# changelog

author: wangkai <13474090681@163.com> - 1.4.3.36-1
changelog:
  - Update to 1.4.3.36
  - Fix dsidm user/posixgroup get_dn fails with search_ext()
  - Fix unable to add objectclass/attribute without x-origin
  - Fix execute dsconf to open pdb


author: wangkai <13474090681@163.com> - 1.4.3.36-8
changelog:
  - Fix dsidm role subtree-status fails with TypeError
  - Fix name cockpit_present is not defined.
  - Fix typo
  - Fix DirSrv has no attribute userid


author: gaoxingwang <gaoxingwang1@huawei.com> - 1.32.12-9
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix remove NetworkManager wrongly when yum remove NetworkManager-bluetooth subpackage that is not installed


author: Aichun Li <liaichun@huawei.com> - 1.32.12-10
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:libnm:fix warning when setting wrong ethtool ternary value
  core: reload config for active devices
  libnm: fix crash on failure of nm_vpn_plugin_info_new_from_file()
  libnm: fix crash in _nm_ip_route_validate_all for invalid-route


author: Chenxi Mao <chenxi.mao@suse.com> - 1:1.32.12-14
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Set NMTST_FORCE_REAL_ROOT to true to skip test which need root user permission


author: gaoxingwang<gaoxingwang1@huawei.com> - 1:1.32.12-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:merge ovs into main package

   Mon Jun 5 2023 gaoxingwang<gaoxingwang1@huawei.com> - 1:1.32.12-16
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add macro firewalld_zone to fix firewalld error about nm-shared.xml


author: yaoxin <yao_xin001@hoperun.com> - 1.2.24-1
changelog:
  - Update to 1.2.24:
    * Fixed formatting of ipsec.conf snippet. This is a security
    issue with severity of "Important." (CVE-2024-9050)
    * Added support for "require-id-on-certificate" setting.
    * Updated Georgian, Slovenian and Ukrainian translations.


author: sunhai <sunhai10@huawei.com> - 36.16.5-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:pxe kickstart version with local pykickstart
         and with build save patch by source4


author: sunhai <sunhai10@huawei.com> - 36.16.5-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:add logo with install
         the kickstart version change to patch


author: Qingqing Li <liqingqing3@huawei.com> - 36.16.5-11
changelog:
  - Type:feature
  - ID:NA
  - SUG:NA
  - DESC:cgroup files is a additional enhanced cgroup feature, which will
         limit cgroup opened files, add cgroup_disable=files to
         default cmdline to disable this feature to keep cgroup's default behavior.


author: sunhai <sunhai10@huawei.com> - 36.16.5-14
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: backport password tooltip text adapt language
          close disk encryption


author: shenyangyang<shenyangyang4@huawei.com> - 1.7.0-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Rebuild for openEuler-rpm-config moving /usr/lib/rpm/openEuler/xxxx
         to /usr/lib/xxxx


author: yanglongkang<yanglongkang@h-partners.com> - 3.2.2-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Adding Patching Operations
         provides relibility and self-heading capabilities for service


author: yaoxin <yao_xin001@hoperun.com> - 1.17-1
changelog:
  - Update to 1.17 for fix CVE-2022-38398,CVE-2022-38648,CVE-2022-40146,CVE-2022-44729 and CVE-2022-44730


author: huangyu <huangyu106@huawei.com> - 32:9.16.23-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Fix catalog zone reconfiguration crash
  Improve the logging on failed TCP accept
  Separate the locked parts of dns_zone_catz_enable-di
  Check if key-metadata is modified before writing
  Fix CID-352776 Concurrent data access violations
  Require valid key for dst_key functions


author: zhanghao<zhanghao383@huawei.com> - 32:9.16.23-14
changelog:
  - Type:CVE
  - CVE:CVE-2022-3736 CVE-2022-3924 CVE-2022-3094
  - SUG:NA
  - DESC:fix CVE-2022-3736 CVE-2022-3924 CVE-2022-3094


author: zhanghao<zhanghao383@huawei.com> - 32:9.16.23-15
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix output expected information when install bing-sdborbind-sdb-chroot


author: zhanghao <zhanghao383@huawei.com> - 32:9.16.23-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Don't perform arithmetic on NULL pointers
  Accept 'in=NULL' with 'inlen=0' in isc_{half}siphash24
  Fix a use-after-free bug in dns_zonemgr_releasezone()
  Fix dns_fwdtable_addfwd() error path cleanup bug
  Detach the views in zone_shutdown(), not in zone_free()
  Detach the zone views outside of the zone lock
  delay trust anchor management until zones are loaded
  In hmac_createctx free ctx on isc_hmac_init failure
  Fix dns_kasp_attach / dns_kasp_detach usage
  Fix backport error in 84929d1c
  Fix a cleanup bug when isc_task_create() fails in dns_catz_new_zones()
  Searching catzs->zones requires a read lock
  Fix view's zones reverting bug during reconfiguration


author: chengyechun <chengyechun1@huawei.com> - 32:9.16.23-21
changelog:
  - Type:CVE
  - CVE:CVE-2023-6516 CVE-2023-4408 CVE-2023-5517 CVE-2023-5680 CVE-2023-5679 CVE-50387 CVE-2023-50868
  - SUG:NA
  - DESC:fix CVE-2023-6516 CVE-2023-4408 CVE-2023-5517 CVE-2023-5680 CVE-2023-5679 CVE-50387 CVE-2023-50868 and sync some patches from upstream


author: chengyechun <chengyechun1@huawei.com> - 32:9.16.23-23
changelog:
  - Type:CVE
  - CVE:CVE-2024-1975,CVE-2024-4076,CVE-2024-1737
  - SUG:NA
  - DESC:fix CVE-2024-1975 CVE-2024-4076 CVE-2024-1737


author: xiechengliang <xiechengliang1@huawei.com> - 1:1.33.1-12
changelog:
  - Type:CVE
  - Id:NA
  - SUG:NA
  - DESC:fix CVE-2021-42378 CVE-2021-42379 CVE-2021-42380 CVE-2021-42381 CVE-2021-42382 CVE-2021-42383 CVE-2021-42384 CVE-2021-42385 and CVE-2021-42386


author: yanglu <yanglu72@h-partners.com> - 1.18.1-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:delete a static library file
         add BuildRequires make to fix build problem


author: hehuazhen <hehuazhen@huawei.com> - 1.18.1-6
changelog:
  - Type:CVE
  - CVE:CVE-2023-32067 CVE-2023-31130
  - SUG:restart
  - DESC:fix CVE-2023-32067 CVE-2023-31130


author: Lv Ying <lvying6@huawei.com> - 21.4-17
changelog:
  - backport upstream patches:
  https://github.com/canonical/cloud-init/commit/fa53c7f4086f5937bc9bd328dba9f91ca73b6614
  https://github.com/canonical/cloud-init/commit/9c7502a801763520639c66125eb373123d1e4f44
  https://github.com/canonical/cloud-init/commit/2e17a0d626d41147b7d0822013e80179b3a81ee4
  https://github.com/canonical/cloud-init/commit/9f0efc474ea430c75cd0abec3e2da719d4934346
  https://github.com/canonical/cloud-init/commit/bb414c7866c4728b2105e84f7b426ab81cc4bf4d
  https://github.com/canonical/cloud-init/commit/9cbd94dd57112083856ead0e0ff724e9d1c1f714
  https://github.com/canonical/cloud-init/commit/6d817e94beb404d3917bf973bcb728aa6cc22ffe
  https://github.com/canonical/cloud-init/commit/0450a1faff9e5095e6da0865916501772b3972e9


author: Lv Ying <lvying6@huawei.com> - 21.4-18
changelog:
  - backport upstream patches:
  https://github.com/canonical/cloud-init/commit/7136109df5a7b3c75dfb05a853fc4485fed25b5f
  https://github.com/canonical/cloud-init/commit/f51c352e6c6a7d05a61308c188450a1b818eac45
  https://github.com/canonical/cloud-init/commit/668a68fe577368555ea7f71577fc352494a98c25


author: shixuantong <shixuantong1@huawei.com> - 21.4-20
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Do not generate dsa and ed25519 key types when crypto FIPS mode is enabled
         Don't fail if IB and Ethernet devices 'collide'
         Fix default route rendering on v2 ipv6
         Fix IPv6 netmask format for sysconfig
         Fix KeyError when rendering sysconfig IPv6 routes
         Fix network v2 metric rendering
         Ignore duplicate macs from mscc_felix and fsl_enetc
         macs: ignore duplicate MAC for devs with driver driver qmi_wwan
         net/dhcp: catch dhclient failures and raise NoDHCPLeaseError
         net: skip duplicate mac check for netvsc nic and its VF
         Set ownership for new folders in Write Files Module
         cc_ubuntu_advantage: Redact token from logs
         Do not silently ignore integer uid
         Ensure network ready before cloud-init service runs
         Fix exception when no activator found
         Fix KeyError in iproute pformat
         Handle non existent ca-cert-config situation


author: shixuantong <shixuantong1@huawei.com> - 21.4-21
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:cc_mounts: Fix swapfile not working on btrfs
         cc_mounts: Use fallocate to create swapfile on btrfs
         collect-logs fix memory usage


author: shixuantong <shixuantong1@huawei.com> - 21.4-28
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:disable use-dns for secondary nics
         Make duplicate route add succeed
         Fix predictable interface rename issue


author: dongyuzhen <dongyuzhen@h-partners.com> - 21.4-29
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix(net): klibc ipconfig PROTO compatibility
         fix(openstack): Fix bond mac_address


author: shixuantong <shixuantong1@huawei.com> - 21.4-32
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:chore: set recursive=False for ensure_dir if parent path is "/"
         test(openstack): Test bond mac address
         fix: Ensure properties for bonded interfaces are properly translated


author: songyanting<songyanting@huawei.com> - 1.2.0-300
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:sync bugfix, include
         1. add check in spec
         2. kill container init process if runc start returns error
         3. fix containerd-shim residual when kill containerd durin
         4. fix deadlock on commit error
         5. backport upstream & ttrpc patches
         6. fix exec event missing due to pid reuse
         7. fix dm left when pause container and kill shim
         8. add CGO security build options
         9. fix start container failed with id exists
        10. drop opt package
        11. fix race access for mobySubscribed
        12. improve log for debugging
        13. reduce permission for bundle dir
        14. fix publish command wait block forever


author: Vanient<xiadanni1@huawei.com> - 1.2.0-301
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Use fs.RootPath when mounting volumes for bundle dir to fix CVE-2022-23648


author: zhongjiawei<zhongjiawei1@huawei.com> - 1.2.0-314
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:bump ttrpc to fix containerd-shim socket connect increase leak after restart docker


author: fuanan <fuanan3@h-partners.com> - 2.13-9
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:revert fix CVE-2015-1197 because it causes AT testcases problems


author: chenziyang <chenziyang4@huawei.com> - 2.13-10
changelog:
  - Type:CVE
  - ID:CVE-2015-1197
  - SUG:NA
  - DESC:backport CVE-2015-1197, delete revert-CVE-2015-1197.patch and backport the following 2 bugfix patches


author: fuanan <fuanan3@huawei.com> - 2.13-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:add 'autoconf automake' to BuildRequires to use autoreconf command


author: wangbin <wangbin224@huawei.com> - 7.3.0-5
changelog:
  - Handle task_struct cpu member changes for kernels >= 5.16-rc1
    and delete use_system_readline_v3.patch


author: gaihuiying <eaglegai@163.com> - 7.79.1-5
changelog:
  - Type:cves
  - CVE:CVE-2022-22576 CVE-2022-27774 CVE-2022-27775 CVE-2022-27776
  - SUG:NA
  - DESC:fix CVE-2022-22576 CVE-2022-27774 CVE-2022-27775 CVE-2022-27776


author: gaihuiying <eaglegai@163.com> - 7.79.1-7
changelog:
  - Type:cves
  - CVE:CVE-2022-32205 CVE-2022-32206 CVE-2022-32207 CVE-2022-32208
  - SUG:NA
  - DESC:fix CVE-2022-32205 CVE-2022-32206 CVE-2022-32207 CVE-2022-32208


author: gaihuiying <eaglegai@163.com> - 7.79.1-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix build error when add --disable-http-auth configure option


author: yanglu <yanglu72@h-partners.com> - 7.79.1-12
changelog:
  - Type:cves
  - CVE:CVE-2022-32221 CVE-2022-42915 CVE-2022-42916
  - SUG:NA
  - DESC:fix CVE-2022-32221 CVE-2022-42915 CVE-2022-42916


author: xinghe <xinghe2@h-partners.com> - 7.79.1-14
changelog:
  - Type:cves
  - CVE:CVE-2023-23914 CVE-2023-23915 CVE-2023-23916
  - SUG:NA
  - DESC:fix CVE-2023-23914 CVE-2023-23915 CVE-2023-23916


author: xingwei <xingwei14@h-partners.com> - 7.79.1-15
changelog:
  - Type:cves
  - CVE:CVE-2023-27533 CVE-2023-27534 CVE-2023-27535 CVE-2023-27536 CVE-2023-27538
  - SUG:NA
  - DESC:fix CVE-2023-27533 CVE-2023-27534 CVE-2023-27535 CVE-2023-27536 CVE-2023-27538


author: zhouyihang <zhouyihang3@h-partners.com> - 7.79.1-26
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:tool_progress: avoid division by zero in parallel progress
         digest: pass over leading spaces in qop values
         Curl_close: call Curl_resolver_cancel to avoid memory-leak
         easy: fix the altsvc init for curl_easy_duphandle
         libssh: if sftp_init fails, don't get the sftp error code
         url: move back the IDN conversion of proxy names
         ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH
         http: fix the ::1 comparison for IPv6 localhost for cookies
         multi: free up more data earleier in DONE
         curl_path: bring back support for SFTP path ending in /~
         transfer: refuse POSTFIELDS + RESUME_FROM combo
         tool_operate: refuse (--data or --form) and --continue-at
         http: free the url before storing a new copy
         url: fix null dispname for --connect-to option
         vtls: avoid memory leak if sha256 call fails
         urlapi: make sure zoneid is also duplicated in curl_url_dup


author: zhouyihang <zhouyihang3@h-partners.com> - 7.79.1-27
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:transfer: also stop the sending on closed connection
         openssl: avoid BN_num_bits() NULL pointer derefs


author: zhouyihang <zhouyihang3@h-partners.com> - 7.79.1-29
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:paramhlp: fix CRLF-stripping files with "-d @file"
         libssh2: set length to 0 if strdup failed
         openldap: create ldap URLs correctly for IPv6 addresses
         multi: avoid memory-leak risk
         tool_cb_rea: limit rate unpause for -T . uploads
         tool_cfgable: free {proxy_}cipher13_list on exit


author: licunlong<licunlong1@huawei.com> - 29-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:don't enable/disable dbus.socket when install/uninstall dbus-broker.


author: renmingshuai <renmingshuai@huawei.com> - 12:4.4.3-4
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:delete report url added by other upstream patch to keep pace with DHCP


author: renmingshuai <renmingshuai@huawei.com> - 12:4.4.3-5
changelog:
  - Type:CVE
  - ID:CVE-2022-2795,CVE-2022-38177,CVE-2022-38178
  - SUG:restart
  - DESC:fix CVE-2022-2795,CVE-2022-38177 and CVE-2022-38178


author: chenhaixing <chenhaixing@huawei.com> 4.14.0-12
changelog:
  - CVE:NA
  - SUG:NA
  - DESC:dnf:fix undo error when include rollback of group upgrade
             fix can't download package when url have characters encoded


author: herengui <herengui@kylinsec.com.cn> - 4.14.0-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:dnf:remove useless patch of loongarch64
         dnf:recreate patch of sw64 and make arch sorted alphabetically


author: chenhaixing <chenhaixing@huawei.com> - 4.14.0-18
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:dnf:Fix bash completion due to sqlite changes
             When parsing over a KVP list, do not return till the whole list is parsed


author: hanhuihui <hanhuihui5@huawei.com> - 4.14.0-19
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:dnf:Remove --duplicates and --oldinstallonly exit with 0 when nothing to remove and Add all candidates for reinstall to solver


author: LuWu <2398491106@qq.com> - 4.14.0-20
changelog:
  - Limit queries to nevra forms when provided by command and Update the man page entry for the countme option


author: chenhaixing <chenhaixing@huawei.com> - 4.3.1-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:dnf-plugins-core:download plugin:respect install_weak_deps option value


author: renmingshuai <renmingshuai@huawei.com> - 2.86-3
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Fix parsing of IPv6 addresses with peer from netlink
         Fix bad interaction between --address=/#/<ip> and
              --server=/some.domain/#
         Fix --address=/#/...... which was lost in 2.86


author: renmingshuai <renmingshuai@huawei.com> - 2.86-7
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Fix memory leak when using --dhcp-optsfile with DHCPv6 options


author: zhongjiawei<zhongjiawei1@huawei.com> - 18.09.0-323
changelog:
  - Type:CVE
  - CVE:CVE-2023-28840,CVE-2023-28841,CVE-2023-28842
  - SUG:NA
  - DESC:fix CVE-2023-28840,CVE-2023-28841,CVE-2023-28842


author: zhongjiawei<zhongjiawei1@huawei.com> - 1.1.3-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libcontainer: skip chown of /dev/null caused by fd redirection


author: zhongjiawei<zhongjiawei1@huawei.com> - 1.1.3-13
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix rootless /sys/fs/cgroup mounts bug and Prohibit /proc and /sys to be symlinks


author: zhongjiawei<zhongjiawei1@huawei.com> - 1.1.3-27
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Set temporary single CPU affinity before cgroup cpuset transition


author: chenjiji <chenjiji09@163.com> - 21.11-33
changelog:
  refactor Rc/Tx function of hns3 PMD
   And patchs are as follows:
    - net/hns3: fix burst mode query with dummy function
    - net/hns3: add debug info for Rx/Tx dummy function
    - net/hns3: remove debug condition for Tx prepare
    - net/hns3: separate Tx prepare from getting Tx function
    - net/hns3: make getting Tx function static
    - net/hns3: extract common functions to set Rx/Tx


author: chenjiji <chenjiji09@163.com> - 21.11-34
changelog:
  Support flow rule keeping capability for hns3 PMD and
   testpmd. Patchs are as follow:
    - net/hns3: declare flow rule keeping capability
    - app/testpmd: add --disable-flow-flush option


author: chenjiji <chenjiji09@163.com> - 21.11-35
changelog:
  Fix some RSS bugs and reimplement hash flow function for hns3:
    - fix some RSS bugs and optimize RSS codes for hns3
    - reimplement hash flow function for hns3 to satisfy the
      mainstream usage of rte flow hash in the community


author: chenjiji <chenjiji09@163.com> - 21.11-36
changelog:
  Fix a m_buf pool was not freed bugs for test and support
   CPPC cpufreq for l3fwd-power. Patchs are as follow:
    - test/mbuf: fix mbuf reset test
    - examples/l3fwd-power: support CPPC cpufreq


author: chenjiji <chenjiji09@163.com> - 21.11-39
changelog:
  Sync some patchs from upstreaming branch and modifies
   are as follow:
   1. Add private dump for bonding, virtio and vhost.
   2. Support LACP info dump for bonding.
   3. Display RSS hash key of flow rule in testpmd.


author: chenjiji <chenjiji09@163.com> - 21.11-41
changelog:
  - Telemetry: support display as hexadecimal
   Sync some patchs from upstreaming for telemetry and modifies
   are as follow:
   1. Support dispaly integer as hexadecimal.
   2. Fix data truncation for some u64 accept as int.
   3. Add JSON pretty print.


author: chenjiji <chenjiji09@163.com> - 21.11-42
changelog:
  - fix empty devargs parsing
   Sync some patchs from upstreaming and modifies are as
   follow:
   1. The rte_kvargs_process() was used to parse KV pairs, it
   also supports to parse 'only keys' type. And the callback
   function parameter 'value' is NULL when parsed 'only keys'.
   This patch fixes segment fault when parse input args with
   'only keys'.
   2. The MAP_FAILED should be used to determine whether the
   mapping is successful but not NULL. This patch fix it.


author: chenjiji <chenjiji09@163.com> - 21.11-43
changelog:
  Sync some patchs from upstreaming for hns3 pmd and modifies
   are as follow:
   1. support flow control autoneg for fiber port
   2. support simplify hardware checksum offloading
   3. support dump media type
   4. add Tx Rx descriptor logs
   5. fix Rx multiple firmware reset interrupts
   6. ethdev: fix one address occupies two entries in MAC addrs


author: chenjiji <chenjiji09@163.com> - 21.11-55
changelog:
  Sync some patchs from upstreaming about add FDIR VLAN match
   mode runtime config and fix doc format for hns3 pmd. Patchs
   are as follow:
   - doc: unify sections of networking drivers guide
   - net/hns3: delete duplicate macro definition
   - net/hns3: add FDIR VLAN match mode runtime config
   - doc: fix kernel patch link in hns3 guide
   - doc: fix syntax in hns3 guide
   - doc: fix number of leading spaces in hns3 guide


author: huangdengdui <huangdengui@huawei.com> - 21.11-58
changelog:
  Sync some patchs from upstreaming and modifies are as follow:
   - maintainers: update for hns3 driver
   - app/testpmd: add command to flush multicast MAC addresses
   - app/testpmd: fix help string
   - app/testpmd: fix multicast address pool leak
   - net/hns3: optimize SVE Rx performance
   - net/hns3: optimize rearm mbuf for SVE Rx
   - net/hns3: optimize free mbuf for SVE Tx
   - net/hns3: fix order in NEON Rx
   - net/hns3: fix traffic management dump text alignment
   - net/hns3: fix traffic management thread safety
   - net/hns3: fix flushing multicast MAC address
   - net/hns3: fix error code for multicast resource
   - net/hns3: fix VF default MAC modified when set failed
   - net/hns3: fix index to look up table in NEON Rx
   - net/hns3: fix non-zero weight for disabled TC
   - config/arm: add HiSilicon HIP10


author: huangdengdui <huangdengui@huawei.com> - 21.11-59
changelog:
  Sync some patchs from upstreaming and modifies are as follow:
   - net/hns3: fix mailbox sync
   - net/hns3: report maximum buffer size
   - ethdev: add maximum Rx buffer size
   - app/procinfo: show RSS hash algorithm
   - ethdev: get RSS algorithm names
   - app/procinfo: adjust format of RSS info
   - app/procinfo: fix RSS info
   - net/hns3: support setting and querying RSS hash function
   - net/hns3: report RSS hash algorithms capability
   - ethdev: set and query RSS hash algorithm
   - ethdev: clarify RSS related fields usage
   - net/hns3: fix uninitialized hash algo value
   - net/hns3: keep set/get algo key functions local
   - net/hns3: fix some error logs
   - net/hns3: fix some return values
   - net/hns3: fix LRO offload to report
   - net/hns3: fix setting DCB capability
   - app/testpmd: ease configuring all offloads
   - net/hns3: refactor interrupt state query
   - net/hns3: fix IMP or global reset
   - net/hns3: fix multiple reset detected log
   - net/hns3: remove reset log in secondary
   - net/hns3: fix double stats for IMP and global reset
   - net/hns3: fix crash for NEON and SVE
   - net/hns3: fix unchecked Rx free threshold
   - net/hns3: fix typo in function name
   - net/hns3: fix build warning
   - telemetry: fix repeat display when callback don't init dict


author: huangdengdui <huangdengui@huawei.com> - 21.11-60
changelog:
  Sync some bugfix from upstreaming about hns3 reset and modifies
   are as follow:
   - net/hns3: fix VF reset handler interruption
   - net/hns3: fix reset event status
   - net/hns3: fix ignored reset event


author: huangdengdui <huangdengui@huawei.com> - 21.11-61
changelog:
  Sync some bugfix from upstreaming about testpmd and doc, modifies
   are as follow:
   - support set RSS hash algorithm
   - ethdev: add new API to get RSS hash algorithm by name
   - doc: fix description of RSS features
   - doc: fix RSS flow description in hns3 guide
   - doc: update features in hns3 guide
   - doc: fix hns3 build option about max queue number
   - app/testpmd: check port and queue Rx/Tx offloads
   - app/testpmd: fix Tx offload command
   - app/testpmd: allow offload config for all ports
   - app/testpmd: fix tunnel TSO configuration
   - app/testpmd: add explicit check for tunnel TSO
   - app/testpmd: fix tunnel TSO capability check
   - app/testpmd: remove useless check in TSO command


author: huangdengdui <huangdengui@huawei.com> - 21.11-62
changelog:
  Sync some patches for hns3 about refactor mailbox and bugfix, modifies
   are as follow:
   - net/hns3: fix reset level comparison
   - net/hns3: fix disable command with firmware
   - net/hns3: fix VF multiple count on one reset
   - net/hns3: refactor handle mailbox function
   - net/hns3: refactor send mailbox function
   - net/hns3: refactor PF mailbox message struct
   - net/hns3: refactor VF mailbox message struct


author: chenyi <chenyi211@huawei.com> - 21.11-66
changelog:
  Sync some patches from upstream about bugfix, modifies
   are as follow:
   - app/testpmd: fix crash in multi-process forwarding
   - net/hns3: fix offload flag of IEEE 1588
   - net/hns3: fix read Rx timestamp handle
   - net/hns3: fix double free for Rx/Tx queue
   - net/hns3: fix variable overflow
   - net/hns3: enable PFC for all user priorities
   - ring: add telemetry command for ring info
   - ring: add telemetry command to list rings
   - net/hns3: support power monitor
   - net/hns3: disable SCTP verification tag for RSS hash input
   - app/testpmd: fix RSS algorithm choice


author: chenyi <chenyi211@huawei.com> - 21.11-67
changelog:
  Sync some patches from upstream about bugfix, modifies
   are as follow:
   - net/hns3: support new device
   - dma/hisilicon: remove support for HIP09 platform


author: hankangknag <hankangknag5@huawei.com> - 21.11-68
changelog:
  Sync some patches from upstream about bugfix, modifies
   are as follow:
   - mlx5: device should be started to set the flow


author: chenyi <chenyi211@huawei.com> - 21.11-69
changelog:
  Sync some patches from upstream about bugfix, modifies
   are as follow:
   - net/hns3: check Rx DMA address alignmnent


author: hankangknag <hankangknag5@huawei.com> - 21.11-70
changelog:
  Sync some patches from upstream about bugfix, modifies are as follow:
  - net/af_xdp: parse UMEM map info from mempool
  - bpf: disable on 32-bit x86
  - net/af_xdp: remove unused local statistic
  - net/af_xdp: fix stats reset
  - net/af_xdp: count mbuf allocation failures
  - net/af_xdp: fix port ID in Rx mbuf
  - net/af_xdp: support AF_XDP device plugin pinned maps
  - net/af_xdp: fix multi-interface support for k8s
  - net/af_xdp: fix leak on XSK configuration failure
  - net/af_xdp: fix memzone leak on config failure
  - net/af_xdp: avoid error log for virtual interfaces
  - net/af_xdp: fix Rx and Tx queue state
  - net/af_xdp: fix missing UMEM feature
  - rework atomic intrinsics fetch operations
  - build: clarify configuration without IOVA field in mbuf
  - net/af_xdp: fix socket handler validation
  - net/af_xdp: support CNI Integration
  - net/af_xdp: parse NUMA node ID from sysfs
  - drivers: mark SW PMDs to support disabling IOVA as PA
  - net/af_xdp: make compatible with libbpf 0.8.0
  - net/af_xdp: add log on XDP program removal failures
  - net/af_xdp: avoid version-based check for program load
  - net/af_xdp: avoid version-based check for shared UMEM
  - net/af_xdp: make clear which libxdp version is required
  - net/af_xdp: move XDP library presence flag setting
  - net/af_xdp: allow using copy mode in XSK
  - net/af_xdp: fix shared UMEM fill queue reserve
  - net/af_xdp: fix custom program loading with multiple queues
  - net/af_xdp: reserve fill queue before socket create
  - net/af_xdp: ensure socket is deleted on Rx queue setup error
  - net/af_xdp: make compatible with libbpf >= 0.7.0
  - net/af_xdp: add missing trailing newline in logs
  - net/af_xdp: allow probing when multiprocess is disabled
  - ethdev: introduce generic dummy packet burst function
  - net/af_xdp: re-enable secondary process support
  - net/af_xdp: make UMEM configure more readable
  - net/af_xdp: use libxdp if available
  - net/af_xdp: fix build with -Wunused-function


author: chenyi <chenyi211@huawei.com> - 21.11-78
changelog:
  Sync some patches from upstream about bugfix, modifies are as follow:
  - bus/pci: fix UIO resource mapping in secondary process


author: gaihuiying <eaglegai@163.com> - 2.0.11-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix ebtables-config file access permisson
         fix ebt_print_error for prints null


author: xinghe <xinghe2@h-partners.com> - 2.0.11-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix: if libvirt and ebtables are installed at the same time, ping the operation prompts "sendmsg: Operation not permitted".


author: xinghe <xinghe2@h-partners.com> - 2.0.11-11
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix ebtables-restore --noflush failed when ebtables is uninstall


author: yexiao<yexiao7@huawei.com> - 202011-14
changelog:
  - fix CVE-2023-0464、CVE-2023-0465、CVE-2023-0466、CVE-2023-2650、CVE-2023-3446、CVE-2023-3817、CVE-2024-0727


author: yexiao<yexiao7@huawei.com> - 202011-16
changelog:
  - fix CVE-2023-45229、CVE-2023-45230、CVE-2023-45231、CVE-2023-45232、CVE-2023-45233、CVE-2023-45234、CVE-2023-45235


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 18-4
changelog:
  - Fix segfault when passed --index is greater than current boot order size
    Add missing short option handling for --index (-I)


author: zhangxingrong <zhangxingrong@uniontech.com> - 18-5
changelog:
  - Fix the incorrect long parameter in help messages
  - efibootmgr: delete_bootnext is just a boolean, not an entry id


author: yangcheng <yangcheng87@huawei.com> - 1:27.2-3
changelog:
  - DESC: Fix the upgrade error caused by the info file in the emacs-help software package being repackaged


author: wangkai <13474090681@163.com> - 1:2.3.0-1
changelog:
  - Update to 2.3.0 for fix CVE-2022-48682
  - Add ncurses mode for interactive file deletion (plain mode still available via --plain or ./configure).
  - Add --minsize --maxsize --time --order=ctime --log --deferconfirmation --cache option.
  - Use configure script for installation (Autotools/Automake).
  - Rename cs command ("clear all selections") from cs to csel.
  - Rename igs command ("invert selections") from igs to isel.
  - Add "prune" command as synonym for DELETE key.
  - Clear selections after deleting files via prune/DELETE.
  - Fix dependency issues when fdupes is configured to not use ncurses.
  - Do not enter ncurses mode when --immediate option given.


author: wangkai <13474090681@163.com> - 102.13.0-1
changelog:
  - Update to 102.13.0
  - Fix CVE-2023-34416 CVE-2023-34414 CVE-2023-37201 CVE-2023-37202 CVE-2023-37207 CVE-2023-37208 CVE-2023-37211
  - Remove unused patch


author: wangkai <13474090681@163.com> - 102.14.0-1
changelog:
  - Update to 102.14.0
  - Fix CVE-2023-4045 CVE-2023-4046 CVE-2023-4047 CVE-2023-4048 CVE-2023-4049 CVE-2023-4050 CVE-2023-4054 CVE-2023-4055 CVE-2023-4056


author: lvfei <lvfei@kylinos.cn> - 102.15.0-1
changelog:
  - Update to 102.15.0
  - Fix CVE-2023-4573 CVE-2023-4574 CVE-2023-4575 CVE-2023-4576  CVE-2023-4581 CVE-2023-4584


author: xinghe <xinghe2@h-partnres.com> - 1.0.2-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix zone combined forward must not default to True
         fix fw icmptype don't alter ipvs in io_object
         fix check config use the dictionary variants
         fix functions check config fails if direct.xml exists
         fix service adding includes


author: zhanghao <zhanghao383@huawei.com> - 1.0.2-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:chore nftables add delete table helper
         nftables always flush main table on start


author: zhanghao <zhanghao383@huawei.com> - 1.0.2-7
changelog:
  - Type:requirement
  - ID:NA
  - SUG:NA
  - DESC:Firewall startup is to set CleanupModuleOnxit=yes to unload
         related ko when stopping firewalld service


author: zhouyihang <zhouyihang3@h-partners.com> - 1.0.2-8
changelog:
  - Type:requirement
  - ID:NA
  - SUG:NA
  - DESC:To reduce unnecessary loading of ebtables-related kernel modules


author: liyuxiang <liyuxiang@ncti-gba.cn> - 2:2.8.1-2
changelog:
  - Fix CVE-2022-39316
  - Fix CVE-2022-39318
  - Fix CVE-2022-39319
  - Fix CVE-2022-39347
  - Fix CVE-2022-41877


author: Funda Wang <fundawang@yeah.net> - 2:2.11.1-1
changelog:
  - 2.11.1
  - Fix CVE-2023-40567
  - Fix CVE-2023-40569
  - Fix CVE-2023-40188
  - Fix CVE-2023-40186
  - Fix CVE-2023-40181
  - Fix CVE-2023-39353
  - Fix CVE-2023-39352
  - Fix CVE-2023-39356
  - Fix CVE-2023-39350
  - Fix CVE-2023-39351
  - Fix CVE-2023-39354
  - Fix CVE-2023-40589


author: wangkai <13474090681@163.com> - 2:2.11.7-1
changelog:
  - Update to 2.11.7 for fix CVE-2024-32039,CVE-2024-32040,
    CVE-2024-32041,CVE-2024-32458,CVE-2024-32459,CVE-2024-32460,
    CVE-2024-32658,CVE-2024-32659 and CVE-2024-32660


author: wuchangsheng <wuchangsheng2@huawei.com> - 1.0.1-40
changelog:
  - add dfx rcv_nxt info
    mbuf private cache line align
    send pkts index bug fix
    free recv pkts in main loop


author: jiangheng12 <jiangheng14@huawei.com> - 1.0.1-56
changelog:
  - fix build err with dpdk-21.11
  - fix config flow rule race
  - update lstack.Makefile
  - add socket check before write it
  - optimize do_close
  - set kni_switch valid only in primary process
  - fix build err on select_path
  - optimite select_path and pbuf_take
  - check primary process idx and secondary lstack num
  - revert select_thread_path and optimize app thread when sendmsg
  - do not transfer broadcast arp pkts to other process


author: kircher <majun65@huawei.com> - 1.0.1-57
changelog:
  - add udp multicast support in gazelle
  - clean code
  - add bond4 suport
  - dfx: security function failed, return error directly
  - dfx: set g_unix_fd to -1 after abnormal close fd to avoid double close
  - fix bond_ports parse error fix socket_mem parse error when the value exceeds 65536 exit if create_rxtx_pktmbuf failed build.sh build failed return 1 clean code
  - add parentheses to fix build error
  - fix rpc msg alloc failed fix process_numa args error coredump fix sock->conn not free when fd is kernel mode
  - kni down not stop nic
  - fix client connect number unbalance on lstack
  - fix gazellectl -x error when multiplt user nic config


author: jiangheng12 <jiangheng14@huawei.com> - 1.0.1-68
changelog:
  - check return value of hugepage_init to avoid coredump when hugepage memory is insufficient
  - fix core dump when slave mac failed


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-17
changelog:
  - support vlan offload
  - add vlan_id in netif
  - dfx: add tcp exception and kernel event statistics
  - stack: fix coredump caused by gazelleclt in rtc mode when stack num defined is greater than the hijacked thread num
  - add tcp faste timer cnt
  - dfx: support bond get dpdk xstats
  - update src/ltran/ltran_param.c. 规范679行的报错日志信息，将“,”之后的“Please”修正为“please”
  - ltran support vlan
  - cfg: rm ipv6_enable
  - wrap: fix connect wrong port after addr bind two ports
  - add gazelle log
  - PRE_LOG: modify log info while there are repeated items in conf file
  - add gazelle log


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-18
changelog:
  - Fixed an issue where no packet is sent or received when UDP traffic is sent
  - support show nic offload and features
  - log: optimize lstack log
  - gazellectl add connect para
  - dfx: fix 'gazellectl lstack show ip' failed
  - The call stack is not printed in the proactive exit scenario.
  - dfx: gazellectl -c support ipv6
  - 1.solve the problem of 1w connection not being able to ping 2.add debug info : rpc_mempool availd size
  - wrap: support shutdown
  - add struct gz_addr_t
  - fix coredump because of addr null in lwip_fill_sendring
  - fix compilation error
  - fix coredump because sock closed before send data fully
  - gazellectl: fix gazellectl lstack show 1 -r error


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-19
changelog:
  - fix EPOLLIN event error
  - optimize gazelle exit process 1. close all fds 2. lstack thread exits, then gazelle process exits
  - mod unix time stamp to local time
  - fix close can't exit
  - add keep-alive info
  - dfx: fix kernel_events stat


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-22
changelog:
  - fix rte_ring_create/free time consuming
  - use default nonblock mode
  - fix func separate_str_to_array overflow problem
  - CFG:fix check func strdup return value is NULL
  - fix gazellectl -c msg error
  - sigaction: fix deprecated signal flags
  - fix alloc not free
  - optimize shutdown exit process


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-47
changelog:
  - fix coredump when get empty from udp sendring
  - [virtio]: distribute pkg by dst_port
  - parse packages type in rx_poll
  - [virtio]: cfg ipv4 and ipv6 addr
  - fix build failed in 2003sp4
  - fix dpdk_bond_primary_set bug
  - cfg: del unnecessary logs
  - perftool: add latency tool


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-48
changelog:
  - add flow_bifurcation switch in lstack_cfg file
  - virtio: dfx data of virtio
  - virtio: update g_rule_port by reg_ring_type enum
  - virtio: mode actual_queue_num
  - fix poll init not clear old fd


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-50
changelog:
  - cleancode: rename gazelle files in lwip
  - add .gitignore
  - cleancode: improving makefile readability


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-51
changelog:
  - cleancode: refactor sys_now and lwip_ioctl
  - add sem post when update event
  - cleancode: refactor lwipgz_hlist.h
  - fix EPOLLIN event dropd
  - cleancode: refactor lwipgz_list.h
  - cleancode: refactor posix_api
  - fix some error of NULL pointer
  - cleancode: refactor posix type and get_socket
  - cleancode: refactor lwipsock.h


author: yangchen555 <yangchen145@huawei.com> - 1.0.2-52
changelog:
  - fix redis coredump when hugetlbs pagesize is 1024M
  - vitio_user: modify mbuf index for bond4
  - Check the return of lwip_init
  - support kernel connect
  - POSIX: fix select timeout disable and build failed in openEuler 2003


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-53
changelog:
  - virtio_user: modify mbuf index for bond4
  - fix issue: create virtio_user based on bond4 main network card
  - virtio: fix dfx error with multiple cpus
  - dfx: optimize gazellectl -x for bond


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-54
changelog:
  - refector fill udp sendring
  - virtio_user: solve the issue that failed to bind virtio_user's IPv6 address
  - virtio_user: add vlan info for kernerl packets when vlan switch is on
  - WRAP:fix double connect lead posix api disable


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-55
changelog:
  - virtio: mod virtio_user_name when multi process is on
  - WRAP: fix bind log error
  - WRAP:fix ltran mode did not bind kernel while open kni
  - virtio_user: The program establishes a network connection when network card status is up
  - fix redis coredump ctrl-c during the pressure test


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-59
changelog:
  - epoll: fix wild pointer detected by cooddy
  - tools: fix sync patch script date wrong and update the way get patchnum
  - cfg: modify maximum tcp_conn_count to 2w
  - fix mbuf_total calculation error


author: yinbin6 <jiangheng14@huawei.com> - 1.0.2-64
changelog:
  - cleancode: declare different cfg_params types
  - cleancode: add rpc_async_call, remove rpc_msg_arg.socklen, fix some format
  - cleancode: move some API from stack to rpc and rtw
  - cleancode: refactor rtc_api rtw_api and dummy_api


author: yinbin6 <jiangheng14@huawei.com> - 1.0.2-66
changelog:
  - af_xdp: set rlimit unlimit when gazelle init
  - add interrupt mode support
  - add pingpong dfx support


author: yinbin6 <jiangheng14@huawei.com> - 1.0.2-67
changelog:
  - bugfix: fix gazelle init failed while setup by non-root user
  - rpc: fix rpc_sync_call spinlock block when msg be recalled
  - rtw: fix send length exceeding send_ring_size
  - fix stack null when register interrupt


author: hantwofish <yinbin8@huawei.com> - 1.0.2-73
changelog:
  - xdp: support XDP_STATISTICS by posix_api->getsockopt_fn
  - add SO_NUMA_ID(optname) for adapting opneGauss
  - remove the unused return variable.
  - Fix annotation errors
  - bugfix: start fail when executing the popen command for the second time in openGauss


author: yinbin <jiangheng14@huawei.com> - 1.0.2-74
changelog:
  - LOG: Optimize some log displays
  - remove: code about nobolck mode for mysql
  - interrupt: fix timeout events cannot be counted


author: yinbin <yinbin8@huawei.com> - 1.0.2-77
changelog:
  - openGauss: support kernel connnect
  - xdp: support stack bind numa
  - CFG: fix xdp iface check error
  - fix build error in 2003SP4
  - cfg: show dpdk args after dpdk_adjust_args
  - fix free null pointer when no matching device is found
  - update test/unitest/ltran/ltran_param_test.c.
  - Fix the wrong spelling description in the notes and logs
  - LWIP: adjust position of shutdown in callback of connect
  - fix socket of control thread is overwirtten due to another primary process start


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-79
changelog:
  - cfg: notify that it's unsupported, when stack_num > 1
  - fix errno == ETIMEFOUT
  - fix epoll and recv threads blocked on the same semaphore. data cannot be read in recv thread.
  - fix rpc pool leak, when thread exits
  - remove app_bind_numa check from exclude_cpus
  - openGauss: fix connection attempt failed
  - openGauss: fix gs_ctl switchover failed


author: benniaobufeijiushiji <linda7@huawei.com> - 10.3.1-20
changelog:
  - Type:Sync
  - ID:NA
  - SUG:NA
  - DESC:Sync patch from openeuler/gcc
         Bugfix for loop-distribution, semi-relayout and mull64.


author: Xiong Zhou <xiongzhou4@huawei.com> - 10.3.1-22
changelog:
  - Type:Sync
  - ID:NA
  - SUG:NA
  - DESC:Sync patch from openeuler/gcc
         Fix typo in tree-ssa-reassoc.c.


author: Zhao Shujian <zhaoshujian@huawei.com> - 10.3.1-23
changelog:
  - Type:Spec
  - ID:NA
  - SUG:NA
  - DESC: To resolve the spec 548 fluctuation problem, revert GCC commit.


author: zhangxianting <zhangxianting@uniontech.com> - 9.55.0-9
changelog:
  - Type:CVE
  - ID:NA
  - SUG:NA
  - DECS: fix CVE-2024-29506 CVE-2024-29507 CVE-2024-29508 CVE-2024-29509 CVE-2024-29511


author: yaoxin <yao_xin001@hoperun.com> - 5.2.2-1
changelog:
  - Update to 5.2.2
    * Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)
    * Address SF issue #151: A heap-buffer-overflow in gif2rgb.c:294:45
    * Address SF issue #166: a read zero page leads segment fault in
      getarg.c and memory leaks in gif2rgb.c and gifmalloc.c


author: fuanan <fuanan3@h-partners.com> - 2.33.0-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Modify parameter in backport-CVE-2022-23521-attr-fix-silently-splitting-up-lines-longer-than-204.patch


author: fuanan <fuanan3@h-partners.com> - 2.33.0-10
changelog:
  - Type:CVE
  - ID:CVE-2023-25652 CVE-2023-29007 CVE-2023-25815
  - SUG:NA
  - DESC:Fix CVE-2023-25652 CVE-2023-29007 CVE-2023-25815


author: fuanan <fuanan3@h-partners.com> - 2.33.0-11
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:enable multithreading compilation and installation,
         move Git.3pm.gz to perl-Git,avoid installation conflicts,
         change BuildRequires from pcre-devel to pcre2-devel.


author: huyubiao <huyubiao@huawei.com> - 2.33.0-13
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Specifying Obsoletes and Provides version numbers, prevent upgrade conflicts.
         Delete git-core-doc from git, git-core-doc is provided by git-help.


author: fuanan <fuanan3@h-partners.com> - 2.33.0-14
changelog:
  - Type:CVE
  - ID:CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465
  - SUG:NA
  - DESC:Fix CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465


author: panxiaohe <panxiaohe@huawei.com> - 2.30.0-4
changelog:
  - Fix CVE-2021-29468
  - Add gcc and gettext to BuildRequires
    - necessary for building and msgfmt command


author: yanan <yanan@huawei.com> - 2.68.1-12
changelog:
  - Type:bugfix
  - DESC:fix issues found by svace static code analyzer
         fix segfault,memory leak,EOF,arguments leak


author: shixuantong <shixuantong1@huawei.com> - 2.34-102
changelog:
  - elf: Do not completely clear reused namespace in dlmopen (bug 29600)
  - elf: Remove allocate use on _dl_debug_printf
  - elf/tlsdeschtab.h: Add the Malloc return value check in _dl_make_tlsdesc_dynamic()
  - Fix OOB read in stdlib thousand grouping parsing [BZ#29727]


author: wanghongliang <wanghongliang@loongson.cn> - 2.34-105
changelog:
  - LoongArch Port
  - Add login-Add-back-libutil-as-an-empty-library.patch from upstream
    to fix libutil build error.
  - Add malloc-Fix-malloc-debug-for-2.35-onwards.patch from upstream
    to fix memory bug
  - After glibc 2.28,removed libnsl.LoongArch Port in glibc 2.34,not support libnsl.
  - Left some test fails in testsuite_whitelist.


author: Xue Liu <liuxue@loongson.cn> - 2.34-106
changelog:
  - LoongArch: Optimize some string functions including memcpy, memmove,
    memset, strchr, strchrnul, strcmp, strncmp, ctrcpy, ctrlen, strnlen.


author: Yang Yanchao <yangyanchao6@huawei.com> - 2.34-109
changelog:
  - Since the pthread_cond_clockwait@GLIBC_2_28 is introduced in earlier
    versions, this symbol is required to keep the previous items compatible.


author: Lv Ying <lvying6@huawei.com> - 2.34-112
changelog:
  - elf/ld.so: ld.so mmap shared object use hugepage new feature and bugfix:
    - feature: support HUGEPAGE_PROBE + hugepageedit mark shared object
      specified segment, just try to use hugepage to mmap specified segment
      instead of all the segments in the shared object
    - bugfix: remove _mmap_hole when ld.so mmap PT_LOAD segment try to use hugepage


author: Qingqing Li <liqingqing3@huawei.com> - 2.34-145
changelog:
  - elf: Add a way to check if tunable is set (BZ 27069)
  - malloc: Improve MAP_HUGETLB with glibc.malloc.hugetlb=2


author: chengyechun <chengyechun1@huawei.com> - 2.34-148
changelog:
  - Type:CVE
  - ID:CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602
  - SUG:NA
  - DESC:fix CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602


author: chengyechun <chengyechun1@huaiwe.com> - 2.34-149
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:nscd: Use errval, not errno to guide cache update
         nsce :Skip unusable entries in first pass in prune_cache


author: shixuantong <shixuantong1@huawei.com> - 2.34-150
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:elf: Add TLS modid reuse test for bug 29039
         elf: Fix TLS modid reuse generation assignment
         elf: Check objname before calling fatal_error
         elf: Fix _dl_debug_vdprintf to work before self-relocation
         elf: ldconfig should skip temporary files created by package managers
         ldconfig: Fixes for skipping temporary files.


author: shixuantong <shixuantong1@huawei.com> - 2.34-157
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:enable shared library use huge page for aarch64 architecture
         revert "elf/ld.so: use special mmap for hugepage to get symbols"
         hugepageedit: static-link build
         elf: the hugepage feature of dynamic library keep compatible with llvm lld
         elf: add some debug info for dynamic library hugepage feature


author: chengyechun <chengyechun1@huawei.com> - 2.34-160
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:resolv: Track single-request fallback via _res._flags
         resolv: Allow short error responses to match any query


author: shixuantong <shixuantong1@huawei.com> - 2.34-162
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:elf: avoid jumping over a needed declaration
         elf: Move __rtld_malloc_init_stubs call into _dl_start_final


author: shixuantong <shixuantong1@huawei.com> - 2.34-163
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:elf: Handle static PIE with non-zero load address
         elf: Introduce _dl_relocate_object_no_relro
         elf: Switch to main malloc after final ld.so self-relocation


author: chenyanpanHW <chenyanpan@huawei.com> - 7.6-2
changelog:
  - DESC: delete -Sgit from 
  %setup       -q



  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/0001-SC2081-can-t-match-globs-Use-or-grep.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/0002-fuse-Resolve-asan-bug-in-during-receive-event-notifi.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f

  , and delete BuildRequires git


author: lihaoxiang <lihaoxiang9@huawei.com> - 10.0-7
changelog:
  - fix upgrade error that /usr/share/man/man8/*gluster*.8* belong to package glusterfs currently conflict with that belong to package help in the lower version.


author: hanchao <hanchao47@huawei.com> - 1.17.3-5
changelog:
  - Type:CVE
  - CVE:NA
  - SUG:NA
  - DESC: fix CVE-2022-32148,CVE-2022-1962,CVE-2022-1705,CVE-2022-30633,
  	CVE-2022-30635,CVE-2022-30630,CVE-2022-30632,CVE-2022-28131,
  	CVE-2022-30631,CVE-2022-30629,CVE-2022-30634


author: hanchao<hanchao47@huawei.com> - 1.17.3-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: golang: modify the golang.spec to remove unnecessary files
  	from golang-help package


author: hanchao <hanchao47@huawei.com> - 1.17.3-10
changelog:
  - Type:CVE
  - CVE:CVE-2022-41715,CVE-2022-2880,CVE-2022-2879
  - SUG:NA
  - DESC: fix CVE-2022-41715,CVE-2022-2880,CVE-2022-2879


author: hanchao <hanchao47@huawei.com> - 1.17.3-12
changelog:
  - Type:CVE
  - CVE:CVE-2022-41716
  - SUG:NA
  - DESC: remove hard code and strong dependency of git, subversion and mercurial


author: hanchao <hanchao47@huawei.com> - 1.17.3-14
changelog:
  - Type:CVE
  - CVE:CVE-2022-23806,CVE-2022-23773,CVE-2022-24921,CVE-2021-44716,CVE-2022-23772,CVE-2022-41717
  - SUG:NA
  - DESC: fix CVE-2022-23806,CVE-2022-23773,CVE-2022-24921,CVE-2021-44716,CVE-2022-23772,CVE-2022-41717


author: hanchao <hanchao47@huawei.com> - 1.17.3-15
changelog:
  - Type:CVE
  - CVE:CVE-2022-41723,CVE-2022-41724,CVE-2022-41725
  - SUG:NA
  - DESC: fix CVE-2022-41723,CVE-2022-41724,CVE-2022-41725


author: hanchao <hanchao47@huawei.com> - 1.17.3-16
changelog:
  - Type:CVE
  - CVE:CVE-2023-24534,CVE-2023-24536,CVE-2023-24537,CVE-2023-24538
  - SUG:NA
  - DESC: fix CVE-2023-24534,CVE-2023-24536,CVE-2023-24537,CVE-2023-24538


author: hanchao <hanchao63@huawei.com> - 1.17.3-18
changelog:
  - Type:CVE
  - CVE:CVE-2023-29400,CVE-2023-24539,CVE-2023-24540
  - SUG:NA
  - DESC: fix CVE-2023-29400,CVE-2023-24539,CVE-2023-24540


author: hanchao <hanchao63@huawei.com> - 1.17.3-19
changelog:
  - Type:CVE
  - CVE:CVE-2023-29402,CVE-2023-29403,CVE-2023-29404,CVE-2023-29405
  - SUG:NA
  - DESC:fix CVE-2023-29402,CVE-2023-29403,CVE-2023-29404,CVE-2023-29405


author: hanchao <hanchao63@huawei.com> - 1.17.3-23
changelog:
  - Type:CVE
  - CVE:CVE-2023-39318,CVE-2023-39319
  - SUG:NA
  - DESC:fix CVE-2023-39318 and CVE-2023-39319


author: hanchao <hanchao63@huawei.com> - 1.17.3-28
changelog:
  - Type:CVE
  - CVE:CVE-2024-24783,CVE-2024-24785,CVE-2023-45290,CVE-2023-45289
  - SUG:NA
  - DESC:fix CVE-2024-24783,CVE-2024-24785,CVE-2023-45290,CVE-2023-45289


author: wangshuo <wangshuo@kylinos.cn> - 1.17.3-31
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport the upstream patch, fix the overflow issue in runtime.netpollWaiters


author: wanglu <wanglu210@huawei.com> - 1:2.06-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:tests: Disable blkid cache usage
         disk/efi/efidisk: Pass buffers with higher alignment


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:modify the permissions of the files which under /usr/lib/systemd/system directory
         in grub2-tools to 644


author: mengyingkun <mengyingkun@loongson.cn> - 1:2.06-20
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:loongarch modify the location where initrd is loaded into memory


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-21
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:disk/diskfilter: Check calloc() result for NULL
         kern/buffer: Handle NULL input pointer in grub_buffer_free()
         disk/diskfilter: Don't make a RAID array with more than 1024 disks
         loader/multiboot_elfxx: Fix memory leak
         loader/linux: Ensure the newc pathname is NULL-terminated
         term/i386/pc/vga_text: Prevent out-of-bounds writes to VGA text buffer
         normal/cmdline: Fix two related integer underflows
         fs/iso9660: Fix memory leaks in grub_iso9660_susp_iterate()
         fs/squash4: Fix memory leaks in grub_squash_iterate_dir()
         fs/xfs: Fix memory leaks in XFS module
         kern/file: Fix error handling in grub_file_open()


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-28
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:osdep/linux/hostdisk: Modify sector by sysfs as disk sector
         net/bootp: Fix unchecked return value
         fs/iso9660: Avoid reading past the entry boundary
         fs/iso9660: Incorrect check for entry boundary
         fs/iso9660: Prevent skipping CE or ST at start of continuation area
         fs/iso9660: Prevent read past the end of system use area
         fs/iso9660: Add check to prevent infinite loop
         gentpl.py: Remove .interp section from .img files
         kern/fs: Fix possible integer overflow in i386-pc mode with large partitions
         font: Reject fonts with negative max_char_width or max_char_height
         font: Assign null_font to unknown_glyph
         font: Check return value of grub_malloc() in ascii_glyph_lookup()


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-31
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:kern/acpi: Use xsdt_addr if present
         commands/acpi: Use xsdt_addrifpresent


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-35
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:kern: Check for NULL when closing devices and disks
         kern/efi/mm: Fix use-after-free in finish boot services
         util/grub-install-common: Fix the key of the --core-compress option
         net/dns: Fix lookup error when no IPv6 is returned
         net/dns: Simplify error handling of recv_hook() function
         net/dns: Fix removal of DNS server


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-37
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fs/udf: Fix out of bounds access
         lib/relocator: Fix OOB write when initializing lo->freebytes[]
         util/grub-mount: Fix memory leak in fuse_getattr()


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-38
changelog:
  - Type:CVE
  - CVE:CVE-2023-4692 CVE-2023-4693
  - SUG:NA
  - DESC:fs/ntfs: Make code more readable
         fs/ntfs: Fix an OOB read when parsing a volume label
         fs/ntfs: Fix an OOB read when parsing bitmaps for index attributes
         fs/ntfs: Fix an OOB read when parsing directory entries from resident and non-resident index attributes
         fs/ntfs: Fix an OOB read when reading data from the resident $DATA attribute
         fs/ntfs: Fix an OOB write when parsing the $ATTRIBUTE_LIST attribute for the $MFT file


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-40
changelog:
  - Type:requirement
  - CVE:NA
  - SUG:NA
  - DESC:add TPCM support with ipmi channel
         change the name of module tpcm to tpcm_kunpeng
         skip verification when not loading grub.cfg


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-41
changelog:
  - Type:CVE
  - CVE:CVE-2024-1048
  - SUG:NA
  - DESC:grub-set-bootflag: Fix for CVE-2024-1048
         commands/acpi: Fix calculation of ACPI tables addresses when processing RSDT and XSDT
         kern/acpi: Skip NULL entries in RSDT and XSDT
         util/grub-mount: Check file path sanity


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-42
changelog:
  - Type:CVE
  - CVE:CVE-2021-46848
  - SUG:NA
  - DESC:lib/libtasn1: Fix ETYPE_OK off by one array size check


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-43
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix log printing in tpcm_kunpeng moddule
         osdep/linux/hostdisk: Use stat() instead of udevadm for partition lookup
         osdep: Introduce include/grub/osdep/major.h and use it
         disk/mdraid1x_linux: Prevent infinite recursion
         disk: Generalize MD_MAX_DISKS to GRUB_MDRAID_MAX_DISKS


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-45
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:commands/legacycfg: Avoid closing file twice
         disk/lvm: GRUB fails to detect LVM volumes due to an incorrect computation of mda_end


author: Funda Wang <fundawang@yeah.net> - 1.18.4-8
changelog:
  - fix CVE-2024-47538, CVE-2024-47541, CVE-2024-47542, CVE-2024-47600,
    CVE-2024-47607, CVE-2024-47615, CVE-2024-47835


author: yaoxin <yao_xin001@hoperun.com> - 1.16.2-7
changelog:
  - Fix cves:
    CVE-2024-47606,CVE-2024-47613,CVE-2024-47775,CVE-2024-47776
    CVE-2024-47777,CVE-2024-47778,CVE-2024-47774,CVE-2024-47540
    CVE-2024-47602,CVE-2024-47601,CVE-2024-47834,CVE-2024-47537
    CVE-2024-47597,CVE-2024-47543,CVE-2024-47596,CVE-2024-47539
    CVE-2024-47546


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 3.24.30-8
changelog:
  - Fix the problem that the prompt information of network icon volume icon is not displayed
  - update xscreen size when x11 screen size change
  - always send the monitors changed signal when screen size change
  - Add function definition of gtk_image_set_from_pixbuf_with_scale


author: xinghe <xinghe2@h-partners.com> - 2.6.6-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:connection: Clear flags when a conn is removed
         connection: Preserve flags when a conn is removed
         stream: do not try to free a failed stream-conn
         http_ana/txn: don't re-initialize txn and req var
         mworker: prevent incorrect values in uptime
         protocol: fix minor memory leak in protocol_bind_all()
         stream: Perform errors handling in right order in stream_new()


author: xinghe <xinghe2@h-partners.com> - 2.6.6-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:backport to fix potential coredump:
         errors: handle malloc failure in usermsgs_put
         ssl_sock: add check for ha_meth
         thread: add a check for pthread_creat


author: xinghe <xinghe2@h-partners.com> - 2.6.6-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:server: add missing free for server->rdr_pfx
         server: do not leak default-server in defaults


author: xinghe <xinghe2@h-partners.com> - 2.6.6-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:server: 'source' interface ignored from 'default-server' directive


author: xinghe <xinghe2@h-partners.com> - 2.6.6-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:haproxy: only tid 0 must not sleep if got signal
         fix timehopping in freq_ctr_total


author: xinghe <xinghe2@h-partners.com> - 2.6.6-13
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:stream: Prevent mux upgrades if client connection is no longer ready


author: yaoxin <yao_xin001@hoperun.com> - 1.14.5-1
changelog:
  - Update to 1.14.5:
    * Added signed Windows msi binary and signed Apple dmg binary files.
    * Moved examples to the HDF5Examples folder in the source tree.
    * Added support for using zlib-ng package as the zlib library
    * Disable CMake UNITY_BUILD for hdf5
    * Removed "function/code stack" debugging configuration option
    * Added configure options for enabling/disabling non-standard programming language features
    * Added the CMake variable HDF5_ENABLE_ROS3_VFD to the HDF5 CMake config
      file hdf5-config.cmake. This allows it to easily detect if the library
      has been built with or without read-only S3 functionality.
    * Fixed many CVE:
      CVE-2024-29157,CVE-2024-29158,CVE-2024-29159,CVE-2024-29160,CVE-2024-29161,CVE-2024-29162
      CVE-2024-29163,CVE-2024-29164,CVE-2024-29165,CVE-2024-29166,CVE-2024-32605,CVE-2024-32606
      CVE-2024-32607,CVE-2024-32608,CVE-2024-32609,CVE-2024-32610,CVE-2024-32611,CVE-2024-32612
      CVE-2024-32613,CVE-2024-32614,CVE-2024-32615,CVE-2024-32616,CVE-2024-32617,CVE-2024-32618
      CVE-2024-32619,CVE-2024-32620,CVE-2024-32621,CVE-2024-32622,CVE-2024-32623,CVE-2024-32624
      CVE-2024-33873,CVE-2024-33874,CVE-2024-33875,CVE-2024-33876,CVE-2024-33877,CVE-2018-13871
      CVE-2018-13875,CVE-2018-14034


author: gaihuiying <eaglegai@163.com> - 2.4.51-4
changelog:
  - Type:cves
  - ID:NA
  - SUG:restart
  - DESC:fix CVE-2022-22719 CVE-2022-22720 CVE-2022-22721 CVE-2022-23934


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-8
changelog:
  - Type:CVE
  - ID:NA
  - SUG:restart
  - DESC:fix CVE-2022-31813,CVE-2022-28614,CVE-2022-29404,CVE-2022-26377,CVE-2022-30522,CVE-2022-30556


author: liweiganga <liweiganga@uniontech.com> - 2.4.51-10
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:restart
  - DESC:change default value of HeartbeatMaxServers
         fix setting and comparison of IPs fileds
         avoid voerflow in case of indecently large session
         make ap_escape_quotes() work correctly
         fix lua_request with cast first
         Handle children killed pathologically
         mod_md do not interfere with requests if challenge type http-01


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-12
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:restart
  - DESC:reduce the dependency of httpd on system-logos installation


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-13
changelog:
  - Type:CVE
  - ID:CVE-2022-36760, CVE-2006-20001, CVE-2022-37436
  - SUG:restart
  - DESC:fix CVE-2022-36760,CVE-2006-20001,CVE-2022-37436


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-15
changelog:
  - Type:CVE
  - ID:CVE-2023-27522, CVE-2023-25690
  - SUG:restart
  - DESC:fix CVE-2023-27522, CVE-2023-25690


author: chengyechun <chengyehcun1@huawei.com> - 2.4.51-16
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:Report an error if the AJP backend sends an invalid number of headers
         handled a negative value when parsing the config
         avoid delimiting the query with a backreference
         fix missing APLOGNO


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-17
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:Fix double encoding of the uri-path of the request
         Do not match the extention against possible query string
         Do not double encode slashes
         Check before forwarding that a nocanon path has not been rewriteen


author: panchenbo <panchenbo@kylinsec.com.cn> - 2.4.51-18
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:add sw_64 support,optimize sw build patch,add loongarch64 support


author: chengyechun <chengyechun1@huaiwe.com> - 2.4.51-21
changelog:
  - Type:CVE
  - ID:CVE-2024-24795,CVE-2023-38709,CVE-2024-27316
  - SUG:NA
  - DESC:fix CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 and sync some patches from upstream


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-22
changelog:
  - Type:CVE
  - ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573
  - SUG:NA
  - DSEC:fix some CVEs


author: yangjiaqi <yangjiaqi16@huawei.com> - 2.0.17-10
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: remove chmod 751 permission for dirs by engine when user-remap enabled


author: yangjiaqi <yangjiaqi16@huawei.com> - 2.0.18-15
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: keep the service status unchanged after iSulad service upgrade


author: chenyanpanHW <chenyanpan@huawei.com> - 10.06-2
changelog:
  - DESC: delete -S git from 
  %setup       -q



  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/backport-run-ifdown-on-all-interfaces.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/bugfix-initscripts-add-udev-wait-dependency-for-network.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/bugfix-mod-network-function-when-NM-unmanage-devices.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/bugfix-initscripts-set-PERSISTENT_DHCLIENT-default-to-yes.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/bugfix-network-need-chkconfig-on.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/bugfix-restart-network-warning.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/new-network-fork-to-start-dhcp.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/exec-udevadm-settle-when-network-start.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/remove-rename_device_lock-when-process-does-not-exis.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f

  , and delete BuildRequires git


author: gaoxingwang <gaoxingwang1@huawei.com> - 10.12-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:remove redundant provide for service cmd and delete unnecessary obseletes to fix upgrade problem


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1.2-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:after executing hook scripts, remove their executable permission
         of non root users


author: sunsuwan<sunsuwan3@huawei.com> - 5.15.0-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:lnstat: fix buffer overflow in header output 
         libnetlink: fix socket leak in rtnl_open_byptoyo
         lnstat: fix strdup leak in w argument parsing
         q_cake: allow fix buffer overflow on large labels
         tc flower: fix buffer overflow on large labels
         tc_tuil: fix parsing action control with space and sl
         tipc: fix keylen check
         fix devlink health dump command without arg
         tc: em_u32: fix offset parsing
         l2tp fix typo in AF_INET6 checksum JSON print
         ip: Fix size_columns() for very large values
         ip: Fix size_columns() invocation that passes a 32-bit quantity


author: jiangheng<jiangheng14@huawei.com> - 5.15.0-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:bridge: fix memory leak when doing fdb get
         mptcp: fix memory leak when doing 'endpoint show'
         mptcp: fix memory leak when getting limits
         ip neigh: fix memory leak when doing 'get'
         ip address: fix memory leak when specifying device
         fix marco expansion in changelog


author: gaoxingwang <gaoxingwang1@huawei.com> - 1:5.15.0-11
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:add epoch version in changelog to fix check_spec_file ci failure


author: gaoxingwang <gaoxingwang1@huawei.com> - 1:5.15.0-14
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:ipnetns: fix fd leak with 'ip netns set'
         iproute2: optimize code and fix some mem-leak risk
         iproute_lwtunnel: fix array boundary check
         iproute_lwtunnel: fix possible use of NULL when malloc()
         m_action: fix warning of overwrite of const string
         netem: fix NULL deref on allocation failure
         nstat: fix potential NULL deref
         rdma/utils: fix some analyzer warnings
         rt_names: check for malloc() failure
         tc/prio: handle possible truncated kernel response
         tc_exec: don't dereference NULL on calloc failure
         tc_util fix unitialized warning
         iptunnel: detect protocol mismatch on tunnel change
         ipmaddr: fix dereference of NULL on malloc() failure


author: gaoxingwang <gaoxingwang1@huawei.com> - 1:5.15.0-16
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:libnetlink: Fix memory leak in __rtnl_talk_iov()
         tc: ct: Fix invalid pointer dereference
         tc_util: Change datatype for maj to avoid overflow issue
         tc_util: Fix no error return when large parent id used
         xfrm: prepare state offload logic to set mode


author: liubo335 <liubo335@huawei.com> - 1:5.15.0-17
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:f_flower: Treat port 0 as valid
         ip: error out if iplink does not consume all options
         iplink_bridge: fix incorrect root id dump
         ss: change aafilter port from int to long (inode support)
         ss: Fix socket type check in packet_show_line()
         ss: print unix socket "ports" as unsigned int (inode)
         Add utility to convert an unsigned int to string
         Add get_long utility and adapt get_integer accordingly
         utils: fix get_integer() logic


author: eaglegai <eaglegai@163.com> - 20210722-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport to fix no reply when ping6 from Subnet-Router anycast address


author: zengweifeng <zwfeng@huawei.com> - 20210722-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: fix ping2 bingding to VRF and address
          Avoid binding to non-VRF
          Fix ARP protocol field for AX.25 and NETROM


author: crash888 <wangmengqi13@huawei.com> - 1:1.8.0.372-b07.0
changelog:
  - deleted Add-ability-to-configure-third-port-for-remote-JMX.patch
  - deleted 8287109-Distrust-failed-with-CertificateExpired.patch
  - deleted Huawei-fix-windows-build-Dynamic-CDS-failure.patch
  - deleted 8296480-Fix-the-problem-that-the-TestPolicy.java-cas.patch
  - deleted 8296485-BuildEEBasicConstraints.java-test-fails-with.patch
  - deleted fix-CVE-2023-21930.patch
  - deleted fix-CVE-2023-21954.patch
  - deleted fix-CVE-2023-21967.patch
  - modified 8202951-Support-default-jsa.patch
  - modified 8204595-add-more-thread-related-system-settings-info.patch
  - modified 8257695-linux-Add-process-memory-information-to-hs-e.patch
  - modified add-appcds-test-case.patch
  - modified fix-log-bug-enhance-aes-hmac-performance.patch
  - modified Test8167409.sh-fails-to-run-with-32bit-jdk-on-64bit-.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch
  - modified add-missing-test-case.patch
  - add fix-the-issue-that-cert-of-geotrustglobalca-expired.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - add 8074354-Make-CreateMinidumpOnCrash-a-new-name-and-av.patch    
  - add jcmd-mnt-add-start-time-and-end-time.patch                    
  - add Fix-localtime_r-not-defined-on-windows.patch                  
  - add 8057743-process-Synchronize-exiting-of-threads-and-p.patch    
  - add 8305541-C2-Div-Mod-nodes-without-zero-check-could-be.patch
  - upgrade to jdk8u372-b07


author: kuenking111 <wangkun49@huawei.com> - 1:1.8.0.372-b07.2
changelog:
  - 0002-8179498-attach-in-linux-should-be-relative-to-proc-p.patch
  - 0003-8187408-AbstractQueuedSynchronizer-wait-queue-corrup.patch
  - 0004-8193710-jcmd-l-and-jps-commands-do-not-list-Java-pro.patch
  - 0005-8196743-jstatd-doesn-t-see-new-Java-processes-inside.patch
  - 0006-8284330-jcmd-may-not-be-able-to-find-processes-in-th.patch
  - 0007-8241670-Enhance-heap-region-size-ergonomics-to-impro.patch
  - 0008-8223162-Improve-ergonomics-for-Sparse-PRT-entry-sizi.patch
  - 0009-8262316-Reducing-locks-in-RSA-Blinding.patch
  - 0010-8283994-Make-Xerces-DatatypeException-stackless.patch
  - 0011-Optimizing-ObjectInputStream-by-FreqInlineSize.patch
  - 0012-8301187-Memory-leaks-in-OopMapCache.patch
  - 0013-8287349-AArch64-Merge-LDR-instructions-to-improve-C1.patch
  - 0014-8280511-AArch64-Combine-shift-and-negate-to-a-single.patch
  - 0015-6605915-jinfo-flag-flag-name-functionality-doesn-t-w.patch
  - 0016-8036599-Use-Diagnostic-Commands-instead-of-SA-by-def.patch
  - 0017-8054889-Compiler-team-s-implementation-task.patch
  - 0018-8130832-Extend-the-WhiteBox-API-to-provide-informati.patch
  - 0019-8040213-C2-does-not-put-all-modified-nodes-on-IGVN-w.patch
  - 0020-8251216-Implement-MD5-Intrinsics-on-aarch64.patch
  - 0021-fastdebug-fix-TestMD5Intrinsics.java-and-TestMD5Mult.patch
  - 0022-8198510-Enable-UseDynamicNumberOfGCThreads-by-defaul.patch
  - 0023-8180421-Change-default-value-of-BiasedLockingStartup.patch
  - 0024-Fix-the-trim-crash-caused-by-incorrect-assert-in-fas.patch
  - 0025-8220166-Performance-regression-in-deserialization.patch
  - 0026-8072070-Improve-interpreter-stack-banging.patch
  - 0027-8193386-CompressedClassSize-too-large-with-MaxMetasp.patch
  - 0028-Display-more-information-about-the-codedump-file-pat.patch
  - 0029-8211845-A-new-switch-to-control-verbosity-of-hs-err-.patch
  - 0030-add-more-specific-possible-reasons-in-hs_error-log-w.patch
  - 0031-8187653-Lock-in-CoderResult.Cache-becomes-performanc.patch
  - 0032-8299158-Improve-MD5-intrinsic-on-AArch64.patch
  - 0033-8211326-add-OS-user-related-information-to-hs_err-fi.patch
  - 0034-8250902-Implement-MD5-Intrinsics-on-x64.patch
  - 0035-8210821-Support-dns_canonicalize_hostname-in-krb5.co.patch
  - 0036-8297656-AArch64-Enable-AES-GCM-Intrinsics.patch
  - 0038-Record-file-descriptor-when-ExtensiveErrorReports-is.patch
  - 0039-8243389-enhance-os-pd_print_cpu_info-on-linux.patch
  - 0040-Print-the-Exception-event-in-more-detail.patch
  - 0041-Reuse-translet-in-XSLTC-for-specjvm-xml-transform.patch
  - 0042-8140581-Excluding-compile-messages-should-only-be-pr.patch
  - 0043-Cache-dom-in-xml-transform.patch
  - 0044-Record-file-descriptor-when-ExtensiveErrorReports-is.patch
  - 0045-8276904-Optional.toString-is-unnecessarily-expensive.patch
  - 0046-8210960-Allow-with-boot-jdk-jvmargs-to-work-during-c.patch
  - 0047-8025692-Log-what-methods-are-touched-at-run-time.patch
  - 0048-fix-jdk8-fastdebug-hotspot-test-compiler-c2-TestSpli.patch
  - 0049-Modify-G1GC-log-information.patch
  - 0050-8181644-C1-crashes-with-XX-PrintCFGToFile.patch
  - 0051-8071962-The-SA-code-needs-to-be-updated-to-support-S.patch
  - 0052-8177959-G1CollectedHeap-print_on-prints-incorrect-ca.patch
  - 0053-8146987-Improve-Parallel-GC-Full-GC-by-caching-resul.patch
  - 0054-Fix-jmap-heapdump-symbols-when-the-class-is-loaded-f.patch
  - 0055-Fix-CodelistTest.java-Failed-to-Execute-CodelistTest.patch


author: wanghao_hw <wanghao564@huawei.com> - 1:1.8.0.382-b05.0
changelog:
  - add Huawei-Print-more-information-when-AbortVMOnException.patch
  - deleted patch 8185736-missing-default-exception-handler-in-calls-t.patch
  - deleted patch cve-2022-37434-Fix-a-bug-when-getting-a-gzip-header-extra-field-with-inflate.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch
  - modified add-missing-test-case.patch
  - modified fix-the-issue-that-cert-of-geotrustglobalca-expired.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - add 8035986-KerberosKey-algorithm-names-are-not-specifie.patch
  - add fixing-a-bug-in-the-processing-of-default-attributes.patch
  - add enhance-java-heap-oom-err-log.patch
  - add 8014628-Support-AES-Encryption-with-HMAC-SHA2-for-Ke.patch
  - add 8179273-sun.net.httpserver.LeftOverInputStream-shoul.patch
  - del --with-zlib=system
  - upgrade to jdk8u382-b05


author: kuenking111 <wangkun49@huawei.com> - 1:1.8.0.382-b05.9
changelog:
  - add add-0010-8301749-Tracking-malloc-pooled-memory-size.patch
  - add 8213397-Stack-dump-should-show-more-clearly-when-a-t.patch
  - add Record-the-number-of-processes-to-errlog-file.patch.patch
  - add 8254723-Add-diagnostic-command-to-write-Linux-perf-m.patch
  - add The-OverWriteOldestGCLog-option-is-added-to-control.patch
  - add add-6899049-G1-Clean-up-code-in-ptrQueue.-ch-pp-and-.patch
  - add add-make-Appcds-jsa-rw-region-deterministic.patch
  - add add-8142508-To-bring-j.u.z.ZipFile-s-native-implemen.patch
  - add add-8198423-Improve-metaspace-chunk-allocation.patch
  - add add-8226530-ZipFile-reads-wrong-entry-size-from-ZIP6.patch
  - add add-fix-lock_fd-no-close-and-improve-KAEProvider.patch
  - add add-8242842-Avoid-reallocating-name-when-checking-fo.patch
  - add add-8170831-ZipFile-implementation-no-longer-caches-.patch
  - add add-8146431-j.u.z.ZipFile.getEntry-throws-AIOOBE.patch
  - add add-8226530-test-case-fixed.patch
  - add add-8147940-Modify-testcase-this-test-does-not-assum.patch
  - add add-8191924-Adjust-DelegatingClassLoader-s-metadata-.patch
  - add add-Do-not-collect_class-when-DynamicCDS-dump.patch
  - add add-add-Count-instance-klass-when-loading-from-jsa-f.patch
  - add add-Adapting-IOException-of-Zip-to-ZipException.patch
  - add add-8227041-runtime-memory-RunUnitTestsConcurrently.patch
  - add add-fix-windows-build-Dynamic-CDS-failure.patch
  - add add-Fix-aarch64-runtime-thread-signal-transfer-bug.patch
  - add 8295068-SSLEngine-throws-NPE-parsing-CertificateRequ.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> - 1:1.8.0.392-b08.0
changelog:
  - add 8308682-Enhance-AES-performance.patch
  - add Fix-the-memory-leak-of-MetaspaceAllocationTest.patch
  - add Add-metaspace-memory-allocation-failure-validation.patch
  - add change-value-of-GCLockerRetryAllocationCount-from-2-.patch
  - del 8202952.patch
  - del 8283441-C2-segmentation-fault-in-ciMethodBlocks-make.patch
  - modified Dynamic-CDS-Archive.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified kae-phase1.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch
  - upgrade to jdk8u392-b08


author: kuenking111 <wangkun49@huawei.com> - 1:1.8.0.392-b08.1
changelog:
  - add Fix-crash-in-JNI-s-GetDoubleArrayRegion-and-SetDoubl.patch
  - add  8263557-Possible-NULL-dereference-in-Arena-destruct_.patch
  - add 8294906-Memory-leak-in-PKCS11-NSS-TLS-server.patch
  - add 8314236-Overflow-in-Collections.rotate.patch
  - add 8313626-C2-crash-due-to-unexpected-exception-control.patch
  - add 8312200-Fix-Parse-catch_call_exceptions-memory-leak.patch
  - add 8193682-Infinite-loop-in-ZipOutputStream.close.patch
  - add 8285516-clearPassword-should-be-called-in-a-finally-.patch
  - add 8148470-Metadata-print-routines-should-not-print-to-.patch
  - add 8293344-JDK-8242181-broke-stack-printing-for-non-att.patch
  - add 8278794-Infinite-loop-in-DeflaterOutputStream.finish.patch
  - add 8312065-Socket.connect-does-not-timeout-when-profili.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified add-missing-test-case.patch


author: kuenking111 <wangkun49@huawei.com> - 1:1.8.0.392-b08.2
changelog:
  - remove add-8142508-To-bring-j.u.z.ZipFile-s-native-implemen.patch
  - remove add-8226530-ZipFile-reads-wrong-entry-size-from-ZIP6.patch
  - remove add-8242842-Avoid-reallocating-name-when-checking-fo.patch
  - remove add-8170831-ZipFile-implementation-no-longer-caches-.patch
  - remove add-8146431-j.u.z.ZipFile.getEntry-throws-AIOOBE.patch
  - remove add-8226530-test-case-fixed.patch
  - remove add-Adapting-IOException-of-Zip-to-ZipException.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> - 1:1.8.0.402-b06.0
changelog:
  - modified 0019-8040213-C2-does-not-put-all-modified-nodes-on-IGVN-w.patch
  - modified Improve_AlgorithmConstraints_checkAlgorithm_performance.patch
  - modified add-missing-test-case.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified g1gc-numa-aware-Implementation.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch
  - modified 8203699.patch
  - add Add-CaptchaTest-and-fix-KAE-Testcases.patch
  - add 8177146-MethodHandles.Lookup-bind-allows-illegal-pro.patch
  - add Add-compiling-option-GS-when-building-windows-JDK.patch
  - add Fix-for-JDK-8137099-for-G1-is-to-not-return-null-unt.patch
  - add 8273553-sun.security.ssl.SSLEngineImpl.closeInbound-.patch
  - add 8260923-Add-more-tests-for-SSLSocket-input-output-sh.patch
  - add 8057967-CallSite-dependency-tracking-scales-devastat.patch
  - add 8079205-CallSite-dependency-tracking-is-broken-after.patch


author: Benshuai5D <benshuai5d@163.com> - 1:1.8.0.402-b06.4
changelog:
  - add 8322725-tz-Update-Timezone-Data-to-2023d.patch
  - add 8325150-tz-Update-Timezone-Data-to-2024a.patch
  - add 8220175-serviceability-dcmd-framework-VMVersionTest..patch
  - add 8149343-assert-rp-num_q-no_of_gc_workers-failed-sani.patch
  - add 8139595-MethodHandles-remove_dependent_nmethod-is-no.patch
  - add 8143408-Crash-during-InstanceKlass-unloading-when-cl.patch
  - add GCC-12-reports-some-compiler-warnings.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> -1:1.8.0.412-b08.0
changelog:
  - del 8322725-tz-Update-Timezone-Data-to-2023d.patch
  - del 8325150-tz-Update-Timezone-Data-to-2024a.patch
  - del fix-the-length-value-of-ciBlock-in-ciMethodBlocks.cp.patch
  - modified 8014628-Support-AES-Encryption-with-HMAC-SHA2-for-Ke.patch
  - modified 8057743-process-Synchronize-exiting-of-threads-and-p.patch
  - modified add-missing-test-case.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified kae-phase2.patch
  - modified support-numactl-for-hadoop-yarn.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch


author: kuenking111 <wangkun49@huawei.com> -1:1.8.0.412-b08.3
changelog:
  - add DependencyContext-mark_dependent_nmethods-crash-in-Dynamic-cds-mode.patch
  - add 8138922-StubCodeDesc-constructor-publishes-partially-constructed.patch


author: songliyang <songliyang@kylinos.cn> -1:1.8.0.412-b08.4
changelog:
  - fix LoongArch64-support.patch error that apply patch on loongarch64 in prep stage
  - fix loongson vendor error


author: kuenking111 <wangkun49@huawei.com> -1:1.8.0.422-b05.4
changelog:
  - Add 8137165-Tests-fail-in-SR_Handler-because-thread-is-n.patch
  - Extending-the-IV-Length-Supported-by-KAEProvider-AES.patch


author: songliyang <songliyang@kylinos.cn> -1:1.8.0.422-b05.6
changelog:
  - let support-KAE-zip.patch not install libz.so on loongarch64
  - update LoongArch64 port to 8u422
  - fix changelog date error


author: Autistic_boyya <wangzhongyi7@huawei.com> -1:1.8.0.432-b05.rolling
changelog:
  - modified 8014628-Support-AES-Encryption-with-HMAC-SHA2-for-Ke.patch
  - modified 8193682-Infinite-loop-in-ZipOutputStream.close.patch
  - modified 8313626-C2-crash-due-to-unexpected-exception-control.patch
  - modified Backport-8318889-Backport-Important-Fixed-Issues-in-Later-Ver.patch
  - modified GCC-12-reports-some-compiler-warnings.patch
  - modified add-missing-test-case.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch
  - deleted 8278794-Infinite-loop-in-DeflaterOutputStream.finish.patch


author: kuenking111 <wangkun49@huawei.com> - 1:11.0.16.8-0
changelog:
  - modified 8224675-Late-GC-barrier-insertion-for-ZGC.patch
  - modified ZGC-Redesign-C2-load-barrier-to-expand-on-th.patch
  - modified fast-serializer-jdk11.patch
  - modified dfx-enhancement-of-FastSerializer.patch
  - modified 8210473-JEP-345-NUMA-Aware-Memory-Allocation-for-G1.patch
  - modified src-openeuler-openjdk-11-resolve-code-inconsistencies.patch
  - modified add-missing-inline.patch
  - modified G1-iterate-region-by-bitmap-rather-than-obj-size-in.patch
  - delete fix_X509TrustManagerImpl_symantec_distrust.patch
  - add fix_Internal_and_external_code_inconsistency.patch


author: DXwangg <wangjiawei80@huawei.com> - 1:11.0.17.6-0
changelog:
  - update to 11.0.17+5
  - modified NUMA-Aware-Implementation-humongous-region.patch
  - modified Add-KAE-implementation.patch
  - modified fast-serializer-jdk11.patch


author: DXwangg <wangjiawei80@huawei.com> - 1:11.0.17.8-0
changelog:
  - update to 11.0.17+8(GA)
  - modified G1-iterate-region-by-bitmap-rather-than-obj-size-in.patch
  - modified PS-introduce-UsePSRelaxedForwardee-to-enable-using-r.patch


author: DXwangg <wangjiawei80@huawei.com> - 1:11.0.18.10-0
changelog:
  - update to 11.0.18+10(GA)
  - modified 8231441-2-AArch64-Initial-SVE-backend-support.patch
  - delete 8290705_fix_StringConcat_validate_mem_flow_asserts_with_unexpected_userStoreI.patch


author: wanghao <wanghao564@huawei.com> - 1:11.0.19.7-0
changelog:
  - update to 11.0.19+7(GA)
  - deleted 8225648-TESTBUG-java-lang-annotation-loaderLeak-Main.patch
  - modified Add-KAE-implementation.patch
  - modified G1-iterate-region-by-bitmap-rather-than-obj-size-in.patch
  - modified delete_expired_certificates.patch
  - modified 8205921-Optimizing-best_of_2-work-stealing-queue-selection.patch
  - deleted fix-CVE-2023-21930.patch


author: DXwangg <wangjiawei80@huawei.com> - 1:11.0.21.9-0
changelog:
  - update to 11.0.21+9(GA)
  - modified delete_expired_certificates.patch
  - modified G1-iterate-region-by-bitmap-rather-than-obj-size-in.patch 
  - modified 8210473-JEP-345-NUMA-Aware-Memory-Allocation-for-G1.patch
  - modified 8214527-AArch64-ZGC-for-Aarch64.patch


author: DXwangg <wangjiawei80@huawei.com> - 1:11.0.22.7-0
changelog:
  - update to 11.0.22+7(GA)
  - modified delete_expired_certificates.patch
  - modified G1-iterate-region-by-bitmap-rather-than-obj-size-in.patch


author: huangjie <huangjie150@huawei.com> - 1:11.0.23.9-0
changelog:
  - modified 8224675-Late-GC-barrier-insertion-for-ZGC.patch
  - modified delete_expired_certificates.patch


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.8.7-2
changelog:
  - add add-Parallel-Full-gc-mark-stack-draining-should.patch
  - add add-8271579-G1-Move-copy-before-CAS-in-do_copy.patch
  - add add-8267185-Add-string-deduplication-support-to.patch
  - add add-8292296-Use-multiple-threads-to-process-Par.patch
  - add fix-cds-SignedJar_java-test-fails.patch


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.9.8-0.rolling
changelog:
  - fix 8253495-CDS-generates-non-deterministic-outpu.patch
  - fix add-8267185-Add-string-deduplication-support-to.patch
  - fix add-version-txt.patch


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.9.8-1
changelog:
  - add 8295068-SSLEngine-throws-NPE-parsing-CertificateRequ.patch
  - add 8316576-com.sun.jndi.ldap.Connection.cleanup-does-no.patch
  - add 8314063-The-socket-is-not-closed-in-Connection-creat.patch
  - add 8314236-Overflow-in-Collections.rotate.patch
  - add 8313626-C2-crash-due-to-unexpected-exception-control.patch
  - add 8168469-Memory-leak-in-JceSecurity.patch
  - add 8312065-Socket.connect-does-not-timeout-when-profili.patch
  - add 8285516-clearPassword-should-be-called-in-a-finally-.patch
  - add 8312200-Fix-Parse-catch_call_exceptions-memory-leak.patch


author: neu-mobi <liuyulong.work@qq.com> - 1:17.0.10.9-0.rolling
changelog:
  - del 8168469-Memory-leak-in-JceSecurity.patch
  - del 8275509-ModuleDescriptor.hashCode-isn-t-rep.patch
  - del 8275509-ModuleDescriptor.hashCode-isn-t-reproducible.patch
  - del 8285516-clearPassword-should-be-called-in-a-finally-.patch
  - del 8312065-Socket.connect-does-not-timeout-when-profili.patch
  - del 8313626-C2-crash-due-to-unexpected-exception-control.patch
  - del 8314063-The-socket-is-not-closed-in-Connection-creat.patch
  - del 8316576-com.sun.jndi.ldap.Connection.cleanup-does-no.patch
  - modified 8253495-CDS-generates-non-deterministic-outpu.patch
  - modified 8280872-Reorder-code-cache-segments-to-improv.patch
  - modified add-version-txt.patch
  - add Add-problemlist.patch
  - add puyuan-jdk17.0.9-patch.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> - 1:17.0.11.9-0.rolling
changelog:
  - del 8295068-SSLEngine-throws-NPE-parsing-CertificateRequ.patch
  - modify puyuan-jdk17.0.9-patch.patch


author: songliyang <songliyang@kylinos.cn> - 1:17.0.11.9-1
changelog:
  - rewrite LoongArch64-support.patch to sovle error while applying this patch in prep stage
  - fix loongarch vendor error and delete redundant vendor args


author: songliyang <songliyang@kylinos.cn> - 1:17.0.12.7-1
changelog:
  - update Loongarch support patch to fix the error while applying in prep stage
  - delete redundant symbols while viewing spec file with vim that make it strange on highlight


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.12.7-2
changelog:
  - add Huawei-Extending-the-IV-Length-Supported-by-KAEProvider-AES.patch
  - add Backport-7036144-GZIPInputStream-readTrailer-uses-faulty-avai.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> - 1:17.0.12.7-5
changelog:
  - Add Backport-of-JDK-8305680.patch
  - Add Backport-of-JDK-8305937.patch
  - Add 8338785-The-java.awt.datatransfer.SystemFlavorMap-FL.patch
  - Add 8337982-Remove-dead-undef-assrt0n.patch
  - Add 8337274-Remove-repeated-the-in-StyleSheet.create-Sma.patch
  - Add 8335610-DiagnosticFramework-CmdLine-is_executable-co.patch
  - Add Backport-of-8333088-ubsan-shenandoahAdaptiveHeuristi.patch
  - Add Backport-of-8339351-Remove-duplicate-line-in-FileMap.patch
  - Add Backport-of-8330191-Fix-typo-in-precompiled.hpp.patch
  - Add Backport-of-8337712-Wrong-javadoc-in-java.util.Date-.patch


author: Benshuai5D <zhangyunbo7@huawei.com> - 1:17.0.13.11-0
changelog:
  - modify 8264805-Backport-Ahead-of-Time-Compiler.patch
  - modify 8264806-Backport-Graal-Compiler.patch
  - modify Add-JBooster-Lazy-AOT-module.patch
  - modify Apply-TBI-to-ZGC-of-JDK17.patch
  - modify Backport-Important-Fixed-Issues.patch
  - modify KAE-zip-Features.patch
  - modify add-version-txt.patch
  - add Huawei-Fix-JBooster-file-issue-caused-by-os-write-change.patch
  - update to 17.0.13+11(ga)


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.4.8-0.2
changelog:
  - del pr3183-rh1340845-support_system_crypto_policy.patch
  - del rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
  - del rh1648644-java_access_bridge_privileged_security.patch


author: neu-mobi <liuyulong.work@qq.com> - 1:17.0.5.8-0.1
changelog:
  - add 8253495-CDS-generates-non-deterministic-outpu.patch
  - add 8296480-Fix-the-problem-that-the-TestPolicy.j.patch
  - add 8296485-BuildEEBasicConstraints.java-test-fai.patch
  - add Fast-Serializer.patch
  - add Apply-TBI-barrier-patch-to-C1.patch
  - add Add-Fast-serializer-testcase.patch


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.6.9-0.rolling
changelog:
  - modified add-version-txt.patch
  - del 8290705_fix_StringConcat_validate_mem_flow_asserts_with_unexpected_userStoreI.patch
  - del 8296480-Fix-the-problem-that-the-TestPolicy.j.patch
  - del 8296485-BuildEEBasicConstraints.java-test-fai.patch
  - del Add-Fast-serializer-testcase.patch
  - add jdk17.0.6-ga


author: Autistic_boyya <wangzhongyi7@huawei.com> - 1:17.0.7.7-0.rolling
changelog:
  - add 8275509-ModuleDescriptor.hashCode-isn-t-reproducible.patch
  - modified add-version-txt.patch
  - modified 8253495-CDS-generates-non-deterministic-outpu.patch
  - modified Delete-expired-certificate.patch
  - modified Apply-TBI-to-ZGC-of-JDK17.patch
  - add jdk17.0.7-ga


author: noah <hedongbo@huawei.com> - 1:18.0.0.37-0.0.ea.rolling
changelog:
  - Update to jdk-18.0.0.0+37
  - adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch


author: DXwangg <wangjiawei80@huawei.com> -1:19.0.0.36-0.0.ea.rolling
changelog:
  - Update to jdk-19.0.0.0+36
  - Remove references to sample directory removed by JDK-8284999
  - Need to include the '.S' suffix in debuginfo checks after JDK-8284661


author: kuenking111 <wangkun49@huawei.com> - 1:21.0.0.35-0-rolling
changelog:
  * Mon Aug 07 2023 misaka00251 <liuxin@iscas.ac.cn> - 1:20.0.2.9-1-rolling
  - Add riscv64 to jit_arches


author: yaoxin <yao_xin001@hoperun.com> - 1.5.4-1
changelog:
  - Upgrade to 1.5.4 for fix cves: CVE-2022-40149,CVE-2022-40150,
    CVE-2022-45685,CVE-2022-45693 and CVE-2023-1436


author: fengtao <fengtao40@huawei.com> - 0.15-5
changelog:
  - we got upgrade error when upgrade json-c from very low version,
    for example json-c-0.11-5. because old version has a softlink:
    /usr/include/json-c  --> /usr/include/json
    and now, softlink has been removed. so, we fix this in pretrans


author: mengkanglai <mengkanglai2@huawei.com> - 0.16-2
changelog:
  - add backport-Add-test-to-check-for-the-memory-leak-mentioned-in-issue-781.patch
  - add backport-Fix-memory-leak-with-emtpy-strings-in-json_object_set_string.patch
  - add backport-json_object_from_fd_ex-fail-if-file-is-too-large.patch


author: sunhai <sunhai10@huawei.com> - 0.16-4
changelog:
  - backport patch to Fix build with clang-15+
  - backport patch to Fix json_tokener_parse_ex: handle out of memory errors


author: Li Nan <linan122@huawei.com> - 5.10.0-136.91.0.172
changelog:
  - !11162  btrfs: get rid of warning on transaction commit when using flushoncommit
  - !11152  protect the fetch of ->fd[fd
  - !11096  usb: xhci: Check endpoint is valid before dereferencing it
  - !11093  mISDN: Fix a use after free in hfcmulti_tx()
  - !11146  drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer
  - btrfs: get rid of warning on transaction commit when using flushoncommit
  - !11082  f2fs: fix to don't dirty inode for readonly filesystem
  - !11097  io_uring: lock overflowing for IOPOLL
  - !11124  Fix CVE-2023-52893
  - !11139 v2  drm/amd/display: Check for NULL pointer
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions
  - !11098  exec: Fix ToCToU between perm check and set-uid/gid usage
  - !11029  remoteproc: imx_rproc: Skip over memory region when node value is NULL
  - drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer
  - !11076  wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
  - !11080  ixgbe: fix pci device refcount leak
  - !11002  tipc: Return non-zero value from tipc_udp_addr2str() on error
  - !10986  RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
  - !11137  netfilter: nf_tables: unregister flowtable hooks on netns exit
  - !11116  net/iucv: fix use after free in iucv_sock_close()
  - drm/amd/display: Check for NULL pointer
  - !11053  m68k: Fix spinlock race in kernel thread creation
  - !11052  phonet: fix rtm_phonet_notify() skb allocation
  - !11127  drm/amd/display: Check pipe offset before setting vblank
  - !11120  misc: fastrpc: Don't remove map on creater_process and device_release
  - netfilter: nf_tables: unregister flowtable hooks on netns exit
  - drm/amd/display: Check pipe offset before setting vblank
  - gsmi: fix null-deref in gsmi_get_variable
  - !11090  net/mlx5: Always drain health in shutdown callback
  - misc: fastrpc: Don't remove map on creater_process and device_release
  - net/iucv: fix use after free in iucv_sock_close()
  - exec: Fix ToCToU between perm check and set-uid/gid usage
  - io_uring: lock overflowing for IOPOLL
  - usb: xhci: Check endpoint is valid before dereferencing it
  - mISDN: Fix a use after free in hfcmulti_tx()
  - !11066  xhci: Fix null pointer dereference when host dies
  - net/mlx5: Always drain health in shutdown callback
  - f2fs: fix to don't dirty inode for readonly filesystem
  - ixgbe: fix pci device refcount leak
  - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
  - !11073  drm/virtio: Fix GEM handle creation UAF
  - drm/virtio: Fix GEM handle creation UAF
  - !11046  bpf: Fix a segment issue when downgrading gso_size
  - !11039  PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()
  - xhci: Fix null pointer dereference when host dies
  - !11016 [sync] PR-10965:  perf: Optimize perf_pmu_migrate_context()
  - m68k: Fix spinlock race in kernel thread creation
  - phonet: fix rtm_phonet_notify() skb allocation
  - !11000  media: venus: fix use after free in vdec_close
  - !11024  drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
  - !11014  media: mediatek: vcodec: Handle invalid decoder vsi
  - !10972  ext4: fix infinite loop when replaying fast_commit
  - bpf: Fix a segment issue when downgrading gso_size
  - !11031 [sync] PR-11006:  kvm: s390: Reject memory region operations for ucontrol VMs
  - !10994  ipvs: properly dereference pe in ip_vs_add_service
  - PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()
  - !11032 [sync] PR-10976:  CVE-2024-42126
  - !10967  Revert "kbuild: fix false positive warning/error about missing libelf"
  - powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
  - Revert "powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt."
  - !10989  drm/amd/display: Add NULL pointer check for kzalloc
  - !11020  net: usb: qmi_wwan: fix memory leak for not ip packets
  - kvm: s390: Reject memory region operations for ucontrol VMs
  - !10988  s390/sclp: Fix sclp_init() cleanup on failure
  - remoteproc: imx_rproc: Skip over memory region when node value is NULL
  - !10961  drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
  - !10452 v2  ipv6: sr: fix missing sk_buff release in seg6_input_core
  - drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
  - net: usb: qmi_wwan: fix memory leak for not ip packets
  - !10996  CVE-2024-42290
  - perf: Optimize perf_pmu_migrate_context()
  - media: mediatek: vcodec: Handle invalid decoder vsi
  - tipc: Return non-zero value from tipc_udp_addr2str() on error
  - media: venus: fix use after free in vdec_close
  - irqchip/imx-irqsteer: Handle runtime power management correctly
  - ipvs: properly dereference pe in ip_vs_add_service
  - drm/amd/display: Add NULL pointer check for kzalloc
  - s390/sclp: Fix sclp_init() cleanup on failure
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
  - ext4: fix infinite loop when replaying fast_commit
  - Revert "kbuild: fix false positive warning/error about missing libelf"
  - drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
  - ipv6: sr: fix missing sk_buff release in seg6_input_core


author: Li Nan <linan122@huawei.com> - 5.10.0-136.92.0.173
changelog:
  - !11373  xdp: fix invalid wait context of page_pool_destroy()
  - !11369  nilfs2: handle inconsistent state in nilfs_btnode_create_block()
  - !11362  kcm: Serialise kcm_sendmsg() for the same socket.
  - !11353  regulator: da9211: Use irq handler when ready
  - !11348 v2  ext4: sanity check for NULL pointer after ext4_force_shutdown
  - !11318  efi: fix NULL-deref in init error path
  - !10997  PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
  - !11285  fix CVE-2024-43905
  - !11344  netfilter: ctnetlink: use helper function to calculate expect ID
  - !11332  jbd2: avoid mount failed when commit block is partial submitted
  - !11191  fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
  - !11200  ibmvnic: don't release napi in __ibmvnic_open()
  - !10750 v2  CVE-2024-41016
  - !11195  tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  - !11296  padata: Fix possible divide-by-0 panic in padata_mt_helper()
  - !11289  Add exception protection processing for vd in axi_chan_handle_err function
  - !11312  nvme-fabrics: use reserved tag for reg read/write command
  - !11311  drm/radeon: check bo_va->bo is non-NULL before using it
  - xdp: fix invalid wait context of page_pool_destroy()
  - nilfs2: handle inconsistent state in nilfs_btnode_create_block()
  - kcm: Serialise kcm_sendmsg() for the same socket.
  - regulator: da9211: Use irq handler when ready
  - ext4: sanity check for NULL pointer after ext4_force_shutdown
  - netfilter: ctnetlink: use helper function to calculate expect ID
  - jbd2: avoid mount failed when commit block is partial submitted
  - efi: fix NULL-deref in init error path
  - nvme-fabrics: use reserved tag for reg read/write command
  - drm/radeon: check bo_va->bo is non-NULL before using it
  - !11059  drm/amdgpu: change vm->task_info handling
  - !11056  scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
  - !11281  misc: fastrpc: Fix use-after-free race condition for maps
  - padata: Fix possible divide-by-0 panic in padata_mt_helper()
  - Add exception protection processing for vd in axi_chan_handle_err function
  - !11278  net/sched: act_mpls: Fix warning during failed attribute validation
  - drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
  - !11225  apparmor: Fix null pointer deref when receiving skb during sock creation
  - misc: fastrpc: Fix use-after-free race condition for maps
  - !11274  serial: core: check uartclk for zero to avoid divide by zero
  - !11101  wifi: mac80211: sdata can be NULL during AMPDU start
  - net/sched: act_mpls: Fix warning during failed attribute validation
  - !11213  drm/amdgpu: Fix the null pointer dereference to ras_manager
  - !11268  net: bridge: mcast: wait for previous gc cycles when removing port
  - serial: core: check uartclk for zero to avoid divide by zero
  - net: bridge: mcast: wait for previous gc cycles when removing port
  - !11244 [sync] PR-11210:  jfs: Fix shift-out-of-bounds in dbDiscardAG
  - !11253  CVE-2024-43892
  - !11218  scsi: qla2xxx: validate nvme_local_port correctly
  - !11180  block: initialize integrity buffer to zero before writing it to media
  - !11112  sysctl: always initialize i_uid/i_gid
  - !11166  f2fs: let's avoid panic if extent_tree is not created
  - !11153  fix cve-2023-52896
  - !11165  tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
  - memcg: protect concurrent access to mem_cgroup_idr
  - !11232  Bluetooth: MGMT: Add error handling to pair_device()
  - jfs: Fix shift-out-of-bounds in dbDiscardAG
  - !11172  tracing: Fix overflow in get_free_elt()
  - !11212 [sync] PR-11123:  fix CVE-2024-42288
  - Bluetooth: MGMT: Add error handling to pair_device()
  - apparmor: Fix null pointer deref when receiving skb during sock creation
  - scsi: qla2xxx: validate nvme_local_port correctly
  - !11161  usb: vhci-hcd: Do not drop references before new references are gained
  - drm/amdgpu: Fix the null pointer dereference to ras_manager
  - scsi: qla2xxx: Fix for possible memory corruption
  - !11148  powerpc/pseries: Fix scv instruction crash with kexec
  - !11141  i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
  - ibmvnic: don't release napi in __ibmvnic_open()
  - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  - fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
  - block: initialize integrity buffer to zero before writing it to media
  - tracing: Fix overflow in get_free_elt()
  - f2fs: let's avoid panic if extent_tree is not created
  - tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
  - usb: vhci-hcd: Do not drop references before new references are gained
  - btrfs: fix race between quota rescan and disable leading to NULL pointer deref
  - btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker
  - powerpc/pseries: Fix scv instruction crash with kexec
  - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
  - sysctl: always initialize i_uid/i_gid
  - wifi: mac80211: sdata can be NULL during AMPDU start
  - drm/amdgpu: change vm->task_info handling
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
  - PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
  - ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
  - ocfs2: add bounds checking to ocfs2_xattr_find_entry()


author: Li Nan <linan122@huawei.com> - 5.10.0-136.93.0.174
changelog:
  - !10941 v2  xfs: fix file creation
  - !11492  Fix CVE-2022-48887
  - !11471  net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
  - drm/vmwgfx: Remove rcu locks from user resources
  - drm/vmwgfx: Remove vmw_user_bo_noref_release
  - drm/vmwgfx: Introduce ttm reference object find function
  - net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
  - !11103  soc: qcom: pdr: protect locator_addr with the main mutex
  - !11446  zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
  - !11392  fix CVE-2023-45896
  - !11445 [sync] PR-11015:  nvme-pci: add missing condition check for existence of mapped data
  - !11283  CVE-2024-44935
  - !11451 [sync] PR-11390:  hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
  - !11442 v2  drm/amd/display: Fix null pointer deref in dcn20_resource.c
  - nvme-pci: add missing condition check for existence of mapped data
  - drm/amd/display: Fix null pointer deref in dcn20_resource.c
  - !11396 [sync] PR-11324:  drm/amd/display: Add null checker before passing variables
  - !11416  md/raid5: avoid BUG_ON() while continue reshape after reassembling
  - !11429  nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
  - !11331  dma: fix call order in dmam_free_coherent
  - !11170  CVE-2024-42267
  - !11236  CVE-2024-43907
  - !11410  btrfs: do not start relocation until in progress drops are done
  - nfc: pn533: initialize struct pn533_out_arg properly
  - nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
  - !11412  wifi: cfg80211: Avoid Wdiscarded-qualifiers warning
  - md/raid5: avoid BUG_ON() while continue reshape after reassembling
  - !11407 [sync] PR-11403:  btrfs: do not WARN_ON() if we have PageError set
  - wifi: cfg80211: Avoid Wdiscarded-qualifiers warning
  - btrfs: do not start relocation until in progress drops are done
  - !11399  fuse: Initialize beyond-EOF page contents before setting uptodate
  - btrfs: do not WARN_ON() if we have PageError set
  - !11365  f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
  - !11377  drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
  - !11240 [sync] PR-11174:  md: restore 'noio_flag' for the last mddev_resume()
  - fuse: Initialize beyond-EOF page contents before setting uptodate
  - drm/amd/display: Add null checker before passing variables
  - fs/ntfs3: Add more attributes checks in mi_enum_attr()
  - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
  - f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
  - dma: fix call order in dmam_free_coherent
  - sctp: Fix null-ptr-deref in reuseport_add_sock().
  - sctp: move hlist_node and hashent out of sctp_ep_common
  - md: restore 'noio_flag' for the last mddev_resume()
  - drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules
  - riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
  - soc: qcom: pdr: protect locator_addr with the main mutex
  - xfs: Fix agf_longest update error
  - xfs: Fix file creation failure


author: Li Nan <linan122@huawei.com> - 5.10.0-136.94.0.175
changelog:
  - !11516  fix CVE-2024-44988
  - !11523  ipv6: prevent UAF in ip6_send_skb()
  - !11519  ipv6: fix possible UAF in ip6_finish_output2()
  - !11489 [sync] PR-11487:  bna: ensure the copied buf is NUL terminated
  - !8756  net: USB: Fix wrong-direction WARNING in plusb.c
  - !11533  Fix CVE-2023-52915
  - media: dvb-usb-v2: af9035: fix missing unlock
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
  - !11483  drm/qxl: Add check for drm_cvt_mode
  - !11477  Fix CVE-2023-52916
  - !11458  usb: gadget: core: Check for unset descriptor
  - !11511  x86/mtrr: Check if fixed MTRRs exist before saving them
  - ipv6: prevent UAF in ip6_send_skb()
  - ipv6: fix possible UAF in ip6_finish_output2()
  - net: dsa: mv88e6xxx: Fix out-of-bound access
  - net: dsa: mv88e6xxx: replace ATU violation prints with trace points
  - net: dsa: mv88e6xxx: read FID when handling ATU violations
  - x86/mtrr: Check if fixed MTRRs exist before saving them
  - bna: ensure the copied buf is NUL terminated
  - drm/qxl: Add check for drm_cvt_mode
  - media: aspeed: Fix memory overwrite if timing is 1600x900
  - media: aspeed: Fix no complete irq for non-64-aligned width
  - usb: gadget: core: Check for unset descriptor
  - net: USB: Fix wrong-direction WARNING in plusb.c


author: Li Nan <linan122@huawei.com> - 5.10.0-136.95.0.176
changelog:
  - !11712  btrfs: fix qgroup reserve leaks in cow_file_range
  - !11724  Squashfs: sanity check symbolic link size
  - !11710  btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
  - !11709  CVE-2024-46751
  - !11702  userfaultfd: fix checks for huge PMDs
  - !11699  x86/mm: Fix pti_clone_pgtable() alignment assumption
  - Squashfs: sanity check symbolic link size
  - btrfs: fix qgroup reserve leaks in cow_file_range
  - btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
  - btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()
  - btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info()
  - btrfs: remove superfluous metadata check at btrfs_lookup_extent_info()
  - userfaultfd: fix checks for huge PMDs
  - x86/mm: Fix pti_clone_pgtable() alignment assumption
  - !9776  wifi: ar5523: enable proper endpoint verification
  - !11664  drm/amd/pm: fix the Out-of-bounds read warning
  - !11643  HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
  - !11650  fix CVE-2024-46714
  - drm/amd/pm: fix the Out-of-bounds read warning
  - !11634  fix CVE-2024-46723
  - !11647  net: hns3: fix a deadlock problem when config TC during resetting
  - !11536  usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
  - !11627 [sync] PR-11615:  mmc: mmc_test: Fix NULL dereference on allocation failure
  - !11576 [sync] PR-11012:  hfsplus: fix uninit-value in copy_name
  - !11589  drm/amd/display: Skip finding free audio for unknown engine_id
  - !11587  jfs: don't walk off the end of ealist
  - !11580  kobject_uevent: Fix OOB access within zap_modalias_env()
  - !11636  netfilter: tproxy: bail out if IP has been disabled on the device
  - drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
  - net: hns3: fix a deadlock problem when config TC during resetting
  - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
  - netfilter: tproxy: bail out if IP has been disabled on the device
  - !11611  Input: uinput - reject requests with unreasonable number of slots
  - !10937  f2fs: avoid format-overflow warning
  - drm/amdgpu: fix ucode
  - !11591 [sync] PR-8827: v2  iomap: fix sub-page not set dirty state
  - mmc: mmc_test: Fix NULL dereference on allocation failure
  - !11597 v2  mptcp: pm: avoid possible UaF when selecting endp
  - !11605  Fix iBMA bug and change version
  - !11601 [sync] PR-11583:  nfs: always check dreq->error after a commit
  - Input: uinput - reject requests with unreasonable number of slots
  - !11590  CVE-2024-36915
  - !10934  drm/amd/display: Check index msg_id before read or write
  - !10935  ata: libata-core: Fix null pointer dereference on error
  - !11599 [sync] PR-11584:  vfs: Don't evict inode under the inode lru traversing context
  - BMA: Fix edma driver initialization problem and change the version number.
  - !11595  gtp: pull network headers in gtp_dev_xmit()
  - nfs: always check dreq->error after a commit
  - vfs: Don't evict inode under the inode lru traversing context
  - mptcp: pm: avoid possible UaF when selecting endp
  - gtp: pull network headers in gtp_dev_xmit()
  - iomap: Ensure sub-page dirty state is set during mmap writes
  - Revert "iomap: Don't create iomap_page objects in iomap_page_mkwrite_actor"
  - nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
  - net: add copy_safe_from_sockptr() helper
  - drm/amd/display: Skip finding free audio for unknown engine_id
  - !11575  nilfs2: add missing check for inode numbers on directory entries
  - jfs: don't walk off the end of ealist
  - !11572  nilfs2: fix general protection fault in nilfs_btree_insert()
  - kobject_uevent: Fix OOB access within zap_modalias_env()
  - hfsplus: fix uninit-value in copy_name
  - nilfs2: add missing check for inode numbers on directory entries
  - !11571  NFSD: Fix ia_size underflow
  - nilfs2: fix general protection fault in nilfs_btree_insert()
  - NFSD: Fix ia_size underflow
  - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
  - f2fs: avoid format-overflow warning
  - ata: libata-core: Fix null pointer dereference on error
  - drm/amd/display: Check index msg_id before read or write
  - wifi: ar5523: enable proper endpoint verification


author: Li Nan <linan122@huawei.com> - 5.10.0-136.96.0.177
changelog:
  - !12070 [sync] PR-12050:  um: line: always fill *error_out in setup_one_line()
  - !11965  drm/amd/pm: Fix negative array index read
  - !12060  CVE-2024-46857
  - !12047  perf/x86/intel: Limit the period on Haswell
  - um: line: always fill *error_out in setup_one_line()
  - !12041 [sync] PR-12032:  serial: sc16is7xx: fix invalid FIFO access with special register set
  - !12042 [sync] PR-12002:  drm/amd/display: Assign linear_pitch_alignment even for VM
  - !12021  drm/amd/display: Check gpio_id before used as array index
  - !12025  ASoC: meson: axg-card: fix 'use-after-free'
  - !11991 [sync] PR-11941:  usb: typec: ucsi: Fix null pointer dereference in trace
  - !11990 [sync] PR-11939:  of/irq: Prevent device address out-of-bounds read in interrupt map walk
  - !12035  ksmbd: discard write access to the directory open
  - !12037  drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
  - net/mlx5: Fix bridge mode operations when there are no VFs
  - net/mlx5: E-switch, Introduce flag to indicate if fdb table is created
  - !11996  drm/amd/display: Add array index check for hdcp ddc access
  - !12010  rtmutex: Drop rt_mutex::wait_lock before scheduling
  - perf/x86/intel: Limit the period on Haswell
  - drm/amd/display: Assign linear_pitch_alignment even for VM
  - serial: sc16is7xx: fix invalid FIFO access with special register set
  - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
  - ksmbd: discard write access to the directory open
  - ASoC: meson: axg-card: fix 'use-after-free'
  - !11872 [sync] PR-11817:  uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  - drm/amd/display: Check gpio_id before used as array index
  - !12001  nvmet-tcp: fix kernel crash if commands allocation fails
  - rtmutex: Drop rt_mutex::wait_lock before scheduling
  - !11911  ksmbd: unset the binding mark of a reused connection
  - !11988 [sync] PR-11938:  KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
  - nvmet-tcp: fix kernel crash if commands allocation fails
  - drm/amd/display: Add array index check for hdcp ddc access
  - !11934 [sync] PR-11925:  nilfs2: protect references to superblock parameters exposed in sysfs
  - !11978  CVE-2024-46814
  - !11932 [sync] PR-11875:  btrfs: handle errors from btrfs_dec_ref() properly
  - usb: typec: ucsi: Fix null pointer dereference in trace
  - of/irq: Prevent device address out-of-bounds read in interrupt map walk
  - KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
  - drm/amd/display: Check msg_id before processing transcation
  - drm/amd/pm: Fix negative array index read
  - !11955  Fix CVE-2024-44958 5.10
  - !11743 [sync] PR-11693:  Fix CVE-2024-39501
  - !11947  btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
  - sched/smt: Fix unbalance sched_smt_present dec/inc
  - sched/smt: Introduce sched_smt_present_inc/dec() helper
  - !11917  ethtool: check device is present when getting link settings
  - !11937  btrfs: remove NULL transaction support for btrfs_lookup_extent_info()
  - !11923  hwmon: (lm95234) Fix underflows seen when writing limit attributes
  - btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
  - btrfs: remove NULL transaction support for btrfs_lookup_extent_info()
  - nilfs2: protect references to superblock parameters exposed in sysfs
  - btrfs: handle errors from btrfs_dec_ref() properly
  - !11841  fix CVE-2024-46771
  - !11913 [sync] PR-11890:  hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
  - hwmon: (lm95234) Fix underflows seen when writing limit attributes
  - ethtool: check device is present when getting link settings
  - !11793  ALSA: line6: Fix racy access to midibuf
  - !11868  pktgen: use cpus_read_lock() in pg_net_init()
  - !11892 [sync] PR-11866: v2  drm/amd/display: Ensure index calculation will not overflow
  - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
  - ksmbd: unset the binding mark of a reused connection
  - !11869  VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  - !11904  scsi: aacraid: Fix double-free on probe failure
  - scsi: aacraid: Fix double-free on probe failure
  - !11886  pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  - !11873 [sync] PR-11494:  ext4: Fix race in buffer_head read fault injection
  - !11880  PCI: Add missing bridge lock to pci_bus_lock()
  - !11879  usb: dwc3: st: fix probed platform device ref count on probe error path
  - !11739 [sync] PR-11625:  smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
  - !11851  usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
  - !11849  bcache: fix variable length array abuse in btree_iter
  - !11833  scsi: bfa: Ensure the copied buf is NUL terminated
  - !11832  enic: Validate length of nl attributes in enic_set_vf_port
  - !11831  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  - !11830  ALSA: usb-audio: Stop parsing channels bits when all channels are found.
  - drm/amd/display: Ensure index calculation will not overflow
  - !11827  CVE-2024-46781
  - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  - !11829 v2  drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
  - PCI: Add missing bridge lock to pci_bus_lock()
  - usb: dwc3: st: fix probed platform device ref count on probe error path
  - !11858 v2  Fix CVE-2024-45025
  - !11768 [sync] PR-11733:  Input: MT - limit max slots
  - !11846  bpf: verifier: prevent userspace memory access
  - ext4: Fix race in buffer_head read fault injection
  - !11750  ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
  - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  - !11853 [sync] PR-11815:  selinux,smack: don't bypass permissions check in inode_setsecctx hook
  - VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  - pktgen: use cpus_read_lock() in pg_net_init()
  - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
  - s390/cio: rename bitmap_size() -> idset_bitmap_size()
  - bitmap: introduce generic optimized bitmap_size()
  - fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64()
  - tools: move alignment-related macros to new <linux/align.h>
  - !11676  wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
  - !11674  netem: fix return value if duplicate enqueue fails
  - !11808  apparmor: fix possible NULL pointer dereference
  - !11807  drm/amdgpu: Fix out-of-bounds write warning
  - !11735  fix CVE-2024-46777 for SP1
  - !11684  binder: fix UAF caused by offsets overwrite
  - !11778 [sync] PR-11729:  scsi: qedi: Fix crash while reading debugfs attribute
  - !11779 [sync] PR-11730:  media: xc2028: avoid use-after-free in load_firmware_cb()
  - !11782 [sync] PR-11728:  lib: objagg: Fix general protection fault
  - !11781 [sync] PR-11727:  jfs: fix null ptr deref in dtInsertEntry
  - !11780 [sync] PR-11726:  drm/vmwgfx: Fix a deadlock in dma buf fence polling
  - selinux,smack: don't bypass permissions check in inode_setsecctx hook
  - !11776 [sync] PR-11738:  hwmon: (adc128d818) Fix underflows seen when writing limit attributes
  - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
  - bcache: fix variable length array abuse in btree_iter
  - bpf: verifier: prevent userspace memory access
  - can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
  - can: bcm: Remove proc entry when dev is unregistered.
  - scsi: bfa: Ensure the copied buf is NUL terminated
  - enic: Validate length of nl attributes in enic_set_vf_port
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  - ALSA: usb-audio: Stop parsing channels bits when all channels are found.
  - drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
  - nilfs2: fix missing cleanup on rollforward recovery error
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
  - !11745  powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
  - !11775 [sync] PR-11752:  driver: iio: add missing checks on iio_info's callback access
  - !11800  can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
  - apparmor: fix possible NULL pointer dereference
  - drm/amdgpu: Fix out-of-bounds write warning
  - !11762  sch/netem: fix use after free in netem_dequeue
  - can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
  - ALSA: line6: Fix racy access to midibuf
  - lib: objagg: Fix general protection fault
  - jfs: fix null ptr deref in dtInsertEntry
  - drm/vmwgfx: Fix a deadlock in dma buf fence polling
  - media: xc2028: avoid use-after-free in load_firmware_cb()
  - scsi: qedi: Fix crash while reading debugfs attribute
  - hwmon: (adc128d818) Fix underflows seen when writing limit attributes
  - driver: iio: add missing checks on iio_info's callback access
  - Input: MT - limit max slots
  - sch/netem: fix use after free in netem_dequeue
  - ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
  - powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
  - driver core: Fix uevent_show() vs driver detach race
  - selftests: forwarding: devlink_lib: Wait for udev events after reloading
  - drivers: core: synchronize really_probe() and dev_uevent()
  - smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
  - udf: Avoid excessive partition lengths
  - udf: Define EFSCORRUPTED error code
  - binder: fix UAF caused by offsets overwrite
  - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
  - netem: fix return value if duplicate enqueue fails


author: Li Nan <linan122@huawei.com> - 5.10.0-136.97.0.178
changelog:
  - !12117  CVE-2024-43855
  - !12167  crypto: stm32/cryp - call finalize with bh disabled
  - !12203  spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware
  - !12206 v2  atm: idt77252: prevent use after free in dequeue_rx()
  - !12143  nfc: pn533: Add poll mod list filling check
  - !12150  wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  - atm: idt77252: prevent use after free in dequeue_rx()
  - !12173  fou: remove warn in gue_gro_receive on unsupported protocol
  - !12169  xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
  - spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware
  - !12165  bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
  - fou: remove warn in gue_gro_receive on unsupported protocol
  - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
  - crypto: stm32/cryp - call finalize with bh disabled
  - bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
  - !12120  sched: sch_cake: fix bulk flow accounting logic for host fairness
  - !12119  ice: Add netif_device_attach/detach into PF reset flow
  - !12118  bpf: Remove tst_run from lwt_seg6local_prog_ops.
  - wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  - nfc: pn533: Add poll mod list filling check
  - !12085 [sync] PR-11856:  acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - !12046  s390/dasd: fix error recovery leading to data corruption on ESE devices
  - !12044  s390/sclp: Prevent release of buffer in I/O
  - sched: sch_cake: fix bulk flow accounting logic for host fairness
  - ice: Add netif_device_attach/detach into PF reset flow
  - bpf: Remove tst_run from lwt_seg6local_prog_ops.
  - md: ensure child flush IO does not affect origin bio->bi_status
  - md: Remove flush handling
  - md: fix a crash in mempool_free
  - !12097  netfilter: nft_socket: fix sk refcount leaks
  - !12099  CVE-2024-46858
  - !12098  net: dpaa: Pad packets to ETH_ZLEN
  - !12091  USB: usbtmc: prevent kernel-usb-infoleak
  - mptcp: pm: Fix uaf in __timer_delete_sync
  - mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer
  - mptcp: export lookup_anno_list_by_saddr
  - net: dpaa: Pad packets to ETH_ZLEN
  - netfilter: nft_socket: fix sk refcount leaks
  - USB: usbtmc: prevent kernel-usb-infoleak
  - acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - !12083  drm/i915/gt: Cleanup partial engine discovery failures
  - !12079  btrfs: clean up our handling of refs == 0 in snapshot delete
  - !12054  drm/amdgpu: the warning dereferencing obj for nbio_v7_4
  - drm/i915/gt: Cleanup partial engine discovery failures
  - btrfs: clean up our handling of refs == 0 in snapshot delete
  - drm/amdgpu: the warning dereferencing obj for nbio_v7_4
  - s390/dasd: fix error recovery leading to data corruption on ESE devices
  - s390/sclp: Prevent release of buffer in I/O


author: Li Nan <linan122@huawei.com> - 5.10.0-136.98.0.179
changelog:
  - !12297  CVE-2024-46822
  - !12242 [sync] PR-12227:  nbd: Fix signal handling
  - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
  - arm64: acpi: Move get_cpu_for_acpi_id() to a header
  - !12260  drm/lima: fix a memleak in lima_heap_alloc
  - !12258  media: go7007: fix a memleak in go7007_load_encoder
  - !12259  octeontx2-af: Use separate handlers for interrupts
  - !12256 [sync] PR-12254:  greybus: Fix use-after-free bug in gb_interface_release due to race condition.
  - !12265  drm/amd/display: Avoid overflow from uint32_t to uint8_t
  - drm/amd/display: Avoid overflow from uint32_t to uint8_t
  - !12243 v2  net/mlx5e: Fix netif state handling
  - drm/lima: fix a memleak in lima_heap_alloc
  - octeontx2-af: Use separate handlers for interrupts
  - media: go7007: fix a memleak in go7007_load_encoder
  - greybus: Fix use-after-free bug in gb_interface_release due to race condition.
  - !12221 [sync] PR-12102:  Fix CVE-2024-46826
  - !12156  bonding: Fix CVE-2024-44990
  - !12158  bonding: fix xfrm real_dev null pointer dereference
  - !12157  netfilter: flowtable: initialise extack before use
  - !11298  gpio: prevent potential speculation leaks in gpio_device_get_desc()
  - !8675 [sync] PR-8534:  riscv: process: Fix kernel gp leakage
  - !8674 [sync] PR-8542:  octeontx2-af: Fix possible null pointer dereference.
  - !12161  md/raid1: don't free conf on raid0_run failure
  - !12237  dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
  - !12235  drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
  - net/mlx5e: Fix netif state handling
  - !12184  mlxsw: spectrum_acl_erp: Fix object nesting warning
  - !12183  netns: Make get_net_ns() handle zero refcount net
  - !12180  net/sched: Fix CVE-2024-36244
  - !12177  ipv6: sr: fix invalid unregister error path
  - !12191  wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  - !12192  netfilter: nft_flow_offload: reset dst in route object after setting up flow
  - !12193  tcp: do not accept ACK of bytes we never sent
  - !12194  mlxsw: spectrum_acl_tcam: Fix warning during rehash
  - !12195  i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  - !12196  net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
  - !12211  scsi: qla2xxx: During vport delete send async logout explicitly
  - !12210  platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - nbd: Fix signal handling
  - nbd: Improve the documentation of the locking assumptions
  - !12231 [sync] PR-12208:  Some bugfixs for ubi/fs
  - dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
  - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
  - locks: fix TOCTOU race when granting write lease
  - ubi: block: fix null-pointer-dereference in ubiblock_create()
  - ubi: block: Remove in vain semicolon
  - !12224 [sync] PR-11910:  ext4: dax: Fix inconsistent isize during writing
  - ext4: dax: keep orphan list before truncate overflow allocated blocks
  - ext4: dax: fix overflowing extents beyond inode size when partially writing
  - !12064 [sync] PR-11942:  sbitmap: backport bugfix patches
  - ELF: Fix mixed declarations and code of "snapshot_randomize_va_space"
  - ELF: fix kernel.randomize_va_space double read
  - scsi: qla2xxx: During vport delete send async logout explicitly
  - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
  - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  - mlxsw: spectrum_acl_tcam: Fix warning during rehash
  - tcp: do not accept ACK of bytes we never sent
  - netfilter: nft_flow_offload: reset dst in route object after setting up flow
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  - mlxsw: spectrum_acl_erp: Fix object nesting warning
  - netns: Make get_net_ns() handle zero refcount net
  - net/sched: taprio: extend minimum interval restriction to entire cycle too
  - net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX.
  - ipv6: sr: fix invalid unregister error path
  - md/raid1: don't free conf on raid0_run failure
  - bonding: fix xfrm real_dev null pointer dereference
  - netfilter: flowtable: initialise extack before use
  - bonding: fix null pointer deref in bond_ipsec_offload_ok
  - bonding: fix bond_ipsec_offload_ok return type
  - blk-mq: Fix potential io hung for shared sbitmap per tagset
  - blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
  - sbitmap: fix lockup while swapping
  - sbitmap: Avoid leaving waitqueue in invalid state in __sbq_wake_up()
  - sbitmap: fix possible io hung due to lost wakeup
  - block: Fix lockdep warning in blk_mq_mark_tag_wait
  - blk-mq: fix potential io hang by wrong 'wake_batch'
  - sbitmap: correct wake_batch recalculation to avoid potential IO hung
  - blk-mq: Fix wrong wakeup batch configuration which will cause hang
  - blk-mq: fix tag_get wait task can't be awakened
  - gpio: prevent potential speculation leaks in gpio_device_get_desc()
  - riscv: process: Fix kernel gp leakage
  - octeontx2-af: Fix possible null pointer dereference.


author: Li Nan <linan122@huawei.com> - 5.10.0-136.99.0.180
changelog:
  - !12652  mm/gup: fix gup_pud_range() for dax
  - !12671  drm/amd/display: Fix index out of bounds in degamma hardware format translation
  - !12247  nilfs2: fix state management in error path of log writing function
  - !12647  sock_map: Add a cond_resched() in sock_hash_free()
  - !12646  tcp: check skb is non-NULL in tcp_rto_delta_us()
  - !12645  RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
  - !12644  net: do not delay dst_entries_add() in dst_release()
  - !12630 [sync] PR-12605:  fix CVE-2024-46802
  - !12657  NFSD: Limit the number of concurrent async COPY operations
  - !12636  ALSA: asihpi: Fix potential OOB array access
  - drm/amd/display: Fix index out of bounds in degamma hardware format translation
  - !12274  blk-mq: fix blk_mq_hw_ctx active request accounting
  - !12613  drm/amd/display: Check null pointer before dereferencing se
  - !12622  NFC: nci: Bounds check struct nfc_target arrays
  - !12619  PCI: mt7621: Add sentinel to quirks table
  - !12504  ocfs2: cancel dqi_sync_work before freeing oinfo
  - NFSD: Limit the number of concurrent async COPY operations
  - mm/gup: fix gup_pud_range() for dax
  - !12625  net: ethernet: nixge: fix NULL dereference
  - !12626  libbpf: Handle size overflow for ringbuf mmap
  - sock_map: Add a cond_resched() in sock_hash_free()
  - tcp: check skb is non-NULL in tcp_rto_delta_us()
  - RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
  - net: do not delay dst_entries_add() in dst_release()
  - !12624  hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
  - ALSA: asihpi: Fix potential OOB array access
  - drm/amd/display: fix mixed declarations warning
  - drm/amd/display: added NULL check at start of dc_validate_stream
  - libbpf: Handle size overflow for ringbuf mmap
  - net: ethernet: nixge: fix NULL dereference
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
  - NFC: nci: Bounds check struct nfc_target arrays
  - PCI: mt7621: Add sentinel to quirks table
  - !12602 [sync] PR-12459:  drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
  - !12601 [sync] PR-12453:  drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
  - !12600 [sync] PR-12442:  drm/amd/display: Fix index out of bounds in DCN30 color transformation
  - !12446  nilfs2: fix potential oob read in nilfs_btree_check_delete()
  - !8926  ext4: avoid deadlock in fs reclaim with page writeback
  - drm/amd/display: Check null pointer before dereferencing se
  - !12582  drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
  - !12578  gpio: amd8111: Fix PCI device reference count leak
  - !12456  nfsd: map the EBADMSG to nfserr_io to avoid warning
  - !12564  ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
  - !12561  fix CVE-2024-49900
  - !12562  fix CVE-2024-47667
  - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
  - drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
  - drm/amd/display: Fix index out of bounds in DCN30 color transformation
  - !12450  Fix CVE-2024-26917 and CVE-2024-50025
  - !12544 [sync] PR-12369:  x86/ioapic: Handle allocation failures gracefully
  - drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
  - !12401  drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
  - gpio: amd8111: Fix PCI device reference count leak
  - !12416  btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
  - !12420  nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
  - !12421  udf: Fix preallocation discarding at indirect extent boundary
  - !12419  jfs: Fix uaf in dbFreeBits
  - !12418  jfs: check if leafidx greater than num leaves per dmap tree
  - !12415  btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
  - !12417  btrfs: wait for fixup workers before stopping cleaner kthread during umount
  - !12522  netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
  - !12543  media: pci: cx23885: check cx23885_vdev_init() return
  - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
  - PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
  - PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
  - jfs: Fix uninit-value access of new_ea in ea_buffer
  - x86/ioapic: Handle allocation failures gracefully
  - media: pci: cx23885: check cx23885_vdev_init() return
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
  - !12251  KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
  - !12514  devres: Fix memory leakage caused by driver API devm_free_percpu()
  - !12513  jfs: Fix array-index-out-of-bounds in diFree
  - !12468  mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
  - !12388  spi: nxp-fspi: fix the KASAN report out-of-bounds bug
  - !12386  drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
  - !12381  fix CVE-2024-46675
  - !12364  hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
  - !12447  iommu/vt-d: Fix double list_add when enabling VMD in scalable mode
  - !12463  fix CVE-2024-42301
  - !12489  CVE-2024-40965_openEuler-22.03-LTS-SP1
  - !12481  CVE-2024-41015
  - !12485  CVE-2024-38667
  - !12483  CVE-2024-36286
  - devres: Fix memory leakage caused by driver API devm_free_percpu()
  - !12457  soundwire: cadence: fix invalid PDI offset
  - jfs: Fix array-index-out-of-bounds in diFree
  - ocfs2: cancel dqi_sync_work before freeing oinfo
  - !12430  CVE-2024-43894
  - i2c: lpi2c: Avoid calling clk_get_rate during transfer
  - i2c: imx-lpi2c: return -EINVAL when i2c peripheral clk doesn't work
  - i2c: imx-lpi2c: use bulk clk API
  - clk: Provide !COMMON_CLK dummy for devm_clk_rate_exclusive_get()
  - clk: Add a devm variant of clk_rate_exclusive_get()
  - riscv: prevent pt_regs corruption for secondary idle threads
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
  - ocfs2: add bounds checking to ocfs2_check_dir_entry()
  - !12392  mm/swapfile: skip HugeTLB pages for unuse_vma
  - !12433 v2  Fix CVE-2022-49006
  - !12356 [sync] PR-12334:  drm/nouveau: prime: fix refcount underflow
  - !12359 [sync] PR-12342:  nvmet: fix a possible leak when destroy a ctrl during qp establishment
  - !12371 [sync] PR-12344:  of: module: prevent NULL pointer dereference in vsnprintf()
  - !12352  i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
  - !12222 [sync] PR-12075:  blk-mq: fix lockdep hardirq warning in __blk_mq_tag_idle()
  - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
  - parport: Proper fix for array out-of-bounds access
  - dev/parport: fix the array out-of-bounds risk
  - !12357 [sync] PR-12318:  nfsd: call cache_put if xdr_reserve_space returns NULL
  - soundwire: cadence: fix invalid PDI offset
  - nfsd: map the EBADMSG to nfserr_io to avoid warning
  - scsi: fnic: Move flush_work initialization out of if block
  - scsi: fnic: Move fnic_fnic_flush_tx() to a work queue
  - iommu/vt-d: Fix double list_add when enabling VMD in scalable mode
  - nilfs2: fix potential oob read in nilfs_btree_check_delete()
  - !12271  drm/amdgpu: fix mc_data out-of-bounds read warning
  - tracing: Free buffers when a used dynamic event is removed
  - tracing: Add tracing_reset_all_online_cpus_unlocked() function
  - !12396  tracing/timerlat: Fix a race during cpuhp processing
  - !12405  CVE-2024-43841
  - drm/client: fix null pointer dereference in drm_client_modeset_probe
  - udf: Fix preallocation discarding at indirect extent boundary
  - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
  - jfs: Fix uaf in dbFreeBits
  - jfs: check if leafidx greater than num leaves per dmap tree
  - btrfs: wait for fixup workers before stopping cleaner kthread during umount
  - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
  - btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
  - wifi: virt_wifi: don't use strlen() in const context
  - wifi: virt_wifi: avoid reporting connection success with wrong SSID
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
  - tracing/timerlat: Fix a race during cpuhp processing
  - mm/swapfile: skip HugeTLB pages for unuse_vma
  - spi: nxp-fspi: fix the KASAN report out-of-bounds bug
  - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
  - usb: dwc3: core: Prevent USB core invalid event buffer address access
  - usb: dwc3: core: Skip setting event buffers for host only controllers
  - of: module: prevent NULL pointer dereference in vsnprintf()
  - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment
  - nfsd: call cache_put if xdr_reserve_space returns NULL
  - !12339  CVE-2023-52855
  - drm/nouveau: prime: fix refcount underflow
  - !12346  CVE-2024-35990
  - i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
  - !12337  ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
  - !12303  soc: qcom: cmd-db: Map shared memory as WC, not WB
  - !12302  media: imon: fix access to invalid resource for the second interface
  - dma: xilinx_dpdma: Fix locking
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
  - ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
  - soc: qcom: cmd-db: Map shared memory as WC, not WB
  - media: imon: fix access to invalid resource for the second interface
  - blk-mq: fix blk_mq_hw_ctx active request accounting
  - drm/amdgpu: fix mc_data out-of-bounds read warning
  - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
  - nilfs2: fix state management in error path of log writing function
  - blk-mq: fix lockdep hardirq warning in __blk_mq_tag_idle()
  - ext4: avoid deadlock in fs reclaim with page writeback


author: Li Nan <linan122@huawei.com> - 5.10.0-136.100.0.181
changelog:
  - !13008  CVE-2024-49950
  - !13050  ext4: fix CVE-2024-47701
  - !13045 [sync] PR-12958:  ext4: update orig_path in ext4_find_extent()
  - !12681  smb: client: fix UAF in async decryption
  - !12990  vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
  - !12995  drm/amd/display: Check BIOS images before it is used
  - !13020  l2tp: prevent possible tunnel refcount underflow
  - !13021  wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
  - !12985 [sync] PR-12781:  uprobes: fix kernel info leak via "[uprobes
  - !13038  drm/shmem-helper: Remove errant put in error path
  - !13037  Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
  - !13036  iio: health: afe4403: Fix oob read in afe4403_read_raw
  - !13035  efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
  - ext4: avoid OOB when system.data xattr changes underneath the filesystem
  - ext4: explicitly exit when ext4_find_inline_entry returns an error
  - ext4: return error on ext4_find_inline_entry
  - ext4: ext4_search_dir should return a proper error
  - ext4: fix RENAME_WHITEOUT handling for inline directories
  - !12902  ext4: fix double brelse() the buffer of the extents path
  - !12898  ext4: aovid use-after-free in ext4_ext_insert_extent()
  - ext4: update orig_path in ext4_find_extent()
  - drm/shmem-helper: Remove errant put in error path
  - !12989  CVE-2022-48966
  - Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
  - iio: health: afe4403: Fix oob read in afe4403_read_raw
  - efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
  - l2tp: prevent possible tunnel refcount underflow
  - !12885  CVE-2024-50016
  - !12836  ASoC: ops: Fix bounds check for _sx controls
  - !12999  f2fs: get rid of online repaire on corrupted directory
  - !12802  ext4: fix slab-use-after-free in ext4_split_extent_at()
  - !12910  fsnotify: fix CVE-2024-47660
  - !12907  io_uring: fix CVE-2024-50060
  - !12880  drm/stm: Avoid use-after-free issues with crtc and plane
  - !12917  tipc: re-fetch skb cb after tipc_msg_validate
  - !12914  CVE-2022-48961
  - !12912  ethernet: aeroflex: fix potential skb leak in greth_init_rings()
  - Bluetooth: L2CAP: Fix uaf in l2cap_connect
  - Bluetooth: Return whether a connection is outbound
  - !12945  fix CVE-2024-47723
  - !12951  drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
  - !12955  memcg_write_event_control(): fix a user-triggerable oops
  - !12823  f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
  - !12549  fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
  - !12872  Fix CVE-2024-47703
  - !12894  ext4: avoid use-after-free in ext4_ext_show_leaf()
  - f2fs: get rid of online repaire on corrupted directory
  - !12936  ASoC: soc-pcm: Add NULL check in BE reparenting
  - !12935  gpiolib: fix memory leak in gpiochip_setup_dev()
  - !12956  wifi: cfg80211: fix buffer overflow in elem comparison
  - drm/amd/display: Check BIOS images before it is used
  - vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
  - net: mvneta: Fix an out of bounds check
  - net: mvneta: Prevent out of bounds read in mvneta_config_rss()
  - !12864  CVE-2022-49020
  - !12833  lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
  - !12876  tipc: guard against string buffer overrun
  - !12839  ocfs2: reserve space for inline xattr before attaching reflink tree
  - !12921  ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
  - !12889  drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
  - uprobes: fix kernel info leak via "[uprobes]" vma
  - wifi: cfg80211: fix buffer overflow in elem comparison
  - memcg_write_event_control(): fix a user-triggerable oops
  - !12845  ACPI: sysfs: validate return type of _STR method
  - drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
  - jfs: Fix sanity check in dbMount
  - jfs: fix out-of-bounds in dbNextAG() and diAlloc()
  - !12931  tcp: fix mptcp DSS corruption due to large pmtu xmit
  - !12929  gso: fix udp gso fraglist segmentation after pull from frag_list
  - !12930  RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
  - ASoC: soc-pcm: Add NULL check in BE reparenting
  - gpiolib: fix memory leak in gpiochip_setup_dev()
  - tcp: fix mptcp DSS corruption due to large pmtu xmit
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
  - gso: fix udp gso fraglist segmentation after pull from frag_list
  - !12788  slip: make slhc_remember() more robust against malicious packets
  - !12789  net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
  - !12787  net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
  - !12786  mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  - !12740  r8169: add tally counter fields added with RTL8125
  - !12744  net/xen-netback: prevent UAF in xenvif_flush_hash()
  - !12408  padata: use integer wrap around to prevent deadlock on seq_nr overflow
  - !12379  nfsd: return -EINVAL when namelen is 0
  - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
  - tipc: re-fetch skb cb after tipc_msg_validate
  - net: mdio: fix unbalanced fwnode reference count in mdio_device_release()
  - net: mdio: use device_set_node() to setup both fwnode and of
  - driver core: add a helper to setup both the of_node and fwnode of a device
  - ethernet: aeroflex: fix potential skb leak in greth_init_rings()
  - fsnotify: clear PARENT_WATCHED flags lazily
  - fsnotify: remove unused declaration
  - fsnotify: Fix comment typo
  - io_uring: check if we need to reschedule during overflow flush
  - io_uring: always lock __io_cqring_overflow_flush
  - ext4: fix double brelse() the buffer of the extents path
  - ext4: aovid use-after-free in ext4_ext_insert_extent()
  - ext4: avoid use-after-free in ext4_ext_show_leaf()
  - drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
  - drm/amd/display: Avoid overflow assignment in link_dp_cts
  - drm/stm: Avoid use-after-free issues with crtc and plane
  - tipc: guard against string buffer overrun
  - bpf, lsm: Add check for BPF LSM return value
  - bpf, lsm: Add disabled BPF LSM hook list
  - net/9p: Fix a potential socket leak in p9_socket_open
  - !12811  serial: protect uart_port_dtr_rts() in uart_shutdown() too
  - !12819  iio: health: afe4404: Fix oob read in afe4404_[read|write
  - !12828  drm/amd/display: Check null pointers before using them
  - !12797  uprobe: avoid out-of-bounds memory access of fetching args
  - ACPI: sysfs: validate return type of _STR method
  - ocfs2: reserve space for inline xattr before attaching reflink tree
  - !12692 [sync] PR-12354: Backport important bugfix from the kernel-5.10.y
  - ASoC: ops: Fix bounds check for _sx controls
  - !12796  platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
  - !12765  thermal: core: Reference count the zone in thermal_zone_get_by_id()
  - !12660  nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
  - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
  - !12763  CVE-2024-50063
  - !12487  gtp: fix a potential NULL pointer dereference
  - !12761  smack: tcp: ipv4, fix incorrect labeling
  - !12779  riscv: Sync efi page table's kernel mappings before switching
  - drm/amd/display: Check null pointers before using them
  - f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
  - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
  - !12687 [sync] PR-12672:  ocfs2: remove unreasonable unlock in ocfs2_read_blocks
  - serial: protect uart_port_dtr_rts() in uart_shutdown() too
  - ext4: fix slab-use-after-free in ext4_split_extent_at()
  - uprobe: avoid out-of-bounds memory access of fetching args
  - platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
  - net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
  - slip: make slhc_remember() more robust against malicious packets
  - net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  - riscv: Sync efi page table's kernel mappings before switching
  - !12552  cifs: Fix buffer overflow when parsing NFS reparse points
  - !12714  drm: omapdrm: Add missing check for alloc_ordered_workqueue
  - !12706  fix CVE-2024-49924
  - thermal: core: Reference count the zone in thermal_zone_get_by_id()
  - !12731  net: phy: fix null-ptr-deref while probe() failed
  - !12722  ppp: fix ppp_async_encode() illegal access
  - !12555  NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
  - selftests/bpf: Add test for lsm tail call
  - bpf: Prevent tail call between progs attached to different hooks
  - smack: tcp: ipv4, fix incorrect labeling
  - !12734  CVE-2024-50059
  - !12404  fix CVE-2024-49954
  - !12367  fix CVE-2022-49011
  - !12518  fix CVE-2024-47742
  - !12664 v2  CVE-2024-49955
  - !12684  block: fix potential invalid pointer dereference in blk_add_partition
  - net/xen-netback: prevent UAF in xenvif_flush_hash()
  - !12696  mm: memcg: don't periodically flush stats when memcg is disabled
  - !12695  crypto: xor - fix template benchmarking
  - r8169: add tally counter fields added with RTL8125
  - !12702  vhost_vdpa: assign irq bypass producer token correctly
  - ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
  - net: phy: fix null-ptr-deref while probe() failed
  - ppp: fix ppp_async_encode() illegal access
  - !12520  ipv6: avoid use-after-free in ip6_fragment()
  - !12677  CVE-2024-47673
  - !12675  IB/core: Fix ib_cache_setup_one error flow cleanup
  - drm: omapdrm: Add missing check for alloc_ordered_workqueue
  - fbdev: pxafb: Fix possible use after free in pxafb_task()
  - vhost_vdpa: assign irq bypass producer token correctly
  - !12643  Bluetooth: Fix crash when replugging CSR fake controllers
  - !12500  nbd: fix race between timeout and normal completion
  - !12609  blk_iocost: fix more out of bound shifts
  - mm: memcg: don't periodically flush stats when memcg is disabled
  - crypto: xor - fix template benchmarking
  - crypto: xor - Fix typo of optimization
  - scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
  - scsi: mpt3sas: Remove scsi_dma_map() error messages
  - ocfs2: remove unreasonable unlock in ocfs2_read_blocks
  - block: fix potential invalid pointer dereference in blk_add_partition
  - smb: client: fix UAF in async decryption
  - wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
  - iwlwifi: mvm: move iwl_mvm_stop_device() out of line
  - IB/core: Fix ib_cache_setup_one error flow cleanup
  - ACPI: battery: Fix possible crash when unregistering a battery hook
  - ACPI: battery: Simplify battery hook locking
  - nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
  - Bluetooth: Fix crash when replugging CSR fake controllers
  - blk_iocost: fix more out of bound shifts
  - NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
  - cifs: Fix buffer overflow when parsing NFS reparse points
  - fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
  - ipv6: avoid use-after-free in ip6_fragment()
  - firmware_loader: Block path traversal
  - nbd: fix race between timeout and normal completion
  - gtp: fix a potential NULL pointer dereference
  - padata: use integer wrap around to prevent deadlock on seq_nr overflow
  - static_call: Replace pointless WARN_ON() in static_call_module_notify()
  - nfsd: return -EINVAL when namelen is 0
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()


author: Li Nan <linan122@huawei.com> - 5.10.0-136.101.0.182
changelog:
  - !13152  xfrm: validate new SA's prefixlen using SA family when sel.family is unset
  - !13153  tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  - !13155  RDMA/mad: Improve handling of timed out WRs of mad agent
  - !13166  CVE-2024-50133
  - !13163  Fix 'cgroup/cpuset: Prevent UAF in proc_cpuset_show()' issue with commmunity patches
  - LoongArch: Don't crash in stack_top() for tasks without vDSO
  - cgroup: add cgroup_root_ext to keep kabi
  - cgroup/cpuset: Prevent UAF in proc_cpuset_show()
  - cgroup: Make operations on the cgroup root_list RCU safe
  - Revert "cgroup: fix uaf when proc_cpuset_show"
  - RDMA/mad: Improve handling of timed out WRs of mad agent
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset
  - !13123  blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
  - !13145  tracing: Consider the NULL character when validating the event length
  - tracing: Consider the NULL character when validating the event length
  - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
  - !12967  : ext4: no need to continue when the number of entries is 1
  - !12964  ext4: fix timer use-after-free on failed mount
  - !12966  ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
  - !12963  ext4: fix i_data_sem unlock order in ext4_ind_migrate()
  - !12961  exfat: fix memory leak in exfat_load_bitmap()
  - !12962  ext4: fix access to uninitialised lock in fc replay path
  - !12965  vfs: fix race between evice_inodes() and find_inode()&iput()
  - !13090  bpf, net: Fix a potential race in do_sock_getsockopt()
  - !13102  thunderbolt: Mark XDomain as unplugged when router is removed
  - !13100  pinctrl: single: fix potential NULL dereference in pcs_get_function()
  - !13104  CVE-2024-49878
  - resource: fix region_intersects() vs add_memory_driver_managed()
  - thunderbolt: Mark XDomain as unplugged when router is removed
  - pinctrl: single: fix potential NULL dereference in pcs_get_function()
  - !13065 [sync] PR-12984: [OLK-5.10] Backport scsi bugfix and cleancode from upstream
  - bpf, net: Fix a potential race in do_sock_getsockopt()
  - !13070  f2fs: fix to check atomic_file in f2fs ioctl interfaces
  - !13071  static_call: Handle module init failure correctly in static_call_del_module()
  - !13058  net: add more sanity checks to qdisc_pkt_len_init()
  - !13059  net: avoid potential underflow in qdisc_pkt_len_init() with UFO
  - !13057 [sync] PR-13017:  f2fs: fix to wait dio completion
  - !13056 [sync] PR-13015:  drm/amd/display: Check stream before comparing them
  - !12946  drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[
  - static_call: Handle module init failure correctly in static_call_del_module()
  - f2fs: fix to check atomic_file in f2fs ioctl interfaces
  - [Backport]scsi: libsas: Fix disk not being scanned in after being removed
  - [Backport]scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type()
  - [Backport]scsi: libsas: Introduce struct smp_disc_resp
  - net: avoid potential underflow in qdisc_pkt_len_init() with UFO
  - f2fs: fix to wait dio completion
  - drm/amd/display: Check stream before comparing them
  - net: add more sanity checks to qdisc_pkt_len_init()
  - ext4: no need to continue when the number of entries is 1
  - ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
  - vfs: fix race between evice_inodes() and find_inode()&iput()
  - ext4: fix timer use-after-free on failed mount
  - ext4: fix i_data_sem unlock order in ext4_ind_migrate()
  - ext4: fix access to uninitialised lock in fc replay path
  - exfat: fix memory leak in exfat_load_bitmap()
  - drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]


author: Li Nan <linan122@huawei.com> - 5.10.0-136.102.0.183
changelog:
  - !13199  fs/ntfs3: Additional check in ntfs_file_release
  - !13284  wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
  - !13279  mailbox: bcm2835: Fix timeout during suspend mode
  - !13302  CVE-2024-50195
  - !13229  fs/ntfs3: Fix possible deadlock in mi_read
  - !13228  fs/ntfs3: Check if more than chunk-size bytes are written
  - !13224  fs/ntfs3: Add rough attr alloc_size check
  - !13191  net/ncsi: Disable the ncsi work before freeing the associated structure
  - !13195  fix CVE-2024-50115
  - posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
  - posix-clock: Fix missing timespec64 check in pc_clock_settime()
  - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
  - !13272 v2  scsi: libsas: Add smp_ata_check_ready_type()
  - !13175  bpf: Use raw_spinlock_t in ringbuf
  - mailbox: bcm2835: Fix timeout during suspend mode
  - !13262  bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
  - !13208 [sync] PR-13146:  arm64: probes: Remove broken LDR (literal) uprobe support
  - scsi: libsas: Add smp_ata_check_ready_type()
  - bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
  - !13232  Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
  - !9720  firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - !9095 [sync] PR-8747:  dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - !13223  e100: Fix possible use after free in e100_xmit_prepare
  - !13222  aoe: fix the potential use-after-free problem in more places
  - !13220  scsi: pm80xx: Set phy->enable_completion only when we wait for it
  - !13238  staging: iio: frequency: ad9834: Validate frequency parameter value
  - !13247  CVE-2022-48878
  - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
  - Bluetooth: hci_qca: Fixed issue during suspend
  - Bluetooth: hci_qca: check for SSR triggered flag while suspend
  - Bluetooth: hci_qca: Wait for SSR completion during suspend
  - Bluetooth: hci_qca: Fix driver shutdown on closed serdev
  - Bluetooth: hci_qca: Wait for timeout during suspend
  - Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
  - !12374  wifi: mac80211: fix NULL dereference at band check in starting tx ba session
  - !8793  netfilter: nf_tables: honor table dormant flag from netdev release event path
  - staging: iio: frequency: ad9834: Validate frequency parameter value
  - !13147  CVE-2022-48953
  - Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
  - !13200  iio: light: veml6030: fix IIO device retrieval from embedded device
  - fs/ntfs3: Fix possible deadlock in mi_read
  - fs/ntfs3: Check if more than chunk-size bytes are written
  - fs/ntfs3: Add rough attr alloc_size check
  - e100: Fix possible use after free in e100_xmit_prepare
  - aoe: fix the potential use-after-free problem in more places
  - scsi: pm80xx: Set phy->enable_completion only when we wait for it
  - !13203 [sync] PR-13186:  virtio_pmem: Check device status before requesting flush
  - !13168  drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe
  - arm64: probes: Remove broken LDR (literal) uprobe support
  - virtio_pmem: Check device status before requesting flush
  - iio: light: veml6030: fix IIO device retrieval from embedded device
  - fs/ntfs3: Additional check in ntfs_file_release
  - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
  - net/ncsi: Disable the ncsi work before freeing the associated structure
  - bpf: Use raw_spinlock_t in ringbuf
  - drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe
  - rtc: cmos: Fix wake alarm breakage
  - rtc: cmos: Fix event handler registration ordering issue
  - wifi: mac80211: fix NULL dereference at band check in starting tx ba session
  - firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - netfilter: nf_tables: honor table dormant flag from netdev release event path


author: Li Nan <linan122@huawei.com> - 5.10.0-136.103.0.184
changelog:
  - !13814  nilfs2: fix kernel bug due to missing clearing of checked flag
  - !13457  io_uring: fix CVE-2024-53052
  - !13461  ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
  - !13385  bpf: Fix out-of-bounds write in trie_get_next_key()
  - !13830  fix CVE-2024-50192
  - !13412  udf: fix uninit-value use in udf_get_fileshortad
  - !13801  media: av7110: fix a spectre vulnerability
  - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs
  - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE
  - !13420  btrfs: reinitialize delayed ref list after deleting it from the list
  - !13422  nfs: Fix KMSAN warning in decode_getfattr_attrs()
  - !13811 [sync] PR-13793:  nilfs2: fix potential deadlock with newly created symlinks
  - !13425  media: s5p-jpeg: prevent buffer overflows
  - nilfs2: fix kernel bug due to missing clearing of checked flag
  - nilfs2: fix potential deadlock with newly created symlinks
  - !13798  drm/amd/display: Initialize denominators' default to 1
  - media: av7110: fix a spectre vulnerability
  - drm/amd/display: Initialize denominators' default to 1
  - !13438  net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
  - !13437  netfilter: br_netfilter: fix panic with metadata_dst skb
  - !13434  netfilter: nf_tables: prevent nf_skb_duplicated corruption
  - !13432  wifi: iwlwifi: mvm: avoid NULL pointer dereference
  - !13320  unicode: Don't special case ignorable code points
  - !13380  fbdev: sisfb: Fix strbuf array overflow
  - !13455 [sync] PR-13356:  NFSD: Initialize struct nfsd4_copy earlier
  - ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
  - io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
  - io_uring: use kiocb_{start,end}_write() helpers
  - fs: create kiocb_{start,end}_write() helpers
  - io_uring: rename kiocb_end_write() local helper
  - !13440  RDMA/cxgb4: Added NULL check for lookup_atid
  - !13442  net: netfilter: Fix CVE-2024-50038
  - !13445  RDMA/rtrs-srv: Avoid null pointer deref during path establishment
  - !13431  xen-netfront: Fix NULL sring after live migration
  - !13430  RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
  - !13429  SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
  - !13428  bonding: Fix CVE-2023-52784
  - !13427  llc: verify mac len before reading mac header
  - NFSD: Initialize struct nfsd4_copy earlier
  - !13390 [sync] PR-12686:  security/keys: fix slab-out-of-bounds in key_task_permission
  - RDMA/rtrs-srv: Avoid null pointer deref during path establishment
  - netfilter: xtables: fix typo causing some targets not to load on IPv6
  - netfilter: xtables: avoid NFPROTO_UNSPEC where needed
  - RDMA/cxgb4: Added NULL check for lookup_atid
  - net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
  - netfilter: br_netfilter: fix panic with metadata_dst skb
  - netfilter: nf_tables: prevent nf_skb_duplicated corruption
  - wifi: iwlwifi: mvm: avoid NULL pointer dereference
  - xen-netfront: Fix NULL sring after live migration
  - RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
  - bonding: stop the device in bond_setup_by_slave()
  - bonding: reset bond's flags when down link is P2P device
  - llc: verify mac len before reading mac header
  - media: s5p-jpeg: prevent buffer overflows
  - nfs: Fix KMSAN warning in decode_getfattr_attrs()
  - btrfs: reinitialize delayed ref list after deleting it from the list
  - udf: fix uninit-value use in udf_get_fileshortad
  - !13388  usb: musb: sunxi: Fix accessing an released usb phy
  - !13393  CVE-2024-47745
  - !13369  CVE-2024-46713
  - !13342  ntfs3: fix CVE-2024-50248
  - !13348  ceph: remove the incorrect Fw reference check when dirtying pages
  - !13347  nilfs2: propagate directory read errors from nilfs_find_entry()
  - mm: split critical region in remap_file_pages() and invoke LSMs in between
  - mm: call the security_mmap_file() LSM hook in remap_file_pages()
  - remap_file_pages: Use vma_lookup() instead of find_vma()
  - mm/mmap.c: don't unlock VMAs in remap_file_pages()
  - !13330  tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
  - security/keys: fix slab-out-of-bounds in key_task_permission
  - usb: musb: sunxi: Fix accessing an released usb phy
  - bpf: Fix out-of-bounds write in trie_get_next_key()
  - fbdev: sisfb: Fix strbuf array overflow
  - !13304  ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
  - perf: Fix kabi problem by put mutex in front of perf_buffer
  - perf/aux: Fix AUX buffer serialization
  - !13311  fs/ntfs3: Additional check in ni_clear()
  - ceph: remove the incorrect Fw reference check when dirtying pages
  - nilfs2: propagate directory read errors from nilfs_find_entry()
  - !13339  smb: client: fix OOBs when building SMB2_IOCTL request
  - fs/ntfs3: Sequential field availability check in mi_enum_attr()
  - ntfs3: Add bounds checking to mi_enum_attr()
  - smb: client: fix OOBs when building SMB2_IOCTL request
  - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
  - unicode: Don't special case ignorable code points
  - fs/ntfs3: Additional check in ni_clear()
  - ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()


author: Li Nan <linan122@huawei.com> - 5.10.0-136.104.0.185
changelog:
  - !14034  xfs: Fix data overflow in xfs_mod_fdblocks()
  - !14016  *** CVE-2024-53063 ***
  - !13957  fs: Fix uninitialized value issue in from_kuid and from_kgid
  - xfs: Fix data overflow in xfs_mod_fdblocks()
  - !13336  fix CVE-2024-50135
  - !13944  net/sched: accept TCA_STAB only for root qdisc
  - !13939  wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
  - !13947  ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
  - !13946  wifi: rtw88: always wait for both firmware loading attempts
  - !13945  Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
  - !13943  net: ethernet: lantiq_etop: fix memory disclosure
  - !13942  net: Fix an unsafe loop on the list
  - !13941  net: stmmac: Fix zero-division error when disabling tc cbs
  - !13940  sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
  - !13938  wifi: ath11k: fix array out-of-bound access in SoC stats
  - media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
  - media: dvbdev: prevent the risk of out of memory access
  - !13840  afs: Fix lock recursion
  - !13907 [sync] PR-13905:  NFSD: Never decrement pending_async_copies on error
  - !13924  wifi: ath10k: Fix memory leak in management tx
  - !13923  RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
  - !13968  bpf: Check validity of link->type in bpf_link_show_fdinfo()
  - bpf: Check validity of link->type in bpf_link_show_fdinfo()
  - fs: Fix uninitialized value issue in from_kuid and from_kgid
  - !13803  pinctrl: ocelot: fix system hang on level based interrupts
  - ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
  - wifi: rtw88: always wait for both firmware loading attempts
  - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
  - net/sched: accept TCA_STAB only for root qdisc
  - net: ethernet: lantiq_etop: fix memory disclosure
  - net: Fix an unsafe loop on the list
  - net: stmmac: Fix zero-division error when disabling tc cbs
  - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
  - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
  - wifi: ath11k: fix array out-of-bound access in SoC stats
  - wifi: ath10k: Fix memory leak in management tx
  - RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
  - !13899  drm/amd/display: Check link_index before accessing dc->links[
  - NFSD: Never decrement pending_async_copies on error
  - !13886  scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths
  - !13863  net: systemport: fix potential memory leak in bcm_sysport_xmit()
  - !13865  Bluetooth: bnep: fix wild-memory-access in proto_unregister
  - !13868  wifi: iwlegacy: Clear stale interrupts before resuming device
  - !13882  RDMA/bnxt_re: Add a check for memory allocation
  - drm/amd/display: Check link_index before accessing dc->links[]
  - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths
  - !13856  CVE-2024-53059
  - !13855  sctp: properly validate chunk size in sctp_sf_ootb()
  - RDMA/bnxt_re: Add a check for memory allocation
  - wifi: iwlegacy: Clear stale interrupts before resuming device
  - Bluetooth: bnep: fix wild-memory-access in proto_unregister
  - net: systemport: fix potential memory leak in bcm_sysport_xmit()
  - mac80211: always have ieee80211_sta_restart()
  - wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
  - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
  - mac80211: Add support to trigger sta disconnect on hardware restart
  - mac80211: do drv_reconfig_complete() before restarting all
  - sctp: properly validate chunk size in sctp_sf_ootb()
  - afs: Fix lock recursion
  - pinctrl: ocelot: fix system hang on level based interrupts
  - nvme-pci: fix race condition between reset and nvme_dev_disable()
  - nvme-pci: refactor the tagset handling in nvme_reset_work
  - nvme-pci: split nvme_dev_add


author: Li Nan <linan122@huawei.com> - 5.10.0-136.105.0.186
changelog:
  - !14047  smb: client: Fix use-after-free of network namespace.
  - !14118  bpf: sync_linked_regs() must preserve subreg_def
  - !14125  media: cx24116: prevent overflows on SNR calculus
  - !13826 [sync] PR-13403: some bugfix of ksmbd smb2_open()
  - !13825 [sync] PR-13448: bugfix of nfs
  - media: cx24116: prevent overflows on SNR calculus
  - bpf: sync_linked_regs() must preserve subreg_def
  - !14105  nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
  - !14115  media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
  - !14084  ocfs2: uncache inode which has failed entering the group
  - nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
  - !14032  fix CVE-2024-50278
  - !14093  USB: serial: io_edgeport: fix use after free in debug printk
  - !14078  vp_vdpa: fix id_table array not null terminated error
  - !14074  HID: core: zero-initialize the report buffer
  - !14029  drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
  - !14028  drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
  - !14023  iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
  - !14063  CVE-2024-53054
  - !14050  wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
  - !14052  net: sched: fix use-after-free in taprio_change()
  - !14053  can: bcm: Fix UAF in bcm_proc_show()
  - USB: serial: io_edgeport: fix use after free in debug printk
  - !14081 [sync] PR-13871:  ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
  - ocfs2: uncache inode which has failed entering the group
  - ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
  - !14020  ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
  - !14061 [sync] PR-13948:  fix CVE-2024-49906
  - vp_vdpa: fix id_table array not null terminated error
  - HID: core: zero-initialize the report buffer
  - cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction
  - Revert "cgroup: Fix AA deadlock caused by cgroup_bpf_release"
  - !13996  drm/radeon: Fix encoder->possible_clones
  - drm/amd/display: Check null pointer before try to access it
  - drm/amd/display: Check null pointer before try to access it
  - !13992  fix CVE-2024-49861
  - can: bcm: Fix UAF in bcm_proc_show()
  - net: sched: fix use-after-free in taprio_change()
  - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
  - smb: client: Fix use-after-free of network namespace.
  - dm cache: fix potential out-of-bounds access on the first resume
  - dm cache: optimize dirty bit checking with find_next_bit when resizing
  - dm cache: fix out-of-bounds access to the dirty bitset when resizing
  - drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
  - drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
  - iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
  - ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
  - drm/radeon: Fix encoder->possible_clones
  - bpf: Fix kabi breakage in enum bpf_type_flag
  - selftests/bpf: Rename ARG_PTR_TO_LONG test description
  - selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test
  - bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
  - bpf: Fix helper writes to read-only maps
  - bpf: Remove truncation test in bpf_strtol and bpf_strtoul helpers
  - bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
  - bpf: Allow helpers to accept pointers with a fixed size
  - bpf: Add MEM_UNINIT as a bpf_type_flag
  - ksmbd: fix return value of smb2_open()
  - ksmbd: fix possible refcount leak in smb2_open()
  - NFSv4: check FMODE_EXEC from open context mode in nfs4_opendata_access()
  - NFS: make sure open context mode have FMODE_EXEC when file open for exec


author: Zheng Zengkai <zhengzengkai@huawei.com> - 5.10.0-136.1.0.76
changelog:
  - coresight: trbe: Enable ACPI/Platform automatic module loading
  - arm64/trbe: Add initial MADT/SPE probing
  - ACPI 6.5: MADT: add support for trace buffer extension in GICC
  - coresight: Return the pointer of @pdata when not "fwnode"
  - blk-mq: don't access request_wrapper if request is not allocated from block layer
  - blk-mq: fix kabi broken due to request_wrapper
  - ide-cd: don't clear rq_flags after blk_get_request
  - iommu: Fix error handling in probe_acpi_namespace_devices()
  - !322 [sync] PR-321: net: hns3: fix the HCLGE_OPC_WOL_CFG opcode id for wol and fix the incorrect way to obtain parameters.
  - !320 Some bugfix about rx packet,rx copybreak and phy link ksettings for the HNS3.
  - net: hns3: fix the HCLGE_OPC_WOL_CFG opcode id for wol
  - net: hns3: fix getting supported parameter from driver in hclge_set_wol
  - net: hns3: fix setting incorrect phy link ksettings for firmware in resetting process
  - net: hns3: fix return value check bug of rx copybreak
  - net: hns3: fix incorrect hw rss hash type of rx packet


author: Zheng Zengkai <zhengzengkai@huawei.com> - 5.10.0-136.3.0.77
changelog:
  - !326 vdpa: Add the vdpa device management mechanism and optimize the iotlb
  - Revert "ipvlan: Modify the value of ipvlan modes"
  - net/af_packet: make sure to pull mac header
  - KVM: arm64: Fix {fp_asimd,sve}_exit_stat manipulation
  - dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata
  - arm64: fix a concurrency issue in emulation_proc_handler()
  - vdpa/vp_vdpa: fix kfree a wrong pointer in vp_vdpa_remove
  - tools include UAPI: Sync linux/vhost.h with the kernel sources
  - tools include UAPI: Sync linux/vhost.h with the kernel sources
  - tools include UAPI: Sync linux/vhost.h with the kernel sources
  - vhost-vdpa: call vhost_vdpa_cleanup during the release
  - vhost: allow batching hint without size
  - vdpa_sim: set vringh notify callback
  - virtio_pci: struct virtio_pci_common_cfg add queue_reset
  - virtio_pci: struct virtio_pci_common_cfg add queue_notify_data
  - virtio: use virtio_reset_device() when possible
  - virtio: document virtio_reset_device
  - virtio: wrap config->reset calls
  - virtio_pci: introduce helper to get/set queue reset
  - virtio_pci: extract the logic of active vq for modern pci
  - vhost-vdpa: uAPI to suspend the device
  - vhost-vdpa: introduce SUSPEND backend feature bit
  - vdpa: Add suspend operation
  - vhost-vdpa: Call ida_simple_remove() when failed
  - vDPA: fix 'cast to restricted le16' warnings in vdpa.c
  - vDPA: !FEATURES_OK should not block querying device config space
  - vdpa: make get_vq_group and set_group_asid optional
  - vhost-vdpa: return -EFAULT on copy_to_user() failure
  - vdpa/vp_vdpa : add vdpa tool support in vp_vdpa
  - vhost-vdpa: support ASID based IOTLB API
  - vhost-vdpa: introduce uAPI to set group ASID
  - vhost-vdpa: uAPI to get virtqueue group id
  - vhost-vdpa: introduce uAPI to get the number of address spaces
  - vhost-vdpa: introduce uAPI to get the number of virtqueue groups
  - vhost-vdpa: introduce asid based IOTLB
  - vhost: support ASID in IOTLB API
  - vhost_iotlb: split out IOTLB initialization
  - vdpa: introduce config operations for associating ASID to a virtqueue group
  - vdpa: multiple address spaces support
  - vdpa: introduce virtqueue groups
  - vhost-vdpa: switch to use vhost-vdpa specific IOTLB
  - vhost-vdpa: passing iotlb to IOMMU mapping helpers
  - virtio-vdpa: don't set callback if virtio doesn't need it
  - vhost: move the backend feature bits to vhost_types.h
  - net/vdpa: Use readers/writers semaphore instead of cf_mutex
  - net/vdpa: Use readers/writers semaphore instead of vdpa_dev_mutex
  - vdpa: Add support for querying vendor statistics
  - vdpa: Fix error logic in vdpa_nl_cmd_dev_get_doit
  - vhost: handle error while adding split ranges to iotlb
  - vdpa: change the type of nvqs to u32
  - vhost: fix hung thread due to erroneous iotlb entries
  - vdpa: factor out vdpa_set_features_unlocked for vdpa internal use
  - vdpa: Protect vdpa reset with cf_mutex
  - vdpa: Avoid taking cf_mutex lock on get status
  - vdpa: Use BIT_ULL for bit operations
  - vdpa: Support reporting max device capabilities
  - vdpa: Add support for returning device configuration information
  - vdpa: Allow to configure max data virtqueues
  - vdpa: Read device configuration only if FEATURES_OK
  - vdpa: Sync calls set/get config/status with cf_mutex
  - vdpa: Provide interface to read driver features
  - vdpa: Mark vdpa_config_ops.get_vq_notification as optional
  - vdpa: Avoid duplicate call to vp_vdpa get_status
  - docs: document sysfs ABI for vDPA bus
  - vhost-vdpa: clean irqs before reseting vdpa device
  - vdpa: Enable user to set mac and mtu of vdpa device
  - vdpa: Use kernel coding style for structure comments
  - vdpa: Introduce query of device config layout
  - vdpa: Introduce and use vdpa device get, set config helpers
  - vdpa: add new attribute VDPA_ATTR_DEV_MIN_VQ_SIZE
  - virtio_vdpa: setup correct vq size with callbacks get_vq_num_{max,min}
  - vdpa: min vq num of vdpa device cannot be greater than max vq num
  - vdpa: add new callback get_vq_num_min in vdpa_config_ops
  - vhost_vdpa: unset vq irq before freeing irq
  - vdpa: potential uninitialized return in vhost_vdpa_va_map()
  - vhost-iotlb: Add an opaque pointer for vhost IOTLB
  - vdpa: Support transferring virtual addressing during DMA mapping
  - vdpa: factor out vhost_vdpa_pa_map() and vhost_vdpa_pa_unmap()
  - vdpa: Add an opaque pointer for vdpa_config_ops.dma_map()
  - vhost-vdpa: Handle the failure of vdpa_reset()
  - vdpa: Fix some coding style issues
  - vdpa: Make use of PFN_PHYS/PFN_UP/PFN_DOWN helper macro
  - vdpa: Add documentation for vdpa_alloc_device() macro
  - virtio/vdpa: clear the virtqueue state during probe
  - vp_vdpa: correct the return value when fail to map notification
  - virito_pci libray: hide vp_modern_map_capability()
  - vhost/vdpa: Remove the restriction that only supports virtio-net devices
  - virtio_pci_modern: hide vp_modern_get_queue_notify_off()
  - vdpa: Follow kdoc comment style
  - vdpa: Follow kdoc comment style
  - virtio_vdpa: don't warn when fail to disable vq
  - vdpa: Use simpler version of ida allocation
  - vhost_vdpa: switch to vmemdup_user()


author: Zheng Zengkai <zhengzengkai@huawei.com> - 5.10.0-136.4.0.78
changelog:
  - RDMA/hns: fix the error of RoCE VF based on RoCE Bonding PF
  - RDMA/hns: Fix AH attr queried by query_qp
  - RDMA/hns: Kernel notify usr space to stop ring db


author: Zheng Zengkai <zhengzengkai@huawei.com> - 5.10.0-136.8.0.80
changelog:
  - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
  - Bluetooth: L2CAP: Fix build errors in some archs
  - cpuidle: add cpuidle-haltpoll driver module parameter
  - clk: imx: Add check for kcalloc
  - x86/cpu/hygon: Set __max_die_per_package on Hygon
  - mm/dynamic_hugetlb: fix clear PagePool without lock protection
  - mm/dynamic_hugetlb: fix list corruption in hpool_merge_page()
  - mm/swapfile: use new way to fix broken kabi in swap_info_struct
  - block: always align request_wrapper to cacheline
  - block: fix crash on cmpxchg for request_wrapper
  - efi/libstub: Fix build error in efi-stub.c for riscv
  - mm: init: Fix build waring for ascend enable features
  - mtd: physmap-core: Fix NULL pointer dereferencing in of_select_probe_type()
  - ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP
  - xen/netback: fix build warning
  - xen/netback: Ensure protocol headers don't fall in the non-linear area
  - block: only use cmpxchg64 in 64bit platform
  - proc: proc_skip_spaces() shouldn't think it is working on C strings
  - proc: avoid integer type confusion in get_proc_long
  - sched/qos: Don't unthrottle cfs_rq when cfs_rq is throttled by qos


author: Zheng Zengkai <zhengzengkai@huawei.com> - 5.10.0-136.10.0.82
changelog:
  - scsi: iscsi: remove .unbind_conn from iscsi_transport
  - Revert "scsi: iscsi: fix kabi broken in struct iscsi_transport"


author: Zheng Zengkai <zhengzengkai@huawei.com> - 5.10.0-136.13.2.89
changelog:
  - media: mceusb: Use new usb_control_msg_*() routines
  - perf: hisi: Fix read sccl_id and ccl_id error in TSV200
  - mm: add cond_resched() in swapin_walk_pmd_entry()
  - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
  - livepatch: Fix compile error when CONFIG_LIVEPATCH_WO_FTRACE disabled
  - dm thin: Use last transaction's pmd->root when commit failed
  - zram: avoid race between zram_remove and disksize_store
  - zram: don't fail to remove zram during unloading module
  - blk-mq: fix kabi broken in struct bio
  - blk-mq: fix kabi broken in struct request
  - block, bfq: fix possible uaf for 'bfqq->bic'
  - block, bfq: fix null pointer dereference in bfq_bio_bfqg()
  - blk-mq: set default elevator as deadline in case of hctx shared tagset
  - ext2: replace bh_submit_read() helper with bh_read()
  - ufs: replace ll_rw_block()
  - udf: replace ll_rw_block()
  - reiserfs: replace ll_rw_block()
  - ocfs2: replace ll_rw_block()
  - ntfs3: replace ll_rw_block()
  - jbd2: replace ll_rw_block()
  - isofs: replace ll_rw_block()
  - gfs2: replace ll_rw_block()
  - fs/buffer: replace ll_rw_block()
  - fs/buffer: add some new buffer read helpers
  - wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_CHANNEL_LIST attribute
  - xen/netback: don't call kfree_skb() with interrupts disabled
  - media: dvb-core: Fix UAF due to refcount races at releasing
  - wifi: wilc1000: validate pairwise and authentication suite offsets
  - wifi: wilc1000: validate number of channels
  - wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute
  - drm/amdkfd: Check for null pointer after calling kmemdup


author: Zheng Zengkai <zhengzengkai@huawei.com> - 5.10.0-136.14.2.90
changelog:
  - !341 Backport CVEs and fs bugfixes
  - KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
  - bfq: fix null-ptr-deref in bfq_pd_offline
  - i2c: ismt: Fix an out-of-bounds bug in ismt_access()
  - ksmbd: fix heap-based overflow in set_ntacl_dacl()
  - ksmbd: prevent out of bound read for SMB2_WRITE
  - ksmbd: validate length in smb2_write()
  - xfs: fix super block buf log item UAF during force shutdown
  - xfs: wait iclog complete before tearing down AIL
  - xfs: get rid of assert from xfs_btree_islastblock


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.15.0.91
changelog:
  - !347 Backport CVEs and fs bugfixes
  - io_uring: kill goto error handling in io_sqpoll_wait_sq()
  - ext4: fix bad checksum after online resize
  - xfs: fix use-after-free in xattr node block inactivation
  - USB: core: Fix RST error in hub.c
  - USB: core: Prevent nested device-reset calls


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.16.0.92
changelog:
  - !358 Backport CVEs, bugfixes and other
  - binder: fix UAF of alloc->vma in race with munmap()
  - io_uring: add missing item types for splice request
  - xfs: fix overfilling of reserve pool
  - xfs: always succeed at setting the reserve pool size
  - xfs: remove infinite loop when reserving free block pool
  - xfs: use current->journal_info for detecting transaction recursion
  - fix kabi broken due to may_pollfree
  - io_uring: disable polling pollfree files
  - ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob
  - driver: char: delete svm.c
  - mm: fix unexpected changes to {failslab|fail_page_alloc}.attr
  - fs/ntfs3: Fix attr_punch_hole() null pointer derenference
  - tracing/osnoise: Do not unregister events twice
  - tracing/osnoise: Properly unhook events if start_per_cpu_kthreads() fails
  - !351 AMD: Fix cpu capabilities incorrect detection bug.
  - x86/cpufeatures: Fix cpu capabilities incorrect detection.


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.17.0.93
changelog:
  - !372 Backport 5.10.141 LTS
  - net: neigh: don't call kfree_skb() under spin_lock_irqsave()
  - net/af_packet: check len when min_header_len equals to 0
  - lib/vdso: Mark do_hres_timens() and do_coarse_timens() __always_inline()
  - netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y
  - drm/amdgpu: Increase tlb flush timeout for sriov
  - drm/amd/display: Fix pixel clock programming
  - drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid
  - s390/hypfs: avoid error message under KVM
  - neigh: fix possible DoS due to net iface start/stop loop
  - drm/amd/display: clear optc underflow before turn off odm clock
  - drm/amd/display: For stereo keep "FLIP_ANY_FRAME"
  - drm/amd/display: Avoid MPC infinite loop
  - mmc: mtk-sd: Clear interrupts when cqe off/disable
  - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
  - fbdev: fb_pm2fb: Avoid potential divide by zero error
  - net: fix refcount bug in sk_psock_get (2)
  - HID: hidraw: fix memory leak in hidraw_release()
  - udmabuf: Set the DMA mask for the udmabuf device (v2)
  - HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
  - Revert "PCI/portdrv: Don't disable AER reporting in get_port_device_capability()"
  - kbuild: Fix include path in scripts/Makefile.modpost
  - s390/mm: do not trigger write fault when vma does not allow VM_WRITE
  - crypto: lib - remove unneeded selection of XOR_BLOCKS
  - x86/nospec: Fix i386 RSB stuffing
  - x86/nospec: Unwreck the RSB stuffing
  - !368 Backport CVEs and bugfixes
  - mm/memory: return vm_fault_t result from migrate_to_ram() callback
  - net: sched: disallow noqueue for qdisc classes
  - netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
  - xfs: Fix deadlock on xfs_inodegc_worker
  - net: sched: cbq: dont intepret cls results when asked to drop
  - net: sched: atm: dont intepret cls results when asked to drop
  - scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process
  - of/fdt: Don't calculate initrd size from DT if start > end
  - lib/cmdline: avoid page fault in next_arg
  - rndis_wlan: Prevent buffer overflow in rndis_query_oid
  - mm/vmpressure: fix data-race with memcg->socket_pressure
  - !367 [sync] PR-354: [OLK-5.10] machine check safe review issue modification
  - kasan: add kasan support for memcpy_mcs()
  - arm64: fix return value type of memcpy_mcs()
  - !363 AMD: Support svm guest when host CR4.LA57 is set.
  - KVM: x86: Allow CPU to force vendor-specific TDP level
  - !338 Fix virtio-gpu free issues
  - drm/virtio: free virtqueues on probe failure
  - drm/virtio: Fixes a potential NULL pointer dereference on probe failure


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.18.0.94
changelog:
  - !385 Backport CVEs and bugfixes
  - !384 Backport 5.10.142 LTS
  - cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
  - cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock
  - cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree
  - net: sched: fix race condition in qdisc_graft()
  - macvlan: enforce a consistent minimal mtu
  - net: switch to storing KCOV handle directly in sk_buff
  - kabi: add early_demux_handler and early_demux back to fix kabi broken in struct net_protocol and inet6_protocol
  - tcp/udp: Make early_demux back namespacified.
  - net: Use u64_stats_fetch_begin_irq() for stats fetch.
  - drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
  - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames
  - ext4: fix use-after-free in ext4_orphan_cleanup
  - ext4: fix null-ptr-deref in ext4_write_info
  - block: don't allow a disk link holder to itself
  - hugetlbfs: fix off-by-one error in hugetlb_vmdelete_list()
  - scsi: fix iscsi rescan fails to create block
  - mm/memcg_memfs_info: fix potential oom_lock recursion deadlock
  - mm: memcontrol: fix potential oom_lock recursion deadlock
  - irqchip/gic-v4: Wait for GICR_VPENDBASER.Dirty to clear before descheduling
  - xfs: fix potential log item leak
  - USB: serial: ch341: fix disabled rx timer on older devices
  - USB: serial: ch341: fix lost character on LCR updates
  - usb: dwc3: disable USB core PHY management
  - usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup
  - usb: dwc3: fix PHY disable sequence
  - mmc: core: Fix UHS-I SD 1.8V workaround branch
  - btrfs: harden identification of a stale device
  - drm/i915/glk: ECS Liva Q2 needs GLK HDMI port timing quirk
  - ALSA: seq: Fix data-race at module auto-loading
  - ALSA: seq: oss: Fix data-race for max_midi_devs access
  - ALSA: hda/realtek: Add speaker AMP init for Samsung laptops with ALC298
  - net: mac802154: Fix a condition in the receive path
  - ip: fix triggering of 'icmp redirect'
  - wifi: mac80211: Fix UAF in ieee80211_scan_rx()
  - wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
  - driver core: Don't probe devices after bus_type.match() probe deferral
  - usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
  - s390: fix nospec table alignments
  - s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages
  - usb-storage: Add ignore-residue quirk for NXP PN7462AU
  - USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020)
  - usb: dwc2: fix wrong order of phy_power_on and phy_init
  - usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles
  - USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode
  - USB: serial: option: add Quectel EM060K modem
  - USB: serial: option: add support for OPPO R11 diag port
  - USB: serial: cp210x: add Decagon UCA device id
  - xhci: Add grace period after xHC start to prevent premature runtime suspend.
  - thunderbolt: Use the actual buffer in tb_async_error()
  - xen-blkfront: Advertise feature-persistent as user requested
  - xen-blkback: Advertise feature-persistent as user requested
  - mm: pagewalk: Fix race between unmap and page walker
  - xen/grants: prevent integer overflow in gnttab_dma_alloc_pages()
  - KVM: x86: Mask off unsupported and unknown bits of IA32_ARCH_CAPABILITIES
  - gpio: pca953x: Add mutex_lock for regcache sync in PM
  - hwmon: (gpio-fan) Fix array out of bounds access
  - clk: bcm: rpi: Add missing newline
  - clk: bcm: rpi: Prevent out-of-bounds access
  - clk: bcm: rpi: Use correct order for the parameters of devm_kcalloc()
  - clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate
  - Input: rk805-pwrkey - fix module autoloading
  - clk: core: Fix runtime PM sequence in clk_core_unprepare()
  - Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops"
  - clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops
  - drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported"
  - USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id
  - misc: fastrpc: fix memory corruption on open
  - misc: fastrpc: fix memory corruption on probe
  - iio: adc: mcp3911: use correct formula for AD conversion
  - iio: ad7292: Prevent regulator double disable
  - Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag
  - tty: serial: lpuart: disable flow control while waiting for the transmit engine to complete
  - vt: Clear selection before changing the font
  - powerpc: align syscall table for ppc32
  - serial: fsl_lpuart: RS485 RTS polariy is inverse
  - net/smc: Remove redundant refcount increase
  - Revert "sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb"
  - tcp: annotate data-race around challenge_timestamp
  - sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb
  - kcm: fix strp_init() order and cleanup
  - ethernet: rocker: fix sleep in atomic context bug in neigh_timer_handler
  - net/sched: fix netdevice reference leaks in attach_default_qdiscs()
  - net: sched: tbf: don't call qdisc_put() while holding tree lock
  - Revert "xhci: turn off port power in shutdown"
  - wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
  - ALSA: hda: intel-nhlt: Correct the handling of fmt_config flexible array
  - ALSA: hda: intel-nhlt: remove use of __func__ in dev_dbg
  - ieee802154/adf7242: defer destroy_workqueue call
  - iio: adc: mcp3911: make use of the sign bit
  - platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask
  - drm/msm/dsi: Fix number of regulators for SDM660
  - drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg
  - drm/msm/dp: delete DP_RECOVERED_CLOCK_OUT_EN to fix tps4
  - drm/msm/dsi: fix the inconsistent indenting


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.19.0.95
changelog:
  - !403 Backport 5.10.145 - 5.10.149 LTS
  - wifi: mac80211: don't parse mbssid in assoc response
  - mac80211: mlme: find auth challenge directly
  - Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
  - misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic
  - misc: pci_endpoint_test: Aggregate params checking for xfer
  - Input: xpad - fix wireless 360 controller breaking after suspend
  - Input: xpad - add supported devices as contributed on github
  - wifi: cfg80211: update hidden BSSes to avoid WARN_ON
  - wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
  - wifi: cfg80211: ensure length byte is present before access
  - wifi: cfg80211/mac80211: reject bad MBSSID elements
  - random: use expired timer rather than wq for mixing fast pool
  - random: avoid reading two cache lines on irq randomness
  - USB: serial: qcserial: add new usb-id for Dell branded EM7455
  - efi: Correct Macmini DMI match in uefi cert quirk
  - ALSA: hda: Fix position reporting on Poulsbo
  - random: clamp credited irq bits to maximum mixed
  - random: restore O_NONBLOCK support
  - Revert "clk: ti: Stop using legacy clkctrl names for omap4 and 5"
  - rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
  - USB: serial: ftdi_sio: fix 300 bps rate for SIO
  - mmc: core: Terminate infinite loop in SD-UHS voltage switch
  - mmc: core: Replace with already defined values for readability
  - drm/amd/display: skip audio setup when audio stream is enabled
  - drm/amd/display: update gamut remap if plane has changed
  - net: atlantic: fix potential memory leak in aq_ndev_close()
  - arch: um: Mark the stack non-executable to fix a binutils warning
  - um: Cleanup compiler warning in arch/x86/um/tls_32.c
  - um: Cleanup syscall_handler_t cast in syscalls_32.h
  - ALSA: hda/hdmi: Fix the converter reuse for the silent stream
  - net/ieee802154: fix uninit value bug in dgram_sendmsg
  - scsi: qedf: Fix a UAF bug in __qedf_probe()
  - ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer
  - dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure
  - dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property
  - dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling
  - firmware: arm_scmi: Add SCMI PM driver remove routine
  - compiler_attributes.h: move __compiletime_{error|warning}
  - powerpc/64s/radix: don't need to broadcast IPI for radix pmd collapse flush
  - mm: gup: fix the fast GUP race against THP collapse
  - xsk: Inherit need_wakeup flag for shared sockets
  - perf tools: Fixup get_current_dir_name() compilation
  - docs: update mediator information in CoC docs
  - Makefile.extrawarn: Move -Wcast-function-type-strict to W=1
  - ceph: don't truncate file in atomic_open
  - nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure
  - ALSA: hda/hdmi: fix warning about PCM count when used with SOF
  - x86/alternative: Fix race in try_get_desc()
  - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest
  - clk: iproc: Do not rely on node name for correct PLL setup
  - clk: imx: imx6sx: remove the SET_RATE_PARENT flag for QSPI clocks
  - selftests: Fix the if conditions of in test_extra_filter()
  - net: stmmac: power up/down serdes in stmmac_open/release
  - nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices
  - nvme: add new line after variable declatation
  - cxgb4: fix missing unlock on ETHOFLD desc collect fail path
  - net: sched: act_ct: fix possible refcount leak in tcf_ct_init()
  - usbnet: Fix memory leak in usbnet_disconnect()
  - Input: melfas_mip4 - fix return value check in mip4_probe()
  - Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time"
  - ASoC: tas2770: Reinit regcache on reset
  - soc: sunxi: sram: Fix debugfs info for A64 SRAM C
  - soc: sunxi: sram: Fix probe function ordering issues
  - soc: sunxi_sram: Make use of the helper function devm_platform_ioremap_resource()
  - soc: sunxi: sram: Prevent the driver from being unbound
  - soc: sunxi: sram: Actually claim SRAM regions
  - reset: imx7: Fix the iMX8MP PCIe PHY PERST support
  - ARM: dts: am33xx: Fix MMCHS0 dma properties
  - swiotlb: max mapping size takes min align mask into account
  - media: rkvdec: Disable H.264 error detection
  - media: dvb_vb2: fix possible out of bound access
  - mm: fix madivse_pageout mishandling on non-LRU page
  - mm/migrate_device.c: flush TLB while holding PTL
  - mm: prevent page_frag_alloc() from corrupting the memory
  - mm/page_alloc: fix race condition between build_all_zonelists and page allocation
  - mmc: hsq: Fix data stomping during mmc recovery
  - mmc: moxart: fix 4-bit bus width and remove 8-bit bus width
  - libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205
  - net: mt7531: only do PLL once after the reset
  - ntfs: fix BUG_ON in ntfs_lookup_inode_by_name()
  - ARM: dts: integrator: Tag PCI host with device_type
  - clk: ingenic-tcu: Properly enable registers before accessing timers
  - Input: snvs_pwrkey - fix SNVS_HPVIDR1 register address
  - net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455
  - thunderbolt: Explicitly reset plug events delay back to USB4 spec value
  - usb: typec: ucsi: Remove incorrect warning
  - uas: ignore UAS for Thinkplus chips
  - usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS
  - uas: add no-uas quirk for Hiksemi usb_disk
  - btrfs: fix hang during unmount when stopping a space reclaim worker
  - ALSA: hda: Fix Nvidia dp infoframe
  - ALSA: hda/hdmi: let new platforms assign the pcm slot dynamically
  - ALSA: hda/tegra: Reset hardware
  - ALSA: hda/tegra: Use clk_bulk helpers
  - thunderbolt: Add support for Intel Maple Ridge single port controller
  - thunderbolt: Add support for Intel Maple Ridge
  - ext4: make directory inode spreading reflect flexbg size
  - ext4: limit the number of retries after discarding preallocations blocks
  - devdax: Fix soft-reservation memory description
  - i2c: mlxbf: Fix frequency calculation
  - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()
  - i2c: mlxbf: incorrect base address passed during io write
  - i2c: imx: If pm_runtime_get_sync() returned 1 device access is possible
  - workqueue: don't skip lockdep work dependency in cancel_work_sync()
  - drm/rockchip: Fix return type of cdn_dp_connector_mode_valid
  - drm/amd/display: Mark dml30's UseMinimumDCFCLK() as noinline for stack usage
  - drm/amd/display: Limit user regamma to a valid value
  - drm/amdgpu: use dirty framebuffer helper
  - drm/gma500: Fix BUG: sleeping function called from invalid context errors
  - Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
  - cifs: always initialize struct msghdr smb_msg completely
  - cifs: use discard iterator to discard unneeded network data more efficiently
  - drm/amdgpu: Fix check for RAS support
  - vfio/type1: fix vaddr_get_pfns() return in vfio_pin_page_external()
  - usb: xhci-mtk: fix issue of out-of-bounds array access
  - s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup
  - serial: tegra-tcu: Use uart_xmit_advance(), fixes icount.tx accounting
  - serial: tegra: Use uart_xmit_advance(), fixes icount.tx accounting
  - serial: Create uart_xmit_advance()
  - drm/amd/amdgpu: fixing read wrong pf2vf data in SRIOV
  - selftests: forwarding: add shebang for sch_red.sh
  - net: sched: fix possible refcount leak in tc_new_tfilter()
  - net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD
  - net/smc: Stop the CLC flow if no link to map buffers on
  - drm/mediatek: dsi: Move mtk_dsi_stop() call back to mtk_dsi_poweroff()
  - perf kcore_copy: Do not check /proc/modules is unchanged
  - perf jit: Include program header in ELF files
  - can: gs_usb: gs_can_open(): fix race dev->can.state condition
  - netfilter: ebtables: fix memory leak when blob is malformed
  - netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain()
  - netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain()
  - net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs
  - net/sched: taprio: avoid disabling offload when it was never enabled
  - net: socket: remove register_gifconf
  - net: enetc: move enetc_set_psfp() out of the common enetc_set_features()
  - wireguard: netlink: avoid variable-sized memcpy on sockaddr
  - wireguard: ratelimiter: disable timings test by default
  - net: ipa: properly limit modem routing table use
  - net: ipa: kill IPA_TABLE_ENTRY_SIZE
  - net: ipa: DMA addresses are nicely aligned
  - net: ipa: avoid 64-bit modulus
  - net: ipa: fix table alignment requirement
  - net: ipa: fix assumptions about DMA address size
  - of: mdio: Add of_node_put() when breaking out of for_each_xx
  - drm/hisilicon: Add depends on MMU
  - drm/hisilicon/hibmc: Allow to be built if COMPILE_TEST is enabled
  - sfc: fix null pointer dereference in efx_hard_start_xmit
  - sfc: fix TX channel offset when using legacy interrupts
  - i40e: Fix set max_tx_rate when it is lower than 1 Mbps
  - i40e: Fix VF set max MTU size
  - iavf: Fix set max MTU size with port VLAN and jumbo frames
  - iavf: Fix bad page state
  - MIPS: Loongson32: Fix PHY-mode being left unspecified
  - MIPS: lantiq: export clk_get_io() for lantiq_wdt.ko
  - drm/panel: simple: Fix innolux_g121i1_l01 bus_format
  - net: team: Unsync device addresses on ndo_stop
  - net: bonding: Unsync device addresses on ndo_stop
  - net: bonding: Share lacpdu_mcast_addr definition
  - scsi: mpt3sas: Fix return value check of dma_get_required_mask()
  - scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region
  - net: phy: aquantia: wait for the suspend/resume operations to finish
  - net: core: fix flow symmetric hash
  - net: let flow have same hash in two directions
  - iavf: Fix cached head and tail value for iavf_get_tx_pending
  - netfilter: nf_conntrack_sip: fix ct_sip_walk_headers
  - arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma
  - dmaengine: ti: k3-udma-private: Fix refcount leak bug in of_xudma_dev_get()
  - arm64: dts: rockchip: Set RK3399-Gru PCLK_EDP to 24 MHz
  - drm/mediatek: dsi: Add atomic {destroy,duplicate}_state, reset callbacks
  - arm64: dts: rockchip: Pull up wlan wake# on Gru-Bob
  - xfs: validate inode fork size against fork format
  - xfs: reorder iunlink remove operation in xfs_ifree
  - interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate
  - mm/slub: fix to return errno if kmalloc() fails
  - can: flexcan: flexcan_mailbox_read() fix return value for drop = true
  - riscv: fix a nasty sigreturn bug...
  - gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully
  - gpio: mockup: fix NULL pointer dereference when removing debugfs
  - wifi: mt76: fix reading current per-tid starting sequence number for aggregation
  - efi: libstub: check Shim mode using MokSBStateRT
  - efi: x86: Wipe setup_data on pure EFI boot
  - media: flexcop-usb: fix endpoint type check
  - iommu/vt-d: Check correct capability for sagaw determination
  - ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5530 laptop
  - ALSA: hda/realtek: Add quirk for ASUS GA503R laptop
  - ALSA: hda/realtek: Add pincfg for ASUS G533Z HP jack
  - ALSA: hda/realtek: Add pincfg for ASUS G513 HP jack
  - ALSA: hda/realtek: Re-arrange quirk table entries
  - ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5570 laptop
  - ALSA: hda/realtek: Add quirk for Huawei WRT-WX9
  - ALSA: hda: add Intel 5 Series / 3400 PCI DID
  - ALSA: hda/tegra: set depop delay for tegra
  - USB: serial: option: add Quectel RM520N
  - USB: serial: option: add Quectel BG95 0x0203 composition
  - arm64/bti: Disable in kernel BTI when cross section thunks are broken
  - arm64: Restrict ARM64_BTI_KERNEL to clang 12.0.0 and newer
  - Revert "usb: gadget: udc-xilinx: replace memcpy with memcpy_toio"
  - vfio/type1: Unpin zero pages
  - vfio/type1: Prepare for batched pinning with struct vfio_batch
  - vfio/type1: Change success value of vaddr_get_pfn()
  - Revert "usb: add quirks for Lenovo OneLink+ Dock"
  - usb: cdns3: fix issue with rearming ISO OUT endpoint
  - usb: cdns3: fix incorrect handling TRB_SMM flag for ISOC transfer
  - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
  - usb: add quirks for Lenovo OneLink+ Dock
  - tty: serial: atmel: Preserve previous USART mode if RS485 disabled
  - serial: atmel: remove redundant assignment in rs485_config
  - mmc: core: Fix inconsistent sd3_bus_mode at UHS-I SD voltage switch failure
  - usb: xhci-mtk: relax TT periodic bandwidth allocation
  - usb: xhci-mtk: allow multiple Start-Split in a microframe
  - usb: xhci-mtk: add some schedule error number
  - usb: xhci-mtk: add a function to (un)load bandwidth info
  - usb: xhci-mtk: use @sch_tt to check whether need do TT schedule
  - usb: xhci-mtk: add only one extra CS for FS/LS INTR
  - usb: xhci-mtk: get the microframe boundary for ESIT
  - usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop
  - usb: dwc3: gadget: Don't modify GEVNTCOUNT in pullup()
  - usb: dwc3: gadget: Refactor pullup()
  - usb: dwc3: gadget: Prevent repeat pullup()
  - usb: dwc3: Issue core soft reset before enabling run/stop
  - usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC unbind
  - usb: typec: intel_pmc_mux: Add new ACPI ID for Meteor Lake IOM device
  - usb: typec: intel_pmc_mux: Update IOM port status offset for AlderLake
  - drm/amdgpu: make sure to init common IP before gmc
  - drm/amdgpu: Separate vf2pf work item init from virt data exchange
  - drm/amdgpu: indirect register access for nv12 sriov
  - drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega
  - ALSA: hda/sigmatel: Fix unused variable warning for beep power change
  - mksysmap: Fix the mismatch of 'L0' symbols in System.map
  - MIPS: OCTEON: irq: Fix octeon_irq_force_ciu_mapping()
  - afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked
  - net: usb: qmi_wwan: add Quectel RM520N
  - ALSA: hda/tegra: Align BDL entry to 4KB boundary
  - ALSA: hda/sigmatel: Keep power up while beep is enabled
  - wifi: mac80211_hwsim: check length for virtio packets
  - rxrpc: Fix calc of resend age
  - rxrpc: Fix local destruction being repeated
  - regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe()
  - ASoC: nau8824: Fix semaphore unbalance at error paths
  - Revert "serial: 8250: Fix reporting real baudrate value in c_ospeed field"
  - tools/include/uapi: Fix <asm/errno.h> for parisc and xtensa
  - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM
  - cifs: revalidate mapping when doing direct writes
  - of/device: Fix up of_dma_configure_id() stub
  - tracing: hold caller_addr to hardirq_{enable,disable}_ip
  - parisc: ccio-dma: Add missing iounmap in error path in ccio_probe()
  - drm/meson: Fix OSD1 RGB to YCbCr coefficient
  - drm/meson: Correct OSD1 global alpha value
  - gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in mpc85xx
  - NFSv4: Turn off open-by-filehandle and NFS re-export for NFSv4.0
  - pinctrl: sunxi: Fix name for A100 R_PIO
  - of: fdt: fix off-by-one error in unflatten_dt_nodes()
  - net: dsa: mv88e6xxx: allow use of PHYs on CPU and DSA ports
  - platform/x86/intel: hid: add quirk to support Surface Go 3
  - usb: cdns3: gadget: fix new urb never complete if ep cancel previous requests
  - powerpc/pseries/mobility: ignore ibm, platform-facilities updates
  - powerpc/pseries/mobility: refactor node lookup during DT update
  - dmaengine: bestcomm: fix system boot lockups
  - parisc: Flush kernel data mapping in set_pte_at() when installing pte for user page
  - parisc: Optimize per-pagetable spinlocks
  - serial: 8250: Fix reporting real baudrate value in c_ospeed field
  - KVM: PPC: Tick accounting should defer vtime accounting 'til after IRQ handling
  - KVM: PPC: Book3S HV: Context tracking exit guest context before enabling irqs
  - !399 Backport fs, block and net bugfixes
  - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
  - ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap
  - ubifs: Re-statistic cleaned znode count if commit failed
  - ubifs: dirty_cow_znode: Fix memleak in error handling path
  - block, bfq: switch 'bfqg->ref' to use atomic refcount apis
  - cifs: sanitize multiple delimiters in prepath
  - bpf: Fix sockmap calling sleepable function in teardown path
  - bpf, sockmap: Fix sk->sk_forward_alloc warn_on in sk_stream_kill_queues
  - !394 Backport 5.10.143 - 5.10.144 LTS
  - Input: goodix - add compatible string for GT1158
  - soc: fsl: select FSL_GUTS driver for DPIO
  - mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
  - usb: storage: Add ASUS <0x0b05:0x1932> to IGNORE_UAS
  - platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes
  - perf/arm_pmu_platform: fix tests for platform_get_irq() failure
  - drm/amd/amdgpu: skip ucode loading if ucode_size == 0
  - nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change()
  - Input: iforce - add support for Boeder Force Feedback Wheel
  - ieee802154: cc2520: add rc code in cc2520_tx()
  - gpio: mockup: remove gpio debugfs when remove device
  - tg3: Disable tg3 device on system reboot to avoid triggering AER
  - hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message
  - HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo
  - drm/msm/rd: Fix FIFO-full deadlock
  - Input: goodix - add support for GT1158
  - tracefs: Only clobber mode/uid/gid on remount if asked
  - iommu/vt-d: Correctly calculate sagaw value of IOMMU
  - ARM: dts: imx6qdl-kontron-samx6i: fix spi-flash compatible
  - ARM: dts: imx: align SPI NOR node name with dtschema
  - hwmon: (mr75203) enable polling for all VM channels
  - hwmon: (mr75203) fix multi-channel voltage reading
  - hwmon: (mr75203) fix voltage equation for negative source input
  - hwmon: (mr75203) update pvt->v_num and vm_num to the actual number of used sensors
  - hwmon: (mr75203) fix VM sensor allocation when "intel,vm-map" not defined
  - iommu/amd: use full 64-bit value in build_completion_wait()
  - swiotlb: avoid potential left shift overflow
  - MIPS: loongson32: ls1c: Fix hang during startup
  - ASoC: mchp-spdiftx: Fix clang -Wbitfield-constant-conversion
  - ASoC: mchp-spdiftx: remove references to mchp_i2s_caps
  - tcp: fix early ETIMEDOUT after spurious non-SACK RTO
  - nvme-tcp: fix regression that causes sporadic requests to time out
  - nvme-tcp: fix UAF when detecting digest errors
  - RDMA/mlx5: Set local port to one when accessing counters
  - IB/core: Fix a nested dead lock as part of ODP flow
  - ipv6: sr: fix out-of-bounds read when setting HMAC data.
  - RDMA/siw: Pass a pointer to virt_to_page()
  - xen-netback: only remove 'hotplug-status' when the vif is actually destroyed
  - i40e: Fix kernel crash during module removal
  - ice: use bitmap_free instead of devm_kfree
  - tipc: fix shift wrapping bug in map_get()
  - afs: Use the operation issue time instead of the reply time for callbacks
  - rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2()
  - ALSA: usb-audio: Register card again for iface over delayed_register option
  - ALSA: usb-audio: Inform the delayed registration more properly
  - netfilter: nf_tables: clean up hook list when offload flags check fails
  - netfilter: br_netfilter: Drop dst references before setting.
  - ARM: dts: at91: sama5d2_icp: don't keep vdd_other enabled all the time
  - ARM: dts: at91: sama5d27_wlsom1: don't keep ldo2 enabled all the time
  - ARM: dts: at91: sama5d2_icp: specify proper regulator output ranges
  - ARM: dts: at91: sama5d27_wlsom1: specify proper regulator output ranges
  - RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift
  - soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs
  - RDMA/cma: Fix arguments order in net device validation
  - tee: fix compiler warning in tee_shm_register()
  - regulator: core: Clean up on enable failure
  - ARM: dts: imx6qdl-kontron-samx6i: remove duplicated node
  - smb3: missing inode locks in punch hole
  - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl()
  - scsi: lpfc: Add missing destroy_workqueue() in error path
  - scsi: mpt3sas: Fix use-after-free warning
  - drm/i915: Implement WaEdpLinkRateDataReload
  - nvmet: fix a use-after-free
  - debugfs: add debugfs_lookup_and_remove()
  - kprobes: Prohibit probes in gate area
  - ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
  - ALSA: aloop: Fix random zeros in capture data when using jiffies timer
  - ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
  - drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly
  - fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init()
  - net/core/skbuff: Check the return value of skb_copy_bits()
  - arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
  - parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines
  - parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources()
  - drm/radeon: add a force flush to delay work when radeon
  - drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup.
  - drm/amdgpu: Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to psp_hw_fini
  - drm/gem: Fix GEM handle release errors
  - scsi: megaraid_sas: Fix double kfree()
  - scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX
  - Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"
  - wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd()
  - efi: libstub: Disable struct randomization
  - tty: n_gsm: avoid call of sleeping functions from atomic context
  - tty: n_gsm: initialize more members at gsm_alloc_mux()
  - xen-blkfront: Cache feature_persistent value before advertisement
  - NFSD: Fix verifier returned in stable WRITEs


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.20.0.96
changelog:
  - !409 Backport CVEs and bugfixes
  - x86/kasan: Populate shadow for shared chunk of the CPU entry area
  - x86/kasan: Add helpers to align shadow addresses up and down
  - x86/kasan: Rename local CPU_ENTRY_AREA variables to shorten names
  - x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area
  - x86/mm: Recompute physical address for every page of per-CPU CEA mapping
  - x86/kasan: Map shadow for percpu pages on demand
  - x86/mm: Randomize per-cpu entry area
  - Huawei BMA: Fix iBMA driver bug
  - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath()
  - mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
  - vfio/iommu_type1: replace kvmalloc with kvzalloc and kfree with kvfree
  - vfio/iommu_type1: replace kfree with kvfree
  - ppp: associate skb with a device at tx
  - arm32: kaslr: Avoid using the -fpic and fno-pic parameters together
  - bpf, sockmap: fix race in sock_map_free()
  - bpf: make sure skb->len != 0 when redirecting to a tunneling device
  - raw: fix KABI for backporting raw RCU conversion patches
  - ipv6: Fix crash when IPv6 is administratively disabled
  - raw: remove unused variables from raw6_icmp_error()
  - raw: fix a typo in raw_icmp_error()
  - raw: complete rcu conversion
  - raw: Use helpers for the hlist_nulls variant.
  - raw: Fix mixed declarations error in raw_icmp_error().
  - raw: convert raw sockets to RCU
  - raw: use more conventional iterators
  - cifs: Fix use-after-free in rdata->read_into_pages()
  - net: bridge: mcast: add and enforce query interval minimum
  - net: bridge: mcast: add and enforce startup query interval minimum
  - media: vivid: fix compose size exceed boundary
  - !346 anolis: bond: broadcast ARP or ND messages to all slaves
  - !404 kvm: arm64: fix some pvsched bugs
  - kvm: arm64: fix some pvsched bugs
  - anolis: bond: broadcast ARP or ND messages to all slaves


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.21.0.97
changelog:
  - !417 Backport CVEs and bugfixes
  - net: mpls: fix stale pointer if allocation fails during device rename
  - x86/bugs: Flush IBP in ib_prctl_set()
  - binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
  - binder: Address corner cases in deferred copy and fixup
  - binder: fix pointer cast warning
  - binder: defer copies of pre-patched txn data
  - binder: read pre-translated fds from sender buffer
  - binder: avoid potential data leakage when copying txn
  - rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed
  - net/sched: sch_taprio: do not schedule in taprio_reset()
  - net/sched: sch_taprio: fix possible use-after-free
  - nbd: fix assignment error for first_minor in nbd_dev_add
  - md/raid10: fix wrong setting of max_corr_read_errors
  - md/raid10: fix overflow in safe_delay_store
  - md/raid10: fix slab-out-of-bounds in md_bitmap_get_counter
  - arm64: topology: fix possible overflow in amu_fie_setup()
  - ARM: 9242/1: kasan: Only map modules if CONFIG_KASAN_VMALLOC=n
  - io_uring: fix soft lockup in io_submit_sqes()
  - fix kabi broken due to import of 5.15-stable io_uring
  - io_uring: import 5.15-stable io_uring
  - task_work: add helper for more targeted task_work canceling
  - coredump: Limit what can interrupt coredumps
  - kernel: provide create_io_thread() helper
  - fs: provide locked helper variant of close_fd_get_file()
  - kernel: remove checking for TIF_NOTIFY_SIGNAL
  - entry: Add support for TIF_NOTIFY_SIGNAL
  - signal: Add task_sigpending() helper
  - arm: add support for TIF_NOTIFY_SIGNAL
  - arm64: add support for TIF_NOTIFY_SIGNAL
  - riscv: add support for TIF_NOTIFY_SIGNAL
  - powerpc: add support for TIF_NOTIFY_SIGNAL
  - x86: Wire up TIF_NOTIFY_SIGNAL
  - iov_iter: add helper to save iov_iter state
  - perf beauty: Update copy of linux/socket.h with the kernel sources
  - perf trace beauty: Update copy of linux/socket.h with the kernel sources
  - io_uring: correct pinned_vm accounting
  - file: Rename __close_fd_get_file close_fd_get_file
  - io_uring: don't hold uring_lock when calling io_run_task_work*
  - io_uring: don't take uring_lock during iowq cancel
  - fs: make do_renameat2() take struct filename
  - net: add accept helper not installing fd
  - net: provide __sys_shutdown_sock() that takes a socket
  - fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED
  - Make sure nd->path.mnt and nd->path.dentry are always valid pointers
  - fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy*
  - fs: add support for LOOKUP_CACHED
  - Revert "io_uring: fix soft lockup when call __io_remove_buffers"
  - Revert "io_uring: deduplicate failing task_work_add"
  - Revert "io_uring: don't take uring_lock during iowq cancel"
  - Revert "[Backport] io_uring: don't keep looping for more events if we can't flush overflow"
  - Revert "[Huawei] io-wq: Switch io_wqe_worker's fs before releasing request"
  - Revert "[Huawei] io_uring: fix soft lockup in io_submit_sqes()"
  - Revert "[Huawei] io_uring:drop identity before creating a private one"


author: Zheng Zengkai <zhengzengkai@huawei.com> - 5.10.0-136.22.0.98
changelog:
  - !455 Backport CVEs and bugfixes
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
  - HID: check empty report_list in bigben_probe()
  - HID: check empty report_list in hid_validate_values()
  - neigh: make sure used and confirmed times are valid
  - Documentation/hw-vuln: Fix rST warning
  - Documentation/hw-vuln: Add documentation for Cross-Thread Return Predictions
  - KVM: x86: Mitigate the cross-thread return address predictions bug
  - x86/speculation: Identify processors vulnerable to SMT RSB predictions
  - radi10: fix leak of 'r10bio->remaining' for recovery
  - md: fix soft lockup in status_resync
  - md: don't update recovery_cp when curr_resync is ACTIVE
  - md: Ensure resync is reported after it starts
  - md: Use enum for overloaded magic numbers used by mddev->curr_resync
  - raid10: fix leak of io accounting
  - tcp: Fix listen() regression in 5.15.88.
  - net/ulp: Remove redundant ->clone() test in inet_clone_ulp().
  - net/ulp: use consistent error code when blocking ULP
  - net/ulp: prevent ULP without clone op from entering the LISTEN status
  - net/tls: tls_is_tx_ready() checked list_entry
  - usb: dwc3: dwc3-qcom: Add missing platform_device_put() in dwc3_qcom_acpi_register_core
  - ntfs: fix out-of-bounds read in ntfs_attr_find()
  - splice: don't generate zero-len segement bvecs
  - rds: rds_rm_zerocopy_callback() use list_first_entry()
  - tap: tap_open(): correctly initialize socket uid
  - tun: tun_chr_open(): correctly initialize socket uid
  - net: add sock_init_data_uid()
  - ring-buffer: Handle race between rb_move_tail and rb_check_pages
  - blk-mq: use quiesced elevator switch when reinitializing queues
  - ovl: fix use inode directly in rcu-walk mode


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.23.0.99
changelog:
  - !484 Backport CVEs and bugfixes
  - scsi: cancel the inflight async device probe when remove scsi_target
  - ring-buffer: Fix race between reset page and reading page
  - raid1, raid10: switch to precise io accounting
  - block: add precise io accouting apis
  - md/raid10: fix memleak for 'conf->bio_split'
  - scsi: fix use-after-free problem in scsi_remove_target
  - sctp: fail if no bound addresses can be used for a given scope
  - ext4: fix WARNING in mb_find_extent
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
  - scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
  - scsi: iscsi: Move pool freeing
  - xfs: aborting inodes on shutdown may need buffer lock
  - ext4: fix incorrect options show of original mount_opt and extend mount_opt2
  - !473 [sync] PR-332: [5.10]Make Multiple functions On Netswift PCIE NIC belong to different IOMMU group
  - openeuler: pci: workaround multiple functions can be assigned to only one VM
  - !452 intel: backport isst issue fix and other update to align with upstream 6.0
  - !457 Backport CVEs and bugfixes
  - !464 Revert "scsi: fix iscsi rescan fails to create block"
  - Revert "scsi: fix iscsi rescan fails to create block"
  - phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
  - platform/x86: ISST: PUNIT device mapping with Sub-NUMA clustering
  - platform/x86: ISST: use semi-colons instead of commas
  - platform/x86: ISST: Mark mmio_range_devid_0 and mmio_range_devid_1 with static keyword
  - platform/x86: ISST: Change PCI device macros
  - platform/x86: ISST: Allow configurable offset range
  - platform/x86: ISST: Check for unaligned mmio address
  - platform/x86: ISST: Fix optimization with use of numa
  - platform/x86: ISST: Use numa node id for cpu pci dev mapping
  - platform/x86: ISST: Optimize CPU to PCI device mapping


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.24.0.100
changelog:
  - !513 Backport CVEs and bugfixes
  - livepatch/core: Fix hungtask against cpu hotplug on x86
  - seccomp: Move copy_seccomp() to no failure path.
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
  - mm: optimize do_wp_page() for fresh pages in local LRU pagevecs
  - mm: optimize do_wp_page() for exclusive pages in the swapcache
  - ftrace: Fix invalid address access in lookup_rec() when index is 0
  - tipc: add an extra conn_get in tipc_conn_alloc
  - tipc: set con sock in tipc_conn_alloc
  - ext4: fix another off-by-one fsmap error on 1k block filesystems
  - mm/vmalloc: huge vmalloc backing pages should be split rather than compound
  - HID: asus: use spinlock to safely schedule workers
  - HID: asus: use spinlock to protect concurrent accesses
  - HID: asus: Remove check for same LED brightness on set
  - jbd2: fix data missing when reusing bh which is ready to be checkpointed


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.25.0.101
changelog:
  - !530 Backport CVEs and bugfixes
  - block: fix use-after-free of q->q_usage_counter
  - block: move q_usage_counter release into blk_queue_release
  - Revert "block: fix null-deref in percpu_ref_put"
  - md/raid6: Fix the problem of repeatedly applying for memory in raid5_read_one_chunk
  - xfs, iomap: limit individual ioend chain lengths in writeback
  - net/sched: tcindex: search key must be 16 bits
  - net/sched: tcindex: update imperfect hash filters respecting rcu
  - tty: fix out-of-bounds access in tty_driver_lookup_tty()
  - fs/ntfs3: Validate resident attribute name
  - Revert "mm/vmalloc: huge vmalloc backing pages should be split rather than compound"
  - mm: compaction: avoid possible NULL pointer dereference in kcompactd_cpu_online
  - coredump: fix kabi broken in struct coredump_params
  - coredump: Use the vma snapshot in fill_files_note
  - coredump/elf: Pass coredump_params into fill_note_info
  - coredump: Remove the WARN_ON in dump_vma_snapshot
  - coredump: Snapshot the vmas in do_coredump
  - mm/swapfile: add cond_resched() in get_swap_pages()
  - mm: slince possible data races about pgdat->kswapd
  - mm: fix null-ptr-deref in kswapd_is_running()
  - fs/ntfs3: Validate MFT flags before replaying logs
  - fs/ntfs3: Validate attribute name offset
  - bpf: Fixes possible race in update_prog_stats() for 32bit arches
  - bpf: Avoid races in __bpf_prog_run() for 32bit arches
  - ext4: make sure fs error flag setted before clear journal error
  - ext4: commit super block if fs record error when journal record without error
  - ima: Fix memory leakage in ima_store_template
  - af_unix: Get user_ns from in_skb in unix_diag_get_exact().
  - net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
  - arm64: errata: Remove AES hwcap for COMPAT tasks
  - ARM: 9206/1: A9: Add ARM ERRATA 764319 workaround (Updated)
  - kernel: Initialize cpumask before parsing
  - softirq: Don't try waking ksoftirqd before it has been spawned
  - bpf: Prevent decl_tag from being referenced in func_proto arg
  - bpf: Skip task with pid=1 in send_signal_common()
  - bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
  - !461 Backport CVEs and bugfixes
  - !518 [sync] PR-374: Enable CONFIG_UPROBES_SUPPORT_PC_ALTER in arm64 by default
  - uprobe: enable CONFIG_UPROBES_SUPPORT_PC_ALTER in arm64
  - malidp: Fix NULL vs IS_ERR() checking


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.27.0.103
changelog:
  - !562 Backport CVEs and bugfixes
  - net: sched: Use struct_size() helper in kvmalloc()
  - net_sched: Use struct_size() and flex_array_size() helpers
  - ext4: dio take shared inode lock when overwriting preallocated blocks
  - ext4: fix race between writepages and remount
  - mm: mem_reliable: Initialize reliable_nr_page when mm_init()
  - clocksource/drivers/arm_arch_timer: Fix CNTPCT_LO and CNTVCT_LO value
  - kvm: initialize all of the kvm_debugregs structure before sending it to userspace
  - nvme: use nvme_cid to generate command_id in trace event
  - xfs: don't report reserved bnobt space as available
  - xfs: don't include bnobt blocks when reserving free block pool
  - xfs: set aside allocation btree blocks from block reservation
  - xfs: introduce in-core global counter of allocbt blocks
  - act_mirred: use the backlog for nested calls to mirred ingress
  - net/sched: act_mirred: better wording on protection against excessive stack growth
  - net/sched: act_mirred: refactor the handle of xmit
  - scsi: scsi_dh_alua: fix memleak for 'qdata' in alua_activate()
  - !557 net: hns3: modify reset delay time to avoid configuration timeout
  - net: hns3: modify reset delay time to avoid configuration timeout


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.28.0.104
changelog:
  - !573 Backport CVEs and bugfixes
  - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
  - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size
  - ubi: ensure that VID header offset + VID header size <= alloc, size
  - ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct()
  - perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach
  - ring-buffer: Fix race while reader and writer are on the same page
  - loop: Add parm check in loop_control_ioctl
  - ext4: Fix i_disksize exceeding i_size problem in paritally written case
  - ext4: ext4_put_super: Remove redundant checking for 'sbi->s_journal_bdev'
  - ext4: Fix reusing stale buffer heads from last failed mounting
  - btrfs: fix race between quota disable and quota assign ioctls
  - dm crypt: add cond_resched() to dmcrypt_write()
  - driver core: Fix lockdep warning on wfs_lock
  - driver core: platform: Add extra error check in devm_platform_get_irqs_affinity()
  - xfs: don't leak memory when attr fork loading fails
  - xfs: delete unnecessary NULL checks
  - xfs: replace inode fork size macros with functions
  - xfs: replace XFS_IFORK_Q with a proper predicate function
  - xfs: use XFS_IFORK_Q to determine the presence of an xattr fork
  - xfs: make inode attribute forks a permanent part of struct xfs_inode
  - xfs: convert XFS_IFORK_PTR to a static inline helper
  - xfs: don't reuse busy extents on extent trim
  - fs/xfs: convert comma to semicolon
  - xfs: xfs_ail_push_all_sync() stalls when racing with updates
  - xfs: check buffer pin state after locking in delwri_submit
  - xfs: log worker needs to start before intent/unlink recovery


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.29.0.105
changelog:
  - !589 [sync] PR-585:  x86/speculation: Allow enabling STIBP with legacy IBRS
  - !590 Backport CVEs and bugfixes
  - net/sched: Retire tcindex classifier
  - drm/vmwgfx: Validate the box size for the snooped cursor
  - netfilter: nf_tables: nft_parse_register can return a negative value
  - netfilter: nf_tables: validate registers coming from userspace.
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
  - KVM: nVMX: add missing consistency checks for CR0 and CR4
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
  - xfs: __percpu_counter_compare() inode count debug too expensive
  - xfs: fix memcpy fortify errors in EFI log format copying
  - xfs: fix memcpy fortify errors in RUI log format copying
  - xfs: fix memcpy fortify errors in CUI log format copying
  - xfs: fix memcpy fortify errors in BUI log format copying
  - xfs: Use struct xfs_bmdr_block instead of struct xfs_btree_block to calculate root node size
  - xfs: allow setting full range of panic tags
  - xfs: don't use BMBT btree split workers for IO completion
  - xfs: fix extent busy updating
  - xfs: get root inode correctly at bulkstat
  - xfs: invalidate xfs_bufs when allocating cow extents
  - xfs: attach dquots to inode before reading data/cow fork mappings
  - xfs: invalidate block device page cache during unmount
  - xfs: add selinux labels to whiteout inodes
  - xfs: convert buf_cancel_table allocation to kmalloc_array
  - xfs: don't leak xfs_buf_cancel structures when recovery fails
  - xfs: refactor buffer cancellation table allocation
  - xfs: fix type mismatches in the inode reclaim functions
  - xfs: don't allow log writes if the data device is readonly
  - x86/speculation: Allow enabling STIBP with legacy IBRS
  - !578  Backport 5.10.150 LTS
  - Revert "drm/amdgpu: make sure to init common IP before gmc"
  - gcov: support GCC 12.1 and newer compilers
  - f2fs: fix wrong condition to trigger background checkpoint correctly
  - thermal: intel_powerclamp: Use first online CPU as control_cpu
  - ext4: continue to expand file system when the target size doesn't reach
  - Revert "drm/amdgpu: use dirty framebuffer helper"
  - Revert "drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega"
  - net/ieee802154: don't warn zero-sized raw_sendmsg()
  - Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
  - net: ieee802154: return -EINVAL for unknown addr type
  - perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
  - clk: bcm2835: Make peripheral PLLC critical
  - usb: idmouse: fix an uninit-value in idmouse_open
  - nvmet-tcp: add bounds check on Transfer Tag
  - nvme: copy firmware_rev on each init
  - staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
  - Revert "usb: storage: Add quirk for Samsung Fit flash"
  - usb: musb: Fix musb_gadget.c rxstate overflow bug
  - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
  - md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
  - soundwire: intel: fix error handling on dai registration issues
  - soundwire: cadence: Don't overwrite msg->buf during write commands
  - bcache: fix set_at_max_writeback_rate() for multiple attached devices
  - ata: libahci_platform: Sanity check the DT child nodes number
  - blk-throttle: prevent overflow while calculating wait time
  - staging: vt6655: fix potential memory leak
  - power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
  - nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
  - scsi: 3w-9xxx: Avoid disabling device if failing to enable it
  - usb: host: xhci-plat: suspend/resume clks for brcm
  - usb: host: xhci-plat: suspend and resume clocks
  - clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
  - media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
  - clk: zynqmp: Fix stack-out-of-bounds in strncpy`
  - btrfs: scrub: try to fix super block errors
  - arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply
  - kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT
  - ARM: dts: imx6sx: add missing properties for sram
  - ARM: dts: imx6sll: add missing properties for sram
  - ARM: dts: imx6sl: add missing properties for sram
  - ARM: dts: imx6qp: add missing properties for sram
  - ARM: dts: imx6dl: add missing properties for sram
  - ARM: dts: imx6q: add missing properties for sram
  - ARM: dts: imx7d-sdb: config the max pressure for tsc2046
  - drm/amd/display: Remove interface for periodic interrupt 1
  - drm/dp: Don't rewrite link config when setting phy test pattern
  - mmc: sdhci-msm: add compatible string check for sdm670
  - drm/meson: explicitly remove aggregate driver at module unload time
  - drm/amdgpu: fix initial connector audio value
  - ASoC: SOF: pci: Change DMI match info to support all Chrome platforms
  - platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
  - platform/chrome: cros_ec: Notify the PM of wake events during resume
  - drm: panel-orientation-quirks: Add quirk for Anbernic Win600
  - drm/vc4: vec: Fix timings for VEC modes
  - drm: bridge: dw_hdmi: only trigger hotplug event on link change
  - udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
  - drm/amd/display: fix overflow on MIN_I64 definition
  - gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init()
  - drm: Prevent drm_copy_field() to attempt copying a NULL pointer
  - drm: Use size_t type for len variable in drm_copy_field()
  - drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
  - Bluetooth: L2CAP: Fix user-after-free
  - net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
  - wifi: rt2x00: correctly set BBP register 86 for MT7620
  - wifi: rt2x00: set SoC wmac clock register
  - wifi: rt2x00: set VGC gain for both chains of MT7620
  - wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
  - wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
  - can: bcm: check the result of can_send() in bcm_can_tx()
  - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
  - Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
  - regulator: core: Prevent integer underflow
  - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
  - xfrm: Update ipcomp_scratches with NULL when freed
  - wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
  - tcp: annotate data-race around tcp_md5sig_pool_populated
  - openvswitch: Fix overreporting of drops in dropwatch
  - openvswitch: Fix double reporting of drops in dropwatch
  - bpftool: Clear errno after libcap's checks
  - wifi: brcmfmac: fix invalid address access when enabling SCAN log level
  - NFSD: fix use-after-free on source server when doing inter-server copy
  - NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
  - x86/entry: Work around Clang __bdos() bug
  - thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
  - powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
  - MIPS: BCM47XX: Cast memcmp() of function to (void *)
  - ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
  - rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE()
  - rcu: Back off upon fill_page_cache_func() allocation failure
  - selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle
  - f2fs: fix to account FS_CP_DATA_IO correctly
  - f2fs: fix to avoid REQ_TIME and CP_TIME collision
  - f2fs: fix race condition on setting FI_NO_EXTENT flag
  - ACPI: APEI: do not add task_work to kernel thread to avoid memory leak
  - thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id
  - crypto: cavium - prevent integer overflow loading firmware
  - crypto: marvell/octeontx - prevent integer overflows
  - kbuild: rpm-pkg: fix breakage when V=1 is used
  - kbuild: remove the target in signal traps when interrupted
  - tracing: kprobe: Make gen test module work in arm and riscv
  - tracing: kprobe: Fix kprobe event gen test module on exit
  - iommu/iova: Fix module config properly
  - crypto: qat - fix DMA transfer direction
  - crypto: qat - use pre-allocated buffers in datapath
  - crypto: qat - fix use of 'dma_map_single'
  - crypto: inside-secure - Change swab to swab32
  - crypto: ccp - Release dma channels before dmaengine unrgister
  - crypto: akcipher - default implementation for setting a private key
  - iommu/omap: Fix buffer overflow in debugfs
  - cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
  - hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear()
  - crypto: sahara - don't sleep when in softirq
  - powerpc: Fix SPE Power ISA properties for e500v1 platforms
  - powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
  - x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
  - powerpc/powernv: add missing of_node_put() in opal_export_attrs()
  - powerpc/pci_dn: Add missing of_node_put()
  - powerpc/sysdev/fsl_msi: Add missing of_node_put()
  - powerpc/math_emu/efp: Include module.h
  - mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
  - clk: ast2600: BCLK comes from EPLL
  - clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
  - clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
  - clk: baikal-t1: Add SATA internal ref clock buffer
  - clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent
  - clk: baikal-t1: Fix invalid xGMAC PTP clock divider
  - clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD
  - spmi: pmic-arb: correct duplicate APID to PPID mapping logic
  - dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
  - clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent
  - mfd: sm501: Add check for platform_driver_register()
  - mfd: fsl-imx25: Fix check for platform_get_irq() errors
  - mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
  - mfd: lp8788: Fix an error handling path in lp8788_probe()
  - mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
  - mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
  - fsi: core: Check error number after calling ida_simple_get
  - clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical
  - scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
  - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
  - serial: 8250: Fix restoring termios speed after suspend
  - firmware: google: Test spinlock on panic path to avoid lockups
  - staging: vt6655: fix some erroneous memory clean-up loops
  - phy: qualcomm: call clk_disable_unprepare in the error handling
  - tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown
  - serial: 8250: Toggle IER bits on only after irq has been set up
  - serial: 8250: Add an empty line and remove some useless {}
  - drivers: serial: jsm: fix some leaks in probe
  - usb: gadget: function: fix dangling pnp_string in f_printer.c
  - xhci: Don't show warning for reinit on known broken suspend
  - IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers
  - RDMA/cm: Use SLID in the work completion as the DLID in responder side
  - md/raid5: Ensure stripe_fill happens on non-read IO with journal
  - md: Replace snprintf with scnprintf
  - mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
  - ata: fix ata_id_has_dipm()
  - ata: fix ata_id_has_ncq_autosense()
  - ata: fix ata_id_has_devslp()
  - ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
  - RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
  - mtd: rawnand: fsl_elbc: Fix none ECC mode
  - mtd: devices: docg3: check the return value of devm_ioremap() in the probe
  - dyndbg: drop EXPORTed dynamic_debug_exec_queries
  - dyndbg: let query-modname override actual module name
  - dyndbg: fix module.dyndbg handling
  - dyndbg: fix static_branch manipulation
  - dmaengine: hisilicon: Add multi-thread support for a DMA channel
  - dmaengine: hisilicon: Fix CQ head update
  - dmaengine: hisilicon: Disable channels when unregister hisi_dma
  - fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
  - misc: ocxl: fix possible refcount leak in afu_ioctl()
  - RDMA/rxe: Fix the error caused by qp->sk
  - RDMA/rxe: Fix "kernel NULL pointer dereference" error
  - media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
  - media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start()
  - tty: xilinx_uartps: Fix the ignore_status
  - media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
  - HSI: omap_ssi_port: Fix dma_map_sg error check
  - HSI: omap_ssi: Fix refcount leak in ssi_probe
  - clk: tegra20: Fix refcount leak in tegra20_clock_init
  - clk: tegra: Fix refcount leak in tegra114_clock_init
  - clk: tegra: Fix refcount leak in tegra210_clock_init
  - clk: sprd: Hold reference returned by of_get_parent()
  - clk: berlin: Add of_node_put() for of_get_parent()
  - clk: qoriq: Hold reference returned by of_get_parent()
  - clk: oxnas: Hold reference returned by of_get_parent()
  - clk: meson: Hold reference returned by of_get_parent()
  - usb: common: debug: Check non-standard control requests
  - usb: common: move function's kerneldoc next to its definition
  - usb: common: add function to get interval expressed in us unit
  - usb: common: Parse for USB SSP genXxY
  - usb: ch9: Add USB 3.2 SSP attributes
  - iio: ABI: Fix wrong format of differential capacitance channel ABI.
  - iio: inkern: only release the device node when done with it
  - iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume
  - iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
  - iio: adc: at91-sama5d2_adc: check return status for pressure and touch
  - iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
  - ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
  - ARM: Drop CMDLINE_* dependency on ATAGS
  - ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
  - soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA
  - ia64: export memory_add_physaddr_to_nid to fix cxl build error
  - ARM: dts: kirkwood: lsxl: remove first ethernet port
  - ARM: dts: kirkwood: lsxl: fix serial line
  - ARM: dts: turris-omnia: Fix mpp26 pin name and comment
  - soc: qcom: smem_state: Add refcounting for the 'state->of_node'
  - soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
  - memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
  - memory: of: Fix refcount leak bug in of_get_ddr_timings()
  - memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
  - ALSA: hda/hdmi: Don't skip notification handling during PM operation
  - ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe
  - ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
  - ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
  - ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
  - mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
  - ALSA: dmaengine: increment buffer pointer atomically
  - ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()
  - drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa()
  - drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
  - ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
  - mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
  - drm/omap: dss: Fix refcount leak bugs
  - ALSA: hda: beep: Simplify keep-power-at-enable behavior
  - ASoC: rsnd: Add check for rsnd_mod_power_on
  - drm/bridge: megachips: Fix a null pointer dereference bug
  - drm: fix drm_mipi_dbi build errors
  - platform/x86: msi-laptop: Fix resource cleanup
  - platform/x86: msi-laptop: Fix old-ec check for backlight registering
  - ASoC: tas2764: Fix mute/unmute
  - ASoC: tas2764: Drop conflicting set_bias_level power setting
  - ASoC: tas2764: Allow mono streams
  - platform/chrome: fix memory corruption in ioctl
  - platform/chrome: fix double-free in chromeos_laptop_prepare()
  - drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node()
  - drm/dp_mst: fix drm_dp_dpcd_read return value checks
  - drm/bridge: parade-ps8640: Fix regulator supply order
  - drm/mipi-dsi: Detach devices when removing the host
  - drm/bridge: Avoid uninitialized variable warning
  - drm: bridge: adv7511: fix CEC power down control register offset
  - once: add DO_ONCE_SLOW() for sleepable contexts
  - net/ieee802154: reject zero-sized raw_sendmsg()
  - net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
  - spi: Ensure that sg_table won't be used after being freed
  - tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
  - sctp: handle the error returned from sctp_auth_asoc_init_active_key
  - vhost/vsock: Use kvmalloc/kvfree for larger packets.
  - wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM
  - spi: s3c64xx: Fix large transfers with DMA
  - netfilter: nft_fib: Fix for rpath check with VRF devices
  - Bluetooth: hci_core: Fix not handling link timeouts propertly
  - i2c: mlxbf: support lock mechanism
  - spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
  - spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe
  - x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype
  - x86/microcode/AMD: Track patch allocation size explicitly
  - wifi: ath11k: fix number of VHT beamformee spatial streams
  - Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
  - bpf: Ensure correct locking around vulnerable function find_vpid()
  - net: fs_enet: Fix wrong check in do_pd_setup
  - wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask
  - wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
  - bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
  - spi: meson-spicc: do not rely on busy flag in pow2 clk ops
  - wifi: rtl8xxxu: Fix skb misuse in TX queue selection
  - spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
  - spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
  - selftests/xsk: Avoid use-after-free on ctx
  - wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
  - Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend
  - Bluetooth: btusb: fix excessive stack usage
  - Bluetooth: btusb: Fine-tune mt7663 mechanism.
  - x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register
  - spi: mt7621: Fix an error message in mt7621_spi_probe()
  - bpftool: Fix a wrong type cast in btf_dumper_int
  - wifi: mac80211: allow bw change during channel switch in mesh
  - leds: lm3601x: Don't use mutex after it was destroyed
  - wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
  - nfsd: Fix a memory leak in an error handling path
  - objtool: Preserve special st_shndx indexes in elf_update_symbol
  - ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
  - ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd()
  - MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create()
  - MIPS: SGI-IP27: Free some unused memory
  - sh: machvec: Use char[] for section boundaries
  - userfaultfd: open userfaultfds with O_RDONLY
  - selinux: use "grep -E" instead of "egrep"
  - smb3: must initialize two ACL struct fields to zero
  - drm/i915: Fix watermark calculations for gen12+ MC CCS modifier
  - drm/i915: Fix watermark calculations for gen12+ RC CCS modifier
  - drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
  - drm/nouveau/kms/nv140-: Disable interlacing
  - staging: greybus: audio_helper: remove unused and wrong debugfs usage
  - KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS
  - KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
  - KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
  - media: cedrus: Set the platform driver data earlier
  - efi: libstub: drop pointless get_memory_map() call
  - thunderbolt: Explicitly enable lane adapter hotplug events at startup
  - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
  - ring-buffer: Add ring_buffer_wake_waiters()
  - ring-buffer: Check pending waiters when doing wake ups as well
  - ring-buffer: Have the shortest_full queue be the shortest not longest
  - ring-buffer: Allow splice to read previous partially read pages
  - ftrace: Properly unset FTRACE_HASH_FL_MOD
  - livepatch: fix race between fork and KLP transition
  - ext4: update 'state->fc_regions_size' after successful memory allocation
  - ext4: fix potential memory leak in ext4_fc_record_regions()
  - ext4: fix potential memory leak in ext4_fc_record_modified_inode()
  - ext4: fix miss release buffer head in ext4_fc_write_inode
  - ext4: place buffer head allocation before handle start
  - ext4: don't increase iversion counter for ea_inodes
  - ext4: make ext4_lazyinit_thread freezable
  - ext4: avoid crash when inline data creation follows DIO write
  - jbd2: add miss release buffer head in fc_do_one_pass()
  - jbd2: fix potential use-after-free in jbd2_fc_wait_bufs
  - jbd2: fix potential buffer head reference count leak
  - jbd2: wake up journal waiters in FIFO order, not LIFO
  - hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero
  - hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO
  - hardening: Clarify Kconfig text for auto-var-init
  - f2fs: fix to do sanity check on summary info
  - f2fs: fix to do sanity check on destination blkaddr during recovery
  - f2fs: increase the limit for reserve_root
  - btrfs: fix race between quota enable and quota rescan ioctl
  - scsi: qedf: Populate sysfs attributes for vport
  - powerpc/boot: Explicitly disable usage of SPE instructions
  - powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain
  - PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
  - mm/mmap: undo ->mmap() when arch_validate_flags() fails
  - drm/udl: Restore display mode on resume
  - drm/virtio: Check whether transferred 2D BO is shmem
  - nvme-pci: set min_align_mask before calculating max_hw_sectors
  - UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
  - riscv: Pass -mno-relax only on lld < 15.0.0
  - riscv: Make VM_WRITE imply VM_READ
  - riscv: Allow PROT_WRITE-only mmap()
  - parisc: fbdev/stifb: Align graphics memory size to 4MB
  - RISC-V: Make port I/O string accessors actually work
  - regulator: qcom_rpm: Fix circular deferral regression
  - hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API
  - ASoC: wcd934x: fix order of Slimbus unprepare/disable
  - ASoC: wcd9335: fix order of Slimbus unprepare/disable
  - platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure
  - HID: multitouch: Add memory barriers
  - fs: dlm: handle -EBUSY first in lock arg validation
  - fs: dlm: fix race between test_bit() and queue_work()
  - mmc: sdhci-sprd: Fix minimum clock limit
  - can: kvaser_usb_leaf: Fix CAN state after restart
  - can: kvaser_usb_leaf: Fix TX queue out of sync after restart
  - can: kvaser_usb_leaf: Fix overread with an invalid command
  - can: kvaser_usb: Fix use of uninitialized completion
  - usb: add quirks for Lenovo OneLink+ Dock
  - iio: pressure: dps310: Reset chip after timeout
  - iio: pressure: dps310: Refactor startup procedure
  - iio: adc: ad7923: fix channel readings for some variants
  - iio: ltc2497: Fix reading conversion results
  - iio: dac: ad5593r: Fix i2c read protocol requirements
  - cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
  - cifs: destage dirty pages before re-reading them for cache=none
  - mtd: rawnand: atmel: Unmap streaming DMA mappings
  - ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
  - ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
  - ALSA: hda/realtek: Correct pin configs for ASUS G533Z
  - ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
  - ALSA: usb-audio: Fix NULL dererence at error path
  - ALSA: usb-audio: Fix potential memory leaks
  - ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
  - ALSA: oss: Fix potential deadlock at unregistration


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.30.0.106
changelog:
  - !631 Backport CVEs and bugfixes
  - bonding: Fix memory leak when changing bond type to Ethernet
  - bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
  - bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
  - rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975]
  - power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
  - mm: mem_reliable: Fix blank space issue in reliable_report_usage()
  - timers/nohz: Last resort update jiffies on nohz_full IRQ entry
  - xfs: don't leak btree cursor when insrec fails after a split
  - xfs: avoid unnecessary runtime sibling pointer endian conversions
  - xfs: detect self referencing btree sibling pointers
  - xfs: introduce xfs_buf_daddr()
  - xfs: move kernel-specific superblock validation out of libxfs
  - xfs: bound maximum wait time for inodegc work
  - xfs: introduce xfs_inodegc_push()
  - xfs: flush inodegc workqueue tasks before cancel
  - xfs: drop async cache flushes from CIL commits.
  - xfs: limit iclog tail updates
  - xfs: need to see iclog flags in tracing
  - io_uring: ensure that io_init_req() passes in the right issue_flags
  - io_uring: add missing lock in io_get_file_fixed


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.31.0.107
changelog:
  - !721 Backport CVEs and bugfixes
  - !694 [sync] PR-625: AMD: Fix build warning.
  - USB: gadgetfs: Fix race between mounting and unmounting
  - prlimit: do_prlimit needs to have a speculation check
  - ext4: check iomap type only if ext4_iomap_begin() does not fail
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern
  - net: qcom/emac: Fix use after free bug in emac_remove due to race condition
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
  - i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
  - ext4: only update i_reserved_data_blocks on successful block allocation
  - can: af_can: fix NULL pointer dereference in can_rcv_filter
  - RDMA/core: Refactor rdma_bind_addr
  - RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
  - scsi: dpt_i2o: Remove obsolete driver
  - writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs
  - bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
  - bpf, sockmap: Fix double bpf_prog_put on error case in map_link
  - bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap
  - bpf, sockmap: Attach map progs to psock early for feature probes
  - bpf, sockmap: Fix return codes from tcp_bpf_recvmsg_parser()
  - bpf, sockmap: Fix race in ingress receive verdict with redirect to self
  - kabi: Fix kabi breakage without build warning.
  - Revert "kabi: Fix kabi breakage caused by commit d5616bac7ada."


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.32.0.108
changelog:
  - !774 Backport CVEs and bugfixes
  - filemap: Correct the conditions for marking a folio as accessed
  - Revert "filemap: Correct the conditions for marking a folio as accessed"
  - netrom: Fix use-after-free caused by accept on already connected socket
  - bluetooth: Perform careful capability checks in hci_sock_ioctl()
  - fs/ntfs3: Delete duplicate condition in ntfs_read_mft()
  - fs/ntfs3: Fix slab-out-of-bounds read in run_unpack
  - fs/ntfs3: Validate data run offset
  - xfs: buffer pins need to hold a buffer reference
  - ovl: get_acl: Fix null pointer dereference at realinode in rcu-walk mode
  - fix kabi broken due to import new inode operation get_inode_acl
  - ovl: enable RCU'd ->get_acl()
  - vfs: add rcu argument to ->get_acl() callback
  - bpf: add missing header file include
  - uaccess: Add speculation barrier to copy_from_user()
  - !685 [sync] PR-675: driver/hifc&hinic: Fix compile error in allyesconfigs
  - scsi/hifc: Fix compile error in allyesconfigs
  - net/hinic: Fix compile error in allyesconfigs


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.33.0.109
changelog:
  - !801 Backport CVEs
  - netfilter: nf_tables: deactivate anonymous set from preparation phase
  - xfs: verify buffer contents when we skip log replay
  - !779 [sync] PR-768: Backport 5.10.151 LTS
  - kbuild: Add skip_encoding_btf_enum64 option to pahole
  - kbuild: Unify options for BTF generation for vmlinux and modules
  - kbuild: skip per-CPU BTF generation for pahole v1.18-v1.21
  - kbuild: Quote OBJCOPY var to avoid a pahole call break the build
  - bpf: Generate BTF_KIND_FLOAT when linking vmlinux


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.34.0.110
changelog:
  - !861 Backport CVEs and bugfixes
  - drm/virtio: Fix error code in virtio_gpu_object_shmem_init()
  - drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling
  - drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init
  - cgroup: Stop task iteration when rebinding subsystem
  - sched/topology: Fix exceptional memory access in sd_llc_free_all()
  - block: Fix the partition start may overflow in add_partition()
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum
  - iomap: don't invalidate folios after writeback errors
  - iomap: Don't create iomap_page objects in iomap_page_mkwrite_actor
  - iomap: Don't create iomap_page objects for inline files
  - iomap: Permit pages without an iop to enter writeback
  - md: fix kabi broken in struct mddev
  - md: use interruptible apis in idle/frozen_sync_thread
  - md: wake up 'resync_wait' at last in md_reap_sync_thread()
  - md: refactor idle/frozen_sync_thread()
  - md: add a mutex to synchronize idle and frozen in action_store()
  - md: refactor action_store() for 'idle' and 'frozen'
  - Revert "md: unlock mddev before reap sync_thread in action_store"
  - md: unlock mddev before reap sync_thread in action_store
  - block: fix wrong mode for blkdev_put() from disk_scan_partitions()
  - block: fix scan partition for exclusively open device again
  - block: merge disk_scan_partitions and blkdev_reread_part


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.35.0.111
changelog:
  - !905 [sync] PR-903: backport block bugfix
  - !963 [sync] PR-937:  tcp: restrict net.ipv4.tcp_app_win
  - !960 [sync] PR-925:  tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent
  - !956 [sync] PR-938:  config: Disable CONFIG_EULER_FS by default
  - tcp: restrict net.ipv4.tcp_app_win
  - tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent
  - config: Disable CONFIG_EULER_FS by default
  - !934 [sync] PR-922:  jbd2: fix checkpoint inconsistent
  - jbd2: remove t_checkpoint_io_list
  - jbd2: recheck chechpointing non-dirty buffer
  - !913 [sync] PR-906:  ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
  - ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
  - md/raid10: fix incorrect done of recovery
  - md/raid10: fix null-ptr-deref in raid10_sync_request
  - block/badblocks: fix badblocks loss when badblocks combine
  - block/badblocks: fix the bug of reverse order
  - md: fix unexpected changes of return value in rdev_set_badblocks
  - md/raid10: fix io hung in md_wait_for_blocked_rdev()
  - block: Only set bb->changed when badblocks changes
  - md/raid10: fix incorrect counting of rdev->nr_pending
  - md/raid10: remove WANR_ON_ONCE in raid10_end_write_request
  - md/raid10: fix uaf if replacement replaces rdev
  - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
  - md/raid10: fix io loss while replacement replace rdev
  - md/raid10: prioritize adding disk to 'removed' mirror
  - md: fix io loss when remove rdev fail
  - md/raid10: fix a race between removing rdev and access conf->mirrors[i].rdev
  - md/raid10: fix taks hung in raid10d
  - md/raid10: factor out code from wait_barrier() to stop_waiting_barrier()
  - md/raid10: fix softlockup in raid10_unplug
  - md/raid1: stop mdx_raid1 thread when raid1 array run failed
  - md: fix sysfs duplicate file while adding rdev
  - md: replace invalid function flush_rdev_wq() with flush_workqueue()
  - md: Flush workqueue md_rdev_misc_wq in md_alloc()
  - block: don't allow the same type rq_qos add more than once
  - blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost
  - blk-iocost: don't allow to configure bio based device
  - !870 [sync] PR-866:  arm64: kdump: Avoid reserving low memory repeatedly
  - arm64: kdump: Avoid reserving low memory repeatedly


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.36.0.112
changelog:
  - !1104 [sync] PR-1089:  power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
  - !1109 [sync] PR-1090:  fs/ntfs3: Check fields while reading
  - fs/ntfs3: Check fields while reading
  - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
  - !1062  Support dynamic_hugetlb on arm64 and fix some bug
  - !1058 [sync] PR-1028:  fs: hfsplus: fix UAF issue in hfsplus_put_super
  - mm/dynamic_hugetlb: fix type error of pfn in __hpool_split_gigantic_page()
  - mm/dynamic_hugetlb: set PagePool to bad page
  - mm/dynamic_hugetlb: replace spin_lock with mutex_lock and fix kabi broken
  - mm/dynamic_hugetlb: isolate hugepage without dissolve
  - mm/dynamic_hugetlb: support dynamic hugetlb on arm64
  - mm/dynamic_hugetlb: fix kabi broken when enable CONFIG_DYNAMIC_HUGETLB on arm64
  - !1021 [sync] PR-978:  io_uring: fix the problem of running
  - fs: hfsplus: fix UAF issue in hfsplus_put_super
  - !1051 [sync] PR-1027: scripts: Fix issue of module signing with openssl 3.x
  - scripts: Fix issue of module signing with openssl 3.x
  - !995 [sync] PR-990:  ubi: Fix deadlock caused by recursively holding work_sem
  - !1000 [sync] PR-928:  hikey9xx: Fixed incorrect use of kfree to free sreg
  - !1017 [sync] PR-944:  nbd: get config_lock before sock_shutdown
  - !1011 [sync] PR-924:  dm: add disk before alloc dax
  - !1014 [sync] PR-920:  dm thin: Fix ABBA deadlock by resetting dm_bufio_client
  - !951 [sync] PR-929:  xfs: rework feature flags
  - !972 [sync] PR-969:  kobject: Fix slab-out-of-bounds in fill_kobj_path()
  - !987 [sync] PR-954:  block: iocost bugfix
  - !984 [sync] PR-946:  icost bugfix
  - kernel: don't call do_exit() for PF_IO_WORKER threads
  - x86/process: setup io_threads more like normal user space threads
  - arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread()
  - arch: setup PF_IO_WORKER threads like PF_KTHREAD
  - nbd: get config_lock before sock_shutdown
  - dm thin: Fix ABBA deadlock by resetting dm_bufio_client
  - dm: add disk before alloc dax
  - hikey9xx: Fixed incorrect use of kfree to free sreg
  - ubi: Fix deadlock caused by recursively holding work_sem
  - mtd: ubi: wl: Fix a couple of kernel-doc issues
  - !976 [sync] PR-968:  Fix ORC unwinder on paravirt {save,restore}_fl
  - block: fix order error in blk_release_queue
  - block: fix null-pointer dereference in ioc_pd_init
  - blk-iocost: dispatch all throttled bio in ioc_pd_offline
  - blk-iocost: don't throttle bio if iocg is offlined
  - blk-iocost: track whether iocg is still online
  - blk-iocost: fix UAF in ioc_pd_free
  - x86/unwind: Fix check_paravirt() calls orc_find() before declaration
  - x86/unwind: Fix orc entry for paravirt {save,restore}_fl
  - kobject: Fix slab-out-of-bounds in fill_kobj_path()
  - xfs: kill xfs_sb_version_has_v3inode()
  - xfs: introduce xfs_sb_is_v5 helper
  - xfs: remove unused xfs_sb_version_has wrappers
  - xfs: convert xfs_sb_version_has checks to use mount features
  - xfs: convert scrub to use mount-based feature checks
  - xfs: open code sb verifier feature checks
  - xfs: convert xfs_fs_geometry to use mount feature checks
  - xfs: replace XFS_FORCED_SHUTDOWN with xfs_is_shutdown
  - xfs: convert remaining mount flags to state flags
  - xfs: convert mount flags to features
  - xfs: consolidate mount option features in m_features
  - xfs: replace xfs_sb_version checks with feature flag checks
  - xfs: reflect sb features in xfs_mount
  - xfs: rework attr2 feature and mount options
  - xfs: rename xfs_has_attr()
  - xfs: xfs_is_shutdown vs xlog_is_shutdown cage fight
  - xfs: log items should have a xlog pointer, not a mount
  - xfs: fix incorrect error-out in xfs_remove


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.37.0.113
changelog:
  - !1164 [sync] PR-1098:  proc: allow pid_revalidate() during LOOKUP_RCU
  - !1168 [sync] PR-1162:  fbcon: Check font dimension limits
  - fbcon: Check font dimension limits
  - proc: allow pid_revalidate() during LOOKUP_RCU
  - !582 mm: oom: move memcg_print_bad_task() out of  mem_cgroup_scan_tasks()
  - !1146 [sync] PR-1136:  gfs2: Don't deref jdesc in evict
  - gfs2: Don't deref jdesc in evict
  - !1025 [sync] PR-947:  locking/rwsem: Prevent potential lock starvation
  - !1072 [sync] PR-1042:  xfrm: Reinject transport-mode packets through workqueue
  - !1129 [sync] PR-1077:  drm/qxl: Fix missing free_irq
  - drm/qxl: Fix missing free_irq
  - xfrm: Reinject transport-mode packets through workqueue
  - locking/rwsem: Prevent potential lock starvation
  - locking/rwsem: Pass the current atomic count to rwsem_down_read_slowpath()
  - locking/rwsem: Better collate rwsem_read_trylock()
  - mm: oom: move memcg_print_bad_task() out of mem_cgroup_scan_tasks()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.38.0.114
changelog:
  - !1192 [sync] PR-1178:  memstick: r592: Fix UAF bug in r592_remove due to race condition
  - !1248 [sync] PR-1245:  hugetlb: Fix some incorrect behavior
  - hugetlb: fix hugepages_setup when deal with pernode
  - hugetlb: fix wrong use of nr_online_nodes
  - !1239 [sync] PR-1181:  relayfs: fix out-of-bounds access in relay_file_read
  - relayfs: fix out-of-bounds access in relay_file_read
  - !1210 [sync] PR-1185:  nbd: validate the block size in nbd_set_size
  - !1233 [sync] PR-1220:  mm/memory_hotplug: extend offline_and_remove_memory() to handle more than one memory block
  - mm/memory_hotplug: extend offline_and_remove_memory() to handle more than one memory block
  - !1225 [sync] PR-1221:  media: rkvdec: fix use after free bug in rkvdec_remove
  - media: rkvdec: fix use after free bug in rkvdec_remove
  - !1199 [sync] PR-1190:  memcg: fix implicit declaration of memcg_print_bad_task()
  - nbd: fix incomplete validation of ioctl arg
  - nbd: validate the block size in nbd_set_size
  - memcg: fix implicit declaration of memcg_print_bad_task()
  - memstick: r592: Fix UAF bug in r592_remove due to race condition
  - !1179 MAINTAINERS: update openEuler/MAINTAINERS for LoongArch
  - MAINTAINERS: update openEuler/MAINTAINERS for LoongArch


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.39.0.116
changelog:
  - !1251 [sync] PR-1191:  fix memory reliable related issues
  - !1230 [sync] PR-1194:  fix memleak with efi_fake_mem
  - !1275 [sync] PR-1253:  media: saa7134: fix use after free bug in saa7134_finidev due to race condition
  - !1302 [sync] PR-1283:  media: dm1105: Fix use after free bug in dm1105_remove due to race condition
  - !1305 [sync] PR-1269:  arm64: Add AMPERE1 to the Spectre-BHB affected list
  - !1300 [sync] PR-1270:  media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
  - arm64: Add AMPERE1 to the Spectre-BHB affected list
  - !1265 [sync] PR-1261:  usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition
  - !1188 [sync] PR-1177:  net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
  - media: saa7134: fix use after free bug in saa7134_finidev due to race condition
  - !1256 [sync] PR-1247:  HID: intel_ish-hid: Add check for ishtp_dma_tx_map
  - usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
  - HID: intel_ish-hid: Add check for ishtp_dma_tx_map
  - efi: Disable mirror feature during crashkernel
  - mm: mem_reliable: Update reliable page counter to zero if underflows
  - mm: mem_reliable: Fix reliable page counter mismatch problem
  - config: Disable EFI_FAKE_MEMMAP support for arm64 by default
  - efi: Fix UAF for arm64 when enable efi_fake_mem
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.40.0.117
changelog:
  - !1367 [sync] PR-1324:  io_uring: hold uring mutex around poll removal
  - !1363 [sync] PR-1287:  ipvlan:Fix out-of-bounds caused by unclear skb->cb
  - io_uring: hold uring mutex around poll removal
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb
  - !1343 [sync] PR-1272:  xfs: fix some problems recently
  - xfs: fix uninitialized variable access
  - xfs: set XFS_FEAT_NLINK correctly
  - xfs: don't leak perag when growfs fails
  - xfs: factor out xfs_destroy_perag()
  - xfs: fix warning in xfs_vm_writepages()
  - xfs: don't leak intent item when recovery intents fail
  - xfs: factor out xfs_defer_pending_abort
  - xfs: fix mounting failed caused by sequencing problem in the log records
  - Fix x86 provides error symbol


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.41.0.118
changelog:
  - !1290 [sync] PR-1262:  drm/msm/dpu: Add check for pstates
  - !1456 [sync] PR-1358:  Remove DECnet support from kernel
  - !1439 [sync] PR-1426:  netfilter: nf_tables: do not ignore genmask when looking up chain by id
  - !1460 [sync] PR-1425:  loop: loop_set_status_from_info() check before assignment
  - !1463 [sync] PR-1436: Fix CVE-2023-3117
  - !1318 [sync] PR-1285:  nbd: fix null-ptr-dereference while accessing 'nbd->config'
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
  - netfilter: nf_tables: fix chain binding transaction logic
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
  - loop: loop_set_status_from_info() check before assignment
  - Remove DECnet support from kernel
  - netfilter: nf_tables: do not ignore genmask when looking up chain by id
  - !1420 [sync] PR-1415:  Fix generic/299 fail
  - !1378 [sync] PR-1295:  blk-wbt: don't show valid wbt_lat_usec in
  - ext4: Add debug message to notify user space is out of free
  - Revert "ext4: Stop trying writing pages if no free blocks generated"
  - Merge branch 'openEuler-22.03-LTS-SP1' of https://gitee.com/openeuler/kernel into openEuler-22.03-LTS-SP1
  - !759 【kernel-openEuler-22.03-LTS-SP1】kernel：fix a type error with 5.10 kernel on openEuler 22.03 LTS SP1 system
  - Merge branch 'openEuler-22.03-LTS-SP1' of https://gitee.com/openeuler/kernel into openEuler-22.03-LTS-SP1
  - ubifs: Fix memory leak in do_rename
  - ubifs: Free memory for tmpfile name
  - !1389 [sync] PR-1312:  quota: fix race condition between dqput() and dquot_mark_dquot_dirty()
  - !1392 [sync] PR-1376:  jbd2: Check 'jh->b_transaction' before remove it from checkpoint
  - !1308 [sync] PR-1280: cgroup: always put cset in cgroup_css_set_put_fork
  - jbd2: Check 'jh->b_transaction' before remove it from checkpoint
  - quota: simplify drop_dquot_ref()
  - quota: fix dqput() to follow the guarantees dquot_srcu should provide
  - quota: add new helper dquot_active()
  - quota: rename dquot_active() to inode_quota_active()
  - quota: factor out dquot_write_dquot()
  - Merge branch 'openEuler-22.03-LTS-SP1' of https://gitee.com/openeuler/kernel into openEuler-22.03-LTS-SP1
  - !1329 [sync] PR-1325:  jbd2: fix several checkpoint
  - !1332 [sync] PR-1314:  ext4: Stop trying writing pages if no free blocks generated
  - dm thin: fix deadlock when swapping to thin device
  - blk-wbt: don't show valid wbt_lat_usec in sysfs while wbt is disabled
  - blk-wbt: make enable_state more accurate
  - !1340 [sync] PR-1286:  ext4: turning quotas off if mount failed after enable quotas
  - ext4: turning quotas off if mount failed after enable quotas
  - ext4: Stop trying writing pages if no free blocks generated
  - jbd2: fix checkpoint cleanup performance regression
  - jbd2: remove __journal_try_to_free_buffer()
  - jbd2: fix a race when checking checkpoint buffer busy
  - jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
  - jbd2: remove journal_clean_one_cp_list()
  - nbd: fix null-ptr-dereference while accessing 'nbd->config'
  - nbd: factor out a helper to get nbd_config without holding 'config_lock'
  - nbd: fold nbd config initialization into nbd_alloc_config()
  - cgroup: always put cset in cgroup_css_set_put_fork
  - drm/msm/dpu: Add check for pstates
  - spdxcheck.py: Fix a type error


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.42.0.120
changelog:
  - !1525 [sync] PR-1482:  CVE-2023-3567 fix patches
  - !1336 [sync] PR-1335:  bpf: Fix incorrect verifier pruning due to missing register precision taints
  - vc_screen: modify vcs_size() handling in vcs_read()
  - vc_screen: don't clobber return value in vcs_read
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
  - !1490 [sync] PR-1476:  ipv6/addrconf: fix a potential refcount underflow for idev
  - !1486 [sync] PR-1452:  media: dvb-core: Fix use-after-free due on race condition at dvb_net
  - !1495 [sync] PR-1445:  netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
  - ipv6/addrconf: fix a potential refcount underflow for idev
  - media: dvb-core: Fix use-after-free due on race condition at dvb_net
  - !1422 [sync] PR-1254:  Two CVE fixes of ksmbd
  - ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem()
  - ksmbd: fix memleak in session setup
  - bpf: Fix incorrect verifier pruning due to missing register precision taints


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.43.0.121
changelog:
  - !1588 [sync] PR-1557:  net/sched: cls_fw: Fix improper refcount update leads to use-after-free
  - !1583 [sync] PR-1480:  ksmbd: fix wrong UserName check in session_user
  - !1599 [sync] PR-1547:  binder: fix UAF caused by faulty buffer cleanup
  - !1602 [sync] PR-1581:  psi: fix compile error for psi cgroupv1 when CONFIG_CGROUP=n
  - !1615 [sync] PR-1591:  net/sched: cls_u32: Fix reference counter leak leading to overflow
  - net/sched: cls_u32: Fix reference counter leak leading to overflow
  - !1593 [sync] PR-1585:  ksmbd: fix global-out-of-bounds in smb2_find_context_vals
  - psi: fix compile error for psi cgroupv1 when CONFIG_CGROUP=n
  - binder: fix UAF caused by faulty buffer cleanup
  - ksmbd: fix global-out-of-bounds in smb2_find_context_vals
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free
  - ksmbd: fix wrong UserName check in session_user
  - !1465 [sync] PR-1428:  scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
  - !1574 [sync] PR-1535:  net/sched: sch_qfq: account for stab overhead in qfq_enqueue
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue
  - !1559 [sync] PR-1548:  mm: memcontrol: fix cannot alloc the maximum memcg ID
  - !1362 [sync] PR-1294:  dm stats: check for and propagate alloc_percpu failure
  - !1503  block: don't set GD_NEED_PART_SCAN if scan partition failed
  - !1478 [sync] PR-1345:  dm: requeue IO if mapping table not yet
  - mm: memcontrol: fix cannot alloc the maximum memcg ID
  - block: don't set GD_NEED_PART_SCAN if scan partition failed
  - dm: don't lock fs when the map is NULL during suspend or resume
  - dm: don't lock fs when the map is NULL in process of resume
  - dm: requeue IO if mapping table not yet available
  - Revert "dm: make sure dm_table is binded before queue request"
  - scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
  - dm stats: check for and propagate alloc_percpu failure


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.44.0.122
changelog:
  - !1703 [sync] PR-1682:  netfilter: nft_set_pipapo: fix improper element removal
  - !1675 [sync] PR-1596:  ksmbd: fix out-of-bound read in deassemble_neg_contexts()
  - netfilter: nft_set_pipapo: fix improper element removal
  - !1642 [sync] PR-1551:  ksmbd: allocate one more byte for implied bcc[0
  - !1644 [sync] PR-1605:  CVE-2023-38430
  - ksmbd: fix out-of-bound read in deassemble_neg_contexts()
  - ksmbd: validate smb request protocol id
  - ksmbd: define SMB2_COMPRESSION_TRANSFORM_ID in fs/ksmbd/smb2pdu.h
  - ksmbd: allocate one more byte for implied bcc[0]
  - ksmbd: validate smb request protocol id
  - ksmbd: define SMB2_COMPRESSION_TRANSFORM_ID in fs/ksmbd/smb2pdu.h


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.45.0.123
changelog:
  - !1757 [sync] PR-1742:  cxgb4: fix use after free bugs caused by circular dependency problem
  - !1764 [sync] PR-1749:  Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync()
  - !1669 [sync] PR-1657:  media: usb: siano: Fix CVE-2023-4132
  - Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync()
  - !1754 [sync] PR-1737:  ksmbd: fix out of bounds read in smb2_sess_setup
  - cxgb4: fix use after free bugs caused by circular dependency problem
  - !1745 [sync] PR-1727:  add support for timer_shutdown() api
  - !1732 [sync] PR-1713:  netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
  - ksmbd: fix out of bounds read in smb2_sess_setup
  - timers: Keep del_timer[_sync]() exported
  - timers: Provide timer_shutdown[_sync]()
  - timers: Add shutdown mechanism to the internal functions
  - timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode
  - timers: Silently ignore timers with a NULL function
  - timers: Rename del_timer() to timer_delete()
  - timers: Rename del_timer_sync() to timer_delete_sync()
  - timers: Use del_timer_sync() even on UP
  - timers: Update kernel-doc for various functions
  - timers: Replace BUG_ON()s
  - timers: Get rid of del_singleshot_timer_sync()
  - sw64: Do not use timer namespace for timer_shutdown() function
  - clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function
  - clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function
  - ARM: spear: Do not use timer namespace for timer_shutdown() function
  - !1715 [sync] PR-1711:  xfrm: add NULL check in xfrm_update_ae_params
  - !1633 [sync] PR-1604:  net: nfc: Fix CVE-2023-3863
  - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
  - xfrm: add NULL check in xfrm_update_ae_params
  - media: usb: siano: Fix warning due to null work_func_t function pointer
  - media: usb: siano: Fix use after free bugs caused by do_submit_urb
  - net: nfc: Fix use-after-free caused by nfc_llcp_find_local
  - nfc: llcp: simplify llcp_sock_connect() error paths


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.46.0.124
changelog:
  - !1839  fix CVE-2023-20593 for openEuler
  - tools arch x86: Sync the msr-index.h copy with the kernel sources
  - x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
  - x86/cpu/amd: Add a Zenbleed fix
  - x86/cpu/amd: Move the errata checking functionality up
  - x86/cpu: Restore AMD's DE_CFG MSR after resume
  - !1776 [sync] PR-1729:  fix CVE-2023-4128 in OLK510
  - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
  - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.47.0.125
changelog:
  - !1892 [sync] PR-1784:  tun/tap: fix CVE-2023-4194
  - !1886 [sync] PR-1815:  Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
  - !1867 [sync] PR-1821:  nbd: pass nbd_sock to nbd_read_reply() instead of index
  - !1781 [sync] PR-1766:  xen/netback: Fix buffer overrun triggered by unusual packet
  - !1889 [sync] PR-1835:  tcp: Reduce chance of collisions in inet6_hashfn().
  - net: tap_open(): set sk_uid from current_fsuid()
  - net: tun_chr_open(): set sk_uid from current_fsuid()
  - tcp: Reduce chance of collisions in inet6_hashfn().
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
  - !1828 [sync] PR-1813:  ksmbd: fix cve-2023-38432
  - nbd: pass nbd_sock to nbd_read_reply() instead of index
  - ksmbd: validate command request size
  - ksmbd: validate command payload size
  - xen/netback: Fix buffer overrun triggered by unusual packet


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.48.0.126
changelog:
  - !2003 [sync] PR-1911:  ksmbd: fix out-of-bound read in smb2_write
  - !2010  block: don't get gendisk if queue has not been registered
  - block: don't get gendisk if queue has not been registered
  - !1627 [sync] PR-1621:  fix three CVEs by backport mainline patchs
  - !1818 [sync] PR-1788:  exfat: check if filename entries exceeds max filename length
  - ksmbd: fix out-of-bound read in smb2_write
  - !1980 [sync] PR-1446:  Fix the default return value of dm_pool_dec_data_range()
  - Fix the default return value of dm_pool_dec_data_range()
  - !1385 [sync] PR-1346:  dm thin metadata: check fail_io before using data_sm
  - exfat: check if filename entries exceeds max filename length
  - ksmbd: fix racy issue from session setup and logoff
  - ksmbd: Fix spelling mistake "excceed" -> "exceeded"
  - ksmbd: limit pdu length size according to connection status
  - ksmbd: Implements sess->ksmbd_chann_list as xarray
  - dm thin metadata: check fail_io before using data_sm


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.49.0.127
changelog:
  - !2146  netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
  - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
  - !2139  net/sched: sch_hfsc: Ensure inner classes have fsc curve
  - !2138  netfilter: nf_tables: skip bound chain on rule flush
  - !2136  af_unix: Fix null-ptr-deref in unix_stream_sendpage().
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve
  - netfilter: nf_tables: skip bound chain on rule flush
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage().
  - !2114  Fixed 4 CVEs of the ksmbd
  - !2077 [sync] PR-2065:  dm: switch to precise io accounting
  - ksmbd: not allow guest user on multichannel
  - ksmbd: fix deadlock in ksmbd_find_crypto_ctx()
  - ksmbd: block asynchronous requests when making a delay on session setup
  - ksmbd: destroy expired sessions
  - !1926 [sync] PR-1883:  SUNRPC: don't pause on incomplete allocation
  - dm: switch to precise io accounting
  - !2058 [sync] PR-2055: Only enable unicast promisc when mac table full to fix the hns3 bug
  - SUNRPC: don't pause on incomplete allocation
  - net: hns3: only enable unicast promisc when mac table full
  - !2048 [sync] PR-1752:  ksmbd: validate session id and tree id in the compound request
  - ksmbd: validate session id and tree id in the compound request


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.50.0.129
changelog:
  - !2221 [sync] PR-2210:  jbd2: Fix potential data lost in recovering journal raced with synchronizing fs bdev
  - !2232 [sync] PR-2086:  fix CVE-2023-20588
  - !2240 [sync] PR-2169:  net: sched: sch_qfq: Fix UAF in qfq_dequeue()
  - !2243 [sync] PR-2230:  media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
  - !2234 [sync] PR-1962:  x86/speculation: Add force option to GDS mitigation
  - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue()
  - x86: Move gds_ucode_mitigated() declaration to header
  - Documentation/x86: Fix backwards on/off logic about YMM support
  - KVM: Add GDS_NO support to KVM
  - x86/speculation: Add Kconfig option for GDS
  - x86/speculation: Add force option to GDS mitigation
  - x86/CPU/AMD: Fix the DIV(0) initial fix attempt
  - x86/CPU/AMD: Do not leak quotient data after a division by 0
  - !1878 [sync] PR-1826:  x86/speculation: Add Gather Data Sampling mitigation
  - jbd2: Fix potential data lost in recovering journal raced with synchronizing fs bdev
  - !2204 [sync] PR-2153:  netfilter: nftables: exthdr: fix 4-byte stack OOB write
  - netfilter: nftables: exthdr: fix 4-byte stack OOB write
  - !2152  io_uring: ensure IOPOLL locks around deferred work
  - io_uring: ensure IOPOLL locks around deferred work
  - x86/speculation: Add cpu_show_gds() prototype
  - x86/speculation: Add Gather Data Sampling mitigation


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.51.0.130
changelog:
  - !2392  netfilter: nf_tables: disallow rule removal from chain binding
  - netfilter: nf_tables: disallow rule removal from chain binding
  - !2385  nf_table LTS
  - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
  - netfilter: nf_tables: skip bound chain on rule flush
  - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails
  - netfilter: nf_tables: drop map element references from preparation phase
  - netfilter: nftables: rename set element data activation/deactivation functions
  - netfilter: nf_tables: reject unbound chain set before commit phase
  - netfilter: nf_tables: reject unbound anonymous set before commit phase
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
  - netfilter: nf_tables: fix chain binding transaction logic
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
  - netfilter: nf_tables: use net_generic infra for transaction data
  - Revert "netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID"
  - Revert "netfilter: nf_tables: skip bound chain on rule flush"
  - Revert "netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE"
  - Revert "netfilter: nf_tables: fix chain binding transaction logic"
  - Revert "netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain"
  - Revert "netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR"
  - Revert "netfilter: nf_tables: unbind non-anonymous set if rule construction fails"
  - !2379 [sync] PR-2359:  netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
  - !2278 [sync] PR-2269:  etmem: Fixed an issue where the module reference counting is incorrect
  - etmem: Fixed an issue where the module reference counting is incorrect
  - !2250 [sync] PR-2224:  ext4: fix rec_len verify error
  - ext4: fix rec_len verify error


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.52.0.131
changelog:
  - !2421 [sync] PR-2323:  net/sched: Retire rsvp classifier
  - net/sched: Retire rsvp classifier
  - !1417  Replace the hulk patch with the lts patch
  - !2367 [sync] PR-2282:  sdei_watchdog: Avoid exception during sdei handler
  - sdei_watchdog: Avoid exception during sdei handler
  - cgroup: Do not corrupt task iteration when rebinding subsystem
  - Revert "cgroup: Stop task iteration when rebinding subsystem"


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.53.0.132
changelog:
  - !2691 [sync] PR-2666:  net: xfrm: Fix xfrm_address_filter OOB read
  - !2374 [sync] PR-2258:  ext4: do not mark inode dirty every time when appending using delalloc
  - !2638 [sync] PR-2454:  igb: set max size RX buffer when store bad packet is enabled
  - net: xfrm: Fix xfrm_address_filter OOB read
  - !2532 [sync] PR-2370:  ipv4: fix null-deref in ipv4_link_failure
  - !2525 [sync] PR-2440:  netfilter: xt_u32: validate user space input
  - !2531 [sync] PR-2411:  netfilter: xt_sctp: validate the flag_info count
  - !2528 [sync] PR-2410:  netfilter: nfnetlink_osf: avoid OOB read
  - !2659 [sync] PR-2628:  ubi: Refuse attaching if mtd's erasesize is 0
  - !2662  arm64: fix a concurrency issue in emulation_proc_handler()
  - arm64: armv8_deprecated: fix unused-function error
  - arm64: armv8_deprecated: rework deprected instruction handling
  - arm64: armv8_deprecated: move aarch32 helper earlier
  - arm64: armv8_deprecated move emulation functions
  - arm64: armv8_deprecated: fold ops into insn_emulation
  - arm64: rework EL0 MRS emulation
  - arm64: factor insn read out of call_undef_hook()
  - arm64: factor out EL1 SSBS emulation hook
  - arm64: split EL0/EL1 UNDEF handlers
  - arm64: allow kprobes on EL0 handlers
  - arm64: rework BTI exception handling
  - arm64: rework FPAC exception handling
  - arm64: consistently pass ESR_ELx to die()
  - arm64: die(): pass 'err' as long
  - Revert "arm64: fix a concurrency issue in emulation_proc_handler()"
  - ubi: Refuse attaching if mtd's erasesize is 0
  - !2648 [sync] PR-2641:  Fix CVE-2023-5717
  - perf: Fix kabi breakage in struct perf_event
  - perf: Disallow mis-matched inherited group reads
  - !2640 [sync] PR-2558:  USB: ene_usb6250: Allocate enough memory for full object
  - !2570  Fix cgroup poll UAF
  - !2520 [sync] PR-2437:  crypto: drbg - Only fail when jent is unavailable in FIPS mode
  - USB: ene_usb6250: Allocate enough memory for full object
  - igb: set max size RX buffer when store bad packet is enabled
  - !2596 [sync] PR-2573:  media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
  - !2567 [sync] PR-2557:  Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
  - !2581 [sync] PR-2476:  Fixed five CVEs vulnerabilities of ksmbd
  - !2622 [sync] PR-2613:  CVE-2022-44033
  - char: pcmcia: remove all the drivers
  - tty: ipwireless: move Kconfig entry to tty
  - !2585 [sync] PR-2571:  xen/events: replace evtchn_rwlock with RCU
  - media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
  - xen/events: replace evtchn_rwlock with RCU
  - ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN
  - ksmbd: fix infinite loop in ksmbd_conn_handler_loop()
  - ksmbd: send proper error response in smb2_tree_connect()
  - ksmbd: fix racy issue from smb2 close and logoff with multichannel
  - ksmbd: call rcu_barrier() in ksmbd_server_exit()
  - ksmbd: fix racy issue under cocurrent smb2 tree disconnect
  - sched/psi: Select KERNFS as needed
  - kernfs: add stub helper for kernfs_generic_poll()
  - sched/psi: use kernfs polling functions for PSI trigger polling
  - Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
  - ipv4: fix null-deref in ipv4_link_failure
  - netfilter: xt_sctp: validate the flag_info count
  - netfilter: nfnetlink_osf: avoid OOB read
  - netfilter: xt_u32: validate user space input
  - !2515 [sync] PR-2499:  f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
  - crypto: drbg - Only fail when jent is unavailable in FIPS mode
  - !2486 [sync] PR-2340:  xfs: recent patches to fix xfs issues
  - f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
  - xfs: update the last_sync_lsn with ctx start lsn
  - xfs: shutdown xfs once inode double free
  - xfs: fix off-by-one-block in xfs_discard_folio()
  - xfs: xfs_bmap_punch_delalloc_range() should take a byte range
  - iomap: buffered write failure should not truncate the page cache
  - xfs,iomap: move delalloc punching to iomap
  - xfs: use byte ranges for write cleanup ranges
  - xfs: punching delalloc extents on write failure is racy
  - xfs: longest free extent no need consider postalloc
  - xfs: fix xfs shutdown since we reserve more blocks in agfl fixup
  - xfs: block reservation too large for minleft allocation
  - xfs: set minleft correctly for randomly sparse inode allocations
  - xfs: shutdown to ensure submits buffers on LSN boundaries
  - xfs: don't verify agf length when log recovery
  - xfs: Remove redundant assignment to busy
  - xfs: remove redundant pointer lip
  - xfs: remove redundant initializations of pointers drop_leaf and save_leaf
  - xfs: xfs_trans_cancel() path must check for log shutdown
  - xfs: fix bounds check in xfs_defer_agfl_block()
  - xfs: AGF length has never been bounds checked
  - xfs: journal geometry is not properly bounds checked
  - xfs: don't block in busy flushing when freeing extents
  - xfs: allow extent free intents to be retried
  - xfs: pass alloc flags through to xfs_extent_busy_flush()
  - Revert "xfs: propagate the return value of xfs_log_force() to avoid soft lockup"
  - xfs: use deferred frees for btree block freeing
  - xfs: don't reverse order of items in bulk AIL insertion
  - xfs: validate block number being freed before adding to xefi
  - xfs: validity check agbnos on the AGFL
  - xfs: pass xfs_extent_free_item directly through the log intent code
  - xfs: remove unused parameter from refcount code
  - xfs: reduce the size of struct xfs_extent_free_item
  - xfs: rename xfs_bmap_add_free to xfs_free_extent_later
  - xfs: create slab caches for frequently-used deferred items
  - xfs: compact deferred intent item structures
  - xfs: rename _zone variables to _cache
  - xfs: remove kmem_zone typedef
  - xfs: remove xfs_setattr_time() declaration
  - xfs: use setattr_copy to set vfs inode attributes
  - xfs: set prealloc flag in xfs_alloc_file_space()
  - xfs: don't assert fail on perag references on teardown
  - xfs: fix dir3 block read verify fail during log recover
  - xfs: propagate the return value of xfs_log_force() to avoid soft lockup
  - xfs: keep growfs sb log item active until ail flush success
  - !1142 [sync] PR-953:  xfs: fixes patchs and backport patchs
  - ext4: do not mark inode dirty every time when appending using delalloc
  - xfs: atomic drop extent entries when inactiving attr
  - xfs: factor out __xfs_da3_node_read()
  - xfs: fix a UAF in xfs_iflush_abort_clean
  - xfs: fix a UAF when inode item push
  - xfs: fix the problem of mount failure caused by not refreshing mp->m_sb
  - iomap: iomap: fix memory corruption when recording errors during writeback
  - xfs: fix hung when transaction commit fail in xfs_inactive_ifree
  - xfs: fix dead loop when do mount with IO fault injection
  - xfs: fix ag count overflow during growfs
  - xfs: account extra freespace btree splits for multiple allocations
  - xfs: force shutdown xfs when xfs_attr_inactive fails
  - xfs: fix negative array access in xfs_getbmap
  - xfs: fix BUG_ON in xfs_getbmap()
  - xfs: use iomap_valid method to detect stale cached iomaps
  - iomap: write iomap validity checks
  - xfs: write page faults in iomap are not buffered writes
  - xfs: fix exception caused by unexpected illegal bestcount in leaf dir
  - Revert "[Huawei] xfs: fix uaf when leaf dir bestcount not match with dir data blocks"
  - xfs: don't expose internal symlink metadata buffers to the vfs
  - xfs: shut down filesystem if we xfs_trans_cancel with deferred work items
  - xfs: fix maxlevels comparisons in the btree staging code
  - xfs: sb verifier doesn't handle uncached sb buffer
  - xfs: fallocate() should call file_modified()
  - xfs: remove XFS_PREALLOC_SYNC
  - xfs: shutdown during log recovery needs to mark the log shutdown
  - xfs: xfs_trans_commit() path must check for log shutdown
  - xfs: xfs_do_force_shutdown needs to block racing shutdowns
  - xfs: log shutdown triggers should only shut down the log
  - xfs: shutdown in intent recovery has non-intent items in the AIL
  - xfs: AIL should be log centric
  - xfs: increase rename inode reservation
  - xfs: trim the mapp array accordingly in xfs_da_grow_inode_int
  - xfs: check return codes when flushing block devices
  - xfs: remove xfs_blkdev_issue_flush
  - xfs: fix NULL pointer dereference in xfs_getbmap()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.54.0.133
changelog:
  - !2718 [sync] PR-2678:  io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
  - !2740 [sync] PR-2443:  CVE-2023-37453
  - !2734 [sync] PR-2688:  nvmet-tcp: Fix a possible UAF in queue intialization setup
  - USB: core: Fix oversight in SuperSpeed initialization
  - USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
  - USB: core: Change usb_get_device_descriptor() API
  - USB: core: Unite old scheme and new scheme descriptor reads
  - nvmet-tcp: Fix a possible UAF in queue intialization setup
  - !2702 [sync] PR-2672:  fix CVE-2023-46813
  - io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
  - !2645 [sync] PR-2543:  psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n
  - x86/sev: Check for user-space IOIO pointing to kernel space
  - x86/sev: Check IOBM for IOIO exceptions from user-space
  - x86/sev: Disable MMIO emulation from user mode
  - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.55.0.134
changelog:
  - !2859  bugfix for CVE-2022-45884
  - media: dvb-core: Fix use-after-free due to race at dvb_register_device()
  - media: dvbdev: fix error logic at dvb_register_device()
  - media: dvbdev: Fix memleak in dvb_register_device
  - !2847 [sync] PR-2840:  drm/qxl: fix UAF on handle creation
  - drm/qxl: fix UAF on handle creation
  - !2801 [sync] PR-2782:  cpufreq: Abort show()/store() for half-initialized policies
  - cpufreq: make interface functions and lock holding state clear
  - cpufreq: Abort show()/store() for half-initialized policies


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.56.0.135
changelog:
  - !2998 [sync] PR-2902:  net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
  - !2903 [sync] PR-2867:  netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
  - !830 [sync] PR-739: Fix kvm-unit-tests  vmx_cr4_osxsave_test  case failed
  - !832 [sync] PR-601: fix  test_vmxon failed
  - net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
  - !2975 Add script to check & update openeuler_defconfig
  - config: update openeuler_defconfig for arm64
  - config: update openeuler_defconfig for x86
  - kconfig: Add script to check & update openeuler_defconfig
  - Revert "kconfig: Add script to update openeuler_defconfig"
  - !1563 [sync] PR-1527:  arm64/mpam: fix missing kfree domain's ctrl_val arrray
  - !2045 [sync] PR-1327:  Huawei BMA: To fix the bug in the iBMA driver code
  - !1897 [sync] PR-1853:  ring-buffer: Fix deadloop issue on reading trace_pipe
  - !1942 [sync] PR-1900:  tracing: Fix cpu buffers unavailable due to 'record_disabled' missed
  - !1984 [sync] PR-1905:  tracing: Fix memleak due to race between current_tracer and trace
  - !2653 [sync] PR-2377:  tracing: Backport bugfixes
  - !1401 [sync] PR-1399:  bpf: cpumap: Fix memory leak in cpu_map_update_elem
  - !2634 [sync] PR-2615:  preempt/dynamic: Fix setup_preempt_mode() return value
  - !1809 [sync] PR-1768:  bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
  - !2812 [sync] PR-2716:  ext4: recheck buffer valid after page unlock
  - !1372 [sync] PR-1353:  ubifs mainline bugfix patch backport
  - !1409 [sync] PR-1354:  ubi: Fix return value overwrite issue in try_write_vid_and_data()
  - !891 [sync] PR-886:  net: sched: fix NULL pointer dereference in mq_attach
  - !901 [sync] PR-890:  ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
  - !2020 [sync] PR-1965:  crypto:padata: Fix return err for PADATA_RESET
  - !1789 [sync] PR-1650:  mm: disable kernelcore=mirror when no mirror memory
  - !1513 [sync] PR-1357:  SUNRPC: Ensure that the gssproxy client can start in a connected state
  - netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
  - !2749 [sync] PR-2683:  fix memcgv1 oom meminfo bug
  - ext4: recheck buffer valid after page unlock
  - memcg: dump memory.stat during cgroup OOM for v1
  - memcg: use seq_buf_do_printk() with mem_cgroup_print_oom_meminfo()
  - seq_buf: Add seq_buf_do_printk() helper
  - seq_buf: Add seq_buf_terminate() API
  - ring-buffer: Do not attempt to read past "commit"
  - ring-buffer: Do not swap cpu_buffer during resize process
  - preempt/dynamic: Fix setup_preempt_mode() return value
  - Huawei BMA: To fix the bug in the iBMA driver code
  - crypto:padata: Fix return err for PADATA_RESET
  - tracing: Fix memleak due to race between current_tracer and trace
  - tracing: Fix cpu buffers unavailable due to 'record_disabled' missed
  - ring-buffer: Fix deadloop issue on reading trace_pipe
  - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
  - mm: disable kernelcore=mirror when no mirror memory
  - arm64/mpam: fix missing kfree domain's ctrl_val arrray
  - SUNRPC: Ensure that the gssproxy client can start in a connected state
  - ubi: Fix return value overwrite issue in try_write_vid_and_data()
  - bpf: cpumap: Fix memory leak in cpu_map_update_elem
  - ubifs: Fix memory leak in do_rename
  - ubifs: Free memory for tmpfile name
  - ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
  - net: sched: fix NULL pointer dereference in mq_attach
  - KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails
  - kvm: x86: Sink cpuid update into vendor-specific set_cr4 functions


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.57.0.136
changelog:
  - !3194 [sync] PR-3128:  fix ksmbd to release the ones allocated for async work
  - !3002 [sync] PR-1656:  Revert "arm64/mpam: Fix mpam corrupt when cpu online"
  - ksmbd: delete asynchronous work from list
  - ksmbd: fix typo, syncronous->synchronous
  - ksmbd: fix possible memory leak in smb2_lock()
  - ksmbd: replace usage of found with dedicated list iterator variable
  - !3104 [sync] PR-3082:  fs/dirty_pages: add last read check in seq_read_dirty()
  - !3166 [sync] PR-3152:  scsi: scsi_device_gets returns failure
  - scsi: fix kabi broken in struct Scsi_Host
  - scsi: don't fail if hostt->module is NULL
  - scsi: scsi_device_gets returns failure when the module is NULL.
  - !3142 [sync] PR-2970:  Add error handle for add_disk
  - block: Set memalloc_noio to false in the error path
  - block: Fix minor range check in device_add_disk()
  - block: clear ->slave_dir when dropping the main slave_dir reference
  - block: call blk_get_queue earlier in __device_add_disk
  - block: check minor range in device_add_disk()
  - block: fix memory leak for elevator on add_disk failure
  - block: Fix the kabi change on blk_register_region
  - block: Fix the kabi change in device_add_disk
  - block: fix error unwinding in device_add_disk
  - block: fix device_add_disk() kobject_create_and_add() error handling
  - block: add error handling for device_add_disk / add_disk
  - block: return errors from blk_register_region
  - block: add the events* attributes to disk_attrs
  - block: return errors from disk_alloc_events
  - block: return errors from blk_integrity_add
  - block: call blk_integrity_add earlier in device_add_disk
  - block: fold register_disk into device_add_disk
  - !1395 [sync] PR-1355:  etmem: fix the div 0 problem in swapcache reclaim process
  - fs/dirty_pages: add last read check in seq_read_dirty()
  - !3079 [sync] PR-3022:  fs/dirty_pages: fix some errors in seq_read_dirty()
  - !3076 [sync] PR-3020:  fs/dirty_pages: fix inode reference count leakage error in dump_dirtypages_sb()
  - fs/dirty_pages: fix some errors in seq_read_dirty()
  - fs/dirty_pages: fix inode reference count leakage error in dump_dirtypages_sb()
  - Revert "arm64/mpam: Fix mpam corrupt when cpu online"
  - etmem: fix the div 0 problem in swapcache reclaim process


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.58.0.137
changelog:
  - !3625  ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
  - !3622  netfilter: nft_set_pipapo: skip inactive elements during set walk
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
  - netfilter: nft_set_pipapo: skip inactive elements during set walk
  - !3595 [sync] PR-3583:  tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
  - !3581 [sync] PR-3577:  perf/core: Fix CVE-2023-6931
  - perf: Fix perf_event_validate_size() lockdep splat
  - perf: Fix perf_event_validate_size()
  - !3293 [sync] PR-2843:  Add error handle for sd
  - !3290 [sync] PR-3222:  md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk()
  - scsi: sd: Clean up sdkp if device_add_disk() failed
  - scsi: sd: Add error handling support for add_disk()
  - md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk()
  - !3180 [sync] PR-2825:  Add error handle for driver
  - !3016 [sync] PR-1203:  Revert "locking/rwsem: Prevent potential lock starvation"
  - !3230 [sync] PR-3161:  fs: Fix error checking for d_hash_and_lookup()
  - fs: Fix error checking for d_hash_and_lookup()
  - nbd: fix uaf in nbd_open
  - mtd/ubi/block: Fix uaf problem in ubiblock_cleanup
  - mtd/ubi/block: Fix null pointer dereference issue in error path
  - mtd/ubi/block: add error handling support for add_disk()
  - ubi: use blk_mq_alloc_disk and blk_cleanup_disk
  - scsi: sr: Add error handling support for add_disk()
  - block/brd: add error handling support for add_disk()
  - brd: convert to blk_alloc_disk/blk_cleanup_disk
  - nvme: add error handling support for add_disk()
  - nvme: use blk_mq_alloc_disk
  - block: add a flag to make put_disk on partially initalized disks safer
  - nbd: add error handling support for add_disk()
  - nbd: fix order of cleaning up the queue and freeing the tagset
  - nbd: use blk_mq_alloc_disk and blk_cleanup_disk
  - loop: add error handling support for add_disk()
  - loop: fix order of cleaning up the queue and freeing the tagset
  - loop: use blk_mq_alloc_disk and blk_cleanup_disk
  - blk-mq: fix an IS_ERR() vs NULL bug
  - blk-mq: add the blk_mq_alloc_disk APIs
  - block: add blk_alloc_disk and blk_cleanup_disk APIs
  - Revert "locking/rwsem: Better collate rwsem_read_trylock()"
  - Revert "locking/rwsem: Pass the current atomic count to rwsem_down_read_slowpath()"
  - Revert "locking/rwsem: Prevent potential lock starvation"


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.59.0.138
changelog:
  - !3854 [sync] PR-3694:  Fix tow CVEs of CIFS
  - !3765 [sync] PR-3594:  CVE-2023-35827 patchset
  - smb: client: fix potential OOB in smb2_dump_detail()
  - smb: client: fix OOB in smbCalcSize()
  - !3800 [sync] PR-3659:  atm: Fix Use-After-Free in do_vcc_ioctl
  - !3825 [sync] PR-3822:  ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
  - !3798  md: protect md_thread with rcu
  - ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
  - !3781 [sync] PR-3447:  dm: add error handling support for add_disk()
  - !3783 [sync] PR-3379:  md: do not return existing mddevs from mddev_find_or_alloc
  - atm: Fix Use-After-Free in do_vcc_ioctl
  - md: protect md_thread with rcu
  - md/bitmap: factor out a helper to set timeout
  - md/bitmap: always wake up md_thread in timeout_store
  - dm-raid: remove useless checking in raid_message()
  - md: factor out a helper to wake up md_thread directly
  - md: do not return existing mddevs from mddev_find_or_alloc
  - md: refactor mddev_find_or_alloc
  - md: factor out a mddev_alloc_unit helper from mddev_find
  - dm: add error handling support for add_disk()
  - ravb: Fix races between ravb_tx_timeout_work() and net related ops
  - ravb: Fix use-after-free issue in ravb_tx_timeout_work()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.60.0.139
changelog:
  - !3987 [sync] PR-3715:  appletalk: Fix Use-After-Free in atalk_ioctl
  - !3990 [sync] PR-3668:  net/rose: Fix Use-After-Free in rose_ioctl
  - !3984 [sync] PR-3915:  nvmet: nul-terminate the NQNs passed in the connect command
  - !3796 [sync] PR-3771:  ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
  - !3772 [sync] PR-3686:  Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
  - net/rose: Fix Use-After-Free in rose_ioctl
  - appletalk: Fix Use-After-Free in atalk_ioctl
  - nvmet: nul-terminate the NQNs passed in the connect command
  - !3878 [sync] PR-3466:  livepatch/core: Disable support for replacing
  - livepatch/core: Disable support for replacing
  - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
  - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.61.0.141
changelog:
  - !4130 [sync] PR-4100:  netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
  - !4126 [sync] PR-4022:  netfilter: nf_tables: Reject tables of unsupported family
  - !4056  ext4: correct return value of ext4_convert_meta_bg
  - !4060  ext4: synchronize the casefold bugfix from the mainline
  - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
  - netfilter: nf_tables: Reject tables of unsupported family
  - !4078 [sync] PR-4069:  tipc: fix a potential deadlock on &tx->lock
  - !4074 [sync] PR-4064:  smb: client: fix OOB in receive_encrypted_standard()
  - !4017  mm/filemap: avoid buffered read/write race to read inconsistent data
  - tipc: fix a potential deadlock on &tx->lock
  - smb: client: fix OOB in receive_encrypted_standard()
  - !4041 [sync] PR-3981:  vhost: use kzalloc() instead of kmalloc() followed by memset()
  - ext4: improve error handling from ext4_dirhash()
  - ext4: reject casefold inode flag without casefold feature
  - ext4: correct return value of ext4_convert_meta_bg
  - vhost: use kzalloc() instead of kmalloc() followed by memset()
  - mm/filemap: avoid buffered read/write race to read inconsistent data


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.62.0.142
changelog:
  - !4335 [sync] PR-4289:  fs:/dcache.c: fix negative dentry limit not complete problem
  - !4325 [sync] PR-4266:  ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
  - fs:/dcache.c: fix negative dentry limit not complete problem
  - !4286 [sync] PR-4257:  nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
  - ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
  - !4264 [sync] PR-4255:  drm/amdgpu: Fix potential fence use-after-free v2
  - nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
  - !4223 [sync] PR-4213:  netlink: fix potential sleeping issue in mqueue_flush_file
  - !4206 [sync] PR-4203:  mm/dynamic_hugetlb: skip unexpected migration
  - !4005  ext4: fix some ext4_lblk_t overflow issues
  - drm/amdgpu: Fix potential fence use-after-free v2
  - netlink: fix potential sleeping issue in mqueue_flush_file
  - mm/dynamic_hugetlb: skip unexpected migration
  - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS
  - ext4: avoid overlapping preallocations due to overflow
  - ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
  - ext4: add two helper functions extent_logical_end() and pa_logical_end()
  - ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.63.0.143
changelog:
  - !4498 [sync] PR-4362:  ubifs: Queue up space reservation tasks if retrying many times
  - !4447 [sync] PR-4321:  io_uring/af_unix: disable sending io_uring over sockets
  - ubifs: Queue up space reservation tasks if retrying many times
  - !4096 [sync] PR-4090:  ida: Fix crash in ida_free when the bitmap is empty
  - !4420 v2  drm/atomic: Fix potential use-after-free in nonblocking commits
  - io_uring/af_unix: disable sending io_uring over sockets
  - !4118 [sync] PR-3975:  md/raid1-10: limit the number of plugged bio
  - drm/atomic: Fix potential use-after-free in nonblocking commits
  - !3859 [sync] PR-3756:  md: mainline backport
  - !4282 [sync] PR-4270:  fix spinlock already unlocked in inet_csk_reqsk_queue_add' bug
  - !4239 [sync] PR-3228:  net: txgbe: Fix memleak in txgbe_calc_eeprom_checksum()
  - !3362 [sync] PR-1680:  nvme-pci: fix doorbell buffer value endianness
  - !3361 [sync] PR-2188:  nvme-pci: fix mempool alloc size
  - !3023 [sync] PR-1666:  nvme-pci: fix timeout request state check
  - !3359 [sync] PR-2287:  scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
  - !3358 [sync] PR-2286:  scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
  - !3355 [sync] PR-1779:  nvme-pci: clear the prp2 field when not used
  - !3354 [sync] PR-1778:  nvme-pci: fix DMA direction of unmapping integrity data
  - !4194 [sync] PR-4015:  drm/amdgpu: correct the amdgpu runtime dereference usage count
  - !4191 [sync] PR-4014:  drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
  - !4187 [sync] PR-4013:  drm/amdgpu: correct chunk_ptr to a pointer to chunk.
  - !4186 [sync] PR-4012:  drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
  - !4182 [sync] PR-4010:  drm/amd/display: Exit idle optimizations before attempt to access PHY
  - !4181 [sync] PR-3955:  drm/radeon: possible buffer overflow
  - !4226 [sync] PR-4149:  block: remove precise_iostat
  - !4349 [sync] PR-4268:  linux Mainline ubifs Fix Patch bacnport to 5.10
  - ubifs: fix possible dereference after free
  - ubi: block: Fix use-after-free in ubiblock_cleanup
  - Revert "mtd/ubi/block: Fix uaf problem in ubiblock_cleanup"
  - ipv6: init the accept_queue's spinlocks in inet6_create
  - tcp: make sure init the accept_queue's spinlocks once
  - net: txgbe: Fix memleak in txgbe_calc_eeprom_checksum()
  - block: remove precise_iostat
  - drm/amdgpu: correct the amdgpu runtime dereference usage count
  - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
  - drm/amdgpu: correct chunk_ptr to a pointer to chunk.
  - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
  - drm/amd/display: Exit idle optimizations before attempt to access PHY
  - drm/radeon: possible buffer overflow
  - md/raid1-10: fix casting from randomized structure in raid1_submit_write()
  - md/raid1-10: limit the number of plugged bio
  - md/raid1-10: don't handle pluged bio by daemon thread
  - md/md-bitmap: add a new helper to unplug bitmap asynchrously
  - md/raid1-10: submit write io directly if bitmap is not enabled
  - md/raid1-10: factor out a helper to submit normal write
  - md/raid1-10: factor out a helper to add bio to plug
  - md/raid10: prevent soft lockup while flush writes
  - md: raid1/raid10: drop pending_cnt
  - md: drop queue limitation for RAID1 and RAID10
  - Revert "md/raid10: fix softlockup in raid10_unplug"
  - ida: Fix crash in ida_free when the bitmap is empty
  - md: fix error handling in md_alloc
  - md: Constify attribute_group structs
  - md: fix mddev->kobj lifetime
  - md: properly unwind when failing to add the kobject in md_alloc
  - md: extend disks_mutex coverage
  - md: add the bitmap group to the default groups for the md kobject
  - md: add error handling support for add_disk()
  - md: convert to blk_alloc_disk/blk_cleanup_disk
  - md/raid10: fix improper BUG_ON() in raise_barrier()
  - md: use msleep() in md_notify_reboot()
  - md: fix double free of mddev->private in autorun_array()
  - nvme-pci: fix doorbell buffer value endianness
  - nvme-pci: fix mempool alloc size
  - scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
  - scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
  - nvme-pci: clear the prp2 field when not used
  - nvme-pci: fix DMA direction of unmapping integrity data
  - nvme-pci: fix timeout request state check


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.64.0.144
changelog:
  - !4516 [sync] PR-4431: v2  patchset for CVE-2023-52340
  - !4444 [sync] PR-4290:  net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
  - !4614 [sync] PR-4521:  xen-netback: don't produce zero-size SKB frags
  - !4592  sctp: fix potential deadlock on &net->sctp.addr_wq_lock
  - !4549 [sync] PR-4461:  netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  - !4608 [sync] PR-4588:  fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
  - xen-netback: don't produce zero-size SKB frags
  - !4586 [sync] PR-4562: v4  tracing: Backport bugfixes
  - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
  - !3343 [sync] 22.03 LTS SP1 sync vdpa patches from branch OLK-5.10
  - sctp: fix potential deadlock on &net->sctp.addr_wq_lock
  - trace: Fix kabi breakage in struct trace_event_file
  - tracing: Fix uaf issue when open the hist or hist_debug file
  - tracing: Have event inject files inc the trace array ref count
  - tracing: Have trace_event_file have ref counters
  - tracing: Increase trace array ref count on enable and filter files
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  - ipv6: fix kabi change in struct dst_ops
  - ipv6: Document that max_size sysctl is deprecated
  - ipv6: remove max_size check inline with ipv4
  - net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
  - vdpa: add vmstate header file
  - vhost-vdpa: add reset state params to indicate reset level
  - vhost-vdpa: allow set feature VHOST_F_LOG_ALL when been negotiated.
  - vhost-vdpa: fix compile warnings
  - arm64: openeuler_defconfig: add VDPA config
  - vhost-vdpa: fix msi irq request err
  - vhost-vdpa: Allow transparent MSI IOV
  - export iommu_get_resv_regions and iommu_set_resv_regions
  - vhost: add VHOST feature VHOST_BACKEND_F_BYTEMAPLOG
  - vhost-vdpa: add uAPI for device migration status
  - vdpa: add vdpa device migration status ops
  - vhost-vdpa: add uAPI for device buffer
  - vdpa: add device state operations
  - vhost-vdpa: add uAPI for logging
  - vdpa: add log operations
  - tools include UAPI: Sync linux/vhost.h with the kernel sources
  - vdpa: add get_backend_features vdpa operation
  - virtio: fix virtio transitional ids
  - virtio: update virtio id table, add transitional ids
  - PCI/IOV: Add pci_iov_vf_id() to get VF index
  - vhost_vdpa: support PACKED when setting-getting vring_base
  - vhost_vdpa: tell vqs about the negotiated
  - vhost_vdpa: fix unmap process in no-batch mode
  - vhost-vdpa: use bind_mm/unbind_mm device callbacks
  - vdpa: add bind_mm/unbind_mm callbacks
  - vhost-vdpa: vhost_vdpa_alloc_domain() should be using a const struct bus_type *
  - vhost-vdpa: free iommu domain after last use during cleanup
  - vhost-vdpa: uAPI to resume the device
  - vhost-vdpa: Introduce RESUME backend feature bit
  - vdpa: Add resume operation
  - vhost_vdpa: fix the crash in unmap a large memory
  - vhost-vdpa: fix an iotlb memory leak


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.65.0.145
changelog:
  - !4467 [sync] PR-4256:  scsi: core: Always send batch on reset or error handling command
  - !4682 [sync] PR-4662: v3  CVE-2023-52435
  - !4692  ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
  - ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
  - !4626 [sync] PR-4531:  fs:/dcache.c: fix negative dentry flag warning in dentry_free
  - net: Fix compile warning in skb_segment()
  - net: prevent mss overflow in skb_segment()
  - fs:/dcache.c: fix negative dentry flag warning in dentry_free
  - scsi: core: Always send batch on reset or error handling command
  - Revert "scsi: core: Add scsi_prot_ref_tag() helper"
  - Revert "scsi: core: Introduce scsi_get_sector()"
  - Revert "scsi: core: Make scsi_get_lba() return the LBA"
  - Revert "scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request"
  - Revert "scsi: core: Use a structure member to track the SCSI command submitter"
  - Revert "scsi: core: Always send batch on reset or error handling command"
  - scsi: core: Always send batch on reset or error handling command
  - scsi: core: Use a structure member to track the SCSI command submitter
  - scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
  - scsi: core: Make scsi_get_lba() return the LBA
  - scsi: core: Introduce scsi_get_sector()
  - scsi: core: Add scsi_prot_ref_tag() helper


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.66.0.146
changelog:
  - !4956 [sync] PR-4868:  net: openvswitch: limit the number of recursions from action sets
  - !4961 [sync] PR-4940:  apparmor: avoid crash when parsed profile name is empty
  - apparmor: avoid crash when parsed profile name is empty
  - net: openvswitch: limit the number of recursions from action sets
  - !4755 [sync] PR-4737:  blk-mq: fix IO hang from sbitmap wakeup race
  - !4814 [sync] PR-4702:  efivarfs: force RO when remounting if SetVariable is not supported
  - !4796 [sync] PR-4747:  KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
  - efivarfs: force RO when remounting if SetVariable is not supported
  - !4792 v2  gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
  - KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
  - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
  - blk-mq: fix IO hang from sbitmap wakeup race
  - !4723 [sync] PR-4694: v2  mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
  - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.67.0.147
changelog:
  - !5154 [sync] PR-4645:  f2fs: explicitly null-terminate the xattr list
  - !5147 [sync] PR-4925: v2  btrfs: do not ASSERT() if the newly created subvolume already got read
  - !4668 [sync] PR-4646:  binder: fix use-after-free in shinker's callback
  - !4831 [sync] PR-4803:  CVE-2024-26583
  - f2fs: explicitly null-terminate the xattr list
  - !4749 [sync] PR-4672:  uio: Fix use-after-free in uio_open
  - !5069 [sync] PR-5033: v3  Remove WQ_FLAG_BOOKMARK flag
  - btrfs: fix double free of anonymous device after snapshot creation failure
  - btrfs: do not ASSERT() if the newly created subvolume already got read
  - !5084 [sync] PR-5058:  net: fix possible store tearing in neigh_periodic_work()
  - !5086 [sync] PR-5064:  net: rds: Fix possible NULL-pointer dereference
  - !5126 [sync] PR-4891:  Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
  - !5080 [sync] PR-5051:  dm: limit the number of targets and parameter size area
  - !5001 [sync] PR-4988:  ieee802154: ca8210: Fix a potential UAF in ca8210_probe
  - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
  - !4839 [sync] PR-4742:  block: add check that partition length needs to be aligned with block size
  - !5066 [sync] PR-5032:  net/sched: act_ct: fix wild memory access when clearing fragments
  - net: rds: Fix possible NULL-pointer dereference
  - net: fix possible store tearing in neigh_periodic_work()
  - !4953  arm64: head.S: always initialize PSTATE
  - dm: limit the number of targets and parameter size area
  - sched: remove wait bookmarks
  - filemap: remove use of wait bookmarks
  - net/sched: act_ct: fix wild memory access when clearing fragments
  - !4985 [sync] PR-4339: 修复pmem_legacy_device未被编译问题
  - !4964 [sync] PR-4901:  fix CVE-2021-47036
  - !5012  nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
  - !5006 [sync] PR-4979:  CVE-2021-47028
  - !5014 [sync] PR-4991:  CVE-2023-52568
  - x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race
  - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
  - mt76: mt7915: fix txrate reporting
  - mt76: mt7915: rename mt7915_mcu_get_rate_info to mt7915_mcu_get_tx_rate
  - !4732 [sync] PR-4706:  mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
  - ieee802154: ca8210: Fix a potential UAF in ca8210_probe
  - pmem: compile pmem legacy device while libnvdimm as a module
  - udp: properly flush normal packet at GRO time
  - udp: skip L4 aggregation for UDP tunnel packets
  - arm64: head.S: always initialize PSTATE
  - block: add check that partition length needs to be aligned with block size
  - tls: fix race between tx work scheduling and socket close
  - tls: fix race between async notify and socket close
  - net: tls: factor out tls_*crypt_async_wait()
  - tls: rx: simplify async wait
  - uio: Fix use-after-free in uio_open
  - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
  - binder: fix use-after-free in shinker's callback


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.68.0.148
changelog:
  - !5344  CVE-2023-52447
  - !5366 v2  CVE-2023-52452
  - !5360  iommu/arm-smmu-v3: Disable ECMDQ before reset
  - bpf: Fix accesses to uninit stack slots
  - bpf: Fix verification of indirect var-off stack access
  - bpf: Allow reads from uninit stack
  - bpf: expose bpf_strtol and bpf_strtoul to all program types
  - bpf, verifier: Fix memory leak in array reallocation for stack state
  - bpf: verifier: Use copy_array for jmp_history
  - bpf: verifier: Improve function state reallocation
  - iommu/arm-smmu-v3: Disable ECMDQ before reset
  - !5182 [sync] PR-4805:  CVE-2023-52451 backport to OLK-5.10 v2
  - bpf: Fix kabi breakage in struct bpf_map and struct bpf_map_ops
  - bpf: Defer the free of inner map when necessary
  - bpf: Set need_defer as false when clearing fd array during map free
  - bpf: Add map and need_defer parameters to .map_fd_put_ptr()
  - !5278 [sync] PR-5246:  ceph: fix deadlock or deadcode of misusing dget()
  - !5294 [sync] PR-5240:  powerpc/lib: Validate size for vector operations
  - powerpc/lib: Validate size for vector operations
  - !5226 [sync] PR-5197:  drm: Don't unref the same fb many times by mistake due to deadlock handling
  - !4853 [sync] PR-4847:  btrfs: mainline backport
  - ceph: fix deadlock or deadcode of misusing dget()
  - !5204  Upgrade driver for Broadcom NIC BCM57414
  - !5192 [sync] PR-5164:  nfc: nci: assert requested protocol is valid
  - !5185 [sync] PR-5156:  RDMA/srp: Do not call scsi_done() from srp_abort()
  - !5124 [sync] PR-5109:  CVE-2024-26586
  - !5098 [sync] PR-5078:  RDMA/rxe: Return CQE error if invalid lkey was supplied
  - drm: Don't unref the same fb many times by mistake due to deadlock handling
  - !5201 [sync] PR-5178:  net: nfc: llcp: Add lock when modifying device list
  - Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
  - bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks
  - bnxt_en: Query default VLAN before VNIC setup on a VF
  - bnxt_en: Don't issue AP reset during ethtool's reset operation
  - net: bcmgenet: Restore phy_stop() depending upon suspend/close
  - net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
  - net: nfc: llcp: Add lock when modifying device list
  - nfc: nci: assert requested protocol is valid
  - RDMA/srp: Do not call scsi_done() from srp_abort()
  - !5166 [sync] PR-5117:  fix CVE-2023-52527
  - powerpc/pseries/memhp: Fix access beyond end of drmem array
  - powerpc/pseries/memhotplug: Quieten some DLPAR operations
  - l2tp: pass correct message length to ip6_append_data
  - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
  - mlxsw: spectrum_acl_tcam: Fix stack corruption
  - mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations
  - mlxsw: spectrum_acl_tcam: Make fini symmetric to init
  - mlxsw: spectrum_acl_tcam: Add missing mutex_destroy()
  - mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable
  - mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure
  - RDMA/rxe: Return CQE error if invalid lkey was supplied
  - btrfs: fix deadlock when cloning inline extents and using qgroups
  - btrfs: do not start and wait for delalloc on snapshot roots on transaction commit


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.69.0.149
changelog:
  - !5534  media: pvrusb2: fix use after free on context disconnection
  - !5503 [sync] PR-5316: v2  iomap: add support to track dirty state of sub pages
  - media: pvrusb2: fix use after free on context disconnection
  - !5138 [sync] PR-4933:  scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
  - !5028 [sync] PR-4987:  net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
  - iomap: add support to track dirty state of sub pages
  - !5439 [sync] PR-5286:  serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
  - !5324  jfs: fix slab-out-of-bounds Read in dtSearch
  - !5329  UBSAN: array-index-out-of-bounds in dtSplitRoot
  - !5436 [sync] PR-5355:  CVE-2023-52593
  - !5311  FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - !5390 [sync] PR-5259:  CVE-2024-26627​
  - serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
  - wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()
  - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
  - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
  - !5372 [sync] PR-5313:  bus: mhi: host: Add alignment check for event ring read pointer
  - !5288 [sync] PR-5231:  af_unix: fix lockdep positive in sk_diag_dump_icons()
  - bus: mhi: host: Add alignment check for event ring read pointer
  - UBSAN: array-index-out-of-bounds in dtSplitRoot
  - jfs: fix slab-out-of-bounds Read in dtSearch
  - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - af_unix: fix lockdep positive in sk_diag_dump_icons()
  - scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.70.0.150
changelog:
  - !5682 [sync] PR-5266:  llc: call sock_orphan() at release time
  - !5690  net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  - !5686 [sync] PR-5253:  tomoyo: fix UAF write bug in tomoyo_write_control()
  - net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  - tomoyo: fix UAF write bug in tomoyo_write_control()
  - llc: call sock_orphan() at release time
  - !5433 [sync] PR-5232:  jfs: fix cve issue
  - !5638 [sync] PR-5617: v4  Fix I/O high when memory almost met memcg limit
  - !5665 [sync] PR-5580:  CVE-2023-52622
  - ext4: avoid online resizing failures due to oversized flex bg
  - ext4: unify the type of flexbg_size to unsigned int
  - ext4: remove unnecessary check from alloc_flex_gd()
  - !5648 [sync] PR-5493:  arm64/mpam: Fix repeated enabling in mpam_enable()
  - !5416 v2  mpt3sas bugfix
  - !5635 [sync] PR-5518:  dm: revert partial fix for redundant bio-based IO accounting
  - !5632 [sync] PR-5521:  md/raid5: fix atomicity violation in raid5_cache_count
  - arm64/mpam: Fix repeated enabling in mpam_enable()
  - mm/readahead: don't decrease mmap_miss when folio has workingset flags
  - mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM
  - !5619 [sync] PR-5606:  mm/mlock: return EINVAL for illegal user memory range in mlock
  - !5610 [sync] PR-5447:  Fix CVE-2021-47094
  - dm: revert partial fix for redundant bio-based IO accounting
  - md/raid5: fix atomicity violation in raid5_cache_count
  - mm/mlock: return EINVAL for illegal user memory range in mlock
  - KVM: x86/mmu: Don't advance iterator after restart due to yielding
  - KVM: x86/mmu: Factor out tdp_iter_return_to_root
  - !5475  jfs: fix array-index-out-of-bounds in dbAdjTree
  - jfs: fix array-index-out-of-bounds in dbAdjTree
  - jfs: fix array-index-out-of-bounds in diNewExt
  - jfs: fix uaf in jfs_evict_inode
  - scsi: mpt3sas: Fix loop logic
  - scsi: mpt3sas: Perform additional retries if doorbell read returns 0
  - scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
  - scsi: mpt3sas: Remove usage of dma_get_required_mask() API
  - scsi: mpt3sas: Don't change DMA mask while reallocating pools
  - scsi: mpt3sas: Fix a memory leak
  - scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.71.0.151
changelog:
  - !5941  CVE-2021-46926
  - !5945 [sync] PR-5861:  ksmbd: fix uaf in smb20_oplock_break_ack
  - !5937 [sync] PR-5911:  CVE-2023-52484
  - !5933 [sync] PR-5895:  i2c: i801: Fix block process call transactions
  - !5928 [sync] PR-5863:  CVE-2024-26788
  - !5909 [sync] PR-4928:  drm/bridge: sii902x: Fix probing race issue
  - !5784  ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - !5919 [sync] PR-5870:  drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - !4909 [sync] PR-4865:  Input: powermate - fix use-after-free in powermate_config_complete
  - !5904 [sync] PR-4931:  phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
  - ksmbd: fix uaf in smb20_oplock_break_ack
  - ALSA: hda: intel-sdw-acpi: harden detection of controller
  - iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range
  - iommu/arm-smmu-v3: Fix size calculation in arm_smmu_mm_invalidate_range()
  - !5913 [sync] PR-5811:  Fixed CVE-2021-47037
  - !5872 [sync] PR-4794:  serial: imx: fix tx statemachine deadlock
  - i2c: i801: Fix block process call transactions
  - dmaengine: fsl-qdma: init irq after reg initialization
  - !5897 [sync] PR-5808:  nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - !5889 [sync] PR-5832:  CVE-2023-52467
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - ASoC: q6afe-clocks: fix reprobing of the driver
  - ASoC: q6afe-clocks: fix warning on symbol scope
  - drm/bridge: sii902x: Fix probing race issue
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
  - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - !5749  ksmbd: fix global oob in ksmbd_nl_policy
  - mfd: syscon: Fix null pointer dereference in of_syscon_register()
  - serial: imx: fix tx statemachine deadlock
  - !5816 [sync] PR-5780:  bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  - !5827 [sync] PR-5785:  net: qualcomm: rmnet: fix global oob in rmnet_policy
  - !4800 [sync] PR-4764:  binder: signal epoll threads of self-work
  - !5791  usb: hub: Guard against accesses to uninitialized BOS descriptors
  - !5798 [sync] PR-5788: v2  Patches to Fix CVE-2023-52454
  - !5821 [sync] PR-5789:  perf/x86/lbr: Filter vsyscall addresses
  - net: qualcomm: rmnet: fix global oob in rmnet_policy
  - !5776 [sync] PR-5724:  ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - !4779 [sync] PR-4772:  x86/fpu: Stop relying on userspace for info to fault in xsave buffer
  - perf/x86/lbr: Filter vsyscall addresses
  - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  - !5765 [sync] PR-5642:  btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - nvmet-tcp: Fix the H2C expected PDU len calculation
  - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
  - usb: hub: Guard against accesses to uninitialized BOS descriptors
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - ksmbd: fix global oob in ksmbd_nl_policy
  - !5720 [sync] PR-5708:  ext4: dio: Put endio under
  - !5705 [sync] PR-5507:  ext4: Validate inode pa before using preallocation blocks
  - ext4: Optimize endio process for DIO overwrites
  - iomap: Add a IOMAP_DIO_MAY_INLINE_COMP flag
  - iomap: pass a flags argument to iomap_dio_rw
  - iomap: rename the flags variable in __iomap_dio_rw
  - iomap: add IOMAP_DIO_INLINE_COMP
  - iomap: use an unsigned type for IOMAP_DIO_* defines
  - iomap: cleanup up iomap_dio_bio_end_io()
  - ext4: Validate inode pa before using preallocation blocks
  - Input: powermate - fix use-after-free in powermate_config_complete
  - binder: signal epoll threads of self-work
  - x86/fpu: Stop relying on userspace for info to fault in xsave buffer


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.72.0.152
changelog:
  - !6181 [sync] PR-5093:  wifi: mac80211: fix potential key use-after-free
  - !6217  RDMA/siw: Fix connection failure handling
  - !6238 [sync] PR-6186:  Fixed CVE-2023-52504
  - !6234 [sync] PR-6193:  uio_hv_generic: Fix another memory leak in error handling paths
  - !6235 [sync] PR-6192:  arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
  - x86/alternatives: Disable KASAN in apply_alternatives()
  - arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
  - uio_hv_generic: Fix another memory leak in error handling paths
  - !6197  tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
  - !6189 [sync] PR-5466:  wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - RDMA/siw: Fix connection failure handling
  - !6114  cifs: Fix UAF in cifs_demultiplex_thread()
  - tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - !6173 [sync] PR-6137:  vfio/pci: Lock external INTx masking ops
  - wifi: mac80211: fix potential key use-after-free
  - !6126  fix-CVE-2021-47101-openEuler-22.03-LTS-SP1
  - vfio/pci: Lock external INTx masking ops
  - !6155 [sync] PR-5717: v2  fix CVE-2023-52587
  - !6149 [sync] PR-6101:  vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - !6142 [sync] PR-6047:  hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  - !6132 [sync] PR-4923:  mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
  - !5420 [sync] PR-5317:  KVM: s390: fix setting of fpc register
  - IB/ipoib: Fix mcast list locking
  - RDMA/IPoIB: Fix error code return in ipoib_mcast_join
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - !5130 [sync] PR-5113:  fix CVE-2023-52578
  - !5121 [sync] PR-5062:  team: fix null-ptr-deref when team device type is changed
  - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  - !6118  wifi: rt2x00: restart beacon queue when hardware reset
  - !6055 [sync] PR-6017:  drm/amdgpu: fix use-after-free bug
  - !6120  dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
  - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
  - asix: fix wrong return value in asix_check_host_enable()
  - asix: fix uninit-value in asix_mdio_read()
  - net: asix: fix uninit value bugs
  - dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
  - wifi: rt2x00: restart beacon queue when hardware reset
  - cifs: Fix UAF in cifs_demultiplex_thread()
  - !6078 [sync] PR-5973:  EDAC/thunderx: Fix possible out-of-bounds string access
  - !6043 [sync] PR-5995:  mm/swap: fix race when skipping swapcache
  - !6023 [sync] PR-5970:  fixup CVE-2024-26751
  - !6035 [sync] PR-5969:  fbdev: savage: Error out if pixclock equals zero
  - EDAC/thunderx: Fix possible out-of-bounds string access
  - !5849  ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - !6059  fs/ntfs3: fix CVE-2023-52640
  - fs/ntfs3: Fix oob in ntfs_listxattr
  - fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea()
  - ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
  - drm/amdgpu: fix use-after-free bug
  - mm/swap: fix race when skipping swapcache
  - !5988 [sync] PR-5901:  CVE-2024-26695
  - !5981 [sync] PR-5812:  afs: Increase buffer size in afs_update_volume_status()
  - fbdev: savage: Error out if pixclock equals zero
  - ARM: ep93xx: Add terminator to gpiod_lookup_table
  - !5948 [sync] PR-5831:  fbdev: sis: Error out if pixclock equals zero
  - !5959 [sync] PR-5884:  KVM: arm64: vgic-its: Fix CVE-2024-26598 fix patch issue
  - !5843 [sync] PR-5348:  s390/ptrace: handle setting of fpc register correctly
  - crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
  - !5857  dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - afs: Increase buffer size in afs_update_volume_status()
  - KVM: arm64: vgic-its: Fix CVE-2024-26598 fix patch issue
  - fbdev: sis: Error out if pixclock equals zero
  - dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - s390/ptrace: handle setting of fpc register correctly
  - KVM: s390: fix setting of fpc register
  - net: fix kabi check warning
  - net: Fix unwanted sign extension in netdev_stats_to_stats64()
  - net: bridge: use DEV_STATS_INC()
  - net: add atomic_long_t to net_device_stats fields
  - team: fix null-ptr-deref when team device type is changed


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.73.0.153
changelog:
  - !6414 [sync] PR-5510:  bus: mhi: host: Drop chan lock before queuing buffers
  - !6143 [sync] PR-6103:  riscv: Sparse-Memory/vmemmap out-of-bounds fix
  - !6535 [sync] PR-5222:  powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  - !6538 [sync] PR-5273:  net/smc: fix illegal rmb_desc access in SMC-D connection dump
  - !6529 [sync] PR-5468:  media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
  - !6298  sp1 fix deadlock in cgroup1_writeback
  - !6497 [sync] PR-6407:  wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump
  - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  - !6506 [sync] PR-5773:  patches for CVE-2023-52617
  - !6502 [sync] PR-5772:  firmware: arm_scmi: Check mailbox/SMT channel for consistency
  - !6518  Fix CVE-2023-52498
  - media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
  - PM: sleep: Fix error handling in dpm_prepare()
  - PM: sleep: Fix possible deadlocks in core system-wide PM code
  - PM: core: Remove unnecessary (void *) conversions
  - PM: sleep: Avoid calling put_device() under dpm_list_mtx
  - PM: sleep: Use dev_printk() when possible
  - async: Introduce async_schedule_dev_nocall()
  - async: Split async_schedule_node_domain()
  - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
  - PCI: switchtec: Fix stdev_release() crash after surprise hot remove
  - firmware: arm_scmi: Check mailbox/SMT channel for consistency
  - !6488 [sync] PR-6455:  CVE-2021-47182
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - !6433 [sync] PR-6312:  fix CVE-2024-24861 for 5.10
  - scsi: core: Fix scsi_mode_sense() buffer length handling
  - scsi: core: Reshuffle response handling in scsi_mode_sense()
  - media: xc4000: Fix atomicity violation in xc4000_get_frequency
  - !6411 [sync] PR-5195:  dmaengine: fix NULL pointer in channel unregistration function
  - bus: mhi: host: Drop chan lock before queuing buffers
  - dmaengine: fix NULL pointer in channel unregistration function
  - cgroup_writeback: fix softlockup for blkcg->memcg_list
  - cgroup_writeback: fix deadlock in cgroup1_writeback
  - !6081  Fix CVE-2024-26764
  - !5967  Fix CVE-2023-52441 and integrate the pre-patch
  - riscv: Sparse-Memory/vmemmap out-of-bounds fix
  - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
  - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
  - ksmbd: fix out of bounds in init_smb2_rsp_hdr()
  - ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr
  - ksmbd: return unsupported error on smb1 mount
  - ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.74.0.154
changelog:
  - !6426 [sync] PR-6291:  aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  - !6902  bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
  - !6920  bpf: Fix hashtab overflow check on 32-bit arches
  - !6926  firmware: arm_scmi: Harden accesses to the reset domains
  - !6922  bpf: Fix stackmap overflow check on 32-bit arches
  - !6864 [sync] PR-6835:  kprobes: Fix check for probe enabled in kill_kprobe()
  - !6898 [sync] PR-6592:  net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  - firmware: arm_scmi: Harden accesses to the reset domains
  - bpf: Fix stackmap overflow check on 32-bit arches
  - bpf: Fix hashtab overflow check on 32-bit arches
  - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
  - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  - !6644 [sync] PR-6623:  amdkfd: use calloc instead of kzalloc to avoid integer overflow
  - kprobes: Fix check for probe enabled in kill_kprobe()
  - !6388 [sync] PR-6202:  ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  - !6628 [sync] PR-6485:  CVE-2024-26843
  - !6752 [sync] PR-6677: v3  olk-5.10: bugfix for mm
  - mm/madvise: fix potential pte_unmap_unlock pte error
  - mm/page_alloc: always attempt to allocate at least one page during bulk allocation
  - !6505  cachefiles: fix memory leak in cachefiles_add_cache()
  - !6687 [sync] PR-6580:  drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  - !6637 [sync] PR-6561:  md: fix kmemleak of rdev->serial
  - amdkfd: use calloc instead of kzalloc to avoid integer overflow
  - !6598 [sync] PR-6584:  ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  - !6607 [sync] PR-6579:  media: rc: bpf attach/detach requires write permission
  - !6606 [sync] PR-6568:  IB/hfi1: Fix a memleak in init_credit_return
  - !6614 [sync] PR-6543:  net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  - !6603 [sync] PR-6520:  firmware: arm_scmi: Fix double free in SMC transport cleanup path
  - md: fix kmemleak of rdev->serial
  - firmware: arm_scmi: Fix double free in SMC transport cleanup path
  - efi: runtime: Fix potential overflow of soft-reserved region size
  - !6249  ubi: Check for too small LEB size in VTBL code
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  - !6449 [sync] PR-6281: v2  net/mlx5: Update error handler for UCTX and UMEM
  - media: rc: bpf attach/detach requires write permission
  - IB/hfi1: Fix a memleak in init_credit_return
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  - !6476  do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  - !6575 [sync] PR-6417:  media: pvrusb2: fix uaf in pvr2_context_set_notify
  - media: pvrusb2: fix uaf in pvr2_context_set_notify
  - cachefiles: fix memory leak in cachefiles_add_cache()
  - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  - net/mlx5: Update error handler for UCTX and UMEM
  - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  - ubi: Check for too small LEB size in VTBL code


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.75.0.155
changelog:
  - !6039 [sync] PR-6006:  fix CVE-2024-26669
  - !5882 [sync] PR-5751:  net: atlantic: Fix DMA mapping for PTP hwts ring
  - !7340  netfilter: nft_limit: reject configurations that cause integer overflow
  - !7253  netfilter: nf_tables: disallow timeout for anonymous sets
  - netfilter: nft_limit: reject configurations that cause integer overflow
  - netfilter: nf_tables: disallow timeout for anonymous sets
  - !7161 [sync] PR-6809:  memcg: fix possible use-after-free in memcg_write_event_control()
  - !7121 [sync] PR-7086:  media: ttpci: fix two memleaks in budget_av_attach
  - !7123 [sync] PR-7080:  drm: nv04: Fix out of bounds access
  - !7145 [sync] PR-7044: v2  nfs: fix UAF in direct writes
  - !7155 [sync] PR-7148:  scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - !7179  ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  - !6978  ksmbd: validate payload size in ipc response
  - !7098 [sync] PR-6818:  mm: memcg: fix stale protection of reclaim target memcg
  - memcg: fix possible use-after-free in memcg_write_event_control()
  - scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - nfs: fix UAF in direct writes
  - !6764 [sync] PR-6680:  cifs: fix underflow in parse_server_interfaces()
  - !6766 [sync] PR-6669:  NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - drm: nv04: Fix out of bounds access
  - media: ttpci: fix two memleaks in budget_av_attach
  - !7102 [sync] PR-7039:  USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - !7084 [sync] PR-7013:  media: edia: dvbdev: fix a use-after-free
  - !7024 [sync] PR-6988:  clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - !6213 [sync] PR-6178:  CVE-2024-26812
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - !7009 [sync] PR-6959:  mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - !7064 [sync] PR-7056:  scsi: qla2xxx: Fix command flush on cable pull
  - mm: memcg: fix stale protection of reclaim target memcg
  - !6946 [sync] PR-6840:  CVE-2023-52650
  - media: edia: dvbdev: fix a use-after-free
  - scsi: qla2xxx: Fix command flush on cable pull
  - !6093 [sync] PR-5921:  ext4: fix double-free of blocks due to wrong extents moved_len
  - !6090 [sync] PR-5977:  btrfs: dev-replace: properly validate device names
  - !6096 [sync] PR-6029:  ceph: prevent use-after-free in encode_cap_msg()
  - !7029 [sync] PR-6977:  wireguard: netlink: access device through ctx instead of peer
  - drm/tegra: dsi: Add missing check for of_find_device_by_node
  - wireguard: netlink: access device through ctx instead of peer
  - !6986 [sync] PR-6964: v2  CVE-2024-27000
  - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - !6691  quota: Fix potential NULL pointer dereference
  - serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
  - serial: mxs-auart: add spinlock around changing cts state
  - serial: core: Provide port lock wrappers
  - !6885 [sync] PR-6740:  V2 cpuset: fix race between rebuild scheduler domains and hotplug work
  - !6961 [sync] PR-6861:  media: dvb-frontends: avoid stack overflow warnings with clang
  - ksmbd: validate payload size in ipc response
  - !6912  pstore: inode: Only d_invalidate() is needed
  - !6937 [sync] PR-6826:  fat: fix uninitialized field in nostale filehandles
  - !6934 [sync] PR-6838:  fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - media: dvb-frontends: avoid stack overflow warnings with clang
  - fat: fix uninitialized field in nostale filehandles
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - pstore: inode: Only d_invalidate() is needed
  - cpuset: fix race between rebuild scheduler domains and hotplug work
  - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - cifs: fix underflow in parse_server_interfaces()
  - quota: Fix potential NULL pointer dereference
  - vfio/pci: Create persistent INTx handler
  - vfio: Introduce interface to flush virqfd inject workqueue
  - ceph: prevent use-after-free in encode_cap_msg()
  - ext4: fix double-free of blocks due to wrong extents moved_len
  - btrfs: dev-replace: properly validate device names
  - net/sched: flower: Fix kabi change
  - net/sched: flower: Fix chain template offload
  - net: atlantic: Fix DMA mapping for PTP hwts ring


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.76.0.156
changelog:
  - !7634  spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
  - !7642  hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - !7724  CVE-2024-27002
  - !7706  pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
  - !7618 [sync] PR-5930:  RDMA/srpt: Support specifying the srpt_service_guid parameter
  - !6243 [sync] PR-6082:  can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  - !6153 [sync] PR-6020:  net/sched: act_mirred: use the backlog for mirred ingress
  - !7621 [sync] PR-6259:  arp: Prevent overflow in arp_req_get().
  - !7616 [sync] PR-5993:  ipv6: sr: fix possible use-after-free and null-ptr-deref
  - !7613 [sync] PR-5996:  mptcp: fix double-free on socket dismantle
  - !6223 [sync] PR-6074:  Fix CVE-2024-26787
  - !7610 [sync] PR-6279:  Bluetooth: Avoid potential use-after-free in hci_error_reset
  - !7380 [sync] PR-6085:  netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  - !7377 [sync] PR-6086:  netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
  - !5984 [sync] PR-5852:  CVE-2024-26809
  - !7708  bpf: Guard stack limits against 32bit overflow
  - !7637  dm-crypt: don't modify the data when using authenticated encryption
  - !7623 [sync] PR-6033:  gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  - !7696  ext4: fix corruption during on-line resize
  - !7703  pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - !7628 [sync] PR-5950:  RDMA/qedr: Fix qedr_create_user_qp error flow
  - clk: mediatek: Do a runtime PM get on controllers during probe
  - !6532 [sync] PR-6486:  devlink: fix possible use-after-free and memory leaks in devlink_init()
  - !7554 [sync] PR-5530:  net: Fix CVE-2024-26641
  - !7551 [sync] PR-7006:  wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - !7667 [sync] PR-7586:  powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - bpf: Guard stack limits against 32bit overflow
  - pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
  - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - ext4: fix corruption during on-line resize
  - !7604  cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  - powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - Merge remote-tracking branch 'upstream/openEuler-22.03-LTS-SP1' into HEAD
  - !7512 [sync] PR-7408:  backport important fix for broadcom net card
  - !7510 [sync] PR-7407:  nvme-fc: do not wait in vain when unloading module
  - !7513 [sync] PR-7406:  drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  - !7508 [sync] PR-7402:  scsi: lpfc: Fix possible file string name overflow when updating firmware
  - !7507 [sync] PR-7404:  scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - !7503 [sync] PR-7403:  scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  - !7523 [sync] PR-7401:  nvme-core: check for too small lba shift
  - !7499 [sync] PR-7396:  drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
  - !7493 [sync] PR-7398:  drm/amd/display: Fix memory leak in dm_sw_fini()
  - !7490 [sync] PR-7399:  drm/amd/pm: fix a double-free in si_dpm_init
  - !7496 [sync] PR-7397:  drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  - Merge remote-tracking branch 'upstream/openEuler-22.03-LTS-SP1' into HEAD
  - !7590  drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
  - !7597 [sync] PR-7548:  btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - !7564  net: hns3: fix kernel crash when 1588 is received on HIP08 devices
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - dm-crypt: don't modify the data when using authenticated encryption
  - spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
  - can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  - dm-crypt: don't modify the data when using authenticated encryption
  - RDMA/qedr: Fix qedr_create_user_qp error flow
  - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  - arp: Prevent overflow in arp_req_get().
  - RDMA/srpt: Support specifying the srpt_service_guid parameter
  - ipv6: sr: fix possible use-after-free and null-ptr-deref
  - mptcp: fix double-free on socket dismantle
  - Bluetooth: Avoid potential use-after-free in hci_error_reset
  - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - !7557 [sync] PR-7520:  drm/i915/gt: Reset queue_priority_hint on parking
  - drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
  - !7363 [sync] PR-5491:  CVE-2024-26640
  - !6553  fixup CVE-2024-26908
  - !7535 v2  CVE-2024-26907
  - net: hns3: fix kernel crash when 1588 is received on HIP08 devices
  - drm/i915/gt: Reset queue_priority_hint on parking
  - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
  - ip6_tunnel: use dev_sw_netstats_rx_add()
  - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - !7518 [sync] PR-7484:  fix CVE-2024-26661
  - kernel-doc: fix struct_group_tagged() parsing
  - uapi: propagate __struct_group() attributes to the container union
  - RDMA/mlx5: Fix fortify source warning while accessing Eth segment
  - uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++
  - stddef: Introduce DECLARE_FLEX_ARRAY() helper
  - uapi/linux/stddef.h: Add include guards
  - stddef: Introduce struct_group() helper macro
  - !7516 [sync] PR-7483:  Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - !7355  blk-iocost: Fix an UBSAN shift-out-of-bounds warning
  - !7347  PM / devfreq: Synchronize devfreq_monitor_[start/stop
  - !7357  sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - !7443 [sync] PR-6037:  fix-CVE-2024-26706
  - nvme-core: check for too small lba shift
  - drm/amd/display: Fix && vs || typos
  - drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
  - !7486 [sync] PR-7476:  firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  - net/tg3: fix race condition in tg3_reset_task()
  - net/tg3: resolve deadlock in tg3_reset_task() during EEH
  - net: bnxt: fix a potential use-after-free in bnxt_init_tc
  - net/bnx2x: Prevent access to a freed page in page_pool
  - nvme-fc: do not wait in vain when unloading module
  - scsi: lpfc: Fix possible file string name overflow when updating firmware
  - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  - drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
  - drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  - drm/amd/display: Fix memory leak in dm_sw_fini()
  - drm/amd/pm: fix a double-free in si_dpm_init
  - !7295  KVM: s390: vsie: fix race during shadow creation
  - firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - !7257  netfilter: nf_tables: disallow anonymous set with timeout flag
  - !7336  inet: read sk->sk_family once in inet_recv_error()
  - !7329  tunnels: fix out of bounds access when building IPv6 PMTU error
  - !7324  net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
  - !7311  btrfs: don't drop extent_map for free space inode on write error
  - !7449 [sync] PR-5998:  net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
  - !7446 [sync] PR-6031:  nilfs2: fix potential bug in end_buffer_async_write
  - !7276  llc: Drop support for ETH_P_TR_802_2.
  - !7281  llc: make llc_ui_sendmsg() more robust against bonding changes
  - !7457  netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !7263  Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - !7479 [sync] PR-7424:  net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - !7343  ppp_async: limit MRU to 64K
  - !5867 [sync] PR-5794:  um: time-travel: fix time corruption
  - !7390 [sync] PR-5469:  wifi: iwlwifi: fix a memory corruption
  - !7313  CVE-2024-26686
  - !7301  nilfs2: fix data corruption in dsync block recovery for small block sizes
  - !7298  powerpc/kasan: Fix addr error caused by page alignment
  - !7274  binder: fix race between mmput() and do_exit()
  - !7261  ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  - !5623 [sync] PR-5566:  tracing: Ensure visibility when inserting an element into tracing_map
  - !7241  SUNRPC: Fix a suspicious RCU usage warning
  - !7231 [sync] PR-5460: v2  crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
  - !7240  bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  - !7319  mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  - !7467 [sync] PR-7394: v2  scsi: sr: Do not leak information in ioctl
  - scsi: sr: Do not leak information in ioctl
  - !7020 [sync] PR-6855:  KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - !7307  iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !7427  net: gtp: Fix Use-After-Free in gtp_dellink
  - !7431 [sync] PR-3972:  arm64: make cma=0 as default for openeuler
  - net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
  - nilfs2: fix potential bug in end_buffer_async_write
  - parisc/unaligned: Fix emulate_ldw() breakage
  - parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd()
  - parisc: Fix random data corruption from exception handler
  - parisc/unaligned: Rewrite 32-bit inline assembly of emulate_sth()
  - parisc/unaligned: Rewrite 32-bit inline assembly of emulate_ldd()
  - parisc/unaligned: Rewrite inline assembly of emulate_ldw()
  - parisc: Mark ex_table entries 32-bit aligned in uaccess.h
  - parisc: Fix some apparent put_user() failures
  - parisc: Implement __get/put_kernel_nofault()
  - parisc: Drop strnlen_user() in favour of generic version
  - parisc: Switch user access functions to signal errors in r29 instead of r8
  - parisc/unaligned: Rewrite inline assembly of emulate_ldh()
  - parisc/unaligned: Use EFAULT fixup handler in unaligned handlers
  - !7436 [sync] PR-7414:  clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
  - clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
  - arm64: make cma=0 as default for openeuler
  - net: gtp: Fix Use-After-Free in gtp_dellink
  - !7383 [sync] PR-6428:  net/sched: flower: Fix unable to handle page fault bug in fl_init
  - !7267  block/rnbd-srv: Check for unlikely string overflow
  - wifi: iwlwifi: fix a memory corruption
  - net/sched: flower: Fix unable to handle page fault bug in fl_init
  - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  - netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
  - tcp: add sanity checks to rx zerocopy
  - net-zerocopy: Refactor frag-is-remappable test.
  - sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - blk-iocost: Fix an UBSAN shift-out-of-bounds warning
  - PM / devfreq: Synchronize devfreq_monitor_[start/stop]
  - ppp_async: limit MRU to 64K
  - inet: read sk->sk_family once in inet_recv_error()
  - tunnels: fix out of bounds access when building IPv6 PMTU error
  - net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
  - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
  - fs/proc: do_task_stat: use __for_each_thread()
  - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand()
  - exit: Use the correct exit_code in /proc/<pid>/stat
  - btrfs: don't drop extent_map for free space inode on write error
  - iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  - nilfs2: fix data corruption in dsync block recovery for small block sizes
  - powerpc/kasan: Fix addr error caused by page alignment
  - KVM: s390: vsie: fix race during shadow creation
  - llc: make llc_ui_sendmsg() more robust against bonding changes
  - llc: Drop support for ETH_P_TR_802_2.
  - binder: fix race between mmput() and do_exit()
  - block/rnbd-srv: Check for unlikely string overflow
  - Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  - netfilter: nf_tables: disallow anonymous set with timeout flag
  - SUNRPC: Fix a suspicious RCU usage warning
  - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  - crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - x86/xen: Add some null pointer checking to smp.c
  - devlink: fix possible use-after-free and memory leaks in devlink_init()
  - mmc: mmci: stm32: fix DMA API overlapping mappings warning
  - mmc: mmci: stm32: use a buffer for unaligned DMA requests
  - net/sched: act_mirred: use the backlog for mirred ingress
  - netfilter: nft_set_pipapo: release elements in clone only from destroy path
  - netfilter: nft_set_pipapo: remove scratch_aligned pointer
  - netfilter: nft_set_pipapo: add helper to release pcpu scratch area
  - netfilter: nft_set_pipapo: store index in scratch maps
  - um: time-travel: fix time corruption
  - tracing: Ensure visibility when inserting an element into tracing_map


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.77.0.157
changelog:
  - !8099  Fix CVE-2023-52854
  - !8045  drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process
  - !8148  pinctrl: single: fix potential NULL dereference
  - !8157 [sync] PR-8017:  perf/core: Bail out early if the request AUX area is out of bound
  - !8114 [sync] PR-8023:  fs/ntfs3: Fixed overflow check in mi_enum_attr()
  - !8093 [sync] PR-7980:  Fix CVE-2021-47455
  - !8117 [sync] PR-8060:  soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  - !7799  net-memcg: Fix scope of sockmem pressure indicators
  - !8087 [sync] PR-8019:  pstore/zone: Add a null pointer check to the psz_kmsg_read
  - !8095 [sync] PR-7143:  media: usbtv: Remove useless locks in usbtv_video_free()
  - !7134 [sync] PR-7092:  Squashfs: check the inode number is not the invalid value of zero
  - perf/core: Bail out early if the request AUX area is out of bound
  - !8132  scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
  - pinctrl: single: fix potential NULL dereference
  - !8083 [sync] PR-6808:  CVE-2024-26923
  - !8003 [sync] PR-7970:  fbmon: prevent division by zero in fb_videomode_from_videomode()
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
  - !6875 [sync] PR-6756:  vfio/fsl-mc: Block calling interrupt handler without trigger
  - soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  - fs/ntfs3: Fixed overflow check in mi_enum_attr()
  - !7879 [sync] PR-7684:  dm snapshot: fix lockup in dm_exception_table_exit
  - !8072 [sync] PR-8030:  netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  - padata: Fix refcnt handling in padata_free_shell()
  - padata: Convert from atomic_t to refcount_t on parallel_data->refcnt
  - !7995  HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  - !8041  media: vidtv: mux: Add check and kfree for kstrdup
  - media: usbtv: Remove useless locks in usbtv_video_free()
  - ptp: fix code indentation issues
  - ptp: Fix possible memory leak in ptp_clock_register()
  - !7962  hwmon: (axi-fan-control) Fix possible NULL pointer dereference
  - pstore/zone: Add a null pointer check to the psz_kmsg_read
  - !8020  media: bttv: fix use after free error due to btv->timeout timer
  - af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
  - af_unix: Fix garbage collector racing against connect()
  - !8026 [sync] PR-7961:  net: atlantic: eliminate double free in error handling logic
  - !7945  crypto: engine - fix crypto_queue backlog handling
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  - !8034  clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data
  - drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process
  - media: vidtv: mux: Add check and kfree for kstrdup
  - clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data
  - !8005 [sync] PR-7903:  virtio_ring : keep used_wrap_counter in
  - net: atlantic: eliminate double free in error handling logic
  - media: bttv: fix use after free error due to btv->timeout timer
  - virtio_ring : keep used_wrap_counter in vq->last_used_idx
  - fbmon: prevent division by zero in fb_videomode_from_videomode()
  - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  - !7954  media: vidtv: psi: Add check for kstrdup
  - !7973 [sync] PR-7949:  drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
  - !7968 [sync] PR-7943: v2  netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  - !7939 v2  pstore/platform: Add check for kstrdup
  - drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
  - netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  - !7936 [sync] PR-7911:  ACPI: LPIT: Avoid u32 multiplication overflow
  - !7850 [sync] PR-7576:  f2fs: compress: fix reserve_cblocks counting error when out of space
  - !7862 [sync] PR-7757:  Fix CVE-2023-52656
  - hwmon: (axi-fan-control) Fix possible NULL pointer dereference
  - media: vidtv: psi: Add check for kstrdup
  - crypto: engine - fix crypto_queue backlog handling
  - !7914 [sync] PR-7853:  net/mlx5e: fix a double-free in arfs_create_groups
  - pstore/platform: Add check for kstrdup
  - ACPI: LPIT: Avoid u32 multiplication overflow
  - !7787 [sync] PR-7655: v3  KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
  - !7906 [sync] PR-7877: v4  eeprom: at24: fix memory corruption race condition
  - net/mlx5e: fix a double-free in arfs_create_groups
  - !7897  Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
  - eeprom: at24: fix memory corruption race condition
  - !7796 [sync] PR-7743:  netrom: Fix data-races around sysctl_net_busy_read
  - !7884 [sync] PR-7773:  Fix CVE-2023-52698
  - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
  - calipso: fix memory leak in netlbl_calipso_add_pass()
  - netlabel: remove unused parameter in netlbl_netlink_auditinfo()
  - net: netlabel: Fix kerneldoc warnings
  - dm snapshot: fix lockup in dm_exception_table_exit
  - !7859 [sync] PR-7846:  netrom: Fix a data-race around sysctl_netrom_transport_timeout
  - io_uring: drop any code related to SCM_RIGHTS
  - io_uring/unix: drop usage of io_uring socket
  - netrom: Fix a data-race around sysctl_netrom_transport_timeout
  - !7778 [sync] PR-7749: v2  wifi: iwlwifi: dbg-tlv: ensure NUL termination
  - f2fs: compress: fix reserve_cblocks counting error when out of space
  - !7829 [sync] PR-7779:  LoongArch: Define the __io_aw() hook as mmiowb()
  - !7826 [sync] PR-7714:  CVE-2024-35936
  - !7837 [sync] PR-7681:  xfs: three bug fix recently
  - xfs: update dir3 leaf block metadata after swap
  - xfs: ensure logflagsp is initialized in xfs_bmap_del_extent_real
  - iomap: fix warning in xfs_iomap_write_delalloc_release()
  - !7747  x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  - !7819 [sync] PR-7734:  mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
  - LoongArch: Define the __io_aw() hook as mmiowb()
  - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
  - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
  - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
  - net-memcg: Fix scope of sockmem pressure indicators
  - netrom: Fix data-races around sysctl_net_busy_read
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
  - !7768  net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination
  - !7711 [sync] PR-7579:  powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  - !7755  wifi: ath11k: decrease MHI channel buffer length to 8KB
  - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
  - wifi: ath11k: decrease MHI channel buffer length to 8KB
  - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  - powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  - Merge remote-tracking branch 'upstream/openEuler-22.03-LTS-SP1' into HEAD
  - Merge remote-tracking branch 'upstream/openEuler-22.03-LTS-SP1' into HEAD
  - Squashfs: check the inode number is not the invalid value of zero
  - vfio/fsl-mc: Block calling interrupt handler without trigger


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.78.0.158
changelog:
  - !8594 [sync] PR-6990:  netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - !8591 [sync] PR-7174:  CVE-2022-48689
  - !8595 [sync] PR-6939:  USB: core: Fix deadlock in usb_deauthorize_interface()
  - !8554 [sync] PR-8395:  5.10: fix CVE-2024-35978
  - !8364  perf: hisi: Fix use-after-free when register pmu fails
  - !8606  smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  - !7672  btrfs: send: handle path ref underflow in header iterate_inode_ref()
  - !8597 [sync] PR-6393:  crypto: xilinx - call finalize with bh disabled
  - !8514  net: ena: Fix incorrect descriptor free behavior
  - !8563 [sync] PR-8110:  drm/client: Fully protect modes[
  - smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  - crypto: xilinx - call finalize with bh disabled
  - USB: core: Fix deadlock in usb_deauthorize_interface()
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - tcp: TX zerocopy should not sense pfmemalloc status
  - net: skbuff: update comment about pfmemalloc propagating
  - net: introduce __skb_fill_page_desc_noacc
  - tcp: factor out tcp_build_frag()
  - !8505  CVE: CVE-2024-36015
  - drm/client: Fully protect modes[] with dev->mode_config.mutex
  - !8523  tty: vcc: Add check for kstrdup() in vcc_probe()
  - !8487 [sync] PR-8397:  mm/hugetlb: fix missing hugetlb_lock for resv uncharge
  - !8486 [sync] PR-8373:  dma-direct: Leak pages on dma_set_decrypted() failure
  - !8245 [sync] PR-7870:  CVE-2024-35995
  - Bluetooth: Fix memory leak in hci_req_sync_complete()
  - !8202  arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
  - !8408  pinctrl: core: delete incorrect free in pinctrl_enable()
  - tty: vcc: Add check for kstrdup() in vcc_probe()
  - net: ena: Fix incorrect descriptor free behavior
  - !8457 [sync] PR-8416:  iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
  - !8501 [sync] PR-7889:  vt: fix unicode buffer corruption when deleting characters
  - ppdev: Add an error check in register_device
  - ppdev: Remove usage of the deprecated ida_simple_xx() API
  - vt: fix unicode buffer corruption when deleting characters
  - mm/hugetlb: fix missing hugetlb_lock for resv uncharge
  - dma-direct: Leak pages on dma_set_decrypted() failure
  - !8429  drm/amdgpu: Fix even more out of bound writes from debugfs
  - !8340  soc: qcom: llcc: Handle a second device without data corruption
  - !8369  efi/capsule-loader: fix incorrect allocation size
  - !8312 [sync] PR-8039: v2  dynamic_hugetlb: backport some bugfix
  - !8451 [sync] PR-8342:  net/mlx5: Properly link new fs rules into the tree
  - !8293  drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
  - iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
  - net/mlx5: Properly link new fs rules into the tree
  - !8179  jfs: fix array-index-out-of-bounds in diAlloc
  - !8167 v2  mmc: sdio: fix possible resource leaks in some error paths
  - !8346 [sync] PR-8248:  gfs2: ignore negated quota changes
  - !8331 [sync] PR-8254:  sysv: don't call sb_bread() with pointers_lock held
  - !8375 [sync] PR-8306:  mptcp: ensure tx skbs always have the MPTCP ext
  - drm/amdgpu: Fix even more out of bound writes from debugfs
  - !8391 [sync] PR-8109:  vhost-vdpa: fix use after free in vhost_vdpa_probe()
  - pinctrl: core: delete incorrect free in pinctrl_enable()
  - !8370  locking/ww_mutex/test: Fix potential workqueue corruption
  - !8311  drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
  - !8334  wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
  - !8317  net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
  - !8235 [sync] PR-8054:  CVE-2023-52669
  - !8380 [sync] PR-8212:  fix CVE-2024-35877
  - vhost-vdpa: fix use after free in vhost_vdpa_probe()
  - !8294  CVE-2023-52735
  - x86/mm/pat: fix VM_PAT handling in COW mappings
  - !8196  clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
  - mptcp: ensure tx skbs always have the MPTCP ext
  - locking/ww_mutex/test: Fix potential workqueue corruption
  - efi/capsule-loader: fix incorrect allocation size
  - perf: hisi: Fix use-after-free when register pmu fails
  - !7776 [sync] PR-7717:  CVE-2023-52655
  - !8323 [sync] PR-8219:  tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
  - !8273  ALSA: hda: Do not unset preset when cleaning up codec
  - !8269  drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
  - !8251 v2  CVE-2024-35956
  - gfs2: ignore negated quota changes
  - soc: qcom: llcc: Handle a second device without data corruption
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
  - sysv: don't call sb_bread() with pointers_lock held
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
  - !8277  usb: udc: remove warning when queue disabled ep
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
  - !8289 [sync] PR-8150:  mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
  - !8265 [sync] PR-8228:  ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  - mm/dynamic_hugetlb: refine error info in the destruction
  - mm/dynamic_hugetlb: make free_huge_page_to_dhugetlb_pool irq safe
  - mm/dynamic_hugetlb: check NULL pointer for early parameter
  - mm/dynamic_hugetlb: add lru_add_drain_all() before migration
  - mm/dynamic_hugetlb: add cond_resched() in hpool_merge_page()
  - mm/dynamic_hugetlb: reduce the number of migration attempts
  - mm/dpool: Use helper function to lock/unlock
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
  - !8231  CVE-2023-52804
  - bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
  - bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself
  - drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
  - mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
  - !7833 [sync] PR-7599:  irqchip/gic-v3-its: Prevent double free on error
  - !8259 v5  can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
  - usb: udc: remove warning when queue disabled ep
  - ALSA: hda: Do not unset preset when cleaning up codec
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
  - ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
  - !7855  clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
  - btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations
  - btrfs: fix anon_dev leak in create_subvol()
  - ACPI: CPPC: Fix access width used for PCC registers
  - ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
  - ACPI: CPPC: Use access_width over bit_width for system memory accesses
  - ACPI: CPPC: Fix up I/O port access in cpc_read()
  - ACPI: CPPC: Implement support for SystemIO registers
  - crypto: s390/aes - Fix buffer overread in CTR mode
  - fs/jfs: Add validity check for db_maxag and db_agpref
  - fs: jfs: fix shift-out-of-bounds in dbAllocAG
  - !8224  ALSA: hda: Fix possible null-ptr-deref when assigning a stream
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream
  - !8125 [sync] PR-8042:  xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  - arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
  - clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
  - jfs: fix array-index-out-of-bounds in diAlloc
  - mmc: sdio: fix possible resource leaks in some error paths
  - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  - clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
  - irqchip/gic-v3-its: Prevent double free on error
  - usb: aqc111: check packet for fixup for true limit
  - btrfs: send: handle path ref underflow in header iterate_inode_ref()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.79.0.159
changelog:
  - !8950  aio: fix mremap after fork null-deref
  - !8948  CVE-2022-48652
  - !8866  ipv6: prevent NULL dereference in ip6_output()
  - !8780  smb: client: fix UAF in smb2_reconnect_server()
  - !8859  net/smc: avoid data corruption caused by decline
  - !8722 v2  SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
  - !8964  Fix CVE-2024-35915
  - !8963  Fix CVE-2024-35915
  - !8735  mptcp: ensure snd_nxt is properly initialized on connect
  - !8761  tipc: fix UAF in error path
  - !8741  octeontx2-af: avoid off-by-one read from userspace
  - !8953  powerpc/powernv: Add a null pointer check in opal_event_init()
  - !8685  mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  - !8967  Fix CVE-2024-36949
  - !8861  blk-iocost: do not WARN if iocg was already offlined
  - !8841 v2  IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
  - !8945  usb: typec: ucsi: Limit read size on v1.2
  - !8905  ALSA: scarlett2: Add missing error checks to *_ctl_get()
  - !8709 [sync] PR-8046:  block: prevent division by zero in blk_rq_stat_sum()
  - !8839  blk-iocost: avoid out of bounds shift
  - !8857  PCI/PM: Drain runtime-idle callbacks before driver removal
  - amd/amdkfd: sync all devices to wait all processes being evicted
  - drm/amdkfd: Rework kfd_locked handling
  - !8911  net/mlx5e: Fix use-after-free of encap entry in neigh update handler
  - !8915  gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - !8788 [sync] PR-8558:  xen-netfront: Add missing skb_mark_for_recycle
  - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_rx_work
  - nfc: nci: Fix kcov check in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
  - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_rx_work
  - nfc: nci: Fix kcov check in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
  - powerpc/powernv: Add a null pointer check in opal_event_init()
  - aio: fix mremap after fork null-deref
  - ice: Fix crash by keep old cfg when update TCs more than queues
  - ice: ethtool: Prohibit improper channel config for DCB
  - !8880  net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - usb: typec: ucsi: Limit read size on v1.2
  - !8892  net: fix out-of-bounds access in ops_init
  - !8810  net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs
  - !8672  fix CVE-2024-36021 and CVE-2024-36900
  - !8886  CVE-2024-36933
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - net/mlx5e: Fix use-after-free of encap entry in neigh update handler
  - ALSA: scarlett2: Add missing error checks to *_ctl_get()
  - !8755  drm/amd/display: Avoid NULL dereference of timing generator
  - !8754  pwm: Fix double shift bug
  - !8850  ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - net: fix out-of-bounds access in ops_init
  - !8665  phonet/pep: fix racy skb_queue_empty() use
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - ipv6: prevent NULL dereference in ip6_output()
  - blk-iocost: do not WARN if iocg was already offlined
  - net/smc: avoid data corruption caused by decline
  - PCI/PM: Drain runtime-idle callbacks before driver removal
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - !8687  tcp: properly terminate timers for kernel sockets
  - !8630  erspan: make sure erspan_base_hdr is present in skb->head
  - IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
  - blk-iocost: avoid out of bounds shift
  - !7988 [sync] PR-7960:  ipv6: Fix infinite recursion in fib6_dump_done().
  - !8388 [sync] PR-8300:  ipvlan: add ipvlan_route_v6_outbound() helper
  - !8282 [sync] PR-8133:  fix CVE-2021-47265
  - !7925 [sync] PR-7741:  ipv4: check for NULL idev in ip_route_use_hint()
  - !8724  tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - !8480  scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - !8622  fs/9p: only translate RWX permissions for plain 9P2000
  - net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs
  - !8728  net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()
  - !8790  Bluetooth: SCO: Fix not validating setsockopt user input
  - !8680  rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  - !8713 [sync] PR-8583:  mmc: sdhci-msm: pervent access to suspended controller
  - !8670  CVE-2024-35854
  - Bluetooth: SCO: Fix not validating setsockopt user input
  - !8696  clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
  - !8653 v3  clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
  - xen-netfront: Add missing skb_mark_for_recycle
  - !8571  jfs: fix two array-index-out-of-bounds issuse
  - !8356  nilfs2: fix underflow in second superblock position calculations
  - !8592  geneve: fix header validation in geneve[6
  - !8531  gpiolib: cdev: fix uninitialised kfifo
  - smb: client: fix UAF in smb2_reconnect_server()
  - !8631 [sync] PR-8519:  mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq
  - tipc: fix UAF in error path
  - !8751  ubifs: Check @c->dirty_[n|p
  - drm/amd/display: Avoid NULL dereference of timing generator
  - pwm: Fix double shift bug
  - !8633 [sync] PR-8425:  CVE-2023-52677
  - ubifs: Check @c->dirty_[n|p]n_cnt and @c->nroot state under @c->lp_mutex
  - octeontx2-af: avoid off-by-one read from userspace
  - !8669  wifi: ath11k: fix dfs radar event locking
  - !8619  CVE-2024-35896
  - !8608  CVE-2024-35895
  - mptcp: ensure snd_nxt is properly initialized on connect
  - !8659  wifi: ath11k: fix htt pktlog locking
  - !8587  fix CVE-2021-47558
  - net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()
  - !8569  fix CVE-2024-36906
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
  - !7933  bpf: Protect against int overflow for stack access size
  - !8627 [sync] PR-8561:  mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
  - !8625 [sync] PR-8497:  Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
  - mmc: sdhci-msm: pervent access to suspended controller
  - !8572  xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
  - block: prevent division by zero in blk_rq_stat_sum()
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
  - tcp: properly terminate timers for kernel sockets
  - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  - net: hns3: fix kernel crash when devlink reload during initialization
  - net: hns3: release PTP resources if pf initialization failed
  - net: hns3: fix kernel crash when devlink reload during vf initialization
  - net: hns3: fix kernel crash when devlink reload during pf initialization
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
  - wifi: ath11k: fix dfs radar event locking
  - phonet/pep: fix racy skb_queue_empty() use
  - wifi: ath11k: fix htt pktlog locking
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
  - !8537  scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs
  - !8538  drm/amdgpu: Fix potential null pointer derefernce
  - !8540  s390/dasd: protect device queue against concurrent access
  - !8462  i2c: smbus: fix NULL function pointer dereference
  - !8432  platform/x86: wmi: Fix opening of char device
  - riscv: Check if the code to patch lies in the exit section
  - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq
  - erspan: make sure erspan_base_hdr is present in skb->head
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
  - fs/9p: only translate RWX permissions for plain 9P2000
  - netfilter: complete validation of user input
  - netfilter: validate user input for expected length
  - Revert "bpf, sockmap: Prevent lock inversion deadlock in map delete elem"
  - bpf: Allow delete from sockmap/sockhash only if update is allowed
  - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
  - geneve: fix header validation in geneve[6]_xmit_skb
  - net: stmmac: Disable Tx queues when reconfiguring the interface
  - xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
  - jfs: fix array-index-out-of-bounds in dbFindLeaf
  - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
  - ARM: 9381/1: kasan: clear stale stack poison
  - s390/dasd: protect device queue against concurrent access
  - drm/amdgpu: Fix potential null pointer derefernce
  - scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs
  - gpiolib: cdev: fix uninitialised kfifo
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - i2c: smbus: fix NULL function pointer dereference
  - platform/x86: wmi: Fix opening of char device
  - ipvlan: add ipvlan_route_v6_outbound() helper
  - nilfs2: fix underflow in second superblock position calculations
  - RDMA: Verify port when creating flow rule
  - IB/mlx4: Use port iterator and validation APIs
  - ipv6: Fix infinite recursion in fib6_dump_done().
  - bpf: Protect against int overflow for stack access size
  - ipv4: check for NULL idev in ip_route_use_hint()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.80.0.160
changelog:
  - !9093 v2  ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
  - !9031  bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - !9065  afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
  - !8933  Fix CVE-2023-52732
  - !8927 [sync] PR-8222:  Fix CVE-2023-52672
  - !9172 [sync] PR-7041:  netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  - !9171 [sync] PR-6994: v2  net/mlx5e: Prevent deadlock while disabling aRFS
  - !8733  batman-adv: Avoid infinite loop trying to resize local TT
  - !7374 [sync] PR-6879:  net/smc: Fix possible access to freed memory in link clear
  - !9098  Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  - net/mlx5e: Prevent deadlock while disabling aRFS
  - !9165  genirq: introduce handle_fasteoi_edge_irq flow handler
  - genirq: introduce handle_fasteoi_edge_irq for phytium
  - genirq: introduce handle_fasteoi_edge_irq flow handler
  - !9139 v2  CVE-2024-36971
  - !8495  rpmsg: virtio: Free driver_override when rpmsg_remove()
  - !9127  hsr: Prevent use after free in prp_create_tagged_frame()
  - !9075  Fix UAF problem of hpool
  - !9132  mm: swap: fix race between free_swap_and_cache() and swapoff()
  - !9130  ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
  - !9069  Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - !8970  mmc: mmc_spi: fix error handling in mmc_spi_probe()
  - !8977 [sync] PR-8584:  virtio-blk: fix implicit overflow on virtio_max_dma_size
  - !8701  wifi: cfg80211: check A-MSDU format more carefully
  - net: fix kabi breakage in struct dst_ops
  - net: fix __dst_negative_advice() race
  - net: annotate data-races around sk->sk_dst_pending_confirm
  - mm: swap: fix race between free_swap_and_cache() and swapoff()
  - ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
  - hsr: Prevent use after free in prp_create_tagged_frame()
  - !9002  scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - !9056  drm/panel: fix a possible null pointer dereference
  - !9054  soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !8939  clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - !8952  ACPI: video: check for error while searching for backlight device parent
  - !8986 [sync] PR-8639:  s390/qeth: Fix kernel panic after setting hsuid
  - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - !8714  Fix page corruption caused by racy check in __free_pages
  - ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
  - !9080  Bluetooth: L2CAP: Fix not validating setsockopt user input
  - Bluetooth: L2CAP: Fix not validating setsockopt user input
  - mm/dynamic_hugetlb: use rcu lock to protect hpool
  - mm/dynamic_hugetlb: simplify the refcount code
  - !9072 [sync] PR-9015:  CVE-2024-36953
  - !9071 [sync] PR-9014:  drm/vc4: don't check if plane->state->fb == state->fb
  - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
  - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
  - drm/vc4: don't check if plane->state->fb == state->fb
  - Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
  - !8947 [sync] PR-6800:  block: fix overflow in blk_ioctl_discard()
  - !9052  CVE-2024-35796
  - drm/panel: fix a possible null pointer dereference
  - soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !9021  wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - net: ll_temac: platform_get_resource replaced by wrong function
  - !9048  IB/hfi1: Restore allocated resources on failed copyout
  - IB/hfi1: Restore allocated resources on failed copyout
  - !9028  tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - !8830  Fix CVE-2024-35951
  - !9009  fix CVE-2024-35839
  - !9008  tipc: fix a possible memleak in tipc_buf_append
  - !8721  CVE-2024-35887
  - !8876  drm/vmwgfx: Fix invalid reads in fence signaled events
  - !8884  scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - !8922  hugetlbfs: fix hugetlbfs_statfs() locking
  - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - netfilter: bridge: replace physindev with physinif in nf_bridge_info
  - netfilter: propagate net to nf_bridge_get_physindev
  - netfilter: nfnetlink_log: use proper helper for fetching physinif
  - !8662  usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
  - tipc: fix a possible memleak in tipc_buf_append
  - !8617 [sync] PR-8472:  fix CVE-2024-27415
  - !8983  fix CVE-2024-36905
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - s390/qeth: Fix kernel panic after setting hsuid
  - net: relax socket state check at accept time.
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
  - virtio-blk: fix implicit overflow on virtio_max_dma_size
  - mmc: mmc_spi: fix error handling in mmc_spi_probe()
  - ACPI: video: check for error while searching for backlight device parent
  - block: fix overflow in blk_ioctl_discard()
  - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - ceph: blocklist the kclient when receiving corrupted snap trace
  - ceph: shut down access to inode when async create fails
  - ceph: refactor remove_session_caps_cb
  - ceph: fix auth cap handling logic in remove_session_caps_cb
  - ceph: drop private list from remove_session_caps_cb
  - pipe: wakeup wr_wait after setting max_usage
  - fs/pipe: move check to pipe_has_watch_queue()
  - hugetlbfs: fix hugetlbfs_statfs() locking
  - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - drm/vmwgfx: Fix invalid reads in fence signaled events
  - drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
  - drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
  - batman-adv: Avoid infinite loop trying to resize local TT
  - ax25: fix use-after-free bugs caused by ax25_ds_del_timer
  - Fix page corruption caused by racy check in __free_pages
  - wifi: cfg80211: check A-MSDU format more carefully
  - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
  - netfilter: br_netfilter: skip conntrack input hook for promisc packets
  - netfilter: bridge: confirm multicast packets before passing them up the stack
  - rpmsg: virtio: Free driver_override when rpmsg_remove()
  - net/smc: Fix possible access to freed memory in link clear


