# changelog

author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.19.0.95
changelog:
  - !403 Backport 5.10.145 - 5.10.149 LTS
  - wifi: mac80211: don't parse mbssid in assoc response
  - mac80211: mlme: find auth challenge directly
  - Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
  - misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic
  - misc: pci_endpoint_test: Aggregate params checking for xfer
  - Input: xpad - fix wireless 360 controller breaking after suspend
  - Input: xpad - add supported devices as contributed on github
  - wifi: cfg80211: update hidden BSSes to avoid WARN_ON
  - wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
  - wifi: cfg80211: ensure length byte is present before access
  - wifi: cfg80211/mac80211: reject bad MBSSID elements
  - random: use expired timer rather than wq for mixing fast pool
  - random: avoid reading two cache lines on irq randomness
  - USB: serial: qcserial: add new usb-id for Dell branded EM7455
  - efi: Correct Macmini DMI match in uefi cert quirk
  - ALSA: hda: Fix position reporting on Poulsbo
  - random: clamp credited irq bits to maximum mixed
  - random: restore O_NONBLOCK support
  - Revert "clk: ti: Stop using legacy clkctrl names for omap4 and 5"
  - rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
  - USB: serial: ftdi_sio: fix 300 bps rate for SIO
  - mmc: core: Terminate infinite loop in SD-UHS voltage switch
  - mmc: core: Replace with already defined values for readability
  - drm/amd/display: skip audio setup when audio stream is enabled
  - drm/amd/display: update gamut remap if plane has changed
  - net: atlantic: fix potential memory leak in aq_ndev_close()
  - arch: um: Mark the stack non-executable to fix a binutils warning
  - um: Cleanup compiler warning in arch/x86/um/tls_32.c
  - um: Cleanup syscall_handler_t cast in syscalls_32.h
  - ALSA: hda/hdmi: Fix the converter reuse for the silent stream
  - net/ieee802154: fix uninit value bug in dgram_sendmsg
  - scsi: qedf: Fix a UAF bug in __qedf_probe()
  - ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer
  - dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure
  - dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property
  - dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling
  - firmware: arm_scmi: Add SCMI PM driver remove routine
  - compiler_attributes.h: move __compiletime_{error|warning}
  - powerpc/64s/radix: don't need to broadcast IPI for radix pmd collapse flush
  - mm: gup: fix the fast GUP race against THP collapse
  - xsk: Inherit need_wakeup flag for shared sockets
  - perf tools: Fixup get_current_dir_name() compilation
  - docs: update mediator information in CoC docs
  - Makefile.extrawarn: Move -Wcast-function-type-strict to W=1
  - ceph: don't truncate file in atomic_open
  - nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure
  - ALSA: hda/hdmi: fix warning about PCM count when used with SOF
  - x86/alternative: Fix race in try_get_desc()
  - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest
  - clk: iproc: Do not rely on node name for correct PLL setup
  - clk: imx: imx6sx: remove the SET_RATE_PARENT flag for QSPI clocks
  - selftests: Fix the if conditions of in test_extra_filter()
  - net: stmmac: power up/down serdes in stmmac_open/release
  - nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices
  - nvme: add new line after variable declatation
  - cxgb4: fix missing unlock on ETHOFLD desc collect fail path
  - net: sched: act_ct: fix possible refcount leak in tcf_ct_init()
  - usbnet: Fix memory leak in usbnet_disconnect()
  - Input: melfas_mip4 - fix return value check in mip4_probe()
  - Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time"
  - ASoC: tas2770: Reinit regcache on reset
  - soc: sunxi: sram: Fix debugfs info for A64 SRAM C
  - soc: sunxi: sram: Fix probe function ordering issues
  - soc: sunxi_sram: Make use of the helper function devm_platform_ioremap_resource()
  - soc: sunxi: sram: Prevent the driver from being unbound
  - soc: sunxi: sram: Actually claim SRAM regions
  - reset: imx7: Fix the iMX8MP PCIe PHY PERST support
  - ARM: dts: am33xx: Fix MMCHS0 dma properties
  - swiotlb: max mapping size takes min align mask into account
  - media: rkvdec: Disable H.264 error detection
  - media: dvb_vb2: fix possible out of bound access
  - mm: fix madivse_pageout mishandling on non-LRU page
  - mm/migrate_device.c: flush TLB while holding PTL
  - mm: prevent page_frag_alloc() from corrupting the memory
  - mm/page_alloc: fix race condition between build_all_zonelists and page allocation
  - mmc: hsq: Fix data stomping during mmc recovery
  - mmc: moxart: fix 4-bit bus width and remove 8-bit bus width
  - libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205
  - net: mt7531: only do PLL once after the reset
  - ntfs: fix BUG_ON in ntfs_lookup_inode_by_name()
  - ARM: dts: integrator: Tag PCI host with device_type
  - clk: ingenic-tcu: Properly enable registers before accessing timers
  - Input: snvs_pwrkey - fix SNVS_HPVIDR1 register address
  - net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455
  - thunderbolt: Explicitly reset plug events delay back to USB4 spec value
  - usb: typec: ucsi: Remove incorrect warning
  - uas: ignore UAS for Thinkplus chips
  - usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS
  - uas: add no-uas quirk for Hiksemi usb_disk
  - btrfs: fix hang during unmount when stopping a space reclaim worker
  - ALSA: hda: Fix Nvidia dp infoframe
  - ALSA: hda/hdmi: let new platforms assign the pcm slot dynamically
  - ALSA: hda/tegra: Reset hardware
  - ALSA: hda/tegra: Use clk_bulk helpers
  - thunderbolt: Add support for Intel Maple Ridge single port controller
  - thunderbolt: Add support for Intel Maple Ridge
  - ext4: make directory inode spreading reflect flexbg size
  - ext4: limit the number of retries after discarding preallocations blocks
  - devdax: Fix soft-reservation memory description
  - i2c: mlxbf: Fix frequency calculation
  - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()
  - i2c: mlxbf: incorrect base address passed during io write
  - i2c: imx: If pm_runtime_get_sync() returned 1 device access is possible
  - workqueue: don't skip lockdep work dependency in cancel_work_sync()
  - drm/rockchip: Fix return type of cdn_dp_connector_mode_valid
  - drm/amd/display: Mark dml30's UseMinimumDCFCLK() as noinline for stack usage
  - drm/amd/display: Limit user regamma to a valid value
  - drm/amdgpu: use dirty framebuffer helper
  - drm/gma500: Fix BUG: sleeping function called from invalid context errors
  - Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
  - cifs: always initialize struct msghdr smb_msg completely
  - cifs: use discard iterator to discard unneeded network data more efficiently
  - drm/amdgpu: Fix check for RAS support
  - vfio/type1: fix vaddr_get_pfns() return in vfio_pin_page_external()
  - usb: xhci-mtk: fix issue of out-of-bounds array access
  - s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup
  - serial: tegra-tcu: Use uart_xmit_advance(), fixes icount.tx accounting
  - serial: tegra: Use uart_xmit_advance(), fixes icount.tx accounting
  - serial: Create uart_xmit_advance()
  - drm/amd/amdgpu: fixing read wrong pf2vf data in SRIOV
  - selftests: forwarding: add shebang for sch_red.sh
  - net: sched: fix possible refcount leak in tc_new_tfilter()
  - net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD
  - net/smc: Stop the CLC flow if no link to map buffers on
  - drm/mediatek: dsi: Move mtk_dsi_stop() call back to mtk_dsi_poweroff()
  - perf kcore_copy: Do not check /proc/modules is unchanged
  - perf jit: Include program header in ELF files
  - can: gs_usb: gs_can_open(): fix race dev->can.state condition
  - netfilter: ebtables: fix memory leak when blob is malformed
  - netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain()
  - netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain()
  - net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs
  - net/sched: taprio: avoid disabling offload when it was never enabled
  - net: socket: remove register_gifconf
  - net: enetc: move enetc_set_psfp() out of the common enetc_set_features()
  - wireguard: netlink: avoid variable-sized memcpy on sockaddr
  - wireguard: ratelimiter: disable timings test by default
  - net: ipa: properly limit modem routing table use
  - net: ipa: kill IPA_TABLE_ENTRY_SIZE
  - net: ipa: DMA addresses are nicely aligned
  - net: ipa: avoid 64-bit modulus
  - net: ipa: fix table alignment requirement
  - net: ipa: fix assumptions about DMA address size
  - of: mdio: Add of_node_put() when breaking out of for_each_xx
  - drm/hisilicon: Add depends on MMU
  - drm/hisilicon/hibmc: Allow to be built if COMPILE_TEST is enabled
  - sfc: fix null pointer dereference in efx_hard_start_xmit
  - sfc: fix TX channel offset when using legacy interrupts
  - i40e: Fix set max_tx_rate when it is lower than 1 Mbps
  - i40e: Fix VF set max MTU size
  - iavf: Fix set max MTU size with port VLAN and jumbo frames
  - iavf: Fix bad page state
  - MIPS: Loongson32: Fix PHY-mode being left unspecified
  - MIPS: lantiq: export clk_get_io() for lantiq_wdt.ko
  - drm/panel: simple: Fix innolux_g121i1_l01 bus_format
  - net: team: Unsync device addresses on ndo_stop
  - net: bonding: Unsync device addresses on ndo_stop
  - net: bonding: Share lacpdu_mcast_addr definition
  - scsi: mpt3sas: Fix return value check of dma_get_required_mask()
  - scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region
  - net: phy: aquantia: wait for the suspend/resume operations to finish
  - net: core: fix flow symmetric hash
  - net: let flow have same hash in two directions
  - iavf: Fix cached head and tail value for iavf_get_tx_pending
  - netfilter: nf_conntrack_sip: fix ct_sip_walk_headers
  - arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma
  - dmaengine: ti: k3-udma-private: Fix refcount leak bug in of_xudma_dev_get()
  - arm64: dts: rockchip: Set RK3399-Gru PCLK_EDP to 24 MHz
  - drm/mediatek: dsi: Add atomic {destroy,duplicate}_state, reset callbacks
  - arm64: dts: rockchip: Pull up wlan wake# on Gru-Bob
  - xfs: validate inode fork size against fork format
  - xfs: reorder iunlink remove operation in xfs_ifree
  - interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate
  - mm/slub: fix to return errno if kmalloc() fails
  - can: flexcan: flexcan_mailbox_read() fix return value for drop = true
  - riscv: fix a nasty sigreturn bug...
  - gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully
  - gpio: mockup: fix NULL pointer dereference when removing debugfs
  - wifi: mt76: fix reading current per-tid starting sequence number for aggregation
  - efi: libstub: check Shim mode using MokSBStateRT
  - efi: x86: Wipe setup_data on pure EFI boot
  - media: flexcop-usb: fix endpoint type check
  - iommu/vt-d: Check correct capability for sagaw determination
  - ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5530 laptop
  - ALSA: hda/realtek: Add quirk for ASUS GA503R laptop
  - ALSA: hda/realtek: Add pincfg for ASUS G533Z HP jack
  - ALSA: hda/realtek: Add pincfg for ASUS G513 HP jack
  - ALSA: hda/realtek: Re-arrange quirk table entries
  - ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5570 laptop
  - ALSA: hda/realtek: Add quirk for Huawei WRT-WX9
  - ALSA: hda: add Intel 5 Series / 3400 PCI DID
  - ALSA: hda/tegra: set depop delay for tegra
  - USB: serial: option: add Quectel RM520N
  - USB: serial: option: add Quectel BG95 0x0203 composition
  - arm64/bti: Disable in kernel BTI when cross section thunks are broken
  - arm64: Restrict ARM64_BTI_KERNEL to clang 12.0.0 and newer
  - Revert "usb: gadget: udc-xilinx: replace memcpy with memcpy_toio"
  - vfio/type1: Unpin zero pages
  - vfio/type1: Prepare for batched pinning with struct vfio_batch
  - vfio/type1: Change success value of vaddr_get_pfn()
  - Revert "usb: add quirks for Lenovo OneLink+ Dock"
  - usb: cdns3: fix issue with rearming ISO OUT endpoint
  - usb: cdns3: fix incorrect handling TRB_SMM flag for ISOC transfer
  - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
  - usb: add quirks for Lenovo OneLink+ Dock
  - tty: serial: atmel: Preserve previous USART mode if RS485 disabled
  - serial: atmel: remove redundant assignment in rs485_config
  - mmc: core: Fix inconsistent sd3_bus_mode at UHS-I SD voltage switch failure
  - usb: xhci-mtk: relax TT periodic bandwidth allocation
  - usb: xhci-mtk: allow multiple Start-Split in a microframe
  - usb: xhci-mtk: add some schedule error number
  - usb: xhci-mtk: add a function to (un)load bandwidth info
  - usb: xhci-mtk: use @sch_tt to check whether need do TT schedule
  - usb: xhci-mtk: add only one extra CS for FS/LS INTR
  - usb: xhci-mtk: get the microframe boundary for ESIT
  - usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop
  - usb: dwc3: gadget: Don't modify GEVNTCOUNT in pullup()
  - usb: dwc3: gadget: Refactor pullup()
  - usb: dwc3: gadget: Prevent repeat pullup()
  - usb: dwc3: Issue core soft reset before enabling run/stop
  - usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC unbind
  - usb: typec: intel_pmc_mux: Add new ACPI ID for Meteor Lake IOM device
  - usb: typec: intel_pmc_mux: Update IOM port status offset for AlderLake
  - drm/amdgpu: make sure to init common IP before gmc
  - drm/amdgpu: Separate vf2pf work item init from virt data exchange
  - drm/amdgpu: indirect register access for nv12 sriov
  - drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega
  - ALSA: hda/sigmatel: Fix unused variable warning for beep power change
  - mksysmap: Fix the mismatch of 'L0' symbols in System.map
  - MIPS: OCTEON: irq: Fix octeon_irq_force_ciu_mapping()
  - afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked
  - net: usb: qmi_wwan: add Quectel RM520N
  - ALSA: hda/tegra: Align BDL entry to 4KB boundary
  - ALSA: hda/sigmatel: Keep power up while beep is enabled
  - wifi: mac80211_hwsim: check length for virtio packets
  - rxrpc: Fix calc of resend age
  - rxrpc: Fix local destruction being repeated
  - regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe()
  - ASoC: nau8824: Fix semaphore unbalance at error paths
  - Revert "serial: 8250: Fix reporting real baudrate value in c_ospeed field"
  - tools/include/uapi: Fix <asm/errno.h> for parisc and xtensa
  - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM
  - cifs: revalidate mapping when doing direct writes
  - of/device: Fix up of_dma_configure_id() stub
  - tracing: hold caller_addr to hardirq_{enable,disable}_ip
  - parisc: ccio-dma: Add missing iounmap in error path in ccio_probe()
  - drm/meson: Fix OSD1 RGB to YCbCr coefficient
  - drm/meson: Correct OSD1 global alpha value
  - gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in mpc85xx
  - NFSv4: Turn off open-by-filehandle and NFS re-export for NFSv4.0
  - pinctrl: sunxi: Fix name for A100 R_PIO
  - of: fdt: fix off-by-one error in unflatten_dt_nodes()
  - net: dsa: mv88e6xxx: allow use of PHYs on CPU and DSA ports
  - platform/x86/intel: hid: add quirk to support Surface Go 3
  - usb: cdns3: gadget: fix new urb never complete if ep cancel previous requests
  - powerpc/pseries/mobility: ignore ibm, platform-facilities updates
  - powerpc/pseries/mobility: refactor node lookup during DT update
  - dmaengine: bestcomm: fix system boot lockups
  - parisc: Flush kernel data mapping in set_pte_at() when installing pte for user page
  - parisc: Optimize per-pagetable spinlocks
  - serial: 8250: Fix reporting real baudrate value in c_ospeed field
  - KVM: PPC: Tick accounting should defer vtime accounting 'til after IRQ handling
  - KVM: PPC: Book3S HV: Context tracking exit guest context before enabling irqs
  - !399 Backport fs, block and net bugfixes
  - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
  - ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap
  - ubifs: Re-statistic cleaned znode count if commit failed
  - ubifs: dirty_cow_znode: Fix memleak in error handling path
  - block, bfq: switch 'bfqg->ref' to use atomic refcount apis
  - cifs: sanitize multiple delimiters in prepath
  - bpf: Fix sockmap calling sleepable function in teardown path
  - bpf, sockmap: Fix sk->sk_forward_alloc warn_on in sk_stream_kill_queues
  - !394 Backport 5.10.143 - 5.10.144 LTS
  - Input: goodix - add compatible string for GT1158
  - soc: fsl: select FSL_GUTS driver for DPIO
  - mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
  - usb: storage: Add ASUS <0x0b05:0x1932> to IGNORE_UAS
  - platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes
  - perf/arm_pmu_platform: fix tests for platform_get_irq() failure
  - drm/amd/amdgpu: skip ucode loading if ucode_size == 0
  - nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change()
  - Input: iforce - add support for Boeder Force Feedback Wheel
  - ieee802154: cc2520: add rc code in cc2520_tx()
  - gpio: mockup: remove gpio debugfs when remove device
  - tg3: Disable tg3 device on system reboot to avoid triggering AER
  - hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message
  - HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo
  - drm/msm/rd: Fix FIFO-full deadlock
  - Input: goodix - add support for GT1158
  - tracefs: Only clobber mode/uid/gid on remount if asked
  - iommu/vt-d: Correctly calculate sagaw value of IOMMU
  - ARM: dts: imx6qdl-kontron-samx6i: fix spi-flash compatible
  - ARM: dts: imx: align SPI NOR node name with dtschema
  - hwmon: (mr75203) enable polling for all VM channels
  - hwmon: (mr75203) fix multi-channel voltage reading
  - hwmon: (mr75203) fix voltage equation for negative source input
  - hwmon: (mr75203) update pvt->v_num and vm_num to the actual number of used sensors
  - hwmon: (mr75203) fix VM sensor allocation when "intel,vm-map" not defined
  - iommu/amd: use full 64-bit value in build_completion_wait()
  - swiotlb: avoid potential left shift overflow
  - MIPS: loongson32: ls1c: Fix hang during startup
  - ASoC: mchp-spdiftx: Fix clang -Wbitfield-constant-conversion
  - ASoC: mchp-spdiftx: remove references to mchp_i2s_caps
  - tcp: fix early ETIMEDOUT after spurious non-SACK RTO
  - nvme-tcp: fix regression that causes sporadic requests to time out
  - nvme-tcp: fix UAF when detecting digest errors
  - RDMA/mlx5: Set local port to one when accessing counters
  - IB/core: Fix a nested dead lock as part of ODP flow
  - ipv6: sr: fix out-of-bounds read when setting HMAC data.
  - RDMA/siw: Pass a pointer to virt_to_page()
  - xen-netback: only remove 'hotplug-status' when the vif is actually destroyed
  - i40e: Fix kernel crash during module removal
  - ice: use bitmap_free instead of devm_kfree
  - tipc: fix shift wrapping bug in map_get()
  - afs: Use the operation issue time instead of the reply time for callbacks
  - rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2()
  - ALSA: usb-audio: Register card again for iface over delayed_register option
  - ALSA: usb-audio: Inform the delayed registration more properly
  - netfilter: nf_tables: clean up hook list when offload flags check fails
  - netfilter: br_netfilter: Drop dst references before setting.
  - ARM: dts: at91: sama5d2_icp: don't keep vdd_other enabled all the time
  - ARM: dts: at91: sama5d27_wlsom1: don't keep ldo2 enabled all the time
  - ARM: dts: at91: sama5d2_icp: specify proper regulator output ranges
  - ARM: dts: at91: sama5d27_wlsom1: specify proper regulator output ranges
  - RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift
  - soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs
  - RDMA/cma: Fix arguments order in net device validation
  - tee: fix compiler warning in tee_shm_register()
  - regulator: core: Clean up on enable failure
  - ARM: dts: imx6qdl-kontron-samx6i: remove duplicated node
  - smb3: missing inode locks in punch hole
  - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl()
  - scsi: lpfc: Add missing destroy_workqueue() in error path
  - scsi: mpt3sas: Fix use-after-free warning
  - drm/i915: Implement WaEdpLinkRateDataReload
  - nvmet: fix a use-after-free
  - debugfs: add debugfs_lookup_and_remove()
  - kprobes: Prohibit probes in gate area
  - ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
  - ALSA: aloop: Fix random zeros in capture data when using jiffies timer
  - ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
  - drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly
  - fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init()
  - net/core/skbuff: Check the return value of skb_copy_bits()
  - arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
  - parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines
  - parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources()
  - drm/radeon: add a force flush to delay work when radeon
  - drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup.
  - drm/amdgpu: Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to psp_hw_fini
  - drm/gem: Fix GEM handle release errors
  - scsi: megaraid_sas: Fix double kfree()
  - scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX
  - Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"
  - wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd()
  - efi: libstub: Disable struct randomization
  - tty: n_gsm: avoid call of sleeping functions from atomic context
  - tty: n_gsm: initialize more members at gsm_alloc_mux()
  - xen-blkfront: Cache feature_persistent value before advertisement
  - NFSD: Fix verifier returned in stable WRITEs


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.20.0.96
changelog:
  - !409 Backport CVEs and bugfixes
  - x86/kasan: Populate shadow for shared chunk of the CPU entry area
  - x86/kasan: Add helpers to align shadow addresses up and down
  - x86/kasan: Rename local CPU_ENTRY_AREA variables to shorten names
  - x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area
  - x86/mm: Recompute physical address for every page of per-CPU CEA mapping
  - x86/kasan: Map shadow for percpu pages on demand
  - x86/mm: Randomize per-cpu entry area
  - Huawei BMA: Fix iBMA driver bug
  - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath()
  - mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
  - vfio/iommu_type1: replace kvmalloc with kvzalloc and kfree with kvfree
  - vfio/iommu_type1: replace kfree with kvfree
  - ppp: associate skb with a device at tx
  - arm32: kaslr: Avoid using the -fpic and fno-pic parameters together
  - bpf, sockmap: fix race in sock_map_free()
  - bpf: make sure skb->len != 0 when redirecting to a tunneling device
  - raw: fix KABI for backporting raw RCU conversion patches
  - ipv6: Fix crash when IPv6 is administratively disabled
  - raw: remove unused variables from raw6_icmp_error()
  - raw: fix a typo in raw_icmp_error()
  - raw: complete rcu conversion
  - raw: Use helpers for the hlist_nulls variant.
  - raw: Fix mixed declarations error in raw_icmp_error().
  - raw: convert raw sockets to RCU
  - raw: use more conventional iterators
  - cifs: Fix use-after-free in rdata->read_into_pages()
  - net: bridge: mcast: add and enforce query interval minimum
  - net: bridge: mcast: add and enforce startup query interval minimum
  - media: vivid: fix compose size exceed boundary
  - !346 anolis: bond: broadcast ARP or ND messages to all slaves
  - !404 kvm: arm64: fix some pvsched bugs
  - kvm: arm64: fix some pvsched bugs
  - anolis: bond: broadcast ARP or ND messages to all slaves


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.21.0.97
changelog:
  - !417 Backport CVEs and bugfixes
  - net: mpls: fix stale pointer if allocation fails during device rename
  - x86/bugs: Flush IBP in ib_prctl_set()
  - binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
  - binder: Address corner cases in deferred copy and fixup
  - binder: fix pointer cast warning
  - binder: defer copies of pre-patched txn data
  - binder: read pre-translated fds from sender buffer
  - binder: avoid potential data leakage when copying txn
  - rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed
  - net/sched: sch_taprio: do not schedule in taprio_reset()
  - net/sched: sch_taprio: fix possible use-after-free
  - nbd: fix assignment error for first_minor in nbd_dev_add
  - md/raid10: fix wrong setting of max_corr_read_errors
  - md/raid10: fix overflow in safe_delay_store
  - md/raid10: fix slab-out-of-bounds in md_bitmap_get_counter
  - arm64: topology: fix possible overflow in amu_fie_setup()
  - ARM: 9242/1: kasan: Only map modules if CONFIG_KASAN_VMALLOC=n
  - io_uring: fix soft lockup in io_submit_sqes()
  - fix kabi broken due to import of 5.15-stable io_uring
  - io_uring: import 5.15-stable io_uring
  - task_work: add helper for more targeted task_work canceling
  - coredump: Limit what can interrupt coredumps
  - kernel: provide create_io_thread() helper
  - fs: provide locked helper variant of close_fd_get_file()
  - kernel: remove checking for TIF_NOTIFY_SIGNAL
  - entry: Add support for TIF_NOTIFY_SIGNAL
  - signal: Add task_sigpending() helper
  - arm: add support for TIF_NOTIFY_SIGNAL
  - arm64: add support for TIF_NOTIFY_SIGNAL
  - riscv: add support for TIF_NOTIFY_SIGNAL
  - powerpc: add support for TIF_NOTIFY_SIGNAL
  - x86: Wire up TIF_NOTIFY_SIGNAL
  - iov_iter: add helper to save iov_iter state
  - perf beauty: Update copy of linux/socket.h with the kernel sources
  - perf trace beauty: Update copy of linux/socket.h with the kernel sources
  - io_uring: correct pinned_vm accounting
  - file: Rename __close_fd_get_file close_fd_get_file
  - io_uring: don't hold uring_lock when calling io_run_task_work*
  - io_uring: don't take uring_lock during iowq cancel
  - fs: make do_renameat2() take struct filename
  - net: add accept helper not installing fd
  - net: provide __sys_shutdown_sock() that takes a socket
  - fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED
  - Make sure nd->path.mnt and nd->path.dentry are always valid pointers
  - fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy*
  - fs: add support for LOOKUP_CACHED
  - Revert "io_uring: fix soft lockup when call __io_remove_buffers"
  - Revert "io_uring: deduplicate failing task_work_add"
  - Revert "io_uring: don't take uring_lock during iowq cancel"
  - Revert "[Backport] io_uring: don't keep looping for more events if we can't flush overflow"
  - Revert "[Huawei] io-wq: Switch io_wqe_worker's fs before releasing request"
  - Revert "[Huawei] io_uring: fix soft lockup in io_submit_sqes()"
  - Revert "[Huawei] io_uring:drop identity before creating a private one"


author: Zheng Zengkai <zhengzengkai@huawei.com> - 5.10.0-136.22.0.98
changelog:
  - !455 Backport CVEs and bugfixes
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
  - HID: check empty report_list in bigben_probe()
  - HID: check empty report_list in hid_validate_values()
  - neigh: make sure used and confirmed times are valid
  - Documentation/hw-vuln: Fix rST warning
  - Documentation/hw-vuln: Add documentation for Cross-Thread Return Predictions
  - KVM: x86: Mitigate the cross-thread return address predictions bug
  - x86/speculation: Identify processors vulnerable to SMT RSB predictions
  - radi10: fix leak of 'r10bio->remaining' for recovery
  - md: fix soft lockup in status_resync
  - md: don't update recovery_cp when curr_resync is ACTIVE
  - md: Ensure resync is reported after it starts
  - md: Use enum for overloaded magic numbers used by mddev->curr_resync
  - raid10: fix leak of io accounting
  - tcp: Fix listen() regression in 5.15.88.
  - net/ulp: Remove redundant ->clone() test in inet_clone_ulp().
  - net/ulp: use consistent error code when blocking ULP
  - net/ulp: prevent ULP without clone op from entering the LISTEN status
  - net/tls: tls_is_tx_ready() checked list_entry
  - usb: dwc3: dwc3-qcom: Add missing platform_device_put() in dwc3_qcom_acpi_register_core
  - ntfs: fix out-of-bounds read in ntfs_attr_find()
  - splice: don't generate zero-len segement bvecs
  - rds: rds_rm_zerocopy_callback() use list_first_entry()
  - tap: tap_open(): correctly initialize socket uid
  - tun: tun_chr_open(): correctly initialize socket uid
  - net: add sock_init_data_uid()
  - ring-buffer: Handle race between rb_move_tail and rb_check_pages
  - blk-mq: use quiesced elevator switch when reinitializing queues
  - ovl: fix use inode directly in rcu-walk mode


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.23.0.99
changelog:
  - !484 Backport CVEs and bugfixes
  - scsi: cancel the inflight async device probe when remove scsi_target
  - ring-buffer: Fix race between reset page and reading page
  - raid1, raid10: switch to precise io accounting
  - block: add precise io accouting apis
  - md/raid10: fix memleak for 'conf->bio_split'
  - scsi: fix use-after-free problem in scsi_remove_target
  - sctp: fail if no bound addresses can be used for a given scope
  - ext4: fix WARNING in mb_find_extent
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
  - scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
  - scsi: iscsi: Move pool freeing
  - xfs: aborting inodes on shutdown may need buffer lock
  - ext4: fix incorrect options show of original mount_opt and extend mount_opt2
  - !473 [sync] PR-332: [5.10]Make Multiple functions On Netswift PCIE NIC belong to different IOMMU group
  - openeuler: pci: workaround multiple functions can be assigned to only one VM
  - !452 intel: backport isst issue fix and other update to align with upstream 6.0
  - !457 Backport CVEs and bugfixes
  - !464 Revert "scsi: fix iscsi rescan fails to create block"
  - Revert "scsi: fix iscsi rescan fails to create block"
  - phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
  - platform/x86: ISST: PUNIT device mapping with Sub-NUMA clustering
  - platform/x86: ISST: use semi-colons instead of commas
  - platform/x86: ISST: Mark mmio_range_devid_0 and mmio_range_devid_1 with static keyword
  - platform/x86: ISST: Change PCI device macros
  - platform/x86: ISST: Allow configurable offset range
  - platform/x86: ISST: Check for unaligned mmio address
  - platform/x86: ISST: Fix optimization with use of numa
  - platform/x86: ISST: Use numa node id for cpu pci dev mapping
  - platform/x86: ISST: Optimize CPU to PCI device mapping


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.24.0.100
changelog:
  - !513 Backport CVEs and bugfixes
  - livepatch/core: Fix hungtask against cpu hotplug on x86
  - seccomp: Move copy_seccomp() to no failure path.
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
  - mm: optimize do_wp_page() for fresh pages in local LRU pagevecs
  - mm: optimize do_wp_page() for exclusive pages in the swapcache
  - ftrace: Fix invalid address access in lookup_rec() when index is 0
  - tipc: add an extra conn_get in tipc_conn_alloc
  - tipc: set con sock in tipc_conn_alloc
  - ext4: fix another off-by-one fsmap error on 1k block filesystems
  - mm/vmalloc: huge vmalloc backing pages should be split rather than compound
  - HID: asus: use spinlock to safely schedule workers
  - HID: asus: use spinlock to protect concurrent accesses
  - HID: asus: Remove check for same LED brightness on set
  - jbd2: fix data missing when reusing bh which is ready to be checkpointed


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.25.0.101
changelog:
  - !530 Backport CVEs and bugfixes
  - block: fix use-after-free of q->q_usage_counter
  - block: move q_usage_counter release into blk_queue_release
  - Revert "block: fix null-deref in percpu_ref_put"
  - md/raid6: Fix the problem of repeatedly applying for memory in raid5_read_one_chunk
  - xfs, iomap: limit individual ioend chain lengths in writeback
  - net/sched: tcindex: search key must be 16 bits
  - net/sched: tcindex: update imperfect hash filters respecting rcu
  - tty: fix out-of-bounds access in tty_driver_lookup_tty()
  - fs/ntfs3: Validate resident attribute name
  - Revert "mm/vmalloc: huge vmalloc backing pages should be split rather than compound"
  - mm: compaction: avoid possible NULL pointer dereference in kcompactd_cpu_online
  - coredump: fix kabi broken in struct coredump_params
  - coredump: Use the vma snapshot in fill_files_note
  - coredump/elf: Pass coredump_params into fill_note_info
  - coredump: Remove the WARN_ON in dump_vma_snapshot
  - coredump: Snapshot the vmas in do_coredump
  - mm/swapfile: add cond_resched() in get_swap_pages()
  - mm: slince possible data races about pgdat->kswapd
  - mm: fix null-ptr-deref in kswapd_is_running()
  - fs/ntfs3: Validate MFT flags before replaying logs
  - fs/ntfs3: Validate attribute name offset
  - bpf: Fixes possible race in update_prog_stats() for 32bit arches
  - bpf: Avoid races in __bpf_prog_run() for 32bit arches
  - ext4: make sure fs error flag setted before clear journal error
  - ext4: commit super block if fs record error when journal record without error
  - ima: Fix memory leakage in ima_store_template
  - af_unix: Get user_ns from in_skb in unix_diag_get_exact().
  - net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
  - arm64: errata: Remove AES hwcap for COMPAT tasks
  - ARM: 9206/1: A9: Add ARM ERRATA 764319 workaround (Updated)
  - kernel: Initialize cpumask before parsing
  - softirq: Don't try waking ksoftirqd before it has been spawned
  - bpf: Prevent decl_tag from being referenced in func_proto arg
  - bpf: Skip task with pid=1 in send_signal_common()
  - bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
  - !461 Backport CVEs and bugfixes
  - !518 [sync] PR-374: Enable CONFIG_UPROBES_SUPPORT_PC_ALTER in arm64 by default
  - uprobe: enable CONFIG_UPROBES_SUPPORT_PC_ALTER in arm64
  - malidp: Fix NULL vs IS_ERR() checking


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.27.0.103
changelog:
  - !562 Backport CVEs and bugfixes
  - net: sched: Use struct_size() helper in kvmalloc()
  - net_sched: Use struct_size() and flex_array_size() helpers
  - ext4: dio take shared inode lock when overwriting preallocated blocks
  - ext4: fix race between writepages and remount
  - mm: mem_reliable: Initialize reliable_nr_page when mm_init()
  - clocksource/drivers/arm_arch_timer: Fix CNTPCT_LO and CNTVCT_LO value
  - kvm: initialize all of the kvm_debugregs structure before sending it to userspace
  - nvme: use nvme_cid to generate command_id in trace event
  - xfs: don't report reserved bnobt space as available
  - xfs: don't include bnobt blocks when reserving free block pool
  - xfs: set aside allocation btree blocks from block reservation
  - xfs: introduce in-core global counter of allocbt blocks
  - act_mirred: use the backlog for nested calls to mirred ingress
  - net/sched: act_mirred: better wording on protection against excessive stack growth
  - net/sched: act_mirred: refactor the handle of xmit
  - scsi: scsi_dh_alua: fix memleak for 'qdata' in alua_activate()
  - !557 net: hns3: modify reset delay time to avoid configuration timeout
  - net: hns3: modify reset delay time to avoid configuration timeout


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.28.0.104
changelog:
  - !573 Backport CVEs and bugfixes
  - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
  - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size
  - ubi: ensure that VID header offset + VID header size <= alloc, size
  - ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct()
  - perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach
  - ring-buffer: Fix race while reader and writer are on the same page
  - loop: Add parm check in loop_control_ioctl
  - ext4: Fix i_disksize exceeding i_size problem in paritally written case
  - ext4: ext4_put_super: Remove redundant checking for 'sbi->s_journal_bdev'
  - ext4: Fix reusing stale buffer heads from last failed mounting
  - btrfs: fix race between quota disable and quota assign ioctls
  - dm crypt: add cond_resched() to dmcrypt_write()
  - driver core: Fix lockdep warning on wfs_lock
  - driver core: platform: Add extra error check in devm_platform_get_irqs_affinity()
  - xfs: don't leak memory when attr fork loading fails
  - xfs: delete unnecessary NULL checks
  - xfs: replace inode fork size macros with functions
  - xfs: replace XFS_IFORK_Q with a proper predicate function
  - xfs: use XFS_IFORK_Q to determine the presence of an xattr fork
  - xfs: make inode attribute forks a permanent part of struct xfs_inode
  - xfs: convert XFS_IFORK_PTR to a static inline helper
  - xfs: don't reuse busy extents on extent trim
  - fs/xfs: convert comma to semicolon
  - xfs: xfs_ail_push_all_sync() stalls when racing with updates
  - xfs: check buffer pin state after locking in delwri_submit
  - xfs: log worker needs to start before intent/unlink recovery


author: Chenxi Mao <chenxi.mao@suse.com> - 3.9.9-23
changelog:
  - Type:enhancement
  - CVE:NA
  - SUG:NA
  - DESC: Enable link time optimizaitons (LTO) for better performance.


