- perf namespaces: Introduce nsinfo__set_in_pidns() +- perf machine: Don't ignore _etext when not a text symbol +- perf top: Don't complain about lack of vmlinux when not resolving some kernel samples +- padata: fix sysfs store callback check +- ALSA: seq: Make dependency on UMP clearer +- ALSA: seq: remove redundant 'tristate' for SND_SEQ_UMP_CLIENT +- crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto() +- ktest.pl: Remove unused declarations in run_bisect_test function +- perf expr: Initialize is_test value in expr__ctx_new() +- ASoC: renesas: rz-ssi: Use only the proper amount of dividers +- perf bpf: Fix two memory leakages when calling perf_env__insert_bpf_prog_info() +- perf header: Fix one memory leakage in process_bpf_prog_info() +- perf header: Fix one memory leakage in process_bpf_btf() +- crypto: caam - use JobR's space to access page 0 regs +- selftests/bpf: Fix fill_link_info selftest on powerpc +- ASoC: sun4i-spdif: Add clock multiplier settings +- tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server bind +- libbpf: don't adjust USDT semaphore address if .stapsdt.base addr is missing +- net/rose: prevent integer overflows in rose_setsockopt() +- tcp_cubic: fix incorrect HyStart round start detection +- net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns() +- netfilter: nft_flow_offload: update tcp state flags under lock +- netfilter: nf_tables: fix set size with rbtree backend +- netfilter: nft_set_rbtree: prefer sync gc to async worker +- netfilter: nft_set_rbtree: rename gc deactivate+erase function +- netfilter: nf_tables: de-constify set commit ops function argument +- net: sched: Disallow replacing of child qdisc from one parent to another +- net: avoid race between device unregistration and ethnl ops +- octeon_ep: remove firmware stats fetch in ndo_get_stats64 +- net/mlxfw: Drop hard coded max FW flash image size +- net: let net.core.dev_weight always be non-zero +- pwm: stm32: Add check for clk_enable() +- clk: analogbits: Fix incorrect calculation of vco rate delta +- inet: ipmr: fix data-races +- wifi: cfg80211: adjust allocation of colocated AP data +- wifi: cfg80211: Handle specific BSSID in 6GHz scanning +- selftests: harness: fix printing of mismatch values in __EXPECT() +- selftests: timers: clocksource-switch: Adapt progress to kselftest framework +- wifi: mt76: mt7996: fix ldpc setting +- wifi: mt76: mt7996: fix incorrect indexing of MIB FW event +- wifi: mt76: mt7996: fix HE Phy capability +- wifi: mt76: mt7996: fix the capability of reception of EHT MU PPDU +- wifi: mt76: mt7996: add max mpdu len capability +- wifi: mt76: mt7996: fix register mapping +- wifi: mt76: mt7915: fix register mapping +- wifi: mt76: mt7915: fix omac index assignment after hardware reset +- wifi: mt76: mt7915: improve hardware restart reliability +- wifi: mt76: connac: move mt7615_mcu_del_wtbl_all to connac +- wifi: mt76: mt7915: firmware restart on devices with a second pcie link +- wifi: mt76: mt7996: fix rx filter setting for bfee functionality +- wifi: mt76: mt7915: fix overflows seen when writing limit attributes +- wifi: mt76: mt7921: fix using incorrect group cipher after disconnection. +- wifi: mt76: mt76u_vendor_request: Do not print error messages when -EPROTO +- landlock: Handle weird files +- net/smc: fix data error when recvmsg with MSG_PEEK flag +- clk: ralink: mtmips: remove duplicated 'xtal' clock for Ralink SoC RT3883 +- wifi: mac80211: don't flush non-uploaded STAs +- wifi: mac80211: Fix common size calculation for ML element +- wifi: mac80211: fix tid removal during mesh forwarding +- wifi: mac80211: prohibit deactivating all links +- wifi: mt76: mt7915: Fix mesh scan on MT7916 DBDC +- wifi: wlcore: fix unbalanced pm_runtime calls +- samples/landlock: Fix possible NULL dereference in parse_path() +- mfd: syscon: Fix race in device_node_get_regmap() +- mfd: syscon: Use scoped variables with memory allocators to simplify error paths +- mfd: syscon: Add of_syscon_register_regmap() API +- mfd: syscon: Remove extern from function prototypes +- leds: cht-wcove: Use devm_led_classdev_register() to avoid memory leak +- HID: fix generic desktop D-Pad controls +- HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check +- clk: qcom: gcc-sdm845: Do not use shared clk_ops for QUPs +- wifi: ath12k: fix tx power, max reg power update to firmware +- ipmi: ssif_bmc: Fix new request loss when bmc ready for a response +- OPP: OF: Fix an OF node leak in _opp_add_static_v2() +- ax25: rcu protect dev->ax25_ptr +- regulator: of: Implement the unwind path of of_regulator_match() +- clk: sunxi-ng: a64: stop force-selecting PLL-MIPI as TCON0 parent +- clk: sunxi-ng: a64: drop redundant CLK_PLL_VIDEO0_2X and CLK_PLL_MIPI +- dt-bindings: clock: sunxi: Export PLL_VIDEO_2X and PLL_MIPI +- team: prevent adding a device which is already a team device lower +- clk: imx8mp: Fix clkout1/2 support +- cpufreq: qcom: Implement clk_ops::determine_rate() for qcom_cpufreq* clocks +- cpufreq: qcom: Fix qcom_cpufreq_hw_recalc_rate() to query LUT if LMh IRQ is not available +- gpio: pca953x: log an error when failing to get the reset GPIO +- gpio: pca953x: Fully convert to device managed resources +- gpio: pca953x: Drop unused fields in struct pca953x_platform_data +- cpufreq: schedutil: Fix superfluous updates caused by need_freq_update +- pwm: stm32-lp: Add check for clk_enable() +- inetpeer: do not get a refcount in inet_getpeer() +- inetpeer: update inetpeer timestamp in inet_getpeer() +- inetpeer: remove create argument of inet_getpeer() +- inetpeer: remove create argument of inet_getpeer_v[46]() +- leds: netxbig: Fix an OF node reference leak in netxbig_leds_get_of_pdata() +- dt-bindings: mfd: bd71815: Fix rsense and typos +- cpupower: fix TSC MHz calculation +- ACPI: fan: cleanup resources in the error path of .probe() +- wifi: brcmfmac: add missing header include for brcmf_dbg +- regulator: dt-bindings: mt6315: Drop regulator-compatible property +- HID: multitouch: fix support for Goodix PID 0x01e9 +- wifi: rtlwifi: pci: wait for firmware loading before releasing memory +- wifi: rtlwifi: fix memory leaks and invalid access at probe error path +- wifi: rtlwifi: destroy workqueue at rtl_deinit_core +- wifi: rtlwifi: remove unused check_buddy_priv +- dt-bindings: leds: class-multicolor: Fix path to color definitions +- clk: fix an OF node reference leak in of_clk_get_parent_name() +- of: remove internal arguments from of_property_for_each_u32() +- clk: si5351: allow PLLs to be adjusted without reset +- serial: sc16is7xx: use device_property APIs when configuring irda mode +- dt-bindings: mmc: controller: clarify the address-cells description +- rxrpc: Fix handling of received connection abort +- spi: zynq-qspi: Add check for clk_enable() +- net_sched: sch_sfq: don't allow 1 packet limit +- net_sched: sch_sfq: handle bigger packets +- net_sched: sch_sfq: annotate data-races around q->perturb_period +- wifi: rtlwifi: usb: fix workqueue leak when probe fails +- wifi: rtlwifi: fix init_sw_vars leak when probe fails +- wifi: rtlwifi: wait for firmware loading before releasing memory +- wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step +- wifi: rtlwifi: do not complete firmware loading needlessly +- wifi: ath11k: Fix unexpected return buffer manager error for WCN6750/WCN6855 +- ipmi: ipmb: Add check devm_kasprintf() returned value +- drm/amdgpu: tear down ttm range manager for doorbell in amdgpu_ttm_fini() +- drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE +- drm/msm: Check return value of of_dma_configure() +- drm/msm/dpu: link DSPP_2/_3 blocks on SM8550 +- drm/msm/dpu: link DSPP_2/_3 blocks on SM8350 +- drm/msm/dpu: link DSPP_2/_3 blocks on SM8250 +- drm/msm/dpu: link DSPP_2/_3 blocks on SC8180X +- drm/msm/dpu: link DSPP_2/_3 blocks on SM8150 +- OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized +- drm/amdgpu/vcn: reset fw_shared under SRIOV +- drm/rockchip: vop2: include rockchip_drm_drv.h +- drm/rockchip: move output interface related definition to rockchip_drm_drv.h +- drm/rockchip: vop2: Check linear format for Cluster windows on rk3566/8 +- drm/rockchip: vop2: Fix the windows switch between different layers +- drm/rockchip: vop2: set bg dly and prescan dly at vop2_post_config +- drm/rockchip: vop2: Set YUV/RGB overlay mode +- drm/rockchip: vop2: Fix the mixer alpha setup for layer 0 +- drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters offset +- drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table +- drm/amd/pm: Fix an error handling path in vega10_enable_se_edc_force_stall_config() +- HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections +- drm/etnaviv: Fix page property being used for non writecombine buffers +- drm/msm/dp: set safe_to_exit_level before printing it +- x86/topology: Use x86_sched_itmt_flags for PKG domain unconditionally +- x86/cpu: Enable SD_ASYM_PACKING for PKG domain on AMD +- sched/topology: Rename 'DIE' domain to 'PKG' +- afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call +- select: Fix unbalanced user_access_end() +- partitions: ldm: remove the initial kernel-doc notation +- selftests/powerpc: Fix argument order to timer_sub() +- pstore/blk: trivial typo fixes +- block: retry call probe after request_module in blk_request_module +- fs: fix proc_handler for sysctl_nr_open +- afs: Fix cleanup of immediately failed async calls +- afs: Fix directory format encoding struct +- afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY +- dlm: fix srcu_read_lock() return type to int +- powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active +- !15477 PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() +- PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() +- !15472 PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() +- PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() +- !15473 iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() +- iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() +- !15474 OPP: add index check to assert to avoid buffer overflow in _read_freq() +- OPP: add index check to assert to avoid buffer overflow in _read_freq() +- !15475 wifi: wcn36xx: fix channel survey memory allocation size +- wifi: wcn36xx: fix channel survey memory allocation size +- !15476 LoongArch: Fix warnings during S3 suspend +- LoongArch: Fix warnings during S3 suspend +- !15464 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.72-6.6.75 LTS Patches +- drm/v3d: Assign job pointer to NULL before signaling the fence +- Input: xpad - add support for wooting two he (arm) +- Input: xpad - add support for Nacon Evol-X Xbox One Controller +- Input: xpad - improve name of 8BitDo controller 2dc8:3106 +- Input: xpad - add QH Electronics VID/PID +- Input: xpad - add unofficial Xbox 360 wireless receiver clone +- Input: atkbd - map F23 key to support default copilot shortcut +- Input: xpad - add support for Nacon Pro Compact +- ALSA: usb-audio: Add delay quirk for USB Audio Device +- Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null" +- scsi: storvsc: Ratelimit warning logs to prevent VM denial of service +- vfio/platform: check the bounds of read/write syscalls +- cachestat: fix page cache statistics permission checking +- Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad" +- net: sched: fix ets qdisc OOB Indexing +- smb: client: handle lack of EA support in smb2_query_path_info() +- libfs: Add simple_offset_rename() API +- ASoC: samsung: Add missing depends on I2C +- hwmon: (drivetemp) Set scsi command timeout to 10s +- irqchip/sunxi-nmi: Add missing SKIP_WAKE flag +- of/unittest: Add test that of_address_to_resource() fails on non-translatable address +- drm/amd/display: Use HW lock mgr for PSR1 +- scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request +- seccomp: Stub for !CONFIG_SECCOMP +- ASoC: samsung: Add missing selects for MFD_WM8994 +- ASoC: wm8994: Add depends on MFD core +- x86/xen: fix SLS mitigation in xen_hypercall_iret() +- nfsd: add list_head nf_gc to struct nfsd_file +- Revert "drm/amdgpu: rework resume handling for display (v2)" +- fs: relax assertions on failure to encode file handles +- ovl: support encoding fid from inode with no alias +- ovl: pass realinode to ovl_encode_real_fh() instead of realdentry +- ocfs2: fix deadlock in ocfs2_get_system_file_inode +- iio: imu: inv_icm42600: fix spi burst write not supported +- Revert "PCI: Use preserve_config in place of pci_flags" +- drm/amdgpu: always sync the GFX pipe on ctx switch +- drm/i915/fb: Relax clear color alignment to 64 bytes +- hrtimers: Handle CPU state correctly on hotplug +- irqchip: Plug a OF node reference leak in platform_irqchip_probe() +- filemap: avoid truncating 64-bit offset to 32 bits +- nouveau/fence: handle cross device fences properly +- vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] +- vsock: reset socket state when de-assigning the transport +- vsock/virtio: cancel close work in the destructor +- vsock/virtio: discard packets if the transport changes +- net: ethernet: xgbe: re-add aneg to supported features in PHY quirks +- selftests: mptcp: avoid spurious errors on disconnect +- mptcp: fix spurious wake-up on under memory pressure +- mptcp: be sure to send ack when mptcp-level window re-opens +- i2c: atr: Fix client detach +- zram: fix potential UAF of zram table +- ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA +- x86/asm: Make serialize() always_inline +- nvmet: propagate npwg topology +- RDMA/bnxt_re: Fix to export port num to ib_query_qp +- poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll() +- ACPI: resource: acpi_dev_irq_override(): Check DMI match last +- smb: client: fix double free of TCP_Server_Info::hostname +- i2c: rcar: fix NACK handling when being a target +- i2c: mux: demux-pinctrl: check initial mux selection, too +- Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data" +- hwmon: (tmp513) Fix division of negative numbers +- soc: ti: pruss: Fix pruss APIs +- drm/v3d: Ensure job pointer is set to NULL after job completion +- drm/vmwgfx: Add new keep_resv BO param +- net/mlx5e: Always start IPsec sequence number from 1 +- net/mlx5e: Rely on reqid in IPsec tunnel mode +- net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel +- net/mlx5: Clear port select structure when fail to create +- net/mlx5: Fix RDMA TX steering prio +- net: fec: handle page_pool_dev_alloc_pages error +- net: xilinx: axienet: Fix IRQ coalescing packet count overflow +- nfp: bpf: prevent integer overflow in nfp_bpf_event_output() +- pktgen: Avoid out-of-bounds access in get_imix_entries +- openvswitch: fix lockup on tx to unregistering netdev with carrier +- bpf: Fix bpf_sk_select_reuseport() memory leak +- net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field() +- Revert "ovl: do not encode lower fh with upper sb_writers held" +- Revert "ovl: pass realinode to ovl_encode_real_fh() instead of realdentry" +- Revert "ovl: support encoding fid from inode with no alias" +- !15608 perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list +- perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list +- !15360 USB: hub: Ignore non-compliant devices with too many configs or interfaces +- USB: hub: Ignore non-compliant devices with too many configs or interfaces +- !15597 CVE-2025-21853 +- bpf: avoid holding freeze_mutex during mmap operation +- bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic +- !15603 Mainline patch merged into OLK-6.6 +- RDMA/hns: Fix missing xa_destroy() +- RDMA/hns: Fix wrong value of max_sge_rd +- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() +- RDMA/hns: Fix invalid sq params not being blocked +- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() +- RDMA/hns: Fix soft lockup during bt pages loop +- !15430 cpufreq: Fix some boost errors related to CPU online and offline +- cpufreq: prevent NULL dereference in cpufreq_online() +- cpufreq: ACPI: Remove set_boost in acpi_cpufreq_cpu_init() +- cpufreq: CPPC: Fix wrong max_freq in policy initialization +- cpufreq: Introduce a more generic way to set default per-policy boost flag +- cpufreq: Fix re-boost issue after hotplugging a CPU +- !15568 [olk 6.6] some features for hibmcge driver +- net: hibmcge: Add support for ioctl +- net: hibmcge: Add support for BMC diagnose feature +- net: hibmcge: Add support for mac link exception handling feature +- net: hibmcge: Add support for abnormal irq handling feature +- net: hibmcge: Add support for checksum offload +- net: hibmcge: Add support for dump statistics +- ethtool: Implement ethtool_puts() +- !15357 blk-cgroup: Fix class @block_class's subsystem refcount leakage +- blk-cgroup: Fix class @block_class's subsystem refcount leakage +- !15333 VirtCCA Feature: cvm support UEFI boot +- Bug fix: Resolve the issue of host hard lockup +- VirtCCA: The cvm removes the vcpu binding limit. +- VirtCCA: Improve nfs workqueue bind method +- VirtCCA: Intercept the situation where devices with both NVM adn CVM passthrough under same PCIe root port +- VirtCCA: an interface to retrieve the TMI version is added +- VirtCCA: cvm support UEFI boot +- !15414 bnxt_en: Fix possible memory leak when hwrm_req_replace fails +- bnxt_en: Fix possible memory leak when hwrm_req_replace fails +- !15580 two bugfixs +- mm/migrate: fix shmem xarray update during migration +- mm: fix finish_fault() handling for large folios + +* Tue Mar 18 2025 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-83.0.0.88 +- !15047 mm: Backport some mm patchs +- mm/memmap: prevent double scanning of memmap by kmemleak +- mm: kmemleak: fix upper boundary check for physical address objects +- mm/vmscan: fix hard LOCKUP in function isolate_lru_folios +- mm: compaction: use the proper flag to determine watermarks +- !15271 LoongArch: fix cacheinfo/unaligned/rtc/s3/hda/usb issues +- blutetooth/btusb: delay 1ms while suspending +- LoongArch: Correct the cacheinfo sharing information +- ice: fix unaligned access in ice_create_lag_recipe +- LoongArch: set CONFIG_CMA_SIZE_MBYTES to 0 +- rtc: loongson: clear TOY_MATCH0_REG in loongson_rtc_isr() +- hda/pci: Add AZX_DCAPS_NO_TCSEL flag for Loongson HDA devices +- LoongArch: Update the flush cache policy +- !15516 mm: shmem: remove unnecessary warning in shmem_writepage() +- mm: shmem: remove unnecessary warning in shmem_writepage() +- !15492 Add dp module in hibmc driver +- drm/hisilicon/hibmc: add dp module in hibmc +- drm/hisilicon/hibmc: refactored struct hibmc_drm_private +- drm/hisilicon/hibmc: add dp hw moduel in hibmc driver +- drm/hisilicon/hibmc: add dp link moduel in hibmc drivers +- drm/hisilicon/hibmc: add dp aux in hibmc drivers +- drm/hisilicon/hibmc: convert to struct drm_edid +- !15395 clk: qcom: dispcc-sm6350: Add missing parent_map for a clock +- clk: qcom: dispcc-sm6350: Add missing parent_map for a clock +- !15459 perf: Configure BRBE correctly on VHE host +- perf: Configure BRBE correctly on VHE host +- !15369 media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread +- media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread +- !15421 [OLK-6.6] [Backport] upstream fix for driver nvme +- nvme: handle connectivity loss in nvme_set_queue_count +- nvme: fix bogus kzalloc() return check in nvme_init_effects_log() +- nvme: Add error path for xa_store in nvme_init_effects +- nvme: Add error check for xa_store in nvme_get_effects_log +- !15370 wifi: brcmfmac: Check the return value of of_property_read_string_index() +- wifi: brcmfmac: Check the return value of of_property_read_string_index() +- !15483 CVE-2024-58069 +- rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read +- !15470 some readahead improvement +- readahead: properly shorten readahead when falling back to do_page_cache_ra() +- readahead: don't shorten readahead window in read_pages() +- readahead: make sure sync readahead reads needed page +- !15404 ipmr: do not call mr_mfc_uses_dev() for unres entries +- ipmr: do not call mr_mfc_uses_dev() for unres entries +- !15376 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.62-6.6.63 LTS Conflicts Patches +- mptcp: update local address flags when setting it +- NFSD: Async COPY result needs to return a write verifier +- !15164 [openEuler-24.03-LTS][linux-6.6.y sync] KVM: x86: Play nice with protected guests in complete_hypercall_exit() +- KVM: x86: Play nice with protected guests in complete_hypercall_exit() +- !15375 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.60-6.6.61 LTS Conflicts Patches +- posix-cpu-timers: Clear TICK_DEP_BIT_POSIX_TIMER on clone +- !15149 Fix northbridge init warning in guest for Hygon family 18h model 4h +- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h +- !15147 Add device HID for Hygon GPIO controller +- pinctrl: Add device HID for Hygon GPIO controller +- !15438 fix HCT build err once VFIO disabled +- hct: fix build err once VFIO disabled + +* Fri Mar 14 2025 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-82.0.0.87 +- RISC-V kernel upgrade to 6.6.0-82.0.0 +- riscv: Fixed conflict created by commit c7c8e8a76904 +- riscv: Enable zstd-compressed firmware support +- riscv: Enable AMDKFD driver for ROCm + +* Wed Mar 12 2025 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-82.0.0.86 +- !15440 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.70-6.6.72 LTS Patches +- drm/mediatek: Only touch DISP_REG_OVL_PITCH_MSB if AFBC is supported +- riscv: Fix text patching when IPI are used +- mm: hugetlb: independent PMD page table shared count +- mm/hugetlb: enforce that PMD PT sharing has split PMD PT locks +- pgtable: fix s390 ptdesc field comments +- workqueue: Add rcu lock check at the end of work item execution +- pmdomain: imx: gpcv2: fix an OF node reference leak in imx_gpcv2_probe() +- pmdomain: imx: gpcv2: Simplify with scoped for each OF child loop +- arm64: dts: rockchip: add hevc power domain clock to rk3328 +- ARM: dts: imxrt1050: Fix clocks for mmc +- io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period +- riscv: kprobes: Fix incorrect address calculation +- iio: adc: ad7124: Disable all channels at probe time +- iio: inkern: call iio_device_put() only on mapped devices +- iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep() +- iio: gyro: fxas21002c: Fix missing data update in trigger handler +- iio: imu: kmx61: fix information leak in triggered buffer +- iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer +- iio: pressure: zpa2326: fix information leak in triggered buffer +- usb: gadget: configfs: Ignore trailing LF for user strings to cdev +- usb: gadget: f_fs: Remove WARN_ON in functionfs_bind +- usb: typec: tcpm/tcpci_maxim: fix error code in max_contaminant_read_resistance_kohm() +- usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints +- usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe() +- usb: gadget: midi2: Reverse-select at the right place +- usb: fix reference leak in usb_new_device() +- USB: core: Disable LPM only for non-suspended ports +- USB: usblp: return error when setting unsupported protocol +- usb: dwc3-am62: Disable autosuspend during remove +- usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null +- tty: serial: 8250: Fix another runtime PM usage counter underflow +- misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config +- usb: dwc3: gadget: fix writing NYET threshold +- USB: serial: cp210x: add Phoenix Contact UPS Device +- usb-storage: Add max sectors quirk for Nokia 208 +- staging: iio: ad9832: Correct phase range check +- staging: iio: ad9834: Correct phase range check +- USB: serial: option: add Neoway N723-EA support +- USB: serial: option: add MeiG Smart SRM815 +- dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2) +- io_uring/timeout: fix multishot updates +- drm/amd/display: increase MAX_SURFACES to the value supported by hw +- drm/amdkfd: fixed page fault when enable MES shader debugger +- ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[] +- ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[] +- smb: client: sync the root session and superblock context passwords before automounting +- thermal: of: fix OF node leak in of_thermal_zone_find() +- ksmbd: Implement new SMB3 POSIX type +- sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy +- sctp: sysctl: udp_port: avoid using current->nsproxy +- sctp: sysctl: auth_enable: avoid using current->nsproxy +- sctp: sysctl: rto_min/max: avoid using current->nsproxy +- sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy +- mptcp: sysctl: sched: avoid using current->nsproxy +- dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY +- scsi: ufs: qcom: Power off the PHY if it was already powered on in ufs_qcom_power_up_sequence() +- dm thin: make get_first_thin use rcu-safe list first function +- riscv: mm: Fix the out of bound issue of vmemmap address +- cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu +- ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked +- afs: Fix the maximum cell name length +- drm/mediatek: Add return value check when reading DPCD +- drm/mediatek: Fix mode valid issue for dp +- drm/mediatek: Fix YCbCr422 color format issue for DP +- drm/mediatek: stop selecting foreign drivers +- net/mlx5: Fix variable not being completed when function returns +- net: stmmac: dwmac-tegra: Read iommu stream id from device tree +- netfilter: nf_tables: imbalance in flowtable binding +- iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on +- x86/mm/numa: Use NUMA_NO_NODE when calling memblock_set_node() +- memblock tests: fix implicit declaration of function 'numa_valid_node' +- riscv: Fix early ftrace nop patching +- tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset +- Bluetooth: btnxpuart: Fix driver sending truncated data +- Bluetooth: MGMT: Fix Add Device to responding before completing +- Bluetooth: hci_sync: Fix not setting Random Address when required +- eth: gve: use appropriate helper to set xdp_features +- ipvlan: Fix use-after-free in ipvlan_get_iflink(). +- tls: Fix tls_sw_sendmsg error handling +- igc: return early when failing to read EECD register +- igc: field get conversion +- ice: fix incorrect PHY settings for 100 GB/s +- cxgb4: Avoid removal of uninserted tid +- bnxt_en: Fix possible memory leak when hwrm_req_replace fails +- pds_core: limit loop over fw name list +- net: libwx: fix firmware mailbox abnormal return +- tcp/dccp: allow a connection when sk_max_ack_backlog is zero +- tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog +- net: 802: LLC+SNAP OID:PID lookup on start of skb data +- ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe() +- selftests/alsa: Fix circular dependency involving global-timer +- ASoC: mediatek: disable buffer pre-allocation +- ASoC: rt722: add delay time to wait for the calibration procedure +- erofs: fix PSI memstall accounting +- erofs: handle overlapped pclusters out of crafted images properly +- ovl: support encoding fid from inode with no alias +- ovl: pass realinode to ovl_encode_real_fh() instead of realdentry +- ovl: do not encode lower fh with upper sb_writers held +- exfat: fix the infinite loop in __exfat_free_cluster() +- dm array: fix cursor index when skipping across block boundaries +- dm array: fix unreleased btree blocks on closing a faulty array cursor +- dm array: fix releasing a faulty array block twice in dm_array_cursor_end +- jbd2: flush filesystem device before updating tail sequence +- jbd2: increase IO priority for writing revoke records +- memblock: make memblock_set_node() also warn about use of MAX_NUMNODES +- x86/hyperv: Fix hv tsc page based sched_clock for hibernation +- Revert "x86, crash: wrap crash dumping code into crash related ifdefs" +- Revert "x86/hyperv: Fix hv tsc page based sched_clock for hibernation" +- !15423 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.69-6.6.70 LTS Additional Patches +- !15423 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.69-6.6.70 LTS Additional Patches +- RDMA/bnxt_re: Fix max SGEs for the Work Request +- mptcp: don't always assume copied data in mptcp_cleanup_rbuf() +- mptcp: fix recvbuffer adjust on sleeping rcvmsg +- mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() +- mm/kmemleak: fix sleeping function called from invalid context at print message +- mm/readahead: fix large folio support in async readahead +- fs/proc/task_mmu: fix pagemap flags with PMD THP entries on 32bit +- drm: adv7511: Fix use-after-free in adv7533_attach_dsi() +- dt-bindings: display: adi,adv7533: Drop single lane support +- drm: adv7511: Drop dsi single lane support +- net/sctp: Prevent autoclose integer overflow in sctp_association_init() +- sky2: Add device ID 11ab:4373 for Marvell 88E8075 +- RDMA/uverbs: Prevent integer overflow issue +- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity +- kcov: mark in_softirq_really() as __always_inline +- ALSA hda/realtek: Add quirk for Framework F111:000C +- ALSA: seq: Check UMP support for midi_version change +- modpost: fix the missed iteration for the max bit in do_input() +- modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host +- RDMA/bnxt_re: Fix the max WQE size for static WQE support +- ARC: build: Try to guess GCC variant of cross compiler +- irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base +- Bluetooth: hci_core: Fix sleeping function called from invalid context +- net: usb: qmi_wwan: add Telit FE910C04 compositions +- smb: client: destroy cfid_put_wq on module exit +- ksmbd: set ATTR_CTIME flags when setting mtime +- ksmbd: retry iterate_dir in smb2_query_dir +- bpf: fix potential error return +- sound: usb: format: don't warn that raw DSD is unsupported +- sound: usb: enable DSD output for ddHiFi TC44C +- ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model +- drm/amdkfd: Correct the migration DMA map direction +- wifi: mac80211: wake the queues in case of failure in resume +- net: ti: icssg-prueth: Fix clearing of IEP_CMP_CFG registers during iep_init +- ila: serialize calls to nf_register_net_hooks() +- af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK +- af_packet: fix vlan_get_tci() vs MSG_PEEK +- net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init() +- net: restrict SO_REUSEPORT to inet sockets +- net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets +- net: sfc: Correct key_len for efx_tc_ct_zone_ht_params +- RDMA/rtrs: Ensure 'ib_sge list' is accessible +- net: mv643xx_eth: fix an OF node reference leak +- eth: bcmsysport: fix call balance of priv->clk handling routines +- ALSA: usb-audio: US16x08: Initialize array before use +- net: llc: reset skb->transport_header +- netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext +- drm/i915/dg1: Fix power gate sequence. +- net/mlx5e: macsec: Maintain TX SA from encoding_sa +- net/mlx5: DR, select MSIX vector 0 for completion queue creation +- netrom: check buffer length before accessing it +- net: Fix netns for ip_tunnel_init_flow() +- ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_xmit() +- ipv4: ip_tunnel: Unmask upper DSCP bits in ip_md_tunnel_xmit() +- ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev() +- ip_tunnel: annotate data-races around t->parms.link +- net: stmmac: restructure the error path of stmmac_probe_config_dt() +- net: stmmac: don't create a MDIO bus if unnecessary +- net: dsa: microchip: Fix LAN937X set_ageing_time function +- net: dsa: microchip: Fix KSZ9477 set_ageing_time function +- drm/bridge: adv7511_audio: Update Audio InfoFrame properly +- RDMA/bnxt_re: Fix the locking while accessing the QP table +- RDMA/bnxt_re: Fix MSN table size for variable wqe mode +- RDMA/bnxt_re: Add send queue size check for variable wqe +- RDMA/bnxt_re: Disable use of reserved wqes +- RDMA/bnxt_re: Add support for Variable WQE in Genp7 adapters +- RDMA/bnxt_re: Fix max_qp_wrs reported +- RDMA/bnxt_re: Fix reporting hw_ver in query_device +- RDMA/bnxt_re: Add check for path mtu in modify_qp +- RDMA/bnxt_re: Fix the check for 9060 condition +- nvme-pci: 512 byte aligned dma pool segment quirk +- RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters +- RDMA/bnxt_re: Avoid initializing the software queue for user queues +- RDMA/mlx5: Enforce same type port association for multiport RoCE +- RDMA/bnxt_re: Remove always true dattr validity check +- RDMA/bnxt_re: Allow MSN table capability check +- powerpc: Remove initialisation of readpos +- net: mctp: handle skb cleanup on sock_queue failures +- ceph: give up on paths longer than PATH_MAX +- mmc: sdhci-msm: fix crypto key eviction +- !15418 ocfs2: handle a symlink read error correctly +- ocfs2: handle a symlink read error correctly +- !15299 ptp: Ensure info->enable callback is always set +- !15299 ptp: Ensure info->enable callback is always set +- ptp: Ensure info->enable callback is always set +- !15424 bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT +- !15424 bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT +- bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT +- !15367 libbpf: Fix segfault due to libelf functions not setting errno +- !15367 libbpf: Fix segfault due to libelf functions not setting errno +- libbpf: Fix segfault due to libelf functions not setting errno +- !15417 [Intel-SIG] x86/cpu: Clearwater Forest support including CPU model and new ISAs +- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest +- x86/cpu: Add model number for Intel Clearwater Forest processor +- !15225 cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0 +- !15225 cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0 +- cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0 +- !15390 backport mainline bugfix patch +- !15390 backport mainline bugfix patch +- irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly +- genirq: Make handle_enforce_irqctx() unconditionally available +- !15229 NFS: remove unused variable nfs_rpcstat +- NFS: remove unused variable nfs_rpcstat +- !14975 [OLK-6.6] [Backport] scsi: lpfc: Update phba link state conditional before sending CMF_SYNC_WQE +- scsi: lpfc: Update phba link state conditional before sending CMF_SYNC_WQE +- !15302 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.57-6.6.58 LTS Conflicts Patches +- selftests: mptcp: join: test for prohibited MPC to port-based endp +- !15292 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.56-6.6.57 LTS Conflicts Patches +- HID: mcp2200: added driver for GPIOs of MCP2200 +- !15326 [OLK-6.6]Hygon: Rename Hygon SM{3,4} feature macro to X86_FEATURE_HYGON_SM{3,4} +- !15326 [OLK-6.6]Hygon: Rename Hygon SM{3,4} feature macro to X86_FEATURE_HYGON_SM{3,4} +- x86/cpufeatures: Rename X86_FEATURE_SM{3,4} to X86_FEATURE_HYGON_SM{3,4} +- !15402 nilfs2: fix possible int overflows in nilfs_fiemap() +- !15402 nilfs2: fix possible int overflows in nilfs_fiemap() +- nilfs2: fix possible int overflows in nilfs_fiemap() +- !15043 wifi: mac80211: fix mbss changed flags corruption on 32 bit systems +- wifi: mac80211: fix mbss changed flags corruption on 32 bit systems +- !15283 wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion +- wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion +- !15308 CVE-2025-21732 +- RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error +- RDMA/mlx5: Ensure created mkeys always have a populated rb_key +- RDMA/mlx5: Change check for cacheable mkeys +- !15298 usbnet: ipheth: fix possible overflow in DPE length check +- usbnet: ipheth: fix possible overflow in DPE length check +- !15334 perf/core: Save raw sample data conditionally based on sample type +- perf/core: Save raw sample data conditionally based on sample type +- !15347 Mainline Patch +- bpf: Use preempt_count() directly in bpf_send_signal_common() +- bpf: Send signals asynchronously if !preemptible +- !15331 Fixes CVE-2025-21767 +- clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context +- clocksource: Use pr_info() for "Checking clocksource synchronization" message +- !15221 smb: client: Fix netns refcount imbalance causing leaks and use-after-free +- smb: client: Fix netns refcount imbalance causing leaks and use-after-free +- !15364 LoongArch: csum: Fix OoB access in IP checksum code for negative lengths +- LoongArch: csum: Fix OoB access in IP checksum code for negative lengths +- !15345 USB: hub: Ignore non-compliant devices with too many configs or interfaces +- USB: hub: Ignore non-compliant devices with too many configs or interfaces +- !15363 gpiolib: Fix crash on error in gpiochip_get_ngpios() +- gpiolib: Fix crash on error in gpiochip_get_ngpios() +- !15385 orangefs: fix a oob in orangefs_debug_write +- orangefs: fix a oob in orangefs_debug_write +- !15265 NFSD: fix hang in nfsd4_shutdown_callback +- NFSD: fix hang in nfsd4_shutdown_callback +- !15263 NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() +- NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() +- !15266 nfsd: clear acl_access/acl_default after releasing them +- nfsd: clear acl_access/acl_default after releasing them +- !15346 block: mark GFP_NOIO around sysfs ->store() +- block: mark GFP_NOIO around sysfs ->store() +- !15309 usb: xhci: Fix NULL pointer dereference on certain command aborts +- !15309 usb: xhci: Fix NULL pointer dereference on certain command aborts +- usb: xhci: Fix NULL pointer dereference on certain command aborts +- !15204 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.69-6.6.70 LTS Patches +- !15204 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.69-6.6.70 LTS Patches +- platform/x86: mlx-platform: call pci_dev_put() to balance the refcount +- ALSA: ump: Shut up truncated string warning +- usb: xhci: Avoid queuing redundant Stop Endpoint commands +- cleanup: Remove address space of returned pointer +- crypto: ecc - Prevent ecc_digits_from_bytes from reading too many bytes +- Bluetooth: btusb: mediatek: add callback function in btusb_disconnect +- Bluetooth: btusb: add callback function in btusb suspend/resume +- scsi: mpi3mr: Start controller indexing from 0 +- scsi: mpi3mr: Use ida to manage mrioc ID +- ALSA: ump: Update legacy substream names upon FB info update +- ALSA: ump: Indicate the inactive group in legacy substream names +- ALSA: ump: Don't open legacy substream for an inactive group +- ALSA: ump: Use guard() for locking +- udf: Verify inode link counts before performing rename +- udf_rename(): only access the child content on cross-directory rename +- watchdog: rzg2l_wdt: Power on the watchdog domain in the restart handler +- watchdog: rzg2l_wdt: Rely on the reset driver for doing proper reset +- watchdog: rzg2l_wdt: Remove reset de-assert from probe +- of: address: Preserve the flags portion on 1:1 dma-ranges mapping +- of: address: Store number of bus flag cells rather than bool +- of: address: Remove duplicated functions +- x86/hyperv: Fix hv tsc page based sched_clock for hibernation +- x86, crash: wrap crash dumping code into crash related ifdefs +- thunderbolt: Don't display nvm_version unless upgrade supported +- thunderbolt: Add support for Intel Panther Lake-M/P +- thunderbolt: Add support for Intel Lunar Lake +- xhci: Turn NEC specific quirk for handling Stop Endpoint errors generic +- usb: xhci: Limit Stop Endpoint retries +- xhci: retry Stop Endpoint on buggy NEC controllers +- net: renesas: rswitch: fix possible early skb release +- softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel +- net/mlx5: unique names for per device caches +- Revert "nvme: make keep-alive synchronous operation" +- nvme: use helper nvme_ctrl_state in nvme_keep_alive_finish function +- usb: typec: ucsi: add update_connector callback +- usb: typec: ucsi: add callback for connector status updates +- iio: adc: ad7192: properly check spi_get_device_match_data() +- iio: adc: ad7192: Convert from of specific to fwnode property handling +- usb: chipidea: udc: limit usb request length to max 16KB +- usb: chipidea: add CI_HDRC_HAS_SHORT_PKT_LIMIT flag +- usb: chipidea: add CI_HDRC_FORCE_VBUS_ACTIVE_ALWAYS flag +- fs/ntfs3: Fix warning in ni_fiemap +- fs/ntfs3: Implement fallocate for compressed files +- remoteproc: qcom: pas: enable SAR2130P audio DSP support +- remoteproc: qcom: pas: Add support for SA8775p ADSP, CDSP and GPDSP +- remoteproc: qcom: pas: Add sc7180 adsp +- mailbox: pcc: Check before sending MCTP PCC response ACK +- clk: qcom: clk-alpha-pll: Add NSS HUAYRA ALPHA PLL support for ipq9574 +- clk: qcom: clk-alpha-pll: Add support for zonda ole pll configure +- Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925 +- Bluetooth: btusb: Add USB HW IDs for MT7921/MT7922/MT7925 +- Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925 +- Bluetooth: Add support ITTIM PE50-M75C +- Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions +- i2c: i801: Add support for Intel Panther Lake +- i2c: i801: Add support for Intel Arrow Lake-H +- wifi: ath10k: avoid NULL pointer error during sdio remove +- wifi: ath10k: Update Qualcomm Innovation Center, Inc. copyrights +- media: uvcvideo: Force UVC version to 1.0a for 0408:4033 +- media: uvcvideo: Force UVC version to 1.0a for 0408:4035 +- cleanup: Adjust scoped_guard() macros to avoid potential warning +- cleanup: Add conditional guard support +- crypto: ecdsa - Avoid signed integer overflow on signature decoding +- crypto: ecdsa - Use ecc_digits_from_bytes to convert signature +- crypto: ecdsa - Rename keylen to bufsize where necessary +- crypto: ecdsa - Convert byte arrays with key coordinates to digits +- ext4: partial zero eof block on unaligned inode size extension +- ext4: convert to new timestamp accessors +- memblock: allow zero threshold in validate_numa_converage() +- NUMA: optimize detection of memory with no node id assigned by firmware +- sched: Initialize idle tasks only once +- usb: dwc3: gadget: Add missing check for single port RAM in TxFIFO resizing logic +- smb: client: fix use-after-free of signing key +- smb: client: stop flooding dmesg in smb2_calc_signature() +- fs/smb/client: implement chmod() for SMB3 POSIX Extensions +- smb/client: rename cifs_ace to smb_ace +- smb/client: rename cifs_acl to smb_acl +- smb/client: rename cifs_sid to smb_sid +- smb/client: rename cifs_ntsd to smb_ntsd +- x86/mm: Carve out INVLPG inline asm for use by others +- docs: media: update location of the media patches +- drm/amd/display: Fix incorrect DSC recompute trigger +- drm/amd/display: Fix DSC-re-computing + +* Wed Mar 05 2025 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-80.0.0.85 +- !15278 tracing/osnoise: Fix resetting of tracepoints +- tracing/osnoise: Fix resetting of tracepoints +- !15227 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.54-6.6.55 LTS Conflicts Patches +- mm: z3fold: deprecate CONFIG_Z3FOLD +- null_blk: Remove usage of the deprecated ida_simple_xx() API +- iomap: handle a post-direct I/O invalidate race in iomap_write_delalloc_release +- proc: add config & param to block forcing mem writes +- HID: Ignore battery for all ELAN I2C-HID devices +- ata: sata_sil: Rename sil_blacklist to sil_quirks +- ata: pata_serverworks: Do not use the term blacklist +- scsi: aacraid: Rearrange order of struct aac_srb_unit +- uprobes: Fix race in uprobe_free_utask +- perf,x86: Fix kabi breakage in struct uprobe_task +- perf,x86: avoid missing caller address in stack traces captured in uprobe +- i2c: synquacer: Deal with optional PCLK correctly +- i2c: synquacer: Remove a clk reference from struct synquacer_i2c +- !15248 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.64-6.6.66 LTS Conflicts Patches +- mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM +- selftests/ftrace: adjust offset for kprobe syntax error test +- bpf: Remove unnecessary kfree(im_node) in lpm_trie_update_elem +- iommu/arm-smmu: Defer probe of clients after smmu device bound +- gpio: grgpio: use a helper variable to store the address of ofdev->dev +- KVM: arm64: Change kvm_handle_mmio_return() return polarity +- !15270 v2 mm: Backport two patch +- arm64/mm: Drop setting PTE_TYPE_PAGE in pte_mkcont() +- arm64/mm: Re-organize arch_make_huge_pte() +- mm/hugetlb: use arch_make_huge_pte() in __hugetlb_insert_pfn() +- !14820 [OLK-6.6]Hygon: Support kernel boot verification and secret injection for Hygon CSV3 VM +- KVM: SVM: CSV: Support inject secret to Hygon CSV3 guest +- KVM: SVM: CSV: Support issue non-4K aligned CSV3_CMD_LAUNCH_ENCRYPT_DATA and more than once +- KVM: SVM: CSV: Provide KVM_CSV3_SET_GUEST_PRIVATE_MEMORY ioctl interface +- KVM: SVM: CSV: Provide KVM_CAP_HYGON_COCO_EXT interface +- crypto: ccp: Provide csv_get_extension_info() to present extensions of newer CSV firmware +- KVM: SVM: CSV: Ensure all the GPRs and some non-GPRs are synced before LAUNCH_ENCRYPT_VMCB +- crypto: ccp: Get api version again when update Hygon CSV firmware at runtime +- KVM: SVM: CSV: Fix the vm_size even if CSV3 feature is unsupported on Hygon CPUs +- !14819 [OLK-6.6]Hygon: Support CSV3 Attestation +- x86/configs: openeuler_defconfig: Set CONFIG_VIRT_DRIVERS=y and CONFIG_EFI_SECRET=m +- virt/csv-guest: Provide interface for request of CSV3 attestation report +- x86/csv: Add support for CSV3 ATTESTATION secure call +- x86/csv: Define ATTESTATION secure call command +- !15251 Intel: Backport upstream auto-tune per-CPU pageset size patchset +- mm and cache_info: remove unnecessary CPU cache info update +- !15185 hwtracing: hisi_ptt: Initialize the filter sysfs attribute when allocation +- hwtracing: hisi_ptt: Check duplicate filters before allocation +- hwtracing: hisi_ptt: Initialize the filter sysfs attribute when allocation + +* Wed Feb 26 2025 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-79.0.0.84 +- !15203 usb: cdc-acm: Check control transfer buffer size before access +- usb: cdc-acm: Check control transfer buffer size before access +- !15214 USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() +- USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() +- !15178 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.53-6.6.54 LTS Conflicts Patches +- perf time-utils: Fix 32-bit nsec parsing +- perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time +- perf stat: Display iostat headers correctly +- perf sched timehist: Fix missing free of session in perf_sched__timehist() +- perf report: Fix --total-cycles --stdio output error +- perf ui/browser/annotate: Use global annotation_options +- perf annotate: Move some source code related fields from 'struct annotation' to 'struct annotated_source' +- perf annotate: Split branch stack cycles info from 'struct annotation' +- perf inject: Fix leader sampling inserting additional samples +- perf mem: Free the allocated sort string, fixing a leak +- !14179 [OLK-6.6] update ITMT support patch for Zhaoxin CPUs +- cpufreq: acpi-cpufreq: Zhaoxin: fix incorrect max-freq issue +- cpufreq: ACPI: add ITMT support when CPPC enabled +- Revert "cpufreq: ACPI: add ITMT support when CPPC enabled" +- !15200 arm64/mpam: Try reading again if monitor instance returns not ready +- arm64/mpam: Try reading again if monitor instance returns not ready +- !15197 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.68-6.6.69 LTS Patches +- block: avoid to reuse `hctx` not removed from cpuhp callback list +- ALSA: hda/realtek: Fix spelling mistake "Firelfy" -> "Firefly" +- ALSA: sh: Fix wrong argument order for copy_from_iter() +- btrfs: sysfs: fix direct super block member reads +- btrfs: avoid monopolizing a core when activating a swap file +- power: supply: gpio-charger: Fix set charge current limits +- drm/amdkfd: pause autosuspend when creating pdd +- drm/amdkfd: Use device based logging for errors +- drm/amdkfd: drop struct kfd_cu_info +- drm/amdkfd: reduce stack size in kfd_topology_add_device() +- drm/amdgpu/hdp6.0: do a posting read when flushing HDP +- drm/amdgpu/hdp5.0: do a posting read when flushing HDP +- drm/amdgpu/hdp4.0: do a posting read when flushing HDP +- drm/amd/amdgpu: allow use kiq to do hdp flush under sriov +- pmdomain: core: Add missing put_device() +- ALSA: hda/realtek: fix micmute LEDs don't work on HP Laptops +- ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook X G1i +- MIPS: mipsregs: Set proper ISA level for virt extensions +- MIPS: Probe toolchain support of -msym32 +- blk-mq: move cpuhp callback registering out of q->sysfs_lock +- blk-mq: register cpuhp callback after hctx is added to xarray table +- drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() +- spi: omap2-mcspi: Fix the IS_ERR() bug for devm_clk_get_optional_enabled() +- scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error +- scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load time +- spi: intel: Add Panther Lake SPI controller support +- platform/x86: asus-nb-wmi: Ignore unknown event 0xCF +- LoongArch: BPF: Adjust the parameter of emit_jirl() +- LoongArch: Fix reserving screen info memory for above-4G firmware +- regmap: Use correct format specifier for logging range errors +- smb: server: Fix building with GCC 15 +- ALSA: sh: Use standard helper for buffer accesses +- ALSA: hda/conexant: fix Z60MR100 startup pop issue +- udf: Skip parent dir link count update if corrupted +- scsi: qla1280: Fix hw revision numbering for ISP1020/1040 +- watchdog: mediatek: Add support for MT6735 TOPRGU/WDT +- watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04 +- stddef: make __struct_group() UAPI C++-friendly +- powerpc/pseries/vas: Add close() callback in vas_vm_ops struct +- mtd: rawnand: fix double free in atmel_pmecc_create_user() +- dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset +- dmaengine: apple-admac: Avoid accessing registers in probe +- dmaengine: fsl-edma: implement the cleanup path of fsl_edma3_attach_pd() +- dmaengine: tegra: Return correct DMA status when paused +- dmaengine: dw: Select only supported masters for ACPI devices +- dmaengine: mv_xor: fix child node refcount handling in early exit +- phy: rockchip: naneng-combphy: fix phy reset +- phy: usb: Toggle the PHY power during init +- phy: core: Fix that API devm_phy_destroy() fails to destroy the phy +- phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider +- phy: core: Fix that API devm_phy_put() fails to release the phy +- phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() +- phy: core: Fix an OF node refcount leakage in _of_phy_get() +- phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP +- mtd: rawnand: arasan: Fix missing de-registration of NAND +- mtd: rawnand: arasan: Fix double assertion of chip-select +- mtd: diskonchip: Cast an operand to prevent potential overflow +- nfsd: restore callback functionality for NFSv4.0 +- nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work" +- bpf: Check negative offsets in __bpf_skb_min_len() +- tcp_bpf: Charge receive socket buffer in bpf_tcp_ingress() +- mm/vmstat: fix a W=1 clang compiler warning +- ceph: allocate sparse_ext map only for sparse reads +- ceph: fix memory leak in ceph_direct_read_write() +- ceph: try to allocate a smaller extent map for sparse read +- !15190 v2 fs/resctrl: Adapt to the hardware topology structures of RDT and MPAM +- arm64/mpam: Add write memory barrier to guarantee monitor results +- arm64/mpam: Improve conversion accuracy between percent and fixed-point fraction +- arm64/mpam: Fix out-of-bound access of cfg array +- arm64/mpam: fix bug in percent_to_mbw_max() +- arm64/mpam: fix MBA granularity conversion formula +- arm64/mpam: Fix out-of-bound access of mbwu_state array +- arm64/mpam: Add judgment to distinguish MSMON_MBWU_CAPTURE definition +- arm64/mpam: Support MATA monitor feature for MPAM +- fs/resctrl: Adapt to the hardware topology structures of RDT and MPAM +- !15192 scsi: megaraid_sas: Fix for a potential deadlock +- scsi: megaraid_sas: Fix for a potential deadlock +- !15191 gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag +- gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag +- !15170 The QoS feature adapts to the cfs bandwidth throttling +- sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug +- sched/qos: Fix qos throttling in SMT expelled +- hungtask: fixed offline group hung task issue under high load scenarios +- !15176 virtio-blk: don't keep queue frozen during system suspend +- virtio-blk: don't keep queue frozen during system suspend +- !15175 block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() +- block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() +- !15167 Backport tracing fix patch +- trace: Fix kabi breakage for trace_event_fields +- tracing: Check "%s" dereference via the field and not the TP_printk format +- !15181 kobject: Fix global-out-of-bounds in kobject_action_type() +- kobject: Fix global-out-of-bounds in kobject_action_type() +- !15184 binfmt_flat: Fix integer overflow bug on 32 bit systems +- binfmt_flat: Fix integer overflow bug on 32 bit systems +- !15161 Revert "irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.0" +- Revert "irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.0" +- !15166 tracing: Have process_string() also allow arrays +- tracing: Have process_string() also allow arrays +- !14939 Fix the performance monitor relates to core for Hygon family 18h processor +- perf/x86/amd/core: Fix performance monitor for Hygon family 18h processor +- !15159 mm/thp: fix deferred split unqueue naming and locking +- mm/thp: fix deferred split unqueue naming and locking +- !15142 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.66-6.6.68 LTS Patches +- dt-bindings: net: fec: add pps channel property +- drm/amdgpu: Handle NULL bo->tbo.resource (again) in amdgpu_vm_bo_update +- net: fec: make PPS channel configurable +- net: fec: refactor PPS channel configuration +- io_uring/rw: avoid punting to io-wq directly +- io_uring/rw: treat -EOPNOTSUPP for IOCB_NOWAIT like -EAGAIN +- io_uring/rw: split io_read() into a helper +- epoll: Add synchronous wakeup support for ep_poll_callback +- ceph: fix memory leaks in __ceph_sync_read() +- ceph: improve error handling and short/overflow-read logic in __ceph_sync_read() +- ceph: validate snapdirname option length when mounting +- of: Fix refcount leakage for OF node returned by __of_get_dma_parent() +- of: Fix error path in of_parse_phandle_with_args_map() +- udmabuf: also check for F_SEAL_FUTURE_WRITE +- nilfs2: fix buffer head leaks in calls to truncate_inode_pages() +- of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() +- of/irq: Fix interrupt-map cell length check in of_irq_parse_imap_parent() +- NFS/pnfs: Fix a live lock between recalled layouts and layoutget +- io_uring: Fix registered ring file refcount leak +- selftests/bpf: Use asm constraint "m" for LoongArch +- selftests/memfd: run sysctl tests when PID namespace support is enabled +- tracing: Add "%s" check in test_event_printk() +- tracing: Add missing helper functions in event pointer dereference check +- tracing: Fix test_event_printk() to process entire print argument +- smb: client: fix TCP timers deadlock after rmmod +- Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet +- btrfs: tree-checker: reject inline extent items with 0 ref count +- vmalloc: fix accounting with i915 +- zram: fix uninitialized ZRAM not releasing backing device +- zram: refuse to use zero sized block device as backing device +- hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers +- hwmon: (tmp513) Fix Current Register value interpretation +- hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers +- hwmon: (tmp513) Use SI constants from units.h +- hwmon: (tmp513) Simplify with dev_err_probe() +- hwmon: (tmp513) Don't use "proxy" headers +- drm/amdgpu: don't access invalid sched +- i915/guc: Accumulate active runtime on gt reset +- i915/guc: Ensure busyness counter increases motonically +- i915/guc: Reset engine utilization buffer before registration +- drm/panel: novatek-nt35950: fix return value check in nt35950_probe() +- thunderbolt: Improve redrive mode handling +- USB: serial: option: add Telit FE910C04 rmnet compositions +- USB: serial: option: add MediaTek T7XX compositions +- USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready +- USB: serial: option: add MeiG Smart SLM770A +- USB: serial: option: add TCL IK512 MBIM & ECM +- hexagon: Disable constant extender optimization for LLVM prior to 19.1.0 +- efivarfs: Fix error on non-existent file +- i2c: riic: Always round-up when calculating bus period +- chelsio/chtls: prevent potential integer overflow on 32bit +- net: tun: fix tun_napi_alloc_frags() +- KVM: x86: Cache CPUID.0xD XSTATE offsets+sizes during module init +- EDAC/amd64: Simplify ECC check on unified memory controllers +- mmc: mtk-sd: disable wakeup in .remove() and in the error path of .probe() +- mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk +- net: mdiobus: fix an OF node reference leak +- selftests: openvswitch: fix tcpdump execution +- netfilter: ipset: Fix for recursive locking warning +- ipvs: Fix clamp() of ip_vs_conn_tab on small memory systems +- net: ethernet: bgmac-platform: fix an OF node reference leak +- ksmbd: fix broken transfers when exceeding max simultaneous operations +- ksmbd: count all requests in req_running counter +- net: renesas: rswitch: rework ts tags management +- ionic: use ee->offset when returning sprom data +- netdevsim: prevent bad user input in nsim_dev_health_break_write() +- net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic() +- net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll +- cxl/region: Fix region creation for greater than x2 switches +- cxl/pci: Fix potential bogus return value upon successful probing +- tools: hv: change permissions of NetworkManager configuration file +- xfs: reset rootdir extent size hint after growfsrt +- xfs: take m_growlock when running growfsrt +- xfs: Fix the owner setting issue for rmap query in xfs fsmap +- xfs: conditionally allow FS_XFLAG_REALTIME changes if S_DAX is set +- xfs: attr forks require attr, not attr2 +- xfs: remove unused parameter in macro XFS_DQUOT_LOGRES +- xfs: fix file_path handling in tracepoints +- xfs: convert comma to semicolon +- xfs: Fix xfs_prepare_shift() range for RT +- xfs: Fix xfs_flush_unmap_range() range for RT +- xfs: create a new helper to return a file's allocation unit +- xfs: declare xfs_file.c symbols in xfs_file.h +- xfs: use consistent uid/gid when grabbing dquots for inodes +- xfs: verify buffer, inode, and dquot items every tx commit +- xfs: fix the contact address for the sysfs ABI documentation +- i2c: pnx: Fix timeout in wait functions +- p2sb: Do not scan and remove the P2SB device when it is unhidden +- p2sb: Move P2SB hide and unhide code to p2sb_scan_and_cache() +- p2sb: Introduce the global flag p2sb_hidden_by_bios +- p2sb: Factor out p2sb_read_from_cache() +- platform/x86: p2sb: Make p2sb_get_devfn() return void +- usb: cdns3: Add quirk flag to enable suspend residency +- PCI/AER: Disable AER service on suspend +- PCI: Use preserve_config in place of pci_flags +- ASoC: Intel: sof_sdw: add quirk for Dell SKU 0B8C +- ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP +- MIPS: Loongson64: DTS: Fix msi node for ls7a +- usb: cdns3-ti: Add workaround for Errata i2409 +- PCI: Add ACS quirk for Broadcom BCM5760X NIC +- PCI: vmd: Create domain symlink before pci_bus_add_devices() +- usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with iommu enabled +- net: sched: fix ordering of qlen adjustment +- x86/static-call: fix 32-bit build +- x86/xen: remove hypercall page +- x86/xen: use new hypercall functions instead of hypercall page +- x86/xen: add central hypercall functions +- x86/static-call: provide a way to do very early static-call updates +- objtool/x86: allow syscall instruction +- x86: make get_cpu_vendor() accessible from Xen code +- xen/netfront: fix crash when removing device +- net: rswitch: Avoid use-after-free in rswitch_poll() +- selftests/bpf: remove use of __xlated() +- tracing/kprobes: Skip symbol counting logic for module symbols in create_local_trace_kprobe() +- kselftest/arm64: abi: fix SVCR detection +- blk-iocost: Avoid using clamp() on inuse in __propagate_weights() +- net: dsa: microchip: KSZ9896 register regmap alignment to 32 bit boundaries +- net: renesas: rswitch: fix initial MPIC register setting +- Bluetooth: SCO: Add support for 16 bits transparent voice setting +- Bluetooth: iso: Fix recursive locking warning +- ACPICA: events/evxfregn: don't release the ContextMutex that was never acquired +- team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL +- bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL +- net/sched: netem: account for backlog updates from child qdisc +- net: dsa: felix: fix stuck CPU-injected packets with short taprio windows +- netfilter: nf_tables: do not defer rule destruction via call_rcu +- net: renesas: rswitch: handle stop vs interrupt race +- net: renesas: rswitch: fix leaked pointer on error path +- net: renesas: rswitch: fix race window between tx start and complete +- net: rswitch: Add jumbo frames handling for TX +- net: rswitch: Add a setting ext descriptor function +- net: rswitch: Add unmap_addrs instead of dma address in each desc +- net: rswitch: Use build_skb() for RX +- net: rswitch: Use unsigned int for desc related array index +- net: rswitch: Drop unused argument/return value +- Documentation: PM: Clarify pm_runtime_resume_and_get() return value +- ASoC: amd: yc: Fix the wrong return value +- ALSA: control: Avoid WARN() for symlink errors +- qca_spi: Make driver probing reliable +- qca_spi: Fix clock speed for multiple QCA7000 +- cxgb4: use port number to set mac addr +- ACPI: resource: Fix memory resource type union access +- net: sparx5: fix the maximum frame length register +- net: sparx5: fix FDMA performance issue +- spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user() +- net: mscc: ocelot: perform error cleanup in ocelot_hwstamp_set() +- net: mscc: ocelot: be resilient to loss of PTP packets during transmission +- net: mscc: ocelot: ocelot->ts_id_lock and ocelot_port->tx_skbs.lock are IRQ-safe +- net: mscc: ocelot: improve handling of TX timestamp for unknown skb +- net: mscc: ocelot: fix memory leak on ocelot_port_add_txtstamp_skb() +- net: lapb: increase LAPB_HEADER_LEN +- ptp: kvm: x86: Return EOPNOTSUPP instead of ENODEV from kvm_arch_ptp_init() +- selftests: mlxsw: sharedbuffer: Ensure no extra packets are counted +- selftests: mlxsw: sharedbuffer: Remove duplicate test cases +- selftests: mlxsw: sharedbuffer: Remove h1 ingress test case +- wifi: cfg80211: sme: init n_channels before channels[] access +- tipc: fix NULL deref in cleanup_bearer() +- batman-adv: Do not let TT changes list grows indefinitely +- batman-adv: Remove uninitialized data in full table TT response +- batman-adv: Do not send uninitialized TT changes +- amdgpu/uvd: get ring reference from rq scheduler +- wifi: mac80211: fix station NSS capability initialization order +- wifi: mac80211: clean up 'ret' in sta_link_apply_parameters() +- wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon +- rtla/timerlat: Make timerlat_hist_cpu->*_count unsigned long long +- bpf, sockmap: Fix update element with same +- bpf, sockmap: Fix race between element replace and close() +- xfs: only run precommits once per transaction object +- xfs: fix scrub tracepoints when inode-rooted btrees are involved +- xfs: return from xfs_symlink_verify early on V4 filesystems +- xfs: don't drop errno values when we fail to ficlone the entire range +- xfs: update btree keys correctly when _insrec splits an inode root block +- drm/i915: Fix memory leak by correcting cache object name in error handler +- usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode +- usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer +- usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe() +- usb: typec: anx7411: fix fwnode_handle reference leak +- usb: ehci-hcd: fix call balance of clocks handling routines +- usb: gadget: midi2: Fix interpretation of is_midi1 bits +- scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe +- usb: dwc2: Fix HCD port connection race +- usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature +- usb: dwc2: Fix HCD resume +- ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys() +- usb: host: max3421-hcd: Correctly abort a USB request. +- riscv: Fix IPIs usage in kfence_protect_page() +- ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5 +- riscv: Fix wrong usage of __pa() on a fixmap address +- tcp: check space before adding MPTCP SYN options +- splice: do not checksum AF_UNIX sockets +- ksmbd: fix racy issue from session lookup and expire +- !15144 hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur +- hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur +- !15143 scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs +- scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs +- !15132 CVE-2024-56607 fix +- wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask() +- wifi: mac80211: Add non-atomic station iterator +- !15140 iio: adc: rockchip_saradc: fix information leak in triggered buffer +- iio: adc: rockchip_saradc: fix information leak in triggered buffer + +* Wed Feb 19 2025 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-78.0.0.83 +- !15076 [olk 6.6] backport some feature patches for hibmcge driver +- net: hibmcge: Add nway_reset supported in this module +- net: hibmcge: Add reset supported in this module +- net: hibmcge: Add pauseparam supported in this module +- net: hibmcge: Add register dump supported in this module +- net: hibmcge: Add unicast frame filter supported in this module +- net: hibmcge: Add irq_info file to debugfs +- net: hibmcge: Add debugfs supported in this module +- lib/string_choices: Add str_true_false()/str_false_true() helper +- !15109 net: Fix icmp host relookup triggering ip_rt_bug +- net: Fix icmp host relookup triggering ip_rt_bug +- !15105 ipv6: Fix soft lockups in fib6_select_path under high next hop churn +- ipv6: Fix soft lockups in fib6_select_path under high next hop churn +- !15106 netfilter: conntrack: clamp maximum hashtable size to INT_MAX +- netfilter: conntrack: clamp maximum hashtable size to INT_MAX +- !15101 net/mlx5e: Don't call cleanup on profile rollback failure +- net/mlx5e: Don't call cleanup on profile rollback failure +- !15103 ethtool: fail closed if we can't get max channel used in indirection tables +- ethtool: fail closed if we can't get max channel used in indirection tables +- !15102 v2 net: Fix CVE-2024-56658 +- net: Fix kabi breakage in struct net +- net: defer final 'struct net' free in netns dismantle +- !15107 netfilter: IDLETIMER: Fix for possible ABBA deadlock +- netfilter: IDLETIMER: Fix for possible ABBA deadlock +- !15110 net/mlx5e: Skip restore TC rules for vport rep without loaded flag +- net/mlx5e: Skip restore TC rules for vport rep without loaded flag +- !15111 net: wwan: t7xx: Fix FSM command timeout issue +- net: wwan: t7xx: Fix FSM command timeout issue +- !15112 net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute +- net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute +- !15113 sched: sch_cake: add bounds checks to host bulk flow fairness counts +- sched: sch_cake: add bounds checks to host bulk flow fairness counts +- !15119 mm: resolve faulty mmap_region() error path behaviour +- mm: resolve faulty mmap_region() error path behaviour +- !15118 iio: adc: at91: call input_free_device() on allocated iio_dev +- iio: adc: at91: call input_free_device() on allocated iio_dev +- !15123 mm, madvise: fix potential workingset node list_lru leaks +- mm, madvise: fix potential workingset node list_lru leaks +- mm: move mapping_set_update out of <linux/swap.h> +- !15055 iomap: avoid avoid truncating 64-bit offset to 32 bits +- iomap: avoid avoid truncating 64-bit offset to 32 bits +- !15128 ALSA: seq: oss: Fix races at processing SysEx messages +- ALSA: seq: oss: Fix races at processing SysEx messages +- !14972 selinux: ignore unknown extended permissions +- selinux: ignore unknown extended permissions +- !15121 KVM: arm64: Get rid of userspace_irqchip_in_use +- KVM: arm64: Get rid of userspace_irqchip_in_use +- !13446 [OLK-6.6]crypto: montage - fix variable 'device_handle' is uninitialized warning for Mont-TSSE driver +- crypto: montage - fix variable 'device_handle' is unintialized warning for Mont-TSSE driver +- !15133 Upgrade Hygon HCT driver to version 0.6 +- hct: remove the unused variables from hct shared structure. +- hct: add write support for node use of MDEV devices. +- hct: fix vm_start issue caused by pre allocated vma changes. +- hct: compatible with hct.ko modules in versions 0.5 and earlier. +- hct: update pasid type from int to long. +- hct: sharing CCP resources between host and virtual machines. +- hct: adding node to identifies hct mdev device usage status. +- !15083 mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation +- mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation +- !15080 [OLK-6.6] crypto: zhaoxin - Fix incorrect parameter in sm4 driver +- crypto: zhaoxin - Fix incorrect parameter in sm4 driver +- !15078 [OLK-6.6] crypto: zhaoxin - Optimize the assembly code in the SM3 driver +- crypto: zhaoxin - Optimize the assembly code in the SM3 driver +- !15068 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.64-6.6.66 LTS Patches +- i3c: master: svc: fix possible assignment of the same address to two devices +- i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin +- serial: amba-pl011: fix build regression +- platform/x86: asus-wmi: Fix thermal profile initialization +- ALSA: usb-audio: Update UMP group attributes for GTB blocks, too +- usb: dwc3: ep0: Don't reset resource alloc flag +- drm/amdgpu: rework resume handling for display (v2) +- ASoC: Intel: avs: Fix return status of avs_pcm_hw_constraints_init() +- ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume" +- btrfs: add cancellation points to trim loops +- iio: invensense: fix multiple odr switch when FIFO is off +- xhci: dbc: Fix STALL transfer event handling +- mm/damon/vaddr: fix issue in damon_va_evenly_split_region() +- KVM: x86/mmu: Ensure that kvm_release_pfn_clean() takes exact pfn from kvm_faultin_pfn() +- vfio/mlx5: Align the page tracking max message size with the device capability +- x86: Fix build regression with CONFIG_KEXEC_JUMP enabled +- tracing/eprobe: Fix to release eprobe when failed to add dyn_event +- clk: en7523: Initialize num before accessing hws in en7523_register_clocks() +- btrfs: fix missing snapshot drew unlock when root is dead during swap activation +- setlocalversion: work around "git describe" performance +- smb: client: don't try following DFS links in cifs_tree_connect() +- serial: 8250_dw: Add Sophgo SG2044 quirk +- rtc: cmos: avoid taking rtc_lock for extended period of time +- misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle +- powerpc/prom_init: Fixup missing powermac #size-cells +- ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 21M1CTO1WW +- MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a +- drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3 +- ASoC: amd: yc: fix internal mic on Redmi G 2022 +- iio: light: ltr501: Add LTER0303 to the supported devices +- usb: chipidea: udc: handle USB Error Interrupt if IOC not set +- fs/ntfs3: Fix case when unmarked clusters intersect with zone +- ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[] +- ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840 +- f2fs: fix to shrink read extent node in batches +- f2fs: print message if fscorrupted was found in f2fs_new_node_page() +- PCI: Add ACS quirk for Wangxun FF5xxx NICs +- PCI: Add 'reset_subordinate' to reset hierarchy below bridge +- PCI: Detect and trust built-in Thunderbolt chips +- PCI: vmd: Set devices to D0 before enabling PM L1 Substates +- PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs +- PCI: qcom: Add support for IPQ9574 +- KMSAN: uninit-value in inode_go_dump (5) +- verification/dot2: Improve dot parser robustness +- smb: client: memcpy() with surrounding object base address +- nvdimm: rectify the illogical code within nd_dax_probe() +- thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens +- pinctrl: qcom: spmi-mpp: Add PM8937 compatible +- pinctrl: qcom-pmic-gpio: add support for PM8937 +- scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset +- scsi: st: Don't modify unknown block number in MTIOCGET +- leds: class: Protect brightness_show() with led_cdev->led_access mutex +- clk: qcom: tcsrcc-sm8550: add SAR2130P support +- clk: qcom: rpmh: add support for SAR2130P +- clk: qcom: rcg2: add clk_rcg2_shared_floor_ops +- scsi: lpfc: Call lpfc_sli4_queue_unset() in restart and rmmod paths +- scsi: ufs: core: Make DMA mask configuration more flexible +- rtla/timerlat: Make timerlat_top_cpu->*_count unsigned long long +- tools/rtla: fix collision with glibc sched_attr/sched_set_attr +- tracing: Use atomic64_inc_return() in trace_clock_counter() +- tracing/ftrace: disable preemption in syscall probe +- pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU +- netpoll: Use rcu_access_pointer() in __netpoll_setup +- net/neighbor: clear error in case strict check is not set +- rocker: fix link status detection in rocker_carrier_init() +- ASoC: hdmi-codec: reorder channel allocation list +- Bluetooth: Set quirks for ATS2851 +- Bluetooth: Support new quirks for ATS2851 +- Bluetooth: Add new quirks for ATS2851 +- Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables +- dsa: qca8k: Use nested lock to avoid splat +- wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() +- wifi: ipw2x00: libipw_rx_any(): fix bad alignment +- ALSA: usb-audio: Make mic volume workarounds globally applicable +- virtio-net: fix overflow inside virtnet_rq_alloc +- drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov +- fsl/fman: Validate cell-index value obtained from Device Tree +- dma-debug: fix a possible deadlock on radix_lock +- drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr +- netlink: specs: Add missing bitset attrs to ethtool spec +- drm/amdgpu: Dereference the ATCS ACPI buffer +- drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih +- drm/sched: memset() 'job' in drm_sched_job_init() +- net: stmmac: Programming sequence for VLAN packets with split header +- net: sfp: change quirks for Alcatel Lucent G-010S-P +- drm/panel: simple: Add Microchip AC69T88A LVDS Display panel +- fanotify: allow reporting errors on failure to open fd +- wifi: ath5k: add PCI ID for Arcadyan devices +- wifi: ath5k: add PCI ID for SX76X +- net: inet6: do not leave a dangling sk pointer in inet6_create() +- net: inet: do not leave a dangling sk pointer in inet_create() +- net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() +- net: af_can: do not leave a dangling sk pointer in can_create() +- af_packet: avoid erroring out after sock_init_data() in packet_create() +- net/sched: cbs: Fix integer overflow in cbs_set_port_rate() +- net: ethernet: fs_enet: Use %pa to format resource_size_t +- net: fec_mpc52xx_phy: Use %pa to format resource_size_t +- samples/bpf: Fix a resource leak +- r8169: don't apply UDP padding quirk on RTL8126A +- drm/display: Fix building with GCC 15 +- dlm: fix possible lkb_resource null dereference +- drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() +- drm/mcde: Enable module autoloading +- drm/bridge: it6505: Enable module autoloading +- drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK +- drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition +- drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model +- drm/vc4: hvs: Set AXI panic modes for the HVS +- drm/vc4: hdmi: Avoid log spam for audio start failure +- HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support +- selftests/resctrl: Protect against array overflow when reading strings +- regmap: maple: Provide lockdep (sub)class for maple tree's internal lock +- mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED +- mmc: core: Add SD card quirk for broken poweroff notification +- media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 +- media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera +- media: uvcvideo: RealSense D421 Depth module metadata +- HID: add per device quirk to force bind to hid-generic +- spi: spi-fsl-lpspi: Adjust type of scldiv +- perf/x86/amd: Warn only on new bits set +- ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID +- hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list +- kselftest/arm64: Don't leak pipe fds in pac.exec_sign_all() +- btrfs: do not clear read-only when adding sprout device +- btrfs: avoid unnecessary device path update for the same device +- btrfs: don't take dev_replace rwsem on task already holding it +- kselftest/arm64: Log fp-stress child startup errors to stdout +- epoll: annotate racy check +- x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables +- kasan: make report_lock a raw spinlock +- lib: stackinit: hide never-taken branch from compiler +- ocfs2: update seq_file index in ocfs2_dlm_seq_next +- mmc: core: Further prevent card detect during shutdown +- mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet +- regmap: detach regmap from dev on regmap_exit +- dma-fence: Use kernel's sort for merging fences +- dma-fence: Fix reference leak on fence merge failure path +- dma-buf: fix dma_fence_array_signaled v4 +- x86/kexec: Restore GDT on return from ::preserve_context kexec +- modpost: Add .irqentry.text to OTHER_SECTIONS +- drm/amdgpu/hdp5.2: do a posting read when flushing HDP +- drm/dp_mst: Fix resetting msg rx state after topology removal +- drm/dp_mst: Verify request type in the corresponding down message reply +- drm/dp_mst: Fix MST sideband message body length check +- bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again +- smb3.1.1: fix posix mounts to older servers +- fs/smb/client: cifs_prime_dcache() for SMB3 POSIX reparse points +- fs/smb/client: Implement new SMB3 POSIX type +- fs/smb/client: avoid querying SMB2_OP_QUERY_WSL_EA for SMB3 POSIX +- scsi: ufs: core: Add missing post notify for power mode change +- scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt +- scsi: qla2xxx: Supported speed displayed incorrectly for VPorts +- scsi: qla2xxx: Fix NVMe and NPIV connect issue +- scsi: qla2xxx: Fix abort in bsg timeout +- ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360 (NP730QFG) +- ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook 430 G8 +- ALSA: usb-audio: add mixer mapping for Corsair HS80 +- arm64: Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit ASIDs +- tracing: Fix cmp_entries_dup() to respect sort() comparison rules +- can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum DS80000789E 6. +- can: dev: can_set_termination(): allow sleeping GPIOs +- watchdog: rti: of: honor timeout-sec property +- LoongArch: Add architecture specific huge_pte_clear() +- x86/CPU/AMD: WARN when setting EFER.AUTOIBRS if and only if the WRMSR fails +- bpf: Fix exact match conditions in trie_get_next_key() +- iio: magnetometer: yas530: use signed integer type for clamp limits +- scatterlist: fix incorrect func name in kernel-doc +- drm/v3d: Enable Performance Counters before clearing them +- ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec +- scsi: scsi_debug: Fix hrtimer support for ndelay +- ASoC: SOF: ipc3-topology: fix resource leaks in sof_ipc3_widget_setup_comp_dai() +- ASoC: SOF: ipc3-topology: Convert the topology pin index to ALH dai index +- tools: Override makefile ARCH variable if defined, but empty +- ALSA: usb-audio: Notify xrun for low-latency mode +- ALSA: seq: ump: Fix seq port updates per FB info notify +- ALSA: ump: Update substream name from assigned FB names +- ALSA: seq: ump: Use automatic cleanup of kfree() +- drm/sti: Add __iomem for mixer_dbg_mxn's parameter +- bpftool: fix potential NULL pointer dereferencing in prog_dump() +- xsk: always clear DMA mapping information when unmapping the pool +- bpf, vsock: Invoke proto::close on close() +- bpf, vsock: Fix poll() missing a queue +- scsi: ufs: core: Add ufshcd_send_bsg_uic_cmd() for UFS BSG +- scsi: ufs: core: Always initialize the UIC done completion +- drm/bridge: it6505: Fix inverted reset polarity +- drm/bridge: it6505: update usleep_range for RC circuit charge time +- i3c: master: Fix dynamic address leak when 'assigned-address' is present +- i3c: master: Extend address status bit to 4 and add I3C_ADDR_SLOT_EXT_DESIRED +- i3c: master: Replace hard code 2 with macro I3C_ADDR_SLOT_STATUS_BITS +- i3c: master: svc: Modify enabled_events bit 7:0 to act as IBI enable counter +- i3c: master: svc: use slow speed for first broadcast address +- i3c: master: support to adjust first broadcast address speed +- i3c: master: fix kernel-doc check warning +- i3c: master: svc: add hot join support +- i3c: master: add enable(disable) hot join in sys entry +- f2fs: fix to drop all discards after creating snapshot on lvm device +- driver core: fw_devlink: Stop trying to optimize cycle detection logic +- driver core: Add FWLINK_FLAG_IGNORE to completely ignore a fwnode link +- driver core: fw_devlink: Improve logs for cycle detection +- ntp: Remove invalid cast in time offset math +- powerpc/vdso: Drop -mstack-protector-guard flags in 32-bit files with clang +- powerpc/vdso: Refactor CFLAGS for CVDSO build +- mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting +- mmc: mtk-sd: fix devm_clk_get_optional usage +- mmc: mtk-sd: Fix error handle of probe function +- mmc: mtk-sd: use devm_mmc_alloc_host +- usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED +- usb: dwc3: ep0: Don't reset resource alloc flag (including ep0) +- usb: dwc3: gadget: Rewrite endpoint allocation flow +- soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure +- soc: fsl: cpm1: qmc: Introduce qmc_{init,exit}_xcc() and their CPM1 version +- soc: fsl: cpm1: qmc: Introduce qmc_init_resource() and its CPM1 version +- soc: fsl: cpm1: qmc: Re-order probe() operations +- soc: fsl: cpm1: qmc: Fix blank line and spaces +- soc/fsl: cpm: qmc: Convert to platform remove callback returning void +- serial: amba-pl011: Fix RX stall when DMA is used +- serial: amba-pl011: Use port lock wrappers +- xhci: Fix control transfer error on Etron xHCI host +- xhci: Don't issue Reset Device command to Etron xHCI host +- xhci: Combine two if statements for Etron xHCI host +- xhci: remove XHCI_TRUST_TX_LENGTH quirk +- xhci: Allow RPM on the USB controller (1022:43f7) by default +- net: avoid potential UAF in default_operstate() +- net/mlx5e: Remove workaround to avoid syndrome for internal port +- geneve: do not assume mac header is set in geneve_xmit_skb() +- mlxsw: spectrum_acl_flex_keys: Use correct key block on Spectrum-4 +- mlxsw: spectrum_acl_flex_keys: Constify struct mlxsw_afk_element_inst +- mlxsw: Mark high entropy key blocks +- mlxsw: Edit IPv6 key blocks to use one less block for multicast forwarding +- mlxsw: spectrum_acl_flex_keys: Add 'ipv4_5b' flex key +- mlxsw: Add 'ipv4_5' flex key +- ethtool: Fix wrong mod state in case of verbose and no_mask bitset +- netfilter: nft_set_hash: skip duplicated elements pending gc run +- netfilter: ipset: Hold module reference while requesting a module +- net: sched: fix erspan_opt settings in cls_flower +- ixgbe: downgrade logging of unsupported VF API version to debug +- ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5 +- net/qed: allow old cards not supporting "num_images" to work +- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). +- dccp: Fix memory leak in dccp_feat_change_recv +- net/ipv6: release expired exception dst cached in socket +- ipv6: introduce dst_rt6_info() helper +- net-timestamp: make sk_tskey more predictable in error path +- platform/x86: asus-wmi: Ignore return value when writing thermal policy +- platform/x86: asus-wmi: Fix inconsistent use of thermal policies +- platform/x86: asus-wmi: add support for vivobook fan profiles +- can: j1939: j1939_session_new(): fix skb reference counting +- net: hsr: avoid potential out-of-bound access in fill_frame_info() +- net/sched: tbf: correct backlog statistic for GSO packets +- ptp: Add error handling for adjfine callback in ptp_clock_adjtime +- selftests: hid: fix typo and exit code +- netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level +- netfilter: x_tables: fix LED ID check in led_tg_check() +- ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() +- can: f81604: f81604_handle_can_bus_errors(): fix {rx,tx}_errors statistics +- can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics +- can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics +- can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics +- can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics +- can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics +- can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics +- can: hi311x: hi3110_can_ist(): fix potential use-after-free +- can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL +- can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails +- can: gs_usb: add usb endpoint address detection at driver probe step +- can: gs_usb: add VID/PID for Xylanta SAINT3 product family +- watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart() +- watchdog: apple: Actually flush writes after requesting watchdog restart +- watchdog: xilinx_wwdt: Calculate max_hw_heartbeat_ms using clock frequency +- iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call +- openrisc: Use asm-generic's version of fix_to_virt() & virt_to_fix() +- Revert "x86/pvh: Set phys_base when calling xen_prepare_pvh()" +- Revert "x86/pvh: Call C code via the kernel virtual mapping" +- !15069 fs/proc: fix softlockup in __read_vmcore (part 2) +- fs/proc: fix softlockup in __read_vmcore (part 2) +- !15067 irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity() +- irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity() +- !15065 fix CVE-2025-21668 +- pmdomain: imx8mp-blk-ctrl: add missing loop break condition +- !15056 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.63-6.6.64 LTS Patches +- posix-timers: Target group sigqueue to current task only if not exiting +- drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7 +- drm/amdgpu: fix usage slab after free +- drm/amdkfd: Use the correct wptr size +- drm: xlnx: zynqmp_dpsub: fix hotplug detection +- drm/etnaviv: flush shader L1 cache after user commandstream +- drm/mediatek: Fix child node refcount handling in early exit +- drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check +- udmabuf: use vmf_insert_pfn and VM_PFNMAP for handling mmap +- powerpc: Adjust adding stack protector flags to KBUILD_CLAGS for clang +- powerpc: Fix stack protector Kconfig test for clang +- iio: gts: fix infinite loop for gain_to_scaletables() +- iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() +- iio: accel: kx022a: Fix raw read format +- nfsd: make sure exp active before svc_export_show +- PCI: rockchip-ep: Fix address translation unit programming +- PCI: of_property: Assign PCI instead of CPU bus address to dynamic PCI nodes +- dm thin: Add missing destroy_work_on_stack() +- dm: Fix typo in error message +- ovl: properly handle large files in ovl_security_fileattr +- leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error paths +- thermal: int3400: Fix reading of current_uuid for active policy +- fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful iov_iter_zero +- PCI: endpoint: Clear secondary (not primary) EPC in pci_epc_remove_epf() +- PCI: keystone: Add link up check to ks_pcie_other_map_bus() +- PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatible +- i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled +- scsi: ufs: exynos: Fix hibern8 notify callbacks +- util_macros.h: fix/rework find_closest() macros +- ceph: extract entity name from device id +- mm/slub: Avoid list corruption when removing a slab from the full list +- ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire() +- ARM: 9430/1: entry: Do a dummy read from VMAP shadow +- s390/entry: Mark IRQ entries to fix stack depot warnings +- ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadow +- clk: qcom: gcc-qcs404: fix initial rate of GPLL3 +- leds: lp55xx: Remove redundant test for invalid channel number +- iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables +- zram: clear IDLE flag after recompression +- vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event +- maple_tree: refine mas_store_root() on storing NULL +- media: uvcvideo: Require entities to have a non-zero unique ID +- media: uvcvideo: Stop stream during unregister +- media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate() +- media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled +- media: amphion: Fix pm_runtime_set_suspended() with runtime pm enabled +- efi/libstub: Free correct pointer on failure +- media: platform: exynos4-is: Fix an OF node reference leak in fimc_md_is_isp_available +- media: ts2020: fix null-ptr-deref in ts2020_probe() +- media: verisilicon: av1: Fix reference video buffer pointer assignment +- media: i2c: tc358743: Fix crash in the probe error path when using polling +- arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay +- media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled +- media: mtk-jpeg: Fix null-ptr-deref during unload module +- media: amphion: Set video drvdata before register video device +- arm64: dts: ti: k3-am62-verdin: Fix SD regulator startup delay +- arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay +- arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer +- md/md-bitmap: Add missing destroy_work_on_stack() +- btrfs: add a sanity check for btrfs root in btrfs_search_slot() +- btrfs: don't loop for nowait writes when checking for cross references +- quota: flush quota_release_work upon quota writeback +- xfs: remove unknown compat feature check in superblock write validation +- SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT +- cifs: unlock on error in smb3_reconfigure() +- cifs: during remount, make sure passwords are in sync +- modpost: remove incorrect code in do_eisa_entry() +- Rename .data.once to .data..once to fix resetting WARN*_ONCE +- Rename .data.unlikely to .data..unlikely +- init/modpost: conditionally check section mismatch to __meminit* +- modpost: squash ALL_{INIT,EXIT}_TEXT_SECTIONS to ALL_TEXT_SECTIONS +- modpost: use ALL_INIT_SECTIONS for the section check from DATA_SECTIONS +- modpost: disallow the combination of EXPORT_SYMBOL and __meminit* +- modpost: remove EXIT_SECTIONS macro +- modpost: remove MEM_INIT_SECTIONS macro +- modpost: disallow *driver to reference .meminit* sections +- modpost: remove ALL_EXIT_DATA_SECTIONS macro +- rtc: ab-eoz9: don't fail temperature reads on undervoltage notification +- cifs: Fix parsing reparse point with native symlink in SMB1 non-UNICODE session +- cifs: Fix parsing native symlinks relative to the export +- smb: client: disable directory caching when dir_cache_timeout is zero +- perf/arm-cmn: Ensure port and device id bits are set properly +- perf/arm-smmuv3: Fix lockdep assert in ->event_init() +- 9p/xen: fix release of IRQ +- 9p/xen: fix init sequence +- block: return unsigned int from bdev_io_min +- nvme/multipath: Fix RCU list traversal to use SRCU primitive +- nvme-multipath: avoid hang on inaccessible namespaces +- nvme-multipath: implement "queue-depth" iopolicy +- nvme-multipath: prepare for "queue-depth" iopolicy +- rtc: rzn1: fix BCD to rtc_time conversion errors +- jffs2: fix use of uninitialized variable +- ubi: fastmap: Fix duplicate slab cache names while attaching +- ubifs: Correct the total block count by deducting journal reservation +- ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty +- rtc: abx80x: Fix WDT bit position of the status register +- rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq() +- um: Always dump trace for specified task in show_stack +- um: Fix the return value of elf_core_copy_task_fpregs +- SUNRPC: make sure cache entry active before cache_show +- ipc: fix memleak if msg_init_ns failed in create_ipc_ns +- lib: string_helpers: silence snprintf() output truncation warning +- ublk: fix error code for unsupported command +- usb: dwc3: gadget: Fix checking for number of TRBs left +- smb: During unmount, ensure all cached dir instances drop their dentry +- smb: prevent use-after-free due to open_cached_dir error paths +- smb: Don't leak cfid when reconnect races with open_cached_dir +- smb: client: handle max length for SMB symlinks +- smb3: request handle caching when caching directories +- ALSA: hda/realtek: Apply quirk for Medion E15433 +- ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max +- ALSA: hda/realtek: Set PCBeep to default value for ALC274 +- ALSA: hda/realtek: Update ALC225 depop procedure +- ALSA: ump: Fix evaluation of MIDI 1.0 FB info +- media: v4l2-core: v4l2-dv-timings: check cvt/gtf result +- soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting() +- HID: wacom: Interpret tilt data from Intuos Pro BT as signed values +- blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long +- block: fix ordering between checking BLK_MQ_S_STOPPED request adding +- block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding +- block: fix missing dispatching request when queue is started or unquiesced +- arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled +- ublk: fix ublk_ch_mmap() for 64K page size +- iio: gts: Fix uninitialized symbol 'ret' +- um: vector: Do not use drvdata in release +- serial: 8250: omap: Move pm_runtime_get_sync +- serial: 8250_fintek: Add support for F81216E +- dt-bindings: serial: rs485: Fix rs485-rts-delay property +- um: net: Do not use drvdata in release +- um: ubd: Do not use drvdata in release +- ubi: wl: Put source PEB into correct list if trying locking LEB failed +- platform/chrome: cros_ec_typec: fix missing fwnode reference decrement +- smb: client: fix NULL ptr deref in crypto_aead_setkey() +- parisc/ftrace: Fix function graph tracing disablement +- cifs: support mounting with alternate password to allow password rotation +- cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power() +- mtd: spi-nor: core: replace dummy buswidth from addr to data +- spi: Fix acpi deferred irq probe +- netfilter: ipset: add missing range check in bitmap_ip_uadt +- gpio: exar: set value when external pull-up or pull-down is present +- Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit" +- serial: sh-sci: Clean sci_ports[0] after at earlycon exit +- Revert "usb: gadget: composite: fix OS descriptors w_value logic" +- wifi: brcmfmac: release 'root' node in all execution paths +- wifi: ath12k: fix crash when unbinding +- ARM: dts: omap36xx: declare 1GHz OPP as turbo again +- usb: xhci: Fix TD invalidation under pending Set TR Dequeue +- Compiler Attributes: disable __counted_by for clang < 19.1.3 +- Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() +- exfat: fix uninit-value in __exfat_get_dentry_set +- dt-bindings: iio: dac: ad3552r: fix maximum spi speed +- pinctrl: qcom: spmi: fix debugfs drive strength +- tools/nolibc: s390: include std.h +- locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass() +- tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler +- comedi: Flush partial mappings in error case +- fsnotify: fix sending inotify event with unexpected filename +- KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status +- KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR +- powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector +- KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE +- crypto: x86/aegis128 - access 32-bit arguments as 32-bit +- perf/x86/intel/pt: Fix buffer full but size is 0 case +- ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata() +- ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 +- jfs: xattr: check invalid xattr size more strictly +- ext4: fix FS_IOC_GETFSMAP handling +- ext4: supress data-race warnings in ext4_free_inodes_{count,set}() +- soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() +- ASoC: Intel: sst: Fix used of uninitialized ctx to log an error +- arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled +- Revert "arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled" +- btrfs: do not BUG_ON() when freeing tree block after error +- dm-bufio: fix warnings about duplicate slab caches +- dm-cache: fix warnings about duplicate slab caches +- closures: Change BUG_ON() to WARN_ON() +- usb: ehci-spear: fix call balance of sehci clk handling routines +- xen: Fix the issue of resource not being properly released in xenbus_dev_probe() +- nvme: fix metadata handling in nvme-passthrough +- mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable() +- f2fs: fix fiemap failure issue when page size is 16KB +- gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru +- ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry +- apparmor: fix 'Do simple duplicate message elimination' +- drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp +- drm/radeon: Fix spurious unplug event on radeon HDMI +- drm/radeon: change rdev->ddev to rdev_to_drm(rdev) +- drm/radeon: add helper rdev_to_drm(rdev) +- ALSA: hda/realtek: Update ALC256 depop procedure +- counter: ti-ecap-capture: Add check for clk_enable() +- counter: stm32-timer-cnt: Add check for clk_enable() +- misc: apds990x: Fix missing pm_runtime_disable() +- USB: chaoskey: Fix possible deadlock chaoskey_list_lock +- USB: chaoskey: fail open after removal +- usb: yurex: make waiting on yurex_write interruptible +- usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read() +- iio: light: al3010: Fix an error handling path in al3010_probe() +- ipmr: fix tables suspicious RCU usage +- ip6mr: fix tables suspicious RCU usage +- rxrpc: Improve setsockopt() handling of malformed user input +- llc: Improve setsockopt() handling of malformed user input +- bnxt_en: Unregister PTP during PCI shutdown and suspend +- bnxt_en: Refactor bnxt_ptp_init() +- bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down +- net: hsr: fix hsr_init_sk() vs network/transport headers. +- spi: atmel-quadspi: Fix register name in verbose logging function +- octeontx2-af: Quiesce traffic before NIX block reset +- octeontx2-af: RPM: fix stale FCFEC counters +- octeontx2-af: RPM: fix stale RSFEC counters +- octeontx2-pf: Reset MAC stats during probe +- octeontx2-af: RPM: Fix low network performance +- octeontx2-af: RPM: Fix mismatch in lmac type +- net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken +- marvell: pxa168_eth: fix call balance of pep->clk handling routines +- net: mdio-ipq4019: add missing error check +- net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged +- s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() +- net: microchip: vcap: Add typegroup table terminators in kunit tests +- net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration +- tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets +- net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device +- power: supply: rt9471: Use IC status regfield to report real charger status +- power: supply: rt9471: Fix wrong WDT function regfield declaration +- power: supply: bq27xxx: Fix registers of bq27426 +- power: supply: core: Remove might_sleep() from power_supply_put() +- LoongArch: BPF: Sign-extend return values +- LoongArch: Fix build failure with GCC 15 (-std=gnu23) +- fs_parser: update mount_api doc to match function signature +- vfio/pci: Properly hide first-in-list PCIe extended capability +- gpio: zevio: Add missed label initialisation +- selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels +- vdpa/mlx5: Fix suboptimal range on iotlb iteration +- hwmon: (tps23861) Fix reporting of negative temperatures +- NFSD: Fix nfsd4_shutdown_copy() +- nfsd: release svc_expkey/svc_export with rcu_work +- NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() +- NFSD: Prevent NULL dereference in nfsd4_process_cb_update() +- PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio' +- remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region +- rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length +- remoteproc: qcom: pas: add minidump_id to SM8350 resources +- perf trace: Avoid garbage when not printing a syscall's arguments +- perf trace: Do not lose last events in a race +- perf trace: Fix tracing itself, creating feedback loops +- perf list: Fix topic and pmu_name argument order +- m68k: coldfire/device.c: only build FEC when HW macros are defined +- m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x +- perf trace: avoid garbage when not printing a trace event's arguments +- f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode +- PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds +- PCI: j721e: Add suspend and resume support +- PCI: j721e: Use T_PERST_CLK_US macro +- PCI: j721e: Add reset GPIO to struct j721e_pcie +- PCI: cadence: Set cdns_pcie_host_init() global +- PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup() +- PCI: j721e: Add PCIe 4x lane selection support +- PCI: j721e: Add per platform maximum lane settings +- PCI: Add T_PVPERL macro +- f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID +- f2fs: check curseg->inited before write_sum_page in change_curseg +- f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block +- perf ftrace latency: Fix unit on histogram first entry when using --use-nsec +- PCI: cpqphp: Fix PCIBIOS_* return value confusion +- PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads +- rust: macros: fix documentation of the paste! macro +- perf probe: Correct demangled symbols in C++ program +- perf probe: Fix libdw memory leak +- f2fs: fix to account dirty data in __get_secs_required() +- f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks +- perf test attr: Add back missing topdown events +- perf trace: Keep exited threads for summary +- perf stat: Fix affinity memory leaks on error path +- perf stat: Close cork_fd when create_perf_stat_counter() failed +- gfs2: Allow immediate GLF_VERIFY_DELETE work +- gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE +- gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw +- perf cs-etm: Don't flush when packet_queue fills up +- mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb() +- smb: cached directories can be more than root file handle +- pinctrl: k210: Undef K210_PC_DEFAULT +- arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to cpufreq-hw +- clk: clk-axi-clkgen: make sure to enable the AXI bus clock +- dt-bindings: clock: axi-clkgen: include AXI clk +- fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() +- powerpc/kexec: Fix return of uninitialized variable +- powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static +- KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending doorbells +- KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests +- dax: delete a stale directory pmem +- cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power() +- x86/tdx: Dynamically disable SEPT violations from causing #VEs +- x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup() +- x86/tdx: Introduce wrappers to read and write TD metadata +- x86/tdx: Pass TDCALL/SEAMCALL input/output registers via a structure +- x86/tdx: Rename __tdx_module_call() to __tdcall() +- x86/tdx: Make macros of TDCALLs consistent with the spec +- x86/tdx: Skip saving output regs when SEAMCALL fails with VMFailInvalid +- scsi: fusion: Remove unused variable 'rc' +- fs/proc/kcore.c: fix coccinelle reported ERROR instances +- mfd: rt5033: Fix missing regmap_del_irq_chip() +- checkpatch: always parse orig_commit in fixes tag +- checkpatch: check for missing Fixes tags +- iommu/vt-d: Fix checks and print in pgtable_walk() +- iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes() +- clk: imx: imx8-acm: Fix return value check in clk_imx_acm_attach_pm_domains() +- clk: imx: clk-scu: fix clk enable state save and restore +- clk: imx: fracn-gppll: fix pll power up +- clk: imx: fracn-gppll: correct PLL initialization flow +- clk: imx: lpcg-scu: SW workaround for errata (e10858) +- RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation +- RDMA/rxe: Set queue pair cur_qp_state when being queried +- clk: renesas: rzg2l: Fix FOUTPOSTDIV clk +- clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset +- RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey +- mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in RD_ANY_REG_OP +- powerpc/mm/fault: Fix kfence page fault reporting +- mtd: rawnand: atmel: Fix possible memory leak +- mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE +- mtd: hyperbus: rpc-if: Convert to platform remove callback returning void +- cpufreq: loongson2: Unregister platform_driver on failure +- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices +- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device +- mfd: da9052-spi: Change read-mask to write-mask +- mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race +- powerpc/vdso: Flag VDSO64 entry points as functions +- pinctrl: zynqmp: drop excess struct member description +- trace/trace_event_perf: remove duplicate samples on the first tracepoint event +- clk: mediatek: drop two dead config options +- unicode: Fix utf8_load() error path +- bpf: fix recursive lock when verdict program return SK_PASS +- wireguard: selftests: load nf_conntrack if not present +- netpoll: Use rcu_access_pointer() in netpoll_poll_lock +- ALSA: caiaq: Use snd_card_free_when_closed() at disconnection +- ALSA: us122l: Use snd_card_free_when_closed() at disconnection +- ALSA: usx2y: Use snd_card_free_when_closed() at disconnection +- net: rfkill: gpio: Add check for clk_enable() +- bpf: Force uprobe bpf program to always return 0 +- drm/amdkfd: Fix wrong usage of INIT_WORK() +- selftests: net: really check for bg process completion +- ipv6: release nexthop on device removal +- net: use unrcu_pointer() helper +- sock_diag: allow concurrent operation in sock_diag_rcv_msg() +- sock_diag: allow concurrent operations +- sock_diag: add module pointer to "struct sock_diag_handler" +- bpf, sockmap: Fix sk_msg_reset_curr +- bpf, sockmap: Several fixes to bpf_msg_push_data +- selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap +- selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap +- selftests/bpf: Fix SENDPAGE data logic in test_sockmap +- selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap +- netlink: typographical error in nlmsg_type constants definition +- netfilter: nf_tables: must hold rcu read lock while iterating object type list +- netfilter: nf_tables: skip transaction if update object is not implemented +- netfilter: nf_tables: must hold rcu read lock while iterating expression type list +- netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion +- netfilter: nf_tables: Introduce nf_tables_getrule_single() +- netfilter: nf_tables: Open-code audit log call in nf_tables_getrule() +- drm: use ATOMIC64_INIT() for atomic64_t +- drm/vkms: Drop unnecessary call to drm_crtc_cleanup() +- bpf, bpftool: Fix incorrect disasm pc +- drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk() +- wifi: wfx: Fix error handling in wfx_core_init() +- drm/etnaviv: hold GPU lock across perfmon sampling +- drm/etnaviv: Request pages from DMA32 zone on addressing_limited +- drm/msm/gpu: Check the status of registration to PM QoS +- drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq() +- bpf, arm64: Remove garbage frame for struct_ops trampoline +- drm/panfrost: Remove unused id_mask from struct panfrost_model +- selftests/bpf: fix test_spin_lock_fail.c's global vars usage +- octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c +- octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c +- octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c +- drm/msm/dpu: drop LM_3 / LM_4 on MSM8998 +- drm/msm/dpu: drop LM_3 / LM_4 on SDM845 +- drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block +- drm: fsl-dcu: enable PIXCLK on LS1021A +- wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() +- selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap +- selftests/bpf: Fix msg_verify_data in test_sockmap +- drm/bridge: tc358767: Fix link properties discovery +- netdevsim: copy addresses for both in and out paths +- libbpf: never interpret subprogs in .text as entry programs +- ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c +- libbpf: fix sym_is_subprog() logic for weak global subprogs +- drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush +- ice: consistently use q_idx in ice_vc_cfg_qs_msg() +- ice: Support FCS/CRC strip disable for VF +- virtchnl: Add CRC stripping capability +- wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR +- bpf: Fix the xdp_adjust_tail sample prog issue +- libbpf: Fix expected_attach_type set handling in program load callback +- drm/bridge: it6505: Drop EDID cache on bridge power off +- drm/bridge: anx7625: Drop EDID cache on bridge power off +- ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode +- ASoC: fsl_micfil: fix regmap_write_bits usage +- dt-bindings: vendor-prefixes: Add NeoFidelity, Inc +- wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2 +- wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1 +- drm/v3d: Address race-condition in MMU flush +- drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq() +- drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq() +- wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq() +- wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq() +- drm/omap: Fix locking in omap_gem_new_dmabuf() +- drm/omap: Fix possible NULL dereference +- wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() +- drm/vc4: hvs: Correct logic on stopping an HVS channel +- drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function +- drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer +- drm/vc4: hvs: Don't write gamma luts on 2711 +- drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused +- platform/x86: panasonic-laptop: Return errno correctly in show callback +- HID: hyperv: streamline driver probe to avoid devres issues +- arm64: dts: rockchip: correct analog audio name on Indiedroid Nova +- selftests/resctrl: Protect against array overrun during iMC config parsing +- selftests/resctrl: Fix memory overflow due to unhandled wraparound +- selftests/resctrl: Refactor fill_buf functions +- selftests/resctrl: Split fill_buf to allow tests finer-grained control +- arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed regulators +- arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names +- arm64: dts: mediatek: mt6358: fix dtbs_check error +- arm64: dts: mediatek: Add ADC node on MT6357, MT6358, MT6359 PMICs +- arm64: dts: renesas: hihope: Drop #sound-dai-cells +- regmap: irq: Set lockdep class for hierarchical IRQ domains +- spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time +- spi: tegra210-quad: Avoid shift-out-of-bounds +- pmdomain: ti-sci: Add missing of_node_put() for args.np +- of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify +- x86/of: Unconditionally call unflatten_and_copy_device_tree() +- um: Unconditionally call unflatten_device_tree() +- arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances +- arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances +- arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances +- arm64: dts: ti: k3-j7200: Fix register map for main domain pmx +- arm64: dts: ti: k3-j7200: use ti,j7200-padconf compatible +- ARM: dts: cubieboard4: Fix DCDC5 regulator constraints +- pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle +- arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns +- arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns +- arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns +- arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns +- regulator: rk808: Restrict DVS GPIOs to the RK808 variant only +- arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad +- arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4 +- arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4 +- media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call +- tpm: fix signed/unsigned bug when checking event logs +- efi/libstub: fix efi_parse_options() ignoring the default command line +- openrisc: Implement fixmap to fix earlycon +- mmc: mmc_spi: drop buggy snprintf() +- ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode +- arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins +- soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq() +- arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node +- arm64: dts: mt8195: Fix dtbs_check error for mutex node +- microblaze: Export xmb_manager functions +- spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq() +- clocksource/drivers/timer-ti-dm: Fix child node refcount handling +- clocksource/drivers:sp804: Make user selectable +- kcsan, seqlock: Fix incorrect assumption in read_seqbegin() +- kcsan, seqlock: Support seqcount_latch_t +- time: Fix references to _msecs_to_jiffies() handling of values +- time: Partially revert cleanup on msecs_to_jiffies() documentation +- x86/unwind/orc: Fix unwind for newly forked tasks +- thermal/lib: Fix memory leak on error in thermal_genl_auto() +- tools/lib/thermal: Make more generic the command encoding function +- rcuscale: Do a proper cleanup if kfree_scale_init() fails +- crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() +- crypto: caam - add error check to caam_rsa_set_priv_key_form +- hwmon: (pmbus/core) clear faults after setting smbalert mask +- hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK +- doc: rcu: update printed dynticks counter bits +- crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init() +- amd-pstate: Set min_perf to nominal_perf for active mode performance gov +- crypto: cavium - Fix the if condition to exit loop after timeout +- EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator +- EDAC/skx_common: Differentiate memory error sources +- EDAC/fsl_ddr: Fix bad bit shift operations +- thermal: core: Initialize thermal zones before registering them +- crypto: qat - remove faulty arbiter config reset +- firmware: google: Unregister driver_info on failure +- crypto: qat/qat_4xxx - fix off by one in uof_get_name() +- crypto: qat - remove check after debugfs_create_dir() +- crypto: caam - Fix the pointer passed to caam_qi_shutdown() +- virtio_blk: reverse request order in virtio_queue_rqs +- nvme-pci: reverse request order in nvme_queue_rqs +- ext4: remove calls to to set/clear the folio error flag +- s390/syscalls: Avoid creation of arch/arch/ directory +- block: fix bio_split_rw_at to take zone_write_granularity into account +- acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block() +- arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG +- m68k: mvme147: Reinstate early console +- m68k: mvme16x: Add and use "mvme16x.h" +- m68k: mvme147: Fix SCSI controller IRQ numbers +- mips: asm: fix warning when disabling MIPS_FP_SUPPORT +- x86/pvh: Call C code via the kernel virtual mapping +- x86/pvh: Set phys_base when calling xen_prepare_pvh() +- s390/pageattr: Implement missing kernel_page_present() +- s390/cio: Do not unregister the subchannel based on DNV +- kselftest/arm64: mte: fix printf type warnings about longs +- kselftest/arm64: mte: fix printf type warnings about __u64 +- fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats +- drm/amd/display: Don't refer to dc_sink in is_dsc_need_re_compute +- x86/stackprotector: Work around strict Clang TLS symbol requirements +- ipmr: Fix access to mfc_cache_list without lock held +- ARM: 9420/1: smp: Fix SMP for xip kernels +- ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry +- LoongArch: Define a default value for VM_DATA_DEFAULT_FLAGS +- ASoC: audio-graph-card2: Purge absent supplies for device tree nodes +- proc/softirqs: replace seq_printf with seq_put_decimal_ull_width +- drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict +- ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div() +- ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate() +- ASoC: amd: yc: Support dmic on another model of Lenovo Thinkpad E14 Gen 6 +- platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect fan speed +- can: j1939: fix error in J1939 documentation. +- tools/lib/thermal: Remove the thermal.h soft link when doing make clean +- ASoC: tas2781: Add new driver version for tas2563 & tas2781 qfn chip +- platform/x86: dell-wmi-base: Handle META key Lock/Unlock events +- platform/x86: dell-smbios-base: Extends support to Alienware products +- regulator: rk808: Add apply_bit for BUCK3 on RK809 +- firmware: arm_scmi: Reject clear channel request on A2P +- soc: qcom: Add check devm_kasprintf() returned value +- net: usb: qmi_wwan: add Quectel RG650V +- bpf: fix filed access without lock +- x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB +- ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13 +- usb: typec: use cleanup facility for 'altmodes_node' +- usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver +- mac80211: fix user-power when emulating chanctx +- wifi: iwlwifi: mvm: Use the sync timepoint API in suspend +- ASoC: Intel: sst: Support LPE0F28 ACPI HID +- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet +- ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec +- ASoC: codecs: rt5640: Always disable IRQs from rt5640_cancel_work() +- wifi: radiotap: Avoid -Wflex-array-member-not-at-end warnings + +* Tue Feb 18 2025 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-77.0.0.82 +- kernel.spec: build iso with 64KB page size kernel + +* Wed Feb 12 2025 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-77.0.0.81 +- !15062 gpio: xilinx: Convert gpio_lock to raw spinlock +- gpio: xilinx: Convert gpio_lock to raw spinlock +- !15060 RDMA/hns: Fix mbox timing out by adding retry mechanism +- RDMA/hns: Fix mbox timing out by adding retry mechanism +- !15052 [OLK-6.6] Intel: Backport KVM Fix for Clearing SGX EDECCSSA to OLK-6.6 +- KVM: VMX: Also clear SGX EDECCSSA in KVM CPU caps when SGX is disabled +- !15048 net: hns3: add sync command to sync io-pgtable +- net: hns3: add sync command to sync io-pgtable +- Revert "net: hns3: add sync command to sync io-pgtable" +- net: hns3: fix oops when unload drivers paralleling +- !15031 nbd: don't allow reconnect after disconnect +- nbd: don't allow reconnect after disconnect +- !15002 riscv: Fix sleeping in invalid context in die() +- riscv: Fix sleeping in invalid context in die() +- !14989 ksmbd: fix a missing return value check bug +- ksmbd: fix a missing return value check bug +- !15027 pinmux: Use sequential access to access desc->pinmux data +- pinmux: Use sequential access to access desc->pinmux data +- !14321 [OLK-6.6] rcu: Provide a boot time parameter to control lazy RCU +- rcu: Provide a boot time parameter to control lazy RCU +- rcu/tree: Remove superfluous return from void call_rcu* functions +- !14900 LeapIOraid: update leapioraid driver version +- LeapIOraid: update leapioraid driver version +- !14325 LeapIOraid: Fix hiding ugood disk problem +- LeapIOraid: Fix hiding ugood disk problem +- !15016 spi: mpc52xx: Add cancel_work_sync before module remove +- spi: mpc52xx: Add cancel_work_sync before module remove +- !15041 gve: guard XDP xmit NDO on existence of xdp queues +- gve: guard XDP xmit NDO on existence of xdp queues +- !15040 gve: guard XSK operations on the existence of queues +- gve: guard XSK operations on the existence of queues +- !15039 mptcp: fix TCP options overflow. +- mptcp: fix TCP options overflow. +- !15038 net: fix memory leak in tcp_conn_request() +- net: fix memory leak in tcp_conn_request() +- !15037 net/smc: check smcd_v2_ext_offset when receiving proposal msg +- net/smc: check smcd_v2_ext_offset when receiving proposal msg +- !15036 net/smc: check return value of sock_recvmsg when draining clc data +- net/smc: check return value of sock_recvmsg when draining clc data +- !15025 net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg +- net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg +- !15019 platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it +- platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it +- !15020 drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() +- drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() +- !14979 igb: Fix potential invalid memory access in igb_init_module() +- igb: Fix potential invalid memory access in igb_init_module() +- !14963 exfat: fix the infinite loop in exfat_readdir() +- exfat: fix the infinite loop in exfat_readdir() +- !14988 net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg +- net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg +- !14987 workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker +- workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker +- !14985 i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock +- i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock +- !14892 s390/cpum_sf: Handle CPU hotplug remove during sampling +- s390/cpum_sf: Handle CPU hotplug remove during sampling +- !15013 v2 nilfs2: prevent use of deleted inode +- nilfs2: prevent use of deleted inode +- !14845 merge HULK-6.6 patches into OLK-6.6 +- mm: refactor map_deny_write_exec() +- drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() +- nommu: pass NULL argument to vma_iter_prealloc() +- mm: page_alloc: move mlocked flag clearance into free_pages_prepare() +- cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU +- kcsan: Turn report_filterlist_lock into a raw_spinlock +- ionic: Fix netdev notifier unregister on failure +- !15018 misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling +- misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling +- !15009 i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request +- i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request +- !15008 nvme-rdma: unquiesce admin_q before destroy it +- nvme-rdma: unquiesce admin_q before destroy it + +* Thu Feb 06 2025 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-76.0.0.80 +- !14997 wifi: rtw89: check return value of ieee80211_probereq_get() for RNR +- wifi: rtw89: check return value of ieee80211_probereq_get() for RNR +- !14941 CVE-2024-57906 +- iio: adc: ti-ads8688: fix information leak in triggered buffer +- !14990 mainline patches +- cgroup/bpf: only cgroup v2 can be attached by bpf programs +- Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline" +- cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains +- !14993 arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL +- arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL +- !14952 drm/mediatek: Set private->all_drm_private[i +- drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err +- !14835 v2 media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg +- media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg +- !14994 mm/compaction: fix UBSAN shift-out-of-bounds warning +- mm/compaction: fix UBSAN shift-out-of-bounds warning +- !14893 btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount +- btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount +- !14876 *** jffs2: Prevent rtime decompress memory corruption *** +- jffs2: Fix rtime decompressor +- jffs2: Prevent rtime decompress memory corruption +- !14833 btrfs: check folio mapping after unlock in relocate_one_folio() +- btrfs: check folio mapping after unlock in relocate_one_folio() +- !14588 smb: Initialize cfid->tcon before performing network ops +- smb: Initialize cfid->tcon before performing network ops +- !14977 PCI: imx6: Fix suspend/resume support on i.MX6QDL +- PCI: imx6: Fix suspend/resume support on i.MX6QDL +- !14984 vsock/bpf: return early if transport is not assigned +- vsock/bpf: return early if transport is not assigned +- !14976 x86/fpu: Ensure shadow stack is active before "getting" registers +- x86/fpu: Ensure shadow stack is active before "getting" registers +- !14682 CVE-2024-56701 +- powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore +- !14780 CVE-2024-56677 +- powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() +- powerpc/fadump: Refactor and prepare fadump_cma_init for late init +- !14681 CVE-2024-56567 +- ad7780: fix division by zero in ad7780_write_raw() +- !14981 nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur +- nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur +- !14916 CVE-2024-56641 +- net/smc: initialize close_work early to avoid warning +- net/smc: refactoring initialization of smc sock +- !14914 bnxt_en: Fix receive ring space parameters when XDP is active +- bnxt_en: Fix receive ring space parameters when XDP is active +- !14915 net/smc: protect link down work from execute after lgr freed +- net/smc: protect link down work from execute after lgr freed +- !14913 xsk: fix OOB map writes when deleting elements +- xsk: fix OOB map writes when deleting elements +- !14911 net/smc: fix LGR and link use-after-free issue +- net/smc: fix LGR and link use-after-free issue +- !14912 net: fix data-races around sk->sk_forward_alloc +- net: fix data-races around sk->sk_forward_alloc +- !14907 ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() +- ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() +- !14908 net: dsa: improve shutdown sequence +- net: dsa: improve shutdown sequence +- !14877 sched: qos sched support online task to preempt offline task +- sched: qos sched support online task to preempt offline task +- !14974 BMA: Fix Oops and spin lock deadlock problem, and change the version number. +- BMA: Fix Oops and spin lock deadlock problem, and change the version number. +- !14973 v2 fix CVE-2024-54193 +- accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal() +- accel/ivpu: Move set autosuspend delay to HW specific code +- !14901 Fix CVE-2024-47794 +- bpf: Fix kabi breakage in struct bpf_prog_aux +- selftests/bpf: Add test to verify tailcall and freplace restrictions +- selftests/bpf: Add testcase for updating attached freplace prog to prog_array map +- bpf: Prevent tailcall infinite loop caused by freplace +- !14874 bpf: Check size for BTF-based ctx access of pointer members +- bpf: Check size for BTF-based ctx access of pointer members +- !14847 bpf: put bpf_link's program when link is safe to be deallocated +- bpf: put bpf_link's program when link is safe to be deallocated +- !14945 btrfs: avoid NULL pointer dereference if no valid extent tree +- btrfs: avoid NULL pointer dereference if no valid extent tree +- !14823 mm：some shmem bugfix +- mm: shmem: fix ShmemHugePages at swapout +- mm: shmem: extend shmem_unused_huge_shrink() to all sizes +- mm: shmem: fix minor off-by-one in shrinkable calculation +- docs: mm: fix the incorrect 'FileHugeMapped' field +- mm: shmem: fix the update of 'shmem_falloc->nr_unswapped' +- mm: shmem: fix incorrect index alignment for within_size policy +- !14970 drm/amd/display: Add check for granularity in dml ceil/floor helpers +- drm/amd/display: Add check for granularity in dml ceil/floor helpers +- !14969 topology: Keep the cpumask unchanged when printing cpumap +- topology: Keep the cpumask unchanged when printing cpumap +- !14935 Two CVE fixes for ksmbd +- ksmbd: fix potencial out-of-bounds when buffer offset is invalid +- ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() +- !14930 tracing/kprobe: Make trace_kprobe's module callback called after jump_label update +- tracing/kprobe: Make trace_kprobe's module callback called after jump_label update +- !14931 bpf: Fix theoretical prog_array UAF in __uprobe_perf_func() +- bpf: Fix theoretical prog_array UAF in __uprobe_perf_func() +- !14953 mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma +- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma +- !14767 mm: shmem: control THP support through the kernel command line +- mm: shmem: remove __shmem_huge_global_enabled() +- mm: shmem: override mTHP shmem default with a kernel parameter +- mm: move ``get_order_from_str()`` to internal.h +- mm: shmem: control THP support through the kernel command line +- !14962 memcg: fix memcg_swapmax_read() not declared warning +- memcg: fix memcg_swapmax_read() not declared warning +- !14944 ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv +- ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv +- !14946 swiotlb: fix swiotlb_bounce() to do partial sync's correctly +- iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices +- swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() +- swiotlb: fix swiotlb_bounce() to do partial sync's correctly +- swiotlb: extend buffer pre-padding to alloc_align_mask if necessary +- !14897 perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG +- perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG +- !14920 iio: light: vcnl4035: fix information leak in triggered buffer +- iio: light: vcnl4035: fix information leak in triggered buffer +- !14964 v2 fix BUG: unable to handle kernel paging request in build_id_parse +- lib/buildid: Handle memfd_secret() files in build_id_parse() +- mm: merge folio_is_secretmem() and folio_fast_pin_allowed() into gup_fast_folio_allowed() +- !14951 Mainline patch to olk-6.6 +- RDMA/hns: Fix UAF for cq async event +- Revert "RDMA/hns: Fix UAF for cq async event" +- RDMA/hns: Check atomic wr length +- Revert "RDMA/hns: Fix a missing check of atomic wr length" +- Revert "RDMA/hns: Check atomic wr length" +- !14925 RDMA/hns: Fix unmatch exception handling when request_irq() fails +- RDMA/hns: Fix unmatch exception handling when request_irq() fails +- !14884 um: Fix potential integer overflow during physmem setup +- um: Fix potential integer overflow during physmem setup +- !14886 Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet +- Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet +- !14889 clk: ralink: mtmips: clock fixes for Ralink SoCs +- clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs +- clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883 +- !14888 usb: dwc3: gadget: Fix looping of queued SG entries +- usb: dwc3: gadget: Fix looping of queued SG entries +- !14924 soc: imx8m: Probe the SoC driver as platform driver +- soc: imx8m: Probe the SoC driver as platform driver +- !14813 drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability +- drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability + +* Tue Jan 21 2025 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-75.0.0.79 +- !14904 net: renesas: rswitch: avoid use-after-put for a device tree node +- net: renesas: rswitch: avoid use-after-put for a device tree node +- !14898 Revert "Revert "driver core: Fix uevent_show() vs driver detach race"" +- Revert "Revert "driver core: Fix uevent_show() vs driver detach race"" +- !14741 io_uring: check for overflows in io_pin_pages +- io_uring: check for overflows in io_pin_pages +- !14863 drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check +- drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check +- !14882 usb: typec: fix potential array underflow in ucsi_ccg_sync_control() +- usb: typec: fix potential array underflow in ucsi_ccg_sync_control() +- !14879 CVE-2024-57872 +- scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove() +- scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove() +- scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers +- scsi: ufs: Convert all platform drivers to return void +- !14880 pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking +- pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking +- !14873 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.62-6.6.63 LTS Patches +- mm/damon/core: copy nr_accesses when splitting region +- mm/damon/core: handle zero schemes apply interval +- mm/damon/core: check apply interval in damon_do_apply_schemes() +- mm: refactor map_deny_write_exec() +- mm: unconditionally close VMAs on error +- drm/amd/pm: Vangogh: Fix kernel memory out of bounds write +- mptcp: pm: use _rcu variant under rcu_read_lock +- mptcp: hold pm lock when deleting entry +- NFSD: initialize copy->cp_clp early in nfsd4_copy for use by trace point +- lib/buildid: Fix build ID parsing logic +- staging: vchiq_arm: Use devm_kzalloc() for vchiq_arm_state allocation +- staging: vchiq_arm: Get the rid off struct vchiq_2835_state +- mm/damon/core: handle zero {aggregation,ops_update} intervals +- mm/damon/core: implement scheme-specific apply interval +- drm/amd: Fix initialization mistake for NBIO 7.7.0 +- nouveau: fw: sync dma after setup is called. +- drm/bridge: tc358768: Fix DSI command tx +- mmc: sunxi-mmc: Fix A100 compatible description +- LoongArch: Make KASAN work with 5-level page-tables +- LoongArch: Disable KASAN if PGDIR_SIZE is too large for cpu_vabits +- ocfs2: fix UBSAN warning in ocfs2_verify_volume() +- ALSA: hda/realtek: fix mute/micmute LEDs for a HP EliteBook 645 G10 +- ALSA: hda/realtek - Fixed Clevo platform headset Mic issue +- nommu: pass NULL argument to vma_iter_prealloc() +- KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN +- KVM: x86: Unconditionally set irr_pending when updating APICv state +- KVM: nVMX: Treat vpid01 as current if L2 is active, but with VPID disabled +- vdpa/mlx5: Fix PA offset with unaligned starting iotlb map +- mm: fix NULL pointer dereference in alloc_pages_bulk_noprof +- x86/mm: Fix a kdump kernel failure on SME system when CONFIG_IMA_KEXEC=y +- tools/mm: fix compile error +- ARM: 9419/1: mm: Fix kernel memory mapping for xip kernels +- bonding: add ns target multicast address to slave device +- net: ti: icssg-prueth: Fix 1 PPS sync +- stmmac: dwmac-intel-plat: fix call balance of tx_clk handling routines +- net: stmmac: rename stmmac_pltfr_remove_no_dt to stmmac_pltfr_remove +- net: stmmac: dwmac-visconti: use devm_stmmac_probe_config_dt() +- net: stmmac: dwmac-intel-plat: use devm_stmmac_probe_config_dt() +- net: Make copy_safe_from_sockptr() match documentation +- net: stmmac: dwmac-mediatek: Fix inverted handling of mediatek,mac-wol +- samples: pktgen: correct dev to DEV +- net: sched: cls_u32: Fix u32's systematic failure to free IDR entries for hnodes. +- net/sched: cls_u32: replace int refcounts with proper refcounts +- Bluetooth: btintel: Direct exception event to bluetooth stack +- Bluetooth: hci_core: Fix calling mgmt_device_connected +- Revert "RDMA/core: Fix ENODEV error for iWARP test over vlan" +- virtio/vsock: Fix accept_queue memory leak +- net/mlx5e: CT: Fix null-ptr-deref in add rule err flow +- net/mlx5e: clear xdp features on non-uplink representors +- net/mlx5e: kTLS, Fix incorrect page refcounting +- net/mlx5: fs, lock FTE when checking if active +- mptcp: cope racing subflow creation in mptcp_rcv_space_adjust +- mptcp: error out earlier on disconnect +- net: vertexcom: mse102x: Fix tx_bytes calculation +- sctp: fix possible UAF in sctp_v6_available() +- netlink: terminate outstanding dump on socket close +- !14856 sched: psi: fix bogus pressure spikes from aggregation race +- sched: psi: fix bogus pressure spikes from aggregation race +- !14861 drm/sti: avoid potential dereference of error pointers +- drm/sti: avoid potential dereference of error pointers +- !14846 net: stmmac: fix TSO DMA API usage causing oops +- net: stmmac: fix TSO DMA API usage causing oops +- !14789 erofs: handle NONHEAD !delta[1 +- erofs: handle NONHEAD !delta[1] lclusters gracefully +- !14848 LoongArch: Fix sleeping in atomic context for PREEMPT_RT +- LoongArch: Fix sleeping in atomic context for PREEMPT_RT +- !14840 [OLK-6.6][bugfix]Hygon: Remove 'CONFIG_' prefix under Kconfig entry HYGON_CSV +- x86/config: Remove 'CONFIG_' prefix under Kconfig entry HYGON_CSV +- !14690 Improve the tmpfs large folio read performance +- mm: shmem: fallback to page size splice if large folio has poisoned pages +- mm: shmem: improve the tmpfs large folio read performance +- mm: shmem: update iocb->ki_pos directly to simplify tmpfs read logic +- !14466 bpf: Call free_htab_elem() after htab_unlock_bucket() +- bpf: Call free_htab_elem() after htab_unlock_bucket() +- !14818 olk-6.6 +- cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw() +- !14738 LoongArch: fix some dwmac/pci/SE/i2c/interrupt issues +- LoongArch: adjust the calc method of number of packages. +- LoongArch: eiointc: fix ext irq route error +- drivers/char: add ACPI firmware support for Loongson SE driver +- LoongArch: fix i2c related issues +- net: stmmac: dwmac-loongson: fix Mac DMA reset +- pci/quirks: LS7A2000: fix pm transition of devices under pcie port +- !14573 RDMA/rxe: Fix the qp flush warnings in req +- RDMA/rxe: Fix the qp flush warnings in req +- !14574 ALSA: pcm: Add sanity NULL check for the default mmap fault handler +- ALSA: pcm: Add sanity NULL check for the default mmap fault handler +- !14035 Backport fs optimizing patch from mainline +- fs/file.c: conditionally clear full_fds +- !14828 cgroup/cpuset: remove kernfs active break +- cgroup/cpuset: remove kernfs active break +- !14589 ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write +- ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write +- !14800 Bluetooth: fix use-after-free in device_for_each_child() +- Bluetooth: fix use-after-free in device_for_each_child() +- !14792 jfs: fix shift-out-of-bounds in dbSplit +- jfs: fix shift-out-of-bounds in dbSplit +- !14791 scsi: ufs: core: sysfs: Prevent div by zero +- scsi: ufs: core: sysfs: Prevent div by zero +- !14787 acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl +- acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl +- !14786 x86/xen: don't do PV iret hypercall through hypercall page +- x86/xen: don't do PV iret hypercall through hypercall page +- !14785 drm/i915: Fix NULL pointer dereference in capture_engine +- drm/i915: Fix NULL pointer dereference in capture_engine +- !14817 olk-6.6 +- wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures +- !14784 wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one +- wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one +- !14807 btrfs: fix use-after-free in btrfs_encoded_read_endio() +- btrfs: fix use-after-free in btrfs_encoded_read_endio() +- !14591 ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit +- ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit +- !14587 jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree +- jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree +- !14747 net: enetc: Do not configure preemptible TCs if SIs do not support +- net: enetc: Do not configure preemptible TCs if SIs do not support +- !14796 btrfs: fix use-after-free when COWing tree bock and tracing is enabled +- btrfs: fix use-after-free when COWing tree bock and tracing is enabled +- !14655 vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() +- vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() +- !14656 iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer +- iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer +- !14659 firmware: arm_scpi: Check the DVFS OPP count returned by the firmware +- firmware: arm_scpi: Check the DVFS OPP count returned by the firmware +- !14712 CVE-2024-56654 +- Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating +- Bluetooth: ISO: Reassociate a socket with an active BIS +- !14761 Add Huawei Intelligent Network Card Driver:hibifur +- Add Huawei Intelligent Network Card Driver:hibifur +- !14772 tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg +- tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg +- !14769 svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() +- svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() +- !14770 bpf, sockmap: Several fixes to bpf_msg_pop_data +- bpf, sockmap: Several fixes to bpf_msg_pop_data +- !14730 sched: Fix bpf cpustats refcount leak +- sched: Fix bpf cpustats refcount leak +- !14739 mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device +- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device +- !14731 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c +- octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c +- !14759 wifi: ath12k: Skip Rx TID cleanup for self peer +- wifi: ath12k: Skip Rx TID cleanup for self peer +- !14757 media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal() +- media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal() +- !14605 scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() +- scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() +- !14490 nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() +- nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() +- !14489 f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode. +- f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode. +- !14488 ovl: Filter invalid inodes with missing lookup function +- ovl: Filter invalid inodes with missing lookup function +- !14486 ocfs2: fix uninitialized value in ocfs2_file_read_iter() +- ocfs2: fix uninitialized value in ocfs2_file_read_iter() +- !14754 i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() +- i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() +- !14776 tracing: Prevent bad count for tracing_cpumask_write +- tracing: Prevent bad count for tracing_cpumask_write +- !14766 drm/i915/hdcp: Add encoder check in hdcp2_get_capability +- drm/i915/hdcp: Add encoder check in hdcp2_get_capability +- !14765 nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint +- nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint +- !14764 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c +- octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c +- !14729 KVM: arm64: Don't retire aborted MMIO instruction +- KVM: arm64: Don't retire aborted MMIO instruction +- !14763 usb: musb: Fix hardware lockup on first Rx endpoint request +- usb: musb: Fix hardware lockup on first Rx endpoint request +- !14762 sched/numa: fix memory leak due to the overwritten vma->numab_state +- sched/numa: fix memory leak due to the overwritten vma->numab_state +- !14749 net/mlx5: DR, prevent potential error pointer dereference +- net/mlx5: DR, prevent potential error pointer dereference +- !14746 nvme-pci: fix freeing of the HMB descriptor table +- nvme-pci: fix freeing of the HMB descriptor table +- !14722 Bluetooth: MGMT: Fix possible deadlocks +- Bluetooth: MGMT: Fix possible deadlocks +- !14670 Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() +- Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() +- !14608 scsi: qla2xxx: Fix use after free on unload +- scsi: qla2xxx: Fix use after free on unload +- !14724 etmem: fix use-after-free of mm in the scan release process +- etmem: fix use-after-free of mm in the scan release process +- !14384 virtiofs: use pages instead of pointer for kernel direct IO +- virtiofs: use pages instead of pointer for kernel direct IO +- !14673 ALSA: 6fire: Release resources at card release +- ALSA: 6fire: Release resources at card release +- !14666 Bluetooth: btmtk: avoid UAF in btmtk_process_coredump +- Bluetooth: btmtk: avoid UAF in btmtk_process_coredump +- !14634 backport mainline bugfix patch +- genirq/msi: Fix off-by-one error in msi_domain_alloc() +- !14611 merge mainline patches into OLK-6.6 +- mm/vmscan: wake up flushers conditionally to avoid cgroup OOM +- mm/mglru: reset page lru tier bits when activating +- tmpfs: don't enable large folios if not supported +- mm: migrate: annotate data-race in migrate_folio_unmap() +- mm: Kconfig: fixup zsmalloc configuration +- mm: ignore data-race in __swap_writepage +- !14602 blk-cgroup: Fix UAF in blkcg_unpin_online() +- blk-cgroup: Fix UAF in blkcg_unpin_online() +- !14720 rtc: check if __rtc_read_time was successful in rtc_timer_do_work() +- rtc: check if __rtc_read_time was successful in rtc_timer_do_work() +- !14719 rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu +- rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu +- !14718 PCI: Fix reset_method_store() memory leak +- PCI: Fix reset_method_store() memory leak +- !14455 f2fs: fix race in concurrent f2fs_stop_gc_thread +- f2fs: fix race in concurrent f2fs_stop_gc_thread +- !14542 net: usb: lan78xx: Fix double free issue with interrupt buffer allocation +- net: usb: lan78xx: Fix double free issue with interrupt buffer allocation +- !14531 sched/deadline: Fix warning in migrate_enable for boosted tasks +- sched/deadline: Fix warning in migrate_enable for boosted tasks +- !14528 drm/amdgpu: set the right AMDGPU sg segment limitation +- drm/amdgpu: set the right AMDGPU sg segment limitation +- !14525 CVE-2024-56609 +- wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb +- wifi: mac80211: export ieee80211_purge_tx_queue() for drivers +- !14667 sched: fix warning in sched_setaffinity +- sched: fix warning in sched_setaffinity +- !14412 [OLK-6.6]Workaround ARM PMUs cpu maps having offline cpus +- perf arm: Workaround ARM PMUs cpu maps having offline cpus +- !14698 bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots +- bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots +- !14694 arm64: probes: Disable kprobes/uprobes on MOPS instructions +- arm64: probes: Disable kprobes/uprobes on MOPS instructions +- !14677 drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe +- drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe +- !14569 PCI: Fix use-after-free of slot->bus on hot remove +- PCI: Fix use-after-free of slot->bus on hot remove +- !14568 wifi: ath12k: fix warning when unbinding +- wifi: ath12k: fix warning when unbinding +- !14424 octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c +- octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c +- !14714 Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync +- Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync +- !14715 media: atomisp: Add check for rgby_data memory allocation failure +- media: atomisp: Add check for rgby_data memory allocation failure +- !14699 CVE-2024-53158 +- soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() +- !14710 CVE-2024-56546 +- drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend() +- !14507 sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers +- sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers +- !14511 netfilter: nft_inner: incorrect percpu area handling under softirq +- netfilter: nft_inner: incorrect percpu area handling under softirq +- !14472 jfs: fix array-index-out-of-bounds in jfs_readdir +- jfs: fix array-index-out-of-bounds in jfs_readdir +- !14664 v2 CVE-2024-53224 +- RDMA/mlx5: Move events notifier registration to be after device registration +- IB/mlx5: Allocate resources just before first QP/SRQ is created + +* Thu Jan 16 2025 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-73.0.0.78 +- riscv kernel upgrade to 6.6.0-73.0.0 +- Backport RISC-V AIA driver from mainline linux +- Fix kernel-mode FPU support on riscv +- Add cache info for SG2042 dts + +* Mon Jan 06 2025 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-73.0.0.77 +- !14618 drm: zynqmp_kms: Unplug DRM device before removal +- drm: zynqmp_kms: Unplug DRM device before removal +- !14621 brd: defer automatic disk creation until module initialization succeeds +- brd: defer automatic disk creation until module initialization succeeds +- !14617 block: fix uaf for flush rq while iterating tags +- block: fix uaf for flush rq while iterating tags +- !14614 scsi: sg: Fix slab-use-after-free read in sg_release() +- scsi: sg: Fix slab-use-after-free read in sg_release() +- !14519 bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog +- bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog +- !14593 CVE-2024-56702 +- bpf: Augment raw_tp arguments with PTR_MAYBE_NULL +- bpf: Revert "bpf: Mark raw_tp arguments with PTR_MAYBE_NULL" +- bpf: Mark raw_tp arguments with PTR_MAYBE_NULL +- !14415 ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read +- ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read +- !14439 sh: intc: Fix use-after-free bug in register_intc_controller() +- sh: intc: Fix use-after-free bug in register_intc_controller() +- !14635 Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() +- Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() +- !14648 memcg: fix soft lockup in the OOM process +- memcg: fix soft lockup in the OOM process +- !14562 f2fs: fix to do sanity check on node blkaddr in truncate_node() +- f2fs: fix to do sanity check on node blkaddr in truncate_node() +- !14524 The bugfix for LPM trie +- bpf: Handle in-place update for full LPM trie correctly +- bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie +- !14459 sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK +- sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK +- !14454 drm/vc4: hdmi: Avoid hang with debug registers when suspended +- drm/vc4: hdmi: Avoid hang with debug registers when suspended +- !14385 media: imx-jpeg: Ensure power suppliers be suspended before detach them +- media: imx-jpeg: Ensure power suppliers be suspended before detach them +- !14546 media: wl128x: Fix atomicity violation in fmc_send_cmd() +- media: wl128x: Fix atomicity violation in fmc_send_cmd() +- !14244 sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport +- sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport +- !14243 sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket +- sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket +- !14504 apparmor: test: Fix memory leak for aa_unpack_strdup() +- apparmor: test: Fix memory leak for aa_unpack_strdup() +- !14418 LoongArch: Add CPU HWMon platform driver +- LoongArch: Add CPU HWMon platform driver +- !14387 LoongArch: compile loongson drm driver as module +- drm/loongson: compile loongson drm driver as module +- LoongArch: cleanup loongson3 defconfig +- !14441 crypto: bcm - add error check in the ahash_hmac_init function +- crypto: bcm - add error check in the ahash_hmac_init function +- !14438 media: imx-jpeg: Set video drvdata before register video device +- media: imx-jpeg: Set video drvdata before register video device +- !14389 CVE-2024-53173 +- NFSv4.0: Fix a use-after-free problem in the asynchronous open() +- NFSv4.0: Fix the wake up of the next waiter in nfs_release_seqid() +- Revert "NFSv4: release seqid when open failed for nfs4.0" +- Revert "nfs: fix rpc_task use-after-free when open and close different files concurrently" +- !14469 io_uring/tctx: work around xa_store() allocation error issue +- io_uring/tctx: work around xa_store() allocation error issue +- !14447 Fix CVE-2024-56744 +- f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason() +- !14394 scsi: ufs: qcom: Only free platform MSIs when ESI is enabled +- scsi: ufs: qcom: Only free platform MSIs when ESI is enabled +- !14518 hfsplus: don't query the device logical block size multiple times +- hfsplus: don't query the device logical block size multiple times +- !14517 scsi: bfa: Fix use-after-free in bfad_im_module_exit() +- scsi: bfa: Fix use-after-free in bfad_im_module_exit() +- !14516 f2fs: fix null-ptr-deref in f2fs_submit_page_bio() +- f2fs: fix null-ptr-deref in f2fs_submit_page_bio() +- !14475 ext4: correct behaviors under errors=remount-ro mode +- Revert "ext4: drop EXT4_MF_FS_ABORTED flag" +- Revert "ext4: warn on read-only filesystem in ext4_journal_check_start()" +- Revert "ext4: drop read-only check in ext4_init_inode_table()" +- Revert "ext4: drop read-only check in ext4_write_inode()" +- Revert "ext4: drop read-only check from ext4_force_commit()" +- Revert "ext4: replace read-only check for shutdown check in mmp code" +- Revert "ext4: don't set SB_RDONLY after filesystem errors" +- sb_writers: fix kabi broken +- fs: fix a hungtask problem when freeze/unfreeze fs +- !14506 iommufd: Fix out_fput in iommufd_fault_alloc() +- iommufd: Fix out_fput in iommufd_fault_alloc() +- !14369 crypto: qat/qat_420xx - fix off by one in uof_get_name() +- crypto: qat/qat_420xx - fix off by one in uof_get_name() +- !14417 v2 drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new() +- drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new() +- !14423 v2 EDAC/igen6: Avoid segmentation fault on module unload +- EDAC/igen6: Avoid segmentation fault on module unload +- !14365 EDAC/bluefield: Fix potential integer overflow +- EDAC/bluefield: Fix potential integer overflow +- !14364 clk: clk-apple-nco: Add NULL check in applnco_probe +- clk: clk-apple-nco: Add NULL check in applnco_probe +- !14408 bpf: fix OOB devmap writes when deleting elements +- bpf: fix OOB devmap writes when deleting elements +- !14367 io_uring: check if iowq is killed before queuing +- io_uring: check if iowq is killed before queuing +- !14355 btrfs: ref-verify: fix use-after-free after invalid ref action +- btrfs: ref-verify: fix use-after-free after invalid ref action +- !14350 jfs: array-index-out-of-bounds fix in dtReadFirst +- jfs: array-index-out-of-bounds fix in dtReadFirst +- !14348 ksmbd: fix use-after-free in SMB request handling +- ksmbd: fix use-after-free in SMB request handling +- !14102 OLK-6.6-fix-CVE-2024-49906 +- drm/amd/display: Check null pointer before try to access it +- drm/amd/display: Check null pointer before try to access it +- !14346 drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' +- drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' +- !14420 HID: wacom: fix when get product name maybe null pointer +- HID: wacom: fix when get product name maybe null pointer +- !14301 Revert "unicode: Don't special case ignorable code points" +- Revert "unicode: Don't special case ignorable code points" +- !14332 mm: avoid unconditional one-tick sleep when swapcache_prepare fails +- mm: avoid unconditional one-tick sleep when swapcache_prepare fails +- !14362 CVE-2024-53217 +- nfsd: restore callback functionality for NFSv4.0 +- NFSD: Prevent NULL dereference in nfsd4_process_cb_update() +- !14319 exfat: fix out-of-bounds access of directory entries +- exfat: fix out-of-bounds access of directory entries +- !14405 NFSD: Prevent a potential integer overflow +- NFSD: Prevent a potential integer overflow +- !14395 scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() +- scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() +- !14401 gpio: grgpio: Add NULL check in grgpio_probe +- gpio: grgpio: Add NULL check in grgpio_probe +- !14400 bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors +- bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors +- !14329 svcrdma: Address an integer overflow +- svcrdma: Address an integer overflow +- !14376 fix CVE-2024-53197 +- ALSA: usb-audio: Fix a DMA to stack memory bug +- ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices +- !14206 v4 erofs/fscache/cachefiles: Add ondemand loading support +- cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter() +- cachefiles: Fix incorrect length return value in cachefiles_ondemand_fd_write_iter() +- cachefiles: Clean up in cachefiles_commit_tmpfile() +- cachefiles: Fix NULL pointer dereference in object->file +- cachefiles: add support for buffer I/O in ondemand mode +- fscache: clean up for fscache_clear_volume_priv +- fscache: Add the synchronous waiting mechanism for the volume unhash in erofs ondemand mode +- cachefiles: Introduce "dir_has_put" in cachefiles_volume +- erofs: remove EXPERIMENTAL feature warning for fscache-based +- cachefiles: Add restrictions to cachefiles_daemon_cull() +- erofs: add erofs_ondemand switch +- erofs: add erofs switch to better control it +- fscache: modify the waiting mechanism with duplicate volumes +- cachefiles: modify inappropriate error return value in cachefiles_daemon_secctx +- fscache: add a memory barrier for FSCACHE_VOLUME_CREATING +- !14377 ftrace: Fix regression with module command in stack_trace_filter +- ftrace: Fix regression with module command in stack_trace_filter +- !14373 [OLK-6.6]Hygon: Fix objtool warning cause by csv3_active() +- x86: mm: Fix objtool warning about bool noinstr csv3_active() +- !14358 firmware_loader: Fix possible resource leak in fw_log_firmware_info() +- firmware_loader: Fix possible resource leak in fw_log_firmware_info() +- !14342 hwmon: (nct6775-core) Fix overflows seen when writing limit attributes +- hwmon: (nct6775-core) Fix overflows seen when writing limit attributes +- !14271 iomap: fix zero padding data issue in concurrent append writes +- iomap: fix zero padding data issue in concurrent append writes +- !14340 ocfs2: free inode when ocfs2_get_init_inode() fails +- ocfs2: free inode when ocfs2_get_init_inode() fails +- !14312 OLK-6.6: Some patches of RDMA/hns from Linux to olk-6.6 v2 +- RDMA/hns: Fix missing flush CQE for DWQE +- RDMA/hns: Fix warning storm caused by invalid input in IO path +- RDMA/hns: Fix accessing invalid dip_ctx during destroying QP +- Revert "RDMA/hns: Fix accessing invalid dip_ctx during destroying QP" +- RDMA/hns: Fix mapping error of zero-hop WQE buffer +- !14338 CVE-2024-53230 +- cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost() +- cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() +- !14336 mm: Backport mainline patch +- mm: don't install PMD mappings when THPs are disabled by the hw/process/vma +- mm: huge_memory: add vma_thp_disabled() and thp_disabled_by_hw() +- mm: fix arithmetic for max_prop_frac when setting max_ratio +- mm: fix arithmetic for bdi min_ratio +- mm/kmemleak: fix partially freeing unknown object warning +- mm: kmemleak: add __find_and_remove_object() +- mm: kmemleak: use mem_pool_free() to free object +- mm: kmemleak: split __create_object into two functions +- mm/hugetlb: fix nodes huge page allocation when there are surplus pages +- !14337 ALSA: usb-audio: Fix out of bounds reads when finding clock sources +- ALSA: usb-audio: Fix out of bounds reads when finding clock sources +- !14322 back some mainline patches for damon +- mm/damon/core: fix return value from damos_wmark_metric_value +- mm/damon/core: remove unnecessary si_meminfo invoke. +- !14323 zram: fix NULL pointer in comp_algorithm_show() +- zram: fix NULL pointer in comp_algorithm_show() +- !14201 【OLK-6.6】 drivers: arch_topology: Refactor do-while loops +- drivers: arch_topology: Refactor do-while loops +- !14295 pmdomain: imx93-blk-ctrl: correct remove path +- pmdomain: imx93-blk-ctrl: correct remove path +- !14190 Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K" +- Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K" +- !14134 x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client +- x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client +- !14214 mm: revert "mm: shmem: fix data-race in shmem_getattr()" +- mm: revert "mm: shmem: fix data-race in shmem_getattr()" +- !14229 Fix extioi restart issue in vm +- LoongArch: arch/loongarch/kvm: Fix extioi restart issue +- !14127 MPTCP Upstream part 24 +- mptcp: refer to 'MPTCP' socket in comments +- mptcp: add mptcp_space_from_win helper +- mptcp: use mptcp_win_from_space helper +- doc: new 'mptcp' page in 'networking' +- doc: mptcp: alphabetical order +- doc: mptcp: add missing 'available_schedulers' entry +- selftests: mptcp: join: mark 'fastclose' tests as flaky +- selftests: mptcp: lib: support flaky subtests +- selftests: mptcp: export ip_mptcp to mptcp_lib +- !13359 [OLK-6.6] [Backport] individual submission +- MIPS: RB532: Declare prom_setup_cmdline() and rb532_gpio_init() static +- MIPS: BCM47XX: Declare early_tlb_init() static +- MIPS: BCM47XX: include header for bcm47xx_prom_highmem_init() prototype +- ocfs2: spelling fix +- !14291 vdpa: solidrun: Fix UB bug with devres +- vdpa: solidrun: Fix UB bug with devres +- !14256 RDMA/hns: Fix creating GSI QP in non-extended SGE QP bank +- RDMA/hns: Fix creating GSI QP in non-extended SGE QP bank + +* Sat Dec 21 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-72.0.0.76 +- !14213 v2 bpf: Add kabi reserve padding for uapi struct bpf_link_info +- bpf: Add kabi reserve padding for uapi struct bpf_link_info +- !14225 kabi OLK-6.6 reverve space +- kabi: reserve space for uprobes.h +- kabi: reserve space for internal.h +- kabi: reserve space for perf_event.h +- !14259 【OLK-6.6】 Hygon family 18h model 6h~fh L3 PMU config incorrect issue fix +- perf/x86/uncore: Correct the L3 PMU config for Hygon processors +- !14251 kabi reserver space for i2c +- kabi reserver space for i2c +- !14258 v2 scsi: hisi_sas: Enable force phy when SATA disk directly connected +- scsi: hisi_sas: Enable force phy when SATA disk directly connected + +* Thu Dec 19 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-69.0.0.75 +- !14221 KABI for cgroup +- cgroup: add more reserve kabi +- cgroup/cpuset: Prevent UAF in proc_cpuset_show() +- cgroup: Move rcu_head up near the top of cgroup_root +- cgroup: Make operations on the cgroup root_list RCU safe +- Revert "cgroup: fix uaf when proc_cpuset_show" +- !14220 fs: Allow fine-grained control of folio sizes +- fs: Allow fine-grained control of folio sizes +- !12108 include/msi: modify kabi size of msi_desc +- include/msi: modify kabi size of msi_desc +- !14195 [OLK-6.6]Hygon: Enable CONFIG_CMA by default on X86 architecture +- x86/Kconfig: Select CONFIG_CMA if CONFIG_HYGON_CSV=y +- x86/config: Enable CONFIG_CMA by default in openeuler_defconfig +- !14215 iommu: Reserve extra KABI entry for struct iopf_group +- iommu: Reserve extra KABI entry for struct iopf_group +- !14223 v2 kabi: net: reserve space for xdp subsystem related structure +- kabi: net: reserve space for xdp subsystem related structure +- !14224 net/kabi: Reserve space for net structures +- net/kabi: Reserve space for net structures +- !14236 v2 statx: kabi: KABI reservation for kstat +- statx: kabi: KABI reservation for kstat +- !14218 seq_file: kabi: KABI reservation for seq_file +- seq_file: kabi: KABI reservation for seq_file +- !14203 tcp: Fix use-after-free of nreq in reqsk_timer_handler(). +- tcp: Fix use-after-free of nreq in reqsk_timer_handler(). +- !14191 nfs: fix the loss of superblock's initialized flags +- nfs: fix the loss of superblock's initialized flags + +* Wed Dec 18 2024 Liu Yanze <lyz25354840@gmail.com> - 6.6.0-68.0.0.74 +- kabi: add kabi_ext2 list for checking +- kernel.spec: fix with_kabichk on non-arm64 platform + +* Tue Dec 17 2024 Xie XiuQi <xiexiuqi@huawei.com> - 6.6.0-68.0.0.73 +- kabi: add kabi_ext1 list for checking +- check-kabi: fix kabi check failed when no namespace +- kernel.spec: fix with_kabichk on non-arm64 platform + +* Tue Dec 17 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-68.0.0.72 +- !14161 drm/rockchip: vop: Fix a dereferenced before check warning +- drm/rockchip: vop: Fix a dereferenced before check warning +- !14143 KVM:arm64:Add a kvm parameter to control guest wfi trapping +- KVM:arm64:Add a kvm parameter to control guest wfi trapping +- !14177 v2 kabi: restrict the KABI fix to a specific architecture and dist +- kabi: enable KABI_COMPAT series by default on x86_64 & ARM64 +- kabi: restrict the KABI fix to a specific architecture and dist +- !14151 CVE-2024-53142 +- initramfs: avoid filename buffer overrun +- !14183 mm/dynamic_pool: use __GENKSYMS__ to revert the kabi change +- mm/dynamic_pool: use __GENKSYMS__ to revert the kabi change +- !13999 add iommu support for loongarch +- LoongArch: add iommu support +- LoongArch: Fix cpu hotplug issue +- !13998 Synchronization with patch for loongarch virtualization +- LoongArch: Fix AP booting issue in VM mode +- LoongArch: KVM: Remove unnecessary CSR register saving during enter guest +- LoongArch: KVM: Remove undefined a6 argument comment for kvm_hypercall() +- LoongArch: KVM: Add vcpu mapping from physical cpuid +- LoongArch: KVM: Remove unnecessary definition of KVM_PRIVATE_MEM_SLOTS +- LoongArch: KVM: Add cpucfg area for kvm hypervisor +- LoongArch: KVM: Add KVM hypercalls documentation for LoongArch +- LoongArch: KVM: Implement function kvm_para_has_feature() +- LoongArch: KVM: Enable paravirt feature control from VMM +- LoongArch: KVM: Add PMU support for guest +- LoongArch: KVM: Add vm migration support for LBT registers +- LoongArch: KVM: Add Binary Translation extension support +- LoongArch: KVM: Add VM feature detection function +- LoongArch: Revert qspinlock to test-and-set simple lock on VM +- LoongArch: KVM: Invalidate guest steal time address on vCPU reset +- KVM: Discard zero mask with function kvm_dirty_ring_reset +- perf kvm: Add kvm-stat for loongarch64 +- LoongArch: KVM: Add PV steal time support in guest side +- LoongArch: KVM: Add PV steal time support in host side +- LoongArch: KVM: always make pte young in page map's fast path +- LoongArch: KVM: Mark page accessed and dirty with page ref added +- LoongArch: KVM: Add dirty bitmap initially all set support +- LoongArch: KVM: Add memory barrier before update pmd entry +- LoongArch: KVM: Discard dirty page tracking on readonly memslot +- LoongArch: KVM: Select huge page only if secondary mmu supports it +- LoongArch: KVM: Delay secondary mmu tlb flush until guest entry +- LoongArch: KVM: Sync pending interrupt when getting ESTAT from user mode +- LoongArch: KVM: Add mmio trace events support +- LoongArch: KVM: Add software breakpoint support +- LoongArch: KVM: Add PV IPI support on guest side +- LoongArch: KVM: Add PV IPI support on host side +- !14163 LeapIOraid： Remove Unnecessary header file references: version.h +- LeapIOraid： Remove Unnecessary header file references: version.h +- !13997 Add interrupt controller emulation in the kernel +- LoongArch: KVM: Add irqfd support +- LoongArch: KVM: Add PCHPIC user mode read and write functions +- LoongArch: KVM: Add PCHPIC read and write functions +- LoongArch: KVM: Add PCHPIC device support +- LoongArch: KVM: Add EXTIOI user mode read and write functions +- LoongArch: KVM: Add EXTIOI read and write functions +- LoongArch: KVM: Add EXTIOI device support +- LoongArch: KVM: Add IPI user mode read and write function +- LoongArch: KVM: Add IPI read and write function +- LoongArch: KVM: Add IPI device support +- LoongArch: KVM: Add iocsr and mmio bus simulation in kernel +- !14111 LeapIOraid： Fix the compilation warnings in LeapIOraid driver in loongarch64 +- LeapIOraid： Fix the compilation warnings in LeapIOraid driver in loongarch64 +- !14162 LeapIOraid： Fix too many invalid interruptes in arm64 +- LeapIOraid： Fix too many invalid interruptes in arm64 +- !11509 [OLK-6.6] Enhanced Hygon processor's processing capabilities for large memory copying +- mm: Enhanced copy capabilities for Hygon processor +- !14155 drm/amd/display: Adjust VSDB parser for replay feature +- drm/amd/display: Adjust VSDB parser for replay feature + +* Fri Dec 13 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-67.0.0.71 +- !14144 [6.6] [Feature] : update patches for sw64 architecture +- sw64: fix compile errors +- sw64: work around gcc bugs with 'asm goto' with output +- libbpf: add sw64 support +- sw64: rename mmap protection_map +- sw64: ptrace: add NT_SW64_SYSTEM_CALL regset +- sw64 bpf: Add missing uapi header for BPF_PROG_TYPE_PERF_EVENT programs +- sw64 bpf: add BPF_NOSPEC jit +- sw64: rename _PFN_BITS to __PFN_BITS +- sw64: update defconfig +- sw64: kvm: declare KVM_CAP_SET_GUEST_DEBUG +- sw64: implementing VDSO with generic code +- sw64: irqchip: fix irq_enable/disable callback for MCU controller +- sw64: kvm: remove unused argument 'addr' of apt_dissolve_pud/pmd() +- sw64: acpi: support reset and S5 +- sw64: kvm: use vma_lookup() instead of find_vma_intersection() +- sw64: refactor reset routines with new API +- sw64: kvm: remove unused kvm_arch_flush_remote_tlbs_memslot() +- sw64: kvm: optimize the calling and implementation of functions in mmu.c +- sw64: irqchip: remove fallback after kzalloc_node() +- sw64: irqchip: improve intx implementation +- sw64: pci: remove function fix_jm585_reset() +- sw64: fix mmap protection_map +- sw64: show CPU feature UNA in /proc/cpuinfo +- sw64: fix the error of cpufreq update +- sw64: fix compilation issues on match.c +- sw64: mm: fix PFN of PMDs for 512M hugepage +- sw64: kvm: fix an error when unmapping 512M hugepages +- sw64: modify sys_pfh_ops +- sw64: fix set_huge_pte_at for C4 +- sw64: add the missed clear_flush() +- sw64: fix compilation issues +- sw64: add arch_hugetlb_valid_size for C4 +- sw64: kvm: adjust interrupt priority for guest +- sw64: compatible with suspend implementation +- sw64: add junzhang_v1/2/3_key +- sw64: fix numa setup when acpi is disabled +- sw64: fix setup_mem_size() +- sw64: fix the register bug in do_entUna +- sw64: add unaligned access handling code for SIMD in kernel mode (5.10) +- sw64: select different MUX to read cpu frequency +- sw64: lpc: fix ast2400 driver error for C4 +- sw64: improve lib performance for new archs +- sw64: remove unnecessary parameter passing +- sw64: add __vdso_getcpu support +- sw64: kexec: fix kernel crashdump bugs +- sw64: bpf: fix BPF_CALL address +- sw64: fix irq work +- sw64: reset the CSR:PTBR_USR +- sw64: kvm: add KVM_CAP_READONLY_MEM support +- sw64: pci: fix incorrect pointer of struct pci_controller +- sw64: perf: add core4 pmu support +- sw64: mm: support fdt memory reservation +- sw64: provide a cleaner raw_smp_processor_id() +- sw64: remove deprecated annotation in irq.h +- sw64: introduce a fine-grained intx mask/unmask system +- sw64: move handle_intx() into pci-intx handle +- sw64: iommu: fix NULL hose check +- sw64: fix judgements about legacy pci support +- sw64: cacheinfo: give preference to cache information from PPTT table +- sw64: cache: fix shared_cpu_map of cacheinfo +- sw64: cpu: refactor cpuinfo related code +- sw64: cache: refactor cacheinfo related code +- sw64: cpu: move cpu related code to the newly created cpu.c +- sw64: topology: support initializing topology via DT or ACPI +- sw64: spi: convert SPI_MASTER_GPIO_SS to SPI_CONTROLLER_GPIO_SS +- sw64: defconfig: fix SPI related configuration items +- sw64: irqchip: add version 3 for PINTC +- sw64: fix null pointer issue when CONFIG_BUILTIN_DTB=y +- sw64: acpi: suppress log of function acpi_numa_x2apic_affinity_init() +- sw64: clk: further fix the clock frequency of SPI and I2C +- sw64: smp: fix function fdt_setup_smp() +- Revert "sw64: fdt: map physical node ID to logical node ID" +- sw64: pci: remove legacy io reservation +- sw64: fix LPC legacy IO space on chip junzhang and junzhang_v2 +- sw64: 6.6 upgrade +- sw64: mm: remove legacy memory detection for JunZhang platform +- sw64: iommu: improve iommu initialization +- sw64: clk: fix the clock frequency of SPI and I2C +- sw64: fix a bug in huge_pte_offset() +- sw64: pci: rename some functions +- sw64: pci: support PCIe controller driver based on device tree +- sw64: remove sw64_io related functions +- sw64: platform: add misc platform driver +- sw64: add basic frequency scaling support for JunZhang +- sw64: remove redundant link options +- sw64: kvm: enable ring-based dirty page tracking +- sw64: kvm: fix invalid memslot flags checking during dirty logging +- sw64: pciehp: fix compile error when CONFIG_PCIE_DPC=y +- sw64: kvm: don't retrieve memory slot again in page fault handler +- sw64: kexec: remove code for compatibility with builtin DTB +- sw64: smp: allow NR_CPUS less than the number detected by firmware +- sw64: fix C4 INTx configuration +- !14166 Align per_cpu osq_node to 64 Byte size cacheline +- Align per_cpu osq_node to 64 Byte size cacheline +- !14130 [virtcca] delete unused interfaces: tmi_data_destroy and tmi_ttt_unmap_range +- virtCCA Feature: remove unused interfaces and add cpumask check +- !14152 crypto: hisilicon/sec2 - the aead algorithm of sec2 is fixed. +- crypto: hisilicon/trng - support to obtain random numbers from soft algorithm +- crypto: hisilicon/sec2 - fix for aead invalid authsize +- crypto: hisilicon/sec2 - fix for aead icv error +- crypto: hisilicon/qm - disable error report before flr +- !13824 mm: some mTHPs improve +- mm: fix docs for the kernel parameter ``thp_anon=`` +- mm: count the number of anonymous THPs per size +- mm: tidy up shmem mTHP controls and stats +- mm: cleanup count_mthp_stat() definition +- mm: huge_mm: fix undefined reference to `mthp_stats' for CONFIG_SYSFS=n +- mm: override mTHP "enabled" defaults at kernel cmdline +- !10305 [OLK-6.6] Backport bugfixes for mm LRU from Linux upstream +- mm: vmscan.c: fix OOM on swap stress test +- mm/gup: clear the LRU flag of a page before adding to LRU batch + +* Wed Dec 11 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-66.0.0.70 +- !13846 [OLK-6.6] cpufreq: acpi-cpufreq: Zhaoxin: fix incorrect max-freq issue +- cpufreq: acpi-cpufreq: Zhaoxin: fix incorrect max-freq issue +- !9184 [OLK-6.6] i2c: smbus: Add support for Zhaoxin SMBUS controller +- configs: Add Zhaoxin i2c smbus items in openeuler_config +- i2c: smbus: Add support for Zhaoxin SMBUS controller +- !9223 [OLK-6.6] x86/hpet: Read HPET directly if panic in progress +- x86/hpet: Read HPET directly if panic in progress +- !14088 ACPI: CPPC: Introduce new EPP capabilities and update auto selection functions +- ACPI: CPPC: Introduce new EPP capabilities and update auto selection functions +- !14112 xfs: Fix data overflow +- xfs: Fix data overflow in xfs_mod_fdblocks() +- Revert "xfs: split xfs_mod_freecounter" +- !14099 [6.6] [Feature] : update patches for sw64 architecture +- sw64: pci: fix compile error when CONFIG_PCI_MSI=n +- sw64: pci: fix unable to get node ID when numa_off is set +- sw64: add uapi reg.h +- sw64: pciehp: remove useless code +- sw64: dts: support online-capable property for cpu device node +- sw64: kvm: resolve a compile warning +- sw64: pciehp: update code +- sw64: kvm: fix mmio GPA for C4 +- sw64: handle null MSI irq in guest os +- sw64: fix guest memory and cpu hotplug function +- sw64: kvm: walk host page tables to find THP mapping size +- sw64: kvm: convert to the gfn-based MMU notifier callbacks +- sw64: kvm: rename mmu_notifier_* to mmu_invalidate_* +- sw64: kvm: fix compiler errors caused by mismatched parameters +- sw64: kvm: use get_page() instead of kvm_get_pfn() +- sw64: kvm: fix the handling when the live migration fails +- sw64: kvm: fix NULL poniter access in kvm_arch_prepare_memory_region +- sw64: kvm: fix link error with CONFIG_KVM=m +- sw64: kvm: fix build failure about KVM +- sw64: add dependency for sunway-ged driver +- sw64: fix compile error with CONFIG_SUNWAY_GED=m +- sw64: remove unused sunway_memory_get_meminfo() +- sw64: Kconfig: activate ARCH_KEEP_MEMBLOCK +- sw64: add cpu hotplug support for C4 guest +- sw64: kvm: support up to 256 vCPUs for C4 +- sw64: kvm: fix inconsistent vcpucb of C4 +- sw64: kvm: implement kvm_arch_set_irq_inatomic() +- sw64: fix guest send ipi target +- sw64: kvm: add numa support for memory hotplug +- sw64: kvm: fix bug when vcpu disable irq +- sw64: kvm: acpi: match sunway_ged by acpi method +- sw64: kvm: use generic kvm mmu memory caches +- sw64: kvm: remove some unused codes +- sw64: kvm: fix pmd_trans_cont +- sw64: kvm: fix size of struct kvm_regs for C3B +- sw64: kvm: add the member of the vcpucb structure +- sw64: kvm: fix the check for THP +- sw64: kvm: fix page walk error of unmap_apt_range() +- sw64: redesign struct kvm_regs for C4 +- sw64: kvm: fix live migration bug +- sw64: kvm: fix APT fault handler +- sw64: kvm: fix unmap_apt_{ptes, pmds} +- sw64: kvm: fix clock sync of CORE4 live migration +- sw64: kvm: delete memory hotplug codes for CORE3B +- sw64: add missing c4 legacy power management code +- sw64: kvm: scale up the range of target vcpu parsed by hypervisor +- sw64: kvm: fix return value of vmem_mmap +- sw64: kvm: add trace kvm function +- sw64: fix rc resource setup +- sw64: 6.6 update: sunway_pciehp_reset_slot() +- sw64: 6.6 update: arch_remove_memory() +- sw64: bypass sunway pcie hotplug driver in non-physical scenario +- sw64: defconfig: update defconfig for kata-containers +- sw64: add HARDLOCKUP_DETECTOR support +- sw64: fix bugs in decreasing frequency +- sw64: add NMI support +- sw64: add CSR_CAUSE into pt_regs +- sw64: optimize the code in do_entInt() +- sw64: seperate IRQ_MSI configs for sub-architectures +- sw64: handle null MSI irq +- sw64: fix a compilation warning +- sw64: fix a base address of msiaddr register +- sw64: fix some S3 CSRs problems for C4 +- sw64: fix io resource remapping +- sw64: amdgpu/radeon: correct low-level mmio memset/memcpy direct calls +- sw64: fix pci resource assignment bug +- sw64: fix MSI compilation warnings +- sw64: 6.6 io.h fixup +- sw64: iommu: support SW64 IOMMU on 6.6 kernel +- sw64: fix msi interrupt for guest os +- sw64: msi: update code +- sw64: gpio: fix compile error of sunway_gpio_add_port +- sw64: fdt: map physical node ID to logical node ID +- sw64: fix regs.pc on single-step with ptrace +- sw64: modify some interrupt target core to logic 0 core +- sw64: fix sw64_is_fake_mcount() of recordmcount +- sw64: remove some unused module init/exit/license +- sw64: numa: support NUMA initialization based on device tree +- sw64: smp: support SMP initialization based on device tree +- sw64: dtb: disable built-in DTB for junzhang +- sw64: ata: add ata_hrst_delay cmdline option +- sw64: kconfig: add I2C and SPI defconfig for junzhang +- sw64: kconfig: set default y for GPIO if ACPI enabled +- sw64: fix a bug in gpio-sunway.c +- sw64: pci: use readq/writeq to read/write RC and PIU IO registers +- sw64: gpu: memset_io and memcpy_toio/fromio for iomem on AMD swsmu +- sw64: pciehp: add pcie hotplug driver support for C4 +- sw64: remove redundant intx code +- sw64: irq: support interrupt for virtual GPIO +- sw64: acpi: enable ACPI by default +- sw64: mm: fix mem=xxx command line invalid in some cases +- sw64: use generic page_is_ram() +- sw64: mm: take memory information from firmware +- sw64: lpc: fix compile error with CONFIG_SUNWAY_SUPERIO_AST2400=y +- sw64: fix typo in gpio-sunway +- sw64: fix compile warning of handle_pci_msi_interrupt +- sw64: fix usage of __add_memory() in sunway-ged driver +- sw64: change FORCE_MAX_ZONEORDER default value +- sw64: perf: fix event check order + +* Tue Dec 10 2024 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-64.0.0.69 +- riscv kernel upgrade to 6.6.0-64.0.0 +- Fix some compilation errors reported by clang. + +* Tue Dec 10 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-64.0.0.68 +- !14106 uacce: some bugfix and cleanup +- migration: modify dfx error type without VM driver +- crypto: hisilicon_qm - fix the uacce_alloc return value check +- crypto: hisilicon_zip - correct the wrong word in the printed information +- uacce: add mutex for check qfr +- uacce: add stop_queue to replace put_queue in ioctl +- uacce: check the qfr address before releasing the qfr +- uacce: add error number for the unsupported mremap +- !14117 mm/page_alloc: Separate THP PCP into movable and non-movable categories +- mm: fix kabi breakage due to struct per_cpu_pages +- mm/page_alloc: Separate THP PCP into movable and non-movable categories +- !14120 bpf: sync_linked_regs() must preserve subreg_def +- bpf: sync_linked_regs() must preserve subreg_def +- !14128 sched: Optimize the latency of select_task_rq and pick_next_task. +- sched: Optimize the latency of select_task_rq and pick_next_task. +- !13991 virtio-fs: introduce multi-queue support +- virtio-fs: add multi-queue support +- virtio-fs: limit number of request queues +- virtiofs: include a newline in sysfs tag +- virtiofs: emit uevents on filesystem events +- virtiofs: export filesystem tags through sysfs +- !14126 [OLK-6.6]perf:Add PMCG platform information for HiSilicon HIP09A +- ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A +- Revert "perf: Add PMCG platform information for HiSilicon HIP09A" +- !14103 nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint +- nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint +- !13841 Fix livepatch selftest +- selftests/livepatch: fix selftest execution error +- !14069 MPTCP Upstream part 23 +- tcp: socket option to check for MPTCP fallback to TCP +- mptcp: fix typos in comments +- !13970 LoongArch: fix AVEC related issue +- drivers/irqchip: Disable pci_irq_limit when using AVEC interrupt controller +- irqchip/avec: Support AVEC for 3C6000 multi-node machine +- !13981 LoongArch: backport ptw&set_pte patches from upstream +- LoongArch: Set initial pte entry with PAGE_GLOBAL for kernel space +- LoongArch: Improve hardware page table walker +- LoongArch: Use accessors to page table entries instead of direct dereference +- LoongArch: Remove superfluous flush_dcache_page() definition +- !14107 ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf() +- ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf() +- !14101 [sync] PR-14087: v2 drivers/perf: hisi: Add support for HiSilicon DDRC v3 PMU driver +- drivers/perf: hisi: Add support for HiSilicon DDRC v3 PMU driver +- !14095 ima: Fix violation digests extending issue in virtcca +- ima: Fix violation digests extending issue in virtcca +- !14079 v3 irqchip: gic: some bugfix of hip10 +- irqchip/gic-v4.1:Check whether indirect table is supported in allocate_vpe_l1_table +- KVM: arm64: vgic-v3: Fix a issue of hip10 erratum 162200806 +- irqchip/gic-v3: Exclude GICv4.1 for hip10 erratum 162200803 +- !14085 ocfs2: uncache inode which has failed entering the group +- ocfs2: uncache inode which has failed entering the group +- !13837 update patches for sw64 architecture +- sw64: wrap frequency workaround into standalone functions +- sw64: remove redudant save_ktp +- sw64: fix compile warning of smp_callin() +- sw64: distribute intx interrupts by hose +- sw64: acpi: remove constraint that cid of boot core must be zero +- sw64: pci: get register base address from firmware +- sw64: fix compile warning of do_entUna() +- sw64: fix save_ktp compatibility for C3 +- sw64: fix PTBR save/restore for hibernation +- sw64: add syscall pfh_ops +- sw64: fix broken rdfpcr() +- sw64: force kernel stack to be 16 bytes aligned +- sw64: match platform device by acpi method +- sw64: spi: update spi controller driver +- sw64: add -fno-sw-unalign-byte to cflags for C4 +- sw64: define cpu_relax() as imb() +- sw64: fix the .endm in hibernate_asm.S +- sw64: fix compile error of efi.systab +- sw64: pci: adjust the maximum number of RC per node +- sw64: get mclk and external clk from firmware +- sw64: fix compile error of MMSIZE +- sw64: acpi: disable ACPI for xuelang +- sw64: ahci: disable parallel bus scan +- sw64: redesign run mode setup method +- sw64: rename static key and related simd libraries +- sw64: fix secondary cpu bring up bug +- sw64: irq: fix compile error when PINTC or LPC-INTC is not set +- sw64: improve the verification logic of DTB +- sw64: apply new boot params from DTB chosen node +- sw64: receive new boot params from firmware +- sw64: setup stackframe at kernel entry point +- sw64: save and restore CSR_WR_FREGS for SIMD libs +- sw64: rename copy and set lib functions +- sw64: rename copy and set lib files +- sw64: choose lib at compile time +- sw64: store topology and numa info by each cpu itself +- sw64: work around suspend for C4 +- sw64: employ trick on regs.pc for specific exception +- sw64: enable CONFIG_FRAME_POINTER by default for junzhang +- sw64: fix syscall_fallback() for vdso gettimeofday +- sw64: dts: add Junzhang +- sw64: lpc: work around hardware flaws +- sw64: improve cpu bring up method +- sw64: introduce new entry framework for C4 +- sw64: irq: update the initial value of nr_irqs +- sw64: dynamically switch between lib implementation +- sw64: msi: remove redundant interrupt enables +- sw64: add unaligned access support for C4 new instructions +- sw64: acpi: fix missed upper bits of rcid for junzhang +- sw64: pci: remove duplicate pcie operations +- sw64: irq: remove unnecessary initialization +- sw64: acpi: enable generic GSI +- sw64: irqchip: support ACPI-based interrupt controller initialization +- sw64: acpi: support MADT entry print for SW PINTC, MSIC and LPC-INTC +- sw64: acpi: add ACPI-style structures for SW PINTC, MSIC and LPC-INTC +- sw64: fix compilation warning +- sw64: fix kconfig selections +- sw64: use a new wrap_asid hmcall when asid wraps +- sw64: rewrite fpcr and swcr conversion +- sw64: enable hardware denorm by default +- sw64: add four-socket system support +- sw64: add a new kernel parameter to override mclk +- sw64: improve sw64_printk() +- sw64: msi: fix bugs in multi-msi interrupts allocation and release +- sw64: pci: change pci transaction ordering rule settings +- sw64: irqchip: fix virtual PINTC not working properly +- sw64: dts: improve properties for PINTC +- sw64: dts: improve properties for LPC-INTC +- sw64: dts: fix interrupt related properties for GPIO +- sw64: dts: add chosen node +- sw64: dts: fix properties for spi controller device node +- sw64: acpi: fix coding style and typos +- sw64: fix rd_f compatibility issue for C4 +- sw64: refactor device interrupt domain +- sw64: fix macro definition compilation error +- USB: xHCI: fix resume issue of some ZHAOXIN hosts +- USB: Fix ehci infinite suspend-resume loop issue in zhaoxin +- sw64: pci: fix compile error when CONFIG_ACPI=n +- sw64: smp: suppress function setup_smp() when ACPI enabled +- sw64: acpi: parse SW CINTC for SMP initialization +- sw64: acpi: support MADT entry print for SW CINTC +- sw64: acpi: add ACPI-style structures for SW CINTC +- sw64: smp: add new structure to record rcid information +- sw64: smp: modify function smp_rcb_init() to receive base address +- sw64: pci: synchronize the OEM table ID of MCFG with BIOS +- sw64: iommu: fix the bug when vfio_iommu unpin pages +- sw64: use rvpcr() to setup run mode +- sw64: kgdb: add single-step debug support +- sw64: fix lockdep error +- sw64: perf: do all event checks in sw64_pmu_event_init() +- sw64: numa: fix compile error when CONFIG_ACPI_NUMA=n +- sw64: pci: export some pci functions +- sw64: uapi: fix a compile error for headers_install +- sw64: perf: hide hardware performance events in guest os +- sw64: fix hugepage support +- sw64: extern vdso_start and vdso_end as char[] +- sw64: remove useless current_policy +- sw64: add arch-specific SYM_END definition +- !13151 [OLK-6.6] arm64: errata: Unify and expand speculative SSBS workaround +- openeuler_defconfig: Enable CONFIG_ARM64_ERRATUM_3194386 by default +- arm64: Subscribe Microsoft Azure Cobalt 100 to erratum 3194386 +- arm64: errata: Expand speculative SSBS workaround once more +- arm64: errata: Expand speculative SSBS workaround (again) +- arm64: errata: Expand speculative SSBS workaround +- arm64: errata: Unify speculative SSBS errata logic +- arm64: errata: Add workaround for Arm errata 3194386 and 3312417 + +* Sat Dec 07 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-62.0.0.67 +- support 64k pagesize: skip kabi check + +* Thu Dec 05 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-62.0.0.66 +- !14091 mm, slab: put should_failslab() back behind CONFIG_SHOULD_FAILSLAB +- mm, page_alloc: put should_fail_alloc_page() back behing CONFIG_FAIL_PAGE_ALLOC +- mm, slab: put should_failslab() back behind CONFIG_SHOULD_FAILSLAB +- !14015 【openEuler 24.03 LTS SP1】SCSI: LeapIO RAID: Support leapioraid RAID controllers +- SCSI: LEAPIORAID: Supports LEAPIO RAID controller +- !14072 Revert "Revert "net: libwx: fix alloc msix vectors failed"" +- Revert "Revert "net: libwx: fix alloc msix vectors failed"" +- !14094 block, bfq: fix bfqq uaf in bfq_limit_depth() +- block, bfq: fix bfqq uaf in bfq_limit_depth() +- !14065 vp_vdpa: fix id_table array not null terminated error +- vp_vdpa: fix id_table array not null terminated error +- !13809 scsi: hisi_sas: Some fixes for hisi_sas +- scsi: sd: Retry START STOP UNIT commands +- scsi: core: Allow passthrough to request midlayer retries +- scsi: hisi_sas: Add latest_dump for the debugfs dump +- scsi: hisi_sas: Create all dump files during debugfs initialization +- scsi: hisi_sas: Update v3 hw STP_LINK_TIMER setting +- scsi: hisi_sas: Add time interval between two H2D FIS following soft reset spec +- scsi: hisi_sas: Update disk locked timeout to 7 seconds +- scsi: hisi_sas: Default enable interrupt coalescing +- scsi: hisi_sas: Add cond_resched() for no forced preemption model +- scsi: hisi_sas: Reset PHY again if phyup timeout +- scsi: hisi_sas: Enable all PHYs that are not disabled by user during controller reset +- scsi: hisi_sas: Add firmware information check +- scsi: hisi_sas: Create trigger_dump at the end of the debugfs initialization +- scsi: hisi_sas: Adjust priority of registering and exiting debugfs for security +- scsi: libsas: Set port when ex_phy is added or deleted +- scsi: libsas: Move sas_add_parent_port() to sas_expander.c +- scsi: libsas: Add helper for port add ex_phy +- !14059 cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction +- cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction +- Revert "cgroup: Fix AA deadlock caused by cgroup_bpf_release" +- !14026 drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags +- drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags +- !14056 virtcca feature : security rectification +- virtcca feature : security rectification +- !14012 drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer +- drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer +- !14011 drm/amd/display: Check phantom_stream before it is used +- drm/amd/display: Check phantom_stream before it is used +- !14013 maple_tree: correct tree corruption on spanning store +- maple_tree: correct tree corruption on spanning store + +* Wed Dec 04 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-61.0.0.65 + +* Wed Dec 04 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-61.0.0.64 +- !13340 cpufreq: Add SEEP governor for hardware-managed P-states +- ACPI: CPPC: fix bug that causes the value written in cpc register to be wrong. +- cpufreq: Add SEEP governor for hardware-managed P-states +- cpufreq: CPPC: Support for auto act window and energy perf in cppc_cpufreq +- ACPI: CPPC: Add New ABIs for reading and writing three new CPPC registers +- !14004 Support haltpoll feature +- arm64: add config for cpuidle-haltpoll +- arm64/delay: remove USECS_TO_CYCLES to avoid conflict +- cpuidle: edit cpuidle-haltpoll driver module parameter +- arm64: support WFET in smp_cond_relaxed_timeout() +- arm64/delay: add some constants to a separate header +- arm64: support cpuidle-haltpoll +- arm64: idle: export arch_cpu_idle +- cpuidle-haltpoll: condition on ARCH_CPUIDLE_HALTPOLL +- governors/haltpoll: drop kvm_para_available() check +- cpuidle-haltpoll: define arch_haltpoll_want() +- ACPI: processor_idle: Support polling state for LPI +- arm64: add support for polling in idle +- arm64: define TIF_POLLING_NRFLAG +- arm64: barrier: add support for smp_cond_relaxed_timeout() +- Kconfig: move ARCH_HAS_OPTIMIZED_POLL to arch/Kconfig +- cpuidle: rename ARCH_HAS_CPU_RELAX to ARCH_HAS_OPTIMIZED_POLL +- cpuidle/poll_state: poll via smp_cond_load_relaxed_timeout() +- asm-generic: add barrier smp_cond_load_relaxed_timeout() +- !13402 【OLK-6.6】Support SMMU vSVA feature +- arm-smmu-v3: remove limitation of S2FWB or CANWBS +- iommufd: enable SVA when IOPF enabled +- iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability +- iommufd: modify iommufd_fault_iopf_enable limitation +- Enable configs for vSVA tests +- iommu/arm-smmu-v3: Implement arm_smmu_get_msi_mapping_domain +- iommu: Fix kabi breakage due to "iommu/dma: Support MSIs through nested domains" +- iommu/dma: Support MSIs through nested domains +- iommu/arm-smmu-v3: Support IOMMU_HWPT_INVALIDATE using a VIOMMU object +- iommu/arm-smmu-v3: Allow ATS for IOMMU_DOMAIN_NESTED +- iommu/arm-smmu-v3: Use S2FWB for NESTED domains +- iommu/arm-smmu-v3: Support IOMMU_DOMAIN_NESTED +- iommu/arm-smmu-v3: Support IOMMU_VIOMMU_ALLOC +- iommu/arm-smmu-v3: Expose the arm_smmu_attach interface +- iommu/arm-smmu-v3: Implement IOMMU_HWPT_ALLOC_NEST_PARENT +- iommu/arm-smmu-v3: Support IOMMU_GET_HW_INFO via struct arm_smmu_hw_info +- iommu/arm-smmu-v3: Report IOMMU_CAP_ENFORCE_CACHE_COHERENCY for CANWBS +- ACPI/IORT: Support CANWBS memory access flag +- ACPICA: IORT: Update for revision E.f +- iommu: Fix kabi breakage due to "vfio: Remove VFIO_TYPE1_NESTING_IOMMU" +- vfio: Remove VFIO_TYPE1_NESTING_IOMMU +- Documentation: userspace-api: iommufd: Update vDEVICE +- iommufd/selftest: Add vIOMMU coverage for IOMMU_HWPT_INVALIDATE ioctl +- iommufd/selftest: Add IOMMU_TEST_OP_DEV_CHECK_CACHE test command +- iommufd/selftest: Add mock_viommu_cache_invalidate +- iommufd/viommu: Add iommufd_viommu_find_dev helper +- iommu: Add iommu_copy_struct_from_full_user_array helper +- iommufd: Allow hwpt_id to carry viommu_id for IOMMU_HWPT_INVALIDATE +- iommu/viommu: Add cache_invalidate to iommufd_viommu_ops +- iommufd/selftest: Add IOMMU_VDEVICE_ALLOC test coverage +- iommufd/viommu: Add IOMMUFD_OBJ_VDEVICE and IOMMU_VDEVICE_ALLOC ioctl +- Documentation: userspace-api: iommufd: Update vIOMMU +- iommufd/selftest: Add IOMMU_VIOMMU_ALLOC test coverage +- iommufd/selftest: Add IOMMU_VIOMMU_TYPE_SELFTEST +- iommufd/selftest: Add refcount to mock_iommu_device +- iommufd/selftest: Prepare for mock_viommu_alloc_domain_nested() +- iommufd/selftest: Add container_of helpers +- iommufd: Allow pt_id to carry viommu_id for IOMMU_HWPT_ALLOC +- iommufd: Add alloc_domain_nested op to iommufd_viommu_ops +- iommufd/viommu: Add IOMMU_VIOMMU_ALLOC ioctl +- iommufd: Verify object in iommufd_object_finalize/abort() +- iommu: Fix kabi breakage due to "iommufd: Introduce IOMMUFD_OBJ_VIOMMU and its related struct" +- iommufd: Introduce IOMMUFD_OBJ_VIOMMU and its related struct +- iommufd: Move _iommufd_object_alloc helper to a sharable file +- iommufd: Move struct iommufd_object to public iommufd header +- Documentation: userspace-api: iommufd: Update HWPT_PAGING and HWPT_NESTED +- iommu/arm-smmu-v3: add missing MODULE_DESCRIPTION() macro +- iommu/arm-smmu-v3: Convert comma to semicolon +- iommu/arm-smmu-v3: Fix last_sid_idx calculation for sid_bits==32 +- iommu: Move IOMMU_DIRTY_NO_CLEAR define +- iommu/arm-smmu-v3: Fix a NULL vs IS_ERR() check +- iommu/arm-smmu-v3: Remove the unused empty definition +- iommu/arm-smmu-v3: Avoid uninitialized asid in case of error +- iommu: Make iommu_sva_domain_alloc() static +- iommu: Handle iommu faults for a bad iopf setup +- iommufd: Put constants for all the uAPI enums +- iommu/arm-smmu-v3: Use *-y instead of *-objs in Makefile +- iommu/arm-smmu-v3: Make the kunit into a module +- iommu/amd: Introduce get_amd_iommu_from_dev() +- iommufd/device: Enforce reserved IOVA also when attached to hwpt_nested +- iommufd/device: Fix hwpt at err_unresv in iommufd_device_do_replace() +- iommufd: Reorder struct forward declarations +- iommufd: Reorder include files +- iommu/arm-smmu-v3: Reorganize struct arm_smmu_ctx_desc_cfg +- iommu/arm-smmu-v3: Add types for each level of the CD table +- iommu/arm-smmu-v3: Shrink the cdtab l1_desc array +- iommu/arm-smmu-v3: Do not use devm for the cd table allocations +- iommu/arm-smmu-v3: Remove strtab_base/cfg +- iommu/arm-smmu-v3: Reorganize struct arm_smmu_strtab_cfg +- iommu/arm-smmu-v3: Add types for each level of the 2 level stream table +- iommu/arm-smmu-v3: Add arm_smmu_strtab_l1/2_idx() +- iommu/arm-smmu-v3: Use the new rb tree helpers +- iommu/arm-smmu-v3: Shrink the strtab l1_desc array +- iommu/arm-smmu-v3: Do not zero the strtab twice +- iommufd: Fix error pointer checking +- iommufd: Add check on user response code +- iommufd: Remove IOMMUFD_PAGE_RESP_FAILURE +- iommufd/selftest: Add coverage for IOPF test +- iommufd/selftest: Add IOPF support for mock device +- iommufd: Associate fault object with iommufd_hw_pgtable +- iommufd: Fault-capable hwpt attach/detach/replace +- iommu: Fix kabi breakage due to "iommufd: Add iommufd fault object" +- iommufd: Add iommufd fault object +- iommufd: Add fault and response message definitions +- iommu: Extend domain attach group with handle support +- iommu: Fix kabi breakage due to "iommu: Add attach handle to struct iopf_group" +- iommu: Add attach handle to struct iopf_group +- iommu: Fix kabi breakage due to "iommu: Remove sva handle list" +- iommu: Remove sva handle list +- iommu: Introduce domain attachment handle +- iommu/arm-smmu-v3: Enable HTTU for stage1 with io-pgtable mapping +- iommu/arm-smmu-v3: Add support for dirty tracking in domain alloc +- iommu/io-pgtable-arm: Add read_and_clear_dirty() support +- iommu/arm-smmu-v3: Add feature detection for HTTU +- iommu/arm-smmu-v3: Add support for domain_alloc_user fn +- iommu/arm-smmu-v3: Allow setting a S1 domain to a PASID +- iommu/arm-smmu-v3: Allow a PASID to be set when RID is IDENTITY/BLOCKED +- iommu/arm-smmu-v3: Test the STE S1DSS functionality +- iommu/arm-smmu-v3: Allow IDENTITY/BLOCKED to be set while PASID is used +- iommu/arm-smmu-v3: Put the SVA mmu notifier in the smmu_domain +- iommu/arm-smmu-v3: Keep track of arm_smmu_master_domain for SVA +- iommu/arm-smmu-v3: Make SVA allocate a normal arm_smmu_domain +- iommu/arm-smmu-v3: Thread SSID through the arm_smmu_attach_*() interface +- iommu/arm-smmu-v3: Do not use master->sva_enable to restrict attaches +- iommu/arm-smmu-v3: Add ssid to struct arm_smmu_master_domain +- iommu/arm-smmu-v3: Make changing domains be hitless for ATS +- iommu/arm-smmu-v3: Make smmu_domain->devices into an allocated list +- iommu/arm-smmu-v3: Start building a generic PASID layer +- iommu/arm-smmu-v3: Convert to domain_alloc_sva() +- iommu/arm-smmu-v3: Add unit tests for arm_smmu_write_entry +- iommu/arm-smmu-v3: Build the whole CD in arm_smmu_make_s1_cd() +- iommu/arm-smmu-v3: Move the CD generation for SVA into a function +- iommu/arm-smmu-v3: Allocate the CD table entry in advance +- iommu/arm-smmu-v3: Make arm_smmu_alloc_cd_ptr() +- iommu/arm-smmu-v3: Consolidate clearing a CD table entry +- iommu/arm-smmu-v3: Move the CD generation for S1 domains into a function +- iommu/arm-smmu-v3: Make CD programming use arm_smmu_write_entry() +- iommu/arm-smmu-v3: Add an ops indirection to the STE code +- iommu: Fix kabi breakage due to "iommu: Add ops->domain_alloc_sva()" +- iommu: Add ops->domain_alloc_sva() +- iommu/arm-smmu-v3: Add a type for the CD entry +- iommu/arm-smmu-v3: Do not ATC invalidate the entire domain +- iommu/arm-smmu-v3: Do not allow a SVA domain to be set on the wrong PASID +- iommu/arm-smmu-v3: Retire disable_bypass parameter +- iommu: Validate the PASID in iommu_attach_device_pasid() +- iommu/arm-smmu-v3: Add cpu_to_le64() around STRTAB_STE_0_V +- iommu: Fix kabi breakage due to "iommu: Pass domain to remove_dev_pasid() op" +- iommu: Pass domain to remove_dev_pasid() op +- iommu: Undo pasid attachment only for the devices that have succeeded +- iommu: Introduce iommu_group_mutex_assert() +- iommu/arm-smmu-v3: Fix access for STE.SHCFG +- iommu/arm-smmu-v3: Convert to domain_alloc_paging() +- iommu/arm-smmu-v3: Pass arm_smmu_domain and arm_smmu_device to finalize +- iommu/arm-smmu-v3: Use the identity/blocked domain during release +- iommu/arm-smmu-v3: Add a global static BLOCKED domain +- iommu/arm-smmu-v3: Add a global static IDENTITY domain +- iommu/arm-smmu-v3: Check that the RID domain is S1 in SVA +- iommu/arm-smmu-v3: Remove arm_smmu_master->domain +- iommu/arm-smmu-v3: Pass smmu_domain to arm_enable/disable_ats() +- iommu/arm-smmu-v3: Put writing the context descriptor in the right order +- iommu/arm-smmu-v3: Do not change the STE twice during arm_smmu_attach_dev() +- iommu/arm-smmu-v3: Compute the STE only once for each master +- iommu/arm-smmu-v3: Hold arm_smmu_asid_lock during all of attach_dev +- iommu/arm-smmu-v3: Build the whole STE in arm_smmu_make_s2_domain_ste() +- iommu/arm-smmu-v3: Move the STE generation for S1 and S2 domains into functions +- iommu/arm-smmu-v3: Consolidate the STE generation for abort/bypass +- iommu/arm-smmu-v3: Make STE programming independent of the callers +- !14019 afs: Fix lock recursion +- afs: Fix lock recursion +- !13230 xfs: Fix fsmap error +- xfs: Fix missing interval for missing_owner in xfs fsmap +- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code +- !13977 xfs: split xfs_mod_freecounter +- xfs: split xfs_mod_freecounter +- !14005 v2 Optimize functions like get_user and put_user +- openeuler_defconfig: remove GCC_ASM_GOTO_OUTPUT_WORKAROUND for x86 and arm64 +- arm64: uaccess: correct thinko in __get_mem_asm() +- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND +- arm64: start using 'asm goto' for put_user() +- arm64: start using 'asm goto' for get_user() when available +- !14031 Various memory tiering fixes +- memory tiering: count PGPROMOTE_SUCCESS when mem tiering is enabled. +- memory tiering: introduce folio_use_access_time() check +- memory tiering: read last_cpupid correctly in do_huge_pmd_numa_page() +- !14025 ext4: show the default enabled prefetch_block_bitmaps option +- ext4: show the default enabled prefetch_block_bitmaps option +- !13906 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.53-6.6.54 LTS Conflicts Patches +- btrfs: update comment for struct btrfs_inode::lock +- arm64: errata: Enable the AC03_CPU_38 workaround for ampere1a +- xen: allow mapping ACPI data using a different physical address +- sched/fair: Make SCHED_IDLE entity be preempted in strict hierarchy +- !9158 [OLK-6.6] ata: ahci: Add support for AHCI SGPIO Enclosure Management +- config: enable Zhaoxin AHCI SGPIO driver +- ata: ahci: Add support for AHCI SGPIO Enclosure Management +- !9162 [OLK-6.6] efi: cper: Add Zhaoxin/Centaur ZDI/ZPI error decode +- efi: cper: Add Zhaoxin/Centaur ZDI/ZPI error decode +- !14022 [OLK-6.6] perf/x86/zhaoxin/uncore: fix pci_driver conflict issue +- perf/x86/zhaoxin/uncore: fix pci_driver conflict issue +- !13965 arm64: entry: Fix some warnings when enable nohz full CPU +- arm64: entry: Fix some warnings when enable nohz full CPU +- !13926 genirq/proc: Fix warning of no previous prototype for register_irqchip_proc() +- genirq/proc: Fix warning of no previous prototype for register_irqchip_proc() +- !13993 50164 +- bpf: Remove MEM_UNINIT from skb/xdp MTU helpers +- bpf: Fix kabi breakage in enum bpf_type_flag and bpf_arg_type +- bpf: Fix overloading of MEM_UNINIT's meaning +- bpf: Add MEM_WRITE attribute +- !13951 Fix UAF in __update_blocked_fair +- Fix UAF in __update_blocked_fair +- !13950 Fix SCHED_WARN_ON(cfs_rq->throttled_clock) in throttle_cfs_rq +- Fix SCHED_WARN_ON(cfs_rq->throttled_clock) in throttle_cfs_rq +- !13949 sched/fair: Fix qos_timer deadlock when cpuhp offline +- sched/fair: Fix qos_timer deadlock when cpuhp offline +- !13912 media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set +- media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set +- !13961 ext4: avoid remount errors with 'abort' mount option +- ext4: avoid remount errors with 'abort' mount option +- !13974 arm64: optimize tlb flush +- arm64: optimize flush tlb kernel range +- arm64: tlbflush: add __flush_tlb_range_limit_excess() +- arm64: tlb: Allow range operation for MAX_TLBI_RANGE_PAGES +- arm64: tlbflush: Rename MAX_TLBI_OPS +- !13969 libbpf: Fix output .symtab byte-order during linking +- libbpf: Fix output .symtab byte-order during linking +- !13955 drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range +- drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range +- !13913 fix CVE-2024-49861 +- bpf: Fix kabi breakage in enum bpf_type_flag and bpf_arg_type +- bpf: Fix helper writes to read-only maps +- !13317 reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC +- reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC +- !12279 [OLK-6.6]HYGON: CSV3 patch series part 2 (Support launch, run, migrate CSV3 guest) +- x86/mm: Print CSV3 info into kernel log +- x86: Add support for changing the memory attribute for CSV3 guest +- x86: Update memory shared/private attribute in early boot for CSV3 guest +- x86/kernel: Set bss decrypted memory as shared in CSV3 guest +- x86/kernel: Add CSV3 early update(enc/dec)/reset memory helpers +- x86/boot/compressed/64: Add CSV3 update page attr(private/shared) +- x86/boot/compressed/64: Init CSV3 secure call pages +- x86/boot/compressed/64: Add CSV3 guest detection +- KVM: SVM: CSV: Add ioctl API to unpin shared pages of CSV3 guest +- KVM: SVM: CSV: Add KVM_CSV3_RECEIVE_ENCRYPT_CONTEXT command +- KVM: SVM: CSV: Add KVM_CSV3_RECEIVE_ENCRYPT_DATA command +- KVM: SVM: CSV: Add KVM_CSV3_SEND_ENCRYPT_CONTEXT command +- KVM: SVM: CSV: Add KVM_CSV3_SEND_ENCRYPT_DATA command +- crypto: ccp: Define CSV3 migration command id +- KVM: SVM: CSV: Manage CSV3 guest's nested page table +- KVM: SVM: CSV: Add KVM_CSV3_LAUNCH_ENCRYPT_VMCB command +- KVM: SVM: CSV: Add KVM_CSV3_LAUNCH_ENCRYPT_DATA command +- KVM: SVM: CSV: Add KVM_CSV3_INIT command +- KVM: Define CSV3 key management command id +- !13843 Add support for FEAT_HAFT +- openeuler_defconfig: Add configuration to enable FEAT_HAFT +- arm64: pgtable: Warn unexpected pmdp_test_and_clear_young() +- arm64: Enable ARCH_HAS_NONLEAF_PMD_YOUNG +- arm64: Add support for FEAT_HAFT +- arm64: setup: name 'tcr2' register +- arm64/sysreg: Update ID_AA64MMFR1_EL1 register +- !13889 ipmi: Use regspacings passed as a module parameter +- ipmi: Use regspacings passed as a module parameter +- !13454 [OLK-6.6][Backport] tracing/selftests: Update kprobe args char/string to match new functions +- tracing/selftests: Update kprobe args char/string to match new functions +- !13453 [OLK-6.6][Backport] selftest: net: Fix the problem that run veth.sh failed +- selftests: net: veth: test the ability to independently manipulate GRO and XDP +- selftests: net: veth: test syncing GRO and XDP state while device is down +- !13450 [OLK-6.6][Backport] tools/nolibc: add support for constructors and destructors +- tools/nolibc: add support for constructors and destructors +- !13815 [OLK-6.6][Backport] selftests/intel_pstate: fix operand expected error +- selftests/intel_pstate: fix operand expected error +- !13417 [OLK-6.6][Backport] selftest: net/af_unix: Fix the problem that run test_unix_oob failed +- selftest: af_unix: Fix kselftest compilation warnings +- selftest: af_unix: Add msg_oob.c. +- selftest: af_unix: Remove test_unix_oob.c. +- selftest: af_unix: Add Kconfig file. +- !13806 [OLK-6.6][Backport] selftests/watchdog-test: Fix system accidentally reset after watchdog-test +- selftests/watchdog-test: Fix system accidentally reset after watchdog-test +- !13897 drm/amd/display: Check link_index before accessing dc->links[ +- drm/amd/display: Check link_index before accessing dc->links[] +- !13901 RDMA/hns: Fix accessing invalid dip_ctx during destroying QP +- RDMA/hns: Fix accessing invalid dip_ctx during destroying QP +- !13904 NFSD: Never decrement pending_async_copies on error +- NFSD: Never decrement pending_async_copies on error +- !13888 CVE-2024-49891 +- scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths + +* Mon Dec 02 2024 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-59.0.0.63 + +- riscv kernel upgrade to 6.6.0-59.0.0 +- Add more th1520 drivers support: + npu-ax3386, vdec, venc, aic8800, g2d, efuse, etnaviv, tdm, spdif, aw87519, + hwspinlock, perf vendor events, iopmp. + +- th1520: Fix Makefile for npu build error +- th1520: Fix Makefile for vc8000d vc8000e tracepoints +- config: Disable video_memory module until the bug is resolved +- config: Update openeuler_defconfig DRM_ETNAVIV and AIC_FW_PATH +- mmc: sdhci-of-dwcmshc: Prevent stale command interrupt handling +- riscv: Add ACLINT SSWI support +- config: Update openeuler_defconfig +- dts: lpi4a: remove mipi screen +- drm/verisilicon: add format_mod_supported to plane +- drm/verisilicon: bias fb address for dual-head offset +- drm/verisilicon: finally fix the cursor position +- drm/verisilicon: fix cursor position +- drm: verisilicon: fix fbcon +- th1520: drm: Fix panel-jadard-jd9365da panel driver +- th1520: drm: Fix panel-jadard-jd9365da panel driver problem +- drm/dc8200: disable gamma lut now +- th1520: use etnaviv gpu +- drm/etnaviv: hack: use only pta id 0 +- drm/etnaviv: add GC620 +- drm/etnaviv: add hwdb entry for TH1520 GC620 +- drm/etnaviv: add workaround for GC620 on TH1520 (0x5552) +- drm/etnaviv: add handle for GPUs with only SECURITY_AHB flag +- sensor: fix bug of channel 1 and channel 2 of video2 failed to run +- th1520: Expand cma size from 512MB to 768MB +- RISC-V: Enable the IPI before workqueue_online_cpu() +- audio: th1520: solve misalignment dma addr problem when HDMI playback +- dts: th1520: sd card not try sdio cmds +- th1520: Fix DSI transfer command failure when hotplug hdmi +- th1520_defconfig: add configs of media +- dts: som: add gpio-keys node +- usb: dwc3: th1520.dtsi: bugfix: fix usb str xhci error +- config: th1520: to modify MEMBLOCK&LOCALVERSION_AUTO config +- dts:th1520: add aliases for basic interface +- move the place of dts "audio-text-memory-region" property +- driver:i2c:fix rx_over miss re-try +- drivers: cpufreq: fix cpufreq em model regsiter warn. +- drivers: pwm: fix pwm enable status check error +- sdhci:th1520: fixup mmc retune infinitely issue +- fix: dts: remove duplicate node +- config: Update openeuler_defconfig +- dts: audio: update audio pin configuration +- audio: th1520: workaround to solve noise at the end +- remove dts "audio_mem" node and add mbox 910r channel +- dts: gpio: add gpio/0/1/2/3 clk gate +- dts: th1520: update mmc sdio clocks +- usb: dwc3-thead: fix usb gadget support +- dts: th1520-lichee-pi-4a: update usb hub +- th1520: iopmp: add iopmp driver +- th1520: regdump: add Kconfig and th1520_defconfig +- drivers: pct: fix NULL ptr error when pvt resume from ram +- drivers: pinctrl: add pinctrl driver pm ops +- dts: th1520: modify kernel memory region, [0x0, 0x20000] is reserved for opensbi +- dts: add th1520-lpi4a-dsi0.dts and th1520-lpi4a-hx8279.dts +- riscv: dts: lpi4a 16g support +- dw-axi-dma : fix the incorrect ttfc configuration in aix-dma +- drivers: dma: change dw dma runtime pm to sync +- audio: th1520: fix i2s pause/resume dma fail +- dma: dw-axi-dmac: fix multi-channel dmatest fail +- audio: th1520: resolve the dma error problem when ap i2s audio stop play +- watchdog: dw_wdt: ap watchdog timeout report different strategies +- drivers: wdt: drop DW wdt restart function for th1520 soc +- drivers: hwmon: bugfix for mr75203 +- spi: spidev: add spidev speed sysfs for debug +- dts: th1520: add cpu thermal node and device thermal node +- riscv: sbi: Introduce system suspend support +- perf: sync vendor event path with torvalds/linux +- th1520: system_monitor: to add system_monitor driver +- driver : rfkill : Delete unnecessary code +- dts: rfkill: Delete unnecessary nodes +- th1520: regdump: add regdump support for lpi4a +- driver:i2c:add i2c mode for tx transfer +- hwspinlock: th1520: to add th1520 hwspinlock driver +- dts: th1520: add rambus eip_28 device node +- perf vendor events riscv: Add PMU event JSON files for TH1520 DDRC PMU +- dts: rfkill: Resolving Insmod Failure Issues +- th1520: nvmem: efuse: add th1520 efuse driver +- dts: th1520: add g2d device node +- dts: th1520: to add npu device node +- defconfig:th1520: enable cma config +- dtb:lipi:enable VI module config +- riscv: config: add MAX_ORDER config for riscv and th1520 +- dts: th1520: add vdec venc and video mem device node +- mm: export sysmbol __pte_offset_map_lock for modules outside +- th1520_defconfig: Enable AIC8800 modules +- th1520: Add AIC8800 modules driver +- th1520_defconfig: Add AIC8800's config +- th1520: aic8800: Fix known issues +- uart: Fix the UART problem +- rfkill: add aic8800 rfkill support for gpio control of aic8800 wifi/bt +- th1520-lichee-pi-4a.dts: change dts for aic8800 wifi Support aic8800 wifi +- th1520-lichee-pi-4a.dts: change dts for aic8800 bt Support aic8800 bt +- th1520: audio: add pa aw87519 driver for XuanTie TH1520 SoC +- th1520: audio: add spdif driver for XuanTie TH1520 SoC +- th1520: audio: add tdm driver for XuanTie TH1520 SoC +- riscv: mm: Add support for Svinval extension +- symbol: gpl: export pud_offset/p4d_offset symbol +- th1520: npu: fix build error +- th1520: npu: Enable vha tracepoint +- th1520_defconfig: Enable video_memory driver +- th1520: riscv: Add video_memory driver +- th1520_defconfig: Enable vc8000d and vc8000e driver +- th1520: riscv: Add vc8000d and vc8000e driver +- th1520: riscv: Add npu to th1520_defconfig +- th1520: riscv: add npu-ax3386 driver + +* Thu Nov 28 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-59.0.0.62 +- !13894 v2 block: support hierarchy stats +- blk-io-hierarchy: support hierarchy stats for bio lifetime +- blk-io-hierarchy: support new rq based stage rq_driver +- blk-io-hierarchy: support new rq based stage requeue +- blk-io-hierarchy: support new rq based stage hctx +- blk-io-hierarchy: support new rq based stage kyber +- blk-io-hierarchy: support new rq based stage bfq +- blk-io-hierarchy: support new rq based stage mq-deadline +- blk-io-hierarchy: support new rq based stage plug +- blk-io-hierarchy: support new bio based stage gettag +- blk-io-hierarchy: support new bio based stage iocost +- blk-io-hierarchy: support new bio based stage wbt +- block-io-hierarchy: core hierarchy stats and iodump implementation +- block: support to record when request is completed +- block: support to recored bio allocation task in request +- block: support to recored bio allocation time in request +- block: support to recored bio allocation task +- block: support to recored bio allocation time +- block: fix kabi broken after caching ns time in blk_plug +- block: fix that blk_time_get_ns() doesn't update time after schedule +- block: limit block time caching to in_task() context +- block: update cached timestamp post schedule/preemption +- block: cache current nsec time in struct blk_plug +- block: add blk_time_get_ns() and blk_time_get() helpers +- block: move cgroup time handling code into blk.h +- block: skip QUEUE_FLAG_STATS and rq-qos for passthrough io +- blk-io-hierarchy: support hierarchy stats for blk-throttle +- !13851 intel: backport intel_pstate driver update from 6.11 +- cpufreq: intel_pstate: Update Balance performance EPP for Emerald Rapids +- cpufreq: intel_pstate: Support highest performance change interrupt +- cpufreq: intel_pstate: Replace boot_cpu_has() +- x86/cpufeatures: Add HWP highest perf change feature flag +- cpufreq: intel_pstate: Check turbo_is_disabled() in store_no_turbo() +- cpufreq: intel_pstate: Fix unchecked HWP MSR access +- cpufreq: intel_pstate: fix struct cpudata::epp_cached kernel-doc +- cpufreq: intel_pstate: hide unused intel_pstate_cpu_oob_ids[] +- cpufreq: intel_pstate: Update the maximum CPU frequency consistently +- cpufreq: intel_pstate: Replace three global.turbo_disabled checks +- cpufreq: intel_pstate: Read global.no_turbo under READ_ONCE() +- cpufreq: intel_pstate: Rearrange show_no_turbo() and store_no_turbo() +- cpufreq: intel_pstate: Do not update global.turbo_disabled after initialization +- cpufreq: intel_pstate: Fold intel_pstate_max_within_limits() into caller +- cpufreq: intel_pstate: Use __ro_after_init for three variables +- cpufreq: intel_pstate: Get rid of unnecessary READ_ONCE() annotations +- cpufreq: intel_pstate: Wait for canceled delayed work to complete +- cpufreq: intel_pstate: Drop redundant locking from intel_pstate_driver_cleanup() +- cpufreq: intel_pstate: Allow model specific EPPs +- cpufreq: intel_pstate: remove cpudata::prev_cummulative_iowait +- cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode +- cpufreq: intel_pstate: Prioritize firmware-provided balance performance EPP +- !13850 intel: backport TPMI uncore frequency driver update from 6.10 +- platform/x86/intel-uncore-freq: Use generic helpers for current frequency +- platform/x86/intel-uncore-freq: Rename the sysfs helper macro names +- platform/x86/intel-uncore-freq: Get rid of uncore_read_freq driver API +- platform/x86/intel-uncore-freq: Use uncore_index with read_control_freq +- platform/x86/intel-uncore-freq: Get rid of magic min_max argument +- platform/x86/intel-uncore-freq: Get rid of magic values +- platform/x86/intel-uncore-freq: Re-arrange bit masks +- platform/x86/intel-uncore-freq: Increase minor number support +- platform/x86/intel-uncore-freq: Process read/write blocked feature status +- platform/x86/intel-uncore-freq: Ignore minor version change +- !13849 intel: backport Intel SST TPMI update from 6.10 +- platform/x86: ISST: Simplify isst_misc_reg() and isst_misc_unreg() +- platform/x86: ISST: Fix return value on last invalid resource +- platform/x86: ISST: Use only TPMI interface when present +- platform/x86: ISST: Avoid some SkyLake server models +- platform/x86: ISST: Add model specific loading for common module +- platform/x86: ISST: fix use-after-free in tpmi_sst_dev_remove() +- platform/x86: ISST: Support SST-BF and SST-TF per level +- platform/x86: ISST: Add missing MODULE_DESCRIPTION +- platform/x86: ISST: Add dev_fmt +- platform/x86: ISST: Use in_range() to check package ID validity +- platform/x86: ISST: Support partitioned systems +- platform/x86: ISST: Shorten the assignments for power_domain_info +- platform/x86: ISST: Use local variable for auxdev->dev +- platform/x86: ISST: Allow reading core-power state on HWP disabled systems +- platform/x86: ISST: Process read/write blocked feature status +- platform/x86: ISST: Ignore minor version change +- platform/x86: intel_speed_select_if: Use devm_ioremap_resource +- platform/x86: intel_speed_select_if: Remove hardcoded map size +- platform/x86: ISST: Allow level 0 to be not present +- platform/x86: ISST: Use fuse enabled mask instead of allowed levels +- !13847 intel: backport tpmi base driver and pmt update from 6.10 to 6.6 +- platform/x86/intel/pmt: telemetry: Export API to read telemetry +- platform/x86/intel/pmt: Add header to struct intel_pmt_entry +- platform/x86/intel/tpmi: Add additional TPMI header fields +- platform/x86/intel/tpmi: Align comments in kernel-doc +- platform/x86/intel/tpmi: Check major version change for TPMI Information +- platform/x86/intel/tpmi: Move TPMI ID definition +- platform/x86/intel/tpmi: Modify external interface to get read/write state +- platform/x86/intel/tpmi: Don't create devices for disabled features +- platform/x86/intel/tpmi: Add debugfs support for read/write blocked +- platform/x86/intel/vsec: Remove nuisance message +- platform/x86/intel/vsec: Add base address field +- platform/x86/intel/vsec: Add intel_vsec_register +- platform/x86/intel/vsec: Assign auxdev parent by argument +- platform/x86/intel/vsec: Use cleanup.h +- platform/x86/intel/vsec: remove platform_info from vsec device structure +- platform/x86/intel/vsec: Move structures to header +- platform/x86/intel/vsec: Remove unnecessary return +- !13880 Fix problems of mounting nfs +- nfs: ignore SB_RDONLY when mounting nfs +- nfs: pass flags to second superblock +- !13822 v4 arm64: Add xcall/xint support +- arm64: Add debugfs dir for xint +- arm64: Introduce Xint software solution +- arm64: Faster SVC exception handler with xcall +- arm64: Introduce xcall a faster svc exception handling +- !13828 crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY +- crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY +- !13805 add ebpf sched +- sched/ebpf: Support task selection programmable +- sched: Add kfunc to get cpu statistics +- bpftool: recognize scheduler programs +- libbpf: add support for scheduler bpf programs +- !13373 acc some patch rounds +- crypto: hisilicon/qm - disable same error report before resetting +- crypto: hisilicon - support querying the capability register +- crypto: hisilicon/qm - fix the coding specifications issue +- crypto: hisilicon/hpre - enable all clusters clock gating +- crypto: hisilicon/sec - Remove trailing space after +- crypto: hisilicon/qm - inject error before stopping queue +- crypto: hisilicon/hpre - mask cluster timeout error +- crypto: hisilicon/qm - reset device before enabling it +- crypto: hisilicon/trng - modifying the order of header files +- crypto: hisilicon - add a lock for the qp send operation +- crypto: hisilicon - fix missed error branch +- crypto: hisilicon/zip - Optimize performance by replacing rw_lock with spinlock +- crypto: hisilicon/zip - optimize the address offset of the reg query function +- crypto: hisilicon/qm - adjust the internal processing sequence of the vf enable and disable +- crypto: hisilicon/sec2 - fix for register offset +- crypto: hisilicon/debugfs - mask the unnecessary info from the dump +- Revert "crypto: hisilicon/qm - reset device before enabling it" +- Revert "crypto: hisilicon/qm - inject error before stopping queue" +- Revert "crypto: hisilicon/qm - modify interrupt processing resource application" +- Revert "crypto: hisilicon/qm - mask error bit before flr" +- Revert "crypto: hisilicon/qm - disable same error report before resetting" +- Revert "crypto: hisilicon/hpre - mask cluster timeout error" +- Revert "crypto: hisilicon/zip - optimize the address offset of the reg query function" +- Revert "crypto: hisilicon/qm - adjust the internal processing sequence of the vf enable and disable" +- Revert "crypto: hisilicon/trng - use %u to print u32 variables" + + newline +* Wed Nov 27 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-57.0.0.61 +- !13845 backport some patches from upstream about HCCS low power +- soc: hisilicon: kunpeng_hccs: Support low power feature for the specified HCCS type +- soc: hisilicon: kunpeng_hccs: Add used HCCS types sysfs +- soc: hisilicon: kunpeng_hccs: Fix the 'lane_mode' field name in port info structure to 'max_lane_num' +- soc: hisilicon: kunpeng_hccs: Add the check for base address and size of shared memory +- soc: hisilicon: kunpeng_hccs: Return failure on having not die or port information +- soc: hisilicon: kunpeng_hccs: Fix a PCC typo +- !13842 ima: fix buffer overrun in ima_eventdigest_init_common +- ima: fix buffer overrun in ima_eventdigest_init_common +- !13827 LoongArch: KVM: Mark hrtimer to expire in hard interrupt context +- LoongArch: KVM: Mark hrtimer to expire in hard interrupt context +- !11952 migration: fix reference counting exception issue +- migration: fix reference counting exception issue +- !13816 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.49-6.6.50 LTS Conflicts Patches +- hwmon: (k10temp) Check return value of amd_smn_read() +- mptcp: pr_debug: add missing +- mptcp: avoid duplicated SUB_CLOSED events +- selftests: mptcp: join: check re-re-adding ID 0 signal +- selftests: mptcp: join: validate event numbers +- !11950 arm64/perf: Enable branch stack sampling +- arm64/perf: Enable branch stack sampling +- perf: test: Extend branch stack sampling test for Arm64 BRBE +- perf: test: Remove empty lines from branch filter test output +- perf: test: Speed up running brstack test on an Arm model +- KVM: arm64: nvhe: Disable branch generation in nVHE guests +- drivers: perf: arm_pmuv3: Enable branch stack sampling via FEAT_BRBE +- arm64/boot: Enable EL2 requirements for BRBE +- drivers: perf: arm_pmu: Add infrastructure for branch stack sampling +- KVM: arm64: Explicitly handle BRBE traps as UNDEFINED +- arm64/sysreg: Add BRBE registers and fields +- KVM: arm64: Initialize the kvm host data's fpsimd_state pointer in pKVM +- KVM: arm64: nv: Drop VCPU_HYP_CONTEXT flag +- KVM: arm64: Exclude FP ownership from kvm_vcpu_arch +- KVM: arm64: Exclude host_fpsimd_state pointer from kvm_vcpu_arch +- KVM: arm64: Exclude mdcr_el2_host from kvm_vcpu_arch +- KVM: arm64: Exclude host_debug_data from vcpu_arch +- KVM: arm64: Add accessor for per-CPU state +- KVM: arm64: Fix TRFCR_EL1/PMSCR_EL1 access in hVHE mode +- arm64: Add missing _EL2 encodings +- arm64: Add missing _EL12 encodings +- !13836 virtcca bugfix: correct array copy for hpre_addr +- virtcca bugfix: correct array copy for hpre_addr +- !13416 tpm: Lock TPM chip in tpm_pm_suspend() first +- tpm: Lock TPM chip in tpm_pm_suspend() first +- !13810 【olk 6.6】 net: hns3: add mac tunnel number query +- net: hns3: add mac tunnel number query +- !13831 fix CVE-2024-50192 +- irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs +- irqchip/gic-v4: Don't allow a VMOVP on a dying VPE +- !13243 virtcca: fix the double map of cvm secure memory +- virtcca feature : disable swiotlb for passthrough device +- virtcca feature : force vring alloc use dma api +- virtcca feature: enable unmap swiotlb buffer to save iotlb cvm memory +- !12343 net: tcp: add a new congestion control algorithm, CAQM, with endhost-network coordination +- net: tcp: Modify codes for better compatibility of code format +- net: tcp: Add CAQM4TCP in the openeuler 6.6 kernel +- !13818 net/hinic3: Support new NIC feature +- net/hinic3: Support new RX feature +- net/hinic3: Support new TX feature +- !13413 sched/topology: Prevent race condition in sched_domain topology +- sched/topology: Prevent race condition in sched_domain topology +- !13808 perf: Add PMCG platform information for HiSilicon HIP09A +- perf: Add PMCG platform information for HiSilicon HIP09A +- !13794 drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw +- drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw +- !13795 drm/amd/display: Initialize denominators' default to 1 +- drm/amd/display: Initialize denominators' default to 1 +- !13408 rseq/mm_cid: change KABI consistency interface +- rseq/mm_cid: change KABI consistency interface +- !13799 media: av7110: fix a spectre vulnerability +- media: av7110: fix a spectre vulnerability +- !13449 RDMA/hns: Fix bonding failure due to wrong reset_state +- RDMA/hns: Fix bonding failure due to wrong reset_state +- !13407 ima: rot: remove misguiding message printing +- ima: rot: remove misguiding message printing +- !13306 btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids() +- btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids() +- !13308 ext4: don't set SB_RDONLY after filesystem errors +- ext4: don't set SB_RDONLY after filesystem errors +- !13355 NFSD: Initialize struct nfsd4_copy earlier +- NFSD: Initialize struct nfsd4_copy earlier +- !13301 RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop +- RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop +- !13391 mm: split critical region in remap_file_pages() and invoke LSMs in between +- mm: split critical region in remap_file_pages() and invoke LSMs in between +- !13394 mm, slub: avoid zeroing kmalloc redzone +- mm, slub: avoid zeroing kmalloc redzone +- !13400 IMA: Fix hungtask issue of digestlist importing +- IMA: Fix hungtask issue of digestlist importing +- !13370 CVE-2024-46713 +- perf: Fix kabi problem by put mutex in front of perf_buffer +- perf/aux: Fix AUX buffer serialization +- !13376 Some patches for RDMA/hns +- RDMA/hns: Fix RoCEE hang when multiple QP banks use EXT_SGE EXT_SGE +- RDMA/hns: Use one CQ bank per context +- RDMA/hns: Fix the modification of max_send_sge +- RDMA/hns: Fix "Should it be static?" warnings +- RDMA/hns: Fix dereference of noderef expression +- RDMA/hns: Fix list_*_careful() not being used in pairs +- RDMA/hns: Fix a meaningless loop in active_dca_pages_proc() +- RDMA/hns: Fix possible RAS when DCA is not attached +- RDMA/hns: Fix integer overflow in calc_loading_percent() +- RDMA/hns: Fix mixed use of u32 and __le32 in sysfs +- RDMA/hns: Fix concurrency between sysfs store and FW configuration of scc params +- RDMA/hns: Fix wrong output of sysfs scc pram when configuration failed +- RDMA/hns: Fix HW UAF when destroy context timeout +- !13350 mm: replace xa_get_order with xas_get_order where appropriate +- mm: replace xa_get_order with xas_get_order where appropriate +- !12240 [OLK-6.6]Update Mont-TSSE driver +- driver: crypto - update support for Mont-TSSE Driver +- !13345 ocfs2: fix unexpected zeroing of virtual disk +- ocfs2: fix unexpected zeroing of virtual disk +- !13377 selftests: udpgro: no need to load xdp for gro +- selftests: udpgro: no need to load xdp for gro +- !13374 netdevsim: fix rtnetlink.sh selftest +- netdevsim: fix rtnetlink.sh selftest +- !13357 x86/selftests: Skip the tests if prerequisites aren't fulfilled +- x86/selftests: Skip the tests if prerequisites aren't fulfilled +- !13248 [OLK-6.6][Backport] selftests/mount_setattr: fix idmap_mount_tree_invalid failed to run +- selftests/mount_setattr: fix idmap_mount_tree_invalid failed to run +- !13389 RDMA/hns: Fix different dgids mapping to the same dip_idx +- RDMA/hns: Fix different dgids mapping to the same dip_idx +- !13362 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.47-6.6.48 LTS Conflicts Patches +- mm/numa: no task_numa_fault() call if PTE is changed +- mm/numa: no task_numa_fault() call if PMD is changed +- mm: fix endless reclaim on machines with unaccepted memory +- !13148 [OLK-6.6] [Backport] mpt3sas_scsih: don't set QUEUE_FLAG_NOMERGES +- mpt3sas_scsih: don't set QUEUE_FLAG_NOMERGES +- !13372 [OLK-6.6] Support Intel Sierra Forest CPU MAXPHYSADDR and fix KVM_STATS_TYPE_MAX +- KVM: selftests: x86: Prioritize getting max_gfn from GuestPhysBits +- KVM: x86: Advertise max mappable GPA in CPUID.0x80000008.GuestPhysBits +- kvm: fix KVM_STATS_TYPE_MAX +- !13331 MPTCP Upstream part 22 +- selftests: mptcp: use KSFT_SKIP/KSFT_PASS/KSFT_FAIL +- selftests: mptcp: add mptcp_lib_verify_listener_events +- selftests: mptcp: extract mptcp_lib_check_expected +- selftests: mptcp: call test_fail without argument +- selftests: mptcp: print test results with colors +- selftests: mptcp: print test results with counters +- selftests: mptcp: add print_title in mptcp_lib +- selftests: mptcp: export TEST_COUNTER variable +- selftests: mptcp: sockopt: print every test result +- selftests: mptcp: connect: fix misaligned output +- selftests: mptcp: connect: add dedicated port counter +- selftests: mptcp: print all error messages to stdout +- mptcp: annotate a data-race around sysctl_tcp_wmem[0] +- tcp: annotate a data-race around sysctl_tcp_wmem[0] + + at the end +* Wed Nov 20 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-56.0.0.60 +- !13324 v2 CVE-2023-52920 +- bpf: handle fake register spill to stack with BPF_ST_MEM instruction +- selftests/bpf: add stack access precision test +- bpf: Fix kabi breakage in struct bpf_verifier_state and bpf_verifier_env +- bpf: support non-r10 register spill/fill to/from stack in precision tracking +- !13321 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.61-6.6.62 LTS Patches +- 9p: fix slab cache name creation for real +- mm: krealloc: Fix MTE false alarm in __do_krealloc +- bpf: Check validity of link->type in bpf_link_show_fdinfo() +- net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition +- ASoC: fsl_micfil: Add sample rate constraint +- LoongArch: Use "Exception return address" to comment ERA +- ASoC: rt722-sdca: increase clk_stop_timeout to fix clock stop issue +- RISCV: KVM: use raw_spinlock for critical section in imsic +- HID: lenovo: Add support for Thinkpad X1 Tablet Gen 3 keyboard +- HID: multitouch: Add quirk for Logitech Bolt receiver w/ Casa touchpad +- fs: Fix uninitialized value issue in from_kuid and from_kgid +- ASoC: amd: yc: Fix non-functional mic on ASUS E1404FA +- ASoC: amd: yc: Add quirk for ASUS Vivobook S15 M3502RA +- bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6 +- bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx +- vDPA/ifcvf: Fix pci_read_config_byte() return code handling +- nvme/host: Fix RCU list traversal to use SRCU primitive +- smb: client: Fix use-after-free of network namespace. +- nvme: make keep-alive synchronous operation +- nvme-loop: flush off pending I/O while shutting down loop controller +- net: phy: mdio-bcm-unimac: Add BCM6846 support +- powerpc/powernv: Free name on error in opal_event_init() +- drm/amdkfd: Accounting pdd vram_usage for svm +- nvme-multipath: defer partition scanning +- RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES +- drm/vmwgfx: Limit display layout ioctl array size to VMWGFX_NUM_DISPLAY_UNITS +- sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML +- crypto: marvell/cesa - Disable hash algorithms +- crypto: api - Fix liveliness check in crypto_alg_tested +- bpf: use kvzmalloc to allocate BPF verifier environment +- nvme: disable CC.CRIME (NVME_CC_CRIME) +- iommu/arm-smmu: Clarify MMU-500 CPRE workaround +- HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad +- HID: multitouch: Add support for B2402FVA track point +- block: Fix elevator_get_default() checking for NULL q->tag_set +- nvme: tcp: avoid race between queue_lock lock and destroy +- irqchip/ocelot: Fix trigger register address +- selftests/bpf: Verify that sync_linked_regs preserves subreg_def +- 9p: Avoid creating multiple slab caches with the same name +- 9p: v9fs_fid_find: also lookup by inode if not found dentry +- !13335 net/hinic3: Support New SDK and NIC features +- net/hinic3: Support New SDK and NIC features +- !11561 mm: support large folio swap-out and swap-in for shmem +- mm/pageout: Fix kabi broken in writeback_control +- mm:shmem: Support large folio adjust reliable shmem usage count +- mm: shmem: support large folio swap out +- mm: shmem: split large entry if the swapin folio is not large +- mm: shmem: drop folio reference count using 'nr_pages' in shmem_delete_from_page_cache() +- mm: shmem: support large folio allocation for shmem_replace_folio() +- mm: shmem: use swap_free_nr() to free shmem swap entries +- mm: filemap: use xa_get_order() to get the swap entry order +- mm: shmem: return number of pages beeing freed in shmem_free_swap +- mm: shmem: extend shmem_partial_swap_usage() to support large folio swap +- mm: swap: extend swap_shmem_alloc() to support batch SWAP_MAP_SHMEM flag setting +- mm: swap: add nr argument in swapcache_prepare and swapcache_clear to support large folios +- mm/swapfile:__swap_duplicate: drop redundant WRITE_ONCE on swap_map for err cases +- mm: extend 'usage' parameter so that cluster_swap_free_nr() can be reused +- !13251 MPTCP Upstream part 21 +- selftests: userspace pm: avoid relaunching pm events +- selftests: mptcp: simult flows: fix shellcheck warnings +- selftests: mptcp: pm netlink: fix shellcheck warnings +- selftests: mptcp: sockopt: fix shellcheck warnings +- selftests: mptcp: diag: fix shellcheck warnings +- selftests: mptcp: add mptcp_lib_events helper +- selftests: mptcp: more operations in ns_init/exit +- selftests: mptcp: add mptcp_lib_ns_init/exit helpers +- selftests: mptcp: add local variables rndh +- selftests: mptcp: add mptcp_lib_check_tools helper +- selftests: mptcp: stop forcing iptables-legacy +- !13313 fix ci compile nbl_ethtool.c warning +- Net: nebula_matrix: fix ci compile nbl_ethtool.c warning +- !13129 drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe +- drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe +- !13296 sched/numa: Fix the potential null pointer dereference in task_numa_work() +- sched/numa: Fix the potential null pointer dereference in task_numa_work() +- !13300 ima: fix a compilation error with ima_bprm_creds_for_exec() +- ima: fix a compilation error with ima_bprm_creds_for_exec() +- !13298 bpf, arm64: Fix address emission with tag-based KASAN enabled +- bpf, arm64: Fix address emission with tag-based KASAN enabled +- !13275 CVE-2024-46698 +- firmware: sysfb: Fix reference count of sysfb parent device +- firmware/sysfb: fix an error code in sysfb_init() +- video/aperture: optionally match the device in sysfb_disable() +- firmware/sysfb: Create firmware device only for enabled PCI devices +- firmware/sysfb: Set firmware-framebuffer parent device +- of/platform: Disable sysfb if a simple-framebuffer node is found + +* Tue Nov 19 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-55.0.0.59 +- !13235 nvmet-auth: assign dh_key to NULL after kfree_sensitive +- nvmet-auth: assign dh_key to NULL after kfree_sensitive +- !9157 [OLK-6.6] cpufreq: ACPI: add ITMT support when CPPC enabled +- Set ASYM_PACKING Flag on Zhaoxin KH-40000 platform +- cpufreq: ACPI: add ITMT support when CPPC enabled +- !13287 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.60-6.6.61 LTS Patches +- vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans +- hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer +- ASoC: amd: yc: fix internal mic on Xiaomi Book Pro 14 2022 +- ucounts: fix counter leak in inc_rlimit_get_ucounts() +- ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() +- irqchip/gic-v3: Force propagation of the active state with a read-back +- USB: serial: option: add Quectel RG650V +- USB: serial: option: add Fibocom FG132 0x0112 composition +- USB: serial: qcserial: add support for Sierra Wireless EM86xx +- USB: serial: io_edgeport: fix use after free in debug printk +- usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() +- usb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier +- usb: dwc3: fix fault at system suspend if device was already runtime suspended +- usb: musb: sunxi: Fix accessing an released usb phy +- signal: restore the override_rlimit logic +- fs/proc: fix compile warning about variable 'vmcore_mmap_ops' +- i2c: designware: do not hold SCL low when I2C_DYNAMIC_TAR_UPDATE is not set +- filemap: Fix bounds checking in filemap_read() +- media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format +- Revert "selftests/bpf: Implement get_hw_ring_size function to retrieve current and max interface size" +- Revert "wifi: mac80211: fix RCU list iterations" +- btrfs: reinitialize delayed ref list after deleting it from the list +- arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint +- arm64: Kconfig: Make SME depend on BROKEN for now +- arm64/sve: Discard stale CPU state when handling SVE traps +- mptcp: use sock_kfree_s instead of kfree +- net: vertexcom: mse102x: Fix possible double free of TX skb +- net: wwan: t7xx: Fix off-by-one error in t7xx_dpmaif_rx_buf_alloc() +- nfs: Fix KMSAN warning in decode_getfattr_attrs() +- ALSA: usb-audio: Add quirk for HP 320 FHD Webcam +- dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow +- dm cache: fix potential out-of-bounds access on the first resume +- dm cache: optimize dirty bit checking with find_next_bit when resizing +- dm cache: fix out-of-bounds access to the dirty bitset when resizing +- dm cache: fix flushing uninitialized delayed_work on cache_ctr error +- dm cache: correct the number of origin blocks to match the target length +- thermal/drivers/qcom/lmh: Remove false lockdep backtrace +- drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported +- drm/amdgpu: Fix DPX valid mode check on GC 9.4.3 +- drm/amdgpu: Adjust debugfs register access permissions +- drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() +- drm/amdgpu: Adjust debugfs eviction and IB access permissions +- rpmsg: glink: Handle rejected intent request better +- pwm: imx-tpm: Use correct MODULO value for EPWM mode +- ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp +- ksmbd: Fix the missing xa_store error check +- ksmbd: check outstanding simultaneous SMB operations +- ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create +- can: mcp251xfd: mcp251xfd_ring_alloc(): fix coalescing configuration when switching CAN modes +- can: mcp251xfd: mcp251xfd_get_tef_len(): fix length calculation +- can: m_can: m_can_close(): don't call free_irq() for IRQ-less devices +- media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl() +- media: v4l2-tpg: prevent the risk of a division by zero +- media: pulse8-cec: fix data timestamp at pulse8_setup() +- media: cx24116: prevent overflows on SNR calculus +- media: s5p-jpeg: prevent buffer overflows +- media: ar0521: don't overflow when checking PLL values +- ASoC: SOF: sof-client-probes-ipc4: Set param_size extension bits +- ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove +- thermal/of: support thermal zones w/o trips subnode +- tools/lib/thermal: Fix sampling handler context ptr +- ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init() +- scsi: sd_zbc: Use kvzalloc() to allocate REPORT ZONES buffer +- media: adv7604: prevent underflow condition when reporting colorspace +- media: dvb_frontend: don't play tricks with underflow values +- media: dvbdev: prevent the risk of out of memory access +- media: stb0899_algo: initialize cfr before using it +- Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown" +- drivers: net: ionic: add missed debugfs cleanup to ionic_probe() error path +- rxrpc: Fix missing locking causing hanging calls +- net: arc: rockchip: fix emac mdio node support +- net: arc: fix the device for dma_map_single/dma_unmap_single +- virtio_net: Add hash_key_length check +- netfilter: nf_tables: wait for rcu grace period on net_device removal +- netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx +- netfilter: nf_tables: cleanup documentation +- net: stmmac: Fix unbalanced IRQ wake disable warning on single irq case +- net: phy: ti: add PHY_RST_AFTER_CLK_EN flag +- net: hns3: fix kernel crash when uninstalling driver +- e1000e: Remove Meteor Lake SMBUS workarounds +- i40e: fix race condition by adding filter's intermediate sync state +- ice: change q_index variable type to s16 to store -1 value +- can: c_can: fix {rx,tx}_errors statistics +- net: enetc: allocate vf_state during PF probes +- sctp: properly validate chunk size in sctp_sf_ootb() +- dt-bindings: net: xlnx,axi-ethernet: Correct phy-mode property value +- net: enetc: set MAC address to the VF net_device +- regulator: rtq2208: Fix uninitialized use of regulator_config +- nfs: avoid i_lock contention in nfs_clear_invalid_mapping +- NFSv3: only use NFS timeout for MOUNT when protocols are compatible +- sunrpc: handle -ENOTCONN in xs_tcp_setup_socket() +- platform/x86/amd/pmc: Detect when STB is not available +- HID: core: zero-initialize the report buffer +- arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes +- ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin +- ARM: dts: rockchip: Fix the spi controller on rk3036 +- ARM: dts: rockchip: drop grf reference from rk3036 hdmi +- ARM: dts: rockchip: fix rk3036 acodec node +- arm64: dts: rockchip: remove orphaned pinctrl-names from pinephone pro +- firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() +- arm64: dts: imx8mp: correct sdhc ipg clk +- arm64: dts: imx8-ss-vpu: Fix imx8qm VPU IRQs +- arm64: dts: imx8qxp: Add VPU subsystem file +- arm64: dts: rockchip: remove num-slots property from rk3328-nanopi-r2s-plus +- arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc +- arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion +- arm64: dts: rockchip: Remove undocumented supports-emmc property +- arm64: dts: rockchip: Add DTS for FriendlyARM NanoPi R2S Plus +- arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards +- arm64: dts: rockchip: Fix bluetooth properties on rk3566 box demo +- arm64: dts: rockchip: fix i2c2 pinctrl-names property on anbernic-rg353p/v +- arm64: dts: rockchip: Fix reset-gpios property on brcm BT nodes +- arm64: dts: rockchip: Fix wakeup prop names on PineNote BT node +- arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328 +- arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator +- arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-eaidk-610 +- !13269 Revert "Loongarch: Dynamic enable writecombine" +- Revert "Loongarch: Dynamic enable writecombine" +- !13193 fix CVE-2024-50115 +- KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory +- !13179 bpf: Use raw_spinlock_t in ringbuf +- bpf: Use raw_spinlock_t in ringbuf +- !13263 bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error +- bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error +- !12249 Bluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush() +- Bluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush() +- !13259 v2 mm, mmap: limit THP alignment of anonymous mappings to PMD-aligned sizes +- mm: enable PMD anouymous mapping by default +- mm, mmap: limit THP alignment of anonymous mappings to PMD-aligned sizes +- !13215 fork: do not expose incomplete mm on fork +- fork: only invoke khugepaged, ksm hooks if no error +- fork: do not invoke uffd on fork if error occurs +- mm/ksm: remove redundant code in ksm_fork +- !13047 virtcca feature :SM Cryptographic Acceleration +- virtcca feature : SM Cryptographic Aacceleration. +- !13210 Script execution control +- fix kabi breakage due to exec is_check +- IMA support script execution check +- exec: Add a new AT_CHECK flag to execveat(2) +- uselib: remove use of __FMODE_EXEC +- exec: Check __FMODE_EXEC instead of in_execve for LSMs +- execve: open the executable file before doing anything else +- !13257 IMA RoT +- ima: rot: Adapt VirtCCA into Rot +- ima: Rename ima_cvm to ima_virtcca +- ima: rot: Make RoT kick in +- ima: rot: Prepare TPM as an RoT +- ima: rot: Introduce basic framework +- !13240 virtcca feature: support transfer smmu_vmid to tmm +- virtcca feature : transfer smmu_vmid +- !13244 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.59-6.6.60 LTS Patches +- fs/ntfs3: Sequential field availability check in mi_enum_attr() +- ASoC: SOF: ipc4-control: Add support for ALSA enum control +- ASoC: SOF: ipc4-control: Add support for ALSA switch control +- ASoC: SOF: ipc4-topology: Add definition for generic switch/enum control +- SUNRPC: Remove BUG_ON call sites +- mtd: spi-nor: winbond: fix w25q128 regression +- wifi: iwlwifi: mvm: fix 6 GHz scan construction +- nilfs2: fix kernel bug due to missing clearing of checked flag +- wifi: mac80211: fix NULL dereference at band check in starting tx ba session +- arm64: dts: imx8ulp: correct the flexspi compatible string +- vmscan,migrate: fix page count imbalance on node stats when demoting pages +- io_uring/rw: fix missing NOWAIT check for O_DIRECT start write +- kasan: remove vmalloc_percpu test +- nvmet-auth: assign dh_key to NULL after kfree_sensitive +- ALSA: hda/realtek: Fix headset mic on TUXEDO Stellaris 16 Gen6 mb1 +- ALSA: hda/realtek: Fix headset mic on TUXEDO Gemini 17 Gen3 +- xfs: fix finding a last resort AG in xfs_filestream_pick_ag +- mctp i2c: handle NULL header address +- ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow +- x86/traps: move kmsan check after instrumentation_begin +- x86/traps: Enable UBSAN traps on x86 +- mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves +- mei: use kvmalloc for read buffer +- mptcp: init: protect sched with rcu_read_lock +- iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP +- cxl/acpi: Ensure ports ready at cxl_acpi_probe() return +- cxl/port: Fix cxl_bus_rescan() vs bus_rescan_devices() +- riscv: Remove duplicated GET_RM +- riscv: Remove unused GENERATING_ASM_OFFSETS +- riscv: Use '%u' to format the output of 'cpu' +- riscv: efi: Set NX compat flag in PE/COFF header +- ALSA: hda/realtek: Limit internal Mic boost on Dell platform +- Input: edt-ft5x06 - fix regmap leak when probe fails +- riscv: vdso: Prevent the compiler from inserting calls to memset() +- spi: spi-fsl-dspi: Fix crash when not using GPIO chip select +- phy: freescale: imx8m-pcie: Do CMN_RST just before PHY PLL lock check +- block: fix sanity checks in blk_rq_map_user_bvec +- mmc: sdhci-pci-gli: GL9767: Fix low power mode in the SD Express process +- mmc: sdhci-pci-gli: GL9767: Fix low power mode on the set clock function +- cxl/port: Fix use-after-free, permit out-of-order decoder shutdown +- thunderbolt: Honor TMU requirements in the domain when setting TMU mode +- tools/mm: -Werror fixes in page-types/slabinfo +- mm: shmem: fix data-race in shmem_getattr() +- RISC-V: ACPI: fix early_ioremap to early_memremap +- nilfs2: fix potential deadlock with newly created symlinks +- iio: light: veml6030: fix microlux value calculation +- iio: gts-helper: Fix memory leaks in iio_gts_build_avail_scale_table() +- iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table() +- iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr() +- staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg() +- wifi: iwlegacy: Clear stale interrupts before resuming device +- wifi: cfg80211: clear wdev->cqm_config pointer on free +- wifi: ath10k: Fix memory leak in management tx +- wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower +- Revert "selftests/mm: replace atomic_bool with pthread_barrier_t" +- Revert "selftests/mm: fix deadlock for fork after pthread_create on ARM" +- Revert "driver core: Fix uevent_show() vs driver detach race" +- xhci: Use pm_runtime_get to prevent RPM on unsupported systems +- phy: qcom: qmp-usb-legacy: fix NULL-deref on runtime suspend +- phy: qcom: qmp-usb: fix NULL-deref on runtime suspend +- usb: typec: qcom-pmic-typec: use fwnode_handle_put() to release fwnodes +- usb: typec: fix unreleased fwnode_handle in typec_port_register_altmodes() +- usb: phy: Fix API devm_usb_put_phy() can not release the phy +- usbip: tools: Fix detach_port() invalid port error path +- ALSA: usb-audio: Add quirks for Dell WD19 dock +- USB: gadget: dummy-hcd: Fix "task hung" problem +- usb: gadget: dummy_hcd: execute hrtimer callback in softirq context +- usb: gadget: dummy_hcd: Set transfer interval to 1 microframe +- usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler +- misc: sgi-gru: Don't disable preemption in GRU driver +- NFS: remove revoked delegation from server's delegation list +- net: amd: mvme147: Fix probe banner message +- thermal: intel: int340x: processor: Add MMIO RAPL PL4 support +- thermal: intel: int340x: processor: Remove MMIO RAPL CPU hotplug support +- cifs: Fix creating native symlinks pointing to current or parent directory +- cifs: Improve creating native symlinks pointing to directory +- scsi: scsi_transport_fc: Allow setting rport state to current state +- fs/ntfs3: Additional check in ntfs_file_release +- fs/ntfs3: Fix general protection fault in run_is_mapped_full +- fs/ntfs3: Additional check in ni_clear() +- fs/ntfs3: Fix possible deadlock in mi_read +- fs/ntfs3: Add rough attr alloc_size check +- fs/ntfs3: Stale inode instead of bad +- fs/ntfs3: Fix warning possible deadlock in ntfs_set_state +- fs/ntfs3: Check if more than chunk-size bytes are written +- ntfs3: Add bounds checking to mi_enum_attr() +- cxl/events: Fix Trace DRAM Event Record +- smb: client: set correct device number on nfs reparse points +- ACPI: CPPC: Make rmw_lock a raw_spin_lock +- afs: Fix missing subdir edit when renamed between parent dirs +- afs: Automatically generate trace tag enums +- kasan: Fix Software Tag-Based KASAN with GCC +- iomap: turn iomap_want_unshare_iter into an inline function +- fsdax: dax_unshare_iter needs to copy entire blocks +- fsdax: remove zeroing code from dax_unshare_iter +- iomap: share iomap_unshare_iter predicate code with fsdax +- iomap: don't bother unsharing delalloc extents +- iomap: improve shared block detection in iomap_unshare_iter +- bpf, test_run: Fix LIVE_FRAME frame update after a page has been recycled +- netfilter: nft_payload: sanitize offset and length before calling skb_checksum() +- mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address +- mlxsw: spectrum_ptp: Add missing verification before pushing Tx header +- net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension +- Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs +- netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() +- netfilter: Fix use-after-free in get_info() +- net: fix crash when config small gso_max_size/gso_ipv4_max_size +- bpf: Fix out-of-bounds write in trie_get_next_key() +- netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() +- bpf: Force checkpoint when jmp history is too long +- selftests/bpf: Add bpf_percpu_obj_{new,drop}() macro in bpf_experimental.h +- net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT +- gtp: allow -1 to be specified as file description from userspace +- ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() +- net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data +- net: stmmac: dwmac4: Fix high address display by updating reg_space[] from register values +- macsec: Fix use-after-free while sending the offloading packet +- ASoC: cs42l51: Fix some error handling paths in cs42l51_probe() +- wifi: iwlwifi: mvm: don't add default link in fw restart flow +- wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() +- wifi: iwlwifi: mvm: disconnect station vifs if recovery failed +- RDMA/bnxt_re: synchronize the qp-handle table array +- RDMA/bnxt_re: Fix the usage of control path spin locks +- RDMA/mlx5: Round max_rd_atomic/max_dest_rd_atomic up instead of down +- RDMA/cxgb4: Dump vendor specific QP details +- wifi: brcm80211: BRCM_TRACING should depend on TRACING +- wifi: ath11k: Fix invalid ring usage in full monitor mode +- wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys +- mac80211: MAC80211_MESSAGE_TRACING should depend on TRACING +- wifi: iwlegacy: Fix "field-spanning write" warning in il_enqueue_hcmd() +- spi: geni-qcom: Fix boot warning related to pm_runtime and devres +- cgroup: Fix potential overflow issue when checking max_depth +- Input: xpad - add support for 8BitDo Ultimate 2C Wireless Controller +- Input: xpad - sort xpad_device by vendor and product ID +- thermal: core: Free tzp copy along with the thermal zone +- thermal: core: Rework thermal zone availability check +- thermal: core: Make thermal_zone_device_unregister() return after freeing the zone +- !9721 drm: vc4: Fix possible null pointer dereference +- drm: vc4: Fix possible null pointer dereference +- !12376 wifi: mac80211: fix NULL dereference at band check in starting tx ba session +- wifi: mac80211: fix NULL dereference at band check in starting tx ba session +- !13140 CVE-2024-50056 +- usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c +- usb: gadget: uvc: fix try format returns on uncompressed formats +- !13180 Add objtool, orc and livepatch support for LoongArch +- LoongArch: Update Loongson-3 default config file +- compiler.h: specify correct attribute for .rodata..c_jump_table +- LoongArch: Set AS_HAS_THIN_ADD_SUB as y if AS_IS_LLVM +- LoongArch: Enable objtool for Clang +- objtool: Handle frame pointer related instructions +- LoongArch: Add ifdefs to fix LSX and LASX related warnings +- LoongArch: Only allow OBJTOOL & ORC unwinder if toolchain supports -mthin-add-sub +- LoongArch: Add kernel livepatching support +- LoongArch: Fix definition of ftrace_regs_set_instruction_pointer() +- LoongArch: Add ORC stack unwinder support +- objtool: Check local label in read_unwind_hints() +- objtool: Check local label in add_dead_ends() +- objtool/LoongArch: Enable orc to be built +- objtool/x86: Separate arch-specific and generic parts +- objtool/LoongArch: Implement instruction decoder +- objtool/LoongArch: Enable objtool to be built +- !13131 [OLK-6.6][Backport] exec: don't WARN for racy path_noexec check +- exec: don't WARN for racy path_noexec check +- Revert "exec: Remove redundant check in do_open_execat/uselib" +- !13192 net/ncsi: Disable the ncsi work before freeing the associated structure +- net/ncsi: Disable the ncsi work before freeing the associated structure +- !13079 serial: core: Fix atomicity violation in uart_tiocmget +- serial: core: Fix atomicity violation in uart_tiocmget +- !13074 selinux: clarify return code in filename_trans_read_helper_compat() +- selinux: clarify return code in filename_trans_read_helper_compat() +- !12431 [olk 6.6] net: hibmcge: add support for hibmcge driver +- net: hibmcge: Add maintainer for hibmcge +- net: hns3/hns: Update the maintainer for the HNS3/HNS ethernet driver +- net: hibmcge: Add a Makefile and update Kconfig for hibmcge +- net: hibmcge: Implement some ethtool_ops functions +- net: hibmcge: Implement rx_poll function to receive packets +- net: hibmcge: Implement .ndo_start_xmit function +- net: hibmcge: Implement some .ndo functions +- net: hibmcge: Add interrupt supported in this module +- net: hibmcge: Add mdio and hardware configuration supported in this module +- net: hibmcge: Add read/write registers supported through the bar space +- net: hibmcge: Add pci table supported in this module +- !13189 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.58-6.6.59 LTS Patches +- xfrm: validate new SA's prefixlen using SA family when sel.family is unset +- RDMA/bnxt_re: Fix unconditional fence for newer adapters +- RDMA/bnxt_re: Avoid creating fence MR for newer adapters +- RDMA/bnxt_re: Fix the offset for GenP7 adapters for user applications +- ACPI: PRM: Clean up guid type in struct prm_handler_info +- platform/x86: dell-wmi: Ignore suspend notifications +- ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe() +- ata: libata: Set DID_TIME_OUT for commands that actually timed out +- net: phy: dp83822: Fix reset pin definitions +- selinux: improve error checking in sel_write_load() +- drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too +- hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event +- xfrm: fix one more kernel-infoleak in algo dumping +- LoongArch: Make KASAN usable for variable cpu_vabits +- LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context +- LoongArch: Get correct cores_per_package for SMT systems +- ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593 +- ALSA: hda/tas2781: select CRC32 instead of CRC32_SARWATE +- x86/lam: Disable ADDRESS_MASKING in most cases +- KVM: arm64: Don't eagerly teardown the vgic on init error +- KVM: arm64: Fix shift-out-of-bounds bug +- KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory +- openat2: explicitly return -E2BIG for (usize > PAGE_SIZE) +- nilfs2: fix kernel bug due to missing clearing of buffer delay flag +- ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue +- ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context +- ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[] +- drm/amd: Guard against bad data for ATIF ACPI method +- btrfs: zoned: fix zone unusable accounting for freed reserved extent +- btrfs: fix passing 0 to ERR_PTR in btrfs_search_dir_index_item() +- cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception +- cpufreq/cppc: Move and rename cppc_cpufreq_{perf_to_khz|khz_to_perf}() +- ALSA: hda/realtek: Update default depop procedure +- powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request() +- ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() +- ASoC: fsl_micfil: Add a flag to distinguish with different volume control types +- ASoC: rsnd: Fix probe failure on HiHope boards due to endpoint parsing +- ASoC: max98388: Fix missing increment of variable slot_found +- ASoC: loongson: Fix component check failed on FDT systems +- ASoC: dt-bindings: davinci-mcasp: Fix interrupt properties +- ASoC: dt-bindings: davinci-mcasp: Fix interrupts property +- net: dsa: mv88e6xxx: support 4000ps cycle counter period +- net: dsa: mv88e6xxx: read cycle counter period from hardware +- net: dsa: mv88e6xxx: group cycle counter coefficients +- bpf,perf: Fix perf_event_detach_bpf_prog error handling +- Bluetooth: ISO: Fix UAF on iso_sock_timeout +- Bluetooth: SCO: Fix UAF on sco_sock_timeout +- posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() +- r8169: avoid unsolicited interrupts +- net: sched: use RCU read-side critical section in taprio_dump() +- net: sched: fix use-after-free in taprio_change() +- net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers +- bpf: Simplify checking size of helper accesses +- net: usb: usbnet: fix name regression +- net: fix races in netdev_tx_sent_queue()/dev_watchdog() +- net/sched: adjust device watchdog timer to detect stopped queue at right time +- net: wwan: fix global oob in wwan_rtnl_policy +- netfilter: xtables: fix typo causing some targets not to load on IPv6 +- fsl/fman: Fix refcount handling of fman-related devices +- fsl/fman: Save device references taken in mac_probe() +- net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x +- net: plip: fix break; causing plip to never transmit +- be2net: fix potential memory leak in be_xmit() +- net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() +- netfilter: bpf: must hold reference on net namespace +- xfrm: respect ip protocols rules criteria when performing dst lookups +- xfrm: extract dst lookup parameters into a struct +- tracing/probes: Fix MAX_TRACE_ARGS limit handling +- jfs: Fix sanity check in dbMount +- LoongArch: Don't crash in stack_top() for tasks without vDSO +- platform/x86: dell-sysman: add support for alienware products +- cifs: Validate content of NFS reparse point buffer +- ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string +- udf: fix uninit-value use in udf_get_fileshortad +- udf: refactor inode_bmap() to handle error +- udf: refactor udf_next_aext() to handle error +- udf: refactor udf_current_aext() to handle error +- arm64: Force position-independent veneers +- ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit +- ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to default regs values +- ASoC: amd: yc: Add quirk for HP Dragonfly pro one +- drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA +- tracing/probes: cleanup: Set trace_probe::nr_args at trace_probe_init +- tracing/fprobe-event: cleanup: Fix a wrong comment in fprobe event +- usb: dwc3: core: Fix system suspend on TI AM62 platforms +- XHCI: Separate PORT and CAPs macros into dedicated file +- usb: gadget: f_uac2: fix return value for UAC2_ATTRIBUTE_STRING store +- usb: gadget: f_uac2: fix non-newline-terminated function name +- usb: gadget: f_uac2: Replace snprintf() with the safer scnprintf() variant +- xhci: dbc: honor usb transfer size boundaries. +- xhci: dbgtty: use kfifo from tty_port struct +- xhci: dbgtty: remove kfifo_out() wrapper +- iio: adc: ti-lmp92064: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig +- cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed() +- bpf: Fix iter/task tid filtering +- nvme-pci: fix race condition between reset and nvme_dev_disable() +- nvme-pci: set doorbell config before unquiescing +- riscv, bpf: Make BPF_CMPXCHG fully ordered +- bpf, vsock: Drop static vsock_bpf_prot initialization +- vsock: Update msg_count on read_skb() +- vsock: Update rx_bytes on read_skb() +- bpf, sockmap: SK_DROP on attempted redirects of unsupported af_vsock +- net/mlx5: Unregister notifier on eswitch init failure +- net/mlx5: Fix command bitmask initialization +- net/mlx5: Check for invalid vector index on EQ creation +- vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame +- Bluetooth: bnep: fix wild-memory-access in proto_unregister +- bpf: Fix link info netfilter flags to populate defrag flag +- s390: Initialize psw mask in perf_arch_fetch_caller_regs() +- usb: typec: altmode should keep reference to parent +- smb: client: fix OOBs when building SMB2_IOCTL request +- scsi: target: core: Fix null-ptr-deref in target_alloc_device() +- net: ravb: Only advertise Rx/Tx timestamps if hardware supports it +- ravb: Remove setting of RX software timestamp +- genetlink: hold RCU in genlmsg_mcast() +- net: dsa: mv88e6xxx: Fix the max_vid definition for the MV88E6361 +- tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). +- net: bcmasp: fix potential memory leak in bcmasp_xmit() +- drm/msm/dpu: don't always program merge_3d block +- irqchip/renesas-rzg2l: Fix missing put_device +- irqchip/renesas-rzg2l: Add support for suspend to RAM +- irqchip/renesas-rzg2l: Document structure members +- irqchip/renesas-rzg2l: Align struct member names to tabs +- net: systemport: fix potential memory leak in bcm_sysport_xmit() +- bpf: Fix truncation bug in coerce_reg_to_size_sx() +- net: xilinx: axienet: fix potential memory leak in axienet_start_xmit() +- net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid +- net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() +- netdevsim: use cond_resched() in nsim_dev_trap_report_work() +- macsec: don't increment counters for an unrelated SA +- drm/amd/amdgpu: Fix double unlock in amdgpu_mes_add_ring +- octeontx2-af: Fix potential integer overflows on integer shifts +- net: stmmac: dwmac-tegra: Fix link bring-up sequence +- net: usb: usbnet: fix race in probe failure +- net/smc: Fix memory leak when using percpu refs +- firmware: arm_scmi: Queue in scmi layer for mailbox implementation +- drm/msm: Allocate memory for disp snapshot with kvzalloc() +- drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation +- drm/msm/dsi: improve/fix dsc pclk calculation +- drm/msm/dpu: check for overflow in _dpu_crtc_setup_lm_bounds() +- drm/msm/dpu: make sure phys resources are properly initialized +- accel/qaic: Fix the for loop used to walk SG table +- RDMA/bnxt_re: Fix the GID table length +- RDMA/bnxt_re: Update the BAR offsets +- RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages +- RDMA/bnxt_re: Return more meaningful error +- RDMA/bnxt_re: Fix out of bound check +- RDMA/bnxt_re: Fix the max CQ WQEs for older adapters +- RDMA/bnxt_re: Support new 5760X P7 devices +- ipv4: give an IPv4 dev to blackhole_netdev +- RDMA/srpt: Make slab cache names unique +- RDMA/irdma: Fix misspelling of "accept*" +- RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP +- firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup() +- ALSA: hda/cs8409: Fix possible NULL dereference +- selftests/bpf: Fix cross-compiling urandom_read +- drm/vmwgfx: Handle possible ENOMEM in vmw_stdu_connector_atomic_check +- iio: frequency: admv4420: fix missing select REMAP_SPI in Kconfig +- iio: frequency: {admv4420,adrf6780}: format Kconfig entries +- bpf: fix kfunc btf caching for modules +- s390/pci: Handle PCI error codes other than 0x3a +- selftests/bpf: fix perf_event link info name_len assertion +- selftests/bpf: Add cookies check for perf_event fill_link_info test +- selftests/bpf: Use bpf_link__destroy in fill_link_info tests +- ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin +- RDMA/core: Fix ENODEV error for iWARP test over vlan +- RDMA/bnxt_re: Add a check for memory allocation +- RDMA/bnxt_re: Fix incorrect AVID type in WQE structure +- RDMA/bnxt_re: Fix a possible memory leak +- bpf: Fix memory leak in bpf_core_apply +- lib/Kconfig.debug: fix grammar in RUST_BUILD_ASSERT_ALLOW +- cpufreq/amd-pstate: Fix amd_pstate mode switch on shared memory systems +- bpf: devmap: provide rxq after redirect +- bpf: Make sure internal and UAPI bpf_redirect flags don't overlap +- iio: accel: bma400: Fix uninitialized variable field_value in tap event handling. + +* Wed Nov 13 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-54.0.0.58 +- !12859 intel: backport GNR and SRF intel_idle fix for 6.6 +- intel_idle: fix ACPI _CST matching for newer Xeon platforms +- intel_idle: add Granite Rapids Xeon support +- !13172 sched: smart_grid: Prevent double-free in sched_grid_qos_free +- sched: smart_grid: Prevent double-free in sched_grid_qos_free +- !13181 drm/msm: Avoid NULL dereference in msm_disp_state_print_regs() +- drm/msm: Avoid NULL dereference in msm_disp_state_print_regs() +- !13161 Some patches of RDMA from Linux to olk-6.6 +- RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() +- RDMA/hns: Fix out-of-order issue of requester when setting FENCE +- !13133 CVE-2024-50145 +- octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx() +- octeon_ep: Implement helper for iterating packets in Rx queue +- !13142 tracing: Consider the NULL character when validating the event length +- tracing: Consider the NULL character when validating the event length +- !13137 drm/amd/display: Check null pointers before multiple uses +- drm/amd/display: Check null pointers before multiple uses +- !13120 smb: client: fix possible double free in smb2_set_ea() +- smb: client: fix possible double free in smb2_set_ea() +- !13096 Update ASPM sysfs on MFD function removal to avoid use-after-free +- PCI/ASPM: Update ASPM sysfs on MFD function removal to avoid use-after-free +- !12877 Revert "LoongArch: Add workaround for 3C6000 about io wr/rd" +- Revert "LoongArch: Add workaround for 3C6000 about io wr/rd" +- !12886 LoongArch: disable cpufreq driver +- LoongArch: disable cpufreq driver +- cpufreq: loongson3-acpi: Initialize scaling_cur_freq correctly +- !12840 drm/loongson: use old version of ast driver for LoongArch platform +- drm/loongson: use old version of ast driver for LoongArch platform +- !12496 LoongArch: add loongson SE support +- LoongArch: add loongson SE SDF support +- dt-bindings: security: add loongson_se +- !12492 LoongArch: Add AVEC irqchip support +- LoongArch: Add AVEC irqchip support +- !13111 MPTCP Upstream part 20 +- mptcp: drop lookup_by_id in lookup_addr +- mptcp: set error messages for set_flags +- mptcp: update set_flags interfaces +- mptcp: drop duplicate header inclusions +- !13110 MPTCP Upstream part 19 +- selftests: mptcp: add token for get_addr +- mptcp: get addr in userspace pm list +- mptcp: implement mptcp_userspace_pm_get_addr +- mptcp: add userspace_pm_lookup_addr_by_id helper +- !13115 smb: client: Handle kstrdup failures for passwords +- smb: client: Handle kstrdup failures for passwords +- !13130 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.57-6.6.58 LTS Patches +- ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne 1000 G2 +- nilfs2: propagate directory read errors from nilfs_find_entry() +- serial: qcom-geni: fix receiver enable +- serial: qcom-geni: fix dma rx cancellation +- serial: qcom-geni: revert broken hibernation support +- serial: qcom-geni: fix polled console initialisation +- irqchip/sifive-plic: Unmask interrupt in plic_irq_enable() +- pinctrl: apple: check devm_kasprintf() returned value +- pinctrl: ocelot: fix system hang on level based interrupts +- x86/entry_32: Clear CPU buffers after register restore in NMI return +- x86/entry_32: Do not clobber user EFLAGS.ZF +- x86/CPU/AMD: Only apply Zenbleed fix for Zen2 during late microcode load +- x86/apic: Always explicitly disarm TSC-deadline timer +- x86/resctrl: Annotate get_mem_config() functions as __init +- serial: imx: Update mctrl old_status on RTSD interrupt +- misc: microchip: pci1xxxx: add support for NVMEM_DEVID_AUTO for OTP device +- misc: microchip: pci1xxxx: add support for NVMEM_DEVID_AUTO for EEPROM device +- usb: dwc3: Wait for EndXfer completion before restoring GUSB2PHYCFG +- usb: typec: qcom-pmic-typec: fix sink status being overwritten with RP_DEF +- USB: serial: option: add Telit FN920C04 MBIM compositions +- USB: serial: option: add support for Quectel EG916Q-GL +- xhci: Mitigate failed set dequeue pointer commands +- xhci: Fix incorrect stream context type macro +- xhci: tegra: fix checked USB2 port number +- Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 +- Bluetooth: Remove debugfs directory on module init failure +- Bluetooth: Call iso_exit() on module unload +- iio: accel: kx022a: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig +- iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig +- iio: adc: ti-lmp92064: add missing select REGMAP_SPI in Kconfig +- iio: dac: ad3552r: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig +- iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig +- iio: dac: ad5766: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig +- iio: light: bu27008: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig +- iio: frequency: adf4377: add missing select REMAP_SPI in Kconfig +- iio: amplifiers: ada4250: add missing select REGMAP_SPI in Kconfig +- iio: light: opt3001: add missing full-scale range value +- iio: light: veml6030: fix IIO device retrieval from embedded device +- iio: light: veml6030: fix ALS sensor resolution +- iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() +- iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig +- iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig +- iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig +- iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig +- drm/amdgpu: prevent BO_HANDLES error from being overwritten +- drm/amdgpu/swsmu: Only force workload setup on init +- drm/vmwgfx: Handle surface check failure correctly +- drm/radeon: Fix encoder->possible_clones +- scsi: ufs: core: Fix the issue of ICU failure +- scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down +- Input: xpad - add support for MSI Claw A1M +- selftest: hid: add the missing tests directory +- ublk: don't allow user copy for unprivileged device +- io_uring/sqpoll: close race on waiting for sqring entries +- x86/bugs: Do not use UNTRAIN_RET with IBPB on entry +- x86/bugs: Skip RSB fill at VMEXIT +- x86/entry: Have entry_ibpb() invalidate return predictions +- x86/cpufeatures: Add a IBPB_NO_RET BUG flag +- x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET +- KVM: s390: Change virtual to physical address access in diag 0x258 handler +- KVM: s390: gaccess: Check if guest address is in memslot +- s390/sclp_vt220: Convert newlines to CRLF instead of LFCR +- s390/sclp: Deactivate sclp after all its users +- iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices +- mptcp: prevent MPC handshake on port-based signal endpoints +- net: fec: Remove duplicated code +- net: fec: Move `fec_ptp_read()` to the top of the file +- xfs: restrict when we try to align cow fork delalloc to cowextsz hints +- xfs: allow unlinked symlinks and dirs with zero size +- xfs: fix freeing speculative preallocations for preallocated files +- xfs: make sure sb_fdblocks is non-negative +- xfs: allow symlinks with short remote targets +- xfs: use dontcache for grabbing inodes during scrub +- xfs: revert commit 44af6c7e59b12 +- xfs: enforce one namespace per attribute +- xfs: validate recovered name buffers when recovering xattr items +- xfs: check shortform attr entry flags specifically +- xfs: fix missing check for invalid attr flags +- xfs: check opcode and iovec count match in xlog_recover_attri_commit_pass2 +- xfs: require XFS_SB_FEAT_INCOMPAT_LOG_XATTRS for attr log intent item recovery +- xfs: remove a racy if_bytes check in xfs_reflink_end_cow_extent +- xfs: fix xfs_bmap_add_extent_delay_real for partial conversions +- xfs: fix error returns from xfs_bmapi_write +- mm/mglru: only clear kswapd_failures if reclaimable +- selftests/mm: fix deadlock for fork after pthread_create on ARM +- selftests/mm: replace atomic_bool with pthread_barrier_t +- fat: fix uninitialized variable +- net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-link PHY +- arm64: probes: Fix uprobes for big-endian kernels +- arm64: probes: Fix simulate_ldr*_literal() +- arm64: probes: Remove broken LDR (literal) uprobe support +- posix-clock: Fix missing timespec64 check in pc_clock_settime() +- net: enetc: add missing static descriptor and inline keyword +- net: enetc: disable NAPI after all rings are disabled +- net: enetc: disable Tx BD rings after they are empty +- net: enetc: block concurrent XDP transmissions during ring reconfiguration +- net: enetc: remove xdp_drops statistic from enetc_xdp_drop() +- mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow +- ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2 +- ksmbd: fix user-after-free from session log off +- !13122 fs: 6.6 performance improve patches +- mm/rmap: minimize folio->_nr_pages_mapped updates when batching PTE (un)mapping +- mm: batch unlink_file_vma calls in free_pgd_range +- maple_tree: remove rcu_read_lock() from mt_validate() +- fs: rearrange general fastpath check now that O_CREAT uses it +- fs: remove audit dummy context check +- fs: pull up trailing slashes check for O_CREAT +- fs: move audit parent inode +- fs: try an opportunistic lookup for O_CREAT opens too +- fs/file.c: remove sanity_check and add likely/unlikely in alloc_fd() +- fs/file.c: add fast path in find_next_fd() +- !13092 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.55-6.6.57 LTS Patches +- e1000e: fix force smbus during suspend flow +- net: ethernet: cortina: Restore TSO support +- secretmem: disable memfd_secret() if arch cannot set direct map +- fs/proc/kcore.c: allow translation of physical memory addresses +- btrfs: split remaining space to discard in chunks +- selftests/rseq: Fix mm_cid test failure +- selftests/mm: fix incorrect buffer->mirror size in hmm2 double_map test +- powercap: intel_rapl_tpmi: Fix bogus register reading +- nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error +- mptcp: pm: do not remove closing subflows +- mptcp: handle consistently DSS corruption +- net: phy: Remove LED entry from LEDs list on unregister +- net: dsa: lan9303: ensure chip reset and wait for READY status +- net: Fix an unsafe loop on the list +- net: explicitly clear the sk pointer, when pf->create fails +- ata: libata: avoid superfluous disk spin down + spin up during hibernation +- mptcp: fallback when MPTCP opts are dropped after 1st data +- scsi: ufs: Use pre-calculated offsets in ufshcd_init_lrb() +- drm/i915/hdcp: fix connector refcounting +- drm/vc4: Stop the active perfmon before being destroyed +- drm/v3d: Stop the active perfmon before being destroyed +- hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma +- usb: gadget: core: force synchronous registration +- usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip +- usb: xhci: Fix problem with xhci resume from suspend +- usb: dwc3: core: Stop processing of pending events if controller is halted +- Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant" +- HID: plantronics: Workaround for an unexcepted opposite volume key +- HID: multitouch: Add support for lenovo Y9000P Touchpad +- HID: amd_sfh: Switch to device-managed dmam_alloc_coherent() +- hwmon: (adt7470) Add missing dependency on REGMAP_I2C +- hwmon: (adm9240) Add missing dependency on REGMAP_I2C +- hwmon: (mc34vr500) Add missing dependency on REGMAP_I2C +- hwmon: (tmp513) Add missing dependency on REGMAP_I2C +- hwmon: intel-m10-bmc-hwmon: relabel Columbiaville to CVL Die Temperature +- hid-asus: add ROG Ally X prod ID to quirk list +- HID: asus: add ROG Z13 lightbar +- HID: asus: add ROG Ally N-Key ID and keycodes +- HID: i2c-hid: Skip SET_POWER SLEEP for Cirque touchpad on system suspend +- HID: i2c-hid: Renumber I2C_HID_QUIRK_ defines +- HID: i2c-hid: Remove I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV quirk +- rcu/nocb: Fix rcuog wake-up from offline softirq +- rcu/nocb: Make IRQs disablement symmetric +- ppp: fix ppp_async_encode() illegal access +- mctp: Handle error of rtnl_register_module(). +- bridge: Handle error of rtnl_register_module(). +- vxlan: Handle error of rtnl_register_module(). +- rtnetlink: Add bulk registration helpers for rtnetlink message handlers. +- netfilter: fib: check correct rtable in vrf setups +- netfilter: xtables: avoid NFPROTO_UNSPEC where needed +- sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start +- btrfs: zoned: fix missing RCU locking in error message when loading zone info +- net: ibm: emac: mal: fix wrong goto +- net/sched: accept TCA_STAB only for root qdisc +- e1000e: change I219 (19) devices to ADP +- ice: Flush FDB entries before reset +- ice: rename switchdev to eswitch +- ice: Fix netif_is_ice() in Safe Mode +- powercap: intel_rapl_tpmi: Ignore minor version change +- platform/x86/intel/tpmi: Add defines to get version information +- gpio: aspeed: Use devm_clk api to manage clock source +- gpio: aspeed: Add the flush write to ensure the write complete. +- nouveau/dmem: Fix privileged error in copy engine channel +- drm/nouveau: pass cli to nouveau_channel_new() instead of drm+device +- net: dsa: b53: fix jumbo frames on 10/100 ports +- net: dsa: b53: allow lower MTUs on BCM5325/5365 +- net: dsa: b53: fix max MTU for BCM5325/BCM5365 +- net: dsa: b53: fix max MTU for 1g switches +- net: dsa: b53: fix jumbo frame mtu check +- net: ethernet: adi: adin1110: Fix some error handling path in adin1110_read_fifo() +- Revert "net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled" +- thermal: intel: int340x: processor: Fix warning during module unload +- thermal: int340x: processor_thermal: Set feature mask before proc_thermal_add +- net: phy: bcm84881: Fix some error handling paths +- Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change +- selftests: net: no_forwarding: fix VID for $swp2 in one_bridge_two_pvids() test +- netfilter: br_netfilter: fix panic with metadata_dst skb +- rxrpc: Fix uninitialised variable in rxrpc_send_data() +- tcp: fix TFO SYN_RECV to not zero retrans_stamp with retransmits out +- tcp: new TCP_INFO stats for RTO events +- tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe +- tcp: fix to allow timestamp undo if no retransmits were sent +- net: phy: dp83869: fix memory corruption when enabling fiber +- SUNRPC: Fix integer overflow in decode_rc_list() +- ice: fix VLAN replay after reset +- ice: set correct dst VSI in only LAN filters +- x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h +- x86/amd_nb: Add new PCI IDs for AMD family 0x1a +- fbdev: sisfb: Fix strbuf array overflow +- fbcon: Fix a NULL pointer dereference issue in fbcon_putcs +- scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance +- scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in lpfc_els_flush_cmd() +- driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute +- staging: vme_user: added bound check to geoid +- tools/iio: Add memory allocation failure check for trigger_name +- virtio_pmem: Check device status before requesting flush +- netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n +- netfilter: nf_nat: don't try nat source port reallocation for reverse dir clash +- LoongArch: Fix memleak in pci_acpi_scan_root() +- comedi: ni_routing: tools: Check when the file could not be opened +- usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario +- usb: chipidea: udc: enable suspend interrupt after usb reset +- clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D +- remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table +- media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put() +- riscv/kexec_file: Fix relocation type R_RISCV_ADD16 and R_RISCV_SUB16 unknown +- soundwire: cadence: re-check Peripheral status with delayed_work +- RDMA/mlx5: Enforce umem boundaries for explicit ODP page faults +- riscv: avoid Imbalance in RAS +- mfd: intel_soc_pmic_chtwc: Make Lenovo Yoga Tab 3 X90F DMI match less strict +- RISC-V: Don't have MAX_PHYSMEM_BITS exceed phys_addr_t +- i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition +- PCI: Mark Creative Labs EMU20k2 INTx masking as broken +- i2c: i801: Use a different adapter-name for IDF adapters +- PCI: Add ACS quirk for Qualcomm SA8775P +- clk: bcm: bcm53573: fix OF node leak in init +- RDMA/rtrs-srv: Avoid null pointer deref during path establishment +- PCI: Add function 0 DMA alias quirk for Glenfly Arise chip +- soundwire: intel_bus_common: enable interrupts before exiting reset +- RDMA/mad: Improve handling of timed out WRs of mad agent +- ktest.pl: Avoid false positives with grub2 skip regex +- s390/cpum_sf: Remove WARN_ON_ONCE statements +- ext4: nested locking for xattr inode +- bpf, x64: Fix a jit convergence issue +- s390/mm: Add cond_resched() to cmm_alloc/free_pages() +- s390/facility: Disable compile time optimization for decompressor code +- bpf: Check percpu map value size first +- selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test +- Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal +- virtio_console: fix misc probe bugs +- fs/ntfs3: Refactor enum_rstbl to suppress static checker +- fs/ntfs3: Fix sparse warning in ni_fiemap +- fs/ntfs3: Do not call file_modified if collapse range failed +- drm/amd/display: Revert "Check HDCP returned status" +- drm/amd/display: Remove a redundant check in authenticated_dp +- lib/build_OID_registry: avoid non-destructive substitution for Perl < 5.13.2 compat +- jbd2: fix kernel-doc for j_transaction_overhead_buffers +- selftests: Introduce Makefile variable to list shared bash scripts +- selftests: net: Remove executable bits from library scripts +- libsubcmd: Don't free the usage string +- perf sched: Move curr_pid and cpu_last_switched initialization to perf_sched__{lat|map|replay}() +- perf sched: Move curr_thread initialization to perf_sched__map() +- perf sched: Fix memory leak in perf_sched__map() +- perf sched: Move start_work_mutex and work_done_wait_mutex initialization to perf_sched__replay() +- bootconfig: Fix the kerneldoc of _xbc_exit() +- e1000e: move force SMBUS near the end of enable_ulp function +- i40e: Include types.h to some headers +- i40e: Fix ST code value for Clause 45 +- ASoC: tas2781: mark dvc_tlv with __maybe_unused +- ata: ahci: Add mask_port_map module parameter +- spi: spi-fsl-lpspi: remove redundant spi_controller_put call +- riscv: cpufeature: Fix thead vector hwcap removal +- tracing: Have saved_cmdlines arrays all in one allocation +- libceph: init the cursor when preparing sparse read in msgr2 +- pds_core: no health-thread in VF path +- Revert "powerpc/ps3_defconfig: Disable PPC64_BIG_ENDIAN_ELF_ABI_V2" +- bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone +- bus: mhi: ep: Add support for async DMA read operation +- bus: mhi: ep: Add support for async DMA write operation +- bus: mhi: ep: Introduce async read/write callbacks +- bus: mhi: ep: Rename read_from_host() and write_to_host() APIs +- drm/crtc: fix uninitialized variable use even harder +- ALSA: hda/realtek: cs35l41: Fix device ID / model name +- ALSA: hda/realtek: cs35l41: Fix order and duplicates in quirks table +- tracing: Remove precision vsnprintf() check from print event +- drm/panel: boe-tv101wum-nl6: Fine tune Himax83102-j02 panel HFP and HBP (again) +- net: ethernet: cortina: Drop TSO support +- riscv: Remove SHADOW_OVERFLOW_STACK_SIZE macro +- gfs2: Revert "ignore negated quota changes" +- gfs2: qd_check_sync cleanups +- gfs2: Revert "introduce qd_bh_get_or_undo" +- phy: qualcomm: eusb2-repeater: Rework init to drop redundant zero-out loop +- phy: qualcomm: phy-qcom-eusb2-repeater: Add tuning overrides +- ASoC: cs35l56: Load tunings for the correct speaker models +- Revert "PCI/MSI: Provide stubs for IMS functions" +- net: fec: don't save PTP state if PTP is unsupported +- unicode: Don't special case ignorable code points +- Revert "perf callchain: Fix stitch LBR memory leaks" +- !12160 Add the spidev.ko to OLK-6.6 +- Open the CONFIG for spidev.ko +- !13113 f2fs: fix to wait dio completion +- f2fs: fix to wait dio completion +- !13121 blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race +- blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race + +* Fri Nov 08 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-53.0.0.57 +- !13126 Revert "perf callchain: Fix stitch LBR memory leaks" +- Revert "perf callchain: Fix stitch LBR memory leaks" +- !13064 CVE-2024-47702 +- bpf: Fix kabi breakage in struct bpf_insn_access_aux +- bpf: Fail verification for sign-extension of packet data/data_end/data_meta +- !13117 nebula-matrix: fix ci build err +- Net: nebula_matrix: fix ci build err +- !12280 fix Hygon TKM may execute fail in CSV VM +- drivers/crypto/ccp: fix the increase in page references caused by gfn_to_pfn +- crypto: ccp: fix the sev_do_cmd panic on non-Hygon platforms +- !13108 nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net +- nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net +- !13109 RDMA/hns: Fix DCA mmap area PUAF +- RDMA/hns: Fix DCA mmap area PUAF +- !12848 Bluetooth: ISO: Fix multiple init when debugfs is disabled +- Bluetooth: ISO: Fix multiple init when debugfs is disabled +- !13112 fix CVE-2024-49926 +- rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb() +- rcu-tasks: Initialize data to eliminate RCU-tasks/do_exit() deadlocks +- rcu-tasks: Add data to eliminate RCU-tasks/do_exit() deadlocks +- rcu-tasks: Pull sampling of ->percpu_dequeue_lim out of loop +- !13087 MPTCP Upstream part 18 +- selftests: mptcp: add mptcp_lib_check_output helper +- selftests: mptcp: add token for dump_addr +- selftests: mptcp: add userspace pm subflow flag +- mptcp: check userspace pm flags +- !13086 MPTCP Upstream part 17 +- mptcp: dump addrs in userspace pm list +- mptcp: add token for get-addr in yaml +- mptcp: implement mptcp_userspace_pm_dump_addr +- mptcp: export mptcp_genl_family & mptcp_nl_fill_addr +- mptcp: implement TCP_NOTSENT_LOWAT support +- mptcp: cleanup writer wake-up +- !13084 ksmbd: add refcnt to ksmbd_conn struct +- ksmbd: add refcnt to ksmbd_conn struct +- !12943 bpf: Fix a sdiv overflow issue +- bpf: Fix a sdiv overflow issue +- !13088 drm/amd/display: Fix index out of bounds in degamma hardware format translation +- drm/amd/display: Fix index out of bounds in degamma hardware format translation +- !13081 sched/fair: Take the scheduling domain into account in select_idle_smt() +- sched/fair: Take the scheduling domain into account in select_idle_smt() +- !13066 Fix UAF of rpc_task +- nfs: fix rpc_task use-after-free when open and close different files concurrently +- NFSv4: release seqid when open failed for nfs4.0 +- !13069 NFSD: Mark filecache "down" if init fails +- NFSD: Mark filecache "down" if init fails +- !13077 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.54-6.6.55 LTS Patches +- perf python: Allow checking for the existence of warning options in clang +- Revert "ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path" +- perf report: Fix segfault when 'sym' sort key is not used +- drm/amd/display: Revert Avoid overflow assignment +- crypto: octeontx* - Select CRYPTO_AUTHENC +- vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() +- rxrpc: Fix a race between socket set up and I/O thread creation +- platform/x86: think-lmi: Fix password opcode ordering for workstations +- drm/bridge: adv7511: fix crash on irq during probe +- net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events +- netfilter: nf_tables: restore set elements when delete set fails +- netfilter: nf_tables: fix memleak in map from abort path +- ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path +- Revert "drm/amd/display: Skip Recompute DSC Params if no Stream on Link" +- drm/rockchip: vop: enable VOP_FEATURE_INTERNAL_RGB on RK3066 +- btrfs: drop the backref cache during relocation if we commit +- btrfs: relocation: constify parameters where possible +- btrfs: relocation: return bool from btrfs_should_ignore_reloc_root +- clk: qcom: gcc-sc8180x: Add GPLL9 support +- iio: pressure: bmp280: Fix waiting time for BMP3xx configuration +- iio: pressure: bmp280: Fix regmap for BMP280 device +- iio: pressure: bmp280: Use BME prefix for BME280 specifics +- iio: pressure: bmp280: Improve indentation and line wrapping +- iio: pressure: bmp280: Allow multiple chips id per family of devices +- dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x +- dt-bindings: clock: qcom: Add missing UFS QREF clocks +- remoteproc: k3-r5: Delay notification of wakeup event +- remoteproc: k3-r5: Acquire mailbox handle during probe routine +- media: imx335: Fix reset-gpio handling +- media: i2c: imx335: Enable regulator supplies +- RDMA/mana_ib: use the correct page table index based on hardware page size +- net: mana: Add support for page sizes other than 4KB on ARM64 +- net: mana: Enable MANA driver on ARM64 with 4K page size +- lib/buildid: harden build ID parsing logic +- build-id: require program headers to be right after ELF header +- drm/amd/display: Allow backlight to go below `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT` +- io_uring/net: harden multishot termination case for recv +- arm64: cputype: Add Neoverse-N3 definitions +- platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors +- platform/x86: x86-android-tablets: Create a platform_device from module_init() +- kconfig: qconf: fix buffer overflow in debug links +- cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock +- drm/amd/display: Add HDR workaround for specific eDP +- drm/sched: Add locking to drm_sched_entity_modify_sched +- drm/i915/gem: fix bitwise and logical AND mixup +- close_range(): fix the logics in descriptor table trimming +- rtla: Fix the help text in osnoise and timerlat top tools +- tracing/timerlat: Fix duplicated kthread creation due to CPU online/offline +- tracing/hwlat: Fix a race during cpuhp processing +- ceph: fix cap ref leak via netfs init_request +- mac802154: Fix potential RCU dereference issue in mac802154_scan_worker +- Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE +- net: pcs: xpcs: fix the wrong register that was written back +- gpio: davinci: fix lazy disable +- btrfs: send: fix invalid clone operation for file that got its size decreased +- ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[] +- ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[] +- Input: adp5589-keys - fix adp5589_gpio_get_value() +- rtc: at91sam9: fix OF node leak in probe() error path +- net: stmmac: Fix zero-division error when disabling tc cbs +- tomoyo: fallback to realpath if symlink's pathname does not exist +- vrf: revert "vrf: Remove unnecessary RCU-bh critical section" +- iio: magnetometer: ak8975: Fix reading for ak099xx sensors +- smb3: fix incorrect mode displayed for read-only files +- smb: client: use actual path when queryfs +- clk: qcom: clk-alpha-pll: Fix CAL_L_VAL override for LUCID EVO PLL +- clk: qcom: gcc-sc8180x: Fix the sdcc2 and sdcc4 clocks freq table +- media: qcom: camss: Fix ordering of pm_runtime_enable +- media: qcom: camss: Remove use_count guard in stop_streaming +- clk: qcom: gcc-sm8250: Do not turn off PCIe GDSCs during gdsc_disable() +- clk: qcom: gcc-sm8150: De-register gcc_cpuss_ahb_clk_src +- clk: samsung: exynos7885: Update CLKS_NR_FSYS after bindings fix +- clk: qcom: clk-rpmh: Fix overflow in BCM vote +- media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags +- clk: qcom: gcc-sm8450: Do not turn off PCIe GDSCs during gdsc_disable() +- media: sun4i_csi: Implement link validate for sun4i_csi subdev +- clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks +- remoteproc: k3-r5: Fix error handling when power-up failed +- clk: rockchip: fix error for unknown clocks +- media: ov5675: Fix power on/off delay timings +- aoe: fix the potential use-after-free problem in more places +- riscv: Fix kernel stack size when KASAN is enabled +- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page +- NFSD: Fix NFSv4's PUTPUBFH operation +- nfsd: fix delegation_blocked() to block correctly for at least 30 seconds +- perf hist: Update hist symbol when updating maps +- perf python: Disable -Wno-cast-function-type-mismatch if present on clang +- riscv: define ILLEGAL_POINTER_VALUE for 64bit +- arm64: fix selection of HAVE_DYNAMIC_FTRACE_WITH_ARGS +- ocfs2: fix null-ptr-deref when journal load failed. +- ocfs2: fix uninit-value in ocfs2_get_block() +- ocfs2: fix the la space leak when unmounting an ocfs2 volume +- mm: krealloc: consider spare memory for __GFP_ZERO +- jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit +- resource: fix region_intersects() vs add_memory_driver_managed() +- of/irq: Support #msi-cells=<0> in of_msi_get_domain +- of: address: Report error on resource bounds overflow +- drm/rockchip: vop: clear DMA stop bit on RK3066 +- parisc: Fix stack start for ADDR_NO_RANDOMIZE personality +- parisc: Allow mmap(MAP_STACK) memory to automatically expand upwards +- parisc: Fix 64-bit userspace syscall path +- ext4: mark fc as ineligible using an handle in ext4_xattr_set() +- ext4: use handle to mark fc as ineligible in __track_dentry_update() +- ext4: fix fast commit inode enqueueing during a full journal commit +- ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list() +- ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() +- ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() +- ext4: fix incorrect tid assumption in ext4_fc_mark_ineligible() +- ext4: propagate errors from ext4_find_extent() in ext4_insert_range() +- ext4: correct encrypted dentry name hash when not casefolded +- ALSA: hda/realtek: Add a quirk for HP Pavilion 15z-ec200 +- ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9 +- ALSA: line6: add hw monitor volume control to POD HD500X +- ALSA: usb-audio: Add native DSD support for Luxman D-08u +- ALSA: usb-audio: Add delay quirk for VIVO USB-C HEADSET +- ALSA: core: add isascii() check to card ID generator +- ALSA: hda/tas2781: Add new quirk for Lenovo Y990 Laptop +- drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS +- drm/mediatek: ovl_adaptor: Add missing of_node_put() +- parisc: Fix itlb miss handler for 64-bit programs +- perf/core: Fix small negative period being ignored +- power: supply: hwmon: Fix missing temp1_max_alarm attribute +- spi: bcm63xx: Fix missing pm_runtime_disable() +- spi: bcm63xx: Fix module autoloading +- dt-bindings: clock: exynos7885: Fix duplicated binding +- memory: tegra186-emc: drop unused to_tegra186_emc() +- firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp() +- ovl: fail if trusted xattrs are needed but caller lacks permission +- rust: sync: require `T: Sync` for `LockedBy::access` +- i2c: designware: fix controller is holding SCL low while ENABLE bit is disabled +- i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled +- i2c: xiic: Wait for TX empty to avoid missed TX NAKs +- i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq() +- Revert "ALSA: hda: Conditionally use snooping for AMD HDMI" +- selftests: vDSO: fix vdso_config for s390 +- selftests: vDSO: fix ELF hash table entry size for s390x +- powerpc/vdso: Fix VDSO data access when running in a non-root time namespace +- selftests/mm: fix charge_reserved_hugetlb.sh test +- selftests: vDSO: fix vDSO symbols lookup for powerpc64 +- selftests: vDSO: fix vdso_config for powerpc +- selftests: vDSO: fix vDSO name for powerpc +- perf: Really fix event_function_call() locking +- perf callchain: Fix stitch LBR memory leaks +- spi: rpc-if: Add missing MODULE_DEVICE_TABLE +- accel/ivpu: Add missing MODULE_FIRMWARE metadata +- selftests: breakpoints: use remaining time to check if suspend succeed +- spi: s3c64xx: fix timeout counters in flush_fifo +- selftest: hid: add missing run-hid-tools-tests.sh +- spi: spi-cadence: Fix missing spi_controller_is_target() check +- spi: spi-cadence: Fix pm_runtime_set_suspended() with runtime pm enabled +- spi: spi-cadence: Use helper function devm_clk_get_enabled() +- spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled +- bpftool: Fix undefined behavior in qsort(NULL, 0, ...) +- bpftool: Fix undefined behavior caused by shifting into the sign bit +- bpf: Make the pointer returned by iter next method valid +- ksmbd: add refcnt to ksmbd_conn struct +- platform/x86: lenovo-ymc: Ignore the 0x0 state +- drm/amdgpu/gfx10: use rlc safe mode for soft recovery +- drm/amdgpu/gfx11: use rlc safe mode for soft recovery +- powerpc/pseries: Use correct data types from pseries_hp_errorlog struct +- of/irq: Refer to actual buffer size in of_irq_parse_one() +- drm/amd/pm: ensure the fw_info is not null before using it +- drm/amdgpu/gfx9: use rlc safe mode for soft recovery +- drm/amdgpu: Block MMR_READ IOCTL in reset +- drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() +- scsi: NCR5380: Initialize buffer for MSG IN and STATUS transfers +- perf: Fix event_function_call() locking +- drm/amdgpu: fix unchecked return value warning for amdgpu_gfx +- scsi: lpfc: Update PRLO handling in direct attached topology +- drm/printer: Allow NULL data in devcoredump printer +- drm/amd/display: Fix index out of bounds in degamma hardware format translation +- drm/stm: ltdc: reset plane transparency after plane disable +- platform/x86: touchscreen_dmi: add nanote-next quirk +- HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio +- drm/amdkfd: Fix resource leak in criu restore queue +- drm/amdgpu: enable gfxoff quirk on HP 705G4 +- drm/amdgpu: add raven1 gfxoff quirk +- scsi: smartpqi: correct stream detection +- jfs: UBSAN: shift-out-of-bounds in dbFindBits +- drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2) +- drm/amd/display: Check null pointers before using dc->clk_mgr +- drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit +- iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count +- iommu/vt-d: Always reserve a domain ID for identity setup +- power: reset: brcmstb: Do not go into infinite loop if reset fails +- rcuscale: Provide clear error when async specified without primitives +- fbdev: efifb: Register sysfs groups through driver core +- hwmon: (nct6775) add G15CF to ASUS WMI monitoring list +- x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments() +- selftests/nolibc: avoid passing NULL to printf("%s") +- tools/nolibc: powerpc: limit stack-protector workaround to GCC +- ALSA: hdsp: Break infinite MIDI input flush loop +- x86/kexec: Add EFI config table identity mapping for kexec kernel +- x86/pkeys: Restore altstack access in sigreturn() +- x86/pkeys: Add PKRU as a parameter in signal handling functions +- tools/x86/kcpuid: Protect against faulty "max subleaf" values +- ASoC: codecs: wsa883x: Handle reading version failure +- ALSA: usb-audio: Add logitech Audio profile quirk +- ALSA: usb-audio: Replace complex quirk lines with macros +- ALSA: usb-audio: Define macros for quirk table entries +- ALSA: usb-audio: Add input value sanity checks for standard types +- nfp: Use IRQF_NO_AUTOEN flag in request_irq() +- wifi: mt76: mt7915: hold dev->mt76.mutex while disabling tx worker +- wifi: mt76: mt7915: add dummy HW offload of IEEE 802.11 fragmentation +- can: netlink: avoid call to do_set_data_bittiming callback with stale can_priv::ctrlmode +- drivers/perf: arm_spe: Use perf_allow_kernel() for permissions +- ACPICA: iasl: handle empty connection_node +- wifi: mac80211: fix RCU list iterations +- wifi: iwlwifi: mvm: avoid NULL pointer dereference +- wifi: iwlwifi: mvm: use correct key iteration +- tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process +- netpoll: Ensure clean state on setup failures +- crypto: simd - Do not call crypto_alloc_tfm during registration +- net: atlantic: Avoid warning about potential string truncation +- ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family +- wifi: rtw89: correct base HT rate mask for firmware +- ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR). +- bnxt_en: Extend maximum length of version string by 1 byte +- net: mvpp2: Increase size of queue_name buffer +- ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() +- ACPI: EC: Do not release locks during operation region accesses +- wifi: rtw88: select WANT_DEV_COREDUMP +- wifi: ath11k: fix array out-of-bound access in SoC stats +- ACPI: CPPC: Add support for setting EPP register in FFH +- ACPI: video: Add force_vendor quirk for Panasonic Toughbook CF-18 +- Bluetooth: btrtl: Set msft ext address filter quirk for RTL8852B +- Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0489:0xe122 +- net: sched: consistently use rcu_replace_pointer() in taprio_change() +- wifi: mt76: mt7915: disable tx worker during tx BA session enable/disable +- e1000e: avoid failing the system during pm_suspend +- ACPICA: Fix memory leak if acpi_ps_get_next_field() fails +- ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails +- ACPI: PAD: fix crash in exit_round_robin() +- net: hisilicon: hns_mdio: fix OF node leak in probe() +- net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info() +- net: hisilicon: hip04: fix OF node leak in probe() +- wifi: iwlwifi: mvm: drop wrong STA selection in TX +- wifi: iwlwifi: mvm: Fix a race in scan abort flow +- ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node() +- crypto: octeontx2 - Fix authenc setkey +- crypto: octeontx - Fix authenc setkey +- crypto: x86/sha256 - Add parentheses around macros' single arguments +- wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit +- wifi: rtw89: avoid to add interface to list twice when SER +- wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats() +- ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin +- ALSA: gus: Fix some error handling paths related to get_bpos() usage +- cifs: Do not convert delimiter when parsing NFS-style symlinks +- ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m +- ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs +- cifs: Remove intermediate object of failed create reparse call +- ALSA: hda/realtek: Fix the push button function for the ALC257 +- ALSA: mixer_oss: Remove some incorrect kfree_const() usages +- ASoC: atmel: mchp-pdmc: Skip ALSA restoration if substream runtime is uninitialized +- Bluetooth: hci_sock: Fix not validating setsockopt user input +- loop: don't set QUEUE_FLAG_NOMERGES +- i2c: xiic: Try re-initialization on bus busy timeout +- i2c: xiic: improve error message when transfer fails to start +- sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start +- dt-bindings: net: xlnx,axi-ethernet: Add missing reg minItems +- iomap: constrain the file range passed to iomap_file_unshare +- ppp: do not assume bh is held in ppp_channel_bridge_input() +- ipv4: ip_gre: Fix drops of small packets in ipgre_xmit +- net: stmmac: dwmac4: extend timeout for VLAN Tag register busy bit check +- net: fec: Reload PTP registers after link-state change +- net: fec: Restart PPS after link state change +- net: ethernet: lantiq_etop: fix memory disclosure +- net: Fix gso_features_check to check for both dev->gso_{ipv4_,}max_size +- net: Add netif_get_gro_max_size helper for GRO +- Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq() +- Bluetooth: L2CAP: Fix uaf in l2cap_connect +- Bluetooth: MGMT: Fix possible crash on mgmt_index_removed +- netfilter: nf_tables: prevent nf_skb_duplicated corruption +- selftests: netfilter: Fix nft_audit.sh for newer nft binaries +- net: wwan: qcom_bam_dmux: Fix missing pm_runtime_disable() +- net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq() +- netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED +- net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice +- net/mlx5: Added cond_resched() to crdump collection +- net/mlx5: Fix error path in multi-packet WQE transmit +- net: sparx5: Fix invalid timestamps +- ieee802154: Fix build error +- ceph: remove the incorrect Fw reference check when dirtying pages +- mailbox: bcm2835: Fix timeout during suspend mode +- mailbox: rockchip: fix a typo in module autoloading +- drm/amdgpu: Fix get each xcp macro +- scsi: pm8001: Do not overwrite PCI queue mapping +- scsi: st: Fix input/output error on empty drive reset +- jump_label: Fix static_key_slow_dec() yet again +- jump_label: Simplify and clarify static_key_fast_inc_cpus_locked() +- static_call: Handle module init failure correctly in static_call_del_module() +- !13043 tty: n_gsm: Fix use-after-free in gsm_cleanup_mux +- tty: n_gsm: Fix use-after-free in gsm_cleanup_mux +- !13062 net: test for not too small csum_start in virtio_net_hdr_to_skb() +- net: test for not too small csum_start in virtio_net_hdr_to_skb() +- !13060 net: add more sanity checks to qdisc_pkt_len_init() +- net: add more sanity checks to qdisc_pkt_len_init() +- !13061 net: avoid potential underflow in qdisc_pkt_len_init() with UFO +- net: avoid potential underflow in qdisc_pkt_len_init() with UFO + +* Wed Nov 06 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-50.0.0.56 +- !12979 ext4: fix timer use-after-free on failed mount +- ext4: fix timer use-after-free on failed mount +- !12980 ext4: no need to continue when the number of entries is 1 +- ext4: no need to continue when the number of entries is 1 +- !12983 CVE-2024-49968 +- ext4: fix error message when rejecting the default hash +- ext4: filesystems without casefold feature cannot be mounted with siphash +- !12981 ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free +- ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free +- !12982 ext4: fix i_data_sem unlock order in ext4_ind_migrate() +- ext4: fix i_data_sem unlock order in ext4_ind_migrate() +- !12978 exfat: fix memory leak in exfat_load_bitmap() +- exfat: fix memory leak in exfat_load_bitmap() +- !12977 ext4: fix access to uninitialised lock in fc replay path +- ext4: fix access to uninitialised lock in fc replay path +- !13018 nebula-matrix: fix ci build warning when use clang +- Net: nebula_matrix: fix ci build warning +- !12866 fix CVE-2024-50041 +- i40e: Fix macvlan leak by synchronizing access to mac_filter_hash +- !12595 scsi: fnic: Move flush_work initialization out of if block +- scsi: fnic: Move flush_work initialization out of if block +- !13004 CVE-2024-50064 +- zram: don't free statically defined names +- zram: free secondary algorithms names +- !13044 Some patches of RDMA/hns from Linux to OLK-6.6 +- RDMA/hns: Fix cpu stuck caused by printings during reset +- RDMA/hns: Use dev_* printings in hem code instead of ibdev_* +- RDMA/hns: Modify debugfs name +- RDMA/hns: Fix flush cqe error when racing with destroy qp +- RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci +- Revert "RDMA/hns: Fix flush cqe error when racing with destroy qp" +- Revert "RDMA/hns: Fix missing spin_lock_init() for qp flush lock" +- !13049 ext4: some dependencies of CVE-2024-47701 +- ext4: explicitly exit when ext4_find_inline_entry returns an error +- ext4: ext4_search_dir should return a proper error +- !12682 smb: client: fix UAF in async decryption +- smb: client: fix UAF in async decryption +- !13023 l2tp: prevent possible tunnel refcount underflow +- l2tp: prevent possible tunnel refcount underflow +- !13025 wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() +- wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() +- !13024 wifi: cfg80211: Set correct chandef when starting CAC +- wifi: cfg80211: Set correct chandef when starting CAC +- !12993 igb: Do not bring the device up after non-fatal error +- igb: Do not bring the device up after non-fatal error +- !12988 mm/mremap: fix move_normal_pmd/retract_page_tables race +- mm/mremap: fix move_normal_pmd/retract_page_tables race +- !12800 cachefiles: fix dentry leak in cachefiles_open_file() +- cachefiles: fix dentry leak in cachefiles_open_file() +- !12900 ext4: fix double brelse() the buffer of the extents path +- ext4: fix double brelse() the buffer of the extents path +- !12896 ext4: aovid use-after-free in ext4_ext_insert_extent() +- ext4: aovid use-after-free in ext4_ext_insert_extent() +- !12960 ext4: update orig_path in ext4_find_extent() +- ext4: update orig_path in ext4_find_extent() +- !13012 drm/amd/display: Revert "drm/amd/display: Fix potential index out of bounds in color transformation function" +- drm/amd/display: Revert "drm/amd/display: Fix potential index out of bounds in color transformation function" +- !12909 btrfs: fix uninitialized pointer free on read_alloc_one_name() error +- btrfs: fix uninitialized pointer free on read_alloc_one_name() error +- !12906 io_uring: fix CVE-2024-50060 +- io_uring: check if we need to reschedule during overflow flush +- io_uring: always lock __io_cqring_overflow_flush +- !12892 ext4: avoid use-after-free in ext4_ext_show_leaf() +- ext4: avoid use-after-free in ext4_ext_show_leaf() +- !12957 rseq/mm_cid: change the mm_cid macro default status and keep KABI consistent +- rseq/mm_cid: change the mm_cid macro default status and keep KABI consistent +- !12377 ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate() +- ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate() +- !12497 drm/stm: Avoid use-after-free issues with crtc and plane +- drm/stm: Avoid use-after-free issues with crtc and plane +- !12775 vt: prevent kernel-infoleak in con_font_get() +- vt: prevent kernel-infoleak in con_font_get() +- !12883 CVE-2024-50016 +- drm/amd/display: Avoid overflow assignment in link_dp_cts +- !12774 net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test() +- net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test() +- !12776 drm/amd/display: Check stream before comparing them +- drm/amd/display: Check stream before comparing them +- !12940 virtCCA feature: GPU supports maximum 1G page table mapping +- virtcca feature : GPU supports maximum 1G page table mapping. +- !12952 drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream +- drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream +- !12942 fix CVE-2024-47704 +- drm/amd/display: Check link_res->hpo_dp_link_enc before using it +- drm/amd/display: Check link_res->hpo_dp_link_enc before using it +- !12953 mm: gup: stop abusing try_grab_folio +- mm: gup: stop abusing try_grab_folio +- !9209 [OLK-6.6] perf/x86/zhaoxin/uncore: update KX-7000 support +- perf/x86/zhaoxin/uncore: update KX-7000 support +- !9191 [OLK-6.6] x86/cpu: Remove pointless evaluation of x86_coreid_bits +- x86/cpu: Remove pointless evaluation of x86_coreid_bits +- !9156 [OLK-6.6] USB: Fix kernel NULL pointer when unbind UHCI form vfio-pci +- USB:Fix kernel NULL pointer when unbind UHCI form vfio-pci +- !7927 [OLK-6.6] fix intel-lkp compilation issues for DMA patch +- x86/cpu/zhaoxin: kx-40000: Apply the static modifier to some symbols +- x86/cpu/zhaoxin: Encapsulate access to kh40000_dma_direct_ops within function +- x86/cpu/zhaoxin: Encapsulate access to global variables within functions +- x86/cpu/zhaoxin: Adjust the configuration options for zhaoxin-kx40000.c +- x86/cpu/zhaoxin: kx40000: fix bitwise warning issue +- !7874 [OLK-6.6] iommu/dma: Move iova_reserve_domain_addr to header dma-iommu.h +- iommu/dma: Move iova_reserve_domain_addr to header dma-iommu.h +- !12835 Net: nebula-matrix: fix ci build warning +- Net: nebula_matrix: fix ci build warning +- !12550 fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name +- fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name +- !12871 Fix CVE-2024-47703 +- selftests/bpf: Add return value checks for failed tests +- bpf: Fix kabi breakage in struct bpf_insn_access_aux +- bpf: Fix kabi breakage in struct bpf_func_state +- bpf: Fix compare error in function retval_range_within +- bpf, lsm: Add check for BPF LSM return value +- bpf, lsm: Add disabled BPF LSM hook list +- bpf: enforce precise retval range on program exit +- bpf: enforce exact retval range on subprog/callback exit +- !12712 drm: omapdrm: Add missing check for alloc_ordered_workqueue +- drm: omapdrm: Add missing check for alloc_ordered_workqueue +- !12838 ocfs2: reserve space for inline xattr before attaching reflink tree +- ocfs2: reserve space for inline xattr before attaching reflink tree +- !12372 fix CVE-2024-49954 +- static_call: Replace pointless WARN_ON() in static_call_module_notify() +- !12358 fix CVE-2024-49852 +- scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del() +- !12822 i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition +- i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition +- !12918 Input: adp5589-keys - fix NULL pointer dereference +- Input: adp5589-keys - fix NULL pointer dereference +- !12874 tipc: guard against string buffer overrun +- tipc: guard against string buffer overrun +- !12916 serial: protect uart_port_dtr_rts() in uart_shutdown() too +- serial: protect uart_port_dtr_rts() in uart_shutdown() too +- !12843 v4 CVE-2024-50063 +- selftests/bpf: Add test for lsm tail call +- bpf: Fix kabi breakage in struct bpf_map +- bpf: Prevent tail call between progs attached to different hooks +- !12932 gso: fix udp gso fraglist segmentation after pull from frag_list +- gso: fix udp gso fraglist segmentation after pull from frag_list +- !12933 tcp: fix mptcp DSS corruption due to large pmtu xmit +- tcp: fix mptcp DSS corruption due to large pmtu xmit +- !12922 ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate +- ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate +- !12913 drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs +- drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs +- !12888 drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw +- drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw +- !12769 uprobes: fix kernel info leak via "[uprobes +- uprobes: fix kernel info leak via "[uprobes]" vma +- !12717 wifi: ath12k: fix array out-of-bound access in SoC stats +- wifi: ath12k: fix array out-of-bound access in SoC stats +- !12742 net/xen-netback: prevent UAF in xenvif_flush_hash() +- net/xen-netback: prevent UAF in xenvif_flush_hash() +- !12738 r8169: add tally counter fields added with RTL8125 +- r8169: add tally counter fields added with RTL8125 +- !12805 ext4: fix slab-use-after-free in ext4_split_extent_at() +- ext4: fix slab-use-after-free in ext4_split_extent_at() +- !12637 kthread: unpark only parked kthread +- kthread: unpark only parked kthread +- !12473 scsi: wd33c93: Don't use stale scsi_pointer value +- scsi: wd33c93: Don't use stale scsi_pointer value +- !12688 security/keys: fix slab-out-of-bounds in key_task_permission +- security/keys: fix slab-out-of-bounds in key_task_permission +- !12791 slip: make slhc_remember() more robust against malicious packets +- slip: make slhc_remember() more robust against malicious packets +- !12607 virtcca compile warning clean and coda bugfix +- virtcca bugfix: compile warning clean +- virtcca bugfix: clear device msi address +- virtcca bugfix: compile warning clean +- !12773 v4 add vdpa support for x86 and enable vdpa migration. +- vdpa: add support for x86 and open vdpa migration build config +- virtio_blk: remove the broken zone revalidation support +- !12759 CVE-2024-50055 +- driver core: bus: Fix double free in driver API bus_register() +- !12772 MPTCP Upstream part 16 +- selftests: mptcp: diag: avoid extra waiting +- configs/debug: add NET debug config +- MAINTAINERS: update Geliang's email address +- !12771 MPTCP Upstream part 15 +- selftests: mptcp: diag: change timeout_poll to 30 +- selftests: mptcp: join: change capture/checksum as bool +- selftests: mptcp: simult flows: define missing vars +- selftests: mptcp: netlink: drop duplicate var ret +- !12834 [OLK-6.6] drivers: load Yunsilicon ethernet driver when xsc_pci probing +- drivers: load Yunsilicon ethernet driver when xsc_pci probing +- !12817 media: venus: fix use after free bug in venus_remove due to race condition +- media: venus: fix use after free bug in venus_remove due to race condition +- !12599 iommufd: Require drivers to supply the cache_invalidate_user ops +- iommufd: Require drivers to supply the cache_invalidate_user ops +- !12793 uprobe: avoid out-of-bounds memory access of fetching args +- uprobe: avoid out-of-bounds memory access of fetching args +- !12821 v4 openeuler_defconfig: Disable CONFIG_DEBUG_INFO_BTF_MODULES +- openeuler_defconfig: Disable CONFIG_DEBUG_INFO_BTF_MODULES +- !12829 drm/amd/display: Check null-initialized variables +- drm/amd/display: Check null-initialized variables +- !12826 media: i2c: ar0521: Use cansleep version of gpiod_set_value() +- media: i2c: ar0521: Use cansleep version of gpiod_set_value() +- !12827 drm/amd/display: Check null pointers before using them +- drm/amd/display: Check null pointers before using them +- !12767 x86/bugs: Use code segment selector for VERW operand +- x86/bugs: Use code segment selector for VERW operand +- !12506 ocfs2: cancel dqi_sync_work before freeing oinfo +- ocfs2: cancel dqi_sync_work before freeing oinfo +- !12482 device-dax: correct pgoff align in dax_set_mapping() +- device-dax: correct pgoff align in dax_set_mapping() +- !12795 platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug +- platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug +- !12816 v2 bpf lts backport +- Fix kabi breakage in struct bpf_map +- bpf: Optimize the free of inner map +- !12747 parport: Proper fix for array out-of-bounds access +- parport: Proper fix for array out-of-bounds access +- !12780 drivers: misc: uacce: bugfix for MAX_ORDER +- drivers: misc: uacce: bugfix for MAX_ORDER +- !12718 thermal: core: Reference count the zone in thermal_zone_get_by_id() +- thermal: core: Reference count the zone in thermal_zone_get_by_id() +- !12707 drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func +- drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func +- !12768 Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync +- Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync +- !12674 net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() +- net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() +- !12736 drm/amd/display: Fix system hang while resume with TBT monitor +- drm/amd/display: Fix system hang while resume with TBT monitor +- !12604 drm/amd/display: Check null pointer before dereferencing se +- drm/amd/display: Check null pointer before dereferencing se +- !12591 cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value +- cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value +- !12465 drm/amd/display: Initialize get_bytes_per_element's default to 1 +- drm/amd/display: Initialize get_bytes_per_element's default to 1 +- !12755 pinctrl: stm32: check devm_kasprintf() returned value +- pinctrl: stm32: check devm_kasprintf() returned value +- !12715 MPTCP Upstream part 14 +- mptcp: check the protocol in mptcp_sk() with DEBUG_NET +- mptcp: check the protocol in tcp_sk() with DEBUG_NET +- mptcp: token kunit: set protocol +- !12711 btrfs: fix uninitialized pointer free in add_inode_ref() +- btrfs: fix uninitialized pointer free in add_inode_ref() +- !12728 Backport "ima: Avoid blocking in RCU read-side critical section" +- ima: Avoid blocking in RCU read-side critical section +- Revert "ima: Avoid blocking in RCU read-side critical section" +- !12516 fix CVE-2024-47742 +- firmware_loader: Block path traversal +- !12710 fix CVE-2024-49924 +- fbdev: pxafb: Fix possible use after free in pxafb_task() +- !12729 CVE-2024-50059 +- ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition +- !12720 drivers/crypto/ccp: fix a build error +- drivers/crypto/ccp: fix a build error +- !12666 block: fix integer overflow in BLKSECDISCARD +- block: fix integer overflow in BLKSECDISCARD +- !12608 blk_iocost: fix more out of bound shifts +- blk_iocost: fix more out of bound shifts +- !12656 CVE-2024-49955 +- ACPI: battery: Fix possible crash when unregistering a battery hook +- ACPI: battery: Simplify battery hook locking +- !12662 drm/amd/display: fix double free issue during amdgpu module unload +- drm/amd/display: fix double free issue during amdgpu module unload +- !12698 mm: memcg: don't periodically flush stats when memcg is disabled +- mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats +- mm: memcg: don't periodically flush stats when memcg is disabled +- !12345 [OLK-6.6] drivers: update Yunsilicon driver to version rel_2406_rc16 +- drivers: update Yunsilicon driver to version 2406_rc16 +- !12617 drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream' +- drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream' +- !12545 Fix TX fifo corruption in patch [3 +- serial: sc16is7xx: fix TX fifo corruption +- kfifo: add kfifo_out_linear{,_ptr}() +- serial: sc16is7xx: refactor FIFO access functions to increase commonality +- !12648 net: do not delay dst_entries_add() in dst_release() +- net: do not delay dst_entries_add() in dst_release() +- !12553 Fix CVE-2024-49996 +- cifs: Fix buffer overflow when parsing NFS reparse points +- smb: client: fix parsing of device numbers + +* Wed Oct 30 2024 jchzhou <zhoujiacheng@iscas.ac.cn> - 6.6.0-48.0.0.55 +- create & package symvers-kernelver.gz unconditionally to fix ISO installation +faliures like in issue #I7MARC + +* Wed Jun 19 2024 Ren Zhijie <zhijie.ren@shingroup.cn> - 6.6.0-48.0.0.54 +- add support for arch ppc64le + +* Wed Oct 30 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-48.0.0.53 +- !12565 KEYS: prevent NULL pointer dereference in find_asymmetric_key() +- KEYS: prevent NULL pointer dereference in find_asymmetric_key() +- !12498 nbd: fix race between timeout and normal completion +- nbd: fix race between timeout and normal completion +- !10861 [OLK-6.6] perf/x86/uncore: Add support for Hygon family 18h model 4h-7h and 10h DF PMU +- perf/x86/uncore: Add DF PMU support for Hygon family 18h model 4h-7h and 10h +- !12673 ocfs2: remove unreasonable unlock in ocfs2_read_blocks +- ocfs2: remove unreasonable unlock in ocfs2_read_blocks +- !12653 usb: typec: tipd: Free IRQ only if it was requested before +- usb: typec: tipd: Free IRQ only if it was requested before +- !12632 ALSA: asihpi: Fix potential OOB array access +- ALSA: asihpi: Fix potential OOB array access +- !12635 bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0 +- bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0 +- !12491 LoongArch: fix some 3C6000&LS7A related problems +- LoongArch: Add workaround for 3C6000 about io wr/rd +- Loongarch: Dynamic enable writecombine +- acpi: mcfg quirk: Increased multi-chip support for the 3C6000 +- pci/quirks: LS7A2000 enable msi +- !12331 LoongArch: prevent LS7A Bus Master clearing on kexec +- LoongArch: prevent LS7A Bus Master clearing on kexec +- !12321 LoongArch: backport 3 patches from upstream +- LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h +- LoongArch: Add writecombine support for DMW-based ioremap() +- LoongArch: Change SHMLBA from SZ_64K to PAGE_SIZE +- !12557 ntfs3: Change to non-blocking allocation in ntfs_d_hash +- ntfs3: Change to non-blocking allocation in ntfs_d_hash +- !12554 NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() +- NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() +- !12444 nilfs2: fix potential oob read in nilfs_btree_check_delete() +- nilfs2: fix potential oob read in nilfs_btree_check_delete() +- !12631 some bugfixs for khuegpaged +- mm: khugepaged: fix the incorrect statistics when collapsing large file folios +- mm: khugepaged: fix the arguments order in khugepaged_collapse_file trace point +- selftests: mm: support shmem mTHP collapse testing +- mm: khugepaged: support shmem mTHP collapse +- mm: khugepaged: support shmem mTHP copy +- mm: khugepaged: use the number of pages in the folio to check the reference count +- mm: khugepaged: expand the is_refcount_suitable() to support file folios +- khugepaged: use a folio throughout hpage_collapse_scan_file() +- khugepaged: use a folio throughout collapse_file() +- khugepaged: remove hpage from collapse_file() +- khugepaged: pass a folio to __collapse_huge_page_copy() +- khugepaged: remove hpage from collapse_huge_page() +- khugepaged: convert alloc_charge_hpage to alloc_charge_folio +- khugepaged: inline hpage_collapse_alloc_folio() +- !12634 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.53-6.6.54 LTS Patches +- Revert: "dm-verity: restart or panic on an I/O error" +- spi: atmel-quadspi: Fix wrong register value written to MR +- x86/tdx: Fix "in-kernel MMIO" check +- thunderbolt: Fix NULL pointer dereference in tb_port_update_credits() +- thunderbolt: Fix minimum allocated USB 3.x and PCIe bandwidth +- thunderbolt: Send uevent after asymmetric/symmetric switch +- wifi: brcmfmac: add linefeed at end of file +- iio: magnetometer: ak8975: Fix 'Unexpected device' error +- perf/arm-cmn: Fail DTC counter allocation correctly +- usb: yurex: Fix inconsistent locking bug in yurex_read() +- Documentation: KVM: fix warning in "make htmldocs" +- i2c: isch: Add missed 'else' +- i2c: aspeed: Update the stop sw state when the bus recovery occurs +- mm/damon/vaddr: protect vma traversal in __damon_va_thre_regions() with rcu read lock +- module: Fix KCOV-ignored file name +- spi: fspi: add support for imx8ulp +- mm: only enforce minimum stack gap size if it's sensible +- lockdep: fix deadlock issue between lockdep and rcu +- dm-verity: restart or panic on an I/O error +- bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0 +- thunderbolt: Improve DisplayPort tunnel setup process to be more robust +- thunderbolt: Configure asymmetric link if needed and bandwidth allows +- thunderbolt: Add support for asymmetric link +- thunderbolt: Introduce tb_switch_depth() +- thunderbolt: Introduce tb_for_each_upstream_port_on_path() +- thunderbolt: Introduce tb_port_path_direction_downstream() +- thunderbolt: Change bandwidth reservations to comply USB4 v2 +- thunderbolt: Make is_gen4_link() available to the rest of the driver +- thunderbolt: Use weight constants in tb_usb3_consumed_bandwidth() +- thunderbolt: Use constants for path weight and priority +- thunderbolt: Create multiple DisplayPort tunnels if there are more DP IN/OUT pairs +- thunderbolt: Expose tb_tunnel_xxx() log macros to the rest of the driver +- thunderbolt: Use tb_tunnel_dbg() where possible to make logging more consistent +- thunderbolt: Fix debug log when DisplayPort adapter not available for pairing +- dt-bindings: spi: nxp-fspi: add imx8ulp support +- dt-bindings: spi: nxp-fspi: support i.MX93 and i.MX95 +- btrfs: reorder btrfs_inode to fill gaps +- btrfs: subpage: fix the bitmap dump which can cause bitmap corruption +- lib/bitmap: add bitmap_{read,write}() +- x86/entry: Remove unwanted instrumentation in common_interrupt() +- x86/idtentry: Incorporate definitions/declarations of the FRED entries +- serial: don't use uninitialized value in uart_poll_init() +- tty: serial: kgdboc: Fix 8250_* kgdb over serial +- pps: add an error check in parport_attach +- pps: remove usage of the deprecated ida_simple_xx() API +- usb: xhci: fix loss of data on Cadence xHC +- xhci: Add a quirk for writing ERST in high-low order +- USB: misc: yurex: fix race between read and write +- usb: yurex: Replace snprintf() with the safer scnprintf() variant +- soc: versatile: realview: fix soc_dev leak during device remove +- soc: versatile: realview: fix memory leak during device remove +- ARM: dts: imx6ul-geam: fix fsl,pins property in tscgrp pinctrl +- spi: fspi: involve lut_num for struct nxp_fspi_devtype_data +- padata: use integer wrap around to prevent deadlock on seq_nr overflow +- cpuidle: riscv-sbi: Use scoped device node handling to fix missing of_node_put +- icmp: change the order of rate limits +- EDAC/igen6: Fix conversion of system address to physical memory address +- fs: Fix file_set_fowner LSM hook inconsistencies +- vfs: fix race between evice_inodes() and find_inode()&iput() +- arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity +- arm64: dts: qcom: sa8775p: Mark APPS and PCIe SMMUs as DMA coherent +- arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency +- arm64: esr: Define ESR_ELx_EC_* constants as UL +- hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume +- hwrng: bcm2835 - Add missing clk_disable_unprepare in bcm2835_rng_init +- hwrng: mtk - Use devm_pm_runtime_enable +- f2fs: fix to check atomic_file in f2fs ioctl interfaces +- f2fs: Require FMODE_WRITE for atomic write ioctls +- f2fs: avoid potential int overflow in sanity_check_area_boundary() +- f2fs: prevent possible int overflow in dir_block_index() +- f2fs: fix several potential integer overflows in file offsets +- btrfs: always update fstrim_range on failure in FITRIM ioctl +- btrfs: tree-checker: fix the wrong output of data backref objectid +- debugobjects: Fix conditions in fill_pool() +- wifi: mt76: mt7615: check devm_kasprintf() returned value +- wifi: rtw88: 8822c: Fix reported RX band width +- wifi: rtw88: 8821cu: Remove VID/PID 0bda:c82c +- wifi: mt76: mt7915: check devm_kasprintf() returned value +- wifi: mt76: mt7921: Check devm_kasprintf() returned value +- perf/x86/intel/pt: Fix sampling synchronization +- efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption +- ACPI: resource: Add another DMI match for the TongFang GMxXGxx +- ACPI: sysfs: validate return type of _STR method +- drbd: Add NULL check for net_conf to prevent dereference in state validation +- drbd: Fix atomicity violation in drbd_uuid_set_bm() +- crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure +- serial: qcom-geni: fix fifo polling timeout +- xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them. +- tty: rp2: Fix reset with non forgiving PCIe host bridges +- firmware_loader: Block path traversal +- bus: mhi: host: pci_generic: Fix the name for the Telit FE990A +- bus: integrator-lm: fix OF node leak in probe() +- usb: dwc2: drd: fix clock gating on USB role switch +- usb: cdnsp: Fix incorrect usb_request status +- USB: class: CDC-ACM: fix race between get_serial and set_serial +- USB: misc: cypress_cy7c63: check for short transfer +- USB: appledisplay: close race between probe and completion handler +- arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled +- usbnet: fix cyclical race on disconnect with work queue +- wifi: rtw88: Fix USB/SDIO devices not transmitting beacons +- can: esd_usb: Remove CAN_CTRLMODE_3_SAMPLES for CAN-USB/3-FD +- scsi: mac_scsi: Disallow bus errors during PDMA send +- scsi: mac_scsi: Refactor polling loop +- scsi: mac_scsi: Revise printk(KERN_DEBUG ...) messages +- scsi: ufs: qcom: Update MODE_MAX cfg_bw value +- scsi: sd: Fix off-by-one error in sd_read_block_characteristics() +- ata: libata-scsi: Fix ata_msense_control() CDL page reporting +- ksmbd: handle caseless file creation +- ksmbd: allow write with FILE_APPEND_DATA +- ksmbd: make __dir_empty() compatible with POSIX +- fs: Create a generic is_dot_dotdot() utility +- powerpc/atomic: Use YZ constraints for DS-form instructions +- KEYS: prevent NULL pointer dereference in find_asymmetric_key() +- drm/amd/display: Validate backlight caps are sane +- drm/amd/display: Round calculated vtotal +- drm/amd/display: Add HDMI DSC native YCbCr422 support +- drm/amd/display: Skip Recompute DSC Params if no Stream on Link +- KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock +- KVM: x86: Move x2APIC ICR helper above kvm_apic_write_nodecode() +- KVM: x86: Enforce x2APIC's must-be-zero reserved ICR bits +- KVM: arm64: Add memory length checks and remove inline in do_ffa_mem_xfer +- Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line +- Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table +- Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table +- Input: adp5588-keys - fix check on return code +- iommufd: Protect against overflow of ALIGN() during iova allocation +- Revert "media: tuners: fix error return code of hybrid_tuner_request_state()" +- soc: versatile: integrator: fix OF node leak in probe() error path +- soc: fsl: cpm1: tsa: Fix tsa_write8() +- ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error +- Revert "soc: qcom: smd-rpm: Match rpmsg channel instead of compatible" +- PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler +- PCI: Use an error code with PCIe failed link retraining +- PCI: Correct error reporting with PCIe failed link retraining +- PCI: imx6: Fix missing call to phy_power_off() in error handling +- PCI: dra7xx: Fix threaded IRQ request for "dra7xx-pcie-main" IRQ +- PCI: Clear the LBMS bit after a link retrain +- PCI: Revert to the original speed after PCIe failed link retraining +- Remove *.orig pattern from .gitignore +- io_uring/sqpoll: do not put cpumask on stack +- io_uring/sqpoll: retain test for whether the CPU is valid +- xen: move checks for e820 conflicts further up +- Revert "net: libwx: fix alloc msix vectors failed" +- drm/vmwgfx: Prevent unmapping active read buffers +- drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination +- mm: call the security_mmap_file() LSM hook in remap_file_pages() +- io_uring: check for presence of task_work rather than TIF_NOTIFY_SIGNAL +- io_uring/sqpoll: do not allow pinning outside of cpuset +- netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path +- netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS +- netfilter: nf_tables: Keep deleted flowtable hooks until after RCU +- net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled +- virtio_net: Fix mismatched buf address when unmapping for small packets +- bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave() +- net: qrtr: Update packets cloning when broadcasting +- tcp: check skb is non-NULL in tcp_rto_delta_us() +- net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL +- net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition +- net: xilinx: axienet: Fix packet counting +- net: xilinx: axienet: Schedule NAPI in two steps +- Revert "dm: requeue IO if mapping table not yet available" +- ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate() +- vhost_vdpa: assign irq bypass producer token correctly +- cxl/pci: Fix to record only non-zero ranges +- interconnect: icc-clk: Add missed num_nodes initialization +- coresight: tmc: sg: Do not leak sg_table +- serial: 8250: omap: Cleanup on error in request_irq +- driver core: Fix a potential null-ptr-deref in module_add_driver() +- dt-bindings: iio: asahi-kasei,ak8975: drop incorrect AK09116 compatible +- iio: magnetometer: ak8975: drop incorrect AK09116 compatible +- iio: magnetometer: ak8975: Convert enum->pointer for data in the match tables +- iio: chemical: bme680: Fix read/write ops to device by adding mutexes +- ABI: testing: fix admv8818 attr description +- driver core: Fix error handling in driver API device_rename() +- iio: adc: ad7606: fix standby gpio state to match the documentation +- iio: adc: ad7606: fix oversampling gpio array +- nvme-multipath: system fails to create generic nvme device +- spi: atmel-quadspi: Avoid overwriting delay register settings +- spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time +- spi: atmel-quadspi: Undo runtime PM changes at driver exit time +- f2fs: get rid of online repaire on corrupted directory +- f2fs: clean up w/ dotdot_name +- f2fs: prevent atomic file from being dirtied before commit +- f2fs: compress: don't redirty sparse cluster during {,de}compress +- f2fs: compress: do sanity check on cluster when CONFIG_F2FS_CHECK_FS is on +- f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread() +- f2fs: support .shutdown in f2fs_sops +- f2fs: atomic: fix to truncate pagecache before on-disk metadata truncation +- f2fs: fix to wait page writeback before setting gcing flag +- f2fs: Create COW inode from parent dentry for atomic write +- f2fs: fix to avoid racing in between read and OPU dio write +- f2fs: reduce expensive checkpoint trigger frequency +- f2fs: atomic: fix to avoid racing w/ GC +- crypto: powerpc/p10-aes-gcm - Disable CRYPTO_AES_GCM_P10 +- crypto: caam - Pad SG length when allocating hash edesc +- ntb: Force physically contiguous allocation of rx ring buffers +- ntb_perf: Fix printk format +- RDMA/irdma: fix error message in irdma_modify_qp_roce() +- RDMA/cxgb4: Added NULL check for lookup_atid +- riscv: Fix fp alignment bug in perf_callchain_user() +- RDMA/mlx5: Obtain upper net device only when needed +- watchdog: imx_sc_wdt: Don't disable WDT in suspend +- RDMA/mlx5: Limit usage of over-sized mkeys from the MR cache +- RDMA/erdma: Return QP state in erdma_query_qp +- PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port() +- IB/core: Fix ib_cache_setup_one error flow cleanup +- pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function +- nfsd: fix refcount leak when file is unhashed after being found +- nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire +- clk: rockchip: rk3588: Fix 32k clock name for pmu_24m_32k_100m_src_p +- clk: starfive: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage +- clk: ti: dra7-atl: Fix leak of of_nodes +- RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds +- RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer +- media: mediatek: vcodec: Fix H264 stateless decoder smatch warning +- media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning +- media: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning +- clk: at91: sama7g5: Allocate only the needed amount of memory for PLLs +- pinctrl: single: fix missing error code in pcs_probe() +- RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency +- media: platform: rzg2l-cru: rzg2l-csi2: Add missing MODULE_DEVICE_TABLE +- PCI: xilinx-nwl: Clean up clock on probe failure/removal +- PCI: xilinx-nwl: Fix register misspelling +- nvdimm: Fix devs leaks in scan_labels() +- x86/PCI: Check pcie_find_root_port() return for NULL +- leds: pca995x: Fix device child node usage in pca995x_probe() +- leds: pca995x: Use device_for_each_child_node() to access device child nodes +- leds: leds-pca995x: Add support for NXP PCA9956B +- clk: qcom: dispcc-sm8250: use special function for Lucid 5LPE PLL +- clk: qcom: ipq5332: Register gcc_qdss_tsctr_clk_src +- PCI: keystone: Fix if-statement expression in ks_pcie_quirk() +- firewire: core: correct range of block for case of switch statement +- PCI: Wait for Link before restoring Downstream Buses +- drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error +- Input: ilitek_ts_i2c - add report id message validation +- Input: ilitek_ts_i2c - avoid wrong input subsystem sync +- pinctrl: ti: ti-iodelay: Fix some error handling paths +- pinctrl: ti: iodelay: Use scope based of_node_put() cleanups +- pinctrl: Use device_get_match_data() +- pinctrl: ti: ti-iodelay: Convert to platform remove callback returning void +- leds: bd2606mvv: Fix device child node usage in bd2606mvv_probe() +- clk: qcom: dispcc-sm8550: use rcg2_shared_ops for ESC RCGs +- clk: qcom: dispcc-sm8650: Update the GDSC flags +- clk: qcom: dispcc-sm8550: use rcg2_ops for mdss_dptx1_aux_clk_src +- clk: qcom: dispcc-sm8550: fix several supposed typos +- clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228 +- remoteproc: imx_rproc: Initialize workqueue earlier +- remoteproc: imx_rproc: Correct ddr alias for i.MX8M +- clk: imx: imx8qxp: Parent should be initialized earlier than the clock +- clk: imx: imx8qxp: Register dc0_bypass0_clk before disp clk +- clk: imx: imx8mp: fix clock tree update of TF-A managed clocks +- clk: imx: fracn-gppll: fix fractional part of PLL getting lost +- clk: imx: composite-7ulp: Check the PCC present bit +- clk: imx: composite-93: keep root clock on when mcore enabled +- clk: imx: composite-8m: Enable gate clk with mcore_booted +- clk: imx: composite-8m: Less function calls in __imx8m_clk_hw_composite() after error detection +- clk: imx: imx6ul: fix default parent for enet*_ref_sel +- clk: imx: clk-audiomix: Correct parent clock for earc_phy and audpll +- nilfs2: fix potential oob read in nilfs_btree_check_delete() +- nilfs2: determine empty node blocks as corrupted +- nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() +- ext4: check stripe size compatibility on remount as well +- ext4: avoid OOB when system.data xattr changes underneath the filesystem +- ext4: return error on ext4_find_inline_entry +- ext4: avoid negative min_clusters in find_group_orlov() +- ext4: avoid potential buffer_head leak in __ext4_new_inode() +- ext4: avoid buffer_head leak in ext4_mark_inode_used() +- smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso +- ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard +- kthread: fix task state in kthread worker if being frozen +- xz: cleanup CRC32 edits from 2018 +- bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos +- samples/bpf: Fix compilation errors with cf-protection option +- selftests/bpf: Fix error compiling tc_redirect.c with musl libc +- selftests/bpf: Fix compile if backtrace support missing in libc +- selftests/bpf: Fix redefinition errors compiling lwt_reroute.c +- selftests/bpf: Fix flaky selftest lwt_redirect/lwt_reroute +- selftests/bpf: Fix C++ compile error from missing _Bool type +- selftests/bpf: Fix error compiling test_lru_map.c +- selftests/bpf: Fix arg parsing in veristat, test_progs +- selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc +- selftests/bpf: Fix errors compiling decap_sanity.c with musl libc +- selftests/bpf: Fix errors compiling lwt_redirect.c with musl libc +- selftests/bpf: Fix compiling core_reloc.c with musl-libc +- selftests/bpf: Fix compiling tcp_rtt.c with musl-libc +- selftests/bpf: Fix compiling flow_dissector.c with musl-libc +- selftests/bpf: Fix compiling kfree_skb.c with musl-libc +- selftests/bpf: Fix compiling parse_tcp_hdr_opt.c with musl-libc +- selftests/bpf: Fix include of <sys/fcntl.h> +- selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test +- selftests/bpf: Refactor out some functions in ns_current_pid_tgid test +- selftests/bpf: Replace CHECK with ASSERT_* in ns_current_pid_tgid test +- selftests/bpf: Fix missing BUILD_BUG_ON() declaration +- selftests/bpf: Fix missing UINT_MAX definitions in benchmarks +- selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c +- selftests/bpf: Drop unneeded error.h includes +- selftests/bpf: Implement get_hw_ring_size function to retrieve current and max interface size +- selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc +- selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c +- selftests/bpf: Use pid_t consistently in test_progs.c +- tools/runqslower: Fix LDFLAGS and add LDLIBS support +- selftests/bpf: Fix wrong binary in Makefile log output +- selftests/bpf: Add CFLAGS per source file and runner +- bpf: Temporarily define BPF_NO_PRESEVE_ACCESS_INDEX for GCC +- bpf: Disable some `attribute ignored' warnings in GCC +- bpf: Use -Wno-error in certain tests when building with GCC +- selftests/bpf: Fix error linking uprobe_multi on mips +- selftests/bpf: Workaround strict bpf_lsm return value check. +- tpm: Clean up TPM space after command failure +- xen/swiotlb: fix allocated size +- xen/swiotlb: add alignment check for dma buffers +- xen: tolerate ACPI NVS memory overlapping with Xen allocated memory +- xen: add capability to remap non-RAM pages to different PFNs +- xen: move max_pfn in xen_memory_setup() out of function scope +- xen: introduce generic helper checking for memory map conflicts +- minmax: avoid overly complex min()/max() macro arguments in xen +- ata: libata: Clear DID_TIME_OUT for ATA PT commands with sense data +- HID: wacom: Do not warn about dropped packets for first packet +- HID: wacom: Support sequence numbers smaller than 16-bit +- xen: use correct end address of kernel for conflict checking +- drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind() +- drm/msm: fix %s null argument error +- drm/msm/dsi: correct programming sequence for SM8350 / SM8450 +- ipmi: docs: don't advertise deprecated sysfs entries +- drm/msm/a5xx: workaround early ring-buffer emptiness check +- drm/msm/a5xx: fix races in preemption evaluation stage +- drm/msm/a5xx: properly clear preemption records on resume +- drm/msm/a5xx: disable preemption in submits by default +- drm/msm: Fix incorrect file name output in adreno_request_fw() +- powerpc/vdso: Inconditionally use CFUNC macro +- powerpc/8xx: Fix kernel vs user address comparison +- powerpc/8xx: Fix initial memory mapping +- drm/mediatek: Use spin_lock_irqsave() for CRTC event lock +- drm/mediatek: Fix missing configuration flags in mtk_crtc_ddp_config() +- jfs: fix out-of-bounds in dbNextAG() and diAlloc() +- scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del() +- drm/vc4: hdmi: Handle error case of pm_runtime_resume_and_get +- drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid() +- drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets +- drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode +- drm/rockchip: vop: Allow 4096px width scaling +- drm/amd/amdgpu: Properly tune the size of struct +- scsi: NCR5380: Check for phase match during PDMA fixup +- scsi: smartpqi: revert propagate-the-multipath-failure-to-SML-quickly +- drm/radeon: properly handle vbios fake edid sizing +- drm/amdgpu: properly handle vbios fake edid sizing +- drm/stm: ltdc: check memory returned by devm_kzalloc() +- drm/stm: Fix an error handling path in stm_drm_platform_probe() +- pmdomain: core: Harden inter-column space in debug summary +- iommu/arm-smmu-qcom: apply num_context_bank fixes for SDM630 / SDM660 +- iommu/arm-smmu-qcom: Work around SDM845 Adreno SMMU w/ 16K pages +- iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux +- mtd: rawnand: mtk: Fix init error path +- mtd: rawnand: mtk: Factorize out the logic cleaning mtk chips +- mtd: rawnand: mtk: Use for_each_child_of_node_scoped() +- rcu/nocb: Fix RT throttling hrtimer armed from offline CPU +- mtd: powernv: Add check devm_kasprintf() returned value +- iommu/amd: Do not set the D bit on AMD v2 table entries +- fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() +- power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense +- power: supply: axp20x_battery: Remove design from min and max voltage +- hwmon: (ntc_thermistor) fix module autoloading +- mtd: slram: insert break after errors in parsing the map +- hwmon: (max16065) Fix alarm attributes +- hwmon: (max16065) Remove use of i2c_match_id() +- hwmon: (max16065) Fix overflows seen when writing limits +- ASoC: loongson: fix error release +- m68k: Fix kernel_clone_args.flags in m68k_clone() +- ALSA: hda: cs35l41: fix module autoloading +- selftests/ftrace: Add required dependency for kprobe tests +- ASoC: tas2781-i2c: Get the right GPIO line +- ASoC: tas2781-i2c: Drop weird GPIO code +- ASoC: tas2781: Use of_property_read_reg() +- ASoC: tas2781: remove unused acpi_subysystem_id +- ASoC: rt5682s: Return devm_of_clk_add_hw_provider to transfer the error +- x86/mm: Use IPIs to synchronize LAM enablement +- arm64: dts: mediatek: mt8195: Correct clock order for dp_intf* +- clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init() +- reset: k210: fix OF node leak in probe() error path +- reset: berlin: fix OF node leak in probe() error path +- ARM: versatile: fix OF node leak in CPUs prepare +- ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property +- ARM: dts: microchip: sama7g5: Fix RTT clock +- spi: bcmbca-hsspi: Fix missing pm_runtime_disable() +- arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations +- arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations +- arm64: dts: rockchip: Correct vendor prefix for Hardkernel ODROID-M1 +- ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks +- arm64: dts: renesas: r9a07g044: Correct GICD and GICR sizes +- arm64: dts: renesas: r9a07g054: Correct GICD and GICR sizes +- arm64: dts: renesas: r9a07g043u: Correct GICD and GICR sizes +- regulator: Return actual error in of_regulator_bulk_get_all() +- spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ +- firmware: arm_scmi: Fix double free in OPTEE transport +- arm64: dts: mediatek: mt8186: Fix supported-hw mask for GPU OPPs +- arm64: dts: exynos: exynos7885-jackpotlte: Correct RAM amount to 4GB +- spi: ppc4xx: handle irq_of_parse_and_map() errors +- block: fix potential invalid pointer dereference in blk_add_partition +- block: print symbolic error name instead of error code +- io_uring/io-wq: inherit cpuset of cgroup in io worker +- io_uring/io-wq: do not allow pinning outside of cpuset +- block, bfq: fix procress reference leakage for bfqq in merge chain +- block, bfq: fix uaf for accessing waker_bfqq after splitting +- erofs: fix incorrect symlink detection in fast symlink +- cachefiles: Fix non-taking of sb_writers around set/removexattr +- block, bfq: don't break merge chain in bfq_split_bfqq() +- block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() +- block, bfq: fix possible UAF for bfqq->bic with merge chain +- nbd: fix race between timeout and normal completion +- ublk: move zone report data out of request pdu +- ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() +- net: tipc: avoid possible garbage value +- net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input +- r8169: disable ALDPS per default for RTL8125 +- net: enetc: Use IRQF_NO_AUTOEN flag in request_irq() +- bareudp: Pull inner IP header on xmit. +- bareudp: Pull inner IP header in bareudp_udp_encap_recv(). +- Bluetooth: btusb: Fix not handling ZPL/short-transfer +- can: m_can: m_can_close(): stop clocks after device has been shut down +- can: m_can: enable NAPI before enabling interrupts +- sock_map: Add a cond_resched() in sock_hash_free() +- Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL +- Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED +- wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param +- wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() +- wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors +- wifi: mt76: mt7996: fix uninitialized TLV data +- wifi: mt76: mt7996: ensure 4-byte alignment for beacon commands +- wifi: mt76: mt7915: fix rx filter setting for bfee functionality +- wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan() +- wifi: mt76: mt7603: fix mixed declarations and code +- crypto: hisilicon/qm - inject error before stopping queue +- pm:cpupower: Add missing powercap_set_enabled() stub function +- x86/sgx: Fix deadlock in SGX NUMA node search +- wifi: mt76: mt7996: fix EHT beamforming capability check +- wifi: mt76: mt7996: fix HE and EHT beamforming capabilities +- wifi: mt76: mt7996: fix wmm set of station interface to 3 +- wifi: mt76: mt7996: fix traffic delay when switching back to working channel +- wifi: mt76: mt7996: use hweight16 to get correct tx antenna +- wifi: mt76: mt7915: fix oops on non-dbdc mt7986 +- cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately +- perf/arm-cmn: Ensure dtm_idx is big enough +- perf/arm-cmn: Fix CCLA register offset +- perf/arm-cmn: Refactor node ID handling. Again. +- perf/arm-cmn: Improve debugfs pretty-printing for large configs +- perf/arm-cmn: Rework DTC counters (again) +- netfilter: nf_tables: remove annotation to access set timeout while holding lock +- netfilter: nf_tables: reject expiration higher than timeout +- netfilter: nf_tables: reject element expiration with no timeout +- netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire +- ACPI: CPPC: Fix MASK_VAL() usage +- can: j1939: use correct function name in comment +- kselftest/arm64: Actually test SME vector length changes via sigreturn +- padata: Honor the caller's alignment in case of chunk_size 0 +- wifi: iwlwifi: mvm: increase the time between ranging measurements +- wifi: iwlwifi: config: label 'gl' devices as discrete +- wifi: iwlwifi: remove AX101, AX201 and AX203 support from LNL +- wifi: mac80211: don't use rate mask for offchannel TX either +- kselftest/arm64: signal: fix/refactor SVE vector length enumeration +- powercap: intel_rapl: Fix off by one in get_rpi() +- ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros +- mount: handle OOM on mnt_warn_timestamp_expiry +- RISC-V: KVM: Fix to allow hpmcounter31 from the guest +- RISC-V: KVM: Allow legacy PMU access from guest +- RISC-V: KVM: Fix sbiret init before forwarding to userspace +- wifi: rtw88: remove CPT execution branch never used +- arm64: signal: Fix some under-bracketed UAPI macros +- wifi: ath12k: fix invalid AMPDU factor calculation in ath12k_peer_assoc_h_he() +- wifi: ath12k: match WMI BSS chan info structure with firmware definition +- wifi: ath12k: fix BSS chan info request WMI command +- wifi: ath9k: Remove error checks when creating debugfs entries +- wifi: brcmfmac: introducing fwil query functions +- wifi: brcmfmac: export firmware interface functions +- ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe() +- crypto: xor - fix template benchmarking +- wifi: rtw88: always wait for both firmware loading attempts +- EDAC/synopsys: Fix error injection on Zynq UltraScale+ +- EDAC/synopsys: Fix ECC status and IRQ control race condition +- !12612 Hygon model 4h~fh and 10h ATL issue fix +- EDAC/amd64: Don't use the ATL for Hygon model 4h~fh and 10h processors +- !12464 f2fs: fix to don't set SB_RDONLY in f2fs_handle_critical_error() +- f2fs: fix to don't set SB_RDONLY in f2fs_handle_critical_error() +- !12584 drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func +- drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func +- !12461 NFSD: Limit the number of concurrent async COPY operations +- NFSD: Limit the number of concurrent async COPY operations +- !12559 fix CVE-2024-49900 +- jfs: Fix uninit-value access of new_ea in ea_buffer +- !12462 drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation +- drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation +- !12455 drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func +- drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func +- !12448 drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer +- drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer +- !12443 drm/amd/display: Fix index out of bounds in DCN30 color transformation +- drm/amd/display: Fix index out of bounds in DCN30 color transformation +- !12533 drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer +- drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer +- !12065 Fix VMAPP/VMOVP races +- irqchip/gic-v4: Fix ordering between vmapp and vpe locks +- irqchip/gic-v4: Make sure a VPE is locked when VMAPP is issued +- irqchip/gic-v4: Substitute vmovp_lock for a per-VM lock +- irqchip/gic-v4: Always configure affinity on VPE activation +- !12400 drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error +- drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error +- !12429 jfs: Fix uaf in dbFreeBits +- jfs: Fix uaf in dbFreeBits +- !12428 jfs: check if leafidx greater than num leaves per dmap tree +- jfs: check if leafidx greater than num leaves per dmap tree +- !12426 btrfs: fix a NULL pointer dereference when failed to start a new trasacntion +- btrfs: fix a NULL pointer dereference when failed to start a new trasacntion +- !12427 btrfs: wait for fixup workers before stopping cleaner kthread during umount +- btrfs: wait for fixup workers before stopping cleaner kthread during umount +- !12524 netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() +- netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() +- !12515 drm/amd/display: Validate function returns +- drm/amd/display: Validate function returns +- !12365 x86/ioapic: Handle allocation failures gracefully +- x86/ioapic: Handle allocation failures gracefully +- !12361 cpufreq: Avoid a bad reference count on CPU node +- cpufreq: Avoid a bad reference count on CPU node +- !12476 fix CVE-2024-40965 +- i2c: lpi2c: Avoid calling clk_get_rate during transfer +- clk: Provide !COMMON_CLK dummy for devm_clk_rate_exclusive_get() +- clk: Add a devm variant of clk_rate_exclusive_get() +- !12300 [OLK-6.6] AMD Address Translation Library (ATL) patches +- RAS/AMD/ATL: Fix MI300 bank hash +- RAS/AMD/ATL: Use system settings for MI300 DRAM to normalized address translation +- RAS/AMD/ATL: Fix array overflow in get_logical_coh_st_fabric_id_mi300() +- RAS/AMD/ATL: Fix bit overflow in denorm_addr_df4_np2() +- RAS: Avoid build errors when CONFIG_DEBUG_FS=n +- RAS/AMD/FMPM: Use atl internal.h for INVALID_SPA +- RAS/AMD/FMPM: Safely handle saved records of various sizes +- RAS/AMD/FMPM: Avoid NULL ptr deref in get_saved_records() +- RAS/AMD/FMPM: Fix off by one when unwinding on error +- RAS/AMD/FMPM: Add debugfs interface to print record entries +- RAS/AMD/FMPM: Save SPA values +- RAS: Introduce a FRU memory poison manager +- RAS/AMD/ATL: Implement DF 4.5 NP2 denormalization +- RAS/AMD/ATL: Validate address map when information is gathered +- RAS/AMD/ATL: Expand helpers for adding and removing base and hole +- RAS/AMD/ATL: Read DRAM hole base early +- RAS/AMD/ATL: Add amd_atl pr_fmt() prefix +- EDAC/amd64: Use new AMD Address Translation Library +- RAS: Export helper to get ras_debugfs_dir +- RAS/AMD/ATL: Add MI300 row retirement support +- RAS/AMD/ATL: Add MI300 DRAM to normalized address translation support +- RAS/AMD/ATL: Add MI300 support +- RAS: Introduce AMD Address Translation Library +- !12440 CVE-2024-35964 +- Bluetooth: ISO: Fix not validating setsockopt user input +- !12438 CVE-2024-35949 +- btrfs: make sure that WRITTEN is set on all metadata blocks +- !12410 iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault() +- iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault() +- !12389 mm/swapfile: skip HugeTLB pages for unuse_vma +- mm/swapfile: skip HugeTLB pages for unuse_vma +- !12363 md: use RCU lock to protect traversal in md_spares_need_change() +- md: use RCU lock to protect traversal in md_spares_need_change() +- !12351 i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume +- i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume +- !12394 tracing/timerlat: Fix a race during cpuhp processing +- tracing/timerlat: Fix a race during cpuhp processing +- !12397 tracing/timerlat: Drop interface_lock in stop_kthread() +- tracing/timerlat: Drop interface_lock in stop_kthread() +- !12399 wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he +- wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he +- !12390 RDMA/hns: Fix missing spin_lock_init() for qp flush lock +- RDMA/hns: Fix missing spin_lock_init() for qp flush lock +- !12273 drm/amdgpu: fix mc_data out-of-bounds read warning +- drm/amdgpu: fix mc_data out-of-bounds read warning +- !12263 drm/amd/display: Avoid overflow from uint32_t to uint8_t +- drm/amd/display: Avoid overflow from uint32_t to uint8_t +- !12288 [OLK-6.6] AMD Turin perf vendor event patches +- perf vendor events amd: Add Zen 5 mapping +- perf vendor events amd: Add Zen 5 metrics +- perf vendor events amd: Add Zen 5 uncore events +- perf vendor events amd: Add Zen 5 core events +- tracing: Add the ::microcode field to the mce_record tracepoint +- tracing: Add the ::ppin field to the mce_record tracepoint +- x86/mce: Clean up TP_printk() output line of the 'mce_record' tracepoint +- !12322 LoongArch: fix dma-direct.h not found +- LoongArch: fix dma-direct.h not found +- !12293 nfsd: return -EINVAL when namelen is 0 +- nfsd: return -EINVAL when namelen is 0 +- !12335 ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() +- ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() +- !12338 drm/amd/display: Add NULL pointer check for kzalloc +- drm/amd/display: Add NULL pointer check for kzalloc +- !12317 nfsd: call cache_put if xdr_reserve_space returns NULL +- nfsd: call cache_put if xdr_reserve_space returns NULL +- !12066 drm/amd/display: added NULL check at start of dc_validate_stream +- drm/amd/display: added NULL check at start of dc_validate_stream + +* Wed Oct 23 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-47.0.0.52 +- !12168 crypto: stm32/cryp - call finalize with bh disabled +- crypto: stm32/cryp - call finalize with bh disabled +- !11502 Virtcca feature: modify vfio/msi/iommu driver to enable confidential device assignment +- virtcca feature: msi place modify +- virtcca feature: fix msi iova map +- virtcca feature: extract the function to the virtcca_coda.c file +- virtcca feature: read or write msi forwarding to the secure world +- virtcca feature: read or write bar space forwarding to the secure world +- virtcca feature: read or write config space forwarding to secure world +- virtcca feature: activate confidential vm to set security device s_s2ttbr +- virtcca feature: set device security properties +- virtcca feature: secure device page fault +- virtcca feature: vfio driver dma map +- virtcca feature: bind the kvm handle of cvm with smmu domain +- virtcca feature: vfio attach the device list to secure world +- !12304 btrfs: fix race setting file private on concurrent lseek using same fd +- btrfs: fix race setting file private on concurrent lseek using same fd +- !12314 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.52-6.6.53 LTS Patches +- USB: serial: pl2303: add device id for Macrosilicon MS3020 +- can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into mcp251xfd_chip_start/stop() +- can: mcp251xfd: properly indent labels +- x86/mm: Switch to new Intel CPU model defines +- nvme-pci: qdepth 1 quirk +- gpiolib: cdev: Ignore reconfiguration without direction +- Revert "wifi: cfg80211: check wiphy mutex is held for wdev mutex" +- netfilter: nf_tables: missing iterator type in lookup walk +- netfilter: nft_set_pipapo: walk over current view on netlink dump +- netfilter: nft_socket: Fix a NULL vs IS_ERR() bug in nft_socket_cgroup_subtree_level() +- netfilter: nft_socket: make cgroupsv2 matching work with namespaces +- powercap/intel_rapl: Add support for AMD family 1Ah +- drm: Expand max DRM device number to full MINORBITS +- accel: Use XArray instead of IDR for minors +- drm: Use XArray instead of IDR for minors +- spi: spidev: Add missing spi_device_id for jg10309-01 +- block: Fix where bio IO priority gets set +- tools: hv: rm .*.cmd when make clean +- x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency +- smb: client: fix hang in wait_for_response() for negproto +- spi: bcm63xx: Enable module autoloading +- drm: komeda: Fix an issue related to normalized zpos +- ALSA: hda: add HDMI codec ID for Intel PTL +- ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK) +- spi: spidev: Add an entry for elgin,jg10309-01 +- ASoC: fix module autoloading +- ASoC: tda7419: fix module autoloading +- ASoC: google: fix module autoloading +- ASoC: intel: fix module autoloading +- ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI match less strict +- can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing configuration +- wifi: iwlwifi: clear trans->state earlier upon error +- wifi: mac80211: free skb on error path in ieee80211_beacon_get_ap() +- wifi: iwlwifi: mvm: pause TCM when the firmware is stopped +- wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room() +- wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation +- wifi: iwlwifi: lower message level for FW buffer destination +- LoongArch: Define ARCH_IRQ_INIT_FLAGS as IRQ_NOPROBE +- net: ftgmac100: Ensure tx descriptor updates are visible +- platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F DMI match less strict +- microblaze: don't treat zero reserved memory regions as error +- hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING +- pinctrl: at91: make it work with current gpiolib +- scsi: lpfc: Fix overflow build issue +- ALSA: hda/realtek - FIxed ALC285 headphone no sound +- ALSA: hda/realtek - Fixed ALC256 headphone no sound +- ASoC: allow module autoloading for table board_ids +- ASoC: allow module autoloading for table db1200_pids +- ASoC: mediatek: mt8188: Mark AFE_DAC_CON0 register as volatile +- ASoC: SOF: mediatek: Add missing board compatible +- !12151 nfc: pn533: Add poll mod list filling check +- nfc: pn533: Add poll mod list filling check +- !12141 drm/vmwgfx: Fix prime with external buffers +- drm/vmwgfx: Fix prime with external buffers +- !12129 bpf: Remove tst_run from lwt_seg6local_prog_ops. +- bpf: Remove tst_run from lwt_seg6local_prog_ops. +- !12296 drivers/perf: Fix ali_drw_pmu driver interrupt status clearing +- drivers/perf: Fix ali_drw_pmu driver interrupt status clearing +- !12200 CVE-2024-38608 +- net/mlx5e: Fix netif state handling +- net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args +- !12201 netfilter: nf_tables: use timestamp to check for set element timeout +- netfilter: nf_tables: use timestamp to check for set element timeout +- !12295 i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup +- i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup +- !12306 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.51-6.6.52 LTS Patches +- riscv: dts: starfive: add assigned-clock* to limit frquency +- pinctrl: meteorlake: Add Arrow Lake-H/U ACPI ID +- cifs: Fix signature miscalculation +- ASoC: codecs: avoid possible garbage value in peb2466_reg_read() +- drm/i915/guc: prevent a possible int overflow in wq offsets +- spi: geni-qcom: Fix incorrect free_irq() sequence +- spi: geni-qcom: Undo runtime PM changes at driver exit time +- drm/amd/amdgpu: apply command submission parser for JPEG v1 +- drm/amdgpu/atomfirmware: Silence UBSAN warning +- drm/nouveau/fb: restore init() for ramgp102 +- drm/syncobj: Fix syncobj leak in drm_syncobj_eventfd_ioctl +- soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps" +- spi: nxp-fspi: fix the KASAN report out-of-bounds bug +- tracing/osnoise: Fix build when timerlat is not enabled +- net: dsa: felix: ignore pending status of TAS module when it's disabled +- selftests: net: csum: Fix checksums for packets with non-zero padding +- net: ftgmac100: Enable TX interrupt to avoid TX timeout +- octeontx2-af: Modify SMQ flush sequence to drop packets +- fou: fix initialization of grc +- net/mlx5: Verify support for scheduling element and TSAR type +- net/mlx5: Correct TASR typo into TSAR +- net/mlx5: Add missing masks and QoS bit masks for scheduling elements +- net/mlx5: Explicitly set scheduling element and TSAR type +- net/mlx5e: Add missing link mode to ptys2ext_ethtool_map +- IB/mlx5: Rename 400G_8X speed to comply to naming convention +- net/mlx5e: Add missing link modes to ptys2ethtool_map +- net/mlx5: Update the list of the PCI supported devices +- igb: Always call igb_xdp_ring_update_tail() under Tx lock +- ice: fix VSI lists confusion when adding VLANs +- ice: fix accounting for filters shared by multiple VSIs +- ice: Fix lldp packets dropping after changing the number of channels +- hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev >= 1.2 +- selftests/bpf: Support SOCK_STREAM in unix_inet_redir_to_connected() +- cxl/core: Fix incorrect vendor debug UUID define +- eeprom: digsy_mtc: Fix 93xx46 driver probe failure +- drm/amd/display: Fix FEC_READY write on DP LT +- drm/amd/display: Disable error correction if it's not supported +- arm64: dts: rockchip: fix PMIC interrupt pin in pinctrl for ROCK Pi E +- net: xilinx: axienet: Fix race in axienet_stop +- mm: avoid leaving partial pfn mappings around in error case +- x86/hyperv: fix kexec crash due to VP assist page corruption +- dm-integrity: fix a race condition when accessing recalc_sector +- net: tighten bad gso csum offset check in virtio_net_hdr +- minmax: reduce min/max macro expansion in atomisp driver +- arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma +- arm64: dts: rockchip: fix eMMC/SPI corruption when audio has been used on RK3399 Puma +- selftests: mptcp: join: restrict fullmesh endp on 1st sf +- platform/x86: panasonic-laptop: Allocate 1 entry extra in the sinf array +- NFS: Avoid unnecessary rescanning of the per-server delegation list +- NFSv4: Fix clearing of layout segments in layoutreturn +- smb/server: fix return value of smb2_open() +- Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table +- drm/msm/adreno: Fix error return if missing firmware-name +- platform/surface: aggregator_registry: Add support for Surface Laptop Go 3 +- platform/surface: aggregator_registry: Add Support for Surface Pro 10 +- scripts: kconfig: merge_config: config files: add a trailing newline +- HID: multitouch: Add support for GT7868Q +- Input: synaptics - enable SMBus for HP Elitebook 840 G2 +- Input: ads7846 - ratelimit the spi_sync error message +- btrfs: update target inode's ctime on unlink +- wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change +- powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL +- net: phy: vitesse: repair vsc73xx autonegotiation +- drm: panel-orientation-quirks: Add quirk for Ayn Loki Max +- drm: panel-orientation-quirks: Add quirk for Ayn Loki Zero +- net: ethernet: use ip_hdrlen() instead of bit shift +- usbnet: ipheth: fix carrier detection in modes 1 and 4 +- usbnet: ipheth: do not stop RX on failing RX callback +- usbnet: ipheth: drop RX URBs with no payload +- usbnet: ipheth: remove extraneous rx URB length check +- ksmbd: override fsids for smb2_query_info() +- ksmbd: override fsids for share path check +- nvmem: u-boot-env: error if NVMEM device is too small +- nvmem: u-boot-env: improve coding style +- nvmem: u-boot-env: use nvmem device helpers +- nvmem: u-boot-env: use nvmem_add_one_cell() nvmem subsystem helper +- nvmem: core: add nvmem_dev_size() helper +- iio: adc: ad7124: fix DT configuration parsing +- iio: adc: ad7124: Switch from of specific to fwnode based property handling +- device property: Introduce device_for_each_child_node_scoped() +- device property: Add cleanup.h based fwnode_handle_put() scope based cleanup. +- !12301 bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() +- bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() +- !12291 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.50-6.6.51 LTS Patches +- Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync +- Bluetooth: hci_sync: Fix UAF on create_le_conn_complete +- Bluetooth: hci_sync: Fix UAF in hci_acl_create_conn_sync +- spi: spi-fsl-lpspi: Fix off-by-one in prescale max +- x86/mm: Fix PTI for i386 some more +- membarrier: riscv: Add full memory barrier in switch_mm() +- ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery() +- riscv: Do not restrict memory size because of linear mapping on nommu +- riscv: Fix toolchain vector detection +- gpio: modepin: Enable module autoloading +- gpio: rockchip: fix OF node leak in probe() +- drm/i915/fence: Mark debug_fence_free() with __maybe_unused +- drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused +- clk: qcom: gcc-sm8550: Don't park the USB RCG at registration time +- clk: qcom: gcc-sm8550: Don't use parking clk_ops for QUPs +- ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode +- ASoc: SOF: topology: Clear SOF link platform name upon unload +- nvme-pci: allocate tagset on reset if necessary +- ASoC: tegra: Fix CBB error during probe() +- powerpc/vdso: Don't discard rela sections +- powerpc/64e: Define mmu_pte_psize static +- powerpc/64e: split out nohash Book3E 64-bit code +- powerpc/64e: remove unused IBM HTW code +- clk: qcom: ipq9574: Update the alpha PLL type for GPLLs +- crypto: starfive - Fix nent assignment in rsa dec +- crypto: starfive - Align rsa input data to 32-bit +- ata: libata-scsi: Check ATA_QCFLAG_RTF_FILLED before using result_tf +- ata: libata-scsi: Remove redundant sense_buffer memsets +- drm/amdgpu: handle gfx12 in amdgpu_display_verify_sizes +- drm/amd: Add gfx12 swizzle mode defs +- can: mcp251xfd: rx: add workaround for erratum DS80000789E 6 of mcp2518fd +- can: mcp251xfd: clarify the meaning of timestamp +- can: mcp251xfd: rx: prepare to workaround broken RX FIFO head index erratum +- can: mcp251xfd: mcp251xfd_handle_rxif_ring_uinc(): factor out in separate function +- ACPI: processor: Fix memory leaks in error paths of processor_add() +- ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add() +- workqueue: Improve scalability of workqueue watchdog touch +- workqueue: wq_watchdog_touch is always called with valid CPU +- Revert "mm: skip CMA pages when they are not available" +- mm/vmscan: use folio_migratetype() instead of get_pageblock_migratetype() +- uprobes: Use kzalloc to allocate xol area +- clocksource/drivers/timer-of: Remove percpu irq related code +- clocksource/drivers/imx-tpm: Fix next event not taking effect sometime +- clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX +- Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic +- nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc +- usb: dwc3: Avoid waking up gadget during startxfer +- usb: cdns2: Fix controller reset issue +- usb: dwc3: core: update LC timer as per USB Spec V3.2 +- iio: adc: ad7124: fix chip ID mismatch +- iio: adc: ad7606: remove frstdata check for serial mode +- iio: adc: ad7124: fix config comparison +- iio: fix scale application in iio_convert_raw_to_processed_unlocked +- iio: buffer-dmaengine: fix releasing dma channel on error +- staging: iio: frequency: ad9834: Validate frequency parameter value +- intel: legacy: Partial revert of field get conversion +- tcp: process the 3rd ACK with sk_socket for TFO/MPTCP +- cpufreq: amd-pstate: fix the highest frequency issue which limits performance +- cpufreq: amd-pstate: Enable amd-pstate preferred core support +- ACPI: CPPC: Add helper to get the highest performance value +- riscv: Use accessors to page table entries instead of direct dereference +- riscv: mm: Only compile pgtable.c if MMU +- mm: Introduce pudp/p4dp/pgdp_get() functions +- riscv: Use WRITE_ONCE() when setting page table entries +- NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations +- ata: pata_macio: Use WARN instead of BUG +- spi: spi-fsl-lpspi: limit PRESCALE bit in TCR register +- MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed +- lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() +- of/irq: Prevent device address out-of-bounds read in interrupt map walk +- usbnet: ipheth: race between ipheth_close and error handling +- s390/vmlinux.lds.S: Move ro_after_init section behind rodata section +- btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry() +- kselftests: dmabuf-heaps: Ensure the driver name is null-terminated +- i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup +- i3c: master: svc: resend target address when get NACK +- vfs: Fix potential circular locking through setxattr() and removexattr() +- regmap: maple: work around gcc-14.1 false-positive warning +- LoongArch: Use correct API to map cmdline in relocate_kernel() +- net: dpaa: avoid on-stack arrays of NR_CPUS elements +- Bluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush() +- tcp: Don't drop SYN+ACK for simultaneous connect(). +- riscv: set trap vector earlier +- cxl/region: Verify target positions using the ordered target list +- btrfs: replace BUG_ON with ASSERT in walk_down_proc() +- fs/ntfs3: Check more cases when directory is corrupted +- smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu() +- drm/amdgpu: reject gang submit on reserved VMIDs +- dma-mapping: benchmark: Don't starve others when doing the test +- ext4: fix possible tid_t sequence overflows +- drm/amdgpu: Set no_hw_access when VF request full GPU fails +- libbpf: Add NULL checks to bpf_object__{prev_map,next_map} +- ASoc: TAS2781: replace beXX_to_cpup with get_unaligned_beXX for potentially broken alignment +- hwmon: (nct6775-core) Fix underflows seen when writing limit attributes +- crypto: qat - fix unintentional re-enabling of error interrupts +- scsi: pm80xx: Set phy->enable_completion only when we wait for it +- virtio_ring: fix KMSAN error for premapped mode +- devres: Initialize an uninitialized struct member +- cgroup: Protect css->cgroup write under css_set_lock +- iommu/vt-d: Handle volatile descriptor status read +- dm init: Handle minors larger than 255 +- ASoC: topology: Properly initialize soc_enum values +- phy: zynqmp: Take the phy mutex in xlate +- firmware: cs_dsp: Don't allow writes to read-only controls +- xen: privcmd: Fix possible access to a freed kirqfd instance +- selftests: net: enable bind tests +- net: dsa: vsc73xx: fix possible subblocks range of CAPT block +- net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN +- r8152: fix the firmware doesn't work +- fou: Fix null-ptr-deref in GRO. +- bareudp: Fix device stats updates. +- bpf, net: Fix a potential race in do_sock_getsockopt() +- net/socket: Break down __sys_getsockopt +- net/socket: Break down __sys_setsockopt +- bpf: Add sockptr support for setsockopt +- bpf: Add sockptr support for getsockopt +- usbnet: modern method to get random MAC +- ice: do not bring the VSI up, if it was down before the XDP setup +- ice: protect XDP configuration with a mutex +- igc: Unlock on error in igc_io_resume() +- Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT +- Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once +- Bluetooth: hci_sync: Attempt to dequeue connection attempt +- Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue +- Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync +- Bluetooth: Remove pending ACL connection attempts +- Bluetooth: hci_conn: Only do ACL connections sequentially +- Bluetooth: hci_event: Use HCI error defines instead of magic values +- Bluetooth: qca: If memdump doesn't work, re-enable IBS +- can: kvaser_pciefd: Use a single write when releasing RX buffers +- can: kvaser_pciefd: Move reset of DMA RX buffers to the end of the ISR +- can: kvaser_pciefd: Rename board_irq to pci_irq +- can: kvaser_pciefd: Remove unnecessary comment +- can: kvaser_pciefd: Skip redundant NULL pointer check in ISR +- regulator: core: Stub devm_regulator_bulk_get_const() if !CONFIG_REGULATOR +- platform/x86: dell-smbios: Fix error path in dell_smbios_init() +- ice: Add netif_device_attach/detach into PF reset flow +- igb: Fix not clearing TimeSync interrupts for 82580 +- cifs: Fix FALLOC_FL_ZERO_RANGE to preflush buffered part of target region +- rust: kbuild: fix export of bss symbols +- rust: Use awk instead of recent xargs +- can: mcp251xfd: fix ring configuration when switching from CAN-CC to CAN-FD mode +- can: m_can: Release irq on error in m_can_open +- drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6 +- pcmcia: Use resource_size function on resource object +- media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse +- Input: ili210x - use kvmalloc() to allocate buffer for firmware update +- PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) +- ice: Check all ice_vsi_rebuild() errors in function +- vfio/spapr: Always clear TCEs before unsetting the window +- media: vivid: don't set HDMI TX controls if there are no HDMI outputs +- drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts +- drm/amdgpu: Fix smatch static checker warning +- drm/amd/display: Check HDCP returned status +- usb: uas: set host status byte on data completion error +- wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3 +- leds: spi-byte: Call of_node_put() on error path +- media: vivid: fix wrong sizeimage value for mplane +- riscv: kprobes: Use patch_text_nosync() for insn slots +- fs/ntfs3: One more reason to mark inode bad +- wifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check +- netfilter: nf_conncount: fix wrong variable type +- iommu: sun50i: clear bypass register +- x86/kmsan: Fix hook for unaligned accesses +- af_unix: Remove put_pid()/put_cred() in copy_peercred(). +- irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 +- accel/habanalabs/gaudi2: unsecure edma max outstanding register +- bpf, verifier: Correct tail_call_reachable for bpf prog +- smack: unix sockets: fix accept()ed socket label +- wifi: ath12k: fix uninitialize symbol error on ath12k_peer_assoc_h_he() +- ALSA: hda: Add input value sanity checks to HDMI channel map controls +- ALSA: control: Apply sanity check of input values for user elements +- drm/i915: Do not attempt to load the GSC multiple times +- nilfs2: fix state management in error path of log writing function +- sched: sch_cake: fix bulk flow accounting logic for host fairness +- ila: call nf_unregister_net_hooks() sooner +- tcp_bpf: fix return value of tcp_bpf_sendmsg() +- Revert "drm/amdgpu: align pp_power_profile_mode with kernel docs" +- x86/apic: Make x2apic_disable() work correctly +- x86/fpu: Avoid writing LBR bit to IA32_XSS unless supported +- net: mctp-serial: Fix missing escapes on transmit +- tracing/timerlat: Add interface_lock around clearing of kthread in stop_kthread() +- tracing: Avoid possible softlockup in tracing_iter_reset() +- tracing/timerlat: Only clear timer if a kthread exists +- mm: vmalloc: ensure vmap_block is initialised before adding to queue +- kexec_file: fix elfcorehdr digest exclusion when CONFIG_CRASH_HOTPLUG=y +- clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API +- clk: qcom: clk-alpha-pll: Fix the pll post div mask +- clk: starfive: jh7110-sys: Add notifier for PLL0 clock +- fuse: fix memory leak in fuse_create_open +- fuse: use unsigned type for getxattr/listxattr size truncation +- fuse: update stats for pages in dropped aux writeback list +- mmc: cqhci: Fix checking of CQHCI_HALT state +- mmc: sdhci-of-aspeed: fix module autoloading +- mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K +- mmc: core: apply SD quirks earlier during probe +- Bluetooth: MGMT: Ignore keys being loaded with invalid type +- Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE" +- rust: macros: provide correct provenance when constructing THIS_MODULE +- rust: types: Make Opaque::get const +- nvme-pci: Add sleep quirk for Samsung 990 Evo +- x86/kaslr: Expose and use the end of the physical memory address space +- irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init() +- x86/tdx: Fix data leak in mmio_read() +- ksmbd: Unlock on in ksmbd_tcp_set_interfaces() +- ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx +- ALSA: hda/realtek: add patch for internal mic in Lenovo V145 +- ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices +- KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is missing +- KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE +- net: microchip: vcap: Fix use-after-free error in kunit test +- !12289 CVE-2024-46691 +- usb: typec: ucsi: Move unregister out of atomic section +- !12223 [sync] PR-11910: ext4: dax: Fix inconsistent isize during writing +- ext4: dax: keep orphan list before truncate overflow allocated blocks +- ext4: dax: fix overflowing extents beyond inode size when partially writing +- !12146 mm: page_cache_ra_order: Restore 'PF_MEMALLOC_NOFS' flag in 'fallback' branch +- mm: page_cache_ra_order: Restore 'PF_MEMALLOC_NOFS' flag in 'fallback' branch +- !12090 USB: usbtmc: prevent kernel-usb-infoleak +- USB: usbtmc: prevent kernel-usb-infoleak +- !12286 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.49-6.6.50 LTS Patches +- i2c: Use IS_REACHABLE() for substituting empty ACPI functions +- virtio_net: Fix napi_skb_cache_put warning +- media: uvcvideo: Enforce alignment of frame and interval +- drm/amd/display: Check BIOS images before it is used +- drm/amd/display: use preferred link settings for dp signal only +- drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX +- drm/amd/display: added NULL check at start of dc_validate_stream +- drm/amd/display: Don't use fsleep for PSR exit waits on dmub replay +- drm/amdgpu: add lock in kfd_process_dequeue_from_device +- drm/amdgpu: add lock in amdgpu_gart_invalidate_tlb +- drm/amdgpu: add skip_hw_access checks for sriov +- block: remove the blk_flush_integrity call in blk_integrity_unregister +- f2fs: fix to do sanity check on blocks for inline_data inode +- wifi: cfg80211: make hash table duplicates more survivable +- dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor +- dmaengine: altera-msgdma: use irq variant of spin_lock/unlock while invoking callbacks +- gfs2: Revert "Add quota_change type" +- crypto: stm32/cryp - call finalize with bh disabled +- drm/meson: plane: Add error handling +- platform/chrome: cros_ec_lpc: MEC access can use an AML mutex +- smack: tcp: ipv4, fix incorrect labeling +- regmap: spi: Fix potential off-by-one when calculating reserved size +- drm/amdgu: fix Unintentional integer overflow for mall size +- net: remove NULL-pointer net parameter in ip_metrics_convert +- fsnotify: clear PARENT_WATCHED flags lazily +- usb: typec: ucsi: Fix null pointer dereference in trace +- usbip: Don't submit special requests twice +- media: v4l2-cci: Always assign *val +- rcu/nocb: Remove buggy bypass lock contention mitigation +- pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode. +- ionic: fix potential irq name truncation +- RDMA/efa: Properly handle unexpected AQ completions +- soc: qcom: smem: Add qcom_smem_bust_hwspin_lock_by_host() +- hwspinlock: Introduce hwspin_lock_bust() +- wifi: mac80211: check ieee80211_bss_info_change_notify() against MLD +- PCI: al: Check IORESOURCE_BUS existence during probe +- cpufreq: scmi: Avoid overflow of target_freq in fast switch +- wifi: iwlwifi: remove fw_running op +- drm/amdgpu: update type of buf size to u32 for eeprom functions +- drm/kfd: Correct pinned buffer handling at kfd restore and validate process +- wifi: rtw89: ser: avoid multiple deinit on same CAM +- drm/amd/pm: check negtive return for table entries +- drm/amd/pm: check specific index for smu13 +- drm/amd/pm: check specific index for aldebaran +- drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs +- wifi: ath11k: initialize 'ret' in ath11k_qmi_load_file_target_mem() +- wifi: ath12k: initialize 'ret' in ath12k_qmi_load_file_target_mem() +- drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device +- drm/amdgpu: fix mc_data out-of-bounds read warning +- drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number +- drm/amdkfd: Check debug trap enable before write dbg_ev_file +- drm/amdgpu: Fix the uninitialized variable warning +- drm/amdgpu/pm: Fix uninitialized variable agc_btc_response +- drm/amdgpu/pm: Fix uninitialized variable warning for smu10 +- drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt +- drm/amd/amdgpu: Check tbo resource pointer +- drm/amd/display: Fix Coverity INTEGER_OVERFLOW within decide_fallback_link_setting_max_bw_policy +- drm/amd/display: Spinlock before reading event +- drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create +- drm/amd/display: Fix Coverity INTERGER_OVERFLOW within construct_integrated_info +- drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] +- drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 +- drm/amdgpu: avoid reading vf2pf info size from FB +- drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr +- drm/amd/pm: fix warning using uninitialized value of max_vid_step +- drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr +- drm/amd/pm: fix uninitialized variable warning +- drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc +- drm/amdgpu: fix overflowed array index read warning +- drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr +- selftests: mptcp: join: stop transfer when check is done (part 2.2) +- selftests: mptcp: join: disable get and dump addr checks +- selftests: mptcp: join: test for flush/re-add endpoints +- selftests: mptcp: join: check re-adding init endp with != id +- selftests: mptcp: join: check re-using ID of unused ADD_ADDR +- selftests: mptcp: add explicit test case for remove/readd +- selftests: mptcp: join: cannot rm sf if closed +- selftests: mptcp: declare event macros in mptcp_lib +- selftests: mptcp: userspace pm get addr tests +- selftests: mptcp: dump userspace addrs list +- mptcp: pm: fix RM_ADDR ID for the initial subflow +- mptcp: make pm_remove_addrs_and_subflows static +- ASoC: codecs: ES8326: button detect issue +- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 +- net: usb: qmi_wwan: add MeiG Smart SRM825L +- dma-debug: avoid deadlock between dma debug vs printk and netconsole +- i2c: Fix conditional for substituting empty ACPI functions +- ASoC: amd: yc: Support mic on HP 14-em0002la +- smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp +- net/mlx5: DR, Fix 'stack guard page was hit' error in dr_rule +- ALSA: seq: ump: Explicitly reset RPN with Null RPN +- ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception +- ALSA: seq: ump: Use the common RPN/bank conversion context +- ALSA: ump: Explicitly reset RPN with Null RPN +- ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception +- ALSA: hda/conexant: Mute speakers at suspend / shutdown +- ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown +- btrfs: tree-checker: validate dref root and objectid +- scsi: ufs: core: Bypass quick recovery if force reset is needed +- scsi: ufs: core: Check LSDBS cap when !mcq +- drm: panel-orientation-quirks: Add quirk for OrangePi Neo +- drm/fb-helper: Don't schedule_work() to flush frame buffer during panic() +- !12281 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.48-6.6.49 LTS Patches +- apparmor: fix policy_unpack_test on big endian systems +- arm64: dts: freescale: imx93-tqma9352-mba93xxla: fix typo +- arm64: dts: freescale: imx93-tqma9352: fix CMA alloc-ranges +- arm64: dts: imx93: update default value for snps,clk-csr +- arm64: dts: imx93: add nvmem property for eqos +- arm64: dts: imx93: add nvmem property for fec1 +- arm64: dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962 +- ARM: dts: omap3-n900: correct the accelerometer orientation +- usb: cdnsp: fix for Link TRB with TC +- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function +- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() +- usb: dwc3: st: add missing depopulate in probe error path +- usb: dwc3: core: Prevent USB core invalid event buffer address access +- usb: dwc3: omap: add missing depopulate in probe error path +- ARM: dts: imx6dl-yapp43: Increase LED current to match the yapp4 HW design +- USB: serial: option: add MeiG Smart SRM825L +- scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress +- firmware: qcom: scm: Mark get_wq_ctx() as atomic call +- cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller +- soc: qcom: pmic_glink: Fix race during initialization +- soc: qcom: pmic_glink: Actually communicate when remote goes down +- soc: qcom: cmd-db: Map shared memory as WC, not WB +- nfc: pn533: Add poll mod list filling check +- net: busy-poll: use ktime_get_ns() instead of local_clock() +- drm/amd/display: avoid using null object of framebuffer +- sctp: fix association labeling in the duplicate COOKIE-ECHO case +- gtp: fix a potential NULL pointer dereference +- bonding: change ipsec_lock from spin lock to mutex +- bonding: extract the use of real_device into local variable +- bonding: implement xdo_dev_state_free and call it after deletion +- selftests: forwarding: local_termination: Down ports on cleanup +- selftests: forwarding: no_forwarding: Down ports on cleanup +- netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation +- wifi: iwlwifi: fw: fix wgds rev 3 exact size +- netfilter: nf_tables: restore IP sanity checks for netdev/egress +- iommu: Do not return 0 from map_pages if it doesn't do anything +- Bluetooth: hci_core: Fix not handling hibernation actions +- Bluetooth: btnxpuart: Fix random crash seen while removing driver +- Bluetooth: btnxpuart: Handle FW Download Abort scenario +- Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test +- dmaengine: dw: Add memory bus width verification +- dmaengine: dw: Add peripheral bus width verification +- phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume +- dmaengine: dw-edma: Do not enable watermark interrupts for HDMA +- dmaengine: dw-edma: Fix unmasking STOP and ABORT interrupts for HDMA +- soundwire: stream: fix programming slave ports for non-continous port maps +- phy: fsl-imx8mq-usb: fix tuning parameter name +- iommufd: Do not allow creating areas without READ or WRITE +- cifs: Fix FALLOC_FL_PUNCH_HOLE support +- mm: Fix missing folio invalidation calls during truncation +- ovl: ovl_parse_param_lowerdir: Add missed ' +- pinctrl: starfive: jh7110: Correct the level trigger configuration of iev register +- pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE +- ASoC: SOF: amd: Fix for acp init sequence +- ASoC: amd: acp: fix module autoloading +- thermal: of: Fix OF node leak in of_thermal_zone_find() error paths +- thermal: of: Fix OF node leak in thermal_of_trips_init() error path +- of: Introduce for_each_*_child_of_node_scoped() to automate of_node_put() handling +- usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister existing source caps before re-registration" +- drm/vmwgfx: Fix prime with external buffers +- drm/amdgpu/swsmu: always force a state reprogram on init +- drm/amdgpu: align pp_power_profile_mode with kernel docs +- selftests: mptcp: join: check re-re-adding ID 0 endp +- selftests: mptcp: join: no extra msg if no counter +- selftests: mptcp: join: check removing ID 0 endpoint +- mptcp: pm: ADD_ADDR 0 is not a new address +- mptcp: pm: fix ID 0 endp usage after multiple re-creations +- mptcp: pm: do not remove already closed subflows +- mptcp: pm: send ACK on an active subflow +- mptcp: pm: reset MPC endp ID when re-added +- mptcp: pm: skip connecting to already established sf +- mptcp: pm: reuse ID 0 after delete and re-add +- mptcp: sched: check both backup in retrans +- mptcp: close subflow when receiving TCP+FIN +- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response +- wifi: mwifiex: duplicate static structs used in driver instances +- wifi: wfx: repair open network AP mode +- of: Add cleanup.h based auto release via __free(device_node) markings +- pinctrl: single: fix potential NULL dereference in pcs_get_function() +- pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins +- btrfs: run delayed iputs when flushing delalloc +- LoongArch: Remove the unused dma-direct.h +- ALSA: seq: Skip event type filtering for UMP events +- !12276 mm: mem_reliable: Initialize reliable_nr_page when mm_init() +- mm: mem_reliable: Initialize reliable_nr_page when mm_init() +- !12178 net: stmmac: move the EST lock to struct stmmac_priv +- net: stmmac: move the EST lock to struct stmmac_priv +- !12181 net: ena: Add validation for completion descriptors consistency +- net: ena: Add validation for completion descriptors consistency +- !12255 drm/amd/display: Ensure index calculation will not overflow +- drm/amd/display: Ensure index calculation will not overflow +- !12214 platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses +- platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses +- !12147 wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead +- wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead +- !9955 [OLK-6.6]HYGON: CSV3 patch series part 1 (Secure memory management and initialization for CSV3) +- crypto: ccp: Add SET_SMR/SET_SMCR commands for CSV3 +- x86/mm: Manage CSV3 guest's private memory by CMA +- crypto: ccp: Define CSV3 key management command id +- KVM: SEV: Pin SEV guest memory out of CMA area +- !12253 RDMA/hns: Fix flush cqe error when racing with destroy qp +- RDMA/hns: Fix flush cqe error when racing with destroy qp +- !12217 v2 RDMA/hns: Fix new mmaped pages during resetting +- RDMA/hns: Fix new mmaped pages during resetting +- !12216 ACPI/IORT: Add PMCG platform information for HiSilicon HIP10/11 +- ACPI/IORT: Add PMCG platform information for HiSilicon HIP10/11 +- !12209 net/hinic3: fix version showed in ethtool +- net/hinic3: fix version showed in ethtool +- !12218 KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS +- KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS +- !11667 Adds Nebula S1000 series network snic driver +- Net:nbl_core: Add nbl_core-driver for nebula-matrix S1055AS series smart NIC. +- !12036 KVM: arm64: Add new HiSi CPU type for supporting DVMBM +- KVM: arm64: Add new HiSi CPU type for supporting DVMBM +- !12112 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.47-6.6.48 LTS Patches +- Revert "s390/dasd: Establish DMA alignment" +- ksmbd: fix race condition between destroy_previous_session() and smb2 operations() +- drm/amdgpu/vcn: not pause dpg for unified queue +- drm/amdgpu/vcn: identify unified queue in sw init +- selftests/bpf: Add a test to verify previous stacksafe() fix +- ALSA: timer: Relax start tick time check for slave timer elements +- igc: Fix qbv tx latency by setting gtxoffset +- drm/panel: nt36523: Set 120Hz fps for xiaomi,elish panels +- drm/msm/mdss: specify cfg bandwidth for SDM670 +- hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt() +- Revert "drm/amd/display: Validate hw_points_num before using it" +- Revert "usb: gadget: uvc: cleanup request when not in correct state" +- selftests: mptcp: join: check re-using ID of closed subflow +- selftests: mptcp: join: validate fullmesh endp on 1st sf +- mptcp: pm: fullmesh: select the right ID later +- mptcp: pm: only in-kernel cannot have entries with ID 0 +- mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR +- mptcp: pm: only mark 'subflow' endp as available +- mptcp: pm: remove mptcp_pm_remove_subflow() +- mptcp: pm: re-using ID of unused flushed subflows +- mptcp: pm: re-using ID of unused removed subflows +- mptcp: pm: re-using ID of unused removed ADD_ADDR +- nouveau/firmware: use dma non-coherent allocator +- pmdomain: imx: wait SSAR when i.MX93 power domain on +- pmdomain: imx: scu-pd: Remove duplicated clocks +- mmc: dw_mmc: allow biu and ciu clocks to defer +- mmc: mtk-sd: receive cmd8 data when hs400 tuning fail +- KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 +- cxgb4: add forgotten u64 ivlan cast before shift +- Input: i8042 - use new forcenorestore quirk to replace old buggy quirk combination +- Input: i8042 - add forcenorestore quirk to leave controller untouched even on s3 +- HID: wacom: Defer calculation of resolution until resolution_code is known +- MIPS: Loongson64: Set timer mode in cpu-probe +- net: dsa: microchip: fix PTP config failure when using multiple ports +- drm/amdgpu: Validate TA binary size +- ksmbd: the buffer of smb2 query dir response has at least 1 byte +- scsi: core: Fix the return value of scsi_logical_block_count() +- smb: client: ignore unhandled reparse tags +- drm/msm: fix the highest_bank_bit for sc7180 +- drm/msm/mdss: Handle the reg bus ICC path +- drm/msm/mdss: Rename path references to mdp_path +- drm/msm/mdss: switch mdss to use devm_of_icc_get() +- drm/msm/dpu: take plane rotation into account for wide planes +- drm/msm/dpu: try multirect based on mdp clock limits +- drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails +- drm/msm/dp: reset the link phy params before link training +- drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable() +- drm/msm/dpu: capture snapshot on the first commit_done timeout +- drm/msm/dpu: split dpu_encoder_wait_for_event into two functions +- drm/msm/dpu: drop MSM_ENC_VBLANK support +- drm/msm/dpu: use drmm-managed allocation for dpu_encoder_phys +- drm/msm/dp: fix the max supported bpp logic +- drm/msm/dpu: don't play tricks with debug macros +- net: ovs: fix ovs_drop_reasons error +- net: xilinx: axienet: Fix dangling multicast addresses +- net: xilinx: axienet: Always disable promiscuous mode +- octeontx2-af: Fix CPT AF register offset calculation +- netfilter: flowtable: validate vlan header +- udp: fix receiving fraglist GSO packets +- igb: cope with large MAX_SKB_FRAGS +- dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp() +- ice: fix truesize operations for PAGE_SIZE >= 8192 +- ice: fix ICE_LAST_OFFSET formula +- ice: fix page reuse when PAGE_SIZE is over 8k +- bonding: fix xfrm state handling when clearing active slave +- bonding: fix xfrm real_dev null pointer dereference +- bonding: fix null pointer deref in bond_ipsec_offload_ok +- bonding: fix bond_ipsec_offload_ok return type +- ip6_tunnel: Fix broken GRO +- netfilter: nft_counter: Synchronize nft_counter_reset() against reader. +- netfilter: nft_counter: Disable BH in nft_counter_offload_stats(). +- net: mctp: test: Use correct skb for route input check +- selftests: udpgro: report error when receive failed +- tc-testing: don't access non-existent variable on exception +- net: mscc: ocelot: serialize access to the injection/extraction groups +- net: mscc: ocelot: fix QoS class for injected packets with "ocelot-8021q" +- net: mscc: ocelot: use ocelot_xmit_get_vlan_info() also for FDMA and register injection +- Bluetooth: SMP: Fix assumption of Central always being Initiator +- Bluetooth: hci_core: Fix LE quote calculation +- drm/amdkfd: reserve the BO before validating it +- ALSA: hda/tas2781: Use correct endian conversion +- platform/surface: aggregator: Fix warning when controller is destroyed in probe +- drm/amd/amdgpu: command submission parser for JPEG +- drm/amd/display: fix cursor offset on rotation 180 +- drm/amd/display: Enable otg synchronization logic for DCN321 +- drm/amd/display: Adjust cursor position +- btrfs: send: allow cloning non-aligned extent if it ends at i_size +- btrfs: replace sb::s_blocksize by fs_info::sectorsize +- mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0 +- selftests: memfd_secret: don't build memfd_secret test on unsupported arches +- selftests/mm: log run_vmtests.sh results in TAP format +- tools/testing/selftests/mm/run_vmtests.sh: lower the ptrace permissions +- dm suspend: return -ERESTARTSYS instead of -EINTR +- riscv: entry: always initialize regs->a0 to -ENOSYS +- i2c: stm32f7: Add atomic_xfer method to driver +- jfs: define xtree root and page independently +- nvme: fix namespace removal list +- EDAC/skx_common: Allow decoding of SGX addresses +- ionic: check cmd_regs before copying in or out +- ionic: use pci_is_enabled not open code +- hrtimer: Prevent queuing of hrtimer without a function callback +- drm/amdgpu: fix dereference null return value for the function amdgpu_vm_pt_parent +- nvme: use srcu for iterating namespace list +- selftests/bpf: Fix a few tests for GCC related warnings. +- nvmet-rdma: fix possible bad dereference when freeing rsps +- irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc +- usb: dwc3: core: Skip setting event buffers for host only controllers +- platform/x86: lg-laptop: fix %s null argument warning +- clocksource: Make watchdog and suspend-timing multiplication overflow safe +- irqchip/renesas-rzg2l: Do not set TIEN and TINT source at the same time +- s390/iucv: fix receive buffer virtual vs physical address confusion +- openrisc: Call setup_memory() earlier in the init sequence +- NFS: avoid infinite loop in pnfs_update_layout. +- nvmet-tcp: do not continue for invalid icreq +- rtc: nct3018y: fix possible NULL dereference +- firmware: cirrus: cs_dsp: Initialize debugfs_root to invalid +- Bluetooth: bnep: Fix out-of-bound access +- nvme: clear caller pointer on identify failure +- usb: gadget: fsl: Increase size of name buffer for endpoints +- f2fs: fix to do sanity check in update_sit_entry +- btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() +- btrfs: change BUG_ON to assertion in tree_move_down() +- btrfs: send: handle unexpected inode in header process_recorded_refs() +- btrfs: send: handle unexpected data in header buffer in begin_cmd() +- btrfs: handle invalid root reference found in may_destroy_subvol() +- btrfs: push errors up from add_async_extent() +- btrfs: tests: allocate dummy fs_info and root in test_find_delalloc() +- btrfs: change BUG_ON to assertion when checking for delayed_node root +- btrfs: defrag: change BUG_ON to assertion in btrfs_defrag_leaves() +- btrfs: delayed-inode: drop pointless BUG_ON in __btrfs_remove_delayed_item() +- powerpc/boot: Only free if realloc() succeeds +- powerpc/boot: Handle allocation failure in simple_realloc() +- f2fs: stop checkpoint when get a out-of-bounds segment +- rxrpc: Don't pick values out of the wire header when setting up security +- parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 +- memory: stm32-fmc2-ebi: check regmap_read return value +- x86: Increase brk randomness entropy for 64-bit systems +- md: clean up invalid BUG_ON in md_ioctl +- netlink: hold nlk->cb_mutex longer in __netlink_dump_start() +- tick: Move got_idle_tick away from common flags +- clocksource/drivers/arm_global_timer: Guard against division by zero +- accel/habanalabs: fix debugfs files permissions +- virtiofs: forbid newlines in tags +- hrtimer: Select housekeeping CPU during migration +- gpio: sysfs: extend the critical section for unregistering sysfs devices +- drm/lima: set gp bus_stop bit before hard reset +- net/sun3_82586: Avoid reading past buffer in debug output +- wifi: iwlwifi: mvm: avoid garbage iPN +- media: drivers/media/dvb-core: copy user arrays safely +- scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() +- fs: binfmt_elf_efpic: don't use missing interpreter's properties +- media: pci: cx23885: check cx23885_vdev_init() return +- kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files +- riscv: blacklist assembly symbols for kprobe +- quota: Remove BUG_ON from dqget() +- wifi: ath12k: Add missing qmi_txn_cancel() calls +- fuse: fix UAF in rcu pathwalks +- afs: fix __afs_break_callback() / afs_drop_open_mmap() race +- btrfs: zlib: fix and simplify the inline extent decompression +- ext4: do not trim the group with corrupted block bitmap +- nvmet-trace: avoid dereferencing pointer too early +- EDAC/skx_common: Filter out the invalid address +- gfs2: Refcounting fix in gfs2_thaw_super +- Bluetooth: hci_conn: Check non NULL function before calling for HFP offload +- evm: don't copy up 'security.evm' xattr +- drm/rockchip: vop2: clear afbc en and transform bit for cluster window at linear mode +- ionic: no fw read when PCI reset failed +- ionic: prevent pci disable of already disabled device +- powerpc/pseries/papr-sysparm: Validate buffer object lengths +- hwmon: (pc87360) Bounds check data->innr usage +- ASoC: SOF: ipc4: check return value of snd_sof_ipc_msg_data +- powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu +- memory: tegra: Skip SID programming if SID registers aren't set +- drm/msm: Reduce fallout of fence signaling vs reclaim hangs +- arm64: Fix KASAN random tag seed initialization +- powerpc/topology: Check if a core is online +- cpu/SMT: Enable SMT only if a core is online +- rust: fix the default format for CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT +- rust: suppress error messages from CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT +- rust: work around `bindgen` 0.69.0 issue +- hwmon: (ltc2992) Avoid division by zero +- IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock +- clk: visconti: Add bounds-checking coverage for struct visconti_pll_provider +- wifi: iwlwifi: check for kmemdup() return value in iwl_parse_tlv_firmware() +- wifi: iwlwifi: fw: Fix debugfs command sending +- wifi: iwlwifi: abort scan when rfkill on but device enabled +- gfs2: setattr_chown: Add missing initialization +- wifi: mac80211: flush STA queues on unauthorization +- scsi: spi: Fix sshdr use +- ASoC: SOF: Intel: hda-dsp: Make sure that no irq handler is pending before suspend +- iommu/arm-smmu-qcom: Add SDM670 MDSS compatible +- media: qcom: venus: fix incorrect return value +- drm/tegra: Zero-initialize iosys_map +- binfmt_misc: cleanup on filesystem umount +- accel/habanalabs: fix bug in timestamp interrupt handling +- accel/habanalabs: export dma-buf only if size/offset multiples of PAGE_SIZE +- accel/habanalabs/gaudi2: unsecure tpc count registers +- media: s5p-mfc: Fix potential deadlock on condlock +- staging: ks7010: disable bh on tx_dev_lock +- drm/amd/display: Validate hw_points_num before using it +- usb: gadget: uvc: cleanup request when not in correct state +- wifi: mt76: fix race condition related to checking tx queue fill status +- staging: iio: resolver: ad2s1210: fix use before initialization +- wifi: ath11k: fix ath11k_mac_op_remain_on_channel() stack usage +- media: radio-isa: use dev_name to fill in bus_info +- drm/amdkfd: Move dma unmapping after TLB flush +- i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer +- i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out +- wifi: ath12k: fix WARN_ON during ath12k_mac_update_vif_chan +- drm/bridge: tc358768: Attempt to fix DSI horizontal timings +- s390/smp,mcck: fix early IPI handling +- RDMA/rtrs: Fix the problem of variable not initialized fully +- i2c: riic: avoid potential division by zero +- cgroup: Avoid extra dereference in css_populate_dir() +- wifi: cw1200: Avoid processing an invalid TIM IE +- sched/topology: Handle NUMA_NO_NODE in sched_numa_find_nth_cpu() +- net: ethernet: mtk_wed: check update_wo_rx_stats in mtk_wed_update_rx_stats() +- rcu: Eliminate rcu_gp_slow_unregister() false positive +- rcu: Dump memory object info if callback function is invalid +- mm: Remove kmem_valid_obj() +- wifi: iwlwifi: mvm: fix recovery flow in CSA +- wifi: mac80211: fix BA session teardown race +- wifi: cfg80211: check wiphy mutex is held for wdev mutex +- wifi: mac80211: lock wiphy in IP address notifier +- ASoC: cs35l45: Checks index of cs35l45_irqs[] +- ssb: Fix division by zero issue in ssb_calc_clock_rate +- drm/amdgpu: access RLC_SPM_MC_CNTL through MMIO in SRIOV runtime +- drm/amd/amdgpu/imu_v11_0: Increase buffer size to ensure all possible values can be stored +- drm/amd/pm: fix error flow in sensor fetching +- ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 +- gpio: mlxbf3: Support shutdown() function +- netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests +- netfilter: nf_tables: Introduce nf_tables_getobj_single +- netfilter: nf_tables: Carry reset boolean in nft_obj_dump_ctx +- netfilter: nf_tables: nft_obj_filter fits into cb->ctx +- netfilter: nf_tables: Carry s_idx in nft_obj_dump_ctx +- netfilter: nf_tables: A better name for nft_obj_filter +- netfilter: nf_tables: Unconditionally allocate nft_obj_filter +- netfilter: nf_tables: Drop pointless memset in nf_tables_dump_obj +- netfilter: nf_tables: Audit log dump reset after the fact +- netfilter: nf_queue: drop packets with cloned unconfirmed conntracks +- netfilter: flowtable: initialise extack before use +- netfilter: allow ipv6 fragments to arrive on different devices +- tcp: Update window clamping condition +- mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size +- mlxbf_gige: disable RX filters until RX path initialized +- net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() +- net: dsa: vsc73xx: check busy flag in MDIO operations +- net: dsa: vsc73xx: use read_poll_timeout instead delay loop +- net: dsa: vsc73xx: pass value in phy_write operation +- net: axienet: Fix register defines comment description +- atm: idt77252: prevent use after free in dequeue_rx() +- net/mlx5e: Correctly report errors for ethtool rx flows +- igc: Fix reset adapter logics when tx mode change +- igc: Fix qbv_config_change_errors logics +- igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer +- bpf: Fix updating attached freplace prog in prog_array map +- s390/uv: Panic for set and remove shared access UVC errors +- drm/amdgpu/jpeg4: properly set atomics vmid field +- drm/amdgpu/jpeg2: properly set atomics vmid field +- memcg_write_event_control(): fix a user-triggerable oops +- drm/amdgpu: Actually check flags for all context ops. +- btrfs: tree-checker: add dev extent item checks +- btrfs: zoned: properly take lock to read/update block group's zoned variables +- btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type +- mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu +- selinux: add the processing of the failure of avc_add_xperms_decision() +- selinux: fix potential counting error in avc_add_xperms_decision() +- wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion +- net: mana: Fix RX buf alloc_size alignment and atomic op panic +- i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume +- btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() +- dm persistent data: fix memory allocation failure +- dm resume: don't return EINVAL when signalled +- arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE +- ACPI: EC: Evaluate _REG outside the EC scope more carefully +- ACPICA: Add a depth argument to acpi_execute_reg_methods() +- riscv: change XIP's kernel_map.size to be size of the entire kernel +- KVM: s390: fix validity interception issue when gisa is switched off +- s390/dasd: fix error recovery leading to data corruption on ESE devices +- ALSA: hda/tas2781: fix wrong calibrated data order +- thunderbolt: Mark XDomain as unplugged when router is removed +- xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration +- ALSA: usb-audio: Support Yamaha P-125 quirk entry +- ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET +- char: xillybus: Refine workqueue handling +- char: xillybus: Don't destroy workqueue from work item running on it +- selinux: revert our use of vma_is_initial_heap() +- Revert "usb: typec: tcpm: clear pd_event queue in PORT_RESET" +- Revert "misc: fastrpc: Restrict untrusted app to attach to privileged PD" +- Revert "ACPI: EC: Evaluate orphan _REG under EC device" +- tty: atmel_serial: use the correct RTS flag. +- !12087 arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry +- arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry +- !6996 sched/fair: Optimize performance by inlining cpu_util_without() and cpu_util() +- sched/fair: Optimize performance by inlining cpu_util_without() and cpu_util() +- !12080 btrfs: clean up our handling of refs == 0 in snapshot delete +- btrfs: clean up our handling of refs == 0 in snapshot delete +- !12052 drm/amdgpu: the warning dereferencing obj for nbio_v7_4 +- drm/amdgpu: the warning dereferencing obj for nbio_v7_4 +- !12082 userfaultfd: don't BUG_ON() if khugepaged yanks our page table +- userfaultfd: don't BUG_ON() if khugepaged yanks our page table +- !12077 ELF: fix kernel.randomize_va_space double read +- ELF: fix kernel.randomize_va_space double read +- !12068 usb: gadget: aspeed_udc: validate endpoint index for ast udc +- usb: gadget: aspeed_udc: validate endpoint index for ast udc +- !12057 netfilter: nft_socket: fix sk refcount leaks +- netfilter: nft_socket: fix sk refcount leaks +- !11954 drm/amdgpu: fix the waring dereferencing hive +- drm/amdgpu: fix the waring dereferencing hive +- !12059 mptcp: pm: Fix uaf in __timer_delete_sync +- mptcp: pm: Fix uaf in __timer_delete_sync +- !12058 net: dpaa: Pad packets to ETH_ZLEN +- net: dpaa: Pad packets to ETH_ZLEN +- !12076 drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ +- drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ +- !11966 drm/amd/pm: Fix negative array index read +- drm/amd/pm: Fix negative array index read + +' for pr_err +* Thu Oct 10 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-46.0.0.51 +- !12061 net/mlx5: Fix bridge mode operations when there are no VFs +- net/mlx5: Fix bridge mode operations when there are no VFs +- !12074 drm/amd/display: Check index for aux_rd_interval before using +- drm/amd/display: Check index for aux_rd_interval before using +- !12063 cpufreq: intel_pstate: Revise global turbo disable check +- cpufreq: intel_pstate: Revise global turbo disable check +- !12051 um: line: always fill *error_out in setup_one_line() +- um: line: always fill *error_out in setup_one_line() +- !12023 ASoC: meson: axg-card: fix 'use-after-free' +- ASoC: meson: axg-card: fix 'use-after-free' +- !12022 drm/amd/display: Check gpio_id before used as array index +- drm/amd/display: Check gpio_id before used as array index +- !12049 drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration +- drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration +- !11949 mptcp: pm: only decrement add_addr_accepted for MPJ req +- mptcp: pm: only decrement add_addr_accepted for MPJ req +- !11763 [OLK-6.6] Intel: Backport to support Intel IFS(In Field Scan) SBAF on GNR +- platform/x86/intel/ifs: Fix SBAF title underline length +- trace: platform/x86/intel/ifs: Add SBAF trace support +- platform/x86/intel/ifs: Add SBAF test support +- platform/x86/intel/ifs: Add SBAF test image loading support +- platform/x86/intel/ifs: Refactor MSR usage in IFS test code +- selftests: ifs: verify IFS ARRAY BIST functionality +- selftests: ifs: verify IFS scan test functionality +- selftests: ifs: verify test image loading functionality +- selftests: ifs: verify test interfaces are created by the driver +- platform/x86/intel/ifs: Disable irq during one load stage +- platform/x86/intel/ifs: trace: display batch num in hex +- platform/x86/intel/ifs: Classify error scenarios correctly +- platform/x86/intel/ifs: Remove unnecessary initialization of 'ret' +- platform/x86/intel/ifs: Add an entry rendezvous for SAF +- platform/x86/intel/ifs: Replace the exit rendezvous with an entry rendezvous for ARRAY_BIST +- platform/x86/intel/ifs: Add current batch number to trace output +- platform/x86/intel/ifs: Trace on all HT threads when executing a test +- !12039 drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links +- drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links +- !12033 sysctl: always initialize i_uid/i_gid +- sysctl: always initialize i_uid/i_gid +- !12014 dma-buf: heaps: Fix off-by-one in CMA heap fault handler +- dma-buf: heaps: Fix off-by-one in CMA heap fault handler +- !12009 rtmutex: Drop rt_mutex::wait_lock before scheduling +- rtmutex: Drop rt_mutex::wait_lock before scheduling +- !11617 v2 Fix VSYNC referencing an unmapped VPE on GIC v4.0/v4.1 +- irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.0 +- irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 +- !12016 perf/x86/intel: Limit the period on Haswell +- perf/x86/intel: Limit the period on Haswell +- !12017 cppc_cpufreq: Fix possible null pointer dereference +- cppc_cpufreq: Fix possible null pointer dereference +- !11995 drm/amd/display: Assign linear_pitch_alignment even for VM +- drm/amd/display: Assign linear_pitch_alignment even for VM +- !11796 bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro() +- bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro() +- !12004 spi: rockchip: Resolve unbalanced runtime PM / system PM handling +- spi: rockchip: Resolve unbalanced runtime PM / system PM handling +- !12000 nvmet-tcp: fix kernel crash if commands allocation fails +- nvmet-tcp: fix kernel crash if commands allocation fails +- !11969 drm/amd/display: Run DC_LOG_DC after checking link->link_enc +- drm/amd/display: Run DC_LOG_DC after checking link->link_enc +- !11963 serial: sc16is7xx: fix invalid FIFO access with special register set +- serial: sc16is7xx: fix invalid FIFO access with special register set +- !11985 Fix CVE-2024-46845 +- tracing/osnoise: Fix build when timerlat is not enabled +- tracing/timerlat: Only clear timer if a kthread exists +- !11909 ksmbd: unset the binding mark of a reused connection +- ksmbd: unset the binding mark of a reused connection +- !11983 wifi: ath12k: fix firmware crash due to invalid peer nss +- wifi: ath12k: fix firmware crash due to invalid peer nss +- !11984 drm/amd/display: Add array index check for hdcp ddc access +- drm/amd/display: Add array index check for hdcp ddc access +- !11989 drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box +- drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box +- !11992 scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info +- scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info +- !11979 CVE-2024-46814 +- drm/amd/display: Check msg_id before processing transcation +- !11960 scsi: ufs: core: Remove SCSI host only if added +- scsi: ufs: core: Remove SCSI host only if added +- !11944 drm/amdgpu: Fix the warning division or modulo by zero +- drm/amdgpu: Fix the warning division or modulo by zero +- !11971 sched: Support to enable/disable dynamic_affinity +- sched: Support to enable/disable dynamic_affinity +- !11951 net: phy: Fix missing of_node_put() for leds +- net: phy: Fix missing of_node_put() for leds +- !11956 Fix CVE-2024-44958 6.6 +- sched/smt: Fix unbalance sched_smt_present dec/inc +- sched/smt: Introduce sched_smt_present_inc/dec() helper +- !11945 btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() +- btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() +- !11919 btrfs: fix race between direct IO write and fsync when using same fd +- btrfs: fix race between direct IO write and fsync when using same fd +- !11920 hwmon: (lm95234) Fix underflows seen when writing limit attributes +- hwmon: (lm95234) Fix underflows seen when writing limit attributes +- !11820 powerpc/qspinlock: Fix deadlock in MCS queue +- powerpc/qspinlock: Fix deadlock in MCS queue +- !11915 ethtool: check device is present when getting link settings +- ethtool: check device is present when getting link settings +- !11936 btrfs: remove NULL transaction support for btrfs_lookup_extent_info() +- btrfs: remove NULL transaction support for btrfs_lookup_extent_info() +- !11929 Merge some hns RoCE patches from the mainline to OLK-6.6 +- RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() +- RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08 +- Revert "RDMA/hns: Fix Use-After-Free of rsv_qp" +- Revert "RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()" +- !11912 smb: client: fix double put of @cfile in smb2_set_path_size() +- smb: client: fix double put of @cfile in smb2_set_path_size() +- !11908 HID: amd_sfh: free driver_data after destroying hid device +- HID: amd_sfh: free driver_data after destroying hid device +- !11926 nilfs2: protect references to superblock parameters exposed in sysfs +- nilfs2: protect references to superblock parameters exposed in sysfs +- !11927 hwmon: (hp-wmi-sensors) Check if WMI event data exists +- hwmon: (hp-wmi-sensors) Check if WMI event data exists +- !11844 fix CVE-2024-46771 +- can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). +- can: bcm: Remove proc entry when dev is unregistered. +- !11885 pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv +- pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv +- !11795 i2c: tegra: Do not mark ACPI devices as irq safe +- i2c: tegra: Do not mark ACPI devices as irq safe +- !11804 drm/amdgpu: Fix out-of-bounds write warning +- drm/amdgpu: Fix out-of-bounds write warning +- !11901 scsi: aacraid: Fix double-free on probe failure +- scsi: aacraid: Fix double-free on probe failure +- !11859 char: xillybus: Check USB endpoints when probing device +- char: xillybus: Check USB endpoints when probing device +- !11865 pktgen: use cpus_read_lock() in pg_net_init() +- pktgen: use cpus_read_lock() in pg_net_init() +- !11876 btrfs: handle errors from btrfs_dec_ref() properly +- btrfs: handle errors from btrfs_dec_ref() properly +- !11893 tracing/osnoise: Use a cpumask to know what threads are kthreads +- tracing/osnoise: Use a cpumask to know what threads are kthreads +- !11840 userfaultfd: fix checks for huge PMDs +- userfaultfd: fix checks for huge PMDs +- !11891 wifi: rtw88: usb: schedule rx work after everything is set up +- wifi: rtw88: usb: schedule rx work after everything is set up +- !11860 VMCI: Fix use-after-free when removing resource in vmci_resource_remove() +- VMCI: Fix use-after-free when removing resource in vmci_resource_remove() +- !11870 NFSD: Reset cb_seq_status after NFS4ERR_DELAY +- NFSD: Reset cb_seq_status after NFS4ERR_DELAY +- !11874 fix CVE-2024-46701 +- libfs: fix infinite directory reads for offset dir +- fs: fix kabi kroken in struct offset_ctx +- libfs: Convert simple directory offsets to use a Maple Tree +- test_maple_tree: testing the cyclic allocation +- maple_tree: Add mtree_alloc_cyclic() +- libfs: Add simple_offset_empty() +- libfs: Define a minimum directory offset +- libfs: Re-arrange locking in offset_iterate_dir() +- !11689 smb: client: fix double put of @cfile in smb2_rename_path() +- smb: client: fix double put of @cfile in smb2_rename_path() +- !11883 usb: dwc3: st: fix probed platform device ref count on probe error path +- usb: dwc3: st: fix probed platform device ref count on probe error path +- !11884 PCI: Add missing bridge lock to pci_bus_lock() +- PCI: Add missing bridge lock to pci_bus_lock() +- !11862 hwmon: (w83627ehf) Fix underflows seen when writing limit attributes +- hwmon: (w83627ehf) Fix underflows seen when writing limit attributes +- !11758 smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() +- smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() +- !11857 arm64/mpam: Fix redefined reference of 'mpam_detect_is_enabled' +- arm64/mpam: Fix redefined reference of 'mpam_detect_is_enabled' +- !11823 mmc: mmc_test: Fix NULL dereference on allocation failure +- mmc: mmc_test: Fix NULL dereference on allocation failure +- !11819 uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind +- uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind +- !11495 ext4: Fix race in buffer_head read fault injection +- ext4: Fix race in buffer_head read fault injection +- !11845 bpf: verifier: prevent userspace memory access +- bpf: verifier: prevent userspace memory access +- !11748 ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object +- ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object +- !11624 Fix iBMA bug and change version +- BMA: Fix edma driver initialization problem and change the version number. +- !11850 misc: fastrpc: Fix double free of 'buf' in error path +- misc: fastrpc: Fix double free of 'buf' in error path +- !11655 drm/amd/display: Check denominator pbn_div before used +- drm/amd/display: Check denominator pbn_div before used +- !11686 udf: Avoid excessive partition lengths +- udf: Avoid excessive partition lengths +- !11685 binder: fix UAF caused by offsets overwrite +- binder: fix UAF caused by offsets overwrite +- !11798 CVE-2024-46784 +- net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup +- net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings +- !11814 selinux,smack: don't bypass permissions check in inode_setsecctx hook +- selinux,smack: don't bypass permissions check in inode_setsecctx hook +- !11811 apparmor: fix possible NULL pointer dereference +- apparmor: fix possible NULL pointer dereference +- !11681 net/mlx5e: SHAMPO, Fix incorrect page release +- net/mlx5e: SHAMPO, Fix incorrect page release +- !11679 wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() +- wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() +- !11672 netem: fix return value if duplicate enqueue fails +- netem: fix return value if duplicate enqueue fails +- !11783 mm: hwpoison: two more poison recovery +- mm: support poison recovery from copy_present_page() +- mm: support poison recovery from do_cow_fault() +- !11787 nilfs2: fix missing cleanup on rollforward recovery error +- nilfs2: fix missing cleanup on rollforward recovery error +- !11744 powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() +- powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() +- !11766 drm/amd/display: Check denominator crb_pipes before used +- drm/amd/display: Check denominator crb_pipes before used +- !11790 efi/libstub: add checking validity of memory regions +- efi/libstub: add checking validity of memory regions +- !11802 can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open +- can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open +- !11747 [OLK 6.6] some bugfixes for hns3 +- net: hns3: fix concurrent setting vlan filter issue +- net: hns3: fix snprintf() is printing too much problem +- net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error +- net: hns3: fix spelling mistake "reg_um" -> "reg_num" +- net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue +- net: hns3:support enable or disable pfc strom prevent +- net: hns3: fix wrong use of semaphore up + +* Wed Sep 25 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-44.0.0.50 +- !11769 tools: move alignment-related macros to new <linux/align.h> +- tools: move alignment-related macros to new <linux/align.h> +- !11753 driver: iio: add missing checks on iio_info's callback access +- driver: iio: add missing checks on iio_info's callback access +- !11740 hwmon: (adc128d818) Fix underflows seen when writing limit attributes +- hwmon: (adc128d818) Fix underflows seen when writing limit attributes +- !11733 Input: MT - limit max slots +- Input: MT - limit max slots +- !11757 arm64/mpam: Check mpam_detect_is_enabled() before accessing MPAM registers +- arm64/mpam: Check mpam_detect_is_enabled() before accessing MPAM registers +- Revert "arm64: head.S: Initialise MPAM EL2 registers and disable traps" +- !11543 Fix CVE-2024-45025 +- fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE +- bitmap: introduce generic optimized bitmap_size() +- fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64() +- s390/cio: rename bitmap_size() -> idset_bitmap_size() +- !11713 btrfs: fix qgroup reserve leaks in cow_file_range +- btrfs: fix qgroup reserve leaks in cow_file_range +- !11725 Squashfs: sanity check symbolic link size +- Squashfs: sanity check symbolic link size +- !11715 btrfs: replace BUG_ON() with error handling at update_ref_for_cow() +- btrfs: replace BUG_ON() with error handling at update_ref_for_cow() +- !11714 CVE-2024-46751 +- btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info() +- btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info() +- btrfs: remove superfluous metadata check at btrfs_lookup_extent_info() +- !11717 CVE-2024-43904 +- drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing +- !11718 CVE-2024-41008 +- drm/amdgpu: change vm->task_info handling +- !11691 sch/netem: fix use after free in netem_dequeue +- sch/netem: fix use after free in netem_dequeue +- !11719 rtla/osnoise: Prevent NULL dereference in error handling +- rtla/osnoise: Prevent NULL dereference in error handling +- !11626 smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open() +- smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open() +- !11651 large folio: Performance and bugfix +- mm: remove invalidate_inode_page() +- mm: convert isolate_page() to mf_isolate_folio() +- mm: convert soft_offline_in_use_page() to use a folio +- mm: use mapping_evict_folio() in truncate_error_page() +- mm: convert __do_fault() to use a folio +- mm: make mapping_evict_folio() the preferred way to evict clean folios +- tmpfs: fault in smaller chunks if large folio allocation not allowed +- mm,tmpfs: consider end of file write in shmem_is_huge +- mm: shmem: move shmem_huge_global_enabled() into shmem_allowable_huge_orders() +- mm: shmem: rename shmem_is_huge() to shmem_huge_global_enabled() +- mm: shmem: simplify the suitable huge orders validation for tmpfs +- !11644 drm/amdgpu: fix dereference after null check +- drm/amdgpu: fix dereference after null check +- !11675 【OLK 6.6】net: hns3: some bugfixes for hns3 driver +- net: hns3: Resolved the issue that the debugfs query result is inconsistent. +- net: hns3: fixed reset failure issues caused by the incorrect reset type +- net: hns3: fix missing features due to dev->features configuration too early +- net: hns3: fix a deadlock problem when config TC during resetting +- net: hns3: add sync command to sync io-pgtable +- net: hns3: default enable tx bounce buffer when smmu enabled +- net: hns3: don't add the len of vlan head if skb_vlan_pop failed +- net: hns3: void array out of bound when loop tnl_num +- net: hns3: use correct release function during uninitialization +- net: hns3: delete redundant enabling actions for Layer 2 fowarding +- !11721 v3 mm/migration: do not folio copy in MIGRATE_SYNC_NO_COPY mode +- mm/migration: do not folio copy in MIGRATE_SYNC_NO_COPY mode +- !8819 Add support for Hygon model 7h processors +- perf/x86/uncore: Add L3 PMU support for Hygon family 18h model 7h +- EDAC/amd64: Add support for Hygon family 18h model 7h +- x86/amd_nb: Add support for Hygon family 18h model 7h +- !11157 [OLK-6.6] Support Hygon Trusted Key Management run on CSV Guest +- drivers/crypto/ccp: add ioctl API to pin TKM hugepage +- driver/crypto/ccp: fix vtkm without C-bit when host SME deactivate +- drivers/crypto/ccp: support TKM run on CSV +- drivers/crypto/ccp: remove multi-level pointers processing for vpsp +- !11669 cgroup-psi-add-PSI_STATE_LAST-for-kabi-reserve +- cgroup/psi: add PSI_STATE_LAST for kabi reserve +- !11666 drm/amd/pm: fix the Out-of-bounds read warning +- drm/amd/pm: fix the Out-of-bounds read warning +- !11607 tty: serial: fsl_lpuart: mark last busy before uart_add_one_port +- tty: serial: fsl_lpuart: mark last busy before uart_add_one_port +- !11646 net: hns3: fix a deadlock problem when config TC during resetting +- net: hns3: fix a deadlock problem when config TC during resetting +- !11648 vsock: fix recursive ->recvmsg calls +- vsock: fix recursive ->recvmsg calls +- !11656 fix CVE-2024-46714 +- drm/amd/display: Skip wbscl_set_scaler_filter if filter is null +- !11631 fix CVE-2024-46723 +- drm/amdgpu: fix ucode out-of-bounds read warning +- !11642 HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup +- HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup +- !11638 Fix CVE-2024-44991 +- tcp: do not export tcp_twsk_purge() +- tcp: prevent concurrent execution of tcp_sk_exit_batch +- tcp/dccp: do not care about families in inet_twsk_purge() +- tcp/dccp: bypass empty buckets in inet_twsk_purge() +- !11608 v3 arm64: perf: Add support for event counting threshold +- perf: arm_pmuv3: Avoid assigning fixed cycle counter with threshold +- arm: perf: Fix ARCH=arm build with GCC +- Revert "perf/arm_dmc620: Remove duplicate format attribute #defines" +- Documentation: arm64: Document the PMU event counting threshold feature +- arm64: perf: Add support for event counting threshold +- arm: pmu: Move error message and -EOPNOTSUPP to individual PMUs +- perf/arm_dmc620: Remove duplicate format attribute #defines +- arm: pmu: Share user ABI format mechanism with SPE +- arm64: perf: Include threshold control fields in PMEVTYPER mask +- arm: perf: Convert remaining fields to use GENMASK +- arm: perf: Use GENMASK for PMMIR fields +- arm: perf/kvm: Use GENMASK for ARMV8_PMU_PMCR_N +- arm: perf: Remove inlines from arm_pmuv3.c +- drivers: perf: arm_pmuv3: Add new macro PMUV3_INIT_MAP_EVENT() +- KVM: arm64: PMU: Add a helper to read a vCPU's PMCR_EL0 +- KVM: arm64: Add PMU event filter bits required if EL3 is implemented +- KVM: arm64: Make PMEVTYPER<n>_EL0.NSH RES0 if EL2 isn't advertised +- drivers: perf: arm_pmuv3: Drop some unused arguments from armv8_pmu_init() +- drivers: perf: arm_pmuv3: Read PMMIR_EL1 unconditionally +- !11629 CVE-2024-46785 +- eventfs: Use list_del_rcu() for SRCU protected list variable +- !11641 mm: set hugepage to false when anon mthp allocation +- mm: set hugepage to false when anon mthp allocation +- !11559 mm/ksm: fix possible UAF of stable_node +- mm/ksm: fix possible UAF of stable_node +- !11613 Input: uinput - reject requests with unreasonable number of slots +- Input: uinput - reject requests with unreasonable number of slots +- !11460 mptcp: pm: avoid possible UaF when selecting endp +- mptcp: pm: avoid possible UaF when selecting endp +- !11598 net/mlx5e: Take state lock during tx timeout reporter +- net/mlx5e: Take state lock during tx timeout reporter +- !11618 RDMA/hns: Fix ah error counter in sw stat not increasing +- RDMA/hns: Fix ah error counter in sw stat not increasing +- !11554 Some patches of RDMA from Linux to openEuler-6.6 +- RDMA/hns: Fix restricted __le16 degrades to integer issue +- RDMA/hns: Optimize hem allocation performance +- RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS +- RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler +- RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled +- !11566 v2 tracefs: Use generic inode RCU for synchronizing freeing +- tracefs: Use generic inode RCU for synchronizing freeing +- !11609 fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF +- fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF +- !11474 fs/netfs/fscache_cookie: add missing "n_accesses" check +- fs/netfs/fscache_cookie: add missing "n_accesses" check +- !11563 iommu: Restore lost return in iommu_report_device_fault() +- iommu: Restore lost return in iommu_report_device_fault() +- !11569 support poison recover from migrate folio +- fs: hugetlbfs: support poisoned recover from hugetlbfs_migrate_folio() +- mm: migrate: support poisoned recover from migrate folio +- mm: migrate: split folio_migrate_mapping() +- mm: add folio_mc_copy() +- mm: move memory_failure_queue() into copy_mc_[user]_highpage() +- mm: migrate: remove migrate_folio_extra() +- mm: migrate_device: unify migrate folio for MIGRATE_SYNC_NO_COPY +- mm: migrate: simplify __buffer_migrate_folio() +- !8822 Add support for Hygon model 10h processors +- ALSA: hda: Add support for Hygon family 18h model 10h HD-Audio +- hwmon/k10temp: Add support for Hygon family 18h model 10h +- EDAC/amd64: Add support for Hygon family 18h model 10h +- x86/amd_nb: Add support for Hygon family 18h model 10h +- x86/cpu: Get LLC ID for Hygon family 18h model 10h +- !11594 gtp: pull network headers in gtp_dev_xmit() +- gtp: pull network headers in gtp_dev_xmit() +- !11573 btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk() +- btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk() +- !11585 vfs: Don't evict inode under the inode lru traversing context +- vfs: Don't evict inode under the inode lru traversing context +- !11461 bnxt_en: Fix double DMA unmapping for XDP_REDIRECT +- bnxt_en: Fix double DMA unmapping for XDP_REDIRECT + +* Wed Sep 18 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-42.0.0.49 +- !11556 bpf: Fix a kernel verifier crash in stacksafe() +- bpf: Fix a kernel verifier crash in stacksafe() +- !11496 virtcca feature：Fix warnings +- virtcca feature: fix warnings +- !11531 [OLK-6.6]Some updates for HiSilicon PCIe PMU +- drivers/perf: hisi_pcie: Export supported Root Ports [bdf_min, bdf_max] +- drivers/perf: hisi_pcie: Fix TLP headers bandwidth counting +- drivers/perf: hisi_pcie: Record hardware counts correctly +- !11546 ata: libata: Fix memory leak for error path in ata_host_alloc() +- ata: libata: Fix memory leak for error path in ata_host_alloc() +- !11551 mm/memory_hotplug: prevent accessing by index=-1 +- mm/memory_hotplug: prevent accessing by index=-1 +- !11522 ipv6: prevent UAF in ip6_send_skb() +- ipv6: prevent UAF in ip6_send_skb() +- !11518 ipv6: fix possible UAF in ip6_finish_output2() +- ipv6: fix possible UAF in ip6_finish_output2() +- !11515 net: dsa: mv88e6xxx: Fix out-of-bound access +- net: dsa: mv88e6xxx: Fix out-of-bound access +- !11513 ipv6: prevent possible UAF in ip6_xmit() +- ipv6: prevent possible UAF in ip6_xmit() +- !11503 mm: mTHP user controls to pagecache large folio +- mm/huge_memory: allow to enable 64K anouymous mapping align alone +- mm/huge_memory: mTHP user controls to pagecache large folio +- !5453 Add GM Driver Support for Hygon platform（Cryptographic Coprocessor，OLK-6.6) +- hct: fix fork issue when use hct in virtual machine +- hct: support 1024 processes simutaneously in the hct-mdev mode. +- hct: change the maximum number of supported ccps from 16 to 48. +- hct: fix build issue when the module mdev is disabled. +- hct: supporting memory encryption in host and wb set in vm +- hct: add mediated ccp driver support for hygon crypto technology. +- crypto: ccp: support sm2 on Hygon generation 4th CPU +- crypto: ccp: remove repeated sm4-hs mode +- crypto: ccp: Process multiple VQ commands once for SM4/SM4-CTR ccp. +- crypto: ccp: Process multiple VQ commands once for SM3 ccp. +- crypto: ccp: Modify value of COMMANDS_PER_QUEUE from 16 to 8192. +- crypto: ccp: fix bug that SM2 encryption of long data causes kernel crash +- crypto: ccp: fix sm2 test failed in testmgr because of missing DER coding +- crypto: ccp: Fix a problem that vq thread may stuck when do multi process test. +- crypto: ccp: Only handle interrupts by completion. +- crypto: ccp: It prompt ILLEGAL_MEM_ADDR when using PSPCCP. +- crypto: ccp: fix sm2 not return due to wrong complete callback parameter +- crypto: ccp: Support SM4 algorithm for hygon ccp. +- crypto: ccp: Support SM3 algorithm for hygon ccp. +- crypto: ccp: Support SM2 algorithm for hygon ccp. +- !11485 Bugfix introduced when support folio +- mm/shmem: replace HPAGE_PMD_ORDER with PMD_ORDER in shmem_alloc_folio() +- mm: huge_memory: add memory reliable count in __discard_anon_folio_pmd_locked() +- mm: limit order to 0 when allocated from dynamic pool +- !11469 OLK-6.6 Revert gpiolib bugfix +- gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match +- Revert "gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match" +- !11464 mm/ksm: fix ksm_zero_pages accounting +- mm_types: Fix kabi breakage in struct mm_struct +- mm/ksm: fix ksm_zero_pages accounting +- !11411 f2fs: fix null reference error when checking end of zone +- f2fs: fix null reference error when checking end of zone +- !11465 【olk 6.6】net: hns3: some bugfixes for netdev +- net: hns3: fix kernel crash when 1588 is sent on HIP08 devices +- net: hns3: initialize reset_timer before hclgevf_misc_irq_init() +- net: hns3: don't auto enable misc vector +- !11454 nfs: fix memory leak in error path of nfs4_do_reclaim +- nfs: fix memory leak in error path of nfs4_do_reclaim +- !11421 Some fixes About cpuset partition +- cgroup/cpuset: Clear effective_xcpus on cpus_allowed clearing only if cpus.exclusive not set +- cgroup/cpuset: fix panic caused by partcmd_update +- cgroup/cpuset: Fix remote root partition creation problem +- cgroup/cpuset: Optimize isolated partition only generate_sched_domains() calls +- !11455 v2 CVE-2024-44972 +- btrfs: fix invalid mapping of extent xarray state +- btrfs: do not clear page dirty inside extent_write_locked_range() + +* Fri Sep 06 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-41.0.0.48 +- !11443 v2 drm/amd/display: Fix null pointer deref in dcn20_resource.c +- drm/amd/display: Fix null pointer deref in dcn20_resource.c +- !11433 ext4: Track data blocks freeing operation in journal +- ext4: Track data blocks freeing operation in journal +- !11063 virtcca feature: secure smmu init +- virtcca feature: secure smmu doc +- virtcca feature: secure smmu init +- !11206 kprobe support %pd/%pD type +- selftests/ftrace: Fix required features for VFS type test case +- selftests/ftrace: add fprobe test cases for VFS type "%pd" and "%pD" +- selftests/ftrace: add kprobe test cases for VFS type "%pd" and "%pD" +- Documentation: tracing: add new type '%pd' and '%pD' for kprobe +- tracing/probes: support '%pD' type for print struct file's name +- tracing/probes: support '%pd' type for print struct dentry's name +- !10875 Incorporate some bonding patches as follows(OLK-6.6) +- RDMA/hns: Fix concurrency issue between bond work and bond event +- RDMA/hns: Fix UAF in clear bond printing +- RDMA/hns: Encapsulate upper event and lowerstate event handlers +- RDMA/hns: Register notifier block of bonding events in bond_grp +- !11304 iomap: fault in smaller chunks for non-large folio mappings +- iomap: fault in smaller chunks for non-large folio mappings +- !11397 fuse: Initialize beyond-EOF page contents before setting uptodate +- fuse: Initialize beyond-EOF page contents before setting uptodate +- !11303 【OLK-6.6】ROH sync patch from OLK-5.10 +- roh/core: Avoid null pointer access and optimize code. +- Revert "RDMA/hns: Support RDMA_CM in ROH mode" +- RDMA/hns: Support getting GRH for UD in RoH mode when NLP = 0 +- roh/core: Support macvlan in roh. +- roh/hns3: Add ROH client case in hclgevf_init_client_instance. +- roh/hns3: Fix IMP reset vlan unusable. +- !11363 kcm: Serialise kcm_sendmsg() for the same socket. +- kcm: Serialise kcm_sendmsg() for the same socket. +- !11381 mm/dynamic_pool: use batch to add free pages to dpool +- mm/dynamic_pool: use batch to add free pages to dpool +- !11355 ext4: Fix wrong da count caused by concurrent racing on extent tree +- ext4: Fix wrong da count caused by concurrent racing on extent tree +- !11335 Revert SPI bugfixs +- spi: hisi-kunpeng: Add validation for the minimum value of speed_hz +- spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware +- Revert "spi: hisi-kunpeng: Add validation for the minimum value of speed_hz" +- Revert "spi: Add verification for the max_frequency provided by the firmware" +- !11336 nfsd: map the EBADMSG to nfserr_io to avoid warning +- nfsd: map the EBADMSG to nfserr_io to avoid warning +- !11342 large folios swap-in: handle refault cases first +- mm: remove folio_test_anon(folio)==false path in __folio_add_anon_rmap() +- mm: use folio_add_new_anon_rmap() if folio_test_anon(folio)==false +- mm: extend rmap flags arguments for folio_add_new_anon_rmap +- mm: rmap: abstract updating per-node and per-memcg stats +- mm: swap: reuse exclusive folio directly instead of wp page faults +- mm: swap: entirely map large folios found in swapcache +- mm: swap: make should_try_to_free_swap() support large-folio +- mm: introduce arch_do_swap_page_nr() which allows restore metadata for nr pages +- mm: introduce pte_move_swp_offset() helper which can move offset bidirectionally +- mm: remove the implementation of swap_free() and always use swap_free_nr() +- mm: swap: introduce swap_free_nr() for batched swap_free() +- mm: remove page_add_new_anon_rmap and lru_cache_add_inactive_or_unevictable +- mm: userswap: page_add_new_anon_rmap() -> folio_add_new_anon_rmap() +- mm: convert collapse_huge_page() to use a folio +- mm: convert migrate_vma_insert_page() to use a folio +- mm: remove references to page_add_new_anon_rmap in comments +- mm: remove stale example from comment +- mm: remove some calls to page_add_new_anon_rmap() +- mm: convert unuse_pte() to use a folio throughout +- mm: convert ksm_might_need_to_copy() to work on folios +- mm: memory: use a folio in validate_page_before_insert() +- mm: ksm: use more folio api in ksm_might_need_to_copy() +- !11328 jbd2: avoid mount failed when commit block is partial submitted +- jbd2: avoid mount failed when commit block is partial submitted +- !11222 nfs: pass explicit offset/count to trace events +- nfs: pass explicit offset/count to trace events +- !11321 NFSD: simplify error paths in nfsd_svc() +- NFSD: simplify error paths in nfsd_svc() +- !11314 nvme-fabrics: use reserved tag for reg read/write command +- nvme-fabrics: use reserved tag for reg read/write command +- !11119 virtcca compile warning clean +- virtcca bugfix: compile warning clean +- !10762 CVE-2024-41016 +- ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() +- ocfs2: add bounds checking to ocfs2_xattr_find_entry() +- !11300 v3 mm/shmem: mTHP support for anon shmem +- mm: shmem: rename mTHP shmem counters +- mm: add docs for per-order mTHP split counters +- mm: add per-order mTHP split counters +- mm: shmem: fix incorrect aligned index when checking conflicts +- mm: shmem: avoid allocating huge pages larger than MAX_PAGECACHE_ORDER for shmem +- mm: thp: support "THPeligible" semantics for mTHP with anonymous shmem +- mm/shmem: fix input and output inconsistencies +- mm: shmem: add mTHP counters for anonymous shmem +- mm: shmem: add mTHP size alignment in shmem_get_unmapped_area +- mm: shmem: add mTHP support for anonymous shmem +- mm: shmem: add multi-size THP sysfs interface for anonymous shmem +- mm: shmem: add THP validation for PMD-mapped THP related statistics +- mm: memory: extend finish_fault() to support large folio +- mm: shmem: Merge shmem_alloc_hugefolio() with shmem_alloc_folio() +- mm: use update_mmu_tlb_range() to simplify code +- mm: implement update_mmu_tlb() using update_mmu_tlb_range() +- mm: add update_mmu_tlb_range() +- shmem: move the shmem_mapping assert into shmem_get_folio_gfp +- shmem: set a_ops earlier in shmem_symlink +- shmem,percpu_counter: add _limited_add(fbc, limit, amount) +- shmem: _add_to_page_cache() before shmem_inode_acct_blocks() +- shmem: move memcg charge out of shmem_add_to_page_cache() +- shmem: shmem_acct_blocks() and shmem_inode_acct_blocks() +- shmem: trivial tidyups, removing extra blank lines, etc +- shmem: factor shmem_falloc_wait() out of shmem_fault() +- shmem: remove vma arg from shmem_get_folio_gfp() +- shmem: shrink shmem_inode_info: dir_offsets in a union +- !11270 nvme: apple: fix device reference counting +- nvme: apple: fix device reference counting +- !11279 ice: Don't process extts if PTP is disabled +- ice: Don't process extts if PTP is disabled +- !11280 ice: Fix improper extts handling +- ice: Fix improper extts handling +- !11233 CVE-2024-43892 +- memcg: protect concurrent access to mem_cgroup_idr +- !11229 tracing: Have format file honor EVENT_FILE_FL_FREED +- tracing: Have format file honor EVENT_FILE_FL_FREED +- !11228 Bluetooth: MGMT: Add error handling to pair_device() +- Bluetooth: MGMT: Add error handling to pair_device() +- !10698 wifi: mac80211: Avoid address calculations via out of bounds array indexing +- wifi: mac80211: Avoid address calculations via out of bounds array indexing +- !11158 usb: vhci-hcd: Do not drop references before new references are gained +- usb: vhci-hcd: Do not drop references before new references are gained +- !11040 mm: lazyfree THP support +- mm/huge_memory.c: fix used-uninitialized +- mm/vmscan: avoid split lazyfree THP during shrink_folio_list() +- mm/rmap: integrate PMD-mapped folio splitting into pagewalk loop +- mm/rmap: remove duplicated exit code in pagewalk loop +- mm: arm64: fix the out-of-bounds issue in contpte_clear_young_dirty_ptes +- mm/madvise: optimize lazyfreeing with mTHP in madvise_free +- mm/memory: add any_dirty optional pointer to folio_pte_batch() +- mm/arm64: override clear_young_dirty_ptes() batch helper +- mm/madvise: introduce clear_young_dirty_ptes() batch helper +- mm: add pmd_folio() +- mm: make HPAGE_PXD_* macros even if !THP +- mm/Kconfig: CONFIG_PGTABLE_HAS_HUGE_LEAVES + +* Tue Aug 27 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-39.0.0.47 +- !11156 v3 Fix CVE-2024-43869 +- perf: Fix kabi broken of struct perf_event +- perf: Fix event leak upon exec and file release +- !11168 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.46-47 LTS Patches +- Revert "ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error" +- media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()" +- KVM: arm64: Don't pass a TLBI level hint when zapping table entries +- KVM: arm64: Don't defer TLB invalidation when zapping table entries +- mm/debug_vm_pgtable: drop RANDOM_ORVALUE trick +- Revert "Input: bcm5974 - check endpoint type before starting traffic" +- Revert "jfs: fix shift-out-of-bounds in dbJoin" +- binfmt_flat: Fix corruption when not offsetting data start +- ALSA: usb: Fix UBSAN warning in parse_audio_unit() +- fs/ntfs3: Do copy_to_user out of run_lock +- jfs: Fix shift-out-of-bounds in dbDiscardAG +- jfs: fix null ptr deref in dtInsertEntry +- fou: remove warn in gue_gro_receive on unsupported protocol +- f2fs: fix to cover read extent cache access with lock +- f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC +- bpf, net: Use DEV_STAT_INC() +- ext4: sanity check for NULL pointer after ext4_force_shutdown +- ext4: convert ext4_da_do_write_end() to take a folio +- mm/page_table_check: support userfault wr-protect entries +- nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies +- net: add copy_safe_from_sockptr() helper +- mISDN: fix MISDN_TIME_STAMP handling +- fs: Annotate struct file_handle with __counted_by() and use struct_size() +- bpf: Avoid kfree_rcu() under lock in bpf_lpm_trie. +- bpf: Replace bpf_lpm_trie_key 0-length array with flexible array +- pppoe: Fix memory leak in pppoe_sendmsg() +- net: sctp: fix skb leak in sctp_inq_free() +- net:rds: Fix possible deadlock in rds_message_put +- quota: Detect loops in quota tree +- Input: bcm5974 - check endpoint type before starting traffic +- net: tls, add test to capture error on large splice +- erofs: avoid debugging output for (de)compressed data +- reiserfs: fix uninit-value in comp_keys +- Squashfs: fix variable overflow triggered by sysbot +- squashfs: squashfs_read_data need to check if the length is 0 +- jfs: fix shift-out-of-bounds in dbJoin +- net: don't dump stack on queue timeout +- jfs: fix log->bdev_handle null ptr deref in lbmStartIO +- wifi: mac80211: fix change_address deadlock during unregister +- wifi: mac80211: take wiphy lock for MAC addr change +- tcp_metrics: optimize tcp_metrics_flush_all() +- genirq/cpuhotplug: Retry with cpu_online_mask when migration fails +- genirq/cpuhotplug: Skip suspended interrupts when restoring affinity +- nvme/pci: Add APST quirk for Lenovo N60z laptop +- nfsd: make svc_stat per-network namespace instead of global +- nfsd: remove nfsd_stats, make th_cnt a global counter +- nfsd: make all of the nfsd stats per-network namespace +- nfsd: expose /proc/net/sunrpc/nfsd in net namespaces +- nfsd: rename NFSD_NET_* to NFSD_STATS_* +- sunrpc: use the struct net as the svc proc private +- sunrpc: remove ->pg_stats from svc_program +- sunrpc: pass in the sv_stats struct through svc_create_pooled +- nfsd: stop setting ->pg_stats for unused stats +- sunrpc: don't change ->sv_stats if it doesn't exist +- NFSD: Fix frame size warning in svc_export_parse() +- NFSD: Rewrite synopsis of nfsd_percpu_counters_init() +- LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h +- btrfs: fix double inode unlock for direct IO sync writes +- Revert "selftests: mptcp: simult flows: mark 'unbalanced' tests as flaky" +- selftests: mptcp: join: test both signal & subflow +- selftests: mptcp: join: ability to invert ADD_ADDR check +- mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set +- mptcp: pm: don't try to create sf if alloc failed +- mptcp: pm: reduce indentation blocks +- nouveau: set placement to original placement on uvmm validate. +- mm/hugetlb: fix potential race in __update_and_free_hugetlb_folio() +- tools headers arm64: Sync arm64's cputype.h with the kernel sources +- ipv6: fix source address selection with route leak +- btrfs: fix corruption after buffer fault in during direct IO append write +- mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines +- mm: huge_memory: don't force huge page alignment on 32 bit +- Revert "drm/amd/display: Add NULL check for 'afb' before dereferencing in amdgpu_dm_plane_handle_cursor_update" +- block: use the right type for stub rq_integrity_vec() +- mptcp: pm: deny endp with signal + subflow + port +- selftests: mptcp: fix error path +- mptcp: fully established after ADD_ADDR echo on MPJ +- drm/radeon: Remove __counted_by from StateArray.states[] +- drm/mgag200: Bind I2C lifetime to DRM device +- drm/mgag200: Set DDC timeout in milliseconds +- drm/lima: Mark simple_ondemand governor as softdep +- drm/dp_mst: Skip CSN if topology probing is not done yet +- drm/bridge: analogix_dp: properly handle zero sized AUX transactions +- x86/mtrr: Check if fixed MTRRs exist before saving them +- x86/paravirt: Fix incorrect virt spinlock setting on bare metal +- selftests: mm: add s390 to ARCH check +- eventfs: Use SRCU for freeing eventfs_inodes +- eventfs: Don't return NULL in eventfs_create_dir() +- smb3: fix setting SecurityFlags when encryption is required +- padata: Fix possible divide-by-0 panic in padata_mt_helper() +- tracing: Fix overflow in get_free_elt() +- power: supply: axp288_charger: Round constant_charge_voltage writes down +- power: supply: axp288_charger: Fix constant_charge_voltage writes +- power: supply: qcom_battmgr: return EAGAIN when firmware service is not up +- LoongArch: Enable general EFI poweroff method +- genirq/irqdesc: Honor caller provided affinity in alloc_desc() +- irqchip/xilinx: Fix shift out of bounds +- kcov: properly check for softirq context +- ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop 16-n0xxx +- parisc: fix a possible DMA corruption +- parisc: fix unaligned accesses in BPF +- serial: core: check uartclk for zero to avoid divide by zero +- timekeeping: Fix bogus clock_was_set() invocation in do_adjtimex() +- ntp: Safeguard against time_constant overflow +- tracefs: Fix inode allocation +- driver core: Fix uevent_show() vs driver detach race +- clocksource: Fix brown-bag boolean thinko in cs_watchdog_read() +- clocksource: Scale the watchdog read retries automatically +- vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler +- tick/broadcast: Move per CPU pointer access into the atomic section +- scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic +- scsi: ufs: core: Do not set link to OFF state while waking up from hibernation +- scsi: mpi3mr: Avoid IOMMU page faults on REPORT ZONES +- usb: gadget: u_audio: Check return codes from usb_ep_enable and config_ep_by_speed. +- usb: gadget: u_serial: Set start_delayed during suspend +- usb: gadget: midi2: Fix the response for FB info with block 0xff +- usb: gadget: core: Check for unset descriptor +- USB: serial: debug: do not echo input by default +- usb: vhci-hcd: Do not drop references before new references are gained +- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 +- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks +- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list +- ALSA: line6: Fix racy access to midibuf +- drm/client: fix null pointer dereference in drm_client_modeset_probe +- drm/i915/gem: Adjust vma offset for framebuffer mmap offset +- drm/amdgpu: Forward soft recovery errors to userspace +- drm/amd/display: Skip Recompute DSC Params if no Stream on Link +- drm/i915/gem: Fix Virtual Memory mapping boundaries calculation +- module: make waiting for a concurrent module loader interruptible +- module: warn about excessively long module waits +- cifs: cifs_inval_name_dfs_link_error: correct the check for fullpath +- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT +- ALSA: usb-audio: Re-add ScratchAmp quirk entries +- spi: spi-fsl-lpspi: Fix scldiv calculation +- i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume +- i2c: qcom-geni: Add missing clk_disable_unprepare in geni_i2c_runtime_resume +- kprobes: Fix to check symbol prefixes correctly +- bpf: kprobe: remove unused declaring of bpf_kprobe_override +- i2c: smbus: Send alert notifications to all devices if source not found +- ASoC: SOF: Remove libraries from topology lookups +- spi: spidev: Add missing spi_device_id for bh2228fv +- ASoC: sti: add missing probe entry for player and reader +- ASoC: codecs: wsa884x: Correct Soundwire ports mask +- ASoC: codecs: wsa884x: parse port-mapping information +- ASoC: codecs: wsa883x: Correct Soundwire ports mask +- ASoC: codecs: wsa883x: parse port-mapping information +- ASoC: codecs: wsa881x: Correct Soundwire ports mask +- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask +- i2c: smbus: Improve handling of stuck alerts +- arm64: cputype: Add Cortex-A725 definitions +- arm64: cputype: Add Cortex-X1C definitions +- arm64: cputype: Add Cortex-X925 definitions +- arm64: cputype: Add Cortex-A720 definitions +- arm64: cputype: Add Cortex-X3 definitions +- arm64: cputype: Add Neoverse-V3 definitions +- arm64: cputype: Add Cortex-X4 definitions +- arm64: barrier: Restore spec_bar() macro +- arm64: Add Neoverse-V2 part +- net: drop bad gso csum_start and offset in virtio_net_hdr +- irqchip/loongarch-cpu: Fix return value of lpic_gsi_to_irq() +- irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to 'raw_spinlock_t' +- scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES +- SUNRPC: Fix a race to wake a sync task +- s390/sclp: Prevent release of buffer in I/O +- jbd2: avoid memleak in jbd2_journal_write_metadata_buffer +- ext4: fix uninitialized variable in ext4_inlinedir_to_tree +- media: xc2028: avoid use-after-free in load_firmware_cb() +- media: uvcvideo: Fix the bandwdith quirk on USB 3.x +- media: uvcvideo: Ignore empty TS packets +- drm/amd/display: Add null checker before passing variables +- drm/amd/display: Add NULL check for 'afb' before dereferencing in amdgpu_dm_plane_handle_cursor_update +- media: amphion: Remove lock in s_ctrl callback +- drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr +- drm/amdgpu: Add lock around VF RLCG interface +- drm/admgpu: fix dereferencing null pointer context +- drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules +- drm/amdgpu: Fix the null pointer dereference to ras_manager +- drm/amdgpu/pm: Fix the null pointer dereference for smu7 +- drm/amdgpu/pm: Fix the param type of set_power_profile_mode +- drm/amdgpu: fix potential resource leak warning +- drm/amd/display: Add delay to improve LTTPR UHBR interop +- Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading +- btrfs: fix bitmap leak when loading free space cache on duplicate entry +- net: stmmac: qcom-ethqos: enable SGMII loopback during DMA reset on sa8775p-ride-r3 +- can: mcp251xfd: tef: update workaround for erratum DS80000789E 6 of mcp2518fd +- can: mcp251xfd: tef: prepare to workaround broken TEF FIFO tail index erratum +- wifi: nl80211: don't give key data to userspace +- udf: prevent integer overflow in udf_bitmap_free_blocks() +- PCI: Add Edimax Vendor ID to pci_ids.h +- af_unix: Don't retry after unix_state_lock_nested() in unix_stream_connect(). +- selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT +- net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink +- wifi: ath12k: fix memory leak in ath12k_dp_rx_peer_frag_setup() +- wifi: nl80211: disallow setting special AP channel widths +- xen: privcmd: Switch from mutex to spinlock for irqfds +- ACPI: SBS: manage alarm sysfs attribute through psy core +- ACPI: battery: create alarm sysfs attribute atomically +- clocksource/drivers/sh_cmt: Address race condition for clock events +- rcu: Fix rcu_barrier() VS post CPUHP_TEARDOWN_CPU invocation +- block: change rq_integrity_vec to respect the iterator +- md/raid5: avoid BUG_ON() while continue reshape after reassembling +- rcutorture: Fix rcu_torture_fwd_cb_cr() data race +- hwmon: corsair-psu: add USB id of HX1200i Series 2023 psu +- gpio: prevent potential speculation leaks in gpio_device_get_desc() +- net: fec: Stop PPS on driver remove +- net: bcmgenet: Properly overlay PHY and MAC Wake-on-LAN capabilities +- l2tp: fix lockdep splat +- net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() +- net/smc: add the max value of fallback reason count +- Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv monitor +- Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() +- ice: Fix reset handler +- net: linkwatch: use system_unbound_wq +- net: bridge: mcast: wait for previous gc cycles when removing port +- sctp: Fix null-ptr-deref in reuseport_add_sock(). +- wifi: ath12k: fix soft lockup on suspend +- wifi: ath12k: add CE and ext IRQ flag to indicate irq_handler +- wifi: ath12k: rename the sc naming convention to ab +- smb: client: handle lack of FSCTL_GET_REPARSE_POINT support +- x86/mm: Fix pti_clone_entry_text() for i386 +- x86/mm: Fix pti_clone_pgtable() alignment assumption +- jump_label: Fix the fix, brown paper bags galore +- platform/x86/intel/ifs: Initialize union ifs_status to zero +- !11100 exec: Fix ToCToU between perm check and set-uid/gid usage +- exec: Fix ToCToU between perm check and set-uid/gid usage +- !11106 CVE-2024-43868 +- riscv/purgatory: align riscv_kernel_entry +- riscv: Use SYM_*() assembly macros instead of deprecated ones +- !11094 v4 Backport bugfix of folio from v6.11 +- ext4: Fix WARNON in generic write begin path for iomap mode +- mm/huge_memory: fix comment errors of thp_mapping_align +- mm/slub: mark racy accesses on slab->slabs +- mm/slub: mark racy access on slab->freelist +- mm/swapfile: mark racy access on si->highest_bit +- mm/mmap: simplify vma link and unlink +- mm/readahead: limit page cache size in page_cache_ra_order() +- readahead: use ilog2 instead of a while loop in page_cache_ra_order() +- filemap: Convert generic_perform_write() to support large folios +- mm/huge_memory: avoid PMD-size page cache if needed +- mm: simplify folio_migrate_mapping() +- mm: refactor folio_undo_large_rmappable() +- mm: fix crashes from deferred split racing folio migration +- mm: page_alloc: allowing mTHP compaction to capture the freed page directly +- mm/migrate: fix deadlock in migrate_pages_batch() on large folios +- mm: fix khugepaged activation policy +- mm/huge_memory: mark racy access onhuge_anon_orders_always +- mm/migrate: putback split folios when numa hint migration fails +- mm/migrate: make migrate_pages_batch() stats consistent +- !11125 mm/memory-failure: fix handling of dissolved but not taken off from buddy pages +- mm/memory-failure: fix handling of dissolved but not taken off from buddy pages +- !11077 IMA: Support the measurement extending of TSI TMM +- IMA: Support the measurement extending of TSI TMM +- !11108 cpufreq: CPPC: Eliminate the impact of cpc_read() latency error +- cpufreq: CPPC: Eliminate the impact of cpc_read() latency error +- !11081 Backport LTS conflicting patches +- ALSA: hda/realtek: Fix conflicting quirk for PCI SSID 17aa:3820 +- vfio/pci: Restore zero affected bus reset devices warning +- cxl/region: check interleave capability +- EDAC/amd64: Convert PCIBIOS_* return codes to errnos +- ALSA: hda/realtek: Enable headset mic on IdeaPad 330-17IKB 81DM +- vfio/pci: Init the count variable in collecting hot-reset devices +- vfio/pci: Collect hot-reset devices to local buffer +- platform/chrome: cros_ec: Handle events during suspend after resume completion +- !10998 PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init() +- PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init() +- !10942 add support for arm virtcca attestation +- cvm_tsi: add support virtcca attestation +- !11043 [OLK-6.6] drivers: add GPU Peer Memory support +- drivers: Fix kabi check failure +- drivers: Add GDR(GPU Direct RDMA) support +- !11044 ext4: some bugfixs for large iomap&folio +- iomap: improve iomap_folio_mkwrite_iter and ifs_clear_range_dirty +- iomap: optimize setting uptodate bit +- iomap: reduce unnecessary state_lock when setting ifs uptodate and dirty bits +- iomap: don't mark blocks uptodate after partial zeroing +- ext4: ext4_iomap_map_blocks: Fix null pointer deference in nojournal mode +- xfs: reserve blocks for truncating large realtime inode +- xfs: hoist multi-fsb allocation unit detection to a helper +- !11018 net: usb: qmi_wwan: fix memory leak for not ip packets +- net: usb: qmi_wwan: fix memory leak for not ip packets +- !10927 block: Fix lockdep warning in blk_mq_mark_tag_wait +- block: Fix lockdep warning in blk_mq_mark_tag_wait +- !11004 kvm: s390: Reject memory region operations for ucontrol VMs +- kvm: s390: Reject memory region operations for ucontrol VMs +- !10969 bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG +- bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG +- !10407 Intel: Backport SPR/EMR CXL and HBM perfmon support to kernel 6.6 +- perf/x86/intel/uncore: Support HBM and CXL PMON counters +- perf/x86/uncore: Cleanup unused unit structure +- perf/x86/uncore: Apply the unit control RB tree to PCI uncore units +- perf/x86/uncore: Apply the unit control RB tree to MSR uncore units +- perf/x86/uncore: Apply the unit control RB tree to MMIO uncore units +- perf/x86/uncore: Retrieve the unit ID from the unit control RB tree +- perf/x86/uncore: Support per PMU cpumask +- perf/x86/uncore: Save the unit control address of all units +- !10411 Intel: Backport 3 core PMU bugfixes to kernel 6.6 +- perf/x86/intel: Correct incorrect 'or' operation for PMU capabilities +- perf/x86/intel: Fix broken fixed event constraints extension +- perf/x86/intel: Add a distinct name for Granite Rapids +- perf/x86/intel: Hide Topdown metrics events if the feature is not enumerated +- perf/x86/intel: Add common intel_pmu_init_hybrid() +- perf/x86/intel: Clean up the hybrid CPU type handling code +- perf/x86/intel: Apply the common initialization code for ADL +- perf/x86/intel: Factor out the initialization code for ADL e-core +- perf/x86/intel: Factor out the initialization code for SPR +- perf/x86/intel: Use the common uarch name for the shared functions +- !10911 Fix CVE-2024-40966 +- tty: fix kabi breakage in struct tty_operations +- tty: add the option to have a tty reject a new ldisc +- !10918 【OLK 6.6】net: hns3: use the user's cfg after reset +- net: hns3: use the user's cfg after reset +- !10907 v2 perf/x86: Fix smp_processor_id()-in-preemptible warnings +- perf/x86: Fix smp_processor_id()-in-preemptible warnings +- !10585 Fix the issue that vm can't access to host with virtio-net +- vhost: move smp_rmb() into vhost_get_avail_idx() +- vhost: correct misleading printing information +- !10812 ima: dont disable digest_list if the file is not processed +- ima: dont disable digest_list if the file is not processed +- !10819 [OLK-6.6] Support Hygon Trusted Key Management virtualization +- drivers/crypto/ccp: memmove is used instead of memcpy in overlapped memmory for tkm +- drivers/crypto/ccp: Eliminate dependence of the kvm module on the ccp module +- drivers/crypto/ccp: Allow VM without a configured vid to use TKM +- drivers/crypto/ccp: support tkm key isolation +- arch/x86/kvm: Support tkm virtualization +- arch/x86/kvm: Support psp virtualization +- drivers/crypto/ccp: Add psp mutex enable ioctl support +- drivers/crypto/ccp: concurrent psp access support between user and kernel space +- !6863 sdei_watchdog: don't update last_check_time when no watchdog_hardlockup_check is performed +- sdei_watchdog: do not update last_check_time when no watchdog_hardlockup_check is performed +- !10899 selftests/bpf: Add netlink helper library +- selftests/bpf: Add netlink helper library +- !10690 [OLK-6.6] Support Trusted computing(TC) feature for hygon CPU +- crypto: command co-processor: Add config to openeuler_defconfig +- linux: tcm: add Hygon TCM2 driver +- linux: tpm: add Hygon TPM2 driver +- crypto: tdm: Support dynamic protection for SCT and IDT by HYGON TDM +- crypto: tdm: Add Hygon TDM driver +- crypto: command co-processor: Add another mailbox interrupt support for PSP sending command to X86 +- crypto: ccp: Add a new interface for X86 sending command to PSP +- !10720 v2 s390/pkey: Wipe copies of clear-key structures on failure +- s390/pkey: Wipe copies of clear-key structures on failure + +* Wed Aug 14 2024 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-38.0.0.46 +- riscv kernel upgrade to 6.6.0-38.0.0 +- bugfix for sg2042 accessing kernel page tables +- revert sg2042 high memory +- revert sg2042 kexec image +- add support th1520 modules: + pinctrl, eMMC, gpio, usb, pwm, ethernet, th1520 perf, ADC, clock, + mailbox, reset, qspi, pvt, gpio, dma, mmc, cpufreq, rtc, dwmac, + light-event, rpmsg, i2c, i2s, light-aon, light-aon-pd, codec, gpu. + +- th1520: riscv: dtb: Add gpu node +- riscv: config: Disable RISCV_ISA_V in openEuler +- th1520: riscv: config: disable RISCV_ISA_V in th1520_defconfig +- riscv: config: Set NVMe driver builtin +- th1520: riscv: config: Enable PowerVR GPU +- th1520: riscv: Add GPU to th1520_defconfig +- th1520: riscv: config: Enable th1520 support +- sg2042: riscv: config: Enable sg2042 support +- sg2042: riscv: config: Add sg2042_defconfig +- riscv: Use accessors to page table entries instead of direct dereference +- riscv: mm: Only compile pgtable.c if MMU +- mm: Introduce pudp/p4dp/pgdp_get() functions +- riscv: Use WRITE_ONCE() when setting page table entries +- Merge patch series "membarrier: riscv: Core serializing command" +- membarrier: riscv: Add full memory barrier in switch_mm() +- stmmac: bitmain: use DWMAC_SOPHGO module config +- pcie: whitelist and support mellanox connectx-2 +- riscv: input: Fixup input_event +- drm: Fix HDMI hot-plug problem +- gpu/drm: hdmi: Add hdmi debounce to enhance hdmi plugin/out stable +- audio: th1520: fixup compile warning of i2s driver +- DPU: fix bugs of DPU and resolve compilation warnings +- riscv: binrpm: Add dtbs install +- th1520: gpu: Add driver for PowerVR Rogue GPU +- dmaengine: dw-axi-dmac: Add support for Xuantie TH1520 DMA +- arch:rsicv:select ARCH_HAS_DMA_WRITE_COMBINE +- configs: enable rtw88 for 8723ds +- drivers: pinctrl: correct th1520 audio i2c1 bit mapping table +- driver:padctrl:correct th1520 gpio_1 24/25 cfg +- dts: th1520: add adc vref-supply regulator +- dts: th1520: add cpu thermal node and device thermal node +- drivers: event: add macro definition to control SW_PANIC event +- chore: use thead instead of xuantie +- chore: use xuantie instead of thead +- riscv: ptrace: Fix ptrace using uninitialized riscv_v_vsize +- audio: th1520: enable soundcard feature +- audio: th1520: support audiosys pinctrl feature +- dts: th1520: fix interrupt number config error in dts +- th1520: defconfig: add configs to align the functionality and performance of previous related versions +- DPU: add DPU driver for Lichee-Pi-4A board +- dts: th1520: add npu device node +- codec: audio: add codec driver for Lichee-Pi-4A board +- drivers: cpufreq: add cpufreq driver. +- riscv: dts: Introduce lichee-pi-4a fixed regulator support. +- th1520: defconfig: to remove unnecessary configs for th1520 +- i2s: remove debug message +- riscv:dts: fix the aon gpio range configuration error +- riscv:dts: fix spi/qspi1 cs pin duplicate configuration error +- riscv:dts: fix the gpio range configuration error +- drivers: regulator: add th1520 AON virtual regulator control support. +- dt-bindings: add AON resource id headfile +- drivers: pmdomain: support th1520 Power domain control. +- i2s: add i2s driver for XuanTie TH1520 SoC +- configs: xuantie: correct definition of SoC Architecture +- configs: enable th1520 xgene rtc and rtc prescale in th1520_defconfig +- riscv: mm: update T-Head memory type definitions +- i2c: designware: add support for hcnt/lcnt got from dt +- add 902 share mem log +- th1520_defconfig: add usb config +- refine thead,th1520-usb.yaml +- drivers: usb: dwc3: add usb_mode usb_speed param for mode speed change when insmod ko +- drivers: usb: add dwc3-thead.c +- th1520.dtsi: refine usb dts +- configs: enable th1520 event and watchdog +- riscv:dts:thead: Add TH1520 event and watchdog device node +- dt-bindings:wdt: Add Documentation for THEAD TH1520 pmic watchdog +- drivers/watchdog: Add THEAD TH1520 pmic watchdog driver +- dt-bindings:event: Add Documentation for THEAD TH1520 event driver +- drivers/soc/event: Add THEAD TH1520 event driver +- Open I2C config +- fix rpmsg addr cast warning +- fix lp32 compile warnoing for rpmsg +- fix proc log warning +- fix rpmsg warning +- add c906 audio support +- Kconfig: Enable APM X-Gene RTC for XuanTie TH1520 +- drivers/rtc/rtc-xgene: Add "snps,dw-apb-rtc" into the "compatible" +- riscv: dts: thead: Add XuanTie TH1520 RTC device node +- dt-bindings: rtc: Add optional property "prescaler" in APM X-Gene RTC Document +- drivers/rtc/rtc-xgene: Add prescaler support in APM X-Gene RTC driver +- th1520: defconfig: to add th1520_defconfig +- net:stmmac: increase timeout for dma reset +- stmmac:dwmac-thead: add support for suspend/resume feature +- net:dwmac-thead: dd ptp clk set and enable +- configs: Enable th1520 mailbox. +- drivers:ipc: update th1520 rpc msg version 2 +- firmware: thead: c910_aon: add th1520 Aon protocol driver +- mmc:sdhci-of-dwcmshc: th1520 add delay line in different mode and sdio rxclk delay +- mmc:sdhci-of-dwcmshc: th1520 larger tuning max loop count to 128 +- dts: th1520: enable sdio1 for wifi card in lichee-pi-4a +- mmc:sdhci-of-dwcmshc: th1520 sdhci add fix io voltage 1v8 +- mmc:sdhci-of-dwcmshc: th1520 resolve accss rpmb error in hs400 +- drivers/dmac: add pm suspend/resume for dma driver +- audio: th1520: add dma chan str for dmaengine +- riscv: dts: thead: Add THEAD TH1520 dmac1 and dmac2 device node +- STR: fix pca953x resume bug +- drivers/iio/adc: add sysfs_remove_file when adc driver removed +- drivers/pvt: add mr75203 driver pm feature and correct temperature coefficient +- riscv: dts: thead: Add THEAD TH1520 SPI/QSPI device node +- dt-bindings: spi/qspi: Add Documentation for THEAD TH1520 SPI/QSPI +- drivers/spi: Add THEAD TH1520 QSPI driver +- reset: th1520: to support npu/fce reset feature +- riscv: dts: Add th1520 reset device tree +- dt-bindings: reset: Document th1520 reset control +- reset: Add th1520 reset driver support +- riscv: dts: thead: Add XuanTie TH1520 Mailbox device node +- mailbox: add XuanTie TH1520 Mailbox IPC driver +- dt-bindings: mailbox: Add a binding file for XuanTie TH1520 Mailbox +- riscv: dts: thead: to add th1520 clk nodes +- drivers: clk: to add thead th1520 clk driver +- configs: enable th1520 clk +- dt-bindings: adc: Add Documentation for THEAD TH1520 ADC +- riscv: dts: thead: Add THEAD TH1520 ADC device node +- drivers/iio/adc: Add THEAD TH1520 ADC driver +- riscv: dts: thead: Enable Lichee Pi 4A USB +- riscv: dts: thead: Add Lichee Pi 4A IO expansions +- riscv: dts: thead: Add TH1520 USB nodes +- riscv: dts: thead: Add TH1520 I2C nodes +- usb: dwc3: add T-HEAD TH1520 usb driver +- dt-bindings: usb: Add T-HEAD TH1520 USB controller +- riscv: dts: thead: Add BeagleV Ahead SDIO0 pins +- riscv: dts: thead: Add Lichee Pi 4A SDIO0 pins +- riscv: dts: thead: Add TH1520 ethernet nodes +- net: stmmac: add glue layer for T-HEAD TH1520 SoC +- dt-bindings: net: add T-HEAD dwmac support +- dt-bindings: net: snps,dwmac: allow dwmac-3.70a to set pbl properties +- gpio: dwapb: Use generic request, free and set_config +- riscv: dts: thead: Enable Lichee Pi 4A PWM fan +- riscv: dts: thead: Add TH1520 PVT node +- riscv: dts: thead: Add TH1520 PWM node +- pwm: add T-HEAD PWM driver +- dt-bindings: pwm: Add T-HEAD PWM controller +- perf vendor events riscv: add T-HEAD C9xx JSON file +- riscv: dts: thead: th1520: Add PMU event node +- chore: dtb_install in /boot +- remove compression for riscv Image +- riscv: dts: thead: Enable LicheePi 4A eMMC and microSD +- riscv: dts: thead: Enable BeagleV Ahead eMMC and microSD +- riscv: dts: thead: Add TH1520 mmc controllers and sdhci clock +- riscv: defconfig: Enable mmc and dma drivers for T-Head TH1520 +- mmc: sdhci-of-dwcmshc: Add support for T-Head TH1520 +- mmc: sdhci: add __sdhci_execute_tuning() to header +- dt-bindings: mmc: sdhci-of-dwcmhsc: Add T-Head TH1520 support +- fix: remove linux/array_size.h for pinctrl-th1520 +- riscv: dtb: thead: Add BeagleV Ahead LEDs +- riscv: dts: thead: Add TH1520 pinctrl settings for UART0 +- riscv: dts: thead: Add Lichee Pi 4M GPIO line names +- riscv: dts: thead: Adjust TH1520 GPIO labels +- riscv: dts: thead: Add TH1520 GPIO ranges +- riscv: dts: thead: Add TH1520 pin control nodes +- pinctrl: Add driver for the T-Head TH1520 SoC +- dt-bindings: pinctrl: Add thead,th1520-pinctrl bindings +- riscv: Enable TEE driver +- sg2042: drivers: rtc: disable BMC RTC device +- sg2042: dts: add i2c-rtc ds1307 device node for single chip +- sg2042: riscv:dts:modify dw gpio clock name +- sg2042: drivers:pci:remove the err log of parsing pci +- sg2042: driver: ipmi: support KVM and IPMI SI for BMC +- sg2042: perf cpumap: Make counter as unsigned ints +- sg2042: kernel: schedule: Fix set_task_cpu() bug +- sg2042: mm: Modify __find_max_addr for memory hole +- sg2042: riscv: kernel: Optimize apply_relocate_add() +- sg2042: riscv: mm: Clear compilation warning about last_cpupid +- sg2042: kernel: tick: filter unnecessary printing +- sg2042: kernel: Adjust the log level of the tick_switch_to_oneshot function +- sg2042: drm/amd/display: Support DRM_AMD_DC_FP on RISC-V +- sg2042: riscv: Factor out riscv-march-y to a separate Makefile +- sg2042: riscv: Add support for kernel-mode FPU +- sg2042: mango pci hack:broadcast when no MSI source known +- sg2042: nvidia hda: force msi +- sg2042: radeon hack: force 64-bit msi to fit top intc +- sg2042: amdgpu: disable rebar +- sg2042: ttm: disallow cached mapping +- sg2042: driver: soc: Add sophgo sg2042 soc support +- sg2042: drivers: pcie: Create msi-x whitelist,turn on msi-x for top intr +- sg2042: driver: pcie: Add sophgo sg2042 soc support +- sg2042: driver: net: Add sophgo sg2042 soc support +- sg2042: driver: mtd: Add sophgo sg2042 soc support +- sg2042: driver: mmc: Add sophgo sg2042 soc support +- sg2042: driver: reset: Add sophgo sg2042 soc support +- sg2042: driver: pinctrl: Add sophgo sg2042 soc support +- sg2042: driver: clk: Add sophgo sg2042 soc support +- sg2042: riscv: spinlock: Fix deadlock issue +- sg2042: riscv: add smp_cond_load_acquire() +- sg2042: riscv: add ioremap_wc for gpu +- sg2042: riscv: changing T-Head PBMT attributes +- sg2042: riscv: errata: thead: Make cache clean to flush +- sg2042: riscv: use VA+PA variant of CMO macros for DMA page preparation +- sg2042: riscv: use VA+PA variant of CMO macros for DMA synchorization +- sg2042: riscv: errata: cmo: add CMO macro variant with both VA and PA +- sg2042: riscv: errata: Replace thead cache clean with flush +- sg2042: riscv: Kconfig: Set vector as default no +- sg2042: riscv: Add sophgo sg2042 soc support + +* Tue Aug 13 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-38.0.0.45 +- !10843 netfilter: nf_tables: prefer nft_chain_validate +- netfilter: nf_tables: prefer nft_chain_validate +- !10893 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.45 LTS Patches +- selftests: mptcp: join: check backup support in signal endp +- selftests: mptcp: join: validate backup in MPJ +- selftests: mptcp: always close input's FD if opened +- mptcp: fix duplicate data handling +- mptcp: pm: only set request_bkup flag when sending MP_PRIO +- mptcp: fix bad RCVPRUNED mib accounting +- mptcp: mib: count MPJ with backup flag +- mptcp: fix NL PM announced address accounting +- mptcp: distinguish rcv vs sent backup flag in requests +- mptcp: fix user-space PM announced address accounting +- r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY +- net: usb: sr9700: fix uninitialized variable use in sr_mdio_read +- drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll() +- drm/virtio: Fix type of dma-fence context variable +- drm/vmwgfx: Fix a deadlock in dma buf fence polling +- Revert "ALSA: firewire-lib: operate for period elapse event in process context" +- Revert "ALSA: firewire-lib: obsolete workqueue for period update" +- ALSA: seq: ump: Optimize conversions from SysEx to UMP +- ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G +- ALSA: usb-audio: Correct surround channels in UAC1 channel map +- mptcp: sched: check both directions for backup +- protect the fetch of ->fd[fd] in do_dup2() from mispredictions +- btrfs: do not subtract delalloc from avail bytes +- btrfs: zoned: fix zone_unusable accounting on making block group read-write again +- HID: wacom: Modify pen IDs +- platform/chrome: cros_ec_proto: Lock device when updating MKBP version +- arm64: jump_label: Ensure patched jump_labels are visible to all CPUs +- riscv: Fix linear mapping checks for non-contiguous memory regions +- riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error() +- perf: riscv: Fix selecting counters in legacy mode +- riscv: remove unused functions in traps_misaligned.c +- ipv6: fix ndisc_is_useropt() handling for PIO +- igc: Fix double reset adapter triggered from a single taprio cmd +- net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys +- net/mlx5e: Fix CT entry update leaks of modify header context +- net/mlx5e: Require mlx5 tc classifier action support for IPsec prio capability +- net/mlx5: Fix missing lock on sync reset reload +- net/mlx5: Lag, don't use the hardcoded value of the first port +- net/mlx5: Fix error handling in irq_pool_request_irq +- net/mlx5: Always drain health in shutdown callback +- netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init(). +- netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init(). +- ALSA: hda: Conditionally use snooping for AMD HDMI +- net: phy: micrel: Fix the KSZ9131 MDI-X status issue +- net: mvpp2: Don't re-use loop iterator +- drm/i915/hdcp: Fix HDCP2_STREAM_STATUS macro +- net/iucv: fix use after free in iucv_sock_close() +- ice: add missing WRITE_ONCE when clearing ice_rx_ring::xdp_prog +- ice: replace synchronize_rcu with synchronize_net +- ice: don't busy wait for Rx queue disable in ice_qp_dis() +- ice: respect netif readiness in AF_XDP ZC related ndo's +- i915/perf: Remove code to update PWR_CLK_STATE for gen12 +- rtnetlink: Don't ignore IFLA_TARGET_NETNSID when ifname is specified in rtnl_dellink(). +- net: axienet: start napi before enabling Rx/Tx +- tcp: Adjust clamping window for applications specifying SO_RCVBUF +- tcp: annotate data-races around tp->window_clamp +- Bluetooth: hci_sync: Fix suspending with wrong filter policy +- Bluetooth: btintel: Fail setup on error +- ALSA: hda: conexant: Fix headset auto detect fail in the polling mode +- net: phy: realtek: add support for RTL8366S Gigabit PHY +- wifi: cfg80211: fix reporting failed MLO links status with cfg80211_connect_done +- sched: act_ct: take care of padding in struct zones_ht_key +- drm/vmwgfx: Trigger a modeset when the screen moves +- drm/vmwgfx: Fix overlay when using Screen Targets +- drm/nouveau: prime: fix refcount underflow +- perf tool: fix dereferencing NULL al->maps +- HID: amd_sfh: Move sensor discovery before HID device initialization +- ARM: 9406/1: Fix callchain_trace() return value +- MIPS: dts: loongson: Fix ls2k1000-rtc interrupt +- MIPS: dts: loongson: Fix liointc IRQ polarity +- MIPS: Loongson64: DTS: Fix PCIe port nodes for ls7a +- perf: imx_perf: fix counter start and config sequence +- dmaengine: fsl-edma: change the memory access from local into remote mode in i.MX 8QM +- dmaengine: fsl-edma: clean up unused "fsl,imx8qm-adma" compatible string +- dmaengine: fsl-edma: add i.MX8ULP edma support +- dmaengine: fsl-edma: add address for channel mux register in fsl_edma_chan +- f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid +- f2fs: fix to avoid use SSR allocate when do defragment +- mm/page_alloc: fix pcp->count race between drain_pages_zone() vs __rmqueue_pcplist() +- fbdev: vesafb: Detect VGA compatibility from screen info's VESA attributes +- firmware/sysfb: Update screen_info for relocated EFI framebuffers +- video: Provide screen_info_get_pci_dev() to find screen_info's PCI device +- video: Add helpers for decoding screen_info +- fbdev/vesafb: Replace references to global screen_info by local pointer +- PCI: Add pci_get_base_class() helper +- KVM: nVMX: Check for pending posted interrupts when looking for nested events +- KVM: nVMX: Add a helper to get highest pending from Posted Interrupt vector +- KVM: VMX: Move posted interrupt descriptor out of VMX code +- KVM: VMX: Split off vmx_onhyperv.{ch} from hyperv.{ch} +- leds: triggers: Flush pending brightness before activating trigger +- leds: trigger: Call synchronize_rcu() before calling trig->activate() +- leds: trigger: Store brightness set by led_trigger_event() +- leds: trigger: Remove unused function led_trigger_rename_static() +- cpufreq: qcom-nvmem: fix memory leaks in probe error paths +- cpufreq: qcom-nvmem: Simplify driver data allocation +- sysctl: allow to change limits for posix messages queues +- sysctl: allow change system v ipc sysctls inside ipc namespace +- thermal/drivers/broadcom: Fix race between removal and clock disable +- thermal: bcm2835: Convert to platform remove callback returning void +- arm64: dts: qcom: sdm845: Disable SS instance in Parkmode for USB +- arm64: dts: qcom: sdm845: switch USB QMP PHY to new style of bindings +- arm64: dts: qcom: sdm845: switch USB+DP QMP PHY to new style of bindings +- arm64: dts: qcom: ipq8074: Disable SS instance in Parkmode for USB +- arm64: dts: qcom: msm8998: Disable SS instance in Parkmode for USB +- arm64: dts: qcom: msm8998: switch USB QMP PHY to new style of bindings +- arm64: dts: qcom: sc7280: Disable SuperSpeed instances in park mode +- arm64: dts: qcom: sc7280: switch USB+DP QMP PHY to new style of bindings +- arm64: dts: qcom: sc7180: Disable SuperSpeed instances in park mode +- arm64: dts: qcom: sc7180: switch USB+DP QMP PHY to new style of bindings +- !10823 mm/userfaultfd: reset ptes when close() for wr-protected ones +- mm/userfaultfd: reset ptes when close() for wr-protected ones +- !10824 dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list +- dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list +- !10855 CVE-2024-36971 +- net: fix kabi breakage in struct dst_ops +- net: fix __dst_negative_advice() race +- !10863 v2 ext4: flexibly control whether to enable dioread_nolock by default +- ext4: flexibly control whether to enable dioread_nolock by default +- !10796 Revert "ARM: spectre-v2: turn off the mitigation via boot cmdline param" +- Revert "ARM: spectre-v2: turn off the mitigation via boot cmdline param" +- !10795 Revert "security: restrict init parameters by configuration" +- Revert "security: restrict init parameters by configuration" +- !10794 revert kaslr arm32 support +- Revert "asm-generic: add .data.rel.ro sections to __ro_after_init" +- Revert "arm-soc: exynos: replace open coded VA->PA conversions" +- Revert "arm-soc: mvebu: replace open coded VA->PA conversion" +- Revert "arm-soc: various: replace open coded VA->PA calculation of pen_release" +- Revert "ARM: kernel: switch to relative exception tables" +- Revert "ARM: kernel: make vmlinux buildable as a PIE executable" +- Revert "ARM: kernel: use PC-relative symbol references in MMU switch code" +- Revert "ARM: kernel: use PC relative symbol references in suspend/resume code" +- Revert "ARM: mm: export default vmalloc base address" +- Revert "ARM: kernel: refer to swapper_pg_dir via its symbol" +- Revert "arm: vectors: use local symbol names for vector entry points" +- Revert "ARM: kernel: implement randomization of the kernel load address" +- Revert "ARM: decompressor: explicitly map decompressor binary cacheable" +- Revert "ARM: decompressor: add KASLR support" +- Revert "No idea why this broke ..." +- Revert "arm32: kaslr: When boot with vxboot, we must adjust dtb address before kaslr_early_init, and store dtb address after init." +- Revert "arm32: kaslr: pop visibility when compile decompress boot code as we need relocate BSS by GOT." +- Revert "arm32: kaslr: print kaslr offset when kernel panic" +- Revert "arm32: kaslr: Fix the bug of symbols relocation" +- Revert "arm32: kaslr: Fix clock_gettime and gettimeofday performance degradation when configure CONFIG_RANDOMIZE_BASE" +- !10615 USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor +- USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor +- !10834 v2 wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values +- wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values +- !10816 sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime +- sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime +- !10805 dummy_struct_ops selftest failed +- Revert "[Backport] selftests/bpf: adjust dummy_st_ops_success to detect additional error" +- Revert "[Backport] selftests/bpf: dummy_st_ops should reject 0 for non-nullable params" +- !10345 blk-wbt: don't throttle swap writes in direct reclaim +- blk-wbt: don't throttle swap writes in direct reclaim +- !10772 s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings +- s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings +- !10722 btrfs: zoned: fix use-after-free in do_zone_finish() +- btrfs: zoned: fix use-after-free in do_zone_finish() + +* Wed Aug 07 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-37.0.0.44 +- !10793 perf util: Add a function for replacing characters in a string +- perf util: Add a function for replacing characters in a string +- !10635 nvme: avoid double free special payload +- nvme: avoid double free special payload +- !10757 CVE-2024-41045 +- bpf: Defer work in bpf_timer_cancel_and_free +- bpf: replace bpf_timer_cancel_and_free with a generic helper +- bpf: replace bpf_timer_set_callback with a generic helper +- !10729 Backport vmalloc 2 bugfix +- mm: vmalloc: fix lockdep warning +- mm/vmalloc: eliminated the lock contention from twice to once +- !10746 irqchip/mbigen: Fix mbigen node address layout +- irqchip/mbigen: Fix mbigen node address layout +- !10533 backport mainline patchs +- cpufreq: Allow drivers to advertise boost enabled +- irqdomain: Fixed unbalanced fwnode get and put +- !10518 xfs: add bounds checking to xlog_recover_process_data +- xfs: add bounds checking to xlog_recover_process_data +- !10622 leds: mlxreg: Use devm_mutex_init() for mutex initialization +- leds: mlxreg: Use devm_mutex_init() for mutex initialization +- !10677 gve: Account for stopped queues when reading NIC stats +- gve: Account for stopped queues when reading NIC stats +- !10639 s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception() +- s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception() +- !10653 virtcca cvm feature patches +- gicv3: add lpi support for cvm guest +- config: modify arm64 defconfig for virtcca cvm feature +- mm: enable swiotlb alloc for cvm share mem +- pmu: enable pmu phys irq inject for cvm +- kvm: add virtcca cvm host feature +- !10658 CVE-2024-35860 +- bpf: Fix a potential use-after-free in bpf_link_free() +- Fix kabi breakage in struct bpf_link and bpf_link_ops +- bpf: support deferring bpf_link dealloc to after RCU grace period +- !10649 xfs: don't walk off the end of a directory data block +- xfs: don't walk off the end of a directory data block +- !10556 smart_grid: introducing rebuild_affinity_domain +- smart_grid: introducing rebuild_affinity_domain +- !10631 sched/deadline: Fix task_struct reference leak +- sched/deadline: Fix task_struct reference leak +- !10319 block: propagate partition scanning errors to the BLKRRPART ioctl +- block: propagate partition scanning errors to the BLKRRPART ioctl +- !10500 fix CVE-2024-42155 +- s390/pkey: Wipe copies of protected- and secure-keys +- !10657 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.40-6.6.44 LTS Patches +- fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT +- nvme-pci: add missing condition check for existence of mapped data +- io_uring: fix io_match_task must_hold +- iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en +- s390/cpum_cf: Fix endless loop in CF_DIAG event stop +- s390/pci: Allow allocation of more than 1 MSI interrupt +- s390/pci: Refactor arch_setup_msi_irqs() +- ceph: fix incorrect kmalloc size of pagevec mempool +- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable +- spi: spidev: add correct compatible for Rohm BH2228FV +- ASoC: sof: amd: fix for firmware reload failure in Vangogh platform +- nvme-pci: Fix the instructions for disabling power management +- spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer +- spi: microchip-core: fix init function not setting the master and motorola modes +- spi: microchip-core: switch to use modern name +- spi: microchip-core: only disable SPI controller when register value change requires it +- spi: microchip-core: defer asserting chip select until just before write to TX FIFO +- spi: microchip-core: fix the issues in the isr +- ASoC: SOF: imx8m: Fix DSP control regmap retrieval +- auxdisplay: ht16k33: Drop reference after LED registration +- lirc: rc_dev_get_from_fd(): fix file leak +- powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() +- apparmor: Fix null pointer deref when receiving skb during sock creation +- mISDN: Fix a use after free in hfcmulti_tx() +- bpf: Fix a segment issue when downgrading gso_size +- net: nexthop: Initialize all fields in dumped nexthops +- net: stmmac: Correct byte order of perfect_match +- tipc: Return non-zero value from tipc_udp_addr2str() on error +- netfilter: nft_set_pipapo_avx2: disable softinterrupts +- ice: Fix recipe read procedure +- net: bonding: correctly annotate RCU in bond_should_notify_peers() +- ipv4: Fix incorrect source address in Record Route option +- MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later +- tools/resolve_btfids: Fix comparison of distinct pointer types warning in resolve_btfids +- bpf, events: Use prog to emit ksymbol event for main program +- dma: fix call order in dmam_free_coherent +- af_unix: Disable MSG_OOB handling for sockets in sockmap/sockhash +- libbpf: Fix no-args func prototype BTF dumping syntax +- selftests/bpf: fexit_sleep: Fix stack allocation for arm64 +- kbuild: avoid build error when single DTB is turned into composite DTB +- f2fs: fix to update user block counts in block_operations() +- watchdog: rzg2l_wdt: Check return status of pm_runtime_put() +- watchdog: rzg2l_wdt: Use pm_runtime_resume_and_get() +- f2fs: fix start segno of large section +- um: time-travel: fix signal blocking race/hang +- um: time-travel: fix time-travel-start option +- phy: zynqmp: Enable reference clock correctly +- phy: cadence-torrent: Check return value on register read +- dmaengine: ti: k3-udma: Fix BCHAN count with UHC and HC channels +- jfs: Fix array-index-out-of-bounds in diFree +- kdb: Use the passed prompt in kdb_position_cursor() +- kdb: address -Wformat-security warnings +- f2fs: fix to truncate preallocated blocks in f2fs_file_open() +- s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception() +- PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal +- PCI: Introduce cleanup helpers for device reference counts and locks +- wifi: mac80211: track capability/opmode NSS separately +- mm/mglru: fix ineffective protection calculation +- nilfs2: handle inconsistent state in nilfs_btnode_create_block() +- minmax: scsi: fix mis-use of 'clamp()' in sr.c +- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591 +- Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables +- video: logo: Drop full path of the input filename in generated file +- lib/build_OID_registry: don't mention the full path of the script in output +- rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings +- rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait +- drm/panfrost: Mark simple_ondemand governor as softdep +- drm/etnaviv: don't block scheduler when GPU is still active +- MIPS: Loongson64: Test register availability before use +- MIPS: Loongson64: reset: Prioritise firmware service +- MIPS: Loongson64: Remove memory node for builtin-dtb +- MIPS: Loongson64: env: Hook up Loongsson-2K +- MIPS: dts: loongson: Fix GMAC phy node +- MIPS: ip30: ip30-console: Add missing include +- MIPS: dts: loongson: Add ISA node +- remoteproc: imx_rproc: Fix refcount mistake in imx_rproc_addr_init +- remoteproc: imx_rproc: Skip over memory region when node value is NULL +- remoteproc: stm32_rproc: Fix mailbox interrupts queuing +- rbd: don't assume rbd_is_lock_owner() for exclusive mappings +- dm-verity: fix dm_is_verity_target() when dm-verity is builtin +- selftests/sigaltstack: Fix ppc64 GCC build +- RDMA/iwcm: Fix a use-after-free related to destroying CM IDs +- platform: mips: cpu_hwmon: Disable driver on unsupported hardware +- watchdog/perf: properly initialize the turbo mode timestamp and rearm counter +- rtc: abx80x: Fix return value of nvmem callback on read +- rtc: isl1208: Fix return value of nvmem callbacks +- drm/i915/dp: Don't switch the LTTPR mode on an active link +- drm/i915/dp: Reset intel_dp->link_trained before retraining the link +- drm/amd/amdgpu: Fix uninitialized variable warnings +- drm/amdgpu: reset vm state machine after gpu reset(vram lost) +- drm/dp_mst: Fix all mstb marked as not probed after suspend/resume +- drm/udl: Remove DRM_CONNECTOR_POLL_HPD +- drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell +- drm/i915/gt: Do not consider preemption during execlists_dequeue for gen8 +- perf/x86/intel/pt: Fix a topa_entry base address calculation +- perf/x86/intel/pt: Fix topa_entry base length +- perf/x86/intel/ds: Fix non 0 retire latency on Raptorlake +- perf/x86/intel/uncore: Fix the bits of the CHA extended umask for SPR +- perf stat: Fix the hard-coded metrics calculation on the hybrid +- perf: Fix event leak upon exit +- scsi: qla2xxx: validate nvme_local_port correctly +- scsi: qla2xxx: Complete command early within lock +- scsi: qla2xxx: Fix flash read failure +- scsi: qla2xxx: Reduce fabric scan duplicate code +- scsi: qla2xxx: Use QP lock to search for bsg +- scsi: qla2xxx: Fix for possible memory corruption +- scsi: qla2xxx: Unable to act on RSCN for port online +- scsi: qla2xxx: During vport delete send async logout explicitly +- scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE state +- rtc: cmos: Fix return value of nvmem callbacks +- mm/numa_balancing: teach mpol_to_str about the balancing mode +- irqchip/imx-irqsteer: Handle runtime power management correctly +- irqdomain: Fixed unbalanced fwnode get and put +- devres: Fix memory leakage caused by driver API devm_free_percpu() +- devres: Fix devm_krealloc() wasting memory +- ice: Add a per-VF limit on number of FDIR filters +- gve: Fix an edge case for TSO skb validity check +- kobject_uevent: Fix OOB access within zap_modalias_env() +- ASoC: amd: yc: Support mic on Lenovo Thinkpad E16 Gen 2 +- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA on unprepare +- kbuild: Fix '-S -c' in x86 stack protector scripts +- decompress_bunzip2: fix rare decompression failure +- mm: fix old/young bit handling in the faulting path +- block: fix deadlock between sd_remove & sd_release +- ubi: eba: properly rollback inside self_check_eba +- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use +- f2fs: use meta inode for GC of COW file +- f2fs: use meta inode for GC of atomic file +- f2fs: fix return value of f2fs_convert_inline_inode() +- f2fs: fix to don't dirty inode for readonly filesystem +- f2fs: fix to force buffered IO on inline_data inode +- ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value +- scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds +- fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed +- efi/libstub: Zero initialize heap allocated struct screen_info +- hostfs: fix dev_t handling +- dev/parport: fix the array out-of-bounds risk +- binder: fix hang of unregistered readers +- PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio +- PCI: dw-rockchip: Fix initial PERST# GPIO value +- PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN +- parisc: Fix warning at drivers/pci/msi/msi.h:121 +- hwrng: amd - Convert PCIBIOS_* return codes to errnos +- tools/memory-model: Fix bug in lock.cat +- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera +- ALSA: usb-audio: Move HD Webcam quirk to the right place +- ALSA: usb-audio: Fix microphone sound on HD webcam. +- ALSA: ump: Force 1 Group for MIDI1 FBs +- ALSA: ump: Don't update FB name for static blocks +- KVM: nVMX: Request immediate exit iff pending nested event needs injection +- KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked() +- media: ivsc: csi: don't count privacy on as error +- media: uvcvideo: Fix integer overflow calculating timestamp +- jbd2: avoid infinite transaction commit loop +- jbd2: precompute number of transaction descriptor blocks +- jbd2: make jbd2_journal_get_max_txn_bufs() internal +- media: imx-pxp: Fix ERR_PTR dereference in pxp_probe() +- media: ivsc: csi: add separate lock for v4l2 control handler +- leds: mt6360: Fix memory leak in mt6360_init_isnk_properties() +- md/md-bitmap: fix writing non bitmap pages +- leds: ss4200: Convert PCIBIOS_* return codes to errnos +- drivers: soc: xilinx: check return status of get_api_version() +- wifi: rtw88: usb: Fix disconnection after beacon loss +- wifi: mwifiex: Fix interface type change +- selftests/landlock: Add cred_transfer test +- trace/pid_list: Change gfp flags in pid_list_fill_irq() +- io_uring: tighten task exit cancellations +- ext4: make sure the first directory block is not a hole +- ext4: check dot and dotdot of dx_root before making dir indexed +- m68k: amiga: Turn off Warp1260 interrupts during boot +- udf: Avoid using corrupted block bitmap buffer +- task_work: Introduce task_work_cancel() again +- task_work: s/task_work_cancel()/task_work_cancel_func()/ +- cifs: mount with "unix" mount option for SMB1 incorrectly handled +- cifs: fix reconnect with SMB1 UNIX Extensions +- cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path +- apparmor: use kvfree_sensitive to free data->data +- drm/amd/display: Check for NULL pointer +- scsi: qla2xxx: Fix optrom version displayed in FDMI +- drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes +- drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes +- io_uring/io-wq: limit retrying worker initialisation +- ext2: Verify bitmap and itable block numbers before using them +- hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() +- ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error +- ata: libata-scsi: Do not overwrite valid sense data when CK_COND=1 +- media: venus: fix use after free in vdec_close +- char: tpm: Fix possible memory leak in tpm_bios_measurements_open() +- ata: libata-scsi: Fix offsets for the fixed format sense data +- fuse: verify {g,u}id mount options correctly +- sched/fair: set_load_weight() must also call reweight_task() for SCHED_IDLE tasks +- NFSD: Support write delegations in LAYOUTGET +- ipv6: take care of scope when choosing the src addr +- ipv4: fix source address selection with route leak +- kernel: rerun task_work while freezing in get_signal() +- btrfs: fix extent map use-after-free when adding pages to compressed bio +- af_packet: Handle outgoing VLAN packets without hardware offloading +- net: netconsole: Disable target before netpoll cleanup +- tick/broadcast: Make takeover of broadcast hrtimer reliable +- dt-bindings: thermal: correct thermal zone node name limit +- exfat: fix potential deadlock on __exfat_get_dentry_set +- x86/efistub: Revert to heap allocated boot_params for PE entrypoint +- x86/efistub: Avoid returning EFI_SUCCESS on error +- mm/mglru: fix overshooting shrinker memory +- mm: mmap_lock: replace get_memcg_path_buf() with on-stack buffer +- mm/mglru: fix div-by-zero in vmpressure_calc_level() +- mm/hugetlb: fix possible recursive locking detected warning +- hugetlb: force allocating surplus hugepages on mempolicy allowed nodes +- landlock: Don't lose track of restrictions on cred_transfer +- LoongArch: Check TIF_LOAD_WATCH to enable user space watchpoint +- sbitmap: use READ_ONCE to access map->word +- s390/dasd: fix error checks in dasd_copy_pair_store() +- powerpc/8xx: fix size given to set_huge_pte_at() +- fs/ntfs3: Keep runs for $MFT::$ATTR_DATA and $MFT::$ATTR_BITMAP +- fs/ntfs3: Missed error return +- fs/ntfs3: Fix the format of the "nocase" mount option +- rtc: interface: Add RTC offset to alarm after fix-up +- nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro +- fs/proc/task_mmu: properly detect PM_MMAP_EXCLUSIVE per page of PMD-mapped THPs +- fs/proc/task_mmu: don't indicate PM_MMAP_EXCLUSIVE without PM_PRESENT +- fs/proc/task_mmu.c: add_to_pagemap: remove useless parameter addr +- fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP +- pinctrl: renesas: r8a779g0: Fix TPU suffixes +- pinctrl: renesas: r8a779g0: Fix TCLK suffixes +- pinctrl: renesas: r8a779g0: FIX PWM suffixes +- pinctrl: renesas: r8a779g0: Fix IRQ suffixes +- pinctrl: renesas: r8a779g0: Fix (H)SCIF3 suffixes +- pinctrl: renesas: r8a779g0: Fix (H)SCIF1 suffixes +- pinctrl: renesas: r8a779g0: Fix FXR_TXEN[AB] suffixes +- pinctrl: renesas: r8a779g0: Fix CANFD5 suffix +- fs/ntfs3: Fix field-spanning write in INDEX_HDR +- fs/ntfs3: Drop stray '' (backslash) in formatting string +- fs/ntfs3: Correct undo if ntfs_create_inode failed +- fs/ntfs3: Replace inode_trylock with inode_lock +- pinctrl: freescale: mxs: Fix refcount of child +- pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails +- pinctrl: ti: ti-iodelay: Drop if block with always false condition +- pinctrl: single: fix possible memory leak when pinctrl_enable() fails +- pinctrl: core: fix possible memory leak when pinctrl_enable() fails +- pinctrl: rockchip: update rk3308 iomux routes +- fs/ntfs3: Add missing .dirty_folio in address_space_operations +- fs/ntfs3: Fix getting file type +- fs/ntfs3: Missed NI_FLAG_UPDATE_PARENT setting +- fs/ntfs3: Deny getting attr data block in compressed frame +- fs/ntfs3: Fix transform resident to nonresident for compressed files +- fs/ntfs3: Merge synonym COMPRESSION_UNIT and NTFS_LZNT_CUNIT +- net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports +- net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports +- ipv4: Fix incorrect TOS in fibmatch route get reply +- ipv4: Fix incorrect TOS in route get reply +- net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE +- gve: Fix XDP TX completion handling when counters overflow +- ipvs: properly dereference pe in ip_vs_add_service +- netfilter: nf_set_pipapo: fix initial map fill +- netfilter: nft_set_pipapo: constify lookup fn args where possible +- netfilter: ctnetlink: use helper function to calculate expect ID +- bnxt_re: Fix imm_data endianness +- RDMA: Fix netdev tracker in ib_device_set_netdev +- RDMA/core: Remove NULL check before dev_{put, hold} +- iommu/vt-d: Fix identity map bounds in si_domain_init() +- macintosh/therm_windtunnel: fix module unload. +- powerpc/xmon: Fix disassembly CPU feature checks +- PCI: dwc: Fix index 0 incorrectly being interpreted as a free ATU slot +- PCI: qcom-ep: Disable resources unconditionally during PERST# assert +- MIPS: Octeron: remove source file executable bit +- clk: en7523: fix rate divider for slic and spi clocks +- clk: qcom: Park shared RCGs upon registration +- clk: qcom: kpss-xcc: Return of_clk_add_hw_provider to transfer the error +- crypto: qat - extend scope of lock in adf_cfg_add_key_value_param() +- nvmem: rockchip-otp: set add_legacy_fixed_of_cells config option +- net: missing check virtio +- vhost/vsock: always initialize seqpacket_allow +- PCI: endpoint: Fix error handling in epf_ntb_epc_cleanup() +- PCI: endpoint: Clean up error handling in vpci_scan_bus() +- ASoC: amd: Adjust error handling in case of absent codec device +- Input: elan_i2c - do not leave interrupt disabled on suspend failure +- RDMA/device: Return error earlier if port in not valid +- mtd: make mtd_test.c a separate module +- ASoC: max98088: Check for clk_prepare_enable() error +- powerpc/prom: Add CPU info to hardware description string later +- hwrng: core - Fix wrong quality calculation at hw rng registration +- scsi: lpfc: Fix a possible null pointer dereference +- ASoC: qcom: Adjust issues in case of DT error in asoc_qcom_lpass_cpu_platform_probe() +- RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs +- RDMA/mlx5: Use sq timestamp as QP timestamp when RoCE is disabled +- RDMA/mlx4: Fix truncated output warning in alias_GUID.c +- RDMA/mlx4: Fix truncated output warning in mad.c +- Input: qt1050 - handle CHIP_ID reading error +- interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID +- clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's +- clk: qcom: gpucc-sa8775p: Park RCG's clk source at XO during disable +- clk: qcom: gpucc-sa8775p: Remove the CLK_IS_CRITICAL and ALWAYS_ON flags +- clk: qcom: gcc-sa8775p: Update the GDSC wait_val fields and flags +- clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during disable +- RDMA/cache: Release GID table even if leak is detected +- usb: typec-mux: nb7vpq904m: unregister typec switch on probe error and remove +- ASoC: cs35l56: Accept values greater than 0 as IRQ numbers +- ASoc: tas2781: Enable RCA-based playback without DSP firmware download +- RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE +- coresight: Fix ref leak when of_coresight_parse_endpoint() fails +- KVM: PPC: Book3S HV: Fix the get_one_reg of SDAR +- KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3 +- iio: frequency: adrf6780: rm clk provider include +- clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs +- clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock +- scsi: ufs: mcq: Fix missing argument 'hba' in MCQ_OPR_OFFSET_n +- PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() +- PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() +- PCI: keystone: Don't enable BAR 0 for AM654x +- PCI: keystone: Relocate ks_pcie_set/clear_dbi_mode() +- PCI: Fix resource double counting on remove & rescan +- iio: Fix the sorting functionality in iio_gts_build_avail_time_table +- SUNRPC: Fixup gss_status tracepoint error output +- sparc64: Fix incorrect function signature and add prototype for prom_cif_init +- leds: flash: leds-qcom-flash: Test the correct variable in init +- ext4: avoid writing unitialized memory to disk in EA inodes +- ext4: don't track ranges in fast_commit if inode has inlined data +- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server +- SUNRPC: avoid soft lockup when transmitting UDP to reachable server. +- xprtrdma: Fix rpcrdma_reqs_reset() +- mfd: omap-usb-tll: Use struct_size to allocate tll +- mfd: rsmu: Split core code into separate module +- perf intel-pt: Fix exclude_guest setting +- perf intel-pt: Fix aux_watermark calculation for 64-bit size +- media: venus: flush all buffers in output plane streamoff +- drm/mediatek/dp: Fix spurious kfree() +- drm/mediatek/dp: switch to ->edid_read callback +- ext4: fix infinite loop when replaying fast_commit +- drm/mediatek: Remove less-than-zero comparison of an unsigned value +- Revert "leds: led-core: Fix refcount leak in of_led_get()" +- drm/qxl: Add check for drm_cvt_mode +- drm/etnaviv: fix DMA direction handling for cached RW buffers +- perf report: Fix condition in sort__sym_cmp() +- perf pmus: Fixes always false when compare duplicates aliases +- perf test: Make test_arm_callgraph_fp.sh more robust +- drm/msm/dpu: drop validity checks for clear_pending_flush() ctl op +- drm/msm/dsi: set VIDEO_COMPRESSION_MODE_CTRL_WC +- leds: trigger: Unregister sysfs attributes before calling deactivate() +- media: imx-jpeg: Drop initial source change event if capture has been setup +- drm/mediatek: Add OVL compatible name for MT8195 +- drm/mediatek: Turn off the layers with zero width or height +- drm/mediatek: Fix destination alpha error in OVL +- drm/mediatek: Fix XRGB setting error in Mixer +- drm/mediatek: Fix XRGB setting error in OVL +- drm/mediatek: Use 8-bit alpha in ETHDR +- drm/mediatek: Add missing plane settings when async update +- media: renesas: vsp1: Store RPF partition configuration per RPF instance +- media: renesas: vsp1: Fix _irqsave and _irq mix +- media: rcar-csi2: Cleanup subdevice in remove() +- media: rcar-csi2: Disable runtime_pm in probe error +- media: rcar-vin: Fix YUYV8_1X16 handling for CSI-2 +- drm: zynqmp_kms: Fix AUX bus not getting unregistered +- drm: zynqmp_dpsub: Fix an error handling path in zynqmp_dpsub_probe() +- media: uvcvideo: Override default flags +- media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920 +- media: uvcvideo: Quirk for invalid dev_sof in Logitech C922 +- media: uvcvideo: Disable autosuspend for Insta360 Link +- media: i2c: imx219: fix msr access command sequence +- saa7134: Unchecked i2c_transfer function result fixed +- ipmi: ssif_bmc: prevent integer overflow on 32bit systems +- x86/shstk: Make return uprobe work with shadow stack +- media: mediatek: vcodec: Handle invalid decoder vsi +- s390/uv: Don't call folio_wait_writeback() without a folio reference +- s390/mm: Convert gmap_make_secure to use a folio +- s390/mm: Convert make_page_secure to use a folio +- media: v4l: async: Fix NULL pointer dereference in adding ancillary links +- media: i2c: Fix imx412 exposure control +- media: imon: Fix race getting ictx->lock +- media: pci: ivtv: Add check for DMA map result +- drm/bridge: it6505: fix hibernate to resume no display issue +- drm/bridge: Fixed a DP link training bug +- drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare() +- drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before regulators +- drm/panel: himax-hx8394: Handle errors from mipi_dsi_dcs_set_display_on() better +- drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1 +- drm/amdgpu: Check if NBIO funcs are NULL in amdgpu_device_baco_exit +- drm/amdgpu: Fix memory range calculation +- drm/amd/pm: Fix aldebaran pcie speed reporting +- drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_generic_write_seq() +- drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_dcs_write_seq() +- drm/amdkfd: Fix CU Masking for GFX 9.4.3 +- drm/arm/komeda: Fix komeda probe failing if there are no links in the secondary pipeline +- drm/rockchip: vop2: Fix the port mux of VP2 +- net: bridge: mst: Check vlan state for egress decision +- xdp: fix invalid wait context of page_pool_destroy() +- Bluetooth: btnxpuart: Add handling for boot-signature timeout errors +- Bluetooth: btintel: Refactor btintel_set_ppag() +- Bluetooth: hci_bcm4377: Use correct unit for timeouts +- selftests: forwarding: devlink_lib: Wait for udev events after reloading +- bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o +- bna: adjust 'name' buf size of bna_tcb and bna_ccb structures +- bpf: annotate BTF show functions with __printf +- selftests/resctrl: Fix closing IMC fds on error and open-code R+W instead of loops +- selftests/resctrl: Convert perror() to ksft_perror() or ksft_print_msg() +- selftests/resctrl: Move run_benchmark() to a more fitting file +- selftests/bpf: Close obj in error path in xdp_adjust_tail +- selftests/bpf: Null checks for links in bpf_tcp_ca +- selftests/bpf: Close fd in error path in drop_on_reuseport +- locking/rwsem: Add __always_inline annotation to __down_write_common() and inlined callers +- wifi: virt_wifi: don't use strlen() in const context +- gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey +- wifi: virt_wifi: avoid reporting connection success with wrong SSID +- xfrm: call xfrm_dev_policy_delete when kill policy +- xfrm: fix netdev reference count imbalance +- wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() +- perf/x86/intel/cstate: Fix Alderlake/Raptorlake/Meteorlake +- perf: Fix default aux_watermark calculation +- perf: Prevent passing zero nr_pages to rb_alloc_aux() +- perf: Fix perf_aux_size() for greater-than 32-bit size +- perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation +- bpftool: Mount bpffs when pinmaps path not under the bpffs +- wifi: rtl8xxxu: 8188f: Limit TX power index +- wifi: rtw89: 8852b: fix definition of KIP register number +- netfilter: nf_tables: rise cap on SELinux secmark context +- ipvs: Avoid unnecessary calls to skb_is_gso_sctp +- libbpf: Checking the btf_type kind when fixing variable offsets +- net: fec: Fix FEC_ECR_EN1588 being cleared on link-down +- net: fec: Refactor: #define magic constants +- udf: Fix bogus checksum computation in udf_rename() +- wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() +- wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he() +- wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers +- jump_label: Fix concurrency issues in static_key_slow_dec() +- perf/x86: Serialize set_attr_rdpmc() +- mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors +- mlxsw: spectrum_acl_erp: Fix object nesting warning +- lib: objagg: Fix general protection fault +- udf: Fix lock ordering in udf_evict_inode() +- selftests/bpf: Check length of recv in test_sockmap +- net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined +- tcp: fix races in tcp_v[46]_err() +- tcp: fix race in tcp_write_err() +- tcp: add tcp_done_with_error() helper +- wifi: ath12k: fix wrong definition of CE ring's base address +- wifi: ath11k: fix wrong definition of CE ring's base address +- wifi: ath11k: Update Qualcomm Innovation Center, Inc. copyrights +- wifi: ath12k: fix firmware crash during reo reinject +- wifi: ath12k: fix invalid memory access while processing fragmented packets +- wifi: ath12k: change DMA direction while mapping reinjected packets +- net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP +- selftests/bpf: Fix prog numbers in test_sockmap +- bpftool: Un-const bpf_func_info to fix it for llvm 17 and newer +- wifi: ath12k: Fix tx completion ring (WBM2SW) setup failure +- wifi: ath12k: Correct 6 GHz frequency value in rx status +- wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device +- firmware: turris-mox-rwtm: Initialize completion before mailbox +- firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout() +- firmware: turris-mox-rwtm: Do not complete if there are no waiters +- vmlinux.lds.h: catch .bss..L* sections into BSS") +- ARM: spitz: fix GPIO assignment for backlight +- m68k: cmpxchg: Fix return value for default case in __arch_xchg() +- cpufreq/amd-pstate: Fix the scaling_max_freq setting on shared memory CPPC systems +- arm64: dts: qcom: sm6350: Add missing qcom,non-secure-domain property +- arm64: dts: rockchip: fixes PHY reset for Lunzn Fastrhino R68S +- arm64: dts: rockchip: disable display subsystem for Lunzn Fastrhino R6xS +- arm64: dts: rockchip: remove unused usb2 nodes for Lunzn Fastrhino R6xS +- arm64: dts: rockchip: fix pmu_io supply for Lunzn Fastrhino R6xS +- arm64: dts: rockchip: fix usb regulator for Lunzn Fastrhino R6xS +- arm64: dts: rockchip: fix regulator name for Lunzn Fastrhino R6xS +- arm64: dts: rockchip: Add missing power-domains for rk356x vop_mmu +- x86/xen: Convert comma to semicolon +- arm64: dts: imx8mp: Fix pgc vpu locations +- arm64: dts: imx8mp: add HDMI power-domains +- arm64: dts: imx8mp: Fix pgc_mlmix location +- arm64: dts: imx8mp: Add NPU Node +- m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages +- arm64: dts: renesas: r9a07g054: Add missing hypervisor virtual timer IRQ +- arm64: dts: renesas: r9a07g044: Add missing hypervisor virtual timer IRQ +- arm64: dts: renesas: r9a07g043u: Add missing hypervisor virtual timer IRQ +- arm64: dts: renesas: r8a779g0: Add missing hypervisor virtual timer IRQ +- arm64: dts: renesas: r8a779f0: Add missing hypervisor virtual timer IRQ +- arm64: dts: renesas: r8a779a0: Add missing hypervisor virtual timer IRQ +- arm64: dts: rockchip: Fix mic-in-differential usage on rk3568-evb1-v10 +- arm64: dts: rockchip: Fix mic-in-differential usage on rk3566-roc-pc +- arm64: dts: rockchip: Drop invalid mic-in-differential on rk3568-rock-3a +- arm64: dts: amlogic: setup hdmi system clock +- arm64: dts: amlogic: add power domain to hdmitx +- arm64: dts: amlogic: gx: correct hdmi clocks +- arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add ports node for anx7625 +- arm64: dts: mediatek: mt8183-kukui: Fix the value of `dlg,jack-det-rate` mismatch +- arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux +- arm64: dts: mediatek: mt8192-asurada: Add off-on-delay-us for pp3300_mipibrdg +- arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property +- arm64: dts: mediatek: mt8195: Fix GPU thermal zone name for SVS +- ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity +- ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects +- ARM: dts: imx6qdl-kontron-samx6i: fix board reset +- ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset +- ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode +- arm64: dts: amlogic: sm1: fix spdif compatibles +- arm64: dts: rockchip: Increase VOP clk rate on RK3328 +- soc: qcom: pdr: fix parsing of domains lists +- soc: qcom: pdr: protect locator_addr with the main mutex +- soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove +- arm64: dts: qcom: qdu1000: Add secure qfprom node +- arm64: dts: qcom: qdu1000-idp: drop unused LLCC multi-ch-bit-off +- arm64: dts: ti: k3-am62-verdin: Drop McASP AFIFOs +- arm64: dts: ti: k3-am625-beagleplay: Drop McASP AFIFOs +- arm64: dts: ti: k3-am62x: Drop McASP AFIFOs +- memory: fsl_ifc: Make FSL_IFC config visible and selectable +- OPP: ti: Fix ti_opp_supply_probe wrong return values +- cpufreq: ti-cpufreq: Handle deferred probe with dev_err_probe() +- arm64: dts: qcom: qrb4210-rb2: make L9A always-on +- ARM: dts: stm32: Add arm,no-tick-in-suspend to STM32MP15xx STGEN timer +- ARM: dts: sunxi: remove duplicated entries in makefile +- soc: xilinx: rename cpu_number1 to dummy_cpu_number +- arm64: dts: qcom: sa8775p: mark ethernet devices as DMA-coherent +- arm64: dts: qcom: msm8996: specify UFS core_clk frequencies +- arm64: dts: rockchip: Update WIFi/BT related nodes on rk3308-rock-pi-s +- arm64: dts: rockchip: Add mdio and ethernet-phy nodes to rk3308-rock-pi-s +- arm64: dts: rockchip: Add pinctrl for UART0 to rk3308-rock-pi-s +- arm64: dts: rockchip: Add sdmmc related properties on rk3308-rock-pi-s +- soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by rpmh_rsc_send_data() callers +- soc: qcom: pmic_glink: Handle the return value of pmic_glink_init +- arm64: dts: qcom: msm8998: enable adreno_smmu by default +- arm64: dts: qcom: sdm850-lenovo-yoga-c630: fix IPA firmware path +- arm64: dts: qcom: msm8996-xiaomi-common: drop excton from the USB PHY +- arm64: dts: qcom: sm8450: add power-domain to UFS PHY +- arm64: dts: qcom: sm8350: add power-domain to UFS PHY +- arm64: dts: qcom: sm8250: add power-domain to UFS PHY +- arm64: dts: qcom: sm8250: switch UFS QMP PHY to new style of bindings +- arm64: dts: qcom: sm6350: add power-domain to UFS PHY +- arm64: dts: qcom: sm6115: add power-domain to UFS PHY +- arm64: dts: qcom: sdm845: add power-domain to UFS PHY +- arm64: dts: qcom: sc8180x: add power-domain to UFS PHY +- arm64: dts: qcom: sc8180x: switch UFS QMP PHY to new style of bindings +- arm64: dts: qcom: sc8180x: Correct PCIe slave ports +- hwmon: (max6697) Fix swapped temp{1,8} critical alarms +- hwmon: (max6697) Fix underflow when writing limit attributes +- pwm: atmel-tcb: Fix race condition and convert to guards +- drm/meson: fix canvas release in bind function +- nvmet-auth: fix nvmet_auth hash error handling +- pwm: stm32: Always do lazy disabling +- md: Don't wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl +- block/mq-deadline: Fix the tag reservation code +- block: Call .limit_depth() after .hctx has been set +- hwmon: (adt7475) Fix default duty on fan is disabled +- x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos +- x86/pci/xen: Fix PCIBIOS_* return code handling +- x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling +- x86/of: Return consistent error type from x86_of_pci_irq_enable() +- hfsplus: fix to avoid false alarm of circular locking +- x86/kconfig: Add as-instr64 macro to properly evaluate AS_WRUSS +- block: initialize integrity buffer to zero before writing it to media +- ubd: untagle discard vs write zeroes not support handling +- ubd: refactor the interrupt handler +- platform/chrome: cros_ec_debugfs: fix wrong EC message version +- md: fix deadlock between mddev_suspend and flush bio +- rcu/tasks: Fix stale task snaphot for Tasks Trace +- EDAC, i10nm: make skx_common.o a separate module +- spi: atmel-quadspi: Add missing check for clk_prepare +- spi: spi-microchip-core: Fix the number of chip selects supported +- powerpc/configs: Update defconfig with now user-visible CONFIG_FSL_IFC +- ALSA: seq: ump: Skip useless ports for static blocks +- ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA is paused +- arm64: dts: qcom: sdm630: Disable SS instance in Parkmode for USB +- arm64: dts: qcom: ipq6018: Disable SS instance in Parkmode for USB +- arm64: dts: qcom: sm6350: Disable SS instance in Parkmode for USB +- arm64: dts: qcom: msm8996: Disable SS instance in Parkmode for USB +- arm64: dts: qcom: qrb4210-rb2: switch I2C2 to i2c-gpio +- ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 +- ALSA: hda/realtek: Enable headset mic on Positivo SU C1400 +- usb: gadget: midi2: Fix incorrect default MIDI2 protocol setup +- jfs: don't walk off the end of ealist +- ocfs2: add bounds checking to ocfs2_check_dir_entry() +- cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() +- cachefiles: fix slab-use-after-free in fscache_withdraw_volume() +- netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume() +- wifi: iwlwifi: mvm: don't wake up rx_sync_waitq upon RFKILL +- wifi: mac80211: disable softirqs for queued frame handling +- wifi: cfg80211: wext: set ssids=NULL for passive scans +- of/irq: Disable "interrupt-map" parsing for PASEMI Nemo +- mm: page_ref: remove folio_try_get_rcu() +- ARM: 9324/1: fix get_user() broken with veneer +- cifs: fix noisy message on copy_file_range +- ALSA: hda: Use imply for suggesting CONFIG_SERIAL_MULTI_INSTANTIATE +- spi: mux: set ctlr->bits_per_word_mask +- selftests/bpf: Extend tcx tests to cover late tcx_entry release +- hfsplus: fix uninit-value in copy_name +- selftests/vDSO: fix clang build errors and warnings +- selftest/timerns: fix clang build failures for abs() calls +- ASoC: SOF: Intel: hda-pcm: Limit the maximum number of periods by MAX_BDL_ENTRIES +- ksmbd: return FILE_DEVICE_DISK instead of super magic +- spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices +- riscv: stacktrace: fix usage of ftrace_graph_ret_addr() +- drivers/perf: riscv: Reset the counter to hpmevent mapping while starting cpus +- wifi: iwlwifi: properly set WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK +- fs: better handle deep ancestor chains in is_subdir() +- drm/radeon: check bo_va->bo is non-NULL before using it +- drm/amd/display: Fix refresh rate range for some panel +- drm/amd/display: Account for cursor prefetch BW in DML1 mode support +- drm/amd/display: Add refresh rate range check +- erofs: ensure m_llen is reset to 0 if metadata is invalid +- Bluetooth: btnxpuart: Enable Power Save feature on startup +- tee: optee: ffa: Fix missing-field-initializers warning +- scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed +- powerpc/pseries: Whitelist dtl slub object for copying to userspace +- net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD() +- net: usb: qmi_wwan: add Telit FN912 compositions +- ASoC: amd: yc: Fix non-functional mic on ASUS M5602RA +- ALSA: dmaengine_pcm: terminate dmaengine before synchronize +- ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx +- ALSA: PCM: Allow resume only for suspended streams +- ibmvnic: Add tx check to prevent skb leak +- btrfs: qgroup: fix quota root leak after quota disable failure +- platform/x86: lg-laptop: Use ACPI device handle when evaluating WMAB/WMBB +- platform/x86: lg-laptop: Change ACPI device id +- platform/x86: lg-laptop: Remove LGEX0815 hotkey handling +- platform/x86: wireless-hotkey: Add support for LG Airplane Button +- platform/mellanox: nvsw-sn2201: Add check for platform_device_add_resources +- s390/sclp: Fix sclp_init() cleanup on failure +- octeontx2-pf: Fix coverity and klockwork issues in octeon PF driver +- gpio: pca953x: fix pca953x_irq_bus_sync_unlock race +- can: kvaser_usb: fix return value for hif_usb_send_regout +- Input: ads7846 - use spi_device_id table +- nvme: fix NVME_NS_DEAC may incorrectly identifying the disk as EXT_LBA. +- ASoC: rt722-sdca-sdw: add debounce time for type detection +- ASoC: SOF: sof-audio: Skip unprepare for in-use widgets on error rollback +- ASoC: ti: omap-hdmi: Fix too long driver name +- ASoC: ti: davinci-mcasp: Set min period size using FIFO config +- ALSA: dmaengine: Synchronize dma channel after drop() +- bytcr_rt5640 : inverse jack detect for Archos 101 cesium +- Input: xpad - add support for ASUS ROG RAIKIRI PRO +- ASoC: rt722-sdca-sdw: add silence detection register as volatile +- Input: i8042 - add Ayaneo Kun to i8042 quirk table +- Input: elantech - fix touchpad state on resume for Lenovo N24 +- mips: fix compat_sys_lseek syscall +- ALSA: hda: cs35l56: Select SERIAL_MULTI_INSTANTIATE +- drm/amdgpu: Indicate CU havest info to CP +- selftests: openvswitch: Set value to nla flags. +- cpumask: limit FORCE_NR_CPUS to just the UP case +- spi: Fix OCTAL mode support +- ALSA: hda/realtek: Add more codec ID to no shutup pins list +- drm/vmwgfx: Fix missing HYPERVISOR_GUEST dependency +- KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() +- ALSA: hda/realtek: Support Lenovo Thinkbook 16P Gen 5 +- ALSA: hda: cs35l56: Fix lifecycle of codec pointer +- nvmet: always initialize cqe.result +- nvme: avoid double free special payload +- drm/mediatek: Call drm_atomic_helper_shutdown() at shutdown time +- drm: panel-orientation-quirks: Add quirk for Aya Neo KUN +- drm/exynos: dp: drop driver owner initialization +- iomap: Fix iomap_adjust_read_range for plen calculation +- mei: demote client disconnect warning on suspend to debug +- fs/file: fix the check in find_next_fd() +- nfs: don't invalidate dentries on transient errors +- nfs: Avoid flushing many pages with NFS_FILE_SYNC +- nfs: propagate readlink errors in nfs_symlink_filler +- HID: Ignore battery for ELAN touchscreens 2F2C and 4116 +- input: Add support for "Do Not Disturb" +- input: Add event code for accessibility key +- kconfig: remove wrong expr_trans_bool() +- kconfig: gconf: give a proper initial state to the Save button +- ila: block BH in ila_output() +- net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input() +- Input: silead - Always support 10 fingers +- of/irq: Factor out parsing of interrupt-map parent phandle+args from of_irq_parse_raw() +- selftests/futex: pass _GNU_SOURCE without a value to the compiler +- selftests/openat2: Fix build warnings on ppc64 +- selftests: cachestat: Fix build warnings on ppc64 +- wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan() +- wifi: iwlwifi: mvm: Fix scan abort handling with HW rfkill +- wifi: iwlwifi: mvm: properly set 6 GHz channel direct probe option +- wifi: iwlwifi: mvm: handle BA session teardown in RF-kill +- wifi: iwlwifi: mvm: Handle BIGTK cipher in kek_kck cmd +- wifi: iwlwifi: mvm: remove stale STA link data during restart +- wifi: iwlwifi: mvm: d3: fix WoWLAN command version lookup +- wifi: cfg80211: fix 6 GHz scan request building +- wifi: mac80211: handle tasklet frames before stopping +- wifi: mac80211: apply mcast rate only if interface is up +- wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata +- tools/power/cpupower: Fix Pstate frequency reporting on AMD Family 1Ah CPUs +- ACPI: EC: Avoid returning AE_OK on errors in address space handler +- ACPI: EC: Abort address space access upon error +- efi/libstub: zboot.lds: Discard .discard sections +- scsi: qedf: Set qed_slowpath_params to zero before use +- scsi: qedf: Wait for stag work during unload +- scsi: qedf: Don't process stag work during unload and recovery +- scsi: sr: Fix unintentional arithmetic wraparound +- scsi: core: alua: I/O errors for ALUA state transitions +- filelock: Remove locks reliably when fcntl/close race is detected +- i2c: rcar: fix error code in probe() +- kbuild: Make ld-version.sh more robust against version string changes +- x86/bhi: Avoid warning in #DB handler due to BHI mitigation +- x86/entry/64: Remove obsolete comment on tracing vs. SYSRET +- x86/entry: Rename ignore_sysret() +- i2c: rcar: clear NO_RXDMA flag after resetting +- i2c: testunit: avoid re-issued work after read message +- i2c: rcar: ensure Gen3+ reset does not disturb local targets +- i2c: rcar: introduce Gen4 devices +- i2c: rcar: reset controller is mandatory for Gen3+ +- i2c: mark HostNotify target address as used +- i2c: rcar: bring hardware to known state when probing +- btrfs: tree-checker: add type and sequence check for inline backrefs +- ext4: avoid ptr null pointer dereference +- nilfs2: fix kernel bug on rename operation of broken directory +- selftests/net: fix gro.c compilation failure due to non-existent opt_ipproto_off +- mm/damon/core: merge regions aggressively when max_nr_regions is unmet +- mm/shmem: disable PMD-sized page cache if needed +- misc: fastrpc: Restrict untrusted app to attach to privileged PD +- misc: fastrpc: Fix ownership reassignment of remote heap +- misc: fastrpc: Fix memory leak in audio daemon attach operation +- misc: fastrpc: Copy the complete capability structure to user +- misc: fastrpc: Avoid updating PD type for capability request +- misc: fastrpc: Fix DSP capabilities request +- wireguard: send: annotate intentional data race in checking empty queue +- wireguard: queueing: annotate intentional data race in cpu round robin +- wireguard: allowedips: avoid unaligned 64-bit memory accesses +- wireguard: selftests: use acpi=off instead of -no-acpi for recent QEMU +- cpufreq: Allow drivers to advertise boost enabled +- cpufreq: ACPI: Mark boost policy as enabled when setting boost +- ACPI: processor_idle: Fix invalid comparison with insertion sort for latency +- libceph: fix race between delayed_work() and ceph_monc_stop() +- pmdomain: qcom: rpmhpd: Skip retention level for Power Domains +- Fix userfaultfd_api to return EINVAL as expected +- ALSA: hda/realtek: Limit mic boost on VAIO PRO PX +- ALSA: hda/realtek: Enable Mute LED on HP 250 G7 +- ALSA: hda/realtek: add quirk for Clevo V5[46]0TU +- tty: serial: ma35d1: Add a NULL check for of_node +- platform/x86: toshiba_acpi: Fix array out-of-bounds access +- nvmem: core: only change name to fram for current attribute +- nvmem: meson-efuse: Fix return value of nvmem callbacks +- nvmem: rmem: Fix return value of rmem_read() +- arm64: dts: qcom: sc8280xp-x13s: fix touchscreen power on +- arm64: dts: qcom: sa8775p: Correct IRQ number of EL2 non-secure physical timer +- iio: trigger: Fix condition for own trigger +- ksmbd: discard write access to the directory open +- mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray +- mm/filemap: skip to create PMD-sized page cache if needed +- mm: vmalloc: check if a hash-index is in cpu_possible_mask +- s390/mm: Add NULL pointer check to crst_table_free() base_crst_free() +- xhci: always resume roothubs if xHC was reset during resume +- hpet: Support 32-bit userspace +- misc: microchip: pci1xxxx: Fix return value of nvmem callbacks +- USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor +- usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() +- usb: dwc3: pci: add support for the Intel Panther Lake +- USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k +- USB: serial: mos7840: fix crash on resume +- USB: serial: option: add Rolling RW350-GL variants +- USB: serial: option: add Netprisma LCUK54 series modules +- USB: serial: option: add support for Foxconn T99W651 +- USB: serial: option: add Fibocom FM350-GL +- USB: serial: option: add Telit FN912 rmnet compositions +- USB: serial: option: add Telit generic core-dump composition +- net: ks8851: Fix potential TX stall after interface reopen +- net: ks8851: Fix deadlock with the SPI chip variant +- Revert "sched/fair: Make sure to try to detach at least one movable task" +- cifs: fix setting SecurityFlags to true +- octeontx2-af: fix issue with IPv4 match for RSS +- octeontx2-af: fix issue with IPv6 ext match for RSS +- octeontx2-af: fix detection of IP layer +- octeontx2-af: fix a issue with cpt_lf_alloc mailbox +- octeontx2-af: replace cpt slot with lf id on reg write +- i40e: fix: remove needless retries of NVM update +- ARM: davinci: Convert comma to semicolon +- ASoC: SOF: Intel: hda: fix null deref on system suspend entry +- firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers +- firmware: cs_dsp: Validate payload length before processing block +- firmware: cs_dsp: Return error if block header overflows file +- arm64: dts: qcom: sc8180x: Fix LLCC reg property again +- s390: Mark psw in __load_psw_mask() as __unitialized +- net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket +- ethtool: netlink: do not return SQI value if link is down +- net: ethernet: mtk-star-emac: set mac_managed_pm when probing +- bpf: Fail bpf_timer_cancel when callback is being cancelled +- bpf: replace bpf_timer_init with a generic helper +- bpf: make timer data struct more generic +- bpf: fix order of args in call to bpf_map_kvcalloc +- i40e: Fix XDP program unloading while removing the driver +- octeontx2-af: Fix incorrect value output on error path in rvu_check_rsrc_availability() +- net: phy: microchip: lan87xx: reinit PHY after cable test +- tcp: fix incorrect undo caused by DSACK of TLP retransmit +- net: bcmasp: Fix error code in probe() +- vfs: don't mod negative dentry count when on shrinker list +- fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading +- dsa: lan9303: Fix mapping between DSA port number and PHY address +- cachefiles: add missing lock protection when polling +- cachefiles: cyclic allocation of msg_id to avoid reuse +- cachefiles: wait for ondemand_object_worker to finish when dropping object +- cachefiles: cancel all requests for the object that is being dropped +- cachefiles: stop sending new request when dropping object +- cachefiles: propagate errors from vfs_getxattr() to avoid infinite loop +- scsi: ufs: core: Fix ufshcd_abort_one racing issue +- scsi: ufs: core: Fix ufshcd_clear_cmd racing issue +- mm: prevent derefencing NULL ptr in pfn_section_valid() +- Compiler Attributes: Add __uninitialized macro +- !10610 wifi: cfg80211: wext: add extra SIOCSIWSCAN data check +- wifi: cfg80211: wext: add extra SIOCSIWSCAN data check +- !10599 ppp: reject claimed-as-LCP but actually malformed packets +- ppp: reject claimed-as-LCP but actually malformed packets +- !10539 tun: add missing verification for short frame +- tun: add missing verification for short frame +- !10538 tap: add missing verification for short frame +- tap: add missing verification for short frame +- !10555 skmsg: Skip zero length skb in sk_msg_recvmsg +- skmsg: Skip zero length skb in sk_msg_recvmsg +- !10596 net: ethernet: lantiq_etop: fix double free in detach +- net: ethernet: lantiq_etop: fix double free in detach +- !10517 mm/dynamic_pool: two bugfix about THP and migration +- mm/dynamic_pool: check page_from_dynamic_pool() on migration +- mm/dynamic_pool: replace task_in_dynamic_pool() with mm_in_dynamic_pool() +- !10579 Fix CVE-2024-41062 +- Bluetooth: Fix usage of __hci_cmd_sync_status +- Bluetooth: L2CAP: Fix deadlock +- bluetooth/l2cap: sync sock recv cb and release +- !10545 bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro() +- bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro() +- !10547 powerpc/eeh: avoid possible crash when edev->pdev changes +- powerpc/eeh: avoid possible crash when edev->pdev changes +- !10470 Make cpuset.cpus.exclusive independent of cpuset.cpus +- cgroup/cpuset: Make cpuset.cpus.exclusive independent of cpuset.cpus +- cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE until valid partition +- cgroup/cpuset: Documentation update for partition +- !10443 v2 cxl/mem: Fix no cxl_nvd during pmem region auto-assembling +- cxl/mem: Fix no cxl_nvd during pmem region auto-assembling +- !10351 bpf: Fix null-pointer-deref in resolve_prog_type() +- selftests/bpf: Test for null-pointer-deref bugfix in resolve_prog_type() +- bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT +- !10401 firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files +- firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files +- !10512 powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. +- powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. +- !10524 Bluetooth: hci_core: cancel all works upon hci_unregister_dev() +- Bluetooth: hci_core: cancel all works upon hci_unregister_dev() +- !10486 fix CVE-2024-42086 +- iio: chemical: bme680: Fix overflows in compensate() functions +- !10466 null_blk: fix validation of block size +- null_blk: fix validation of block size +- !10480 ALSA: emux: improve patch ioctl data validation +- ALSA: emux: improve patch ioctl data validation +- !10385 firmware: cs_dsp: Fix overflow checking of wmfw header +- firmware: cs_dsp: Fix overflow checking of wmfw header +- !10403 Fix CVE-2024-41069 +- ASoC: topology: Fix route memory corruption +- ASoC: topology: Do not assign fields that are already set +- ASoC: topology: Fix references to freed memory +- !10474 jffs2: Fix potential illegal address access in jffs2_free_inode +- jffs2: Fix potential illegal address access in jffs2_free_inode +- !10463 io_uring: fix possible deadlock in io_register_iowq_max_workers() +- io_uring: fix possible deadlock in io_register_iowq_max_workers() +- !10456 NFSv4: Fix memory leak in nfs4_set_security_label +- NFSv4: Fix memory leak in nfs4_set_security_label +- !10450 fs/ntfs3: Validate ff offset +- fs/ntfs3: Validate ff offset +- !10394 filelock: Fix fcntl/close race recovery compat path +- filelock: Fix fcntl/close race recovery compat path +- !10496 PCI/MSI: Fix UAF in msi_capability_init +- PCI/MSI: Fix UAF in msi_capability_init +- !10380 filelock: fix potential use-after-free in posix_lock_inode +- filelock: fix potential use-after-free in posix_lock_inode +- !10378 fs/ntfs3: Add a check for attr_names and oatbl +- fs/ntfs3: Add a check for attr_names and oatbl +- !10491 Bluetooth: ISO: Check socket flag instead of hcon +- Bluetooth: ISO: Check socket flag instead of hcon +- !10495 drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc +- drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc +- !10442 net/sched: Fix UAF when resolving a clash +- net/sched: Fix UAF when resolving a clash +- !10457 udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). +- udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). +- !10371 iommu/arm-smmu-v3: Reducing the CMD_SYNC times +- iommu/arm-smmu-v3: Reducing the CMD_SYNC times +- !10228 PCI/ROM: Fix PCI ROM header check bug +- PCI/ROM: Fix PCI ROM header check bug +- !10416 [sync] PR-10408: iommu/arm-smmu-v3: Fix the compile warning +- iommu/arm-smmu-v3: Fix the compile warning +- !9824 fix CVE-2024-39486 +- drm/drm_file: Fix pid refcounting race +- !10388 ovl: simplify ovl_parse_param_lowerdir() +- ovl: ovl_parse_param_lowerdir: Add missed ' +- ovl: fix wrong lowerdir number check for parameter Opt_lowerdir +- ovl: pass string to ovl_parse_layer() +- !10507 Backport 6.6.35-40 LTS patches from upstream +- Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" +- nilfs2: fix incorrect inode allocation from reserved inodes +- null_blk: Do not allow runt zone with zone capacity smaller then zone size +- drm/amdgpu: silence UBSAN warning +- ALSA: ump: Set default protocol when not given explicitly +- spi: cadence: Ensure data lines set to low during dummy-cycle period +- nfc/nci: Add the inconsistency check between the input data length and count +- kbuild: fix short log for AS in link-vmlinux.sh +- nvmet: fix a possible leak when destroy a ctrl during qp establishment +- platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro +- platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT IVW 11.6" tablet +- regmap-i2c: Subtract reg size from max_write +- nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset +- connector: Fix invalid conversion in cn_proc.h +- dma-mapping: benchmark: avoid needless copy_to_user if benchmark fails +- nvme-multipath: find NUMA path only for online numa-node +- vhost-scsi: Handle vhost_vq_work_queue failures for events +- ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897 +- fs/ntfs3: Mark volume as dirty if xattr is broken +- i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr +- clk: mediatek: mt8183: Only enable runtime PM on mt8183-mfgcfg +- clk: qcom: clk-alpha-pll: set ALPHA_EN bit for Stromer Plus PLLs +- clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents +- media: dw2102: fix a potential buffer overflow +- arm64: dts: rockchip: Fix the DCDC_REG2 minimum voltage on Quartz64 Model B +- bnx2x: Fix multiple UBSAN array-index-out-of-bounds +- net: stmmac: dwmac-qcom-ethqos: fix error array size +- mtd: rawnand: rockchip: ensure NVDDR timings are rejected +- mtd: rawnand: Bypass a couple of sanity checks during NAND identification +- mtd: rawnand: Fix the nand_read_data_op() early check +- mtd: rawnand: Ensure ECC configuration is propagated to upper layers +- powerpc/64s: Fix unnecessary copy to 0 when kernel is booted at address 0 +- powerpc/pseries: Fix scv instruction crash with kexec +- clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common +- clk: qcom: gcc-ipq9574: Add BRANCH_HALT_VOTED flag +- drm: panel-orientation-quirks: Add quirk for Valve Galileo +- drm/amdgpu/atomfirmware: silence UBSAN warning +- drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes +- Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" +- fsnotify: Do not generate events for O_PATH file descriptors +- can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct +- Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot +- Bluetooth: hci_bcm4377: Fix msgid release +- scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() +- f2fs: Add inline to f2fs_build_fault_attr() stub +- btrfs: fix adding block group to a reclaim list and the unused list during reclaim +- mm: avoid overflows in dirty throttling logic +- mm: optimize the redundant loop of mm_update_owner_next() +- nilfs2: add missing check for inode numbers on directory entries +- nilfs2: fix inode number range checks +- Revert "igc: fix a log entry using uninitialized netdev" +- platform/x86: toshiba_acpi: Fix quickstart quirk handling +- cpu: Fix broken cmdline "nosmp" and "maxcpus=0" +- gpiolib: of: add polarity quirk for TSC2005 +- mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file +- inet_diag: Initialize pad field in struct inet_diag_req_v2 +- selftests: make order checking verbose in msg_zerocopy selftest +- selftests: fix OOM in msg_zerocopy selftest +- netfilter: nf_tables: unconditionally flush pending work before notifier +- riscv: kexec: Avoid deadlock in kexec crash path +- wifi: wilc1000: fix ies_len type in connect path +- gpio: mmio: do not calculate bgpio_bits via "ngpios" +- net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() +- net: txgbe: initialize num_q_vectors for MSI/INTx interrupts +- gpiolib: of: fix lookup quirk for MIPS Lantiq +- e1000e: Fix S0ix residency on corporate systems +- KVM: s390: fix LPSWEY handling +- tcp_metrics: validate source addr length +- bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX +- Bluetooth: ISO: Check socket flag instead of hcon +- Bluetooth: Ignore too large handle values in BIG +- Bluetooth: hci_event: Fix setting of unicast qos interval +- net/mlx5e: Add mqprio_rl cleanup and free in mlx5e_priv_cleanup() +- net/mlx5: E-switch, Create ingress ACL when needed +- UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open() +- net: phy: phy_device: Fix PHY LED blinking code comment +- mac802154: fix time calculation in ieee802154_configure_durations() +- vhost_task: Handle SIGKILL by flushing work and exiting +- vhost: Release worker mutex during flushes +- vhost: Use virtqueue mutex for swapping worker +- tools/power turbostat: Remember global max_die_id +- cdrom: rearrange last_media_change check to avoid unintentional overflow +- btrfs: scrub: initialize ret in scrub_simple_mirror() to fix compilation warning +- s390/pkey: Wipe sensitive data on failure +- jffs2: Fix potential illegal address access in jffs2_free_inode +- serial: imx: Raise TX trigger level to 8 +- scsi: mpi3mr: Sanitise num_phys +- f2fs: check validation of fault attrs in f2fs_build_fault_attr() +- bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD +- igc: fix a log entry using uninitialized netdev +- selftests/net: fix uninitialized variables +- powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#" +- kunit: Fix timeout message +- orangefs: fix out-of-bounds fsid access +- powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n +- i2c: i801: Annotate apanel_addr as __ro_after_init +- media: dvb-frontends: tda10048: Fix integer overflow +- media: s2255: Use refcount_t instead of atomic_t for num_channels +- media: dvb-frontends: tda18271c2dd: Remove casting during div +- net: dsa: mv88e6xxx: Correct check for empty list +- thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data +- wifi: mt76: mt7996: add sanity checks for background radar trigger +- wifi: mt76: replace skb_put with skb_put_zero +- usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB +- Input: ff-core - prefer struct_size over open coded arithmetic +- firmware: dmi: Stop decoding on broken entry +- sctp: prefer struct_size over open coded arithmetic +- riscv: Apply SiFive CIP-1200 workaround to single-ASID sfence.vma +- media: dw2102: Don't translate i2c read into write +- drm/amdgpu: fix the warning about the expression (int)size - len +- drm/amdgpu: fix uninitialized scalar variable warning +- drm/amd/display: Fix uninitialized variables in DM +- drm/amd/display: Skip finding free audio for unknown engine_id +- drm/amd/display: Check pipe offset before setting vblank +- drm/amd/display: Check index msg_id before read or write +- drm/amdgpu: Initialize timestamp for some legacy SOCs +- drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc +- drm/amdgpu: Fix uninitialized variable warnings +- media: mediatek: vcodec: Only free buffer VA that is not NULL +- crypto: aead,cipher - zeroize key buffer after use +- RISC-V: KVM: Fix the initial sample period value +- selftests/bpf: dummy_st_ops should reject 0 for non-nullable params +- selftests/bpf: do not pass NULL for non-nullable params in dummy_st_ops +- selftests/bpf: adjust dummy_st_ops_success to detect additional error +- scsi: qedf: Make qedf_execute_tmf() non-preemptible +- IB/core: Implement a limit on UMAD receive List +- media: dvb-usb: dib0700_devices: Add missing release_firmware() +- media: dvb: as102-fe: Fix as10x_register_addr packing +- powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. +- drm/lima: fix shared irq handling on driver remove +- leds: an30259a: Use devm_mutex_init() for mutex initialization +- locking/mutex: Introduce devm_mutex_init() +- Revert "powerpc/bpf: rename powerpc64_jit_data to powerpc_jit_data" +- Revert "powerpc/bpf: use bpf_jit_binary_pack_[alloc|finalize|free]" +- tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset() +- serial: 8250_omap: Fix Errata i2310 with RX FIFO level check +- serial: imx: only set receiver level if it is zero +- cxl/region: Avoid null pointer dereference in region lookup +- cxl/region: Move cxl_dpa_to_region() work to the region driver +- arm64: dts: rockchip: Add sound-dai-cells for RK3368 +- arm64: dts: rockchip: fix PMIC interrupt pin on ROCK Pi E +- arm64: dts: rockchip: make poweroff(8) work on Radxa ROCK 5A +- ARM: dts: rockchip: rk3066a: add #sound-dai-cells to hdmi node +- arm64: dts: rockchip: Fix the value of `dlg,jack-det-rate` mismatch on rk3399-gru +- arm64: dts: rockchip: Rename LED related pinctrl nodes on rk3308-rock-pi-s +- arm64: dts: rockchip: Fix SD NAND and eMMC init on rk3308-rock-pi-s +- pwm: stm32: Refuse too small period requests +- syscalls: fix sys_fanotify_mark prototype +- syscalls: fix compat_sys_io_pgetevents_time64 usage +- ftruncate: pass a signed offset +- ata: libata-core: Fix double free on error +- ata: ahci: Clean up sysfs file on error +- can: mcp251xfd: fix infinite loop when xmit fails +- batman-adv: Don't accept TT entries for out-of-spec VIDs +- drm/amdgpu/atomfirmware: fix parsing of vram_info +- drm/amd/display: Send DP_TOTAL_LTTPR_CNT during detection if LTTPR is present +- drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes +- drm/i915/gt: Fix potential UAF by revoke of fence registers +- drm/amdgpu: avoid using null object of framebuffer +- drm/fbdev-dma: Only set smem_start is enable per module option +- drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes +- drm/drm_file: Fix pid refcounting race +- hexagon: fix fadvise64_64 calling conventions +- csky, hexagon: fix broken sys_sync_file_range +- btrfs: zoned: fix initial free space detection +- sh: rework sync_file_range ABI +- kbuild: Install dtb files as 0644 in Makefile.dtbinst +- cpu/hotplug: Fix dynstate assignment in __cpuhp_setup_state_cpuslocked() +- cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing +- PCI/MSI: Fix UAF in msi_capability_init +- net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new +- net: can: j1939: recover socket queue on CAN bus error during BAM transmission +- net: can: j1939: Initialize unused data in j1939_send_one() +- tty: mcf: MCF54418 has 10 UARTS +- ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook 645/665 G11. +- serial: bcm63xx-uart: fix tx after conversion to uart_port_tx_limited() +- serial: core: introduce uart_port_tx_limited_flags() +- serial: imx: set receiver level before starting uart +- serial: 8250_omap: Implementation of Errata i2310 +- Revert "serial: core: only stop transmit when HW fifo is empty" +- usb: dwc3: core: Workaround for CSR read timeout +- usb: dwc3: core: Add DWC31 version 2.00a controller +- usb: ucsi: stm32: fix command completion handling +- usb: typec: ucsi: glink: fix child node release in probe function +- usb: gadget: aspeed_udc: fix device address configuration +- usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock +- usb: atm: cxacru: fix endpoint checking in cxacru_bind() +- usb: musb: da8xx: fix a resource leak in probe() +- usb: gadget: printer: fix races against disable +- usb: gadget: printer: SS+ support +- net: usb: ax88179_178a: improve link status logs +- iio: chemical: bme680: Fix sensor data read operation +- iio: chemical: bme680: Fix overflows in compensate() functions +- iio: chemical: bme680: Fix calibration data variable +- iio: chemical: bme680: Fix pressure value output +- iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF +- iio: adc: ad7266: Fix variable checking bug +- ata,scsi: libata-core: Do not leak memory for ata_port struct members +- ata: libata-core: Fix null pointer dereference on error +- i2c: testunit: discard write requests while old command is running +- i2c: testunit: don't erase registers after STOP +- kbuild: Fix build target deb-pkg: ln: failed to create hard link +- kbuild: doc: Update default INSTALL_MOD_DIR from extra to updates +- counter: ti-eqep: enable clock at probe +- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask +- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro() +- mmc: sdhci: Do not invert write-protect twice +- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos +- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard +- mmc: sdhci-pci-o2micro: Convert PCIBIOS_* return codes to errnos +- mm: fix incorrect vbq reference in purge_fragmented_block +- nfs: drop the incorrect assertion in nfs_swap_rw() +- ocfs2: fix DIO failure due to insufficient transaction credits +- pinctrl: qcom: spmi-gpio: drop broken pm8008 support +- Revert "MIPS: pci: lantiq: restore reset gpio polarity" +- parisc: use generic sys_fanotify_mark implementation +- x86: stop playing stack games in profile_pc() +- randomize_kstack: Remove non-functional per-arch entropy filtering +- gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1) +- riscv: stacktrace: convert arch_stack_walk() to noinstr +- drm/amdgpu: Fix pci state save during mode-1 reset +- RISC-V: fix vector insn load/store width mask +- gpio: davinci: Validate the obtained number of IRQs +- drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA +- nvme: fixup comment for nvme RDMA Provider Type +- drm/radeon/radeon_display: Decrease the size of allocated memory +- gfs2: Fix NULL pointer dereference in gfs2_log_flush +- soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message +- irqchip/loongson: Select GENERIC_IRQ_EFFECTIVE_AFF_MASK if SMP for IRQ_LOONGARCH_CPU +- media: dvbdev: Initialize sbuf +- ALSA: emux: improve patch ioctl data validation +- crypto: ecdh - explicitly zeroize private_key +- net/dpaa2: Avoid explicit cpumask var allocation on stack +- net/iucv: Avoid explicit cpumask var allocation on stack +- RDMA/restrack: Fix potential invalid address access +- bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode +- wifi: ieee80211: check for NULL in ieee80211_mle_size_ok() +- mtd: partitions: redboot: Added conversion of operands to a larger type +- x86/fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup +- vduse: Temporarily fail if control queue feature requested +- vduse: validate block features only with block devices +- drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep +- powerpc/bpf: use bpf_jit_binary_pack_[alloc|finalize|free] +- powerpc/bpf: rename powerpc64_jit_data to powerpc_jit_data +- net: mana: Fix possible double free in error handling path +- netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers +- ALSA: seq: Fix missing MSB in MIDI2 SPP conversion +- tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed TFO +- powerpc: restore some missing spu syscalls +- parisc: use correct compat recv/recvfrom syscalls +- sparc: fix compat recv/recvfrom syscalls +- sparc: fix old compat_sys_select() +- net: dsa: microchip: fix wrong register write when masking interrupt +- ALSA: seq: Fix missing channel at encoding RPN/NRPN MIDI2 messages +- Fix race for duplicate reqsk on identical SYN +- btrfs: use NOFS context when getting inodes during logging and log replay +- xdp: Remove WARN() from __xdp_reg_mem_model() +- ice: Rebuild TC queues on VSI queue reconfiguration +- net: dsa: microchip: use collision based back pressure mode +- net: phy: micrel: add Microchip KSZ 9477 to the device table +- ibmvnic: Free any outstanding tx skbs during scrq reset +- mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems +- openvswitch: get related ct labels from its master if it is not confirmed +- net: dsa: microchip: fix initial port flush problem +- ASoC: fsl-asoc-card: set priv->pdev before using it +- ASoC: amd: acp: remove i2s configuration check in acp_i2s_probe() +- ASoC: amd: acp: add a null check for chip_pdev structure +- s390/pci: Add missing virt_to_phys() for directed DIBV +- bpf: Add missed var_off setting in coerce_subreg_to_size_sx() +- bpf: Add missed var_off setting in set_sext32_default_val() +- ASoC: q6apm-lpass-dai: close graph on prepare errors +- workqueue: Increase worker desc's length to 32 +- ASoC: atmel: atmel-classd: Re-add dai_link->platform to fix card init +- ASoC: atmel: convert not to use asoc_xxx() +- ASoC: mediatek: mt8183-da7219-max98357: Fix kcontrol name collision +- ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on right mclk +- wifi: mac80211: Use flexible array in struct ieee80211_tim_ie +- selftests: mptcp: userspace_pm: fixed subtest names +- selftests: mptcp: print_test out of verify_listener_events +- MIPS: pci: lantiq: restore reset gpio polarity +- pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set +- pinctrl: rockchip: use dedicated pinctrl type for RK3328 +- pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins +- pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins +- pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER +- Input: ili210x - fix ili251x_read_touch_data() return value +- usb: typec: ucsi: Ack also failed Get Error commands +- usb: typec: ucsi: Never send a lone connector change ack +- iio: pressure: bmp280: Fix BMP580 temperature reading +- iio: pressure: fix some word spelling errors +- Revert "mm: mmap: allow for the maximum number of bits for randomizing mmap_base by default" +- hid: asus: asus_report_fixup: fix potential read out of bounds +- kprobe/ftrace: fix build error due to bad function definition +- ASoC: Intel: sof-sdw: really remove FOUR_SPEAKER quirk +- drm/amd/display: revert Exit idle optimizations before HDCP execution +- LoongArch: Fix entry point in kernel image header +- efi/loongarch: Directly position the loaded image file +- vgacon: rework screen_info #ifdef checks +- riscv: force PAGE_SIZE linear mapping if debug_pagealloc is enabled +- riscv: Don't use PGD entries for the linear mapping +- x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL +- x86/cpu/vfm: Add new macros to work with (vendor/family/model) values +- tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test +- nbd: Fix signal handling +- nbd: Improve the documentation of the locking assumptions +- ocfs2: update inode fsync transaction id in ocfs2_unlink and ocfs2_link +- ocfs2: convert to new timestamp accessors +- wifi: rtl8xxxu: enable MFP support with security flag of RX descriptor +- perf script: Show also errors for --insn-trace option +- perf: script: add raw|disasm arguments to --insn-trace option +- spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to CCR_BUSWIDTH_4 +- arm64: dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc +- spi: stm32: qspi: Fix dual flash mode sanity test in stm32_qspi_setup() +- dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to i2c-controller schema +- dt-bindings: i2c: atmel,at91sam: correct path to i2c-controller schema +- i2c: ocores: set IACK bit after core is enabled +- mm/page_table_check: fix crash on ZONE_DEVICE +- tcp: clear tp->retrans_stamp in tcp_rcv_fastopen_synack() +- mm: mmap: allow for the maximum number of bits for randomizing mmap_base by default +- efi/x86: Free EFI memory map only when installing a new one. +- kcov: don't lose track of remote references during softirqs +- gcov: add support for GCC 14 +- dt-bindings: dma: fsl-edma: fix dma-channels constraints +- drm/radeon: fix UBSAN warning in kv_dpm.c +- drm/i915/mso: using joiner is not possible with eDP MSO +- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14AHP9 +- ALSA: hda/realtek: Limit mic boost on N14AP7 +- ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 445/465 G11. +- ovl: fix encoding fid for lower only root +- RDMA/mlx5: Follow rb_key.ats when creating new mkeys +- RDMA/mlx5: Remove extra unlock on error path +- RDMA/rxe: Fix data copy for IB_SEND_INLINE +- KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC routes +- KVM: arm64: Disassociate vcpus from redistributor region on teardown +- LoongArch: Fix multiple hardware watchpoint issues +- LoongArch: Trigger user-space watchpoints correctly +- LoongArch: Fix watchpoint setting error +- cifs: fix typo in module parameter enable_gcm_256 +- scsi: ufs: core: Free memory allocated for model before reinit +- btrfs: retry block group reclaim without infinite loop +- net: do not leave a dangling sk pointer, when socket creation fails +- net: usb: ax88179_178a: improve reset check +- net: stmmac: Assign configured channel value to EXTTS event +- locking/atomic: scripts: fix ${atomic}_sub_and_test() kerneldoc +- arm64: defconfig: enable the vf610 gpio driver +- ACPI: EC: Evaluate orphan _REG under EC device +- RDMA/mana_ib: Ignore optional access flags for MRs +- RDMA/mlx5: Fix unwind flow as part of mlx5_ib_stage_init_init +- firmware: psci: Fix return value from psci_system_suspend() +- io_uring/rsrc: fix incorrect assignment of iter->nr_segs in io_import_fixed +- spi: spi-imx: imx51: revert burst length calculation back to bits_per_word +- arm64: dts: freescale: imx8mm-verdin: enable hysteresis on slow input pin +- arm64: dts: imx93-11x11-evk: Remove the 'no-sdio' property +- arm64: dts: freescale: imx8mp-venice-gw73xx-2x: fix BT shutdown GPIO +- arm64: dts: imx8mp: Fix TC9595 input clock on DH i.MX8M Plus DHCOM SoM +- arm64: dts: imx8mp: Fix TC9595 reset GPIO on DH i.MX8M Plus DHCOM SoM +- thermal/drivers/mediatek/lvts_thermal: Return error in case of invalid efuse data +- regulator: bd71815: fix ramp values +- dmaengine: ioatdma: Fix missing kmem_cache_destroy() +- dmaengine: fsl-edma: avoid linking both modules +- dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe() +- dmaengine: ioatdma: Fix error path in ioat3_dma_probe() +- dmaengine: ioatdma: Fix leaking on version mismatch +- regulator: core: Fix modpost error "regulator_get_regmap" undefined +- RDMA/rxe: Fix responder length checking for UD request packets +- spi: cs42l43: Correct SPI root clock speed +- RDMA/bnxt_re: Fix the max msix vectors macro +- net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings +- bnxt_en: Restore PTP tx_avail count in case of skb_pad() error +- ice: Fix VSI list rule with ICE_SW_LKUP_LAST type +- octeontx2-pf: Fix linking objects into multiple modules +- octeontx2-pf: Add error handling to VLAN unoffload handling +- virtio_net: fixing XDP for fully checksummed packets handling +- virtio_net: checksum offloading handling fix +- net: stmmac: No need to calculate speed divider when offload is disabled +- selftests: openvswitch: Use bash as interpreter +- ptp: fix integer overflow in max_vclocks_store +- sched: act_ct: add netns into the key of tcf_ct_flow_table +- net: phy: mxl-gpy: Remove interrupt mask clearing from config_init +- net: lan743x: Support WOL at both the PHY and MAC appropriately +- net: lan743x: disable WOL upon resume to restore full data path operation +- qca_spi: Make interrupt remembering atomic +- netns: Make get_net_ns() handle zero refcount net +- xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() +- ipv6: prevent possible NULL deref in fib6_nh_init() +- bpf: Avoid splat in pskb_pull_reason +- ALSA: hda: tas2781: Component should be unbound before deconstruction +- ALSA: hda: cs35l56: Component should be unbound before deconstruction +- cipso: fix total option length computation +- net: mvpp2: use slab_build_skb for oversized frames +- ice: avoid IRQ collision to fix init failure on ACPI S3 resume +- ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option +- ALSA: hda/realtek: Remove Framework Laptop 16 from quirks +- MIPS: Routerboard 532: Fix vendor retry check code +- ALSA: seq: ump: Fix missing System Reset message handling +- PCI: Do not wait for disconnected devices when resuming +- ACPI: EC: Install address space handler at the namespace root +- usb: gadget: function: Remove usage of the deprecated ida_simple_xx() API +- serial: exar: adding missing CTI and Exar PCI ids +- f2fs: don't set RO when shutting down f2fs +- PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports +- udf: udftime: prevent overflow in udf_disk_stamp_to_time() +- usb: typec: ucsi_glink: drop special handling for CCI_BUSY +- usb: dwc3: pci: Don't set "linux,phy_charger_detect" property on Lenovo Yoga Tab2 1380 +- Avoid hw_desc array overrun in dw-axi-dmac +- usb: misc: uss720: check for incompatible versions of the Belkin F5U002 +- usb: gadget: uvc: configfs: ensure guid to be valid before set +- kprobe/ftrace: bail out if ftrace was killed +- power: supply: cros_usbpd: provide ID table for avoiding fallback match +- platform/x86: p2sb: Don't init until unassigned resources have been assigned +- powerpc/io: Avoid clang null pointer arithmetic warnings +- media: mtk-vcodec: potential null pointer deference in SCP +- media: intel/ipu6: Fix build with !ACPI +- ALSA: hda/realtek: Add quirks for Lenovo 13X +- drm/lima: mask irqs in timeout path before hard reset +- drm/lima: add mask irq callback to gp and pp +- ASoC: Intel: sof_sdw: add quirk for Dell SKU 0C0F +- ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14 +- platform/x86: toshiba_acpi: Add quirk for buttons on Z830 +- drm/amd/display: Exit idle optimizations before HDCP execution +- Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl +- ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7 +- HID: asus: fix more n-key report descriptors if n-key quirked +- HID: Add quirk for Logitech Casa touchpad +- net: dsa: realtek: keep default LED state in rtl8366rb +- kselftest: arm64: Add a null pointer check +- net: sfp: add quirk for ATS SFP-GE-T 1000Base-TX module +- scsi: qedi: Fix crash while reading debugfs attribute +- ACPI: x86: Add PNP_UART1_SKIP quirk for Lenovo Blade2 tablets +- af_packet: avoid a false positive warning in packet_setsockopt() +- wifi: ath9k: work around memset overflow warning +- selftests/bpf: Fix flaky test btf_map_in_map/lookup_update +- selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh +- block/ioctl: prefer different overflow check +- rcutorture: Fix invalid context warning when enable srcu barrier testing +- rcutorture: Make stall-tasks directly exit when rcutorture tests end +- rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment +- io_uring/sqpoll: work around a potential audit memory leak +- padata: Disable BH when taking works lock on MT path +- zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING +- i2c: designware: Fix the functionality flags of the slave-only interface +- i2c: at91: Fix the functionality flags of the slave-only interface +- misc: microchip: pci1xxxx: Fix a memory leak in the error handling of gp_aux_bus_probe() +- serial: core: Add UPIO_UNKNOWN constant for unknown port type +- device property: Implement device_is_big_endian() +- greybus: Fix use-after-free bug in gb_interface_release due to race condition. +- remoteproc: k3-r5: Jump to error handling labels in start/stop errors +- serial: 8250_pxa: Configure tx_loadsz to match FIFO IRQ level +- mm/huge_memory: don't unpoison huge_zero_folio +- tick/nohz_full: Don't abuse smp_call_function_single() in tick_setup_device() +- nilfs2: fix potential kernel bug due to lack of writeback flag waiting +- xfs: allow cross-linking special files without project quota +- xfs: allow sunit mount option to repair bad primary sb stripe values +- xfs: shrink failure needs to hold AGI buffer +- xfs: fix SEEK_HOLE/DATA for regions with active COW extents +- xfs: fix scrub stats file permissions +- xfs: fix imprecise logic in xchk_btree_check_block_owner +- pmdomain: ti-sci: Fix duplicate PD referrals +- intel_th: pci: Add Lunar Lake support +- intel_th: pci: Add Meteor Lake-S support +- intel_th: pci: Add Sapphire Rapids SOC support +- intel_th: pci: Add Granite Rapids SOC support +- intel_th: pci: Add Granite Rapids support +- drm/i915: Fix audio component initialization +- drm/i915/dpt: Make DPT object unshrinkable +- drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) +- drm/i915/gt: Disarm breadcrumbs if engines are already idle +- rtla/auto-analysis: Replace with spaces +- rtla/timerlat: Simplify "no value" printing on top +- iio: invensense: fix interrupt timestamp alignment +- iio: adc: axi-adc: make sure AXI clock is enabled +- remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs +- remoteproc: k3-r5: Wait for core0 power-up before powering up core1 +- dmaengine: axi-dmac: fix possible race in remove() +- PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id +- ocfs2: use coarse time for new created files +- fs/proc: fix softlockup in __read_vmcore +- knfsd: LOOKUP can return an illegal error value +- spmi: hisi-spmi-controller: Do not override device identifier +- dma-buf: handle testing kthreads creation failure +- null_blk: Print correct max open zones limit in null_init_zoned_dev() +- kheaders: explicitly define file modes for archived headers +- tracing/selftests: Fix kprobe event name test for .isra. functions +- riscv: fix overlap of allocated page and PTR_ERR +- perf auxtrace: Fix multiple use of --itrace option +- perf/core: Fix missing wakeup when waiting for context reference +- x86/amd_nb: Check for invalid SMN reads +- x86/kexec: Fix bug with call depth tracking +- irqchip/gic-v3-its: Fix potential race condition in its_vlpi_prop_update() +- mptcp: pm: update add_addr counters after connect +- mptcp: pm: inc RmAddr MIB counter once per RM_ADDR ID +- ACPI: x86: Force StorageD3Enable on more products +- drivers: core: synchronize really_probe() and dev_uevent() +- iio: imu: inv_icm42600: delete unneeded update watermark call +- iio: invensense: fix odr switching to same value +- iio: dac: ad5592r: fix temperature channel scaling value +- iio: adc: ad9467: fix scan type sign +- x86/boot: Don't add the EFI stub to targets, again +- ksmbd: fix missing use of get_write in in smb2_set_ea() +- bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() +- af_unix: Read with MSG_PEEK loops if the first unread byte is OOB +- net/ipv6: Fix the RT cache flush via sysctl using a previous delay +- nvmet-passthru: propagate status from id override functions +- block: fix request.queuelist usage in flush +- block: sed-opal: avoid possible wrong address reference in read_sed_opal_key() +- net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs parameters +- gve: ignore nonrelevant GSO type bits when processing TSO headers +- net: pse-pd: Use EOPNOTSUPP error code instead of ENOTSUPP +- scsi: ufs: core: Quiesce request queues before checking pending cmds +- x86/uaccess: Fix missed zeroing of ia32 u64 get_user() range checking +- x86/asm: Use %c/%n instead of %P operand modifier in asm templates +- netfilter: nft_inner: validate mandatory meta and payload +- Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ +- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets +- geneve: Fix incorrect inner network header offset when innerprotoinherit is set +- net dsa: qca8k: fix usages of device_get_named_child_node() +- tcp: fix race in tcp_v6_syn_recv_sock() +- drm/bridge/panel: Fix runtime warning on panel bridge release +- net: stmmac: dwmac-qcom-ethqos: Configure host DMA width +- net: sfp: Always call `sfp_sm_mod_remove()` on remove +- modpost: do not warn about missing MODULE_DESCRIPTION() for vmlinux.o +- af_unix: Annotate data-race of sk->sk_state in unix_accept(). +- drm/vmwgfx: Don't memcmp equivalent pointers +- drm/vmwgfx: Remove STDU logic from generic mode_valid function +- drm/vmwgfx: 3D disabled should not effect STDU memory limits +- drm/vmwgfx: Filter modes which exceed graphics memory +- drm/vmwgfx: Refactor drm connector probing for display modes +- io_uring/io-wq: avoid garbage value of 'match' in io_wq_enqueue() +- iommu: Return right value in iommu_sva_bind_device() +- iommu/amd: Fix sysfs leak in iommu init +- HID: core: remove unnecessary WARN_ON() in implement() +- gpio: tqmx86: fix broken IRQ_TYPE_EDGE_BOTH interrupt type +- gpio: tqmx86: store IRQ trigger type and unmask status separately +- gpio: tqmx86: introduce shadow register for GPIO output value +- gpio: tqmx86: fix typo in Kconfig label +- platform/x86: dell-smbios: Fix wrong token data in sysfs +- drm/panel: sitronix-st7789v: Add check for of_drm_get_panel_orientation +- nvme: fix nvme_pr_* status code parsing +- selftests/tracing: Fix event filter test to retry up to 10 times +- NFS: add barriers when testing for NFS_FSDATA_BLOCKED +- SUNRPC: return proper error from gss_wrap_req_priv +- NFSv4.1 enforce rootpath check in fs_location query +- clk: sifive: Do not register clkdevs for PRCI clocks +- selftests/ftrace: Fix to check required event file +- cxl/test: Add missing vmalloc.h for tools/testing/cxl/test/mem.c +- HID: nvidia-shield: Add missing check for input_ff_create_memless +- powerpc/uaccess: Fix build errors seen with GCC 13/14 +- gve: Clear napi->skb before dev_kfree_skb_any() +- scsi: sd: Use READ(16) when reading block zero on large capacity disks +- scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory +- scsi: mpi3mr: Fix ATA NCQ priority support +- scsi: core: Disable CDL by default +- thunderbolt: debugfs: Fix margin debugfs node creation condition +- xhci: Apply broken streams quirk to Etron EJ188 xHCI host +- xhci: Handle TD clearing for multiple streams case +- xhci: Apply reset resume quirk to Etron EJ188 xHCI host +- xhci: Set correct transferred length for cancelled bulk transfers +- jfs: xattr: fix buffer overflow for invalid xattr +- landlock: Fix d_parent walk +- serial: port: Don't block system suspend even if bytes are left to xmit +- tty: n_tty: Fix buffer offsets when lookahead is used +- mei: me: release irq in mei_me_pci_resume error path +- usb: typec: tcpm: Ignore received Hard Reset in TOGGLING state +- usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps +- USB: xen-hcd: Traverse host/ when CONFIG_USB_XEN_HCD is selected +- USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages +- bpf: fix multi-uprobe PID filtering logic +- eventfs: Update all the eventfs_inodes from the events descriptor +- irqchip/riscv-intc: Prevent memory leak when riscv_intc_init_common() fails +- irqchip/riscv-intc: Introduce Andes hart-level interrupt controller +- irqchip/riscv-intc: Allow large non-standard interrupt number +- selftests/mm: compaction_test: fix bogus test success on Aarch64 +- selftests/mm: log a consistent test name for check_compaction +- selftests/mm: conform test to TAP format output +- memory-failure: use a folio in me_huge_page() +- firmware: qcom_scm: disable clocks if qcom_scm_bw_enable() fails +- ksmbd: use rwsem instead of rwlock for lease break +- net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() +- af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill(). +- af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen(). +- af_unix: Use skb_queue_empty_lockless() in unix_release_sock(). +- af_unix: Use unix_recvq_full_lockless() in unix_stream_connect(). +- af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen. +- af_unix: Annotate data-races around sk->sk_sndbuf. +- af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG. +- af_unix: Annotate data-race of sk->sk_state in unix_stream_read_skb(). +- af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg(). +- af_unix: Annotate data-race of sk->sk_state in unix_stream_connect(). +- af_unix: Annotate data-races around sk->sk_state in unix_write_space() and poll(). +- af_unix: Annotate data-race of sk->sk_state in unix_inq_len(). +- af_unix: Annodate data-races around sk->sk_state for writers. +- af_unix: Set sk->sk_state under unix_state_lock() for truly disconencted peer. +- net: wwan: iosm: Fix tainted pointer delete is case of region creation fail +- ice: add flag to distinguish reset from .ndo_bpf in XDP rings config +- ice: remove af_xdp_zc_qps bitmap +- ice: fix iteration of TLVs in Preserved Fields Area +- ptp: Fix error message on failed pin verification +- net/mlx5: Fix tainted pointer delete is case of flow rules creation fail +- net/mlx5: Stop waiting for PCI if pci channel is offline +- mptcp: count CLOSE-WAIT sockets for MPTCP_MIB_CURRESTAB +- tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB +- vxlan: Fix regression when dropping packets due to invalid src addresses +- net: phy: Micrel KSZ8061: fix errata solution not taking effect problem +- net/smc: avoid overwriting when adjusting sock bufsizes +- octeontx2-af: Always allocate PF entries from low prioriy zone +- net: tls: fix marking packets as decrypted +- ipv6: sr: block BH in seg6_output_core() and seg6_input_core() +- ipv6: ioam: block BH from ioam6_output() +- bpf: Store ref_ctr_offsets values in bpf_uprobe array +- net: phy: micrel: fix KSZ9477 PHY issues after suspend/resume +- net/ncsi: Fix the multi thread manner of NCSI driver +- net/ncsi: Simplify Kconfig/dts control flow +- ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put() +- ax25: Fix refcount imbalance on inbound connections +- RISC-V: KVM: Fix incorrect reg_subtype labels in kvm_riscv_vcpu_set_reg_isa_ext function +- RISC-V: KVM: No need to use mask when hart-index-bit is 0 +- scsi: ufs: mcq: Fix error output and clean up ufshcd_mcq_abort() +- wifi: mac80211: correctly parse Spatial Reuse Parameter Set element +- wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef +- wifi: iwlwifi: mvm: set properly mac header +- wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64 +- wifi: iwlwifi: mvm: don't initialize csa_work twice +- wifi: cfg80211: pmsr: use correct nla_get_uX functions +- wifi: cfg80211: Lock wiphy in cfg80211_get_station +- wifi: cfg80211: fully move wiphy work to unbound workqueue +- !10369 Backport 6.6.33-34 LTS patches from upstream +- openeuler_defconfig: add new config +- selftests: net: more strict check in net_helper +- powerpc/bpf: enforce full ordering for ATOMIC operations with BPF_FETCH +- ALSA: seq: Fix incorrect UMP type for system messages +- btrfs: fix leak of qgroup extent records after transaction abort +- tracefs: Clear EVENT_INODE flag in tracefs_drop_inode() +- eventfs: Keep the directories from having the same inode number as files +- NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS +- nfs: fix undefined behavior in nfs_block_bits() +- EDAC/igen6: Convert PCIBIOS_* return codes to errnos +- ALSA: ump: Don't accept an invalid UMP protocol number +- ALSA: ump: Don't clear bank selection after sending a program change +- i3c: master: svc: fix invalidate IBI type and miss call client IBI handler +- s390/cpacf: Make use of invalid opcode produce a link error +- s390/cpacf: Split and rework cpacf query functions +- parisc: Define sigset_t in parisc uapi header +- parisc: Define HAVE_ARCH_HUGETLB_UNMAPPED_AREA +- ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat +- ARM: dts: samsung: smdk4412: fix keypad no-autorepeat +- ARM: dts: samsung: smdkv310: fix keypad no-autorepeat +- riscv: dts: starfive: Remove PMIC interrupt info for Visionfive 2 board +- drm/amdkfd: handle duplicate BOs in reserve_bo_and_cond_vms +- sparc: move struct termio to asm/termios.h +- kdb: Use format-specifiers rather than memset() for padding in kdb_read() +- kdb: Merge identical case statements in kdb_read() +- kdb: Fix console handling when editing and tab-completing commands +- kdb: Use format-strings rather than '0' injection in kdb_read() +- wifi: ath10k: fix QCOM_RPROC_COMMON dependency +- watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin +- selftests/mm: fix build warnings on ppc64 +- selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages +- mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL +- mm: /proc/pid/smaps_rollup: avoid skipping vma after getting mmap_lock again +- mm/hugetlb: pass correct order_per_bit to cma_declare_contiguous_nid +- mm/cma: drop incorrect alignment check in cma_init_reserved_mem +- sparc64: Fix number of online CPUs +- rtla/timerlat: Fix histogram report when a cpu count is 0 +- intel_th: pci: Add Meteor Lake-S CPU support +- tpm_tis: Do *not* flush uninitialized work +- kmsan: do not wipe out origin when doing partial unpoisoning +- mm/ksm: fix ksm_pages_scanned accounting +- net/ipv6: Fix route deleting failure when metric equals 0 +- scsi: core: Handle devices which return an unusually large VPD page count +- HID: i2c-hid: elan: fix reset suspend current leakage +- filemap: add helper mapping_max_folio_size() +- kbuild: Remove support for Clang's ThinLTO caching +- crypto: ecrdsa - Fix module auto-load on add_key +- crypto: ecdsa - Fix module auto-load on add-key +- clk: qcom: clk-alpha-pll: fix rate setting for Stromer PLLs +- LoongArch: Override higher address bits in JUMP_VIRT_ADDR +- LoongArch: Add all CPUs enabled by fdt to NUMA node 0 +- KVM: arm64: AArch32: Fix spurious trapping of conditional instructions +- KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode +- KVM: arm64: Fix AArch32 register narrowing on userspace write +- Revert "drm/amdkfd: fix gfx_target_version for certain 11.0.3 devices" +- drm/amd: Fix shutdown (again) on some SMU v13.0.4/11 platforms +- drm/amdgpu/atomfirmware: add intergrated info v2.3 table +- drm/fbdev-generic: Do not set physical framebuffer address +- mmc: sdhci-acpi: Add quirk to enable pull-up on the card-detect GPIO on Asus T100TA +- mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A +- mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working +- mmc: sdhci-acpi: Sort DMI quirks alphabetically +- mmc: sdhci: Add support for "Tuning Error" interrupts +- mmc: core: Add mmc_gpiod_set_cd_config() function +- media: v4l: async: Don't set notifier's V4L2 device if registering fails +- media: v4l2-core: hold videodev_lock until dev reg, finishes +- media: mxl5xx: Move xpt structures off stack +- media: mc: mark the media devnode as registered from the, start +- arm64: dts: ti: verdin-am62: Set memory size to 2gb +- arm64: dts: hi3798cv200: fix the size of GICR +- arm64: dts: qcom: sc8280xp: add missing PCIe minimum OPP +- wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path +- wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE +- wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power +- wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU +- wifi: rtw89: pci: correct TX resource checking for PCI DMA channel of firmware command +- md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING +- arm64: dts: qcom: qcs404: fix bluetooth device address +- arm64: tegra: Correct Tegra132 I2C alias +- ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx +- soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request +- proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation +- fsverity: use register_sysctl_init() to avoid kmemleak warning +- ata: pata_legacy: make legacy_exit() work again +- wifi: rtw89: correct aSIFSTime for 6GHz band +- bcache: fix variable length array abuse in btree_iter +- f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() +- drm/sun4i: hdmi: Move mode_set into enable +- drm/sun4i: hdmi: Convert encoder to atomic +- selftests: net: List helper scripts in TEST_FILES Makefile variable +- selftests: net: included needed helper in the install targets +- selftests/net: synchronize udpgro tests' tx and rx connection +- vxlan: Fix regression when dropping packets due to invalid src addresses +- erofs: avoid allocating DEFLATE streams before mounting +- mptcp: fix full TCP keep-alive support +- mptcp: cleanup SOL_TCP handling +- mptcp: avoid some duplicate code in socket option handling +- net: sfp-bus: fix SFP mode detect from bitrate +- afs: Don't cross .backup mountpoint from backup volume +- mmc: core: Do not force a retune before RPMB switch +- riscv: stacktrace: fixed walk_stackframe() +- riscv: prevent pt_regs corruption for secondary idle threads +- SUNRPC: Fix loop termination condition in gss_free_in_token_pages() +- f2fs: use f2fs_{err,info}_ratelimited() for cleanup +- f2fs: write missing last sum blk of file pinning section +- perf sched timehist: Fix -g/--call-graph option failure +- media: vsp1: Remove unbalanced .s_stream(0) calls +- nouveau: report byte usage in VRAM usage. +- RDMA/bnxt_re: Fix the sparse warnings +- perf evlist: Add perf_evlist__go_system_wide() helper +- platform/x86/intel-uncore-freq: Don't present root domain on error +- platform/x86/intel/tpmi: Handle error from tpmi_process_info() +- KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in CPUID +- x86/pci: Skip early E820 check for ECAM region +- x86/efistub: Omit physical KASLR when memory reservations exist +- ALSA: seq: ump: Fix swapped song position pointer data +- hwmon: (shtc1) Fix property misspelling +- hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board power sensor +- drm/panel: sitronix-st7789v: fix display size for jt240mhqs_hwt_ek_e3 panel +- drm/panel: sitronix-st7789v: tweak timing for jt240mhqs_hwt_ek_e3 panel +- drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3 panel +- powerpc/pseries/lparcfg: drop error message from guest name lookup +- ALSA: seq: Fix yet another spot for system message conversion +- ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound +- net: ena: Fix redundant device NUMA node override +- net: ena: Reduce lines with longer column width boundary +- net: dsa: microchip: fix RGMII error in KSZ DSA driver +- spi: stm32: Don't warn about spurious interrupts +- kheaders: use `command -v` to test for existence of `cpio` +- drm/i915/gt: Fix CCS id's calculation for CCS mode setting +- drm/i915/guc: avoid FIELD_PREP warning +- kconfig: fix comparison to constant symbols, 'm', 'n' +- net/sched: taprio: extend minimum interval restriction to entire cycle too +- net/sched: taprio: make q->picos_per_byte available to fill_sched_entry() +- netfilter: nft_fib: allow from forward/input without iif selector +- netfilter: tproxy: bail out if IP has been disabled on the device +- netfilter: nft_payload: skbuff vlan metadata mangle support +- net: ti: icssg-prueth: Fix start counter for ft1 filter +- ALSA: seq: Don't clear bank selection at event -> UMP MIDI2 conversion +- ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP conversion +- selftests: mptcp: join: mark 'fail' tests as flaky +- selftests: mptcp: add ms units for tc-netem delay +- selftests: mptcp: simult flows: mark 'unbalanced' tests as flaky +- ice: fix accounting if a VLAN already exists +- net: micrel: Fix lan8841_config_intr after getting out of sleep mode +- net:fec: Add fec_enet_deinit() +- ASoC: cs42l43: Only restrict 44.1kHz for the ASP +- net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM +- Octeontx2-pf: Free send queue buffers incase of leaf to inner +- af_unix: Read sk->sk_hash under bindlock during bind(). +- af_unix: Annotate data-race around unix_sk(sk)->addr. +- enic: Validate length of nl attributes in enic_set_vf_port +- ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp +- ALSA: core: Remove debugfs at disconnection +- ALSA: jack: Use guard() for locking +- bpf: Fix potential integer overflow in resolve_btfids +- net/mlx5e: Fix UDP GSO for encapsulated packets +- net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion +- net/mlx5e: Fix IPsec tunnel mode offload feature check +- net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules +- net/mlx5: Fix MTMP register capability offset in MCAM register +- net/mlx5: Lag, do bond only if slaves agree on roce state +- net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061 +- drm/amd/display: Enable colorspace property for MST connectors +- nvmet: fix ns enable/disable possible hang +- nvme-multipath: fix io accounting on failover +- nvme-tcp: add definitions for TLS cipher suites +- dma-mapping: benchmark: handle NUMA_NO_NODE correctly +- dma-mapping: benchmark: fix node id validation +- dma-mapping: benchmark: fix up kthread-related error handling +- kthread: add kthread_stop_put +- netfilter: nft_payload: restore vlan q-in-q match support +- netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() +- kasan, fortify: properly rename memintrinsics +- ice: Interpret .set_channels() input differently +- drivers/xen: Improve the late XenStore init protocol +- nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() +- net: relax socket state check at accept time. +- net: fec: avoid lock evasion when reading pps_enable +- Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI" +- i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame +- i3c: master: svc: return actual transfer data len +- i3c: master: svc: rename read_len as actual_len +- i3c: add actual_len in i3c_priv_xfer +- net: lan966x: Remove ptp traps in case the ptp is not enabled. +- rv: Update rv_en(dis)able_monitor doc to match kernel-doc +- openvswitch: Set the skbuff pkt_type for proper pmtud support. +- pNFS/filelayout: fixup pNfs allocation modes +- regulator: tps6594-regulator: Correct multi-phase configuration +- af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. +- regulator: tps6287x: Force writing VSEL bit +- regulator: pickable ranges: don't always cache vsel +- rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL +- sunrpc: fix NFSACL RPC retry on soft mount +- nfs: keep server info for remounts +- NFSv4: Fixup smatch warning for ambiguous return +- ASoC: tas2552: Add TX path for capturing AUDIO-OUT data +- nfc: nci: Fix uninit-value in nci_rx_work +- selftests: net: kill smcrouted in the cleanup logic in amt.sh +- ipv6: sr: fix missing sk_buff release in seg6_input_core +- net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled +- x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y +- perf/arm-dmc620: Fix lockdep assert in ->event_init() +- xen/x86: add extra pages to unpopulated-alloc if available +- regulator: bd71828: Don't overwrite runtime voltages +- blk-cgroup: Properly propagate the iostat update up the hierarchy +- blk-cgroup: fix list corruption from resetting io stat +- drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations +- nouveau: add an ioctl to report vram usage +- nouveau: add an ioctl to return vram bar size. +- ASoC: mediatek: mt8192: fix register configuration for tdm +- ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance +- ALSA: hda: cs35l56: Initialize all ASP1 registers +- ASoC: cs35l56: Fix to ensure ASP1 registers match cache +- null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION() +- ASoC: tas2781: Fix a warning reported by robot kernel test +- selftests/powerpc/dexcr: Add -no-pie to hashchk tests +- Revert "drm/bridge: ti-sn65dsi83: Fix enable error path" +- media: cec: core: avoid confusing "transmit timed out" message +- media: cec: core: avoid recursive cec_claim_log_addrs +- media: cec: cec-api: add locking in cec_release() +- media: cec: cec-adap: always cancel work in cec_transmit_msg_fh +- media: sunxi: a83-mips-csi2: also select GENERIC_PHY +- cxl/region: Fix cxlr_pmem leaks +- cxl/trace: Correct DPA field masks for general_media & dram events +- um: Fix the declaration of kasan_map_memory +- um: Fix the -Wmissing-prototypes warning for get_thread_reg +- um: Fix the -Wmissing-prototypes warning for __switch_mm +- powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp +- media: flexcop-usb: fix sanity check of bNumEndpoints +- platform/x86: thinkpad_acpi: Take hotkey_mutex during hotkey_exit() +- tools/arch/x86/intel_sdsi: Fix meter_certificate decoding +- tools/arch/x86/intel_sdsi: Fix meter_show display +- tools/arch/x86/intel_sdsi: Fix maximum meter bundle length +- media: mediatek: vcodec: fix possible unbalanced PM counter +- media: mediatek: vcodec: add encoder power management helper functions +- drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode() +- drm/amdgpu: init microcode chip name from ip versions +- Input: cyapa - add missing input core locking to suspend/resume functions +- drm/bridge: tc358775: fix support for jeida-18 and jeida-24 +- um: vector: fix bpfflash parameter evaluation +- um: Add winch to winch_handlers before registering winch IRQ +- um: Fix return value in ubd_init() +- drm/meson: gate px_clk when setting rate +- drm/mediatek: dp: Fix mtk_dp_aux_transfer return value +- drm/msm/dpu: Always flush the slave INTF on the CTL +- drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk +- media: ov2680: Do not fail if data-lanes property is absent +- media: ov2680: Allow probing if link-frequencies is absent +- media: ov2680: Clear the 'ret' variable on success +- media: v4l: Don't turn on privacy LED if streamon fails +- media: v4l2-subdev: Document and enforce .s_stream() requirements +- Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation +- mmc: sdhci_am654: Fix ITAPDLY for HS400 timing +- mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock +- mmc: sdhci_am654: Add OTAP/ITAP delay enable +- mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel +- mmc: sdhci_am654: Write ITAPDLY for DDR52 timing +- mmc: sdhci_am654: Add tuning algorithm for delay chain +- Input: ims-pcu - fix printf string overflow +- dt-bindings: adc: axi-adc: add clocks property +- dt-bindings: adc: axi-adc: update bindings for backend framework +- eventfs: Have "events" directory get permissions from its parent +- eventfs: Free all of the eventfs_inode after RCU +- eventfs/tracing: Add callback for release of an eventfs_inode +- eventfs: Create eventfs_root_inode to store dentry +- serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler +- serial: sc16is7xx: replace hardcoded divisor value with BIT() macro +- misc/pvpanic-pci: register attributes via pci_driver +- misc/pvpanic: deduplicate common code +- iio: accel: mxc4005: Reset chip on probe() and resume() +- iio: accel: mxc4005: allow module autoloading via OF compatible +- eventfs: Do not differentiate the toplevel events directory +- drm/amd/display: Revert Remove pixle rate limit for subvp +- drm/amd/display: Remove pixle rate limit for subvp +- dt-bindings: PCI: rockchip,rk3399-pcie: Add missing maxItems to ep-gpios +- s390/boot: Remove alt_stfle_fac_list from decompressor +- s390/ipl: Fix incorrect initialization of nvme dump block +- s390/ipl: Fix incorrect initialization of len fields in nvme reipl block +- s390/vdso: Use standard stack frame layout +- s390/vdso: Generate unwind information for C modules +- s390/vdso64: filter out munaligned-symbols flag for vdso +- LoongArch: Fix callchain parse error with kernel tracepoint events again +- perf tools: Add/use PMU reverse lookup from config to name +- perf tools: Use pmus to describe type from attribute +- perf pmu: "Compat" supports regular expression matching identifiers +- perf pmu: Move pmu__find_core_pmu() to pmus.c +- perf test: Add a test for strcmp_cpuid_str() expression +- perf stat: Don't display metric header for non-leader uncore events +- usb: fotg210: Add missing kernel doc description +- f2fs: fix to add missing iput() in gc_data_segment() +- perf daemon: Fix file leak in daemon_session__control +- libsubcmd: Fix parse-options memory leak +- serial: sh-sci: protect invalidating RXDMA on shutdown +- f2fs: fix to release node block count in error path of f2fs_new_node_page() +- f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock +- f2fs: compress: fix error path of inc_valid_block_count() +- f2fs: introduce get_available_block_count() for cleanup +- f2fs: deprecate io_bits +- f2fs: compress: fix to update i_compr_blocks correctly +- perf symbols: Fix ownership of string in dso__load_vmlinux() +- perf maps: Move symbol maps functions to maps.c +- perf thread: Fixes to thread__new() related to initializing comm +- perf report: Avoid SEGV in report__setup_sample_type() +- perf ui browser: Avoid SEGV on title +- f2fs: fix block migration when section is not aligned to pow2 +- f2fs: support file pinning for zoned devices +- f2fs: kill heap-based allocation +- f2fs: separate f2fs_gc_range() to use GC for a range +- f2fs: use BLKS_PER_SEG, BLKS_PER_SEC, and SEGS_PER_SEC +- f2fs: support printk_ratelimited() in f2fs_printk() +- f2fs: Clean up errors in segment.h +- PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 +- PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 +- dt-bindings: spmi: hisilicon,hisi-spmi-controller: fix binding references +- extcon: max8997: select IRQ_DOMAIN instead of depending on it +- perf ui browser: Don't save pointer to stack memory +- perf bench internals inject-build-id: Fix trap divide when collecting just one DSO +- i2c: synquacer: Fix an error handling path in synquacer_i2c_probe() +- i2c: cadence: Avoid fifo clear after start +- ppdev: Add an error check in register_device +- ppdev: Remove usage of the deprecated ida_simple_xx() API +- stm class: Fix a double free in stm_register_device() +- usb: gadget: u_audio: Clear uac pointer when freed. +- dt-bindings: phy: qcom,usb-snps-femto-v2: use correct fallback for sc8180x +- dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: fix msm899[68] power-domains +- watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe() +- watchdog: bd9576: Drop "always-running" property +- pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins regs +- dt-bindings: pinctrl: mediatek: mt7622: fix array properties +- VMCI: Fix an error handling path in vmci_guest_probe_device() +- ovl: remove upper umask handling from ovl_create_upper() +- leds: pwm: Disable PWM when going to suspend +- pwm: Rename pwm_apply_state() to pwm_apply_might_sleep() +- perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer) +- PCI: Wait for Link Training==0 before starting Link retrain +- microblaze: Remove early printk call from cpuinfo-static.c +- microblaze: Remove gcc flag for non existing early_printk.c file +- udf: Convert udf_expand_file_adinicb() to use a folio +- udf: Remove GFP_NOFS allocation in udf_expand_file_adinicb() +- i915: make inject_virtual_interrupt() void +- coresight: etm4x: Fix access to resource selector registers +- coresight: etm4x: Safe access for TRCQCLTR +- coresight: etm4x: Do not save/restore Data trace control registers +- coresight: etm4x: Do not hardcode IOMEM access for register restore +- iio: adc: adi-axi-adc: only error out in major version mismatch +- iio: adc: adi-axi-adc: move to backend framework +- iio: adc: ad9467: convert to backend framework +- iio: add the IIO backend framework +- iio: buffer-dmaengine: export buffer alloc and free functions +- iio: adc: adi-axi-adc: convert to regmap +- iio: adc: ad9467: use chip_info variables instead of array +- iio: adc: ad9467: use spi_get_device_match_data() +- iio: pressure: dps310: support negative temperature values +- perf test shell arm_coresight: Increase buffer size for Coresight basic tests +- perf docs: Document bpf event modifier +- coresight: etm4x: Fix unbalanced pm_runtime_enable() +- riscv: dts: starfive: visionfive 2: Remove non-existing TDM hardware +- iio: adc: stm32: Fixing err code to not indicate success +- f2fs: fix to check pinfile flag in f2fs_move_file_range() +- f2fs: fix to relocate check condition in f2fs_fallocate() +- f2fs: compress: fix to relocate check condition in f2fs_ioc_{,de}compress_file() +- f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks() +- perf bench uprobe: Remove lib64 from libc.so.6 binary path +- dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties +- dt-bindings: PCI: rcar-pci-host: Add optional regulators +- perf record: Fix debug message placement for test consumption +- perf record: Move setting tracking events before record__init_thread_masks() +- perf evlist: Add evlist__findnew_tracking_event() helper +- perf tests: Apply attributes to all events in object code reading test +- perf tests: Make "test data symbol" more robust on Neoverse N1 +- arm64: dts: meson: fix S4 power-controller node +- interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment +- module: don't ignore sysfs_create_link() failures +- serial: sc16is7xx: add proper sched.h include for sched_set_fifo() +- PCI: tegra194: Fix probe path for Endpoint mode +- greybus: arche-ctrl: move device table to its right location +- serial: max3100: Fix bitwise types +- serial: max3100: Update uart_driver_registered on driver removal +- perf annotate: Fix annotation_calc_lines() to pass correct address to get_srcline() +- perf annotate: Use global annotation_options +- perf top: Convert to the global annotation_options +- perf report: Convert to the global annotation_options +- perf annotate: Introduce global annotation_options +- perf annotate: Split branch stack cycles information out of 'struct annotation_line' +- perf machine thread: Remove exited threads by default +- perf record: Lazy load kernel symbols +- firmware: dmi-id: add a release callback function +- dmaengine: idma64: Add check for dma_set_max_seg_size +- soundwire: cadence: fix invalid PDI offset +- perf stat: Do not fail on metrics on s390 z/VM systems +- usb: typec: ucsi: simplify partner's PD caps registration +- usb: typec: ucsi: always register a link to USB PD device +- perf annotate: Get rid of duplicate --group option item +- counter: linux/counter.h: fix Excess kernel-doc description warning +- f2fs: fix to wait on page writeback in __clone_blkaddrs() +- phy: qcom: qmp-combo: fix duplicate return in qmp_v4_configure_dp_phy +- iio: core: Leave private pointer NULL when no private data supplied +- perf probe: Add missing libgen.h header needed for using basename() +- perf record: Delete session after stopping sideband thread +- sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level +- af_packet: do not call packet_read_pending() from tpacket_destruct_skb() +- net: qrtr: ns: Fix module refcnt +- selftests: net: bridge: increase IGMP/MLD exclude timeout membership interval +- tracing/user_events: Fix non-spaced field matching +- tracing/user_events: Prepare find/delete for same name events +- tracing/user_events: Allow events to persist for perfmon_capable users +- RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw +- RDMA/IPoIB: Fix format truncation compilation errors +- selftests/kcmp: remove unused open mode +- SUNRPC: Fix gss_free_in_token_pages() +- bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq +- RDMA/bnxt_re: Adds MSN table capability for Gen P7 adapters +- RDMA/bnxt_re: Update the HW interface definitions +- RDMA/bnxt_re: Remove roundup_pow_of_two depth for all hardware queue resources +- RDMA/bnxt_re: Refactor the queue index update +- ext4: remove the redundant folio_wait_stable() +- ext4: fix potential unnitialized variable +- sunrpc: removed redundant procp check +- ext4: avoid excessive credit estimate in ext4_tmpfile() +- x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and VPDPWSSDS +- x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map +- clk: qcom: mmcc-msm8998: fix venus clock issue +- clk: qcom: dispcc-sm8550: fix DisplayPort clocks +- clk: qcom: dispcc-sm6350: fix DisplayPort clocks +- clk: qcom: dispcc-sm8450: fix DisplayPort clocks +- lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure +- clk: renesas: r9a07g043: Add clock and reset entry for PLIC +- clk: renesas: r8a779a0: Fix CANFD parent clock +- IB/mlx5: Use __iowrite64_copy() for write combining stores +- RDMA/rxe: Fix incorrect rxe_put in error path +- RDMA/rxe: Allow good work requests to be executed +- clk: qcom: clk-alpha-pll: remove invalid Stromer register offset +- clk: rs9: fix wrong default value for clock amplitude +- clk: mediatek: mt8365-mm: fix DPI0 parent +- clk: mediatek: pllfh: Don't log error for missing fhctl node +- RDMA/mlx5: Adding remote atomic access flag to updatable flags +- RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent +- clk: samsung: exynosautov9: fix wrong pll clock id value +- media: cadence: csi2rx: configure DPHY before starting source stream +- drm/edid: Parse topology block for all DispID structure v1.x +- drm/rockchip: vop2: Do not divide height twice for YUV +- media: uvcvideo: Add quirk for Logitech Rally Bar +- drm/mipi-dsi: use correct return type for the DSC functions +- drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector +- drm/bridge: anx7625: Update audio status while detecting +- drm/panel: novatek-nt35950: Don't log an error when DSI host can't be found +- drm/bridge: dpc3433: Don't log an error when DSI host can't be found +- drm/bridge: tc358775: Don't log an error when DSI host can't be found +- drm/bridge: lt9611uxc: Don't log an error when DSI host can't be found +- drm/bridge: lt9611: Don't log an error when DSI host can't be found +- drm/bridge: lt8912b: Don't log an error when DSI host can't be found +- drm/bridge: icn6211: Don't log an error when DSI host can't be found +- drm/bridge: anx7625: Don't log an error when DSI host can't be found +- ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value +- drm: vc4: Fix possible null pointer dereference +- media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries +- fbdev: sh7760fb: allow modular build +- media: v4l2-subdev: Fix stream handling for crop API +- media: i2c: et8ek8: Don't strip remove function when driver is builtin +- media: dt-bindings: ovti,ov2680: Fix the power supply names +- media: ipu3-cio2: Request IRQ earlier +- drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected +- drm/msm/dp: allow voltage swing / pre emphasis of 3 +- media: radio-shark2: Avoid led_names truncations +- media: rcar-vin: work around -Wenum-compare-conditional warning +- media: ngene: Add dvb_ca_en50221_init return value check +- ASoC: Intel: avs: Test result of avs_get_module_entry() +- ASoC: Intel: avs: Fix potential integer overflow +- ASoC: Intel: avs: Fix ASRC module initialization +- selftests: cgroup: skip test_cgcore_lesser_ns_open when cgroup2 mounted without nsdelegate +- fbdev: sisfb: hide unused variables +- ASoC: SOF: Intel: mtl: Implement firmware boot state check +- ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed +- ASoC: SOF: Intel: mtl: call dsp dump when boot retry fails +- ASoC: SOF: Intel: lnl: Correct rom_status_reg +- ASoC: SOF: Intel: mtl: Correct rom_status_reg +- ASoC: SOF: Intel: pci-mtl: fix ARL-S definitions +- ASoC: SOF: Intel: pci-mtl: use ARL specific firmware definitions +- ASoC: Intel: common: add ACPI matching tables for Arrow Lake +- powerpc/fsl-soc: hide unused const variable +- drm/meson: vclk: fix calculation of 59.94 fractional rates +- ASoC: kirkwood: Fix potential NULL dereference +- fbdev: shmobile: fix snprintf truncation +- mtd: rawnand: hynix: fixed typo +- mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add() +- ASoC: Intel: avs: ssm4567: Do not ignore route checks +- ASoC: Intel: Disable route checks for Skylake boards +- drm/amd/display: Fix potential index out of bounds in color transformation function +- drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't assert +- drm/dp: Don't attempt AUX transfers when eDP panels are not powered +- drm/lcdif: Do not disable clocks on already suspended hardware +- dev_printk: Add and use dev_no_printk() +- printk: Let no_printk() use _printk() +- drm/omapdrm: Fix console with deferred ops +- fbdev: Provide I/O-memory helpers as module +- drm/omapdrm: Fix console by implementing fb_dirty +- drm/ci: update device type for volteer devices +- drm/ci: add subset-1-gfx to LAVA_TAGS and adjust shards +- drm/ci: uprev mesa version: fix container build & crosvm +- drm/bridge: Fix improper bridge init order with pre_enable_prev_first +- Bluetooth: qca: Fix error code in qca_read_fw_build_info() +- Bluetooth: compute LE flow credits based on recvbuf space +- net: micrel: Fix receiving the timestamp in the frame for lan8841 +- mptcp: SO_KEEPALIVE: fix getsockopt support +- riscv, bpf: make some atomic operations fully ordered +- s390/bpf: Emit a barrier for BPF_FETCH instructions +- net/mlx5: Reload only IB representors upon lag disable/enable +- net/mlx5: Enable 4 ports multiport E-switch +- ipv6: sr: fix invalid unregister error path +- ipv6: sr: fix incorrect unregister order +- ipv6: sr: add missing seg6_local_exit +- net: usb: smsc95xx: stop lying about skb->truesize +- net: ethernet: cortina: Locking fixes +- selftests: net: move amt to socat for better compatibility +- selftests: net: add missing config for amt.sh +- selftests: net: add more missing kernel config +- net: ipv6: fix wrong start position when receive hop-by-hop fragment +- m68k: mac: Fix reboot hang on Mac IIci +- m68k: Fix spinlock race in kernel thread creation +- net: usb: sr9700: stop lying about skb->truesize +- usb: aqc111: stop lying about skb->truesize +- HID: amd_sfh: Handle "no sensors" in PM operations +- wifi: mwl8k: initialize cmd->addr[] properly +- scsi: qla2xxx: Fix debugfs output for fw_resource_count +- scsi: bfa: Ensure the copied buf is NUL terminated +- HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors +- selftests/bpf: Fix pointer arithmetic in test_xdp_do_redirect +- kunit: Fix kthread reference +- selftests: default to host arch for LLVM builds +- selftests/resctrl: fix clang build failure: use LOCAL_HDRS +- selftests/binderfs: use the Makefile's rules, not Make's implicit rules +- libbpf: Fix error message in attach_kprobe_multi +- wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset +- wifi: mt76: mt7603: fix tx queue of loopback packets +- Revert "sh: Handle calling csum_partial with misaligned data" +- sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe() +- wifi: ar5523: enable proper endpoint verification +- net: give more chances to rcu in netdev_wait_allrefs_any() +- pwm: sti: Simplify probe function using devm functions +- pwm: sti: Prepare removing pwm_chip from driver data +- tcp: avoid premature drops in tcp_add_backlog() +- net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on 88E6250-family switches +- net: dsa: mv88e6xxx: Add support for model-specific pre- and post-reset handlers +- wifi: ath10k: populate board data for WCN3990 +- cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations +- scsi: ufs: core: mcq: Fix ufshcd_mcq_sqe_search() +- selftests/bpf: Fix a fd leak in error paths in open_netns +- gfs2: do_xmote fixes +- gfs2: finish_xmote cleanup +- gfs2: Rename gfs2_withdrawn to gfs2_withdrawing_or_withdrawn +- gfs2: Mark withdraws as unlikely +- gfs2: Rename gfs2_lookup_{ simple => meta } +- gfs2: Convert gfs2_internal_read to folios +- gfs2: Get rid of gfs2_alloc_blocks generation parameter +- wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() +- dt-bindings: thermal: loongson,ls2k-thermal: Fix incorrect compatible definition +- dt-bindings: thermal: loongson,ls2k-thermal: Add Loongson-2K0500 compatible +- dt-bindings: thermal: loongson,ls2k-thermal: Fix binding check issues +- thermal/drivers/tsens: Fix null pointer dereference +- x86/purgatory: Switch to the position-independent small code model +- scsi: hpsa: Fix allocation size for Scsi_Host private data +- scsi: libsas: Fix the failure of adding phy with zero-address to port +- udp: Avoid call to compute_score on multiple sites +- x86/pat: Fix W^X violation false-positives when running as Xen PV guest +- x86/pat: Restructure _lookup_address_cpa() +- x86/pat: Introduce lookup_address_in_pgd_attr() +- cpufreq: exit() callback is optional +- tcp: increase the default TCP scaling ratio +- selftests/bpf: Fix umount cgroup2 error in test_sockmap +- x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57 +- gfs2: Fix "ignore unlock failures after withdraw" +- gfs2: Don't forget to complete delayed withdraw +- ACPI: disable -Wstringop-truncation +- irqchip/loongson-pch-msi: Fix off-by-one on allocation error path +- irqchip/alpine-msi: Fix off-by-one in allocation error path +- locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128() +- ACPI: LPSS: Advertise number of chip selects via property +- scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL +- scsi: ufs: core: Perform read back after disabling interrupts +- scsi: ufs: core: Perform read back after writing UTP_TASK_REQ_LIST_BASE_H +- scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV +- scsi: ufs: qcom: Perform read back after writing CGC enable +- scsi: ufs: qcom: Perform read back after writing unipro mode +- scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US +- scsi: ufs: qcom: Perform read back after writing reset bit +- bpf: prevent r10 register from being marked as precise +- bpf: Pack struct bpf_fib_lookup +- bpftool: Mount bpffs on provided dir instead of parent dir +- wifi: carl9170: re-fix fortified-memset warning +- dlm: fix user space lock decision to copy lvb +- bitops: add missing prototype check +- mlx5: stop warning for 64KB pages +- mlx5: avoid truncating error message +- qed: avoid truncating work queue length +- enetc: avoid truncating error message +- ACPI: Fix Generic Initiator Affinity _OSC bit +- sched/fair: Add EAS checks before updating root_domain::overutilized +- wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask +- wifi: iwlwifi: reconfigure TLC during HW restart +- wifi: iwlwifi: mvm: select STA mask only for active links +- wifi: iwlwifi: mvm: allocate STA links only for active links +- wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok() +- x86/boot: Ignore relocations in .notes sections in walk_relocs() too +- wifi: mt76: mt7915: workaround too long expansion sparse warnings +- wifi: ath12k: use correct flag field for 320 MHz channels +- bpftool: Fix missing pids during link show +- wifi: ath11k: don't force enable power save on non-running vdevs +- wifi: brcmfmac: pcie: handle randbuf allocation failure +- wifi: ath10k: poll service ready message before failing +- block: fix and simplify blkdevparts= cmdline parsing +- lkdtm: Disable CFI checking for perms functions +- soc: qcom: pmic_glink: Make client-lock non-sleeping +- null_blk: Fix missing mutex_destroy() at module removal +- soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE +- firmware: qcom: scm: Fix __scm and waitq completion variable initialization +- soc: qcom: pmic_glink: notify clients about the current state +- soc: qcom: pmic_glink: don't traverse clients list without a lock +- s390/mm: Re-enable the shared zeropage for !PV and !skeys KVM guests +- mm/userfaultfd: Do not place zeropages when zeropages are disallowed +- io-wq: write next_work before dropping acct_lock +- ARM: configs: sunxi: Enable DRM_DW_HDMI +- io_uring: use the right type for work_llist empty check +- s390/cio: fix tracepoint subchannel type field +- crypto: x86/sha512-avx2 - add missing vzeroupper +- crypto: x86/sha256-avx2 - add missing vzeroupper +- crypto: x86/nh-avx2 - add missing vzeroupper +- crypto: ccp - drop platform ifdef checks +- parisc: add missing export of __cmpxchg_u8() +- nilfs2: fix out-of-range warning +- firmware: raspberrypi: Use correct device for DMA mappings +- mm/slub, kunit: Use inverted data to corrupt kmem cache +- openpromfs: finish conversion to the new mount API +- nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists() +- ksmbd: fix uninitialized symbol 'share' in smb2_tree_connect() +- epoll: be better about file lifetimes +- nvmet: fix nvme status code when namespace is disabled +- nvmet-tcp: fix possible memory leak when tearing down a controller +- nvme: cancel pending I/O if nvme controller is in terminal state +- nvmet-auth: replace pr_debug() with pr_err() to report an error. +- nvmet-auth: return the error code to the nvmet_auth_host_hash() callers +- nvme: find numa distance only if controller has valid numa id +- drm/amdkfd: Flush the process wq before creating a kfd_process +- drm/amd/display: Disable seamless boot on 128b/132b encoding +- drm/amd/display: Fix DC mode screen flickering on DCN321 +- drm/amd/display: Add VCO speed parameter for DCN31 FPU +- drm/amd/display: Allocate zero bw after bw alloc enable +- drm/amd/display: Add dtbclk access to dcn315 +- drm/amdgpu: Fix VRAM memory accounting +- ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection +- ASoC: da7219-aad: fix usage of device_get_named_child_node() +- platform/x86: ISST: Add Grand Ridge to HPM CPU list +- softirq: Fix suspicious RCU usage in __do_softirq() +- ALSA: emu10k1: make E-MU FPGA writes potentially more reliable +- bpf, x86: Fix PROBE_MEM runtime load check +- fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card +- Input: xpad - add support for ASUS ROG RAIKIRI +- KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF +- ASoC: rt715-sdca: volume step modification +- ASoC: rt715: add vendor clear control register +- ASoC: cs35l41: Update DSP1RX5/6 Sources for DSP config +- regulator: vqmmc-ipq4019: fix module autoloading +- regulator: qcom-refgen: fix module autoloading +- ASoC: rt722-sdca: add headset microphone vrefo setting +- ASoC: rt722-sdca: modify channel number to support 4 channels +- ASoC: dt-bindings: rt5645: add cbj sleeve gpio property +- ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating +- ASoC: acp: Support microphone from device Acer 315-24p +- ASoC: SOF: pcm: Restrict DSP D0i3 during S0ix to IPC3 +- ALSA: hda: cs35l56: Exit cache-only after cs35l56_wait_for_firmware_boot() +- regulator: irq_helpers: duplicate IRQ name +- ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too +- sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU +- selftests: sud_test: return correct emulated syscall value on RISC-V +- drm/etnaviv: fix tx clock gating on some GC7000 variants +- LoongArch: Lately init pmu after smp is online +- cpu: Ignore "mitigations" kernel parameter if CPU_MITIGATIONS=n +- drm/amdgpu: Fix the ring buffer size for queue VM flush +- drm/amdkfd: Add VRAM accounting for SVM migration +- drm/amd/pm: Restore config space after reset +- drm/amdgpu: Update BO eviction priorities +- drm/amd/display: Set color_mgmt_changed to true on unsuspend +- net: usb: qmi_wwan: add Telit FN920C04 compositions +- HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is enabled +- dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node +- wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class +- wifi: mac80211: ensure beacon is non-S1G prior to extracting the beacon timestamp field +- wifi: mac80211: don't use rate mask for scanning +- KEYS: asymmetric: Add missing dependency on CRYPTO_SIG +- ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 440/460 G11. +- ksmbd: ignore trailing slashes in share paths +- ksmbd: avoid to send duplicate oplock break notifications +- fs/ntfs3: Break dir enumeration if directory contents error +- fs/ntfs3: Fix case when index is reused during tree transformation +- fs/ntfs3: Taking DOS names into account during link counting +- fs/ntfs3: Remove max link count info display during driver init +- net: smc91x: Fix m68k kernel compilation for ColdFire CPU +- net: lan966x: remove debugfs directory in probe() error path +- net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe() +- tools/nolibc/stdlib: fix memory error in realloc() +- tools/latency-collector: Fix -Wformat-security compile warns +- net: mana: Fix the extra HZ in mana_hwc_send_request +- Revert "r8169: don't try to disable interrupts if NAPI is, scheduled already" +- io_uring: fail NOP if non-zero op flags is passed in +- Input: try trimming too long modalias strings +- serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup +- serial: 8250_bcm7271: use default_mux_rate if possible +- tty: n_gsm: fix missing receive state reset after mode switch +- selftests/ftrace: Fix BTFARG testcase to check fprobe is enabled correctly +- x86/tsc: Trust initial offset in architectural TSC-adjust MSRs +- !10398 BMA: Fix DMA reset problem and change the version +- BMA/kbox_drv: Change the version number. +- BMA/veth_drv: Change the version number. +- BMA/cdev_drv: Change the version number. +- BMA/edma_drv: Fix DMA reset problem and change the version number. +- !10358 jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error +- jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error +- !10344 CVE-2024-39471 +- drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() +- drm/amdgpu: add error handle to avoid out-of-bounds +- !9904 ext4: improve buffered write with more than one blocks_per_folio +- ext4: improve sub-polio check in ext4_iomap_write_begin() +- iomap: add iomap_is_fully_dirty() +- iomap: correct the dirty length in page mkwrite +- iomap: advance the ifs allocation if we have more than one blocks per folio +- iomap: support invalidating partial folios +- iomap: correct the range of a partial dirty clear +- !9533 net/mlx5: Add a timeout to acquire the command queue semaphore +- net/mlx5: Add a timeout to acquire the command queue semaphore +- !10317 improve dump_page() robustness +- mm: improve dumping of mapcount and page_type +- mm: add __dump_folio() +- fs: improve dump_mapping() robustness +- !9361 macintosh/via-macii: Fix "BUG: sleeping function called from invalid context" +- macintosh/via-macii: Fix "BUG: sleeping function called from invalid context" +- !9892 support for SMC-D loopback_lo feature +- net/smc: enable the smc-lo on the x86 and arm64 platforms +- net/smc: implement DMB-merged operations of loopback-ism +- net/smc: adapt cursor update when sndbuf and peer DMB are merged +- net/smc: {at|de}tach sndbuf to peer DMB if supported +- net/smc: add operations to merge sndbuf with peer DMB +- net/smc: register loopback-ism into SMC-D device list +- net/smc: ignore loopback-ism when dumping SMC-D devices +- net/smc: mark optional smcd_ops and check for support when called +- net/smc: implement DMB-related operations of loopback-ism +- net/smc: implement ID-related operations of loopback-ism +- net/smc: introduce loopback-ism for SMC intra-OS shortcut +- net/smc: decouple ism_client from SMC-D DMB registration +- net/smc: change the term virtual ISM to Emulated-ISM +- net/smc: fix incorrect SMC-D link group matching logic +- net/smc: manage system EID in SMC stack instead of ISM driver +- net/smc: support extended GID in SMC-D lgr netlink attribute +- net/smc: compatible with 128-bits extended GID of virtual ISM device +- net/smc: define a reserved CHID range for virtual ISM devices +- net/smc: introduce virtual ISM device support feature +- net/smc: support SMCv2.x supplemental features negotiation +- net/smc: unify the structs of accept or confirm message for v1 and v2 +- net/smc: introduce sub-functions for smc_clc_send_confirm_accept() +- net/smc: rename some 'fce' to 'fce_v2x' for clarity +- !10171 netrom: Fix a memory leak in nr_heartbeat_expiry() +- netrom: Fix a memory leak in nr_heartbeat_expiry() +- !10312 bpf: Fix too early release of tcx_entry +- bpf: Fix too early release of tcx_entry +- !10170 x86: resctrl: Fix illegal access by the chips not having RDT +- x86: resctrl: Fix illegal access by the chips not having RDT +- !10311 wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects +- wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects +- !10254 fbdev: savage: Handle err return when savagefb_check_var failed +- fbdev: savage: Handle err return when savagefb_check_var failed +- !10078 bpf: Set run context for rawtp test_run callback +- bpf: Set run context for rawtp test_run callback +- !10261 batman-adv: bypass empty buckets in batadv_purge_orig_ref() +- batman-adv: bypass empty buckets in batadv_purge_orig_ref() +- !10066 serial: imx: Introduce timeout when waiting on transmitter empty +- serial: imx: Introduce timeout when waiting on transmitter empty +- !9971 KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() +- KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() + +' for pr_err +* Wed Jul 24 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-35.0.0.43 +- !9782 usb-storage: alauda: Check whether the media is initialized +- usb-storage: alauda: Check whether the media is initialized +- !10294 [OLK-6.6] drivers: Fix compile warning "argument used uninitialized" +- drivers: Fix compile warning "argument used uninitialized" +- !10257 media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control() +- media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control() +- !10287 CVE-2024-36979 +- net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state +- net: bridge: mst: fix suspicious rcu usage in br_mst_set_state +- net: bridge: mst: fix vlan use-after-free +- !10018 ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty() +- ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty() +- !9985 btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes +- btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes +- !10260 [RoCE]从社区回合patch到openEuler（OLK-6.6） +- RDMA/hns: Fix mbx timing out before CMD execution is completed +- RDMA/hns: Fix insufficient extend DB for VFs. +- RDMA/hns: Fix undifined behavior caused by invalid max_sge +- RDMA/hns: Fix shift-out-bounds when max_inline_data is 0 +- RDMA/hns: Fix missing pagesize and alignment check in FRMR +- RDMA/hns: Fix unmatch exception handling when init eq table fails +- RDMA/hns: Check atomic wr length +- !10248 ssb: Fix potential NULL pointer dereference in ssb_device_uevent() +- ssb: Fix potential NULL pointer dereference in ssb_device_uevent() +- !9243 Bluetooth: RFCOMM: Fix not validating setsockopt user input +- Bluetooth: RFCOMM: Fix not validating setsockopt user input +- !10160 fix CVE-2024-40915 +- riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context +- !10264 mm: filemap: optimize semantic when thp_exec_enabled is set to 3 +- mm: filemap: optimize semantic when thp_exec_enabled is set to 3 +- !5264 [OLK-6.6]HYGON: Support CSV Reuse ASID feature on Hygon CPUs +- KVM: SVM: Add support for different CSV guests to reuse the same ASID +- !10231 fix CVE-2024-41007 +- tcp: avoid too many retransmit packets +- tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() +- !10233 fpga: bridge: add owner module and take its refcount +- fpga: bridge: add owner module and take its refcount +- !10237 ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger() +- ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger() +- !9915 powerpc/pseries: Enforce hcall result buffer validity and size +- powerpc/pseries: Enforce hcall result buffer validity and size +- !10148 fs/9p: fix uninitialized values during inode evict +- fs/9p: fix uninitialized values during inode evict +- !10056 io_uring/rsrc: don't lock while !TASK_RUNNING +- io_uring/rsrc: don't lock while !TASK_RUNNING +- !10226 cxl/region: Fix memregion leaks in devm_cxl_add_region() +- cxl/region: Fix memregion leaks in devm_cxl_add_region() +- !10177 ima: Fix use-after-free on a dentry's dname.name +- ima: Fix use-after-free on a dentry's dname.name +- !5262 [OLK-6.6]HYGON: Support Hygon DCU passthrough to VMs +- x86/config: Set CONFIG_HYDCU_FIXUP_HEADER=y by default +- drm/hygon: Add support to passthrough Hygon DCU to virtual machine +- !10220 bpf: Fix overrunning reservations in ringbuf +- bpf: Fix overrunning reservations in ringbuf +- !10219 CVE-2024-35931 +- drm/amdgpu: Skip do PCI error slot reset during RAS recovery +- drm/amdgpu : Add hive ras recovery check +- !10167 CVE-2024-36022 +- drm/amdgpu: Init zone device and drm client after mode-1 reset on reload +- drm/amdgpu: move the drm client creation behind drm device registration +- drm/amdkfd: init drm_client with funcs hook +- drm/amdkfd: Export DMABufs from KFD using GEM handles +- !9598 fpga: manager: add owner module and take its refcount +- fpga: manager: add owner module and take its refcount +- !10139 [sync] PR-10095: CVE-2024-40968 +- MIPS: Octeon: Add PCIe link status check +- !10044 btrfs: fix CVE-2024-39496 +- btrfs: zoned: fix use-after-free due to race with dev replace +- btrfs: zoned: factor out DUP bg handling from btrfs_load_block_group_zone_info +- btrfs: zoned: factor out single bg handling from btrfs_load_block_group_zone_info +- btrfs: zoned: factor out per-zone logic from btrfs_load_block_group_zone_info +- btrfs: zoned: introduce a zone_info struct in btrfs_load_block_group_zone_info +- !10114 v2 ecryptfs: Fix buffer size for tag 66 packet +- ecryptfs: Fix buffer size for tag 66 packet +- !10133 ALSA: timer: Set lower bound of start tick time +- ALSA: timer: Set lower bound of start tick time +- !10115 efi/unaccepted: touch soft lockup during memory accept +- efi/unaccepted: touch soft lockup during memory accept +- !10131 kunit/fortify: Fix mismatched kvalloc()/vfree() usage +- kunit/fortify: Fix mismatched kvalloc()/vfree() usage +- !10132 wifi: ath12k: fix out-of-bound access of qmi_invoke_handler() +- wifi: ath12k: fix out-of-bound access of qmi_invoke_handler() +- !10188 Part of "mm: mapcount for large folios + page_mapcount() cleanups" +- mm/rmap: add fast-path for small folios when adding/removing/duplicating +- mm/rmap: always inline anon/file rmap duplication of a single PTE +- mm: allow for detecting underflows with page_mapcount() again +- !10001 tty: n_gsm: fix possible out-of-bounds in gsm0_receive() +- tty: n_gsm: fix possible out-of-bounds in gsm0_receive() +- !10176 f2fs: compress: don't allow unaligned truncation on released compress inode +- f2fs: compress: don't allow unaligned truncation on released compress inode +- !10106 platform/x86: x86-android-tablets: Unregister devices in reverse order +- platform/x86: x86-android-tablets: Unregister devices in reverse order +- !10109 tracing: Build event generation tests only as modules +- tracing: Build event generation tests only as modules +- !10166 drop_monitor: replace spin_lock by raw_spin_lock +- drop_monitor: replace spin_lock by raw_spin_lock +- !10161 RDMA/mlx5: Add check for srq max_sge attribute +- RDMA/mlx5: Add check for srq max_sge attribute +- !10111 drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found +- drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found +- !10155 wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() +- wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() +- !10149 mips: bmips: BCM6358: make sure CBR is correctly set +- mips: bmips: BCM6358: make sure CBR is correctly set +- !10103 v2 fpga: region: add owner module and take its refcount +- fpga: region: add owner module and take its refcount +- !10097 [sync] PR-9741: scsi: qedf: Ensure the copied buf is NUL terminated +- scsi: qedf: Ensure the copied buf is NUL terminated +- !10021 drm/exynos/vidi: fix memory leak in .get_modes() +- drm/exynos/vidi: fix memory leak in .get_modes() +- !10127 wifi: iwlwifi: mvm: don't read past the mfuart notifcation +- wifi: iwlwifi: mvm: don't read past the mfuart notifcation +- !10117 wifi: iwlwifi: mvm: check n_ssids before accessing the ssids +- wifi: iwlwifi: mvm: check n_ssids before accessing the ssids +- !10116 wifi: mt76: mt7921s: fix potential hung tasks during chip recovery +- wifi: mt76: mt7921s: fix potential hung tasks during chip recovery +- !10017 liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet +- liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet +- !10051 tipc: force a dst refcount before doing decryption +- tipc: force a dst refcount before doing decryption +- !10102 vmxnet3: disable rx data ring on dma allocation failure +- vmxnet3: disable rx data ring on dma allocation failure +- !10093 drm/arm/malidp: fix a possible null pointer dereference +- drm/arm/malidp: fix a possible null pointer dereference +- !9989 io_uring/io-wq: Use set_bit() and test_bit() at worker->flags +- io_uring/io-wq: Use set_bit() and test_bit() at worker->flags +- !10083 CVE-2024-40955 +- ext4: clean up s_mb_rb_lock to fix build warnings with C=1 +- ext4: set the type of max_zeroout to unsigned int to avoid overflow +- ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow +- ext4: add positive int attr pointer to avoid sysfs variables overflow +- ext4: add new attr pointer attr_mb_order +- ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists() +- ext4: refactor out ext4_generic_attr_show() +- ext4: refactor out ext4_generic_attr_store() +- ext4: avoid overflow when setting values via sysfs +- !10069 ALSA: Fix deadlocks with kctl removals at disconnection +- ALSA: Fix deadlocks with kctl removals at disconnection +- !10074 PCI: of_property: Return error for int_map allocation failure +- PCI: of_property: Return error for int_map allocation failure +- !10087 fix CVE-2024-40995 +- net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() +- net/sched: act_api: rely on rcu in tcf_idr_check_alloc +- !10064 net/mlx5: Always stop health timer during driver removal +- net/mlx5: Always stop health timer during driver removal +- !9240 v2 cachefiles: introduce failover mechanism +- cachefiles: make on-demand read killable +- cachefiles: flush all requests after setting CACHEFILES_DEAD +- cachefiles: Set object to close if ondemand_id < 0 in copen +- cachefiles: defer exposing anon_fd until after copy_to_user() succeeds +- cachefiles: never get a new anonymous fd if ondemand_id is valid +- cachefiles: add spin_lock for cachefiles_ondemand_info +- cachefiles: add consistency check for copen/cread +- cachefiles: remove err_put_fd label in cachefiles_ondemand_daemon_read() +- cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() +- cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd() +- cachefiles: remove requests from xarray during flushing requests +- cachefiles: add output string to cachefiles_obj_[get|put]_ondemand_fd +- cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode +- cachefiles: add restore command to recover inflight ondemand read requests +- cachefiles: narrow the scope of triggering EPOLLIN events in ondemand mode +- cachefiles: resend an open request if the read request's object is closed +- cachefiles: extract ondemand info field from cachefiles_object +- cachefiles: introduce object ondemand state +- !9933 nvdimm: Backport some bugfixs +- dax: alloc_dax() return ERR_PTR(-EOPNOTSUPP) for CONFIG_DAX=n +- nvdimm/pmem: fix leak on dax_add_host() failure +- !10038 media: v4l: async: Properly re-initialise notifier entry in unregister +- media: v4l: async: Properly re-initialise notifier entry in unregister +- !9970 CVE-2024-39503 +- netfilter: ipset: Fix suspicious rcu_dereference_protected() +- netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type +- netfilter: ipset: Add list flush to cancel_gc +- !10011 xfs: fix mount hung while sb recover fail +- xfs: fix mount hung while sb recover fail +- !10050 vmci: prevent speculation leaks by sanitizing event in event_deliver() +- vmci: prevent speculation leaks by sanitizing event in event_deliver() +- !10006 drm/amdgpu: fix UBSAN warning in kv_dpm.c +- drm/amdgpu: fix UBSAN warning in kv_dpm.c +- !9959 parisc: Try to fix random segmentation faults in package builds +- parisc: Try to fix random segmentation faults in package builds +- !10028 ipv6: prevent possible NULL dereference in rt6_probe() +- ipv6: prevent possible NULL dereference in rt6_probe() +- !10005 seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors +- seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors + +* Wed Jul 17 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-34.0.0.42 +- Remove mlx5 related API from kabi whitelist + +* Wed Jul 17 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-34.0.0.41 +- !10059 nilfs2: fix use-after-free of timer for log writer thread +- nilfs2: fix use-after-free of timer for log writer thread +- !10025 9p: add missing locking around taking dentry fid list +- 9p: add missing locking around taking dentry fid list +- !9835 fix CVE-2024-39479 +- drm/i915/hwmon: Get rid of devm +- !9998 ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup +- ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup +- !9997 openrisc: traps: Don't send signals to kernel mode threads +- openrisc: traps: Don't send signals to kernel mode threads +- !9956 drm/komeda: check for error-valued pointer +- drm/komeda: check for error-valued pointer +- !9914 arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY +- arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY +- !9944 f2fs: remove clear SB_INLINECRYPT flag in default_options +- f2fs: remove clear SB_INLINECRYPT flag in default_options +- !9909 sock_map: avoid race between sock_map_close and sk_psock_put +- sock_map: avoid race between sock_map_close and sk_psock_put +- !10045 misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe() +- misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe() +- !10055 media: v4l: async: Fix notifier list entry init +- media: v4l: async: Fix notifier list entry init +- !9900 ipv6: fix possible race in __fib6_drop_pcpu_from() +- ipv6: fix possible race in __fib6_drop_pcpu_from() +- !9979 CVE-2024-40972 +- ext4: do not create EA inode under buffer lock +- ext4: fold quota accounting into ext4_xattr_inode_lookup_create() +- !9988 netpoll: Fix race condition in netpoll_owner_active +- netpoll: Fix race condition in netpoll_owner_active +- !9945 ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." +- ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." +- !9935 ALSA: hda: cs35l41: Possible null pointer dereference in cs35l41_hda_unbind() +- ALSA: hda: cs35l41: Possible null pointer dereference in cs35l41_hda_unbind() +- !9962 iommu/arm-smmu-v3: Change the style to identify the the hisi_platform +- iommu/arm-smmu-v3: Change the style to identify the the hisi_platform +- !9896 bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() +- bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() +- !9928 ocfs2: fix races between hole punching and AIO+DIO +- ocfs2: fix races between hole punching and AIO+DIO +- !9938 fix CVE-2024-40934 +- HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode() +- !9899 ionic: fix use after netif_napi_del() +- ionic: fix use after netif_napi_del() +- !9898 cpufreq: amd-pstate: fix memory leak on CPU EPP exit +- cpufreq: amd-pstate: fix memory leak on CPU EPP exit +- !9903 mptcp: ensure snd_una is properly initialized on connect +- mptcp: ensure snd_una is properly initialized on connect +- !9878 CVE-2024-39478 +- crypto: starfive - Do not free stack buffer +- !9888 ipv6: sr: fix memleak in seg6_hmac_init_algo +- ipv6: sr: fix memleak in seg6_hmac_init_algo +- !5261 [OLK-6.6]Hygon: Some enhancement and bugfixes for HYGON CSV/CSV2 +- KVM: SVM: Unmap ghcb pages if they're still mapped when destroy guest +- KVM: x86: Fix KVM_GET_MSRS stack info leak +- KVM: SEV: Do not intercept accesses to MSR_IA32_XSS for SEV-ES guests +- x86/head/64: Flush caches for .bss..decrypted section after CR3 switches to early_top_pgt +- KVM: x86: Calls is_64_bit_hypercall() instead of is_64_bit_mode() in complete_hypercall_exit() +- x86/csv2: Keep in atomic context when holding ghcb page if the #VC comes from userspace +- KVM: SVM: Fix the available ASID range for CSV2 guest +- !9861 MPTCP Upstream part 13 +- selftests: mptcp: lib: catch duplicated subtest entries +- selftests: mptcp: explicitly trigger the listener diag code-path +- bpf, btf: Add check_btf_kconfigs helper +- bpf, btf: Fix return value of register_btf_id_dtor_kfuncs +- !9876 v3 Fix xfs file creation issue +- xfs: Avoid races with cnt_btree lastrec updates +- Revert "xfs: Fix file creation failure" +- !9877 gfs2: Fix potential glock use-after-free on unmount +- gfs2: Fix potential glock use-after-free on unmount +- !9862 ipvlan: Modify the value of ipvlan modes +- ipvlan: Modify the value of ipvlan modes +- !5260 [OLK-6.6] Support live migration for CSV/CSV2 guest, and support rebooting CSV/CSV2 guest +- KVM: SVM: Force flush caches before reboot CSV guest +- KVM: SVM: Add support for rebooting CSV2 guest +- KVM: x86: Introduce control_{pre,post}_system_reset ioctl interfaces +- KVM: SVM: Export MSR_AMD64_SEV_ES_GHCB to userspace for CSV2 guest +- KVM: x86: Restore control registers in __set_sregs() to support CSV2 guest live migration +- KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_VMSA command +- KVM: SVM: Add KVM_SEV_SEND_UPDATE_VMSA command +- crypto: ccp: Fix definition of struct sev_data_send_update_vmsa +- KVM: SVM: Add RECEIVE_UPDATE_DATA command helper to support KVM_CSV_COMMAND_BATCH +- KVM: SVM: Add SEND_UPDATE_DATA command helper to support KVM_CSV_COMMAND_BATCH +- KVM: SVM: Prepare memory pool to allocate buffers for KVM_CSV_COMMAND_BATCH +- KVM: SVM: Add KVM_CSV_COMMAND_BATCH command for applying CSV RING_BUFFER mode +- crypto: ccp: Add support for issue commands in CSV RING_BUFFER mode +- crypto: ccp: Add support to switch to CSV RING_BUFFER mode +- crypto: ccp: Add support for dequeue status in CSV RING_BUFFER mode +- crypto: ccp: Add support for enqueue command pointers in CSV RING_BUFFER mode +- crypto: ccp: Introduce init and free helpers to manage CSV RING_BUFFER queues +- !9294 Compiler: Add clang's PGO support for kernel. +- Compiler: Add clang's PGO support for kernel. +- !9610 rcu: Fix buffer overflow in print_cpu_stall_info() +- rcu: Fix buffer overflow in print_cpu_stall_info() +- !9845 xfs: fix log recovery buffer allocation for the legacy h_size fixup +- xfs: fix log recovery buffer allocation for the legacy h_size fixup +- !9859 block: enable BLK_IO_HUNG_TASK_CHECK by default +- block: enable BLK_IO_HUNG_TASK_CHECK by default +- !9857 drm/amdgpu/mes: fix use-after-free issue +- drm/amdgpu/mes: fix use-after-free issue +- !9829 fix CVE-2024-38620 +- Bluetooth: fix connection setup in l2cap_connect +- Bluetooth: HCI: Remove HCI_AMP support +- Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS +- Bluetooth: Remove usage of the deprecated ida_simple_xx() API +- Bluetooth: ISO: Fix BIS cleanup +- !9838 cgroup: Fix AA deadlock caused by cgroup_bpf_release +- cgroup: Fix AA deadlock caused by cgroup_bpf_release +- !9841 ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension +- ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension +- !9834 mmc: davinci: Don't strip remove function when driver is builtin +- mmc: davinci: Don't strip remove function when driver is builtin + +* Wed Jul 10 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-33.0.0.40 +- !9779 CVE-2024-39461 +- clk: bcm: rpi: Assign ->num before accessing ->hws +- !9801 loongarch平台config配置对kdump的支持 +- loongarch: configs: Configure degbuginfo +- Fix the kdump second kernel boot failure +- loongarch: Cleanup loongson3_defconfig with make savedefconfig +- !9811 fix CVE-2024-39481 +- media: mc: Fix graph walk in media_pipeline_start +- !9810 KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked +- KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked +- !9821 kdb: Fix buffer overflow during tab-complete +- kdb: Fix buffer overflow during tab-complete +- !9788 net: fix wrong return value in bpf_sock_ops_get_uid_gid +- net: fix wrong return value in bpf_sock_ops_get_uid_gid +- !9816 mm: mem_reliable: Make counting reliable task usage compatible with folio +- mm: mem_reliable: Make counting reliable task usage compatible with folio +- !9807 drm: zynqmp_dpsub: Always register bridge +- drm: zynqmp_dpsub: Always register bridge +- !9804 CVE-2024-36478 +- null_blk: Fix return value of nullb_device_power_store() +- null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' +- !9805 md: fix resync softlockup when bitmap size is less than array size +- md: fix resync softlockup when bitmap size is less than array size +- !9802 ax25: Fix reference count leak issue of net_device +- ax25: Fix reference count leak issue of net_device +- !9770 Add a switch to enable hungtask check for io +- block: disable BLK_IO_HUNG_TASK_CHECK by default +- block: add a switch to enable hungtask check for io +- !9793 drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference +- drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference +- !9649 f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() +- f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() +- !9732 CVE-2024-39469 +- nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors +- nilfs2: return the mapped address from nilfs_get_page() +- !9775 mm/slub: Reduce memory consumption in extreme scenarios +- mm/slub: Reduce memory consumption in extreme scenarios +- !9614 v2 wifi: carl9170: add a proper sanity check for endpoints +- wifi: carl9170: add a proper sanity check for endpoints +- !9709 cgroup: fix uaf when proc_cpuset_show +- cgroup: fix uaf when proc_cpuset_show +- !9748 cxl/pci: Skip to handle RAS errors if CXL.mem device is detached +- cxl/pci: Skip to handle RAS errors if CXL.mem device is detached +- !8877 drm/vmwgfx: Fix invalid reads in fence signaled events +- drm/vmwgfx: Fix invalid reads in fence signaled events +- !9730 efi: libstub: only free priv.runtime_map when allocated +- efi: libstub: only free priv.runtime_map when allocated +- !9679 cgroup/cpuset: Make cpuset hotplug processing synchronous +- cgroup/cpuset: Make cpuset hotplug processing synchronous +- !9757 net: openvswitch: fix overwriting ct original tuple for ICMPv6 +- net: openvswitch: fix overwriting ct original tuple for ICMPv6 +- !9665 CVE-2024-38622 +- drm/msm/dpu: make error messages at dpu_core_irq_register_callback() more sensible +- drm/msm/dpu: Add callback function pointer check before its call +- drm/msm/dpu: stop using raw IRQ indices in the kernel output +- drm/msm/dpu: make the irq table size static +- drm/msm/dpu: add helper to get IRQ-related data +- drm/msm/dpu: extract dpu_core_irq_is_valid() helper +- drm/msm/dpu: remove irq_idx argument from IRQ callbacks +- !9668 wifi: nl80211: Avoid address calculations via out of bounds array indexing +- wifi: nl80211: Avoid address calculations via out of bounds array indexing +- !9715 CVE-2024-38602 +- ax25: Fix reference count leak issues of ax25_dev +- ax25: Use kernel universal linked list to implement ax25_dev_list +- !9746 v2 Revert "ACPI: processor: Add support for processors described as container packages" +- Revert "ACPI: processor: Add support for processors described as container packages" +- !9736 net/9p: fix uninit-value in p9_client_rpc() +- net/9p: fix uninit-value in p9_client_rpc() +- !9596 iomap: fix warning in iomap_write_delalloc_release() +- iomap: fix warning in iomap_write_delalloc_release() +- !9703 dma-buf/sw-sync: don't enable IRQ from sync_print_obj() +- dma-buf/sw-sync: don't enable IRQ from sync_print_obj() +- !9642 CVE-2024-38582 +- nilfs2: fix potential hang in nilfs_detach_log_writer() +- nilfs2: fix unexpected freezing of nilfs_segctor_sync() +- !9687 greybus: lights: check return of get_channel_from_mode +- greybus: lights: check return of get_channel_from_mode +- !9678 crypto: bcm - Fix pointer arithmetic +- crypto: bcm - Fix pointer arithmetic +- !7918 [OLK-6.6]drivers: support Yunsilicon's metaScale/metaVisor series NICs +- drivers: support Yunsilicon's MS and MV series NICs +- !9619 r8169: Fix possible ring buffer corruption on fragmented Tx packets. +- r8169: Fix possible ring buffer corruption on fragmented Tx packets. +- !9664 tls: fix missing memory barrier in tls_init +- tls: fix missing memory barrier in tls_init +- !9161 xfs: don't use current->journal_info +- xfs: don't use current->journal_info +- !9624 CVE-2024-38597 +- net: fec: remove .ndo_poll_controller to avoid deadlocks +- eth: sungem: remove .ndo_poll_controller to avoid deadlocks +- !9631 ACPI: APEI: Skip initialization of GHES_ASSIST structures for Machine Check Architecture +- ACPI: APEI: Skip initialization of GHES_ASSIST structures for Machine Check Architecture +- !9632 drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails +- drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails +- !9399 fix CVE-2024-38544 and CVE-2024-37356 +- tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). +- RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt +- !9341 serial: max3100: Lock port->lock when calling uart_handle_cts_change() +- serial: max3100: Lock port->lock when calling uart_handle_cts_change() +- !9562 CVE-2024-38385 +- genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after() +- !9582 v2 eventfs: Fix a possible null pointer dereference in eventfs_find_events() +- eventfs: Fix a possible null pointer dereference in eventfs_find_events() +- !9588 s390/ap: Fix crash in AP internal function modify_bitmap() +- s390/ap: Fix crash in AP internal function modify_bitmap() +- !9513 RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt +- RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt +- !9561 v2 virtio: delete vq in vp_find_vqs_msix() when request_irq() fails +- virtio: delete vq in vp_find_vqs_msix() when request_irq() fails +- !9578 net/mlx5: Discard command completions in internal error +- net/mlx5: Discard command completions in internal error +- !9549 btrfs: fix crash on racing fsync and size-extending write into prealloc +- btrfs: fix crash on racing fsync and size-extending write into prealloc +- !9479 xfs: fix unlink vs cluster buffer instantiation race +- xfs: fix unlink vs cluster buffer instantiation race +- !9519 MPTCP Upstream part 12 +- mptcp: annotate lockless accesses around read-mostly fields +- mptcp: annotate lockless access for token +- mptcp: annotate lockless access for RX path fields +- mptcp: annotate lockless access for the tx path +- mptcp: annotate access for msk keys +- !9557 i2c: acpi: Unbind mux adapters before delete +- i2c: acpi: Unbind mux adapters before delete +- !9555 smb: client: fix deadlock in smb2_find_smb_tcon() +- smb: client: fix deadlock in smb2_find_smb_tcon() +- !9489 fs/ntfs3: Check 'folio' pointer for NULL +- fs/ntfs3: Check 'folio' pointer for NULL +- !9482 fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow +- fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow +- !9506 usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind. +- usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind. +- !9528 media: lgdt3306a: Add a check against null-pointer-def +- media: lgdt3306a: Add a check against null-pointer-def +- !9551 ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() +- ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() +- !9478 watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger +- watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger +- !9536 clk: bcm: dvp: Assign ->num before accessing ->hws +- clk: bcm: dvp: Assign ->num before accessing ->hws +- !9463 fix CVE-2024-38621 +- media: stk1160: fix bounds checking in stk1160_copy_video() +- !9457 bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE +- bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE +- !9459 bpf: Fix verifier assumptions about socket->sk +- bpf: Fix verifier assumptions about socket->sk +- !9522 bonding: fix oops during rmmod +- bonding: fix oops during rmmod +- !9502 netrom: fix possible dead-lock in nr_rt_ioctl() +- netrom: fix possible dead-lock in nr_rt_ioctl() +- !9402 fs/ntfs3: Use variable length array instead of fixed size +- fs/ntfs3: Use variable length array instead of fixed size +- !9320 drm/amd/display: Fix potential index out of bounds in color transformation function +- drm/amd/display: Fix potential index out of bounds in color transformation function +- !9493 thermal/drivers/qcom/lmh: Check for SCM availability at probe +- thermal/drivers/qcom/lmh: Check for SCM availability at probe +- !9398 tracing/probes: fix error check in parse_btf_field() +- tracing/probes: fix error check in parse_btf_field() +- !9510 ftrace: Fix possible use-after-free issue in ftrace_location() +- ftrace: Fix possible use-after-free issue in ftrace_location() +- !9509 cifs: fix pagecache leak when do writepages +- cifs: fix pagecache leak when do writepages +- !9436 v2 ASoC: mediatek: Assign dummy when codec not specified for a DAI link +- ASoC: mediatek: Assign dummy when codec not specified for a DAI link +- !9486 [OLK-6.6] Fix os crash while enable sriov for rnp +- RNPVF: NET: Fix os crash while enable sriov for rnp +- !9371 MPTCP Upstream part 11 +- selftests: net: ip_local_port_range: define IPPROTO_MPTCP +- selftests: mptcp: join: check CURRESTAB counters +- selftests/net: add MPTCP coverage for IP_LOCAL_PORT_RANGE +- mptcp: sockopt: support IP_LOCAL_PORT_RANGE and IP_BIND_ADDRESS_NO_PORT +- mptcp: rename mptcp_setsockopt_sol_ip_set_transparent() +- !5258 [OLK-6.6] Support request attestation report from CSV guest +- driver/virt/coco: Add HYGON CSV Guest dirver. +- KVM: x86: Support VM_ATTESTATION hypercall +- !9485 v2 CVE-2024-38610 +- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() +- virt: acrn: stop using follow_pfn +- !9380 psi: using cpuacct_cgrp_id under CONFIG_CGROUP_CPUACCT +- psi: using cpuacct_cgrp_id under CONFIG_CGROUP_CPUACCT +- !8899 block: fix module reference leakage from bdev_open_by_dev error path +- block: fix module reference leakage from bdev_open_by_dev error path +- !9445 blk-cgroup: fix list corruption from reorder of WRITE ->lqueued +- blk-cgroup: fix list corruption from reorder of WRITE ->lqueued +- !9466 io_uring: check for non-NULL file pointer in io_file_can_poll() +- io_uring: check for non-NULL file pointer in io_file_can_poll() +- !9389 block: refine the EOF check in blkdev_iomap_begin +- block: refine the EOF check in blkdev_iomap_begin +- !9414 vfio/pci: fix potential memory leak in vfio_intx_enable() +- vfio/pci: fix potential memory leak in vfio_intx_enable() +- !9455 jffs2: prevent xattr node from overflowing the eraseblock +- jffs2: prevent xattr node from overflowing the eraseblock +- !9465 CVE-2024-38662 +- Revert "bpf, sockmap: Prevent lock inversion deadlock in map delete elem" +- bpf: Allow delete from sockmap/sockhash only if update is allowed +- !9410 Fix CVE-2024-31076 +- genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline +- !9449 rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow +- rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow + +* Wed Jun 26 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-31.0.0.39 +- !9438 【OLK-6.6】RDMA/hns: Fix some mutex UAF +- RDMA/hns: Fix some mutex UAF +- !9394 CVE-2024-38587 +- speakup: Fix sizeof() vs ARRAY_SIZE() bug +- !9405 drm/mediatek: Add 0 size check to mtk_drm_gem_obj +- drm/mediatek: Add 0 size check to mtk_drm_gem_obj +- !9415 mm: drop the 'anon_' prefix for swap-out mTHP counters +- mm: drop the 'anon_' prefix for swap-out mTHP counters +- !9376 ALSA: core: Fix NULL module pointer assignment at card init +- ALSA: core: Fix NULL module pointer assignment at card init +- !9295 Port patches from OLK-5.10 +- livepatch: Enable CONFIG_LIVEPATCH_ISOLATE_KPROBE in openeuler_defconfig +- livepatch: Avoid patching conflicts with kprobes +- !9356 tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer +- tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer +- !9332 net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP +- net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP +- !9355 f2fs: multidev: fix to recognize valid zero block address +- f2fs: multidev: fix to recognize valid zero block address +- !9329 af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg +- af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg +- !9352 MPTCP Upstream part 10 +- MAINTAINERS: add Geliang as reviewer for MPTCP +- mailmap: add entries for Geliang Tang +- mptcp: fill in missing MODULE_DESCRIPTION() +- netlink: fill in missing MODULE_DESCRIPTION() +- netlink: specs: mptcp: rename the MPTCP path management spec +- !9304 MPTCP Upstream part 9 +- selftests: mptcp: add mptcp_lib_wait_local_port_listen +- selftests: mptcp: add mptcp_lib_check_transfer +- selftests: mptcp: add mptcp_lib_make_file +- selftests: mptcp: add missing oflag=append +- !9307 of: module: add buffer overflow check in of_modalias() +- of: module: add buffer overflow check in of_modalias() +- !9331 Some folio bugfix +- mm/memory: don't require head page for do_set_pmd() +- mm/migrate: fix kernel BUG at mm/compaction.c:2761! +- mm: huge_memory: fix misused mapping_large_folio_support() for anon folios +- mm: shmem: fix getting incorrect lruvec when replacing a shmem folio +- mm: fix possible OOB in numa_rebuild_large_mapping() +- mm: support multi-size THP numa balancing +- mm/rmap: do not add fully unmapped large folio to deferred split list +- !9302 ring-buffer: Fix a race between readers and resize checks +- ring-buffer: Fix a race between readers and resize checks +- !9345 net: sched: sch_multiq: fix possible OOB write in multiq_tune() +- net: sched: sch_multiq: fix possible OOB write in multiq_tune() +- !9346 net: bridge: xmit: make sure we have at least eth header len bytes +- net: bridge: xmit: make sure we have at least eth header len bytes +- !9301 MPTCP Upstream part 8 +- selftests: mptcp: userspace pm send RM_ADDR for ID 0 +- selftests: mptcp: userspace pm remove initial subflow +- mptcp: userspace pm rename remove_err to out +- selftests: mptcp: userspace pm create id 0 subflow +- mptcp: add mptcpi_subflows_total counter +- !9266 MPTCP Upstream part 7 +- net: fill in MODULE_DESCRIPTION()s for SOCK_DIAG modules +- selftests: mptcp: sockopt: drop mptcp_connect var +- mptcp: define more local variables sk +- mptcp: move sk assignment statement ahead +- !9262 MPTCP Upstream part 6 +- mptcp: use mptcp_get_ext helper +- mptcp: use mptcp_check_fallback helper +- mptcp: drop useless ssk in pm_subflow_check_next +- mptcp: ignore notsent_lowat setting at the subflow level +- mptcp: consolidate sockopt synchronization +- !5257 [OLK-6.6] Support DOWNLOAD_FIRMWARE feature for hygon CSV +- crypto: ccp: Implement CSV_DOWNLOAD_FIRMWARE ioctl command +- crypto: ccp: Implement CSV_PLATFORM_SHUTDOWN ioctl command +- crypto: ccp: Implement CSV_PLATFORM_INIT ioctl command +- crypto: ccp: Support DOWNLOAD_FIRMWARE when detect CSV +- !8058 Intel: Backport QuickAssist Technology(QAT) live migration support for in-tree driver +- Enable QAT_VFIO_PCI as kernel module to support Intel QAT live migration +- crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak +- crypto: qat - specify firmware files for 402xx +- crypto: qat - validate slices count returned by FW +- crypto: qat - improve error logging to be consistent across features +- crypto: qat - improve error message in adf_get_arbiter_mapping() +- crypto: qat - implement dh fallback for primes > 4K +- crypto: qat - Fix spelling mistake "Invalide" -> "Invalid" +- crypto: qat - Avoid -Wflex-array-member-not-at-end warnings +- vfio/qat: Add vfio_pci driver for Intel QAT SR-IOV VF devices +- crypto: qat - implement interface for live migration +- crypto: qat - add interface for live migration +- crypto: qat - add bank save and restore flows +- crypto: qat - expand CSR operations for QAT GEN4 devices +- crypto: qat - rename get_sla_arr_of_type() +- crypto: qat - relocate CSR access code +- crypto: qat - move PFVF compat checker to a function +- crypto: qat - relocate and rename 4xxx PF2VM definitions +- crypto: qat - adf_get_etr_base() helper +- !8304 [OLK-6.6] Backport TPMI based RAPL PMU support for next Intel Xeon Granite Rapids (GNR) +- powercap: intel_rapl_tpmi: Enable PMU support +- powercap: intel_rapl: Introduce APIs for PMU support +- powercap: intel_rapl: Sort header files +- !9245 MPTCP Upstream part 5 +- mptcp: prevent BPF accessing lowat from a subflow socket. +- mptcp: use copy_from_iter helpers on transmit +- mptcp: give rcvlowat some love +- tcp: define initial scaling factor value as a macro +- mptcp: use plain bool instead of custom binary enum +- mptcp: add a new sysctl for make after break timeout +- !8422 [OLK-6.6] Intel IAA Compression Accelerator Crypto Driver (iaa_crypto) +- openeuler_defconfig: Add kernel config for Intel IAA crypto driver +- dmaengine: idxd: Avoid unnecessary destruction of file_ida +- dmaengine: idxd: Check for driver name match before sva user feature +- crypto: iaa - Use cpumask_weight() when rebalancing +- crypto: iaa - Fix some errors in IAA documentation +- crypto: iaa - Change iaa statistics to atomic64_t +- crypto: iaa - Add global_stats file and remove individual stat files +- crypto: iaa - Remove comp/decomp delay statistics +- crypto: iaa - fix decomp_bytes_in stats +- crypto: iaa - Fix nr_cpus < nr_iaa case +- crypto: iaa - fix the missing CRYPTO_ALG_ASYNC in cra_flags +- crypto: iaa - Fix comp/decomp delay statistics +- crypto: iaa - Fix async_disable descriptor leak +- crypto: iaa - Remove unnecessary debugfs_create_dir() error check in iaa_crypto_debugfs_init() +- crypto: iaa - Remove header table code +- dmaengine: idxd: constify the struct device_type usage +- dmaengine: idxd: make dsa_bus_type const +- dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API +- crypto: iaa - Account for cpu-less numa nodes +- crypto: iaa - remove unneeded semicolon +- crypto: iaa - Remove unneeded newline in update_max_adecomp_delay_ns() +- crypto: iaa - Change desc->priv to 0 +- dmaengine: idxd: Add support for device/wq defaults +- crypto: iaa - Add IAA Compression Accelerator stats +- crypto: iaa - Add irq support for the crypto async interface +- crypto: iaa - Add support for deflate-iaa compression algorithm +- crypto: iaa - Add compression mode management along with fixed mode +- crypto: iaa - Add per-cpu workqueue table with rebalancing +- crypto: iaa - Add Intel IAA Compression Accelerator crypto driver core +- crypto: iaa - Add IAA Compression Accelerator Documentation +- dmaengine: idxd: add callback support for iaa crypto +- dmaengine: idxd: Add wq private data accessors +- dmaengine: idxd: Export wq resource management functions +- dmaengine: idxd: Export descriptor management functions +- dmaengine: idxd: Rename drv_enable/disable_wq to idxd_drv_enable/disable_wq, and export +- dmaengine: idxd: add external module driver support for dsa_bus_type +- dmaengine: idxd: Fix incorrect descriptions for GRPCFG register +- dmaengine: idxd: add wq driver name support for accel-config user tool +- dmaengine: idxd: rate limit printk in misc interrupt thread +- !9230 MPTCP Upstream part 4 +- net: mptcp: use policy generated by YAML spec +- net: mptcp: rename netlink handlers to mptcp_pm_nl_<blah>_{doit,dumpit} +- uapi: mptcp: use header file generated from YAML spec +- Documentation: netlink: add a YAML spec for mptcp +- net: mptcp: convert netlink from small_ops to ops +- !9229 v2 sched: smart_grid: fix potential NULL pointer dereference +- sched: smart_grid: fix potential NULL pointer dereference +- !9226 MPTCP Upstream part 3 +- tools: ynl-gen: add support for exact-len validation +- tools: ynl: add uns-admin-perm to genetlink legacy +- tools: ynl-gen: support limit names +- tools: ynl-gen: support full range of min/max checks for integer values +- tools: ynl-gen: track attribute use +- !9217 memcg: attach memcg async reclaim worker to curcpu +- memcg: attach memcg async reclaim worker to curcpu +- !9173 MPTCP Upstream part 2 +- inet: implement lockless getsockopt(IP_MULTICAST_IF) +- inet: lockless IP_PKTOPTIONS implementation +- inet: implement lockless getsockopt(IP_UNICAST_IF) +- inet: lockless getsockopt(IP_MTU) +- inet: lockless getsockopt(IP_OPTIONS) + +* Wed Jun 19 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-30.0.0.38 +- !8809 MPTCP Upstream part 1 +- net: bpf: Use sockopt_lock_sock() in ip_sock_set_tos() +- inet: lock the socket in ip_sock_set_tos() +- inet: implement lockless IP_TOS +- inet: implement lockless IP_MTU_DISCOVER +- inet: implement lockless IP_MULTICAST_TTL +- !9141 Fix allmodconfig build frame size error +- net/ethernet/huawei/hiroce3: Fix allmodconfig build frame size error +- !9101 ext4: Skip moving extents if page writeback failed +- ext4: Skip moving extents if page writeback failed +- !9126 arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process +- arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process +- !9010 Backport 6.6.31&6.6.32 LTS patches from upstream +- block: add a partscan sysfs attribute for disks +- block: add a disk_has_partscan helper +- Docs/admin-guide/mm/damon/usage: fix wrong example of DAMOS filter matching sysfs file +- docs: kernel_include.py: Cope with docutils 0.21 +- admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET +- KEYS: trusted: Do not use WARN when encode fails +- remoteproc: mediatek: Make sure IPI buffer fits in L2TCM +- serial: kgdboc: Fix NMI-safety problems from keyboard reset code +- usb: typec: tipd: fix event checking for tps6598x +- usb: typec: ucsi: displayport: Fix potential deadlock +- net: usb: ax88179_178a: fix link status when link is set to down/up +- usb: dwc3: Wait unconditionally after issuing EndXfer command +- binder: fix max_thread type inconsistency +- drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper() +- erofs: reliably distinguish block based and fscache mode +- erofs: get rid of erofs_fs_context +- kselftest: Add a ksft_perror() helper +- mmc: core: Add HS400 tuning in HS400es initialization +- KEYS: trusted: Fix memory leak in tpm2_key_encode() +- Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() +- Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() +- ice: remove unnecessary duplicate checks for VF VSI ID +- ice: pass VSI pointer into ice_vc_isvalid_q_id +- net: ks8851: Fix another TX stall caused by wrong ISR flag handling +- drm/amd/display: Fix division by zero in setup_dsc_config +- smb: smb2pdu.h: Avoid -Wflex-array-member-not-at-end warnings +- ksmbd: add continuous availability share parameter +- cifs: Add tracing for the cifs_tcon struct refcounting +- smb: client: instantiate when creating SFU files +- smb: client: fix NULL ptr deref in cifs_mark_open_handles_for_deleted_file() +- smb3: add trace event for mknod +- smb311: additional compression flag defined in updated protocol spec +- smb311: correct incorrect offset field in compression header +- cifs: Move some extern decls from .c files to .h +- ksmbd: Fix spelling mistake "connction" -> "connection" +- ksmbd: fix possible null-deref in smb_lazy_parent_lease_break_close +- cifs: remove redundant variable assignment +- cifs: fixes for get_inode_info +- cifs: defer close file handles having RH lease +- ksmbd: add support for durable handles v1/v2 +- ksmbd: mark SMB2_SESSION_EXPIRED to session when destroying previous session +- smb: common: simplify compression headers +- smb: common: fix fields sizes in compression_pattern_payload_v1 +- smb: client: negotiate compression algorithms +- smb3: add dynamic trace point for ioctls +- smb: client: return reparse type in /proc/mounts +- smb: client: set correct d_type for reparse DFS/DFSR and mount point +- smb: client: parse uid, gid, mode and dev from WSL reparse points +- smb: client: introduce SMB2_OP_QUERY_WSL_EA +- smb: client: Fix a NULL vs IS_ERR() check in wsl_set_xattrs() +- smb: client: add support for WSL reparse points +- smb: client: reduce number of parameters in smb2_compound_op() +- smb: client: fix potential broken compound request +- smb: client: move most of reparse point handling code to common file +- smb: client: introduce reparse mount option +- smb: client: retry compound request without reusing lease +- smb: client: do not defer close open handles to deleted files +- smb: client: reuse file lease key in compound operations +- smb: client: get rid of smb311_posix_query_path_info() +- smb: client: parse owner/group when creating reparse points +- smb3: update allocation size more accurately on write completion +- smb: client: handle path separator of created SMB symlinks +- cifs: update the same create_guid on replay +- ksmbd: Add kernel-doc for ksmbd_extract_sharename() function +- cifs: set replay flag for retries of write command +- cifs: commands that are retried should have replay flag set +- smb: client: delete "true", "false" defines +- smb: Fix some kernel-doc comments +- cifs: new mount option called retrans +- smb: client: don't clobber ->i_rdev from cached reparse points +- cifs: new nt status codes from MS-SMB2 +- cifs: pick channel for tcon and tdis +- cifs: minor comment cleanup +- cifs: remove redundant variable tcon_exist +- ksmbd: vfs: fix all kernel-doc warnings +- ksmbd: auth: fix most kernel-doc warnings +- cifs: remove unneeded return statement +- cifs: get rid of dup length check in parse_reparse_point() +- cifs: Pass unbyteswapped eof value into SMB2_set_eof() +- smb3: Improve exception handling in allocate_mr_list() +- cifs: fix in logging in cifs_chan_update_iface +- smb: client: handle special files and symlinks in SMB3 POSIX +- smb: client: cleanup smb2_query_reparse_point() +- smb: client: allow creating symlinks via reparse points +- smb: client: optimise reparse point querying +- smb: client: allow creating special files via reparse points +- smb: client: extend smb2_compound_op() to accept more commands +- smb: client: Fix minor whitespace errors and warnings +- smb: client: introduce cifs_sfu_make_node() +- cifs: fix use after free for iface while disabling secondary channels +- Missing field not being returned in ioctl CIFS_IOC_GET_MNT_INFO +- smb3: minor cleanup of session handling code +- smb3: more minor cleanups for session handling routines +- smb3: minor RDMA cleanup +- cifs: print server capabilities in DebugData +- smb: use crypto_shash_digest() in symlink_hash() +- Add definition for new smb3.1.1 command type +- SMB3: clarify some of the unused CreateOption flags +- cifs: Add client version details to NTLM authenticate message +- md: fix kmemleak of rdev->serial +- Revert "selftests/bpf: Add netkit to tc_redirect selftest" +- btrfs: do not wait for short bulk allocation +- keys: Fix overwrite of key expiration on instantiation +- dmaengine: idxd: add a write() method for applications to submit work +- dmaengine: idxd: add a new security check to deal with a hardware erratum +- VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist +- Bluetooth: qca: fix firmware check error path +- Bluetooth: qca: fix info leak when fetching fw build id +- Bluetooth: qca: fix info leak when fetching board id +- Bluetooth: qca: generalise device address check +- Bluetooth: qca: fix NVM configuration parsing +- Bluetooth: qca: add missing firmware sanity checks +- Bluetooth: qca: fix wcn3991 device address check +- Bluetooth: qca: fix invalid device address check +- eventfs: Do not treat events directory different than other directories +- tracefs: Still use mount point as default permissions for instances +- tracefs: Reset permissions on remount if permissions are options +- ksmbd: do not grant v2 lease if parent lease key and epoch are not set +- ksmbd: avoid to send duplicate lease break notifications +- ksmbd: off ipv6only for both ipv4/ipv6 binding +- spi: microchip-core-qspi: fix setting spi bus clock rate +- regulator: core: fix debugfs creation regression +- nvme-pci: Add quirk for broken MSIs +- selftests/mm: fix powerpc ARCH check +- x86/apic: Don't access the APIC when disabling x2APIC +- hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us +- net: fix out-of-bounds access in ops_init +- arm64: dts: qcom: sa8155p-adp: fix SDHC2 CD pin configuration +- drm/amd/display: Fix incorrect DSC instance for MST +- drm/amd/display: Handle Y carry-over in VCP X.Y calculation +- drm/i915/bios: Fix parsing backlight BDB data +- drm/i915/gt: Automate CCS Mode setting during engine resets +- drm/i915/audio: Fix audio time stamp programming for DP +- drm/vmwgfx: Fix invalid reads in fence signaled events +- drm/vmwgfx: Fix Legacy Display Unit +- drm/ttm: Print the memory decryption status just once +- drm/amdkfd: don't allow mapping the MMIO HDP page with large pages +- Revert "drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()" +- drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor() +- mei: me: add lunar lake point M DID +- clk: sunxi-ng: a64: Set minimum and maximum rate for PLL-MIPI +- clk: sunxi-ng: common: Support minimum and maximum rate +- slimbus: qcom-ngd-ctrl: Add timeout for wait operation +- dyndbg: fix old BUG_ON in >control parser +- ASoC: ti: davinci-mcasp: Fix race condition during probe +- ASoC: tegra: Fix DSPK 16-bit playback +- net: bcmgenet: synchronize UMAC_CMD access +- net: bcmgenet: synchronize use of bcmgenet_set_rx_mode() +- net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access +- xtensa: fix MAKE_PC_FROM_RA second argument +- tipc: fix UAF in error path +- e1000e: change usleep_range to udelay in PHY mdic access +- kmsan: compiler_types: declare __no_sanitize_or_inline +- iio: accel: mxc4005: Interrupt handling fixes +- iio: pressure: Fixes BME280 SPI driver data +- iio:imu: adis16475: Fix sync mode setting +- dt-bindings: iio: health: maxim,max30102: fix compatible check +- workqueue: Fix selection of wake_cpu in kick_pool() +- mptcp: only allow set existing scheduler for net.mptcp.scheduler +- mptcp: ensure snd_nxt is properly initialized on connect +- mm/slab: make __free(kfree) accept error pointers +- maple_tree: fix mas_empty_area_rev() null pointer dereference +- btrfs: set correct ram_bytes when splitting ordered extent +- btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() +- firewire: ohci: fulfill timestamp for some local asynchronous transaction +- ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU +- usb: typec: tcpm: Check for port partner validity before consuming it +- usb: typec: tcpm: unregister existing source caps before re-registration +- usb: typec: tcpm: clear pd_event queue in PORT_RESET +- usb: dwc3: core: Prevent phy suspend during init +- usb: xhci-plat: Don't include xhci.h +- usb: gadget: f_fs: Fix a race condition when processing setup packets. +- usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete +- usb: gadget: uvc: use correct buffer size when parsing configfs lists +- usb: gadget: composite: fix OS descriptors w_value logic +- USB: core: Fix access violation during port device removal +- usb: ohci: Prevent missed ohci interrupts +- usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device +- usb: typec: ucsi: Fix connector check on init +- usb: typec: ucsi: Check for notifications after init +- Reapply "drm/qxl: simplify qxl_fence_wait" +- firewire: nosy: ensure user_length is taken into account when fetching packet contents +- btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send() +- drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 +- drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible +- drm/amd/display: Atom Integrated System Info v2_2 for DCN35 +- gpiolib: cdev: fix uninitialised kfifo +- gpiolib: cdev: relocate debounce_period_us from struct gpio_desc +- gpiolib: cdev: Fix use after free in lineinfo_changed_notify +- dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users +- drm/connector: Add +- drm/meson: dw-hdmi: add bandgap setting for g12 +- drm/meson: dw-hdmi: power up phy on device init +- net: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21 family +- net/smc: fix neighbour and rtable leak in smc_ib_find_route() +- ipv6: prevent NULL dereference in ip6_output() +- ipv6: annotate data-races around cnf.disable_ipv6 +- hsr: Simplify code for announcing HSR nodes timer setup +- net-sysfs: convert dev->operstate reads to lockless ones +- ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() +- dt-bindings: net: mediatek: remove wrongly added clocks and SerDes +- rxrpc: Only transmit one ACK per jumbo packet received +- rxrpc: Fix congestion control algorithm +- rxrpc: Fix the names of the fields in the ACK trailer struct +- selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC +- selftests/net: convert test_bridge_neigh_suppress.sh to run it in unique namespace +- ipv6: Fix potential uninit-value access in __ip6_make_skb() +- net: bridge: fix corrupted ethernet header on multicast-to-unicast +- nfc: nci: Fix kcov check in nci_rx_work() +- phonet: fix rtm_phonet_notify() skb allocation +- hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock +- hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event() +- hwmon: (corsair-cpro) Use a separate buffer for sending commands +- rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation +- net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs +- Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout +- Bluetooth: HCI: Fix potential null-ptr-deref +- Bluetooth: msft: fix slab-use-after-free in msft_do_close() +- Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout +- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). +- tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets +- ARM: 9381/1: kasan: clear stale stack poison +- qibfs: fix dentry leak +- SUNRPC: add a missing rpc_stat for TCP TLS +- blk-iocost: do not WARN if iocg was already offlined +- net:usb:qmi_wwan: support Rolling modules +- drm/radeon: silence UBSAN warning (v3) +- platform/x86: ISST: Add Granite Rapids-D to HPM CPU list +- drm/nouveau/dp: Don't probe eDP ports twice harder +- gpio: lpc32xx: fix module autoloading +- fs/9p: drop inodes immediately on non-.L too +- clk: Don't hold prepare_lock when calling kref_put() +- gpio: crystalcove: Use -ENOTSUPP consistently +- gpio: wcove: Use -ENOTSUPP consistently +- powerpc/crypto/chacha-p10: Fix failure on non Power10 +- 9p: explicitly deny setlease attempts +- fs/9p: fix the cache always being enabled on files with qid flags +- fs/9p: translate O_TRUNC into OTRUNC +- fs/9p: only translate RWX permissions for plain 9P2000 +- iommu: mtk: fix module autoloading +- smb3: fix broken reconnect when password changing on the server by allowing password rotation +- Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted +- uio_hv_generic: Don't free decrypted memory +- hv_netvsc: Don't free decrypted memory +- Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl +- Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails +- selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior +- amd/amdkfd: sync all devices to wait all processes being evicted +- drm/amdgpu: Fix VCN allocation in CPX partition +- drm/amd/display: Skip on writeback when it's not applicable +- drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2 +- drm/amdgpu: Refine IB schedule error logging +- tools/power/turbostat: Fix uncore frequency file string +- MIPS: scall: Save thread_info.syscall unconditionally on entry +- gpu: host1x: Do not setup DMA for virtual devices +- blk-iocost: avoid out of bounds shift +- scsi: target: Fix SELinux error when systemd-modules loads the target module +- memblock tests: fix undefined reference to `BIT' +- memblock tests: fix undefined reference to `panic' +- memblock tests: fix undefined reference to `early_pfn_to_nid' +- btrfs: always clear PERTRANS metadata during commit +- btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve +- tools/power turbostat: Fix warning upon failed /dev/cpu_dma_latency read +- tools/power turbostat: Print ucode revision only if valid +- tools/power turbostat: Fix Bzy_MHz documentation typo +- tools/power turbostat: Increase the limit for fd opened +- tools/power turbostat: Fix added raw MSR output +- firewire: ohci: mask bus reset interrupts between ISR and bottom half +- ata: sata_gemini: Check clk_enable() result +- vboxsf: explicitly deny setlease attempts +- net: bcmgenet: Reset RBUF on first open +- ALSA: line6: Zero-initialize message buffers +- scsi: ufs: core: Fix MCQ mode dev command timeout +- scsi: ufs: core: WLUN suspend dev/link state error recovery +- regulator: tps65132: Add of_match table +- ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3 suspend +- kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries +- selftests/ftrace: Fix event filter target_func selection +- bpf: Check bloom filter map value size +- drm/amdkfd: range check cp bad op exception interrupts +- drm/amdkfd: Check cgroup when returning DMABuf info +- btrfs: return accurate error code on open failure in open_fs_devices() +- scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload +- scsi: mpi3mr: Avoid memcpy field-spanning write WARNING +- net: mark racy access on sk->sk_rcvbuf +- wifi: iwlwifi: mvm: guard against invalid STA ID on removal +- wifi: iwlwifi: read txq->read_ptr under lock +- wifi: mac80211: fix prep_connection error path +- wifi: cfg80211: fix rdev_dump_mpp() arguments order +- wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc +- gfs2: Fix invalid metadata access in punch_hole +- scsi: lpfc: Use a dedicated lock for ras_fwlog state +- scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() +- scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port() +- scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic +- scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling +- scsi: lpfc: Move NPIV's transport unregistration to after resource clean up +- scsi: ufs: core: Fix MCQ MAC configuration +- KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() +- KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id +- swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y +- powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE +- powerpc/pseries: make max polling consistent for longer H_CALLs +- clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change +- clk: qcom: smd-rpm: Restore msm8976 num_clk +- net: gro: add flush check in udp_gro_receive_segment +- net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb +- net: gro: parse ipv6 ext headers without frag0 invalidation +- ipv4: Fix uninit-value access in __ip_make_skb() +- drm/panel: ili9341: Use predefined error codes +- drm/panel: ili9341: Respect deferred probe +- drm/panel: ili9341: Correct use of device property APIs +- s390/qeth: Fix kernel panic after setting hsuid +- vxlan: Pull inner IP header in vxlan_rcv(). +- tipc: fix a possible memleak in tipc_buf_append +- rxrpc: Clients must accept conn from any address +- net: core: reject skb_copy(_expand) for fraglist GSO skbs +- net: bridge: fix multicast-to-unicast with fraglist GSO +- spi: fix null pointer dereference within spi_sync +- drm/amdgpu: fix doorbell regression +- net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341 +- cxgb4: Properly lock TX queue for the selftest. +- s390/cio: Ensure the copied buf is NUL terminated +- ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() +- ASoC: meson: cards: select SND_DYNAMIC_MINORS +- ASoC: meson: axg-tdm-interface: manage formatters in trigger +- ASoC: meson: axg-card: make links nonatomic +- ASoC: meson: axg-fifo: use threaded irq to check periods +- ASoC: meson: axg-fifo: use FIELD helpers +- vxlan: Add missing VNI filter counter update in arp_reduce(). +- vxlan: Fix racy device stats updates. +- net: qede: use return from qede_parse_actions() +- net: qede: use return from qede_parse_flow_attr() for flow_spec +- net: qede: use return from qede_parse_flow_attr() for flower +- net: qede: sanitize 'rc' in qede_add_tc_flower_fltr() +- ALSA: emu10k1: fix E-MU dock initialization +- ALSA: emu10k1: move the whole GPIO event handling to the workqueue +- ALSA: emu10k1: factor out snd_emu1010_load_dock_firmware() +- ALSA: emu10k1: fix E-MU card dock presence monitoring +- Fix a potential infinite loop in extract_user_to_sg() +- s390/vdso: Add CFI for RA register to asm macro vdso_func +- net l2tp: drop flow hash on forward +- nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). +- octeontx2-af: avoid off-by-one read from userspace +- bna: ensure the copied buf is NUL terminated +- xdp: use flags field to disambiguate broadcast redirect +- s390/mm: Fix clearing storage keys for huge pages +- s390/mm: Fix storage key clearing for guest huge pages +- ASoC: codecs: wsa881x: set clk_stop_mode1 flag +- ASoC: Intel: avs: Set name of control as in topology +- riscv, bpf: Fix incorrect runtime stats +- bpf, arm64: Fix incorrect runtime stats +- spi: axi-spi-engine: fix version format string +- spi: axi-spi-engine: use common AXI macros +- spi: axi-spi-engine: move msg state to new struct +- spi: axi-spi-engine: use devm_spi_alloc_host() +- spi: axi-spi-engine: simplify driver data allocation +- spi: spi-axi-spi-engine: Use helper function devm_clk_get_enabled() +- bpf: Fix a verifier verbose message +- nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH +- ASoC: SOF: Intel: add default firmware library path for LNL +- ASoC: SOF: Introduce generic names for IPC types +- regmap: Add regmap_read_bypassed() +- bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue +- bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition +- regulator: change devm_regulator_get_enable_optional() stub to return Ok +- regulator: change stubbed devm_regulator_get_enable to return Ok +- regulator: mt6360: De-capitalize devicetree regulator subnodes +- pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() +- power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator +- power: rt9455: hide unused rt9455_boost_voltage_values +- pinctrl: baytrail: Fix selecting gpio pinctrl state +- nfs: Handle error of rpc_proc_register() in nfs_net_init(). +- nfs: make the rpc_stat per net namespace +- nfs: expose /proc/net/sunrpc/nfs in net namespaces +- sunrpc: add a struct rpc_stats arg to rpc_create_args +- pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE +- pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback +- pinctrl: core: delete incorrect free in pinctrl_enable() +- pinctrl/meson: fix typo in PDM's pin name +- pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T +- Bluetooth: qca: add support for QCA2066 +- eeprom: at24: fix memory corruption race condition +- eeprom: at24: Probe for DDR3 thermal sensor in the SPD case +- rust: kernel: require `Send` for `Module` implementations +- wifi: nl80211: don't free NULL coalescing rule +- rust: macros: fix soundness issue in `module!` macro +- rust: module: place generated init_module() function in .init.text +- mtd: limit OTP NVMEM cell parse to non-NAND devices +- nvmem: add explicit config option to read old syntax fixed OF cells +- dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state" +- dmaengine: pl330: issue_pending waits until WFP state +- !9104 [OLK-6.6] drm/phytium: Fix make allmodconfig build fail +- DRM: Fix Phytium DRM build fail +- !9085 [OLK-6.6] openeuler_defconfig: fix checkdefconfig fail +- openeuler_defconfig: fix checkdefconfig fail +- !8750 ubifs: Check @c->dirty_[n|p +- ubifs: Check @c->dirty_[n|p]n_cnt and @c->nroot state under @c->lp_mutex +- !8703 v2 IMA: Introduce a config to bypass i_version detection for Overlayfs issue +- IMA: Introduce a config to bypass i_version detection for Overlayfs issue +- !8621 LoongArch: fix HT RX INT TRANS register not initialized +- LoongArch: fix HT RX INT TRANS register not initialized +- !8440 arm64: cpufeature: Both the major and the minor version numbers need to be checked +- arm64/mpam: skip mpam initialize under kdump kernel +- arm64: cpufeature: Both the major and the minor version numbers need to be checked +- !8107 [OLK 6.6]net: hns3: fix kernel crash when devlink reload during pf/vf initialization +- {topost} net: hns3: fix kernel crash when devlink reload during vf initialization +- {topost} net: hns3: fix kernel crash when devlink reload during pf initialization +- !8481 Fix vf init and common user permissions issue +- net/ethernet/huawei/hiroce3: Fix vf init and common user permissions issue +- !8576 【OLK-6.6】backport PCC patches to support shared interrupt for multiple subspaces and platform notification handling +- soc: hisilicon: kunpeng_hccs: replace MAILBOX dependency with PCC +- soc: hisilicon: kunpeng_hccs: Add the check for obtaining complete port attribute +- mailbox: pcc: Support shared interrupt for multiple subspaces +- mailbox: pcc: Add support for platform notification handling +- !8471 ext4: Fixes len calculation in mpage_journal_page_buffers +- ext4: Fixes len calculation in mpage_journal_page_buffers +- !8496 mm/mlock: return EINVAL for illegal user memory range in mlock +- mm/mlock: return EINVAL for illegal user memory range in mlock +- !8435 LoongArch: add GMAC&GNET support +- net: stmmac: dwmac-loongson: Add loongson module author +- net: stmmac: dwmac-loongson: Move disable_force flag to _gnet_date +- net: stmmac: dwmac-loongson: Add Loongson GNET support +- net: stmmac: dwmac-loongson: Fixed failure to set network speed to 1000. +- net: stmmac: dwmac-loongson: Add loongson_dwmac_config_legacy +- net: stmmac: dwmac-loongson: Add full PCI support +- net: stmmac: dwmac-loongson: Add phy_interface for Loongson GMAC +- net: stmmac: dwmac-loongson: Add phy mask for Loongson GMAC +- net: stmmac: dwmac-loongson: Add ref and ptp clocks for Loongson +- net: stmmac: dwmac-loongson: Split up the platform data initialization +- net: stmmac: dwmac-loongson: Use PCI_DEVICE_DATA() macro for device identification +- net: stmmac: dwmac-loongson: Drop useless platform data +- net: stmmac: Export dwmac1000_dma_ops +- net: stmmac: Add multi-channel support +- net: stmmac: Move the atds flag to the stmmac_dma_cfg structure +- !7896 backport upstream stmmac related patches. +- net: stmmac: Move MAC caps init to phylink MAC caps getter +- net: stmmac: Rename phylink_get_caps() callback to update_caps() +- net: phylink: provide mac_get_caps() method +- !8450 sched/core: Fix incorrect initialization of the 'burst' parameter in cpu_max_write() +- sched/core: Fix incorrect initialization of the 'burst' parameter in cpu_max_write() +- !7482 v2 perf parse-events: Make legacy events lower priority than sysfs/JSON +- perf x86 test: Update hybrid expectations +- perf parse-events: Make legacy events lower priority than sysfs/JSON +- !8309 xfs: Fix file creation failure +- xfs: Fix file creation failure +- !8183 perf pmu: Count sys and cpuid JSON events separately +- perf pmu: Count sys and cpuid JSON events separately +- !7077 v4 block: dicard bugfix +- block: check io size before submit discard +- block: fix overflow in blk_ioctl_discard() +- !8353 mm/dynamic_pool: clear PG_hugetlb when promote hugepages +- mm/dynamic_pool: clear PG_hugetlb when promote hugepages +- !8151 LoongArch: Fix secondary bridge routing errors +- LoongArch: Fix secondary bridge routing errors +- !7948 【OLK-6.6】Fix BUILD REGRESSION warnings in bzwx N5/N6 series NIC drivers +- drivers: Fix BUILD REGRESSION warnings in bzwx N5/N6 series NIC drivers +- !8228 ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted +- ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted +- !6283 fix deadlock in cgroup1_writeback V2 +- cgroup_writeback: fix deadlock in cgroup1_writeback +- cgroup_writeback: Revert "fix deadlock in cgroup1_writeback" +- !8036 fix CVE-2024-27010 +- net/sched: fix kabi change in struct Qdisc +- net/sched: Fix mirred deadlock on device recursion + + to message about demoting connector force-probes +* Thu Jun 13 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-28.0.0.37 +- Enable kabi check for src and change the check-kabi format to Python3 + +* Thu Jun 6 2024 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-28.0.0.36 +- riscv-kernel patch update to 6.6.0-29.0.0 +- Fix QEMU UEFI boot panic +- Deal with riscv SoC dtb search path + +* Thu Jun 6 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-28.0.0.35 +- Add kabi_whitelist_aarch64/x86 and update Module.kabi_aarch64/x86 + +* Sun May 26 2024 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-28.0.0.34 +- riscv-kernel patch update to 6.6.0-28.0.0 +- fixed a merge conflict from the commit f1e873348141 + +* Sun May 26 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-28.0.0.33 +- !8010 mm/mempolicy.c: fix the out-of-bounds access issue in mpol_parse_str +- mm/mempolicy.c: fix the out-of-bounds access issue in mpol_parse_str +- !7997 mm: some misc bugfix +- mm: vmalloc: bail out early in find_vmap_area() if vmap is not init +- Revert "mm: support multi-size THP numa balancing" +- mm: simplify thp_vma_allowable_order +- mm: huge_memory: add the missing folio_test_pmd_mappable() for THP split statistics +- mm/huge_memory: skip invalid debugfs new_order input for folio split +- mm: prohibit the last subpage from reusing the entire large folio +- mm/memory.c: do_numa_page(): remove a redundant page table read +- mm: memory: fix shift-out-of-bounds in fault_around_bytes_set +- !7966 [OLK-6.6] openeuler_defconfig: Modify openeuler-defconfig +- openeuler_defconfig: Modify openeuler-defconfig +- !7909 Scheduler load balance fixes +- config: Disable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64 +- sched/numa: Fix numa imbalance in load_balance() +- !7917 sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED +- sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED +- Revert "sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED" +- !7902 v3 Revert "ACPI: Rename ACPI_HOTPLUG_CPU to include 'present'" +- Revert "ACPI: Rename ACPI_HOTPLUG_CPU to include 'present'" +- !7888 v3 mm: add thp anon pmd size mapping align control +- mm: add thp anon pmd size mapping align control +- !7730 v2 sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED +- sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED +- !7808 Bluetooth: L2CAP: Fix not validating setsockopt user input +- Bluetooth: L2CAP: Fix not validating setsockopt user input +- !7822 LoongArch: limit min pci msi-x/msi vector number when request more than 32 vectors +- LoongArch: limit min pci msi-x/msi vector number when request more than 32 vectors +- !7823 LoongArch: fix kdump not work when legacy mode disabled +- LoongArch: fix efi map page table error +- Revert "LoongArch: kdump: Add memory reservation for old kernel" +- Revert "LoongArch: Fix kdump failure on v40 interface specification" +- Revert "LoongArch: kdump: Add high memory reservation" +- !7764 v2 mm: Some bugfix and optimization +- mm/dynamic_pool: clear PG_hugetlb when demote hugepages +- mm: optimise vmf_anon_prepare() for VMAs without an anon_vma +- mm: delay the check for a NULL anon_vma +- mm: assert the mmap_lock is held in __anon_vma_prepare() +- mm/memory: change vmf_anon_prepare() to be non-static +- mm: always initialise folio->_deferred_list +- mm: page_alloc: control latency caused by zone PCP draining +- mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() +- hugetlb: check for hugetlb folio before vmemmap_restore +- hugetlb: set hugetlb page flag before optimizing vmemmap +- mm: add alloc_contig_migrate_range allocation statistics +- mm: convert free_zone_device_page to free_zone_device_folio +- mm: combine __folio_put_small, __folio_put_large and __folio_put +- mm: inline destroy_large_folio() into __folio_put_large() +- mm: combine free_the_page() and free_unref_page() +- mm: free non-hugetlb large folios in a batch +- mm: increase folio batch size +- mm: fix list corruption in put_pages_list +- mm: remove folio from deferred split list before uncharging it +- mm: convert free_swap_cache() to take a folio +- mm: use a folio in __collapse_huge_page_copy_succeeded() +- mm: convert free_pages_and_swap_cache() to use folios_put() +- mm: remove lru_to_page() +- mm: remove free_unref_page_list() +- memcg: remove mem_cgroup_uncharge_list() +- mm: free folios directly in move_folios_to_lru() +- mm: free folios in a batch in shrink_folio_list() +- mm: allow non-hugetlb large folios to be batch processed +- mm: handle large folios in free_unref_folios() +- mm: use __page_cache_release() in folios_put() +- mm: use free_unref_folios() in put_pages_list() +- mm: remove use of folio list from folios_put() +- memcg: add mem_cgroup_uncharge_folios() +- mm: use folios_put() in __folio_batch_release() +- mm: add free_unref_folios() +- mm: convert free_unref_page_list() to use folios +- mm: make folios_put() the basis of release_pages() +- !7812 [OLK-6.6] drm/phytium: Replace default efi fb0 with dc fb +- drm/phytium: Replace default efi fb0 with dc fb +- !7767 irqchip/loongson-eiointc: fix gsi register error +- irqchip/loongson-eiointc: fix gsi register error +- !7771 ext4: default enable iomap for buffered IO and large folio +- ext4: default enable iomap for buffered IO and large folio +- !7721 【OLK-6.6】bugfix from upstream v6.9 for AMD EPYC +- x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range +- x86/CPU/AMD: Do the common init on future Zens too +- !7572 Fix pseudo nmi identifier undeclaration complilation error +- arm64/cpufeature: Fix pseudo nmi identifier undeclaration complilation error +- !7537 [OLK-6.6] irqchip/gic-v3: Fix one race condition due to NMI withdraw +- irqchip/gic-v3: Fix one race condition due to NMI withdraw +- !7164 [sync] PR-7143: media: usbtv: Remove useless locks in usbtv_video_free() +- media: usbtv: Remove useless locks in usbtv_video_free() +- !6386 [OLK-6.6] Fix warnings for RNPVF driver with loongarch-allmodconfig +- RNPVF: NET: Fix "'%d' directive output may be truncated" warnings +- !5243 [OLK-6.6] Support PSP identification for Hygon 4th CPU and print secure features when running on Hygon CPUs +- x86/config: Set CONFIG_HYGON_CSV by default +- x86/cpu/hygon: Clear SME feature flag when not in use +- x86/cpufeatures: Add CSV3 CPU feature +- x86/cpufeatures: Add CPUID_8C86_0000_EDX CPUID leaf +- x86/cpu: Detect memory encryption features on Hygon CPUs +- KVM: SVM: Print Hygon CSV support info if support is detected +- crypto: ccp: Print Hygon CSV API version when CSV support is detected +- x86/mm: Print CSV info into the kernel log +- x86/mm: Provide a Kconfig entry to build the HYGON memory encryption support into the kernel +- Documentation/arch/x86: Add HYGON secure virtualization description +- crypto: ccp: Add support to detect CCP devices on Hygon 4th CPUs +- !7180 【3snic】 use same string “sssnic" for "Kernel driver in use" and "Kernel modules" +- 3snic: use sssnic as kernel driver name +- !7607 Fix allmodconfig build error +- net/ethernet/huawei/hiroce3: Fix allmodconfig build error +- !7583 [OLK-6.6] Fixed display error for ps23xx when using ast and pe2201 bmc card +- drm/ast: Fixed display error for ps23xx when using ast bmc card +- drm/phytium: Bugfix Xorg startup for ps23xx when using pe2201 bmc card +- !7593 memcg_swap_qos: Backport two bugfix +- mm/swapfile: fix infinite loop in get_swap_pages after set memory.swapfile +- memcg: fix incorrect value of sysctl_memcg_swap_qos_stat +- !7595 jbd2: speed up jbd2_transaction_committed() +- jbd2: speed up jbd2_transaction_committed() +- !5480 [OLK-6.6] Fix DMA RW sequence disorder issue +- Add kh40000_iommu_dma_ops for KH-40000 platform +- Add kh40000_direct_dma_ops for KH-40000 platform +- !3133 [OLK-6.6] iommu/vt-d:Add support for detecting ACPI device in RMRR +- iommu/vt-d: Add support for detecting ACPI namespace device in RMRR + +* Fri May 24 2024 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-27.0.0.32 +- Update the riscv-kernel patch for sg2042, rebase 6.6.0-27.0.0 and add features: + - SPI Flash driver + - kexec file raw image + - HIGHMEM +- This patch only applies to the RISC-V architecture, the related commit list: +- +- sg2042: Update sg2042 openeuler_defconfig +- th1520: riscv: config: Enable th1520 support +- riscv: thead: Use the wback_inv instead of wback_only +- riscv: errata: thead: use pa based instructions for CMO +- riscv: errata: thead: use riscv_nonstd_cache_ops for CMO +- Revert "riscv: use VA+PA variant of CMO macros for DMA page preparation" +- Revert "riscv: use VA+PA variant of CMO macros for DMA synchorization" +- Revert "riscv: errata: cmo: add CMO macro variant with both VA and PA" +- Revert "riscv: errata: Replace thead cache clean with flush" +- Revert "riscv: errata: thead: use riscv_nonstd_cache_ops for CMO" +- Revert "riscv: errata: thead: use pa based instructions for CMO" +- riscv: mm: fix NOCACHE_THEAD does not set bit[61] correctly +- riscv: mm: update T-Head memory type definitions +- Revert "sg2042: riscv: changing T-Head PBMT attributes" +- riscv: remove compression for riscv Image +- th1520: cpufreq: correct typo in config name +- th1520: riscv: dts: thead: Add Milk-V Meles board +- th1520: cpufreq: light-mpw-cpufreq: fix -Wunused-variable in panic_cpufreq_notifier_call +- th1520: cpufreq: light-mpw-cpufreq: fix cpu_pll1 already disabled warning +- riscv: Add th1520-lichee-cluster-4a dts support (8G/16G) +- riscv: dts: th1520-beaglev-ahead: add alias for emmc & sd +- riscv: dts: th1520-lichee-pi-4a: add alias for emmc & sd +- riscv: dts: lpi4a 16g support +- th1520: perf vendor events riscv: add T-HEAD C9xx JSON file +- th1520: riscv: dts: thead: Add PMU event node +- riscv: pinctrl: th1520: fix build +- riscv: dts: th1520: lpi4a: add rpmsg node +- riscv: dts: th1520: add mbox client node +- riscv: rpmsg: mailbox-client: sync thead sdk 1.4.2 +- riscv: panic: add thead sdk quirks +- riscv: dts: add watchdog node +- th1520: riscv: dts: Add th1520 reset device tree +- th1520: reset: Add th1520 reset driver support +- th1520: dt-bindings: reset: Document th1520 reset control +- riscv: light_wdt: update sdk 1.4.2 +- th1520_light_event: update sdk 1.4.2 +- th1520_aon: update sdk 1.4.2 +- th1520: fix compile th1520-beaglev-ahead error +- th1520: add TH1520 cpu frequency driver +- th1520: riscv: errata: thead: use pa based instructions for CMO +- th1520: riscv: errata: thead: use riscv_nonstd_cache_ops for CMO +- riscv: dts: thead: Add TH1520 CPU reset node +- th1520: riscv: dts: thead: Enable Lichee Pi 4A USB +- th1520: riscv: dts: thead: Add Lichee Pi 4A IO expansions +- th1520: riscv: dts: thead: Add TH1520 USB nodes +- th1520: riscv: dts: thead: Add TH1520 I2C nodes +- th1520: usb: dwc3: add T-HEAD TH1520 usb driver +- th1520: dt-bindings: usb: Add T-HEAD TH1520 USB controller +- th1520: riscv: dts: thead: Add BeagleV Ahead SDIO0 pins +- th1520: riscv: dts: thead: Add Lichee Pi 4A SDIO0 pins +- th1520: riscv: dts: thead: Add TH1520 ethernet nodes +- th1520: net: stmmac: add glue layer for T-HEAD TH1520 SoC +- th1520: dt-bindings: net: add T-HEAD dwmac support +- th1520: dt-bindings: net: snps,dwmac: allow dwmac-3.70a to set pbl properties +- th1520: riscv: dts: thead: Enable Lichee Pi 4A PWM fan +- th1520: riscv: dts: thead: Add TH1520 PVT node +- th1520: riscv: dts: thead: Add TH1520 PWM node +- th1520: pwm: add T-HEAD PWM driver +- th1520: dt-bindings: pwm: Add T-HEAD PWM controller +- th1520: gpio: dwapb: Use generic request, free and set_config +- riscv: dts: thead: Enable LicheePi 4A eMMC and microSD +- riscv: dts: thead: Enable BeagleV Ahead eMMC and microSD +- riscv: dts: thead: Add TH1520 mmc controllers and sdhci clock +- riscv: defconfig: Enable mmc and dma drivers for T-Head TH1520 +- mmc: sdhci-of-dwcmshc: Add support for T-Head TH1520 +- mmc: sdhci: add __sdhci_execute_tuning() to header +- dt-bindings: mmc: sdhci-of-dwcmhsc: Add T-Head TH1520 support +- th1520: riscv: dtb: thead: Add BeagleV Ahead LEDs +- th1520: riscv: dts: thead: Add TH1520 pinctrl settings for UART0 +- th1520: riscv: dts: thead: Adjust TH1520 GPIO labels +- th1520: riscv: dts: thead: Add TH1520 GPIO ranges +- th1520: riscv: dts: thead: Add TH1520 pin control nodes +- th1520: pinctrl: Add driver for the T-Head TH1520 SoC +- th1520: dt-bindings: pinctrl: Add thead,th1520-pinctrl bindings +- th1520: dt-bindings: gpio: dwapb: allow gpio-ranges +- sg2042: riscv: config: Enable sg2042 support +- sg2042: drivers: rtc: disable BMC RTC device +- sg2042: dts: add i2c-rtc ds1307 device node for single chip +- sg2042: riscv:dts:modify dw gpio clock name +- sg2042: drivers:pci:remove the err log of parsing pci +- sg2042: driver: ipmi: support KVM and IPMI SI for BMC +- sg2042: perf cpumap: Make counter as unsigned ints +- sg2042: driver: radeon: deinit device during kexec +- sg2042: kernel: schedule: Fix set_task_cpu() bug +- sg2042: mm: Modify __find_max_addr for memory hole +- sg2042: riscv: kernel: Optimize apply_relocate_add() +- sg2042: riscv: mm: Clear compilation warning about last_cpupid +- sg2042: kernel: tick: filter unnecessary printing +- sg2042: kernel: Adjust the log level of the tick_switch_to_oneshot function +- sg2042: driver: clk: Modify the timer clock is turned off defaultly +- sg2042: drivers: clock: Add sophgo sg2042 multi-chip clock synchronous support +- Revert "riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings" +- Revert "riscv: Fix set_direct_map_default_noflush() to reset _PAGE_EXEC" +- Revert "riscv: Fix wrong usage of lm_alias() when splitting a huge linear mapping" +- sg2042: riscv: mm: Add high memory on riscv64 using sv39 +- sg2042: riscv/kexec: handle R_RISCV_ADD16 and R_RISCV_SUB16 relocation types +- sg2042: riscv: kexec: Add image loader for kexec file +- sg2042: drm/amd/display: Support DRM_AMD_DC_FP on RISC-V +- sg2042: riscv: Factor out riscv-march-y to a separate Makefile +- sg2042: riscv: Add support for kernel-mode FPU +- sg2042: mango pci hack:broadcast when no MSI source known +- sg2042: nvidia hda: force msi +- sg2042: radeon hack: force 64-bit msi to fit top intc +- sg2042: amdgpu: disable rebar +- sg2042: ttm: disallow cached mapping +- sg2042: driver: soc: Add sophgo sg2042 soc support +- sg2042: drivers: pcie: Create msi-x whitelist,turn on msi-x for top intr +- sg2042: driver: pcie: Add sophgo sg2042 soc support +- sg2042: driver: net: Add sophgo sg2042 soc support +- sg2042: driver: mtd: Add sophgo sg2042 soc support +- sg2042: driver: mmc: Add sophgo sg2042 soc support +- sg2042: driver: reset: Add sophgo sg2042 soc support +- sg2042: driver: pinctrl: Add sophgo sg2042 soc support +- sg2042: driver: clk: Add sophgo sg2042 soc support +- sg2042: riscv: spinlock: Fix deadlock issue +- sg2042: riscv: add smp_cond_load_acquire() +- sg2042: riscv: add ioremap_wc for gpu +- sg2042: riscv: changing T-Head PBMT attributes +- sg2042: riscv: errata: thead: Make cache clean to flush +- sg2042: riscv: use VA+PA variant of CMO macros for DMA page preparation +- sg2042: riscv: use VA+PA variant of CMO macros for DMA synchorization +- sg2042: riscv: errata: cmo: add CMO macro variant with both VA and PA +- sg2042: riscv: errata: Replace thead cache clean with flush +- sg2042: riscv: Kconfig: Set vector as default no +- sg2042: riscv: Add sophgo sg2042 soc support + +* Sat May 18 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-27.0.0.31 +- !7527 ext4 iomap performance optimize +- ext4: fallback to generic_perform_write once iov_iter_count <= PAGE_SIZE +- iomap: export __iomap_write_{begin|end} +- !7530 mm: more thp control for large folio +- mm: correct the docs for thp_fault_alloc and thp_fault_fallback +- mm: add docs for per-order mTHP counters and transhuge_page ABI +- mm: add per-order mTHP anon_swpout and anon_swpout_fallback counters +- mm: add per-order mTHP anon_fault_alloc and anon_fault_fallback counters +- mm: add control to allow specified high-order pages stored on PCP list +- mm: huge_memory: add thp mapping align control +- mm: huge_memory: add folio_get_unmapped_area() +- mm: filemap: make mTHP configurable for exec mapping +- mm/filemap: Allow arch to request folio size for exec memory +- mm/memcontrol: remove __mod_lruvec_page_state() +- mm/khugepaged: use a folio more in collapse_file() +- mm: remove inc/dec lruvec page state functions +- !7521 v2 Avoiding false sharing in field access of tk_core +- openeuler_defconfig: Enable CONFIG_ARCH_LLC_128_LINE_SIZE for Hisilicon platforms +- timekeeping: Avoiding false sharing in field access of tk_core +- !7182 v3 mm: mglru: reuse some legacy trace +- mm: multi-gen LRU: reuse some legacy trace events +- mm, vmscan: remove ISOLATE_UNMAPPED +- trace-vmscan-postprocess: sync with tracepoints updates +- !7219 Hygon model 6h L3 PMU event duplicate creating issue fix +- perf/x86/uncore: Create L3 event strictly to the CPU vendor +- !7474 sched/fair: set burst to zero when cfs bandwidth is cancelled +- sched/fair: set burst to zero when set max to cpu.max +- sched/fair: limit burst to zero when cfs bandwidth is toggled off +- !7475 Makefile.oever: add OPENEULER_RELEASE for version.h +- Makefile.oever: add OPENEULER_RELEASE for version.h +- !6241 add pmu support for loongarch kvm +- LoongArch: KVM: Add PMU support +- !5654 [OLK-6.6] USB: UAS: return ENODEV when submit urbs fail with device not attached +- USB: UAS: return ENODEV when submit urbs fail with device not attached +- !5218 [OLK-6.6] Add HGSC_CERT_IMPORT ioctl interface for Hygon CPUs. +- crypto: ccp: Implement CSV_HGSC_CERT_IMPORT ioctl command +- crypto: ccp: Move the fixup code for Hygon psp to Hygon specific files +- crypto: ccp: Bind specific sp_dev_vdata for Hygon secure processor +- crypto: ccp: Introduce hygon specific interface to support driver +- !6311 v2 ima: Avoid blocking in RCU read-side critical section +- ima: Avoid blocking in RCU read-side critical section +- !6837 fs: sysfs: Fix reference leak in sysfs_break_active_protection() +- fs: sysfs: Fix reference leak in sysfs_break_active_protection() +- !5644 [OLK-6.6] x86/mce: Set bios_cmci_threshold for CMCI threshold +- x86/mce: Set bios_cmci_threshold for CMCI threshold +- !7454 add new kvm_type for Confidential VMs +- kvm: add macro CONFIG_CVM_HOST to defconfig +- kvm: add new kvm_type for cvm +- !7405 v2 mm: prepare to support weighted interleaving mempolicy +- mm: prepare to support weighted interleaving mempolicy +- !7370 v2 sched: smart_grid: silence complier error +- sched: smart_grid: silence complier error +- !7227 arm64: arm_pmuv3: Correctly extract and check the PMUVer +- arm64: arm_pmuv3: Correctly extract and check the PMUVer +- !5291 [OLK-6.6] iommu/dma: Fix not fully traversing iova reservations issue +- iommu/dma: Fix not fully traversing iova reservations issue +- !6774 [OLK-6.6] merge upstream 4 wangxun related patches to fix i2c bug +- Revert "net: txgbe: fix clk_name exceed MAX_DEV_ID limits" +- Revert "net: txgbe: fix i2c dev name cannot match clkdev" +- net: wangxun: add ethtool_ops for channel number +- clkdev: Update clkdev id usage to allow for longer names +- !7206 v2 sched: programmable: Allow set tag for pid 1. +- sched: programmable: Allow set tag for pid 1. + +* Sat May 11 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-26.0.0.30 +- !7198 v2 mm: prepare more high-order pages on pcplist +- mm: prepare more high-order pages to be stored on the per-cpu lists +- mm: page_alloc: use the correct THP order for THP PCP +- !7196 v3 Backport folio feature and bugfix +- mm: madvise: avoid split during MADV_PAGEOUT and MADV_COLD +- mm: vmscan: avoid split during shrink_folio_list() +- mm: swap: allow storage of all mTHP orders +- mm: swap: update get_swap_pages() to take folio order +- mm: swap: simplify struct percpu_cluster +- mm: swap: free_swap_and_cache_nr() as batched free_swap_and_cache() +- mm: swap: remove CLUSTER_FLAG_HUGE from swap_cluster_info:flags +- mm/madvise: don't forget to leave lazy MMU mode in madvise_cold_or_pageout_pte_range() +- mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range() +- mm: support multi-size THP numa balancing +- mm: factor out the numa mapping rebuilding into a new helper +- mm: alloc_anon_folio: avoid doing vma_thp_gfp_mask in fallback cases +- huge_memory.c: document huge page splitting rules more thoroughly +- mm: convert folio_estimated_sharers() to folio_likely_mapped_shared() +- mm/migrate: split source folio if it is on deferred split list +- mm: hold PTL from the first PTE while reclaiming a large folio +- madvise:madvise_cold_or_pageout_pte_range(): allow split while folio_estimated_sharers = 0 +- mm/filemap: don't decrease mmap_miss when folio has workingset flag +- mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM +- arm64: mm: swap: support THP_SWAP on hardware with MTE +- mm: remove PageAnonExclusive assertions in unuse_pte() +- mm: remove struct page from get_shadow_from_swap_cache +- selftests: mm: fix unused and uninitialized variable warning +- XArray: set the marks correctly when splitting an entry +- mm/huge_memory: check new folio order when split a folio +- mm: huge_memory: enable debugfs to split huge pages to any order +- mm: thp: split huge page to any lower order pages +- mm: page_owner: add support for splitting to any order in split page_owner +- mm: memcg: make memcg huge page split support any order split +- mm/page_owner: use order instead of nr in split_page_owner() +- mm/memcg: use order instead of nr in split_page_memcg() +- mm: support order-1 folios in the page cache +- mm/huge_memory: only split PMD mapping when necessary in unmap_folio() +- selftests/mm: split_huge_page_test: conform test to TAP format output +- mm: huge_memory: use more folio api in __split_huge_page_tail() +- mm/vmalloc: fix return value of vb_alloc if size is 0 +- mm: use memalloc_nofs_save() in page_cache_ra_order() +- mm: madvise: pageout: ignore references rather than clearing young +- mm: ratelimit stat flush from workingset shrinker +- mm, oom:dump_tasks add rss detailed information printing +- arm64/mm: improve comment in contpte_ptep_get_lockless() +- arm64/mm: export contpte symbols only to GPL users +- mm: page_alloc: enforce minimum zone size to do high atomic reserves +- mm: page_alloc: correct high atomic reserve calculations +- mm: fix draining remote pageset +- !7190 entry: inline syscall enter/exit functions +- entry: Move syscall_enter_from_user_mode() to header file +- entry: Move enter_from_user_mode() to header file +- entry: Move exit to usermode functions to header file +- !7130 v2 openeuler_defconfig: update oedefconfig for the minimum set +- openeuler_defconfig: update oedefconfig for the minimum set +- !7141 spi: hisi-kunpeng: Add validation for the minimum value of speed_hz +- spi: hisi-kunpeng: Add validation for the minimum value of speed_hz +- spi: Add verification for the max_frequency provided by the firmware +- !7136 Fix failed in acpi_gpiochip_find() by adding parent node match +- gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match +- !6778 v2 Fix two soc bugs of hip09 +- irqchip: gicv3: Add workaround for hip09 erratum 162200806 +- irqchip: gicv3: Add workaround for hip09 erratum 162200803 +- !7165 v2 tick/broadcast-hrtimer: Prevent the timer device on broadcast duty CPU from being disabled +- tick/broadcast-hrtimer: Prevent the timer device on broadcast duty CPU from being disabled +- !7184 v3 md: do not delete safemode_timer in mddev_suspend +- md: do not delete safemode_timer in mddev_suspend +- !7131 net: hns3: Fix ROH mac address initialization. +- net: hns3: Fix ROH mac address initialization. +- !7126 net: hns3: some bugfixes for hns3 driver +- net: hns3: fix kernel crash when devlink reload during initialization +- net: hns3: direct return when receive a unknown mailbox message +- net: hns3: release PTP resources if pf initialization failed +- net: hns3: change type of numa_node_mask as nodemask_t +- net: hns3: using cpumask_copy when set value to cpumask_t +- net: hns3: set irq affinity directly +- net: hns3: use appropriate barrier function after setting a bit value +- net: hns3: don't need to check an unsigned number is less than 0 +- net: hns3: add +- net: hns3: using user configure after hardware reset +- net: hns3: add cond_resched() to hns3 ring buffer init process +- net: hns3: fix kernel crash problem in concurrent scenario +- net: hns3: fix port vlan filter not disabled issue +- net: hns3: revert "net: hns3: fix port vlan filter not disabled problem in dynamic vlan mode" +- !7159 【OLK 6.6】 backport some mailist patches for perf +- drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() +- drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group +- drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group +- !7068 kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in kernfs_find_and_get_node_by_id() +- kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in kernfs_find_and_get_node_by_id() +- !7153 Backports for OLK-6.6 +- netfilter: br_netfilter: skip conntrack input hook for promisc packets +- netfilter: bridge: confirm multicast packets before passing them up the stack +- !7069 ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() +- ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() +- !7075 RDMA/hns: Some bugfixes and cleanups +- RDMA/hns: Fix soft lockup under heavy CEQE load +- RDMA/hns: Fix sleeping in spin_lock critical section +- RDMA/hns: Fix Use-After-Free of rsv_qp +- RDMA/hns: Fix a missing check of atomic wr length +- !3184 [OLK-6.6] add support for Zhaoxin ZXPAUSE instruction +- x86/delay: add support for Zhaoxin ZXPAUSE instruction +- !7078 v2 Backport four conflict stable patch +- mm: turn folio_test_hugetlb into a PageType +- mm/hugetlb: fix missing hugetlb_lock for resv uncharge +- fork: defer linking file vma until vma is fully initialized +- mm, treewide: introduce NR_PAGE_ORDERS +- !7067 crypto: hisilicon fix some issues +- uacce: fix for cdev memory leak +- crypto: hisilicon/qm - adjust the internal processing sequence of the vf enable and disable +- crypto: hisilicon/zip - optimize the address offset of the reg query function +- !4084 riscv64: initial LIVEPATCH_WO_FTRACE support +- riscv64: add initial livepatch support +- livepatch: add arch hook before doing klp_resolve_symbols +- !6868 irqchip/loongson-pch-pic: Update interrupt registration policy +- irqchip/loongson-pch-pic: Update interrupt registration policy +- !6004 [OLK-6.6] fix bug：ethtool -S and ethtool -x/X for mucse rnpm drvier +- mucse: ethtool -S and ethtool -x/X for mucse rnpm drvier + + at the end when print msg +* Sat May 11 2024 Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-25.0.0.29 +- Add riscv-kernel patch, which adds support for sg2042 and th1520 RISC-V SoCs. +- This patch only applies to the RISC-V architecture, the related commit list: +- +- th1520: riscv: config: Enable th1520 support +- riscv: thead: Use the wback_inv instead of wback_only +- riscv: errata: thead: use pa based instructions for CMO +- riscv: errata: thead: use riscv_nonstd_cache_ops for CMO +- Revert "riscv: errata: thead: use riscv_nonstd_cache_ops for CMO" +- Revert "riscv: errata: thead: use pa based instructions for CMO" +- riscv: mm: fix NOCACHE_THEAD does not set bit[61] correctly +- riscv: mm: update T-Head memory type definitions +- Revert "sg2042: riscv: changing T-Head PBMT attributes" +- riscv: remove compression for riscv Image +- th1520: cpufreq: correct typo in config name +- th1520: riscv: dts: thead: Add Milk-V Meles board +- th1520: cpufreq: light-mpw-cpufreq: fix -Wunused-variable in panic_cpufreq_notifier_call +- th1520: cpufreq: light-mpw-cpufreq: fix cpu_pll1 already disabled warning +- riscv: Add th1520-lichee-cluster-4a dts support (8G/16G) +- riscv: dts: th1520-beaglev-ahead: add alias for emmc & sd +- riscv: dts: th1520-lichee-pi-4a: add alias for emmc & sd +- riscv: dts: lpi4a 16g support +- th1520: perf vendor events riscv: add T-HEAD C9xx JSON file +- th1520: riscv: dts: thead: Add PMU event node +- riscv: pinctrl: th1520: fix build +- riscv: dts: th1520: lpi4a: add rpmsg node +- riscv: dts: th1520: add mbox client node +- riscv: rpmsg: mailbox-client: sync thead sdk 1.4.2 +- riscv: panic: add thead sdk quirks +- riscv: dts: add watchdog node +- th1520: riscv: dts: Add th1520 reset device tree +- th1520: reset: Add th1520 reset driver support +- th1520: dt-bindings: reset: Document th1520 reset control +- riscv: light_wdt: update sdk 1.4.2 +- th1520_light_event: update sdk 1.4.2 +- th1520_aon: update sdk 1.4.2 +- th1520: fix compile th1520-beaglev-ahead error +- th1520: add TH1520 cpu frequency driver +- th1520: riscv: errata: thead: use pa based instructions for CMO +- th1520: riscv: errata: thead: use riscv_nonstd_cache_ops for CMO +- riscv: dts: thead: Add TH1520 CPU reset node +- th1520: riscv: dts: thead: Enable Lichee Pi 4A USB +- th1520: riscv: dts: thead: Add Lichee Pi 4A IO expansions +- th1520: riscv: dts: thead: Add TH1520 USB nodes +- th1520: riscv: dts: thead: Add TH1520 I2C nodes +- th1520: usb: dwc3: add T-HEAD TH1520 usb driver +- th1520: dt-bindings: usb: Add T-HEAD TH1520 USB controller +- th1520: riscv: dts: thead: Add BeagleV Ahead SDIO0 pins +- th1520: riscv: dts: thead: Add Lichee Pi 4A SDIO0 pins +- th1520: riscv: dts: thead: Add TH1520 ethernet nodes +- th1520: net: stmmac: add glue layer for T-HEAD TH1520 SoC +- th1520: dt-bindings: net: add T-HEAD dwmac support +- th1520: dt-bindings: net: snps,dwmac: allow dwmac-3.70a to set pbl properties +- th1520: riscv: dts: thead: Enable Lichee Pi 4A PWM fan +- th1520: riscv: dts: thead: Add TH1520 PVT node +- th1520: riscv: dts: thead: Add TH1520 PWM node +- th1520: pwm: add T-HEAD PWM driver +- th1520: dt-bindings: pwm: Add T-HEAD PWM controller +- th1520: gpio: dwapb: Use generic request, free and set_config +- riscv: dts: thead: Enable LicheePi 4A eMMC and microSD +- riscv: dts: thead: Enable BeagleV Ahead eMMC and microSD +- riscv: dts: thead: Add TH1520 mmc controllers and sdhci clock +- riscv: defconfig: Enable mmc and dma drivers for T-Head TH1520 +- mmc: sdhci-of-dwcmshc: Add support for T-Head TH1520 +- mmc: sdhci: add __sdhci_execute_tuning() to header +- dt-bindings: mmc: sdhci-of-dwcmhsc: Add T-Head TH1520 support +- th1520: riscv: dtb: thead: Add BeagleV Ahead LEDs +- th1520: riscv: dts: thead: Add TH1520 pinctrl settings for UART0 +- th1520: riscv: dts: thead: Adjust TH1520 GPIO labels +- th1520: riscv: dts: thead: Add TH1520 GPIO ranges +- th1520: riscv: dts: thead: Add TH1520 pin control nodes +- th1520: pinctrl: Add driver for the T-Head TH1520 SoC +- th1520: dt-bindings: pinctrl: Add thead,th1520-pinctrl bindings +- th1520: dt-bindings: gpio: dwapb: allow gpio-ranges +- sg2042: riscv: config: Enable sg2042 support +- sg2042: riscv: changing T-Head PBMT attributes +- sg2042: kconfig: Enable DW_APB_TIMER_OF in ARCH_SOPHGO +- sg2042: pcie contronller msi-x whitelist add device_id +- sg2042: nvidia hda: force msi +- sg2042: radeon hack: force 64-bit msi to fit top intc +- sg2042: amdgpu: disable rebar +- sg2042: ttm: disallow cached mapping +- sg2042: mango pci hack: broadcast when no MSI source known +- sg2042: riscv: dts: separate sg2042 mtime and mtimecmp to fit aclint format +- sg2042: dt-bindings: timer: thead,c900-aclint-mtimer: separate mtime and mtimecmp regs +- sg2042: riscv: dts: modify the PCIe range +- sg2042: drivers: clk: turn off non-essential clocks by default +- sg2042: drivers: clk: Avoid the problem of serial port garbled characters +- sg2042: mm: Modify __find_max_addr for memory hole +- sg2042: riscv: dts: Add timer apb clock +- sg2042: riscv: dts: Remove cma node +- sg2042: riscv: dts: Add uart apb clock and remove sysdma clock +- sg2042: riscv: dts: Move memory node from dts to zsbl +- sg2042: riscv: dts: Reduce bootargs +- sg2042: riscv: dts: Configure external interrupt in m mode +- sg2042: rebase: v6.6-rc1: Fix some compile warnings +- sg2042: riscv: dts: Remove nvme paremeter in bootargs +- sg2042: riscv: dtsi: confirm correspondence between PMU events and IDs +- sg2042: driver: pcie: support msix for top intr +- sg2042: driver: mmc: add config for MMC_SDHCI_SOPHGO +- sg2042: riscv: Kconfig: Set vector as default no +- sg2042: driver: soc: Add sophgo sg2042 soc support +- sg2042: driver: net: Add sophgo sg2042 soc support +- sg2042: driver: mmc: Add sophgo sg2042 soc support +- sg2042: driver: pcie: Add sophgo sg2042 soc support +- sg2042: driver: reset: Add sophgo sg2042 soc support +- sg2042: driver: pinctrl: Add sophgo sg2042 soc support +- sg2042: driver: clk: Add sophgo sg2042 soc support +- sg2042: riscv: dts: Add sophgo sg2042 soc support +- sg2042: riscv: defconfig: enable SOPHGO SoC +- sg2042: riscv: dts: sophgo: add Milk-V Pioneer board device tree +- sg2042: riscv: dts: add initial Sophgo SG2042 SoC device tree +- sg2042: dt-bindings: interrupt-controller: Add Sophgo sg2042 CLINT mswi +- sg2042: dt-bindings: timer: Add Sophgo sg2042 CLINT timer +- sg2042: dt-bindings: interrupt-controller: Add Sophgo SG2042 PLIC +- sg2042: dt-bindings: riscv: Add T-HEAD C920 compatibles +- sg2042: dt-bindings: riscv: add sophgo sg2042 bindings +- sg2042: dt-bindings: vendor-prefixes: add milkv/sophgo +- sg2042: riscv: Add SOPHGO SOC family Kconfig support + +* Thu May 09 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-25.0.0.28 +- !6930 fix general protection fault in update_cpumask +- cgroup/cpuset: fix general protection fault in update_cpumask +- !6905 v2 arm64: mmap: disable align larger anonymous mappings on THP boundaries +- arm64: mmap: disable align larger anonymous mappings on THP boundaries +- !7015 Fixes and cleanups to fs-writeback +- fs/writeback: remove unnecessary return in writeback_inodes_sb +- fs/writeback: correct comment of __wakeup_flusher_threads_bdi +- fs/writeback: only calculate dirtied_before when b_io is empty +- fs/writeback: remove unused parameter wb of finish_writeback_work +- fs/writeback: bail out if there is no more inodes for IO and queued once +- fs/writeback: avoid to writeback non-expired inode in kupdate writeback +- !6581 LoongArch: fix KASLR can not be disabled by nokaslr when boot from old BPI +- LoongArch: fix KASLR can not be disabled by nokaslr when boot from old BPI +- !6483 LoongArch: fix boot error caused by ioremap_page_range error +- LoongArch: fix boot error caused by ioremap_page_range error +- !6759 net: hns3: backport some maillist patches +- net: hns3: move constants from hclge_debugfs.h to hclge_debugfs.c +- net: hns3: dump more reg info based on ras mod +- net: hns3: add command queue trace for hns3 +- net: hns3: add support to query scc version by devlink info +- net: hns3: revert "net: hns3: dump more reg info based on ras mod" +- net: hns3: revert "net: hns3: add command queue trace for hns3" +- net: hns3: revert "net: hns3: add support to query scc version by devlink info" +- !7011 v3 bugfix patches from OLK-5.10 +- x86/quirks: Add parameter to clear MSIs early on boot +- x86/PCI: Export find_cap() to be used in early PCI code +- !6844 block: fix deadlock between bd_link_disk_holder and partition scan +- block: fix deadlock between bd_link_disk_holder and partition scan +- !5879 [OLK-6.6] Fix 'duplicate symbol rnp10_netdev_ops' error for RNPGBE driver with x86_64-allyesconfig +- RNPGBE: NET: Fix 'duplicate symbol rnp10_netdev_ops' errors +- !5836 [OLK-6.6] Fix "'snprintf' output between 10 and 37 bytes into a destination of size 24" warning for RNP driver with loongarch-allmodconfig +- RNP: NET: Fix "'snprintf' output between 10 and 37 bytes into a destination of size 24" wanrings + +* Wed May 08 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-24.0.0.27 +- !6824 Introduce CONFIG_ARCH_CUSTOM_NUMA_DISTANCE +- config: enable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64 +- arm64/numa: Support node_reclaim_distance adjust for arch +- !6877 maple_tree: avoid checking other gaps after getting the largest gap +- maple_tree: avoid checking other gaps after getting the largest gap +- !6859 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.23-6.6.30 LTS Patches +- x86: update openeuler_defconfig for x86_64 +- bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS +- net/mlx5e: Advertise mlx5 ethernet driver updates sk_buff md_dst for MACsec +- macsec: Detect if Rx skb is macsec-related for offloading devices that update md_dst +- macsec: Enable devices to advertise whether they update sk_buff md_dst during offloads +- Revert "riscv: kdump: fix crashkernel reserving problem on RISC-V" +- ovl: fix memory leak in ovl_parse_param() +- phy: qcom: qmp-combo: fix VCO div offset on v5_5nm and v6 +- i2c: smbus: fix NULL function pointer dereference +- sched/eevdf: Prevent vlag from going out of bounds in reweight_eevdf() +- sched/eevdf: Fix miscalculation in reweight_entity() when se is not curr +- sched/eevdf: Always update V if se->on_rq when reweighting +- phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered +- riscv: Fix loading 64-bit NOMMU kernels past the start of RAM +- riscv: Fix TASK_SIZE on 64-bit NOMMU +- riscv: fix VMALLOC_START definition +- dmaengine: idxd: Fix oops during rmmod on single-CPU platforms +- dma: xilinx_dpdma: Fix locking +- dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue +- phy: qcom: m31: match requested regulator name with dt schema +- phy: rockchip: naneng-combphy: Fix mux on rk3588 +- phy: rockchip-snps-pcie3: fix clearing PHP_GRF_PCIESEL_CON bits +- phy: rockchip-snps-pcie3: fix bifurcation on rk3588 +- phy: freescale: imx8m-pcie: fix pcie link-up instability +- phy: marvell: a3700-comphy: Fix hardcoded array size +- phy: marvell: a3700-comphy: Fix out of bounds read +- soundwire: amd: fix for wake interrupt handling for clockstop mode +- idma64: Don't try to serve interrupts when device is powered off +- dmaengine: tegra186: Fix residual calculation +- dmaengine: owl: fix register access functions +- x86/tdx: Preserve shared bit on mprotect() +- phy: qcom: qmp-combo: Fix VCO div offset on v3 +- phy: qcom: qmp-combo: Fix register base for QSERDES_DP_PHY_MODE +- mtd: diskonchip: work around ubsan link failure +- udp: preserve the connected status if only UDP cmsg +- fbdev: fix incorrect address computation in deferred IO +- stackdepot: respect __GFP_NOLOCKDEP allocation flag +- net: b44: set pause params only when interface is up +- ethernet: Add helper for assigning packet type when dest address does not match device address +- ACPI: CPPC: Fix access width used for PCC registers +- ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro +- ACPI: CPPC: Use access_width over bit_width for system memory accesses +- irqchip/gic-v3-its: Prevent double free on error +- drm/amdgpu: Fix leak when GPU memory allocation fails +- drm/amdgpu: Assign correct bits for SDMA HDP flush +- drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 +- arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma +- arm64: dts: qcom: sm8450: Fix the msi-map entries +- arm64: dts: qcom: sc8280xp: add missing PCIe minimum OPP +- LoongArch: Fix access error when read fault on a write-only VMA +- LoongArch: Fix callchain parse error with kernel tracepoint events +- cpu: Re-enable CPU mitigations by default for !X86 architectures +- btrfs: fix information leak in btrfs_ioctl_logical_to_ino() +- btrfs: scrub: run relocation repair when/only needed +- btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range() +- btrfs: fallback if compressed IO fails for ENOSPC +- HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up +- smb3: fix lock ordering potential deadlock in cifs_sync_mid_result +- smb3: missing lock when picking channel +- smb: client: Fix struct_group() usage in __packed structs +- mm: support page_mapcount() on page_has_type() pages +- mm: create FOLIO_FLAG_FALSE and FOLIO_TYPE_OPS macros +- mmc: sdhci-msm: pervent access to suspended controller +- mtd: rawnand: qcom: Fix broken OP_RESET_DEVICE command in qcom_misc_cmd_type_exec() +- Bluetooth: qca: fix NULL-deref on non-serdev setup +- Bluetooth: qca: fix NULL-deref on non-serdev suspend +- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 +- Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() +- rust: remove `params` from `module` macro example +- kbuild: rust: force `alloc` extern to allow "empty" Rust files +- kbuild: rust: remove unneeded `@rustc_cfg` to avoid ICE +- rust: make mutually exclusive with CFI_CLANG +- rust: init: remove impl Zeroable for Infallible +- rust: don't select CONSTRUCTORS +- x86/cpu: Fix check for RDPKRU in __show_regs() +- selftests/seccomp: Handle EINVAL on unshare(CLONE_NEWPID) +- selftests/seccomp: Change the syscall used in KILL_THREAD test +- selftests/seccomp: user_notification_addfd check nextfd is available +- Squashfs: check the inode number is not the invalid value of zero +- squashfs: convert to new timestamp accessors +- drm/amdgpu: fix visible VRAM handling during faults +- drm/amdgpu: add shared fdinfo stats +- drm: add drm_gem_object_is_shared_for_memory_stats() helper +- mm/madvise: make MADV_POPULATE_(READ|WRITE) handle VM_FAULT_RETRY properly +- mm/gup: explicitly define and check internal GUP flags, disallow FOLL_TOUCH +- KVM: x86/pmu: Set enable bits for GP counters in PERF_GLOBAL_CTRL at "RESET" +- KVM: x86/pmu: Zero out PMU metadata on AMD if PMU is disabled +- af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc(). +- tls: fix lockless read of strp->msg_ready in ->poll +- net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets +- ice: fix LAG and VF lock dependency in ice_reset_vf() +- iavf: Fix TC config comparison with existing adapter TC config +- i40e: Report MFS in decimal base instead of hex +- i40e: Do not use WQ_MEM_RECLAIM flag for workqueue +- net: ti: icssg-prueth: Fix signedness bug in prueth_init_rx_chns() +- net: phy: dp83869: Fix MII mode failure +- netfilter: nf_tables: honor table dormant flag from netdev release event path +- ARM: dts: imx6ull-tarragon: fix USB over-current polarity +- eth: bnxt: fix counting packets discarded due to OOM and netpoll +- mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work +- mlxsw: spectrum_acl_tcam: Fix incorrect list API usage +- mlxsw: spectrum_acl_tcam: Fix warning during rehash +- mlxsw: spectrum_acl_tcam: Fix memory leak during rehash +- mlxsw: spectrum_acl_tcam: Rate limit error message +- mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash +- mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update +- mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work +- mlxsw: spectrum_acl_tcam: Fix race in region ID allocation +- mlxsw: Use refcount_t for reference counting +- net: openvswitch: Fix Use-After-Free in ovs_ct_exit +- ipvs: Fix checksumming on GSO of SCTP packets +- Bluetooth: qca: set power_ctrl_enabled on NULL returned by gpiod_get_optional() +- Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor +- Bluetooth: btusb: mediatek: Fix double free of skb in coredump +- Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID +- Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE +- Bluetooth: btusb: Fix triggering coredump implementation for QCA +- gpio: tegra186: Fix tegra186_gpio_is_accessible() check +- net: phy: mediatek-ge-soc: follow netdev LED trigger semantics +- net: gtp: Fix Use-After-Free in gtp_dellink +- net: usb: ax88179_178a: stop lying about skb->truesize +- ipv4: check for NULL idev in ip_route_use_hint() +- net: fix sk_memory_allocated_{add|sub} vs softirqs +- net: make SK_MEMORY_PCPU_RESERV tunable +- tools: ynl: don't ignore errors in NLMSG_DONE messages +- ax25: Fix netdev refcount issue +- NFC: trf7970a: disable all regulators on removal +- net: dsa: mv88e6xx: fix supported_interfaces setup in mv88e6250_phylink_get_caps() +- cxl/core: Fix potential payload size confusion in cxl_mem_get_poison() +- bnxt_en: Fix the PCI-AER routines +- bnxt_en: refactor reset close code +- bridge/br_netlink.c: no need to return void function +- icmp: prevent possible NULL dereferences from icmp_build_probe() +- ARM: dts: microchip: at91-sama7g5ek: Replace regulator-suspend-voltage with the valid property +- mlxsw: core_env: Fix driver initialization with old firmware +- mlxsw: core: Unregister EMAD trap using FORWARD action +- net: bcmasp: fix memory leak when bringing down interface +- vxlan: drop packets from invalid src-address +- net: libwx: fix alloc msix vectors failed +- wifi: mac80211: fix unaligned le16 access +- wifi: mac80211: remove link before AP +- wifi: mac80211_hwsim: init peer measurement result +- drm/gma500: Remove lid code +- wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd +- wifi: iwlwifi: mvm: remove old PASN station when adding a new one +- wifi: mac80211: split mesh fast tx cache into local/proxied/forwarded +- wifi: mac80211: clean up assignments to pointer cache. +- ARC: [plat-hsdk]: Remove misplaced interrupt-cells property +- gpio: tangier: Use correct type for the IRQ chip data +- arm64: dts: qcom: sc8180x: Fix ss_phy_irq for secondary USB controller +- arm64: dts: rockchip: regulator for sd needs to be always on for BPI-R2Pro +- arm64: dts: mediatek: mt2712: fix validation errors +- arm64: dts: mediatek: mt7986: prefix BPI-R3 cooling maps with "map-" +- arm64: dts: mediatek: mt7986: drop invalid thermal block clock +- arm64: dts: mediatek: mt7986: reorder nodes +- arm64: dts: mediatek: mt7986: drop "#reset-cells" from Ethernet controller +- arm64: dts: mediatek: mt7986: drop invalid properties from ethsys +- arm64: dts: mediatek: mt7986: reorder properties +- arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block +- arm64: dts: mediatek: mt7622: fix ethernet controller "compatible" +- arm64: dts: mediatek: mt7622: fix IR nodename +- arm64: dts: mediatek: mt7622: fix clock controllers +- arm64: dts: mediatek: mt8183-kukui: Use default min voltage for MT6358 +- arm64: dts: mediatek: mt8195-cherry: Update min voltage constraint for MT6315 +- arm64: dts: mediatek: mt8192-asurada: Update min voltage constraint for MT6315 +- arm64: dts: mediatek: cherry: Describe CPU supplies +- arm64: dts: mediatek: cherry: Add platform thermal configuration +- arm64: dts: mediatek: mt8195: Add missing gce-client-reg to mutex1 +- arm64: dts: mediatek: mt8195: Add missing gce-client-reg to mutex +- arm64: dts: mediatek: mt8195: Add missing gce-client-reg to vpp/vdosys +- arm64: dts: mediatek: mt8192: Add missing gce-client-reg to mutex +- arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg +- arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro dts +- arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma +- arm64: dts: rockchip: fix alphabetical ordering RK3399 puma +- arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 Puma +- arm64: dts: rockchip: set PHY address of MT7531 switch to 0x1f +- HID: logitech-dj: allow mice to use all types of reports +- HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc +- cifs: reinstate original behavior again for forceuid/forcegid +- smb: client: fix rename(2) regression against samba +- cifs: Fix reacquisition of volume cookie on still-live connection +- selftests: kselftest: Fix build failure with NOLIBC +- thunderbolt: Reset only non-USB4 host routers in resume +- PCI/ASPM: Fix deadlock when enabling ASPM +- ksmbd: common: use struct_group_attr instead of struct_group for network_open_info +- ksmbd: clear RENAME_NOREPLACE before calling vfs_rename +- ksmbd: validate request buffer size in smb2_allocate_rsp_buf() +- ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf +- powerpc/ftrace: Ignore ftrace locations in exit text sections +- virtio_net: Do not send RSS key if it is not supported +- net: dsa: mt7530: fix enabling EEE on MT7531 switch on all boards +- net: dsa: mt7530: fix improper frames on all 25MHz and 40MHz XTAL MT7530 +- nilfs2: fix OOB in nilfs_set_de_type +- bootconfig: use memblock_free_late to free xbc memory to buddy +- nouveau: fix instmem race condition around ptr stores +- drm/vmwgfx: Fix crtc's atomic check conditional +- drm/vmwgfx: Sort primary plane formats by order of preference +- drm/vmwgfx: Fix prime import/export +- drm/amdgpu: remove invalid resource->start check v2 +- drm/amdkfd: Fix memory leak in create_process failure +- drm/amdgpu: validate the parameters of bo mapping operations more clearly +- fuse: fix leaked ENOSYS error on first statx call +- mm/shmem: inline shmem_is_huge() for disabled transparent hugepages +- mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled +- mm,swapops: update check in is_pfn_swap_entry for hwpoison entries +- mm/userfaultfd: allow hugetlb change protection upon poison entry +- init/main.c: Fix potential static_command_line memory overflow +- arm64: hibernate: Fix level3 translation fault in swsusp_save() +- arm64/head: Disable MMU at EL2 before clearing HCR_EL2.E2H +- KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status +- KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms +- KVM: x86/pmu: Disable support for adaptive PEBS +- KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel compatible +- sched: Add missing memory barrier in switch_mm_cid +- fs: sysfs: Fix reference leak in sysfs_break_active_protection() +- speakup: Avoid crash on very long word +- mei: me: disable RPL-S on SPS and IGN firmwares +- usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error +- usb: Disable USB3 LPM at shutdown +- usb: dwc2: host: Fix dereference issue in DDMA completion flow. +- Revert "usb: cdc-wdm: close race between read and workqueue" +- USB: serial: option: add Telit FN920C04 rmnet compositions +- USB: serial: option: add Rolling RW101-GL and RW135-GL support +- USB: serial: option: support Quectel EM060K sub-models +- USB: serial: option: add Lonsung U8300/U9300 product +- USB: serial: option: add support for Fibocom FM650/FG650 +- USB: serial: option: add Fibocom FM135-GL variants +- serial: core: Fix missing shutdown and startup for serial base port +- serial: core: Clearing the circular buffer before NULLifying it +- serial: stm32: Reset .throttled state in .startup() +- serial: stm32: Return IRQ_NONE in the ISR if no handling happend +- serial/pmac_zilog: Remove flawed mitigation for rx irq flood +- serial: mxs-auart: add spinlock around changing cts state +- comedi: vmk80xx: fix incomplete endpoint checking +- thunderbolt: Fix wake configurations after device unplug +- thunderbolt: Avoid notify PM core about runtime PM resume +- binder: check offset alignment in binder_get_object() +- ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC +- ALSA: hda/realtek: Add quirks for Huawei Matebook D14 NBLB-WAX9N +- ALSA: hda/tas2781: Add new vendor_id and subsystem_id to support ThinkPad ICE-1 +- ALSA: hda/tas2781: correct the register for pow calibrated data +- ALSA: seq: ump: Fix conversion from MIDI2 to MIDI1 UMP messages +- net/mlx5: E-switch, store eswitch pointer before registering devlink_param +- x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ +- x86/bugs: Fix BHI retpoline check +- clk: mediatek: Do a runtime PM get on controllers during probe +- clk: Get runtime PM before walking tree for clk_summary +- clk: Show active consumers of clocks in debugfs +- clk: Get runtime PM before walking tree during disable_unused +- clk: Initialize struct clk_core kref earlier +- clk: Remove prepare_lock hold assertion in __clk_release() +- interconnect: Don't access req_list while it's being manipulated +- platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes +- usb: new quirk to reduce the SET_ADDRESS request timeout +- usb: xhci: Add timeout argument in address_device USB HCD callback +- drm: panel-orientation-quirks: Add quirk for Lenovo Legion Go +- ALSA: scarlett2: Rename scarlett_gen2 to scarlett2 +- PCI: Simplify pcie_capability_clear_and_set_word() to ..._clear_word() +- PCI/DPC: Use FIELD_GET() +- ALSA: scarlett2: Add Focusrite Clarett 2Pre and 4Pre USB support +- ALSA: scarlett2: Add Focusrite Clarett+ 2Pre and 4Pre support +- ALSA: scarlett2: Add correct product series name to messages +- ALSA: scarlett2: Default mixer driver to enabled +- thunderbolt: Reset topology created by the boot firmware +- thunderbolt: Make tb_switch_reset() support Thunderbolt 2, 3 and USB4 routers +- thunderbolt: Introduce tb_path_deactivate_hop() +- thunderbolt: Introduce tb_port_reset() +- ASoC: ti: Convert Pandora ASoC to GPIO descriptors +- ALSA: scarlett2: Add support for Clarett 8Pre USB +- ALSA: scarlett2: Move USB IDs out from device_info struct +- drm/radeon: make -fstrict-flex-arrays=3 happy +- drm/panel: visionox-rm69299: don't unregister DSI device +- drm: nv04: Fix out of bounds access +- s390/cio: fix race condition during online processing +- s390/qdio: handle deferred cc1 +- perf lock contention: Add a missing NULL check +- RDMA/mlx5: Fix port number for counter query in multi-port configuration +- RDMA/cm: Print the old state when cm_destroy_id gets timeout +- RDMA/rxe: Fix the problem "mutex_destroy missing" +- drm/i915/mst: Limit MST+DSC to TGL+ +- net: ethernet: ti: am65-cpsw-nuss: cleanup DMA Channels before using them +- net: ethernet: mtk_eth_soc: fix WED + wifi reset +- gpiolib: swnode: Remove wrong header inclusion +- s390/ism: Properly fix receive message buffer allocation +- net: dsa: mt7530: fix port mirroring for MT7988 SoC switch +- net: dsa: mt7530: fix mirroring frames received on local port +- tun: limit printing rate when illegal packet received by tun dev +- ice: Fix checking for unsupported keys on non-tunnel device +- ice: tc: allow zero flags in parsing tc flower +- ice: tc: check src_vsi in case of traffic from VF +- net: stmmac: Fix IP-cores specific MAC capabilities +- net: stmmac: Fix max-speed being ignored on queue re-init +- net: stmmac: Apply half-duplex-less constraint for DW QoS Eth only +- octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation +- net: change maximum number of UDP segments to 128 +- net/mlx5e: Prevent deadlock while disabling aRFS +- net/mlx5: Lag, restore buckets number to default after hash LAG deactivation +- net: sparx5: flower: fix fragment flags handling +- af_unix: Don't peek OOB data without MSG_OOB. +- af_unix: Call manage_oob() for every skb in unix_stream_read_generic(). +- netfilter: flowtable: incorrect pppoe tuple +- netfilter: flowtable: validate pppoe header +- netfilter: nft_set_pipapo: do not free live element +- netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() +- netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() +- scsi: ufs: qcom: Add missing interconnect bandwidth values for Gear 5 +- arm64: tlb: Fix TLBI RANGE operand +- arm64/mm: Modify range-based tlbi to decrement scale +- net: usb: ax88179_178a: avoid writing the mac address before first reading +- scsi: core: Fix handling of SCMD_FAIL_IF_RECOVERING +- random: handle creditable entropy from atomic process context +- selftests/ftrace: Limit length in subsystem-enable tests +- SUNRPC: Fix rpcgss_context trace event acceptor field +- drm/i915/vma: Fix UAF on destroy against retire race +- io_uring: Fix io_cqring_wait() not restoring sigmask on get_timespec64() failure +- media: videobuf2: request more buffers for vb2_read +- drm/msm/dpu: populate SSPP scaler block version +- selftests: timers: Fix posix_timers ksft_print_msg() warning +- ceph: redirty page before returning AOP_WRITEPAGE_ACTIVATE +- ceph: rename _to_client() to _to_fs_client() +- ceph: pass the mdsc to several helpers +- drm/amd/display: Do not recursively call manual trigger programming +- selftests/timers/posix_timers: Reimplement check_timer_distribution() +- selftests: timers: Convert posix_timers test to generate KTAP output +- drm/i915: Disable live M/N updates when using bigjoiner +- drm/i915: Adjust seamless_m_n flag behaviour +- drm/i915: Enable VRR later during fastsets +- drm/i915: Extract intel_crtc_vblank_evade_scanlines() +- drm/i915: Change intel_pipe_update_{start,end}() calling convention +- drm/i915/cdclk: Fix voltage_level programming edge case +- drm/i915/mst: Reject FEC+MST on ICL +- drm/i915: Fix FEC pipe A vs. DDI A mixup +- smb: client: refresh referral without acquiring refpath_lock +- smb: client: guarantee refcounted children from parent session +- smb3: show beginning time for per share stats +- smb: client: fix UAF in smb2_reconnect_server() +- smb: client: remove extra @chan_count check in __cifs_put_smb_ses() +- drm/amd/display: fix disable otg wa logic in DCN316 +- drm/amd/display: Set VSC SDP Colorimetry same way for MST and SST +- drm/amd/display: Program VSC SDP colorimetry for all DP sinks >= 1.4 +- drm/amdgpu: fix incorrect number of active RBs for gfx11 +- drm/amdgpu: always force full reset for SOC21 +- drm/amdgpu: Reset dGPU if suspend got aborted +- drm/i915: Disable port sync when bigjoiner is used +- drm/i915/cdclk: Fix CDCLK programming order when pipes are active +- x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI +- x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto +- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation +- x86/bugs: Fix BHI handling of RRSBA +- x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' +- x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES +- x86/bugs: Fix BHI documentation +- x86/bugs: Fix return type of spectre_bhi_state() +- irqflags: Explicitly ignore lockdep_hrtimer_exit() argument +- x86/apic: Force native_apic_mem_read() to use the MOV instruction +- selftests: timers: Fix abs() warning in posix_timers test +- x86/cpu: Actually turn off mitigations by default for SPECULATION_MITIGATIONS=n +- perf/x86: Fix out of range data +- vhost: Add smp_rmb() in vhost_enable_notify() +- vhost: Add smp_rmb() in vhost_vq_avail_empty() +- arm64: dts: imx8-ss-dma: fix spi lpcg indices +- arm64: dts: imx8-ss-lsio: fix pwm lpcg indices +- arm64: dts: imx8-ss-conn: fix usb lpcg indices +- arm64: dts: imx8-ss-dma: fix adc lpcg indices +- arm64: dts: imx8-ss-dma: fix can lpcg indices +- arm64: dts: imx8qm-ss-dma: fix can lpcg indices +- drm/client: Fully protect modes[] with dev->mode_config.mutex +- drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr() +- drm/ast: Fix soft lockup +- drm/amdkfd: Reset GPU on queue preemption failure +- drm/i915/vrr: Disable VRR when using bigjoiner +- drm/vmwgfx: Enable DMA mappings with SEV +- accel/ivpu: Fix deadlock in context_xa +- scsi: sg: Avoid race in error handling & drop bogus warn +- scsi: sg: Avoid sg device teardown race +- kprobes: Fix possible use-after-free issue on kprobe registration +- io_uring/net: restore msg_control on sendzc retry +- btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans +- btrfs: record delayed inode root in transaction +- btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations +- btrfs: qgroup: correctly model root qgroup rsv in convert +- selftests: mptcp: use += operator to append strings +- iommu/vt-d: Allocate local memory for page request queue +- iommu/vt-d: Fix wrong use of pasid config +- tracing: hide unused ftrace_event_id_fops +- net: ena: Set tx_info->xdpf value to NULL +- net: ena: Use tx_ring instead of xdp_ring for XDP channel TX +- net: ena: Pass ena_adapter instead of net_device to ena_xmit_common() +- net: ena: Move XDP code to its new files +- net: ena: Fix incorrect descriptor free behavior +- net: ena: Wrong missing IO completions check order +- net: ena: Fix potential sign extension issue +- af_unix: Fix garbage collector racing against connect() +- af_unix: Do not use atomic ops for unix_sk(sk)->inflight. +- net: dsa: mt7530: trap link-local frames regardless of ST Port State +- Revert "s390/ism: fix receive message buffer allocation" +- net: sparx5: fix wrong config being used when reconfiguring PCS +- net/mlx5e: Do not produce metadata freelist entries in Tx port ts WQE xmit +- net/mlx5e: HTB, Fix inconsistencies with QoS SQs number +- net/mlx5e: Fix mlx5e_priv_init() cleanup flow +- net/mlx5: Correctly compare pkt reformat ids +- net/mlx5: Properly link new fs rules into the tree +- net/mlx5: offset comp irq index in name by one +- net/mlx5: Register devlink first under devlink lock +- net/mlx5: SF, Stop waiting for FW as teardown was called +- netfilter: complete validation of user input +- Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit +- Bluetooth: SCO: Fix not validating setsockopt user input +- Bluetooth: hci_sync: Fix using the same interval and window for Coded PHY +- Bluetooth: hci_sync: Use QoS to determine which PHY to scan +- Bluetooth: ISO: Don't reject BT_ISO_QOS if parameters are unset +- Bluetooth: ISO: Align broadcast sync_timeout with connection timeout +- ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr +- ipv4/route: avoid unused-but-set-variable warning +- ipv6: fib: hide unused 'pn' variable +- octeontx2-af: Fix NIX SQ mode and BP config +- af_unix: Clear stale u->oob_skb. +- net: ks8851: Handle softirqs at the end of IRQ thread to fix hang +- net: ks8851: Inline ks8851_rx_skb() +- bnxt_en: Reset PTP tx_avail after possible firmware reset +- bnxt_en: Fix error recovery for RoCE ulp client +- bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init() +- s390/ism: fix receive message buffer allocation +- geneve: fix header validation in geneve[6]_xmit_skb +- block: fix q->blkg_list corruption during disk rebind +- octeontx2-pf: Fix transmit scheduler resource leak +- xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING +- u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file +- net: openvswitch: fix unwanted error log on timeout policy probing +- scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() +- nouveau: fix function cast warning +- Revert "drm/qxl: simplify qxl_fence_wait" +- cxl/core: Fix initialization of mbox_cmd.size_out in get event +- arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order +- drm/msm/dpu: don't allow overriding data from catalog +- cxl/core/regs: Fix usage of map->reg_type in cxl_decode_regblock() before assigned +- cxl/mem: Fix for the index of Clear Event Record Handle +- firmware: arm_scmi: Make raw debugfs entries non-seekable +- ARM: OMAP2+: fix USB regression on Nokia N8x0 +- mmc: omap: restore original power up/down steps +- mmc: omap: fix deferred probe +- mmc: omap: fix broken slot switch lookup +- ARM: OMAP2+: fix N810 MMC gpiod table +- ARM: OMAP2+: fix bogus MMC GPIO labels on Nokia N8x0 +- media: cec: core: remove length check of Timer Status +- PM: s2idle: Make sure CPUs will wakeup directly on resume +- ACPI: scan: Do not increase dep_unmet for already met dependencies +- platform/chrome: cros_ec_uart: properly fix race condition +- drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 +- Bluetooth: Fix memory leak in hci_req_sync_complete() +- ring-buffer: Only update pages_touched when a new page is touched +- raid1: fix use-after-free for original bio in raid1_write_request() +- ARM: dts: imx7s-warp: Pass OV2680 link-frequencies +- batman-adv: Avoid infinite loop trying to resize local TT +- ata: libata-scsi: Fix ata_scsi_dev_rescan() error path +- ata: libata-core: Allow command duration limits detection for ACS-4 drives +- smb3: fix Open files on server counter going negative +- drm: Check polling initialized before enabling in drm_helper_probe_single_connector_modes +- Revert "drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()" +- VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() +- net: mpls: error out if inner headers are not set +- Bluetooth: btintel: Fixe build regression +- platform/x86: intel-vbtn: Update tablet mode switch at end of probe +- randomize_kstack: Improve entropy diffusion +- media: mediatek: vcodec: adding lock to protect encoder context list +- media: mediatek: vcodec: adding lock to protect decoder context list +- media: mediatek: vcodec: Fix oops when HEVC init fails +- selftests: mptcp: display simult in extra_msg +- gcc-plugins/stackleak: Avoid .head.text section +- ALSA: hda/realtek: Add quirks for some Clevo laptops +- fbmon: prevent division by zero in fb_videomode_from_videomode() +- drivers/nvme: Add quirks for device 126f:2262 +- modpost: fix null pointer dereference +- io_uring: clear opcode specific data for an early failure +- fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 +- x86/xen: attempt to inflate the memory balloon on PVH +- ASoC: soc-core.c: Skip dummy codec when adding platforms +- thermal/of: Assume polling-delay(-passive) 0 when absent +- ASoC: amd: yc: Fix non-functional mic on ASUS M7600RE +- usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined +- usb: typec: tcpci: add generic tcpci fallback compatible +- thunderbolt: Keep the domain powered when USB4 port is in redrive mode +- usb: typec: ucsi: Limit read size on v1.2 +- usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR +- bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state +- tools: iio: replace seekdir() in iio_generic_buffer +- ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment +- Input: xpad - add support for Snakebyte GAMEPADs +- ktest: force $buildonly = 1 for 'make_warnings_file' test type +- ALSA: hda/realtek: Add quirk for Lenovo Yoga 9 14IMH9 +- platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet +- Input: allocate keycode for Display refresh rate toggle +- Input: imagis - use FIELD_GET where applicable +- RDMA/cm: add timeout to cm_destroy_id wait +- block: prevent division by zero in blk_rq_stat_sum() +- input/touchscreen: imagis: Correct the maximum touch area value +- libperf evlist: Avoid out-of-bounds access +- Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default" +- PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge +- SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int +- drm: Check output polling initialized before disabling +- drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init() +- HID: input: avoid polling stylus battery on Chromebook Pompom +- i2c: designware: Fix RX FIFO depth define on Wangxun 10Gb NIC +- accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings +- drm/amd/display: Fix nanosec stat overflow +- ext4: forbid commit inconsistent quota data when errors=remount-ro +- ext4: add a hint for block bitmap corrupt state in mb_groups +- ASoC: Intel: avs: Populate board selection with new I2S entries +- ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter +- media: sta2x11: fix irq handler cast +- Julia Lawall reported this null pointer dereference, this should fix it. +- rcu-tasks: Repair RCU Tasks Trace quiescence check +- rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock() +- ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710) laptops +- isofs: handle CDs with bad root inode but good Joliet root directory +- scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() +- sysv: don't call sb_bread() with pointers_lock held +- pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs +- drm/ttm: return ENOSPC from ttm_bo_mem_space v3 +- ASoC: SOF: amd: Optimize quirk for Valve Galileo +- drm: panel-orientation-quirks: Add quirk for GPD Win Mini +- Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails +- drm/vc4: don't check if plane->state->fb == state->fb +- Bluetooth: Add new quirk for broken read key length on ATS2851 +- Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922 +- Bluetooth: btintel: Fix null ptr deref in btintel_read_version +- net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() +- ice: use relative VSI index for VFs instead of PF VSI number +- btrfs: send: handle path ref underflow in header iterate_inode_ref() +- btrfs: export: handle invalid inode or root reference in btrfs_get_parent() +- btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() +- wifi: cfg80211: check A-MSDU format more carefully +- wifi: iwlwifi: Add missing MODULE_FIRMWARE() for *.pnvm +- overflow: Allow non-type arg to type_max() and type_min() +- cpufreq: Don't unregister cpufreq cooling on CPU hotplug +- wifi: ath11k: decrease MHI channel buffer length to 8KB +- dma-direct: Leak pages on dma_set_decrypted() failure +- net: pcs: xpcs: Return EINVAL in the internal methods +- tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num() +- pstore/zone: Add a null pointer check to the psz_kmsg_read +- ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS +- wifi: mt76: mt7996: add locking for accessing mapped registers +- wifi: mt76: mt7996: disable AMSDU for non-data frames +- wifi: mt76: mt7915: add locking for accessing mapped registers +- wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro +- firmware: tegra: bpmp: Return directly after a failed kzalloc() in get_filename() +- net: skbuff: add overflow debug check to pull/push helpers +- ionic: set adminq irq affinity +- pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain +- pmdomain: ti: Add a null pointer check to the omap_prm_domain_init +- net: add netdev_lockdep_set_classes() to virtual drivers +- arm64: dts: rockchip: fix rk3399 hdmi ports node +- arm64: dts: rockchip: fix rk3328 hdmi ports node +- ARM: dts: rockchip: fix rk322x hdmi ports node +- ARM: dts: rockchip: fix rk3288 hdmi ports node +- cpuidle: Avoid potential overflow in integer multiplication +- panic: Flush kernel log buffer at the end +- printk: For @suppress_panic_printk check for other CPU in panic +- wifi: iwlwifi: pcie: Add the PCI device id for new hardware +- VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() +- wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor +- net: phy: phy_device: Prevent nullptr exceptions on ISR +- net: stmmac: dwmac-starfive: Add support for JH7100 SoC +- bnx2x: Fix firmware version string character counts +- wifi: rtw89: fix null pointer access when abort scan +- wifi: ath9k: fix LNA selection in ath_ant_try_scan() +- amdkfd: use calloc instead of kzalloc to avoid integer overflow +- x86: set SPECTRE_BHI_ON as default +- KVM: x86: Add BHI_NO +- x86/bhi: Mitigate KVM by default +- x86/bhi: Add BHI mitigation knob +- x86/bhi: Enumerate Branch History Injection (BHI) bug +- x86/bhi: Define SPEC_CTRL_BHI_DIS_S +- x86/bhi: Add support for clearing branch history at syscall entry +- x86/syscall: Don't force use of indirect calls for system calls +- x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file +- x86/boot: Move mem_encrypt= parsing to the decompressor +- x86/efistub: Remap kernel text read-only before dropping NX attribute +- x86/sev: Move early startup code into .head.text section +- x86/sme: Move early SME kernel encryption handling into .head.text +- efi/libstub: Add generic support for parsing mem_encrypt= +- x86/head/64: Move the __head definition to <asm/init.h> +- bpf: put uprobe link's path and task in release callback +- mptcp: don't account accept() of non-MPC client as fallback to TCP +- mptcp: don't overwrite sock_ops in mptcp_is_tcpsk() +- selftests: mptcp: connect: fix shellcheck warnings +- of: module: prevent NULL pointer dereference in vsnprintf() +- Revert "x86/mpparse: Register APIC address only once" +- drm/i915/gt: Enable only one CCS for compute workload +- drm/i915/gt: Do not generate the command streamer for all the CCS +- drm/i915/gt: Disable HW load balancing for CCS +- smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() +- smb: client: fix potential UAF in smb2_is_network_name_deleted() +- smb: client: fix potential UAF in is_valid_oplock_break() +- smb: client: fix potential UAF in smb2_is_valid_lease_break() +- smb: client: fix potential UAF in smb2_is_valid_oplock_break() +- smb: client: fix potential UAF in cifs_dump_full_key() +- smb: client: fix potential UAF in cifs_stats_proc_show() +- smb: client: fix potential UAF in cifs_stats_proc_write() +- smb: client: fix potential UAF in cifs_debug_files_proc_show() +- smb3: retrying on failed server close +- smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex +- smb: client: handle DFS tcons in cifs_construct_tcon() +- riscv: process: Fix kernel gp leakage +- riscv: Fix spurious errors from __get/put_kernel_nofault +- s390/entry: align system call table on 8 bytes +- selftests/mm: include strings.h for ffsl +- mm/secretmem: fix GUP-fast succeeding on secretmem folios +- arm64/ptrace: Use saved floating point state type to determine SVE layout +- perf/x86/intel/ds: Don't clear ->pebs_data_cfg for the last PEBS event +- x86/coco: Require seeding RNG with RDRAND on CoCo systems +- x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() +- x86/mm/pat: fix VM_PAT handling in COW mappings +- of: dynamic: Synchronize of_changeset_destroy() with the devlink removals +- driver core: Introduce device_link_wait_removal() +- io_uring/kbuf: hold io_buffer_list reference over mmap +- io_uring: use private workqueue for exit work +- io_uring/kbuf: protect io_buffer_list teardown with a reference +- io_uring/kbuf: get rid of bl->is_ready +- io_uring/kbuf: get rid of lower BGID lists +- ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone +- ALSA: hda/realtek - Fix inactive headset mic jack +- ksmbd: do not set SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1 +- ksmbd: validate payload size in ipc response +- ksmbd: don't send oplock break if rename fails +- gpio: cdev: fix missed label sanitizing in debounce_setup() +- gpio: cdev: check for NULL labels when sanitizing them for irqs +- x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk +- ice: fix typo in assignment +- nfsd: hold a lighter-weight client reference over CB_RECALL_ANY +- riscv: Disable preemption when using patch_map() +- ASoC: SOF: amd: fix for false dsp interrupts +- ata: sata_mv: Fix PCI device ID table declaration compilation warning +- spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe +- cifs: Fix caching to try to do open O_WRONLY as rdwr on server +- Revert "ALSA: emu10k1: fix synthesizer sample playback position and caching" +- scsi: mylex: Fix sysfs buffer lengths +- ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit +- regmap: maple: Fix uninitialized symbol 'ret' warnings +- ASoC: amd: acp: fix for acp_init function error handling +- spi: s3c64xx: Use DMA mode from fifo size +- spi: s3c64xx: determine the fifo depth only once +- spi: s3c64xx: allow full FIFO masks +- spi: s3c64xx: define a magic value +- spi: s3c64xx: remove else after return +- spi: s3c64xx: explicitly include <linux/bits.h> +- spi: s3c64xx: sort headers alphabetically +- spi: s3c64xx: Extract FIFO depth calculation to a dedicated macro +- ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw +- ASoC: rt722-sdca-sdw: fix locking sequence +- ASoC: rt712-sdca-sdw: fix locking sequence +- ASoC: rt711-sdw: fix locking sequence +- ASoC: rt711-sdca: fix locking sequence +- ASoC: rt5682-sdw: fix locking sequence +- drm/prime: Unbreak virtgpu dma-buf export +- nouveau/uvmm: fix addr/range calcs for remap operations +- drm/panfrost: fix power transition timeout warnings +- ALSA: hda: cs35l56: Add ACPI device match tables +- regmap: maple: Fix cache corruption in regcache_maple_drop() +- RISC-V: Update AT_VECTOR_SIZE_ARCH for new AT_MINSIGSTKSZ +- drivers/perf: riscv: Disable PERF_SAMPLE_BRANCH_* while not supported +- ASoC: wm_adsp: Fix missing mutex_lock in wm_adsp_write_ctl() +- 9p: Fix read/write debug statements to report server reply +- fs/pipe: Fix lockdep false-positive in watchqueue pipe_write() +- KVM: SVM: Add support for allowing zero SEV ASIDs +- KVM: SVM: Use unsigned integers when dealing with ASIDs +- net: ravb: Always update error counters +- net: ravb: Always process TX descriptor ring +- net: ravb: Let IP-specific receive function to interrogate descriptors +- e1000e: move force SMBUS from enable ulp function to avoid PHY loss issue +- e1000e: Minor flow correction in e1000_shutdown function +- e1000e: Workaround for sporadic MDI error on Meteor Lake systems +- intel: legacy: field get conversion +- intel: add bit macro includes where needed +- i40e: Remove circular header dependencies and fix headers +- i40e: Split i40e_osdep.h +- i40e: Move memory allocation structures to i40e_alloc.h +- i40e: Simplify memory allocation functions +- virtchnl: Add header dependencies +- i40e: Refactor I40E_MDIO_CLAUSE* macros +- i40e: Remove back pointer from i40e_hw structure +- i40e: Enforce software interrupt during busy-poll exit +- i40e: Remove _t suffix from enum type names +- drm/amd: Flush GFXOFF requests in prepare stage +- drm/amd: Add concept of running prepare_suspend() sequence for IP blocks +- drm/amd: Evict resources during PM ops prepare() callback +- drm/amd/display: Prevent crash when disable stream +- drm/amd/display: Fix DPSTREAM CLK on and off sequence +- usb: typec: ucsi: Fix race between typec_switch and role_switch +- i40e: fix vf may be used uninitialized in this function warning +- i40e: fix i40e_count_filters() to count only active/new filters +- octeontx2-af: Add array index check +- octeontx2-pf: check negative error code in otx2_open() +- octeontx2-af: Fix issue with loading coalesced KPU profiles +- udp: prevent local UDP tunnel packets from being GROed +- udp: do not transition UDP GRO fraglist partial checksums to unnecessary +- udp: do not accept non-tunnel GSO skbs landing in a tunnel +- r8169: skip DASH fw status checks when DASH is disabled +- mlxbf_gige: stop interface during shutdown +- ipv6: Fix infinite recursion in fib6_dump_done(). +- ax25: fix use-after-free bugs caused by ax25_ds_del_timer +- tcp: Fix bind() regression for v6-only wildcard and v4(-mapped-v6) non-wildcard addresses. +- selftests: reuseaddr_conflict: add missing new line at the end of the output +- erspan: make sure erspan_base_hdr is present in skb->head +- i40e: Fix VF MAC filter removal +- ice: fix enabling RX VLAN filtering +- gro: fix ownership transfer +- selftests: net: gro fwd: update vxlan GRO test expectations +- net: dsa: mv88e6xxx: fix usable ports on 88e6020 +- net: phy: micrel: Fix potential null pointer dereference +- net: fec: Set mac_managed_pm during probe +- net: txgbe: fix i2c dev name cannot match clkdev +- net: phy: micrel: lan8814: Fix when enabling/disabling 1-step timestamping +- net: stmmac: fix rx queue priority assignment +- net/sched: fix lockdep splat in qdisc_tree_reduce_backlog() +- net: dsa: sja1105: Fix parameters order in sja1110_pcs_mdio_write_c45() +- net/sched: act_skbmod: prevent kernel-infoleak +- KVM: arm64: Ensure target address is granule-aligned for range TLBI +- x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO +- bpf, sockmap: Prevent lock inversion deadlock in map delete elem +- vboxsf: Avoid an spurious warning if load_nls_xxx() fails +- netfilter: validate user input for expected length +- netfilter: nf_tables: discard table flag update with pending basechain deletion +- netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() +- netfilter: nf_tables: flush pending destroy work before exit_net release +- netfilter: nf_tables: reject new basechain after table flag update +- x86/bugs: Fix the SRSO mitigation on Zen3/4 +- x86/nospec: Refactor UNTRAIN_RET[_*] +- x86/srso: Disentangle rethunk-dependent options +- x86/srso: Improve i-cache locality for alias mitigation +- vsock/virtio: fix packet delivery to tap device +- net: mana: Fix Rx DMA datasize and skb_over_panic +- net: usb: ax88179_178a: avoid the interface always configured as random address +- net/rds: fix possible cp null dereference +- xen-netfront: Add missing skb_mark_for_recycle +- selftests: mptcp: join: fix dev in check_endpoint +- netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path +- netfilter: nf_tables: release batch on table validation from abort path +- Bluetooth: Fix TOCTOU in HCI debugfs implementation +- Bluetooth: hci_event: set the conn encrypted before conn establishes +- Bluetooth: add quirk for broken address properties +- Bluetooth: qca: fix device-address endianness +- arm64: dts: qcom: sc7180-trogdor: mark bluetooth address as broken +- Revert "Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT" +- x86/bpf: Fix IP after emitting call depth accounting +- r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d +- selinux: avoid dereference of garbage after mount failure +- KVM: arm64: Fix host-programmed guest events in nVHE +- RISC-V: KVM: Fix APLIC in_clrip[x] read emulation +- RISC-V: KVM: Fix APLIC setipnum_le/be write emulation +- gpio: cdev: sanitize the label before requesting the interrupt +- modpost: do not make find_tosym() return NULL +- btrfs: fix race when detecting delalloc ranges during fiemap +- btrfs: ensure fiemap doesn't race with writes when FIEMAP_FLAG_SYNC is given +- Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped." +- mm/treewide: replace pud_large() with pud_leaf() +- dm integrity: fix out-of-range warning +- drm/i915/mtl: Update workaround 14018575942 +- drm/i915/xelpg: Extend some workarounds/tuning to gfx version 12.74 +- drm/i915/mtl: Update workaround 14016712196 +- drm/i915: Replace several IS_METEORLAKE with proper IP version checks +- drm/i915: Eliminate IS_MTL_GRAPHICS_STEP +- drm/i915/xelpg: Call Xe_LPG workaround functions based on IP version +- drm/i915: Consolidate condition for Wa_22011802037 +- drm/i915: Tidy workaround definitions +- drm/i915/dg2: Drop pre-production GT workarounds +- inet: inet_defrag: prevent sk release while still in use +- Octeontx2-af: fix pause frame configuration in GMP mode +- net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips +- net: bcmasp: Bring up unimac after PHY link up +- netfilter: nf_tables: skip netdev hook unregistration if table is dormant +- netfilter: nf_tables: reject table flag and netdev basechain updates +- netfilter: nf_tables: reject destroy command to remove basechain hooks +- cifs: Fix duplicate fscache cookie warnings +- bpf: Protect against int overflow for stack access size +- mlxbf_gige: call request_irq() after NAPI initialized +- tls: get psock ref after taking rxlock to avoid leak +- tls: adjust recv return with async crypto and failed copy to userspace +- tls: recv: process_rx_list shouldn't use an offset with kvec +- net: hns3: mark unexcuted loopback test result as UNEXECUTED +- net: hns3: fix kernel crash when devlink reload during pf initialization +- net: hns3: fix index limit to support all queue stats +- ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields() +- selftests: vxlan_mdb: Fix failures with old libnet +- net: wwan: t7xx: Split 64bit accesses to fix alignment issues +- tcp: properly terminate timers for kernel sockets +- net: hsr: hsr_slave: Fix the promiscuous mode in offload mode +- s390/qeth: handle deferred cc1 +- igc: Remove stale comment about Tx timestamping +- ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa() +- ice: fix memory corruption bug with suspend and rebuild +- ice: realloc VSI stats arrays +- ice: Refactor FW data type and fix bitmap casting issue +- ALSA: hda: cs35l56: Set the init_done flag before component_add() +- wifi: iwlwifi: mvm: include link ID when releasing frames +- wifi: iwlwifi: disable multi rx queue for 9000 +- wifi: iwlwifi: mvm: rfi: fix potential response leaks +- mlxbf_gige: stop PHY during open() error paths +- tools: ynl: fix setting presence bits in simple nests +- nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet +- arm64: bpf: fix 32bit unconditional bswap +- dma-buf: Fix NULL pointer dereference in sanitycheck() +- bpf, arm64: fix bug in BPF_LDX_MEMSX +- s390/bpf: Fix bpf_plt pointer arithmetic +- scripts/bpf_doc: Use silent mode when exec make cmd +- drm/i915: Pre-populate the cursor physical dma address +- drm/i915/display: Use i915_gem_object_get_dma_address to get dma address +- Revert "workqueue.c: Increase workqueue name length" +- Revert "workqueue: Move pwq->max_active to wq->max_active" +- Revert "workqueue: Factor out pwq_is_empty()" +- Revert "workqueue: Replace pwq_activate_inactive_work() with [__]pwq_activate_work()" +- Revert "workqueue: Move nr_active handling into helpers" +- Revert "workqueue: Make wq_adjust_max_active() round-robin pwqs while activating" +- Revert "workqueue: Introduce struct wq_node_nr_active" +- Revert "workqueue: Shorten events_freezable_power_efficient name" +- drm/amdgpu: fix use-after-free bug +- tools/resolve_btfids: fix build with musl libc +- x86/sev: Skip ROM range scans and validation for SEV-SNP guests +- scsi: lpfc: Correct size for wqe for memset() +- scsi: lpfc: Correct size for cmdwqe/rspwqe for memset() +- usb: dwc3: pci: Drop duplicate ID +- Revert "x86/bugs: Use fixed addressing for VERW operand" +- x86/bugs: Use fixed addressing for VERW operand +- scsi: qla2xxx: Delay I/O Abort on PCI error +- scsi: qla2xxx: Change debug message during driver unload +- scsi: qla2xxx: Fix double free of fcport +- scsi: qla2xxx: Fix double free of the ha->vp_map pointer +- scsi: qla2xxx: Fix command flush on cable pull +- scsi: qla2xxx: NVME|FCP prefer flag not being honored +- scsi: qla2xxx: Update manufacturer detail +- scsi: qla2xxx: Split FCE|EFT trace control +- scsi: qla2xxx: Fix N2N stuck connection +- scsi: qla2xxx: Prevent command send on chip reset +- usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset +- usb: typec: ucsi_acpi: Refactor and fix DELL quirk +- usb: typec: ucsi: Ack unsupported commands +- usb: typec: ucsi: Clear EVENT_PENDING under PPM lock +- usb: typec: Return size of buffer if pd_set operation succeeds +- usb: udc: remove warning when queue disabled ep +- usb: dwc2: gadget: LPM flow fix +- usb: dwc2: gadget: Fix exiting from clock gating +- usb: dwc2: host: Fix ISOC flow in DDMA mode +- usb: dwc2: host: Fix hibernation flow +- usb: dwc2: host: Fix remote wakeup from hibernation +- USB: core: Fix deadlock in port "disable" sysfs attribute +- USB: core: Add hub_get() and hub_put() routines +- USB: core: Fix deadlock in usb_deauthorize_interface() +- usb: dwc3: Properly set system wakeup +- staging: vc04_services: fix information leak in create_component() +- staging: vc04_services: changen strncpy() to strscpy_pad() +- scsi: core: Fix unremoved procfs host directory regression +- scsi: sd: Fix TCG OPAL unlock on system resume +- vfio/pds: Make sure migration file isn't accessed after reset +- drm/amd/display: Clear OPTC mem select on disable +- drm/amd/display: Disconnect phantom pipe OPP from OPTC being disabled +- drm/amd/display: Fix hang/underflow when transitioning to ODM4:1 +- USB: UAS: return ENODEV when submit urbs fail with device not attached +- usb: cdc-wdm: close race between read and workqueue +- Revert "usb: phy: generic: Get the vbus supply" +- mtd: spinand: Add support for 5-byte IDs +- Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync +- drm/i915/gt: Reset queue_priority_hint on parking +- drm/i915: Do not match JSL in ehl_combo_pll_div_frac_wa_needed() +- drm/i915/dsi: Go back to the previous INIT_OTP/DISPLAY_ON order, mostly +- drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() +- drm/i915/hwmon: Fix locking inversion in sysfs getter +- drm/amdgpu: fix deadlock while reading mqd from debugfs +- drm/amdkfd: fix TLB flush after unmap for GFX9.4.2 +- drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed +- net: ll_temac: platform_get_resource replaced by wrong function +- nouveau/dmem: handle kcalloc() allocation failure +- thermal: devfreq_cooling: Fix perf state when calculate dfc res_util +- block: Do not force full zone append completion in req_bio_endio() +- sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove() +- mmc: core: Avoid negative index with array access +- mmc: core: Initialize mmc_blk_ioc_data +- mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc HS200 mode +- selftests/mm: fix ARM related issue with fork after pthread_create +- selftests/mm: sigbus-wp test requires UFFD_FEATURE_WP_HUGETLBFS_SHMEM +- mm: cachestat: fix two shmem bugs +- hexagon: vmlinux.lds.S: handle attributes section +- exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack() +- Revert "drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP displays without PSR" +- wifi: iwlwifi: fw: don't always use FW dump trig +- wifi: iwlwifi: mvm: disable MLO for the time being +- wifi: cfg80211: add a flag to disable wireless extensions +- wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes +- btrfs: zoned: use zone aware sb location for scrub +- btrfs: zoned: don't skip block groups with 100% zone unusable +- btrfs: fix race in read_extent_buffer_pages() +- tmpfs: fix race on handling dquot rbtree +- ARM: prctl: reject PR_SET_MDWE on pre-ARMv6 +- prctl: generalize PR_SET_MDWE support check to be per-arch +- x86/efistub: Reinstate soft limit for initrd loading +- x86/efistub: Add missing boot_params for mixed mode compat entry +- init: open /initrd.image with O_LARGEFILE +- ALSA: hda/tas2781: add locks to kcontrols +- ALSA: hda/tas2781: remove digital gain kcontrol +- perf top: Use evsel's cpus to replace user_requested_cpus +- selftests/mm: Fix build with _FORTIFY_SOURCE +- selftests/mm: gup_test: conform test to TAP format output +- pwm: img: fix pwm clock lookup +- efi: fix panic in kdump kernel +- x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD +- x86/mpparse: Register APIC address only once +- kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address +- irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger type +- irqchip/renesas-rzg2l: Rename rzg2l_irq_eoi() +- irqchip/renesas-rzg2l: Rename rzg2l_tint_eoi() +- irqchip/renesas-rzg2l: Add macro to retrieve TITSR register offset based on register's index +- irqchip/renesas-rzg2l: Flush posted write in irq_eoi() +- irqchip/renesas-rzg2l: Implement restriction when writing ISCR register +- printk: Update @console_may_schedule in console_trylock_spinning() +- iommu/dma: Force swiotlb_max_mapping_size on an untrusted device +- swiotlb: Fix alignment checks when both allocation and DMA masks are present +- swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc() +- swiotlb: Fix double-allocation of slots due to broken alignment handling +- entry: Respect changes to system call number by trace_sys_enter() +- ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses +- ARM: 9352/1: iwmmxt: Remove support for PJ4/PJ4B cores +- clocksource/drivers/arm_global_timer: Fix maximum prescaler value +- x86/sev: Fix position dependent variable references in startup code +- x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT +- vfio/fsl-mc: Block calling interrupt handler without trigger +- vfio/platform: Create persistent IRQ handlers +- vfio/pci: Create persistent INTx handler +- vfio: Introduce interface to flush virqfd inject workqueue +- btrfs: fix deadlock with fiemap and extent locking +- xfs: remove conditional building of rt geometry validator functions +- xfs: reset XFS_ATTR_INCOMPLETE filter on node removal +- xfs: update dir3 leaf block metadata after swap +- xfs: ensure logflagsp is initialized in xfs_bmap_del_extent_real +- xfs: short circuit xfs_growfs_data_private() if delta is zero +- xfs: initialise di_crc in xfs_log_dinode +- xfs: add missing nrext64 inode flag check to scrub +- xfs: force all buffers to be written during btree bulk load +- xfs: fix an off-by-one error in xreap_agextent_binval +- xfs: recompute growfsrtfree transaction reservation while growing rt volume +- xfs: remove unused fields from struct xbtree_ifakeroot +- xfs: make xchk_iget safer in the presence of corrupt inode btrees +- xfs: don't allow overly small or large realtime volumes +- xfs: fix 32-bit truncation in xfs_compute_rextslog +- xfs: make rextslog computation consistent with mkfs +- xfs: transfer recovered intent item ownership in ->iop_recover +- xfs: pass the xfs_defer_pending object to iop_recover +- xfs: use xfs_defer_pending objects to recover intent items +- xfs: don't leak recovered attri intent items +- xfs: consider minlen sized extents in xfs_rtallocate_extent_block +- xfs: convert rt bitmap extent lengths to xfs_rtbxlen_t +- xfs: move the xfs_rtbitmap.c declarations to xfs_rtbitmap.h +- wifi: rtw88: 8821cu: Fix connection failure +- wifi: iwlwifi: pcie: fix RB status reading +- ASoC: amd: yc: Revert "Fix non-functional mic on Lenovo 21J2" +- x86/efistub: Call mixed mode boot services on the firmware's stack +- drm/amd/display: handle range offsets in VRR ranges +- drm/i915: Don't explode when the dig port we don't have an AUX CH +- iio: imu: inv_mpu6050: fix FIFO parsing when empty +- iio: imu: inv_mpu6050: fix frequency setting when chip is off +- i2c: i801: Avoid potential double call to gpiod_remove_lookup_table +- iio: accel: adxl367: fix I2C FIFO data register +- iio: accel: adxl367: fix DEVID read after reset +- arm64: dts: qcom: sc8280xp-x13s: limit pcie4 link speed +- mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations +- ARM: imx_v6_v7_defconfig: Restore CONFIG_BACKLIGHT_CLASS_DEVICE +- tee: optee: Fix kernel panic caused by incorrect error handling +- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook +- ALSA: hda/realtek - Add Headset Mic supported Acer NB platform +- fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion +- Revert "tty: serial: simplify qcom_geni_serial_send_chunk_fifo()" +- vt: fix unicode buffer corruption when deleting characters +- mei: me: add arrow lake point H DID +- mei: me: add arrow lake point S DID +- serial: port: Don't suspend if the port is still busy +- misc: fastrpc: Pass proper arguments to scm call +- misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume +- tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled +- xhci: Fix failure to detect ring expansion need. +- usb: port: Don't try to peer unused USB ports based on location +- usb: gadget: ncm: Fix handling of zero block length packets +- usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group +- USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command +- ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform +- drm/i915: Check before removing mm notifier +- tty: serial: imx: Fix broken RS485 +- drm/amdgpu/pm: Fix the error of pwm1_enable setting +- tracing: Use .flush() call to wake up readers +- SEV: disable SEV-ES DebugSwap by default +- KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() +- KVM: x86: Mark target gfn of emulated atomic instruction as dirty +- firewire: ohci: prevent leak of left-over IRQ on unbind +- init/Kconfig: lower GCC version check for -Warray-bounds +- Input: xpad - add additional HyperX Controller Identifiers +- cgroup/cpuset: Fix retval in update_cpumask() +- usb: typec: tpcm: Fix PORT_RESET behavior for self powered devices +- selftests: mptcp: diag: return KSFT_FAIL not test_cnt +- mm, mmap: fix vma_merge() case 7 with vma_ops->close +- xfrm: Avoid clang fortify warning in copy_to_user_tmpl() +- crypto: sun8i-ce - Fix use after free in unprepare +- crypto: rk3288 - Fix use after free in unprepare +- drm/nouveau: fix stale locked mutex in nouveau_gem_ioctl_pushbuf +- nouveau: lock the client object tree. +- Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory +- netfilter: nf_tables: reject constant set with timeout +- netfilter: nf_tables: disallow anonymous set with timeout flag +- netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout +- net: fix IPSTATS_MIB_OUTPKGS increment in OutForwDatagrams. +- drm/amd/display: Use freesync when `DRM_EDID_FEATURE_CONTINUOUS_FREQ` found +- workqueue: Shorten events_freezable_power_efficient name +- drm/bridge: lt8912b: do not return negative values from .get_modes() +- drm/bridge: lt8912b: clear the EDID property on failures +- drm/bridge: lt8912b: use drm_bridge_edid_read() +- drm/bridge: add ->edid_read hook and drm_bridge_edid_read() +- drm/ttm: Make sure the mapped tt pages are decrypted when needed +- wifi: brcmfmac: Demote vendor-specific attach/detach messages to info +- wifi: brcmfmac: cfg80211: Use WSEC to set SAE password +- wifi: brcmfmac: add per-vendor feature detection callback +- x86/pm: Work around false positive kmemleak report in msr_build_context() +- dm snapshot: fix lockup in dm_exception_table_exit +- drm/amd/display: Fix noise issue on HDMI AV mute +- drm/amd/display: Return the correct HDCP error code +- drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag +- ahci: asm1064: asm1166: don't limit reported ports +- ahci: asm1064: correct count of reported ports +- wireguard: selftests: set RISCV_ISA_FALLBACK on riscv{32,64} +- wireguard: netlink: access device through ctx instead of peer +- wireguard: netlink: check for dangling peer via is_dead instead of empty list +- LoongArch/crypto: Clean up useless assignment operations +- LoongArch: Define the __io_aw() hook as mmiowb() +- LoongArch: Change __my_cpu_offset definition to avoid mis-optimization +- virtio: reenable config if freezing device failed +- cxl/trace: Properly initialize cxl_poison region name +- net: hns3: tracing: fix hclgevf trace event strings +- drm/i915: Add missing ; to __assign_str() macros in tracepoint code +- NFSD: Fix nfsd_clid_class use of __string_len() macro +- net: esp: fix bad handling of pages from page_pool +- x86/CPU/AMD: Update the Zenbleed microcode revisions +- cpufreq: dt: always allocate zeroed cpumask +- mtd: rawnand: Constrain even more when continuous reads are enabled +- mtd: rawnand: Fix and simplify again the continuous read derivations +- cifs: open_cached_dir(): add FILE_READ_EA to desired access +- cifs: reduce warning log level for server not advertising interfaces +- cifs: make cifs_chan_update_iface() a void function +- cifs: delete unnecessary NULL checks in cifs_chan_update_iface() +- cifs: do not let cifs_chan_update_iface deallocate channels +- cifs: make sure server interfaces are requested only for SMB3+ +- cifs: add xid to query server interface call +- nilfs2: prevent kernel bug at submit_bh_wbc() +- nilfs2: fix failure to detect DAT corruption in btree and direct mappings +- f2fs: truncate page cache before clearing flags when aborting atomic write +- f2fs: mark inode dirty for FI_ATOMIC_COMMITTED flag +- Revert "block/mq-deadline: use correct way to throttling write requests" +- memtest: use {READ,WRITE}_ONCE in memory scanning +- drm/vc4: hdmi: do not return negative values from .get_modes() +- drm/imx/ipuv3: do not return negative values from .get_modes() +- drm/exynos: do not return negative values from .get_modes() +- drm/panel: do not return negative error codes from drm_panel_get_modes() +- drm/probe-helper: warn about negative .get_modes() +- s390/zcrypt: fix reference counting on zcrypt card objects +- soc: fsl: qbman: Use raw spinlock for cgr_lock +- soc: fsl: qbman: Always disable interrupts when taking cgr_lock +- dlm: fix user space lkb refcounting +- ring-buffer: Use wait_event_interruptible() in ring_buffer_wait() +- ring-buffer: Fix full_waiters_pending in poll +- ring-buffer: Fix resetting of shortest_full +- ring-buffer: Do not set shortest_full when full target is hit +- ring-buffer: Fix waking up ring buffer readers +- io_uring: clean rings on NO_MMAP alloc fail +- platform/x86/intel/tpmi: Change vsec offset to u64 +- ksmbd: retrieve number of blocks using vfs_getattr in set_file_allocation_info +- ksmbd: replace generic_fillattr with vfs_getattr +- server: convert to new timestamp accessors +- vfio/platform: Disable virqfds on cleanup +- vfio/pci: Lock external INTx masking ops +- vfio/pci: Disable auto-enable of exclusive INTx IRQ +- thermal/drivers/mediatek: Fix control buffer enablement on MT7896 +- cifs: allow changing password during remount +- cifs: prevent updating file size from server if we have a read/write lease +- smb: client: stop revalidating reparse points unnecessarily +- PCI: hv: Fix ring buffer size calculation +- PCI: dwc: endpoint: Fix advertised resizable BAR size +- PCI: qcom: Enable BDF to SID translation properly +- kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 +- NFS: Read unlock folio on nfs_page_create_from_folio() error +- nfs: fix UAF in direct writes +- sparc32: Fix parport build with sparc32 +- io_uring: fix mshot io-wq checks +- io_uring/net: correctly handle multishot recvmsg retry setup +- PCI/AER: Block runtime suspend when handling errors +- speakup: Fix 8bit characters from direct synth +- usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic +- phy: tegra: xusb: Add API to retrieve the port number of phy +- slimbus: core: Remove usage of the deprecated ida_simple_xx() API +- nvmem: meson-efuse: fix function pointer type mismatch +- ext4: fix corruption during on-line resize +- hwmon: (amc6821) add of_match table +- landlock: Warn once if a Landlock action is requested while disabled +- drm/etnaviv: Restore some id values +- leds: trigger: netdev: Fix kernel panic on interface rename trig notify +- Bluetooth: btnxpuart: Fix btnxpuart_close +- mmc: core: Fix switch on gp3 partition +- mm: swap: fix race between free_swap_and_cache() and swapoff() +- mac802154: fix llsec key resources release in mac802154_llsec_key_del +- block: Fix page refcounts for unaligned buffers in __bio_release_pages() +- powerpc: xor_vmx: Add '-mhard-float' to CFLAGS +- dm-raid: fix lockdep waring in "pers->hot_add_disk" +- PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports +- PCI/PM: Drain runtime-idle callbacks before driver removal +- wifi: rtw88: Add missing VID/PIDs for 8811CU and 8821CU +- btrfs: fix off-by-one chunk length calculation at contains_pending_extent() +- btrfs: qgroup: always free reserved space for extent records +- serial: Lock console when calling into driver before registration +- serial: core: only stop transmit when HW fifo is empty +- usb: dwc3-am62: Disable wakeup at remove +- usb: dwc3-am62: fix module unload/reload behavior +- usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros +- fuse: don't unhash root +- fuse: fix root lookup with nonzero generation +- fuse: replace remaining make_bad_inode() with fuse_make_bad() +- mmc: tmio: avoid concurrent runs of mmc_request_done() +- PM: sleep: wakeirq: fix wake irq warning in system suspend +- USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M +- KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled +- USB: serial: option: add MeiG Smart SLM320 product +- USB: serial: cp210x: add ID for MGP Instruments PDS100 +- USB: serial: add device ID for VeriFone adapter +- USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB +- powerpc/fsl: Fix mfpmr build errors with newer binutils +- usb: xhci: Add error handling in xhci_map_urb_for_dma +- clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays +- clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays +- clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays +- clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays +- clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays +- clk: qcom: gcc-ipq5018: fix terminating of frequency table arrays +- vfio/pds: Always clear the save/restore FDs on reset +- PM: suspend: Set mem_sleep_current during kernel command line setup +- cpufreq: Limit resolving a frequency to policy min/max +- docs: Restore "smart quotes" for quotes +- iio: adc: rockchip_saradc: use mask for write_enable bitfield +- iio: adc: rockchip_saradc: fix bitmask for channels on SARADCv2 +- md/raid5: fix atomicity violation in raid5_cache_count +- parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds +- parisc: Fix csum_ipv6_magic on 64-bit systems +- parisc: Fix csum_ipv6_magic on 32-bit systems +- parisc: Fix ip_fast_csum +- parisc: Avoid clobbering the C/B bits in the PSW with tophys and tovirt macros +- parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd() +- x86/nmi: Fix the inverse "in NMI handler" check +- md/md-bitmap: fix incorrect usage for sb_index +- mtd: rawnand: meson: fix scrambling mode value in command macro +- ubi: correct the calculation of fastmap size +- ubifs: Set page uptodate in the correct place +- fuse: fix VM_MAYSHARE and direct_io_allow_mmap +- fat: fix uninitialized field in nostale filehandles +- bounds: support non-power-of-two CONFIG_NR_CPUS +- kasan/test: avoid gcc warning for intentional overflow +- block: Clear zone limits for a non-zoned stacked queue +- ext4: correct best extent lstart adjustment logic +- selftests/mqueue: Set timeout to 180 seconds +- sparc: vDSO: fix return value of __setup handler +- sparc64: NMI watchdog: fix return value of __setup handler +- powerpc/smp: Increase nr_cpu_ids to include the boot CPU +- powerpc/smp: Adjust nr_cpu_ids to cover all threads of a core +- powercap: intel_rapl_tpmi: Fix System Domain probing +- powercap: intel_rapl_tpmi: Fix a register bug +- powercap: intel_rapl: Fix locking in TPMI RAPL +- sched: Simplify tg_set_cfs_bandwidth() +- powercap: intel_rapl: Fix a NULL pointer dereference +- thermal/intel: Fix intel_tcc_get_temp() to support negative CPU temperature +- cpufreq: amd-pstate: Fix min_perf assignment in amd_pstate_adjust_perf() +- arm64: dts: qcom: sm8550-mtp: correct WCD9385 TX port mapping +- arm64: dts: qcom: sm8550-qrd: correct WCD9385 TX port mapping +- KVM: Always flush async #PF workqueue when vCPU is being destroyed +- media: nxp: imx8-isi: Mark all crossbar sink pads as MUST_CONNECT +- media: mc: Expand MUST_CONNECT flag to always require an enabled link +- media: mc: Rename pad variable to clarify intent +- media: mc: Add num_links flag to media_pad +- media: nxp: imx8-isi: Check whether crossbar pad is non-NULL before access +- media: mc: Fix flags handling when creating pad links +- media: mc: Add local pad to pipeline regardless of the link state +- media: xc4000: Fix atomicity violation in xc4000_get_frequency +- pci_iounmap(): Fix MMIO mapping leak +- drm/vmwgfx: Fix the lifetime of the bo cursor memory +- serial: max310x: fix NULL pointer dereference in I2C instantiation +- drm/vmwgfx: Fix possible null pointer derefence with invalid contexts +- arm: dts: marvell: Fix maxium->maxim typo in brownstone dts +- smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity() +- smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr() +- clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd +- remoteproc: virtio: Fix wdg cannot recovery remote processor +- arm64: dts: qcom: sc7280: Add additional MSI interrupts +- media: staging: ipu3-imgu: Set fields before media_entity_pads_init() +- wifi: brcmfmac: avoid invalid list operation when vendor attach fails +- wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach +- drm/vmwgfx: Unmap the surface before resetting it on a plane state +- KVM: x86: Use a switch statement and macros in __feature_translate() +- KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace +- x86/efistub: Don't clear BSS twice in mixed mode +- x86/efistub: Clear decompressor BSS in native EFI entrypoint +- dm-integrity: align the outgoing bio in integrity_recheck +- dm io: Support IO priority +- selftests: forwarding: Fix ping failure due to short timeout +- spi: spi-mt65xx: Fix NULL pointer access in interrupt handler +- netfilter: nf_tables: Fix a memory leak in nf_tables_updchain +- net: dsa: mt7530: fix handling of all link-local frames +- net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports +- bpf: report RCU QS in cpumap kthread +- net: report RCU QS on threaded NAPI repolling +- rcu: add a helper to report consolidated flavor QS +- netfilter: nf_tables: do not compare internal table flags on updates +- netfilter: nft_set_pipapo: release elements in clone only from destroy path +- octeontx2-af: Use separate handlers for interrupts +- octeontx2-pf: Send UP messages to VF only when VF is up. +- octeontx2-pf: Use default max_active works instead of one +- octeontx2-pf: Wait till detach_resources msg is complete +- octeontx2: Detect the mbox up or down message via register +- devlink: fix port new reply cmd type +- net/bnx2x: Prevent access to a freed page in page_pool +- dm-integrity: fix a memory leak when rechecking the data +- net: phy: fix phy_read_poll_timeout argument type in genphy_loopback +- ceph: stop copying to iter at EOF on sync reads +- ipv4: raw: Fix sending packets from raw sockets via IPsec tunnels +- hsr: Handle failures in module init +- rds: introduce acquire/release ordering in acquire/release_in_xmit() +- wireguard: receive: annotate data-race around receiving_counter.counter +- virtio: packed: fix unmap leak for indirect desc table +- vdpa/mlx5: Allow CVQ size changes +- vdpa_sim: reset must not run +- drm: Fix drm_fixp2int_round() making it add 0.5 +- spi: spi-imx: fix off-by-one in mx51 CPU mode burst length +- net: dsa: mt7530: prevent possible incorrect XTAL frequency selection +- net: veth: do not manipulate GRO when using XDP +- xfrm: Allow UDP encapsulation only in offload modes +- packet: annotate data-races around ignore_outgoing +- xen/events: increment refcnt only if event channel is refcounted +- xen/evtchn: avoid WARN() when unbinding an event channel +- riscv: Fix compilation error with FAST_GUP and rv32 +- io_uring: fix poll_remove stalled req completion +- net: ethernet: mtk_eth_soc: fix PPE hanging issue +- net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up +- nvme: fix reconnection fail due to reserved tag allocation +- net: txgbe: fix clk_name exceed MAX_DEV_ID limits +- hsr: Fix uninit-value access in hsr_get_node() +- vmxnet3: Fix missing reserved tailroom +- tcp: Fix refcnt handling in __inet_hash_connect(). +- io_uring: Fix release of pinned pages when __io_uaddr_map fails +- cpufreq: Fix per-policy boost behavior on SoCs using cpufreq_boost_set_sw() +- soc: fsl: dpio: fix kcalloc() argument order +- net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check +- s390/vtime: fix average steal time calculation +- octeontx2-af: Use matching wake_up API variant in CGX command interface +- rds: tcp: Fix use-after-free of net in reqsk_timer_handler(). +- tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() +- nouveau: reset the bo resource bus info after an eviction +- ASoC: rockchip: i2s-tdm: Fix inaccurate sampling rates +- spi: lpspi: Avoid potential use-after-free in probe() +- io_uring: don't save/restore iowait state +- thermal/drivers/qoriq: Fix getting tmu range +- thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error handling path +- ASoC: tlv320adc3xxx: Don't strip remove function when driver is builtin +- x86/hyperv: Use per cpu initial stack for vtl context +- usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin +- staging: greybus: fix get_channel_from_mode() failure path +- serial: 8250_exar: Don't remove GPIO device on suspend +- rtc: mt6397: select IRQ_DOMAIN instead of depending on it +- bus: mhi: ep: check the correct variable in mhi_ep_register_controller() +- iio: gts-helper: Fix division loop +- kconfig: fix infinite loop when expanding a macro at the end of file +- coresight: etm4x: Set skip_power_up in etm4_init_arch_data function +- coresight: Fix issue where a source device's helpers aren't disabled +- arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells +- tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT +- serial: max310x: fix syntax error in IRQ error message +- tty: vt: fix 20 vs 0x20 typo in EScsiignore +- usb: phy: generic: Get the vbus supply +- iio: pressure: mprls0025pa fix off-by-one enum +- remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef +- remoteproc: stm32: Fix incorrect type in assignment for va +- mei: gsc_proxy: match component when GSC is on different bus +- comedi: comedi_test: Prevent timers rescheduling during deletion +- io_uring/net: correct the type of variable +- afs: Revert "afs: Hide silly-rename files from userspace" +- f2fs: zone: fix to remove pow2 check condition for zoned block device +- f2fs: compress: fix reserve_cblocks counting error when out of space +- f2fs: compress: relocate some judgments in f2fs_reserve_compress_blocks +- NFSv4.1/pnfs: fix NFS with TLS in pnfs +- NFS: Fix an off by one in root_nfs_cat() +- NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt +- Input: iqs7222 - add support for IQS7222D v1.1 and v1.2 +- RDMA/mana_ib: Fix bug in creation of dma regions +- f2fs: ro: compress: fix to avoid caching unaligned extent +- f2fs: fix to use correct segment type in f2fs_allocate_data_block() +- watchdog: stm32_iwdg: initialize default timeout +- watchdog: starfive: Check pm_runtime_enabled() before decrementing usage counter +- f2fs: check number of blocks in a current section +- f2fs: compress: fix to check compress flag w/ .i_sem lock +- NFSv4.2: fix listxattr maximum XDR buffer size +- NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 +- net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() +- f2fs: compress: fix to check zstd compress level correctly in mount option +- f2fs: fix to create selinux label during whiteout initialization +- scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn +- RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store() +- RDMA/device: Fix a race between mad_client and cm_client init +- i3c: dw: Disable IBI IRQ depends on hot-join and SIR enabling +- scsi: csiostor: Avoid function pointer casts +- f2fs: fix to avoid potential panic during recovery +- f2fs: compress: fix to cover f2fs_disable_compressed_file() w/ i_sem +- f2fs: zone: fix to wait completion of last bio in zone correctly +- f2fs: fix to remove unnecessary f2fs_bug_on() to avoid panic +- f2fs: compress: fix to avoid inconsistence bewteen i_blocks and dnode +- f2fs: update blkaddr in __set_data_blkaddr() for cleanup +- f2fs: introduce get_dnode_addr() to clean up codes +- f2fs: delete obsolete FI_DROP_CACHE +- f2fs: delete obsolete FI_FIRST_BLOCK_WRITTEN +- f2fs: compress: fix to check unreleased compressed cluster +- f2fs: compress: fix to cover normal cluster write with cp_rwsem +- f2fs: compress: fix to guarantee persisting compressed blocks by CP +- RDMA/srpt: Do not register event handler until srpt device is fully setup +- RDMA/irdma: Remove duplicate assignment +- ALSA: usb-audio: Stop parsing channels bits when all channels are found. +- ALSA: hda/tas2781: restore power state after system_resume +- ALSA: hda/tas2781: configure the amp after firmware load +- ALSA: hda/tas2781: do not call pm_runtime_force_* in system_resume/suspend +- ALSA: hda/tas2781: add ptrs to calibration functions +- ALSA: hda/tas2781: do not reset cur_* values in runtime_suspend +- ALSA: hda/tas2781: add lock to system_suspend +- ALSA: hda/tas2781: use dev_dbg in system_resume +- ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops +- cifs: Fix writeback data corruption +- cifs: Don't use certain unnecessary folio_*() functions +- smb: do not test the return value of folio_start_writeback() +- PCI: brcmstb: Fix broken brcm_pcie_mdio_write() polling +- clk: zynq: Prevent null pointer dereference caused by kmalloc failure +- clk: Fix clk_core_get NULL dereference +- sparc32: Fix section mismatch in leon_pci_grpci +- backlight: lp8788: Fully initialize backlight_properties during probe +- backlight: lm3639: Fully initialize backlight_properties during probe +- backlight: da9052: Fully initialize backlight_properties during probe +- backlight: lm3630a: Don't set bl->props.brightness in get_brightness +- backlight: lm3630a: Initialize backlight_properties on init +- backlight: ktz8866: Correct the check for of_property_read_u32 +- leds: sgm3140: Add missing timer cleanup and flash gpio control +- leds: aw2013: Unlock mutex before destroying it +- powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc. +- mfd: cs42l43: Fix wrong GPIO_FN_SEL and SPI_CLK_CONFIG1 defaults +- modules: wait do_free_init correctly +- drm/msm/dpu: add division of drm_display_mode's hskew parameter +- clk: qcom: gcc-ipq5018: fix register offset for GCC_UBI0_AXI_ARES reset +- clk: qcom: gcc-ipq5018: fix 'halt_reg' offset of 'gcc_pcie1_pipe_clk' +- clk: qcom: gcc-ipq5018: fix 'enable_reg' offset of 'gcc_gmac0_sys_clk' +- powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks +- powerpc/pseries: Fix potential memleak in papr_get_attr() +- mfd: cs42l43: Fix wrong register defaults +- drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip +- gpio: nomadik: fix offset bug in nmk_pmx_set() +- drm/amd/pm: Fix esm reg mask use to get pcie speed +- drm/tests: helpers: Include missing drm_drv header +- arm64: ftrace: Don't forbid CALL_OPS+CC_OPTIMIZE_FOR_SIZE with Clang +- media: mediatek: vcodec: avoid -Wcast-function-type-strict warning +- media: ttpci: fix two memleaks in budget_av_attach +- media: go7007: fix a memleak in go7007_load_encoder +- media: dvb-frontends: avoid stack overflow warnings with clang +- drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int() +- HID: amd_sfh: Avoid disabling the interrupt +- HID: amd_sfh: Update HPD sensor structure elements +- perf pmu: Fix a potential memory leak in perf_pmu__lookup() +- ASoC: meson: axg-tdm-interface: add frame rate constraint +- ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs +- mtd: rawnand: lpc32xx_mlc: fix irq handler prototype +- mtd: maps: physmap-core: fix flash size larger than 32-bit +- clk: imx: imx8mp: Fix SAI_MCLK_SEL definition +- drm/tidss: Fix sync-lost issue with two displays +- drm/tidss: Fix initial plane zpos values +- crypto: jitter - fix CRYPTO_JITTERENTROPY help text +- crypto: ccp - Avoid discarding errors in psp_send_platform_access_msg() +- crypto: arm/sha - fix function cast warnings +- perf print-events: make is_event_supported() more robust +- mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref +- mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref +- media: i2c: imx290: Fix IMX920 typo +- media: ivsc: csi: Swap SINK and SOURCE pads +- drm/tegra: put drm_gem_object ref on error in tegra_fb_create +- clk: mediatek: mt7981-topckgen: flag SGM_REG_SEL as critical +- clk: mediatek: mt8183: Correct parent of CLK_INFRA_SSPM_32K_SELF +- clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() +- clk: mediatek: mt8135: Fix an error handling path in clk_mt8135_apmixed_probe() +- clk: hisilicon: hi3559a: Fix an erroneous devm_kfree() +- clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister() +- pinctrl: renesas: Allow the compiler to optimize away sh_pfc_pm +- PCI: Mark 3ware-9650SE Root Port Extended Tags as broken +- drm/mediatek: dsi: Fix DSI RGB666 formats and definitions +- drm/panel: boe-tv101wum-nl6: make use of prepare_prev_first +- drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()' +- clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times +- media: pvrusb2: fix pvr2_stream_callback casts +- media: pvrusb2: remove redundant NULL check +- media: go7007: add check of return value of go7007_read_addr() +- media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak +- media: sun8i-di: Fix chroma difference threshold +- media: sun8i-di: Fix power on/off sequences +- media: sun8i-di: Fix coefficient writes +- media: cedrus: h265: Fix configuring bitstream size +- NTB: fix possible name leak in ntb_register_device() +- drm: ci: use clk_ignore_unused for apq8016 +- ASoC: SOF: Add some bounds checking to firmware data +- powerpc: Force inlining of arch_vmap_p{u/m}d_supported() +- ASoC: meson: t9015: fix function pointer type mismatch +- ASoC: meson: aiu: fix function pointer type mismatch +- perf metric: Don't remove scale from counts +- perf stat: Avoid metric-only segv +- perf expr: Fix "has_event" function for metric style events +- ALSA: seq: fix function cast warnings +- clk: renesas: r8a779f0: Correct PFC/GPIO parent clock +- clk: renesas: r8a779g0: Correct PFC/GPIO parent clocks +- drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini() +- drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode() +- drm/msm/dpu: Only enable DSC_MODE_MULTIPLEX if dsc_merge is enabled +- drm/msm/dpu: fix the programming of INTF_CFG2_DATA_HCTL_EN +- dt-bindings: msm: qcom, mdss: Include ommited fam-b compatible +- perf srcline: Add missed addr2line closes +- perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str() +- drivers/ps3: select VIDEO to provide cmdline functions +- crypto: xilinx - call finalize with bh disabled +- PCI: switchtec: Fix an error handling path in switchtec_pci_probe() +- PCI/P2PDMA: Fix a sleeping issue in a RCU read section +- quota: Properly annotate i_dquot arrays with __rcu +- quota: Fix rcu annotations of inode dquot pointers +- clk: qcom: reset: Ensure write completion on reset de/assertion +- clk: qcom: reset: Commonize the de/assert functions +- drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' +- pinctrl: mediatek: Drop bogus slew rate register range for MT8192 +- pinctrl: mediatek: Drop bogus slew rate register range for MT8186 +- media: edia: dvbdev: fix a use-after-free +- mtd: spinand: esmt: Extend IDs to 5 bytes +- media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity +- media: v4l2-tpg: fix some memleaks in tpg_alloc +- media: em28xx: annotate unchecked call to media_device_register() +- clk: meson: Add missing clocks to axg_clk_regmaps +- perf bpf: Clean up the generated/copied vmlinux.h +- perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample() +- media: v4l2: cci: print leading 0 on error +- clk: samsung: exynos850: Propagate SPI IPCLK rate change +- pinctrl: renesas: r8a779g0: Add missing SCIF_CLK2 pin group/function +- drm/vmwgfx: Fix vmw_du_get_cursor_mob fencing of newly-created MOBs +- ASoC: sh: rz-ssi: Fix error message print +- drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()' +- perf pmu: Treat the msr pmu as software +- drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' +- HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd +- perf record: Check conflict between '--timestamp-filename' option and pipe mode before recording +- perf top: Uniform the event name for the hybrid machine +- perf record: Fix possible incorrect free in record__switch_output() +- PCI/DPC: Print all TLP Prefixes, not just the first +- media: cadence: csi2rx: use match fwnode for media link +- media: tc358743: register v4l2 async device only after successful setup +- dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA +- ASoC: SOF: amd: Fix memory leak in amd_sof_acp_probe() +- ASoC: amd: acp: Add missing error handling in sof-mach +- drm/lima: fix a memleak in lima_heap_alloc +- drm/panel-edp: use put_sync in unprepare +- drm/rockchip: lvds: do not print scary message when probing defer +- drm/rockchip: lvds: do not overwrite error code +- drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node +- drm/vkms: Avoid reading beyond LUT array +- drm: Don't treat 0 as -1 in drm_fixp2int_ceil +- drm/rockchip: inno_hdmi: Fix video timing +- drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe() +- drm/tegra: rgb: Fix missing clk_put() in the error handling paths of tegra_dc_rgb_probe() +- drm/tegra: rgb: Fix some error handling paths in tegra_dc_rgb_probe() +- drm/tegra: hdmi: Fix some error handling paths in tegra_hdmi_probe() +- drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe() +- drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe() +- drm/tegra: dpaux: Fix PM disable depth imbalance in tegra_dpaux_probe +- drm/tegra: dsi: Add missing check for of_find_device_by_node +- dm: call the resume method on internal suspend +- dm raid: fix false positive for requeue needed during reshape +- bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes() +- nfp: flower: handle acti_netdevs allocation failure +- net/x25: fix incorrect parameter validation in the x25_getsockopt() function +- net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function +- udp: fix incorrect parameter validation in the udp_lib_getsockopt() function +- l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function +- ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function +- tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function +- OPP: debugfs: Fix warning around icc_get_name() +- erofs: fix lockdep false positives on initializing erofs_pseudo_mnt +- net: phy: dp83822: Fix RGMII TX delay configuration +- Bluetooth: Fix eir name length +- net: phy: fix phy_get_internal_delay accessing an empty array +- net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() +- ipv6: fib6_rules: flush route cache when rule is changed +- iommu: Fix compilation without CONFIG_IOMMU_INTEL +- bpf: Fix stackmap overflow check on 32-bit arches +- bpf: Fix hashtab overflow check on 32-bit arches +- bpf: Fix DEVMAP_HASH overflow check on 32-bit arches +- s390/cache: prevent rebuild of shared_cpu_list +- Bluetooth: fix use-after-free in accessing skb after sending it +- Bluetooth: af_bluetooth: Fix deadlock +- Bluetooth: btusb: Fix memory leak +- Bluetooth: msft: Fix memory leak +- Bluetooth: msft: __hci_cmd_sync() doesn't return NULL +- Bluetooth: hci_core: Fix possible buffer overflow +- Bluetooth: btrtl: fix out of bounds memory access +- Bluetooth: hci_h5: Add ability to allocate memory for private data +- Bluetooth: hci_sync: Fix overwriting request callback +- Bluetooth: hci_core: Cancel request on command timeout +- Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional() +- Bluetooth: hci_event: Fix not indicating new connection for BIG Sync +- Bluetooth: Remove BT_HS +- Bluetooth: Remove superfluous call to hci_conn_check_pending() +- Bluetooth: mgmt: Remove leftover queuing of power_off work +- Bluetooth: Remove HCI_POWER_OFF_TIMEOUT +- ice: fix stats being updated by way too large values +- igb: Fix missing time sync events +- igc: Fix missing time sync events +- iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected +- PCI: Make pci_dev_is_disconnected() helper public for other drivers +- wifi: brcm80211: handle pmk_op allocation failure +- wifi: rtw88: 8821c: Fix false alarm count +- wifi: rtw88: 8821c: Fix beacon loss and disconnect +- wifi: rtw88: 8821cu: Fix firmware upload fail +- ACPI: CPPC: enable AMD CPPC V2 support for family 17h processors +- mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function +- arm64: dts: qcom: sm8550: Fix SPMI channels size +- SUNRPC: fix some memleaks in gssx_dec_option_array +- SUNRPC: fix a memleak in gss_import_v2_context +- x86, relocs: Ignore relocations in .notes section +- objtool: Fix UNWIND_HINT_{SAVE,RESTORE} across basic blocks +- arm64: dts: rockchip: drop rockchip,trcm-sync-tx-only from rk3588 i2s +- arm64: dts: rockchip: fix reset-names for rk356x i2s2 controller +- arm64: dts: rockchip: add missing interrupt-names for rk356x vdpu +- ACPI: scan: Fix device check notification handling +- ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override +- ACPI: resource: Do IRQ override on Lunnen Ground laptops +- ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override +- arm64: dts: marvell: reorder crypto interrupts on Armada SoCs +- gpiolib: Pass consumer device through to core in devm_fwnode_gpiod_get_index() +- regulator: userspace-consumer: add module device table +- arm64: dts: imx8mp-evk: Fix hdmi@3d node +- arm64: dts: imx8mp: Set SPI NOR to max 40 MHz on Data Modul i.MX8M Plus eDM SBC +- ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node +- ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address +- arm64: dts: allwinner: h6: Add RX DMA channel for SPDIF +- pstore: inode: Only d_invalidate() is needed +- pstore: inode: Convert mutex usage to guard(mutex) +- net: mctp: copy skb ext data when fragmenting +- arm64: dts: renesas: r8a779g0: Correct avb[01] reg sizes +- arm64: dts: renesas: r8a779a0: Correct avb[01] reg sizes +- arm64: dts: renesas: rzg2l: Add missing interrupts to IRQC nodes +- wifi: mt76: mt792x: fix a potential loading failure of the 6Ghz channel config from ACPI +- wifi: mt76: mt7921e: fix use-after-free in free_irq() +- wifi: mt76: mt792x: fix ethtool warning +- wifi: mt76: mt7996: fix HIF_TXD_V2_1 value +- wifi: mt76: mt7996: fix efuse reading issue +- wifi: mt76: mt7996: fix HE beamformer phy cap for station vif +- wifi: mt76: mt7996: fix incorrect interpretation of EHT MCS caps +- wifi: mt76: mt7996: fix TWT issues +- memory: tegra: Correct DLA client names +- ARM: dts: arm: realview: Fix development chip ROM compatible value +- wifi: wilc1000: revert reset line logic flip +- arm64: dts: ti: k3-am62p: Fix memory ranges for DMSS +- firmware: arm_scmi: Fix double free in SMC transport cleanup path +- arm64: dts: ti: Add common1 register space for AM62x SoC +- arm64: dts: ti: Add common1 register space for AM65x SoC +- arm64: dts: mt8195-cherry-tomato: change watchdog reset boot flow +- arm64: dts: ti: k3-am64-main: Fix ITAP/OTAP values for MMC +- arm64: dts: ti: k3-am64: Enable SDHCI nodes at the board level +- arm64: dts: ti: k3-am642-sk: Add boot phase tags marking +- arm64: dts: ti: k3-am642-evm: Add boot phase tags marking +- arm64: dts: ti: k3-j784s4-evm: Remove Pinmux for CTS and RTS in wkup_uart0 +- arm64: dts: ti: k3-j721s2-common-proc-board: Remove Pinmux for CTS and RTS in wkup_uart0 +- arm64: dts: ti: k3-j7200-common-proc-board: Remove clock-frequency from mcu_uart0 +- arm64: dts: ti: k3-j7200-common-proc-board: Modify Pinmux for wkup_uart0 and mcu_uart0 +- net: ena: Remove ena_select_queue +- powercap: dtpm_cpu: Fix error check against freq_qos_add_request() +- arm64: dts: qcom: sm8150: correct PCIe wake-gpios +- arm64: dts: qcom: sm8150: use 'gpios' suffix for PCI GPIOs +- arm64: dts: qcom: sdm845-db845c: correct PCIe wake-gpios +- wifi: brcmsmac: avoid function pointer casts +- iommu/amd: Mark interrupt as managed +- bus: tegra-aconnect: Update dependency to ARCH_TEGRA +- arm64: dts: ti: k3-am62-main: disable usb lpm +- wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces +- cpufreq: qcom-hw: add CONFIG_COMMON_CLK dependency +- arm64: dts: mediatek: mt8186: Add missing xhci clock to usb controllers +- arm64: dts: mediatek: mt8186: Add missing clocks to ssusb power domains +- ARM: dts: qcom: msm8974: correct qfprom node size +- soc: qcom: llcc: Check return value on Broadcast_OR reg read +- arm64: dts: qcom: sdm845: Use the Low Power Island CX/MX for SLPI +- bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly +- wifi: iwlwifi: mvm: Fix the listener MAC filter flags +- can: m_can: Start/Cancel polling timer together with interrupts +- arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes +- arm64: dts: mediatek: mt8186: fix VENC power domain clocks +- arm64: dts: mediatek: mt8192: fix vencoder clock name +- arm64: dts: mediatek: mt8192-asurada: Remove CrosEC base detection node +- arm64: dts: mediatek: mt7986: add "#reset-cells" to infracfg +- arm64: dts: mediatek: mt7986: drop "#clock-cells" from PWM +- arm64: dts: mediatek: mt7986: fix SPI nodename +- arm64: dts: mediatek: mt7986: fix SPI bus width properties +- arm64: dts: mediatek: mt7986: drop crypto's unneeded/invalid clock name +- arm64: dts: mediatek: mt7986: fix reference to PWM in fan node +- arm64: dts: mt8183: Move CrosEC base detection node to kukui-based DTs +- ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down() +- selftests: forwarding: Add missing multicast routing config entries +- selftests: forwarding: Add missing config entries +- s390/vdso: drop '-fPIC' from LDFLAGS +- s390/pai: fix attr_event_free upper limit for pai device drivers +- wifi: iwlwifi: mvm: don't set replay counters to 0xff +- wifi: iwlwifi: mvm: don't set the MFP flag for the GTK +- wifi: iwlwifi: mvm: fix erroneous queue index mask +- wifi: iwlwifi: support EHT for WH +- tools/resolve_btfids: Fix cross-compilation to non-host endianness +- tools/resolve_btfids: Refactor set sorting with types from btf_ids.h +- pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan +- printk: Disable passing console lock owner completely during panic() +- wifi: ath12k: fix incorrect logic of calculating vdev_stats_id +- arm64: dts: qcom: sm6115: declare VLS CLAMP register for USB3 PHY +- arm64: dts: qcom: qcm2290: declare VLS CLAMP register for USB3 PHY +- wifi: wfx: fix memory leak when starting AP +- libbpf: Use OPTS_SET() macro in bpf_xdp_query() +- wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() +- wifi: ath11k: initialize rx_mcs_80 and rx_mcs_160 before use +- arm64: dts: ti: k3-j784s4: Fix power domain for VTM node +- arm64: dts: ti: k3-j721s2: Fix power domain for VTM node +- net: blackhole_dev: fix build warning for ethh set but not used +- pwm: atmel-hlcdc: Fix clock imbalance related to suspend support +- arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS +- gpio: vf610: allow disabling the vf610 driver +- wifi: iwlwifi: read BIOS PNVM only for non-Intel SKU +- wifi: iwlwifi: mvm: fix the TLC command after ADD_STA +- wifi: iwlwifi: mvm: d3: fix IPN byte order +- wifi: iwlwifi: fix EWRD table validity check +- wifi: iwlwifi: mvm: initialize rates in FW earlier +- wifi: iwlwifi: acpi: fix WPFC reading +- wifi: iwlwifi: dbg-tlv: ensure NUL termination +- wifi: iwlwifi: mvm: report beacon protection failures +- wifi: ath12k: fix fetching MCBC flag for QCN9274 +- wifi: ath12k: Update Qualcomm Innovation Center, Inc. copyrights +- wifi: ath11k: change to move WMI_VDEV_PARAM_SET_HEMU_MODE before WMI_PEER_ASSOC_CMDID +- wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete +- libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API +- arm64: dts: imx8mm-kontron: Fix interrupt for RTC on OSM-S i.MX8MM module +- arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL board +- arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL OSM-S board +- arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL board +- arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL OSM-S board +- arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL i.MX8MM +- arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on OSM-S i.MX8MM +- selftests/bpf: Disable IPv6 for lwt_redirect test +- arm64: dts: renesas: r8a779g0: Add missing SCIF_CLK2 +- arm64: dts: renesas: r8a779g0: Restore sort order +- arm64: dts: qcom: sa8540p: Drop gfx.lvl as power-domain for gpucc +- pmdomain: qcom: rpmhpd: Drop SA8540P gfx.lvl +- libbpf: Fix faccessat() usage on Android +- cpufreq: mediatek-hw: Don't error out if supply is not found +- arm64: dts: qcom: sdm845-oneplus-common: improve DAI node naming +- soc: qcom: socinfo: rename PM2250 to PM4125 +- arm64: dts: qcom: sm8450: Add missing interconnects to serial +- af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc(). +- selftests/bpf: Wait for the netstamp_needed_key static key to be turned on +- selftests/bpf: Fix the flaky tc_redirect_dtime test +- selftests/bpf: Add netkit to tc_redirect selftest +- selftests/bpf: De-veth-ize the tc_redirect test case +- wifi: ath12k: Fix issues in channel list update +- selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY values +- libbpf: Apply map_set_def_max_entries() for inner_maps on creation +- selftests/bpf: Fix potential premature unload in bpf_testmod +- bpftool: Silence build warning about calloc() +- inet_diag: annotate data-races around inet_diag_table[] +- sock_diag: annotate data-races around sock_diag_handlers[family] +- cpufreq: mediatek-hw: Wait for CPU supplies before probing +- cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value +- arm64: dts: qcom: sc8180x: Shrink aoss_qmp register space size +- arm64: dts: qcom: sc8180x: Require LOW_SVS vote for MMCX if DISPCC is on +- arm64: dts: qcom: sc8180x: Don't hold MDP core clock at FMAX +- arm64: dts: qcom: sc8180x: Fix eDP PHY power-domains +- arm64: dts: qcom: sc8180x: Add missing CPU off state +- arm64: dts: qcom: sc8180x: Fix up big CPU idle state entry latency +- arm64: dts: qcom: sc8180x: Hook up VDD_CX as GCC parent domain +- ARM: dts: renesas: r8a73a4: Fix external clocks and clock rate +- wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir() +- wifi: wilc1000: fix multi-vif management when deleting a vif +- wifi: wilc1000: do not realloc workqueue everytime an interface is added +- wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work +- wifi: wilc1000: fix RCU usage in connect path +- wifi: wilc1000: fix declarations ordering +- wifi: b43: Disable QoS for bcm4331 +- wifi: b43: Stop correct queue in DMA worker when QoS is disabled +- wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled +- wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled +- wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() +- timekeeping: Fix cross-timestamp interpolation for non-x86 +- timekeeping: Fix cross-timestamp interpolation corner case decision +- timekeeping: Fix cross-timestamp interpolation on counter wrap +- x86/sme: Fix memory encryption setting if enabled by default and not overridden +- x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type +- aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts +- io_uring/net: fix overflow check in io_recvmsg_mshot_prep() +- io_uring/net: move receive multishot out of the generic msghdr path +- io_uring/net: unify how recvmsg and sendmsg copy in the msghdr +- rtc: test: Fix invalid format specifier. +- time: test: Fix incorrect format specifier +- lib: memcpy_kunit: Fix an invalid format specifier in an assertion msg +- lib/cmdline: Fix an invalid format specifier in an assertion msg +- kunit: test: Log the correct filter string in executor_test +- ovl: Always reject mounting over case-insensitive directories +- ovl: add support for appending lowerdirs one by one +- ovl: refactor layer parsing helpers +- ovl: store and show the user provided lowerdir mount option +- ovl: remove unused code in lowerdir param parsing +- md: Don't clear MD_CLOSING when the raid is about to stop +- fs/select: rework stack allocation hack for clang +- rcu/exp: Handle RCU expedited grace period kworker allocation failure +- rcu/exp: Fix RCU expedited parallel grace period kworker allocation failure recovery +- s390/dasd: fix double module refcount decrement +- s390/dasd: Use dev_*() for device log messages +- io_uring: remove unconditional looping in local task_work handling +- io_uring: remove looping around handling traditional task_work +- fs: Fix rw_hint validation +- workqueue: Introduce struct wq_node_nr_active +- workqueue: Make wq_adjust_max_active() round-robin pwqs while activating +- workqueue: Move nr_active handling into helpers +- workqueue: Replace pwq_activate_inactive_work() with [__]pwq_activate_work() +- workqueue: Factor out pwq_is_empty() +- workqueue: Move pwq->max_active to wq->max_active +- workqueue.c: Increase workqueue name length +- ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll +- ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode +- ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC +- Input: gpio_keys_polled - suppress deferred probe error for gpio +- xfrm: set skb control buffer based on packet offload as well +- xfrm: fix xfrm child route lookup for packet offload +- ASoC: amd: yc: Add HP Pavilion Aero Laptop 13-be2xxx(8BD6) into DMI quirk table +- x86/hyperv: Allow 15-bit APIC IDs for VTL platforms +- ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet +- arm64: tegra: Set the correct PHY mode for MGBE +- perf: RISCV: Fix panic on pmu overflow handler +- firewire: core: use long bus reset on gap count error +- Bluetooth: mgmt: Fix limited discoverable off timeout +- ASoC: amd: yc: Fix non-functional mic on Lenovo 21J2 +- drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series +- ALSA: hda/realtek - ALC285 reduce pop noise from Headphone port +- scsi: mpt3sas: Prevent sending diag_reset when the controller is ready +- ASoC: amd: yc: Add Lenovo ThinkBook 21J0 into DMI quirk table +- drm/ttm/tests: depend on UML || COMPILE_TEST +- wifi: mac80211: only call drv_sta_rc_update for uploaded stations +- net: smsc95xx: add support for SYS TEC USB-SPEmodule1 +- regulator: max5970: Fix regulator child node name +- ARM: dts: renesas: rcar-gen2: Add missing #interrupt-cells to DA9063 nodes +- arm64: dts: qcom: Fix interrupt-map cell sizes +- arm: dts: Fix dtc interrupt_map warnings +- arm64: dts: Fix dtc interrupt_provider warnings +- arm: dts: Fix dtc interrupt_provider warnings +- dm-verity, dm-crypt: align "struct bvec_iter" correctly +- platform/x86: x86-android-tablets: Fix acer_b1_750_goodix_gpios name +- perf: CXL: fix CPMU filter value mask length +- cxl/region: Allow out of order assembly of autodiscovered regions +- cxl/region: Handle endpoint decoders in cxl_region_find_decoder() +- block: sed-opal: handle empty atoms when parsing response +- parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check +- net/iucv: fix the allocation size of iucv_path_table array +- x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() +- x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h +- riscv: dts: sifive: add missing #interrupt-cells to pmic +- ARM: dts: rockchip: Drop interrupts property from pwm-rockchip nodes +- RDMA/mlx5: Relax DEVX access upon modify commands +- RDMA/mlx5: Fix fortify source warning while accessing Eth segment +- arm64: dts: rockchip: mark system power controller on rk3588-evb1 +- soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt +- arm64/sve: Lower the maximum allocation for the SVE ptrace regset +- gen_compile_commands: fix invalid escape sequence warning +- ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend +- HID: multitouch: Add required quirk for Synaptics 0xcddc device +- MIPS: Clear Cause.BD in instruction_pointer_set +- x86/xen: Add some null pointer checking to smp.c +- ASoC: amd: yc: Fix non-functional mic on Lenovo 82UU +- regmap: kunit: Ensure that changed bytes are actually different +- spi: intel-pci: Add support for Lunar Lake-M SPI serial flash +- ASoC: rt5645: Make LattePanda board DMI match more precise +- selftests: tls: use exact comparison in recv_partial +- selftests: openvswitch: Add validation for the recursion test +- perf/arm-cmn: Workaround AmpereOneX errata AC04_MESH_1 (incorrect child count) +- wifi: iwlwifi: mvm: use correct address 3 in A-MSDU +- ASoC: cs42l43: Handle error from devm_pm_runtime_enable +- media: rkisp1: Fix IRQ handling due to shared interrupts +- soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free +- io_uring: drop any code related to SCM_RIGHTS +- io_uring/unix: drop usage of io_uring socket +- platform/x86: p2sb: On Goldmont only cache P2SB and SPI devfn BAR +- !6730 quota: Fix potential NULL pointer dereference +- quota: Fix potential NULL pointer dereference +- !6782 i2c: hisi: Add I2C controller reset and initialization proccess in bus recovery action +- i2c: hisi: Correct the description comment for PIN_MUX METHOD +- i2c: hisi: Add I2C controller reset and initialization proccess in bus recovery action +- !6760 spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs +- spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs +- !3176 [OLK-6.6] Turning off Zhaoxin ahci controller runtime pm +- Turning off Zhaoxin ahci controller runtime pm +- !6403 iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol +- iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol +- !6479 do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak +- do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak +- !6005 [OLK-6.6]Add Yunsilicon eth driver and rdma driver +- drivers: support for xsc drivers from Yunsilicon Technology +- !6595 A Solution to Re-enable hugetlb vmemmap optimize on ARM64 +- arm64: update openeuler_defconfig for HVO enable +- arm64: mm: Re-enable OPTIMIZE_HUGETLB_VMEMMAP +- arm64: mm: HVO: support BBM of vmemmap pgtable safely +- mm: HVO: introduce helper function to update and flush pgtable +- !6731 [OLK-6.6] watchdog: Fix call trace when failed to initialize sdei +- watchdog: Fix call trace when failed to initialize sdei +- !6651 [OLK - 6.6]net: hns3: add support for Hisilicon ptp sync device +- net: hns3: add support for Hisilicon ptp sync device +- !6385 ipvlan: Fix warning while IPVLAN_L2E disabled +- ipvlan: Fix warning while IPVLAN_L2E disabled +- !6409 [OLK-6.6] irqchip: gic-v3: Collection table support muti pages +- irqchip: gic-v3: Collection table support muti pages +- !6735 v2 SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP +- SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP +- !6590 v6 Introduce BPF_READAHEAD option for optimizing read performance +- arch: Add BPF_READAHEAD config options for supported architectures +- mm, fs: Add BPF_READAHEAD build option for bpf readhead +- !6681 v2 btrfs: fix data races when accessing the reserved amount of block reserves +- btrfs: fix data races when accessing the reserved amount of block reserves + +* Sun Apr 28 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-23.0.0.26 +- !6306 【OLK-6.6】fix compiling problem in bzwx N5/N6 series NIC drivers +- drivers: fix compiling problem in bzwx N5/N6 series NIC drivers +- !6692 ipvlan: enable CONFIG_IPVLAN_L2E option in openeuler config +- ipvlan: enable CONFIG_IPVLAN_L2E option in openeuler config +- !6632 ext4: use iomap for regular file's buffered IO path and enable large foilo +- ext4: add mount option for buffered IO iomap path +- ext4: don't mark IOMAP_F_DIRTY for buffer write +- ext4: enable large folio for regular file with iomap buffered IO path +- filemap: support disable large folios on active inode +- ext4: partial enable iomap for regular file's buffered IO path +- ext4: fall back to buffer_head path for defrag +- ext4: writeback partial blocks before zeroing out range +- ext4: implement zero_range iomap path +- ext4: implement mmap iomap path +- ext4: implement writeback iomap path +- ext4: implement buffered write iomap path +- ext4: implement buffered read iomap path +- ext4: add a new iomap aops for regular file's buffered IO path +- ext4: introduce seq counter for the extent status entry +- ext4: factor out ext4_map_create_blocks() to allocate new blocks +- ext4: use reserved metadata blocks when splitting extent on endio +- ext4: make ext4_da_map_blocks() buffer_head unaware +- ext4: make ext4_insert_delayed_block() insert multi-blocks +- ext4: factor out check for whether a cluster is allocated +- ext4: make ext4_da_reserve_space() reserve multi-clusters +- ext4: make ext4_es_insert_delayed_block() insert multi-blocks +- ext4: drop iblock parameter +- ext4: trim delalloc extent +- ext4: check the extent status again before inserting delalloc block +- ext4: factor out a common helper to query extent map +- ext4: make ext4_set_iomap() recognize IOMAP_DELALLOC map type +- ext4: make ext4_map_blocks() distinguish delalloc only extent +- ext4: add a hole extent entry in cache after punch +- ext4: convert to exclusive lock while inserting delalloc extents +- ext4: refactor ext4_da_map_blocks() +- iomap: do some small logical cleanup in buffered write +- iomap: make iomap_write_end() return a boolean +- iomap: use a new variable to handle the written bytes in iomap_write_iter() +- iomap: don't increase i_size if it's not a write operation +- iomap: drop the write failure handles when unsharing and zeroing +- xfs: convert delayed extents to unwritten when zeroing post eof blocks +- xfs: make xfs_bmapi_convert_delalloc() to allocate the target offset +- xfs: make the seq argument to xfs_bmapi_convert_delalloc() optional +- xfs: match lock mode in xfs_buffered_write_iomap_begin() +- iomap: add pos and dirty_len into trace_iomap_writepage_map +- iomap: pass the length of the dirty region to ->map_blocks +- iomap: map multiple blocks at a time +- iomap: submit ioends immediately +- iomap: factor out a iomap_writepage_map_block helper +- iomap: only call mapping_set_error once for each failed bio +- iomap: don't chain bios +- iomap: move the iomap_sector sector calculation out of iomap_add_to_ioend +- iomap: clean up the iomap_alloc_ioend calling convention +- iomap: move all remaining per-folio logic into iomap_writepage_map +- iomap: factor out a iomap_writepage_handle_eof helper +- iomap: move the PF_MEMALLOC check to iomap_writepages +- iomap: move the io_folios field out of struct iomap_ioend +- iomap: treat inline data in iomap_writepage_map as an I/O error +- iomap: clear the per-folio dirty bits on all writeback failures +- !6625 v2 perf data convert: Fix segfault when converting to json when cpu_desc isn't set +- perf data convert: Fix segfault when converting to json when cpu_desc isn't set +- !6647 infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver +- infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver +- net/ethernet/huawei/hinic3: Add the CQM on which the RDMA depends +- !6624 hisi-acc-vfio-pci:add DFX for acc migration driver +- hisi_acc_vfio_pci: add exception error handling +- hisi-acc-vfio-pci:add DFX for acc migration driver +- !6658 sched: disable sched_autogroup by default +- sched: disable sched_autogroup by default +- !6626 Backport page fault and fork optimization +- mm: swapfile: check usable swap device in __folio_throttle_swaprate() +- mm/filemap: optimize filemap folio adding +- lib/xarray: introduce a new helper xas_get_order +- lib/xarray: introduce a new helper xas_get_order +- mm/filemap: clean up hugetlb exclusion code +- mm/filemap: return early if failed to allocate memory for split +- mm: memory: check userfaultfd_wp() in vmf_orig_pte_uffd_wp() +- !6179 crypto: hisilicon - fixed some code security review issues +- crypto: hisilicon/debugfs - Resolve the problem of applying for redundant space in sq dump +- crypto: hisilicon/sec - Fix memory leak for sec resource release +- crypto: hisilicon - Adjust debugfs creation and release order +- crypto: hisilicon/qm - Add the default processing branch +- crypto: hisilicon/debugfs - Fix the processing logic issue in the debugfs creation +- crypto: hisilicon/sgl - Delete redundant parameter verification +- crypto: hisilicon/debugfs - Fix debugfs uninit process issue +- crypto: hisilicon/sec - Add the condition for configuring the sriov function +- crypto: hisilicon/zip - fix the missing CRYPTO_ALG_ASYNC in cra_flags +- !6400 btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve +- btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve +- !6444 Fix CVE-2024-26869 +- f2fs: fix to truncate meta inode pages forcely +- f2fs: introduce f2fs_invalidate_internal_cache() for cleanup +- !6585 ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() +- ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() +- !6251 ubi: Check for too small LEB size in VTBL code +- ubi: Check for too small LEB size in VTBL code +- !6418 media: pvrusb2: fix uaf in pvr2_context_set_notify +- media: pvrusb2: fix uaf in pvr2_context_set_notify + +* Wed Apr 24 2024 Zheng Zengkai <zhengzengkai@huawei.com> - 6.6.0-22.0.0.25 +- !6467 RDMA/hns: Some bugfixes and cleanups +- RDMA/hns: Fix incorrect variable usage in scc_attr_is_visible() +- RDMA/hns: Fix null pointer when alloc_scc_param() fails +- RDMA/hns: Fix scc_param delay_work to execute after sysfs shutdown +- RDMA/hns: Add mutex_destroy() to destroy the mutex +- RDMA/hns: Fix a potential Sleep-in-Atomic-Context +- !6468 v2 scsi: fnic: Move fnic_fnic_flush_tx() to a work queue +- scsi: fnic: Move fnic_fnic_flush_tx() to a work queue +- !6439 v3 m: convert mm's rss stats to use atomic mode +- mm: convert mm's rss stats to use atomic mode +- percpu_counter: introduce atomic mode for percpu_counter +- !6424 mm/migrate: correct nr_failed in migrate_pages_sync() +- mm/migrate: add nr_split to trace_mm_migrate_pages stats. +- mm/migrate: correct nr_failed in migrate_pages_sync() +- !6390 nfs: fix panic when nfs4_ff_layout_prepare_ds() fails +- nfs: fix panic when nfs4_ff_layout_prepare_ds() fails +- !5482 [OLK-6.6] crypto: update zhaoxin-aes for __pcpu_unique_paes_last_cword +- crypto: update zhaoxin-aes for __pcpu_unique_paes_last_cword +- !3171 [OLK-6.6] ata: libata: disabling PhyRdy Change Interrupt based on actual LPM capability +- ata: libata: disabling PhyRdy Change Interrupt based on actual LPM capability +- !6443 f2fs: fix NULL pointer dereference in f2fs_submit_page_write() +- f2fs: fix NULL pointer dereference in f2fs_submit_page_write() +- !6261 RDMA/hns: Some bugfixes and cleanups +- RDMA/hns: Modify the print level of CQE error +- RDMA/hns: Add mutex_destroy() +- RDMA/hns: Fix GMV table pagesize +- RDMA/hns: Fix mismatch exception rollback +- RDMA/hns: Fix UAF for cq async event +- RDMA/hns: Fix deadlock on SRQ async events. +- RDMA/hns: Remove unused parameters and variables +- RDMA/hns: Use macro instead of magic number +- RDMA/hns: Fix return value in hns_roce_map_mr_sg +- !6265 tpm_tis: Avoid warning splat at shutdown +- tpm,tpm_tis: Avoid warning splat at shutdown +- !6402 bpf: Add missing BPF_LINK_TYPE invocations +- bpf: Add missing BPF_LINK_TYPE invocations +- !6256 [OLK-6.6] bugfix from upstream v6.9 for AMD EPYC perf +- perf/x86/amd/core: Define a proper ref-cycles event for Zen 4 and later +- perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later +- perf/x86/amd/lbr: Use freeze based on availability +- !6134 v3 rootfs: Fix support for rootfstype= when root= is given +- rootfs: Fix support for rootfstype= when root= is given + +* Tue Apr 23 2024 Hongchen Zhang <zhanghongchen@loongson.cn> - 6.6.0-21.0.0.24 +- add LoongArch support + +* Tue Apr 23 2024 Hongchen Zhang <zhanghongchen@loongson.cn> - 6.6.0-21.0.0.23 +- exclude cpufreq.h and cpuidle.h from kernel-headers package + +* Sat Apr 20 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-21.0.0.22 +- !6201 v2 mm: some optimization about hugetlb and thp +- mm: filemap: try to enable THP for exec mapping +- mm/khugepaged: keep mm in mm_slot without MMF_DISABLE_THP check +- mm/khugepaged: bypassing unnecessary scans with MMF_DISABLE_THP check +- mm: mmap: no need to call khugepaged_enter_vma() for stack +- mm: remove VM_EXEC requirement for THP eligibility +- mm: thp_get_unmapped_area must honour topdown preference +- mm: huge_memory: don't force huge page alignment on 32 bit +- mm: mmap: map MAP_STACK to VM_NOHUGEPAGE +- mm: align larger anonymous mappings on THP boundaries +- fs/hugetlbfs/inode.c: mm/memory-failure.c: fix hugetlbfs hwpoison handling +- mm/hugetlb: have CONFIG_HUGETLB_PAGE select CONFIG_XARRAY_MULTI +- mm/filemap: remove hugetlb special casing in filemap.c +- mm/filemap: clarify filemap_fault() comments for not uptodate case +- mm: huge_memory: batch tlb flush when splitting a pte-mapped THP +- !6230 xarray: inline xas_descend to improve performance +- xarray: inline xas_descend to improve performance +- !5891 Fix several compilation warnings for hinic driver +- net/hinic: Fix several compilation warnings with aarch64-openEuler-linux toolchain +- !6244 arm64: enable CONFIG_ARM64_MPAM in openeuler_defconfig +- arm64: enable CONFIG_ARM64_MPAM in openeuler_defconfig +- !6105 fix some issues for arm64 machine check safe +- ACPI: APEI: handle synchronous exceptions in task work to send correct SIGBUS si_code +- mm: memory-failure: move return value documentation to function declaration +- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered +- arm64: add machine check safe sysctl interface +- arm64: introduce copy_mc_to_kernel() implementation +- arm64: support copy_mc_[user]_highpage() +- arm64: Get rid of ARM64_HAS_NO_HW_PREFETCH +- mm/hwpoison: return -EFAULT when copy fail in copy_mc_[user]_highpage() +- arm64: add support for ARCH_HAS_COPY_MC +- Revert "arm64: add support for machine check error safe" +- Revert "arm64: add uaccess to machine check safe" +- Revert "mm/hwpoison: return -EFAULT when copy fail in copy_mc_[user]_highpage()" +- Revert "arm64: support copy_mc_[user]_highpage()" +- Revert "arm64: introduce copy_mc_to_kernel() implementation" +- Revert "arm64: add machine check safe sysctl interface" +- Revert "kasan: fix the compilation error for memcpy_mcs()" + +* Tue Apr 16 2024 Zheng Zengkai <zhengzengkai@huawei.com> - 6.6.0-20.0.0.21 +- !6048 improve 3SNIC 910/920/930 NIC driver +- improve 3SNIC 910/920/930 NIC driver +- !5815 v2 Support NMI in the virtual machine +- KVM: arm64: vgic-v3: Handle traps of ICV_NMIAR1_EL1 +- arm64: Decouple KVM from CONFIG_ARM64_NMI +- KVM: arm64: Handle traps of ALLINT +- KVM: arm64: Allow GICv3.3 NMI if the host supports it +- KVM: arm64: vgic-v3: Don't inject an NMI if the vcpu doesn't have FEAT_NMI +- KVM: arm64: Don't trap ALLINT accesses if the vcpu has FEAT_NMI +- KVM: arm64: Allow userspace to control ID_AA64PFR1_EL1.NMI +- KVM: arm64: vgic-debug: Add the NMI field to the debug output +- KVM: arm64: vgic-v3: Add userspace selection for GICv3.3 NMI +- KVM: arm64: vgic-v3: Add support for GIC{D,R}_INMIR registers +- KVM: arm64: vgic-v3: Use the NMI attribute as part of the AP-list sorting +- KVM: arm64: vgic-v4: Propagate the NMI state into the GICv4.1 VSGI configuration +- KVM: arm64: vgic-v3: Make NMI priority RES0 +- KVM: arm64: vgic-v3: Allow the NMI state to make it into the LRs +- KVM: arm64: vgic-v3: Upgrade AP1Rn to 64bit. +- !5752 【OLK-6.6】Add Chengdu BeiZhongWangXin Technology N5/N6 Series Network Card Driver +- drivers: add Chengdu BeiZhongWangXin Technology N5/N6 Series Network Card Driver +- !5730 [OLK-6.6] Fix warnings for RNPGBEVF driver +- RNPGBEVF: NET: Fix wanrings +- !5726 [OLK-6.6] Fix warnings for RNPVF driver +- RNPVF: NET: Fix wanrings +- !5854 [OLK-6.6] Make Cluster Scheduling Configurable +- scheduler: Disable cluster scheduling by default +- scheduler: Add boot time enabling/disabling of cluster scheduling +- scheduler: Add runtime knob sysctl_sched_cluster +- scheduler: Create SDTL_SKIP flag to skip topology level +- !6068 mm: batch mm counter updating in filemap_map_pages() +- mm: filemap: batch mm counter updating in filemap_map_pages() +- mm: move mm counter updating out of set_pte_range() +- !5931 irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801 +- irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801 +- !5678 v2 KVM: arm64: Translate logic cluster id to physical cluster id when updating lsudvmbm +- KVM: arm64: Translate logic cluster id to physical cluster id when updating lsudvmbm +- !5972 Perf-related bugfix +- docs: perf: Fix build warning of hisi-pcie-pmu.rst +- drivers/perf: hisi_pcie: Merge find_related_event() and get_event_idx() +- drivers/perf: hisi_pcie: Relax the check on related events +- drivers/perf: hisi_pcie: Check the target filter properly +- drivers/perf: hisi_pcie: Add more events for counting TLP bandwidth +- drivers/perf: hisi_pcie: Fix incorrect counting under metric mode +- drivers/perf: hisi_pcie: Introduce hisi_pcie_pmu_get_event_ctrl_val() +- drivers/perf: hisi_pcie: Rename hisi_pcie_pmu_{config,clear}_filter() +- drivers/perf: hisi: Enable HiSilicon Erratum 162700402 quirk for HIP09 +- docs: perf: Update usage for target filter of hisi-pcie-pmu +- !6063 RDMA/hns: Some bugfixes and cleanups +- RDMA/hns: Fix long waiting cmd event when reset +- RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() +- RDMA/hns: Fix simultaneous reset and resource deregistration +- RDMA/hns: Fix cpu stuck by printings during reset +- RDMA/hns: Fix missing capacities in query_device() +- RDMA/hns: Fix missing resetting notify +- RDMA/hns: Remove extra blank line in get_sge_num_from_max_inl_data() +- RDMA/hns: Use complete parentheses in macros +- RDMA/hns: fix iommu_map_sg() failed when MR bigger than 4G +- !6069 RDMA/hns: support roh +- RDMA/hns: Support RDMA_CM in ROH mode +- RDMA/hns: Support for ROH +- RDMA/hns: Add new device ID +- !6008 locking/osq_lock: Avoid false sharing in optimistic_spin_node +- locking/osq_lock: Avoid false sharing in optimistic_spin_node +- !5774 irqdomain: Fix driver re-inserting failures when IRQs not being freed +- irqdomain: Fix driver re-inserting failures when IRQs not being freed +- !5709 【OLK-6.6】configs: arm64: Enable CONFIG_DLM +- configs: arm64: Enable CONFIG_DLM +- !5971 RDMA/hns: Support hns roce DCA mode +- RDMA/hns: Fix DCA's dependence on ib_uverbs +- RDMA/hns: Fixes concurrent ressetting and post_recv in DCA mode +- RDMA/hns: Optimize user DCA perfermance by sharing DCA status +- RDMA/hns: Add debugfs support for DCA +- RDMA/hns: Add DCA support for kernel space +- RDMA/hns: Add method to query WQE buffer's address +- RDMA/hns: Add method to detach WQE buffer +- RDMA/hns: Setup the configuration of WQE addressing to QPC +- RDMA/hns: Add method for attaching WQE buffer +- RDMA/hns: Configure DCA mode for the userspace QP +- RDMA/hns: Add method for shrinking DCA memory pool +- RDMA/hns: Introduce DCA for RC QP + +* Fri Apr 12 2024 Jin Lun <jinlun@huawei.com> - 6.6.0-19.0.0.20 +- Remove PGP certificates. +- Optimize the signing process, if the project has no permission + to send sign request, use the kernel native signing. + +* Wed Apr 10 2024 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-19.0.0.19 +- !5877 optimize eevdf scheduler +- sched/eevdf: Skip eligibility check for current entity during wakeup preemption +- sched/eevdf: O(1) fastpath for task selection +- sched/eevdf: Sort the rbtree by virtual deadline +- !5922 Some fixes and cleanups for SAS +- Revert "scsi: hisi_sas: Disable SATA disk phy for severe I_T nexus reset failure" +- scsi: hisi_sas: Add slave_destroy interface for v3 hw +- scsi: hisi_sas: Modify the deadline for ata_wait_after_reset() +- scsi: libsas: Allocation SMP request is aligned to ARCH_DMA_MINALIGN +- scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type() +- scsi: libsas: Fix disk not being scanned in after being removed +- scsi: hisi_sas: Remove redundant checks for automatic debugfs dump +- scsi: hisi_sas: Check usage count only when the runtime PM status is RPM_SUSPENDING +- scsi: hisi_sas: Handle the NCQ error returned by D2H frame +- scsi: hisi_sas: Remove hisi_hba->timer for v3 hw +- scsi: hisi_sas: Check whether debugfs is enabled before removing or releasing it +- scsi: hisi_sas: Fix a deadlock issue related to automatic dump +- scsi: hisi_sas: Allocate DFX memory during dump trigger +- scsi: hisi_sas: Directly call register snapshot instead of using workqueue +- !5546 support 3snic NIC +- support 3SNIC 910/920/930 NIC +- !5869 KVM: arm64: vgic-its: use vgic_get_irq_kref() before vgic_put_irq() +- KVM: arm64: vgic-its: use vgic_get_irq_kref() before vgic_put_irq() +- !5878 ima:Dont check xattr when loading digest lists +- ima:Dont check xattr when loading digest lists +- !5800 firmware: arm_sdei: Move sdei_cpuhp_up/down() before lockup_detector_online_cpu() +- firmware: arm_sdei: Move sdei_cpuhp_up/down() before lockup_detector_online_cpu() +- !3175 [OLK-6.6] x86/tsc: Make cur->adjusted values in package#1 to be the same +- x86/tsc: Make cur->adjusted values in package#1 to be the same +- !5022 [devel-6.6] perf/x86/zhaoxin/uncore: Add KX-7000 support +- perf/x86/zhaoxin/uncore: Add KX-7000 support +- !5652 [OLK-6.6] i2c: zhaoxin: update support for Zhaoxin I2C controller +- i2c: zhaoxin: update support for Zhaoxin I2C controller +- !4475 [OLK-6.6] Update zhaoxin cputemp driver with using the same MSR uniformly +- Update zhaoxin cputemp driver with using the same MSR uniformly +- !5813 [intel]OLK-tdx-guest-configs-6.6 +- Enable Intel TDX guest as kernel module +- !5723 vfio/migration: some bugfix +- hisi_acc_vfio_pci: obtain the mailbox configuration at one time +- vfio/migration: remove unused local variable +- vfio/migration: bugfix cache write-back issue +- vfio/migration: add eq and aeq interruption restore +- vfio/migration: bugfix some driver code +- vfio/migration: added map length page alignment +- !5707 [OLK-6.6] Fix warnings for RNPGBE driver +- RNPGBE: NET: Fix wanrings +- !5659 [OLK-6.6] Fix warnings for RNP driver +- RNP: Fix warnings + +* Mon Apr 08 2024 Ren Zhijie <zhijie.ren@shingroup.cn> - 6.6.0-18.0.0.18 +- add support for arch ppc64le + +* Mon Apr 08 2024 Zheng Zengkai <zhengzengkai@huawei.com> - 6.6.0-18.0.0.17 +- !5768 resctrl: fix undefined reference to lockdep_is_cpus_held() +- fs/resctrl: Move rdtgroup_setup_default() out of init.text section +- resctrl: fix undefined reference to lockdep_is_cpus_held() +- !5769 Revert "KVM: arm64: Disable MPAM visibility by default, and handle traps" +- Revert "KVM: arm64: Disable MPAM visibility by default, and handle traps" +- !5744 Backport maple_tree: iterator state changes +- lib/maple_tree.c: fix build error due to hotfix alteration +- maple_tree: mtree_range_walk() clean up +- maple_tree: don't find node end in mtree_lookup_walk() +- maple_tree: use maple state end for write operations +- maple_tree: remove mas_searchable() +- maple_tree: separate ma_state node from status +- maple_tree: clean up inlines for some functions +- maple_tree: use cached node end in mas_destroy() +- maple_tree: use cached node end in mas_next() +- maple_tree: add end of node tracking to the maple state +- maple_tree: move debug check to __mas_set_range() +- maple_tree: make mas_erase() more robust +- maple_tree: remove unnecessary default labels from switch statements +- !5725 ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs +- ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs + +* Sun Apr 07 2024 Zheng Zengkai <zhengzengkai@huawei.com> - 6.6.0-17.0.0.16 +- !5695 v2 Disable OLK-6.6 configs +- arm64: configs: Disable PROBE_EVENTS_BTF_ARGS +- x86: configs: Disable PROBE_EVENTS_BTF_ARGS +- x86: configs: Disable X86_KERNEL_IBT +- x86: configs: Disable CRASH_HOTPLUG +- !5733 fix port vlan filter not disabled problem in dynamic vlan mode +- net: hns3: fix port vlan filter not disabled problem in dynamic vlan mode +- !5734 arch/mm/fault: accelerate pagefault when badaccess +- x86: mm: accelerate pagefault when badaccess +- arm64: mm: accelerate pagefault when VM_FAULT_BADACCESS +- !5657 Backport slub performance optimization +- mm/slub: remove unused parameter in next_freelist_entry() +- mm/slub: remove full list manipulation for non-debug slab +- mm/slub: directly load freelist from cpu partial slab in the likely case +- slub: Update frozen slabs documentations in the source +- slub: Rename all *unfreeze_partials* functions to *put_partials* +- slub: Optimize deactivate_slab() +- slub: Delay freezing of partial slabs +- slub: Introduce freeze_slab() +- slub: Prepare __slab_free() for unfrozen partial slab out of node partial list +- slub: Keep track of whether slub is on the per-node partial list +- slub: Change get_partial() interfaces to return slab +- slub: Reflow ___slab_alloc() +- !5699 sr9800: Add check for usbnet_get_endpoints +- sr9800: Add check for usbnet_get_endpoints + +* Tue Apr 02 2024 Zheng Zengkai <zhengzengkai@huawei.com> - 6.6.0-16.0.0.15 +- !5647 hisilicon - some bugfix and cleanup +- crypto: hisilicon/sec2: fix memory use-after-free issue +- crypto: hisilicon/qm - hardware error does not reset during binding/unbinding +- crypto: hisilicon/qm - check device status before sending mailbox +- crypto: hisilicon/qm - mask error bit before flr +- crypto: hisilicon/qm - fix the pf2vf timeout when global reset +- crypto: hisilicon/qm - obtain the mailbox configuration at one time +- crypto: hisilicon/hpre - mask cluster timeout error +- crypto: hisilicon/qm - disable same error report before resetting +- crypto: hisilicon/qm - modify interrupt processing resource application +- crypto: hisilicon/qm - reset device before enabling it +- openeuler_defconfig: enable HISI_ACC_VFIO_PCI=m +- Revert "openeuler_defconfig: enable HISI_ACC_VFIO_PCI=m" +- !5509 ext4: Validate inode pa before using preallocation blocks +- ext4: Validate inode pa before using preallocation blocks +- !5630 scsi: sd: try more retries of START_STOP when resuming scsi device +- scsi: sd: try more retries of START_STOP when resuming scsi device +- !5561 roh: backport roh driver feature support +- roh/hns3: Fix the processing flow of ROH CMDq during the reset process. +- roh/core: Synchronously update the mac address of the vlan device when configuring the vlan device ip +- roh/hns3: Fix ROH multi-BD cmdq issue +- roh/hns3: Add support for roh dfx(debugfs) +- roh/hns3: Add support for roh reset +- roh/core: Add support for inetaddr notifier in roh/core +- roh/hns3: Add support for roh abnormal interruption +- roh/core: Add roh device sysfs node +- roh/hns3: Add ROH cmdq interface support +- roh/hns3: Add ROH hns3 driver and register a ROH device +- roh/core: Add ROH device driver +- net: hns3: add support for ROH reset +- net: hns3: intercept invalid MAC address setting in ROH +- !5703 openeuler_defconfig: Disable CONFIG_PREEMPT_DYNAMIC for x86 +- openeuler_defconfig: Disable CONFIG_PREEMPT_DYNAMIC for x86 +- !5513 [OLK-6.6] SCSI: SSSRAID: Support 3SNIC 3S5XX serial RAID/HBA controllers +- SCSI: SSSRAID: Support 3SNIC 3S5XX serial RAID/HBA controllers +- !5582 [OLK-6.6]Open CONFIG_LZ4_COMPRESS option for x86_64 architecture +- Open CONFIG_LZ4_COMPRESS option for x86_64 architecture +- !5688 v3 Optimize compaction +- mm/compaction: optimize >0 order folio compaction with free page split. +- mm/compaction: add support for >0 order folio memory compaction. +- mm/compaction: enable compacting >0 order folios. +- mm/page_alloc: remove unused fpi_flags in free_pages_prepare() +- mm/compaction: introduce NR_PAGE_ORDERS and MAX_PAGE_ORDER +- mm: compaction: limit the suitable target page order to be less than cc->order +- mm: compaction: update the cc->nr_migratepages when allocating or freeing the freepages +- mm: compaction: avoid fast_isolate_freepages blindly choose improper pageblock +- mm: add page_rmappable_folio() wrapper +- mm: page_alloc: check the order of compound page even when the order is zero +- mm/compaction: factor out code to test if we should run compaction for target order +- mm/compaction: improve comment of is_via_compact_memory +- mm/compaction: remove repeat compact_blockskip_flush check in reset_isolation_suitable +- mm/compaction: correctly return failure with bogus compound_order in strict mode +- mm/compaction: call list_is_{first}/{last} more intuitively in move_freelist_{head}/{tail} +- mm/compaction: use correct list in move_freelist_{head}/{tail} +- !5655 add steal time software breakpoint pv ipi support for loongarch kvm +- LoongArch: Add steal time support in guest side +- LoongArch: KVM: Add steal time support in kvm side +- irqchip/loongson-eiointc: Add virt extension support +- LoongArch: KVM: Add software breakpoint support +- Documentation: KVM: Add hypercall for LoongArch +- LoongArch: Add pv ipi support on guest kernel side +- LoongArch: KVM: Add pv ipi support on kvm side +- LoongArch: KVM: Add vcpu search support from physical cpuid +- LoongArch: KVM: Add cpucfg area for kvm hypervisor +- LoongArch: KVM: Add hypercall instruction emulation support +- LoongArch/smp: Refine some ipi functions on LoongArch platform +- !5653 arm64: Enable hardware NMI for perf events NMI +- arm64: Enable hardware NMI for perf events NMI +- !5667 configs: arm64: Enable CONFIG_ACPI_AGDI and CONFIG_ACPI_FFH +- configs: arm64: Enable CONFIG_ACPI_AGDI and CONFIG_ACPI_FFH +- !5669 disable CONFIG_CMDLINE_FROM_BOOTLOADER CONFIG_INITRAMFS_PRESERVE_MTIME in 6.6 +- configs: disable CONFIG_CMDLINE_FROM_BOOTLOADER CONFIG_INITRAMFS_PRESERVE_MTIME in 6.6 +- !5663 arm64: transparent contiguous PTEs for user mappings +- arm64: configs: enable ARM64_CONTPTE +- tools/mm: add thpmaps script to dump THP usage info +- mm: make folio_pte_batch available outside of mm/memory.c +- arm64/mm: automatically fold contpte mappings +- arm64/mm: __always_inline to improve fork() perf +- arm64/mm: implement pte_batch_hint() +- mm: add pte_batch_hint() to reduce scanning in folio_pte_batch() +- arm64/mm: implement new [get_and_]clear_full_ptes() batch APIs +- arm64/mm: implement new wrprotect_ptes() batch API +- arm64/mm: wire up PTE_CONT for user mappings +- arm64/mm: dplit __flush_tlb_range() to elide trailing DSB +- arm64/mm: new ptep layer to manage contig bit +- arm64/mm: convert ptep_clear() to ptep_get_and_clear() +- arm64/mm: convert set_pte_at() to set_ptes(..., 1) +- arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep) +- mm: tidy up pte_next_pfn() definition +- x86/mm: convert pte_next_pfn() to pte_advance_pfn() +- arm64/mm: convert pte_next_pfn() to pte_advance_pfn() +- mm: introduce pte_advance_pfn() and use for pte_next_pfn() +- mm: thp: batch-collapse PMD with set_ptes() +- mm: clarify the spec for set_ptes() +- mm: memory: move mem_cgroup_charge() into alloc_anon_folio() +- mm: memory: use folio_prealloc() in wp_page_copy() +- mm: memory: use a folio in do_cow_fault() +- mm: memory: rename page_copy_prealloc() to folio_prealloc() +- !5662 v4 Introduce dynamic pool feature part 2 +- mm/dynamic_pool: Wrap some core functions with dpool prefix +- mm/dynamic_pool: disable irq for dynamic_pool lock +- mm/dynamic_pool: don't set subpool for page from dynamic pool +- mm/dynamic_pool: skip unexpected migration +- mm/mem_reliable: Fallback to dpool if reliable memory is not enough +- mm/mem_reliable: Treat page from dhugetlb pool as unreliable page +- mm/dynamic_pool: Stop alloc reliable page from dynamic pool +- !5621 irqchip/gic-v3: Fix a system stall when using pseudo NMI with CONFIG_ARM64_NMI closed +- irqchip/gic-v3: Fix a system stall when using pseudo NMI with CONFIG_ARM64_NMI closed +- !5656 v3 mm: backport fork/unmap/zap optimize +- mm/memory: fix missing pte marker for !page on pte zaps +- mm/memory: optimize unmap/zap with PTE-mapped THP +- mm/mmu_gather: improve cond_resched() handling with large folios and expensive page freeing +- mm/mmu_gather: add __tlb_remove_folio_pages() +- mm/mmu_gather: add tlb_remove_tlb_entries() +- mm/mmu_gather: define ENCODED_PAGE_FLAG_DELAY_RMAP +- mm/mmu_gather: pass "delay_rmap" instead of encoded page to __tlb_remove_page_size() +- mm/memory: factor out zapping folio pte into zap_present_folio_pte() +- mm/memory: further separate anon and pagecache folio handling in zap_present_pte() +- mm/memory: handle !page case in zap_present_pte() separately +- mm/memory: factor out zapping of present pte into zap_present_pte() +- mm/memory: ignore writable bit in folio_pte_batch() +- mm/memory: ignore dirty/accessed/soft-dirty bits in folio_pte_batch() +- mm/memory: optimize fork() with PTE-mapped THP +- mm/memory: pass PTE to copy_present_pte() +- mm/memory: factor out copying the actual PTE in copy_present_pte() +- powerpc/mm: use pte_next_pfn() in set_ptes() +- arm/mm: use pte_next_pfn() in set_ptes() +- mm/pgtable: make pte_next_pfn() independent of set_ptes() +- sparc/pgtable: define PFN_PTE_SHIFT +- s390/pgtable: define PFN_PTE_SHIFT +- riscv/pgtable: define PFN_PTE_SHIFT +- powerpc/pgtable: define PFN_PTE_SHIFT +- nios2/pgtable: define PFN_PTE_SHIFT +- arm/pgtable: define PFN_PTE_SHIFT +- arm64/mm: make set_ptes() robust when OAs cross 48-bit boundary +- arm64: Mark the 'addr' argument to set_ptes() and __set_pte_at() as unused +- arm64/mm: Hoist synchronization out of set_ptes() loop +- mm: convert mm_counter_file() to take a folio +- mm: convert mm_counter() to take a folio +- mm: convert to should_zap_page() to should_zap_folio() +- mm: use pfn_swap_entry_folio() in copy_nonpresent_pte() +- mm: use pfn_swap_entry_to_folio() in zap_huge_pmd() +- mm: use pfn_swap_entry_folio() in __split_huge_pmd_locked() +- s390: use pfn_swap_entry_folio() in ptep_zap_swap_entry() +- mprotect: use pfn_swap_entry_folio +- mm: add pfn_swap_entry_folio() + +* Tue Apr 2 2024 Jin Lun <jinlun@huawei.com> - 6.6.0-15.0.0.14 +- Support generating moudle/kernel signature with openEuler signature platform + +* Sat Mar 30 2024 Liu Jian <liujian56@huawei.com> - 6.6.0-15.0.0.13 +- And net-acc tool to kernel-tools. + +* Fri Mar 29 2024 Zheng Zengkai <zhengzengkai@huawei.com> - 6.6.0-15.0.0.12 +- !5470 [OLK-6.6] Add support for Mucse Virtual Function Network Adapter(N500/n210) +- drivers: initial support for rnpgbevf drivers from Mucse Technology +- !3164 [OLK-6.6] Fix CRC32C instruction low performance issue +- crypto: x86/crc32c-intel - Don't match some Zhaoxin CPUs +- !5547 Synchronizing upstream patch +- LoongArch: KVM: Set reserved bits as zero in CPUCFG +- LoongArch: KVM: Do not restart SW timer when it is expired +- LoongArch: KVM: Start SW timer only when vcpu is blocking +- irqchip/loongson-eiointc: Remove explicit interrupt affinity restore on resume +- irqchip/loongson-eiointc: Skip handling if there is no pending irq +- !3182 [OLK-6.6] Add support for Zhaoxin GMI SM2 Secure Hash algorithm +- configs: add CONFIG_CRYPTO_SM2_ZHAOXIN_GMI to m +- Add support for Zhaoxin GMI SM2 Secure Hash algorithm +- !5578 SCSI: hisi_raid: support SPxxx serial RAID/HBA controllers +- SCSI: hisi_raid: support SPxxx serial RAID/HBA controllers +- !5641 userfaultfd: early return in dup_userfaultfd() +- userfaultfd: early return in dup_userfaultfd() +- !5629 v3 Mitigate a vmap lock contention +- mm: vmalloc: refactor vmalloc_dump_obj() function +- mm: vmalloc: improve description of vmap node layer +- mm: vmalloc: add a shrinker to drain vmap pools +- mm: vmalloc: set nr_nodes based on CPUs in a system +- mm: vmalloc: support multiple nodes in vmallocinfo +- mm: vmalloc: support multiple nodes in vread_iter +- mm: vmalloc: add a scan area of VA only once +- mm: vmalloc: offload free_vmap_area_lock lock +- mm: vmalloc: remove global purge_vmap_area_root rb-tree +- mm/vmalloc: remove vmap_area_list +- mm: vmalloc: remove global vmap_area_root rb-tree +- mm: vmalloc: move vmap_init_free_space() down in vmalloc.c +- mm: vmalloc: rename adjust_va_to_fit_type() function +- mm: vmalloc: add va_alloc() helper +- mm: Introduce vmap_page_range() to map pages in PCI address space +- mm: Introduce VM_SPARSE kind and vm_area_[un]map_pages(). +- mm: Enforce VM_IOREMAP flag and range in ioremap_page_range. +- mm/vmalloc: fix the unchecked dereference warning in vread_iter() +- !5609 Adding Huawei BMA driver +- configs: add config BMA to config files +- Huawei BMA: Adding Huawei BMA driver: cdev_veth_drv +- Huawei BMA: Adding Huawei BMA driver: host_kbox_drv +- Huawei BMA: Adding Huawei BMA driver: host_veth_drv +- Huawei BMA: Adding Huawei BMA driver: host_cdev_drv +- Huawei BMA: Adding Huawei BMA driver: host_edma_drv +- !5613 mm: backport rmap interface overhaul +- mm/memory: fix folio_set_dirty() vs. folio_mark_dirty() in zap_pte_range() +- mm/huge_memory: fix folio_set_dirty() vs. folio_mark_dirty() +- mm/rmap: silence VM_WARN_ON_FOLIO() in __folio_rmap_sanity_checks() +- mm: remove one last reference to page_add_*_rmap() +- mm/rmap: rename COMPOUND_MAPPED to ENTIRELY_MAPPED +- mm: convert page_try_share_anon_rmap() to folio_try_share_anon_rmap_[pte|pmd]() +- mm/rmap: remove page_try_dup_anon_rmap() +- mm/memory: page_try_dup_anon_rmap() -> folio_try_dup_anon_rmap_pte() +- mm/huge_memory: page_try_dup_anon_rmap() -> folio_try_dup_anon_rmap_pmd() +- mm/rmap: introduce folio_try_dup_anon_rmap_[pte|ptes|pmd]() +- mm/rmap: convert page_dup_file_rmap() to folio_dup_file_rmap_[pte|ptes|pmd]() +- mm/rmap: remove page_remove_rmap() +- Documentation: stop referring to page_remove_rmap() +- mm: userswap: page_remove_rmap() -> folio_remove_rmap_pte() +- mm/rmap: page_remove_rmap() -> folio_remove_rmap_pte() +- mm/migrate_device: page_remove_rmap() -> folio_remove_rmap_pte() +- mm/memory: page_remove_rmap() -> folio_remove_rmap_pte() +- mm/ksm: page_remove_rmap() -> folio_remove_rmap_pte() +- mm/khugepaged: page_remove_rmap() -> folio_remove_rmap_pte() +- mm/huge_memory: page_remove_rmap() -> folio_remove_rmap_pmd() +- kernel/events/uprobes: page_remove_rmap() -> folio_remove_rmap_pte() +- mm/rmap: introduce folio_remove_rmap_[pte|ptes|pmd]() +- mm/rmap: remove RMAP_COMPOUND +- mm/rmap: remove page_add_anon_rmap() +- mm/memory: page_add_anon_rmap() -> folio_add_anon_rmap_pte() +- mm/swapfile: page_add_anon_rmap() -> folio_add_anon_rmap_pte() +- mm/ksm: page_add_anon_rmap() -> folio_add_anon_rmap_pte() +- mm/migrate: page_add_anon_rmap() -> folio_add_anon_rmap_pte() +- mm/huge_memory: page_add_anon_rmap() -> folio_add_anon_rmap_pmd() +- mm/huge_memory: batch rmap operations in __split_huge_pmd_locked() +- mm/rmap: introduce folio_add_anon_rmap_[pte|ptes|pmd]() +- mm/rmap: factor out adding folio mappings into __folio_add_rmap() +- mm/rmap: remove page_add_file_rmap() +- mm/userfaultfd: page_add_file_rmap() -> folio_add_file_rmap_pte() +- mm/migrate: page_add_file_rmap() -> folio_add_file_rmap_pte() +- mm/huge_memory: page_add_file_rmap() -> folio_add_file_rmap_pmd() +- mm/memory: page_add_file_rmap() -> folio_add_file_rmap_[pte|pmd]() +- mm/rmap: convert folio_add_file_rmap_range() into folio_add_file_rmap_[pte|ptes|pmd]() +- mm/rmap: add hugetlb sanity checks for anon rmap handling +- mm/rmap: introduce and use hugetlb_try_share_anon_rmap() +- mm/rmap: introduce and use hugetlb_try_dup_anon_rmap() +- mm/rmap: introduce and use hugetlb_add_file_rmap() +- mm/rmap: introduce and use hugetlb_remove_rmap() +- mm/rmap: rename hugepage_add* to hugetlb_add* +- mm/khugepaged: convert collapse_pte_mapped_thp() to use folios +- mm/khugepaged: convert alloc_charge_hpage() to use folios +- mm/khugepaged: convert is_refcount_suitable() to use folios +- mm/khugepaged: convert hpage_collapse_scan_pmd() to use folios +- mm/khugepaged: convert __collapse_huge_page_isolate() to use folios +- !5543 v2 locking/qspinlock: Add CNA support for ARM64 +- config/arm64: Enable numa aware qspinlock by default +- locking/qspinlock: Add CNA support for ARM64 without pvspinlock +- !5555 v2 ACPI/arm64: add support for virtual cpu hotplug +- arm64/psci: Add undefined error message printing for psci_x_cpu_on +- cpumask: Add enabled cpumask for present CPUs that can be brought online +- ACPI: Add _OSC bits to advertise OS support for toggling CPU present/enabled +- arm64: document virtual CPU hotplug's expectations +- ACPI: processor: Only call arch_unregister_cpu() if HOTPLUG_CPU is selected +- ACPI: add support to register CPUs based on the _STA enabled bit +- arm64: psci: Ignore DENIED CPUs +- irqchip/gic-v3: Add support for ACPI's disabled but 'online capable' CPUs +- irqchip/gic-v3: Don't return errors from gic_acpi_match_gicc() +- ACPICA: Add new MADT GICC flags fields +- arm64: acpi: Move get_cpu_for_acpi_id() to a header +- ACPI: Warn when the present bit changes but the feature is not enabled +- ACPI: Check _STA present bit before making CPUs not present +- ACPI: convert acpi_processor_post_eject() to use IS_ENABLED() +- ACPI: Add post_eject to struct acpi_scan_handler for cpu hotplug +- ACPI: Rename acpi_processor_hotadd_init and remove pre-processor guards +- ACPI: Move acpi_bus_trim_one() before acpi_scan_hot_remove() +- ACPI: Rename ACPI_HOTPLUG_CPU to include 'present' +- ACPI: processor: Register all CPUs from acpi_processor_get_info() +- ACPI: processor: Register CPUs that are online, but not described in the DSDT +- ACPI: processor: Add support for processors described as container packages +- ACPI: Only enumerate enabled (or functional) devices +- !5461 [OLK-6.6] Add support for Mucse Virtual Function Network Adapter(N10) +- drivers: initial support for rnpvf drivers from Mucse Technology +- !5526 Intel: Backport QuickAssist Technology(QAT) in-tree driver +- Enable Intel QAT_4XXX as kernel module +- crypto: qat - make ring to service map common for QAT GEN4 +- crypto: qat - fix ring to service map for dcc in 420xx +- crypto: qat - fix ring to service map for dcc in 4xxx +- crypto: qat - fix comment structure +- crypto: qat - remove unnecessary description from comment +- crypto: qat - remove double initialization of value +- crypto: qat - avoid division by zero +- crypto: qat - removed unused macro in adf_cnv_dbgfs.c +- crypto: qat - remove unused macros in qat_comp_alg.c +- crypto: qat - uninitialized variable in adf_hb_error_inject_write() +- Documentation: qat: fix auto_reset section +- crypto: qat - resolve race condition during AER recovery +- crypto: qat - change SLAs cleanup flow at shutdown +- crypto: qat - improve aer error reset handling +- crypto: qat - limit heartbeat notifications +- crypto: qat - add auto reset on error +- crypto: qat - add fatal error notification +- crypto: qat - re-enable sriov after pf reset +- crypto: qat - update PFVF protocol for recovery +- crypto: qat - disable arbitration before reset +- crypto: qat - add fatal error notify method +- crypto: qat - add heartbeat error simulator +- crypto: qat - use kcalloc_node() instead of kzalloc_node() +- crypto: qat - avoid memcpy() overflow warning +- crypto: qat - fix arbiter mapping generation algorithm for QAT 402xx +- crypto: qat - generate dynamically arbiter mappings +- crypto: qat - add support for ring pair level telemetry +- crypto: qat - add support for device telemetry +- crypto: qat - add admin msgs for telemetry +- crypto: qat - include pci.h for GET_DEV() +- crypto: qat - add support for 420xx devices +- crypto: qat - move fw config related structures +- crypto: qat - relocate portions of qat_4xxx code +- crypto: qat - change signature of uof_get_num_objs() +- crypto: qat - relocate and rename get_service_enabled() +- crypto: qat - add NULL pointer check +- crypto: qat - fix mutex ordering in adf_rl +- crypto: qat - fix error path in add_update_sla() +- crypto: qat - add sysfs_added flag for rate limiting +- crypto: qat - add sysfs_added flag for ras +- crypto: qat - prevent underflow in rp2srv_store() +- units: add missing header +- seq_file: add helper macro to define attribute for rw file +- crypto: qat - move adf_cfg_services +- crypto: qat - add num_rps sysfs attribute +- crypto: qat - add rp2svc sysfs attribute +- crypto: qat - add rate limiting sysfs interface +- crypto: qat - add rate limiting feature to qat_4xxx +- crypto: qat - add retrieval of fw capabilities +- crypto: qat - add bits.h to icp_qat_hw.h +- units: Add BYTES_PER_*BIT +- crypto: qat - move admin api +- crypto: qat - count QAT GEN4 errors +- crypto: qat - add error counters +- crypto: qat - add handling of errors from ERRSOU3 for QAT GEN4 +- crypto: qat - add adf_get_aram_base() helper function +- crypto: qat - add handling of compression related errors for QAT GEN4 +- crypto: qat - add handling of errors from ERRSOU2 for QAT GEN4 +- crypto: qat - add reporting of errors from ERRSOU1 for QAT GEN4 +- crypto: qat - add reporting of correctable errors for QAT GEN4 +- crypto: qat - add infrastructure for error reporting +- crypto: qat - add cnv_errors debugfs file +- crypto: qat - add pm_status debugfs file +- crypto: qat - refactor included headers +- crypto: qat - add namespace to driver +- crypto: qat - Remove zlib-deflate +- crypto: qat - Annotate struct adf_fw_counters with __counted_by +- crypto: qat - do not shadow error code +- crypto: qat - refactor deprecated strncpy +- crypto: qat - Use list_for_each_entry() helper +- Documentation: ABI: debugfs-driver-qat: fix fw_counters path + +* Thu Mar 28 2024 Bing Xia <xiabing12@h-partners.com> - 6.6.0-14.0.0.11 +- perf: add CoreSight trace component support on aarch64 platform + +* Wed Mar 27 2024 Zheng Zengkai <zhengzengkai@huawei.com> - 6.6.0-14.0.0.10 +- !5524 [OLK-6.6] fix 0day bugs reported by CI robot for Mont-TSSE +- fix 0 day bugs for Mont-TSSE Driver +- !5284 [OLK-6.6] fs/address_space: move i_mmap_rwsem to mitigate a false sharing with i_mmap. +- fs/address_space: move i_mmap_rwsem to mitigate a false sharing with i_mmap. +- !5280 Add Huawei Intelligent Network Card Driver: hinic3 +- net/hinic3: add huawei/hinic3 driver +- !5179 Update Huawei Intelligent Network Card Driver: hinic +- net/hinic: Update Huawei Intelligent Network Card Driver: hinic +- !5523 enable openeuler_defconfig HISI_ACC_VFIO_PCI=m +- openeuler_defconfig: enable HISI_ACC_VFIO_PCI=m +- !5529 arch/powerpc: open BTF relevant configs in openuler defconfig +- arch/powerpc: open BTF relevant configs in openuler defconfig +- !5541 RDMA/hns: Backport bugfixes +- RDMA/hns: Refactor hns_roce_alloc_ucontext() +- RDMA/hns: Fix missing reset notification by user space driver +- RDMA/hns: Kernel notify usr space to stop ring db +- RDMA/hns: Support flexible wqe buffer page size +- !5464 net: hns3: backport some driver feature enhancement +- net: hns3: default select PAGE_POOL_STATS +- net: hns3: support set/get VxLAN rule of rx flow director by ethtool +- net: ethtool: add VxLAN to the NFC API +- net: hns3: add support for ROH ras +- net: hns3: fix bug for init roh client instance +- net: hns3: HNAE3 framework add support for ROH client +- net: hns3: add support handling tx dhcp packets for ROH +- net: hns3: support arp proxy +- net: hns3: add arp proxy switch in ethtool +- net: hns3: support tc limit rate +- net: hns3: support tc command with max rate parameter +- net: hns3: add ROH MAC type definitions and support query MAC type +- net: hns3: Add support for some CMIS transceiver modules +- net: sfp: Synchronize some CMIS transceiver modules from ethtool +- net: hns3: add command queue trace for hns3 +- net: hns3: dump more reg info based on ras mod +- net: hns3: add support for page_pool_get_stats +- net: hns3: add support to query scc version by devlink info +- net: hns3: correct the logic of hclge_sync_vf_qb_mode() +- net: hns3: add support for FD counter +- net: hns3: allocate fd counter for queue bonding +- net: hns3: refactor the debugfs for dumping FD tcam +- net: hns3: add queue bonding mode support for VF +- net: hns3: add support for queue bonding mode of flow director +- !5426 BTC's bugfix for openeuler OLK-6.6 +- ipmi: Add erratum 162102203 config to enable workaround for SMS message processing timeout +- ipmi: Errata workaround to prevent SMS message processing timeout +- !5049 [OLK-6.6]Add pcie acs and no-bus-reset quirk for mucse Nics +- Add pcie acs and no-bus-reset quirk for mucse Nics +- !5354 iommu/arm-smmu-v3: Disable ECMDQ before reset +- iommu/arm-smmu-v3: Disable ECMDQ before reset +- !5061 [OLK-6.6] riscv: Update openeuler_defconfig to support sg2042 SoC +- riscv: Update openeuler_defconfig to support sg2042 SoC +- !5427 crypto/trng: Remove the automatic loading of the hisi_trng driver +- crypto/trng: Remove the automatic loading of the hisi_trng driver +- crypto: hisilicon/trng - use %u to print u32 variables +- !5492 Backport Introduce __mt_dup() to improve the performance of fork() +- fork: use __mt_dup() to duplicate maple tree in dup_mmap() +- maple_tree: preserve the tree attributes when destroying maple tree +- maple_tree: update check_forking() and bench_forking() +- maple_tree: skip other tests when BENCH is enabled +- maple_tree: update the documentation of maple tree +- maple_tree: add test for mtree_dup() +- radix tree test suite: align kmem_cache_alloc_bulk() with kernel behavior. +- maple_tree: introduce interfaces __mt_dup() and mtree_dup() +- maple_tree: introduce {mtree,mas}_lock_nested() +- maple_tree: add mt_free_one() and mt_attr() helpers +- radix tree test suite: fix allocation calculation in kmem_cache_alloc_bulk() +- !5334 v4 iommu/iova: avoid softlockup in fq_flush_timeout +- iommu/iova: avoid softlockup in fq_flush_timeout +- !5412 [OLK-6.6] perf/x86/amd: Miscellaneous fixes +- perf vendor events amd: Fix Zen 4 cache latency events +- perf/x86/amd/lbr: Discard erroneous branch entries +- perf/x86/amd/core: Avoid register reset when CPU is dead +- !5376 Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security +- Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security + +* Fri Mar 22 2024 Zheng Zengkai <zhengzengkai@huawei.com> - 6.6.0-13.0.0.9 +- !5424 block: Fix iterating over an empty bio with bio_for_each_folio_all +- block: Fix iterating over an empty bio with bio_for_each_folio_all +- !5425 nbd: always initialize struct msghdr completely +- nbd: always initialize struct msghdr completely +- !5255 CVE-2024-26627 +- scsi: core: Move scsi_host_busy() out of host lock if it is for per-command +- scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler +- !5221 powerpc/mm: Fix null-pointer dereference in pgtable_cache_add +- powerpc/mm: Fix null-pointer dereference in pgtable_cache_add +- !5045 [OLK-6.6] Add support for Mont-TSSE firmware update and fix 0day bugs +- add firmware update function for Mont-TSSE +- fix 0day bugs for Mont-TSSE in CI test +- !5363 [OLK-6.6] ima: Support modsig verify using trusted keys +- ima: Enable modsig appraisal by default +- ima: Support modsig verify using trusted keys +- !5369 Backport 6.6.9-6.6.22 LTS +- KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests +- x86/rfds: Mitigate Register File Data Sampling (RFDS) +- Documentation/hw-vuln: Add documentation for RFDS +- x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set +- selftests: mptcp: decrease BW in simult flows +- readahead: avoid multiple marked readahead pages +- KVM: s390: vsie: fix race during shadow creation +- KVM: s390: add stat counter for shadow gmap events +- net: pds_core: Fix possible double free in error handling path +- netrom: Fix data-races around sysctl_net_busy_read +- netrom: Fix a data-race around sysctl_netrom_link_fails_count +- netrom: Fix a data-race around sysctl_netrom_routing_control +- netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout +- netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size +- netrom: Fix a data-race around sysctl_netrom_transport_busy_delay +- netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay +- netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries +- netrom: Fix a data-race around sysctl_netrom_transport_timeout +- netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser +- netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser +- netrom: Fix a data-race around sysctl_netrom_default_path_quality +- erofs: apply proper VMA alignment for memory mapped files on THP +- netfilter: nf_conntrack_h323: Add protection for bmp length out of range +- netfilter: nft_ct: fix l3num expectations with inet pseudo family +- net/rds: fix WARNING in rds_conn_connect_if_down +- net: dsa: microchip: fix register write order in ksz8_ind_write8() +- cpumap: Zero-initialise xdp_rxq_info struct before running XDP program +- selftests/bpf: Fix up xdp bonding test wrt feature flags +- xdp, bonding: Fix feature flags when there are no slave devs anymore +- bpf: check bpf_func_state->callback_depth when pruning states +- net/ipv6: avoid possible UAF in ip6_route_mpath_notify() +- igc: avoid returning frame twice in XDP_REDIRECT +- net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() +- ice: virtchnl: stop pretending to support RSS over AQ or registers +- net: sparx5: Fix use after free inside sparx5_del_mact_entry +- geneve: make sure to pull inner header in geneve_rx() +- tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string +- net/mlx5e: Switch to using _bh variant of of spinlock API in port timestamping NAPI poll context +- net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map +- net/mlx5e: Fix MACsec state loss upon state update in offload path +- net/mlx5e: Change the warning when ignore_flow_level is not supported +- net/mlx5: Check capability for fw_reset +- net/mlx5: E-switch, Change flow rule destination checking +- Revert "net/mlx5e: Check the number of elements before walk TC rhashtable" +- Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" +- ice: reorder disabling IRQ and NAPI in ice_qp_dis +- i40e: disable NAPI right after disabling irqs when handling xsk_pool +- ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able +- net: lan78xx: fix runtime PM count underflow on link stop +- xfrm: Pass UDP encapsulation in TX packet offload +- mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index +- ceph: switch to corrected encoding of max_xattr_size in mdsmap +- dmaengine: fsl-edma: correct max_segment_size setting +- dmaengine: fsl-edma: utilize common dt-binding header file +- dt-bindings: dma: fsl-edma: Add fsl-edma.h to prevent hardcoding in dts +- drm/nouveau: don't fini scheduler before entity flush +- selftests: mptcp: rm subflow with v4/v4mapped addr +- selftests: mptcp: add mptcp_lib_is_v6 +- selftests: mptcp: update userspace pm test helpers +- selftests: mptcp: add chk_subflows_total helper +- selftests: mptcp: add evts_get_info helper +- KVM/VMX: Move VERW closer to VMentry for MDS mitigation +- KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH +- x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key +- x86/entry_32: Add VERW just before userspace transition +- x86/entry_64: Add VERW just before userspace transition +- block: define bvec_iter as __packed __aligned(4) +- gpio: fix resource unwinding order in error path +- gpiolib: Fix the error path order in gpiochip_add_data_with_key() +- gpio: 74x164: Enable output pins after registers are reset +- powerpc/rtas: use correct function name for resetting TCE tables +- powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV +- dmaengine: idxd: Ensure safe user copy of completion record +- dmaengine: idxd: Remove shadow Event Log head stored in idxd +- phy: freescale: phy-fsl-imx8-mipi-dphy: Fix alias name to use dashes +- dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup +- dmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup +- dmaengine: dw-edma: Add HDMA remote interrupt configuration +- dmaengine: dw-edma: HDMA_V0_REMOTEL_STOP_INT_EN typo fix +- dmaengine: dw-edma: Fix wrong interrupt bit set for HDMA +- dmaengine: dw-edma: Fix the ch_count hdma callback +- ASoC: cs35l56: fix reversed if statement in cs35l56_dspwait_asp1tx_put() +- af_unix: Drop oob_skb ref before purging queue in GC. +- af_unix: Fix task hung while purging oob_skb in GC. +- NFS: Fix data corruption caused by congestion. +- mptcp: fix possible deadlock in subflow diag +- mptcp: fix double-free on socket dismantle +- mptcp: fix potential wake-up event loss +- mptcp: fix snd_wnd initialization for passive socket +- selftests: mptcp: join: add ss mptcp support check +- mptcp: push at DSS boundaries +- mptcp: avoid printing warning once on client side +- mptcp: map v4 address to v6 when destroying subflow +- x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers +- x86/e820: Don't reserve SETUP_RNG_SEED in e820 +- mm/debug_vm_pgtable: fix BUG_ON with pud advanced test +- pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation +- efivarfs: Request at most 512 bytes for variable names +- kbuild: Add -Wa,--fatal-warnings to as-instr invocation +- riscv: add CALLER_ADDRx support +- RISC-V: Drop invalid test from CONFIG_AS_HAS_OPTION_ARCH +- mmc: sdhci-xenon: fix PHY init clock stability +- mmc: sdhci-xenon: add timeout for PHY init complete +- mmc: core: Fix eMMC initialization with 1-bit bus connection +- mmc: mmci: stm32: fix DMA API overlapping mappings warning +- dmaengine: fsl-qdma: init irq after reg initialization +- dmaengine: fsl-edma: correct calculation of 'nbytes' in multi-fifo scenario +- dmaengine: ptdma: use consistent DMA masks +- crypto: arm64/neonbs - fix out-of-bounds access on short input +- dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read +- soc: qcom: pmic_glink: Fix boot when QRTR=m +- drm/amd/display: Add monitor patch for specific eDP +- drm/buddy: fix range bias +- Revert "drm/amd/pm: resolve reboot exception for si oland" +- btrfs: send: don't issue unnecessary zero writes for trailing hole +- btrfs: dev-replace: properly validate device names +- btrfs: fix double free of anonymous device after snapshot creation failure +- wifi: nl80211: reject iftype change with mesh ID change +- mtd: rawnand: marvell: fix layouts +- gtp: fix use-after-free and null-ptr-deref in gtp_newlink() +- landlock: Fix asymmetric private inodes referring +- Bluetooth: hci_bcm4377: do not mark valid bd_addr as invalid +- ALSA: hda/realtek: Add special fixup for Lenovo 14IRP8 +- ALSA: hda/realtek: fix mute/micmute LED For HP mt440 +- ALSA: hda/realtek: Enable Mute LED on HP 840 G8 (MB 8AB8) +- ALSA: hda/realtek: tas2781: enable subwoofer volume control +- ALSA: ump: Fix the discard error code from snd_ump_legacy_open() +- ALSA: firewire-lib: fix to check cycle continuity +- tomoyo: fix UAF write bug in tomoyo_write_control() +- of: property: fw_devlink: Fix stupid bug in remote-endpoint parsing +- btrfs: fix race between ordered extent completion and fiemap +- riscv: Sparse-Memory/vmemmap out-of-bounds fix +- riscv: Fix pte_leaf_size() for NAPOT +- Revert "riscv: mm: support Svnapot in huge vmap" +- drivers: perf: ctr_get_width function for legacy is not defined +- drivers: perf: added capabilities for legacy PMU +- afs: Fix endless loop in directory parsing +- fbcon: always restore the old font data in fbcon_do_set_font() +- drm/tegra: Remove existing framebuffer only if we support display +- RISC-V: Ignore V from the riscv,isa DT property on older T-Head CPUs +- ASoC: soc-card: Fix missing locking in snd_soc_card_get_kcontrol() +- ASoC: cs35l56: Fix deadlock in ASP1 mixer register initialization +- ASoC: cs35l56: Fix misuse of wm_adsp 'part' string for silicon revision +- ASoC: cs35l56: Fix for initializing ASP1 mixer registers +- ASoC: cs35l56: Don't add the same register patch multiple times +- ASoC: cs35l56: cs35l56_component_remove() must clean up wm_adsp +- ASoC: cs35l56: cs35l56_component_remove() must clear cs35l56->component +- riscv: Fix build error if !CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION +- ASoC: qcom: Fix uninitialized pointer dmactl +- ASoC: qcom: convert not to use asoc_xxx() +- ASoC: soc.h: convert asoc_xxx() to snd_soc_xxx() +- ALSA: Drop leftover snd-rtctimer stuff from Makefile +- ASoC: cs35l56: Must clear HALO_STATE before issuing SYSTEM_RESET +- power: supply: bq27xxx-i2c: Do not free non existing IRQ +- efi/capsule-loader: fix incorrect allocation size +- tls: fix use-after-free on failed backlog decryption +- tls: separate no-async decryption request handling from async +- tls: fix peeking with sync+async decryption +- tls: decrement decrypt_pending if no async completion will be called +- net: hsr: Use correct offset for HSR TLV values in supervisory HSR frames +- igb: extend PTP timestamp adjustments to i211 +- rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back +- tools: ynl: fix handling of multiple mcast groups +- netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate() +- Bluetooth: qca: Fix triggering coredump implementation +- Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT +- Bluetooth: qca: Fix wrong event type for patch config command +- Bluetooth: Enforce validation on max value of connection interval +- Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST +- Bluetooth: hci_event: Fix wrongly recorded wakeup BD_ADDR +- Bluetooth: hci_sync: Fix accept_list when attempting to suspend +- Bluetooth: Avoid potential use-after-free in hci_error_reset +- Bluetooth: hci_sync: Check the correct flag before starting a scan +- stmmac: Clear variable when destroying workqueue +- uapi: in6: replace temporary label with rfc9486 +- net: lan78xx: fix "softirq work is pending" error +- net: usb: dm9601: fix wrong return value in dm9601_mdio_read +- veth: try harder when allocating queue memory +- lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected +- ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() +- net: veth: clear GRO when clearing XDP even when down +- cpufreq: intel_pstate: fix pstate limits enforcement for adjust_perf call back +- tun: Fix xdp_rxq_info's queue_index when detaching +- net: dpaa: fman_memac: accept phy-interface-type = "10gbase-r" in the device tree +- net: mctp: take ownership of skb in mctp_local_output +- net: ip_tunnel: prevent perpetual headroom growth +- netlink: add nla be16/32 types to minlen array +- netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter +- spi: cadence-qspi: fix pointer reference in runtime PM hooks +- mtd: spinand: gigadevice: Fix the get ecc status issue +- ublk: move ublk_cancel_dev() out of ub->mutex +- ksmbd: fix wrong allocation size update in smb2_open() +- ASoC: cs35l34: Fix GPIO name and drop legacy include +- fs/ntfs3: fix build without CONFIG_NTFS3_LZX_XPRESS +- ahci: Extend ASM1061 43-bit DMA address quirk to other ASM106x parts +- ata: ahci: add identifiers for ASM2116 series adapters +- mptcp: add needs_id for netlink appending addr +- mptcp: userspace pm send RM_ADDR for ID 0 +- selftests: mptcp: add mptcp_lib_get_counter +- selftests: mptcp: join: stop transfer when check is done (part 2) +- mm: zswap: fix missing folio cleanup in writeback race path +- mm/zswap: invalidate duplicate entry when !zswap_enabled +- selftests: mptcp: join: stop transfer when check is done (part 1) +- i2c: imx: when being a target, mark the last read as processed +- drm/amd/display: Fix memory leak in dm_sw_fini() +- drm/syncobj: handle NULL fence in syncobj_eventfd_entry_func +- drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set +- net: phy: realtek: Fix rtl8211f_config_init() for RTL8211F(D)(I)-VD-CG PHY +- Fix write to cloned skb in ipv6_hop_ioam() +- phonet/pep: fix racy skb_queue_empty() use +- phonet: take correct lock to peek at the RX queue +- net: sparx5: Add spinlock for frame transmission from CPU +- net/sched: flower: Add lock protection when remove filter handle +- devlink: fix port dump cmd type +- tools: ynl: don't leak mcast_groups on init error +- tools: ynl: make sure we always pass yarg to mnl_cb_run +- net: mctp: put sock on tag allocation failure +- netfilter: nf_tables: use kzalloc for hook allocation +- netfilter: nf_tables: register hooks last when adding new chain/flowtable +- netfilter: nft_flow_offload: release dst in case direct xmit path is used +- netfilter: nft_flow_offload: reset dst in route object after setting up flow +- netfilter: nf_tables: set dormant flag on hook register failure +- tls: don't skip over different type records from the rx_list +- tls: stop recv() if initial process_rx_list gave us non-DATA +- tls: break out of main loop when PEEK gets a non-data record +- hwmon: (nct6775) Fix access to temperature configuration registers +- cache: ax45mp_cache: Align end size to cache boundary in ax45mp_dma_cache_wback() +- bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready() +- s390: use the correct count for __iowrite64_copy() +- net: ipa: don't overrun IPA suspend interrupt registers +- octeontx2-af: Consider the action set by PF +- drm/i915/tv: Fix TV mode +- platform/x86: thinkpad_acpi: Only update profile if successfully converted +- arm64/sme: Restore SMCR_EL1.EZT0 on exit from suspend +- arm64/sme: Restore SME registers on exit from suspend +- arp: Prevent overflow in arp_req_get(). +- devlink: fix possible use-after-free and memory leaks in devlink_init() +- ipv6: sr: fix possible use-after-free and null-ptr-deref +- afs: Increase buffer size in afs_update_volume_status() +- parisc: Fix stack unwinder +- bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel +- ata: ahci_ceva: fix error handling for Xilinx GT PHY support +- selftests: bonding: set active slave to primary eth1 specifically +- powerpc/pseries/iommu: DLPAR add doesn't completely initialize pci_controller +- net: bcmasp: Sanity check is off by one +- net: bcmasp: Indicate MAC is in charge of PHY PM +- ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid +- ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid +- net: stmmac: Fix incorrect dereference in interrupt handlers +- x86/numa: Fix the sort compare func used in numa_fill_memblks() +- x86/numa: Fix the address overlap check in numa_fill_memblks() +- nouveau: fix function cast warnings +- net/sched: act_mirred: don't override retval if we already lost the skb +- net/sched: act_mirred: use the backlog for mirred ingress +- net/sched: act_mirred: Create function tcf_mirred_to_dev and improve readability +- dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished(). +- net: bridge: switchdev: Ensure deferred event delivery on unoffload +- net: bridge: switchdev: Skip MDB replays of deferred events on offload +- scsi: jazz_esp: Only build if SCSI core is builtin +- scsi: smartpqi: Fix disable_managed_interrupts +- bpf, scripts: Correct GPL license name +- RDMA/srpt: fix function pointer cast warnings +- xsk: Add truesize to skb_add_rx_frag(). +- arm64: dts: rockchip: Correct Indiedroid Nova GPIO Names +- arm64: dts: rockchip: set num-cs property for spi on px30 +- RDMA/qedr: Fix qedr_create_user_qp error flow +- bus: imx-weim: fix valid range check +- arm64: dts: tqma8mpql: fix audio codec iov-supply +- RDMA/srpt: Support specifying the srpt_service_guid parameter +- RDMA/irdma: Add AE for too many RNRS +- RDMA/irdma: Set the CQ read threshold for GEN 1 +- RDMA/irdma: Validate max_send_wr and max_recv_wr +- RDMA/irdma: Fix KASAN issue with tasklet +- arm64: dts: imx8mp: Disable UART4 by default on Data Modul i.MX8M Plus eDM SBC +- IB/mlx5: Don't expose debugfs entries for RRoCE general parameters if not supported +- RDMA/bnxt_re: Add a missing check in bnxt_qplib_query_srq +- RDMA/bnxt_re: Return error for SRQ resize +- IB/hfi1: Fix a memleak in init_credit_return +- bpf: Derive source IP addr via bpf_*_fib_lookup() +- xen/events: fix error code in xen_bind_pirq_msi_to_irq() +- Revert "drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz" +- drm/amd/display: Fix buffer overflow in 'get_host_router_total_dp_tunnel_bw()' +- drm/amd/display: Avoid enum conversion warning +- smb3: add missing null server pointer check +- selftests: mptcp: diag: unique 'cestab' subtest names +- selftests: mptcp: diag: unique 'in use' subtest names +- selftests: mptcp: diag: fix bash warnings on older kernels +- selftests: mptcp: diag: check CURRESTAB counters +- selftests: mptcp: pm nl: avoid error msg on older kernels +- selftests: mptcp: pm nl: also list skipped tests +- selftests: mptcp: simult flows: fix some subtest names +- selftests: mptcp: userspace_pm: unique subtest names +- mptcp: fix duplicate subflow creation +- mptcp: fix data races on remote_id +- mptcp: fix data races on local_id +- mptcp: fix lockless access in subflow ULP diag +- mptcp: add needs_id for userspace appending addr +- usb: roles: don't get/set_role() when usb_role_switch is unregistered +- usb: roles: fix NULL pointer issue when put module's reference +- usb: gadget: omap_udc: fix USB gadget regression on Palm TE +- usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs +- usb: cdns3: fix memory double free when handle zero packet +- usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() +- usb: cdnsp: fixed issue with incorrect detecting CDNSP family controllers +- usb: cdnsp: blocked some cdns3 specific code +- usb: dwc3: gadget: Don't disconnect if not started +- serial: amba-pl011: Fix DMA transmission in RS485 mode +- serial: stm32: do not always set SER_RS485_RX_DURING_TX if RS485 is enabled +- Revert "usb: typec: tcpm: reset counter when enter into unattached state after try role" +- erofs: fix refcount on the metabuf used for inode lookup +- dm-integrity, dm-verity: reduce stack usage for recheck +- ARM: ep93xx: Add terminator to gpiod_lookup_table +- l2tp: pass correct message length to ip6_append_data +- PCI/MSI: Prevent MSI hardware interrupt number truncation +- irqchip/sifive-plic: Enable interrupt if needed before EOI +- irqchip/gic-v3-its: Do not assume vPE tables are preallocated +- irqchip/mbigen: Don't use bus_get_dev_root() to find the parent +- crypto: virtio/akcipher - Fix stack overflow on memcpy +- gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() +- accel/ivpu: Don't enable any tiles by default on VPU40xx +- KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() +- KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler +- md: Fix missing release of 'active_io' for flush +- sparc: Fix undefined reference to fb_is_primary_device +- platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names +- platform/x86: intel-vbtn: Stop calling "VBDL" from notify_handler +- mm/damon/reclaim: fix quota stauts loss due to online tunings +- mm: memcontrol: clarify swapaccount=0 deprecation warning +- mm/damon/lru_sort: fix quota status loss due to online tunings +- mm/swap: fix race when skipping swapcache +- selftests/mm: uffd-unit-test check if huge page size is 0 +- scsi: core: Consult supported VPD page list prior to fetching page +- scsi: target: pscsi: Fix bio_put() for error case +- scsi: sd: usb_storage: uas: Access media prior to querying device properties +- cxl/acpi: Fix load failures due to single window creation failure +- dm-verity: recheck the hash after a failure +- dm-crypt: don't modify the data when using authenticated encryption +- dm-integrity: recheck the integrity tag after a failure +- Revert "parisc: Only list existing CPUs in cpu_possible_mask" +- dm-crypt: recheck the integrity tag after a failure +- lib/Kconfig.debug: TEST_IOV_ITER depends on MMU +- fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio +- ata: libata-core: Do not try to set sleeping devices to standby +- s390/cio: fix invalid -EBUSY on ccw_device_start +- drm/amd/display: adjust few initialization order in dm +- drm/meson: Don't remove bridges which are created by other drivers +- drm/ttm: Fix an invalid freeing on already freed page in error path +- btrfs: defrag: avoid unnecessary defrag caused by incorrect extent size +- LoongArch: Update cpu_sibling_map when disabling nonboot CPUs +- LoongArch: Disable IRQ before init_fn() for nonboot CPUs +- LoongArch: Call early_init_fdt_scan_reserved_mem() earlier +- docs: Instruct LaTeX to cope with deeper nesting +- x86/bugs: Add asm helpers for executing VERW +- IB/hfi1: Fix sdma.h tx->num_descs off-by-one error +- xen/events: close evtchn after mapping cleanup +- xen/events: modify internal [un]bind interfaces +- xen/events: drop xen_allocate_irqs_dynamic() +- xen/events: remove some simple helpers from events_base.c +- xen/events: reduce externally visible helper functions +- xen: evtchn: Allow shared registration of IRQ handers +- drm/amd/display: fixed integer types and null check locations +- drm/amd/display: Request usb4 bw for mst streams +- drm/amd/display: Add dpia display mode validation logic +- mptcp: corner case locking for rx path fields initialization +- mptcp: fix more tx path fields initialization +- mptcp: use mptcp_set_state +- mptcp: add CurrEstab MIB counter support +- smb3: clarify mount warning +- cifs: handle cases where multiple sessions share connection +- cifs: change tcon status when need_reconnect is set on it +- virtio-blk: Ensure no requests in virtqueues before deleting vqs. +- smb: client: set correct d_type for reparse points under DFS mounts +- drm/amdgpu: Fix HDP flush for VFs on nbio v7.9 +- drm/amdgpu: Fix shared buff copy to user +- drm/amdgpu: reset gpu for s3 suspend abort case +- drm/amdgpu: skip to program GFXDEC registers for suspend abort +- libceph: fail sparse-read if the data length doesn't match +- firewire: core: send bus reset promptly on gap count error +- accel/ivpu/40xx: Stop passing SKU boot parameters to FW +- accel/ivpu: Disable d3hot_delay on all NPU generations +- accel/ivpu: Force snooping for MMU writes +- LoongArch: vDSO: Disable UBSAN instrumentation +- LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC] +- LoongArch: Select HAVE_ARCH_SECCOMP to use the common SECCOMP menu +- LoongArch: Select ARCH_ENABLE_THP_MIGRATION instead of redefining it +- scsi: ufs: core: Remove the ufshcd_release() in ufshcd_err_handling_prepare() +- scsi: ufs: core: Fix shift issue in ufshcd_clear_cmd() +- scsi: lpfc: Use unsigned type for num_sge +- hwmon: (coretemp) Enlarge per package core count limit +- efi: Don't add memblocks for soft-reserved memory +- efi: runtime: Fix potential overflow of soft-reserved region size +- wifi: iwlwifi: do not announce EPCS support +- wifi: mac80211: accept broadcast probe responses on 6 GHz +- wifi: mac80211: adding missing drv_mgd_complete_tx() call +- wifi: mac80211: set station RX-NSS on reconfig +- fs/ntfs3: Fix oob in ntfs_listxattr +- fs/ntfs3: Update inode->i_size after success write into compressed file +- fs/ntfs3: Fixed overflow check in mi_enum_attr() +- fs/ntfs3: Correct function is_rst_area_valid +- fs/ntfs3: Use i_size_read and i_size_write +- fs/ntfs3: Prevent generic message "attempt to access beyond end of device" +- fs/ntfs3: use non-movable memory for ntfs3 MFT buffer cache +- fs/ntfs3: Use kvfree to free memory allocated by kvmalloc +- fs/ntfs3: Disable ATTR_LIST_ENTRY size check +- fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() +- fs/ntfs3: ntfs3_forced_shutdown use int instead of bool +- fs/ntfs3: Implement super_operations::shutdown +- fs/ntfs3: Drop suid and sgid bits as a part of fpunch +- fs/ntfs3: Add file_modified +- fs/ntfs3: Fix detected field-spanning write (size 8) of single field "le->name" +- fs/ntfs3: Fix multithreaded stress test +- fs/ntfs3: Reduce stack usage +- fs/ntfs3: Print warning while fixing hard links count +- fs/ntfs3: Correct hard links updating when dealing with DOS names +- fs/ntfs3: Improve ntfs_dir_count +- fs/ntfs3: Modified fix directory element type detection +- fs/ntfs3: Improve alternative boot processing +- Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table +- ext4: correct the hole length returned by ext4_map_blocks() +- smb: client: increase number of PDUs allowed in a compound request +- cifs: do not search for channel if server is terminating +- nvmet-fc: take ref count on tgtport before delete assoc +- nvmet-fc: avoid deadlock on delete association path +- nvmet-fc: abort command when there is no binding +- nvmet-fc: hold reference on hostport match +- nvmet-fc: defer cleanup using RCU properly +- nvmet-fc: release reference on target port +- nvmet-fcloop: swap the list_add_tail arguments +- nvme-fc: do not wait in vain when unloading module +- ALSA: usb-audio: Ignore clock selector errors for single connection +- ASoC: wm_adsp: Don't overwrite fwf_name with the default +- cifs: make sure that channel scaling is done only once +- drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz +- drm/amdkfd: Use correct drm device for cgroup permission check +- netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new +- misc: open-dice: Fix spurious lockdep warning +- Input: xpad - add Lenovo Legion Go controllers +- spi: sh-msiof: avoid integer overflow in constants +- regulator (max5970): Fix IRQ handler +- ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616 +- ALSA: usb-audio: Check presence of valid altsetting control +- usb: ucsi_acpi: Quirk to ack a connector change ack cmd +- nvmet-tcp: fix nvme tcp ida memory leak +- HID: nvidia-shield: Add missing null pointer checks to LED initialization +- ALSA: hda: Increase default bdl_pos_adj for Apollo Lake +- ALSA: hda: Replace numeric device IDs with constant values +- HID: logitech-hidpp: add support for Logitech G Pro X Superlight 2 +- regulator: pwm-regulator: Add validity checks in continuous .get_voltage +- ASoC: amd: acp: Add check for cpu dai link initialization +- dmaengine: ti: edma: Add some null pointer checks to the edma_probe +- Input: goodix - accept ACPI resources with gpio_count == 3 && gpio_int_idx == 0 +- ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() +- ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() +- ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt +- platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet +- MIPS: reserve exception vector space ONLY ONCE +- ARM: dts: Fix TPM schema violations +- ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers +- spi: cs42l43: Handle error from devm_pm_runtime_enable +- aoe: avoid potential deadlock at set_capacity +- ahci: asm1166: correct count of reported ports +- cifs: helper function to check replayable error codes +- cifs: translate network errors on send to -ECONNABORTED +- cifs: cifs_pick_channel should try selecting active channels +- smb: Work around Clang __bdos() type confusion +- block: Fix WARNING in _copy_from_iter +- spi: intel-pci: Add support for Arrow Lake SPI serial flash +- platform/mellanox: mlxbf-tmfifo: Drop Tx network packet when Tx TmFIFO is full +- fbdev: sis: Error out if pixclock equals zero +- fbdev: savage: Error out if pixclock equals zero +- wifi: mac80211: fix race condition on enabling fast-xmit +- wifi: cfg80211: fix missing interfaces when dumping +- dmaengine: dw-edma: increase size of 'name' in debugfs code +- dmaengine: fsl-qdma: increase size of 'irq_name' +- dmaengine: shdma: increase size of 'dev_id' +- cifs: open_cached_dir should not rely on primary channel +- scsi: target: core: Add TMF to tmr_list handling +- tools: selftests: riscv: Fix compile warnings in mm tests +- tools: selftests: riscv: Fix compile warnings in vector tests +- scsi: smartpqi: Fix logical volume rescan race condition +- scsi: smartpqi: Add new controller PCI IDs +- dmaengine: apple-admac: Keep upper bits of REG_BUS_WIDTH +- riscv/efistub: Ensure GP-relative addressing is not used +- PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq() +- sched/rt: Disallow writing invalid values to sched_rt_period_us +- tracing: Fix a NULL vs IS_ERR() bug in event_subsystem_dir() +- tracing: Make system_callback() function static +- Documentation/arch/ia64/features.rst: fix kernel-feat directive +- nilfs2: fix potential bug in end_buffer_async_write +- of: property: Add in-ports/out-ports support to of_graph_get_port_parent() +- sched/membarrier: reduce the ability to hammer on sys_membarrier +- x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section +- x86/boot: Increase section and file alignment to 4k/512 +- x86/boot: Split off PE/COFF .data section +- x86/boot: Drop PE/COFF .reloc section +- x86/boot: Construct PE/COFF .text section from assembler +- x86/boot: Derive file size from _edata symbol +- x86/boot: Define setup size in linker script +- x86/boot: Set EFI handover offset directly in header asm +- x86/boot: Grab kernel_info offset from zoffset header directly +- x86/boot: Drop references to startup_64 +- x86/boot: Drop redundant code setting the root device +- x86/boot: Omit compression buffer from PE/COFF image memory footprint +- x86/boot: Remove the 'bugger off' message +- x86/efi: Drop alignment flags from PE section headers +- x86/efi: Disregard setup header of loaded image +- x86/efi: Drop EFI stub .bss from .data section +- nfsd: don't take fi_lock in nfsd_break_deleg_cb() +- eventfs: Keep all directory links at 1 +- eventfs: Remove fsnotify*() functions from lookup() +- eventfs: Restructure eventfs_inode structure to be more condensed +- eventfs: Warn if an eventfs_inode is freed without is_freed being set +- eventfs: Get rid of dentry pointers without refcounts +- eventfs: Clean up dentry ops and add revalidate function +- eventfs: Remove unused d_parent pointer field +- tracefs: dentry lookup crapectomy +- tracefs: Avoid using the ei->dentry pointer unnecessarily +- eventfs: Initialize the tracefs inode properly +- tracefs: Zero out the tracefs_inode when allocating it +- tracefs: remove stale update_gid code +- eventfs: Save directory inodes in the eventfs_inode structure +- eventfs: Use kcalloc() instead of kzalloc() +- eventfs: Do not create dentries nor inodes in iterate_shared +- eventfs: Have the inodes all for files and directories all be the same +- eventfs: Shortcut eventfs_iterate() by skipping entries already read +- eventfs: Read ei->entries before ei->children in eventfs_iterate() +- eventfs: Do ctx->pos update for all iterations in eventfs_iterate() +- eventfs: Have eventfs_iterate() stop immediately if ei->is_freed is set +- tracefs/eventfs: Use root and instance inodes as default ownership +- eventfs: Stop using dcache_readdir() for getdents() +- eventfs: Remove "lookup" parameter from create_dir/file_dentry() +- eventfs: Fix bitwise fields for "is_events" +- tracefs: Check for dentry->d_inode exists in set_gid() +- eventfs: Fix file and directory uid and gid ownership +- eventfs: Have event files and directories default to parent uid and gid +- eventfs: Fix events beyond NAME_MAX blocking tasks +- eventfs: Make sure that parent->d_inode is locked in creating files/dirs +- eventfs: Do not allow NULL parent to eventfs_start_creating() +- eventfs: Move taking of inode_lock into dcache_dir_open_wrapper() +- eventfs: Use GFP_NOFS for allocation when eventfs_mutex is held +- eventfs: Do not invalidate dentry in create_file/dir_dentry() +- eventfs: Remove expectation that ei->is_freed means ei->dentry == NULL +- eventfs: Use simple_recursive_removal() to clean up dentries +- eventfs: Remove special processing of dput() of events directory +- eventfs: Delete eventfs_inode when the last dentry is freed +- eventfs: Hold eventfs_mutex when calling callback functions +- eventfs: Save ownership and mode +- eventfs: Test for ei->is_freed when accessing ei->dentry +- eventfs: Have a free_ei() that just frees the eventfs_inode +- eventfs: Remove "is_freed" union with rcu head +- eventfs: Fix kerneldoc of eventfs_remove_rec() +- eventfs: Remove extra dget() in eventfs_create_events_dir() +- eventfs: Fix typo in eventfs_inode union comment +- eventfs: Fix WARN_ON() in create_file_dentry() +- tracefs/eventfs: Modify mismatched function name +- eventfs: Fix failure path in eventfs_create_events_dir() +- eventfs: Use ERR_CAST() in eventfs_create_events_dir() +- eventfs: Use eventfs_remove_events_dir() +- eventfs: Remove eventfs_file and just use eventfs_inode +- Revert "eventfs: Remove "is_freed" union with rcu head" +- Revert "eventfs: Save ownership and mode" +- Revert "eventfs: Delete eventfs_inode when the last dentry is freed" +- Revert "eventfs: Use simple_recursive_removal() to clean up dentries" +- Revert "eventfs: Check for NULL ef in eventfs_set_attr()" +- Revert "eventfs: Do not allow NULL parent to eventfs_start_creating()" +- parisc: Fix random data corruption from exception handler +- netfilter: ipset: Missing gc cancellations fixed +- netfilter: ipset: fix performance regression in swap operation +- block: fix partial zone append completion handling in req_bio_endio() +- tracing: Inform kmemleak of saved_cmdlines allocation +- tracing: Fix HAVE_DYNAMIC_FTRACE_WITH_REGS ifdef +- fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() +- pmdomain: core: Move the unused cleanup to a _sync initcall +- can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) +- can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock +- can: netlink: Fix TDCO calculation using the old data bittiming +- of: property: fix typo in io-channels +- docs: kernel_feat.py: fix build error for missing files +- blk-wbt: Fix detection of dirty-throttled tasks +- LoongArch: Fix earlycon parameter if KASAN enabled +- mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE +- ceph: prevent use-after-free in encode_cap_msg() +- hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed +- net: stmmac: protect updates of 64-bit statistics counters +- pmdomain: renesas: r8a77980-sysc: CR7 must be always on +- net: ethernet: ti: cpsw_new: enable mac_managed_pm to fix mdio +- s390/qeth: Fix potential loss of L3-IP@ in case of network issues +- net: ethernet: ti: cpsw: enable mac_managed_pm to fix mdio +- fs: relax mount_setattr() permission checks +- tools/rtla: Fix Makefile compiler options for clang +- tools/rtla: Fix uninitialized bucket/data->bucket_size warning +- tools/rtla: Exit with EXIT_SUCCESS when help is invoked +- tools/rtla: Fix clang warning about mount_point var size +- tools/rtla: Replace setting prio with nice for SCHED_OTHER +- tools/rtla: Remove unused sched_getattr() function +- tools/rv: Fix Makefile compiler options for clang +- tools/rv: Fix curr_reactor uninitialized variable +- ASoC: amd: yc: Add DMI quirk for Lenovo Ideapad Pro 5 16ARP8 +- ASoC: tas2781: add module parameter to tascodec_init() +- ASoC: SOF: IPC3: fix message bounds on ipc ops +- arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata +- arm64/signal: Don't assume that TIF_SVE means we saved SVE state +- mmc: sdhci-pci-o2micro: Fix a warm reboot issue that disk can't be detected by BIOS +- zonefs: Improve error handling +- KVM: arm64: Fix circular locking dependency +- smb: Fix regression in writes when non-standard maximum write size negotiated +- smb: client: set correct id, uid and cruid for multiuser automounts +- thunderbolt: Fix setting the CNS bit in ROUTER_CS_5 +- irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update +- irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems +- irqchip/irq-brcmstb-l2: Add write memory barrier before exit +- wifi: iwlwifi: mvm: fix a crash when we run out of stations +- wifi: mac80211: reload info pointer in ieee80211_tx_dequeue() +- wifi: cfg80211: fix wiphy delayed work queueing +- wifi: iwlwifi: fix double-free bug +- nfp: flower: prevent re-adding mac index for bonded port +- nfp: enable NETDEV_XDP_ACT_REDIRECT feature flag +- nfp: use correct macro for LengthSelect in BAR config +- crypto: algif_hash - Remove bogus SGL free on zero-length error path +- crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked +- nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() +- nilfs2: fix data corruption in dsync block recovery for small block sizes +- ALSA: hda/realtek: add IDs for Dell dual spk platform +- ALSA: hda/conexant: Add quirk for SWS JS201D +- ALSA: hda/realtek: fix mute/micmute LED For HP mt645 +- mmc: slot-gpio: Allow non-sleeping GPIO ro +- io_uring/net: fix multishot accept overflow handling +- x86/mm/ident_map: Use gbpages only where full GB page should be mapped. +- KVM: x86/pmu: Fix type length error when reading pmu->fixed_ctr_ctrl +- KVM: x86: make KVM_REQ_NMI request iff NMI pending for vcpu +- x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6 +- serial: mxs-auart: fix tx +- serial: core: introduce uart_port_tx_flags() +- powerpc/pseries: fix accuracy of stolen time +- powerpc/cputable: Add missing PPC_FEATURE_BOOKE on PPC64 Book-E +- powerpc/64: Set task pt_regs->link to the LR value on scv entry +- ftrace: Fix DIRECT_CALLS to use SAVE_REGS by default +- serial: max310x: prevent infinite while() loop in port startup +- serial: max310x: fail probe if clock crystal is unstable +- serial: max310x: improve crystal stable clock detection +- serial: max310x: set default value when reading clock ready bit +- nfp: flower: fix hardware offload for the transfer layer port +- nfp: flower: add hardware offload check for post ct entry +- net: dsa: mv88e6xxx: Fix failed probe due to unsupported C45 reads +- ring-buffer: Clean ring_buffer_poll_wait() error return +- hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove +- drm/amd/display: Preserve original aspect ratio in create stream +- drm/amd/display: Increase frame-larger-than for all display_mode_vba files +- drm/amd/display: Fix MST Null Ptr for RV +- drm/amdgpu/soc21: update VCN 4 max HEVC encoding resolution +- drm/prime: Support page array >= 4GB +- drm/amd/display: Add align done check +- drm/msm: Wire up tlb ops +- ksmbd: free aux buffer if ksmbd_iov_pin_rsp_read fails +- media: rc: bpf attach/detach requires write permission +- pmdomain: mediatek: fix race conditions with genpd +- iio: pressure: bmp280: Add missing bmp085 to SPI id table +- iio: imu: bno055: serdev requires REGMAP +- iio: imu: adis: ensure proper DMA alignment +- iio: adc: ad_sigma_delta: ensure proper DMA alignment +- iio: accel: bma400: Fix a compilation problem +- iio: commom: st_sensors: ensure proper DMA alignment +- iio: core: fix memleak in iio_device_register_sysfs +- iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC +- staging: iio: ad5933: fix type mismatch regression +- tracing/probes: Fix to search structure fields correctly +- tracing/probes: Fix to set arg size and fmt after setting type from BTF +- tracing/probes: Fix to show a parse error for bad type for $comm +- tracing/synthetic: Fix trace_string() return value +- tracing: Fix wasted memory in saved_cmdlines logic +- tracing/timerlat: Move hrtimer_init to timerlat_fd open() +- ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks() +- ext4: fix double-free of blocks due to wrong extents moved_len +- misc: fastrpc: Mark all sessions as invalid in cb_remove +- binder: signal epoll threads of self-work +- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power +- ALSA: hda/cs8409: Suppress vmaster control for Dolphin models +- ASoC: codecs: wcd938x: handle deferred probe +- ALSA: hda/realtek - Add speaker pin verbtable for Dell dual speaker platform +- ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL +- usb: typec: tpcm: Fix issues with power being removed during reset +- modpost: Add '.ltext' and '.ltext.*' to TEXT_SECTIONS +- linux/init: remove __memexit* annotations +- um: Fix adding '-no-pie' for clang +- xen-netback: properly sync TX responses +- parisc: BTLB: Fix crash when setting up BTLB at CPU bringup +- net: stmmac: do not clear TBS enable bit on link up/down +- net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() +- nfc: nci: free rx_data_reassembly skb on NCI device cleanup +- kbuild: Fix changing ELF file type for output of gen_btf for big endian +- ALSA: hda/realtek: Apply headset jack quirk for non-bass alc287 thinkpads +- firewire: core: correct documentation of fw_csr_string() kernel API +- lsm: fix the logic in security_inode_getsecctx() +- lsm: fix default return value of the socket_getpeersec_*() hooks +- drm/amd: Don't init MEC2 firmware when it fails to load +- drm/amdgpu: Reset IH OVERFLOW_CLEAR bit +- drm/virtio: Set segment size for virtio_gpu device +- connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" +- Revert "drm/msm/gpu: Push gpu lock down past runpm" +- Revert "drm/amd: flush any delayed gfxoff on suspend entry" +- scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" +- media: Revert "media: rkisp1: Drop IRQF_SHARED" +- Revert "powerpc/pseries/iommu: Fix iommu initialisation during DLPAR add" +- mptcp: really cope with fastopen race +- mptcp: check addrs list in userspace_pm_get_local_id +- mptcp: fix rcv space initialization +- mptcp: drop the push_pending field +- selftests: mptcp: add mptcp_lib_kill_wait +- selftests: mptcp: allow changing subtests prefix +- selftests: mptcp: increase timeout to 30 min +- selftests: mptcp: add missing kconfig for NF Mangle +- selftests: mptcp: add missing kconfig for NF Filter in v6 +- selftests: mptcp: add missing kconfig for NF Filter +- mptcp: fix data re-injection from stale subflow +- kallsyms: ignore ARMv4 thunks along with others +- modpost: trim leading spaces when processing source files list +- i2c: i801: Fix block process call transactions +- i2c: pasemi: split driver into two separate modules +- powerpc/kasan: Limit KASAN thread size increase to 32KB +- irqchip/gic-v3-its: Handle non-coherent GICv4 redistributors +- i2c: qcom-geni: Correct I2C TRE sequence +- cifs: fix underflow in parse_server_interfaces() +- iio: adc: ad4130: only set GPIO_CTRL if pin is unused +- iio: adc: ad4130: zero-initialize clock init data +- PCI: Fix active state requirement in PME polling +- Revert "kobject: Remove redundant checks for whether ktype is NULL" +- powerpc/kasan: Fix addr error caused by page alignment +- powerpc/6xx: set High BAT Enable flag on G2_LE cores +- powerpc/pseries/iommu: Fix iommu initialisation during DLPAR add +- driver core: fw_devlink: Improve detection of overlapping cycles +- media: ir_toy: fix a memleak in irtoy_tx +- interconnect: qcom: sm8550: Enable sync_state +- interconnect: qcom: sc8180x: Mark CO0 BCM keepalive +- usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend +- usb: core: Prevent null pointer dereference in update_port_device_state +- usb: chipidea: core: handle power lost in workqueue +- usb: f_mass_storage: forbid async queue when shutdown happen +- USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT +- usb: ucsi_acpi: Fix command completion handling +- usb: ulpi: Fix debugfs directory leak +- usb: ucsi: Add missing ppm_lock +- iio: hid-sensor-als: Return 0 for HID_USAGE_SENSOR_TIME_TIMESTAMP +- HID: wacom: Do not register input devices until after hid_hw_start +- HID: wacom: generic: Avoid reporting a serial of '0' to userspace +- HID: i2c-hid-of: fix NULL-deref on failed power up +- HID: bpf: actually free hdev memory after attaching a HID-BPF program +- HID: bpf: remove double fdget() +- ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx +- ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift 1 SF114-32 +- parisc: Prevent hung tasks when printing inventory on serial console +- ASoC: amd: yc: Add DMI quirk for MSI Bravo 15 C7VF +- dm-crypt, dm-verity: disable tasklets +- nouveau: offload fence uevents work to workqueue +- scsi: storvsc: Fix ring buffer size calculation +- selftests: mm: fix map_hugetlb failure on 64K page size systems +- selftests/mm: Update va_high_addr_switch.sh to check CPU for la57 flag +- mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again +- selftests/mm: switch to bash from sh +- tracing/trigger: Fix to return error if failed to alloc snapshot +- scs: add CONFIG_MMU dependency for vfree_atomic() +- selftests/mm: ksm_tests should only MADV_HUGEPAGE valid memory +- userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb +- i40e: Fix waiting for queues of all VSIs to be disabled +- i40e: Do not allow untrusted VF to remove administratively set MAC +- mm/memory: Use exception ip to search exception tables +- ptrace: Introduce exception_ip arch hook +- MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler +- nouveau/svm: fix kvcalloc() argument order +- net: sysfs: Fix /sys/class/net/<iface> path for statistics +- ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work() +- spi: ppc4xx: Drop write-only variable +- net: tls: fix returned read length with async decrypt +- net: tls: fix use-after-free with partial reads and async decrypt +- net: tls: handle backlogging of crypto requests +- tls: fix race between tx work scheduling and socket close +- tls: fix race between async notify and socket close +- net: tls: factor out tls_*crypt_async_wait() +- tls: extract context alloc/initialization out of tls_set_sw_offload +- lan966x: Fix crash when adding interface under a lag +- net: openvswitch: limit the number of recursions from action sets +- selftests: forwarding: Fix bridge locked port test flakiness +- selftests: forwarding: Suppress grep warnings +- selftests: bridge_mdb: Use MDB get instead of dump +- selftests: forwarding: Fix bridge MDB test flakiness +- selftests: forwarding: Fix layer 2 miss test flakiness +- selftests: net: Fix bridge backup port test flakiness +- selftests/net: convert test_bridge_backup_port.sh to run it in unique namespace +- perf: CXL: fix mismatched cpmu event opcode +- ALSA: hda/cs35l56: select intended config FW_CS_DSP +- of: property: Improve finding the supplier of a remote-endpoint property +- of: property: Improve finding the consumer of a remote-endpoint property +- devlink: Fix command annotation documentation +- bonding: do not report NETDEV_XDP_ACT_XSK_ZEROCOPY +- net/handshake: Fix handshake_req_destroy_test1 +- ASoC: SOF: ipc3-topology: Fix pipeline tear down logic +- wifi: iwlwifi: uninitialized variable in iwl_acpi_get_ppag_table() +- wifi: iwlwifi: Fix some error codes +- KVM: selftests: Fix a semaphore imbalance in the dirty ring logging test +- spi: imx: fix the burst length at DMA mode and CPU mode +- drm/msm/gem: Fix double resv lock aquire +- of: unittest: Fix compile in the non-dynamic case +- KVM: selftests: Avoid infinite loop in hyperv_features when invtsc is missing +- KVM: selftests: Delete superfluous, unused "stage" variable in AMX test +- selftests/landlock: Fix fs_test build with old libc +- driver core: Fix device_link_flag_is_sync_state_only() +- btrfs: don't drop extent_map for free space inode on write error +- btrfs: reject encoded write if inode has nodatasum flag set +- btrfs: don't reserve space for checksums when writing to nocow files +- btrfs: send: return EOPNOTSUPP on unknown flags +- btrfs: forbid deleting live subvol qgroup +- btrfs: do not ASSERT() if the newly created subvolume already got read +- btrfs: forbid creating subvol qgroups +- btrfs: do not delete unused block group if it may be used soon +- btrfs: add and use helper to check if block group is used +- update workarounds for gcc "asm goto" issue +- work around gcc bugs with 'asm goto' with outputs +- netfilter: nft_set_rbtree: skip end interval element from gc +- net: stmmac: xgmac: fix a typo of register name in DPP safety handling +- ALSA: usb-audio: Sort quirk table entries +- net: stmmac: xgmac: use #define for string constants +- io_uring/net: limit inline multishot retries +- io_uring/poll: add requeue return code from poll multishot handling +- io_uring/net: un-indent mshot retry path in io_recv_finish() +- io_uring/poll: move poll execution helpers higher up +- io_uring/net: fix sr->len for IORING_OP_RECV with MSG_WAITALL and buffers +- media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) +- Revert "ASoC: amd: Add new dmi entries for acp5x platform" +- Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID +- Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU +- hrtimer: Report offline hrtimer enqueue +- usb: dwc3: pci: add support for the Intel Arrow Lake-H +- xhci: handle isoc Babble and Buffer Overrun events properly +- xhci: process isoc TD properly when there was a transaction error mid TD. +- usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK +- usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK +- x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups +- Revert "usb: typec: tcpm: fix cc role at port reset" +- USB: serial: cp210x: add ID for IMST iM871A-USB +- USB: serial: option: add Fibocom FM101-GL variant +- USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e +- ALSA: usb-audio: add quirk for RODE NT-USB+ +- ALSA: usb-audio: Add a quirk for Yamaha YIT-W12TX transmitter +- ALSA: usb-audio: Add delay quirk for MOTU M Series 2nd revision +- blk-iocost: Fix an UBSAN shift-out-of-bounds warning +- riscv: declare overflow_stack as exported from traps.c +- riscv: Fix arch_hugetlb_migration_supported() for NAPOT +- libceph: just wait for more data to be available on the socket +- libceph: rename read_sparse_msg_*() to read_partial_sparse_msg_*() +- riscv: Flush the tlb when a page directory is freed +- scsi: core: Move scsi_host_busy() out of host lock if it is for per-command +- riscv: Fix hugetlb_mask_last_page() when NAPOT is enabled +- riscv: Fix set_huge_pte_at() for NAPOT mapping +- riscv: mm: execute local TLB flush after populating vmemmap +- mm: Introduce flush_cache_vmap_early() +- riscv: Improve flush_tlb_kernel_range() +- riscv: Make __flush_tlb_range() loop over pte instead of flushing the whole tlb +- riscv: Improve tlb_flush() +- fs/ntfs3: Fix an NULL dereference bug +- netfilter: nft_set_pipapo: remove scratch_aligned pointer +- netfilter: nft_set_pipapo: add helper to release pcpu scratch area +- netfilter: nft_set_pipapo: store index in scratch maps +- netfilter: nft_ct: reject direction for ct id +- drm/amd/display: Implement bounds check for stream encoder creation in DCN301 +- drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()' +- drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()' +- netfilter: nft_compat: restrict match/target protocol to u16 +- netfilter: nft_compat: reject unused compat flag +- netfilter: nft_compat: narrow down revision to unsigned 8-bits +- selftests: cmsg_ipv6: repeat the exact packet +- ppp_async: limit MRU to 64K +- af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC. +- tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() +- selftests: net: let big_tcp test cope with slow env +- rxrpc: Fix counting of new acks and nacks +- rxrpc: Fix response to PING RESPONSE ACKs to a dead call +- rxrpc: Fix delayed ACKs to not set the reference serial number +- rxrpc: Fix generation of serial numbers to skip zero +- drm/i915/gvt: Fix uninitialized variable in handle_mmio() +- inet: read sk->sk_family once in inet_recv_error() +- hwmon: (coretemp) Fix bogus core_id to attr name mapping +- hwmon: (coretemp) Fix out-of-bounds memory access +- hwmon: (aspeed-pwm-tacho) mutex for tach reading +- octeontx2-pf: Fix a memleak otx2_sq_init +- atm: idt77252: fix a memleak in open_card_ubr0 +- tunnels: fix out of bounds access when building IPv6 PMTU error +- tsnep: Fix mapping for zero copy XDP_TX action +- selftests: net: avoid just another constant wait +- selftests: net: fix tcp listener handling in pmtu.sh +- selftests/net: change shebang to bash to support "source" +- selftests/net: convert pmtu.sh to run it in unique namespace +- selftests/net: convert unicast_extensions.sh to run it in unique namespace +- selftests: net: cut more slack for gro fwd tests. +- net: atlantic: Fix DMA mapping for PTP hwts ring +- netdevsim: avoid potential loop in nsim_dev_trap_report_work() +- wifi: brcmfmac: Adjust n_channels usage for __counted_by +- wifi: iwlwifi: exit eSR only after the FW does +- wifi: mac80211: fix waiting for beacons logic +- wifi: mac80211: fix RCU use in TDLS fast-xmit +- net: stmmac: xgmac: fix handling of DPP safety error for DMA channels +- x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR +- x86/efistub: Give up if memory attribute protocol returns an error +- drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup +- drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case +- drm/msms/dp: fixed link clock divider bits be over written in BPC unknown case +- xfs: respect the stable writes flag on the RT device +- xfs: clean up FS_XFLAG_REALTIME handling in xfs_ioctl_setattr_xflags +- xfs: dquot recovery does not validate the recovered dquot +- xfs: clean up dqblk extraction +- xfs: inode recovery does not validate the recovered inode +- xfs: fix again select in kconfig XFS_ONLINE_SCRUB_STATS +- xfs: fix internal error from AGFL exhaustion +- xfs: up(ic_sema) if flushing data device fails +- xfs: only remap the written blocks in xfs_reflink_end_cow_extent +- xfs: allow read IO and FICLONE to run concurrently +- xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space +- xfs: introduce protection for drop nlink +- xfs: make sure maxlen is still congruent with prod when rounding down +- xfs: fix units conversion error in xfs_bmap_del_extent_delay +- xfs: rt stubs should return negative errnos when rt disabled +- xfs: prevent rt growfs when quota is enabled +- xfs: hoist freeing of rt data fork extent mappings +- xfs: bump max fsgeom struct version +- MAINTAINERS: add Catherine as xfs maintainer for 6.6.y +- rust: upgrade to Rust 1.73.0 +- rust: print: use explicit link in documentation +- rust: task: remove redundant explicit link +- rust: upgrade to Rust 1.72.1 +- rust: arc: add explicit `drop()` around `Box::from_raw()` +- cifs: failure to add channel on iface should bump up weight +- cifs: avoid redundant calls to disable multichannel +- phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP +- dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV +- perf evlist: Fix evlist__new_default() for > 1 core PMU +- phy: renesas: rcar-gen3-usb2: Fix returning wrong error code +- dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA +- dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA +- dmaengine: ti: k3-udma: Report short packet errors +- dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools +- pds_core: Prevent health thread from running during reset/remove +- drm/amdgpu: Fix missing error code in 'gmc_v6/7/8/9_0_hw_init()' +- ASoC: codecs: wsa883x: fix PA volume control +- ASoC: codecs: lpass-wsa-macro: fix compander volume hack +- ASoC: codecs: wcd938x: fix headphones volume controls +- ASoC: qcom: sc8280xp: limit speaker volumes +- bonding: remove print in bond_verify_device_path +- selftests/bpf: Remove flaky test_btf_id test +- LoongArch/smp: Call rcutree_report_cpu_starting() at tlb_init() +- drm/msm/dsi: Enable runtime PM +- Revert "drm/amd/display: Disable PSR-SU on Parade 0803 TCON again" +- mm, kmsan: fix infinite recursion due to RCU critical section +- arm64: irq: set the correct node for shadow call stack +- selftests: net: enable some more knobs +- selftests: net: add missing config for NF_TARGET_TTL +- selftests: bonding: Check initial state +- selftests: team: Add missing config options +- net: sysfs: Fix /sys/class/net/<iface> path +- octeontx2-pf: Remove xdp queues on program detach +- selftests: net: don't access /dev/stdout in pmtu.sh +- selftests: net: fix available tunnels detection +- selftests: net: add missing config for pmtu.sh tests +- selftests: net: add missing config for nftables-backed iptables +- pds_core: Rework teardown/setup flow to be more common +- pds_core: Clear BARs on reset +- pds_core: Prevent race issues involving the adminq +- pds_core: implement pci reset handlers +- pds_core: Use struct pdsc for the pdsc_adminq_isr private data +- pds_core: Cancel AQ work on teardown +- af_unix: fix lockdep positive in sk_diag_dump_icons() +- net: ipv4: fix a memleak in ip_setup_cork +- netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations +- netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger +- netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV +- netfilter: conntrack: correct window scaling with retransmitted SYN +- selftests: net: add missing config for GENEVE +- devlink: Fix referring to hw_addr attribute during state validation +- bridge: mcast: fix disabled snooping after long uptime +- selftests: net: Add missing matchall classifier +- llc: call sock_orphan() at release time +- ipv6: Ensure natural alignment of const ipv6 loopback and router addresses +- net: dsa: qca8k: fix illegal usage of GPIO +- ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550() +- ixgbe: Refactor overtemp event handling +- ixgbe: Refactor returning internal error codes +- e1000e: correct maximum frequency adjustment values +- tcp: add sanity checks to rx zerocopy +- net: lan966x: Fix port configuration when using SGMII interface +- ipmr: fix kernel panic when forwarding mcast packets +- net: dsa: mt7530: fix 10M/100M speed on MT7988 switch +- ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() +- selftests: net: give more time for GRO aggregation +- selftests: net: add missing required classifier +- selftests: net: add missing config for big tcp tests +- net: phy: mediatek-ge-soc: sync driver with MediaTek SDK +- net: ethernet: mtk_eth_soc: set DMA coherent mask to get PPE working +- gve: Fix skb truesize underestimation +- selftests: net: explicitly wait for listener ready +- selftests: net: remove dependency on ebpf tests +- HID: hidraw: fix a problem of memory leak in hidraw_release() +- scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler +- regulator: ti-abb: don't use devm_platform_ioremap_resource_byname for shared interrupt register +- kunit: run test suites only after module initialization completes +- scsi: isci: Fix an error code problem in isci_io_request_build() +- riscv: Fix build error on rv32 + XIP +- drm/amdkfd: only flush mes process context if mes support is there +- drm: using mul_u32_u32() requires linux/math64.h +- wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update +- perf: Fix the nr_addr_filters fix +- i2c: rk3x: Adjust mask/value offset for i2c2 on rv1126 +- drm/amdkfd: Fix 'node' NULL check in 'svm_range_get_range_boundaries()' +- drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()' +- drm/amdgpu: Fix with right return code '-EIO' in 'amdgpu_gmc_vram_checking()' +- drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()' +- drm/amdgpu: fix avg vs input power reporting on smu7 +- ceph: fix invalid pointer access if get_quota_realm return ERR_PTR +- ceph: reinitialize mds feature bit even when session in open +- virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings +- drm/amdkfd: Fix lock dependency warning with srcu +- drm/amdkfd: Fix lock dependency warning +- libsubcmd: Fix memory leak in uniq() +- misc: lis3lv02d_i2c: Add missing setting of the reg_ctrl callback +- usb: xhci-plat: fix usb disconnect issue after s4 +- 9p: Fix initialisation of netfs_inode for 9p +- PCI/AER: Decode Requester ID when no error info found +- PCI: Fix 64GT/s effective data rate calculation +- spmi: mediatek: Fix UAF on device remove +- fs/kernfs/dir: obey S_ISGID +- tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE +- selftests/sgx: Fix linker script asserts +- usb: hub: Add quirk to decrease IN-ep poll interval for Microchip USB491x hub +- usb: hub: Replace hardcoded quirk value with BIT() macro +- extcon: fix possible name leak in extcon_dev_register() +- perf cs-etm: Bump minimum OpenCSD version to ensure a bugfix is present +- PCI: switchtec: Fix stdev_release() crash after surprise hot remove +- PCI: Only override AMD USB controller if required +- mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt +- mfd: ti_am335x_tscadc: Fix TI SoC dependencies +- xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import +- riscv: Make XIP bootable again +- i3c: master: cdns: Update maximum prescaler value for i2c clock +- um: time-travel: fix time corruption +- um: net: Fix return type of uml_net_start_xmit() +- um: Don't use vfprintf() for os_info() +- um: Fix naming clash between UML and scheduler +- leds: trigger: panic: Don't register panic notifier if creating the trigger failed +- pinctrl: baytrail: Fix types of config value in byt_pin_config_set() +- ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140 +- drm/amdgpu: apply the RV2 system aperture fix to RN/CZN as well +- drm/amdkfd: Fix iterator used outside loop in 'kfd_add_peer_prop()' +- drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()' +- drm/amdgpu: Fix '*fw' from request_firmware() not released in 'amdgpu_ucode_request()' +- Re-revert "drm/amd/display: Enable Replay for static screen use cases" +- drm/amdgpu: Let KFD sync with VM fences +- drm/amd/display: Fix minor issues in BW Allocation Phase2 +- drm/amdgpu: Fix ecc irq enable/disable unpaired +- clk: imx: clk-imx8qxp: fix LVDS bypass, pixel and phy clocks +- drm/amd/display: Only clear symclk otg flag for HDMI +- drm/amd/display: make flip_timestamp_in_us a 64-bit variable +- accel/habanalabs: add support for Gaudi2C device +- watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786 +- watchdog: starfive: add lock annotations to fix context imbalances +- clk: mmp: pxa168: Fix memory leak in pxa168_clk_init() +- clk: hi3620: Fix memory leak in hi3620_mmc_clk_init() +- drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap +- drm/msm/dpu: fix writeback programming for YUV cases +- drm/msm/dpu: Ratelimit framedone timeout msgs +- drm/msm/dpu: enable writeback on SM8450 +- drm/msm/dpu: enable writeback on SM8350 +- drm/amdkfd: fix mes set shader debugger process management +- drm/amd/display: Force p-state disallow if leaving no plane config +- drm/amd/display: For prefetch mode > 0, extend prefetch if possible +- media: i2c: imx335: Fix hblank min/max values +- media: ddbridge: fix an error code problem in ddb_probe +- media: amphion: remove mutext lock in condition of wait_event +- IB/ipoib: Fix mcast list locking +- drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time +- hwmon: (hp-wmi-sensors) Fix failure to load on EliteDesk 800 G6 +- hwmon: (nct6775) Fix fan speed set failure in automatic mode +- media: rkisp1: resizer: Stop manual allocation of v4l2_subdev_state +- media: rkisp1: Fix IRQ disable race issue +- media: rkisp1: Store IRQ lines +- media: rkisp1: Fix IRQ handler return values +- media: rkisp1: Drop IRQF_SHARED +- media: uvcvideo: Fix power line control for SunplusIT camera +- media: uvcvideo: Fix power line control for a Chicony camera +- drm/msm/dp: Add DisplayPort controller for SM8650 +- ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL +- ALSA: hda: Intel: add HDA_ARL PCI ID support +- PCI: add INTEL_HDA_ARL to pci_ids.h +- media: rockchip: rga: fix swizzling for RGB formats +- media: stk1160: Fixed high volume of stk1160_dbg messages +- drm/mipi-dsi: Fix detach call without attach +- drm/framebuffer: Fix use of uninitialized variable +- drm/drm_file: fix use of uninitialized variable +- drm/amd/display: Fix MST PBN/X.Y value calculations +- ASoC: amd: Add new dmi entries for acp5x platform +- f2fs: fix write pointers on zoned device after roll forward +- drm/amd/display: Fix tiled display misalignment +- drm/bridge: anx7625: Fix Set HPD irq detect window to 2ms +- drm/panel-edp: Add override_edid_mode quirk for generic edp +- RDMA/IPoIB: Fix error code return in ipoib_mcast_join +- reiserfs: Avoid touching renamed directory if parent does not change +- fast_dput(): handle underflows gracefully +- ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument +- ALSA: hda: Refer to correct stream index at loops +- f2fs: fix to check return value of f2fs_reserve_new_block() +- net: dsa: qca8k: put MDIO bus OF node on qca8k_mdio_register() failure +- net: kcm: fix direct access to bv_len +- octeontx2-af: Fix max NPC MCAM entry check while validating ref_entry +- i40e: Fix VF disable behavior to block all traffic +- arm64: dts: sprd: Change UMS512 idle-state nodename to match bindings +- arm64: dts: sprd: Add clock reference for pll2 on UMS512 +- bridge: cfm: fix enum typo in br_cc_ccm_tx_parse +- net/smc: disable SEID on non-s390 archs where virtual ISM may be used +- Bluetooth: L2CAP: Fix possible multiple reject send +- Bluetooth: hci_sync: fix BR/EDR wakeup bug +- Bluetooth: ISO: Avoid creating child socket if PA sync is terminating +- Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066 +- wifi: cfg80211: free beacon_ies when overridden from hidden BSS +- wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() +- libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos +- wifi: rtw89: coex: Fix wrong Wi-Fi role info and FDDT parameter members +- wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices +- arm64: dts: amlogic: fix format for s4 uart node +- ice: fix pre-shifted bit usage +- arm64: dts: qcom: Fix coresight warnings in in-ports and out-ports +- arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property +- arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property +- block: prevent an integer overflow in bvec_try_merge_hw_page +- net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path +- net: atlantic: eliminate double free in error handling logic +- ice: fix ICE_AQ_VSI_Q_OPT_RSS_* register values +- scsi: hisi_sas: Set .phy_attached before notifing phyup event HISI_PHYE_PHY_UP_PM +- scsi: lpfc: Move determination of vmid_flag after VMID reinitialization completes +- scsi: lpfc: Reinitialize an NPIV's VMID data structures after FDISC +- ARM: dts: imx23/28: Fix the DMA controller node name +- ARM: dts: imx23-sansa: Use preferred i2c-gpios properties +- ARM: dts: imx27-apf27dev: Fix LED name +- ARM: dts: imx25/27: Pass timing0 +- ARM: dts: imx25: Fix the iim compatible string +- selftests/bpf: fix compiler warnings in RELEASE=1 mode +- arm64: zynqmp: Fix clock node name in kv260 cards +- arm64: zynqmp: Move fixed clock to / for kv260 +- block/rnbd-srv: Check for unlikely string overflow +- ionic: bypass firmware cmds when stuck in reset +- ionic: pass opcode to devcmd_wait +- net: phy: at803x: fix passing the wrong reference for config_intr +- ARM: dts: imx1: Fix sram node +- ARM: dts: imx27: Fix sram node +- ARM: dts: imx: Use flash@0,0 pattern +- ARM: dts: imx25/27-eukrea: Fix RTC node name +- ARM: dts: rockchip: fix rk3036 hdmi ports node +- wifi: ath12k: fix the issue that the multicast/broadcast indicator is not read correctly for WCN7850 +- bpf: Set uattr->batch.count as zero before batched update or deletion +- wifi: mt76: mt7996: add PCI IDs for mt7992 +- wifi: mt76: connac: fix EHT phy mode check +- arm64: dts: qcom: sm8350: Fix remoteproc interrupt type +- arm64: dts: qcom: sm8450: fix soundwire controllers node name +- arm64: dts: qcom: sm8550: fix soundwire controllers node name +- net: mvmdio: Avoid excessive sleeps in polled mode +- minmax: relax check to allow comparison between unsigned arguments and signed constants +- minmax: allow comparisons of 'int' against 'unsigned char/short' +- minmax: fix indentation of __cmp_once() and __clamp_once() +- minmax: allow min()/max()/clamp() if the arguments have the same signedness. +- minmax: add umin(a, b) and umax(a, b) +- minmax: fix header inclusions +- minmax: deduplicate __unconst_integer_typeof() +- scsi: libfc: Fix up timeout error in fc_fcp_rec_error() +- scsi: libfc: Don't schedule abort twice +- wifi: ath12k: fix and enable AP mode for WCN7850 +- bpf: Set need_defer as false when clearing fd array during map free +- bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers +- wifi: rtw89: fix misbehavior of TX beacon in concurrent mode +- wifi: ath11k: fix race due to setting ATH11K_FLAG_EXT_IRQ_ENABLED too early +- wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() +- bpf: Fix a few selftest failures due to llvm18 change +- ARM: dts: imx7s: Fix nand-controller #size-cells +- ARM: dts: imx7s: Fix lcdif compatible +- ARM: dts: imx7d: Fix coresight funnel ports +- scsi: arcmsr: Support new PCI device IDs 1883 and 1886 +- scsi: mpi3mr: Add PCI checks where SAS5116 diverges from SAS4116 +- scsi: mpi3mr: Add support for SAS5116 PCI IDs +- net: usb: ax88179_178a: avoid two consecutive device resets +- bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk +- PCI: Add no PM reset quirk for NVIDIA Spectrum devices +- net: phy: micrel: fix ts_info value in case of no phc +- ARM: dts: samsung: s5pv210: fix camera unit addresses/ranges +- ARM: dts: samsung: exynos4: fix camera unit addresses/ranges +- scsi: lpfc: Fix possible file string name overflow when updating firmware +- soc: xilinx: fix unhandled SGI warning message +- soc: xilinx: Fix for call trace due to the usage of smp_processor_id() +- ARM: dts: qcom: msm8660: fix PMIC node labels +- ARM: dts: qcom: mdm9615: fix PMIC node labels +- ARM: dts: qcom: strip prefix from PMIC files +- selftests/bpf: Fix issues in setup_classid_environment() +- wifi: rt2x00: correct wrong BBP register in RxDCOC calibration +- selftests/bpf: Fix pyperf180 compilation failure with clang18 +- libbpf: Fix potential uninitialized tail padding with LIBBPF_OPTS_RESET +- selftests/bpf: satisfy compiler by having explicit return in btf test +- selftests/bpf: fix RELEASE=1 build for tc_opts +- wifi: rt2x00: restart beacon queue when hardware reset +- wifi: rtw89: fix timeout calculation in rtw89_roc_end() +- ext4: avoid online resizing failures due to oversized flex bg +- ext4: remove unnecessary check from alloc_flex_gd() +- ext4: unify the type of flexbg_size to unsigned int +- ext4: fix inconsistent between segment fstrim and full fstrim +- ecryptfs: Reject casefold directory inodes +- smb: client: fix hardlinking of reparse points +- smb: client: fix renaming of reparse points +- ext4: treat end of range as exclusive in ext4_zero_range() +- SUNRPC: Fix a suspicious RCU usage warning +- sysctl: Fix out of bounds access for empty sysctl registers +- KVM: s390: fix setting of fpc register +- s390/ptrace: handle setting of fpc register correctly +- s390/vfio-ap: fix sysfs status attribute for AP queue devices +- arch: consolidate arch_irq_work_raise prototypes +- s390/boot: always align vmalloc area on segment boundary +- jfs: fix array-index-out-of-bounds in diNewExt +- rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() +- afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*() +- afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu() +- crypto: stm32/crc32 - fix parsing list of devices +- erofs: fix ztailpacking for subpage compressed blocks +- crypto: octeontx2 - Fix cptvf driver cleanup +- crypto: starfive - Fix dev_err_probe return error +- erofs: fix up compacted indexes for block size < 4096 +- pstore/ram: Fix crash when setting number of cpus to an odd number +- crypto: p10-aes-gcm - Avoid -Wstringop-overflow warnings +- hwrng: starfive - Fix dev_err_probe return error +- jfs: fix uaf in jfs_evict_inode +- jfs: fix array-index-out-of-bounds in dbAdjTree +- jfs: fix slab-out-of-bounds Read in dtSearch +- UBSAN: array-index-out-of-bounds in dtSplitRoot +- FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree +- thermal: core: Fix thermal zone suspend-resume synchronization +- ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events +- PM / devfreq: Synchronize devfreq_monitor_[start/stop] +- kunit: tool: fix parsing of test attributes +- ACPI: NUMA: Fix the logic of getting the fake_pxm value +- selftests/nolibc: fix testcase status alignment +- ACPI: extlog: fix NULL pointer dereference check +- PNP: ACPI: fix fortify warning +- ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop +- audit: Send netlink ACK before setting connection in auditd_set +- regulator: core: Only increment use_count when enable_count changes +- debugobjects: Stop accessing objects after releasing hash bucket lock +- perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file +- x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel +- powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE +- x86/boot: Ignore NMIs during very early boot +- powerpc/64s: Fix CONFIG_NUMA=n build due to create_section_mapping() +- powerpc/mm: Fix build failures due to arch_reserved_kernel_pages() +- powerpc: Fix build error due to is_valid_bugaddr() +- drivers/perf: pmuv3: don't expose SW_INCR event in sysfs +- arm64: irq: set the correct node for VMAP stack +- powerpc/mm: Fix null-pointer dereference in pgtable_cache_add +- asm-generic: make sparse happy with odd-sized put_unaligned_*() +- Documentation/sphinx: fix Python string escapes +- thermal: trip: Drop lockdep assertion from thermal_zone_trip_id() +- serial: core: fix kernel-doc for uart_port_unlock_irqrestore() +- x86/entry/ia32: Ensure s32 is sign extended to s64 +- tick/sched: Preserve number of idle sleeps across CPU hotplug events +- clocksource: Skip watchdog check for large watchdog intervals +- genirq: Initialize resend_node hlist for all interrupt descriptors +- mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan +- cxl/region：Fix overflow issue in alloc_hpa() +- drm: bridge: samsung-dsim: Don't use FORCE_STOP_STATE +- MIPS: lantiq: register smp_ops on non-smp platforms +- spi: fix finalize message on error return +- cifs: fix stray unlock in cifs_chan_skip_or_disable +- spi: spi-cadence: Reverse the order of interleaved write and read operations +- spi: bcm-qspi: fix SFDP BFPT read by usig mspi read +- cpufreq/amd-pstate: Fix setting scaling max/min freq values +- drm/bridge: anx7625: Ensure bridge is suspended in disable() +- block: Move checking GENHD_FL_NO_PART to bdev_add_partition() +- spi: intel-pci: Remove Meteor Lake-S SoC PCI ID from the list +- ARM: dts: exynos4212-tab3: add samsung,invert-vclk flag to fimd +- gpio: eic-sprd: Clear interrupt after set the interrupt type +- firmware: arm_scmi: Use xa_insert() when saving raw queues +- firmware: arm_scmi: Use xa_insert() to store opps +- drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume +- drm/exynos: fix accidental on-stack copy of exynos_drm_plane +- memblock: fix crash when reserved memory is not added to memory +- drm/bridge: parade-ps8640: Make sure we drop the AUX mutex in the error case +- drm/bridge: parade-ps8640: Ensure bridge is suspended in .post_disable() +- drm/bridge: sii902x: Fix audio codec unregistration +- drm/bridge: sii902x: Fix probing race issue +- drm/panel: samsung-s6d7aa0: drop DRM_BUS_FLAG_DE_HIGH for lsl080al02 +- drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33] +- drm/bridge: parade-ps8640: Wait for HPD when doing an AUX transfer +- drm/amdgpu/gfx11: set UNORD_DISPATCH in compute MQDs +- drm/amdgpu/gfx10: set UNORD_DISPATCH in compute MQDs +- drm/panel-edp: drm/panel-edp: Fix AUO B116XTN02 name +- drm/panel-edp: drm/panel-edp: Fix AUO B116XAK01 name and timing +- drm/panel-edp: Add AUO B116XTN02, BOE NT116WHM-N21,836X2, NV116WHM-N49 V8.0 +- drm/i915/psr: Only allow PSR in LPSP mode on HSW non-ULT +- drm/i915/lnl: Remove watchdog timers for PSR +- btrfs: zoned: optimize hint byte for zoned allocator +- btrfs: zoned: factor out prepare_allocation_zoned() +- serial: sc16is7xx: fix unconditional activation of THRI interrupt +- serial: sc16is7xx: Use port lock wrappers +- serial: core: Provide port lock wrappers +- mm: migrate: fix getting incorrect page mapping during page migration +- mm: migrate: record the mlocked page status to remove unnecessary lru drain +- thermal: gov_power_allocator: avoid inability to reset a cdev +- thermal: core: Store trip pointer in struct thermal_instance +- thermal: trip: Drop redundant trips check from for_each_thermal_trip() +- media: i2c: imx290: Properly encode registers as little-endian +- media: v4l2-cci: Add support for little-endian encoded registers +- media: v4l: cci: Add macros to obtain register width and address +- media: v4l: cci: Include linux/bits.h +- pipe: wakeup wr_wait after setting max_usage +- fs/pipe: move check to pipe_has_watch_queue() +- thermal: intel: hfi: Add syscore callbacks for system-wide PM +- thermal: intel: hfi: Disable an HFI instance when all its CPUs go offline +- thermal: intel: hfi: Refactor enabling code into helper functions +- net/bpf: Avoid unused "sin_addr_len" warning when CONFIG_CGROUP_BPF is not set +- drm/amd/display: Fix uninitialized variable usage in core_link_ 'read_dpcd() & write_dpcd()' functions +- drm/amdgpu/pm: Fix the power source flag error +- drm/amd/display: Fix late derefrence 'dsc' check in 'link_set_dsc_pps_packet()' +- drm/amd/display: Align the returned error code with legacy DP +- drm/amd/display: Port DENTIST hang and TDR fixes to OTG disable W/A +- drm/amd/display: Fix variable deferencing before NULL check in edp_setup_replay() +- drm/amdgpu: correct the cu count for gfx v11 +- drm/bridge: nxp-ptn3460: simplify some error checking +- Revert "drm/amd/display: fix bandwidth validation failure on DCN 2.1" +- drm/amd/display: Disable PSR-SU on Parade 0803 TCON again +- drm/amd/display: fix bandwidth validation failure on DCN 2.1 +- drm: Allow drivers to indicate the damage helpers to ignore damage clips +- drm/virtio: Disable damage clipping if FB changed since last page-flip +- drm: Disable the cursor plane on atomic contexts with virtualized drivers +- drm/tidss: Fix atomic_flush check +- drm: Fix TODO list mentioning non-KMS drivers +- drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking +- drm: Don't unref the same fb many times by mistake due to deadlock handling +- Revert "drm/i915/dsi: Do display on sequence later on icl+" +- cpufreq: intel_pstate: Refine computation of P-state for given frequency +- gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04 +- xfs: read only mounts with fsopen mount API are busted +- drm/amdgpu: Fix the null pointer when load rlc firmware +- Revert "drivers/firmware: Move sysfb_init() from device_initcall to subsys_initcall_sync" +- firmware: arm_scmi: Check mailbox/SMT channel for consistency +- ksmbd: fix global oob in ksmbd_nl_policy +- platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe +- platform/x86: intel-uncore-freq: Fix types in sysfs callbacks +- netfilter: nf_tables: reject QUEUE/DROP verdict parameters +- netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain +- hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes +- nfsd: fix RELEASE_LOCKOWNER +- wifi: iwlwifi: fix a memory corruption +- exec: Fix error handling in begin_new_exec() +- rbd: don't move requests to the running list on errors +- btrfs: don't abort filesystem when attempting to snapshot deleted subvolume +- btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args +- btrfs: don't warn if discard range is not aligned to sector +- btrfs: tree-checker: fix inline ref size in error messages +- btrfs: ref-verify: free ref cache before clearing mount opt +- btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume being deleted +- btrfs: zoned: fix lock ordering in btrfs_zone_activate() +- tsnep: Fix XDP_RING_NEED_WAKEUP for empty fill ring +- tsnep: Remove FCS for XDP data path +- net: fec: fix the unhandled context fault from smmu +- selftests: bonding: do not test arp/ns target with mode balance-alb/tlb +- fjes: fix memleaks in fjes_hw_setup +- i40e: update xdp_rxq_info::frag_size for ZC enabled Rx queue +- i40e: set xdp_rxq_info::frag_size +- xdp: reflect tail increase for MEM_TYPE_XSK_BUFF_POOL +- ice: update xdp_rxq_info::frag_size for ZC enabled Rx queue +- intel: xsk: initialize skb_frag_t::bv_offset in ZC drivers +- ice: remove redundant xdp_rxq_info registration +- i40e: handle multi-buffer packets that are shrunk by xdp prog +- ice: work on pre-XDP prog frag count +- xsk: fix usage of multi-buffer BPF helpers for ZC XDP +- bpf: Add bpf_sock_addr_set_sun_path() to allow writing unix sockaddr from bpf +- bpf: Propagate modified uaddrlen from cgroup sockaddr programs +- xsk: make xsk_buff_pool responsible for clearing xdp_buff::flags +- xsk: recycle buffer in case Rx queue was full +- selftests: netdevsim: fix the udp_tunnel_nic test +- selftests: net: fix rps_default_mask with >32 CPUs +- net: mvpp2: clear BM pool before initialization +- net: stmmac: Wait a bit for the reset to take effect +- netfilter: nf_tables: validate NFPROTO_* family +- netfilter: nf_tables: restrict anonymous set and map names to 16 bytes +- netfilter: nft_limit: reject configurations that cause integer overflow +- rcu: Defer RCU kthreads wakeup when CPU is dying +- net/mlx5e: fix a potential double-free in fs_any_create_groups +- net/mlx5e: fix a double-free in arfs_create_groups +- net/mlx5e: Ignore IPsec replay window values on sender side +- net/mlx5e: Allow software parsing when IPsec crypto is enabled +- net/mlx5: Use mlx5 device constant for selecting CQ period mode for ASO +- net/mlx5: DR, Can't go to uplink vport on RX rule +- net/mlx5: DR, Use the right GVMI number for drop action +- net/mlx5: Bridge, fix multicast packets sent to uplink +- net/mlx5: Bridge, Enable mcast in smfs steering mode +- net/mlx5: Fix a WARN upon a callback command failure +- net/mlx5e: Fix peer flow lists handling +- net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context +- net/sched: flower: Fix chain template offload +- selftests: fill in some missing configs for net +- ipv6: init the accept_queue's spinlocks in inet6_create +- netlink: fix potential sleeping issue in mqueue_flush_file +- selftest: Don't reuse port for SO_INCOMING_CPU test. +- tcp: Add memory barrier to tcp_push() +- afs: Hide silly-rename files from userspace +- tracing: Ensure visibility when inserting an element into tracing_map +- netfs, fscache: Prevent Oops in fscache_put_cache() +- net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv +- net: micrel: Fix PTP frame parsing for lan8814 +- tun: add missing rx stats accounting in tun_xdp_act +- tun: fix missing dropped counter in tun_xdp_act +- net: fix removing a namespace with conflicting altnames +- udp: fix busy polling +- llc: Drop support for ETH_P_TR_802_2. +- llc: make llc_ui_sendmsg() more robust against bonding changes +- vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING +- bnxt_en: Prevent kernel warning when running offline self test +- bnxt_en: Wait for FLR to complete during probe +- tcp: make sure init the accept_queue's spinlocks once +- selftests: bonding: Increase timeout to 1200s +- net/smc: fix illegal rmb_desc access in SMC-D connection dump +- wifi: mac80211: fix potential sta-link leak +- SUNRPC: use request size to initialize bio_vec in svc_udp_sendto() +- cifs: after disabling multichannel, mark tcon for reconnect +- cifs: fix a pending undercount of srv_count +- cifs: fix lock ordering while disabling multichannel +- Revert "drm/amd: Enable PCIe PME from D3" +- selftests/bpf: check if max number of bpf_loop iterations is tracked +- bpf: keep track of max number of bpf_loop callback iterations +- selftests/bpf: test widening for iterating callbacks +- bpf: widening for callback iterators +- selftests/bpf: tests for iterating callbacks +- bpf: verify callbacks as if they are called unknown number of times +- bpf: extract setup_func_entry() utility function +- bpf: extract __check_reg_arg() utility function +- selftests/bpf: track string payload offset as scalar in strobemeta +- selftests/bpf: track tcp payload offset as scalar in xdp_synproxy +- bpf: print full verifier states on infinite loop detection +- selftests/bpf: test if state loops are detected in a tricky case +- bpf: correct loop detection for iterators convergence +- selftests/bpf: tests with delayed read/precision makrs in loop body +- bpf: exact states comparison for iterator convergence checks +- bpf: extract same_callsites() as utility function +- bpf: move explored_state() closer to the beginning of verifier.c +- dt-bindings: net: snps,dwmac: Tx coe unsupported +- ksmbd: Add missing set_freezable() for freezable kthread +- ksmbd: send lease break notification on FILE_RENAME_INFORMATION +- ksmbd: don't increment epoch if current state and request state are same +- ksmbd: fix potential circular locking issue in smb2_set_ea() +- ksmbd: set v2 lease version on lease upgrade +- serial: Do not hold the port lock when setting rx-during-tx GPIO +- mm: page_alloc: unreserve highatomic page blocks before oom +- LoongArch/smp: Call rcutree_report_cpu_starting() earlier +- serial: sc16is7xx: improve do/while loop in sc16is7xx_irq() +- serial: sc16is7xx: remove obsolete loop in sc16is7xx_port_irq() +- serial: sc16is7xx: fix invalid sc16is7xx_lines bitfield in case of probe error +- serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO +- serial: sc16is7xx: change EFR lock to operate on each channels +- serial: sc16is7xx: remove unused line structure member +- serial: sc16is7xx: remove global regmap from struct sc16is7xx_port +- serial: sc16is7xx: remove wasteful static buffer in sc16is7xx_regmap_name() +- serial: sc16is7xx: improve regmap debugfs by using one regmap per port +- rename(): fix the locking of subdirectories +- mm/sparsemem: fix race in accessing memory_section->usage +- mm/rmap: fix misplaced parenthesis of a likely() +- selftests: mm: hugepage-vmemmap fails on 64K page size systems +- kexec: do syscore_shutdown() in kernel_kexec +- ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path +- nouveau/vmm: don't set addr on the fail path to avoid warning +- rtc: Extend timeout for waiting for UIP to clear to 1s +- rtc: Add support for configuring the UIP timeout for RTC reads +- rtc: mc146818-lib: Adjust failure return code for mc146818_get_time() +- rtc: Adjust failure return code for cmos_set_alarm() +- rtc: cmos: Use ACPI alarm for non-Intel x86 systems too +- arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD +- arm64/sme: Always exit sme_alloc() early with existing storage +- arm64: errata: Add Cortex-A510 speculative unprivileged load workaround +- arm64: Rename ARM64_WORKAROUND_2966298 +- riscv: mm: Fixup compat mode boot failure +- riscv: mm: Fixup compat arch_get_mmap_end +- media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run +- media: mtk-jpeg: Fix timeout schedule error in mtk_jpegdec_worker. +- media: i2c: st-mipid02: correct format propagation +- mmc: mmc_spi: remove custom DMA mapped buffers +- mmc: core: Use mrq.sbc in close-ended ffu +- media: videobuf2-dma-sg: fix vmap callback +- scripts/get_abi: fix source path leak +- docs: kernel_abi.py: fix command injection +- dlm: use kernel_connect() and kernel_bind() +- lsm: new security_file_ioctl_compat() hook +- ARM: dts: qcom: sdx55: fix USB SS wakeup +- arm64: dts: qcom: sdm670: fix USB SS wakeup +- arm64: dts: qcom: sdm670: fix USB DP/DM HS PHY interrupts +- arm64: dts: qcom: sc8180x: fix USB SS wakeup +- arm64: dts: qcom: sc8180x: fix USB DP/DM HS PHY interrupts +- arm64: dts: qcom: sm8150: fix USB SS wakeup +- arm64: dts: qcom: sm8150: fix USB DP/DM HS PHY interrupts +- arm64: dts: qcom: sdm845: fix USB SS wakeup +- arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts +- ARM: dts: qcom: sdx55: fix USB DP/DM HS PHY interrupts +- arm64: dts: qcom: Add missing vio-supply for AW2013 +- arm64: dts: qcom: sc7280: fix usb_1 wakeup interrupt types +- arm64: dts: qcom: sc8180x: fix USB wakeup interrupt types +- arm64: dts: qcom: sm8150: fix USB wakeup interrupt types +- arm64: dts: qcom: sdm670: fix USB wakeup interrupt types +- arm64: dts: qcom: sdm845: fix USB wakeup interrupt types +- arm64: dts: qcom: sc7180: fix USB wakeup interrupt types +- arm64: dts: qcom: msm8939: Make blsp_dma controlled-remotely +- arm64: dts: qcom: msm8916: Make blsp_dma controlled-remotely +- arm64: dts: rockchip: Fix rk3588 USB power-domain clocks +- arm64: dts: rockchip: configure eth pad driver strength for orangepi r1 plus lts +- arm64: dts: sprd: fix the cpu node for UMS512 +- ARM: dts: qcom: sdx55: fix pdc '#interrupt-cells' +- ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12 +- ARM: dts: qcom: sdx55: fix USB wakeup interrupt types +- arm64: dts: qcom: sc8280xp-crd: fix eDP phy compatible +- ARM: dts: imx6q-apalis: add can power-up delay on ixora board +- parisc/power: Fix power soft-off button emulation on qemu +- parisc/firmware: Fix F-extend for PDC addresses +- bus: mhi: host: Add spinlock to protect WP access when queueing TREs +- bus: mhi: host: Drop chan lock before queuing buffers +- bus: mhi: host: Add alignment check for event ring read pointer +- mips: Fix max_mapnr being uninitialized on early stages +- nbd: always initialize struct msghdr completely +- s390/vfio-ap: do not reset queue removed from host config +- s390/vfio-ap: reset queues associated with adapter for queue unbound from driver +- s390/vfio-ap: reset queues filtered from the guest's AP config +- s390/vfio-ap: let on_scan_complete() callback filter matrix and update guest's APCB +- s390/vfio-ap: loop over the shadow APCB when filtering guest's AP configuration +- soc: fsl: cpm1: qmc: Fix rx channel reset +- soc: fsl: cpm1: qmc: Fix __iomem addresses declaration +- soc: fsl: cpm1: tsa: Fix __iomem addresses declaration +- media: ov01a10: Enable runtime PM before registering async sub-device +- media: ov13b10: Enable runtime PM before registering async sub-device +- media: ov9734: Enable runtime PM before registering async sub-device +- rpmsg: virtio: Free driver_override when rpmsg_remove() +- media: imx355: Enable runtime PM before registering async sub-device +- soc: qcom: pmic_glink_altmode: fix port sanity check +- mtd: rawnand: Clarify conditions to enable continuous reads +- mtd: rawnand: Prevent sequential reads with on-die ECC engines +- mtd: rawnand: Fix core interference with sequential reads +- mtd: rawnand: Prevent crossing LUN boundaries during sequential reads +- mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters +- PM / devfreq: Fix buffer overflow in trans_stat_show +- s390/vfio-ap: unpin pages on gisc registration failure +- crypto: s390/aes - Fix buffer overread in CTR mode +- hwrng: core - Fix page fault dead lock on mmap-ed hwrng +- PM: hibernate: Enforce ordering during image compression/decompression +- crypto: api - Disallow identical driver names +- crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init +- btrfs: sysfs: validate scrub_speed_max value +- OPP: Pass rounded rate to _set_opp() +- arm64: properly install vmlinuz.efi +- PM: sleep: Fix possible deadlocks in core system-wide PM code +- async: Introduce async_schedule_dev_nocall() +- async: Split async_schedule_node_domain() +- ext4: allow for the last group to be marked as trimmed +- powerpc/ps3_defconfig: Disable PPC64_BIG_ENDIAN_ELF_ABI_V2 +- cifs: update iface_last_update on each query-and-update +- cifs: handle servers that still advertise multichannel after disabling +- cifs: reconnect worker should take reference on server struct unconditionally +- Revert "cifs: reconnect work should have reference on server struct" +- cifs: handle when server stops supporting multichannel +- cifs: handle when server starts supporting multichannel +- cifs: reconnect work should have reference on server struct +- cifs: handle cases where a channel is closed +- smb: client: fix parsing of SMB3.1.1 POSIX create context +- sh: ecovec24: Rename missed backlight field from fbdev to dev +- scsi: core: Kick the requeue list after inserting when flushing +- riscv: Fix an off-by-one in get_early_cmdline() +- scsi: ufs: core: Remove the ufshcd_hba_exit() call from ufshcd_async_scan() +- dmaengine: idxd: Move dma_free_coherent() out of spinlocked context +- dmaengine: fix NULL pointer in channel unregistration function +- dmaengine: fsl-edma: fix eDMAv4 channel allocation issue +- iio: adc: ad7091r: Enable internal vref if external vref is not supplied +- iio: adc: ad7091r: Allow users to configure device events +- iio: adc: ad7091r: Set alert bit in config register +- net: stmmac: Prevent DSA tags from breaking COE +- net: stmmac: Tx coe sw fallback +- soundwire: fix initializing sysfs for same devices on different buses +- soundwire: bus: introduce controller_id +- serial: core: set missing supported flag for RX during TX GPIO +- serial: core: Simplify uart_get_rs485_mode() +- docs: kernel_feat.py: fix potential command injection +- docs: sparse: add sparse.rst to toctree +- docs: sparse: move TW sparse.txt to TW dev-tools +- Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"" +- arm64: dts: armada-3720-turris-mox: set irq type for RTC +- Revert "KEYS: encrypted: Add check for strsep" +- riscv: Fix wrong usage of lm_alias() when splitting a huge linear mapping +- i2c: s3c24xx: fix transferring more than one message in polling mode +- i2c: s3c24xx: fix read transfers in polling mode +- ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work +- selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes +- mlxsw: spectrum_router: Register netdevice notifier before nexthop +- mlxsw: spectrum_acl_tcam: Fix stack corruption +- mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path +- mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure +- loop: fix the the direct I/O support check when used on top of block devices +- ethtool: netlink: Add missing ethnl_ops_begin/complete +- arm64/ptrace: Don't flush ZA/ZT storage when writing ZA via ptrace +- kdb: Fix a potential buffer overflow in kdb_local() +- io_uring: adjust defer tw counting +- ipvs: avoid stat macros calls from preemptible context +- netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description +- netfilter: nf_tables: skip dead set elements in netlink dump +- netfilter: nf_tables: do not allow mismatch field size and set key length +- netfilter: bridge: replace physindev with physinif in nf_bridge_info +- netfilter: propagate net to nf_bridge_get_physindev +- netfilter: nf_queue: remove excess nf_bridge variable +- netfilter: nfnetlink_log: use proper helper for fetching physinif +- netfilter: nft_limit: do not ignore unsupported flags +- netfilter: nf_tables: reject invalid set policy +- net: netdevsim: don't try to destroy PHC on VFs +- mptcp: relax check on MPC passive fallback +- LoongArch: BPF: Prevent out-of-bounds memory access +- net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe +- bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS +- net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake calls +- selftests: bonding: Change script interpreter +- drm/amdgpu: fall back to INPUT power for AVG power via INFO IOCTL +- drm/amdkfd: fixes for HMM mem allocation +- ASoC: SOF: ipc4-loader: remove the CPC check warnings +- gpio: mlxbf3: add an error code check in mlxbf3_gpio_probe +- dt-bindings: gpio: xilinx: Fix node address in gpio +- net: ravb: Fix dma_addr_t truncation in error case +- net: tls, fix WARNIING in __sk_msg_free +- bpf: Avoid iter->offset making backward progress in bpf_iter_udp +- bpf: iter_udp: Retry with a larger batch size without going back to the previous bucket +- net: netdev_queue: netdev_txq_completed_mb(): fix wake condition +- net: add more sanity check in virtio_net_hdr_to_skb() +- udp: annotate data-races around up->pending +- net: stmmac: Fix ethool link settings ops for integrated PCS +- block: ensure we hold a queue reference when using queue limits +- mptcp: refine opt_mp_capable determination +- mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req() +- mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() +- mptcp: strict validation before using mp_opt->hmac +- mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN +- ALSA: hda: Properly setup HDMI stream +- net: phy: micrel: populate .soft_reset for KSZ9131 +- net: micrel: Fix PTP frame parsing for lan8841 +- amt: do not use overwrapped cb area +- net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames +- octeontx2-af: CN10KB: Fix FIFO length calculation for RPM2 +- rxrpc: Fix use of Don't Fragment flag +- net: qualcomm: rmnet: fix global oob in rmnet_policy +- s390/pci: fix max size calculation in zpci_memcpy_toio() +- ASoC: mediatek: sof-common: Add NULL check for normal_link string +- PCI: mediatek-gen3: Fix translation window size calculation +- PCI: keystone: Fix race condition when initializing PHYs +- nvmet-tcp: Fix the H2C expected PDU len calculation +- nvme: trace: avoid memcpy overflow warning +- nvmet: re-fix tracing strncpy() warning +- hisi_acc_vfio_pci: Update migration data pointer correctly on saving/resume +- spi: coldfire-qspi: Remove an erroneous clk_disable_unprepare() from the remove function +- cxl/port: Fix missing target list lock +- perf db-export: Fix missing reference count get in call_path_from_sample() +- serial: apbuart: fix console prompt on qemu +- serial: imx: Correct clock error message in function probe() +- usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer +- apparmor: avoid crash when parsed profile name is empty +- apparmor: fix possible memory leak in unpack_trans_table +- cxl/region: fix x9 interleave typo +- perf stat: Fix hard coded LL miss units +- perf env: Avoid recursively taking env->bpf_progs.lock +- nvmet-tcp: fix a crash in nvmet_req_complete() +- nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length +- apparmor: Fix ref count leak in task_kill +- vdpa: Fix an error handling path in eni_vdpa_probe() +- power: supply: Fix null pointer dereference in smb2_probe +- usb: gadget: webcam: Make g_webcam loadable again +- spmi: mtk-pmif: Serialize PMIF status check and command submission +- usb: cdc-acm: return correct error code on unsupported break +- tty: use 'if' in send_break() instead of 'goto' +- tty: don't check for signal_pending() in send_break() +- tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK +- PCI: epf-mhi: Fix the DMA data direction of dma_unmap_single() +- bus: mhi: ep: Pass mhi_ep_buf_info struct to read/write APIs +- bus: mhi: ep: Use slab allocator where applicable +- bus: mhi: ep: Do not allocate event ring element on stack +- perf unwind-libunwind: Fix base address for .eh_frame +- perf unwind-libdw: Handle JIT-generated DSOs properly +- perf genelf: Set ELF program header addresses properly +- perf header: Fix one memory leakage in perf_event__fprintf_event_update() +- iio: adc: ad9467: fix scale setting +- iio: adc: ad9467: add mutex to struct ad9467_state +- iio: adc: ad9467: don't ignore error codes +- iio: adc: ad9467: fix reset gpio handling +- selftests/sgx: Skip non X86_64 platform +- selftests/sgx: Include memory clobber for inline asm in test enclave +- selftests/sgx: Fix uninitialized pointer dereferences in encl_get_entry +- selftests/sgx: Fix uninitialized pointer dereference in error path +- serial: imx: fix tx statemachine deadlock +- software node: Let args be NULL in software_node_get_reference_args +- acpi: property: Let args be NULL in __acpi_node_get_property_reference +- base/node.c: initialize the accessor list before registering +- perf stat: Exit perf stat if parse groups fails +- perf mem: Fix error on hybrid related to availability of mem event in a PMU +- perf vendor events arm64 AmpereOne: Rename BPU_FLUSH_MEM_FAULT to GPC_FLUSH_MEM_FAULT +- vfio/pds: Fix calculations in pds_vfio_dirty_sync +- perf test record user-regs: Fix mask for vg register +- libapi: Add missing linux/types.h header to get the __u64 type on io.h +- perf header: Fix segfault on build_mem_topology() error path +- perf test: Remove atomics from test_loop to avoid test failures +- power: supply: bq256xx: fix some problem in bq256xx_hw_init +- power: supply: cw2015: correct time_to_empty units in sysfs +- MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup() +- MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup() +- riscv: Fixed wrong register in XIP_FIXUP_FLASH_OFFSET macro +- riscv: Fix set_direct_map_default_noflush() to reset _PAGE_EXEC +- riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings +- riscv: Fix module_alloc() that did not reset the linear mapping permissions +- riscv: Check if the code to patch lies in the exit section +- um: virt-pci: fix platform map offset +- mips: Fix incorrect max_low_pfn adjustment +- mips: dmi: Fix early remap on MIPS32 +- srcu: Use try-lock lockdep annotation for NMI-safe access. +- mfd: intel-lpss: Fix the fractional clock divider flags +- mfd: tps6594: Add null pointer check to tps6594_device_init() +- leds: aw200xx: Fix write to DIM parameter +- leds: aw2013: Select missing dependency REGMAP_I2C +- mfd: syscon: Fix null pointer dereference in of_syscon_register() +- mfd: cs42l43: Correct SoundWire port list +- mfd: rk8xx: fixup devices registration with PLATFORM_DEVID_AUTO +- ARM: 9330/1: davinci: also select PINCTRL +- serial: sc16is7xx: set safe default SPI clock frequency +- serial: sc16is7xx: add check for unsupported SPI modes during probe +- HID: wacom: Correct behavior when processing some confidence == false touches +- HID: sensor-hub: Enable hid core report processing for all devices +- iio: adc: ad7091r: Pass iio_dev to event handler +- KVM: x86/pmu: Reset the PMU, i.e. stop counters, before refreshing +- KVM: x86/pmu: Move PMU reset logic to common x86 code +- KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache +- x86/kvm: Do not try to disable kvmclock if it was not enabled +- PCI: mediatek: Clear interrupt status before dispatching handler +- PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support +- x86/pci: Reserve ECAM if BIOS didn't include it in PNP0C02 _CRS +- PCI/P2PDMA: Remove reference to pci_p2pdma_map_sg() +- cxl/port: Fix decoder initialization when nr_targets > interleave_ways +- Revert "nSVM: Check for reserved encodings of TLB_CONTROL in nested VMCB" +- Revert "net: rtnetlink: Enslave device before bringing it up" +- net: stmmac: fix ethtool per-queue statistics +- wifi: mwifiex: fix uninitialized firmware_stat +- wifi: mwifiex: configure BSSID consistently when starting AP +- wifi: mwifiex: add extra delay for firmware ready +- wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors +- wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code +- wifi: mt76: fix broken precal loading from MTD for mt7915 +- iommu/arm-smmu-qcom: Add missing GMU entry to match table +- bpf: Fix re-attachment branch in bpf_tracing_prog_attach +- Bluetooth: Fix atomicity violation in {min,max}_key_size_set +- md/raid1: Use blk_opf_t for read and write operations +- pwm: Fix out-of-bounds access in of_pwm_single_xlate() +- pwm: jz4740: Don't use dev_err_probe() in .request() +- netfilter: nf_tables: check if catch-all set element is active in next generation +- block: Fix iterating over an empty bio with bio_for_each_folio_all +- block: Remove special-casing of compound pages +- drm/amd: Enable PCIe PME from D3 +- scsi: mpi3mr: Block PEL Enable Command on Controller Reset and Unrecoverable State +- scsi: mpi3mr: Clean up block devices post controller reset +- scsi: mpi3mr: Refresh sdev queue depth after controller reset +- scsi: target: core: add missing file_{start,end}_write() +- scsi: ufs: core: Simplify power management during async scan +- fbdev: flush deferred IO before closing +- fbdev: flush deferred work in fb_deferred_io_fsync() +- fbdev/acornfb: Fix name of fb_ops initializer macro +- io_uring: ensure local task_work is run on wait timeout +- io_uring/rw: ensure io->bytes_done is always initialized +- io_uring: don't check iopoll if request completes +- LoongArch: Fix and simplify fcsr initialization on execve() +- ceph: select FS_ENCRYPTION_ALGS if FS_ENCRYPTION +- ksmbd: only v2 leases handle the directory +- ksmbd: fix UAF issue in ksmbd_tcp_new_connection() +- ksmbd: validate mech token in session setup +- ALSA: hda/realtek: Enable headset mic on Lenovo M70 Gen5 +- ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on HP ZBook +- ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx +- ALSA: oxygen: Fix right channel of capture volume mixer +- serial: omap: do not override settings for RS485 support +- serial: 8250_exar: Set missing rs485_supported flag +- serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock +- serial: core, imx: do not set RS485 enabled if it is not supported +- serial: 8250_bcm2835aux: Restore clock error handling +- serial: core: make sure RS485 cannot be enabled when it is not supported +- serial: core: fix sanitizing check for RTS settings +- dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp-phy: fix path to header +- usb: mon: Fix atomicity violation in mon_bin_vma_fault +- usb: typec: class: fix typec_altmode_put_partner to put plugs +- Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs" +- usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled +- usb: cdns3: fix iso transfer error when mult is not zero +- usb: cdns3: fix uvc failure work since sg support enabled +- usb: chipidea: wait controller resume finished for wakeup irq +- Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only" +- Revert "usb: dwc3: Soft reset phy on probe for host" +- usb: dwc3: gadget: Queue PM runtime idle on disconnect event +- usb: dwc3: gadget: Handle EP0 request dequeuing properly +- usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart +- usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host() +- Revert "usb: gadget: f_uvc: change endpoint allocation in uvc_function_bind()" +- tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug +- powerpc/64s: Increase default stack size to 32KB +- clocksource/drivers/timer-ti-dm: Fix make W=n kerneldoc warnings +- binder: fix race between mmput() and do_exit() +- xen-netback: don't produce zero-size SKB frags +- Revert "drm/amdkfd: Relocate TBA/TMA to opposite side of VM hole" +- rust: Ignore preserve-most functions +- Input: atkbd - use ab83 as id when skipping the getid command +- mips/smp: Call rcutree_report_cpu_starting() earlier +- binder: fix unused alloc->free_async_space +- binder: fix async space check for 0-sized buffers +- keys, dns: Fix size check of V1 server-list header +- selftests/bpf: Add assert for user stacks in test_task_stack +- Revert "kernfs: convert kernfs_idr_lock to an irq safe raw spinlock" +- kernfs: convert kernfs_idr_lock to an irq safe raw spinlock +- class: fix use-after-free in class_register() +- of: unittest: Fix of_count_phandle_with_args() expected value message +- fbdev: imxfb: fix left margin setting +- of: Fix double free in of_parse_phandle_with_args_map +- ksmbd: validate the zero field of packet header +- kselftest/alsa - conf: Stringify the printed errno in sysfs_get() +- kselftest/alsa - mixer-test: Fix the print format specifier warning +- kselftest/alsa - mixer-test: fix the number of parameters to ksft_exit_fail_msg() +- drm/amd/display: avoid stringop-overflow warnings for dp_decide_lane_settings() +- drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init +- drm/amdkfd: Confirm list is non-empty before utilizing list_first_entry in kfd_topology.c +- IB/iser: Prevent invalidating wrong MR +- gpio: sysfs: drop the mention of gpiochip_find() from sysfs code +- gpiolib: provide gpio_device_find() +- gpiolib: make gpio_device_get() and gpio_device_put() public +- drm/amdkfd: Fix type of 'dbg_flags' in 'struct kfd_process' +- mmc: sdhci_omap: Fix TI SoC dependencies +- mmc: sdhci_am654: Fix TI SoC dependencies +- ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put() +- ALSA: scarlett2: Add missing error checks to *_ctl_get() +- ALSA: scarlett2: Allow passing any output to line_out_remap() +- ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config() +- ALSA: scarlett2: Add missing error check to scarlett2_config_save() +- ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[] +- pwm: stm32: Fix enable count for clk in .probe() +- pwm: stm32: Use hweight32 in stm32_pwm_detect_channels +- clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw +- clk: qcom: dispcc-sm8550: Update disp PLL settings +- clk: qcom: gcc-sm8550: Mark RCGs shared where applicable +- clk: qcom: gcc-sm8550: use collapse-voting for PCIe GDSCs +- clk: qcom: gcc-sm8550: Mark the PCIe GDSCs votable +- clk: qcom: gcc-sm8550: Add the missing RETAIN_FF_ENABLE GDSC flag +- accel/habanalabs: fix information leak in sec_attest_info() +- drm/mediatek: dp: Add phy_mtk_dp module as pre-dependency +- ASoC: tas2781: add support for FW version 0x0503 +- ASoC: amd: vangogh: Drop conflicting ACPI-based probing +- clk: si5341: fix an error code problem in si5341_output_clk_set_rate +- clk: rs9: Fix DIF OEn bit placement on 9FGV0241 +- watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused +- watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling +- watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO +- watchdog: set cdev owner before adding +- drivers: clk: zynqmp: update divider round rate logic +- drivers: clk: zynqmp: calculate closest mux rate +- clk: sp7021: fix return value check in sp7021_clk_probe() +- clk: qcom: videocc-sm8150: Add missing PLL config property +- clk: qcom: videocc-sm8150: Update the videocc resets +- dt-bindings: clock: Update the videocc resets for sm8150 +- f2fs: fix to check return value of f2fs_recover_xattr_data +- drm/amd/pm: fix a double-free in amdgpu_parse_extended_power_table +- gpu/drm/radeon: fix two memleaks in radeon_vm_init +- drivers/amd/pm: fix a use-after-free in kv_parse_power_table +- drm/amd/pm: fix a double-free in si_dpm_init +- drm/amdgpu/debugfs: fix error code when smc register accessors are NULL +- drm/mediatek: Fix underrun in VDO1 when switches off the layer +- drm/mediatek: Remove the redundant driver data for DPI +- drm/mediatek: Return error if MDP RDMA failed to enable the clock +- drm/msm/dpu: Drop enable and frame_count parameters from dpu_hw_setup_misr() +- drm/msm/dpu: Set input_sel bit for INTF +- clk: renesas: rzg2l: Check reset monitor registers +- clk: renesas: rzg2l-cpg: Reuse code in rzg2l_cpg_reset() +- media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe() +- media: dvbdev: drop refcount on error path in dvb_device_open() +- f2fs: fix to update iostat correctly in f2fs_filemap_fault() +- f2fs: fix to check compress file in f2fs_move_file_range() +- f2fs: fix to wait on block writeback for post_read case +- drm/panel: st7701: Fix AVCL calculation +- drm/msm/adreno: Fix A680 chip id +- media: rkisp1: Fix media device memory leak +- media: dt-bindings: media: rkisp1: Fix the port description for the parallel interface +- media: imx-mipi-csis: Drop extra clock enable at probe() +- media: imx-mipi-csis: Fix clock handling in remove() +- media: bttv: add back vbi hack +- media: bttv: start_streaming should return a proper error code +- clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config +- media: cx231xx: fix a memleak in cx231xx_init_isoc +- drm/bridge: tc358767: Fix return value on error case +- drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable +- drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table +- drm/radeon/dpm: fix a memleak in sumo_parse_power_table +- drm/msm/dpu: correct clk bit for WB2 block +- drm/panfrost: Ignore core_mask for poweroff and disable PWRTRANS irq +- ASoC: SOF: topology: Use partial match for disconnecting DAI link and DAI widget +- ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx->headset_codec_dev = NULL +- ASoC: Intel: glk_rt5682_max98357a: fix board id mismatch +- media: v4l: async: Fix duplicated list deletion +- drm/drv: propagate errors from drm_modeset_register_all() +- drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks +- drm/msm/dpu: Add missing safe_lut_tbl in sc8180x catalog +- drm/msm/mdp4: flush vblank event on disable +- ASoC: cs35l33: Fix GPIO name and drop legacy include +- drm/imx/lcdc: Fix double-free of driver data +- drm/tidss: Fix dss reset +- drm/tidss: Check for K2G in in dispc_softreset() +- drm/tidss: Return error value from from softreset +- drm/tidss: Move reset to the end of dispc_init() +- drm/radeon: check return value of radeon_ring_lock() +- drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() +- drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() +- drm/bridge: Fix typo in post_disable() description +- media: amphion: Fix VPU core alias name +- media: rkvdec: Hook the (TRY_)DECODER_CMD stateless ioctls +- media: verisilicon: Hook the (TRY_)DECODER_CMD stateless ioctls +- media: visl: Hook the (TRY_)DECODER_CMD stateless ioctls +- media: mtk-jpeg: Remove cancel worker in mtk_jpeg_remove to avoid the crash of multi-core JPEG devices +- media: pvrusb2: fix use after free on context disconnection +- drm/tilcdc: Fix irq free on unload +- drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function +- drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer +- drm/panel-elida-kd35t133: hold panel in reset for unprepare +- drm/panel: nv3051d: Hold panel in reset for unprepare +- RDMA/usnic: Silence uninitialized symbol smatch warnings +- drm/panfrost: Really power off GPU cores in panfrost_gpu_power_off() +- drm/dp_mst: Fix fractional DSC bpp handling +- Revert "drm/omapdrm: Annotate dma-fence critical section in commit path" +- Revert "drm/tidss: Annotate dma-fence critical section in commit path" +- ARM: davinci: always select CONFIG_CPU_ARM926T +- ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() +- rxrpc: Fix skbuff cleanup of call's recvmsg_queue and rx_oos_queue +- mlxbf_gige: Enable the GigE port in mlxbf_gige_open +- mlxbf_gige: Fix intermittent no ip issue +- net/sched: act_ct: fix skb leak and crash on ooo frags +- blk-cgroup: fix rcu lockdep warning in blkg_lookup() +- sctp: fix busy polling +- sctp: support MSG_ERRQUEUE flag in recvmsg() +- bpf: sockmap, fix proto update hook to avoid dup calls +- wifi: cfg80211: parse all ML elements in an ML probe response +- wifi: cfg80211: correct comment about MLD ID +- arm64: dts: rockchip: Fix led pinctrl of lubancat 1 +- null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS +- Bluetooth: btmtkuart: fix recv_buf() return value +- Bluetooth: btnxpuart: fix recv_buf() return value +- Bluetooth: Fix bogus check for re-auth no supported with non-ssp +- netfilter: nf_tables: validate chain type update if available +- netfilter: nf_tables: mark newset as dead on transaction abort +- wifi: iwlwifi: assign phy_ctxt before eSR activation +- wifi: iwlwifi: fix out of bound copy_from_user +- wifi: iwlwifi: mvm: send TX path flush in rfkill +- wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request +- wifi: rtlwifi: rtl8192se: using calculate_bit_shift() +- wifi: rtlwifi: rtl8192ee: using calculate_bit_shift() +- wifi: rtlwifi: rtl8192de: using calculate_bit_shift() +- wifi: rtlwifi: rtl8192ce: using calculate_bit_shift() +- wifi: rtlwifi: rtl8192cu: using calculate_bit_shift() +- wifi: rtlwifi: rtl8192c: using calculate_bit_shift() +- wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() +- wifi: rtlwifi: add calculate_bit_shift() +- bpf: Use c->unit_size to select target cache during free +- bpf: Use pcpu_alloc_size() in bpf_mem_free{_rcu}() +- bpf: Re-enable unit_size checking for global per-cpu allocator +- arm64: dts: qcom: sc8180x: Fix up PCIe nodes +- arm64: dts: qcom: sc8180x: switch PCIe QMP PHY to new style of bindings +- arm64: dts: qcom: sc8180x: Mark PCIe hosts cache-coherent +- arm64: dts: qcom: sm8550: Update idle state time requirements +- arm64: dts: qcom: sm8550: Separate out X3 idle state +- arm64: dts: qcom: ipq6018: fix clock rates for GCC_USB0_MOCK_UTMI_CLK +- arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent +- soc: qcom: llcc: Fix LLCC_TRP_ATTR2_CFGn offset +- arm64: dts: qcom: sm8150-hdk: fix SS USB regulators +- arm64: dts: qcom: sm8150: make dispcc cast minimal vote on MMCX +- arm64: dts: qcom: sm6375: Hook up MPM +- arm64: dts: qcom: sm6375: fix USB wakeup interrupt types +- soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration +- arm64: dts: qcom: acer-aspire1: Correct audio codec definition +- bpf: Limit the number of kprobes when attaching program to multiple kprobes +- bpf: Limit the number of uprobes when attaching program to multiple uprobes +- dma-mapping: clear dev->dma_mem to NULL after freeing it +- virtio/vsock: send credit update during setting SO_RCVLOWAT +- virtio/vsock: fix logic which reduces credit update messages +- ipmr: support IP_PKTINFO on cache report IGMP msg +- selftests/net: fix grep checking for fib_nexthop_multiprefix +- bpf: Fix a race condition between btf_put() and map_free() +- ARM: dts: stm32: don't mix SCMI and non-SCMI board compatibles +- scsi: hisi_sas: Correct the number of global debugfs registers +- scsi: hisi_sas: Rollback some operations if FLR failed +- scsi: hisi_sas: Check before using pointer variables +- scsi: hisi_sas: Replace with standard error code return value +- scsi: ufs: qcom: Fix the return value when platform_get_resource_byname() fails +- scsi: ufs: qcom: Fix the return value of ufs_qcom_ice_program_key() +- arm64: dts: imx8mm: Reduce GPU to nominal speed +- arm64: dts: renesas: white-hawk-cpu: Fix missing serial console pin control +- arm64: dts: xilinx: Apply overlays to base dtbs +- selftests/bpf: Relax time_tai test for equal timestamps in tai_forward +- wifi: iwlwifi: don't support triggered EHT CQI feedback +- wifi: mt76: mt7921: fix country count limitation for CLC +- arm64: dts: mediatek: mt8186: fix address warning for ADSP mailboxes +- arm64: dts: mediatek: mt8186: Fix alias prefix for ovl_2l0 +- arm64: dts: mediatek: mt8195: revise VDOSYS RDMA node name +- arm64: dts: mediatek: mt8183: correct MDP3 DMA-related nodes +- dt-bindings: media: mediatek: mdp3: correct RDMA and WROT node with generic names +- bpf: Fix accesses to uninit stack slots +- bpf: Guard stack limits against 32bit overflow +- arm64: dts: hisilicon: hikey970-pmic: fix regulator cells properties +- bpf: Fix verification of indirect var-off stack access +- wifi: mt76: mt7921s: fix workqueue problem causes STA association fail +- wifi: mt76: mt7915: also MT7981 is 3T3R but nss2 on 5 GHz band +- wifi: mt76: mt7915: fix EEPROM offset of TSSI flag on MT7981 +- wifi: mt76: mt7996: fix rate usage of inband discovery frames +- wifi: mt76: mt7996: fix the size of struct bss_rate_tlv +- wifi: mt76: mt7915: fallback to non-wed mode if platform_get_resource fails in mt7915_mmio_wed_init() +- wifi: mt76: fix typo in mt76_get_of_eeprom_from_nvmem function +- arm64: dts: qcom: sm8550: fix USB wakeup interrupt types +- arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types +- arm64: dts: qcom: sa8775p: fix USB wakeup interrupt types +- arm64: dts: qcom: sc7280: Mark Adreno SMMU as DMA coherent +- arm64: dts: qcom: sc7280: Fix up GPU SIDs +- arm64: dts: qcom: sm8350: Fix DMA0 address +- arm64: dts: qcom: sm6125: add interrupts to DWC3 USB controller +- arm64: dts: qcom: sdm845-db845c: correct LED panic indicator +- arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator +- arm64: dts: qcom: qrb2210-rb1: use USB host mode +- arm64: dts: qcom: qrb2210-rb1: Hook up USB3 +- scsi: fnic: Return error if vmalloc() failed +- bpf: fix check for attempt to corrupt spilled pointer +- selftests/net: specify the interface when do arping +- bpf: Defer the free of inner map when necessary +- bpf: Add map and need_defer parameters to .map_fd_put_ptr() +- arm64: dts: qcom: sm6350: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sc8280xp: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sa8775p: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sm8250: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sm8150: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sdm845: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sc7280: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sc7280: Mark some nodes as 'reserved' +- arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sm8550: correct TX Soundwire clock +- arm64: dts: qcom: sm8450: correct TX Soundwire clock +- arm64: dts: qcom: sc8180x-primus: Fix HALL_INT polarity +- dt-bindings: arm: qcom: Fix html link +- ARM: dts: qcom: sdx65: correct SPMI node name +- ARM: dts: qcom: sdx65: correct PCIe EP phy-names +- bpf: enforce precision of R0 on callback return +- selftests/bpf: Fix erroneous bitmask operation +- wifi: rtw88: sdio: Honor the host max_req_size in the RX path +- arm64: dts: ti: iot2050: Re-add aliases +- arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type +- arm64: dts: ti: k3-am62a-main: Fix GPIO pin count in DT nodes +- wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior +- scsi: bfa: Use the proper data type for BLIST flags +- firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() +- net/ncsi: Fix netlink major/minor version numbers +- ARM: dts: qcom: apq8064: correct XOADC register address +- wifi: libertas: stop selecting wext +- wifi: ath11k: Defer on rproc_get failure +- bpf: Add crosstask check to __bpf_get_stack +- bpf, lpm: Fix check prefixlen before walking trie +- wifi: rtw88: fix RX filter in FIF_ALLMULTI flag +- wifi: plfxlc: check for allocation failure in plfxlc_usb_wreq_async() +- ARM: dts: qcom: msm8226: provide dsi phy clocks to mmcc +- arm64: dts: qcom: sc8280xp-x13s: add missing camera LED pin config +- arm64: dts: qcom: sc8280xp-x13s: Use the correct DP PHY compatible +- arm64: dts: qcom: qrb4210-rb2: don't force usb peripheral mode +- asm-generic: Fix 32 bit __generic_cmpxchg_local +- pNFS: Fix the pnfs block driver's calculation of layoutget size +- SUNRPC: fix _xprt_switch_find_current_entry logic +- NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT +- NFS: Use parent's objective cred in nfs_access_login_time() +- blocklayoutdriver: Fix reference leak of pnfs_device_node +- csky: fix arch_jump_label_transform_static override +- crypto: scomp - fix req->dst buffer overflow +- crypto: sahara - do not resize req->src when doing hash operations +- crypto: sahara - fix processing hash requests with req->nbytes < sg->length +- crypto: sahara - improve error handling in sahara_sha_process() +- crypto: sahara - fix wait_for_completion_timeout() error handling +- crypto: sahara - fix ahash reqsize +- crypto: sahara - handle zero-length aes requests +- crypto: sahara - avoid skcipher fallback code duplication +- crypto: virtio - Wait for tasklet to complete on device remove +- dlm: fix format seq ops type 4 +- gfs2: fix kernel BUG in gfs2_quota_cleanup +- fs: indicate request originates from old mount API +- erofs: fix memory leak on short-lived bounced pages +- pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() +- crypto: sahara - fix error handling in sahara_hw_descriptor_create() +- crypto: sahara - fix processing requests with cryptlen < sg->length +- crypto: sahara - fix ahash selftest failure +- crypto: sahara - fix cbc selftest failure +- crypto: sahara - remove FLAGS_NEW_KEY logic +- crypto: safexcel - Add error handling for dma_map_sg() calls +- crypto: af_alg - Disallow multiple in-flight AIO requests +- crypto: ccp - fix memleak in ccp_init_dm_workarea +- crypto: sa2ul - Return crypto_aead_setkey to transfer the error +- crypto: virtio - Handle dataq logic with tasklet +- crypto: jh7110 - Correct deferred probe return +- crypto: rsa - add a check for allocation failure +- selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket +- drivers/thermal/loongson2_thermal: Fix incorrect PTR_ERR() judgment +- cpuidle: haltpoll: Do not enable interrupts when entering idle +- kunit: debugfs: Fix unchecked dereference in debugfs_print_results() +- thermal: core: Fix NULL pointer dereference in zone registration error path +- ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error +- ACPI: LPSS: Fix the fractional clock divider flags +- spi: sh-msiof: Enforce fixed DTDL for R-Car H3 +- efivarfs: Free s_fs_info on unmount +- calipso: fix memory leak in netlbl_calipso_add_pass() +- cpufreq: scmi: process the result of devm_of_clk_add_hw_provider() +- platform/x86/intel/vsec: Fix xa_alloc memory leak +- spi: cadence-quadspi: add missing clk_disable_unprepare() in cqspi_probe() +- KEYS: encrypted: Add check for strsep +- ACPI: LPIT: Avoid u32 multiplication overflow +- ACPI: video: check for error while searching for backlight device parent +- mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response +- spi: spi-zynqmp-gqspi: fix driver kconfig dependencies +- perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() +- sched/fair: Update min_vruntime for reweight_entity() correctly +- powerpc/imc-pmu: Add a null pointer check in update_events_in_group() +- powerpc/powernv: Add a null pointer check in opal_powercap_init() +- powerpc/powernv: Add a null pointer check in opal_event_init() +- powerpc/powernv: Add a null pointer check to scom_debug_init_one() +- powerpc/rtas: Avoid warning on invalid token argument to sys_rtas() +- powerpc/hv-gpci: Add return value check in affinity_domain_via_partition_show function +- selftests/powerpc: Fix error handling in FPU/VMX preemption tests +- KVM: PPC: Book3S HV: Handle pending exceptions on guest entry with MSR_EE +- KVM: PPC: Book3S HV: Introduce low level MSR accessor +- KVM: PPC: Book3S HV: Use accessors for VCPU registers +- drivers/perf: hisi: Fix some event id for HiSilicon UC pmu +- perf/arm-cmn: Fix HN-F class_occup_id events +- powerpc/pseries/memhp: Fix access beyond end of drmem array +- powerpc/44x: select I2C for CURRITUCK +- x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram +- powerpc: add crtsavres.o to always-y instead of extra-y +- EDAC/thunderx: Fix possible out-of-bounds string access +- x86/mce/inject: Clear test status value +- x86/lib: Fix overflow when counting digits +- mm/memory_hotplug: fix memmap_on_memory sysfs value retrieval +- scripts/decode_stacktrace.sh: optionally use LLVM utilities +- coresight: etm4x: Fix width of CCITMIN field +- PCI: Add ACS quirk for more Zhaoxin Root Ports +- leds: ledtrig-tty: Free allocated ttyname buffer on deactivate +- parport: parport_serial: Add Brainboxes device IDs and geometry +- parport: parport_serial: Add Brainboxes BAR details +- uio: Fix use-after-free in uio_open +- binder: fix comment on binder_alloc_new_buf() return value +- binder: fix trivial typo of binder_free_buf_locked() +- binder: fix use-after-free in shinker's callback +- binder: use EPOLLERR from eventpoll.h +- ksmbd: free ppace array on error in parse_dacl +- ksmbd: don't allow O_TRUNC open on read-only share +- drm/amd/display: Pass pwrseq inst for backlight and ABM +- ASoC: SOF: Intel: hda-codec: Delay the codec device registration +- bus: moxtet: Add spi device table +- bus: moxtet: Mark the irq as shared +- ACPI: resource: Add another DMI match for the TongFang GMxXGxx +- ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 13-ay0xxx +- drm/crtc: fix uninitialized variable use +- x86/csum: clean up `csum_partial' further +- x86/csum: Remove unnecessary odd handling +- ARM: sun9i: smp: fix return code check of of_property_match_string +- connector: Fix proc_event_num_listeners count not cleared +- net: qrtr: ns: Return 0 if server port is not present +- nfc: Do not send datagram if socket state isn't LLCP_BOUND +- virtio_blk: fix snprintf truncation compiler warning +- ida: Fix crash in ida_free when the bitmap is empty +- posix-timers: Get rid of [COMPAT_]SYS_NI() uses +- pinctrl: cy8c95x0: Fix get_pincfg +- pinctrl: cy8c95x0: Fix regression +- pinctrl: cy8c95x0: Fix typo +- drm/amd/display: get dprefclk ss info from integration info table +- drm/amd/display: Add case for dcn35 to support usb4 dmub hpd event +- drm/amdkfd: svm range always mapped flag not working on APU +- i2c: rk3x: fix potential spinlock recursion on poll +- smb: client: fix potential OOB in smb2_dump_detail() +- HID: nintendo: Prevent divide-by-zero on code +- dm audit: fix Kconfig so DM_AUDIT depends on BLK_DEV_DM +- ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models +- ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk +- ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346 +- platform/x86/amd/pmc: Disable keyboard wakeup on AMD Framework 13 +- platform/x86/amd/pmc: Move keyboard wakeup disablement detection to pmc-quirks +- platform/x86/amd/pmc: Only run IRQ1 firmware version check on Cezanne +- platform/x86/amd/pmc: Move platform defines to header +- platform/x86: thinkpad_acpi: fix for incorrect fan reporting on some ThinkPad systems +- HID: nintendo: fix initializer element is not constant error +- kselftest: alsa: fixed a print formatting warning +- driver core: Add a guard() definition for the device_lock() +- Input: xpad - add Razer Wolverine V2 support +- wifi: iwlwifi: pcie: avoid a NULL pointer dereference +- ARC: fix smatch warning +- ARC: fix spare error +- s390/scm: fix virtual vs physical address confusion +- ASoC: cs35l45: Prevents spinning during runtime suspend +- ASoC: cs35l45: Prevent IRQ handling when suspending/resuming +- ASoC: cs35l45: Use modern pm_ops +- pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend +- Input: i8042 - add nomux quirk for Acer P459-G2-M +- Input: atkbd - skip ATKBD_CMD_GETID in translated mode +- reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning +- Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1 +- ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI +- tracing: Fix uaf issue when open the hist or hist_debug file +- MIPS: dts: loongson: drop incorrect dwmac fallback compatible +- stmmac: dwmac-loongson: drop useless check for compatible fallback +- tracing: Add size check when printing trace_marker output +- tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing +- jbd2: fix soft lockup in journal_finish_inode_data_buffers() +- efi/loongarch: Use load address to calculate kernel entry address +- platform/x86: intel-vbtn: Fix missing tablet-mode-switch events +- neighbour: Don't let neigh_forced_gc() disable preemption for long +- drm/crtc: Fix uninit-value bug in drm_mode_setcrtc +- jbd2: increase the journal IO's priority +- jbd2: correct the printing of write_flags in jbd2_write_superblock() +- soundwire: intel_ace2x: fix AC timing setting for ACE2.x +- clk: rockchip: rk3128: Fix HCLK_OTG gate register +- clk: rockchip: rk3568: Add PLL rate for 292.5MHz +- LoongArch: Preserve syscall nr across execve() +- LoongArch: Set unwind stack type to unknown rather than set error flag +- LoongArch: Apply dynamic relocations for LLD +- hwmon: (corsair-psu) Fix probe when built-in +- ALSA: pcmtest: stop timer before buffer is released +- drm/exynos: fix a wrong error checking +- drm/exynos: fix a potential error pointer dereference +- drm/amdgpu: Add NULL checks for function pointers +- drm/amd/display: Add monitor patch for specific eDP +- arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru +- nvme: fix deadlock between reset and scan +- nvme: prevent potential spectre v1 gadget +- nvme-ioctl: move capable() admin check to the end +- nvme: ensure reset state check ordering +- nvme: introduce helper function to get ctrl state +- ASoC: da7219: Support low DC impedance headset +- net/tg3: fix race condition in tg3_reset_task() +- pds_vdpa: set features order +- pds_vdpa: clear config callback when status goes to 0 +- pds_vdpa: fix up format-truncation complaint +- ASoC: SOF: ipc4-topology: Correct data structures for the GAIN module +- ASoC: SOF: ipc4-topology: Correct data structures for the SRC module +- ASoC: hdac_hda: Conditionally register dais for HDMI and Analog +- ASoC: amd: yc: Add DMI entry to support System76 Pangolin 13 +- nouveau/tu102: flush all pdbs on vmm flush +- ASoC: SOF: sof-audio: Modify logic for enabling/disabling topology cores +- ASoC: SOF: ipc4-topology: Add core_mask in struct snd_sof_pipeline +- ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not available +- ASoC: fsl_xcvr: refine the requested phy clock frequency +- ASoC: rt5650: add mutex to avoid the jack detection failure +- ASoC: fsl_xcvr: Enable 2 * TX bit clock for spdif only case +- ASoC: cs43130: Fix incorrect frame delay configuration +- ASoC: cs43130: Fix the position of const qualifier +- ASoC: Intel: Skylake: mem leak in skl register function +- ASoC: SOF: topology: Fix mem leak in sof_dai_load() +- ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16 +- ASoC: Intel: Skylake: Fix mem leak in few functions +- arm64: dts: rockchip: fix rk356x pcie msg interrupt name +- ASoC: wm8974: Correct boost mixer inputs +- ASoC: amd: yc: Add HP 255 G10 into quirk table +- nvme-core: check for too small lba shift +- blk-mq: don't count completed flush data request as inflight in case of quiesce +- smb: client, common: fix fortify warnings +- drm/amdgpu: Use another offset for GC 9.4.3 remap +- drm/amdkfd: Free gang_ctx_bo and wptr_bo in pqm_uninit +- drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer +- drm/amd/display: update dcn315 lpddr pstate latency +- drm/amdkfd: Use common function for IP version check +- drm/amdgpu: Do not issue gpu reset from nbio v7_9 bif interrupt +- block: warn once for each partition in bio_check_ro() +- io_uring: use fget/fput consistently +- nvme-core: fix a memory leak in nvme_ns_info_from_identify() +- ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps format +- debugfs: fix automount d_fsdata usage +- wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap +- wifi: avoid offset calculation on NULL pointer +- wifi: cfg80211: lock wiphy mutex for rfkill poll +- mptcp: fix uninit-value in mptcp_incoming_options +- ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro +- pinctrl: lochnagar: Don't build on MIPS +- pinctrl: s32cc: Avoid possible string truncation +- nfsd: drop the nfsd_put helper +- media: qcom: camss: Comment CSID dt_id field +- cxl/memdev: Hold region_rwsem during inject and clear poison ops +- cxl/hdm: Fix a benign lockdep splat +- cxl: Add cxl_num_decoders_committed() usage to cxl_test +- mmc: sdhci-sprd: Fix eMMC init failure after hw reset +- mmc: core: Cancel delayed work before releasing host +- mmc: rpmb: fixes pause retune on all RPMB partitions. +- mmc: meson-mx-sdhc: Fix initialization frozen issue +- drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP displays without PSR +- drm/amd/display: add nv12 bounding box +- drm/amdgpu: skip gpu_info fw loading on navi12 +- mm: fix unmap_mapping_range high bits shift bug +- i2c: core: Fix atomic xfer check for non-preempt config +- x86/kprobes: fix incorrect return address calculation in kprobe_emulate_call_indirect +- firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards +- mm/mglru: skip special VMAs in lru_gen_look_around() +- net: constify sk_dst_get() and __sk_dst_get() argument +- cxl/pmu: Ensure put_device on pmu devices +- net: prevent mss overflow in skb_segment() +- powerpc/pseries/vas: Migration suspend waits for no in-progress open windows +- RISCV: KVM: update external interrupt atomically for IMSIC swfile +- dmaengine: fsl-edma: fix wrong pointer check in fsl_edma3_attach_pd() +- dmaengine: idxd: Protect int_handle field in hw descriptor +- drm/amd/display: Increase frame warning limit with KASAN or KCSAN in dml +- kernel/resource: Increment by align value in get_free_mem_region() +- cxl/core: Always hold region_rwsem while reading poison lists +- cxl: Add cxl_decoders_committed() helper +- drm/amd/display: Increase num voltage states to 40 +- drm/i915: Call intel_pre_plane_updates() also for pipes getting enabled +- clk: rockchip: rk3128: Fix SCLK_SDMMC's clock name +- clk: rockchip: rk3128: Fix aclk_peri_src's parent +- phy: sunplus: return negative error code in sp_usb_phy_probe +- phy: mediatek: mipi: mt8183: fix minimal supported frequency +- iio: imu: adis16475: use bit numbers in assign_bit() +- dmaengine: fsl-edma: Add judgment on enabling round robin arbitration +- dmaengine: fsl-edma: Do not suspend and resume the masked dma channel when the system is sleeping +- dmaengine: ti: k3-psil-am62a: Fix SPI PDMA data +- dmaengine: ti: k3-psil-am62: Fix SPI PDMA data +- phy: ti: gmii-sel: Fix register offset when parent is not a syscon node +- KVM: s390: vsie: fix wrong VIR 37 when MSO is used +- riscv: don't probe unaligned access speed if already done +- rcu/tasks-trace: Handle new PF_IDLE semantics +- rcu/tasks: Handle new PF_IDLE semantics +- rcu: Introduce rcu_cpu_online() +- rcu: Break rcu_node_0 --> &rq->__lock order +- ACPI: thermal: Fix acpi_thermal_unregister_thermal_zone() cleanup +- RDMA/mlx5: Fix mkey cache WQ flush +- clk: si521xx: Increase stack based print buffer size in probe +- vfio/mtty: Overhaul mtty interrupt handling +- crypto: qat - fix double free during reset +- crypto: xts - use 'spawn' for underlying single-block cipher +- bpftool: Align output skeleton ELF code +- bpftool: Fix -Wcast-qual warning +- tcp: derive delack_max from rto_min +- media: qcom: camss: Fix genpd cleanup +- media: qcom: camss: Fix V4L2 async notifier error path +- xsk: add multi-buffer support for sockets sharing umem +- mm/memory-failure: pass the folio and the page to collect_procs() +- mm: convert DAX lock/unlock page to lock/unlock folio +- net: Implement missing SO_TIMESTAMPING_NEW cmsg support +- bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters() +- net: ravb: Wait for operating mode to be applied +- asix: Add check for usbnet_get_endpoints +- octeontx2-af: Re-enable MAC TX in otx2_stop processing +- octeontx2-af: Always configure NIX TX link credits based on max frame size +- net/smc: fix invalid link access in dumping SMC-R connections +- net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues +- virtio_net: fix missing dma unmap for resize +- virtio_net: avoid data-races on dev->stats fields +- apparmor: Fix move_mount mediation by detecting if source is detached +- igc: Fix hicredit calculation +- i40e: Restore VF MSI-X state during PCI reset +- ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux +- ASoC: meson: g12a-toacodec: Fix event generation +- ASoC: meson: g12a-tohdmitx: Validate written enum values +- ASoC: meson: g12a-toacodec: Validate written enum values +- i40e: fix use-after-free in i40e_aqc_add_filters() +- net: Save and restore msg_namelen in sock_sendmsg +- netfilter: nft_immediate: drop chain reference counter on error +- netfilter: nf_nat: fix action not being set for all ct states +- net: bcmgenet: Fix FCS generation for fragmented skbuffs +- sfc: fix a double-free bug in efx_probe_filters +- ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init +- selftests: bonding: do not set port down when adding to bond +- net: Implement missing getsockopt(SO_TIMESTAMPING_NEW) +- r8169: Fix PCI error on system resume +- net: sched: em_text: fix possible memory leak in em_text_destroy() +- mlxbf_gige: fix receive packet race condition +- ASoC: mediatek: mt8186: fix AUD_PAD_TOP register and offset +- ASoC: fsl_rpmsg: Fix error handler with pm_runtime_enable +- igc: Check VLAN EtherType mask +- igc: Check VLAN TCI mask +- igc: Report VLAN EtherType matching back to user +- i40e: Fix filter input checks to prevent config with invalid values +- ice: Shut down VSI with "link-down-on-close" enabled +- ice: Fix link_down_on_close message +- drm/i915/perf: Update handling of MMIO triggered reports +- drm/i915/dp: Fix passing the correct DPCD_REV for drm_dp_set_phy_test_pattern +- octeontx2-af: Fix marking couple of structure as __packed +- nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local +- netfilter: nf_tables: set transport offset from mac header for netdev/egress +- drm/bridge: ps8640: Fix size mismatch warning w/ len +- drm/bridge: ti-sn65dsi86: Never store more than msg->size bytes in AUX xfer +- drm/bridge: parade-ps8640: Never store more than msg->size bytes in AUX xfer +- wifi: iwlwifi: pcie: don't synchronize IRQs from IRQ +- accel/qaic: Implement quirk for SOC_HW_VERSION +- accel/qaic: Fix GEM import path code +- KVM: x86/pmu: fix masking logic for MSR_CORE_PERF_GLOBAL_CTRL +- cifs: do not depend on release_iface for maintaining iface_list +- cifs: cifs_chan_is_iface_active should be called with chan_lock held +- drm/mgag200: Fix gamma lut not initialized for G200ER, G200EV, G200SE +- Revert "PCI/ASPM: Remove pcie_aspm_pm_state_change()" +- mptcp: prevent tcp diag from closing listener subflows +- drm/amd/display: pbn_div need be updated for hotplug event +- ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP ProBook 440 G6 +- ALSA: hda/realtek: fix mute/micmute LEDs for a HP ZBook +- ALSA: hda/realtek: enable SND_PCI_QUIRK for hp pavilion 14-ec1xxx series +- ALSA: hda/tas2781: remove sound controls in unbind +- ALSA: hda/tas2781: move set_drv_data outside tasdevice_init +- ALSA: hda/tas2781: do not use regcache +- keys, dns: Fix missing size check of V1 server-list header +- Revert "platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe" +- netfilter: nf_tables: skip set commit for deleted/destroyed sets +- wifi: nl80211: fix deadlock in nl80211_set_cqm_rssi (6.6.x) +- wifi: cfg80211: fix CQM for non-range use +- tracing: Fix blocked reader of snapshot buffer +- ftrace: Fix modification of direct_function hash while in use +- ring-buffer: Fix wake ups when buffer_percent is set to 100 +- Revert "nvme-fc: fix race between error recovery and creating association" +- mm/memory-failure: check the mapcount of the precise page +- mm/memory-failure: cast index to loff_t before shifting it +- mm: migrate high-order folios in swap cache correctly +- mm/filemap: avoid buffered read/write race to read inconsistent data +- selftests: secretmem: floor the memory size to the multiple of page_size +- maple_tree: do not preallocate nodes for slot stores +- platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe +- platform/x86/intel/pmc: Move GBE LTR ignore to suspend callback +- platform/x86/intel/pmc: Allow reenabling LTRs +- platform/x86/intel/pmc: Add suspend callback +- block: renumber QUEUE_FLAG_HW_WC +- mptcp: fix inconsistent state on fastopen race +- mptcp: fix possible NULL pointer dereference on close +- mptcp: refactor sndbuf auto-tuning +- linux/export: Ensure natural alignment of kcrctab array +- linux/export: Fix alignment for 64-bit ksymtab entries +- kexec: select CRYPTO from KEXEC_FILE instead of depending on it +- kexec: fix KEXEC_FILE dependencies +- virtio_ring: fix syncs DMA memory with different direction +- fs: cifs: Fix atime update check +- client: convert to new timestamp accessors +- fs: new accessor methods for atime and mtime +- ksmbd: avoid duplicate opinfo_put() call on error of smb21_lease_break_ack() +- ksmbd: lazy v2 lease break on smb2_write() +- ksmbd: send v2 lease break notification for directory +- ksmbd: downgrade RWH lease caching state to RH for directory +- ksmbd: set v2 lease capability +- ksmbd: set epoch in create context v2 lease +- ksmbd: don't update ->op_state as OPLOCK_STATE_NONE on error +- ksmbd: move setting SMB2_FLAGS_ASYNC_COMMAND and AsyncId +- ksmbd: release interim response after sending status pending response +- ksmbd: move oplock handling after unlock parent dir +- ksmbd: separately allocate ci per dentry +- ksmbd: prevent memory leak on error return +- ksmbd: fix kernel-doc comment of ksmbd_vfs_kern_path_locked() +- ksmbd: no need to wait for binded connection termination at logoff +- ksmbd: add support for surrogate pair conversion +- ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev() +- ksmbd: fix kernel-doc comment of ksmbd_vfs_setxattr() +- ksmbd: reorganize ksmbd_iov_pin_rsp() +- ksmbd: Remove unused field in ksmbd_user struct +- spi: cadence: revert "Add SPI transfer delays" +- x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully +- x86/alternatives: Disable interrupts and sync when optimizing NOPs in place +- x86/alternatives: Sync core before enabling interrupts +- KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy +- KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() +- KVM: arm64: vgic: Simplify kvm_vgic_destroy() +- thunderbolt: Fix memory leak in margining_port_remove() +- lib/vsprintf: Fix %pfwf when current node refcount == 0 +- gpio: dwapb: mask/unmask IRQ when disable/enale it +- bus: ti-sysc: Flush posted write only after srst_udelay +- pinctrl: starfive: jh7100: ignore disabled device tree nodes +- pinctrl: starfive: jh7110: ignore disabled device tree nodes +- selftests: mptcp: join: fix subflow_send_ack lookup +- dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() +- tracing / synthetic: Disable events after testing in synth_event_gen_test_init() +- scsi: core: Always send batch on reset or error handling command +- Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity" +- nvmem: brcm_nvram: store a copy of NVRAM content +- spi: atmel: Fix clock issue when using devices with different polarities +- spi: atmel: Prevent spi transfers from being killed +- spi: atmel: Do not cancel a transfer upon any signal +- ring-buffer: Fix slowpath of interrupted event +- ring-buffer: Remove useless update to write_stamp in rb_try_to_discard() +- ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg() +- 9p: prevent read overrun in protocol dump tracepoint +- drm/i915/dmc: Don't enable any pipe DMC events +- drm/i915: Reject async flips with bigjoiner +- smb: client: fix OOB in smbCalcSize() +- smb: client: fix OOB in SMB2_query_info_init() +- smb: client: fix potential OOB in cifs_dump_detail() +- smb: client: fix OOB in cifsd when receiving compounded resps +- nfsd: call nfsd_last_thread() before final nfsd_put() +- dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp +- net: stmmac: fix incorrect flag check in timestamp interrupt +- net: avoid build bug in skb extension length calculation +- net: ks8851: Fix TX stall caused by TX buffer overrun +- net: rfkill: gpio: set GPIO direction +- net: 9p: avoid freeing uninit memory in p9pdu_vreadf +- Input: soc_button_array - add mapping for airplane mode button +- net: usb: ax88179_178a: avoid failed operations when device is disconnected +- usb: fotg210-hcd: delete an incorrect bounds test +- usb: typec: ucsi: fix gpio-based orientation detection +- Bluetooth: Add more enc key size check +- Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE +- Bluetooth: L2CAP: Send reject on command corrupted request +- Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg +- Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent +- ASoC: tas2781: check the validity of prm_no/cfg_no +- ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA +- ALSA: hda/tas2781: select program 0, conf 0 by default +- USB: serial: option: add Quectel RM500Q R13 firmware support +- USB: serial: option: add Foxconn T99W265 with new baseline +- USB: serial: option: add Quectel EG912Y module support +- USB: serial: ftdi_sio: update Actisense PIDs constant names +- wifi: cfg80211: fix certs build to not depend on file order +- wifi: cfg80211: Add my certificate +- wifi: mt76: fix crash with WED rx support enabled +- usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3 +- ARM: dts: Fix occasional boot hang for am3 usb +- ALSA: usb-audio: Increase delay in MOTU M quirk +- iio: triggered-buffer: prevent possible freeing of wrong buffer +- iio: tmag5273: fix temperature offset +- iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma() +- iio: imu: adis16475: add spi_device_id table +- iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table +- iio: adc: imx93: add four channels for imx93 adc +- iio: kx022a: Fix acceleration value scaling +- scsi: ufs: core: Let the sq_lock protect sq_tail_slot access +- scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify() +- scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() +- iio: adc: meson: add separate config for axg SoC family +- Input: ipaq-micro-keys - add error handling for devm_kmemdup +- interconnect: qcom: sm8250: Enable sync_state +- iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw +- interconnect: Treat xlate() returning NULL node as an error +- nvme-pci: fix sleeping function called from interrupt context +- gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl() +- pinctrl: at91-pio4: use dedicated lock class for IRQ +- x86/xen: add CPU dependencies for 32-bit build +- i2c: aspeed: Handle the coalesced stop conditions with the start conditions. +- drm/amdgpu: re-create idle bo's PTE during VM state machine reset +- i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off() +- ASoC: fsl_sai: Fix channel swap issue on i.MX8MP +- ASoC: hdmi-codec: fix missing report for jack initial status +- drm/i915/mtl: Fix HDMI/DP PLL clock selection +- drm/i915/hwmon: Fix static analysis tool reported issues +- afs: Fix use-after-free due to get/remove race in volume tree +- afs: Fix overwriting of result of DNS query +- keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry +- net: check dev->gso_max_size in gso_features_check() +- net/ipv6: Revert remove expired routes with a separated list of routes +- net: ethernet: mtk_wed: fix possible NULL pointer dereference in mtk_wed_wo_queue_tx_clean() +- afs: Fix dynamic root lookup DNS check +- afs: Fix the dynamic root's d_delete to always delete unused dentries +- net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() +- net: mana: select PAGE_POOL +- ice: Fix PF with enabled XDP going no-carrier after reset +- ice: alter feature support check for SRIOV and LAG +- ice: stop trashing VF VSI aggregator node ID information +- net: phy: skip LED triggers on PHYs on SFP modules +- bnxt_en: do not map packet buffers twice +- Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis +- Bluetooth: hci_event: shut up a false-positive warning +- Bluetooth: Fix deadlock in vhci_send_frame +- Bluetooth: Fix not notifying when connection encryption changes +- net/rose: fix races in rose_kill_by_device() +- ethernet: atheros: fix a memleak in atl1e_setup_ring_resources +- net: sched: ife: fix potential use-after-free +- net: Return error from sk_stream_wait_connect() if sk_wait_event() fails +- octeontx2-pf: Fix graceful exit during PFC configuration failure +- net: mscc: ocelot: fix pMAC TX RMON stats for bucket 256-511 and above +- net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and above +- net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors +- net/mlx5e: Correct snprintf truncation handling for fw_version buffer +- net/mlx5e: Fix error codes in alloc_branch_attr() +- net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get() +- net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num +- net/mlx5: Fix fw tracer first block check +- net/mlx5e: XDP, Drop fragmented packets larger than MTU size +- net/mlx5e: Decrease num_block_tc when unblock tc offload +- net/mlx5e: Fix overrun reported by coverity +- net/mlx5e: fix a potential double-free in fs_udp_create_groups +- net/mlx5e: Fix a race in command alloc flow +- net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() +- Revert "net/mlx5e: fix double free of encap_header" +- Revert "net/mlx5e: fix double free of encap_header in update funcs" +- bpf: syzkaller found null ptr deref in unix_bpf proto add +- ice: fix theoretical out-of-bounds access in ethtool link modes +- wifi: mac80211: mesh_plink: fix matches_local logic +- wifi: mac80211: mesh: check element parsing succeeded +- wifi: mac80211: check defragmentation succeeded +- wifi: mac80211: don't re-add debugfs during reconfig +- wifi: mac80211: check if the existing link config remains unchanged +- wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock +- wifi: ieee80211: don't require protected vendor action frames +- SUNRPC: Revert 5f7fc5d69f6e92ec0b38774c387f5cf7812c5806 +- platform/x86/intel/pmc: Fix hang in pmc_core_send_ltr_ignore() +- s390/vx: fix save/restore of fpu kernel context +- reset: Fix crash when freeing non-existent optional resets +- ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init +- ARM: dts: dra7: Fix DRA7 L3 NoC node register size +- arm64: dts: allwinner: h616: update emac for Orange Pi Zero 3 +- spi: spi-imx: correctly configure burst length when using dma +- drm: Fix FD ownership check in drm_master_check_perm() +- drm: Update file owner during use +- drm/i915/edp: don't write to DP_LINK_BW_SET when using rate select +- drm/i915: Introduce crtc_state->enhanced_framing +- drm/i915: Fix FEC state dump +- drm/amd/display: fix hw rotated modes when PSR-SU is enabled +- btrfs: free qgroup pertrans reserve on transaction abort +- btrfs: qgroup: use qgroup_iterator in qgroup_convert_meta() +- btrfs: qgroup: iterate qgroups without memory allocation for qgroup_reserve() +- mm/damon/core: make damon_start() waits until kdamond_fn() starts +- mm/damon/core: use number of passed access sampling as a timer +- bpf: Fix prog_array_map_poke_run map poke update +- !5451 arm64: Delete macro in the scsnp feature +- arm64: Delete macro in the scsnp feature +- !5037 [OLK-6.6] Add support for Mucse Network Adapter(N500/N210) +- drivers: initial support for rnpgbe drivers from Mucse Technology +- !4782 [OLK-6.6] Add drivers support for Mucse Network Adapter rnpm (N10/N400) +- drivers: initial support for rnpm drivers from Mucse Technology +- !5340 CVE-2023-52593 +- wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() +- !5341 powerpc/lib: Validate size for vector operations +- powerpc/lib: Validate size for vector operations +- !5346 v2 s390/vfio-ap: always filter entire AP matrix +- s390/vfio-ap: always filter entire AP matrix +- !5248 mm: cachestat: fix folio read-after-free in cache walk +- mm: cachestat: fix folio read-after-free in cache walk +- !5212 [OLK-6.6] Support PSPCCP/NTBCCP identification for Hygon 2th and 3th CPU +- crypto: ccp: Add Hygon CSV support +- crypto: ccp: Fixup the capability of Hygon PSP during initialization +- !5318 Backport 6.6.8 LTS Patches +- RDMA/mlx5: Change the key being sent for MPV device affiliation +- x86/speculation, objtool: Use absolute relocations for annotations +- ring-buffer: Have rb_time_cmpxchg() set the msb counter too +- ring-buffer: Do not try to put back write_stamp +- ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs +- ring-buffer: Fix writing to the buffer with max_data_size +- ring-buffer: Have saved event hold the entire event +- ring-buffer: Do not update before stamp when switching sub-buffers +- tracing: Update snapshot buffer on resize if it is allocated +- ring-buffer: Fix memory leak of free page +- smb: client: fix OOB in smb2_query_reparse_point() +- smb: client: fix NULL deref in asn1_ber_decoder() +- smb: client: fix potential OOBs in smb2_parse_contexts() +- drm/i915: Fix remapped stride with CCS on ADL+ +- drm/i915: Fix intel_atomic_setup_scalers() plane_state handling +- drm/i915: Fix ADL+ tiled plane stride when the POT stride is smaller than the original +- drm/amd/display: Disable PSR-SU on Parade 0803 TCON again +- drm/amd/display: Restore guard against default backlight value < 1 nit +- drm/edid: also call add modes in EDID connector update fallback +- drm/amdgpu: fix tear down order in amdgpu_vm_pt_free +- btrfs: don't clear qgroup reserved bit in release_folio +- btrfs: fix qgroup_free_reserved_data int overflow +- btrfs: free qgroup reserve when ORDERED_IOERR is set +- kexec: drop dependency on ARCH_SUPPORTS_KEXEC from CRASH_DUMP +- mm/shmem: fix race in shmem_undo_range w/THP +- mm/mglru: reclaim offlined memcgs harder +- mm/mglru: respect min_ttl_ms with memcgs +- mm/mglru: try to stop at high watermarks +- mm/mglru: fix underprotected page cache +- dmaengine: fsl-edma: fix DMA channel leak in eDMAv4 +- dmaengine: stm32-dma: avoid bitfield overflow assertion +- drm/mediatek: Fix access violation in mtk_drm_crtc_dma_dev_get +- drm/amdgpu/sdma5.2: add begin/end_use ring callbacks +- team: Fix use-after-free when an option instance allocation fails +- arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify +- Revert "selftests: error out if kernel header files are not yet built" +- ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS +- soundwire: stream: fix NULL pointer dereference for multi_link +- cxl/hdm: Fix dpa translation locking +- btrfs: do not allow non subvolume root targets for snapshot +- perf: Fix perf_event_validate_size() lockdep splat +- HID: hid-asus: add const to read-only outgoing usb buffer +- arm64: add dependency between vmlinuz.efi and Image +- smb: client: set correct file type from NFS reparse points +- smb: client: introduce ->parse_reparse_point() +- smb: client: implement ->query_reparse_point() for SMB1 +- net: usb: qmi_wwan: claim interface 4 for ZTE MF290 +- eventfs: Do not allow NULL parent to eventfs_start_creating() +- asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation +- scripts/checkstack.pl: match all stack sizes for s390 +- nfc: virtual_ncidev: Add variable to check if ndev is running +- HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad +- HID: hid-asus: reset the backlight brightness level on resume +- HID: add ALWAYS_POLL quirk for Apple kb +- HID: glorious: fix Glorious Model I HID report +- HID: apple: add Jamesdonkey and A3R to non-apple keyboards list +- HID: mcp2221: Allow IO to start during probe +- HID: mcp2221: Set driver data before I2C adapter add +- platform/x86: intel_telemetry: Fix kernel doc descriptions +- LoongArch: Mark {dmw,tlb}_virt_to_page() exports as non-GPL +- LoongArch: Silence the boot warning about 'nokaslr' +- LoongArch: Record pc instead of offset in la_abs relocation +- LoongArch: Add dependency between vmlinuz.efi and vmlinux.efi +- selftests/bpf: fix bpf_loop_bench for new callback verification scheme +- nvme: catch errors from nvme_configure_metadata() +- nvme-auth: set explanation code for failure2 msgs +- bcache: avoid NULL checking to c->root in run_cache_set() +- bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() +- bcache: remove redundant assignment to variable cur_idx +- bcache: avoid oversize memory allocation by small stripe_size +- blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" +- rxrpc: Fix some minor issues with bundle tracing +- stmmac: dwmac-loongson: Add architecture dependency +- usb: aqc111: check packet for fixup for true limit +- x86/hyperv: Fix the detection of E820_TYPE_PRAM in a Gen2 VM +- selftests/mm: cow: print ksft header before printing anything else +- drm/i915: Use internal class when counting engine resets +- drm/i915/selftests: Fix engine reset count storage for multi-tile +- accel/ivpu/37xx: Fix interrupt_clear_with_0 WA initialization +- accel/ivpu: Print information about used workarounds +- drm/mediatek: Add spinlock for setting vblank event in atomic_begin +- drm/mediatek: fix kernel oops if no crtc is found +- PCI: vmd: Fix potential deadlock when enabling ASPM +- ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE +- PCI/ASPM: Add pci_enable_link_state_locked() +- PCI: loongson: Limit MRRS to 256 +- Revert "PCI: acpiphp: Reassign resources on bridge if necessary" +- ALSA: hda/tas2781: reset the amp before component_add +- ALSA: hda/tas2781: call cleanup functions only once +- ALSA: hda/tas2781: handle missing EFI calibration data +- ALSA: hda/tas2781: leave hda_component in usable state +- ALSA: hda/realtek: Apply mute LED quirk for HP15-db +- ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants +- ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB +- io_uring/cmd: fix breakage in SOCKET_URING_OP_SIOC* implementation +- fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() +- fuse: disable FOPEN_PARALLEL_DIRECT_WRITES with FUSE_DIRECT_IO_ALLOW_MMAP +- fuse: share lookup state between submount and its parent +- fuse: Rename DIRECT_IO_RELAX to DIRECT_IO_ALLOW_MMAP +- HID: Add quirk for Labtec/ODDOR/aikeec handbrake +- HID: i2c-hid: Add IDEA5002 to i2c_hid_acpi_blacklist[] +- net: atlantic: fix double free in ring reinit logic +- appletalk: Fix Use-After-Free in atalk_ioctl +- net: stmmac: Handle disabled MDIO busses from devicetree +- net: stmmac: dwmac-qcom-ethqos: Fix drops in 10M SGMII RX +- dpaa2-switch: do not ask for MDB, VLAN and FDB replay +- dpaa2-switch: fix size of the dma_unmap +- vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() +- sign-file: Fix incorrect return values check +- stmmac: dwmac-loongson: Make sure MDIO is initialized before use +- net: ena: Fix XDP redirection error +- net: ena: Fix DMA syncing in XDP path when SWIOTLB is on +- net: ena: Fix xdp drops handling due to multibuf packets +- net: ena: Destroy correct number of xdp queues upon failure +- net: Remove acked SYN flag from packet in the transmit queue correctly +- qed: Fix a potential use-after-free in qed_cxt_tables_alloc +- iavf: Fix iavf_shutdown to call iavf_remove instead iavf_close +- iavf: Handle ntuple on/off based on new state machines for flow director +- iavf: Introduce new state machines for flow director +- net/rose: Fix Use-After-Free in rose_ioctl +- atm: Fix Use-After-Free in do_vcc_ioctl +- octeontx2-af: Fix pause frame configuration +- octeontx2-af: Update RSS algorithm index +- octeontx2-pf: Fix promisc mcam entry action +- octeon_ep: explicitly test for firmware ready value +- net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table +- octeontx2-af: fix a use-after-free in rvu_nix_register_reporters +- net: fec: correct queue selection +- atm: solos-pci: Fix potential deadlock on &tx_queue_lock +- atm: solos-pci: Fix potential deadlock on &cli_queue_lock +- bnxt_en: Fix HWTSTAMP_FILTER_ALL packet timestamp logic +- bnxt_en: Fix wrong return value check in bnxt_close_nic() +- bnxt_en: Fix skb recycling logic in bnxt_deliver_skb() +- bnxt_en: Clear resource reservation during resume +- qca_spi: Fix reset behavior +- qca_debug: Fix ethtool -G iface tx behavior +- qca_debug: Prevent crash on TX ring changes +- net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX +- net/mlx5: Fix a NULL vs IS_ERR() check +- net/mlx5e: Check netdev pointer before checking its net ns +- net/mlx5: Nack sync reset request when HotPlug is enabled +- net/mlx5e: TC, Don't offload post action rule if not supported +- net/mlx5e: Fix possible deadlock on mlx5e_tx_timeout_work +- net/mlx5e: Disable IPsec offload support if not FW steering +- RDMA/mlx5: Send events from IB driver about device affiliation state +- net/mlx5e: Check the number of elements before walk TC rhashtable +- net/mlx5e: Reduce eswitch mode_lock protection context +- net/mlx5e: Tidy up IPsec NAT-T SA discovery +- net/mlx5e: Unify esw and normal IPsec status table creation/destruction +- net/mlx5e: Ensure that IPsec sequence packet number starts from 1 +- net/mlx5e: Honor user choice of IPsec replay window size +- HID: lenovo: Restrict detection of patched firmware only to USB cptkbd +- afs: Fix refcount underflow from error handling race +- efi/x86: Avoid physical KASLR on older Dell systems +- ksmbd: fix memory leak in smb2_lock() +- ext4: fix warning in ext4_dio_write_end_io() +- r8152: add vendor/device ID pair for ASUS USB-C2500 +- !5239 crypto: hisilicon support no-sva feature +- crypto: hisilicon/qm - register to UACCE subsystem in UACCE_MODE_NOIOMMU mode +- crypto: hisilicon/qm - get the type of iommu +- uacce: support UACCE_MODE_NOIOMMU mode +- !5256 net: hns3: some bugfix for the HNS3 ethernet driver +- net: hns3: add checking for vf id of mailbox +- net: hns3: fix port duplex configure error in IMP reset +- net: hns3: fix reset timeout under full functions and queues +- net: hns3: fix delete tc fail issue +- net: hns3: fix kernel crash when 1588 is received on HIP08 devices +- net: hns3: Disable SerDes serial loopback for HiLink H60 +- net: hns3: add new 200G link modes for hisilicon device +- net: hns3: fix wrong judgment condition issue +- !5250 f2fs: fix to tag gcing flag on page during block migration +- f2fs: fix to tag gcing flag on page during block migration +- !5249 btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned +- btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned +- !5244 ceph: fix deadlock or deadcode of misusing dget() +- ceph: fix deadlock or deadcode of misusing dget() +- !5180 RDMA/hns: Support hns RoCE Bonding +- RDMA/hns: Fix the concurrency error between bond and reset. +- RDMA/hns: Fix the device loss after unbinding RoCE bond resource slave +- RDMA/hns: Fix wild pointer error of RoCE bonding when rmmod hns3 +- RDMA/hns: Support reset recovery for RoCE bonding +- RDMA/hns: Add functions to obtain netdev and bus_num from an hr_dev +- RDMA/hns: Support dispatching IB event for RoCE bonding +- RDMA/hns: Set IB port state depending on upper device for RoCE bonding +- RDMA/hns: Support RoCE bonding + +* Thu Mar 14 2024 Zheng Zengkai <zhengzengkai@huawei.com> - 6.6.0-12.0.0.8 +- !5174 [OLK-6.6][sync from OLK-5.10] Introduce multiple LPI translation caches +- KVM:arm64:vgic update openEuler's config's to enable MULTI_LPI_TRANSLATE_CACHE +- KVM: arm64: vgic-its: Do not execute invalidate MSI-LPI translation cache on movi command +- KVM: arm64: vgic-its: Introduce multiple LPI translation caches +- !5208 Revert “Fix the header file location error and adjust the function and structure version.” +- Revert “Fix the header file location error and adjust the function and structure version.” +- !5199 v2 mTHP anon support +- uprobes: use pagesize-aligned virtual address when replacing pages +- selftests/mm/cow: add tests for anonymous multi-size THP +- selftests/mm/cow: generalize do_run_with_thp() helper +- selftests/mm/khugepaged: enlighten for multi-size THP +- selftests/mm: support multi-size THP interface in thp_settings +- selftests/mm: factor out thp settings management +- selftests/mm/kugepaged: restore thp settings at exit +- mm: thp: support allocation of anonymous multi-size THP +- mm: thp: introduce multi-size THP sysfs interface +- mm: non-pmd-mappable, large folios for folio_add_new_anon_rmap() +- mm: allow deferred splitting of arbitrary anon large folios +- mm/readahead: do not allow order-1 folio +- mm: more ptep_get() conversion +- mm/thp: fix "mm: thp: kill __transhuge_page_enabled()" +- memory: move exclusivity detection in do_wp_page() into wp_can_reuse_anon_folio() +- mm/rmap: convert page_move_anon_rmap() to folio_move_anon_rmap() +- mm/rmap: move SetPageAnonExclusive() out of page_move_anon_rmap() +- mm/rmap: pass folio to hugepage_add_anon_rmap() +- mm/rmap: simplify PageAnonExclusive sanity checks when adding anon rmap +- mm/rmap: warn on new PTE-mapped folios in page_add_anon_rmap() +- mm/rmap: move folio_test_anon() check out of __folio_set_anon() +- mm/rmap: move SetPageAnonExclusive out of __page_set_anon_rmap() +- mm/rmap: drop stale comment in page_add_anon_rmap and hugepage_add_anon_rmap() +- !4908 cgroup/cpuset: add exclusive and exclusive.effective for v2 +- cgroup/cpuset: Fix retval in update_cpumask() +- cgroup/cpuset: Fix a memory leak in update_exclusive_cpumask() +- cgroup/cpuset: Cleanup signedness issue in cpu_exclusive_check() +- cgroup/cpuset: Enable invalid to valid local partition transition +- cgroup/cpuset: Check partition conflict with housekeeping setup +- cgroup/cpuset: Introduce remote partition +- cgroup/cpuset: Add cpuset.cpus.exclusive for v2 +- cgroup/cpuset: Add cpuset.cpus.exclusive.effective for v2 +- !5159 【OLK-6.6】iommu: reserve KABI for struct iommu_ops +- [OLK-6.6] iommu:kabi reserver space for struct iommu_ops +- !5149 net: hns3: add support some customized exception handling interfaces +- net: hns3: add input parameters checking +- net: hns3: add extend interface support for read and write phy register +- net: hns3: add support set led +- net: hns3: add support set mac state +- net: hns3: add support detect port wire type +- net: hns3: add support PF provides customized interfaces to detect port faults. +- net: hns3: support set pfc pause trans time +- net: hns3: add support disable nic clock +- net: hns3: add support config and query serdes lane status +- net: hns3: add supports configure optical module enable +- net: hns3: add support query the presence of optical module +- net: hns3: add support modified tx timeout +- net: hns3: add support query port ext information +- net: hns3: add support configuring function-level interrupt affinity +- net: hns3: add support clear mac statistics +- net: hns3: add support to get/set 1d torus param +- net: hns3: add supports fast reporting of faulty nodes +- net: hns3: add supports pfc storm detection and suppression +- net: hns3: add support customized exception handling interfaces +- !4761 [OLK-6.6] backport 6.7 kernel signal patch +- riscv: signal: handle syscall restart before get_signal +- !5151 intel-sig: configs: enable TPMI related configs for OLK6.6 +- config: update Intel TPMI based driver configs to openeuler_defconfig for x86 +- !5150 intel-sig: configs: enable PMT related configs for OLK6.6 +- config: x86: Intel: enabled PMT SDSI TPMI configs +- !4427 【OLK-6.6】watchdog: Support watchdog_sdei coexist with existing watchdogs +- watchdog: Support watchdog_sdei coexist with existing watchdogs +- !4776 [OLK-6.6] kabi:reserve space for msi expansion +- [OLK-6.6] kabi:reserve space for msi expansion +- !5041 [OLK-6.6] support the AMD Zen5 Turin +- x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5 +- x86/CPU/AMD: Add X86_FEATURE_ZEN5 +- x86/CPU/AMD: Add X86_FEATURE_ZEN1 +- x86/CPU/AMD: Drop now unused CPU erratum checking function +- x86/CPU/AMD: Get rid of amd_erratum_1485[] +- x86/CPU/AMD: Get rid of amd_erratum_400[] +- x86/CPU/AMD: Get rid of amd_erratum_383[] +- x86/CPU/AMD: Get rid of amd_erratum_1054[] +- x86/CPU/AMD: Move the DIV0 bug detection to the Zen1 init function +- x86/CPU/AMD: Move Zenbleed check to the Zen2 init function +- x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common() +- x86/CPU/AMD: Call the spectral chicken in the Zen2 init function +- x86/CPU/AMD: Move erratum 1076 fix into the Zen1 init function +- x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function +- x86/CPU/AMD: Carve out the erratum 1386 fix +- x86/CPU/AMD: Add ZenX generations flags +- !5036 [OLK-6.6] Do not serialize MSR accesses on AMD +- x86/barrier: Do not serialize MSR accesses on AMD +- !5134 modpost: Optimize symbol search from linear to binary search +- modpost: Optimize symbol search from linear to binary search +- !4826 add sw64 architecture support +- drivers: vfio: add sw64 support +- drivers: usb: add sw64 support +- drivers: tty: add sw64 support +- drivers: spi: add sw64 support +- drivers: scsi: add sw64 support +- drivers: rtc: add sw64 rtc support +- drivers: qemu_fw_cfg: add sw64 support +- drivers: platform: add sw64 support +- drivers: pci: add sw64 support +- drivers: misc: add sw64 support +- drivers: mfd: add sw64 support +- drivers: irqchip: add sw64 support +- drivers: iommu: add sw64 support +- drivers: i2c: add sw64 support +- drivers: hwmon: add sw64 support +- drivers: gpio: add sw64 support +- drivers: efi: add sw64 support +- !4927 ima: digest list new support modsig +- ima: digest list new support modsig +- !4971 net: hns3: backport some patch from kernel 6.7 +- net: hns3: add some link modes for hisilicon device +- net: hns3: add vf fault detect support +- net: hns3: add hns3 vf fault detect cap bit support +- !5040 [OLK-6.6] Add support for Vendor Defined Error Types in Einj Module +- ACPI: APEI: EINJ: Add support for vendor defined error types +- platform/chrome: cros_ec_debugfs: Fix permissions for panicinfo +- fs: debugfs: Add write functionality to debugfs blobs +- ACPI: APEI: EINJ: Refactor available_error_type_show() +- !5039 [OLK-6.6] Fix disabling memory if DVSEC CXL Range does not match a CFMWS window +- cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window +- !5047 Backport etmem swapcache recalim feature to OLK 6.6 +- etmem: add swapcache reclaim to etmem +- etmem: Expose symbol reclaim_folio_list +- !4514 [OLK-6.6] kabi: IOMMU subsystem reservation +- kabi: IOMMU reservations +- kabi: bus_type, device_driver, dev_pm_ops reservation +- !5056 erofs: fix handling kern_mount() failure +- erofs: fix handling kern_mount() failure +- !5059 dm: limit the number of targets and parameter size area +- dm: limit the number of targets and parameter size area +- !5021 LoongArch: fix some known issue and update defconfig +- LoongArch: enable CONFIG_DEBUG_INFO_BTF by default +- net: stmmac: fix potential double free of dma descriptor resources +- drm/radeon: Workaround radeon driver bug for Loongson +- irqchip/loongson-liointc: Set different isr for differnt core +- LoongArch: kdump: Add high memory reservation +- LoongArch: Fix kdump failure on v40 interface specification +- LoongArch: kexec: Add compatibility with old interfaces +- LoongArch: kdump: Add memory reservation for old kernel +- LoongArch: defconfig: Enable a large number of configurations +- irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. +- LoongArch: Remove generic irq migration +- LoongArch: Adapted SECTION_SIZE_BITS with page size +- !4689 Remove WQ_FLAG_BOOKMARK flag +- sched: remove wait bookmarks +- filemap: remove use of wait bookmarks +- !5024 v2 vmemmap optimize bugfix +- mm: hugetlb_vmemmap: allow alloc vmemmap pages fallback to other nodes +- mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes +- !4653 [OLK-6.6] Add support for Mucse Network Adapter(N10/N400) +- drivers: initial support for rnp drivers from Mucse Technology +- !4935 RDMA/hns: Support userspace configuring congestion control algorithm with QP granularity +- RDMA/hns: Support userspace configuring congestion control algorithm with QP granularity +- RDMA/hns: Fix mis-modifying default congestion control algorithm +- !4993 v3 kworker: Fix the problem of ipsan performance degradation +- Add kernel compilation configuration options +- iscsi: use dynamic single thread workqueue to improve performance +- workqueue: add member for NUMA aware order workqueue and implement NUMA affinity for single thread workqueue +- !4930 erofs: fix lz4 inplace decompression +- erofs: fix lz4 inplace decompression +- !4082 【OLK-6.6】KVM: arm64: vtimer irq bypass support +- mbigen: probe mbigen driver with arch_initcall +- mbigen: vtimer: disable vtimer mbigen probe when vtimer_irqbypass disabled +- mbigen: Sets the regs related to vtimer irqbypass +- KVM: arm64: vgic-v3: Clearing pending status of vtimer on guest reset +- mbigen: vtimer: add support for MBIX1_CPPI_NEGEDGE_CLR_EN_SETR(CLRR) +- KVM: arm64: arch_timer: Make vtimer_irqbypass a Distributor attr +- KVM: arm64: vtimer: Expose HW-based vtimer interrupt in debugfs +- KVM: arm64: GICv4.1: Allow non-trapping WFI when using direct vtimer interrupt +- KVM: arm64: GICv4.1: Add support for MBIGEN save/restore +- KVM: arm64: arch_timer: Rework vcpu init/reset logic +- KVM: arm64: arch_timer: Probe vtimer irqbypass capability +- KVM: arm64: GICv4.1: Enable vtimer vPPI irqbypass config +- KVM: arm64: GICv4.1: Add direct injection capability to PPI registers +- KVM: arm64: vgic: Add helper for vtimer vppi info register +- KVM: arm64: GICv4.1: Inform the HiSilicon vtimer irqbypass capability +- irqchip/gic-v4.1: Probe vtimer irqbypass capability at RD level +- irqchip/gic-v4.1: Rework its_alloc_vcpu_sgis() to support vPPI allocation +- irqchip/gic-v4.1: Rework get/set_irqchip_state callbacks of GICv4.1-sgi chip +- irqchip/gic-v4.1: Extend VSGI command to support the new vPPI +- irqchip/gic-v4.1: Detect ITS vtimer interrupt bypass capability +- mbigen: vtimer mbigen driver support +- mbigen: vtimer: isolate mbigen vtimer funcs with macro +- !4875 [OLK-6.6] backport latest v6.8 iommu fixes +- iommufd/selftest: Don't check map/unmap pairing with HUGE_PAGES +- iommufd: Fix protection fault in iommufd_test_syz_conv_iova +- iommufd/selftest: Fix mock_dev_num bug +- iommufd: Fix iopt_access_list_id overwrite bug +- iommu/sva: Fix SVA handle sharing in multi device case +- !4867 ext4: regenerate buddy after block freeing failed if under fc replay +- ext4: regenerate buddy after block freeing failed if under fc replay +- !4851 cachefiles: fix memory leak in cachefiles_add_cache() +- cachefiles: fix memory leak in cachefiles_add_cache() +- !4913 RDMA/hns: Support SCC parameter configuration and reporting of the down/up event of the HNS RoCE network port +- RDMA/hns: Add support for sending port down event fastly +- RDMA/hns: Deliver net device event to ofed +- RDMA/hns: Support congestion control algorithm parameter configuration +- !4670 crypto HiSilicon round main line code +- crypto: hisilicon/qm - change function type to void +- crypto: hisilicon/qm - obtain stop queue status +- crypto: hisilicon/qm - add stop function by hardware +- crypto: hisilicon/sec - remove unused parameter +- crypto: hisilicon/sec2 - fix some cleanup issues +- crypto: hisilicon/sec2 - modify nested macro call +- crypto: hisilicon/sec2 - updates the sec DFX function register +- crypto: hisilicon - Fix smp_processor_id() warnings +- crypto: hisilicon/qm - dump important registers values before resetting +- crypto: hisilicon/qm - support get device state +- crypto: hisilicon/sec2 - optimize the error return process +- crypto: hisilicon/qm - delete a dbg function +- crypto: hisilicon/sec2 - Remove cfb and ofb +- crypto: hisilicon/zip - save capability registers in probe process +- crypto: hisilicon/sec2 - save capability registers in probe process +- crypto: hisilicon/hpre - save capability registers in probe process +- crypto: hisilicon/qm - save capability registers in qm init process +- crypto: hisilicon/qm - add a function to set qm algs +- crypto: hisilicon/qm - add comments and remove redundant array element +- crypto: hisilicon/qm - simplify the status of qm +- crypto: hisilicon/sgl - small cleanups for sgl.c +- crypto: hisilicon/zip - add zip comp high perf mode configuration +- crypto: hisilicon/qm - remove incorrect type cast +- crypto: hisilicon/qm - print device abnormal information +- crypto: hisilicon/trng - Convert to platform remove callback returning void +- crypto: hisilicon/sec - Convert to platform remove callback returning void +- crypto: hisilicon/qm - fix EQ/AEQ interrupt issue +- crypto: hisilicon/qm - alloc buffer to set and get xqc +- crypto: hisilicon/qm - check function qp num before alg register +- crypto: hisilicon/qm - fix the type value of aeq +- crypto: hisilicon/sec - fix for sgl unmmap problem +- crypto: hisilicon/zip - remove zlib and gzip +- crypto: hisilicon/zip - support deflate algorithm +- uacce: make uacce_class constant +- !4725 [OLK-6.6] merge upstream net-v6.7 all wangxun patches +- net: fill in MODULE_DESCRIPTION()s for wx_lib +- wangxun: select CONFIG_PHYLINK where needed +- net: wangxun: add ethtool_ops for msglevel +- net: wangxun: add coalesce options support +- net: wangxun: add ethtool_ops for ring parameters +- net: wangxun: add flow control support +- net: ngbe: convert phylib to phylink +- net: txgbe: use phylink bits added in libwx +- net: libwx: add phylink to libwx +- net: wangxun: remove redundant kernel log +- net: ngbe: add ethtool stats support +- net: txgbe: add ethtool stats support +- net: wangxun: move MDIO bus implementation to the library +- net: libwx: fix memory leak on free page +- net: libwx: support hardware statistics +- net: wangxun: fix changing mac failed when running +- !4841 Intel-sig: intel_idle: add Sierra Forest SoC support on 6.6 +- intel_idle: add Sierra Forest SoC support +- !4834 ras: fix return type of log_arm_hw_error when not add CONFIG_RAS_ARM_EVENT_INFO config +- ras: fix return type of log_arm_hw_error when not add CONFIG_RAS_ARM_EVENT_INFO config +- !4845 PCI: Avoid potential out-of-bounds read in pci_dev_for_each_resource() +- PCI: Avoid potential out-of-bounds read in pci_dev_for_each_resource() +- !4773 Add loongarch kernel kvm support +- loongarch/kernel: Fix loongarch compilation error +- LoongArch: KVM: Add returns to SIMD stubs +- LoongArch: KVM: Streamline kvm_check_cpucfg() and improve comments +- LoongArch: KVM: Rename _kvm_get_cpucfg() to _kvm_get_cpucfg_mask() +- LoongArch: KVM: Fix input validation of _kvm_get_cpucfg() & kvm_check_cpucfg() +- irqchip/loongson-eiointc: Use correct struct type in eiointc_domain_alloc() +- LoongArch: KVM: Add LASX (256bit SIMD) support +- LoongArch: KVM: Add LSX (128bit SIMD) support +- LoongArch: KVM: Fix timer emulation with oneshot mode +- LoongArch: KVM: Remove kvm_acquire_timer() before entering guest +- LoongArch: KVM: Allow to access HW timer CSR registers always +- LoongArch: KVM: Remove SW timer switch when vcpu is halt polling +- LoongArch: KVM: Optimization for memslot hugepage checking +- LoongArch: Implement constant timer shutdown interface +- LoongArch: KVM: Add maintainers for LoongArch KVM +- LoongArch: KVM: Supplement kvm document about LoongArch-specific part +- LoongArch: KVM: Enable kvm config and add the makefile +- LoongArch: KVM: Implement vcpu world switch +- LoongArch: KVM: Implement kvm exception vectors +- LoongArch: KVM: Implement handle fpu exception +- LoongArch: KVM: Implement handle mmio exception +- LoongArch: KVM: Implement handle gspr exception +- LoongArch: KVM: Implement handle idle exception +- LoongArch: KVM: Implement handle iocsr exception +- LoongArch: KVM: Implement handle csr exception +- LoongArch: KVM: Implement kvm mmu operations +- LoongArch: KVM: Implement virtual machine tlb operations +- LoongArch: KVM: Implement vcpu timer operations +- LoongArch: KVM: Implement misc vcpu related interfaces +- LoongArch: KVM: Implement vcpu load and vcpu put operations +- LoongArch: KVM: Implement vcpu interrupt operations +- LoongArch: KVM: Implement fpu operations for vcpu +- LoongArch: KVM: Implement basic vcpu ioctl interfaces +- LoongArch: KVM: Implement basic vcpu interfaces +- LoongArch: KVM: Add vcpu related header files +- LoongArch: KVM: Implement VM related functions +- LoongArch: KVM: Implement kvm hardware enable, disable interface +- LoongArch: KVM: Implement kvm module related interface +- LoongArch: KVM: Add kvm related header files +- !3951 【OLK-6.6】KVM/arm64: support virt_dev irqbypass +- KVM: arm64: update arm64 openeuler_defconfig for CONFIG_VIRT_PLAT_DEV +- KVM: arm64: sdev: Support virq bypass by INT/VSYNC command +- KVM: arm64: kire: irq routing entry cached the relevant cache data +- KVM: arm64: Introduce shadow device +- virt_plat_dev: Register the virt platform device driver +- irqchip/gic-v3-its: Add virt platform devices MSI support +- irqchip/gic-v3-its: Alloc/Free device id from pools for virtual devices +- irqchip/gic-v3-its: Introduce the reserved device ID pools +- !4425 【OLK-6.6】arm64/nmi: Support for FEAT_NMI +- irqchip/gic-v3: Fix hard LOCKUP caused by NMI being masked +- config: enable CONFIG_ARM64_NMI and CONFIG_HARDLOCKUP_DETECTOR_PERF for arm64 +- irqchip/gic-v3: Implement FEAT_GICv3_NMI support +- arm64/nmi: Add Kconfig for NMI +- arm64/nmi: Add handling of superpriority interrupts as NMIs +- arm64/irq: Document handling of FEAT_NMI in irqflags.h +- arm64/entry: Don't call preempt_schedule_irq() with NMIs masked +- arm64/nmi: Manage masking for superpriority interrupts along with DAIF +- KVM: arm64: Hide FEAT_NMI from guests +- arm64/cpufeature: Detect PE support for FEAT_NMI +- arm64/idreg: Add an override for FEAT_NMI +- arm64/hyp-stub: Enable access to ALLINT +- arm64/asm: Introduce assembly macros for managing ALLINT +- arm64/sysreg: Add definitions for immediate versions of MSR ALLINT +- arm64/booting: Document boot requirements for FEAT_NMI +- !4679 f2fs: fix to avoid dirent corruption +- f2fs: fix to avoid dirent corruption +- !4730 coresight: trbe: Enable ACPI based devices +- coresight: trbe: Enable ACPI based TRBE devices +- coresight: trbe: Add a representative coresight_platform_data for TRBE +- !4807 [OLK-6.6] Intel: backport KVM LAM from v6.8 to OLK-6.6 +- KVM: x86: Use KVM-governed feature framework to track "LAM enabled" +- KVM: x86: Advertise and enable LAM (user and supervisor) +- KVM: x86: Virtualize LAM for user pointer +- KVM: x86: Virtualize LAM for supervisor pointer +- KVM: x86: Untag addresses for LAM emulation where applicable +- KVM: x86: Introduce get_untagged_addr() in kvm_x86_ops and call it in emulator +- KVM: x86: Remove kvm_vcpu_is_illegal_gpa() +- KVM: x86: Add & use kvm_vcpu_is_legal_cr3() to check CR3's legality +- KVM: x86/mmu: Drop non-PA bits when getting GFN for guest's PGD +- KVM: x86: Add X86EMUL_F_INVLPG and pass it in em_invlpg() +- KVM: x86: Add an emulation flag for implicit system access +- KVM: x86: Consolidate flags for __linearize() +- !4700 efivarfs: force RO when remounting if SetVariable is not supported +- efivarfs: force RO when remounting if SetVariable is not supported +- !4785 Support PV-sched feature +- KVM: arm64: Support the vCPU preemption check +- KVM: arm64: Add interface to support vCPU preempted check +- KVM: arm64: Support pvsched preempted via shared structure +- KVM: arm64: Implement PV_SCHED_FEATURES call +- KVM: arm64: Document PV-sched interface +- !4629 add sw64 architecture support +- drivers: cpufreq: add sw64 support +- drivers: clocksource: add sw64 support +- drivers: acpi: add sw64 support +- selftests: fix sw64 support +- perf: fix sw64 support +- perf: add sw64 support +- tools: fix basic sw64 support +- tools: add basic sw64 support +- sw64: fix ftrace support +- sw64: fix audit support +- sw64: fix kexec support +- sw64: fix PCI support +- sw64: fix KVM support +- sw64: fix module support +- sw64: fix ACPI support +- sw64: fix rrk support +- sw64: fix ELF support +- !4727 RAS: Report ARM processor information to userspace +- RAS: Report ARM processor information to userspace +- !4769 [sync] PR-4729: serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed +- serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed +- !4781 x86/fpu: Stop relying on userspace for info to fault in xsave buffer +- x86/fpu: Stop relying on userspace for info to fault in xsave buffer +- !4787 v2 gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump +- gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump +- !4789 v2 fix CVE-2024-26590 +- erofs: fix inconsistent per-file compression format +- erofs: simplify compression configuration parser +- !4736 PCIe and miniIO OLK-5.10 branch partial code round OLK-6.6 branch +- xhci:fix USB xhci controller issue +- spi: hisi-sfc-v3xx: return IRQ_NONE if no interrupts were detected +- Add the verification operation after the bus recovery operation obtains resources through the ACPI +- i2c: hisi: Add gpio bus recovery support +- gpio: hisi: Fix format specifier +- perf hisi-ptt: Fix one memory leakage in hisi_ptt_process_auxtrace_event() +- Fix the header file location error and adjust the function and structure version. +- hwtracing: hisi_ptt: Don't try to attach a task +- hwtracing: hisi_ptt: Optimize the trace data committing +- hwtracing: hisi_ptt: Handle the interrupt in hardirq context +- hwtracing: hisi_ptt: Disable interrupt after trace end +- !4802 Export vcpu stat via debugfs +- kvm: debugfs: add EXIT_REASON_PREEMPTION_TIMER to vcpu_stat +- kvm: debugfs: add fastpath msr_wr exits to debugfs statistics +- kvm: debugfs: Export x86 kvm exits to vcpu_stat +- kvm: debugfs: aarch64 export cpu time related items to debugfs +- kvm: debugfs: export remaining aarch64 kvm exit reasons to debugfs +- kvm: debugfs: Export vcpu stat via debugfs +- !4676 [OLK-6.6] kabi/iommu: Backport patches from upstream and maintainer tree +- iommu/sva: Restore SVA handle sharing +- iommu/arm-smmu-v3: Do not use GFP_KERNEL under as spinlock +- Revert "iommu/arm-smmu: Convert to domain_alloc_paging()" +- iommu/vt-d: Fix constant-out-of-range warning +- iommu/vt-d: Set SSADE when attaching to a parent with dirty tracking +- iommu/vt-d: Add missing dirty tracking set for parent domain +- iommu/vt-d: Wrap the dirty tracking loop to be a helper +- iommu/vt-d: Remove domain parameter for intel_pasid_setup_dirty_tracking() +- iommu/vt-d: Add missing device iotlb flush for parent domain +- iommu/vt-d: Update iotlb in nested domain attach +- iommu/vt-d: Add missing iotlb flush for parent domain +- iommu/vt-d: Add __iommu_flush_iotlb_psi() +- iommu/vt-d: Track nested domains in parent +- iommu: Make iommu_report_device_fault() return void +- iommu: Make iopf_group_response() return void +- iommu: Track iopf group instead of last fault +- iommu: Improve iopf_queue_remove_device() +- iommu: Use refcount for fault data access +- iommu: Refine locking for per-device fault data management +- iommu: Separate SVA and IOPF +- iommu: Make iommu_queue_iopf() more generic +- iommu: Prepare for separating SVA and IOPF +- iommu: Merge iommu_fault_event and iopf_fault +- iommu: Remove iommu_[un]register_device_fault_handler() +- iommu: Merge iopf_device_param into iommu_fault_param +- iommu: Cleanup iopf data structure definitions +- iommu: Remove unrecoverable fault data +- iommu/arm-smmu-v3: Remove unrecoverable faults reporting +- iommu: Move iommu fault data to linux/iommu.h +- iommu/iova: use named kmem_cache for iova magazines +- iommu/iova: Reorganise some code +- iommu/iova: Tidy up iova_cache_get() failure +- selftests/iommu: fix the config fragment +- iommufd: Reject non-zero data_type if no data_len is provided +- iommufd/iova_bitmap: Consider page offset for the pages to be pinned +- iommufd/selftest: Add mock IO hugepages tests +- iommufd/selftest: Hugepage mock domain support +- iommufd/selftest: Refactor mock_domain_read_and_clear_dirty() +- iommufd/selftest: Refactor dirty bitmap tests +- iommufd/iova_bitmap: Handle recording beyond the mapped pages +- iommufd/selftest: Test u64 unaligned bitmaps +- iommufd/iova_bitmap: Switch iova_bitmap::bitmap to an u8 array +- iommufd/iova_bitmap: Bounds check mapped::pages access +- powerpc/iommu: Fix the missing iommu_group_put() during platform domain attach +- powerpc: iommu: Bring back table group release_ownership() call +- iommu: Allow ops->default_domain to work when !CONFIG_IOMMU_DMA +- iommufd/selftest: Check the bus type during probe +- iommu/vt-d: Add iotlb flush for nested domain +- iommufd: Add data structure for Intel VT-d stage-1 cache invalidation +- iommufd/selftest: Add coverage for IOMMU_HWPT_INVALIDATE ioctl +- iommufd/selftest: Add IOMMU_TEST_OP_MD_CHECK_IOTLB test op +- iommufd/selftest: Add mock_domain_cache_invalidate_user support +- iommu: Add iommu_copy_struct_from_user_array helper +- iommufd: Add IOMMU_HWPT_INVALIDATE +- iommu: Add cache_invalidate_user op +- iommu: Don't reserve 0-length IOVA region +- iommu/sva: Fix memory leak in iommu_sva_bind_device() +- iommu/dma: Trace bounce buffer usage when mapping buffers +- iommu/tegra: Use tegra_dev_iommu_get_stream_id() in the remaining places +- acpi: Do not return struct iommu_ops from acpi_iommu_configure_id() +- iommu: Mark dev_iommu_priv_set() with a lockdep +- iommu: Mark dev_iommu_get() with lockdep +- iommu/of: Use -ENODEV consistently in of_iommu_configure() +- iommmu/of: Do not return struct iommu_ops from of_iommu_configure() +- iommu: Remove struct iommu_ops *iommu from arch_setup_dma_ops() +- iommu: Set owner token to SVA domain +- mm: Deprecate pasid field +- iommu: Support mm PASID 1:n with sva domains +- mm: Add structure to keep sva information +- iommu: Add mm_get_enqcmd_pasid() helper function +- iommu/vt-d: Remove mm->pasid in intel_sva_bind_mm() +- iommu: Change kconfig around IOMMU_SVA +- iommu: Extend LPAE page table format to support custom allocators +- iommu: Allow passing custom allocators to pgtable drivers +- iommu: Clean up open-coded ownership checks +- iommu: Retire bus ops +- iommu/arm-smmu: Don't register fwnode for legacy binding +- iommu: Decouple iommu_domain_alloc() from bus ops +- iommu: Validate that devices match domains +- iommu: Decouple iommu_present() from bus ops +- iommu: Factor out some helpers +- iommu: Map reserved memory as cacheable if device is coherent +- iommu/vt-d: Move inline helpers to header files +- iommu/vt-d: Remove unused vcmd interfaces +- iommu/vt-d: Remove unused parameter of intel_pasid_setup_pass_through() +- iommu/vt-d: Refactor device_to_iommu() to retrieve iommu directly +- iommu/virtio: Add ops->flush_iotlb_all and enable deferred flush +- iommu/virtio: Make use of ops->iotlb_sync_map +- iommu/arm-smmu: Convert to domain_alloc_paging() +- iommu/arm-smmu: Pass arm_smmu_domain to internal functions +- iommu/arm-smmu: Implement IOMMU_DOMAIN_BLOCKED +- iommu/arm-smmu: Convert to a global static identity domain +- iommu/arm-smmu: Reorganize arm_smmu_domain_add_master() +- iommu/arm-smmu-v3: Remove ARM_SMMU_DOMAIN_NESTED +- iommu/arm-smmu-v3: Master cannot be NULL in arm_smmu_write_strtab_ent() +- iommu/arm-smmu-v3: Add a type for the STE +- iommu/apple-dart: Fix spelling mistake "grups" -> "groups" +- iommu/apple-dart: Use readl instead of readl_relaxed for consistency +- iommu/apple-dart: Add support for t8103 USB4 DART +- iommu/apple-dart: Write to all DART_T8020_STREAM_SELECT +- dt-bindings: iommu: dart: Add t8103-usb4-dart compatible +- iommufd: Do not UAF during iommufd_put_object() +- iommufd: Add iommufd_ctx to iommufd_put_object() +- iommu/vt-d: Support enforce_cache_coherency only for empty domains +- iommu: Flow ERR_PTR out from __iommu_domain_alloc() +- iommu/dma: Use a large flush queue and timeout for shadow_on_flush +- iommu/dma: Allow a single FQ in addition to per-CPU FQs +- iommu/s390: Disable deferred flush for ISM devices +- s390/pci: Use dma-iommu layer +- s390/pci: prepare is_passed_through() for dma-iommu +- iommu: Allow .iotlb_sync_map to fail and handle s390's -ENOMEM return +- iommu/dart: Remove the force_bypass variable +- iommu/dart: Call apple_dart_finalize_domain() as part of alloc_paging() +- iommu/dart: Convert to domain_alloc_paging() +- iommu/dart: Move the blocked domain support to a global static +- iommu/dart: Use static global identity domains +- iommufd: Convert to alloc_domain_paging() +- iommu/vt-d: Use ops->blocked_domain +- iommu/vt-d: Update the definition of the blocking domain +- iommu: Move IOMMU_DOMAIN_BLOCKED global statics to ops->blocked_domain +- iommu: change iommu_map_sgtable to return signed values +- powerpc/iommu: Do not do platform domain attach atctions after probe +- iommu: Fix return code in iommu_group_alloc_default_domain() +- iommu: Do not use IOMMU_DOMAIN_DMA if CONFIG_IOMMU_DMA is not enabled +- iommu: Remove duplicate include +- iommu: Improve map/unmap sanity checks +- iommu: Retire map/unmap ops +- iommu/tegra-smmu: Update to {map,unmap}_pages +- iommu/sun50i: Update to {map,unmap}_pages +- iommu/rockchip: Update to {map,unmap}_pages +- iommu/omap: Update to {map,unmap}_pages +- iommu/exynos: Update to {map,unmap}_pages +- iommu/omap: Convert to generic_single_device_group() +- iommu/ipmmu-vmsa: Convert to generic_single_device_group() +- iommu/rockchip: Convert to generic_single_device_group() +- iommu/sprd: Convert to generic_single_device_group() +- iommu/sun50i: Convert to generic_single_device_group() +- iommu: Add generic_single_device_group() +- iommu: Remove useless group refcounting +- iommu: Convert remaining simple drivers to domain_alloc_paging() +- iommu: Convert simple drivers with DOMAIN_DMA to domain_alloc_paging() +- iommu: Add ops->domain_alloc_paging() +- iommu: Add __iommu_group_domain_alloc() +- iommu: Require a default_domain for all iommu drivers +- iommu/sun50i: Add an IOMMU_IDENTITIY_DOMAIN +- iommu/mtk_iommu: Add an IOMMU_IDENTITIY_DOMAIN +- iommu/ipmmu: Add an IOMMU_IDENTITIY_DOMAIN +- iommu/qcom_iommu: Add an IOMMU_IDENTITIY_DOMAIN +- iommu: Remove ops->set_platform_dma_ops() +- iommu/msm: Implement an IDENTITY domain +- iommu/omap: Implement an IDENTITY domain +- iommu/tegra-smmu: Support DMA domains in tegra +- iommu/tegra-smmu: Implement an IDENTITY domain +- iommu/exynos: Implement an IDENTITY domain +- iommu: Allow an IDENTITY domain as the default_domain in ARM32 +- iommu: Reorganize iommu_get_default_domain_type() to respect def_domain_type() +- iommu/mtk_iommu_v1: Implement an IDENTITY domain +- iommu/tegra-gart: Remove tegra-gart +- iommu/fsl_pamu: Implement a PLATFORM domain +- iommu: Add IOMMU_DOMAIN_PLATFORM for S390 +- powerpc/iommu: Setup a default domain and remove set_platform_dma_ops +- iommu: Add IOMMU_DOMAIN_PLATFORM +- iommu: Add iommu_ops->identity_domain +- iommu/vt-d: debugfs: Support dumping a specified page table +- iommu/vt-d: debugfs: Create/remove debugfs file per {device, pasid} +- iommu/vt-d: debugfs: Dump entry pointing to huge page +- iommu/virtio: Add __counted_by for struct viommu_request and use struct_size() +- iommu/arm-smmu-v3-sva: Remove bond refcount +- iommu/arm-smmu-v3-sva: Remove unused iommu_sva handle +- iommu/arm-smmu-v3: Rename cdcfg to cd_table +- iommu/arm-smmu-v3: Update comment about STE liveness +- iommu/arm-smmu-v3: Cleanup arm_smmu_domain_finalise +- iommu/arm-smmu-v3: Move CD table to arm_smmu_master +- iommu/arm-smmu-v3: Refactor write_ctx_desc +- iommu/arm-smmu-v3: move stall_enabled to the cd table +- iommu/arm-smmu-v3: Encapsulate ctx_desc_cfg init in alloc_cd_tables +- iommu/arm-smmu-v3: Replace s1_cfg with cdtab_cfg +- iommu/arm-smmu-v3: Move ctx_desc out of s1_cfg +- iommu/tegra-smmu: Drop unnecessary error check for for debugfs_create_dir() +- powerpc: Remove extern from function implementations +- iommufd: Organize the mock domain alloc functions closer to Joerg's tree +- iommu/vt-d: Disallow read-only mappings to nest parent domain +- iommu/vt-d: Add nested domain allocation +- iommu/vt-d: Set the nested domain to a device +- iommu/vt-d: Make domain attach helpers to be extern +- iommu/vt-d: Add helper to setup pasid nested translation +- iommu/vt-d: Add helper for nested domain allocation +- iommu/vt-d: Extend dmar_domain to support nested domain +- iommufd: Add data structure for Intel VT-d stage-1 domain allocation +- iommufd/selftest: Add coverage for IOMMU_HWPT_ALLOC with nested HWPTs +- iommufd/selftest: Add nested domain allocation for mock domain +- iommu: Add iommu_copy_struct_from_user helper +- iommufd: Add a nested HW pagetable object +- iommu: Pass in parent domain with user_data to domain_alloc_user op +- iommufd: Share iommufd_hwpt_alloc with IOMMUFD_OBJ_HWPT_NESTED +- iommufd: Derive iommufd_hwpt_paging from iommufd_hw_pagetable +- iommufd/device: Wrap IOMMUFD_OBJ_HWPT_PAGING-only configurations +- iommufd: Rename IOMMUFD_OBJ_HW_PAGETABLE to IOMMUFD_OBJ_HWPT_PAGING +- iommu: Add IOMMU_DOMAIN_NESTED +- iommufd: Only enforce cache coherency in iommufd_hw_pagetable_alloc +- iommufd: Fix spelling errors in comments +- !4767 reserve space for arch related structures +- kabi: reserve space for struct mfd_cell +- kabi: reserve space for struct irq_work +- !4709 mtd: Fix gluebi NULL pointer dereference caused by ftl notifier +- mtd: Fix gluebi NULL pointer dereference caused by ftl notifier +- !4738 blk-mq: fix IO hang from sbitmap wakeup race +- blk-mq: fix IO hang from sbitmap wakeup race +- !4561 sched: migtate user interface from smart grid to sched bpf +- sched: migtate user interface from smart grid to sched bpf +- !4026 [OLK-6.6]Add support for Mont-TSSE +- add support for Mont-TSSE Driver +- !4564 v2 reserve space for arm64 related structures +- kabi: reserve space for processor.h +- kabi: reserve space for fb.h +- kabi: reserve space for efi.h +- !4675 v5 Backport vDPA migration support patches +- vdpa: add CONFIG_VHOST_VDPA_MIGRATION +- vdpa: add vmstate header file +- vhost-vdpa: add reset state params to indicate reset level +- vhost-vdpa: allow set feature VHOST_F_LOG_ALL when been negotiated. +- vhost-vdpa: fix msi irq request err +- vhost-vdpa: Allow transparent MSI IOV +- vhost: add VHOST feature VHOST_BACKEND_F_BYTEMAPLOG +- vhost-vdpa: add uAPI for device migration status +- vdpa: add vdpa device migration status ops +- vhost-vdpa: add uAPI for device buffer +- vdpa: add device state operations +- vhost-vdpa: add uAPI for logging +- vdpa: add log operations +- !4660 Intel: Backport to fix In Field Scan(IFS) SAF for GNR & SRF +- platform/x86/intel/ifs: Call release_firmware() when handling errors. +- !4652 RDMA/hns: Support SCC context query and DSCP configuration. +- RDMA/hns: Support DSCP of userspace +- RDMA/hns: Append SCC context to the raw dump of QP Resource +- !4628 fs:/dcache.c: fix negative dentry flag warning in dentry_free +- fs:/dcache.c: fix negative dentry flag warning in dentry_free +- !4654 hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init() +- hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init() +- !3880 ima: Add IMA digest lists extension +- ima: add default INITRAMFS_FILE_METADATA and EVM_DEFAULT_HASH CONFIG +- ima: don't allow control characters in policy path +- ima: Add max size for IMA digest database +- config: add digest list options for arm64 and x86 +- evm: Propagate choice of HMAC algorithm in evm_crypto.c +- ima: Execute parser to upload digest lists not recognizable by the kernel +- evm: Extend evm= with x509. allow_metadata_writes and complete values +- ima: Add parser keyword to the policy +- ima: Allow direct upload of digest lists to securityfs +- ima: Search key in the built-in keyrings +- certs: Introduce search_trusted_key() +- KEYS: Provide a function to load keys from a PGP keyring blob +- KEYS: Introduce load_pgp_public_keyring() +- KEYS: Provide PGP key description autogeneration +- KEYS: PGP data parser +- PGPLIB: Basic packet parser +- PGPLIB: PGP definitions (RFC 4880) +- rsa: add parser of raw format +- mpi: introduce mpi_key_length() +- ima: Add Documentation/security/IMA-digest-lists.txt +- ima: Introduce appraise_exec_immutable policy +- ima: Introduce appraise_exec_tcb policy +- ima: Introduce exec_tcb policy +- ima: Add meta_immutable appraisal type +- evm: Add support for digest lists of metadata +- ima: Add support for appraisal with digest lists +- ima: Add support for measurement with digest lists +- ima: Load all digest lists from a directory at boot time +- ima: Introduce new hook DIGEST_LIST_CHECK +- ima: Introduce new securityfs files +- ima: Prevent usage of digest lists not measured or appraised +- ima: Add parser of compact digest list +- ima: Use ima_show_htable_value to show violations and hash table data +- ima: Generalize policy file operations +- ima: Generalize ima_write_policy() and raise uploaded data size limit +- ima: Generalize ima_read_policy() +- ima: Allow choice of file hash algorithm for measurement and audit +- ima: Add enforce-evm and log-evm modes to strictly check EVM status +- init: Add kernel option to force usage of tmpfs for rootfs +- gen_init_cpio: add support for file metadata +- initramfs: read metadata from special file METADATA!!! +- initramfs: add file metadata +- !4542 Support feature TLBI DVMBM +- KVM: arm64: Implement the capability of DVMBM +- KVM: arm64: Add kvm_arch::sched_cpus and sched_lock +- KVM: arm64: Add kvm_vcpu_arch::sched_cpus and pre_sched_cpus +- KVM: arm64: Probe and configure DVMBM capability on HiSi CPUs +- KVM: arm64: Support a new HiSi CPU type +- KVM: arm64: Only probe Hisi ncsnp feature on Hisi CPUs +- KVM: arm64: Add support for probing Hisi ncsnp capability +- KVM: arm64: Probe Hisi CPU TYPE from ACPI/DTB +- !4661 [OLK-6.6] Fix gic support for Phytium S2500 +- Enable CONFIG_ARCH_PHYTIUM +- Fix gic support for Phytium S2500 +- !4644 f2fs: explicitly null-terminate the xattr list +- f2fs: explicitly null-terminate the xattr list +- !4637 Using smmu IIDR registers +- iommu/arm-smmu-v3: Enable iotlb_sync_map according to SMMU_IIDR +- Revert "iommu/arm-smmu-v3: Add a SYNC command to avoid broken page table prefetch" +- !4506 ubi: fastmap: Optimize ubi wl algorithm to improve flash service life +- ubi: fastmap: Add control in 'UBI_IOCATT' ioctl to reserve PEBs for filling pools +- ubi: fastmap: Add module parameter to control reserving filling pool PEBs +- ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs +- ubi: fastmap: Get wl PEB even ec beyonds the 'max' if free PEBs are run out +- ubi: fastmap: may_reserve_for_fm: Don't reserve PEB if fm_anchor exists +- ubi: fastmap: Remove unneeded break condition while filling pools +- ubi: fastmap: Wait until there are enough free PEBs before filling pools +- ubi: fastmap: Use free pebs reserved for bad block handling +- ubi: Replace erase_block() with sync_erase() +- ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap +- ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash +- ubi: fastmap: Fix missed ec updating after erasing old fastmap data block +- !4624 6.6: i2c: Optimized the value setting of maxwrite limit to fifo depth - 1 +- i2c: hisi: Add clearing tx aempty interrupt operation +- i2c: hisi: Optimized the value setting of maxwrite limit to fifo depth - 1 +- !4631 Add kabi reserve +- drm/ttm: Add kabi reserve in ttm_tt.h +- drm/ttm: Add kabi reserve in ttm_resource.h +- drm/ttm: Add kabi reserve in ttm_bo.h +- drm: Add kabi reserve in drm_gpu_scheduler.h +- drm: Add kabi reserve in drm_syncobj.h +- drm: Add kabi reserve in drm_plane.h +- drm: Add kabi reserve in drm_modeset_lock.h +- drm: Add kabi reserve in drm_mode_config.h +- sbitmap: Add kabi reserve +- xarray: Reserve kabi for xa_state +- delayacct: Reserve kabi for task_delay_info + +* Mon Feb 26 2024 huangzq6 <huangzhenqiang2@huawei.com> - 6.6.0-10.0.0.7 +- add signature for vmlinux + +* Wed Feb 21 2024 Zheng Zengkai <zhengzengkai@huawei.com> - 6.6.0-10.0.0.6 +- !4598 [OLK-6.6] Add iommu support for Phytium S2500 +- Add iommu support for Phytium S2500 +- !4596 add sw64 architecture support +- sw64: fix build support +- sw64: add dynamic turning on/off cores support +- sw64: add dynamic frequency scaling support +- sw64: add kgdb support +- sw64: add jump_label support +- sw64: add uprobe support +- sw64: add kprobe support +- sw64: add kernel relocation support +- sw64: add ftrace support +- sw64: add hibernation support +- sw64: add suspend support +- sw64: add eBPF JIT support +- sw64: add kdump support +- sw64: add kexec support +- sw64: add perf events support +- sw64: add qspinlock support +- sw64: add stacktrace support +- !4567 Support feature TWED +- KVM: arm64: Make use of TWED feature +- arm64: cpufeature: TWED support detection +- !4383 [OLK-6.6] kabi: add more x86/cpu reservations in cpu feature bits and bug bits +- kabi: reserve x86 cpu bug fields +- kabi: reserve x86 cpu capability fields +- !3695 x86: Add x86 related kabi reservations +- x86: Add x86 related kabi reservations +- !4589 fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super +- fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super +- !4451 v5 kabi reserve patches +- kabi: reserve space for arm64 cpufeature related structure +- kabi: reserve space for power management related structure +- energy_model: Add kabi_reserve +- pm: pm.h: Add kabi_reserve +- pm: pm_domain.h: Add kabi_reserve +- drm: drm_gem.h: Add kabi_reserve +- drm: drm_fourcc.h: Add kabi_reserve +- drm: drm_file.h: Add kabi_reserve +- drm: drm_fb_helper.h: Add kabi_reserve +- drm: drm_drv.h: Add kabi_reserve +- drm: drm_device.h: Add kabi_reserve +- drm: drm_crtc.h: Add kabi_reserve +- drm: drm_connector.h: Add kabi_reserve +- drm: drm_client.h: Add kabi_reserve +- drm: drm_atomic.h: Add kabi_reserve +- irqdomain: Add kabi_reserve in irqdomain +- irq_desc: Add kabi_reserve in irq_desc +- irq: Add kabi_reserve in irq +- interrupt: Add kabi_reserve in interrupt.h +- msi: Add kabi_reserve in msi.h +- kabi: reserve space for struct cpu_stop_work +- KABI: reserve space for struct input_dev +- !4557 Add ZONE_EXTMEM to avoid kabi broken +- openeuler_defconfig: enable CONFIG_ZONE_EXTMEM for arm64 +- mm: add ZONE_EXTMEM for future extension to avoid kabi broken +- !4569 add sw64 architecture support +- sw64: add KVM support +- sw64: add EFI support +- sw64: add DMA support +- sw64: add ACPI support +- sw64: add device trees +- sw64: add MSI support +- sw64: add PCI support +- sw64: add default configs +- sw64: add NUMA support +- sw64: add SMP support +- sw64: add VDSO support +- sw64: add some library functions +- sw64: add some other routines +- sw64: add some common routines +- sw64: add module support +- sw64: add basic IO support +- sw64: add FPU support +- !3498 fuse: reserve space for future expansion +- kabi:fuse: reserve space for future expansion +- !4435 v2 kabi: reserve space for struct ptp_clock +- kabi: reserve space for struct ptp_clock +- !4584 v5 kabi reserve +- kabi: reserve space for struct clocksource +- kabi: reserve space for struct timer_list +- kabi: reserve space for struct ptp_clock_info +- kabi: reserve space for posix clock related structure +- kabi: reserve space for hrtimer related structures +- kabi: reserve space for kobject related structures +- !4049 openeuler_defconfig: Disable new HW_RANDOM support for arm64 +- openeuler_defconfig: Disable new HW_RANDOM support for arm64 +- !4582 cgroup/hugetlb: hugetlb accounting +- mm: memcg: fix split queue list crash when large folio migration +- hugetlb: memcg: account hugetlb-backed memory in memory controller +- memcontrol: only transfer the memcg data for migration +- memcontrol: add helpers for hugetlb memcg accounting +- !4347 【OLK-6.6】AMD: CXL RCH Protocol Error Handling supporting +- openeuler_defconfig: Enable CONFIG_PCIEAER_CXL=y +- cxl/hdm: Fix && vs || bug +- cxl/pci: Change CXL AER support check to use native AER +- cxl/core/regs: Rework cxl_map_pmu_regs() to use map->dev for devm +- cxl/core/regs: Rename phys_addr in cxl_map_component_regs() +- PCI/AER: Unmask RCEC internal errors to enable RCH downstream port error handling +- PCI/AER: Forward RCH downstream port-detected errors to the CXL.mem dev handler +- cxl/pci: Disable root port interrupts in RCH mode +- cxl/pci: Add RCH downstream port error logging +- cxl/pci: Map RCH downstream AER registers for logging protocol errors +- cxl/pci: Update CXL error logging to use RAS register address +- PCI/AER: Refactor cper_print_aer() for use by CXL driver module +- cxl/pci: Add RCH downstream port AER register discovery +- cxl/port: Remove Component Register base address from struct cxl_port +- cxl/pci: Remove Component Register base address from struct cxl_dev_state +- cxl/hdm: Use stored Component Register mappings to map HDM decoder capability +- cxl/pci: Store the endpoint's Component Register mappings in struct cxl_dev_state +- cxl/port: Pre-initialize component register mappings +- cxl/port: Rename @comp_map to @reg_map in struct cxl_register_map +- !4390 [OLK-6.6] Add kdump support for Phytium S2500 +- Add kdump support for Phytium S2500 +- !4459 v2 Introduce page eject for arm64 +- config: update defconfig for PAGE_EJECT +- mm: page_eject: Introuduce page ejection +- mm/memory-failure: introduce soft_online_page +- mm/hwpoison: Export symbol soft_offline_page +- !3699 [OLK-6.6] Enable CONFIG_IOMMUFD and CONFIG_VFIO_DEVICE_CDEV in x86/arm64 defconfig +- defconfig: enable CONFIG_IOMMUFD and CONFIG_VFIO_DEVICE_CDEV +- !4571 scsi: iscsi: kabi: KABI reservation for iscsi_transport +- scsi: iscsi: kabi: KABI reservation for iscsi_transport +- !4546 RDMA/hns: Support MR management +- RDMA/hns: Simplify 'struct hns_roce_hem' allocation +- RDMA/hns: Support adaptive PBL hopnum +- RDMA/hns: Support flexible umem page size +- RDMA/hns: Alloc MTR memory before alloc_mtt() +- RDMA/hns: Refactor mtr_init_buf_cfg() +- RDMA/hns: Refactor mtr find +- !4576 v6 Add support for ecmdq +- iommu/arm-smmu-v3: Allow disabling ECMDQs at boot time +- iommu/arm-smmu-v3: Add support for less than one ECMDQ per core +- iommu/arm-smmu-v3: Add arm_smmu_ecmdq_issue_cmdlist() for non-shared ECMDQ +- iommu/arm-smmu-v3: Ensure that a set of associated commands are inserted in the same ECMDQ +- iommu/arm-smmu-v3: Add support for ECMDQ register mode +- !3697 enable ARM64/X86 CONFIG_BPF_LSM config +- lsm: enable CONFIG_BPF_LSM for use bpf in lsm program +- !4537 mainline cgroup bufix +- cgroup: use legacy_name for cgroup v1 disable info +- blk-cgroup: bypass blkcg_deactivate_policy after destroying +- cgroup: Check for ret during cgroup1_base_files cft addition +- !4438 kabi: reserve space for workqueue subsystem related structure +- kabi: reserve space for workqueue subsystem related structure +- !4570 v2 scsi: reserve space for structures in scsi +- scsi: reserve space for structures in scsi +- !4566 v2 reserve kabi space for some structures +- libnvdimm: reserve space for structures in libnvdimm +- ata: libata: reserve space for structures in libata +- elevator: reserve space for structures in elevator + +* Wed Feb 7 2024 Zheng Zengkai <zhengzengkai@huawei.com> - 6.6.0-9.0.0.5 +- !4545 add sw64 architecture support +- sw64: add signal handling support +- sw64: add system call support +- sw64: add hugetlb support +- sw64: add memory management +- sw64: add hardware match support +- sw64: add process management +- sw64: add exception handling support +- sw64: add irq handling support +- sw64: add timer support +- sw64: add topology setup routine +- sw64: add boot and setup routines +- sw64: add some other headers +- sw64: add ELF support +- sw64: add common headers +- sw64: add atomic/locking headers +- sw64: add CPU definition headers +- sw64: add build infrastructure +- !4423 kabi: reserve space for pci subsystem and thread_info +- kabi: reserve space for pci subsystem related structure +- kabi: reserve space for thread_info structure +- !3997 [OLK-6.6] openEuler-24.03 Phytium S2500 IPMI adaption +- ipmi_si: Phytium S2500 workaround for MMIO-based IPMI +- !3841 Add support for Hygon family 18h model 5h HD-Audio +- ALSA: hda: Fix single byte writing issue for Hygon family 18h model 5h +- ALSA: hda: Add support for Hygon family 18h model 5h HD-Audio +- !3835 Add support for Hygon model 6h L3 PMU +- perf/x86/uncore: Add L3 PMU support for Hygon family 18h model 6h +- !3698 enable ARM64/X86_64 CONFIG_MPTCP/CONFIG_MPTCP_IPV6 config +- mptcp: enable config CONFIG_MPTCP and CONFIG_MPTCP_IPV6 +- !3696 enable ARM64/X86 CONFIG_XDP_SOCKET、CONFIG_XDP_SOCKETS_DIAG config +- xdp: enable config CONFIG_XDP_SOCKETS and CONFIG_XDP_SOCKETS_DIAG +- !3183 [OLK-6.6] Add support Zhaoxin GPIO pinctrl +- configs: add CONFIG_PINCTRL_ZHAOXIN and KX7000 to m +- Add support Zhaoxin GPIO pinctrl +- !4539 nvme: kabi: KABI reservation for nvme_ctrl +- nvme: kabi: KABI reservation for nvme_ctrl +- !4527 v3 block: kabi: KABI reservation for blk-cgroup +- block: kabi: KABI reservation for blk-cgroup +- !4554 v3 kabi: Reserve KABI slots for fs module +- sysfs: kabi: Reserve KABI slots for bin_attribute struct +- profs: kabi: Reserve KABI slots for proc_ops struct +- dax: kabi: Reserve KABI slots for dax_* struct +- fs: kabi: Reserve KABI slots for nameidata struct +- xattr: kabi: Reserve KABI slots for xattr_handler struct +- kernfs: kabi: Reserve KABI slots for kernfs_* struct +- fanotify: kabi: Reserve KABI slots for fsnotify_* struct +- fscrypt: kabi: Reserve KABI slots for fscrypt_operations struct +- !3932 [OLK-6.6] 同步OLK-5.10 SMMU HTTU补丁 +- iommu/arm-smmu-v3: Add Arm SMMU HTTU config +- vfio/iommu_type1: Add support for manual dirty log clear +- vfio/iommu_type1: Optimize dirty bitmap population based on iommu HWDBM +- vfio/iommu_type1: Add HWDBM status maintenance +- iommu/arm-smmu-v3: Realize support_dirty_log iommu ops +- iommu/arm-smmu-v3: Realize clear_dirty_log iommu ops +- iommu/arm-smmu-v3: Realize sync_dirty_log iommu ops +- iommu/arm-smmu-v3: Realize switch_dirty_log iommu ops +- iommu/arm-smmu-v3: Add feature detection for BBML +- iommu/arm-smmu-v3: Enable HTTU for stage1 with io-pgtable mapping +- iommu/io-pgtable-arm: Add and realize clear_dirty_log ops +- iommu/io-pgtable-arm: Add and realize sync_dirty_log ops +- iommu/io-pgtable-arm: Add and realize merge_page ops +- iommu/io-pgtable-arm: Add and realize split_block ops +- iommu/io-pgtable-arm: Add __arm_lpae_set_pte +- iommu/io-pgtable-arm: Add quirk ARM_HD and ARM_BBMLx +- iommu: Introduce dirty log tracking framework +- iommu/arm-smmu-v3: Add support for Hardware Translation Table Update +- !4560 v5 block: reserve kabi space for general block layer structures +- block: reserve kabi space for general block layer structures +- !4168 Reserve syscall entries for kabi compatibility +- kabi: Reserve syscall entries for kabi compatibility +- arch: Reserve map_shadow_stack() syscall number for all architectures +- !4532 v2 fscache: reserve kabi for fscache structures +- fscache: reserve kabi for fscache structures +- !4543 v2 fs/dcache: kabi: KABI reservation for dentry +- fs/dcache: kabi: KABI reservation for dentry +- !4533 quota: kabi: KABI reservation for quota +- quota: kabi: KABI reservation for quota +- !4528 v3 jbd2: kabi: KABI reservation for jbd2 +- jbd2: kabi: KABI reservation for jbd2 +- !4483 block: kabi: KABI reservation for iocontext +- block: kabi: KABI reservation for iocontext +- !4455 scsi: iscsi: kabi: KABI reservation for scsi_transport_iscsi.h +- scsi: iscsi: kabi: KABI reservation for scsi_transport_iscsi.h +- !4456 scsi: scsi_transport_fc: kabi: KABI reservation for scsi_transport_fc +- scsi: scsi_transport_fc: kabi: KABI reservation for scsi_transport_fc +- !4472 nvmet-fc: kabi: KABI reservation for nvme_fc_port_template +- nvmet-fc: kabi: KABI reservation for nvme_fc_port_template +- !4474 scsi: libsas: kabi: KABI reservation for libsas +- scsi: libsas: kabi: KABI reservation for libsas +- !4463 RDMA/hns: Backport bugfix +- RDMA/hns: Fix memory leak in free_mr_init() +- RDMA/hns: Remove unnecessary checks for NULL in mtr_alloc_bufs() +- RDMA/hns: Add a max length of gid table +- RDMA/hns: Response dmac to userspace +- RDMA/hns: Rename the interrupts +- RDMA/hns: Support SW stats with debugfs +- RDMA/hns: Add debugfs to hns RoCE +- RDMA/hns: Fix inappropriate err code for unsupported operations +- !3838 Add support for Hygon model 4h EDAC +- EDAC/amd64: Adjust UMC channel for Hygon family 18h model 6h +- EDAC/amd64: Add support for Hygon family 18h model 6h +- EDAC/amd64: Add support for Hygon family 18h model 5h +- EDAC/mce_amd: Use struct cpuinfo_x86.logical_die_id for Hygon NodeId +- EDAC/amd64: Adjust address translation for Hygon family 18h model 4h +- EDAC/amd64: Add support for Hygon family 18h model 4h +- EDAC/amd64: Get UMC channel from the 6th nibble for Hygon +- !4408 v2 kabi: reserve space for struct acpi_device and acpi_scan_handler +- kabi: reserve space for struct acpi_device and acpi_scan_handler +- !4495 KABI reservation for driver +- audit: kabi: Remove extra semicolons +- ipmi: kabi: KABI reservation for ipmi +- mmc: kabi: KABI reservation for mmc +- mtd: kabi: KABI reservation for mtd +- tty: kabi: KABI reservation for tty +- !3831 Add support for loading Hygon microcode +- x86/microcode/hygon: Add microcode loading support for Hygon processors +- !4356 【OLK-6.6】AMD: support the UMC Performance Counters for Zen4 +- perf vendor events amd: Add Zen 4 memory controller events +- perf/x86/amd/uncore: Pass through error code for initialization failures, instead of -ENODEV +- perf/x86/amd/uncore: Fix uninitialized return value in amd_uncore_init() +- perf/x86/amd/uncore: Add memory controller support +- perf/x86/amd/uncore: Add group exclusivity +- perf/x86/amd/uncore: Use rdmsr if rdpmc is unavailable +- perf/x86/amd/uncore: Move discovery and registration +- perf/x86/amd/uncore: Refactor uncore management +- !4494 v2 writeback: kabi: KABI reservation for writeback +- writeback: kabi: KABI reservation for writeback +- !4491 sched/rt: Fix possible warn when push_rt_task +- sched/rt: Fix possible warn when push_rt_task +- !4396 [OLK-6.6] perf/x86/zhaoxin/uncore: add NULL pointer check after kzalloc +- perf/x86/zhaoxin/uncore: add NULL pointer check after kzalloc +- !4405 mm: improve performance of accounted kernel memory allocations +- mm: kmem: properly initialize local objcg variable in current_obj_cgroup() +- mm: kmem: reimplement get_obj_cgroup_from_current() +- percpu: scoped objcg protection +- mm: kmem: scoped objcg protection +- mm: kmem: make memcg keep a reference to the original objcg +- mm: kmem: add direct objcg pointer to task_struct +- mm: kmem: optimize get_obj_cgroup_from_current() +- !4500 fs: kabi: KABI reservation for vfs +- fs: kabi: KABI reservation for vfs +- !4505 iov_iter: kabi: KABI reservation for iov_iter +- iov_iter: kabi: KABI reservation for iov_iter +- !4486 v2 openeuler_defconfig: enable CONFIG_PAGE_CACHE_LIMIT +- openeuler_defconfig: enable CONFIG_PAGE_CACHE_LIMIT +- !4489 【OLK-6.6】AMD: fix brstack event for AMD Zen CPU +- perf/x86/amd: Reject branch stack for IBS events +- !4376 [OLK-6.6] Add Phytium Display Engine support to the OLK-6.6. +- DRM: Phytium display DRM doc +- DRM: Phytium display DRM driver +- !4385 v2 sched: remove __GENKSYMS__ used +- sched: remove __GENKSYMS__ used +- !4449 memory tiering: calculate abstract distance based on ACPI HMAT +- dax, kmem: calculate abstract distance with general interface +- acpi, hmat: calculate abstract distance with HMAT +- acpi, hmat: refactor hmat_register_target_initiators() +- memory tiering: add abstract distance calculation algorithms management +- !4362 ubifs: Queue up space reservation tasks if retrying many times +- ubifs: Queue up space reservation tasks if retrying many times +- !4450 change zswap's default allocator to zsmalloc +- openeuler_defconfig: set ZSWAP_ZPOOL_DEFAULT to ZSMALLOC +- zswap: change zswap's default allocator to zsmalloc +- !4298 misc for controlling fd +- cgroup/misc: support cgroup misc to control fd +- filescgroup: add adapter for legacy and misc cgroup +- filescgroup: rename filescontrol.c to legacy-filescontrol.c +- filescgroup: Add CONFIG_CGROUP_FILES at files_cgroup in files_struct +- filescgroup: remove files of dfl_cftypes. +- !4173 block: remove precise_iostat +- block: remove precise_iostat +- !4481 cred: kabi: KABI reservation for cred +- cred: kabi: KABI reservation for cred +- !4418 KABI: Add reserve space for sched structures +- KABI: Reserve space for fwnode.h +- KABI: Reserve space for struct module +- fork: Allocate a new task_struct_resvd object for fork task +- KABI: Add reserve space for sched structures +- !4355 v4 kabi reserve for memcg and cgroup_bpf +- cgroup_bpf/kabi: reserve space for cgroup_bpf related structures +- memcg/kabi: reserve space for memcg related structures +- !4476 net/kabi: Reserve space for net structures +- net/kabi: Reserve space for net structures +- !4440 v2 kabi:dma:add kabi reserve for dma_map_ops structure +- kabi:dma:add kabi reserve for dma_map_ops structure +- !4479 mm/memcontrol: fix out-of-bound access in mem_cgroup_sysctls_init +- mm/memcontrol: fix out-of-bound access in mem_cgroup_sysctls_init +- !4429 Remove unnecessary KABI reservation +- crypto: kabi: Removed unnecessary KABI reservation +- !4211 blk-mq: avoid housekeeping CPUs scheduling a worker on a non-housekeeping CPU +- blk-mq: avoid housekeeping CPUs scheduling a worker on a non-housekeeping CPU +- !4407 sched/topology: Fix cpus hotplug deadlock in check_node_limit() +- sched/topology: Fix cpus hotplug deadlock in check_node_limit() +- !4351 kabi: net: reserve space for net subsystem related structure +- kabi: net: reserve space for net subsystem related structure +- !4453 arm64/ascend: Make enable_oom_killer feature depends on ASCEND_FEATURE +- arm64/ascend: Make enable_oom_killer feature depends on ASCEND_FEATURE +- !4386 fix static scanning issues +- bond: fix static scanning issue with bond_broadcast_arp_or_nd_table_header +- tcp: fix static scanning issue with sysctl_local_port_allocation +- !4403 v2 kabi: net: reserve space for net related structure +- kabi: net: reserve space for net related structure +- !4406 v2 net/kabi: reserve space for net related structures +- net/kabi: reserve space for net related structures +- !4398 v2 vfs: reserve kabi space for vfs related structures +- vfs: reserve kabi space for vfs related structures +- !4372 kabi: reserve space for struct rate_sample +- kabi: reserve space for struct rate_sample +- !4322 cgroup_writeback: fix deadlock +- cgroup_writeback: fix deadlock in cgroup1_writeback +- !4414 Support srq record doorbell and support query srq context +- RDMA/hns: Support SRQ record doorbell +- RDMA/hns: Support SRQ restrack ops for hns driver +- RDMA/core: Add support to dump SRQ resource in RAW format +- RDMA/core: Add dedicated SRQ resource tracker function +- !4165 tlb: reserve fields for struct mmu_gather +- tlb: reserve fields for struct mmu_gather +- !4178 OLK-6.6 cred backport for kabi reserve +- cred: get rid of CONFIG_DEBUG_CREDENTIALS +- groups: Convert group_info.usage to refcount_t +- cred: switch to using atomic_long_t +- cred: add get_cred_many and put_cred_many +- !4343 v3 reserve KABI slots for file system or storage related structures +- mtd: kabi: Reserve KABI slots for mtd_device_xxx_register() related structures +- pipe: kabi: Reserve KABI slots for pipe_inode_info structure +- exportfs: kabi: Reserve KABI slots for export_operations structure +- !4200 Expose swapcache stat for memcg v1 +- memcg: remove unused do_memsw_account in memcg1_stat_format +- memcg: expose swapcache stat for memcg v1 +- !4140 backport some patches for kunpeng hccs +- soc: hisilicon: kunpeng_hccs: Support the platform with PCC type3 and interrupt ack +- doc: kunpeng_hccs: Fix incorrect email domain name +- soc: hisilicon: kunpeng_hccs: Remove an unused blank line +- soc: hisilicon: kunpeng_hccs: Add failure log for no _CRS method +- soc: hisilicon: kunpeng_hccs: Fix some incorrect format strings +- soc/hisilicon: kunpeng_hccs: Convert to platform remove callback returning void +- soc: kunpeng_hccs: Migrate to use generic PCC shmem related macros +- hwmon: (xgene) Migrate to use generic PCC shmem related macros +- i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros +- ACPI: PCC: Add PCC shared memory region command and status bitfields +- !3641 Make the cpuinfo_cur_freq interface read correctly +- cpufreq: CPPC: Keep the target core awake when reading its cpufreq rate +- arm64: cpufeature: Export cpu_has_amu_feat() +- !4410 config: Update openeuler_defconfig base on current +- config: x86: Update openeuler_defconfig base on current source code +- config: arm64: Update openeuler_defconfig base on current source code +- !4400 v2 soc: hisilicon: hisi_hbmdev: Fix compile error +- soc: hisilicon: hisi_hbmdev: Fix compile error +- !4397 v2 cryptd: kabi: Fixed boot panic +- cryptd: kabi: Fixed boot panic +- !4393 [OLK-6.6] crypto: sm4: fix the build warning issue of sm4 driver +- crypto: sm4: fix the build warning issue of sm4 driver +- !4368 cgroup/misc: fix compiling waring +- cgroup/misc: fix compiling waring +- !4364 [OLK-6.6] crypto: sm3/sm4: fix zhaoxin sm3/sm4 driver file name mismatch issue +- crypto: sm3/sm4: fix zhaoxin sm3/sm4 driver file name mismatch issue +- !4204 arm64: Turn on CONFIG_IPI_AS_NMI in openeuler_defconfig +- arm64: Turn on CONFIG_IPI_AS_NMI in openeuler_defconfig +- !4314 tracing: Reserve kabi fields +- tracing: Reserve kabi fields +- !4301 v3 kabi: reserve space for cpu cgroup and cpuset cgroup related structures +- kabi: reserve space for cpu cgroup and cpuset cgroup related structures +- !4177 kabi: reserve space for bpf related structures +- kabi: reserve space for bpf related structures +- !4354 v7 KABI reservation for IMA and crypto +- ima: kabi: KABI reservation for IMA +- crypto: kabi: KABI reservation for crypto +- !4346 v2 pciehp: fix a race between pciehp and removing operations by sysfs +- pciehp: fix a race between pciehp and removing operations by sysfs +- !4146 tcp: fix compilation issue when CONFIG_SYSCTL is disabled +- tcp: fix compilation issue when CONFIG_SYSCTL is disabled +- !4066 smb: client: fix OOB in receive_encrypted_standard() +- smb: client: fix OOB in receive_encrypted_standard() +- !3995 net: config: enable network config +- net: config: enable network config +- !3745 【OLK-6.6】Support SMT control on arm64 +- config: enable CONFIG_HOTPLUG_SMT for arm64 +- arm64: Kconfig: Enable HOTPLUG_SMT +- arm64: topology: Support SMT control on ACPI based system +- arch_topology: Support SMT control for OF based system +- arch_topology: Support basic SMT control for the driver +- !4000 audit: kabi: KABI reservation for audit +- audit: kabi: KABI reservation for audit +- !4249 ubifs: fix possible dereference after free +- ubifs: fix possible dereference after free +- !3178 [OLK-6.6] Driver for Zhaoxin SM3 and SM4 algorithm +- configs: Add Zhaoxin SM3 and SM4 algorithm configs +- Add support for Zhaoxin GMI SM4 Block Cipher algorithm +- Add support for Zhaoxin GMI SM3 Secure Hash algorithm +- !4219 Initial cleanups for vCPU hotplug +- riscv: convert to use arch_cpu_is_hotpluggable() +- riscv: Switch over to GENERIC_CPU_DEVICES +- LoongArch: convert to use arch_cpu_is_hotpluggable() +- LoongArch: Use the __weak version of arch_unregister_cpu() +- LoongArch: Switch over to GENERIC_CPU_DEVICES +- x86/topology: convert to use arch_cpu_is_hotpluggable() +- x86/topology: use weak version of arch_unregister_cpu() +- x86/topology: Switch over to GENERIC_CPU_DEVICES +- arm64: convert to arch_cpu_is_hotpluggable() +- arm64: setup: Switch over to GENERIC_CPU_DEVICES using arch_register_cpu() +- drivers: base: Print a warning instead of panic() when register_cpu() fails +- drivers: base: Move cpu_dev_init() after node_dev_init() +- drivers: base: add arch_cpu_is_hotpluggable() +- drivers: base: Implement weak arch_unregister_cpu() +- drivers: base: Allow parts of GENERIC_CPU_DEVICES to be overridden +- drivers: base: Use present CPUs in GENERIC_CPU_DEVICES +- ACPI: Move ACPI_HOTPLUG_CPU to be disabled on arm64 and riscv +- Loongarch: remove arch_*register_cpu() exports +- x86/topology: remove arch_*register_cpu() exports +- x86: intel_epb: Don't rely on link order +- arch_topology: Make register_cpu_capacity_sysctl() tolerant to late CPUs +- arm64, irqchip/gic-v3, ACPI: Move MADT GICC enabled check into a helper +- ACPI: scan: Rename acpi_scan_device_not_present() to be about enumeration +- ACPI: scan: Use the acpi_device_is_present() helper in more places +- !4215 pci: Enable acs for QLogic HBA cards +- pci: Enable acs for QLogic HBA cards +- !4267 ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() +- ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() +- !4317 [OLK-6.6] cputemp: zhaoxin: fix HWMON_THERMAL namespace not import issue +- cputemp: zhaoxin: fix HWMON_THERMAL namespace not import issue. +- !3682 cgroup and ns kabi reserve +- cgroup/misc: reserve kabi for future misc development +- cgroup/psi: reserve kabi for future psi development +- namespace: kabi: reserve for future namespace development +- cgroup: kabi: reserve space for cgroup frame +- !4291 fs:/dcache.c: fix negative dentry limit not complete problem +- fs:/dcache.c: fix negative dentry limit not complete problem +- !4292 powerpc: Add PVN support for HeXin C2000 processor +- powerpc: Add PVN support for HeXin C2000 processor +- !3129 [OLK-6.6] Driver for Zhaoxin AES and SHA algorithm +- Add Zhaoxin aes/sha items in openeuler_config +- Add support for Zhaoxin SHA algorithm +- Add support for Zhaoxin AES algorithm +- !3959 kabi: mm: add kabi reserve for mm structure +- kabi: mm: add kabi reserve for mm structure +- !4046 [OLK-6.6] Add gic support for Phytium S2500 +- Add gic support for Phytium S2500 +- !3126 [OLK-6.6] Driver for Zhaoxin HW Random Number Generator +- Add CONFIG_HW_RANDOM_ZHAOXIN in openeuler_defconfig +- Add support for Zhaoxin HW Random Number Generator +- !3169 [OLK-6.6] x86/perf: Add uncore performance events support for Zhaoxin CPU +- x86/perf: Add uncore performance events support for Zhaoxin CPU +- !3187 [OLK-6.6] Add support for Zhaoxin I2C controller +- configs: add CONFIG_I2C_ZHAOXIN to m +- Add support for Zhaoxin I2C controller +- !4164 arch/mm/fault: fix major fault accounting when retrying under per-VMA lock +- arch/mm/fault: fix major fault accounting when retrying under per-VMA lock +- !3903 kabi: Reserve space for perf subsystem related structures +- kabi: Reserve space for perf subsystem related structures +- !4128 drm/qxl: Fix missing free_irq +- drm/qxl: Fix missing free_irq +- !4050 kabi: net: reserve space for net +- kabi: net: reserve space for net sunrpc subsystem related structure +- kabi: net: reserve space for net rdma subsystem related structure +- kabi: net: reserve space for net netfilter subsystem related structure +- kabi: net: reserve space for net can subsystem related structure +- kabi: net: reserve space for net bpf subsystem related structure +- kabi: net: reserve space for net base subsystem related structure +- !3774 [OLK-6.6] sched/fair: Scan cluster before scanning LLC in wake-up path +- sched/fair: Use candidate prev/recent_used CPU if scanning failed for cluster wakeup +- sched/fair: Scan cluster before scanning LLC in wake-up path +- sched: Add cpus_share_resources API +- !3125 [OLK-6.6] Driver for Zhaoxin Serial ATA IDE +- configs: enable CONFIG_SATA_ZHAOXIN to y +- Add support for Zhaoxin Serial ATA IDE. +- !4044 Set CONFIG_NODES_SHIFT to 8 +- openeuler_defconfig: set CONFIG_NODES_SHIFT to 8 for both x86_64/ARM64 +- x86/Kconfig: allow NODES_SHIFT to be set on MAXSMP +- !3840 Remove Hygon SMBus IMC detecting +- i2c-piix4: Remove the IMC detecting for Hygon SMBus +- !3839 Add support for Hygon model 4h k10temp +- hwmon/k10temp: Add support for Hygon family 18h model 5h +- hwmon/k10temp: Add support for Hygon family 18h model 4h +- !3837 Add support for Hygon model 4h northbridge +- x86/amd_nb: Add support for Hygon family 18h model 6h +- x86/amd_nb: Add support for Hygon family 18h model 5h +- x86/amd_nb: Add northbridge support for Hygon family 18h model 4h +- x86/amd_nb: Add Hygon family 18h model 4h PCI IDs +- !4199 Support large folio for mlock +- mm: mlock: avoid folio_within_range() on KSM pages +- mm: mlock: update mlock_pte_range to handle large folio +- mm: handle large folio when large folio in VM_LOCKED VMA range +- mm: add functions folio_in_range() and folio_within_vma() +- !4147 arm64: Add CONFIG_IPI_AS_NMI to IPI as NMI feature +- arm64: Add CONFIG_IPI_AS_NMI to IPI as NMI feature +- !4159 Backport iommufd dirty tracking from v6.7 +- iommu/vt-d: Set variable intel_dirty_ops to static +- iommufd/selftest: Fix _test_mock_dirty_bitmaps() +- iommufd/selftest: Fix page-size check in iommufd_test_dirty() +- iommu/vt-d: Enhance capability check for nested parent domain allocation +- iommufd/selftest: Test IOMMU_HWPT_GET_DIRTY_BITMAP_NO_CLEAR flag +- iommufd/selftest: Test out_capabilities in IOMMU_GET_HW_INFO +- iommufd/selftest: Test IOMMU_HWPT_GET_DIRTY_BITMAP +- iommufd/selftest: Test IOMMU_HWPT_SET_DIRTY_TRACKING +- iommufd/selftest: Test IOMMU_HWPT_ALLOC_DIRTY_TRACKING +- iommufd/selftest: Expand mock_domain with dev_flags +- iommu/vt-d: Access/Dirty bit support for SS domains +- iommu/amd: Access/Dirty bit support in IOPTEs +- iommu/amd: Add domain_alloc_user based domain allocation +- iommufd: Add a flag to skip clearing of IOPTE dirty +- iommufd: Add capabilities to IOMMU_GET_HW_INFO +- iommufd: Add IOMMU_HWPT_GET_DIRTY_BITMAP +- iommufd: Add IOMMU_HWPT_SET_DIRTY_TRACKING +- iommufd: Add a flag to enforce dirty tracking on attach +- iommufd: Correct IOMMU_HWPT_ALLOC_NEST_PARENT description +- iommu: Add iommu_domain ops for dirty tracking +- iommufd/iova_bitmap: Move symbols to IOMMUFD namespace +- vfio: Move iova_bitmap into iommufd +- vfio/iova_bitmap: Export more API symbols +- iommufd/selftest: Rework TEST_LENGTH to test min_size explicitly +- iommu/vt-d: Add domain_alloc_user op +- iommufd/selftest: Add domain_alloc_user() support in iommu mock +- iommufd/selftest: Iterate idev_ids in mock_domain's alloc_hwpt test +- iommufd: Support allocating nested parent domain +- iommufd: Flow user flags for domain allocation to domain_alloc_user() +- iommufd: Use the domain_alloc_user() op for domain allocation +- iommu: Add new iommu op to create domains owned by userspace +- !4109 PCI: add a member in 'struct pci_bus' to record the original 'pci_ops' +- PCI: add a member in 'struct pci_bus' to record the original 'pci_ops' +- !4108 PCI/AER: increments pci bus reference count in aer-inject process +- PCI/AER: increments pci bus reference count in aer-inject process +- !4114 pci: do not save 'PCI_BRIDGE_CTL_BUS_RESET' +- pci: do not save 'PCI_BRIDGE_CTL_BUS_RESET' +- !4113 PCI: check BIR before mapping MSI-X Table +- PCI: check BIR before mapping MSI-X Table +- !4112 PCI: Fail MSI-X mapping if MSI-X Table offset is out of range of BAR space +- PCI: Fail MSI-X mapping if MSI-X Table offset is out of range of BAR space +- !4110 PCI: Add MCFG quirks for some Hisilicon Chip host controllers +- PCI: Add MCFG quirks for some Hisilicon Chip host controllers +- !4111 sysrq: avoid concurrently info printing by 'sysrq-trigger' +- sysrq: avoid concurrently info printing by 'sysrq-trigger' +- !4107 ntp: Avoid undefined behaviour in second_overflow() +- ntp: Avoid undefined behaviour in second_overflow() +- !4105 PCI/sysfs: Take reference on device to be removed +- PCI/sysfs: Take reference on device to be removed +- !3836 Add support for Hygon model 4h QoS +- x86/resctrl: Add Hygon QoS support +- !4154 Add per-node vmstat info and memcg info +- mm/vmstat: move pgdemote_* out of CONFIG_NUMA_BALANCING +- mm/vmstat: move pgdemote_* to per-node stats +- mm: memcg: add THP swap out info for anonymous reclaim +- !4170 mm/ksm: generalize ksm_process_profit +- mm/ksm: generalize ksm_process_profit +- !4120 arm_mpam: support mpam feature in OLK-6.6 +- arm_mpam: control memory bandwidth with hard limit flag +- fs/resctrl: Remove the limit on the number of CLOSID +- arm_mpam: resctrl: Update the rmid reallocation limit +- arm_mpam: resctrl: Call resctrl_exit() in the event of errors +- arm_mpam: resctrl: Tell resctrl about cpu/domain online/offline +- perf/arm-cmn: Stop claiming all the resources +- arm64: mpam: Select ARCH_HAS_CPU_RESCTRL +- arm_mpam: resctrl: Add dummy definition for free running counters +- arm_mpam: resctrl: Add empty definitions for fine-grained enables +- arm_mpam: resctrl: Add empty definitions for pseudo lock +- untested: arm_mpam: resctrl: Allow monitors to be configured +- arm_mpam: resctrl: Add resctrl_arch_rmid_read() and resctrl_arch_reset_rmid() +- arm_mpam: resctrl: Allow resctrl to allocate monitors +- untested: arm_mpam: resctrl: Add support for mbm counters +- untested: arm_mpam: resctrl: Add support for MB resource +- arm_mpam: resctrl: Add rmid index helpers +- arm64: mpam: Add helpers to change a tasks and cpu mpam partid/pmg values +- arm_mpam: resctrl: Add CDP emulation +- arm_mpam: resctrl: Implement helpers to update configuration +- arm_mpam: resctrl: Add resctrl_arch_get_config() +- arm_mpam: resctrl: Implement resctrl_arch_reset_resources() +- arm_mpam: resctrl: Pick a value for num_rmid +- arm_mpam: resctrl: Pick the caches we will use as resctrl resources +- arm_mpam: resctrl: Add boilerplate cpuhp and domain allocation +- arm_mpam: Add helper to reset saved mbwu state +- arm_mpam: Use long MBWU counters if supported +- arm_mpam: Probe for long/lwd mbwu counters +- arm_mpam: Track bandwidth counter state for overflow and power management +- arm_mpam: Add mpam_msmon_read() to read monitor value +- arm_mpam: Add helpers to allocate monitors +- arm_mpam: Probe and reset the rest of the features +- arm_mpam: Allow configuration to be applied and restored during cpu online +- arm_mpam: Use the arch static key to indicate when mpam is enabled +- arm_mpam: Register and enable IRQs +- arm_mpam: Extend reset logic to allow devices to be reset any time +- arm_mpam: Add a helper to touch an MSC from any CPU +- arm_mpam: Reset MSC controls from cpu hp callbacks +- arm_mpam: Merge supported features during mpam_enable() into mpam_class +- arm_mpam: Probe the hardware features resctrl supports +- arm_mpam: Probe MSCs to find the supported partid/pmg values +- arm_mpam: Add cpuhp callbacks to probe MSC hardware +- arm_mpam: Add MPAM MSC register layout definitions +- arm_mpam: Add the class and component structures for ris firmware described +- arm_mpam: Add probe/remove for mpam msc driver and kbuild boiler plate +- dt-bindings: arm: Add MPAM MSC binding +- ACPI / MPAM: Parse the MPAM table +- drivers: base: cacheinfo: Add helper to find the cache size from cpu+level +- cacheinfo: Expose the code to generate a cache-id from a device_node +- cacheinfo: Set cache 'id' based on DT data +- cacheinfo: Allow for >32-bit cache 'id' +- ACPI / PPTT: Add a helper to fill a cpumask from a cache_id +- ACPI / PPTT: Add a helper to fill a cpumask from a processor container +- ACPI / PPTT: Find PPTT cache level by ID +- ACPI / PPTT: Provide a helper to walk processor containers +- untested: KVM: arm64: Force guest EL1 to use user-space's partid configuration +- arm64: mpam: Context switch the MPAM registers +- KVM: arm64: Disable MPAM visibility by default, and handle traps +- KVM: arm64: Fix missing traps of guest accesses to the MPAM registers +- arm64: cpufeature: discover CPU support for MPAM +- arm64: head.S: Initialise MPAM EL2 registers and disable traps +- x86/resctrl: Move the filesystem portions of resctrl to live in '/fs/' +- x86/resctrl: Move the filesystem bits to headers visible to fs/resctrl +- fs/resctrl: Add boiler plate for external resctrl code +- x86/resctrl: Drop __init/__exit on assorted symbols +- x86/resctrl: Describe resctrl's bitmap size assumptions +- x86/resctrl: Claim get_domain_from_cpu() for resctrl +- x86/resctrl: Move get_config_index() to a header +- x86/resctrl: Move thread_throttle_mode_init() to be managed by resctrl +- x86/resctrl: Make resctrl_arch_pseudo_lock_fn() take a plr +- x86/resctrl: Make prefetch_disable_bits belong to the arch code +- x86/resctrl: Allow an architecture to disable pseudo lock +- x86/resctrl: Allow resctrl_arch_mon_event_config_write() to return an error +- x86/resctrl: Change mon_event_config_{read,write}() to be arch helpers +- x86/resctrl: Add resctrl_arch_is_evt_configurable() to abstract BMEC +- x86/resctrl: Export the is_mbm_*_enabled() helpers to asm/resctrl.h +- x86/resctrl: Stop using the for_each_*_rdt_resource() walkers +- x86/resctrl: Move max_{name,data}_width into resctrl code +- x86/resctrl: Move monitor exit work to a restrl exit call +- x86/resctrl: Move monitor init work to a resctrl init call +- x86/resctrl: Add a resctrl helper to reset all the resources +- x86/resctrl: Move resctrl types to a separate header +- x86/resctrl: Wrap resctrl_arch_find_domain() around rdt_find_domain() +- x86/resctrl: Export resctrl fs's init function +- x86/resctrl: Remove rdtgroup from update_cpu_closid_rmid() +- x86/resctrl: Add helper for setting CPU default properties +- x86/resctrl: Move ctrlval string parsing links away from the arch code +- x86/resctrl: Add a helper to avoid reaching into the arch code resource list +- x86/resctrl: Separate arch and fs resctrl locks +- x86/resctrl: Move domain helper migration into resctrl_offline_cpu() +- x86/resctrl: Add CPU offline callback for resctrl work +- x86/resctrl: Allow overflow/limbo handlers to be scheduled on any-but cpu +- x86/resctrl: Add CPU online callback for resctrl work +- x86/resctrl: Add helpers for system wide mon/alloc capable +- x86/resctrl: Make rdt_enable_key the arch's decision to switch +- x86/resctrl: Move alloc/mon static keys into helpers +- x86/resctrl: Make resctrl_mounted checks explicit +- x86/resctrl: Allow arch to allocate memory needed in resctrl_arch_rmid_read() +- x86/resctrl: Allow resctrl_arch_rmid_read() to sleep +- x86/resctrl: Queue mon_event_read() instead of sending an IPI +- x86/resctrl: Add cpumask_any_housekeeping() for limbo/overflow +- x86/resctrl: Move CLOSID/RMID matching and setting to use helpers +- x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid +- x86/resctrl: Use __set_bit()/__clear_bit() instead of open coding +- x86/resctrl: Track the number of dirty RMID a CLOSID has +- x86/resctrl: Allow RMID allocation to be scoped by CLOSID +- x86/resctrl: Access per-rmid structures by index +- x86/resctrl: Track the closid with the rmid +- x86/resctrl: Move rmid allocation out of mkdir_rdt_prepare() +- x86/resctrl: Create helper for RMID allocation and mondata dir creation +- x86/resctrl: kfree() rmid_ptrs from resctrl_exit() +- tick/nohz: Move tick_nohz_full_mask declaration outside the #ifdef +- x86/resctrl: Display RMID of resource group +- x86/resctrl: Add support for the files of MON groups only +- x86/resctrl: Display CLOSID for resource group +- x86/resctrl: Introduce "-o debug" mount option +- x86/resctrl: Move default group file creation to mount +- x86/resctrl: Unwind properly from rdt_enable_ctx() +- x86/resctrl: Rename rftype flags for consistency +- x86/resctrl: Simplify rftype flag definitions +- x86/resctrl: Add multiple tasks to the resctrl group at once +- x86/resctrl: Fix remaining kernel-doc warnings +- !3834 Add support for Hygon model 4h IOAPIC +- iommu/hygon: Add support for Hygon family 18h model 4h IOAPIC +- !3830 Add support for Hygon model 5h CPU cache +- x86/cpu: Get LLC ID for Hygon family 18h model 5h +- !3311 Add support for Hygon model 4h CPU topology +- x86/cpu/hygon: Fix __max_die_per_package for Hygon family 18h model 4h +- !3124 [OLK-6.6] Add support for Zhaoxin HDAC and codec +- ALSA: hda: Add support of Zhaoxin NB HDAC codec +- ALSA: hda: Add support of Zhaoxin NB HDAC +- ALSA: hda: Add support of Zhaoxin SB HDAC +- !3098 [OLK-6.6] Add support for Zhaoxin Processors +- x86/cpu: Add detect extended topology for Zhaoxin CPUs +- x86/cpufeatures: Add Zhaoxin feature bits +- !3742 arch/powerpc: add ppc little endian openuler defconfig +- arch/powerpc: add ppc little endian openuler defconfig +- !4099 Intel: Backport SRF LBR branch counter support to kernel v6.6 +- perf/x86/intel: Support branch counters logging +- perf/x86/intel: Reorganize attrs and is_visible +- perf: Add branch_sample_call_stack +- perf/x86: Add PERF_X86_EVENT_NEEDS_BRANCH_STACK flag +- perf: Add branch stack counters +- !3177 [OLK-6.6] Add MWAIT Cx support for Zhaoxin CPUs +- Add MWAIT Cx support for Zhaoxin CPUs +- !3170 [OLK-6.6] rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs +- rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs +- !3131 [OLK-6.6] Driver for Zhaoxin CPU core temperature monitoring +- Add CONFIG_SENSORS_ZHAOXIN_CPUTEMP in openeuler_defconfig +- Add support for Zhaoxin core temperature monitoring +- !3102 [OLK-6.6] x86/mce: Add Centaur MCA support +- x86/mce: Add Centaur MCA support +- !4116 Intel: Backport GNR/SRF PMU uncore support to kernel v6.6 +- perf/x86/intel/uncore: Support Sierra Forest and Grand Ridge +- perf/x86/intel/uncore: Support IIO free-running counters on GNR +- perf/x86/intel/uncore: Support Granite Rapids +- perf/x86/uncore: Use u64 to replace unsigned for the uncore offsets array +- perf/x86/intel/uncore: Generic uncore_get_uncores and MMIO format of SPR +- !4115 Intel: Backport In Field Scan(IFS) SAF & Array BIST support for GNR & SRF +- platform/x86/intel/ifs: ARRAY BIST for Sierra Forest +- platform/x86/intel/ifs: Add new error code +- platform/x86/intel/ifs: Add new CPU support +- platform/x86/intel/ifs: Metadata validation for start_chunk +- platform/x86/intel/ifs: Validate image size +- platform/x86/intel/ifs: Gen2 Scan test support +- platform/x86/intel/ifs: Gen2 scan image loading +- platform/x86/intel/ifs: Refactor image loading code +- platform/x86/intel/ifs: Store IFS generation number +- !4103 [OLK-6.6] Intel: microcode restructuring backport +- x86/setup: Make relocated_ramdisk a local variable of relocate_initrd() +- x86/microcode/intel: Add a minimum required revision for late loading +- x86/microcode: Prepare for minimal revision check +- x86/microcode: Handle "offline" CPUs correctly +- x86/apic: Provide apic_force_nmi_on_cpu() +- x86/microcode: Protect against instrumentation +- x86/microcode: Rendezvous and load in NMI +- x86/microcode: Replace the all-in-one rendevous handler +- x86/microcode: Provide new control functions +- x86/microcode: Add per CPU control field +- x86/microcode: Add per CPU result state +- x86/microcode: Sanitize __wait_for_cpus() +- x86/microcode: Clarify the late load logic +- x86/microcode: Handle "nosmt" correctly +- x86/microcode: Clean up mc_cpu_down_prep() +- x86/microcode: Get rid of the schedule work indirection +- x86/microcode: Mop up early loading leftovers +- x86/microcode/amd: Use cached microcode for AP load +- x86/microcode/amd: Cache builtin/initrd microcode early +- x86/microcode/amd: Cache builtin microcode too +- x86/microcode/amd: Use correct per CPU ucode_cpu_info +- x86/microcode: Remove pointless apply() invocation +- x86/microcode/intel: Rework intel_find_matching_signature() +- x86/microcode/intel: Reuse intel_cpu_collect_info() +- x86/microcode/intel: Rework intel_cpu_collect_info() +- x86/microcode/intel: Unify microcode apply() functions +- x86/microcode/intel: Switch to kvmalloc() +- x86/microcode/intel: Save the microcode only after a successful late-load +- x86/microcode/intel: Simplify early loading +- x86/microcode/intel: Cleanup code further +- x86/microcode/intel: Simplify and rename generic_load_microcode() +- x86/microcode/intel: Simplify scan_microcode() +- x86/microcode/intel: Rip out mixed stepping support for Intel CPUs +- x86/microcode/32: Move early loading after paging enable +- x86/boot/32: Temporarily map initrd for microcode loading +- x86/microcode: Provide CONFIG_MICROCODE_INITRD32 +- x86/boot/32: Restructure mk_early_pgtbl_32() +- x86/boot/32: De-uglify the 2/3 level paging difference in mk_early_pgtbl_32() +- x86/boot: Use __pa_nodebug() in mk_early_pgtbl_32() +- x86/boot/32: Disable stackprotector and tracing for mk_early_pgtbl_32() +- x86/microcode/amd: Fix snprintf() format string warning in W=1 build +- !4102 Intel: Backport Sierra Forest(SRF) perf cstate support to kernel OLK-6.6 +- perf/x86/intel/cstate: Add Grand Ridge support +- perf/x86/intel/cstate: Add Sierra Forest support +- x86/smp: Export symbol cpu_clustergroup_mask() +- perf/x86/intel/cstate: Cleanup duplicate attr_groups +- !4104 arm64: Add the arm64.nolse command line option +- arm64: Add the arm64.nolse command line option +- !4093 introduce smart_grid zone +- smart_grid: introduce smart_grid cmdline +- smart_grid: cpufreq: introduce smart_grid cpufreq control +- smart_grid: introduce smart_grid_strategy_ctrl sysctl +- smart_grid: introduce /proc/pid/smart_grid_level +- sched: introduce smart grid qos zone +- config: enable CONFIG_QOS_SCHED_SMART_GRID by default +- sched: smart grid: init sched_grid_qos structure on QOS purpose +- sched: Introduce smart grid scheduling strategy for cfs + +* Wed Jan 31 2024 Jialin Zhang <zhangjialin11@huawei.com> - 6.6.0-6.0.0.4 +- Module.kabi_aarch64 and Module.kabi_x86_64 v1 + +* Tue Jan 23 2024 Zheng Zengkai <zhengzengkai@huawei.com> - 6.6.0-6.0.0.3 +- !4087 backport two page_owner patchsets: +- mm/page_owner: record and dump free_pid and free_tgid +- tools/mm: update the usage output to be more organized +- tools/mm: fix the default case for page_owner_sort +- tools/mm: filter out timestamps for correct collation +- tools/mm: remove references to free_ts from page_owner_sort +- mm/page_owner: remove free_ts from page_owner output +- !4070 Backport etmem feature to OLK 6.6 +- etmem: enable etmem configurations +- etmem: add original kernel swap enabled options +- etmem: add etmem swap feature +- mm: Export symbol reclaim_pages +- etmem: add etmem scan feature +- mm: Export symbol walk_page_range +- mm: Export symbol __pud_trans_huge_lock +- etmem: add ETMEM scan feature CONFIG to mm/Kconfig +- etmem: add ETMEM feature CONFIG to mm/Kconfig +- !3444 LoongArch: fix some pci problems +- LoongArch: pci root bridige set acpi companion only when not acpi_disabled. +- PCI: irq: Add early_param pci_irq_limit to limit pci irq numbers +- PCI: fix X server auto probe fail when both ast and etnaviv drm present +- PCI: LS7A2000: fix GPU card error +- PCI: LS7A2000: fix pm transition of devices under pcie port +- LoongArch: fix some PCIE card not scanning properly +- PCI: fix kabi error caused by pm_suspend_target_state +- PCI: PM: fix pcie mrrs restoring +- PCI: Check if the pci controller can use both CFG0 and CFG1 mode to access configuration space +- PCI: Check if entry->offset already exist for mem resource +- LS7A2000: Add quirk for OHCI device rev 0x02 +- !4027 [OLK-6.6] Intel RDT non-contiguous CBM support +- Documentation/x86: Document resctrl's new sparse_masks +- x86/resctrl: Add sparse_masks file in info +- x86/resctrl: Enable non-contiguous CBMs in Intel CAT +- x86/resctrl: Rename arch_has_sparse_bitmaps +- !4098 sched: programmable: Fix is_cpu_allowed build error +- sched: programmable: Fix is_cpu_allowed build error +- !4072 cgroup/misc: openeuler_defconfig open misc config by default +- cgroup/misc: openeuler_defconfig open misc config by default +- !4053 sched: basic infrastructure for scheduler bpf +- openeuler_defconfig: enable CONFIG_BPF_SCHED +- sched: programmable: Add hook in can_migrate_task() +- sched: programmable: Add hook in select_task_rq_fair() +- sched: introduce bpf_sched_enable() +- sched: basic infrastructure for scheduler bpf +- sched: programmable: Add user interface of task tag +- sched: programmable: Add user interface of task group tag +- sched: programmable: Add a tag for the task group +- sched: programmable: Add a tag for the task +- sched: programmable: Introduce bpf sched +- !4068 mm/oom_kill: fix NULL pointer dereference in memcg_print_bad_task() +- mm/oom_kill: fix NULL pointer dereference in memcg_print_bad_task() +- !4036 ubi: fix slab-out-of-bounds in ubi_eba_get_ldesc+0xfb/0x130 +- ubi: fix slab-out-of-bounds in ubi_eba_get_ldesc+0xfb/0x130 +- !3971 optimize inlining +- make OPTIMIZE_INLINING config editable +- Revert "compiler: remove CONFIG_OPTIMIZE_INLINING entirely" +- !3631 drm: fix free illegal pointer when create drm_property_blob failed +- drm: fix free illegal pointer when create drm_property_blob failed +- !3958 Revert "drm/prime: Unexport helpers for fd/handle conversion" +- Revert "drm/prime: Unexport helpers for fd/handle conversion" +- !3670 Add initial openeuler_defconfig for riscv64 +- config: add initial openeuler_defconfig for riscv64 +- !3895 Spark SQL scenario bpf readahead optimization synchronization to OLK-6.6 +- selftests/bpf: Update the demo file_read_pattern to run on libbpf 1.0+ +- VFS: Rolling Back the fmode macro definition and structure members +- selftests/bpf: add demo for file read pattern detection +- ext4: add trace for the read and release of regular file +- xfs: add trace for read and release of regular file +- fs: add helper fs_file_read_do_trace() +- vfs: add bare tracepoints for vfs read and release +- readahead: introduce FMODE_CTL_WILLNEED to read first 2MB of file +- !3964 drivers: hooks: add bonding driver vendor hooks +- drivers: hooks: add bonding driver vendor hooks +- !3996 hfs: fix null-ptr-deref in hfs_find_init() +- hfs: fix null-ptr-deref in hfs_find_init() +- !3976 Introduce dynamic pool feature +- mm/dynamic_pool: enable CONFIG_DYNAMIC_POOL on x86_64 and arm64 by default +- mm/dynamic_pool: add Document for dynamic hugetlb feature +- mm/dynamic_pool: compatible with memory hwpoison +- mm/dynamic_pool: compatible with HugeTLB Vmemmap +- mm/dynamic_pool: compatible with HugeTLB dissolve +- mm/dynamic_pool: disable THP for task attached with dpool +- mm/dynamic_pool: fill dpool with pagelist +- mm/dynamic_pool: add tracepoints for dpool +- mm/dynamic_pool: support HugeTLB page allocation from dpool +- mm/dynamic_pool: check resv for HugeTLB allocation from dpool +- mm/dynamic_pool: speed up allocation by percpu pages pool +- mm/dynamic_pool: support page allocation from dpool +- mm/dynamic_pool: prevent task attach to another dpool +- mm/dynamic_pool: call mem_cgroup_force_empty before restore pool +- mm/dynamic_pool: migrate used pages before promote to huge page +- mm/dynamic_pool: support to flow pages between 2M and 4K pages pool +- mm/dynamic_pool: support to flow pages between 1G and 2M pages pool +- mm/dynamic_pool: add restore_pool ops to reclaim memory and restore hugepages +- mm/dynamic_pool: add interface to configure the count of hugepages +- mm/dynamic_pool: fill dpool with HugeTLB 1G pages +- mm/dynamic_pool: create dpool by dhugetlb.nr_pages interface +- mm/dynamic_pool: introduce PG_pool to mark pages allocated from dpool +- mm/dynamic_pool: introduce PG_dpool to mark free pages in dpool +- mm/dynamic_pool: introduce per-memcg memory pool +- mm/memcg: introduce memcg_has_children to check memcg +- mm/memcg: introduce mem_cgroup_scan_cgroups to scan all memcgs +- !3833 xfs: fix block space problems +- xfs: longest free extent no need consider postalloc +- xfs: fix xfs shutdown since we reserve more blocks in agfl fixup +- xfs: set minleft correctly for randomly sparse inode allocations +- xfs: account extra freespace btree splits for multiple allocations +- !3902 xfs: update the last_sync_lsn with ctx start lsn +- xfs: update the last_sync_lsn with ctx start lsn +- !3977 Terrace Service Acceleration +- bpf, sockmap: Add sk_rmem_alloc check for sockmap +- bpf: Add new bpf helper to get SO_ORIGINAL_DST/REPLY_SRC +- bpf: Add bpf_get_sockops_uid_gid helper function +- net: core: Add a GID field to struct sock. +- !3974 Add support for mbigen to generate SPIs +- dt-bindings/irqchip/mbigen: add example of MBIGEN generate SPIs +- irqchip/mbigen: add support for a MBIGEN generating SPIs +- irqchip/mbigen: rename register marcros +- !3963 block: Add config to show info about opening a mounted device for write +- add config about writing mounted devices in openeuler_defconfig +- block: Show info about opening a lower device for write while upper-layers mounted +- block: Add config option to show info about opening a mounted device for write +- block: Add config option to detect writing to part0 while partitions mounted +- block: Expand the meaning of bdev_allow_write_mounted +- block: Record writing and mounting regardless of whether bdev_allow_write_mounted is set +- !3921 mm: mem_reliable: Introduce memory reliable +- config: enable MEMORY_RELIABLE by default +- mm: mem_reliable: Show debug info about memory reliable if oom occurs +- mm: mem_reliable: Introduce proc interface to disable memory reliable features +- proc: mem_reliable: Count reliable memory usage of reliable tasks +- mm: mem_reliable: Introduce fallback mechanism for memory reliable +- mm: mem_reliable: Add limiting the usage of reliable memory +- mm: mem_reliable: Show reliable meminfo +- mm: mem_reliable: Count reliable shmem usage +- mm: mem_reliable: Count reliable page cache usage +- mm: mem_reliable: Add cmdline reliable_debug to enable separate feature +- mm/hugetlb: Allocate non-mirrored memory by default +- mm/memblock: Introduce ability to alloc memory from specify memory region +- mm: mem_reliable: Add memory reliable support during hugepaged collapse +- mm: mem_reliable: Alloc pagecache from reliable region +- shmem: mem_reliable: Alloc shmem from reliable region +- mm: mem_reliable: Alloc task memory from reliable region +- mm: mem_reliable: Introduce memory reliable +- efi: Disable mirror feature during crashkernel +- proc: introduce proc_hide_ents to hide proc files +- !3935 pid_ns: Make pid_max per namespace +- pid_ns: Make pid_max per namespace +- !3913 arm64: Add non nmi ipi backtrace support +- arm64: Add non nmi ipi backtrace support +- !3785 【OLK-6.6】PSI cgroupv1 and PSI fine grained +- sched/psi: enable PSI_CGROUP_V1 and PSI_FINE_GRAINED in openeuler_defconfig +- sched/psi: add cpu fine grained stall tracking in pressure.stat +- sched/psi: add more memory fine grained stall tracking in pressure.stat +- sched/psi: Introduce pressure.stat in psi +- sched/psi: Introduce avgs and total calculation for cgroup reclaim +- sched/psi: Introduce fine grained stall time collect for cgroup reclaim +- sched/psi: introduce tracepoints for psi_memstall_{enter, leave} +- sched/psi: update psi irqtime when the irq delta is nozero +- sched/psi: Export cgroup psi from cgroupv2 to cgroupv1 +- sched/psi: Bail out early from irq time accounting +- !3907 cgroup: Support iocost for cgroup v1 +- openeuler_defconfig: enable iocost in openeuler_defconfig for x86 and arm64 +- cgroup: Support iocost for cgroup v1 +- !3897 Some simple extensions of the kfence feature +- arm64: kfence: scale sample_interval to support early init for kfence. +- kfence: Add a module parameter to adjust kfence objects +- !3888 fs/dcache.c: avoid panic while lockref of dentry overflow +- fs/dcache.c: avoid panic while lockref of dentry overflow +- !3894 Add swap control for memcg +- config: enable memcg swap qos for x86_64 and arm64 by default +- memcg/swap: add ability to disable memcg swap +- mm: swap_slots: add per-type slot cache +- mm/swapfile: introduce per-memcg swapfile control +- memcg: add restrict to swap to cgroup1 +- memcg: introduce per-memcg swapin interface +- memcg: introduce memcg swap qos feature +- memcg: make sysctl registration more extensible +- memcg: add page type to memory.reclaim interface +- !3827 backport mainline md patch +- dm-raid: delay flushing event_work() after reconfig_mutex is released +- md/raid1: support read error check +- md: factor out a helper exceed_read_errors() to check read_errors +- md: Whenassemble the array, consult the superblock of the freshest device +- md/raid1: remove unnecessary null checking +- md: split MD_RECOVERY_NEEDED out of mddev_resume +- md: fix stopping sync thread +- md: fix missing flush of sync_work +- md: synchronize flush io with array reconfiguration +- md/md-multipath: remove rcu protection to access rdev from conf +- md/raid5: remove rcu protection to access rdev from conf +- md/raid1: remove rcu protection to access rdev from conf +- md/raid10: remove rcu protection to access rdev from conf +- md: remove flag RemoveSynchronized +- Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" +- md: bypass block throttle for superblock update +- md: cleanup pers->prepare_suspend() +- md-cluster: check for timeout while a new disk adding +- md: rename __mddev_suspend/resume() back to mddev_suspend/resume() +- md: remove old apis to suspend the array +- md: suspend array in md_start_sync() if array need reconfiguration +- md/raid5: replace suspend with quiesce() callback +- md/md-linear: cleanup linear_add() +- md: cleanup mddev_create/destroy_serial_pool() +- md: use new apis to suspend array before mddev_create/destroy_serial_pool +- md: use new apis to suspend array for ioctls involed array reconfiguration +- md: use new apis to suspend array for adding/removing rdev from state_store() +- md: use new apis to suspend array for sysfs apis +- md/raid5: use new apis to suspend array +- md/raid5-cache: use new apis to suspend array +- md/md-bitmap: use new apis to suspend array for location_store() +- md/dm-raid: use new apis to suspend array +- md: add new helpers to suspend/resume and lock/unlock array +- md: add new helpers to suspend/resume array +- md: replace is_md_suspended() with 'mddev->suspended' in md_check_recovery() +- md/raid5-cache: use READ_ONCE/WRITE_ONCE for 'conf->log' +- md: use READ_ONCE/WRITE_ONCE for 'suspend_lo' and 'suspend_hi' +- md/raid1: don't split discard io for write behind +- md: do not require mddev_lock() for all options in array_state_store() +- md: simplify md_seq_ops +- md: factor out a helper from mddev_put() +- md: replace deprecated strncpy with memcpy +- md: don't check 'mddev->pers' and 'pers->quiesce' from suspend_lo_store() +- md: don't check 'mddev->pers' from suspend_hi_store() +- md-bitmap: suspend array earlier in location_store() +- md-bitmap: remove the checking of 'pers->quiesce' from location_store() +- md: initialize 'writes_pending' while allocating mddev +- md: initialize 'active_io' while allocating mddev +- md: delay remove_and_add_spares() for read only array to md_start_sync() +- md: factor out a helper rdev_addable() from remove_and_add_spares() +- md: factor out a helper rdev_is_spare() from remove_and_add_spares() +- md: factor out a helper rdev_removeable() from remove_and_add_spares() +- md: delay choosing sync action to md_start_sync() +- md: factor out a helper to choose sync action from md_check_recovery() +- md: use separate work_struct for md_start_sync() +- !3857 scsi: fix use-after-free problem in scsi_remove_target +- scsi: fix use-after-free problem in scsi_remove_target +- !3906 sched/core: Change depends of SCHED_CORE +- sched/core: Change depends of SCHED_CORE +- !3747 Introduce multiple qos level +- config: Enable CONFIG_QOS_SCHED_MULTILEVEL +- sched/fair: Introduce multiple qos level +- !3899 fs/dirty_pages: dump the number of dirty pages for each inode +- fs/dirty_pages: dump the number of dirty pages for each inode +- !3815 JFFS2: Fix the race issues caused by the GC of jffs2 +- jffs2: reset pino_nlink to 0 when inode creation failed +- jffs2: make the overwritten xattr invisible after remount +- jffs2: handle INO_STATE_CLEARING in jffs2_do_read_inode() +- jffs2: protect no-raw-node-ref check of inocache by erase_completion_lock +- !3891 block: support to account io_ticks precisely +- block: support to account io_ticks precisely +- !3881 iommu: set CONFIG_SMMU_BYPASS_DEV=y +- iommu: set CONFIG_SMMU_BYPASS_DEV=y +- !3819 support ext3/ext4 netlink error report. +- Add new config 'CONFIG_EXT4_ERROR_REPORT' to control ext3/4 error reporting +- ext4: report error to userspace by netlink +- !3720 blk-mq: make fair tag sharing configurable +- scsi_lib: disable fair tag sharing by default if total tags is less than 128 +- scsi: core: make fair tag sharing configurable via sysfs +- blk-mq: add apis to disable fair tag sharing +- !3090 fs/dcache.c: avoid softlock since too many negative dentry +- fs/dcache.c: avoid softlock since too many negative dentry +- !3656 iommu: Enable smmu-v3 when 3408iMR/3416iMRraid card exist +- iommu: Enable smmu-v3 when 3408iMR/3416iMRraid card exist +- !3843 [OLK-6.6] export cgroup.stat from cgroupv2 to cgroupv1 +- cgroup: Export cgroup.stat from cgroupv2 to cgroupv1 +- !3828 openeuler_defconfig: enable erofs ondemand for x86 and arm64 +- openeuler_defconfig: enable erofs ondemand for x86 and arm64 +- !3851 ext4: fix slab-out-of-bounds in ext4_find_extent() +- ext4: check magic even the extent block bh is verified +- ext4: avoid recheck extent for EXT4_EX_FORCE_CACHE +- !3850 aio: add timeout validity check for io_[p +- aio: add timeout validity check for io_[p]getevents +- !3849 pipe: Fix endless sleep problem due to the out-of-order +- pipe: Fix endless sleep problem due to the out-of-order +- !3787 scsi: sd: unregister device if device_add_disk() failed in sd_probe() +- scsi: sd: unregister device if device_add_disk() failed in sd_probe() +- !3450 Backport nbd bugfix patch +- nbd: pass nbd_sock to nbd_read_reply() instead of index +- nbd: fix null-ptr-dereference while accessing 'nbd->config' +- nbd: factor out a helper to get nbd_config without holding 'config_lock' +- nbd: fold nbd config initialization into nbd_alloc_config() +- !3675 block mainline bugfix backport +- block: Set memalloc_noio to false on device_add_disk() error path +- block: add check of 'minors' and 'first_minor' in device_add_disk() +- block: add check that partition length needs to be aligned with block size +- !3786 ubi: block: fix memleak in ubiblock_create() +- ubi: block: fix memleak in ubiblock_create() +- !3448 ubi: block: Fix use-after-free in ubiblock_cleanup +- ubi: block: Fix use-after-free in ubiblock_cleanup +- !3760 Add huge page allocation limit +- openeuler_defconfig: enable HUGETLB_ALLOC_LIMIT +- hugetlb: Add huge page allocation limit +- !3818 [sync] PR-1989: support Android vendor hooks +- openeuler_defconfig: enable CONFIG_VENDOR_HOOKS for x86 and arm64 +- vendor_hooks: make android vendor hooks feature generic. +- ANDROID: fixup restricted hooks after tracepont refactoring +- ANDROID: simplify vendor hooks for non-GKI builds +- ANDROID: vendor_hooks: fix __section macro +- ANDROID: use static_call() for restricted hooks +- ANDROID: fix redefinition error for restricted vendor hooks +- ANDROID: add support for vendor hooks +- !3502 ARM: LPAE: Use phys_addr_t instead of unsigned long in outercache hooks +- ARM: LPAE: Use phys_addr_t instead of unsigned long in outercache hooks +- !3755 livepatch/core: Fix miss disable ro for MOD_RO_AFTER_INIT memory +- livepatch/core: Fix miss disable ro for MOD_RO_AFTER_INIT memory +- !3813 kernel: add OPENEULER_VERSION_CODE to version.h +- kernel: add OPENEULER_VERSION_CODE to version.h +- !3744 Add NUMA-awareness to qspinlock +- config: Enable CONFIG_NUMA_AWARE_SPINLOCKS on x86 +- locking/qspinlock: Disable CNA by default +- locking/qspinlock: Introduce the shuffle reduction optimization into CNA +- locking/qspinlock: Avoid moving certain threads between waiting queues in CNA +- locking/qspinlock: Introduce starvation avoidance into CNA +- locking/qspinlock: Introduce CNA into the slow path of qspinlock +- locking/qspinlock: Refactor the qspinlock slow path +- locking/qspinlock: Rename mcs lock/unlock macros and make them more generic +- !3517 support CLOCKSOURCE_VALIDATE_LAST_CYCLE on +- config: make CLOCKSOURCE_VALIDATE_LAST_CYCLE not set by default +- timekeeping: Make CLOCKSOURCE_VALIDATE_LAST_CYCLE configurable +- !3710 Backport 6.6.7 LTS Patches +- drm/amdgpu: Restrict extended wait to PSP v13.0.6 +- drm/amdgpu: update retry times for psp BL wait +- drm/amdgpu: Fix refclk reporting for SMU v13.0.6 +- riscv: Kconfig: Add select ARM_AMBA to SOC_STARFIVE +- gcc-plugins: randstruct: Update code comment in relayout_struct() +- ASoC: qcom: sc8280xp: Limit speaker digital volumes +- netfilter: nft_set_pipapo: skip inactive elements during set walk +- MIPS: Loongson64: Enable DMA noncoherent support +- MIPS: Loongson64: Handle more memory types passed from firmware +- MIPS: Loongson64: Reserve vgabios memory on boot +- perf metrics: Avoid segv if default metricgroup isn't set +- perf list: Fix JSON segfault by setting the used skip_duplicate_pmus callback +- KVM: SVM: Update EFER software model on CR0 trap for SEV-ES +- KVM: s390/mm: Properly reset no-dat +- MIPS: kernel: Clear FPU states when setting up kernel threads +- cifs: Fix flushing, invalidation and file size with FICLONE +- cifs: Fix flushing, invalidation and file size with copy_file_range() +- USB: gadget: core: adjust uevent timing on gadget unbind +- powerpc/ftrace: Fix stack teardown in ftrace_no_trace +- x86/CPU/AMD: Check vendor in the AMD microcode callback +- devcoredump: Send uevent once devcd is ready +- serial: 8250_omap: Add earlycon support for the AM654 UART controller +- serial: 8250: 8250_omap: Do not start RX DMA on THRI interrupt +- serial: 8250: 8250_omap: Clear UART_HAS_RHR_IT_DIS bit +- serial: sc16is7xx: address RX timeout interrupt errata +- ARM: PL011: Fix DMA support +- usb: typec: class: fix typec_altmode_put_partner to put plugs +- smb: client: fix potential NULL deref in parse_dfs_referrals() +- Revert "xhci: Loosen RPM as default policy to cover for AMD xHC 1.1" +- cifs: Fix non-availability of dedup breaking generic/304 +- parport: Add support for Brainboxes IX/UC/PX parallel cards +- serial: ma35d1: Validate console index before assignment +- serial: 8250_dw: Add ACPI ID for Granite Rapids-D UART +- nvmem: Do not expect fixed layouts to grab a layout driver +- usb: gadget: f_hid: fix report descriptor allocation +- kprobes: consistent rcu api usage for kretprobe holder +- ASoC: ops: add correct range check for limiting volume +- gpiolib: sysfs: Fix error handling on failed export +- x86/sev: Fix kernel crash due to late update to read-only ghcb_version +- perf: Fix perf_event_validate_size() +- drm/amdgpu: disable MCBP by default +- arm64: dts: mt8183: kukui: Fix underscores in node names +- arm64: dts: mediatek: add missing space before { +- parisc: Fix asm operand number out of range build error in bug table +- parisc: Reduce size of the bug_table on 64-bit kernel by half +- LoongArch: BPF: Don't sign extend function return value +- LoongArch: BPF: Don't sign extend memory load operand +- perf vendor events arm64: AmpereOne: Add missing DefaultMetricgroupName fields +- misc: mei: client.c: fix problem of return '-EOVERFLOW' in mei_cl_write +- misc: mei: client.c: return negative error code in mei_cl_write +- coresight: ultrasoc-smb: Fix uninitialized before use buf_hw_base +- coresight: ultrasoc-smb: Config SMB buffer before register sink +- coresight: ultrasoc-smb: Fix sleep while close preempt in enable_smb +- hwtracing: hisi_ptt: Add dummy callback pmu::read() +- coresight: Fix crash when Perf and sysfs modes are used concurrently +- coresight: etm4x: Remove bogous __exit annotation for some functions +- arm64: dts: mediatek: mt8186: Change gpu speedbin nvmem cell name +- arm64: dts: mediatek: mt8186: fix clock names for power domains +- arm64: dts: mediatek: mt8183-evb: Fix unit_address_vs_reg warning on ntc +- arm64: dts: mediatek: mt8183: Move thermal-zones to the root node +- arm64: dts: mediatek: mt8183: Fix unit address for scp reserved memory +- arm64: dts: mediatek: mt8195: Fix PM suspend/resume with venc clocks +- arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names +- arm64: dts: mediatek: cherry: Fix interrupt cells for MT6360 on I2C7 +- arm64: dts: mediatek: mt8183-kukui-jacuzzi: fix dsi unnecessary cells properties +- arm64: dts: mediatek: mt7622: fix memory node warning check +- arm64: dts: mt7986: fix emmc hs400 mode without uboot initialization +- arm64: dts: mt7986: define 3W max power to both SFP on BPI-R3 +- arm64: dts: mt7986: change cooling trips +- drm/i915: Skip some timing checks on BXT/GLK DSI transcoders +- drm/i915/mst: Reject modes that require the bigjoiner +- drm/i915/mst: Fix .mode_valid_ctx() return values +- drm/atomic-helpers: Invoke end_fb_access while owning plane state +- md/raid6: use valid sector values to determine if an I/O should wait on the reshape +- powercap: DTPM: Fix missing cpufreq_cpu_put() calls +- mm/memory_hotplug: fix error handling in add_memory_resource() +- mm: fix oops when filemap_map_pmd() without prealloc_pte +- mm/memory_hotplug: add missing mem_hotplug_lock +- drivers/base/cpu: crash data showing should depends on KEXEC_CORE +- hugetlb: fix null-ptr-deref in hugetlb_vma_lock_write +- workqueue: Make sure that wq_unbound_cpumask is never empty +- platform/surface: aggregator: fix recv_buf() return value +- regmap: fix bogus error on regcache_sync success +- r8169: fix rtl8125b PAUSE frames blasting when suspended +- packet: Move reference count in packet_sock to atomic_long_t +- nfp: flower: fix for take a mutex lock in soft irq context and rcu lock +- leds: trigger: netdev: fix RTNL handling to prevent potential deadlock +- tracing: Fix a possible race when disabling buffered events +- tracing: Fix incomplete locking when disabling buffered events +- tracing: Disable snapshot buffer when stopping instance tracers +- tracing: Stop current tracer when resizing buffer +- tracing: Always update snapshot buffer size +- checkstack: fix printed address +- cgroup_freezer: cgroup_freezing: Check if not frozen +- lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly +- nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() +- nilfs2: fix missing error check for sb_set_blocksize call +- highmem: fix a memory copy problem in memcpy_from_folio +- ring-buffer: Force absolute timestamp on discard of event +- ring-buffer: Test last update in 32bit version of __rb_time_read() +- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 +- ALSA: hda/realtek: Add Framework laptop 16 to quirks +- ALSA: hda/realtek: add new Framework laptop to quirks +- ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5 +- ALSA: hda/realtek: fix speakers on XPS 9530 (2023) +- ALSA: hda/realtek: Apply quirk for ASUS UM3504DA +- ALSA: pcm: fix out-of-bounds in snd_pcm_state_names +- ALSA: usb-audio: Add Pioneer DJM-450 mixer controls +- io_uring: fix mutex_unlock with unreferenced ctx +- nvme-pci: Add sleep quirk for Kingston drives +- io_uring/af_unix: disable sending io_uring over sockets +- ASoC: amd: yc: Fix non-functional mic on ASUS E1504FA +- rethook: Use __rcu pointer for rethook::handler +- scripts/gdb: fix lx-device-list-bus and lx-device-list-class +- kernel/Kconfig.kexec: drop select of KEXEC for CRASH_DUMP +- md: don't leave 'MD_RECOVERY_FROZEN' in error path of md_set_readonly() +- riscv: errata: andes: Probe for IOCP only once in boot stage +- riscv: fix misaligned access handling of C.SWSP and C.SDSP +- arm64: dts: rockchip: Fix eMMC Data Strobe PD on rk3588 +- ARM: dts: imx28-xea: Pass the 'model' property +- ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt +- arm64: dts: imx8-apalis: set wifi regulator to always-on +- ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init +- arm64: dts: imx93: correct mediamix power +- arm64: dts: freescale: imx8-ss-lsio: Fix #pwm-cells +- arm64: dts: imx8-ss-lsio: Add PWM interrupts +- scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() +- tracing: Fix a warning when allocating buffered events fails +- io_uring/kbuf: check for buffer list readiness after NULL check +- io_uring/kbuf: Fix an NULL vs IS_ERR() bug in io_alloc_pbuf_ring() +- ARM: dts: imx6ul-pico: Describe the Ethernet PHY clock +- arm64: dts: imx8mp: imx8mq: Add parkmode-disable-ss-quirk on DWC3 +- drm/bridge: tc358768: select CONFIG_VIDEOMODE_HELPERS +- RDMA/irdma: Avoid free the non-cqp_request scratch +- RDMA/irdma: Fix support for 64k pages +- RDMA/irdma: Ensure iWarp QP queue memory is OS paged aligned +- RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz +- ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate +- firmware: arm_scmi: Fix possible frequency truncation when using level indexing mode +- firmware: arm_scmi: Simplify error path in scmi_dvfs_device_opps_add() +- firmware: arm_scmi: Fix frequency truncation by promoting multiplier type +- firmware: arm_scmi: Extend perf protocol ops to get information of a domain +- firmware: arm_scmi: Extend perf protocol ops to get number of domains +- hwmon: (nzxt-kraken2) Fix error handling path in kraken2_probe() +- ASoC: codecs: lpass-tx-macro: set active_decimator correct default value +- hwmon: (acpi_power_meter) Fix 4.29 MW bug +- ARM: dts: bcm2711-rpi-400: Fix delete-node of led_act +- ARM: dts: rockchip: Fix sdmmc_pwren's pinmux setting for RK3128 +- ARM: dts: imx6q: skov: fix ethernet clock regression +- arm64: dt: imx93: tqma9352-mba93xxla: Fix LPUART2 pad config +- RDMA/irdma: Fix UAF in irdma_sc_ccq_get_cqe_info() +- RDMA/bnxt_re: Correct module description string +- RDMA/rtrs-clt: Remove the warnings for req in_use check +- RDMA/rtrs-clt: Fix the max_send_wr setting +- RDMA/rtrs-srv: Destroy path files after making sure no IOs in-flight +- RDMA/rtrs-srv: Free srv_mr iu only when always_invalidate is true +- RDMA/rtrs-srv: Check return values while processing info request +- RDMA/rtrs-clt: Start hb after path_up +- RDMA/rtrs-srv: Do not unconditionally enable irq +- ASoC: fsl_sai: Fix no frame sync clock issue on i.MX8MP +- arm64: dts: rockchip: Expand reg size of vdec node for RK3399 +- arm64: dts: rockchip: Expand reg size of vdec node for RK3328 +- RDMA/irdma: Add wait for suspend on SQD +- RDMA/irdma: Do not modify to SQD on error +- RDMA/hns: Fix unnecessary err return when using invalid congest control algorithm +- RDMA/core: Fix uninit-value access in ib_get_eth_speed() +- tee: optee: Fix supplicant based device enumeration +- mm/damon/sysfs: eliminate potential uninitialized variable warning +- drm/amdkfd: get doorbell's absolute offset based on the db_size +- drm/amd/amdgpu/amdgpu_doorbell_mgr: Correct misdocumented param 'doorbell_index' +- net/smc: fix missing byte order conversion in CLC handshake +- net: dsa: microchip: provide a list of valid protocols for xmit handler +- drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group +- psample: Require 'CAP_NET_ADMIN' when joining "packets" group +- bpf: sockmap, updating the sg structure should also update curr +- net: tls, update curr on splice as well +- net: dsa: mv88e6xxx: Restore USXGMII support for 6393X +- tcp: do not accept ACK of bytes we never sent +- netfilter: xt_owner: Fix for unsafe access of sk->sk_socket +- netfilter: nf_tables: validate family when identifying table via handle +- netfilter: nf_tables: bail out on mismatching dynset and set expressions +- netfilter: nf_tables: fix 'exist' matching on bigendian arches +- netfilter: bpf: fix bad registration on nf_defrag +- dt-bindings: interrupt-controller: Allow #power-domain-cells +- octeontx2-af: Update Tx link register range +- octeontx2-af: Add missing mcs flr handler call +- octeontx2-af: Fix mcs stats register address +- octeontx2-af: Fix mcs sa cam entries size +- octeontx2-af: Adjust Tx credits when MCS external bypass is disabled +- net: hns: fix fake link up on xge port +- net: hns: fix wrong head when modify the tx feature when sending packets +- net: atlantic: Fix NULL dereference of skb pointer in +- ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit() +- ionic: Fix dim work handling in split interrupt mode +- ionic: fix snprintf format length warning +- tcp: fix mid stream window clamp. +- net: bnxt: fix a potential use-after-free in bnxt_init_tc +- iavf: validate tx_coalesce_usecs even if rx_coalesce_usecs is zero +- i40e: Fix unexpected MFS warning message +- ice: Restore fix disabling RX VLAN filtering +- octeontx2-af: fix a use-after-free in rvu_npa_register_reporters +- xsk: Skip polling event check for unbound socket +- net: stmmac: fix FPE events losing +- octeontx2-pf: consider both Rx and Tx packet stats for adaptive interrupt coalescing +- arcnet: restoring support for multiple Sohard Arcnet cards +- platform/mellanox: Check devm_hwmon_device_register_with_groups() return value +- platform/mellanox: Add null pointer checks for devm_kasprintf() +- mlxbf-bootctl: correctly identify secure boot with development keys +- r8152: Add RTL8152_INACCESSIBLE to r8153_aldps_en() +- r8152: Add RTL8152_INACCESSIBLE to r8153_pre_firmware_1() +- r8152: Add RTL8152_INACCESSIBLE to r8156b_wait_loading_flash() +- r8152: Add RTL8152_INACCESSIBLE checks to more loops +- r8152: Hold the rtnl_lock for all of reset +- hv_netvsc: rndis_filter needs to select NLS +- bpf: Fix a verifier bug due to incorrect branch offset comparison with cpu=v4 +- octeontx2-af: Check return value of nix_get_nixlf before using nixlf +- octeontx2-pf: Add missing mutex lock in otx2_get_pauseparam +- ipv6: fix potential NULL deref in fib6_add() +- platform/x86: wmi: Skip blocks with zero instances +- of: dynamic: Fix of_reconfig_get_state_change() return value documentation +- platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code +- dt: dt-extract-compatibles: Don't follow symlinks when walking tree +- dt: dt-extract-compatibles: Handle cfile arguments in generator function +- x86/tdx: Allow 32-bit emulation by default +- x86/entry: Do not allow external 0x80 interrupts +- x86/entry: Convert INT 0x80 emulation to IDTENTRY +- x86/coco: Disable 32-bit emulation by default on TDX and SEV +- x86: Introduce ia32_enabled() +- dm-crypt: start allocating with MAX_ORDER +- drm/amdgpu: correct chunk_ptr to a pointer to chunk. +- drm/amdgpu: finalizing mem_partitions at the end of GMC v9 sw_fini +- drm/amdgpu: Do not program VF copy regs in mmhub v1.8 under SRIOV (v2) +- kconfig: fix memory leak from range properties +- modpost: fix section mismatch message for RELA +- tg3: Increment tx_dropped in tg3_tso_bug() +- tg3: Move the [rt]x_dropped counters to tg3_napi +- zstd: Fix array-index-out-of-bounds UBSAN warning +- nouveau: use an rwlock for the event lock. +- netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test +- i2c: ocores: Move system PM hooks to the NOIRQ phase +- i2c: designware: Fix corrupted memory seen in the ISR +- hrtimers: Push pending hrtimers away from outgoing CPU earlier +- scsi: sd: Fix sshdr use in sd_suspend_common() +- vdpa/mlx5: preserve CVQ vringh index +- !3749 support nokaslr and memmap parameter for kaslr collision detection +- kaslr: enable CONFIG_SKIP_KASLR_MEM_RANGE in openeuler defconfig +- x86/boot: add x86 nokaslr memory regions +- efi/libstub: add arm64 nokaslr memory regions +- efi/libstub: arm64: Fix KASLR and memmap= collision +- efi/libstub: arm64: support strchr function for EFI stub +- efi/libstub: add arm64 kaslr memory region avoid support +- !3737 arm64: Fix compilation error with ILP32 +- config: Disable CONFIG_COMPAT_BINFMT_ELF as default +- arm64: Fix compilation error with ILP32 support +- Revert "Kconfig: regularize selection of CONFIG_BINFMT_ELF" +- !3743 Fix ppc32 build error +- powerpc: Fix ppc32 build +- !3713 Introduce CPU inspect feature +- openeuler_defconfig: enable CPU inspect for arm64 by default +- cpuinspect: add ATF inspector +- cpuinspect: add CPU-inspect infrastructure +- !3730 ARM: spectre-v2: turn off the mitigation via boot cmdline param +- ARM: spectre-v2: turn off the mitigation via boot cmdline param +- !3732 tcp_comp: implement tcp compression +- tcp_comp: implement tcp compression +- !3748 jffs2: move jffs2_init_inode_info() just after allocating inode +- jffs2: move jffs2_init_inode_info() just after allocating inode +- !3542 Support kernel livepatching +- livepatch/powerpc: Add arch_klp_module_check_calltrace +- livepatch/powerpc: Support breakpoint exception optimization +- livepatch/ppc64: Sample testcase fix ppc64 +- livepatch/ppc64: Implement livepatch without ftrace for ppc64be +- livepatch: Bypass dead thread when check calltrace +- livepatch/arm: Add arch_klp_module_check_calltrace +- livepatch/arm64: Add arch_klp_module_check_calltrace +- livepatch/x86: Add arch_klp_module_check_calltrace +- livepatch: Add klp_module_delete_safety_check +- livepatch/arm: Support breakpoint exception optimization +- livepatch/arm64: Support breakpoint exception optimization +- livepatch: Add arch_klp_init +- livepatch/x86: Support breakpoint exception optimization +- livepatch: Use breakpoint exception to optimize enabling livepatch +- livepatch/ppc32: Support livepatch without ftrace +- livepatch/arm: Support livepatch without ftrace +- livepatch/core: Add support for arm for klp relocation +- arm/module: Use plt section indices for relocations +- livepatch: Enable livepatch configs in openeuler_defconfig +- livepatch/core: Revert module_enable_ro and module_disable_ro +- livepatch/arm64: Support livepatch without ftrace +- livepatch/core: Avoid conflict with static {call,key} +- livepatch: Fix patching functions which have static_call +- livepatch: Fix crash when access the global variable in hook +- livepatch/core: Support jump_label +- livepatch: samples: Adapt livepatch-sample for solution without ftrace +- livepatch/core: Support load and unload hooks +- livepatch/core: Restrict livepatch patched/unpatched when plant kprobe +- livepatch/core: Disable support for replacing +- livepatch/x86: Support livepatch without ftrace +- Revert "x86/insn: Make insn_complete() static" +- livepatch/core: Reuse common codes in the solution without ftrace +- livepatch/core: Allow implementation without ftrace +- !3678 timer_list: avoid other cpu soft lockup when printing timer list +- timer_list: avoid other cpu soft lockup when printing timer list +- !3733 drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() +- drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() +- !3734 Introduce qos smt expeller for co-location +- sched/fair: Add cmdline nosmtexpell +- sched/fair: Introduce QOS_SMT_EXPELL priority reversion mechanism +- sched/fair: Start tracking qos_offline tasks count in cfs_rq +- config: Enable CONFIG_QOS_SCHED_SMT_EXPELLER +- sched: Add tracepoint for qos smt expeller +- sched: Add statistics for qos smt expeller +- sched: Implement the function of qos smt expeller +- sched: Introduce qos smt expeller for co-location +- !3629 x86/kdump: make crash kernel boot faster +- x86/kdump: make crash kernel boot faster +- !3722 add memmap interface to reserved memory +- arm64: Request resources for reserved memory via memmap +- arm64: Add support for memmap kernel parameters +- !3724 lib/clear_user: ensure loop in __arch_clear_user cache-aligned v2 +- config: enable CONFIG_CLEAR_USER_WORKAROUND by default +- lib/clear_user: ensure loop in __arch_clear_user cache-aligned v2 +- !3688 Support priority load balance for qos scheduler +- sched: Introduce priority load balance for qos scheduler +- !3712 sched: steal tasks to improve CPU utilization +- config: enable CONFIG_SCHED_STEAL by default +- sched/fair: introduce SCHED_STEAL +- disable stealing by default +- sched/fair: Provide idle search schedstats +- sched/fair: disable stealing if too many NUMA nodes +- sched/fair: Steal work from an overloaded CPU when CPU goes idle +- sched/fair: Provide can_migrate_task_llc +- sched/fair: Generalize the detach_task interface +- sched/fair: Hoist idle_stamp up from idle_balance +- sched/fair: Dynamically update cfs_overload_cpus +- sched/topology: Provide cfs_overload_cpus bitmap +- sched/topology: Provide hooks to allocate data shared per LLC +- sched: Provide sparsemask, a reduced contention bitmap +- !3701 mm: Add sysctl to clear free list pages +- mm: Add sysctl to clear free list pages +- !3598 arm64: add config switch and kernel parameter for cpu0 hotplug +- config: disable config ARM64_BOOTPARAM_HOTPLUG_CPU0 by default +- arm64: Add config switch and kernel parameter for CPU0 hotplug +- !3649 x86/kdump: add log before booting crash kernel +- x86/kdump: add log before booting crash kernel +- !3700 Backport 6.6.6 LTS Patches +- Revert "wifi: cfg80211: fix CQM for non-range use" +- !3565 blk-throttle: enable hierarchical throttle in cgroup v1 +- blk-throttle: enable hierarchical throttle in cgroup v1 +- !3608 xfs: fix two corruption problems +- xfs: shutdown xfs once inode double free +- xfs: shutdown to ensure submits buffers on LSN boundaries +- !3674 mm/hugetlb: Introduce alloc_hugetlb_folio_size() +- mm/hugetlb: Introduce alloc_hugetlb_folio_size() +- !3651 nbd: get config_lock before sock_shutdown +- nbd: get config_lock before sock_shutdown +- !3573 Support dynamic affinity scheduler +- sched/fair: Modify idle cpu judgment in dynamic affinity +- sched/fair: Remove invalid cpu selection logic in dynamic affinity +- config: enable CONFIG_QOS_SCHED_DYNAMIC_AFFINITY by default +- sched: Add cmdline for dynamic affinity +- sched: Add statistics for scheduler dynamic affinity +- sched: Adjust cpu allowed in load balance dynamicly +- sched: Adjust wakeup cpu range according CPU util dynamicly +- cpuset: Introduce new interface for scheduler dynamic affinity +- sched: Introduce dynamic affinity for cfs scheduler +- !3599 arm64: Add framework to turn IPI as NMI +- arm64: kgdb: Roundup cpus using IPI as NMI +- kgdb: Expose default CPUs roundup fallback mechanism +- arm64: ipi_nmi: Add support for NMI backtrace +- nmi: backtrace: Allow runtime arch specific override +- arm64: smp: Assign and setup an IPI as NMI +- irqchip/gic-v3: Enable support for SGIs to act as NMIs +- arm64: Add framework to turn IPI as NMI +- !3638 memcg: support OOM priority for memcg +- memcg: enable CONFIG_MEMCG_OOM_PRIORITY by default +- memcg: Add sysctl memcg_qos_enable +- memcg: support priority for oom +- !3602 xfs: fix attr inactive problems +- xfs: atomic drop extent entries when inactiving attr +- xfs: factor out __xfs_da3_node_read() +- xfs: force shutdown xfs when xfs_attr_inactive fails +- !3601 xfs: fix perag leak when growfs fails +- xfs: fix perag leak when growfs fails +- xfs: add lock protection when remove perag from radix tree +- !3575 ubi: Enhance fault injection capability for the UBI driver +- mtd: Add several functions to the fail_function list +- ubi: Reserve sufficient buffer length for the input mask +- ubi: Add six fault injection type for testing +- ubi: Split io_failures into write_failure and erase_failure +- ubi: Use the fault injection framework to enhance the fault injection capability +- !3588 files cgroups +- enable CONFIG_CGROUP_FILES in openeuler_defconfig for x86 and arm64 +- cgroup/files: support boot parameter to control if disable files cgroup +- fs/filescontrol: add a switch to enable / disable accounting of open fds +- cgroups: Resource controller for open files +- !3605 openeuler_defconfig: enable CONFIG_UNICODE for x86 and arm64 +- openeuler_defconfig: enable CONFIG_UNICODE for x86 and arm64 +- !3600 iommu/arm-smmu-v3: Add a SYNC command to avoid broken page table prefetch +- iommu/arm-smmu-v3: Add a SYNC command to avoid broken page table prefetch +- !3397 xfs: fix some growfs problems +- xfs: fix dir3 block read verify fail during log recover +- xfs: keep growfs sb log item active until ail flush success +- xfs: fix mounting failed caused by sequencing problem in the log records +- xfs: fix the problem of mount failure caused by not refreshing mp->m_sb +- !3582 Add support for memory limit +- mm: support pagecache limit +- mm: support periodical memory reclaim +- !3323 LoongArch: add cpufreq and ls2k500 bmc support +- LoongArch: fix ls2k500 bmc not work when installing iso +- LoongArch: defconfig: enable CONFIG_FB_LS2K500=m. +- ipmi: add ls2k500 bmc ipmi support. +- fbdev: add ls2k500sfb driver for ls2k500 bmc. +- cpufreq: Add cpufreq driver for LoongArch +- !3363 xfs: fix some misc issue +- xfs: xfs_trans_cancel() path must check for log shutdown +- xfs: don't verify agf length when log recovery +- xfs: fix a UAF in xfs_iflush_abort_clean +- xfs: fix a UAF when inode item push +- !3495 xfs: fix hung and warning +- xfs: fix warning in xfs_vm_writepages() +- xfs: fix hung when transaction commit fail in xfs_inactive_ifree +- xfs: fix dead loop when do mount with IO fault injection +- !3525 ARM: support kaslr feature in arm32 platform +- arm32: kaslr: Fix clock_gettime and gettimeofday performance degradation when configure CONFIG_RANDOMIZE_BASE +- arm32: kaslr: Fix the bug of symbols relocation +- arm32: kaslr: print kaslr offset when kernel panic +- arm32: kaslr: pop visibility when compile decompress boot code as we need relocate BSS by GOT. +- arm32: kaslr: When boot with vxboot, we must adjust dtb address before kaslr_early_init, and store dtb address after init. +- No idea why this broke ... +- ARM: decompressor: add KASLR support +- ARM: decompressor: explicitly map decompressor binary cacheable +- ARM: kernel: implement randomization of the kernel load address +- arm: vectors: use local symbol names for vector entry points +- ARM: kernel: refer to swapper_pg_dir via its symbol +- ARM: mm: export default vmalloc base address +- ARM: kernel: use PC relative symbol references in suspend/resume code +- ARM: kernel: use PC-relative symbol references in MMU switch code +- ARM: kernel: make vmlinux buildable as a PIE executable +- ARM: kernel: switch to relative exception tables +- arm-soc: various: replace open coded VA->PA calculation of pen_release +- arm-soc: mvebu: replace open coded VA->PA conversion +- arm-soc: exynos: replace open coded VA->PA conversions +- asm-generic: add .data.rel.ro sections to __ro_after_init +- !3563 memcg: support ksm merge any mode per cgroup +- memcg: support ksm merge any mode per cgroup +- !3528 Print rootfs and tmpfs files charged by memcg +- config: enable CONFIG_MEMCG_MEMFS_INFO by default +- mm/memcg_memfs_info: show files that having pages charged in mem_cgroup +- fs: move {lock, unlock}_mount_hash to fs/mount.h +- !3489 ascend: export interfaces required by ascend drivers +- ascend: export interfaces required by ascend drivers +- !3381 cgroupv1 cgroup writeback enable +- openeuler_defconfig: enable CONFIG_CGROUP_V1_WRITEBACK in openeuler_defconfig for x86 and arm64 +- cgroup: support cgroup writeback on cgroupv1 +- cgroup: factor out __cgroup_get_from_id() for cgroup v1 +- !3537 backport cgroup bugs from olk5.10 +- cgroup: disable kernel memory accounting for all memory cgroups by default +- cgroup: Return ERSCH when add Z process into task +- cgroup: wait for cgroup destruction to complete when umount +- cgroup: check if cgroup root is alive in cgroupstats_show() +- !3439 security: restrict init parameters by configuration +- security: restrict init parameters by configuration +- !3475 kaslr: ppc64: Introduce KASLR for PPC64 +- powerpc/fsl_booke/kaslr: Fix preserved memory size for int-vectors issue +- powerpc/fsl_booke/kaslr: Provide correct r5 value for relocated kernel +- powerpc/fsl_booke/kaslr: rename kaslr-booke32.rst to kaslr-booke.rst and add 64bit part +- powerpc/fsl_booke/64: clear the original kernel if randomized +- powerpc/fsl_booke/64: do not clear the BSS for the second pass +- powerpc/fsl_booke/64: implement KASLR for fsl_booke64 +- powerpc/fsl_booke/64: introduce reloc_kernel_entry() helper +- powerpc/fsl_booke/kaslr: refactor kaslr_legal_offset() and kaslr_early_init() +- !3486 sync smmu patches for olk-6.6 +- iommu/arm-smmu-v3: disable stall for quiet_cd +- iommu/iova: Manage the depot list size +- iommu/iova: Make the rcache depot scale better +- !3434 arm64/ascend: Add new enable_oom_killer interface for oom contrl +- arm64/ascend: Add new enable_oom_killer interface for oom contrl +- !3479 cache: Workaround HiSilicon Linxicore DC CVAU +- cache: Workaround HiSilicon Linxicore DC CVAU +- !3367 ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet +- ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet +- !3471 add redis sockmap sample code +- tools: add sample sockmap code for redis +- net: add local_skb parameter to identify local tcp connection +- net: let sockops can use bpf_get_current_comm() +- !3432 ACPI / APEI: Notify all ras err to driver +- ACPI / APEI: Notify all ras err to driver + +* Tue Dec 26 2023 Zheng Zengkai <zhengzengkai@huawei.com> - 6.6.0-2.0.0.2 +- !3435 iommu/arm-smmu-v3: Add suspend and resume support +- !3315 Backport 6.6.5 LTS Patches +- !3314 Backport 6.6.4 LTS Patches +- !3286 block: Add config option to not allow writing to mounted devices +- !3430 Add support for hisi HBM devices +- !3431 memcg reclaim and cgroup kill +- iommu/arm-smmu-v3: Add suspend and resume support +- config: enable CONFIG_MEMCG_V1_RECLAIM and CONFIG_CGROUP_V1_KILL +- memcg: introduce per-memcg reclaim interface +- memcg: export high_async_ratio to userland +- memcg: enable memcg async reclaim +- memcg: Export memory.events{local} from cgroupv2 to cgroupv1 +- memcg: Export memcg.{min/low/high} from cgroupv2 to cgroupv1 +- cgroup: Export cgroup.kill from cgroupv2 to cgroupv1 +- soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods +- soc: hbmcache: Add support for online and offline the hbm cache +- soc: hisilicon: hisi_hbmdev: Provide extra memory topology information +- ACPI: memhotplug: export the state of each hotplug device +- soc: hisilicon: hisi_hbmdev: Add power domain control methods +- ACPI: OSL: Export the symbol of acpi_hotplug_schedule +- !3391 nbd_genl_status: null check for nla_nest_start +- !3352 support userswap feature +- !3383 Support Qos Scheduler +- nbd_genl_status: null check for nla_nest_start +- sched: Enable qos scheduler config +- sched: Introduce handle priority reversion mechanism +- sched: Support kill boost for offline task +- sched: Throttle qos cfs_rq when current cpu is running online task +- sched: Introduce qos scheduler for co-location +- !3306 improve gettimeofday() performance in user space +- !3331 kabi: add kabi helper macros and tools +- mm/userswap: openeuler_defconfig: enable userswap +- mm/userswap: provide cpu info in userfault msg +- mm/userswap: introduce UFFDIO_COPY_MODE_DIRECT_MAP +- mm/userswap: support userswap via userfaultfd +- mm/userswap: introduce MREMAP_USWAP_SET_PTE +- mm/userswap: add enable_userswap boot option +- mm/userswap: add VM_USWAP and SWP_USERSWAP_ENTRY +- !3326 config: Open CONFIG_AARCH32_EL0 and keep CONFIG_ARM64_ILP32 closed +- kabi: add kABI reference checking tool +- kabi: add a tool to generate the kabi reference relationship +- kabi: add script tools to check kabi symbol +- kabi: deduplication friendly structs +- kabi: Generalize naming of kabi helper macros +- openeuler_defconfig: Enable CONFIG_KABI_RESERVE for x86 and arm64 +- KABI: Add CONFIG_KABI_RESERVE to control KABI padding reserve +- kabi: enables more stringent kabi checks +- kabi: add KABI_SIZE_ALIGN_CHECKS for more stringent kabi checks +- kabi: add kabi helper macros +- !3298 ARM: Add unwinding annotations to __loop.*delay functions +- config: Open CONFIG_AARCH32_EL0 and keep CONFIG_ARM64_ILP32 closed +- !3300 Add sharepool support v3 +- vfio: Drop vfio_file_iommu_group() stub to fudge around a KVM wart +- x86/xen: fix percpu vcpu_info allocation +- vfio/pds: Fix possible sleep while in atomic context +- vfio/pds: Fix mutex lock->magic != lock warning +- drm/amd/display: Fix MPCC 1DLUT programming +- drm/amd/display: Simplify brightness initialization +- drm/amd/display: Reduce default backlight min from 5 nits to 1 nits +- drm/amd/display: refactor ILR to make it work +- iommu: Fix printk arg in of_iommu_get_resv_regions() +- drm/amd/pm: fix a memleak in aldebaran_tables_init +- cpufreq/amd-pstate: Only print supported EPP values for performance governor +- cpufreq/amd-pstate: Fix scaling_min_freq and scaling_max_freq update +- drm/panel: nt36523: fix return value check in nt36523_probe() +- drm/panel: starry-2081101qfh032011-53g: Fine tune the panel power sequence +- drm/i915/gsc: Mark internal GSC engine with reserved uabi class +- iommu/vt-d: Make context clearing consistent with context mapping +- iommu/vt-d: Disable PCI ATS in legacy passthrough mode +- iommu/vt-d: Omit devTLB invalidation requests when TES=0 +- cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily +- drm/amd/display: Remove power sequencing check +- drm/amd/display: Refactor edp power control +- s390/cmma: fix handling of swapper_pg_dir and invalid_pg_dir +- powerpc/pseries/iommu: enable_ddw incorrectly returns direct mapping for SR-IOV device +- net: ravb: Keep reverse order of operations in ravb_remove() +- net: ravb: Stop DMA in case of failures on ravb_open() +- net: ravb: Start TX queues after HW initialization succeeded +- net: ravb: Make write access to CXR35 first before accessing other EMAC registers +- net: ravb: Use pm_runtime_resume_and_get() +- net: ravb: Check return value of reset_control_deassert() +- ice: Fix VF Reset paths when interface in a failed over aggregate +- bpf, sockmap: af_unix stream sockets need to hold ref for pair sock +- ethtool: don't propagate EOPNOTSUPP from dumps +- ravb: Fix races between ravb_tx_timeout_work() and net related ops +- r8169: prevent potential deadlock in rtl8169_close +- efi/unaccepted: Fix off-by-one when checking for overlapping ranges +- neighbour: Fix __randomize_layout crash in struct neighbour +- octeontx2-pf: Restore TC ingress police rules when interface is up +- octeontx2-pf: Fix adding mbox work queue entry when num_vfs > 64 +- net: stmmac: xgmac: Disable FPE MMC interrupts +- octeontx2-af: Fix possible buffer overflow +- selftests/net: mptcp: fix uninitialized variable warnings +- selftests/net: unix: fix unused variable compiler warning +- selftests/net: fix a char signedness issue +- selftests/net: ipsec: fix constant out of range +- uapi: propagate __struct_group() attributes to the container union +- bpf: Add missed allocation hint for bpf_mem_cache_alloc_flags() +- dpaa2-eth: recycle the RX buffer only after all processing done +- dpaa2-eth: increase the needed headroom to account for alignment +- net: dsa: mv88e6xxx: fix marvell 6350 probe crash +- net: dsa: mv88e6xxx: fix marvell 6350 switch probing +- wifi: mac80211: do not pass AP_VLAN vif pointer to drivers during flush +- wifi: iwlwifi: mvm: fix an error code in iwl_mvm_mld_add_sta() +- ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet +- net: rswitch: Fix missing dev_kfree_skb_any() in error path +- net: rswitch: Fix return value in rswitch_start_xmit() +- net: rswitch: Fix type of ret in rswitch_start_xmit() +- netdevsim: Don't accept device bound programs +- media: v4l2-subdev: Fix a 64bit bug +- pinctrl: stm32: fix array read out of bound +- pinctrl: stm32: Add check for devm_kcalloc +- wifi: cfg80211: fix CQM for non-range use +- io_uring/kbuf: recycle freed mapped buffer ring entries +- io_uring/kbuf: defer release of mapped buffer rings +- io_uring: enable io_mem_alloc/free to be used in other parts +- btrfs: fix 64bit compat send ioctl arguments not initializing version member +- btrfs: free the allocated memory if btrfs_alloc_page_array() fails +- btrfs: make error messages more clear when getting a chunk map +- btrfs: send: ensure send_fd is writable +- btrfs: fix off-by-one when checking chunk map includes logical address +- btrfs: ref-verify: fix memory leaks in btrfs_ref_tree_mod() +- btrfs: add dmesg output for first mount and last unmount of a filesystem +- parisc: Mark altinstructions read-only and 32-bit aligned +- parisc: Ensure 32-bit alignment on parisc unwind section +- parisc: Mark jump_table naturally aligned +- parisc: Drop the HP-UX ENOSYM and EREMOTERELEASE error codes +- parisc: Mark lock_aligned variables 16-byte aligned on SMP +- parisc: Use natural CPU alignment for bug_table +- parisc: Mark ex_table entries 32-bit aligned in uaccess.h +- parisc: Mark ex_table entries 32-bit aligned in assembly.h +- powerpc: Don't clobber f0/vs0 during fp|altivec register save +- KVM: PPC: Book3S HV: Fix KVM_RUN clobbering FP/VEC user registers +- iommu/vt-d: Add MTL to quirk list to skip TE disabling +- ext2: Fix ki_pos update for DIO buffered-io fallback case +- bcache: revert replacing IS_ERR_OR_NULL with IS_ERR +- iommu: Avoid more races around device probe +- io_uring: don't guard IORING_OFF_PBUF_RING with SETUP_NO_MMAP +- dma-buf: fix check in dma_resv_add_fence +- cpufreq/amd-pstate: Fix the return value of amd_pstate_fast_switch() +- powercap: DTPM: Fix unneeded conversions to micro-Watts +- nouveau: find the smallest page allocation to cover a buffer alloc. +- io_uring: free io_buffer_list entries via RCU +- iommu/vt-d: Fix incorrect cache invalidation for mm notification +- io_uring: don't allow discontig pages for IORING_SETUP_NO_MMAP +- ACPI: video: Use acpi_video_device for cooling-dev driver data +- r8169: fix deadlock on RTL8125 in jumbo mtu mode +- nvme: check for valid nvme_identify_ns() before using it +- dm verity: don't perform FEC for failed readahead IO +- dm verity: initialize fec io before freeing it +- drm/amd/display: force toggle rate wa for first link training for a retimer +- drm/amd/display: fix ABM disablement +- drm/amd/display: Update min Z8 residency time to 2100 for DCN314 +- drm/amd/display: Use DRAM speed from validation for dummy p-state +- drm/amd/display: Remove min_dst_y_next_start check for Z8 +- drm/amd/display: Include udelay when waiting for INBOX0 ACK +- drm/amdgpu: Update EEPROM I2C address for smu v13_0_0 +- drm/amdgpu: fix memory overflow in the IB test +- drm/amdgpu: Force order between a read and write to the same address +- drm/amdgpu: correct the amdgpu runtime dereference usage count +- drm/amd: Enable PCIe PME from D3 +- scsi: ufs: core: Clear cmd if abort succeeds in MCQ mode +- scsi: sd: Fix system start for ATA devices +- scsi: Change SCSI device boolean fields to single bit flags +- dm-verity: align struct dm_verity_fec_io properly +- net: libwx: fix memory leak on msix entry +- ALSA: hda/realtek: Add supported ALC257 for ChromeOS +- ALSA: hda/realtek: Headset Mic VREF to 100% +- ALSA: hda: Disable power-save on KONTRON SinglePC +- drm/i915: Also check for VGA converter in eDP probe +- mmc: block: Be sure to wait while busy in CQE error recovery +- mmc: block: Do not lose cache flush during CQE error recovery +- mmc: block: Retry commands in CQE error recovery +- mmc: cqhci: Fix task clearing in CQE error recovery +- mmc: cqhci: Warn of halt or task clear failure +- mmc: cqhci: Increase recovery halt timeout +- mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled +- mmc: sdhci-pci-gli: Disable LPM during initialization +- firewire: core: fix possible memory leak in create_units() +- pinctrl: avoid reload of p state in list iteration +- ksmbd: fix possible deadlock in smb2_open +- smb: client: report correct st_size for SMB and NFS symlinks +- smb: client: fix missing mode bits for SMB symlinks +- cifs: Fix FALLOC_FL_INSERT_RANGE by setting i_size after EOF moved +- cifs: Fix FALLOC_FL_ZERO_RANGE by setting i_size if EOF moved +- leds: class: Don't expose color sysfs entry +- USB: dwc3: qcom: fix wakeup after probe deferral +- USB: dwc3: qcom: fix software node leak on probe errors +- usb: dwc3: set the dma max_seg_size +- usb: dwc3: Fix default mode initialization +- USB: dwc2: write HCINT with INTMASK applied +- usb: typec: tcpm: Skip hard reset when in error recovery +- usb: typec: tcpm: Fix sink caps op current check +- USB: serial: option: don't claim interface 4 for ZTE MF290 +- USB: serial: option: fix FM101R-GL defines +- USB: serial: option: add Fibocom L7xx modules +- usb: cdnsp: Fix deadlock issue during using NCM gadget +- usb: config: fix iteration issue in 'usb_get_bos_descriptor()' +- USB: xhci-plat: fix legacy PHY double init +- bcache: fixup lock c->root error +- bcache: fixup init dirty data errors +- bcache: prevent potential division by zero error +- bcache: check return value from btree_node_alloc_replacement() +- veth: Use tstats per-CPU traffic counters +- dm-delay: fix a race between delay_presuspend and delay_bio +- ALSA: hda/realtek: Add quirks for ASUS 2024 Zenbooks +- ALSA: hda: ASUS UM5302LA: Added quirks for cs35L41/10431A83 on i2c bus +- cifs: fix leak of iface for primary channel +- cifs: account for primary channel in the interface list +- cifs: distribute channels across interfaces based on speed +- Revert "phy: realtek: usb: Add driver for the Realtek SoC USB 2.0 PHY" +- Revert "phy: realtek: usb: Add driver for the Realtek SoC USB 3.0 PHY" +- Revert "usb: phy: add usb phy notify port status API" +- hv_netvsc: Mark VF as slave before exposing it to user-mode +- hv_netvsc: Fix race of register_netdevice_notifier and VF register +- hv_netvsc: fix race of netvsc and VF register_netdevice +- platform/x86: ideapad-laptop: Set max_brightness before using it +- platform/x86/amd/pmc: adjust getting DRAM size behavior +- USB: serial: option: add Luat Air72*U series products +- usb: misc: onboard-hub: add support for Microchip USB5744 +- dt-bindings: usb: microchip,usb5744: Add second supply +- platform/x86: hp-bioscfg: Fix error handling in hp_add_other_attributes() +- platform/x86: hp-bioscfg: move mutex_lock() down in hp_add_other_attributes() +- platform/x86: hp-bioscfg: Simplify return check in hp_add_other_attributes() +- s390/dasd: protect device queue against concurrent access +- io_uring/fs: consider link->flags when getting path for LINKAT +- bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race +- md: fix bi_status reporting in md_end_clone_io +- bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce() +- io_uring: fix off-by one bvec index +- tls: fix NULL deref on tls_sw_splice_eof() with empty record +- swiotlb-xen: provide the "max_mapping_size" method +- ACPI: PM: Add acpi_device_fix_up_power_children() function +- ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA +- ACPI: processor_idle: use raw_safe_halt() in acpi_idle_play_dead() +- ACPI: video: Use acpi_device_fix_up_power_children() +- thunderbolt: Set lane bonding bit only for downstream port +- drm/ast: Disconnect BMC if physical connector is connected +- drm/msm/dpu: Add missing safe_lut_tbl in sc8280xp catalog +- kselftest/arm64: Fix output formatting for za-fork +- prctl: Disable prctl(PR_SET_MDWE) on parisc +- mm: add a NO_INHERIT flag to the PR_SET_MDWE prctl +- lockdep: Fix block chain corruption +- USB: dwc3: qcom: fix ACPI platform device leak +- USB: dwc3: qcom: fix resource leaks on probe deferral +- nvmet: nul-terminate the NQNs passed in the connect command +- nvme: blank out authentication fabrics options if not configured +- afs: Fix file locking on R/O volumes to operate in local mode +- afs: Return ENOENT if no cell DNS record can be found +- net: ipa: fix one GSI register field width +- net: axienet: Fix check for partial TX checksum +- vsock/test: fix SEQPACKET message bounds test +- i40e: Fix adding unsupported cloud filters +- amd-xgbe: propagate the correct speed and duplex status +- amd-xgbe: handle the corner-case during tx completion +- amd-xgbe: handle corner-case during sfp hotplug +- net: veth: fix ethtool stats reporting +- octeontx2-pf: Fix ntuple rule creation to direct packet to VF with higher Rx queue than its PF +- arm/xen: fix xen_vcpu_info allocation alignment +- arm64: mm: Fix "rodata=on" when CONFIG_RODATA_FULL_DEFAULT_ENABLED=y +- s390/ipl: add missing IPL_TYPE_ECKD_DUMP case to ipl_init() +- net/smc: avoid data corruption caused by decline +- net: usb: ax88179_178a: fix failed operations during ax88179_reset +- drm/panel: boe-tv101wum-nl6: Fine tune Himax83102-j02 panel HFP and HBP +- ipv4: Correct/silence an endian warning in __ip_do_redirect +- HID: fix HID device resource race between HID core and debugging support +- accel/ivpu/37xx: Fix hangs related to MMIO reset +- accel/ivpu: Do not initialize parameters on power up +- bpf: Fix dev's rx stats for bpf_redirect_peer traffic +- net: Move {l,t,d}stats allocation to core and convert veth & vrf +- net, vrf: Move dstats structure to core +- PM: tools: Fix sleepgraph syntax error +- drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full +- libfs: getdents() should return 0 after reaching EOD +- block: update the stable_writes flag in bdev_add +- filemap: add a per-mapping stable writes flag +- drm/i915: do not clean GT table on error path +- ata: pata_isapnp: Add missing error check for devm_ioport_map() +- octeontx2-pf: Fix memory leak during interface down +- wireguard: use DEV_STATS_INC() +- net: wangxun: fix kernel panic due to null pointer +- drm/panel: simple: Fix Innolux G101ICE-L01 timings +- drm/panel: simple: Fix Innolux G101ICE-L01 bus flags +- fs: Pass AT_GETATTR_NOSEC flag to getattr interface function +- drm/panel: auo,b101uan08.3: Fine tune the panel power sequence +- blk-cgroup: avoid to warn !rcu_read_lock_held() in blkg_lookup() +- afs: Make error on cell lookup failure consistent with OpenAFS +- afs: Fix afs_server_list to be cleaned up with RCU +- rxrpc: Defer the response to a PING ACK until we've parsed it +- rxrpc: Fix RTT determination to use any ACK as a source +- s390/ism: ism driver implies smc protocol +- drm/msm/dsi: use the correct VREG_CTRL_1 value for 4nm cphy +- sched/fair: Fix the decision for load balance +- sched/eevdf: Fix vruntime adjustment on reweight +- hv/hv_kvp_daemon: Some small fixes for handling NM keyfiles +- irqchip/gic-v3-its: Flush ITS tables correctly in non-coherent GIC designs +- NFSD: Fix checksum mismatches in the duplicate reply cache +- NFSD: Fix "start of NFS reply" pointer passed to nfsd_cache_update() +- !3310 kasan: fix the compilation error for memcpy_mcs() +- kasan: fix the compilation error for memcpy_mcs() +- arm64: arch_timer: disable CONFIG_ARM_ARCH_TIMER_WORKAROUND_IN_USERSPACE +- vdso: do cntvct workaround in the VDSO +- arm64: arch_timer: Disable CNTVCT_EL0 trap if workaround is enabled +- mm/sharepool: Protect the va reserved for sharepool +- mm/sharepool: support fork() and exit() to handle the mm +- mm/sharepool: Add proc interfaces to show sp info +- mm/sharepool: Implement mg_sp_config_dvpp_range() +- mm/sharepool: Implement mg_sp_id_of_current() +- mm/sharepool: Implement mg_sp_group_id_by_pid() +- mm/sharepool: Implement mg_sp_group_add_task() +- mm/sharepool: Implement mg_sp_make_share_k2u() +- mm/sharepool: Implement mg_sp_alloc() +- mm/sharepool: Implement mg_sp_free() +- mm/sharepool: Implement mg_sp_walk_page_range() +- mm/sharepool: Implement mg_sp_unshare_kva +- mm/sharepool: Implement mg_sp_make_share_u2k() +- mm/sharepool: Reserve the va space for share_pool +- mm/sharepool: Add sp_area management code +- mm/sharepool: Add base framework for share_pool +- mm: Extend mmap assocated functions to accept mm_struct +- mm/vmalloc: Extend vmalloc usage about hugepage +- mm/hugetlb: Introduce hugetlb_insert_hugepage_pte[_by_pa] +- ARM: Add unwinding annotations to __loop.*delay functions +- !3285 arm64: errata: add option to disable cache readunique prefetch on HIP08 +- !3280 arm64: add machine check safe support +- !3036 Added SM3 as module signing algorithm +- ext4: Block writes to journal device +- xfs: Block writes to log device +- fs: Block writes to mounted block devices +- btrfs: Do not restrict writes to btrfs devices +- block: Add config option to not allow writing to mounted devices +- arm64: errata: enable HISILICON_ERRATUM_HIP08_RU_PREFETCH +- arm64: errata: add option to disable cache readunique prefetch on HIP08 +- arm64: add machine check safe sysctl interface +- arm64: introduce copy_mc_to_kernel() implementation +- arm64: support copy_mc_[user]_highpage() +- mm/hwpoison: return -EFAULT when copy fail in copy_mc_[user]_highpage() +- arm64: add uaccess to machine check safe +- arm64: add support for machine check error safe +- uaccess: add generic fallback version of copy_mc_to_user() +- !3275 arm64: kernel: disable CNP on LINXICORE9100 +- !3099 block: Make blkdev_get_by_*() return +- arm64: kernel: disable CNP on LINXICORE9100 +- !3111 openeuler_defconfig: enable some mm new +- !3211 Add SDEI Watchdog Support +- !3041 Random boot-time optimization +- !3026 Backport ARM64-ILP32 patches +- !3156 xfs: fix intent item leak during reovery +- !3137 LoongArch: add old BPI compatibility +- !3218 ipvlan: Introduce l2e mode +- !3209 exec: Remove redundant check in do_open_execat/uselib +- ipvlan: Introduce local xmit queue for l2e mode +- ipvlan: Introduce l2e mode +- arm64: kexec: only clear EOI for SDEI in NMI context +- stop_machine: mask sdei before running the callback +- openeuler_defconfig: Enable SDEI Watchdog +- kprobes/arm64: Blacklist sdei watchdog callback functions +- init: only move down lockup_detector_init() when sdei_watchdog is enabled +- sdei_watchdog: avoid possible false hardlockup +- sdei_watchdog: set secure timer period base on 'watchdog_thresh' +- sdei_watchdog: clear EOI of the secure timer before kdump +- watchdog: add nmi_watchdog support for arm64 based on SDEI +- lockup_detector: init lockup detector after all the init_calls +- firmware: arm_sdei: make 'sdei_api_event_disable/enable' public +- firmware: arm_sdei: add interrupt binding api +- exec: Remove redundant check in do_open_execat/uselib +- xfs: abort intent items when recovery intents fail +- xfs: factor out xfs_defer_pending_abort +- !3141 Backport 6.6.3 LTS Patches +- drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox +- drm/amd/display: Clear dpcd_sink_ext_caps if not set +- drm/amd/display: Enable fast plane updates on DCN3.2 and above +- drm/amd/display: fix a NULL pointer dereference in amdgpu_dm_i2c_xfer() +- drm/amd/display: Fix DSC not Enabled on Direct MST Sink +- drm/amd/display: Guard against invalid RPTR/WPTR being set +- drm/amdgpu: Fix possible null pointer dereference +- drm/amdgpu: lower CS errors to debug severity +- drm/amdgpu: fix error handling in amdgpu_bo_list_get() +- drm/amdgpu: fix error handling in amdgpu_vm_init +- drm/amdgpu: don't use ATRM for external devices +- drm/amdgpu: add a retry for IP discovery init +- drm/amdgpu: fix GRBM read timeout when do mes_self_test +- drm/amdgpu: don't use pci_is_thunderbolt_attached() +- drm/amdgpu/smu13: drop compute workload workaround +- drm/amd/pm: Fix error of MACO flag setting code +- drm/i915: Flush WC GGTT only on required platforms +- drm/i915: Fix potential spectre vulnerability +- drm/i915: Bump GLK CDCLK frequency when driving multiple pipes +- drm/i915/mtl: Support HBR3 rate with C10 phy and eDP in MTL +- drm/amd/display: Add Null check for DPP resource +- x86/srso: Move retbleed IBPB check into existing 'has_microcode' code block +- drm: bridge: it66121: ->get_edid callback must not return err pointers +- drm/amd/pm: Handle non-terminated overdrive commands. +- ext4: fix racy may inline data check in dio write +- ext4: properly sync file size update after O_SYNC direct IO +- ext4: add missed brelse in update_backups +- ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks +- ext4: correct the start block of counting reserved clusters +- ext4: correct return value of ext4_convert_meta_bg +- ext4: mark buffer new if it is unwritten to avoid stale data exposure +- ext4: correct offset of gdb backup in non meta_bg group to update_backups +- ext4: apply umask if ACL support is disabled +- ext4: make sure allocate pending entry not fail +- ext4: no need to generate from free list in mballoc +- ext4: fix race between writepages and remount +- Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E" +- Revert "HID: logitech-dj: Add support for a new lightspeed receiver iteration" +- media: qcom: camss: Fix csid-gen2 for test pattern generator +- media: qcom: camss: Fix invalid clock enable bit disjunction +- media: qcom: camss: Fix set CSI2_RX_CFG1_VC_MODE when VC is greater than 3 +- media: qcom: camss: Fix missing vfe_lite clocks check +- media: qcom: camss: Fix VFE-480 vfe_disable_output() +- media: qcom: camss: Fix VFE-17x vfe_disable_output() +- media: qcom: camss: Fix vfe_get() error jump +- media: qcom: camss: Fix pm_domain_on sequence in probe +- mmc: sdhci-pci-gli: GL9750: Mask the replay timer timeout of AER +- r8169: add handling DASH when DASH is disabled +- r8169: fix network lost after resume on DASH systems +- selftests: mptcp: fix fastclose with csum failure +- mptcp: fix setsockopt(IP_TOS) subflow locking +- mptcp: add validity check for sending RM_ADDR +- mptcp: deal with large GSO size +- mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors +- mm: fix for negative counter: nr_file_hugepages +- mmc: sdhci-pci-gli: A workaround to allow GL9750 to enter ASPM L1.2 +- riscv: kprobes: allow writing to x0 +- riscv: correct pt_level name via pgtable_l5/4_enabled +- riscv: mm: Update the comment of CONFIG_PAGE_OFFSET +- riscv: put interrupt entries into .irqentry.text +- riscv: Using TOOLCHAIN_HAS_ZIHINTPAUSE marco replace zihintpause +- swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC +- swiotlb: do not free decrypted pages if dynamic +- tracing: fprobe-event: Fix to check tracepoint event and return +- LoongArch: Mark __percpu functions as always inline +- NFSD: Update nfsd_cache_append() to use xdr_stream +- nfsd: fix file memleak on client_opens_release +- dm-verity: don't use blocking calls from tasklets +- dm-bufio: fix no-sleep mode +- drm/mediatek/dp: fix memory leak on ->get_edid callback error path +- drm/mediatek/dp: fix memory leak on ->get_edid callback audio detection +- media: ccs: Correctly initialise try compose rectangle +- media: venus: hfi: add checks to handle capabilities from firmware +- media: venus: hfi: fix the check to handle session buffer requirement +- media: venus: hfi_parser: Add check to keep the number of codecs within range +- media: sharp: fix sharp encoding +- media: lirc: drop trailing space from scancode transmit +- f2fs: split initial and dynamic conditions for extent_cache +- f2fs: avoid format-overflow warning +- f2fs: set the default compress_level on ioctl +- f2fs: do not return EFSCORRUPTED, but try to run online repair +- i2c: i801: fix potential race in i801_block_transaction_byte_by_byte +- gfs2: don't withdraw if init_threads() got interrupted +- net: phylink: initialize carrier state at creation +- net: dsa: lan9303: consequently nested-lock physical MDIO +- net: ethtool: Fix documentation of ethtool_sprintf() +- s390/ap: fix AP bus crash on early config change callback invocation +- i2c: designware: Disable TX_EMPTY irq while waiting for block length byte +- sbsa_gwdt: Calculate timeout with 64-bit math +- lsm: fix default return value for inode_getsecctx +- lsm: fix default return value for vm_enough_memory +- Revert "i2c: pxa: move to generic GPIO recovery" +- Revert ncsi: Propagate carrier gain/loss events to the NCSI controller +- ALSA: hda/realtek: Add quirks for HP Laptops +- ALSA: hda/realtek: Enable Mute LED on HP 255 G10 +- ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC +- ALSA: hda/realtek - Add Dell ALC295 to pin fall back table +- ALSA: hda/realtek: Enable Mute LED on HP 255 G8 +- ALSA: info: Fix potential deadlock at disconnection +- btrfs: zoned: wait for data BG to be finished on direct IO allocation +- xfs: recovery should not clear di_flushiter unconditionally +- cifs: Fix encryption of cleared, but unset rq_iter data buffers +- cifs: do not pass cifs_sb when trying to add channels +- cifs: do not reset chan_max if multichannel is not supported at mount +- cifs: force interface update before a fresh session setup +- cifs: reconnect helper should set reconnect for the right channel +- smb: client: fix mount when dns_resolver key is not available +- smb: client: fix potential deadlock when releasing mids +- smb: client: fix use-after-free in smb2_query_info_compound() +- smb: client: fix use-after-free bug in cifs_debug_data_proc_show() +- smb3: fix caching of ctime on setxattr +- smb3: allow dumping session and tcon id to improve stats analysis and debugging +- smb3: fix touch -h of symlink +- smb3: fix creating FIFOs when mounting with "sfu" mount option +- xhci: Enable RPM on controllers that support low-power states +- parisc: fix mmap_base calculation when stack grows upwards +- parisc/power: Fix power soft-off when running on qemu +- parisc/pgtable: Do not drop upper 5 address bits of physical address +- parisc: Prevent booting 64-bit kernels on PA1.x machines +- selftests/resctrl: Extend signal handler coverage to unmount on receiving signal +- selftests/resctrl: Make benchmark command const and build it with pointers +- selftests/resctrl: Simplify span lifetime +- selftests/resctrl: Remove bw_report and bm_type from main() +- rcutorture: Fix stuttering races and other issues +- torture: Make torture_hrtimeout_ns() take an hrtimer mode parameter +- drm/amd/display: enable dsc_clk even if dsc_pg disabled +- Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE +- Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables +- apparmor: Fix regression in mount mediation +- apparmor: pass cred through to audit info. +- apparmor: rename audit_data->label to audit_data->subj_label +- apparmor: combine common_audit_data and apparmor_audit_data +- apparmor: Fix kernel-doc warnings in apparmor/policy.c +- apparmor: Fix kernel-doc warnings in apparmor/resource.c +- apparmor: Fix kernel-doc warnings in apparmor/lib.c +- apparmor: Fix kernel-doc warnings in apparmor/audit.c +- cxl/port: Fix delete_endpoint() vs parent unregistration race +- cxl/region: Fix x1 root-decoder granularity calculations +- i3c: master: svc: fix random hot join failure since timeout error +- i3c: master: svc: fix SDA keep low when polling IBIWON timeout happen +- i3c: master: svc: fix check wrong status register in irq handler +- i3c: master: svc: fix ibi may not return mandatory data byte +- i3c: master: svc: fix wrong data return when IBI happen during start frame +- i3c: master: svc: fix race condition in ibi work thread +- i3c: master: cdns: Fix reading status register +- cxl/region: Do not try to cleanup after cxl_region_setup_targets() fails +- mtd: cfi_cmdset_0001: Byte swap OTP info +- mm: make PR_MDWE_REFUSE_EXEC_GAIN an unsigned long +- mm/memory_hotplug: use pfn math in place of direct struct page manipulation +- mm/hugetlb: use nth_page() in place of direct struct page manipulation +- mm/cma: use nth_page() in place of direct struct page manipulation +- s390/cmma: fix detection of DAT pages +- s390/mm: add missing arch_set_page_dat() call to gmap allocations +- s390/mm: add missing arch_set_page_dat() call to vmem_crst_alloc() +- dmaengine: stm32-mdma: correct desc prep when channel running +- mcb: fix error handling for different scenarios when parsing +- driver core: Release all resources during unbind before updating device links +- tracing: Have the user copy of synthetic event address use correct context +- selftests/clone3: Fix broken test under !CONFIG_TIME_NS +- i2c: core: Run atomic i2c xfer when !preemptible +- mips: use nth_page() in place of direct struct page manipulation +- fs: use nth_page() in place of direct struct page manipulation +- scripts/gdb/vmalloc: disable on no-MMU +- kernel/reboot: emergency_restart: Set correct system_state +- quota: explicitly forbid quota files from being encrypted +- jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev +- ASoC: codecs: wsa-macro: fix uninitialized stack variables with name prefix +- hid: lenovo: Resend all settings on reset_resume for compact keyboards +- selftests/resctrl: Reduce failures due to outliers in MBA/MBM tests +- selftests/resctrl: Fix feature checks +- selftests/resctrl: Refactor feature check to use resource and feature name +- selftests/resctrl: Move _GNU_SOURCE define into Makefile +- selftests/resctrl: Remove duplicate feature check from CMT test +- selftests/resctrl: Fix uninitialized .sa_flags +- ASoC: codecs: wsa883x: make use of new mute_unmute_on_trigger flag +- ASoC: soc-dai: add flag to mute and unmute stream during trigger +- netfilter: nf_tables: split async and sync catchall in two functions +- netfilter: nf_tables: remove catchall element in GC sync path +- ima: detect changes to the backing overlay file +- ima: annotate iint mutex to avoid lockdep false positive warnings +- mfd: qcom-spmi-pmic: Fix revid implementation +- mfd: qcom-spmi-pmic: Fix reference leaks in revid helper +- leds: trigger: netdev: Move size check in set_device_name +- arm64: dts: qcom: ipq6018: Fix tcsr_mutex register size +- arm64: dts: qcom: ipq9574: Fix hwlock index for SMEM +- ACPI: FPDT: properly handle invalid FPDT subtables +- firmware: qcom_scm: use 64-bit calling convention only when client is 64-bit +- arm64: dts: qcom: ipq8074: Fix hwlock index for SMEM +- arm64: dts: qcom: ipq5332: Fix hwlock index for SMEM +- thermal: intel: powerclamp: fix mismatch in get function for max_idle +- btrfs: don't arbitrarily slow down delalloc if we're committing +- rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects +- PM: hibernate: Clean up sync_read handling in snapshot_write_next() +- PM: hibernate: Use __get_safe_page() rather than touching the list +- dt-bindings: timer: renesas,rz-mtu3: Fix overflow/underflow interrupt names +- arm64: dts: qcom: ipq6018: Fix hwlock index for SMEM +- rcu/tree: Defer setting of jiffies during stall reset +- svcrdma: Drop connection after an RDMA Read error +- wifi: wilc1000: use vmm_table as array in wilc struct +- PCI: Lengthen reset delay for VideoPropulsion Torrent QN16e card +- PCI: exynos: Don't discard .remove() callback +- PCI: kirin: Don't discard .remove() callback +- PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common() +- PCI: qcom-ep: Add dedicated callback for writing to DBI2 registers +- mmc: Add quirk MMC_QUIRK_BROKEN_CACHE_FLUSH for Micron eMMC Q2J54A +- mmc: sdhci_am654: fix start loop index for TAP value parsing +- mmc: vub300: fix an error code +- ksmbd: fix slab out of bounds write in smb_inherit_dacl() +- ksmbd: handle malformed smb1 message +- ksmbd: fix recursive locking in vfs helpers +- clk: qcom: ipq6018: drop the CLK_SET_RATE_PARENT flag from PLL clocks +- clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks +- integrity: powerpc: Do not select CA_MACHINE_KEYRING +- clk: visconti: Fix undefined behavior bug in struct visconti_pll_provider +- clk: socfpga: Fix undefined behavior bug in struct stratix10_clock_data +- powercap: intel_rapl: Downgrade BIOS locked limits pr_warn() to pr_debug() +- cpufreq: stats: Fix buffer overflow detection in trans_stats() +- parisc/power: Add power soft-off when running on qemu +- parisc/pdc: Add width field to struct pdc_model +- parisc/agp: Use 64-bit LE values in SBA IOMMU PDIR table +- pmdomain: imx: Make imx pgc power domain also set the fwnode +- arm64: module: Fix PLT counting when CONFIG_RANDOMIZE_BASE=n +- arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer +- pmdomain: amlogic: Fix mask for the second NNA mem PD domain +- PCI: keystone: Don't discard .probe() callback +- PCI: keystone: Don't discard .remove() callback +- KEYS: trusted: Rollback init_trusted() consistently +- KEYS: trusted: tee: Refactor register SHM usage +- pmdomain: bcm: bcm2835-power: check if the ASB register is equal to enable +- sched/core: Fix RQCF_ACT_SKIP leak +- genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware +- mmc: meson-gx: Remove setting of CMD_CFG_ERROR +- wifi: ath12k: fix dfs-radar and temperature event locking +- wifi: ath12k: fix htt mlo-offset event locking +- wifi: ath11k: fix gtk offload status event locking +- wifi: ath11k: fix htt pktlog locking +- wifi: ath11k: fix dfs radar event locking +- wifi: ath11k: fix temperature event locking +- regmap: Ensure range selector registers are updated after cache sync +- ACPI: resource: Do IRQ override on TongFang GMxXGxx +- parisc: Add nop instructions after TLB inserts +- mm/damon/sysfs: check error from damon_sysfs_update_target() +- mm/damon/core.c: avoid unintentional filtering out of schemes +- mm/damon/sysfs-schemes: handle tried regions sysfs directory allocation failure +- mm/damon/sysfs-schemes: handle tried region directory allocation failure +- mm/damon/core: avoid divide-by-zero during monitoring results update +- mm/damon: implement a function for max nr_accesses safe calculation +- mm/damon/ops-common: avoid divide-by-zero during region hotness calculation +- mm/damon/lru_sort: avoid divide-by-zero in hot threshold calculation +- dm crypt: account large pages in cc->n_allocated_pages +- fbdev: stifb: Make the STI next font pointer a 32-bit signed offset +- iommufd: Fix missing update of domains_itree after splitting iopt_area +- watchdog: move softlockup_panic back to early_param +- mm/damon/sysfs: update monitoring target regions for online input commit +- mm/damon/sysfs: remove requested targets when online-commit inputs +- PCI/sysfs: Protect driver's D3cold preference from user space +- hvc/xen: fix event channel handling for secondary consoles +- hvc/xen: fix error path in xen_hvc_init() to always register frontend driver +- hvc/xen: fix console unplug +- acpi/processor: sanitize _OSC/_PDC capabilities for Xen dom0 +- tty: serial: meson: fix hard LOCKUP on crtscts mode +- tty/sysrq: replace smp_processor_id() with get_cpu() +- proc: sysctl: prevent aliased sysctls from getting passed to init +- audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() +- audit: don't take task_lock() in audit_exe_compare() code path +- sched: psi: fix unprivileged polling against cgroups +- mmc: sdhci-pci-gli: GL9755: Mask the replay timer timeout of AER +- KVM: x86: Fix lapic timer interrupt lost after loading a snapshot. +- KVM: x86: Clear bit12 of ICR after APIC-write VM-exit +- KVM: x86: Ignore MSR_AMD64_TW_CFG access +- KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space +- x86/cpu/hygon: Fix the CPU topology evaluation for real +- x86/apic/msi: Fix misconfigured non-maskable MSI quirk +- x86/PCI: Avoid PME from D3hot/D3cold for AMD Rembrandt and Phoenix USB4 +- crypto: x86/sha - load modules based on CPU features +- x86/shstk: Delay signal entry SSP write until after user accesses +- scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR +- scsi: qla2xxx: Fix system crash due to bad pointer access +- scsi: ufs: qcom: Update PHY settings only when scaling to higher gears +- scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for selected registers +- scsi: mpt3sas: Fix loop logic +- bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END +- bpf: Fix check_stack_write_fixed_off() to correctly spill imm +- spi: Fix null dereference on suspend +- randstruct: Fix gcc-plugin performance mode to stay in group +- powerpc/perf: Fix disabling BHRB and instruction sampling +- perf intel-pt: Fix async branch flags +- media: venus: hfi: add checks to perform sanity on queue pointers +- drivers: perf: Check find_first_bit() return value +- perf: arm_cspmu: Reject events meant for other PMUs +- i915/perf: Fix NULL deref bugs with drm_dbg() calls +- perf/core: Fix cpuctx refcounting +- cifs: fix check of rc in function generate_smb3signingkey +- cifs: spnego: add ';' in HOST_KEY_LEN +- scsi: ufs: core: Expand MCQ queue slot to DeviceQueueDepth + 1 +- tools/power/turbostat: Enable the C-state Pre-wake printing +- tools/power/turbostat: Fix a knl bug +- macvlan: Don't propagate promisc change to lower dev in passthru +- net: sched: do not offload flows with a helper in act_ct +- net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors +- net/mlx5e: Check return value of snprintf writing to fw_version buffer +- net/mlx5e: Reduce the size of icosq_str +- net/mlx5: Increase size of irq name buffer +- net/mlx5e: Update doorbell for port timestamping CQ before the software counter +- net/mlx5e: Track xmit submission to PTP WQ after populating metadata map +- net/mlx5e: Avoid referencing skb after free-ing in drop path of mlx5e_sq_xmit_wqe +- net/mlx5e: Don't modify the peer sent-to-vport rules for IPSec offload +- net/mlx5e: Fix pedit endianness +- net/mlx5e: fix double free of encap_header in update funcs +- net/mlx5e: fix double free of encap_header +- net/mlx5: Decouple PHC .adjtime and .adjphase implementations +- net/mlx5: Free used cpus mask when an IRQ is released +- Revert "net/mlx5: DR, Supporting inline WQE when possible" +- io_uring/fdinfo: remove need for sqpoll lock for thread/pid retrieval +- gve: Fixes for napi_poll when budget is 0 +- pds_core: fix up some format-truncation complaints +- pds_core: use correct index to mask irq +- net: stmmac: avoid rx queue overrun +- net: stmmac: fix rx budget limit check +- netfilter: nf_tables: bogus ENOENT when destroying element which does not exist +- netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() +- netfilter: nf_conntrack_bridge: initialize err to 0 +- af_unix: fix use-after-free in unix_stream_read_actor() +- net: ethernet: cortina: Fix MTU max setting +- net: ethernet: cortina: Handle large frames +- net: ethernet: cortina: Fix max RX frame define +- bonding: stop the device in bond_setup_by_slave() +- ptp: annotate data-race around q->head and q->tail +- blk-mq: make sure active queue usage is held for bio_integrity_prep() +- xen/events: fix delayed eoi list handling +- ppp: limit MRU to 64K +- net: mvneta: fix calls to page_pool_get_stats +- tipc: Fix kernel-infoleak due to uninitialized TLV value +- net: hns3: fix VF wrong speed and duplex issue +- net: hns3: fix VF reset fail issue +- net: hns3: fix variable may not initialized problem in hns3_init_mac_addr() +- net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs +- net: hns3: fix incorrect capability bit display for copper port +- net: hns3: add barrier in vf mailbox reply process +- net: hns3: fix add VLAN fail issue +- xen/events: avoid using info_for_irq() in xen_send_IPI_one() +- net: ti: icssg-prueth: Fix error cleanup on failing pruss_request_mem_region +- net: ti: icssg-prueth: Add missing icss_iep_put to error path +- tty: Fix uninit-value access in ppp_sync_receive() +- ipvlan: add ipvlan_route_v6_outbound() helper +- net: set SOCK_RCU_FREE before inserting socket into hashtable +- bpf: fix control-flow graph checking in privileged mode +- bpf: fix precision backtracking instruction iteration +- bpf: handle ldimm64 properly in check_cfg() +- gcc-plugins: randstruct: Only warn about true flexible arrays +- vhost-vdpa: fix use after free in vhost_vdpa_probe() +- vdpa_sim_blk: allocate the buffer zeroed +- riscv: split cache ops out of dma-noncoherent.c +- drm/i915/tc: Fix -Wformat-truncation in intel_tc_port_init +- gfs2: Silence "suspicious RCU usage in gfs2_permission" warning +- riscv: provide riscv-specific is_trap_insn() +- RISC-V: hwprobe: Fix vDSO SIGSEGV +- SUNRPC: Fix RPC client cleaned up the freed pipefs dentries +- NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO +- SUNRPC: Add an IS_ERR() check back to where it was +- NFSv4.1: fix handling NFS4ERR_DELAY when testing for session trunking +- drm/i915/mtl: avoid stringop-overflow warning +- mtd: rawnand: meson: check return value of devm_kasprintf() +- mtd: rawnand: intel: check return value of devm_kasprintf() +- SUNRPC: ECONNRESET might require a rebind +- dt-bindings: serial: fix regex pattern for matching serial node children +- samples/bpf: syscall_tp_user: Fix array out-of-bound access +- samples/bpf: syscall_tp_user: Rename num_progs into nr_tests +- sched/core: Optimize in_task() and in_interrupt() a bit +- wifi: iwlwifi: Use FW rate for non-data frames +- mtd: rawnand: tegra: add missing check for platform_get_irq() +- pwm: Fix double shift bug +- drm/amdgpu: fix software pci_unplug on some chips +- ALSA: hda/realtek: Add quirk for ASUS UX7602ZM +- drm/qxl: prevent memory leak +- ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings +- i2c: dev: copy userspace array safely +- riscv: VMAP_STACK overflow detection thread-safe +- kgdb: Flush console before entering kgdb on panic +- gfs2: Fix slab-use-after-free in gfs2_qd_dealloc +- drm/amd/display: Avoid NULL dereference of timing generator +- media: imon: fix access to invalid resource for the second interface +- media: ccs: Fix driver quirk struct documentation +- media: cobalt: Use FIELD_GET() to extract Link Width +- gfs2: fix an oops in gfs2_permission +- gfs2: ignore negated quota changes +- media: ipu-bridge: increase sensor_name size +- media: vivid: avoid integer overflow +- media: gspca: cpia1: shift-out-of-bounds in set_flicker +- i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data. +- virtio-blk: fix implicit overflow on virtio_max_dma_size +- i2c: sun6i-p2wi: Prevent potential division by zero +- i2c: fix memleak in i2c_new_client_device() +- i2c: i801: Add support for Intel Birch Stream SoC +- i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler +- 9p: v9fs_listxattr: fix %s null argument warning +- 9p/trans_fd: Annotate data-racy writes to file::f_flags +- usb: gadget: f_ncm: Always set current gadget in ncm_bind() +- usb: host: xhci: Avoid XHCI resume delay if SSUSB device is not present +- f2fs: fix error handling of __get_node_page +- f2fs: fix error path of __f2fs_build_free_nids +- soundwire: dmi-quirks: update HP Omen match +- usb: ucsi: glink: use the connector orientation GPIO to provide switch events +- usb: dwc3: core: configure TX/RX threshold for DWC3_IP +- phy: qualcomm: phy-qcom-eusb2-repeater: Zero out untouched tuning regs +- phy: qualcomm: phy-qcom-eusb2-repeater: Use regmap_fields +- dt-bindings: phy: qcom,snps-eusb2-repeater: Add magic tuning overrides +- tty: vcc: Add check for kstrdup() in vcc_probe() +- thunderbolt: Apply USB 3.x bandwidth quirk only in software connection manager +- iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe() +- mfd: intel-lpss: Add Intel Lunar Lake-M PCI IDs +- exfat: support handle zero-size directory +- HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W +- crypto: hisilicon/qm - prevent soft lockup in receive loop +- ASoC: Intel: soc-acpi-cht: Add Lenovo Yoga Tab 3 Pro YT3-X90 quirk +- PCI: Use FIELD_GET() in Sapphire RX 5600 XT Pulse quirk +- misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller +- PCI: dwc: Add missing PCI_EXP_LNKCAP_MLW handling +- PCI: dwc: Add dw_pcie_link_set_max_link_width() +- PCI: Disable ATS for specific Intel IPU E2000 devices +- PCI: Extract ATS disabling to a helper function +- PCI: Use FIELD_GET() to extract Link Width +- scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() +- PCI: Do error check on own line to split long "if" conditions +- atm: iphase: Do PCI error checks on own line +- PCI: mvebu: Use FIELD_PREP() with Link Width +- PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields +- gpiolib: of: Add quirk for mt2701-cs42448 ASoC sound +- ALSA: hda: Fix possible null-ptr-deref when assigning a stream +- ARM: 9320/1: fix stack depot IRQ stack filter +- HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround +- jfs: fix array-index-out-of-bounds in diAlloc +- jfs: fix array-index-out-of-bounds in dbFindLeaf +- fs/jfs: Add validity check for db_maxag and db_agpref +- fs/jfs: Add check for negative db_l2nbperpage +- scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool +- scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs +- RDMA/hfi1: Use FIELD_GET() to extract Link Width +- ASoC: SOF: ipc4: handle EXCEPTION_CAUGHT notification from firmware +- crypto: pcrypt - Fix hungtask for PADATA_RESET +- ASoC: cs35l56: Use PCI SSID as the firmware UID +- ASoC: Intel: sof_sdw: Copy PCI SSID to struct snd_soc_card +- ASoC: SOF: Pass PCI SSID to machine driver +- ASoC: soc-card: Add storage for PCI SSID +- ASoC: mediatek: mt8188-mt6359: support dynamic pinctrl +- selftests/efivarfs: create-read: fix a resource leak +- arm64: dts: ls208xa: use a pseudo-bus to constrain usb dma size +- arm64: dts: rockchip: Add NanoPC T6 PCIe e-key support +- soc: qcom: pmic: Fix resource leaks in a device_for_each_child_node() loop +- drm/amd: check num of link levels when update pcie param +- drm/amd/display: fix num_ways overflow error +- drm/amd: Disable PP_PCIE_DPM_MASK when dynamic speed switching not supported +- drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL +- drm/amdkfd: Fix shift out-of-bounds issue +- drm/panel: st7703: Pick different reset sequence +- drm/amdgpu/vkms: fix a possible null pointer dereference +- drm/radeon: fix a possible null pointer dereference +- drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference +- drm/panel: fix a possible null pointer dereference +- drm/amdgpu: Fix potential null pointer derefernce +- drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga +- drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 +- drm/msm/dp: skip validity check for DP CTS EDID checksum +- drm: vmwgfx_surface.c: copy user-array safely +- drm_lease.c: copy user-array safely +- kernel: watch_queue: copy user-array safely +- kernel: kexec: copy user-array safely +- string.h: add array-wrappers for (v)memdup_user() +- drm/amd/display: use full update for clip size increase of large plane source +- drm/amd: Update `update_pcie_parameters` functions to use uint8_t arguments +- drm/amdgpu: update retry times for psp vmbx wait +- drm/amdkfd: Fix a race condition of vram buffer unref in svm code +- drm/amdgpu: not to save bo in the case of RAS err_event_athub +- md: don't rely on 'mddev->pers' to be set in mddev_suspend() +- drm/edid: Fixup h/vsync_end instead of h/vtotal +- drm/amd/display: add seamless pipe topology transition check +- drm/amd/display: Don't lock phantom pipe on disabling +- drm/amd/display: Blank phantom OTG before enabling +- drm/komeda: drop all currently held locks if deadlock happens +- drm/amdkfd: ratelimited SQ interrupt messages +- drm/gma500: Fix call trace when psb_gem_mm_init() fails +- platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e +- of: address: Fix address translation when address-size is greater than 2 +- platform/chrome: kunit: initialize lock for fake ec_dev +- gpiolib: acpi: Add a ignore interrupt quirk for Peaq C1010 +- tsnep: Fix tsnep_request_irq() format-overflow warning +- ACPI: EC: Add quirk for HP 250 G7 Notebook PC +- Bluetooth: Fix double free in hci_conn_cleanup +- Bluetooth: btusb: Add date->evt_skb is NULL check +- wifi: iwlwifi: mvm: fix size check for fw_link_id +- bpf: Ensure proper register state printing for cond jumps +- vsock: read from socket's error queue +- net: sfp: add quirk for FS's 2.5G copper SFP +- wifi: ath10k: Don't touch the CE interrupt registers after power up +- wifi: ath12k: mhi: fix potential memory leak in ath12k_mhi_register() +- net: annotate data-races around sk->sk_dst_pending_confirm +- net: annotate data-races around sk->sk_tx_queue_mapping +- wifi: mt76: fix clang-specific fortify warnings +- wifi: mt76: mt7921e: Support MT7992 IP in Xiaomi Redmibook 15 Pro (2023) +- net: sfp: add quirk for Fiberstone GPON-ONU-34-20BI +- ACPI: APEI: Fix AER info corruption when error status data has multiple sections +- wifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps() +- wifi: ath10k: fix clang-specific fortify warning +- wifi: ath12k: fix possible out-of-bound read in ath12k_htt_pull_ppdu_stats() +- wifi: ath9k: fix clang-specific fortify warnings +- bpf: Detect IP == ksym.end as part of BPF program +- atl1c: Work around the DMA RX overflow issue +- wifi: mac80211: don't return unset power in ieee80211_get_tx_power() +- wifi: mac80211_hwsim: fix clang-specific fortify warning +- wifi: ath12k: Ignore fragments from uninitialized peer in dp +- wifi: plfxlc: fix clang-specific fortify warning +- x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size +- workqueue: Provide one lock class key per work_on_cpu() callsite +- cpu/hotplug: Don't offline the last non-isolated CPU +- smp,csd: Throw an error if a CSD lock is stuck for too long +- srcu: Only accelerate on enqueue time +- clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware +- clocksource/drivers/timer-imx-gpt: Fix potential memory leak +- selftests/lkdtm: Disable CONFIG_UBSAN_TRAP in test config +- srcu: Fix srcu_struct node grpmask overflow on 64-bit systems +- perf/core: Bail out early if the request AUX area is out of bound +- x86/retpoline: Make sure there are no unconverted return thunks due to KCSAN +- lib/generic-radix-tree.c: Don't overflow in peek() +- btrfs: abort transaction on generation mismatch when marking eb as dirty +- locking/ww_mutex/test: Fix potential workqueue corruption +- LoongArch: use arch specific phys_to_dma +- LoongArch: Fixed EIOINTC structure members +- LoongArch: Fix virtual machine startup error +- LoongArch: Old BPI compatibility +- LoongArch: add kernel setvirtmap for runtime +- arm64: openeuler_defconfig: update for new feature +- x86: openeuler_defconfig: update from new feature +- erofs: fix NULL dereference of dif->bdev_handle in fscache mode +- block: Remove blkdev_get_by_*() functions +- bcache: Fixup error handling in register_cache() +- xfs: Convert to bdev_open_by_path() +- reiserfs: Convert to bdev_open_by_dev/path() +- ocfs2: Convert to use bdev_open_by_dev() +- nfs/blocklayout: Convert to use bdev_open_by_dev/path() +- jfs: Convert to bdev_open_by_dev() +- f2fs: Convert to bdev_open_by_dev/path() +- ext4: Convert to bdev_open_by_dev() +- erofs: Convert to use bdev_open_by_path() +- btrfs: Convert to bdev_open_by_path() +- fs: Convert to bdev_open_by_dev() +- mm/swap: Convert to use bdev_open_by_dev() +- PM: hibernate: Drop unused snapshot_test argument +- PM: hibernate: Convert to bdev_open_by_dev() +- scsi: target: Convert to bdev_open_by_path() +- s390/dasd: Convert to bdev_open_by_path() +- nvmet: Convert to bdev_open_by_path() +- mtd: block2mtd: Convert to bdev_open_by_dev/path() +- md: Convert to bdev_open_by_dev() +- dm: Convert to bdev_open_by_dev() +- bcache: Convert to bdev_open_by_path() +- zram: Convert to use bdev_open_by_dev() +- xen/blkback: Convert to bdev_open_by_dev() +- rnbd-srv: Convert to use bdev_open_by_path() +- pktcdvd: Convert to bdev_open_by_dev() +- drdb: Convert to use bdev_open_by_path() +- block: Use bdev_open_by_dev() in disk_scan_partitions() and blkdev_bszset() +- block: Use bdev_open_by_dev() in blkdev_open() +- block: Provide bdev_open_* functions +- alinux: random: speed up the initialization of module +- keys: Allow automatic module signature with SM3 +- arm64: fix image size inflation with CONFIG_COMPAT_TASK_SIZE +- arm64: set 32-bit compatible TASK_SIZE_MAX to fix U32 libc_write_01 error +- arm64: replace is_compat_task() with is_ilp32_compat_task() in TASK_SIZE_MAX +- arm64: fix address limit problem with TASK_SIZE_MAX +- ilp32: fix compile problem when ARM64_ILP32 and UBSAN are both enabled +- arm64: fix abi change caused by ILP32 +- arm64: fix AUDIT_ARCH_AARCH64ILP32 bug on audit subsystem +- ilp32: skip ARM erratum 1418040 for ilp32 application +- ilp32: avoid clearing upper 32 bits of syscall return value for ilp32 +- arm64: secomp: fix the secure computing mode 1 syscall check for ilp32 +- arm64:ilp32: add ARM64_ILP32 to Kconfig +- arm64:ilp32: add vdso-ilp32 and use for signal return +- arm64: ptrace: handle ptrace_request differently for aarch32 and ilp32 +- arm64: ilp32: introduce ilp32-specific sigframe and ucontext +- arm64: signal32: move ilp32 and aarch32 common code to separated file +- arm64: signal: share lp64 signal structures and routines to ilp32 +- arm64: ilp32: introduce syscall table for ILP32 +- arm64: ilp32: share aarch32 syscall handlers +- arm64: ilp32: introduce binfmt_ilp32.c +- arm64: change compat_elf_hwcap and compat_elf_hwcap2 prefix to a32 +- arm64: introduce binfmt_elf32.c +- arm64: introduce AUDIT_ARCH_AARCH64ILP32 for ilp32 +- arm64: ilp32: add is_ilp32_compat_{task,thread} and TIF_32BIT_AARCH64 +- arm64: introduce is_a32_compat_{task,thread} for AArch32 compat +- arm64: uapi: set __BITS_PER_LONG correctly for ILP32 and LP64 +- arm64: rename functions that reference compat term +- arm64: rename COMPAT to AARCH32_EL0 +- arm64: ilp32: add documentation on the ILP32 ABI for ARM64 +- thread: move thread bits accessors to separated file +- ptrace: Add compat PTRACE_{G,S}ETSIGMASK handlers +- arm64: signal: Make parse_user_sigframe() independent of rt_sigframe layout + +* Tue Dec 5 2023 Zheng Zengkai <zhengzengkai@huawei.com> - 6.6.0-1.0.0.1 +- !3058 tcp/dccp: Add another way to allocate local ports in connect() +- !3064 mm: PCP high auto-tuning +- !2985 hugetlbfs: avoid overflow in hugetlbfs_fallocate +- !3059 Handle more faults under the VMA lock +- mm, pcp: reduce detecting time of consecutive high order page freeing +- mm, pcp: decrease PCP high if free pages < high watermark +- mm: tune PCP high automatically +- mm: add framework for PCP high auto-tuning +- mm, page_alloc: scale the number of pages that are batch allocated +- mm: restrict the pcp batch scale factor to avoid too long latency +- mm, pcp: reduce lock contention for draining high-order pages +- cacheinfo: calculate size of per-CPU data cache slice +- mm, pcp: avoid to drain PCP when process exit +- mm: handle write faults to RO pages under the VMA lock +- mm: handle read faults under the VMA lock +- mm: handle COW faults under the VMA lock +- mm: handle shared faults under the VMA lock +- mm: call wp_page_copy() under the VMA lock +- mm: make lock_folio_maybe_drop_mmap() VMA lock aware +- tcp/dccp: Add another way to allocate local ports in connect() +- !3044 mm: hugetlb: Skip initialization of gigantic tail struct pages if freed by HVO +- !2980 io_uring: fix soft lockup in io_submit_sqes() +- !3014 anolis: bond: broadcast ARP or ND messages to all slaves +- !3018 folio conversions for numa balance +- mm: hugetlb: skip initialization of gigantic tail struct pages if freed by HVO +- memblock: introduce MEMBLOCK_RSRV_NOINIT flag +- memblock: pass memblock_type to memblock_setclr_flag +- mm: hugetlb_vmemmap: use nid of the head page to reallocate it +- mm: remove page_cpupid_xchg_last() +- mm: use folio_xchg_last_cpupid() in wp_page_reuse() +- mm: convert wp_page_reuse() and finish_mkwrite_fault() to take a folio +- mm: make finish_mkwrite_fault() static +- mm: huge_memory: use folio_xchg_last_cpupid() in __split_huge_page_tail() +- mm: migrate: use folio_xchg_last_cpupid() in folio_migrate_flags() +- sched/fair: use folio_xchg_last_cpupid() in should_numa_migrate_memory() +- mm: add folio_xchg_last_cpupid() +- mm: remove xchg_page_access_time() +- mm: huge_memory: use a folio in change_huge_pmd() +- mm: mprotect: use a folio in change_pte_range() +- sched/fair: use folio_xchg_access_time() in numa_hint_fault_latency() +- mm: add folio_xchg_access_time() +- mm: remove page_cpupid_last() +- mm: huge_memory: use folio_last_cpupid() in __split_huge_page_tail() +- mm: huge_memory: use folio_last_cpupid() in do_huge_pmd_numa_page() +- mm: memory: use folio_last_cpupid() in do_numa_page() +- mm: add folio_last_cpupid() +- mm_types: add virtual and _last_cpupid into struct folio +- sched/numa, mm: make numa migrate functions to take a folio +- mm: mempolicy: make mpol_misplaced() to take a folio +- mm: memory: make numa_migrate_prep() to take a folio +- mm: memory: use a folio in do_numa_page() +- mm: huge_memory: use a folio in do_huge_pmd_numa_page() +- mm: memory: add vm_normal_folio_pmd() +- mm: migrate: remove isolated variable in add_page_for_migration() +- mm: migrate: remove PageHead() check for HugeTLB in add_page_for_migration() +- mm: migrate: use a folio in add_page_for_migration() +- mm: migrate: use __folio_test_movable() +- mm: migrate: convert migrate_misplaced_page() to migrate_misplaced_folio() +- mm: migrate: convert numamigrate_isolate_page() to numamigrate_isolate_folio() +- mm: migrate: remove THP mapcount check in numamigrate_isolate_page() +- mm: migrate: remove PageTransHuge check in numamigrate_isolate_page() +- anolis: bond: broadcast ARP or ND messages to all slaves +- hugetlbfs: avoid overflow in hugetlbfs_fallocate +- io_uring: fix soft lockup in io_submit_sqes() +- !2971 net: sched: sch_qfq: Use non-work-conserving warning handler +- !2968 checkpatch: Update link tags to fix ci warning +- net: sched: sch_qfq: Use non-work-conserving warning handler +- checkpatch: Update check of link tags +- !2945 Backport linux 6.6.2 LTS patches +- btrfs: make found_logical_ret parameter mandatory for function queue_scrub_stripe() +- btrfs: use u64 for buffer sizes in the tree search ioctls +- Revert "mmc: core: Capture correct oemid-bits for eMMC cards" +- Revert "PCI/ASPM: Disable only ASPM_STATE_L1 when driver, disables L1" +- x86/amd_nb: Use Family 19h Models 60h-7Fh Function 4 IDs +- io_uring/net: ensure socket is marked connected on connect retry +- selftests: mptcp: fix wait_rm_addr/sf parameters +- selftests: mptcp: run userspace pm tests slower +- eventfs: Check for NULL ef in eventfs_set_attr() +- tracing/kprobes: Fix the order of argument descriptions +- fbdev: fsl-diu-fb: mark wr_reg_wa() static +- ALSA: hda/realtek: Add support dual speaker for Dell +- fbdev: imsttfb: fix a resource leak in probe +- fbdev: imsttfb: fix double free in probe() +- arm64/arm: arm_pmuv3: perf: Don't truncate 64-bit registers +- spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies +- ASoC: dapm: fix clock get name +- ASoC: hdmi-codec: register hpd callback on component probe +- ASoC: mediatek: mt8186_mt6366_rt1019_rt5682s: trivial: fix error messages +- ASoC: rt712-sdca: fix speaker route missing issue +- drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE +- drm/vc4: tests: Fix UAF in the mock helpers +- fs: dlm: Simplify buffer size computation in dlm_create_debug_file() +- module/decompress: use kvmalloc() consistently +- drivers: perf: Do not broadcast to other cpus when starting a counter +- net: ti: icss-iep: fix setting counter value +- RISC-V: Don't fail in riscv_of_parent_hartid() for disabled HARTs +- net/sched: act_ct: Always fill offloading tuple iifidx +- netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses +- netfilter: xt_recent: fix (increase) ipv6 literal buffer length +- i2c: iproc: handle invalid slave state +- net: enetc: shorten enetc_setup_xdp_prog() error message to fit NETLINK_MAX_FMTMSG_LEN +- virtio/vsock: Fix uninit-value in virtio_transport_recv_pkt() +- r8169: respect userspace disabling IFF_MULTICAST +- vsock/virtio: remove socket from connected/bound list on shutdown +- blk-core: use pr_warn_ratelimited() in bio_check_ro() +- nbd: fix uaf in nbd_open +- tg3: power down device only on SYSTEM_POWER_OFF +- ice: Fix VF-VF direction matching in drop rule in switchdev +- ice: Fix VF-VF filter rules in switchdev mode +- ice: lag: in RCU, use atomic allocation +- ice: Fix SRIOV LAG disable on non-compliant aggregate +- riscv: boot: Fix creation of loader.bin +- nvme: fix error-handling for io_uring nvme-passthrough +- net/smc: put sk reference if close work was canceled +- net/smc: allow cdc msg send rather than drop it with NULL sndbuf_desc +- net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT +- octeontx2-pf: Free pending and dropped SQEs +- selftests: pmtu.sh: fix result checking +- net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs +- Fix termination state for idr_for_each_entry_ul() +- net: r8169: Disable multicast filter for RTL8168H and RTL8107E +- dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. +- dccp: Call security_inet_conn_request() after setting IPv4 addresses. +- net: page_pool: add missing free_percpu when page_pool_init fail +- octeontx2-pf: Fix holes in error code +- octeontx2-pf: Fix error codes +- inet: shrink struct flowi_common +- bpf: Check map->usercnt after timer->timer is assigned +- rxrpc: Fix two connection reaping bugs +- tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING +- hsr: Prevent use after free in prp_create_tagged_frame() +- llc: verify mac len before reading mac header +- watchdog: ixp4xx: Make sure restart always works +- watchdog: marvell_gti_wdt: Fix error code in probe() +- Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() +- pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume +- pwm: sti: Reduce number of allocations and drop usage of chip_data +- drm/amdgpu: don't put MQDs in VRAM on ARM | ARM64 +- drm/amdgpu/gfx10,11: use memcpy_to/fromio for MQDs +- regmap: prevent noinc writes from clobbering cache +- cpupower: fix reference to nonexistent document +- media: cec: meson: always include meson sub-directory in Makefile +- media: platform: mtk-mdp3: fix uninitialized variable in mdp_path_config() +- media: mediatek: vcodec: using encoder device to alloc/free encoder memory +- media: imx-jpeg: notify source chagne event when the first picture parsed +- media: mediatek: vcodec: Handle invalid encoder vsi +- media: verisilicon: Fixes clock list for rk3588 av1 decoder +- media: dvb-usb-v2: af9035: fix missing unlock +- media: cadence: csi2rx: Unregister v4l2 async notifier +- media: i2c: imx219: Drop IMX219_REG_CSI_LANE_MODE from common regs array +- media: i2c: imx219: Replace register addresses with macros +- media: i2c: imx219: Convert to CCI register access helpers +- media: cedrus: Fix clock/reset sequence +- media: vidtv: mux: Add check and kfree for kstrdup +- media: vidtv: psi: Add check for kstrdup +- media: s3c-camif: Avoid inappropriate kfree() +- media: mtk-jpegenc: Fix bug in JPEG encode quality selection +- media: amphion: handle firmware debug message +- media: bttv: fix use after free error due to btv->timeout timer +- media: ov5640: Fix a memory leak when ov5640_probe fails +- media: i2c: max9286: Fix some redundant of_node_put() calls +- media: ov5640: fix vblank unchange issue when work at dvp mode +- media: ov13b10: Fix some error checking in probe +- media: verisilicon: Do not enable G2 postproc downscale if source is narrower than destination +- media: hantro: Check whether reset op is defined before use +- media: imx-jpeg: initiate a drain of the capture queue in dynamic resolution change +- pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() +- pcmcia: ds: fix refcount leak in pcmcia_device_add() +- pcmcia: cs: fix possible hung task and memory leak pccardd() +- cxl/hdm: Remove broken error path +- cxl/port: Fix @host confusion in cxl_dport_setup_regs() +- cxl/core/regs: Rename @dev to @host in struct cxl_register_map +- cxl/region: Fix cxl_region_rwsem lock held when returning to user space +- cxl/region: Use cxl_calc_interleave_pos() for auto-discovery +- cxl/region: Calculate a target position in a region interleave +- cxl/region: Prepare the decoder match range helper for reuse +- rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call +- virt: sevguest: Fix passing a stack buffer as a scatterlist target +- cxl/mem: Fix shutdown order +- cxl/memdev: Fix sanitize vs decoder setup locking +- cxl/pci: Fix sanitize notifier setup +- cxl/pci: Clarify devm host for memdev relative setup +- cxl/pci: Remove inconsistent usage of dev_err_probe() +- cxl/pci: Cleanup 'sanitize' to always poll +- cxl/pci: Remove unnecessary device reference management in sanitize work +- rtc: brcmstb-waketimer: support level alarm_irq +- i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs +- rtla: Fix uninitialized variable found +- 9p/net: fix possible memory leak in p9_check_errors() +- perf vendor events intel: Add broadwellde two metrics +- perf vendor events intel: Fix broadwellde tma_info_system_dram_bw_use metric +- perf hist: Add missing puts to hist__account_cycles +- libperf rc_check: Make implicit enabling work for GCC +- perf machine: Avoid out of bounds LBR memory read +- powerpc/vmcore: Add MMU information to vmcoreinfo +- usb: host: xhci-plat: fix possible kernel oops while resuming +- xhci: Loosen RPM as default policy to cover for AMD xHC 1.1 +- perf vendor events: Update PMC used in PM_RUN_INST_CMPL event for power10 platform +- powerpc/pseries: fix potential memory leak in init_cpu_associativity() +- powerpc/imc-pmu: Use the correct spinlock initializer. +- powerpc/vas: Limit open window failure messages in log bufffer +- perf trace: Use the right bpf_probe_read(_str) variant for reading user data +- powerpc: Hide empty pt_regs at base of the stack +- powerpc/xive: Fix endian conversion size +- powerpc/40x: Remove stale PTE_ATOMIC_UPDATES macro +- perf tools: Do not ignore the default vmlinux.h +- modpost: fix ishtp MODULE_DEVICE_TABLE built on big-endian host +- modpost: fix tee MODULE_DEVICE_TABLE built on big-endian host +- s390/ap: re-init AP queues on config on +- perf mem-events: Avoid uninitialized read +- perf parse-events: Fix for term values that are raw events +- perf build: Add missing comment about NO_LIBTRACEEVENT=1 +- interconnect: fix error handling in qnoc_probe() +- powerpc: Only define __parse_fpscr() when required +- interconnect: qcom: osm-l3: Replace custom implementation of COUNT_ARGS() +- interconnect: qcom: sm8350: Set ACV enable_mask +- interconnect: qcom: sm8250: Set ACV enable_mask +- interconnect: qcom: sm8150: Set ACV enable_mask +- interconnect: qcom: sm6350: Set ACV enable_mask +- interconnect: qcom: sdm845: Set ACV enable_mask +- interconnect: qcom: sdm670: Set ACV enable_mask +- interconnect: qcom: sc8280xp: Set ACV enable_mask +- interconnect: qcom: sc8180x: Set ACV enable_mask +- interconnect: qcom: sc7280: Set ACV enable_mask +- interconnect: qcom: sc7180: Set ACV enable_mask +- interconnect: qcom: qdu1000: Set ACV enable_mask +- f2fs: fix to initialize map.m_pblk in f2fs_precache_extents() +- dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() +- USB: usbip: fix stub_dev hub disconnect +- tools: iio: iio_generic_buffer ensure alignment +- debugfs: Fix __rcu type comparison warning +- misc: st_core: Do not call kfree_skb() under spin_lock_irqsave() +- tools/perf: Update call stack check in builtin-lock.c +- dmaengine: ti: edma: handle irq_of_parse_and_map() errors +- usb: chipidea: Simplify Tegra DMA alignment code +- usb: chipidea: Fix DMA overwrite for Tegra +- usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency +- dmaengine: idxd: Register dsa_bus_type before registering idxd sub-drivers +- perf record: Fix BTF type checks in the off-cpu profiling +- perf vendor events arm64: Fix for AmpereOne metrics +- pinctrl: renesas: rzg2l: Make reverse order of enable() for disable() +- livepatch: Fix missing newline character in klp_resolve_symbols() +- perf parse-events: Fix tracepoint name memory leak +- tty: tty_jobctrl: fix pid memleak in disassociate_ctty() +- f2fs: fix to drop meta_inode's page cache in f2fs_put_super() +- f2fs: compress: fix to avoid redundant compress extension +- f2fs: compress: fix to avoid use-after-free on dic +- f2fs: compress: fix deadloop in f2fs_write_cache_pages() +- perf kwork: Set ordered_events to true in 'struct perf_tool' +- perf kwork: Add the supported subcommands to the document +- perf kwork: Fix incorrect and missing free atom in work_push_atom() +- pinctrl: baytrail: fix debounce disable case +- iio: frequency: adf4350: Use device managed functions and fix power down issue. +- perf stat: Fix aggr mode initialization +- apparmor: fix invalid reference on profile->disconnected +- scripts/gdb: fix usage of MOD_TEXT not defined when CONFIG_MODULES=n +- leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu' +- leds: pwm: Don't disable the PWM when the LED should be off +- leds: turris-omnia: Do not use SMBUS calls +- mfd: arizona-spi: Set pdata.hpdet_channel for ACPI enumerated devs +- dt-bindings: mfd: mt6397: Split out compatible for MediaTek MT6366 PMIC +- mfd: dln2: Fix double put in dln2_probe +- mfd: core: Ensure disabled devices are skipped without aborting +- mfd: core: Un-constify mfd_cell.of_reg +- IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF +- erofs: fix erofs_insert_workgroup() lockref usage +- ASoC: ams-delta.c: use component after check +- crypto: qat - fix deadlock in backlog processing +- crypto: qat - fix ring to service map for QAT GEN4 +- crypto: qat - use masks for AE groups +- crypto: qat - refactor fw config related functions +- crypto: qat - enable dc chaining service +- crypto: qat - consolidate services structure +- certs: Break circular dependency when selftest is modular +- padata: Fix refcnt handling in padata_free_shell() +- PCI: endpoint: Fix double free in __pci_epc_create() +- ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails +- HID: logitech-hidpp: Move get_wireless_feature_index() check to hidpp_connect_event() +- HID: logitech-hidpp: Revert "Don't restart communication if not necessary" +- HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only +- sh: bios: Revive earlyprintk support +- HID: uclogic: Fix a work->entry not empty bug in __queue_work() +- HID: uclogic: Fix user-memory-access bug in uclogic_params_ugee_v2_init_event_hooks() +- hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip +- RDMA/hfi1: Workaround truncation compilation error +- scsi: ufs: core: Leave space for '\0' in utf8 desc string +- ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe +- ASoC: intel: sof_sdw: Stop processing CODECs when enough are found +- ASoC: SOF: core: Ensure sof_ops_free() is still called when probe never ran. +- RDMA/hns: Fix init failure of RoCE VF and HIP08 +- RDMA/hns: Fix unnecessary port_num transition in HW stats allocation +- RDMA/hns: The UD mode can only be configured with DCQCN +- RDMA/hns: Add check for SL +- RDMA/hns: Fix signed-unsigned mixed comparisons +- RDMA/hns: Fix uninitialized ucmd in hns_roce_create_qp_common() +- RDMA/hns: Fix printing level of asynchronous events +- IB/mlx5: Fix rdma counter binding for RAW QP +- dlm: fix no ack after final message +- dlm: be sure we reset all nodes at forced shutdown +- dlm: fix remove member after close call +- dlm: fix creating multiple node structures +- fs: dlm: Fix the size of a buffer in dlm_create_debug_file() +- ASoC: fsl-asoc-card: Add comment for mclk in the codec_priv +- ASoC: Intel: sof_sdw_rt_sdca_jack_common: add rt713 support +- backlight: pwm_bl: Disable PWM on shutdown, suspend and remove +- ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member not described +- kselftest: vm: fix mdwe's mmap_FIXED test case +- ext4: move 'ix' sanity check to corrent position +- ext4: add missing initialization of call_notify_error in update_super_work() +- ARM: 9323/1: mm: Fix ARCH_LOW_ADDRESS_LIMIT when CONFIG_ZONE_DMA +- ARM: 9321/1: memset: cast the constant byte to unsigned char +- crypto: hisilicon/qm - fix PF queue parameter issue +- hid: cp2112: Fix duplicate workqueue initialization +- PCI: vmd: Correct PCI Header Type Register's multi-function check +- ASoC: SOF: ipc4-topology: Use size_add() in call to struct_size() +- crypto: qat - increase size of buffers +- crypto: caam/jr - fix Chacha20 + Poly1305 self test failure +- crypto: caam/qi2 - fix Chacha20 + Poly1305 self test failure +- nd_btt: Make BTT lanes preemptible +- libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return value +- ASoC: soc-pcm.c: Make sure DAI parameters cleared if the DAI becomes inactive +- scsi: ibmvfc: Fix erroneous use of rtas_busy_delay with hcall return code +- crypto: qat - fix unregistration of compression algorithms +- crypto: qat - fix unregistration of crypto algorithms +- crypto: qat - ignore subsequent state up commands +- crypto: qat - fix state machines cleanup paths +- RDMA/core: Use size_{add,sub,mul}() in calls to struct_size() +- hwrng: geode - fix accessing registers +- hwrng: bcm2835 - Fix hwrng throughput regression +- crypto: hisilicon/hpre - Fix a erroneous check after snprintf() +- crypto: ccp - Fix some unfused tests +- crypto: ccp - Fix sample application signature passing +- crypto: ccp - Fix DBC sample application error handling +- crypto: ccp - Fix ioctl unit tests +- crypto: ccp - Get a free page to use while fetching initial nonce +- KEYS: Include linux/errno.h in linux/verification.h +- ALSA: hda: cs35l41: Undo runtime PM changes at driver exit time +- ALSA: hda: cs35l41: Fix unbalanced pm_runtime_get() +- ASoC: cs35l41: Undo runtime PM changes at driver exit time +- ASoC: cs35l41: Verify PM runtime resume errors in IRQ handler +- ASoC: cs35l41: Fix broken shared boost activation +- ASoC: cs35l41: Initialize completion object before requesting IRQ +- ASoC: cs35l41: Handle mdsync_up reg write errors +- ASoC: cs35l41: Handle mdsync_down reg write errors +- module/decompress: use vmalloc() for gzip decompression workspace +- iommufd: Add iopt_area_alloc() +- ARM: dts: BCM5301X: Explicitly disable unused switch CPU ports +- soc: qcom: pmic_glink: fix connector type to be DisplayPort +- selftests/resctrl: Ensure the benchmark commands fits to its array +- selftests/pidfd: Fix ksft print formats +- arm64: tegra: Use correct interrupts for Tegra234 TKE +- memory: tegra: Set BPMP msg flags to reset IPC channels +- firmware: tegra: Add suspend hook and reset BPMP IPC early on resume +- arm64: tegra: Fix P3767 QSPI speed +- arm64: tegra: Fix P3767 card detect polarity +- arm64: dts: imx8mn: Add sound-dai-cells to micfil node +- arm64: dts: imx8mm: Add sound-dai-cells to micfil node +- arm64: dts: imx8mp-debix-model-a: Remove USB hub reset-gpios +- arm64: dts: imx8qm-ss-img: Fix jpegenc compatible entry +- clk: scmi: Free scmi_clk allocated when the clocks with invalid info are skipped +- ARM: dts: am3517-evm: Fix LED3/4 pinmux +- firmware: arm_ffa: Allow the FF-A drivers to use 32bit mode of messaging +- firmware: arm_ffa: Assign the missing IDR allocation ID to the FFA device +- arm64: dts: ti: Fix HDMI Audio overlay in Makefile +- arm64: dts: ti: k3-am62a7-sk: Drop i2c-1 to 100Khz +- arm64: dts: ti: k3-am625-beagleplay: Fix typo in ramoops reg +- arm64: dts: ti: verdin-am62: disable MIPI DSI bridge +- arm64: dts: ti: k3-j721s2-evm-gesi: Specify base dtb for overlay file +- firmware: ti_sci: Mark driver as non removable +- ARM: dts: stm32: stm32f7-pinctrl: don't use multiple blank lines +- kunit: test: Fix the possible memory leak in executor_test +- kunit: Fix possible memory leak in kunit_filter_suites() +- kunit: Fix the wrong kfree of copy for kunit_filter_suites() +- kunit: Fix missed memory release in kunit_free_suite_set() +- soc: qcom: llcc: Handle a second device without data corruption +- ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator +- ARM: dts: qcom: apq8026-samsung-matisse-wifi: Fix inverted hall sensor +- arm64: dts: qcom: apq8016-sbc: Add missing ADV7533 regulators +- riscv: dts: allwinner: remove address-cells from intc node +- arm64: dts: qcom: msm8939: Fix iommu local address range +- arm64: dts: qcom: msm8976: Fix ipc bit shifts +- ARM64: dts: marvell: cn9310: Use appropriate label for spi1 pins +- arm64: dts: qcom: sdx75-idp: align RPMh regulator nodes with bindings +- arm64: dts: qcom: sdm845-mtp: fix WiFi configuration +- arm64: dts: qcom: sm8350: fix pinctrl for UART18 +- arm64: dts: qcom: sm8150: add ref clock to PCIe PHYs +- arm64: dts: qcom: sc7280: drop incorrect EUD port on SoC side +- arm64: dts: qcom: sdm670: Fix pdc mapping +- arm64: dts: qcom: qrb2210-rb1: Fix regulators +- arm64: dts: qcom: qrb2210-rb1: Swap UART index +- arm64: dts: qcom: sc7280: Add missing LMH interrupts +- arm64: dts: qcom: sm6125: Pad APPS IOMMU address to 8 characters +- arm64: dts: qcom: msm8992-libra: drop duplicated reserved memory +- arm64: dts: qcom: msm8916: Fix iommu local address range +- arm64: dts: qcom: sc7280: link usb3_phy_wrapper_gcc_usb30_pipe_clk +- arm64: dts: qcom: sdm845: cheza doesn't support LMh node +- arm64: dts: qcom: sdm845: Fix PSCI power domain names +- ARM: dts: renesas: blanche: Fix typo in GP_11_2 pin name +- perf: hisi: Fix use-after-free when register pmu fails +- drivers/perf: hisi_pcie: Check the type first in pmu::event_init() +- perf/arm-cmn: Fix DTC domain detection +- drm/amd/pm: Fix a memory leak on an error path +- drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process +- drm: mediatek: mtk_dsi: Fix NO_EOT_PACKET settings/handling +- clocksource/drivers/arm_arch_timer: limit XGene-1 workaround +- drm/msm/dsi: free TX buffer in unbind +- drm/msm/dsi: use msm_gem_kernel_put to free TX buffer +- xen-pciback: Consider INTx disabled when MSI/MSI-X is enabled +- xen: irqfd: Use _IOW instead of the internal _IOC() macro +- xen: Make struct privcmd_irqfd's layout architecture independent +- xenbus: fix error exit in xenbus_init() +- drm/rockchip: Fix type promotion bug in rockchip_gem_iommu_map() +- arm64/arm: xen: enlighten: Fix KPTI checks +- drm/bridge: lt9611uxc: fix the race in the error path +- gpu: host1x: Correct allocated size for contexts +- drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe() +- drm/msm/a6xx: Fix unknown speedbin case +- drm/msm/adreno: Fix SM6375 GPU ID +- accel/habanalabs/gaudi2: Fix incorrect string length computation in gaudi2_psoc_razwi_get_engines() +- drm/mediatek: Fix iommu fault during crtc enabling +- drm/mediatek: Fix iommu fault by swapping FBs after updating plane state +- drm/mediatek: Add mmsys_dev_num to mt8188 vdosys0 driver data +- io_uring/kbuf: Allow the full buffer id space for provided buffers +- io_uring/kbuf: Fix check of BID wrapping in provided buffers +- drm/amd/display: Bail from dm_check_crtc_cursor if no relevant change +- drm/amd/display: Refactor dm_get_plane_scale helper +- drm/amd/display: Check all enabled planes in dm_check_crtc_cursor +- drm/amd/display: Fix null pointer dereference in error message +- drm/amdkfd: Handle errors from svm validate and map +- drm/amdkfd: Remove svm range validated_once flag +- drm/amdkfd: fix some race conditions in vram buffer alloc/free of svm code +- drm/amdgpu: Increase IH soft ring size for GFX v9.4.3 dGPU +- drm: Call drm_atomic_helper_shutdown() at shutdown/remove time for misc drivers +- drm/bridge: tc358768: Fix tc358768_ns_to_cnt() +- drm/bridge: tc358768: Clean up clock period code +- drm/bridge: tc358768: Rename dsibclk to hsbyteclk +- drm/bridge: tc358768: Use dev for dbg prints, not priv->dev +- drm/bridge: tc358768: Print logical values, not raw register values +- drm/bridge: tc358768: Use struct videomode +- drm/bridge: tc358768: Fix bit updates +- drm/bridge: tc358768: Fix use of uninitialized variable +- x86/tdx: Zero out the missing RSI in TDX_HYPERCALL macro +- drm/mediatek: Fix coverity issue with unintentional integer overflow +- drm/ssd130x: Fix screen clearing +- drm/bridge: lt8912b: Add missing drm_bridge_attach call +- drm/bridge: lt8912b: Manually disable HPD only if it was enabled +- drm/bridge: lt8912b: Fix crash on bridge detach +- drm/bridge: lt8912b: Fix bridge_detach +- drm: bridge: it66121: Fix invalid connector dereference +- drm/radeon: Remove the references of radeon_gem_ pread & pwrite ioctls +- drm/radeon: possible buffer overflow +- drm/rockchip: vop2: Add missing call to crtc reset helper +- drm/rockchip: vop2: Don't crash for invalid duplicate_state +- drm/rockchip: vop: Fix call to crtc reset helper +- drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs +- drm/loongson: Fix error handling in lsdc_pixel_pll_setup() +- drm: bridge: samsung-dsim: Fix waiting for empty cmd transfer FIFO on older Exynos +- drm: bridge: for GENERIC_PHY_MIPI_DPHY also select GENERIC_PHY +- drm: bridge: samsung-dsim: Initialize ULPS EXIT for i.MX8M DSIM +- spi: omap2-mcspi: Fix hardcoded reference clock +- spi: omap2-mcspi: switch to use modern name +- platform/chrome: cros_ec_lpc: Separate host command and irq disable +- hte: tegra: Fix missing error code in tegra_hte_test_probe() +- hwmon: (sch5627) Disallow write access if virtual registers are locked +- hwmon: (sch5627) Use bit macros when accessing the control register +- hwmon: (pmbus/mp2975) Move PGOOD fix +- Revert "hwmon: (sch56xx-common) Add automatic module loading on supported devices" +- Revert "hwmon: (sch56xx-common) Add DMI override table" +- hwmon: (coretemp) Fix potentially truncated sysfs attribute name +- hwmon: (axi-fan-control) Fix possible NULL pointer dereference +- regulator: qcom-rpmh: Fix smps4 regulator for pm8550ve +- platform/x86: wmi: Fix opening of char device +- platform/x86: wmi: Fix probe failure when failing to register WMI devices +- clk: mediatek: fix double free in mtk_clk_register_pllfh() +- clk: qcom: ipq5332: drop the CLK_SET_RATE_PARENT flag from GPLL clocks +- clk: qcom: ipq9574: drop the CLK_SET_RATE_PARENT flag from GPLL clocks +- clk: qcom: ipq5018: drop the CLK_SET_RATE_PARENT flag from GPLL clocks +- clk: qcom: apss-ipq-pll: Fix 'l' value for ipq5332_pll_config +- clk: qcom: apss-ipq-pll: Use stromer plus ops for stromer plus pll +- clk: qcom: clk-alpha-pll: introduce stromer plus ops +- clk: qcom: config IPQ_APSS_6018 should depend on QCOM_SMEM +- clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data +- clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data +- clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data +- clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data +- clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data +- clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data +- clk: npcm7xx: Fix incorrect kfree +- clk: ti: fix double free in of_ti_divider_clk_setup() +- clk: keystone: pll: fix a couple NULL vs IS_ERR() checks +- clk: ralink: mtmips: quiet unused variable warning +- spi: nxp-fspi: use the correct ioremap function +- clk: linux/clk-provider.h: fix kernel-doc warnings and typos +- clk: renesas: rzg2l: Fix computation formula +- clk: renesas: rzg2l: Use FIELD_GET() for PLL register fields +- clk: renesas: rzg2l: Trust value returned by hardware +- clk: renesas: rzg2l: Lock around writes to mux register +- clk: renesas: rzg2l: Wait for status bit of SD mux before continuing +- clk: renesas: rcar-gen3: Extend SDnH divider table +- clk: imx: imx8qxp: Fix elcdif_pll clock +- clk: imx: imx8mq: correct error handling path +- clk: imx: imx8: Fix an error handling path in imx8_acm_clk_probe() +- clk: imx: imx8: Fix an error handling path if devm_clk_hw_register_mux_parent_data_table() fails +- clk: imx: imx8: Fix an error handling path in clk_imx_acm_attach_pm_domains() +- clk: imx: Select MXC_CLK for CLK_IMX8QXP +- regulator: mt6358: Fail probe on unknown chip ID +- gpio: sim: initialize a managed pointer when declaring it +- clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src +- clk: qcom: mmcc-msm8998: Fix the SMMU GDSC +- clk: qcom: mmcc-msm8998: Don't check halt bit on some branch clks +- clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies +- clk: qcom: gcc-msm8996: Remove RPM bus clocks +- clk: qcom: ipq5332: Drop set rate parent from gpll0 dependent clocks +- spi: tegra: Fix missing IRQ check in tegra_slink_probe() +- regmap: debugfs: Fix a erroneous check after snprintf() +- ipvlan: properly track tx_errors +- net: add DEV_STATS_READ() helper +- virtio_net: use u64_stats_t infra to avoid data-races +- ipv6: avoid atomic fragment on GSO packets +- mptcp: properly account fastopen data +- ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() +- bpf: Fix unnecessary -EBUSY from htab_lock_bucket +- Bluetooth: hci_sync: Fix Opcode prints in bt_dev_dbg/err +- Bluetooth: Make handle of hci_conn be unique +- Bluetooth: ISO: Pass BIG encryption info through QoS +- wifi: iwlwifi: empty overflow queue during flush +- wifi: iwlwifi: mvm: update IGTK in mvmvif upon D3 resume +- wifi: iwlwifi: pcie: synchronize IRQs before NAPI +- wifi: iwlwifi: mvm: fix netif csum flags +- wifi: iwlwifi: increase number of RX buffers for EHT devices +- wifi: iwlwifi: mvm: remove TDLS stations from FW +- wifi: iwlwifi: mvm: fix iwl_mvm_mac_flush_sta() +- wifi: iwlwifi: mvm: change iwl_mvm_flush_sta() API +- wifi: iwlwifi: mvm: Don't always bind/link the P2P Device interface +- wifi: iwlwifi: mvm: Fix key flags for IGTK on AP interface +- wifi: iwlwifi: mvm: Correctly set link configuration +- wifi: iwlwifi: yoyo: swap cdb and jacket bits values +- wifi: mac80211: Fix setting vif links +- wifi: mac80211: don't recreate driver link debugfs in reconfig +- wifi: iwlwifi: mvm: use correct sta ID for IGTK/BIGTK +- wifi: iwlwifi: mvm: fix removing pasn station for responder +- wifi: iwlwifi: mvm: update station's MFP flag after association +- tcp: fix cookie_init_timestamp() overflows +- chtls: fix tp->rcv_tstamp initialization +- thermal: core: Don't update trip points inside the hysteresis range +- selftests/bpf: Make linked_list failure test more robust +- net: skb_find_text: Ignore patterns extending past 'to' +- bpf: Fix missed rcu read lock in bpf_task_under_cgroup() +- thermal/drivers/mediatek: Fix probe for THERMAL_V2 +- r8169: fix rare issue with broken rx after link-down on RTL8125 +- thermal: core: prevent potential string overflow +- wifi: rtw88: Remove duplicate NULL check before calling usb_kill/free_urb() +- virtio-net: fix the vq coalescing setting for vq resize +- virtio-net: fix per queue coalescing parameter setting +- virtio-net: consistently save parameters for per-queue +- virtio-net: fix mismatch of getting tx-frames +- netfilter: nf_tables: Drop pointless memset when dumping rules +- wifi: wfx: fix case where rates are out of order +- PM / devfreq: rockchip-dfi: Make pmu regmap mandatory +- can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds +- can: dev: can_restart(): fix race condition between controller restart and netif_carrier_on() +- can: dev: can_restart(): don't crash kernel if carrier is OK +- wifi: ath11k: fix Tx power value during active CAC +- r8152: break the loop when the budget is exhausted +- selftests/bpf: Define SYS_NANOSLEEP_KPROBE_NAME for riscv +- selftests/bpf: Define SYS_PREFIX for riscv +- libbpf: Fix syscall access arguments on riscv +- can: etas_es58x: add missing a blank line after declaration +- can: etas_es58x: rework the version check logic to silence -Wformat-truncation +- ACPI: video: Add acpi_backlight=vendor quirk for Toshiba Portégé R100 +- ACPI: property: Allow _DSD buffer data only for byte accessors +- wifi: rtlwifi: fix EDCA limit set by BT coexistence +- tcp_metrics: do not create an entry from tcp_init_metrics() +- tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics() +- tcp_metrics: add missing barriers on delete +- wifi: ath: dfs_pattern_detector: Fix a memory initialization issue +- wifi: mt76: mt7921: fix the wrong rate selected in fw for the chanctx driver +- wifi: mt76: mt7921: fix the wrong rate pickup for the chanctx driver +- wifi: mt76: move struct ieee80211_chanctx_conf up to struct mt76_vif +- wifi: mt76: mt7915: fix beamforming availability check +- wifi: mt76: fix per-band IEEE80211_CONF_MONITOR flag comparison +- wifi: mt76: get rid of false alamrs of tx emission issues +- wifi: mt76: fix potential memory leak of beacon commands +- wifi: mt76: update beacon size limitation +- wifi: mt76: mt7996: fix TWT command format +- wifi: mt76: mt7996: fix rx rate report for CBW320-2 +- wifi: mt76: mt7996: fix wmm queue mapping +- wifi: mt76: mt7996: fix beamformee ss subfield in EHT PHY cap +- wifi: mt76: mt7996: fix beamform mcu cmd configuration +- wifi: mt76: mt7996: set correct wcid in txp +- wifi: mt76: remove unused error path in mt76_connac_tx_complete_skb +- wifi: mt76: mt7603: improve stuck beacon handling +- wifi: mt76: mt7603: improve watchdog reset reliablity +- wifi: mt76: mt7603: rework/fix rx pse hang check +- cpufreq: tegra194: fix warning due to missing opp_put +- PM: sleep: Fix symbol export for _SIMPLE_ variants of _PM_OPS() +- wifi: mac80211: fix check for unusable RX result +- wifi: ath11k: fix boot failure with one MSI vector +- wifi: ath12k: fix DMA unmap warning on NULL DMA address +- wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug for debugfs_create_file() +- net: ethernet: mtk_wed: fix EXT_INT_STATUS_RX_FBUF definitions for MT7986 SoC +- ice: fix pin assignment for E810-T without SMA control +- net: spider_net: Use size_add() in call to struct_size() +- tipc: Use size_add() in calls to struct_size() +- tls: Use size_add() in call to struct_size() +- mlxsw: Use size_mul() in call to struct_size() +- gve: Use size_add() in call to struct_size() +- bpf: Fix kfunc callback register type handling +- tcp: call tcp_try_undo_recovery when an RTOd TFO SYNACK is ACKed +- selftests/bpf: Skip module_fentry_shadow test when bpf_testmod is not available +- udplite: fix various data-races +- udplite: remove UDPLITE_BIT +- udp: annotate data-races around udp->encap_type +- udp: lockless UDP_ENCAP_L2TPINUDP / UDP_GRO +- udp: move udp->accept_udp_{l4|fraglist} to udp->udp_flags +- udp: add missing WRITE_ONCE() around up->encap_rcv +- udp: move udp->gro_enabled to udp->udp_flags +- udp: move udp->no_check6_rx to udp->udp_flags +- udp: move udp->no_check6_tx to udp->udp_flags +- udp: introduce udp->udp_flags +- wifi: cfg80211: fix kernel-doc for wiphy_delayed_work_flush() +- bpf, x64: Fix tailcall infinite loop +- selftests/bpf: Correct map_fd to data_fd in tailcalls +- iavf: Fix promiscuous mode configuration flow messages +- i40e: fix potential memory leaks in i40e_remove() +- wifi: iwlwifi: don't use an uninitialized variable +- wifi: iwlwifi: honor the enable_ini value +- wifi: mac80211: fix # of MSDU in A-MSDU calculation +- wifi: cfg80211: fix off-by-one in element defrag +- wifi: mac80211: fix RCU usage warning in mesh fast-xmit +- wifi: mac80211: move sched-scan stop work to wiphy work +- wifi: mac80211: move offchannel works to wiphy work +- wifi: mac80211: move scan work to wiphy work +- wifi: mac80211: move radar detect work to wiphy work +- wifi: cfg80211: add flush functions for wiphy work +- wifi: ath12k: fix undefined behavior with __fls in dp +- irqchip/sifive-plic: Fix syscore registration for multi-socket systems +- genirq/matrix: Exclude managed interrupts in irq_matrix_allocated() +- string: Adjust strtomem() logic to allow for smaller sources +- PCI/MSI: Provide stubs for IMS functions +- selftests/x86/lam: Zero out buffer for readlink() +- perf: Optimize perf_cgroup_switch() +- pstore/platform: Add check for kstrdup +- x86/nmi: Fix out-of-order NMI nesting checks & false positive warning +- drivers/clocksource/timer-ti-dm: Don't call clk_get_rate() in stop function +- srcu: Fix callbacks acceleration mishandling +- x86/apic: Fake primary thread mask for XEN/PV +- cpu/SMT: Make SMT control more robust against enumeration failures +- x86/boot: Fix incorrect startup_gdt_descr.size +- x86/sev-es: Allow copy_from_kernel_nofault() in earlier boot +- cgroup/cpuset: Fix load balance state in update_partition_sd_lb() +- ACPI/NUMA: Apply SRAT proximity domain to entire CFMWS window +- x86/numa: Introduce numa_fill_memblks() +- futex: Don't include process MM in futex key on no-MMU +- x86/srso: Fix unret validation dependencies +- x86/srso: Fix vulnerability reporting for missing microcode +- x86/srso: Print mitigation for retbleed IBPB case +- x86/srso: Fix SBPB enablement for (possible) future fixed HW +- writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs +- vfs: fix readahead(2) on block devices +- nfsd: Handle EOPENSTALE correctly in the filecache +- sched: Fix stop_one_cpu_nowait() vs hotplug +- objtool: Propagate early errors +- sched/uclamp: Ignore (util == 0) optimization in feec() when p_util_max = 0 +- sched/uclamp: Set max_spare_cap_cpu even if max_spare_cap is 0 +- iov_iter, x86: Be consistent about the __user tag on copy_mc_to_user() +- sched/fair: Fix cfs_rq_is_decayed() on !SMP +- sched/topology: Fix sched_numa_find_nth_cpu() in non-NUMA case +- sched/topology: Fix sched_numa_find_nth_cpu() in CPU-less case +- numa: Generalize numa_map_to_online_node() +- hwmon: (nct6775) Fix incorrect variable reuse in fan_div calculation +- !2933 Backport linux 6.6.1 LTS patches +- ASoC: SOF: sof-pci-dev: Fix community key quirk detection +- ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection +- serial: core: Fix runtime PM handling for pending tx +- misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support +- dt-bindings: serial: rs485: Add rs485-rts-active-high +- tty: 8250: Add Brainboxes Oxford Semiconductor-based quirks +- tty: 8250: Add support for Intashield IX cards +- tty: 8250: Add support for additional Brainboxes PX cards +- tty: 8250: Fix up PX-803/PX-857 +- tty: 8250: Fix port count of PX-257 +- tty: 8250: Add support for Intashield IS-100 +- tty: 8250: Add support for Brainboxes UP cards +- tty: 8250: Add support for additional Brainboxes UC cards +- tty: 8250: Remove UC-257 and UC-431 +- tty: n_gsm: fix race condition in status line change on dead connections +- Bluetooth: hci_bcm4377: Mark bcm4378/bcm4387 as BROKEN_LE_CODED +- usb: raw-gadget: properly handle interrupted requests +- usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() +- usb: typec: tcpm: Add additional checks for contaminant +- usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility +- PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device +- ALSA: usb-audio: add quirk flag to enable native DSD for McIntosh devices +- eventfs: Use simple_recursive_removal() to clean up dentries +- eventfs: Delete eventfs_inode when the last dentry is freed +- eventfs: Save ownership and mode +- eventfs: Remove "is_freed" union with rcu head +- tracing: Have trace_event_file have ref counters +- perf evlist: Avoid frequency mode for the dummy event +- power: supply: core: Use blocking_notifier_call_chain to avoid RCU complaint +- drm/amd/display: Don't use fsleep for PSR exit waits +- !2927 dm ioctl: add DMINFO() to track dm device create/remove +- dm ioctl: add DMINFO() to track dm device create/remove +- !2900 Add initial openeuler_defconfig for arm64 and x86 +- config: add initial openeuler_defconfig for x86 +- config: add initial openeuler_defconfig for arm64 +- kconfig: Add script to check & update openeuler_defconfig +- init from linux v6.6 |