# changelog

author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.27.0.103
changelog:
  - !2145 [sync] PR-2126:  netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
  - !2110 [sync] PR-2090:  net/sched: sch_hfsc: Ensure inner classes have fsc curve
  - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
  - !2103 [sync] PR-2092:  netfilter: nf_tables: skip bound chain on rule flush
  - !2112 [sync] PR-2085:  af_unix: Fix null-ptr-deref in unix_stream_sendpage().
  - !2104 [sync] PR-2097:  Fixed 4 CVEs of the ksmbd
  - !2078 [sync] PR-2065:  dm: switch to precise io accounting
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage().
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve
  - netfilter: nf_tables: skip bound chain on rule flush
  - ksmbd: not allow guest user on multichannel
  - ksmbd: fix deadlock in ksmbd_find_crypto_ctx()
  - ksmbd: block asynchronous requests when making a delay on session setup
  - ksmbd: destroy expired sessions
  - !1927 [sync] PR-1883:  SUNRPC: don't pause on incomplete allocation
  - !2008 [sync] PR-1928: RDMA/hns Bugfix from mainline linux
  - dm: switch to precise io accounting
  - !2059 [sync] PR-2055: Only enable unicast promisc when mac table full to fix the hns3 bug
  - SUNRPC: don't pause on incomplete allocation
  - net: hns3: only enable unicast promisc when mac table full
  - !2049 [sync] PR-1752:  ksmbd: validate session id and tree id in the compound request
  - ksmbd: validate session id and tree id in the compound request
  - RDMA/hns: Remove the num_qpc_timer variable


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.28.0.105
changelog:
  - !2215 [sync] PR-2210:  jbd2: Fix potential data lost in recovering journal raced with synchronizing fs bdev
  - !2241 [sync] PR-2169:  net: sched: sch_qfq: Fix UAF in qfq_dequeue()
  - !2244 [sync] PR-2230:  media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
  - !2235 [sync] PR-1962:  x86/speculation: Add force option to GDS mitigation
  - !2233 [sync] PR-2086:  fix CVE-2023-20588
  - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue()
  - x86: Move gds_ucode_mitigated() declaration to header
  - Documentation/x86: Fix backwards on/off logic about YMM support
  - KVM: Add GDS_NO support to KVM
  - x86/speculation: Add Kconfig option for GDS
  - x86/speculation: Add force option to GDS mitigation
  - x86/CPU/AMD: Fix the DIV(0) initial fix attempt
  - x86/CPU/AMD: Do not leak quotient data after a division by 0
  - !1879 [sync] PR-1826:  x86/speculation: Add Gather Data Sampling mitigation
  - jbd2: Fix potential data lost in recovering journal raced with synchronizing fs bdev
  - !2172 [sync] PR-2153:  netfilter: nftables: exthdr: fix 4-byte stack OOB write
  - !2083 [sync] PR-2009: Fix errors related to bond for RDMA/hns
  - netfilter: nftables: exthdr: fix 4-byte stack OOB write
  - !2151 [sync] PR-2095:  io_uring: ensure IOPOLL locks around deferred work
  - io_uring: ensure IOPOLL locks around deferred work
  - RDMA/hns: Fix missing cleanup when bond_grp becomes invalid
  - RDMA/hns: Fix the device loss after unbinding RoCE bond resource slave
  - RDMA/hns: Fix wild pointer error of RoCE bonding when rmmod hns3
  - RDMA/hns: Add functions to obtain netdev and bus_num from an hr_dev
  - RDMA/hns: Fix a memory leak error when bond clear failed
  - x86/speculation: Add cpu_show_gds() prototype
  - x86/speculation: Add Gather Data Sampling mitigation


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.29.0.106
changelog:
  - !2393  netfilter: nf_tables: disallow rule removal from chain binding
  - netfilter: nf_tables: disallow rule removal from chain binding
  - !2386  nf_table LTS
  - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
  - netfilter: nf_tables: skip bound chain on rule flush
  - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails
  - netfilter: nf_tables: drop map element references from preparation phase
  - netfilter: nftables: rename set element data activation/deactivation functions
  - netfilter: nf_tables: reject unbound chain set before commit phase
  - netfilter: nf_tables: reject unbound anonymous set before commit phase
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
  - netfilter: nf_tables: fix chain binding transaction logic
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
  - netfilter: nf_tables: use net_generic infra for transaction data
  - Revert "netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID"
  - Revert "netfilter: nf_tables: skip bound chain on rule flush"
  - Revert "netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE"
  - Revert "netfilter: nf_tables: fix chain binding transaction logic"
  - Revert "netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain"
  - Revert "netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR"
  - Revert "netfilter: nf_tables: unbind non-anonymous set if rule construction fails"
  - !2380 [sync] PR-2359:  netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
  - !1939 [sync] PR-1771: Backport 5.10.164 - 5.10.165  LTS patches from upstream.
  - !2320 [sync] PR-2287:  scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
  - scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
  - !2311 [sync] PR-2286:  scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
  - scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
  - !2279 [sync] PR-2269:  etmem: Fixed an issue where the module reference counting is incorrect
  - etmem: Fixed an issue where the module reference counting is incorrect
  - !2125 [sync] PR-1778:  nvme-pci: fix DMA direction of unmapping integrity data
  - !2187  nvme-pci: fix timeout request state check
  - !2251 [sync] PR-2224:  ext4: fix rec_len verify error
  - ext4: fix rec_len verify error
  - nvme-pci: fix timeout request state check
  - nvme-pci: fix DMA direction of unmapping integrity data
  - io_uring/rw: remove leftover debug statement
  - io_uring/rw: ensure kiocb_end_write() is always called
  - io_uring: fix double poll leak on repolling
  - io_uring: Clean up a false-positive warning from GCC 9.3.0
  - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
  - Bluetooth: hci_qca: Fixed issue during suspend
  - Bluetooth: hci_qca: check for SSR triggered flag while suspend
  - Bluetooth: hci_qca: Wait for SSR completion during suspend
  - soc: qcom: apr: Make qcom,protection-domain optional again
  - Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()"
  - net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work()
  - io_uring/net: fix fast_iov assignment in io_setup_async_msg()
  - io_uring: io_kiocb_update_pos() should not touch file for non -1 offset
  - tracing: Use alignof__(struct {type b;}) instead of offsetof()
  - x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN
  - Revert "drm/amdgpu: make display pinning more flexible (v2)"
  - efi: rt-wrapper: Add missing include
  - arm64: efi: Execute runtime services from a dedicated stack
  - drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
  - drm/amd/display: Calculate output_color_space after pixel encoding adjustment
  - drm/amd/display: Fix set scaling doesn's work
  - drm/i915: re-disable RC6p on Sandy Bridge
  - mei: me: add meteor lake point M DID
  - gsmi: fix null-deref in gsmi_get_variable
  - serial: atmel: fix incorrect baudrate setup
  - dmaengine: tegra210-adma: fix global intr clear
  - serial: pch_uart: Pass correct sg to dma_unmap_sg()
  - dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation
  - dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation
  - usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210
  - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
  - usb: gadget: g_webcam: Send color matching descriptor per frame
  - usb: typec: altmodes/displayport: Fix pin assignment calculation
  - usb: typec: altmodes/displayport: Add pin assignment helper
  - usb: host: ehci-fsl: Fix module alias
  - USB: serial: cp210x: add SCALANCE LPE-9000 device id
  - tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
  - thunderbolt: Use correct function to calculate maximum USB3 link rate
  - cifs: do not include page data when checking signature
  - btrfs: fix race between quota rescan and disable leading to NULL pointer deref
  - mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting
  - mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
  - comedi: adv_pci1760: Fix PWM instruction handling
  - usb: core: hub: disable autosuspend for TI TUSB8041
  - misc: fastrpc: Fix use-after-free race condition for maps
  - misc: fastrpc: Don't remove map on creater_process and device_release
  - USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100
  - staging: vchiq_arm: fix enum vchiq_status return types
  - USB: serial: option: add Quectel EM05CN modem
  - USB: serial: option: add Quectel EM05CN (SG) modem
  - USB: serial: option: add Quectel EC200U modem
  - USB: serial: option: add Quectel EM05-G (RS) modem
  - USB: serial: option: add Quectel EM05-G (CS) modem
  - USB: serial: option: add Quectel EM05-G (GR) modem
  - xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
  - usb: acpi: add helper to check port lpm capability using acpi _DSM
  - xhci: Add a flag to disable USB3 lpm on a xhci root port level.
  - xhci: Add update_hub_device override for PCI xHCI hosts
  - xhci: Fix null pointer dereference when host dies
  - usb: xhci: Check endpoint is valid before dereferencing it
  - xhci-pci: set the dma max_seg_size
  - io_uring/rw: defer fsnotify calls to task context
  - io_uring: do not recalculate ppos unnecessarily
  - io_uring: update kiocb->ki_pos at execution time
  - io_uring: remove duplicated calls to io_kiocb_ppos
  - io_uring: ensure that cached task references are always put on exit
  - io_uring: fix CQ waiting timeout handling
  - io_uring: lock overflowing for IOPOLL
  - io_uring: check for valid register opcode earlier
  - io_uring: fix async accept on O_NONBLOCK sockets
  - io_uring: allow re-poll if we made progress
  - io_uring: support MSG_WAITALL for IORING_OP_SEND(MSG)
  - io_uring: add flag for disabling provided buffer recycling
  - io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly
  - io_uring: improve send/recv error handling
  - io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL
  - Bluetooth: hci_qca: Fix driver shutdown on closed serdev
  - Bluetooth: hci_qca: Wait for timeout during suspend
  - drm/i915/gt: Reset twice
  - ALSA: hda/realtek - Turn on power early
  - efi: fix userspace infinite retry read efivars after EFI runtime services page fault
  - nilfs2: fix general protection fault in nilfs_btree_insert()
  - zonefs: Detect append writes at invalid locations
  - Add exception protection processing for vd in axi_chan_handle_err function
  - wifi: mac80211: sdata can be NULL during AMPDU start
  - wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices
  - f2fs: let's avoid panic if extent_tree is not created
  - x86/asm: Fix an assembler warning with current binutils
  - btrfs: always report error in run_one_delayed_ref()
  - RDMA/srp: Move large values to a new enum for gcc13
  - net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats
  - tools/virtio: initialize spinlocks in vring_test.c
  - selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID
  - pNFS/filelayout: Fix coalescing test for single DS
  - btrfs: fix trace event name typo for FLUSH_DELAYED_REFS
  - Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout"
  - io_uring/io-wq: only free worker if it was allocated for creation
  - io_uring/io-wq: free worker if task_work creation is canceled
  - drm/virtio: Fix GEM handle creation UAF
  - efi: fix NULL-deref in init error path
  - arm64: cmpxchg_double*: hazard against entire exchange variable
  - arm64: atomics: remove LL/SC trampolines
  - arm64: atomics: format whitespace consistently
  - x86/resctrl: Fix task CLOSID/RMID update race
  - x86/resctrl: Use task_curr() instead of task_struct->on_cpu to prevent unnecessary IPI
  - KVM: x86: Do not return host topology information from KVM_GET_SUPPORTED_CPUID
  - Documentation: KVM: add API issues section
  - iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe()
  - iommu/mediatek-v1: Add error handle for mtk_iommu_probe
  - mm: Always release pages to the buddy allocator in memblock_free_late().
  - net/mlx5e: Don't support encap rules with gbp option
  - net/mlx5: Fix ptp max frequency adjustment range
  - net/sched: act_mpls: Fix warning during failed attribute validation
  - nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
  - hvc/xen: lock console list traversal
  - octeontx2-af: Fix LMAC config in cgx_lmac_rx_tx_enable
  - octeontx2-af: Map NIX block from CGX connection
  - octeontx2-af: Update get/set resource count functions
  - tipc: fix unexpected link reset due to discovery messages
  - ASoC: wm8904: fix wrong outputs volume after power reactivation
  - regulator: da9211: Use irq handler when ready
  - EDAC/device: Fix period calculation in edac_device_reset_delay_period()
  - x86/boot: Avoid using Intel mnemonics in AT&T syntax asm
  - powerpc/imc-pmu: Fix use of mutex in IRQs disabled section
  - netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
  - ext4: fix uninititialized value in 'ext4_evict_inode'
  - usb: ulpi: defer ulpi_register on ulpi_read_id timeout
  - xhci: Prevent infinite loop in transaction errors recovery for streams
  - xhci: move and rename xhci_cleanup_halted_endpoint()
  - xhci: store TD status in the td struct instead of passing it along
  - xhci: move xhci_td_cleanup so it can be called by more functions
  - xhci: Add xhci_reset_halted_ep() helper function
  - xhci: adjust parameters passed to cleanup_halted_endpoint()
  - xhci: get isochronous ring directly from endpoint structure
  - xhci: Avoid parsing transfer events several times
  - clk: imx: imx8mp: add shared clk gate for usb suspend clk
  - dt-bindings: clocks: imx8mp: Add ID for usb suspend clock
  - clk: imx8mp: add clkout1/2 support
  - clk: imx8mp: Add DISP2 pixel clock
  - iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options
  - iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands
  - bus: mhi: host: Fix race between channel preparation and M0 event
  - ixgbe: fix pci device refcount leak
  - platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe
  - drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer
  - drm/msm/adreno: Make adreno quirks not overwrite each other
  - cifs: Fix uninitialized memory read for smb311 posix symlink create
  - s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple()
  - s390/cpum_sf: add READ_ONCE() semantics to compare and swap loops
  - ASoC: qcom: lpass-cpu: Fix fallback SD line index handling
  - s390/kexec: fix ipl report address for kdump
  - perf auxtrace: Fix address filter duplicate symbol selection
  - docs: Fix the docs build with Sphinx 6.0
  - efi: tpm: Avoid READ_ONCE() for accessing the event log
  - KVM: arm64: Fix S1PTW handling on RO memslots
  - ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.30.0.107
changelog:
  - !2422 [sync] PR-2323:  net/sched: Retire rsvp classifier
  - !2398 Backport 5.10.166 - 5.10.167 LTS patches from upstream.
  - net/sched: Retire rsvp classifier
  - !1122  ext4: delete redundant uptodate check for buffer
  - !2368 [sync] PR-2282:  sdei_watchdog: Avoid exception during sdei handler
  - net: fix NULL pointer in skb_segment_list
  - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
  - dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
  - blk-cgroup: fix missing pd_online_fn() while activating policy
  - arm64: dts: imx8mq-thor96: fix no-mmc property for SDHCI
  - ARM: dts: vf610: Fix pca9548 i2c-mux node names
  - ARM: dts: imx: Fix pca9547 i2c-mux node name
  - clk: Fix pointer casting to prevent oops in devm_clk_release()
  - perf/x86/amd: fix potential integer overflow on shift of a int
  - netfilter: conntrack: unify established states for SCTP paths
  - x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
  - block: fix and cleanup bio_check_ro
  - Revert "selftests/ftrace: Update synthetic event syntax errors"
  - nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted
  - nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf
  - Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode"
  - tools: gpio: fix -c option of gpio-event-mon
  - net: mdio-mux-meson-g12a: force internal PHY off on mux switch
  - net/tg3: resolve deadlock in tg3_reset_task() during EEH
  - thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type()
  - net: ravb: Fix possible hang if RIS2_QFF1 happen
  - netrom: Fix use-after-free of a listening socket.
  - netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
  - ipv4: prevent potential spectre v1 gadget in fib_metrics_match()
  - ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
  - netlink: annotate data races around sk_state
  - netlink: annotate data races around dst_portid and dst_group
  - netlink: annotate data races around nlk->portid
  - netfilter: nft_set_rbtree: skip elements in transaction from garbage collection
  - netfilter: nft_set_rbtree: Switch to node list walk for overlap detection
  - net: fix UaF in netns ops registration error path
  - netlink: prevent potential spectre v1 gadgets
  - i2c: designware: use casting of u64 in clock multiplication to avoid overflow
  - i2c: designware: Use DIV_ROUND_CLOSEST() macro
  - units: Add SI metric prefix definitions
  - units: Add Watt units
  - EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
  - EDAC/device: Respect any driver-supplied workqueue polling value
  - ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment
  - thermal: intel: int340x: Protect trip temperature from concurrent updates
  - KVM: x86/vmx: Do not skip segment attributes if unusable bit is set
  - cifs: Fix oops due to uncleared server->smbd_conn in reconnect
  - ftrace/scripts: Update the instructions for ftrace-bisect.sh
  - trace_events_hist: add check for return value of 'create_hist_field'
  - tracing: Make sure trace_printk() can output as soon as it can be used
  - module: Don't wait for GOING modules
  - scsi: hpsa: Fix allocation size for scsi_host_alloc()
  - xhci: Set HCD flag to defer primary roothub registration
  - Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
  - docs: Fix path paste-o for /sys/kernel/warn_count
  - panic: Expose "warn_count" to sysfs
  - panic: Introduce warn_limit
  - panic: Consolidate open-coded panic_on_warn checks
  - panic: Separate sysctl logic from CONFIG_SMP
  - ia64: make IA64_MCA_RECOVERY bool instead of tristate
  - kasan: no need to unset panic_on_warn in end_report()
  - ubsan: no need to unset panic_on_warn in ubsan_epilogue()
  - panic: unset panic_on_warn inside panic()
  - kernel/panic: move panic sysctls to its own file
  - fs: reiserfs: remove useless new_opts in reiserfs_remount
  - x86: ACPI: cstate: Optimize C3 entry on AMD CPUs
  - netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state
  - Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID"
  - lockref: stop doing cpu_relax in the cmpxchg loop
  - platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK
  - platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD
  - KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
  - spi: spidev: remove debug messages that access spidev->spi without locking
  - ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets
  - ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC
  - cpufreq: armada-37xx: stop using 0 as NULL pointer
  - s390/debug: add _ASM_S390_ prefix to header guard
  - drm: Add orientation quirk for Lenovo ideapad D330-10IGL
  - ASoC: fsl_micfil: Correct the number of steps on SX controls
  - kcsan: test: don't put the expect array on the stack
  - cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist
  - tcp: fix rate_app_limited to default to 1
  - net: dsa: microchip: ksz9477: port map correction in ALU table entry register
  - driver core: Fix test_async_probe_init saves device in wrong array
  - w1: fix WARNING after calling w1_process()
  - w1: fix deadloop in __w1_remove_master_device()
  - tcp: avoid the lookup process failing to get sk in ehash table
  - dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()
  - HID: betop: check shape of output reports
  - l2tp: prevent lockdep issue in l2tp_tunnel_register()
  - net: macb: fix PTP TX timestamp failure due to packet padding
  - dmaengine: Fix double increment of client_count in dma_chan_get()
  - drm/panfrost: fix GENERIC_ATOMIC64 dependency
  - net: mlx5: eliminate anonymous module_init & module_exit
  - usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
  - usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
  - HID: revert CHERRY_MOUSE_000C quirk
  - net: stmmac: fix invalid call to mdiobus_get_phy()
  - net: mdio: validate parameter addr in mdiobus_get_phy()
  - net: usb: sr9700: Handle negative len
  - l2tp: close all race conditions in l2tp_tunnel_register()
  - l2tp: convert l2tp_tunnel_list to idr
  - gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode
  - net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs
  - net: nfc: Fix use-after-free in local_cleanup()
  - phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on()
  - bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
  - amd-xgbe: Delay AN timeout during KR training
  - amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent
  - ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60
  - phy: ti: fix Kconfig warning and operator precedence
  - PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe()
  - affs: initialize fsdata in affs_truncate()
  - IB/hfi1: Remove user expected buffer invalidate race
  - IB/hfi1: Immediately remove invalid memory from hardware
  - IB/hfi1: Fix expected receive setup error exit issues
  - IB/hfi1: Reserve user expected TIDs
  - IB/hfi1: Reject a zero-length user expected buffer
  - RDMA/core: Fix ib block iterator counter overflow
  - tomoyo: fix broken dependency on *.conf.default
  - firmware: arm_scmi: Harden shared memory access in fetch_notification
  - firmware: arm_scmi: Harden shared memory access in fetch_response
  - EDAC/highbank: Fix memory leak in highbank_mc_probe()
  - ARM: imx: add missing of_node_put()
  - arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux
  - ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts'
  - ARM: dts: imx7d-pico: Use 'clock-frequency'
  - ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency'
  - memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe()
  - memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe()
  - clk: Provide new devm_clk helpers for prepared and enabled clocks
  - clk: generalize devm_clk_get() a bit
  - sdei_watchdog: Avoid exception during sdei handler
  - ext4: delete redundant uptodate check for buffer


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.31.0.108
changelog:
  - !2680 [sync] PR-2390: Backport 5.10.174 -  5.10.175 LTS patches from upstream.
  - !2692 [sync] PR-2666:  net: xfrm: Fix xfrm_address_filter OOB read
  - !2375 [sync] PR-2258:  ext4: do not mark inode dirty every time when appending using delalloc
  - !2639 [sync] PR-2454:  igb: set max size RX buffer when store bad packet is enabled
  - net: xfrm: Fix xfrm_address_filter OOB read
  - !2533 [sync] PR-2370:  ipv4: fix null-deref in ipv4_link_failure
  - !2526 [sync] PR-2440:  netfilter: xt_u32: validate user space input
  - !2534 [sync] PR-2411:  netfilter: xt_sctp: validate the flag_info count
  - !2529 [sync] PR-2410:  netfilter: nfnetlink_osf: avoid OOB read
  - !2660 [sync] PR-2628:  ubi: Refuse attaching if mtd's erasesize is 0
  - s390/dasd: add missing discipline function
  - KVM: VMX: Fix crash due to uninitialized current_vmcs
  - KVM: VMX: Introduce vmx_msr_bitmap_l01_changed() helper
  - KVM: nVMX: Don't use Enlightened MSR Bitmap for L3
  - UML: define RUNTIME_DISCARD_EXIT
  - sh: define RUNTIME_DISCARD_EXIT
  - s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36
  - powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds
  - powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT
  - arch: fix broken BuildID for arm64 and riscv
  - ext4: block range must be validated before use in ext4_mb_clear_bb()
  - ext4: add strict range checks while freeing blocks
  - ext4: add ext4_sb_block_valid() refactored out of ext4_inode_block_valid()
  - ext4: refactor ext4_free_blocks() to pull out ext4_mb_clear_bb()
  - drm/i915: Don't use BAR mappings for ring buffers with LLC
  - skbuff: Fix nfct leak on napi stolen
  - media: rc: gpio-ir-recv: add remove function
  - media: ov5640: Fix analogue gain control
  - scripts: handle BrokenPipeError for python scripts
  - PCI: Add SolidRun vendor ID
  - macintosh: windfarm: Use unsigned type for 1-bit bitfields
  - alpha: fix R_ALPHA_LITERAL reloc for large modules
  - powerpc/kcsan: Exclude udelay to prevent recursive instrumentation
  - MIPS: Fix a compilation issue
  - block, bfq: fix uaf for bfqq in bic_set_bfqq()
  - block, bfq: replace 0/1 with false/true in bic apis
  - block/bfq-iosched.c: use "false" rather than "BLK_RW_ASYNC"
  - block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq
  - block, bfq: fix possible uaf for 'bfqq->bic'
  - tpm/eventlog: Don't abort tpm_read_log on faulty ACPI address
  - watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths
  - iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter
  - ext4: Fix deadlock during directory rename
  - RISC-V: Don't check text_mutex during stop_machine
  - riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
  - SUNRPC: Fix a server shutdown leak
  - net/smc: fix fallback failed while sendmsg with fastopen
  - platform: x86: MLX_PLATFORM: select REGMAP instead of depending on it
  - scsi: megaraid_sas: Update max supported LD IDs to 240
  - net: ethernet: mtk_eth_soc: fix RX data corruption issue
  - btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR
  - netfilter: tproxy: fix deadlock due to missing BH disable
  - netfilter: ctnetlink: revert to dumping mark regardless of event type
  - bnxt_en: Avoid order-5 memory allocation for TPA data
  - net: phylib: get rid of unnecessary locking
  - net: stmmac: add to set device wake up flag when stmmac init phy
  - net: caif: Fix use-after-free in cfusbl_device_notify()
  - net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver
  - net: usb: lan78xx: Remove lots of set but unused 'ret' variables
  - selftests: nft_nat: ensuring the listening side is up before starting the client
  - ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
  - powerpc: dts: t1040rdb: fix compatible string for Rev A boards
  - nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties
  - bgmac: fix *initial* chip reset to support BCM5358
  - drm/msm/a5xx: fix context faults during ring switch
  - drm/msm/a5xx: fix the emptyness check in the preempt code
  - drm/msm: Document and rename preempt_lock
  - drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register
  - drm/msm: Fix potential invalid ptr free
  - drm/nouveau/kms/nv50: fix nv50_wndw_new_ prototype
  - drm/nouveau/kms/nv50-: remove unused functions
  - ext4: Fix possible corruption when moving a directory
  - scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
  - riscv: Add header include guards to insn.h
  - riscv: Avoid enabling interrupts in die()
  - RISC-V: Avoid dereferening NULL regs in die()
  - arm64: efi: Make efi_rt_lock a raw_spinlock
  - iommu/vt-d: Fix PASID directory pointer coherency
  - iommu/vt-d: Fix lockdep splat in intel_pasid_get_entry()
  - irqdomain: Fix mapping-creation race
  - irqdomain: Refactor __irq_domain_alloc_irqs()
  - irqdomain: Look for existing mapping only once
  - irq: Fix typos in comments
  - udf: Fix off-by-one error when discarding preallocation
  - nfc: change order inside nfc_se_io error path
  - ext4: zero i_disksize when initializing the bootloader inode
  - ext4: fix WARNING in ext4_update_inline_data
  - ext4: move where set the MAY_INLINE_DATA flag is set
  - ext4: fix RENAME_WHITEOUT handling for inline directories
  - ext4: fix cgroup writeback accounting with fs-layer encryption
  - drm/connector: print max_requested_bpc in state debugfs
  - drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc15
  - x86/CPU/AMD: Disable XSAVES on AMD family 0x17
  - fork: allow CLONE_NEWTIME in clone3 flags
  - fs: prevent out-of-bounds array speculation when closing a file descriptor
  - staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh
  - staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script
  - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext"
  - !2674 [22.03-LTS-SP2]Backport 5.10.173 LTS patches from upstream.
  - usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails
  - scsi: mpt3sas: Remove usage of dma_get_required_mask() API
  - scsi: mpt3sas: re-do lost mpt3sas DMA mask fix
  - scsi: mpt3sas: Don't change DMA mask while reallocating pools
  - Revert "scsi: mpt3sas: Fix return value check of dma_get_required_mask()"
  - media: uvcvideo: Fix race condition with usb_kill_urb
  - media: uvcvideo: Provide sync and async uvc_ctrl_status_event
  - Bluetooth: hci_sock: purge socket queues in the destruct() callback
  - drm/display/dp_mst: Fix down message handling after a packet reception error
  - drm/display/dp_mst: Fix down/up message handling after sink disconnect
  - net: tls: avoid hanging tasks on the tx_lock
  - soundwire: cadence: Drain the RX FIFO after an IO timeout
  - soundwire: cadence: Remove wasted space in response_buf
  - phy: rockchip-typec: Fix unsigned comparison with less than zero
  - kernel/fail_function: fix memory leak with using debugfs_lookup()
  - PCI: Take other bus devices into account when distributing resources
  - PCI: Align extra resources for hotplug bridges properly
  - usb: gadget: uvc: Make bSourceID read/write
  - usb: uvc: Enumerate valid values for color matching
  - USB: ene_usb6250: Allocate enough memory for full object
  - usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math
  - iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word()
  - iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word()
  - tools/iio/iio_utils:fix memory leak
  - mei: bus-fixup:upon error print return values of send and receive
  - serial: sc16is7xx: setup GPIO controller later in probe
  - tty: serial: fsl_lpuart: disable the CTS when send break signal
  - staging: emxx_udc: Add checks for dma_alloc_coherent()
  - media: uvcvideo: Silence memcpy() run-time false positive warnings
  - media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
  - media: uvcvideo: Handle errors from calls to usb_string
  - media: uvcvideo: Handle cameras with invalid descriptors
  - IB/hfi1: Update RMT size calculation
  - mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
  - bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support
  - firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
  - tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
  - thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
  - thermal: intel: quark_dts: fix error pointer dereference
  - ASoC: zl38060 add gpiolib dependency
  - ASoC: zl38060: Remove spurious gpiolib select
  - ASoC: adau7118: don't disable regulators on device unbind
  - scsi: ipr: Work around fortify-string warning
  - rtc: sun6i: Always export the internal oscillator
  - tcp: tcp_check_req() can be called from process context
  - ARM: dts: spear320-hmi: correct STMPE GPIO compatible
  - net/sched: act_sample: fix action bind logic
  - nfc: fix memory leak of se_io context in nfc_genl_se_io
  - net/mlx5: Geneve, Fix handling of Geneve object id as error code
  - 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
  - 9p/xen: fix connection sequence
  - 9p/xen: fix version parsing
  - net: fix __dev_kfree_skb_any() vs drop monitor
  - sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
  - netfilter: ebtables: fix table blob use-after-free
  - netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
  - watchdog: pcwd_usb: Fix attempting to access uninitialized memory
  - watchdog: Fix kmemleak in watchdog_cdev_register
  - watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path
  - x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
  - ubi: Fix possible null-ptr-deref in ubi_free_volume()
  - ubifs: Fix memory leak in alloc_wbufs()
  - ubifs: Fix build errors as symbol undefined
  - ubi: ensure that VID header offset + VID header size <= alloc, size
  - um: vector: Fix memory leak in vector_config
  - fs: f2fs: initialize fsdata in pagecache_write()
  - f2fs: use memcpy_{to,from}_page() where possible
  - pwm: stm32-lp: fix the check on arr and cmp registers update
  - pwm: sifive: Always let the first pwm_apply_state succeed
  - pwm: sifive: Reduce time the controller lock is held
  - objtool: Fix memory leak in create_static_call_sections()
  - kbuild: Port silent mode detection to future gnu make.
  - pinctrl: rockchip: fix reading pull type on rk3568
  - pinctrl: rockchip: fix mux route data for rk3568
  - wifi: ath9k: use proper statements in conditionals
  - arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY
  - drm/edid: fix AVI infoframe aspect ratio handling
  - drm/radeon: Fix eDP for single-display iMac11,2
  - drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
  - vfio/type1: prevent underflow of locked_vm via exec()
  - PCI: Avoid FLR for AMD FCH AHCI adapters
  - PCI: hotplug: Allow marking devices as disconnected during bind/unbind
  - PCI/PM: Observe reset delay irrespective of bridge_d3
  - riscv: jump_label: Fixup unaligned arch_static_branch function
  - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
  - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
  - scsi: ses: Don't attach if enclosure has no components
  - scsi: qla2xxx: Fix erroneous link down
  - scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
  - scsi: qla2xxx: Fix link failure in NPIV environment
  - ktest.pl: Add RUN_TIMEOUT option with default unlimited
  - ktest.pl: Fix missing "end_monitor" when machine check fails
  - ktest.pl: Give back console on Ctrt^C on monitor
  - mm/thp: check and bail out if page in deferred queue already
  - mm: memcontrol: deprecate charge moving
  - docs: gdbmacros: print newest record
  - remoteproc/mtk_scp: Move clk ops outside send_lock
  - media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
  - mips: fix syscall_get_nr
  - dax/kmem: Fix leak of memory-hotplug resources
  - alpha: fix FEN fault handling
  - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
  - ARM: dts: exynos: correct TMU phandle in Odroid HC1
  - ARM: dts: exynos: correct TMU phandle in Odroid XU
  - ARM: dts: exynos: correct TMU phandle in Exynos5250
  - ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
  - ARM: dts: exynos: correct TMU phandle in Exynos4
  - ARM: dts: exynos: correct TMU phandle in Exynos4210
  - dm flakey: don't corrupt the zero page
  - dm flakey: fix logic when corrupting a bio
  - thermal: intel: powerclamp: Fix cur_state for multi package system
  - wifi: cfg80211: Fix use after free for wext
  - wifi: rtl8xxxu: Use a longer retry limit of 48
  - dm: add cond_resched() to dm_wq_work()
  - mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
  - ext4: refuse to create ea block when umounted
  - ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
  - ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
  - io_uring: remove MSG_NOSIGNAL from recvmsg
  - io_uring/rsrc: disallow multi-source reg buffers
  - io_uring: add a conditional reschedule to the IOPOLL cancelation loop
  - io_uring: mark task TASK_RUNNING before handling resume/task work
  - io_uring: handle TIF_NOTIFY_RESUME when checking for task_work
  - irqdomain: Drop bogus fwspec-mapping error handling
  - irqdomain: Fix disassociation race
  - irqdomain: Fix association race
  - ima: Align ima_file_mmap() parameters with mmap_file LSM hook
  - brd: return 0/-error from brd_insert_page()
  - Documentation/hw-vuln: Document the interaction between IBRS and STIBP
  - x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter
  - x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
  - x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
  - x86/reboot: Disable SVM, not just VMX, when stopping CPUs
  - x86/reboot: Disable virtualization in an emergency if SVM is supported
  - x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
  - x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
  - KVM: s390: disable migration mode when dirty tracking is disabled
  - KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
  - KVM: Destroy target device if coalesced MMIO unregistration fails
  - udf: Fix file corruption when appending just after end of preallocated extent
  - udf: Detect system inodes linked into directory hierarchy
  - udf: Preserve link count of system files
  - udf: Do not update file length for failed writes to inline files
  - udf: Do not bother merging very long extents
  - udf: Truncate added extents on failed expansion
  - ocfs2: fix non-auto defrag path not working issue
  - ocfs2: fix defrag path triggering jbd2 ASSERT
  - f2fs: fix cgroup writeback accounting with fs-layer encryption
  - f2fs: fix information leak in f2fs_move_inline_dirents()
  - exfat: fix inode->i_blocks for non-512 byte sector size device
  - exfat: redefine DIR_DELETED as the bad cluster number
  - exfat: fix unexpected EOF while reading dir
  - exfat: fix reporting fs error when reading dir beyond EOF
  - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
  - ARM: dts: exynos: correct HDMI phy compatible in Exynos4
  - cifs: Fix uninitialized memory read in smb3_qfs_tcon()
  - s390/kprobes: fix current_kprobe never cleared after kprobes reenter
  - s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
  - s390: discard .interp section
  - s390/extmem: return correct segment type in __segment_load()
  - ipmi_ssif: Rename idle state and check
  - rtc: pm8xxx: fix set-alarm race
  - firmware: coreboot: framebuffer: Ignore reserved pixel color bits
  - wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
  - nfsd: zero out pointers after putting nfsd_files on COPY setup error
  - dm cache: add cond_resched() to various workqueue loops
  - dm thin: add cond_resched() to various workqueue loops
  - HID: logitech-hidpp: Don't restart communication if not necessary
  - pinctrl: at91: use devm_kasprintf() to avoid potential leaks
  - hwmon: (coretemp) Simplify platform device handling
  - gfs2: Improve gfs2_make_fs_rw error handling
  - regulator: s5m8767: Bounds check id indexing into arrays
  - regulator: max77802: Bounds check regulator id against opmode
  - ASoC: kirkwood: Iterate over array indexes instead of using pointer math
  - docs/scripts/gdb: add necessary make scripts_gdb step
  - drm/msm/dsi: Add missing check for alloc_ordered_workqueue
  - drm: amd: display: Fix memory leakage
  - drm/radeon: free iio for atombios when driver shutdown
  - drm/tiny: ili9486: Do not assume 8-bit only SPI controllers
  - HID: Add Mapping for System Microphone Mute
  - drm/omap: dsi: Fix excessive stack usage
  - drm/amd/display: Fix potential null-deref in dm_resume
  - Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
  - PM: EM: fix memory leak with using debugfs_lookup()
  - uaccess: Add minimum bounds check on kernel buffer size
  - coda: Avoid partial allocation of sig_inputArgs
  - net/mlx5: fw_tracer: Fix debug print
  - ACPI: video: Fix Lenovo Ideapad Z570 DMI match
  - wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
  - m68k: Check syscall_trace_enter() return code
  - net: bcmgenet: Add a check for oversized packets
  - ACPI: Don't build ACPICA with '-Os'
  - ice: add missing checks for PF vsi type
  - inet: fix fast path in __inet_hash_connect()
  - wifi: mt7601u: fix an integer underflow
  - wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
  - x86/bugs: Reset speculation control settings on init
  - timers: Prevent union confusion from unexpected restart_syscall()
  - thermal: intel: Fix unsigned comparison with less than zero
  - wifi: ath11k: debugfs: fix to work with multiple PCI devices
  - rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
  - rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait()
  - rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
  - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
  - wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
  - blk-iocost: fix divide by 0 error in calc_lcoefs()
  - ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
  - udf: Define EFSCORRUPTED error code
  - rpmsg: glink: Avoid infinite loop on intent for missing channel
  - media: saa7134: Use video_unregister_device for radio_dev
  - media: i2c: ov7670: 0 instead of -EINVAL was returned
  - media: i2c: imx219: Fix binning for RAW8 capture
  - media: i2c: imx219: Split common registers from mode tables
  - media: i2c: imx219: remove redundant writes
  - media: i2c: ov772x: Fix memleak in ov772x_probe()
  - media: ov5675: Fix memleak in ov5675_init_controls()
  - media: ov2740: Fix memleak in ov2740_init_controls()
  - media: max9286: Fix memleak in max9286_v4l2_register()
  - builddeb: clean generated package content
  - powerpc: Remove linker flag from KBUILD_AFLAGS
  - media: platform: ti: Add missing check for devm_regulator_get
  - media: ti: cal: fix possible memory leak in cal_ctx_create()
  - remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers
  - Input: iqs269a - do not poll during ATI
  - Input: iqs269a - do not poll during suspend or resume
  - alpha/boot/tools/objstrip: fix the check for ELF header
  - vdpa/mlx5: Don't clear mr struct on destroy MR
  - MIPS: vpe-mt: drop physical_memsize
  - MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set
  - powerpc/eeh: Set channel state after notifying the drivers
  - powerpc/eeh: Small refactor of eeh_handle_normal_event()
  - powerpc/rtas: ensure 4KB alignment for rtas_data_buf
  - powerpc/rtas: make all exports GPL
  - powerpc/pseries/lparcfg: add missing RTAS retry status handling
  - powerpc/pseries/lpar: add missing RTAS retry status handling
  - powerpc/perf/hv-24x7: add missing RTAS retry status handling
  - clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
  - powerpc/powernv/ioda: Skip unallocated resources when mapping to PE
  - clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC
  - clk: qcom: gpucc-sc7180: fix clk_dis_wait being programmed for CX GDSC
  - Input: ads7846 - don't check penirq immediately for 7845
  - Input: ads7846 - always set last command to PWRDOWN
  - Input: ads7846 - convert to one message
  - Input: ads7846 - convert to full duplex
  - Input: ads7846 - don't report pressure for ads7845
  - clk: imx: avoid memory leak
  - clk: renesas: cpg-mssr: Remove superfluous check in resume code
  - clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed
  - linux/kconfig.h: replace IF_ENABLED() with PTR_IF() in <linux/kernel.h>
  - Input: iqs269a - configure device with a single block write
  - Input: iqs269a - increase interrupt handler return delay
  - Input: iqs269a - drop unused device node references
  - mtd: rawnand: sunxi: Fix the size of the last OOB region
  - RISC-V: fix funct4 definition for c.jalr in parse_asm.h
  - clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents
  - clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents
  - mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
  - objtool: add UACCESS exceptions for __tsan_volatile_read/write
  - printf: fix errname.c list
  - sparc: allow PM configs for sparc32 COMPILE_TEST
  - perf tools: Fix auto-complete on aarch64
  - leds: led-core: Fix refcount leak in of_led_get()
  - perf llvm: Fix inadvertent file creation
  - gfs2: jdata writepage fix
  - cifs: Fix warning and UAF when destroy the MR list
  - cifs: Fix lost destroy smbd connection when MR allocate failed
  - nfsd: fix race to check ls_layouts
  - hid: bigben_probe(): validate report count
  - HID: bigben: use spinlock to safely schedule workers
  - HID: bigben_worker() remove unneeded check on report_field
  - HID: bigben: use spinlock to protect concurrent accesses
  - ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
  - spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
  - NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode()
  - dm: remove flush_scheduled_work() during local_exit()
  - ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init
  - hwmon: (mlxreg-fan) Return zero speed for broken fan
  - spi: bcm63xx-hsspi: Fix multi-bit mode setting
  - spi: bcm63xx-hsspi: fix pm_runtime
  - scsi: aic94xx: Add missing check for dma_map_single()
  - scsi: mpt3sas: Fix a memory leak
  - drm/amdgpu: fix enum odm_combine_mode mismatch
  - hwmon: (ltc2945) Handle error case in ltc2945_value_store
  - ASoC: dt-bindings: meson: fix gx-card codec node regex
  - ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params()
  - ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove()
  - ASoC: mchp-spdifrx: fix controls that works with completion mechanism
  - ASoC: mchp-spdifrx: fix return value in case completion times out
  - ASoC: atmel: fix spelling mistakes
  - ASoC: mchp-spdifrx: fix controls which rely on rsr register
  - spi: dw_bt1: fix MUX_MMIO dependencies
  - gpio: vf610: connect GPIO label to dev name
  - ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
  - drm/mediatek: Clean dangling pointer on bind error path
  - drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
  - drm/mediatek: Drop unbalanced obj unref
  - drm/mediatek: Use NULL instead of 0 for NULL pointer
  - drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd
  - gpu: host1x: Don't skip assigning syncpoints to channels
  - pinctrl: mediatek: Initialize variable *buf to zero
  - pinctrl: mediatek: Initialize variable pullen and pullup to zero
  - pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback()
  - drm/msm/mdp5: Add check for kzalloc
  - drm/msm/dpu: Add check for cstate
  - drm/msm: use strscpy instead of strncpy
  - drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
  - drm/bridge: lt9611: pass a pointer to the of node
  - drm/bridge: lt9611: fix clock calculation
  - drm/bridge: lt9611: fix programming of video modes
  - drm/bridge: lt9611: fix polarity programming
  - drm/bridge: lt9611: fix HPD reenablement
  - drm/bridge: lt9611: fix sleep mode setup
  - drm/msm/dpu: Disallow unallocated resources to be returned
  - ALSA: hda/ca0132: minor fix for allocation size
  - drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
  - ASoC: fsl_sai: initialize is_dsp_mode flag
  - drm/vc4: hdmi: Correct interlaced timings again
  - drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
  - drm/vc4: hvs: Set AXI panic modes
  - pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
  - pinctrl: rockchip: do coding style for mux route struct
  - pinctrl: rockchip: add support for rk3568
  - pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
  - pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins
  - drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
  - gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id()
  - drm: tidss: Fix pixel format definition
  - drm/vc4: dpi: Fix format mapping for RGB565
  - drm/vc4: dpi: Add option for inverting pixel clock and output enable
  - drm/vkms: Fix null-ptr-deref in vkms_release()
  - drm/bridge: megachips: Fix error handling in i2c_register_driver()
  - drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
  - drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
  - drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
  - sefltests: netdevsim: wait for devlink instance after netns removal
  - selftest: fib_tests: Always cleanup before exit
  - net: bcmgenet: fix MoCA LED control
  - l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
  - selftests/net: Interpret UDP_GRO cmsg data as an int value
  - irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
  - irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
  - bpf: Fix global subprog context argument resolution logic
  - can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error
  - thermal/drivers/hisi: Drop second sensor hi3660
  - wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
  - crypto: crypto4xx - Call dma_unmap_page when done
  - selftests/bpf: Fix out-of-srctree build
  - wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
  - wifi: iwl4965: Add missing check for create_singlethread_workqueue()
  - wifi: iwl3945: Add missing check for create_singlethread_workqueue
  - RISC-V: time: initialize hrtimer based broadcast clock event device
  - m68k: /proc/hardware should depend on PROC_FS
  - crypto: rsa-pkcs1pad - Use akcipher_request_complete
  - rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
  - libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
  - Bluetooth: L2CAP: Fix potential user-after-free
  - OPP: fix error checking in opp_migrate_dentry()
  - s390/vmem: fix empty page tables cleanup under KASAN
  - irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
  - irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
  - irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
  - irqchip: Fix refcount leak in platform_irqchip_probe
  - net/mlx5: Enhance debug print in page allocation failure
  - bpftool: profile online CPUs instead of possible
  - crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware
  - crypto: ccp - Refactor out sev_fw_alloc()
  - leds: led-class: Add missing put_device() to led_put()
  - crypto: xts - Handle EBUSY correctly
  - net: ethernet: ti: add missing of_node_put before return
  - net: ethernet: ti: am65-cpsw: handle deferred probe with dev_err_probe()
  - net: ethernet: ti: am65-cpsw: fix tx csum offload for multi mac mode
  - x86/microcode: Print previous version of microcode after reload
  - x86/microcode: Default-disable late loading
  - x86/microcode: Rip out the OLD_INTERFACE
  - x86: Mark stop_this_cpu() __noreturn
  - x86/microcode: Replace deprecated CPU-hotplug functions.
  - x86/cpu: Init AP exception handling from cpu_init_secondary()
  - powercap: fix possible name leak in powercap_register_zone()
  - crypto: seqiv - Handle EBUSY correctly
  - crypto: essiv - Handle EBUSY correctly
  - crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
  - ACPI: battery: Fix missing NUL-termination with large strings
  - wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data()
  - wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
  - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
  - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
  - ath9k: htc: clean up statistics macros
  - ath9k: hif_usb: simplify if-if to if-else
  - wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
  - wifi: orinoco: check return value of hermes_write_wordrec()
  - wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
  - thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
  - thermal/drivers/tsens: Add compat string for the qcom,msm8960
  - thermal/drivers/qcom/tsens_v1: Enable sensor 3 on MSM8976
  - thermal/drivers/tsens: Drop msm8976-specific defines
  - ACPICA: nsrepair: handle cases without a return value correctly
  - crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2
  - crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak
  - crypto: ccp: Use the stack and common buffer for status commands
  - crypto: ccp: Use the stack for small SEV command buffers
  - lib/mpi: Fix buffer overrun when SG is too long
  - rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
  - rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
  - rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
  - genirq: Fix the return type of kstat_cpu_irqs_sum()
  - ACPICA: Drop port I/O validation for some regions
  - crypto: x86/ghash - fix unaligned access in ghash_setkey()
  - wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
  - wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
  - wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
  - wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
  - wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
  - wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
  - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
  - wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
  - wifi: ipw2200: fix memory leak in ipw_wdev_init()
  - wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
  - libbpf: Fix btf__align_of() by taking into account field offsets
  - wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
  - rtlwifi: fix -Wpointer-sign warning
  - wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
  - wifi: libertas: fix memory leak in lbs_init_adapter()
  - wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave()
  - wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave()
  - wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave()
  - wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave()
  - wifi: rsi: Fix memory leak in rsi_coex_attach()
  - block: bio-integrity: Copy flags when bio_integrity_payload is cloned
  - x86/perf/zhaoxin: Add stepping check for ZXC
  - sched/rt: pick_next_rt_entity(): check list_entry
  - sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity()
  - s390/dasd: Fix potential memleak in dasd_eckd_init()
  - s390/dasd: Prepare for additional path event handling
  - blk-mq: correct stale comment of .get_budget
  - blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
  - blk-mq: avoid sleep in blk_mq_alloc_request_hctx
  - arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
  - ARM: dts: imx7s: correct iomuxc gpr mux controller cells
  - ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
  - arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
  - arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name
  - arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
  - arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name
  - arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name
  - arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
  - arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property
  - arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
  - arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
  - arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
  - ARM: imx: Call ida_simple_remove() for ida_simple_get
  - ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
  - arm64: dts: ti: k3-j7200: Fix wakeup pinmux range
  - ARM: s3c: fix s3c64xx_set_timer_source prototype
  - ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init()
  - arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
  - arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names
  - arm64: dts: qcom: ipq8074: fix Gen3 PCIe node
  - arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges
  - arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY
  - arm64: dts: qcom: ipq8074: fix PCIe PHY serdes size
  - arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes
  - arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names
  - arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
  - arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
  - arm64: dts: meson-gx: Fix Ethernet MAC address unit name
  - arm64: dts: qcom: sc7180: correct SPMI bus address cells
  - arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
  - arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description
  - ARM: zynq: Fix refcount leak in zynq_early_slcr_init
  - arm64: dts: qcom: qcs404: use symbol names for PCIe resets
  - ARM: OMAP2+: Fix memory leak in realtime_counter_init()
  - powerpc/mm: Rearrange if-else block to avoid clang warning
  - ubi: Refuse attaching if mtd's erasesize is 0
  - !2649 [sync] PR-2641:  Fix CVE-2023-5717
  - perf: Fix kabi breakage in struct perf_event
  - perf: Disallow mis-matched inherited group reads
  - !2572  Fix cgroup psi poll UAF
  - !2521 [sync] PR-2437:  crypto: drbg - Only fail when jent is unavailable in FIPS mode
  - igb: set max size RX buffer when store bad packet is enabled
  - !2597 [sync] PR-2573:  media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
  - !2568 [sync] PR-2557:  Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
  - !2582 [sync] PR-2476:  Fixed five CVEs vulnerabilities of ksmbd
  - !2623 [sync] PR-2613:  CVE-2022-44033
  - char: pcmcia: remove all the drivers
  - tty: ipwireless: move Kconfig entry to tty
  - !2586 [sync] PR-2571:  xen/events: replace evtchn_rwlock with RCU
  - media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
  - xen/events: replace evtchn_rwlock with RCU
  - !2523 [sync] PR-2159: Enable HiSilicon Erratum 162001900 quirk for HIP08/09
  - ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN
  - ksmbd: fix infinite loop in ksmbd_conn_handler_loop()
  - ksmbd: send proper error response in smb2_tree_connect()
  - ksmbd: fix racy issue from smb2 close and logoff with multichannel
  - ksmbd: call rcu_barrier() in ksmbd_server_exit()
  - ksmbd: fix racy issue under cocurrent smb2 tree disconnect
  - sched/psi: Select KERNFS as needed
  - kernfs: add stub helper for kernfs_generic_poll()
  - sched/psi: use kernfs polling functions for PSI trigger polling
  - Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
  - !2467 [sync] PR-1851: Backport 5.10.169 - 5.10.172 LTS patches from upstream
  - netfilter: xt_sctp: validate the flag_info count
  - ipv4: fix null-deref in ipv4_link_failure
  - !2324 [sync] PR-2197: [RoCE] Support getting xrcd num from firmware；Fix incorrect post-send with direct wqe of wr-list
  - netfilter: nfnetlink_osf: avoid OOB read
  - netfilter: xt_u32: validate user space input
  - perf/smmuv3: Add MODULE_ALIAS for module auto loading
  - perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09
  - Revert "perf/smmuv3: Enable HiSilicon Erratum quirk"
  - !2516 [sync] PR-2499:  f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
  - crypto: drbg - Only fail when jent is unavailable in FIPS mode
  - !2487 [sync] PR-2340:  xfs: recent patches to fix xfs issues
  - f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
  - xfs: update the last_sync_lsn with ctx start lsn
  - xfs: shutdown xfs once inode double free
  - xfs: fix off-by-one-block in xfs_discard_folio()
  - xfs: xfs_bmap_punch_delalloc_range() should take a byte range
  - iomap: buffered write failure should not truncate the page cache
  - xfs,iomap: move delalloc punching to iomap
  - xfs: use byte ranges for write cleanup ranges
  - xfs: punching delalloc extents on write failure is racy
  - xfs: longest free extent no need consider postalloc
  - xfs: fix xfs shutdown since we reserve more blocks in agfl fixup
  - xfs: block reservation too large for minleft allocation
  - xfs: set minleft correctly for randomly sparse inode allocations
  - xfs: shutdown to ensure submits buffers on LSN boundaries
  - xfs: don't verify agf length when log recovery
  - xfs: Remove redundant assignment to busy
  - xfs: remove redundant pointer lip
  - xfs: remove redundant initializations of pointers drop_leaf and save_leaf
  - xfs: xfs_trans_cancel() path must check for log shutdown
  - xfs: fix bounds check in xfs_defer_agfl_block()
  - xfs: AGF length has never been bounds checked
  - xfs: journal geometry is not properly bounds checked
  - xfs: don't block in busy flushing when freeing extents
  - xfs: allow extent free intents to be retried
  - xfs: pass alloc flags through to xfs_extent_busy_flush()
  - Revert "xfs: propagate the return value of xfs_log_force() to avoid soft lockup"
  - xfs: use deferred frees for btree block freeing
  - xfs: don't reverse order of items in bulk AIL insertion
  - xfs: validate block number being freed before adding to xefi
  - xfs: validity check agbnos on the AGFL
  - xfs: pass xfs_extent_free_item directly through the log intent code
  - xfs: remove unused parameter from refcount code
  - xfs: reduce the size of struct xfs_extent_free_item
  - xfs: rename xfs_bmap_add_free to xfs_free_extent_later
  - xfs: create slab caches for frequently-used deferred items
  - xfs: compact deferred intent item structures
  - xfs: rename _zone variables to _cache
  - xfs: remove kmem_zone typedef
  - xfs: remove xfs_setattr_time() declaration
  - xfs: use setattr_copy to set vfs inode attributes
  - xfs: set prealloc flag in xfs_alloc_file_space()
  - xfs: don't assert fail on perag references on teardown
  - xfs: fix dir3 block read verify fail during log recover
  - xfs: propagate the return value of xfs_log_force() to avoid soft lockup
  - xfs: keep growfs sb log item active until ail flush success
  - USB: core: Don't hold device lock while reading the "descriptors" sysfs file
  - usb: gadget: u_serial: Add null pointer check in gserial_resume
  - USB: serial: option: add support for VW/Skoda "Carstick LTE"
  - scripts/tags.sh: fix incompatibility with PCRE2
  - scripts/tags.sh: Invoke 'realpath' via 'xargs'
  - bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
  - HID: core: Fix deadloop in hid_apply_multiplier.
  - IB/hfi1: Assign npages earlier
  - btrfs: send: limit number of clones and allocated memory size
  - ACPI: NFIT: fix a potential deadlock during NFIT teardown
  - ARM: dts: rockchip: add power-domains property to dp node on rk3288
  - arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc
  - Fix XFRM-I support for nested ESP tunnels
  - ext4: Fix function prototype mismatch for ext4_feat_ktype
  - audit: update the mailing list in MAINTAINERS
  - wifi: mwifiex: Add missing compatible string for SD8787
  - nbd: fix possible overflow for 'first_minor' in nbd_dev_add()
  - nbd: fix max value for 'first_minor'
  - Revert "Revert "block: nbd: add sanity check for first_minor""
  - mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
  - powerpc: dts: t208x: Disable 10G on MAC1 and MAC2
  - can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len
  - KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid
  - KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception
  - random: always mix cycle counter in add_latent_entropy()
  - clk: mxl: syscon_node_to_regmap() returns error pointers
  - powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G
  - clk: mxl: Fix a clk entry by adding relevant flags
  - clk: mxl: Add option to override gate clks
  - clk: mxl: Remove redundant spinlocks
  - clk: mxl: Switch from direct readl/writel based IO to regmap based IO
  - wifi: rtl8xxxu: gen2: Turn on the rate control
  - drm/etnaviv: don't truncate physical page address
  - nvmem: core: fix return value
  - net: sched: sch: Fix off by one in htb_activate_prios()
  - ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak
  - alarmtimer: Prevent starvation by small intervals and SIG_IGN
  - i40e: Add checking for null for nlmsg_find_attr()
  - net/sched: act_ctinfo: use percpu stats
  - flow_offload: fill flags to action structure
  - drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list
  - drm/i915/gen11: Moving WAs to icl_gt_workarounds_init()
  - nilfs2: fix underflow in second superblock position calculations
  - ipv6: Fix tcp socket connection with DSCP.
  - ipv6: Fix datagram socket connection with DSCP.
  - ixgbe: add double of VLAN header when computing the max MTU
  - net: stmmac: Restrict warning on disabling DMA store and fwd mode
  - bnxt_en: Fix mqprio and XDP ring checking logic
  - net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence
  - net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
  - dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.
  - sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list
  - net: bgmac: fix BCM5358 support by setting correct flags
  - i40e: add double of VLAN header when computing the max MTU
  - ixgbe: allow to increase MTU to 3K with XDP enabled
  - revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"
  - Revert "mm: Always release pages to the buddy allocator in memblock_free_late()."
  - hugetlb: check for undefined shift on 32 bit architectures
  - sched/psi: Fix use-after-free in ep_remove_wait_queue()
  - ALSA: hda/realtek - fixed wrong gpio assigned
  - ALSA: hda/conexant: add a new hda codec SN6180
  - mmc: mmc_spi: fix error handling in mmc_spi_probe()
  - mmc: sdio: fix possible resource leaks in some error paths
  - mmc: jz4740: Work around bug on JZ4760(B)
  - netfilter: nft_tproxy: restrict to prerouting hook
  - ovl: remove privs in ovl_fallocate()
  - ovl: remove privs in ovl_copyfile()
  - s390/signal: fix endless loop in do_signal
  - aio: fix mremap after fork null-deref
  - nvmem: core: fix registration vs use race
  - nvmem: core: fix cleanup after dev_set_name()
  - nvmem: core: remove nvmem_config wp_gpio
  - nvmem: core: add error handling for dev_set_name
  - platform/x86: touchscreen_dmi: Add Chuwi Vi8 (CWI501) DMI match
  - nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association
  - s390/decompressor: specify __decompress() buf len to avoid overflow
  - net: sched: sch: Bounds check priority
  - net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC
  - net/rose: Fix to not accept on connected socket
  - tools/virtio: fix the vringh test for virtio ring changes
  - ASoC: cs42l56: fix DT probe
  - ALSA: hda: Do not unset preset when cleaning up codec
  - selftests/bpf: Verify copy_register_state() preserves parent/live fields
  - ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers
  - !2430 [sync] PR-1822: Backport 5.10.168 LTS patches from upstream
  - Fix page corruption caused by racy check in __free_pages
  - arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive
  - arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive
  - arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive
  - riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte
  - ceph: flush cap releases when the session is flushed
  - usb: typec: altmodes/displayport: Fix probe pin assign check
  - usb: core: add quirk for Alcor Link AK9563 smartcard reader
  - btrfs: free device in btrfs_close_devices for a single device filesystem
  - net: USB: Fix wrong-direction WARNING in plusb.c
  - pinctrl: intel: Restore the pins that used to be in Direct IRQ mode
  - spi: dw: Fix wrong FIFO level setting for long xfers
  - pinctrl: single: fix potential NULL dereference
  - pinctrl: aspeed: Fix confusing types in return value
  - ALSA: pci: lx6464es: fix a debug loop
  - selftests: forwarding: lib: quote the sysctl values
  - net/mlx5: fw_tracer, Zero consumer index when reloading the tracer
  - net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers
  - net/mlx5e: IPoIB, Show unknown speed instead of error
  - net: mscc: ocelot: fix VCAP filters not matching on MAC with "protocol 802.1Q"
  - ice: Do not use WQ_MEM_RECLAIM flag for workqueue
  - uapi: add missing ip/ipv6 header dependencies for linux/stddef.h
  - ionic: clean interrupt before enabling queue to avoid credit race
  - net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY
  - bonding: fix error checking in bond_debug_reregister()
  - xfrm: fix bug with DSCP copy to v6 from v4 tunnel
  - RDMA/usnic: use iommu_map_atomic() under spin_lock()
  - IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
  - xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
  - IB/hfi1: Restore allocated resources on failed copyout
  - xfrm: compat: change expression for switch in xfrm_xlate64
  - can: j1939: do not wait 250 ms if the same addr was already claimed
  - of/address: Return an error when no valid dma-ranges are found
  - tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw
  - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360
  - ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
  - ALSA: hda/realtek: Add Positivo N14KP6-TG
  - btrfs: zlib: zero-initialize zlib workspace
  - btrfs: limit device extents to the device size
  - migrate: hugetlb: check for hugetlb shared PMD in node migration
  - mm/migration: return errno when isolate_huge_page failed
  - iio:adc:twl6030: Enable measurement of VAC
  - bpf: Do not reject when the stack read size is different from the tracked scalar size
  - nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property
  - wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
  - f2fs: fix to do sanity check on i_extra_isize in is_alive()
  - fbdev: smscufx: fix error handling code in ufx_usb_probe
  - serial: 8250_dma: Fix DMA Rx rearm race
  - serial: 8250_dma: Fix DMA Rx completion race
  - nvmem: core: fix cell removal on error
  - nvmem: core: initialise nvmem->id early
  - drm/i915: Fix potential bit_17 double-free
  - Squashfs: fix handling and sanity checking of xattr_ids count
  - fpga: stratix10-soc: Fix return value check in s10_ops_write_init()
  - x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses
  - mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
  - riscv: disable generation of unwind tables
  - parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case
  - parisc: Fix return code of pdc_iodc_print()
  - nvmem: qcom-spmi-sdam: fix module autoloading
  - iio: imu: fxos8700: fix MAGN sensor scale and unit
  - iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN
  - iio: imu: fxos8700: fix failed initialization ODR mode assignment
  - iio: imu: fxos8700: fix incorrect ODR mode readback
  - iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback
  - iio: imu: fxos8700: fix map label of channel type to MAGN sensor
  - iio: imu: fxos8700: fix IMU data bits returned to user space
  - iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback
  - iio: imu: fxos8700: fix ACCEL measurement range selection
  - iio:adc:twl6030: Enable measurements of VUSB, VBAT and others
  - iio: adc: berlin2-adc: Add missing of_node_put() in error path
  - iio: hid: fix the retval in accel_3d_capture_sample
  - efi: Accept version 2 of memory attributes table
  - ALSA: hda/realtek: Add Acer Predator PH315-54
  - watchdog: diag288_wdt: fix __diag288() inline assembly
  - watchdog: diag288_wdt: do not use stack buffers for hardware data
  - net: qrtr: free memory on error path in radix_tree_insert()
  - Input: i8042 - add Clevo PCX0DX to i8042 quirk table
  - Input: i8042 - add TUXEDO devices to i8042 quirk tables
  - Input: i8042 - merge quirk tables
  - Input: i8042 - move __initconst to fix code styling warning
  - usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
  - usb: dwc3: qcom: enable vbus override when in OTG dr-mode
  - usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API
  - iio: adc: stm32-dfsdm: fill module aliases
  - net/x25: Fix to not accept on connected socket
  - platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table
  - i2c: rk3x: fix a bunch of kernel-doc warnings
  - scsi: target: core: Fix warning on RT kernels
  - i2c: mxs: suppress probe-deferral error message
  - qede: execute xdp_do_flush() before napi_complete_done()
  - qede: add netpoll support for qede driver
  - efi: fix potential NULL deref in efi_mem_reserve_persistent
  - net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
  - virtio-net: Keep stop() to follow mirror sequence of open()
  - selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking
  - selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs
  - selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided
  - selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning
  - ata: libata: Fix sata_down_spd_limit() when no link speed is reported
  - can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate
  - igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp()
  - net: phy: meson-gxl: Add generic dummy stubs for MMD register access
  - squashfs: harden sanity check in squashfs_read_xattr_id_table
  - netfilter: br_netfilter: disable sabotage_in hook after first suppression
  - net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices
  - sfc: correctly advertise tunneled IPv6 segmentation
  - virtio-net: execute xdp_do_flush() before napi_complete_done()
  - fix "direction" argument of iov_iter_kvec()
  - fix iov_iter_bvec() "direction" argument
  - READ is "data destination", not source...
  - WRITE is "data source", not destination...
  - vhost/net: Clear the pending messages when the backend is removed
  - scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT"
  - drm/vc4: hdmi: make CEC adapter name unique
  - arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX
  - bpf: Fix to preserve reg parent/live fields when copying range info
  - bpf: Support <8-byte scalar spill and refill
  - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
  - bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers
  - powerpc/imc-pmu: Revert nest_init_lock to being a mutex
  - bpf: Fix incorrect state pruning for <8B spill/fill
  - bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
  - firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region
  - ext4: do not mark inode dirty every time when appending using delalloc
  - RDMA/hns: Fix incorrect post-send with direct wqe of wr-list
  - RDMA/hns: Support get XRCD number from firmware
  - Revert "RDMA/hns: Fix incorrect post-send with direct wqe of wr-list in kernel space"
  - Revert "RDMA/hns: Support getting xrcd num from firmware"


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.32.0.109
changelog:
  - !2719 [sync] PR-2678:  io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
  - !2741 [sync] PR-2443:  CVE-2023-37453
  - !2735 [sync] PR-2688:  nvmet-tcp: Fix a possible UAF in queue intialization setup
  - USB: core: Fix oversight in SuperSpeed initialization
  - USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
  - USB: core: Change usb_get_device_descriptor() API
  - USB: core: Unite old scheme and new scheme descriptor reads
  - !2729 [sync] PR-2686: Backport 5.10.179 LTS patches from upstream.
  - nvmet-tcp: Fix a possible UAF in queue intialization setup
  - ASN.1: Fix check for strdup() success
  - ASoC: fsl_asrc_dma: fix potential null-ptr-deref
  - iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger()
  - pwm: hibvt: Explicitly set .polarity in .get_state()
  - pwm: iqs620a: Explicitly set .polarity in .get_state()
  - pwm: meson: Explicitly set .polarity in .get_state()
  - ext4: fix use-after-free in ext4_xattr_set_entry
  - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set()
  - Revert "ext4: fix use-after-free in ext4_xattr_set_entry"
  - fuse: fix deadlock between atomic O_TRUNC and page invalidation
  - fuse: always revalidate rename target dentry
  - fuse: fix attr version comparison in fuse_read_update_size()
  - fuse: check s_root when destroying sb
  - virtiofs: split requests that exceed virtqueue size
  - virtiofs: clean up error handling in virtio_fs_get_tree()
  - purgatory: fix disabling debug info
  - docs: futex: Fix kernel-doc references after code split-up preparation
  - MIPS: Define RUNTIME_DISCARD_EXIT in LD script
  - sched/uclamp: Fix a uninitialized variable warnings
  - sched/uclamp: Make cpu_overutilized() use util_fits_cpu()
  - sched/uclamp: Make select_idle_capacity() use util_fits_cpu()
  - sched/uclamp: Fix fits_capacity() check in feec()
  - sched/uclamp: Make task_fits_capacity() use util_fits_cpu()
  - mm/khugepaged: check again on anon uffd-wp during isolation
  - mmc: sdhci_am654: Set HIGH_SPEED_ENA for SDR12 and SDR25
  - kernel/sys.c: fix and improve control flow in __sys_setres[ug]id()
  - memstick: fix memory leak if card device is never registered
  - nilfs2: initialize unused bytes in segment summary blocks
  - iio: light: tsl2772: fix reading proximity-diodes from device tree
  - powerpc/doc: Fix htmldocs errors
  - xen/netback: use same error messages for same errors
  - nvme-tcp: fix a possible UAF when failing to allocate an io queue
  - s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling
  - net: dsa: b53: mmap: add phy ops
  - scsi: core: Improve scsi_vpd_inquiry() checks
  - scsi: megaraid_sas: Fix fw_crash_buffer_show()
  - selftests: sigaltstack: fix -Wuninitialized
  - Input: i8042 - add quirk for Fujitsu Lifebook A574/H
  - f2fs: Fix f2fs_truncate_partial_nodes ftrace event
  - e1000e: Disable TSO on i219-LM card to increase speed
  - mlxsw: pci: Fix possible crash during initialization
  - net: rpl: fix rpl header size calculation
  - mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
  - i40e: fix i40e_setup_misc_vector() error handling
  - i40e: fix accessing vsi->active_filters without holding lock
  - netfilter: nf_tables: fix ifdef to also consider nf_tables=m
  - sfc: Fix use-after-free due to selftest_work
  - sfc: Split STATE_READY in to STATE_NET_DOWN and STATE_NET_UP.
  - virtio_net: bugfix overflow inside xdp_linearize_page()
  - regulator: fan53555: Explicitly include bits header
  - netfilter: br_netfilter: fix recent physdev match breakage
  - arm64: dts: imx8mm-evk: correct pmic clock source
  - arm64: dts: meson-g12-common: specify full DMC range
  - arm64: dts: qcom: ipq8074-hk01: enable QMP device, not the PHY node
  - ARM: dts: rockchip: fix a typo error for rk3288 spdif node
  - !2724 [22.03-LTS-SP2]Backport 5.10.178 LTS patches from upstream
  - sysctl: Fix data-races in proc_dou8vec_minmax().
  - panic, kexec: make __crash_kexec() NMI safe
  - kexec: turn all kexec_mutex acquisitions into trylocks
  - kexec: move locking into do_kexec_load
  - riscv: Handle zicsr/zifencei issues between clang and binutils
  - kbuild: check CONFIG_AS_IS_LLVM instead of LLVM_IAS
  - kbuild: Switch to 'f' variants of integrated assembler flag
  - kbuild: check the minimum assembler version in Kconfig
  - watchdog: sbsa_wdog: Make sure the timeout programming is within the limits
  - i2c: ocores: generate stop condition after timeout in polling mode
  - x86/rtc: Remove __init for runtime functions
  - sched/fair: Fix imbalance overflow
  - sched/fair: Move calculate of avg_load to a better location
  - powerpc/papr_scm: Update the NUMA distance table for the target node
  - powerpc/pseries: Add support for FORM2 associativity
  - powerpc/pseries: Add a helper for form1 cpu distance
  - powerpc/pseries: Consolidate different NUMA distance update code paths
  - powerpc/pseries: Rename TYPE1_AFFINITY to FORM1_AFFINITY
  - powerpc/pseries: rename min_common_depth to primary_domain_index
  - cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach()
  - x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot
  - scsi: ses: Handle enclosure with just a primary component gracefully
  - net: sfp: initialize sfp->i2c_block_size at sfp allocation
  - riscv: add icache flush for nommu sigreturn trampoline
  - asymmetric_keys: log on fatal failures in PE/pkcs7
  - verify_pefile: relax wrapper length check
  - efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L
  - i2c: imx-lpi2c: clean rx/tx buffers upon new message
  - wifi: mwifiex: mark OF related data as maybe unused
  - power: supply: cros_usbpd: reclassify "default case!" as debug
  - libbpf: Fix single-line struct definition output in btf_dump
  - net: macb: fix a memory corruption in extended buffer descriptor mode
  - udp6: fix potential access to stale information
  - RDMA/core: Fix GID entry ref leak when create_ah fails
  - sctp: fix a potential overflow in sctp_ifwdtsn_skip
  - net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()
  - qlcnic: check pci_reset_function result
  - drm/armada: Fix a potential double free in an error handling path
  - sysctl: add proc_dou8vec_minmax()
  - niu: Fix missing unwind goto in niu_alloc_channels()
  - RDMA/cma: Allow UD qp_type to join multicast only
  - IB/mlx5: Add support for 400G_8X lane speed
  - IB/mlx5: Add support for NDR link speed
  - clk: sprd: set max_register according to mapping range
  - mtd: rawnand: stm32_fmc2: use timings.mode instead of checking tRC_min
  - mtd: rawnand: stm32_fmc2: remove unsupported EDO mode
  - mtd: rawnand: meson: fix bitmask for length in command word
  - mtdblock: tolerate corrected bit-flips
  - fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace
  - btrfs: fix fast csum implementation detection
  - btrfs: print checksum type and implementation at mount time
  - Bluetooth: Fix race condition in hidp_session_thread
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
  - ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards
  - ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex()
  - ALSA: i2c/cs8427: fix iec958 mixer control deactivation
  - ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard
  - ALSA: emu10k1: fix capture interrupt handler unlinking
  - Revert "pinctrl: amd: Disable and mask interrupts on resume"
  - bpftool: Print newline before '}' for struct with padding only fields
  - ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown
  - Revert "media: ti: cal: fix possible memory leak in cal_ctx_create()"
  - drm/bridge: lt9611: Fix PLL being unable to lock
  - selftests: intel_pstate: ftime() is deprecated
  - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
  - drm/nouveau/disp: Support more modes by checking with lower bpc
  - drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
  - ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots()
  - tracing: Free error logs of tracing instances
  - can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events
  - can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access
  - ftrace: Mark get_lock_parent_ip() __always_inline
  - perf/core: Fix the same task check in perf_event_set_output
  - iio: adc: ad7791: fix IRQ flags
  - ALSA: hda/realtek: Add quirk for Clevo X370SNW
  - dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs
  - nilfs2: fix sysfs interface lifetime
  - nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()
  - tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty
  - tty: serial: sh-sci: Fix Rx on RZ/G2L SCI
  - tty: serial: sh-sci: Fix transmit end interrupt handler
  - iio: light: cm32181: Unregister second I2C client if present
  - iio: dac: cio-dac: Fix max DAC write value check for 12-bit
  - iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip
  - USB: serial: option: add Quectel RM500U-CN modem
  - USB: serial: option: add Telit FE990 compositions
  - usb: typec: altmodes/displayport: Fix configure initial pin assignment
  - USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs
  - xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu
  - usb: xhci: tegra: fix sleep in atomic call
  - NFSD: callback request does not use correct credential for AUTH_SYS
  - sunrpc: only free unix grouplist after RCU settles
  - net: stmmac: fix up RX flow hash indirection table when setting channels
  - net: ethernet: ti: am65-cpsw: Fix mdio cleanup in probe
  - gpio: davinci: Add irq chip flag to skip set wake
  - ipv6: Fix an uninit variable access bug in __ip6_make_skb()
  - net: qrtr: Do not do DEL_SERVER broadcast after DEL_CLIENT
  - sctp: check send stream number after wait_for_sndbuf
  - net: don't let netpoll invoke NAPI if in xmit context
  - icmp: guard against too small mtu
  - net: qrtr: Fix a refcount bug in qrtr_recvmsg()
  - net: qrtr: combine nameservice into main module
  - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
  - KVM: s390: pv: fix external interruption loop not always detected
  - pwm: sprd: Explicitly set .polarity in .get_state()
  - pwm: cros-ec: Explicitly set .polarity in .get_state()
  - Drivers: vmbus: Check for channel allocation before looking up relids
  - gpio: GPIO_REGMAP: select REGMAP instead of depending on it
  - !2703 [sync] PR-2672:  fix CVE-2023-46813
  - !2711 [sync] PR-2465: Backport 5.10.177 LTS patches from upstream
  - io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
  - hsr: ratelimit only when errors are printed
  - gfs2: Always check inode size of inline inodes
  - libbpf: Fix btf_dump's packed struct determination
  - selftests/bpf: Add few corner cases to test padding handling of btf_dump
  - libbpf: Fix BTF-to-C converter's padding logic
  - selftests/bpf: Test btf dump for struct with padding only fields
  - zonefs: Fix error message in zonefs_file_dio_append()
  - btrfs: scan device in non-exclusive mode
  - s390/uaccess: add missing earlyclobber annotations to __clear_user()
  - drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub
  - drm/etnaviv: fix reference leak when mmaping imported buffer
  - rcu: Fix rcu_torture_read ftrace event
  - xtensa: fix KASAN report for show_stack
  - ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z
  - ALSA: usb-audio: Fix regression on detection of Roland VS-100
  - ALSA: hda/conexant: Partial revert of a quirk for Lenovo
  - NFSv4: Fix hangs when recovering open state after a server reboot
  - powerpc: Don't try to copy PPR for task with NULL pt_regs
  - pinctrl: at91-pio4: fix domain name assignment
  - pinctrl: amd: Disable and mask interrupts on resume
  - net: phy: dp83869: fix default value for tx-/rx-internal-delay
  - xen/netback: don't do grant copy across page boundary
  - Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table
  - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
  - cifs: prevent infinite recursion in CIFSGetDFSRefer()
  - Input: focaltech - use explicitly signed char type
  - Input: alps - fix compatibility with -funsigned-char
  - pinctrl: ocelot: Fix alt mode for ocelot
  - net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only
  - bnxt_en: Add missing 200G link speed reporting
  - bnxt_en: Fix typo in PCI id to device description string mapping
  - i40e: fix registers dump after run ethtool adapter self test
  - net: ipa: compute DMA pool size properly
  - ALSA: ymfpci: Fix BUG_ON in probe function
  - ALSA: ymfpci: Fix assignment in if condition
  - s390/vfio-ap: fix memory leak in vfio_ap device driver
  - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
  - net: stmmac: don't reject VLANs when IFF_PROMISC is set
  - net/net_failover: fix txq exceeding warning
  - regulator: Handle deferred clk
  - r8169: fix RTL8168H and RTL8107E rx crc error
  - ptp_qoriq: fix memory leak in probe()
  - scsi: megaraid_sas: Fix crash after a double completion
  - sfc: ef10: don't overwrite offload features at NIC reset
  - mtd: rawnand: meson: invalidate cache on polling ECC bit
  - mips: bmips: BCM6358: disable RAC flush for TP1
  - ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx()
  - tracing: Fix wrong return in kprobe_event_gen_test.c
  - tools/power turbostat: Fix /dev/cpu_dma_latency warnings
  - fbdev: au1200fb: Fix potential divide by zero
  - fbdev: lxfb: Fix potential divide by zero
  - fbdev: intelfb: Fix potential divide by zero
  - fbdev: nvidia: Fix potential divide by zero
  - sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
  - fbdev: tgafb: Fix potential divide by zero
  - ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
  - ALSA: asihpi: check pao in control_message()
  - net: hsr: Don't log netdev_err message on unknown prp dst node
  - md: avoid signed overflow in slot_store()
  - fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY
  - dm crypt: avoid accessing uninitialized tasklet
  - bus: imx-weim: fix branch condition evaluates to a garbage value
  - drm/meson: fix missing component unbind on bind errors
  - drm/meson: Fix error handling when afbcd.ops->init fails
  - kcsan: avoid passing -g for test
  - kernel: kcsan: kcsan_test: build without structleak plugin
  - usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC
  - usb: dwc3: gadget: move cmd_endtransfer to extra function
  - NFSD: fix use-after-free in __nfs42_ssc_open()
  - KVM: fix memoryleak in kvm_init()
  - ocfs2: fix data corruption after failed write
  - sched/fair: Sanitize vruntime of entity being migrated
  - sched/fair: sanitize vruntime of entity being placed
  - firmware: arm_scmi: Fix device node validation for mailbox transport
  - tee: amdtee: fix race condition in amdtee_open_session
  - drm/i915: Preserve crtc_state->inherited during state clearing
  - drm/i915/active: Fix missing debug object activation
  - nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
  - wifi: mac80211: fix qos on mesh interfaces
  - usb: ucsi: Fix NULL pointer deref in ucsi_connector_change()
  - usb: chipidea: core: fix possible concurrent when switch role
  - usb: chipdea: core: fix return -EINVAL if request role is the same with current role
  - usb: cdns3: Fix issue with using incorrect PCI device function
  - igb: revert rtnl_lock() that causes deadlock
  - fsverity: Remove WQ_UNBOUND from fsverity read workqueue
  - usb: gadget: u_audio: don't let userspace block driver unbind
  - usb: dwc2: fix a devres leak in hw_enable upon suspend resume
  - scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
  - cifs: empty interface list when server doesn't support query interfaces
  - sh: sanitize the flags on sigreturn
  - net: usb: qmi_wwan: add Telit 0x1080 composition
  - net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990
  - scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file
  - scsi: lpfc: Avoid usage of list iterator variable after loop
  - scsi: ufs: core: Add soft dependency on governor_simpleondemand
  - scsi: hisi_sas: Check devm_add_action() return value
  - scsi: target: iscsi: Fix an error message in iscsi_check_key()
  - selftests/bpf: check that modifier resolves after pointer
  - m68k: Only force 030 bus error if PC not in exception table
  - ca8210: fix mac_len negative array access
  - HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded
  - riscv: Bump COMMAND_LINE_SIZE value to 1024
  - thunderbolt: Use const qualifier for `ring_interrupt_index`
  - thunderbolt: Use scale field when allocating USB3 bandwidth
  - uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2
  - scsi: qla2xxx: Perform lockless command completion in abort path
  - hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs
  - hwmon: fix potential sensor registration fail if of_node is missing
  - platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work
  - Bluetooth: L2CAP: Fix responding with wrong PDU type
  - Bluetooth: L2CAP: Fix not checking for maximum number of DCID
  - Bluetooth: btqcomsmd: Fix command timeout after setting BD address
  - net: mdio: thunder: Add missing fwnode_handle_put()
  - gve: Cache link_speed value from device
  - nvme-tcp: fix nvme_tcp_term_pdu to match spec
  - net/sonic: use dma_mapping_error() for error check
  - erspan: do not use skb_mac_header() in ndo_start_xmit()
  - atm: idt77252: fix kmemleak when rmmod idt77252
  - net/mlx5: E-Switch, Fix an Oops in error handling code
  - net/mlx5: Read the TC mapping of all priorities on ETS query
  - net/mlx5: Fix steering rules cleanup
  - bpf: Adjust insufficient default bpf_jit_limit
  - keys: Do not cache key in task struct if key is requested from kernel thread
  - bootconfig: Fix testcase to increase max node
  - net/ps3_gelic_net: Use dma_mapping_error
  - net/ps3_gelic_net: Fix RX sk_buff length
  - net: phy: Ensure state transitions are processed from phy_stop()
  - qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
  - net: usb: smsc95xx: Limit packet length to skb->len
  - i2c: imx-lpi2c: check only for enabled interrupt flags
  - igc: fix the validation logic for taprio's gate list
  - igbvf: Regard vf reset nack as success
  - intel/igbvf: free irq on the error path in igbvf_request_msix()
  - iavf: fix non-tunneled IPv6 UDP packet type and hashing
  - iavf: fix inverted Rx hash condition leading to disabled hash
  - xsk: Add missing overflow check in xdp_umem_reg
  - ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl
  - ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl
  - power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync
  - drm/sun4i: fix missing component unbind on bind errors
  - serial: 8250: ASPEED_VUART: select REGMAP instead of depending on it
  - serial: 8250: SERIAL_8250_ASPEED_VUART should depend on ARCH_ASPEED
  - tty: serial: fsl_lpuart: fix race on RX DMA shutdown
  - serial: fsl_lpuart: Fix comment typo
  - KVM: Register /dev/kvm as the _very_ last thing during initialization
  - KVM: Pre-allocate cpumasks for kvm_make_all_cpus_request_except()
  - KVM: Optimize kvm_make_vcpus_request_mask() a bit
  - KVM: KVM: Use cpumask_available() to check for NULL cpumask when kicking vCPUs
  - KVM: Clean up benign vcpu->cpu data races when kicking vCPUs
  - ipmi:ssif: Add a timer between request retries
  - ipmi:ssif: resend_msg() cannot fail
  - ipmi:ssif: Increase the message retry time
  - ipmi:ssif: make ssif_i2c_send() void
  - interconnect: qcom: osm-l3: fix icc_onecell_data allocation
  - !2700 [22.03-LTS-SP2]Backport 5.10.176 LTS patches from upstream.
  - !2646 [sync] PR-2543:  psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n
  - x86/sev: Check for user-space IOIO pointing to kernel space
  - x86/sev: Check IOBM for IOIO exceptions from user-space
  - x86/sev: Disable MMIO emulation from user mode
  - HID: uhid: Over-ride the default maximum data buffer value with our own
  - HID: core: Provide new max_buffer_size attribute to over-ride the default
  - fs: use consistent setgid checks in is_sxid()
  - attr: add in_group_or_capable()
  - fs: move S_ISGID stripping into the vfs_*() helpers
  - fs: add mode_strip_sgid() helper
  - PCI/DPC: Await readiness of secondary bus after reset
  - PCI: Unify delay handling for reset and resume
  - s390/ipl: add missing intersection check to ipl_report handling
  - drm/i915/active: Fix misuse of non-idle barriers as fence trackers
  - drm/i915: Don't use stolen memory for ring buffers with LLC
  - x86/mm: Fix use of uninitialized buffer in sme_enable()
  - x86/mce: Make sure logged MCEs are processed after sysfs update
  - cpuidle: psci: Iterate backwards over list in psci_pd_remove()
  - fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
  - mmc: sdhci_am654: lower power-on failed message severity
  - mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage
  - mptcp: avoid setting TCP_CLOSE state twice
  - drm/shmem-helper: Remove another errant put in error path
  - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro
  - ALSA: hda: intel-dsp-config: add MTL PCI id
  - cifs: Fix smb2_set_path_size()
  - tracing: Make tracepoint lockdep check actually test something
  - tracing: Check field value in hist_field_name()
  - tracing: Make splice_read available again
  - interconnect: fix mem leak when freeing nodes
  - firmware: xilinx: don't make a sleepable memory allocation from an atomic context
  - serial: 8250_em: Fix UART port type
  - tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
  - ext4: fix possible double unlock when moving a directory
  - drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
  - sh: intc: Avoid spurious sizeof-pointer-div warning
  - drm/amdkfd: Fix an illegal memory access
  - ext4: fix task hung in ext4_xattr_delete_inode
  - ext4: fail ext4_iget if special inode unallocated
  - jffs2: correct logic when creating a hole in jffs2_write_begin
  - mmc: atmel-mci: fix race between stop command and start of next command
  - media: m5mols: fix off-by-one loop termination error
  - hwmon: (adm1266) Set `can_sleep` flag for GPIO chip
  - hwmon: tmp512: drop of_match_ptr for ID table
  - hwmon: (ucd90320) Add minimum delay between bus accesses
  - hwmon: (ina3221) return prober error code
  - hwmon: (adt7475) Fix masking of hysteresis registers
  - hwmon: (adt7475) Display smoothing attributes in correct order
  - ethernet: sun: add check for the mdesc_grab()
  - qed/qed_mng_tlv: correctly zero out ->min instead of ->hour
  - selftests: net: devlink_port_split.py: skip test if no suitable device available
  - net/iucv: Fix size of interrupt data
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
  - ipv4: Fix incorrect table ID in IOCTL path
  - net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290
  - ice: xsk: disable txq irq before flushing hw
  - block: sunvdc: add check for mdesc_grab() returning NULL
  - nvmet: avoid potential UAF in nvmet_req_complete()
  - nvme: fix handling single range discard request
  - block: null_blk: Fix handling of fake timeout request
  - null_blk: Move driver into its own directory
  - drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc
  - net: usb: smsc75xx: Limit packet length to skb->len
  - net/smc: fix deadlock triggered by cancel_delayed_work_syn()
  - net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
  - net: tunnels: annotate lockless accesses to dev->needed_headroom
  - qed/qed_dev: guard against a possible division by zero
  - net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
  - i40e: Fix kernel crash during reboot when adapter is in recovery mode
  - ipvlan: Make skb->skb_iif track skb->dev for l3s mode
  - nfc: pn533: initialize struct pn533_out_arg properly
  - tcp: tcp_make_synack() can be called from process context
  - scsi: core: Fix a procfs host directory removal regression
  - scsi: core: Fix a comment in function scsi_host_dev_release()
  - netfilter: nft_redir: correct value of inet type `.maxattrs`
  - netfilter: nft_redir: correct length for loading protocol registers
  - netfilter: nft_masq: correct length for loading protocol registers
  - netfilter: nft_nat: correct length for loading protocol registers
  - ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
  - scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
  - docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
  - clk: HI655X: select REGMAP instead of depending on it
  - drm/meson: fix 1px pink line on GXM when scaling video overlay
  - cifs: Move the in_send statistic to __smb_send_rqst()
  - drm/panfrost: Don't sync rpm suspension after mmu flushing
  - xfrm: Allow transport-mode states with AF_UNSPEC selector
  - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.33.0.110
changelog:
  - !2858 [sync] PR-2851:  bugfix for CVE-2022-45884
  - media: dvb-core: Fix use-after-free due to race at dvb_register_device()
  - media: dvbdev: fix error logic at dvb_register_device()
  - media: dvbdev: Fix memleak in dvb_register_device
  - !2848 [sync] PR-2840:  drm/qxl: fix UAF on handle creation
  - drm/qxl: fix UAF on handle creation
  - !2832 [22.03-LTS-SP2]Backport 5.10.180 LTS patches from upstream.
  - !2518 [sync] PR-2501:  scsi: mpt3sas: Perform additional retries if doorbell read returns 0
  - ext4: fix data races when using cached status extents
  - drm/amd/display: Fix hang when skipping modeset
  - drm/exynos: move to use request_irq by IRQF_NO_AUTOEN flag
  - printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h
  - KVM: x86: move guest_pv_has out of user_access section
  - KVM: x86: do not report preemption if the steal time cache is stale
  - KVM: x86: revalidate steal time cache if MSR value changes
  - KVM: x86: do not set st->preempted when going back to user space
  - KVM: x86: Remove obsolete disabling of page faults in kvm_arch_vcpu_put()
  - KVM: Fix steal time asm constraints
  - KVM: x86: Fix recording of guest steal time / preempted status
  - KVM: x86: Ensure PV TLB flush tracepoint reflects KVM behavior
  - drbd: correctly submit flush bio on barrier
  - serial: 8250: Fix serial8250_tx_empty() race with DMA Tx
  - ext4: remove a BUG_ON in ext4_mb_release_group_pa()
  - ext4: bail out of ext4_xattr_ibody_get() fails for any reason
  - ext4: add bounds checking in get_max_inline_xattr_value_size()
  - ext4: fix deadlock when converting an inline directory in nojournal mode
  - ext4: improve error recovery code paths in __ext4_remount()
  - KVM: x86: hyper-v: Avoid calling kvm_make_vcpus_request_mask() with vcpu_mask==NULL
  - HID: wacom: insert timestamp to packed Bluetooth (BT) events
  - HID: wacom: Set a default resolution for older tablets
  - drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend
  - drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras
  - drm/amdgpu: fix an amdgpu_irq_put() issue in gmc_v9_0_hw_fini()
  - drm/panel: otm8009a: Set backlight parent to panel device
  - f2fs: fix potential corruption when moving a directory
  - ARM: dts: s5pv210: correct MIPI CSIS clock name
  - ARM: dts: exynos: fix WM8960 clock name in Itop Elite
  - remoteproc: st: Call of_node_put() on iteration error
  - remoteproc: stm32: Call of_node_put() on iteration error
  - sh: nmi_debug: fix return value of __setup handler
  - sh: init: use OF_EARLY_FLATTREE for early init
  - sh: mcount.S: fix build error when PRINTK is not enabled
  - sh: math-emu: fix macro redefined warning
  - inotify: Avoid reporting event with invalid wd
  - platform/x86: touchscreen_dmi: Add info for the Dexp Ursus KX210i
  - platform/x86: touchscreen_dmi: Add upside-down quirk for GDIX1002 ts on the Juno Tablet
  - cifs: fix pcchunk length type in smb2_copychunk_range
  - btrfs: print-tree: parent bytenr must be aligned to sector size
  - btrfs: don't free qgroup space unless specified
  - btrfs: fix btrfs_prev_leaf() to not return the same key twice
  - perf symbols: Fix return incorrect build_id size in elf_read_build_id()
  - crypto: sun8i-ss - Fix a test in sun8i_ss_setup_ivs()
  - perf map: Delete two variable initialisations before null pointer checks in sort__sym_from_cmp()
  - perf pmu: zfree() expects a pointer to a pointer to zero it after freeing its contents
  - perf vendor events power9: Remove UTF-8 characters from JSON files
  - net: enetc: check the index of the SFI rather than the handle
  - virtio_net: suppress cpu stall when free_unused_bufs
  - virtio_net: split free_unused_bufs()
  - net: dsa: mt7530: fix corrupt frames using trgmii on 40 MHz XTAL MT7621
  - ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init`
  - drm/amdgpu: add a missing lock for AMDGPU_SCHED
  - af_packet: Don't send zero-byte data in packet_sendmsg_spkt().
  - ionic: remove noise from ethtool rxnfc error msg
  - octeontx2-vf: Detach LF resources on probe cleanup
  - octeontx2-pf: Disable packet I/O for graceful exit
  - rxrpc: Fix hard call timeout units
  - sfc: Fix module EEPROM reporting for QSFP modules
  - net/sched: act_mirred: Add carrier check
  - watchdog: dw_wdt: Fix the error handling path of dw_wdt_drv_probe()
  - writeback: fix call of incorrect macro
  - net: dsa: mv88e6xxx: add mv88e6321 rsvd2cpu
  - sit: update dev->needed_headroom in ipip6_tunnel_bind_dev()
  - net/sched: cls_api: remove block_cb from driver_list before freeing
  - net/ncsi: clear Tx enable mode when handling a Config required AEN
  - scsi: qedi: Fix use after free bug in qedi_remove()
  - dm verity: fix error handling for check_at_most_once on FEC
  - dm verity: skip redundant verity_handle_err() on I/O errors
  - mailbox: zynqmp: Fix counts of child nodes
  - mailbox: zynq: Switch to flexible array to simplify code
  - crypto: ccp - Clear PSP interrupt status register before calling handler
  - ring-buffer: Ensure proper resetting of atomic variables in ring_buffer_reset_online_cpus
  - tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH
  - tty: clean include/linux/tty.h up
  - tty: move some tty-only functions to drivers/tty/tty.h
  - tty: move some internal tty lock enums and functions out of tty.h
  - tty: audit: move some local functions out of tty.h
  - tty: create internal tty.h file
  - scsi: target: core: Avoid smp_processor_id() in preemptible code
  - arm64: dts: qcom: sdm845: correct dynamic power coefficients
  - sound/oss/dmasound: fix 'dmasound_setup' defined but not used
  - debugobject: Ensure pool refill (again)
  - arm64: Stash shadow stack pointer in the task struct on interrupt
  - arm64: Always load shadow stack pointer directly from the task struct
  - perf intel-pt: Fix CYC timestamps after standalone CBR
  - perf auxtrace: Fix address filter entire kernel size
  - dm flakey: fix a crash with invalid table line
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path
  - dm clone: call kmem_cache_destroy() in dm_clone_init() error path
  - ia64: fix an addr to taddr in huge_pte_offset()
  - s390/dasd: fix hanging blockdevice after request requeue
  - btrfs: scrub: reject unsupported scrub flags
  - scripts/gdb: fix lx-timerlist for Python3
  - afs: Fix updating of i_size with dv jump from server
  - mfd: tqmx86: Correct board names for TQMxE39x
  - mfd: tqmx86: Specify IO port register range more precisely
  - mfd: tqmx86: Add support for TQMx110EB and TQMxE40x
  - mfd: tqmx86: Remove incorrect TQMx90UC board ID
  - mfd: tqmx86: Do not access I2C_DETECT register through io_base
  - thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe
  - dmaengine: at_xdmac: do not enable all cyclic channels
  - dmaengine: dw-edma: Fix to enable to issue dma request on DMA processing
  - dmaengine: dw-edma: Fix to change for continuous transfer
  - phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port
  - pwm: mtk-disp: Disable shadow registers before setting backlight values
  - pwm: mtk-disp: Adjust the clocks to avoid them mismatch
  - pwm: mtk-disp: Don't check the return code of pwmchip_remove()
  - leds: tca6507: Fix error handling of using fwnode_property_read_string
  - dmaengine: mv_xor_v2: Fix an error code.
  - leds: TI_LMU_COMMON: select REGMAP instead of depending on it
  - ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline
  - openrisc: Properly store r31 to pt_regs on unhandled exceptions
  - clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails
  - RDMA/mlx5: Use correct device num_ports when modify DC
  - SUNRPC: remove the maximum number of retries in call_bind_status
  - RDMA/mlx5: Fix flow counter query via DEVX
  - Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe
  - input: raspberrypi-ts: Release firmware handle when not needed
  - firmware: raspberrypi: Introduce devm_rpi_firmware_get()
  - NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease
  - IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests
  - IB/hfi1: Add additional usdma traces
  - IB/hfi1: Add AIP tx traces
  - IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order
  - RDMA/srpt: Add a check for valid 'mad_agent' pointer
  - RDMA/cm: Trace icm_send_rej event before the cm state is reset
  - RDMA/siw: Remove namespace check from siw_netdev_event()
  - clk: add missing of_node_put() in "assigned-clocks" property parsing
  - power: supply: generic-adc-battery: fix unit scaling
  - rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time
  - RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()
  - rtc: omap: include header for omap_rtc_power_off_program prototype
  - workqueue: Fix hung time report of worker pools
  - RDMA/rdmavt: Delete unnecessary NULL check
  - RDMA/siw: Fix potential page_array out of range access
  - clk: at91: clk-sam9x60-pll: fix return value check
  - perf/core: Fix hardlockup failure caused by perf throttle
  - powerpc/rtas: use memmove for potentially overlapping buffer copy
  - macintosh: via-pmu-led: requires ATA to be set
  - powerpc/sysdev/tsi108: fix resource printk format warnings
  - powerpc/wii: fix resource printk format warnings
  - powerpc/mpc512x: fix resource printk format warning
  - macintosh/windfarm_smu_sat: Add missing of_node_put()
  - spmi: Add a check for remove callback when removing a SPMI driver
  - staging: rtl8192e: Fix W_DISABLE# does not work after stop/start
  - serial: 8250: Add missing wakeup event reporting
  - tty: serial: fsl_lpuart: adjust buffer length to the intended size
  - firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
  - usb: mtu3: fix kernel panic at qmu transfer done irq handler
  - usb: chipidea: fix missing goto in `ci_hdrc_probe`
  - usb: gadget: tegra-xudc: Fix crash in vbus_draw
  - sh: sq: Fix incorrect element size for allocating bitmap buffer
  - i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path
  - spi: cadence-quadspi: fix suspend-resume implementations
  - ASoC: fsl_mqs: move of_node_put() to the correct location
  - coresight: etm_pmu: Set the module field
  - scripts/gdb: bail early if there are no generic PD
  - scripts/gdb: bail early if there are no clocks
  - ia64: salinfo: placate defined-but-not-used warning
  - ia64: mm/contig: fix section mismatch warning/error
  - PCI/EDR: Clear Device Status after EDR error recovery
  - of: Fix modalias string generation
  - vmci_host: fix a race condition in vmci_host_poll() causing GPF
  - spi: fsl-spi: Fix CPM/QE mode Litte Endian
  - spi: qup: Don't skip cleanup in remove's error path
  - linux/vt_buffer.h: allow either builtin or modular for macros
  - ASoC: es8316: Handle optional IRQ assignment
  - ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ
  - PCI: imx6: Install the fault handler only on compatible match
  - spi: imx: Don't skip cleanup in remove's error path
  - spi: spi-imx: using pm_runtime_resume_and_get instead of pm_runtime_get_sync
  - iio: light: max44009: add missing OF device matching
  - fpga: bridge: fix kernel-doc parameter description
  - usb: dwc3: gadget: Change condition for processing suspend event
  - usb: host: xhci-rcar: remove leftover quirk handling
  - pstore: Revert pmsg_lock back to a normal mutex
  - ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on it
  - tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.
  - net: amd: Fix link leak when verifying config failed
  - netlink: Use copy_to_user() for optval in netlink_getsockopt().
  - Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work"
  - ipv4: Fix potential uninit variable access bug in __ip_make_skb()
  - net/sched: sch_fq: fix integer overflow of "credit"
  - bpf: Don't EFAULT for getsockopt with optval=NULL
  - ixgbe: Enable setting RSS table to default values
  - ixgbe: Allow flow hash to be set via ethtool
  - wifi: iwlwifi: fw: fix memory leak in debugfs
  - wifi: iwlwifi: mvm: check firmware response size
  - wifi: iwlwifi: make the loop for card preparation effective
  - jdb2: Don't refuse invalidation of already invalidated buffers
  - wifi: iwlwifi: fw: move memset before early return
  - wifi: iwlwifi: yoyo: Fix possible division by zero
  - md/raid10: fix memleak of md thread
  - bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap
  - nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage"
  - nvme: fix async event trace event
  - nvme: handle the persistent internal error AER
  - bpf, sockmap: fix deadlocks in the sockhash and sockmap
  - net: ethernet: stmmac: dwmac-rk: fix optional phy regulator handling
  - f2fs: fix to avoid use-after-free for cached IPU bio
  - xsk: Fix unaligned descriptor validation
  - bpftool: Fix bug for long instructions in program CFG dumps
  - selftests/bpf: Wait for receive in cg_storage_multi test
  - net: qrtr: correct types of trace event parameters
  - wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_reg()
  - wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()
  - crypto: sa2ul - Select CRYPTO_DES
  - crypto: caam - Clear some memory in instantiate_rng
  - f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages()
  - f2fs: apply zone capacity to all zone type
  - f2fs: enforce single zone capacity
  - f2fs: handle dqget error in f2fs_transfer_project_quota()
  - scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS
  - scsi: target: iscsit: Fix TAS handling during conn cleanup
  - scsi: target: Fix multiple LUN_RESET handling
  - scsi: target: Make state_list per CPU
  - scsi: target: Rename cmd.bad_sector to cmd.sense_info
  - scsi: target: Rename struct sense_info to sense_detail
  - net/packet: convert po->auxdata to an atomic flag
  - net/packet: convert po->origdev to an atomic flag
  - net/packet: annotate accesses to po->xmit
  - vlan: partially enable SIOCSHWTSTAMP in container
  - bpf: Remove misleading spec_v1 check on var-offset stack read
  - scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
  - bpf: fix precision propagation verbose logging
  - bpf: take into account liveness when propagating precision
  - wifi: rtw88: mac: Return the original error from rtw_mac_power_switch()
  - wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser()
  - tools: bpftool: Remove invalid ' json escape
  - wifi: ath6kl: reduce WARN to dev_dbg() in callback
  - wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list()
  - wifi: ath9k: hif_usb: fix memory leak of remain_skbs
  - wifi: ath6kl: minor fix for allocation size
  - tick/common: Align tick period with the HZ tick.
  - tick: Get rid of tick_period
  - drm/i915: Make intel_get_crtc_new_encoder() less oopsy
  - debugobject: Prevent init race with static objects
  - arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step
  - x86/ioapic: Don't return 0 from arch_dynirq_lower_bound()
  - regulator: stm32-pwr: fix of_iomap leak
  - media: venus: dec: Fix handling of the start cmd
  - media: venus: vdec: Handle DRC after drain
  - media: venus: preserve DRC state across seeks
  - media: venus: vdec: Make decoder return LAST flag for sufficient event
  - media: venus: vdec: Fix non reliable setting of LAST flag
  - media: rc: gpio-ir-recv: Fix support for wake-up
  - media: rcar_fdp1: Fix refcount leak in probe and remove function
  - media: rcar_fdp1: Fix the correct variable assignments
  - media: rcar_fdp1: Make use of the helper function devm_platform_ioremap_resource()
  - media: rcar_fdp1: fix pm_runtime_get_sync() usage count
  - media: rcar_fdp1: simplify error check logic at fdp_open()
  - x86/apic: Fix atomic update of offset in reserve_eilvt_offset()
  - regulator: core: Avoid lockdep reports when resolving supplies
  - regulator: core: Consistently set mutex_owner when using ww_mutex_lock_slow()
  - drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe()
  - ARM: dts: gta04: fix excess dma channel usage
  - mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data
  - ACPI: processor: Fix evaluating _PDC method when running as Xen dom0
  - drm: msm: adreno: Disable preemption on Adreno 510
  - drm/msm/adreno: drop bogus pm_runtime_set_active()
  - drm/msm/adreno: Defer enabling runpm until hw_init()
  - media: max9286: Free control handler
  - drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and adv7535
  - firmware: qcom_scm: Clear download bit during reboot
  - media: bdisp: Add missing check for create_workqueue
  - ARM: dts: qcom: ipq8064: Fix the PCI I/O port range
  - ARM: dts: qcom: ipq8064: reduce pci IO size to 64K
  - ARM: dts: qcom: ipq4019: Fix the PCI I/O port range
  - arm64: dts: qcom: msm8996: Fix the PCI I/O port range
  - arm64: dts: qcom: ipq8074: Fix the PCI I/O port range
  - arm64: dts: qcom: msm8998: Fix the PCI I/O port range
  - arm64: dts: qcom: sdm845: Fix the PCI I/O port range
  - arm64: dts: qcom: sdm845: correct dynamic power coefficients
  - arm64: dts: qcom: msm8998: Fix stm-stimulus-base reg name
  - EDAC/skx: Fix overflows on the DRAM row address mapping arrays
  - drm/msm/disp/dpu: check for crtc enable rather than crtc active to release shared resources
  - arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table
  - arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table
  - soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe
  - soc: ti: pm33xx: Enable basic PM runtime support for genpd
  - drm/probe-helper: Cancel previous job before starting new one
  - drm/vgem: add missing mutex_destroy
  - drm/rockchip: Drop unbalanced obj unref
  - erofs: fix potential overflow calculating xattr_isize
  - erofs: stop parsing non-compact HEAD index if clusterofs is invalid
  - tpm, tpm_tis: Claim locality when interrupts are reenabled on resume
  - tpm, tpm: Implement usage counter for locality
  - tpm, tpm_tis: Claim locality before writing interrupt registers
  - tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed
  - tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register
  - tpm, tpm_tis: Do not skip reset of original interrupt vector
  - selinux: ensure av_permissions.h is built when needed
  - selinux: fix Makefile dependencies of flask.h
  - selftests/resctrl: Check for return value after write_schemata()
  - selftests/resctrl: Return NULL if malloc_and_init_memory() did not alloc mem
  - rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check
  - clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent
  - wifi: rtl8xxxu: RTL8192EU always needs full init
  - mailbox: zynqmp: Fix typo in IPI documentation
  - mailbox: zynqmp: Fix IPI isr handling
  - nilfs2: fix infinite loop in nilfs_mdt_get_block()
  - nilfs2: do not write dirty data after degenerating to read-only
  - parisc: Fix argument pointer in real64_call_asm()
  - sound/oss/dmasound: fix build when drivers are mixed =y/=m
  - iommu/amd: Fix "Guest Virtual APIC Table Root Pointer" configuration in IRTE
  - i2c: omap: Fix standard mode false ACK readings
  - KVM: nVMX: Emulate NOPs in L2, and PAUSE if it's not intercepted
  - reiserfs: Add security prefix to xattr name in reiserfs_security_write()
  - crypto: safexcel - Cleanup ring IRQ workqueues on load failure
  - crypto: api - Demote BUG_ON() in crypto_unregister_alg() to a WARN_ON()
  - ring-buffer: Sync IRQ works before buffer destruction
  - pwm: meson: Fix g12a ao clk81 name
  - pwm: meson: Fix axg ao mux parents
  - kheaders: Use array declaration instead of char
  - ipmi: fix SSIF not responding under certain cond.
  - ipmi:ssif: Add send_retries increment
  - MIPS: fw: Allow firmware to pass a empty env
  - tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem
  - xhci: fix debugfs register accesses while suspended
  - staging: iio: resolver: ads1210: fix config mode
  - ext4: use ext4_journal_start/stop for fast commit transactions
  - blk-crypto: make blk_crypto_evict_key() more robust
  - blk-crypto: make blk_crypto_evict_key() return void
  - blk-mq: release crypto keyslot before reporting I/O complete
  - hwmon: (adt7475) Use device_property APIs when configuring polarity
  - hwmon: (k10temp) Check range scale when CUR_TEMP register is read-write
  - USB: dwc3: fix runtime pm imbalance on unbind
  - USB: dwc3: fix runtime pm imbalance on probe errors
  - PCI: qcom: Fix the incorrect register usage in v2.7.0 config
  - PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock
  - wireguard: timers: cast enum limits members to int in prints
  - asm-generic/io.h: suppress endianness warnings for readq() and writeq()
  - ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7 B1-750
  - iio: adc: palmas_gpadc: fix NULL dereference on rmmod
  - driver core: Don't require dynamic_debug for initcall_debug probe timing
  - USB: serial: option: add UNISOC vendor and TOZED LT70C product
  - drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var
  - KVM: arm64: Fix buffer overflow in kvm_arm_set_fw_reg()
  - counter: 104-quad-8: Fix race condition between FLAG and CNTR reads
  - !2802 [sync] PR-2782:  cpufreq: Abort show()/store() for half-initialized policies
  - cpufreq: make interface functions and lock holding state clear
  - cpufreq: Abort show()/store() for half-initialized policies
  - scsi: mpt3sas: Perform additional retries if doorbell read returns 0


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.34.0.111
changelog:
  - !2999 [sync] PR-2902:  net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
  - !1722 [sync] PR-1597: Fix the bugs of 3SNIC driver compilation failure while using clang
  - !2904 [sync] PR-2867:  netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
  - !3012  config: update openeuler_defconfig for x86 with gcc 10.3.1
  - config: update openeuler_defconfig for x86 with gcc 10.3.1
  - net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
  - !2974 Add script to check & update openeuler_defconfig
  - config: update openeuler_defconfig for arm64
  - config: update openeuler_defconfig for x86
  - kconfig: Add script to check & update openeuler_defconfig
  - Revert "kconfig: Add script to update openeuler_defconfig"
  - !2433 [sync] PR-2326: fix CVE-2023-20569
  - !1564 [sync] PR-1527:  arm64/mpam: fix missing kfree domain's ctrl_val arrray
  - !2910 [sync] PR-1613:  arm64/mpam: implement CPU_PM notifier
  - !2044 [sync] PR-1327:  Huawei BMA: To fix the bug in the iBMA driver code
  - !1898 [sync] PR-1853:  ring-buffer: Fix deadloop issue on reading trace_pipe
  - !1943 [sync] PR-1900:  tracing: Fix cpu buffers unavailable due to 'record_disabled' missed
  - !1985 [sync] PR-1905:  tracing: Fix memleak due to race between current_tracer and trace
  - !2654 [sync] PR-2377:  tracing: Backport bugfixes
  - !2931 revert: : ab873cbbab39 x86/microcode: Rip out the OLD_INTERFACE
  - !1741 [sync] PR-1734:  arm64/mpam: mark partid non-exclusive if self-owned
  - !2901  mm/hugetlb: fix parameter passed to allocate bootmem memory
  - !1403 [sync] PR-1399:  bpf: cpumap: Fix memory leak in cpu_map_update_elem
  - Revert "x86/microcode: Rip out the OLD_INTERFACE"
  - !2635 [sync] PR-2615:  preempt/dynamic: Fix setup_preempt_mode() return value
  - !1810 [sync] PR-1768:  bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
  - !2813 [sync] PR-2716:  ext4: recheck buffer valid after page unlock
  - !1410 [sync] PR-1353:  ubifs mainline bugfix patch backport
  - !1373 [sync] PR-1354:  ubi: Fix return value overwrite issue in try_write_vid_and_data()
  - !892 [sync] PR-886:  net: sched: fix NULL pointer dereference in mq_attach
  - !902 [sync] PR-890:  ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
  - !2021 [sync] PR-1965:  crypto:padata: Fix return err for PADATA_RESET
  - arm64/mpam: implement CPU_PM notifier
  - !1514 [sync] PR-1357:  SUNRPC: Ensure that the gssproxy client can start in a connected state
  - netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
  - !2750 [sync] PR-2683:  fix memcgv1 oom meminfo bug
  - mm/hugetlb: fix parameter passed to allocate bootmem memory
  - ext4: recheck buffer valid after page unlock
  - memcg: dump memory.stat during cgroup OOM for v1
  - memcg: use seq_buf_do_printk() with mem_cgroup_print_oom_meminfo()
  - seq_buf: Add seq_buf_do_printk() helper
  - seq_buf: Add seq_buf_terminate() API
  - ring-buffer: Do not attempt to read past "commit"
  - ring-buffer: Do not swap cpu_buffer during resize process
  - preempt/dynamic: Fix setup_preempt_mode() return value
  - kabi: Allow extra bugsints (bsc#1213927).
  - x86/cpufeatures: Fix abi breakage caused by NCAPINTS in cpufeature header file.
  - tools arch x86: Sync the msr-index.h copy with the kernel sources
  - objtool/x86: Fix SRSO mess
  - x86/srso: Correct the mitigation status when SMT is disabled
  - objtool/x86: Fixup frame-pointer vs rethunk
  - x86/srso: Disable the mitigation on unaffected configurations
  - x86/retpoline: Don't clobber RFLAGS during srso_safe_ret()
  - x86/cpu: Cleanup the untrain mess
  - x86/cpu: Rename srso_(.*)_alias to srso_alias_1
  - x86/cpu: Rename original retbleed methods
  - x86/cpu: Clean up SRSO return thunk mess
  - x86/alternative: Make custom return thunk unconditional
  - x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()
  - x86/cpu: Fix __x86_return_thunk symbol type
  - x86/ibt: Add ANNOTATE_NOENDBR
  - objtool: Add frame-pointer-specific function ignore
  - x86/srso: Fix build breakage with the LLVM linker
  - x86/srso: Tie SBPB bit setting to microcode patch detection
  - x86/srso: Fix return thunks in generated code
  - x86/srso: Add IBPB on VMEXIT
  - x86/srso: Add IBPB
  - x86/srso: Add SRSO_NO support
  - x86/srso: Add IBPB_BRTYPE support
  - x86/srso: Add a Speculative RAS Overflow mitigation
  - x86/cpu, kvm: Add support for CPUID_80000021_EAX
  - x86/bugs: Increase the x86 bugs vector size to two u32s
  - tools headers cpufeatures: Sync with the kernel sources
  - Huawei BMA: To fix the bug in the iBMA driver code
  - crypto:padata: Fix return err for PADATA_RESET
  - tracing: Fix memleak due to race between current_tracer and trace
  - tracing: Fix cpu buffers unavailable due to 'record_disabled' missed
  - ring-buffer: Fix deadloop issue on reading trace_pipe
  - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
  - arm64/mpam: mark partid non-exclusive if self-owned
  - Fix the bugs of 3SNIC driver compilation failure while using clang
  - arm64/mpam: fix missing kfree domain's ctrl_val arrray
  - SUNRPC: Ensure that the gssproxy client can start in a connected state
  - ubi: Fix return value overwrite issue in try_write_vid_and_data()
  - ubifs: Fix memory leak in do_rename
  - ubifs: Free memory for tmpfile name
  - bpf: cpumap: Fix memory leak in cpu_map_update_elem
  - ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
  - net: sched: fix NULL pointer dereference in mq_attach


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.35.0.112
changelog:
  - !3195 [sync] PR-3128:  fix ksmbd to release the ones allocated for async work
  - !3003 [sync] PR-1656:  Revert "arm64/mpam: Fix mpam corrupt when cpu online"
  - ksmbd: delete asynchronous work from list
  - ksmbd: fix typo, syncronous->synchronous
  - ksmbd: fix possible memory leak in smb2_lock()
  - ksmbd: replace usage of found with dedicated list iterator variable
  - !3105 [sync] PR-3082:  fs/dirty_pages: add last read check in seq_read_dirty()
  - !3167 [sync] PR-3152:  scsi: scsi_device_gets returns failure
  - scsi: fix kabi broken in struct Scsi_Host
  - scsi: don't fail if hostt->module is NULL
  - scsi: scsi_device_gets returns failure when the module is NULL.
  - !3143 [sync] PR-2970:  Add error handle for add_disk
  - !3146 [22.03-LTS-SP2] 5.10.185 - 5.10.187 LTS补丁回合
  - x86/microcode/AMD: Load late on both threads too
  - bpf/btf: Accept function names that contain dots
  - i2c: imx-lpi2c: fix type char overflow issue when calculating the clock cycle
  - x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys
  - drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl
  - drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl
  - drm/exynos: vidi: fix a wrong error return
  - ARM: dts: Fix erroneous ADS touchscreen polarities
  - s390/purgatory: disable branch profiling
  - ASoC: nau8824: Add quirk to active-high jack-detect
  - ASoC: simple-card: Add missing of_node_put() in case of error
  - spi: lpspi: disable lpspi module irq in DMA mode
  - s390/cio: unregister device when the only path is gone
  - Input: soc_button_array - add invalid acpi_index DMI quirk handling
  - usb: gadget: udc: fix NULL dereference in remove()
  - nfcsim.c: Fix error checking for debugfs_create_dir
  - media: cec: core: don't set last_initiator if tx in progress
  - arm64: Add missing Set/Way CMO encodings
  - HID: wacom: Add error check to wacom_parse_and_register()
  - scsi: target: iscsi: Prevent login threads from racing between each other
  - gpiolib: Fix GPIO chip IRQ initialization restriction
  - gpio: Allow per-parent interrupt data
  - sch_netem: acquire qdisc lock in netem_change()
  - Revert "net: phy: dp83867: perform soft reset and retain established link"
  - netfilter: nfnetlink_osf: fix module autoload
  - netfilter: nf_tables: disallow element updates of bound anonymous sets
  - netfilter: nft_set_pipapo: .walk does not deal with generations
  - be2net: Extend xmit workaround to BE3 chip
  - net: dsa: mt7530: fix trapping frames on non-MT7621 SoC MT7530 switch
  - ipvs: align inner_mac_header for encapsulation
  - mmc: usdhi60rol0: fix deferred probing
  - mmc: sh_mmcif: fix deferred probing
  - mmc: sdhci-acpi: fix deferred probing
  - mmc: owl: fix deferred probing
  - mmc: omap_hsmmc: fix deferred probing
  - mmc: omap: fix deferred probing
  - mmc: mvsdio: fix deferred probing
  - mmc: mtk-sd: fix deferred probing
  - net: qca_spi: Avoid high load if QCA7000 is not available
  - xfrm: Linearize the skb after offloading if needed.
  - selftests: net: fcnal-test: check if FIPS mode is enabled
  - selftests: net: vrf-xfrm-tests: change authentication and encryption algos
  - xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets
  - bpf: Fix verifier id tracking of scalars on spill
  - bpf: track immediate values written to stack by BPF_ST instruction
  - xfrm: Ensure policies always checked on XFRM-I input path
  - xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c
  - ieee802154: hwsim: Fix possible memory leaks
  - memfd: check for non-NULL file_seals in memfd_create() syscall
  - x86/mm: Avoid using set_pgd() outside of real PGD pages
  - nilfs2: prevent general protection fault in nilfs_clear_dirty_page()
  - io_uring/net: disable partial retries for recvmsg with cmsg
  - io_uring/net: clear msg_controllen on partial sendmsg retry
  - io_uring/net: save msghdr->msg_control for retries
  - writeback: fix dereferencing NULL mapping->host on writeback_page_template
  - regmap: spi-avmm: Fix regmap_bus max_raw_write
  - regulator: pca9450: Fix LDO3OUT and LDO4OUT MASK
  - ip_tunnels: allow VXLAN/GENEVE to inherit TOS/TTL from VLAN
  - mmc: mmci: stm32: fix max busy timeout calculation
  - mmc: meson-gx: remove redundant mmc_request_done() call from irq context
  - mmc: sdhci-msm: Disable broken 64-bit DMA on MSM8916
  - PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic
  - PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev
  - Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally"
  - PCI: hv: Fix a race condition bug in hv_pci_query_relations()
  - Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs
  - nilfs2: fix buffer corruption due to concurrent device reads
  - selftests: mptcp: join: skip check if MIB counter not supported
  - selftests: mptcp: pm nl: remove hardcoded default limits
  - selftests: mptcp: lib: skip if not below kernel version
  - selftests: mptcp: lib: skip if missing symbol
  - tick/common: Align tick period during sched_timer setup
  - tracing: Add tracing_reset_all_online_cpus_unlocked() function
  - net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs
  - drm/amd/display: fix the system hang while disable PSR
  - um: Fix build w/o CONFIG_PM_SLEEP
  - drm/i915/gen11+: Only load DRAM information from pcode
  - drm/i915/dg1: Wait for pcode/uncore handshake at startup
  - nilfs2: reject devices with insufficient block count
  - mmc: block: ensure error propagation for non-blk
  - batman-adv: Switch to kstrtox.h for kstrtou64
  - neighbour: delete neigh_lookup_nodev as not used
  - net: Remove unused inline function dst_hold_and_use()
  - neighbour: Remove unused inline function neigh_key_eq16()
  - rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period
  - afs: Fix vlserver probe RTT handling
  - selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET
  - net: tipc: resize nlattr array to correct size
  - net: lapbether: only support ethernet devices
  - net/sched: cls_api: Fix lockup on flushing explicitly created chain
  - ext4: drop the call to ext4_error() from ext4_get_group_info()
  - drm/nouveau: add nv_encoder pointer check for NULL
  - drm/nouveau/dp: check for NULL nv_connector->native_mode
  - drm/nouveau: don't detect DSM for non-NVIDIA device
  - igb: fix nvm.ops.read() error handling
  - sctp: fix an error code in sctp_sf_eat_auth()
  - ipvlan: fix bound dev checking for IPv6 l3s mode
  - IB/isert: Fix incorrect release of isert connection
  - IB/isert: Fix possible list corruption in CMA handler
  - IB/isert: Fix dead lock in ib_isert
  - IB/uverbs: Fix to consider event queue closing also upon non-blocking mode
  - RDMA/cma: Always set static rate to 0 for RoCE
  - RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions
  - octeontx2-af: fixed resource availability check
  - iavf: remove mask from iavf_irq_enable_queues()
  - RDMA/rxe: Fix the use-before-initialization error of resp_pkts
  - RDMA/rxe: Removed unused name from rxe_task struct
  - RDMA/rxe: Remove the unused variable obj
  - ping6: Fix send to link-local addresses with VRF.
  - net: enetc: correct the indexes of highest and 2nd highest TCs
  - netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
  - spi: fsl-dspi: avoid SCK glitches with continuous transfers
  - RDMA/rtrs: Fix the last iu->buf leak in err path
  - usb: dwc3: gadget: Reset num TRBs before giving back the request
  - serial: lantiq: add missing interrupt ack
  - USB: serial: option: add Quectel EM061KGL series
  - ALSA: hda/realtek: Add a quirk for Compaq N14JP6
  - net: usb: qmi_wwan: add support for Compal RXM-G1
  - RDMA/uverbs: Restrict usage of privileged QKEYs
  - nouveau: fix client work fence deletion race
  - powerpc/purgatory: remove PGO flags
  - x86/purgatory: remove PGO flags
  - kexec: support purgatories with .text.hot sections
  - nilfs2: fix possible out-of-bounds segment allocation in resize ioctl
  - nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key()
  - nios2: dts: Fix tse_mac "max-frame-size" property
  - ocfs2: check new file size on fallocate call
  - ocfs2: fix use-after-free when unmounting read-only filesystem
  - epoll: ep_autoremove_wake_function should use list_del_init_careful
  - irqchip/gic: Correctly validate OF quirk descriptors
  - drm:amd:amdgpu: Fix missing buffer object unlock in failure path
  - xen/blkfront: Only check REQ_FUA for writes
  - ASoC: dwc: move DMA init to snd_soc_dai_driver probe()
  - mips: Move initrd_start check after initrd address sanitisation.
  - MIPS: Alchemy: fix dbdma2
  - parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory()
  - parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu()
  - ASoC: soc-pcm: test if a BE can be prepared
  - btrfs: handle memory allocation failure in btrfs_csum_one_bio
  - btrfs: scrub: try harder to mark RAID56 block groups read-only
  - power: supply: Fix logic checking if system is running from battery
  - irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues
  - regulator: Fix error checking for debugfs_create_dir
  - platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0
  - power: supply: Ratelimit no data debug output
  - tools: gpio: fix debounce_period_us output of lsgpio
  - ARM: dts: vexpress: add missing cache properties
  - power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule()
  - power: supply: sc27xx: Fix external_power_changed race
  - power: supply: ab8500: Fix external_power_changed race
  - test_firmware: fix a memory leak with reqs buffer
  - test_firmware: prevent race conditions by a correct implementation of locking
  - test_firmware: Use kstrtobool() instead of strtobool()
  - kernel.h: split out kstrtox() and simple_strtox() to a separate header
  - lib: cleanup kstrto*() usage
  - block: Set memalloc_noio to false in the error path
  - block: Fix minor range check in device_add_disk()
  - block: clear ->slave_dir when dropping the main slave_dir reference
  - block: call blk_get_queue earlier in __device_add_disk
  - block: check minor range in device_add_disk()
  - block: fix memory leak for elevator on add_disk failure
  - block: Fix the kabi change on blk_register_region
  - block: Fix the kabi change in device_add_disk
  - block: fix error unwinding in device_add_disk
  - block: fix device_add_disk() kobject_create_and_add() error handling
  - block: add error handling for device_add_disk / add_disk
  - block: return errors from blk_register_region
  - block: add the events* attributes to disk_attrs
  - block: return errors from disk_alloc_events
  - block: return errors from blk_integrity_add
  - block: call blk_integrity_add earlier in device_add_disk
  - block: fold register_disk into device_add_disk
  - !1812 [sync] PR-1724: Net: ethernet: Support management channel of the host tool in 3snic 3s9xx network driver
  - !3086 [sync] PR-2938: Backport 5.10.183 - 5.10.184 LTS patches from upstream
  - fs/dirty_pages: add last read check in seq_read_dirty()
  - !3077 [sync] PR-3020:  fs/dirty_pages: fix inode reference count leakage error in dump_dirtypages_sb()
  - !3080 [sync] PR-3022:  fs/dirty_pages: fix some errors in seq_read_dirty()
  - Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE"
  - btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
  - btrfs: check return value of btrfs_commit_transaction in relocation
  - drm/atomic: Don't pollute crtc_state->mode_blob with error pointers
  - MIPS: locking/atomic: Fix atomic{_64,}_sub_if_positive
  - tcp: fix tcp_min_tso_segs sysctl
  - ext4: only check dquot_initialize_needed() when debugging
  - Revert "ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled"
  - vhost: support PACKED when setting-getting vring_base
  - riscv: fix kprobe __user string arg print fault issue
  - eeprom: at24: also select REGMAP
  - i2c: sprd: Delete i2c adapter in .remove's error path
  - ASoC: codecs: wsa881x: do not set can_multi_write flag
  - staging: vc04_services: fix gcc-13 build warning
  - usb: usbfs: Use consistent mmap functions
  - usb: usbfs: Enforce page requirements for mmap
  - pinctrl: meson-axg: add missing GPIOA_18 gpio group
  - rbd: get snapshot context after exclusive lock is ensured to be held
  - rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting
  - tee: amdtee: Add return_origin to 'struct tee_cmd_load_ta'
  - Bluetooth: hci_qca: fix debugfs registration
  - Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk
  - s390/dasd: Use correct lock while counting channel queue length
  - ceph: fix use-after-free bug for inodes when flushing capsnaps
  - can: j1939: avoid possible use-after-free when j1939_can_rx_register fails
  - can: j1939: change j1939_netdev_lock type to mutex
  - can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in J1939 Socket
  - drm/amdgpu: fix xclk freq on CHIP_STONEY
  - ALSA: hda/realtek: Add Lenovo P3 Tower platform
  - ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01
  - Input: psmouse - fix OOB access in Elantech protocol
  - Input: xpad - delete a Razer DeathAdder mouse VID/PID entry
  - batman-adv: Broken sync while rescheduling delayed work
  - bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks
  - bnxt_en: Query default VLAN before VNIC setup on a VF
  - bnxt_en: Don't issue AP reset during ethtool's reset operation
  - lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()
  - bpf: Add extra path pointer check to d_path helper
  - net: sched: fix possible refcount leak in tc_chain_tmplt_add()
  - net: sched: move rtm_tca_policy declaration to include file
  - rfs: annotate lockless accesses to RFS sock flow table
  - rfs: annotate lockless accesses to sk->sk_rxhash
  - ipv6: rpl: Fix Route of Death.
  - netfilter: ipset: Add schedule point in call_ad().
  - netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper
  - qed/qede: Fix scheduling while atomic
  - Bluetooth: L2CAP: Add missing checks for invalid DCID
  - Bluetooth: Fix l2cap_disconnect_req deadlock
  - net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values
  - net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT
  - net: dsa: lan9303: allow vid != 0 in port_fdb_{add|del} methods
  - wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll
  - afs: Fix setting of mtime when creating a file/dir/symlink
  - spi: qup: Request DMA before enabling clocks
  - staging: vchiq_core: drop vchiq_status from vchiq_initialise
  - i40e: fix build warning in ice_fltr_add_mac_to_list()
  - i40e: fix build warnings in i40e_alloc.h
  - i40iw: fix build warning in i40iw_manage_apbvt()
  - block/blk-iocost (gcc13): keep large values in a new enum
  - blk-iocost: avoid 64-bit division in ioc_timer_fn
  - f2fs: fix iostat lock protection
  - bonding (gcc13): synchronize bond_{a,t}lb_xmit() types
  - remove the sx8 block driver
  - sfc (gcc13): synchronize ef100_enqueue_skb()'s return type
  - gcc-plugins: Reorganize gimple includes for GCC 13
  - ata: ahci: fix enum constants for gcc-13
  - ext4: enable the lazy init thread when remounting read/write
  - selftests: mptcp: join: skip if MPTCP is not supported
  - selftests: mptcp: simult flows: skip if MPTCP is not supported
  - selftests: mptcp: diag: skip if MPTCP is not supported
  - crypto: ccp: Play nice with vmalloc'd memory for SEV command structs
  - crypto: ccp: Reject SEV commands with mismatching command buffer
  - media: ti-vpe: cal: avoid FIELD_GET assertion
  - tpm, tpm_tis: Request threaded interrupt handler
  - regmap: Account for register length when chunking
  - KEYS: asymmetric: Copy sig and digest in public_key_verify_signature()
  - KVM: x86: Account fastpath-only VM-Exits in vCPU stats
  - test_firmware: fix the memory leak of the allocated firmware buffer
  - serial: 8250_tegra: Fix an error handling path in tegra_uart_probe()
  - fbcon: Fix null-ptr-deref in soft_cursor
  - ext4: add lockdep annotations for i_data_sem for ea_inode's
  - ext4: disallow ea_inodes with extended attributes
  - ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find()
  - ext4: add EA_INODE checking to ext4_iget()
  - selftests: mptcp: pm nl: skip if MPTCP is not supported
  - selftests: mptcp: connect: skip if MPTCP is not supported
  - tracing/probe: trace_probe_primary_from_call(): checked list_first_entry
  - selinux: don't use make's grouped targets feature yet
  - btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds
  - tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK
  - mmc: vub300: fix invalid response handling
  - eth: sun: cassini: remove dead code
  - gcc-12: disable '-Wdangling-pointer' warning for now
  - ath6kl: Use struct_group() to avoid size-mismatched casting
  - ACPI: thermal: drop an always true check
  - x86/boot: Wrap literal addresses in absolute_pointer()
  - ata: libata-scsi: Use correct device no in ata_find_dev()
  - scsi: stex: Fix gcc 13 warnings
  - misc: fastrpc: reject new invocations during device removal
  - misc: fastrpc: return -EPIPE to invocations on device removal
  - usb: gadget: f_fs: Add unbind event before functionfs_unbind
  - net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818
  - iio: dac: build ad5758 driver when AD5758 is selected
  - iio: adc: ad7192: Change "shorted" channels to differential
  - iio: dac: mcp4725: Fix i2c_master_send() return value handling
  - iio: light: vcnl4035: fixed chip ID check
  - iio: imu: inv_icm42600: fix timestamp reset
  - HID: wacom: avoid integer overflow in wacom_intuos_inout()
  - HID: google: add jewel USB id
  - iio: adc: mxs-lradc: fix the order of two cleanup operations
  - mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
  - atm: hide unused procfs functions
  - drm/msm: Be more shouty if per-process pgtables aren't working
  - ALSA: oss: avoid missing-prototype warnings
  - netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
  - wifi: b43: fix incorrect __packed annotation
  - scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed
  - arm64/mm: mark private VM_FAULT_X defines as vm_fault_t
  - ARM: dts: stm32: add pin map for CAN controller on stm32f7
  - wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value
  - s390/pkey: zeroize key blobs
  - media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table
  - media: dvb_ca_en50221: fix a size write bug
  - media: netup_unidvb: fix irq init by register it at the end of probe
  - media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address
  - media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
  - media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer
  - media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()
  - media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()
  - media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
  - media: dvb_demux: fix a bug for the continuity counter
  - ASoC: ssm2602: Add workaround for playback distortions
  - ASoC: dt-bindings: Adjust #sound-dai-cells on TI's single-DAI codecs
  - xfrm: Check if_id in inbound policy/secpath match
  - ASoC: dwc: limit the number of overrun messages
  - block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE
  - fbdev: stifb: Fix info entry in sti_struct on error path
  - fbdev: modedb: Add 1920x1080 at 60 Hz video mode
  - media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE
  - ARM: 9295/1: unwind:fix unwind abort for uleb128 case
  - btrfs: abort transaction when sibling keys check fails for leaves
  - mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
  - watchdog: menz069_wdt: fix watchdog initialisation
  - mtd: rawnand: marvell: don't set the NAND frequency select
  - mtd: rawnand: marvell: ensure timing values are written
  - net: dsa: mv88e6xxx: Increase wait after reset deactivation
  - net/mlx5: Read embedded cpu after init bit cleared
  - udp6: Fix race condition in udp6_sendmsg & connect
  - net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report
  - net/sched: Prohibit regrafting ingress or clsact Qdiscs
  - net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs
  - net/sched: sch_clsact: Only create under TC_H_CLSACT
  - net/sched: sch_ingress: Only create under TC_H_INGRESS
  - tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set
  - af_packet: do not use READ_ONCE() in packet_bind()
  - mtd: rawnand: ingenic: fix empty stub helper definitions
  - amd-xgbe: fix the false linkup in xgbe_phy_status
  - af_packet: Fix data-races of pkt_sk(sk)->num.
  - netrom: fix info-leak in nr_write_internal()
  - net/mlx5: fw_tracer, Fix event handling
  - dmaengine: pl330: rename _start to prevent build error
  - iommu/amd: Don't block updates to GATag if guest mode is on
  - iommu/rockchip: Fix unwind goto issue
  - RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx
  - RDMA/bnxt_re: Fix a possible memory leak
  - dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved()
  - dmaengine: at_xdmac: Move the free desc to the tail of the desc list
  - dmaengine: at_xdmac: Fix race for the tx desc callback
  - dmaengine: at_xdmac: Fix concurrency over chan's completed_cookie
  - RDMA/efa: Fix unsupported page sizes in device
  - RDMA/bnxt_re: Fix the page_size used during the MR creation
  - RDMA/bnxt_re: Code refactor while populating user MRs
  - !2935 [sync] PR-2865: Backport 5.10.181 - 5.10.182 LTS patches from upstream
  - fs/dirty_pages: fix some errors in seq_read_dirty()
  - fs/dirty_pages: fix inode reference count leakage error in dump_dirtypages_sb()
  - Revert "arm64/mpam: Fix mpam corrupt when cpu online"
  - netfilter: ctnetlink: Support offloaded conntrack entry deletion
  - ipv{4,6}/raw: fix output xfrm lookup wrt protocol
  - bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
  - net: phy: mscc: enable VSC8501/2 RGMII RX clock
  - net/mlx5: Devcom, serialize devcom registration
  - net/mlx5: devcom only supports 2 ports
  - power: supply: bq24190: Call power_supply_changed() after updating input current
  - power: supply: core: Refactor power_supply_set_input_current_limit_from_supplier()
  - power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize
  - power: supply: bq27xxx: Ensure power_supply_changed() is called on current sign changes
  - power: supply: bq27xxx: Move bq27xxx_battery_update() down
  - power: supply: bq27xxx: expose battery data when CI=1
  - power: supply: bq27xxx: Add cache parameter to bq27xxx_battery_current_and_status()
  - power: supply: bq27xxx: make status more robust
  - power: supply: bq27xxx: fix sign of current_now for newer ICs
  - power: supply: bq27xxx: fix polarity of current_now
  - net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE
  - 3c589_cs: Fix an error handling path in tc589_probe()
  - arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay
  - net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
  - net/mlx5: Fix error message when failing to allocate device memory
  - net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs
  - net/mlx5e: do as little as possible in napi poll when budget is 0
  - forcedeth: Fix an error handling path in nv_probe()
  - ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg
  - x86/show_trace_log_lvl: Ensure stack pointer is aligned, again
  - xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()
  - coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet()
  - fs: fix undefined behavior in bit shift for SB_NOUSER
  - power: supply: sbs-charger: Fix INHIBITED bit for Status reg
  - power: supply: bq27xxx: Fix poll_interval handling and races on remove
  - power: supply: bq27xxx: Fix I2C IRQ race on remove
  - power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition
  - power: supply: leds: Fix blink to LED on transition
  - ipv6: Fix out-of-bounds access in ipv6_find_tlv()
  - bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields
  - octeontx2-pf: Fix TSOv6 offload
  - selftests: fib_tests: mute cleanup error message
  - net: fix skb leak in __skb_tstamp_tx()
  - media: radio-shark: Add endpoint checks
  - USB: sisusbvga: Add endpoint checks
  - USB: core: Add routines for endpoint checks in old drivers
  - udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().
  - net: fix stack overflow when LRO is disabled for virtual interfaces
  - fbdev: udlfb: Fix endpoint check
  - debugobjects: Don't wake up kswapd from fill_pool()
  - x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms
  - parisc: Fix flush_dcache_page() for usage from irq context
  - selftests/memfd: Fix unknown type name build failure
  - dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type
  - btrfs: use nofs when cleaning up aborted transactions
  - gpio: mockup: Fix mode of debugfs files
  - parisc: Allow to reboot machine after system halt
  - parisc: Handle kgdb breakpoints only in kernel context
  - m68k: Move signal frame following exception on 68020/030
  - net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
  - ALSA: hda/realtek: Enable headset onLenovo M70/M90
  - ALSA: hda: Fix unhandled register update during auto-suspend period
  - ALSA: hda/ca0132: add quirk for EVGA X299 DARK
  - ocfs2: Switch to security_inode_init_security()
  - spi: fsl-cpm: Use 16 bit mode for large transfers with even size
  - spi: fsl-spi: Re-organise transfer bits_per_word adaptation
  - ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
  - watchdog: sp5100_tco: Immediately trigger upon starting.
  - s390/qdio: fix do_sqbs() inline assembly constraint
  - s390/qdio: get rid of register asm
  - serial: 8250_exar: Add support for USR298x PCI Modems
  - serial: exar: Add support for Sealevel 7xxxC serial cards
  - serial: 8250_exar: derive nr_ports from PCI ID for Acces I/O cards
  - HID: wacom: add three styli to wacom_intuos_get_tool_type
  - HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs
  - HID: wacom: Force pen out of prox if no events have been received in a while
  - nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
  - powerpc/64s/radix: Fix soft dirty tracking
  - tpm/tpm_tis: Disable interrupts for more Lenovo devices
  - ceph: force updating the msg pointer in non-split case
  - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
  - serial: Add support for Advantech PCI-1611U card
  - statfs: enforce statfs[64] structure initialization
  - can: kvaser_pciefd: Disable interrupts in probe error path
  - can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt
  - can: kvaser_pciefd: Clear listen-only bit if not explicitly requested
  - can: kvaser_pciefd: Empty SRB buffer in probe
  - can: kvaser_pciefd: Call request_irq() before enabling interrupts
  - can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop()
  - can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag
  - can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag
  - ALSA: hda/realtek: Add quirk for 2nd ASUS GU603
  - ALSA: hda/realtek: Add a quirk for HP EliteDesk 805
  - ALSA: hda/realtek: Add quirk for Clevo L140AU
  - ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table
  - ALSA: hda: Fix Oops by 9.1 surround channel names
  - usb: typec: altmodes/displayport: fix pin_assignment_show
  - usb: gadget: u_ether: Fix host MAC address case
  - usb: dwc3: debugfs: Resume dwc3 before accessing registers
  - USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value
  - usb-storage: fix deadlock when a scsi command timeouts more than once
  - USB: usbtmc: Fix direction for 0-length ioctl control messages
  - ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go
  - bridge: always declare tunnel functions
  - netfilter: nft_set_rbtree: fix null deref on element insertion
  - vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
  - igb: fix bit_shift to be in [1..8] range
  - cassini: Fix a memory leak in the error handling path of cas_init_one()
  - scsi: storvsc: Don't pass unused PFNs to Hyper-V host
  - wifi: iwlwifi: mvm: don't trust firmware n_channels
  - wifi: mac80211: fix min center freq offset tracing
  - net: bcmgenet: Restore phy_stop() depending upon suspend/close
  - net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
  - tipc: check the bearer min mtu properly when setting it by netlink
  - tipc: do not update mtu if msg_max is too small in mtu negotiation
  - tipc: add tipc_bearer_min_mtu to calculate min mtu
  - net/tipc: fix tipc header files for kernel-doc
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
  - drm/exynos: fix g2d_open/close helper function definitions
  - SUNRPC: Fix trace_svc_register() call site
  - media: netup_unidvb: fix use-after-free at del_timer()
  - erspan: get the proto with the md version for collect_md
  - serial: arc_uart: fix of_iomap leak in `arc_serial_probe`
  - vsock: avoid to close connected socket after the timeout
  - ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15
  - ALSA: firewire-digi00x: prevent potential use after free
  - net: phy: dp83867: add w/a for packet errors seen with short cables
  - net: fec: Better handle pm_runtime_get() failing in .remove()
  - af_key: Reject optional tunnel/BEET mode templates in outbound policies
  - cpupower: Make TSC read per CPU for Mperf monitor
  - drm/msm/dpu: Remove duplicate register defines from INTF
  - drm/msm/dp: unregister audio driver during unbind
  - Revert "Fix XFRM-I support for nested ESP tunnels"
  - btrfs: fix space cache inconsistency after error loading it from disk
  - btrfs: replace calls to btrfs_find_free_ino with btrfs_find_free_objectid
  - btrfs: move btrfs_find_highest_objectid/btrfs_find_free_objectid to disk-io.c
  - mfd: dln2: Fix memory leak in dln2_probe()
  - phy: st: miphy28lp: use _poll_timeout functions for waits
  - Input: xpad - add constants for GIP interface numbers
  - iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any
  - clk: tegra20: fix gcc-7 constant overflow warning
  - iommu/arm-smmu-qcom: Limit the SMR groups to 128
  - RDMA/core: Fix multiple -Warray-bounds warnings
  - recordmcount: Fix memory leaks in the uwrite function
  - sched: Fix KCSAN noinstr violation
  - mcb-pci: Reallocate memory region to avoid memory overlapping
  - serial: 8250: Reinit port->pm on port specific driver unbind
  - usb: typec: tcpm: fix multiple times discover svids error
  - HID: wacom: generic: Set battery quirk only when we see battery data
  - spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3
  - HID: logitech-hidpp: Reconcile USB and Unifying serials
  - HID: logitech-hidpp: Don't use the USB serial for USB devices
  - staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
  - Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set
  - wifi: ath11k: Fix SKB corruption in REO destination ring
  - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
  - null_blk: Always check queue mode setting from configfs
  - wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
  - wifi: iwlwifi: pcie: fix possible NULL pointer dereference
  - samples/bpf: Fix fout leak in hbm's run_bpf_prog
  - f2fs: fix to drop all dirty pages during umount() if cp_error is set
  - ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()
  - ext4: set goal start correctly in ext4_mb_normalize_request
  - gfs2: Fix inode height consistency check
  - scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition
  - lib: cpu_rmap: Avoid use after free on rmap->obj array entries
  - scsi: target: iscsit: Free cmds before session free
  - net: Catch invalid index in XPS mapping
  - net: pasemi: Fix return type of pasemi_mac_start_tx()
  - ext2: Check block size validity during mount
  - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
  - bpf: Annotate data races in bpf_local_storage
  - wifi: ath: Silence memcpy run-time false positive warning
  - drm/amd: Fix an out of bounds error in BIOS parser
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects
  - ACPICA: Avoid undefined behavior: applying zero offset to null pointer
  - drm/tegra: Avoid potential 32-bit integer overflow
  - remoteproc: stm32_rproc: Add mutex protection for workqueue
  - ACPI: EC: Fix oops when removing custom query handlers
  - arm64: dts: qcom: msm8996: Add missing DWC3 quirks
  - regmap: cache: Return error in cache sync operations for REGCACHE_NONE
  - drm/amd/display: Use DC_LOG_DC in the trasform pixel function
  - fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()
  - rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access
  - refscale: Move shutdown from wait_event() to wait_event_idle()
  - ext4: allow ext4_get_group_info() to fail
  - ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set
  - ext4: add mballoc stats proc file
  - ext4: drop s_mb_bal_lock and convert protected fields to atomic
  - ext4: remove redundant mb_regenerate_buddy()
  - ext4: fix lockdep warning when enabling MMP
  - ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled
  - ext4: reflect error codes from ext4_multi_mount_protect() to its callers
  - ext4: remove an unused variable warning with CONFIG_QUOTA=n
  - fbdev: arcfb: Fix error handling in arcfb_probe()
  - drm/i915/dp: prevent potential div-by-zero
  - af_unix: Fix data races around sk->sk_shutdown.
  - af_unix: Fix a data race of sk->sk_receive_queue->qlen.
  - net: datagram: fix data-races in datagram_poll()
  - tcp: add annotations around sk->sk_shutdown accesses
  - tcp: factor out __tcp_close() helper
  - net: add vlan_get_protocol_and_depth() helper
  - net: tap: check vlan with eth_type_vlan() method
  - net: annotate sk->sk_err write from do_recvmmsg()
  - netlink: annotate accesses to nlk->cb_running
  - netfilter: conntrack: fix possible bug_on with enable_hooks=1
  - net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
  - linux/dim: Do nothing if no time delta between samples
  - net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe()
  - ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings
  - drm/mipi-dsi: Set the fwnode for mipi_dsi_device
  - driver core: add a helper to setup both the of_node and fwnode of a device
  - Net: ethernet: Support management channel of the host tool in 3snic 3s9xx network driver


author: <fengjiabo1@huawei.com> - 10:6.2.0-78
changelog:
  - sw_64: Added sw64 architecture related updates
  - virtio-crypto: verify src&dst buffer length for sym request
  - vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present
  - qga: Fix suspend on Linux guests without systemd
  - tests: vhost-user-test: release mutex on protocol violation
  - qapi: support updating expected test output via make
  - block: Fix misleading hexadecimal format
  - block/rbd: fix write zeroes with growing images
  - block/nbd.c: Fixed IO request coroutine not being wakeup when kill NBD server
  - block/nfs: Fix 32-bit Windows build
  - qapi/qdev: Tidy up device_add documentation
  - hw/xen/xen_pt: fix uninitialized variable
  - migration/ram: Fix error handling in ram_write_tracking_start()
  - docs/about/build-platforms: Refine the distro support policy
  - xen-block: Avoid leaks on new error path
  - QGA VSS: Add wrapper to send log to debugger and stderr
  - chardev/char-socket: set s->listener = NULL in char_socket_finalize
  - qapi/block: Tidy up block-latency-histogram-set documentation
  - disas/riscv Fix ctzw disassemble
  - vfio: Fix vfio_get_dev_region() trace event
  - migration/ram: Fix populate_read_range()
  - Check and report for incomplete 'global' option  format


author: <fengjiabo1@huawei.com> - 10:6.2.0-79
changelog:
  - test: Fix test-crypto-secret when compiling without keyring support
  - aio-posix: fix build failure io_uring 2.2


author: <fengjiabo1@huawei.com> - 10:6.2.0-80
changelog:
  - io: remove io watch if TLS channel is closed during handshake
  - hw/ssi: Fix Linux driver init issue with xilinx_spi
  - chardev: report the handshake error
  - vhost: Drop unused eventfd_add|del hooks
  - virtio-iommu: use-after-free fix
  - hw/arm/virt: Check for attempt to use TrustZone with KVM or HVF
  - hw/rx: rx-gdbsim DTB load address aligned of 16byte
  - vhost-user: Use correct macro name TARGET_PPC64
  - accel/kvm: Make kvm_dirty_ring_reaper_init() void
  - accel/kvm: Free as when an error occurred


author: <fengjiabo1@huawei.com> - 10:6.2.0-81
changelog:
  - hw/nvme: Avoid dynamic stack allocation
  - ppc/vof: Fix missed fields in VOF cleanup
  - ui: fix crash when there are no active_console
  - tests/qtest/pflash: Clean up local variable shadowing
  - target/ppc: Fix the order of kvm_enable judgment about kvmppc_set_interrupt()
  - tulip: Assign default MAC address if not specified
  - hw/char: fix qcode array bounds check in ESCC impl


author: <fengjiabo1@huawei.com> - 10:6.2.0-82
changelog:
  - thread-pool: optimize scheduling of completion bottom half
  - migration/rdma: zore out head.repeat to make the error more clear
  - vhost-user-fs: Back up vqs before cleaning up vhost_dev
  - hw/vfio/pci-quirks: Sanitize capability pointer
  - hw/vfio/pci-quirks: Support alternate offset for GPUDirect Cliques
  - replay: fix event queue flush for qemu shutdown
  - hw/net: Fix read of uninitialized memory in ftgmac100
  - target/ppc: Fix tlbie
  - target/i386: fix INVD vmexit
  - qtest/npcm7xx_pwm-test: Fix memory leak in mft_qom_set
  - aio-posix: zero out io_uring sqe user_data


author: <fengjiabo1@huawei.com> - 10:6.2.0-83
changelog:
  - hw/virtio/virtio-pmem: Replace impossible check by assertion
  - tests: Fix printf format string in acpi-utils.c
  - softmmu/dirtylimit: Add parameter check for hmp "set_vcpu_dirty_limit"
  - disas/riscv: Fix the typo of inverted order of pmpaddr13 and pmpaddr14
  - qga: Fix memory leak when output stream is unused
  - ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255)
  - target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model
  - target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES
  - target/i386: Allow MCDT_NO if host supports
  - target/i386: Add support for MCDT_NO in CPUID enumeration
  - target/i386: Export MSR_ARCH_CAPABILITIES bits to guests
  - target/i386: add support for FB_CLEAR feature
  - target/i386: add support for FLUSH_L1D feature
  - crypto: remove shadowed 'ret' variable
  - hw/i2c/pmbus_device: Fix modifying QOM class internals from instance
  - hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number


author: <fengjiabo1@huawei.com> - 10:6.2.0-84
changelog:
  - hw/arm/fsl-imx: Do not ignore Error argument
  - hw/net/cadence_gem.c: spelling fixes: Octects
  - tests/qtest: check the return value
  - libvhost-user: Fix VHOST_USER_GET_MAX_MEM_SLOTS  reply mainline inclusion commit 69a5daec06f423843ce1bb9be5fb049314996f78 category: bugfix
  - io_uring: fix short read slow path mainline inclusion commit c06fc7ce147e57ab493bad9263f1601b8298484b category: bugfix
  - libvhost-user: Fix VHOST_USER_ADD_MEM_REG reply mainline inclusion commit 7f27d20ded2f480f3e66d03f90ea71507b834276 category: bugfix
  - qsd: Unlink absolute PID file path mainline inclusion commit 9d8f8233b9fa525a7e37350fbc18877051128c5d category: bugfix
  - net: Fix a misleading error message
  - vdpa: stop all svq on device deletion
  - vhost: release virtqueue objects in error path
  - vhost: fix the fd leak
  - virtio: i2c: Check notifier helpers for VIRTIO_CONFIG_IRQ_IDX
  - hw/virtio: fix typo in VIRTIO_CONFIG_IRQ_IDX comments
  - virtio-net: clear guest_announce feature if no cvq backend
  - vdpa: fix VHOST_BACKEND_F_IOTLB_ASID flag check
  - vdpa: do not block migration if device has cvq and x-svq=on
  - vdpa net: block migration if the device has CVQ
  - vdpa: Return -EIO if device ack is VIRTIO_NET_ERR in _load_mq()
  - vdpa: Return -EIO if device ack is VIRTIO_NET_ERR in _load_mac()
  - vdpa: fix not using CVQ buffer in case of error
  - vdpa: Fix possible use-after-free for VirtQueueElement
  - hw/virtio: fix vhost_user_read tracepoint
  - vhost: Fix false positive out-of-bounds
  - vhost: fix possible wrap in SVQ descriptor ring
  - vhost: move iova_tree set to vhost_svq_start
  - vhost: Always store new kick fd on vhost_svq_set_svq_kick_fd
  - virtio-crypto: verify src&dst buffer length for sym request
  - vdpa: commit all host notifier MRs in a single MR transaction
  - vdpa: harden the error path if get_iova_range failed
  - vdpa-dev: get iova range explicitly
  - virtio-pci: add support for configure interrupt
  - virtio-mmio: add support for configure interrupt
  - virtio-net: add support for configure interrupt
  - vhost: add support for configure interrupt
  - virtio: add support for configure interrupt
  - vhost-vdpa: add support for config interrupt
  - vhost: introduce new VhostOps vhost_set_config_call
  - virtio-pci: decouple the single vector from the interrupt process
  - virtio-pci: decouple notifier from interrupt process
  - virtio: introduce macro VIRTIO_CONFIG_IRQ_IDX
  - vdpa: do not handle VIRTIO_NET_F_GUEST_ANNOUNCE in vhost-vdpa
  - vdpa: handle VIRTIO_NET_CTRL_ANNOUNCE in vhost_vdpa_net_handle_ctrl_avail
  - vhost: fix vq dirty bitmap syncing when vIOMMU is enabled
  - hw/virtio: gracefully handle unset vhost_dev vdev
  - hw/virtio/vhost: Fix typo in comment.
  - vdpa: always start CVQ in SVQ mode if possible
  - vdpa: add shadow_data to vhost_vdpa
  - vdpa: store x-svq parameter in VhostVDPAState
  - vdpa: add asid parameter to vhost_vdpa_dma_map/unmap
  - vdpa: allocate SVQ array unconditionally
  - vdpa: move SVQ vring features check to net/
  - vdpa: request iova_range only once
  - vdpa: add vhost_vdpa_net_valid_svq_features
  - vhost: allocate SVQ device file descriptors at device start
  - vhost: set SVQ device call handler at SVQ start
  - vdpa: use v->shadow_vqs_enabled in vhost_vdpa_svqs_start & stop
  - vhost: enable vrings in vhost_dev_start() for vhost-user devices
  - vhost-vdpa: fix assert !virtio_net_get_subqueue(nc)->async_tx.elem in virtio_net_reset
  - net/vhost-vdpa.c: Fix clang compilation failure
  - vhost-vdpa: allow passing opened vhostfd to vhost-vdpa
  - vdpa: Remove shadow CVQ command check
  - vdpa: Delete duplicated vdpa_feature_bits entry
  - hw/virtio: add some vhost-user trace events
  - vdpa: Allow MQ feature in SVQ
  - virtio-net: Update virtio-net curr_queue_pairs in vdpa backends
  - vdpa: validate MQ CVQ commands
  - vdpa: Add vhost_vdpa_net_load_mq
  - vdpa: extract vhost_vdpa_net_load_mac from vhost_vdpa_net_load
  - vdpa: Make VhostVDPAState cvq_cmd_in_buffer control ack type
  - vdpa: Delete CVQ migration blocker
  - vdpa: Add virtio-net mac address via CVQ at start
  - vhost_net: add NetClientState->load() callback
  - vdpa: extract vhost_vdpa_net_cvq_add from vhost_vdpa_net_handle_ctrl_avail
  - vdpa: Move command buffers map to start of net device
  - vdpa: add net_vhost_vdpa_cvq_info NetClientInfo
  - vhost_net: Add NetClientInfo stop callback
  - vhost_net: Add NetClientInfo start callback
  - vdpa: Use ring hwaddr at vhost_vdpa_svq_unmap_ring
  - vdpa: Make SVQ vring unmapping return void
  - vdpa: Remove SVQ vring from iova_tree at shutdown
  - util: accept iova_tree_remove_parameter by value
  - vdpa: do not save failed dma maps in SVQ iova tree
  - vdpa: Skip the maps not in the iova tree
  - vdpa: Fix file descriptor leak on get features error
  - vdpa: Fix memory listener deletions of iova tree
  - vhost: Get vring base from vq, not svq
  - vdpa: Add x-svq to NetdevVhostVDPAOptions
  - vdpa: Add device migration blocker
  - vdpa: Extract get features part from vhost_vdpa_get_max_queue_pairs
  - vdpa: Buffer CVQ support on shadow virtqueue
  - vdpa: manual forward CVQ buffers
  - vdpa: Export vhost_vdpa_dma_map and unmap calls
  - vhost: Add svq avail_handler callback
  - vhost: add vhost_svq_poll
  - vhost: Expose vhost_svq_add
  - vhost: add vhost_svq_push_elem
  - vhost: Track number of descs in SVQDescState
  - vhost: Add SVQDescState
  - vhost: Decouple vhost_svq_add from VirtQueueElement
  - vhost: Check for queue full at vhost_svq_add
  - vhost: Move vhost_svq_kick call to vhost_svq_add
  - vhost: Reorder vhost_svq_kick
  - vdpa: Avoid compiler to squash reads to used idx
  - virtio-net: Expose ctrl virtqueue logic
  - virtio-net: Expose MAC_TABLE_ENTRIES
  - vhost: move descriptor translation to vhost_svq_vring_write_descs
  - util: Return void on iova_tree_remove
  - virtio-net: don't handle mq request in userspace handler for vhost-vdpa
  - vhost-vdpa: change name and polarity for vhost_vdpa_one_time_request()
  - vhost-vdpa: backend feature should set only once
  - vhost-vdpa: fix improper cleanup in net_init_vhost_vdpa
  - virtio-net: align ctrl_vq index for non-mq guest for vhost_vdpa
  - virtio: add vhost support for virtio devices
  - include/hw: start documenting the vhost API
  - hw/virtio: add vhost_user_[read|write] trace points
  - vhost: Fix element in vhost_svq_add failure
  - vdpa: Fix index calculus at vhost_vdpa_svqs_start
  - vdpa: Fix bad index calculus at vhost_vdpa_get_vring_base
  - vhost: Fix device's used descriptor dequeue
  - vhost: Track descriptor chain in private at SVQ
  - vdpa: Add missing tracing to batch mapping functions
  - vhost-vdpa: fix typo in a comment
  - virtio: fix --enable-vhost-user build on non-Linux
  - vdpa: Expose VHOST_F_LOG_ALL on SVQ
  - vdpa: Never set log_base addr if SVQ is enabled
  - vdpa: Adapt vhost_vdpa_get_vring_base to SVQ
  - vdpa: Add custom IOTLB translations to SVQ
  - vhost: Add VhostIOVATree
  - util: add iova_tree_find_iova
  - util: Add iova_tree_alloc_map
  - vhost: Shadow virtqueue buffers forwarding
  - vdpa: adapt vhost_ops callbacks to svq
  - virtio: Add vhost_svq_get_vring_addr
  - vhost: Add vhost_svq_valid_features to shadow vq
  - vhost: Add Shadow VirtQueue call forwarding capabilities
  - vhost: Add Shadow VirtQueue kick forwarding capabilities
  - vhost: Add VhostShadowVirtqueue
  - vdpa: Make ncs autofree
  - Revert "virtio: introduce macro IRTIO_CONFIG_IRQ_IDX"
  - Revert "virtio-pci: decouple notifier from interrupt process"
  - Revert "virtio-pci: decouple the single vector from the interrupt process"
  - Revert "vhost-vdpa: add support for config interrupt"
  - Revert "virtio: add support for configure interrupt"
  - Revert "vhost: add support for configure interrupt"
  - Revert "virtio-net: add support for configure interrupt"
  - Revert "virtio-mmio: add support for configure interrupt"
  - Revert "virtio-pci: add support for configure interrupt"
  - Revert "vhost: introduce new VhostOps vhost_set_config_call"
  - virtio: signal after wrapping packed used_idx
  - target/i386: Adjust feature level according to FEAT_7_1_EDX
  - target/i386: Add new CPU model GraniteRapids
  - target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration
  - target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration
  - target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration
  - target/i386: Add support for AVX-IFMA in CPUID enumeration
  - target/i386: Add support for AMX-FP16 in CPUID enumeration
  - target/i386: Add support for CMPCCXADD in CPUID enumeration
  - tracetool: avoid invalid escape in Python string
  - hw/pvrdma: Protect against buggy or malicious guest driver
  - vga: avoid crash if no default vga card mainline inclusion commit 6985d8ede92494f3b791de01e8ee9306eb6d5e4a category: bugfix
  - qom/object: Remove circular include dependency mainline inclusion commit 5bba9bcfbb42e7c016626420e148a1bf1b080835 category: bugfix
  - artist: set memory region owners for buffers to the  artist device mainline inclusion commit 39fbaeca096a9bf6cbe2af88572c1cb2aa62aa8c category: bugfix
  - virtio-iommu: Fix the partial copy of probe request mainline inclusion commit 45461aace83d961e933b27519b81d17b4c690514 category: bugfix
  - e1000: set RX descriptor status in a separate  operation mainline inclusion commit 034d00d4858161e1d4cff82d8d230bce874a04d3 category: bugfix
  - vhost: introduce new VhostOps vhost_set_config_call
  - vhost: stick to -errno error return convention
  - vhost-user: stick to -errno error return convention
  - vhost-vdpa: stick to -errno error return convention
  - virtio-pci: add support for configure interrupt
  - virtio-mmio: add support for configure interrupt
  - virtio-net: add support for configure interrupt
  - vhost: add support for configure interrupt
  - virtio: add support for configure interrupt
  - vhost-vdpa: add support for config interrupt
  - virtio-pci: decouple the single vector from the interrupt process
  - virtio-pci: decouple notifier from interrupt process
  - virtio: introduce macro IRTIO_CONFIG_IRQ_IDX
  - pci: Fix the update of interrupt disable bit in PCI_COMMAND register
  - hw/timer/npcm7xx_timer: Prevent timer from counting down past zero
  - tpm_crb: mark command buffer as dirty on request  completion mainline inclusion commit e37a0ef4605e5d2041785ff3fc89ca6021faf7a0 category: bugfix
  - pci: fix overflow in snprintf string formatting mainline inclusion commit 36f18c6989a3d1ff1d7a0e50b0868ef3958299b4 category: bugfix
  - hw/usb/hcd-ehci: fix writeback order mainline inclusion commit f471e8b060798f26a7fc339c6152f82f22a7b33d category: bugfix
  - qemu-timer: Skip empty timer lists before locking  in qemu_clock_deadline_ns_all mainline inclusion commit 3f42906c9ab2c777a895b48b87b8107167e4a275 category: bugfix
  - semihosting/config: Merge --semihosting-config  option groups mainline inclusion commit 90c072e063737e9e8f431489bbd334452f89056e category: bugfix
  - semihosting: fix memleak at semihosting_arg_fallback
  - target/i386: Export GDS_NO bit to guests


author: <fengjiabo1@huawei.com> - 10:6.2.0-86
changelog:
  - vdpa: move memory listener to the realize stage
  - vdpa: implement vdpa device migration
  - vhost: implement post resume bh
  - vhost: implement migration state notifier for vdpa device
  - vhost: implement savevm_hanlder for vdpa device
  - vhost: implement vhost_vdpa_device_suspend/resume
  - vhost: implement vhost-vdpa suspend/resume
  - vhost: add vhost_dev_suspend/resume_op
  - vhost: introduce bytemap for vhost backend logging
  - vhost-vdpa: add migration log ops for VhostOps
  - vhost-vdpa: add VHOST_BACKEND_F_BYTEMAPLOG
  - vhost: fix null pointer access
  - ui/gtk: prevent ui lock up when dpy_gl_update called again before current draw event occurs
  - hw/usb: dev-mtp: Use g_mkdir()
  - target/ppc/cpu-models: Remove the "default" CPU alias
  - hw/intc/arm_gicv3: ICC_PMR_EL1 high bits should be RAZ
  - Fixed a QEMU hang when guest poweroff in COLO mode
  - migration/colo: More accurate update checkpoint time
  - scripts/entitlement.sh: Use backward-compatible cp flags
  - block/nvme: fix infinite loop in nvme_free_req_queue_cb()
  - hw/net: npcm7xx_emc fix missing queue_flush
  - Add dummy Aspeed AST2600 Display Port MCU (DPMCU)
  - hw/arm: ast2600: Fix address mapping of second SPI controller
  - vhost-user-blk: reconnect on any error during realize
  - vhost-user-blk: propagate error return from generic vhost
  - hw/riscv: boot: Reduce FDT address alignment constraints
  - Revert "hw/virtio/virtio-iommu-pci: Enforce the device is plugged on the root bus"
  - Fix STM32F2XX USART data register readout
  - block: use 'unsigned' for in_flight field on driver state
  - sphinx: change default language to 'en'
  - tests/qtest: Fix two format strings
  - trivial typos: namesapce
  - hw/ide/atapi.c: Correct typos (CD-CDROM -> CD-ROM)
  - hw/virtio/virtio-iommu-pci: Enforce the device is plugged on the root bus
  - hw/display/next-fb: Fix comment typo
  - xen/pass-through: merge emulated bits correctly mainline inclusion commit be9c61da9fc57eb7d293f380d0805ca6f46c2657 category: bugfix
  - tests/qtest/migration-test.c: spelling fix: bandwith
  - target/i386/cpu: Improve error message for property "vendor"
  - balloon: Fix a misleading error message
  - target/arm: Don't set syndrome ISS for loads and  stores with writeback mainline inclusion commit 53ae2fdef1f5661cbaa2ea571c517f98e6041cb8 category: bugfix
  - disas/hppa: Show hexcode of instruction along with disassembly
  - tcg/loongarch64: Fix tcg_out_mov() Aborted
  - ui/qmp-cmds: Improve two error messages
  - qga: Improve guest-exec-status error message
  - hmp: Improve sync-profile error message
  - spapr/pci: Correct "does not support hotplugging error messages
  - xen/pass-through: don't create needless register  group mainline inclusion commit c0e86b7624cb9d6db03e0d48cf82659e5b89a6a6 category: bugfix


