# changelog

author: hanchao <hanchao47@huawei.com> - 1.15.7-24
changelog:
  - Type:CVE
  - CVE:CVE-2022-41723,CVE-2022-41724,CVE-2022-41725
  - SUG:NA
  - DESC:fix CVE-2022-41723,CVE-2022-41724,CVE-2022-41725


author: hanchao <hanchao47@huawei.com> - 1.15.7-25
changelog:
  - Type:CVE
  - CVE:CVE-2023-24534,CVE-2023-24536,CVE-2023-24537,CVE-2023-24538
  - SUG:NA
  - DESC:fix CVE-2023-24534,CVE-2023-24536,CVE-2023-24537,CVE-2023-24538


author: hanchao <hanchao63@huawei.com> - 1.15.7-27
changelog:
  - Type:CVE
  - CVE:CVE-2023-29400,CVE-2023-24539,CVE-2023-24540
  - SUG:NA
  - DESC: fix CVE-2023-29400,CVE-2023-24539,CVE-2023-24540


author: hanchao <hanchao63@huawei.com> - 1.15.7-28
changelog:
  - Type:CVE
  - CVE:CVE-2023-29402,CVE-2023-29404,CVE-2023-29405
  - SUG:NA
  - DESC: fix CVE-2023-29402,CVE-2023-29404,CVE-2023-29405


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2306.1.0.0204
changelog:
  - !932 [sync] PR-922:  jbd2: fix checkpoint inconsistent
  - jbd2: remove t_checkpoint_io_list
  - jbd2: recheck chechpointing non-dirty buffer
  - irqchip/gic-v3-its: Balance initial LPI affinity across CPUs
  - irqchip/gic-v3-its: Track LPI distribution on a per CPU basis
  - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
  - net: sched: fix NULL pointer dereference in mq_attach


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2306.3.0.0205
changelog:
  - arm64: Add AMPERE1 to the Spectre-BHB affected list
  - sctp: Call inet6_destroy_sock() via sk->sk_destruct().
  - net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
  - dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
  - sched: smart grid: init sched_grid_qos structure on QOS purpose
  - sched: Introduce smart grid scheduling strategy for cfs
  - ipmi: fix SSIF not responding under certain cond.
  - ipmi_ssif: Rename idle state and check
  - mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock
  - printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h
  - serial: 8250: Fix serial8250_tx_empty() race with DMA Tx
  - tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH
  - af_packet: Don't send zero-byte data in packet_sendmsg_spkt().
  - nohz: Add TICK_DEP_BIT_RCU
  - perf/core: Fix hardlockup failure caused by perf throttle
  - of: Fix modalias string generation
  - tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.
  - ipv4: Fix potential uninit variable access bug in __ip_make_skb()
  - crypto: drbg - Only fail when jent is unavailable in FIPS mode
  - crypto: drbg - make drbg_prepare_hrng() handle jent instantiation errors
  - net/packet: convert po->auxdata to an atomic flag
  - net/packet: convert po->origdev to an atomic flag
  - ring-buffer: Sync IRQ works before buffer destruction
  - dccp: Call inet6_destroy_sock() via sk->sk_destruct().
  - inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().
  - tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
  - udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM).
  - lib/cmdline: fix get_option() for strings starting with hyphen
  - of: overlay: fix for_each_child.cocci warnings
  - kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
  - fs: hfsplus: fix UAF issue in hfsplus_put_super
  - block: Fix the partition start may overflow in add_partition()
  - block: refactor blkpg_ioctl
  - nbd: get config_lock before sock_shutdown
  - ipv6: sr: fix out-of-bounds read when setting HMAC data.
  - dm: add disk before alloc dax
  - dm thin: Fix ABBA deadlock by resetting dm_bufio_client


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2306.4.0.0206
changelog:
  - sched: Adjust few parameters range for smart grid
  - sched: clear credit count in error branch
  - sched: Fix memory leak on error branch
  - sched: fix dereference NULL pointers
  - sched: Fix timer storm for smart grid
  - memstick: r592: Fix UAF bug in r592_remove due to race condition
  - fbcon: Check font dimension limits
  - sched/rt: Fix possible warn when push_rt_task
  - !1152 pci: workaround multiple functions can be assigned to only one VM
  - pci: workaround multiple functions can be assigned to only one VM
  - sched: Fix negative count for jump label
  - sched: Fix possible deadlock in tg_set_dynamic_affinity_mode
  - sched: fix WARN found by deadlock detect
  - sched: fix smart grid usage count
  - sched: Add static key to reduce noise
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
  - !1134 【openEuler-1.0-LTS】cpufreq:conservative: Fix load in fast_dbs_update()
  - firewire: fix potential uaf in outbound_phy_packet_callback()
  - cpufreq: conservative: fix load in fast_dbs_update()


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2306.5.0.0207
changelog:
  - HID: intel_ish-hid: Add check for ishtp_dma_tx_map
  - media: saa7134: fix use after free bug in saa7134_finidev due to race condition
  - config: enable CONFIG_QOS_SCHED_SMART_GRID by default
  - mm: oom: move memcg_print_bad_task() out of mem_cgroup_scan_tasks()
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition
  - sched: Fix memory leak for smart grid
  - sched: Delete redundant updates to p->prefer_cpus
  - nbd: fix incomplete validation of ioctl arg
  - nbd: validate the block size in nbd_set_size
  - relayfs: fix out-of-bounds access in relay_file_read
  - kernel/relay.c: fix read_pos error when multiple readers
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt()


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2306.7.0.0208
changelog:
  - sched: Fix null pointer derefrence for sd->span
  - scsi: hisi_sas: Fix Null point exception after call debugfs_remove_recursive()
  - scsi: hisi_sas: Fix normally completed I/O analysed as failed
  - drm/msm/dpu: Add check for pstates
  - usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2307.3.0.0209
changelog:
  - !1361 fix CVE-2023-1295
  - io_uring: get rid of intermediate IORING_OP_CLOSE stage
  - fs: provide locked helper variant of close_fd_get_file()
  - file: Rename __close_fd_get_file close_fd_get_file
  - Remove DECnet support from kernel
  - net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report
  - net: tcp: fix kabi breakage in struct sock
  - tcp: deny tcp_disconnect() when threads are waiting
  - ping6: Fix send to link-local addresses with VRF.
  - net: sched: fix possible refcount leak in tc_chain_tmplt_add()
  - rfs: annotate lockless accesses to RFS sock flow table
  - rfs: annotate lockless accesses to sk->sk_rxhash
  - xfrm: Check if_id in inbound policy/secpath match
  - udp6: Fix race condition in udp6_sendmsg & connect
  - tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set
  - af_packet: do not use READ_ONCE() in packet_bind()
  - af_packet: Fix data-races of pkt_sk(sk)->num.
  - ipv{4,6}/raw: fix output xfrm lookup wrt protocol
  - ipv6: Fix out-of-bounds access in ipv6_find_tlv()
  - net: fix skb leak in __skb_tstamp_tx()
  - udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().
  - vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
  - af_key: Reject optional tunnel/BEET mode templates in outbound policies
  - net: Catch invalid index in XPS mapping
  - af_unix: Fix data races around sk->sk_shutdown.
  - af_unix: Fix a data race of sk->sk_receive_queue->qlen.
  - net: datagram: fix data-races in datagram_poll()
  - tcp: factor out __tcp_close() helper
  - net: annotate sk->sk_err write from do_recvmmsg()
  - netlink: annotate accesses to nlk->cb_running
  - quota: simplify drop_dquot_ref()
  - quota: fix dqput() to follow the guarantees dquot_srcu should provide
  - quota: add new helper dquot_active()
  - quota: rename dquot_active() to inode_quota_active()
  - quota: factor out dquot_write_dquot()
  - quota: add dqi_dirty_list description to comment of Dquot List Management
  - quota: avoid increasing DQST_LOOKUPS when iterating over dirty/inuse list
  - kernel/extable.c: use address-of operator on section symbols
  - arm64/mm: mark private VM_FAULT_X defines as vm_fault_t
  - x86/mm: Avoid incomplete Global INVLPG flushes
  - sched: Fix KCSAN noinstr violation
  - serial: 8250: Reinit port->pm on port specific driver unbind
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects
  - ACPI: EC: Fix oops when removing custom query handlers
  - lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()
  - lib: cpu_rmap: Avoid use after free on rmap->obj array entries
  - ext4: improve error recovery code paths in __ext4_remount()
  - scsi: core: Improve scsi_vpd_inquiry() checks
  - PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock
  - loop: loop_set_status_from_info() check before assignment
  - loop: Check for overflow while configuring loop
  - Revert "loop: Check for overflow while configuring loop"
  - block: don't set GD_NEED_PART_SCAN if scan partition failed
  - block: return -EBUSY when there are open partitions in blkdev_reread_part
  - blk-wbt: make enable_state more accurate
  - block: Limit number of items taken from the I/O scheduler in one go
  - crypto: cryptd - Protect per-CPU resource by disabling BH.
  - random: fix data race on crng_node_pool
  - x86/kprobes: Fix the error judgment for debug exceptions
  - ext4: turning quotas off if mount failed after enable quotas
  - ext4: forbid commit inconsistent quota data when errors=remount-ro
  - quota: fixup *_write_file_info() to return proper error code
  - ipmi_si: fix a memleak in try_smi_init()
  - net: add vlan_get_protocol_and_depth() helper
  - net: tap: check vlan with eth_type_vlan() method
  - !1317  ext4: Stop trying writing pages if no free blocks generated
  - !1323  jbd2: fix several checkpoint
  - jbd2: fix checkpoint cleanup performance regression
  - jbd2: remove __journal_try_to_free_buffer()
  - jbd2: fix a race when checking checkpoint buffer busy
  - jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
  - jbd2: remove journal_clean_one_cp_list()
  - nbd: fix null-ptr-dereference while accessing 'nbd->config'
  - nbd: factor out a helper to get nbd_config without holding 'config_lock'
  - nbd: fold nbd config initialization into nbd_alloc_config()
  - ext4: Stop trying writing pages if no free blocks generated
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2307.4.0.0210
changelog:
  - !1435 fix CVE-2023-3117
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
  - !1400 [openEuler-1.0-LTS] block: Try to handle busy underlying device on discard
  - !1416  Fix generic/299 fail
  - ext4: Add debug message to notify user space is out of free
  - Revert "ext4: Stop trying writing pages if no free blocks generated"
  - !1404  bpf: cpumap: Fix memory leak in cpu_map_update_elem
  - bpf: cpumap: Fix memory leak in cpu_map_update_elem
  - block: Try to handle busy underlying device on discard
  - !1377 [sync] PR-1376:  jbd2: Check 'jh->b_transaction' before remove it from checkpoint
  - !1374  etmem: fix the div 0 problem in swapcache reclaim process
  - !177 net:bonding:support balance-alb interface with vlan to bridge
  - jbd2: Check 'jh->b_transaction' before remove it from checkpoint
  - etmem: fix the div 0 problem in swapcache reclaim process
  - bonding: fix reference count leak in balance-alb mode
  - net:bonding:support balance-alb interface with vlan to bridge


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2307.5.0.0211
changelog:
  - !1534 arm64/mpam: fix missing kfree domain's ctrl_val arrray
  - arm64/mpam: fix missing kfree domain's ctrl_val arrray
  - !1529  net/sched: sch_qfq: account for stab overhead in qfq_enqueue
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue
  - !1474 [openEuler-1.0-LTS] pmu: remove uncore code for Zhaoxin Platform
  - !1498  media: dvb-core: Fix use-after-free due on race condition at dvb_net
  - media: dvb-core: Fix use-after-free due on race condition at dvb_net
  - !1444 ring-buffer: Fix deadloop issue on reading trace_pipe
  - !1469  netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
  - !1472  ipv6/addrconf: fix a potential refcount underflow for idev
  - pmu: remove uncore code for Zhaoxin Platform
  - ipv6/addrconf: fix a potential refcount underflow for idev
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
  - ftrace: Fix possible warning on checking all pages used in ftrace_process_locs()
  - ring-buffer: Fix deadloop issue on reading trace_pipe


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2308.1.0.0212
changelog:
  - !1571 【openEuler-1.0-LTS】net: hns: fix wrong head when modify the tx feature when sending packets
  - !1570 【openEuler-1.0-LTS】net: hns3: bugfixes for hns3 drivers 2023.07.29
  - net: hns: update hns version to 23.7.1
  - net: hns: fix wrong head when modify the tx feature when sending packets
  - net: hns3: update hns3 version to 23.7.1
  - net: hns3: fix tx timeout issue
  - net: hns3: fix incorrect hw rss hash type of rx packet
  - net: hns3: add barrier in vf mailbox reply process
  - net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg
  - net: hns3: fix not call nic_call_event() problem when reset failed
  - !1556  net/sched: cls_fw: Fix improper refcount update leads to use-after-free
  - !1568  net/sched: cls_u32: Fix reference counter leak leading to overflow
  - net/sched: cls_u32: Fix reference counter leak leading to overflow
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free
  - !1549  binder: fix UAF caused by faulty buffer cleanup
  - binder: fix UAF caused by faulty buffer cleanup


author: Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2308.2.0.0213
changelog:
  - !1699 dm bugfixes backport from mainline
  - !1697  x86/cpu/amd: Add a Zenbleed fix
  - md: Flush workqueue md_rdev_misc_wq in md_alloc()
  - dm: don't lock fs when the map is NULL during suspend or resume
  - dm: don't lock fs when the map is NULL in process of resume
  - dm: requeue IO if mapping table not yet available
  - Revert "dm: make sure dm_table is binded before queue request"
  - dm thin metadata: check fail_io before using data_sm
  - !1662  media: usb: siano: Fix CVE-2023-4132
  - !1696  Revert "arm64/mpam: Fix mpam corrupt when cpu online"
  - x86/cpu/amd: Add a Zenbleed fix
  - !1694 linux-4.19.y bugfixes backport
  - Revert "arm64/mpam: Fix mpam corrupt when cpu online"
  - x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys
  - sch_netem: fix issues in netem_change() vs get_dist_table()
  - sch_netem: acquire qdisc lock in netem_change()
  - cgroup: Do not corrupt task iteration when rebinding subsystem
  - !1577  tracing: Fix warning in trace_buffered_event_disable()
  - !1663  tty: fix pid memleak in disassociate_ctty()
  - tty: fix pid memleak in disassociate_ctty()
  - media: usb: siano: Fix warning due to null work_func_t function pointer
  - media: usb: siano: Fix use after free bugs caused by do_submit_urb
  - !1629  can: raw: fix receiver memory leak
  - !1655  can: bcm: Fix UAF in bcm_proc_show()
  - can: bcm: Fix UAF in bcm_proc_show()
  - can: raw: fix lockdep issue in raw_release()
  - can: raw: fix receiver memory leak
  - !1625  Fix host zero page refcount overflow caused by kvm
  - !1595  net: nfc: Fix CVE-2023-3863
  - KVM: Don't set Accessed/Dirty bits for ZERO_PAGE
  - KVM: fix overflow of zero page refcount with ksm running
  - net: nfc: Fix use-after-free caused by nfc_llcp_find_local
  - nfc: llcp: simplify llcp_sock_connect() error paths
  - nfc: llcp: nullify llcp_sock->dev on connect() error paths
  - nfc: Fix to check for kmemdup failure
  - tracing: Fix warning in trace_buffered_event_disable()


author: yangmingtai <yangmingtai@huawei.com> - 10.35-4
changelog:
  - DESC:sync community patches
         backport-jit-fail-early-in-ffcps_-if-subject-shorter-than-off.patch
         backport-jit-fix-pcre2_jit_free_unused_memory-if-sljit-not-us.patch


