# changelog

author: zhanghua <zhanghua40@huawei.com> - 2.2.0-18
changelog:
  - Type:CVE
  - ID:NA
  - SUG:NA
  - DESC:fix CVE-2017-9110 CVE-2017-9111 CVE-2017-9112 CVE-2017-9113
    CVE-2017-9114 CVE-2017-9115 CVE-2017-9116 CVE-2017-12596


author: wangyue <wangyue92@huawei.com> - 2.2.0-19
changelog:
  - fix CVE-2021-3474 CVE-2021-3477 CVE-2021-3476 CVE-2021-3475 CVE-2021-20296 CVE-2021-3479 CVE-2021-20296


author: Huawei Technologies Co., Ltd <alex.chen@huawei.com>
changelog:
  - hw: usb: hcd-ohci: check for processed TD before retire
  - hw: ehci: check return value of 'usb_packet_map'
  - hw: usb: hcd-ohci: check len and frame_number variables
  - hw/net/e1000e: advance desc_offset in case of null descriptor


author: Huawei Technologies Co., Ltd <alex.chen@huawei.com>
changelog:
  - ati: use vga_read_byte in ati_cursor_define
  - sd: sdhci: assert data_count is within fifo_buffer
  - msix: add valid.accepts methods to check address


author: Chen Qun <kuhn.chenqun@huawei.com>
changelog:
  - scsi-bus: Refactor the code that retries requests
  - scsi-disk: Add support for retry on errors
  - qapi/block-core: Add retry option for error action
  - block-backend: Introduce retry timer
  - block-backend: Add device specific retry callback
  - block-backend: Enable retry action on errors
  - block-backend: Add timeout support for retry
  - block: Add error retry param setting
  - virtio-blk: Refactor the code that processes queued requests
  - virtio-blk: On restart, process queued requests in the proper context
  - virtio_blk: Add support for retry on errors
  - block-backend: Stop retrying when draining
  - block: Add sanity check when setting retry parameters


author: Chen Qun <kuhn.chenqun@huawei.com>
changelog:
  - hw/sd: sdhci: Don't transfer any data when command time out
  - hw/sd: sdhci: Don't write to SDHC_SYSAD register when transfer is in progress
  - hw/sd: sdhci: Correctly set the controller status for ADMA
  - hw/sd: sdhci: Limit block size only when SDHC_BLKSIZE register is writable
  - hw/sd: sdhci: Reset the data pointer of s->fifo_buffer[] when a different block size is programmed


author: Chen Qun <kuhn.chenqun@huawei.com>
changelog:
  - net: introduce qemu_receive_packet()
  - e1000: switch to use qemu_receive_packet() for loopback
  - dp8393x: switch to use qemu_receive_packet() for loopback packet
  - sungem: switch to use qemu_receive_packet() for loopback
  - tx_pkt: switch to use qemu_receive_packet_iov() for loopback
  - rtl8139: switch to use qemu_receive_packet() for loopback
  - pcnet: switch to use qemu_receive_packet() for loopback
  - cadence_gem: switch to use qemu_receive_packet() for loopback
  - lan9118: switch to use qemu_receive_packet() for loopback


author: Chen Qun <kuhn.chenqun@huawei.com>
changelog:
  - hw/pci-host: add pci-intack write method
  - pci-host: add pcie-msi read method
  - vfio: add quirk device write method
  - prep: add ppc-parity write method
  - nvram: add nrf51_soc flash read method
  - spapr_pci: add spapr msi read method
  - tz-ppc: add dummy read/write methods
  - imx7-ccm: add digprog mmio write method


author: Chen Qun <kuhn.chenqun@huawei.com>
changelog:
  - vhost-user-gpu: fix resource leak in 'vg_resource_create_2d' (CVE-2021-3544)
  - vhost-user-gpu: fix memory leak in vg_resource_attach_backing (CVE-2021-3544)
  - vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' (CVE-2021-3544)
  - vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544)
  - vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' (CVE-2021-3544)
  - vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info (CVE-2021-3545)
  - vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546)


author: Chen Qun <kuhn.chenqun@huawei.com>
changelog:
  - ide: ahci: add check to avoid null dereference (CVE-2019-12067)
  - hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register
  - usb: limit combined packets to 1 MiB (CVE-2021-3527)


author: Chen Qun <kuhn.chenqun@huawei.com>
changelog:
  - fix cve-2020-35504 esp: always check current_req is not NULL before use in DMA callbacks
  - fix cve-2020-35505 esp: ensure cmdfifo is not empty and current_dev is non-NULL


