# changelog

author: wangxiao <wangxiao65@huawei.com> - 6.9.10.67-19
changelog:
  - Fix CVE-2020-25676 CVE-2020-27757 CVE-2020-27758 CVE-2020-27771
    CVE-2020-27772 CVE-2020-27774 CVE-2020-27775 CVE-2020-27751


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2203.1.0.0139
changelog:
  - usb: gadget: rndis: check size of RNDIS_MSG_SET command
  - USB: gadget: validate interface OS descriptor requests
  - mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
  - udf: Restore i_lenAlloc when inode expansion fails
  - udf: Fix NULL ptr deref when converting from inline format
  - ext4: fix underflow in ext4_max_bitmap_size()
  - bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds()
  - livepatch/x86: Fix incorrect use of 'strncpy'
  - tipc: improve size validations for received domain records
  - yam: fix a memory leak in yam_siocdevprivate()
  - ipmi_si: Phytium S2500 missing timeout counter reset in intf_mem_inw
  - mm,hwpoison: Fix use-after-free in memory_failure()
  - dm-mpath: fix UAF in multipath_message()
  - usb: gadget: clear related members when goto fail
  - usb: gadget: don't release an existing dev->buf
  - dm: make sure dm_table is binded before queue request
  - cgroup-v1: Require capabilities to set release_agent
  - NFSv4: nfs_atomic_open() can race when looking up a non-regular file
  - NFSv4: Handle case where the lookup of a directory fails
  - configfs: fix a race in configfs_{,un}register_subsystem()


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2203.2.0.0140
changelog:
  - mm: Fix return val in khugepaged_scan_pmd()
  - mm: do some clean up of accounting ReliableTaskUsed
  - mm: fix statistic of ReliableTaskUsed
  - mm: fix missing reclaim of low-reliable page cache
  - mm: fix statistic of ReliableFileCache in /proc/meminfo
  - mm: Add more gfp flag check in prepare_before_alloc()
  - efi: Stub mirrored_kernelcore if CONFIG_HAVE_MEMBLOCK_NODE_MAP is not enabled
  - mm: Memory reliable features can only be disabled via proc interface
  - mm: Fix reliable_debug in proc not consistent with boot parameter problem
  - f2fs: fix to do sanity check on inode type during garbage collection
  - mm: Check page status in page_reliable()
  - mm: Show ReliableTaskUsed in /proc/meminfo
  - mm: Refactor code in reliable_report_meminfo()
  - mm: Show correct reliable_user_used if PAGE_SIZE is not 4K
  - proc: Fix reliable display err in /proc/pid/status
  - Revert "mm: add page cache fallback statistic"
  - mm: fix page cache use reliable memory when reliable_debug=P
  - mm: add support for limiting the usage of reliable memory in pagecache
  - mm: add "ReliableFileCache" item in /proc/meminfo
  - mm: Introduce shmem mirrored memory limit for memory reliable
  - mm: Introduce watermark check for memory reliable
  - mm: Count mirrored pages in buddy system
  - mm: Export mem_reliable_status() for checking memory reliable status
  - mm: Make MEMORY_RELIABLE depends on HAVE_MEMBLOCK_NODE_MAP
  - efi: Disable mirror feature if kernelcore is not spcified
  - mm: Introduce proc interface to control memory reliable features
  - mm: Demote warning message in vmemmap_verify() to debug level
  - mm: Ratelimited mirrored memory related warning messages


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2203.3.0.0141
changelog:
  - crypto: pcrypt - Fix user-after-free on module unload
  - lib/iov_iter: initialize "flags" in new pipe_buffer
  - mm: Count reliable shmem used based on NR_SHMEM
  - mm: fix zoneref mapping problem in memory reliable
  - mm: disable memory reliable when kdump is in progress
  - mm: introduce "clear_freelist" kernel parameter
  - mm: fix unable to use reliable memory in page cache
  - nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
  - select: Fix indefinitely sleeping task in poll_schedule_timeout()
  - mtd: nand: bbt: Fix corner case in bad block table handling
  - netns: add schedule point in ops_exit_list()
  - af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
  - crypto: stm32/crc32 - Fix kernel BUG triggered in probe()
  - ext4: don't use the orphan list when migrating an inode
  - ext4: set csum seed in tmp inode while migrating to extents
  - ext4: make sure quota gets properly shutdown on error
  - ext4: make sure to reset inode lockdep class when quota enabling fails
  - cputime, cpuacct: Include guest time in user time in cpuacct.stat
  - serial: Fix incorrect rs485 polarity on uart open
  - scsi: sr: Don't use GFP_DMA
  - dm space map common: add bounds check to sm_ll_lookup_bitmap()
  - dm btree: add a defensive bounds check to insert_at()
  - ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
  - ACPICA: Utilities: Avoid deleting the same object twice in a row
  - jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
  - bpf: Do not WARN in bpf_warn_invalid_xdp_action()
  - net: bonding: debug: avoid printing debug logs when bond is not notifying peers
  - net-sysfs: update the queue counts in the unregistration path
  - dmaengine: pxa/mmp: stop referencing config->slave_id
  - scsi: ufs: Fix race conditions related to driver data
  - iommu/io-pgtable-arm: Fix table descriptor paddr formatting
  - ext4: avoid trim error on fs with small groups
  - net: mcs7830: handle usb read errors properly
  - tpm: add request_locality before write TPM_INT_ENABLE
  - netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
  - xfrm: state and policy should fail if XFRMA_IF_ID 0
  - xfrm: interface with if_id 0 should return error
  - crypto: stm32/cryp - fix double pm exit
  - xfrm: fix a small bug in xfrm_sa_len()
  - sched/rt: Try to restart rt period timer when rt runtime exceeded
  - serial: amba-pl011: do not request memory region twice
  - tty: serial: uartlite: allow 64 bit address
  - netfilter: bridge: add support for pppoe filtering
  - crypto: qce - fix uaf on qce_ahash_register_one
  - shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
  - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet
  - ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
  - scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
  - ipv6: Do cleanup if attribute validation fails in multipath route
  - ipv6: Continue processing multipath route even if gateway attribute is invalid
  - ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
  - ipv6: Check attribute length for RTA_GATEWAY in multipath route
  - tracing: Tag trace_percpu_buffer as a percpu pointer
  - tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
  - net: fix use-after-free in tw_timer_handler
  - udp: using datalen to cap ipv6 udp max gso segments
  - selinux: initialize proto variable in selinux_ip_postroute_compat()
  - x86/pkey: Fix undefined behaviour with PKRU_WD_BIT
  - ipmi: fix initialization when workqueue allocation fails
  - ipmi: bail out if init_srcu_struct fails
  - bonding: fix ad_actor_system option setting to default
  - ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
  - net: skip virtio_net_hdr_set_proto if protocol already set
  - net: hns3: update hns3 version to 22.2.1
  - net: hns3: fix RMW issue for VLAN filter switch
  - net: hns3: fix pf vlan filter out of work after self test
  - arm64: acpi: fix UBSAN warning
  - sched: Fix sleeping in atomic context at cpu_qos_write()
  - io_uring: don't re-setup vecs/iter in io_resumit_prep() is already there
  - io_uring: don't double complete failed reissue request
  - io_uring: remove redundant initialization of variable ret
  - block: don't ignore REQ_NOWAIT for direct IO
  - io_uring: re-issue block requests that failed because of resources
  - dm multipath: fix missing blk_account_io_done() in error path
  - block: account inflight from blk_account_io_start() if 'precise_iostat' is set
  - block: add a switch for precise iostat accounting
  - blk-throttle: Set BIO_THROTTLED when bio has been throttled
  - bfq: fix use-after-free in bfq_dispatch_request
  - hugetlbfs: fix a truncation issue in hugepages parameter


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2203.4.0.0142
changelog:
  - kabi: fix kabi broken in struct fuse_in
  - fuse: fix pipe buffer lifetime for direct_io
  - blk-throtl: fix race in io dispatching
  - ext4: Fix symlink file size not match to file content
  - livepatch/core: Check klp_func before 'klp_init_object_loaded'
  - irqchip/gic-phytium-2500: Fix issue that interrupts are concentrated in one cpu
  - blk-mq: add exception handling when srcu->sda alloc failed
  - audit: improve audit queue handling when "audit=1" on cmdline
  - Revert "audit: bugfix for infinite loop when flush the hold queue"
  - veth: Do not record rx queue hint in veth_xmit


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2203.5.0.0143
changelog:
  - livepatch/arm64: Fix incorrect endian conversion when long jump
  - arm64/mpam: realign step entry when traversing rmid_transform
  - dt-bindings: mpam: refactor device tree node structure
  - arm64/mpam: refactor device tree structure to support multiple devices
  - arm64/mpam: fix __mpam_device_create() section mismatch error
  - block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
  - hugetlb: Add huge page alloced limit
  - swiotlb: rework "fix info leak with DMA_FROM_DEVICE"
  - swiotlb: fix info leak with DMA_FROM_DEVICE
  - esp: Fix possible buffer overflow in ESP transformation
  - sock: remove one redundant SKB_FRAG_PAGE_ORDER macro
  - io_uring: fix UAF in get_files_struct()
  - xfs: fix an undefined behaviour in _da3_path_shift
  - xfs: Fix possible null-pointer dereferences in xchk_da_btree_block_check_sibling()
  - xfs: fix use after free in buf log item unlock assert
  - ACPI/IORT: Do not blindly trust DMA masks from firmware


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2204.1.0.0144
changelog:
  - serial: 8250: Fix max baud limit in generic 8250 port
  - sched/fair: Add qos_throttle_list node in struct cfs_rq
  - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
  - Revert "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
  - USB: gadget: validate endpoint index for xilinx udc
  - sr9700: sanity check for packet length
  - ima: Fix return value of ima_write_policy()
  - ima: Don't modify file descriptor mode on the fly
  - ima: Set file->f_mode instead of file->f_flags in ima_calc_file_hash()
  - ima: Remove __init annotation from ima_pcrread()
  - ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init()
  - evm: Check size of security.evm before using it
  - ima: Don't ignore errors from crypto_shash_update()
  - mm: Fallback to non-mirrored region below low watermark
  - mm: Disable watermark check if reliable fallback is disabled
  - mm: Do limit checking after memory allocation for memory reliable


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2204.2.0.0145
changelog:
  - Revert "module, async: async_synchronize_full() on module init iff async is used"
  - tty: n_gsm: fix encoding of control signal octet bit DV
  - fget: clarify and improve __fget_files() implementation
  - memblock: use kfree() to release kmalloced memblock regions
  - tty: n_gsm: fix proper link termination after failed open
  - gso: do not skip outer ip header in case of ipip and net_failover
  - net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends
  - cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug
  - tracing: Fix tp_printk option related with tp_printk_stop_on_boot
  - dmaengine: sh: rcar-dmac: Check for error num after setting mask
  - net: sched: limit TC_ACT_REPEAT loops
  - mtd: rawnand: qcom: Fix clock sequencing in qcom_nandc_probe()
  - NFS: Do not report writeback errors in nfs_getattr()
  - NFS: LOOKUP_DIRECTORY is also ok with symlinks
  - bonding: fix data-races around agg_select_timer
  - drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
  - ping: fix the dif and sdif check in ping_lookup
  - taskstats: Cleanup the use of task->exit_code
  - xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
  - nvme: fix a possible use-after-free in controller reset during load
  - quota: make dquot_quota_sync return errors from ->sync_fs
  - vfs: make freeze_super abort when sync_filesystem returns error
  - serial: parisc: GSC: fix build when IOSAPIC is not set
  - perf: Fix list corruption in perf_cgroup_switch()
  - seccomp: Invalidate seccomp mode to catch death failures
  - n_tty: wake up poll(POLLRDNORM) on receiving data
  - veth: fix races around rq->rx_notify_masked
  - net: fix a memleak when uncloning an skb dst and its metadata
  - net: do not keep the dst cache when uncloning an skb dst and its metadata
  - ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
  - bonding: pair enable_port with slave_arr_updates
  - bpf: Add kconfig knob for disabling unpriv bpf by default
  - scsi: target: iscsi: Make sure the np under each tpg is unique
  - NFSv4 expose nfs_parse_server_name function
  - NFSv4 remove zero number of fs_locations entries error check
  - NFSv4.1: Fix uninitialised variable in devicenotify
  - nfs: nfs4clinet: check the return value of kstrdup()
  - NFSv4 only print the label when its queried
  - NFS: Fix initialisation of nfs_client cl_flags field
  - ima: Allow template selection with ima_template[_fmt]= after ima_hash=
  - ima: Remove ima_policy file before directory
  - integrity: check the return value of audit_log_start()
  - ext4: fix error handling in ext4_restore_inline_data()
  - iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
  - iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()
  - block: bio-integrity: Advance seed correctly for larger interval sizes
  - af_packet: fix data-race in packet_setsockopt / packet_setsockopt
  - rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
  - ipv4: tcp: send zero IPID in SYNACK messages
  - ipv4: raw: lock the socket in raw_bind()
  - phylib: fix potential use-after-free
  - NFS: Ensure the server has an up to date ctime before renaming
  - NFS: Ensure the server has an up to date ctime before hardlinking
  - ipv6: annotate accesses to fn->fn_sernum
  - ipv4: avoid using shared IP generator for connected sockets
  - ping: fix the sk_bound_dev_if match in ping_lookup
  - ipv6_tunnel: Rate limit warning messages
  - tty: n_gsm: fix SW flow control encoding/handling
  - serial: stm32: fix software flow control transfer
  - serial: 8250: of: Fix mapped region size when using reg-offset property
  - netfilter: nft_payload: do not update layer 4 checksum when mangling fragments
  - PM: wakeup: simplify the output logic of pm_show_wakelocks()
  - tty: fix crash in release_tty if tty->port is not set
  - tty: don't crash in tty_init_dev when missing tty_port
  - printk: Convert a use of sprintf to snprintf in console_unlock


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2204.3.0.0146
changelog:
  - ext4: fix fs corruption when tring to remove a non-empty directory with IO error
  - Revert "ext4: fix file system corrupted when rmdir non empty directory with IO error"
  - sched: Fix yet more sched_fork() races
  - sched/fair: Fix wrong cpu selecting from isolated domain
  - netfilter: nf_tables: initialize registers in nft_do_chain()
  - nbd: fix possible overflow on 'first_minor' in nbd_dev_add()
  - net: sched: adapt Qdisc kabi
  - net_sched: fix a crash in tc_new_tfilter()
  - net: sched: use Qdisc rcu API instead of relying on rtnl lock
  - net: sched: add helper function to take reference to Qdisc
  - net: sched: extend Qdisc with rcu
  - net: core: netlink: add helper refcount dec and lock function
  - xen/netfront: react properly to failing gnttab_end_foreign_access_ref()
  - xen/gnttab: fix gnttab_end_foreign_access() without page specified
  - xen/pvcalls: use alloc/free_pages_exact()
  - xen/9p: use alloc/free_pages_exact()
  - xen: remove gnttab_query_foreign_access()
  - xen/gntalloc: don't use gnttab_query_foreign_access()
  - xen/scsifront: don't use gnttab_query_foreign_access() for mapped status
  - xen/netfront: don't use gnttab_query_foreign_access() for mapped status
  - xen/blkfront: don't use gnttab_query_foreign_access() for mapped status
  - xen/grant-table: add gnttab_try_end_foreign_access()
  - xen/xenbus: don't let xenbus_grant_ring() remove grants in error case
  - xen/xenbus: Fix granting of vmalloc'd memory
  - binder: fix test regression due to sender_euid change
  - binder: use cred instead of task for selinux checks
  - binder: use euid from cred instead of using task
  - svm: Change svm to modules
  - svm: Delete unused svm_get_unmapped_area ops
  - ascend: mm: Add MAP_ALIGN flag to map aligned va
  - svm: Delete unused function sysrq_sched_debug_show_export
  - svm: Delete get meminfo interface in svm ioctl
  - svm: Export symbols for svm module
  - can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
  - mm: Add space after ReliableFileCache
  - mm: Drop reliable_reserve_size
  - mm: page_counter: mitigate consequences of a page_counter underflow
  - drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
  - hamradio: remove needs_free_netdev to avoid UAF
  - hamradio: defer 6pack kfree after unregister_netdev
  - ovl: fix uninitialized pointer read in ovl_lookup_real_one()
  - ovl: fix IOCB_DIRECT if underlying fs doesn't support direct IO
  - ovl: fix lseek overflow on 32bit
  - ovl: sync dirty data when remounting to ro mode


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2204.4.0.0147
changelog:
  - Revert "perf: Paper over the hw.target problems"
  - ax25: Fix NULL pointer dereferences in ax25 timers
  - ax25: fix NPD bug in ax25_disconnect
  - ax25: Fix NULL pointer dereference in ax25_kill_by_device
  - ax25: improve the incomplete fix to avoid UAF and NPD bugs
  - ax25: NPD bug when detaching AX25 device
  - objtool: Fix stack offset tracking for indirect CFAs
  - x86/entry/64: Fix unwind hints in kernel exit path
  - af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
  - arm64: Use the clearbhb instruction in mitigations
  - arm64: add ID_AA64ISAR2_EL1 sys register
  - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated
  - arm64: Mitigate spectre style branch history side channels
  - KVM: arm64: Add templates for BHB mitigation sequences
  - arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2
  - arm64: Add percpu vectors for EL1
  - arm64: entry: Add macro for reading symbol addresses from the trampoline
  - arm64: entry: Add vectors that have the bhb mitigation sequences
  - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations
  - arm64: entry: Allow the trampoline text to occupy multiple pages
  - arm64: entry: Make the kpti trampoline's kpti sequence optional
  - arm64: entry: Move trampoline macros out of ifdef'd section
  - arm64: entry: Don't assume tramp_vectors is the start of the vectors
  - arm64: entry: Allow tramp_alias to access symbols after the 4K boundary
  - arm64: entry: Move the trampoline data page before the text page
  - arm64: entry: Free up another register on kpti's tramp_exit path
  - arm64: entry: Make the trampoline cleanup optional
  - arm64: entry.S: Add ventry overflow sanity checks
  - x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
  - x86/speculation: Warn about Spectre v2 LFENCE mitigation
  - x86/speculation: Update link to AMD speculation whitepaper
  - x86/speculation: Use generic retpoline by default on AMD
  - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
  - Documentation/hw-vuln: Update spectre doc
  - x86/speculation: Add eIBRS + Retpoline options
  - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE
  - x86,bugs: Unconditionally allow spectre_v2=retpoline,amd
  - x86/speculation: Merge one test in spectre_v2_user_select_mitigation()
  - mm/memory.c: fix clear_gigantic_page_chunk


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.1.0.0148
changelog:
  - hamradio: improve the incomplete fix to avoid NPD
  - hamradio: defer ax25 kfree after unregister_netdev
  - can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path
  - llc: only change llc->dev when bind() succeeds
  - netdevice: add the case if dev is NULL
  - llc: fix netdevice reference leaks in llc_ui_bind()
  - ARM: fix Thumb2 regression with Spectre BHB
  - ARM: Spectre-BHB: provide empty stub for non-config
  - ARM: fix build warning in proc-v7-bugs.c
  - ARM: Do not use NOCROSSREFS directive with ld.lld
  - ARM: fix co-processor register typo
  - ARM: fix build error when BPF_SYSCALL is disabled
  - ARM: include unprivileged BPF status in Spectre V2 reporting
  - ARM: Spectre-BHB workaround
  - ARM: use LOADADDR() to get load address of sections
  - ARM: early traps initialisation
  - ARM: report Spectre v2 status through sysfs
  - can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.3.0.0149
changelog:
  - ixgbevf: add disable link state
  - ixgbe: add improvement for MDD response functionality
  - ixgbe: add the ability for the PF to disable VF link state
  - io_uring: fix false WARN_ONCE
  - mm/sharepool: Fix sharepool node id invalid when using sp_alloc
  - sharepool: fix hisi oom deadlock
  - share_pool: Fix ABBA deadlock
  - net: ipv6: fix skb_over_panic in __ip6_append_data
  - net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit()
  - net/packet: fix slab-out-of-bounds access in packet_recvmsg()
  - mm: fix dereference a null pointer in migrate[_huge]_page_move_mapping()
  - cpuset: Fix unsafe lock order between cpuset lock and cpuslock
  - tcp: make tcp_read_sock() more robust
  - xfrm: Fix xfrm migrate issues when address family changes
  - Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0"
  - ext4: add check to prevent attempting to resize an fs with sparse_super2
  - net-sysfs: add check for netdevice being present to speed_show
  - memfd: fix F_SEAL_WRITE after shmem huge page allocated
  - PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
  - netfilter: nf_queue: fix possible use-after-free
  - netfilter: nf_queue: don't assume sk is full socket
  - xfrm: enforce validity of offload input flags
  - xfrm: fix the if_id check in changelink
  - netfilter: fix use-after-free in __nf_register_net_hook()
  - xfrm: fix MTU regression
  - cifs: fix double free race when mount fails in cifs_get_root()
  - mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status
  - x86/asm: Move native_write_cr0/4() out of line
  - x86/asm: Pin sensitive CR0 bits
  - x86/asm: Pin sensitive CR4 bits
  - mm: Add more debug info if oom occurs
  - mm: Fix reliable task used problem shown in meminfo
  - mm: Show correct reliable pagecache size


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.4.0.0150
changelog:
  - scsi: hisi_sas: Change hisi_sas_control_phy() phyup timeout
  - scsi: hisi_sas: Fix SAS disk sense info print incorrectly sometimes
  - scsi: hisi_sas: Don't fail IT nexus reset for Open Reject timeout
  - mm/share_pool: Support read-only memory allocation
  - mm: clear_freelist_page: Provide timeout mechanism for worker runtime
  - io_uring: fix race between timeout flush and removal
  - ax25: fix UAF bug in ax25_send_control()
  - ax25: Fix refcount leaks caused by ax25_cb_del()
  - ax25: fix UAF bugs of net_device caused by rebinding operation
  - ax25: fix reference count leaks of ax25_dev
  - ax25: add refcount in ax25_dev to avoid UAF bugs
  - ext4: fix bug_on in start_this_handle during umount filesystem
  - ext4: unregister sysfs path before destroying jbd2 journal
  - ext4: fix use-after-free in ext4_search_dir
  - mm: Update reliable flag in memory allocaion for reliable task only in task context
  - mm: refactor the reclaim thread of page cache from per-cpu to per-node


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.5.0.0151
changelog:
  - sched/qos: Add qos_tg_{throttle,unthrottle}_{up,down}
  - sched: Throttle offline task at tracehook_notify_resume()
  - sched: enable CONFIG_QOS_SCHED on arm64
  - sched/qos: Remove dependency CONFIG_x86
  - net/sched: cls_u32: fix netns refcount changes in u32_change()
  - mm: hwpoison: enable memory error handling on 1GB hugepage optionaly
  - mm: fix gup_pud_range
  - nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs
  - ext4: fix warning when submitting superblock in ext4_commit_super()
  - ext4: fix bug_on in __es_tree_search
  - secure_seq: use the 64 bits of the siphash for port offset calculation
  - floppy: use a statically allocated error counter
  - mmc: block: fix read single on recovery logic
  - SUNRPC: Ensure that the gssproxy client can start in a connected state
  - Revert "SUNRPC: attempt AF_LOCAL connect on setup"
  - ax25: Fix UAF bugs in ax25 timers
  - ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
  - drm/vgem: Close use-after-free race in vgem_gem_create
  - mm/memory.c: update the first page in clear_gigantic_page_chunk


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.6.0.0152
changelog:
  - net: hns3: update hns3 version to 22.5.1
  - net: hns3: fix vf link setting failed when no vf driver loaded
  - arm64: Add memmap reserve range check to avoid conflict
  - ext4: fix bug_on in ext4_writepages
  - ext4: fix warning in ext4_handle_inode_extension
  - ext4: fix use-after-free in ext4_rename_dir_prepare
  - uce: coredump scenario support kernel recovery
  - NULL pointer dereference on rmmod iptable_mangle.


author: haowenchao <haowenchao@huawei.com> - 6.10-3
changelog:
  - DESC: delete -Sgit from 
  %setup       -q




  /usr/bin/cat /home/abuild/rpmbuild/SOURCES/0001-CVE-2020-14342-mount.cifs-fix-shell-command-injectio.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /home/abuild/rpmbuild/SOURCES/0002-CVE-2021-20208.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /home/abuild/rpmbuild/SOURCES/1001-cifs.upcall-update-the-cap-bounding-set-only-when-CA.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /home/abuild/rpmbuild/SOURCES/1002-mount.cifs-update-the-cap-bounding-set-only-when-CAP.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /home/abuild/rpmbuild/SOURCES/0004-CVE-2022-27239.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /home/abuild/rpmbuild/SOURCES/0005-CVE-2022-29869.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch

  , and delete BuildRequires git


author: xiadanni<xiadanni1@huawei.com> - 1.2.0-200
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:sync bugfix and bump version to 200, bugfix include
         1. check task list to avoid unnecessary cleanup.
         2. fix dead loop
         3. cleanup dangling shim by brand new context
         4. fix potential panic for task in unknown state


author: xiadanni<xiadanni1@huawei.com> - 1.2.0-201
changelog:
  - Type:bugfix                                          
  - ID:NA                                                   
  - SUG:NA
  - DESC:reduce permissions for bundle dir to fix CVE-2021-41103


author: xiadanni<xiadanni1@huawei.com> - 1.2.0-202
changelog:
  - Type:bugfix
  - ID:NA 
  - SUG:NA
  - DESC:Use fs.RootPath when mounting volumes for bundle dir to fix CVE-2022-23648


author: gaoxingwang<gaoxingwang@huawei.com> - 7.71.1-12
changelog:
  - Type:CVE
  - CVE:CVE-2021-22922 CVE-2021-22923
  - SUG:NA
  - DESC:disable metalink to fix CVE-2021-22922 and CVE-2021-22923


author: gaihuiying <eaglegai@163.com> - 7.71.1-13
changelog:
  - Type:cves
  - CVE:CVE-2022-22576 CVE-2022-27774 CVE-2022-27775 CVE-2022-27776
  - SUG:NA
  - DESC:fix CVE-2022-22576 CVE-2022-27774 CVE-2022-27775 CVE-2022-27776


author: yangzhuangzhuang <yangzhuangzhuang1@huawei.com> - 2.27.0-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Resolved the problem that a failure message is displayed when the git-daemon package is uninstalled


author: panxiaohe <panxiaohe@huawei.com> - 2.27.0-4
changelog:
  - Fix CVE-2021-29468
  - Add gcc and gettext to BuildRequires
    - necessary for building and msgfmt command


author: chenjiankun <chenjiankun1@huawei.com> - 1.15.7-5
changelog:
  - fix CVE-2021-33195,CVE-2021-33196,CVE-2021-33197,CVE-2021-33198,CVE-2021-34558,CVE-2021-29923,CVE-2021-38297,CVE-2021-36221


author: kuenking111 <wangkun49@huawei.com> - 1:11.0.15.10-0
changelog:
  - modified 8231441-3-AArch64-Initial-SVE-backend-support.patch
  - modified 8210473-JEP-345-NUMA-Aware-Memory-Allocation-for-G1.patch
  - modified delete_expired_certificates.patch
  - modified G1-iterate-region-by-bitmap-rather-than-obj-size-in.patch


author: wangye <wangye70@huawei.com> - 4.1.0-2
changelog:
  - Type:cves
  - ID:CVE-2020-35521 CVE-2020-35522 CVE-2020-35523 CVE-2020-35524
  - SUG:NA
  - DESC: fix CVE-2020-35521 CVE-2020-35522 CVE-2020-35523 CVE-2020-35524


author: panxiaohe <panxiaohe@huawei.com> - 2.9.10-17
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix fuzz issues
         fix heap-use-after-free in xmlXIncludeIncludeNode
         fix stack overflow in xmlDocDumpMemory
         fix stack overflow in htmlDocContentDumpOutput


author: panxiaohe <panxiaohe@huawei.com> - 2.9.10-18
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix fuzz issues
         fix memory leaks in XPointer string-range function
         fix null pointer deref in xmlXPtrRangeInsideFunction
         stop using maxParserDepth in xpath.c
         hardcode maximum XPath recursion depth
         fix XPath recursion limit


author: fuanan <fuanan3@h-partners.com> - 2.9.10-23
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:use upstream patch refix heap-use-after-free in xmlAddNextSibling and xmlAddChild


author: bzhaoop <bzhaojyathousandy@gmail.com> - 5.7.34-1
changelog:
  - Bump from 5.7.21 to latest 5.7.34
  - Correct the test steps and options
  - Refactor part of the file structure according to the new packages


author: bzhaoop <bzhaojyathousandy@gmail.com> - 5.7.37-1
changelog:
  - Fix CVE issues for bump to the 5.7.37 version
  - CVE-2022-21245
  - CVE-2022-21270
  - CVE-2022-21303
  - CVE-2022-21304
  - CVE-2022-21344
  - CVE-2022-21367
  - CVE-2021-35624
  - CVE-2021-2356
  - CVE-2021-2011
  - CVE-2021-2010
  - CVE-2021-2007


author: liuyumeng <liuyumeng5@huawei.com> - 2.3.1-6
changelog:
  - fix CVE-2020-8112 CVE-2020-6851 CVE-2020-27823 CVE-2020-27824,avoid integer overflow:pre-patch of CVE-2020-27841,fix fuzz


author: liulong <liulong20@huawei.com> - 2.4.50-3
changelog:
  - Type:cves
  - ID:NA
  - SUG:restart
  - DESC:fix CVE-2020-36221 CVE-2020-36222 CVE-2020-36223 CVE-2020-36224 CVE-2020-36225 CVE-2020-36226 CVE-2020-36227 CVE-2020-36228 CVE-2020-36229 CVE-2020-36230


author: BruceGW<gyl93216@163.com> - 3.7.9-16
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix _PyEval_FiniThreads
         rewrite _PyObject_IsFreed unit tests
         get test_capi passing with address sanitize
         remove use after free reference in ctypes
         fix memory leak in _asynciomodule.c


author: shixuantong <shixuantong@h-partners.com> - 3.7.9-18
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:disable profile guided optimizations for x86_64 and i686 architectures


author: shixuantong <shixuantong@h-partners.com> - 3.7.9-20
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:bpo-43124: Fix smtplib multiple CRLF injection
         bpo-12800: tarfile: Restore fix from 011525ee9
         bpo-41815: SQLite: segfault if backup called on closed database
         bpo-42183: Fix a stack overflow error for asyncio Task or Future repr()
         bpo-45001: Make email date parsing more robust against malformed input


author: yezengruan <yezengruan@huawei.com>
changelog:
  - hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582)
  - pvrdma: Ensure correct input on ring init (CVE-2021-3607)
  - pvrdma: Fix the ring init error flow (CVE-2021-3608)


author: yezengruan <yezengruan@huawei.com>
changelog:
  - vhost-vsock: detach the virqueue element in case of error (CVE-2022-26354)
  - virtio-net: fix map leaking on error during receive (CVE-2022-26353)


author: yezengruan <yezengruan@huawei.com>
changelog:
  - hw/block/fdc: Extract blk_create_empty_drive()
  - hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196
  - tests/fdc-test: Add a regression test for CVE-2021-20196
  - display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207)
  - ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)


author: yezengruan <yezengruan@huawei.com>
changelog:
  - hw/intc/arm_gicv3_dist: Rename 64-bit accessors with 'q' suffix
  - hw/intc/arm_gicv3: Replace mis-used MEMTX_* constants by booleans
  - hw/intc/arm_gicv3: Check for !MEMTX_OK instead of MEMTX_ERROR (CVE-2021-3750)
  - net/colo-compare.c: Check that colo-compare is active


author: sundongxu <sundongxu3@huawei.com>
changelog:
  - e1000: fail early for evil descriptor
  - e1000: fix tx re-entrancy problem
  - hw/sd/sdcard: Do not allow invalid SD card sizes
  - hw/sd/sdcard: Do not switch to ReceivingData if address is invalid
  - hw/sd/sdcard: Restrict Class 6 commands to SCSD cards
  - hw/sd/sdcard: Simplify realize() a bit
  - hw/sd/sdcard: Update coding style to make checkpatch.pl happy
  - scsi/qemu-pr-helper: Fix out-of-bounds access to trnptid_list[]
  - curses: Fixes curses compiling errors.
  - net/dump.c: Suppress spurious compiler warning
  - tests: Replace deprecated ASN1 code


author: luhuaxin <1539327763@qq.com> - 3.14.2-71
changelog:
  - backport some upstream patches
    backport-Allow-systemd-logind-dbus-chat-with-fwupd.patch
    backport-Allow-auditd-manage-kerberos-host-rcache-files.patch
    backport-Add-dev_lock_all_blk_files-interface.patch
    backport-Define-named-file-transition-for-sshd-on-tmp-krb5_0..patch
    backport-Allow-nsswitch_domain-to-connect-to-systemd-machined.patch
    backport-Allow-unconfined_t-to-node_bind-icmp_sockets-in-node.patch
    backport-Create-macro-corenet_icmp_bind_generic_node.patch
    backport-Allow-traceroute_t-and-ping_t-to-bind-generic-nodes.patch
    backport-Allow-passwd-to-get-attributes-in-proc_t.patch
    backport-Allow-login_pgm-attribute-to-get-attributes-in-proc_.patch
    backport-Allow-syslogd_t-domain-to-read-write-tmpfs-systemd-b.patch
    backport-Allow-all-users-to-connect-to-systemd-userdbd-with-a.patch
    backport-Add-new-devices-and-filesystem-interfaces.patch
    backport-Add-lvm_dbus_send_msg-lvm_rw_var_run-interfaces.patch
    backport-Allow-domain-write-to-an-automount-unnamed-pipe.patch
    backport-Allow-dyntransition-from-sshd_t-to-unconfined_t.patch
    backport-Allow-initrc_t-create-run-chronyd-dhcp-directory-wit.patch
    backport-Update-systemd_resolved_read_pid-to-also-read-symlin.patch
    backport-Allow-systemd-resolved-manage-its-private-runtime-sy.patch
    backport-Allow-systemd-logind-manage-init-s-pid-files.patch
    backport-Add-systemd_resolved_write_pid_sock_files-interface.patch
    backport-Allow-nsswitch-domain-write-to-systemd-resolved-PID-.patch
    backport-sysnetwork.if-avoid-directly-referencing-systemd_res.patch
    backport-Allow-stub-resolv.conf-to-be-a-symlink.patch
    backport-Allow-domain-stat-proc-filesystem.patch
    backport-Allow-domain-write-to-systemd-resolved-PID-socket-fi.patch
    backport-Allow-systemd-machined-manage-systemd-userdbd-runtim.patch
    backport-Allow-domain-stat-the-sys-filesystem.patch
    backport-Allow-login_userdomain-write-inaccessible-nodes.patch
    backport-Allow-local_login_t-get-attributes-of-tmpfs-filesyst.patch
    backport-Allow-dhcpc_t-domain-transition-to-chronyc_t.patch
    backport-Allow-nsswitch_domain-read-cgroup-files.patch
    backport-Allow-IPsec-and-certmonger-to-use-opencryptoki-servi.patch
    backport-Create-chronyd_pid_filetrans-interface.patch


author: shixuantong <shixuantong@h-partners.com> - 2:8.2-27
changelog:
  - Type:CVE
  - ID:CVE-2022-1629 CVE-2022-1620 CVE-2022-1674 CVE-2022-1621 CVE-2022-1619
  - SUG:NA
  - DESC:fix CVE-2022-1629 CVE-2022-1620 CVE-2022-1674 CVE-2022-1621 CVE-2022-1619


