# changelog

author: wuchangsheng <wuchangsheng2@huawei.com> - 1.0.1-42
changelog:
  - add dfx rcv_nxt info
    mbuf private cache line align
    send pkts index bug fix
    free recv pkts in main loop


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2211.1.0.0175
changelog:
  - uacce: add the reference counter protection
  - nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()
  - usb: mon: make mmapped memory read only
  - !185 [openEuler-1.0-LTS] Add support sata lpm for Zhaoxin CPUs
  - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode
  - ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode
  - ext4: add helper to check quota inums
  - ext4: fix bug_on in __es_tree_search caused by bad quota inode
  - atm: idt77252: fix use-after-free bugs caused by tst_timer
  - ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate
  - !94 [openEuler-1.0-LTS] rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs
  - !88 [openEuler-1.0-LTS] XHCI:Fix some device identify fail when enable xHCI runtime suspend
  - !92 [openEuler-1.0-LTS] x86/tsc: Make cur->adjusted values in package#1 to be the same
  - !93 [openEuler-1.0-LTS] Driver for Zhaoxin CPU core temperature monitoring
  - !89 [openEuler-1.0-LTS] EHCI: Clear wakeup signal locked in S0  state when device plug in
  - scsi: stex: Properly zero out the passthrough command structure
  - !192 x86/apic/vector: Fix ordering in vector assignment
  - nilfs2: fix leak of nilfs_root in case of writer thread creation failure
  - vsock: Fix memory leak in vsock_connect()
  - x86/apic/vector: Fix ordering in vector assignment
  - Add support for PxSCT.LPM set based on actual LPM circumstances
  - Add support for disabling PhyRdy Change Interrupt based on actual LPM capability
  - Driver for Zhaoxin CPU core temperature monitoring
  - rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs
  - x86/tsc: Make cur->adjusted values in package#1 to be the same
  - EHCI: Clear wakeup signal locked in S0 state when device plug in
  - XHCI:Fix some device identify fail when enable xHCI runtime suspend


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2211.2.0.0176
changelog:
  - net: tun: fix bugs for oversize packet when napi frags enabled
  - tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
  - tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent
  - ext4: fix bad checksum after online resize
  - blktrace: remove unnessary stop block trace in 'blk_trace_shutdown'
  - blktrace: fix possible memleak in '__blk_trace_remove'
  - blktrace: introduce 'blk_trace_{start,stop}' helper
  - kabi: net: fix kabi broken in sk_buff
  - io_uring/af_unix: defer registered files gc to io_uring release
  - nbd: refactor size updates
  - nbd: move the task_recv check into nbd_size_update
  - nbd: remove the call to set_blocksize
  - wifi: Fix potential buffer overflow in 'brcmf_fweh_event_worker'
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy
  - dm: Fix UAF in run_timer_softirq()
  - Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
  - ext4: record error information when insert extent failed in 'ext4_split_extent_at'
  - livepatch/core: Fix livepatch/state leak on error path
  - !130 [openEuler-1.0-LTS] update pmu for Zhaoxin CPUs
  - update pmu for Zhaoxin CPUs


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2211.4.0.0177
changelog:
  - block: fix use after free for bd_holder_dir
  - Revert "block: Fix UAF in bd_link_disk_holder()"
  - init/main.c: return 1 from handled __setup() functions
  - x86/pm: Save the MSR validity status at context setup
  - x86/speculation: Restore speculation related MSRs during S3 resume
  - x86/cpu: Load microcode during restore_processor_state()
  - genirq: Synchronize interrupt thread startup
  - nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices
  - once: add DO_ONCE_SLOW() for sleepable contexts
  - inet: fully convert sk->sk_rx_dst to RCU rules
  - ext4: continue to expand file system when the target size doesn't reach
  - nvme: copy firmware_rev on each init
  - net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
  - can: bcm: check the result of can_send() in bcm_can_tx()
  - xfrm: Update ipcomp_scratches with NULL when freed
  - tcp: annotate data-race around tcp_md5sig_pool_populated
  - tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
  - ext4: fix null-ptr-deref in ext4_write_info
  - Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
  - ima: Free the entire rule if it fails to parse
  - ima: Free the entire rule when deleting a list of rules
  - ima: Have the LSM free its audit rule
  - mm/migrate_device.c: flush TLB while holding PTL
  - mm: prevent page_frag_alloc() from corrupting the memory
  - mm/page_alloc: fix race condition between build_all_zonelists and page allocation
  - net: team: Unsync device addresses on ndo_stop
  - mm/slub: fix to return errno if kmalloc() fails
  - of: fdt: fix off-by-one error in unflatten_dt_nodes()


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2211.5.0.0178
changelog:
  - svm: Delete unused ioctl command
  - Revert "posix-cpu-timers: Make timespec to nsec conversion safe"
  - block: limit request dispatch loop duration
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory
  - block: check flags of claimed slave bdev to fix uaf for bd_holder_dir


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2211.6.0.0179
changelog:
  - x86/tsc: use topology_max_packages() in tsc watchdog check
  - scsi: hisi_sas: Set iptt aborted flag when receiving an abnormal CQ
  - ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2212.1.0.0180
changelog:
  - !272 [openEuler-1.0-LTS] Add MWAIT Cx support for Zhaoxin CPUs.
  - Bluetooth: L2CAP: Fix u8 overflow
  - l2tp: Don't sleep and disable BH under writer-side sk_callback_lock
  - l2tp: Serialize access to sk_user_data with sk_callback_lock
  - !288 Add support for ConnectX6 Lx and ConnectX6Dx with openEuler inbox driver
  - net/mlx5: Update the list of the PCI supported devices
  - net/mlx5: Update the list of the PCI supported devices
  - drivers: net: slip: fix NPD bug in sl_tx_timeout()
  - staging: rtl8712: fix use after free bugs
  - Add MWAIT Cx support for Zhaoxin CPUs.


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2212.2.0.0181
changelog:
  - mm/sharepool: Fix a double free problem caused by init_local_group
  - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()
  - macvlan: enforce a consistent minimal mtu
  - net: macvlan: fix memory leaks of macvlan_common_newlink
  - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
  - net: gso: fix panic on frag_list with mixed head alloc types
  - tcp/udp: Make early_demux back namespacified.
  - ipv6: fix WARNING in ip6_route_net_exit_late()
  - net, neigh: Fix null-ptr-deref in neigh_table_clear()
  - tcp: fix indefinite deferral of RTO with SACK reneging
  - net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
  - serial: 8250: Flush DMA Rx on RLSI
  - serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs
  - capabilities: fix potential memleak on error path from vfs_getxattr_alloc()
  - security: commoncap: fix -Wstringop-overread warning
  - ring_buffer: Do not deactivate non-existant pages
  - ftrace: Fix null pointer dereference in ftrace_add_mod()
  - ftrace: Optimize the allocation for mcount entries
  - kprobe: reverse kp->flags when arm_kprobe failed
  - mm: fs: initialize fsdata passed to write_begin/write_end interface
  - nfs4: Fix kmemleak when allocate slot failed
  - kernfs: fix use-after-free in __kernfs_remove
  - mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
  - mm: /proc/pid/smaps_rollup: fix no vma's null-deref
  - signal handling: don't use BUG_ON() for debugging
  - ida: don't use BUG_ON() for debugging


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2212.3.0.0182
changelog:
  - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
  - Bluetooth: L2CAP: Fix build errors in some archs
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
  - hv_netvsc: Add check for kvmalloc_array
  - xen/netback: don't call kfree_skb() with interrupts disabled
  - xen/netback: fix build warning
  - xen/netback: Ensure protocol headers don't fall in the non-linear area
  - !273 [openEuler-1.0-LTS] Fix mouse enumeration issue after wakeup from s4
  - arm64: fix a concurrency issue in emulation_proc_handler()
  - dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata
  - sched/qos: Don't unthrottle cfs_rq when cfs_rq is throttled by qos
  - media: mceusb: Use new usb_control_msg_*() routines
  - media: mceusb: fix control-message timeouts
  - USB: add usb_control_msg_send() and usb_control_msg_recv()
  - Fix mouse enumeration issue after wakeup from s4


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2212.4.0.0183
changelog:
  - dm thin: Use last transaction's pmd->root when commit failed
  - drm: mali-dp: potential dereference of null pointer
  - power: supply: wm8350-power: Add missing free in free_charger_irq
  - sched: Reinit task's vruntime if a task sleep over 200 days
  - media: dvb-core: Fix UAF due to refcount races at releasing
  - drm/amdkfd: Check for null pointer after calling kmemdup
  - !325 Support enabling dirty log gradually in small chunks
  - KVM: arm64: Support enabling dirty log gradually in small chunks
  - KVM: x86: enable dirty log gradually in small chunks
  - KVM: Introduce KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2
  - KVM: Fix kvm_clear_dirty_log_protect off-by-(minus-)one
  - KVM: Fix the bitmap range to copy during clear dirty
  - kvm_main: fix some comments
  - KVM: fix KVM_CLEAR_DIRTY_LOG for memory slots of unaligned size
  - Revert "KVM: Eliminate extra function calls in kvm_get_dirty_log_protect()"
  - KVM: validate userspace input in kvm_clear_dirty_log_protect()
  - kvm: introduce manual dirty log reprotect
  - kvm: rename last argument to kvm_get_dirty_log_protect
  - kvm: make KVM_CAP_ENABLE_CAP_VM architecture agnostic


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2301.3.0.0184
changelog:
  - arm64: Kconfig: default unset ARCH_LLC_128_LINE_SIZE
  - mm/sharepool: clean up ABI breakage
  - timekeeping: Avoiding false sharing in field access of tk_core
  - mm/hwpoison: put page in already hwpoisoned case with MF_COUNT_INCREASED
  - mm/memory-failure.c: fix race with changing page more robustly
  - mm,memory_failure: always pin the page in madvise_inject_error
  - kobject: Fix slab-out-of-bounds in fill_kobj_path()
  - tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line
  - i2c: ismt: Fix an out-of-bounds bug in ismt_access()
  - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
  - mm/sharepool: Charge Buddy hugepage to memcg


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-3
changelog:
  - Type:CVE
  - ID:CVE-2022-3491 CVE-2022-3520 CVE-2022-3591
  - SUG:NA
  - DESC:fix CVE-2022-3491 CVE-2022-3520 CVE-2022-3591


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-6
changelog:
  - Type:CVE
  - ID:CVE-2023-0049 CVE-2023-0051 CVE-2023-0054
  - SUG:NA
  - DESC:CVE-2023-0049 CVE-2023-0051 CVE-2023-0054


