# changelog

author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2312.4.0.0231
changelog:
  - !3426  Revert "hrtimers: Push pending hrtimers away from outgoing CPU earlier"
  - Revert "hrtimers: Push pending hrtimers away from outgoing CPU earlier"
  - Revert "cpu/hotplug: fix kabi breakage in enum cpuhp_state"


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2312.6.0.0232
changelog:
  - !3607  Fix CVE-2023-6546
  - !3606  perf/core: Fix CVE-2023-6931
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
  - tty: n_gsm: fix restart handling via CLD command
  - perf: Fix perf_event_validate_size() lockdep splat
  - perf: Fix perf_event_validate_size()
  - !3417  SCSI: hisi_raid: support SPxxx serial RAID/HBA controllers
  - !3531 Fix kernel panic occurs during ISO installation on the 20.03 SP3/SP4
  - i2c: hisi: Only handle the interrupt of the driver's transfer
  - i2c: hisi: Only use the completion interrupt to finish the transfer
  - i2c: hisi: Avoid redundant interrupts
  - !3483  net: Remove acked SYN flag from packet in the transmit queue correctly
  - net: Remove acked SYN flag from packet in the transmit queue correctly
  - SCSI: hisi_raid: support SPxxx serial RAID/HBA controllers


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2401.1.0.0233
changelog:
  - !3660  atm: Fix Use-After-Free in do_vcc_ioctl
  - !3687  Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
  - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
  - !3672  smb: client: fix potential OOB in smb2_dump_detail()
  - !3671  smb: client: fix OOB in smbCalcSize()
  - !3627  jbd2: fix soft lockup in journal_finish_inode_data_buffers()
  - !3189  fs: don't audit the capability check in simple_xattr_list()
  - smb: client: fix potential OOB in smb2_dump_detail()
  - smb: client: fix OOB in smbCalcSize()
  - !3555  net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
  - atm: Fix Use-After-Free in do_vcc_ioctl
  - !3592  CVE-2023-35827 patchset
  - !3449  Fix data-races around
  - jbd2: fix soft lockup in journal_finish_inode_data_buffers()
  - ravb: Fix races between ravb_tx_timeout_work() and net related ops
  - ravb: Fix use-after-free issue in ravb_tx_timeout_work()
  - net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
  - ip: Fix data-races around sysctl_ip_no_pmtu_disc.
  - ip: Fix data-races around sysctl_ip_fwd_update_priority.
  - fs: don't audit the capability check in simple_xattr_list()


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2401.3.0.0234
changelog:
  - !3768  iomap: add support to track dirty state of sub pages
  - !3845  netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
  - !3847  nvmet: nul-terminate the NQNs passed in the connect command
  - !3863 linux-4.19.y inclusion(4.19.299..4.19.303) part2
  - team: Fix use-after-free when an option instance allocation fails
  - packet: Move reference count in packet_sock to atomic_long_t
  - tcp: do not accept ACK of bytes we never sent
  - ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit()
  - ipv6: fix potential NULL deref in fib6_add()
  - ipv4: Correct/silence an endian warning in __ip_do_redirect
  - net: sched: fix race condition in qdisc_graft()
  - macvlan: Don't propagate promisc change to lower dev in passthru
  - ppp: limit MRU to 64K
  - tty: Fix uninit-value access in ppp_sync_receive()
  - net: annotate data-races around sk->sk_dst_pending_confirm
  - net: annotate data-races around sk->sk_tx_queue_mapping
  - !3862 linux-4.19.y inclusion(4.19.299..4.19.303) part1
  - ring-buffer: Fix memory leak of free page
  - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify
  - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation
  - Revert "PCI: acpiphp: Reassign resources on bridge if necessary"
  - x86/CPU/AMD: Check vendor in the AMD microcode callback
  - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
  - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
  - audit: don't take task_lock() in audit_exe_compare() code path
  - nvmet: nul-terminate the NQNs passed in the connect command
  - netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
  - !3823 [sync] PR-3822:  ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
  - ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
  - !3803  net/sched: cbs: Fix not adding cbs instance to list
  - net/sched: cbs: Fix not adding cbs instance to list
  - !3770  ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
  - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
  - iomap: add support to track dirty state of sub pages
  - !3757  Fix bugs from LTS patches
  - devcoredump: Send uevent once devcd is ready
  - devcoredump : Serialize devcd_del work
  - driver core: Release all resources during unbind before updating device links
  - !3716  appletalk: Fix Use-After-Free in atalk_ioctl
  - !3667  net/rose: Fix Use-After-Free in rose_ioctl
  - appletalk: Fix Use-After-Free in atalk_ioctl
  - net/rose: Fix Use-After-Free in rose_ioctl


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2401.4.0.0235
changelog:
  - !4006  crypto: hisilicon/sec2: fix memory use-after-free issue
  - crypto: hisilicon/sec2: fix memory use-after-free issue
  - !3923  net: bridge: multicast: fix UAF of net_bridge
  - net: bridge: multicast: fix UAF of net_bridge


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2401.5.0.0236
changelog:
  - !4101  netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
  - !2954 spi: phytium: fix phytium_spi_irq panic on boot
  - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
  - !4067  fix CVE-2022-48619
  - !4080  rtnetlink: Reject negative ifindexes in RTM_NEWLINK
  - rtnetlink: Reject negative ifindexes in RTM_NEWLINK
  - Revert "rtnetlink: Reject negative ifindexes in RTM_NEWLINK"
  - !4065  smb: client: fix OOB in receive_encrypted_standard()
  - !4021  netfilter: nf_tables: Reject tables of unsupported family
  - Input: add bounds checking to input_set_capability()
  - smb: client: fix OOB in receive_encrypted_standard()
  - !4039  crypto: hisilicon/qm: fix several issues
  - !4025  crypto: hisilicon - replace 'smp_processor_id' with the raw version of the macro
  - !3980  vhost: use kzalloc() instead of kmalloc() followed by memset()
  - crypto: hisilicon/qm: fix several issues
  - crypto: hisilicon - replace 'smp_processor_id' with the raw version of the macro
  - netfilter: nf_tables: Reject tables of unsupported family
  - vhost: use kzalloc() instead of kmalloc() followed by memset()
  - spi: phytium: fix phytium_spi_irq panic on boot


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2402.1.0.0237
changelog:
  - !4277  fs:/dcache.c: fix negative dentry limit not complete problem
  - !4288  net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
  - !4299  smb: client: fix NULL deref in asn1_ber_decoder()
  - smb: client: fix NULL deref in asn1_ber_decoder()
  - net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
  - !4228  fix spinlock already unlocked in inet_csk_reqsk_queue_add' bug
  - fs:/dcache.c: fix negative dentry limit not complete problem
  - !4235  nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
  - !4255  drm/amdgpu: Fix potential fence use-after-free v2
  - !4209  dhugetlb: skip unexpected migration
  - drm/amdgpu: Fix potential fence use-after-free v2
  - !4231  crypto: hisilicon/qm - drop unnecessary IS_ENABLE(CONFIG_NUMA) check
  - nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
  - crypto: hisilicon/qm - drop unnecessary IS_ENABLE(CONFIG_NUMA) check
  - ipv6: init the accept_queue's spinlocks in inet6_create
  - tcp: make sure init the accept_queue's spinlocks once
  - !4212  netlink: fix potential sleeping issue in mqueue_flush_file
  - netlink: fix potential sleeping issue in mqueue_flush_file
  - dhugetlb: skip unexpected migration
  - dhugetlb: introduce page_belong_to_dynamic_hugetlb() function
  - !3944  time: Handle negative seconds correctly in timespec64_to_ns()
  - !3943  timerqueue: Use rb_entry_safe() in timerqueue_getnext()
  - !3942  efi/x86: Map the entire EFI vendor string before copying it
  - !4166  sched/fair: Fix qos_timer deadlock when cpuhp offline
  - sched/fair: Fix qos_timer deadlock when cpuhp offline
  - !4137  sctp: fix potential deadlock on &net->sctp.addr_wq_lock
  - sctp: fix potential deadlock on &net->sctp.addr_wq_lock
  - time: Handle negative seconds correctly in timespec64_to_ns()
  - timerqueue: Use rb_entry_safe() in timerqueue_getnext()
  - efi/x86: Map the entire EFI vendor string before copying it


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2402.4.0.0238
changelog:
  - !4454  netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  - !4411 v2  drm/atomic: Fix potential use-after-free in nonblocking commits
  - !4412 v3  Save and restore msg_namelen in sock_sendmsg
  - net: Save and restore msg_namelen in sock_sendmsg
  - net: prevent rewrite of msg_name in sock_sendmsg()
  - !4399  net: dst: Optimized route gc
  - drm/atomic: Fix potential use-after-free in nonblocking commits
  - !4392 linux-4.19.y inclusion
  - !4369  mm/filemap: avoid buffered read/write race to read inconsistent data
  - net/dst: use a smaller percpu_counter batch for dst entries accounting
  - net: add a route cache full diagnostic message
  - net: check dev->gso_max_size in gso_features_check()
  - net: warn if gso_type isn't set for a GSO SKB
  - mm: fix unmap_mapping_range high bits shift bug
  - x86/alternatives: Sync core before enabling interrupts
  - mm/filemap: avoid buffered read/write race to read inconsistent data
  - !4360  net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
  - !4320  io_uring/af_unix: disable sending io_uring over sockets
  - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
  - io_uring/af_unix: disable sending io_uring over sockets


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2402.5.0.0239
changelog:
  - !4601 v2  xen-netback: don't produce zero-size SKB frags
  - xen-netback: don't produce zero-size SKB frags
  - !4583  net: hns3: fix a bug and modify the hns3 driver version
  - net: hns3: update hns3 version to 24.2.1
  - net: hns3: fix tm port shapping of fibre port is incorrect after driver initialization
  - !4552 v4  CVE-2023-52340
  - !4526 v2  fs:/dcache.c: fix negative dentry flag warning in dentry_free
  - ipv6: fix kabi broken in struct dst_ops
  - ipv6: Document that max_size sysctl is deprecated
  - ipv6: remove max_size check inline with ipv4
  - !4538  fix kprobe reenter bug
  - arm64/openeuler_defconfig: add not set config to fix compiling error
  - tracing/kprobes: Do the notrace functions check without kprobes on ftrace
  - fs:/dcache.c: fix negative dentry flag warning in dentry_free


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2402.6.0.0240
changelog:
  - !4701 v2  mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
  - !4684 v3  CVE-2023-52435
  - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
  - net: Fix compile warning in skb_segment()
  - net: prevent mss overflow in skb_segment()
  - !4643  f2fs: explicitly null-terminate the xattr list
  - f2fs: explicitly null-terminate the xattr list


author: yexiao<yexiao7@huawei.com> - 202002-18
changelog:
  - fix CVE-2023-0464、CVE-2023-0465、CVE-2023-0466、CVE-2023-2650、CVE-2023-3446、CVE-2023-3817、CVE-2024-0727


author: yanglu<yanglu72@h-partners.com> - 1.11.0-7
changelog:
  - Type:cves
  - CVE:CVE-2022-30698 CVE-2022-30699
  - SUG:NA
  - DESC:fix CVE-2022-30698 and CVE-2022-30699


author: jinlun <jinlun@huawei.com> - 15-23
changelog:
  - fix CVE-2017-3735 CVE-2017-3737 CVE-2018-0732 CVE-2018-0737
    CVE-2018-0739 CVE-2019-1563 CVE-2020-1971 CVE-2021-23840
    CVE-2021-23841 CVE-2022-0778


