# changelog

author: Li Nan <linan122@huawei.com> - 6.6.0-136.0.0.117
changelog:
  - !20020  ext4: fix e4b bitmap inconsistency reports
  - !20308  ext4: fix stale data issue on the iomap path
  - !20347  Fix exception when umount with release dev fd
  - mfs: Do not release the async event immediately when read failed
  - mfs: Fix wild-memory-access error when mfs event is destroy.
  - !20336  memcg: avoid the warning in mem_cgroup_migrate
  - !20326  KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
  - !20059  net/mdiobus: Fix potential out-of-bounds read/write access
  - !20057  net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
  - !20056  net: phy: clear phydev->devlink when the link is deleted
  - !20055  netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
  - !20130  ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()
  - !20327  s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump
  - !20324  drm/mediatek: Disable AFBC support on Mediatek DRM driver
  - !20276  ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
  - !20325  atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
  - !20330 [OLK-6.6][linux-6.6.y sync] Backport 6.6.98-6.6.99 LTS Patches
  - Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
  - kasan: use vmalloc_dump_obj() for vmalloc error reports
  - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
  - btrfs: don't ignore inode missing when replaying log tree
  - btrfs: fix log tree replay failure due to file with 0 links and extents
  - btrfs: do not assert we found block group item when creating free space tree
  - vsock: fix lock inversion in vsock_assign_transport()
  - ksmbd: fix potential use-after-free in oplock/lease break ack
  - kasan: remove kasan_find_vm_area() to prevent possible deadlock
  - smb: client: fix potential race in cifs_put_tcon()
  - selftests/bpf: adapt one more case in test_lru_map to the new target_free
  - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
  - bpf: Adjust free target to avoid global starvation of LRU map
  - vt: add missing notification when switching back to text mode
  - btrfs: fix assertion when building free space tree
  - net: mana: Record doorbell physical address in PF mode
  - HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
  - net: usb: qmi_wwan: add SIMCom 8230C composition
  - ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
  - ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
  - io_uring: make fallocate be hashed work
  - um: vector: Reduce stack usage in vector_eth_configure()
  - atm: idt77252: Add missing `dma_map_error()`
  - ublk: sanity check add_dev input for underflow
  - net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
  - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
  - net: appletalk: Fix device refcount leak in atrtr_create()
  - drm/tegra: nvdec: Fix dma_alloc_coherent error check
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
  - cifs: all initializations for tcon should happen in tcon_info_alloc
  - smb: client: fix DFS interlink failover
  - smb: client: avoid unnecessary reconnects when refreshing referrals
  - usb: dwc3: Abort suspend on soft disconnect failure
  - usb: cdnsp: Fix issue with CV Bad Descriptor test
  - usb: cdnsp: Replace snprintf() with the safer scnprintf() variant
  - usb:cdnsp: remove TRB_FLUSH_ENDPOINT command
  - btrfs: fix inode lookup error handling during log replay
  - btrfs: return a btrfs_inode from btrfs_iget_logging()
  - btrfs: remove redundant root argument from fixup_inode_link_count()
  - btrfs: remove redundant root argument from btrfs_update_inode_fallback()
  - btrfs: remove noinline from btrfs_update_inode()
  - erofs: fix to add missing tracepoint in erofs_read_folio()
  - ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
  - smb: server: make use of rdma_destroy_qp()
  - x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
  - mm/vmalloc: leave lazy MMU mode on PTE mapping error
  - scripts/gdb: fix interrupts.py after maple tree conversion
  - scripts/gdb: de-reference per-CPU MCE interrupts
  - scripts/gdb: fix interrupts display after MCP on x86
  - mm: fix the inaccurate memory statistics issue for users
  - maple_tree: fix mt_destroy_walk() on root leaf node
  - Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
  - drm/gem: Fix race in drm_gem_handle_create_tail()
  - drm/ttm: fix error handling in ttm_buffer_object_transfer
  - memcg: avoid the warning in mem_cgroup_migrate
  - !17578 perf mem/c2c: Add load store event mapping for Hygon
  - !19670 [OLK-6.6] Fix CVE-2025-39833
  - !19669 [OLK-6.6] Fix CVE-2025-39743
  - !19668 [OLK-6.6] Fix CVE-2025-38681
  - !18606 [0LK-6.6] Fix CVE-2025-38699
  - !20332 Fix CVE-2025-68371
  - !19666 [OLK-6.6] Fix CVE-2025-38650
  - !19665 [OLK-6.6] Fix CVE-2025-38578
  - !19649 [olk 6.6] 主线补丁同步，hugememory&khugepaged
  - !20317 Fix CVE-2025-71108
  - scsi: smartpqi: Fix device resources accessed after device removal
  - !20037 [Intel-SIG] DMR new CPU model support
  - wifi: prevent A-MSDU attacks in mesh networks
  - KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
  - KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table.
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails
  - x86/mce/amd: Fix threshold limit reset
  - x86/mce/amd: Add default names for MCA banks and blocks
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct
  - Bluetooth: HCI: Set extended advertising data synchronously
  - perf: build: Setup PKG_CONFIG_LIBDIR for cross compilation
  - maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
  - rxrpc: Fix bug due to prealloc collision
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
  - atm: clip: Fix infinite recursive call of clip_push().
  - atm: clip: Fix memory leak of struct clip_vcc.
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd().
  - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
  - net: phy: smsc: Force predictable MDI-X state on LAN87xx
  - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
  - net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
  - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
  - !19995  net: netpoll: fix incorrect refcount handling causing incorrect cleanup
  - vsock: Fix transport_* TOCTOU
  - !19994  ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
  - vsock: Fix transport_{g2h,h2g} TOCTOU
  - !19993  net: ipv6: fix field-spanning memcpy warning in AH output
  - vsock: fix `vsock_proto` declaration
  - !19988  udp_tunnel: use netdev_warn() instead of netdev_WARN()
  - fix proc_sys_compare() handling of in-lookup dentries
  - pinctrl: amd: Clear GPIO debounce for suspend
  - Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
  - Bluetooth: hci_sync: Fix not disabling advertising instance
  - ASoC: cs35l56: probe() should fail if the device ID is not recognized
  - ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode
  - !19146 Backport uncore freq driver fixes and support for agent_types and die_id sysfs attributes
  - !20036 Backport CWF cstate PMU for 6.6
  - !20304 [OLK-6.6][linux-6.6.y sync] Backport 6.6.96-6.6.98 LTS Patches
  - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump
  - !20303 ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
  - KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
  - drm/mediatek: Disable AFBC support on Mediatek DRM driver
  - !20295  CVE-2025-68296
  - usb: typec: ucsi: Handle incorrect num_connectors capability
  - Input: xpad - set correct controller type for Acer NGR200
  - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
  - smb: client: remove redundant lstrp update in negotiate protocol
  - igc: fix disabling L1.2 PCI-E link substate on I226 on init
  - platform/x86: Fix initialization order for firmware_attributes_class
  - RDMA/mlx5: Fix vport loopback forcing for MPV device
  - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
  - ext4: fix stale data issue on the iomap path
  - !20046  drm/sysfb: Do not dereference NULL pointer in plane reset
  - !20045  binfmt_misc: restore write access before closing files opened by open_exec()
  - f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault
  - powerpc/kernel: Fix ppc_save_regs inclusion in build
  - platform/x86: think-lmi: Fix sysfs group cleanup
  - platform/x86: think-lmi: Fix kobject cleanup
  - platform/x86: think-lmi: Create ksets consecutively
  - powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed
  - iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
  - Logitech C-270 even more broken
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2
  - smb: client: fix readdir returning wrong type with POSIX extensions
  - usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume
  - usb: cdnsp: do not disable slot for disabled slot
  - Input: iqs7222 - explicitly define number of external channels
  - Input: xpad - support Acer NGR 200 Controller
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
  - xhci: dbc: Flush queued requests before stopping dbc
  - xhci: dbctty: disable ECHO flag by default
  - usb: xhci: quirk for data loss in ISOC transfers
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O
  - module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper
  - platform/x86: hp-bioscfg: Fix class device unregistration
  - platform/x86: hp-bioscfg: Directly use firmware_attributes_class
  - rcu: Return early if callback is not specified
  - wifi: mac80211: drop invalid source address OCB frames
  - aoe: defer rexmit timer downdev work to workqueue
  - regulator: fan53555: add enable_time support and soft-start times
  - ASoC: amd: yc: update quirk data for HP Victus
  - powerpc: Fix struct termio related ioctl macros
  - platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list
  - ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic
  - ata: pata_cs5536: fix build on 32-bit UML
  - ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed
  - ALSA: sb: Don't allow changing the DMA mode during operations
  - drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read
  - drm/simpledrm: Do not upcast in release helpers
  - scsi: ufs: core: Fix clk scaling to be conditional in reset and restore
  - scsi: ufs: core: Add OPP support for scaling clocks and regulators
  - scsi: ufs: core: Fix abnormal scale up after last cmd finish
  - f2fs: fix to zero post-eof page
  - f2fs: convert f2fs_vm_page_mkwrite() to use folio
  - f2fs: prevent writing without fallocate() for pinned files
  - f2fs: add tracepoint for f2fs_vm_page_mkwrite()
  - x86/traps: Initialize DR6 by writing its architectural reset value
  - wifi: mac80211: finish link init before RCU publish
  - wifi: mac80211: Add link iteration macro for link data
  - wifi: mac80211: chan: chandef is non-NULL for reserved
  - smb: client: remove 	 from TP_printk statements
  - btrfs: fix qgroup reservation leak on failure to allocate ordered extent
  - smb: client: fix race condition in negotiate timeout by using more precise timing
  - amd-xgbe: do not double read link status
  - nui: Fix dma_mapping_error() check
  - enic: fix incorrect MTU comparison in enic_change_mtu()
  - amd-xgbe: align CL37 AN sequence as per databook
  - lib: test_objagg: Set error message in check_expect_hints_stats()
  - igc: disable L1.2 PCI-E link substate to avoid performance issue
  - drm/i915/gsc: mei interrupt top half should be in irq disabled context
  - drm/i915/gt: Fix timeline left held on VMA alloc error
  - platform/mellanox: mlxreg-lc: Fix logic error in power state check
  - platform/x86: dell-wmi-sysman: Fix class device unregistration
  - platform/x86: dell-sysman: Directly use firmware_attributes_class
  - platform/x86: think-lmi: Fix class device unregistration
  - platform/x86: think-lmi: Directly use firmware_attributes_class
  - platform/x86: firmware_attributes_class: Simplify API
  - platform/x86: firmware_attributes_class: Move include linux/device/class.h
  - platform/x86: make fw_attr_class constant
  - arm64: dts: qcom: sm8550: add UART14 nodes
  - drm/i915/selftests: Change mock_request() to return error pointers
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer
  - drm/exynos: fimd: Guard display clock control with runtime PM calls
  - dpaa2-eth: fix xdp_rxq_info leak
  - ethernet: atl1: Add missing DMA mapping error checks and count errors
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir
  - btrfs: rename err to ret in btrfs_rmdir()
  - btrfs: fix iteration of extrefs during log replay
  - btrfs: fix missing error handling when searching for inode refs during log replay
  - Bluetooth: Prevent unintended pause by checking if advertising is active
  - platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message
  - RDMA/mlx5: Fix vport loopback for MPV device
  - RDMA/mlx5: Fix CC counters query for MPV
  - RDMA/mlx5: Fix HW counters query for non-representor devices
  - scsi: ufs: core: Fix spelling of a sysfs attribute name
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
  - scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database()
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
  - arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename
  - mtk-sd: reset host->mrq on prepare_data() error
  - mtk-sd: Prevent memory corruption from DMA map failure
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
  - Bluetooth: MGMT: mesh_send: check instances prior disabling advertising
  - Bluetooth: MGMT: set_mesh: update LE scan interval and window
  - Bluetooth: hci_sync: revert some mesh modifications
  - mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode
  - vsock/vmci: Clear the vmci transport packet properly when initializing it
  - s390/pci: Do not try re-enabling load/store if device is disabled
  - rtc: cmos: use spin_lock_irqsave in cmos_interrupt
  - rtc: pcf2127: fix SPI command byte for PCF2131
  - rtc: pcf2127: add missing semicolon after statement
  - !20296 [OLK-6.6][linux-6.6.y sync] Backport 6.6.95-6.6.96 LTS Patches
  - !20298  cifs: Fix memory and information leak in smb3_reconfigure()
  - !20042  RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
  - !20041  Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
  - !19820  usbnet: Prevents free active kevent
  - !20268 urma: fix dereference of null_ptr for uobj
  - Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1"
  - kallsyms: fix build without execinfo
  - drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe()
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
  - usb: typec: displayport: Fix potential deadlock
  - NFSv4.2: another fix for listxattr
  - ARM: 9354/1: ptrace: Use bitfield helpers
  - firmware: arm_scmi: Ensure that the message-id supports fastchannel
  - firmware: arm_scmi: Add a common helper to check if a message is supported
  - nvme: always punt polled uring_cmd end_io work to task_work
  - Revert "ipv6: save dontfrag in cork"
  - x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
  - Kunit to check the longest symbol length
  - s390/entry: Fix last breaking event handling in case of stack corruption
  - media: uvcvideo: Rollback non processed entities on error
  - ksmbd: remove unsafe_memcpy use in session setup
  - ksmbd: Use unsafe_memcpy() for ntlm_negotiate
  - drm/amdgpu: switch job hw_fence to amdgpu_fence
  - drm/amdgpu: Add kicker device detection
  - drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
  - drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram
  - drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config
  - drm/bridge: cdns-dsi: Fix connecting to next bridge
  - drm/bridge: cdns-dsi: Fix phy de-init and flag it so
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
  - drm/amdkfd: Fix race in GWS queue scheduling
  - drm/msm/gpu: Fix crash when throttling GPU immediately during boot
  - drm/udl: Unregister device before cleaning up on disconnect
  - drm/tegra: Assign plane type before registration
  - drm/etnaviv: Protect the scheduler's pending list with its lock
  - drm/cirrus-qemu: Fix pitch programming
  - drm/ast: Fix comment on modeset lock
  - HID: wacom: fix kobject reference count leak
  - HID: wacom: fix memory leak on sysfs attribute creation failure
  - HID: wacom: fix memory leak on kobject creation failure
  - HID: lenovo: Restrict F7/9/11 mode to compact keyboards only
  - net: libwx: fix the creation of page_pool
  - btrfs: update superblock's device bytes_used when dropping chunk
  - btrfs: fix a race between renames and directory logging
  - dm-raid: fix variable in journal device check
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation
  - serial: imx: Restore original RXTL for console to fix data loss
  - dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
  - EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs
  - drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type
  - drm/bridge: ti-sn65dsi86: make use of debugfs_init callback
  - drm/i915: fix build error some more
  - net: selftests: fix TCP packet checksum
  - ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR
  - net: enetc: Correct endianness handling in _enetc_rd_reg64
  - libbpf: Fix possible use-after-free for externs
  - um: ubd: Add missing error check in start_io_thread()
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
  - af_unix: Don't set -ECONNRESET for consumed OOB skb.
  - wifi: mac80211: fix beacon interval calculation overflow
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
  - lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
  - s390/pkey: Prevent overflow in size calculation for memdup_user()
  - ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15
  - i2c: robotfuzz-osif: disable zero-length read messages
  - i2c: tiny-usb: disable zero-length read messages
  - af_unix: Don't leave consecutive consumed OOB skbs.
  - af_unix: Don't call skb_get() for OOB skb.
  - af_unix: Define locking order for U_RECVQ_LOCK_EMBRYO in unix_collect_skb().
  - af_unix: Define locking order for U_LOCK_SECOND in unix_state_double_lock().
  - af_unix: Define locking order for unix_table_double_lock().
  - platform/x86: ideapad-laptop: use usleep_range() for EC polling
  - platform/x86: ideapad-laptop: move ACPI helpers from header to source file
  - platform/x86: ideapad-laptop: move ymc_trigger_ec from lenovo-ymc
  - platform/x86: ideapad-laptop: introduce a generic notification chain
  - dummycon: Trigger redraw when switching consoles with deferred takeover
  - tty: vt: make consw::con_switch() return a bool
  - tty: vt: sanitize arguments of consw::con_clear()
  - tty: vt: make init parameter of consw::con_init() a bool
  - PCI: apple: Set only available ports up
  - PCI: apple: Use helper function for_each_child_of_node_scoped()
  - !20288  memcg: avoid dead loop when setting memory.max
  - cifs: Fix memory and information leak in smb3_reconfigure()
  - !19975  Bluetooth: MGMT: cancel mesh send timer when hdev removed
  - !19976  net/mlx5: Clean up only new IRQ glue on request_irq() failure
  - !19977  net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
  - !19978  net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
  - uio_hv_generic: Query the ringbuffer size for device
  - Drivers: hv: vmbus: Add utility function for querying ring size
  - f2fs: don't over-report free space or inodes in statvfs
  - btrfs: handle csum tree error with rescue=ibadroots correctly
  - ovl: Check for NULL d_inode() in ovl_dentry_upper()
  - scsi: ufs: core: Don't perform UFS clkscaling during host async scan
  - ceph: fix possible integer overflow in ceph_zero_objects()
  - ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock
  - ALSA: hda: Add new pci id for AMD GPU display HD audio controller
  - ALSA: hda: Ignore unsol events for cards being shut down
  - usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
  - usb: Add checks for snprintf() calls in usb_alloc_dev()
  - usb: common: usb-conn-gpio: use a unique name for usb connector device
  - usb: potential integer overflow in usbg_make_tpg()
  - misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe()
  - iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos
  - usb: dwc2: also exit clock_gating when stopping udc while suspended
  - coresight: Only check bottom two claim bits
  - um: use proper care when taking mmap lock during segfault
  - um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp
  - bcache: fix NULL pointer in cache_set_flush()
  - amd/amdkfd: fix a kfd_process ref leak
  - md/md-bitmap: fix dm-raid max_write_behind setting
  - PCI: apple: Fix missing OF node reference in apple_pcie_setup_port
  - PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane
  - dmaengine: xilinx_dma: Set dma_device directions
  - rust: module: place cleanup_module() in .exit.text section
  - ksmbd: provide zero as a unique ID to the Mac client
  - ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension
  - hwmon: (pmbus/max34440) Fix support for max34451
  - NFSv4: xattr handlers should check for absent nfs filehandles
  - cxl/region: Add a dev_err() on missing target list entries
  - fuse: fix race between concurrent setattrs from multiple nodes
  - leds: multicolor: Fix intensity setting while SW blinking
  - sunrpc: don't immediately retransmit on seqno miss
  - mfd: max14577: Fix wakeup source leaks on device unbind
  - mailbox: Not protect module_put with spin_lock_irqsave
  - NFSv4.2: fix listxattr to return selinux security label
  - NFSv4: Always set NLINK even if the server doesn't support it
  - cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode
  - cifs: Fix cifs_query_path_info() for Windows NT servers
  - cifs: Correctly set SMB1 SessionKey field in Session Setup Request
  - !20282 [OLK-6.6][linux-6.6.y sync] Backport 6.6.94-6.6.95 LTS Patches
  - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
  - drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info
  - Revert "gpio: mlxbf3: only get IRQ for device instance 0"
  - smb: client: fix warning when reconnecting channel
  - wifi: ath11k: Add missing platform IDs for quirk table
  - power: supply: bq27xxx: restrict no-battery detection to bq27000
  - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
  - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
  - Revert "ACPI: battery: negate current when discharging"
  - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
  - cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function
  - gpio: mlxbf3: only get IRQ for device instance 0
  - perf evsel: Missed close() when probing hybrid core PMUs
  - RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
  - RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
  - scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
  - perf: Fix cgroup state vs ERROR
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly
  - platform/loongarch: laptop: Add backlight power control support
  - smb: client: fix first command failure during re-negotiation
  - Revert "cpufreq: tegra186: Share policy per cluster"
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
  - platform/x86: ideapad-laptop: add missing Ideapad Pro 5 fn keys
  - serial: sh-sci: Increment the runtime usage counter for the earlycon device
  - net: make for_each_netdev_dump() a little more bug-proof
  - smb: Log an error when close_all_cached_dirs fails
  - dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
  - EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
  - net: atm: fix /proc/net/atm/lec handling
  - net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
  - net: microchip: lan743x: Reduce PTP timeout on HW failure
  - tcp: fix passive TFO socket having invalid NAPI ID
  - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
  - ptp: allow reading of currently dialed frequency to succeed on free-running clocks
  - e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13
  - net: ice: Perform accurate aRFS flow match
  - pldmfw: Select CRC32 when PLDMFW is selected
  - hwmon: (occ) fix unaligned accesses
  - hwmon: (occ) Rework attribute registration for stack usage
  - memcg: avoid dead loop when setting memory.max
  - drm/nouveau/bl: increase buffer size to avoid truncate warning
  - ionic: Prevent driver/fw getting out of sync on devcmd(s)
  - drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
  - drm/msm/disp: Correct porch timing for SDM845
  - smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels
  - erofs: remove unused trace event erofs_destroy_inode
  - bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
  - net: Fix checksum update for ILA adj-transport
  - iio: accel: fxls8962af: Fix temperature calculation
  - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
  - ALSA: hda/intel: Add Thinkpad E15 to PM deny list
  - ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card
  - wifi: rtw89: pci: use DBI function for 8852AE/8852BE/8851BE
  - Input: sparcspkr - avoid unannotated fall-through
  - platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
  - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
  - selftests/x86: Add a test to detect infinite SIGTRAP handler loop
  - udmabuf: use sgtable-based scatterlist wrappers
  - net_sched: sch_sfq: reject invalid perturb period
  - scsi: s390: zfcp: Ensure synchronous unit_add
  - scsi: storvsc: Increase the timeouts to storvsc_timeout
  - smb: improve directory cache reuse for readdir operations
  - cifs: do not disable interface polling on failure
  - cifs: serialize other channels when query server interfaces is pending
  - cifs: deal with the channel loading lag while picking channels
  - LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
  - platform/loongarch: laptop: Unregister generic_sub_drivers on exit
  - platform/loongarch: laptop: Get brightness setting from EC on probe
  - io_uring: fix task leak issue in io_wq_create()
  - Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older
  - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
  - powerpc/vdso: Fix build of VDSO32 with pcrel
  - platform/x86: dell_rbu: Stop overwriting data buffer
  - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
  - tee: Prevent size calculation wraparound on 32-bit kernels
  - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
  - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
  - watchdog: da9052_wdt: respect TWDMIN
  - wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz
  - wifi: ath12k: fix incorrect CE addresses
  - wifi: ath12k: fix link valid field initialization in the monitor Rx
  - wifi: ath11k: determine PM policy based on machine model
  - octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
  - bpf, sockmap: Fix data lost during EAGAIN retries
  - f2fs: fix to set atomic write status more clear
  - usbnet: asix AX88772: leave the carrier control to phylink
  - ice: fix check for existing switch rule
  - sock: Correct error checking condition for (assign|release)_proto_idx()
  - wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping
  - pinctrl: mcp23s08: Reset all pins to input at probe
  - net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
  - vxlan: Do not treat dst cache initialization errors as fatal
  - net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions
  - net: bridge: mcast: update multicast contex when vlan state is changed
  - wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
  - wifi: mac80211: VLAN traffic in multicast path
  - wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
  - wifi: iwlwifi: pcie: make sure to lock rxq->read
  - iommu/amd: Ensure GA log notifier callbacks finish running before module unload
  - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
  - libbpf: Add identical pointer detection to btf_dedup_is_equiv()
  - clk: rockchip: rk3036: mark ddrphy as critical
  - wifi: mac80211: do not offer a mesh path if forwarding is disabled
  - wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
  - net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
  - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
  - net: atlantic: generate software timestamp just before the doorbell
  - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
  - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
  - tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
  - wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
  - wifi: ath11k: Fix QMI memory reuse logic
  - wifi: ath12k: fix a possible dead lock caused by ab->base_lock
  - wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
  - net: dlink: add synchronization for stats update
  - i2c: npcm: Add clock toggle recovery
  - cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
  - sctp: Do not wake readers in __sctp_write_space()
  - wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
  - wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
  - emulex/benet: correct command version selection in be_cmd_get_stats()
  - wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
  - i2c: designware: Invoke runtime suspend on quick slave re-registration
  - f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
  - tipc: use kfree_sensitive() for aead cleanup
  - net: macb: Check return value of dma_set_mask_and_coherent()
  - ACPI: battery: negate current when discharging
  - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
  - gpiolib: of: Add polarity quirk for s5m8767
  - ASoC: tegra210_ahub: Add check to of_device_get_match_data()
  - ACPICA: utilities: Fix overflow check in vsnprintf()
  - power: supply: bq27xxx: Retrieve again when busy
  - ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
  - ACPI: bus: Bail out if acpi_kobj registration fails
  - ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
  - ACPICA: Avoid sequence overread in call to strncmp()
  - mmc: Add quirk to disable DDR50 tuning
  - power: supply: collie: Fix wakeup source leaks on device unbind
  - clocksource: Fix the CPUs' choice in the watchdog per CPU verification
  - ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
  - iio: adc: ad7606_spi: fix reg write value mask
  - iio: imu: inv_icm42600: Fix temperature calculation
  - iio: accel: fxls8962af: Fix temperature scan element sign
  - PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
  - PCI: Fix lock symmetry in pci_slot_unlock()
  - PCI: cadence-ep: Correct PBA offset in .set_msix() callback
  - uio_hv_generic: Use correct size for interrupt and monitor pages
  - Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary
  - cifs: dns resolution is needed only for primary channel
  - cifs: update dstaddr whenever channel iface is updated
  - cifs: reset connections for all channels when reconnect requested
  - remoteproc: core: Release rproc->clean_table after rproc_attach() fails
  - remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
  - regulator: max14577: Add error check for max14577_read_reg()
  - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
  - staging: iio: ad5933: Correct settling cycles encoding per datasheet
  - KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
  - phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
  - mtd: rawnand: qcom: Fix read len for onfi param page
  - dm-verity: fix a memory leak if some arguments are specified multiple times
  - dm-mirror: fix a tiny race condition
  - KVM: VMX: Flush shadow VMCS on emergency reboot
  - KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
  - mtd: nand: sunxi: Add randomizer configuration before randomizer enable
  - mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
  - mm: fix ratelimit_pages update error in dirty_ratio_handler()
  - clk: meson-g12a: add missing fclk_div2 to spicc
  - parisc: fix building with gcc-15
  - vgacon: Add check for vc_origin address range in vgacon_scroll()
  - parisc/unaligned: Fix hex output to show 8 hex chars
  - EDAC/altera: Use correct write width with the INTTEST register
  - fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
  - net: ftgmac100: select FIXED_PHY
  - Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()
  - ext4: ensure i_size is smaller than maxbytes
  - ext4: factor out ext4_get_maxbytes()
  - ext4: fix calculation of credits for extent tree modification
  - bus: fsl-mc: fix GET/SET_TAILDROP command ids
  - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
  - cgroup,freezer: fix incomplete freezing when attaching tasks
  - ceph: set superblock s_magic for IMA fsmagic matching
  - can: tcan4x5x: fix power regulator retrieval during probe
  - bus: mhi: host: Fix conflict between power_up and SYSERR
  - bus: mhi: ep: Update read pointer only after buffer is written
  - ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
  - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
  - arm64/mm: Close theoretical race where stale TLB entry remains valid
  - media: uvcvideo: Fix deferred probing error
  - media: uvcvideo: Send control events for partial succeeds
  - media: uvcvideo: Return the number of processed controls
  - media: imx-jpeg: Reset slot data pointers when freed
  - media: imx-jpeg: Drop the first error frames
  - media: videobuf2: use sgtable-based scatterlist wrappers
  - media: venus: Fix probe error handling
  - media: v4l2-dev: fix error handling in __video_register_device()
  - media: omap3isp: use sgtable-based scatterlist wrappers
  - media: mediatek: vcodec: Correct vsi_core framebuffer size
  - media: gspca: Add error handling for stv06xx_read_sensor()
  - media: davinci: vpif: Fix memory leak in probe error path
  - media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
  - media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
  - media: ccs-pll: Start OP pre-PLL multiplier search from correct value
  - media: ccs-pll: Start VT pre-PLL multiplier search from correct value
  - media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
  - media: nxp: imx8-isi: better handle the m2m usage_count
  - media: ov5675: suppress probe deferral errors
  - media: ov8856: suppress probe deferral errors
  - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
  - wifi: rtw88: usb: Reduce control message timeout to 500 ms
  - wifi: ath12k: fix ring-buffer corruption
  - SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
  - wifi: ath11k: fix ring-buffer corruption
  - wifi: ath11k: fix rx completion meta data corruption
  - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
  - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
  - regulator: max20086: Change enable gpio to optional
  - regulator: max20086: Fix MAX200086 chip id
  - powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states
  - io_uring/kbuf: account ring io_buffer_list memory
  - io_uring: account drain memory to cgroup
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
  - ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
  - gfs2: move msleep to sleepable context
  - crypto: marvell/cesa - Do not chain submitted requests
  - configfs: Do not override creating attribute file failure in populate_attrs()
  - !19787  ima: Handle error code returned by ima_filter_rule_match()
  - !20207  *** fix CVE-2025-37800 ***
  - !20248  sched/fair: Track idle balance interval with idle_stamp in balance_fair
  - !20179 v3  oenetcls: add a switch to enable/disable checking NIC ntuple feature
  - ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
  - !20263 Fix CVE-2025-40311
  - urma: fix dereference of null_ptr for uobj
  - !19549  NFSD: free copynotify stateid in nfs4_free_ol_stateid()
  - !20147  fuse: fix readahead reclaim deadlock
  - !20146  fuse: fix io-uring list corruption for terminated non-committed requests
  - !20145  fuse: missing copy_finish in fuse-over-io-uring argument copies
  - !20144  fsnotify: do not generate ACCESS/MODIFY events on child for special files
  - !19482  NFSD: Define a proc_layoutcommit for the FlexFiles layout type
  - !19483  ksmbd: fix refcount leak causing resource not released
  - !19484  NFSD: fix race between nfsd registration and exports_proc
  - accel/habanalabs: support mapping cb with vmalloc-backed coherent memory
  - !19989  proc: fix missing pde_set_flags() for net proc files
  - sched/fair: Track idle balance interval with idle_stamp in balance_fair
  - !19990  Fix SDEI state machine issue during reboot process
  - !20024 [OLK-6.6] backport irqchip/gic-v4.1: Use local 4_1 ITS to generate VSGI from upstream linux-6.16.rc1
  - !20217 [OLK-6.6][linux-6.6.y sync] Backport 6.6.93-6.6.94 LTS Patches
  - !20070 [OLK-6.6] Merge continuous pages into a large range when notifying range enc status changes
  - ACPI: CPPC: Perform fast check switch only for online CPUs
  - arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator
  - serial: sh-sci: Check that the DMA cookie is valid
  - thunderbolt: Fix wake on connect at runtime
  - bonding: set random address only when slaves already exist
  - drm/mediatek: Fix device use-after-free on unbind
  - rtc: Optimize calculations in rtc_time64_to_tm()
  - !20170  perf/x86/amd: Check event before enable to avoid GPF
  - !20069 ub: cdma: jfs 64K page table memory adaptation
  - !20224  crypto: af_alg - zero initialize memory allocated via sock_kmalloc
  - !20027 [OLK-6.6]Enhance CMA memory usage reporting for CSV3
  - crypto: af_alg - zero initialize memory allocated via sock_kmalloc
  - drm/meson: Use 1000ULL when operating with mode->clock
  - regulator: dt-bindings: mt6357: Drop fixed compatible requirement
  - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
  - usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx()
  - usb: Flush altsetting 0 endpoints before reinitializating them after reset.
  - usb: cdnsp: Fix issue with detecting USB 3.2 speed
  - usb: cdnsp: Fix issue with detecting command completion event
  - kbuild: Disable -Wdefault-const-init-unsafe
  - Revert "io_uring: ensure deferred completions are posted for multishot"
  - io_uring/rw: fix wrong NOWAIT check in io_rw_init_file()
  - io_uring/rw: allow pollable non-blocking attempts for !FMODE_NOWAIT
  - io_uring: add io_file_can_poll() helper
  - ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1
  - tools/resolve_btfids: Fix build when cross compiling kernel with clang.
  - block: Fix bvec_set_folio() for very large folios
  - bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP
  - perf: Ensure bpf_perf_link path is properly serialized
  - nvmet-fcloop: access fcpreq only when holding reqlock
  - fs/filesystems: Fix potential unsigned integer underflow in fs_name()
  - net_sched: tbf: fix a race in tbf_change()
  - net/mlx5e: Fix leak of Geneve TLV option object
  - net/mlx5: Fix return value when searching for existing flow group
  - net/mlx5: Ensure fw pages are always allocated on same NUMA
  - Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance
  - Bluetooth: Fix NULL pointer deference on eir_get_service_data
  - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
  - net/mdiobus: Fix potential out-of-bounds read/write access
  - macsec: MACsec SCI assignment for ES = 0
  - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used
  - i40e: retry VFLR handling if there is ongoing VF reset
  - i40e: return false from i40e_reset_vf if reset is in progress
  - drm/meson: fix more rounding issues with 59.94Hz modes
  - drm/meson: use vclk_freq instead of pixel_freq in debug print
  - drm/meson: fix debug log statement when setting the HDMI clocks
  - drm/meson: use unsigned long long / Hz for frequency types
  - scsi: iscsi: Fix incorrect error path labels for flashnode operations
  - pinctrl: qcom: pinctrl-qcm2290: Add missing pins
  - wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready
  - wifi: ath11k: don't wait when there is no vdev started
  - wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process()
  - wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request()
  - wifi: ath11k: convert timeouts to secs_to_jiffies()
  - wifi: ath11k: fix soc_dp_stats debugfs file permission
  - ath10k: snoc: fix unbalanced IRQ enable in crash recovery
  - Bluetooth: hci_core: fix list_for_each_entry_rcu usage
  - serial: sh-sci: Clean sci_ports[0] after at earlycon exit
  - serial: sh-sci: Move runtime PM enable to sci_probe_single()
  - serial: sh-sci: Check if TX data was written to device in .tx_empty()
  - arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators
  - arm64: dts: ti: k3-j721e-sk: Add support for multiple CAN instances
  - arm64: dts: ti: k3-j721e-sk: Model CSI2RX connector mux
  - arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0
  - arm64: dts: ti: k3-am65-main: Fix sdhci node properties
  - kasan: use unchecked __memset internally
  - Input: synaptics-rmi - fix crash with unsupported versions of F34
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
  - ASoC: ti: omap-hdmi: Re-add dai_link->platform to fix card init
  - ASoC: Intel: avs: Verify content returned by parse_int_array()
  - ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX
  - ASoC: codecs: hda: Fix RPM usage count underflow
  - scsi: ufs: qcom: Prevent calling phy_exit() before phy_init()
  - wireguard: device: enable threaded NAPI
  - net: dsa: b53: allow RGMII for bcm63xx RGMII ports
  - net: dsa: b53: do not enable RGMII delay on bcm63xx
  - netfilter: nf_nat: also check reverse tuple to obtain clashing entry
  - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
  - vmxnet3: correctly report gso type for UDP tunnels
  - net: wwan: t7xx: Fix napi rx poll issue
  - net: dsa: tag_brcm: legacy: fix pskb_may_pull length
  - ice: fix rebuilding the Tx scheduler tree for large queue counts
  - ice: create new Tx scheduler nodes for new queues only
  - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
  - spi: bcm63xx-hsspi: fix shared reset
  - spi: bcm63xx-spi: fix shared reset
  - net: lan966x: Make sure to insert the vlan tags also in host mode
  - net/mlx4_en: Prevent potential integer overflow calculating Hz
  - driver: net: ethernet: mtk_star_emac: fix suspend/resume issue
  - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt
  - net: stmmac: platform: guarantee uniqueness of bus_id
  - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
  - coresight: prevent deactivate active config while enabling the config
  - counter: interrupt-cnt: Protect enable/disable OPs with mutex
  - MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a
  - iio: adc: ad7124: Fix 3dB filter frequency reading
  - iio: filter: admv8818: Support frequencies >= 2^32
  - iio: filter: admv8818: fix range calculation
  - iio: filter: admv8818: fix integer overflow
  - iio: filter: admv8818: fix band 4, state 15
  - thunderbolt: Fix a logic error in wake on connect
  - rtc: loongson: Add missing alarm notifications for ACPI RTC events
  - PCI/DPC: Initialize aer_err_info before using it
  - PCI: apple: Use gpiod_set_value_cansleep in probe flow
  - PCI: cadence: Fix runtime atomic count underflow
  - PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus()
  - rtc: sh: assign correct interrupts with DT
  - cifs: Fix validation of SMB1 query reparse point response
  - perf trace: Always print return value for syscalls returning a pid
  - perf record: Fix incorrect --user-regs comments
  - perf tests switch-tracking: Fix timestamp comparison
  - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
  - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
  - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
  - remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick}
  - remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe
  - perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
  - perf intel-pt: Fix PEBS-via-PT data_src
  - perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids()
  - dm-flakey: make corrupting read bios work
  - dm-flakey: error all IOs when num_features is absent
  - mtd: nand: ecc-mxic: Fix use of uninitialized variable ret
  - dm: free table mempools if not used in __bind
  - dm: don't change md if dm_table_set_restrictions() fails
  - perf ui browser hists: Set actions->thread before calling do_zoom_thread()
  - perf build: Warn when libdebuginfod devel files are not available
  - randstruct: gcc-plugin: Fix attribute addition
  - randstruct: gcc-plugin: Remove bogus void member
  - soc: aspeed: lpc: Fix impossible judgment condition
  - ARM: aspeed: Don't select SRAM
  - arm64: dts: mt6359: Rename RTC node to match binding expectations
  - arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups
  - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou
  - arm64: defconfig: mediatek: enable PHY drivers
  - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device
  - ARM: dts: qcom: apq8064: add missing clocks to the timer node
  - dt-bindings: vendor-prefixes: Add Liontron name
  - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
  - nilfs2: add pointer check for nilfs_direct_propagate()
  - ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery
  - arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E
  - arm64: tegra: Drop remaining serial clock-names and reset-names
  - arm64: dts: rockchip: Update eMMC for NanoPi R5 series
  - arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning
  - arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply
  - arm64: dts: mt6359: Add missing 'compatible' property to regulators node
  - arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles
  - arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio
  - arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio
  - arm64: dts: imx8mp-beacon: Fix RTC capacitive load
  - arm64: dts: imx8mn-beacon: Fix RTC capacitive load
  - arm64: dts: imx8mm-beacon: Fix RTC capacitive load
  - arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO
  - arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains
  - ARM: dts: at91: at91sam9263: fix NAND chip selects
  - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
  - arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies
  - arm64: dts: qcom: sm8250: Fix CPU7 opp table
  - arm64: dts: qcom: sm8350: Reenable crypto & cryptobam
  - arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios
  - arm64: dts: qcom: sdm845-starqltechn: refactor node order
  - arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake
  - arm64: dts: qcom: sdm845-starqltechn: remove wifi
  - f2fs: fix to correct check conditions in f2fs_cross_rename
  - f2fs: use d_inode(dentry) cleanup dentry->d_inode
  - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames
  - octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
  - net: phy: mscc: Fix memory leak when using one step timestamping
  - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
  - net: phy: fix up const issues in to_mdio_device() and to_phy_device()
  - net: phy: clear phydev->devlink when the link is deleted
  - net: lan966x: Fix 1-step timestamping over ipv4 or ipv6
  - RISC-V: KVM: lock the correct mp_state during reset
  - netfilter: nft_tunnel: fix geneve_opt dump
  - Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach()
  - vfio/type1: Fix error unwind in migration dirty bitmap allocation
  - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
  - wifi: mt76: mt7996: fix RX buffer size of MCU event
  - wifi: mt76: mt7996: set EHT max ampdu length capability
  - scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort()
  - wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event
  - iommu: remove duplicate selection of DMAR_TABLE
  - s390/bpf: Store backchain even for leaf progs
  - clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz
  - libbpf: Use proper errno value in nlattr
  - ktls, sockmap: Fix missing uncharge operation
  - tracing: Fix error handling in event_trigger_parse()
  - tracing: Rename event_trigger_alloc() to trigger_data_alloc()
  - efi/libstub: Describe missing 'out' parameter in efi_load_initrd
  - clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs
  - clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs
  - clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs
  - clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs
  - bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction
  - netfilter: nft_quota: match correctly when the quota just depleted
  - netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
  - libbpf: Use proper errno value in linker
  - f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed()
  - f2fs: clean up w/ fscrypt_is_bounce_page()
  - bonding: assign random address if device address is same as bond
  - iommu: Protect against overflow in iommu_pgsize()
  - Use thread-safe function pointer in libbpf_print
  - libbpf: Remove sample_period init in perf_buffer
  - wifi: ath12k: Add MSDU length validation for TKIP MIC error
  - wifi: rtw88: do not ignore hardware read error during DPK
  - wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally
  - wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT
  - xfrm: Use xdo.dev instead of xdo.real_dev
  - libbpf: Fix buffer overflow in bpf_object__init_prog
  - net: ncsi: Fix GCPS 64-bit member variables
  - wifi: ath12k: Fix WMI tag for EHT rate in peer assoc
  - selftests/bpf: Fix bpf_nf selftest failure
  - IB/cm: use rwlock for MAD agent lock
  - drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err
  - drm/mediatek: Fix kobject put for component sub-drivers
  - drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr
  - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
  - x86/cpu: Rename and move CPU model entry for Diamond Rapids
  - x86/cpu: Add two Intel CPU model numbers
  - !20099 v2  xsched: Add XSched manual
  - firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES
  - drm/tegra: rgb: Fix the unbound reference count
  - drm/vkms: Adjust vkms_state->active_planes allocation type
  - drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
  - selftests/seccomp: fix syscall_restart test for arm compat
  - arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX
  - firmware: psci: Fix refcount leak in psci_dt_init
  - m68k: mac: Fix macintosh_config for Mac II
  - watchdog: exar: Shorten identity name to fit correctly
  - drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe()
  - arm64/fpsimd: Fix merging of FPSIMD state during signal return
  - arm64/fpsimd: Avoid RES0 bits in the SME trap handler
  - media: rkvdec: Fix frame size enumeration
  - drm/vc4: tests: Use return instead of assert
  - drm/vmwgfx: Add seqno waiter for sync_files
  - ASoC: apple: mca: Constrain channels according to TDM mask
  - spi: sh-msiof: Fix maximum DMA transfer size
  - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
  - PM: sleep: Print PM debug messages during hibernation
  - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
  - PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
  - ASoC: SOF: ipc4-pcm: Adjust pipeline_list->pipelines allocation type
  - power: reset: at91-reset: Optimize at91_reset()
  - spi: tegra210-quad: modify chip select (CS) deactivation
  - spi: tegra210-quad: remove redundant error handling code
  - !20076  smb3: fix for slab out of bounds on mount to ksmbd
  - spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers
  - ASoC: tas2764: Enable main IRQs
  - ACPICA: exserial: don't forget to handle FFixedHW opregions for reading
  - kunit: Fix wrong parameter to kunit_deactivate_static_stub()
  - crypto: sun8i-ce - move fallback ahash_request to the end of the struct
  - crypto: xts - Only add ecb if it is not already there
  - crypto: lrw - Only add ecb if it is not already there
  - rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture
  - btrfs: scrub: fix a wrong error type when metadata bytenr mismatches
  - btrfs: scrub: update device stats when an error is detected
  - crypto: marvell/cesa - Avoid empty transfer descriptor
  - x86/cpu: Sanitize CPUID(0x80000000) output
  - x86/microcode/AMD: Do not return error when microcode update is not necessary
  - powerpc: do not build ppc_save_regs.o always
  - crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions
  - perf/core: Fix broken throttling when max_samples_per_tick=1
  - gfs2: gfs2_create_inode error handling fix
  - crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run()
  - tools/x86/kcpuid: Fix error handling
  - dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property
  - dt-bindings: usb: cypress,hx3: Add support for all variants
  - usb: usbtmc: Fix timeout value in get_stb
  - Bluetooth: hci_qca: move the SoC type check to the right place
  - usb: typec: ucsi: fix Clang -Wsign-conversion warning
  - USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB
  - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
  - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
  - rtc: Fix offset calculation for .start_secs < 0
  - rtc: Make rtc_time64_to_tm() support dates before 1970
  - pinctrl: armada-37xx: set GPIO output value before setting direction
  - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
  - !18475 [OLK-6.6] x86/kvm: expose CPUID 0xC000_0000 for Zhaoxin "Shanghai" vendor
  - driver core: fix potential NULL pointer dereference in dev_uevent()
  - Revert "Revert "Revert "driver core: Fix uevent_show() vs driver detach race"""
  - !19893  nbd: defer config unlock in nbd_genl_connect
  - !19892  nbd: defer config put in recv_work
  - !19890  md: fix rcu protection in md_wakeup_thread
  - !19889  nvme-multipath: fix lockdep WARN due to partition scan work
  - !19835  blk-cgroup: fix possible deadlock while configuring policy
  - !19815  scsi: sg: Do not sleep in atomic context
  - !20162  tracing: Fix enabling of tracing on file release
  - !20110  macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
  - !20164  powerpc/kexec: Enable SMT before waking offline CPUs
  - !20149  tracing: Do not register unsupported perf events
  - !20153  iavf: fix off-by-one issues in iavf_config_rss_reg()
  - !20152  e1000: fix OOB in e1000_tbi_should_accept()
  - !20140  mlxsw: spectrum_router: Fix neighbour use-after-free
  - !20139  mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats
  - !20118 [OLK-6.6][linux-6.6.y sync] Backport 6.6.92-6.6.93 LTS Patches
  - !19756  erofs: avoid infinite loops due to corrupted subpage compact indexes
  - !19107 mptcp: Fix proto fallback detection with BPF
  - !20128  NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
  - !20000  cifs: fix memory leak in smb3_fs_context_parse_param error path
  - !20001  smb: client: fix memory leak in cifs_construct_tcon()
  - !20002  CVE-2025-40328
  - !19999  smb: client: fix potential cfid UAF in smb2_query_info_compound
  - !19998  cifs: client: fix memory leak in smb3_fs_context_parse_param
  - !20094  CVE-2025-40099
  - !20089  smb: client: Fix refcount leak for cifs_sb_tlink
  - !20088  ceph: fix race condition validating r_parent before applying state
  - !20086  smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
  - !20081  CVE-2025-39798
  - !20078  NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
  - !20077  NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
  - !20075  smb: client: fix potential deadlock when reconnecting channels
  - !20074  smb: client: add NULL check in automount_fullpath
  - !20071  smb: client: Avoid race in open_cached_dir with lease breaks
  - !19945  fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
  - !19021  memcg: enable asynchronous reclaim for cgroup-v2
  - net/oenetcls: add a switch to enable/disable checking NIC ntuple feature
  - net/oenetcls: Balancing softirq to improve performance
  - perf/x86/amd: Check event before enable to avoid GPF
  - af_unix: Initialise scc_index in unix_add_edge().
  - wifi: rtw89: avoid circular locking dependency in ser_state_run()
  - Revert "leds: trigger: netdev: Configure LED blink interval for HW offload"
  - ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
  - Revert "cpuidle: menu: Avoid discarding useful information"
  - cpuidle: governors: menu: Avoid using invalid recent intervals data
  - ASoC: ops: dynamically allocate struct snd_ctl_elem_value
  - cpufreq: tegra186: Set target frequency for all cpus in policy
  - Revert "mmc: sdhci: Disable SD card clock before changing parameters"
  - soc: qcom: smp2p: Fix fallback to qcom,ipc parse
  - rpmsg: qcom_smd: Fix fallback to qcom,ipc parse
  - Revert "SUNRPC: Don't allow waiting for exiting tasks"
  - nvmem: imx-ocotp: fix MAC address byte length
  - phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe()
  - ksmbd: use list_first_entry_or_null for opinfo_get_list()
  - net: ethernet: ti: am65-cpsw: Lower random mac address error print to info
  - platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
  - NFS: Avoid flushing data while holding directory locks in nfs_rename()
  - nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro
  - spi: spi-sun4i: fix early activation
  - phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure
  - drm/amd/display: fix link_set_dpms_off multi-display MST corner case
  - um: let 'make clean' properly clean underlying SUBARCH as well
  - platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
  - nfs: don't share pNFS DS connections between net namespaces
  - HID: quirks: Add ADATA XPG alpha wireless mouse support
  - dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open
  - coredump: fix error handling for replace_fd()
  - perf/arm-cmn: Initialise cmn->cpu earlier
  - perf/arm-cmn: Fix REQ2/SNP2 mixup
  - arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy
  - arm64: dts: qcom: sm8550: Add missing properties for cryptobam
  - arm64: dts: qcom: sm8450: Add missing properties for cryptobam
  - arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node
  - arm64: dts: qcom: ipq9574: Add missing properties for cryptobam
  - af_unix: Fix uninit-value in __unix_walk_scc()
  - af_unix: Fix garbage collection of embryos carrying OOB with SCM_RIGHTS
  - af_unix: Add dead flag to struct scm_fp_list.
  - af_unix: Don't access successor in unix_del_edges() during GC.
  - af_unix: Try not to hold unix_gc_lock during accept().
  - af_unix: Remove lock dance in unix_peek_fds().
  - af_unix: Replace garbage collection algorithm.
  - af_unix: Detect dead SCC.
  - af_unix: Assign a unique index to SCC.
  - af_unix: Avoid Tarjan's algorithm if unnecessary.
  - af_unix: Skip GC if no cycle exists.
  - af_unix: Save O(n) setup of Tarjan's algo.
  - af_unix: Fix up unix_edge.successor for embryo socket.
  - af_unix: Save listener for embryo socket.
  - af_unix: Detect Strongly Connected Components.
  - af_unix: Iterate all vertices by DFS.
  - af_unix: Bulk update unix_tot_inflight/unix_inflight when queuing skb.
  - af_unix: Link struct unix_edge when queuing skb.
  - af_unix: Allocate struct unix_edge for each inflight AF_UNIX fd.
  - af_unix: Allocate struct unix_vertex for each inflight AF_UNIX fd.
  - af_unix: Remove CONFIG_UNIX_SCM.
  - af_unix: Remove io_uring code for GC.
  - af_unix: Replace BUG_ON() with WARN_ON_ONCE().
  - af_unix: Try to run GC async.
  - af_unix: Run GC on only one CPU.
  - af_unix: Return struct unix_sock from unix_get_socket().
  - can: kvaser_pciefd: Force IRQ edge in case of nested IRQ
  - drm/gem: Internally test import_attach for imported objects
  - x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers
  - i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work()
  - pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group()
  - watchdog: aspeed: fix 64-bit division
  - serial: sh-sci: Save and restore more registers
  - highmem: add folio_test_partial_kmap()
  - spi: spi-fsl-dspi: Reset SR flags before sending a new message
  - spi: spi-fsl-dspi: Halt the module after a new message transfer
  - spi: spi-fsl-dspi: restrict register range for regmap access
  - Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection"
  - Input: xpad - add more controllers
  - smb: client: Reset all search buffer pointers when releasing buffer
  - arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs
  - smb: client: Fix use-after-free in cifs_fill_dirent
  - drm/edid: fixed the bug that hdr metadata was not reset
  - thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature
  - can: kvaser_pciefd: Continue parsing DMA buf after dropped RX
  - llc: fix data loss when reading from a socket in llc_ui_recvmsg()
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10
  - ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction
  - ASoc: SOF: topology: connect DAI to a single DAI link
  - ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext
  - can: slcan: allow reception of short error messages
  - clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe()
  - octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG
  - octeontx2-af: Set LMT_ENA bit for APR table entries
  - octeontx2-pf: Add AF_XDP non-zero copy support
  - io_uring: fix overflow resched cqe reordering
  - net: lan743x: Restore SGMII CTRL register on resume
  - net: dwmac-sun8i: Use parsed internal PHY address instead of 1
  - pinctrl: qcom: switch to devm_register_sys_off_handler()
  - pinctrl: qcom/msm: Convert to platform remove callback returning void
  - ice: Fix LACP bonds without SRIOV environment
  - ice: fix vf->num_mac count with port representors
  - bridge: netfilter: Fix forwarding of fragmented packets
  - Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling
  - dmaengine: fsl-edma: Fix return code for unhandled interrupts
  - dmaengine: idxd: Fix ->poll() return value
  - xfrm: Sanitize marks before insert
  - clk: sunxi-ng: d1: Add missing divider for MMC mod clocks
  - remoteproc: qcom_wcnss: Fix on platforms without fallback regulators
  - dmaengine: idxd: Fix allowing write() from different address spaces
  - soundwire: bus: Fix race on the creation of the IRQ domain
  - xenbus: Allow PVH dom0 a non-local xenstore
  - wifi: iwlwifi: add support for Killer on MTL
  - tools: ynl-gen: validate 0 len strings from kernel
  - cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function
  - cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info()
  - io_uring/fdinfo: annotate racy sq/cq head/tail reads
  - nvme-pci: add quirks for WDC Blue SN550 15b7:5009
  - nvme-pci: add quirks for device 126f:1001
  - ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
  - ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
  - ASoC: cs42l43: Disable headphone clamps during type detection
  - pinctrl: meson: define the pull up/down resistor value as 60 kOhm
  - book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n
  - ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of()
  - drm: Add valid clones check
  - drm/panel-edp: Add Starry 116KHD024006
  - drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
  - drm: bridge: adv7511: fill stream capabilities
  - wifi: ath12k: Fix end offset bit definition in monitor ring descriptor
  - wifi: ath9k: return by of_get_mac_address
  - accel/qaic: Mask out SR-IOV PCI resources
  - wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override
  - regulator: ad5398: Add device tree support
  - spi: zynqmp-gqspi: Always acknowledge interrupts
  - wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet
  - wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate
  - wifi: rtl8xxxu: retry firmware download on error
  - perf/amd/ibs: Fix ->config to sample period calculation for OP PMU
  - perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt
  - firmware: arm_scmi: Relax duplicate name constraint across protocol ids
  - bpftool: Fix readlink usage in get_fd_type
  - drm/ast: Find VBIOS mode from regular display size
  - ASoC: rt722-sdca: Add some missing readable registers
  - ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode
  - arm64: zynqmp: add clock-output-names property in clock nodes
  - HID: usbkbd: Fix the bit shift number for LED_KANA
  - wifi: ath12k: Avoid napi_sync() before napi_enable()
  - scsi: st: Restore some drive settings after reset
  - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
  - net/mana: fix warning in the writer of client oob
  - ice: count combined queues using Rx/Tx count
  - rcu: fix header guard for rcu_all_qs()
  - rcu: handle unstable rdp in rcu_read_unlock_strict()
  - rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
  - ice: treat dyn_allowed only as suggestion
  - bridge: mdb: Allow replace of a host-joined group
  - r8169: don't scan PHY addresses > 0
  - ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only
  - vxlan: Annotate FDB data races
  - media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available
  - f2fs: introduce f2fs_base_attr for global sysfs entries
  - hwmon: (xgene-hwmon) use appropriate type for the latency value
  - clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs
  - wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU
  - wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
  - ext4: remove writable userspace mappings before truncating page cache
  - ext4: don't write back data before punch hole in nojournal mode
  - leds: trigger: netdev: Configure LED blink interval for HW offload
  - pstore: Change kmsg_bytes storage size to u32
  - r8152: add vendor/device ID pair for Dell Alienware AW1022z
  - ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
  - arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src
  - powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory
  - net: fec: Refactor MAC reset to function
  - wifi: mac80211: remove misplaced drv_mgd_complete_tx() call
  - wifi: mac80211: don't unconditionally call drv_mgd_complete_tx()
  - drm/v3d: Add clock handling
  - net/mlx5e: reduce the max log mpwrq sz for ECPF and reps
  - net/mlx5e: reduce rep rxq depth to 256 for ECPF
  - net/mlx5e: set the tx_queue_len for pfifo_fast
  - net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
  - scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr()
  - drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer()
  - drm/amdgpu: enlarge the VBIOS binary size limit
  - drm/amd/display: Initial psr_version with correct setting
  - drm/amd/display: Update CR AUX RD interval interpretation
  - drm/amdgpu: reset psp->cmd to NULL after releasing the buffer
  - drm/amd/display: Don't try AUX transactions on disconnected link
  - drm/amdgpu: Set snoop bit for SDMA for MI series
  - soundwire: amd: change the soundwire wake enable/disable sequence
  - phy: core: don't require set_mode() callback for phy_get_mode() to work
  - serial: sh-sci: Update the suspend/resume support
  - sched: Reduce the default slice to avoid tasks getting an extra tick
  - x86/traps: Cleanup and robustify decode_bug()
  - clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate
  - clk: qcom: ipq5018: allow it to be bulid on arm32
  - net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
  - media: v4l: Memset argument to 0 before calling get_mbus_config pad op
  - media: i2c: imx219: Correct the minimum vblanking value
  - kunit: tool: Use qboot on QEMU x86_64
  - smack: Revert "smackfs: Added check catlen"
  - smack: recognize ipv4 CIPSO w/o categories
  - pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map
  - ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
  - ASoC: tas2764: Power up/down amp on mute ops
  - ASoC: tas2764: Mark SW_RESET as volatile
  - ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG
  - ASoC: ops: Enforce platform maximum on initial value
  - firmware: arm_ffa: Reject higher major version as incompatible
  - net/mlx5: Apply rate-limiting to high temperature warning
  - net/mlx5: Modify LSB bitmask in temperature event to include only the first bit
  - media: test-drivers: vivid: don't call schedule in loop
  - vxlan: Join / leave MC group after remote changes
  - PCI: Fix old_size lower bound in calculate_iosize() too
  - eth: mlx4: don't try to complete XDP frames in netpoll
  - bpf: don't do clean_live_states when state->loop_entry->branches > 0
  - can: c_can: Use of_property_present() to test existence of DT property
  - pmdomain: imx: gpcv2: use proper helper for property detection
  - RDMA/core: Fix best page size finding when it can cross SG entries
  - drm/amd/display: Add support for disconnected eDP streams
  - i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA)
  - EDAC/ie31200: work around false positive build warning
  - wifi: rtw89: fw: propagate error code from rtw89_h2c_tx()
  - wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
  - wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
  - wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
  - scsi: mpt3sas: Send a diag reset if target reset fails
  - clocksource: mips-gic-timer: Enable counter when CPUs start
  - MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
  - MIPS: Use arch specific syscall name match function
  - crypto: skcipher - Zap type in crypto_alloc_sync_skcipher
  - x86/kaslr: Reduce KASLR entropy on most x86 systems
  - net/mlx5: Change POOL_NEXT_SIZE define value and make it global
  - libbpf: Fix out-of-bound read
  - media: tc358746: improve calculation of the D-PHY timing registers
  - media: adv7180: Disable test-pattern control on adv7180
  - cpuidle: menu: Avoid discarding useful information
  - vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines
  - vhost-scsi: Return queue full for page alloc failures during copy
  - x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus()
  - ASoC: mediatek: mt8188: Add reference for dmic clocks
  - ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile
  - drm/amd/display: handle max_downscale_src_width fail check
  - x86/build: Fix broken copy command in genimage.sh when making isoimage
  - Octeontx2-af: RPM: Register driver with PCI subsys IDs
  - soc: ti: k3-socinfo: Do not use syscon helper to build regmap
  - wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band
  - bonding: report duplicate MAC address in all situations
  - net: xgene-v2: remove incorrect ACPI_PTR annotation
  - net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only
  - leds: pwm-multicolor: Add check for fwnode_property_read_u32
  - drm/amdkfd: KFD release_work possible circular locking
  - selftests/net: have `gro.sh -t` return a correct exit code
  - net/mlx5: Avoid report two health errors on same syndrome
  - firmware: arm_ffa: Set dma_mask for ffa devices
  - PCI: brcmstb: Add a softdep to MIP MSI-X driver
  - PCI: brcmstb: Expand inbound window size up to 64GB
  - wifi: ath12k: Report proper tx completion status to mac80211
  - soc: apple: rtkit: Implement OSLog buffers properly
  - soc: apple: rtkit: Use high prio work queue
  - fpga: altera-cvp: Increase credit timeout
  - drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
  - ARM: at91: pm: fix at91_suspend_finish for ZQ calibration
  - hwmon: (gpio-fan) Add missing mutex locks
  - x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
  - clk: imx8mp: inform CCF of maximum frequency of clocks
  - media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value
  - media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
  - drm/rockchip: vop2: Add uv swap for cluster window
  - ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
  - ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7
  - perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type
  - net: pktgen: fix mpls maximum labels list parsing
  - net: ethernet: ti: cpsw_new: populate netdev of_node
  - pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
  - drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination
  - drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
  - remoteproc: qcom_wcnss: Handle platforms with only single power domain
  - net: phylink: use pl->link_interface in phylink_expects_phy()
  - drm/gem: Fix kabi-breakage for drm
  - powerpc/kexec: Enable SMT before waking offline CPUs
  - tracing: Fix enabling of tracing on file release
  - iavf: fix off-by-one issues in iavf_config_rss_reg()
  - e1000: fix OOB in e1000_tbi_should_accept()
  - tracing: Do not register unsupported perf events
  - fuse: fix readahead reclaim deadlock
  - fuse: fix io-uring list corruption for terminated non-committed requests
  - fuse: missing copy_finish in fuse-over-io-uring argument copies
  - fsnotify: do not generate ACCESS/MODIFY events on child for special files
  - mlxsw: spectrum_router: Fix neighbour use-after-free
  - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats
  - drm/gem: Test for imported GEM buffers with helper
  - ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()
  - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
  - media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
  - ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
  - ieee802154: ca8210: Use proper setters and getters for bitwise types
  - rtc: ds1307: stop disabling alarms on probe
  - tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
  - ALSA: seq: Improve data consistency at polling
  - powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
  - arm64: tegra: Resize aperture for the IGX PCIe C5 slot
  - arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator
  - drm/amdkfd: Set per-process flags only once cik/vi
  - watchdog: aspeed: Update bootstatus handling
  - cpufreq: tegra186: Share policy per cluster
  - iommu/amd/pgtbl_v2: Improve error handling
  - ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup()
  - auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common"
  - gfs2: Check for empty queue in run_queue
  - drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch
  - drm/amd/display: calculate the remain segments for all pipes
  - drm/amd/display: remove minimum Dispclk and apply oem panel timing.
  - ipv6: save dontfrag in cork
  - printk: Check CON_SUSPEND when unblanking a console
  - hwmon: (dell-smm) Increment the number of fans
  - usb: xhci: Don't change the status of stalled TDs on failed Stop EP
  - mmc: sdhci: Disable SD card clock before changing parameters
  - mmc: dw_mmc: add exynos7870 DW MMC support
  - arm64/mm: Check PUD_TYPE_TABLE in pud_bad()
  - netfilter: conntrack: Bound nf_conntrack sysctl writes
  - timer_list: Don't use %pK through printk()
  - posix-timers: Add cond_resched() to posix_timer_add() search loop
  - RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject()
  - ext4: do not convert the unwritten extents if data writeback fails
  - ext4: reject the 'data_err=abort' option in nojournal mode
  - ASoC: sun4i-codec: support hp-det-gpios property
  - drm/amdgpu: Update SRIOV video codec caps
  - mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check
  - pinctrl-tegra: Restore SFSEL bit when freeing pins
  - xen: Add support for XenServer 6.1 platform device
  - net/smc: use the correct ndev to find pnetid by pnetid table
  - dm: restrict dm device size to 2^63-512 bytes
  - crypto: octeontx2 - suppress auth failure screaming due to negative tests
  - kbuild: fix argument parsing in scripts/config
  - ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect
  - thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer
  - objtool: Fix error handling inconsistencies in check()
  - rtc: rv3032: fix EERD location
  - tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
  - jbd2: do not try to recover wiped journal
  - bpf: Return prog btf_id without capable check
  - vfio/pci: Handle INTx IRQ_NOTCONNECTED
  - scsi: st: ERASE does not change tape location
  - scsi: st: Tighten the page format heuristics with MODE SELECT
  - hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure
  - ext4: reorder capability check last
  - um: Update min_low_pfn to match changes in uml_reserved
  - um: Store full CSGSFS and SS register from mcontext
  - dlm: make tcp still work in multi-link env
  - i3c: master: svc: Fix missing STOP for master request
  - drm/amd/display: Guard against setting dispclk low for dcn31x
  - btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
  - btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work()
  - btrfs: fix non-empty delayed iputs list on unmount due to async workers
  - btrfs: run btrfs_error_commit_super() early
  - btrfs: avoid linker error in btrfs_find_create_tree_block()
  - btrfs: make btrfs_discard_workfn() block_group ref explicit
  - i2c: pxa: fix call balance of i2c->clk handling routines
  - i2c: qup: Vote for interconnect bandwidth to DRAM
  - x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP
  - wifi: mt76: mt7996: revise TXS size
  - wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2
  - mmc: host: Wait for Vdd to settle on card power off
  - ext4: on a remount, only log the ro or r/w state when it has changed
  - PCI: vmd: Disable MSI remapping bypass under Xen
  - pNFS/flexfiles: Report ENETDOWN as a connection error
  - tools/build: Don't pass test log files to linker
  - PCI: dwc: ep: Ensure proper iteration over outbound map windows
  - objtool: Properly disable uaccess validation
  - lockdep: Fix wait context check on softirq for PREEMPT_RT
  - dql: Fix dql->limit value when reset.
  - thermal/drivers/qoriq: Power down TMU on system suspend
  - SUNRPC: rpcbind should never reset the port to the value '0'
  - SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
  - NFSv4: Treat ENETUNREACH errors as fatal for state recovery
  - cifs: Fix establishing NetBIOS session for SMB2+ connection
  - cifs: add validation check for the fields in smb_aces
  - fbdev: core: tileblit: Implement missing margin clearing for tileblit
  - fbcon: Use correct erase colour for clearing in fbcon
  - fbdev: fsl-diu-fb: add missing device_remove_file()
  - riscv: Allow NOMMU kernels to access all of RAM
  - mailbox: use error ret code of of_parse_phandle_with_args()
  - ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list
  - tracing: Mark binary printing functions with __printf() attribute
  - SUNRPC: Don't allow waiting for exiting tasks
  - NFS: Don't allow waiting for exiting tasks
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked()
  - fuse: Return EPERM rather than ENOSYS from link()
  - cifs: Fix negotiate retry functionality
  - cifs: Fix querying and creating MF symlinks over SMB1
  - cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES
  - s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log
  - kconfig: merge_config: use an empty file as initfile
  - samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora
  - bpf: fix possible endless loop in BPF map iteration
  - selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure
  - drm/amdgpu: Allow P2P access through XGMI
  - ima: process_measurement() needlessly takes inode_lock() on MAY_READ
  - net: enetc: refactor bulk flipping of RX buffers to separate function
  - scsi: mpi3mr: Add level check to control event logging
  - cgroup: Fix compilation issue due to cgroup_mutex not being exported
  - dma-mapping: avoid potential unused data compilation warning
  - intel_th: avoid using deprecated page->mapping, index fields
  - scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices
  - nvmem: qfprom: switch to 4-byte aligned reads
  - nvmem: core: update raw_len if the bit reading is required
  - nvmem: core: verify cell's raw_len
  - nvmem: rockchip-otp: add rk3576 variant data
  - nvmem: rockchip-otp: Move read-offset into variant-data
  - cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist
  - phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
  - phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data
  - phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
  - phy: renesas: rcar-gen3-usb2: Add support to initialize the bus
  - i2c: designware: Fix an error handling path in i2c_dw_pci_probe()
  - i2c: designware: Use temporary variable for struct device
  - i2c: designware: Remove ->disable() callback
  - i2c: designware: Uniform initialization flow for polling mode
  - gpio: pca953x: fix IRQ storm on system wake up
  - gpio: pca953x: Simplify code with cleanup helpers
  - gpio: pca953x: Split pca953x_restore_context() and pca953x_save_context()
  - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
  - xsched: Add XSched manual
  - x86/sev: merge continuous pages into a large range when notifying range enc status changes
  - cifs: parse_dfs_referrals: prevent oob on malformed input
  - smb: client: fix return value of parse_dfs_referrals()
  - smb: client: Fix refcount leak for cifs_sb_tlink
  - ceph: fix race condition validating r_parent before applying state
  - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
  - NFSv4: Don't clear capabilities that won't be reset
  - NFS: Fix the setting of capabilities when automounting a new filesystem
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
  - smb3: fix for slab out of bounds on mount to ksmbd
  - smb: client: fix potential deadlock when reconnecting channels
  - smb: client: add NULL check in automount_fullpath
  - smb: client: Avoid race in open_cached_dir with lease breaks
  - ub: cdma: jfs 64K page table memory adaptation
  - ub: cdma: ELR code refactoring
  - ub: cdma: add some log print
  - net/mdiobus: Fix potential out-of-bounds read/write access
  - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
  - net: phy: clear phydev->devlink when the link is deleted
  - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
  - drm/sysfb: Do not dereference NULL pointer in plane reset
  - binfmt_misc: restore write access before closing files opened by open_exec()
  - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
  - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
  - perf/x86/intel/cstate: Add Clearwater Forest support
  - perf/x86/intel/cstate: Add pkg C2 residency counter for Sierra Forest
  - perf/x86/intel: Add missing MODULE_DESCRIPTION() lines
  - perf/x86/intel/cstate: Switch to new Intel CPU model defines
  - irqchip/gic-v4.1: Use local 4_1 ITS to generate VSGI
  - ext4: fix e4b bitmap inconsistency reports
  - x86/csv: Enhance CMA memory usage reporting for CSV3
  - smb: client: fix incomplete backport in cfids_invalidation_worker()
  - smb: client: fix potential UAF in smb2_close_cached_fid()
  - smb: client: fix memory leak in cifs_construct_tcon()
  - cifs: fix memory leak in smb3_fs_context_parse_param error path
  - smb: client: fix potential cfid UAF in smb2_query_info_compound
  - cifs: client: fix memory leak in smb3_fs_context_parse_param
  - net: netpoll: fix incorrect refcount handling causing incorrect cleanup
  - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
  - net: ipv6: fix field-spanning memcpy warning in AH output
  - Fix SDEI state machine issue during reboot process
  - Add sdei interface to check event status
  - proc: fix type confusion in pde_set_flags()
  - proc: fix missing pde_set_flags() for net proc files
  - udp_tunnel: use netdev_warn() instead of netdev_WARN()
  - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
  - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead
  - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
  - net/mlx5: Clean up only new IRQ glue on request_irq() failure
  - Bluetooth: MGMT: cancel mesh send timer when hdev removed
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
  - nbd: defer config unlock in nbd_genl_connect
  - nbd: defer config put in recv_work
  - md: fix rcu protection in md_wakeup_thread
  - nvme-multipath: fix lockdep WARN due to partition scan work
  - blk-cgroup: fix possible deadlock while configuring policy
  - usbnet: Prevents free active kevent
  - scsi: sg: Do not sleep in atomic context
  - ima: Handle error code returned by ima_filter_rule_match()
  - erofs: avoid infinite loops due to corrupted subpage compact indexes
  - scsi: bfa: Double-free fix
  - mISDN: hfcpci: Fix warning when deleting uninitialized timer
  - jfs: truncate good inode pages when hard link is 0
  - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
  - hfsplus: remove mutex_lock check in hfsplus_free_extents
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
  - mm/khugepaged: use KMEM_CACHE()
  - mm/ksm: cleanup mm_slot_entry() invocation
  - mm/khugepaged: remove definition of struct khugepaged_mm_slot
  - mm/ksm: get mm_slot by mm_slot_entry() when slot is !NULL
  - mm/khugepaged: use list_xxx() helper to improve readability
  - khugepaged: simplify the allocation of slab caches
  - mm/khugepaged: fix comment for default scan sleep duration
  - NFSD: free copynotify stateid in nfs4_free_ol_stateid()
  - NFSD: fix race between nfsd registration and exports_proc
  - ksmbd: fix refcount leak causing resource not released
  - NFSD: Define a proc_layoutcommit for the FlexFiles layout type
  - platform/x86: intel-uncore-freq: fix all header kernel-doc warnings
  - platform/x86/intel: power-domains: Fix error code in tpmi_init()
  - platform/x86/intel-uncore-freq: Present unique domain ID per package
  - platform/x86/intel-uncore-freq: Fix warning in partitioned system
  - platform/x86/intel-uncore-freq: avoid non-literal format string
  - Documentation: admin-guide: pm: Add documentation for die_id
  - platform/x86/intel-uncore-freq: Add attributes to show die_id
  - platform/x86/intel: power-domains: Add interface to get Linux die ID
  - Documentation: admin-guide: pm: Add documentation for agent_types
  - platform/x86/intel-uncore-freq: Add attributes to show agent types
  - mptcp: Fix proto fallback detection with BPF
  - memcg: enable asynchronous reclaim for cgroup-v2
  - memcg: change CONFIG_MEMCG_V1_RECLAIM to CONFIG_MEMCG_QOS
  - x86/kvm: expose CPUID 0xC000_0000 for Zhaoxin "Shanghai" vendor
  - perf mem/c2c: Add load store event mapping for Hygon


author: Li Nan <linan122@huawei.com> - 6.6.0-137.0.0.118
changelog:
  - !20552 ub: udma: fix some code issues.
  - !20313 Fix CVE-2025-40220
  - !20321  nvme: fix admin request_queue lifetime
  - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling
  - !20544 Fix CVE-2025-71147
  - !20548 v4  net: LTS-6.6 backport
  - !20503 Fix CVE-2025-39713
  - !20133 Fix CVE-2025-39721
  - !20438 Fix CVE-2025-38659
  - !20264 Fix CVE-2025-40277
  - !20340 Fix CVE-2025-40271
  - !20319 Fix CVE-2025-40237
  - !20392  vfs: Don't leak disconnected dentries on umount
  - !20554  iommu/s390: Implement blocking domain
  - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches
  - !20513 ACPI: PCC: Fix race condition by removing static qualifier
  - !20468  drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
  - !20483  rcu: Protect ->defer_qs_iw_pending from data race
  - !20510 drivers/ub/sentry: fix primary eid index value
  - !20553 ub: cdma: support separated page table feature
  - ub: udma: fix some code issues.
  - !20480 iommu/ummu-core: fix error invalidate tid
  - !20561 iommu/ummu: Add ummu sva independent page table parameter
  - ub: udma: bugfix related to 2m_hugepage.
  - ub: udma: support for separate page tables
  - ub: udma: delete debugfs code.
  - ub: udma: bugfix related to ctrlq function.
  - ub: udma: verify get cqe/ae aux info out addr and len.
  - ub: cdma: support separated page table feature
  - iommu/ummu: Add ummu sva independent page table parameter
  - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant'
  - !20505 Fix CVE-2026-23035
  - iommu/s390: Implement blocking domain
  - drivers/ub/sentry: fix primary eid index value
  - !20535  libceph: make decode_pool() more resilient against corrupted osdmaps
  - !20536  mm/page_alloc: change all pageblocks migrate type on coalescing
  - !20537  mm/secretmem: fix use-after-free race in fault handler
  - !20538  wifi: avoid kernel-infoleak from struct iw_point
  - !20539  net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
  - !20440  PCI/AER: Fix NULL pointer access by aer_info
  - !20262 Fix CVE-2025-68176
  - netfilter: nf_reject: don't leak dst refcount for loopback packets
  - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
  - page_pool: always add GFP_NOWARN for ATOMIC allocations
  - virtio-net: fix received length check in big packets
  - net: bridge: fix use-after-free due to MST port state bypass
  - vsock: Ignore signal/timeout on connect() if already established
  - tls: make sure to abort the stream if headers are bogus
  - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
  - xfrm: Duplicate SPI Handling
  - tls: handle data disappearing from under the TLS ULP
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush()
  - KEYS: trusted: Fix a memory leak in tpm2_load_cmd
  - !20237 Fix CVE-2025-68724
  - !20459 Fix CVE-2025-71131
  - !20525 Fix CVE-2025-68816
  - !20529  CVE-2025-68172
  - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
  - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback""
  - wifi: avoid kernel-infoleak from struct iw_point
  - mm/secretmem: fix use-after-free race in fault handler
  - mm/page_alloc: change all pageblocks migrate type on coalescing
  - libceph: make decode_pool() more resilient against corrupted osdmaps
  - pps: Fix kabi breakage of struct pps_device for last_fetched_ev
  - sched: Fix kabi breakage of struct task_struct for saved_state
  - crypto: aspeed - fix double free caused by devm
  - !20515  Bluetooth: bcsp: receive data only if registered
  - !20507 Fix CVE-2025-40358
  - !20450 ub: ubase&unic: Fix some bug in concurrent process
  - !20452 iommu/ummu: Fix some bugs and optimize the code implementation
  - !20451 iommu/ummu: Add the function of creating devices with SVA-separated
  - !20500 mm: fix the inaccurate memory statistics issue for users
  - net/mlx5: fw_tracer, Validate format string parameters
  - Bluetooth: bcsp: receive data only if registered
  - ACPI: PCC: Fix race condition by removing static qualifier
  - ACPI: CPPC: Fix missing PCC check for guaranteed_perf
  - iommu/ummu: Add the function of creating devices with SVA-separated
  - iommu/ummu-core: fix error invalidate tid
  - riscv: stacktrace: Disable KASAN checks for non-current tasks
  - !20497  arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
  - !20496  drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
  - !20495  iommu/amd: Avoid stack buffer overflow from kernel cmdline
  - !20494  HID: core: Harden s32ton() against conversion to 0 bits
  - !20493  iommu: Fix two issues in iommu_copy_struct_from_user()
  - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
  - PM / devfreq: hisi: Fix potential UAF in OPP handling
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
  - !20487  interference: Fix uninitialized ifs_clock compiling issue
  - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
  - MIPS: mm: Prevent a TLB shutdown on initial uniquification
  - mm: fix the inaccurate memory statistics issue for users
  - mm: add config option for atomic mode in mm counter
  - Revert "mm: fix the inaccurate memory statistics issue for users"
  - !20444  net/mlx5e: Fix crash on profile change rollback failure
  - !20442  net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
  - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
  - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
  - iommu/amd: Avoid stack buffer overflow from kernel cmdline
  - HID: core: Harden s32ton() against conversion to 0 bits
  - iommu: Fix two issues in iommu_copy_struct_from_user()
  - SUNRPC: call xs_sock_process_cmsg for all cmsg
  - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
  - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO.
  - !20227  Rename leapioraid to leapraid and release v2.0
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init
  - x86/fpu: Delay instruction pointer fixup until after warning
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
  - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
  - x86/sev: Evict cache lines during SNP memory validation
  - net: usbnet: Fix the wrong netif_carrier_on() call
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
  - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
  - sched,freezer: Remove unnecessary warning in __thaw_task
  - freezer,sched: Clean saved_state when restoring it during thaw
  - freezer,sched: Do not restore saved_state of a thawed task
  - freezer,sched: Use saved_state to reduce some spurious wakeups
  - sched/core: Remove ifdeffery for saved_state
  - i2c: stm32f7: unmap DMA mapped buffer
  - i2c: stm32f7: simplify status messages in case of errors
  - i2c: stm32f7: perform most of irq job in threaded handler
  - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq
  - i2c: stm32f7: Use devm_clk_get_enabled()
  - USB: serial: option: add Foxconn T99W709
  - smb: server: Fix extension string in ksmbd_extract_shortname()
  - ksmbd: fix corrupted mtime and ctime in smb2_open
  - ksmbd: fix Preauh_HashValue race condition
  - ksmbd: fix null pointer dereference error in generate_encryptionkey
  - vsock: Do not allow binding to VMADDR_PORT_ANY
  - selftests/perf_events: Add a mmap() correctness test
  - smb: client: return an error if rdma_connect does not return within 5 seconds
  - smb: client: let recv_done() cleanup before notifying the callers.
  - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
  - smb: client: make use of common smbdirect_socket
  - smb: smbdirect: add smbdirect_socket.h
  - smb: client: Correct typos in multiple comments across various files
  - smb: client: Use min() macro
  - smb: server: let recv_done() avoid touching data_transfer after cleanup/move
  - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
  - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
  - irqchip: Build IMX_MU_MSI only on ARM
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
  - sunrpc: fix client side handling of tls alerts
  - net/sched: taprio: enforce minimum value for picos_per_byte
  - net: drop UFO packets in udp_rcv_segment()
  - ipv6: reject malicious packets in ipv6_gso_segment()
  - net/mlx5: Correctly set gso_segs when LRO is used
  - netlink: specs: ethtool: fix module EEPROM input/output arguments
  - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
  - phy: mscc: Fix parsing of unicast frames
  - netpoll: prevent hanging NAPI when netcons gets enabled
  - md/md-cluster: handle REMOVE message earlier
  - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
  - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
  - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up()
  - pNFS/flexfiles: don't attempt pnfs on fatal DS errors
  - PCI: pnv_php: Fix surprise plug detection and recovery
  - powerpc/eeh: Export eeh_unfreeze_pe()
  - PCI: pnv_php: Work around switches with broken presence detection
  - kconfig: qconf: fix ConfigList::updateListAllforAll()
  - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
  - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume
  - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
  - scsi: mpt3sas: Fix a fw_event memory leak
  - vfio/pci: Separate SR-IOV VF dev_set
  - vfio/pds: Fix missing detach_ioas op
  - vfio: Prevent open_count decrement to negative
  - vfio: Fix unbalanced vfio_df_close call in no-iommu mode
  - f2fs: fix to calculate dirty data during has_not_enough_free_secs()
  - f2fs: fix to update upper_p in __get_secs_required() correctly
  - f2fs: vm_unmap_ram() may be called from an invalid context
  - f2fs: fix to avoid out-of-boundary access in devs.path
  - f2fs: doc: fix wrong quota mount option description
  - f2fs: fix KMSAN uninit-value in extent_info usage
  - rtc: rv3028: fix incorrect maximum clock rate handling
  - rtc: pcf8563: fix incorrect maximum clock rate handling
  - rtc: pcf85063: fix incorrect maximum clock rate handling
  - rtc: nct3018y: fix incorrect maximum clock rate handling
  - rtc: hym8563: fix incorrect maximum clock rate handling
  - rtc: ds1307: fix incorrect maximum clock rate handling
  - ucount: fix atomic_long_inc_below() argument type
  - module: Restore the moduleparam prefix length check
  - apparmor: fix loop detection used in conflicting attachment resolution
  - apparmor: ensure WB_HISTORY_SIZE value is a power of 2
  - bpf: Check netfilter ctx accesses are aligned
  - bpf: Check flow_dissector ctx accesses are aligned
  - vhost-scsi: Fix log flooding with target does not exist errors
  - mtd: rawnand: atmel: set pmecc data setup time
  - mtd: rawnand: rockchip: Add missing check after DMA map
  - mtd: rawnand: atmel: Fix dma_mapping_error() address
  - jfs: fix metapage reference count leak in dbAllocCtl
  - crypto: qat - fix seq_file position update in adf_ring_next()
  - crypto: qat - fix DMA direction for compression on GEN2 devices
  - perf tools: Remove libtraceevent in .gitignore
  - sh: Do not use hyphen in exported variable name
  - ASoC: fsl_xcvr: get channel status data when PHY is not exists
  - dmaengine: nbpfaxi: Add missing check after DMA map
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
  - fs/orangefs: Allow 2 more characters in do_c_string()
  - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
  - soundwire: stream: restore params when prepare ports fail
  - crypto: img-hash - Fix dma_unmap_sg() nents value
  - crypto: keembay - Fix dma_unmap_sg() nents value
  - hwrng: mtk - handle devm_pm_runtime_enable errors
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
  - scsi: isci: Fix dma_unmap_sg() nents value
  - scsi: mvsas: Fix dma_unmap_sg() nents value
  - scsi: elx: efct: Fix dma_unmap_sg() nents value
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
  - clk: sunxi-ng: v3s: Fix de clock definition
  - perf tests bp_account: Fix leaked file descriptor
  - kernel: trace: preemptirq_delay_test: use offstack cpu mask
  - crypto: inside-secure - Fix `dma_unmap_sg()` nents value
  - perf sched: Fix memory leaks in 'perf sched latency'
  - perf sched: Fix memory leaks for evsel->priv in timehist
  - perf sched: Free thread->priv using priv_destructor
  - perf dso: Add missed dso__put to dso__load_kcore
  - perf tools: Fix use-after-free in help_unknown_cmd()
  - Fix dma_unmap_sg() nents value
  - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
  - fanotify: sanitize handle_type values when reporting fid
  - pinctrl: sunxi: Fix memory leak on krealloc failure
  - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails
  - crypto: arm/aes-neonbs - work around gcc-15 warning
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
  - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
  - clk: xilinx: vcu: unregister pll_post only if registered correctly
  - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
  - mtd: fix possible integer overflow in erase_xfer()
  - crypto: marvell/cesa - Fix engine load inaccuracy
  - crypto: qat - use unmanaged allocation for dc_data
  - crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
  - PCI: rockchip-host: Fix "Unexpected Completion" log message
  - bpf/preload: Don't select USERMODE_DRIVER
  - ipv6: annotate data-races around rt->fib6_nsiblings
  - ipv6: fix possible infinite loop in fib6_info_uses_dev()
  - vrf: Drop existing dst reference in vrf_ip6_input_dst
  - selftests: rtnetlink.sh: remove esp4_offload after test
  - net/mlx5e: Clear Read-Only port buffer size in PBMC before update
  - netfilter: xt_nfacct: don't assume acct name is null-terminated
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index
  - can: kvaser_pciefd: Store device channel index
  - can: peak_usb: fix USB FD devices potential malfunction
  - tools/rv: Do not skip idle in trace
  - Bluetooth: hci_event: Mask data status from LE ext adv reports
  - kcsan: test: Initialize dummy variable
  - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
  - wifi: ath12k: fix endianness handling while accessing wmi service bit
  - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key()
  - wifi: mac80211: Don't call fq_flow_idx() for management frames
  - wifi: mac80211: Do not schedule stopped TXQs
  - wifi: plfxlc: Fix error handling in usb driver probe
  - wifi: mac80211: reject TDLS operations when station is not associated
  - iommu/amd: Fix geometry.aperture_end for V2 tables
  - mwl8k: Add missing check after DMA map
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
  - tcp: call tcp_measure_rcv_mss() for ooo packets
  - xen/gntdev: remove struct gntdev_copy_batch from stack
  - net_sched: act_ctinfo: use atomic64_t for three counters
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree
  - um: rtc: Avoid shadowing err in uml_rtc_start()
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
  - netfilter: nf_tables: adjust lockdep assertions handling
  - netfilter: nf_tables: Drop dead code from fill_*_info routines
  - fbcon: Fix outdated registered_fb reference in comment
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
  - m68k: Don't unregister boot console needlessly
  - drm/msm/dpu: Fill in min_prefill_lines for SC8180X
  - kselftest/arm64: Fix check for setting new VLs in sve-ptrace
  - net: dst: annotate data-races around dst->input
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
  - wifi: ath11k: clear initialized flag for deinit-ed srng lists
  - iwlwifi: Add missing check for alloc_ordered_workqueue
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
  - wifi: rtl818x: Kill URBs before clearing tx status queue
  - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band
  - caif: reduce stack size, again
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
  - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
  - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
  - selftests/bpf: fix signedness bug in redir_partial()
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
  - bpf, sockmap: Fix psock incorrectly pointing to sk
  - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
  - staging: nvec: Fix incorrect null termination of battery manufacturer
  - interconnect: qcom: sc8180x: specify num_nodes
  - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
  - soc: qcom: pmic_glink: fix OF node leak
  - samples: mei: Fix building on musl libc
  - cpufreq: Initialize cpufreq-based frequency-invariance later
  - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
  - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
  - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
  - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
  - arm: dts: ti: omap: Fixup pinheader typo
  - usb: early: xhci-dbc: Fix early_ioremap leak
  - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
  - pps: fix poll support
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
  - spi: stm32: Check for cfg availability in stm32_spi_probe
  - usb: misc: apple-mfi-fastcharge: Make power supply names unique
  - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe()
  - ARM: dts: vfxxx: Correctly use two tuples for timer address
  - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
  - arm64: dts: qcom: sc7180: Expand IMEM region
  - arm64: dts: qcom: sdm845: Expand IMEM region
  - soc: qcom: QMI encoding/decoding for big endian
  - selftests: Fix errno checking in syscall_user_dispatch test
  - ASoC: mediatek: use reserved memory or enable buffer pre-allocation
  - gfs2: No more self recovery
  - Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
  - hfs: make splice write available again
  - hfsplus: make splice write available again
  - ublk: use vmalloc for ublk_device's __queues
  - fs_context: fix parameter name in infofc() macro
  - audit,module: restore audit logging in load failure case
  - ASoC: amd: yc: add DMI quirk for ASUS M6501RM
  - ASoC: Intel: fix SND_SOC_SOF dependencies
  - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
  - ethernet: intel: fix building with large NR_CPUS
  - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
  - interference: Fix uninitialized ifs_clock compiling issue
  - iommu/ummu: optimize log printing
  - !20455 Fix compilation failure caused by PR#20174
  - !20302  CVE-2026-22980
  - !20142  CVE-2025-68803
  - !20261  ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
  - !20435  fix CVE-2026-22998
  - !20433  scsi: target: Reset t_task_cdb pointer in error case
  - !20432  scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
  - !20431  block: Use RCU in blk_mq_[un
  - !20307  tpm: Cap the number of PCR banks
  - !20062  xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read
  - !20157 v2  md: backport from mainline
  - rcu: Protect ->defer_qs_iw_pending from data race
  - platform/x86/intel/pmt: fix compilation failure caused by PR#20174
  - iommu/ummu: optimize kv cache memory management
  - iommu/ummu: optimize permission table management
  - iommu/ummu: remove check for eid_type while del eid
  - iommu/ummu: optimize the code implementation
  - drivers/perf: fix ummu-pmu data reading exception
  - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct
  - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
  - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
  - net: unic: Notify mami of the bond ip change.
  - ub: ubase: Support for UE link by ctrlq message
  - ub: ubase: send a deactivate req in removing
  - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode.
  - ub: ubase: Use an independent thread for the ctrlq workqueue.
  - !20368 ubcore: fix logging and permission for route query.
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
  - !20344  ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
  - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios
  - ub: ubase: Add KABI compatibility
  - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration
  - ub: ubase: add PMU IDEV interrupt supported abilities.
  - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context
  - ub: ubase: Set the completion event interrupt to auto
  - net: unic: fix poll tx read old skb cause a UAF bug
  - !20249 Fix CVE-2025-38489
  - !20250 Fix CVE-2025-38480
  - !20378 Fix CVE-2025-39838
  - !20430  Fix CVE-2025-39942
  - !20351 Fix CVE-2025-71149
  - !20375 Fix CVE-2025-71150
  - !20323 Fix CVE-2025-38730
  - !20320 Fix CVE-2025-68814
  - !20314 Fix CVE-2025-71072
  - !20315 Fix CVE-2025-68794
  - !20403  bpf: Check skb->transport_header is set in bpf_skb_check_mtu
  - !20402  bpf: Do not let BPF test infra emit invalid GSO types to stack
  - !20401  tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
  - !20400  netfilter: nft_ct: add seqadj extension for natted connections
  - !20399  net: xfrm: Fix CVE-2025-40215
  - !20398  net/sched: sch_qfq: Fix null-deref in agg_dequeue
  - !20397  bpf: Reject narrower access to pointer ctx fields
  - !20396  Bluetooth: eir: Fix possible crashes on eir_create_adv_data
  - !20394  IB/mlx5: Fix potential deadlock in MR deregistration
  - !20367 ub: cdma: cdma uaf bugfix
  - net/mlx5e: Fix crash on profile change rollback failure
  - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
  - PCI/AER: Fix NULL pointer access by aer_info
  - gfs2: No more self recovery
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
  - crypto: qat - flush misc workqueue during device shutdown
  - !20174 Backport PMT spec 3.0 support
  - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts
  - !19814 [OLK-6.6] Batch flushing user memory encrytion status change
  - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
  - nvmet-tcp: remove boilerplate code
  - scsi: target: Reset t_task_cdb pointer in error case
  - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
  - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock
  - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
  - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
  - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection
  - smb: server: remove separate empty_recvmsg_queue
  - !20384 ub:ubus: Fix ubus link message and pool device error
  - !20389  gfs2: Prevent recursive memory reclaim
  - !20388  *** fix CVE-2025-38062 ***
  - !20387  KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
  - !20386  pinctrl: check the return value of pinmux_ops::get_function_name()
  - !20385  iommu/amd/pgtbl: Fix possible race while increase page table level
  - ub:ubus: Not cfg access during surprise down
  - ub:hisi-ubus: Delete validate_pa err print
  - PCI: cadence: Check for the existence of cdns_pcie::ops before using it
  - can: netlink: can_changelink(): allow disabling of automatic restart
  - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test"
  - drm/sched: Remove optimization that causes hang when killing dependent jobs
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
  - bpf: Check skb->transport_header is set in bpf_skb_check_mtu
  - bpf: Do not let BPF test infra emit invalid GSO types to stack
  - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
  - netfilter: nft_ct: add seqadj extension for natted connections
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
  - xfrm: delete x->tunnel as we delete x
  - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation.
  - net/sched: sch_qfq: Fix null-deref in agg_dequeue
  - bpf: Reject narrower access to pointer ctx fields
  - Bluetooth: eir: Fix possible crashes on eir_create_adv_data
  - IB/mlx5: Fix potential deadlock in MR deregistration
  - ub:ubus: Fix ubus link message and pool device error
  - ub:hisi-ubus: cq poller maximum handle 64 cqe per time
  - ub:hisi-ubus:Fix vdm message print error
  - ub:ubus:Fix ubus interrupt release issue
  - wifi: mt76: mt7921: prevent decap offload config before STA initialization
  - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec()
  - iio: hid-sensor-prox: Restore lost scale assignments
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation
  - crypto: powerpc/poly1305 - add depends on BROKEN for now
  - erofs: address D-cache aliasing
  - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
  - ALSA: hda: Add missing NVIDIA HDA codec IDs
  - ALSA: hda/tegra: Add Tegra264 support
  - comedi: comedi_test: Fix possible deletion of uninitialized timers
  - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach
  - usb: typec: tcpm: allow switching to mode accessory to mux properly
  - usb: typec: tcpm: allow to use sink in accessory mode
  - drm/amdkfd: Don't call mmput from MMU notifier callback
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
  - selftests: mptcp: connect: also cover checksum
  - selftests: mptcp: connect: also cover alt modes
  - resource: fix false warning in __request_region()
  - gve: Fix stuck TX queue for DQ queue format
  - e1000e: ignore uninitialized checksum word on tgp
  - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
  - dpaa2-switch: Fix device reference count leak in MAC endpoint handling
  - dpaa2-eth: Fix device reference count leak in MAC endpoint handling
  - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
  - sprintf.h requires stdarg.h
  - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint()
  - i2c: virtio: Avoid hang by using interruptible completion wait
  - i2c: tegra: Fix reset error handling with ACPI
  - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots
  - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
  - can: dev: can_restart(): move debug message and stats after successful restart
  - can: dev: can_restart(): reverse logic to remove need for goto
  - i40e: When removing VF MAC filters, only check PF-set MAC
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards
  - i40e: Add rx_missed_errors for buffer exhaustion
  - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
  - net/mlx5: Fix memory leak in cmd_exec()
  - staging: vchiq_arm: Make vchiq_shutdown never fail
  - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
  - regmap: fix potential memory leak of regmap_bus
  - iio: adc: ad7949: use spi_is_bpw_supported()
  - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node
  - RDMA/core: Rate limit GID cache warning messages
  - virtio_ring: Fix error reporting in virtqueue_resize
  - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches
  - !20346  tracing: Fix crash on synthetic stacktrace field usage
  - vfs: Don't leak disconnected dentries on umount
  - !20334 Fix CVE-2025-68780
  - gfs2: Prevent recursive memory reclaim
  - amd/amdkfd: enhance kfd process check in switch partition
  - drm/amdkfd: allow compute partition mode switch with cgroup exclusions
  - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
  - pinctrl: check the return value of pinmux_ops::get_function_name()
  - iommu/amd/pgtbl: Fix possible race while increase page table level
  - !19966  nvme-fc: use lock accessing port_state and rport state
  - ASoC: fsl_sai: replace regmap_write with regmap_update_bits
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  - cifs: prevent NULL pointer dereference in UTF16 conversion
  - ksmbd: Fix refcount leak when invalid session is found on session lookup
  - ubcore: fix logging and permission for route query.
  - !20232 driver/coda: VirtCCA supports MSI device DA
  - Revert "Revert "RDMA/hns: Fix mismatch exception rollback""
  - !20197 ub: udma&ubase: fix a bug that caused long reboot time
  - x86: Resolve FPU state corruption between atomic and non-atomic contexts
  - ub: cdma: cdma uaf bugfix
  - ub: cdma: jfs call trace bugfix
  - !20353  x86/fpu: Clear XSTATE_BV[i
  - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
  - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls
  - nvmem: layouts: u-boot-env: remove crc32 endianness conversion
  - i2c: omap: fix deprecated of_property_read_bool() use
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode
  - regulator: pwm-regulator: Manage boot-on with disabled PWM channels
  - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs
  - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
  - i2c: omap: Fix an error handling path in omap_i2c_probe()
  - i2c: omap: Add support for setting mux
  - usb: dwc3: qcom: Don't leave BCR asserted
  - usb: hub: Don't try to recover devices lost during warm reset.
  - usb: hub: Fix flushing of delayed work used for post resume purposes
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs
  - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented
  - ipv6: make addrconf_wq single threaded
  - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling
  - sched/deadline: only set free_cpus for online runqueues
  - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling
  - io_uring/poll: correctly handle io_poll_add() return value on update
  - shmem: fix recovery on rename failures
  - io_uring: fix filename leak in __io_openat_prep()
  - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
  - rxrpc: Fix transmission of an abort in response to an abort
  - rxrpc: Fix recv-recv race of completed call
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
  - net: bridge: Do not offload IGMP/MLD messages
  - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
  - net/mlx5: Correctly set gso_size when LRO is used
  - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
  - Bluetooth: SMP: If an unallowed command is received consider it a failure
  - Bluetooth: hci_sync: fix connectable extended advertising when using static random address
  - hwmon: (corsair-cpro) Validate the size of the received input buffer
  - selftests: net: increase inter-packet timeout in udpgro.sh
  - wifi: cfg80211: remove scan request n_channels counted_by
  - nvme: fix misaccounting of nvme-mpath inflight I/O
  - net: phy: Don't register LEDs for genphy
  - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
  - rpl: Fix use-after-free in rpl_do_srh_inline().
  - block: fix kobject leak in blk_unregister_queue
  - net: emaclite: Fix missing pointer increment in aligned_read()
  - soundwire: amd: fix for clearing command status register
  - soundwire: amd: fix for handling slave alerts after link is down
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  - comedi: Fix some signed shift left operations
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
  - comedi: das6402: Fix bit shift out of bounds
  - comedi: das16m1: Fix bit shift out of bounds
  - comedi: aio_iiro_16: Fix bit shift out of bounds
  - comedi: pcl812: Fix bit shift out of bounds
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler
  - iio: adc: max1363: Reorder mode_list[] entries
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
  - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order
  - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
  - net: libwx: properly reset Rx ring descriptor
  - net: libwx: remove duplicate page_pool_put_full_page()
  - mmc: sdhci_am654: Workaround for Errata i2312
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
  - mmc: bcm2835: Fix dma_unmap_sg() nents value
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
  - isofs: Verify inode mode when loading from disk
  - dmaengine: nbpfaxi: Fix memory corruption in probe()
  - af_packet: fix soft lockup issue caused by tpacket_snd()
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
  - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck
  - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
  - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
  - net/mlx5: Update the list of the PCI supported devices
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
  - io_uring/poll: fix POLLERR handling
  - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
  - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
  - tracing/osnoise: Fix crash in timerlat_dump_stack()
  - spi: Add check for 8-bit transfer with 8 IO mode support
  - pch_uart: Fix dma_sync_sg_for_device() nents value
  - thunderbolt: Fix bit masking in tb_dp_port_set_hops()
  - i2c: stm32: fix the device used for the DMA map
  - tracing: Fix crash on synthetic stacktrace field usage
  - usb: musb: fix gadget state on disconnect
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
  - USB: serial: option: add Foxconn T99W640
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
  - phy: tegra: xusb: Disable periodic tracking on Tegra234
  - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode
  - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
  - fs/proc: fix uaf in proc_readdir_de()
  - io_uring/net: commit partial buffers on retry
  - nvme: fix admin request_queue lifetime
  - fs/notify: call exportfs_encode_fid with s_umount
  - iomap: adjust read range correctly for non-block-aligned positions
  - fuse: fix livelock in synchronous file put from fuseblk workers
  - tpm: Cap the number of PCR banks
  - nfsd: provide locking for v4_end_grace
  - Revert "nfsd: provide locking for v4_end_grace"
  - config: enable config for PMT discovery driver
  - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe
  - platform/x86/intel/pmt: Fix kobject memory leak on init failure
  - platform/x86/intel/pmt: fix a crashlog NULL pointer access
  - platform/x86/intel/pmt: fix build dependency for kunit test
  - platform/x86/intel/pmt/discovery: fix format string warning
  - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit
  - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API
  - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature
  - platform/x86/intel/pmt/discovery: Get telemetry attributes
  - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI
  - platform/x86/intel/vsec: Set OOBMSM to CPU mapping
  - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h
  - docs: Add ABI documentation for intel_pmt feature directories
  - platform/x86/intel/pmt: Add PMT Discovery driver
  - sysfs: Fix crash on empty group attributes array
  - sysfs: Introduce a mechanism to hide static attribute_groups
  - platform/x86/intel/vsec: Add new Discovery feature
  - platform/x86/intel/vsec: Skip driverless features
  - platform/x86/intel/vsec: Skip absent features during initialization
  - platform/x86/intel/vsec: Add device links to enforce dependencies
  - platform/x86/intel/vsec: Create wrapper to walk PCI config space
  - platform/x86/intel/vsec: Add private data for per-device data
  - MAINTAINERS: Add link to documentation of Intel PMT ABI
  - platform/x86/intel/pmt: allow user offset for PMT callbacks
  - driver/coda: VirtCCA supports MSI device DA
  - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
  - Rename leapioraid to leapraid and release v2.0
  - ub: udma: fix a bug that caused long reboot time.
  - ub: ubase: Accelerate when ctrl node is shutting down
  - platform/x86/intel/pmt: Use PMT callbacks
  - platform/x86/intel/vsec: Add PMT read callbacks
  - platform/x86/intel/vsec.h: Move to include/linux
  - md: prevent incorrect update of resync/recovery offset
  - md/raid1: Fix data corruption for degraded array with slow disk
  - md/raid1: set max_sectors during early return from choose_slow_rdev()
  - md-cluster: fix no recovery job when adding/re-adding a disk
  - md-cluster: fix hanging issue while a new disk adding
  - md/raid5: recheck if reshape has finished with device_lock held
  - md-cluster: Constify struct md_cluster_operations
  - md: Remove unneeded semicolon
  - md/raid5: fix spares errors about rcu usage
  - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume
  - md: pass in max_sectors for pers->sync_request()
  - md: factor out helpers for different sync_action in md_do_sync()
  - md: replace last_sync_action with new enum type
  - md: use new helpers in md_do_sync()
  - md: don't fail action_store() if sync_thread is not registered
  - md: remove parameter check_seq for stop_sync_thread()
  - md: replace sysfs api sync_action with new helpers
  - md: factor out helper to start reshape from action_store()
  - md: add new helpers for sync_action
  - md: add a new enum type sync_action
  - md: rearrange recovery_flags
  - md/raid0: don't free conf on raid0_run failure
  - md: make md_flush_request() more readable
  - md: change the return value type of md_write_start to void
  - md: Revert "md: Fix overflow in is_mddev_idle"
  - md: don't account sync_io if iostats of the disk is disabled
  - md: Fix overflow in is_mddev_idle
  - md: add check for sleepers in md_wakeup_thread()
  - md: add a mddev_is_dm helper
  - md: add a mddev_add_trace_msg helper
  - md: add a mddev_trace_remap helper
  - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape
  - dm-raid: add a new helper prepare_suspend() in md_personality
  - dm-raid: really frozen sync_thread during suspend
  - md: add a new helper reshape_interrupted()
  - md: export helper md_is_rdwr()
  - md: export helpers to stop sync_thread
  - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume
  - md/raid1: factor out helpers to choose the best rdev from read_balance()
  - md/raid1: factor out the code to manage sequential IO
  - md/raid1: factor out choose_bb_rdev() from read_balance()
  - md/raid1: factor out choose_slow_rdev() from read_balance()
  - md/raid1: factor out read_first_rdev() from read_balance()
  - md/raid1-10: factor out a new helper raid1_should_read_first()
  - md/raid1-10: add a helper raid1_check_read_range()
  - md/raid1: fix choose next idle in read_balance()
  - md/raid1: record nonrot rdevs while adding/removing rdevs to conf
  - md/raid1: factor out helpers to add rdev to conf
  - md: add a new helper rdev_has_badblock()
  - md: check mddev->pers before calling md_set_readonly()
  - md: clean up openers check in do_md_stop() and md_set_readonly()
  - md: sync blockdev before stopping raid or setting readonly
  - md: factor out a helper to sync mddev
  - md: return directly before setting did_set_md_closing
  - md: changed the switch of RAID_VERSION to if
  - md: merge the check of capabilities into md_ioctl_valid()
  - md: Don't suspend the array for interrupted reshape
  - md: Don't register sync_thread for reshape directly
  - md: Make sure md_do_sync() will set MD_RECOVERY_DONE
  - md: Don't ignore read-only array in md_check_recovery()
  - md: Don't ignore suspended array in md_check_recovery()
  - md: get rdev->mddev with READ_ONCE()
  - md: remove redundant md_wakeup_thread()
  - md: remove redundant check of 'mddev->sync_thread'
  - md: fix a suspicious RCU usage warning
  - raid: Remove now superfluous sentinel element from ctl_table array
  - NFSD: NFSv4 file creation neglects setting ACL
  - nfsd: set security label during create operations
  - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read
  - nvme-fc: use lock accessing port_state and rport state
  - x86/mm: Batch flushing user memory encrytion status change


author: Li Nan <linan122@huawei.com> - 6.6.0-138.0.0.119
changelog:
  - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3"
  - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3"
  - !20576  media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
  - !20575  RDMA/cm: Fix leaking the multicast GID table reference
  - !20580  RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
  - !20551  Fix CVE-2025-68785
  - !20478  f2fs: fix to avoid potential deadlock
  - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y
  - !20520 Fix CVE-2026-23038
  - !20424  net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
  - !20425  mlx5: Fix default values in create CQ
  - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
  - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
  - RDMA/cm: Fix leaking the multicast GID table reference
  - net: openvswitch: fix middle attribute validation in push_nsh() action
  - net: openvswitch: remove never-working support for setting nsh fields
  - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
  - bnxt_en: Fix potential data corruption with HW GRO/LRO
  - f2fs: fix to avoid potential deadlock
  - mlx5: Fix default values in create CQ
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup


author: Li Nan <linan122@huawei.com> - 6.6.0-139.0.0.120
changelog:
  - !20727 v2  bpf: sockmap fixes
  - !20741  scsi: qla2xxx: Sanitize payload size to prevent member overflow
  - !20744  fix CVE-2025-38449
  - !20763  net: usb: asix: validate PHY address before use
  - !20762  smc91x: fix broken irq-context in PREEMPT_RT
  - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors
  - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h
  - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h
  - !20245 KVM: arm64: Refactor exit handlers
  - !20246 KVM: arm64: Mark some header functions as inline
  - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS
  - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch
  - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors
  - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches
  - !20667  fix CVE-2024-50102
  - !20736  netfilter: nf_tables: remove redundant chain validation on register store
  - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition.
  - !20721 obmm: reduce log noise for successful export/import/preimport
  - net: usb: asix: validate PHY address before use
  - smc91x: fix broken irq-context in PREEMPT_RT
  - !20731  devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
  - !20732  libceph: return the handler error from mon_handle_auth_done()
  - !20743  mm: slub: avoid wake up kswapd in set_track_prepare
  - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition.
  - !20750 ub: cdma: adapted to UMMU interface changes
  - !20713 urma: DFX of log in kernel
  - urma: optimize log levels for kernel space
  - ub: cdma: adapted to UMMU interface changes
  - wifi: ath11k: avoid bit operation on key flags
  - drm/mediatek: fix potential OF node use-after-free
  - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes
  - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
  - !20708 ub:hisi-ubus: Add create bus instance ummu bypass
  - drm: fix kabi for struct drm_framebuffer
  - drm/framebuffer: Acquire internal references on GEM handles
  - drm/gem: Acquire references on GEM handles for framebuffers
  - mm: slub: avoid wake up kswapd in set_track_prepare
  - scsi: qla2xxx: Sanitize payload size to prevent member overflow
  - netfilter: nf_tables: remove redundant chain validation on register store
  - libceph: return the handler error from mon_handle_auth_done()
  - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
  - Documentation/hw-vuln: Add VMSCAPE documentation
  - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
  - riscv: use lw when reading int cpu in asm_per_cpu
  - mm: slub: avoid wake up kswapd in set_track_prepare
  - tools: gpio: remove the include directory on make clean
  - tools: gpio: rm .*.cmd on make clean
  - drm/amd/amdgpu: Fix missing error return on kzalloc failure
  - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c
  - perf bpf-event: Fix use-after-free in synthesis
  - drm/bridge: ti-sn65dsi86: fix REFCLK setting
  - spi: spi-fsl-lpspi: Clear status register after disabling the module
  - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
  - spi: spi-fsl-lpspi: Set correct chip-select polarity bit
  - spi: spi-fsl-lpspi: Fix transmissions when using CONT
  - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
  - pcmcia: omap: Add missing check for platform_get_resource
  - Revert "drm/amdgpu: Avoid extra evict-restore process."
  - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
  - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
  - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv
  - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm
  - drm/mediatek: Add crtc path enum for all_drm_priv array
  - vmxnet3: update MTU after device quiesce
  - net: dsa: microchip: linearize skb for tail-tagging switches
  - net: dsa: microchip: update tag_ksz masks for KSZ9477 family
  - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
  - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
  - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA
  - iio: pressure: mprls0025pa: use aligned_s64 for timestamp
  - iio: chemical: pms7003: use aligned_s64 for timestamp
  - iio: imu: inv_mpu6050: align buffer for timestamp
  - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold
  - nouveau: fix disabling the nonstall irq due to storm code
  - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
  - net: pcs: rzn1-miic: Correct MODCTRL register offset
  - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list
  - drm/amdgpu: drop hw access in non-DC audio fini
  - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
  - wifi: mwifiex: Initialize the chan_stats array to zero
  - tcp_bpf: Fix copied value in tcp_bpf_sendmsg
  - skmsg: Return copied bytes in sk_msg_memcopy_from_iter
  - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection
  - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap"
  - ALSA: usb-audio: Add mute TLV for playback volumes on some devices
  - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
  - selftest: net: Fix weird setsockopt() in bind_bhash.c.
  - net: atm: fix memory leak in atm_register_sysfs when device_register fail
  - ax25: properly unshare skbs in ax25_kiss_rcv()
  - mctp: return -ENOPROTOOPT for unknown getsockopt options
  - net/smc: Remove validation of reserved bits in CLC Decline message
  - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
  - net: thunder_bgx: decrement cleanup index before use
  - net: thunder_bgx: add a missing of_node_put
  - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
  - wifi: libertas: cap SSID len in lbs_associate()
  - wifi: cw1200: cap SSID length in cw1200_do_join()
  - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
  - wifi: ath11k: fix group data packet drops during rekey
  - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay()
  - wifi: ath11k: rename ath11k_start_vdev_delay()
  - wifi: ath11k: Introduce and use ath11k_sta_to_arsta()
  - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
  - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
  - netlink: add variable-length / auto integers
  - net: macb: Fix tx_ptr_lock locking
  - icmp: fix icmp_ndo_send address translation for reply direction
  - mISDN: Fix memory leak in dsp_hwec_enable()
  - xirc2ps_cs: fix register access when enabling FullDuplex
  - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
  - wifi: cfg80211: fix use-after-free in cmp_bss()
  - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC
  - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM
  - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
  - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
  - Bluetooth: hci_sync: Avoid adding default advertising on startup
  - cpupower: Fix a bug where the -t option of the set subcommand was not working.
  - drm/amd/display: Don't warn when missing DCE encoder caps
  - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
  - LoongArch: Save LBT before FPU in setup_sigcontext()
  - btrfs: avoid load/store tearing races when checking if an inode was logged
  - btrfs: fix race between setting last_dir_index_offset and inode logging
  - btrfs: fix race between logging inode and checking if it was logged before
  - bpf: Fix oob access in cgroup local storage
  - !20556 urma: fix update topo logic
  - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches
  - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers
  - !20560  *** fix CVE-2025-38062 ***
  - !20662  pNFS: Fix a deadlock when returning a delegation during open()
  - ub:hisi-ubus: Add create bus instance ummu bypass
  - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
  - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
  - HID: mcp2221: Handle reads greater than 60 bytes
  - HID: mcp2221: Don't set bus speed on every transfer
  - net/mlx5: SF, Fix add port error handling
  - drm/nouveau/disp: Always accept linear modifier
  - smb3 client: fix return code mapping of remap_file_range
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
  - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
  - HID: wacom: Add a new Art Pen 2
  - HID: logitech: Add ids for G PRO 2 LIGHTSPEED
  - HID: quirks: add support for Legion Go dual dinput modes
  - net: stmmac: Set CIC bit only for TX queues with COE
  - net: stmmac: xgmac: Correct supported speed modes
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
  - net/mlx5e: Set local Xoff after FW update
  - net/mlx5e: Update and set Xon/Xoff upon port speed set
  - net/mlx5e: Update and set Xon/Xoff upon MTU set
  - net/mlx5: Nack sync reset when SFs are present
  - net/mlx5: Convert SF port_indices xarray to function_ids xarray
  - net/mlx5: Use devlink port pointer to get the pointer of container SF struct
  - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc()
  - phy: mscc: Fix when PTP clock is register and unregister
  - net: dlink: fix multicast stats being counted incorrectly
  - dt-bindings: display/msm: qcom,mdp5: drop lut clock
  - drm/nouveau: remove unused memory target test
  - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
  - Bluetooth: hci_sync: fix set_local_name race condition
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
  - Bluetooth: hci_event: Mark connection as closed during suspend disconnect
  - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
  - HID: input: report battery status changes immediately
  - HID: input: rename hidinput_set_battery_charge_status()
  - powerpc/kvm: Fix ifdef to remove build warning
  - drm/msm: Defer fd_install in SUBMIT ioctl
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
  - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
  - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
  - ASoC: codecs: tx-macro: correct tx_macro_component_drv name
  - smb: client: fix race with concurrent opens in unlink(2)
  - scsi: core: sysfs: Correct sysfs attributes access rights
  - of: dynamic: Fix use after free in of_changeset_add_prop_helper()
  - of: Add a helper to free property struct
  - mips: lantiq: xway: sysctrl: rename the etop node
  - mips: dts: lantiq: danube: add missing burst length property
  - pinctrl: STMFX: add missing HAS_IOMEM dependency
  - of: dynamic: Fix memleak when of_pci_add_properties() failed
  - !20684 urma: adjust urma log format
  - !20355  udp: Deal with race between UDP socket address change and rehash
  - !20627  Fixes CVE-2025-38627
  - !20702  CVE-2025-39948
  - !20701  netfilter: ctnetlink: remove refcounting in expectation dumpers
  - !20700  CVE-2025-38678
  - !20703  CVE-2025-38491
  - !20690  tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
  - obmm: reduce log noise for successful export/import/preimport
  - mptcp: avoid deadlock on fallback while reinjecting
  - mptcp: plug races between subflow fail and subflow creation
  - mptcp: make fallback action and fallback decision atomic
  - ice: fix Rx page leak on multi-buffer frames
  - ice: fix incorrect counter for buffer allocation failures
  - ice: stop storing XDP verdict within ice_rx_buf
  - ice: gather page_count()'s of each frag right before XDP prog call
  - ice: Introduce ice_xdp_buff
  - netfilter: ctnetlink: remove refcounting in expectation dumpers
  - netfilter: nf_tables: reject duplicate device on updates
  - netfilter: nf_tables: Introduce functions freeing nft_hook objects
  - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c
  - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
  - !20498 Fix CVE-2025-71118
  - !20608  pmdomain: arm: scmi: Fix genpd leak on provider registration failure
  - !20679  x86/CPU/AMD: Add RDSEED fix for Zen5
  - !20650  fix cve-2025-40300
  - !20661  Input: alps - fix use-after-free bugs caused by dev3_register_work
  - !20664  backport some net bugfix from 6.6 lts
  - urma: adjust urma log format
  - !20678 ub: udma: close debug switch load parameters.
  - ub: udma: close debug switch load parameters.
  - x86/CPU/AMD: Add RDSEED fix for Zen5
  - !20630  net: LTS-6.6 bugfix backport
  - !20632  net/sched: sch_qfq: do not free existing class in qfq_change_class()
  - !20631  macvlan: fix possible UAF in macvlan_forward_source()
  - !20628  Fix CVE-2025-39910
  - !20659 v2  Fix CVE-2025-22090
  - !20506  XSched: Update XSched manual
  - !20647  media: imon: make send_packet() more robust
  - !20646  ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
  - !20645  fbcon: Set fb_display[i
  - !20648  parse_longname(): strrchr() expects NUL-terminated string
  - !20621 urma: modify log level
  - !20602 urma: fix the jfe uaf issue that occurred during the killall process.
  - !20567 urma:change log level and pass status 9
  - !20640  iio: common: st_sensors: Fix use of uninitialize device structs
  - !20634  usb: gadget: udc: fix use-after-free in usb_gadget_state_work
  - !20633  net: dsa: properly keep track of conduit reference
  - !20635  fix CVE-2025-68231
  - !20651  mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  - !20649  drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
  - !20652  mm/vmalloc: fix data race in show_numa_info()
  - x86: uaccess: don't use runtime-const rewriting in modules
  - x86: fix off-by-one in access_ok()
  - x86: fix user address masking non-canonical speculation issue
  - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit
  - x86/uaccess: Improve the 8-byte getuser() case
  - x86: fix whitespace in runtime-const assembler output
  - dcache: keep dentry_hashtable or d_hash_shift even when not used
  - runtime constants: add x86 architecture support
  - runtime constants: deal with old decrepit linkers
  - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address()
  - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
  - libceph: replace BUG_ON with bounds check for map->max_osd
  - libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
  - libceph: fix potential use-after-free in have_mon_and_osd_map()
  - sctp: Hold sock lock while iterating over address list
  - sctp: Prevent TOCTOU out-of-bounds write
  - sctp: Hold RCU read lock while iterating over address list
  - tipc: Fix use-after-free in tipc_mon_reinit_self().
  - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
  - sctp: avoid NULL dereference when chunk data buffer is missing
  - bpf: Explicitly check accesses to bpf_sock_addr
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup
  - nexthop: Forbid FDB status change while nexthop is in a group
  - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
  - sctp: initialize more fields in sctp_v6_from_sk()
  - pNFS: Fix a deadlock when returning a delegation during open()
  - Input: alps - fix use-after-free bugs caused by dev3_register_work
  - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors
  - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork()
  - mm: (un)track_pfn_copy() fix + doc improvements
  - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
  - !20642  mtdchar: fix integer overflow in read/write ioctls
  - mm/vmalloc: fix data race in show_numa_info()
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86
  - x86/vmscape: Enable the mitigation
  - x86/vmscape: Enumerate VMSCAPE bug
  - x86/vmscape: Add conditional IBPB mitigation
  - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
  - parse_longname(): strrchr() expects NUL-terminated string
  - media: imon: make send_packet() more robust
  - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
  - fbcon: Set fb_display[i]->mode to NULL when the mode is released
  - !20569  CVE-2024-35808
  - mtdchar: fix integer overflow in read/write ioctls
  - !20619 Fix CVE-2026-22991
  - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits
  - LoongArch: Add more instruction opcodes and emit_* helpers
  - iio: common: st_sensors: Fix use of uninitialize device structs
  - !20581  null_blk: fix kmemleak by releasing references to fault configfs items
  - mm/mempool: fix poisoning order>0 pages with HIGHMEM
  - mm/page_poison: replace kmap_atomic() with kmap_local_page()
  - mm/mempool: replace kmap_atomic() with kmap_local_page()
  - usb: gadget: udc: fix use-after-free in usb_gadget_state_work
  - net: dsa: properly keep track of conduit reference
  - net/sched: sch_qfq: do not free existing class in qfq_change_class()
  - macvlan: fix possible UAF in macvlan_forward_source()
  - netfilter: nft_objref: validate objref and objrefmap expressions
  - arp: do not assume dev_hard_header() does not change skb->head
  - ip6_gre: make ip6gre_header() robust
  - netfilter: nf_tables: avoid chain re-validation if possible
  - netfilter: nf_tables: drop unused 3rd argument from validate callback ops
  - Revert "netfilter: nft_objref: validate objref and objrefmap expressions"
  - bpf: Fix reference count leak in bpf_prog_test_run_xdp()
  - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
  - ethtool: Avoid overflowing userspace buffer on stats query
  - ipvs: fix ipv4 null-ptr-deref in route error path
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
  - !20596  mm/page_alloc: prevent pcp corruption with SMP=n
  - !20598  team: fix check for port enabled in team_queue_override_port_prio_changed()
  - !18823  hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
  - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
  - kasan: avoid sleepable page allocation from atomic context
  - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
  - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi
  - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches
  - !20460  fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - urma:fix log level and pass status 9
  - urma: modify log level
  - !20592  CVE-2025-71141 fixup
  - !20594  CVE-2025-39744 fixup
  - !20607  powerpc/64s/slb: Fix SLB multihit issue during SLB preload
  - !20606  mm/huge_memory: fix NULL pointer deference when splitting folio
  - !20604 Fix CVE-2026-22984
  - !20603 Fix CVE-2026-23021
  - !20600 Fix CVE-2026-22990
  - urma: fix the jfe uaf issue that occurred during the killall process.
  - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD
  - libceph: make free_choose_arg_map() resilient to partial allocation
  - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET
  - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits
  - net: hns3: extend HCLGE_FD_AD_QID to 11 bits
  - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
  - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
  - Revert "net: hns3: add support for FD counter"
  - !20587  dmaengine: stm32: dmamux: fix device leak on route allocation
  - pmdomain: arm: scmi: Fix genpd leak on provider registration failure
  - powerpc/64s/slb: Fix SLB multihit issue during SLB preload
  - mm/huge_memory: fix NULL pointer deference when splitting folio
  - !20562  LoongArch: BPF: Sign extend kfunc call arguments
  - !20470  ipv4: Fix reference count leak when using error routes with nexthop objects
  - !20471  net: sock: fix hardened usercopy panic in sock_recv_errqueue
  - !20472  net: fix memory leak in skb_segment_list for GRO packets
  - !20473  ipv4: ip_gre: make ipgre_header() robust
  - !20469  SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
  - !20476  ipv6: Fix use-after-free in inet6_addr_del().
  - !20477  svcrdma: bound check rq_pages index in inline path
  - !20578  ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
  - !20579  fix CVE-2025-68768
  - !20542  Fix NFS deadlock
  - USB: storage: Remove subclass and protocol overrides from Novatek quirk
  - cpuidle: governors: menu: Select polling state in some more cases
  - cpuidle: governors: menu: Rearrange main loop in menu_select()
  - cpuidle: menu: Update documentation after previous changes
  - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader"
  - parisc: Remove spurious if statement from raw_copy_from_user()
  - ata: libata-scsi: Fix system suspend for a security locked drive
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo"
  - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present
  - drm/amd/display: use udelay rather than fsleep
  - sched/fair: Revert max_newidle_lb_cost bump
  - net: ipv4: fix regression in local-broadcast routes
  - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
  - PM: runtime: Do not clear needs_force_resume with enabled runtime PM
  - usb: typec: ucsi: psy: Set max current to zero when disconnected
  - io_uring/rw: cast rw->flags assignment to rwf_t
  - Documentation: ACPI: i2c-muxes: fix I2C device references
  - s390/hypfs: Enable limited access during lockdown
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
  - net/mlx5e: Preserve shared buffer capacity during headroom updates
  - net/mlx5: Base ECVF devlink port attrs from 0
  - Octeontx2-af: Skip overlap check for SPI field
  - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU
  - bonding: Add independent control state machine
  - bonding: update LACP activity flag after setting lacp_active
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
  - gve: prevent ethtool ops after shutdown
  - phy: mscc: Fix timestamping for vsc8584
  - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
  - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3()
  - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
  - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
  - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
  - scsi: qla4xxx: Prevent a potential error pointer dereference
  - RDMA/bnxt_re: Fix to initialize the PBL array
  - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
  - RDMA/bnxt_re: Fix to do SRQ armena by default
  - RDMA/erdma: Fix ignored return value of init_kernel_qp
  - iosys-map: Fix undefined behavior in iosys_map_clear()
  - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key
  - spi: spi-fsl-lpspi: Clamp too high speed_hz
  - usb: typec: maxim_contaminant: disable low power mode when reading comparator values
  - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean
  - iio: imu: inv_icm42600: change invalid data error to -EBUSY
  - iio: imu: inv_icm42600: Convert to uXX and sXX integer types
  - iio: imu: inv_icm42600: use = { } instead of memset()
  - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64
  - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
  - iio: light: as73211: Ensure buffer holes are zeroed
  - tls: fix handling of zero-length records on the rx_list
  - powerpc/boot: Fix build with gcc 15
  - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
  - compiler: remove __ADDRESSABLE_ASM{_STR,}() again
  - drm/amd/display: Don't overclock DCE 6 by 15%
  - usb: dwc3: pci: add support for the Intel Wildcat Lake
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
  - usb: renesas-xhci: Fix External ROM access timeouts
  - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test
  - comedi: Make insn_rw_emulate_bits() do insn->n samples
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
  - cdx: Fix off-by-one error in cdx_rpmsg_probe()
  - most: core: Drop device reference after usage in get_channel()
  - iio: proximity: isl29501: fix buffered read on big-endian systems
  - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
  - cpuidle: governors: menu: Avoid selecting states with too much latency
  - cpuidle: menu: Remove iowait influence
  - mmc: sdhci-pci-gli: Add a new function to simplify the code
  - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values
  - mptcp: disable add_addr retransmission when timeout is 0
  - mptcp: remove duplicate sk_reset_timer call
  - use uniform permission checks for all mount propagation changes
  - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support
  - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
  - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
  - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
  - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features
  - PCI: imx6: Delay link start until configfs 'start' written
  - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
  - PCI: rockchip: Use standard PCIe definitions
  - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
  - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
  - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6
  - mm/debug_vm_pgtable: clear page table entries at destroy_args()
  - squashfs: fix memory leak in squashfs_fill_super
  - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
  - memstick: Fix deadlock by moving removing flag earlier
  - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix
  - sched/fair: Fix frequency selection for non-invariant case
  - kbuild: userprogs: use correct linker when mixing clang and GNU ld
  - ata: libata-scsi: Return aborted command when missing sense and result TF
  - PM: runtime: Take active children into account in pm_runtime_get_if_in_use()
  - PM: runtime: Simplify pm_runtime_get_if_active() usage
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
  - usb: dwc3: imx8mp: fix device leak at unbind
  - wifi: mac80211: check basic rates validity in sta_link_apply_parameters
  - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
  - s390/mm: Remove possible false-positive warning in pte_free_defer()
  - btrfs: send: make fs_path_len() inline and constify its argument
  - btrfs: send: use fallocate for hole punching with send stream v2
  - btrfs: send: avoid path allocation for the current inode when issuing commands
  - btrfs: send: keep the current inode's path cached
  - btrfs: send: add and use helper to rename current inode when processing refs
  - btrfs: send: only use boolean variables at process_recorded_refs()
  - btrfs: send: factor out common logic when sending xattrs
  - btrfs: populate otime when logging an inode item
  - btrfs: constify more pointer parameters
  - btrfs: fix ssd_spread overallocation
  - btrfs: open code timespec64 in struct btrfs_inode
  - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
  - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
  - btrfs: always abort transaction on failure to add block group to free space tree
  - btrfs: move transaction aborts to the error site in add_block_group_free_space()
  - btrfs: qgroup: fix race between quota disable and quota rescan ioctl
  - usb: typec: fusb302: cache PD RX state
  - block: Make REQ_OP_ZONE_FINISH a write operation
  - block: reject invalid operation in submit_bio_noacct
  - leds: flash: leds-qcom-flash: Fix registry access after re-bind
  - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition
  - selftests/memfd: add test for mapping write-sealed memfd read-only
  - mm: update memfd seal write check to include F_SEAL_WRITE
  - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
  - mptcp: drop skb if MPTCP skb extension allocation fails
  - ipv6: sr: Fix MAC comparison to be constant-time
  - drm/amd/display: Don't overwrite dce60_clk_mgr
  - drm/amd/display: Add primary plane to commits for correct VRR handling
  - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
  - drm/amdgpu: update mmhub 3.0.1 client id mappings
  - drm/amdgpu: Avoid extra evict-restore process.
  - drm/amd: Restore cached power limit during resume
  - media: venus: venc: Clamp param smaller than 1fps and bigger than 240
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
  - media: venus: protect against spurious interrupts during probe
  - media: venus: hfi: explicitly release IRQ during teardown
  - media: qcom: camss: cleanup media device allocated resource on error path
  - media: ov2659: Fix memory leaks in ov2659_probe()
  - media: usbtv: Lock resolution while streaming
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
  - media: verisilicon: Fix AV1 decoder clock frequency
  - media: vivid: fix wrong pixel_array control size
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
  - media: hi556: correct the test pattern configuration
  - media: gspca: Add bounds checking to firmware parser
  - parisc: Update comments in make_insert_tlb
  - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault()
  - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c
  - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers
  - parisc: Define and use set_pte_at()
  - parisc: Check region is readable by user in raw_copy_from_user()
  - soc/tegra: pmc: Ensure power-domains are in a known state
  - f2fs: fix to avoid out-of-boundary access in dnode page
  - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence
  - vhost/vsock: Avoid allocating arbitrarily-sized SKBs
  - PCI: endpoint: Fix configfs group removal on driver teardown
  - PCI: endpoint: Fix configfs group list head handling
  - mtd: rawnand: renesas: Add missing check after DMA map
  - mtd: rawnand: fsmc: Add missing check after DMA map
  - mtd: spinand: propagate spinand_wait() errors from spinand_write_page()
  - mtd: spi-nor: Fix spi_nor_try_unlock_all()
  - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
  - pwm: mediatek: Fix duty and period setting
  - pwm: mediatek: Handle hardware enable and clock enable separately
  - pwm: imx-tpm: Reset counter if CMOD is 0
  - wifi: ath11k: fix dest ring-buffer corruption when ring is full
  - wifi: ath11k: fix source ring-buffer corruption
  - wifi: ath11k: fix dest ring-buffer corruption
  - wifi: ath12k: fix dest ring-buffer corruption when ring is full
  - wifi: ath12k: fix source ring-buffer corruption
  - wifi: ath12k: fix dest ring-buffer corruption
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
  - iio: adc: ad_sigma_delta: change to buffer predisable
  - zynq_fpga: use sgtable-based scatterlist wrappers
  - scsi: ufs: ufs-pci: Fix default runtime and system PM levels
  - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers
  - ata: libata-scsi: Fix ata_to_sense_error() status handling
  - scsi: mpi3mr: Fix race between config read submit and interrupt completion
  - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints
  - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
  - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses
  - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1
  - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default
  - btrfs: zoned: fix write time activation failure for metadata block group
  - ext4: fix hole length calculation overflow in non-extent inodes
  - ext4: don't try to clear the orphan_present feature block device is r/o
  - ext4: fix reserved gdt blocks handling in fsmap
  - ext4: fix fsmap end of range reporting with bigalloc
  - ext4: check fast symlink for ea_inode correctly
  - tracing: fprobe-event: Sanitize wildcard for fprobe event name
  - crypto: qat - lower priority for skcipher and aead algorithms
  - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap
  - vt: defkeymap: Map keycodes above 127 to K_HOLE
  - vt: keyboard: Don't process Unicode characters in K_OFF mode
  - bus: mhi: host: Fix endianness of BHI vector table
  - usb: dwc3: meson-g12a: fix device leaks at unbind
  - usb: musb: omap2430: fix device leak at unbind
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
  - m68k: Fix lost column on framebuffer debug console
  - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
  - rcu: Fix racy re-initialization of irq_work causing hangs
  - HID: apple: avoid setting up battery timer for devices without battery
  - HID: magicmouse: avoid setting up battery timer when not needed
  - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
  - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros
  - media: uvcvideo: Do not mark valid metadata as invalid
  - media: venus: Fix OOB read due to missing payload bound check
  - parisc: Makefile: fix a typo in palo.conf
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - btrfs: do not allow relocation of partially dropped subvolumes
  - btrfs: zoned: do not select metadata BG as finish target
  - btrfs: clear dirty status from extent buffer on error at insert_new_root()
  - btrfs: zoned: do not remove unwritten non-data block group
  - btrfs: abort transaction during log replay if walk_log_tree() failed
  - btrfs: zoned: use filesystem size not disk size for reclaim decision
  - cdc-acm: fix race between initial clearing halt and open
  - thunderbolt: Fix copy+paste error in match_service_id()
  - usb: typec: ucsi: Update power_supply on power role change
  - misc: rtsx: usb: Ensure mmc child device is active when card is present
  - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range
  - cifs: reset iface weights when we cannot find a candidate
  - drm/amdgpu: fix incorrect vm flags to map bo
  - scsi: lpfc: Remove redundant assignment to avoid memory leak
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
  - pNFS: Handle RPC size limit for layoutcommits
  - pNFS: Fix disk addr range check in block/scsi layout
  - pNFS: Fix stripe mapping in block/scsi layout
  - ASoC: Intel: avs: Fix uninitialized pointer error in probe()
  - net: phy: smsc: add proper reset flags for LAN8710A
  - ipmi: Fix strcpy source and destination the same
  - kconfig: lxdialog: fix 'space' to (de)select options
  - kconfig: gconf: fix potential memory leak in renderer_edited()
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings
  - vfio/mlx5: fix possible overflow in tracking max message size
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY
  - scsi: target: core: Generate correct identifiers for PR OUT transport IDs
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
  - kconfig: nconf: Ensure null termination where strncpy is used
  - vfio/type1: conditional rescheduling while pinning
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
  - f2fs: check the generic conditions first
  - exfat: add cluster chain loop check for dir
  - i2c: Force DLL0945 touchpad i2c freq to 100khz
  - apparmor: use the condition in AA_BUG_FMT even with debug disabled
  - dm-table: fix checking for rq stackable devices
  - dm-mpath: don't print the "loaded" message if registering fails
  - i3c: master: Initialize ret in i3c_i2c_notifier_call()
  - i3c: don't fail if GETHDRCAP is unsupported
  - apparmor: shift ouid when mediating hard links in userns
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
  - i3c: add missing include to internal header
  - module: Prevent silent truncation of module name in delete_module(2)
  - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use
  - soundwire: Move handle_nested_irq outside of sdw_dev_lock
  - soundwire: amd: serialize amd manager resume sequence during pm_prepare
  - crypto: octeontx2 - add timeout for load_fvc completion poll
  - media: uvcvideo: Fix bandwidth issue for Alcor camera
  - media: usb: hdpvr: disable zero-length read messages
  - media: tc358743: Increase FIFO trigger level to 374
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
  - media: tc358743: Check I2C succeeded during probe
  - pinctrl: stm32: Manage irq affinity settings
  - scsi: mpi3mr: Correctly handle ATA device errors
  - scsi: mpt3sas: Correctly handle ATA device errors
  - power: supply: qcom_battmgr: Add lithium-polymer entry
  - RDMA/core: reduce stack using in nldev_stat_get_doit()
  - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs
  - leds: leds-lp50xx: Handle reg to get correct multi_index
  - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control
  - MIPS: lantiq: falcon: sysctrl: fix request memory check logic
  - crypto: jitter - fix intermediary handling
  - watchdog: iTCO_wdt: Report error if timeout configuration fails
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
  - clk: qcom: ipq5018: keep XO clock always on
  - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state
  - watchdog: dw_wdt: Fix default timeout
  - fs/orangefs: use snprintf() instead of sprintf()
  - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal
  - mfd: axp20x: Set explicit ID for AXP313 regulator
  - clk: tegra: periph: Fix error handling and resolve unsigned compare warning
  - fbdev: fix potential buffer overflow in do_register_framebuffer()
  - cifs: Fix calling CIFSFindFirst() for root path without msearch
  - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition
  - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported
  - drm/amd/display: Only finalize atomic_obj if it was initialized
  - vhost: fail early when __vhost_add_used() fails
  - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
  - rcu: Fix rcu_read_unlock() deadloop due to IRQ work
  - drm/amd/display: Avoid trying AUX transactions on disconnected ports
  - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size
  - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP
  - uapi: in6: restore visibility of most IPv6 socket options
  - drm/ttm: Should to return the evict error
  - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range
  - net: ncsi: Fix buffer overflow in fetching version id
  - ionic: clean dbpage in de-init
  - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc()
  - ptp: Use ratelimite for freerun error message
  - bpftool: Fix JSON writer resource leak in version command
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
  - net: dsa: b53: prevent DIS_LEARNING access on BCM5325
  - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
  - gve: Return error for unknown admin queue command
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
  - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured
  - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual
  - dpaa_eth: don't use fixed_phy_change_carrier
  - wifi: iwlegacy: Check rate_idx range after addition
  - netmem: fix skb_frag_address_safe with unreadable skbs
  - powerpc: floppy: Add missing checks after DMA map
  - wifi: ath12k: Decrement TID on RX peer frag setup error handling
  - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
  - wifi: mac80211: update radar_required in channel context after channel switch
  - drm/amd/display: Fix 'failed to blank crtc!'
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
  - wifi: ath12k: Add memset and update default rate value in wmi tx completion
  - drm/amd/display: Separate set_gsl from set_gsl_source_select
  - net: fec: allow disable coalescing
  - net: atlantic: add set_power to fw_ops for atl2 to fix wol
  - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
  - net: thunderbolt: Enable end-to-end flow control also in transmit
  - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace
  - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch
  - wifi: rtw89: Disable deep power saving for USB/SDIO
  - wifi: rtw89: Fix rtw89_mac_power_switch() for USB
  - drm/msm: use trylock for debugfs
  - wifi: mac80211: fix rx link assignment for non-MLO stations
  - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc().
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
  - wifi: mac80211: don't complete management TX on SAE commit
  - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
  - s390/stp: Remove udelay from stp_sync_clock()
  - wifi: iwlwifi: mvm: fix scan request validation
  - um: Re-evaluate thread flags repeatedly
  - wifi: iwlwifi: mvm: set gtk id also in older FWs
  - perf/cxlpmu: Remove unintended newline from IRQ name format string
  - net: phy: micrel: Add ksz9131_resume()
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
  - net: ipv4: fix incorrect MTU in broadcast routes
  - wifi: cfg80211: Fix interface type validation
  - net: mctp: Prevent duplicate binds
  - arm64: Mark kernel as tainted on SAE and SError panic
  - net/mlx5e: Properly access RCU protected qdisc_sleeping variable
  - net: ag71xx: Add missing check after DMA map
  - et131x: Add missing check after DMA map
  - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
  - be2net: Use correct byte order and format string for TCP seq and ack_seq
  - s390/time: Use monotonic clock in get_cycles()
  - wifi: cfg80211: reject HTC bit for management frames
  - ktest.pl: Prevent recursion of default variable options
  - wifi: ath12k: Correct tid cleanup when tid setup fails
  - net: usb: cdc-ncm: check for filtering capability
  - xen/netfront: Fix TX response spurious interrupts
  - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie()
  - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64
  - ASoC: qcom: use drvdata instead of component to keep id
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification
  - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
  - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
  - platform/chrome: cros_ec_typec: Defer probe on missing EC parent
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
  - soc: qcom: mdt_loader: Actually use the e_phoff
  - imx8m-blk-ctrl: set ISI panic write hurry level
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
  - usb: core: usb_submit_urb: downgrade type check
  - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
  - ALSA: hda: Disable jack polling at shutdown
  - ALSA: hda: Handle the jack polling always via a work
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
  - mei: bus: Check for still connected devices in mei_cl_bus_dev_release()
  - char: misc: Fix improper and inaccurate error code returned by misc_init()
  - reset: brcmstb: Enable reset drivers for ARCH_BCM2835
  - pps: clients: gpio: fix interrupt handling order in remove path
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
  - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
  - ACPI: processor: fix acpi_object initialization
  - PM: sleep: console: Fix the black screen issue
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
  - firmware: tegra: Fix IVC dependency problems
  - ACPI: PRM: Reduce unnecessary printing to avoid user confusion
  - selftests: tracing: Use mutex_unlock for testing glob filter
  - tools/build: Fix s390(x) cross-compilation with clang
  - gpio: tps65912: check the return value of regmap_update_bits()
  - iio: adc: ad_sigma_delta: don't overallocate scan buffer
  - tools/nolibc: define time_t in terms of __kernel_old_time_t
  - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
  - EDAC/synopsys: Clear the ECC counters on init
  - gpio: wcd934x: check the return value of regmap_update_bits()
  - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
  - soc: qcom: rpmh-rsc: Add RSC version 4 support
  - usb: xhci: Avoid showing errors during surprise removal
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
  - usb: xhci: Avoid showing warnings for dying controller
  - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
  - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
  - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
  - usb: xhci: print xhci->xhc_state when queue_command failed
  - tracefs: Add d_delete to remove negative dentries
  - securityfs: don't pin dentries twice, once is enough...
  - fix locking in efi_secret_unlink()
  - ext2: Handle fiemap on empty files to prevent EINVAL
  - fs/ntfs3: correctly create symlink for relative path
  - fs/ntfs3: Add sanity check for file name
  - better lockdep annotations for simple_recursive_removal()
  - hfs: fix not erasing deleted b-tree node issue
  - drbd: add missing kref_get in handle_write_conflicts
  - udf: Verify partition map count
  - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
  - nvme-pci: try function level reset on init failure
  - smb/server: avoid deadlock when linking with ReplaceIfExists
  - arm64: Handle KCOV __init vs inline mismatches
  - ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
  - intel_idle: Allow loading ACPI tables for any family
  - net: ti: icss-iep: Fix incorrect type for return value in extts_enable()
  - netfilter: ctnetlink: fix refcount leak on table dump
  - udp: also consider secpath when evaluating ipsec use for checksumming
  - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
  - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
  - KVM: VMX: Extract checking of guest's DEBUGCTL into helper
  - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
  - KVM: VMX: Handle forced exit due to preemption timer in fastpath
  - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits
  - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint
  - libceph: prevent potential out-of-bounds reads in handle_auth_done()
  - net: usb: pegasus: fix memory leak in update_eth_regs_async()
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
  - !20540 urma: added support for ipoverurma
  - team: fix check for port enabled in team_queue_override_port_prio_changed()
  - mm/page_alloc: prevent pcp corruption with SMP=n
  - !20528 Fix CVE-2025-71083
  - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
  - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
  - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow
  - smb: client: don't wait for info->send_pending == 0 on error
  - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()
  - ACPI: processor: perflib: Move problematic pr->performance check
  - ACPI: processor: perflib: Fix initial _PPC limit application
  - Documentation: ACPI: Fix parent device references
  - fs: Prevent file descriptor table allocations exceeding INT_MAX
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check
  - PCI: Extend isolated function probing to LoongArch
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op
  - net: dpaa: fix device leak when querying time stamp info
  - net: ti: icss-iep: fix device and OF node leaks at probe
  - net: mtk_eth_soc: fix device leak at probe
  - net: enetc: fix device and OF node leak at probe
  - net: gianfar: fix device leak when querying time stamp info
  - net: phy: micrel: fix KSZ8081/KSZ8091 cable test
  - gpio: mlxbf3: use platform_get_irq_optional()
  - gpio: mlxbf2: use platform_get_irq_optional()
  - gpio: virtio: Fix config space reading.
  - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
  - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors
  - rcu: Fix racy re-initialization of irq_work causing hangs
  - rcu: Fix rcu_read_unlock() deadloop due to IRQ work
  - drm/tilcdc: Fix removal actions in case of failed probe
  - drm/tilcdc: request and mapp iomem with devres
  - urma: fix update topo logic
  - dmaengine: stm32: dmamux: fix device leak on route allocation
  - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD
  - null_blk: fix kmemleak by releasing references to fault configfs items
  - inet: frags: flush pending skbs in fqdir_pre_exit()
  - inet: frags: add inet_frag_queue_flush()
  - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
  - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen
  - md/dm-raid: don't call md_reap_sync_thread() directly
  - ACPICA: Avoid walking the Namespace if start_node is NULL
  - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS
  - LoongArch: BPF: Sign extend kfunc call arguments
  - genirq/msi:: Fix kabi break of struct msi_desc
  - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie
  - NFS: Fix a deadlock involving nfs_release_folio()
  - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page""
  - urma: added support for ipoverurma
  - drm/ttm: Avoid NULL pointer deref for evicted BOs
  - XSched: Update XSched manual
  - svcrdma: bound check rq_pages index in inline path
  - ipv6: Fix use-after-free in inet6_addr_del().
  - ipv4: ip_gre: make ipgre_header() robust
  - net: fix memory leak in skb_segment_list for GRO packets
  - net: sock: fix hardened usercopy panic in sock_recv_errqueue
  - ipv4: Fix reference count leak when using error routes with nexthop objects
  - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - udp: Deal with race between UDP socket address change and rehash
  - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors
  - x86/tsc: Use topology_max_packages() to get package number
  - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register
  - EDAC/amd64: Correct the address translation for hygon family 18h model 4h
  - KVM: arm64: Mark some header functions as inline
  - KVM: arm64: Refactor exit handlers
  - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs
  - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio


author: Li Nan <linan122@huawei.com> - 6.6.0-140.0.0.121
changelog:
  - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes
  - ub/obmm: fix wrong pxm_numa parameter validation
  - ub/obmm: Remove unused parameters from obmm_addr_check.c
  - ub/obmm: Enhance mem_allocator_granu validation
  - ub/obmm: simplify allocator naming scheme
  - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory
  - ub/obmm: add sysfs interface with fine-grained memory statistics
  - !20804  net: hv_netvsc: reject RSS hash key programming without RX indirection table
  - !20813  migrate: correct lock ordering for hugetlb file folios
  - !20812  libceph: make calc_target() set t->paused, not just clear it
  - !20719 drivers/ub/sentry: some bugfix
  - !20798 urma: log should not retrieve eid_idx from uctx
  - !20808 urma: support triple bonding device
  - urma: log should not retrieve eid_idx from uctx
  - migrate: correct lock ordering for hugetlb file folios
  - libceph: make calc_target() set t->paused, not just clear it
  - !20745 vfio platform VFIO support for hisi05a1 devices
  - urma: support triple bonding device
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table
  - !20789  gic: Add hip09 support for HISILICON_ERRATUM_165010801
  - !20726  tracing: Add recursion protection in kernel stack trace recording
  - !20668  irqchip/gic-v3-its: Avoid truncating memory addresses
  - !20795 ub: udma: support query and set qos info.
  - !20791 Migration/urma:optimize performance in live migration.
  - ub: udma: Support for UE link establishment message.
  - Migration/urma: optimize performance in live migration.
  - !20787 ub: cdma: modify the method of assigning values to the structure
  - !20759 ubcore: hotfix route query for port eid on the same node.
  - ub: udma: support query and set qos info.
  - Revert "ub: ubase: Support for RC saved by queue granularity"
  - ubcore: hotfix route query for port eid on the same node.
  - !20676 urma: set/get sl
  - !20765 urma: bugfix of UAF and double free in ubcm
  - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability
  - gic: Add hip09 support for HISILICON_ERRATUM_165010801
  - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default
  - vfio/platform: VFIO support for hisi05a1 devices
  - ub: cdma: modify the method of assigning values to the structure
  - urma: set/get sl
  - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth
  - ub: ubase: Support for RC saved by queue granularity
  - ub: ubase: Traverse mailbox AE events using interrupts and polling.
  - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages
  - net: unic: The function of dumping himac registers is added.
  - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style
  - ub: ubase: Retain the initial tm qset configuration and restore it
  - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs.
  - ub: ubase: Add a retransmission function to improve reliability.
  - net: unic: Increase the readability and reliability of loopback code
  - net: unic: Synchronize the code modify for ip management and deactivation
  - net: unic: Increase the readability and reliability of VLAN feature.
  - net: unic: Added unic DFX log information.
  - ub: ubase: Add and correct comments for some functions and data structures
  - net: unic: Notify MAMI when the bond port status changes
  - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset
  - !20768 iommu/ummu-core: Fix separate page table compatibility
  - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3
  - !20764 net: hns3: fix double free issue for tx spare buffer
  - urma: bugfix of UAF and double free in ubcm
  - iommu/ummu-core: Fix separate page table compatibility
  - net: hns3: fix double free issue for tx spare buffer
  - drivers/ub/sentry: fix memory leak in sentry_msg_helper
  - drivers/ub/sentry: initialize some variables
  - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg()
  - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm
  - drivers/ub/sentry: add input parameter verification for exported symbols
  - tracing: Add recursion protection in kernel stack trace recording
  - x86/csv: Enhance CMA memory usage reporting for CSV3
  - irqchip/gic-v3-its: Avoid truncating memory addresses


author: Li Nan <linan122@huawei.com> - 6.6.0-141.0.0.123
changelog:
  - !20704 kernel support hisi-cca-da
  - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration
  - !20905 v2  KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
  - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization
  - !20964 iommu/ummu: Support TID and EID Granularity for MPAM
  - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver
  - hisi-cca-da: Start dev by rsi call
  - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV
  - hisi-cca-da: Support swiotlb and realm memory use
  - hisi-cca-da: Add smmu info when dev attach
  - hisi-cca-da: Transfer realm msix access to rmm
  - hisi-cca-da: Support pcipc sriov capability
  - hisi-cca-da: Delay realm memory release to kvm_destroy_realm
  - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm
  - hisi-cca-da: Add cca realm s2 pgtable framework
  - hisi-cca-da: Use bitmap to determine whether the command can be forwarded
  - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only
  - hisi-cca-da: Add cmd forward mechanism in realm smmu
  - hisi-cca-da: Add realm smmu event and gerror irq initialization
  - hisi-cca-da: Add realm smmu stream table initialization
  - hisi-cca-da: Add realm smmu cmdq and evtq initialization
  - hisi-cca-da: Add realm smmu initialization
  - hisi-cca-da: Add relam iommu support to iommufd
  - hisi-cca-da: Add realm iommu support for vfio-iommu-type1
  - hisi-cca-da: Support dev map and unmap
  - hisi-cca-da: Support dev validate and dev start
  - hisi-cca-da: VFIO support ccada
  - hisi-cca-da: Support dev delegate and dev attach
  - hisi-cca-da: Support root dev delegate and dev init
  - hisi-cca-da: Add hisilicon extension smc and ccada cmd
  - hisi-cca-da: Add hisi ccada feature config
  - !20751 ARM CCA supports hugepage
  - !20944 ub: ubmempfd: supports for D2H mapping and demapping
  - !20888  HiSock Enhancement
  - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver.
  - net: unic: Resolve the residual MAC address problem
  - net: unic: Optimized the code for the cmd structure and FEC function.
  - ub: ubase: add log for post mailbox timeout
  - ub: ubus: Remove black box header file to include dir
  - rme: Remove the secret bit of the vring desc addr
  - rme: improve hisi-cca data mmap and destroy method
  - !20943 uvb: fix wd_obtain logic err
  - !20942 urma: fix bond device id not release
  - !20892  dcache: Limit the minimal number of bucket to two
  - rme: isolate page when do delegation to avoid migration
  - rme: hisi-cca supports different levels for mapping ram
  - rme: rename ccal to hisi-cca
  - rme: support set ripas for ccal realm vm
  - rme: support destroy ram data for ccal realm vm
  - rme: support populate region for ccal realm vm
  - rme: support map ram for ccal realm vm
  - rme: support config ccal realm vm
  - rme: support ccal RMI calls
  - rme: realm vm supports wfx handler
  - !20952 urma: introduce ipourma module
  - iommu/ummu-core: Simplifies tdev initialization resources
  - iommu/ummu: Optimized log printing
  - iommu/ummu: Use passed gfp_mask in map_pages callback
  - uvb: fix wd_obtain logic err
  - !20949 ub: udma: support user ctl function.
  - urma: fix bond device id not release
  - !20901 drivers/ub/sentry: some bugfix
  - ub: ubmempfd: supports for D2H mapping and demapping
  - ub: ubmempfd: supports providing services to the QEMU process through file nodes
  - [virtCCA Live Migration 2]virtcca secure cvm supports live migration
  - urma: query priority and enable bit, support ring size configuration
  - urma: implement debugfs, improve boundary checks and error handling logic
  - urma: implement data plane interaction and statistics
  - urma: implement ipourma network device operations
  - urma: ipourma resource management
  - urma: ipourma resource management and err code
  - urma: introduce ipourma main module
  - iommu/ummu: Optimized the TID invalidation configuration
  - iommu/ummu: Optimized SVA permission table memory allocation approach
  - iommu/ummu: Adapt UMMU SVA interface adjustment
  - iommu/ummu: Support TID and EID Granularity for MPAM
  - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y
  - !20847 urma: sl resource query error
  - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches
  - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption
  - !20929  PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug
  - drivers/ub/sentry: fix check input parameters
  - ub: udma: support user ctl function.
  - ub: udma: support uboe function.
  - ub: udma: bugfix related to query aux info.
  - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs
  - drivers/ub/sentry: do not use magic numbers
  - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface
  - urma: sl resource query error
  - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4
  - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time
  - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs
  - ub: ubmem_vmmu: supports parsing and configuring the hardware node information
  - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation
  - !20806 Fix CVE-2025-71225
  - !20896  scsi: qla2xxx: Free sp in error path to fix system crash
  - !20894  scsi: qla2xxx: Delay module unload while fabric scan in progress
  - !20893  scsi: qla2xxx: Validate sp before freeing associated memory
  - !20802 Fix CVE-2026-23110
  - urma: Kernel-mode specific implementations file for Jetty extension interface
  - drivers/ub/sentry: fix memory leak in process_urma_data()
  - drivers/ub/sentry: initialize some variables
  - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug
  - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory
  - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
  - mm: consider non-anon swap cache folios in folio_expected_ref_count()
  - mm: simplify folio_expected_ref_count()
  - ASoC: qcom: audioreach: fix potential null pointer dereference
  - gcc-plugins: Remove TODO_verify_il for GCC >= 16
  - crypto: sha256 - fix crash at kexec
  - drm/i915/backlight: Return immediately when scale() finds invalid parameters
  - minmax.h: remove some #defines that are only expanded once
  - minmax.h: simplify the variants of clamp()
  - minmax.h: move all the clamp() definitions after the min/max() ones
  - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
  - minmax.h: reduce the #define expansion of min(), max() and clamp()
  - minmax.h: update some comments
  - minmax.h: add whitespace around operators and after commas
  - minmax: fix up min3() and max3() too
  - minmax: improve macro expansion and type checking
  - minmax: don't use max() in situations that want a C constant expression
  - minmax: simplify min()/max()/clamp() implementation
  - minmax: make generic MIN() and MAX() macros available everywhere
  - drm/ast: Use msleep instead of mdelay for edid read
  - gpiolib: Extend software-node support to support secondary software-nodes
  - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB
  - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b
  - kmsan: fix out-of-bounds access to shadow memory
  - afs: Fix potential null pointer dereference in afs_put_server
  - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
  - i40e: improve VF MAC filters accounting
  - i40e: add mask to apply valid bits for itr_idx
  - HID: asus: add support for missing PX series fn keys
  - drm/gma500: Fix null dereference in hdmi teardown
  - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
  - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
  - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
  - net: dsa: lantiq_gswip: do also enable or disable cpu port
  - selftests: fib_nexthops: Fix creation of non-FDB nexthops
  - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
  - bnxt_en: correct offset handling for IPv6 destination address
  - vhost: Take a reference on the task in struct vhost_task.
  - Bluetooth: hci_sync: Fix hci_resume_advertising_sync
  - ethernet: rvu-af: Remove slash from the driver name
  - can: peak_usb: fix shift-out-of-bounds issue
  - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
  - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
  - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
  - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
  - bpf: Reject bpf_timer for PREEMPT_RT
  - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
  - wifi: virt_wifi: Fix page fault on connect
  - cpufreq: Initialize cpufreq-based invariance before subsys
  - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
  - arm64: dts: imx8mp: Correct thermal sensor index
  - mm: folio_may_be_lru_cached() unless folio_test_large()
  - mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
  - mm/gup: check ref_count instead of lru before migration
  - mm: add folio_expected_ref_count() for reference count calculation
  - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
  - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
  - ALSA: usb-audio: Add mute TLV for playback volumes on more devices
  - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
  - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
  - i2c: designware: Add quirk for Intel Xe
  - mmc: sdhci-cadence: add Mobileye eyeQ support
  - usb: core: Add 0x prefix to quirks debug output
  - ALSA: usb-audio: Fix build with CONFIG_INPUT=n
  - ALSA: usb-audio: Convert comma to semicolon
  - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
  - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
  - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
  - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
  - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
  - ALSA: usb-audio: Fix block comments in mixer_quirks
  - firewire: core: fix overlooked update of subsystem ABI version
  - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
  - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches
  - !20869 ub:hisi-ubus: fix bug of security smatch
  - !20861  CVE-2026-23163
  - ub: ubdevshm: supports the memory user to obtain and release shared memory
  - ub: ubdevshm: supports granting and revoking shared memory permissions
  - ub: ubdevshm: supports the registration and deregistration of shared memory segments
  - ub: ubdevshm: supports the registration and deregistration
  - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
  - !20886  Fix CVE-2026-23205
  - !20803 Fix CVE-2026-23112
  - !20868  sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure
  - !20811  smb/server: fix refcount leak in smb2_open()
  - !20810  smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
  - !20809  smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
  - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4
  - sunrpc: fix race in cache cleanup causing stale nextcheck time
  - scsi: qla2xxx: Free sp in error path to fix system crash
  - scsi: qla2xxx: Delay module unload while fabric scan in progress
  - scsi: qla2xxx: Validate sp before freeing associated memory
  - dcache: Limit the minimal number of bucket to two
  - !20872 Fix CVE-2026-23220
  - !20846 Fix CVE-2026-23193
  - !20815 Fix CVE-2026-23216
  - !20859 Fix CVE-2026-23179
  - !20871  CVE-2026-23096
  - !20858 ub: ubase: resolve the cmdq crq overflow problem
  - bpf: Deprecate hisock unused kfuncs and orig ingress logic
  - bpf: Add local connect support for hisock
  - bpf: Add ipv4-mapped ipv6 addr support for hisock
  - bpf: Add target comm parse to hisock_cmd
  - bpf: Add multi port parse to hisock_cmd
  - bpf: Only deploy hisock in server
  - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress
  - bpf: Add bpf_handle_ingress/egress_ptype kfunc
  - bpf: Add bpf_get_skb_ethhdr kfunc
  - bpf: Add bpf_set_ingress/egress_dev kfunc
  - bpf: Add bpf_set_ingress_dst kfunc
  - bpf: Add BPF_HISOCK_INGRESS attach type
  - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted
  - smb: client: fix potential UAF and double free in smb2_open_file()
  - smb/client: fix memory leak in smb2_open_file()
  - !20852  ASoC: amd: fix memory leak in acp3x pdm dma ops
  - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths
  - uacce: fix cdev handling in the cleanup path
  - Revert "uacce: fix for cdev memory leak"
  - ub:hisi-ubus: fix bug of security smatch
  - ub:ubus: injected route event
  - ub:ubus: Black Box Development
  - !20865 urma: urma support uboe
  - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure
  - urma: urma support uboe
  - !20857 ub_fwctl driver adds support for querying some functions
  - ub:ub_fwctl:Add illegal verification for scc
  - ub:ub_fwctl:Support querying the historical status of port links
  - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove
  - drm/amdkfd: Don't use sw fault filter if retry cam enabled
  - ub:ub_fwctl:Support querying firmware version numbers
  - ub: ub_fwctl: Support querying real-time bandwidth statistics
  - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels
  - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  - !20854 [URMA] add ping server for urma_ping
  - urma: add ping server
  - ub: ubase: resolve the cmdq crq overflow problem
  - ub: ubase: Optimized the QoS code naming to improve code readability.
  - ub: ubase&unic: optimizing code and configuration settings.
  - net: unic: not support query and configure ip by control plane in UBoE
  - net: unic: fix the automatically enable uc guid promisc mode.
  - !20844 urma:kernel header of userctl
  - urma: Kernel-mode header file for Jetty extension interface
  - ASoC: amd: fix memory leak in acp3x pdm dma ops
  - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
  - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
  - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
  - !20835 Fix CVE-2026-23084
  - minmax: add a few more MIN_T/MAX_T users
  - minmax: simplify and clarify min_t()/max_t() implementation
  - minmax: avoid overly complicated constant expressions in VM code
  - rtc: pcf2127: fix SPI command byte for PCF2131 backport
  - xhci: dbc: Fix full DbC transfer ring after several reconnects
  - xhci: dbc: decouple endpoint allocation from initialization
  - phy: ti: omap-usb2: fix device leak at unbind
  - phy: Use device_get_match_data()
  - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
  - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
  - ASoC: wm8974: Correct PLL rate rounding
  - ASoC: wm8940: Correct typo in control name
  - ASoC: wm8940: Correct PLL rate rounding
  - io_uring: include dying ring in task_work "should cancel" state
  - io_uring: backport io_should_terminate_tw()
  - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
  - selftests: mptcp: avoid spurious errors on TCP disconnect
  - selftests: mptcp: connect: catch IO errors on listen side
  - rds: ib: Increment i_fastreg_wrs before bailing out
  - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
  - mmc: mvsdio: Fix dma_unmap_sg() nents value
  - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
  - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface
  - btrfs: tree-checker: fix the incorrect inode ref size check
  - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page()
  - LoongArch: Check the return value when creating kobj
  - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled
  - LoongArch: Update help info of ARCH_STRICT_ALIGN
  - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
  - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
  - net: liquidio: fix overflow in octeon_init_instr_queue()
  - bonding: don't set oif to bond dev when getting NS target destination
  - net/mlx5e: Consider aggregated port speed during rate configuration
  - i40e: remove redundant memory barrier when cleaning Tx descs
  - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
  - selftests: mptcp: sockopt: fix error messages
  - mptcp: tfo: record 'deny join id0' info
  - mptcp: set remote_deny_join_id0 on SYN recv
  - dpaa2-switch: fix buffer pool seeding for control traffic
  - btrfs: fix invalid extref key setup when replaying dentry
  - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
  - wifi: mac80211: fix incorrect type for ret
  - wifi: mac80211: increase scan_ies_len for S1G
  - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
  - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches
  - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
  - !20776 ub:ubfi: Release the chosen node
  - !20817  CVE-2026-23094
  - !20819  dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
  - ub:ubus: Add port num check
  - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer
  - !20830  sched/soft_domain: Increasing NR_MAX_CLUSTER to 32
  - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32
  - btrfs: fix incorrect readahead expansion length
  - x86: disable image size check for test builds
  - drm/i915/power: fix size for for_each_set_bit() in abox iteration
  - drm/amdgpu: fix a memory leak in fence cleanup when unloading
  - net: mdiobus: release reset_gpio in mdiobus_unregister_device()
  - phy: ti-pipe3: fix device leak at unbind
  - phy: tegra: xusb: fix device and OF node leak at probe
  - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate
  - usb: gadget: midi2: Fix MIDI2 IN EP max packet size
  - usb: gadget: midi2: Fix missing UMP group attributes initialization
  - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
  - RISC-V: Remove unnecessary include from compat.h
  - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active()
  - hrtimer: Remove unused function
  - regulator: sy7636a: fix lifecycle of power good gpio
  - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
  - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
  - hsr: use rtnl lock when iterating over ports
  - net: hsr: Add VLAN CTAG filter support
  - net: hsr: Add support for MC filtering at the slave device
  - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
  - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
  - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
  - igb: fix link test skipping when interface is admin down
  - docs: networking: can: change bcm_msg_head frames member to support flexible array
  - tunnels: reset the GSO metadata before reusing the skb
  - net: bridge: Bounce invalid boolopts
  - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
  - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
  - USB: serial: option: add Telit Cinterion FN990A w/audio compositions
  - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
  - serial: sc16is7xx: fix bug in flow control levels init
  - tty: hvc_console: Call hvc_kick in hvc_write unconditionally
  - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups"
  - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
  - Input: iqs7222 - avoid enabling unused interrupts
  - mm/khugepaged: fix the address passed to notifier on testing young
  - btrfs: fix corruption reading compressed range when block size is smaller than page size
  - btrfs: use readahead_expand() on compressed extents
  - mm/damon/sysfs: fix use-after-free in state_show()
  - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
  - mtd: nand: raw: atmel: Fix comment in timings preparation
  - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
  - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
  - mm/damon/core: set quota->charged_from to jiffies at first charge window
  - fuse: prevent overflow in copy_file_range return value
  - fuse: check if copy_file_range() returns larger than requested size
  - mtd: rawnand: stm32_fmc2: fix ECC overwrite
  - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
  - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups
  - i2c: i801: Hide Intel Birch Stream SoC TCO WDT
  - ocfs2: fix recursive semaphore deadlock in fiemap call
  - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
  - compiler-clang.h: define __SANITIZE_*__ macros only when undefined
  - EDAC/altera: Delete an inappropriate dma_free_coherent() call
  - rcu-tasks: Maintain real-time response in rcu_tasks_postscan()
  - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks
  - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks
  - s390/cpum_cf: Deny all sampling events by counter PMU
  - NFSv4/flexfiles: Fix layout merge mirror check.
  - NFSv4.2: Serialise O_DIRECT i/o and copy range
  - NFSv4.2: Serialise O_DIRECT i/o and clone range
  - NFSv4.2: Serialise O_DIRECT i/o and fallocate()
  - NFS: Serialise O_DIRECT i/o and truncate()
  - fs/nfs/io: make nfs_start_io_*() killable
  - ftrace/samples: Fix function size computation
  - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
  - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
  - media: i2c: imx214: Fix link frequency validation
  - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs()
  - nfsd: Fix a regression in nfsd_setattr()
  - kasan: fix GCC mem-intrinsic prefix with sw tags
  - kunit: kasan_test: disable fortify string checker on kasan_strings() test
  - io_uring: fix kabi broken in struct io_ring_ctx
  - io_uring: Support forcing sq thread to be idle and woken up by hrtimer
  - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
  - uacce: fix isolate sysfs check condition
  - Revert "uacce: fix isolate sysfs check condition"
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
  - smb/server: fix refcount leak in smb2_open()
  - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
  - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
  - md: suspend array while updating raid_disks via sysfs
  - scsi: core: Wake up the error handler when final completions race against each other
  - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
  - ub:ubfi: Release the chosen node
  - ub:ubus: Delete unused functions
  - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption


author: Li Nan <linan122@huawei.com> - 6.6.0-142.0.0.124
changelog:
  - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise.
  - !21192 urma: bugfix of ubagg&ubcore&uburma
  - !21183  platform/x86: classmate-laptop: Add missing NULL pointer checks
  - urma: bugfix of ubagg&ubcore&uburma
  - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise.
  - platform/x86: classmate-laptop: Add missing NULL pointer checks
  - !21167 urma: fix kernel codecheck issues.
  - !21174 urma: change return value for provider err
  - !21127 urma: copy linked ports when importing bond jetty/seg
  - !20247 ubcore: query primary eid in ipourma loopback mode.
  - !21077 Fix hisi cca bugs
  - ubcore: route query refine and ipo loopback adapt.
  - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device.
  - hisi-cca-da: Write NS STE for PF drivers.
  - hisi-cca-da: Provide IO interfaces
  - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices
  - !21045  scsi: hisi_sas: Fix NULL pointer exception when do user_scan()
  - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe.
  - !21165  tools/interference: add ifstool utility for kernel interference statistics
  - !21166 urma: fix jfce uaf in batch cleanup
  - !21043 urma: fix tjetty ref in ping server
  - urma: change return value for provider err
  - !21128  sched/rt: Skip currently executing CPU in rto_next_cpu()
  - !21129  procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  - urma: fix jfce uaf in batch cleanup
  - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver
  - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches
  - urma: fix kernel codecheck issues.
  - tools/interference: add ifstool utility for kernel interference statistics
  - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor
  - !21092  kexec: derive purgatory entry from symbol
  - !21154  sched: Add SOFT_DOMAIN feature interface for cgroup2
  - !21153  fix CVE-2025-39981
  - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm"
  - urma: fix tjetty ref in ping server
  - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA
  - hisi-cca-da: Improve hisi cca dev validate and delegate
  - hisi-cca-da: Fix smmu enable rme problem
  - hisi-cca-da: Fix msi region shared problem
  - sched: Add SOFT_DOMAIN feature interface for cgroup2
  - Bluetooth: MGMT: Fix memory leak in set_ssp_complete
  - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
  - overflow: Introduce __DEFINE_FLEX for having no initializer
  - overflow: Fix direct struct member initialization in _DEFINE_FLEX()
  - overflow: Change DEFINE_FLEX to take __counted_by member
  - overflow: add DEFINE_FLEX() for on-stack allocs
  - Bluetooth: MGMT: Fix possible UAFs
  - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete()
  - !21103  Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()"
  - !21104 v2  vsock/virtio: cap TX credit to local buffer size
  - !21070  Fixes CVE-2026-23100
  - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs
  - !21088  ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
  - RDMA/hns: Support configure and query the CNP DSCP through sysfs
  - RDMA/hns: Support query FW cap bit
  - RDMA/hns: Support query HW ID.
  - !20934  smb/server: fix refcount leak in parse_durable_handle_context()
  - !21004  regmap: Fix race condition in hwspinlock irqsave routine
  - !19568 [OLK-6.6]fix txgbe clang compile warning
  - urma: copy linked ports when importing bond jetty/seg
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  - sched/rt: Skip currently executing CPU in rto_next_cpu()
  - !21073  scsi: qla2xxx: Fix bsg_done() causing double free
  - !21114  CVE-2024-57979
  - !21113  iommu: disable SVA when CONFIG_X86 is set
  - !20957  dmaengine: xilinx: xdma: Fix regmap max_register
  - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset
  - pps: Fix a use-after-free - fix kabi
  - pps: Fix a use-after-free
  - !21078  of: unittest: Fix memory leak in unittest_data_add()
  - !21079  *** fix CVE-2026-23208 ***
  - !21082  ALSA: aloop: Fix racy access at PCM trigger
  - !21083  bus: fsl-mc: fix use-after-free in driver_override_show()
  - iommu: disable SVA when CONFIG_X86 is set
  - vsock/virtio: cap TX credit to local buffer size
  - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()"
  - !20983 Fix CVE-2026-23139
  - !20878 Fix CVE-2026-23230
  - kexec: derive purgatory entry from symbol
  - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
  - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
  - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"
  - rtc: interface: Alarm race handling should not discard preceding error
  - perf test stat tests: Fix for virtualized machines
  - perf test stat: Update test expectations and events
  - perf test stat: Avoid hybrid assumption when virtualized
  - writeback: Avoid excessively long inode switching times
  - writeback: Avoid softlockup when switching many inodes
  - cramfs: Verify inode mode when loading from disk
  - fs: Add 'initramfs_options' to set initramfs mount options
  - minixfs: Verify inode mode when loading from disk
  - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume
  - irqchip/sifive-plic: Make use of __assign_bit()
  - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled
  - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
  - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
  - s390/bpf: Describe the frame using a struct instead of constants
  - s390/bpf: Centralize frame offset calculations
  - s390/bpf: Change seen_reg to a mask
  - ACPI: property: Do not pass NULL handles to acpi_attach_data()
  - ACPI: property: Add code comments explaining what is going on
  - ACPI: property: Disregard references in data-only subnode lists
  - ACPI: battery: Add synchronization between interface updates
  - ACPI: battery: Check for error code from devm_mutex_init() call
  - ACPI: battery: initialize mutexes through devm_ APIs
  - ACPI: battery: allocate driver data through devm_ APIs
  - arm64: mte: Do not flag the zero page as PG_mte_tagged
  - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
  - !20790  dm: use bio_clone_blkg_association
  - ipmi: Add HiSilicon IPMI Page Soft Offline driver
  - net: unic: Resolve network unavailability caused by concurrent activation and reset
  - net: unic: Provide the DFX capability for querying MNG table
  - net: unic: Delete the elr reset process after the tx timeout
  - bus: fsl-mc: fix use-after-free in driver_override_show()
  - ALSA: aloop: Fix racy access at PCM trigger
  - ALSA: usb-audio: Use the right limit for PCM OOB check
  - ALSA: usb-audio: Prevent excessive number of frames
  - of: unittest: Fix memory leak in unittest_data_add()
  - !21034  CVE-2026-23140
  - !21016  net: fix segmentation of forwarding fraglist GRO
  - !21017  mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
  - !21018  CVE-2026-23209
  - !21019  ipv6: annotate data-race in ndisc_router_discovery()
  - !20881  ipvlan: Make the addrs_lock be per port
  - rme: Imporve range delegate
  - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
  - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release
  - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan()
  - misc: fastrpc: Save actual DMA size in fastrpc_map structure
  - misc: fastrpc: Add missing dev_err newlines
  - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
  - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
  - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
  - media: mc: Clear minor number before put device
  - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
  - ACPICA: Allow to skip Global Lock initialization
  - ext4: validate ea_ino and size in check_xattrs
  - ext4: correctly handle queries for metadata mappings
  - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
  - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
  - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
  - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
  - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0
  - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
  - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
  - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
  - selftests: mptcp: join: validate C-flag + def limit
  - spi: cadence-quadspi: Flush posted register writes before DAC access
  - spi: cadence-quadspi: Flush posted register writes before INDAC access
  - PCI: tegra194: Handle errors in BPMP response
  - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
  - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
  - PCI: rcar-host: Drop PMSR spinlock
  - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
  - PCI/AER: Support errors introduced by PCIe r6.0
  - PCI/AER: Fix missing uevent on recovery when a reset is requested
  - PCI/ERR: Fix uevent on failure to recover
  - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
  - PCI/sysfs: Ensure devices are powered for config reads
  - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock
  - rseq/selftests: Use weak symbol reference, not definition, to link with glibc
  - rtc: interface: Fix long-standing race when setting alarm
  - rtc: interface: Ensure alarm irq is enabled when UIE is enabled
  - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
  - mmc: core: SPI mode remove cmd7
  - mtd: rawnand: fsmc: Default to autodetect buswidth
  - xtensa: simdisk: add input size check in proc_write_simdisk
  - sparc: fix error handling in scan_one_device()
  - sparc64: fix hugetlb for sun4u
  - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
  - sched/deadline: Fix race in push_dl_task()
  - pwm: berlin: Fix wrong register in suspend/resume
  - powerpc/pseries/msi: Fix potential underflow and leak issue
  - powerpc/powernv/pci: Fix underflow and leak issue
  - power: supply: max77976_charger: fix constant current reporting
  - pinctrl: samsung: Drop unused S3C24xx driver data
  - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
  - parisc: don't reference obsolete termio struct for TC* constants
  - openat2: don't trigger automounts with RESOLVE_NO_XDEV
  - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify
  - lib/genalloc: fix device leak in of_gen_pool_get()
  - KEYS: trusted_tpm1: Compare HMAC values in constant time
  - iommu/vt-d: PRS isn't usable if PDS isn't supported
  - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
  - init: handle bootloader identifier in kernel parameters
  - iio: xilinx-ams: Unmask interrupts after updating alarms
  - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK
  - iio: frequency: adf4350: Fix prescaler usage.
  - iio: dac: ad5421: use int type to store negative error codes
  - iio: dac: ad5360: use int type to store negative error codes
  - fs/ntfs3: Fix a resource leak bug in wnd_extend()
  - fbdev: Fix logic error in "offb" name match
  - crypto: rockchip - Fix dma_unmap_sg() nents value
  - crypto: atmel - Fix dma_unmap_sg() direction
  - crypto: aspeed - Fix dma_unmap_sg() direction
  - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
  - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
  - bus: mhi: ep: Fix chained transfer handling in read path
  - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
  - blk-crypto: fix missing blktrace bio split events
  - drm/nouveau: fix bad ret code in nouveau_bo_move_prep
  - drm/rcar-du: dsi: Fix 1/2/3 lane support
  - media: lirc: Fix error handling in lirc_register()
  - media: venus: firmware: Use correct reset sequence for IRIS2
  - media: pci: ivtv: Add missing check after DMA map
  - media: mc: Fix MUST_CONNECT handling for pads with no links
  - media: i2c: mt9v111: fix incorrect type for ret
  - media: cx18: Add missing check after DMA map
  - firmware: meson_sm: fix device leak at probe
  - xen/events: Update virq_to_irq on migration
  - xen/events: Return -EEXIST for bound VIRQs
  - xen/manage: Fix suspend error path
  - xen/events: Cleanup find_virq() return codes
  - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
  - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
  - arm64: dts: ti: k3-am62a-main: Fix main padcfg length
  - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
  - arm64: dts: qcom: msm8939: Add missing MDSS reset
  - arm64: dts: qcom: msm8916: Add missing MDSS reset
  - ACPI: debug: fix signedness issues in read/write helpers
  - ACPI: property: Fix buffer properties extraction for subnodes
  - gpio: wcd934x: mark the GPIO controller as sleeping
  - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
  - smb: client: fix missing timestamp updates after utime(2)
  - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
  - drm/amd/display: Properly disable scaling on DCE6
  - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
  - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
  - drm/amdgpu: Add additional DCE6 SCL registers
  - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
  - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
  - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
  - perf python: split Clang options when invoking Popen
  - tools build: Align warning options with perf
  - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
  - drm/vmwgfx: Fix copy-paste typo in validation
  - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
  - LoongArch: Init acpi_gbl_use_global_lock to false
  - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init()
  - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
  - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
  - clk: tegra: do not overallocate memory for bpmp clocks
  - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
  - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
  - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags()
  - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
  - perf evsel: Ensure the fallback message is always written to
  - perf tools: Add fallback for exclude_guest
  - perf test: Add a test for default perf stat command
  - perf test: Don't leak workload gopipe in PERF_RECORD_*
  - perf session: Fix handling when buffer exceeds 2 GiB
  - perf arm_spe: Correct memory level for remote access
  - perf arm_spe: Correct setting remote access
  - rtc: optee: fix memory leak on driver removal
  - rtc: x1205: Fix Xicor X1205 vendor prefix
  - perf util: Fix compression checks returning -1 as bool
  - clk: at91: peripheral: fix return value
  - libperf event: Ensure tracing data is multiple of 8 sized
  - perf evsel: Avoid container_of on a NULL leader
  - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
  - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
  - clocksource/drivers/clps711x: Fix resource leaks in error paths
  - fscontext: do not consume log entries when returning -EMSGSIZE
  - fs: always return zero on success from replace_fd()
  - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches
  - scsi: qla2xxx: Fix bsg_done() causing double free
  - !21065 Fix CVE-2026-23069
  - !21062 v4  Support multi-level cgroup
  - !20987 Fix CVE-2026-23212
  - !20982 Fix CVE-2026-23119
  - !20979 Fix CVE-2026-23111
  - !20974 Fix CVE-2026-23099
  - !20973 Fix CVE-2026-23105
  - !20972 Fix CVE-2026-23074
  - !20884  ksmbd: add chann_lock to protect ksmbd_chann_list xarray
  - !20947 Fix CVE-2026-23101
  - ext4: clear i_state_flags when alloc inode
  - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
  - Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
  - fs/ntfs3: fix mount failure for sparse runs in run_unpack()
  - !20825  efivarfs: fix error propagation in efivar_entry_get()
  - !20824  io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem
  - mm/rmap: fix two comments related to huge_pmd_unshare()
  - mm/hugetlb: fix two comments related to huge_pmd_unshare()
  - mm/hugetlb: fix hugetlb_pmd_shared()
  - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
  - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers
  - vsock/virtio: fix potential underflow in virtio_transport_get_credit()
  - !21001 Fix CVE-2026-23229
  - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
  - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode
  - !20999 Fix CVE-2026-23173
  - usb: typec: tipd: Clear interrupts first
  - bus: fsl-mc: Check return value of platform_get_resource()
  - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()
  - Input: atmel_mxt_ts - allow reset GPIO to sleep
  - misc: fastrpc: Skip reference for DMA handles
  - misc: fastrpc: fix possible map leak in fastrpc_put_args
  - misc: fastrpc: Fix fastrpc_map_lookup operation
  - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
  - ext4: fix checks for orphan inodes
  - ksmbd: fix error code overwriting in smb2_get_info_filesystem()
  - LoongArch: Automatically disable kaslr if boot from kexec_file
  - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
  - mfd: rz-mtu3: Fix MTU5 NFCR register offset
  - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down
  - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
  - vhost: vringh: Modify the return value check
  - net/mlx5: fw reset, add reset timeout work
  - net/mlx5: pagealloc: Fix reclaim race during command interface teardown
  - net/mlx5: Stop polling for command response if interface goes down
  - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
  - nfp: fix RSS hash key size when RSS is not supported
  - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands
  - drivers/base/node: fix double free in register_one_node()
  - hwrng: ks-sa - fix division by zero in ks_sa_rng_init
  - KEYS: X.509: Fix Basic Constraints CA flag parsing
  - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
  - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
  - vhost: vringh: Fix copy_to_iter return value check
  - RDMA/siw: Always report immediate post SQ errors
  - usb: vhci-hcd: Prevent suspending virtually attached devices
  - NFSv4.1: fix backchannel max_resp_sz verification check
  - coresight: trbe: Return NULL pointer for allocation failures
  - coresight: etm4x: Support atclk
  - coresight-etm4x: Conditionally access register TRCEXTINSELR
  - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
  - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert()
  - vfio/pds: replace bitmap_free with vfree
  - sparc: fix accurate exception reporting in copy_{from,to}_user for M7
  - sparc: fix accurate exception reporting in copy_to_user for Niagara 4
  - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
  - wifi: mac80211: fix Rx packet handling when pubsta information is not available
  - wifi: ath10k: avoid unnecessary wait for service ready message
  - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
  - IB/sa: Fix sa_local_svc_timeout_ms read race
  - RDMA/core: Resolve MAC of next-hop device without ARP support
  - f2fs: fix zero-sized extent for precache extents
  - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
  - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
  - scsi: qla2xxx: edif: Fix incorrect sign of error code
  - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
  - f2fs: fix to truncate first page in error path of f2fs_truncate()
  - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
  - wifi: mt76: fix potential memory leak in mt76_wmac_probe()
  - RDMA/cm: Rate limit destroy CM ID timeout error message
  - drivers/base/node: handle error properly in register_one_node()
  - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
  - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
  - iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
  - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed()
  - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
  - fs: ntfs3: Fix integer overflow in run_unpack()
  - drm/msm/dpu: fix incorrect type for ret
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
  - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
  - misc: genwqe: Fix incorrect cmd field being reported in error
  - usb: gadget: configfs: Correctly set use_os_string at bind
  - usb: phy: twl6030: Fix incorrect type for ret
  - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
  - tcp: fix __tcp_close() to only send RST when required
  - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
  - wifi: mwifiex: send world regulatory domain to driver
  - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
  - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
  - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
  - drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
  - drm/amd/pm: Fix si_upload_smc_data (v3)
  - drm/amd/pm: Disable ULV even if unsupported (v3)
  - drm/amdgpu: Power up UVD 3 for FW validation (v2)
  - coresight: Only register perf symlink for sinks with alloc_buffer
  - inet: ping: check sock_net() in ping_get_port() and ping_lookup()
  - media: st-delta: avoid excessive stack usage
  - ALSA: lx_core: use int type to store negative error codes
  - media: rj54n1cb0c: Fix memleak in rj54n1_probe()
  - scsi: myrs: Fix dma_alloc_coherent() error check
  - hwrng: nomadik - add ARM_AMBA dependency
  - crypto: keembay - Add missing check after sg_nents_for_len()
  - drm/amd/display: Remove redundant semicolons
  - serial: max310x: Add error checking in probe()
  - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
  - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
  - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
  - media: zoran: Remove zoran_fh structure
  - drm/bridge: it6505: select REGMAP_I2C
  - f2fs: fix condition in __allow_reserved_blocks()
  - drm/radeon/r600_cs: clean up of dead code in r600_cs
  - drm/panel: novatek-nt35560: Fix invalid return value
  - bpf: Enforce expected_attach_type for tailcall compatibility
  - i2c: designware: Add disabling clocks when probe fails
  - i2c: designware: Fix clock issue when PM is disabled
  - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
  - thermal/drivers/qcom/lmh: Add missing IRQ includes
  - thermal/drivers/qcom: Make LMH select QCOM_SCM
  - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems
  - once: fix race by moving DO_ONCE to separate section
  - smp: Fix up and expand the smp_call_function_many() kerneldoc
  - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
  - i3c: master: svc: Recycle unused IBI slot
  - i3c: master: svc: Use manual response for IBI events
  - ACPICA: Fix largest possible resource descriptor index
  - pwm: tiehrpwm: Fix corner case in clock divisor calculation
  - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
  - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
  - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names
  - cpuidle: qcom-spm: fix device and OF node leaks at probe
  - firmware: firmware: meson-sm: fix compile-test default
  - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0
  - null_blk: Fix the description of the cache_size module argument
  - pinctrl: renesas: Use int type to store negative error codes
  - power: supply: cw2015: Fix a alignment coding style issue
  - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()
  - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property
  - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS
  - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax
  - block: use int to store blk_stack_limits() return value
  - selftests/nolibc: fix EXPECT_NZ macro
  - regulator: scmi: Use int type to store negative error codes
  - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
  - ARM: at91: pm: fix MCKx restore routine
  - pinctrl: meson-gxl: add missing i2c_d pinmux
  - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
  - leds: flash: leds-qcom-flash: Update torch current clamp setting
  - ARM: dts: renesas: porter: Fix CAN pin group
  - libbpf: Fix reuse of DEVMAP
  - bpf: Remove migrate_disable in kprobe_multi_link_prog_run
  - bpf/selftests: Fix test_tcpnotify_user
  - regmap: Remove superfluous check for !config in __regmap_init()
  - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
  - x86/vdso: Fix output operand size of RDPID
  - smb: server: fix IRD/ORD negotiation with the client
  - coresight: trbe: Prevent overflow in PERF_IDX2OFF()
  - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
  - selftests: arm64: Check fread return value in exec_target
  - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
  - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
  - filelock: add FL_RECLAIM to show_fl_flags() macro
  - !21022  KVM: Don't clobber irqfd routing type when deassigning irqfd
  - !20998  ceph: fix oops due to invalid pointer for kfree() in parse_longname()
  - !21023  l2tp: avoid one data-race in l2tp_tunnel_del_work()
  - xsched: fix potential NULL dereference in xsched_quota_timeout_update
  - xsched: remove the standalone xcu_cfs_cg_deinit() helper
  - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle
  - xsched: simplify root group check by direct comparison with root_xcg
  - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length
  - xsched/core: immediate cleanup of remaining operators on task exit
  - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization
  - xsched: modify xcu_cg_initialize_components helper
  - xsched: refactor xsched_entity initialization
  - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq
  - xsched: harden and clarify xcu_move_task() logic
  - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs
  - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling
  - xsched/quota: support multi-level cgroup
  - xsched: remove redundant xcu parameter from dequeue_ctx
  - xsched: update group shares using xcu_grp_shares_add/sub helpers
  - xsched: delete unused code
  - xsched/cfs: propagate group activation/deactivation up the hierarchy
  - xsched/cfs: move xruntime updates to pick/put paths
  - xsched: add has_running hook to xsched classes for wake-up eligibility check
  - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches
  - scsi: hisi_sas: Fix NULL pointer exception when do user_scan()
  - !21013  CVE-2026-23177
  - !21007  bonding: fix use-after-free due to enslave fail after slave array update
  - !21006  net: Fix CVE-2026-23204
  - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path
  - bpf, test_run: Subtract size of xdp_frame from allowed metadata size
  - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN
  - bpf: Make variables in bpf_prog_test_run_xdp less confusing
  - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K
  - !21015  libceph: reset sparse-read state in osd_fault()
  - !21024 ub: udma: bugfix related to print messages.
  - !20980 Fix CVE-2026-23126
  - !20922 Fix CVE-2026-23133
  - ub: udma: bugfix related to print messages.
  - l2tp: avoid one data-race in l2tp_tunnel_del_work()
  - KVM: Don't clobber irqfd routing type when deassigning irqfd
  - ipv6: annotate data-race in ndisc_router_discovery()
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path
  - macvlan: fix error recovery in macvlan_common_newlink()
  - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
  - net: fix segmentation of forwarding fraglist GRO
  - can: rcar_canfd: Fix CAN-FD mode as default
  - libceph: reset sparse-read state in osd_fault()
  - !21008 uvb: fix cis call return value and obtain
  - mm, shmem: prevent infinite loop on truncate race
  - mm/shmem, swap: fix race of truncate and swap entry split
  - net/9p: fix double req put in p9_fd_cancelled
  - riscv: mm: Do not restrict mmap address based on hint
  - riscv: mm: Use hint address in mmap if available
  - driver core/PM: Set power.no_callbacks along with power.no_pm
  - serial: stm32: allow selecting console when the driver is module
  - hid: fix I2C read buffer overflow in raw_event() for mcp2221
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
  - ALSA: usb-audio: Kill timer properly at removal
  - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list
  - can: rcar_canfd: Fix controller mode setting
  - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled
  - btrfs: ref-verify: handle damaged extent root tree
  - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
  - perf subcmd: avoid crash in exclude_cmds when excludes is empty
  - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list
  - dm-integrity: limit MAX_TAG_SIZE to 255
  - ASoC: amd: acp: Adjust pdm gain value
  - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
  - USB: serial: option: add SIMCom 8230C compositions
  - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
  - !20931 Fix CVE-2026-23060
  - uvb: fix cis call return value and obtain
  - bonding: fix use-after-free due to enslave fail after slave array update
  - net/sched: cls_u32: use skb_header_pointer_careful()
  - net: add skb_header_pointer_careful() helper
  - regmap: Fix race condition in hwspinlock irqsave routine
  - crypto: virtio - Add spinlock protection with virtqueue notification
  - net/mlx5e: TC, delete flows only for existing peers
  - !20967 net: hns3: modify code of judging if SMMU DMA is enabled
  - ceph: fix oops due to invalid pointer for kfree() in parse_longname()
  - !20969 Fix CVE-2026-23125
  - !20948 v4  arm64: Add memory poison recovery support for various paths
  - !20975  CVE-2026-23102
  - !20977 v4  support apei_page_offline_policy
  - bonding: annotate data-races around slave->last_rx
  - netfilter: nf_conncount: update last_gc only when GC has been performed
  - bonding: provide a net pointer to __skb_flow_dissect()
  - netdevsim: fix a race issue related to the operation on bpf_bound_progs list
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
  - apei/ghes: Add sysctl interface to control soft-offline page isolation
  - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages"
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
  - arm64/fpsimd: signal: Fix restoration of SVE context
  - arm64/fpsimd: signal: Consistently read FPSIMD context
  - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state
  - bonding: limit BOND_MODE_8023AD to Ethernet devices
  - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
  - net/sched: Enforce that teql can only be used as root qdisc
  - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
  - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers
  - net: hns3: modify code of judging if SMMU DMA is enabled
  - dmaengine: xilinx: xdma: Fix regmap max_register
  - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem
  - ub:ubus: Avoid getting empty uent from ubc
  - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory
  - arm64: send sig fault for user task when apei_claim_sea fails
  - arm64: add ras log during do_sea
  - arm64: move getting valid siaddr to the top of do_sea
  - arm64: mm: shmem: support poison recovery from shmem_file_read_iter()
  - arm64: fs: support poison recovery from __kernel_read()
  - iov_iter: add mc support for copy_page_to_iter
  - arm64: mm: support recovery from copy_{from/to}_user_page()
  - iov_iter: get rid of 'copy_mc' flag
  - leds: led-class: Only Add LED to leds_list when it is fully ready
  - wifi: ath10k: fix dma_free_coherent() pointer
  - smb/server: fix refcount leak in parse_durable_handle_context()
  - ksmbd: add chann_lock to protect ksmbd_chann_list xarray
  - ipvlan: Make the addrs_lock be per port
  - smb: client: split cached_fid bitfields to avoid shared-byte RMW races
  - efivarfs: fix error propagation in efivar_entry_get()
  - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  - dm: use bio_clone_blkg_association
  - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor
  - net: txgbe: fix clang compile warning


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-26.0.0.30
changelog:
  - !7198 v2  mm: prepare more high-order pages on pcplist
  - mm: prepare more high-order pages to be stored on the per-cpu lists
  - mm: page_alloc: use the correct THP order for THP PCP
  - !7196 v3  Backport folio feature and bugfix
  - mm: madvise: avoid split during MADV_PAGEOUT and MADV_COLD
  - mm: vmscan: avoid split during shrink_folio_list()
  - mm: swap: allow storage of all mTHP orders
  - mm: swap: update get_swap_pages() to take folio order
  - mm: swap: simplify struct percpu_cluster
  - mm: swap: free_swap_and_cache_nr() as batched free_swap_and_cache()
  - mm: swap: remove CLUSTER_FLAG_HUGE from swap_cluster_info:flags
  - mm/madvise: don't forget to leave lazy MMU mode in madvise_cold_or_pageout_pte_range()
  - mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range()
  - mm: support multi-size THP numa balancing
  - mm: factor out the numa mapping rebuilding into a new helper
  - mm: alloc_anon_folio: avoid doing vma_thp_gfp_mask in fallback cases
  - huge_memory.c: document huge page splitting rules more thoroughly
  - mm: convert folio_estimated_sharers() to folio_likely_mapped_shared()
  - mm/migrate: split source folio if it is on deferred split list
  - mm: hold PTL from the first PTE while reclaiming a large folio
  - madvise:madvise_cold_or_pageout_pte_range(): allow split while folio_estimated_sharers = 0
  - mm/filemap: don't decrease mmap_miss when folio has workingset flag
  - mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM
  - arm64: mm: swap: support THP_SWAP on hardware with MTE
  - mm: remove PageAnonExclusive assertions in unuse_pte()
  - mm: remove struct page from get_shadow_from_swap_cache
  - selftests: mm: fix unused and uninitialized variable warning
  - XArray: set the marks correctly when splitting an entry
  - mm/huge_memory: check new folio order when split a folio
  - mm: huge_memory: enable debugfs to split huge pages to any order
  - mm: thp: split huge page to any lower order pages
  - mm: page_owner: add support for splitting to any order in split page_owner
  - mm: memcg: make memcg huge page split support any order split
  - mm/page_owner: use order instead of nr in split_page_owner()
  - mm/memcg: use order instead of nr in split_page_memcg()
  - mm: support order-1 folios in the page cache
  - mm/huge_memory: only split PMD mapping when necessary in unmap_folio()
  - selftests/mm: split_huge_page_test: conform test to TAP format output
  - mm: huge_memory: use more folio api in __split_huge_page_tail()
  - mm/vmalloc: fix return value of vb_alloc if size is 0
  - mm: use memalloc_nofs_save() in page_cache_ra_order()
  - mm: madvise: pageout: ignore references rather than clearing young
  - mm: ratelimit stat flush from workingset shrinker
  - mm, oom:dump_tasks add rss detailed information printing
  - arm64/mm: improve comment in contpte_ptep_get_lockless()
  - arm64/mm: export contpte symbols only to GPL users
  - mm: page_alloc: enforce minimum zone size to do high atomic reserves
  - mm: page_alloc: correct high atomic reserve calculations
  - mm: fix draining remote pageset
  - !7190  entry: inline syscall enter/exit functions
  - entry: Move syscall_enter_from_user_mode() to header file
  - entry: Move enter_from_user_mode() to header file
  - entry: Move exit to usermode functions to header file
  - !7130 v2  openeuler_defconfig: update oedefconfig for the minimum set
  - openeuler_defconfig: update oedefconfig for the minimum set
  - !7141 spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
  - spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
  - spi: Add verification for the max_frequency provided by the firmware
  - !7136 Fix failed in acpi_gpiochip_find() by adding parent node match
  - gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match
  - !6778 v2 Fix two soc bugs of hip09
  - irqchip: gicv3: Add workaround for hip09 erratum 162200806
  - irqchip: gicv3: Add workaround for hip09 erratum 162200803
  - !7165 v2  tick/broadcast-hrtimer: Prevent the timer device on broadcast duty CPU from being disabled
  - tick/broadcast-hrtimer: Prevent the timer device on broadcast duty CPU from being disabled
  - !7184 v3  md: do not delete safemode_timer in mddev_suspend
  - md: do not delete safemode_timer in mddev_suspend
  - !7131 net: hns3: Fix ROH mac address initialization.
  - net: hns3: Fix ROH mac address initialization.
  - !7126 net: hns3: some bugfixes for hns3 driver
  - net: hns3: fix kernel crash when devlink reload during initialization
  - net: hns3: direct return when receive a unknown mailbox message
  - net: hns3: release PTP resources if pf initialization failed
  - net: hns3: change type of numa_node_mask as nodemask_t
  - net: hns3: using cpumask_copy when set value to cpumask_t
  - net: hns3: set irq affinity directly
  - net: hns3: use appropriate barrier function after setting a bit value
  - net: hns3: don't need to check an unsigned number is less than 0
  - net: hns3: add 
  - net: hns3: using user configure after hardware reset
  - net: hns3: add cond_resched() to hns3 ring buffer init process
  - net: hns3: fix kernel crash problem in concurrent scenario
  - net: hns3: fix port vlan filter not disabled issue
  - net: hns3: revert "net: hns3: fix port vlan filter not disabled problem in dynamic vlan mode"
  - !7159 【OLK 6.6】 backport some mailist patches for perf
  - drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
  - drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
  - drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - !7068  kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in kernfs_find_and_get_node_by_id()
  - kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in kernfs_find_and_get_node_by_id()
  - !7153  Backports for OLK-6.6
  - netfilter: br_netfilter: skip conntrack input hook for promisc packets
  - netfilter: bridge: confirm multicast packets before passing them up the stack
  - !7069  ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
  - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
  - !7075 RDMA/hns: Some bugfixes and cleanups
  - RDMA/hns: Fix soft lockup under heavy CEQE load
  - RDMA/hns: Fix sleeping in spin_lock critical section
  - RDMA/hns: Fix Use-After-Free of rsv_qp
  - RDMA/hns: Fix a missing check of atomic wr length
  - !3184 [OLK-6.6] add support for Zhaoxin ZXPAUSE instruction
  - x86/delay: add support for Zhaoxin ZXPAUSE instruction
  - !7078 v2  Backport four conflict stable patch
  - mm: turn folio_test_hugetlb into a PageType
  - mm/hugetlb: fix missing hugetlb_lock for resv uncharge
  - fork: defer linking file vma until vma is fully initialized
  - mm, treewide: introduce NR_PAGE_ORDERS
  - !7067 crypto: hisilicon fix some issues
  - uacce: fix for cdev memory leak
  - crypto: hisilicon/qm - adjust the internal processing sequence of the vf enable and disable
  - crypto: hisilicon/zip - optimize the address offset of the reg query function
  - !4084 riscv64: initial LIVEPATCH_WO_FTRACE support
  - riscv64: add initial livepatch support
  - livepatch: add arch hook before doing klp_resolve_symbols
  - !6868  irqchip/loongson-pch-pic: Update interrupt registration policy
  - irqchip/loongson-pch-pic: Update interrupt registration policy
  - !6004 [OLK-6.6] fix bug：ethtool -S and ethtool -x/X for mucse rnpm drvier
  - mucse: ethtool -S and ethtool -x/X for mucse rnpm drvier

   at the end when print msg


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-27.0.0.31
changelog:
  - !7527  ext4 iomap performance optimize
  - ext4: fallback to generic_perform_write once iov_iter_count <= PAGE_SIZE
  - iomap: export __iomap_write_{begin|end}
  - !7530  mm: more thp control for large folio
  - mm: correct the docs for thp_fault_alloc and thp_fault_fallback
  - mm: add docs for per-order mTHP counters and transhuge_page ABI
  - mm: add per-order mTHP anon_swpout and anon_swpout_fallback counters
  - mm: add per-order mTHP anon_fault_alloc and anon_fault_fallback counters
  - mm: add control to allow specified high-order pages stored on PCP list
  - mm: huge_memory: add thp mapping align control
  - mm: huge_memory: add folio_get_unmapped_area()
  - mm: filemap: make mTHP configurable for exec mapping
  - mm/filemap: Allow arch to request folio size for exec memory
  - mm/memcontrol: remove __mod_lruvec_page_state()
  - mm/khugepaged: use a folio more in collapse_file()
  - mm: remove inc/dec lruvec page state functions
  - !7521 v2  Avoiding false sharing in field access of tk_core
  - openeuler_defconfig: Enable CONFIG_ARCH_LLC_128_LINE_SIZE for Hisilicon platforms
  - timekeeping: Avoiding false sharing in field access of tk_core
  - !7182 v3  mm: mglru: reuse some legacy trace
  - mm: multi-gen LRU: reuse some legacy trace events
  - mm, vmscan: remove ISOLATE_UNMAPPED
  - trace-vmscan-postprocess: sync with tracepoints updates
  - !7219 Hygon model 6h L3 PMU event duplicate creating issue fix
  - perf/x86/uncore: Create L3 event strictly to the CPU vendor
  - !7474  sched/fair: set burst to zero when cfs bandwidth is cancelled
  - sched/fair: set burst to zero when set max to cpu.max
  - sched/fair: limit burst to zero when cfs bandwidth is toggled off
  - !7475  Makefile.oever: add OPENEULER_RELEASE for version.h
  - Makefile.oever: add OPENEULER_RELEASE for version.h
  - !6241 add pmu support for loongarch kvm
  - LoongArch: KVM: Add PMU support
  - !5654 [OLK-6.6] USB: UAS: return ENODEV when submit urbs fail with device not attached
  - USB: UAS: return ENODEV when submit urbs fail with device not attached
  - !5218 [OLK-6.6] Add HGSC_CERT_IMPORT ioctl interface for Hygon CPUs.
  - crypto: ccp: Implement CSV_HGSC_CERT_IMPORT ioctl command
  - crypto: ccp: Move the fixup code for Hygon psp to Hygon specific files
  - crypto: ccp: Bind specific sp_dev_vdata for Hygon secure processor
  - crypto: ccp: Introduce hygon specific interface to support driver
  - !6311 v2  ima: Avoid blocking in RCU read-side critical section
  - ima: Avoid blocking in RCU read-side critical section
  - !6837  fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - !5644 [OLK-6.6] x86/mce: Set bios_cmci_threshold for CMCI threshold
  - x86/mce: Set bios_cmci_threshold for CMCI threshold
  - !7454  add new kvm_type for Confidential VMs
  - kvm: add macro CONFIG_CVM_HOST to defconfig
  - kvm: add new kvm_type for cvm
  - !7405 v2  mm: prepare to support weighted interleaving mempolicy
  - mm: prepare to support weighted interleaving mempolicy
  - !7370 v2  sched: smart_grid: silence complier error
  - sched: smart_grid: silence complier error
  - !7227  arm64: arm_pmuv3: Correctly extract and check the PMUVer
  - arm64: arm_pmuv3: Correctly extract and check the PMUVer
  - !5291 [OLK-6.6] iommu/dma: Fix not fully traversing iova reservations issue
  - iommu/dma: Fix not fully traversing iova reservations issue
  - !6774 [OLK-6.6] merge upstream  4 wangxun related patches to fix i2c bug
  - Revert "net: txgbe: fix clk_name exceed MAX_DEV_ID limits"
  - Revert "net: txgbe: fix i2c dev name cannot match clkdev"
  - net: wangxun: add ethtool_ops for channel number
  - clkdev: Update clkdev id usage to allow for longer names
  - !7206 v2  sched: programmable: Allow set tag for pid 1.
  - sched: programmable: Allow set tag for pid 1.


author: Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-27.0.0.32
changelog:
  - Update the riscv-kernel patch for sg2042, rebase 6.6.0-27.0.0 and add features:
    - SPI Flash driver
    - kexec file raw image
    - HIGHMEM
  - This patch only applies to the RISC-V architecture, the related commit list:
  -
  - sg2042: Update sg2042 openeuler_defconfig
  - th1520: riscv: config: Enable th1520 support
  - riscv: thead: Use the wback_inv instead of wback_only
  - riscv: errata: thead: use pa based instructions for CMO
  - riscv: errata: thead: use riscv_nonstd_cache_ops for CMO
  - Revert "riscv: use VA+PA variant of CMO macros for DMA page preparation"
  - Revert "riscv: use VA+PA variant of CMO macros for DMA synchorization"
  - Revert "riscv: errata: cmo: add CMO macro variant with both VA and PA"
  - Revert "riscv: errata: Replace thead cache clean with flush"
  - Revert "riscv: errata: thead: use riscv_nonstd_cache_ops for CMO"
  - Revert "riscv: errata: thead: use pa based instructions for CMO"
  - riscv: mm: fix NOCACHE_THEAD does not set bit[61] correctly
  - riscv: mm: update T-Head memory type definitions
  - Revert "sg2042: riscv: changing T-Head PBMT attributes"
  - riscv: remove compression for riscv Image
  - th1520: cpufreq: correct typo in config name
  - th1520: riscv: dts: thead: Add Milk-V Meles board
  - th1520: cpufreq: light-mpw-cpufreq: fix -Wunused-variable in panic_cpufreq_notifier_call
  - th1520: cpufreq: light-mpw-cpufreq: fix cpu_pll1 already disabled warning
  - riscv: Add th1520-lichee-cluster-4a dts support (8G/16G)
  - riscv: dts: th1520-beaglev-ahead: add alias for emmc & sd
  - riscv: dts: th1520-lichee-pi-4a: add alias for emmc & sd
  - riscv: dts: lpi4a 16g support
  - th1520: perf vendor events riscv: add T-HEAD C9xx JSON file
  - th1520: riscv: dts: thead: Add PMU event node
  - riscv: pinctrl: th1520: fix build
  - riscv: dts: th1520: lpi4a: add rpmsg node
  - riscv: dts: th1520: add mbox client node
  - riscv: rpmsg: mailbox-client: sync thead sdk 1.4.2
  - riscv: panic: add thead sdk quirks
  - riscv: dts: add watchdog node
  - th1520: riscv: dts: Add th1520 reset device tree
  - th1520: reset: Add th1520 reset driver support
  - th1520: dt-bindings: reset: Document th1520 reset control
  - riscv: light_wdt: update sdk 1.4.2
  - th1520_light_event: update sdk 1.4.2
  - th1520_aon: update sdk 1.4.2
  - th1520: fix compile th1520-beaglev-ahead error
  - th1520: add TH1520 cpu frequency driver
  - th1520: riscv: errata: thead: use pa based instructions for CMO
  - th1520: riscv: errata: thead: use riscv_nonstd_cache_ops for CMO
  - riscv: dts: thead: Add TH1520 CPU reset node
  - th1520: riscv: dts: thead: Enable Lichee Pi 4A USB
  - th1520: riscv: dts: thead: Add Lichee Pi 4A IO expansions
  - th1520: riscv: dts: thead: Add TH1520 USB nodes
  - th1520: riscv: dts: thead: Add TH1520 I2C nodes
  - th1520: usb: dwc3: add T-HEAD TH1520 usb driver
  - th1520: dt-bindings: usb: Add T-HEAD TH1520 USB controller
  - th1520: riscv: dts: thead: Add BeagleV Ahead SDIO0 pins
  - th1520: riscv: dts: thead: Add Lichee Pi 4A SDIO0 pins
  - th1520: riscv: dts: thead: Add TH1520 ethernet nodes
  - th1520: net: stmmac: add glue layer for T-HEAD TH1520 SoC
  - th1520: dt-bindings: net: add T-HEAD dwmac support
  - th1520: dt-bindings: net: snps,dwmac: allow dwmac-3.70a to set pbl properties
  - th1520: riscv: dts: thead: Enable Lichee Pi 4A PWM fan
  - th1520: riscv: dts: thead: Add TH1520 PVT node
  - th1520: riscv: dts: thead: Add TH1520 PWM node
  - th1520: pwm: add T-HEAD PWM driver
  - th1520: dt-bindings: pwm: Add T-HEAD PWM controller
  - th1520: gpio: dwapb: Use generic request, free and set_config
  - riscv: dts: thead: Enable LicheePi 4A eMMC and microSD
  - riscv: dts: thead: Enable BeagleV Ahead eMMC and microSD
  - riscv: dts: thead: Add TH1520 mmc controllers and sdhci clock
  - riscv: defconfig: Enable mmc and dma drivers for T-Head TH1520
  - mmc: sdhci-of-dwcmshc: Add support for T-Head TH1520
  - mmc: sdhci: add __sdhci_execute_tuning() to header
  - dt-bindings: mmc: sdhci-of-dwcmhsc: Add T-Head TH1520 support
  - th1520: riscv: dtb: thead: Add BeagleV Ahead LEDs
  - th1520: riscv: dts: thead: Add TH1520 pinctrl settings for UART0
  - th1520: riscv: dts: thead: Adjust TH1520 GPIO labels
  - th1520: riscv: dts: thead: Add TH1520 GPIO ranges
  - th1520: riscv: dts: thead: Add TH1520 pin control nodes
  - th1520: pinctrl: Add driver for the T-Head TH1520 SoC
  - th1520: dt-bindings: pinctrl: Add thead,th1520-pinctrl bindings
  - th1520: dt-bindings: gpio: dwapb: allow gpio-ranges
  - sg2042: riscv: config: Enable sg2042 support
  - sg2042: drivers: rtc: disable BMC RTC device
  - sg2042: dts: add i2c-rtc ds1307 device node for single chip
  - sg2042: riscv:dts:modify dw gpio clock name
  - sg2042: drivers:pci:remove the err log of parsing pci
  - sg2042: driver: ipmi: support KVM and IPMI SI for BMC
  - sg2042: perf cpumap: Make counter as unsigned ints
  - sg2042: driver: radeon: deinit device during kexec
  - sg2042: kernel: schedule: Fix set_task_cpu() bug
  - sg2042: mm: Modify __find_max_addr for memory hole
  - sg2042: riscv: kernel: Optimize apply_relocate_add()
  - sg2042: riscv: mm: Clear compilation warning about last_cpupid
  - sg2042: kernel: tick: filter unnecessary printing
  - sg2042: kernel: Adjust the log level of the tick_switch_to_oneshot function
  - sg2042: driver: clk: Modify the timer clock is turned off defaultly
  - sg2042: drivers: clock: Add sophgo sg2042 multi-chip clock synchronous support
  - Revert "riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings"
  - Revert "riscv: Fix set_direct_map_default_noflush() to reset _PAGE_EXEC"
  - Revert "riscv: Fix wrong usage of lm_alias() when splitting a huge linear mapping"
  - sg2042: riscv: mm: Add high memory on riscv64 using sv39
  - sg2042: riscv/kexec: handle R_RISCV_ADD16 and R_RISCV_SUB16 relocation types
  - sg2042: riscv: kexec: Add image loader for kexec file
  - sg2042: drm/amd/display: Support DRM_AMD_DC_FP on RISC-V
  - sg2042: riscv: Factor out riscv-march-y to a separate Makefile
  - sg2042: riscv: Add support for kernel-mode FPU
  - sg2042: mango pci hack:broadcast when no MSI source known
  - sg2042: nvidia hda: force msi
  - sg2042: radeon hack: force 64-bit msi to fit top intc
  - sg2042: amdgpu: disable rebar
  - sg2042: ttm: disallow cached mapping
  - sg2042: driver: soc: Add sophgo sg2042 soc support
  - sg2042: drivers: pcie: Create msi-x whitelist,turn on msi-x for top intr
  - sg2042: driver: pcie: Add sophgo sg2042 soc support
  - sg2042: driver: net: Add sophgo sg2042 soc support
  - sg2042: driver: mtd: Add sophgo sg2042 soc support
  - sg2042: driver: mmc: Add sophgo sg2042 soc support
  - sg2042: driver: reset: Add sophgo sg2042 soc support
  - sg2042: driver: pinctrl: Add sophgo sg2042 soc support
  - sg2042: driver: clk: Add sophgo sg2042 soc support
  - sg2042: riscv: spinlock: Fix deadlock issue
  - sg2042: riscv: add smp_cond_load_acquire()
  - sg2042: riscv: add ioremap_wc for gpu
  - sg2042: riscv: changing T-Head PBMT attributes
  - sg2042: riscv: errata: thead: Make cache clean to flush
  - sg2042: riscv: use VA+PA variant of CMO macros for DMA page preparation
  - sg2042: riscv: use VA+PA variant of CMO macros for DMA synchorization
  - sg2042: riscv: errata: cmo: add CMO macro variant with both VA and PA
  - sg2042: riscv: errata: Replace thead cache clean with flush
  - sg2042: riscv: Kconfig: Set vector as default no
  - sg2042: riscv: Add sophgo sg2042 soc support


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-28.0.0.33
changelog:
  - !8010  mm/mempolicy.c: fix the out-of-bounds access issue in mpol_parse_str
  - mm/mempolicy.c: fix the out-of-bounds access issue in mpol_parse_str
  - !7997  mm: some misc bugfix
  - mm: vmalloc: bail out early in find_vmap_area() if vmap is not init
  - Revert "mm: support multi-size THP numa balancing"
  - mm: simplify thp_vma_allowable_order
  - mm: huge_memory: add the missing folio_test_pmd_mappable() for THP split statistics
  - mm/huge_memory: skip invalid debugfs new_order input for folio split
  - mm: prohibit the last subpage from reusing the entire large folio
  - mm/memory.c: do_numa_page(): remove a redundant page table read
  - mm: memory: fix shift-out-of-bounds in fault_around_bytes_set
  - !7966 [OLK-6.6] openeuler_defconfig: Modify openeuler-defconfig
  - openeuler_defconfig: Modify openeuler-defconfig
  - !7909  Scheduler load balance fixes
  - config: Disable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64
  - sched/numa: Fix numa imbalance in load_balance()
  - !7917  sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED
  - sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED
  - Revert "sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED"
  - !7902 v3  Revert "ACPI: Rename ACPI_HOTPLUG_CPU to include 'present'"
  - Revert "ACPI: Rename ACPI_HOTPLUG_CPU to include 'present'"
  - !7888 v3  mm: add thp anon pmd size mapping align control
  - mm: add thp anon pmd size mapping align control
  - !7730 v2  sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED
  - sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED
  - !7808  Bluetooth: L2CAP: Fix not validating setsockopt user input
  - Bluetooth: L2CAP: Fix not validating setsockopt user input
  - !7822  LoongArch: limit min pci msi-x/msi vector number when request more than 32 vectors
  - LoongArch: limit min pci msi-x/msi vector number when request more than 32 vectors
  - !7823  LoongArch: fix kdump not work when legacy mode disabled
  - LoongArch: fix efi map page table error
  - Revert "LoongArch: kdump: Add memory reservation for old kernel"
  - Revert "LoongArch: Fix kdump failure on v40 interface specification"
  - Revert "LoongArch: kdump: Add high memory reservation"
  - !7764 v2  mm: Some bugfix and optimization
  - mm/dynamic_pool: clear PG_hugetlb when demote hugepages
  - mm: optimise vmf_anon_prepare() for VMAs without an anon_vma
  - mm: delay the check for a NULL anon_vma
  - mm: assert the mmap_lock is held in __anon_vma_prepare()
  - mm/memory: change vmf_anon_prepare() to be non-static
  - mm: always initialise folio->_deferred_list
  - mm: page_alloc: control latency caused by zone PCP draining
  - mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio()
  - hugetlb: check for hugetlb folio before vmemmap_restore
  - hugetlb: set hugetlb page flag before optimizing vmemmap
  - mm: add alloc_contig_migrate_range allocation statistics
  - mm: convert free_zone_device_page to free_zone_device_folio
  - mm: combine __folio_put_small, __folio_put_large and __folio_put
  - mm: inline destroy_large_folio() into __folio_put_large()
  - mm: combine free_the_page() and free_unref_page()
  - mm: free non-hugetlb large folios in a batch
  - mm: increase folio batch size
  - mm: fix list corruption in put_pages_list
  - mm: remove folio from deferred split list before uncharging it
  - mm: convert free_swap_cache() to take a folio
  - mm: use a folio in __collapse_huge_page_copy_succeeded()
  - mm: convert free_pages_and_swap_cache() to use folios_put()
  - mm: remove lru_to_page()
  - mm: remove free_unref_page_list()
  - memcg: remove mem_cgroup_uncharge_list()
  - mm: free folios directly in move_folios_to_lru()
  - mm: free folios in a batch in shrink_folio_list()
  - mm: allow non-hugetlb large folios to be batch processed
  - mm: handle large folios in free_unref_folios()
  - mm: use __page_cache_release() in folios_put()
  - mm: use free_unref_folios() in put_pages_list()
  - mm: remove use of folio list from folios_put()
  - memcg: add mem_cgroup_uncharge_folios()
  - mm: use folios_put() in __folio_batch_release()
  - mm: add free_unref_folios()
  - mm: convert free_unref_page_list() to use folios
  - mm: make folios_put() the basis of release_pages()
  - !7812 [OLK-6.6] drm/phytium: Replace default efi fb0 with dc fb
  - drm/phytium: Replace default efi fb0 with dc fb
  - !7767  irqchip/loongson-eiointc: fix gsi register error
  - irqchip/loongson-eiointc: fix gsi register error
  - !7771  ext4: default enable iomap for buffered IO and large folio
  - ext4: default enable iomap for buffered IO and large folio
  - !7721 【OLK-6.6】bugfix from upstream v6.9 for AMD EPYC
  - x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range
  - x86/CPU/AMD: Do the common init on future Zens too
  - !7572 Fix pseudo nmi identifier undeclaration complilation error
  - arm64/cpufeature: Fix pseudo nmi identifier undeclaration complilation error
  - !7537 [OLK-6.6] irqchip/gic-v3: Fix one race condition due to NMI withdraw
  - irqchip/gic-v3: Fix one race condition due to NMI withdraw
  - !7164 [sync] PR-7143:  media: usbtv: Remove useless locks in usbtv_video_free()
  - media: usbtv: Remove useless locks in usbtv_video_free()
  - !6386 [OLK-6.6] Fix warnings for RNPVF driver with loongarch-allmodconfig
  - RNPVF: NET: Fix "'%d' directive output may be truncated" warnings
  - !5243 [OLK-6.6] Support PSP identification for Hygon 4th CPU and print secure features when running on Hygon CPUs
  - x86/config: Set CONFIG_HYGON_CSV by default
  - x86/cpu/hygon: Clear SME feature flag when not in use
  - x86/cpufeatures: Add CSV3 CPU feature
  - x86/cpufeatures: Add CPUID_8C86_0000_EDX CPUID leaf
  - x86/cpu: Detect memory encryption features on Hygon CPUs
  - KVM: SVM: Print Hygon CSV support info if support is detected
  - crypto: ccp: Print Hygon CSV API version when CSV support is detected
  - x86/mm: Print CSV info into the kernel log
  - x86/mm: Provide a Kconfig entry to build the HYGON memory encryption support into the kernel
  - Documentation/arch/x86: Add HYGON secure virtualization description
  - crypto: ccp: Add support to detect CCP devices on Hygon 4th CPUs
  - !7180 【3snic】 use same string “sssnic" for "Kernel driver in use" and "Kernel modules"
  - 3snic: use sssnic as kernel driver name
  - !7607  Fix allmodconfig build error
  - net/ethernet/huawei/hiroce3: Fix allmodconfig build error
  - !7583 [OLK-6.6] Fixed display error for ps23xx when using ast and pe2201 bmc card
  - drm/ast: Fixed display error for ps23xx when using ast bmc card
  - drm/phytium: Bugfix Xorg startup for ps23xx when using pe2201 bmc card
  - !7593  memcg_swap_qos: Backport two bugfix
  - mm/swapfile: fix infinite loop in get_swap_pages after set memory.swapfile
  - memcg: fix incorrect value of sysctl_memcg_swap_qos_stat
  - !7595  jbd2: speed up jbd2_transaction_committed()
  - jbd2: speed up jbd2_transaction_committed()
  - !5480 [OLK-6.6] Fix DMA RW sequence disorder issue
  - Add kh40000_iommu_dma_ops for KH-40000 platform
  - Add kh40000_direct_dma_ops for KH-40000 platform
  - !3133 [OLK-6.6] iommu/vt-d:Add support for detecting ACPI device in RMRR
  - iommu/vt-d: Add support for detecting ACPI namespace device in RMRR


author: Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-28.0.0.36
changelog:
  - riscv-kernel patch update to 6.6.0-29.0.0
  - Fix QEMU UEFI boot panic
  - Deal with riscv SoC dtb search path


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-30.0.0.38
changelog:
  - !8809 MPTCP Upstream part 1
  - net: bpf: Use sockopt_lock_sock() in ip_sock_set_tos()
  - inet: lock the socket in ip_sock_set_tos()
  - inet: implement lockless IP_TOS
  - inet: implement lockless IP_MTU_DISCOVER
  - inet: implement lockless IP_MULTICAST_TTL
  - !9141  Fix allmodconfig build frame size error
  - net/ethernet/huawei/hiroce3: Fix allmodconfig build frame size error
  - !9101  ext4: Skip moving extents if page writeback failed
  - ext4: Skip moving extents if page writeback failed
  - !9126  arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
  - arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
  - !9010 Backport 6.6.31&6.6.32 LTS patches from upstream
  - block: add a partscan sysfs attribute for disks
  - block: add a disk_has_partscan helper
  - Docs/admin-guide/mm/damon/usage: fix wrong example of DAMOS filter matching sysfs file
  - docs: kernel_include.py: Cope with docutils 0.21
  - admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET
  - KEYS: trusted: Do not use WARN when encode fails
  - remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
  - serial: kgdboc: Fix NMI-safety problems from keyboard reset code
  - usb: typec: tipd: fix event checking for tps6598x
  - usb: typec: ucsi: displayport: Fix potential deadlock
  - net: usb: ax88179_178a: fix link status when link is set to down/up
  - usb: dwc3: Wait unconditionally after issuing EndXfer command
  - binder: fix max_thread type inconsistency
  - drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()
  - erofs: reliably distinguish block based and fscache mode
  - erofs: get rid of erofs_fs_context
  - kselftest: Add a ksft_perror() helper
  - mmc: core: Add HS400 tuning in HS400es initialization
  - KEYS: trusted: Fix memory leak in tpm2_key_encode()
  - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
  - ice: remove unnecessary duplicate checks for VF VSI ID
  - ice: pass VSI pointer into ice_vc_isvalid_q_id
  - net: ks8851: Fix another TX stall caused by wrong ISR flag handling
  - drm/amd/display: Fix division by zero in setup_dsc_config
  - smb: smb2pdu.h: Avoid -Wflex-array-member-not-at-end warnings
  - ksmbd: add continuous availability share parameter
  - cifs: Add tracing for the cifs_tcon struct refcounting
  - smb: client: instantiate when creating SFU files
  - smb: client: fix NULL ptr deref in cifs_mark_open_handles_for_deleted_file()
  - smb3: add trace event for mknod
  - smb311: additional compression flag defined in updated protocol spec
  - smb311: correct incorrect offset field in compression header
  - cifs: Move some extern decls from .c files to .h
  - ksmbd: Fix spelling mistake "connction" -> "connection"
  - ksmbd: fix possible null-deref in smb_lazy_parent_lease_break_close
  - cifs: remove redundant variable assignment
  - cifs: fixes for get_inode_info
  - cifs: defer close file handles having RH lease
  - ksmbd: add support for durable handles v1/v2
  - ksmbd: mark SMB2_SESSION_EXPIRED to session when destroying previous session
  - smb: common: simplify compression headers
  - smb: common: fix fields sizes in compression_pattern_payload_v1
  - smb: client: negotiate compression algorithms
  - smb3: add dynamic trace point for ioctls
  - smb: client: return reparse type in /proc/mounts
  - smb: client: set correct d_type for reparse DFS/DFSR and mount point
  - smb: client: parse uid, gid, mode and dev from WSL reparse points
  - smb: client: introduce SMB2_OP_QUERY_WSL_EA
  - smb: client: Fix a NULL vs IS_ERR() check in wsl_set_xattrs()
  - smb: client: add support for WSL reparse points
  - smb: client: reduce number of parameters in smb2_compound_op()
  - smb: client: fix potential broken compound request
  - smb: client: move most of reparse point handling code to common file
  - smb: client: introduce reparse mount option
  - smb: client: retry compound request without reusing lease
  - smb: client: do not defer close open handles to deleted files
  - smb: client: reuse file lease key in compound operations
  - smb: client: get rid of smb311_posix_query_path_info()
  - smb: client: parse owner/group when creating reparse points
  - smb3: update allocation size more accurately on write completion
  - smb: client: handle path separator of created SMB symlinks
  - cifs: update the same create_guid on replay
  - ksmbd: Add kernel-doc for ksmbd_extract_sharename() function
  - cifs: set replay flag for retries of write command
  - cifs: commands that are retried should have replay flag set
  - smb: client: delete "true", "false" defines
  - smb: Fix some kernel-doc comments
  - cifs: new mount option called retrans
  - smb: client: don't clobber ->i_rdev from cached reparse points
  - cifs: new nt status codes from MS-SMB2
  - cifs: pick channel for tcon and tdis
  - cifs: minor comment cleanup
  - cifs: remove redundant variable tcon_exist
  - ksmbd: vfs: fix all kernel-doc warnings
  - ksmbd: auth: fix most kernel-doc warnings
  - cifs: remove unneeded return statement
  - cifs: get rid of dup length check in parse_reparse_point()
  - cifs: Pass unbyteswapped eof value into SMB2_set_eof()
  - smb3: Improve exception handling in allocate_mr_list()
  - cifs: fix in logging in cifs_chan_update_iface
  - smb: client: handle special files and symlinks in SMB3 POSIX
  - smb: client: cleanup smb2_query_reparse_point()
  - smb: client: allow creating symlinks via reparse points
  - smb: client: optimise reparse point querying
  - smb: client: allow creating special files via reparse points
  - smb: client: extend smb2_compound_op() to accept more commands
  - smb: client: Fix minor whitespace errors and warnings
  - smb: client: introduce cifs_sfu_make_node()
  - cifs: fix use after free for iface while disabling secondary channels
  - Missing field not being returned in ioctl CIFS_IOC_GET_MNT_INFO
  - smb3: minor cleanup of session handling code
  - smb3: more minor cleanups for session handling routines
  - smb3: minor RDMA cleanup
  - cifs: print server capabilities in DebugData
  - smb: use crypto_shash_digest() in symlink_hash()
  - Add definition for new smb3.1.1 command type
  - SMB3: clarify some of the unused CreateOption flags
  - cifs: Add client version details to NTLM authenticate message
  - md: fix kmemleak of rdev->serial
  - Revert "selftests/bpf: Add netkit to tc_redirect selftest"
  - btrfs: do not wait for short bulk allocation
  - keys: Fix overwrite of key expiration on instantiation
  - dmaengine: idxd: add a write() method for applications to submit work
  - dmaengine: idxd: add a new security check to deal with a hardware erratum
  - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist
  - Bluetooth: qca: fix firmware check error path
  - Bluetooth: qca: fix info leak when fetching fw build id
  - Bluetooth: qca: fix info leak when fetching board id
  - Bluetooth: qca: generalise device address check
  - Bluetooth: qca: fix NVM configuration parsing
  - Bluetooth: qca: add missing firmware sanity checks
  - Bluetooth: qca: fix wcn3991 device address check
  - Bluetooth: qca: fix invalid device address check
  - eventfs: Do not treat events directory different than other directories
  - tracefs: Still use mount point as default permissions for instances
  - tracefs: Reset permissions on remount if permissions are options
  - ksmbd: do not grant v2 lease if parent lease key and epoch are not set
  - ksmbd: avoid to send duplicate lease break notifications
  - ksmbd: off ipv6only for both ipv4/ipv6 binding
  - spi: microchip-core-qspi: fix setting spi bus clock rate
  - regulator: core: fix debugfs creation regression
  - nvme-pci: Add quirk for broken MSIs
  - selftests/mm: fix powerpc ARCH check
  - x86/apic: Don't access the APIC when disabling x2APIC
  - hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
  - net: fix out-of-bounds access in ops_init
  - arm64: dts: qcom: sa8155p-adp: fix SDHC2 CD pin configuration
  - drm/amd/display: Fix incorrect DSC instance for MST
  - drm/amd/display: Handle Y carry-over in VCP X.Y calculation
  - drm/i915/bios: Fix parsing backlight BDB data
  - drm/i915/gt: Automate CCS Mode setting during engine resets
  - drm/i915/audio: Fix audio time stamp programming for DP
  - drm/vmwgfx: Fix invalid reads in fence signaled events
  - drm/vmwgfx: Fix Legacy Display Unit
  - drm/ttm: Print the memory decryption status just once
  - drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
  - Revert "drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()"
  - drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()
  - mei: me: add lunar lake point M DID
  - clk: sunxi-ng: a64: Set minimum and maximum rate for PLL-MIPI
  - clk: sunxi-ng: common: Support minimum and maximum rate
  - slimbus: qcom-ngd-ctrl: Add timeout for wait operation
  - dyndbg: fix old BUG_ON in >control parser
  - ASoC: ti: davinci-mcasp: Fix race condition during probe
  - ASoC: tegra: Fix DSPK 16-bit playback
  - net: bcmgenet: synchronize UMAC_CMD access
  - net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
  - net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
  - xtensa: fix MAKE_PC_FROM_RA second argument
  - tipc: fix UAF in error path
  - e1000e: change usleep_range to udelay in PHY mdic access
  - kmsan: compiler_types: declare __no_sanitize_or_inline
  - iio: accel: mxc4005: Interrupt handling fixes
  - iio: pressure: Fixes BME280 SPI driver data
  - iio:imu: adis16475: Fix sync mode setting
  - dt-bindings: iio: health: maxim,max30102: fix compatible check
  - workqueue: Fix selection of wake_cpu in kick_pool()
  - mptcp: only allow set existing scheduler for net.mptcp.scheduler
  - mptcp: ensure snd_nxt is properly initialized on connect
  - mm/slab: make __free(kfree) accept error pointers
  - maple_tree: fix mas_empty_area_rev() null pointer dereference
  - btrfs: set correct ram_bytes when splitting ordered extent
  - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
  - firewire: ohci: fulfill timestamp for some local asynchronous transaction
  - ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
  - usb: typec: tcpm: Check for port partner validity before consuming it
  - usb: typec: tcpm: unregister existing source caps before re-registration
  - usb: typec: tcpm: clear pd_event queue in PORT_RESET
  - usb: dwc3: core: Prevent phy suspend during init
  - usb: xhci-plat: Don't include xhci.h
  - usb: gadget: f_fs: Fix a race condition when processing setup packets.
  - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
  - usb: gadget: uvc: use correct buffer size when parsing configfs lists
  - usb: gadget: composite: fix OS descriptors w_value logic
  - USB: core: Fix access violation during port device removal
  - usb: ohci: Prevent missed ohci interrupts
  - usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device
  - usb: typec: ucsi: Fix connector check on init
  - usb: typec: ucsi: Check for notifications after init
  - Reapply "drm/qxl: simplify qxl_fence_wait"
  - firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send()
  - drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2
  - drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible
  - drm/amd/display: Atom Integrated System Info v2_2 for DCN35
  - gpiolib: cdev: fix uninitialised kfifo
  - gpiolib: cdev: relocate debounce_period_us from struct gpio_desc
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users
  - drm/connector: Add 
  - drm/meson: dw-hdmi: add bandgap setting for g12
  - drm/meson: dw-hdmi: power up phy on device init
  - net: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21 family
  - net/smc: fix neighbour and rtable leak in smc_ib_find_route()
  - ipv6: prevent NULL dereference in ip6_output()
  - ipv6: annotate data-races around cnf.disable_ipv6
  - hsr: Simplify code for announcing HSR nodes timer setup
  - net-sysfs: convert dev->operstate reads to lockless ones
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - dt-bindings: net: mediatek: remove wrongly added clocks and SerDes
  - rxrpc: Only transmit one ACK per jumbo packet received
  - rxrpc: Fix congestion control algorithm
  - rxrpc: Fix the names of the fields in the ACK trailer struct
  - selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC
  - selftests/net: convert test_bridge_neigh_suppress.sh to run it in unique namespace
  - ipv6: Fix potential uninit-value access in __ip6_make_skb()
  - net: bridge: fix corrupted ethernet header on multicast-to-unicast
  - nfc: nci: Fix kcov check in nci_rx_work()
  - phonet: fix rtm_phonet_notify() skb allocation
  - hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
  - hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event()
  - hwmon: (corsair-cpro) Use a separate buffer for sending commands
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  - net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
  - Bluetooth: HCI: Fix potential null-ptr-deref
  - Bluetooth: msft: fix slab-use-after-free in msft_do_close()
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
  - ARM: 9381/1: kasan: clear stale stack poison
  - qibfs: fix dentry leak
  - SUNRPC: add a missing rpc_stat for TCP TLS
  - blk-iocost: do not WARN if iocg was already offlined
  - net:usb:qmi_wwan: support Rolling modules
  - drm/radeon: silence UBSAN warning (v3)
  - platform/x86: ISST: Add Granite Rapids-D to HPM CPU list
  - drm/nouveau/dp: Don't probe eDP ports twice harder
  - gpio: lpc32xx: fix module autoloading
  - fs/9p: drop inodes immediately on non-.L too
  - clk: Don't hold prepare_lock when calling kref_put()
  - gpio: crystalcove: Use -ENOTSUPP consistently
  - gpio: wcove: Use -ENOTSUPP consistently
  - powerpc/crypto/chacha-p10: Fix failure on non Power10
  - 9p: explicitly deny setlease attempts
  - fs/9p: fix the cache always being enabled on files with qid flags
  - fs/9p: translate O_TRUNC into OTRUNC
  - fs/9p: only translate RWX permissions for plain 9P2000
  - iommu: mtk: fix module autoloading
  - smb3: fix broken reconnect when password changing on the server by allowing password rotation
  - Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
  - uio_hv_generic: Don't free decrypted memory
  - hv_netvsc: Don't free decrypted memory
  - Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
  - Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
  - selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
  - amd/amdkfd: sync all devices to wait all processes being evicted
  - drm/amdgpu: Fix VCN allocation in CPX partition
  - drm/amd/display: Skip on writeback when it's not applicable
  - drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2
  - drm/amdgpu: Refine IB schedule error logging
  - tools/power/turbostat: Fix uncore frequency file string
  - MIPS: scall: Save thread_info.syscall unconditionally on entry
  - gpu: host1x: Do not setup DMA for virtual devices
  - blk-iocost: avoid out of bounds shift
  - scsi: target: Fix SELinux error when systemd-modules loads the target module
  - memblock tests: fix undefined reference to `BIT'
  - memblock tests: fix undefined reference to `panic'
  - memblock tests: fix undefined reference to `early_pfn_to_nid'
  - btrfs: always clear PERTRANS metadata during commit
  - btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
  - tools/power turbostat: Fix warning upon failed /dev/cpu_dma_latency read
  - tools/power turbostat: Print ucode revision only if valid
  - tools/power turbostat: Fix Bzy_MHz documentation typo
  - tools/power turbostat: Increase the limit for fd opened
  - tools/power turbostat: Fix added raw MSR output
  - firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - ata: sata_gemini: Check clk_enable() result
  - vboxsf: explicitly deny setlease attempts
  - net: bcmgenet: Reset RBUF on first open
  - ALSA: line6: Zero-initialize message buffers
  - scsi: ufs: core: Fix MCQ mode dev command timeout
  - scsi: ufs: core: WLUN suspend dev/link state error recovery
  - regulator: tps65132: Add of_match table
  - ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3 suspend
  - kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
  - selftests/ftrace: Fix event filter target_func selection
  - bpf: Check bloom filter map value size
  - drm/amdkfd: range check cp bad op exception interrupts
  - drm/amdkfd: Check cgroup when returning DMABuf info
  - btrfs: return accurate error code on open failure in open_fs_devices()
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
  - net: mark racy access on sk->sk_rcvbuf
  - wifi: iwlwifi: mvm: guard against invalid STA ID on removal
  - wifi: iwlwifi: read txq->read_ptr under lock
  - wifi: mac80211: fix prep_connection error path
  - wifi: cfg80211: fix rdev_dump_mpp() arguments order
  - wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
  - gfs2: Fix invalid metadata access in punch_hole
  - scsi: lpfc: Use a dedicated lock for ras_fwlog state
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
  - scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
  - scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling
  - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - scsi: ufs: core: Fix MCQ MAC configuration
  - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
  - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
  - swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y
  - powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
  - powerpc/pseries: make max polling consistent for longer H_CALLs
  - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - clk: qcom: smd-rpm: Restore msm8976 num_clk
  - net: gro: add flush check in udp_gro_receive_segment
  - net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb
  - net: gro: parse ipv6 ext headers without frag0 invalidation
  - ipv4: Fix uninit-value access in __ip_make_skb()
  - drm/panel: ili9341: Use predefined error codes
  - drm/panel: ili9341: Respect deferred probe
  - drm/panel: ili9341: Correct use of device property APIs
  - s390/qeth: Fix kernel panic after setting hsuid
  - vxlan: Pull inner IP header in vxlan_rcv().
  - tipc: fix a possible memleak in tipc_buf_append
  - rxrpc: Clients must accept conn from any address
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - net: bridge: fix multicast-to-unicast with fraglist GSO
  - spi: fix null pointer dereference within spi_sync
  - drm/amdgpu: fix doorbell regression
  - net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
  - cxgb4: Properly lock TX queue for the selftest.
  - s390/cio: Ensure the copied buf is NUL terminated
  - ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
  - ASoC: meson: cards: select SND_DYNAMIC_MINORS
  - ASoC: meson: axg-tdm-interface: manage formatters in trigger
  - ASoC: meson: axg-card: make links nonatomic
  - ASoC: meson: axg-fifo: use threaded irq to check periods
  - ASoC: meson: axg-fifo: use FIELD helpers
  - vxlan: Add missing VNI filter counter update in arp_reduce().
  - vxlan: Fix racy device stats updates.
  - net: qede: use return from qede_parse_actions()
  - net: qede: use return from qede_parse_flow_attr() for flow_spec
  - net: qede: use return from qede_parse_flow_attr() for flower
  - net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
  - ALSA: emu10k1: fix E-MU dock initialization
  - ALSA: emu10k1: move the whole GPIO event handling to the workqueue
  - ALSA: emu10k1: factor out snd_emu1010_load_dock_firmware()
  - ALSA: emu10k1: fix E-MU card dock presence monitoring
  - Fix a potential infinite loop in extract_user_to_sg()
  - s390/vdso: Add CFI for RA register to asm macro vdso_func
  - net l2tp: drop flow hash on forward
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  - octeontx2-af: avoid off-by-one read from userspace
  - bna: ensure the copied buf is NUL terminated
  - xdp: use flags field to disambiguate broadcast redirect
  - s390/mm: Fix clearing storage keys for huge pages
  - s390/mm: Fix storage key clearing for guest huge pages
  - ASoC: codecs: wsa881x: set clk_stop_mode1 flag
  - ASoC: Intel: avs: Set name of control as in topology
  - riscv, bpf: Fix incorrect runtime stats
  - bpf, arm64: Fix incorrect runtime stats
  - spi: axi-spi-engine: fix version format string
  - spi: axi-spi-engine: use common AXI macros
  - spi: axi-spi-engine: move msg state to new struct
  - spi: axi-spi-engine: use devm_spi_alloc_host()
  - spi: axi-spi-engine: simplify driver data allocation
  - spi: spi-axi-spi-engine: Use helper function devm_clk_get_enabled()
  - bpf: Fix a verifier verbose message
  - nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH
  - ASoC: SOF: Intel: add default firmware library path for LNL
  - ASoC: SOF: Introduce generic names for IPC types
  - regmap: Add regmap_read_bypassed()
  - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
  - regulator: change devm_regulator_get_enable_optional() stub to return Ok
  - regulator: change stubbed devm_regulator_get_enable to return Ok
  - regulator: mt6360: De-capitalize devicetree regulator subnodes
  - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
  - power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
  - power: rt9455: hide unused rt9455_boost_voltage_values
  - pinctrl: baytrail: Fix selecting gpio pinctrl state
  - nfs: Handle error of rpc_proc_register() in nfs_net_init().
  - nfs: make the rpc_stat per net namespace
  - nfs: expose /proc/net/sunrpc/nfs in net namespaces
  - sunrpc: add a struct rpc_stats arg to rpc_create_args
  - pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
  - pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
  - pinctrl: core: delete incorrect free in pinctrl_enable()
  - pinctrl/meson: fix typo in PDM's pin name
  - pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
  - Bluetooth: qca: add support for QCA2066
  - eeprom: at24: fix memory corruption race condition
  - eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
  - rust: kernel: require `Send` for `Module` implementations
  - wifi: nl80211: don't free NULL coalescing rule
  - rust: macros: fix soundness issue in `module!` macro
  - rust: module: place generated init_module() function in .init.text
  - mtd: limit OTP NVMEM cell parse to non-NAND devices
  - nvmem: add explicit config option to read old syntax fixed OF cells
  - dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
  - dmaengine: pl330: issue_pending waits until WFP state
  - !9104 [OLK-6.6] drm/phytium: Fix make allmodconfig build fail
  - DRM: Fix Phytium DRM build fail
  - !9085 [OLK-6.6] openeuler_defconfig: fix checkdefconfig fail
  - openeuler_defconfig: fix checkdefconfig fail
  - !8750  ubifs: Check @c->dirty_[n|p
  - ubifs: Check @c->dirty_[n|p]n_cnt and @c->nroot state under @c->lp_mutex
  - !8703 v2  IMA: Introduce a config to bypass i_version detection for Overlayfs issue
  - IMA: Introduce a config to bypass i_version detection for Overlayfs issue
  - !8621  LoongArch: fix HT RX INT TRANS register not initialized
  - LoongArch: fix HT RX INT TRANS register not initialized
  - !8440  arm64: cpufeature: Both the major and the minor version numbers need to be checked
  - arm64/mpam: skip mpam initialize under kdump kernel
  - arm64: cpufeature: Both the major and the minor version numbers need to be checked
  - !8107 [OLK 6.6]net: hns3: fix kernel crash when devlink reload  during pf/vf initialization
  - {topost} net: hns3: fix kernel crash when devlink reload during vf initialization
  - {topost} net: hns3: fix kernel crash when devlink reload during pf initialization
  - !8481  Fix vf init and common user permissions issue
  - net/ethernet/huawei/hiroce3: Fix vf init and common user permissions issue
  - !8576 【OLK-6.6】backport PCC patches to support shared interrupt for multiple subspaces and platform notification handling
  - soc: hisilicon: kunpeng_hccs: replace MAILBOX dependency with PCC
  - soc: hisilicon: kunpeng_hccs: Add the check for obtaining complete port attribute
  - mailbox: pcc: Support shared interrupt for multiple subspaces
  - mailbox: pcc: Add support for platform notification handling
  - !8471  ext4: Fixes len calculation in mpage_journal_page_buffers
  - ext4: Fixes len calculation in mpage_journal_page_buffers
  - !8496  mm/mlock: return EINVAL for illegal user memory range in mlock
  - mm/mlock: return EINVAL for illegal user memory range in mlock
  - !8435  LoongArch: add GMAC&GNET support
  - net: stmmac: dwmac-loongson: Add loongson module author
  - net: stmmac: dwmac-loongson: Move disable_force flag to _gnet_date
  - net: stmmac: dwmac-loongson: Add Loongson GNET support
  - net: stmmac: dwmac-loongson: Fixed failure to set network speed to 1000.
  - net: stmmac: dwmac-loongson: Add loongson_dwmac_config_legacy
  - net: stmmac: dwmac-loongson: Add full PCI support
  - net: stmmac: dwmac-loongson: Add phy_interface for Loongson GMAC
  - net: stmmac: dwmac-loongson: Add phy mask for Loongson GMAC
  - net: stmmac: dwmac-loongson: Add ref and ptp clocks for Loongson
  - net: stmmac: dwmac-loongson: Split up the platform data initialization
  - net: stmmac: dwmac-loongson: Use PCI_DEVICE_DATA() macro for device identification
  - net: stmmac: dwmac-loongson: Drop useless platform data
  - net: stmmac: Export dwmac1000_dma_ops
  - net: stmmac: Add multi-channel support
  - net: stmmac: Move the atds flag to the stmmac_dma_cfg structure
  - !7896  backport upstream stmmac related patches.
  - net: stmmac: Move MAC caps init to phylink MAC caps getter
  - net: stmmac: Rename phylink_get_caps() callback to update_caps()
  - net: phylink: provide mac_get_caps() method
  - !8450  sched/core: Fix incorrect initialization of the 'burst' parameter in cpu_max_write()
  - sched/core: Fix incorrect initialization of the 'burst' parameter in cpu_max_write()
  - !7482 v2  perf parse-events: Make legacy events lower priority than sysfs/JSON
  - perf x86 test: Update hybrid expectations
  - perf parse-events: Make legacy events lower priority than sysfs/JSON
  - !8309  xfs: Fix file creation failure
  - xfs: Fix file creation failure
  - !8183  perf pmu: Count sys and cpuid JSON events separately
  - perf pmu: Count sys and cpuid JSON events separately
  - !7077 v4  block: dicard bugfix
  - block: check io size before submit discard
  - block: fix overflow in blk_ioctl_discard()
  - !8353  mm/dynamic_pool: clear PG_hugetlb when promote hugepages
  - mm/dynamic_pool: clear PG_hugetlb when promote hugepages
  - !8151  LoongArch: Fix secondary bridge routing errors
  - LoongArch: Fix secondary bridge routing errors
  - !7948 【OLK-6.6】Fix BUILD REGRESSION warnings in bzwx N5/N6 series NIC drivers
  - drivers: Fix BUILD REGRESSION warnings in bzwx N5/N6 series NIC drivers
  - !8228  ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  - ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  - !6283  fix deadlock in cgroup1_writeback V2
  - cgroup_writeback: fix deadlock in cgroup1_writeback
  - cgroup_writeback: Revert "fix deadlock in cgroup1_writeback"
  - !8036  fix CVE-2024-27010
  - net/sched: fix kabi change in struct Qdisc
  - net/sched: Fix mirred deadlock on device recursion

   to message about demoting connector force-probes


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-31.0.0.39
changelog:
  - !9438 【OLK-6.6】RDMA/hns: Fix some mutex UAF
  - RDMA/hns: Fix some mutex UAF
  - !9394  CVE-2024-38587
  - speakup: Fix sizeof() vs ARRAY_SIZE() bug
  - !9405  drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - !9415  mm: drop the 'anon_' prefix for swap-out mTHP counters
  - mm: drop the 'anon_' prefix for swap-out mTHP counters
  - !9376  ALSA: core: Fix NULL module pointer assignment at card init
  - ALSA: core: Fix NULL module pointer assignment at card init
  - !9295  Port patches from OLK-5.10
  - livepatch: Enable CONFIG_LIVEPATCH_ISOLATE_KPROBE in openeuler_defconfig
  - livepatch: Avoid patching conflicts with kprobes
  - !9356  tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
  - tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
  - !9332  net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - !9355  f2fs: multidev: fix to recognize valid zero block address
  - f2fs: multidev: fix to recognize valid zero block address
  - !9329  af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - !9352 MPTCP Upstream part 10
  - MAINTAINERS: add Geliang as reviewer for MPTCP
  - mailmap: add entries for Geliang Tang
  - mptcp: fill in missing MODULE_DESCRIPTION()
  - netlink: fill in missing MODULE_DESCRIPTION()
  - netlink: specs: mptcp: rename the MPTCP path management spec
  - !9304 MPTCP Upstream part 9
  - selftests: mptcp: add mptcp_lib_wait_local_port_listen
  - selftests: mptcp: add mptcp_lib_check_transfer
  - selftests: mptcp: add mptcp_lib_make_file
  - selftests: mptcp: add missing oflag=append
  - !9307  of: module: add buffer overflow check in of_modalias()
  - of: module: add buffer overflow check in of_modalias()
  - !9331  Some folio bugfix
  - mm/memory: don't require head page for do_set_pmd()
  - mm/migrate: fix kernel BUG at mm/compaction.c:2761!
  - mm: huge_memory: fix misused mapping_large_folio_support() for anon folios
  - mm: shmem: fix getting incorrect lruvec when replacing a shmem folio
  - mm: fix possible OOB in numa_rebuild_large_mapping()
  - mm: support multi-size THP numa balancing
  - mm/rmap: do not add fully unmapped large folio to deferred split list
  - !9302  ring-buffer: Fix a race between readers and resize checks
  - ring-buffer: Fix a race between readers and resize checks
  - !9345  net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - !9346  net: bridge: xmit: make sure we have at least eth header len bytes
  - net: bridge: xmit: make sure we have at least eth header len bytes
  - !9301 MPTCP Upstream part 8
  - selftests: mptcp: userspace pm send RM_ADDR for ID 0
  - selftests: mptcp: userspace pm remove initial subflow
  - mptcp: userspace pm rename remove_err to out
  - selftests: mptcp: userspace pm create id 0 subflow
  - mptcp: add mptcpi_subflows_total counter
  - !9266 MPTCP Upstream part 7
  - net: fill in MODULE_DESCRIPTION()s for SOCK_DIAG modules
  - selftests: mptcp: sockopt: drop mptcp_connect var
  - mptcp: define more local variables sk
  - mptcp: move sk assignment statement ahead
  - !9262 MPTCP Upstream part 6
  - mptcp: use mptcp_get_ext helper
  - mptcp: use mptcp_check_fallback helper
  - mptcp: drop useless ssk in pm_subflow_check_next
  - mptcp: ignore notsent_lowat setting at the subflow level
  - mptcp: consolidate sockopt synchronization
  - !5257 [OLK-6.6] Support DOWNLOAD_FIRMWARE feature for hygon CSV
  - crypto: ccp: Implement CSV_DOWNLOAD_FIRMWARE ioctl command
  - crypto: ccp: Implement CSV_PLATFORM_SHUTDOWN ioctl command
  - crypto: ccp: Implement CSV_PLATFORM_INIT ioctl command
  - crypto: ccp: Support DOWNLOAD_FIRMWARE when detect CSV
  - !8058 Intel: Backport QuickAssist Technology(QAT) live migration support for in-tree driver
  - Enable QAT_VFIO_PCI as kernel module to support Intel QAT live migration
  - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
  - crypto: qat - specify firmware files for 402xx
  - crypto: qat - validate slices count returned by FW
  - crypto: qat - improve error logging to be consistent across features
  - crypto: qat - improve error message in adf_get_arbiter_mapping()
  - crypto: qat - implement dh fallback for primes > 4K
  - crypto: qat - Fix spelling mistake "Invalide" -> "Invalid"
  - crypto: qat - Avoid -Wflex-array-member-not-at-end warnings
  - vfio/qat: Add vfio_pci driver for Intel QAT SR-IOV VF devices
  - crypto: qat - implement interface for live migration
  - crypto: qat - add interface for live migration
  - crypto: qat - add bank save and restore flows
  - crypto: qat - expand CSR operations for QAT GEN4 devices
  - crypto: qat - rename get_sla_arr_of_type()
  - crypto: qat - relocate CSR access code
  - crypto: qat - move PFVF compat checker to a function
  - crypto: qat - relocate and rename 4xxx PF2VM definitions
  - crypto: qat - adf_get_etr_base() helper
  - !8304 [OLK-6.6] Backport TPMI based RAPL PMU support for next Intel Xeon Granite Rapids (GNR)
  - powercap: intel_rapl_tpmi: Enable PMU support
  - powercap: intel_rapl: Introduce APIs for PMU support
  - powercap: intel_rapl: Sort header files
  - !9245 MPTCP Upstream part 5
  - mptcp: prevent BPF accessing lowat from a subflow socket.
  - mptcp: use copy_from_iter helpers on transmit
  - mptcp: give rcvlowat some love
  - tcp: define initial scaling factor value as a macro
  - mptcp: use plain bool instead of custom binary enum
  - mptcp: add a new sysctl for make after break timeout
  - !8422 [OLK-6.6] Intel IAA Compression Accelerator Crypto Driver (iaa_crypto)
  - openeuler_defconfig: Add kernel config for Intel IAA crypto driver
  - dmaengine: idxd: Avoid unnecessary destruction of file_ida
  - dmaengine: idxd: Check for driver name match before sva user feature
  - crypto: iaa - Use cpumask_weight() when rebalancing
  - crypto: iaa - Fix some errors in IAA documentation
  - crypto: iaa - Change iaa statistics to atomic64_t
  - crypto: iaa - Add global_stats file and remove individual stat files
  - crypto: iaa - Remove comp/decomp delay statistics
  - crypto: iaa - fix decomp_bytes_in stats
  - crypto: iaa - Fix nr_cpus < nr_iaa case
  - crypto: iaa - fix the missing CRYPTO_ALG_ASYNC in cra_flags
  - crypto: iaa - Fix comp/decomp delay statistics
  - crypto: iaa - Fix async_disable descriptor leak
  - crypto: iaa - Remove unnecessary debugfs_create_dir() error check in iaa_crypto_debugfs_init()
  - crypto: iaa - Remove header table code
  - dmaengine: idxd: constify the struct device_type usage
  - dmaengine: idxd: make dsa_bus_type const
  - dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API
  - crypto: iaa - Account for cpu-less numa nodes
  - crypto: iaa - remove unneeded semicolon
  - crypto: iaa - Remove unneeded newline in update_max_adecomp_delay_ns()
  - crypto: iaa - Change desc->priv to 0
  - dmaengine: idxd: Add support for device/wq defaults
  - crypto: iaa - Add IAA Compression Accelerator stats
  - crypto: iaa - Add irq support for the crypto async interface
  - crypto: iaa - Add support for deflate-iaa compression algorithm
  - crypto: iaa - Add compression mode management along with fixed mode
  - crypto: iaa - Add per-cpu workqueue table with rebalancing
  - crypto: iaa - Add Intel IAA Compression Accelerator crypto driver core
  - crypto: iaa - Add IAA Compression Accelerator Documentation
  - dmaengine: idxd: add callback support for iaa crypto
  - dmaengine: idxd: Add wq private data accessors
  - dmaengine: idxd: Export wq resource management functions
  - dmaengine: idxd: Export descriptor management functions
  - dmaengine: idxd: Rename drv_enable/disable_wq to idxd_drv_enable/disable_wq, and export
  - dmaengine: idxd: add external module driver support for dsa_bus_type
  - dmaengine: idxd: Fix incorrect descriptions for GRPCFG register
  - dmaengine: idxd: add wq driver name support for accel-config user tool
  - dmaengine: idxd: rate limit printk in misc interrupt thread
  - !9230 MPTCP Upstream part 4
  - net: mptcp: use policy generated by YAML spec
  - net: mptcp: rename netlink handlers to mptcp_pm_nl_<blah>_{doit,dumpit}
  - uapi: mptcp: use header file generated from YAML spec
  - Documentation: netlink: add a YAML spec for mptcp
  - net: mptcp: convert netlink from small_ops to ops
  - !9229 v2  sched: smart_grid: fix potential NULL pointer dereference
  - sched: smart_grid: fix potential NULL pointer dereference
  - !9226 MPTCP Upstream part 3
  - tools: ynl-gen: add support for exact-len validation
  - tools: ynl: add uns-admin-perm to genetlink legacy
  - tools: ynl-gen: support limit names
  - tools: ynl-gen: support full range of min/max checks for integer values
  - tools: ynl-gen: track attribute use
  - !9217  memcg: attach memcg async reclaim worker to curcpu
  - memcg: attach memcg async reclaim worker to curcpu
  - !9173 MPTCP Upstream part 2
  - inet: implement lockless getsockopt(IP_MULTICAST_IF)
  - inet: lockless IP_PKTOPTIONS implementation
  - inet: implement lockless getsockopt(IP_UNICAST_IF)
  - inet: lockless getsockopt(IP_MTU)
  - inet: lockless getsockopt(IP_OPTIONS)


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-33.0.0.40
changelog:
  - !9779  CVE-2024-39461
  - clk: bcm: rpi: Assign ->num before accessing ->hws
  - !9801 loongarch平台config配置对kdump的支持
  - loongarch: configs: Configure degbuginfo
  - Fix the kdump second kernel boot failure
  - loongarch: Cleanup loongson3_defconfig with make savedefconfig
  - !9811  fix CVE-2024-39481
  - media: mc: Fix graph walk in media_pipeline_start
  - !9810  KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked
  - KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked
  - !9821  kdb: Fix buffer overflow during tab-complete
  - kdb: Fix buffer overflow during tab-complete
  - !9788  net: fix wrong return value in bpf_sock_ops_get_uid_gid
  - net: fix wrong return value in bpf_sock_ops_get_uid_gid
  - !9816  mm: mem_reliable: Make counting reliable task usage compatible with folio
  - mm: mem_reliable: Make counting reliable task usage compatible with folio
  - !9807  drm: zynqmp_dpsub: Always register bridge
  - drm: zynqmp_dpsub: Always register bridge
  - !9804  CVE-2024-36478
  - null_blk: Fix return value of nullb_device_power_store()
  - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
  - !9805  md: fix resync softlockup when bitmap size is less than array size
  - md: fix resync softlockup when bitmap size is less than array size
  - !9802  ax25: Fix reference count leak issue of net_device
  - ax25: Fix reference count leak issue of net_device
  - !9770  Add a switch to enable hungtask check for io
  - block: disable BLK_IO_HUNG_TASK_CHECK by default
  - block: add a switch to enable hungtask check for io
  - !9793  drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
  - drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
  - !9649  f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
  - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
  - !9732  CVE-2024-39469
  - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
  - nilfs2: return the mapped address from nilfs_get_page()
  - !9775  mm/slub: Reduce memory consumption in extreme scenarios
  - mm/slub: Reduce memory consumption in extreme scenarios
  - !9614 v2  wifi: carl9170: add a proper sanity check for endpoints
  - wifi: carl9170: add a proper sanity check for endpoints
  - !9709  cgroup: fix uaf when proc_cpuset_show
  - cgroup: fix uaf when proc_cpuset_show
  - !9748  cxl/pci: Skip to handle RAS errors if CXL.mem device is detached
  - cxl/pci: Skip to handle RAS errors if CXL.mem device is detached
  - !8877  drm/vmwgfx: Fix invalid reads in fence signaled events
  - drm/vmwgfx: Fix invalid reads in fence signaled events
  - !9730  efi: libstub: only free priv.runtime_map when allocated
  - efi: libstub: only free priv.runtime_map when allocated
  - !9679  cgroup/cpuset: Make cpuset hotplug processing synchronous
  - cgroup/cpuset: Make cpuset hotplug processing synchronous
  - !9757  net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - !9665  CVE-2024-38622
  - drm/msm/dpu: make error messages at dpu_core_irq_register_callback() more sensible
  - drm/msm/dpu: Add callback function pointer check before its call
  - drm/msm/dpu: stop using raw IRQ indices in the kernel output
  - drm/msm/dpu: make the irq table size static
  - drm/msm/dpu: add helper to get IRQ-related data
  - drm/msm/dpu: extract dpu_core_irq_is_valid() helper
  - drm/msm/dpu: remove irq_idx argument from IRQ callbacks
  - !9668  wifi: nl80211: Avoid address calculations via out of bounds array indexing
  - wifi: nl80211: Avoid address calculations via out of bounds array indexing
  - !9715  CVE-2024-38602
  - ax25: Fix reference count leak issues of ax25_dev
  - ax25: Use kernel universal linked list to implement ax25_dev_list
  - !9746 v2  Revert "ACPI: processor: Add support for processors described as container packages"
  - Revert "ACPI: processor: Add support for processors described as container packages"
  - !9736  net/9p: fix uninit-value in p9_client_rpc()
  - net/9p: fix uninit-value in p9_client_rpc()
  - !9596  iomap: fix warning in iomap_write_delalloc_release()
  - iomap: fix warning in iomap_write_delalloc_release()
  - !9703  dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - !9642  CVE-2024-38582
  - nilfs2: fix potential hang in nilfs_detach_log_writer()
  - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
  - !9687  greybus: lights: check return of get_channel_from_mode
  - greybus: lights: check return of get_channel_from_mode
  - !9678  crypto: bcm - Fix pointer arithmetic
  - crypto: bcm - Fix pointer arithmetic
  - !7918 [OLK-6.6]drivers: support Yunsilicon's metaScale/metaVisor series NICs
  - drivers: support Yunsilicon's MS and MV series NICs
  - !9619  r8169: Fix possible ring buffer corruption on fragmented Tx packets.
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets.
  - !9664  tls: fix missing memory barrier in tls_init
  - tls: fix missing memory barrier in tls_init
  - !9161  xfs: don't use current->journal_info
  - xfs: don't use current->journal_info
  - !9624  CVE-2024-38597
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
  - !9631  ACPI: APEI: Skip initialization of GHES_ASSIST structures for Machine Check Architecture
  - ACPI: APEI: Skip initialization of GHES_ASSIST structures for Machine Check Architecture
  - !9632  drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails
  - drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails
  - !9399 fix CVE-2024-38544 and CVE-2024-37356
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
  - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - !9341  serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - !9562  CVE-2024-38385
  - genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()
  - !9582 v2  eventfs: Fix a possible null pointer dereference in eventfs_find_events()
  - eventfs: Fix a possible null pointer dereference in eventfs_find_events()
  - !9588  s390/ap: Fix crash in AP internal function modify_bitmap()
  - s390/ap: Fix crash in AP internal function modify_bitmap()
  - !9513  RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - !9561 v2  virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - !9578  net/mlx5: Discard command completions in internal error
  - net/mlx5: Discard command completions in internal error
  - !9549  btrfs: fix crash on racing fsync and size-extending write into prealloc
  - btrfs: fix crash on racing fsync and size-extending write into prealloc
  - !9479  xfs: fix unlink vs cluster buffer instantiation race
  - xfs: fix unlink vs cluster buffer instantiation race
  - !9519 MPTCP Upstream part 12
  - mptcp: annotate lockless accesses around read-mostly fields
  - mptcp: annotate lockless access for token
  - mptcp: annotate lockless access for RX path fields
  - mptcp: annotate lockless access for the tx path
  - mptcp: annotate access for msk keys
  - !9557  i2c: acpi: Unbind mux adapters before delete
  - i2c: acpi: Unbind mux adapters before delete
  - !9555  smb: client: fix deadlock in smb2_find_smb_tcon()
  - smb: client: fix deadlock in smb2_find_smb_tcon()
  - !9489  fs/ntfs3: Check 'folio' pointer for NULL
  - fs/ntfs3: Check 'folio' pointer for NULL
  - !9482  fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - !9506  usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.
  - usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.
  - !9528  media: lgdt3306a: Add a check against null-pointer-def
  - media: lgdt3306a: Add a check against null-pointer-def
  - !9551  ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - !9478  watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - !9536  clk: bcm: dvp: Assign ->num before accessing ->hws
  - clk: bcm: dvp: Assign ->num before accessing ->hws
  - !9463  fix CVE-2024-38621
  - media: stk1160: fix bounds checking in stk1160_copy_video()
  - !9457  bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - !9459  bpf: Fix verifier assumptions about socket->sk
  - bpf: Fix verifier assumptions about socket->sk
  - !9522  bonding: fix oops during rmmod
  - bonding: fix oops during rmmod
  - !9502  netrom: fix possible dead-lock in nr_rt_ioctl()
  - netrom: fix possible dead-lock in nr_rt_ioctl()
  - !9402  fs/ntfs3: Use variable length array instead of fixed size
  - fs/ntfs3: Use variable length array instead of fixed size
  - !9320  drm/amd/display: Fix potential index out of bounds in color transformation function
  - drm/amd/display: Fix potential index out of bounds in color transformation function
  - !9493  thermal/drivers/qcom/lmh: Check for SCM availability at probe
  - thermal/drivers/qcom/lmh: Check for SCM availability at probe
  - !9398  tracing/probes: fix error check in parse_btf_field()
  - tracing/probes: fix error check in parse_btf_field()
  - !9510  ftrace: Fix possible use-after-free issue in ftrace_location()
  - ftrace: Fix possible use-after-free issue in ftrace_location()
  - !9509  cifs: fix pagecache leak when do writepages
  - cifs: fix pagecache leak when do writepages
  - !9436 v2  ASoC: mediatek: Assign dummy when codec not specified for a DAI link
  - ASoC: mediatek: Assign dummy when codec not specified for a DAI link
  - !9486 [OLK-6.6] Fix os crash while enable sriov for rnp
  - RNPVF: NET: Fix os crash while enable sriov for rnp
  - !9371 MPTCP Upstream part 11
  - selftests: net: ip_local_port_range: define IPPROTO_MPTCP
  - selftests: mptcp: join: check CURRESTAB counters
  - selftests/net: add MPTCP coverage for IP_LOCAL_PORT_RANGE
  - mptcp: sockopt: support IP_LOCAL_PORT_RANGE and IP_BIND_ADDRESS_NO_PORT
  - mptcp: rename mptcp_setsockopt_sol_ip_set_transparent()
  - !5258 [OLK-6.6] Support request attestation report from CSV guest
  - driver/virt/coco: Add HYGON CSV Guest dirver.
  - KVM: x86: Support VM_ATTESTATION hypercall
  - !9485 v2  CVE-2024-38610
  - drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  - virt: acrn: stop using follow_pfn
  - !9380  psi: using cpuacct_cgrp_id under CONFIG_CGROUP_CPUACCT
  - psi: using cpuacct_cgrp_id under CONFIG_CGROUP_CPUACCT
  - !8899  block: fix module reference leakage from bdev_open_by_dev error path
  - block: fix module reference leakage from bdev_open_by_dev error path
  - !9445  blk-cgroup: fix list corruption from reorder of WRITE ->lqueued
  - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued
  - !9466  io_uring: check for non-NULL file pointer in io_file_can_poll()
  - io_uring: check for non-NULL file pointer in io_file_can_poll()
  - !9389  block: refine the EOF check in blkdev_iomap_begin
  - block: refine the EOF check in blkdev_iomap_begin
  - !9414  vfio/pci: fix potential memory leak in vfio_intx_enable()
  - vfio/pci: fix potential memory leak in vfio_intx_enable()
  - !9455  jffs2: prevent xattr node from overflowing the eraseblock
  - jffs2: prevent xattr node from overflowing the eraseblock
  - !9465  CVE-2024-38662
  - Revert "bpf, sockmap: Prevent lock inversion deadlock in map delete elem"
  - bpf: Allow delete from sockmap/sockhash only if update is allowed
  - !9410  Fix CVE-2024-31076
  - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
  - !9449  rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-34.0.0.41
changelog:
  - !10059  nilfs2: fix use-after-free of timer for log writer thread
  - nilfs2: fix use-after-free of timer for log writer thread
  - !10025  9p: add missing locking around taking dentry fid list
  - 9p: add missing locking around taking dentry fid list
  - !9835 fix CVE-2024-39479
  - drm/i915/hwmon: Get rid of devm
  - !9998  ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
  - ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
  - !9997  openrisc: traps: Don't send signals to kernel mode threads
  - openrisc: traps: Don't send signals to kernel mode threads
  - !9956  drm/komeda: check for error-valued pointer
  - drm/komeda: check for error-valued pointer
  - !9914  arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
  - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
  - !9944  f2fs: remove clear SB_INLINECRYPT flag in default_options
  - f2fs: remove clear SB_INLINECRYPT flag in default_options
  - !9909  sock_map: avoid race between sock_map_close and sk_psock_put
  - sock_map: avoid race between sock_map_close and sk_psock_put
  - !10045  misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe()
  - misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe()
  - !10055  media: v4l: async: Fix notifier list entry init
  - media: v4l: async: Fix notifier list entry init
  - !9900  ipv6: fix possible race in __fib6_drop_pcpu_from()
  - ipv6: fix possible race in __fib6_drop_pcpu_from()
  - !9979  CVE-2024-40972
  - ext4: do not create EA inode under buffer lock
  - ext4: fold quota accounting into ext4_xattr_inode_lookup_create()
  - !9988  netpoll: Fix race condition in netpoll_owner_active
  - netpoll: Fix race condition in netpoll_owner_active
  - !9945  ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
  - !9935  ALSA: hda: cs35l41: Possible null pointer dereference in cs35l41_hda_unbind()
  - ALSA: hda: cs35l41: Possible null pointer dereference in cs35l41_hda_unbind()
  - !9962  iommu/arm-smmu-v3: Change the style to identify the the hisi_platform
  - iommu/arm-smmu-v3: Change the style to identify the the hisi_platform
  - !9896  bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  - !9928  ocfs2: fix races between hole punching and AIO+DIO
  - ocfs2: fix races between hole punching and AIO+DIO
  - !9938  fix CVE-2024-40934
  - HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()
  - !9899  ionic: fix use after netif_napi_del()
  - ionic: fix use after netif_napi_del()
  - !9898  cpufreq: amd-pstate: fix memory leak on CPU EPP exit
  - cpufreq: amd-pstate: fix memory leak on CPU EPP exit
  - !9903  mptcp: ensure snd_una is properly initialized on connect
  - mptcp: ensure snd_una is properly initialized on connect
  - !9878  CVE-2024-39478
  - crypto: starfive - Do not free stack buffer
  - !9888  ipv6: sr: fix memleak in seg6_hmac_init_algo
  - ipv6: sr: fix memleak in seg6_hmac_init_algo
  - !5261 [OLK-6.6]Hygon: Some enhancement and bugfixes for HYGON CSV/CSV2
  - KVM: SVM: Unmap ghcb pages if they're still mapped when destroy guest
  - KVM: x86: Fix KVM_GET_MSRS stack info leak
  - KVM: SEV: Do not intercept accesses to MSR_IA32_XSS for SEV-ES guests
  - x86/head/64: Flush caches for .bss..decrypted section after CR3 switches to early_top_pgt
  - KVM: x86: Calls is_64_bit_hypercall() instead of is_64_bit_mode() in complete_hypercall_exit()
  - x86/csv2: Keep in atomic context when holding ghcb page if the #VC comes from userspace
  - KVM: SVM: Fix the available ASID range for CSV2 guest
  - !9861 MPTCP Upstream part 13
  - selftests: mptcp: lib: catch duplicated subtest entries
  - selftests: mptcp: explicitly trigger the listener diag code-path
  - bpf, btf: Add check_btf_kconfigs helper
  - bpf, btf: Fix return value of register_btf_id_dtor_kfuncs
  - !9876 v3  Fix xfs file creation issue
  - xfs: Avoid races with cnt_btree lastrec updates
  - Revert "xfs: Fix file creation failure"
  - !9877  gfs2: Fix potential glock use-after-free on unmount
  - gfs2: Fix potential glock use-after-free on unmount
  - !9862  ipvlan: Modify the value of ipvlan modes
  - ipvlan: Modify the value of ipvlan modes
  - !5260 [OLK-6.6] Support live migration for CSV/CSV2 guest, and support rebooting CSV/CSV2 guest
  - KVM: SVM: Force flush caches before reboot CSV guest
  - KVM: SVM: Add support for rebooting CSV2 guest
  - KVM: x86: Introduce control_{pre,post}_system_reset ioctl interfaces
  - KVM: SVM: Export MSR_AMD64_SEV_ES_GHCB to userspace for CSV2 guest
  - KVM: x86: Restore control registers in __set_sregs() to support CSV2 guest live migration
  - KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_VMSA command
  - KVM: SVM: Add KVM_SEV_SEND_UPDATE_VMSA command
  - crypto: ccp: Fix definition of struct sev_data_send_update_vmsa
  - KVM: SVM: Add RECEIVE_UPDATE_DATA command helper to support KVM_CSV_COMMAND_BATCH
  - KVM: SVM: Add SEND_UPDATE_DATA command helper to support KVM_CSV_COMMAND_BATCH
  - KVM: SVM: Prepare memory pool to allocate buffers for KVM_CSV_COMMAND_BATCH
  - KVM: SVM: Add KVM_CSV_COMMAND_BATCH command for applying CSV RING_BUFFER mode
  - crypto: ccp: Add support for issue commands in CSV RING_BUFFER mode
  - crypto: ccp: Add support to switch to CSV RING_BUFFER mode
  - crypto: ccp: Add support for dequeue status in CSV RING_BUFFER mode
  - crypto: ccp: Add support for enqueue command pointers in CSV RING_BUFFER mode
  - crypto: ccp: Introduce init and free helpers to manage CSV RING_BUFFER queues
  - !9294 Compiler: Add clang's PGO support for kernel.
  - Compiler: Add clang's PGO support for kernel.
  - !9610  rcu: Fix buffer overflow in print_cpu_stall_info()
  - rcu: Fix buffer overflow in print_cpu_stall_info()
  - !9845  xfs: fix log recovery buffer allocation for the legacy h_size fixup
  - xfs: fix log recovery buffer allocation for the legacy h_size fixup
  - !9859  block: enable BLK_IO_HUNG_TASK_CHECK by default
  - block: enable BLK_IO_HUNG_TASK_CHECK by default
  - !9857  drm/amdgpu/mes: fix use-after-free issue
  - drm/amdgpu/mes: fix use-after-free issue
  - !9829  fix CVE-2024-38620
  - Bluetooth: fix connection setup in l2cap_connect
  - Bluetooth: HCI: Remove HCI_AMP support
  - Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS
  - Bluetooth: Remove usage of the deprecated ida_simple_xx() API
  - Bluetooth: ISO: Fix BIS cleanup
  - !9838  cgroup: Fix AA deadlock caused by cgroup_bpf_release
  - cgroup: Fix AA deadlock caused by cgroup_bpf_release
  - !9841  ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension
  - ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension
  - !9834  mmc: davinci: Don't strip remove function when driver is builtin
  - mmc: davinci: Don't strip remove function when driver is builtin


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-35.0.0.43
changelog:
  - !9782  usb-storage: alauda: Check whether the media is initialized
  - usb-storage: alauda: Check whether the media is initialized
  - !10294 [OLK-6.6] drivers: Fix compile warning "argument used uninitialized"
  - drivers: Fix compile warning "argument used uninitialized"
  - !10257  media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
  - media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
  - !10287  CVE-2024-36979
  - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state
  - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
  - net: bridge: mst: fix vlan use-after-free
  - !10018  ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty()
  - ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty()
  - !9985  btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes
  - btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes
  - !10260 [RoCE]从社区回合patch到openEuler（OLK-6.6）
  - RDMA/hns: Fix mbx timing out before CMD execution is completed
  - RDMA/hns: Fix insufficient extend DB for VFs.
  - RDMA/hns: Fix undifined behavior caused by invalid max_sge
  - RDMA/hns: Fix shift-out-bounds when max_inline_data is 0
  - RDMA/hns: Fix missing pagesize and alignment check in FRMR
  - RDMA/hns: Fix unmatch exception handling when init eq table fails
  - RDMA/hns: Check atomic wr length
  - !10248  ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
  - ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
  - !9243  Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - !10160  fix CVE-2024-40915
  - riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context
  - !10264  mm: filemap: optimize semantic when thp_exec_enabled is set to 3
  - mm: filemap: optimize semantic when thp_exec_enabled is set to 3
  - !5264 [OLK-6.6]HYGON: Support CSV Reuse ASID feature on Hygon CPUs
  - KVM: SVM: Add support for different CSV guests to reuse the same ASID
  - !10231  fix CVE-2024-41007
  - tcp: avoid too many retransmit packets
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
  - !10233  fpga: bridge: add owner module and take its refcount
  - fpga: bridge: add owner module and take its refcount
  - !10237  ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger()
  - ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger()
  - !9915  powerpc/pseries: Enforce hcall result buffer validity and size
  - powerpc/pseries: Enforce hcall result buffer validity and size
  - !10148  fs/9p: fix uninitialized values during inode evict
  - fs/9p: fix uninitialized values during inode evict
  - !10056  io_uring/rsrc: don't lock while !TASK_RUNNING
  - io_uring/rsrc: don't lock while !TASK_RUNNING
  - !10226  cxl/region: Fix memregion leaks in devm_cxl_add_region()
  - cxl/region: Fix memregion leaks in devm_cxl_add_region()
  - !10177  ima: Fix use-after-free on a dentry's dname.name
  - ima: Fix use-after-free on a dentry's dname.name
  - !5262 [OLK-6.6]HYGON: Support Hygon DCU passthrough to VMs
  - x86/config: Set CONFIG_HYDCU_FIXUP_HEADER=y by default
  - drm/hygon: Add support to passthrough Hygon DCU to virtual machine
  - !10220  bpf: Fix overrunning reservations in ringbuf
  - bpf: Fix overrunning reservations in ringbuf
  - !10219  CVE-2024-35931
  - drm/amdgpu: Skip do PCI error slot reset during RAS recovery
  - drm/amdgpu : Add hive ras recovery check
  - !10167  CVE-2024-36022
  - drm/amdgpu: Init zone device and drm client after mode-1 reset on reload
  - drm/amdgpu: move the drm client creation behind drm device registration
  - drm/amdkfd: init drm_client with funcs hook
  - drm/amdkfd: Export DMABufs from KFD using GEM handles
  - !9598  fpga: manager: add owner module and take its refcount
  - fpga: manager: add owner module and take its refcount
  - !10139 [sync] PR-10095:  CVE-2024-40968
  - MIPS: Octeon: Add PCIe link status check
  - !10044  btrfs: fix CVE-2024-39496
  - btrfs: zoned: fix use-after-free due to race with dev replace
  - btrfs: zoned: factor out DUP bg handling from btrfs_load_block_group_zone_info
  - btrfs: zoned: factor out single bg handling from btrfs_load_block_group_zone_info
  - btrfs: zoned: factor out per-zone logic from btrfs_load_block_group_zone_info
  - btrfs: zoned: introduce a zone_info struct in btrfs_load_block_group_zone_info
  - !10114 v2  ecryptfs: Fix buffer size for tag 66 packet
  - ecryptfs: Fix buffer size for tag 66 packet
  - !10133  ALSA: timer: Set lower bound of start tick time
  - ALSA: timer: Set lower bound of start tick time
  - !10115  efi/unaccepted: touch soft lockup during memory accept
  - efi/unaccepted: touch soft lockup during memory accept
  - !10131  kunit/fortify: Fix mismatched kvalloc()/vfree() usage
  - kunit/fortify: Fix mismatched kvalloc()/vfree() usage
  - !10132  wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
  - wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
  - !10188  Part of "mm: mapcount for large folios + page_mapcount() cleanups"
  - mm/rmap: add fast-path for small folios when adding/removing/duplicating
  - mm/rmap: always inline anon/file rmap duplication of a single PTE
  - mm: allow for detecting underflows with page_mapcount() again
  - !10001  tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - !10176  f2fs: compress: don't allow unaligned truncation on released compress inode
  - f2fs: compress: don't allow unaligned truncation on released compress inode
  - !10106  platform/x86: x86-android-tablets: Unregister devices in reverse order
  - platform/x86: x86-android-tablets: Unregister devices in reverse order
  - !10109  tracing: Build event generation tests only as modules
  - tracing: Build event generation tests only as modules
  - !10166  drop_monitor: replace spin_lock by raw_spin_lock
  - drop_monitor: replace spin_lock by raw_spin_lock
  - !10161  RDMA/mlx5: Add check for srq max_sge attribute
  - RDMA/mlx5: Add check for srq max_sge attribute
  - !10111  drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
  - drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
  - !10155  wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - !10149  mips: bmips: BCM6358: make sure CBR is correctly set
  - mips: bmips: BCM6358: make sure CBR is correctly set
  - !10103 v2  fpga: region: add owner module and take its refcount
  - fpga: region: add owner module and take its refcount
  - !10097 [sync] PR-9741:  scsi: qedf: Ensure the copied buf is NUL terminated
  - scsi: qedf: Ensure the copied buf is NUL terminated
  - !10021  drm/exynos/vidi: fix memory leak in .get_modes()
  - drm/exynos/vidi: fix memory leak in .get_modes()
  - !10127  wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - !10117  wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - !10116  wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
  - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
  - !10017  liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - !10051  tipc: force a dst refcount before doing decryption
  - tipc: force a dst refcount before doing decryption
  - !10102  vmxnet3: disable rx data ring on dma allocation failure
  - vmxnet3: disable rx data ring on dma allocation failure
  - !10093  drm/arm/malidp: fix a possible null pointer dereference
  - drm/arm/malidp: fix a possible null pointer dereference
  - !9989  io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - !10083  CVE-2024-40955
  - ext4: clean up s_mb_rb_lock to fix build warnings with C=1
  - ext4: set the type of max_zeroout to unsigned int to avoid overflow
  - ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow
  - ext4: add positive int attr pointer to avoid sysfs variables overflow
  - ext4: add new attr pointer attr_mb_order
  - ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()
  - ext4: refactor out ext4_generic_attr_show()
  - ext4: refactor out ext4_generic_attr_store()
  - ext4: avoid overflow when setting values via sysfs
  - !10069  ALSA: Fix deadlocks with kctl removals at disconnection
  - ALSA: Fix deadlocks with kctl removals at disconnection
  - !10074  PCI: of_property: Return error for int_map allocation failure
  - PCI: of_property: Return error for int_map allocation failure
  - !10087  fix CVE-2024-40995
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
  - net/sched: act_api: rely on rcu in tcf_idr_check_alloc
  - !10064  net/mlx5: Always stop health timer during driver removal
  - net/mlx5: Always stop health timer during driver removal
  - !9240 v2  cachefiles: introduce failover mechanism
  - cachefiles: make on-demand read killable
  - cachefiles: flush all requests after setting CACHEFILES_DEAD
  - cachefiles: Set object to close if ondemand_id < 0 in copen
  - cachefiles: defer exposing anon_fd until after copy_to_user() succeeds
  - cachefiles: never get a new anonymous fd if ondemand_id is valid
  - cachefiles: add spin_lock for cachefiles_ondemand_info
  - cachefiles: add consistency check for copen/cread
  - cachefiles: remove err_put_fd label in cachefiles_ondemand_daemon_read()
  - cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()
  - cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd()
  - cachefiles: remove requests from xarray during flushing requests
  - cachefiles: add output string to cachefiles_obj_[get|put]_ondemand_fd
  - cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode
  - cachefiles: add restore command to recover inflight ondemand read requests
  - cachefiles: narrow the scope of triggering EPOLLIN events in ondemand mode
  - cachefiles: resend an open request if the read request's object is closed
  - cachefiles: extract ondemand info field from cachefiles_object
  - cachefiles: introduce object ondemand state
  - !9933  nvdimm: Backport some bugfixs
  - dax: alloc_dax() return ERR_PTR(-EOPNOTSUPP) for CONFIG_DAX=n
  - nvdimm/pmem: fix leak on dax_add_host() failure
  - !10038  media: v4l: async: Properly re-initialise notifier entry in unregister
  - media: v4l: async: Properly re-initialise notifier entry in unregister
  - !9970  CVE-2024-39503
  - netfilter: ipset: Fix suspicious rcu_dereference_protected()
  - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
  - netfilter: ipset: Add list flush to cancel_gc
  - !10011  xfs: fix mount hung while sb recover fail
  - xfs: fix mount hung while sb recover fail
  - !10050  vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - !10006  drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - !9959  parisc: Try to fix random segmentation faults in package builds
  - parisc: Try to fix random segmentation faults in package builds
  - !10028  ipv6: prevent possible NULL dereference in rt6_probe()
  - ipv6: prevent possible NULL dereference in rt6_probe()
  - !10005  seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
  - seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors


author: ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-37.0.0.44
changelog:
  - !10793  perf util: Add a function for replacing characters in a string
  - perf util: Add a function for replacing characters in a string
  - !10635  nvme: avoid double free special payload
  - nvme: avoid double free special payload
  - !10757  CVE-2024-41045
  - bpf: Defer work in bpf_timer_cancel_and_free
  - bpf: replace bpf_timer_cancel_and_free with a generic helper
  - bpf: replace bpf_timer_set_callback with a generic helper
  - !10729  Backport vmalloc 2 bugfix
  - mm: vmalloc: fix lockdep warning
  - mm/vmalloc: eliminated the lock contention from twice to once
  - !10746  irqchip/mbigen: Fix mbigen node address layout
  - irqchip/mbigen: Fix mbigen node address layout
  - !10533  backport mainline patchs
  - cpufreq: Allow drivers to advertise boost enabled
  - irqdomain: Fixed unbalanced fwnode get and put
  - !10518  xfs: add bounds checking to xlog_recover_process_data
  - xfs: add bounds checking to xlog_recover_process_data
  - !10622  leds: mlxreg: Use devm_mutex_init() for mutex initialization
  - leds: mlxreg: Use devm_mutex_init() for mutex initialization
  - !10677  gve: Account for stopped queues when reading NIC stats
  - gve: Account for stopped queues when reading NIC stats
  - !10639  s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception()
  - s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception()
  - !10653  virtcca cvm feature patches
  - gicv3: add lpi support for cvm guest
  - config: modify arm64 defconfig for virtcca cvm feature
  - mm: enable swiotlb alloc for cvm share mem
  - pmu: enable pmu phys irq inject for cvm
  - kvm: add virtcca cvm host feature
  - !10658  CVE-2024-35860
  - bpf: Fix a potential use-after-free in bpf_link_free()
  - Fix kabi breakage in struct bpf_link and bpf_link_ops
  - bpf: support deferring bpf_link dealloc to after RCU grace period
  - !10649  xfs: don't walk off the end of a directory data block
  - xfs: don't walk off the end of a directory data block
  - !10556  smart_grid: introducing rebuild_affinity_domain
  - smart_grid: introducing rebuild_affinity_domain
  - !10631  sched/deadline: Fix task_struct reference leak
  - sched/deadline: Fix task_struct reference leak
  - !10319  block: propagate partition scanning errors to the BLKRRPART ioctl
  - block: propagate partition scanning errors to the BLKRRPART ioctl
  - !10500  fix CVE-2024-42155
  - s390/pkey: Wipe copies of protected- and secure-keys
  - !10657 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.40-6.6.44 LTS Patches
  - fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT
  - nvme-pci: add missing condition check for existence of mapped data
  - io_uring: fix io_match_task must_hold
  - iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en
  - s390/cpum_cf: Fix endless loop in CF_DIAG event stop
  - s390/pci: Allow allocation of more than 1 MSI interrupt
  - s390/pci: Refactor arch_setup_msi_irqs()
  - ceph: fix incorrect kmalloc size of pagevec mempool
  - ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable
  - spi: spidev: add correct compatible for Rohm BH2228FV
  - ASoC: sof: amd: fix for firmware reload failure in Vangogh platform
  - nvme-pci: Fix the instructions for disabling power management
  - spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer
  - spi: microchip-core: fix init function not setting the master and motorola modes
  - spi: microchip-core: switch to use modern name
  - spi: microchip-core: only disable SPI controller when register value change requires it
  - spi: microchip-core: defer asserting chip select until just before write to TX FIFO
  - spi: microchip-core: fix the issues in the isr
  - ASoC: SOF: imx8m: Fix DSP control regmap retrieval
  - auxdisplay: ht16k33: Drop reference after LED registration
  - lirc: rc_dev_get_from_fd(): fix file leak
  - powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
  - apparmor: Fix null pointer deref when receiving skb during sock creation
  - mISDN: Fix a use after free in hfcmulti_tx()
  - bpf: Fix a segment issue when downgrading gso_size
  - net: nexthop: Initialize all fields in dumped nexthops
  - net: stmmac: Correct byte order of perfect_match
  - tipc: Return non-zero value from tipc_udp_addr2str() on error
  - netfilter: nft_set_pipapo_avx2: disable softinterrupts
  - ice: Fix recipe read procedure
  - net: bonding: correctly annotate RCU in bond_should_notify_peers()
  - ipv4: Fix incorrect source address in Record Route option
  - MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later
  - tools/resolve_btfids: Fix comparison of distinct pointer types warning in resolve_btfids
  - bpf, events: Use prog to emit ksymbol event for main program
  - dma: fix call order in dmam_free_coherent
  - af_unix: Disable MSG_OOB handling for sockets in sockmap/sockhash
  - libbpf: Fix no-args func prototype BTF dumping syntax
  - selftests/bpf: fexit_sleep: Fix stack allocation for arm64
  - kbuild: avoid build error when single DTB is turned into composite DTB
  - f2fs: fix to update user block counts in block_operations()
  - watchdog: rzg2l_wdt: Check return status of pm_runtime_put()
  - watchdog: rzg2l_wdt: Use pm_runtime_resume_and_get()
  - f2fs: fix start segno of large section
  - um: time-travel: fix signal blocking race/hang
  - um: time-travel: fix time-travel-start option
  - phy: zynqmp: Enable reference clock correctly
  - phy: cadence-torrent: Check return value on register read
  - dmaengine: ti: k3-udma: Fix BCHAN count with UHC and HC channels
  - jfs: Fix array-index-out-of-bounds in diFree
  - kdb: Use the passed prompt in kdb_position_cursor()
  - kdb: address -Wformat-security warnings
  - f2fs: fix to truncate preallocated blocks in f2fs_file_open()
  - s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception()
  - PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
  - PCI: Introduce cleanup helpers for device reference counts and locks
  - wifi: mac80211: track capability/opmode NSS separately
  - mm/mglru: fix ineffective protection calculation
  - nilfs2: handle inconsistent state in nilfs_btnode_create_block()
  - minmax: scsi: fix mis-use of 'clamp()' in sr.c
  - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
  - Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
  - video: logo: Drop full path of the input filename in generated file
  - lib/build_OID_registry: don't mention the full path of the script in output
  - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings
  - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
  - drm/panfrost: Mark simple_ondemand governor as softdep
  - drm/etnaviv: don't block scheduler when GPU is still active
  - MIPS: Loongson64: Test register availability before use
  - MIPS: Loongson64: reset: Prioritise firmware service
  - MIPS: Loongson64: Remove memory node for builtin-dtb
  - MIPS: Loongson64: env: Hook up Loongsson-2K
  - MIPS: dts: loongson: Fix GMAC phy node
  - MIPS: ip30: ip30-console: Add missing include
  - MIPS: dts: loongson: Add ISA node
  - remoteproc: imx_rproc: Fix refcount mistake in imx_rproc_addr_init
  - remoteproc: imx_rproc: Skip over memory region when node value is NULL
  - remoteproc: stm32_rproc: Fix mailbox interrupts queuing
  - rbd: don't assume rbd_is_lock_owner() for exclusive mappings
  - dm-verity: fix dm_is_verity_target() when dm-verity is builtin
  - selftests/sigaltstack: Fix ppc64 GCC build
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
  - platform: mips: cpu_hwmon: Disable driver on unsupported hardware
  - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
  - rtc: abx80x: Fix return value of nvmem callback on read
  - rtc: isl1208: Fix return value of nvmem callbacks
  - drm/i915/dp: Don't switch the LTTPR mode on an active link
  - drm/i915/dp: Reset intel_dp->link_trained before retraining the link
  - drm/amd/amdgpu: Fix uninitialized variable warnings
  - drm/amdgpu: reset vm state machine after gpu reset(vram lost)
  - drm/dp_mst: Fix all mstb marked as not probed after suspend/resume
  - drm/udl: Remove DRM_CONNECTOR_POLL_HPD
  - drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell
  - drm/i915/gt: Do not consider preemption during execlists_dequeue for gen8
  - perf/x86/intel/pt: Fix a topa_entry base address calculation
  - perf/x86/intel/pt: Fix topa_entry base length
  - perf/x86/intel/ds: Fix non 0 retire latency on Raptorlake
  - perf/x86/intel/uncore: Fix the bits of the CHA extended umask for SPR
  - perf stat: Fix the hard-coded metrics calculation on the hybrid
  - perf: Fix event leak upon exit
  - scsi: qla2xxx: validate nvme_local_port correctly
  - scsi: qla2xxx: Complete command early within lock
  - scsi: qla2xxx: Fix flash read failure
  - scsi: qla2xxx: Reduce fabric scan duplicate code
  - scsi: qla2xxx: Use QP lock to search for bsg
  - scsi: qla2xxx: Fix for possible memory corruption
  - scsi: qla2xxx: Unable to act on RSCN for port online
  - scsi: qla2xxx: During vport delete send async logout explicitly
  - scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE state
  - rtc: cmos: Fix return value of nvmem callbacks
  - mm/numa_balancing: teach mpol_to_str about the balancing mode
  - irqchip/imx-irqsteer: Handle runtime power management correctly
  - irqdomain: Fixed unbalanced fwnode get and put
  - devres: Fix memory leakage caused by driver API devm_free_percpu()
  - devres: Fix devm_krealloc() wasting memory
  - ice: Add a per-VF limit on number of FDIR filters
  - gve: Fix an edge case for TSO skb validity check
  - kobject_uevent: Fix OOB access within zap_modalias_env()
  - ASoC: amd: yc: Support mic on Lenovo Thinkpad E16 Gen 2
  - ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA on unprepare
  - kbuild: Fix '-S -c' in x86 stack protector scripts
  - decompress_bunzip2: fix rare decompression failure
  - mm: fix old/young bit handling in the faulting path
  - block: fix deadlock between sd_remove & sd_release
  - ubi: eba: properly rollback inside self_check_eba
  - clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use
  - f2fs: use meta inode for GC of COW file
  - f2fs: use meta inode for GC of atomic file
  - f2fs: fix return value of f2fs_convert_inline_inode()
  - f2fs: fix to don't dirty inode for readonly filesystem
  - f2fs: fix to force buffered IO on inline_data inode
  - ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value
  - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
  - fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
  - efi/libstub: Zero initialize heap allocated struct screen_info
  - hostfs: fix dev_t handling
  - dev/parport: fix the array out-of-bounds risk
  - binder: fix hang of unregistered readers
  - PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
  - PCI: dw-rockchip: Fix initial PERST# GPIO value
  - PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
  - parisc: Fix warning at drivers/pci/msi/msi.h:121
  - hwrng: amd - Convert PCIBIOS_* return codes to errnos
  - tools/memory-model: Fix bug in lock.cat
  - ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  - ALSA: usb-audio: Move HD Webcam quirk to the right place
  - ALSA: usb-audio: Fix microphone sound on HD webcam.
  - ALSA: ump: Force 1 Group for MIDI1 FBs
  - ALSA: ump: Don't update FB name for static blocks
  - KVM: nVMX: Request immediate exit iff pending nested event needs injection
  - KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked()
  - media: ivsc: csi: don't count privacy on as error
  - media: uvcvideo: Fix integer overflow calculating timestamp
  - jbd2: avoid infinite transaction commit loop
  - jbd2: precompute number of transaction descriptor blocks
  - jbd2: make jbd2_journal_get_max_txn_bufs() internal
  - media: imx-pxp: Fix ERR_PTR dereference in pxp_probe()
  - media: ivsc: csi: add separate lock for v4l2 control handler
  - leds: mt6360: Fix memory leak in mt6360_init_isnk_properties()
  - md/md-bitmap: fix writing non bitmap pages
  - leds: ss4200: Convert PCIBIOS_* return codes to errnos
  - drivers: soc: xilinx: check return status of get_api_version()
  - wifi: rtw88: usb: Fix disconnection after beacon loss
  - wifi: mwifiex: Fix interface type change
  - selftests/landlock: Add cred_transfer test
  - trace/pid_list: Change gfp flags in pid_list_fill_irq()
  - io_uring: tighten task exit cancellations
  - ext4: make sure the first directory block is not a hole
  - ext4: check dot and dotdot of dx_root before making dir indexed
  - m68k: amiga: Turn off Warp1260 interrupts during boot
  - udf: Avoid using corrupted block bitmap buffer
  - task_work: Introduce task_work_cancel() again
  - task_work: s/task_work_cancel()/task_work_cancel_func()/
  - cifs: mount with "unix" mount option for SMB1 incorrectly handled
  - cifs: fix reconnect with SMB1 UNIX Extensions
  - cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path
  - apparmor: use kvfree_sensitive to free data->data
  - drm/amd/display: Check for NULL pointer
  - scsi: qla2xxx: Fix optrom version displayed in FDMI
  - drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
  - drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
  - io_uring/io-wq: limit retrying worker initialisation
  - ext2: Verify bitmap and itable block numbers before using them
  - hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error
  - ata: libata-scsi: Do not overwrite valid sense data when CK_COND=1
  - media: venus: fix use after free in vdec_close
  - char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
  - ata: libata-scsi: Fix offsets for the fixed format sense data
  - fuse: verify {g,u}id mount options correctly
  - sched/fair: set_load_weight() must also call reweight_task() for SCHED_IDLE tasks
  - NFSD: Support write delegations in LAYOUTGET
  - ipv6: take care of scope when choosing the src addr
  - ipv4: fix source address selection with route leak
  - kernel: rerun task_work while freezing in get_signal()
  - btrfs: fix extent map use-after-free when adding pages to compressed bio
  - af_packet: Handle outgoing VLAN packets without hardware offloading
  - net: netconsole: Disable target before netpoll cleanup
  - tick/broadcast: Make takeover of broadcast hrtimer reliable
  - dt-bindings: thermal: correct thermal zone node name limit
  - exfat: fix potential deadlock on __exfat_get_dentry_set
  - x86/efistub: Revert to heap allocated boot_params for PE entrypoint
  - x86/efistub: Avoid returning EFI_SUCCESS on error
  - mm/mglru: fix overshooting shrinker memory
  - mm: mmap_lock: replace get_memcg_path_buf() with on-stack buffer
  - mm/mglru: fix div-by-zero in vmpressure_calc_level()
  - mm/hugetlb: fix possible recursive locking detected warning
  - hugetlb: force allocating surplus hugepages on mempolicy allowed nodes
  - landlock: Don't lose track of restrictions on cred_transfer
  - LoongArch: Check TIF_LOAD_WATCH to enable user space watchpoint
  - sbitmap: use READ_ONCE to access map->word
  - s390/dasd: fix error checks in dasd_copy_pair_store()
  - powerpc/8xx: fix size given to set_huge_pte_at()
  - fs/ntfs3: Keep runs for $MFT::$ATTR_DATA and $MFT::$ATTR_BITMAP
  - fs/ntfs3: Missed error return
  - fs/ntfs3: Fix the format of the "nocase" mount option
  - rtc: interface: Add RTC offset to alarm after fix-up
  - nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
  - fs/proc/task_mmu: properly detect PM_MMAP_EXCLUSIVE per page of PMD-mapped THPs
  - fs/proc/task_mmu: don't indicate PM_MMAP_EXCLUSIVE without PM_PRESENT
  - fs/proc/task_mmu.c: add_to_pagemap: remove useless parameter addr
  - fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP
  - pinctrl: renesas: r8a779g0: Fix TPU suffixes
  - pinctrl: renesas: r8a779g0: Fix TCLK suffixes
  - pinctrl: renesas: r8a779g0: FIX PWM suffixes
  - pinctrl: renesas: r8a779g0: Fix IRQ suffixes
  - pinctrl: renesas: r8a779g0: Fix (H)SCIF3 suffixes
  - pinctrl: renesas: r8a779g0: Fix (H)SCIF1 suffixes
  - pinctrl: renesas: r8a779g0: Fix FXR_TXEN[AB] suffixes
  - pinctrl: renesas: r8a779g0: Fix CANFD5 suffix
  - fs/ntfs3: Fix field-spanning write in INDEX_HDR
  - fs/ntfs3: Drop stray '' (backslash) in formatting string
  - fs/ntfs3: Correct undo if ntfs_create_inode failed
  - fs/ntfs3: Replace inode_trylock with inode_lock
  - pinctrl: freescale: mxs: Fix refcount of child
  - pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails
  - pinctrl: ti: ti-iodelay: Drop if block with always false condition
  - pinctrl: single: fix possible memory leak when pinctrl_enable() fails
  - pinctrl: core: fix possible memory leak when pinctrl_enable() fails
  - pinctrl: rockchip: update rk3308 iomux routes
  - fs/ntfs3: Add missing .dirty_folio in address_space_operations
  - fs/ntfs3: Fix getting file type
  - fs/ntfs3: Missed NI_FLAG_UPDATE_PARENT setting
  - fs/ntfs3: Deny getting attr data block in compressed frame
  - fs/ntfs3: Fix transform resident to nonresident for compressed files
  - fs/ntfs3: Merge synonym COMPRESSION_UNIT and NTFS_LZNT_CUNIT
  - net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports
  - net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports
  - ipv4: Fix incorrect TOS in fibmatch route get reply
  - ipv4: Fix incorrect TOS in route get reply
  - net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
  - gve: Fix XDP TX completion handling when counters overflow
  - ipvs: properly dereference pe in ip_vs_add_service
  - netfilter: nf_set_pipapo: fix initial map fill
  - netfilter: nft_set_pipapo: constify lookup fn args where possible
  - netfilter: ctnetlink: use helper function to calculate expect ID
  - bnxt_re: Fix imm_data endianness
  - RDMA: Fix netdev tracker in ib_device_set_netdev
  - RDMA/core: Remove NULL check before dev_{put, hold}
  - iommu/vt-d: Fix identity map bounds in si_domain_init()
  - macintosh/therm_windtunnel: fix module unload.
  - powerpc/xmon: Fix disassembly CPU feature checks
  - PCI: dwc: Fix index 0 incorrectly being interpreted as a free ATU slot
  - PCI: qcom-ep: Disable resources unconditionally during PERST# assert
  - MIPS: Octeron: remove source file executable bit
  - clk: en7523: fix rate divider for slic and spi clocks
  - clk: qcom: Park shared RCGs upon registration
  - clk: qcom: kpss-xcc: Return of_clk_add_hw_provider to transfer the error
  - crypto: qat - extend scope of lock in adf_cfg_add_key_value_param()
  - nvmem: rockchip-otp: set add_legacy_fixed_of_cells config option
  - net: missing check virtio
  - vhost/vsock: always initialize seqpacket_allow
  - PCI: endpoint: Fix error handling in epf_ntb_epc_cleanup()
  - PCI: endpoint: Clean up error handling in vpci_scan_bus()
  - ASoC: amd: Adjust error handling in case of absent codec device
  - Input: elan_i2c - do not leave interrupt disabled on suspend failure
  - RDMA/device: Return error earlier if port in not valid
  - mtd: make mtd_test.c a separate module
  - ASoC: max98088: Check for clk_prepare_enable() error
  - powerpc/prom: Add CPU info to hardware description string later
  - hwrng: core - Fix wrong quality calculation at hw rng registration
  - scsi: lpfc: Fix a possible null pointer dereference
  - ASoC: qcom: Adjust issues in case of DT error in asoc_qcom_lpass_cpu_platform_probe()
  - RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs
  - RDMA/mlx5: Use sq timestamp as QP timestamp when RoCE is disabled
  - RDMA/mlx4: Fix truncated output warning in alias_GUID.c
  - RDMA/mlx4: Fix truncated output warning in mad.c
  - Input: qt1050 - handle CHIP_ID reading error
  - interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID
  - clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's
  - clk: qcom: gpucc-sa8775p: Park RCG's clk source at XO during disable
  - clk: qcom: gpucc-sa8775p: Remove the CLK_IS_CRITICAL and ALWAYS_ON flags
  - clk: qcom: gcc-sa8775p: Update the GDSC wait_val fields and flags
  - clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during disable
  - RDMA/cache: Release GID table even if leak is detected
  - usb: typec-mux: nb7vpq904m: unregister typec switch on probe error and remove
  - ASoC: cs35l56: Accept values greater than 0 as IRQ numbers
  - ASoc: tas2781: Enable RCA-based playback without DSP firmware download
  - RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE
  - coresight: Fix ref leak when of_coresight_parse_endpoint() fails
  - KVM: PPC: Book3S HV: Fix the get_one_reg of SDAR
  - KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3
  - iio: frequency: adrf6780: rm clk provider include
  - clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs
  - clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock
  - scsi: ufs: mcq: Fix missing argument 'hba' in MCQ_OPR_OFFSET_n
  - PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup()
  - PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()
  - PCI: keystone: Don't enable BAR 0 for AM654x
  - PCI: keystone: Relocate ks_pcie_set/clear_dbi_mode()
  - PCI: Fix resource double counting on remove & rescan
  - iio: Fix the sorting functionality in iio_gts_build_avail_time_table
  - SUNRPC: Fixup gss_status tracepoint error output
  - sparc64: Fix incorrect function signature and add prototype for prom_cif_init
  - leds: flash: leds-qcom-flash: Test the correct variable in init
  - ext4: avoid writing unitialized memory to disk in EA inodes
  - ext4: don't track ranges in fast_commit if inode has inlined data
  - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server
  - SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
  - xprtrdma: Fix rpcrdma_reqs_reset()
  - mfd: omap-usb-tll: Use struct_size to allocate tll
  - mfd: rsmu: Split core code into separate module
  - perf intel-pt: Fix exclude_guest setting
  - perf intel-pt: Fix aux_watermark calculation for 64-bit size
  - media: venus: flush all buffers in output plane streamoff
  - drm/mediatek/dp: Fix spurious kfree()
  - drm/mediatek/dp: switch to ->edid_read callback
  - ext4: fix infinite loop when replaying fast_commit
  - drm/mediatek: Remove less-than-zero comparison of an unsigned value
  - Revert "leds: led-core: Fix refcount leak in of_led_get()"
  - drm/qxl: Add check for drm_cvt_mode
  - drm/etnaviv: fix DMA direction handling for cached RW buffers
  - perf report: Fix condition in sort__sym_cmp()
  - perf pmus: Fixes always false when compare duplicates aliases
  - perf test: Make test_arm_callgraph_fp.sh more robust
  - drm/msm/dpu: drop validity checks for clear_pending_flush() ctl op
  - drm/msm/dsi: set VIDEO_COMPRESSION_MODE_CTRL_WC
  - leds: trigger: Unregister sysfs attributes before calling deactivate()
  - media: imx-jpeg: Drop initial source change event if capture has been setup
  - drm/mediatek: Add OVL compatible name for MT8195
  - drm/mediatek: Turn off the layers with zero width or height
  - drm/mediatek: Fix destination alpha error in OVL
  - drm/mediatek: Fix XRGB setting error in Mixer
  - drm/mediatek: Fix XRGB setting error in OVL
  - drm/mediatek: Use 8-bit alpha in ETHDR
  - drm/mediatek: Add missing plane settings when async update
  - media: renesas: vsp1: Store RPF partition configuration per RPF instance
  - media: renesas: vsp1: Fix _irqsave and _irq mix
  - media: rcar-csi2: Cleanup subdevice in remove()
  - media: rcar-csi2: Disable runtime_pm in probe error
  - media: rcar-vin: Fix YUYV8_1X16 handling for CSI-2
  - drm: zynqmp_kms: Fix AUX bus not getting unregistered
  - drm: zynqmp_dpsub: Fix an error handling path in zynqmp_dpsub_probe()
  - media: uvcvideo: Override default flags
  - media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920
  - media: uvcvideo: Quirk for invalid dev_sof in Logitech C922
  - media: uvcvideo: Disable autosuspend for Insta360 Link
  - media: i2c: imx219: fix msr access command sequence
  - saa7134: Unchecked i2c_transfer function result fixed
  - ipmi: ssif_bmc: prevent integer overflow on 32bit systems
  - x86/shstk: Make return uprobe work with shadow stack
  - media: mediatek: vcodec: Handle invalid decoder vsi
  - s390/uv: Don't call folio_wait_writeback() without a folio reference
  - s390/mm: Convert gmap_make_secure to use a folio
  - s390/mm: Convert make_page_secure to use a folio
  - media: v4l: async: Fix NULL pointer dereference in adding ancillary links
  - media: i2c: Fix imx412 exposure control
  - media: imon: Fix race getting ictx->lock
  - media: pci: ivtv: Add check for DMA map result
  - drm/bridge: it6505: fix hibernate to resume no display issue
  - drm/bridge: Fixed a DP link training bug
  - drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare()
  - drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before regulators
  - drm/panel: himax-hx8394: Handle errors from mipi_dsi_dcs_set_display_on() better
  - drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1
  - drm/amdgpu: Check if NBIO funcs are NULL in amdgpu_device_baco_exit
  - drm/amdgpu: Fix memory range calculation
  - drm/amd/pm: Fix aldebaran pcie speed reporting
  - drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_generic_write_seq()
  - drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_dcs_write_seq()
  - drm/amdkfd: Fix CU Masking for GFX 9.4.3
  - drm/arm/komeda: Fix komeda probe failing if there are no links in the secondary pipeline
  - drm/rockchip: vop2: Fix the port mux of VP2
  - net: bridge: mst: Check vlan state for egress decision
  - xdp: fix invalid wait context of page_pool_destroy()
  - Bluetooth: btnxpuart: Add handling for boot-signature timeout errors
  - Bluetooth: btintel: Refactor btintel_set_ppag()
  - Bluetooth: hci_bcm4377: Use correct unit for timeouts
  - selftests: forwarding: devlink_lib: Wait for udev events after reloading
  - bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o
  - bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
  - bpf: annotate BTF show functions with __printf
  - selftests/resctrl: Fix closing IMC fds on error and open-code R+W instead of loops
  - selftests/resctrl: Convert perror() to ksft_perror() or ksft_print_msg()
  - selftests/resctrl: Move run_benchmark() to a more fitting file
  - selftests/bpf: Close obj in error path in xdp_adjust_tail
  - selftests/bpf: Null checks for links in bpf_tcp_ca
  - selftests/bpf: Close fd in error path in drop_on_reuseport
  - locking/rwsem: Add __always_inline annotation to __down_write_common() and inlined callers
  - wifi: virt_wifi: don't use strlen() in const context
  - gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
  - wifi: virt_wifi: avoid reporting connection success with wrong SSID
  - xfrm: call xfrm_dev_policy_delete when kill policy
  - xfrm: fix netdev reference count imbalance
  - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()
  - perf/x86/intel/cstate: Fix Alderlake/Raptorlake/Meteorlake
  - perf: Fix default aux_watermark calculation
  - perf: Prevent passing zero nr_pages to rb_alloc_aux()
  - perf: Fix perf_aux_size() for greater-than 32-bit size
  - perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
  - bpftool: Mount bpffs when pinmaps path not under the bpffs
  - wifi: rtl8xxxu: 8188f: Limit TX power index
  - wifi: rtw89: 8852b: fix definition of KIP register number
  - netfilter: nf_tables: rise cap on SELinux secmark context
  - ipvs: Avoid unnecessary calls to skb_is_gso_sctp
  - libbpf: Checking the btf_type kind when fixing variable offsets
  - net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
  - net: fec: Refactor: #define magic constants
  - udf: Fix bogus checksum computation in udf_rename()
  - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
  - wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
  - wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
  - jump_label: Fix concurrency issues in static_key_slow_dec()
  - perf/x86: Serialize set_attr_rdpmc()
  - mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors
  - mlxsw: spectrum_acl_erp: Fix object nesting warning
  - lib: objagg: Fix general protection fault
  - udf: Fix lock ordering in udf_evict_inode()
  - selftests/bpf: Check length of recv in test_sockmap
  - net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined
  - tcp: fix races in tcp_v[46]_err()
  - tcp: fix race in tcp_write_err()
  - tcp: add tcp_done_with_error() helper
  - wifi: ath12k: fix wrong definition of CE ring's base address
  - wifi: ath11k: fix wrong definition of CE ring's base address
  - wifi: ath11k: Update Qualcomm Innovation Center, Inc. copyrights
  - wifi: ath12k: fix firmware crash during reo reinject
  - wifi: ath12k: fix invalid memory access while processing fragmented packets
  - wifi: ath12k: change DMA direction while mapping reinjected packets
  - net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP
  - selftests/bpf: Fix prog numbers in test_sockmap
  - bpftool: Un-const bpf_func_info to fix it for llvm 17 and newer
  - wifi: ath12k: Fix tx completion ring (WBM2SW) setup failure
  - wifi: ath12k: Correct 6 GHz frequency value in rx status
  - wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
  - firmware: turris-mox-rwtm: Initialize completion before mailbox
  - firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout()
  - firmware: turris-mox-rwtm: Do not complete if there are no waiters
  - vmlinux.lds.h: catch .bss..L* sections into BSS")
  - ARM: spitz: fix GPIO assignment for backlight
  - m68k: cmpxchg: Fix return value for default case in __arch_xchg()
  - cpufreq/amd-pstate: Fix the scaling_max_freq setting on shared memory CPPC systems
  - arm64: dts: qcom: sm6350: Add missing qcom,non-secure-domain property
  - arm64: dts: rockchip: fixes PHY reset for Lunzn Fastrhino R68S
  - arm64: dts: rockchip: disable display subsystem for Lunzn Fastrhino R6xS
  - arm64: dts: rockchip: remove unused usb2 nodes for Lunzn Fastrhino R6xS
  - arm64: dts: rockchip: fix pmu_io supply for Lunzn Fastrhino R6xS
  - arm64: dts: rockchip: fix usb regulator for Lunzn Fastrhino R6xS
  - arm64: dts: rockchip: fix regulator name for Lunzn Fastrhino R6xS
  - arm64: dts: rockchip: Add missing power-domains for rk356x vop_mmu
  - x86/xen: Convert comma to semicolon
  - arm64: dts: imx8mp: Fix pgc vpu locations
  - arm64: dts: imx8mp: add HDMI power-domains
  - arm64: dts: imx8mp: Fix pgc_mlmix location
  - arm64: dts: imx8mp: Add NPU Node
  - m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
  - arm64: dts: renesas: r9a07g054: Add missing hypervisor virtual timer IRQ
  - arm64: dts: renesas: r9a07g044: Add missing hypervisor virtual timer IRQ
  - arm64: dts: renesas: r9a07g043u: Add missing hypervisor virtual timer IRQ
  - arm64: dts: renesas: r8a779g0: Add missing hypervisor virtual timer IRQ
  - arm64: dts: renesas: r8a779f0: Add missing hypervisor virtual timer IRQ
  - arm64: dts: renesas: r8a779a0: Add missing hypervisor virtual timer IRQ
  - arm64: dts: rockchip: Fix mic-in-differential usage on rk3568-evb1-v10
  - arm64: dts: rockchip: Fix mic-in-differential usage on rk3566-roc-pc
  - arm64: dts: rockchip: Drop invalid mic-in-differential on rk3568-rock-3a
  - arm64: dts: amlogic: setup hdmi system clock
  - arm64: dts: amlogic: add power domain to hdmitx
  - arm64: dts: amlogic: gx: correct hdmi clocks
  - arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add ports node for anx7625
  - arm64: dts: mediatek: mt8183-kukui: Fix the value of `dlg,jack-det-rate` mismatch
  - arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
  - arm64: dts: mediatek: mt8192-asurada: Add off-on-delay-us for pp3300_mipibrdg
  - arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property
  - arm64: dts: mediatek: mt8195: Fix GPU thermal zone name for SVS
  - ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
  - ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects
  - ARM: dts: imx6qdl-kontron-samx6i: fix board reset
  - ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
  - ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode
  - arm64: dts: amlogic: sm1: fix spdif compatibles
  - arm64: dts: rockchip: Increase VOP clk rate on RK3328
  - soc: qcom: pdr: fix parsing of domains lists
  - soc: qcom: pdr: protect locator_addr with the main mutex
  - soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove
  - arm64: dts: qcom: qdu1000: Add secure qfprom node
  - arm64: dts: qcom: qdu1000-idp: drop unused LLCC multi-ch-bit-off
  - arm64: dts: ti: k3-am62-verdin: Drop McASP AFIFOs
  - arm64: dts: ti: k3-am625-beagleplay: Drop McASP AFIFOs
  - arm64: dts: ti: k3-am62x: Drop McASP AFIFOs
  - memory: fsl_ifc: Make FSL_IFC config visible and selectable
  - OPP: ti: Fix ti_opp_supply_probe wrong return values
  - cpufreq: ti-cpufreq: Handle deferred probe with dev_err_probe()
  - arm64: dts: qcom: qrb4210-rb2: make L9A always-on
  - ARM: dts: stm32: Add arm,no-tick-in-suspend to STM32MP15xx STGEN timer
  - ARM: dts: sunxi: remove duplicated entries in makefile
  - soc: xilinx: rename cpu_number1 to dummy_cpu_number
  - arm64: dts: qcom: sa8775p: mark ethernet devices as DMA-coherent
  - arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
  - arm64: dts: rockchip: Update WIFi/BT related nodes on rk3308-rock-pi-s
  - arm64: dts: rockchip: Add mdio and ethernet-phy nodes to rk3308-rock-pi-s
  - arm64: dts: rockchip: Add pinctrl for UART0 to rk3308-rock-pi-s
  - arm64: dts: rockchip: Add sdmmc related properties on rk3308-rock-pi-s
  - soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by rpmh_rsc_send_data() callers
  - soc: qcom: pmic_glink: Handle the return value of pmic_glink_init
  - arm64: dts: qcom: msm8998: enable adreno_smmu by default
  - arm64: dts: qcom: sdm850-lenovo-yoga-c630: fix IPA firmware path
  - arm64: dts: qcom: msm8996-xiaomi-common: drop excton from the USB PHY
  - arm64: dts: qcom: sm8450: add power-domain to UFS PHY
  - arm64: dts: qcom: sm8350: add power-domain to UFS PHY
  - arm64: dts: qcom: sm8250: add power-domain to UFS PHY
  - arm64: dts: qcom: sm8250: switch UFS QMP PHY to new style of bindings
  - arm64: dts: qcom: sm6350: add power-domain to UFS PHY
  - arm64: dts: qcom: sm6115: add power-domain to UFS PHY
  - arm64: dts: qcom: sdm845: add power-domain to UFS PHY
  - arm64: dts: qcom: sc8180x: add power-domain to UFS PHY
  - arm64: dts: qcom: sc8180x: switch UFS QMP PHY to new style of bindings
  - arm64: dts: qcom: sc8180x: Correct PCIe slave ports
  - hwmon: (max6697) Fix swapped temp{1,8} critical alarms
  - hwmon: (max6697) Fix underflow when writing limit attributes
  - pwm: atmel-tcb: Fix race condition and convert to guards
  - drm/meson: fix canvas release in bind function
  - nvmet-auth: fix nvmet_auth hash error handling
  - pwm: stm32: Always do lazy disabling
  - md: Don't wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl
  - block/mq-deadline: Fix the tag reservation code
  - block: Call .limit_depth() after .hctx has been set
  - hwmon: (adt7475) Fix default duty on fan is disabled
  - x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
  - x86/pci/xen: Fix PCIBIOS_* return code handling
  - x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
  - x86/of: Return consistent error type from x86_of_pci_irq_enable()
  - hfsplus: fix to avoid false alarm of circular locking
  - x86/kconfig: Add as-instr64 macro to properly evaluate AS_WRUSS
  - block: initialize integrity buffer to zero before writing it to media
  - ubd: untagle discard vs write zeroes not support handling
  - ubd: refactor the interrupt handler
  - platform/chrome: cros_ec_debugfs: fix wrong EC message version
  - md: fix deadlock between mddev_suspend and flush bio
  - rcu/tasks: Fix stale task snaphot for Tasks Trace
  - EDAC, i10nm: make skx_common.o a separate module
  - spi: atmel-quadspi: Add missing check for clk_prepare
  - spi: spi-microchip-core: Fix the number of chip selects supported
  - powerpc/configs: Update defconfig with now user-visible CONFIG_FSL_IFC
  - ALSA: seq: ump: Skip useless ports for static blocks
  - ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA is paused
  - arm64: dts: qcom: sdm630: Disable SS instance in Parkmode for USB
  - arm64: dts: qcom: ipq6018: Disable SS instance in Parkmode for USB
  - arm64: dts: qcom: sm6350: Disable SS instance in Parkmode for USB
  - arm64: dts: qcom: msm8996: Disable SS instance in Parkmode for USB
  - arm64: dts: qcom: qrb4210-rb2: switch I2C2 to i2c-gpio
  - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360
  - ALSA: hda/realtek: Enable headset mic on Positivo SU C1400
  - usb: gadget: midi2: Fix incorrect default MIDI2 protocol setup
  - jfs: don't walk off the end of ealist
  - ocfs2: add bounds checking to ocfs2_check_dir_entry()
  - cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
  - cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
  - netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume()
  - wifi: iwlwifi: mvm: don't wake up rx_sync_waitq upon RFKILL
  - wifi: mac80211: disable softirqs for queued frame handling
  - wifi: cfg80211: wext: set ssids=NULL for passive scans
  - of/irq: Disable "interrupt-map" parsing for PASEMI Nemo
  - mm: page_ref: remove folio_try_get_rcu()
  - ARM: 9324/1: fix get_user() broken with veneer
  - cifs: fix noisy message on copy_file_range
  - ALSA: hda: Use imply for suggesting CONFIG_SERIAL_MULTI_INSTANTIATE
  - spi: mux: set ctlr->bits_per_word_mask
  - selftests/bpf: Extend tcx tests to cover late tcx_entry release
  - hfsplus: fix uninit-value in copy_name
  - selftests/vDSO: fix clang build errors and warnings
  - selftest/timerns: fix clang build failures for abs() calls
  - ASoC: SOF: Intel: hda-pcm: Limit the maximum number of periods by MAX_BDL_ENTRIES
  - ksmbd: return FILE_DEVICE_DISK instead of super magic
  - spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices
  - riscv: stacktrace: fix usage of ftrace_graph_ret_addr()
  - drivers/perf: riscv: Reset the counter to hpmevent mapping while starting cpus
  - wifi: iwlwifi: properly set WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK
  - fs: better handle deep ancestor chains in is_subdir()
  - drm/radeon: check bo_va->bo is non-NULL before using it
  - drm/amd/display: Fix refresh rate range for some panel
  - drm/amd/display: Account for cursor prefetch BW in DML1 mode support
  - drm/amd/display: Add refresh rate range check
  - erofs: ensure m_llen is reset to 0 if metadata is invalid
  - Bluetooth: btnxpuart: Enable Power Save feature on startup
  - tee: optee: ffa: Fix missing-field-initializers warning
  - scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed
  - powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()
  - net: usb: qmi_wwan: add Telit FN912 compositions
  - ASoC: amd: yc: Fix non-functional mic on ASUS M5602RA
  - ALSA: dmaengine_pcm: terminate dmaengine before synchronize
  - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx
  - ALSA: PCM: Allow resume only for suspended streams
  - ibmvnic: Add tx check to prevent skb leak
  - btrfs: qgroup: fix quota root leak after quota disable failure
  - platform/x86: lg-laptop: Use ACPI device handle when evaluating WMAB/WMBB
  - platform/x86: lg-laptop: Change ACPI device id
  - platform/x86: lg-laptop: Remove LGEX0815 hotkey handling
  - platform/x86: wireless-hotkey: Add support for LG Airplane Button
  - platform/mellanox: nvsw-sn2201: Add check for platform_device_add_resources
  - s390/sclp: Fix sclp_init() cleanup on failure
  - octeontx2-pf: Fix coverity and klockwork issues in octeon PF driver
  - gpio: pca953x: fix pca953x_irq_bus_sync_unlock race
  - can: kvaser_usb: fix return value for hif_usb_send_regout
  - Input: ads7846 - use spi_device_id table
  - nvme: fix NVME_NS_DEAC may incorrectly identifying the disk as EXT_LBA.
  - ASoC: rt722-sdca-sdw: add debounce time for type detection
  - ASoC: SOF: sof-audio: Skip unprepare for in-use widgets on error rollback
  - ASoC: ti: omap-hdmi: Fix too long driver name
  - ASoC: ti: davinci-mcasp: Set min period size using FIFO config
  - ALSA: dmaengine: Synchronize dma channel after drop()
  - bytcr_rt5640 : inverse jack detect for Archos 101 cesium
  - Input: xpad - add support for ASUS ROG RAIKIRI PRO
  - ASoC: rt722-sdca-sdw: add silence detection register as volatile
  - Input: i8042 - add Ayaneo Kun to i8042 quirk table
  - Input: elantech - fix touchpad state on resume for Lenovo N24
  - mips: fix compat_sys_lseek syscall
  - ALSA: hda: cs35l56: Select SERIAL_MULTI_INSTANTIATE
  - drm/amdgpu: Indicate CU havest info to CP
  - selftests: openvswitch: Set value to nla flags.
  - cpumask: limit FORCE_NR_CPUS to just the UP case
  - spi: Fix OCTAL mode support
  - ALSA: hda/realtek: Add more codec ID to no shutup pins list
  - drm/vmwgfx: Fix missing HYPERVISOR_GUEST dependency
  - KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
  - ALSA: hda/realtek: Support Lenovo Thinkbook 16P Gen 5
  - ALSA: hda: cs35l56: Fix lifecycle of codec pointer
  - nvmet: always initialize cqe.result
  - nvme: avoid double free special payload
  - drm/mediatek: Call drm_atomic_helper_shutdown() at shutdown time
  - drm: panel-orientation-quirks: Add quirk for Aya Neo KUN
  - drm/exynos: dp: drop driver owner initialization
  - iomap: Fix iomap_adjust_read_range for plen calculation
  - mei: demote client disconnect warning on suspend to debug
  - fs/file: fix the check in find_next_fd()
  - nfs: don't invalidate dentries on transient errors
  - nfs: Avoid flushing many pages with NFS_FILE_SYNC
  - nfs: propagate readlink errors in nfs_symlink_filler
  - HID: Ignore battery for ELAN touchscreens 2F2C and 4116
  - input: Add support for "Do Not Disturb"
  - input: Add event code for accessibility key
  - kconfig: remove wrong expr_trans_bool()
  - kconfig: gconf: give a proper initial state to the Save button
  - ila: block BH in ila_output()
  - net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input()
  - Input: silead - Always support 10 fingers
  - of/irq: Factor out parsing of interrupt-map parent phandle+args from of_irq_parse_raw()
  - selftests/futex: pass _GNU_SOURCE without a value to the compiler
  - selftests/openat2: Fix build warnings on ppc64
  - selftests: cachestat: Fix build warnings on ppc64
  - wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()
  - wifi: iwlwifi: mvm: Fix scan abort handling with HW rfkill
  - wifi: iwlwifi: mvm: properly set 6 GHz channel direct probe option
  - wifi: iwlwifi: mvm: handle BA session teardown in RF-kill
  - wifi: iwlwifi: mvm: Handle BIGTK cipher in kek_kck cmd
  - wifi: iwlwifi: mvm: remove stale STA link data during restart
  - wifi: iwlwifi: mvm: d3: fix WoWLAN command version lookup
  - wifi: cfg80211: fix 6 GHz scan request building
  - wifi: mac80211: handle tasklet frames before stopping
  - wifi: mac80211: apply mcast rate only if interface is up
  - wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata
  - tools/power/cpupower: Fix Pstate frequency reporting on AMD Family 1Ah CPUs
  - ACPI: EC: Avoid returning AE_OK on errors in address space handler
  - ACPI: EC: Abort address space access upon error
  - efi/libstub: zboot.lds: Discard .discard sections
  - scsi: qedf: Set qed_slowpath_params to zero before use
  - scsi: qedf: Wait for stag work during unload
  - scsi: qedf: Don't process stag work during unload and recovery
  - scsi: sr: Fix unintentional arithmetic wraparound
  - scsi: core: alua: I/O errors for ALUA state transitions
  - filelock: Remove locks reliably when fcntl/close race is detected
  - i2c: rcar: fix error code in probe()
  - kbuild: Make ld-version.sh more robust against version string changes
  - x86/bhi: Avoid warning in #DB handler due to BHI mitigation
  - x86/entry/64: Remove obsolete comment on tracing vs. SYSRET
  - x86/entry: Rename ignore_sysret()
  - i2c: rcar: clear NO_RXDMA flag after resetting
  - i2c: testunit: avoid re-issued work after read message
  - i2c: rcar: ensure Gen3+ reset does not disturb local targets
  - i2c: rcar: introduce Gen4 devices
  - i2c: rcar: reset controller is mandatory for Gen3+
  - i2c: mark HostNotify target address as used
  - i2c: rcar: bring hardware to known state when probing
  - btrfs: tree-checker: add type and sequence check for inline backrefs
  - ext4: avoid ptr null pointer dereference
  - nilfs2: fix kernel bug on rename operation of broken directory
  - selftests/net: fix gro.c compilation failure due to non-existent opt_ipproto_off
  - mm/damon/core: merge regions aggressively when max_nr_regions is unmet
  - mm/shmem: disable PMD-sized page cache if needed
  - misc: fastrpc: Restrict untrusted app to attach to privileged PD
  - misc: fastrpc: Fix ownership reassignment of remote heap
  - misc: fastrpc: Fix memory leak in audio daemon attach operation
  - misc: fastrpc: Copy the complete capability structure to user
  - misc: fastrpc: Avoid updating PD type for capability request
  - misc: fastrpc: Fix DSP capabilities request
  - wireguard: send: annotate intentional data race in checking empty queue
  - wireguard: queueing: annotate intentional data race in cpu round robin
  - wireguard: allowedips: avoid unaligned 64-bit memory accesses
  - wireguard: selftests: use acpi=off instead of -no-acpi for recent QEMU
  - cpufreq: Allow drivers to advertise boost enabled
  - cpufreq: ACPI: Mark boost policy as enabled when setting boost
  - ACPI: processor_idle: Fix invalid comparison with insertion sort for latency
  - libceph: fix race between delayed_work() and ceph_monc_stop()
  - pmdomain: qcom: rpmhpd: Skip retention level for Power Domains
  - Fix userfaultfd_api to return EINVAL as expected
  - ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
  - ALSA: hda/realtek: Enable Mute LED on HP 250 G7
  - ALSA: hda/realtek: add quirk for Clevo V5[46]0TU
  - tty: serial: ma35d1: Add a NULL check for of_node
  - platform/x86: toshiba_acpi: Fix array out-of-bounds access
  - nvmem: core: only change name to fram for current attribute
  - nvmem: meson-efuse: Fix return value of nvmem callbacks
  - nvmem: rmem: Fix return value of rmem_read()
  - arm64: dts: qcom: sc8280xp-x13s: fix touchscreen power on
  - arm64: dts: qcom: sa8775p: Correct IRQ number of EL2 non-secure physical timer
  - iio: trigger: Fix condition for own trigger
  - ksmbd: discard write access to the directory open
  - mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray
  - mm/filemap: skip to create PMD-sized page cache if needed
  - mm: vmalloc: check if a hash-index is in cpu_possible_mask
  - s390/mm: Add NULL pointer check to crst_table_free() base_crst_free()
  - xhci: always resume roothubs if xHC was reset during resume
  - hpet: Support 32-bit userspace
  - misc: microchip: pci1xxxx: Fix return value of nvmem callbacks
  - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
  - usb: dwc3: pci: add support for the Intel Panther Lake
  - USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
  - USB: serial: mos7840: fix crash on resume
  - USB: serial: option: add Rolling RW350-GL variants
  - USB: serial: option: add Netprisma LCUK54 series modules
  - USB: serial: option: add support for Foxconn T99W651
  - USB: serial: option: add Fibocom FM350-GL
  - USB: serial: option: add Telit FN912 rmnet compositions
  - USB: serial: option: add Telit generic core-dump composition
  - net: ks8851: Fix potential TX stall after interface reopen
  - net: ks8851: Fix deadlock with the SPI chip variant
  - Revert "sched/fair: Make sure to try to detach at least one movable task"
  - cifs: fix setting SecurityFlags to true
  - octeontx2-af: fix issue with IPv4 match for RSS
  - octeontx2-af: fix issue with IPv6 ext match for RSS
  - octeontx2-af: fix detection of IP layer
  - octeontx2-af: fix a issue with cpt_lf_alloc mailbox
  - octeontx2-af: replace cpt slot with lf id on reg write
  - i40e: fix: remove needless retries of NVM update
  - ARM: davinci: Convert comma to semicolon
  - ASoC: SOF: Intel: hda: fix null deref on system suspend entry
  - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers
  - firmware: cs_dsp: Validate payload length before processing block
  - firmware: cs_dsp: Return error if block header overflows file
  - arm64: dts: qcom: sc8180x: Fix LLCC reg property again
  - s390: Mark psw in __load_psw_mask() as __unitialized
  - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
  - ethtool: netlink: do not return SQI value if link is down
  - net: ethernet: mtk-star-emac: set mac_managed_pm when probing
  - bpf: Fail bpf_timer_cancel when callback is being cancelled
  - bpf: replace bpf_timer_init with a generic helper
  - bpf: make timer data struct more generic
  - bpf: fix order of args in call to bpf_map_kvcalloc
  - i40e: Fix XDP program unloading while removing the driver
  - octeontx2-af: Fix incorrect value output on error path in rvu_check_rsrc_availability()
  - net: phy: microchip: lan87xx: reinit PHY after cable test
  - tcp: fix incorrect undo caused by DSACK of TLP retransmit
  - net: bcmasp: Fix error code in probe()
  - vfs: don't mod negative dentry count when on shrinker list
  - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading
  - dsa: lan9303: Fix mapping between DSA port number and PHY address
  - cachefiles: add missing lock protection when polling
  - cachefiles: cyclic allocation of msg_id to avoid reuse
  - cachefiles: wait for ondemand_object_worker to finish when dropping object
  - cachefiles: cancel all requests for the object that is being dropped
  - cachefiles: stop sending new request when dropping object
  - cachefiles: propagate errors from vfs_getxattr() to avoid infinite loop
  - scsi: ufs: core: Fix ufshcd_abort_one racing issue
  - scsi: ufs: core: Fix ufshcd_clear_cmd racing issue
  - mm: prevent derefencing NULL ptr in pfn_section_valid()
  - Compiler Attributes: Add __uninitialized macro
  - !10610  wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
  - !10599  ppp: reject claimed-as-LCP but actually malformed packets
  - ppp: reject claimed-as-LCP but actually malformed packets
  - !10539  tun: add missing verification for short frame
  - tun: add missing verification for short frame
  - !10538  tap: add missing verification for short frame
  - tap: add missing verification for short frame
  - !10555  skmsg: Skip zero length skb in sk_msg_recvmsg
  - skmsg: Skip zero length skb in sk_msg_recvmsg
  - !10596  net: ethernet: lantiq_etop: fix double free in detach
  - net: ethernet: lantiq_etop: fix double free in detach
  - !10517  mm/dynamic_pool: two bugfix about THP and migration
  - mm/dynamic_pool: check page_from_dynamic_pool() on migration
  - mm/dynamic_pool: replace task_in_dynamic_pool() with mm_in_dynamic_pool()
  - !10579  Fix CVE-2024-41062
  - Bluetooth: Fix usage of __hci_cmd_sync_status
  - Bluetooth: L2CAP: Fix deadlock
  - bluetooth/l2cap: sync sock recv cb and release
  - !10545  bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
  - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
  - !10547  powerpc/eeh: avoid possible crash when edev->pdev changes
  - powerpc/eeh: avoid possible crash when edev->pdev changes
  - !10470  Make cpuset.cpus.exclusive independent of cpuset.cpus
  - cgroup/cpuset: Make cpuset.cpus.exclusive independent of cpuset.cpus
  - cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE until valid partition
  - cgroup/cpuset: Documentation update for partition
  - !10443 v2  cxl/mem: Fix no cxl_nvd during pmem region auto-assembling
  - cxl/mem: Fix no cxl_nvd during pmem region auto-assembling
  - !10351  bpf: Fix null-pointer-deref in resolve_prog_type()
  - selftests/bpf: Test for null-pointer-deref bugfix in resolve_prog_type()
  - bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT
  - !10401  firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
  - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
  - !10512  powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
  - powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
  - !10524  Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
  - !10486  fix CVE-2024-42086
  - iio: chemical: bme680: Fix overflows in compensate() functions
  - !10466  null_blk: fix validation of block size
  - null_blk: fix validation of block size
  - !10480  ALSA: emux: improve patch ioctl data validation
  - ALSA: emux: improve patch ioctl data validation
  - !10385  firmware: cs_dsp: Fix overflow checking of wmfw header
  - firmware: cs_dsp: Fix overflow checking of wmfw header
  - !10403  Fix CVE-2024-41069
  - ASoC: topology: Fix route memory corruption
  - ASoC: topology: Do not assign fields that are already set
  - ASoC: topology: Fix references to freed memory
  - !10474  jffs2: Fix potential illegal address access in jffs2_free_inode
  - jffs2: Fix potential illegal address access in jffs2_free_inode
  - !10463  io_uring: fix possible deadlock in io_register_iowq_max_workers()
  - io_uring: fix possible deadlock in io_register_iowq_max_workers()
  - !10456  NFSv4: Fix memory leak in nfs4_set_security_label
  - NFSv4: Fix memory leak in nfs4_set_security_label
  - !10450  fs/ntfs3: Validate ff offset
  - fs/ntfs3: Validate ff offset
  - !10394  filelock: Fix fcntl/close race recovery compat path
  - filelock: Fix fcntl/close race recovery compat path
  - !10496  PCI/MSI: Fix UAF in msi_capability_init
  - PCI/MSI: Fix UAF in msi_capability_init
  - !10380  filelock: fix potential use-after-free in posix_lock_inode
  - filelock: fix potential use-after-free in posix_lock_inode
  - !10378  fs/ntfs3: Add a check for attr_names and oatbl
  - fs/ntfs3: Add a check for attr_names and oatbl
  - !10491  Bluetooth: ISO: Check socket flag instead of hcon
  - Bluetooth: ISO: Check socket flag instead of hcon
  - !10495  drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - !10442  net/sched: Fix UAF when resolving a clash
  - net/sched: Fix UAF when resolving a clash
  - !10457  udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
  - !10371  iommu/arm-smmu-v3: Reducing the CMD_SYNC times
  - iommu/arm-smmu-v3: Reducing the CMD_SYNC times
  - !10228  PCI/ROM: Fix PCI ROM header check bug
  - PCI/ROM: Fix PCI ROM header check bug
  - !10416 [sync] PR-10408:  iommu/arm-smmu-v3: Fix the compile warning
  - iommu/arm-smmu-v3: Fix the compile warning
  - !9824 fix CVE-2024-39486
  - drm/drm_file: Fix pid refcounting race
  - !10388  ovl: simplify ovl_parse_param_lowerdir()
  - ovl: ovl_parse_param_lowerdir: Add missed '
  - ovl: fix wrong lowerdir number check for parameter Opt_lowerdir
  - ovl: pass string to ovl_parse_layer()
  - !10507 Backport 6.6.35-40 LTS patches from upstream
  - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB"
  - nilfs2: fix incorrect inode allocation from reserved inodes
  - null_blk: Do not allow runt zone with zone capacity smaller then zone size
  - drm/amdgpu: silence UBSAN warning
  - ALSA: ump: Set default protocol when not given explicitly
  - spi: cadence: Ensure data lines set to low during dummy-cycle period
  - nfc/nci: Add the inconsistency check between the input data length and count
  - kbuild: fix short log for AS in link-vmlinux.sh
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment
  - platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro
  - platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT IVW 11.6" tablet
  - regmap-i2c: Subtract reg size from max_write
  - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset
  - connector: Fix invalid conversion in cn_proc.h
  - dma-mapping: benchmark: avoid needless copy_to_user if benchmark fails
  - nvme-multipath: find NUMA path only for online numa-node
  - vhost-scsi: Handle vhost_vq_work_queue failures for events
  - ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897
  - fs/ntfs3: Mark volume as dirty if xattr is broken
  - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
  - clk: mediatek: mt8183: Only enable runtime PM on mt8183-mfgcfg
  - clk: qcom: clk-alpha-pll: set ALPHA_EN bit for Stromer Plus PLLs
  - clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents
  - media: dw2102: fix a potential buffer overflow
  - arm64: dts: rockchip: Fix the DCDC_REG2 minimum voltage on Quartz64 Model B
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - net: stmmac: dwmac-qcom-ethqos: fix error array size
  - mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  - mtd: rawnand: Bypass a couple of sanity checks during NAND identification
  - mtd: rawnand: Fix the nand_read_data_op() early check
  - mtd: rawnand: Ensure ECC configuration is propagated to upper layers
  - powerpc/64s: Fix unnecessary copy to 0 when kernel is booted at address 0
  - powerpc/pseries: Fix scv instruction crash with kexec
  - clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common
  - clk: qcom: gcc-ipq9574: Add BRANCH_HALT_VOTED flag
  - drm: panel-orientation-quirks: Add quirk for Valve Galileo
  - drm/amdgpu/atomfirmware: silence UBSAN warning
  - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
  - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
  - fsnotify: Do not generate events for O_PATH file descriptors
  - can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct
  - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
  - Bluetooth: hci_bcm4377: Fix msgid release
  - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add()
  - f2fs: Add inline to f2fs_build_fault_attr() stub
  - btrfs: fix adding block group to a reclaim list and the unused list during reclaim
  - mm: avoid overflows in dirty throttling logic
  - mm: optimize the redundant loop of mm_update_owner_next()
  - nilfs2: add missing check for inode numbers on directory entries
  - nilfs2: fix inode number range checks
  - Revert "igc: fix a log entry using uninitialized netdev"
  - platform/x86: toshiba_acpi: Fix quickstart quirk handling
  - cpu: Fix broken cmdline "nosmp" and "maxcpus=0"
  - gpiolib: of: add polarity quirk for TSC2005
  - mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file
  - inet_diag: Initialize pad field in struct inet_diag_req_v2
  - selftests: make order checking verbose in msg_zerocopy selftest
  - selftests: fix OOM in msg_zerocopy selftest
  - netfilter: nf_tables: unconditionally flush pending work before notifier
  - riscv: kexec: Avoid deadlock in kexec crash path
  - wifi: wilc1000: fix ies_len type in connect path
  - gpio: mmio: do not calculate bgpio_bits via "ngpios"
  - net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()
  - net: txgbe: initialize num_q_vectors for MSI/INTx interrupts
  - gpiolib: of: fix lookup quirk for MIPS Lantiq
  - e1000e: Fix S0ix residency on corporate systems
  - KVM: s390: fix LPSWEY handling
  - tcp_metrics: validate source addr length
  - bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
  - Bluetooth: ISO: Check socket flag instead of hcon
  - Bluetooth: Ignore too large handle values in BIG
  - Bluetooth: hci_event: Fix setting of unicast qos interval
  - net/mlx5e: Add mqprio_rl cleanup and free in mlx5e_priv_cleanup()
  - net/mlx5: E-switch, Create ingress ACL when needed
  - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
  - net: phy: phy_device: Fix PHY LED blinking code comment
  - mac802154: fix time calculation in ieee802154_configure_durations()
  - vhost_task: Handle SIGKILL by flushing work and exiting
  - vhost: Release worker mutex during flushes
  - vhost: Use virtqueue mutex for swapping worker
  - tools/power turbostat: Remember global max_die_id
  - cdrom: rearrange last_media_change check to avoid unintentional overflow
  - btrfs: scrub: initialize ret in scrub_simple_mirror() to fix compilation warning
  - s390/pkey: Wipe sensitive data on failure
  - jffs2: Fix potential illegal address access in jffs2_free_inode
  - serial: imx: Raise TX trigger level to 8
  - scsi: mpi3mr: Sanitise num_phys
  - f2fs: check validation of fault attrs in f2fs_build_fault_attr()
  - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
  - igc: fix a log entry using uninitialized netdev
  - selftests/net: fix uninitialized variables
  - powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
  - kunit: Fix timeout message
  - orangefs: fix out-of-bounds fsid access
  - powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
  - i2c: i801: Annotate apanel_addr as __ro_after_init
  - media: dvb-frontends: tda10048: Fix integer overflow
  - media: s2255: Use refcount_t instead of atomic_t for num_channels
  - media: dvb-frontends: tda18271c2dd: Remove casting during div
  - net: dsa: mv88e6xxx: Correct check for empty list
  - thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data
  - wifi: mt76: mt7996: add sanity checks for background radar trigger
  - wifi: mt76: replace skb_put with skb_put_zero
  - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB
  - Input: ff-core - prefer struct_size over open coded arithmetic
  - firmware: dmi: Stop decoding on broken entry
  - sctp: prefer struct_size over open coded arithmetic
  - riscv: Apply SiFive CIP-1200 workaround to single-ASID sfence.vma
  - media: dw2102: Don't translate i2c read into write
  - drm/amdgpu: fix the warning about the expression (int)size - len
  - drm/amdgpu: fix uninitialized scalar variable warning
  - drm/amd/display: Fix uninitialized variables in DM
  - drm/amd/display: Skip finding free audio for unknown engine_id
  - drm/amd/display: Check pipe offset before setting vblank
  - drm/amd/display: Check index msg_id before read or write
  - drm/amdgpu: Initialize timestamp for some legacy SOCs
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - drm/amdgpu: Fix uninitialized variable warnings
  - media: mediatek: vcodec: Only free buffer VA that is not NULL
  - crypto: aead,cipher - zeroize key buffer after use
  - RISC-V: KVM: Fix the initial sample period value
  - selftests/bpf: dummy_st_ops should reject 0 for non-nullable params
  - selftests/bpf: do not pass NULL for non-nullable params in dummy_st_ops
  - selftests/bpf: adjust dummy_st_ops_success to detect additional error
  - scsi: qedf: Make qedf_execute_tmf() non-preemptible
  - IB/core: Implement a limit on UMAD receive List
  - media: dvb-usb: dib0700_devices: Add missing release_firmware()
  - media: dvb: as102-fe: Fix as10x_register_addr packing
  - powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
  - drm/lima: fix shared irq handling on driver remove
  - leds: an30259a: Use devm_mutex_init() for mutex initialization
  - locking/mutex: Introduce devm_mutex_init()
  - Revert "powerpc/bpf: rename powerpc64_jit_data to powerpc_jit_data"
  - Revert "powerpc/bpf: use bpf_jit_binary_pack_[alloc|finalize|free]"
  - tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()
  - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
  - serial: imx: only set receiver level if it is zero
  - cxl/region: Avoid null pointer dereference in region lookup
  - cxl/region: Move cxl_dpa_to_region() work to the region driver
  - arm64: dts: rockchip: Add sound-dai-cells for RK3368
  - arm64: dts: rockchip: fix PMIC interrupt pin on ROCK Pi E
  - arm64: dts: rockchip: make poweroff(8) work on Radxa ROCK 5A
  - ARM: dts: rockchip: rk3066a: add #sound-dai-cells to hdmi node
  - arm64: dts: rockchip: Fix the value of `dlg,jack-det-rate` mismatch on rk3399-gru
  - arm64: dts: rockchip: Rename LED related pinctrl nodes on rk3308-rock-pi-s
  - arm64: dts: rockchip: Fix SD NAND and eMMC init on rk3308-rock-pi-s
  - pwm: stm32: Refuse too small period requests
  - syscalls: fix sys_fanotify_mark prototype
  - syscalls: fix compat_sys_io_pgetevents_time64 usage
  - ftruncate: pass a signed offset
  - ata: libata-core: Fix double free on error
  - ata: ahci: Clean up sysfs file on error
  - can: mcp251xfd: fix infinite loop when xmit fails
  - batman-adv: Don't accept TT entries for out-of-spec VIDs
  - drm/amdgpu/atomfirmware: fix parsing of vram_info
  - drm/amd/display: Send DP_TOTAL_LTTPR_CNT during detection if LTTPR is present
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  - drm/i915/gt: Fix potential UAF by revoke of fence registers
  - drm/amdgpu: avoid using null object of framebuffer
  - drm/fbdev-dma: Only set smem_start is enable per module option
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  - drm/drm_file: Fix pid refcounting race
  - hexagon: fix fadvise64_64 calling conventions
  - csky, hexagon: fix broken sys_sync_file_range
  - btrfs: zoned: fix initial free space detection
  - sh: rework sync_file_range ABI
  - kbuild: Install dtb files as 0644 in Makefile.dtbinst
  - cpu/hotplug: Fix dynstate assignment in __cpuhp_setup_state_cpuslocked()
  - cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing
  - PCI/MSI: Fix UAF in msi_capability_init
  - net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
  - net: can: j1939: recover socket queue on CAN bus error during BAM transmission
  - net: can: j1939: Initialize unused data in j1939_send_one()
  - tty: mcf: MCF54418 has 10 UARTS
  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook 645/665 G11.
  - serial: bcm63xx-uart: fix tx after conversion to uart_port_tx_limited()
  - serial: core: introduce uart_port_tx_limited_flags()
  - serial: imx: set receiver level before starting uart
  - serial: 8250_omap: Implementation of Errata i2310
  - Revert "serial: core: only stop transmit when HW fifo is empty"
  - usb: dwc3: core: Workaround for CSR read timeout
  - usb: dwc3: core: Add DWC31 version 2.00a controller
  - usb: ucsi: stm32: fix command completion handling
  - usb: typec: ucsi: glink: fix child node release in probe function
  - usb: gadget: aspeed_udc: fix device address configuration
  - usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  - usb: musb: da8xx: fix a resource leak in probe()
  - usb: gadget: printer: fix races against disable
  - usb: gadget: printer: SS+ support
  - net: usb: ax88179_178a: improve link status logs
  - iio: chemical: bme680: Fix sensor data read operation
  - iio: chemical: bme680: Fix overflows in compensate() functions
  - iio: chemical: bme680: Fix calibration data variable
  - iio: chemical: bme680: Fix pressure value output
  - iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF
  - iio: adc: ad7266: Fix variable checking bug
  - ata,scsi: libata-core: Do not leak memory for ata_port struct members
  - ata: libata-core: Fix null pointer dereference on error
  - i2c: testunit: discard write requests while old command is running
  - i2c: testunit: don't erase registers after STOP
  - kbuild: Fix build target deb-pkg: ln: failed to create hard link
  - kbuild: doc: Update default INSTALL_MOD_DIR from extra to updates
  - counter: ti-eqep: enable clock at probe
  - iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  - mmc: sdhci: Do not invert write-protect twice
  - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  - mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  - mmc: sdhci-pci-o2micro: Convert PCIBIOS_* return codes to errnos
  - mm: fix incorrect vbq reference in purge_fragmented_block
  - nfs: drop the incorrect assertion in nfs_swap_rw()
  - ocfs2: fix DIO failure due to insufficient transaction credits
  - pinctrl: qcom: spmi-gpio: drop broken pm8008 support
  - Revert "MIPS: pci: lantiq: restore reset gpio polarity"
  - parisc: use generic sys_fanotify_mark implementation
  - x86: stop playing stack games in profile_pc()
  - randomize_kstack: Remove non-functional per-arch entropy filtering
  - gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
  - riscv: stacktrace: convert arch_stack_walk() to noinstr
  - drm/amdgpu: Fix pci state save during mode-1 reset
  - RISC-V: fix vector insn load/store width mask
  - gpio: davinci: Validate the obtained number of IRQs
  - drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
  - nvme: fixup comment for nvme RDMA Provider Type
  - drm/radeon/radeon_display: Decrease the size of allocated memory
  - gfs2: Fix NULL pointer dereference in gfs2_log_flush
  - soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
  - irqchip/loongson: Select GENERIC_IRQ_EFFECTIVE_AFF_MASK if SMP for IRQ_LOONGARCH_CPU
  - media: dvbdev: Initialize sbuf
  - ALSA: emux: improve patch ioctl data validation
  - crypto: ecdh - explicitly zeroize private_key
  - net/dpaa2: Avoid explicit cpumask var allocation on stack
  - net/iucv: Avoid explicit cpumask var allocation on stack
  - RDMA/restrack: Fix potential invalid address access
  - bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode
  - wifi: ieee80211: check for NULL in ieee80211_mle_size_ok()
  - mtd: partitions: redboot: Added conversion of operands to a larger type
  - x86/fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup
  - vduse: Temporarily fail if control queue feature requested
  - vduse: validate block features only with block devices
  - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - powerpc/bpf: use bpf_jit_binary_pack_[alloc|finalize|free]
  - powerpc/bpf: rename powerpc64_jit_data to powerpc_jit_data
  - net: mana: Fix possible double free in error handling path
  - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
  - ALSA: seq: Fix missing MSB in MIDI2 SPP conversion
  - tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed TFO
  - powerpc: restore some missing spu syscalls
  - parisc: use correct compat recv/recvfrom syscalls
  - sparc: fix compat recv/recvfrom syscalls
  - sparc: fix old compat_sys_select()
  - net: dsa: microchip: fix wrong register write when masking interrupt
  - ALSA: seq: Fix missing channel at encoding RPN/NRPN MIDI2 messages
  - Fix race for duplicate reqsk on identical SYN
  - btrfs: use NOFS context when getting inodes during logging and log replay
  - xdp: Remove WARN() from __xdp_reg_mem_model()
  - ice: Rebuild TC queues on VSI queue reconfiguration
  - net: dsa: microchip: use collision based back pressure mode
  - net: phy: micrel: add Microchip KSZ 9477 to the device table
  - ibmvnic: Free any outstanding tx skbs during scrq reset
  - mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems
  - openvswitch: get related ct labels from its master if it is not confirmed
  - net: dsa: microchip: fix initial port flush problem
  - ASoC: fsl-asoc-card: set priv->pdev before using it
  - ASoC: amd: acp: remove i2s configuration check in acp_i2s_probe()
  - ASoC: amd: acp: add a null check for chip_pdev structure
  - s390/pci: Add missing virt_to_phys() for directed DIBV
  - bpf: Add missed var_off setting in coerce_subreg_to_size_sx()
  - bpf: Add missed var_off setting in set_sext32_default_val()
  - ASoC: q6apm-lpass-dai: close graph on prepare errors
  - workqueue: Increase worker desc's length to 32
  - ASoC: atmel: atmel-classd: Re-add dai_link->platform to fix card init
  - ASoC: atmel: convert not to use asoc_xxx()
  - ASoC: mediatek: mt8183-da7219-max98357: Fix kcontrol name collision
  - ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on right mclk
  - wifi: mac80211: Use flexible array in struct ieee80211_tim_ie
  - selftests: mptcp: userspace_pm: fixed subtest names
  - selftests: mptcp: print_test out of verify_listener_events
  - MIPS: pci: lantiq: restore reset gpio polarity
  - pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
  - pinctrl: rockchip: use dedicated pinctrl type for RK3328
  - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
  - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
  - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
  - Input: ili210x - fix ili251x_read_touch_data() return value
  - usb: typec: ucsi: Ack also failed Get Error commands
  - usb: typec: ucsi: Never send a lone connector change ack
  - iio: pressure: bmp280: Fix BMP580 temperature reading
  - iio: pressure: fix some word spelling errors
  - Revert "mm: mmap: allow for the maximum number of bits for randomizing mmap_base by default"
  - hid: asus: asus_report_fixup: fix potential read out of bounds
  - kprobe/ftrace: fix build error due to bad function definition
  - ASoC: Intel: sof-sdw: really remove FOUR_SPEAKER quirk
  - drm/amd/display: revert Exit idle optimizations before HDCP execution
  - LoongArch: Fix entry point in kernel image header
  - efi/loongarch: Directly position the loaded image file
  - vgacon: rework screen_info #ifdef checks
  - riscv: force PAGE_SIZE linear mapping if debug_pagealloc is enabled
  - riscv: Don't use PGD entries for the linear mapping
  - x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
  - x86/cpu/vfm: Add new macros to work with (vendor/family/model) values
  - tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
  - nbd: Fix signal handling
  - nbd: Improve the documentation of the locking assumptions
  - ocfs2: update inode fsync transaction id in ocfs2_unlink and ocfs2_link
  - ocfs2: convert to new timestamp accessors
  - wifi: rtl8xxxu: enable MFP support with security flag of RX descriptor
  - perf script: Show also errors for --insn-trace option
  - perf: script: add raw|disasm arguments to --insn-trace option
  - spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to CCR_BUSWIDTH_4
  - arm64: dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc
  - spi: stm32: qspi: Fix dual flash mode sanity test in stm32_qspi_setup()
  - dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to i2c-controller schema
  - dt-bindings: i2c: atmel,at91sam: correct path to i2c-controller schema
  - i2c: ocores: set IACK bit after core is enabled
  - mm/page_table_check: fix crash on ZONE_DEVICE
  - tcp: clear tp->retrans_stamp in tcp_rcv_fastopen_synack()
  - mm: mmap: allow for the maximum number of bits for randomizing mmap_base by default
  - efi/x86: Free EFI memory map only when installing a new one.
  - kcov: don't lose track of remote references during softirqs
  - gcov: add support for GCC 14
  - dt-bindings: dma: fsl-edma: fix dma-channels constraints
  - drm/radeon: fix UBSAN warning in kv_dpm.c
  - drm/i915/mso: using joiner is not possible with eDP MSO
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14AHP9
  - ALSA: hda/realtek: Limit mic boost on N14AP7
  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 445/465 G11.
  - ovl: fix encoding fid for lower only root
  - RDMA/mlx5: Follow rb_key.ats when creating new mkeys
  - RDMA/mlx5: Remove extra unlock on error path
  - RDMA/rxe: Fix data copy for IB_SEND_INLINE
  - KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC routes
  - KVM: arm64: Disassociate vcpus from redistributor region on teardown
  - LoongArch: Fix multiple hardware watchpoint issues
  - LoongArch: Trigger user-space watchpoints correctly
  - LoongArch: Fix watchpoint setting error
  - cifs: fix typo in module parameter enable_gcm_256
  - scsi: ufs: core: Free memory allocated for model before reinit
  - btrfs: retry block group reclaim without infinite loop
  - net: do not leave a dangling sk pointer, when socket creation fails
  - net: usb: ax88179_178a: improve reset check
  - net: stmmac: Assign configured channel value to EXTTS event
  - locking/atomic: scripts: fix ${atomic}_sub_and_test() kerneldoc
  - arm64: defconfig: enable the vf610 gpio driver
  - ACPI: EC: Evaluate orphan _REG under EC device
  - RDMA/mana_ib: Ignore optional access flags for MRs
  - RDMA/mlx5: Fix unwind flow as part of mlx5_ib_stage_init_init
  - firmware: psci: Fix return value from psci_system_suspend()
  - io_uring/rsrc: fix incorrect assignment of iter->nr_segs in io_import_fixed
  - spi: spi-imx: imx51: revert burst length calculation back to bits_per_word
  - arm64: dts: freescale: imx8mm-verdin: enable hysteresis on slow input pin
  - arm64: dts: imx93-11x11-evk: Remove the 'no-sdio' property
  - arm64: dts: freescale: imx8mp-venice-gw73xx-2x: fix BT shutdown GPIO
  - arm64: dts: imx8mp: Fix TC9595 input clock on DH i.MX8M Plus DHCOM SoM
  - arm64: dts: imx8mp: Fix TC9595 reset GPIO on DH i.MX8M Plus DHCOM SoM
  - thermal/drivers/mediatek/lvts_thermal: Return error in case of invalid efuse data
  - regulator: bd71815: fix ramp values
  - dmaengine: ioatdma: Fix missing kmem_cache_destroy()
  - dmaengine: fsl-edma: avoid linking both modules
  - dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
  - dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
  - dmaengine: ioatdma: Fix leaking on version mismatch
  - regulator: core: Fix modpost error "regulator_get_regmap" undefined
  - RDMA/rxe: Fix responder length checking for UD request packets
  - spi: cs42l43: Correct SPI root clock speed
  - RDMA/bnxt_re: Fix the max msix vectors macro
  - net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings
  - bnxt_en: Restore PTP tx_avail count in case of skb_pad() error
  - ice: Fix VSI list rule with ICE_SW_LKUP_LAST type
  - octeontx2-pf: Fix linking objects into multiple modules
  - octeontx2-pf: Add error handling to VLAN unoffload handling
  - virtio_net: fixing XDP for fully checksummed packets handling
  - virtio_net: checksum offloading handling fix
  - net: stmmac: No need to calculate speed divider when offload is disabled
  - selftests: openvswitch: Use bash as interpreter
  - ptp: fix integer overflow in max_vclocks_store
  - sched: act_ct: add netns into the key of tcf_ct_flow_table
  - net: phy: mxl-gpy: Remove interrupt mask clearing from config_init
  - net: lan743x: Support WOL at both the PHY and MAC appropriately
  - net: lan743x: disable WOL upon resume to restore full data path operation
  - qca_spi: Make interrupt remembering atomic
  - netns: Make get_net_ns() handle zero refcount net
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
  - ipv6: prevent possible NULL deref in fib6_nh_init()
  - bpf: Avoid splat in pskb_pull_reason
  - ALSA: hda: tas2781: Component should be unbound before deconstruction
  - ALSA: hda: cs35l56: Component should be unbound before deconstruction
  - cipso: fix total option length computation
  - net: mvpp2: use slab_build_skb for oversized frames
  - ice: avoid IRQ collision to fix init failure on ACPI S3 resume
  - ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option
  - ALSA: hda/realtek: Remove Framework Laptop 16 from quirks
  - MIPS: Routerboard 532: Fix vendor retry check code
  - ALSA: seq: ump: Fix missing System Reset message handling
  - PCI: Do not wait for disconnected devices when resuming
  - ACPI: EC: Install address space handler at the namespace root
  - usb: gadget: function: Remove usage of the deprecated ida_simple_xx() API
  - serial: exar: adding missing CTI and Exar PCI ids
  - f2fs: don't set RO when shutting down f2fs
  - PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
  - udf: udftime: prevent overflow in udf_disk_stamp_to_time()
  - usb: typec: ucsi_glink: drop special handling for CCI_BUSY
  - usb: dwc3: pci: Don't set "linux,phy_charger_detect" property on Lenovo Yoga Tab2 1380
  - Avoid hw_desc array overrun in dw-axi-dmac
  - usb: misc: uss720: check for incompatible versions of the Belkin F5U002
  - usb: gadget: uvc: configfs: ensure guid to be valid before set
  - kprobe/ftrace: bail out if ftrace was killed
  - power: supply: cros_usbpd: provide ID table for avoiding fallback match
  - platform/x86: p2sb: Don't init until unassigned resources have been assigned
  - powerpc/io: Avoid clang null pointer arithmetic warnings
  - media: mtk-vcodec: potential null pointer deference in SCP
  - media: intel/ipu6: Fix build with !ACPI
  - ALSA: hda/realtek: Add quirks for Lenovo 13X
  - drm/lima: mask irqs in timeout path before hard reset
  - drm/lima: add mask irq callback to gp and pp
  - ASoC: Intel: sof_sdw: add quirk for Dell SKU 0C0F
  - ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
  - platform/x86: toshiba_acpi: Add quirk for buttons on Z830
  - drm/amd/display: Exit idle optimizations before HDCP execution
  - Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
  - ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7
  - HID: asus: fix more n-key report descriptors if n-key quirked
  - HID: Add quirk for Logitech Casa touchpad
  - net: dsa: realtek: keep default LED state in rtl8366rb
  - kselftest: arm64: Add a null pointer check
  - net: sfp: add quirk for ATS SFP-GE-T 1000Base-TX module
  - scsi: qedi: Fix crash while reading debugfs attribute
  - ACPI: x86: Add PNP_UART1_SKIP quirk for Lenovo Blade2 tablets
  - af_packet: avoid a false positive warning in packet_setsockopt()
  - wifi: ath9k: work around memset overflow warning
  - selftests/bpf: Fix flaky test btf_map_in_map/lookup_update
  - selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh
  - block/ioctl: prefer different overflow check
  - rcutorture: Fix invalid context warning when enable srcu barrier testing
  - rcutorture: Make stall-tasks directly exit when rcutorture tests end
  - rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
  - io_uring/sqpoll: work around a potential audit memory leak
  - padata: Disable BH when taking works lock on MT path
  - zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
  - i2c: designware: Fix the functionality flags of the slave-only interface
  - i2c: at91: Fix the functionality flags of the slave-only interface
  - misc: microchip: pci1xxxx: Fix a memory leak in the error handling of gp_aux_bus_probe()
  - serial: core: Add UPIO_UNKNOWN constant for unknown port type
  - device property: Implement device_is_big_endian()
  - greybus: Fix use-after-free bug in gb_interface_release due to race condition.
  - remoteproc: k3-r5: Jump to error handling labels in start/stop errors
  - serial: 8250_pxa: Configure tx_loadsz to match FIFO IRQ level
  - mm/huge_memory: don't unpoison huge_zero_folio
  - tick/nohz_full: Don't abuse smp_call_function_single() in tick_setup_device()
  - nilfs2: fix potential kernel bug due to lack of writeback flag waiting
  - xfs: allow cross-linking special files without project quota
  - xfs: allow sunit mount option to repair bad primary sb stripe values
  - xfs: shrink failure needs to hold AGI buffer
  - xfs: fix SEEK_HOLE/DATA for regions with active COW extents
  - xfs: fix scrub stats file permissions
  - xfs: fix imprecise logic in xchk_btree_check_block_owner
  - pmdomain: ti-sci: Fix duplicate PD referrals
  - intel_th: pci: Add Lunar Lake support
  - intel_th: pci: Add Meteor Lake-S support
  - intel_th: pci: Add Sapphire Rapids SOC support
  - intel_th: pci: Add Granite Rapids SOC support
  - intel_th: pci: Add Granite Rapids support
  - drm/i915: Fix audio component initialization
  - drm/i915/dpt: Make DPT object unshrinkable
  - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
  - drm/i915/gt: Disarm breadcrumbs if engines are already idle
  - rtla/auto-analysis: Replace 	 with spaces
  - rtla/timerlat: Simplify "no value" printing on top
  - iio: invensense: fix interrupt timestamp alignment
  - iio: adc: axi-adc: make sure AXI clock is enabled
  - remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs
  - remoteproc: k3-r5: Wait for core0 power-up before powering up core1
  - dmaengine: axi-dmac: fix possible race in remove()
  - PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
  - ocfs2: use coarse time for new created files
  - fs/proc: fix softlockup in __read_vmcore
  - knfsd: LOOKUP can return an illegal error value
  - spmi: hisi-spmi-controller: Do not override device identifier
  - dma-buf: handle testing kthreads creation failure
  - null_blk: Print correct max open zones limit in null_init_zoned_dev()
  - kheaders: explicitly define file modes for archived headers
  - tracing/selftests: Fix kprobe event name test for .isra. functions
  - riscv: fix overlap of allocated page and PTR_ERR
  - perf auxtrace: Fix multiple use of --itrace option
  - perf/core: Fix missing wakeup when waiting for context reference
  - x86/amd_nb: Check for invalid SMN reads
  - x86/kexec: Fix bug with call depth tracking
  - irqchip/gic-v3-its: Fix potential race condition in its_vlpi_prop_update()
  - mptcp: pm: update add_addr counters after connect
  - mptcp: pm: inc RmAddr MIB counter once per RM_ADDR ID
  - ACPI: x86: Force StorageD3Enable on more products
  - drivers: core: synchronize really_probe() and dev_uevent()
  - iio: imu: inv_icm42600: delete unneeded update watermark call
  - iio: invensense: fix odr switching to same value
  - iio: dac: ad5592r: fix temperature channel scaling value
  - iio: adc: ad9467: fix scan type sign
  - x86/boot: Don't add the EFI stub to targets, again
  - ksmbd: fix missing use of get_write in in smb2_set_ea()
  - bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send()
  - af_unix: Read with MSG_PEEK loops if the first unread byte is OOB
  - net/ipv6: Fix the RT cache flush via sysctl using a previous delay
  - nvmet-passthru: propagate status from id override functions
  - block: fix request.queuelist usage in flush
  - block: sed-opal: avoid possible wrong address reference in read_sed_opal_key()
  - net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs parameters
  - gve: ignore nonrelevant GSO type bits when processing TSO headers
  - net: pse-pd: Use EOPNOTSUPP error code instead of ENOTSUPP
  - scsi: ufs: core: Quiesce request queues before checking pending cmds
  - x86/uaccess: Fix missed zeroing of ia32 u64 get_user() range checking
  - x86/asm: Use %c/%n instead of %PATCHoperand
  - netfilter: nft_inner: validate mandatory meta and payload
  - Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
  - net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets
  - geneve: Fix incorrect inner network header offset when innerprotoinherit is set
  - net dsa: qca8k: fix usages of device_get_named_child_node()
  - tcp: fix race in tcp_v6_syn_recv_sock()
  - drm/bridge/panel: Fix runtime warning on panel bridge release
  - net: stmmac: dwmac-qcom-ethqos: Configure host DMA width
  - net: sfp: Always call `sfp_sm_mod_remove()` on remove
  - modpost: do not warn about missing MODULE_DESCRIPTION() for vmlinux.o
  - af_unix: Annotate data-race of sk->sk_state in unix_accept().
  - drm/vmwgfx: Don't memcmp equivalent pointers
  - drm/vmwgfx: Remove STDU logic from generic mode_valid function
  - drm/vmwgfx: 3D disabled should not effect STDU memory limits
  - drm/vmwgfx: Filter modes which exceed graphics memory
  - drm/vmwgfx: Refactor drm connector probing for display modes
  - io_uring/io-wq: avoid garbage value of 'match' in io_wq_enqueue()
  - iommu: Return right value in iommu_sva_bind_device()
  - iommu/amd: Fix sysfs leak in iommu init
  - HID: core: remove unnecessary WARN_ON() in implement()
  - gpio: tqmx86: fix broken IRQ_TYPE_EDGE_BOTH interrupt type
  - gpio: tqmx86: store IRQ trigger type and unmask status separately
  - gpio: tqmx86: introduce shadow register for GPIO output value
  - gpio: tqmx86: fix typo in Kconfig label
  - platform/x86: dell-smbios: Fix wrong token data in sysfs
  - drm/panel: sitronix-st7789v: Add check for of_drm_get_panel_orientation
  - nvme: fix nvme_pr_* status code parsing
  - selftests/tracing: Fix event filter test to retry up to 10 times
  - NFS: add barriers when testing for NFS_FSDATA_BLOCKED
  - SUNRPC: return proper error from gss_wrap_req_priv
  - NFSv4.1 enforce rootpath check in fs_location query
  - clk: sifive: Do not register clkdevs for PRCI clocks
  - selftests/ftrace: Fix to check required event file
  - cxl/test: Add missing vmalloc.h for tools/testing/cxl/test/mem.c
  - HID: nvidia-shield: Add missing check for input_ff_create_memless
  - powerpc/uaccess: Fix build errors seen with GCC 13/14
  - gve: Clear napi->skb before dev_kfree_skb_any()
  - scsi: sd: Use READ(16) when reading block zero on large capacity disks
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
  - scsi: mpi3mr: Fix ATA NCQ priority support
  - scsi: core: Disable CDL by default
  - thunderbolt: debugfs: Fix margin debugfs node creation condition
  - xhci: Apply broken streams quirk to Etron EJ188 xHCI host
  - xhci: Handle TD clearing for multiple streams case
  - xhci: Apply reset resume quirk to Etron EJ188 xHCI host
  - xhci: Set correct transferred length for cancelled bulk transfers
  - jfs: xattr: fix buffer overflow for invalid xattr
  - landlock: Fix d_parent walk
  - serial: port: Don't block system suspend even if bytes are left to xmit
  - tty: n_tty: Fix buffer offsets when lookahead is used
  - mei: me: release irq in mei_me_pci_resume error path
  - usb: typec: tcpm: Ignore received Hard Reset in TOGGLING state
  - usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps
  - USB: xen-hcd: Traverse host/ when CONFIG_USB_XEN_HCD is selected
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - bpf: fix multi-uprobe PID filtering logic
  - eventfs: Update all the eventfs_inodes from the events descriptor
  - irqchip/riscv-intc: Prevent memory leak when riscv_intc_init_common() fails
  - irqchip/riscv-intc: Introduce Andes hart-level interrupt controller
  - irqchip/riscv-intc: Allow large non-standard interrupt number
  - selftests/mm: compaction_test: fix bogus test success on Aarch64
  - selftests/mm: log a consistent test name for check_compaction
  - selftests/mm: conform test to TAP format output
  - memory-failure: use a folio in me_huge_page()
  - firmware: qcom_scm: disable clocks if qcom_scm_bw_enable() fails
  - ksmbd: use rwsem instead of rwlock for lease break
  - net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool()
  - af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().
  - af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen().
  - af_unix: Use skb_queue_empty_lockless() in unix_release_sock().
  - af_unix: Use unix_recvq_full_lockless() in unix_stream_connect().
  - af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen.
  - af_unix: Annotate data-races around sk->sk_sndbuf.
  - af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG.
  - af_unix: Annotate data-race of sk->sk_state in unix_stream_read_skb().
  - af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg().
  - af_unix: Annotate data-race of sk->sk_state in unix_stream_connect().
  - af_unix: Annotate data-races around sk->sk_state in unix_write_space() and poll().
  - af_unix: Annotate data-race of sk->sk_state in unix_inq_len().
  - af_unix: Annodate data-races around sk->sk_state for writers.
  - af_unix: Set sk->sk_state under unix_state_lock() for truly disconencted peer.
  - net: wwan: iosm: Fix tainted pointer delete is case of region creation fail
  - ice: add flag to distinguish reset from .ndo_bpf in XDP rings config
  - ice: remove af_xdp_zc_qps bitmap
  - ice: fix iteration of TLVs in Preserved Fields Area
  - ptp: Fix error message on failed pin verification
  - net/mlx5: Fix tainted pointer delete is case of flow rules creation fail
  - net/mlx5: Stop waiting for PCI if pci channel is offline
  - mptcp: count CLOSE-WAIT sockets for MPTCP_MIB_CURRESTAB
  - tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB
  - vxlan: Fix regression when dropping packets due to invalid src addresses
  - net: phy: Micrel KSZ8061: fix errata solution not taking effect problem
  - net/smc: avoid overwriting when adjusting sock bufsizes
  - octeontx2-af: Always allocate PF entries from low prioriy zone
  - net: tls: fix marking packets as decrypted
  - ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
  - ipv6: ioam: block BH from ioam6_output()
  - bpf: Store ref_ctr_offsets values in bpf_uprobe array
  - net: phy: micrel: fix KSZ9477 PHY issues after suspend/resume
  - net/ncsi: Fix the multi thread manner of NCSI driver
  - net/ncsi: Simplify Kconfig/dts control flow
  - ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put()
  - ax25: Fix refcount imbalance on inbound connections
  - RISC-V: KVM: Fix incorrect reg_subtype labels in kvm_riscv_vcpu_set_reg_isa_ext function
  - RISC-V: KVM: No need to use mask when hart-index-bit is 0
  - scsi: ufs: mcq: Fix error output and clean up ufshcd_mcq_abort()
  - wifi: mac80211: correctly parse Spatial Reuse Parameter Set element
  - wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
  - wifi: iwlwifi: mvm: set properly mac header
  - wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
  - wifi: iwlwifi: mvm: don't initialize csa_work twice
  - wifi: cfg80211: pmsr: use correct nla_get_uX functions
  - wifi: cfg80211: Lock wiphy in cfg80211_get_station
  - wifi: cfg80211: fully move wiphy work to unbound workqueue
  - !10369 Backport 6.6.33-34 LTS patches from upstream
  - openeuler_defconfig: add new config
  - selftests: net: more strict check in net_helper
  - powerpc/bpf: enforce full ordering for ATOMIC operations with BPF_FETCH
  - ALSA: seq: Fix incorrect UMP type for system messages
  - btrfs: fix leak of qgroup extent records after transaction abort
  - tracefs: Clear EVENT_INODE flag in tracefs_drop_inode()
  - eventfs: Keep the directories from having the same inode number as files
  - NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS
  - nfs: fix undefined behavior in nfs_block_bits()
  - EDAC/igen6: Convert PCIBIOS_* return codes to errnos
  - ALSA: ump: Don't accept an invalid UMP protocol number
  - ALSA: ump: Don't clear bank selection after sending a program change
  - i3c: master: svc: fix invalidate IBI type and miss call client IBI handler
  - s390/cpacf: Make use of invalid opcode produce a link error
  - s390/cpacf: Split and rework cpacf query functions
  - parisc: Define sigset_t in parisc uapi header
  - parisc: Define HAVE_ARCH_HUGETLB_UNMAPPED_AREA
  - ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat
  - ARM: dts: samsung: smdk4412: fix keypad no-autorepeat
  - ARM: dts: samsung: smdkv310: fix keypad no-autorepeat
  - riscv: dts: starfive: Remove PMIC interrupt info for Visionfive 2 board
  - drm/amdkfd: handle duplicate BOs in reserve_bo_and_cond_vms
  - sparc: move struct termio to asm/termios.h
  - kdb: Use format-specifiers rather than memset() for padding in kdb_read()
  - kdb: Merge identical case statements in kdb_read()
  - kdb: Fix console handling when editing and tab-completing commands
  - kdb: Use format-strings rather than '0' injection in kdb_read()
  - wifi: ath10k: fix QCOM_RPROC_COMMON dependency
  - watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin
  - selftests/mm: fix build warnings on ppc64
  - selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages
  - mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL
  - mm: /proc/pid/smaps_rollup: avoid skipping vma after getting mmap_lock again
  - mm/hugetlb: pass correct order_per_bit to cma_declare_contiguous_nid
  - mm/cma: drop incorrect alignment check in cma_init_reserved_mem
  - sparc64: Fix number of online CPUs
  - rtla/timerlat: Fix histogram report when a cpu count is 0
  - intel_th: pci: Add Meteor Lake-S CPU support
  - tpm_tis: Do *not* flush uninitialized work
  - kmsan: do not wipe out origin when doing partial unpoisoning
  - mm/ksm: fix ksm_pages_scanned accounting
  - net/ipv6: Fix route deleting failure when metric equals 0
  - scsi: core: Handle devices which return an unusually large VPD page count
  - HID: i2c-hid: elan: fix reset suspend current leakage
  - filemap: add helper mapping_max_folio_size()
  - kbuild: Remove support for Clang's ThinLTO caching
  - crypto: ecrdsa - Fix module auto-load on add_key
  - crypto: ecdsa - Fix module auto-load on add-key
  - clk: qcom: clk-alpha-pll: fix rate setting for Stromer PLLs
  - LoongArch: Override higher address bits in JUMP_VIRT_ADDR
  - LoongArch: Add all CPUs enabled by fdt to NUMA node 0
  - KVM: arm64: AArch32: Fix spurious trapping of conditional instructions
  - KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
  - KVM: arm64: Fix AArch32 register narrowing on userspace write
  - Revert "drm/amdkfd: fix gfx_target_version for certain 11.0.3 devices"
  - drm/amd: Fix shutdown (again) on some SMU v13.0.4/11 platforms
  - drm/amdgpu/atomfirmware: add intergrated info v2.3 table
  - drm/fbdev-generic: Do not set physical framebuffer address
  - mmc: sdhci-acpi: Add quirk to enable pull-up on the card-detect GPIO on Asus T100TA
  - mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A
  - mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working
  - mmc: sdhci-acpi: Sort DMI quirks alphabetically
  - mmc: sdhci: Add support for "Tuning Error" interrupts
  - mmc: core: Add mmc_gpiod_set_cd_config() function
  - media: v4l: async: Don't set notifier's V4L2 device if registering fails
  - media: v4l2-core: hold videodev_lock until dev reg, finishes
  - media: mxl5xx: Move xpt structures off stack
  - media: mc: mark the media devnode as registered from the, start
  - arm64: dts: ti: verdin-am62: Set memory size to 2gb
  - arm64: dts: hi3798cv200: fix the size of GICR
  - arm64: dts: qcom: sc8280xp: add missing PCIe minimum OPP
  - wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path
  - wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE
  - wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power
  - wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
  - wifi: rtw89: pci: correct TX resource checking for PCI DMA channel of firmware command
  - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING
  - arm64: dts: qcom: qcs404: fix bluetooth device address
  - arm64: tegra: Correct Tegra132 I2C alias
  - ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
  - soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request
  - proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation
  - fsverity: use register_sysctl_init() to avoid kmemleak warning
  - ata: pata_legacy: make legacy_exit() work again
  - wifi: rtw89: correct aSIFSTime for 6GHz band
  - bcache: fix variable length array abuse in btree_iter
  - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
  - drm/sun4i: hdmi: Move mode_set into enable
  - drm/sun4i: hdmi: Convert encoder to atomic
  - selftests: net: List helper scripts in TEST_FILES Makefile variable
  - selftests: net: included needed helper in the install targets
  - selftests/net: synchronize udpgro tests' tx and rx connection
  - vxlan: Fix regression when dropping packets due to invalid src addresses
  - erofs: avoid allocating DEFLATE streams before mounting
  - mptcp: fix full TCP keep-alive support
  - mptcp: cleanup SOL_TCP handling
  - mptcp: avoid some duplicate code in socket option handling
  - net: sfp-bus: fix SFP mode detect from bitrate
  - afs: Don't cross .backup mountpoint from backup volume
  - mmc: core: Do not force a retune before RPMB switch
  - riscv: stacktrace: fixed walk_stackframe()
  - riscv: prevent pt_regs corruption for secondary idle threads
  - SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
  - f2fs: use f2fs_{err,info}_ratelimited() for cleanup
  - f2fs: write missing last sum blk of file pinning section
  - perf sched timehist: Fix -g/--call-graph option failure
  - media: vsp1: Remove unbalanced .s_stream(0) calls
  - nouveau: report byte usage in VRAM usage.
  - RDMA/bnxt_re: Fix the sparse warnings
  - perf evlist: Add perf_evlist__go_system_wide() helper
  - platform/x86/intel-uncore-freq: Don't present root domain on error
  - platform/x86/intel/tpmi: Handle error from tpmi_process_info()
  - KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in CPUID
  - x86/pci: Skip early E820 check for ECAM region
  - x86/efistub: Omit physical KASLR when memory reservations exist
  - ALSA: seq: ump: Fix swapped song position pointer data
  - hwmon: (shtc1) Fix property misspelling
  - hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board power sensor
  - drm/panel: sitronix-st7789v: fix display size for jt240mhqs_hwt_ek_e3 panel
  - drm/panel: sitronix-st7789v: tweak timing for jt240mhqs_hwt_ek_e3 panel
  - drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3 panel
  - powerpc/pseries/lparcfg: drop error message from guest name lookup
  - ALSA: seq: Fix yet another spot for system message conversion
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  - net: ena: Fix redundant device NUMA node override
  - net: ena: Reduce lines with longer column width boundary
  - net: dsa: microchip: fix RGMII error in KSZ DSA driver
  - spi: stm32: Don't warn about spurious interrupts
  - kheaders: use `command -v` to test for existence of `cpio`
  - drm/i915/gt: Fix CCS id's calculation for CCS mode setting
  - drm/i915/guc: avoid FIELD_PREP warning
  - kconfig: fix comparison to constant symbols, 'm', 'n'
  - net/sched: taprio: extend minimum interval restriction to entire cycle too
  - net/sched: taprio: make q->picos_per_byte available to fill_sched_entry()
  - netfilter: nft_fib: allow from forward/input without iif selector
  - netfilter: tproxy: bail out if IP has been disabled on the device
  - netfilter: nft_payload: skbuff vlan metadata mangle support
  - net: ti: icssg-prueth: Fix start counter for ft1 filter
  - ALSA: seq: Don't clear bank selection at event -> UMP MIDI2 conversion
  - ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP conversion
  - selftests: mptcp: join: mark 'fail' tests as flaky
  - selftests: mptcp: add ms units for tc-netem delay
  - selftests: mptcp: simult flows: mark 'unbalanced' tests as flaky
  - ice: fix accounting if a VLAN already exists
  - net: micrel: Fix lan8841_config_intr after getting out of sleep mode
  - net:fec: Add fec_enet_deinit()
  - ASoC: cs42l43: Only restrict 44.1kHz for the ASP
  - net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
  - Octeontx2-pf: Free send queue buffers incase of leaf to inner
  - af_unix: Read sk->sk_hash under bindlock during bind().
  - af_unix: Annotate data-race around unix_sk(sk)->addr.
  - enic: Validate length of nl attributes in enic_set_vf_port
  - ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp
  - ALSA: core: Remove debugfs at disconnection
  - ALSA: jack: Use guard() for locking
  - bpf: Fix potential integer overflow in resolve_btfids
  - net/mlx5e: Fix UDP GSO for encapsulated packets
  - net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion
  - net/mlx5e: Fix IPsec tunnel mode offload feature check
  - net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules
  - net/mlx5: Fix MTMP register capability offset in MCAM register
  - net/mlx5: Lag, do bond only if slaves agree on roce state
  - net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061
  - drm/amd/display: Enable colorspace property for MST connectors
  - nvmet: fix ns enable/disable possible hang
  - nvme-multipath: fix io accounting on failover
  - nvme-tcp: add definitions for TLS cipher suites
  - dma-mapping: benchmark: handle NUMA_NO_NODE correctly
  - dma-mapping: benchmark: fix node id validation
  - dma-mapping: benchmark: fix up kthread-related error handling
  - kthread: add kthread_stop_put
  - netfilter: nft_payload: restore vlan q-in-q match support
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
  - kasan, fortify: properly rename memintrinsics
  - ice: Interpret .set_channels() input differently
  - drivers/xen: Improve the late XenStore init protocol
  - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
  - net: relax socket state check at accept time.
  - net: fec: avoid lock evasion when reading pps_enable
  - Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI"
  - i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame
  - i3c: master: svc: return actual transfer data len
  - i3c: master: svc: rename read_len as actual_len
  - i3c: add actual_len in i3c_priv_xfer
  - net: lan966x: Remove ptp traps in case the ptp is not enabled.
  - rv: Update rv_en(dis)able_monitor doc to match kernel-doc
  - openvswitch: Set the skbuff pkt_type for proper pmtud support.
  - pNFS/filelayout: fixup pNfs allocation modes
  - regulator: tps6594-regulator: Correct multi-phase configuration
  - af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.
  - regulator: tps6287x: Force writing VSEL bit
  - regulator: pickable ranges: don't always cache vsel
  - rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
  - sunrpc: fix NFSACL RPC retry on soft mount
  - nfs: keep server info for remounts
  - NFSv4: Fixup smatch warning for ambiguous return
  - ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
  - nfc: nci: Fix uninit-value in nci_rx_work
  - selftests: net: kill smcrouted in the cleanup logic in amt.sh
  - ipv6: sr: fix missing sk_buff release in seg6_input_core
  - net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled
  - x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y
  - perf/arm-dmc620: Fix lockdep assert in ->event_init()
  - xen/x86: add extra pages to unpopulated-alloc if available
  - regulator: bd71828: Don't overwrite runtime voltages
  - blk-cgroup: Properly propagate the iostat update up the hierarchy
  - blk-cgroup: fix list corruption from resetting io stat
  - drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations
  - nouveau: add an ioctl to report vram usage
  - nouveau: add an ioctl to return vram bar size.
  - ASoC: mediatek: mt8192: fix register configuration for tdm
  - ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance
  - ALSA: hda: cs35l56: Initialize all ASP1 registers
  - ASoC: cs35l56: Fix to ensure ASP1 registers match cache
  - null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
  - ASoC: tas2781: Fix a warning reported by robot kernel test
  - selftests/powerpc/dexcr: Add -no-pie to hashchk tests
  - Revert "drm/bridge: ti-sn65dsi83: Fix enable error path"
  - media: cec: core: avoid confusing "transmit timed out" message
  - media: cec: core: avoid recursive cec_claim_log_addrs
  - media: cec: cec-api: add locking in cec_release()
  - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
  - media: sunxi: a83-mips-csi2: also select GENERIC_PHY
  - cxl/region: Fix cxlr_pmem leaks
  - cxl/trace: Correct DPA field masks for general_media & dram events
  - um: Fix the declaration of kasan_map_memory
  - um: Fix the -Wmissing-prototypes warning for get_thread_reg
  - um: Fix the -Wmissing-prototypes warning for __switch_mm
  - powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
  - media: flexcop-usb: fix sanity check of bNumEndpoints
  - platform/x86: thinkpad_acpi: Take hotkey_mutex during hotkey_exit()
  - tools/arch/x86/intel_sdsi: Fix meter_certificate decoding
  - tools/arch/x86/intel_sdsi: Fix meter_show display
  - tools/arch/x86/intel_sdsi: Fix maximum meter bundle length
  - media: mediatek: vcodec: fix possible unbalanced PM counter
  - media: mediatek: vcodec: add encoder power management helper functions
  - drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()
  - drm/amdgpu: init microcode chip name from ip versions
  - Input: cyapa - add missing input core locking to suspend/resume functions
  - drm/bridge: tc358775: fix support for jeida-18 and jeida-24
  - um: vector: fix bpfflash parameter evaluation
  - um: Add winch to winch_handlers before registering winch IRQ
  - um: Fix return value in ubd_init()
  - drm/meson: gate px_clk when setting rate
  - drm/mediatek: dp: Fix mtk_dp_aux_transfer return value
  - drm/msm/dpu: Always flush the slave INTF on the CTL
  - drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk
  - media: ov2680: Do not fail if data-lanes property is absent
  - media: ov2680: Allow probing if link-frequencies is absent
  - media: ov2680: Clear the 'ret' variable on success
  - media: v4l: Don't turn on privacy LED if streamon fails
  - media: v4l2-subdev: Document and enforce .s_stream() requirements
  - Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
  - mmc: sdhci_am654: Fix ITAPDLY for HS400 timing
  - mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
  - mmc: sdhci_am654: Add OTAP/ITAP delay enable
  - mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel
  - mmc: sdhci_am654: Write ITAPDLY for DDR52 timing
  - mmc: sdhci_am654: Add tuning algorithm for delay chain
  - Input: ims-pcu - fix printf string overflow
  - dt-bindings: adc: axi-adc: add clocks property
  - dt-bindings: adc: axi-adc: update bindings for backend framework
  - eventfs: Have "events" directory get permissions from its parent
  - eventfs: Free all of the eventfs_inode after RCU
  - eventfs/tracing: Add callback for release of an eventfs_inode
  - eventfs: Create eventfs_root_inode to store dentry
  - serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler
  - serial: sc16is7xx: replace hardcoded divisor value with BIT() macro
  - misc/pvpanic-pci: register attributes via pci_driver
  - misc/pvpanic: deduplicate common code
  - iio: accel: mxc4005: Reset chip on probe() and resume()
  - iio: accel: mxc4005: allow module autoloading via OF compatible
  - eventfs: Do not differentiate the toplevel events directory
  - drm/amd/display: Revert Remove pixle rate limit for subvp
  - drm/amd/display: Remove pixle rate limit for subvp
  - dt-bindings: PCI: rockchip,rk3399-pcie: Add missing maxItems to ep-gpios
  - s390/boot: Remove alt_stfle_fac_list from decompressor
  - s390/ipl: Fix incorrect initialization of nvme dump block
  - s390/ipl: Fix incorrect initialization of len fields in nvme reipl block
  - s390/vdso: Use standard stack frame layout
  - s390/vdso: Generate unwind information for C modules
  - s390/vdso64: filter out munaligned-symbols flag for vdso
  - LoongArch: Fix callchain parse error with kernel tracepoint events again
  - perf tools: Add/use PMU reverse lookup from config to name
  - perf tools: Use pmus to describe type from attribute
  - perf pmu: "Compat" supports regular expression matching identifiers
  - perf pmu: Move pmu__find_core_pmu() to pmus.c
  - perf test: Add a test for strcmp_cpuid_str() expression
  - perf stat: Don't display metric header for non-leader uncore events
  - usb: fotg210: Add missing kernel doc description
  - f2fs: fix to add missing iput() in gc_data_segment()
  - perf daemon: Fix file leak in daemon_session__control
  - libsubcmd: Fix parse-options memory leak
  - serial: sh-sci: protect invalidating RXDMA on shutdown
  - f2fs: fix to release node block count in error path of f2fs_new_node_page()
  - f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
  - f2fs: compress: fix error path of inc_valid_block_count()
  - f2fs: introduce get_available_block_count() for cleanup
  - f2fs: deprecate io_bits
  - f2fs: compress: fix to update i_compr_blocks correctly
  - perf symbols: Fix ownership of string in dso__load_vmlinux()
  - perf maps: Move symbol maps functions to maps.c
  - perf thread: Fixes to thread__new() related to initializing comm
  - perf report: Avoid SEGV in report__setup_sample_type()
  - perf ui browser: Avoid SEGV on title
  - f2fs: fix block migration when section is not aligned to pow2
  - f2fs: support file pinning for zoned devices
  - f2fs: kill heap-based allocation
  - f2fs: separate f2fs_gc_range() to use GC for a range
  - f2fs: use BLKS_PER_SEG, BLKS_PER_SEC, and SEGS_PER_SEC
  - f2fs: support printk_ratelimited() in f2fs_printk()
  - f2fs: Clean up errors in segment.h
  - PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
  - PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
  - dt-bindings: spmi: hisilicon,hisi-spmi-controller: fix binding references
  - extcon: max8997: select IRQ_DOMAIN instead of depending on it
  - perf ui browser: Don't save pointer to stack memory
  - perf bench internals inject-build-id: Fix trap divide when collecting just one DSO
  - i2c: synquacer: Fix an error handling path in synquacer_i2c_probe()
  - i2c: cadence: Avoid fifo clear after start
  - ppdev: Add an error check in register_device
  - ppdev: Remove usage of the deprecated ida_simple_xx() API
  - stm class: Fix a double free in stm_register_device()
  - usb: gadget: u_audio: Clear uac pointer when freed.
  - dt-bindings: phy: qcom,usb-snps-femto-v2: use correct fallback for sc8180x
  - dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: fix msm899[68] power-domains
  - watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe()
  - watchdog: bd9576: Drop "always-running" property
  - pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins regs
  - dt-bindings: pinctrl: mediatek: mt7622: fix array properties
  - VMCI: Fix an error handling path in vmci_guest_probe_device()
  - ovl: remove upper umask handling from ovl_create_upper()
  - leds: pwm: Disable PWM when going to suspend
  - pwm: Rename pwm_apply_state() to pwm_apply_might_sleep()
  - perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer)
  - PCI: Wait for Link Training==0 before starting Link retrain
  - microblaze: Remove early printk call from cpuinfo-static.c
  - microblaze: Remove gcc flag for non existing early_printk.c file
  - udf: Convert udf_expand_file_adinicb() to use a folio
  - udf: Remove GFP_NOFS allocation in udf_expand_file_adinicb()
  - i915: make inject_virtual_interrupt() void
  - coresight: etm4x: Fix access to resource selector registers
  - coresight: etm4x: Safe access for TRCQCLTR
  - coresight: etm4x: Do not save/restore Data trace control registers
  - coresight: etm4x: Do not hardcode IOMEM access for register restore
  - iio: adc: adi-axi-adc: only error out in major version mismatch
  - iio: adc: adi-axi-adc: move to backend framework
  - iio: adc: ad9467: convert to backend framework
  - iio: add the IIO backend framework
  - iio: buffer-dmaengine: export buffer alloc and free functions
  - iio: adc: adi-axi-adc: convert to regmap
  - iio: adc: ad9467: use chip_info variables instead of array
  - iio: adc: ad9467: use spi_get_device_match_data()
  - iio: pressure: dps310: support negative temperature values
  - perf test shell arm_coresight: Increase buffer size for Coresight basic tests
  - perf docs: Document bpf event modifier
  - coresight: etm4x: Fix unbalanced pm_runtime_enable()
  - riscv: dts: starfive: visionfive 2: Remove non-existing TDM hardware
  - iio: adc: stm32: Fixing err code to not indicate success
  - f2fs: fix to check pinfile flag in f2fs_move_file_range()
  - f2fs: fix to relocate check condition in f2fs_fallocate()
  - f2fs: compress: fix to relocate check condition in f2fs_ioc_{,de}compress_file()
  - f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks()
  - perf bench uprobe: Remove lib64 from libc.so.6 binary path
  - dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties
  - dt-bindings: PCI: rcar-pci-host: Add optional regulators
  - perf record: Fix debug message placement for test consumption
  - perf record: Move setting tracking events before record__init_thread_masks()
  - perf evlist: Add evlist__findnew_tracking_event() helper
  - perf tests: Apply attributes to all events in object code reading test
  - perf tests: Make "test data symbol" more robust on Neoverse N1
  - arm64: dts: meson: fix S4 power-controller node
  - interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment
  - module: don't ignore sysfs_create_link() failures
  - serial: sc16is7xx: add proper sched.h include for sched_set_fifo()
  - PCI: tegra194: Fix probe path for Endpoint mode
  - greybus: arche-ctrl: move device table to its right location
  - serial: max3100: Fix bitwise types
  - serial: max3100: Update uart_driver_registered on driver removal
  - perf annotate: Fix annotation_calc_lines() to pass correct address to get_srcline()
  - perf annotate: Use global annotation_options
  - perf top: Convert to the global annotation_options
  - perf report: Convert to the global annotation_options
  - perf annotate: Introduce global annotation_options
  - perf annotate: Split branch stack cycles information out of 'struct annotation_line'
  - perf machine thread: Remove exited threads by default
  - perf record: Lazy load kernel symbols
  - firmware: dmi-id: add a release callback function
  - dmaengine: idma64: Add check for dma_set_max_seg_size
  - soundwire: cadence: fix invalid PDI offset
  - perf stat: Do not fail on metrics on s390 z/VM systems
  - usb: typec: ucsi: simplify partner's PD caps registration
  - usb: typec: ucsi: always register a link to USB PD device
  - perf annotate: Get rid of duplicate --group option item
  - counter: linux/counter.h: fix Excess kernel-doc description warning
  - f2fs: fix to wait on page writeback in __clone_blkaddrs()
  - phy: qcom: qmp-combo: fix duplicate return in qmp_v4_configure_dp_phy
  - iio: core: Leave private pointer NULL when no private data supplied
  - perf probe: Add missing libgen.h header needed for using basename()
  - perf record: Delete session after stopping sideband thread
  - sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
  - af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
  - net: qrtr: ns: Fix module refcnt
  - selftests: net: bridge: increase IGMP/MLD exclude timeout membership interval
  - tracing/user_events: Fix non-spaced field matching
  - tracing/user_events: Prepare find/delete for same name events
  - tracing/user_events: Allow events to persist for perfmon_capable users
  - RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw
  - RDMA/IPoIB: Fix format truncation compilation errors
  - selftests/kcmp: remove unused open mode
  - SUNRPC: Fix gss_free_in_token_pages()
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
  - RDMA/bnxt_re: Adds MSN table capability for Gen P7 adapters
  - RDMA/bnxt_re: Update the HW interface definitions
  - RDMA/bnxt_re: Remove roundup_pow_of_two depth for all hardware queue resources
  - RDMA/bnxt_re: Refactor the queue index update
  - ext4: remove the redundant folio_wait_stable()
  - ext4: fix potential unnitialized variable
  - sunrpc: removed redundant procp check
  - ext4: avoid excessive credit estimate in ext4_tmpfile()
  - x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and VPDPWSSDS
  - x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
  - clk: qcom: mmcc-msm8998: fix venus clock issue
  - clk: qcom: dispcc-sm8550: fix DisplayPort clocks
  - clk: qcom: dispcc-sm6350: fix DisplayPort clocks
  - clk: qcom: dispcc-sm8450: fix DisplayPort clocks
  - lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
  - clk: renesas: r9a07g043: Add clock and reset entry for PLIC
  - clk: renesas: r8a779a0: Fix CANFD parent clock
  - IB/mlx5: Use __iowrite64_copy() for write combining stores
  - RDMA/rxe: Fix incorrect rxe_put in error path
  - RDMA/rxe: Allow good work requests to be executed
  - clk: qcom: clk-alpha-pll: remove invalid Stromer register offset
  - clk: rs9: fix wrong default value for clock amplitude
  - clk: mediatek: mt8365-mm: fix DPI0 parent
  - clk: mediatek: pllfh: Don't log error for missing fhctl node
  - RDMA/mlx5: Adding remote atomic access flag to updatable flags
  - RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent
  - clk: samsung: exynosautov9: fix wrong pll clock id value
  - media: cadence: csi2rx: configure DPHY before starting source stream
  - drm/edid: Parse topology block for all DispID structure v1.x
  - drm/rockchip: vop2: Do not divide height twice for YUV
  - media: uvcvideo: Add quirk for Logitech Rally Bar
  - drm/mipi-dsi: use correct return type for the DSC functions
  - drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
  - drm/bridge: anx7625: Update audio status while detecting
  - drm/panel: novatek-nt35950: Don't log an error when DSI host can't be found
  - drm/bridge: dpc3433: Don't log an error when DSI host can't be found
  - drm/bridge: tc358775: Don't log an error when DSI host can't be found
  - drm/bridge: lt9611uxc: Don't log an error when DSI host can't be found
  - drm/bridge: lt9611: Don't log an error when DSI host can't be found
  - drm/bridge: lt8912b: Don't log an error when DSI host can't be found
  - drm/bridge: icn6211: Don't log an error when DSI host can't be found
  - drm/bridge: anx7625: Don't log an error when DSI host can't be found
  - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
  - drm: vc4: Fix possible null pointer dereference
  - media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
  - fbdev: sh7760fb: allow modular build
  - media: v4l2-subdev: Fix stream handling for crop API
  - media: i2c: et8ek8: Don't strip remove function when driver is builtin
  - media: dt-bindings: ovti,ov2680: Fix the power supply names
  - media: ipu3-cio2: Request IRQ earlier
  - drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected
  - drm/msm/dp: allow voltage swing / pre emphasis of 3
  - media: radio-shark2: Avoid led_names truncations
  - media: rcar-vin: work around -Wenum-compare-conditional warning
  - media: ngene: Add dvb_ca_en50221_init return value check
  - ASoC: Intel: avs: Test result of avs_get_module_entry()
  - ASoC: Intel: avs: Fix potential integer overflow
  - ASoC: Intel: avs: Fix ASRC module initialization
  - selftests: cgroup: skip test_cgcore_lesser_ns_open when cgroup2 mounted without nsdelegate
  - fbdev: sisfb: hide unused variables
  - ASoC: SOF: Intel: mtl: Implement firmware boot state check
  - ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed
  - ASoC: SOF: Intel: mtl: call dsp dump when boot retry fails
  - ASoC: SOF: Intel: lnl: Correct rom_status_reg
  - ASoC: SOF: Intel: mtl: Correct rom_status_reg
  - ASoC: SOF: Intel: pci-mtl: fix ARL-S definitions
  - ASoC: SOF: Intel: pci-mtl: use ARL specific firmware definitions
  - ASoC: Intel: common: add ACPI matching tables for Arrow Lake
  - powerpc/fsl-soc: hide unused const variable
  - drm/meson: vclk: fix calculation of 59.94 fractional rates
  - ASoC: kirkwood: Fix potential NULL dereference
  - fbdev: shmobile: fix snprintf truncation
  - mtd: rawnand: hynix: fixed typo
  - mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add()
  - ASoC: Intel: avs: ssm4567: Do not ignore route checks
  - ASoC: Intel: Disable route checks for Skylake boards
  - drm/amd/display: Fix potential index out of bounds in color transformation function
  - drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't assert
  - drm/dp: Don't attempt AUX transfers when eDP panels are not powered
  - drm/lcdif: Do not disable clocks on already suspended hardware
  - dev_printk: Add and use dev_no_printk()
  - printk: Let no_printk() use _printk()
  - drm/omapdrm: Fix console with deferred ops
  - fbdev: Provide I/O-memory helpers as module
  - drm/omapdrm: Fix console by implementing fb_dirty
  - drm/ci: update device type for volteer devices
  - drm/ci: add subset-1-gfx to LAVA_TAGS and adjust shards
  - drm/ci: uprev mesa version: fix container build & crosvm
  - drm/bridge: Fix improper bridge init order with pre_enable_prev_first
  - Bluetooth: qca: Fix error code in qca_read_fw_build_info()
  - Bluetooth: compute LE flow credits based on recvbuf space
  - net: micrel: Fix receiving the timestamp in the frame for lan8841
  - mptcp: SO_KEEPALIVE: fix getsockopt support
  - riscv, bpf: make some atomic operations fully ordered
  - s390/bpf: Emit a barrier for BPF_FETCH instructions
  - net/mlx5: Reload only IB representors upon lag disable/enable
  - net/mlx5: Enable 4 ports multiport E-switch
  - ipv6: sr: fix invalid unregister error path
  - ipv6: sr: fix incorrect unregister order
  - ipv6: sr: add missing seg6_local_exit
  - net: usb: smsc95xx: stop lying about skb->truesize
  - net: ethernet: cortina: Locking fixes
  - selftests: net: move amt to socat for better compatibility
  - selftests: net: add missing config for amt.sh
  - selftests: net: add more missing kernel config
  - net: ipv6: fix wrong start position when receive hop-by-hop fragment
  - m68k: mac: Fix reboot hang on Mac IIci
  - m68k: Fix spinlock race in kernel thread creation
  - net: usb: sr9700: stop lying about skb->truesize
  - usb: aqc111: stop lying about skb->truesize
  - HID: amd_sfh: Handle "no sensors" in PM operations
  - wifi: mwl8k: initialize cmd->addr[] properly
  - scsi: qla2xxx: Fix debugfs output for fw_resource_count
  - scsi: bfa: Ensure the copied buf is NUL terminated
  - HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
  - selftests/bpf: Fix pointer arithmetic in test_xdp_do_redirect
  - kunit: Fix kthread reference
  - selftests: default to host arch for LLVM builds
  - selftests/resctrl: fix clang build failure: use LOCAL_HDRS
  - selftests/binderfs: use the Makefile's rules, not Make's implicit rules
  - libbpf: Fix error message in attach_kprobe_multi
  - wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset
  - wifi: mt76: mt7603: fix tx queue of loopback packets
  - Revert "sh: Handle calling csum_partial with misaligned data"
  - sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
  - wifi: ar5523: enable proper endpoint verification
  - net: give more chances to rcu in netdev_wait_allrefs_any()
  - pwm: sti: Simplify probe function using devm functions
  - pwm: sti: Prepare removing pwm_chip from driver data
  - tcp: avoid premature drops in tcp_add_backlog()
  - net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on 88E6250-family switches
  - net: dsa: mv88e6xxx: Add support for model-specific pre- and post-reset handlers
  - wifi: ath10k: populate board data for WCN3990
  - cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations
  - scsi: ufs: core: mcq: Fix ufshcd_mcq_sqe_search()
  - selftests/bpf: Fix a fd leak in error paths in open_netns
  - gfs2: do_xmote fixes
  - gfs2: finish_xmote cleanup
  - gfs2: Rename gfs2_withdrawn to gfs2_withdrawing_or_withdrawn
  - gfs2: Mark withdraws as unlikely
  - gfs2: Rename gfs2_lookup_{ simple => meta }
  - gfs2: Convert gfs2_internal_read to folios
  - gfs2: Get rid of gfs2_alloc_blocks generation parameter
  - wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger()
  - dt-bindings: thermal: loongson,ls2k-thermal: Fix incorrect compatible definition
  - dt-bindings: thermal: loongson,ls2k-thermal: Add Loongson-2K0500 compatible
  - dt-bindings: thermal: loongson,ls2k-thermal: Fix binding check issues
  - thermal/drivers/tsens: Fix null pointer dereference
  - x86/purgatory: Switch to the position-independent small code model
  - scsi: hpsa: Fix allocation size for Scsi_Host private data
  - scsi: libsas: Fix the failure of adding phy with zero-address to port
  - udp: Avoid call to compute_score on multiple sites
  - x86/pat: Fix W^X violation false-positives when running as Xen PV guest
  - x86/pat: Restructure _lookup_address_cpa()
  - x86/pat: Introduce lookup_address_in_pgd_attr()
  - cpufreq: exit() callback is optional
  - tcp: increase the default TCP scaling ratio
  - selftests/bpf: Fix umount cgroup2 error in test_sockmap
  - x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57
  - gfs2: Fix "ignore unlock failures after withdraw"
  - gfs2: Don't forget to complete delayed withdraw
  - ACPI: disable -Wstringop-truncation
  - irqchip/loongson-pch-msi: Fix off-by-one on allocation error path
  - irqchip/alpine-msi: Fix off-by-one in allocation error path
  - locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128()
  - ACPI: LPSS: Advertise number of chip selects via property
  - scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
  - scsi: ufs: core: Perform read back after disabling interrupts
  - scsi: ufs: core: Perform read back after writing UTP_TASK_REQ_LIST_BASE_H
  - scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
  - scsi: ufs: qcom: Perform read back after writing CGC enable
  - scsi: ufs: qcom: Perform read back after writing unipro mode
  - scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US
  - scsi: ufs: qcom: Perform read back after writing reset bit
  - bpf: prevent r10 register from being marked as precise
  - bpf: Pack struct bpf_fib_lookup
  - bpftool: Mount bpffs on provided dir instead of parent dir
  - wifi: carl9170: re-fix fortified-memset warning
  - dlm: fix user space lock decision to copy lvb
  - bitops: add missing prototype check
  - mlx5: stop warning for 64KB pages
  - mlx5: avoid truncating error message
  - qed: avoid truncating work queue length
  - enetc: avoid truncating error message
  - ACPI: Fix Generic Initiator Affinity _OSC bit
  - sched/fair: Add EAS checks before updating root_domain::overutilized
  - wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask
  - wifi: iwlwifi: reconfigure TLC during HW restart
  - wifi: iwlwifi: mvm: select STA mask only for active links
  - wifi: iwlwifi: mvm: allocate STA links only for active links
  - wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok()
  - x86/boot: Ignore relocations in .notes sections in walk_relocs() too
  - wifi: mt76: mt7915: workaround too long expansion sparse warnings
  - wifi: ath12k: use correct flag field for 320 MHz channels
  - bpftool: Fix missing pids during link show
  - wifi: ath11k: don't force enable power save on non-running vdevs
  - wifi: brcmfmac: pcie: handle randbuf allocation failure
  - wifi: ath10k: poll service ready message before failing
  - block: fix and simplify blkdevparts= cmdline parsing
  - lkdtm: Disable CFI checking for perms functions
  - soc: qcom: pmic_glink: Make client-lock non-sleeping
  - null_blk: Fix missing mutex_destroy() at module removal
  - soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE
  - firmware: qcom: scm: Fix __scm and waitq completion variable initialization
  - soc: qcom: pmic_glink: notify clients about the current state
  - soc: qcom: pmic_glink: don't traverse clients list without a lock
  - s390/mm: Re-enable the shared zeropage for !PV and !skeys KVM guests
  - mm/userfaultfd: Do not place zeropages when zeropages are disallowed
  - io-wq: write next_work before dropping acct_lock
  - ARM: configs: sunxi: Enable DRM_DW_HDMI
  - io_uring: use the right type for work_llist empty check
  - s390/cio: fix tracepoint subchannel type field
  - crypto: x86/sha512-avx2 - add missing vzeroupper
  - crypto: x86/sha256-avx2 - add missing vzeroupper
  - crypto: x86/nh-avx2 - add missing vzeroupper
  - crypto: ccp - drop platform ifdef checks
  - parisc: add missing export of __cmpxchg_u8()
  - nilfs2: fix out-of-range warning
  - firmware: raspberrypi: Use correct device for DMA mappings
  - mm/slub, kunit: Use inverted data to corrupt kmem cache
  - openpromfs: finish conversion to the new mount API
  - nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()
  - ksmbd: fix uninitialized symbol 'share' in smb2_tree_connect()
  - epoll: be better about file lifetimes
  - nvmet: fix nvme status code when namespace is disabled
  - nvmet-tcp: fix possible memory leak when tearing down a controller
  - nvme: cancel pending I/O if nvme controller is in terminal state
  - nvmet-auth: replace pr_debug() with pr_err() to report an error.
  - nvmet-auth: return the error code to the nvmet_auth_host_hash() callers
  - nvme: find numa distance only if controller has valid numa id
  - drm/amdkfd: Flush the process wq before creating a kfd_process
  - drm/amd/display: Disable seamless boot on 128b/132b encoding
  - drm/amd/display: Fix DC mode screen flickering on DCN321
  - drm/amd/display: Add VCO speed parameter for DCN31 FPU
  - drm/amd/display: Allocate zero bw after bw alloc enable
  - drm/amd/display: Add dtbclk access to dcn315
  - drm/amdgpu: Fix VRAM memory accounting
  - ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection
  - ASoC: da7219-aad: fix usage of device_get_named_child_node()
  - platform/x86: ISST: Add Grand Ridge to HPM CPU list
  - softirq: Fix suspicious RCU usage in __do_softirq()
  - ALSA: emu10k1: make E-MU FPGA writes potentially more reliable
  - bpf, x86: Fix PROBE_MEM runtime load check
  - fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card
  - Input: xpad - add support for ASUS ROG RAIKIRI
  - KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF
  - ASoC: rt715-sdca: volume step modification
  - ASoC: rt715: add vendor clear control register
  - ASoC: cs35l41: Update DSP1RX5/6 Sources for DSP config
  - regulator: vqmmc-ipq4019: fix module autoloading
  - regulator: qcom-refgen: fix module autoloading
  - ASoC: rt722-sdca: add headset microphone vrefo setting
  - ASoC: rt722-sdca: modify channel number to support 4 channels
  - ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
  - ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
  - ASoC: acp: Support microphone from device Acer 315-24p
  - ASoC: SOF: pcm: Restrict DSP D0i3 during S0ix to IPC3
  - ALSA: hda: cs35l56: Exit cache-only after cs35l56_wait_for_firmware_boot()
  - regulator: irq_helpers: duplicate IRQ name
  - ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too
  - sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU
  - selftests: sud_test: return correct emulated syscall value on RISC-V
  - drm/etnaviv: fix tx clock gating on some GC7000 variants
  - LoongArch: Lately init pmu after smp is online
  - cpu: Ignore "mitigations" kernel parameter if CPU_MITIGATIONS=n
  - drm/amdgpu: Fix the ring buffer size for queue VM flush
  - drm/amdkfd: Add VRAM accounting for SVM migration
  - drm/amd/pm: Restore config space after reset
  - drm/amdgpu: Update BO eviction priorities
  - drm/amd/display: Set color_mgmt_changed to true on unsuspend
  - net: usb: qmi_wwan: add Telit FN920C04 compositions
  - HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is enabled
  - dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node
  - wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class
  - wifi: mac80211: ensure beacon is non-S1G prior to extracting the beacon timestamp field
  - wifi: mac80211: don't use rate mask for scanning
  - KEYS: asymmetric: Add missing dependency on CRYPTO_SIG
  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 440/460 G11.
  - ksmbd: ignore trailing slashes in share paths
  - ksmbd: avoid to send duplicate oplock break notifications
  - fs/ntfs3: Break dir enumeration if directory contents error
  - fs/ntfs3: Fix case when index is reused during tree transformation
  - fs/ntfs3: Taking DOS names into account during link counting
  - fs/ntfs3: Remove max link count info display during driver init
  - net: smc91x: Fix m68k kernel compilation for ColdFire CPU
  - net: lan966x: remove debugfs directory in probe() error path
  - net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe()
  - tools/nolibc/stdlib: fix memory error in realloc()
  - tools/latency-collector: Fix -Wformat-security compile warns
  - net: mana: Fix the extra HZ in mana_hwc_send_request
  - Revert "r8169: don't try to disable interrupts if NAPI is, scheduled already"
  - io_uring: fail NOP if non-zero op flags is passed in
  - Input: try trimming too long modalias strings
  - serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup
  - serial: 8250_bcm7271: use default_mux_rate if possible
  - tty: n_gsm: fix missing receive state reset after mode switch
  - selftests/ftrace: Fix BTFARG testcase to check fprobe is enabled correctly
  - x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
  - !10398  BMA: Fix DMA reset problem and change the version
  - BMA/kbox_drv: Change the version number.
  - BMA/veth_drv: Change the version number.
  - BMA/cdev_drv: Change the version number.
  - BMA/edma_drv: Fix DMA reset problem and change the version number.
  - !10358  jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
  - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
  - !10344  CVE-2024-39471
  - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
  - drm/amdgpu: add error handle to avoid out-of-bounds
  - !9904  ext4: improve buffered write with more than one blocks_per_folio
  - ext4: improve sub-polio check in ext4_iomap_write_begin()
  - iomap: add iomap_is_fully_dirty()
  - iomap: correct the dirty length in page mkwrite
  - iomap: advance the ifs allocation if we have more than one blocks per folio
  - iomap: support invalidating partial folios
  - iomap: correct the range of a partial dirty clear
  - !9533  net/mlx5: Add a timeout to acquire the command queue semaphore
  - net/mlx5: Add a timeout to acquire the command queue semaphore
  - !10317  improve dump_page() robustness
  - mm: improve dumping of mapcount and page_type
  - mm: add __dump_folio()
  - fs: improve dump_mapping() robustness
  - !9361  macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
  - macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
  - !9892  support for SMC-D loopback_lo feature
  - net/smc: enable the smc-lo on the x86 and arm64 platforms
  - net/smc: implement DMB-merged operations of loopback-ism
  - net/smc: adapt cursor update when sndbuf and peer DMB are merged
  - net/smc: {at|de}tach sndbuf to peer DMB if supported
  - net/smc: add operations to merge sndbuf with peer DMB
  - net/smc: register loopback-ism into SMC-D device list
  - net/smc: ignore loopback-ism when dumping SMC-D devices
  - net/smc: mark optional smcd_ops and check for support when called
  - net/smc: implement DMB-related operations of loopback-ism
  - net/smc: implement ID-related operations of loopback-ism
  - net/smc: introduce loopback-ism for SMC intra-OS shortcut
  - net/smc: decouple ism_client from SMC-D DMB registration
  - net/smc: change the term virtual ISM to Emulated-ISM
  - net/smc: fix incorrect SMC-D link group matching logic
  - net/smc: manage system EID in SMC stack instead of ISM driver
  - net/smc: support extended GID in SMC-D lgr netlink attribute
  - net/smc: compatible with 128-bits extended GID of virtual ISM device
  - net/smc: define a reserved CHID range for virtual ISM devices
  - net/smc: introduce virtual ISM device support feature
  - net/smc: support SMCv2.x supplemental features negotiation
  - net/smc: unify the structs of accept or confirm message for v1 and v2
  - net/smc: introduce sub-functions for smc_clc_send_confirm_accept()
  - net/smc: rename some 'fce' to 'fce_v2x' for clarity
  - !10171  netrom: Fix a memory leak in nr_heartbeat_expiry()
  - netrom: Fix a memory leak in nr_heartbeat_expiry()
  - !10312  bpf: Fix too early release of tcx_entry
  - bpf: Fix too early release of tcx_entry
  - !10170  x86: resctrl: Fix illegal access by the chips not having RDT
  - x86: resctrl: Fix illegal access by the chips not having RDT
  - !10311  wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
  - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
  - !10254  fbdev: savage: Handle err return when savagefb_check_var failed
  - fbdev: savage: Handle err return when savagefb_check_var failed
  - !10078  bpf: Set run context for rawtp test_run callback
  - bpf: Set run context for rawtp test_run callback
  - !10261  batman-adv: bypass empty buckets in batadv_purge_orig_ref()
  - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
  - !10066  serial: imx: Introduce timeout when waiting on transmitter empty
  - serial: imx: Introduce timeout when waiting on transmitter empty
  - !9971  KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
  - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()

  ' for pr_err


