# changelog

author: wuchangsheng <wuchangsheng2@huawei.com> - 19.11-15
changelog:
  - backport pathes from community
  - net/softnic fix memory leak as profile is freed
  - net/virtio fix interrupt handle leak
  - vhost fix crash on reconnect
  - net/virtio report maximum MTU in device info
  - bus/dpaa fix freeing in FMAN interface destructor
  - distributor fix 128 bit write alignment


author: zhangxiaoyu <zhangxiaoyu58@huawei.com> - 2.0.16-4
changelog:
  - Type: enhancement
  - ID: NA
  - SUG: NA
  - DESC: invalid free default-runtime and cri-runtime after free json-confs


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2207.3.0.0159
changelog:
  - block: fix that part scan is disabled in device_add_disk()
  - Revert "block: rename bd_invalidated"
  - Revert "block: move the NEED_PART_SCAN flag to struct gendisk"
  - Revert "block:Fix kabi broken"
  - rcu/tree: Mark functions as notrace
  - netfilter: nf_tables: stricter validation of element data
  - net: rose: fix UAF bugs caused by timer handler
  - xen/arm: Fix race in RB-tree based P2M accounting
  - vt: drop old FONT ioctls
  - dm thin: Fix crash in dm_sm_register_threshold_callback()
  - xen/blkfront: force data bouncing when backend is untrusted
  - xen/netfront: force data bouncing when backend is untrusted
  - xen-netfront: fix potential deadlock in xennet_remove()
  - xen/netfront: fix leaking data in shared pages
  - xen/blkfront: fix leaking data in shared pages
  - xen/blkfront: fix memory allocation flags in blkfront_setup_indirect()
  - tmpfs: fix the issue that the mount and remount results are inconsistent.
  - tmpfs: fix undefined-behaviour in shmem_reconfigure()
  - mm/sharepool: Check sp_is_enabled() before show spa_stat


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2207.4.0.0160
changelog:
  - inotify: show inotify mask flags in proc fdinfo
  - io_uring: always grab file table for deferred statx
  - bpf: Don't redirect packets with invalid pkt_len
  - config: enable CONFIG_QOS_SCHED_DYNAMIC_AFFINITY by default
  - sched: Add statistics for scheduler dynamic affinity
  - sched: Adjust cpu range in load balance dynamicly
  - sched: Adjust wakeup cpu range according CPU util dynamicly
  - cpuset: Introduce new interface for scheduler dynamic affinity
  - sched: Introduce dynamic affinity for cfs scheduler
  - crypto: hisilicon/sec - don't sleep when in softirq
  - video: fbdev: sm712fb: Fix crash in smtcfb_write()
  - video: fbdev: sm712fb: Fix crash in smtcfb_read()
  - scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process
  - block: don't delete queue kobject before its children
  - etmem:fix kernel stack overflow in do_swapcache_reclaim
  - etmem:fix kasan slab-out-of-bounds in do_swapcache_reclaim
  - nbd: don't clear 'NBD_CMD_INFLIGHT' flag if request is not completed
  - blk-throttle: fix io hung due to configuration updates
  - block: fix NULL pointer dereference in disk_release()
  - block, bfq: make bfq_has_work() more accurate
  - blk-mq: fix panic during blk_mq_run_work_fn()
  - blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()
  - blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue
  - ext4: fix race condition between ext4_ioctl_setflags and ext4_fiemap


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2208.1.0.0161
changelog:
  - fbcon: Prevent that screen size is smaller than font size
  - fbcon: Disallow setting font bigger than screen size
  - fbmem: Check virtual screen sizes in fb_set_var()
  - xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
  - scsi: core: Fix race between handling STS_RESOURCE and completion
  - block: prevent lockdep false positive warning about 'bd_mutex'
  - dm verity: allow only one error handling mode
  - dm verity: Fix compilation warning
  - dm verity: add root hash pkcs#7 signature verification
  - jbd2: Fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
  - dm btree spine: show warning if node_check failed in node_prep_for_write()
  - dm btree spine: remove paranoid node_check call in node_prep_for_write()
  - ext4: Fix race when reusing xattr blocks
  - ext4: Unindent codeblock in ext4_xattr_block_set()
  - ext4: Remove EA inode entry from mbcache on inode eviction
  - mbcache: Add functions to delete entry if unused
  - mbcache: Don't reclaim used entries
  - perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2208.2.0.0162
changelog:
  - netfilter: nf_queue: do not allow packet truncation below transport header offset
  - openvswitch: fix OOB access in reserve_sfa_size()
  - dm thin: use refcount_t for thin_c reference counting
  - exec: Force single empty string when argv is empty
  - usb: gadget: rndis: prevent integer overflow in rndis_set_response()
  - serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle
  - serial: 8250: fix return error code in serial8250_request_std_resource()
  - ipv4: Fix data-races around sysctl_ip_dynaddr.
  - icmp: Fix a data-race around sysctl_icmp_ratemask.
  - icmp: Fix a data-race around sysctl_icmp_ratelimit.
  - icmp: Fix data-races around sysctl.
  - net: Fix data-races around sysctl_mem.
  - inetpeer: Fix data-races around sysctl.
  - usbnet: fix memory leak in error case
  - esp: limit skb_page_frag_refill use to a single page
  - net: tun: avoid disabling NAPI twice
  - net: bonding: fix use-after-free after 802.3ad slave unbind
  - net: bonding: fix possible NULL deref in rlb code
  - usbnet: fix memory allocation in helpers
  - net: tun: stop NAPI when detaching queues
  - net: tun: unlink NAPI from device on destruction
  - virtio-net: fix race between ndo_open() and virtio_device_ready()
  - SUNRPC: Fix READ_PLUS crasher
  - virtio_net: fix xdp_rxq_info bug after suspend/resume
  - erspan: do not assume transport header is always set
  - net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms
  - bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
  - ext4: make variable "count" signed
  - serial: 8250: Store to lsr_save_flags after lsr read
  - irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions
  - irqchip/gic/realview: Fix refcount leak in realview_gic_of_init
  - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
  - ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr
  - io_uring: add missing item types for various requests
  - net/sched: cls_u32: fix possible leak in u32_init_knode()
  - fq_codel: reject silly quantum parameters
  - net: sched: sch_teql: fix null-pointer dereference
  - rcu: Set a maximum limit for back-to-back callback invocation
  - mm: Fix page counter mismatch in shmem_mfill_atomic_pte
  - scsi: mpt3sas: Fix unlock imbalance
  - io-wq: Switch io_wqe_worker's fs before releasing request
  - ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
  - Revert "iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()"


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2208.4.0.0163
changelog:
  - Revert "x86/unwind/orc: Change REG_SP_INDIRECT"
  - Phytium/S2500: kdump: Avoid vmcore saving failure across multi-socket
  - PCI: Add config control for phytium ACS quirks
  - scsi: libiscsi: Teardown iscsi_cls_conn gracefully
  - scsi: libiscsi: Add iscsi_cls_conn to sysfs after initialization
  - scsi: iscsi: Add helper functions to manage iscsi_cls_conn
  - media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls
  - sched: Fix null-ptr-deref in free_fair_sched_group
  - RDMA/ib_srp: Fix a deadlock
  - mm/slub: add missing TID updates on slab deactivation
  - block: fix regression for dm
  - blk-mq: handle bio after queue is initialized
  - x86: Clear .brk area at early boot
  - signal/seccomp: Dump core when there is only one live thread
  - x86/unwind/orc: Recheck address range after stack info was updated
  - x86/unwind/orc: Silence warnings caused by missing ORC data
  - x86/unwind/orc: Change REG_SP_INDIRECT


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2208.5.0.0164
changelog:
  - x86/speculation: Add LFENCE to RSB fill sequence
  - x86/speculation: Add RSB VM Exit protections
  - Revert "blk-mq: fix null pointer dereference in blk_mq_queue_tag_busy_ite"
  - blk-mq: fix null pointer dereference in blk_mq_queue_tag_busy_ite
  - arm64: Avoid premature usercopy failure for __arch_copy_to_user_generic_read
  - net_sched: cls_route: remove from list when handle is 0


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2208.6.0.0165
changelog:
  - tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
  - tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
  - tty: drop tty_schedule_flip()
  - tty: the rest, stop using tty_schedule_flip()
  - tty: drivers/tty/, stop using tty_schedule_flip()
  - can: bcm/raw/isotp: use per module netdevice notifier
  - CIFS: Fix retry mid list corruption on reconnects
  - KVM: arm64: vgic-its: Change default outer cacheability for {PEND, PROP}BASER
  - xhci: Fix a logic issue when display Zhaoxin XHCI root hub speed
  - dm verity: set DM_TARGET_IMMUTABLE feature flag
  - scsi: hisi_sas: Add SATA_DISK_ERR bit handling for v3 hw
  - Revert "scsi: hisi_sas: Modify v3 HW I/O processing when SATA_DISK_ERR bit is set and NCQ Error occurs"
  - netfilter: nf_tables: do not allow RULE_ID to refer to another chain
  - netfilter: nf_tables: do not allow SET_ID to refer to another table


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2209.1.0.0166
changelog:
  - dm-thin: Resume failed in FAIL mode
  - tpm: fix reference counting for struct tpm_chip
  - af_key: Do not call xfrm_probe_algs in parallel
  - net: usb: ax88179_178a: Fix packet receiving
  - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
  - net: usb: ax88179_178a: fix packet alignment padding


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2209.3.0.0167
changelog:
  - KVM: x86: do not report a vCPU as preempted outside instruction boundaries
  - KVM: arm64: Write arch.mdcr_el2 changes since last vcpu_load on VHE
  - netfilter: nf_conntrack_irc: Tighten matching on DCC message
  - ext4: avoid resizing to a partial cluster size
  - locking/atomic: Make test_and_*_bit() ordered on failure
  - geneve: do not use RT_TOS for IPv6 flowlabel
  - SUNRPC: Reinitialise the backchannel request buffers before reuse
  - NFSv4/pnfs: Fix a use-after-free bug in open
  - NFSv4.1: RECLAIM_COMPLETE must handle EACCES
  - tcp: fix over estimation in sk_forced_mem_schedule()
  - ext4: fix extent status tree race in writeback error recovery path
  - ext4: update s_overhead_clusters in the superblock during an on-line resize
  - ext4: make sure ext4_append() always allocates new block
  - kprobes: Forbid probing on trampoline and BPF code areas
  - kfifo: fix kfifo_to_user() return type
  - profiling: fix shift too large makes kernel panic
  - serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty()
  - mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
  - mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path
  - mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release
  - can: error: specify the values of data[5..7] of CAN error frames
  - fs: check FMODE_LSEEK to control internal pipe splicing
  - tcp: make retransmitted SKB fit into the send window
  - nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt()
  - bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe()
  - x86/pmem: Fix platform-device leak in error path
  - selinux: Add boundary check in put_entry()
  - ACPI: LPSS: Fix missing check in register_device_clock()
  - fs: Add missing umask strip in vfs_tmpfile
  - vfs: Check the truncate maximum size in inode_newsize_ok()
  - tcp: Fix a data-race around sysctl_tcp_comp_sack_nr.
  - tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns.
  - tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit.
  - tcp: Fix a data-race around sysctl_tcp_autocorking.
  - tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen.
  - tcp: Fix a data-race around sysctl_tcp_min_tso_segs.
  - igmp: Fix data-races around sysctl_igmp_qrv.
  - net: ping6: Fix memleak in ipv6_renew_options().
  - tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit.
  - tcp: Fix a data-race around sysctl_tcp_nometrics_save.
  - tcp: Fix a data-race around sysctl_tcp_frto.
  - tcp: Fix a data-race around sysctl_tcp_adv_win_scale.
  - tcp: Fix a data-race around sysctl_tcp_app_win.
  - tcp: Fix data-races around sysctl_tcp_dsack.
  - mm/mempolicy: fix uninit-value in mpol_rebind_policy()
  - tcp: Fix data-races around sysctl_tcp_max_reordering.
  - tcp: Fix a data-race around sysctl_tcp_rfc1337.
  - tcp: Fix a data-race around sysctl_tcp_stdurg.
  - tcp: Fix a data-race around sysctl_tcp_retrans_collapse.
  - tcp: Fix data-races around sysctl_tcp_slow_start_after_idle.
  - tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.
  - tcp: Fix data-races around sysctl_tcp_recovery.
  - tcp: Fix a data-race around sysctl_tcp_early_retrans.
  - tcp: Fix data-races around sysctl_tcp_fastopen.
  - tcp: Fix a data-race around sysctl_tcp_tw_reuse.
  - tcp: Fix a data-race around sysctl_tcp_notsent_lowat.
  - tcp: Fix data-races around some timeout sysctl knobs.
  - tcp: Fix data-races around sysctl_tcp_reordering.
  - igmp: Fix a data-race around sysctl_igmp_max_memberships.
  - igmp: Fix data-races around sysctl_igmp_llm_reports.
  - tcp: Fix a data-race around sysctl_tcp_probe_interval.
  - tcp: Fix a data-race around sysctl_tcp_probe_threshold.
  - tcp: Fix data-races around sysctl_tcp_mtu_probing.
  - tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
  - ip: Fix a data-race around sysctl_fwmark_reflect.
  - ip: Fix data-races around sysctl_ip_nonlocal_bind.
  - ip: Fix data-races around sysctl_ip_fwd_use_pmtu.
  - block: fix the problem of io_ticks becoming smaller
  - blk-mq: Fix memory leak in blk_mq_init_allocated_queue error handling
  - block, bfq: save & resume weight on a queue merge/split
  - ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1
  - acpi/nfit: improve bounds checking for 'func'
  - ACPICA: Do not increment operation_region reference counts for field units
  - ACPICA: Fix exception code class checks
  - ACPI: configfs: add missing check after configfs_register_default_group()
  - ACPI: custom_method: fix potential use-after-free issue
  - ACPI: custom_method: fix a possible memory leak
  - ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  - ACPI/IORT: Fix PMCG node single ID mapping handling
  - ACPI/IORT: Check node revision for PMCG resources
  - kprobes: don't call disarm_kprobe() for disabled kprobes
  - x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry
  - usb: gadget: function: printer: fix use-after-free in __lock_acquire
  - video: fbdev: i740fb: Error out if 'pixclock' equals zero
  - lightnvm: disable the subsystem
  - configfs: fix a race in configfs_lookup()
  - configfs: fold configfs_attach_attr into configfs_lookup
  - configfs: make configfs_create() return inode
  - configfs: factor dirent removal into helpers
  - configfs: simplify the configfs_dirent_is_ready
  - configfs: return -ENAMETOOLONG earlier in configfs_lookup


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2209.4.0.0168
changelog:
  - mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
  - video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write


author: chengzeruizhi<chengzeruizhi@huawei.com> - 2.0.8-3
changelog:
  - Type: enhancement
  - ID: NA
  - SUG: NA
  - DESC: add HAVE_ISULAD definition and fix cpu quota out of range


author: yuboyun <yuboyun@huawei.com> - 33.6-2
changelog:
  - Do not use '--loglevel' option when running Anaconda
    Improve Imc no-virt error handling
    Add POSTIN scriptlet error to the log monitor list
    Remove LD_PRELOAD libgomp.so.1 from Imc --no-virt


author: shixuantong <shixuantong@h-partners.com> - 3.7.9-19
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:disable profile guided optimizations for x86_64 and i686 architectures


author: shixuantong <shixuantong@h-partners.com> - 3.7.9-21
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:bpo-43124: Fix smtplib multiple CRLF injection
         bpo-12800: tarfile: Restore fix from 011525ee9
         bpo-41815: SQLite: segfault if backup called on closed database
         bpo-42183: Fix a stack overflow error for asyncio Task or Future repr()
         bpo-45001: Make email date parsing more robust against malformed input


author: yezengruan <yezengruan@huawei.com>
changelog:
  - hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582)
  - pvrdma: Ensure correct input on ring init (CVE-2021-3607)
  - pvrdma: Fix the ring init error flow (CVE-2021-3608)


author: yezengruan <yezengruan@huawei.com>
changelog:
  - vhost-vsock: detach the virqueue element in case of error (CVE-2022-26354)
  - virtio-net: fix map leaking on error during receive (CVE-2022-26353)


author: yezengruan <yezengruan@huawei.com>
changelog:
  - hw/block/fdc: Extract blk_create_empty_drive()
  - hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196
  - tests/fdc-test: Add a regression test for CVE-2021-20196
  - display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207)
  - ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)


author: yezengruan <yezengruan@huawei.com>
changelog:
  - hw/intc/arm_gicv3_dist: Rename 64-bit accessors with 'q' suffix
  - hw/intc/arm_gicv3: Replace mis-used MEMTX_* constants by booleans
  - hw/intc/arm_gicv3: Check for !MEMTX_OK instead of MEMTX_ERROR (CVE-2021-3750)
  - net/colo-compare.c: Check that colo-compare is active


author: sundongxu <sundongxu3@huawei.com>
changelog:
  - e1000: fail early for evil descriptor
  - e1000: fix tx re-entrancy problem
  - hw/sd/sdcard: Do not allow invalid SD card sizes
  - hw/sd/sdcard: Do not switch to ReceivingData if address is invalid
  - hw/sd/sdcard: Restrict Class 6 commands to SCSD cards
  - hw/sd/sdcard: Simplify realize() a bit
  - hw/sd/sdcard: Update coding style to make checkpatch.pl happy
  - scsi/qemu-pr-helper: Fix out-of-bounds access to trnptid_list[]
  - curses: Fixes curses compiling errors.
  - net/dump.c: Suppress spurious compiler warning
  - tests: Replace deprecated ASN1 code


author: yezengruan <yezengruan@huawei.com>
changelog:
  - hw/scsi/lsi53c895a: Do not abort when DMA requested and no data queued
  - scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216)
  - scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216)


author: dongyuzhen <dongyuzhen@h-partners.com> - 2:8.2-47
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix the error of backport-cannot-list-options-one-per-line.patch


