# changelog

author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2301.6.0.0186
changelog:
  - bus: hisi_lpc: Fixup IO ports addresses to avoid use-after-free in host removal
  - of/fdt: Don't calculate initrd size from DT if start > end
  - lib/cmdline: avoid page fault in next_arg
  - genirq: Introduce warn log when irq be reentrant
  - net: sched: disallow noqueue for qdisc classes
  - net: sched: atm: dont intepret cls results when asked to drop
  - block: check 'bd_super' before rescanning partition
  - net: sched: cbq: dont intepret cls results when asked to drop
  - swapfile: fix soft lockup in scan_swap_map_slots
  - Huawei BMA: Fix iBMA driver bug


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2302.1.0.0187
changelog:
  - ring-buffer: Fix race between reset page and reading page
  - block: don't allow a disk link holder to itself
  - ext4: fix use-after-free in ext4_orphan_cleanup
  - ext4: lost matching-pair of trace in ext4_truncate
  - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames
  - mm/swapfile: add cond_resched() in get_swap_pages()
  - hugetlbfs: don't delete error page from pagecache
  - mm: hwpoison: refactor refcount check handling
  - dhugetlb: set DYNAMIC_HUGETLB to y for hulk_defconfig
  - dhugetlb: use enable_dhugetlb to disable huge_memory
  - dhugetlb: skip dissolve hugepage belonging to dynamic hugetlb
  - dhugetlb: only support 1G/2M hugepage and ARM64_4K_PAGES
  - dhugetlb: isolate dynamic hugetlb code
  - dhugetlb: backport dynamic hugetlb feature
  - !344 mm: fix false-positive OVERCOMMIT_GUESS failures
  - cfq: fix memory leak for cfqq
  - mm: fix false-positive OVERCOMMIT_GUESS failures


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2302.3.0.0188
changelog:
  - block, bfq: switch 'bfqg->ref' to use atomic refcount apis
  - x86/bugs: Flush IBP in ib_prctl_set()
  - media: vivid: fix compose size exceed boundary
  - cifs: do not include page data when checking signature
  - SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails
  - net: stream: purge sk_error_queue in sk_stream_kill_queues()
  - net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
  - ext4: fix deadlock due to mbcache entry corruption
  - mbcache: automatically delete entries from cache on freeing
  - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
  - mm/khugepaged: fix GUP-fast interaction by sending IPI
  - mm: gup: fix the fast GUP race against THP collapse
  - prlimit: do_prlimit needs to have a speculation check
  - arm64: cmpxchg_double*: hazard against entire exchange variable
  - net/ulp: prevent ULP without clone op from entering the LISTEN status
  - driver core: Fix bus_type.match() error handling in __driver_attach()
  - md: fix a crash in mempool_free
  - bpf: pull before calling skb_postpull_rcsum()
  - SUNRPC: ensure the matching upcall is in-flight upon downcall
  - ovl: Use ovl mounter's fsuid and fsgid in ovl_link()
  - pnode: terminate at peers of source
  - cifs: Fix uninitialized memory read for smb311 posix symlink create
  - device_cgroup: Roll back to original exceptions after copy failure
  - PCI/sysfs: Fix double free in error path
  - PCI: Fix pci_device_is_present() for VFs by checking PF
  - ipmi: fix use after free in _ipmi_destroy_user()
  - ima: Fix a potential NULL pointer access in ima_restore_measurement_list
  - ipmi: fix long wait in unload when IPMI disconnect
  - binfmt: Fix error return code in load_elf_fdpic_binary()
  - chardev: fix error handling in cdev_device_add()
  - mrp: introduce active flags to prevent UAF when applicant uninit
  - bpf: make sure skb->len != 0 when redirecting to a tunneling device
  - ipmi: fix memleak when unload ipmi driver
  - ACPICA: Fix error code path in acpi_ds_call_control_method()
  - skbuff: Account for tail adjustment during pull operations
  - serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle.
  - serial: amba-pl011: avoid SBSA UART accessing DMACR register
  - class: fix possible memory leak in __class_register()
  - crypto: tcrypt - Fix multibuffer skcipher speed test mem leak
  - blktrace: Fix output non-blktrace event when blk_classic option enabled
  - SUNRPC: Fix missing release socket in rpc_sockname()
  - bonding: uninitialized variable in bond_miimon_inspect()
  - pinctrl: pinconf-generic: add missing of_node_put()
  - ima: Fix misuse of dereference of pointer in template_desc_init_fields()
  - ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
  - md/raid1: stop mdx_raid1 thread when raid1 array run failed
  - blk-mq: fix possible memleak when register 'hctx' failed
  - perf: Fix possible memleak in pmu_dev_alloc()
  - cpuidle: dt: Return the correct numbers of parsed idle states
  - pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP
  - pstore/ram: Fix error return code in ramoops_probe()
  - perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init()
  - sched/rt: Optimize checking group RT scheduler constraints
  - md: protect md_unregister_thread from reentrancy
  - hugetlbfs: fix off-by-one error in hugetlb_vmdelete_list()
  - lib/list_debug.c: Detect uninitialized lists
  - crypto: tcrypt - avoid signed overflow in byte count
  - mm: sharepool: fix hugepage_rsvd count increase error
  - config: enbale irq pending config for openeuler
  - genirq: introduce CONFIG_GENERIC_PENDING_IRQ_FIX_KABI
  - irqchip/gic-v3-its: introduce CONFIG_GENERIC_PENDING_IRQ
  - md: fix uaf in md_wakeup_thread
  - genirq: add printk safe in irq context
  - jbd2: Fix data missing when reusing bh which is ready to be checkpointed
  - x86/unwind: Fix orc entry for paravirt {save,restore}_fl
  - cifs: sanitize multiple delimiters in prepath
  - drm/i915/gvt: fix double free bug in split_2MB_gtt_entry


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2302.4.0.0189
changelog:
  - !213  net: bonding: Inherit MPLS features from slave devices
  - x86/unwind: Fix check_paravirt() calls orc_find() before declaration
  - dhugetlb: set hpool to NULL for cont-bit hugepage
  - arm64/ascend: Delete CONFIG_ASCEND_AUTO_TUNING_HUGEPAGE in hulk_defconfig
  - arm64/ascend: Delete unused feature auto-tuning hugepage
  - mm/memcg_memfs_info: fix potential oom_lock recursion deadlock
  - net: bridge: mcast: add and enforce query interval minimum
  - net: bridge: mcast: add and enforce startup query interval minimum
  - !396 anolis: bond: broadcast ARP or ND messages to all slaves
  - anolis: bond: broadcast ARP or ND messages to all slaves
  - net: bonding: Inherit MPLS features from slave devices


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2302.5.0.0190
changelog:
  - !423 genirq bugfix for arm64
  - genirq: Remove irqd_irq_disabled in __irq_move_irq
  - !422 iscsi bugfixes backport
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
  - scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
  - !420 backport CVEs and bugfixes
  - net: mpls: fix stale pointer if allocation fails during device rename
  - nbd: fix assignment error for first_minor in nbd_dev_add
  - selinux: further adjust init order for cred_* hooks
  - selinux: further adjust init order for file_alloc_security hook
  - !415 mainline bugfix backport
  - selinux: reorder hooks to make runtime disable less broken
  - evm: Fix a small race in init_desc()
  - evm: Check also if *tfm is an error pointer in init_desc()
  - iommu: Properly export iommu_group_get_for_dev()
  - of: resolver: Add of_node_put() before return and break
  - of: unittest: Add of_node_put() before return
  - drivers/iommu: Allow IOMMU bus ops to be unregistered
  - drivers/iommu: Export core IOMMU API symbols to permit modular drivers
  - component: do not dereference opaque pointer in debugfs
  - ipmi: use %*ph to print small buffer
  - crypto: algif_skcipher - Use chunksize instead of blocksize
  - crypto: algif_skcipher - EBUSY on aio should be an error
  - crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete()
  - dhugetlb: isolate hwpoison hugepage when release
  - mm/sharepool: Fix null-pointer-deference in sp_free_area


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2303.1.0.0191
changelog:
  - HID: check empty report_list in hid_validate_values()
  - dhugetlb: use mutex lock in update_reserve_pages()
  - ntfs: fix out-of-bounds read in ntfs_attr_find()
  - ntfs: fix use-after-free in ntfs_ucsncmp()
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
  - phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
  - netfilter: nf_tables: fix null deref due to zeroed list head
  - tcp: Fix listen() regression in 5.15.88.
  - tap: tap_open(): correctly initialize socket uid
  - tun: tun_chr_open(): correctly initialize socket uid
  - net: add sock_init_data_uid()
  - rds: rds_rm_zerocopy_callback() use list_first_entry()


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2303.3.0.0192
changelog:
  - scsi: cancel the inflight async device probe when remove scsi_target
  - scsi: fix use-after-free problem in scsi_remove_target
  - HID: asus: use spinlock to safely schedule workers
  - HID: asus: use spinlock to protect concurrent accesses
  - HID: asus: Remove check for same LED brightness on set
  - blk-wbt: don't enable throttling if default elevator is bfq
  - block: Fix kabi broken by "block: split .sysfs_lock into two locks"
  - block: fix comment and add lockdep assert
  - block: don't release queue's sysfs lock during switching elevator
  - block: fix race between switching elevator and removing queues
  - block: split .sysfs_lock into two locks
  - crypto: rsa-pkcs1pad - restore signature length check
  - fs/proc: task_mmu.c: don't read mapcount for migration entry
  - migrate: hugetlb: check for hugetlb shared PMD in node migration
  - mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
  - ipv6: Fix tcp socket connection with DSCP.
  - ipv6: Fix datagram socket connection with DSCP.
  - aio: fix mremap after fork null-deref
  - bpf: Always return target ifindex in bpf_fib_lookup
  - serial: 8250_dma: Fix DMA Rx rearm race
  - serial: 8250_dma: Fix DMA Rx completion race
  - x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
  - ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
  - netlink: annotate data races around sk_state
  - netlink: annotate data races around dst_portid and dst_group
  - netlink: annotate data races around nlk->portid
  - netlink: remove hash::nelems check in netlink_insert
  - net: fix UaF in netns ops registration error path
  - netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state
  - binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
  - binder: Address corner cases in deferred copy and fixup
  - binder: fix pointer cast warning
  - binder: defer copies of pre-patched txn data
  - binder: read pre-translated fds from sender buffer
  - binder: avoid potential data leakage when copying txn
  - binder: fix handling of error during copy
  - binder: use cred instead of task for getsecid
  - binder: don't detect sender/target during buffer cleanup
  - binder: make sure fd closes complete
  - binder: Remove bogus warning on failed same-process transaction
  - binder: fix incorrect calculation for num_valid
  - binder: Prevent repeated use of ->mmap() via NULL mapping
  - binder: Don't modify VMA bounds in ->mmap handler
  - binder: Set end of SG buffer area properly.
  - binder: return errors from buffer copy functions
  - binder: check for overflow when alloc for security context
  - binder: fix BUG_ON found by selinux-testsuite
  - binder: fix handling of misaligned binder object
  - binder: use userspace pointer as base of buffer space
  - binder: remove user_buffer_offset
  - binder: remove kernel vm_area for buffer space
  - binder: avoid kernel vm_area for buffer fixups
  - binder: add function to copy binder object from buffer
  - binder: add functions to copy to/from binder buffers
  - binder: create userspace-to-binder-buffer copy function
  - binder: fix use-after-free due to ksys_close() during fdget()
  - binder: fix kerneldoc header for struct binder_buffer
  - binder: create node flag to request sender's security context
  - binder: Add BINDER_GET_NODE_INFO_FOR_REF ioctl.
  - binder: use standard functions to allocate fds
  - block: fix kabi change since add bd_write_openers and bd_part_write_openers
  - block: add info when opening an exclusive opened block device for write
  - block: add info when opening a write opend block device exclusively
  - Revert "block: add info when opening an exclusive opened block device for write"
  - Revert "block: add info when opening a write opend block device exclusively"
  - ext4: fix WARNING in mb_find_extent
  - sctp: fail if no bound addresses can be used for a given scope


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2303.4.0.0193
changelog:
  - tipc: add an extra conn_get in tipc_conn_alloc
  - tipc: set con sock in tipc_conn_alloc
  - mm/oom_kill.c: fix oom_cpuset_eligible() comment
  - oom: decouple mems_allowed from oom_unkillable_task
  - mm, oom: remove redundant task_in_mem_cgroup() check
  - mm, oom: refactor dump_tasks for memcg OOMs
  - block: Fix wrong offset in bio_truncate()
  - fs: move guard_bio_eod() after bio_set_op_attrs
  - block: add bio_truncate to fix guard_bio_eod
  - mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
  - cifs: Fix use-after-free in rdata->read_into_pages()
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2303.5.0.0194
changelog:
  - net/sched: tcindex: search key must be 16 bits
  - net/sched: tcindex: update imperfect hash filters respecting rcu
  - rcu: Upgrade rcu_swap_protected() to rcu_replace_pointer()
  - x86/speculation: Add RSB VM Exit protections
  - x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts
  - x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current
  - x86/speculation: Disable RRSBA behavior
  - x86/bugs: Add Cannon lake to RETBleed affected CPU list
  - x86/cpu/amd: Enumerate BTC_NO
  - x86/common: Stamp out the stepping madness
  - x86/speculation: Fill RSB on vmexit for IBRS
  - KVM: VMX: Fix IBRS handling after vmexit
  - KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  - x86/speculation: Remove x86_spec_ctrl_mask
  - x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit
  - x86/speculation: Fix SPEC_CTRL write on SMT state change
  - x86/speculation: Fix firmware entry SPEC_CTRL handling
  - x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n
  - x86/speculation: Change FILL_RETURN_BUFFER to work with objtool
  - intel_idle: Disable IBRS during long idle
  - x86/bugs: Report Intel retbleed vulnerability
  - x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation()
  - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS
  - x86/bugs: Optimize SPEC_CTRL MSR writes
  - x86/entry: Add kernel IBRS implementation
  - x86/entry: Remove skip_r11rcx
  - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value
  - x86/bugs: Add AMD retbleed= boot parameter
  - x86/bugs: Report AMD retbleed vulnerability
  - x86/cpufeatures: Move RETPOLINE flags to word 11
  - x86/cpu: Add a steppings field to struct x86_cpu_id
  - x86/cpu: Add consistent CPU match macros
  - x86/devicetable: Move x86 specific macro out of generic code
  - x86/cpufeature: Fix various quality problems in the <asm/cpu_device_hd.h> header
  - x86/cpufeature: Add facility to check for min microcode revisions
  - Revert "x86/cpu: Add a steppings field to struct x86_cpu_id"
  - Revert "x86/speculation: Add RSB VM Exit protections"
  - x86/nospec: Fix i386 RSB stuffing
  - ext4: make sure fs error flag setted before clear journal error
  - ext4: commit super block if fs record error when journal record without error
  - hugetlb: fix hugepages_setup when deal with pernode
  - hugetlb: fix wrong use of nr_online_nodes
  - tty: fix out-of-bounds access in tty_driver_lookup_tty()
  - arm64: errata: Remove AES hwcap for COMPAT tasks
  - kernel: Initialize cpumask before parsing
  - genirq: Disable interrupts for force threaded handlers
  - softirq: Don't try waking ksoftirqd before it has been spawned
  - scsi: hisi_sas: Clear interrupt status when exiting channel int0 for v3 hw
  - scsi: hisi_sas: Handle NCQ error when IPTT is valid
  - scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list
  - act_mirred: use the backlog for nested calls to mirred ingress
  - net/sched: act_mirred: refactor the handle of xmit
  - net: sched: don't expose action qstats to skb_tc_reinsert()
  - net: sched: protect against stack overflow in TC act_mirred
  - net: sched: refactor reinsert action
  - net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
  - ext4: fix another off-by-one fsmap error on 1k block filesystems


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2303.6.0.0195
changelog:
  - ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
  - ftrace: Fix invalid address access in lookup_rec() when index is 0
  - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
  - scsi: scsi_dh_alua: fix memleak for 'qdata' in alua_activate()
  - RDMA/core: Don't infoleak GRH fields
  - !480 mm  bugfixes backport
  - cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
  - cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock
  - cgroup/cpuset: Change cpuset_rwsem and hotplug lock order
  - mm: memcontrol: fix cannot alloc the maximum memcg ID


