# changelog

author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2209.6.0.0170
changelog:
  - KVM: x86/pmu: Update AMD PMC sample period to fix guest NMI-watchdog
  - KVM: x86: Adjust counter sample period after a wrmsr
  - KVM: x86: Fix perfctr WRMSR for running counters
  - perf/core: Provide a kernel-internal interface to recalibrate event period
  - media: em28xx: initialize refcount before kref_get
  - mm: avoid potential deadlock tirgged by writing slab-attr-file
  - ext4: fix use-after-free in ext4_ext_shift_extents
  - quota: Add more checking after reading from quota file
  - quota: Replace all block number checking with helper function
  - quota: Check next/prev free block number after reading from quota file
  - efi: capsule-loader: Fix use-after-free in efi_capsule_write
  - ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header
  - mm/sharepool: Fix UAF reported by KASAN
  - blk-mq: avoid extending delays of active hctx from blk_mq_delay_run_hw_queues
  - mm: mem_reliable: Start fallback if no suitable zone found
  - net: hns3: update hns3 version to 22.9.2
  - net: hns3: fix error resume keep alive when remove hclgevf
  - net: hns3: update hns3 version to 22.9.1
  - net: hns3: fix keep alive can not resume problem when system busy


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2210.1.0.0171
changelog:
  - netfilter: nf_conntrack_irc: Fix forged IP logic
  - ext4: fix check for block being out of directory size
  - ext4: check if directory block is within i_size
  - block: Fix UAF in bd_link_disk_holder()
  - ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
  - block: add a new config to control dispatching bios asynchronously
  - block: fix kabi broken in request_queue
  - md: enable dispatching bio asynchronously for raid10 by default
  - arm64/topology: getting preferred sibling's cpumask supported by platform
  - block: support to dispatch bio asynchronously
  - block: add new fields in request_queue
  - md/raid10: convert resync_lock to use seqlock
  - md/raid10: prevent unnecessary calls to wake_up() in fast path
  - !122 【kernel-openEuler-1.0-LTS】kernel：fix some issues with 4.19 kernel on openEuler 22.03 system
  - mm: sharepool: fix potential AA deadlock
  - mm: sharepool: check size=0 in mg_sp_make_share_k2u()
  - mm: sharepool: delete redundant check in __sp_remap_get_pfn
  - Revert "cifs: fix double free race when mount fails in cifs_get_root()"
  - scsi: hisi_sas: Release resource directly in hisi_sas_abort_task() when NCQ error
  - scsi: hisi_sas: Enable force phy when SATA disk directly connected
  - scsi: hisi_sas: Modify v3 HW ATA completion process when SATA disk is in error status
  - sched: Fix invalid free for tsk->se.dyn_affi_stats
  - scsi: target: tcmu: Fix warning: 'page' may be used uninitialized
  - scsi: target: tcmu: Fix crash on ARM during cmd completion
  - scsi: target: tcmu: Optimize use of flush_dcache_page
  - scsi: target: tcmu: Fix size in calls to tcmu_flush_dcache_range
  - signal: fix deadlock caused by calling printk() under sighand->siglock
  - mm: fix missing handler for __GFP_NOWARN
  - perf bench futex-wake: Restore thread count default to online CPU count
  - selftests/bpf: Enlarge select() timeout for test_maps
  - xfs: preserve default grace interval during quotacheck
  - i40e: Fix kernel crash during module removal
  - i40e: Fix use-after-free in i40e_client_subtask()
  - EDAC: skx_common: downgrade message importance on missing PCI device
  - x86/entry/64: Don't compile ignore_sysret if 32-bit emulation is enabled
  - x86: Fix early boot crash on gcc-10, third try
  - objtool: Don't fail on missing symbol table


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2210.3.0.0172
changelog:
  - binder: fix UAF of ref->proc caused by race condition
  - arm64: fix oops in concurrently setting insn_emulation sysctls
  - mm/hotplug: silence a lockdep splat with printk()
  - init/Kconfig: Add SMP to the dependencies of QOS_SCHED
  - mm/rmap: Fix kabi broken in anon_vma
  - mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
  - HID: roccat: Fix use-after-free in roccat_read()
  - ext4: fix dir corruption when ext4_dx_add_entry() fails
  - quota: Add more checking after reading from quota file
  - quota: Replace all block number checking with helper function
  - quota: Check next/prev free block number after reading from quota file
  - Revert "quota: Check next/prev free block number after reading from quota file"
  - Revert "quota: Replace all block number checking with helper function"
  - Revert "quota: Add more checking after reading from quota file"
  - tracefs: Only clobber mode/uid/gid on remount if asked
  - netfilter: ebtables: fix memory leak when blob is malformed
  - netfilter: ebtables: reject blobs that don't provide all entry points
  - mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
  - SUNRPC: use _bh spinlocking on ->transport_lock
  - tcp: fix early ETIMEDOUT after spurious non-SACK RTO
  - netfilter: br_netfilter: Drop dst references before setting.
  - debugfs: add debugfs_lookup_and_remove()
  - tcp: annotate data-race around challenge_timestamp
  - Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"
  - net: neigh: don't call kfree_skb() under spin_lock_irqsave()
  - neigh: fix possible DoS due to net iface start/stop loop
  - mm/hugetlb: fix hugetlb not supporting softdirty tracking
  - asm-generic: sections: refactor memory_intersects
  - loop: Check for overflow while configuring loop
  - net: Fix a data-race around sysctl_somaxconn.
  - net: Fix a data-race around netdev_budget_usecs.
  - net: Fix a data-race around netdev_budget.
  - net: Fix a data-race around sysctl_net_busy_read.
  - net: Fix a data-race around sysctl_net_busy_poll.
  - net: Fix a data-race around sysctl_tstamp_allow_data.
  - ratelimit: Fix data-races in ___ratelimit().
  - net: Fix data-races around netdev_tstamp_prequeue.
  - net: Fix data-races around weight_p and dev_weight_[rt]x_bias.
  - net: ipvtap - add __init/__exit annotations to module init/exit funcs
  - bonding: 802.3ad: fix no transmission of LACPDUs
  - xfrm: fix refcount leak in __xfrm_policy_check()
  - audit: fix potential double free on error path from fsnotify_add_inode_mark
  - dm: return early from dm_pr_call() if DM device is suspended
  - NFSv4: Fix races in the legacy idmapper upcall


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2210.4.0.0173
changelog:
  - nfp: fix use-after-free in area_cache_get()
  - mISDN: fix use-after-free bugs in l1oip timer handlers
  - tcp: Fix data races around icsk->icsk_af_ops.
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
  - !134 scsi: megaraid_sas: Add support for MegaRAID Aero controllers
  - !138 vfio-pci: Mask cap zero
  - bnx2x: fix potential memory leak in bnx2x_tpa_stop()
  - r8152: Rate limit overflow messages
  - scsi: megaraid_sas: Add support for MegaRAID Aero controllers
  - vfio-pci: Mask cap zero
  - tcp/udp: Fix memory leak in ipv6_renew_options().
  - net: mvpp2: fix mvpp2 debugfs leak
  - !159 PCI: Add ACS quirk for Broadcom NICs
  - !137 net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode
  - kcm: avoid potential race in kcm_tx_work
  - net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode
  - !139 nvme: Assign subsys instance from first ctrl
  - fbdev: smscufx: Fix use-after-free in ufx_ops_open()
  - nvme: fix controller instance leak
  - nvme: Assign subsys instance from first ctrl
  - PCI: Add ACS quirk for Broadcom BCM5750x NICs
  - PCI: Add ACS quirk for Broadcom BCM57414 NIC


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2210.5.0.0174
changelog:
  - sch_sfb: Also store skb len before calling child enqueue
  - sch_sfb: Don't assume the skb is still around after enqueueing to child
  - ipv6: Fix data races around sk->sk_prot.
  - ipv6: annotate some data-races around sk->sk_prot
  - ipv6: provide and use ipv6 specific version for {recv, send}msg
  - inet: factor out inet_send_prepare()
  - nilfs2: fix use-after-free bug of struct nilfs_root


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2211.1.0.0175
changelog:
  - uacce: add the reference counter protection
  - nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()
  - usb: mon: make mmapped memory read only
  - !185 [openEuler-1.0-LTS] Add support sata lpm for Zhaoxin CPUs
  - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode
  - ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode
  - ext4: add helper to check quota inums
  - ext4: fix bug_on in __es_tree_search caused by bad quota inode
  - atm: idt77252: fix use-after-free bugs caused by tst_timer
  - ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate
  - !94 [openEuler-1.0-LTS] rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs
  - !88 [openEuler-1.0-LTS] XHCI:Fix some device identify fail when enable xHCI runtime suspend
  - !92 [openEuler-1.0-LTS] x86/tsc: Make cur->adjusted values in package#1 to be the same
  - !93 [openEuler-1.0-LTS] Driver for Zhaoxin CPU core temperature monitoring
  - !89 [openEuler-1.0-LTS] EHCI: Clear wakeup signal locked in S0  state when device plug in
  - scsi: stex: Properly zero out the passthrough command structure
  - !192 x86/apic/vector: Fix ordering in vector assignment
  - nilfs2: fix leak of nilfs_root in case of writer thread creation failure
  - vsock: Fix memory leak in vsock_connect()
  - x86/apic/vector: Fix ordering in vector assignment
  - Add support for PxSCT.LPM set based on actual LPM circumstances
  - Add support for disabling PhyRdy Change Interrupt based on actual LPM capability
  - Driver for Zhaoxin CPU core temperature monitoring
  - rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs
  - x86/tsc: Make cur->adjusted values in package#1 to be the same
  - EHCI: Clear wakeup signal locked in S0 state when device plug in
  - XHCI:Fix some device identify fail when enable xHCI runtime suspend


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2211.2.0.0176
changelog:
  - net: tun: fix bugs for oversize packet when napi frags enabled
  - tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
  - tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent
  - ext4: fix bad checksum after online resize
  - blktrace: remove unnessary stop block trace in 'blk_trace_shutdown'
  - blktrace: fix possible memleak in '__blk_trace_remove'
  - blktrace: introduce 'blk_trace_{start,stop}' helper
  - kabi: net: fix kabi broken in sk_buff
  - io_uring/af_unix: defer registered files gc to io_uring release
  - nbd: refactor size updates
  - nbd: move the task_recv check into nbd_size_update
  - nbd: remove the call to set_blocksize
  - wifi: Fix potential buffer overflow in 'brcmf_fweh_event_worker'
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy
  - dm: Fix UAF in run_timer_softirq()
  - Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
  - ext4: record error information when insert extent failed in 'ext4_split_extent_at'
  - livepatch/core: Fix livepatch/state leak on error path
  - !130 [openEuler-1.0-LTS] update pmu for Zhaoxin CPUs
  - update pmu for Zhaoxin CPUs


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2211.4.0.0177
changelog:
  - block: fix use after free for bd_holder_dir
  - Revert "block: Fix UAF in bd_link_disk_holder()"
  - init/main.c: return 1 from handled __setup() functions
  - x86/pm: Save the MSR validity status at context setup
  - x86/speculation: Restore speculation related MSRs during S3 resume
  - x86/cpu: Load microcode during restore_processor_state()
  - genirq: Synchronize interrupt thread startup
  - nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices
  - once: add DO_ONCE_SLOW() for sleepable contexts
  - inet: fully convert sk->sk_rx_dst to RCU rules
  - ext4: continue to expand file system when the target size doesn't reach
  - nvme: copy firmware_rev on each init
  - net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
  - can: bcm: check the result of can_send() in bcm_can_tx()
  - xfrm: Update ipcomp_scratches with NULL when freed
  - tcp: annotate data-race around tcp_md5sig_pool_populated
  - tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
  - ext4: fix null-ptr-deref in ext4_write_info
  - Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
  - ima: Free the entire rule if it fails to parse
  - ima: Free the entire rule when deleting a list of rules
  - ima: Have the LSM free its audit rule
  - mm/migrate_device.c: flush TLB while holding PTL
  - mm: prevent page_frag_alloc() from corrupting the memory
  - mm/page_alloc: fix race condition between build_all_zonelists and page allocation
  - net: team: Unsync device addresses on ndo_stop
  - mm/slub: fix to return errno if kmalloc() fails
  - of: fdt: fix off-by-one error in unflatten_dt_nodes()


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2211.5.0.0178
changelog:
  - svm: Delete unused ioctl command
  - Revert "posix-cpu-timers: Make timespec to nsec conversion safe"
  - block: limit request dispatch loop duration
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory
  - block: check flags of claimed slave bdev to fix uaf for bd_holder_dir


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2211.6.0.0179
changelog:
  - x86/tsc: use topology_max_packages() in tsc watchdog check
  - scsi: hisi_sas: Set iptt aborted flag when receiving an abnormal CQ
  - ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0


author: xinghe <xinghe@h-partners.com> - 4.11.12-13
changelog:
  - Type:cves
  - CVE:CVE-2022-32746 CVE-2022-32744 CVE-2022-2031 CVE-2022-32742
  - SUG:NA
  - DESC:fix CVE-2022-32746 CVE-2022-32744 CVE-2022-2031 CVE-2022-32742


