# changelog

author: Funda Wang <fundawang@yeah.net> - 5.3.1-10
changelog:
  - Type:CVE
  - CVE:CVE-2025-2751 CVE-2025-3158 CVE-2025-3196
  - SUG:NA
  - DESC:fix CVE-2025-2751 CVE-2025-3158 CVE-2025-3196


author: mapengyuan <mapengyuan@xfusion.com> - 5.3.1-16
changelog:
  - Type:CVE
  - CVE:CVE-2025-2754 CVE-2025-2756 CVE-2025-5200
  - SUG:NA
  - DESC:fix CVE-2025-2754 CVE-2025-2756 CVE-2025-5200


author: majianhan <majianhan@kylinos.cn> - 5.3.1-17
changelog:
  - Type:CVE
  - CVE:CVE-2025-2752 CVE-2025-2755 CVE-2025-5201 CVE-2025-5202 CVE-2025-5203 CVE-2025-5204
  - SUG:NA
  - DESC:fix CVE-2025-2752 CVE-2025-2755 CVE-2025-5201 CVE-2025-5202 CVE-2025-5203 CVE-2025-5204


author: chengyechun<chengyechun1@huawei.com> - 32:9.18.21-3
changelog:
  - Type:CVE
  - CVE:CVE-2024-0760,CVE-2024-1737,CVE-2024-1975,CVE-2024-4076
  - SUG:NA
  - DESC:fix CVE-2024-0760,CVE-2024-1737,CVE-2024-1975,CVE-2024-4076


author: chengyechun<chengyechun1@huawei.com> - 32:9.18.21-4
changelog:
  - Type:CVE
  - CVE:CVE-2024-11187,CVE-2024-12705
  - SUG:NA
  - DESC:fix CVE-2024-111878 and CVE-2024-12705


author: tangce<tangce1@huawei.com> - 32:9.18.21-5
changelog:
  - Type:CVE
  - CVE:CVE-2025-8677,CVE-2025-40778,CVE-2025-40780
  - SUG:NA
  - DESC:fix CVE-2025-8677,CVE-2025-40778,CVE-2025-40780


author: Li Nan <linan122@huawei.com> - 6.6.0-141.0.0.135
changelog:
  - !20704 kernel support hisi-cca-da
  - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration
  - !20905 v2  KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
  - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization
  - !20964 iommu/ummu: Support TID and EID Granularity for MPAM
  - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver
  - hisi-cca-da: Start dev by rsi call
  - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV
  - hisi-cca-da: Support swiotlb and realm memory use
  - hisi-cca-da: Add smmu info when dev attach
  - hisi-cca-da: Transfer realm msix access to rmm
  - hisi-cca-da: Support pcipc sriov capability
  - hisi-cca-da: Delay realm memory release to kvm_destroy_realm
  - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm
  - hisi-cca-da: Add cca realm s2 pgtable framework
  - hisi-cca-da: Use bitmap to determine whether the command can be forwarded
  - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only
  - hisi-cca-da: Add cmd forward mechanism in realm smmu
  - hisi-cca-da: Add realm smmu event and gerror irq initialization
  - hisi-cca-da: Add realm smmu stream table initialization
  - hisi-cca-da: Add realm smmu cmdq and evtq initialization
  - hisi-cca-da: Add realm smmu initialization
  - hisi-cca-da: Add relam iommu support to iommufd
  - hisi-cca-da: Add realm iommu support for vfio-iommu-type1
  - hisi-cca-da: Support dev map and unmap
  - hisi-cca-da: Support dev validate and dev start
  - hisi-cca-da: VFIO support ccada
  - hisi-cca-da: Support dev delegate and dev attach
  - hisi-cca-da: Support root dev delegate and dev init
  - hisi-cca-da: Add hisilicon extension smc and ccada cmd
  - hisi-cca-da: Add hisi ccada feature config
  - !20751 ARM CCA supports hugepage
  - !20944 ub: ubmempfd: supports for D2H mapping and demapping
  - !20888  HiSock Enhancement
  - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver.
  - net: unic: Resolve the residual MAC address problem
  - net: unic: Optimized the code for the cmd structure and FEC function.
  - ub: ubase: add log for post mailbox timeout
  - ub: ubus: Remove black box header file to include dir
  - rme: Remove the secret bit of the vring desc addr
  - rme: improve hisi-cca data mmap and destroy method
  - !20943 uvb: fix wd_obtain logic err
  - !20942 urma: fix bond device id not release
  - !20892  dcache: Limit the minimal number of bucket to two
  - rme: isolate page when do delegation to avoid migration
  - rme: hisi-cca supports different levels for mapping ram
  - rme: rename ccal to hisi-cca
  - rme: support set ripas for ccal realm vm
  - rme: support destroy ram data for ccal realm vm
  - rme: support populate region for ccal realm vm
  - rme: support map ram for ccal realm vm
  - rme: support config ccal realm vm
  - rme: support ccal RMI calls
  - rme: realm vm supports wfx handler
  - !20952 urma: introduce ipourma module
  - iommu/ummu-core: Simplifies tdev initialization resources
  - iommu/ummu: Optimized log printing
  - iommu/ummu: Use passed gfp_mask in map_pages callback
  - uvb: fix wd_obtain logic err
  - !20949 ub: udma: support user ctl function.
  - urma: fix bond device id not release
  - !20901 drivers/ub/sentry: some bugfix
  - ub: ubmempfd: supports for D2H mapping and demapping
  - ub: ubmempfd: supports providing services to the QEMU process through file nodes
  - [virtCCA Live Migration 2]virtcca secure cvm supports live migration
  - urma: query priority and enable bit, support ring size configuration
  - urma: implement debugfs, improve boundary checks and error handling logic
  - urma: implement data plane interaction and statistics
  - urma: implement ipourma network device operations
  - urma: ipourma resource management
  - urma: ipourma resource management and err code
  - urma: introduce ipourma main module
  - iommu/ummu: Optimized the TID invalidation configuration
  - iommu/ummu: Optimized SVA permission table memory allocation approach
  - iommu/ummu: Adapt UMMU SVA interface adjustment
  - iommu/ummu: Support TID and EID Granularity for MPAM
  - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y
  - !20847 urma: sl resource query error
  - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches
  - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption
  - !20929  PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug
  - drivers/ub/sentry: fix check input parameters
  - ub: udma: support user ctl function.
  - ub: udma: support uboe function.
  - ub: udma: bugfix related to query aux info.
  - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs
  - drivers/ub/sentry: do not use magic numbers
  - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface
  - urma: sl resource query error
  - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4
  - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time
  - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs
  - ub: ubmem_vmmu: supports parsing and configuring the hardware node information
  - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation
  - !20806 Fix CVE-2025-71225
  - !20896  scsi: qla2xxx: Free sp in error path to fix system crash
  - !20894  scsi: qla2xxx: Delay module unload while fabric scan in progress
  - !20893  scsi: qla2xxx: Validate sp before freeing associated memory
  - !20802 Fix CVE-2026-23110
  - urma: Kernel-mode specific implementations file for Jetty extension interface
  - drivers/ub/sentry: fix memory leak in process_urma_data()
  - drivers/ub/sentry: initialize some variables
  - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug
  - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory
  - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
  - mm: consider non-anon swap cache folios in folio_expected_ref_count()
  - mm: simplify folio_expected_ref_count()
  - ASoC: qcom: audioreach: fix potential null pointer dereference
  - gcc-plugins: Remove TODO_verify_il for GCC >= 16
  - crypto: sha256 - fix crash at kexec
  - drm/i915/backlight: Return immediately when scale() finds invalid parameters
  - minmax.h: remove some #defines that are only expanded once
  - minmax.h: simplify the variants of clamp()
  - minmax.h: move all the clamp() definitions after the min/max() ones
  - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
  - minmax.h: reduce the #define expansion of min(), max() and clamp()
  - minmax.h: update some comments
  - minmax.h: add whitespace around operators and after commas
  - minmax: fix up min3() and max3() too
  - minmax: improve macro expansion and type checking
  - minmax: don't use max() in situations that want a C constant expression
  - minmax: simplify min()/max()/clamp() implementation
  - minmax: make generic MIN() and MAX() macros available everywhere
  - drm/ast: Use msleep instead of mdelay for edid read
  - gpiolib: Extend software-node support to support secondary software-nodes
  - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB
  - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b
  - kmsan: fix out-of-bounds access to shadow memory
  - afs: Fix potential null pointer dereference in afs_put_server
  - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
  - i40e: improve VF MAC filters accounting
  - i40e: add mask to apply valid bits for itr_idx
  - HID: asus: add support for missing PX series fn keys
  - drm/gma500: Fix null dereference in hdmi teardown
  - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
  - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
  - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
  - net: dsa: lantiq_gswip: do also enable or disable cpu port
  - selftests: fib_nexthops: Fix creation of non-FDB nexthops
  - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
  - bnxt_en: correct offset handling for IPv6 destination address
  - vhost: Take a reference on the task in struct vhost_task.
  - Bluetooth: hci_sync: Fix hci_resume_advertising_sync
  - ethernet: rvu-af: Remove slash from the driver name
  - can: peak_usb: fix shift-out-of-bounds issue
  - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
  - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
  - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
  - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
  - bpf: Reject bpf_timer for PREEMPT_RT
  - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
  - wifi: virt_wifi: Fix page fault on connect
  - cpufreq: Initialize cpufreq-based invariance before subsys
  - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
  - arm64: dts: imx8mp: Correct thermal sensor index
  - mm: folio_may_be_lru_cached() unless folio_test_large()
  - mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
  - mm/gup: check ref_count instead of lru before migration
  - mm: add folio_expected_ref_count() for reference count calculation
  - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
  - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
  - ALSA: usb-audio: Add mute TLV for playback volumes on more devices
  - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
  - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
  - i2c: designware: Add quirk for Intel Xe
  - mmc: sdhci-cadence: add Mobileye eyeQ support
  - usb: core: Add 0x prefix to quirks debug output
  - ALSA: usb-audio: Fix build with CONFIG_INPUT=n
  - ALSA: usb-audio: Convert comma to semicolon
  - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
  - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
  - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
  - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
  - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
  - ALSA: usb-audio: Fix block comments in mixer_quirks
  - firewire: core: fix overlooked update of subsystem ABI version
  - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
  - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches
  - !20869 ub:hisi-ubus: fix bug of security smatch
  - !20861  CVE-2026-23163
  - ub: ubdevshm: supports the memory user to obtain and release shared memory
  - ub: ubdevshm: supports granting and revoking shared memory permissions
  - ub: ubdevshm: supports the registration and deregistration of shared memory segments
  - ub: ubdevshm: supports the registration and deregistration
  - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
  - !20886  Fix CVE-2026-23205
  - !20803 Fix CVE-2026-23112
  - !20868  sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure
  - !20811  smb/server: fix refcount leak in smb2_open()
  - !20810  smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
  - !20809  smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
  - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4
  - sunrpc: fix race in cache cleanup causing stale nextcheck time
  - scsi: qla2xxx: Free sp in error path to fix system crash
  - scsi: qla2xxx: Delay module unload while fabric scan in progress
  - scsi: qla2xxx: Validate sp before freeing associated memory
  - dcache: Limit the minimal number of bucket to two
  - !20872 Fix CVE-2026-23220
  - !20846 Fix CVE-2026-23193
  - !20815 Fix CVE-2026-23216
  - !20859 Fix CVE-2026-23179
  - !20871  CVE-2026-23096
  - !20858 ub: ubase: resolve the cmdq crq overflow problem
  - bpf: Deprecate hisock unused kfuncs and orig ingress logic
  - bpf: Add local connect support for hisock
  - bpf: Add ipv4-mapped ipv6 addr support for hisock
  - bpf: Add target comm parse to hisock_cmd
  - bpf: Add multi port parse to hisock_cmd
  - bpf: Only deploy hisock in server
  - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress
  - bpf: Add bpf_handle_ingress/egress_ptype kfunc
  - bpf: Add bpf_get_skb_ethhdr kfunc
  - bpf: Add bpf_set_ingress/egress_dev kfunc
  - bpf: Add bpf_set_ingress_dst kfunc
  - bpf: Add BPF_HISOCK_INGRESS attach type
  - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted
  - smb: client: fix potential UAF and double free in smb2_open_file()
  - smb/client: fix memory leak in smb2_open_file()
  - !20852  ASoC: amd: fix memory leak in acp3x pdm dma ops
  - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths
  - uacce: fix cdev handling in the cleanup path
  - Revert "uacce: fix for cdev memory leak"
  - ub:hisi-ubus: fix bug of security smatch
  - ub:ubus: injected route event
  - ub:ubus: Black Box Development
  - !20865 urma: urma support uboe
  - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure
  - urma: urma support uboe
  - !20857 ub_fwctl driver adds support for querying some functions
  - ub:ub_fwctl:Add illegal verification for scc
  - ub:ub_fwctl:Support querying the historical status of port links
  - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove
  - drm/amdkfd: Don't use sw fault filter if retry cam enabled
  - ub:ub_fwctl:Support querying firmware version numbers
  - ub: ub_fwctl: Support querying real-time bandwidth statistics
  - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels
  - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  - !20854 [URMA] add ping server for urma_ping
  - urma: add ping server
  - ub: ubase: resolve the cmdq crq overflow problem
  - ub: ubase: Optimized the QoS code naming to improve code readability.
  - ub: ubase&unic: optimizing code and configuration settings.
  - net: unic: not support query and configure ip by control plane in UBoE
  - net: unic: fix the automatically enable uc guid promisc mode.
  - !20844 urma:kernel header of userctl
  - urma: Kernel-mode header file for Jetty extension interface
  - ASoC: amd: fix memory leak in acp3x pdm dma ops
  - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
  - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
  - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
  - !20835 Fix CVE-2026-23084
  - minmax: add a few more MIN_T/MAX_T users
  - minmax: simplify and clarify min_t()/max_t() implementation
  - minmax: avoid overly complicated constant expressions in VM code
  - rtc: pcf2127: fix SPI command byte for PCF2131 backport
  - xhci: dbc: Fix full DbC transfer ring after several reconnects
  - xhci: dbc: decouple endpoint allocation from initialization
  - phy: ti: omap-usb2: fix device leak at unbind
  - phy: Use device_get_match_data()
  - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
  - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
  - ASoC: wm8974: Correct PLL rate rounding
  - ASoC: wm8940: Correct typo in control name
  - ASoC: wm8940: Correct PLL rate rounding
  - io_uring: include dying ring in task_work "should cancel" state
  - io_uring: backport io_should_terminate_tw()
  - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
  - selftests: mptcp: avoid spurious errors on TCP disconnect
  - selftests: mptcp: connect: catch IO errors on listen side
  - rds: ib: Increment i_fastreg_wrs before bailing out
  - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
  - mmc: mvsdio: Fix dma_unmap_sg() nents value
  - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
  - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface
  - btrfs: tree-checker: fix the incorrect inode ref size check
  - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page()
  - LoongArch: Check the return value when creating kobj
  - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled
  - LoongArch: Update help info of ARCH_STRICT_ALIGN
  - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
  - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
  - net: liquidio: fix overflow in octeon_init_instr_queue()
  - bonding: don't set oif to bond dev when getting NS target destination
  - net/mlx5e: Consider aggregated port speed during rate configuration
  - i40e: remove redundant memory barrier when cleaning Tx descs
  - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
  - selftests: mptcp: sockopt: fix error messages
  - mptcp: tfo: record 'deny join id0' info
  - mptcp: set remote_deny_join_id0 on SYN recv
  - dpaa2-switch: fix buffer pool seeding for control traffic
  - btrfs: fix invalid extref key setup when replaying dentry
  - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
  - wifi: mac80211: fix incorrect type for ret
  - wifi: mac80211: increase scan_ies_len for S1G
  - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
  - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches
  - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
  - !20776 ub:ubfi: Release the chosen node
  - !20817  CVE-2026-23094
  - !20819  dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
  - ub:ubus: Add port num check
  - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer
  - !20830  sched/soft_domain: Increasing NR_MAX_CLUSTER to 32
  - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32
  - btrfs: fix incorrect readahead expansion length
  - x86: disable image size check for test builds
  - drm/i915/power: fix size for for_each_set_bit() in abox iteration
  - drm/amdgpu: fix a memory leak in fence cleanup when unloading
  - net: mdiobus: release reset_gpio in mdiobus_unregister_device()
  - phy: ti-pipe3: fix device leak at unbind
  - phy: tegra: xusb: fix device and OF node leak at probe
  - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate
  - usb: gadget: midi2: Fix MIDI2 IN EP max packet size
  - usb: gadget: midi2: Fix missing UMP group attributes initialization
  - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
  - RISC-V: Remove unnecessary include from compat.h
  - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active()
  - hrtimer: Remove unused function
  - regulator: sy7636a: fix lifecycle of power good gpio
  - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
  - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
  - hsr: use rtnl lock when iterating over ports
  - net: hsr: Add VLAN CTAG filter support
  - net: hsr: Add support for MC filtering at the slave device
  - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
  - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
  - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
  - igb: fix link test skipping when interface is admin down
  - docs: networking: can: change bcm_msg_head frames member to support flexible array
  - tunnels: reset the GSO metadata before reusing the skb
  - net: bridge: Bounce invalid boolopts
  - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
  - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
  - USB: serial: option: add Telit Cinterion FN990A w/audio compositions
  - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
  - serial: sc16is7xx: fix bug in flow control levels init
  - tty: hvc_console: Call hvc_kick in hvc_write unconditionally
  - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups"
  - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
  - Input: iqs7222 - avoid enabling unused interrupts
  - mm/khugepaged: fix the address passed to notifier on testing young
  - btrfs: fix corruption reading compressed range when block size is smaller than page size
  - btrfs: use readahead_expand() on compressed extents
  - mm/damon/sysfs: fix use-after-free in state_show()
  - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
  - mtd: nand: raw: atmel: Fix comment in timings preparation
  - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
  - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
  - mm/damon/core: set quota->charged_from to jiffies at first charge window
  - fuse: prevent overflow in copy_file_range return value
  - fuse: check if copy_file_range() returns larger than requested size
  - mtd: rawnand: stm32_fmc2: fix ECC overwrite
  - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
  - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups
  - i2c: i801: Hide Intel Birch Stream SoC TCO WDT
  - ocfs2: fix recursive semaphore deadlock in fiemap call
  - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
  - compiler-clang.h: define __SANITIZE_*__ macros only when undefined
  - EDAC/altera: Delete an inappropriate dma_free_coherent() call
  - rcu-tasks: Maintain real-time response in rcu_tasks_postscan()
  - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks
  - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks
  - s390/cpum_cf: Deny all sampling events by counter PMU
  - NFSv4/flexfiles: Fix layout merge mirror check.
  - NFSv4.2: Serialise O_DIRECT i/o and copy range
  - NFSv4.2: Serialise O_DIRECT i/o and clone range
  - NFSv4.2: Serialise O_DIRECT i/o and fallocate()
  - NFS: Serialise O_DIRECT i/o and truncate()
  - fs/nfs/io: make nfs_start_io_*() killable
  - ftrace/samples: Fix function size computation
  - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
  - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
  - media: i2c: imx214: Fix link frequency validation
  - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs()
  - nfsd: Fix a regression in nfsd_setattr()
  - kasan: fix GCC mem-intrinsic prefix with sw tags
  - kunit: kasan_test: disable fortify string checker on kasan_strings() test
  - io_uring: fix kabi broken in struct io_ring_ctx
  - io_uring: Support forcing sq thread to be idle and woken up by hrtimer
  - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
  - uacce: fix isolate sysfs check condition
  - Revert "uacce: fix isolate sysfs check condition"
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
  - smb/server: fix refcount leak in smb2_open()
  - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
  - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
  - md: suspend array while updating raid_disks via sysfs
  - scsi: core: Wake up the error handler when final completions race against each other
  - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
  - ub:ubfi: Release the chosen node
  - ub:ubus: Delete unused functions
  - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption


author: Li Nan <linan122@huawei.com> - 6.6.0-142.0.0.136
changelog:
  - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise.
  - !21192 urma: bugfix of ubagg&ubcore&uburma
  - !21183  platform/x86: classmate-laptop: Add missing NULL pointer checks
  - urma: bugfix of ubagg&ubcore&uburma
  - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise.
  - platform/x86: classmate-laptop: Add missing NULL pointer checks
  - !21167 urma: fix kernel codecheck issues.
  - !21174 urma: change return value for provider err
  - !21127 urma: copy linked ports when importing bond jetty/seg
  - !20247 ubcore: query primary eid in ipourma loopback mode.
  - !21077 Fix hisi cca bugs
  - ubcore: route query refine and ipo loopback adapt.
  - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device.
  - hisi-cca-da: Write NS STE for PF drivers.
  - hisi-cca-da: Provide IO interfaces
  - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices
  - !21045  scsi: hisi_sas: Fix NULL pointer exception when do user_scan()
  - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe.
  - !21165  tools/interference: add ifstool utility for kernel interference statistics
  - !21166 urma: fix jfce uaf in batch cleanup
  - !21043 urma: fix tjetty ref in ping server
  - urma: change return value for provider err
  - !21128  sched/rt: Skip currently executing CPU in rto_next_cpu()
  - !21129  procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  - urma: fix jfce uaf in batch cleanup
  - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver
  - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches
  - urma: fix kernel codecheck issues.
  - tools/interference: add ifstool utility for kernel interference statistics
  - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor
  - !21092  kexec: derive purgatory entry from symbol
  - !21154  sched: Add SOFT_DOMAIN feature interface for cgroup2
  - !21153  fix CVE-2025-39981
  - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm"
  - urma: fix tjetty ref in ping server
  - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA
  - hisi-cca-da: Improve hisi cca dev validate and delegate
  - hisi-cca-da: Fix smmu enable rme problem
  - hisi-cca-da: Fix msi region shared problem
  - sched: Add SOFT_DOMAIN feature interface for cgroup2
  - Bluetooth: MGMT: Fix memory leak in set_ssp_complete
  - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
  - overflow: Introduce __DEFINE_FLEX for having no initializer
  - overflow: Fix direct struct member initialization in _DEFINE_FLEX()
  - overflow: Change DEFINE_FLEX to take __counted_by member
  - overflow: add DEFINE_FLEX() for on-stack allocs
  - Bluetooth: MGMT: Fix possible UAFs
  - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete()
  - !21103  Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()"
  - !21104 v2  vsock/virtio: cap TX credit to local buffer size
  - !21070  Fixes CVE-2026-23100
  - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs
  - !21088  ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
  - RDMA/hns: Support configure and query the CNP DSCP through sysfs
  - RDMA/hns: Support query FW cap bit
  - RDMA/hns: Support query HW ID.
  - !20934  smb/server: fix refcount leak in parse_durable_handle_context()
  - !21004  regmap: Fix race condition in hwspinlock irqsave routine
  - !19568 [OLK-6.6]fix txgbe clang compile warning
  - urma: copy linked ports when importing bond jetty/seg
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  - sched/rt: Skip currently executing CPU in rto_next_cpu()
  - !21073  scsi: qla2xxx: Fix bsg_done() causing double free
  - !21114  CVE-2024-57979
  - !21113  iommu: disable SVA when CONFIG_X86 is set
  - !20957  dmaengine: xilinx: xdma: Fix regmap max_register
  - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset
  - pps: Fix a use-after-free - fix kabi
  - pps: Fix a use-after-free
  - !21078  of: unittest: Fix memory leak in unittest_data_add()
  - !21079  *** fix CVE-2026-23208 ***
  - !21082  ALSA: aloop: Fix racy access at PCM trigger
  - !21083  bus: fsl-mc: fix use-after-free in driver_override_show()
  - iommu: disable SVA when CONFIG_X86 is set
  - vsock/virtio: cap TX credit to local buffer size
  - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()"
  - !20983 Fix CVE-2026-23139
  - !20878 Fix CVE-2026-23230
  - kexec: derive purgatory entry from symbol
  - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
  - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
  - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"
  - rtc: interface: Alarm race handling should not discard preceding error
  - perf test stat tests: Fix for virtualized machines
  - perf test stat: Update test expectations and events
  - perf test stat: Avoid hybrid assumption when virtualized
  - writeback: Avoid excessively long inode switching times
  - writeback: Avoid softlockup when switching many inodes
  - cramfs: Verify inode mode when loading from disk
  - fs: Add 'initramfs_options' to set initramfs mount options
  - minixfs: Verify inode mode when loading from disk
  - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume
  - irqchip/sifive-plic: Make use of __assign_bit()
  - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled
  - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
  - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
  - s390/bpf: Describe the frame using a struct instead of constants
  - s390/bpf: Centralize frame offset calculations
  - s390/bpf: Change seen_reg to a mask
  - ACPI: property: Do not pass NULL handles to acpi_attach_data()
  - ACPI: property: Add code comments explaining what is going on
  - ACPI: property: Disregard references in data-only subnode lists
  - ACPI: battery: Add synchronization between interface updates
  - ACPI: battery: Check for error code from devm_mutex_init() call
  - ACPI: battery: initialize mutexes through devm_ APIs
  - ACPI: battery: allocate driver data through devm_ APIs
  - arm64: mte: Do not flag the zero page as PG_mte_tagged
  - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
  - !20790  dm: use bio_clone_blkg_association
  - ipmi: Add HiSilicon IPMI Page Soft Offline driver
  - net: unic: Resolve network unavailability caused by concurrent activation and reset
  - net: unic: Provide the DFX capability for querying MNG table
  - net: unic: Delete the elr reset process after the tx timeout
  - bus: fsl-mc: fix use-after-free in driver_override_show()
  - ALSA: aloop: Fix racy access at PCM trigger
  - ALSA: usb-audio: Use the right limit for PCM OOB check
  - ALSA: usb-audio: Prevent excessive number of frames
  - of: unittest: Fix memory leak in unittest_data_add()
  - !21034  CVE-2026-23140
  - !21016  net: fix segmentation of forwarding fraglist GRO
  - !21017  mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
  - !21018  CVE-2026-23209
  - !21019  ipv6: annotate data-race in ndisc_router_discovery()
  - !20881  ipvlan: Make the addrs_lock be per port
  - rme: Imporve range delegate
  - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
  - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release
  - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan()
  - misc: fastrpc: Save actual DMA size in fastrpc_map structure
  - misc: fastrpc: Add missing dev_err newlines
  - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
  - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
  - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
  - media: mc: Clear minor number before put device
  - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
  - ACPICA: Allow to skip Global Lock initialization
  - ext4: validate ea_ino and size in check_xattrs
  - ext4: correctly handle queries for metadata mappings
  - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
  - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
  - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
  - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
  - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0
  - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
  - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
  - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
  - selftests: mptcp: join: validate C-flag + def limit
  - spi: cadence-quadspi: Flush posted register writes before DAC access
  - spi: cadence-quadspi: Flush posted register writes before INDAC access
  - PCI: tegra194: Handle errors in BPMP response
  - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
  - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
  - PCI: rcar-host: Drop PMSR spinlock
  - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
  - PCI/AER: Support errors introduced by PCIe r6.0
  - PCI/AER: Fix missing uevent on recovery when a reset is requested
  - PCI/ERR: Fix uevent on failure to recover
  - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
  - PCI/sysfs: Ensure devices are powered for config reads
  - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock
  - rseq/selftests: Use weak symbol reference, not definition, to link with glibc
  - rtc: interface: Fix long-standing race when setting alarm
  - rtc: interface: Ensure alarm irq is enabled when UIE is enabled
  - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
  - mmc: core: SPI mode remove cmd7
  - mtd: rawnand: fsmc: Default to autodetect buswidth
  - xtensa: simdisk: add input size check in proc_write_simdisk
  - sparc: fix error handling in scan_one_device()
  - sparc64: fix hugetlb for sun4u
  - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
  - sched/deadline: Fix race in push_dl_task()
  - pwm: berlin: Fix wrong register in suspend/resume
  - powerpc/pseries/msi: Fix potential underflow and leak issue
  - powerpc/powernv/pci: Fix underflow and leak issue
  - power: supply: max77976_charger: fix constant current reporting
  - pinctrl: samsung: Drop unused S3C24xx driver data
  - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
  - parisc: don't reference obsolete termio struct for TC* constants
  - openat2: don't trigger automounts with RESOLVE_NO_XDEV
  - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify
  - lib/genalloc: fix device leak in of_gen_pool_get()
  - KEYS: trusted_tpm1: Compare HMAC values in constant time
  - iommu/vt-d: PRS isn't usable if PDS isn't supported
  - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
  - init: handle bootloader identifier in kernel parameters
  - iio: xilinx-ams: Unmask interrupts after updating alarms
  - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK
  - iio: frequency: adf4350: Fix prescaler usage.
  - iio: dac: ad5421: use int type to store negative error codes
  - iio: dac: ad5360: use int type to store negative error codes
  - fs/ntfs3: Fix a resource leak bug in wnd_extend()
  - fbdev: Fix logic error in "offb" name match
  - crypto: rockchip - Fix dma_unmap_sg() nents value
  - crypto: atmel - Fix dma_unmap_sg() direction
  - crypto: aspeed - Fix dma_unmap_sg() direction
  - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
  - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
  - bus: mhi: ep: Fix chained transfer handling in read path
  - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
  - blk-crypto: fix missing blktrace bio split events
  - drm/nouveau: fix bad ret code in nouveau_bo_move_prep
  - drm/rcar-du: dsi: Fix 1/2/3 lane support
  - media: lirc: Fix error handling in lirc_register()
  - media: venus: firmware: Use correct reset sequence for IRIS2
  - media: pci: ivtv: Add missing check after DMA map
  - media: mc: Fix MUST_CONNECT handling for pads with no links
  - media: i2c: mt9v111: fix incorrect type for ret
  - media: cx18: Add missing check after DMA map
  - firmware: meson_sm: fix device leak at probe
  - xen/events: Update virq_to_irq on migration
  - xen/events: Return -EEXIST for bound VIRQs
  - xen/manage: Fix suspend error path
  - xen/events: Cleanup find_virq() return codes
  - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
  - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
  - arm64: dts: ti: k3-am62a-main: Fix main padcfg length
  - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
  - arm64: dts: qcom: msm8939: Add missing MDSS reset
  - arm64: dts: qcom: msm8916: Add missing MDSS reset
  - ACPI: debug: fix signedness issues in read/write helpers
  - ACPI: property: Fix buffer properties extraction for subnodes
  - gpio: wcd934x: mark the GPIO controller as sleeping
  - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
  - smb: client: fix missing timestamp updates after utime(2)
  - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
  - drm/amd/display: Properly disable scaling on DCE6
  - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
  - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
  - drm/amdgpu: Add additional DCE6 SCL registers
  - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
  - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
  - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
  - perf python: split Clang options when invoking Popen
  - tools build: Align warning options with perf
  - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
  - drm/vmwgfx: Fix copy-paste typo in validation
  - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
  - LoongArch: Init acpi_gbl_use_global_lock to false
  - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init()
  - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
  - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
  - clk: tegra: do not overallocate memory for bpmp clocks
  - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
  - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
  - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags()
  - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
  - perf evsel: Ensure the fallback message is always written to
  - perf tools: Add fallback for exclude_guest
  - perf test: Add a test for default perf stat command
  - perf test: Don't leak workload gopipe in PERF_RECORD_*
  - perf session: Fix handling when buffer exceeds 2 GiB
  - perf arm_spe: Correct memory level for remote access
  - perf arm_spe: Correct setting remote access
  - rtc: optee: fix memory leak on driver removal
  - rtc: x1205: Fix Xicor X1205 vendor prefix
  - perf util: Fix compression checks returning -1 as bool
  - clk: at91: peripheral: fix return value
  - libperf event: Ensure tracing data is multiple of 8 sized
  - perf evsel: Avoid container_of on a NULL leader
  - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
  - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
  - clocksource/drivers/clps711x: Fix resource leaks in error paths
  - fscontext: do not consume log entries when returning -EMSGSIZE
  - fs: always return zero on success from replace_fd()
  - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches
  - scsi: qla2xxx: Fix bsg_done() causing double free
  - !21065 Fix CVE-2026-23069
  - !21062 v4  Support multi-level cgroup
  - !20987 Fix CVE-2026-23212
  - !20982 Fix CVE-2026-23119
  - !20979 Fix CVE-2026-23111
  - !20974 Fix CVE-2026-23099
  - !20973 Fix CVE-2026-23105
  - !20972 Fix CVE-2026-23074
  - !20884  ksmbd: add chann_lock to protect ksmbd_chann_list xarray
  - !20947 Fix CVE-2026-23101
  - ext4: clear i_state_flags when alloc inode
  - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
  - Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
  - fs/ntfs3: fix mount failure for sparse runs in run_unpack()
  - !20825  efivarfs: fix error propagation in efivar_entry_get()
  - !20824  io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem
  - mm/rmap: fix two comments related to huge_pmd_unshare()
  - mm/hugetlb: fix two comments related to huge_pmd_unshare()
  - mm/hugetlb: fix hugetlb_pmd_shared()
  - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
  - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers
  - vsock/virtio: fix potential underflow in virtio_transport_get_credit()
  - !21001 Fix CVE-2026-23229
  - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
  - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode
  - !20999 Fix CVE-2026-23173
  - usb: typec: tipd: Clear interrupts first
  - bus: fsl-mc: Check return value of platform_get_resource()
  - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()
  - Input: atmel_mxt_ts - allow reset GPIO to sleep
  - misc: fastrpc: Skip reference for DMA handles
  - misc: fastrpc: fix possible map leak in fastrpc_put_args
  - misc: fastrpc: Fix fastrpc_map_lookup operation
  - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
  - ext4: fix checks for orphan inodes
  - ksmbd: fix error code overwriting in smb2_get_info_filesystem()
  - LoongArch: Automatically disable kaslr if boot from kexec_file
  - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
  - mfd: rz-mtu3: Fix MTU5 NFCR register offset
  - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down
  - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
  - vhost: vringh: Modify the return value check
  - net/mlx5: fw reset, add reset timeout work
  - net/mlx5: pagealloc: Fix reclaim race during command interface teardown
  - net/mlx5: Stop polling for command response if interface goes down
  - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
  - nfp: fix RSS hash key size when RSS is not supported
  - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands
  - drivers/base/node: fix double free in register_one_node()
  - hwrng: ks-sa - fix division by zero in ks_sa_rng_init
  - KEYS: X.509: Fix Basic Constraints CA flag parsing
  - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
  - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
  - vhost: vringh: Fix copy_to_iter return value check
  - RDMA/siw: Always report immediate post SQ errors
  - usb: vhci-hcd: Prevent suspending virtually attached devices
  - NFSv4.1: fix backchannel max_resp_sz verification check
  - coresight: trbe: Return NULL pointer for allocation failures
  - coresight: etm4x: Support atclk
  - coresight-etm4x: Conditionally access register TRCEXTINSELR
  - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
  - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert()
  - vfio/pds: replace bitmap_free with vfree
  - sparc: fix accurate exception reporting in copy_{from,to}_user for M7
  - sparc: fix accurate exception reporting in copy_to_user for Niagara 4
  - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
  - wifi: mac80211: fix Rx packet handling when pubsta information is not available
  - wifi: ath10k: avoid unnecessary wait for service ready message
  - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
  - IB/sa: Fix sa_local_svc_timeout_ms read race
  - RDMA/core: Resolve MAC of next-hop device without ARP support
  - f2fs: fix zero-sized extent for precache extents
  - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
  - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
  - scsi: qla2xxx: edif: Fix incorrect sign of error code
  - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
  - f2fs: fix to truncate first page in error path of f2fs_truncate()
  - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
  - wifi: mt76: fix potential memory leak in mt76_wmac_probe()
  - RDMA/cm: Rate limit destroy CM ID timeout error message
  - drivers/base/node: handle error properly in register_one_node()
  - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
  - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
  - iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
  - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed()
  - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
  - fs: ntfs3: Fix integer overflow in run_unpack()
  - drm/msm/dpu: fix incorrect type for ret
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
  - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
  - misc: genwqe: Fix incorrect cmd field being reported in error
  - usb: gadget: configfs: Correctly set use_os_string at bind
  - usb: phy: twl6030: Fix incorrect type for ret
  - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
  - tcp: fix __tcp_close() to only send RST when required
  - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
  - wifi: mwifiex: send world regulatory domain to driver
  - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
  - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
  - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
  - drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
  - drm/amd/pm: Fix si_upload_smc_data (v3)
  - drm/amd/pm: Disable ULV even if unsupported (v3)
  - drm/amdgpu: Power up UVD 3 for FW validation (v2)
  - coresight: Only register perf symlink for sinks with alloc_buffer
  - inet: ping: check sock_net() in ping_get_port() and ping_lookup()
  - media: st-delta: avoid excessive stack usage
  - ALSA: lx_core: use int type to store negative error codes
  - media: rj54n1cb0c: Fix memleak in rj54n1_probe()
  - scsi: myrs: Fix dma_alloc_coherent() error check
  - hwrng: nomadik - add ARM_AMBA dependency
  - crypto: keembay - Add missing check after sg_nents_for_len()
  - drm/amd/display: Remove redundant semicolons
  - serial: max310x: Add error checking in probe()
  - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
  - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
  - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
  - media: zoran: Remove zoran_fh structure
  - drm/bridge: it6505: select REGMAP_I2C
  - f2fs: fix condition in __allow_reserved_blocks()
  - drm/radeon/r600_cs: clean up of dead code in r600_cs
  - drm/panel: novatek-nt35560: Fix invalid return value
  - bpf: Enforce expected_attach_type for tailcall compatibility
  - i2c: designware: Add disabling clocks when probe fails
  - i2c: designware: Fix clock issue when PM is disabled
  - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
  - thermal/drivers/qcom/lmh: Add missing IRQ includes
  - thermal/drivers/qcom: Make LMH select QCOM_SCM
  - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems
  - once: fix race by moving DO_ONCE to separate section
  - smp: Fix up and expand the smp_call_function_many() kerneldoc
  - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
  - i3c: master: svc: Recycle unused IBI slot
  - i3c: master: svc: Use manual response for IBI events
  - ACPICA: Fix largest possible resource descriptor index
  - pwm: tiehrpwm: Fix corner case in clock divisor calculation
  - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
  - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
  - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names
  - cpuidle: qcom-spm: fix device and OF node leaks at probe
  - firmware: firmware: meson-sm: fix compile-test default
  - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0
  - null_blk: Fix the description of the cache_size module argument
  - pinctrl: renesas: Use int type to store negative error codes
  - power: supply: cw2015: Fix a alignment coding style issue
  - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()
  - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property
  - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS
  - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax
  - block: use int to store blk_stack_limits() return value
  - selftests/nolibc: fix EXPECT_NZ macro
  - regulator: scmi: Use int type to store negative error codes
  - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
  - ARM: at91: pm: fix MCKx restore routine
  - pinctrl: meson-gxl: add missing i2c_d pinmux
  - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
  - leds: flash: leds-qcom-flash: Update torch current clamp setting
  - ARM: dts: renesas: porter: Fix CAN pin group
  - libbpf: Fix reuse of DEVMAP
  - bpf: Remove migrate_disable in kprobe_multi_link_prog_run
  - bpf/selftests: Fix test_tcpnotify_user
  - regmap: Remove superfluous check for !config in __regmap_init()
  - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
  - x86/vdso: Fix output operand size of RDPID
  - smb: server: fix IRD/ORD negotiation with the client
  - coresight: trbe: Prevent overflow in PERF_IDX2OFF()
  - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
  - selftests: arm64: Check fread return value in exec_target
  - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
  - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
  - filelock: add FL_RECLAIM to show_fl_flags() macro
  - !21022  KVM: Don't clobber irqfd routing type when deassigning irqfd
  - !20998  ceph: fix oops due to invalid pointer for kfree() in parse_longname()
  - !21023  l2tp: avoid one data-race in l2tp_tunnel_del_work()
  - xsched: fix potential NULL dereference in xsched_quota_timeout_update
  - xsched: remove the standalone xcu_cfs_cg_deinit() helper
  - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle
  - xsched: simplify root group check by direct comparison with root_xcg
  - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length
  - xsched/core: immediate cleanup of remaining operators on task exit
  - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization
  - xsched: modify xcu_cg_initialize_components helper
  - xsched: refactor xsched_entity initialization
  - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq
  - xsched: harden and clarify xcu_move_task() logic
  - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs
  - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling
  - xsched/quota: support multi-level cgroup
  - xsched: remove redundant xcu parameter from dequeue_ctx
  - xsched: update group shares using xcu_grp_shares_add/sub helpers
  - xsched: delete unused code
  - xsched/cfs: propagate group activation/deactivation up the hierarchy
  - xsched/cfs: move xruntime updates to pick/put paths
  - xsched: add has_running hook to xsched classes for wake-up eligibility check
  - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches
  - scsi: hisi_sas: Fix NULL pointer exception when do user_scan()
  - !21013  CVE-2026-23177
  - !21007  bonding: fix use-after-free due to enslave fail after slave array update
  - !21006  net: Fix CVE-2026-23204
  - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path
  - bpf, test_run: Subtract size of xdp_frame from allowed metadata size
  - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN
  - bpf: Make variables in bpf_prog_test_run_xdp less confusing
  - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K
  - !21015  libceph: reset sparse-read state in osd_fault()
  - !21024 ub: udma: bugfix related to print messages.
  - !20980 Fix CVE-2026-23126
  - !20922 Fix CVE-2026-23133
  - ub: udma: bugfix related to print messages.
  - l2tp: avoid one data-race in l2tp_tunnel_del_work()
  - KVM: Don't clobber irqfd routing type when deassigning irqfd
  - ipv6: annotate data-race in ndisc_router_discovery()
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path
  - macvlan: fix error recovery in macvlan_common_newlink()
  - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
  - net: fix segmentation of forwarding fraglist GRO
  - can: rcar_canfd: Fix CAN-FD mode as default
  - libceph: reset sparse-read state in osd_fault()
  - !21008 uvb: fix cis call return value and obtain
  - mm, shmem: prevent infinite loop on truncate race
  - mm/shmem, swap: fix race of truncate and swap entry split
  - net/9p: fix double req put in p9_fd_cancelled
  - riscv: mm: Do not restrict mmap address based on hint
  - riscv: mm: Use hint address in mmap if available
  - driver core/PM: Set power.no_callbacks along with power.no_pm
  - serial: stm32: allow selecting console when the driver is module
  - hid: fix I2C read buffer overflow in raw_event() for mcp2221
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
  - ALSA: usb-audio: Kill timer properly at removal
  - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list
  - can: rcar_canfd: Fix controller mode setting
  - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled
  - btrfs: ref-verify: handle damaged extent root tree
  - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
  - perf subcmd: avoid crash in exclude_cmds when excludes is empty
  - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list
  - dm-integrity: limit MAX_TAG_SIZE to 255
  - ASoC: amd: acp: Adjust pdm gain value
  - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
  - USB: serial: option: add SIMCom 8230C compositions
  - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
  - !20931 Fix CVE-2026-23060
  - uvb: fix cis call return value and obtain
  - bonding: fix use-after-free due to enslave fail after slave array update
  - net/sched: cls_u32: use skb_header_pointer_careful()
  - net: add skb_header_pointer_careful() helper
  - regmap: Fix race condition in hwspinlock irqsave routine
  - crypto: virtio - Add spinlock protection with virtqueue notification
  - net/mlx5e: TC, delete flows only for existing peers
  - !20967 net: hns3: modify code of judging if SMMU DMA is enabled
  - ceph: fix oops due to invalid pointer for kfree() in parse_longname()
  - !20969 Fix CVE-2026-23125
  - !20948 v4  arm64: Add memory poison recovery support for various paths
  - !20975  CVE-2026-23102
  - !20977 v4  support apei_page_offline_policy
  - bonding: annotate data-races around slave->last_rx
  - netfilter: nf_conncount: update last_gc only when GC has been performed
  - bonding: provide a net pointer to __skb_flow_dissect()
  - netdevsim: fix a race issue related to the operation on bpf_bound_progs list
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
  - apei/ghes: Add sysctl interface to control soft-offline page isolation
  - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages"
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
  - arm64/fpsimd: signal: Fix restoration of SVE context
  - arm64/fpsimd: signal: Consistently read FPSIMD context
  - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state
  - bonding: limit BOND_MODE_8023AD to Ethernet devices
  - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
  - net/sched: Enforce that teql can only be used as root qdisc
  - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
  - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers
  - net: hns3: modify code of judging if SMMU DMA is enabled
  - dmaengine: xilinx: xdma: Fix regmap max_register
  - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem
  - ub:ubus: Avoid getting empty uent from ubc
  - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory
  - arm64: send sig fault for user task when apei_claim_sea fails
  - arm64: add ras log during do_sea
  - arm64: move getting valid siaddr to the top of do_sea
  - arm64: mm: shmem: support poison recovery from shmem_file_read_iter()
  - arm64: fs: support poison recovery from __kernel_read()
  - iov_iter: add mc support for copy_page_to_iter
  - arm64: mm: support recovery from copy_{from/to}_user_page()
  - iov_iter: get rid of 'copy_mc' flag
  - leds: led-class: Only Add LED to leds_list when it is fully ready
  - wifi: ath10k: fix dma_free_coherent() pointer
  - smb/server: fix refcount leak in parse_durable_handle_context()
  - ksmbd: add chann_lock to protect ksmbd_chann_list xarray
  - ipvlan: Make the addrs_lock be per port
  - smb: client: split cached_fid bitfields to avoid shared-byte RMW races
  - efivarfs: fix error propagation in efivar_entry_get()
  - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  - dm: use bio_clone_blkg_association
  - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor
  - net: txgbe: fix clang compile warning


author: Li Nan <linan122@huawei.com> - 6.6.0-143.0.0.137
changelog:
  - !21258 ub:hisi-ubus: Review of Readability Modifications
  - !21293 urma: update urma_admin agg expose flag
  - urma: update urma_admin agg expose
  - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches
  - !21270  l2tp: fix double dst_release() on sk_dst_cache race
  - !21272  mptcp: fix soft lockup in mptcp_recvmsg()
  - !20994 urma: support comm endpoint
  - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo'
  - !21271 urma: fix useless copy_logic_device and use expose instead.
  - urma: support non-root execute in containers
  - urma: fix useless copy_logic_device and use expose instead.
  - ub:hisi-ubus: Review of Readability Modifications
  - mptcp: fix soft lockup in mptcp_recvmsg()
  - mptcp: fix MSG_PEEK stream corruption
  - l2tp: fix double dst_release() on sk_dst_cache race
  - urma: update urma_admin agg expose
  - !21252  arm64: Set __nocfi on swsusp_arch_resume()
  - !21226 hisi-cca-da: Fix potential data overflow.
  - !19706 [OLK-6.6]:update patches for sw64 architecture
  - !21253  xattr: switch to CLASS(fd)
  - !21255 ub: cdma: cdma bug fix
  - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq
  - ub: cdma: cdma bug fix
  - xattr: switch to CLASS(fd)
  - arm64: Set __nocfi on swsusp_arch_resume()
  - hisi-cca-da: Fix error where multiple devices share the same SMMU domain.
  - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq
  - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist
  - !21237 urma: change warn log into info for topo query
  - hisi-cca-da: Fix potential data overflow.
  - !21210 urma: fix tjetty tp type in ping server
  - !21224  arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc()
  - !21240 urma: update urma_admin agg expose
  - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS
  - urma: update urma_admin agg expose
  - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS
  - !21238 urma: delete ubcm_genl implementation
  - urma: delete ubcm_genl implementation
  - urma: change warn log into info for topo query
  - tcpm: allow looking for role_sw device in the main node
  - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
  - most: usb: fix double free on late probe failure
  - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
  - net: enetc: fix build warning when PAGE_SIZE is greater than 128K
  - gpio: ljca: Initialize num before accessing item in ljca_gpio_config
  - s390/cio: Update purge function to unregister the unused subchannels
  - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
  - xfs: always warn about deprecated mount options
  - devcoredump: Fix circular locking dependency with devcd->mutex.
  - serial: 8250_mtk: Enable baud clock and manage in runtime PM
  - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018
  - serial: 8250_dw: handle reset control deassert error
  - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
  - tcpm: switch check for role_sw device with fw_node
  - most: usb: hdm_probe: Fix calling put_device() before device initialization
  - most: usb: Fix use-after-free in hdm_disconnect
  - mei: me: add wildcat lake P DID
  - comedi: fix divide-by-zero in comedi_buf_munge()
  - binder: remove "invalid inc weak" check
  - x86/microcode: Fix Entrysign revision check for Zen1/Naples
  - xhci: dbc: enable back DbC in resume if it was enabled before suspend
  - usb: raw-gadget: do not limit transfer length
  - usb/core/quirks: Add Huawei ME906S to wakeup quirk
  - USB: serial: option: add Telit FN920C04 ECM compositions
  - USB: serial: option: add Quectel RG255C
  - USB: serial: option: add UNISOC UIS7720
  - sched: Remove never used code in mm_cid_get()
  - io_uring: correct __must_hold annotation in io_install_fixed_file
  - gpio: ljca: Fix duplicated IRQ mapping
  - gpio: update Intel LJCA USB GPIO driver
  - hwmon: (sht3x) Fix error handling
  - RISC-V: Don't print details of CPUs disabled in DT
  - RISC-V: Define pgprot_dmacoherent() for non-coherent devices
  - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode
  - spi: spi-nxp-fspi: add extra delay after dll locked
  - selftests: mptcp: join: mark implicit tests as skipped if not supported
  - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported
  - net: ravb: Ensure memory write completes before ringing TX doorbell
  - net: ravb: Enforce descriptor type ordering
  - net: usb: rtl8150: Fix frame padding
  - net: stmmac: dwmac-rk: Fix disabling set_clock_selection
  - ocfs2: clear extent cache after moving/defragmenting extents
  - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
  - cifs: Fix TCP_Server_Info::credits to be signed
  - gpio: 104-idio-16: Define maximum valid register address offset
  - gpio: pci-idio-16: Define maximum valid register address offset
  - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
  - net: bonding: fix possible peer notify event loss or dup issue
  - arm64, mm: avoid always making PTE dirty in pte_mkwrite()
  - !21236  Fix TLBI broadcast optimization loss and incorrect dvmbm handling
  - KVM: arm64: Fix CCA guest panic when dvmbm is enabled
  - !21228 ub:ubus: add reset function
  - !21220  selftests/bpf: Add cross-build support for urandom_read et al
  - !21214  optimize lightweight load balancing
  - ub:ubus: add reset function
  - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios
  - !21221 iommu/ummu: Modify the ummu/tid permission
  - selftests: net: fix server bind failure in sctp_vrf.sh
  - selftests/net: convert sctp_vrf.sh to run it in unique namespace
  - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb()
  - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
  - net: enetc: correct the value of ENETC_RXB_TRUESIZE
  - net: enetc: fix the deadlock of enetc_mdio_lock
  - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush().
  - rtnetlink: Allow deleting FDB entries in user namespace
  - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size()
  - Unbreak 'make tools/*' for user-space targets
  - smb: server: let smb_direct_flush_send_list() invalidate a remote key first
  - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure
  - m68k: bitops: Fix find_*_bit() signatures
  - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure
  - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
  - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
  - dlm: check for defined force value in dlm_lockspace_release
  - hfs: validate record offset in hfsplus_bmap_alloc
  - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
  - hfs: make proper initalization of struct hfs_find_data
  - hfs: clear offset and space out of valid records in b-tree node
  - nios2: ensure that memblock.current_limit is set when setting pfn limits
  - exec: Fix incorrect type for ret
  - !21222 ub: ubase: Added the interface for obtaining hardware version information
  - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing
  - !21216  Fix RT priority Setting
  - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc()
  - iommu/ummu: Modify the ummu/tid permission
  - ub: ubase&unic: Optimize the code for log information
  - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long
  - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset
  - ub:ub_fwctl:Add a mutex lock
  - ub:ub_fwctl:Add interception and validation for unsupported environment commands
  - ub: ubase: Added the interface for obtaining hardware version information.
  - selftests/bpf: Add cross-build support for urandom_read et al
  - !21217  Revert "drivers: core: synchronize really_probe() and dev_uevent()"
  - !21205  arm64/mpam: Fix wrong closid config access when CDP is enabled
  - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches
  - Revert "drivers: core: synchronize really_probe() and dev_uevent()"
  - !21213 ub:ubus: alter nl ssu credit ras recover
  - iommu/ummu: Optimize the duplicate code
  - xsched: initialize tgid before configuring RT priority
  - xsched: fix typo in xcu cgroup subsys released callback name
  - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness
  - sched: expand sysctl_sched_features to unsigned long
  - sched: Fix kabi breakage of struct sched_domain for newidle_stats
  - sched/fair: Proportional newidle balance
  - ub:ubus: alter nl ssu credit ras recover
  - ub:ubus add some missing code to openeuler
  - change bus instance create EID_BYPASS
  - urma: fix tjetty tp type in ping server
  - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info'
  - iommu/ummu: Delete the unused interface of the UMMU
  - arm64/mpam: Fix wrong closid config access when CDP is enabled
  - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled"
  - iommu/ummu: Remove the constraint that l_tid must be valid
  - iommu/ummu: Remove redundant read register operations
  - iommu/ummu: Optimize the UMMU instance matching logic
  - iommu/ummu: Improve the reliability of ummu initialization
  - iommu/ummu: Modify parameter for separated page table
  - drm/amd: Fix suspend failure with secure display TA
  - PCI: tegra194: Reset BARs when running in PCIe endpoint mode
  - PCI: j721e: Fix programming sequence of "strap" settings
  - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists
  - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL
  - PCI/sysfs: Ensure devices are powered for config reads (part 2)
  - nfsd: decouple the xprtsec policy check from check_nfsd_access()
  - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine
  - xfs: use deferred intent items for reaping crosslinked blocks
  - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
  - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure
  - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling
  - phy: cdns-dphy: Store hs_clk_rate and return it
  - iio: imu: inv_icm42600: Simplify pm_runtime setup
  - PM: runtime: Add new devm functions
  - xfs: fix log CRC mismatches between i386 and other architectures
  - xfs: rename the old_crc variable in xlog_recover_process
  - NFSD: Fix last write offset handling in layoutcommit
  - NFSD: Minor cleanup in layoutcommit processing
  - NFSD: Rework encoding and decoding of nfsd4_deviceid
  - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
  - block: fix race between set_blocksize and read paths
  - arm64: errata: Apply workarounds for Neoverse-V3AE
  - arm64: cputype: Add Neoverse-V3AE definitions
  - selftests: arg_parsing: Ensure data is flushed to disk before reading.
  - HID: multitouch: fix name of Stylus input devices
  - HID: hid-input: only ignore 0 battery events for digitizers
  - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
  - selftests/bpf: make arg_parsing.c more robust to crashes
  - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
  - drm/rockchip: vop2: use correct destination rectangle height check
  - drm/amd/powerplay: Fix CIK shutdown temperature
  - drm/i915/guc: Skip communication warning on reset in progress
  - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
  - ASoC: nau8821: Generalize helper to clear IRQ status
  - ASoC: nau8821: Cancel jdet_work before handling jack ejection
  - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec
  - drm/bridge: lt9211: Drop check for last nibble of version register
  - riscv: kprobes: Fix probe address validation
  - nvme-multipath: Skip nr_active increments in RETRY disposition
  - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset
  - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
  - tls: don't rely on tx_work during send()
  - tls: always set record_type in tls_process_cmsg
  - tls: wait for async encrypt in case of error during latter iterations of sendmsg
  - net: tls: wait for async completion on last message
  - tls: trim encrypted message to match the plaintext on short splice
  - tg3: prevent use of uninitialized remote_adv and local_adv variables
  - tcp: fix tcp_tso_should_defer() vs large RTT
  - amd-xgbe: Avoid spurious link down messages during interface toggle
  - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
  - doc: fix seg6_flowlabel path
  - net: dlink: handle dma_map_single() failure properly
  - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
  - dax: skip read lock assertion for read-only filesystems
  - HID: multitouch: fix sticky fingers
  - usb: gadget: f_rndis: Refactor bind path to use __free()
  - usb: gadget: f_ncm: Refactor bind path to use __free()
  - usb: gadget: f_acm: Refactor bind path to use __free()
  - usb: gadget: f_ecm: Refactor bind path to use __free()
  - usb: gadget: Introduce free_usb_request helper
  - usb: gadget: Store endpoint pointer in usb_request
  - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release
  - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain()
  - drm/exynos: exynos7_drm_decon: remove ctx->suspended
  - drm/exynos: exynos7_drm_decon: properly clear channels during bind
  - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions
  - drm/msm/a6xx: Fix PDC sleep sequence
  - drm/msm/adreno: De-spaghettify the use of memory barriers
  - eventpoll: Replace rwlock with spinlock
  - epoll: Remove ep_scan_ready_list() in comments
  - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
  - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
  - drm/amd: Check whether secure display TA loaded successfully
  - drm/amdgpu: use atomic functions with memory barriers for vm fault info
  - cifs: parse_dfs_referrals: prevent oob on malformed input
  - can: gs_usb: increase max interface to U8_MAX
  - can: gs_usb: gs_make_candev(): populate net_device->dev_port
  - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running
  - ext4: wait for ongoing I/O to complete before freeing blocks
  - jbd2: ensure that all ongoing I/O complete before freeing blocks
  - f2fs: fix wrong block mapping for multi-devices
  - r8152: add error handling in rtl8152_driver_init
  - sw64: ebpf: port arch_prepare_bpf_trampoline()
  - sw64: fix random mmap base range
  - sw64: paravirt: add pv steal_time support in guest side
  - sw64: kvm: add pv steal time support
  - sw64: pci: remove redundant debug control


author: Li Nan <linan122@huawei.com> - 6.6.0-144.0.0.139
changelog:
  - !21367 ub: udma: bugfix related to jfr id.
  - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot
  - !21357 urma: fix add obj type compile error
  - ub: udma: bugfix related to jfr id.
  - urma: fix add obj type compile error
  - ub: ubase: optimized reboot time required
  - !21350 urma: add obj type in ubcore delete uobj error
  - !21343 urma: support ubp methods
  - !21351  arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled
  - urma: support ubp methods;
  - !21320 urma: decrease session creation max timeout
  - !21323 urma: tp reuse in RC transmode
  - !21319 urma: remove legacy bonding dev create/delete
  - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces
  - ub: ubase: Improving the reliability of CtrlQ.
  - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled
  - urma: add obj type in ubcore delete uobj error
  - urma: Kernel-mode file for tp reuse in RC transmode
  - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam.
  - ub:ubfi: Delete device load debug logs
  - iommu/ummu-core: Fix kref imbalance in VMA split scenario
  - iommu/ummu-core: Prevent FREE_TID while mmap is active
  - iommu/ummu: Add deprecation markers for ummu SVA APIs
  - !21324 mfs: fix mfsd_prefetch.cpp compile error
  - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE
  - !20936 gmem: fix several issues
  - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy
  - !21333 v4  hugetlb: drain pcp for movable zone before alloc
  - drivers/ub/sentry: set the priority
  - hugetlb: drain pcp for movable zone before alloc
  - !21325  mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb
  - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true
  - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference
  - gmem: hold mmap_read lock while executing gmem_unmap_region
  - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm()
  - gmem: fix hmemcpy src/dest conflict deadlock under concurrency
  - gmem: fix NULL ptr deference in vm_object_merge
  - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb
  - mfs: fix mfsd_prefetch.cpp compile error
  - !21310 CCA: Add the RSI interface for obtaining the device certificate.
  - urma: remove legacy bonding dev create/delete
  - urma: Decrease session creation max timeout
  - !21316 ub: udma: Move the request for RC context from UDMA to UBASE
  - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE
  - ub: ubase: Move the request for RC context from UDMA to UBASE
  - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode
  - !21302 [OLK-6.6]:update patches for sw64 architecture
  - ub: udma: bugfix related to deactivate tp.
  - ub: udma: bugfix related to jetty group.
  - !21311  mm/shrinker: Implementation of register_shrinker() and unregister_shrinker()
  - !21312 urma: support remove ubagg & uburma ko
  - !21223 kvm: add skip vmovp feature support
  - CCA: Add the RSI interface for obtaining the device certificate.
  - urma: support remove ubagg & uburma ko
  - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group
  - !21276 ub/ubdevshm: Fix some issues
  - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches
  - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations
  - ub/ubmem-mmu: Fix some issues
  - ub/ubmempfd: Add module author
  - ub/ubdevshm: Fix some issues
  - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker()
  - gpio: regmap: Fix memleak in error path in gpio_regmap_register()
  - perf: sched: Fix perf crash with new is_user_task() helper
  - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times
  - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports
  - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection
  - net: unic: correct DMA direction for TX path
  - net: unic: Fix the bug that could cause nconsistent resource state or double-free
  - net: unic: optimize MAC address deletion to avoid sleeping in spinlock
  - ub: ubase: Resolve integer wraparound
  - ub: ubase: Resolve cache coherence and set smp_rmb
  - ub: ubase&unic: adjust the encoding format of the ubase&unic driver.
  - ub: ubase: Support udma get ue msg info.
  - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver.
  - ub: ubase: The debugfs function supports querying the Ethernet port rate.
  - sw64: adapt arch_tlbbatch_add_pending according to upstream
  - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled
  - sw64: add support for batched TLB flushing during unmap
  - sw64: fix the parameter passing logic of memblock_mark_nomap
  - sw64: add HUGE_VMAP support for c4
  - sw64: define get_cycles macro
  - sw64: cpuidle: refine C6 state stability
  - sw64: add barriers and tlb flush for set_atc
  - sw64: adapt kernel page table for kdump
  - sw64: adapt kernel page table for memory hotplug
  - sw64: set PTBR_SYS before accessing vmalloc area
  - sw64: set execute permission for virtual machine's hmcode text section
  - sw64: adjust the marking and definitions of some kernel mapping functions
  - sw64: adapt kernel page table for S4
  - sw64: fix an inappropriate lock in __set_memory
  - sw64: enable kernel page table
  - sw64: use ioremap to map IO address in functions like __get_cpu_nums()
  - sw64: move non-boot core's kernel page table enabling logic to hmcode
  - sw64: use ioremap to map IO address
  - sw64: map legacy I/O to K segment
  - sw64: setup early_ioremap
  - sw64: reset ATC for kvm
  - sw64: setup mapping for efi_mm
  - sw64: set protection for kernel page table
  - sw64: modify codes with fixmap
  - sw64: map the early and the final page table
  - sw64: add fixmap support
  - sw64: fix mmap_base exceeding Java assertion address
  - sw64: add memb before/after atomic
  - sw64: add EDAC support with dynamic node and MC detection
  - sw64: fix: getcpu passed a null pointer error
  - sw64: iommu: refactor iommu v2 initialization
  - sw64: cache: fix shared_cpu_map when PPTT is invalid
  - sw64: add alternative runtime patching
  - sw64: pci: fix IO_BASE if numa_off
  - sw64: use ioremap to map spaces for cpufreq and S3
  - sw64: pci: add sunway pci controller for Command Completed errata
  - sw64: add definitions for kernel-required CPU capabilities
  - sw64: kvm: add qemu-gdb watchpoint support
  - sw64: kvm: fix srcu lock leak in pv steal time
  - gpio: idio-16: Define fixed direction of the GPIO lines
  - gpio: regmap: add the .fixed_direction_output configuration parameter
  - gpio: regmap: Allow to allocate regmap-irq device
  - bits: introduce fixed-type GENMASK_U*()
  - bits: add comments and newlines to #if, #else and #endif directives
  - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event
  - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.
  - xhci: dbc: Improve performance by removing delay in transfer event polling.
  - xhci: dbc: Allow users to modify DbC poll interval via sysfs
  - xhci: dbc: poll at different rate depending on data transfer activity
  - serial: sc16is7xx: reorder code to remove prototype declarations
  - serial: sc16is7xx: remove unused to_sc16is7xx_port macro
  - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported
  - selftests: mptcp: disable add_addr retrans in endpoint_tests
  - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
  - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
  - btrfs: use level argument in log tree walk callback replay_one_buffer()
  - btrfs: always drop log root tree reference in btrfs_replay_log()
  - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io()
  - btrfs: zoned: refine extent allocator hint selection
  - btrfs: zoned: return error from btrfs_zone_finish_endio()
  - EDAC/mc_sysfs: Increase legacy channel support to 16
  - x86/bugs: Fix reporting of LFENCE retpoline
  - x86/bugs: Report correct retbleed mitigation status
  - perf: Skip user unwind if the task is a kernel thread
  - perf: Have get_perf_callchain() return NULL if crosstask and user are set
  - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL
  - audit: record fanotify event regardless of presence of rules
  - sched/topology,x86: Fix build warning
  - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode
  - sched: Create architecture specific sched domain distances


author: Li Nan <linan122@huawei.com> - 6.6.0-145.0.0.140
changelog:
  - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty
  - urma: Kernel-mode file for bugfix of kerf of tjetty
  - !21456  time/jiffies: Mark jiffies_64_to_clock_t() notrace
  - !21393 Fix CVE-2026-23268
  - !21446  i40e: Fix preempt count leak in napi poll tracepoint
  - !21441  ext4: fix generic/363 failure in iomap buffered I/O mode
  - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes
  - !21450 Fix CVE-2026-23317
  - !21429 urma: add workqueue for well_know_jetty
  - !21439 urma: userctl fuction about fix mode.
  - !21458 urma: adjust log level to info for get_dev_name
  - !21425 urma: fix the double free issue of import_cb
  - !21408 urma: ipourma default sl configuration
  - urma: usrctrl function about fix mode.
  - urma: adjust log level to info for get_dev_name
  - !21436  bpf: Release module BTF IDR before module unload
  - !21440 v2  CVE-2026-23319
  - !21438  bpf: Fix stack-out-of-bounds write in devmap
  - time/jiffies: Mark jiffies_64_to_clock_t() notrace
  - !21426  RDMA/umad: Reject negative data_len in ib_umad_write
  - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
  - !21421 v3  CVE-2026-23352
  - !21380  perf: HiSilicon: Support uncore ITS PMU
  - !21379  drivers/perf: hisi: Add new function for HiSilicon MN PMU driver
  - !21391  quota: fix livelock between quotactl and freeze_super
  - !21390  ext4: fix dirtyclusters double decrement on fs shutdown
  - !21389  fat: avoid parent link count underflow in rmdir
  - !21388  ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
  - !21387  ext4: fix memory leak in ext4_ext_shift_extents()
  - !21386  blktrace: fix __this_cpu_read/write in preemptible context
  - !21434 Fix CVE-2026-23388
  - i40e: Fix preempt count leak in napi poll tracepoint
  - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed
  - urma: add workqueue for well_know_jetty
  - ext4: zero post EOF partial block before iomap appending write
  - ext4: move pagecache_isize_extended() out of active handle
  - ext4: remove ctime/mtime update from ext4_alloc_file_blocks()
  - ext4: unify SYNC mode checks in fallocate paths
  - ext4: ensure zeroed partial blocks are persisted in SYNC mode
  - ext4: move zero partial block range functions out of active handle
  - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks()
  - ext4: remove handle parameters from zero partial block functions
  - ext4: move ordered data handling out of ext4_block_do_zero_range()
  - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range()
  - ext4: factor out journalled block zeroing range
  - ext4: rename and extend ext4_block_truncate_page()
  - iomap: make zero range flush conditional on unwritten mappings
  - iomap: fix handling of dirty folios over unwritten extents
  - ub/obmm: minor bugfixes
  - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
  - bpf: export bpf_link_inc_not_zero.
  - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs
  - crypto: hisilicon/qm - support querying the hardware fault status through VFs
  - urma: ipourma default sl configuration
  - bpf: Fix stack-out-of-bounds write in devmap
  - bpf: Release module BTF IDR before module unload
  - Squashfs: check metadata block offset is within range
  - !21346 Revert "net: hns3: add sync command to sync io-pgtable"
  - !21372  nvme: fix memory allocation in nvme_pr_read_keys()
  - apparmor: fix unprivileged local user can do privileged policy management
  - !21423  nvme: fix admin queue leak on controller reset
  - !21422  scsi: target: Fix recursive locking in __configfs_open_file()
  - RDMA/umad: Reject negative data_len in ib_umad_write
  - !21402  CVE-2026-23296
  - !21403  fix queue start/stop imbalance under race
  - urma: fix the double free issue of bind_cb
  - nvme: fix admin queue leak on controller reset
  - scsi: target: Fix recursive locking in __configfs_open_file()
  - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
  - x86/efi: defer freeing of boot services memory
  - !21405 Fix CVE-2025-71239
  - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0
  - !21410 urma: disallow user-mode calls for some ubagg userctl ops
  - !21371 urma: remote all logic device when set dev ns
  - urma: disallow user-mode calls for some ubagg userctl ops
  - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes
  - drivers/ub/sentry: skip memory_failure if pfn is 0x0
  - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches
  - audit: add fchmodat2() to change attributes class
  - urma: remote all logic device when set dev ns
  - !21348 uvb: support communication in VM
  - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM
  - dm: fix queue start/stop imbalance under remove/resume races
  - dm: fix queue start/stop imbalance under suspend/load/resume races
  - scsi: core: Fix error handling for scsi_alloc_sdev()
  - scsi: core: Fix refcount leak for tagset_refcnt
  - uvb: support communication in VM
  - !21313  bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
  - !21334  prevent SEA storms on critical RAS
  - !21375 urma: Kernel-mode file for tp reuse in RC transmode
  - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state
  - quota: fix livelock between quotactl and freeze_super
  - ext4: fix dirtyclusters double decrement on fs shutdown
  - fat: avoid parent link count underflow in rmdir
  - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
  - ext4: fix memory leak in ext4_ext_shift_extents()
  - blktrace: fix __this_cpu_read/write in preemptible context
  - !21354  media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  - perf: HiSilicon: Support uncore ITS PMU
  - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver
  - net/ipv4:scmtcp: fix no dmi_uuid in VM
  - !21355  perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
  - !21249  arm64/xcall: add research papers reference in file headers
  - !21322  nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
  - !21369 drivers/ub/sentry: add some log for event report
  - mm/filemap: restrict pagecache to non-cpuless NUMA nodes
  - mm/mempolicy: add mpol_update_interleave_stats() helper
  - !21328 genirq: Get rid of global lock in irq_do_set_affinity()
  - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - nvme: fix memory allocation in nvme_pr_read_keys()
  - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter
  - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization"
  - drivers/ub/sentry: add some log for event report
  - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
  - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  - iommu: Revert to using .domain_alloc_user without kvm parameter
  - Revert "net: hns3: add sync command to sync io-pgtable"
  - regulator: fixed: Rely on the core freeing the enable GPIO
  - net/mlx5e: Fix validation logic in rate limiting
  - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling
  - ntfs3: init run lock for extend inode
  - scsi: ufs: host: mediatek: Require CONFIG_PM
  - wifi: rtw88: limit indirect IO under powered off for RTL8822CS
  - pinctrl: keembay: fix double free in keembay_build_functions()
  - block: fix comment for op_is_zone_mgmt() to include RESET_ALL
  - mptcp: schedule rtx timer only after pushing data
  - ACPI: HMAT: Remove register of memory node for generic target
  - mm/memory-tier: fix abstract distance calculation overflow
  - mm/truncate: unmap large folio on split failure
  - mm: memcg: change flush_next_time to flush_last_time
  - mm: memcg: add per-memcg zswap writeback stat
  - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL
  - scsi: ufs: core: Add a quirk to suppress link_startup_again
  - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register
  - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT
  - scsi: ufs: core: Add fill_crypto_prdt variant op
  - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE
  - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller
  - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE
  - f2fs: fix to avoid overflow while left shift operation
  - mm, percpu: do not consider sleepable allocations atomic
  - iommufd: Don't overflow during division for dirty tracking
  - btrfs: ensure no dirty metadata is written back for an fs with errors
  - Revert "perf dso: Add missed dso__put to dso__load_kcore"
  - selftests: mptcp: connect: trunc: read all recv data
  - selftests: mptcp: join: rm: set backup flag
  - selftests: mptcp: connect: fix fallback note due to OoO
  - pmdomain: samsung: plug potential memleak during probe
  - btrfs: do not update last_log_commit when logging inode due to a new name
  - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe()
  - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
  - EDAC/altera: Handle OCRAM ECC enable after warm reset
  - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY
  - selftests/user_events: fix type cast for write_index packed member in perf_test
  - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
  - spi: Try to get ACPI GPIO IRQ earlier
  - smb: client: fix cifs_pick_channel when channel needs reconnect
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
  - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
  - mm/mm_init: fix hash table order logging in alloc_large_system_hash()
  - wifi: mac80211: reject address change while connecting
  - selftests/tracing: Run sample events to clear page cache events
  - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY
  - LoongArch: Use correct accessor to read FWPC/MWPC
  - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
  - strparser: Fix signed/unsigned mismatch bug
  - ksmbd: close accepted socket when per-IP limit rejects connection
  - gcov: add support for GCC 15
  - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
  - HID: uclogic: Fix potential memory leak in error path
  - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY
  - HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
  - ARM: dts: imx51-zii-rdu1: Fix audmux node names
  - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1
  - mtd: onenand: Pass correct pointer to IRQ handler
  - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
  - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
  - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops
  - acpi/hmat: Fix lockdep warning for hmem_register_resource()
  - base/node / ACPI: Enumerate node access class for 'struct access_coordinate'
  - acpi: numa: Add setting of generic port system locality attributes
  - acpi: Break out nesting for hmat_parse_locality()
  - acpi: numa: Add genport target allocation to the HMAT parsing
  - acpi: numa: Create enum for memory_target access coordinates indexing
  - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates'
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
  - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
  - NFS: sysfs: fix leak when nfs_client kobject add fails
  - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
  - NFS: enable nconnect for RDMA
  - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
  - ASoC: tas2781: fix getting the wrong device number
  - ASoC: codecs: va-macro: fix resource leak in probe error path
  - ASoC: cs4271: Fix regulator leak on probe failure
  - regulator: fixed: fix GPIO descriptor leak on register failure
  - acpi,srat: Fix incorrect device handle check for Generic Initiator
  - cifs: Fix uncached read into ITER_KVEC iterator
  - cifs: stop writeback extension when change of size is detected
  - Bluetooth: L2CAP: export l2cap_chan_hold for modules
  - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
  - ACPI: CPPC: Check _CPC validity for only the online CPUs
  - hsr: Fix supervision frame sending on HSRv0
  - virtio-net: fix incorrect flags recording in big mode
  - net_sched: limit try_bulk_dequeue_skb() batches
  - net/mlx5e: Fix potentially misleading debug message
  - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
  - net/mlx5e: Fix maxrate wraparound in threshold between units
  - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
  - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
  - net_sched: act_connmark: use RCU in tcf_connmark_dump()
  - wifi: mac80211: skip rate verification for not captured PSDUs
  - net: mdio: fix resource leak in mdiobus_register_device()
  - net/handshake: Fix memory leak in tls_handshake_accept()
  - net/smc: fix mismatch between CLC header and proposal
  - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
  - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
  - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
  - net: fec: correct rx_bytes statistic for the case SHIFT16 is set
  - selftests: net: local_termination: Wait for interfaces to come up
  - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
  - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
  - smb/server: fix possible refcount leak in smb2_sess_setup()
  - smb/server: fix possible memory leak in smb2_read()
  - NFS: check if suid/sgid was cleared after a write as needed
  - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
  - NFS4: Fix state renewals missing after boot
  - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
  - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
  - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used
  - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors
  - compiler_types: Move unused static inline functions warning to W=2
  - iommufd: Make vfio_compat's unmap succeed if the range is already empty
  - smb: client: fix refcount leak in smb2_set_path_attr
  - drm/i915: Fix conversion between clock ticks and nanoseconds
  - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
  - selftests: netdevsim: set test timeout to 10 minutes
  - riscv: stacktrace: fix backtracing through exceptions
  - drm/amd/display: Fix black screen with HDMI outputs
  - drm/amdgpu: Fix function header names in amdgpu_connectors.c
  - extcon: adc-jack: Cleanup wakeup source only if it was enabled
  - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
  - x86/microcode/AMD: Add more known models to entry sign checking
  - drm/amd/display: Enable mst when it's detected but yet to be initialized
  - net: bridge: fix MST static key usage
  - lan966x: Fix sleeping in atomic context
  - net: dsa: microchip: Fix reserved multicast address table programming
  - net/mlx5e: SHAMPO, Fix skb size check for 64K pages
  - net/mlx5e: Fix return value in case of module EEPROM read error
  - net/mlx5e: Use extack in get module eeprom by page callback
  - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup
  - net: dsa: b53: stop reading ARL entries if search is done
  - net: dsa: b53: fix enabling ip multicast
  - net: dsa: b53: fix resetting speed and pause on forced link
  - net: vlan: sync VLAN features with lower device
  - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh
  - netdevsim: add Makefile for selftests
  - selftests/net: use destination options instead of hop-by-hop
  - selftests/net: fix GRO coalesce test and add ext header coalesce tests
  - selftests/net: fix out-of-order delivery of FIN in gro:tcp test
  - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx
  - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
  - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro
  - riscv: stacktrace: Disable KASAN checks for non-current tasks
  - riscv: Improve exception and system call latency
  - net: libwx: fix device bus LAN ID
  - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
  - ceph: refactor wake_up_bit() pattern of calling
  - ceph: add checking of wait_for_completion_killable() return value
  - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
  - kbuild: uapi: Strip comments before size type check
  - rtc: pcf2127: fix watchdog interrupt mask on pcf2131
  - tools: lib: thermal: use pkg-config to locate libnl3
  - tools: lib: thermal: don't preserve owner in install
  - tools bitmap: Add missing asm-generic/bitsperlong.h include
  - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
  - 9p: sysfs_init: don't hardcode error to ENOMEM
  - cpufreq: tegra186: Initialize all cores to max frequencies
  - 9p: fix /sys/fs/9p/caches overwriting itself
  - NTB: epf: Allow arbitrary BAR mapping
  - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
  - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register
  - clk: at91: clk-master: Add check for divide by 3
  - ARM: at91: pm: save and restore ACR during PLL disable/enable
  - rtc: pcf2127: clear minute/second interrupt
  - clk: sunxi-ng: sun6i-rtc: Add A523 specifics
  - um: Fix help message for ssl-non-raw
  - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
  - btrfs: mark dirty extent range for out of bound prealloc extents
  - RDMA/irdma: Set irdma_cq cq_num field during CQ create
  - RDMA/irdma: Remove unused struct irdma_cq fields
  - RDMA/irdma: Fix SD index calculation
  - ACPICA: Update dsmethod.c to get rid of unused variable warning
  - char: misc: restrict the dynamic range to exclude reserved minors
  - smb: client: transport: avoid reconnects triggered by pending task work
  - ksmbd: use sock_create_kern interface to create kernel socket
  - orangefs: fix xattr related buffer overflow...
  - page_pool: Clamp pool size to max 16K pages
  - 6pack: drop redundant locking and refcounting
  - exfat: limit log print for IO error
  - ALSA: usb-audio: add mono main switch to Presonus S1824c
  - Bluetooth: SCO: Fix UAF on sco_conn_free
  - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames
  - net: macb: avoid dealing with endianness in macb_set_hwaddr()
  - arm64: openeuler_defconfig: enable ras critical related configs by default
  - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS
  - futex: avoid memory access during exit_robust_list if task facing critical RAS
  - mm: avoid memory access during __access_remote_vm if task facing critical RAS
  - coredump: skip coredump during critical error if task facing critical RAS
  - exit: terminate process on critical RAS events to prevent further damage
  - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct
  - ACPI: APEI: Add vendor specific error info handling for ARM Processor
  - mm: memory_failure: fix UAF in memory_failure_cb
  - genirq: Get rid of global lock in irq_do_set_affinity()
  - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
  - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
  - ASoC: stm32: sai: manage context in set_sysclk callback
  - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
  - ext4: increase IO priority of fastcommit
  - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state
  - accel/habanalabs: return ENOMEM if less than requested pages were pinned
  - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
  - accel/habanalabs/gaudi2: fix BMON disable configuration
  - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
  - net: bridge: Install FDB for bridge MAC on VLAN 0
  - NFSv4.1: fix mount hang after CREATE_SESSION failure
  - NFSv4: handle ERR_GRACE on delegation recalls
  - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream
  - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
  - remoteproc: qcom: q6v5: Avoid handling handover twice
  - PCI/PM: Skip resuming to D0 if device is disconnected
  - vfio: return -ENOTTY for unsupported device feature
  - sparc64: fix prototypes of reads[bwl]()
  - sparc/module: Add R_SPARC_UA64 relocation handling
  - r8169: set EEE speed down ratio to 1
  - net: intel: fm10k: Fix parameter idx set but not used
  - wifi: ath10k: Fix connection after GTK rekeying
  - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot()
  - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X
  - net: phy: clear link parameters on admin link down
  - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup()
  - jfs: fix uninitialized waitqueue in transaction manager
  - jfs: Verify inode mode when loading from disk
  - ipv6: np->rxpmtu race annotation
  - f2fs: fix infinite loop in __insert_extent_tree()
  - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
  - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
  - allow finish_no_open(file, ERR_PTR(-E...))
  - scsi: lpfc: Define size of debugfs entry for xri rebalancing
  - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup
  - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
  - scsi: ufs: core: Disable timestamp functionality if not supported
  - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
  - drm/amdgpu: reject gang submissions under SRIOV
  - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
  - ethernet: Extend device_get_mac_address() to use NVMEM
  - drm/amd/display: Disable VRR on DCE 6
  - drm/amd/display: Fix DVI-D/HDMI adapters
  - drm/amd: Avoid evicting resources at S5
  - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
  - ALSA: serial-generic: remove shared static buffer
  - wifi: mt76: mt7996: Temporarily disable EPCS
  - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device
  - net/cls_cgroup: Fix task_get_classid() during qdisc run
  - crypto: caam - double the entropy delay interval for retry
  - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
  - crypto: sun8i-ce - remove channel timeout field
  - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
  - HID: asus: add Z13 folio to generic group for multitouch to work
  - selftests: Replace sleep with slowwait
  - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
  - selftests: Disable dad for ipv6 in fcnal-test.sh
  - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT
  - netfilter: nf_reject: don't reply to icmp error messages
  - selftests: traceroute: Use require_command()
  - media: redrat3: use int type to store negative error codes
  - selftests: net: replace sleeps in fcnal-test with waits
  - net: sh_eth: Disable WoL if system can not suspend
  - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0
  - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet
  - phy: cadence: cdns-dphy: Enable lower resolutions in dphy
  - wifi: mac80211: Fix HE capabilities element check
  - ntfs3: pretend $Extend records as regular files
  - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes
  - net: phy: marvell: Fix 88e1510 downshift counter errata
  - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure
  - scsi: ufs: host: mediatek: Enhance recovery on resume failure
  - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer
  - media: ov08x40: Fix the horizontal flip control
  - char: Use list_del_init() in misc_deregister() to reinitialize list pointer
  - drm/msm: make sure to not queue up recovery more than once
  - usb: gadget: f_hid: Fix zero length packet transfer
  - drm/amdgpu: add support for cyan skillfish gpu_info
  - drm/amdgpu: don't enable SMU on cyan skillfish
  - drm/amd: add more cyan skillfish PCI ids
  - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs
  - iommu/amd: Skip enabling command/event buffers for kdump
  - smsc911x: add second read of EEPROM mac when possible corruption seen
  - net: call cond_resched() less often in __release_sock()
  - ALSA: usb-audio: apply quirk for MOONDROP Quark2
  - media: verisilicon: Explicitly disable selection api ioctls for decoders
  - media: adv7180: Only validate format in querystd
  - media: adv7180: Do not write format to device in set_fmt
  - media: adv7180: Add missing lock in suspend callback
  - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
  - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
  - drm/amdgpu: Allow kfd CRIU with no buffer objects
  - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
  - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
  - dmaengine: dw-edma: Set status for callback_result
  - dmaengine: mv_xor: match alloc_wc and free_wc
  - dmaengine: sh: setup_xref error handling
  - ptp: Limit time setting of PTP clocks
  - scsi: pm8001: Use int instead of u32 to store error codes
  - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
  - mips: lantiq: danube: rename stp node on EASY50712 reference board
  - mips: lantiq: xway: sysctrl: rename stp clock
  - mips: lantiq: danube: add missing device_type in pci node
  - mips: lantiq: danube: add model to EASY50712 dts
  - mips: lantiq: danube: add missing properties to cpu node
  - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
  - media: fix uninitialized symbol warnings
  - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
  - drm/amdkfd: fix vram allocation failure for a special case
  - fuse: zero initialize inode private data
  - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
  - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
  - extcon: adc-jack: Fix wakeup source leaks on device unbind
  - scsi: pm80xx: Fix race condition caused by static variables
  - scsi: mpi3mr: Fix controller init failure on fault during queue creation
  - rds: Fix endianness annotation for RDS_MPATH_HASH
  - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
  - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
  - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
  - net: stmmac: Correctly handle Rx checksum offload errors
  - net: When removing nexthops, don't call synchronize_net if it is not necessary
  - char: misc: Does not request module for miscdevice with dynamic minor
  - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor
  - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
  - iio: adc: imx93_adc: load calibrated values even calibration failed
  - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
  - drm/amdkfd: Handle lack of READ permissions in SVM mapping
  - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
  - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling
  - scsi: ufs: host: mediatek: Change reset sequence for improved stability
  - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change
  - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration
  - bridge: Redirect to backup port when port is administratively down
  - s390/pci: Use pci_uevent_ers() in PCI recovery
  - powerpc/eeh: Use result of error_detected() in uevent
  - ice: Don't use %pK through printk or tracepoints
  - net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
  - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
  - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR
  - drm/tidss: Set crtc modesetting parameters with adjusted mode
  - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST
  - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value
  - drm/tidss: Use the crtc_* timings when programming the HW
  - media: amphion: Delete v4l2_fh synchronously in .release()
  - media: pci: ivtv: Don't create fake v4l2_fh
  - drm/amdkfd: return -ENOTTY for unsupported IOCTLs
  - wifi: rtw88: sdio: use indirect IO for device registers before power-on
  - selftests/net: Ensure assert() triggers in psock_tpacket.c
  - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
  - PCI: Disable MSI on RDC PCI to PCIe bridges
  - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
  - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
  - drm/amd/pm: Use cached metrics data on arcturus
  - drm/amd/pm: Use cached metrics data on aldebaran
  - drm/amd/display: update dpp/disp clock from smu clock table
  - drm/amd/display: add more cyan skillfish devices
  - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
  - drm/amd/display: ensure committing streams is seamless
  - mfd: da9063: Split chip variant reading in two bus transactions
  - mfd: madera: Work around false-positive -Wininitialized warning
  - mfd: stmpe-i2c: Add missing MODULE_LICENSE
  - mfd: stmpe: Remove IRQ domain upon removal
  - tools/power x86_energy_perf_policy: Prefer driver HWP limits
  - tools/power x86_energy_perf_policy: Enhance HWP enable
  - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
  - tools/cpupower: Fix incorrect size in cpuidle_state_disable()
  - hwmon: (dell-smm) Add support for Dell OptiPlex 7040
  - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
  - uprobe: Do not emulate/sstep original instruction when ip is changed
  - nvme: Use non zero KATO for persistent discovery connections
  - bpf: Clear pfmemalloc flag when freeing all fragments
  - riscv: bpf: Fix uninitialized symbol 'retval_off'
  - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
  - spi: rpc-if: Add resume support for RZ/G3E
  - cpuidle: Fail cpuidle device registration if there is one already
  - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
  - power: supply: qcom_battmgr: handle charging state change notifications
  - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"
  - tools/cpupower: fix error return value in cpupower_write_sysfs()
  - video: backlight: lp855x_bl: Set correct EPROM start for LP8556
  - tee: allow a driver to allocate a tee_device without a pool
  - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
  - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
  - ARM: tegra: transformer-20: fix audio-codec interrupt
  - ARM: tegra: transformer-20: add missing magnetometer interrupt
  - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
  - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106
  - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller
  - hwmon: sy7636a: add alias
  - power: supply: sbs-charger: Support multiple devices
  - pinctrl: keembay: release allocated memory in detach path
  - hwmon: (sbtsi_temp) AMD CPU extended temperature range support
  - power: supply: qcom_battmgr: add OOI chemistry
  - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
  - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
  - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
  - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
  - arc: Fix __fls() const-foldability via __builtin_clzl()
  - cpufreq/longhaul: handle NULL policy in longhaul_exit
  - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
  - irqchip/sifive-plic: Respect mask state when setting affinity
  - memstick: Add timeout to prevent indefinite waiting
  - mmc: host: renesas_sdhi: Fix the actual clock
  - pinctrl: single: fix bias pull up/down handling in pin_config_set
  - bpf: Don't use %pK through printk
  - spi: loopback-test: Don't use %pK through printk
  - soc: qcom: smem: Fix endian-unaware access of num_entries
  - soc: aspeed: socinfo: Add AST27xx silicon IDs
  - usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
  - drm/sched: Fix race in drm_sched_entity_select_rq()
  - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
  - sched/fair: Use all little CPUs for CPU-bound workloads
  - sched/pelt: Avoid underestimation of task utilization
  - net: phy: dp83867: Disable EEE support as not implemented
  - s390/pci: Restore IRQ unconditionally for the zPCI device
  - regmap: slimbus: fix bus_context pointer in regmap init calls
  - block: make REQ_OP_ZONE_OPEN a write operation
  - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
  - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
  - sfc: fix potential memory leak in efx_mae_process_mport()
  - drm/etnaviv: fix flush sequence logic
  - Bluetooth: hci_core: Fix tracking of periodic advertisement
  - Bluetooth: ISO: Fix another instance of dst_type handling
  - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
  - libbpf: Fix powerpc's stack register definition in bpf_tracing.h
  - ASoC: fsl_sai: fix bit order for DSD format
  - ASoC: Intel: avs: Unprepare a stream when XRUN occurs
  - scsi: ufs: core: Initialize value of an attribute returned by uic cmd
  - ALSA: usb-audio: fix control pipe direction
  - drm/msm/a6xx: Fix GMU firmware parser
  - wifi: ath12k: free skb during idr cleanup callback
  - wifi: ath10k: Fix memory leak on unsupported WMI command
  - ASoC: qdsp6: q6asm: do not sleep while atomic
  - mptcp: restore window probe
  - mptcp: drop bogus optimization in __mptcp_check_push()
  - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
  - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
  - Bluetooth: rfcomm: fix modem control handling
  - ACPI: button: Call input_free_device() on failing input device registration
  - fbdev: atyfb: Check if pll_ops->init_pll failed
  - net: usb: asix_devices: Check return value of usbnet_get_endpoints
  - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
  - arm64/xcall: add research papers reference in file headers


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.1.141
changelog:
  - !21670 urma: change well-known jetty to UM
  - !21669 urma: adjust netlink log level of ipourma
  - urma: change well-known jetty to UM
  - urma: adjust netlink log level of ipourma
  - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0
  - f2fs: fix to detect potential corrupted nid in free_nid_list
  - ntfs3: Fix uninit buffer allocated by __getname()
  - nvme-pci: Fix race bug in nvme_poll_irqdisable()
  - tls: Purge async_hold in tls_decrypt_async_wait()
  - clsact: Fix use-after-free in init/destroy rollback asymmetry
  - nf_tables: nft_dynset: fix possible stateful expression memleak in error path
  - xdp: produce a warning when calculated tailroom is negative
  - xdp: use modulo operation to calculate XDP frag tailroom
  - apparmor: fix race between freeing data and fs accessing it
  - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks"
  - riscv: Replace function-like macro by static inline function
  - sched/fair: scale wake_wide() threshold by SMT width
  - sched/core: fix SCHED_FEAT overflow on 32-bit architectures
  - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid()
  - urma: fix race condition in async event causing kfree of invalid pointer
  - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid
  - apparmor: replace recursive profile removal with iterative approach
  - apparmor: fix: limit the number of levels of policy namespaces
  - nfnetlink_osf: validate individual option lengths in fingerprints
  - tls: Fix race condition in tls_sw_cancel_work_tx()
  - urma: Kernel-mode file for bugfix of vtpn of empty pointer
  - xen/privcmd: add boot control for restricted usage in domU
  - xen/privcmd: unregister xenstore notifier on module exit
  - xen/privcmd: restrict usage in unprivileged domU
  - af_unix: Give up GC if MSG_PEEK intervened.
  - urma: Kernel-mode file for bugfix to move hashtable from alloc to active
  - apparmor: fix differential encoding verification
  - ub:hisi-ubus: Synchronize the missing code
  - apparmor: Fix double free of ns_name in aa_replace_profiles()
  - mptcp: pm: in-kernel: always mark signal+subflow endp as used
  - bridge: cfm: Fix race condition in peer_mep deletion
  - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
  - apparmor: fix race on rawdata dereference
  - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
  - net/sched: act_gate: snapshot parameters with RCU on replace
  - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
  - netfilter: nf_tables: always walk all pending catchall elements
  - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
  - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
  - netfilter: nf_tables: unconditionally bump set->nelems before insertion
  - netfilter: nf_tables: release flowtable after rcu grace period on error
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks
  - netfilter: xt_CT: drop pending enqueued packets on template removal
  - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
  - apparmor: fix memory leak in verify_header
  - wifi: libertas: fix use-after-free in lbs_free_adapter()
  - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
  - urma: Kernel-mode file for bugfix deactivate to apply pid in udma
  - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback
  - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
  - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
  - can: bcm: fix locking for bcm_op runtime updates
  - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
  - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
  - net: prevent NULL deref in ip[6]tunnel_xmit()
  - net: add xmit recursion limit to tunnel xmit functions
  - net: gro: fix outer network offset
  - net: annotate data-races around sk->sk_{data_ready,write_space}
  - net: add proper RCU protection to /proc/net/ptype
  - urma: fix potential deadlock risk in urma_ping
  - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
  - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
  - net: usb: kalmia: validate USB endpoints
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
  - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair()
  - urma: use user-specified dev_name when creating agg dev
  - mm: thp: deny THP for files on anonymous inodes
  - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
  - smb: client: Don't log plaintext credentials in cifs_set_cifscreds
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
  - xhci: dbgtty: fix device unregister: fixup
  - tty: introduce and use tty_port_tty_vhangup() helper
  - net: dsa: microchip: Fix error path in PTP IRQ setup
  - can: ucan: Fix infinite loop from zero-length messages
  - net: dsa: microchip: Free previously initialized ports on init failures
  - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}()
  - selftests: mptcp: join: properly kill background tasks
  - staging: rtl8712: Remove driver using deprecated API wext
  - net: macb: fix unregister_netdev call order in macb_remove()
  - iio: adc: rtq6056: Correct the sign bit index
  - nfsd: Replace clamp_t in nfsd4_get_drc_mem()
  - net: dsa: microchip: ptp: Fix checks on irq_find_mapping()
  - net: dsa: microchip: common: Fix checks on irq_find_mapping()
  - drm/amd/display: Check NULL before accessing
  - drm: sti: fix device leaks at component probe
  - USB: serial: option: add support for Rolling RW101R-GL
  - USB: serial: ftdi_sio: add support for u-blox EVK-M101
  - xhci: dbgtty: fix device unregister
  - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
  - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
  - usb: dwc3: pci: Sort out the Intel device IDs
  - usb: dwc3: pci: add support for the Intel Nova Lake -S
  - usb: renesas_usbhs: Fix synchronous external abort on unbind
  - usb: gadget: f_eem: Fix memory leak in eem_unwrap
  - usb: cdns3: Fix double resource release in cdns3_pci_probe
  - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking
  - mptcp: clear scheduled subflows on retransmit
  - firmware: stratix10-svc: fix bug in saving controller data
  - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
  - thunderbolt: Add support for Intel Wildcat Lake
  - drivers/usb/dwc3: fix PCI parent check
  - dm-verity: fix unreliable memory allocation
  - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
  - can: sja1000: fix max irq loop handling
  - atm/fore200e: Fix possible data race in fore200e_open()
  - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line
  - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230
  - iio: adc: ad7280a: fix ad7280_store_balance_timer()
  - iio: accel: fix ADXL355 startup race condition
  - iio: accel: bmc150: Fix irq assumption regression
  - iio:common:ssp_sensors: Fix an error handling path ssp_probe()
  - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
  - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
  - spi: bcm63xx: fix premature CS deassertion on RX-only transactions
  - spi: nxp-fspi: Propagate fwnode in ACPI case as well
  - spi: nxp-fspi: Support per spi-mem operation frequency switches
  - spi: spi-mem: Add a new controller capability
  - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency
  - spi: spi-mem: Allow specifying the byte order in Octal DTR mode
  - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors
  - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA
  - mailbox: pcc: don't zero error register
  - mailbox: mailbox-test: Fix debugfs_create_dir error checking
  - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors
  - iio: st_lsm6dsx: Fixed calibrated timestamp calculation
  - net: fec: do not register PPS event for PEROUT
  - net: fec: do not allow enabling PPS and PEROUT simultaneously
  - net: fec: do not update PEROUT if it is enabled
  - net: fec: cancel perout_timer when PEROUT is disabled
  - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic
  - net: dsa: sja1105: simplify static configuration reload
  - net: sxgbe: fix potential NULL dereference in sxgbe_rx()
  - net: lan966x: Fix the initialization of taprio
  - net: aquantia: Add missing descriptor cache invalidation on ATL2
  - platform/x86: intel: punit_ipc: fix memory corruption
  - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY
  - Bluetooth: SMP: Fix not generating mackey and ltk when repairing
  - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data
  - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header
  - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs
  - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.2.142
changelog:
  - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove
  - !21695 urma: Create jetty with kernel thread
  - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove
  - urma: Create jetty with kernel thread


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.3.143
changelog:
  - !21778 urma: implement share TP for RM mode
  - urma: implement share TP for RM mode
  - !21768 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-146.0.0 to 6.6.0-147.0.0
  - ub:hisi-ubus: Adjust the order of the message struct
  - ub:ubus: Fix find error ubc_num of local ras
  - ub:ubus: Fix null message workqueue issue
  - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().
  - net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work
  - urma: fix Clos networking and add a new interface get_path_set.
  - sched/debug: Fix avg_vruntime() usage
  - sched/fair: Fix zero_vruntime tracking fix
  - sched/fair: Fix vruntime drift by preventing double lag scaling during reweight
  - sched/eevdf: Update se->vprot in reweight_entity()
  - sched/fair: Only set slice protection at pick time
  - sched: Fix struct sched_entity kabi broken
  - sched/fair: Fix NO_RUN_TO_PARITY case
  - sched/fair: Use protect_slice() instead of direct comparison
  - sched: Cancel the slice protection of the idle entity
  - sched/eevdf: Fix wakeup-preempt by checking cfs_rq->nr_running
  - sched/eevdf: Disable shorter slices to wakeup-preempt
  - sched/eevdf: Allow shorter slices to wakeup-preempt
  - sched: Unify more update_curr*()
  - sched: Remove vruntime from trace_sched_stat_runtime()
  - sched: fix kabi broken in struct sched_statistics
  - sched: Unify runtime accounting across classes
  - sched/fair: Adhere to place_entity() constraints
  - sched/fair: Fix EEVDF entity placement bug causing scheduling lag
  - sched/fair: Fix zero_vruntime tracking
  - sched: Fix kabi breakage of struct cfs_rq for sum_w_vruntime
  - sched/fair: Rename cfs_rq::avg_vruntime to ::sum_w_vruntime, and helper functions
  - sched: Fix kabi breakage of struct cfs_rq for sum_weight
  - sched/fair: Rename cfs_rq::avg_load to cfs_rq::sum_weight
  - sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups
  - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer
  - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer
  - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one
  - spi: tegra210-quad: Move curr_xfer read inside spinlock
  - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer
  - tools: Fix bitfield dependency failure
  - iomap: allocate s_dio_done_wq for async reads as well
  - i3c: Move device name assignment after i3c_bus_init
  - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
  - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
  - selftests: bonding: Add more missing config options
  - selftests: bonding: add missing build configs
  - mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors
  - net: stmmac: fix rx limit check in stmmac_rx_zc()
  - netfilter: flowtable: check for maximum number of encapsulations in bridge vlan
  - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"
  - resource: introduce is_type_match() helper and use it
  - resource: replace open coded resource_intersection()
  - resource: Reuse for_each_resource() macro
  - ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend
  - ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend
  - ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend
  - ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend
  - ASoC: Intel: catpt: Fix error path in hw_params()
  - vdpa/pds: use %pe for ERR_PTR() in event handler registration
  - virtio: fix virtqueue_set_affinity() docs
  - virtio: fix whitespace in virtio_config_ops
  - virtio: fix typo in virtio_device_ready() comment
  - virtio_vdpa: fix misleading return in void function
  - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation
  - ext4: remove unused return value of __mb_check_buddy
  - ublk: prevent invalid access with DEBUG
  - ublk: complete command synchronously on error
  - ublk: make sure io cmd handled in submitter task context
  - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
  - hwmon: sy7636a: Fix regulator_enable resource leak on error path
  - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1()
  - ASoC: fsl_xcvr: clear the channel status control memory
  - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY
  - RDMA/irdma: Add support to re-register a memory region
  - RDMA/irdma: Fix data race in irdma_free_pble
  - RDMA/irdma: Fix data race in irdma_sc_ccq_arm
  - iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal
  - backlight: lp855x: Fix lp855x.h kernel-doc warnings
  - backlight: led-bl: Add devlink to supplier LEDs
  - wifi: ieee80211: correct FILS status codes
  - iomap: always run error completions in user context
  - iomap: factor out a iomap_dio_done helper
  - drm/nouveau: restrict the flush page to a 32-bit address
  - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
  - btrfs: fix leaf leak in an error path in btrfs_del_items()
  - staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
  - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc
  - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
  - RDMA/bnxt_re: Fix the inline size for GenP7 devices
  - RISC-V: KVM: Fix guest page fault within HLV* instructions
  - crypto: ccree - Correctly handle return of sg_nents_for_len
  - crypto: starfive - Correctly handle return of sg_nents_for_len
  - selftests/bpf: Improve reliability of test_perf_branches_no_hw()
  - selftests/bpf: skip test_perf_branches_hw() on unsupported platforms
  - usb: dwc2: fix hang during suspend if set as peripheral
  - usb: dwc2: fix hang during shutdown if set as peripheral
  - usb: dwc2: disable platform lowlevel hw resources during shutdown
  - usb: chaoskey: fix locking for O_NONBLOCK
  - cpuset: Treat cpusets in attaching as populated
  - net: phy: adin1100: Fix software power-down ready condition
  - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
  - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
  - wifi: mac80211: fix CMAC functions not handling errors
  - wifi: mac80211: remove RX_DROP_UNUSABLE
  - pwm: bcm2835: Make sure the channel is enabled after pwm_request()
  - perf arm_spe: Fix memset subclass in operation
  - perf arm-spe: Extend branch operations
  - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
  - fs/ntfs3: Prevent memory leaks in add sub record
  - fs/ntfs3: out1 also needs to put mi
  - powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format
  - powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit
  - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
  - drm/msm/a2xx: stop over-complaining about the legacy firmware
  - NFSD/blocklayout: Fix minlength check in proc_layoutget
  - tracefs: fix a leak in eventfs_create_events_dir()
  - watchdog: starfive: Fix resource leak in probe error path
  - watchdog: wdat_wdt: Fix ACPI table leak in probe function
  - selftests/bpf: Fix failure paths in send_signal test
  - bpf: Handle return value of ftrace_set_filter_ip in register_fentry
  - ps3disk: use memcpy_{from,to}_bvec index
  - arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A
  - arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A
  - PCI: keystone: Exit ks_pcie_probe() for invalid mode
  - leds: netxbig: Fix GPIO descriptor leak in error paths
  - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
  - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()
  - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
  - lib/vsprintf: Check pointer before dereferencing in time_and_date()
  - clk: renesas: r9a06g032: Fix memory leak in error path
  - coresight: etm4x: Add context synchronization before enabling trace
  - coresight: etm4x: Extract the trace unit controlling
  - coresight: etm4x: Correct polling IDLE bit
  - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
  - powerpc/32: Fix unpaired stwcx. on interrupt exit
  - cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs
  - scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc()
  - ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties
  - RDMA/rtrs: server: Fix error handling in get_or_create_srv
  - dt-bindings: PCI: amlogic: Fix the register name of the DBI region
  - staging: most: remove broken i2c driver
  - staging: most: i2c: Drop explicit initialization of struct i2c_device_id::driver_data to 0
  - scsi: stex: Fix reboot_notifier leak in probe error path
  - regulator: core: disable supply if enabling main regulator fails
  - perf/x86/intel: Correct large PEBS flag check
  - ext4: correct the checking of quota files before moving extents
  - mfd: da9055: Fix missing regmap_del_irq_chip() in error path
  - efi/libstub: Fix page table access in 5-level to 4-level paging transition
  - x86/boot: Fix page table access in 5-level to 4-level paging transition
  - ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible
  - ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible
  - ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels
  - spi: tegra210-quad: Fix timeout handling
  - fs/9p: Don't open remote file with APPEND mode when writeback cache is used
  - scsi: target: Do not write NUL characters into ASCII configfs output
  - power: supply: apm_power: only unset own apm_get_power_status
  - power: supply: wm831x: Check wm831x_set_bits() return value
  - power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges()
  - power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges()
  - power: supply: cw2015: Check devm_delayed_work_autocancel() return code
  - perf record: skip synthesize event when open evsel failed
  - perf lock contention: Load kernel map before lookup
  - perf maps: Add maps__load_first()
  - interconnect: debugfs: Fix incorrect error handling for NULL path
  - arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller
  - interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS
  - i3c: master: svc: Prevent incomplete IBI transaction
  - i3c: fix refcount inconsistency in i3c_master_register
  - i3c: master: Inherit DMA masks and parameters from parent device
  - pinctrl: stm32: fix hwspinlock resource leak in probe function
  - soc: qcom: smem: fix hwspinlock resource leak in probe error paths
  - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
  - mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove
  - mtd: nand: relax ECC parameter validation check
  - Revert "mtd: rawnand: marvell: fix layouts"
  - ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties
  - ARM: dts: renesas: gose: Remove superfluous port property
  - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
  - phy: mscc: Fix PTP for VSC8574 and VSC8572
  - arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider
  - firmware: imx: scu-irq: fix OF node leak in
  - arm64: dts: ti: k3-am62p: Fix memory ranges for GPU
  - s390/ap: Don't leak debug feature files if AP instructions are not available
  - s390/smp: Fix fallback CPU detection
  - wifi: ath11k: fix peer HE MCS assignment
  - clk: qcom: camcc-sm6350: Fix PLL config of PLL2
  - clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other
  - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
  - PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2
  - arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1
  - arm64: dts: imx8mp-venice-gw702x: remove off-board uart
  - arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
  - arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props
  - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member
  - inet: Avoid ehash lookup race in inet_ehash_insert()
  - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
  - ntfs3: fix uninit memory after failed mi_read in mi_format_new
  - crypto: authenc - Correctly pass EINPROGRESS back up to the caller
  - irqchip/qcom-irq-combiner: Fix section mismatch
  - irqchip/imx-mu-msi: Fix section mismatch
  - irqchip/irq-brcmstb-l2: Fix section mismatch
  - irqchip/irq-bcm7120-l2: Fix section mismatch
  - irqchip/irq-bcm7038-l1: Fix section mismatch
  - objtool: Fix weak symbol detection
  - objtool: Fix standalone --hacks=jump_label
  - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync()
  - clk: renesas: cpg-mssr: Read back reset registers to assure values latched
  - clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register
  - clk: renesas: Use str_on_off() helper
  - clk: renesas: rzg2l: Use %x format specifier to print CLK_ON_R()
  - clk: renesas: rzg2l: Remove critical area
  - clk: renesas: rzg2l: Simplify the logic in rzg2l_mod_clock_endisable()
  - clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback
  - USB: Fix descriptor count when handling invalid MBIM extended descriptor
  - drm/vgem-fence: Fix potential deadlock on release
  - drm/panel: visionox-rm69299: Don't clear all mode flags
  - gpu: host1x: Fix race in syncpt alloc/free
  - smack: fix bug: unprivileged task can create labels
  - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
  - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
  - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
  - comedi: check device's attached status in compat ioctls
  - comedi: multiq3: sanitize config options in multiq3_attach()
  - comedi: c6xdigio: Fix invalid PNP driver unregistration
  - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1
  - samples: work around glibc redefining some of our defines wrong
  - HID: elecom: Add support for ELECOM M-XT3URBK (018F)
  - platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
  - platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
  - platform/x86: huawei-wmi: add keys for HONOR models
  - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
  - platform/x86: acer-wmi: Ignore backlight event
  - pinctrl: qcom: msm: Fix deadlock in pinmux configuration
  - HID: hid-input: Extend Elan ignore battery quirk to USB
  - bfs: Reconstruct file type when loading from disk
  - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
  - smb: fix invalid username check in smb3_fs_context_parse_param()
  - Bluetooth: btrtl: Avoid loading the config file on security chips
  - drm/vmwgfx: Use kref in vmw_bo_dirty
  - spi: imx: keep dma request disabled before dma transfer setup
  - spi: xilinx: increase number of retries before declaring stall
  - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
  - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
  - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
  - serial: add support of CPCI cards
  - USB: serial: ftdi_sio: match on interface number for jtag
  - USB: serial: option: move Telit 0x10c7 composition in the right place
  - USB: serial: option: add Telit Cinterion FE910C04 new compositions
  - USB: serial: option: add Foxconn T99W760
  - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()
  - locking/spinlock/debug: Fix data-race in do_raw_write_lock
  - ksmbd: ipc: fix use-after-free in ipc_msg_send_request
  - Documentation: process: Also mention Sasha Levin as stable tree maintainer
  - leds: spi-byte: Use devm_led_classdev_register_ext()
  - fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error
  - Solve kernel ABI issue introduced by x86_max_cores updates
  - x86/acpi/boot: Correct acpi_is_processor_usable() check again
  - x86/xen: mark boot CPU of PV guest in MSR_IA32_APICBASE
  - x86/topology: Handle the !APIC case gracefully
  - x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI
  - x86/cpu/topology: Remove limit of CPUs due to disabled IO/APIC
  - x86/topology: Handle bogus ACPI tables correctly
  - x86/xen/smp_pv: Register the boot CPU APIC properly
  - x86/topology: Don't update cpu_possible_map in topo_set_cpuids()
  - x86/topology: Don't evaluate logical IDs during early boot
  - x86/topology: Ignore non-present APIC IDs in a present package
  - x86/cpu/topology: Get rid of cpuinfo::x86_max_cores
  - x86/cpu/topology: Provide __num_[cores|threads]_per_package
  - x86/cpu/topology: Rename topology_max_die_per_package()
  - x86/cpu/topology: Rename smp_num_siblings
  - x86/cpu/topology: Retrieve cores per package from topology bitmaps
  - x86/cpu/topology: Use topology logical mapping mechanism
  - x86/cpu/topology: Provide logical pkg/die mapping
  - x86/cpu/topology: Simplify cpu_mark_primary_thread()
  - x86/cpu/topology: Mop up primary thread mask handling
  - x86/cpu/topology: Use topology bitmaps for sizing
  - x86/cpu/topology: Let XEN/PV use topology from CPUID/MADT
  - x86/xen/smp_pv: Count number of vCPUs early
  - x86/cpu/topology: Assign hotpluggable CPUIDs during init
  - x86/cpu/topology: Reject unknown APIC IDs on ACPI hotplug
  - x86/topology: Add a mechanism to track topology via APIC IDs
  - x86/cpu: Detect real BSP on crash kernels
  - x86/cpu/topology: Rework possible CPU management
  - x86/cpu/topology: Sanitize the APIC admission logic
  - x86/smpboot: Make error message actually useful
  - x86/cpu/topology: Use a data structure for topology info
  - x86/cpu/topology: Simplify APIC registration
  - x86/cpu/topology: Confine topology information
  - x86/xen/smp_pv: Register fake APICs
  - x86/acpi: Dont invoke topology_register_apic() for XEN PV
  - x86/mpparse: Use new APIC registration function
  - x86/of: Use new APIC registration functions
  - x86/jailhouse: Use new APIC registration function
  - x86/acpi: Use new APIC registration functions
  - x86/cpu/topology: Provide separate APIC registration functions
  - x86/cpu/topology: Move registration out of APIC code
  - x86/of: Set the parse_smp_cfg for all the DeviceTree platforms by default
  - x86/hyperv/vtl: Correct x86_init.mpparse.parse_smp_cfg assignment
  - x86/of: Move the x86_flattree_get_config() call out of x86_dtb_init()
  - x86/apic: Use a proper define for invalid ACPI CPU ID
  - x86/apic: Remove yet another dubious callback
  - x86/apic: Remove the pointless writeback of boot_cpu_physical_apicid
  - x86/mpparse: Remove the physid_t bitmap wrapper
  - x86/mm/numa: Move early mptable evaluation into common code
  - x86/mpparse: Switch to new init callbacks
  - x86/hyperv/vtl: Prepare for separate mpparse callbacks
  - x86/xen/smp_pv: Prepare for separate mpparse callbacks
  - x86/jailhouse: Prepare for separate mpparse callbacks
  - x86/platform/intel-mid: Prepare for separate mpparse callbacks
  - x86/platform/ce4100: Prepare for separate mpparse callbacks
  - x86/dtb: Rename x86_dtb_init()
  - x86/mpparse: Prepare for callback separation
  - x86/mpparse: Provide separate early/late callbacks
  - x86/mpparse: Rename default_find_smp_config()
  - x86/apic: Remove check_apicid_used() and ioapic_phys_id_map()
  - x86/ioapic: Simplify setup_ioapic_ids_from_mpc_nocheck()
  - x86/ioapic: Make io_apic_get_unique_id() simpler
  - x86/apic: Get rid of get_physical_broadcast()
  - x86/ioapic: Replace some more set bit nonsense
  - x86/platform/ce4100: Dont override x86_init.mpparse.setup_ioapic_ids
  - x86/xen: return a sane initial apic id when running as PV guest
  - x86/cpu/topology: Make the APIC mismatch warnings complete
  - Solve kernel ABI issues introduced by x86_coreid_bits updates
  - x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON
  - x86/apic/uv: Remove the private leaf 0xb parser
  - x86/xen/smp_pv: Remove cpudata fiddling
  - x86/apic: Remove unused phys_pkg_id() callback
  - x86/cpu: Remove x86_coreid_bits
  - x86/cpu: Remove topology.c
  - x86/cpu: Make topology_amd_node_id() use the actual node info
  - x86/mm/numa: Use core domain size on AMD
  - x86/cpu: Use common topology code for HYGON
  - x86/cpu: Use common topology code for AMD
  - x86/smpboot: Teach it about topo.amd_node_id
  - x86/topology/amd: Evaluate SMT in CPUID leaf 0x8000001e only on family 0x17 and greater
  - x86/topology/amd: Ensure that LLC ID is initialized
  - x86/cpu/amd: Move TOPOEXT enablement into the topology parser
  - x86/cpu/amd: Make the NODEID_MSR union actually work
  - x86/cpu/amd: Make the CPUID 0x80000008 parser correct
  - x86/cpu: Provide an AMD/HYGON specific topology parser
  - x86/cpu/amd: Provide a separate accessor for Node ID
  - x86/topology/intel: Unlock CPUID before evaluating anything
  - x86/cpu: Use common topology code for Intel
  - x86/cpu: Provide a sane leaf 0xb/0x1f parser
  - x86/cpu: Move __max_die_per_package to common.c
  - x86/cpu: Use common topology code for Centaur and Zhaoxin
  - x86/cpu: Add legacy topology parser
  - x86/cpu: Provide cpu_init/parse_topology()
  - x86/cpuid: Include <linux/build_bug.h> in <asm/cpuid.h>
  - x86/cpu: Provide cpuid_read() et al.
  - Revert "RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor"
  - Solve kernel ABI issues introduced by cpuinfo_x86 updates
  - x86/cpu: Provide debug interface
  - x86/cpu/topology: Cure the abuse of cpuinfo for persisting logical ids
  - x86/apic, x86/hyperv: Use u32 in hv_snp_boot_ap() too
  - x86/apic: Use u32 for wakeup_secondary_cpu[_64]()
  - x86/apic: Use u32 for [gs]et_apic_id()
  - x86/apic: Use u32 for phys_pkg_id()
  - x86/apic: Use u32 for cpu_present_to_apicid()
  - x86/apic: Use u32 for check_apicid_used()
  - x86/apic: Use u32 for APIC IDs in global data
  - x86/apic: Use BAD_APICID consistently
  - x86/cpu: Move cpu_l[l2]c_id into topology info
  - x86/cpu: Move logical package and die IDs into topology info
  - x86/cpu: Move cu_id into topology info
  - x86/cpu: Move cpu_core_id into topology info
  - hwmon: (fam15h_power) Use topology_core_id()
  - scsi: lpfc: Use topology_core_id()
  - x86/cpu: Move cpu_die_id into topology info
  - x86/cpu: Move phys_proc_id into topology info
  - x86/cpu: Encapsulate topology information in cpuinfo_x86
  - urma: fix bonding udata exchange for imported seg/jetty objects.
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
  - urma: fix log error in connect
  - urma: fix kmod log format error
  - x86/uprobes: Fix XOL allocation failure for 32-bit tasks
  - pstore/ram: fix buffer overflow in persistent_ram_save_old()
  - urma: fix ubcore connect error
  - urma: fix error for setting conn timeout
  - ub: udma: change return value format.
  - drivers/ub/sentry: add some log for sent_cnt and remote_recv_cnt
  - drivers/ub/sentry: Refactor the message data format sent via UVB/URMA
  - net/mlx5e: Fix race condition during IPSec ESN update
  - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario
  - nvdimm/bus: Fix potential use after free in asynchronous initialization
  - urma: fix bind jetty compat error
  - net/mlx5e: Prevent concurrent access to IPSec ASO context
  - urma: change urma kmod errno
  - urma:delete redundant sub_trans_mode_cap in urma
  - RDMA/hns: Fix config the CNP DSCP
  - RDMA/hns: Fix the panic caused by a large number of print
  - media: dvb-net: fix OOB access in ULE extension header tables
  - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
  - urma: bonding support health check
  - xSched: update xSched manual for xcu cmdline enable option
  - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig
  - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16
  - xSched/cgroup: make xcu.stat invisible at root cgroup
  - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI
  - apparmor: validate DFA start states are in bounds in unpack_pdb
  - tcp: secure_seq: add back ports to TS offset
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
  - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
  - ice: Fix memory leak in ice_set_ringparam()
  - bpf: Fix regsafe() for pointers to packet
  - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.4.144
changelog:
  - !21886 urma: fix peer reconnection notification after ubagg failover
  - urma: fix peer reconnection notification after ubagg failover
  - urma: add configurable retransmission count limit
  - urma: fix tjetty creation anomaly in the first connection creation
  - !21879 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-147.0.0 to 6.6.0-148.0.0
  - urma: fix kernel irq profiling
  - xSched: remove redundant lookup in alloc_ctx_from_vstream to enforce allocation semantics
  - xSched/cgroup: prevent to init xse when xcu cgroup is disabled
  - urma: fix the panic issue caused by ipourma abnormal exit
  - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
  - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume
  - net: macb: Introduce gem_init_rx_ring()
  - net: macb: queue tie-off or disable during WOL suspend
  - net: macb: Shuffle the tx ring before enabling tx
  - net: macb: Fix tx/rx malfunction after phy link down and up
  - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race
  - net: openvswitch: Avoid releasing netdev before teardown completes
  - ext4: fix error message when rejecting the default hash
  - ext4: filesystems without casefold feature cannot be mounted with siphash
  - Revert "iommu/amd: Skip enabling command/event buffers for kdump"
  - firmware: arm_scmi: Fix unused notifier-block in unregister
  - tty: fix tty_port_tty_*hangup() kernel-doc
  - pwm: stm32: Always program polarity
  - virtio_console: fix order of fields cols and rows
  - mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result()
  - mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs()
  - mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration()
  - mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions()
  - mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out()
  - mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate()
  - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of()
  - mm/damon/tests/core-kunit: handle memory failure from damon_test_target()
  - mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two()
  - mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of()
  - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at()
  - mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions()
  - mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter()
  - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ()
  - net: Allow to use SMP threads for backlog NAPI.
  - net: Remove conditional threaded-NAPI wakeup based on task state.
  - sched/fair: Small cleanup to sched_balance_newidle()
  - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions()
  - mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail()
  - media: mediatek: vcodec: Use spinlock for context list protection lock
  - media: amphion: Remove vpu_vb_is_codecconfig
  - media: amphion: Make some vpu_v4l2 functions static
  - media: amphion: Add a frame flush mode for decoder
  - KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit
  - powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
  - mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize()
  - mm/balloon_compaction: we cannot have isolated pages in the balloon list
  - media: verisilicon: Fix CPU stalls on G2 bus error
  - media: verisilicon: g2: Use common helpers to compute chroma and mv offsets
  - media: verisilicon: Store chroma and motion vectors offset
  - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
  - f2fs: use global inline_xattr_slab instead of per-sb slab cache
  - f2fs: fix to propagate error from f2fs_enable_checkpoint()
  - f2fs: fix to avoid updating compression context during writeback
  - f2fs: drop inode from the donation list when the last file is closed
  - f2fs: keep POSIX_FADV_NOREUSE ranges
  - f2fs: remove unused GC_FAILURE_PIN
  - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
  - powerpc/64s/radix/kfence: map __kfence_pool at page granularity
  - drm/mediatek: Fix probe resource leaks
  - drm/mediatek: Fix probe memory leak
  - drm/amdgpu: Forward VMID reservation errors
  - net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration
  - pmdomain: imx: Fix reference count leak in imx_gpc_probe()
  - pmdomain: Use device_get_match_data()
  - wifi: mac80211: Discard Beacon frames to non-broadcast address
  - lockd: fix vfs_test_lock() calls
  - mptcp: fallback earlier on simult connection
  - PCI: brcmstb: Fix disabling L0s capability
  - ARM: dts: microchip: sama7g5: fix uart fifo size to 32
  - gpiolib: acpi: Add quirk for Dell Precision 7780
  - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
  - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error
  - usb: ohci-nxp: fix device leak on probe failure
  - usb: ohci-nxp: Use helper function devm_clk_get_enabled()
  - mm/ksm: fix exec/fork inheritance support for prctl
  - wifi: mt76: Fix DTS power-limits on little endian systems
  - btrfs: don't rewrite ret from inode_permission
  - gfs2: fix freeze error handling
  - jbd2: fix the inconsistency between checksum and data in memory for journal sb
  - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()
  - ALSA: wavefront: Clear substream pointers on close
  - ALSA: wavefront: Use guard() for spin locks
  - ALSA: wavefront: Fix integer overflow in sample size validation
  - ALSA: wavefront: Use standard print API
  - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
  - drm/msm/dpu: Add missing NULL pointer check for pingpong interface
  - drm/mgag200: Fix big-endian support
  - drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()
  - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
  - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
  - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma
  - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()
  - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
  - net: usb: sr9700: fix incorrect command used to write single register
  - nfsd: Drop the client reference in client_states_open()
  - LoongArch: BPF: Zero-extend bpf_tail_call() index
  - fjes: Add missing iounmap in fjes_hw_init()
  - samples/ftrace: Adjust LoongArch register restore order in direct calls
  - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting
  - idr: fix idr_alloc() returning an ID out of range
  - kasan: refactor pcpu kasan vmalloc unpoison
  - compiler_types.h: add "auto" as a macro for "__auto_type"
  - LoongArch: Use unsigned long for _end and _text
  - LoongArch: Use __pmd()/__pte() for swap entry conversions
  - LoongArch: Fix build errors for CONFIG_RANDSTRUCT
  - LoongArch: Add new PCI ID for pci_fixup_vgadev()
  - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
  - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
  - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
  - media: amphion: Cancel message work before releasing the VPU core
  - media: vpif_display: fix section mismatch
  - media: vpif_capture: fix section mismatch
  - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
  - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
  - media: TDA1997x: Remove redundant cancel_delayed_work in probe
  - media: samsung: exynos4-is: fix potential ABBA deadlock on init
  - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled
  - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread()
  - media: cec: Fix debugfs leak on bus_register() failure
  - fbdev: tcx.c fix mem_map to correct smem_start offset
  - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
  - fbdev: gbefb: fix to use physical address instead of dma address
  - dm-bufio: align write boundary on physical block size
  - dm-ebs: Mark full buffer dirty even on partial write
  - firmware: stratix10-svc: Add mutex in stratix10 memory management
  - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status()
  - powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION
  - parisc: entry: set W bit for !compat tasks in syscall_restore_rfi()
  - parisc: entry.S: fix space adjustment on interruption for 64-bit userspace
  - media: rc: st_rc: Fix reset control resource leak
  - mfd: max77620: Fix potential IRQ chip conflict when probing two devices
  - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup
  - clk: samsung: exynos-clkout: Assign .num before accessing .hws
  - leds: leds-lp50xx: Enable chip before any communication
  - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
  - leds: leds-lp50xx: Allow LED 0 to be added to module bank
  - powerpc, mm: Fix mprotect on book3s 32-bit
  - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
  - HID: logitech-dj: Remove duplicate error logging
  - iommu: disable SVA when CONFIG_X86 is set
  - iommu/tegra: fix device leak on probe_device()
  - iommu/sun50i: fix device leak on of_xlate()
  - iommu/qcom: fix device leak on of_xlate()
  - iommu/omap: fix device leaks on probe_device()
  - iommu/mediatek: fix device leak on of_xlate()
  - iommu/mediatek-v1: fix device leaks on probe()
  - iommu/mediatek-v1: fix device leak on probe_device()
  - iommu/ipmmu-vmsa: fix device leak on of_xlate()
  - iommu/exynos: fix device leak on of_xlate()
  - iommu/apple-dart: fix device leak on of_xlate()
  - iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
  - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment.
  - ASoC: qcom: q6adm: the the copp device only during last instance
  - ASoC: qcom: q6asm-dai: perform correct state check before closing
  - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr
  - ASoC: stm32: sai: fix OF node leak on probe
  - ASoC: stm32: sai: fix clk prepare imbalance on probe failure
  - ASoC: stm32: sai: fix device leak on probe
  - ntfs: Do not overwrite uptodate pages
  - selftests/ftrace: traceonoff_triggers: strip off names
  - RDMA/bnxt_re: fix dma_free_coherent() pointer
  - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
  - ksmbd: Fix memory leak in get_file_all_info()
  - RDMA/bnxt_re: Fix to use correct page size for PDE table
  - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
  - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
  - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
  - RDMA/efa: Remove possible negative shift
  - RDMA/irdma: avoid invalid read in irdma_net_event
  - net: rose: fix invalid array index in rose_kill_by_device()
  - net: stmmac: fix the crash issue for zero copy XDP_TX action
  - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
  - platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing
  - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
  - net: dsa: b53: skip multicast entries for fdb_dump()
  - firewire: nosy: Fix dma_free_coherent() size
  - genalloc.h: fix htmldocs warning
  - selftests: net: fix "buffer overflow detected" for tap.c
  - amd-xgbe: reset retries and mode on RX adapt failures
  - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic
  - platform/x86: msi-laptop: add missing sysfs_remove_group()
  - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
  - net: mdio: aspeed: add dummy read to avoid read-after-write issue
  - Bluetooth: btusb: revert use of devm_kzalloc in btusb
  - i40e: fix scheduling in set_rx_mode
  - wifi: mac80211: do not use old MBSSID elements
  - iommu/mediatek: fix use-after-free on probe deferral
  - ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32
  - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
  - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
  - hwmon: (max16065) Use local variable to avoid TOCTOU
  - i2c: amd-mp2: fix reference leak in MP2 PCI device
  - platform/x86: intel: chtwc_int33fe: don't dereference swnode args
  - rpmsg: glink: fix rpmsg device leak
  - ub: udma: fix a bug related to get tp list.
  - perf/core: Fix race between perf_event_exit_task and perf_pending_task
  - userfaultfd: fix kabi breakage due to struct userfaultfd_ctx
  - mm/mremap: fix WARN with uffd that has remap events disabled
  - mm: clear uffd-wp PTE/PMD state on mremap()
  - userfaultfd: move userfaultfd_ctx struct to header file
  - urma: add timeout mechanism for TP state waiting loop
  - ub: udma: bugfix related to stars jfc db.
  - net: usb: kaweth: validate USB endpoints
  - arm64: mm: fix pass user prot to ioremap_prot in generic_access_phys
  - RDMA/hns: Support setting GSI QP SL
  - RDMA/hns: Fix warning in poll cq direct mode
  - RDMA/hns: Fix missing CQE when UD QP use different SL
  - ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
  - xsk: introduce helper to determine rxq->frag_size
  - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
  - urma: fix log implementation in urma kmod
  - urma: fix deactivate tp failure under RM share TP mode
  - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
  - smb: client: fix krb5 mount with username option
  - io_uring/poll: fix multishot recv missing EOF on wakeup race
  - io_uring/poll: improve readability of poll reference decrementing
  - LoongArch: efi: avoid double calling set_virtual_map()
  - LoongArch: Fix the improper handling of the set_virtual_map's return value
  - LoongArch: Disable instrumentation for setup_ptwalker()
  - LoongArch: Remove some code if kasan_arch_is_ready() is false
  - LoongArch: entry: Migrate ret_from_fork() to C
  - LoongArch: Clarify 3 MSG interrupt features
  - LoongArch: Always select HAVE_VIRT_CPU_ACCOUNTING_GEN
  - drivers/amdgpu: amd rx550 should emit 10 fences after run a command
  - LoongArch: Fix AP booting issue in VM mode
  - LoongArch: Increase COMMAND_LINE_SIZE up to 4096
  - LoongArch: Relax memory ordering for atomic operations
  - pci/quirks: 2k3000: set discrete GPU as default boot device if present
  - drm/amdgpu: Make eleven EOP packet for GFX10_0/GFX11_0 have real content
  - urma: fix of adapt to bondp_import
  - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
  - ACPI: APEI: GHES: Don't send SIGBUS to kernel threads on ARM HW errors
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
  - net/sched: teql: Fix double-free in teql_master_xmit
  - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
  - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
  - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
  - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
  - ipv6: add NULL checks for idev in SRv6 paths
  - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
  - sunrpc: fix cache_request leak in cache_release
  - urma: fix psn exchange anomaly when import jfr
  - mfs: fix race condition issue in try_hook_fd()
  - drivers/loongson-pwm: sync master patch to fix pwm driver
  - LoongArch:stmmac:fix mdc too high issues.
  - LoongArch: gpio: read/write mode to 8bit in BIT_CTRL_MODE
  - drivers/pwm: export symbol for pwm_add_table
  - LoongArch: config: Revert CONFIG_RTC_DRV_EFI back to 'm'
  - urma: fix psn exchange anomaly under share_tp mode
  - RNP: NET: Update driver to 1.0.0
  - RNPGBE: NET: Update driver to 1.0.0
  - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
  - intel_th: fix device leak on output open()
  - usb: gadget: lpc32xx_udc: fix clock imbalance in error path
  - Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
  - efi/cper: Fix cper_bits_to_str buffer handling and return value
  - soc: amlogic: canvas: fix device leak on lookup
  - soc: qcom: ocmem: fix device leak on lookup
  - tracing: Fix fixed array of synthetic event
  - amba: tegra-ahb: Fix device leak on SMMU enable
  - crypto: caam - Add check for kcalloc() in test_len()
  - selftests: openvswitch: Fix escape chars in regexp.
  - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
  - s390/ipl: Clear SBP flag when bootprog is set
  - btrfs: don't log conflicting inode if it's a dir moved in the current transaction
  - svcrdma: return 0 on success from svc_rdma_copy_inline_range
  - nfsd: Mark variable __maybe_unused to avoid W=1 build break
  - net/handshake: restore destructor on submit failure
  - r8169: fix RTL8117 Wake-on-Lan in DASH mode
  - xfs: fix a memory leak in xfs_buf_item_init()
  - KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits
  - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN)
  - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN
  - KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation
  - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN
  - KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE
  - KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn()
  - KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0
  - parisc: Do not reprogram affinitiy on ASP chip
  - scs: fix a wrong parameter in __scs_magic
  - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
  - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI)
  - ocfs2: fix kernel BUG in ocfs2_find_victim_chain
  - media: vidtv: initialize local pointers upon transfer of memory ownership
  - tools/testing/nvdimm: Use per-DIMM device handle
  - f2fs: fix return value of f2fs_recover_fsync_data()
  - f2fs: fix age extent cache insertion skip on counter overflow
  - f2fs: invalidate dentry cache on failed whiteout creation
  - f2fs: fix to avoid updating zero-sized extent in extent cache
  - f2fs: ensure node page reads complete before f2fs_put_super() finishes
  - NFSD: use correct reservation type in nfsd4_scsi_fence_client
  - scsi: aic94xx: fix use-after-free in device removal path
  - cpufreq: nforce2: fix reference count leak in nforce2
  - cpuidle: governors: teo: Drop misguided target residency check
  - intel_th: Fix error handling in intel_th_output_open
  - char: applicom: fix NULL pointer dereference in ac_ioctl
  - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc()
  - usb: dwc3: keep susphy enabled during exit to avoid controller faults
  - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe
  - usb: phy: isp1301: fix non-OF device reference imbalance
  - usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal
  - USB: lpc32xx_udc: Fix error handling in probe
  - phy: broadcom: bcm63xx-usbh: fix section mismatches
  - media: pvrusb2: Fix incorrect variable used in trace message
  - usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
  - media: v4l2-mem2mem: Fix outdated documentation
  - jbd2: use a weaker annotation in journal handling
  - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key
  - ext4: fix incorrect group number assertion in mb_check_buddy
  - ktest.pl: Fix uninitialized var in config-bisect.pl
  - kallsyms: Fix wrong "big" kernel symbol type read from procfs
  - floppy: fix for PAGE_SIZE != 4KB
  - block: rate-limit capacity change info log
  - s390/dasd: Fix gendisk parent after copy pair swap
  - lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
  - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition
  - vhost/vsock: improve RCU read sections around vhost_vsock_get()
  - block: rnbd-clt: Fix signedness bug in init_dev()
  - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks
  - nvme-fc: don't hold rport lock when putting ctrl
  - i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware
  - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map
  - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready
  - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive.
  - usb: xhci: limit run_graceperiod for only usb 3.0 devices
  - iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains
  - usbip: Fix locking bug in RT-enabled kernels
  - exfat: fix remount failure in different process environments
  - reset: fix BIT macro reference
  - via_wdt: fix critical boot hang due to unnamed resource allocation
  - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write
  - fuse: Always flush the page cache before FOPEN_DIRECT_IO write
  - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
  - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
  - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
  - powerpc/addnote: Fix overflow on 32-bit builds
  - clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4
  - ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
  - firmware: imx: scu-irq: Init workqueue before request mbox channel
  - ipmi: Fix __scan_channels() failing to rescan channels
  - ipmi: Fix the race between __scan_channels() and deliver_response()
  - ALSA: usb-mixer: us16x08: validate meter packet indices
  - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
  - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
  - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
  - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml
  - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig
  - spi: fsl-cpm: Check length parity before switching to 16 bit mode
  - can: gs_usb: gs_can_open(): fix error handling
  - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
  - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
  - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
  - ksmbd: fix buffer validation by including null terminator size in EA length
  - ksmbd: skip lock-range check on equal size to avoid size==0 underflow
  - block: rnbd-clt: Fix leaked ID in init_dev()
  - spi: cadence-quadspi: Fix clock disable on probe failure path
  - x86/xen: Fix sparse warning in enlighten_pv.c
  - x86/xen: Move Xen upcall handler
  - drm/panel: sony-td4353-jdi: Enable prepare_prev_first
  - MIPS: Fix a reference leak bug in ip22_check_gio()
  - hwmon: (tmp401) fix overflow caused by default conversion rate value
  - hwmon: (ibmpex) fix use-after-free in high/low store
  - net: enetc: do not transmit redirected XDP frames when the link is down
  - net/handshake: duplicate handshake cancellations leak socket
  - net/mlx5: Serialize firmware reset with devlink
  - net/mlx5: Skip HotPlug check on sync reset using hot reset
  - net/mlx5: fw_tracer, Handle escaped percent properly
  - net/mlx5: Drain firmware reset in shutdown callback
  - net/mlx5: fw reset, clear reset requested on drain_fw_reset
  - iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED
  - netfilter: nf_tables: pass context structure to nft_parse_register_load
  - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
  - caif: fix integer underflow in cffrml_receive()
  - broadcom: b44: prevent uninitialized value usage
  - mlxsw: spectrum_router: Fix possible neighbour reference count leak
  - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
  - netrom: Fix memory leak in nr_sendmsg()
  - net: fec: ERR007885 Workaround for XDP TX path
  - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
  - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV
  - ksmbd: vfs: fix race on m_flags in vfs_cache
  - gfs2: fix remote evict for read-only filesystems
  - btrfs: scrub: always update btrfs_scrub_progress::last_physical
  - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
  - hfsplus: fix volume corruption issue for generic/073
  - hfsplus: Verify inode mode when loading from disk
  - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
  - hfsplus: fix volume corruption issue for generic/070
  - ntfs: set dummy blocksize to read boot_block when mounting
  - kbuild: Use objtree for module signing key path
  - fs/ntfs3: Support timestamps prior to epoch
  - livepatch: Match old_sympos 0 and 1 in klp_find_func()
  - cpuidle: menu: Use residency threshold in polling state override decisions
  - cpufreq: s5pv210: fix refcount leak
  - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist
  - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
  - x86/ptrace: Always inline trivial accessors
  - iomap: account for unaligned end offsets when truncating read range
  - btrfs: fix memory leak of fs_devices in degraded seed device path
  - btrfs: fix a potential path leak in print_data_reloc_error()
  - btrfs: do not skip logging new dentries when logging a new name
  - ALSA: dice: fix buffer overflow in detect_stream_formats()
  - usb: phy: Initialize struct usb_phy list_head
  - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt
  - net: lan743x: Allocate rings outside ZONE_DMA
  - ocfs2: fix memory leak in ocfs2_merge_rec_left()
  - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
  - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
  - efi/cper: Adjust infopfx size to accept an extra space
  - efi/cper: Add a new helper function to print bitmasks
  - dm log-writes: Add missing set_freezable() for freezable kthread
  - dm-raid: fix possible NULL dereference with undefined raid type
  - ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad()
  - ALSA: firewire-motu: add bounds check in put_user loop for DSP events
  - rtc: gamecube: Check the return value of ioremap()
  - ALSA: uapi: Fix typo in asound.h comment
  - dma/pool: eliminate alloc_pages warning in atomic_pool_expand
  - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
  - nvme-auth: use kvfree() for memory allocated with kvcalloc()
  - ASoC: ak5558: Disable regulator when error happens
  - ASoC: ak4458: Disable regulator when error happens
  - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure()
  - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
  - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
  - NFS: Fix inheritance of the block sizes when automounting
  - Expand the type of nfs_fattr->valid
  - Revert "nfs: clear SB_RDONLY before getting superblock"
  - Revert "nfs: ignore SB_RDONLY when remounting nfs"
  - NFS: Initialise verifiers for visible dentries in nfs_atomic_open()
  - NFS: Initialise verifiers for visible dentries in readdir and lookup
  - fs/nls: Fix utf16 to utf8 conversion
  - NFS: Avoid changing nlink when file removes and attribute updates race
  - 9p: fix cache/debug options printing in v9fs_show_options
  - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
  - pinctrl: single: Fix incorrect type for error return variable
  - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling
  - perf tools: Fix split kallsyms DSO counting
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
  - clk: keystone: fix compile testing
  - md/raid5: fix IO hang when array is broken with IO inflight
  - remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs
  - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
  - selftests: bonding: add delay before each xvlan_over_bond connectivity check
  - selftests: bonding: add ipvlan over bond testing
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
  - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
  - hisi-cca-da: Fix compile warnings when CONFIG_HISI_CCA=n.
  - ub: cdma: cdma code format issue bugfix
  - i3c: master: Inherit DMA masks and parameters from parent device
  - urma: bugfix ubagg get physical dev info acquisition
  - !21874 urma: add software reliability for create and destroy connection
  - urma: add software reliability for create and destroy connection


author: liyancheng <412998149@qq.com> - 12.3.1-66
changelog:
  - Type:Sync
  - ID:NA
  - SUG:NA
  - DESC:Don't use local_detect_cpu when cross build and fix hip09 costs.


author: Funda Wang <fundawang@yeah.net> - 1:2.4.7-7
changelog:
  - fix CVE-2025-58060, CVE-2025-58364
  - move www files into main package due to requirement by web interface


author: Funda Wang <fundawang@yeah.net> - 140.5.0-1
changelog:
  - update to 140.5.0
    * fix CVE-2025-13012, CVE-2025-13013, CVE-2025-13014, CVE-2025-13015,
      CVE-2025-13016, CVE-2025-13017, CVE-2025-13018, CVE-2025-13019,
      CVE-2025-13020


author: Funda Wang <fundawang@yeah.net> - 140.7.0-1
changelog:
  - update to 140.7.0
    * fix CVE-2026-0877, CVE-2026-0878, CVE-2026-0879, CVE-2026-0880,
      CVE-2026-0882, CVE-2025-14327, CVE-2026-0883, CVE-2026-0884,
      CVE-2026-0885, CVE-2026-0886, CVE-2026-0887, CVE-2026-0890,
      CVE-2026-0891


author: wangkai <13474090681@163.com> - 2:2.11.7-1
changelog:
  - Update to 2.11.7 for fix CVE-2024-32039,CVE-2024-32040,
    CVE-2024-32041,CVE-2024-32458,CVE-2024-32459,CVE-2024-32460,
    CVE-2024-32658,CVE-2024-32659 and CVE-2024-32660


author: wangkai <13474090681@163.com> - 2:2.11.8-1
changelog:
  - Update to 2.11.8
  - Fix CVE-2026-22852, CVE-2026-22856, CVE-2026-22859, CVE-2026-23530, CVE-2026-23531,
    CVE-2026-23532, CVE-2026-23534, CVE-2026-24491, CVE-2026-24675, CVE-2026-24676,
    CVE-2026-24679, CVE-2026-24681, CVE-2026-24682, CVE-2026-24683, CVE-2026-24684,
    CVE-2026-25997, CVE-2026-26271, CVE-2026-26986, CVE-2026-27015, CVE-2026-25941,
    CVE-2026-22855, CVE-2026-22857, CVE-2026-23533, CVE-2026-23732, CVE-2026-23883,
    CVE-2026-23884


author: wangkai <13474090681@163.com> - 2:2.11.8-3
changelog:
  - Fix CVE-2026-26955, CVE-2026-26965, CVE-2026-31806, CVE-2026-31883, CVE-2026-31885,
    CVE-2026-33984, CVE-2026-33983


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-98
changelog:
  - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module
  - posix: Run tst-wordexp-reuse-mem test
  - elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-101
changelog:
  - Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046)
  - Document CVE-2026-4046


author: xinghe <xinghe2@h-partners.com> - 2.9.5-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:stream: Prevent mux upgrades if client connection is no longer ready


author: yanglu <yanglu72@h-partners.com> - 2.9.5-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:queues:Do not use pendconn_grab_from_px
         queues:Make sure we call process_srv_queue when leaving
         queue:Make process_srv_queue return the number of streams


author: xinghe <xinghe2@h-partners.com> - 2.9.5-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:haproxy: only tid 0 must not sleep if got signal
         server/addr: fix tune.events.max-events-at-once event miss and leak


author: yaoxin <yao_xin001@hoperun.com> - 1.14.5-1
changelog:
  - Update to 1.14.5:
    * Added signed Windows msi binary and signed Apple dmg binary files.
    * Moved examples to the HDF5Examples folder in the source tree.
    * Added support for using zlib-ng package as the zlib library
    * Disable CMake UNITY_BUILD for hdf5
    * Removed "function/code stack" debugging configuration option
    * Added configure options for enabling/disabling non-standard programming language features
    * Added the CMake variable HDF5_ENABLE_ROS3_VFD to the HDF5 CMake config
      file hdf5-config.cmake. This allows it to easily detect if the library
      has been built with or without read-only S3 functionality.
    * Fixed many CVE:
      CVE-2024-29157,CVE-2024-29158,CVE-2024-29159,CVE-2024-29160,CVE-2024-29161,CVE-2024-29162
      CVE-2024-29163,CVE-2024-29164,CVE-2024-29165,CVE-2024-29166,CVE-2024-32605,CVE-2024-32606
      CVE-2024-32607,CVE-2024-32608,CVE-2024-32609,CVE-2024-32610,CVE-2024-32611,CVE-2024-32612
      CVE-2024-32613,CVE-2024-32614,CVE-2024-32615,CVE-2024-32616,CVE-2024-32617,CVE-2024-32618
      CVE-2024-32619,CVE-2024-32620,CVE-2024-32621,CVE-2024-32622,CVE-2024-32623,CVE-2024-32624
      CVE-2024-33873,CVE-2024-33874,CVE-2024-33875,CVE-2024-33876,CVE-2024-33877,CVE-2018-13871
      CVE-2018-13875,CVE-2018-14034


author: Funda Wang <fundawang@yeah.net> - 1.14.5-2
changelog:
  - add patches from azure linux for fixing CVE-2025-2153, CVE-2025-2310,
    CVE-2025-2914, CVE-2025-2926, CVE-2025-6816, CVE-2025-2925,
    CVE-2025-2924, CVE-2025-44905, CVE-2025-6269, CVE-2025-6750,
    CVE-2025-6857, CVE-2025-7067, CVE-2025-7068, CVE-2025-6858,
    CVE-2025-2923, CVE-2025-2913, CVE-2025-6516, CVE-2025-6818,
    CVE-2025-6817, CVE-2025-6856, CVE-2025-7069


author: yangyingqing <yangyingqing@h-partners.com> -1:11.0.31.11-0
changelog:
  - update to 11.0.31+11(GA)
  - modify G1-interate-region-by-bitmap-rather-than-obj-size-in.patch
  - delete fix-libpng-API-allow-reading-up-to-1012-bytes-beyond-the-png-sRGB-bbase-array-bug.patch
  - delete fix-libpng-CVE-2026-22695.patch
  - delete 8373476-tz-Update-Timezone-Data-to-2025c.patch
  - delete fix-libpng-CVE-2026-25646.patch
  - add Use-stlr-for-putOrdered.patch


author: wangkai <13474090681@163.com> - 2.5.31-3
changelog:
  - Fix CVE-2026-40334, CVE-2026-40334, CVE-2026-40338, CVE-2026-40339,
    CVE-2026-40340, CVE-2026-40341


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-7
changelog:
  - Type:cves
  - ID:CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913
  - SUG:NA
  - DESC:fix CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-10
changelog:
  - Type:cves
  - ID:CVE-2025-4476 CVE-2025-4948 CVE-2025-4969
  - SUG:NA
  - DESC:fix CVE-2025-4476 CVE-2025-4948 CVE-2025-4969


author: nickyang <nickyang228@163.com> - 2.74.3-12
changelog:
  - Type:cves
  - ID:CVE-2026-1539 CVE-2026-1467 CVE-2026-1761 CVE-2026-0716
  - SUG:NA
  - DESC:fix CVE-2026-1539 CVE-2026-1467 CVE-2026-1761 CVE-2026-0716


author: nickyang <nickyang228@163.com> - 2.74.3-13
changelog:
  - Type:cves
  - ID:CVE-2026-1760 CVE-2026-1801 CVE-2026-2369
  - SUG:NA
  - DESC:fix CVE-2026-1760 CVE-2026-1801 CVE-2026-2369


author: wangkai <13474090681@163.com> - 8.0.40-1
changelog:
  - Update to 8.0.40 for fix CVEs(CVE-2024-21218,CVE-2024-21196,CVE-2024-21207,
    CVE-2024-21198,CVE-2024-21203,CVE-2024-21213,CVE-2024-21239,CVE-2024-21199,
    CVE-2024-21197,CVE-2024-21247,CVE-2024-21193,CVE-2024-21212,CVE-2024-21241,
    CVE-2024-21230,CVE-2024-21236,CVE-2024-21194,CVE-2024-21238,CVE-2024-21237,
    CVE-2024-21201,CVE-2024-21231,CVE-2024-21219,CVE-2024-21185)


author: yaoxin <1024769339@qq.com> - 8.0.41-1
changelog:
  - Update to 8.0.41 for fix CVEs(CVE-2025-21490,CVE-2025-21491,CVE-2025-21495,
    CVE-2025-21497,CVE-2025-21500,CVE-2025-21501,CVE-2025-21503,CVE-2025-21505,
    CVE-2025-21518,CVE-2025-21519,CVE-2025-21520,CVE-2025-21522,CVE-2025-21523,
    CVE-2025-21529,CVE-2025-21531,CVE-2025-21540,CVE-2025-21543,CVE-2025-21546,
    CVE-2025-21555,CVE-2025-21559)


author: yaoxin <1024769339@qq.com> - 8.0.42-1
changelog:
  - Update to 8.0.42 for fix CVEs(CVE-2025-21574,CVE-2025-21575,CVE-2025-21577,
    CVE-2025-21580,CVE-2025-21581,CVE-2025-21584,CVE-2025-21585,CVE-2025-30681,
    CVE-2025-30682,CVE-2025-30683,CVE-2025-30684,CVE-2025-30685,CVE-2025-30687,
    CVE-2025-30688,CVE-2025-30689,CVE-2025-30693,CVE-2025-30695,CVE-2025-30696,
    CVE-2025-30699,CVE-2025-30703,CVE-2025-30704,CVE-2025-30705,CVE-2025-30710,
    CVE-2025-30715,CVE-2025-30721,CVE-2025-30722


author: yaoxin <1024769339@qq.com> - 8.0.43-1
changelog:
  - Update to 8.4.6 for fix CVEs (CVE-2025-50068,CVE-2025-50077,CVE-2025-50078,
    CVE-2025-50079,CVE-2025-50080,CVE-2025-50081,CVE-2025-50082,CVE-2025-50083,
    CVE-2025-50084,CVE-2025-50085,CVE-2025-50086,CVE-2025-50087,CVE-2025-50091,
    CVE-2025-50092,CVE-2025-50093,CVE-2025-50094,CVE-2025-50096,CVE-2025-50097,
    CVE-2025-50098,CVE-2025-50099,CVE-2025-50100,CVE-2025-50101,CVE-2025-50102,
    CVE-2025-50104,CVE-2025-53023)


author: wangkai <13474090681@163.com> - 8.0.44-1
changelog:
  - Update to 8.0.44 for fix CVEs (CVE-2025-53069,CVE-2025-53062,CVE-2025-53054,
    CVE-2025-53053,CVE-2025-53045,CVE-2025-53044,CVE-2025-53042,CVE-2025-53040)


author: yaoxin <1024769339@qq.com> - 8.0.45-1
changelog:
  - Update to 8.0.45 for fix CVEs (CVE-2026-21936,CVE-2026-21937,
    CVE-2026-21941,CVE-2026-21948,CVE-2026-21964,CVE-2026-21968)


author: wangkai <13474090681@163.com> - 8.0.46-1
changelog:
  - Update to 8.0.46 for fix CVEs (CVE-2026-21998, CVE-2026-22001, CVE-2026-22002,
    CVE-2026-22004, CVE-2026-22005, CVE-2026-22009, CVE-2026-22015, CVE-2026-22017,
    CVE-2026-34267, CVE-2026-34270, CVE-2026-34271, CVE-2026-34276, CVE-2026-34278,
    CVE-2026-34293, CVE-2026-34303, CVE-2026-34304, CVE-2026-34308, CVE-2026-35236,
    CVE-2026-35237, CVE-2026-35238, CVE-2026-35239, CVE-2026-35240)


author: lipengyu <lipengyu@kylinos.cn> - 3.11.6-20
changelog:
  - Type:CVE
  - CVE:CVE-2025-13836 CVE-2025-13837 CVE-2025-12084
  - SUG:NA
  - DESC:fix CVE-2025-13836 CVE-2025-13837 CVE-2025-12084


author: yueyuankun <yueyuankun@kylinos.cn> - 15.7-21
changelog:
  - spec: Remove debugsource requirement from debuginfo
  - Allow debuginfo to be installed alone without pulling in the debugsource package.


author: wjiang <app@cameyan.com> -15.7-22
changelog:
  - Backport bugfix patches from upstream
  - Fix build with binutils 2.46 (c4665d2)
  - Fix memory leak on TPM log error in mirror_one_mok_variable (92630f2)


