# changelog

author: Li Nan <linan122@huawei.com> - 6.6.0-95.0.0.99
changelog:
  - !16482 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.69-6.6.70 LTS Conflicts Patches
  - !16211 [OLK-6.6] Fix CVE-2025-22028
  - !16210 [OLK-6.6] Fix CVE-2025-22109
  - !16209 [OLK-6.6] Fix CVE-2025-22127
  - !16207 [OLK-6.6] Fix CVE-2025-22104
  - !16563 Some random fixes and cleanup to shmem
  - !16564  tracing: Fix filter string testing
  - mm/shmem: remove unneeded xa_is_value() check in shmem_unuse_swap_entries()
  - mm/shmem: fix potential dead loop in shmem_unuse()
  - mm: shmem: add missing shmem_unacct_size() in __shmem_file_setup()
  - !16536  sched: fair: Use rq_clock_task to account rq->idle_avg
  - tracing: Fix filter string testing
  - mm: shmem: avoid unpaired folio_unlock() in shmem_swapin_folio()
  - !16542  perf: Fix hang while freeing sigtrap event
  - !16313  PCI: Fix reference leak in pci_register_host_bridge()
  - !16395  PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type
  - !16246 backport mainline mm bugfix
  - !16541  irqchip/gic: remove useless printing in pv sgi
  - !16477  CVE-2024-50140
  - !16435  fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount()
  - !16372  ksmbd: Fix UAF in __close_file_table_ids
  - !16371  ext4: ignore xattrs past end
  - perf: Fix hang while freeing sigtrap event
  - irqchip/gic: remove useless printing in pv sgi
  - !16532  memcg: always call cond_resched() after fn()
  - sched: fair: Use rq_clock_task to account rq->idle_avg
  - memcg: always call cond_resched() after fn()
  - !16524 v3  CVE-2024-27079
  - iommu/vt-d: Fix NULL domain on device release
  - iommu: Fix kabi breakage for release_domain in struct iommu_ops
  - iommu: Add static iommu_ops->release_domain
  - usb: typec: ucsi: Set orientation as none when connector is unplugged
  - usb: typec: ucsi: glink: fix off-by-one in connector_status
  - usb: typec: ucsi: glink: be more precise on orientation-aware ports
  - usb: typec: ucsi: glink: set orientation aware if supported
  - usb: typec: ucsi: glink: move GPIO reading into connector_status callback
  - task_work: make TWA_NMI_CURRENT handling conditional on IRQ_WORK
  - task_work: Fix kabi breakage in enum task_work_notify_mode
  - sched/core: Disable page allocation in task_tick_mm_cid()
  - task_work: Add TWA_NMI_CURRENT as an additional notify mode.
  - wifi: ath12k: Optimize the mac80211 hw data access
  - mm/huge_memory: fix dereferencing invalid pmd migration entry
  - selftests/mm: compaction_test: support platform with huge mount of memory
  - fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount()
  - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type
  - ksmbd: Fix UAF in __close_file_table_ids
  - ext4: ignore xattrs past end
  - PCI: Fix reference leak in pci_register_host_bridge()
  - media: vimc: skip .s_stream() for stopped entities
  - media: subdev: Add v4l2_subdev_is_streaming()
  - media: subdev: Improve v4l2_subdev_enable/disable_streams_fallback
  - media: subdev: Fix use of sd->enabled_streams in call_s_stream()
  - f2fs: fix potential deadloop in prepare_compress_overwrite()
  - ax25: Remove broken autobind
  - ibmvnic: Use kernel helpers for hex dumps


author: Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-95.0.0.100
changelog:
  - RISC-V kernel upgrade to 6.6.0-95.0.0
  - Hwprobe related backport
  - Add ACPI NUMA support for RISC-V
  - Backport RISC-V external interrupt controller support for ACPI


author: Li Nan <linan122@huawei.com> - 6.6.0-96.0.0.101
changelog:
  - !16670  mm/mm_spe.c: remove redundant checks and debug prints in mm_spe probe
  - !16668  Remove useless file
  - mm/mm_spe.c: remove redundant checks and debug prints in mm_spe probe
  - Remove useless file
  - !15819 [OLK-6.6]drm/phytium: Fix some Bugs in Phytium Display Engine
  - !16627  fix move_pages return value
  - !16620  close_files(): don't bother with xchg()
  - !16604  pds_core: remove write-after-free of client_id
  - !16434  ksmbd: fix use-after-free in ksmbd_session_rpc_open
  - !16585  tracing: Fix oob write in trace_seq_to_buffer()
  - mm/migrate: convert add_page_for_migration() from follow_page() to folio_walk
  - mm/pagewalk: fix usage of pmd_leaf()/pud_leaf() without present check
  - mm/pagewalk: introduce folio_walk_start() + folio_walk_end()
  - mm: introduce vma_pgtable_walk_{begin|end}()
  - mm/migrate: use folio_likely_mapped_shared() in add_page_for_migration()
  - !16537  md: fix mddev uaf while iterating all_mddevs list
  - !16538  md/raid10: wait barrier before returning discard request with REQ_NOWAIT
  - !16494  scsi: st: Fix array overflow in st_setup()
  - !16582  module: ensure that kobject_put() is safe for module type kobjects
  - !16605  iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
  - !16606  CVE-2024-58100
  - close_files(): don't bother with xchg()
  - !16609 migration: update status after RAS error
  - !16586  dlm: prevent NPD when writing a positive value to event_done
  - !16580  dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature
  - bpf: Fix kabi breakage for changes_pkt_data in struct bpf_prog_aux
  - bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs
  - bpf: check changes_pkt_data property for extension programs
  - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
  - pds_core: remove write-after-free of client_id
  - !16571  Fix erofs fid overflow
  - !16574  cgroup/cpuset-v1: Add missing support for cpuset_v2_mode
  - !16550  media: venus: hfi_parser: refactor hfi packet parsing logic
  - !16549  soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()
  - !16600  ftrace: Fix preemption accounting for stacktrace trigger command
  - !16596  powerpc/crash: Fix non-smp kexec preparation
  - !16562 platform/x86/intel-uncore-freq: Add efficiency latency control and other fix for 6.6
  - !16593  vxlan: vnifilter: Fix unlocked deletion of default FDB entry
  - finally take no_llseek out
  - migration: update status after RAS error
  - ftrace: Fix preemption accounting for stacktrace trigger command
  - powerpc/crash: Fix non-smp kexec preparation
  - !16588  ipc: fix to protect IPCS lookups using RCU
  - vxlan: vnifilter: Fix unlocked deletion of default FDB entry
  - ipc: fix to protect IPCS lookups using RCU
  - dlm: prevent NPD when writing a positive value to event_done
  - tracing: Fix compilation warning on arm32
  - tracing: Fix oob write in trace_seq_to_buffer()
  - module: ensure that kobject_put() is safe for module type kobjects
  - dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature
  - !16492  arm64/watchdog: fix watchdog failure in low power scenarios
  - cgroup/cpuset-v1: Add missing support for cpuset_v2_mode
  - erofs: fix file handle encoding for 64-bit NIDs
  - exportfs: define FILEID_INO64_GEN* file handle types
  - media: venus: hfi_parser: refactor hfi packet parsing logic
  - soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()
  - md/raid10: wait barrier before returning discard request with REQ_NOWAIT
  - md: fix mddev uaf while iterating all_mddevs list
  - platform/x86/intel-uncore-freq: Add efficiency latency control to sysfs interface
  - platform/x86/intel-uncore-freq: Add support for efficiency latency control
  - platform/x86/intel-uncore-freq: Do not present separate package-die domain
  - scsi: st: Fix array overflow in st_setup()
  - arm64/watchdog: fix watchdog failure in low power scenarios
  - drm/phytium: Fix some Bugs in Phytium Display Engine
  - ksmbd: fix use-after-free in ksmbd_session_rpc_open


author: Li Nan <linan122@huawei.com> - 6.6.0-97.0.0.102
changelog:
  - !16653 [OLK-6.6] Revert "USB: xHCI: fix resume issue of some ZHAOXIN hosts"
  - !16699  mm: provide vm_normal_(page|folio)_pmd() with CONFIG_PGTABLE_HAS_HUGE_LEAVES
  - mm: provide vm_normal_(page|folio)_pmd() with CONFIG_PGTABLE_HAS_HUGE_LEAVES
  - !16686 v2  Soft domain improves and bugfixes
  - sched: Fix might sleep in atomic section issue
  - sched: Consider task affinity in wake_soft_domain()
  - sched: Fix soft domain group memleak
  - sched: Rework cpu.soft_domain_nr_cpu
  - sched: Add cmdline sched_soft_domain switch for soft domain feature
  - !16639  arm64/mpam: Add MPAM manual
  - !16651  iommu/arm-smmu-v3: Fix global-out-of-bounds access in arm_smmu_group_get_mpam()
  - Revert "USB: xHCI: fix resume issue of some ZHAOXIN hosts"
  - iommu/arm-smmu-v3: Fix global-out-of-bounds access in arm_smmu_group_get_mpam()
  - fs/resctrl: Prevent idle RMIDs from not being released in time from limbo
  - arm64/mpam: Update the chip condition judgment in resctrl_arch_would_mbm_overflow()
  - arm64/mpam: Add MPAM manual


author: Li Nan <linan122@huawei.com> - 6.6.0-98.0.0.103
changelog:
  - !16740  KVM: arm64: check if IPIV is enabled in BIOS
  - !16737  drivers/perf: hisi: Add events and rename event "cycle" for pa_pmu
  - KVM: arm64: check if IPIV is enabled in BIOS
  - drivers/perf: hisi: Add events and rename event "cycle" for pa_pmu
  - !16694  RDMA/hns: Fix double destruction of rsv_qp
  - !16730  uacce: removal of the Shared Memory Feature for Queues
  - !16727  perf: Remove unstable events for uncore L3C PMU
  - !16732  drivers/perf: hisi: Fixes the incorrect bitmask limit for the CPA event sysfs interface
  - !16728  drivers/perf: hisi: Add cacheable option for L3C PMU
  - !16724  drivers/perf: hisi: Clarifying event names and fix event ID for pa_pmu
  - !16723  perf iostat: hisi: Fix port range retrival
  - !16729  arm64: Fix unmet direct dependencies for DEBUG_FEATURE_BYPASS
  - drivers/perf: hisi: Fixes the incorrect bitmask limit for the CPA event sysfs interface
  - crypto: hisilicon/qm - check whether the input parameters and device PF match
  - uacce: removal of the Shared Memory Feature for Queues
  - arm64: Fix unmet direct dependencies for DEBUG_FEATURE_BYPASS
  - !16721 cpufreq: CPPC: Don't warn on failing to read perf counters on offline cpus
  - drivers/perf: hisi: Add cacheable option for L3C PMU
  - perf: Remove unstable events for uncore L3C PMU
  - drivers/perf: hisi: Clarifying event names and fix event ID for pa_pmu
  - perf iostat: hisi: Fix port range retrival
  - !16701  Add HiSilicon uncore frequency scaling driver
  - !16712 crypto: hisilicon - support algorithm fallback v2
  - arm64: topology: Setup amu fie when cpu hotplugging
  - cpufreq: CPPC: Fix error handling in cppc_scale_freq_workfn()
  - cpufreq: CPPC: Don't warn on failing to read perf counters on offline cpus
  - topology: Set capacity_freq_ref in all cases
  - arm64/amu: Use capacity_ref_freq() to set AMU ratio
  - cpufreq/cppc: Set the frequency used for computing the capacity
  - energy_model: Use a fixed reference frequency
  - cpufreq/schedutil: Use a fixed reference frequency
  - cpufreq: Use the fixed and coherent frequency for scaling capacity
  - !16717  Fix issues of nfs mounting
  - !16714 v2  Fix file content inconsistency issue and incorporate subsequent fix patches
  - sched/topology: Add a new arch_scale_freq_ref() method
  - !16696  KVM: arm64: Check whether GICv4.0 is enabled
  - nfs: ignore SB_RDONLY when remounting nfs
  - nfs: clear SB_RDONLY before getting superblock
  - vfs: generate FS_CREATE before FS_OPEN when ->atomic_open used.
  - NFS: abort nfs_atomic_open_v23 if name is too long.
  - NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly.
  - !16680  Fix the problem of NFS client mount read/write permission failure
  - crypto: hisilicon/qm - check the value obtained from the hardware
  - crypto: hisilicon/hpre - support the hpre algorithm fallback
  - crypto: hisilicon - implement full backlog support for sec
  - uacce: add queue lock for uacce_get_ss_dma
  - uacce: use WARN_ON_ONCE instead of WARN_ON
  - !16705  fs/resctrl: Fix return value in rdtgroup_pseudo_locked_in_hierarchy()
  - !16691 v3  Rewrite smt interference account logic
  - !16662  Fix watchdog false positive problem
  - !16711  af_unix: Read 0 bytes with MSG_PEEK loops if last skb is OOB
  - af_unix: Read 0 bytes with MSG_PEEK loops if last skb is OOB
  - fs/resctrl: Fix return value in rdtgroup_pseudo_locked_in_hierarchy()
  - !16287 Update the watchdog period according to real CPU frequency
  - !16679  fs/resctrl: L2_MON does not support the limbo mechanism
  - openeuler_defconfig: Enable devfreq and hisi_uncore_freq by default
  - PM / devfreq: Add HiSilicon uncore frequency scaling driver
  - PM / devfreq: Allow devfreq driver to add custom sysfs ABIs
  - PM / devfreq: Check governor before using governor->name
  - PM / devfreq: Remove redundant devfreq_get_freq_range() calling in devfreq_add_device()
  - PM / devfreq: Limit max_freq with scaling_min_freq
  - PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store()
  - mailbox: pcc: Refactor and simplify check_and_ack()
  - mailbox: pcc: Always map the shared memory communication address
  - mailbox: pcc: Refactor error handling in irq handler into separate function
  - mailbox: pcc: Use acpi_os_ioremap() instead of ioremap()
  - mailbox: pcc: Return early if no GAS register from pcc_mbox_cmd_complete_check
  - mailbox: pcc: Drop unnecessary endianness conversion of pcc_hdr.flags
  - KVM: arm64: Check whether GICv4.0 is enabled
  - RDMA/hns: Fix double destruction of rsv_qp
  - interference: Rewrite smt interference account logic
  - interference: Fix the compilation warning of sched_task_is_throttled()
  - Revert "nfs: ignore SB_RDONLY when mounting nfs"
  - Revert "nfs: pass flags to second superblock"
  - Revert "nfs: fix the loss of superblock's initialized flags"
  - fs/resctrl: L2_MON does not support the limbo mechanism
  - watchdog: fix the SOFTLOCKUP_DETECTOR=n case
  - watchdog: fix watchdog may detect false positive of softlockup
  - arm64/watchdog_hld: Add a cpufreq notifier for update watchdog thresh
  - watchdog/perf: Provide function for adjusting the event period


author: Li Nan <linan122@huawei.com> - 6.6.0-99.0.0.104
changelog:
  - !16556 [OLK-6.6] PCI: Supplement ACS quirk for more Zhaoxin Root Ports
  - !16559 mm: mincore: use pte_batch_hint() to batch process large folios
  - !16689 mm/madvise: batch tlb flushes for MADV_DONTNEED and MADV_FREE
  - !16426 FIX CVE-2025-40014
  - !16601 add virtcca capability and kae vf interface
  - !16866 v2  mempolicy: optimize queue_folios_pte_range by PTE batching
  - !16865  pci:vga fix race condition in vga_arb_write
  - !16770 [OLK-6.6] Intel: Backport to fix QuickAssist Technology(QAT) in-tree driver from v6.10 to v6.16
  - !16773  mm:userswap: change VM_USWAP_BIT to bit 61
  - !16820 v2  Fix some smmu bugs
  - !16803  CVE-2025-38060
  - !16828  orangefs: Do not truncate file size
  - !16812 perf hisi-ptt: Fix memory leak in lseek failure handling
  - !16827  btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
  - !16775 [OLK-6.6]fix enfs bug
  - !16861  arm64: kaslr: fix nokaslr cmdline parsing
  - mempolicy: optimize queue_folios_pte_range by PTE batching
  - !16804  HID: uclogic: Add NULL check in uclogic_input_configured()
  - !16806  vhost-scsi: protect vq->log_used with vq->mutex
  - !14552 [OLK-6.6]Arm64:KVM: Auto get the virtual_dev irq bypass's devid
  - !16573  Backport 6.6.64-6.6.72 LTS
  - !16757  objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
  - !16756  mm: pcp: increase pcp->free_count threshold to trigger free_high
  - pci:vga fix race condition in vga_arb_write
  - !16656  merge CVE patches into OLK-6.6
  - !16512  perf/x86/intel: Only check the group flag for X86 leader
  - !16617  SELinux: Add check for the user data passed to kcalloc in hashtab_init
  - !16748  arm64: xcall: Fix GPR touch as the original step
  - !16778  drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
  - !16848  tracing: probes: Fix a possible race in trace_probe_log APIs
  - !16842  ftrace: Fix UAF when lookup kallsym after ftrace disabled
  - !16837  ftrace: Fix preemption accounting for stacktrace filter command
  - !16845  bpf: Avoid __bpf_prog_ret0_warn when jit fails
  - !16652 v2  CVE-2025-37948
  - !16791  ALSA: pcm: Fix race of buffer access at PCM OSS layer
  - arm64: kaslr: fix nokaslr cmdline parsing
  - !16851  drm/amd/display: Increase block_sequence array size
  - drm/amd/display: Increase block_sequence array size
  - tracing: probes: Fix a possible race in trace_probe_log APIs
  - bpf: Avoid __bpf_prog_ret0_warn when jit fails
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled
  - ftrace: Fix preemption accounting for stacktrace filter command
  - orangefs: Do not truncate file size
  - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
  - iommu/arm-smmu-v3: Fix the problematic platform detection logic
  - iommu/arm-smmu-v3: Fix the extra atc tlb flush
  - fix review issue
  - vhost-scsi: protect vq->log_used with vq->mutex
  - perf hisi-ptt: Fix memory leak in lseek failure handling
  - HID: uclogic: Add NULL check in uclogic_input_configured()
  - bpf: abort verification if env->cur_state->loop_entry != NULL
  - bpf: copy_verifier_state() should copy 'loop_entry' field
  - ALSA: pcm: Fix race of buffer access at PCM OSS layer
  - fix enfs bug
  - drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
  - mm:userswap: change VM_USWAP_BIT to bit 61
  - crypto: qat - switch to standard pattern for PCI IDs
  - crypto: qat - remove BITS_IN_DWORD()
  - crypto: qat - remove initialization in device class
  - crypto: qat - add shutdown handler to qat_c3xxx
  - crypto: qat - remove redundant prototypes in qat_c3xxx
  - crypto: qat - add shutdown handler to qat_c62x
  - crypto: qat - remove redundant prototypes in qat_c62x
  - crypto: qat - add shutdown handler to qat_dh895xcc
  - crypto: qat - remove redundant prototypes in qat_dh895xcc
  - crypto: qat - add shutdown handler to qat_420xx
  - crypto: qat - add shutdown handler to qat_4xxx
  - crypto: qat - Remove dst_null support
  - crypto: qat - remove access to parity register for QAT GEN4
  - crypto: qat - set parity error mask for qat_420xx
  - crypto: qat - optimize allocations for fw authentication
  - crypto: qat - remove redundant FW image size check
  - crypto: qat - remove unused members in suof structure
  - crypto: qat - introduce fuse array
  - crypto: qat - add macro to write 64-bit values to registers
  - crypto: qat - refactor service parsing logic
  - crypto: qat - do not export adf_cfg_services
  - crypto: qat - reorder objects in qat_common Makefile
  - crypto: qat - fix object goals in Makefiles
  - crypto: qat - set command ids as reserved
  - crypto: drivers - Use str_enable_disable-like helpers
  - vfio/qat: fix overflow check in qat_vf_resume_write()
  - crypto: qat - Fix missing destroy_workqueue in adf_init_aer()
  - crypto: qat - Fix typo "accelaration"
  - crypto: qat - Constify struct pm_status_row
  - crypto: qat - remove unused adf_devmgr_get_first
  - lib/string_choices: Add str_up_down() helper
  - crypto: qat - Remove trailing space after 
  - crypto: qat - fix "Full Going True" macro definition
  - crypto: qat - Use static_assert() to check struct sizes
  - crypto: qat - allow disabling SR-IOV VFs
  - crypto: qat - ensure correct order in VF restarting handler
  - crypto: qat - fix recovery flow for VFs
  - crypto: qat - disable IOV in adf_dev_stop()
  - crypto: qat - preserve ADF_GENERAL_SEC
  - crypto: qat - initialize user_input.lock for rate_limiting
  - crypto: qat - make adf_ctl_class constant
  - crypto: qat - Fix typo
  - crypto: qat - fix linking errors when PCI_IOV is disabled
  - objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
  - mm: pcp: increase pcp->free_count threshold to trigger free_high
  - mm: page_alloc: remove redundant READ_ONCE
  - arm64: xcall: Fix GPR touch as the original step
  - mm/madvise: handle madvise_lock() failure during race unwinding
  - mm/madvise: batch tlb flushes for MADV_DONTNEED[_LOCKED]
  - mm/memory: split non-tlb flushing part from zap_page_range_single()
  - mm/madvise: batch tlb flushes for MADV_FREE
  - mm/madvise: define and use madvise_behavior struct for madvise_do_behavior()
  - mm/madvise: remove len parameter of madvise_do_behavior()
  - mm/madvise: remove redundant mmap_lock operations from process_madvise()
  - mm/madvise: split out madvise() behavior execution
  - mm/madvise: split out madvise input validity check
  - mm/madvise: split out mmap locking operations for madvise()
  - mm/madvise: unrestrict process_madvise() for current process
  - mm/madvise: don't perform madvise VMA walk for MADV_POPULATE_(READ|WRITE)
  - crypto: iaa - Fix potential use after free bug
  - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
  - mm: migrate_device: use more folio in migrate_device_finalize()
  - Revert "remoteproc: core: Clear table_sz when rproc_shutdown"
  - remoteproc: core: Clear table_sz when rproc_shutdown
  - jfs: fix slab-out-of-bounds read in ea_get()
  - tpm: do not start chip while suspended
  - KVM: arm64: Tear down vGIC on failed vCPU creation
  - drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()
  - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation
  - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
  - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs
  - arm64: proton-pack: Expose whether the branchy loop k value
  - arm64: proton-pack: Expose whether the platform is mitigated by firmware
  - arm64: insn: Add support for encoding DSB
  - arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays
  - arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists
  - arm64: cputype: Add MIDR_CORTEX_A76AE
  - arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list
  - arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB
  - arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list
  - add virtcca capability and kae vf interface
  - SELinux: Add check for the user data passed to kcalloc in hashtab_init
  - PCI: Supplement ACS quirk for more Zhaoxin Root Ports
  - seq_buf: Make DECLARE_SEQ_BUF() usable
  - seq_buf: Introduce DECLARE_SEQ_BUF and seq_buf_str()
  - mm: mincore: use pte_batch_hint() to batch process large folios
  - perf/x86/intel: Only check the group flag for X86 leader
  - objtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq()
  - irqchip/gic-v3-its: Init reserved rsv_devid_pools use pci bus info
  - irqchip/gic-v3-its: Move build_devid_pools from its to acpi iort init
  - irqchip/gic-v3-its: Add ACPI_IORT as VIRT_PLAT_DEV's dependency
  - acpi/iort: Add func to get used deviceid bitmap


author: Li Nan <linan122@huawei.com> - 6.6.0-100.0.0.105
changelog:
  - !17003  net_sched: red: fix a race in __red_change()
  - !16747  LoongArch: Fix bugs in huge_pte_offset/__alloc_pages_slowpath/iommu
  - !17026  CVE-2025-37842
  - !17022  spi-rockchip: Fix register out of bounds access
  - !17039  iio: light: opt3001: fix deadlock due to concurrent flag access
  - !17036  parisc: Fix double SIGFPE crash
  - !17001  Fix CVE-2025-38182
  - !17034  fix CVE-2025-38118
  - !17033  LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
  - !17035  drm/amdkfd: Fix mode1 reset crash issue
  - !16792 v3  Support CCA Guest
  - iio: light: opt3001: fix deadlock due to concurrent flag access
  - !17023  bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
  - parisc: Fix double SIGFPE crash
  - drm/amdkfd: Fix mode1 reset crash issue
  - Bluetooth: MGMT: Fix sparse errors
  - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
  - LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
  - spi: fsl-qspi: Fix double cleanup in probe error path
  - spi: fsl-qspi: use devm function instead of driver remove
  - !16991  hwmon: (asus-ec-sensors) check sensor index in read_string()
  - !17014 v2  CVE-2025-38099
  - !17013  crypto: null - Use spin lock instead of mutex
  - bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
  - spi-rockchip: Fix register out of bounds access
  - !16983  crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
  - !16982  KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses
  - !16957  f2fs: fix to do sanity check on sbi->total_valid_block_count
  - !16999  octeon_ep: Fix host hang issue during device reboot
  - !16995  f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()
  - !17000 v2  mm: respect mmap hint address when aligning for THP
  - !17006  drivers/rapidio/rio_cm.c: prevent possible heap overwrite
  - Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers
  - Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken
  - Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE
  - Bluetooth: Add quirk for broken READ_VOICE_SETTING
  - crypto: null - Use spin lock instead of mutex
  - !16467 drm/virtio: implement virtio_gpu_shutdown
  - !16565 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y
  - !16743 [OLK-6.6] backport important bugfix for lpfc driver from upstream linux-6.6.y
  - !16902  cachefiles: Fix the incorrect return value in cachefiles_ondemand_fd_write_iter()
  - !16994  net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
  - !16996  wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite
  - net_sched: red: fix a race in __red_change()
  - ublk: santizize the arguments from userspace when adding a device
  - mm: respect mmap hint address when aligning for THP
  - octeon_ep: Fix host hang issue during device reboot
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
  - f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()
  - net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
  - !16988  Fix compile problem for psi_grained
  - hwmon: (asus-ec-sensors) check sensor index in read_string()
  - Fix compile problem for psi_grained
  - crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
  - KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses
  - !16969  Fix CVE-2025-38170
  - !16967  net: openvswitch: Fix the dead loop of MPLS parse
  - !16964  dma-buf: insert memory barrier before updating num_fences
  - arm64/fpsimd: Discard stale CPU state when handling SME traps
  - !16891 fix some build errors of enfs
  - net: openvswitch: Fix the dead loop of MPLS parse
  - dma-buf: insert memory barrier before updating num_fences
  - !16557 [OLK-6.6] PCI/P2PDMA: Add Zhaoxin Zhaoxin bridges to the whitelist
  - !16919  Backport mainline patches
  - f2fs: fix to do sanity check on sbi->total_valid_block_count
  - !16567 [OLK-6.6]:update patches for sw64 architecture
  - !16897  CVE-2025-37784
  - !16922 v2  irqchip/gic-v3: Fix xint sleeping function called from invalid context
  - !16926  nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
  - !16912 Unbinding VF drivers in virtCCA CoDA SR-IOV scenarios.
  - !16908  OLK-6.6 Bperf
  - !16603 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.83-6.6.84 LTS Patches
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
  - irqchip/gic-v3: Fix xint sleeping function called from invalid context
  - !16906  rseq: Fix segfault on registration when rseq_cs is non-zero
  - xfrm: Clear low order bits of ->flowi4_tos in decode_session4().
  - xfrm: policy: fix layer 4 flowi decoding
  - xfrm: policy: replace session decode with flow dissector
  - xfrm: move mark and oif flowi decode into common code
  - xfrm: pass struct net to xfrm_decode_session wrappers
  - !16898  libnvdimm/labels: Fix divide error in nd_label_data_init()
  - !16903  some optimization patches for inet_diag dump
  - Unbinding VF drivers in virtCCA CoDA SR-IOV scenarios.
  - !16895 virtCCA supports SR-IOV in CoDA scenarios.
  - perf stat: Fix incorrect display of bperf when event count is 0
  - perf stat: Increase perf_attr_map entries
  - perf test: Use sqrtloop workload to test bperf event
  - perf test stat_bpf_counter.sh: Stabilize the test results
  - perf test bpf-counters: Add test for BPF event modifier
  - perf stat: Support inherit events during fork() for bperf
  - !16896  drm/v3d: Add job to pending list if the reset was skipped
  - rseq: Fix segfault on registration when rseq_cs is non-zero
  - inet_diag: skip over empty buckets
  - sock_diag: remove sock_diag_mutex
  - inet_diag: allow concurrent operations
  - inet_diag: add module pointer to "struct inet_diag_handler"
  - cachefiles: Fix the incorrect return value in cachefiles_ondemand_fd_write_iter()
  - !16780 v2  mm/mem_sampling: add trace event for spe based damon record
  - !16781 v4  mm/mem_sampling: fix some mem sampling issues
  - libnvdimm/labels: Fix divide error in nd_label_data_init()
  - net: ti: icss-iep: Fix possible NULL pointer dereference for perout request
  - net: ti: icss-iep: Add phase offset configuration for perout signal
  - net: ti: icss-iep: Add pwidth configuration for perout signal
  - drm/v3d: Add job to pending list if the reset was skipped
  - !16753  nfs: handle failure of nfs_get_lock_context in unlock path
  - !16237  pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result
  - virtCCA supports SR-IOV in CoDA scenarios.
  - sunrpc, nfs: CONFIG_ENFS should select CONFIG_SUNRPC_ENFS
  - sunrpc, nfs: fix build errors when CONFIG_SUNRPC_ENFS=m && CONFIG_ENFS=m && CONFIG_NFS=y
  - nfs: fix build errors when CONFIG_ENFS=m && CONFIG_NFS_FS=y
  - nfs: fix enfs mount failure when CONFIG_ENFS=y
  - sw64: adapt to the upstream changes in huge_ptep_get_and_clear
  - sw64: sort arch/sw64/Kconfig
  - sw64: iommu: implement map_pages/unmap_pages API
  - gicv3: add lpi support for virtcca cvm guest
  - MAINTAINERS: Add CCA and pKVM CoCO guest support to the ARM64 entry
  - configfs-tsm-report: Fix NULL dereference of tsm_ops
  - arm64: Document Arm Confidential Compute
  - virt: arm-cca-guest: TSM_REPORT support for realms
  - mm/slab: Add __free() support for kvfree
  - configfs-tsm: Introduce a shared ABI for attestation reports
  - virt: coco: Add a coco/Makefile and coco/Kconfig
  - arm64: realm: Use aliased addresses for device DMA to shared buffers
  - dma: Introduce generic dma_addr_*crypted helpers
  - dma: Fix encryption bit clearing for dma_to_phys
  - rme: make sure realm guest map memory in page granularity
  - arm64: realm: ioremap: Allow mapping memory as encrypted
  - parisc: Delay write-protection until mark_rodata_ro() call
  - jump_label,module: Don't alloc static_key_mod for __ro_after_init keys
  - irqchip/gic-v3-its: Rely on genpool alignment
  - irqchip/gic-v3-its: Fix over allocation in itt_alloc_pool()
  - irqchip/gic-v3-its: Share ITS tables with a non-trusted hypervisor
  - arm64: Enable memory encrypt for Realms
  - arm64: mm: Avoid TLBI when marking pages as valid
  - arm64: Enforce bounce buffers for realm DMA
  - efi: arm64: Map Device with Prot Shared
  - arm64: rsi: Map unprotected MMIO as decrypted
  - arm64: rsi: Add support for checking whether an MMIO is protected
  - arm64: realm: Query IPA size from the RMM
  - arm64: Detect if in a realm and set RIPAS RAM
  - arm64: rsi: Add RSI definitions
  - arm64: mm: Add confidential computing hook to ioremap_prot()
  - arm64: mm: Add top-level dispatcher for internal mem_encrypt API
  - Revert "gicv3: add lpi support for cvm guest"
  - Revert "virtcca feature : disable swiotlb for passthrough device"
  - mm/mem_sampling: Fix inaccurate sampling for NUMA balancing and DAMON
  - mm/mem_sampling: Prevent mem_sampling from being enabled if SPE init failed
  - mm/mem_sampling: add trace event for spe based damon record
  - nfs: handle failure of nfs_get_lock_context in unlock path
  - iommu/loongarch: fix potential hung task when error occurred
  - LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
  - mm/page_alloc.c: avoid infinite retries caused by cpuset race
  - LoongArch: Fix early_numa_add_cpu() usage for FDT systems
  - scsi: lpfc: Free phba irq in lpfc_sli4_enable_msi() when pci_irq_vector() fails
  - ksmbd: fix r_count dec/increment mismatch
  - Input: xpad - fix two controller table values
  - cifs: Ensure that all non-client-specific reparse points are processed by the server
  - nvme: unblock ctrl state transition for firmware update
  - vboxsf: Add __nonstring annotations for unterminated strings
  - netfilter: nf_tables: allow clone callbacks to sleep
  - netfilter: nf_tables: bail out if stateful expression provides no .clone
  - netfilter: nf_tables: use timestamp to check for set element timeout
  - rust: lockdep: Remove support for dynamically allocated LockClassKeys
  - HID: apple: disable Fn key handling on the Omoton KB066
  - nvme-fc: rely on state transitions to handle connectivity loss
  - Bluetooth: L2CAP: Fix corrupted list in hci_chan_del
  - smb: client: Fix match_session bug preventing session reuse
  - smb3: add support for IAKerb
  - i2c: sis630: Fix an error handling path in sis630_probe()
  - i2c: ali15x3: Fix an error handling path in ali15x3_probe()
  - i2c: ali1535: Fix an error handling path in ali1535_probe()
  - cifs: Throw -EOPNOTSUPP error on unsupported reparse point type from parse_reparse_point()
  - cifs: Validate content of WSL reparse point buffers
  - cifs: Fix integer overflow while processing closetimeo mount option
  - cifs: Fix integer overflow while processing actimeo mount option
  - scripts: generate_rust_analyzer: add missing macros deps
  - ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
  - ASoC: rt722-sdca: add missing readable registers
  - rust: init: add missing newline to pr_info! calls
  - ASoC: cs42l43: Fix maximum ADC Volume
  - drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
  - rust: error: add missing newline to pr_warn! calls
  - ASoC: ops: Consistently treat platform_max as control value
  - smb: client: fix regression with guest option
  - qlcnic: fix memory leak issues in qlcnic_sriov_common.c
  - arm64: mm: Populate vmemmap at the page level if not section aligned
  - ASoC: amd: yc: Support mic on another Lenovo ThinkPad E16 Gen 2 model
  - clk: samsung: update PLL locktime for PLL142XX used on FSD platform
  - ksmbd: prevent connection release during oplock break notification
  - ksmbd: fix use-after-free in ksmbd_free_work_struct
  - drm/amd/display: Fix slab-use-after-free on hdcp_work
  - drm/amd/display: Assign normalized_pix_clk when color depth = 14
  - drm/amd/display: Restore correct backlight brightness after a GPU reset
  - drm/amd/display: Disable unneeded hpd interrupts during dm_init
  - drm/dp_mst: Fix locking when skipping CSN before topology probing
  - drm/atomic: Filter out redundant DPMS calls
  - drm/i915/cdclk: Do cdclk post plane programming later
  - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
  - USB: serial: option: match on interface class for Telit FN990B
  - USB: serial: option: fix Telit Cinterion FE990A name
  - USB: serial: option: add Telit Cinterion FE990B compositions
  - USB: serial: ftdi_sio: add support for Altera USB Blaster 3
  - Input: i8042 - swap old quirk combination with new quirk for more devices
  - Input: i8042 - swap old quirk combination with new quirk for several devices
  - Input: i8042 - add required quirks for missing old boardnames
  - Input: i8042 - swap old quirk combination with new quirk for NHxxRZQ
  - Input: xpad - rename QH controller to Legion Go S
  - Input: xpad - add support for TECNO Pocket Go
  - Input: xpad - add support for ZOTAC Gaming Zone
  - Input: xpad - add multiple supported devices
  - Input: xpad - add 8BitDo SN30 Pro, Hyperkin X91 and Gamesir G7 SE controllers
  - Input: iqs7222 - preserve system status register
  - Input: ads7846 - fix gpiod allocation
  - io_uring: use unpin_user_pages() where appropriate
  - io_uring/kbuf: vmap pinned buffer ring
  - io_uring: use vmap() for ring mapping
  - io_uring: fix corner case forgetting to vunmap
  - io_uring: don't attempt to mmap larger than what the user asks for
  - io_uring: get rid of remap_pfn_range() for mapping rings/sqes
  - mm: add nommu variant of vm_insert_pages()
  - block: fix 'kmem_cache of name 'bio-108' already exists'
  - net: Handle napi_schedule() calls from non-interrupt
  - drm/nouveau: Do not override forced connector status
  - mptcp: safety check before fallback
  - x86/irq: Define trace events conditionally
  - perf/x86/intel: Use better start period for frequency mode
  - drm/vkms: Round fixp2int conversion in lerp_u16
  - fuse: don't truncate cached, mutated symlink
  - ASoC: tas2764: Set the SDOUT polarity correctly
  - ASoC: tas2764: Fix power control mask
  - ASoC: tas2770: Fix volume scale
  - nvme: only allow entering LIVE from CONNECTING state
  - sctp: Fix undefined behavior in left shift operation
  - cifs: Treat unhandled directory name surrogate reparse points as mount directory nodes
  - apple-nvme: Release power domains when probe fails
  - nvmet-rdma: recheck queue state is LIVE in state lock in recv done
  - nvme-pci: quirk Acer FA100 for non-uniqueue identifiers
  - io-wq: backoff when retrying worker creation
  - net: wwan: mhi_wwan_mbim: Silence sequence number glitch errors
  - ASoC: SOF: amd: Handle IPC replies before FW_BOOT_COMPLETE
  - ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module
  - ASoC: arizona/madera: use fsleep() in up/down DAPM event delays.
  - ASoC: rsnd: adjust convert rate limitation
  - ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime()
  - ASoC: rsnd: indicate unsupported clock rate
  - ALSA: hda/realtek: Limit mic boost on Positivo ARN50
  - ASoC: simple-card-utils.c: add missing dlc->of_node
  - selftests/bpf: Fix invalid flag of recv()
  - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
  - Xen/swiotlb: mark xen_swiotlb_fixup() __init
  - thermal/cpufreq_cooling: Remove structure member documentation
  - s390/cio: Fix CHPID "configure" attribute caching
  - platform/x86: thinkpad_acpi: Support for V9 DYTC platform profiles
  - platform/x86: thinkpad_acpi: Fix invalid fan speed on ThinkPad X120e
  - sched: Clarify wake_up_q()'s write to task->wake_q.next
  - objtool: Ignore dangling jump table entries
  - HID: apple: fix up the F6 key on the Omoton KB066 keyboard
  - HID: hid-apple: Apple Magic Keyboard a3203 USB-C support
  - HID: topre: Fix n-key rollover on Realforce R3S TKL boards
  - usb: phy: generic: Use proper helper for property detection
  - HID: ignore non-functional sensor in HP 5MP Camera
  - HID: intel-ish-hid: Send clock sync message immediately after reset
  - HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
  - vboxsf: fix building with GCC 15
  - alpha/elf: Fix misc/setarch test of util-linux by removing 32bit support
  - smb: client: fix noisy when tree connecting to DFS interlink targets
  - ACPI: resource: IRQ override for Eluktronics MECH-17
  - scsi: ufs: core: Fix error return with query response
  - scsi: core: Use GFP_NOIO to avoid circular locking dependency
  - platform/x86/intel: pmc: fix ltr decode in pmc_core_ltr_show()
  - sched/debug: Provide slice length for fair tasks
  - powercap: call put_device() on an error path in powercap_register_control_type()
  - hrtimers: Mark is_migration_base() with __always_inline
  - nvme-fc: do not ignore connectivity loss during connecting
  - nvme-fc: go straight to connecting state when initializing
  - net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
  - net/mlx5: Bridge, fix the crash caused by LAG state check
  - net/mlx5: Lag, Check shared fdb before creating MultiPort E-Switch
  - net: openvswitch: remove misbehaving actions length check
  - netfilter: nft_exthdr: fix offset with ipv4_find_option()
  - net_sched: Prevent creation of classes with TC_H_ROOT
  - ipvs: prevent integer overflow in do_ip_vs_get_ctl()
  - netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
  - bonding: fix incorrect MAC address setting to receive NS messages
  - net: switchdev: Convert blocking notification chain to a raw one
  - eth: bnxt: do not update checksum in bnxt_xdp_build_skb()
  - net/mlx5: handle errors in mlx5_chains_create_table()
  - Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
  - netpoll: hold rcu read lock in __netpoll_send_skb()
  - net: mctp i2c: Copy headers if cloned
  - net: dsa: mv88e6xxx: Verify after ATU Load ops
  - net/mlx5: Fill out devlink dev info only for PFs
  - Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context"
  - Bluetooth: hci_event: Fix enabling passive scanning
  - sched: address a potential NULL pointer dereference in the GRED scheduler.
  - netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around
  - ice: fix memory leak in aRFS after reset
  - netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.
  - pinctrl: bcm281xx: Fix incorrect regmap max_registers value
  - fbdev: hyperv_fb: iounmap() the correct memory when removing a device
  - tcp: fix forever orphan socket caused by tcp_abort
  - tcp: fix races in tcp_abort()
  - hrtimer: Use and report correct timerslack values for realtime tasks
  - zram: fix NULL pointer in comp_algorithm_show()
  - sched/isolation: Prevent boot crash when the boot CPU is nohz_full
  - clockevents/drivers/i8253: Fix stop sequence for timer 0
  - PCI/P2PDMA: Add Zhaoxin Zhaoxin bridges to the whitelist
  - sw64: disable EFFICIENT_UNALIGNED_ACCESS for C3B
  - sw64: optimize unaligned access
  - sw64: ftrace: Add direct call trampoline samples support
  - sw64: ftrace: Add direct call support
  - sw64: ftrace: No need to save original function's temporary registers
  - sw64: perf: fix perf test 'import perf' in python failed
  - sw64: add support for function error injection
  - sw64: add sw64 rethook implementation
  - sw64: emit fixed-length instructions for BPF_PSEUDO_FUNC
  - sw64: ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL
  - sw64: mm: adjust userspace memory layout
  - sw64: cpufreq: fix the frequency returned by cpufreq_driver->get()
  - sw64: ioremap: map some IO space with ioremap
  - sw64: ioremap: fix an overflow in pci_remap_cfgspace
  - sw64: ioremap: support generic ioremap for C4
  - nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable
  - drm/virtio: implement virtio_gpu_shutdown
  - virtgpu: don't reset on shutdown
  - virtio: break and reset virtio devices on device_shutdown()
  - LoongArch: sync kvm head file from upstream
  - LoongArch: fix migrate issue
  - LoongArch: Save and restore CSR.CNTC for hibernation
  - pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result


author: Li Ping <1477412247@qq.com> - 6.6.0-100.0.0.106
changelog:
  - btusb: move btmtk module from extra to main kernel modules
    * Fixes dependency issue where btusb.ko required symbols from btmtk.ko
      (btmtk_setup_firmware*, btmtk_set_bdaddr, etc.)
    * Resolves depmod warnings during kernel installation
    * Original issue seen with kernel-6.6.0-100.0.0.105.oe2403sp2.x86_64


author: Li Nan <linan122@huawei.com> - 6.6.0-101.0.0.107
changelog:
  - !17041 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.70-6.6.72 LTS Conflicts Patches
  - !17126  EDAC/skx_common: Fix general protection fault
  - !17136  xcall xint 644
  - modify xcall proc file permissions to 640
  - modify xint proc file permissions to 640
  - !17070  arm64/mpam: Add quirk for MPAM MSMON_MBWU monitor NRDY bit
  - !17106  arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  - !17120 v3  mm: batched unmap lazyfree large folios
  - EDAC/skx_common: Fix general protection fault
  - mm/rmap: fix potential out-of-bounds page table access during batched unmap
  - mm: avoid splitting pmd for lazyfree pmd-mapped THP in try_to_unmap
  - mm: support batched unmap for lazyfree large folios during reclamation
  - mm: support tlbbatch flush for a range of PTEs
  - mm: set folio swapbacked iff folios are dirty in try_to_unmap_one
  - !16998  arm64/mpam: Fix L2 monitor issue under CDP mode
  - !17107  CVE-2025-38322
  - !16947 [OLK-6.6] Fix patches for X2avic to backport for OLK-6.6
  - !17092  drm/amd/display: Fix && vs || typos
  - perf/x86/intel: Fix crash in icl_update_topdown_event()
  - perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read
  - perf/x86/intel: Apply static call for drain_pebs
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  - !16884  fs: Backport four namespace fix patches
  - !17094  config: Set TSM_REPORTS=m and ARM_CCA_GUEST=m
  - config: Set TSM_REPORTS=m and ARM_CCA_GUEST=m
  - drm/amd/display: Fix && vs || typos
  - !17071  usb: dwc3: gadget: check that event count does not exceed event buffer length
  - !17068  mcb: fix a double free bug in chameleon_parse_gdd()
  - !17062  bnxt_en: Mask the bd_cnt field in the TX BD properly
  - !16956 v3  config: Enable CONFIG_VIRT_DRIVERS
  - !16950 perf: Add support for SPE Data Source packet on HiSilicon HIP12
  - usb: dwc3: gadget: check that event count does not exceed event buffer length
  - arm64/mpam: Add quirk for MPAM MSMON_MBWU monitor NRDY bit
  - mcb: fix a double free bug in chameleon_parse_gdd()
  - bnxt_en: Mask the bd_cnt field in the TX BD properly
  - !17055  bpf lts backport
  - !17054  bpf verifier fixes
  - !17049  platform/x86: dell_rbu: Fix list usage
  - !17059  media: cxusb: no longer judge rbuf when the write fails
  - !16462 fix  CVE-2025-22101
  - media: cxusb: no longer judge rbuf when the write fails
  - bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
  - bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
  - selftests/bpf: Add tests with stack ptr register in conditional jmp
  - bpf: Do not include stack ptr register in precision backtracking bookkeeping
  - selftests/bpf: precision tracking test for BPF_NEG and BPF_END
  - platform/x86: dell_rbu: Fix list usage
  - fs/Kconfig: make hugetlbfs a menuconfig
  - workqueue: Update lock debugging code
  - memblock: use numa_valid_node() helper to check for invalid node ID
  - perf mem: Count L2 HITM for c2c statistic
  - perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12
  - arm64: cputype: Add cputype definition for HIP12
  - Revert "perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12"
  - arm64/mpam: Fix L2 monitor issue under CDP mode
  - KVM: x86: Fix a comment inside __kvm_set_or_clear_apicv_inhibit()
  - config: Enable CONFIG_VIRT_DRIVERS
  - KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is enabled
  - iommu/amd: Do not flush IRTE when only updating isRun and destination fields
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
  - do_change_type(): refuse to operate on unmounted/not ours mounts
  - fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2)
  - path_overmount(): avoid false negatives
  - net: libwx: fix Tx L4 checksum


author: Li Nan <linan122@huawei.com> - 6.6.0-102.0.0.108
changelog:
  - !17076  smb: client: fix use-after-free in crypt_message when using async crypto
  - !17102  smb: client: fix use-after-free in cifs_oplock_break
  - !17240  some fix for spe hotcold
  - !17159 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.72-6.6.75 LTS Conflicts Patches
  - !17206  driver core: Use kasprintf() instead of fixed buffer formatting
  - mm_monitor/mm_spe: Embed boost events within SPE packets
  - mm_monitor/mm_spe: Fix SPE boost enablement and continuation handling
  - !17161  olk-6.6-backport-bugfix-for-dynamic-affinity
  - !17150  HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
  - !17153  f2fs: prevent kernel warning due to negative i_nlink from corrupted image
  - !17154  media: vivid: Change the siize of the composing
  - !17238 v2  net: Fix kabi breakage for defer_free_list in struct net
  - !17237 RDMA/hns: Fix HW configurations not cleared in error flow
  - net: Fix kabi breakage for defer_free_list in struct net
  - RDMA/hns: Fix HW configurations not cleared in error flow
  - RDMA/hns: Fix -Wframe-larger-than issue
  - RDMA/hns: Drop GFP_NOWARN
  - RDMA/hns: Fix accessing uninitialized resources
  - RDMA/hns: Remove redundant hnae3.h in bond and sysfs
  - RDMA/hns: Use __free_page() to free pages allocated with alloc_page()
  - RDMA/hns: Fix divide-by-zero error in dca debugfs
  - RDMA/hns: Add check between dca_min_size and dca_max_size
  - RDMA/hns: Get messgae length of ack_req from FW
  - !17229 net: hns3: fix spelling mistake "reg_um" -&gt; "reg_num"
  - !17032  fbcon: Make sure modelist not set on unregistered console
  - !16958  scsi: target: iscsi: Fix timeout on deleted connection
  - net: hns3: fix spelling mistake "reg_um" -> "reg_num"
  - net: hns3: add complete parentheses for some macros
  - net: hns3: use hns3_get_ops() helper to reduce the unnecessary middle layer conversion
  - net: hns3: use hns3_get_ae_dev() helper to reduce the unnecessary middle layer conversion
  - net: hns3: delete redundant address before the array
  - net: hns3: clear hns alarm: comparison of integer expressions of different signedness
  - net: hns3: add \n at the end when print msg
  - Revert "net: hns3: add \n at the end when print msg"
  - !17201 net: hns3: reduce stack usage in hclge_dbg_dump_tm_pri()
  - !17215  net_sched: sch_sfq: fix a potential crash on gso_skb handling
  - !17214  netfilter: nf_set_pipapo_avx2: fix initial map fill
  - !17213  net: fix udp gso skb_segment after pull from frag_list
  - !17212  ice: fix Tx scheduler error handling in XDP callback
  - !17207  net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
  - !17200  xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
  - !17199  tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
  - !17198  bpf: consider that tail calls invalidate packet pointers
  - !17197  net: stmmac: Fix accessing freed irq affinity_hint
  - !17196  mptcp: fix NULL pointer in can_accept_new_subflow
  - !17194  tipc: fix memory leak in tipc_link_xmit
  - !17193  net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered
  - !17192  cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
  - !17184  sctp: add mutual exclusion in proc_sctp_do_udp_port()
  - !17181  net: fix NULL pointer dereference in l3mdev_l3_rcv
  - !17101  jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  - !17191  net: mctp: Set SOCK_RCU_FREE
  - !17190  usbnet:fix NPE during rx_complete
  - !17189  net: ibmveth: make veth_pool_store stop hanging
  - !17188  arcnet: Add NULL check in com20020pci_probe()
  - !17187  net: fix geneve_opt length integer overflow
  - !17186  udp: Fix memory accounting leak.
  - !17185  net: mvpp2: Prevent parser TCAM memory corruption
  - !17182  net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
  - !17179  net: dsa: free routing table on probe failure
  - !17178  sctp: detect and prevent references to a freed transport in sendmsg
  - !17177  net_sched: hfsc: Fix a UAF vulnerability in class handling
  - !17176  net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
  - !17175  net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported
  - !17174  net: dsa: clean up FDB, MDB, VLAN entries on unbind
  - !17172  xsk: fix an integer overflow in xp_create_and_assign_umem()
  - !17171  net: atm: fix use after free in lec_send()
  - !17170  eth: bnxt: fix truesize for mb-xdp-pass case
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling
  - netfilter: nf_set_pipapo_avx2: fix initial map fill
  - net: fix udp gso skb_segment after pull from frag_list
  - ice: fix Tx scheduler error handling in XDP callback
  - net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
  - !17016 [OLK-6.6]:update patches for sw64 architecture
  - driver core: Use kasprintf() instead of fixed buffer formatting
  - !17074  ext4: only dirty folios when data journaling regular files
  - !16951  wifi: ath9k_htc: Abort software beacon handling if disabled
  - net: hns3: reduce stack usage in hclge_dbg_dump_tm_pri()
  - net: hns3: Resolved the issue that the debugfs query result is inconsistent.
  - Revert "net: hns3: Resolved the issue that the debugfs query result is inconsistent."
  - net: hns3: initialize reset_timer before hclgevf_misc_irq_init()
  - Revert "net: hns3: initialize reset_timer before hclgevf_misc_irq_init()"
  - net: hns3: Use ARRAY_SIZE() to improve readability
  - Revert "net: hns3: fix spelling mistake "reg_um" -> "reg_num""
  - xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
  - tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
  - bpf: consider that tail calls invalidate packet pointers
  - net: stmmac: Fix accessing freed irq affinity_hint
  - mptcp: fix NULL pointer in can_accept_new_subflow
  - tipc: fix memory leak in tipc_link_xmit
  - net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered
  - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
  - net: mctp: Set SOCK_RCU_FREE
  - usbnet:fix NPE during rx_complete
  - net: ibmveth: make veth_pool_store stop hanging
  - arcnet: Add NULL check in com20020pci_probe()
  - net: fix geneve_opt length integer overflow
  - !16850 [OLK-6.6] Backport TDX HLT/SAFE-HLT fix
  - udp: Fix memory accounting leak.
  - net: mvpp2: Prevent parser TCAM memory corruption
  - sctp: add mutual exclusion in proc_sctp_do_udp_port()
  - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
  - net: fix NULL pointer dereference in l3mdev_l3_rcv
  - net: dsa: free routing table on probe failure
  - sctp: detect and prevent references to a freed transport in sendmsg
  - net_sched: hfsc: Fix a UAF vulnerability in class handling
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
  - net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported
  - net: dsa: clean up FDB, MDB, VLAN entries on unbind
  - !17137 [olk 6.6] net: hibmcge: backport some feature patches
  - xsk: fix an integer overflow in xp_create_and_assign_umem()
  - net: atm: fix use after free in lec_send()
  - eth: bnxt: fix truesize for mb-xdp-pass case
  - !17156  v3:add perpcu stock for kmem
  - scsi: ufs: core: Set default runtime/system PM levels before ufshcd_hba_init()
  - libfs: Fix simple_offset_rename_exchange()
  - shmem: Fix shmem_rename2()
  - mac802154: check local interfaces before deleting sdata list
  - hfs: Sanity check the root record
  - !17109 efi: efi_get_memory_map -- increase map headroom
  - !17148  Bluetooth: MGMT: Protect mgmt_pending list with its own lock
  - sched/dynamic_affinity: Calculate cpu capacity in real time when realtime tasks are running on this cpu
  - sched/dynamic_affinity: fix CI test alway select prefer_cpu problem
  - sched/dynamic_affinity: fix preffered_cpu offline problem
  - sched/fair: reset idlest_cpu if not meet the conditions for preferred CPU
  - memcg: add stock for kmem [un]charging
  - memcg: add CONFIG_MEMCG_KMEM_STOCK
  - scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers
  - selftests: tc-testing: reduce rshift value
  - media: vivid: Change the siize of the composing
  - f2fs: prevent kernel warning due to negative i_nlink from corrupted image
  - !17124  crypto: algif_hash - fix double free in hash_accept
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
  - Bluetooth: MGMT: Protect mgmt_pending list with its own lock
  - net: hibmcge: configure FIFO thresholds according to the MAC controller documentation
  - net: hibmcge: adjust the burst len configuration of the MAC controller to improve TX performance.
  - net: hibmcge: support scenario without PHY
  - net: phy: fixed_phy: constify status argument where possible
  - net: phy: fixed_phy: remove irq argument from fixed_phy_register
  - efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32
  - net: phy: fixed_phy: remove irq argument from fixed_phy_add
  - net: phy: fixed_phy: remove fixed_phy_register_with_gpiod
  - !17140 v2  Cgroup-Based Interference Statistics followup
  - interference: Add distribution histogram support
  - interference: Use hardware timer counter
  - interference: Add mutex interference track support
  - interference: Add spinlock interference track support
  - interference: Add cgroup_ifs_enter/leave_lock helper
  - interference: Disable irq track when irqtime disabled
  - sw64: delete useless I/O access in VM and emulator
  - sw64: kvm: fix perf kvm support
  - sw64: Kconfig: enable HAS_IOPORT by default
  - sw64: pci: remove zx200 dma mask reset
  - sw64: fix for executing syscall(-1)
  - sw64: acpi: select HAVE_ACPI_APEI when ACPI is set
  - sw64: pci: add base address of devmn
  - sw64: adjust the notrace in the code
  - crypto: algif_hash - fix double free in hash_accept
  - smb: client: fix use-after-free in cifs_oplock_break
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  - smb: client: fix use-after-free in crypt_message when using async crypto
  - ext4: only dirty folios when data journaling regular files
  - Fix kabi for TDX halt/safe-halt
  - fbcon: Make sure modelist not set on unregistered console
  - sw64: irqchip: update effective affinity for PINTC
  - sw64: irqchip: add support for PINTC on all NUMA nodes
  - sw64: cpufreq: optimize the granularity of cpufreq
  - sw64: ftrace: restore the register storing direct call address
  - sw64: kvm: fix undefined compile issues for kvm module
  - sw64: pintc: fix guest pintc init
  - sw64: set module region to the 2GB space below vmalloc area
  - scsi: target: iscsi: Fix timeout on deleted connection
  - wifi: ath9k_htc: Abort software beacon handling if disabled
  - x86/tdx: Fix arch_safe_halt() execution for TDX VMs
  - x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT


author: liuxu <liuxu156@huawei.com> - 1:1.36.1-6
changelog:
  - Type:CVE
  - Id:NA
  - SUG:NA
  - DESC:revert fix CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 CVE-2023-42363


author: Kai Liu <kai.liu@windriver.com> - 1:1.49.5-5
changelog:
  - Replace patch support_OPENEULER_to_configure.patch by backport-support-openEuler.patch
    which is backported from upstream, fix issue of detecting openEuler.
  - Add provide-openEuler-appliance-package-list.patch after correctly detected openEuler.
    It was using REDHAT list before.


author: yyjeqhc <jialin.oerv@isrc.iscas.ac.cn> - 0.2.17-3
changelog:
  - Migrated legacy `import pango` and `pangocairo` usage to modern PyGObject (`gi.repository.Pango`, `PangoCairo`)
  - Replaced all legacy constants (`pango.STRETCH_...`) with `Pango.Stretch.XXX` enums


author: chenyaqiang <chengyaqiang@huawei.com> - 1:9.0.96-1
changelog:
  - Update to 9.0.96
  - Fix CVE-2021-43980 CVE-2022-25762 CVE-2023-44487 CVE-2023-46589
    CVE-2024-23672 CVE-2024-24549 CVE-2024-34750


author: wangkai <13474090681@163.com> - 1:9.0.100-1
changelog:
  - Update to 9.0.100 for fix CVE-2024-56337
  - Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337,
    the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not.


