# changelog

author: zhanghao<zhanghao383@huawei.com> - 32:9.16.23-14
changelog:
  - Type:CVE
  - CVE:CVE-2022-3736 CVE-2022-3924 CVE-2022-3094
  - SUG:NA
  - DESC:fix CVE-2022-3736 CVE-2022-3924 CVE-2022-3094


author: zhanghao<zhanghao383@huawei.com> - 32:9.16.23-15
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix output expected information when install bing-sdborbind-sdb-chroot


author: zhanghao <zhanghao383@huawei.com> - 32:9.16.23-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Don't perform arithmetic on NULL pointers
  Accept 'in=NULL' with 'inlen=0' in isc_{half}siphash24
  Fix a use-after-free bug in dns_zonemgr_releasezone()
  Fix dns_fwdtable_addfwd() error path cleanup bug
  Detach the views in zone_shutdown(), not in zone_free()
  Detach the zone views outside of the zone lock
  delay trust anchor management until zones are loaded
  In hmac_createctx free ctx on isc_hmac_init failure
  Fix dns_kasp_attach / dns_kasp_detach usage
  Fix backport error in 84929d1c
  Fix a cleanup bug when isc_task_create() fails in dns_catz_new_zones()
  Searching catzs->zones requires a read lock
  Fix view's zones reverting bug during reconfiguration


author: chengyechun <chengyechun1@huawei.com> - 32:9.16.23-21
changelog:
  - Type:CVE
  - CVE:CVE-2023-6516 CVE-2023-4408 CVE-2023-5517 CVE-2023-5680 CVE-2023-5679 CVE-50387 CVE-2023-50868
  - SUG:NA
  - DESC:fix CVE-2023-6516 CVE-2023-4408 CVE-2023-5517 CVE-2023-5680 CVE-2023-5679 CVE-50387 CVE-2023-50868 and sync some patches from upstream


author: chengyechun <chengyechun1@huawei.com> - 32:9.16.23-23
changelog:
  - Type:CVE
  - CVE:CVE-2024-1975,CVE-2024-4076,CVE-2024-1737
  - SUG:NA
  - DESC:fix CVE-2024-1975 CVE-2024-4076 CVE-2024-1737


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-207.0.0.107
changelog:
  - !8599  Bluetooth: hci_core: Fix possible buffer overflow
  - !8949  CVE-2022-48652
  - !8602  netfilter: nf_tables: set dormant flag on hook register failure
  - !8867  ipv6: prevent NULL dereference in ip6_output()
  - !8779  smb: client: fix UAF in smb2_reconnect_server()
  - !8893 [sync] PR-8531:  gpiolib: cdev: fix uninitialised kfifo
  - !8985  cvm_tsi: Fix security issue for Confidential cVM TSI
  - !8686  mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  - !8711  ubifs: Set page uptodate in the correct place
  - !8860  blk-iocost: do not WARN if iocg was already offlined
  - !8639  s390/qeth: Fix kernel panic after setting hsuid
  - !8946  usb: typec: ucsi: Limit read size on v1.2
  - !8969  Fix CVE-2024-36949
  - cvm_tsi: Fix security issue for Confidential cVM TSI
  - !8216  ACPI: video: check for error while searching for backlight device parent
  - !8903  ALSA: scarlett2: Add missing error checks to *_ctl_get()
  - !8584  virtio-blk: fix implicit overflow on virtio_max_dma_size
  - !8838  blk-iocost: avoid out of bounds shift
  - !8856  PCI/PM: Drain runtime-idle callbacks before driver removal
  - amd/amdkfd: sync all devices to wait all processes being evicted
  - drm/amdkfd: Rework kfd_locked handling
  - !8906  net/mlx5e: Fix use-after-free of encap entry in neigh update handler
  - !8910  gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - ice: Fix crash by keep old cfg when update TCs more than queues
  - ice: ethtool: Prohibit improper channel config for DCB
  - !8879  net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - !6695  netfilter: nft_set_pipapo: do not free live element
  - usb: typec: ucsi: Limit read size on v1.2
  - !8891  net: fix out-of-bounds access in ops_init
  - !8871 add sdma-dae for openeuler 22.03 SP4
  - !8762  tipc: fix UAF in error path
  - !8742  octeontx2-af: avoid off-by-one read from userspace
  - !8734  mptcp: ensure snd_nxt is properly initialized on connect
  - !8634  batman-adv: Avoid infinite loop trying to resize local TT
  - !8736  net: hns3: fix kernel crash when devlink reload during initialization
  - !8745  afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
  - !3547  fs: mitigatin cacheline false sharing in struct file
  - !8887  nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - net/mlx5e: Fix use-after-free of encap entry in neigh update handler
  - ALSA: scarlett2: Add missing error checks to *_ctl_get()
  - !8785  tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  - drivers: misc: sdma-dae: enable sdma_dae for arm64
  - drivers: misc: sdma-dae: support page fault preprocess
  - gpiolib: cdev: fix uninitialised kfifo
  - !8849  ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - net: fix out-of-bounds access in ops_init
  - !8666  phonet/pep: fix racy skb_queue_empty() use
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - drivers: misc: sdma-dae: support interrupt init and handle
  - drivers: misc: sdma-dae: support sqe task send and execute
  - drivers: misc: sdma-dae: support channel management
  - drivers: misc: sdma-dae: support getting streamID
  - drivers: misc: sdma-dae: support initializ sdma driver
  - ipv6: prevent NULL dereference in ip6_output()
  - blk-iocost: do not WARN if iocg was already offlined
  - PCI/PM: Drain runtime-idle callbacks before driver removal
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - !8684  tcp: properly terminate timers for kernel sockets
  - !8629  erspan: make sure erspan_base_hdr is present in skb->head
  - blk-iocost: avoid out of bounds shift
  - !8635  ipv6: Fix potential uninit-value access in __ip6_make_skb()
  - !8550  tipc: fix a possible memleak in tipc_buf_append
  - !8726  tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - !8808 v2  Add support for PCC Operation Region
  - !8623  fs/9p: only translate RWX permissions for plain 9P2000
  - !8479  scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - arm64: config: Enable ACPI_PCC
  - ACPI: PCC: Setup PCC Opregion handler only if platform interrupt is available
  - ACPI: PCC: Fix unintentional integer overflow
  - ACPI: PCC: Fix Tx acknowledge in the PCC address space handler
  - ACPI: PCC: replace wait_for_completion()
  - ACPI: PCC: Release resources on address space setup failure path
  - ACPI: PCC: pcc_ctx can be static
  - ACPI: PCC: Implement OperationRegion handler for the PCC Type 3 subtype
  - ACPICA: Add support for PCC Opregion special context data
  - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  - smb: client: fix UAF in smb2_reconnect_server()
  - tipc: fix UAF in error path
  - afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
  - octeontx2-af: avoid off-by-one read from userspace
  - net: hns3: fix kernel crash when devlink reload during initialization
  - mptcp: ensure snd_nxt is properly initialized on connect
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - ubifs: Set page uptodate in the correct place
  - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  - tcp: properly terminate timers for kernel sockets
  - phonet/pep: fix racy skb_queue_empty() use
  - s390/qeth: Fix kernel panic after setting hsuid
  - ipv6: Fix potential uninit-value access in __ip6_make_skb()
  - batman-adv: Avoid infinite loop trying to resize local TT
  - erspan: make sure erspan_base_hdr is present in skb->head
  - fs/9p: only translate RWX permissions for plain 9P2000
  - netfilter: nf_tables: set dormant flag on hook register failure
  - Bluetooth: hci_core: Fix possible buffer overflow
  - virtio-blk: fix implicit overflow on virtio_max_dma_size
  - tipc: fix a possible memleak in tipc_buf_append
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - ACPI: video: check for error while searching for backlight device parent
  - netfilter: nft_set_pipapo: do not free live element
  - fs: enable CONFIG_FILE_MITIGATION_FALSE_SHARING by default on arm64
  - fs: mitigatin cacheline false sharing in struct file


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-208.0.0.108
changelog:
  - !9084 v5  xfs: atomic writes for xfs
  - block: fix kabi in struct queue_limits
  - xfs: make bunmapi observe forcealigin
  - xfs: Only free full extents for forcealign
  - xfs: Update xfs_is_falloc_aligned() mask for forcealign
  - xfs: fix set xflags fail when inode has extent hit
  - xfs: support atomic write ioctl
  - fs: xfs: Support setting FMODE_CAN_ATOMIC_WRITE
  - fs: xfs: Validate atomic writes
  - fs: xfs: Support FS_XFLAG_ATOMICWRITES for forcealign
  - fs: iomap: Atomic write support
  - fs: Add FS_XFLAG_ATOMICWRITES flag
  - fs: xfs: iomap: Sub-extent zeroing
  - fs: iomap: Sub-extent zeroing
  - fs: xfs: Do not free EOF blocks for forcealign
  - fs: xfs: Make file data allocations observe the 'forcealign' flag
  - fs: xfs: Enable file data forcealign feature
  - fs: xfs: Introduce FORCEALIGN inode flag
  - nvme: Atomic write support
  - block: Add core atomic write support
  - fs: Initial atomic write support
  - block: get atomic write max sectors
  - !9064 drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - !9067  config: enable CONFIG_BLK_CGROUP_IOCOST by default
  - !9063 v3  block: support to dispatch bio asynchronously
  - !9066 change sdma-dae default mode to n
  - !8827 v2  iomap: fix sub-page not set dirty state
  - drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - !9059 roh/hns3: Add ROH client case in hclgevf_init_client_instance.
  - !9055  CVE-2024-36020
  - !9015  CVE-2024-36953
  - !9014  drm/vc4: don't check if plane->state->fb == state->fb
  - config: enable CONFIG_BLK_CGROUP_IOCOST by default
  - drivers: misc: sdma-dae: not compile sdma-dae by default
  - block: fix kabi broken in struct request_queue about CONFIG_BLK_BIO_DISPATCH_ASYNC
  - block: support to dispatch bio asynchronously
  - !9050  CVE-2024-35796
  - roh/hns3: Add ROH client case in hclgevf_init_client_instance.
  - i40e: fix vf may be used uninitialized in this function warning
  - !9020  wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - net: ll_temac: platform_get_resource replaced by wrong function
  - !7205  mm: memcontrol: do not miss MEMCG_MAX events for enforced allocations
  - !8908  Refactor hbmdev a bit
  - !9001 roh/hns3: Fix IMP reset vlan unusable.
  - !8774  CVE-2024-36914
  - !9027  tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - !8828  drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
  - !8719  CVE-2024-35887
  - !8872  drm/vmwgfx: Fix invalid reads in fence signaled events
  - !8882  scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - !8921  hugetlbfs: fix hugetlbfs_statfs() locking
  - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
  - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
  - drm/vc4: don't check if plane->state->fb == state->fb
  - roh/hns3: Fix IMP reset vlan unusable.
  - !8965  cvm: enhance security for cvm host feature
  - !8982  fix CVE-2024-36905
  - !8996  pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
  - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
  - net: relax socket state check at accept time.
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
  - cvm: enhance security for cvm host feature
  - hugetlbfs: fix hugetlbfs_statfs() locking
  - arm64: config: Open the hbmdev related config
  - soc: hisilicon: Don't poweroff if memblocks don't offlined
  - soc: hisilicon: hisi_hbmdev: Notify the device in the ACPI
  - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - drm/vmwgfx: Fix invalid reads in fence signaled events
  - drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
  - iomap: Ensure sub-page dirty state is set during mmap writes
  - Revert "iomap: Don't create iomap_page objects in iomap_page_mkwrite_actor"
  - drm/amd/display: Skip on writeback when it's not applicable
  - ax25: fix use-after-free bugs caused by ax25_ds_del_timer
  - mm: memcontrol: do not miss MEMCG_MAX events for enforced allocations


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-209.0.0.109
changelog:
  - !9092 v2  ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
  - !9030  bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - !9112  Backport some optimizing patches for kunpeng920
  - !9099  Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - !9166  A Solution to Re-enable hugetlb vmemmap optimize on ARM64
  - !9163  genirq: introduce handle_fasteoi_edge_irq flow handler
  - ARM: 9278/1: kfence: only handle translation faults
  - arm64: mm: HVO: support BBM of vmemmap pgtable safely
  - arm64: mm: kfence: only handle translation faults
  - mm: HVO: introduce helper function to update and flush pgtable
  - genirq: introduce handle_fasteoi_edge_irq for phytium
  - genirq: introduce handle_fasteoi_edge_irq flow handler
  - !8753  memcg: fix input of try_to_free_mem_cgroup_pages
  - !9149 [sync] PR-9054:  soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !9125  arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
  - !9138 v2  CVE-2024-36971
  - !8494  rpmsg: virtio: Free driver_override when rpmsg_remove()
  - !9073 v2  Fix UAF problem of hpool
  - soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !9131  mm: swap: fix race between free_swap_and_cache() and swapoff()
  - !9129  ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
  - !9068  Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - !8700  wifi: cfg80211: check A-MSDU format more carefully
  - net: fix kabi breakage in struct dst_ops
  - net: fix __dst_negative_advice() race
  - mm: swap: fix race between free_swap_and_cache() and swapoff()
  - ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
  - arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
  - !8999  scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - !8938  clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - arm64: syscall: unmask DAIF for tracing status
  - arm64: Snapshot thread flags
  - sched: Snapshot thread flags
  - entry: Snapshot thread flags
  - x86: Snapshot thread flags
  - thread_info: Add helpers to snapshot thread flags
  - irqchip/gic-v3: Use dsb(ishst) to order writes with ICC_SGI1R_EL1 accesses
  - sched/fair: Optimize test_idle_cores() for !SMT
  - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - !8940  firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - !8747  dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
  - !9074 [sync] PR-8963:  Fix CVE-2024-35915
  - !9083  Bluetooth: L2CAP: Fix not validating setsockopt user input
  - !9081 v2  arm64: mm: Replace global variable in pbha with static key
  - Bluetooth: L2CAP: Fix not validating setsockopt user input
  - arm64: mm: Replace global variable in pbha with static key
  - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_rx_work
  - nfc: nci: Fix kcov check in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
  - mm/dynamic_hugetlb: use rcu lock to protect hpool
  - mm/dynamic_hugetlb: simplify the refcount code
  - Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - memcg: fix input of try_to_free_mem_cgroup_pages
  - dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - wifi: cfg80211: check A-MSDU format more carefully
  - rpmsg: virtio: Free driver_override when rpmsg_remove()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-210.0.0.110
changelog:
  - !9268  net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - !9103  ksmbd: no response from compound read
  - !9186  spi: Fix deadlock when adding SPI controllers on SPI buses
  - !9283 hns3 udma: support non share jfr mode in UM
  - !9277 ima: Fix violation digests extending issue in cvm
  - hns3 udma: kernel support non share jfr mode in UM mode
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - !9244 urma: cannot uninstall uburma driver
  - !9250  Fix token error issue when concurrent calls
  - !9241 v2  Bugfix backport for rcu
  - urma: cannot uninstall uburma driver
  - Fix token error issue when concurrent calls
  - !9180  wifi: wilc1000: fix RCU usage in connect path
  - !9212  drm/amd/display: Fix division by zero in setup_dsc_config
  - ima: Fix violation digests extending issue in cvm
  - !9239  Fix allmodconfig build frame size error
  - !9207 v2  sched: smart_grid: fix potential NULL pointer dereference
  - srcu: Fix callbacks acceleration mishandling
  - entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up
  - rcu: Defer RCU kthreads wakeup when CPU is dying
  - RDMA/hiroce3: Fix allmodconfig build frame size error
  - !7729  loop: use lo->lo_disk for kobject_uevent
  - !9211  memcg: attach memcg async reclaim worker to curcpu
  - !9168  UBIFS: fixes a series of issues that caused by power cut
  - !9000  media: tc358743: register v4l2 async device only after successful setup
  - !9087  fs/9p: fix uninitialized values during inode evict
  - drm/amd/display: Fix division by zero in setup_dsc_config
  - memcg: attach memcg async reclaim worker to curcpu
  - sched: smart_grid: fix potential NULL pointer dereference
  - spi: fix kabi breakage in struct spi_controller
  - spi: fix use-after-free of the add_lock mutex
  - spi: Fix deadlock when adding SPI controllers on SPI buses
  - wifi: wilc1000: fix RCU usage in connect path
  - ubifs: dbg_orphan_check: Fix missed key type checking
  - ubifs: Fix unattached inode when powercut happens in creating
  - ubifs: Fix space leak when powercut happens in linking tmpfile
  - ubifs: Move ui->data initialization after initializing security
  - ubifs: Fix adding orphan entry twice for the same inode
  - ubifs: Remove insert_dead_orphan from replaying orphan process
  - ubifs: Don't add xattr inode into orphan area
  - ubifs: Fix unattached xattr inode if powercut happens after deleting
  - ubifs: Fix some kernel-doc comments
  - ubifs: Fix spelling mistakes
  - ksmbd: no response from compound read
  - fs/9p: fix uninitialized values during inode evict
  - media: tc358743: register v4l2 async device only after successful setup
  - loop: use lo->lo_disk for kobject_uevent


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-211.0.0.111
changelog:
  - !9318  Revert "sched/fair:ARM64 enables SIS_UTIL and disables SIS_PROP"
  - Revert "sched/fair:ARM64 enables SIS_UTIL and disables SIS_PROP"


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-212.0.0.112
changelog:
  - !9347  sched: ARM64 enables SIS_PROP and disables SIS_UTIL"
  - sched: ARM64 enables SIS_PROP and disables SIS_UTIL"


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-213.0.0.113
changelog:
  - !9327  af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - !9264  ring-buffer: Fix a race between readers and resize checks
  - !9305  CVE-2024-26661 following bugfix
  - !9246  ksmbd: no response from compound read
  - !9350  tracing: Fix permissions for the buffer_percent file
  - tracing: Fix permissions for the buffer_percent file
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - drm/amd/display: Fix && vs || typos
  - drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'
  - Revert "drm/amd/display: Fix && vs || typos"
  - ring-buffer: Fix a race between readers and resize checks
  - ksmbd: no response from compound read


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-214.0.0.114
changelog:
  - !9391  fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
  - fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-216.0.0.115
changelog:
  - !9507  Enable SIS_UTIL for arm64 and optimize load_balance
  - !9508  Revert "fs: Use CHECK_DATA_CORRUPTION() when
  - Revert "fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected"
  - config: Disable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64
  - sched/numa: Fix numa imbalance in load_balance()
  - Revert "Revert "sched/fair:ARM64 enables SIS_UTIL and disables SIS_PROP""
  - Revert "sched: ARM64 enables SIS_PROP and disables SIS_UTIL""
  - !9333  net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - !8098  netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  - !5860  ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
  - !9421 v3  block: fix WARNING in init_blk_queue_async_dispatch
  - block: fix WARNING in init_blk_queue_async_dispatch
  - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  - ksmbd: fix UAF issue in ksmbd_tcp_new_connection()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-217.0.0.116
changelog:
  - !9160  xfs: don't use current->journal_info
  - !9429  usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  - !9644  fix uaf when proc_cpuset_show
  - !9532  CVE-2024-37356
  - !9496  netrom: fix possible dead-lock in nr_rt_ioctl()
  - cgroup: fix uaf when proc_cpuset_show
  - !9514  RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - !9559  CVE-2024-38597
  - !9039 [OLK-5.10] drm/phytium: Replace default efi fb0 with dc fb
  - !9595  drm/arm/malidp: fix a possible null pointer dereference
  - !9593  ARM: 9170/1: fix panic when kasan and kprobe are enabled
  - !9504  um: Add winch to winch_handlers before registering winch IRQ
  - drm/arm/malidp: fix a possible null pointer dereference
  - ARM: 9170/1: fix panic when kasan and kprobe are enabled
  - !9587  s390/ap: Fix crash in AP internal function modify_bitmap()
  - s390/ap: Fix crash in AP internal function modify_bitmap()
  - !9569  net: fec: remove .ndo_poll_controller to avoid deadlocks
  - !9540  net/mlx5e: Avoid field-overflowing memcpy()
  - !9577 v2  btrfs: fix crash on racing fsync and size-extending write into prealloc
  - !9563  fs/ntfs3: Check 'folio' pointer for NULL
  - !9383  serial: max3100: Update uart_driver_registered on driver removal
  - btrfs: fix crash on racing fsync and size-extending write into prealloc
  - !8744  ext4 bugfix from mainline
  - !9499  ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - !9500  netfilter: nf_tables: flush pending destroy work before exit_net release
  - !9453  jffs2: prevent xattr node from overflowing the eraseblock
  - !9202  dyndbg: fix old BUG_ON in >control parser
  - !9193  wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  - !9201  ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  - !9190  clk: Fix clk_core_get NULL dereference
  - !9188  net: phy: fix phy_get_internal_delay accessing an empty array
  - !9462 v2  CVE-2024-27032
  - !9408  drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - !9447  rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - !9425  ASoC: SOF: Fix DSP oops stack dump output contents
  - !9321  drm/amd/display: Fix potential index out of bounds in color transformation function
  - !9297  CVE-2021-47599
  - !9401  Fix CVE-2024-31076
  - !9434  cvm: delete dead code and resolve macro definition holes
  - !9395  CVE-2024-38587
  - !9386  vfio/pci: fix potential memory leak in vfio_intx_enable()
  - !9199  init/main.c: Fix potential static_command_line memory overflow
  - !8683 v4  Fix CVE-2024-35879
  - !9339  serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - !9470  net/mlx5: Add a timeout to acquire the command queue semaphore
  - !9442  net/mlx5: Discard command completions in internal error
  - !9290  net: bridge: xmit: make sure we have at least eth header len bytes
  - !9284  of: module: add buffer overflow check in of_modalias()
  - !9477  watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - !9544  ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - !9483  fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - !9558  CVE-2024-39362
  - !9456  bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - !9527  media: lgdt3306a: Add a check against null-pointer-def
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
  - fs/ntfs3: Check 'folio' pointer for NULL
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
  - i2c: acpi: Unbind mux adapters before delete
  - i2c: add fwnode APIs
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - net/mlx5e: Avoid field-overflowing memcpy()
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
  - params: lift param_set_uint_minmax to common code
  - media: lgdt3306a: Add a check against null-pointer-def
  - !9511  blk-throttle: check for overflow in calculate_bytes_allowed
  - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - blk-throttle: check for overflow in calculate_bytes_allowed
  - blk-throttle: use calculate_io/bytes_allowed() for throtl_trim_slice()
  - blk-throttle: factor out code to calculate ios/bytes_allowed
  - um: Add winch to winch_handlers before registering winch IRQ
  - netfilter: nf_tables: flush pending destroy work before exit_net release
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - netrom: fix possible dead-lock in nr_rt_ioctl()
  - fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - net/mlx5: Add a timeout to acquire the command queue semaphore
  - f2fs: fix to avoid potential panic during recovery
  - f2fs: fix to check return value of f2fs_reserve_new_block()
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - jffs2: prevent xattr node from overflowing the eraseblock
  - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - net/mlx5: Discard command completions in internal error
  - cvm: delete dead code and resolve macro definition holes
  - usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  - ASoC: SOF: Fix DSP oops stack dump output contents
  - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
  - speakup: Fix sizeof() vs ARRAY_SIZE() bug
  - vfio/pci: fix potential memory leak in vfio_intx_enable()
  - serial: max3100: Update uart_driver_registered on driver removal
  - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - drm/amd/display: Fix potential index out of bounds in color transformation function
  - btrfs: remove stale comment about the btrfs_show_devname
  - btrfs: update latest_dev when we create a sprout device
  - btrfs: use latest_dev in btrfs_show_devname
  - btrfs: convert latest_bdev type to btrfs_device and rename
  - net: bridge: xmit: make sure we have at least eth header len bytes
  - of: module: add buffer overflow check in of_modalias()
  - dyndbg: fix old BUG_ON in >control parser
  - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  - init/main.c: Fix potential static_command_line memory overflow
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  - clk: Fix clk_core_get NULL dereference
  - net: phy: fix phy_get_internal_delay accessing an empty array
  - xfs: don't use current->journal_info
  - drm/phytium: Replace default efi fb0 with dc fb
  - ext4: fix warning in ext4_dio_write_end_io()
  - ext4: properly sync file size update after O_SYNC direct IO
  - iomap: update ki_pos a little later in iomap_dio_complete
  - driver core: Fix kabi broken
  - of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
  - driver core: Introduce device_link_wait_removal()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-218.0.0.117
changelog:
  - !9851  net/sched: act_skbmod: prevent kernel-infoleak
  - !9853  nilfs2: fix use-after-free of timer for log writer thread
  - !9831  mmc: davinci: Don't strip remove function when driver is builtin
  - !8096  Fix CVE-2024-35988
  - nilfs2: fix use-after-free of timer for log writer thread
  - net/sched: act_skbmod: prevent kernel-infoleak
  - mmc: davinci: Don't strip remove function when driver is builtin
  - !9643  f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
  - !9820  kdb: Fix buffer overflow during tab-complete
  - kdb: Fix buffer overflow during tab-complete
  - !9799  null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
  - !9783  CVE-2024-38598
  - !9772  btrfs: fix use-after-free after failure to create a snapshot
  - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
  - !9792 v3  net: fix one NULL pointer dereference bug in net_rship module
  - !9795  drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
  - !9363  fs/ntfs3: Use variable length array instead of fixed size
  - !9712  fix CVE-2024-38540
  - drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
  - net: fix one NULL pointer dereference bug in net_rship module
  - md: fix resync softlockup when bitmap size is less than array size
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
  - Revert "md/raid10: fix slab-out-of-bounds in md_bitmap_get_counter"
  - !9373  ALSA: core: Fix NULL module pointer assignment at card init
  - !9616 v2  wifi: carl9170: add a proper sanity check for endpoints
  - !9538  virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - !9766  f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
  - !9768  iomap: Don't finish dio under irq when there exists pages
  - !9753 v2  arm64: arm_pmuv3: Correctly extract and check the PMUVer
  - !9731 v2  Backport bpf bugfixes
  - btrfs: fix use-after-free after failure to create a snapshot
  - iomap: Don't finish dio under irq when there exists pages
  - !9719  KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
  - !9764  wifi: ar5523: enable proper endpoint verification
  - !9711  fix CVE-2024-38615
  - !9761  CVE-2024-26816
  - !9756  net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
  - wifi: ar5523: enable proper endpoint verification
  - !9716  ax25: Fix reference count leak issues of ax25_dev
  - x86/boot: Ignore relocations in .notes sections in walk_relocs() too
  - x86, relocs: Ignore relocations in .notes section
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - arm64: arm_pmuv3: Correctly extract and check the PMUVer
  - !9672  ax25: Fix reference count leak issue of net_device
  - !9735  net/9p: fix uninit-value in p9_client_rpc()
  - !9572  dma-mapping: benchmark: handle NUMA_NO_NODE correctly
  - !9571  media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
  - net/9p: fix uninit-value in p9_client_rpc()
  - bpf: ensure main program has an extable
  - bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen
  - bpf: Fix __reg_bound_offset 64->32 var_off subreg propagation
  - bpf: Clobber stack slot when writing over spilled PTR_TO_BTF_ID
  - bpf: Fix memory leaks in __check_func_call
  - !9440  fix CVE-2024-38621
  - !9705  net/hinic3: Add pcie device ID adaption for DPU_NIC card
  - KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
  - ax25: Fix reference count leak issues of ax25_dev
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
  - cpufreq: exit() callback is optional
  - cpufreq: Rearrange locking in cpufreq_remove_dev()
  - cpufreq: Split cpufreq_offline()
  - cpufreq: Reorganize checks in cpufreq_offline()
  - !9701  dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - net/hinic3: Add pcie device ID adaption for DPU_NIC card
  - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - !9640  CVE-2024-38582
  - !9662  tls: fix missing memory barrier in tls_init
  - !9657 v2  CVE-2024-38586
  - !9686  greybus: lights: check return of get_channel_from_mode
  - !9675  crypto: bcm - Fix pointer arithmetic
  - greybus: lights: check return of get_channel_from_mode
  - crypto: bcm - Fix pointer arithmetic
  - ax25: Fix reference count leak issue of net_device
  - tls: fix missing memory barrier in tls_init
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets.
  - r8169: remove nr_frags argument from rtl_tx_slots_avail
  - r8169: improve rtl8169_start_xmit
  - r8169: improve rtl_tx
  - r8169: use READ_ONCE in rtl_tx_slots_avail
  - r8169: remove unneeded memory barrier in rtl_tx
  - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
  - nilfs2: fix potential hang in nilfs_detach_log_writer()
  - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
  - wifi: carl9170: add a proper sanity check for endpoints
  - dma-mapping: benchmark: handle NUMA_NO_NODE correctly
  - media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
  - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - media: stk1160: fix bounds checking in stk1160_copy_video()
  - ALSA: core: Fix NULL module pointer assignment at card init
  - fs/ntfs3: Use variable length array instead of fixed size
  - riscv: Fix TASK_SIZE on 64-bit NOMMU
  - riscv: fix VMALLOC_START definition


author: Li Nan <linan122@huawei.com> - 5.10.0-219.0.0.118
changelog:
  - !9850  power: supply: bq27xxx-i2c: Do not free non existing IRQ
  - !10031  ipv6: prevent possible NULL dereference in rt6_probe()
  - !10060  ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  - !9984  nilfs2: fix potential kernel bug due to lack of writeback flag waiting
  - !9990  netpoll: Fix race condition in netpoll_owner_active
  - !10040  lib/generic-radix-tree.c: Don't overflow in peek()
  - !9950  f2fs: remove clear SB_INLINECRYPT flag in default_options
  - !9968  CVE-2024-40972
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  - !9926  ocfs2: fix races between hole punching and AIO+DIO
  - !9910  arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
  - !9908  sock_map: avoid race between sock_map_close and sk_psock_put
  - !9946  ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
  - !9936  fix CVE-2024-40934
  - !9953  drm/komeda: check for error-valued pointer
  - lib/generic-radix-tree.c: Don't overflow in peek()
  - ipv6: prevent possible NULL dereference in rt6_probe()
  - netpoll: Fix race condition in netpoll_owner_active
  - nilfs2: fix potential kernel bug due to lack of writeback flag waiting
  - ext4: do not create EA inode under buffer lock
  - ext4: fold quota accounting into ext4_xattr_inode_lookup_create()
  - !9871  cifs: Fix deadlock in cifs_writepages during reconnect
  - drm/komeda: check for error-valued pointer
  - !9897  ionic: fix use after netif_napi_del()
  - !9924  drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
  - !9905  mptcp: ensure snd_una is properly initialized on connect
  - f2fs: remove clear SB_INLINECRYPT flag in default_options
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
  - !9893  bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  - HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()
  - ocfs2: fix races between hole punching and AIO+DIO
  - drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
  - !9884 roh/core: Support macvlan in roh.
  - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
  - !9827  ksmbd: fix slab out of bounds write in smb_inherit_dacl()
  - !9825  smb: client: fix potential deadlock when releasing mids
  - !9839  cgroup: Fix AA deadlock caused by cgroup_bpf_release
  - !9889  ipv6: sr: fix memleak in seg6_hmac_init_algo
  - sock_map: avoid race between sock_map_close and sk_psock_put
  - mptcp: ensure snd_una is properly initialized on connect
  - ionic: fix use after netif_napi_del()
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  - ipv6: sr: fix memleak in seg6_hmac_init_algo
  - !9368  CVE-2024-27416
  - !9879  fs: improve dump_mapping() robustness
  - !9872  CVE-2024-38570
  - !9881 v2  iommu/arm-smmu-v3: Change the style to identify the the hisi_platform
  - iommu/arm-smmu-v3: Change the style to identify the the hisi_platform
  - fs: improve dump_mapping() robustness
  - roh/core: Support macvlan in roh.
  - gfs2: Fix potential glock use-after-free on unmount
  - gfs2: Rename sd_{ glock => kill }_wait
  - cifs: Fix deadlock in cifs_writepages during reconnect
  - !9745  CVE-2024-39469
  - !9843  xfs: fix log recovery buffer allocation for the legacy h_size fixup
  - power: supply: bq27xxx-i2c: Do not free non existing IRQ
  - xfs: fix log recovery buffer allocation for the legacy h_size fixup
  - cgroup: Fix AA deadlock caused by cgroup_bpf_release
  - ksmbd: fix slab out of bounds write in smb_inherit_dacl()
  - smb: client: fix potential deadlock when releasing mids
  - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
  - nilfs2: return the mapped address from nilfs_get_page()
  - Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST


author: Li Nan <linan122@huawei.com> - 5.10.0-220.0.0.119
changelog:
  - !9035  keys: Fix overwrite of key expiration on instantiation
  - !9182  netfilter: nf_tables: restore set elements when delete set fails
  - !10184 [RoCE]从社区回合patch到openEuler（OLK-5.10）
  - !10303  netfilter: nf_tables: do not compare internal table flags on updates
  - !10258  batman-adv: bypass empty buckets in batadv_purge_orig_ref()
  - !10280 v2  CVE-2022-48816
  - !9780  ksmbd: fix wrong DataOffset validation of create context
  - !10278  usb-storage: alauda: Check whether the media is initialized
  - netfilter: nf_tables: do not compare internal table flags on updates
  - !10262  media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
  - !10290 Backport 5.10.210 LTS patches from upstream
  - PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq()
  - net: bcmgenet: Fix EEE implementation
  - drm/msm/dsi: Enable runtime PM
  - PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
  - PM: runtime: add devm_pm_runtime_enable helper
  - nilfs2: replace WARN_ONs for invalid DAT metadata block requests
  - sched/membarrier: reduce the ability to hammer on sys_membarrier
  - Revert "arm64: Stash shadow stack pointer in the task struct on interrupt"
  - hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range()
  - scripts/decode_stacktrace.sh: optionally use LLVM utilities
  - scripts: decode_stacktrace: demangle Rust symbols
  - scripts/decode_stacktrace.sh: support old bash version
  - scripts/decode_stacktrace.sh: silence stderr messages from addr2line/nm
  - serial: 8250_exar: Set missing rs485_supported flag
  - serial: 8250_exar: Fill in rs485_supported
  - serial: Add rs485_supported to uart_port
  - mips: Fix max_mapnr being uninitialized on early stages
  - PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support
  - bus: moxtet: Add spi device table
  - Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
  - tracing: Inform kmemleak of saved_cmdlines allocation
  - pmdomain: core: Move the unused cleanup to a _sync initcall
  - of: property: fix typo in io-channels
  - s390/qeth: Fix potential loss of L3-IP@ in case of network issues
  - irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update
  - irqchip/irq-brcmstb-l2: Add write memory barrier before exit
  - wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()
  - nfp: flower: prevent re-adding mac index for bonded port
  - nfp: use correct macro for LengthSelect in BAR config
  - ALSA: hda/conexant: Add quirk for SWS JS201D
  - mmc: slot-gpio: Allow non-sleeping GPIO ro
  - x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
  - x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
  - serial: max310x: improve crystal stable clock detection
  - serial: max310x: set default value when reading clock ready bit
  - ring-buffer: Clean ring_buffer_poll_wait() error return
  - iio: accel: bma400: Fix a compilation problem
  - staging: iio: ad5933: fix type mismatch regression
  - tracing: Fix wasted memory in saved_cmdlines logic
  - misc: fastrpc: Mark all sessions as invalid in cb_remove
  - ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
  - xen-netback: properly sync TX responses
  - kbuild: Fix changing ELF file type for output of gen_btf for big endian
  - firewire: core: correct documentation of fw_csr_string() kernel API
  - lsm: fix the logic in security_inode_getsecctx()
  - scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
  - modpost: trim leading spaces when processing source files list
  - usb: f_mass_storage: forbid async queue when shutdown happen
  - USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
  - usb: ucsi_acpi: Fix command completion handling
  - HID: wacom: Do not register input devices until after hid_hw_start
  - HID: wacom: generic: Avoid reporting a serial of '0' to userspace
  - ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx
  - ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift 1 SF114-32
  - i40e: Fix waiting for queues of all VSIs to be disabled
  - MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
  - net: sysfs: Fix /sys/class/net/<iface> path for statistics
  - ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
  - spi: ppc4xx: Drop write-only variable
  - of: unittest: Fix compile in the non-dynamic case
  - btrfs: send: return EOPNOTSUPP on unknown flags
  - btrfs: forbid deleting live subvol qgroup
  - btrfs: forbid creating subvol qgroups
  - Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
  - Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
  - usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK
  - USB: serial: cp210x: add ID for IMST iM871A-USB
  - USB: serial: option: add Fibocom FM101-GL variant
  - USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
  - net/af_iucv: clean up a try_then_request_module()
  - netfilter: nft_ct: reject direction for ct id
  - netfilter: nft_compat: restrict match/target protocol to u16
  - netfilter: nft_compat: reject unused compat flag
  - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
  - rxrpc: Fix response to PING RESPONSE ACKs to a dead call
  - hwmon: (coretemp) Fix bogus core_id to attr name mapping
  - hwmon: (coretemp) Fix out-of-bounds memory access
  - hwmon: (aspeed-pwm-tacho) mutex for tach reading
  - atm: idt77252: fix a memleak in open_card_ubr0
  - selftests: net: avoid just another constant wait
  - drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case
  - dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
  - phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
  - dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
  - dmaengine: ti: k3-udma: Report short packet errors
  - dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools
  - bonding: remove print in bond_verify_device_path
  - HID: apple: Add 2021 magic keyboard FN key mapping
  - HID: apple: Add support for the 2021 Magic Keyboard
  - net: sysfs: Fix /sys/class/net/<iface> path
  - net: ipv4: fix a memleak in ip_setup_cork
  - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
  - netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
  - ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
  - ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
  - ixgbe: Refactor overtemp event handling
  - ixgbe: Refactor returning internal error codes
  - ixgbe: Remove non-inclusive language
  - scsi: isci: Fix an error code problem in isci_io_request_build()
  - drm: using mul_u32_u32() requires linux/math64.h
  - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
  - perf: Fix the nr_addr_filters fix
  - drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
  - drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()'
  - virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
  - libsubcmd: Fix memory leak in uniq()
  - PCI/AER: Decode Requester ID when no error info found
  - fs/kernfs/dir: obey S_ISGID
  - tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
  - usb: hub: Replace hardcoded quirk value with BIT() macro
  - PCI: Only override AMD USB controller if required
  - mfd: ti_am335x_tscadc: Fix TI SoC dependencies
  - xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
  - i3c: master: cdns: Update maximum prescaler value for i2c clock
  - um: net: Fix return type of uml_net_start_xmit()
  - um: Don't use vfprintf() for os_info()
  - um: Fix naming clash between UML and scheduler
  - leds: trigger: panic: Don't register panic notifier if creating the trigger failed
  - drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
  - drm/amdgpu: Let KFD sync with VM fences
  - watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
  - clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
  - clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
  - drm/msm/dpu: Ratelimit framedone timeout msgs
  - media: ddbridge: fix an error code problem in ddb_probe
  - drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
  - ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL
  - ALSA: hda: Intel: add HDA_ARL PCI ID support
  - PCI: add INTEL_HDA_ARL to pci_ids.h
  - media: rockchip: rga: fix swizzling for RGB formats
  - media: stk1160: Fixed high volume of stk1160_dbg messages
  - drm/mipi-dsi: Fix detach call without attach
  - drm/framebuffer: Fix use of uninitialized variable
  - drm/drm_file: fix use of uninitialized variable
  - f2fs: fix write pointers on zoned device after roll forward
  - drm/amd/display: Fix tiled display misalignment
  - fast_dput(): handle underflows gracefully
  - ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
  - ALSA: hda: Refer to correct stream index at loops
  - i40e: Fix VF disable behavior to block all traffic
  - Bluetooth: L2CAP: Fix possible multiple reject send
  - Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
  - wifi: cfg80211: free beacon_ies when overridden from hidden BSS
  - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
  - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
  - arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
  - arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
  - md: Whenassemble the array, consult the superblock of the freshest device
  - block: prevent an integer overflow in bvec_try_merge_hw_page
  - net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
  - ARM: dts: imx23/28: Fix the DMA controller node name
  - ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
  - ARM: dts: imx27-apf27dev: Fix LED name
  - ARM: dts: imx25/27: Pass timing0
  - ARM: dts: imx25: Fix the iim compatible string
  - ionic: pass opcode to devcmd_wait
  - ARM: dts: imx1: Fix sram node
  - ARM: dts: imx27: Fix sram node
  - ARM: dts: imx: Use flash@0,0 pattern
  - ARM: dts: imx25/27-eukrea: Fix RTC node name
  - ARM: dts: rockchip: fix rk3036 hdmi ports node
  - bpf: Set uattr->batch.count as zero before batched update or deletion
  - scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
  - scsi: libfc: Don't schedule abort twice
  - ARM: dts: imx7s: Fix nand-controller #size-cells
  - ARM: dts: imx7s: Fix lcdif compatible
  - ARM: dts: imx7d: Fix coresight funnel ports
  - scsi: arcmsr: Support new PCI device IDs 1883 and 1886
  - bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
  - PCI: Add no PM reset quirk for NVIDIA Spectrum devices
  - selftests/bpf: Fix pyperf180 compilation failure with clang18
  - selftests/bpf: satisfy compiler by having explicit return in btf test
  - ext4: fix inconsistent between segment fstrim and full fstrim
  - ecryptfs: Reject casefold directory inodes
  - rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
  - afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
  - afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
  - crypto: stm32/crc32 - fix parsing list of devices
  - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - ACPI: extlog: fix NULL pointer dereference check
  - PNP: ACPI: fix fortify warning
  - ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
  - audit: Send netlink ACK before setting connection in auditd_set
  - regulator: core: Only increment use_count when enable_count changes
  - debugobjects: Stop accessing objects after releasing hash bucket lock
  - perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
  - x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
  - powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
  - powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
  - powerpc: Fix build error due to is_valid_bugaddr()
  - drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
  - x86/entry/ia32: Ensure s32 is sign extended to s64
  - tick/sched: Preserve number of idle sleeps across CPU hotplug events
  - mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
  - spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
  - gpio: eic-sprd: Clear interrupt after set the interrupt type
  - drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
  - drm/exynos: fix accidental on-stack copy of exynos_drm_plane
  - drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
  - arm64: dts: qcom: sc7180: fix USB wakeup interrupt types
  - arm64: dts: qcom: sc7180: Use pdc interrupts for USB instead of GIC interrupts
  - ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12
  - drm/bridge: nxp-ptn3460: simplify some error checking
  - drm/tidss: Fix atomic_flush check
  - drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
  - gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
  - exec: Fix error handling in begin_new_exec()
  - rbd: don't move requests to the running list on errors
  - btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
  - btrfs: don't warn if discard range is not aligned to sector
  - btrfs: tree-checker: fix inline ref size in error messages
  - btrfs: ref-verify: free ref cache before clearing mount opt
  - net: fec: fix the unhandled context fault from smmu
  - fjes: fix memleaks in fjes_hw_setup
  - selftests: netdevsim: fix the udp_tunnel_nic test
  - net: mvpp2: clear BM pool before initialization
  - netfilter: nf_tables: validate NFPROTO_* family
  - netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
  - net/mlx5: DR, Use the right GVMI number for drop action
  - tcp: Add memory barrier to tcp_push()
  - afs: Hide silly-rename files from userspace
  - vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
  - bnxt_en: Wait for FLR to complete during probe
  - mm: vmalloc: introduce array allocation functions
  - block: Remove special-casing of compound pages
  - nouveau/vmm: don't set addr on the fail path to avoid warning
  - rtc: Adjust failure return code for cmos_set_alarm()
  - mmc: mmc_spi: remove custom DMA mapped buffers
  - mmc: core: Use mrq.sbc in close-ended ffu
  - scripts/get_abi: fix source path leak
  - lsm: new security_file_ioctl_compat() hook
  - arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
  - arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
  - parisc/firmware: Fix F-extend for PDC addresses
  - PM: hibernate: Enforce ordering during image compression/decompression
  - crypto: api - Disallow identical driver names
  - ext4: allow for the last group to be marked as trimmed
  - iio:adc:ad7091r: Move exports into IIO_AD7091R namespace.
  - iio: adc: ad7091r: Enable internal vref if external vref is not supplied
  - iio: adc: ad7091r: Allow users to configure device events
  - iio: adc: ad7091r: Set alert bit in config register
  - serial: sc16is7xx: add check for unsupported SPI modes during probe
  - spi: introduce SPI_MODE_X_MASK macro
  - serial: sc16is7xx: set safe default SPI clock frequency
  - units: add the HZ macros
  - units: change from 'L' to 'UL'
  - PCI: mediatek: Clear interrupt status before dispatching handler
  - usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled
  - usb: cdns3: fix iso transfer error when mult is not zero
  - usb: cdns3: fix incorrect calculation of ep_buf_size when more than one config
  - usb: cdns3: fix uvc failure work since sg support enabled
  - usb: cdns3: Fixes for sparse warnings
  - !10246  ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
  - !10224  scsi: ufs: Fix a deadlock in the error handler
  - SUNRPC: Do not dereference non-socket transports in sysfs
  - SUNRPC: lock against ->sock changing during sysfs read
  - !10245  Bluetooth: hci_core: Fix leaking sent_cmd skb
  - usb-storage: alauda: Check whether the media is initialized
  - !10232  fix CVE-2024-41007
  - !10202  net: dsa: seville: register the mdiobus under devres
  - !10266  USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - !9430  CVE-2022-48703
  - !10255  dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
  - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
  - !10189  fix CVE-2024-40915
  - !10187  fix CVE-2021-47205
  - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
  - RDMA/hns: Fix mbx timing out before CMD execution is completed
  - RDMA/hns: Fix insufficient extend DB for VFs.
  - RDMA/hns: Fix undifined behavior caused by invalid max_sge
  - RDMA/hns: Fix shift-out-bounds when max_inline_data is 0
  - RDMA/hns: Fix missing pagesize and alignment check in FRMR
  - RDMA/hns: Fix unmatch exception handling when init eq table fails
  - RDMA/hns: Check atomic wr length
  - ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
  - !10210 hns3 udma: functions related to CQ bank IDs are supported.
  - !10194  sched/fair: Take the scheduling domain into account in select_idle_core()
  - Bluetooth: hci_core: Fix leaking sent_cmd skb
  - !10179 [22.03-LTS-SP3]net:openvswitch: Before calling ovs_vport_send, check the link status of vport->dev
  - !9913  powerpc/pseries: Enforce hcall result buffer validity and size
  - !10217  CVE-2024-35931
  - !10061 Backport bugfixes for RDMA/hns from mainline linux
  - !10046  nfs: Ensure that the NFS client returns a correct writeback error code
  - tcp: avoid too many retransmit packets
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
  - !10222  bpf: Fix overrunning reservations in ringbuf
  - !10203  dma-mapping: benchmark: fix node id validation
  - !9817  arm64: mm: Pass pbha-performance-only bit under chosen node
  - !10019  drm/exynos/vidi: fix memory leak in .get_modes()
  - !10178  ima: Fix use-after-free on a dentry's dname.name
  - scsi: ufs: Fix a deadlock in the error handler
  - bpf: Fix overrunning reservations in ringbuf
  - drm/amdgpu: Fix kabi breakage in struct amdgpu_hive_info
  - drm/amdgpu: Skip do PCI error slot reset during RAS recovery
  - drm/amdgpu : Add hive ras recovery check
  - hns3 udma: functions related to CQ bank IDs are supported.
  - !10135  ALSA: timer: Set lower bound of start tick time
  - !10104  ecryptfs: Fix buffer size for tag 66 packet
  - dma-mapping: benchmark: fix node id validation
  - net: dsa: seville: register the mdiobus under devres
  - !10138 [sync] PR-10095:  CVE-2024-40968
  - sched/fair: Take the scheduling domain into account in select_idle_core()
  - !10107  tracing: Build event generation tests only as modules
  - riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context
  - clk: sunxi-ng: Unregister clocks/resets when unbinding
  - !10156 v2  wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - !9836  fpga: manager: add owner module and take its refcount
  - net: openvswitch: fix race on port output
  - ima: Fix use-after-free on a dentry's dname.name
  - !10165  drop_monitor: replace spin_lock by raw_spin_lock
  - !10162  RDMA/mlx5: Add check for srq max_sge attribute
  - !10048  tipc: force a dst refcount before doing decryption
  - !10022  liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - !10150  mips: bmips: BCM6358: make sure CBR is correctly set
  - drop_monitor: replace spin_lock by raw_spin_lock
  - RDMA/mlx5: Add check for srq max_sge attribute
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - mips: bmips: BCM6358: make sure CBR is correctly set
  - MIPS: Octeon: Add PCIe link status check
  - !10041  Fix CVE-2024-36939
  - !10128  wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - ALSA: timer: Set lower bound of start tick time
  - !10118  wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - !10079  drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - !10052  vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - !10009  xfs: fix mount hung while sb recover fail
  - !10088  fix CVE-2024-40995
  - !9992  io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - !9901  ipv6: fix possible race in __fib6_drop_pcpu_from()
  - !10096 [sync] PR-9741:  scsi: qedf: Ensure the copied buf is NUL terminated
  - !9931  nvdimm: Backport some bugfixs
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - tracing: Build event generation tests only as modules
  - ecryptfs: Fix buffer size for tag 66 packet
  - scsi: qedf: Ensure the copied buf is NUL terminated
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
  - net/sched: act_api: rely on rcu in tcf_idr_check_alloc
  - drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - RDMA/hns: Fix UAF for cq async event
  - RDMA/hns: Add mutex_destroy()
  - Revert "RDMA/hns: Fix UAF for cq async event"
  - Revert "RDMA/hns: Add mutex_destroy()"
  - vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - tipc: force a dst refcount before doing decryption
  - nfs: Ensure write and flush consume writeback errors
  - NFS: Don't report ENOSPC write errors twice
  - NFS: Use of mapping_set_error() results in spurious errors
  - nfs: ensure correct writeback errors are returned on close()
  - nfs: nfs_file_write() should check for writeback errors
  - sunrpc: fix KABI broken in struct rpc_create_args
  - nfs: Handle error of rpc_proc_register() in nfs_net_init().
  - nfs: make the rpc_stat per net namespace
  - nfs: expose /proc/net/sunrpc/nfs in net namespaces
  - sunrpc: add a struct rpc_stats arg to rpc_create_args
  - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - drm/exynos/vidi: fix memory leak in .get_modes()
  - xfs: fix mount hung while sb recover fail
  - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - dax: alloc_dax() return ERR_PTR(-EOPNOTSUPP) for CONFIG_DAX=n
  - nvdimm/pmem: use add_disk() error handling
  - powerpc/pseries: Enforce hcall result buffer validity and size
  - ipv6: fix possible race in __fib6_drop_pcpu_from()
  - fpga: manager: add owner module and take its refcount
  - arm64: mm: Pass pbha-performance-only bit under chosen node
  - ksmbd: fix wrong DataOffset validation of create context
  - thermal: int340x_thermal: Consolidate priv->data_vault checks
  - thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR
  - netfilter: nf_tables: restore set elements when delete set fails
  - keys: Fix overwrite of key expiration on instantiation


author: Li Nan <linan122@huawei.com> - 5.10.0-221.0.0.120
changelog:
  - !10436  CVE-2024-39476
  - !10418  net: move to_gnet_bpf_attach_type() to filter.c
  - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING
  - Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
  - !10065  iommu: Return right value in iommu_sva_bind_device()
  - net: move to_gnet_bpf_attach_type() to filter.c
  - !10334  fix CVE-2024-36479 for olk-5.10
  - !10408  iommu/arm-smmu-v3: Fix the compile warning
  - !10363  drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
  - !10058  net: mvpp2: clear BM pool before initialization
  - !10057  udp: do not accept non-tunnel GSO skbs landing in a tunnel
  - iommu/arm-smmu-v3: Fix the compile warning
  - !10339  net/sched: initialize noop_qdisc owner
  - !10366 v2  jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
  - !10336 v2  mm: numa-affinity: support THP migration
  - !10321  media: i2c: et8ek8: Don't strip remove function when driver is builtin
  - !10318 【OLK 5.10】net: hns3: add set_loopback interface to realtek phy driver
  - !10342  CVE-2024-39471
  - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
  - drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
  - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
  - drm/amdgpu: add error handle to avoid out-of-bounds
  - net/sched: initialize noop_qdisc owner
  - mm,do_huge_pmd_numa_page: remove unnecessary TLB flushing code
  - mm: numa-affinity: delete the duplicate numa_migrate_prep
  - mm: numa-affinity: backport some migrate policy from AutoNuma
  - mm: numa-affinity: support THP migration
  - mm: thp: skip make PMD PROT_NONE if THP migration is not supported
  - mm: migrate: check mapcount for THP instead of refcount
  - mm: migrate: don't split THP for misplaced NUMA page
  - mm/migrate: fix NR_ISOLATED corruption on 64-bit
  - mm: migrate: account THP NUMA migration counters correctly
  - mm: thp: refactor NUMA fault handling
  - mm: memory: make numa_migrate_prep() non-static
  - mm: fix KABI broken in struct vm_fault
  - mm: memory: add orig_pmd to struct vm_fault
  - !10333  BMA: Fix DMA reset problem and change the version
  - fpga: bridge: add owner module and take its refcount
  - fpga: remove redundant checks for bridge ops
  - fpga: bridge: properly initialize bridge device before populating children
  - fpga: bridge: Use standard dev_release for class driver
  - fpga: bridge: Rename dev to parent for parent device
  - BMA/kbox_drv: Change the version number.
  - BMA/veth_drv: Change the version number.
  - BMA/cdev_drv: Change the version number.
  - BMA/edma_drv: Fix DMA reset problem and change the version number.
  - !9362  macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
  - media: i2c: et8ek8: Don't strip remove function when driver is builtin
  - net: phy: add set_loopback interface to realtek phy driver
  - !10316  sched: Add cfs_preferred_nid_init hook
  - !9976  KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
  - !10073  serial: imx: Introduce timeout when waiting on transmitter empty
  - !10172  netrom: Fix a memory leak in nr_heartbeat_expiry()
  - sched: Add cfs_preferred_nid_init hook
  - !10295 sdma-dae: fix interrupt handle logic
  - !10253  fbdev: savage: Handle err return when savagefb_check_var failed
  - !10309  net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr
  - !10304 Backport 5.10.211 LTS patches from upstream
  - net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr
  - block: ataflop: more blk-mq refactoring fixes
  - drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
  - drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
  - tls: rx: drop pointless else after goto
  - s390: use the correct count for __iowrite64_copy()
  - ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
  - ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
  - nouveau: fix function cast warnings
  - scsi: jazz_esp: Only build if SCSI core is builtin
  - bpf, scripts: Correct GPL license name
  - RDMA/srpt: fix function pointer cast warnings
  - arm64: dts: rockchip: set num-cs property for spi on px30
  - RDMA/bnxt_re: Return error for SRQ resize
  - mptcp: fix lockless access in subflow ULP diag
  - usb: roles: don't get/set_role() when usb_role_switch is unregistered
  - usb: roles: fix NULL pointer issue when put module's reference
  - usb: cdns3: fix memory double free when handle zero packet
  - usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
  - x86/alternative: Make custom return thunk unconditional
  - Revert "x86/alternative: Make custom return thunk unconditional"
  - x86/returnthunk: Allow different return thunks
  - x86/ftrace: Use alternative RET encoding
  - x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch()
  - x86/text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR
  - Revert "x86/ftrace: Use alternative RET encoding"
  - PCI/MSI: Prevent MSI hardware interrupt number truncation
  - KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
  - KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
  - s390/cio: fix invalid -EBUSY on ccw_device_start
  - erofs: fix lz4 inplace decompression
  - x86: drop bogus "cc" clobber from __try_cmpxchg_user_asm()
  - iwlwifi: mvm: write queue_sync_state only for sync
  - iwlwifi: mvm: do more useful queue sync accounting
  - platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC
  - lan743x: fix for potential NULL pointer dereference with bare card
  - btrfs: do not pin logs too early during renames
  - btrfs: unify lookup return value when dir entry is missing
  - btrfs: introduce btrfs_lookup_match_dir
  - btrfs: tree-checker: check for overlapping extent items
  - task_stack, x86/cea: Force-inline stack helpers
  - ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use
  - ASoC: Intel: boards: get codec device with ACPI instead of bus search
  - ASoC: Intel: boards: harden codec property handling
  - mtd: spinand: macronix: Add support for MX35LFxGE4AD
  - cifs: add a warning when the in-flight count goes negative
  - powerpc/watchpoints: Annotate atomic context in more places
  - powerpc/watchpoint: Workaround P10 DD1 issue with VSX-32 byte instructions
  - block: ataflop: fix breakage introduced at blk-mq refactoring
  - seccomp: Invalidate seccomp mode to catch death failures
  - x86/uaccess: Implement macros for CMPXCHG on user addresses
  - hsr: Avoid double remove of a node.
  - hvc/xen: prevent concurrent accesses to the shared ring
  - media: av7110: prevent underflow in write_ts_to_decoder()
  - ASoC: fsl_micfil: register platform component before registering cpu dai
  - ARM: dts: imx: Set default tuning step for imx6sx usdhc
  - irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable
  - ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger
  - pmdomain: renesas: r8a77980-sysc: CR7 must be always on
  - virtio-blk: Ensure no requests in virtqueues before deleting vqs.
  - firewire: core: send bus reset promptly on gap count error
  - scsi: lpfc: Use unsigned type for num_sge
  - hwmon: (coretemp) Enlarge per package core count limit
  - efi: Don't add memblocks for soft-reserved memory
  - Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table
  - ext4: correct the hole length returned by ext4_map_blocks()
  - nvmet-fc: abort command when there is no binding
  - nvmet-fc: release reference on target port
  - nvmet-fcloop: swap the list_add_tail arguments
  - netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
  - spi: sh-msiof: avoid integer overflow in constants
  - ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
  - nvmet-tcp: fix nvme tcp ida memory leak
  - regulator: pwm-regulator: Add validity checks in continuous .get_voltage
  - ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
  - ahci: asm1166: correct count of reported ports
  - wifi: cfg80211: fix missing interfaces when dumping
  - dmaengine: fsl-qdma: increase size of 'irq_name'
  - dmaengine: shdma: increase size of 'dev_id'
  - sched/rt: Fix sysctl_sched_rr_timeslice intial value
  - zonefs: Improve error handling
  - userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
  - sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
  - smb: client: fix parsing of SMB3.1.1 POSIX create context
  - smb: client: fix potential OOBs in smb2_parse_contexts()
  - net/sched: Retire dsmark qdisc
  - net/sched: Retire ATM qdisc
  - net/sched: Retire CBQ qdisc
  - drivers: misc: sdma-dae: fix interrupt handle logic
  - fbdev: savage: Handle err return when savagefb_check_var failed
  - netrom: Fix a memory leak in nr_heartbeat_expiry()
  - serial: imx: Introduce timeout when waiting on transmitter empty
  - iommu: Return right value in iommu_sva_bind_device()
  - net: mvpp2: clear BM pool before initialization
  - udp: do not accept non-tunnel GSO skbs landing in a tunnel
  - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
  - macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"


author: Li Nan <linan122@huawei.com> - 5.10.0-222.0.0.121
changelog:
  - !10787  NFSD: Fix the behavior of READ near OFFSET_MAX
  - !10764  CVE-2024-41027
  - !10666 v2  ASoC: fsl-asoc-card: set priv->pdev before using it
  - !10624  ata: libata-core: Fix double free on error
  - !10652  nvme: avoid double free special payload
  - NFSD: Fix the behavior of READ near OFFSET_MAX
  - !10785  fix CVE-2024-42155
  - s390/pkey: Wipe copies of protected- and secure-keys
  - Revert "s390/pkey: Wipe copies of protected- and secure-keys"
  - !10742  irqchip/mbigen: Fix mbigen node address layout
  - !10737  net/dpaa2: Avoid explicit cpumask var allocation on stack
  - Fix userfaultfd_api to return EINVAL as expected
  - mm/userfaultfd: fail uffd-wp registration if not supported
  - !10743  media: mediatek: vcodec: Only free buffer VA that is not NULL
  - !10759  Fix CVE-2024-42160
  - !10530  ftruncate: pass a signed offset
  - !10679  ibmvnic: Add tx check to prevent skb leak
  - !10725  scsi: qedf: Make qedf_execute_tmf() non-preemptible
  - f2fs: Add inline to f2fs_build_fault_attr() stub
  - f2fs: check validation of fault attrs in f2fs_build_fault_attr()
  - !10582 v2  bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
  - !10489  backport mainline patches
  - !10717  CVE-2024-42101
  - !10713  CVE-2024-41079
  - media: mediatek: vcodec: Only free buffer VA that is not NULL
  - irqchip/mbigen: Fix mbigen node address layout
  - !10727  net/iucv: Avoid explicit cpumask var allocation on stack
  - !10694 v2  drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
  - !10715  gve: Account for stopped queues when reading NIC stats
  - !10691  Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
  - net/dpaa2: Avoid explicit cpumask var allocation on stack
  - !10621  fix CVE-2024-42129
  - !9682  drm: vc4: Fix possible null pointer dereference
  - !10427  net: stmmac: move the EST lock to struct stmmac_priv
  - net/iucv: Avoid explicit cpumask var allocation on stack
  - scsi: qedf: Make qedf_execute_tmf() non-preemptible
  - !10697  mm: prevent derefencing NULL ptr in pfn_section_valid()
  - !10589 v2  ax25: Fix refcount imbalance on inbound connections
  - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
  - gve: Account for stopped queues when reading NIC stats
  - nvmet: always initialize cqe.result
  - !10683  ocfs2: fix DIO failure due to insufficient transaction credits
  - !10566  gpio: davinci: Validate the obtained number of IRQs
  - !10670  net: can: j1939: Initialize unused data in j1939_send_one()
  - !10661  fix CVE-2024-41062
  - !10519  xfs: add bounds checking to xlog_recover_process_data
  - !10650  xfs: don't walk off the end of a directory data block
  - mm: prevent derefencing NULL ptr in pfn_section_valid()
  - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
  - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
  - !10654  KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
  - !10630  sched/deadline: Fix task_struct reference leak
  - ocfs2: fix DIO failure due to insufficient transaction credits
  - ibmvnic: Add tx check to prevent skb leak
  - !10391  pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
  - net: can: j1939: Initialize unused data in j1939_send_one()
  - ASoC: fsl-asoc-card: set priv->pdev before using it
  - !10642  usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  - !10644  inet_diag: Initialize pad field in struct inet_diag_req_v2
  - !10636  RDMA/restrack: Fix potential invalid address access
  - !10648  net: dsa: mv88e6xxx: Correct check for empty list
  - !10598  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  - Bluetooth: L2CAP: Fix deadlock
  - bluetooth/l2cap: sync sock recv cb and release
  - !10503  fix CVE-2024-42155
  - KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
  - nvme: avoid double free special payload
  - xfs: don't walk off the end of a directory data block
  - net: dsa: mv88e6xxx: Correct check for empty list
  - inet_diag: Initialize pad field in struct inet_diag_req_v2
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  - !10557  CVE-2024-42105
  - RDMA/restrack: Fix potential invalid address access
  - sched/deadline: Fix task_struct reference leak
  - !10600  ppp: reject claimed-as-LCP but actually malformed packets
  - !10612  wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
  - !10603  IB/core: Implement a limit on UMAD receive List
  - ata: libata-core: Fix double free on error
  - leds: mlxreg: Use devm_mutex_init() for mutex initialization
  - locking/mutex: Introduce devm_mutex_init()
  - !10554  skmsg: Skip zero length skb in sk_msg_recvmsg
  - !10536  CVE-2024-42082
  - !10594  fix CVE-2024-41046
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
  - !10569  ila: block BH in ila_output()
  - !10564  net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
  - IB/core: Implement a limit on UMAD receive List
  - ppp: reject claimed-as-LCP but actually malformed packets
  - !10586  filelock: Fix fcntl/close race recovery compat path
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  - net: ethernet: lantiq_etop: fix double free in detach
  - net: lantiq_etop: add blank line after declaration
  - !10541  tap: add missing verification for short frame
  - !10540  tun: add missing verification for short frame
  - !10534  ipv6: prevent possible NULL deref in fib6_nh_init()
  - !10544  bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
  - ax25: Fix refcount imbalance on inbound connections
  - filelock: Fix fcntl/close race recovery compat path
  - !10548  powerpc/eeh: avoid possible crash when edev->pdev changes
  - !10527  Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
  - !10420  stm class: Fix a double free in stm_register_device()
  - !10475  ALSA: emux: improve patch ioctl data validation
  - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
  - ila: block BH in ila_output()
  - gpio: davinci: Validate the obtained number of IRQs
  - net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
  - nilfs2: fix inode number range checks
  - skmsg: Skip zero length skb in sk_msg_recvmsg
  - !10465  null_blk: fix validation of block size
  - powerpc/eeh: avoid possible crash when edev->pdev changes
  - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
  - tap: add missing verification for short frame
  - tun: add missing verification for short frame
  - xdp: xdp_mem_allocator can be NULL in trace_mem_connect().
  - xdp: Remove WARN() from __xdp_reg_mem_model()
  - xdp: Allow registering memory model without rxq reference
  - xdp: Move the rxq_info.mem clearing to unreg_mem_model()
  - !10476  jffs2: Fix potential illegal address access in jffs2_free_inode
  - !10467  io_uring: fix possible deadlock in io_register_iowq_max_workers()
  - !10454  fs/ntfs3: Validate ff offset
  - ipv6: prevent possible NULL deref in fib6_nh_init()
  - ftruncate: pass a signed offset
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
  - !10383  filelock: fix potential use-after-free in posix_lock_inode
  - xfs: add bounds checking to xlog_recover_process_data
  - !10460  udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
  - !10493  drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - !10417 Backport 5.10.212 LTS patches from upstream
  - !10487  fix CVE-2024-42086
  - !10384  drm/radeon: fix UBSAN warning in kv_dpm.c
  - s390/pkey: Wipe copies of protected- and secure-keys
  - !10425  kunit: Fix kthread reference
  - !10424  kunit: Fix kthread reference
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - irqdomain: Fixed unbalanced fwnode get and put
  - iio: chemical: bme680: Fix overflows in compensate() functions
  - !10361  PCI/ROM: Fix PCI ROM header check bug
  - mtd: spinand: gigadevice: fix Quad IO for GD5F1GQ5UExxG
  - gpio: fix resource unwinding order in error path
  - gpiolib: Fix the error path order in gpiochip_add_data_with_key()
  - gpio: 74x164: Enable output pins after registers are reset
  - ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks()
  - mptcp: fix possible deadlock in subflow diag
  - pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation
  - mmc: sdhci-xenon: fix PHY init clock stability
  - mmc: sdhci-xenon: add timeout for PHY init complete
  - mmc: core: Fix eMMC initialization with 1-bit bus connection
  - dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
  - wifi: nl80211: reject iftype change with mesh ID change
  - gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
  - afs: Fix endless loop in directory parsing
  - ALSA: Drop leftover snd-rtctimer stuff from Makefile
  - netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
  - Bluetooth: Enforce validation on max value of connection interval
  - Bluetooth: hci_event: Fix wrongly recorded wakeup BD_ADDR
  - net: usb: dm9601: fix wrong return value in dm9601_mdio_read
  - lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected
  - tun: Fix xdp_rxq_info's queue_index when detaching
  - mtd: spinand: gigadevice: Fix the get ecc status issue
  - mtd: spinand: gigadevice: Support GD5F1GQ5UExxG
  - crypto: virtio/akcipher - Fix stack overflow on memcpy
  - platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names
  - !10458  xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
  - !10404  Fix CVE-2024-41069
  - jffs2: Fix potential illegal address access in jffs2_free_inode
  - ALSA: emux: improve patch ioctl data validation
  - !10352  fix CVE-2024-40976
  - !10406  usb: gadget: ncm: Fix handling of zero block length packets
  - !10271  HID: core: remove unnecessary WARN_ON() in implement()
  - !10431  s390/qeth: fix deadlock during failing recovery
  - !10440  net/sched: Fix UAF when resolving a clash
  - !10328  net/smc: enable smcrv1 when RNIC supports rocev2
  - !10449  net: ena: Add validation for completion descriptors consistency
  - io_uring: fix possible deadlock in io_register_iowq_max_workers()
  - null_blk: fix validation of block size
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
  - fs/ntfs3: Validate ff offset
  - net: ena: Add validation for completion descriptors consistency
  - net/sched: Fix UAF when resolving a clash
  - s390/qeth: fix deadlock during failing recovery
  - net: stmmac: move the EST lock to struct stmmac_priv
  - kunit: Fix kthread reference
  - kunit: Fix kthread reference
  - stm class: Fix a double free in stm_register_device()
  - usb: gadget: ncm: Fix handling of zero block length packets
  - ASoC: topology: Fix route memory corruption
  - ASoC: topology: Fix references to freed memory
  - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
  - drm/radeon: fix UBSAN warning in kv_dpm.c
  - filelock: fix potential use-after-free in posix_lock_inode
  - PCI/ROM: Fix PCI ROM header check bug
  - drm/lima: mask irqs in timeout path before hard reset
  - drm/lima: add mask irq callback to gp and pp
  - net/smc: enable smcrv1 when RNIC supports rocev2
  - HID: core: remove unnecessary WARN_ON() in implement()
  - drm: vc4: Fix possible null pointer dereference


author: Li Nan <linan122@huawei.com> - 5.10.0-223.0.0.122
changelog:
  - !10877  drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - !10878  orangefs: fix out-of-bounds fsid access
  - !10876  drm/i915/gt: Fix potential UAF by revoke of fence registers
  - !10788 [OLK-5.10]sync some patch from upstream for Mini-OS
  - !10523 [OLK-5.10] drivers: add GDR support
  - !10885  crypto: aead,cipher - zeroize key buffer after use
  - !10888  s390/pkey: Wipe copies of clear-key structures on failure
  - !10820  powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - drivers: Fix kabi check failure
  - drivers: Add GDR(GPU Direct RDMA) support
  - !10842  netfilter: nf_tables: prefer nft_chain_validate
  - !10869 v2  net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
  - !10873  USB: serial: mos7840: fix crash on resume
  - !10887 v3  sched/fair: Prefer physical cores when migrating tasks
  - s390/pkey: Wipe copies of clear-key structures on failure
  - sched/fair: Prefer physical cores when migrating tasks
  - crypto: aead,cipher - zeroize key buffer after use
  - orangefs: fix out-of-bounds fsid access
  - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - drm/i915/gt: Fix potential UAF by revoke of fence registers
  - USB: serial: mos7840: fix crash on resume
  - !10831  wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
  - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
  - !10862 v2  ext4: flexibly control whether to enable dioread_nolock by default
  - !10849  wireguard: allowedips: avoid unaligned 64-bit memory accesses
  - !10817  media: dvb-frontends: tda10048: Fix integer overflow
  - !10616  USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  - !10801  fix CVE-2024-42095
  - !10514  powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
  - !10704  x86: stop playing stack games in profile_pc()
  - ext4: flexibly control whether to enable dioread_nolock by default
  - wireguard: allowedips: avoid unaligned 64-bit memory accesses
  - !10836  wifi: mt76: replace skb_put with skb_put_zero
  - !10839  bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - netfilter: nf_tables: prefer nft_chain_validate
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - wifi: mt76: replace skb_put with skb_put_zero
  - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
  - !10814  sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
  - !10807  wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
  - !10810  tcp_metrics: validate source addr length
  - !10766 Backport 5.10.213 LTS patches from upstream
  - powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - !10752  btrfs: qgroup: fix quota root leak after quota disable failure
  - media: dvb-frontends: tda10048: Fix integer overflow
  - sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
  - !10781  nilfs2: fix kernel bug on rename operation of broken directory
  - tcp_metrics: validate source addr length
  - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
  - !10733  filelock: Remove locks reliably when fcntl/close race is detected
  - !10765 mbigen: add kvm dependency
  - !10761  leds: an30259a: Use devm_mutex_init() for mutex initialization
  - !10681  crypto: ecdh - explicitly zeroize private_key
  - !10798  s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
  - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
  - serial: 8250_omap: Implementation of Errata i2310
  - s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
  - mbigen: add kvm dependency
  - !10778  Fix CVE-2021-47582
  - !10784  s390/pkey: Wipe sensitive data on failure
  - serial: max310x: implement I2C support
  - serial: max310x: make accessing revision id interface-agnostic
  - Drivers: hv: vmbus: Drop error message when 'No request id available'
  - serial: max310x: Unprepare and disable clock in error path
  - getrusage: use sig->stats_lock rather than lock_task_sighand()
  - getrusage: use __for_each_thread()
  - getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand()
  - getrusage: add the "signal_struct *sig" local variable
  - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
  - hv_netvsc: use netif_is_bond_master() instead of open code
  - hv_netvsc: Make netvsc/VF binding check both MAC and serial number
  - hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove
  - hv_netvsc: Wait for completion on request SWITCH_DATA_PATH
  - hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening
  - Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening
  - ext4: convert to exclusive lock while inserting delalloc extents
  - ext4: refactor ext4_da_map_blocks()
  - ext4: make ext4_es_insert_extent() return void
  - lsm: fix default return value of the socket_getpeersec_*() hooks
  - lsm: make security_socket_getpeersec_stream() sockptr_t safe
  - bpf: net: Change sk_getsockopt() to take the sockptr_t argument
  - net: Change sock_getsockopt() to take the sk ptr instead of the sock ptr
  - serial: max310x: prevent infinite while() loop in port startup
  - serial: max310x: use a separate regmap for each port
  - serial: max310x: use regmap methods for SPI batch operations
  - serial: max310x: Make use of device properties
  - serial: max310x: fail probe if clock crystal is unstable
  - serial: max310x: Try to get crystal clock rate from property
  - serial: max310x: Use devm_clk_get_optional() to get the input clock
  - xhci: handle isoc Babble and Buffer Overrun events properly
  - xhci: process isoc TD properly when there was a transaction error mid TD.
  - xhci: prevent double-fetch of transfer and transfer event TRBs
  - xhci: remove extra loop in interrupt context
  - um: allow not setting extra rpaths in the linux binary
  - selftests: mm: fix map_hugetlb failure on 64K page size systems
  - selftests/mm: switch to bash from sh
  - netrom: Fix a data-race around sysctl_netrom_link_fails_count
  - netrom: Fix a data-race around sysctl_netrom_routing_control
  - netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
  - netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
  - netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
  - netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
  - netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
  - netrom: Fix a data-race around sysctl_netrom_default_path_quality
  - netfilter: nft_ct: fix l3num expectations with inet pseudo family
  - geneve: make sure to pull inner header in geneve_rx()
  - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string
  - i40e: disable NAPI right after disabling irqs when handling xsk_pool
  - ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
  - net: lan78xx: fix runtime PM count underflow on link stop
  - lan78xx: Fix race conditions in suspend/resume handling
  - lan78xx: Fix partial packet errors on suspend/resume
  - lan78xx: Add missing return code checks
  - lan78xx: Fix white space and style issues
  - vhost: Add smp_rmb() in vhost_enable_notify()
  - vhost: Add smp_rmb() in vhost_vq_avail_empty()
  - s390/pkey: Wipe sensitive data on failure
  - nilfs2: fix kernel bug on rename operation of broken directory
  - usb: core: Don't hold the device lock while sleeping in do_proc_control()
  - USB: core: Make do_proc_control() and do_proc_bulk() killable
  - leds: an30259a: Use devm_mutex_init() for mutex initialization
  - btrfs: qgroup: fix quota root leak after quota disable failure
  - filelock: Remove locks reliably when fcntl/close race is detected
  - x86: stop playing stack games in profile_pc()
  - crypto: ecdh - explicitly zeroize private_key
  - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  - powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.


author: liuxu <liuxu156@huawei.com> - 1:1.34.1-21
changelog:
  - Type:CVE
  - Id:NA
  - SUG:NA
  - DESC:revert fix CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 CVE-2023-42363


author: xinghe <xinghe2@h-partners.com> - 2.0.11-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix: if libvirt and ebtables are installed at the same time, ping the operation prompts "sendmsg: Operation not permitted".


author: yanglu <yanglu72@h-partners.com> - 2.0.11-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:rebuild package to ensure that the upgrade between branches is normal


author: xinghe <xinghe2@h-partners.com> - 2.0.11-12
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix ebtables-restore --noflush failed when ebtables is uninstall


author: yexiao<yexiao7@huawei.com> - 202011-14
changelog:
  - fix CVE-2023-0464、CVE-2023-0465、CVE-2023-0466、CVE-2023-2650、CVE-2023-3446、CVE-2023-3817、CVE-2024-0727


author: yexiao<yexiao7@huawei.com> - 202011-16
changelog:
  - fix CVE-2023-45229、CVE-2023-45230、CVE-2023-45231、CVE-2023-45232、CVE-2023-45233、CVE-2023-45234、CVE-2023-45235


author: xinghe <xinghe2@h-partnres.com> - 1.0.2-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix zone combined forward must not default to True
         fix fw icmptype don't alter ipvs in io_object
         fix check config use the dictionary variants
         fix functions check config fails if direct.xml exists
         fix service adding includes


author: zhanghao <zhanghao383@huawei.com> - 1.0.2-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:chore nftables add delete table helper
         nftables always flush main table on start


author: zhanghao <zhanghao383@huawei.com> - 1.0.2-7
changelog:
  - Type:requirement
  - ID:NA
  - SUG:NA
  - DESC:Firewall startup is to set CleanupModuleOnxit=yes to unload
         related ko when stopping firewalld service


author: zhouyihang <zhouyihang3@h-partners.com> - 1.0.2-8
changelog:
  - Type:requirement
  - ID:NA
  - SUG:NA
  - DESC:To reduce unnecessary loading of ebtables-related kernel modules


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-47
changelog:
  - fix coredump when get empty from udp sendring
  - [virtio]: distribute pkg by dst_port
  - parse packages type in rx_poll
  - [virtio]: cfg ipv4 and ipv6 addr
  - fix build failed in 2003sp4
  - fix dpdk_bond_primary_set bug
  - cfg: del unnecessary logs
  - perftool: add latency tool


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-48
changelog:
  - add flow_bifurcation switch in lstack_cfg file
  - virtio: dfx data of virtio
  - virtio: update g_rule_port by reg_ring_type enum
  - virtio: mode actual_queue_num
  - fix poll init not clear old fd


author: chengyechun <chengyechun1@huawei.com> - 2.34-148
changelog:
  - Type:CVE
  - ID:CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602
  - SUG:NA
  - DESC:fix CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602


author: chengyechun <chengyechun1@huaiwe.com> - 2.34-149
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:nscd: Use errval, not errno to guide cache update
         nsce :Skip unusable entries in first pass in prune_cache


author: shixuantong <shixuantong1@huawei.com> - 2.34-150
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:elf: Add TLS modid reuse test for bug 29039
         elf: Fix TLS modid reuse generation assignment
         elf: Check objname before calling fatal_error
         elf: Fix _dl_debug_vdprintf to work before self-relocation
         elf: ldconfig should skip temporary files created by package managers
         ldconfig: Fixes for skipping temporary files.


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 3.24.30-8
changelog:
  - Fix the problem that the prompt information of network icon volume icon is not displayed
  - update xscreen size when x11 screen size change
  - always send the monitors changed signal when screen size change
  - Add function definition of gtk_image_set_from_pixbuf_with_scale


author: xinghe <xinghe2@h-partners.com> - 2.6.6-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:connection: Clear flags when a conn is removed
         connection: Preserve flags when a conn is removed
         stream: do not try to free a failed stream-conn
         http_ana/txn: don't re-initialize txn and req var
         mworker: prevent incorrect values in uptime
         protocol: fix minor memory leak in protocol_bind_all()
         stream: Perform errors handling in right order in stream_new()


author: xinghe <xinghe2@h-partners.com> - 2.6.6-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:backport to fix potential coredump:
         errors: handle malloc failure in usermsgs_put
         ssl_sock: add check for ha_meth
         thread: add a check for pthread_creat


author: xinghe <xinghe2@h-partners.com> - 2.6.6-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:server: add missing free for server->rdr_pfx
         server: do not leak default-server in defaults


author: xinghe <xinghe2@h-partners.com> - 2.6.6-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:server: 'source' interface ignored from 'default-server' directive


author: seuzw <930zhaowei@163.com> - 2.4.51-13
changelog:
  - Type:cves
  - ID:CVE-2022-36760,CVE-2006-20001,CVE-2022-37436
  - SUG:restart
  - DESC:fix CVE-2022-36760,CVE-2006-20001,CVE-2022-37436


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-15
changelog:
  - Type:CVE
  - ID:CVE-2023-27522, CVE-2023-25690
  - SUG:restart
  - DESC:fix CVE-2023-27522, CVE-2023-25690


author: chengyechun <chengyehcun1@huawei.com> - 2.4.51-16
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:Report an error if the AJP backend sends an invalid number of headers
         handled a negative value when parsing the config
         avoid delimiting the query with a backreference
         fix missing APLOGNO


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-17
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:Fix double encoding of the uri-path of the request
         Do not match the extention against possible query string
         Do not double encode slashes
         Check before forwarding that a nocanon path has not been rewriteen


author: panchenbo <panchenbo@kylinsec.com.cn> - 2.4.51-18
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:add sw_64 support,optimize sw build patch,add loongarch64 support


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-21
changelog:
  - Type:CVE
  - ID:CVE-2024-24795,CVE-2023-38709,CVE-2024-27316
  - SUG:NA
  - DESC:fix CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 and sync some patches from upstream


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-22
changelog:
  - Type:CVE
  - ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573
  - SUG:NA
  - DSEC:fix some CVEs


author: neu-mobi <liuyulong.work@qq.com> - 1:17.0.10.9-0.rolling
changelog:
  - del 8168469-Memory-leak-in-JceSecurity.patch
  - del 8275509-ModuleDescriptor.hashCode-isn-t-rep.patch
  - del 8275509-ModuleDescriptor.hashCode-isn-t-reproducible.patch
  - del 8285516-clearPassword-should-be-called-in-a-finally-.patch
  - del 8312065-Socket.connect-does-not-timeout-when-profili.patch
  - del 8313626-C2-crash-due-to-unexpected-exception-control.patch
  - del 8314063-The-socket-is-not-closed-in-Connection-creat.patch
  - del 8316576-com.sun.jndi.ldap.Connection.cleanup-does-no.patch
  - modified 8253495-CDS-generates-non-deterministic-outpu.patch
  - modified 8280872-Reorder-code-cache-segments-to-improv.patch
  - modified add-version-txt.patch
  - add Add-problemlist.patch
  - add puyuan-jdk17.0.9-patch.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> - 1:17.0.11.9-0.rolling
changelog:
  - del 8295068-SSLEngine-throws-NPE-parsing-CertificateRequ.patch
  - modify puyuan-jdk17.0.9-patch.patch


author: songliyang <songliyang@kylinos.cn> - 1:17.0.11.9-1
changelog:
  - rewrite LoongArch64-support.patch to sovle error while applying this patch in prep stage
  - fix loongarch vendor error and delete redundant vendor args


author: caixiaomeng <caixiaomeng2@huawei.com> - 1:0.9.5-11
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:ignore sssnic module when building hotpatch to fix sssnic wrongly dependency of sssnic


author: yaoxin <yao_xin001@hoperun.com> - 1.27.4-1
changelog:
  - Update to 1.27.4 for fix CVE-2024-6381 and CVE-2024-6383
  - libbson Fixes:
    * Fix build with Visual Studio 2013.
    * Fix parsing of colon in timezone.
    * Error on failure to init subdocument in bson_iter_visit_all.
    * Fix string handling in bson_string_new and bson_string_append.
    * Fix iteration in bson_strfreev.
    * Use aligned alloc for bson_array_builder_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Fix conversion warning with GCC 12.
    * Fixes to some format strings in trace logs.
    * Allow mongoc_buffer_t to be larger than INT_MAX.
    * Add bson_array_builder_t.
  - libmongoc Fixes:
    * Fix possible crash reading malformed wire protocol message.
    * Upgraded bundled Zlib from 1.2.3 to 1.3.1
    * Close leftover connections to removed servers.
    * Fix possible crash when client is configured with empty password.
    * Fix possible hang if mongoc_gridfs_file_readv is called with a corrupt chunk with incomplete data.
    * Fix 32-bit compile with 64-bit time_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Disable shared libmongoc targets if ENABLE_SHARED=OFF
    * Fix documentation build with Python 3.9.
    * Fix data race in mongoc_cursor_get_host.
    * Add back support for BUILD_VERSION CMake option. BUILD_VERSION was unintentionally removed in 1.25.0.
    * Send recoveryToken in transactions when connected to a load balancer.


author: yixiangzhike <yixiangzhike007@163.com> - 1.4.4-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:change the files order in patch file fix-doc-about-difok.patch


author: wangkai <13474090681@163.com> - 8.0.37-1
changelog:
  - Update to 8.0.37 for fix CVEs(CVE-2024-20964,CVE-2024-20971,CVE-2024-20976,
    CVE-2024-20973,CVE-2024-20978,CVE-2024-20981,CVE-2024-20962,CVE-2024-20977,
    CVE-2024-20963,CVE-2024-20965,CVE-2024-20972,CVE-2024-20961,CVE-2024-20982,
    CVE-2024-20970,CVE-2024-20967,CVE-2024-20984,CVE-2024-20974,CVE-2024-20966,
    CVE-2024-20960,CVE-2024-20985,CVE-2024-20969,CVE-2024-21000,CVE-2024-21069,
    CVE-2024-21009,CVE-2024-21087,CVE-2024-21047,CVE-2024-20998,CVE-2024-21013,
    CVE-2024-21060,CVE-2024-21008,CVE-2024-21102,CVE-2024-21054,CVE-2024-21062,
    CVE-2024-20994,CVE-2024-21096,CVE-2024-21061,CVE-2024-20993,CVE-2024-21055,
    CVE-2024-21057,CVE-2023-6129)


author: wangkai <13474090681@163.com> - 8.0.38-1
changelog:
  - Update to 8.0.38 for fix CVEs(CVE-2024-21125,CVE-2024-21142,CVE-2024-21179,
    CVE-2024-21171,CVE-2024-21130,CVE-2024-21162,CVE-2024-21177,CVE-2024-20996,
    CVE-2024-21134,CVE-2024-21165,CVE-2024-21173,CVE-2024-21129,CVE-2024-21127,
    CVE-2024-21163)


author: xinghe <xinghe2@h-partners.com> - 1:1.0.0-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix cache prepare nft_cache evaluate to return error
         fix cache validate handle string length
         add src support for implicit chain bindings
         fix cache release pending rules
         fix segtree map listing
         parser_json fix device parsing in netdev family
         fix src Don't parse string as verdict in map


author: huangyu <huangyu106@huawei.com> - 1:1.0.0-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix string prefix expression must retain original length
  fix release top level scope


author: zhanghao <zhanghao383@huawei.com> - 1:1.0.0-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:evaluate allow implicit ether vlan dep
  evaluate datatype memleak after binop transfer
  evaluate bogus datatype assertion in binary operation evaluation
  netlink delinearize do not transfer binary operation to non anonymous sets
  payload do not kill dependency for proto unknown
  monitor missing cache and set handle initialization
  netlink linearize fix timeout with map updates


author: zhanghao <zhanghao383@huawei.com> - 1:1.0.0-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix potential array out of bounds access
  evaluate: fix shift exponent underflow in concatenation evaluation
  netlink: Fix for potential NULL-pointer deref
  mnl: dump_nf_hooks() leaks memory in error path


author: gaihuiying <eaglegai@163.com> - 1:1.0.0-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: error out if basetypes are different
         evaluate: guard against NULL basetype
         evaluate: handle invalid mapping expressions gracefully
         evaluate: reject attempt to update a set
         evaluate: release mpz type in expr_evaluate_list() error path
         expression: missing line in describe command with invalid expression

  Thu Apr 18 2024 lingsheng <lingsheng1@h-partners.com> - 1:1.0.0-10
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:datatype: don't return a const string from cgroupv2_get_path()
  datatype: fix leak and cleanup reference counting for struct datatype
  datatype: initialize TYPE_CT_EVENTBIT slot in datatype array
  datatype: initialize TYPE_CT_LABEL slot in datatype array
  evaluate: do not remove anonymous set with protocol flags and single element
  evaluate: don't crash if object map does not refer to a value
  evaluate: error out when expression has no datatype
  evaluate: error out when store needs more than one 128bit register of align fixup
  evaluate: fix check for truncation in stmt_evaluate_log_prefix()
  evaluate: fix double free on dtype release
  evaluate: fix memleak in prefix evaluation with wildcard interface name
  evaluate: reject set in concatenation
  evaluate: revisit anonymous set with single element optimization
  evaluate: skip anonymous set optimization for concatenations
  evaluate: stmt_nat: set reference must point to a map
  evaluate: tproxy: move range error checks after arg evaluation
  evaluate: validate chain max length
  evaluate: validate maximum log statement prefix length
  exthdr: fix tcpopt_find_template to use length after mask adjustment
  exthdr: prefer raw_type instead of desc->type
  json: expose dynamic flag
  json: fix use after free in table_flags_json()
  libnftables: Drop cache in -c/--check mode
  meta: fix tc classid parsing out-of-bounds access
  netlink: don't crash if prefix for < byte is requested
  netlink: fix leaking typeof_expr_data/typeof_expr_key in netlink_delinearize_set()
  netlink: handle invalid etype in set_make_key()
  parser_bison: fix ct scope underflow if ct helper section is duplicated
  parser_bison: fix memleak in meta set error handling
  parser_bison: make sure obj_free releases timeout policies
  parser_json: Catch nonsense ops in match statement
  parser_json: Default meter size to zero
  parser_json: Fix flowtable prio value parsing
  parser_json: Fix synproxy object mss/wscale parsing
  parser_json: Fix typo in json_parse_cmd_add_object()
  parser_json: Proper ct expectation attribute parsing
  parser_json: Wrong check in json_parse_ct_timeout_policy()
  py: fix exception during cleanup of half-initialized Nftables
  rule: fix sym refcount assertion


author: fly_1997 <flylove7@outlook.com> -v1.0.1-6
changelog:
  - fix dependency error and add enable failed logs
  - fix dependency disabled failed and pre-enable illegal plugin


author: fly_1997 <flylove7@outlook.com> -v1.0.2-3
changelog:
  - add automatic startup based on the version
  - fix coredump when process exits
  - modify logger mode to append


author: renmingshuai<renmingshuai@huawei.com> - 8.8p1-25
changelog:
  - Type:CVE
  - CVE:CVE-2023-48795,CVE-2023-51385
  - SUG:NA
  - DESC:fix CVE-2023-48795 and CVE-2023-51385


author: zhouwenpei <zhouwenpei1@h-partners.com> - 0.90.0-6
changelog:
  - fix CVE-2022-37050,CVE-2022-37051,CVE-2022-37052,CVE-2022-38349,CVE-2020-23804
  - fix install error


author: xiongyi <xiongyi@uniontech.com> - 0.90.0-7
changelog:
  - fix CVE-2020-36023
  - fix infinite looping in cvtGlyph with broken files
  - patch source:https://gitlab.freedesktop.org/poppler/poppler/-/issues/1013


author: heppen <hepeng68@huawei.com> - 1.0.1-4
changelog:
  - Add the dependency on ipmitool.
  - Fix bug: Coredump when CPU cores number exceed 248 or numa nodes exceed 16.
  - Fix some memory bug.


author: heppen <hepeng68@huawei.com> - 1.1.0-3
changelog:
  - Bug fix: fix build warning.
  - Bug fix: export PWR_SYS_GetRtPowerInfo.
  - Bug fix: data collection task intercept invalid task type.


author: heppen <hepeng68@huawei.com> - 1.1.0-4
changelog:
  - Bug fix: memcpy null pointer, array out of bounds, struct align.
  - Bug fix: get watt state will failed at the first time.
  - Bug fix: use process name to query pid but return all pids.
  - Bug fix: mismatch fopen/pclose and popen/fclose, useless if statement.


author: heppen <hepeng68@huawei.com> - 1.1.0-5
changelog:
  - Bug fix: SIGPIPE cause powerapi server exit.
  - Bug fix: pstree command is too slow to get all pid.
  - Bug fix: set smart grid state failed.
  - Bug fix: get watt attr and task list is not correct.


author: Zihao Xue <xuezihao@huawei.com> - 1.1.0-6
changelog:
  - Bug fix: heap buffer overflow caused by sending incomplete strings.
  - Bug fix: too long strings into QueryProcs causes services broke down.


author: <fengjiabo1@huawei.com> - 10:6.2.0-87
changelog:
  - vdpa: suspend function return 0 when the vdpa device is stopped
  - vdpa: don't suspend/resume device when vdpa device not started
  - vdpa: support vdpa device suspend/resume
  - vdpa: correct param passed in when unregister save
  - vdpa: set vring enable only if the vring address has already been set
  - shadow_dev: introduce shadow dev for virtio-net device
  - revert "tcg/loongarch64: Fix tcg_out_mov() Aborted"
  - migration: Set downtime_start even for postcopy
  - gdb-xml: fix duplicate register in arm-neon.xml
  - iotests: fix default machine type detection
  - migration: fix RAMBlock add NULL check
  - s390x: Fix spelling errors
  - ppc: spelling fixes
  - hw/scsi/vhost-scsi: don't double close vhostfd on error
  - virtio/vhost-vsock: don't double close vhostfd, remove redundant cleanup
  - hw/scsi/vhost-scsi: don't leak vqs on error
  - hw/i386/pc: Add missing property descriptions
  - pcie_aer: Don't trigger a LSI if none are defined
  - pci: Export the pci_intx() function
  - hw/qdev: Cosmetic around documentation
  - tests/unit: fix a -Wformat-truncation warning
  - tests/avocado: mark ReplayKernelNormal.test_mips64el_malta as flaky
  - i386/sev: Avoid SEV-ES crash due to missing MSR_EFER_LMA bit
  - ui/vnc-clipboard: fix inflate_buffer
  - hw/usb/hcd-xhci.c: spelling: tranfer


author: <fengjiabo1@huawei.com> - 10:6.2.0-88
changelog:
  - ui/vnc.c: Fixed a deadlock bug.
  - hw/i386: Fix comment style in topology.h
  - migration/multifd: Remove unnecessary usage of local Error
  - linux-user: fix sockaddr_in6 endianness
  - vhost_vdpa: fix the input in trace_vhost_vdpa_listener_region_del()
  - iotests: fix 194: filter out racy postcopy-active event
  - tests/avocado: fix waiting for vm shutdown in replay_linux
  - ui/vnc: fix debug output for invalid audio message


author: <fengjiabo1@huawei.com> - 10:6.2.0-89
changelog:
  - qga-win: Fix guest-get-fsinfo multi-disks collection
  - hw/timer: fix systick trace message
  - virtio-net: correctly copy vnet header when flushing TX (CVE-2023-6693)
  - ui/clipboard: mark type as not available when there is no data (CVE-2023-6683)
  - esp: restrict non-DMA transfer length to that of available data (CVE-2024-24474)
  - hw/scsi/lsi53c895a: add missing decrement of reentrancy counter
  - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330)
  - net: Update MemReentrancyGuard for NIC (CVE-2023-3019)
  - net: Provide MemReentrancyGuard * to qemu_new_nic()


author: <fengjiabo1@huawei.com> - 10:6.2.0-90
changelog:
  - i386/cpuid: Move leaf 7 to correct group
  - i386/cpuid: Decrease cpuid_i when skipping CPUID leaf 1F
  - i386/cpu: Mask with XCR0/XSS mask for FEAT_XSAVE_XCR0_HI and FEAT_XSAVE_XSS_HI leafs
  - i386/cpu: Clear FEAT_XSAVE_XSS_LO/HI leafs when CPUID_EXT_XSAVE is not available
  - target/i386: Change wrong XFRM value in SGX CPUID leaf
  - target/i386: Enable support for XSAVES based features
  - target/i386: Add kvm_get_one_msr helper
  - hw/block/hd-geometry: Do not override specified bios-chs-trans mainline inclusion commit fd8a68ad6823d33bedeba20a22857867a1c3890e category: bugfix
  - linux-user/riscv: Align signal frame to 16 bytes mainline inclusion commit 1eaa63429a9944265c92efdb94c02fabb231f564 category: bugfix
  - ipmi:smbus: Add a check around a memcpy mainline inclusion commit 3fde641e7286f9b968bdb3b4b922c6465f2a9abc category: bugfix
  - tests/tcg/linux-test: Fix random hangs in test_socket mainline inclusion commit b9e6074fc5b429b1e956e9c60db7e284a91e0f3d category: bugfix
  - qemu-options.hx: Don't claim "-serial" has limit of 4 serial ports Before v2.12, the implementation of serial ports was limited to a value of MAX_SERIAL_PORTS = 4. We now dynamically allocate the data structures for serial ports, so this limit is no longer present, but the documentation for the -serial options still reads:
  - target/ppc: Modify the uncorrect value irq to n_IRQ
  - block-migration: Ensure we don't crash during migration cleanup
  - target/s390x: fix handling of zeroes in vfmin/vfmax mainline inclusion commit 13c59eb09bd6d1fbc13f08b708226421f14a232b category: bugfix
  - hw/virtio/virtio-iommu: Enforce power-of-two notify for both MAP and UNMAP mainline inclusion commit 0522be9a0c0094088ccef7aab352c57f483ca250 category: bugfix
  - configure: Add missing POSIX-required space mainline inclusion commit 35a7a6fc5624b1df828d82f2dfa74d0e4188b3b2 category: bugfix
  - vga: fix incorrect line height in 640x200x2 mode mainline inclusion commit 37e7b86766244b62a406747bb78e049390d0b528 category: bugfix
  - hw/ide/core: set ERR_STAT in unsupported command completion
  - linux-user/flatload.c: Fix setting of  image_info::end_code mainline inclusion commit 734a659ad264ac080457167e845ffabbaaa66d0e category: bugfix
  - load_elf: fix iterator's type for elf file processing
  - hw/misc/mps2-scc: Free MPS2SCC::oscclk[] array on finalize()
  - hw/nvram/xlnx-efuse: Free XlnxEFuse::ro_bits[] array on finalize()
  - hw/nvram/xlnx-efuse-ctrl: Free XlnxVersalEFuseCtrl[] "pg0-lock" array
  - chardev/char.c: fix "abstract device type" error message
  - block/rbd: fix handling of holes in .bdrv_co_block_status
  - qga: treat get-guest-fsinfo as "best effort" mainline inclusion commit bbb0151cf2e82489120a15df5e2eb9653312b0ec category: bugfix
  - usb/hcd-xhci: check slotid in  xhci_wakeup_endpoint() mainline inclusion commit 84218892f05515d20347fde4506e1944eb11cb25 category: bugfix
  - hw/display/bcm2835_fb: Fix framebuffer allocation  address mainline inclusion commit 5865d99fe88d8c8fa437c18c6b63fb2a8165634f category: bugfix
  - block/parallels: Fix buffer-based write call mainline inclusion commit eba088f91d21d9e42a81bef847173da30c5da961 category: bugfix
  - vl: Improve error message for conflicting -incoming and -loadvm
  - hw/smbios: Fix OEM strings table option validation


author: <fengjiabo1@huawei.com> - 10:6.2.0-91
changelog:
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/virtio: Introduce virtio_bh_new_guarded() helper
  - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded
  - checkpatch: add qemu_bh_new/aio_bh_new checks
  - async: avoid use-after-free on re-entrancy guard
  - async: Add an optional reentrancy guard to the BH API
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set(CVE-2024-3447)
  - rtl8139: Remove unused variable
  - tulip: Remove unused variable
  - virtio-mem: Fix the bitmap index of the section offset
  - virtio-mem: Fix the iterator variable in a vmem->rdl_list loop
  - system/memory: use ldn_he_p/stn_he_p
  - block: Fix crash when loading snapshot on inactive node
  - smmu: Clear SMMUPciBus pointer cache when system reset
  - block/mirror: Fix NULL s->job in active writes
  - amd_iommu: Fix APIC address check
  - virtio-crypto: fix NULL pointer dereference in virtio_crypto_free_reques
  - libqos/virtio.c: Correct 'flags' reading in qvirtqueue_kick
  - ivshmem-test.c: enable test_ivshmem_server for ppc64 arch
  - ivshmem.c: change endianness to LITTLE_ENDIAN
  - hw/ppc/mac.h: Remove MAX_CPUS macro
  - configure: remove dead variables
  - virtio-gpu: do not byteswap padding
  - hw/intc: clean-up error reporting for failed ITS cmd
  - qemu-iotests: Discard stderr when probing devices
  - linux-user: un-parent OBJECT(cpu) when closing thread
  - hw/net/rocker: Avoid undefined shifts with more than 31 ports
  - contrib/vhost-user-blk: Clean up deallocation of VuVirtqElement
  - scsi-disk: fix overflow when block size is not a multiple of BDRV_SECTOR_SIZE


author: <fengjiabo1@huawei.com> - 10:6.2.0-92
changelog:
  - s390x/sclp: Simplify get_sclp_device() 
  - target/ppc: Remove msr_pr macro
  - docs/system/target-arm: Re-alphabetize board list
  - migration: Extend query-migrate to provide dirty page limit info
  - migration: Implement dirty-limit convergence algo
  - migration: Put the detection logic before auto-converge checking
  - migration: Refactor auto-converge capability logic
  - migration: Introduce dirty-limit capability
  - qapi/migration: Introduce vcpu-dirty-limit parameters
  - qapi/migration: Introduce x-vcpu-dirty-limit-period parameter
  - Change the value of no_ged from true to false
  - Allow UNIX socket option for VNC websocket
  - tpm_emulator: Avoid double initialization during
  - chardev/char-socket: Update AF_UNIX for Windows
  - KVM: dirty ring: add missing memory barrier
  - i386: reset KVM nested state upon CPU reset
  - esp: Handle CMD_BUSRESET by resetting the SCSI bus
  - dbus-vmstate: Restrict error checks to registered proxies in dbus_get_proxies
  - vfio/pci: Add Ascend310b scend910b support
  - target/i386: Export RFDS bit to guests
  - target/i386: Add new CPU model SierraForest
  - target/i386: Introduce Icelake-Server-v7 to enable TSX
  - hw/virtio: handle un-configured shutdown in virtio-pci
  - target/s390x: display deprecation status in '-cpu  help'
  - target/i386: display deprecation status in '-cpu  help'
  - pc-bios/s390-ccw: Fix booting with logical block size < physical block size


author: <fengjiabo1@huawei.com> - 10:6.2.0-93
changelog:
  - cvm: bug-fix for macro isolation
  - tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fix CVE-2023-5088)
  - hw/ide: reset: cancel async DMA operation before resetting state (Fix CVE-2023-5088)
  - Add support for the virtcca cvm feature.


author: <fengjiabo1@huawei.com> - 10:6.2.0-96
changelog:
  - vdpa: Fix bug where vdpa appliance migration does not resume after rollback
  - block: Parse filenames only when explicitly requested (CVE-2024-4467)
  - block: introduce bdrv_open_file_child() helper
  - iotests/270: Don't store data-file with json: prefix in image (CVE-2024-4467)
  - iotests/244: Don't store data-file with protocol in image (CVE-2024-4467)
  - qcow2: Don't open data_file with BDRV_O_NO_IO (CVE-2024-4467)
  - qcow2: Do not reopen data_file in invalidate_cache
  - hw/intc/arm_gic: Fix deactivation of SPI lines chery-pick from 7175a562f157d39725ab396e39c1e8e410d206b3
  - vhost-user: Skip unnecessary duplicated VHOST_USER_SET_LOG_BASE requests
  - target/ppc: Split off common embedded TLB init cheery-pick from 581eea5d656b73c6532109f4ced4c73fd4e5fd47`
  - vdpa: fix vdpa device migrate rollback wrong when suspend device failed 1. 
  - hw/virtio/virtio-pci:Support shadow device for virtio-net/blk/scsi devices


author: sunsuwan <sunsuwan3@huawei.com> - 1.2.6-6
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:add a user directory when the rpc user directory does not exist


author: zouzhimin <zouzhimin@kylinos.cn> - 1:2.2.3.1-4
changelog:
  - Type:CVES
  - ID:CVE-2024-26141 CVE-2024-26146 CVE-2024-25126
  - SUG:NA
  - DESC:CVE-2024-26141 CVE-2024-26146 CVE-2024-25126


author: zouzhimin <zouzhimin@kylinos.cn> - 1:2.2.3.1-5
changelog:
  - Type:CVES
  - ID:CVE-2022-44570 CVE-2022-44571 CVE-2022-44572
  - SUG:NA
  - DESC:CVE-2022-44570 CVE-2022-44571 CVE-2022-44572


author: zhongjiawei<zhongjiawei1@huawei.com> - 1.1.3-27
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Set temporary single CPU affinity before cgroup cpuset transition


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-16
changelog:
  - Type:CVE
  - ID:CVE-2023-4736 CVE-2023-4733 CVE-2023-4734 CVE-2023-4735
  - SUG:NA
  - DESC:fix CVE-2023-4736 CVE-2023-4733 CVE-2023-4734 CVE-2023-4735


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-17
changelog:
  - Type:CVE
  - ID:CVE-2023-4738 CVE-2023-4750 CVE-2023-4752 CVE-2023-4781
  - SUG:NA
  - DESC:fix CVE-2023-4738 CVE-2023-4750 CVE-2023-4752 CVE-2023-4781


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-22
changelog:
  - Type:CVE
  - ID:CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237
  - SUG:NA
  - DESC:fix CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237


