# changelog

author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.113.0.140
changelog:
  - !2391  netfilter: nf_tables: disallow rule removal from chain binding
  - netfilter: nf_tables: disallow rule removal from chain binding
  - !2389  nf_table LTS
  - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
  - netfilter: nf_tables: skip bound chain on rule flush
  - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails
  - netfilter: nf_tables: drop map element references from preparation phase
  - netfilter: nftables: rename set element data activation/deactivation functions
  - netfilter: nf_tables: reject unbound chain set before commit phase
  - netfilter: nf_tables: reject unbound anonymous set before commit phase
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
  - netfilter: nf_tables: fix chain binding transaction logic
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
  - netfilter: nf_tables: use net_generic infra for transaction data
  - Revert "netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID"
  - Revert "netfilter: nf_tables: skip bound chain on rule flush"
  - Revert "netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE"
  - Revert "netfilter: nf_tables: fix chain binding transaction logic"
  - Revert "netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain"
  - Revert "netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR"
  - Revert "netfilter: nf_tables: unbind non-anonymous set if rule construction fails"
  - !2378 [sync] PR-2359:  netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
  - !2299 [sync] PR-2287:  scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
  - !2297 [sync] PR-2286:  scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
  - scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
  - scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
  - !2273 [sync] PR-2156:  drm: add inspur drm driver support
  - !2238 [sync] PR-2163:  Fix the two problems when using binutil 2.41.
  - !2277 [sync] PR-2269:  etmem: Fixed an issue where the module reference counting is incorrect
  - etmem: Fixed an issue where the module reference counting is incorrect
  - !2124 [sync] PR-1778:  nvme-pci: fix DMA direction of unmapping integrity data
  - !2186  nvme-pci: fix timeout request state check
  - !2188  nvme-pci: fix mempool alloc size
  - drm: add inspur drm driver support
  - !2249 [sync] PR-2224:  ext4: fix rec_len verify error
  - ext4: fix rec_len verify error
  - LoongArch: Fix module relocation error with binutils 2.41
  - LoongArch: Fix the write_fcsr() macro
  - nvme-pci: fix mempool alloc size
  - nvme-pci: fix timeout request state check
  - nvme-pci: fix DMA direction of unmapping integrity data


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.114.0.141
changelog:
  - !2420 [sync] PR-2323:  net/sched: Retire rsvp classifier
  - net/sched: Retire rsvp classifier
  - !2366 [sync] PR-2282:  sdei_watchdog: Avoid exception during sdei handler
  - sdei_watchdog: Avoid exception during sdei handler


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.115.0.142
changelog:
  - !2690 [sync] PR-2666:  net: xfrm: Fix xfrm_address_filter OOB read
  - !2373 [sync] PR-2258:  ext4: do not mark inode dirty every time when appending using delalloc
  - !2637 [sync] PR-2454:  igb: set max size RX buffer when store bad packet is enabled
  - net: xfrm: Fix xfrm_address_filter OOB read
  - !2535 [sync] PR-2370:  ipv4: fix null-deref in ipv4_link_failure
  - !2524 [sync] PR-2440:  netfilter: xt_u32: validate user space input
  - !2530 [sync] PR-2411:  netfilter: xt_sctp: validate the flag_info count
  - !2527 [sync] PR-2410:  netfilter: nfnetlink_osf: avoid OOB read
  - !2658 [sync] PR-2628:  ubi: Refuse attaching if mtd's erasesize is 0
  - !2663  arm64: fix a concurrency issue in emulation_proc_handler()
  - arm64: armv8_deprecated: fix unused-function error
  - arm64: armv8_deprecated: rework deprected instruction handling
  - arm64: armv8_deprecated: move aarch32 helper earlier
  - arm64: armv8_deprecated move emulation functions
  - arm64: armv8_deprecated: fold ops into insn_emulation
  - arm64: rework EL0 MRS emulation
  - arm64: factor insn read out of call_undef_hook()
  - arm64: factor out EL1 SSBS emulation hook
  - arm64: split EL0/EL1 UNDEF handlers
  - arm64: allow kprobes on EL0 handlers
  - arm64: rework BTI exception handling
  - arm64: rework FPAC exception handling
  - arm64: consistently pass ESR_ELx to die()
  - arm64: die(): pass 'err' as long
  - arm64: report EL1 UNDEFs better
  - Revert "arm64: fix a concurrency issue in emulation_proc_handler()"
  - ubi: Refuse attaching if mtd's erasesize is 0
  - !2647 [sync] PR-2641:  Fix CVE-2023-5717
  - perf: Fix kabi breakage in struct perf_event
  - perf: Disallow mis-matched inherited group reads
  - !2563  fix cgroup poll UAF
  - !2519 [sync] PR-2437:  crypto: drbg - Only fail when jent is unavailable in FIPS mode
  - !2558  USB: ene_usb6250: Allocate enough memory for full object
  - igb: set max size RX buffer when store bad packet is enabled
  - !2595 [sync] PR-2573:  media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
  - !2566 [sync] PR-2557:  Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
  - !2580 [sync] PR-2476:  Fixed five CVEs vulnerabilities of ksmbd
  - !2613  CVE-2022-44033
  - char: pcmcia: remove all the drivers
  - tty: ipwireless: move Kconfig entry to tty
  - !2552  scsi: mpt3sas: Driver patch set for openEuler-22.03-LTS
  - !2584 [sync] PR-2571:  xen/events: replace evtchn_rwlock with RCU
  - media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
  - xen/events: replace evtchn_rwlock with RCU
  - ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN
  - ksmbd: fix infinite loop in ksmbd_conn_handler_loop()
  - ksmbd: send proper error response in smb2_tree_connect()
  - ksmbd: fix racy issue from smb2 close and logoff with multichannel
  - ksmbd: call rcu_barrier() in ksmbd_server_exit()
  - ksmbd: fix racy issue under cocurrent smb2 tree disconnect
  - Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
  - sched/psi: Select KERNFS as needed
  - kernfs: add stub helper for kernfs_generic_poll()
  - sched/psi: use kernfs polling functions for PSI trigger polling
  - USB: ene_usb6250: Allocate enough memory for full object
  - scsi: mpt3sas: Perform additional retries if doorbell read returns 0
  - scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
  - scsi: mpt3sas: Remove usage of dma_get_required_mask() API
  - scsi: mpt3sas: re-do lost mpt3sas DMA mask fix
  - scsi: mpt3sas: Don't change DMA mask while reallocating pools
  - scsi: mpt3sas: Fix a memory leak
  - scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
  - scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region
  - scsi: mpt3sas: Fix use-after-free warning
  - ipv4: fix null-deref in ipv4_link_failure
  - netfilter: xt_sctp: validate the flag_info count
  - netfilter: nfnetlink_osf: avoid OOB read
  - netfilter: xt_u32: validate user space input
  - !1561 Add ACS quirk for Wangxun NICs
  - !2514 [sync] PR-2499:  f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
  - crypto: drbg - Only fail when jent is unavailable in FIPS mode
  - !2485 [sync] PR-2340:  xfs: recent patches to fix xfs issues
  - f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
  - xfs: update the last_sync_lsn with ctx start lsn
  - xfs: shutdown xfs once inode double free
  - xfs: fix off-by-one-block in xfs_discard_folio()
  - xfs: xfs_bmap_punch_delalloc_range() should take a byte range
  - iomap: buffered write failure should not truncate the page cache
  - xfs,iomap: move delalloc punching to iomap
  - xfs: use byte ranges for write cleanup ranges
  - xfs: punching delalloc extents on write failure is racy
  - xfs: longest free extent no need consider postalloc
  - xfs: fix xfs shutdown since we reserve more blocks in agfl fixup
  - xfs: block reservation too large for minleft allocation
  - xfs: set minleft correctly for randomly sparse inode allocations
  - xfs: shutdown to ensure submits buffers on LSN boundaries
  - xfs: don't verify agf length when log recovery
  - xfs: Remove redundant assignment to busy
  - xfs: remove redundant pointer lip
  - xfs: remove redundant initializations of pointers drop_leaf and save_leaf
  - xfs: xfs_trans_cancel() path must check for log shutdown
  - xfs: fix bounds check in xfs_defer_agfl_block()
  - xfs: AGF length has never been bounds checked
  - xfs: journal geometry is not properly bounds checked
  - xfs: don't block in busy flushing when freeing extents
  - xfs: allow extent free intents to be retried
  - xfs: pass alloc flags through to xfs_extent_busy_flush()
  - Revert "xfs: propagate the return value of xfs_log_force() to avoid soft lockup"
  - xfs: use deferred frees for btree block freeing
  - xfs: don't reverse order of items in bulk AIL insertion
  - xfs: validate block number being freed before adding to xefi
  - xfs: validity check agbnos on the AGFL
  - xfs: pass xfs_extent_free_item directly through the log intent code
  - xfs: remove unused parameter from refcount code
  - xfs: reduce the size of struct xfs_extent_free_item
  - xfs: rename xfs_bmap_add_free to xfs_free_extent_later
  - xfs: create slab caches for frequently-used deferred items
  - xfs: compact deferred intent item structures
  - xfs: rename _zone variables to _cache
  - xfs: remove kmem_zone typedef
  - xfs: remove xfs_setattr_time() declaration
  - xfs: use setattr_copy to set vfs inode attributes
  - xfs: set prealloc flag in xfs_alloc_file_space()
  - xfs: don't assert fail on perag references on teardown
  - xfs: fix dir3 block read verify fail during log recover
  - xfs: propagate the return value of xfs_log_force() to avoid soft lockup
  - xfs: keep growfs sb log item active until ail flush success
  - !1141 [sync] PR-953:  xfs: fixes patchs and backport patchs
  - PCI: Add ACS quirk for Wangxun NICs
  - ext4: do not mark inode dirty every time when appending using delalloc
  - Revert "openeuler: pci: workaround multiple functions can be assigned to only one VM"
  - xfs: atomic drop extent entries when inactiving attr
  - xfs: factor out __xfs_da3_node_read()
  - xfs: fix a UAF in xfs_iflush_abort_clean
  - xfs: fix a UAF when inode item push
  - xfs: fix the problem of mount failure caused by not refreshing mp->m_sb
  - iomap: iomap: fix memory corruption when recording errors during writeback
  - xfs: fix hung when transaction commit fail in xfs_inactive_ifree
  - xfs: fix dead loop when do mount with IO fault injection
  - xfs: fix ag count overflow during growfs
  - xfs: account extra freespace btree splits for multiple allocations
  - xfs: force shutdown xfs when xfs_attr_inactive fails
  - xfs: fix negative array access in xfs_getbmap
  - xfs: fix BUG_ON in xfs_getbmap()
  - xfs: use iomap_valid method to detect stale cached iomaps
  - iomap: write iomap validity checks
  - xfs: write page faults in iomap are not buffered writes
  - xfs: fix exception caused by unexpected illegal bestcount in leaf dir
  - Revert "[Huawei] xfs: fix uaf when leaf dir bestcount not match with dir data blocks"
  - xfs: don't expose internal symlink metadata buffers to the vfs
  - xfs: shut down filesystem if we xfs_trans_cancel with deferred work items
  - xfs: fix maxlevels comparisons in the btree staging code
  - xfs: sb verifier doesn't handle uncached sb buffer
  - xfs: fallocate() should call file_modified()
  - xfs: remove XFS_PREALLOC_SYNC
  - xfs: shutdown during log recovery needs to mark the log shutdown
  - xfs: xfs_trans_commit() path must check for log shutdown
  - xfs: xfs_do_force_shutdown needs to block racing shutdowns
  - xfs: log shutdown triggers should only shut down the log
  - xfs: shutdown in intent recovery has non-intent items in the AIL
  - xfs: AIL should be log centric
  - xfs: increase rename inode reservation
  - xfs: trim the mapp array accordingly in xfs_da_grow_inode_int
  - xfs: check return codes when flushing block devices
  - xfs: remove xfs_blkdev_issue_flush
  - xfs: fix NULL pointer dereference in xfs_getbmap()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.116.0.143
changelog:
  - !2717 [sync] PR-2678:  io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
  - !2739 [sync] PR-2443:  CVE-2023-37453
  - !2733 [sync] PR-2688:  nvmet-tcp: Fix a possible UAF in queue intialization setup
  - USB: core: Fix oversight in SuperSpeed initialization
  - USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
  - USB: core: Change usb_get_device_descriptor() API
  - USB: core: Unite old scheme and new scheme descriptor reads
  - nvmet-tcp: Fix a possible UAF in queue intialization setup
  - !2701 [sync] PR-2672:  fix CVE-2023-46813
  - io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
  - !2710 [sync] PR-2694:  LoongArch: add 32/64 pc relative relocation type support
  - !2664 [sync] PR-2579:  LoongArch: default IPMI related defconfig to m
  - LoongArch: Add support for 64_PCREL relocation type
  - LoongArch: Add support for 32_PCREL relocation type
  - LoongArch: Define relocation types for ABI v2.10
  - !2644 [sync] PR-2543:  psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n
  - x86/sev: Check for user-space IOIO pointing to kernel space
  - x86/sev: Check IOBM for IOIO exceptions from user-space
  - x86/sev: Disable MMIO emulation from user mode
  - LoongArch: default IPMI related defconfig to m
  - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.117.0.144
changelog:
  - !2860  bugfix for CVE-2022-45884
  - media: dvb-core: Fix use-after-free due to race at dvb_register_device()
  - media: dvbdev: fix error logic at dvb_register_device()
  - media: dvbdev: Fix memleak in dvb_register_device
  - !2846 [sync] PR-2840:  drm/qxl: fix UAF on handle creation
  - drm/qxl: fix UAF on handle creation
  - !2800 [sync] PR-2782:  cpufreq: Abort show()/store() for half-initialized policies
  - cpufreq: make interface functions and lock holding state clear
  - cpufreq: Abort show()/store() for half-initialized policies


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.118.0.145
changelog:
  - !2997 [sync] PR-2902:  net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
  - !829 [sync] PR-739: Fix kvm-unit-tests  vmx_cr4_osxsave_test  case failed
  - !831 [sync] PR-601: fix  test_vmxon failed
  - !2918 fix some bugs in loongarch kvm
  - net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
  - !2976 Add script to check & update openeuler_defconfig
  - config: update openeuler_defconfig for arm64
  - config: update openeuler_defconfig for x86
  - kconfig: Add script to check & update openeuler_defconfig
  - Revert "kconfig: Add script to update openeuler_defconfig"
  - !1562 [sync] PR-1527:  arm64/mpam: fix missing kfree domain's ctrl_val arrray
  - !2043 [sync] PR-1327:  Huawei BMA: To fix the bug in the iBMA driver code
  - !1896 [sync] PR-1853:  ring-buffer: Fix deadloop issue on reading trace_pipe
  - !1941 [sync] PR-1900:  tracing: Fix cpu buffers unavailable due to 'record_disabled' missed
  - !1983 [sync] PR-1905:  tracing: Fix memleak due to race between current_tracer and trace
  - !2652 [sync] PR-2377:  tracing: Backport bugfixes
  - !1402 [sync] PR-1399:  bpf: cpumap: Fix memory leak in cpu_map_update_elem
  - !2633 [sync] PR-2615:  preempt/dynamic: Fix setup_preempt_mode() return value
  - !1808 [sync] PR-1768:  bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
  - !2811 [sync] PR-2716:  ext4: recheck buffer valid after page unlock
  - loongarch/kvm: disable hugepage during migration process
  - loongarch/kvm: Fix oneshot timer emulation
  - loongarch/kvm: Remove SW timer switch when vcpu is halt polling
  - !2899 [sync] PR-2884:  LoongArch: fix two cpu hotplug problem
  - !1424 [sync] PR-1354:  ubi: Fix return value overwrite issue in try_write_vid_and_data()
  - !889 [sync] PR-886:  net: sched: fix NULL pointer dereference in mq_attach
  - !900 [sync] PR-890:  ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
  - !2019 [sync] PR-1965:  crypto:padata: Fix return err for PADATA_RESET
  - !2896 [sync] PR-2867:  netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
  - !1512 [sync] PR-1357:  SUNRPC: Ensure that the gssproxy client can start in a connected state
  - !2753  fix memcgv1 oom meminfo bug
  - LoongArch: fix two cpu hotplug problem
  - netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
  - ext4: recheck buffer valid after page unlock
  - memcg: dump memory.stat during cgroup OOM for v1
  - memcg: use seq_buf_do_printk() with mem_cgroup_print_oom_meminfo()
  - seq_buf: Add seq_buf_do_printk() helper
  - seq_buf: Add seq_buf_terminate() API
  - ring-buffer: Do not attempt to read past "commit"
  - ring-buffer: Do not swap cpu_buffer during resize process
  - preempt/dynamic: Fix setup_preempt_mode() return value
  - Huawei BMA: To fix the bug in the iBMA driver code
  - crypto:padata: Fix return err for PADATA_RESET
  - tracing: Fix memleak due to race between current_tracer and trace
  - tracing: Fix cpu buffers unavailable due to 'record_disabled' missed
  - ring-buffer: Fix deadloop issue on reading trace_pipe
  - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
  - arm64/mpam: fix missing kfree domain's ctrl_val arrray
  - SUNRPC: Ensure that the gssproxy client can start in a connected state
  - ubi: Fix return value overwrite issue in try_write_vid_and_data()
  - bpf: cpumap: Fix memory leak in cpu_map_update_elem
  - ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
  - net: sched: fix NULL pointer dereference in mq_attach
  - KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails
  - kvm: x86: Sink cpuid update into vendor-specific set_cr4 functions


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.119.0.146
changelog:
  - !3193 [sync] PR-3128:  fix ksmbd to release the ones allocated for async work
  - ksmbd: delete asynchronous work from list
  - ksmbd: fix typo, syncronous->synchronous
  - ksmbd: fix possible memory leak in smb2_lock()
  - ksmbd: replace usage of found with dedicated list iterator variable
  - !3103 [sync] PR-3082:  fs/dirty_pages: add last read check in seq_read_dirty()
  - !3185 [sync] PR-3152:  scsi: scsi_device_gets returns failure
  - scsi: fix kabi broken in struct Scsi_Host
  - scsi: don't fail if hostt->module is NULL
  - scsi: scsi_device_gets returns failure when the module is NULL.
  - !2970  Add error handle for add_disk
  - !1394 [sync] PR-1355:  etmem: fix the div 0 problem in swapcache reclaim process
  - fs/dirty_pages: add last read check in seq_read_dirty()
  - !3078 [sync] PR-3022:  fs/dirty_pages: fix some errors in seq_read_dirty()
  - !3075 [sync] PR-3020:  fs/dirty_pages: fix inode reference count leakage error in dump_dirtypages_sb()
  - fs/dirty_pages: fix some errors in seq_read_dirty()
  - fs/dirty_pages: fix inode reference count leakage error in dump_dirtypages_sb()
  - block: Set memalloc_noio to false in the error path
  - block: Fix minor range check in device_add_disk()
  - block: clear ->slave_dir when dropping the main slave_dir reference
  - block: call blk_get_queue earlier in __device_add_disk
  - block: check minor range in device_add_disk()
  - block: fix memory leak for elevator on add_disk failure
  - block: Fix the kabi change on blk_register_region
  - block: Fix the kabi change in device_add_disk
  - block: fix error unwinding in device_add_disk
  - block: fix device_add_disk() kobject_create_and_add() error handling
  - block: add error handling for device_add_disk / add_disk
  - block: return errors from blk_register_region
  - block: add the events* attributes to disk_attrs
  - block: return errors from disk_alloc_events
  - block: return errors from blk_integrity_add
  - block: call blk_integrity_add earlier in device_add_disk
  - block: fold register_disk into device_add_disk
  - etmem: fix the div 0 problem in swapcache reclaim process


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.120.0.147
changelog:
  - !3624  ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
  - !3621  netfilter: nft_set_pipapo: skip inactive elements during set walk
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
  - netfilter: nft_set_pipapo: skip inactive elements during set walk
  - !3583  tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
  - !3580 [sync] PR-3577:  perf/core: Fix CVE-2023-6931
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
  - perf: Fix perf_event_validate_size() lockdep splat
  - perf: Fix perf_event_validate_size()
  - !3292 [sync] PR-2843:  Add error handle for sd
  - !3288 [sync] PR-3222:  md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk()
  - !3252 [sync] PR-2946:  LoongArch: disable 40bit user space by default
  - scsi: sd: Clean up sdkp if device_add_disk() failed
  - scsi: sd: Add error handling support for add_disk()
  - md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk()
  - !3179 [sync] PR-2825:  Add error handle for driver
  - LoongArch: disable 40bit user space by default
  - !3017 [sync] PR-1203:  Revert "locking/rwsem: Prevent potential lock starvation"
  - !3229 [sync] PR-3161:  fs: Fix error checking for d_hash_and_lookup()
  - !2956 [sync] PR-1613:  arm64/mpam: implement CPU_PM notifier
  - fs: Fix error checking for d_hash_and_lookup()
  - nbd: fix uaf in nbd_open
  - mtd/ubi/block: Fix uaf problem in ubiblock_cleanup
  - mtd/ubi/block: Fix null pointer dereference issue in error path
  - mtd/ubi/block: add error handling support for add_disk()
  - ubi: use blk_mq_alloc_disk and blk_cleanup_disk
  - scsi: sr: Add error handling support for add_disk()
  - block/brd: add error handling support for add_disk()
  - brd: convert to blk_alloc_disk/blk_cleanup_disk
  - nvme: add error handling support for add_disk()
  - nvme: use blk_mq_alloc_disk
  - block: add a flag to make put_disk on partially initalized disks safer
  - nbd: add error handling support for add_disk()
  - nbd: fix order of cleaning up the queue and freeing the tagset
  - nbd: use blk_mq_alloc_disk and blk_cleanup_disk
  - loop: add error handling support for add_disk()
  - loop: fix order of cleaning up the queue and freeing the tagset
  - loop: use blk_mq_alloc_disk and blk_cleanup_disk
  - blk-mq: fix an IS_ERR() vs NULL bug
  - blk-mq: add the blk_mq_alloc_disk APIs
  - block: add blk_alloc_disk and blk_cleanup_disk APIs
  - Revert "locking/rwsem: Better collate rwsem_read_trylock()"
  - Revert "locking/rwsem: Pass the current atomic count to rwsem_down_read_slowpath()"
  - Revert "locking/rwsem: Prevent potential lock starvation"
  - arm64/mpam: implement CPU_PM notifier


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.121.0.148
changelog:
  - !3853 [sync] PR-3694:  Fix tow CVEs of CIFS
  - !3773 [sync] PR-3594:  CVE-2023-35827 patchset
  - smb: client: fix potential OOB in smb2_dump_detail()
  - smb: client: fix OOB in smbCalcSize()
  - !3799 [sync] PR-3659:  atm: Fix Use-After-Free in do_vcc_ioctl
  - !3824 [sync] PR-3822:  ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
  - !3794  md: protect md_thread with rcu
  - ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
  - !3780 [sync] PR-3447:  dm: add error handling support for add_disk()
  - !3778 [sync] PR-3379:  md: do not return existing mddevs from mddev_find_or_alloc
  - atm: Fix Use-After-Free in do_vcc_ioctl
  - md: protect md_thread with rcu
  - md/bitmap: factor out a helper to set timeout
  - md/bitmap: always wake up md_thread in timeout_store
  - dm-raid: remove useless checking in raid_message()
  - md: factor out a helper to wake up md_thread directly
  - dm: add error handling support for add_disk()
  - md: do not return existing mddevs from mddev_find_or_alloc
  - md: refactor mddev_find_or_alloc
  - md: factor out a mddev_alloc_unit helper from mddev_find
  - ravb: Fix races between ravb_tx_timeout_work() and net related ops
  - ravb: Fix use-after-free issue in ravb_tx_timeout_work()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.122.0.149
changelog:
  - !3986 [sync] PR-3715:  appletalk: Fix Use-After-Free in atalk_ioctl
  - !3989 [sync] PR-3668:  net/rose: Fix Use-After-Free in rose_ioctl
  - !3416 Modify the kvm code style
  - !3983 [sync] PR-3915:  nvmet: nul-terminate the NQNs passed in the connect command
  - !3795 [sync] PR-3771:  ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
  - !3763 [sync] PR-3686:  Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
  - net/rose: Fix Use-After-Free in rose_ioctl
  - appletalk: Fix Use-After-Free in atalk_ioctl
  - nvmet: nul-terminate the NQNs passed in the connect command
  - !3924  livepatch/core: Disable support for replacing
  - livepatch/core: Disable support for replacing
  - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
  - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
  - loongarch/kvm: Modify the kvm code style


