# changelog

author: zhangxiaoyu<zhangxiaoyu58@huawei.com> - 2.0.9-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix update cpu-rt period failed and fix layer size type as int64


author: jikai<jikai11@huawei.com> - 2.0.9-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix potential log error, empty pointer reference and overflow


author: zhangxiaoyu<zhangxiaoyu58@huawei.com> - 2.0.8-9
changelog:
  - Type:enhancement
  - CVE:NA
  - SUG:NA
  - DESC:add macro to adapt musl libc and add add-gids option for exec


author: fuanan <fuanan3@huawei.com> - 563-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:[add] backport patches from upstream
         Create only one ifile when a file is opened under different names.
         Remove extraneous frees, associated with removed call to lrealpath.
         Fix crash when call set_ifilename with a pointer to the name that is
         Remove unnecessary call to pshift in pappend.
         Reset horizontal shift when opening a new file.
         Protect from buffer overrun.
         Make histpattern return negative value to indicate error.
         Lesskey: don't translate ctrl-K in an EXTRA string.
         Ignore SIGTSTP in secure mode.
         Fix "Tag not found" error while looking for a tag's location
         Fix minor memory leak with input preprocessor.


author: Eibz-Chan <chenbingzhao@huawei.com> - 590-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:[add] backport patches from upstream
  	Fix-memory-leak-when-using-corrupt-lesshst-file.patch
  	Fix-crash-when-enter-invaid-pattern-in-command.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-19
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         [add]backport-libfdisk-Fix-randomly-generated-GPT-UUID-s.patch
         backport-write-correctly-handle-wide-characters.patch
         backport-wall-convert-homebrew-buffering-to-open_memstream.patch
         backport-wall-use-fputs_careful.patch
         backport-hexdump-parse-handle-truncated-format-pattern.patch
         backport-libblkid-copy-BLKID_PARTS_FORCE_GPT-to-whole-disk-pr.patch
         backport-lscpu-fix-p-output-all-caches-delimiter.patch
         backport-add-return-in-supam_conv-function.patch
         backport-wrap-return-in-else-directive-to-avoid-dead-code.patch
         backport-sulogin-ignore-none-existing-console-devices.patch
         backport-sulogin-fix-KDGKBMODE-ifdef.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-20
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         [add]backport-lib-caputils-fix-integer-handling-issues-coverity-sc.patch
         backport-unshare-Move-implementation-of-keep-caps-option-to-l.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-21
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         [add]backport-libblkid-jfs-avoid-undefined-shift.patch
         backport-cfdisk-add-hint-about-labels-for-bootable-flag.patch
         backport-logger-initialize-socket-credentials-contol-union.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-22
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         [add]backport-column-fix-buffer-overflow-when-l-specified.patch
         backport-column-fix-greedy-mode-on-l.patch
         backport-column-fix-memory-leak.patch
         backport-column-fix-l.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-23
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         [add]backport-scriptreplay-support-ctrl-s-and-ctrl-g.patch
         backport-login-use-correct-terminal-fd-during-setup.patch
         backport-login-prevent-undefined-ioctl-and-tcsetattr-calls.patch
         backport-libblkid-avoid-memory-leak-of-cachefile-path.patch
         backport-more-avoid-out-of-bound-access.patch
         backport-lslogins-fix-realloc-loop-allocation-size.patch
         backport-ldattach-don-t-call-exit-from-signal-handler.patch
         backport-libblkid-ntfs-validate-that-sector_size-is-a-power-o.patch
         backport-blkid-fix-call-to-err_exclusive_options.patch
         backport-libblkid-reset-errno-before-calling-probefuncs.patch
         backport-lib-path-fix-possible-out-of-boundary-access.patch
         backport-libmount-improve-mnt_table_next_child_fs.patch
         backport-libmount-fix-possible-NULL-dereference-coverity-scan.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-24
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
  	[add]backport-libsmartcols-drop-spourious-newline-in-between-strea.patch
  	backport-libsmartcols-flush-correct-stream.patch
  	backport-libsmartcols-only-recognize-closed-object-as-final-e.patch
  	backport-cal-avoid-out-of-bound-write.patch
  	backport-libfdisk-sun-properly-initialize-partition-data.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-25
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:solve the issue of ext4 is incorrectly probed as drbd
          [add]backport-include-c.h-add-helpers-for-unaligned-structure-acce.patch
          backport-libblkid-probe-read-data-in-chunks.patch
          backport-libblkid-avoid-aligning-out-of-probing-area.patch
          backport-libblkid-drbd-validate-zero-padding.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-26
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         backport-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-receive.patch
         backport-libblkid-hfsplus-reduce-false-positive.patch
         backport-wall-fix-calloc-cal-Werror-calloc-transposed-args.patch
         backport-libblkid-drbd-reduce-false-positive.patch
         backport-lib-cpuset-exit-early-from-cpulist_parse.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-27
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         backport-sys-utils-lscpu-Unblock-SIGSEGV-before-vmware_bdoor.patch
         backport-libblkid-Check-offset-in-LUKS2-header.patch
         backport-more-fix-poll-use.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-29
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add provides and support enable-raw
         The current version of the kernel also supports the raw driver.
         To keep consistent with the previous version, roll back the modification.


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-30
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix lscpu core dump
         backport-lscpu-don-t-use-NULL-sharedmap.patch
         backport-lscpu-use-topology-maps-in-more-robust-way.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-31
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         backport-hexdump-check-blocksize-when-display-data.patch
         backport-lslocks-fix-buffer-overflow.patch
         backport-last-avoid-out-of-bounds-array-access.patch
         backport-lsipc-fix-semaphore-USED-counter.patch


author: yanglongkang <yanglongkang@h-partners.com> - 2.37.2-32
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         backport-uuidd-fix-open-lock-state-issue.patch


author: zhangmingyi<zhangmingyi5@huawei.com> - 2:0.8.1-3
changelog:
  -- backporting: backport-libbpf-Ensure-functions-with-always_inline-attribute-are-inline.patch 
                  backport-libbpf-Fix-the-name-of-a-reused-map.patch
                  backport-libbpf-preserve-errno-across-pr_warn-pr_info-pr_debug.patch


author: JofDiamonds <kwb0523@163.com> -2:0.8.1-4
changelog:
  - backport patches from upstream:
    backport-libbpf-Fix-overrun-in-netlink-attribute-iteration.patch
    backport-libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch
    backport-libbpf-Deal-with-section-with-no-data-gracefully.patch
    backport-libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch
    backport-sync-start-syncing-include-uapi-linux-fcntl.h-UAPI-h.patch
    backport-libbpf-Handle-size-overflow-for-ringbuf-mmap.patch
    backport-libbpf-Use-page-size-as-max_entries-when-probing-rin.patch


author: SuperCharge <xiesongyang@huawei.com> -2:0.8.1-6
changelog:
  - backport patches from upstream:
    backport-libbpf-Fix-alen-calculation-in-libbpf_nla_dump_error.patch


author: zhangmingyi <zhangmingyi5@huawei.com> -2:0.8.1-8
changelog:
  - backport patches from upstream:
    backport-libbpf-disassociate-section-handler-on-explicit-bpf_.patch
    backport-libbpf-Use-correct-return-pointer-in-attach_raw_tp.patch
    backport-libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch


author: zhangmingyi <zhangmingyi5@huawei.com> 2:0.8.1-9
changelog:
  - backport patches from upstream:
    backport-libbpf-Ensure-FD-3-during-bpf_map__reuse_fd.patch
    backport-libbpf-Ensure-libbpf-always-opens-files-with-O_CLOEX.patch


author: zhangmingyi <zhangmingyi5@huawei.com> 2:0.8.1-10
changelog:
  - backport patches from upstream:
    backport-libbpf-Fix-realloc-API-handling-in-zero-sized-edge-cases.patch
    backport-libbpf-Set-close-on-exec-flag-on-gzopen.patch
    backport-libbpf-Fix-is_pow_of_2.patch
    backport-libbpf-make-RINGBUF-map-size-adjustments-more-eagerly.patch


author: yaoxin <yao_xin001@hoperun.com> - 1.27.4-1
changelog:
  - Update to 1.27.4 for fix CVE-2024-6381 and CVE-2024-6383
  - libbson Fixes:
    * Fix build with Visual Studio 2013.
    * Fix parsing of colon in timezone.
    * Error on failure to init subdocument in bson_iter_visit_all.
    * Fix string handling in bson_string_new and bson_string_append.
    * Fix iteration in bson_strfreev.
    * Use aligned alloc for bson_array_builder_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Fix conversion warning with GCC 12.
    * Fixes to some format strings in trace logs.
    * Allow mongoc_buffer_t to be larger than INT_MAX.
    * Add bson_array_builder_t.
  - libmongoc Fixes:
    * Fix possible crash reading malformed wire protocol message.
    * Upgraded bundled Zlib from 1.2.3 to 1.3.1
    * Close leftover connections to removed servers.
    * Fix possible crash when client is configured with empty password.
    * Fix possible hang if mongoc_gridfs_file_readv is called with a corrupt chunk with incomplete data.
    * Fix 32-bit compile with 64-bit time_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Disable shared libmongoc targets if ENABLE_SHARED=OFF
    * Fix documentation build with Python 3.9.
    * Fix data race in mongoc_cursor_get_host.
    * Add back support for BUILD_VERSION CMake option. BUILD_VERSION was unintentionally removed in 1.25.0.
    * Send recoveryToken in transactions when connected to a load balancer.


author: yixiangzhike <yixiangzhike007@163.com> - 2.32-3
changelog:
  - capsh better error handling for integer parsing
  - setcap clean up error handling of the ns rootid argument


author: chenhaixing <chenhaixing@huawei.com> - 0.69.0-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libdnf:Avoid reinstalling installonly packages marked for ERASE
                Fix utimes error message in dnf-repo
                Do not download repository if our local cache is up to date in dnf-repo
                python bindings:Load all modules with RTLD_GLOBAL


author: hanhuihui <hanhuihui5@huawei.com> - 0.69.0-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix history rollback cmd not meet the expectation
         Fix memory leak in subject-py


author: yanglu<yanglu72@h-partners.com> - 8.17.1-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: fix newaliases command error and postfix service start execption after sendmail install


author: yixiangzhike <yixiangzhike007@163.com> - 1.4.4-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:change the files order in patch file fix-doc-about-difok.patch


author: zhangjun<zhangjun@kylinos.cn> - 0.7.20-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix memory leak when using testsolv to execute cases 
         Fix segfault on conflict resolution when using bindings


author: zengweifeng <zwfeng@huawei.com> - 0.9.6-3
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:add errno while reset with strtoul call
         fix error returned in ssh_userauth_try_publicke
         client do not close the socket if it was set via opt
         fix openForward to not set sourcehost to NULL
         fix the length calculation of packet in sftp_write


author: xinghe <xinghe2@h-partners.com> - 0.9.6-4
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:options: Parse hostname by last '@'
         torture_options: Add test for '@' in login name
         session: Initialize pointers
         tests: Ensure the mode of the created file is what we set


author: seuzw <930zhaowei@163.com> - 0.9.6-5
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:backport some upstream patches:
         Avoid false positive report from Coveritt CID 1470006
         kdf: Avoid endianess issues
         misc: Fix format truncation in ssh_path_expand_escape()
         misc: Fix expanding port numbers
         misc: rename gettimeofday symbol
         session: Initialize the port with the standard port (22)
         session->socket_callbacks.data will be set to ssh_packet_socket_callback
         socket: Add error message if execv fails
         tests: Add test for expanding port numbers


author: renmingshuai <renmingshuai@huawei.com> - 0.9.6-6
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:config: Escape brackets in ProxyCommand build
         packet: do not enqueue outgoing packets


author: renmingshuai <renmingshuai@huawei.com> - 0.9.6-8
changelog:
  - Type:CVE
  - Id:CVE-2023-6004,CVE-2023-6918,CVE-2023-48795
  - SUG:NA
  - DESC:fix CVE-2023-6004, CVE-2023-6918 and CVE-2023-48795


author: zhouwenpei <zhouwenpei1@h-partners.com> - 4.3.0-23
changelog:
  - fix CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799,
  - fix CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804


author: yezengruan <yezengruan@huawei.com> - 0.7.3-7
changelog:
  - tpm2: Reset TPM2B buffer sizes after test fails for valid buffer size
  - tpm2: Add maxSize parameter to TPM2B_Marshal for sanity checks
  - tpm2: Restore original value if unmarsalled value was illegal
  - fix CVE-2021-3623


author: yaoxin <yao_xin001@hoperun.com> - 2.20.0-1
changelog:
  - Upgrade to 2.20.0
  - Fix CVE-2023-39929
  - Fix minor issue about printf data type and value range
  - av1: Revise offsets comments for av1 encode
  - jpeg: add support for crop and partial decode
  - Drop no longer applicable vaGetDriverNames check


author: XuFei <xufei30@huawei.com> - 6.2.0-56
changelog:
  - nodedev: ignore EINVAL from libudev in udevEventHandleThread
  - qemu: tpm: Pass --logfile to swtpm_setup for incoming migration


author: zhangxinhao <zhangxinhao1@huawei.com> - 6.2.0-57
changelog:
  - cpu_topo: support for cpu_topo "clusters” in conf
  - cpu_topo: support for specifying "clusters" in qemu comand
  - cpu_topo: support for reporting cluster_id in NUMA topology
  - cpu_topo: fix detection of vCPU pids when multiple clusters are present


author: Jiabo Feng <fengjiabo1@huawei.com> - 6.2.0-58
changelog:
  - virnetsshsession: Adapt to change libssh2 API
  - selinux: Reflect context_str() type change
  - Revert "selinux: adapt to libselinux"
  - selinux: adapt to libselinux
  - fix error in printf format string


author: Jiabo Feng <fengjiabo1@huawei.com> - 6.2.0-61
changelog:
  - lxc: fix lxcContainerMountAllFS() DEREF_BEFORE_CHECK
  - qemu: Return perf status that affect next boot  for shutoff domains While we set up perf events for a shutoff domain and check the settings, All of perf events are reported as 'disabled', unless we add --config, This is redundant for a shutoff domain.
  - tests: upstream Fixing compiler warning in cputest
  - qemu_migration_cookie: Rename ret in qemuDomainExtractTLSSubject
  - virrandom: Fix printf format string in virRandomGenerateWWN()
  - fix the issue of errors when saving after 'virsh edit'
  - Use (un)signed printf specifiers correctly
  - admin: fix leak of typed parameters on error
  - esx: call freeaddrinfo earlier in esxUtil_ResolveHostname Call freeaddrinfo() as soon as @result is not needed anymore, i.e. right after getnameinfo(); this avoids calling freeaddrinfo() in two branches.
  - qemu: Fix incorrect command name in error messages


author: jiangdongxu <jiangdongxu1@huawei.com> - 6.2.0-62
changelog:
  - vdpa: Release pci slot address when unplugging vdpa device
  - vdpa: return pcieFlags when calculate vdpa passthrough devices.
  - vdpa: support vdpa device migrate
  - vdpa: support vdpa device hot plug/unplug
  - vdpa: Introduce the new device type vdpa to hostdev
  - node_device: fix leak of DIR*
  - Include vdpa devices in node device list


author: caozhongwang <caozhongwang1@huawei.com>
changelog:
  - interface: fix udev_device_get_sysattr_value return value check (CVE-2024-2496)
  - remote: check for negative array lengths before allocation (CVE-2024-2494)
  - vish:Fix off-by-one error in udevListInterfacesByStatus (CVE-2024-1441)


author: jiangjiacheng <jiangjiacheng@huawei.com> - 6.2.0-64
changelog:
  - util: keep track of full GSource object not source ID number
  - rpc: mark source returned by virEventGLibAddSocketWatch as unused
  - rpc: ensure temporary GSource is removed from client event loop (CVE-2024-4418)


author: Jiabo Feng <fengjiabo1@huawei.com> - 6.2.0-65
changelog:
  - remote: fix double free of migration params on error
  - qemu: avoid deadlock in qemuDomainObjStopWorker We are dropping the only reference here so that the event loop thread is going to be exited synchronously. In order to avoid deadlocks we need to unlock the VM so that any handler being called can finish execution and thus even loop thread be finished too.
  - virsh: add tmm main command word Add tmm command word into virsh tool to call get tmm memory info API. It makes virsh can use tmm main commmand to show tmm memory info on console. This command requires specific kernel and a kernel driver to make sure its regular function. If runnning environment missing the above reliance, this command will show error result on console.
  - libvirt: add get tmm memory info API and libvirtd RPC Add the get tmm memory info API into libvirt-host. Also should add the RPC calls into libvirtd for API calling.
  - libvirt: support the virtCCA feature Add cvm parameter into the type of LaunchSecurity which is a optional filed for libvirt xml. Its purpose is to pass the cvm parameter through to qemu. Also this patch support virsh edit to save cvm parameter into libvirt temporary xml.
  - qemu_driver: Add calc_mode for dirtyrate statistics
  - virsh: Add mode option to domdirtyrate-calc virsh api
  - qemu: Generate command line for dirty-ring-size
  - qemu: support dirty ring feature
  - conf: Turn virDomainDef.kvm_features into a struct
  - qemu_validate: Allow kvm hint-dedicated on non-passthrough VMs
  - virDomainFeaturesKVMDefParse: Remove tautological "if"
  - virDomainFeaturesKVMDefParse: Remove tautological "switch"
  - virxml: Add virXMLPropUInt
  - virxml: Add virXMLPropInt
  - virxml: Add virXMLPropTristateSwitch
  - virxml: Add virXMLPropTristateBool
  - virDomainFeaturesKVMDefParse: Remove ctxt
  - virDomainFeaturesDefParse: Factor out KVM parsing into separate function
  - internal.h: Introduce and use VIR_IS_POW2()
  - hotpatch: if hotpatch_path not in qemu.conf,the hotpatch doesn't antoload


author: fuanan <fuanan3@h-partners.com> - 2.9.14-1
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:Upgrade to upstream v2.9.14 and Cleanup duplicate installation


author: fuanan <fuanan3@h-partners.com> - 2.9.12-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:use upstream patch refix heap-use-after-free in xmlAddNextSibling and xmlAddChild


author: fuanan <fuanan3@h-partners.com> - 2.9.12-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix memory leaks in xmlACatalogAdd when xmlHashAddEntry failed


author: zhaoxiaohu <zhaoxiaohu@kuaishou.com> - 20211027-3
changelog:
  - fix build install need use copy-firmware.sh ice Intel(R) E810 Series intel/ice/ddp/ice.pkg -> ice-1.3.26.0.pkg


author: Xiong Zhou <xiongzhou4@huawei.com> 0-2.20211016.gitb72f753
changelog:
  - Type:backport
  - ID:NA
  - SUG:NA
  - DESC: Handle data at the beginning of a function when disassembling and building CFG.


author: Xiong Zhou <xiongzhou4@huawei.com> 15.0.7-2
changelog:
  - Type:Update
  - ID:NA
  - SUG:NA
  - DESC: Backport bugfix and add AArch64 support for hugify and inline.


author: bzhaoop<bzhaojyathousandy@gmail.com> -4:10.5.15-1
changelog:
  - Bump to 10.5.15
  - For resolving CVEs:
  - CVE-2022-24048
  - CVE-2022-24052
  - CVE-2022-24050
  - CVE-2022-24051
  - CVE-2021-46668
  - CVE-2021-46658


author: bzhaoop<bzhaojyathousandy@gmail.com> - 4:10.5.15-2
changelog:
  - Fix the systemd service issue about the env variable.
  - Apply the patches from old branch.
  - Adaption the cmake version and integrate into the spec file.


author: bzhaoop<bzhaojyathousandy@gmail.com> - 4:10.5.16-1
changelog:
  - Bump to 10.5.16 for resolving CVEs below
  - CVE-2022-27385
  - CVE-2022-27382
  - CVE-2022-27451
  - CVE-2022-27457
  - CVE-2022-27446
  - CVE-2022-27455
  - CVE-2022-27444
  - CVE-2022-27379
  - CVE-2022-27386
  - CVE-2022-27447
  - CVE-2022-27448
  - CVE-2022-27449
  - CVE-2022-27445
  - CVE-2022-27456
  - CVE-2022-27458
  - CVE-2022-27452
  - CVE-2022-27376
  - CVE-2022-27378
  - CVE-2022-27377
  - CVE-2022-27381
  - CVE-2022-27383
  - CVE-2022-27380
  - CVE-2022-27384
  - CVE-2022-27387
  - And we fit the latest packages for the new mariadb release, such as errmsg package.


author: xiejing <xiejing@kylinos.cn> - 1:10.5.25-1
changelog:
  - Bump to 10.5.25 for resolving CVE-2024-21096, CVE-2023-22084
  - Fix version description in systemd service file


author: weishengjing <weishengjing1@huawei.com> - 8.0.22-1
changelog:
  - New version 8.0.22 fix CVES:   CVE-2020-14852 CVE-2020-14794 CVE-2020-14775
     CVE-2020-14893 CVE-2020-14829 CVE-2020-14828 CVE-2020-14888 CVE-2020-14891
     CVE-2020-14812 CVE-2020-14870 CVE-2020-14769 CVE-2020-14878 CVE-2020-14789
     CVE-2020-14821 CVE-2020-14844 CVE-2020-14836 CVE-2020-14830 CVE-2020-14827
     CVE-2020-14773 CVE-2020-14765 CVE-2020-14869 CVE-2020-14776 CVE-2020-14861
     CVE-2020-14866 CVE-2020-14672 CVE-2020-14837 CVE-2020-14771 CVE-2020-14785
     CVE-2020-14838 CVE-2020-14848 CVE-2020-14791 CVE-2020-14793 CVE-2020-14804
     CVE-2020-14777 CVE-2020-14800 CVE-2020-14786 CVE-2020-14845 CVE-2020-14839
     CVE-2020-14846 CVE-2020-14867 CVE-2020-14868 CVE-2020-14873 CVE-2020-14860
     CVE-2020-14814 CVE-2020-14790 CVE-2020-14809


author: wangxiao <wangxiao65@huawei.com> - 8.0.23-1
changelog:
  - Upgrade mysql to 8.0.23, fix CVES: CVE-2021-1998 CVE-2021-2002
    CVE-2021-2010 CVE-2021-2011 CVE-2021-2016 CVE-2021-2021 CVE-2021-2022
    CVE-2021-2024 CVE-2021-2031 CVE-2021-2032 CVE-2021-2036 CVE-2021-2038
    CVE-2021-2046 CVE-2021-2048 CVE-2021-2056 CVE-2021-2058 CVE-2021-2060
    CVE-2021-2061 CVE-2021-2065 CVE-2021-2070 CVE-2021-2072 CVE-2021-2076
    CVE-2021-2081 CVE-2021-2087 CVE-2021-2088 CVE-2021-2122


author: wutao <wutao61@huawei.com> - 8.0.24-1
changelog:
  - Upgrade mysql to 8.0.24, fix CVES: CVE-2021-2166 CVE-2021-2146
    CVE-2021-2162 CVE-2021-2212 CVE-2021-2299 CVE-2021-2293 CVE-2021-2215
    CVE-2021-2278 CVE-2021-2164 CVE-2021-2208 CVE-2021-2217 CVE-2021-2203
    CVE-2021-2226 CVE-2021-2298 CVE-2021-2230 CVE-2021-2300 CVE-2021-2304
    CVE-2021-2172 CVE-2021-2194 CVE-2021-2170 CVE-2021-2196 CVE-2021-2201
    CVE-2021-2180 CVE-2021-2307 CVE-2021-2169 CVE-2021-2171 CVE-2021-2305
    CVE-2021-2179 CVE-2021-2174 CVE-2021-2193 CVE-2021-2232 CVE-2021-2301
    CVE-2021-2308


author: liwu <liwu13@huawei.com> - 8.0.26-1
changelog:
  - Upgrade mysql to 8.0.26,fix CVES:CVE-2021-2356 CVE-2021-2339 CVE-2021-2354
    CVE-2021-2352 CVE-2021-2340


author: yaoxin <yaoxin30@huawei.com> - 8.0.27-1
changelog:
  - Upgrade mysql to 8.0.27,fix CVES:CVE-2021-2471 CVE-2021-2478 CVE-2021-2479
    CVE-2021-2481  CVE-2021-35546 CVE-2021-35575 CVE-2021-35577 CVE-2021-35591
    CVE-2021-35596 CVE-2021-35597 CVE-2021-35602 CVE-2021-35604 CVE-2021-35607
    CVE-2021-35608 CVE-2021-35610 CVE-2021-35612 CVE-2021-35618
    CVE-2021-35621-to-CVE-2021-35636 CVE-2021-35638-to-CVE-2021-35642
    CVE-2021-35644-to-CVE-2021-35648


author: jintang song<jintang.song@epro.com.cn> - 8.0.29-1
changelog:
  - Upgrade mysql to 8.0.29,fix CVES:'CVE-2022-21423 CVE-2022-21451 
    CVE-2022-21444 CVE-2022-21460 CVE-2022-21417 CVE-2022-21427 CVE-2022-21414 
    CVE-2022-21435 CVE-2022-21452 CVE-2022-21413 CVE-2022-21462 CVE-2022-21412 
    CVE-2022-21415 CVE-2022-21437 CVE-2022-21438 CVE-2022-21436 CVE-2022-21418 
    CVE-2022-21459 CVE-2022-21478 CVE-2022-21479 CVE-2022-21440 CVE-2022-21425 
    CVE-2022-21457 CVE-2022-21454 CVE-2022-21483 CVE-2022-21482 CVE-2022-21484 
    CVE-2022-21485 CVE-2022-21486 CVE-2022-21489 CVE-2022-21490


author: wangkai <13474090681@163.com> - 8.0.37-1
changelog:
  - Update to 8.0.37 for fix CVEs(CVE-2024-20964,CVE-2024-20971,CVE-2024-20976,
    CVE-2024-20973,CVE-2024-20978,CVE-2024-20981,CVE-2024-20962,CVE-2024-20977,
    CVE-2024-20963,CVE-2024-20965,CVE-2024-20972,CVE-2024-20961,CVE-2024-20982,
    CVE-2024-20970,CVE-2024-20967,CVE-2024-20984,CVE-2024-20974,CVE-2024-20966,
    CVE-2024-20960,CVE-2024-20985,CVE-2024-20969,CVE-2024-21000,CVE-2024-21069,
    CVE-2024-21009,CVE-2024-21087,CVE-2024-21047,CVE-2024-20998,CVE-2024-21013,
    CVE-2024-21060,CVE-2024-21008,CVE-2024-21102,CVE-2024-21054,CVE-2024-21062,
    CVE-2024-20994,CVE-2024-21096,CVE-2024-21061,CVE-2024-20993,CVE-2024-21055,
    CVE-2024-21057,CVE-2023-6129)


author: wangkai <13474090681@163.com> - 8.0.38-1
changelog:
  - Update to 8.0.38 for fix CVEs(CVE-2024-21125,CVE-2024-21142,CVE-2024-21179,
    CVE-2024-21171,CVE-2024-21130,CVE-2024-21162,CVE-2024-21177,CVE-2024-20996,
    CVE-2024-21134,CVE-2024-21165,CVE-2024-21173,CVE-2024-21129,CVE-2024-21127,
    CVE-2024-21163)


author: wangkai <13474090681@163.com> - 8.0.40-1
changelog:
  - Update to 8.0.40 for fix CVEs(CVE-2024-21218,CVE-2024-21196,CVE-2024-21207,
    CVE-2024-21198,CVE-2024-21203,CVE-2024-21213,CVE-2024-21239,CVE-2024-21199,
    CVE-2024-21197,CVE-2024-21247,CVE-2024-21193,CVE-2024-21212,CVE-2024-21241,
    CVE-2024-21230,CVE-2024-21236,CVE-2024-21194,CVE-2024-21238,CVE-2024-21237,
    CVE-2024-21201,CVE-2024-21231,CVE-2024-21219,CVE-2024-21185)


author: yaoxin <yao_xin001@hoperun.com> - 8.0-1
changelog:
  - Update to 8.0
    * CVE-2024-5742: Avoid privilege escalations via symlink attacks
      on emergency save file (boo#1226099)
    * By default ^F is bound to starting a forward search, and ^B to
      starting a backward search, while M-F and M-B repeat the search
      in the corresponding direction. (See the documentation if you
      want the old bindings back.)
    * Command-line option --modernbindings (-/) makes ^Q quit, ^X cut,
      ^C copy, ^V paste, ^Z undo, ^Y redo, ^O open a file, ^W write a file,
      ^R replace, ^G find again, ^D find again backwards, ^A set the mark,
      ^T jump to a line, ^P show the position, and ^E execute.
    * For easier access, M-" is bound to placing/removing an anchor,
      and M-' to jumping to the next anchor.


author: gaihuiying <gaihuiying1@huawei.com> - 5.8-15
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix undefined behavior in asn_build_int()
         libsnmp: Rework parse_imports()
         libsnmp: Increase MAX_IMPORTS
         libsnmp: Allocate the module import list on the heap
         libsnmp: Fix a memory leak in a MIB parser error path
         libsnmp: Fix the getoid() error path


author: gaihuiying <eaglegai@163.com> - 1:5.9.1-3
changelog:
  - Type:CVE
  - CVE:CVE-2022-24805 CVE-2022-24806 CVE-2022-24807 CVE-2022-24808 CVE-2022-24809 CVE-2022-24810
  - SUG:NA
  - DESC:fix CVE-2022-24805 CVE-2022-24806 CVE-2022-24807
             CVE-2022-24808 CVE-2022-24809 CVE-2022-24810


author: xingwei <xingwei14@h-partners.com> - 1:5.9.1-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: IF-MIB, IP-FORWARD-MIB: Improve robustness
          IF-MIB: pass the network interface index to net
          IF-MIB: fix a memory leak
          IF-MIB: fix a recently introduced use after free
          IF-MIB: add a trailing newline to an error message


author: wangkai <wangkai385@huawei.com> - 4.1.13-17
changelog:
  - This package depends on log4j.After the log4j vulnerability CVE-2021-45105 is fixed,the version needs to be rebuild.


author: xinghe <xinghe2@h-partners.com> - 1:1.0.0-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix cache prepare nft_cache evaluate to return error
         fix cache validate handle string length
         add src support for implicit chain bindings
         fix cache release pending rules
         fix segtree map listing
         parser_json fix device parsing in netdev family
         fix src Don't parse string as verdict in map


author: huangyu <huangyu106@huawei.com> - 1:1.0.0-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix string prefix expression must retain original length
  fix release top level scope


author: zhanghao <zhanghao383@huawei.com> - 1:1.0.0-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:evaluate allow implicit ether vlan dep
  evaluate datatype memleak after binop transfer
  evaluate bogus datatype assertion in binary operation evaluation
  netlink delinearize do not transfer binary operation to non anonymous sets
  payload do not kill dependency for proto unknown
  monitor missing cache and set handle initialization
  netlink linearize fix timeout with map updates


author: zhanghao <zhanghao383@huawei.com> - 1:1.0.0-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix potential array out of bounds access
  evaluate: fix shift exponent underflow in concatenation evaluation
  netlink: Fix for potential NULL-pointer deref
  mnl: dump_nf_hooks() leaks memory in error path


author: gaihuiying <eaglegai@163.com> - 1:1.0.0-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: error out if basetypes are different
         evaluate: guard against NULL basetype
         evaluate: handle invalid mapping expressions gracefully
         evaluate: reject attempt to update a set
         evaluate: release mpz type in expr_evaluate_list() error path
         expression: missing line in describe command with invalid expression

  Thu Apr 18 2024 lingsheng <lingsheng1@h-partners.com> - 1:1.0.0-10
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:datatype: don't return a const string from cgroupv2_get_path()
  datatype: fix leak and cleanup reference counting for struct datatype
  datatype: initialize TYPE_CT_EVENTBIT slot in datatype array
  datatype: initialize TYPE_CT_LABEL slot in datatype array
  evaluate: do not remove anonymous set with protocol flags and single element
  evaluate: don't crash if object map does not refer to a value
  evaluate: error out when expression has no datatype
  evaluate: error out when store needs more than one 128bit register of align fixup
  evaluate: fix check for truncation in stmt_evaluate_log_prefix()
  evaluate: fix double free on dtype release
  evaluate: fix memleak in prefix evaluation with wildcard interface name
  evaluate: reject set in concatenation
  evaluate: revisit anonymous set with single element optimization
  evaluate: skip anonymous set optimization for concatenations
  evaluate: stmt_nat: set reference must point to a map
  evaluate: tproxy: move range error checks after arg evaluation
  evaluate: validate chain max length
  evaluate: validate maximum log statement prefix length
  exthdr: fix tcpopt_find_template to use length after mask adjustment
  exthdr: prefer raw_type instead of desc->type
  json: expose dynamic flag
  json: fix use after free in table_flags_json()
  libnftables: Drop cache in -c/--check mode
  meta: fix tc classid parsing out-of-bounds access
  netlink: don't crash if prefix for < byte is requested
  netlink: fix leaking typeof_expr_data/typeof_expr_key in netlink_delinearize_set()
  netlink: handle invalid etype in set_make_key()
  parser_bison: fix ct scope underflow if ct helper section is duplicated
  parser_bison: fix memleak in meta set error handling
  parser_bison: make sure obj_free releases timeout policies
  parser_json: Catch nonsense ops in match statement
  parser_json: Default meter size to zero
  parser_json: Fix flowtable prio value parsing
  parser_json: Fix synproxy object mss/wscale parsing
  parser_json: Fix typo in json_parse_cmd_add_object()
  parser_json: Proper ct expectation attribute parsing
  parser_json: Wrong check in json_parse_ct_timeout_policy()
  py: fix exception during cleanup of half-initialized Nftables
  rule: fix sym refcount assertion


author: gaihuiying <eaglegai@163.com> - 1:1.0.0-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: disable meta set with ranges
         src: reject large raw payload and concat expressions
         evaluate: fix stack overflow with huge priority string
         tcpopt: don't create exthdr expression without datatype
         src: do not allow to chain more than 16 binops
         rule: fix ASAN errors in chain priority to textual names
         tests: shell: add regression test for double-free crash bug
         evaluate: handle invalid mapping expressions in stateful object
         evaluate: Fix incorrect checking the `base` variable in case of IPV6
         netlink: reset temporary set element stmt list after list splice


author: xingwei <xingwei14@h-partners.com> - 2:7.92-4
changelog:
  - Type:bugfix
  - CVE:
  - SUG:NA
  - DESC:decouple from PCRE because it has been End-of-life, use local libpcre to build instead


author: wangkai <13474090681@163.com> - 1:12.22.11-5
changelog:
  - Fix CVE-2022-32212,CVE-2022-32213,CVE-2022-32214,CVE-2022-32215,
  - CVE-2022-25881,CVE-2023-23918,CVE-2023-23920,CVE-2023-30589,
  - CVE-2023-30590,CVE-2023-30581,CVE-2023-32002,CVE-2023-32006,
  - CVE-2023-32559,CVE-2022-35256


author: chenyanpanHW <chenyanpan@huawei.com> - 4.29.0-2
changelog:
  - DESC: delete -Sgit from 
  %setup       -q



  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/nspr-gcc-atomics.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f

  , and delete BuildRequires git


author: chengyechun <chengyechun1@huawei.com> - 4.2.8p15-8
changelog:
  - Type:CVE
  - ID:CVE-2023-26551
  - SUG:NA
  - DESC:make sure the buffer has enough room for the input extra characters


author: chengyechun <chengyechun1@huawei.com> - 4.2.8p15-10
changelog:
  - Type:CVE
  - ID:CVE-2023-26551,CVE-2023-26552,CVE-2023-26553,CVE-2023-26554,CVE-2023-26555
  - SUG:NA
  - DESC:change the patch of CVE-2023-26551 and fix CVE-2023-26555


author: cuixucui <cuixucui1@h-partners.com> - 1.1.2-4
changelog:
  - Add requirements for system and bugfix
  - Upgrade oec-hardware-server
  - Update readme and design doc
  - Fix nvme error
  - Update network fibre check and log 
  - Update description for perf test
  - Add automatic configuration network card IP


author: cuixucui <cuixucui1@h-partners.com> - 1.1.2-5
changelog:
  - fix the bug that the test board information is not added to the configuration file
  - Add kabi for hardware critical test
  - Optimize disk/raid/fc/ethernet/infiniband test suite
  - Fix the bug of reading nvme data failed
  - Add file size check when uploading file to server


author: zhangyale <zhangyale3@h-partners.com> - 1.1.3-0
changelog:
  - Add support for openEuler 22.03 LTS SP1
  - Add AMD GPU testcase
  - Add automatic configuration network card IP
  - Add generate compatibility information


author: cuixucui <cuixucui1@h-partner.com> - 1.1.3-2
changelog:
  - Fix code issue and update log print in network
  - Cancel deleting the IP that automatically configured on the server
  - Fix cdrom bug


author: liqiang <liqiang332@h-partner.com> - 1.1.3-3
changelog:
  - Fix libswsds.so not stripped
  - Fix the value of kernel.src obtained by the kabi test case is incorrect
  - Add board infomation and fix memory bug
  - Fix the block size fails to be obtained during the NVME test
  - Judge whether to support kabi testing by architecture
  - Update readme and dev_design


author: cuixucui <cuixucui1@h-partner.com> - 1.1.4-0
changelog:
  - Add board information in the test report
  - Add spdk test case
  - Add dpdk test case
  - Update pci.ids file


author: cuixucui <cuixucui1@h-partner.com> - 1.1.4-1
changelog:
  - Add igc dpdk
  - Secure_filename to improve input robustness and security
  - Correcting bug, self.changed_ Logpath is a string
  - Increase the number of network card up detection times
  - Resolve the issue of IP configuration failure


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-0
changelog:
  - Add support for openEuler 20.03 LTS SP4, openEuler 22.03 LTS SP2, openEuler 22.03 LTS SP3
  - Add modifications to Kylinsec with oec-hardware
  - Add support for Loongson and SW architectures
  - Bugfix


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Add virtual cases
  - Resolve IB startup IB_Read_BW service failure issue
  - Delete redundant references
  - Resolve incorrect type in vgpu result data
  - Resolve the issue of getting the kernel source rpm


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Resolve kdump\watchdog\cpufreq\kabiwhitelist\network test failure issue 
  - Add fio test cases:read,write,randread,randwrite
  - Solve the nvme line break issue in the command line interface
  - Fix compilation errors in the make command
  - Add Vulkan testcase for nvida GPU
  - Resolve the issue of oech server startup failure on version 24.03


author: xiaochn <xiaochuannan@inspur.com> - 1.1.5-3
changelog:
  - Resolve the issue of different kernel source download locations in kabi test case
  - Resolve the issue that kabiwhitelist still passes when the ko and rpm file does not exist
  - Add the way for manually adding kabiwhitelist file
  - For custom vendors, refer to the method of obtaining openEuler os information
  - Supports custom vendor


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-0
changelog:
  - Add new test suite srpm and intel
  - Add virtual branch of test suite
  - Add support for Kylin and UOS
  - Bugfix


author: Noah <hedongbo@huawei.com> - 8u330.1
changelog:
  - change upstream to openeuler
  - rm 0004-Fix-Compilation-Flags.patch
  - rm 0005-fxpackager-extract-jre-accept-symlink.patch
  - rm 0003-fix-cast-between-incompatible-function-types.patch


author: Funda Wang <fundawang@yeah.net> - 0.21.0-11
changelog:
  - fix CVE-2024-8443, CVE-2024-45615, CVE-2024-45616,
    CVE-2024-45617, CVE-2024-45618, CVE-2024-45619, CVE-2024-45620


author: renmingshuai<renmingshuai@huawei.com> - 8.8p1-20
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport some upstream patches and modify some patches numbers


author: renmingshuai<renmingshuai@huawei.com> - 8.8p1-25
changelog:
  - Type:CVE
  - CVE:CVE-2023-48795,CVE-2023-51385
  - SUG:NA
  - DESC:fix CVE-2023-48795 and CVE-2023-51385


author: wujie <wujie@nj.iscas.ac.cn> - 5.6.0-10
changelog:
  - add support for riscv64 from http://fedora.riscv.rocks/koji/buildinfo?buildID=31200
    Author is David Abdurachmanov <david.abdurachmanov@gmail.com>


author: panxiaohe <panxh.life@foxmail.com> - 8.0.0-8
changelog:
  - use lmdb instead of Berkeley DB for package dba
  - update %configure for riscv
  - delete unused rcver


author: chenyanpanHW <chenyanpan@huawei.com> - 0.67.0-8
changelog:
  - DESC: delete -S git from 
  %setup       -q



  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/poppler-0.30.0-rotated-words-selection.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/poppler-0.73.0-PSOutputDev-buffer-read.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/poppler-0.84.0-MacroPushRequiredVars.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/poppler-0.90.0-position-independent-code.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/poppler-gcc11.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/backport-CVE-2022-38784.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/backport-CVE-2022-27337.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f

  , and delete BuildRequires git


author: zhouwenpei <zhouwenpei1@h-partners.com> - 0.90.0-6
changelog:
  - fix CVE-2022-37050,CVE-2022-37051,CVE-2022-37052,CVE-2022-38349,CVE-2020-23804
  - fix install error


author: xiongyi <xiongyi@uniontech.com> - 0.90.0-7
changelog:
  - fix CVE-2020-36023
  - fix infinite looping in cvtGlyph with broken files
  - patch source:https://gitlab.freedesktop.org/poppler/poppler/-/issues/1013


author: bzhaoop <bzhaojyathousandy@gmail.com> - 13.3-6
changelog:
  - Porting "Fix subtransaction test failed" from master branch
  - Fri May 6 2022 caodongxia <caodongxia@h-partners.com> - 13.3-4
  - sync the same line with master


author: dillon chen <dillon.chen@gmail.com> - 13.3-8
changelog:
  - Fix build error for loongarch64
  - Fix issue: confilct between libpq-devel and postgresql-devel
  - guess init spec from redhat
  - change redhat spec:rm private package and add files to server-devel
  - so add delete lines to Fix issue
  - Next: write oe libpq and postgresql spec by myself


author: gaihuiying <eaglegai@163.com> - 2.4.9-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:pppd: Negotiate IP address when only peer addresses are provided


author: yangcheng <yangcheng1203@163.com> - 8.1.2-4
changelog:
  - Type:CVE
  - CVE:CVE-2022-22815,CVE-2022-22816,CVE-2022-22817
  - SUG:NA
  - DESC:fix CVE-2022-22815,CVE-2022-22816,CVE-2022-22817


author: dongyuzhen <dongyuzhen@h-partners.com> - 9.0.1-2
changelog:
  - correct memory allocation in alloc_array (this is the rear patch of CVE-2022-22815,CVE-2022-22816)


author: Chenxi Mao <chenxi.mao@suse.com> - 3.9.9-23
changelog:
  - Type:enhancement
  - CVE:NA
  - SUG:NA
  - DESC: Enable link time optimizaitons (LTO) for better performance.


author: zhaoyu <zhaoyu64@huawei.com>- 3.9.9-25
changelog:
  - Type:CVE
  - CVE:CVE-2007-4559
  - SUG:NA
  - DESC:Add a filter parameter to tarfile.extractall will allow users to avoid CVE-2007-4559 by changing their code/settings.


author: xinsheng <xinsheng3@huawei.com> - 3.9.9-31
changelog:
  - Type:CVE
  - CVE:NA
  - SUG:NA
  - DESC:fix CVE-2024-6923,CVE-2024-7592,CVE-2024-8088
      - Encode newlines in headers, and verify headers are sound
      - Fix quadratic complexity in parsing quoted cookie values with backslashes
      - Replaced SanitizedNames with a more surgical fix


author: xinsheng <xinsheng3@huawei.com> - 3.9.9-32
changelog:
  - Type:CVE
  - CVE:CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597,CVE-2024-4032
  - SUG:NA
  - DESC:fix CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597,CVE-2024-4032
      - rename all CVE patch name
      - CVE-2024-6232: Remove backtracking when parsing tarfile headers
      - CVE-2024-3219: patch1 Authenticate socket connection for `socket.socketpair()` fallback
      - CVE-2024-3219: patch2 Rework pure Python socketpair tests to avoid use of importlib.reload.
      - CVE-2024-0450: Protect zipfile from "quoted-overlap" zipbomb
      - CVE-2023-6597: tempfile.TemporaryDirectory: fix symlink bug in cleanup
      - CVE-2024-4032: Fix "private" (non-global) IP address ranges


author: chenyanpanHW <chenyanpan@huawei.com> - 1.2.2-6
changelog:
  - DESC: delete -Sgit from 
  %setup       -q



  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/backport-BUG-fix-a-minor-refcounting-issue-in-Py_FindObjects.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/backport-BUG-fix-small-refcount-issue-in-ndimage._ctest.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f

  , and delete BuildRequires git


author: gaihuiying <eaglegai@163.com> - 1.13.2-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:remove buildin key
         add macros to control if key files permissons is 600 or 644
         remove useless BuildRequires:unbound-libs


author: yanglu <yanglu72@h-partners.com> - 1.13.2-5
changelog:
  - Type:cves
  - CVE:CVE-2022-30698 CVE-2022-30699
  - SUG:NA
  - DESC:fix CVE-2022-30698 and CVE-2022-30699


author: gaihuiying <eaglegai@163.com> - 1.13.2-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:change run directory from /var/run to /run to fix "/usr/lib/tmpfiles.d/unbound.conf:1: xxxx"


author: chenhaixing <chenhaixing@huawei.com> - 1.26.8-2
changelog:
  - delete patch Bump-RECENT_DATE.patch and modify RECENT_DATE in python-urllib3.spec to adapt time change


author: chenhaixing <chenhaixing@huawei.com> - 1.26.12-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix socket timeout value when HTTPConnect is reused
         remove Exclamation mark character from the unreserved characters
         fix _idna_encode handling of x80


author: chengyechun <chengyechun1@huawei.com> - 1.26.12-7
changelog:
  - Type:CVE
  - CVE:CVE-2024-37891
  - SUG:NA
  - DESC:fix CVE-2024-37891 Strip Proxy-Authorization header on redirects


author: <fengjiabo1@huawei.com> - 10:6.2.0-91
changelog:
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/virtio: Introduce virtio_bh_new_guarded() helper
  - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded
  - checkpatch: add qemu_bh_new/aio_bh_new checks
  - async: avoid use-after-free on re-entrancy guard
  - async: Add an optional reentrancy guard to the BH API
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set(CVE-2024-3447)
  - rtl8139: Remove unused variable
  - tulip: Remove unused variable
  - virtio-mem: Fix the bitmap index of the section offset
  - virtio-mem: Fix the iterator variable in a vmem->rdl_list loop
  - system/memory: use ldn_he_p/stn_he_p
  - block: Fix crash when loading snapshot on inactive node
  - smmu: Clear SMMUPciBus pointer cache when system reset
  - block/mirror: Fix NULL s->job in active writes
  - amd_iommu: Fix APIC address check
  - virtio-crypto: fix NULL pointer dereference in virtio_crypto_free_reques
  - libqos/virtio.c: Correct 'flags' reading in qvirtqueue_kick
  - ivshmem-test.c: enable test_ivshmem_server for ppc64 arch
  - ivshmem.c: change endianness to LITTLE_ENDIAN
  - hw/ppc/mac.h: Remove MAX_CPUS macro
  - configure: remove dead variables
  - virtio-gpu: do not byteswap padding
  - hw/intc: clean-up error reporting for failed ITS cmd
  - qemu-iotests: Discard stderr when probing devices
  - linux-user: un-parent OBJECT(cpu) when closing thread
  - hw/net/rocker: Avoid undefined shifts with more than 31 ports
  - contrib/vhost-user-blk: Clean up deallocation of VuVirtqElement
  - scsi-disk: fix overflow when block size is not a multiple of BDRV_SECTOR_SIZE


author: <fengjiabo1@huawei.com> - 10:6.2.0-92
changelog:
  - s390x/sclp: Simplify get_sclp_device() 
  - target/ppc: Remove msr_pr macro
  - docs/system/target-arm: Re-alphabetize board list
  - migration: Extend query-migrate to provide dirty page limit info
  - migration: Implement dirty-limit convergence algo
  - migration: Put the detection logic before auto-converge checking
  - migration: Refactor auto-converge capability logic
  - migration: Introduce dirty-limit capability
  - qapi/migration: Introduce vcpu-dirty-limit parameters
  - qapi/migration: Introduce x-vcpu-dirty-limit-period parameter
  - Change the value of no_ged from true to false
  - Allow UNIX socket option for VNC websocket
  - tpm_emulator: Avoid double initialization during
  - chardev/char-socket: Update AF_UNIX for Windows
  - KVM: dirty ring: add missing memory barrier
  - i386: reset KVM nested state upon CPU reset
  - esp: Handle CMD_BUSRESET by resetting the SCSI bus
  - dbus-vmstate: Restrict error checks to registered proxies in dbus_get_proxies
  - vfio/pci: Add Ascend310b scend910b support
  - target/i386: Export RFDS bit to guests
  - target/i386: Add new CPU model SierraForest
  - target/i386: Introduce Icelake-Server-v7 to enable TSX
  - hw/virtio: handle un-configured shutdown in virtio-pci
  - target/s390x: display deprecation status in '-cpu  help'
  - target/i386: display deprecation status in '-cpu  help'
  - pc-bios/s390-ccw: Fix booting with logical block size < physical block size


author: <fengjiabo1@huawei.com> - 10:6.2.0-93
changelog:
  - cvm: bug-fix for macro isolation
  - tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fix CVE-2023-5088)
  - hw/ide: reset: cancel async DMA operation before resetting state (Fix CVE-2023-5088)
  - Add support for the virtcca cvm feature.


author: <fengjiabo1@huawei.com> - 10:6.2.0-96
changelog:
  - vdpa: Fix bug where vdpa appliance migration does not resume after rollback
  - block: Parse filenames only when explicitly requested (CVE-2024-4467)
  - block: introduce bdrv_open_file_child() helper
  - iotests/270: Don't store data-file with json: prefix in image (CVE-2024-4467)
  - iotests/244: Don't store data-file with protocol in image (CVE-2024-4467)
  - qcow2: Don't open data_file with BDRV_O_NO_IO (CVE-2024-4467)
  - qcow2: Do not reopen data_file in invalidate_cache
  - hw/intc/arm_gic: Fix deactivation of SPI lines chery-pick from 7175a562f157d39725ab396e39c1e8e410d206b3
  - vhost-user: Skip unnecessary duplicated VHOST_USER_SET_LOG_BASE requests
  - target/ppc: Split off common embedded TLB init cheery-pick from 581eea5d656b73c6532109f4ced4c73fd4e5fd47`
  - vdpa: fix vdpa device migrate rollback wrong when suspend device failed 1. 
  - hw/virtio/virtio-pci:Support shadow device for virtio-net/blk/scsi devices


author: <fengjiabo1@huawei.com> - 10:6.2.0-97
changelog:
  - nbd/server: CVE-2024-7409: Close stray clients at server-stop
  - main-loop.h: introduce qemu_in_main_thread()
  - aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED
  - nbd/server: CVE-2024-7409: Drop non-negotiating clients
  - nbd/server: CVE-2024-7409: Cap default max-connections to 100
  - nbd/server: Plumb in new args to nbd_client_add()
  - nbd: Minor style and typo fixes


author: <fengjiabo1@huawei.com> - 10:6.2.0-98
changelog:
  - pci-host: designware: Limit value range of iATU viewport register
  - hmat acpi: Fix out of bounds access due to missing use of indirection
  - migration: Skip only empty block devices
  - aspeed/hace: Initialize g_autofree pointer
  - hw/net/vmxnet3: Fix guest-triggerable assert()
  - qxl: don't assert() if device isn't yet initialized
  - Avoid unaligned fetch in ladr_match()
  - linux-user: Fix waitid return of siginfo_t and rusage
  - hw/net/lan9118: Replace magic '2048' value by MIL_TXFIFO_SIZE definition
  - stdvga: fix screen blanking
  - virtio-net: drop too short packets early
  - ebpf: replace deprecated bpf_program__set_socket_filter
  - vhsot-user: only read reply of SET_LOG_BASE from vq 0
  - cpu: add Tengyun S5000C cpu support
  - hw/virtio: Fix obtain the buffer id from the last descriptor
  - hw/core: ensure kernel_end never gets used undefined


author: <fengjiabo1@huawei.com> - 10:6.2.0-99
changelog:
  - target/i386: Introduce SapphireRapids-v3 to add missing features
  - qtest/fuzz-lsi53c895a-test: set guest RAM to 2G
  - hw/net/lan9118: Signal TSFL_INT flag when TX FIFO reaches specified level
  - target/arm: Fix alignment for VLD4.32
  - hw/microblaze: pass random seed to fdt
  - tests/qtest: npcm7xx-emc-test: Skip checking MAC
  - tests: mark io-command test as skipped if socat is missing
  - tests: unit: add NULL-pointer check
  - tests: test-qga: close socket on failure to connect
  - vdpa:block device capacity expansion online support vdpa block device update capacity.
  - virtio-net: Ensure queue index fits with RSS(CVE-2024-6505)
  - nbd/server: CVE-2024-7409: Avoid use-after-free when closing server
  - ppc/vof: Fix unaligned FDT property access
  - vvfat: Fix reading files with non-continuous clusters
  - vvfat: Fix bug in writing to middle of file
  - savevm: Fix load_snapshot error path crash
  - hw/dma/xilinx_axidma: Use semicolon at end of statement, not comma
  - hw/remote/message.c: Don't directly invoke DeviceClass:reset
  - crypto/tlscredspsk: Free username on finalize
  - hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()
  - virtio: remove virtio_tswap16s() call in vring_packed_event_read()
  - char-stdio: Restore blocking mode of stdout on exit
  - hw/ppc: spapr: Use qemu_vfree() to free spapr->htab
  - smbios: sanitize type from external type before checking have_fields_bitmap
  - spapr_pci: fix leak in spapr_phb_vfio_get_loc_code
  - KVM: use store-release to mark dirty pages as harvested
  - monitor/hmp: print trace as option in help for log command
  - tpm_crb: Avoid backend startup just before shutdown under Xen
  - crypto/block-luks: make range overlap check more readable
  - spapr: Free stdout path
  - target/rx: Use target_ulong for address in LI
  - virtio-pci: Fix the use of an uninitialized irqfd
  - rtl8139: Fix behaviour for old kernels.
  - virtio-rng: block max-bytes=0 MIME-Version: 1.0
  - hw/audio/es1370: Clean up comment
  - vhost-user-server: do not set memory fd non-blocking
  - ui: reject extended clipboard message if not activated
  - virtio-net: Fix vhost virtqueue notifiers for RSS
  - hw/misc/applesmc: Fix memory leak in reset() handler


author: <fengjiabo1@huawei.com> - 10:6.2.0-100
changelog:
  - mac_dbdma: Remove leftover `dma_memory_unmap` calls(CVE-2024-8612)
  - softmmu: Support concurrent bounce buffers(CVE-2024-8612)
  - system/physmem: Per-AddressSpace bounce buffering
  - system/physmem: Propagate AddressSpace to MapClient helpers


author: yezengruan <yezengruan@huawei.com> - 10:6.2.0-65
changelog:
  - linux-user: Add strace output for timer_settime64() syscall
  - fix qemu-core when vhost-user-net config with server mode


author: <xufei30@huawei.com> - 10:6.2.0-67
changelog:
  - hw/net/vmxnet3: Log guest-triggerable errors using LOG_GUEST_ERROR mainline
  - net/eth: Don't consider ESP to be an IPv6 option header mainline
  - net: Fix uninitialized data usage mainline
  - block-backend: prevent dangling BDS pointers across aio_poll() mainline inclusion
  - i386: add notify VM exit support
  - kvm: expose struct KVMState
  - kvm: allow target-specific accelerator properties
  - i386: kvm: extend kvm_{get, put}_vcpu_events to support pending triple fault
  - linux-headers: include missing changes from 6.0
  - dsoundaudio: fix crackling audio recordings mainline
  - hw/audio/intel-hda: fix stream reset mainline
  - hw/pvrdma: Protect against buggy or malicious guest driver
  - qemu support for loongarch
  - hw/pci: Trace IRQ routing on PCI topology
  - hw/pci: Fix a typo
  - hw/riscv: virt: Simplify virt_{get,set}_aclint()
  - curl: Fix error path in curl_open()
  - tests: add (riscv virt) machine mapping to testenv from v7.0.0
  - tests/tcg: Fix target-specific Makefile variables  path for user-mode mainline
  - hw/core/machine:Fix the missing consideration of cluster-id
  - arm/virt: Correct timing of pause all vcpus for hot-plugged CPUs
  - arm/virt: Correct timing of executing cpu_synchronize_post_init for hot-plugged cpus
  - hw/acpi: Support acpi-ged to report CPU's OST info
  - hw/acpi: Add ospm_status hook implementation for acpi-ged
  - fix qmp command migrate-set-parameters


author: <xufei30@huawei.com> - 10:6.2.0-71
changelog:
  - vhost-user-blk: fix the resize crash
  - plugins: make qemu_plugin_user_exit's locking order consistent with fork_start's
  - linux-user: fix strace build w/out munlockall
  - ui: fix crash on serial reset, during init
  - qga/win/vss: requester_freeze changes
  - migration: fix populate_vfio_info
  - block/rbd: workaround for ceph issue #53784
  - target/i386: add FZRM, FSRS, FSRC
  - i386: Add new CPU model SapphireRapids
  - core/cpu-common: Fix the wrong '#ifdef __aarch64__'


author: <xufei30@huawei.com> - 10:6.2.0-72
changelog:
  - migration/xbzrle: fix out-of-bounds write with axv512
  - migration/xbzrle: use ctz64 to avoid undefined result
  - Update bench-code for addressing CI problem
  - AVX512 support for xbzrle_encode_buffer
  - configure, meson: move AVX tests to meson
  - target/i386: KVM: allow fast string operations if host supports them
  - target/i386: add FSRM to TCG
  - hw/nvme: fix memory leak in nvme_dsm
  - aio-posix: fix race between epoll upgrade and aio_set_fd_handler()
  - target/i386: Add SGX aex-notify and EDECCSSA support
  - hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
  - target/i386: Set maximum APIC ID to KVM prior to vCPU creation
  - target/i386: Fix sanity check on max APIC ID / X2APIC enablement


author: <fengjiabo1@huawei.com> - 10:6.2.0-75
changelog:
  - Add lbt support for kvm.
  - Fix smp.cores value and Fix divide 0 error
  - hw/nvme: Change alignment in dma functions for nvme_blk_*
  - virtio: fix reachable assertion due to stale value of cached region size
  - hw/nvme: fix missing DNR on compare failure


author: <fengjiabo1@huawei.com> - 10:6.2.0-76
changelog:
  - qga/win32: Use rundll for VSS installation
  - qga/win32: Remove change action from MSI installer
  - ide: Increment BB in-flight counter for TRIM BH
  - hw/pci-bridge/pxb: Fix missing swizzle
  - host-vdpa: make notifiers _init()/_uninit() symmetric
  - hw/virtio: vdpa: Fix leak of host-notifier memory-region
  - accel/tcg/cpu-exec: Fix precise single-stepping after interrupt
  - Allow setting up to 8 bytes with the generic loader
  - hw/net/virtio-net: make some VirtIONet const
  - accel/tcg: Optimize jump cache flush during tlb range flush
  - 9pfs: prevent opening special files (CVE-2023-2861)
  - tcg: Reduce tcg_assert_listed_vecop() scope
  - gitlab: Disable plugins for cross-i386-tci
  - vfio/pci: Fix a segfault in vfio_realize
  - block/iscsi: fix double-free on BUSY or similar statuses
  - tests/tcg: fix unused variable in linux-test
  - hw/net/vmxnet3: allow VMXNET3_MAX_MTU itself as a value
  - qga/vss-win32: fix warning for clang++-15
  - vnc: avoid underflow when accessing user-provided address
  - block/monitor: Fix crash when executing HMP commit
  - virtio-gpu: add a FIXME for virtio_gpu_load()
  - hw/ppc/Kconfig: MAC_NEWWORLD should always select USB_OHCI_PCI
  - migration: report compress thread pid to libvirt


author: <fengjiabo1@huawei.com> - 10:6.2.0-78
changelog:
  - sw_64: Added sw64 architecture related updates
  - virtio-crypto: verify src&dst buffer length for sym request
  - vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present
  - qga: Fix suspend on Linux guests without systemd
  - tests: vhost-user-test: release mutex on protocol violation
  - qapi: support updating expected test output via make
  - block: Fix misleading hexadecimal format
  - block/rbd: fix write zeroes with growing images
  - block/nbd.c: Fixed IO request coroutine not being wakeup when kill NBD server
  - block/nfs: Fix 32-bit Windows build
  - qapi/qdev: Tidy up device_add documentation
  - hw/xen/xen_pt: fix uninitialized variable
  - migration/ram: Fix error handling in ram_write_tracking_start()
  - docs/about/build-platforms: Refine the distro support policy
  - xen-block: Avoid leaks on new error path
  - QGA VSS: Add wrapper to send log to debugger and stderr
  - chardev/char-socket: set s->listener = NULL in char_socket_finalize
  - qapi/block: Tidy up block-latency-histogram-set documentation
  - disas/riscv Fix ctzw disassemble
  - vfio: Fix vfio_get_dev_region() trace event
  - migration/ram: Fix populate_read_range()
  - Check and report for incomplete 'global' option  format


author: <fengjiabo1@huawei.com> - 10:6.2.0-79
changelog:
  - test: Fix test-crypto-secret when compiling without keyring support
  - aio-posix: fix build failure io_uring 2.2


author: <fengjiabo1@huawei.com> - 10:6.2.0-80
changelog:
  - io: remove io watch if TLS channel is closed during handshake
  - hw/ssi: Fix Linux driver init issue with xilinx_spi
  - chardev: report the handshake error
  - vhost: Drop unused eventfd_add|del hooks
  - virtio-iommu: use-after-free fix
  - hw/arm/virt: Check for attempt to use TrustZone with KVM or HVF
  - hw/rx: rx-gdbsim DTB load address aligned of 16byte
  - vhost-user: Use correct macro name TARGET_PPC64
  - accel/kvm: Make kvm_dirty_ring_reaper_init() void
  - accel/kvm: Free as when an error occurred


author: <fengjiabo1@huawei.com> - 10:6.2.0-81
changelog:
  - hw/nvme: Avoid dynamic stack allocation
  - ppc/vof: Fix missed fields in VOF cleanup
  - ui: fix crash when there are no active_console
  - tests/qtest/pflash: Clean up local variable shadowing
  - target/ppc: Fix the order of kvm_enable judgment about kvmppc_set_interrupt()
  - tulip: Assign default MAC address if not specified
  - hw/char: fix qcode array bounds check in ESCC impl


author: <fengjiabo1@huawei.com> - 10:6.2.0-82
changelog:
  - thread-pool: optimize scheduling of completion bottom half
  - migration/rdma: zore out head.repeat to make the error more clear
  - vhost-user-fs: Back up vqs before cleaning up vhost_dev
  - hw/vfio/pci-quirks: Sanitize capability pointer
  - hw/vfio/pci-quirks: Support alternate offset for GPUDirect Cliques
  - replay: fix event queue flush for qemu shutdown
  - hw/net: Fix read of uninitialized memory in ftgmac100
  - target/ppc: Fix tlbie
  - target/i386: fix INVD vmexit
  - qtest/npcm7xx_pwm-test: Fix memory leak in mft_qom_set
  - aio-posix: zero out io_uring sqe user_data


author: <fengjiabo1@huawei.com> - 10:6.2.0-83
changelog:
  - hw/virtio/virtio-pmem: Replace impossible check by assertion
  - tests: Fix printf format string in acpi-utils.c
  - softmmu/dirtylimit: Add parameter check for hmp "set_vcpu_dirty_limit"
  - disas/riscv: Fix the typo of inverted order of pmpaddr13 and pmpaddr14
  - qga: Fix memory leak when output stream is unused
  - ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255)
  - target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model
  - target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES
  - target/i386: Allow MCDT_NO if host supports
  - target/i386: Add support for MCDT_NO in CPUID enumeration
  - target/i386: Export MSR_ARCH_CAPABILITIES bits to guests
  - target/i386: add support for FB_CLEAR feature
  - target/i386: add support for FLUSH_L1D feature
  - crypto: remove shadowed 'ret' variable
  - hw/i2c/pmbus_device: Fix modifying QOM class internals from instance
  - hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number


author: <fengjiabo1@huawei.com> - 10:6.2.0-84
changelog:
  - hw/arm/fsl-imx: Do not ignore Error argument
  - hw/net/cadence_gem.c: spelling fixes: Octects
  - tests/qtest: check the return value
  - libvhost-user: Fix VHOST_USER_GET_MAX_MEM_SLOTS  reply mainline inclusion commit 69a5daec06f423843ce1bb9be5fb049314996f78 category: bugfix
  - io_uring: fix short read slow path mainline inclusion commit c06fc7ce147e57ab493bad9263f1601b8298484b category: bugfix
  - libvhost-user: Fix VHOST_USER_ADD_MEM_REG reply mainline inclusion commit 7f27d20ded2f480f3e66d03f90ea71507b834276 category: bugfix
  - qsd: Unlink absolute PID file path mainline inclusion commit 9d8f8233b9fa525a7e37350fbc18877051128c5d category: bugfix
  - net: Fix a misleading error message
  - vdpa: stop all svq on device deletion
  - vhost: release virtqueue objects in error path
  - vhost: fix the fd leak
  - virtio: i2c: Check notifier helpers for VIRTIO_CONFIG_IRQ_IDX
  - hw/virtio: fix typo in VIRTIO_CONFIG_IRQ_IDX comments
  - virtio-net: clear guest_announce feature if no cvq backend
  - vdpa: fix VHOST_BACKEND_F_IOTLB_ASID flag check
  - vdpa: do not block migration if device has cvq and x-svq=on
  - vdpa net: block migration if the device has CVQ
  - vdpa: Return -EIO if device ack is VIRTIO_NET_ERR in _load_mq()
  - vdpa: Return -EIO if device ack is VIRTIO_NET_ERR in _load_mac()
  - vdpa: fix not using CVQ buffer in case of error
  - vdpa: Fix possible use-after-free for VirtQueueElement
  - hw/virtio: fix vhost_user_read tracepoint
  - vhost: Fix false positive out-of-bounds
  - vhost: fix possible wrap in SVQ descriptor ring
  - vhost: move iova_tree set to vhost_svq_start
  - vhost: Always store new kick fd on vhost_svq_set_svq_kick_fd
  - virtio-crypto: verify src&dst buffer length for sym request
  - vdpa: commit all host notifier MRs in a single MR transaction
  - vdpa: harden the error path if get_iova_range failed
  - vdpa-dev: get iova range explicitly
  - virtio-pci: add support for configure interrupt
  - virtio-mmio: add support for configure interrupt
  - virtio-net: add support for configure interrupt
  - vhost: add support for configure interrupt
  - virtio: add support for configure interrupt
  - vhost-vdpa: add support for config interrupt
  - vhost: introduce new VhostOps vhost_set_config_call
  - virtio-pci: decouple the single vector from the interrupt process
  - virtio-pci: decouple notifier from interrupt process
  - virtio: introduce macro VIRTIO_CONFIG_IRQ_IDX
  - vdpa: do not handle VIRTIO_NET_F_GUEST_ANNOUNCE in vhost-vdpa
  - vdpa: handle VIRTIO_NET_CTRL_ANNOUNCE in vhost_vdpa_net_handle_ctrl_avail
  - vhost: fix vq dirty bitmap syncing when vIOMMU is enabled
  - hw/virtio: gracefully handle unset vhost_dev vdev
  - hw/virtio/vhost: Fix typo in comment.
  - vdpa: always start CVQ in SVQ mode if possible
  - vdpa: add shadow_data to vhost_vdpa
  - vdpa: store x-svq parameter in VhostVDPAState
  - vdpa: add asid parameter to vhost_vdpa_dma_map/unmap
  - vdpa: allocate SVQ array unconditionally
  - vdpa: move SVQ vring features check to net/
  - vdpa: request iova_range only once
  - vdpa: add vhost_vdpa_net_valid_svq_features
  - vhost: allocate SVQ device file descriptors at device start
  - vhost: set SVQ device call handler at SVQ start
  - vdpa: use v->shadow_vqs_enabled in vhost_vdpa_svqs_start & stop
  - vhost: enable vrings in vhost_dev_start() for vhost-user devices
  - vhost-vdpa: fix assert !virtio_net_get_subqueue(nc)->async_tx.elem in virtio_net_reset
  - net/vhost-vdpa.c: Fix clang compilation failure
  - vhost-vdpa: allow passing opened vhostfd to vhost-vdpa
  - vdpa: Remove shadow CVQ command check
  - vdpa: Delete duplicated vdpa_feature_bits entry
  - hw/virtio: add some vhost-user trace events
  - vdpa: Allow MQ feature in SVQ
  - virtio-net: Update virtio-net curr_queue_pairs in vdpa backends
  - vdpa: validate MQ CVQ commands
  - vdpa: Add vhost_vdpa_net_load_mq
  - vdpa: extract vhost_vdpa_net_load_mac from vhost_vdpa_net_load
  - vdpa: Make VhostVDPAState cvq_cmd_in_buffer control ack type
  - vdpa: Delete CVQ migration blocker
  - vdpa: Add virtio-net mac address via CVQ at start
  - vhost_net: add NetClientState->load() callback
  - vdpa: extract vhost_vdpa_net_cvq_add from vhost_vdpa_net_handle_ctrl_avail
  - vdpa: Move command buffers map to start of net device
  - vdpa: add net_vhost_vdpa_cvq_info NetClientInfo
  - vhost_net: Add NetClientInfo stop callback
  - vhost_net: Add NetClientInfo start callback
  - vdpa: Use ring hwaddr at vhost_vdpa_svq_unmap_ring
  - vdpa: Make SVQ vring unmapping return void
  - vdpa: Remove SVQ vring from iova_tree at shutdown
  - util: accept iova_tree_remove_parameter by value
  - vdpa: do not save failed dma maps in SVQ iova tree
  - vdpa: Skip the maps not in the iova tree
  - vdpa: Fix file descriptor leak on get features error
  - vdpa: Fix memory listener deletions of iova tree
  - vhost: Get vring base from vq, not svq
  - vdpa: Add x-svq to NetdevVhostVDPAOptions
  - vdpa: Add device migration blocker
  - vdpa: Extract get features part from vhost_vdpa_get_max_queue_pairs
  - vdpa: Buffer CVQ support on shadow virtqueue
  - vdpa: manual forward CVQ buffers
  - vdpa: Export vhost_vdpa_dma_map and unmap calls
  - vhost: Add svq avail_handler callback
  - vhost: add vhost_svq_poll
  - vhost: Expose vhost_svq_add
  - vhost: add vhost_svq_push_elem
  - vhost: Track number of descs in SVQDescState
  - vhost: Add SVQDescState
  - vhost: Decouple vhost_svq_add from VirtQueueElement
  - vhost: Check for queue full at vhost_svq_add
  - vhost: Move vhost_svq_kick call to vhost_svq_add
  - vhost: Reorder vhost_svq_kick
  - vdpa: Avoid compiler to squash reads to used idx
  - virtio-net: Expose ctrl virtqueue logic
  - virtio-net: Expose MAC_TABLE_ENTRIES
  - vhost: move descriptor translation to vhost_svq_vring_write_descs
  - util: Return void on iova_tree_remove
  - virtio-net: don't handle mq request in userspace handler for vhost-vdpa
  - vhost-vdpa: change name and polarity for vhost_vdpa_one_time_request()
  - vhost-vdpa: backend feature should set only once
  - vhost-vdpa: fix improper cleanup in net_init_vhost_vdpa
  - virtio-net: align ctrl_vq index for non-mq guest for vhost_vdpa
  - virtio: add vhost support for virtio devices
  - include/hw: start documenting the vhost API
  - hw/virtio: add vhost_user_[read|write] trace points
  - vhost: Fix element in vhost_svq_add failure
  - vdpa: Fix index calculus at vhost_vdpa_svqs_start
  - vdpa: Fix bad index calculus at vhost_vdpa_get_vring_base
  - vhost: Fix device's used descriptor dequeue
  - vhost: Track descriptor chain in private at SVQ
  - vdpa: Add missing tracing to batch mapping functions
  - vhost-vdpa: fix typo in a comment
  - virtio: fix --enable-vhost-user build on non-Linux
  - vdpa: Expose VHOST_F_LOG_ALL on SVQ
  - vdpa: Never set log_base addr if SVQ is enabled
  - vdpa: Adapt vhost_vdpa_get_vring_base to SVQ
  - vdpa: Add custom IOTLB translations to SVQ
  - vhost: Add VhostIOVATree
  - util: add iova_tree_find_iova
  - util: Add iova_tree_alloc_map
  - vhost: Shadow virtqueue buffers forwarding
  - vdpa: adapt vhost_ops callbacks to svq
  - virtio: Add vhost_svq_get_vring_addr
  - vhost: Add vhost_svq_valid_features to shadow vq
  - vhost: Add Shadow VirtQueue call forwarding capabilities
  - vhost: Add Shadow VirtQueue kick forwarding capabilities
  - vhost: Add VhostShadowVirtqueue
  - vdpa: Make ncs autofree
  - Revert "virtio: introduce macro IRTIO_CONFIG_IRQ_IDX"
  - Revert "virtio-pci: decouple notifier from interrupt process"
  - Revert "virtio-pci: decouple the single vector from the interrupt process"
  - Revert "vhost-vdpa: add support for config interrupt"
  - Revert "virtio: add support for configure interrupt"
  - Revert "vhost: add support for configure interrupt"
  - Revert "virtio-net: add support for configure interrupt"
  - Revert "virtio-mmio: add support for configure interrupt"
  - Revert "virtio-pci: add support for configure interrupt"
  - Revert "vhost: introduce new VhostOps vhost_set_config_call"
  - virtio: signal after wrapping packed used_idx
  - target/i386: Adjust feature level according to FEAT_7_1_EDX
  - target/i386: Add new CPU model GraniteRapids
  - target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration
  - target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration
  - target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration
  - target/i386: Add support for AVX-IFMA in CPUID enumeration
  - target/i386: Add support for AMX-FP16 in CPUID enumeration
  - target/i386: Add support for CMPCCXADD in CPUID enumeration
  - tracetool: avoid invalid escape in Python string
  - hw/pvrdma: Protect against buggy or malicious guest driver
  - vga: avoid crash if no default vga card mainline inclusion commit 6985d8ede92494f3b791de01e8ee9306eb6d5e4a category: bugfix
  - qom/object: Remove circular include dependency mainline inclusion commit 5bba9bcfbb42e7c016626420e148a1bf1b080835 category: bugfix
  - artist: set memory region owners for buffers to the  artist device mainline inclusion commit 39fbaeca096a9bf6cbe2af88572c1cb2aa62aa8c category: bugfix
  - virtio-iommu: Fix the partial copy of probe request mainline inclusion commit 45461aace83d961e933b27519b81d17b4c690514 category: bugfix
  - e1000: set RX descriptor status in a separate  operation mainline inclusion commit 034d00d4858161e1d4cff82d8d230bce874a04d3 category: bugfix
  - vhost: introduce new VhostOps vhost_set_config_call
  - vhost: stick to -errno error return convention
  - vhost-user: stick to -errno error return convention
  - vhost-vdpa: stick to -errno error return convention
  - virtio-pci: add support for configure interrupt
  - virtio-mmio: add support for configure interrupt
  - virtio-net: add support for configure interrupt
  - vhost: add support for configure interrupt
  - virtio: add support for configure interrupt
  - vhost-vdpa: add support for config interrupt
  - virtio-pci: decouple the single vector from the interrupt process
  - virtio-pci: decouple notifier from interrupt process
  - virtio: introduce macro IRTIO_CONFIG_IRQ_IDX
  - pci: Fix the update of interrupt disable bit in PCI_COMMAND register
  - hw/timer/npcm7xx_timer: Prevent timer from counting down past zero
  - tpm_crb: mark command buffer as dirty on request  completion mainline inclusion commit e37a0ef4605e5d2041785ff3fc89ca6021faf7a0 category: bugfix
  - pci: fix overflow in snprintf string formatting mainline inclusion commit 36f18c6989a3d1ff1d7a0e50b0868ef3958299b4 category: bugfix
  - hw/usb/hcd-ehci: fix writeback order mainline inclusion commit f471e8b060798f26a7fc339c6152f82f22a7b33d category: bugfix
  - qemu-timer: Skip empty timer lists before locking  in qemu_clock_deadline_ns_all mainline inclusion commit 3f42906c9ab2c777a895b48b87b8107167e4a275 category: bugfix
  - semihosting/config: Merge --semihosting-config  option groups mainline inclusion commit 90c072e063737e9e8f431489bbd334452f89056e category: bugfix
  - semihosting: fix memleak at semihosting_arg_fallback
  - target/i386: Export GDS_NO bit to guests


author: <fengjiabo1@huawei.com> - 10:6.2.0-86
changelog:
  - vdpa: move memory listener to the realize stage
  - vdpa: implement vdpa device migration
  - vhost: implement post resume bh
  - vhost: implement migration state notifier for vdpa device
  - vhost: implement savevm_hanlder for vdpa device
  - vhost: implement vhost_vdpa_device_suspend/resume
  - vhost: implement vhost-vdpa suspend/resume
  - vhost: add vhost_dev_suspend/resume_op
  - vhost: introduce bytemap for vhost backend logging
  - vhost-vdpa: add migration log ops for VhostOps
  - vhost-vdpa: add VHOST_BACKEND_F_BYTEMAPLOG
  - vhost: fix null pointer access
  - ui/gtk: prevent ui lock up when dpy_gl_update called again before current draw event occurs
  - hw/usb: dev-mtp: Use g_mkdir()
  - target/ppc/cpu-models: Remove the "default" CPU alias
  - hw/intc/arm_gicv3: ICC_PMR_EL1 high bits should be RAZ
  - Fixed a QEMU hang when guest poweroff in COLO mode
  - migration/colo: More accurate update checkpoint time
  - scripts/entitlement.sh: Use backward-compatible cp flags
  - block/nvme: fix infinite loop in nvme_free_req_queue_cb()
  - hw/net: npcm7xx_emc fix missing queue_flush
  - Add dummy Aspeed AST2600 Display Port MCU (DPMCU)
  - hw/arm: ast2600: Fix address mapping of second SPI controller
  - vhost-user-blk: reconnect on any error during realize
  - vhost-user-blk: propagate error return from generic vhost
  - hw/riscv: boot: Reduce FDT address alignment constraints
  - Revert "hw/virtio/virtio-iommu-pci: Enforce the device is plugged on the root bus"
  - Fix STM32F2XX USART data register readout
  - block: use 'unsigned' for in_flight field on driver state
  - sphinx: change default language to 'en'
  - tests/qtest: Fix two format strings
  - trivial typos: namesapce
  - hw/ide/atapi.c: Correct typos (CD-CDROM -> CD-ROM)
  - hw/virtio/virtio-iommu-pci: Enforce the device is plugged on the root bus
  - hw/display/next-fb: Fix comment typo
  - xen/pass-through: merge emulated bits correctly mainline inclusion commit be9c61da9fc57eb7d293f380d0805ca6f46c2657 category: bugfix
  - tests/qtest/migration-test.c: spelling fix: bandwith
  - target/i386/cpu: Improve error message for property "vendor"
  - balloon: Fix a misleading error message
  - target/arm: Don't set syndrome ISS for loads and  stores with writeback mainline inclusion commit 53ae2fdef1f5661cbaa2ea571c517f98e6041cb8 category: bugfix
  - disas/hppa: Show hexcode of instruction along with disassembly
  - tcg/loongarch64: Fix tcg_out_mov() Aborted
  - ui/qmp-cmds: Improve two error messages
  - qga: Improve guest-exec-status error message
  - hmp: Improve sync-profile error message
  - spapr/pci: Correct "does not support hotplugging error messages
  - xen/pass-through: don't create needless register  group mainline inclusion commit c0e86b7624cb9d6db03e0d48cf82659e5b89a6a6 category: bugfix


author: <fengjiabo1@huawei.com> - 10:6.2.0-87
changelog:
  - vdpa: suspend function return 0 when the vdpa device is stopped
  - vdpa: don't suspend/resume device when vdpa device not started
  - vdpa: support vdpa device suspend/resume
  - vdpa: correct param passed in when unregister save
  - vdpa: set vring enable only if the vring address has already been set
  - shadow_dev: introduce shadow dev for virtio-net device
  - revert "tcg/loongarch64: Fix tcg_out_mov() Aborted"
  - migration: Set downtime_start even for postcopy
  - gdb-xml: fix duplicate register in arm-neon.xml
  - iotests: fix default machine type detection
  - migration: fix RAMBlock add NULL check
  - s390x: Fix spelling errors
  - ppc: spelling fixes
  - hw/scsi/vhost-scsi: don't double close vhostfd on error
  - virtio/vhost-vsock: don't double close vhostfd, remove redundant cleanup
  - hw/scsi/vhost-scsi: don't leak vqs on error
  - hw/i386/pc: Add missing property descriptions
  - pcie_aer: Don't trigger a LSI if none are defined
  - pci: Export the pci_intx() function
  - hw/qdev: Cosmetic around documentation
  - tests/unit: fix a -Wformat-truncation warning
  - tests/avocado: mark ReplayKernelNormal.test_mips64el_malta as flaky
  - i386/sev: Avoid SEV-ES crash due to missing MSR_EFER_LMA bit
  - ui/vnc-clipboard: fix inflate_buffer
  - hw/usb/hcd-xhci.c: spelling: tranfer


author: <fengjiabo1@huawei.com> - 10:6.2.0-88
changelog:
  - ui/vnc.c: Fixed a deadlock bug.
  - hw/i386: Fix comment style in topology.h
  - migration/multifd: Remove unnecessary usage of local Error
  - linux-user: fix sockaddr_in6 endianness
  - vhost_vdpa: fix the input in trace_vhost_vdpa_listener_region_del()
  - iotests: fix 194: filter out racy postcopy-active event
  - tests/avocado: fix waiting for vm shutdown in replay_linux
  - ui/vnc: fix debug output for invalid audio message


author: <fengjiabo1@huawei.com> - 10:6.2.0-89
changelog:
  - qga-win: Fix guest-get-fsinfo multi-disks collection
  - hw/timer: fix systick trace message
  - virtio-net: correctly copy vnet header when flushing TX (CVE-2023-6693)
  - ui/clipboard: mark type as not available when there is no data (CVE-2023-6683)
  - esp: restrict non-DMA transfer length to that of available data (CVE-2024-24474)
  - hw/scsi/lsi53c895a: add missing decrement of reentrancy counter
  - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330)
  - net: Update MemReentrancyGuard for NIC (CVE-2023-3019)
  - net: Provide MemReentrancyGuard * to qemu_new_nic()


author: <fengjiabo1@huawei.com> - 10:6.2.0-90
changelog:
  - i386/cpuid: Move leaf 7 to correct group
  - i386/cpuid: Decrease cpuid_i when skipping CPUID leaf 1F
  - i386/cpu: Mask with XCR0/XSS mask for FEAT_XSAVE_XCR0_HI and FEAT_XSAVE_XSS_HI leafs
  - i386/cpu: Clear FEAT_XSAVE_XSS_LO/HI leafs when CPUID_EXT_XSAVE is not available
  - target/i386: Change wrong XFRM value in SGX CPUID leaf
  - target/i386: Enable support for XSAVES based features
  - target/i386: Add kvm_get_one_msr helper
  - hw/block/hd-geometry: Do not override specified bios-chs-trans mainline inclusion commit fd8a68ad6823d33bedeba20a22857867a1c3890e category: bugfix
  - linux-user/riscv: Align signal frame to 16 bytes mainline inclusion commit 1eaa63429a9944265c92efdb94c02fabb231f564 category: bugfix
  - ipmi:smbus: Add a check around a memcpy mainline inclusion commit 3fde641e7286f9b968bdb3b4b922c6465f2a9abc category: bugfix
  - tests/tcg/linux-test: Fix random hangs in test_socket mainline inclusion commit b9e6074fc5b429b1e956e9c60db7e284a91e0f3d category: bugfix
  - qemu-options.hx: Don't claim "-serial" has limit of 4 serial ports Before v2.12, the implementation of serial ports was limited to a value of MAX_SERIAL_PORTS = 4. We now dynamically allocate the data structures for serial ports, so this limit is no longer present, but the documentation for the -serial options still reads:
  - target/ppc: Modify the uncorrect value irq to n_IRQ
  - block-migration: Ensure we don't crash during migration cleanup
  - target/s390x: fix handling of zeroes in vfmin/vfmax mainline inclusion commit 13c59eb09bd6d1fbc13f08b708226421f14a232b category: bugfix
  - hw/virtio/virtio-iommu: Enforce power-of-two notify for both MAP and UNMAP mainline inclusion commit 0522be9a0c0094088ccef7aab352c57f483ca250 category: bugfix
  - configure: Add missing POSIX-required space mainline inclusion commit 35a7a6fc5624b1df828d82f2dfa74d0e4188b3b2 category: bugfix
  - vga: fix incorrect line height in 640x200x2 mode mainline inclusion commit 37e7b86766244b62a406747bb78e049390d0b528 category: bugfix
  - hw/ide/core: set ERR_STAT in unsupported command completion
  - linux-user/flatload.c: Fix setting of  image_info::end_code mainline inclusion commit 734a659ad264ac080457167e845ffabbaaa66d0e category: bugfix
  - load_elf: fix iterator's type for elf file processing
  - hw/misc/mps2-scc: Free MPS2SCC::oscclk[] array on finalize()
  - hw/nvram/xlnx-efuse: Free XlnxEFuse::ro_bits[] array on finalize()
  - hw/nvram/xlnx-efuse-ctrl: Free XlnxVersalEFuseCtrl[] "pg0-lock" array
  - chardev/char.c: fix "abstract device type" error message
  - block/rbd: fix handling of holes in .bdrv_co_block_status
  - qga: treat get-guest-fsinfo as "best effort" mainline inclusion commit bbb0151cf2e82489120a15df5e2eb9653312b0ec category: bugfix
  - usb/hcd-xhci: check slotid in  xhci_wakeup_endpoint() mainline inclusion commit 84218892f05515d20347fde4506e1944eb11cb25 category: bugfix
  - hw/display/bcm2835_fb: Fix framebuffer allocation  address mainline inclusion commit 5865d99fe88d8c8fa437c18c6b63fb2a8165634f category: bugfix
  - block/parallels: Fix buffer-based write call mainline inclusion commit eba088f91d21d9e42a81bef847173da30c5da961 category: bugfix
  - vl: Improve error message for conflicting -incoming and -loadvm
  - hw/smbios: Fix OEM strings table option validation


author: chenziyang <chenziyang4@huawei.com> - 8.1-3
changelog:
  - Add shell command to switch bracketed-paste mode from on to off to keep consistent with realine-8.0


author: dongyuzhen <dongyuzhen@h-partners.com> - 2.16-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:change the uid and gid of directories newly created when run with --change-files


author: dongyuzhen <dongyuzhen@h-partners.com> - 2.16-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix failure when recompiling noarch rpm and remove the require to rpm-build


author: dongyuzhen <dongyuzhen@h-partners.com> - 2.16-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:revert: remove the require to rpm-build.For consistency with other community-released dependencies


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 8.2110.0-15
changelog:
  - Type:NA
  - ID:NA
  - SUG:NA
  - DESC:omprog bugfix: invalid status handling at called program
         core bugfix: template system may generate invalid json


author: linzhuorong <linzhuorong@huawei.com> - 8.2110.0-16
changelog:
  - Type:NA
  - ID:NA
  - SUG:NA
  - DESC: OpenSSL: fix depreacted API issues for OpenSSL 3.x
          MMDBLOOKUP::FIXED:: Don't crash Rsyslog on mmdb
          support sha256 for StreamDriverAuthMode="x509/fingerprint"
          imjournal: add second fallback to _COMM
          bugfix: prevent pot. segfault when switchung to
          core/bugfix: using $uuid msg prop can deadlock rsyslog on shutdown
          GNUTls Driver: Fix memory leaks in gtlsInitCred


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 8.2110.0-19
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:tcp net subsystem: handle data race gracefully
         fix startup issue on modern systemd systems
         tcpflood bugfix: plain tcp send error not properly reported
         tcpflood bugfix: TCP sending was not implemented properly
         lookup tables: fix static analyzer issue
         lookup tables bugfix: reload on HUP did not work when backgrounded
         openssl: Replaced depreceated method SSLv23_method with TLS_method
         testbench: make waiting for HUP processing more reliable
         bugfix: cosmetic data races
         mmnormalize bugfix: if msg cannot be parsed, parser chain is stopped
         core bugfix: potential segfault on busy systems
         imfile: fix ext directory's fd leak in case of inotify on symlink
         imfile tests: ext directory's fd leak in case of inotify on symlink
         testbench: fix imfile-statefile-delete.sh (INOTIFY trigger)
         imfile bugfix: message loss/duplication when monitored file is rotated
         testbench: add testcase for frequent imfile input file change
         Use runConf instead of loadConf in ratelimiting during runtime


author: zouzhimin <zouzhimin@kylinos.cn> - 1:2.2.3.1-3
changelog:
  - Type:CVES
  - ID:CVE-2024-26141 CVE-2024-26146 CVE-2024-25126
  - SUG:NA
  - DESC:CVE-2024-26141 CVE-2024-26146 CVE-2024-25126


author: zouzhimin <zouzhimin@kylinos.cn> - 1:2.2.3.1-4
changelog:
  - Type:CVES
  - ID:CVE-2022-44570 CVE-2022-44571 CVE-2022-44572
  - SUG:NA
  - DESC:CVE-2022-44570 CVE-2022-44571 CVE-2022-44572


author: wangjiang <wangjiang37@h-partners.com> - 35.5-16
changelog:
  - backport patch Allow virt_domain read device sysctls
                   Allow icecast rename its log files


author: jinlun <jinlun@huawei.com> - 15.4-5
changelog:
  - fix CVE-2017-3735 CVE-2017-3737 CVE-2018-0732 CVE-2018-0737
    CVE-2018-0739 CVE-2019-1563 CVE-2020-1971 CVE-2021-23840
    CVE-2021-23841 CVE-2022-0778 CVE-2021-3712


author: wangkai <13474090681@163.com> - 14.4.2.0-29
changelog:
  - Fix CVE-2021-33844,CVE-2023-32627,CVE-2021-23159,CVE-2023-34432
  - CVE-2023-34318,CVE-2021-23172,CVE-2021-3643,CVE-2021-23210
  - CVE-2022-31650,CVE-2023-26590,CVE-2022-31651,CVE-2023-32627
  - CVE-2017-18189


author: Jie Yang <yangjieyj.yang@huawei.com> - 2.0.0-6
changelog:
  - docs: fix some statement
  - machine_manager: add autodeflate for balloon
  - migration: add dev_id into VirtioPciState when save and restore device state
  - machine: fix more than one pcie-root-ports with same id
  - migration: move function "transport_reset" to save state stage for vhost vsock device
  - vfio: adding ram device region to vfio bar region
  - machine_manager: move argument "serial" from -drive to -device virtio-blk-pci/device
  - machine_manager: add multifunction for devices
  - machine: add init_multifunction function to init multifunction
  - machine: add realization for multifunction


author: Jie Yang <yangjieyj.yang@huawei.com> - 2.1.0-1
changelog:
  - Add support for PCIe native hotplugging.
  - Reduce memory consumption of reading edk2 firmware files on aarch64.
  - Add support for booting from disk image directly.
  - Add support for VM reboot and VM shutdown.
  - Add support for guest memory preallocation.
  - Add more test cases.
  - Add and fix documentation.
  - Replace lazy_static crate with once_cell.
  - Performance enhancement for virtio-blk and virtio-net devices.
  - Add ftrace support.


author: Jie Yang <yangjieyj.yang@huawei.com> - 2.1.0-2
changelog:
  - Fix VFIO hotplugging failure caused by missing seccomp rules.
  - Fix booting failure from disk image on x86_64.
  - Update some documents.


author: Jie Yang <yangjieyj.yang@huawei.com> - 2.1.0-3
changelog:
  - Fix memory snapshot failure with hotplugged devices.
  - Fix address translation for virtio devices.
  - Add some test cases for microvm.
  - Update some documents.


author: yangmingtai <yangmingtai@huawei.com> -249-42
changelog:
  - 1.change /etc/systemd/journald.conf ForwardToWall to no
    2.change DefaultLimitMEMLOCK to 64M
    3.replace openEuler to vendor
    4.delete useless file udev-61-openeuler-persistent-storage.rules


author: wangyuhang <wangyuhang27@huawei.com> - 249-54
changelog:
  - add a new switch to control whether udev complies with the new SAT standards
    and add sense_data.py to check if the device meets the new SAT standards


author: shixin <shixin21@huawei.com> - 249-55
changelog:
  - sysuesrs_dir, sysctl_dir, binfmt_dir, modules_load_dir reference directories in /usr/lib for embedded
  - modify dns server address to avoid security risk for embedded
  - add support to relabel systemd process for embedded
  - add noexec mount option to strenthen tmp partition for embedded
  - use yocto configs for embedded


author: huyubiao <huyubiao@huawei.com> - 249-60
changelog:
  - backport: sync patches from systemd community
    add backport-core-path-do-not-enqueue-new-job-in-.trigger_notify-.patch
        backport-socket-fix-use-of-ERRNO_IS_DISCONNECT.patch
        backport-sd-bus-fix-use-of-ERRNO_IS_DISCONNECT.patch
        backport-resolved-fix-use-of-ERRNO_IS_DISCONNECT.patch
        backport-bus-add-some-minimal-bounds-check-on-signatures.patch
        backport-udev-builtin-net_id-fix-potential-buffer-overflow.patch
        backport-hostname-Make-sure-we-pass-error-to-bus_verify_polki.patch
        backport-Limit-rlim_max-in-rlimit_nofile_safe-to-nr_open.patch
        backport-udev-raise-RLIMIT_NOFILE-as-high-as-we-can.patch


author: wangyuhang <wangyuhang27@huawei.com> - 249-62
changelog:
  - add: backport-json-use-unsigned-for-refernce-counter.patch
        backport-macro-check-over-flow-in-reference-counter.patch
        backport-sd-bus-fix-reference-counter-to-be-incremented.patch
        backport-sd-bus-introduce-ref-unref-function-for-track_item.patch
        backport-sd-bus-do-not-read-unused-value.patch
        backport-sd-bus-do-not-return-negative-errno-when-unknown-nam.patch
        backport-sd-bus-use-hashmap_contains-and-drop-unnecessary-cas.patch
        backport-test-shorten-code-a-bit.patch
        backport-test-add-several-tests-for-track-item.patch
        backport-Use-dummy-allocator-to-make-accesses-defined-as-per-standard.patch
        backport-sd-bus-switch-to-a-manual-overflow-check-in.patch


author: wangyuhang <wangyuhang27@huawei.com> - 249-68
changelog:
  - backport: sync patches from systemd community
              add backport-journal-recalculate-line_max-when-stdout-stream-stat.patch
              backport-pid1-terminate-cylon-string.patch
              backport-pid1-move-draw_cylong-to-pretty-print.-ch.patch
              backport-test-add-test-for-draw_cylon.patch
              backport-locale-util-do-not-call-setlocale-when-multi-threade.patch
              backport-resolve-fix-wrong-error-cause-assignment-to-log_debu.patch
              backport-resolve-do-not-trigger-assertion-on-exit.patch
              backport-network-neighbor-add-missing-OOM-check.patch
              backport-dissect-tool-right-align-the-partition-number.patch
              backport-dissect-image-fix-fd-leak-in-dissected_image_acquire.patch
              backport-udev-even-if-a-device-is-a-zac-device-scsi-ID_SERIAL.patch
              backport-core-log-message-when-reloading-finishes.patch


author: huyubiao <huyubiao@huawei.com> - 249-69
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add backport-basic-fix-overflow-detection-in-sigbus_pop.patch
         backport-busctl-avoid-asserting-on-NULL-message.patch
         backport-resolve-don-t-add-sockets-to-the-graveyard-on-shutdo.patch
         backport-sd-journal-check-sd-event-state-before-setting-up-po.patch


author: huyubiao <huyubiao@huawei.com> - 249-70
changelog:
  - move the architecture patches after Patch9800 (excluding Patch9800)
    delete the duplicate systemd-coredump.socket


author: huyubiao <huyubiao@huawei.com> - 249-73
changelog:
  - DESC:add backport-core-exec-do-not-crash-with-UtmpMode-user-without-Us.patch
         backport-resolved-limit-the-number-of-signature-validations-i.patch
         backport-resolved-reduce-the-maximum-nsec3-iterations-to-100.patch


author: huyubiao <huyubiao@huawei.com> - 249-76
changelog:
  - add backport-login-user-runtime-dir-properly-check-for-mount-poin.patch
        backport-user-util-validate-the-right-field.patch


author: zhaoxiaohu <zhaoxiaohu@kuaishou.com> - 249-85
changelog:
  - add backport-man-fix-directory-for-user-home-bind-mounts.patch
        backport-nspawn-fix-directory-in-logged-error.patch
        backport-test-boot-timestamp-Handle-ERANGE-error.patch


author: zhaoxiaohu <zhaoxiaohu@kuaishou.com> - 249-87
changelog:
  - add backport-userdb-Use-json_dispatch_user_group_name-to-parse-Ge.patch
        backport-README-explicitly-note-that-util-linux-s-mount-swap-.patch
        backport-man-fix-section-number.patch
        backport-repart-fix-invalid-errno-in-log.patch
        backport-sysusers-insist-that-root-group-is-0.patch
        backport-importd-Always-specify-file-unpacked-by-tar.patch
        backport-docs-remove-dev-tty-confusion.patch


author: zhaoxiaohu <zhaoxiaohu@kuaishou.com> - 249-88
changelog:
  - wait-online: fix handling of unmanaged state
  - add backport-wait-online-make-manager_link_is_online-return-0-whe.patch


author: zhaoxiaohu <zhaoxiaohu@kuaishou.com> - 249-91
changelog:
  - add backport-cgroup-util-introduce-cg_is_threaded.patch
        backport-core-execute-warn-when-threaded-mode-is-detected.patch


author: xingwei <xingwei14@h-partners.com> - 14:4.99.1-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Set SA_RESTART on non-lethal signals (REQ_INFO, FLUSH_PCAP) to avoid corrupting binary pcap output


author: qinyu<qinyu32@huawei.com> - 2022a-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Greenland change should affect only America/Nuuk; The northern edge of Chihuahua changes to US rules


author: langfei<langfei@huawei.com> - 2022a-16
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Fix Palestine predictions for 2072 through 2075; Ittoqqortoormiit (America/Scoresbysund) zone change.


author: liuchao <liuchao173@huawei.com> - 2022a-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Vostok switches to +05; Sync Casey data from timeanddata.com; Kazakhstan unifies on UTC+5


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-4
changelog:
  - Type:CVE
  - ID:CVE-2022-3491 CVE-2022-3520 CVE-2022-3591
  - SUG:NA
  - DESC:fix CVE-2022-3491 CVE-2022-3520 CVE-2022-3591


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-7
changelog:
  - Type:CVE
  - ID:CVE-2023-0049 CVE-2023-0051 CVE-2023-0054
  - SUG:NA
  - DESC:CVE-2023-0049 CVE-2023-0051 CVE-2023-0054


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-16
changelog:
  - Type:CVE
  - ID:CVE-2023-4736 CVE-2023-4733 CVE-2023-4734 CVE-2023-4735
  - SUG:NA
  - DESC:fix CVE-2023-4736 CVE-2023-4733 CVE-2023-4734 CVE-2023-4735


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-17
changelog:
  - Type:CVE
  - ID:CVE-2023-4738 CVE-2023-4750 CVE-2023-4752 CVE-2023-4781
  - SUG:NA
  - DESC:fix CVE-2023-4738 CVE-2023-4750 CVE-2023-4752 CVE-2023-4781


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-22
changelog:
  - Type:CVE
  - ID:CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237
  - SUG:NA
  - DESC:fix CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237


author: ouyangminxiang<ouyangminxiang@kylinsec.com.cn> - 1.20.11-7
changelog:
  - Fix the crash in shadowUpdatePacked because of memcpy acts randomly with overlapping areas.
  - Fix the problem of black screen after entering the login interface


author: wanglin <wangl29@chinatelecom.cn> - 1.20.11-14
changelog:
  - Fix openEuler hard code problem
  - use -git instead of .git as the filename, to avoid .git ignore
  - Fix changelog date


author: yanglu <yanglu72@h-partners.com> -1.20.11-31
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix regression caused by the fix for CVE-2024-0229 
         fix use after free related to CVE-2024-21886


author: shuaijiakun <shuaijiakun1288@phytium.com.cn> -1.20.11-32
changelog:
  - Type:feature
  - CVE:NA
  - SUG:NA
  - DESC:fix display error for ps23xx when using ast and pe2201 bmc card.


author: xingwei <xingwei14@h-partners.com> - 4.2.3-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add haveged requires and optimize random number function replacement patch


