# changelog

author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.346.3.el8uek]
changelog:
  - x86/bpf: Classic BPF program can fail when BHB barrier is used (Alexandre Chartre) [Orabug: 38151403]
  - Add Zen34 clients (Borislav Petkov) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}
  - x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}
  - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}
  - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}
  - KVM: x86: add support for CPUID leaf 0x80000021 (Paolo Bonzini) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}
  - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}
  - x86/CPU/AMD: Add ZenX generations flags (Borislav Petkov) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}
  - x86/bugs: Free X86_BUG_AMD_APIC_C1E and X86_BUG_AMD_E400 bits (Boris Ostrovsky) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.346.4.el8uek]
changelog:
  - pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
  - Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann)


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.346.5.el8uek]
changelog:
  - perf: Fix perf_event_validate_size() lockdep splat (Mark Rutland)  [Orabug: 36261486]  {CVE-2023-6931}
  - perf: Fix perf_event_validate_size() (Peter Zijlstra)  [Orabug: 36261486]  {CVE-2023-6931}
  - net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38182891]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.346.6.el8uek]
changelog:
  - net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju)  [Orabug: 38109070]  
  - net/rds: poll eq during user-reset (Praveen Kumar Kannoju)  [Orabug: 38189315]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.346.4.el8uek]
changelog:
  - pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
  - Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217340] {CVE-2025-38350}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.346.5.el8uek]
changelog:
  - perf: Fix perf_event_validate_size() lockdep splat (Mark Rutland) [Orabug: 36261486] {CVE-2023-6931}
  - perf: Fix perf_event_validate_size() (Peter Zijlstra) [Orabug: 36261486] {CVE-2023-6931}
  - net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182891]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.346.6.el8uek]
changelog:
  - net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38109070]
  - net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189315]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.1.el8uek]
changelog:
  - LTS tag: v5.4.295 (Alok Tiwari)
  - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180596] {CVE-2025-38320}
  - perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254030] {CVE-2025-38424}
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
  - rtc: test: Fix invalid format specifier. (David Gow)
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180707] {CVE-2025-38337}
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976985] {CVE-2025-37958}
  - rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
  - rtc: Improve performance of rtc_time64_to_tm(). Add tests. (Cassio Neri)
  - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (Dan Aloni) [Orabug: 37101886] {CVE-2022-48773}
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223087] {CVE-2025-38352}
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms (Geert Uytterhoeven)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert time (Colin Foster)
  - ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board (Shengyu Qu)
  - net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158407] {CVE-2025-38180}
  - net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180612] {CVE-2025-38323}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158413] {CVE-2025-38181}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158425] {CVE-2025-38184}
  - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
  - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158434] {CVE-2025-38185}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180618] {CVE-2025-38324}
  - wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254011] {CVE-2025-38420}
  - aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180629] {CVE-2025-38326}
  - hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
  - drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
  - erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
  - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
  - ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
  - Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152878] {CVE-2025-38103}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158458] {CVE-2025-38190}
  - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
  - scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
  - scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
  - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180636] {CVE-2025-38328}
  - jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158484] {CVE-2025-38194}
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137454] {CVE-2025-38090}
  - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
  - platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
  - platform: Add Surface platform directory (Maximilian Luz)
  - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
  - tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
  - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
  - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
  - watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158518] {CVE-2025-38200}
  - sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
  - scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180668] {CVE-2025-38332}
  - vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
  - clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
  - wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
  - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
  - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
  - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
  - tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
  - net: dlink: add synchronization for stats update (Moon Yeounsu)
  - sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
  - emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
  - i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
  - net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
  - cpufreq: Force sync policy boost with global boost on sysfs update (Viresh Kumar)
  - nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults (Simon Schuster)
  - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang) [Orabug: 38175014] {CVE-2025-38237}
  - media: tc358743: ignore video while HPD is low (Hans Verkuil)
  - drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB (Amber Lin)
  - jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff) [Orabug: 38158546] {CVE-2025-38203}
  - drm/amdgpu/gfx9: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx8: fix CSIB handling (Alex Deucher)
  - jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt) [Orabug: 38158553] {CVE-2025-38204}
  - drm/amdgpu/gfx7: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx10: fix CSIB handling (Alex Deucher)
  - drm/msm/a6xx: Increase HFI response timeout (Akhil P Oommen)
  - drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() (Srinivasan Shanmugam)
  - media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Nas Chung)
  - drm/msm/hdmi: add runtime PM calls to DDC transfer function (Dmitry Baryshkov)
  - drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() (Damon Ding)
  - sunrpc: update nextcheck time when adding new cache entries (Long Li)
  - drm/amdgpu/gfx6: fix CSIB handling (Alex Deucher)
  - ACPI: battery: negate current when discharging (Peter Marheine)
  - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
  - power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
  - ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180748] {CVE-2025-38344}
  - ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
  - ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180756] {CVE-2025-38345}
  - iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
  - PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
  - PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
  - uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
  - regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
  - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
  - staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
  - net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132189] {CVE-2025-38086}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180768] {CVE-2025-38346}
  - dm-mirror: fix a tiny race condition (Mikulas Patocka)
  - mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
  - mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
  - mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
  - ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158598] {CVE-2025-38212}
  - parisc: fix building with gcc-15 (Arnd Bergmann)
  - vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158615] {CVE-2025-38214}
  - EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
  - NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253992] {CVE-2025-38416}
  - f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158649] {CVE-2025-38219}
  - Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254054] {CVE-2025-38428}
  - ext4: fix calculation of credits for extent tree modification (Jan Kara)
  - ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158662] {CVE-2025-38222}
  - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
  - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180697] {CVE-2025-38336}
  - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
  - media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
  - media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
  - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254062] {CVE-2025-38430}
  - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180783] {CVE-2025-38348}
  - gfs2: move msleep to sleepable context (Alexander Aring)
  - configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
  - net: usb: aqc111: debug info before sanitation (Oliver Neukum)
  - calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
  - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
  - usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
  - fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
  - net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
  - drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang (Nathan Chancellor)
  - drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang (Nathan Chancellor)
  - MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option (Nathan Chancellor)
  - x86/boot/compressed: prefer cc-option for CFLAGS additions (Nick Desaulniers)
  - net: mdio: C22 is now optional, EOPNOTSUPP if not provided (Andrew Lunn)
  - net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
  - net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152899] {CVE-2025-38108}
  - net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105335] {CVE-2025-38083}
  - net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
  - net/mlx5: Wait for inactive autogroups (Paul Blakey)
  - i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
  - i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152923] {CVE-2025-38115}
  - scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
  - NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (Chuck Lever) [Orabug: 36954169] {CVE-2022-48829}
  - NFSD: Fix ia_size underflow (Chuck Lever) [Orabug: 36954164] {CVE-2022-48828}
  - Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
  - Input: synaptics-rmi4 - convert to use sysfs_emit() APIs (Zhang Songyi)
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256450] {CVE-2025-38498}
  - ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
  - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
  - net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
  - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
  - serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153012] {CVE-2025-38135}
  - usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153017] {CVE-2025-38136}
  - rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
  - rtc: sh: assign correct interrupts with DT (Wolfram Sang)
  - perf record: Fix incorrect --user-regs comments (Dapeng Mi)
  - perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
  - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
  - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
  - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
  - perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
  - perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180566] {CVE-2025-38312}
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153060] {CVE-2025-38145}
  - soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
  - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
  - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
  - bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180573] {CVE-2025-38313}
  - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
  - nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
  - Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253985] {CVE-2025-38415}
  - ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
  - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
  - f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
  - f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
  - calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153070] {CVE-2025-38147}
  - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
  - net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153090] {CVE-2025-38153}
  - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
  - wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153110] {CVE-2025-38157}
  - bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180489] {CVE-2025-38285}
  - pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180495] {CVE-2025-38286}
  - ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
  - netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
  - f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
  - RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
  - wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
  - net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
  - f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu) [Orabug: 38153150] {CVE-2025-38163}
  - drm/tegra: rgb: Fix the unbound reference count (Biju Das)
  - drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
  - drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
  - selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
  - firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
  - m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
  - drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
  - spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
  - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
  - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
  - PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
  - EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180525] {CVE-2025-38298}
  - crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
  - crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153190] {CVE-2025-38173}
  - x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
  - perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
  - netfilter: nft_socket: fix sk refcount leaks (Florian Westphal) [Orabug: 37116555] {CVE-2024-46855}
  - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [Orabug: 38158384] {CVE-2025-38174}
  - usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
  - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
  - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
  - pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
  - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.2.el8uek]
changelog:
  - rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38236847]
  - kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges (Lianbo Jiang) [Orabug: 38134902]
  - module: correctly exit module_kallsyms_on_each_symbol when fn() != 0 (Jon Mediero) [Orabug: 37820709]
  - module: potential uninitialized return in module_kallsyms_on_each_symbol() (Dan Carpenter) [Orabug: 37820709]
  - module: use RCU to synchronize find_module (Christoph Hellwig) [Orabug: 37820709]
  - kallsyms: refactor {,module_}kallsyms_on_each_symbol (Christoph Hellwig) [Orabug: 37820709]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.347.3.el8uek]
changelog:
  - mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu) [Orabug: 38146326]
  - mm/rmap: Fix handling of hugetlbfs pages in page_vma_mapped_walk (Zhenwei Pi) [Orabug: 38146326]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.4.el8uek]
changelog:
  - KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38319938]
  - KVM: APIC: add helper func to remove duplicate code in kvm_pv_send_ipi (Miaohe Lin) [Orabug: 38319938]
  - rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169303]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.347.5.el8uek]
changelog:
  - squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher)
  - netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
  - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller)
  - ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.6.el8uek]
changelog:
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila) [Orabug: 38377926] {CVE-2025-37752}
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila) [Orabug: 38377926]
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila) [Orabug: 38377926] {CVE-2024-57996}
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet) [Orabug: 38377926]
  - net_sched: sch_sfq: annotate data-races around q->perturb_period (Eric Dumazet) [Orabug: 38377926]


author: Jack Vogel <jack.vogel@oracle.com> [5.4.17-2136.347.6.1.el8uek]
changelog:
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343661]  
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343661]  
  - x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343661]  
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343661]  
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343661]  
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343661]  
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343661]


author: Jack Vogel <jack.vogel@oracle.com> [5.4.17-2136.347.6.1.el8uek]
changelog:
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343661]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343661]
  - x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343661]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343661]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343661]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343661]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343661]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.6.2.el8uek]
changelog:
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro)  [Orabug: 38453918]  {CVE-2025-38499} 
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453914]  
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires)  [Orabug: 38453908]  
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires)  [Orabug: 38453904]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.6.2.el8uek]
changelog:
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38453918] {CVE-2025-38499}
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38453914] {CVE-2025-38618}
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38453908] {CVE-2025-38495}
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38453904] {CVE-2025-38494}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.347.6.4.el8uek]
changelog:
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38501612]  {CVE-2025-38724}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.6.el8uek]
changelog:
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila)  [Orabug: 38377926]  {CVE-2025-37752} 
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)  [Orabug: 38377926]  
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila)  [Orabug: 38377926]  {CVE-2024-57996} 
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet)  [Orabug: 38377926]  
  - net_sched: sch_sfq: annotate data-races around q->perturb_period (Eric Dumazet)  [Orabug: 38377926]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.4.el8uek]
changelog:
  - KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38319938,38440302] {CVE-2025-39823}
  - KVM: APIC: add helper func to remove duplicate code in kvm_pv_send_ipi (Miaohe Lin) [Orabug: 38319938]
  - rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169303]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.347.5.el8uek]
changelog:
  - squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343661]
  - netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
  - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343661]
  - ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.6.el8uek]
changelog:
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila) [Orabug: 38377926,38394593] {CVE-2025-37752}
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila) [Orabug: 38377926]
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila) [Orabug: 38377926] {CVE-2024-57996}
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet) [Orabug: 38377926]
  - net_sched: sch_sfq: annotate data-races around q->perturb_period (Eric Dumazet) [Orabug: 38377926]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.348.1.el8uek]
changelog:
  - LTS tag: v5.4.298 (Sherry Yang)
  - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343661]
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440228] {CVE-2025-39808}
  - HID: wacom: Add a new Art Pen 2 (Ping Cheng)
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440310] {CVE-2025-39824}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440277] {CVE-2025-39817}
  - sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440251] {CVE-2025-39812}
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
  - net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
  - net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440347] {CVE-2025-39828}
  - net/atm: remove the atmdev_ops {get, set}sockopt methods (Christoph Hellwig)
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
  - powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
  - net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343661]
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
  - scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440259] {CVE-2025-39813}
  - pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
  - LTS tag: v5.4.297 (Sherry Yang)
  - alloc_fdtable(): change calling conventions. (Al Viro)
  - s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423457] {CVE-2025-39766}
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343661]
  - scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401514] {CVE-2025-39676}
  - usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
  - nfs: fix UAF in direct writes (Josef Bacik) [Orabug: 36596831] {CVE-2024-26958}
  - NFS: Fix up commit deadlocks (Trond Myklebust)
  - cifs: Fix UAF in cifs_demultiplex_thread() (Zhang Xiaoxu) [Orabug: 36983927] {CVE-2023-52572}
  - Bluetooth: fix use-after-free in device_for_each_child() (Dmitry Antipov) [Orabug: 37433654] {CVE-2024-53237}
  - act_mirred: use the backlog for nested calls to mirred ingress (Davide Caratti)
  - net/sched: act_mirred: better wording on protection against excessive stack growth (Davide Caratti)
  - net/sched: act_mirred: refactor the handle of xmit (Wenxu)
  - selftests: forwarding: tc_actions.sh: add matchall mirror test (Jiri Pirko)
  - net: sched: don't expose action qstats to skb_tc_reinsert() (Vlad Buslov)
  - net: sched: extract qstats update code into functions (Vlad Buslov)
  - net: sched: extract bstats update code into function (Vlad Buslov)
  - net: sched: extract common action counters update code into function (Vlad Buslov)
  - mm: perform the mapping_map_writable() check after call_mmap() (Lorenzo Stoakes)
  - mm: update memfd seal write check to include F_SEAL_WRITE (Lorenzo Stoakes)
  - mm: drop the assumption that VM_SHARED always implies writable (Lorenzo Stoakes)
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [Orabug: 37908492] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [Orabug: 38158396] {CVE-2025-38177}
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - btrfs: populate otime when logging an inode item (Qu Wenruo)
  - media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
  - f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu) [Orabug: 38375870] {CVE-2025-38677}
  - media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz) [Orabug: 38401659] {CVE-2025-39709}
  - media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
  - pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
  - pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
  - pwm: mediatek: Implement .apply() callback (Uwe Kleine-König)
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401677] {CVE-2025-39713}
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
  - media: v4l2-ctrls: always copy the controls on completion (Hans Verkuil)
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
  - soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524] {CVE-2025-39787}
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
  - usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
  - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429211] {CVE-2025-39798}
  - NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() (Trond Myklebust)
  - NFSv4: Fix nfs4_bitmap_copy_adjust() (Trond Myklebust)
  - usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
  - cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
  - USB: cdc-acm: do not log successful probe on later errors (Johan Hovold)
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao) [Orabug: 38423261] {CVE-2025-39736}
  - mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t (He Zhe)
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
  - x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395081] {CVE-2025-38724}
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324271] {CVE-2025-38539}
  - usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
  - usb: hub: avoid warm port reset during USB3 disconnect (Mathias Nyman)
  - x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
  - f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180774] {CVE-2025-38347}
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
  - mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() (Miaohe Lin)
  - drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351930] {CVE-2025-38664}
  - net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
  - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Li Zhong)
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254285] {CVE-2025-38481}
  - comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254272] {CVE-2025-38478}
  - kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
  - kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
  - kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
  - mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
  - kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue (Thorsten Blum)
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
  - ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401581] {CVE-2025-39689}
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
  - use uniform permission checks for all mount propagation changes (Al Viro)
  - move_mount: allow to add a mount into an existing group (Pavel Tikhomirov)
  - fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401587] {CVE-2025-39691}
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
  - memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
  - media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar) [Orabug: 38401666] {CVE-2025-39710}
  - media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
  - media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401684] {CVE-2025-39714}
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
  - media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
  - soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423509] {CVE-2025-39782}
  - PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
  - PCI: endpoint: Fix configfs group list head handling (Damien Le Moal) [Orabug: 38423515] {CVE-2025-39783}
  - mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
  - pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
  - zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
  - ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
  - ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
  - ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
  - vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
  - vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
  - usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
  - m68k: Fix lost column on framebuffer debug console (Finn Thain)
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
  - serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401729] {CVE-2025-39724}
  - media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394816] {CVE-2025-38680}
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long) [Orabug: 38423265] {CVE-2025-39737}
  - parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
  - btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
  - thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
  - comedi: fix race between polling and detaching (Ian Abbott) [Orabug: 38394854] {CVE-2025-38687}
  - misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
  - drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
  - scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
  - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394867] {CVE-2025-38691}
  - pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
  - pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
  - pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
  - net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
  - ipmi: Fix strcpy source and destination the same (Corey Minyard)
  - kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
  - kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
  - kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
  - i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
  - PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
  - i3c: add missing include to internal header (Wolfram Sang)
  - media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394880] {CVE-2025-38693}
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394887] {CVE-2025-38694}
  - media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
  - media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
  - media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
  - pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
  - scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394894] {CVE-2025-38695}
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423286] {CVE-2025-39742}
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
  - jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte) [Orabug: 38394912] {CVE-2025-38697}
  - jfs: Regular file corruption check (Edward Adam Davis) [Orabug: 38394918] {CVE-2025-38698}
  - jfs: truncate good inode pages when hard link is 0 (Lizhi Xu) [Orabug: 38423294] {CVE-2025-39743}
  - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394925] {CVE-2025-38699}
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
  - watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
  - fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug: 38394931] {CVE-2025-38700}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394937] {CVE-2025-38701}
  - cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
  - vhost: fail early when __vhost_add_used() fails (Jason Wang)
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
  - uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
  - net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
  - wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
  - netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
  - net: fec: allow disable coalescing (Jonas Rebmann)
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
  - s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
  - wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
  - net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
  - wifi: cfg80211: Fix interface type validation (Ilan Peer)
  - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423341] {CVE-2025-39749}
  - net: ag71xx: Add missing check after DMA map (Thomas Fourier)
  - et131x: Add missing check after DMA map (Thomas Fourier)
  - be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
  - s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
  - wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
  - ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423359] {CVE-2025-39751}
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
  - usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
  - ACPI: processor: fix acpi_object initialization (Sebastian Ott)
  - PM: sleep: console: Fix the black screen issue (Tuhaowen)
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
  - selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
  - ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling) [Orabug: 38429180] {CVE-2025-39794}
  - gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
  - ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov) [Orabug: 38423372] {CVE-2025-39752}
  - cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
  - usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
  - usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
  - usb: xhci: print xhci->xhc_state when queue_command failed (Su Hui)
  - securityfs: don't pin dentries twice, once is enough... (Al Viro)
  - hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
  - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394995] {CVE-2025-38708}
  - udf: Verify partition map count (Jan Kara)
  - arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko) [Orabug: 38395027] {CVE-2025-38713}
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko) [Orabug: 38395033] {CVE-2025-38714}
  - hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko) [Orabug: 38395039] {CVE-2025-38715}
  - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395059] {CVE-2025-38718}
  - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395068] {CVE-2025-38721}
  - udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
  - ACPI: processor: perflib: Move problematic pr->performance check (Rafael J. Wysocki)
  - ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
  - Documentation: ACPI: Fix parent device references (Andy Shevchenko)
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423397] {CVE-2025-39756}
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
  - net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
  - net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38401319] {CVE-2025-38727}
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423407] {CVE-2025-39757}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395101] {CVE-2025-38729}
  - io_uring: don't use int for ABI (Pavel Begunkov)
  - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
  - USB: serial: option: add Foxconn T99W709 (Slark Xiao)
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351771,38453914] {CVE-2025-38618}
  - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351764] {CVE-2025-38617}
  - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334948] {CVE-2025-38563}
  - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334959] {CVE-2025-38565}
  - perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
  - pptp: fix pptp_xmit() error path (Eric Dumazet)
  - smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
  - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334976] {CVE-2025-38569}
  - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351786] {CVE-2025-38622}
  - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334988] {CVE-2025-38572}
  - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335004] {CVE-2025-38574}
  - netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401745] {CVE-2025-39730}
  - pci/hotplug/pnv-php: Wrap warnings in macro (Frederic Barrat)
  - pci/hotplug/pnv-php: Improve error msg on power state change failure (Frederic Barrat)
  - usb: chipidea: udc: fix sleeping function called from invalid context (Peter Chen)
  - f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu) [Orabug: 38351895] {CVE-2025-38652}
  - f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu) [Orabug: 38335025] {CVE-2025-38577}
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu) [Orabug: 38335033] {CVE-2025-38578}
  - rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
  - module: Restore the moduleparam prefix length check (Petr Pavlu)
  - bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
  - mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
  - mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
  - jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
  - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang) [Orabug: 38351831] {CVE-2025-38630}
  - crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
  - dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
  - fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
  - soundwire: stream: restore params when prepare ports fail (Bard Liao)
  - crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
  - scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
  - perf tests bp_account: Fix leaked file descriptor (Leo Yan)
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong) [Orabug: 38335042] {CVE-2025-38581}
  - pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
  - clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin) [Orabug: 38351846] {CVE-2025-38635}
  - mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
  - crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
  - PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
  - vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
  - selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
  - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351854] {CVE-2025-38639}
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
  - can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
  - Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
  - mwl8k: Add missing check after DMA map (Thomas Fourier)
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331466] {CVE-2025-38553}
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
  - m68k: Don't unregister boot console needlessly (Finn Thain)
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
  - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335110] {CVE-2025-38602}
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
  - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335120] {CVE-2025-38604}
  - caif: reduce stack size, again (Arnd Bergmann)
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335131] {CVE-2025-38608}
  - staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
  - samples: mei: Fix building on musl libc (Brahmajit Das)
  - cpufreq: Init policy->rwsem before it may be possibly used (Lifeng Zheng)
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
  - usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
  - Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
  - pps: fix poll support (Denis Osterland-Heim)
  - vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
  - ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
  - hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li) [Orabug: 38351890] {CVE-2025-38650}
  - ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
  - ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
  - usb: phy: mxs: disconnect line when USB charger is attached (Xu Yang)
  - usb: chipidea: add USB PHY event (Xu Yang)
  - usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use (Peter Chen)
  - usb: chipidea: udc: protect usb interrupt enable (Li Jun)
  - usb: chipidea: udc: add new API ci_hdrc_gadget_connect (Peter Chen)
  - ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
  - comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
  - nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi) [Orabug: 38351921] {CVE-2025-38663}
  - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351994] {CVE-2025-38671}
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
  - net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu) [Orabug: 38351969] {CVE-2025-38666}
  - net: appletalk: fix kerneldoc warnings (Andrew Lunn)
  - RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
  - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351978] {CVE-2025-38668}
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158477] {CVE-2025-38193}
  - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition (Zheng Wang)
  - power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync (Minghao Chi)
  - power: supply: bq24190_charger: Fix runtime PM imbalance on error (Dinghao Liu)
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
  - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253834] {CVE-2025-38375}
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
  - usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
  - usb: musb: fix gadget state on disconnect (Drew Hamilton)
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254214] {CVE-2025-38468}
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254225] {CVE-2025-38470}
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
  - Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254241] {CVE-2025-38473}
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254249] {CVE-2025-38474}
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254266] {CVE-2025-38477}
  - net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254278] {CVE-2025-38480}
  - comedi: Fix some signed shift left operations (Ian Abbott)
  - comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254294] {CVE-2025-38482}
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254301] {CVE-2025-38483}
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324231] {CVE-2025-38529}
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324238] {CVE-2025-38530}
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
  - iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
  - mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
  - mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
  - isofs: Verify inode mode when loading from disk (Jan Kara)
  - dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324264] {CVE-2025-38538}
  - af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254340,38453904] {CVE-2025-38494}
  - HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254348,38453908] {CVE-2025-38495}
  - pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
  - Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
  - i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
  - USB: serial: option: add Foxconn T99W640 (Slark Xiao)
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
  - LTS tag: v5.4.296 (Sherry Yang)
  - x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
  - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID (Hans de Goede)
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324280] {CVE-2025-38540}
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
  - vt: add missing notification when switching back to text mode (Nicolas Pitre)
  - net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
  - atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254090] {CVE-2025-38439}
  - bnxt_en: Fix DCB ETS validation (Shravya Kn)
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
  - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324290] {CVE-2025-38542}
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254109] {CVE-2025-38445}
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324161] {CVE-2025-38513}
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
  - Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
  - Input: xpad - add VID for Turtle Beach controllers (Vicki Pfau)
  - Input: xpad - add support for Amazon Game Controller (Matt Reynolds)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Tigran Mkrtchyan)
  - RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad)
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski)
  - Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
  - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254118] {CVE-2025-38448}
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324180] {CVE-2025-38515}
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324186] {CVE-2025-38516}
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
  - x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324172] {CVE-2025-38514}
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254147] {CVE-2025-38457}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254153] {CVE-2025-38458}
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254161] {CVE-2025-38459}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324309] {CVE-2025-38546}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254167] {CVE-2025-38460}
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254181] {CVE-2025-38464}
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254188] {CVE-2025-38465}
  - fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
  - proc: Clear the pieces of proc_inode that proc_evict_inode cares about (Eric W. Biederman)
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254203] {CVE-2025-38467}
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
  - media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
  - media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
  - media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
  - ACPI: PAD: fix crash in exit_round_robin() (Seiji Nishikawa) [Orabug: 37206006] {CVE-2024-49935}
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38401436] {CVE-2025-38404}
  - Logitech C-270 even more broken (Oliver Neukum)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253842] {CVE-2025-38377}
  - net: rose: Fix fall-through warnings for Clang (Gustavo A R Silva)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253887] {CVE-2025-38389}
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path (Vladimir Oltean)
  - spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write (Vladimir Oltean)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad)
  - RDMA/core: Create and destroy counters in the ib_core (Leon Romanovsky)
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253821] {CVE-2025-38371}
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253928] {CVE-2025-38401}
  - mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data() (Yue Hu)
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253907] {CVE-2025-38395}
  - regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253875] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253946] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253923] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253881] {CVE-2025-38387}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253894] {CVE-2025-38391}
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253937] {CVE-2025-38403}
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume (Omar Sandoval) [Orabug: 36530119] {CVE-2024-26644}
  - arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
  - s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
  - drm/tegra: Assign plane type before registration (Thierry Reding)
  - HID: wacom: fix kobject reference count leak (Qasim Ijaz)
  - HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
  - HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
  - dm-raid: fix variable in journal device check (Heinz Mauelshagen)
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175045] {CVE-2025-38245}
  - net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
  - um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
  - wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175065] {CVE-2025-38249}
  - i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
  - i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158592] {CVE-2025-38211}
  - RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private (Weihang Li)
  - media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158681] {CVE-2025-38226}
  - media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158692] {CVE-2025-38229}
  - media: cxusb: use dev_dbg() rather than hand-rolled debug (Sean Young)
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158701] {CVE-2025-38230}
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
  - of: Add of_property_present() helper (Rob Herring)
  - of: property: define of_property_read_u{8,16,32,64}_array() unconditionally (Michael Walle)
  - kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
  - kbuild: add --target to correctly cross-compile UAPI headers with Clang (Masahiro Yamada)
  - bpfilter: match bit size of bpfilter_umh to that of the kernel (Masahiro Yamada)
  - kbuild: use -MMD instead of -MD to exclude system headers from dependency (Masahiro Yamada)
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152869] {CVE-2025-38102}
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (George Kennedy)
  - ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
  - ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
  - ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
  - usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
  - tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175114] {CVE-2025-38262}
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
  - md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
  - dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
  - mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
  - cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.348.2.el8uek]
changelog:
  - uek-rpm: Move ifb module to nano modules (Harshit Mogalapalli) [Orabug: 38443798]
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310007,38453918] {CVE-2025-38499}
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424094]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424094]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424094]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.348.3.el8uek]
changelog:
  - hugetlbfs: take read_lock on i_mmap for PMD sharing (Waiman Long) [Orabug: 38459576]
  - kallsyms: add module_kallsyms_on_each_symbol_locked (Julian Pidancet) [Orabug: 38418686]
  - kallsyms: export module_kallsyms_on_each_symbol (Julian Pidancet) [Orabug: 38418686]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.348.3.1.el8uek]
changelog:
  - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38604168]  {CVE-2025-39973} 
  - i40e: increase max descriptors for XL710 (Justin Bronder)  [Orabug: 38604168]  {CVE-2025-39973}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.1.el8uek]
changelog:
  - LTS tag: v5.4.295 (Alok Tiwari)
  - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180596] {CVE-2025-38320}
  - perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254030] {CVE-2025-38424}
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
  - rtc: test: Fix invalid format specifier. (David Gow)
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180707] {CVE-2025-38337}
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976985] {CVE-2025-37958}
  - rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
  - rtc: Improve performance of rtc_time64_to_tm(). Add tests. (Cassio Neri)
  - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (Dan Aloni) [Orabug: 37101886] {CVE-2022-48773}
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223087] {CVE-2025-38352}
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms (Geert Uytterhoeven)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert time (Colin Foster)
  - ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board (Shengyu Qu)
  - net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158407] {CVE-2025-38180}
  - net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180612] {CVE-2025-38323}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158413] {CVE-2025-38181}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158425] {CVE-2025-38184}
  - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
  - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158434] {CVE-2025-38185}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180618] {CVE-2025-38324}
  - wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254011] {CVE-2025-38420}
  - aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180629] {CVE-2025-38326}
  - hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
  - drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
  - erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
  - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
  - ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
  - Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152878] {CVE-2025-38103}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158458] {CVE-2025-38190}
  - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
  - scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
  - scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
  - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180636] {CVE-2025-38328}
  - jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158484] {CVE-2025-38194}
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton)
  - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
  - platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
  - platform: Add Surface platform directory (Maximilian Luz)
  - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
  - tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
  - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
  - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
  - watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158518] {CVE-2025-38200}
  - sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
  - scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180668] {CVE-2025-38332}
  - vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
  - clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
  - wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
  - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
  - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
  - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
  - tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
  - net: dlink: add synchronization for stats update (Moon Yeounsu)
  - sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
  - emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
  - i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
  - net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
  - cpufreq: Force sync policy boost with global boost on sysfs update (Viresh Kumar)
  - nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults (Simon Schuster)
  - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang)
  - media: tc358743: ignore video while HPD is low (Hans Verkuil)
  - drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB (Amber Lin)
  - jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff)
  - drm/amdgpu/gfx9: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx8: fix CSIB handling (Alex Deucher)
  - jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt)
  - drm/amdgpu/gfx7: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx10: fix CSIB handling (Alex Deucher)
  - drm/msm/a6xx: Increase HFI response timeout (Akhil P Oommen)
  - drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() (Srinivasan Shanmugam)
  - media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Nas Chung)
  - drm/msm/hdmi: add runtime PM calls to DDC transfer function (Dmitry Baryshkov)
  - drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() (Damon Ding)
  - sunrpc: update nextcheck time when adding new cache entries (Long Li)
  - drm/amdgpu/gfx6: fix CSIB handling (Alex Deucher)
  - ACPI: battery: negate current when discharging (Peter Marheine)
  - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
  - power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
  - ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180748] {CVE-2025-38344}
  - ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
  - ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180756] {CVE-2025-38345}
  - iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
  - PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
  - PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
  - uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
  - regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
  - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
  - staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
  - net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132189] {CVE-2025-38086}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180768] {CVE-2025-38346}
  - dm-mirror: fix a tiny race condition (Mikulas Patocka)
  - mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
  - mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
  - mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
  - ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158598] {CVE-2025-38212}
  - parisc: fix building with gcc-15 (Arnd Bergmann)
  - vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158615] {CVE-2025-38214}
  - EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
  - NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski)
  - f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim)
  - Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter)
  - ext4: fix calculation of credits for extent tree modification (Jan Kara)
  - ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158662] {CVE-2025-38222}
  - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
  - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180697] {CVE-2025-38336}
  - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
  - media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
  - media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
  - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254062] {CVE-2025-38430}
  - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180783] {CVE-2025-38348}
  - gfs2: move msleep to sleepable context (Alexander Aring)
  - configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
  - net: usb: aqc111: debug info before sanitation (Oliver Neukum)
  - calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
  - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
  - usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
  - fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
  - net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
  - drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang (Nathan Chancellor)
  - drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang (Nathan Chancellor)
  - MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option (Nathan Chancellor)
  - x86/boot/compressed: prefer cc-option for CFLAGS additions (Nick Desaulniers)
  - net: mdio: C22 is now optional, EOPNOTSUPP if not provided (Andrew Lunn)
  - net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
  - net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152899] {CVE-2025-38108}
  - net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105335] {CVE-2025-38083}
  - net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
  - net/mlx5: Wait for inactive autogroups (Paul Blakey)
  - i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
  - i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152923] {CVE-2025-38115}
  - scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
  - NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (Chuck Lever) [Orabug: 36954169] {CVE-2022-48829}
  - NFSD: Fix ia_size underflow (Chuck Lever) [Orabug: 36954164] {CVE-2022-48828}
  - Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
  - Input: synaptics-rmi4 - convert to use sysfs_emit() APIs (Zhang Songyi)
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256450] {CVE-2025-38498}
  - ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
  - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
  - net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
  - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
  - serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin)
  - usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153017] {CVE-2025-38136}
  - rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
  - rtc: sh: assign correct interrupts with DT (Wolfram Sang)
  - perf record: Fix incorrect --user-regs comments (Dapeng Mi)
  - perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
  - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
  - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
  - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
  - perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
  - perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180566] {CVE-2025-38312}
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin)
  - soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
  - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
  - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
  - bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei)
  - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
  - nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
  - Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253985] {CVE-2025-38415}
  - ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
  - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
  - f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
  - f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
  - calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153070] {CVE-2025-38147}
  - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
  - net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich)
  - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
  - wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153110] {CVE-2025-38157}
  - bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180489] {CVE-2025-38285}
  - pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko)
  - ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
  - netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
  - f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
  - RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
  - wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
  - net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
  - f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu)
  - drm/tegra: rgb: Fix the unbound reference count (Biju Das)
  - drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
  - drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
  - selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
  - firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
  - m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
  - drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
  - spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
  - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
  - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
  - PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
  - EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180525] {CVE-2025-38298}
  - crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
  - crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu)
  - x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
  - perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
  - netfilter: nft_socket: fix sk refcount leaks (Florian Westphal)
  - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [Orabug: 38158384] {CVE-2025-38174}
  - usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
  - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
  - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
  - pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
  - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.348.1.el8uek]
changelog:
  - LTS tag: v5.4.298 (Sherry Yang)
  - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343661]
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440228] {CVE-2025-39808}
  - HID: wacom: Add a new Art Pen 2 (Ping Cheng)
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440310] {CVE-2025-39824}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440277] {CVE-2025-39817}
  - sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440251] {CVE-2025-39812}
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
  - net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
  - net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440347] {CVE-2025-39828}
  - net/atm: remove the atmdev_ops {get, set}sockopt methods (Christoph Hellwig)
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
  - powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
  - net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343661]
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
  - scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440259] {CVE-2025-39813}
  - pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
  - LTS tag: v5.4.297 (Sherry Yang)
  - alloc_fdtable(): change calling conventions. (Al Viro)
  - s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu)
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343661]
  - scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401514] {CVE-2025-39676}
  - usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
  - nfs: fix UAF in direct writes (Josef Bacik) [Orabug: 36596831] {CVE-2024-26958}
  - NFS: Fix up commit deadlocks (Trond Myklebust)
  - cifs: Fix UAF in cifs_demultiplex_thread() (Zhang Xiaoxu) [Orabug: 36154626] {CVE-2023-1192}
  - Bluetooth: fix use-after-free in device_for_each_child() (Dmitry Antipov) [Orabug: 37433654] {CVE-2024-53237}
  - act_mirred: use the backlog for nested calls to mirred ingress (Davide Caratti)
  - net/sched: act_mirred: better wording on protection against excessive stack growth (Davide Caratti)
  - net/sched: act_mirred: refactor the handle of xmit (Wenxu)
  - selftests: forwarding: tc_actions.sh: add matchall mirror test (Jiri Pirko)
  - net: sched: don't expose action qstats to skb_tc_reinsert() (Vlad Buslov)
  - net: sched: extract qstats update code into functions (Vlad Buslov)
  - net: sched: extract bstats update code into function (Vlad Buslov)
  - net: sched: extract common action counters update code into function (Vlad Buslov)
  - mm: perform the mapping_map_writable() check after call_mmap() (Lorenzo Stoakes)
  - mm: update memfd seal write check to include F_SEAL_WRITE (Lorenzo Stoakes)
  - mm: drop the assumption that VM_SHARED always implies writable (Lorenzo Stoakes)
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [Orabug: 37908492] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [Orabug: 38158396] {CVE-2025-38177}
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - btrfs: populate otime when logging an inode item (Qu Wenruo)
  - media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
  - f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
  - media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
  - media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
  - pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
  - pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
  - pwm: mediatek: Implement .apply() callback (Uwe Kleine-König)
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401677] {CVE-2025-39713}
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
  - media: v4l2-ctrls: always copy the controls on completion (Hans Verkuil)
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
  - soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson)
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
  - usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
  - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429211] {CVE-2025-39798}
  - NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() (Trond Myklebust)
  - NFSv4: Fix nfs4_bitmap_copy_adjust() (Trond Myklebust)
  - usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
  - cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
  - USB: cdc-acm: do not log successful probe on later errors (Johan Hovold)
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
  - mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t (He Zhe)
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
  - x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395081] {CVE-2025-38724}
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324271] {CVE-2025-38539}
  - usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
  - usb: hub: avoid warm port reset during USB3 disconnect (Mathias Nyman)
  - x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
  - f2fs: fix to do sanity check on ino and xnid (Chao Yu)
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
  - mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() (Miaohe Lin)
  - drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351930] {CVE-2025-38664}
  - net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
  - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Li Zhong)
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
  - comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
  - kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
  - kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
  - kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
  - mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
  - kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue (Thorsten Blum)
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
  - ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401581] {CVE-2025-39689}
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
  - use uniform permission checks for all mount propagation changes (Al Viro)
  - move_mount: allow to add a mount into an existing group (Pavel Tikhomirov)
  - fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401587] {CVE-2025-39691}
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
  - memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
  - media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
  - media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
  - media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401684] {CVE-2025-39714}
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
  - media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
  - soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423509] {CVE-2025-39782}
  - PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
  - PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
  - mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
  - pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
  - zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
  - ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
  - ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
  - ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
  - vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
  - vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
  - usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
  - m68k: Fix lost column on framebuffer debug console (Finn Thain)
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
  - serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401729] {CVE-2025-39724}
  - media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394816] {CVE-2025-38680}
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
  - parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
  - btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
  - thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
  - comedi: fix race between polling and detaching (Ian Abbott)
  - misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
  - drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
  - scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
  - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394867] {CVE-2025-38691}
  - pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
  - pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
  - pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
  - net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
  - ipmi: Fix strcpy source and destination the same (Corey Minyard)
  - kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
  - kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
  - kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
  - i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
  - PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
  - i3c: add missing include to internal header (Wolfram Sang)
  - media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394880] {CVE-2025-38693}
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394887] {CVE-2025-38694}
  - media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
  - media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
  - media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
  - pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
  - scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394894] {CVE-2025-38695}
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423286] {CVE-2025-39742}
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
  - jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
  - jfs: Regular file corruption check (Edward Adam Davis)
  - jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
  - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394925] {CVE-2025-38699}
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
  - watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
  - fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug: 38394931] {CVE-2025-38700}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394937] {CVE-2025-38701}
  - cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
  - vhost: fail early when __vhost_add_used() fails (Jason Wang)
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
  - uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
  - net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
  - wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
  - netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
  - net: fec: allow disable coalescing (Jonas Rebmann)
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
  - s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
  - wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
  - net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
  - wifi: cfg80211: Fix interface type validation (Ilan Peer)
  - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423341] {CVE-2025-39749}
  - net: ag71xx: Add missing check after DMA map (Thomas Fourier)
  - et131x: Add missing check after DMA map (Thomas Fourier)
  - be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
  - s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
  - wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
  - ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423359] {CVE-2025-39751}
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
  - usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
  - ACPI: processor: fix acpi_object initialization (Sebastian Ott)
  - PM: sleep: console: Fix the black screen issue (Tuhaowen)
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
  - selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
  - ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
  - gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
  - ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
  - cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
  - usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
  - usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
  - usb: xhci: print xhci->xhc_state when queue_command failed (Su Hui)
  - securityfs: don't pin dentries twice, once is enough... (Al Viro)
  - hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
  - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394995] {CVE-2025-38708}
  - udf: Verify partition map count (Jan Kara)
  - arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
  - hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
  - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395059] {CVE-2025-38718}
  - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395068] {CVE-2025-38721}
  - udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
  - ACPI: processor: perflib: Move problematic pr->performance check (Rafael J. Wysocki) [Orabug: 38429229] {CVE-2025-39799}
  - ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
  - Documentation: ACPI: Fix parent device references (Andy Shevchenko)
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423397] {CVE-2025-39756}
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
  - net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
  - net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38401319] {CVE-2025-38727}
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423407] {CVE-2025-39757}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395101] {CVE-2025-38729}
  - io_uring: don't use int for ABI (Pavel Begunkov)
  - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
  - USB: serial: option: add Foxconn T99W709 (Slark Xiao)
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351771] {CVE-2025-38618}
  - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351764] {CVE-2025-38617}
  - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334948] {CVE-2025-38563}
  - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334959] {CVE-2025-38565}
  - perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
  - pptp: fix pptp_xmit() error path (Eric Dumazet)
  - smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
  - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334976] {CVE-2025-38569}
  - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351786] {CVE-2025-38622}
  - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334988] {CVE-2025-38572}
  - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335004] {CVE-2025-38574}
  - netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401745] {CVE-2025-39730}
  - pci/hotplug/pnv-php: Wrap warnings in macro (Frederic Barrat)
  - pci/hotplug/pnv-php: Improve error msg on power state change failure (Frederic Barrat)
  - usb: chipidea: udc: fix sleeping function called from invalid context (Peter Chen)
  - f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
  - f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
  - rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
  - module: Restore the moduleparam prefix length check (Petr Pavlu)
  - bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
  - mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
  - mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
  - jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
  - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
  - crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
  - dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
  - fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
  - soundwire: stream: restore params when prepare ports fail (Bard Liao)
  - crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
  - scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
  - perf tests bp_account: Fix leaked file descriptor (Leo Yan)
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
  - pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
  - clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
  - mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
  - crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
  - PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
  - vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
  - selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
  - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351854] {CVE-2025-38639}
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
  - can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
  - Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
  - mwl8k: Add missing check after DMA map (Thomas Fourier)
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331466] {CVE-2025-38553}
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
  - m68k: Don't unregister boot console needlessly (Finn Thain)
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
  - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335110] {CVE-2025-38602}
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
  - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335120] {CVE-2025-38604}
  - caif: reduce stack size, again (Arnd Bergmann)
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335131] {CVE-2025-38608}
  - staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
  - samples: mei: Fix building on musl libc (Brahmajit Das)
  - cpufreq: Init policy->rwsem before it may be possibly used (Lifeng Zheng)
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
  - usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
  - Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
  - pps: fix poll support (Denis Osterland-Heim)
  - vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
  - ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
  - hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
  - ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
  - ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
  - usb: phy: mxs: disconnect line when USB charger is attached (Xu Yang)
  - usb: chipidea: add USB PHY event (Xu Yang)
  - usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use (Peter Chen)
  - usb: chipidea: udc: protect usb interrupt enable (Li Jun)
  - usb: chipidea: udc: add new API ci_hdrc_gadget_connect (Peter Chen)
  - ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
  - comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
  - nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
  - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351994] {CVE-2025-38671}
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
  - net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
  - net: appletalk: fix kerneldoc warnings (Andrew Lunn)
  - RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
  - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351978] {CVE-2025-38668}
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158477] {CVE-2025-38193}
  - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition (Zheng Wang)
  - power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync (Minghao Chi)
  - power: supply: bq24190_charger: Fix runtime PM imbalance on error (Dinghao Liu)
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
  - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253834] {CVE-2025-38375}
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
  - usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
  - usb: musb: fix gadget state on disconnect (Drew Hamilton)
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254214] {CVE-2025-38468}
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254225] {CVE-2025-38470}
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
  - Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254241] {CVE-2025-38473}
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254249] {CVE-2025-38474}
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254266] {CVE-2025-38477}
  - net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
  - comedi: Fix some signed shift left operations (Ian Abbott)
  - comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
  - iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
  - mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
  - mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
  - isofs: Verify inode mode when loading from disk (Jan Kara)
  - dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
  - af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254340] {CVE-2025-38494}
  - HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254348] {CVE-2025-38495}
  - pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
  - Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
  - i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
  - USB: serial: option: add Foxconn T99W640 (Slark Xiao)
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
  - LTS tag: v5.4.296 (Sherry Yang)
  - x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
  - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID (Hans de Goede)
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324280] {CVE-2025-38540}
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
  - vt: add missing notification when switching back to text mode (Nicolas Pitre)
  - net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
  - atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254090] {CVE-2025-38439}
  - bnxt_en: Fix DCB ETS validation (Shravya Kn)
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
  - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254109] {CVE-2025-38445}
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324161] {CVE-2025-38513}
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
  - Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
  - Input: xpad - add VID for Turtle Beach controllers (Vicki Pfau)
  - Input: xpad - add support for Amazon Game Controller (Matt Reynolds)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Tigran Mkrtchyan)
  - RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad)
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski)
  - Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
  - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254118] {CVE-2025-38448}
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324180] {CVE-2025-38515}
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324186] {CVE-2025-38516}
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
  - x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254147] {CVE-2025-38457}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254153] {CVE-2025-38458}
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254161] {CVE-2025-38459}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324309] {CVE-2025-38546}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254167] {CVE-2025-38460}
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254181] {CVE-2025-38464}
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254188] {CVE-2025-38465}
  - fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
  - proc: Clear the pieces of proc_inode that proc_evict_inode cares about (Eric W. Biederman)
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254203] {CVE-2025-38467}
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
  - media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
  - media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
  - media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
  - ACPI: PAD: fix crash in exit_round_robin() (Seiji Nishikawa) [Orabug: 37206006] {CVE-2024-49935}
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38401436] {CVE-2025-38404}
  - Logitech C-270 even more broken (Oliver Neukum)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
  - net: rose: Fix fall-through warnings for Clang (Gustavo A R Silva)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253887] {CVE-2025-38389}
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path (Vladimir Oltean)
  - spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write (Vladimir Oltean)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad)
  - RDMA/core: Create and destroy counters in the ib_core (Leon Romanovsky)
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
  - mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data() (Yue Hu)
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253907] {CVE-2025-38395}
  - regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253875] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253946] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253923] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253881] {CVE-2025-38387}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253894] {CVE-2025-38391}
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253937] {CVE-2025-38403}
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume (Omar Sandoval) [Orabug: 36530119] {CVE-2024-26644}
  - arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
  - s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
  - drm/tegra: Assign plane type before registration (Thierry Reding)
  - HID: wacom: fix kobject reference count leak (Qasim Ijaz)
  - HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
  - HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
  - dm-raid: fix variable in journal device check (Heinz Mauelshagen)
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175045] {CVE-2025-38245}
  - net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
  - um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
  - wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175065] {CVE-2025-38249}
  - i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
  - i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158592] {CVE-2025-38211}
  - RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private (Weihang Li)
  - media: vivid: Change the siize of the composing (Denis Arefev)
  - media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158692] {CVE-2025-38229}
  - media: cxusb: use dev_dbg() rather than hand-rolled debug (Sean Young)
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev)
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
  - of: Add of_property_present() helper (Rob Herring)
  - of: property: define of_property_read_u{8,16,32,64}_array() unconditionally (Michael Walle)
  - kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
  - kbuild: add --target to correctly cross-compile UAPI headers with Clang (Masahiro Yamada)
  - bpfilter: match bit size of bpfilter_umh to that of the kernel (Masahiro Yamada)
  - kbuild: use -MMD instead of -MD to exclude system headers from dependency (Masahiro Yamada)
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152869] {CVE-2025-38102}
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (George Kennedy)
  - ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
  - ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
  - ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
  - usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
  - tty: serial: uartlite: register uart driver in init (Jakub Lewalski)
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
  - md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
  - dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
  - mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
  - cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.348.2.el8uek]
changelog:
  - uek-rpm: Move ifb module to nano modules (Harshit Mogalapalli) [Orabug: 38443798]
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310007] {CVE-2025-38499}
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424094]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424094]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424094]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.348.3.el8uek]
changelog:
  - hugetlbfs: take read_lock on i_mmap for PMD sharing (Waiman Long)  [Orabug: 38459576]  
  - kallsyms: add module_kallsyms_on_each_symbol_locked (Julian Pidancet)  [Orabug: 37629344] [Orabug: 38418686]  
  - kallsyms: export module_kallsyms_on_each_symbol (Julian Pidancet)  [Orabug: 37629344] [Orabug: 38418686]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.348.1.el8uek]
changelog:
  - LTS tag: v5.4.298 (Sherry Yang)
  - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343661]
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440228] {CVE-2025-39808}
  - HID: wacom: Add a new Art Pen 2 (Ping Cheng)
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440310] {CVE-2025-39824}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440277] {CVE-2025-39817}
  - sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440251] {CVE-2025-39812}
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
  - net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
  - net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440347] {CVE-2025-39828}
  - net/atm: remove the atmdev_ops {get, set}sockopt methods (Christoph Hellwig)
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
  - powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
  - net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343661]
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
  - scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440259] {CVE-2025-39813}
  - pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
  - LTS tag: v5.4.297 (Sherry Yang)
  - alloc_fdtable(): change calling conventions. (Al Viro)
  - s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu)
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343661]
  - scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401514] {CVE-2025-39676}
  - usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
  - nfs: fix UAF in direct writes (Josef Bacik) [Orabug: 36596831] {CVE-2024-26958}
  - NFS: Fix up commit deadlocks (Trond Myklebust)
  - cifs: Fix UAF in cifs_demultiplex_thread() (Zhang Xiaoxu)
  - Bluetooth: fix use-after-free in device_for_each_child() (Dmitry Antipov) [Orabug: 37433654] {CVE-2024-53237}
  - act_mirred: use the backlog for nested calls to mirred ingress (Davide Caratti)
  - net/sched: act_mirred: better wording on protection against excessive stack growth (Davide Caratti)
  - net/sched: act_mirred: refactor the handle of xmit (Wenxu)
  - selftests: forwarding: tc_actions.sh: add matchall mirror test (Jiri Pirko)
  - net: sched: don't expose action qstats to skb_tc_reinsert() (Vlad Buslov)
  - net: sched: extract qstats update code into functions (Vlad Buslov)
  - net: sched: extract bstats update code into function (Vlad Buslov)
  - net: sched: extract common action counters update code into function (Vlad Buslov)
  - mm: perform the mapping_map_writable() check after call_mmap() (Lorenzo Stoakes)
  - mm: update memfd seal write check to include F_SEAL_WRITE (Lorenzo Stoakes)
  - mm: drop the assumption that VM_SHARED always implies writable (Lorenzo Stoakes)
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [Orabug: 37908492] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [Orabug: 38158396] {CVE-2025-38177}
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - btrfs: populate otime when logging an inode item (Qu Wenruo)
  - media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
  - f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
  - media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
  - media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
  - pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
  - pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
  - pwm: mediatek: Implement .apply() callback (Uwe Kleine-König)
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401677] {CVE-2025-39713}
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
  - media: v4l2-ctrls: always copy the controls on completion (Hans Verkuil)
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
  - soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524] {CVE-2025-39787}
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
  - usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
  - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429211] {CVE-2025-39798}
  - NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() (Trond Myklebust)
  - NFSv4: Fix nfs4_bitmap_copy_adjust() (Trond Myklebust)
  - usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
  - cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
  - USB: cdc-acm: do not log successful probe on later errors (Johan Hovold)
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
  - mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t (He Zhe)
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
  - x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395081,38501612] {CVE-2025-38724}
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324271] {CVE-2025-38539}
  - usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
  - usb: hub: avoid warm port reset during USB3 disconnect (Mathias Nyman)
  - x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
  - f2fs: fix to do sanity check on ino and xnid (Chao Yu)
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
  - mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() (Miaohe Lin)
  - drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351930] {CVE-2025-38664}
  - net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
  - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Li Zhong)
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
  - comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
  - kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
  - kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
  - kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
  - mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
  - kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue (Thorsten Blum)
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
  - ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401581] {CVE-2025-39689}
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
  - use uniform permission checks for all mount propagation changes (Al Viro)
  - move_mount: allow to add a mount into an existing group (Pavel Tikhomirov)
  - fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401587] {CVE-2025-39691}
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
  - memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
  - media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
  - media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
  - media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401684] {CVE-2025-39714}
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
  - media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
  - soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423509] {CVE-2025-39782}
  - PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
  - PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
  - mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
  - pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
  - zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
  - ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
  - ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
  - ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
  - vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
  - vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
  - usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
  - m68k: Fix lost column on framebuffer debug console (Finn Thain)
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
  - serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401729] {CVE-2025-39724}
  - media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394816] {CVE-2025-38680}
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
  - parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
  - btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
  - thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
  - comedi: fix race between polling and detaching (Ian Abbott)
  - misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
  - drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
  - scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
  - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394867] {CVE-2025-38691}
  - pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
  - pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
  - pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
  - net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
  - ipmi: Fix strcpy source and destination the same (Corey Minyard)
  - kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
  - kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
  - kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
  - i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
  - PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
  - i3c: add missing include to internal header (Wolfram Sang)
  - media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394880] {CVE-2025-38693}
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394887] {CVE-2025-38694}
  - media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
  - media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
  - media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
  - pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
  - scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394894] {CVE-2025-38695}
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423286] {CVE-2025-39742}
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
  - jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
  - jfs: Regular file corruption check (Edward Adam Davis)
  - jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
  - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394925] {CVE-2025-38699}
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
  - watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
  - fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug: 38394931] {CVE-2025-38700}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394937] {CVE-2025-38701}
  - cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
  - vhost: fail early when __vhost_add_used() fails (Jason Wang)
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
  - uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
  - net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
  - wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
  - netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
  - net: fec: allow disable coalescing (Jonas Rebmann)
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
  - s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
  - wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
  - net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
  - wifi: cfg80211: Fix interface type validation (Ilan Peer)
  - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423341] {CVE-2025-39749}
  - net: ag71xx: Add missing check after DMA map (Thomas Fourier)
  - et131x: Add missing check after DMA map (Thomas Fourier)
  - be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
  - s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
  - wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
  - ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun)
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
  - usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
  - ACPI: processor: fix acpi_object initialization (Sebastian Ott)
  - PM: sleep: console: Fix the black screen issue (Tuhaowen)
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
  - selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
  - ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
  - gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
  - ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
  - cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
  - usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
  - usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
  - usb: xhci: print xhci->xhc_state when queue_command failed (Su Hui)
  - securityfs: don't pin dentries twice, once is enough... (Al Viro)
  - hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
  - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394995] {CVE-2025-38708}
  - udf: Verify partition map count (Jan Kara)
  - arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
  - hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
  - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395059] {CVE-2025-38718}
  - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395068] {CVE-2025-38721}
  - udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
  - ACPI: processor: perflib: Move problematic pr->performance check (Rafael J. Wysocki)
  - ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
  - Documentation: ACPI: Fix parent device references (Andy Shevchenko)
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423397] {CVE-2025-39756}
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
  - net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
  - net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38401319] {CVE-2025-38727}
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423407] {CVE-2025-39757}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395101] {CVE-2025-38729}
  - io_uring: don't use int for ABI (Pavel Begunkov)
  - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
  - USB: serial: option: add Foxconn T99W709 (Slark Xiao)
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351771,38453914] {CVE-2025-38618}
  - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351764] {CVE-2025-38617}
  - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334948] {CVE-2025-38563}
  - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334959] {CVE-2025-38565}
  - perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
  - pptp: fix pptp_xmit() error path (Eric Dumazet)
  - smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
  - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334976] {CVE-2025-38569}
  - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351786] {CVE-2025-38622}
  - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334988] {CVE-2025-38572}
  - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335004] {CVE-2025-38574}
  - netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401745] {CVE-2025-39730}
  - pci/hotplug/pnv-php: Wrap warnings in macro (Frederic Barrat)
  - pci/hotplug/pnv-php: Improve error msg on power state change failure (Frederic Barrat)
  - usb: chipidea: udc: fix sleeping function called from invalid context (Peter Chen)
  - f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
  - f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
  - rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
  - module: Restore the moduleparam prefix length check (Petr Pavlu)
  - bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
  - mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
  - mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
  - jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
  - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
  - crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
  - dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
  - fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
  - soundwire: stream: restore params when prepare ports fail (Bard Liao)
  - crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
  - scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
  - perf tests bp_account: Fix leaked file descriptor (Leo Yan)
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
  - pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
  - clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
  - mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
  - crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
  - PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
  - vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
  - selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
  - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351854] {CVE-2025-38639}
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
  - can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
  - Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
  - mwl8k: Add missing check after DMA map (Thomas Fourier)
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331466] {CVE-2025-38553}
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
  - m68k: Don't unregister boot console needlessly (Finn Thain)
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
  - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335110] {CVE-2025-38602}
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
  - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335120] {CVE-2025-38604}
  - caif: reduce stack size, again (Arnd Bergmann)
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335131] {CVE-2025-38608}
  - staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
  - samples: mei: Fix building on musl libc (Brahmajit Das)
  - cpufreq: Init policy->rwsem before it may be possibly used (Lifeng Zheng)
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
  - usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
  - Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
  - pps: fix poll support (Denis Osterland-Heim)
  - vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
  - ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
  - hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
  - ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
  - ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
  - usb: phy: mxs: disconnect line when USB charger is attached (Xu Yang)
  - usb: chipidea: add USB PHY event (Xu Yang)
  - usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use (Peter Chen)
  - usb: chipidea: udc: protect usb interrupt enable (Li Jun)
  - usb: chipidea: udc: add new API ci_hdrc_gadget_connect (Peter Chen)
  - ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
  - comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
  - nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
  - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351994] {CVE-2025-38671}
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
  - net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
  - net: appletalk: fix kerneldoc warnings (Andrew Lunn)
  - RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
  - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351978] {CVE-2025-38668}
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158477] {CVE-2025-38193}
  - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition (Zheng Wang)
  - power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync (Minghao Chi)
  - power: supply: bq24190_charger: Fix runtime PM imbalance on error (Dinghao Liu)
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
  - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253834] {CVE-2025-38375}
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
  - usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
  - usb: musb: fix gadget state on disconnect (Drew Hamilton)
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254214] {CVE-2025-38468}
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254225] {CVE-2025-38470}
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
  - Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254241] {CVE-2025-38473}
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254249] {CVE-2025-38474}
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254266] {CVE-2025-38477}
  - net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
  - comedi: Fix some signed shift left operations (Ian Abbott)
  - comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
  - iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
  - mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
  - mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
  - isofs: Verify inode mode when loading from disk (Jan Kara)
  - dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
  - af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254340,38453904] {CVE-2025-38494}
  - HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254348,38453908] {CVE-2025-38495}
  - pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
  - Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
  - i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
  - USB: serial: option: add Foxconn T99W640 (Slark Xiao)
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
  - LTS tag: v5.4.296 (Sherry Yang)
  - x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
  - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID (Hans de Goede)
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324280] {CVE-2025-38540}
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
  - vt: add missing notification when switching back to text mode (Nicolas Pitre)
  - net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
  - atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254090] {CVE-2025-38439}
  - bnxt_en: Fix DCB ETS validation (Shravya Kn)
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
  - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254109] {CVE-2025-38445}
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324161] {CVE-2025-38513}
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
  - Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
  - Input: xpad - add VID for Turtle Beach controllers (Vicki Pfau)
  - Input: xpad - add support for Amazon Game Controller (Matt Reynolds)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Tigran Mkrtchyan)
  - RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad)
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski)
  - Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
  - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254118] {CVE-2025-38448}
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324180] {CVE-2025-38515}
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324186] {CVE-2025-38516}
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
  - x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254147] {CVE-2025-38457}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254153] {CVE-2025-38458}
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254161] {CVE-2025-38459}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324309] {CVE-2025-38546}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254167] {CVE-2025-38460}
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254181] {CVE-2025-38464}
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254188] {CVE-2025-38465}
  - fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
  - proc: Clear the pieces of proc_inode that proc_evict_inode cares about (Eric W. Biederman)
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254203] {CVE-2025-38467}
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
  - media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
  - media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
  - media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
  - ACPI: PAD: fix crash in exit_round_robin() (Seiji Nishikawa) [Orabug: 37206006] {CVE-2024-49935}
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38401436] {CVE-2025-38404}
  - Logitech C-270 even more broken (Oliver Neukum)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
  - net: rose: Fix fall-through warnings for Clang (Gustavo A R Silva)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253887] {CVE-2025-38389}
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path (Vladimir Oltean)
  - spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write (Vladimir Oltean)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad)
  - RDMA/core: Create and destroy counters in the ib_core (Leon Romanovsky)
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
  - mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data() (Yue Hu)
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253907] {CVE-2025-38395}
  - regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253875] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253946] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253923] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253881] {CVE-2025-38387}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253894] {CVE-2025-38391}
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253937] {CVE-2025-38403}
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume (Omar Sandoval) [Orabug: 36530119] {CVE-2024-26644}
  - arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
  - s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
  - drm/tegra: Assign plane type before registration (Thierry Reding)
  - HID: wacom: fix kobject reference count leak (Qasim Ijaz)
  - HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
  - HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
  - dm-raid: fix variable in journal device check (Heinz Mauelshagen)
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175045] {CVE-2025-38245}
  - net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
  - um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
  - wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175065] {CVE-2025-38249}
  - i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
  - i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158592] {CVE-2025-38211}
  - RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private (Weihang Li)
  - media: vivid: Change the siize of the composing (Denis Arefev)
  - media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158692] {CVE-2025-38229}
  - media: cxusb: use dev_dbg() rather than hand-rolled debug (Sean Young)
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev)
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
  - of: Add of_property_present() helper (Rob Herring)
  - of: property: define of_property_read_u{8,16,32,64}_array() unconditionally (Michael Walle)
  - kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
  - kbuild: add --target to correctly cross-compile UAPI headers with Clang (Masahiro Yamada)
  - bpfilter: match bit size of bpfilter_umh to that of the kernel (Masahiro Yamada)
  - kbuild: use -MMD instead of -MD to exclude system headers from dependency (Masahiro Yamada)
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152869] {CVE-2025-38102}
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (George Kennedy)
  - ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
  - ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
  - ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
  - usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
  - tty: serial: uartlite: register uart driver in init (Jakub Lewalski)
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
  - md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
  - dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
  - mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
  - cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.349.1.el8uek]
changelog:
  - NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
  - power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
  - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
  - usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
  - soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
  - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
  - LTS tag: v5.4.299 (Alok Tiwari)
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456754] {CVE-2025-39841}
  - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
  - cifs: fix integer overflow in match_server() (Roman Smirnov)
  - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
  - spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
  - spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
  - pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
  - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
  - randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
  - randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
  - vmxnet3: update MTU after device quiesce (Ronak Doshi)
  - net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
  - net: dsa: microchip: update tag_ksz masks for KSZ9477 family (Pieter Van Trappen)
  - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
  - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
  - gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
  - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977028] {CVE-2025-37968}
  - iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494761] {CVE-2025-39902}
  - mm/khugepaged: fix ->anon_vma race (Jann Horn)
  - e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494740] {CVE-2025-39898}
  - batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
  - drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
  - wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494723] {CVE-2025-39891}
  - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
  - ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
  - ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456781] {CVE-2025-39847}
  - net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
  - ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
  - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
  - net: thunder_bgx: add a missing of_node_put (Rosen Penev)
  - wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
  - wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
  - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
  - i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456814] {CVE-2025-39853}
  - icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
  - mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
  - xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
  - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456834] {CVE-2025-39860}
  - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
  - wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456860] {CVE-2025-39864}
  - powerpc: boot: Remove leading zero in label in udelay() (Nathan Chancellor)


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.349.2.el8uek]
changelog:
  - bpf/bpf_get,set_sockopt: add option to set TCP-BPF sock ops flags (Alan Maguire) [Orabug: 36699199]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.349.3.el8uek]
changelog:
  - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545204]
  - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson) [Orabug: 38494247]
  - rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492234]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.349.3.1.el8uek]
changelog:
  - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38604171]  {CVE-2025-39973} 
  - i40e: increase max descriptors for XL710 (Justin Bronder)  [Orabug: 38604171]  {CVE-2025-39973}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.349.3.1.el8uek]
changelog:
  - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38604171]  {CVE-2025-39973}
  - i40e: increase max descriptors for XL710 (Justin Bronder)  [Orabug: 38604171]  {CVE-2025-39973}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.349.3.2.el8uek]
changelog:
  - crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu)  [Orabug: 38705546]  {CVE-2025-40019}


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2035.el8
changelog:
  - arm64/elf: Disable automatic READ_IMPLIES_EXEC for 64-bit address spaces (Kees Cook)  [Orabug: 31776976] 
  - arm32/64/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK (Kees Cook)  [Orabug: 31776976] 
  - arm32/64/elf: Add tables to document READ_IMPLIES_EXEC (Kees Cook)  [Orabug: 31776976] 
  - x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit (Kees Cook)  [Orabug: 31776976] 
  - x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK (Kees Cook)  [Orabug: 31776976] 
  - x86/elf: Add table to document READ_IMPLIES_EXEC (Kees Cook)  [Orabug: 31776976] 
  - Linux 5.4.60 (Greg Kroah-Hartman)  
  - drm/amd/display: dchubbub p-state warning during surface planes switch (hersen wu)  
  - drm/amdgpu: Fix bug where DPM is not enabled after hibernate and resume (Sandeep Raghuraman)  
  - drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi (Xin Xiong)  
  - drm: Added orientation quirk for ASUS tablet model T103HAF (Marius Iacob)  
  - drm/panfrost: Use kvfree() to free bo->sgts (Denis Efremov)  
  - arm64: dts: marvell: espressobin: add ethernet alias (Tomasz Maciej Nowak)  
  - khugepaged: retract_page_tables() remember to test exit (Hugh Dickins)  
  - sh: landisk: Add missing initialization of sh_io_port_base (Geert Uytterhoeven)  
  - perf/x86/rapl: Fix missing psys sysfs attributes (Zhang Rui)  
  - tools build feature: Quote CC and CXX for their arguments (Daniel Díaz)  
  - perf bench mem: Always memset source before memcpy (Vincent Whitchurch)  
  - ALSA: echoaudio: Fix potential Oops in snd_echo_resume() (Dinghao Liu)  
  - crypto: algif_aead - fix uninitialized ctx->init (Ondrej Mosnacek)  
  - mfd: dln2: Run event handler loop under spinlock (Andy Shevchenko)  
  - i2c: iproc: fix race between client unreg and isr (Dhananjay Phadke)  
  - test_kmod: avoid potential double free in trigger_config_run_type() (Tiezhu Yang)  
  - fs/ufs: avoid potential u32 multiplication overflow (Colin Ian King)  
  - fs/minix: remove expected error message in block_to_path() (Eric Biggers)  
  - fs/minix: fix block limit check for V1 filesystems (Eric Biggers)  
  - fs/minix: set s_maxbytes correctly (Eric Biggers)  
  - nfs: Fix getxattr kernel panic and memory overflow (Jeffrey Mitchell)  
  - net: qcom/emac: add missed clk_disable_unprepare in error path of emac_clks_phase1_init (Wang Hai)  
  - drm/vmwgfx: Fix two list_for_each loop exit tests (Dan Carpenter)  
  - drm/vmwgfx: Use correct vmw_legacy_display_unit pointer (Dan Carpenter)  
  - recordmcount: Fix build failure on non arm64 (Christophe Leroy)  
  - Input: sentelic - fix error return when fsp_reg_write fails (Colin Ian King)  
  - x86/tsr: Fix tsc frequency enumeration bug on Lightning Mountain SoC (Dilip Kota)  
  - md-cluster: Fix potential error pointer dereference in resize_bitmaps() (Dan Carpenter)  
  - watchdog: initialize device before misc_register (Krzysztof Sobota)  
  - nfs: nfs_file_write() should check for writeback errors (Scott Mayhew)  
  - scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport (Ewan D. Milne)  
  - openrisc: Fix oops caused when dumping stack (Stafford Horne)  
  - libnvdimm/security: ensure sysfs poll thread woke up and fetch updated attr (Jane Chu)  
  - libnvdimm/security: fix a typo (Jane Chu)  
  - clk: bcm2835: Do not use prediv with bcm2711's PLLs (Nicolas Saenz Julienne)  
  - ubifs: Fix wrong orphan node deletion in ubifs_jnl_update|rename (Zhihao Cheng)  
  - nfs: ensure correct writeback errors are returned on close() (Scott Mayhew)  
  - i2c: rcar: avoid race when unregistering slave (Wolfram Sang)  
  - tools build feature: Use CC and CXX from parent (Thomas Hebb)  
  - pwm: bcm-iproc: handle clk_get_rate() return (Rayagonda Kokatanur)  
  - clk: clk-atlas6: fix return value check in atlas6_clk_init() (Xu Wang)  
  - clk: qcom: gcc-sdm660: Fix up gcc_mss_mnoc_bimc_axi_clk (Konrad Dybcio)  
  - i2c: rcar: slave: only send STOP event when we have been addressed (Wolfram Sang)  
  - iommu/vt-d: Enforce PASID devTLB field mask (Liu Yi L)  
  - clk: qcom: clk-alpha-pll: remove unused/incorrect PLL_CAL_VAL (Jonathan Marek)  
  - clk: qcom: gcc: fix sm8150 GPU and NPU clocks (Jonathan Marek)  
  - iommu/omap: Check for failure of a call to omap_iommu_dump_ctx (Colin Ian King)  
  - selftests/powerpc: ptrace-pkey: Don't update expected UAMOR value (Aneesh Kumar K.V)  
  - selftests/powerpc: ptrace-pkey: Update the test to mark an invalid pkey correctly (Aneesh Kumar K.V)  
  - selftests/powerpc: ptrace-pkey: Rename variables to make it easier to follow code (Aneesh Kumar K.V)  
  - clk: actions: Fix h_clk for Actions S500 SoC (Cristian Ciocaltea)  
  - dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue() (Ming Lei)  
  - gpu: ipu-v3: image-convert: Wait for all EOFs before completing a tile (Steve Longerbeam)  
  - gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers (Steve Longerbeam)  
  - crypto: caam - Remove broken arc4 support (Herbert Xu)  
  - mmc: renesas_sdhi_internal_dmac: clean up the code for dma complete (Yoshihiro Shimoda)  
  - RDMA/counter: Allow manually bind QPs with different pids to same counter (Mark Zhang)  
  - RDMA/counter: Only bind user QPs in auto mode (Mark Zhang)  
  - devres: keep both device name and resource name in pretty name (Vladimir Oltean)  
  - crypto: af_alg - Fix regression on empty requests (Herbert Xu)  
  - USB: serial: ftdi_sio: clean up receive processing (Johan Hovold)  
  - USB: serial: ftdi_sio: make process-packet buffer unsigned (Johan Hovold)  
  - selftests/bpf: test_progs use another shell exit on non-actions (Jesper Dangaard Brouer)  
  - selftests/bpf: Test_progs indicate to shell on non-actions (Jesper Dangaard Brouer)  
  - IB/uverbs: Set IOVA on IB MR in uverbs layer (Yishai Hadas)  
  - media: rockchip: rga: Only set output CSC mode for RGB input (Paul Kocialkowski)  
  - media: rockchip: rga: Introduce color fmt macros and refactor CSC mode logic (Paul Kocialkowski)  
  - RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah() (Jason Gunthorpe)  
  - RDMA/ipoib: Return void from ipoib_ib_dev_stop() (Kamal Heib)  
  - platform/chrome: cros_ec_ishtp: Fix a double-unlock issue (Qiushi Wu)  
  - mtd: rawnand: fsl_upm: Remove unused mtd var (Boris Brezillon)  
  - octeontx2-af: change (struct qmem)->entry_sz from u8 to u16 (Eric Dumazet)  
  - mfd: arizona: Ensure 32k clock is put on driver unbind and error (Charles Keepax)  
  - crypto: algif_aead - Only wake up when ctx->more is zero (Herbert Xu)  
  - pinctrl: ingenic: Properly detect GPIO direction when configured for IRQ (Paul Cercueil)  
  - orangefs: get rid of knob code... (Mike Marshall)  
  - drm/imx: imx-ldb: Disable both channels for split mode in enc->disable() (Liu Ying)  
  - remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load (Sibi Sankar)  
  - remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load (Sibi Sankar)  
  - remoteproc: qcom: q6v5: Update running state before requesting stop (Sibi Sankar)  
  - perf intel-pt: Fix duplicate branch after CBR (Adrian Hunter)  
  - perf intel-pt: Fix FUP packet state (Adrian Hunter)  
  - module: Correctly truncate sysfs sections output (Kees Cook)  
  - pseries: Fix 64 bit logical memory block panic (Anton Blanchard)  
  - ceph: handle zero-length feature mask in session messages (Jeff Layton)  
  - ceph: set sec_context xattr on symlink creation (Jeff Layton)  
  - watchdog: f71808e_wdt: clear watchdog timeout occurred flag (Ahmad Fatoum)  
  - watchdog: f71808e_wdt: remove use of wrong watchdog_info option (Ahmad Fatoum)  
  - watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options (Ahmad Fatoum)  
  - tracing: Move pipe reference to trace array instead of current_tracer (Steven Rostedt (VMware))  
  - tracing: Use trace_sched_process_free() instead of exit() for pid tracing (Steven Rostedt (VMware))  
  - tracing/hwlat: Honor the tracing_cpumask (Kevin Hao)  
  - kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler (Muchun Song)  
  - ftrace: Setup correct FTRACE_FL_REGS flags for module (Chengming Zhou)  
  - mm/memory_hotplug: fix unpaired mem_hotplug_begin/done (Jia He)  
  - mm/page_counter.c: fix protection usage propagation (Michal Koutný)  
  - ocfs2: change slot number type s16 to u16 (Junxiao Bi)  
  - khugepaged: collapse_pte_mapped_thp() protect the pmd lock (Hugh Dickins)  
  - khugepaged: collapse_pte_mapped_thp() flush the right range (Hugh Dickins)  
  - ext2: fix missing percpu_counter_inc (Mikulas Patocka)  
  - MIPS: qi_lb60: Fix routing to audio amplifier (Paul Cercueil)  
  - MIPS: CPU#0 is not hotpluggable (Huacai Chen)  
  - driver core: Avoid binding drivers to dead devices (Lukas Wunner)  
  - mac80211: fix misplaced while instead of if (Johannes Berg)  
  - bcache: fix overflow in offset_to_stripe() (Coly Li)  
  - bcache: allocate meta data pages as compound pages (Coly Li)  
  - md/raid5: Fix Force reconstruct-write io stuck in degraded raid5 (ChangSyun Peng)  
  - net/compat: Add missing sock updates for SCM_RIGHTS (Kees Cook)  
  - net: stmmac: dwmac1000: provide multicast filter fallback (Jonathan McDowell)  
  - net: ethernet: stmmac: Disable hardware multicast filter (Jonathan McDowell)  
  - media: vsp1: dl: Fix NULL pointer dereference on unbind (Eugeniu Rosca)  
  - pinctrl: ingenic: Enhance support for IRQ_TYPE_EDGE_BOTH (Paul Cercueil)  
  - powerpc: Fix circular dependency between percpu.h and mmu.h (Michael Ellerman)  
  - powerpc: Allow 4224 bytes of stack expansion for the signal frame (Michael Ellerman)  
  - powerpc/ptdump: Fix build failure in hashpagetable.c (Christophe Leroy)  
  - cifs: Fix leak when handling lease break for cached root fid (Paul Aurich)  
  - xtensa: fix xtensa_pmu_setup prototype (Max Filippov)  
  - xtensa: add missing exclusive access state management (Max Filippov)  
  - iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw() (Alexandru Ardelean)  
  - dt-bindings: iio: io-channel-mux: Fix compatible string in example code (Christian Eggers)  
  - arm64: perf: Correct the event index in sysfs (Shaokun Zhang)  
  - btrfs: fix return value mixup in btrfs_get_extent (Pavel Machek)  
  - btrfs: make sure SB_I_VERSION doesn't get unset by remount (Josef Bacik)  
  - btrfs: fix memory leaks after failure to lookup checksums during inode logging (Filipe Manana)  
  - btrfs: inode: fix NULL pointer dereference if inode doesn't need compression (Qu Wenruo)  
  - btrfs: only search for left_info if there is no right_info in try_merge_free_space (Josef Bacik)   {CVE-2019-19448}
  - btrfs: fix messages after changing compression level by remount (David Sterba)  
  - btrfs: fix race between page release and a fast fsync (Filipe Manana)  
  - btrfs: don't WARN if we abort a transaction with EROFS (Josef Bacik)  
  - btrfs: sysfs: use NOFS for device creation (Josef Bacik)  
  - btrfs: avoid possible signal interruption of btrfs_drop_snapshot() on relocation tree (Qu Wenruo)  
  - btrfs: add missing check for nocow and compression inode flags (David Sterba)  
  - btrfs: relocation: review the call sites which can be interrupted by signal (Qu Wenruo)  
  - btrfs: move the chunk_mutex in btrfs_read_chunk_tree (Josef Bacik)  
  - btrfs: open device without device_list_mutex (Josef Bacik)  
  - btrfs: don't traverse into the seed devices in show_devname (Anand Jain)  
  - btrfs: remove no longer needed use of log_writers for the log root tree (Filipe Manana)  
  - btrfs: stop incremening log_batch for the log root tree when syncing log (Filipe Manana)  
  - btrfs: ref-verify: fix memory leak in add_block_entry (Tom Rix)  
  - btrfs: don't allocate anonymous block device for user invisible roots (Qu Wenruo)  
  - btrfs: free anon block device right after subvolume deletion (Qu Wenruo)  
  - btrfs: allow use of global block reserve for balance item deletion (David Sterba)  
  - PCI: qcom: Add support for tx term offset for rev 2.1.0 (Ansuel Smith)  
  - PCI: qcom: Define some PARF params needed for ipq8064 SoC (Ansuel Smith)  
  - PCI: Add device even if driver attach failed (Rajat Jain)  
  - PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken (Kai-Heng Feng)  
  - PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context() (Rafael J. Wysocki)  
  - genirq/PM: Always unlock IRQ descriptor in rearm_wake_irq() (Guenter Roeck)  
  - genirq/affinity: Make affinity setting if activated opt-in (Thomas Gleixner)  
  - smb3: warn on confusing error scenario with sec=krb5 (Steve French)  
  - scsi: mpt3sas: Fix memset() in non-RDPQ mode (Suganath Prabu S)  [Orabug: 31741029] 
  - scsi: mpt3sas: Fix reply queue count in non RDPQ mode (Suganath Prabu S)  [Orabug: 31741029] 
  - scsi: mpt3sas: Remove unused including <linux/version.h> (Samuel Zou)  [Orabug: 31741029] 
  - scsi: mpt3sas: Disable DIF when prot_mask set to zero (Sreekanth Reddy)  [Orabug: 31741029] 
  - scsi: mpt3sas: Capture IOC data for debugging purposes (Suganath Prabu)  [Orabug: 31741029] 
  - scsi: mpt3sas: Use true, false for ioc->use_32bit_dma (Jason Yan)  [Orabug: 31741029] 
  - scsi: mpt3sas: Remove NULL check before freeing function (Jason Yan)  [Orabug: 31741029] 
  - scsi: mpt3sas: Update mpt3sas version to 33.101.00.00 (Suganath Prabu)  [Orabug: 31741029] 
  - scsi: mpt3sas: Handle RDPQ DMA allocation in same 4G region (Suganath Prabu)  [Orabug: 31741029] 
  - scsi: mpt3sas: Separate out RDPQ allocation to new function (Suganath Prabu)  [Orabug: 31741029] 
  - scsi: mpt3sas: Rename function name is_MSB_are_same (Suganath Prabu)  [Orabug: 31741029] 
  - scsi: mpt3sas: Don't change the DMA coherent mask after allocations (Christoph Hellwig)  [Orabug: 31741029] 
  - scsi: mpt3sas: use true,false for bool variables (Jason Yan)  [Orabug: 31741029] 
  - x86/mm: use max memory block size on bare metal (Daniel Jordan)  [Orabug: 31765311] 
  - drivers/base/memory.c: cache memory blocks in xarray to accelerate lookup (Scott Cheloha)  [Orabug: 31765311] 
  - sched/core: remove undesired trace_printk from core scheduling backport (chris hyser)  [Orabug: 31757863] 
  - libnvdimm/security: the 'security' attr never (Jane Chu)  [Orabug: 30501507] 
  - net/rds: Incorrect pointer used in rds_getname() (Ka-Cheong Poon)  [Orabug: 31755710] 
  - Linux 5.4.59 (Greg Kroah-Hartman)  
  - io_uring: Fix NULL pointer dereference in loop_rw_iter() (Guoyu Huang)  
  - s390/gmap: improve THP splitting (Gerald Schaefer)  
  - s390/dasd: fix inability to use DASD with DIAG driver (Stefan Haberland)  
  - xen/gntdev: Fix dmabuf import with non-zero sgt offset (Oleksandr Andrushchenko)  
  - xen/balloon: make the balloon wait interruptible (Roger Pau Monne)  
  - xen/balloon: fix accounting in alloc_xenballooned_pages error path (Roger Pau Monne)  
  - fs/minix: reject too-large maximum file size (Eric Biggers)  
  - fs/minix: don't allow getting deleted inodes (Eric Biggers)  
  - fs/minix: check return value of sb_getblk() (Eric Biggers)  
  - bitfield.h: don't compile-time validate _val in FIELD_FIT (Jakub Kicinski)  
  - crypto: cpt - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified (Mikulas Patocka)  
  - crypto: ccp - Fix use of merged scatterlists (John Allen)  
  - crypto: qat - fix double free in qat_uclo_create_batch_init_list (Tom Rix)  
  - crypto: hisilicon - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified (Mikulas Patocka)  
  - pstore: Fix linking when crypto API disabled (Matteo Croce)  
  - tpm: Unify the mismatching TPM space buffer sizes (Jarkko Sakkinen)  
  - ALSA: usb-audio: add quirk for Pioneer DDJ-RB (Hector Martin)  
  - irqdomain/treewide: Free firmware node after domain removal (Jon Derrick)  
  - ARM: 8992/1: Fix unwind_frame for clang-built kernels (Nathan Huckleberry)  
  - parisc: mask out enable and reserved bits from sba imask (Sven Schnelle)  
  - parisc: Implement __smp_store_release and __smp_load_acquire barriers (John David Anglin)  
  - parisc: Do not use an ordered store in pa_tlb_lock() (John David Anglin)  
  - Revert "parisc: Revert "Release spinlocks using ordered store"" (Helge Deller)  
  - Revert "parisc: Use ldcw instruction for SMP spinlock release barrier" (Helge Deller)  
  - Revert "parisc: Drop LDCW barrier in CAS code when running UP" (Helge Deller)  
  - erofs: fix extended inode could cross boundary (Gao Xiang)  
  - mtd: rawnand: qcom: avoid write to unavailable register (Sivaprakash Murugesan)  
  - spi: spidev: Align buffers for DMA (Christian Eggers)  
  - include/asm-generic/vmlinux.lds.h: align ro_after_init (Romain Naour)  
  - cpufreq: dt: fix oops on armada37xx (Ivan Kokshaysky)  
  - cpufreq: Fix locking issues with governors (Viresh Kumar)  
  - NFS: Don't return layout segments that are in use (Trond Myklebust)  
  - NFS: Don't move layouts to plh_return_segs list while in use (Trond Myklebust)  
  - io_uring: set ctx sq/cq entry count earlier (Jens Axboe)  
  - drm/ttm/nouveau: don't call tt destroy callback on alloc failure. (Dave Airlie)  
  - media: media-request: Fix crash if memory allocation fails (Tuomas Tynkkynen)  
  - 9p: Fix memory leak in v9fs_mount (Zheng Bin)  
  - ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109 (Hector Martin)  
  - ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109 (Hector Martin)  
  - ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support (Mirko Dietrich)  
  - ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO (Hui Wang)  
  - USB: serial: cp210x: enable usb generic throttle/unthrottle (Brant Merryman)  
  - USB: serial: cp210x: re-enable auto-RTS on open (Brant Merryman)  
  - net: initialize fastreuse on inet_inherit_port (Tim Froidcoeur)  
  - net: refactor bind_bucket fastreuse into helper (Tim Froidcoeur)  
  - vmxnet3: use correct tcp hdr length when packet is encapsulated (Ronak Doshi)  
  - tcp: correct read of TFO keys on big endian systems (Jason Baron)  
  - net/tls: Fix kmap usage (Ira Weiny)  
  - net: Set fput_needed iff FDPUT_FPUT is set (Miaohe Lin)  
  - net: phy: fix memory leak in device-create error path (Johan Hovold)  
  - net/nfc/rawsock.c: add CAP_NET_RAW check. (Qingyu Li)  
  - net: Fix potential memory leak in proto_register() (Miaohe Lin)  
  - drivers/net/wan/lapbether: Added needed_headroom and a skb->len check (Xie He)  
  - af_packet: TPACKET_V3: fix fill status rwlock imbalance (John Ogness)  
  - crypto: aesni - add compatibility with IAS (Jian Cai)  
  - x86/fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task (Eric Dumazet)  
  - SUNRPC: Fix ("SUNRPC: Add "@len" parameter to gss_unwrap()") (Chuck Lever)  
  - svcrdma: Fix page leak in svc_rdma_recv_read_chunk() (Chuck Lever)  
  - pinctrl-single: fix pcs_parse_pinconf() return value (Drew Fustini)  
  - ocfs2: fix unbalanced locking (Pavel Machek)  
  - dlm: Fix kobject memleak (Wang Hai)  
  - net: thunderx: initialize VF's mailbox mutex before first usage (Dean Nelson)  
  - fsl/fman: fix eth hash table allocation (Florinel Iordache)  
  - fsl/fman: check dereferencing null pointer (Florinel Iordache)  
  - fsl/fman: fix unreachable code (Florinel Iordache)  
  - fsl/fman: fix dereference null return value (Florinel Iordache)  
  - fsl/fman: use 32-bit unsigned integer (Florinel Iordache)  
  - net: spider_net: Fix the size used in a 'dma_free_coherent()' call (Christophe JAILLET)  
  - liquidio: Fix wrong return value in cn23xx_get_pf_num() (Tianjia Zhang)  
  - net: ethernet: aquantia: Fix wrong return value (Tianjia Zhang)  
  - net/mlx5: Delete extra dump stack that gives nothing (Leon Romanovsky)  
  - net/mlx5: DR, Change push vlan action sequence (Alex Vesker)  
  - tools, bpftool: Fix wrong return value in do_dump() (Tianjia Zhang)  
  - tools, build: Propagate build failures from tools/build/Makefile.build (Andrii Nakryiko)  
  - wl1251: fix always return 0 error (Wang Hai)  
  - rtw88: coex: only skip coex triggered by BT info (Yan-Hsuan Chuang)  
  - rtw88: fix short GI capability based on current bandwidth (Tsang-Shian Lin)  
  - rtw88: fix LDPC field for RA info (Tsang-Shian Lin)  
  - ice: Graceful error handling in HW table calloc failure (Surabhi Boob)  
  - s390/qeth: don't process empty bridge port events (Julian Wiedmann)  
  - ASoC: fsl_sai: Fix value of FSL_SAI_CR1_RFW_MASK (Shengjiu Wang)  
  - ASoC: meson: axg-tdm-formatters: fix sclk inversion (Jerome Brunet)  
  - ASoC: meson: axg-tdmin: fix g12a skew (Jerome Brunet)  
  - ASoC: meson: axg-tdm-interface: fix link fmt setup (Jerome Brunet)  
  - selftests/powerpc: Fix online CPU selection (Sandipan Das)  
  - cpufreq: ap806: fix cpufreq driver needs ap cpu clk (Sven Auhagen)  
  - PCI: Release IVRS table in AMD ACS quirk (Hanjun Guo)  
  - RDMA/netlink: Remove CAP_NET_RAW check when dump a raw QP (Mark Zhang)  
  - selftests/powerpc: Fix CPU affinity for child process (Harish)  
  - powerpc/boot: Fix CONFIG_PPC_MPC52XX references (Michael Ellerman)  
  - powerpc/32s: Fix CONFIG_BOOK3S_601 uses (Michael Ellerman)  
  - selftests/powerpc: Squash spurious errors due to device removal (Oliver O'Halloran)  
  - xfs: fix inode allocation block res calculation precedence (Brian Foster)  
  - net: dsa: rtl8366: Fix VLAN set-up (Linus Walleij)  
  - net: dsa: rtl8366: Fix VLAN semantics (Linus Walleij)  
  - Bluetooth: hci_serdev: Only unregister device if it was registered (Nicolas Boichat)  
  - Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags (Nicolas Boichat)  
  - power: supply: check if calc_soc succeeded in pm860x_init_battery (Tom Rix)  
  - Smack: prevent underflow in smk_set_cipso() (Dan Carpenter)  
  - Smack: fix another vsscanf out of bounds (Dan Carpenter)  
  - RDMA/core: Fix return error value in _ib_modify_qp() to negative (Li Heng)  
  - PCI: cadence: Fix updating Vendor ID and Subsystem Vendor ID register (Kishon Vijay Abraham I)  
  - macintosh/via-macii: Access autopoll_devs when inside lock (Finn Thain)  
  - net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration (Chris Packham)  
  - scsi: mesh: Fix panic after host or bus reset (Finn Thain)  
  - scsi: megaraid_sas: Clear affinity hint (Tomas Henzl)  
  - usb: gadget: f_uac2: fix AC Interface Header Descriptor wTotalLength (Ruslan Bilovol)  
  - usb: dwc2: Fix error path in gadget registration (Marek Szyprowski)  
  - MIPS: OCTEON: add missing put_device() call in dwc3_octeon_device_init() (Yu Kuai)  
  - phy: armada-38x: fix NETA lockup when repeatedly switching speeds (Russell King)  
  - mt76: mt7615: fix potential memory leak in mcu message handler (Sean Wang)  
  - powerpc/perf: Fix missing is_sier_aviable() during build (Madhavan Srinivasan)  
  - coresight: tmc: Fix TMC mode read in tmc_read_unprepare_etb() (Sai Prakash Ranjan)  
  - thermal: ti-soc-thermal: Fix reversed condition in ti_thermal_expose_sensor() (Dan Carpenter)  
  - usb: core: fix quirks_param_set() writing to a const pointer (Kars Mulder)  
  - USB: serial: iuu_phoenix: fix led-activity helpers (Johan Hovold)  
  - spi: lantiq-ssc: Fix warning by using WQ_MEM_RECLAIM (Hauke Mehrtens)  
  - gpu: ipu-v3: Restore RGB32, BGR32 (Steve Longerbeam)  
  - drm/imx: tve: fix regulator_disable error path (Marco Felsch)  
  - drm/imx: fix use after free (Philipp Zabel)  
  - powerpc/book3s64/pkeys: Use PVR check instead of cpu feature (Aneesh Kumar K.V)  
  - phy: renesas: rcar-gen3-usb2: move irq registration to init (Yoshihiro Shimoda)  
  - PCI/ASPM: Add missing newline in sysfs 'policy' (Xiongfeng Wang)  
  - ASoC: meson: fixes the missed kfree() for axg_card_add_tdm_loopback (Jing Xiangfeng)  
  - staging: rtl8192u: fix a dubious looking mask before a shift (Colin Ian King)  
  - ima: Have the LSM free its audit rule (Tyler Hicks)  
  - RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue (Mikhail Malygin)  
  - RDMA/qedr: SRQ's bug fixes (Yuval Basson)  
  - powerpc/vdso: Fix vdso cpu truncation (Milton Miller)  
  - powerpc/rtas: don't online CPUs for partition suspend (Nathan Lynch)  
  - kernfs: do not call fsnotify() with name without a parent (Amir Goldstein)  
  - mwifiex: Prevent memory corruption handling keys (Dan Carpenter)  
  - scsi: scsi_debug: Add check for sdebug_max_queue during module init (John Garry)  
  - drm/bridge: sil_sii8620: initialize return of sii8620_readb (Tom Rix)  
  - phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY (Marek Szyprowski)  
  - drm: panel: simple: Fix bpc for LG LB070WV8 panel (Laurent Pinchart)  
  - leds: core: Flush scheduled work for system suspend (Kai-Heng Feng)  
  - kobject: Avoid premature parent object freeing in kobject_cleanup() (Heikki Krogerus)  
  - drm/stm: repair runtime power management (Marek Vasut)  
  - PCI: Fix pci_cfg_wait queue locking problem (Bjorn Helgaas)  
  - RDMA/rxe: Skip dgid check in loopback mode (Zhu Yanjun)  
  - xfs: fix reflink quota reservation accounting error (Darrick J. Wong)  
  - xfs: don't eat an EIO/ENOSPC writeback error when scrubbing data fork (Darrick J. Wong)  
  - media: cros-ec-cec: do not bail on device_init_wakeup failure (Dariusz Marcinkiewicz)  
  - media: exynos4-is: Add missed check for pinctrl_lookup_state() (Chuhong Yuan)  
  - media: firewire: Using uninitialized values in node_probe() (Dan Carpenter)  
  - ipvs: allow connection reuse for unconfirmed conntrack (Julian Anastasov)  
  - scsi: eesox: Fix different dev_id between request_irq() and free_irq() (Christophe JAILLET)  
  - scsi: powertec: Fix different dev_id between request_irq() and free_irq() (Christophe JAILLET)  
  - RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued() (Jason Gunthorpe)  
  - iavf: Fix updating statistics (Tony Nguyen)  
  - iavf: fix error return code in iavf_init_get_resources() (Wei Yongjun)  
  - staging: vchiq_arm: Add a matching unregister call (Phil Elwell)  
  - drm/radeon: fix array out-of-bounds read and write issues (Colin Ian King)  
  - cxl: Fix kobject memleak (Wang Hai)  
  - drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline (Emil Velikov)  
  - scsi: cumana_2: Fix different dev_id between request_irq() and free_irq() (Christophe JAILLET)  
  - ASoC: Intel: bxt_rt298: add missing .owner field (Pierre-Louis Bossart)  
  - ASoC: SOF: nocodec: add missing .owner field (Pierre-Louis Bossart)  
  - media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities() (Chuhong Yuan)  
  - media: marvell-ccic: Add missed v4l2_async_notifier_cleanup() (Chuhong Yuan)  
  - media: cxusb-analog: fix V4L2 dependency (Arnd Bergmann)  
  - Bluetooth: btmtksdio: fix up firmware download sequence (Sean Wang)  
  - Bluetooth: btusb: fix up firmware download sequence (Sean Wang)  
  - leds: lm355x: avoid enum conversion warning (Arnd Bergmann)  
  - clk: bcm63xx-gate: fix last clock availability (Álvaro Fernández Rojas)  
  - drm/arm: fix unintentional integer overflow on left shift (Colin Ian King)  
  - drm/etnaviv: Fix error path on failure to enable bus clk (Lubomir Rintel)  
  - iio: improve IIO_CONCENTRATION channel type description (Tomasz Duszynski)  
  - ath10k: Acquire tx_lock in tx error paths (Evan Green)  
  - video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call (Christophe JAILLET)  
  - console: newport_con: fix an issue about leak related system resources (Dejin Zheng)  
  - video: fbdev: sm712fb: fix an issue about iounmap for a wrong address (Dejin Zheng)  
  - btmrvl: Fix firmware filename for sd8997 chipset (Pali Rohár)  
  - btmrvl: Fix firmware filename for sd8977 chipset (Pali Rohár)  
  - mwifiex: Fix firmware filename for sd8997 chipset (Pali Rohár)  
  - mwifiex: Fix firmware filename for sd8977 chipset (Pali Rohár)  
  - agp/intel: Fix a memory leak on module initialisation failure (Qiushi Wu)  
  - drm/bridge: ti-sn65dsi86: Clear old error bits before AUX transfers (Douglas Anderson)  
  - drm/gem: Fix a leak in drm_gem_objects_lookup() (Dan Carpenter)  
  - drm/msm: ratelimit crtc event overflow error (Rob Clark)  
  - ACPICA: Do not increment operation_region reference counts for field units (Erik Kaneda)  
  - bcache: fix super block seq numbers comparision in register_cache_set() (Coly Li)  
  - dyndbg: fix a BUG_ON in ddebug_describe_flags (Jim Cromie)  
  - usb: bdc: Halt controller on suspend (Danesh Petigara)  
  - bdc: Fix bug causing crash after multiple disconnects (Sasi Kumar)  
  - usb: gadget: net2280: fix memory leak on probe error handling paths (Evgeny Novikov)  
  - mmc: sdhci-pci-o2micro: Bug fix for O2 host controller Seabird1 (shirley her)  
  - ionic: update eid test for overflow (Shannon Nelson)  
  - gpu: host1x: debug: Fix multiple channels emitting messages simultaneously (Dmitry Osipenko)  
  - iwlegacy: Check the return value of pcie_capability_read_*() (Bolarinwa Olayemi Saheed)  
  - platform/x86: asus-nb-wmi: add support for ASUS ROG Zephyrus G14 and G15 (Armas Spann)  
  - brcmfmac: set state of hanger slot to FREE when flushing PSQ (Wright Feng)  
  - brcmfmac: To fix Bss Info flag definition Bug (Prasanna Kerekoppa)  
  - brcmfmac: keep SDIO watchdog running when console_interval is non-zero (Wright Feng)  
  - bpf: Fix fds_example SIGSEGV error (Wenbo Zhang)  
  - drm/amd/powerplay: fix compile error with ARCH=arc (Evan Quan)  
  - drm/amdgpu/display bail early in dm_pp_get_static_clocks (Alex Deucher)  
  - mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls (Paul E. McKenney)  
  - irqchip/irq-mtk-sysirq: Replace spinlock with raw_spinlock (Bartosz Golaszewski)  
  - drm/radeon: disable AGP by default (Christian König)  
  - drm/debugfs: fix plain echo to connector "force" attribute (Michael Tretter)  
  - drm/msm: Fix a null pointer access in msm_gem_shrinker_count() (Akhil P Oommen)  
  - drm: msm: a6xx: fix gpu failure after system resume (Akhil P Oommen)  
  - usb: mtu3: clear dual mode of u3port when disable device (Chunfeng Yun)  
  - btrfs: fix lockdep splat from btrfs_dump_space_info (Josef Bacik)  
  - mmc: sdhci-cadence: do not use hardware tuning for SD mode (Masahiro Yamada)  
  - drm/nouveau: fix multiple instances of reference count leaks (Aditya Pakki)  
  - drm/nouveau: fix reference count leak in nouveau_debugfs_strap_peek (Aditya Pakki)  
  - drm/etnaviv: fix ref count leak via pm_runtime_get_sync (Navid Emamdoost)  
  - arm64: dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT binding (Ricardo Cañuelo)  
  - drm/nouveau/kms/nv50-: Fix disabling dithering (Lyude Paul)  
  - md-cluster: fix wild pointer of unlock_all_bitmaps() (Zhao Heming)  
  - bus: ti-sysc: Add missing quirk flags for usb_host_hs (Tony Lindgren)  
  - video: fbdev: neofb: fix memory leak in neo_scan_monitor() (Evgeny Novikov)  
  - video: fbdev: savage: fix memory leak on error handling path in probe (Evgeny Novikov)  
  - crypto: aesni - Fix build with LLVM_IAS=1 (Sedat Dilek)  
  - drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync (Aditya Pakki)  
  - drm/amdgpu: avoid dereferencing a NULL pointer (Jack Xiao)  
  - fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls (Paul E. McKenney)  
  - loop: be paranoid on exit and prevent new additions / removals (Luis Chamberlain)  
  - Bluetooth: add a mutex lock to avoid UAF in do_enale_set (Lihong Kou)  
  - soc: qcom: rpmh-rsc: Set suppress_bind_attrs flag (Maulik Shah)  
  - drm/tilcdc: fix leak & null ref in panel_connector_get_modes (Tomi Valkeinen)  
  - nvme-multipath: do not fall back to __nvme_find_path() for non-optimized paths (Hannes Reinecke)  
  - nvme-multipath: fix logic for non-optimized paths (Martin Wilck)  
  - nvme-rdma: fix controller reset hang during traffic (Sagi Grimberg)  
  - nvme-tcp: fix controller reset hang during traffic (Sagi Grimberg)  
  - md: raid0/linear: fix dereference before null check on pointer mddev (Colin Ian King)  
  - seccomp: Fix ioctl number for SECCOMP_IOCTL_NOTIF_ID_VALID (Kees Cook)  
  - irqchip/ti-sci-inta: Fix return value about devm_ioremap_resource() (Tiezhu Yang)  
  - iocost: Fix check condition of iocg abs_vdebt (Chengming Zhou)  
  - ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh() (Yu Kuai)  
  - spi: rockchip: Fix error in SPI slave pio read (Jon Lin)  
  - io_uring: fix sq array offset calculation (Dmitry Vyukov)  
  - regulator: fix memory leak on error path of regulator_register() (Vladimir Zapolskiy)  
  - recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64. (Gregory Herrero)  
  - tpm: Require that all digests are present in TCG_PCR_EVENT2 structures (Tyler Hicks)  
  - spi: lantiq: fix: Rx overflow error in full duplex mode (Dilip Kota)  
  - ARM: dts: sunxi: bananapi-m2-plus-v1.2: Fix CPU supply voltages (Chen-Yu Tsai)  
  - ARM: dts: sunxi: bananapi-m2-plus-v1.2: Add regulator supply to all CPU cores (Chen-Yu Tsai)  
  - ARM: at91: pm: add missing put_device() call in at91_pm_sram_init() (yu kuai)  
  - ARM: dts: gose: Fix ports node name for adv7612 (Niklas Söderlund)  
  - ARM: dts: gose: Fix ports node name for adv7180 (Niklas Söderlund)  
  - platform/x86: intel-vbtn: Fix return value check in check_acpi_dev() (Lu Wei)  
  - platform/x86: intel-hid: Fix return value check in check_acpi_dev() (Lu Wei)  
  - m68k: mac: Fix IOP status/control register writes (Finn Thain)  
  - m68k: mac: Don't send IOP message until channel is idle (Finn Thain)  
  - clk: scmi: Fix min and max rate when registering clocks with discrete rates (Sudeep Holla)  
  - sched/uclamp: Fix initialization of struct uclamp_rq (Qais Yousef)  
  - arm64: dts: exynos: Fix silent hang after boot on Espresso (Alim Akhtar)  
  - firmware: arm_scmi: Fix SCMI genpd domain probing (Cristian Marussi)  
  - ARM: exynos: MCPM: Restore big.LITTLE cpuidle support (Marek Szyprowski)  
  - crypto: ccree - fix resource leak on error path (Gilad Ben-Yossef)  
  - blktrace: fix debugfs use after free (Luis Chamberlain)   {CVE-2019-19770}
  - arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property (Stephan Gerhold)  
  - crc-t10dif: Fix potential crypto notify dead-lock (Herbert Xu)  
  - EDAC: Fix reference count leaks (Qiushi Wu)  
  - arm64: dts: rockchip: fix rk3399-puma gmac reset gpio (Heiko Stuebner)  
  - arm64: dts: rockchip: fix rk3399-puma vcc5v0-host gpio (Heiko Stuebner)  
  - arm64: dts: rockchip: fix rk3368-lion gmac reset gpio (Heiko Stuebner)  
  - sched: correct SD_flags returned by tl->sd_flags() (Peng Liu)  
  - sched/fair: Fix NOHZ next idle balance (Vincent Guittot)  
  - x86/mce/inject: Fix a wrong assignment of i_mce.status (Zhenzhong Duan)  
  - clk: qcom: clk-rpmh: Wait for completion when enabling clocks (Mike Tipton)  
  - fs/io_uring.c: Fix uninitialized variable is referenced in io_submit_sqe (Liu Yong)  
  - nvme: add a Identify Namespace Identification Descriptor list quirk (Christoph Hellwig)  
  - HID: input: Fix devices that return multiple bytes in battery report (Grant Likely)  
  - tracepoint: Mark __tracepoint_string's __used (Nick Desaulniers)  
  - uek-rpm: Enable CONFIG_EDAC_I10NM (Thomas Tai)  [Orabug: 31644938] 
  - EDAC/i10nm: Update driver to support different bus number config register offsets (Qiuxu Zhuo)  [Orabug: 31644938] 
  - EDAC, {skx,i10nm}: Make some configurations CPU model specific (Qiuxu Zhuo)  [Orabug: 31644938] 
  - EDAC: Convert to new X86 CPU match macros (Thomas Gleixner)  [Orabug: 31644938] 
  - arm64/dts: Serial console fix for RPi4 (Vijay Kumar)  [Orabug: 31747726] 
  - md: get sysfs entry after redundancy attr group create (Junxiao Bi)  [Orabug: 31682031] 
  - md: fix deadlock causing by sysfs_notify (Junxiao Bi)  [Orabug: 31682031]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.el8
changelog:
  - RDMA/bnxt_re: Do not add user qps to flushlist (Selvin Xavier)  [Orabug: 31820672] 
  - RDMA/bnxt_re: Update maintainers for Broadcom rdma driver (Devesh Sharma)  [Orabug: 31820672] 
  - RDMA/bnxt_re: Change wr posting logic to accommodate variable wqes (Devesh Sharma)  [Orabug: 31820672] 
  - RDMA/bnxt_re: Add helper data structures (Devesh Sharma)  [Orabug: 31820672] 
  - RDMA/bnxt_re: Pull psn buffer dynamically based on prod (Devesh Sharma)  [Orabug: 31820672] 
  - RDMA/bnxt_re: introduce a function to allocate swq (Devesh Sharma)  [Orabug: 31820672] 
  - RDMA/bnxt_re: introduce wqe mode to select execution path (Devesh Sharma)  [Orabug: 31820672] 
  - RDMA/cm: Protect access to remote_sidr_table (Maor Gottlieb)  [Orabug: 31784883] 
  - RDMA/cm: Fix missing RDMA_CM_EVENT_REJECTED event after receiving REJ message (Leon Romanovsky)  [Orabug: 31784651] 
  - sample-trace-array: Fix sleeping function called from invalid context (Kefeng Wang)  [Orabug: 31712849] 
  - sample-trace-array: Remove trace_array 'sample-instance' (Kefeng Wang)  [Orabug: 31712849] 
  - tracing: Sample module to demonstrate kernel access to Ftrace instances. (Divya Indi)  [Orabug: 31712849] 
  - tracing: Adding new functions for kernel access to Ftrace instances (Aruna Ramakrishna)  [Orabug: 31712849] 
  - tracing: Adding NULL checks for trace_array descriptor pointer (Divya Indi)  [Orabug: 31712849] 
  - tracing: Verify if trace array exists before destroying it. (Divya Indi)  [Orabug: 31712849] 
  - tracing: Declare newly exported APIs in include/linux/trace.h (Divya Indi)  [Orabug: 31712849] 
  - sched/core: cleanup kABI for struct rq (chris hyser)  [Orabug: 31776423] 
  - Revert "scsi: qla2xxx: Disable T10-DIF feature with FC-NVMe during probe" (Quinn Tran)  [Orabug: 31798223] 
  - Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" (Saurav Kashyap)  [Orabug: 31798223] 
  - scsi: qla2xxx: Fix null pointer access during disconnect from subsystem (Quinn Tran)  [Orabug: 31798223] 
  - scsi: qla2xxx: Check if FW supports MQ before enabling (Saurav Kashyap)  [Orabug: 31798223] 
  - scsi: qla2xxx: Fix WARN_ON in qla_nvme_register_hba (Arun Easi)  [Orabug: 31798223] 
  - scsi: qla2xxx: Allow ql2xextended_error_logging special value 1 to be set anytime (Arun Easi)  [Orabug: 31798223] 
  - scsi: qla2xxx: Reduce noisy debug message (Quinn Tran)  [Orabug: 31798223] 
  - scsi: qla2xxx: Fix login timeout (Quinn Tran)  [Orabug: 31798223] 
  - scsi: qla2xxx: Indicate correct supported speeds for Mezz card (Quinn Tran)  [Orabug: 31798223] 
  - scsi: qla2xxx: Flush I/O on zone disable (Quinn Tran)  [Orabug: 31798223] 
  - scsi: qla2xxx: Flush all sessions on zone disable (Quinn Tran)  [Orabug: 31798223] 
  - scsi: qla2xxx: Use MBX_TOV_SECONDS for mailbox command timeout values (Enzo Matsumiya)  [Orabug: 31798223] 
  - rename kABI whitelists to lockedlists (Dan Duval)  [Orabug: 31783145] 
  - x86/vmlinux: Restore "text" Program Header with dummy section (Kees Cook)  [Orabug: 31781680] 
  - bnxt: don't enable NAPI until rings are ready (Jakub Kicinski)  [Orabug: 31541567] 
  - bnxt_en: Setup default RSS map in all scenarios. (Michael Chan)  [Orabug: 31541567] 
  - bnxt_en: init RSS table for Minimal-Static VF reservation (Edwin Peer)  [Orabug: 31541567] 
  - bnxt_en: fix HWRM error when querying VF temperature (Edwin Peer)  [Orabug: 31541567] 
  - bnxt_en: Fix possible crash in bnxt_fw_reset_task(). (Michael Chan)  [Orabug: 31541567] 
  - bnxt_en: Fix PCI AER error recovery flow (Vasundhara Volam)  [Orabug: 31541567] 
  - bnxt_en: Fix ethtool -S statitics with XDP or TCs enabled. (Michael Chan)  [Orabug: 31541567] 
  - bnxt_en: Check for zero dir entries in NVRAM. (Vasundhara Volam)  [Orabug: 31541567] 
  - bnxt_en: Don't query FW when netif_running() is false. (Pavan Chebbi)  [Orabug: 31541567] 
  - bnxt_en: Remove superfluous memset() (Li Heng)  [Orabug: 31541567] 
  - bnxt_en: Add support for 'ethtool -d' (Vasundhara Volam)  [Orabug: 31541567] 
  - bnxt_en: Switch over to use the 64-bit software accumulated counters. (Michael Chan)  [Orabug: 31541567] 
  - bnxt_en: Accumulate all counters. (Michael Chan)  [Orabug: 31541567] 
  - bnxt_en: Retrieve hardware masks for port counters. (Michael Chan)  [Orabug: 31541567] 
  - bnxt_en: Retrieve hardware counter masks from firmware if available. (Michael Chan)  [Orabug: 31541567] 
  - bnxt_en: Allocate additional memory for all statistics blocks. (Michael Chan)  [Orabug: 31541567] 
  - bnxt_en: Refactor statistics code and structures. (Michael Chan)  [Orabug: 31541567] 
  - bnxt_en: Use macros to define port statistics size and offset. (Michael Chan)  [Orabug: 31541567] 
  - bnxt_en: Update firmware interface to 1.10.1.54. (Michael Chan)  [Orabug: 31541567] 
  - bnxt_en: Remove PCIe non-counters from ethtool statistics (Vasundhara Volam)  [Orabug: 31541567] 
  - bnxt_en: Init ethtool link settings after reading updated PHY configuration. (Vasundhara Volam)  [Orabug: 31541567] 
  - bnxt_en: Fix AER reset logic on 57500 chips. (Michael Chan)  [Orabug: 31541567] 
  - bnxt_en: Re-enable SRIOV during resume. (Michael Chan)  [Orabug: 31541567] 
  - bnxt_en: Simplify bnxt_resume(). (Michael Chan)  [Orabug: 31541567] 
  - bnxt_en: Fix return code to "flash_device". (Vasundhara Volam)  [Orabug: 31541567] 
  - bnxt_en: Call devlink_port_type_clear() in remove() (Vasundhara Volam)  [Orabug: 31541567] 
  - bnxt_en: Return -EAGAIN if fw command returns BUSY (Vasundhara Volam)  [Orabug: 31541567] 
  - bnxt_en: Register devlink irrespective of firmware spec version (Vasundhara Volam)  [Orabug: 31541567] 
  - bnxt_en: Refactor bnxt_dl_register() (Vasundhara Volam)  [Orabug: 31541567] 
  - bnxt_en: Improve bnxt_probe_phy(). (Michael Chan)  [Orabug: 31541567] 
  - rcu: Upgrade rcu_swap_protected() to rcu_replace_pointer() (Paul E. McKenney)  [Orabug: 31474973] 
  - nvme: explicitly update mpath disk capacity on revalidation (Anthony Iliopoulos)  [Orabug: 31474973] 
  - nvme: fix possible deadlock when I/O is blocked (Sagi Grimberg)  [Orabug: 31474973] 
  - nvmet: fail outstanding host posted AEN req (Chaitanya Kulkarni)  [Orabug: 31474973] 
  - nvmet: cleanups the loop in nvmet_async_events_process (David Milburn)  [Orabug: 31474973] 
  - nvme-fc: don't call nvme_cleanup_cmd() for AENs (Daniel Wagner)  [Orabug: 31474973] 
  - nvmet: fix memory leak when removing namespaces and controllers concurrently (Sagi Grimberg)  [Orabug: 31474973] 
  - nvme-pci: make sure write/poll_queues less or equal then cpu count (Weiping Zhang)  [Orabug: 31474973] 
  - nvme-fc: avoid gcc-10 zero-length-bounds warning (Arnd Bergmann)  [Orabug: 31474973] 
  - nvme-pci: avoid race between nvme_reap_pending_cqes() and nvme_poll() (Dongli Zhang)  [Orabug: 31474973] 
  - nvme-pci: dma read memory barrier for completions (Keith Busch)  [Orabug: 31474973] 
  - nvme-pci: fix "slimmer CQ head update" (Alexey Dobriyan)  [Orabug: 31474973] 
  - nvmet-rdma: fix double free of rdma queue (Israel Rukshin)  [Orabug: 31474973] 
  - nvmet-rdma: fix bonding failover possible NULL deref (Sagi Grimberg)  [Orabug: 31474973] 
  - nvmet: fix NULL dereference when removing a referral (Sagi Grimberg)  [Orabug: 31474973] 
  - nvme: inherit stable pages constraint in the mpath stack device (Sagi Grimberg)  [Orabug: 31474973] 
  - nvme-tcp: fix possible crash in recv error flow (Sagi Grimberg)  [Orabug: 31474973] 
  - nvme-tcp: don't poll a non-live queue (Sagi Grimberg)  [Orabug: 31474973] 
  - nvmet-fc: fix typo in comment (James Smart)  [Orabug: 31474973] 
  - nvme-rdma: Replace comma with a semicolon (Israel Rukshin)  [Orabug: 31474973] 
  - nvme-fcloop: fix deallocation of working context (James Smart)  [Orabug: 31474973] 
  - nvme: cleanup namespace identifier reporting in nvme_init_ns_head (Christoph Hellwig)  [Orabug: 31474973] 
  - nvme: rename __nvme_find_ns_head to nvme_find_ns_head (Christoph Hellwig)  [Orabug: 31474973] 
  - nvme-tcp: Add warning on state change failure at nvme_tcp_setup_ctrl (Israel Rukshin)  [Orabug: 31474973] 
  - nvme-rdma: Add warning on state change failure at nvme_rdma_setup_ctrl (Israel Rukshin)  [Orabug: 31474973] 
  - nvme: Fix controller creation races with teardown flow (Israel Rukshin)  [Orabug: 31474973] 
  - nvme: Make nvme_uninit_ctrl symmetric to nvme_init_ctrl (Israel Rukshin)  [Orabug: 31474973] 
  - nvme: Fix ctrl use-after-free during sysfs deletion (Israel Rukshin)  [Orabug: 31474973] 
  - nvme-pci: Re-order nvme_pci_free_ctrl (Israel Rukshin)  [Orabug: 31474973] 
  - nvme: Remove unused return code from nvme_delete_ctrl_sync (Israel Rukshin)  [Orabug: 31474973] 
  - nvme: Use nvme_state_terminal helper (Israel Rukshin)  [Orabug: 31474973] 
  - nvme: release ida resources (Max Gurtovoy)  [Orabug: 31474973] 
  - nvme: Add compat_ioctl handler for NVME_IOCTL_SUBMIT_IO (masahiro31.yamada@kioxia.com)  [Orabug: 31474973] 
  - nvmet-tcp: optimize tcp stack TX when data digest is used (Sagi Grimberg)  [Orabug: 31474973] 
  - nvme-fabrics: Use scnprintf() for avoiding potential buffer overflow (Takashi Iwai)  [Orabug: 31474973] 
  - nvme-multipath: do not reset on unknown status (John Meneghini)  [Orabug: 31474973] 
  - nvmet-rdma: allocate RW ctxs according to mdts (Max Gurtovoy)  [Orabug: 31474973] 
  - nvmet-rdma: Implement get_mdts controller op (Max Gurtovoy)  [Orabug: 31474973] 
  - nvmet: Add get_mdts op for controllers (Max Gurtovoy)  [Orabug: 31474973] 
  - nvme-pci: properly print controller address (Max Gurtovoy)  [Orabug: 31474973] 
  - nvme-tcp: break from io_work loop if recv failed (Sagi Grimberg)  [Orabug: 31474973] 
  - nvme-tcp: move send failure to nvme_tcp_try_send (Sagi Grimberg)  [Orabug: 31474973] 
  - nvme-tcp: optimize queue io_cpu assignment for multiple queue maps (Sagi Grimberg)  [Orabug: 31474973] 
  - nvme-pci: Simplify nvme_poll_irqdisable (Keith Busch)  [Orabug: 31474973] 
  - nvme-pci: Remove two-pass completions (Keith Busch)  [Orabug: 31474973] 
  - nvme-pci: Remove tag from process cq (Keith Busch)  [Orabug: 31474973] 
  - nvme-pci: slimmer CQ head update (Alexey Dobriyan)  [Orabug: 31474973] 
  - nvmet: check ncqr & nsqr for set-features cmd (Amit Engel)  [Orabug: 31474973] 
  - nvme: Check for readiness more quickly, to speed up boot time (Josh Triplett)  [Orabug: 31474973] 
  - nvme: log additional message for controller status (Rupesh Girase)  [Orabug: 31474973] 
  - nvme: code cleanup nvme_identify_ns_desc() (Chaitanya Kulkarni)  [Orabug: 31474973] 
  - nvme: Don't deter users from enabling hwmon support (Jean Delvare)  [Orabug: 31474973] 
  - nvme: expose hostid via sysfs for fabrics controllers (Sagi Grimberg)  [Orabug: 31474973] 
  - nvme: expose hostnqn via sysfs for fabrics controllers (Sagi Grimberg)  [Orabug: 31474973] 
  - nvmet-tcp: set SO_PRIORITY for accepted sockets (Wunderlich, Mark)  [Orabug: 31474973] 
  - nvme-tcp: Set SO_PRIORITY for all host sockets (Wunderlich, Mark)  [Orabug: 31474973] 
  - nvmet: check sscanf value for subsys serial attr (Chaitanya Kulkarni)  [Orabug: 31474973] 
  - nvmet: make ctrl model configurable (Mark Ruijter)  [Orabug: 31474973] 
  - nvmet: make ctrl-id configurable (Chaitanya Kulkarni)  [Orabug: 31474973] 
  - nvmet: configfs code cleanup (Chaitanya Kulkarni)  [Orabug: 31474973] 
  - nvme: remove unused return code from nvme_alloc_ns (Edmund Nadolski)  [Orabug: 31474973] 
  - scsi: lpfc: Update lpfc version to 12.8.0.3 (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix LUN loss after cable pull (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix validation of bsg reply lengths (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix retry of PRLI when status indicates its unsupported (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix oops when unloading driver while running mds diags (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix RSCN timeout due to incorrect gidft counter (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Add missing misc_deregister() for lpfc_init() (Jing Xiangfeng)  [Orabug: 31793335] 
  - scsi: lpfc: Fix no message shown for lpfc_hdw_queue out of range value (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix FCoE speed reporting (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix typo in comment for ULP (Ferruh Yigit)  [Orabug: 31793335] 
  - scsi: lpfc: Add description for lpfc_release_rpi()'s 'ndlpl param (Lee Jones)  [Orabug: 31793335] 
  - scsi: lpfc: Fix a bunch of kerneldoc misdemeanors (Lee Jones)  [Orabug: 31793335] 
  - scsi: lpfc: Add and rename a whole bunch of function parameter descriptions (Lee Jones)  [Orabug: 31793335] 
  - scsi: lpfc: Fix kerneldoc parameter formatting/misnaming/missing issues (Lee Jones)  [Orabug: 31793335] 
  - scsi: lpfc: Fix some function parameter descriptions (Lee Jones)  [Orabug: 31793335] 
  - scsi: lpfc: Ensure variable has the same stipulations as code using it (Lee Jones)  [Orabug: 31793335] 
  - scsi: lpfc: Fix-up formatting/docrot where appropriate (Lee Jones)  [Orabug: 31793335] 
  - scsi: lpfc: Provide description for lpfc_mem_alloc()'s 'align' param (Lee Jones)  [Orabug: 31793335] 
  - scsi: lpfc: Remove unused variable 'pg_addr' (Lee Jones)  [Orabug: 31793335] 
  - scsi: lpfc: NVMe remote port devloss_tmo from lldd (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Quieten some printks (Anton Blanchard)  [Orabug: 31793335] 
  - scsi: lpfc: Fix interrupt assignments when multiple vectors are supported on same CPU (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix inconsistent indenting (Colin Ian King)  [Orabug: 31793335] 
  - scsi: lpfc: Update lpfc version to 12.8.0.2 (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Add blk_io_poll support for latency improvment (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Add support to display if adapter dumps are available (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Allow applications to issue Common Set Features mailbox command (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix language in 0373 message to reflect non-error message (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix kdump hang on PPC (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix shost refcount mismatch when deleting vport (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix stack trace seen while setting rrq active (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix oops due to overrun when reading SLI3 data (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix NVMe rport deregister and registration during ADISC (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix missing MDS functionality (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix unused assignment in lpfc_sli4_bsg_link_diag_test (Dick Kennedy)  [Orabug: 31793335] 
  - lpfc_debugfs: get rid of pointless access_ok() (Al Viro)  [Orabug: 31793335] 
  - scsi: lpfc: Update lpfc version to 12.8.0.1 (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix MDS Diagnostic Enablement definition (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Fix noderef and address space warnings (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Remove unnecessary lockdep_assert_held calls (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Change default queue allocation for reduced memory consumption (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Remove re-binding of nvme rport during registration (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Maintain atomic consistency of queue_claimed flag (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: remove duplicate unloading checks (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Change default SCSI LUN QD to 64 (Dick Kennedy)  [Orabug: 31793335] 
  - scsi: lpfc: Update lpfc version to 12.8.0.0 (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Remove prototype FIPS/DSS options from SLI-3 (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Make debugfs ktime stats generic for NVME and SCSI (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Fix erroneous cpu limit of 128 on I/O statistics (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Fix update of wq consumer index in lpfc_sli4_wq_release (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Fix scsi host template for SLI3 vports (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Fix lpfc overwrite of sg_cnt field in nvmefc_tgt_fcp_req (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Fix lockdep error - register non-static key (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: fix spelling mistake "Notication" -> "Notification" (Colin Ian King)  [Orabug: 31793335] 
  - scsi: lpfc: add RDF registration and Link Integrity FPIN logging (James Smart)  [Orabug: 31793335] 
  - scsi: fc: Update Descriptor definition and add RDF and Link Integrity FPINs (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Copyright updates for 12.6.0.4 patches (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Update lpfc version to 12.6.0.4 (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Clean up hba max_lun_queue_depth checks (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Remove handler for obsolete ELS - Read Port Status (RPS) (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Fix coverity errors in fmdi attribute handling (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Fix compiler warning on frame size (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Fix release of hwq to clear the eq relationship (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Fix registration of ELS type support in fdmi (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Fix RQ buffer leakage when no IOCBs available (James Smart)  [Orabug: 31793335] 
  - scsi: lpfc: Make lpfc_defer_acc_rsp static (YueHaibing)  [Orabug: 31793335] 
  - Linux 5.4.61 (Greg Kroah-Hartman)  
  - KVM: arm64: Only reschedule if MMU_NOTIFIER_RANGE_BLOCKABLE is not set (Will Deacon)  
  - KVM: Pass MMU notifier range flags to kvm_unmap_hva_range() (Will Deacon)  
  - xen: don't reschedule in preemption off sections (Juergen Gross)  
  - mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible (Peter Xu)  
  - do_epoll_ctl(): clean the failure exits up a bit (Al Viro)  
  - epoll: Keep a reference on files added to the check list (Marc Zyngier)  
  - efi: add missed destroy_workqueue when efisubsys_init fails (Li Heng)  
  - powerpc/pseries: Do not initiate shutdown when system is running on UPS (Vasant Hegde)  
  - net: dsa: b53: check for timeout (Tom Rix)  
  - hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit() (Haiyang Zhang)  
  - net: gemini: Fix missing free_netdev() in error path of gemini_ethernet_port_probe() (Wang Hai)  
  - net: ena: Prevent reset after device destruction (Shay Agroskin)  
  - bonding: fix active-backup failover for current ARP slave (Jiri Wiesner)  
  - ARM64: vdso32: Install vdso32 from vdso_install (Stephen Boyd)  
  - afs: Fix NULL deref in afs_dynroot_depopulate() (David Howells)  
  - Fix build error when CONFIG_ACPI is not set/enabled: (Randy Dunlap)  
  - efi: avoid error message when booting under Xen (Juergen Gross)  
  - kconfig: qconf: fix signal connection to invalid slots (Masahiro Yamada)  
  - kconfig: qconf: do not limit the pop-up menu to the first row (Masahiro Yamada)  
  - kvm: x86: Toggling CR4.PKE does not load PDPTEs in PAE mode (Jim Mattson)  
  - kvm: x86: Toggling CR4.SMAP does not load PDPTEs in PAE mode (Jim Mattson)  
  - vfio/type1: Add proper error unwind for vfio_iommu_replay() (Alex Williamson)  
  - ASoC: intel: Fix memleak in sst_media_open (Dinghao Liu)  
  - ASoC: msm8916-wcd-analog: fix register Interrupt offset (Srinivas Kandagatla)  
  - s390/ptrace: fix storage key handling (Heiko Carstens)  
  - s390/runtime_instrumentation: fix storage key handling (Heiko Carstens)  
  - bonding: fix a potential double-unregister (Cong Wang)  
  - can: j1939: add rxtimer for multipacket broadcast session (Zhang Changzhong)  
  - can: j1939: abort multipacket broadcast session when timeout occurs (Zhang Changzhong)  
  - can: j1939: cancel rxtimer on multipacket broadcast session complete (Zhang Changzhong)  
  - can: j1939: fix support for multipacket broadcast message (Zhang Changzhong)  
  - bonding: show saner speed for broadcast mode (Jarod Wilson)  
  - net: fec: correct the error path for regulator disable in probe (Fugang Duan)  
  - i40e: Fix crash during removing i40e driver (Grzegorz Szczurek)  
  - i40e: Set RX_ONLY mode for unicast promiscuous on VLAN (Przemyslaw Patynowski)  
  - can: j1939: transport: add j1939_session_skb_find_by_offset() function (Oleksij Rempel)  
  - can: j1939: transport: j1939_simple_recv(): ignore local J1939 messages send not by J1939 stack (Oleksij Rempel)  
  - can: j1939: fix kernel-infoleak in j1939_sk_sock2sockaddr_can() (Eric Dumazet)  
  - bpf: sock_ops sk access may stomp registers when dst_reg = src_reg (John Fastabend)  
  - ASoC: q6routing: add dummy register read/write function (Srinivas Kandagatla)  
  - ASoC: q6afe-dai: mark all widgets registers as SND_SOC_NOPM (Srinivas Kandagatla)  
  - spi: stm32: fixes suspend/resume management (Amelie Delaunay)  
  - netfilter: nf_tables: nft_exthdr: the presence return value should be little-endian (Stephen Suryaputra)  
  - ext4: don't allow overlapping system zones (Jan Kara)  
  - ext4: fix potential negative array index in do_split() (Eric Sandeen)  
  - fs/signalfd.c: fix inconsistent return codes for signalfd4 (Helge Deller)  
  - alpha: fix annotation of io{read,write}{16,32}be() (Luc Van Oostenryck)  
  - xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init (Eiichi Tsukata)  
  - tools/testing/selftests/cgroup/cgroup_util.c: cg_read_strcmp: fix null pointer dereference (Gaurav Singh)  
  - media: camss: fix memory leaks on error handling paths in probe (Evgeny Novikov)  
  - virtio_ring: Avoid loop when vq is broken in virtqueue_poll (Mao Wenan)  
  - scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases (Javed Hasan)  
  - cpufreq: intel_pstate: Fix cpuinfo_max_freq when MSR_TURBO_RATIO_LIMIT is 0 (Srinivas Pandruvada)  
  - swiotlb-xen: use vmalloc_to_page on vmalloc virt addresses (Boris Ostrovsky)  
  - ceph: fix use-after-free for fsc->mdsc (Xiubo Li)  
  - jffs2: fix UAF problem (Zhe Li)  
  - drm/ttm: fix offset in VMAs with a pg_offs in ttm_bo_vm_access (Felix Kuehling)  
  - xfs: fix inode quota reservation checks (Darrick J. Wong)  
  - svcrdma: Fix another Receive buffer leak (Chuck Lever)  
  - m68knommu: fix overwriting of bits in ColdFire V3 cache control (Greg Ungerer)  
  - MIPS: Fix unable to reserve memory for Crash kernel (Jinyang He)  
  - Input: psmouse - add a newline when printing 'proto' by sysfs (Xiongfeng Wang)  
  - media: vpss: clean up resources in init (Evgeny Novikov)  
  - rtc: goldfish: Enable interrupt in set_alarm() when necessary (Huacai Chen)  
  - media: budget-core: Improve exception handling in budget_register() (Chuhong Yuan)  
  - scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM (Bodo Stroesser)  
  - scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices (Stanley Chu)  
  - opp: Enable resources again if they were disabled earlier (Rajendra Nayak)  
  - kthread: Do not preempt current task if it is going to call schedule() (Liang Chen)  
  - drm/amd/display: fix pow() crashing when given base 0 (Krunoslav Kovac)  
  - drm/amd/display: Fix EDID parsing after resume from suspend (Stylon Wang)  
  - drm/amdgpu/display: use GFP_ATOMIC in dcn20_validate_bandwidth_internal (Daniel Kolesa)  
  - scsi: zfcp: Fix use-after-free in request timeout handlers (Steffen Maier)  
  - jbd2: add the missing unlock_buffer() in the error path of jbd2_write_superblock() (zhangyi (F))  
  - ext4: fix checking of directory entry validity for inline directories (Jan Kara)  
  - RDMA/hfi1: Correct an interlock issue for TID RDMA WRITE request (Kaike Wan)  
  - mm, page_alloc: fix core hung in free_pcppages_bulk() (Charan Teja Reddy)  
  - mm: include CMA pages in lowmem_reserve at boot (Doug Berger)  
  - uprobes: __replace_page() avoid BUG in munlock_vma_page() (Hugh Dickins)  
  - kernel/relay.c: fix memleak on destroy relay channel (Wei Yongjun)  
  - romfs: fix uninitialized memory leak in romfs_dev_read() (Jann Horn)  
  - spi: Prevent adding devices below an unregistering controller (Lukas Wunner)  
  - can: j1939: socket: j1939_sk_bind(): make sure ml_priv is allocated (Oleksij Rempel)  
  - can: j1939: transport: j1939_session_tx_dat(): fix use-after-free read in j1939_tp_txtimer() (Oleksij Rempel)  
  - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion (Mike Pozulp)  
  - ALSA: hda/realtek: Add quirk for Samsung Galaxy Flex Book (Mike Pozulp)  
  - btrfs: add wrapper for transaction abort predicate (David Sterba)  
  - btrfs: return EROFS for BTRFS_FS_STATE_ERROR cases (Josef Bacik)  
  - btrfs: don't show full path of bind mounts in subvol= (Josef Bacik)  
  - btrfs: export helpers for subvolume name/id resolution (Marcos Paulo de Souza)  
  - bcache: avoid nr_stripes overflow in bcache_device_init() (Coly Li)  
  - khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() (Hugh Dickins)  
  - khugepaged: khugepaged_test_exit() check mmget_still_valid() (Hugh Dickins)  
  - perf probe: Fix memory leakage when the probe point is not found (Masami Hiramatsu)  
  - gfs2: Never call gfs2_block_zero_range with an open transaction (Bob Peterson)  
  - gfs2: Improve mmap write vs. punch_hole consistency (Andreas Gruenbacher)  
  - drm/vgem: Replace opencoded version of drm_gem_dumb_map_offset() (Chris Wilson)  
  - kbuild: support LLVM=1 to switch the default tools to Clang/LLVM (Masahiro Yamada)  
  - kbuild: replace AS=clang with LLVM_IAS=1 (Masahiro Yamada)  
  - kbuild: remove AS variable (Masahiro Yamada)  
  - kbuild: remove PYTHON2 variable (Masahiro Yamada)  
  - x86/boot: kbuild: allow readelf executable to be specified (Dmitry Golovin)  
  - net: wan: wanxl: use $(M68KCC) instead of $(M68KAS) for rebuilding firmware (Masahiro Yamada)  
  - net: wan: wanxl: use allow to pass CROSS_COMPILE_M68k for rebuilding firmware (Masahiro Yamada)  
  - Documentation/llvm: fix the name of llvm-size (Fangrui Song)  
  - Documentation/llvm: add documentation on building w/ Clang/LLVM (Nick Desaulniers)


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.100.1.el8
changelog:
  - nvme: multipath: round-robin: eliminate "fallback" variable (Martin Wilck)  [Orabug: 31821390] 
  - nvme: multipath: round-robin: fix single non-optimized path case (Martin Wilck)  [Orabug: 31821390]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.100.2.el8
changelog:
  - net/packet: fix overflow in tpacket_rcv (Or Cohen)  [Orabug: 31866486]  {CVE-2020-14386}
  - iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE (Suravee Suthikulpanit)  [Orabug: 31849529] 
  - uek-rpm: ol8: config-aarch64: add *_MEMORY_HOTPLUG (Mihai Carabas)  [Orabug: 31848212] 
  - block: better deal with the delayed not supported case in blk_cloned_rq_check_limits (Ritika Srivastava)  [Orabug: 31850340] 
  - block: Return blk_status_t instead of errno codes (Ritika Srivastava)  [Orabug: 31850340] 
  - kvm: ioapic: Restrict lazy EOI update to edge-triggered interrupts (Paolo Bonzini)  [Orabug: 31839184] 
  - virtio_vsock: Fix race condition in virtio_transport_recv_pkt (Jia He)  [Orabug: 31837274] 
  - net: virtio_vsock: Enhance connection semantics (Sebastien Boeuf)  [Orabug: 31837274] 
  - IB/mlx5: Expose RoCE accelerator counters (Avihai Horon)  [Orabug: 31840631] 
  - net/mlx5: Add RoCE accelerator counters (Leon Romanovsky)  [Orabug: 31840631]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.100.3.el8
changelog:
  - xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen)  [Orabug: 31895364]  {CVE-2020-14385}
  - btrfs: allow btrfs_truncate_block() to fallback to nocow for data space reservation (Qu Wenruo)  [Orabug: 31899351] 
  - btrfs: fix RWF_NOWAIT write not failling when we need to cow (Filipe Manana)  [Orabug: 31899351] 
  - btrfs: Ensure we trim ranges across block group boundary (Qu Wenruo)  [Orabug: 31899340] 
  - btrfs: volumes: Use more straightforward way to calculate map length (Qu Wenruo)  [Orabug: 31899340] 
  - Btrfs: send, fix emission of invalid clone operations within the same file (Filipe Manana)  [Orabug: 31899298] 
  - Btrfs: send, allow clone operations within the same file (Filipe Manana)  [Orabug: 31899298] 
  - mmc: sdhci: Silence MMC warnings (Maxime Ripard)  [Orabug: 31898202] 
  - bcm2835-dma: Add support for per-channel flags (Phil Elwell)  [Orabug: 31898202] 
  - mmc: sdhci-iproc: Fix vmmc regulators on iProc (Phil Elwell)  [Orabug: 31898202] 
  - scsi: core: Register sysfs for SCSI workqueue (Bob Liu)  [Orabug: 31894419] 
  - scsi: iscsi: Change iSCSI workqueue max_active back to 1 (Bob Liu)  [Orabug: 31894419] 
  - scsi: iscsi: Register sysfs for iscsi workqueue (Bob Liu)  [Orabug: 31894419] 
  - mm/hugetlb: fix a race between hugetlb sysctl handlers (Muchun Song)  [Orabug: 31884231]  {CVE-2020-25285}
  - rbd: require global CAP_SYS_ADMIN for mapping and unmapping (Ilya Dryomov)  [Orabug: 31884150]  {CVE-2020-25284}
  - padata: fix possible padata_works_lock deadlock (Daniel Jordan)  [Orabug: 31891481] 
  - KVM: x86: minor code refactor and comments fixup around dirty logging (Anthony Yznaga)  [Orabug: 31845163] 
  - KVM: x86: avoid unnecessary rmap walks when creating/moving slots (Anthony Yznaga)  [Orabug: 31845163] 
  - KVM: x86: remove unnecessary rmap walk of read-only memslots (Anthony Yznaga)  [Orabug: 31845163] 
  - scsi: mpt3sas: A small correction in _base_process_reply_queue (Tomas Henzl)  [Orabug: 31902837] 
  - scsi: mpt3sas: Fix sync irqs (Tomas Henzl)  [Orabug: 31902837] 
  - scsi: mpt3sas: Detect tampered Aero and Sea adapters (Sreekanth Reddy)  [Orabug: 31902837] 
  - scsi: mpt3sas: Don't call disable_irq from IRQ poll handler (Tomas Henzl)  [Orabug: 31902837] 
  - scsi: mpt3sas: Remove pci-dma-compat wrapper API (Suraj Upadhyay)  [Orabug: 31902837] 
  - scsi: mpt3sas: Remove superfluous memset() (Li Heng)  [Orabug: 31902837] 
  - scsi: mpt3sas: Update driver version to 35.100.00.00 (Suganath Prabu S)  [Orabug: 31902837] 
  - scsi: mpt3sas: Postprocessing of target and LUN reset (Suganath Prabu S)  [Orabug: 31902837] 
  - scsi: mpt3sas: Add functions to check if any cmd is outstanding on Target and LUN (Suganath Prabu S)  [Orabug: 31902837] 
  - scsi: mpt3sas: Rename and export interrupt mask/unmask functions (Suganath Prabu S)  [Orabug: 31902837] 
  - scsi: mpt3sas: Cancel the running work during host reset (Suganath Prabu S)  [Orabug: 31902837] 
  - scsi: mpt3sas: Dump system registers for debugging (Suganath Prabu S)  [Orabug: 31902837] 
  - scsi: mpt3sas: Memset config_cmds.reply buffer with zeros (Suganath Prabu S)  [Orabug: 31902837] 
  - scsi: mpt3sas: Fix kdoc comments format (Damien Le Moal)  [Orabug: 31902837] 
  - scsi: mpt3sas: Fix set but unused variable (Damien Le Moal)  [Orabug: 31902837] 
  - scsi: mpt3sas: Fix spelling mistake (Flavio Suligoi)  [Orabug: 31902837]


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 5.4.17-2036.100.4.el8
changelog:
  - xfs: force writes to delalloc regions to unwritten (Darrick J. Wong)  [Orabug: 30787888] 
  - xfs: properly serialise fallocate against AIO+DIO (Dave Chinner)  [Orabug: 31366104] 
  - perf/x86/rapl: Add Ice Lake RAPL support (Thomas Tai)  [Orabug: 31766610] 
  - xfs: attach dquots and reserve quota blocks during unwritten conversion (Darrick J. Wong)  [Orabug: 31785972] 
  - netfilter: ctnetlink: add a range check for l3/l4 protonum (Will McVicker)  [Orabug: 31872853]  {CVE-2020-25211}
  - net/rds: Extract dest qp num for displaying in rds-info (Praveen Kumar Kannoju)  [Orabug: 31880140] 
  - uek-rpm: streamline 4konly build (Dave Kleikamp)  [Orabug: 31891770] 
  - bnxt: correct warning: unused variable: 'rc' (John Donnelly)  [Orabug: 31907548] 
  - i40e: Correct warning: 'aq_ret' may be used uninitialized, (John Donnelly)  [Orabug: 31907631] 
  - uek-rpm: Add ovmapi.ko to uek6 nano_modules (Joe Jin)  [Orabug: 31908852] 
  - uek-rpm: config: Enable OVM API (Joe Jin)  [Orabug: 31908852] 
  - uek-rpm: Fix kernel-ueknano depmod warnings vhost_iotlb regmap-i2c (Vijayendra Suman)  [Orabug: 31916879] 
  - kprobes: Fix compiler warning for !CONFIG_KPROBES_ON_FTRACE (Muchun Song)  [Orabug: 31920526] 
  - scsi: page warning: 'page' may be used uninitialized. (John Donnelly)  [Orabug: 31920671] 
  - x86/speculation/taa: Add TAA_MITIGATION_IDLE mode (Patrick Colp)  [Orabug: 31921884] 
  - oracleasm: Access d_bdev before dropping inode (Stephen Brennan)  [Orabug: 31927355] 
  - iommu/amd: Restore IRTE.RemapEn bit for amd_iommu_activate_guest_mode (Suravee Suthikulpanit)  [Orabug: 31931368] 
  - iommu/amd: Fix potential @entry null deref (Joao Martins)  [Orabug: 31931368] 
  - iommu/amd: Restore IRTE.RemapEn bit after programming IRTE (Suravee Suthikulpanit)  [Orabug: 31931368]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.100.5.el8
changelog:
  - uek-rpm: Fix integer test for 4k page size module signing (Dave Kleikamp)  [Orabug: 32021114] 
  - uek-rpm/kernel-uek.spec: Sign modules for 4k kernel (Vijay Kumar)  [Orabug: 32021114] 
  - hdlc_ppp: add range checks in ppp_cp_parse_cr() (Dan Carpenter)  [Orabug: 31989185]  {CVE-2020-25643}
  - dm crypt: add flags to optionally bypass kcryptd workqueues (Ignat Korchagin)  [Orabug: 31998688] 
  - uek-rpm: Create initramfs at postinstall stage also. (Somasundaram Krishnasamy)  [Orabug: 32010302] 
  - geneve: add transport ports in route lookup for geneve (Mark Gray)  [Orabug: 32013938]  {CVE-2020-25645}
  - nvmet: Disable keep-alive timer when kato is cleared to 0h (Amit Engel)  [Orabug: 31997181] 
  - KVM: nVMX: stop abusing need_vmcs12_to_shadow_sync for eVMCS mapping (Vitaly Kuznetsov)  [Orabug: 31986433] 
  - cpu/hotplug: avoid race between cpuset_hotplug_workfn and later hotplug (Daniel Jordan)  [Orabug: 31985221] 
  - uek-rpm: Update secure boot UEK signing certificates (Brian Maly)  [Orabug: 31979626] 
  - uek-rpm: Add old OL keys to the default .blacklist keyring (Eric Snowberg)  [Orabug: 31961115] 
  - certs: Add ability to preload revocation certs (Eric Snowberg)  [Orabug: 31961115] 
  - certs: Move load_system_certificate_list to a common function (Eric Snowberg)  [Orabug: 31961115] 
  - certs: Add EFI_CERT_X509_GUID support for dbx entries (Eric Snowberg)  [Orabug: 31961115]  {CVE-2020-26541}
  - bcache: stop setting ->queuedata (Christoph Hellwig)  [Orabug: 30210051] 
  - bcache: pr_info() format clean up in bcache_device_init() (Coly Li)  [Orabug: 30210051] 
  - bcache: use delayed kworker fo asynchronous devices registration (Coly Li)  [Orabug: 30210051] 
  - bcache: check and adjust logical block size for backing devices (Mauricio Faria de Oliveira)  [Orabug: 30210051] 
  - bcache: configure the asynchronous registertion to be experimental (Coly Li)  [Orabug: 30210051] 
  - bcache: asynchronous devices registration (Coly Li)  [Orabug: 30210051] 
  - bcache: Convert pr_<level> uses to a more typical style (Joe Perches)  [Orabug: 30210051] 
  - bcache: remove redundant variables i and n (Colin Ian King)  [Orabug: 30210051] 
  - bcache: remove a duplicate ->make_request_fn assignment (Christoph Hellwig)  [Orabug: 30210051] 
  - bcache: pass the make_request methods to blk_queue_make_request (Christoph Hellwig)  [Orabug: 30210051] 
  - bcache: remove dupplicated declaration from btree.h (Coly Li)  [Orabug: 30210051] 
  - bcache: optimize barrier usage for atomic operations (Coly Li)  [Orabug: 30210051] 
  - bcache: optimize barrier usage for Rmw atomic bitops (Davidlohr Bueso)  [Orabug: 30210051] 
  - bcache: Use scnprintf() for avoiding potential buffer overflow (Takashi Iwai)  [Orabug: 30210051] 
  - bcache: make bch_sectors_dirty_init() to be multithreaded (Coly Li)  [Orabug: 30210051] 
  - bcache: make bch_btree_check() to be multithreaded (Coly Li)  [Orabug: 30210051] 
  - bcache: add bcache_ prefix to btree_root() and btree() macros (Coly Li)  [Orabug: 30210051] 
  - bcache: move macro btree() and btree_root() into btree.h (Coly Li)  [Orabug: 30210051] 
  - bcache: remove macro nr_to_fifo_front() (Coly Li)  [Orabug: 30210051] 
  - bcache: Revert "bcache: shrink btree node cache after bch_btree_check()" (Coly Li)  [Orabug: 30210051] 
  - bcache: check return value of prio_read() (Coly Li)  [Orabug: 30210051] 
  - bcache: reap from tail of c->btree_cache in bch_mca_scan() (Coly Li)  [Orabug: 30210051] 
  - bcache: reap c->btree_cache_freeable from the tail in bch_mca_scan() (Coly Li)  [Orabug: 30210051] 
  - bcache: remove member accessed from struct btree (Coly Li)  [Orabug: 30210051] 
  - bcache: add code comments for state->pool in __btree_sort() (Coly Li)  [Orabug: 30210051] 
  - bcache: use read_cache_page_gfp to read the superblock (Christoph Hellwig)  [Orabug: 30210051] 
  - bcache: store a pointer to the on-disk sb in the cache and cached_dev structures (Christoph Hellwig)  [Orabug: 30210051] 
  - bcache: return a pointer to the on-disk sb from read_super (Christoph Hellwig)  [Orabug: 30210051] 
  - bcache: transfer the sb_page reference to register_{bdev,cache} (Christoph Hellwig)  [Orabug: 30210051] 
  - bcache: use a separate data structure for the on-disk super block (Christoph Hellwig)  [Orabug: 30210051] 
  - bcache: don't export symbols (Christoph Hellwig)  [Orabug: 30210051] 
  - bcache: remove the extra cflags for request.o (Christoph Hellwig)  [Orabug: 30210051] 
  - bcache: add idle_max_writeback_rate sysfs interface (Coly Li)  [Orabug: 30210051] 
  - bcache: add code comments in bch_btree_leaf_dirty() (Coly Li)  [Orabug: 30210051] 
  - bcache: add code comment bch_keylist_pop() and bch_keylist_pop_front() (Coly Li)  [Orabug: 30210051] 
  - bcache: deleted code comments for dead code in bch_data_insert_keys() (Coly Li)  [Orabug: 30210051] 
  - bcache: add more accurate error messages in read_super() (Coly Li)  [Orabug: 30210051] 
  - bcache: fix a lost wake-up problem caused by mca_cannibalize_lock (Guoju Fang)  [Orabug: 30210051] 
  - mstflint_access: Update driver code to v4.15.0-1 from Github (Itay Avraham)  [Orabug: 31965669] 
  - rds/tcp: Enhance stats maintained by rds (Rao Shoaib)  [Orabug: 31933715] 
  - panic: move disabling iommu to after dump_stack() (John Donnelly)  [Orabug: 31916337] 
  - nbd_genl_status: null check for nla_nest_start (Navid Emamdoost)  [Orabug: 31972480]  {CVE-2019-16089}
  - vgacon: remove software scrollback support (Linus Torvalds)  [Orabug: 31914650]  {CVE-2020-14390}
  - fbcon: remove soft scrollback code (Linus Torvalds)  [Orabug: 31914650]  {CVE-2020-14390}
  - net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init() (Shung-Hsi Yu)  [Orabug: 31907969] 
  - PCI: pciehp: Reduce noisiness on hot removal (Lukas Wunner)  [Orabug: 30512596] 
  - kdump: update Documentation about crashkernel (Chen Zhou)  [Orabug: 31554906] 
  - arm64: kdump: add memory for devices by DT property linux, usable-memory-range (Chen Zhou)  [Orabug: 31554906] 
  - kdump: add threshold for the required memory (Chen Zhou)  [Orabug: 31554906] 
  - arm64: kdump: reimplement crashkernel=X (Chen Zhou)  [Orabug: 31554906] 
  - arm64: kdump: introduce some macroes for crash kernel reservation (Chen Zhou)  [Orabug: 31554906] 
  - x86: kdump: move reserve_crashkernel[_low]() into crash_core.c (Chen Zhou)  [Orabug: 31554906] 
  - x86: kdump: use macro CRASH_ADDR_LOW_MAX in functions reserve_crashkernel[_low]() (Chen Zhou)  [Orabug: 31554906] 
  - x86: kdump: make the lower bound of crash kernel reservation consistent (Chen Zhou)  [Orabug: 31554906] 
  - x86: kdump: move CRASH_ALIGN to 2M (Chen Zhou)  [Orabug: 31554906] 
  - block: allow 'chunk_sectors' to be non-power-of-2 (Mike Snitzer)  [Orabug: 31827023] 
  - block: use lcm_not_zero() when stacking chunk_sectors (Mike Snitzer)  [Orabug: 31827023] 
  - dm: fix comment in dm_process_bio() (Mike Snitzer)  [Orabug: 31827023] 
  - dm: fix bio splitting and its bio completion order for regular IO (Mike Snitzer)  [Orabug: 31827023] 
  - block: allow for_each_bvec to support zero len bvec (Ming Lei)  [Orabug: 31955136]  {CVE-2020-25641}


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.100.6.el8
changelog:
  - KVM: ioapic: break infinite recursion on lazy EOI (Vitaly Kuznetsov)  [Orabug: 32066585]  {CVE-2020-27152}
  - x86/mitigations: Restore paranoid checks for int3 handling (Boris Ostrovsky)  [Orabug: 31999339] 
  - x86/jump_label: Patch one site at a time (Boris Ostrovsky)  [Orabug: 31999339]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.100.6.1.el8
changelog:
  - powercap: restrict energy meter to root access (Kanth Ghatraju)  [Orabug:
    32040802]  {CVE-2020-8694} {CVE-2020-8695}


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.101.0.el8
changelog:
  - hv_utils: drain the timesync packets on onchannelcallback (Vineeth Pillai)  [Orabug: 32152142] 
  - hv_utils: return error if host timesysnc update is stale (Vineeth Pillai)  [Orabug: 32152142] 
  - x86/cpu/intel: enable X86_FEATURE_NT_GOOD on Intel Icelakex (Ankur Arora)  [Orabug: 32143850] 
  - x86/cpu/amd: enable X86_FEATURE_NT_GOOD on AMD Zen (Ankur Arora)  [Orabug: 32143850] 
  - x86/cpu/intel: enable X86_FEATURE_NT_GOOD on Intel Broadwellx (Ankur Arora)  [Orabug: 32143850] 
  - mm, clear_huge_page: use clear_page_uncached() for gigantic pages (Ankur Arora)  [Orabug: 32143850] 
  - x86/clear_page: add clear_page_uncached() (Ankur Arora)  [Orabug: 32143850] 
  - x86/asm: add clear_page_nt() (Ankur Arora)  [Orabug: 32143850] 
  - perf bench: add memset_movnti() (Ankur Arora)  [Orabug: 32143850] 
  - x86/asm: add memset_movnti() (Ankur Arora)  [Orabug: 32143850] 
  - x86/cpuid: add X86_FEATURE_NT_GOOD (Ankur Arora)  [Orabug: 32143850] 
  - kernel: add panic_on_taint (Rafael Aquini)  [Orabug: 32137996] 
  - cifs: handle empty list of targets in cifs_reconnect() (Paulo Alcantara)  [Orabug: 32124750] 
  - cifs: get rid of unused parameter in reconn_setup_dfs_targets() (Paulo Alcantara)  [Orabug: 32124750] 
  - rds/ib: Fix: (rds: Deregister all FRWR mr with free_mr) (Manjunath Patil)  [Orabug: 32113472] 
  - net/rds: Force ARP flush upon RDMA_CM_EVENT_ADDR_CHANGE (Gerd Rausch)  [Orabug: 32095959] 
  - uek-rpm: aarch64: increase CONFIG_NODES_SHIFT from 3 to 6 (Dave Kleikamp)  [Orabug: 32075923] 
  - rds: Restore MR use-once semantics (Håkon Bugge)  [Orabug: 31990092] [Orabug: 32072247] 
  - rds: Fix incorrect cmsg status and use-after-free (Håkon Bugge)  [Orabug: 32003078] [Orabug: 32072245] 
  - rds: Force ordering of {set,clear}_bit operating on m_flags (Håkon Bugge)  [Orabug: 31505749] [Orabug: 32072228] 
  - rds: Do not send canceled operations to the transport layer (Håkon Bugge)  [Orabug: 31505749] [Orabug: 32072228] 
  - rds: Introduce rds_conn_to_path helper (Håkon Bugge)  [Orabug: 31505749] [Orabug: 32072228] 
  - Revert "RDS: Drop the connection as part of cancel to avoid hangs" (Håkon Bugge)  [Orabug: 31505749] [Orabug: 32072228] 
  - Revert "rds: fix warning in rds_send_drop_to()" (Håkon Bugge)  [Orabug: 31505749] [Orabug: 32072228] 
  - Revert "rds: Use correct conn when dropping connections due to cancel" (Håkon Bugge)  [Orabug: 31505749] [Orabug: 32072228] 
  - Revert "rds: prevent use-after-free of rds conn in rds_send_drop_to()" (Håkon Bugge)  [Orabug: 31505749] [Orabug: 32072228] 
  - Revert "rds: Use bitmap to designate dropped connections" (Håkon Bugge)  [Orabug: 31505749] [Orabug: 32072228] 
  - Revert "UEK6 compiler warning for /net/rds/send.c" (Håkon Bugge)  [Orabug: 31505749] [Orabug: 32072228] 
  - x86/mce/therm_throt: Undo thermal polling properly on CPU offline (Thomas Gleixner)  [Orabug: 32048971] 
  - x86/mce/therm_throt: Do not access uninitialized therm_work (Chuansheng Liu)  [Orabug: 32048971] 
  - x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused (Arnd Bergmann)  [Orabug: 32048971] 
  - x86/mce/therm_throt: Mask out read-only and reserved MSR bits (Srinivas Pandruvada)  [Orabug: 32048971] 
  - x86/mce/therm_throt: Optimize notifications of thermal throttle (Srinivas Pandruvada)  [Orabug: 32048971] 
  - ocfs2: fix remounting needed after setfacl command (Gang He)  [Orabug: 32042684] 
  - IB/mlx4: disable CQ time stamping (aru kolappan)  [Orabug: 32042517] 
  - net/rds: Refactor sendmsg ancillary data processing (Ka-Cheong Poon)  [Orabug: 32027845] 
  - Bluetooth: A2MP: Fix not initializing all members (Luiz Augusto von Dentz)  [Orabug: 32021285]  {CVE-2020-12352}
  - ima: Use ima_hash_algo for collision detection in the measurement list (Roberto Sassu)  [Orabug: 31973040] 
  - ima: Calculate and extend PCR with digests in ima_template_entry (Roberto Sassu)  [Orabug: 31973040] 
  - ima: Allocate and initialize tfm for each PCR bank (Roberto Sassu)  [Orabug: 31973040] 
  - ima: Switch to dynamically allocated buffer for template digests (Roberto Sassu)  [Orabug: 31973040] 
  - ima: Store template digest directly in ima_template_entry (Roberto Sassu)  [Orabug: 31973040] 
  - scsi: lpfc: Fix initial FLOGI failure due to BBSCN not supported (James Smart)  [Orabug: 31598148] 
  - net/rds: Check for NULL rds_ibdev in rds_ib_rx() only if rds_ib_srq_enabled (Sharath Srinivasan)  [Orabug: 32113840] 
  - A/A Bonding: Increase number and interval of GARPs sent by rdmaip (Sharath Srinivasan)  [Orabug: 32095766] 
  - powercap: restrict energy meter to root access (Kanth Ghatraju)  [Orabug: 32040802]  {CVE-2020-8694} {CVE-2020-8695}


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.101.1.el8
changelog:
  - uek-rpm: Enable Intel Speed Select Technology interface support (Somasundaram Krishnasamy)  [Orabug: 32161425] 
  - platform/x86: ISST: Increase timeout (Srinivas Pandruvada)  [Orabug: 32161425] 
  - platform/x86: ISST: Fix wrong unregister type (Srinivas Pandruvada)  [Orabug: 32161425] 
  - platform/x86: ISST: Allow additional core-power mailbox commands (Srinivas Pandruvada)  [Orabug: 32161425] 
  - IB/mlx4: Convert rej_tmout radix-tree to XArray (Håkon Bugge)  [Orabug: 32136895] 
  - IB/mlx4: Adjust delayed work when a dup is observed (Håkon Bugge)  [Orabug: 32136895] 
  - IB/mlx4: Add support for REJ due to timeout (Håkon Bugge)  [Orabug: 32136895] 
  - IB/mlx4: Fix starvation in paravirt mux/demux (Håkon Bugge)  [Orabug: 32136895] 
  - IB/mlx4: Separate tunnel and wire bufs parameters (Håkon Bugge)  [Orabug: 32136895] 
  - IB/mlx4: Add support for MRA (Håkon Bugge)  [Orabug: 32136895] 
  - IB/mlx4: Add and improve logging (Håkon Bugge)  [Orabug: 32136895] 
  - perf/core: Fix a memory leak in perf_event_parse_addr_filter() (kiyin(尹亮))  [Orabug: 32131172]  {CVE-2020-25704}
  - vt: keyboard, extend func_buf_lock to readers (Jiri Slaby)  [Orabug: 32122948]  {CVE-2020-25656}
  - vt: keyboard, simplify vt_kdgkbsent (Jiri Slaby)  [Orabug: 32122948]  {CVE-2020-25656}
  - tty: make FONTX ioctl use the tty pointer they were actually passed (Linus Torvalds)  [Orabug: 32122725]  {CVE-2020-25668}
  - NFSv4.2: Fix NFS4ERR_STALE error when doing inter server copy (Dai Ngo)  [Orabug: 31879682]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.101.2.el8
changelog:
  - vt: Disable KD_FONT_OP_COPY (Daniel Vetter)  [Orabug: 32187738]  {CVE-2020-28974}
  - page_frag: Recover from memory pressure (Dongli Zhang)  [Orabug: 32177966] 
  - Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts (Peilin Ye)  [Orabug: 32176254]  {CVE-2020-28915}
  - fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h (Peilin Ye)  [Orabug: 32176254]  {CVE-2020-28915}
  - ocfs2: initialize ip_next_orphan (Wengang Wang)  [Orabug: 32159053] 
  - net/rds: rds_ib_remove_one() accesses freed memory (Ka-Cheong Poon)  [Orabug: 32213896] 
  - hv_netvsc: make recording RSS hash depend on feature flag (Stephen Hemminger)  [Orabug: 32159973] 
  - hv_netvsc: record hardware hash in skb (Stephen Hemminger)  [Orabug: 32159973] 
  - RDMA/umem: Move to allocate SG table from pages (Maor Gottlieb)  [Orabug: 32005752] 
  - lib/scatterlist: Add support in dynamic allocation of SG table from pages (Maor Gottlieb)  [Orabug: 32005752] 
  - arm64:uek/config: Enable ZONE_DMA config (Vijay Kumar)  [Orabug: 31970521] 
  - Revert "arm64/dts: Serial console fix for RPi4" (Vijay Kumar)  [Orabug: 31970521] 
  - uek-rpm: aarch64: enable CONFIG_ACPI_APEI_EINJ (Dave Kleikamp)  [Orabug: 32182237] 
  - NFSD: fix missing refcount in nfsd4_copy by nfsd4_do_async_copy (Dai Ngo)  [Orabug: 32177992] 
  - NFSD: Fix use-after-free warning when doing inter-server copy (Dai Ngo)  [Orabug: 32177992] 
  - xen/events: block rogue events for some time (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
  - xen/events: defer eoi in case of excessive number of events (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
  - xen/events: use a common cpu hotplug hook for event channels (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
  - xen/events: switch user event channels to lateeoi model (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
  - xen/pciback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
  - xen/pvcallsback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
  - xen/scsiback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
  - xen/netback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
  - xen/blkback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
  - xen/events: add a new "late EOI" evtchn framework (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
  - xen/events: fix race in evtchn_fifo_unmask() (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
  - xen/events: add a proper barrier to 2-level uevent unmasking (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
  - xen/events: avoid removing an event channel while handling it (Juergen Gross)  [Orabug: 32177543]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.102.0.el8
changelog:
  - futex: Fix inode life-time issue (Peter Zijlstra)  [Orabug: 32233515]  {CVE-2020-14381}
  - perf/core: Fix race in the perf_mmap_close() function (Jiri Olsa)  [Orabug: 32233352]  {CVE-2020-14351}
  - intel_idle: Customize IceLake server support (Chen Yu)  [Orabug: 32218858] 
  - dm crypt: Allow unaligned bio buffer lengths for skcipher devices (Sudhakar Panneerselvam)  [Orabug: 32210418] 
  - vhost scsi: fix lun reset completion handling (Mike Christie)  [Orabug: 32167069] 
  - vhost scsi: Add support for LUN resets. (Mike Christie)  [Orabug: 32167069] 
  - vhost scsi: add lun parser helper (Mike Christie)  [Orabug: 32167069] 
  - vhost scsi: fix cmd completion race (Mike Christie)  [Orabug: 32167069] 
  - vhost scsi: alloc cmds per vq instead of session (Mike Christie)  [Orabug: 32167069] 
  - vhost: Create accessors for virtqueues private_data (Eugenio Pérez)  [Orabug: 32167069] 
  - vhost: add helper to check if a vq has been setup (Mike Christie)  [Orabug: 32167069] 
  - scsi: sd: Allow user to configure command retries (Mike Christie)  [Orabug: 32167069] 
  - scsi: core: Add limitless cmd retry support (Mike Christie)  [Orabug: 32167069] 
  - scsi: mpt3sas: Update driver version to 36.100.00.00 (Suganath Prabu S)  [Orabug: 32242279] 
  - scsi: mpt3sas: Handle trigger page after firmware update (Suganath Prabu S)  [Orabug: 32242279] 
  - scsi: mpt3sas: Add persistent MPI trigger page (Suganath Prabu S)  [Orabug: 32242279] 
  - scsi: mpt3sas: Add persistent SCSI sense trigger page (Suganath Prabu S)  [Orabug: 32242279] 
  - scsi: mpt3sas: Add persistent Event trigger page (Suganath Prabu S)  [Orabug: 32242279] 
  - scsi: mpt3sas: Add persistent Master trigger page (Suganath Prabu S)  [Orabug: 32242279] 
  - scsi: mpt3sas: Add persistent trigger pages support (Suganath Prabu S)  [Orabug: 32242279] 
  - scsi: mpt3sas: Sync time periodically between driver and firmware (Suganath Prabu S)  [Orabug: 32242279] 
  - scsi: mpt3sas: Bump driver version to 35.101.00.00 (Sreekanth Reddy)  [Orabug: 32242279] 
  - scsi: mpt3sas: Add module parameter multipath_on_hba (Sreekanth Reddy)  [Orabug: 32242279] 
  - scsi: mpt3sas: Handle vSES vphy object during HBA reset (Sreekanth Reddy)  [Orabug: 32242279] 
  - scsi: mpt3sas: Add bypass_dirty_port_flag parameter (Sreekanth Reddy)  [Orabug: 32242279] 
  - scsi: mpt3sas: Handling HBA vSES device (Sreekanth Reddy)  [Orabug: 32242279] 
  - scsi: mpt3sas: Set valid PhysicalPort in SMPPassThrough (Sreekanth Reddy)  [Orabug: 32242279] 
  - scsi: mpt3sas: Update hba_port objects after host reset (Sreekanth Reddy)  [Orabug: 32242279] 
  - scsi: mpt3sas: Get sas_device objects using device's rphy (Sreekanth Reddy)  [Orabug: 32242279] 
  - scsi: mpt3sas: Rename transport_del_phy_from_an_existing_port() (Sreekanth Reddy)  [Orabug: 32242279] 
  - scsi: mpt3sas: Get device objects using sas_address & portID (Sreekanth Reddy)  [Orabug: 32242279] 
  - scsi: mpt3sas: Update hba_port's sas_address & phy_mask (Sreekanth Reddy)  [Orabug: 32242279] 
  - scsi: mpt3sas: Rearrange _scsih_mark_responding_sas_device() (Sreekanth Reddy)  [Orabug: 32242279] 
  - scsi: mpt3sas: Allocate memory for hba_port objects (Sreekanth Reddy)  [Orabug: 32242279] 
  - scsi: mpt3sas: Define hba_port structure (Sreekanth Reddy)  [Orabug: 32242279] 
  - scsi: mpt3sas: Fix ioctl timeout (Suganath Prabu S)  [Orabug: 32242279] 
  - icmp: randomize the global rate limiter (Eric Dumazet)  [Orabug: 32227958]  {CVE-2020-25705}
  - perf/x86/intel/uncore: Add box_offsets for free-running counters (Kan Liang)  [Orabug: 32020885] 
  - perf/x86/intel/uncore: Factor out __snr_uncore_mmio_init_box (Kan Liang)  [Orabug: 32020885] 
  - perf/x86/intel/uncore: Add Ice Lake server uncore support (Kan Liang)  [Orabug: 32020885]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.102.0.2.el8
changelog:
  - xen-blkback: set ring->xenblkd to NULL after kthread_stop() (Pawel Wieczorkiewicz)  [Orabug: 32260252]  {CVE-2020-29569}
  - xenbus/xenbus_backend: Disallow pending watch messages (SeongJae Park)  [Orabug: 32253409]  {CVE-2020-29568}
  - xen/xenbus: Count pending messages for each watch (SeongJae Park)  [Orabug: 32253409]  {CVE-2020-29568}
  - xen/xenbus/xen_bus_type: Support will_handle watch callback (SeongJae Park)  [Orabug: 32253409]  {CVE-2020-29568}
  - xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path() (SeongJae Park)  [Orabug: 32253409]  {CVE-2020-29568}
  - xen/xenbus: Allow watches discard events before queueing (SeongJae Park)  [Orabug: 32253409]  {CVE-2020-29568}
  - target: fix XCOPY NAA identifier lookup (David Disseldorp)  [Orabug: 32248035]  {CVE-2020-28374}


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.103.0.el8
changelog:
  - lockd: don't use interval-based rebinding over TCP (Calum Mackay)  [Orabug: 32337715] 
  - tools: update header files in the tools directory (Thomas Tai)  [Orabug: 32321484] 
  - perf: Fix a kABI breakage in perf_event.h (Thomas Tai)  [Orabug: 32321484] 
  - perf/x86: Fix n_metric for cancelled txn (Peter Zijlstra)  [Orabug: 32321484] 
  - perf/x86: Fix n_pair for cancelled txn (Peter Zijlstra)  [Orabug: 32321484] 
  - perf/x86/intel: Check perf metrics feature for each CPU (Kan Liang)  [Orabug: 32321484] 
  - perf/x86/intel: Support per-thread RDPMC TopDown metrics (Kan Liang)  [Orabug: 32321484] 
  - perf/x86/intel: Support TopDown metrics on Ice Lake (Kan Liang)  [Orabug: 32321484] 
  - perf/x86: Use event_base_rdpmc for the RDPMC userspace support (Kan Liang)  [Orabug: 32321484] 
  - perf/x86: Add a macro for RDPMC offset of fixed counters (Kan Liang)  [Orabug: 32321484] 
  - perf/x86/intel: Generic support for hardware TopDown metrics (Kan Liang)  [Orabug: 32321484] 
  - perf/core: Add a new PERF_EV_CAP_SIBLING event capability (Kan Liang)  [Orabug: 32321484] 
  - perf/core: Unify {pinned,flexible}_sched_in() (Peter Zijlstra)  [Orabug: 32321484] 
  - perf/x86/intel: Use switch in intel_pmu_disable/enable_event (Kan Liang)  [Orabug: 32321484] 
  - perf/x86: Keep LBR records unchanged in host context for guest usage (Like Xu)  [Orabug: 32321484] 
  - perf/x86/intel: Fix the name of perf METRICS (Kan Liang)  [Orabug: 32321484] 
  - perf/x86/intel: Move BTS index to 47 (Kan Liang)  [Orabug: 32321484] 
  - perf/x86/intel: Introduce the fourth fixed counter (Kan Liang)  [Orabug: 32321484] 
  - perf/x86/intel: Name the global status bit in NMI handler (Kan Liang)  [Orabug: 32321484] 
  - perf/x86: Add constraint to create guest LBR event without hw counter (Like Xu)  [Orabug: 32321484] 
  - perf/x86/lbr: Add interface to get LBR information (Like Xu)  [Orabug: 32321484] 
  - perf/x86/core: Refactor hw->idx checks and cleanup (Like Xu)  [Orabug: 32321484] 
  - perf/x86/intel: Avoid unnecessary PEBS_ENABLE MSR access in PMI (Kan Liang)  [Orabug: 32321484] 
  - perf/x86: Provide stubs of KVM helpers for non-Intel CPUs (Sean Christopherson)  [Orabug: 32321484] 
  - partitions/efi: Enable no warning option for the GPT warnings related to alternative header (Saeed Mirzamohammadi)  [Orabug: 32302136] 
  - Revert "cpu/hotplug: avoid race between cpuset_hotplug_workfn and later hotplug" (Daniel Jordan)  [Orabug: 32295229] 
  - cpuset: fix race between hotplug work and later CPU offline (Daniel Jordan)  [Orabug: 32295229] 
  - uek-rpm: aarch64: update PMU configs for Altra (Dave Kleikamp)  [Orabug: 32290034] 
  - driver/perf: Add PMU driver for the ARM DMC-620 memory controller (Tuan Phan)  [Orabug: 32290034] 
  - perf: arm-cmn: Fix conversion specifiers for node type (Will Deacon)  [Orabug: 32290034] 
  - perf: arm-cmn: Fix unsigned comparison to less than zero (Will Deacon)  [Orabug: 32290034] 
  - perf: Add Arm CMN-600 PMU driver (Robin Murphy)  [Orabug: 32290034] 
  - perf: Add Arm CMN-600 DT binding (Robin Murphy)  [Orabug: 32290034] 
  - perf: arm_dsu: Support DSU ACPI devices (Tuan Phan)  [Orabug: 32290034] 
  - arm64: acpi: Make apei_claim_sea() synchronise with APEI's irq work (James Morse)  [Orabug: 32290034] 
  - ACPI: APEI: Kick the memory_failure() queue for synchronous errors (James Morse)  [Orabug: 32290034] 
  - iommu/arm-smmu-v3: Don't reserve implementation defined register space (Jean-Philippe Brucker)  [Orabug: 32290034] 
  - Revert "BACKPORT: perf: Add Arm CMN-600 DT binding" (Dave Kleikamp)  [Orabug: 32290034] 
  - Revert "BACKPORT: WIP: perf: Add Arm CMN-600 PMU driver" (Dave Kleikamp)  [Orabug: 32290034] 
  - Revert "BACKPORT: WIP: perf/arm-cmn: Add ACPI support" (Dave Kleikamp)  [Orabug: 32290034] 
  - Revert "perf: Add ARM DMC-620 PMU driver." (Dave Kleikamp)  [Orabug: 32290034] 
  - Revert "BACKPORT: ACPI / APEI: Kick the memory_failure() queue for synchronous errors" (Dave Kleikamp)  [Orabug: 32290034] 
  - Revert "BACKPORT: arm64: acpi: Make apei_claim_sea() synchronise with APEI's irq work" (Dave Kleikamp)  [Orabug: 32290034] 
  - Revert "Perf: arm-cmn: Allow irq to be shared." (Dave Kleikamp)  [Orabug: 32290034] 
  - Revert "perf: arm_cmn: improve and make it work on 2P." (Dave Kleikamp)  [Orabug: 32290034] 
  - Revert "perf: arm_dsu: Allow IRQ to be shared among devices." (Dave Kleikamp)  [Orabug: 32290034] 
  - Revert "perf: arm_dsu: Support ACPI mode." (Dave Kleikamp)  [Orabug: 32290034] 
  - Revert "perf: arm_dmc620: Update ACPI ID." (Dave Kleikamp)  [Orabug: 32290034] 
  - Revert "perf: avoid breaking KABI by reusing enum" (Dave Kleikamp)  [Orabug: 32290034] 
  - Revert "perf/smmuv3: Allow sharing MMIO registers with the SMMU driver" (Dave Kleikamp)  [Orabug: 32290034] 
  - tty: Fix ->session locking (Jann Horn)  [Orabug: 32266677]  {CVE-2020-29660}
  - tty: Fix ->pgrp locking in tiocspgrp() (Jann Horn)  [Orabug: 32266677]  {CVE-2020-29660}
  - xen-blkback: set ring->xenblkd to NULL after kthread_stop() (Pawel Wieczorkiewicz)  [Orabug: 32260252]  {CVE-2020-29569}
  - xenbus/xenbus_backend: Disallow pending watch messages (SeongJae Park)  [Orabug: 32253409]  {CVE-2020-29568}
  - xen/xenbus: Count pending messages for each watch (SeongJae Park)  [Orabug: 32253409]  {CVE-2020-29568}
  - xen/xenbus/xen_bus_type: Support will_handle watch callback (SeongJae Park)  [Orabug: 32253409]  {CVE-2020-29568}
  - xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path() (SeongJae Park)  [Orabug: 32253409]  {CVE-2020-29568}
  - xen/xenbus: Allow watches discard events before queueing (SeongJae Park)  [Orabug: 32253409]  {CVE-2020-29568}
  - KVM: x86: clflushopt should be treated as a no-op by emulation (David Edmondson)  [Orabug: 32251910]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.103.1.el8
changelog:
  - mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start (Zhang Xiaohui)  [Orabug: 32349203]  {CVE-2020-36158}
  - x86/process: Mark cpu inactive before offlining (Mridula Shastry)  [Orabug: 32234812] 
  - add license checking to kABI checker (Dan Duval)  [Orabug: 32355206]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.103.2.el8
changelog:
  - A/A Bonding: Fix a one-byte-off kmalloc (Håkon Bugge)  [Orabug: 32380824] 
  - netfilter: add and use nf_hook_slow_list() (Florian Westphal)  [Orabug: 32372530]  {CVE-2021-20177}
  - net/rds: Fix gfp_t parameter (Hans Westgaard Ry)  [Orabug: 32372158] 
  - uek-rpm: Report removed symbols also during kabi check (Somasundaram Krishnasamy)  [Orabug: 32380061] 
  - uek-rpm: update kABI lists for new symbol (Dan Duval)  [Orabug: 32378206] 
  - A/A Bonding: Introduce selective interface name inclusion (Håkon Bugge)  [Orabug: 32350974] 
  - uek-rpm: add nfs_ssc to nano_modules (Calum Mackay)  [Orabug: 32346419] 
  - target: fix XCOPY NAA identifier lookup (David Disseldorp)  [Orabug: 32248035]  {CVE-2020-28374}


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.103.3.1.el8
changelog:
  - xen-blkback: fix error handling in xen_blkbk_map() (Jan Beulich)  [Orabug: 32492109]  {CVE-2021-26930}
  - xen-scsiback: don't "handle" error by BUG() (Jan Beulich)  [Orabug: 32492101]  {CVE-2021-26931}
  - xen-netback: don't "handle" error by BUG() (Jan Beulich)  [Orabug: 32492101]  {CVE-2021-26931}
  - xen-blkback: don't "handle" error by BUG() (Jan Beulich)  [Orabug: 32492101]  {CVE-2021-26931}
  - Xen/gntdev: correct error checking in gntdev_map_grant_pages() (Jan Beulich)  [Orabug: 32492093]  {CVE-2021-26932}
  - Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages() (Jan Beulich)  [Orabug: 32492093]  {CVE-2021-26932}
  - Xen/x86: also check kernel mapping in set_foreign_p2m_mapping() (Jan Beulich)  [Orabug: 32492093]  {CVE-2021-26932}
  - Xen/x86: don't bail early from clear_foreign_p2m_mapping() (Jan Beulich)  [Orabug: 32492093]  {CVE-2021-26932}


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.104.0.el8
changelog:
  - Revert "rds: Deregister all FRWR mr with free_mr" (aru kolappan)  [Orabug: 32426610] 
  - thermal: intel_pch_thermal: Add PCI ids for Lewisburg PCH. (Andres Freund)  [Orabug: 32424705] 
  - thermal: intel: intel_pch_thermal: Add Cannon Lake Low Power PCH support (Sumeet Pawnikar)  [Orabug: 32424705] 
  - thermal: intel: intel_pch_thermal: Add Comet Lake (CML) platform support (Gayatri Kammela)  [Orabug: 32424705] 
  - nfs: Fix security label length not being reset (Jeffrey Mitchell)  [Orabug: 32350989] 
  - ovl: check permission to open real file (Miklos Szeredi)  [Orabug: 32046372]  {CVE-2020-16120}
  - ovl: verify permissions in ovl_path_open() (Miklos Szeredi)  [Orabug: 32046372]  {CVE-2020-16120}
  - ovl: switch to mounter creds in readdir (Miklos Szeredi)  [Orabug: 32046372]  {CVE-2020-16120}
  - ovl: pass correct flags for opening real directory (Miklos Szeredi)  [Orabug: 32046372] 
  - A/A Bonding: Add synchronized bundle failback (Gerd Rausch)  [Orabug: 32381883]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.104.1.el8
changelog:
  - vhost scsi: alloc vhost_scsi with kvzalloc() to avoid delay (Dongli Zhang)  [Orabug: 32471677] 
  - HID: hid-input: fix stylus battery reporting (Dmitry Torokhov)  [Orabug: 32464784]  {CVE-2020-0431}
  - nbd: freeze the queue while we're adding connections (Josef Bacik)  [Orabug: 32447285]  {CVE-2021-3348}
  - futex: Handle faults correctly for PI futexes (Thomas Gleixner)  [Orabug: 32447187]  {CVE-2021-3347}
  - futex: Simplify fixup_pi_state_owner() (Thomas Gleixner)  [Orabug: 32447187]  {CVE-2021-3347}
  - futex: Use pi_state_update_owner() in put_pi_state() (Thomas Gleixner)  [Orabug: 32447187]  {CVE-2021-3347}
  - rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (Thomas Gleixner)  [Orabug: 32447187]  {CVE-2021-3347}
  - futex: Don't enable IRQs unconditionally in put_pi_state() (Dan Carpenter)  [Orabug: 32447187]  {CVE-2021-3347}
  - futex: Provide and use pi_state_update_owner() (Thomas Gleixner)  [Orabug: 32447187]  {CVE-2021-3347}
  - futex: Replace pointless printk in fixup_owner() (Thomas Gleixner)  [Orabug: 32447187]  {CVE-2021-3347}
  - futex: Ensure the correct return value from futex_lock_pi() (Thomas Gleixner)  [Orabug: 32447187]  {CVE-2021-3347}
  - uek-rpm: Enable Oracle Pilot BMC module (Eric Snowberg)  [Orabug: 32422662] 
  - hwmon: Add a new Oracle Pilot BMC driver (Eric Snowberg)  [Orabug: 32422662] 
  - arm64: Reserve only 256M on RPi for crashkernel=auto (Vijay Kumar)  [Orabug: 32301026]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.104.2.el8
changelog:
  - tcp: fix to update snd_wl1 in bulk receiver fast path (Neal Cardwell)  [Orabug: 32498822] 
  - selinux: allow reading labels before policy is loaded (Jonathan Lebon)  [Orabug: 32492277] 
  - selinux: allow labeling before policy is loaded (Jonathan Lebon)  [Orabug: 32492277] 
  - KVM: SVM: Initialize prev_ga_tag before use (Suravee Suthikulpanit)  [Orabug: 32478549] 
  - tools/power turbostat: Support additional CPU model numbers (Len Brown)  [Orabug: 32422451] 
  - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family (Tony Luck)  [Orabug: 32422451] 
  - x86/cpu: Add Sapphire Rapids CPU model number (Tony Luck)  [Orabug: 32422451] 
  - tools/power turbostat: Support Tiger Lake (Chen Yu)  [Orabug: 32422451] 
  - uek-rpm: config-aarch64: enable MEMORY HOTREMOVE (Mihai Carabas)  [Orabug: 32353851] 
  - arm64/mm/hotplug: Ensure early memory sections are all online (Anshuman Khandual)  [Orabug: 32353851] 
  - arm64/mm/hotplug: Enable MEM_OFFLINE event handling (Anshuman Khandual)  [Orabug: 32353851] 
  - arm64/mm/hotplug: Register boot memory hot remove notifier earlier (Anshuman Khandual)  [Orabug: 32353851] 
  - arm64/mm: Enable memory hot remove (Anshuman Khandual)  [Orabug: 32353851] 
  - arm64/mm: Hold memory hotplug lock while walking for kernel page table dump (Anshuman Khandual)  [Orabug: 32353851] 
  - KVM: arm64: Save/restore sp_el0 as part of __guest_enter (Marc Zyngier)  [Orabug: 32171445] 
  - net/mlx4_en: Handle TX error CQE (Moshe Shemesh)  [Orabug: 32492969] 
  - net/mlx4_en: Avoid scheduling restart task if it is already running (Moshe Shemesh)  [Orabug: 32492969]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.104.3.el8
changelog:
  - config: enable CONFIG_MLX5_MPFS (Brian Maly)  [Orabug: 32249042] 
  - net: Fix bridge enslavement failure (Ido Schimmel)  [Orabug: 32503298] 
  - inet: do not call sublist_rcv on empty list (Florian Westphal)  [Orabug: 32512814] 
  - KVM: arm64: pmu: Don't mark a counter as chained if the odd one is disabled (Eric Auger)  [Orabug: 32499188] 
  - random: wire /dev/random with a DRBG instance (Saeed Mirzamohammadi)  [Orabug: 32522087] 
  - crypto: drbg - always try to free Jitter RNG instance (Stephan Müller)  [Orabug: 32522087] 
  - crypto: drbg - always seeded with SP800-90B compliant noise source (Stephan Müller)  [Orabug: 32522087] 
  - crypto: jitter - SP800-90B compliance (Stephan Müller)  [Orabug: 32522087] 
  - crypto: jitter - add header to fix buildwarnings (Ben Dooks)  [Orabug: 32522087] 
  - crypto: jitter - fix comments (Alexander E. Patrakov)  [Orabug: 32522087] 
  - xen-blkback: fix error handling in xen_blkbk_map() (Jan Beulich)  [Orabug: 32492109]  {CVE-2021-26930}
  - xen-scsiback: don't "handle" error by BUG() (Jan Beulich)  [Orabug: 32492101]  {CVE-2021-26931}
  - xen-netback: don't "handle" error by BUG() (Jan Beulich)  [Orabug: 32492101]  {CVE-2021-26931}
  - xen-blkback: don't "handle" error by BUG() (Jan Beulich)  [Orabug: 32492101]  {CVE-2021-26931}
  - Xen/gntdev: correct error checking in gntdev_map_grant_pages() (Jan Beulich)  [Orabug: 32492093]  {CVE-2021-26932}
  - Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages() (Jan Beulich)  [Orabug: 32492093]  {CVE-2021-26932}
  - Xen/x86: also check kernel mapping in set_foreign_p2m_mapping() (Jan Beulich)  [Orabug: 32492093]  {CVE-2021-26932}
  - Xen/x86: don't bail early from clear_foreign_p2m_mapping() (Jan Beulich)  [Orabug: 32492093]  {CVE-2021-26932}


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2036.104.5.el8
changelog:
  - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech)  [Orabug: 32603379]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
  - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech)  [Orabug: 32603379]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
  - scsi: iscsi: Report connection state in sysfs (Gabriel Krisman Bertazi)  [Orabug: 32603379]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
  - sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output (Joe Perches)  [Orabug: 32603379]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
  - scsi: iscsi: Restrict sessions and handles to admin capabilities (Lee Duncan)  [Orabug: 32603379]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2102.200.4.el8
changelog:
  - Revert "rds: Deregister all FRWR mr with free_mr" (aru kolappan)  [Orabug: 32426609] 
  - thermal: intel_pch_thermal: Add PCI ids for Lewisburg PCH. (Andres Freund)  [Orabug: 32424704] 
  - thermal: intel: intel_pch_thermal: Add Cannon Lake Low Power PCH support (Sumeet Pawnikar)  [Orabug: 32424704] 
  - thermal: intel: intel_pch_thermal: Add Comet Lake (CML) platform support (Gayatri Kammela)  [Orabug: 32424704] 
  - KVM: x86: Expose AVX512_FP16 for supported CPUID (Cathy Zhang)  [Orabug: 32424461] 
  - x86/kvm: Expose TSX Suspend Load Tracking feature (Cathy Zhang)  [Orabug: 32424461] 
  - x86: Expose SERIALIZE for supported cpuid (Paolo Bonzini)  [Orabug: 32424461] 
  - KVM: x86: Expose fast short REP MOV for supported cpuid (Zhenyu Wang)  [Orabug: 32424461] 
  - KVM: x86: Expose AVX512 VP2INTERSECT in cpuid for TGL (Zhenyu Wang)  [Orabug: 32424461] 
  - x86: Enumerate AVX512 FP16 CPUID feature flag (Kyung Min Park)  [Orabug: 32424461] 
  - EDAC/i10nm: Add Intel Sapphire Rapids server support (Qiuxu Zhuo)  [Orabug: 32424461] 
  - EDAC/i10nm: Use readl() to access MMIO registers (Qiuxu Zhuo)  [Orabug: 32424461] 
  - EDAC: Add DDR5 new memory type (Qiuxu Zhuo)  [Orabug: 32424461] 
  - EDAC: Add three new memory types (Qiuxu Zhuo)  [Orabug: 32424461] 
  - x86/cpufeatures: Enumerate ENQCMD and ENQCMDS instructions (Fenghua Yu)  [Orabug: 32424461] 
  - x86/cpufeatures: Enumerate TSX suspend load address tracking instructions (Kyung Min Park)  [Orabug: 32424461] 
  - x86/cpufeatures: Add enumeration for SERIALIZE instruction (Ricardo Neri)  [Orabug: 32424461] 
  - x86/split_lock: Enable the split lock feature on Sapphire Rapids and Alder Lake CPUs (Fenghua Yu)  [Orabug: 32424461] 
  - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family (Tony Luck)  [Orabug: 32424461] 
  - x86/cpufeatures: Add Architectural LBRs feature bit (Kan Liang)  [Orabug: 32424461] 
  - powercap: intel_rapl: add support for Sapphire Rapids (Zhang Rui)  [Orabug: 32424461] 
  - x86/cpu: Add Sapphire Rapids CPU model number (Tony Luck)  [Orabug: 32424461] 
  - EDAC, {skx,i10nm}: Use CPU stepping macro to pass configurations (Qiuxu Zhuo)  [Orabug: 32424461] 
  - x86/cpu: Add a X86_MATCH_INTEL_FAM6_MODEL_STEPPINGS() macro (Borislav Petkov)  [Orabug: 32424461] 
  - powercap/intel_rapl: Convert to new X86 CPU match macros (Thomas Gleixner)  [Orabug: 32424461] 
  - powercap/intel_rapl: add support for TigerLake Mobile (Zhang Rui)  [Orabug: 32424461] 
  - powercap/intel_rapl: add support for JasperLake (Zhang Rui)  [Orabug: 32424461] 
  - x86/cpufeatures: Add support for fast short REP; MOVSB (Tony Luck)  [Orabug: 32424461] 
  - powercap/intel_rapl: add support for Cometlake desktop (Zhang Rui)  [Orabug: 32424461] 
  - powercap/intel_rapl: add support for CometLake Mobile (Zhang Rui)  [Orabug: 32424461] 
  - crypto: lib/chacha20poly1305 - define empty module exit function (Jason A. Donenfeld)  [Orabug: 32417868] 
  - A/A Bonding: Add synchronized bundle failback (Gerd Rausch)  [Orabug: 32381881]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2102.200.5.el8
changelog:
  - vhost scsi: alloc vhost_scsi with kvzalloc() to avoid delay (Dongli Zhang)  [Orabug: 32471659] 
  - arm64: Reserve only 256M on RPi for crashkernel=auto (Vijay Kumar)  [Orabug: 32454711] 
  - nbd: freeze the queue while we're adding connections (Josef Bacik)  [Orabug: 32447284]  {CVE-2021-3348}
  - futex: Handle faults correctly for PI futexes (Thomas Gleixner)  [Orabug: 32447185]  {CVE-2021-3347}
  - futex: Simplify fixup_pi_state_owner() (Thomas Gleixner)  [Orabug: 32447185]  {CVE-2021-3347}
  - futex: Use pi_state_update_owner() in put_pi_state() (Thomas Gleixner)  [Orabug: 32447185]  {CVE-2021-3347}
  - rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (Thomas Gleixner)  [Orabug: 32447185]  {CVE-2021-3347}
  - futex: Provide and use pi_state_update_owner() (Thomas Gleixner)  [Orabug: 32447185]  {CVE-2021-3347}
  - futex: Replace pointless printk in fixup_owner() (Thomas Gleixner)  [Orabug: 32447185]  {CVE-2021-3347}
  - futex: Ensure the correct return value from futex_lock_pi() (Thomas Gleixner)  [Orabug: 32447185]  {CVE-2021-3347}
  - uek-rpm: Enable Oracle Pilot BMC module (Eric Snowberg)  [Orabug: 32422661] 
  - hwmon: Add a new Oracle Pilot BMC driver (Eric Snowberg)  [Orabug: 32422661] 
  - rds: avoid crash on IB conn path shutdown prepare (Alan Maguire)  [Orabug: 32466763] 
  - mm/memcontrol: Increase threshold for draining per-cpu stocked bytes (Imran Khan)  [Orabug: 32314559]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2102.200.6.el8
changelog:
  - selinux: allow reading labels before policy is loaded (Jonathan Lebon)  [Orabug: 32492276] 
  - rds: tracepoints incorrectly reporting valid rds ping as drop (Alan Maguire)  [Orabug: 32490004] 
  - KVM: arm64: Save/restore sp_el0 as part of __guest_enter (Marc Zyngier)  [Orabug: 32488537] 
  - uek-rpm: config-aarch64: enable MEMORY HOTREMOVE (Mihai Carabas)  [Orabug: 32353873] 
  - arm64/mm/hotplug: Ensure early memory sections are all online (Anshuman Khandual)  [Orabug: 32353873] 
  - arm64/mm/hotplug: Enable MEM_OFFLINE event handling (Anshuman Khandual)  [Orabug: 32353873] 
  - arm64/mm/hotplug: Register boot memory hot remove notifier earlier (Anshuman Khandual)  [Orabug: 32353873] 
  - arm64/mm: Enable memory hot remove (Anshuman Khandual)  [Orabug: 32353873] 
  - arm64/mm: Hold memory hotplug lock while walking for kernel page table dump (Anshuman Khandual)  [Orabug: 32353873] 
  - rds: tracepoint-related KASAN: use-after-free Read in rds_send_xmit (Alan Maguire)  [Orabug: 32490030] 
  - inet: do not call sublist_rcv on empty list (Florian Westphal)  [Orabug: 32422895] 
  - net/mlx4_en: Handle TX error CQE (Moshe Shemesh)  [Orabug: 32485133] 
  - net/mlx4_en: Avoid scheduling restart task if it is already running (Moshe Shemesh)  [Orabug: 32485133] 
  - vdpa/mlx5: allow Jumbo MTU config other than standard sized MTU (Si-Wei Liu)  [Orabug: 32480078] 
  - vdpa/mlx5: should exclude header length and fcs from mtu (Si-Wei Liu)  [Orabug: 32480078] 
  - vdpa/mlx5: Fix memory key MTT population (Eli Cohen)  [Orabug: 32480078] 
  - vdpa: Use simpler version of ida allocation (Parav Pandit)  [Orabug: 32480078] 
  - vdpa: Add missing comment for virtqueue count (Parav Pandit)  [Orabug: 32480078] 
  - vdpa/mlx5: Use write memory barrier after updating CQ index (Eli Cohen)  [Orabug: 32480078] 
  - vdpa: remove unnecessary 'default n' in Kconfig entries (Stefano Garzarella)  [Orabug: 32480078] 
  - vhost_vdpa: switch to vmemdup_user() (Tian Tao)  [Orabug: 32480078] 
  - vhost_vdpa: return -EFAULT if copy_to_user() fails (Dan Carpenter)  [Orabug: 32480078] 
  - vdpa: mlx5: fix vdpa/vhost dependencies (Randy Dunlap)  [Orabug: 32480078] 
  - vdpa/mlx5: Setup driver only if VIRTIO_CONFIG_S_DRIVER_OK (Eli Cohen)  [Orabug: 32480078] 
  - vdpa/mlx5: Fix failure to bring link up (Eli Cohen)  [Orabug: 32480078] 
  - vdpa/mlx5: Make use of a specific 16 bit endianness API (Eli Cohen)  [Orabug: 32480078] 
  - vdpasim: fix "mac_pton" undefined error (Laurent Vivier)  [Orabug: 32480078] 
  - vdpasim: allow to assign a MAC address (Laurent Vivier)  [Orabug: 32480078] 
  - vdpasim: fix MAC address configuration (Laurent Vivier)  [Orabug: 32480078] 
  - vdpa: handle irq bypass register failure case (Zhu Lingshan)  [Orabug: 32480078] 
  - vdpa_sim: Fix DMA mask (Laurent Vivier)  [Orabug: 32480078] 
  - vdpa/mlx5: Fix error return in map_direct_mr() (Jing Xiangfeng)  [Orabug: 32480078] 
  - vhost_vdpa: Return -EFAULT if copy_from_user() fails (Dan Carpenter)  [Orabug: 32480078] 
  - vdpa_sim: implement get_iova_range() (Jason Wang)  [Orabug: 32480078] 
  - vhost: vdpa: report iova range (Jason Wang)  [Orabug: 32480078] 
  - vdpa: introduce config op to get valid iova range (Jason Wang)  [Orabug: 32480078] 
  - vhost_vdpa: remove unnecessary spin_lock in vhost_vring_call (Zhu Lingshan)  [Orabug: 32480078] 
  - vhost_vdpa: Fix duplicate included kernel.h (Tian Tao)  [Orabug: 32480078] 
  - rds: CONFIG_RDS_DEBUG + tracepoints breaks rds build (Alan Maguire)  [Orabug: 32442487] 
  - tools/power turbostat: Support additional CPU model numbers (Len Brown)  [Orabug: 32422450] 
  - tools/power turbostat: Support Tiger Lake (Chen Yu)  [Orabug: 32422450]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2102.200.7.el8
changelog:
  - KVM: arm64: pmu: Don't mark a counter as chained if the odd one is disabled (Eric Auger)  [Orabug: 32504832] 
  - xen-blkback: fix error handling in xen_blkbk_map() (Jan Beulich)  [Orabug: 32492108]  {CVE-2021-26930}
  - xen-scsiback: don't "handle" error by BUG() (Jan Beulich)  [Orabug: 32492100]  {CVE-2021-26931}
  - xen-netback: don't "handle" error by BUG() (Jan Beulich)  [Orabug: 32492100]  {CVE-2021-26931}
  - xen-blkback: don't "handle" error by BUG() (Jan Beulich)  [Orabug: 32492100]  {CVE-2021-26931}
  - Xen/gntdev: correct error checking in gntdev_map_grant_pages() (Jan Beulich)  [Orabug: 32492092]  {CVE-2021-26932}
  - Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages() (Jan Beulich)  [Orabug: 32492092]  {CVE-2021-26932}
  - Xen/x86: also check kernel mapping in set_foreign_p2m_mapping() (Jan Beulich)  [Orabug: 32492092]  {CVE-2021-26932}
  - Xen/x86: don't bail early from clear_foreign_p2m_mapping() (Jan Beulich)  [Orabug: 32492092]  {CVE-2021-26932}


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2102.200.8.el8
changelog:
  - config: enable CONFIG_MLX5_MPFS (Brian Maly)  [Orabug: 32522477] 
  - random: wire /dev/random with a DRBG instance (Saeed Mirzamohammadi)  [Orabug: 32522086] 
  - crypto: drbg - always try to free Jitter RNG instance (Stephan Müller)  [Orabug: 32522086] 
  - crypto: drbg - always seeded with SP800-90B compliant noise source (Stephan Müller)  [Orabug: 32522086] 
  - crypto: jitter - SP800-90B compliance (Stephan Müller)  [Orabug: 32522086] 
  - crypto: jitter - add header to fix buildwarnings (Ben Dooks)  [Orabug: 32522086] 
  - crypto: jitter - fix comments (Alexander E. Patrakov)  [Orabug: 32522086] 
  - Revert "RDMA/umem: Move to allocate SG table from pages" (John Donnelly)  [Orabug: 32481224] 
  - Revert "lib/scatterlist: Add support in dynamic allocation of SG table from pages" (John Donnelly)  [Orabug: 32481224] 
  - Revert "Maintainer: Fix build warning introduced in commit 99b99d76e6732" (John Donnelly)  [Orabug: 32481224]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2102.200.10.el8
changelog:
  - scsi: target: core: Make completion affinity configurable (Mike Christie)  [Orabug: 32403502] 
  - target: flush submission work during TMR processing (Mike Christie)  [Orabug: 32403502] 
  - target iblock: add backend plug/unplug callouts (Mike Christie)  [Orabug: 32403502] 
  - target: fix backend plugging (Mike Christie)  [Orabug: 32403502] 
  - target: cleanup cmd flag bits (Mike Christie)  [Orabug: 32403502] 
  - tcm loop: use lio wq cmd submission helper (Mike Christie)  [Orabug: 32403502] 
  - tcm loop: use blk cmd allocator for se_cmds (Mike Christie)  [Orabug: 32403502] 
  - vhost scsi: use lio wq cmd submission helper (Mike Christie)  [Orabug: 32403502] 
  - target: add workqueue based cmd submission (Mike Christie)  [Orabug: 32403502] 
  - target: add gfp_t arg to target_cmd_init_cdb (Mike Christie)  [Orabug: 32403502] 
  - target: remove target_submit_cmd_map_sgls (Mike Christie)  [Orabug: 32403502] 
  - tcm_fc: Convert to new submission API (Mike Christie)  [Orabug: 32403502] 
  - xen-scsiback: Convert to new submission API (Mike Christie)  [Orabug: 32403502] 
  - vhost-scsi: Convert to new submission API (Mike Christie)  [Orabug: 32403502] 
  - usb gadget: Convert to new submission API (Mike Christie)  [Orabug: 32403502] 
  - sbp_target: Convert to new submission API (Mike Christie)  [Orabug: 32403502] 
  - tcm_loop: Convert to new submission API (Mike Christie)  [Orabug: 32403502] 
  - qla2xxx: Convert to new submission API (Mike Christie)  [Orabug: 32403502] 
  - ibmvscsi_tgt: Convert to new submission API (Mike Christie)  [Orabug: 32403502] 
  - srpt: Convert to new submission API (Mike Christie)  [Orabug: 32403502] 
  - target: break up target_submit_cmd_map_sgls (Mike Christie)  [Orabug: 32403502] 
  - target: rename transport_init_se_cmd (Mike Christie)  [Orabug: 32403502] 
  - target: drop kref_get_unless_zero in target_get_sess_cmd (Mike Christie)  [Orabug: 32403502] 
  - target: move t_task_cdb initialization (Mike Christie)  [Orabug: 32403502] 
  - scsi: tcm_loop: Allow queues, can_queue and cmd_per_lun to be settable (Mike Christie)  [Orabug: 32403502] 
  - scsi: target: Make state_list per CPU (Mike Christie)  [Orabug: 32403502] 
  - scsi: target: Drop sess_cmd_lock from I/O path (Mike Christie)  [Orabug: 32403502] 
  - scsi: qla2xxx: Move sess cmd list/lock to driver (Mike Christie)  [Orabug: 32403502] 
  - scsi: target: Remove TARGET_SCF_LOOKUP_LUN_FROM_TAG (Mike Christie)  [Orabug: 32403502] 
  - scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG (Mike Christie)  [Orabug: 32403502] 
  - scsi: target: Fix cmd_count ref leak (Mike Christie)  [Orabug: 32403502] 
  - scsi: target: Fix LUN ref count handling (Mike Christie)  [Orabug: 32403502] 
  - scsi: target: Fix lun lookup for TARGET_SCF_LOOKUP_LUN_FROM_TAG case (Sudhakar Panneerselvam)  [Orabug: 32403502] 
  - scsi: target: Rename target_setup_cmd_from_cdb() to target_cmd_parse_cdb() (Sudhakar Panneerselvam)  [Orabug: 32403502] 
  - scsi: target: Fix NULL pointer dereference (Sudhakar Panneerselvam)  [Orabug: 32403502] 
  - scsi: target: Initialize LUN in transport_init_se_cmd() (Sudhakar Panneerselvam)  [Orabug: 32403502] 
  - scsi: target: Factor out a new helper, target_cmd_init_cdb() (Sudhakar Panneerselvam)  [Orabug: 32403502] 
  - mm: memcontrol: decouple reference counting from page accounting (Johannes Weiner)  [Orabug: 32424163] 
  - uek-rpm: add opbmc to nano-kernel (Eric Snowberg)  [Orabug: 32555675] 
  - rds: rds_drop_egress events should be enabled as part of RDS_RTD_SND (Alan Maguire)  [Orabug: 32587016] 
  - rds: use dedicated rds_send_lock_contention tracepoint instead of drop (Alan Maguire)  [Orabug: 32587016] 
  - rds: ensure saddr/daddr for tracepoints is not NULL (Alan Maguire)  [Orabug: 32580940] 
  - hsr: use netdev_err() instead of WARN_ONCE() (Taehee Yoo)  [Orabug: 32576070] 
  - PCI: hotplug: Add module parameter to allow user control of LEDs (Thomas Tai)  [Orabug: 32556980] 
  - net/rds: increase 1MB MR pool size for RDS (Manjunath Patil)  [Orabug: 32556086] 
  - block/diskstats: accumulate all per-cpu counters in one pass (Konstantin Khlebnikov)  [Orabug: 32531556] 
  - arm64/crash_core: fix TCR_EL1.T1SZ in vmcoreinfo (John Donnelly)  [Orabug: 32559514] 
  - x86/platform/uv: Fix UV4 hub revision adjustment (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Fix copied UV5 output archtype (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Drop last traces of uv_flush_tlb_others (Jiri Slaby)  [Orabug: 32527680] 
  - x86/tlb/uv: Add a forward declaration for struct flush_tlb_info (Borislav Petkov)  [Orabug: 32527680] 
  - x86/platform/uv: Recognize UV5 hubless system identifier (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Remove spaces from OEM IDs (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Fix missing OEM_TABLE_ID (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Update Copyrights to conform to HPE standards (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Update for UV5 NMI MMR changes (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Update UV5 TSC checking (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Update node present counting (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Update UV5 MMR references in UV GRU (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Adjust GAM MMR references affected by UV5 updates (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Update MMIOH references based on new UV5 MMRs (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Add and decode Arch Type in UVsystab (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Add UV5 direct references (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Update UV MMRs for UV5 (Mike Travis)  [Orabug: 32527680] 
  - drivers/misc/sgi-xp: Adjust references in UV kernel modules (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Remove SCIR MMR references for UV systems (Mike Travis)  [Orabug: 32527680] 
  - x86/platform/uv: Remove UV BAU TLB Shootdown Handler (Mike Travis)  [Orabug: 32527680] 
  - x86/apic/uv: Avoid unused variable warning (Arnd Bergmann)  [Orabug: 32527680] 
  - x86/platform/uv: Remove vestigial mention of UV1 platform from bios header (steve.wahl@hpe.com)  [Orabug: 32527680] 
  - x86/platform/uv: Remove support for UV1 platform from uv (steve.wahl@hpe.com)  [Orabug: 32527680] 
  - x86/platform/uv: Remove support for uv1 platform from uv_hub (steve.wahl@hpe.com)  [Orabug: 32527680] 
  - x86/platform/uv: Remove support for UV1 platform from uv_bau (steve.wahl@hpe.com)  [Orabug: 32527680] 
  - x86/platform/uv: Remove support for UV1 platform from uv_mmrs (steve.wahl@hpe.com)  [Orabug: 32527680] 
  - x86/platform/uv: Remove support for UV1 platform from x2apic_uv_x (steve.wahl@hpe.com)  [Orabug: 32527680] 
  - x86/platform/uv: Remove support for UV1 platform from uv_tlb (steve.wahl@hpe.com)  [Orabug: 32527680] 
  - x86/platform/uv: Remove support for UV1 platform from uv_time (steve.wahl@hpe.com)  [Orabug: 32527680] 
  - x86/platform/uv: Remove the unused _uv_cpu_blade_processor_id() macro (Christoph Hellwig)  [Orabug: 32527680] 
  - x86/platform/uv: Unexport uv_apicid_hibits (Christoph Hellwig)  [Orabug: 32527680] 
  - x86/platform/uv: Remove _uv_hub_info_check() (Christoph Hellwig)  [Orabug: 32527680] 
  - x86/platform/uv: Simplify uv_send_IPI_one() (Christoph Hellwig)  [Orabug: 32527680] 
  - x86/platform/uv: Remove the UV*_HUB_IS_SUPPORTED macros (Christoph Hellwig)  [Orabug: 32527680] 
  - x86/platform/uv: Remove the uv_partition_coherence_id() macro (Christoph Hellwig)  [Orabug: 32527680] 
  - x86/apic/uv: Remove code for unused distributed GRU mode (Steve Wahl)  [Orabug: 32527680] 
  - cper,edac,efi: Memory Error Record: bank group/address and chip id (Alex Kluver)  [Orabug: 32526741] 
  - edac,ghes,cper: Add Row Extension to Memory Error Record (Alex Kluver)  [Orabug: 32526741] 
  - perf/x86/intel/uncore: With > 8 nodes, get pci bus die id from NUMA info (Steve Wahl)  [Orabug: 32526200] 
  - perf/x86/intel/uncore: Store the logical die id instead of the physical die id. (Steve Wahl)  [Orabug: 32526200] 
  - perf/x86/intel/uncore: Generic support for the PCI sub driver (Kan Liang)  [Orabug: 32526200] 
  - perf/x86/intel/uncore: Factor out uncore_pci_pmu_unregister() (Kan Liang)  [Orabug: 32526200] 
  - perf/x86/intel/uncore: Factor out uncore_pci_pmu_register() (Kan Liang)  [Orabug: 32526200] 
  - perf/x86/intel/uncore: Factor out uncore_pci_find_dev_pmu() (Kan Liang)  [Orabug: 32526200] 
  - perf/x86/intel/uncore: Factor out uncore_pci_get_dev_die_info() (Kan Liang)  [Orabug: 32526200]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2102.200.11.el8
changelog:
  - mm/vmscan: fix infinite loop in drop_slab_node (Chunxin Zang)  [Orabug: 32620155] 
  - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech)  [Orabug: 32603378]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
  - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech)  [Orabug: 32603378]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
  - scsi: iscsi: Report connection state in sysfs (Gabriel Krisman Bertazi)  [Orabug: 32603378]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
  - sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output (Joe Perches)  [Orabug: 32603378]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
  - scsi: iscsi: Restrict sessions and handles to admin capabilities (Lee Duncan)  [Orabug: 32603378]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
  - drm/nouveau: bail out of nouveau_channel_new if channel init fails (Frantisek Hrbata)  [Orabug: 32591559]  {CVE-2020-25639}
  - mm: support memblock alloc on the exact node for sparse_buffer_init() (Yunfeng Ye)  [Orabug: 32613823] 
  - mm/sparse.c: do not waste pre allocated memmap space (Michal Hocko)  [Orabug: 32613823] 
  - mm/sparse: consistently do not zero memmap (Vincent Whitchurch)  [Orabug: 32613823]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2102.200.12.el8
changelog:
  - Revert "x86/platform/uv: Update UV MMRs for UV5" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Add UV5 direct references" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Add and decode Arch Type in UVsystab" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Update MMIOH references based on new UV5 MMRs" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Adjust GAM MMR references affected by UV5 updates" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Update UV5 MMR references in UV GRU" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Update node present counting" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Update UV5 TSC checking" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Update for UV5 NMI MMR changes" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Update Copyrights to conform to HPE standards" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Fix missing OEM_TABLE_ID" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Remove spaces from OEM IDs" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Recognize UV5 hubless system identifier" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/tlb/uv: Add a forward declaration for struct flush_tlb_info" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Drop last traces of uv_flush_tlb_others" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Fix copied UV5 output archtype" (Jack Vogel)  [Orabug: 32651197] 
  - Revert "x86/platform/uv: Fix UV4 hub revision adjustment" (Jack Vogel)  [Orabug: 32651197]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2102.200.13.el8
changelog:
  - bpf, selftests: Fix up some test_verifier cases for unprivileged (Piotr Krysiuk)  [Orabug: 32656761]  {CVE-2020-27170} {CVE-2020-27171}
  - bpf: Add sanity check for upper ptr_limit (Piotr Krysiuk)  [Orabug: 32656761]  {CVE-2020-27170} {CVE-2020-27171}
  - bpf: Simplify alu_limit masking for pointer arithmetic (Piotr Krysiuk)  [Orabug: 32656761]  {CVE-2020-27170} {CVE-2020-27171}
  - bpf: Fix off-by-one for area size in creating mask to left (Piotr Krysiuk)  [Orabug: 32656761]  {CVE-2020-27170} {CVE-2020-27171}
  - bpf: Prohibit alu ops for pointer types not defining ptr_limit (Piotr Krysiuk)  [Orabug: 32656761]  {CVE-2020-27170} {CVE-2020-27171}
  - selftests/bpf: Test access to bpf map pointer (Andrey Ignatov)  [Orabug: 32656761]  {CVE-2020-27170} {CVE-2020-27171}
  - bpf: Fix truncation handling for mod32 dst reg wrt zero (Daniel Borkmann)  [Orabug: 32673813]  {CVE-2021-3444}
  - bpf: Fix 32 bit src register truncation on div/mod (Daniel Borkmann)  [Orabug: 32673813]  {CVE-2021-3444}


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2102.201.1.el8
changelog:
  - IB/mlx5: Reduce max order of memory allocated for xlt update (Praveen Kumar Kannoju)  [Orabug: 32751624] 
  - netfilter: x_tables: Use correct memory barriers. (Mark Tomlinson)  [Orabug: 32709120]  {CVE-2021-29650}
  - perf/x86/intel: Fix a crash caused by zero PEBS status (Kan Liang)  [Orabug: 32669468]  {CVE-2021-28971}
  - btrfs: fix race when cloning extent buffer during rewind of an old root (Filipe Manana)  [Orabug: 32669450]  {CVE-2021-28964}
  - uek-rpm: Update SecureBoot Digicert 2021 certificates (Jack Vogel)  [Orabug: 32532663] 
  - RDMA/rxe:  ipc_bench fails on SoftRoCE with shpd (Rao Shoaib)  [Orabug: 32716155] 
  - vhost-vdpa: set v->config_ctx to NULL if eventfd_ctx_fdget() fails (Stefano Garzarella)  [Orabug: 32696005]  {CVE-2021-29266}
  - vhost-vdpa: fix use-after-free of v->config_ctx (Stefano Garzarella)  [Orabug: 32696005]  {CVE-2021-29266}
  - fuse: fix live lock in fuse_iget() (Amir Goldstein)  [Orabug: 32669269]  {CVE-2021-28950}
  - fuse: fix bad inode (Miklos Szeredi)  [Orabug: 32669269]  {CVE-2021-28950}
  - RDMA/core: Fix corrupted SL on passive side (Håkon Bugge)  [Orabug: 32662965] 
  - Xen/gnttab: handle p2m update errors on a per-slot basis (Jan Beulich)  [Orabug: 32651473]  {CVE-2021-28038}
  - RDMA/rxe: Compute the maximum sges and inline size based on the WQE size (Rao Shoaib)  [Orabug: 32648060] 
  - KVM: kvmclock: Fix vCPUs > 64 can't be online/hotpluged (Wanpeng Li)  [Orabug: 32641672] 
  - xen/netback: avoid race in xenvif_rx_ring_slots_available() (Juergen Gross)  [Orabug: 32640116] 
  - uek-rpm: ol7: aarch64: add CONFIG_ACPI_HOTPLUG_MEMORY (Mihai Carabas)  [Orabug: 32638660] 
  - KVM: SVM: Disable AVIC before setting V_IRQ (Suravee Suthikulpanit)  [Orabug: 32603569] 
  - KVM: Introduce kvm_make_all_cpus_request_except() (Suravee Suthikulpanit)  [Orabug: 32603569] 
  - KVM: X86: correct meaningless kvm_apicv_activated() check (Paolo Bonzini)  [Orabug: 32603569] 
  - KVM: Disable preemption in kvm_get_running_vcpu() (Marc Zyngier)  [Orabug: 32603569] 
  - KVM: Move running VCPU from ARM to common code (Paolo Bonzini)  [Orabug: 32603569] 
  - xen-blkback: don't leak persistent grants from xen_blkbk_map() (Jan Beulich)  [Orabug: 32697850]  {CVE-2021-28688}
  - video: hyperv_fb: Fix the mmap() regression for v5.4.y and older (Dexuan Cui)  [Orabug: 32651461]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2102.201.2.el8
changelog:
  - md/bitmap: wait for external bitmap writes to complete during tear down (Sudhakar Panneerselvam)  [Orabug: 32764237] 
  - ocfs2: fix deadlock between setattr and dio_end_io_write (Wengang Wang)  [Orabug: 32763849] 
  - tcp: do not mess with cloned skbs in tcp_add_backlog() (Eric Dumazet)  [Orabug: 32760314] 
  - Revert "x86/vmlinux: Use INT3 instead of NOP for linker fill bytes" (John Donnelly)  [Orabug: 32576398]  {CVE-2021-3411}
  - iommu/vt-d: Fix agaw for a supported 48 bit guest address width (Saeed Mirzamohammadi)  [Orabug: 32734148] 
  - LTS tag: v5.4.85 (Jack Vogel)  
  - x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled (Xiaochen Shen)  
  - x86/resctrl: Remove unused struct mbm_state::chunks_bw (James Morse)  
  - membarrier: Explicitly sync remote cores when SYNC_CORE is requested (Andy Lutomirski)  
  - Revert "selftests/ftrace: check for do_sys_openat2 in user-memory test" (Kamal Mostafa)  
  - KVM: mmu: Fix SPTE encoding of MMIO generation upper half (Maciej S. Szmigiero)  
  - serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access (Alexander Sverdlin)  
  - ALSA: pcm: oss: Fix potential out-of-bounds shift (Takashi Iwai)  
  - USB: sisusbvga: Make console support depend on BROKEN (Thomas Gleixner)  
  - USB: UAS: introduce a quirk to set no_write_same (Oliver Neukum)  
  - xhci-pci: Allow host runtime PM as default for Intel Alpine Ridge LP (Hans de Goede)  
  - xhci: Give USB2 ports time to enter U3 in bus suspend (Li Jun)  
  - ALSA: usb-audio: Fix control 'access overflow' errors from chmap (Takashi Iwai)  
  - ALSA: usb-audio: Fix potential out-of-bounds shift (Takashi Iwai)  
  - USB: add RESET_RESUME quirk for Snapscan 1212 (Oliver Neukum)  
  - USB: dummy-hcd: Fix uninitialized array use in init() (Bui Quang Minh)  
  - ktest.pl: If size of log is too big to email, email error message (Steven Rostedt (VMware))  
  - net: stmmac: delete the eee_ctrl_timer after napi disabled (Fugang Duan)  
  - net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux (Martin Blumenstingl)  
  - net: ll_temac: Fix potential NULL dereference in temac_probe() (Zhang Changzhong)  
  - lan743x: fix for potential NULL pointer dereference with bare card (Sergej Bauer)  
  - tcp: fix cwnd-limited bug for TSO deferral where we send nothing (Neal Cardwell)  
  - tcp: select sane initial rcvq_space.space for big MSS (Eric Dumazet)  
  - net: stmmac: free tx skb buffer in stmmac_resume() (Fugang Duan)  
  - bridge: Fix a deadlock when enabling multicast snooping (Joseph Huang)  
  - enetc: Fix reporting of h/w packet counters (Claudiu Manoil)  
  - udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments (Xin Long)  
  - net: hns3: remove a misused pragma packed (Huazhong Tan)  
  - vrf: packets with lladdr src needs dst at input with orig_iif when needs strict (Stephen Suryaputra)  
  - net: bridge: vlan: fix error return code in __vlan_add() (Zhang Changzhong)  
  - mac80211: mesh: fix mesh_pathtbl_init() error path (Eric Dumazet)  
  - ipv4: fix error return code in rtm_to_fib_config() (Zhang Changzhong)  
  - ptrace: Prevent kernel-infoleak in ptrace_get_syscall_info() (Peilin Ye)  
  - LTS tag: v5.4.84 (Jack Vogel)  
  - compiler.h: fix barrier_data() on clang (Arvind Sankar)  
  - mm/zsmalloc.c: drop ZSMALLOC_PGTABLE_MAPPING (Minchan Kim)  
  - x86/apic/vector: Fix ordering in vector assignment (Thomas Gleixner)  
  - x86/membarrier: Get rid of a dubious optimization (Andy Lutomirski)  
  - x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP (Arvind Sankar)  
  - scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()" (Dan Carpenter)  
  - proc: use untagged_addr() for pagemap_read addresses (Miles Chen)  
  - kbuild: avoid static_assert for genksyms (Arnd Bergmann)  
  - drm/i915/display/dp: Compute the correct slice count for VDSC on DP (Manasi Navare)  
  - mmc: block: Fixup condition for CMD13 polling for RPMB requests (Bean Huo)  
  - pinctrl: amd: remove debounce filter setting in IRQ type setting (Coiby Xu)  
  - Input: i8042 - add Acer laptops to the i8042 reset list (Chris Chiu)  
  - Input: cm109 - do not stomp on control URB (Dmitry Torokhov)  
  - ktest.pl: Fix incorrect reboot for grub2bls (Libo Chen)  
  - can: m_can: m_can_dev_setup(): add support for bosch mcan version 3.3.0 (Pankaj Sharma)  
  - platform/x86: touchscreen_dmi: Add info for the Irbis TW118 tablet (Hans de Goede)  
  - platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC (Max Verevkin)  
  - platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE (Timo Witte)  
  - platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for Thinkpad Yoga 11e 4th gen (Hans de Goede)  
  - platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e (Hans de Goede)  
  - arm64: tegra: Disable the ACONNECT for Jetson TX2 (Jon Hunter)  
  - soc: fsl: dpio: Get the cpumask through cpumask_of(cpu) (Hao Si)  
  - spi: spi-nxp-fspi: fix fspi panic by unexpected interrupts (Ran Wang)  
  - irqchip/gic-v3-its: Unconditionally save/restore the ITS state on suspend (Xu Qiang)  
  - ibmvnic: skip tx timeout reset while in resetting (Lijun Pan)  
  - interconnect: qcom: qcs404: Remove GPU and display RPM IDs (Georgi Djakov)  
  - scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE (Can Guo)  
  - ARC: stack unwinding: don't assume non-current task is sleeping (Vineet Gupta)  
  - arm64: dts: broadcom: clear the warnings caused by empty dma-ranges (Zhen Lei)  
  - powerpc: Drop -me200 addition to build flags (Michael Ellerman)  
  - iwlwifi: mvm: fix kernel panic in case of assert during CSA (Sara Sharon)  
  - iwlwifi: pcie: set LTR to avoid completion timeout (Johannes Berg)  
  - arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards. (Markus Reichl)  
  - iwlwifi: pcie: limit memory read spin time (Johannes Berg)  
  - x86/lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S (Fangrui Song)  
  - Kbuild: do not emit debug info for assembly with LLVM_IAS=1 (Nick Desaulniers)


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2102.202.0.el8
changelog:
  - LTS tag: v5.4.86 (Jack Vogel)  
  - x86/CPU/AMD: Save AMD NodeId as cpu_die_id (Yazen Ghannam)  
  - Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS" (Steven Rostedt (VMware))  
  - rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time (Nikita Shubin)  
  - regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x (DingHua Ma)  
  - PCI: Fix pci_slot_release() NULL pointer dereference (Jubin Zhong)  
  - platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12 (Carlos Garnacho)  
  - libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels (Dan Williams)  
  - dma-buf/dma-resv: Respect num_fences when initializing the shared fence list. (Maarten Lankhorst)  
  - device-dax/core: Fix memory leak when rmmod dax.ko (Wang Hai)  
  - clk: tegra: Do not return 0 on failure (Nicolin Chen)  
  - clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9 (Terry Zhou)  
  - clk: ingenic: Fix divider calculation with div tables (Paul Cercueil)  
  - pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler (Yangtao Li)  
  - md/cluster: fix deadlock when node is doing resync job (Zhao Heming)  
  - md/cluster: block reshape with remote resync job (Zhao Heming)  
  - iio:adc:ti-ads124s08: Fix alignment and data leak issues. (Jonathan Cameron)  
  - iio:adc:ti-ads124s08: Fix buffer being too long. (Jonathan Cameron)  
  - iio:imu:bmi160: Fix too large a buffer. (Jonathan Cameron)  
  - iio:pressure:mpl3115: Force alignment of buffer (Jonathan Cameron)  
  - iio:magnetometer:mag3110: Fix alignment and data leak issues. (Jonathan Cameron)  
  - iio:light:st_uvis25: Fix timestamp alignment and prevent data leak. (Jonathan Cameron)  
  - iio:light:rpr0521: Fix timestamp alignment and prevent data leak. (Jonathan Cameron)  
  - iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume (Qinglang Miao)  
  - iio: buffer: Fix demux update (Nuno Sá)  
  - scsi: qla2xxx: Fix crash during driver load on big endian machines (Arun Easi)  
  - mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments (Sergei Antonov)  
  - mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read (Praveenkumar I)  
  - mtd: parser: cmdline: Fix parsing of part-names with colons (Sven Eckelmann)  
  - mtd: spinand: Fix OOB read (Miquel Raynal)  
  - soc: qcom: smp2p: Safely acquire spinlock without IRQs (Evan Green)  
  - spi: atmel-quadspi: Fix AHB memory accesses (Tudor Ambarus)  
  - spi: atmel-quadspi: Disable clock in probe error path (Lukas Wunner)  
  - spi: mt7621: Don't leak SPI master in probe error path (Lukas Wunner)  
  - spi: mt7621: Disable clock in probe error path (Lukas Wunner)  
  - spi: synquacer: Disable clock in probe error path (Lukas Wunner)  
  - spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path (Lukas Wunner)  
  - spi: sc18is602: Don't leak SPI master in probe error path (Lukas Wunner)  
  - spi: rb4xx: Don't leak SPI master in probe error path (Lukas Wunner)  
  - spi: pic32: Don't leak DMA channels in probe error path (Lukas Wunner)  
  - spi: mxic: Don't leak SPI master in probe error path (Lukas Wunner)  
  - spi: gpio: Don't leak SPI master in probe error path (Lukas Wunner)  
  - spi: fsl: fix use of spisel_boot signal on MPC8309 (Rasmus Villemoes)  
  - spi: davinci: Fix use-after-free on unbind (Lukas Wunner)  
  - spi: atmel-quadspi: Fix use-after-free on unbind (Lukas Wunner)  
  - spi: spi-sh: Fix use-after-free on unbind (Lukas Wunner)  
  - spi: pxa2xx: Fix use-after-free on unbind (Lukas Wunner)  
  - drm/i915: Fix mismatch between misplaced vma check and vma insert (Chris Wilson)  
  - drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() (Zwane Mwaikambo)  
  - drm/amd/display: Fix memory leaks in S3 resume (Stylon Wang)  
  - platform/x86: mlx-platform: remove an unused variable (Arnd Bergmann)  
  - jfs: Fix array index bounds check in dbAdjTree (Dave Kleikamp)  
  - jffs2: Fix ignoring mounting options problem during remounting (lizhe)  
  - jffs2: Fix GC exit abnormally (Zhe Li)  
  - ubifs: wbuf: Don't leak kernel memory to flash (Richard Weinberger)  
  - SMB3: avoid confusing warning message on mount to Azure (Steve French)  
  - ceph: fix race in concurrent __ceph_remove_cap invocations (Luis Henriques)  
  - um: Remove use of asprinf in umid.c (Anton Ivanov)  
  - ima: Don't modify file descriptor mode on the fly (Roberto Sassu)  
  - powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently (David Hildenbrand)  
  - powerpc/powernv/memtrace: Don't leak kernel memory to user space (David Hildenbrand)  
  - powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU (Alexey Kardashevskiy)  
  - powerpc/mm: Fix verification of MMU_FTR_TYPE_44x (Christophe Leroy)  
  - powerpc/8xx: Fix early debug when SMC1 is relocated (Christophe Leroy)  
  - powerpc/xmon: Change printk() to pr_cont() (Christophe Leroy)  
  - powerpc/feature: Add CPU_FTR_NOEXECUTE to G2_LE (Christophe Leroy)  
  - powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter (Tyrel Datwyler)  
  - powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at (Mathieu Desnoyers)  
  - xprtrdma: Fix XDRBUF_SPARSE_PAGES support (Chuck Lever)  
  - ARM: dts: at91: sama5d2: fix CAN message ram offset and size (Nicolas Ferre)  
  - ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES (H. Nikolaus Schaller)  
  - KVM: arm64: Introduce handling of AArch32 TTBCR2 traps (Marc Zyngier)  
  - ext4: fix deadlock with fs freezing and EA inodes (Jan Kara)  
  - ext4: fix a memory leak of ext4_free_data (Chunguang Xu)  
  - btrfs: trim: fix underflow in trim length to prevent access beyond device boundary (Qu Wenruo)  
  - btrfs: do not shorten unpin len for caching block groups (Josef Bacik)  
  - USB: serial: keyspan_pda: fix write unthrottling (Johan Hovold)  
  - USB: serial: keyspan_pda: fix tx-unthrottle use-after-free (Johan Hovold)  
  - USB: serial: keyspan_pda: fix write-wakeup use-after-free (Johan Hovold)  
  - USB: serial: keyspan_pda: fix stalled writes (Johan Hovold)  
  - USB: serial: keyspan_pda: fix write deadlock (Johan Hovold)  
  - USB: serial: keyspan_pda: fix dropped unthrottle interrupts (Johan Hovold)  
  - USB: serial: digi_acceleport: fix write-wakeup deadlocks (Johan Hovold)  
  - USB: serial: mos7720: fix parallel-port state restore (Johan Hovold)  
  - EDAC/amd64: Fix PCI component registration (Borislav Petkov)  
  - crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata (Ard Biesheuvel)  
  - crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() (Ard Biesheuvel)  
  - powerpc/perf: Exclude kernel samples while counting events in user space. (Athira Rajeev)  
  - perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake (Kan Liang)  
  - perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY (Kan Liang)  
  - staging: comedi: mf6x4: Fix AI end-of-conversion detection (Ian Abbott)  
  - ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams (Takashi Iwai)  
  - binder: add flag to clear buffer on txn complete (Todd Kjos)  
  - s390/dasd: fix list corruption of lcu list (Stefan Haberland)  
  - s390/dasd: fix list corruption of pavgroup group list (Stefan Haberland)  
  - s390/dasd: prevent inconsistent LCU device data (Stefan Haberland)  
  - s390/dasd: fix hanging device offline processing (Stefan Haberland)  
  - s390/kexec_file: fix diag308 subcode when loading crash kernel (Philipp Rudo)  
  - s390/smp: perform initial CPU reset also for SMT siblings (Sven Schnelle)  
  - ALSA: core: memalloc: add page alignment for iram (Robin Gong)  
  - ALSA: usb-audio: Disable sample read check if firmware doesn't give back (Takashi Iwai)  
  - ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices (Amadej Kastelic)  
  - ALSA: hda/realtek: Apply jack fixup for Quanta NL3 (Chris Chiu)  
  - ALSA: hda/realtek: Add quirk for MSI-GP73 (Takashi Iwai)  
  - ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G (Chris Chiu)  
  - ALSA: pcm: oss: Fix a few more UBSAN fixes (Takashi Iwai)  
  - ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button (Kailang Yang)  
  - ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (Chris Chiu)  
  - ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 (Chris Chiu)  
  - ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop (Hui Wang)  
  - ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg. (Connor McAdams)  
  - ALSA: hda: Fix regressions on clear and reconfig sysfs (Takashi Iwai)  
  - ACPI: PNP: compare the string length in the matching_id() (Hui Wang)  
  - Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" (Daniel Scally)  
  - PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() (Rafael J. Wysocki)  
  - ALSA: hda/ca0132 - Change Input Source enum strings. (Connor McAdams)  
  - Input: cyapa_gen6 - fix out-of-bounds stack access (Arnd Bergmann)  
  - media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE (Sakari Ailus)  
  - media: ipu3-cio2: Validate mbus format in setting subdev format (Sakari Ailus)  
  - media: ipu3-cio2: Serialise access to pad format (Sakari Ailus)  
  - media: ipu3-cio2: Return actual subdev format (Sakari Ailus)  
  - media: ipu3-cio2: Remove traces of returned buffers (Sakari Ailus)  
  - media: netup_unidvb: Don't leak SPI master in probe error path (Lukas Wunner)  
  - media: sunxi-cir: ensure IR is handled when it is continuous (Sean Young)  
  - media: gspca: Fix memory leak in probe (Alan Stern)  
  - vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU (Alexey Kardashevskiy)  
  - Input: goodix - add upside-down quirk for Teclast X98 Pro tablet (Simon Beginn)  
  - initramfs: fix clang build failure (Arnd Bergmann)  
  - Input: cros_ec_keyb - send 'scancodes' in addition to key events (Dmitry Torokhov)  
  - drm/amdkfd: Fix leak in dmabuf import (Felix Kuehling)  
  - drm/amd/display: Prevent bandwidth overflow (Chris Park)  
  - lwt: Disable BH too in run_lwt_bpf() (Dongdong Wang)  
  - fix namespaced fscaps when !CONFIG_SECURITY (Serge Hallyn)  
  - cfg80211: initialize rekey_data (Sara Sharon)  
  - ARM: sunxi: Add machine match for the Allwinner V3 SoC (Paul Kocialkowski)  
  - perf probe: Fix memory leak when synthesizing SDT probes (Arnaldo Carvalho de Melo)  
  - kconfig: fix return value of do_error_if() (Masahiro Yamada)  
  - clk: sunxi-ng: Make sure divider tables have sentinel (Jernej Skrabec)  
  - clk: s2mps11: Fix a resource leak in error handling paths in the probe function (Christophe JAILLET)  
  - clk: at91: sam9x60: remove atmel,osc-bypass support (Alexandre Belloni)  
  - virtio_ring: Fix two use after free bugs (Dan Carpenter)  
  - virtio_net: Fix error code in probe() (Dan Carpenter)  
  - virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed() (Dan Carpenter)  
  - qlcnic: Fix error code in probe (Dan Carpenter)  
  - perf record: Fix memory leak when using '--user-regs=?' to list registers (Zheng Zengkai)  
  - pwm: lp3943: Dynamically allocate PWM chip base (Lokesh Vutla)  
  - pwm: zx: Add missing cleanup in error path (Uwe Kleine-König)  
  - clk: ti: Fix memleak in ti_fapll_synth_setup (Zhang Qilong)  
  - watchdog: coh901327: add COMMON_CLK dependency (Arnd Bergmann)  
  - watchdog: qcom: Avoid context switch in restart handler (Manivannan Sadhasivam)  
  - libnvdimm/label: Return -ENXIO for no slot in __blk_label_update (Zhang Qilong)  
  - net: korina: fix return value (Vincent Stehlé)  
  - net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function (Christophe JAILLET)  
  - net: bcmgenet: Fix a resource leak in an error handling path in the probe functin (Christophe JAILLET)  
  - lan743x: fix rx_napi_poll/interrupt ping-pong (Sven Van Asbroeck)  
  - checkpatch: fix unescaped left brace (Dwaipayan Ray)  
  - mm: don't wake kswapd prematurely when watermark boosting is disabled (Johannes Weiner)  
  - sparc: fix handling of page table constructor failure (Matthew Wilcox (Oracle))  
  - powerpc/ps3: use dma_mapping_error() (Vincent Stehlé)  
  - nfc: s3fwrn5: Release the nfc firmware (Bongsu Jeon)  
  - RDMA/cma: Don't overwrite sgid_attr after device is released (Leon Romanovsky)  
  - sunrpc: fix xs_read_xdr_buf for partial pages receive (Dan Aloni)  
  - um: chan_xterm: Fix fd leak (Anton Ivanov)  
  - um: tty: Fix handling of close in tty lines (Anton Ivanov)  
  - um: Monitor error events in IRQ controller (Anton Ivanov)  
  - ubifs: Fix error return code in ubifs_init_authentication() (Wang ShaoBo)  
  - watchdog: Fix potential dereferencing of null pointer (Wang Wensheng)  
  - watchdog: sprd: check busy bit before new loading rather than after that (Lingling Xu)  
  - watchdog: sprd: remove watchdog disable from resume fail path (Lingling Xu)  
  - watchdog: sirfsoc: Add missing dependency on HAS_IOMEM (Guenter Roeck)  
  - watchdog: armada_37xx: Add missing dependency on HAS_IOMEM (Guenter Roeck)  
  - irqchip/alpine-msi: Fix freeing of interrupts on allocation error path (Marc Zyngier)  
  - ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control() (Dan Carpenter)  
  - mac80211: don't set set TDLS STA bandwidth wider than possible (Johannes Berg)  
  - crypto: atmel-i2c - select CONFIG_BITREVERSE (Arnd Bergmann)  
  - extcon: max77693: Fix modalias string (Marek Szyprowski)  
  - mtd: rawnand: gpmi: Fix the random DMA timeout issue (Han Xu)  
  - mtd: rawnand: meson: Fix a resource leak in init (Dan Carpenter)  
  - mtd: rawnand: gpmi: fix reference count leak in gpmi ops (Zhang Qilong)  
  - clk: tegra: Fix duplicated SE clock entry (Dmitry Osipenko)  
  - remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio() (Zhang Changzhong)  
  - remoteproc: qcom: fix reference leak in adsp_start (Zhang Qilong)  
  - remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable (Zhang Qilong)  
  - RDMA/core: Do not indicate device ready when device enablement fails (Jack Morgenstein)  
  - can: m_can: m_can_config_endisable(): remove double clearing of clock stop request bit (Sean Nyekjaer)  
  - erofs: avoid using generic_block_bmap (Huang Jianan)  
  - iwlwifi: mvm: hook up missing RX handlers (Johannes Berg)  
  - s390/cio: fix use-after-free in ccw_device_destroy_console (Qinglang Miao)  
  - bus: fsl-mc: fix error return code in fsl_mc_object_allocate() (Zhang Changzhong)  
  - platform/chrome: cros_ec_spi: Don't overwrite spi::mode (Stephen Boyd)  
  - x86/kprobes: Restore BTF if the single-stepping is cancelled (Masami Hiramatsu)  
  - nfs_common: need lock during iterate through the list (Cheng Lin)  
  - nfsd: Fix message level for normal termination (kazuo ito)  
  - speakup: fix uninitialized flush_lock (Yang Yingliang)  
  - usb: oxu210hp-hcd: Fix memory leak in oxu_create (Zhang Qilong)  
  - usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe (Zhang Qilong)  
  - powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S (Christophe Leroy)  
  - ASoC: amd: change clk_get() to devm_clk_get() and add missed checks (Chuhong Yuan)  
  - drm/mediatek: avoid dereferencing a null hdmi_phy on an error message (Colin Ian King)  
  - powerpc/pseries/hibernation: remove redundant cacheinfo update (Nathan Lynch)  
  - powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops (Nathan Lynch)  
  - platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems (Vadim Pasternak)  
  - scsi: fnic: Fix error return code in fnic_probe() (Zhang Changzhong)  
  - seq_buf: Avoid type mismatch for seq_buf_init (Arnd Bergmann)  
  - scsi: pm80xx: Fix error return in pm8001_pci_probe() (Zhang Qilong)  
  - scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe (Qinglang Miao)  
  - arm64: dts: meson: g12a: x96-max: fix PHY deassert timing requirements (Stefan Agner)  
  - ARM: dts: meson: fix PHY deassert timing requirements (Stefan Agner)  
  - arm64: dts: meson: fix PHY deassert timing requirements (Stefan Agner)  
  - Bluetooth: btmtksdio: Add the missed release_firmware() in mtk_setup_firmware() (Jing Xiangfeng)  
  - Bluetooth: btusb: Add the missed release_firmware() in btusb_mtk_setup_firmware() (Jing Xiangfeng)  
  - cpufreq: scpi: Add missing MODULE_ALIAS (Pali Rohár)  
  - cpufreq: loongson1: Add missing MODULE_ALIAS (Pali Rohár)  
  - cpufreq: sun50i: Add missing MODULE_DEVICE_TABLE (Pali Rohár)  
  - cpufreq: st: Add missing MODULE_DEVICE_TABLE (Pali Rohár)  
  - cpufreq: qcom: Add missing MODULE_DEVICE_TABLE (Pali Rohár)  
  - cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE (Pali Rohár)  
  - cpufreq: highbank: Add missing MODULE_DEVICE_TABLE (Pali Rohár)  
  - cpufreq: ap806: Add missing MODULE_DEVICE_TABLE (Pali Rohár)  
  - clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI (Keqian Zhu)  
  - clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne (Keqian Zhu)  
  - phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure (Wang Li)  
  - dm ioctl: fix error return code in target_message (Qinglang Miao)  
  - ASoC: jz4740-i2s: add missed checks for clk_get() (Chuhong Yuan)  
  - net/mlx5: Properly convey driver version to firmware (Leon Romanovsky)  
  - MIPS: Don't round up kernel sections size for memblock_add() (Alexander Sverdlin)  
  - memstick: r592: Fix error return in r592_probe() (Jing Xiangfeng)  
  - arm64: dts: rockchip: Fix UART pull-ups on rk3328 (Chen-Yu Tsai)  
  - pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() (Yu Kuai)  
  - bpf: Fix bpf_put_raw_tracepoint()'s use of __module_address() (Andrii Nakryiko)  
  - ARM: dts: at91: sama5d2: map securam as device (Claudiu Beznea)  
  - iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context (Lars-Peter Clausen)  
  - clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent() (Yu Kuai)  
  - clocksource/drivers/orion: Add missing clk_disable_unprepare() on error path (Yang Yingliang)  
  - powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S (Jordan Niethe)  
  - powerpc/perf: Fix crash with is_sier_available when pmu is not set (Athira Rajeev)  
  - media: saa7146: fix array overflow in vidioc_s_audio() (Dan Carpenter)  
  - hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable (Zhang Qilong)  
  - vfio-pci: Use io_remap_pfn_range() for PCI IO memory (Jason Gunthorpe)  
  - selftests/seccomp: Update kernel config (Mickaël Salaün)  
  - NFS: switch nfsiod to be an UNBOUND workqueue. (NeilBrown)  
  - net: sunrpc: Fix 'snprintf' return value check in 'do_xprt_debugfs' (Fedor Tokarev)  
  - NFSv4: Fix the alignment of page data in the getdeviceinfo reply (Trond Myklebust)  
  - SUNRPC: xprt_load_transport() needs to support the netid "rdma6" (Trond Myklebust)  
  - NFSv4.2: condition READDIR's mask for security label based on LSM state (Olga Kornievskaia)  
  - SUNRPC: rpc_wake_up() should wake up tasks in the correct order (Trond Myklebust)  
  - ath10k: Release some resources in an error handling path (Christophe JAILLET)  
  - ath10k: Fix an error handling path (Christophe JAILLET)  
  - ath10k: Fix the parsing error in service available event (Rakesh Pillai)  
  - platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init (Qinglang Miao)  
  - ARM: dts: at91: at91sam9rl: fix ADC triggers (Alexandre Belloni)  
  - soc: amlogic: canvas: add missing put_device() call in meson_canvas_get() (Yu Kuai)  
  - arm64: dts: meson-sm1: fix typo in opp table (Dongjin Kim)  
  - arm64: dts: meson: fix spi-max-frequency on Khadas VIM2 (Artem Lapkin)  
  - PCI: iproc: Fix out-of-bound array accesses (Bharat Gooty)  
  - PCI: Fix overflow in command-line resource alignment requests (Colin Ian King)  
  - PCI: Bounds-check command-line resource alignment requests (Bjorn Helgaas)  
  - arm64: dts: qcom: c630: Polish i2c-hid devices (Bjorn Andersson)  
  - arm64: dts: ls1028a: fix ENETC PTP clock input (Michael Walle)  
  - genirq/irqdomain: Don't try to free an interrupt that has no mapping (Marc Zyngier)  
  - power: supply: bq24190_charger: fix reference leak (Zhang Qilong)  
  - power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching (Hans de Goede)  
  - arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc (Chen-Yu Tsai)  
  - arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name (Marek Behún)  
  - ARM: dts: Remove non-existent i2c1 from 98dx3236 (Chris Packham)  
  - HSI: omap_ssi: Don't jump to free ID in ssi_add_controller() (Jing Xiangfeng)  
  - slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI (Bjorn Andersson)  
  - media: max2175: fix max2175_set_csm_mode() error code (Dan Carpenter)  
  - mips: cdmm: fix use-after-free in mips_cdmm_bus_discover (Qinglang Miao)  
  - media: imx214: Fix stop streaming (Daniel Gomez)  
  - samples: bpf: Fix lwt_len_hist reusing previous BPF map (Daniel T. Lee)  
  - platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration (Vadim Pasternak)  
  - platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration (Vadim Pasternak)  
  - media: siano: fix memory leak of debugfs members in smsdvb_hotplug (Keita Suzuki)  
  - arm64: tegra: Fix DT binding for IO High Voltage entry (Vidya Sagar)  
  - dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe() (Zhihao Cheng)  
  - cw1200: fix missing destroy_workqueue() on error in cw1200_init_common (Qinglang Miao)  
  - rsi: fix error return code in rsi_reset_card() (Zhang Changzhong)  
  - qtnfmac: fix error return code in qtnf_pcie_probe() (Wang Hai)  
  - orinoco: Move context allocation after processing the skb (Sebastian Andrzej Siewior)  
  - mmc: pxamci: Fix error return code in pxamci_probe (Zhihao Cheng)  
  - ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host (Cristian Birsan)  
  - ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host (Cristian Birsan)  
  - memstick: fix a double-free bug in memstick_check (Qinglang Miao)  
  - RDMA/cxgb4: Validate the number of CQEs (Kamal Heib)  
  - clk: meson: Kconfig: fix dependency for G12A (Kevin Hilman)  
  - Input: omap4-keypad - fix runtime PM error handling (Zhang Qilong)  
  - drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe (Zhihao Cheng)  
  - soc: ti: Fix reference imbalance in knav_dma_probe (Zhang Qilong)  
  - soc: ti: knav_qmss: fix reference leak in knav_queue_probe (Zhang Qilong)  
  - spi: fix resource leak for drivers without .remove callback (Uwe Kleine-König)  
  - crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe (Zhang Qilong)  
  - crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd (Nathan Chancellor)  
  - EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId (Yazen Ghannam)  
  - powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 (Christophe Leroy)  
  - powerpc: Avoid broken GCC __attribute__((optimize)) (Ard Biesheuvel)  
  - selftests/bpf: Fix broken riscv build (Björn Töpel)  
  - spi: mxs: fix reference leak in mxs_spi_probe (Zhang Qilong)  
  - usb/max3421: fix return error code in max3421_probe() (Yang Yingliang)  
  - Input: ads7846 - fix unaligned access on 7845 (Dmitry Torokhov)  
  - Input: ads7846 - fix integer overflow on Rt calculation (Oleksij Rempel)  
  - Input: ads7846 - fix race that causes missing releases (David Jander)  
  - drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() (Yang Yingliang)  
  - video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init() (Yang Yingliang)  
  - media: solo6x10: fix missing snd_card_free in error handling case (Qinglang Miao)  
  - scsi: core: Fix VPD LUN ID designator priorities (Martin Wilck)  
  - ASoC: meson: fix COMPILE_TEST error (Jerome Brunet)  
  - media: v4l2-fwnode: Return -EINVAL for invalid bus-type (Lad Prabhakar)  
  - media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_enc_pm() (Yu Kuai)  
  - media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm() (Yu Kuai)  
  - media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_dec_pm() (Yu Kuai)  
  - media: tm6000: Fix sizeof() mismatches (Colin Ian King)  
  - staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c (Jing Xiangfeng)  
  - staging: greybus: codecs: Fix reference counter leak in error handling (Zhang Qilong)  
  - crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() (Jack Xu)  
  - MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA (Necip Fazil Yildiran)  
  - RDMa/mthca: Work around -Wenum-conversion warning (Arnd Bergmann)  
  - ASoC: arizona: Fix a wrong free in wm8997_probe (Zhang Qilong)  
  - spi: sprd: fix reference leak in sprd_spi_remove (Zhang Qilong)  
  - ASoC: wm8998: Fix PM disable depth imbalance on error (Zhang Qilong)  
  - selftest/bpf: Add missed ip6ip6 test back (Hangbin Liu)  
  - mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure (Tsuchiya Yuto)  
  - spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume (Qinglang Miao)  
  - spi: tegra114: fix reference leak in tegra spi ops (Zhang Qilong)  
  - spi: tegra20-sflash: fix reference leak in tegra_sflash_resume (Zhang Qilong)  
  - spi: tegra20-slink: fix reference leak in slink ops of tegra20 (Zhang Qilong)  
  - spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe (Qinglang Miao)  
  - spi: spi-ti-qspi: fix reference leak in ti_qspi_setup (Zhang Qilong)  
  - Bluetooth: hci_h5: fix memory leak in h5_close (Anant Thazhemadam)  
  - Bluetooth: Fix null pointer dereference in hci_event_packet() (Anmol Karn)  
  - arm64: dts: exynos: Correct psci compatible used on Exynos7 (Paweł Chmiel)  
  - arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7 (Paweł Chmiel)  
  - brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free} (Seung-Woo Kim)  
  - spi: stm32: fix reference leak in stm32_spi_resume (Zhang Qilong)  
  - selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling (Paul Moore)  
  - ASoC: pcm: DRAIN support reactivation (Cezary Rojewski)  
  - spi: spi-mem: fix reference leak in spi_mem_access_start (Zhang Qilong)  
  - drm/msm/dsi_pll_10nm: restore VCO rate during restore_state (Dmitry Baryshkov)  
  - f2fs: call f2fs_get_meta_page_retry for nat page (Jaegeuk Kim)  
  - spi: img-spfi: fix reference leak in img_spfi_resume (Zhang Qilong)  
  - powerpc/64: Set up a kernel stack for secondaries before cpu_restore() (Jordan Niethe)  
  - drm/amdgpu: fix build_coefficients() argument (Arnd Bergmann)  
  - ARM: dts: aspeed: tiogapass: Remove vuart (Vijay Khemka)  
  - ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode (Clément Péron)  
  - crypto: inside-secure - Fix sizeof() mismatch (Colin Ian King)  
  - crypto: talitos - Fix return type of current_desc_hdr() (Christophe Leroy)  
  - crypto: talitos - Endianess in current_desc_hdr() (Christophe Leroy)  
  - drm/amdgpu: fix incorrect enum type (Arnd Bergmann)  
  - sched: Reenable interrupts in do_sched_yield() (Thomas Gleixner)  
  - sched/deadline: Fix sched_dl_global_validate() (Peng Liu)  
  - x86/apic: Fix x2apic enablement without interrupt remapping (David Woodhouse)  
  - ARM: p2v: fix handling of LPAE translation in BE mode (Ard Biesheuvel)  
  - x86/mm/ident_map: Check for errors from ident_pud_init() (Arvind Sankar)  
  - RDMA/rxe: Compute PSN windows correctly (Bob Pearson)  
  - ARM: dts: aspeed: s2600wf: Fix VGA memory region location (Joel Stanley)  
  - selinux: fix error initialization in inode_doinit_with_dentry() (Tianyue Ren)  
  - rtc: pcf2127: fix pcf2127_nvmem_read/write() returns (Dan Carpenter)  
  - RDMA/bnxt_re: Set queue pair state when being queried (Kamal Heib)  
  - Revert "i2c: i2c-qcom-geni: Fix DMA transfer race" (Douglas Anderson)  
  - soc: qcom: geni: More properly switch to DMA mode (Douglas Anderson)  
  - soc: mediatek: Check if power domains can be powered on at boot time (Nicolas Boichat)  
  - soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains() (Dan Carpenter)  
  - arm64: dts: renesas: cat875: Remove rxc-skew-ps from ethernet-phy node (Biju Das)  
  - arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from ethernet-phy node (Biju Das)  
  - drm/tve200: Fix handling of platform_get_irq() error (Krzysztof Kozlowski)  
  - drm/mcde: Fix handling of platform_get_irq() error (Krzysztof Kozlowski)  
  - drm/aspeed: Fix Kconfig warning & subsequent build errors (Randy Dunlap)  
  - drm/gma500: fix double free of gma_connector (Tom Rix)  
  - md: fix a warning caused by a race between concurrent md_ioctl()s (Dae R. Jeong)  
  - crypto: af_alg - avoid undefined behavior accessing salg_name (Eric Biggers)  
  - media: msi2500: assign SPI bus number dynamically (Antti Palosaari)  
  - quota: Sanity-check quota file headers on load (Jan Kara)  
  - Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() (Peilin Ye)  
  - serial_core: Check for port state when tty is in error state (Alexey Kardashevskiy)  
  - HID: i2c-hid: add Vero K147 to descriptor override (Julian Sax)  
  - scsi: megaraid_sas: Check user-provided offsets (Arnd Bergmann)  
  - coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf() (Sai Prakash Ranjan)  
  - coresight: tmc-etr: Fix barrier packet insertion for perf buffer (Suzuki K Poulose)  
  - coresight: tmc-etr: Check if page is valid before dma_map_page() (Mao Jinlong)  
  - coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf() (Sai Prakash Ranjan)  
  - ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU (Krzysztof Kozlowski)  
  - ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 (Krzysztof Kozlowski)  
  - ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU (Krzysztof Kozlowski)  
  - usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul (Fabio Estevam)  
  - USB: gadget: f_rndis: fix bitrate for SuperSpeed and above (Will McVicker)  
  - usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus (Jack Pham)  
  - USB: gadget: f_midi: setup SuperSpeed Plus descriptors (Will McVicker)  
  - USB: gadget: f_acm: add support for SuperSpeed Plus (taehyun.cho)  
  - USB: serial: option: add interface-number sanity check to flag handling (Johan Hovold)  
  - usb: mtu3: fix memory corruption in mtu3_debugfs_regset() (Dan Carpenter)  
  - soc/tegra: fuse: Fix index bug in get_process_id (Nicolin Chen)  
  - kbuild: avoid split lines in .mod files (Masahiro Yamada)  
  - perf/x86/intel: Check PEBS status correctly (Stephane Eranian)  
  - drm/amd/display: Init clock value by current vbios CLKs (Brandon Syu)  
  - iwlwifi: pcie: add one missing entry for AX210 (Luca Coelho)  
  - dm table: Remove BUG_ON(in_interrupt()) (Thomas Gleixner)  
  - scsi: mpt3sas: Increase IOCInit request timeout to 30s (Sreekanth Reddy)  
  - vxlan: Copy needed_tailroom from lowerdev (Sven Eckelmann)  
  - vxlan: Add needed_headroom for lower device (Sven Eckelmann)  
  - arm64: syscall: exit userspace before unmasking exceptions (Mark Rutland)  
  - habanalabs: put devices before driver removal (Ofir Bitton)  
  - drm/tegra: sor: Disable clocks on error in tegra_sor_init() (Qinglang Miao)  
  - kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling (Nicholas Piggin)  
  - drm/tegra: replace idr_init() by idr_init_base() (Deepak R Varma)  
  - net: mvpp2: add mvpp2_phylink_to_port() helper (Russell King)  
  - selftests: fix poll error in udpgro.sh (Paolo Abeni)  
  - ixgbe: avoid premature Rx buffer reuse (Björn Töpel)  
  - i40e: avoid premature Rx buffer reuse (Björn Töpel)  
  - i40e: optimise prefetch page refcount (Li RongQing)  
  - i40e: Refactor rx_bi accesses (Björn Töpel)  
  - RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait (Leon Romanovsky)  
  - selftests/bpf/test_offload.py: Reset ethtool features after failed setting (Toke Høiland-Jørgensen)  
  - netfilter: nft_ct: Remove confirmation check for NFT_CT_ID (Brett Mastbergen)  
  - gpio: eic-sprd: break loop when getting NULL device resource (Chunyan Zhang)  
  - Revert "gpio: eic-sprd: Use devm_platform_ioremap_resource()" (Baolin Wang)  
  - afs: Fix memory leak when mounting with multiple source parameters (David Howells)  
  - netfilter: nft_dynset: fix timeouts later than 23 days (Pablo Neira Ayuso)  
  - netfilter: nft_compat: make sure xtables destructors have run (Florian Westphal)  
  - netfilter: x_tables: Switch synchronization to RCU (Subash Abhinov Kasiviswanathan)  
  - pinctrl: aspeed: Fix GPIO requests on pass-through banks (Andrew Jeffery)  
  - blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason to kick (Douglas Anderson)  
  - block: factor out requeue handling from dispatch code (Johannes Thumshirn)  
  - block: Simplify REQ_OP_ZONE_RESET_ALL handling (Damien Le Moal)  
  - clk: renesas: r9a06g032: Drop __packed for portability (Geert Uytterhoeven)  
  - can: softing: softing_netdev_open(): fix error handling (Zhang Qilong)  
  - xsk: Replace datagram_poll by sock_poll_wait (Xuan Zhuo)  
  - xsk: Fix xsk_poll()'s return type (Luc Van Oostenryck)  
  - scsi: bnx2i: Requires MMU (Randy Dunlap)  
  - gpio: mvebu: fix potential user-after-free on probe (Baruch Siach)  
  - gpio: zynq: fix reference leak in zynq_gpio functions (Qinglang Miao)  
  - PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter (Zhang Qilong)  
  - ARM: dts: imx6qdl-kontron-samx6i: fix I2C_PM scl pin (Bernd Bauer)  
  - ARM: dts: imx6qdl-wandboard-revd1: Remove PAD_GPIO_6 from enetgrp (Fabio Estevam)  
  - ARM: dts: sun7i: pcduino3-nano: enable RGMII RX/TX delay on PHY (Adam Sampson)  
  - ARM: dts: sun8i: v3s: fix GIC node memory range (Icenowy Zheng)  
  - pinctrl: baytrail: Avoid clearing debounce value when turning it off (Andy Shevchenko)  
  - pinctrl: merrifield: Set default bias in case no particular value given (Andy Shevchenko)  
  - ARM: dts: sun8i: v40: bananapi-m2-berry: Fix ethernet node (Pablo Greco)  
  - ARM: dts: sun8i: r40: bananapi-m2-berry: Fix dcdc1 regulator (Pablo Greco)  
  - RAS/CEC: Correct ce_add_elem()'s returned values (William Roche)  [Orabug: 32774757] 
  - bpf, x86: Validate computation of branch displacements for x86-64 (Piotr Krysiuk)  [Orabug: 32759959]  {CVE-2021-29154}
  - KVM: SVM: avoid infinite loop on NPF from bad address (John Donnelly)  [Orabug: 32759746]  {CVE-2020-36310}
  - uek-rpm: Add Amazon Elastic Network Adapter module to nano rpm. (Somasundaram Krishnasamy)  [Orabug: 32795492]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2102.202.1.el8
changelog:
  - LTS tag: v5.4.90 (Jack Vogel)  
  - regmap: debugfs: Fix a reversed if statement in regmap_debugfs_init() (Dan Carpenter)  
  - net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet (Vasily Averin)  
  - block: fix use-after-free in disk_part_iter_next (Ming Lei)  
  - KVM: arm64: Don't access PMCR_EL0 when no PMU is available (Marc Zyngier)  
  - net: mvpp2: disable force link UP during port init procedure (Stefan Chulski)  
  - regulator: qcom-rpmh-regulator: correct hfsmps515 definition (Dmitry Baryshkov)  
  - wan: ds26522: select CONFIG_BITREVERSE (Arnd Bergmann)  
  - regmap: debugfs: Fix a memory leak when calling regmap_attach_dev (Xiaolei Wang)  
  - net/mlx5e: Fix two double free cases (Dinghao Liu)  
  - net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups (Dinghao Liu)  
  - iommu/intel: Fix memleak in intel_irq_remapping_alloc (Dinghao Liu)  
  - lightnvm: select CONFIG_CRC32 (Arnd Bergmann)  
  - block: rsxx: select CONFIG_CRC32 (Arnd Bergmann)  
  - wil6210: select CONFIG_CRC32 (Arnd Bergmann)  
  - qed: select CONFIG_CRC32 (Arnd Bergmann)  
  - dmaengine: xilinx_dma: fix mixed_enum_type coverity warning (Shravya Kumbham)  
  - dmaengine: xilinx_dma: fix incompatible param warning in _child_probe() (Shravya Kumbham)  
  - dmaengine: xilinx_dma: check dma_async_device_register return value (Shravya Kumbham)  
  - dmaengine: mediatek: mtk-hsdma: Fix a resource leak in the error handling path of the probe function (Christophe JAILLET)  
  - i2c: i801: Fix the i2c-mux gpiod_lookup_table not being properly terminated (Hans de Goede)  
  - spi: stm32: FIFO threshold level - fix align packet size (Roman Guskov)  
  - cpufreq: powernow-k8: pass policy rather than use cpufreq_cpu_get() (Colin Ian King)  
  - can: kvaser_pciefd: select CONFIG_CRC32 (Arnd Bergmann)  
  - can: m_can: m_can_class_unregister(): remove erroneous m_can_clk_stop() (Marc Kleine-Budde)  
  - can: tcan4x5x: fix bittiming const, use common bittiming from m_can driver (Marc Kleine-Budde)  
  - dmaengine: dw-edma: Fix use after free in dw_edma_alloc_chunk() (Dan Carpenter)  
  - i2c: sprd: use a specific timeout to avoid system hang up issue (Chunyan Zhang)  
  - ARM: OMAP2+: omap_device: fix idling of devices during probe (Andreas Kemnade)  
  - HID: wacom: Fix memory leakage caused by kfifo_alloc (Ping Cheng)  
  - iio: imu: st_lsm6dsx: fix edge-trigger interrupts (Lorenzo Bianconi)  
  - vmlinux.lds.h: Add PGO and AutoFDO input sections (Nick Desaulniers)  
  - exfat: Month timestamp metadata accidentally incremented (Valdis Kletnieks)  
  - x86/resctrl: Don't move a task to the same resource group (Fenghua Yu)  
  - x86/resctrl: Use an IPI instead of task_work_add() to update PQR_ASSOC MSR (Fenghua Yu)  
  - chtls: Fix chtls resources release sequence (Ayush Sawal)  
  - chtls: Added a check to avoid NULL pointer dereference (Ayush Sawal)  
  - chtls: Replace skb_dequeue with skb_peek (Ayush Sawal)  
  - chtls: Fix panic when route to peer not configured (Ayush Sawal)  
  - chtls: Remove invalid set_tcb call (Ayush Sawal)  
  - chtls: Fix hardware tid leak (Ayush Sawal)  
  - net/mlx5e: ethtool, Fix restriction of autoneg with 56G (Aya Levin)  
  - net/mlx5: Use port_num 1 instead of 0 when delete a RoCE address (Mark Zhang)  
  - net: dsa: lantiq_gswip: Exclude RMII from modes that report 1 GbE (Aleksander Jan Bajkowski)  
  - s390/qeth: fix L2 header access in qeth_l3_osa_features_check() (Julian Wiedmann)  
  - nexthop: Unlink nexthop group entry in error path (Ido Schimmel)  
  - nexthop: Fix off-by-one error in error path (Ido Schimmel)  
  - octeontx2-af: fix memory leak of lmac and lmac->name (Colin Ian King)  
  - net: ip: always refragment ip defragmented packets (Florian Westphal)  
  - net: fix pmtu check in nopmtudisc mode (Florian Westphal)  
  - tools: selftests: add test for changing routes with PTMU exceptions (Sean Tranchetti)  
  - net: ipv6: fib: flush exceptions when purging route (Sean Tranchetti)  
  - net/sonic: Fix some resource leaks in error handling paths (Christophe JAILLET)  
  - net: vlan: avoid leaks on register_vlan_dev() failures (Jakub Kicinski)  
  - net: stmmac: dwmac-sun8i: Balance internal PHY power (Samuel Holland)  
  - net: stmmac: dwmac-sun8i: Balance internal PHY resource references (Samuel Holland)  
  - net: hns3: fix a phy loopback fail issue (Yonglong Liu)  
  - net: hns3: fix the number of queues actually used by ARQ (Yufeng Mo)  
  - net: cdc_ncm: correct overhead in delayed_ndp_size (Jouni K. Seppänen)  
  - vfio iommu: Add dma available capability (Matthew Rosato)  
  - x86/asm/32: Add ENDs to some functions and relabel with SYM_CODE_* (Jiri Slaby)  
  - LTS tag: v5.4.89 (Jack Vogel)  
  - scsi: target: Fix XCOPY NAA identifier lookup (David Disseldorp)   {CVE-2020-28374}
  - KVM: x86: fix shift out of bounds reported by UBSAN (Paolo Bonzini)  
  - x86/mtrr: Correct the range check before performing MTRR type lookups (Ying-Tsun Huang)  
  - netfilter: nft_dynset: report EOPNOTSUPP on missing set feature (Pablo Neira Ayuso)  
  - netfilter: xt_RATEEST: reject non-null terminated string from userspace (Florian Westphal)  
  - netfilter: ipset: fix shift-out-of-bounds in htable_bits() (Vasily Averin)  
  - netfilter: x_tables: Update remaining dereference to RCU (Subash Abhinov Kasiviswanathan)  
  - drm/i915: clear the gpu reloc batch (Matthew Auld)  
  - dmabuf: fix use-after-free of dmabuf's file->f_inode (Charan Teja Reddy)  
  - Revert "device property: Keep secondary firmware node secondary by type" (Bard Liao)  
  - btrfs: send: fix wrong file path when there is an inode with a pending rmdir (Filipe Manana)  
  - ALSA: hda/realtek: Add two "Intel Reference board" SSID in the ALC256. (PeiSen Hou)  
  - ALSA: hda/realtek: Enable mute and micmute LED on HP EliteBook 850 G7 (Kai-Heng Feng)  
  - ALSA: hda/realtek - Fix speaker volume control on Lenovo C940 (Kailang Yang)  
  - ALSA: hda/conexant: add a new hda codec CX11970 (bo liu)  
  - ALSA: hda/via: Fix runtime PM for Clevo W35xSS (Takashi Iwai)  
  - kvm: check tlbs_dirty directly (Lai Jiangshan)  
  - x86/mm: Fix leak of pmd ptlock (Dan Williams)  
  - USB: serial: keyspan_pda: remove unused variable (Johan Hovold)  
  - usb: gadget: configfs: Fix use-after-free issue with udc_name (Eddie Hung)  
  - usb: gadget: configfs: Preserve function ordering after bind failure (Chandana Kishori Chiluveru)  
  - usb: gadget: Fix spinlock lockup on usb_function_deactivate (Sriharsha Allenki)  
  - USB: gadget: legacy: fix return error code in acm_ms_bind() (Yang Yingliang)  
  - usb: gadget: u_ether: Fix MTU size mismatch with RX packet size (Manish Narani)  
  - usb: gadget: function: printer: Fix a memory leak for interface descriptor (Zqiang)  
  - usb: gadget: f_uac2: reset wMaxPacketSize (Jerome Brunet)  
  - usb: gadget: select CONFIG_CRC32 (Arnd Bergmann)  
  - ALSA: usb-audio: Fix UBSAN warnings for MIDI jacks (Takashi Iwai)  
  - USB: usblp: fix DMA to stack (Johan Hovold)  
  - USB: yurex: fix control-URB timeout handling (Johan Hovold)  
  - USB: serial: option: add Quectel EM160R-GL (Bjørn Mork)  
  - USB: serial: option: add LongSung M5710 module support (Daniel Palmer)  
  - USB: serial: iuu_phoenix: fix DMA from stack (Johan Hovold)  
  - usb: uas: Add PNY USB Portable SSD to unusual_uas (Thinh Nguyen)  
  - usb: usbip: vhci_hcd: protect shift size (Randy Dunlap)  
  - USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set (Michael Grzeschik)  
  - usb: chipidea: ci_hdrc_imx: add missing put_device() call in usbmisc_get_init_data() (Yu Kuai)  
  - usb: dwc3: ulpi: Use VStsDone to detect PHY regs access completion (Serge Semin)  
  - USB: cdc-wdm: Fix use after free in service_outstanding_interrupt(). (Tetsuo Handa)  
  - USB: cdc-acm: blacklist another IR Droid device (Sean Young)  
  - usb: gadget: enable super speed plus (taehyun.cho)  
  - staging: mt7621-dma: Fix a resource leak in an error handling path (Christophe JAILLET)  
  - powerpc: Handle .text.{hot,unlikely}.* in linker script (Nathan Chancellor)  
  - crypto: asym_tpm: correct zero out potential secrets (Greg Kroah-Hartman)  
  - crypto: ecdh - avoid buffer overflow in ecdh_set_secret() (Ard Biesheuvel)  
  - Bluetooth: revert: hci_h5: close serdev device and free hu in h5_close (Hans de Goede)  
  - kbuild: don't hardcode depmod path (Dominique Martinet)  
  - net/sched: sch_taprio: ensure to reset/destroy all child qdiscs (Davide Caratti)  
  - ionic: account for vlan tag len in rx buffer len (Shannon Nelson)  
  - vhost_net: fix ubuf refcount incorrectly when sendmsg fails (Yunjian Wang)  
  - net: usb: qmi_wwan: add Quectel EM160R-GL (Bjørn Mork)  
  - CDC-NCM: remove "connected" log message (Roland Dreier)  
  - net: dsa: lantiq_gswip: Fix GSWIP_MII_CFG(p) register access (Martin Blumenstingl)  
  - net: dsa: lantiq_gswip: Enable GSWIP_MII_CFG_EN also for internal PHYs (Martin Blumenstingl)  
  - r8169: work around power-saving bug on some chip versions (Heiner Kallweit)  
  - net: hdlc_ppp: Fix issues when mod_timer is called while timer is running (Xie He)  
  - erspan: fix version 1 check in gre_parse_header() (Cong Wang)  
  - net: hns: fix return value check in __lb_other_process() (Yunjian Wang)  
  - net: sched: prevent invalid Scell_log shift count (Randy Dunlap)  
  - ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst() (Guillaume Nault)  
  - net: mvpp2: fix pkt coalescing int-threshold configuration (Stefan Chulski)  
  - tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS (Yunjian Wang)  
  - net: ethernet: ti: cpts: fix ethtool output when no ptp_clock registered (Grygorii Strashko)  
  - net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc (Antoine Tenart)  
  - net-sysfs: take the rtnl lock when storing xps_rxqs (Antoine Tenart)  
  - net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc (Antoine Tenart)  
  - net-sysfs: take the rtnl lock when storing xps_cpus (Antoine Tenart)  
  - net: ethernet: Fix memleak in ethoc_probe (Dinghao Liu)  
  - net/ncsi: Use real net-device for response handler (John Wang)  
  - virtio_net: Fix recursive call to cpus_read_lock() (Jeff Dike)  
  - qede: fix offload for IPIP tunnel packets (Manish Chopra)  
  - net: ethernet: mvneta: Fix error handling in mvneta_probe (Dinghao Liu)  
  - ibmvnic: continue fatal error reset after passive init (Lijun Pan)  
  - net: mvpp2: Fix GoP port 3 Networking Complex Control configurations (Stefan Chulski)  
  - atm: idt77252: call pci_disable_device() on error path (Dan Carpenter)  
  - ethernet: ucc_geth: set dev->max_mtu to 1518 (Rasmus Villemoes)  
  - ethernet: ucc_geth: fix use-after-free in ucc_geth_remove() (Rasmus Villemoes)  
  - net: systemport: set dev->max_mtu to UMAC_MAX_MTU_SIZE (Florian Fainelli)  
  - net: mvpp2: prs: fix PPPoE with ipv6 packet parse (Stefan Chulski)  
  - net: mvpp2: Add TCAM entry to drop flow control pause frames (Stefan Chulski)  
  - iavf: fix double-release of rtnl_lock (Jakub Kicinski)  
  - i40e: Fix Error I40E_AQ_RC_EINVAL when removing VFs (Sylwester Dziedziuch)  
  - proc: fix lookup in /proc/net subdirectories after setns(2) (Alexey Dobriyan)  
  - proc: change ->nlink under proc_subdir_lock (Alexey Dobriyan)  
  - depmod: handle the case of /sbin/depmod without /sbin in PATH (Linus Torvalds)  
  - lib/genalloc: fix the overflow when size is too big (Huang Shijie)  
  - scsi: scsi_transport_spi: Set RQF_PM for domain validation commands (Bart Van Assche)  
  - scsi: ide: Do not set the RQF_PREEMPT flag for sense requests (Bart Van Assche)  
  - scsi: ufs-pci: Ensure UFS device is in PowerDown mode for suspend-to-disk ->poweroff() (Adrian Hunter)  
  - scsi: ufs: Fix wrong print message in dev_err() (Bean Huo)  
  - workqueue: Kick a worker based on the actual activation of delayed works (Yunfeng Ye)  
  - LTS tag: v5.4.88 (Jack Vogel)  
  - exec: Transform exec_update_mutex into a rw_semaphore (Eric W. Biederman)  
  - rwsem: Implement down_read_interruptible (Eric W. Biederman)  
  - rwsem: Implement down_read_killable_nested (Eric W. Biederman)  
  - perf: Break deadlock involving exec_update_mutex (peterz@infradead.org)  
  - iio:imu:bmi160: Fix alignment and data leak issues (Jonathan Cameron)  
  - kdev_t: always inline major/minor helper functions (Josh Poimboeuf)  
  - dmaengine: at_hdmac: add missing kfree() call in at_dma_xlate() (Yu Kuai)  
  - dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate() (Yu Kuai)  
  - dmaengine: at_hdmac: Substitute kzalloc with kmalloc (Tudor Ambarus)  
  - Revert "mtd: spinand: Fix OOB read" (Felix Fietkau)  
  - Revert "drm/amd/display: Fix memory leaks in S3 resume" (Alex Deucher)  
  - LTS tag: v5.4.87 (Jack Vogel)  
  - dm verity: skip verity work if I/O error when system is shutting down (Hyeongseok Kim)  
  - ALSA: pcm: Clear the full allocated memory at hw_params (Takashi Iwai)  
  - tick/sched: Remove bogus boot "safety" check (Thomas Gleixner)  
  - um: ubd: Submit all data segments atomically (Gabriel Krisman Bertazi)  
  - fs/namespace.c: WARN if mnt_count has become negative (Eric Biggers)  
  - module: delay kobject uevent until after module init call (Jessica Yu)  
  - f2fs: avoid race condition for shrinker count (Jaegeuk Kim)  
  - NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode (Trond Myklebust)  
  - i3c master: fix missing destroy_workqueue() on error in i3c_master_register (Qinglang Miao)  
  - powerpc: sysdev: add missing iounmap() on error in mpic_msgr_probe() (Qinglang Miao)  
  - rtc: pl031: fix resource leak in pl031_probe (Zheng Liang)  
  - quota: Don't overflow quota file offsets (Jan Kara)  
  - module: set MODULE_STATE_GOING state when a module fails to load (Miroslav Benes)  
  - rtc: sun6i: Fix memleak in sun6i_rtc_clk_init (Dinghao Liu)  
  - fcntl: Fix potential deadlock in send_sig{io, urg}() (Boqun Feng)  
  - bfs: don't use WARNING: string when it's just info. (Randy Dunlap)  
  - ALSA: rawmidi: Access runtime->avail always in spinlock (Takashi Iwai)  
  - ALSA: seq: Use bool for snd_seq_queue internal flags (Takashi Iwai)  
  - f2fs: fix shift-out-of-bounds in sanity_check_raw_super() (Chao Yu)  
  - media: gp8psk: initialize stats at power control logic (Mauro Carvalho Chehab)  
  - misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() (Anant Thazhemadam)  
  - reiserfs: add check for an invalid ih_entry_count (Rustam Kovhaev)  
  - Bluetooth: hci_h5: close serdev device and free hu in h5_close (Anant Thazhemadam)  
  - scsi: cxgb4i: Fix TLS dependency (Randy Dunlap)  
  - cgroup: Fix memory leak when parsing multiple source parameters (Qinglang Miao)  
  - of: fix linker-section match-table corruption (Johan Hovold)  
  - null_blk: Fix zone size initialization (Damien Le Moal)  
  - tools headers UAPI: Sync linux/const.h with the kernel headers (Arnaldo Carvalho de Melo)  
  - uapi: move constants from <linux/kernel.h> to <linux/const.h> (Petr Vorel)  
  - scsi: block: Fix a race in the runtime power management code (Bart Van Assche)  
  - jffs2: Fix NULL pointer dereference in rp_size fs option parsing (Jamie Iles)  
  - jffs2: Allow setting rp_size to zero during remounting (lizhe)  
  - powerpc/bitops: Fix possible undefined behaviour with fls() and fls64() (Christophe Leroy)  
  - KVM: x86: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits (Paolo Bonzini)  
  - KVM: x86: avoid incorrect writes to host MSR_IA32_SPEC_CTRL (Paolo Bonzini)  
  - ext4: don't remount read-only with errors=continue on reboot (Jan Kara)  
  - btrfs: fix race when defragmenting leads to unnecessary IO (Filipe Manana)  
  - vfio/pci: Move dummy_resources_list init in vfio_pci_probe() (Eric Auger)  
  - fscrypt: remove kernel-internal constants from UAPI header (Eric Biggers)  
  - fscrypt: add fscrypt_is_nokey_name() (Eric Biggers)  
  - f2fs: prevent creating duplicate encrypted filenames (Eric Biggers)  
  - ubifs: prevent creating duplicate encrypted filenames (Eric Biggers)  
  - ext4: prevent creating duplicate encrypted filenames (Eric Biggers)  
  - thermal/drivers/cpufreq_cooling: Update cpufreq_state only if state has changed (Zhuguangqing)  
  - md/raid10: initialize r10_bio->read_slot before use. (Kevin Vigor)  
  - net/sched: sch_taprio: reset child qdiscs before freeing them (Davide Caratti)  
  - uek/ol/config-aarch64: Update uek6 kernel with RPI IOT configs (Vijay Kumar)  [Orabug: 32833361] 
  - dts/bcm2711: set gpio6 to level=0 and pull=down (Vijay Kumar)  [Orabug: 32833361] 
  - dts: bcm283x: Fix vc4's firmware bus DMA limitations (Nicolas Saenz Julienne)  [Orabug: 32833361] 
  - uek6/config-aarch64-rpi: Enable CONFIG_RTC_DRV_ABEOZ9 (Vijay Kumar)  [Orabug: 32833361] 
  - rtc/ab-eoz9: Add support for ABEOA9 SPI chip (Vijay Kumar)  [Orabug: 32833361] 
  - rtc: abracon: add abeoa9 device id (Tom Saeger)  [Orabug: 32833361] 
  - arm64/dts/bcm2711: Set SPI_CE0_N to output for GPIO8 (Vijay Kumar)  [Orabug: 32833361] 
  - uek-rpm/ol8: Build rpi kernel (Tom Saeger)  [Orabug: 32833361] 
  - uek-rpm: add rpi specific config (Tom Saeger)  [Orabug: 32833361] 
  - firmware/raspberrypi: Notify firmware of a reboot (Phil Elwell)  [Orabug: 32833361] 
  - firmware: raspberrypi: Report the fw variant during probe (Dave Stevenson)  [Orabug: 32833361] 
  - raspberrypi-firmware: Export the general transaction function. (Eric Anholt)  [Orabug: 32833361] 
  - firmware: bcm2835: Support ARCH_BCM270x (Noralf Trønnes)  [Orabug: 32833361] 
  - Add NO_WAIT_RESP flag (Phil Elwell)  [Orabug: 32833361] 
  - bcm2835-dma: Add proper 40-bit DMA support (Phil Elwell)  [Orabug: 32833361] 
  - dmaengine: Add support for BCM2708 (Florian Meier)  [Orabug: 32833361] 
  - dmaengine: bcm2835: Load driver early and support legacy API (Noralf Trønnes)  [Orabug: 32833361] 
  - RPi: char: broadcom: Add vcio module (Noralf Trønnes)  [Orabug: 32833361] 
  - RPi: Add /dev/gpiomem device for rootless user GPIO access (Luke Wren)  [Orabug: 32833361] 
  - RPi: vcsm: VideoCore shared memory service for BCM2835 (Tim Gover)  [Orabug: 32833361] 
  - RPi: vc_mem: Add vc_mem driver for querying firmware memory addresses (popcornmix)  [Orabug: 32833361] 
  - RPi4/dts: set alias for i2c device (Vijay Kumar)  [Orabug: 32833361] 
  - dts: Enable i2c4 for RPi4 (Vijay Kumar)  [Orabug: 32833361] 
  - RPi:dts/bcm2711: Enable pwm for RPi4 board (Vijay Kumar)  [Orabug: 32833361] 
  - RPi: transplant rpi_backlight to it's expected place (Andrew Thomas)  [Orabug: 32833361] 
  - RPi: pinctrl-bcm2835: Set base to 0 for BCM2711 (Andrew Thomas)  [Orabug: 32833361] 
  - RPi: pinctrl-bcm2835: Set base to 0 give expected gpio numbering (notro)  [Orabug: 32833361] 
  - RPi: spidev: add rpi4 spidev0 (Tom Saeger)  [Orabug: 32833361] 
  - RPi: dts: rpi4 add gpiomem (Tom Saeger)  [Orabug: 32833361] 
  - RPi: dts: enable rpi4 touchscreen, i2c, and spi (Tom Saeger)  [Orabug: 32833361] 
  - RPi: rpi_display: add backlight driver and overlay (P33M)  [Orabug: 32833361] 
  - HID: quirks: Add quirk for Lenovo optical mouse (Saeed Mirzamohammadi)  [Orabug: 32820273] 
  - x86/amd: Disable IBS on Rome processors due to erratum 1215 (Boris Ostrovsky)  [Orabug: 32817184] 
  - perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3 (Kan Liang)  [Orabug: 32806848]


author: Jack Vogel <jack.vogel@oracle.com> - 5.4.17-2102.202.3.el8
changelog:
  - LTS tag: v5.4.94 (Jack Vogel)  
  - fs: fix lazytime expiration handling in __writeback_single_inode() (Eric Biggers)  
  - writeback: Drop I_DIRTY_TIME_EXPIRE (Jan Kara)  
  - dm integrity: conditionally disable "recalculate" feature (Mikulas Patocka)  
  - tools: Factor HOSTCC, HOSTLD, HOSTAR definitions (Jean-Philippe Brucker)  
  - SMB3.1.1: do not log warning message if server doesn't populate salt (Steve French)  
  - arm64: mm: use single quantity to represent the PA to VA translation (Ard Biesheuvel)  
  - tracing: Fix race in trace_open and buffer resize call (Gaurav Kohli)  
  - io_uring: Fix current->fs handling in io_sq_wq_submit_work() (Nicolai Stange)  
  - HID: wacom: Correct NULL dereference on AES pen proximity (Jason Gerecke)  
  - Revert "mm/slub: fix a memory leak in sysfs_slab_add()" (Wang Hai)  
  - gpio: mvebu: fix pwm .get_state period calculation (Baruch Siach)  
  - LTS tag: v5.4.93 (Jack Vogel)  
  - tcp: fix TCP_USER_TIMEOUT with zero window (Enke Chen)  
  - net: dsa: b53: fix an off by one in checking "vlan->vid" (Dan Carpenter)  
  - net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled (Tariq Toukan)  
  - net: mscc: ocelot: allow offloading of bridge on top of LAG (Vladimir Oltean)  
  - ipv6: set multicast flag on the multicast route (Matteo Croce)  
  - net_sched: reject silly cell_log in qdisc_get_rtab() (Eric Dumazet)  
  - net_sched: avoid shift-out-of-bounds in tcindex_set_parms() (Eric Dumazet)  
  - ipv6: create multicast route with RTPROT_KERNEL (Matteo Croce)  
  - udp: mask TOS bits in udp_v4_early_demux() (Guillaume Nault)  
  - kasan: fix incorrect arguments passing in kasan_add_zero_shadow (Lecopzer Chen)  
  - kasan: fix unaligned address is unhandled in kasan_remove_zero_shadow (Lecopzer Chen)  
  - skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too (Alexander Lobakin)  
  - lightnvm: fix memory leak when submit fails (Pan Bian)  
  - sh_eth: Fix power down vs. is_opened flag ordering (Geert Uytterhoeven)  
  - net: dsa: mv88e6xxx: also read STU state in mv88e6250_g1_vtu_getnext (Rasmus Villemoes)  
  - sh: dma: fix kconfig dependency for G2_DMA (Necip Fazil Yildiran)  
  - netfilter: rpfilter: mask ecn bits before fib lookup (Guillaume Nault)  
  - x86/cpu/amd: Set __max_die_per_package on AMD (Yazen Ghannam)  
  - pinctrl: ingenic: Fix JZ4760 support (Paul Cercueil)  
  - driver core: Extend device_is_dependent() (Rafael J. Wysocki)  
  - xhci: tegra: Delay for disabling LFPS detector (JC Kuo)  
  - xhci: make sure TRB is fully written before giving it to the controller (Mathias Nyman)  
  - usb: bdc: Make bdc pci driver depend on BROKEN (Patrik Jakobsson)  
  - usb: udc: core: Use lock when write to soft_connect (Thinh Nguyen)  
  - usb: gadget: aspeed: fix stop dma register setting. (Ryan Chen)  
  - USB: ehci: fix an interrupt calltrace error (Longfang Liu)  
  - ehci: fix EHCI host controller initialization sequence (Eugene Korenevsky)  
  - serial: mvebu-uart: fix tx lost characters at power off (Pali Rohár)  
  - stm class: Fix module init return on allocation failure (Wang Hui)  
  - intel_th: pci: Add Alder Lake-P support (Alexander Shishkin)  
  - x86/mmx: Use KFPU_387 for MMX string operations (Andy Lutomirski)  
  - x86/topology: Make __max_die_per_package available unconditionally (Borislav Petkov)  
  - x86/fpu: Add kernel_fpu_begin_mask() to selectively initialize state (Andy Lutomirski)  
  - irqchip/mips-cpu: Set IPI domain parent chip (Mathias Kresin)  
  - cifs: do not fail __smb_send_rqst if non-fatal signals are pending (Ronnie Sahlberg)  
  - iio: ad5504: Fix setting power-down state (Lars-Peter Clausen)  
  - can: peak_usb: fix use after free bugs (Vincent Mailhol)  
  - can: vxcan: vxcan_xmit: fix use after free bug (Vincent Mailhol)  
  - can: dev: can_restart: fix use after free bug (Vincent Mailhol)  
  - selftests: net: fib_tests: remove duplicate log test (Hangbin Liu)  
  - platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11 from allow-list (Hans de Goede)  
  - i2c: octeon: check correct size of maximum RECV_LEN packet (Wolfram Sang)  
  - powerpc: Fix alignment bug within the init sections (Ariel Marcovitch)  
  - scsi: megaraid_sas: Fix MEGASAS_IOC_FIRMWARE regression (Arnd Bergmann)  
  - pinctrl: aspeed: g6: Fix PWMG0 pinctrl setting (Billy Tsai)  
  - powerpc: Use the common INIT_DATA_SECTION macro in vmlinux.lds.S (Youling Tang)  
  - drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0 (Ben Skeggs)  
  - drm/nouveau/mmu: fix vram heap sizing (Ben Skeggs)  
  - drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields (Ben Skeggs)  
  - drm/nouveau/privring: ack interrupts the same way as RM (Ben Skeggs)  
  - drm/nouveau/bios: fix issue shadowing expansion ROMs (Ben Skeggs)  
  - drm/amd/display: Fix to be able to stop crc calculation (Wayne Lin)  
  - drm/amdgpu/psp: fix psp gfx ctrl cmds (Victor Zhao)  
  - riscv: defconfig: enable gpio support for HiFive Unleashed (Sagar Shrikant Kadam)  
  - dts: phy: fix missing mdio device and probe failure of vsc8541-01 device (Sagar Shrikant Kadam)  
  - x86/xen: Add xen_no_vector_callback option to test PCI INTX delivery (David Woodhouse)  
  - xen: Fix event channel callback via INTX/GSI (David Woodhouse)  
  - arm64: make atomic helpers __always_inline (Arnd Bergmann)  
  - clk: tegra30: Add hda clock default rates to clock driver (Peter Geis)  
  - HID: Ignore battery for Elan touchscreen on ASUS UX550 (Seth Miller)  
  - HID: logitech-dj: add the G602 receiver (Filipe Laíns)  
  - riscv: Fix sifive serial driver (Damien Le Moal)  
  - riscv: Fix kernel time_init() (Damien Le Moal)  
  - scsi: sd: Suppress spurious errors when WRITE SAME is being disabled (Ewan D. Milne)  
  - scsi: qedi: Correct max length of CHAP secret (Nilesh Javali)  
  - scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback (Can Guo)  
  - dm integrity: select CRYPTO_SKCIPHER (Anthony Iliopoulos)  
  - HID: multitouch: Enable multi-input for Synaptics pointstick/touchpad device (Kai-Heng Feng)  
  - ASoC: Intel: haswell: Add missing pm_ops (Cezary Rojewski)  
  - drm/i915/gt: Prevent use of engine->wa_ctx after error (Chris Wilson)  
  - drm/syncobj: Fix use-after-free (Daniel Vetter)  
  - drm/atomic: put state on error path (Pan Bian)  
  - dm integrity: fix a crash if "recalculate" used without "internal_hash" (Mikulas Patocka)  
  - dm: avoid filesystem lookup in dm_get_dev_t() (Hannes Reinecke)  
  - mmc: sdhci-xenon: fix 1.8v regulator stabilization (Alex Leibovich)  
  - mmc: core: don't initialize block size from ext_csd if not present (Peter Collingbourne)  
  - btrfs: send: fix invalid clone operations when cloning from the same file and root (Filipe Manana)  
  - btrfs: don't clear ret in btrfs_start_dirty_block_groups (Josef Bacik)  
  - btrfs: fix lockdep splat in btrfs_recover_relocation (Josef Bacik)  
  - btrfs: don't get an EINTR during drop_snapshot for reloc (Josef Bacik)  
  - ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (Hans de Goede)  
  - ALSA: hda/via: Add minimum mute flag (Takashi Iwai)  
  - ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (Takashi Iwai)  
  - platform/x86: ideapad-laptop: Disable touchpad_switch for ELAN0634 (Jiaxun Yang)  
  - platform/x86: i2c-multi-instantiate: Don't create platform device for INT3515 ACPI nodes (Heikki Krogerus)  
  - i2c: bpmp-tegra: Ignore unknown I2C_M flags (Mikko Perttunen)  
  - LTS tag: v5.4.92 (Jack Vogel)  
  - spi: cadence: cache reference clock rate during probe (Michael Hennerich)  
  - mac80211: check if atf has been disabled in __ieee80211_schedule_txq (Lorenzo Bianconi)  
  - mac80211: do not drop tx nulldata packets on encrypted links (Felix Fietkau)  
  - tipc: fix NULL deref in tipc_link_xmit() (Hoang Le)  
  - net, sctp, filter: remap copy_from_user failure error (Daniel Borkmann)  
  - rxrpc: Fix handling of an unsupported token type in rxrpc_read() (David Howells)  
  - net: avoid 32 x truesize under-estimation for tiny skbs (Eric Dumazet)  
  - net: sit: unregister_netdevice on newlink's error path (Jakub Kicinski)  
  - net: stmmac: Fixed mtu channged by cache aligned (David Wu)  
  - rxrpc: Call state should be read with READ_ONCE() under some circumstances (Baptiste Lepers)  
  - net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands (Petr Machata)  
  - net: dcb: Validate netlink message in DCB handler (Petr Machata)  
  - esp: avoid unneeded kmap_atomic call (Willem de Bruijn)  
  - rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request (Andrey Zhizhikin)  
  - net: mvpp2: Remove Pause and Asym_Pause support (Stefan Chulski)  
  - mlxsw: core: Increase critical threshold for ASIC thermal zone (Vadim Pasternak)  
  - mlxsw: core: Add validation of transceiver temperature thresholds (Vadim Pasternak)  
  - net: ipv6: Validate GSO SKB before finish IPv6 processing (Aya Levin)  
  - netxen_nic: fix MSI/MSI-x interrupts (Manish Chopra)  
  - udp: Prevent reuseport_select_sock from reading uninitialized socks (Baptiste Lepers)  
  - bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback (Mircea Cirjaliu)  
  - bpf: Don't leak memory in bpf getsockopt when optlen == 0 (Stanislav Fomichev)  
  - nfsd4: readdirplus shouldn't return parent of export (J. Bruce Fields)  
  - spi: npcm-fiu: Disable clock in probe error path (Lukas Wunner)  
  - spi: npcm-fiu: simplify the return expression of npcm_fiu_probe() (Qinglang Miao)  
  - elfcore: fix building with clang (Arnd Bergmann)  
  - xen/privcmd: allow fetching resource sizes (Roger Pau Monne)  
  - compiler.h: Raise minimum version of GCC to 5.1 for arm64 (Will Deacon)  
  - usb: ohci: Make distrust_firmware param default to false (Hamish Martin)  
  - LTS tag: v5.4.91 (Jack Vogel)  
  - netfilter: nft_compat: remove flush counter optimization (Florian Westphal)  
  - netfilter: nf_nat: Fix memleak in nf_nat_init (Dinghao Liu)  
  - netfilter: conntrack: fix reading nf_conntrack_buckets (Jesper Dangaard Brouer)  
  - ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (Geert Uytterhoeven)  
  - ALSA: fireface: Fix integer overflow in transmit_midi_msg() (Geert Uytterhoeven)  
  - dm: eliminate potential source of excessive kernel log noise (Mike Snitzer)  
  - net: sunrpc: interpret the return value of kstrtou32 correctly (j.nixdorf@avm.de)  
  - iommu/vt-d: Fix unaligned addresses for intel_flush_svm_range_dev() (Lu Baolu)  
  - mm, slub: consider rest of partial list if acquire_slab() fails (Jann Horn)  
  - drm/i915/dsi: Use unconditional msleep for the panel_on_delay when there is no reset-deassert MIPI-sequence (Hans de Goede)  
  - IB/mlx5: Fix error unwinding when set_has_smi_cap fails (Parav Pandit)  
  - RDMA/mlx5: Fix wrong free of blue flame register on error (Mark Bloch)  
  - bnxt_en: Improve stats context resource accounting with RDMA driver loaded. (Michael Chan)  
  - RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp (Dinghao Liu)  
  - RDMA/restrack: Don't treat as an error allocation ID wrapping (Leon Romanovsky)  
  - ext4: fix superblock checksum failure when setting password salt (Jan Kara)  
  - NFS: nfs_igrab_and_active must first reference the superblock (Trond Myklebust)  
  - NFS/pNFS: Fix a leak of the layout 'plh_outstanding' counter (Trond Myklebust)  
  - pNFS: Stricter ordering of layoutget and layoutreturn (Trond Myklebust)  
  - pNFS: Mark layout for return if return-on-close was not sent (Trond Myklebust)  
  - pNFS: We want return-on-close to complete when evicting the inode (Trond Myklebust)  
  - NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock (Dave Wysochanski)  
  - nvme-tcp: fix possible data corruption with bio merges (Sagi Grimberg)  
  - ASoC: Intel: fix error code cnl_set_dsp_D0() (Dan Carpenter)  
  - ASoC: meson: axg-tdmin: fix axg skew offset (Jerome Brunet)  
  - ASoC: meson: axg-tdm-interface: fix loopback (Jerome Brunet)  
  - dump_common_audit_data(): fix racy accesses to ->d_name (Al Viro)  
  - perf intel-pt: Fix 'CPU too large' error (Adrian Hunter)  
  - ARM: picoxcell: fix missing interrupt-parent properties (Arnd Bergmann)  
  - drm/msm: Call msm_init_vram before binding the gpu (Craig Tatlor)  
  - ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (Shawn Guo)  
  - usb: typec: Fix copy paste error for NVIDIA alt-mode description (Peter Robinson)  
  - drm/amdgpu: fix a GPU hang issue when remove device (Dennis Li)  
  - nvmet-rdma: Fix list_del corruption on queue establishment failure (Israel Rukshin)  
  - nvme-pci: mark Samsung PM1725a as IGNORE_DEV_SUBNQN (Gopal Tiwari)  
  - selftests: fix the return value for UDP GRO test (Po-Hsu Lin)  
  - net: ethernet: fs_enet: Add missing MODULE_LICENSE (Michael Ellerman)  
  - misdn: dsp: select CONFIG_BITREVERSE (Arnd Bergmann)  
  - arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC (Randy Dunlap)  
  - bfq: Fix computation of shallow depth (Jan Kara)  
  - lib/raid6: Let $(UNROLL) rules work with macOS userland (John Millikin)  
  - hwmon: (pwm-fan) Ensure that calculation doesn't discard big period values (Uwe Kleine-König)  
  - habanalabs: Fix memleak in hl_device_reset (Dinghao Liu)  
  - habanalabs: register to pci shutdown callback (Oded Gabbay)  
  - ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram (Rasmus Villemoes)  
  - regulator: bd718x7: Add enable times (Guido Günther)  
  - btrfs: fix transaction leak and crash after RO remount caused by qgroup rescan (Filipe Manana)  
  - netfilter: ipset: fixes possible oops in mtype_resize (Vasily Averin)  
  - ARC: build: move symlink creation to arch/arc/Makefile to avoid race (Masahiro Yamada)  
  - ARC: build: add boot_targets to PHONY (Masahiro Yamada)  
  - ARC: build: add uImage.lzma to the top-level target (Masahiro Yamada)  
  - ARC: build: remove non-existing bootpImage from KBUILD_IMAGE (Masahiro Yamada)  
  - dm integrity: fix flush with external metadata device (Mikulas Patocka)  
  - cifs: fix interrupted close commands (Paulo Alcantara)  
  - smb3: remove unused flag passed into close functions (Steve French)  
  - ext4: don't leak old mountpoint samples (Theodore Ts'o)  
  - ext4: fix bug for rename with RENAME_WHITEOUT (yangerkun)  
  - drm/i915/backlight: fix CPU mode backlight takeover on LPT (Jani Nikula)  
  - btrfs: tree-checker: check if chunk item end overflows (Su Yue)  
  - r8152: Add Lenovo Powered USB-C Travel Hub (Leon Schuermann)  
  - dm integrity: fix the maximum number of arguments (Mikulas Patocka)  
  - dm snapshot: flush merged data before committing metadata (Akilesh Kailash)  
  - dm raid: fix discard limits for raid1 (Mike Snitzer)  
  - mm/hugetlb: fix potential missing huge page size info (Miaohe Lin)  
  - ACPI: scan: Harden acpi_device_add() against device ID overflows (Dexuan Cui)  
  - RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd() (Tom Rix)  
  - MIPS: relocatable: fix possible boot hangup with KASLR enabled (Alexander Lobakin)  
  - MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB (Paul Cercueil)  
  - mips: lib: uncached: fix non-standard usage of variable 'sp' (Anders Roxell)  
  - mips: fix Section mismatch in reference (Anders Roxell)  
  - tracing/kprobes: Do the notrace functions check without kprobes on ftrace (Masami Hiramatsu)  
  - x86/hyperv: check cpu mask after interrupt has been disabled (Wei Liu)  
  - ASoC: dapm: remove widget from dirty list on free (Thomas Hebb)  
  - btrfs: prevent NULL pointer dereference in extent_io_tree_panic (Su Yue)  
  - kbuild: enforce -Werror=return-type (Olaf Hering)  
  - IB/ipoib: Improve latency in ipoib/cm connection formation (Manjunath Patil)  [Orabug: 32852998]


