# changelog

author: chenyi <chenyi211@huawei.com> - 4.19.90-2407.1.0.0284
changelog:
  - !9629  stm class: Fix a double free in stm_register_device()
  - !9646  phonet: fix rtm_phonet_notify() skb allocation
  - !9628  m68k: Fix spinlock race in kernel thread creation
  - !9623 v2  net/nfc/rawsock.c: fix a permission check bug
  - !9648 backport two patches from 5.10 to fix some bugs for GuestOS
  - !9617  mac80211: track only QoS data frames for admission control
  - !9637  ipv6: sr: fix invalid unregister error path
  - !9607  enic: Validate length of nl attributes in enic_set_vf_port
  - !9606  drm/nouveau: fix off by one in BIOS boundary checking
  - !9605  scsi: bfa: Ensure the copied buf is NUL terminated
  - irqchip: gic-v3: Collection table support muti pages
  - scsi: virtio_scsi: limit number of hw queues by nr_cpu_ids
  - phonet: fix rtm_phonet_notify() skb allocation
  - ipv6: sr: fix invalid unregister error path
  - stm class: Fix a double free in stm_register_device()
  - m68k: Fix spinlock race in kernel thread creation
  - !9076  RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
  - net/nfc/rawsock.c: fix a permission check bug
  - mac80211: track only QoS data frames for admission control
  - enic: Validate length of nl attributes in enic_set_vf_port
  - drm/nouveau: fix off by one in BIOS boundary checking
  - !9600  CVE-2024-38597
  - scsi: bfa: Ensure the copied buf is NUL terminated
  - !9409  drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - !9452  jffs2: prevent xattr node from overflowing the eraseblock
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
  - !8163 v2  mmc: sdio: fix possible resource leaks in some error paths
  - !9535  igbvf: fix double free in `igbvf_probe`
  - !9590  s390/ap: Fix crash in AP internal function modify_bitmap()
  - !9584  ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  - !9537  virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - !9585  net/mlx5e: Avoid field-overflowing memcpy()
  - s390/ap: Fix crash in AP internal function modify_bitmap()
  - net/mlx5e: Avoid field-overflowing memcpy()
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  - !9534  rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
  - !9419  mm/migrate: set swap entry values of THP tail pages properly.
  - !9560  net: systemport: Add global locking for descriptor lifecycle
  - !9526  media: lgdt3306a: Add a check against null-pointer-def
  - !9539  ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - net: systemport: Add global locking for descriptor lifecycle
  - !9340  serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - !9330  ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx()
  - !9382  serial: max3100: Update uart_driver_registered on driver removal
  - !9503 v2  watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - !9464  quota: Fix rcu annotations of inode dquot pointers
  - !9530 v2  Backport LTS patches
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - !9435  fix CVE-2024-38621
  - igbvf: fix double free in `igbvf_probe`
  - rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
  - !9381  vfio/pci: fix potential memory leak in vfio_intx_enable()
  - !9497  netrom: fix possible dead-lock in nr_rt_ioctl()
  - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
  - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map
  - media: lgdt3306a: Add a check against null-pointer-def
  - !9505  CVE-2024-38587
  - !9473  um: Add winch to winch_handlers before registering winch IRQ
  - !9407  drm/arm/malidp: fix a possible null pointer dereference
  - !9400  Fix CVE-2024-31076
  - speakup: Fix sizeof() vs ARRAY_SIZE() bug
  - !9439  CVE-2022-48715
  - !9133  net: ethernet: fix potential use-after-free in ec_bhf_remove
  - watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - netrom: fix possible dead-lock in nr_rt_ioctl()
  - !9265  ring-buffer: Fix a race between readers and resize checks
  - !9390  NFS: Fix an off by one in root_nfs_cat()
  - um: Add winch to winch_handlers before registering winch IRQ
  - quota: Fix rcu annotations of inode dquot pointers
  - fs/quota: erase unused but set variable warning
  - jffs2: prevent xattr node from overflowing the eraseblock
  - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
  - media: stk1160: fix bounds checking in stk1160_copy_video()
  - mm/migrate: set swap entry values of THP tail pages properly.
  - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - drm/arm/malidp: fix a possible null pointer dereference
  - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
  - NFS: Fix an off by one in root_nfs_cat()
  - serial: max3100: Update uart_driver_registered on driver removal
  - vfio/pci: fix potential memory leak in vfio_intx_enable()
  - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx()
  - ring-buffer: Fix a race between readers and resize checks
  - net: ethernet: fix potential use-after-free in ec_bhf_remove
  - RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
  - mmc: sdio: fix possible resource leaks in some error paths


author: chenyi <chenyi211@huawei.com> - 4.19.90-2407.3.0.0285
changelog:
  - !9803 v2  x86/ftrace: Disable lockdep check when execute ftrace_int3_handler()
  - x86/ftrace: Disable lockdep check when execute ftrace_int3_handler()
  - !9797  sch_cake: do not call cake_destroy() from cake_init()
  - sch_cake: do not call cake_destroy() from cake_init()
  - !9786  drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
  - drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
  - !9777  CVE-2024-23848
  - media: cec: cec-api: add locking in cec_release()
  - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
  - !9765  i40e: Fix queues reservation for XDP
  - !9760  CVE-2024-26816
  - !9754  net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - !9367 v2  net: qcom/emac: fix UAF in emac_remove
  - !9512  drm: vc4: Fix possible null pointer dereference
  - !9755  wifi: ar5523: enable proper endpoint verification
  - i40e: Fix queues reservation for XDP
  - !9744  Fix CVE-2024-36949
  - !9741  scsi: qedf: Ensure the copied buf is NUL terminated
  - !9727  net: amd-xgbe: Fix skb data length underflow
  - x86/boot: Ignore relocations in .notes sections in walk_relocs() too
  - x86, relocs: Ignore relocations in .notes section
  - !9743  USB: core: Fix hang in usb_kill_urb by adding memory barriers
  - wifi: ar5523: enable proper endpoint verification
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - !9674  ax25: Fix reference count leak issue of net_device
  - !9729  seg6: fix the iif in the IPv6 socket control block
  - !9725 v2  net: Fix CVE-2022-48757
  - !9737  net/9p: fix uninit-value in p9_client_rpc()
  - amd/amdkfd: sync all devices to wait all processes being evicted
  - drm/amdkfd: Rework kfd_locked handling
  - USB: core: Fix hang in usb_kill_urb by adding memory barriers
  - scsi: qedf: Ensure the copied buf is NUL terminated
  - net/9p: fix uninit-value in p9_client_rpc()
  - !9710  CVE-2022-48738
  - !9568  media: mxl111sf: change mutex_init() location
  - !9570  net: ieee802154: ca8210: Stop leaking skb's
  - seg6: fix the iif in the IPv6 socket control block
  - !9700 v2  crypto: bcm - Fix pointer arithmetic
  - !9684  greybus: lights: check return of get_channel_from_mode
  - net: amd-xgbe: Fix skb data length underflow
  - !9666  ftrace: Fix rcu warn in ftrace_location()
  - net: fix kabi breakage in struct packet_type
  - net: fix information leakage in /proc/net/ptype
  - !9724  Fix CVE-2024-35915
  - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_rx_work
  - nfc: nci: Fix kcov check in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
  - !9658  KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak
  - !9698  Fix CVE-2021-47270
  - !9699  dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - !9550  scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()
  - !9707  nilfs2: fix use-after-free of timer for log writer thread
  - ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min
  - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()
  - nilfs2: fix use-after-free of timer for log writer thread
  - !9655  nfc: fix segfault in nfc_genl_dump_devices_done
  - !9654  mac80211: validate extended element ID is present
  - !9653  ecryptfs: Fix buffer size for tag 66 packet
  - !9652  ALSA: timer: Set lower bound of start tick time
  - !9697 v3  Fix CVE-2024-38567
  - !9633  CVE-2024-38582
  - !9692  netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
  - crypto: bcm - Fix pointer arithmetic
  - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS
  - usb: fix various gadgets null ptr deref on 10gbps cabling.
  - wifi: carl9170: add a proper sanity check for endpoints
  - USB: core: Add routines for endpoint checks in old drivers
  - !9597  ASoC: max9759: fix underflow in speaker_gain_control_put()
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
  - !9626  fix uaf when proc_cpuset_show
  - !9660  nilfs2: fix potential kernel bug due to lack of writeback flag waiting
  - greybus: lights: check return of get_channel_from_mode
  - ax25: Fix reference count leak issue of net_device
  - ftrace: Fix rcu warn in ftrace_location()
  - !9553  CVE-2024-37356
  - nilfs2: fix potential kernel bug due to lack of writeback flag waiting
  - KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak
  - nfc: fix segfault in nfc_genl_dump_devices_done
  - mac80211: validate extended element ID is present
  - ecryptfs: Fix buffer size for tag 66 packet
  - ALSA: timer: Set lower bound of start tick time
  - nilfs2: fix potential hang in nilfs_detach_log_writer()
  - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
  - cgroup: fix uaf when proc_cpuset_show
  - ASoC: max9759: fix underflow in speaker_gain_control_put()
  - net: ieee802154: ca8210: Stop leaking skb's
  - media: mxl111sf: change mutex_init() location
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
  - params: lift param_set_uint_minmax to common code
  - scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()
  - drm: vc4: Fix possible null pointer dereference
  - net: qcom/emac: fix UAF in emac_remove


author: chenyi <chenyi211@huawei.com> - 4.19.90-2407.4.0.0286
changelog:
  - !9925  ocfs2: fix races between hole punching and AIO+DIO
  - !9874  crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
  - !9830  mmc: davinci: Don't strip remove function when driver is builtin
  - !9870  cifs: Fix deadlock in cifs_writepages during reconnect
  - !9895  bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  - ocfs2: fix races between hole punching and AIO+DIO
  - !9891  ipv6: sr: fix memleak in seg6_hmac_init_algo
  - !9856  btrfs: fix memory ordering between normal and ordered work functions
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  - ipv6: sr: fix memleak in seg6_hmac_init_algo
  - !9492  netlabel: fix out-of-bounds memory accesses
  - !9868  usb: musb: tusb6010: check return value after calling platform_get_resource()
  - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
  - cifs: Fix deadlock in cifs_writepages during reconnect
  - usb: musb: tusb6010: check return value after calling platform_get_resource()
  - !9858  khugepaged: fix null-pointer dereference due to race
  - !9819  kdb: Fix buffer overflow during tab-complete
  - khugepaged: fix null-pointer dereference due to race
  - btrfs: fix memory ordering between normal and ordered work functions
  - !9842  net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove
  - net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove
  - mmc: davinci: Don't strip remove function when driver is builtin
  - kdb: Fix buffer overflow during tab-complete
  - netlabel: fix out-of-bounds memory accesses


author: chenyi <chenyi211@huawei.com> - 4.19.90-2407.5.0.0287
changelog:
  - !10125  nvme-rdma: fix possible use-after-free in transport error_recovery work
  - !10112  ftrace: Fix use-after-free for dynamic ftrace_ops
  - !10276  net: ieee802154: at86rf230: Stop leaking skb's
  - net: ieee802154: at86rf230: Stop leaking skb's
  - !9917  powerpc/pseries: Enforce hcall result buffer validity and size
  - !10240  CVE-2024-41007
  - !10251  sctp: fix kernel-infoleak for SCTP sockets
  - !10241  USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - sctp: fix kernel-infoleak for SCTP sockets
  - !10229  staging: gdm724x: fix use after free in gdm_lte_rx()
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - tcp: avoid too many retransmit packets
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
  - net: tcp: fix unexcepted socket die when snd_wnd is 0
  - tcp: refactor tcp_retransmit_timer()
  - tcp: fix incorrect undo caused by DSACK of TLP retransmit
  - staging: gdm724x: fix use after free in gdm_lte_rx()
  - !10137  NFSD: Fix ia_size underflow
  - !10183 v3  ima: Fix use-after-free on a dentry's dname.name
  - !10121  usb: f_fs: Fix use-after-free for epfile
  - !10016  drm/exynos/vidi: fix memory leak in .get_modes()
  - !10211  fix CVE-2022-48865
  - !10206  gianfar: ethtool: Fix refcount leak in gfar_get_ts_info
  - tipc: fix kernel panic when enabling bearer
  - tipc: fix NULL pointer dereference in tipc_disc_rcv()
  - gianfar: ethtool: Fix refcount leak in gfar_get_ts_info
  - !10186  vsock: remove vsock from connected table when connect is interrupted by a signal
  - !10190  Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj
  - Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj
  - vsock: remove vsock from connected table when connect is interrupted by a signal
  - !10141  vt_ioctl: fix array_index_nospec in vt_setactivate
  - ima: Fix use-after-free on a dentry's dname.name
  - !10152  wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - !10026  liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - !10147  CVE-2022-48836
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - Input: aiptek - properly check endpoint type
  - Input: aiptek - fix endpoint sanity check
  - vt_ioctl: fix array_index_nospec in vt_setactivate
  - !10095  CVE-2024-40968
  - !10130  wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - NFSD: Fix ia_size underflow
  - !10123  CVE-2022-48838
  - !10122  wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - !10081  drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - !10092  usb: host: ohci-tmio: check return value after calling platform_get_resource()
  - nvme-rdma: fix possible use-after-free in transport error_recovery work
  - usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - usb: f_fs: Fix use-after-free for epfile
  - !10094  net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
  - ftrace: Fix use-after-free for dynamic ftrace_ops
  - !10054  vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - MIPS: Octeon: Add PCIe link status check
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
  - usb: host: ohci-tmio: check return value after calling platform_get_resource()
  - !10033  ipv6: prevent possible NULL dereference in rt6_probe()
  - drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - !9996  netpoll: Fix race condition in netpoll_owner_active
  - !9948  ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
  - vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - ipv6: prevent possible NULL dereference in rt6_probe()
  - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - drm/exynos/vidi: fix memory leak in .get_modes()
  - netpoll: Fix race condition in netpoll_owner_active
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
  - powerpc/pseries: Enforce hcall result buffer validity and size


author: chenyi <chenyi211@huawei.com> - 4.19.90-2408.1.0.0288
changelog:
  - !10327  NFC: port100: fix use-after-free in port100_send_complete
  - !10325  kobject: Fix global-out-of-bounds in kobject_action_type()
  - !10337  drm/radeon: fix UBSAN warning in kv_dpm.c
  - !10368 v2  jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
  - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
  - !10227  MIPS: smp: fill in sibling and core maps earlier
  - drm/radeon: fix UBSAN warning in kv_dpm.c
  - !10324  BMA: Fix iBMA bug and change
  - NFC: port100: fix use-after-free in port100_send_complete
  - kobject: Fix global-out-of-bounds in kobject_action_type()
  - !10315  jfs: xattr: fix buffer overflow for invalid xattr
  - BMA/cdev_veth_drv: Fix softlockup problem
  - BMA/kbox_drv: Change the version number.
  - BMA/veth_drv: Fix soft interrupt loops and change the version number
  - BMA/cdev_drv: Change the version number.
  - BMA/edma_drv: Fix DMA reset problem and change the version number.
  - !10173  netrom: Fix a memory leak in nr_heartbeat_expiry()
  - !10249  fbdev: savage: Handle err return when savagefb_check_var failed
  - !10306  mISDN: Fix memory leak in dsp_pipeline_build()
  - jfs: xattr: fix buffer overflow for invalid xattr
  - !10198  scsi: qedi: Fix crash while reading debugfs attribute
  - !10310  batman-adv: bypass empty buckets in batadv_purge_orig_ref()
  - !10307  wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
  - !10296  Backport dvb-usb bugfix
  - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
  - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
  - mISDN: Fix memory leak in dsp_pipeline_build()
  - media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
  - USB: move snd_usb_pipe_sanity_check into the USB core
  - fbdev: savage: Handle err return when savagefb_check_var failed
  - MIPS: smp: fill in sibling and core maps earlier
  - scsi: qedi: Fix crash while reading debugfs attribute
  - netrom: Fix a memory leak in nr_heartbeat_expiry()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2408.2.0.0289
changelog:
  - !10629 v2  hfsplus: fix uninit-value in copy_name
  - !10723  net/iucv: Avoid explicit cpumask var allocation on stack
  - !10646  net: dsa: mv88e6xxx: Correct check for empty list
  - !10609  wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
  - !10608  CVE-2024-41044
  - net/iucv: Avoid explicit cpumask var allocation on stack
  - !10693  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  - !10571  ila: block BH in ila_output()
  - !10593  fix CVE-2024-41046
  - !10521  xfs: add bounds checking to xlog_recover_process_data
  - !10597  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  - !10562  nilfs2: add missing check for inode numbers on directory entries
  - !10706  jfs: don't walk off the end of ealist
  - !10699  drm/amd/display: Skip finding free audio for unknown engine_id
  - !10672  inet_diag: Initialize pad field in struct inet_diag_req_v2
  - !10684  ocfs2: fix DIO failure due to insufficient transaction credits
  - !10565  gpio: davinci: Validate the obtained number of IRQs
  - !10389  pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
  - jfs: don't walk off the end of ealist
  - drm/amd/display: Skip finding free audio for unknown engine_id
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  - ocfs2: fix DIO failure due to insufficient transaction credits
  - inet_diag: Initialize pad field in struct inet_diag_req_v2
  - !10641  usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  - !10601  IB/core: Implement a limit on UMAD receive List
  - net: dsa: mv88e6xxx: Correct check for empty list
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  - hfsplus: fix uninit-value in copy_name
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
  - ppp: reject claimed-as-LCP but actually malformed packets
  - ppp: ensure minimum packet size in ppp_write()
  - IB/core: Implement a limit on UMAD receive List
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  - net: ethernet: lantiq_etop: fix double free in detach
  - net: lantiq_etop: add blank line after declaration
  - !10320  thermal: Fix NULL pointer dereferences in of_thermal_ functions
  - !10529  Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
  - ila: block BH in ila_output()
  - gpio: davinci: Validate the obtained number of IRQs
  - nilfs2: add missing check for inode numbers on directory entries
  - !10471  ALSA: emux: improve patch ioctl data validation
  - !10479  jffs2: Fix potential illegal address access in jffs2_free_inode
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
  - xfs: add bounds checking to xlog_recover_process_data
  - !10386  filelock: Fix fcntl/close race recovery compat path
  - !10485  fix CVE-2024-42086
  - !10492  drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - !10400  Fix CVE-2024-41069
  - !10270  HID: core: remove unnecessary WARN_ON() in implement()
  - !10472 v2  xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
  - !10359 v2  PCI/ROM: Fix PCI ROM header check bug
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - iio: chemical: bme680: Fix overflows in compensate() functions
  - jffs2: Fix potential illegal address access in jffs2_free_inode
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
  - ALSA: emux: improve patch ioctl data validation
  - !10341  net/sched: initialize noop_qdisc owner
  - ASoC: topology: Fix route memory corruption
  - ASoC: topology: Fix references to freed memory
  - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
  - filelock: Fix fcntl/close race recovery compat path
  - PCI/ROM: Fix PCI ROM header check bug
  - net/sched: initialize noop_qdisc owner
  - thermal: Fix NULL pointer dereferences in of_thermal_ functions
  - HID: core: remove unnecessary WARN_ON() in implement()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2408.3.0.0290
changelog:
  - !10895  drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - !10897 v2  orangefs: fix out-of-bounds fsid access
  - !10858 v4  powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - orangefs: fix out-of-bounds fsid access
  - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - !10891  CVE-2024-42105
  - nilfs2: fix inode number range checks
  - !10871  USB: serial: mos7840: fix crash on resume
  - !10643  USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  - USB: serial: mos7840: fix crash on resume
  - !10865  Revert "NFS: Don't interrupt file writeout due to fatal errors"
  - !10825  Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
  - Revert "NFS: Don't interrupt file writeout due to fatal errors"
  - !10730  filelock: Remove locks reliably when fcntl/close race is detected
  - powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - !10802  media: dvb-frontends: tda10048: Fix integer overflow
  - !10703  x86: stop playing stack games in profile_pc()
  - !10838  bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
  - !10806  tcp_metrics: validate source addr length
  - !10803  s390/pkey: Wipe sensitive data on failure
  - !10786  CVE-2024-41034
  - tcp_metrics: validate source addr length
  - s390/pkey: Wipe sensitive data on failure
  - !10700  ethernet: Fix error handling in xemaclite_of_probe
  - !10777  Fix CVE-2024-42160
  - media: dvb-frontends: tda10048: Fix integer overflow
  - !10532  ftruncate: pass a signed offset
  - !10623  ata: libata-core: Fix double free on error
  - !10664 v2  ASoC: fsl-asoc-card: set priv->pdev before using it
  - nilfs2: fix kernel bug on rename operation of broken directory
  - nilfs2: return the mapped address from nilfs_get_page()
  - nilfs2: Remove check for PageError
  - f2fs: Add inline to f2fs_build_fault_attr() stub
  - f2fs: check validation of fault attrs in f2fs_build_fault_attr()
  - filelock: Remove locks reliably when fcntl/close race is detected
  - x86: stop playing stack games in profile_pc()
  - ethernet: Fix error handling in xemaclite_of_probe
  - ASoC: fsl-asoc-card: set priv->pdev before using it
  - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  - ata: libata-core: Fix double free on error
  - ftruncate: pass a signed offset


author: chenyi <chenyi211@huawei.com> - 4.19.90-2408.4.0.0291
changelog:
  - !10978  CVE-2024-42304
  - !10946  drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
  - !10957  bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
  - ext4: make sure the first directory block is not a hole
  - ext4: check dot and dotdot of dx_root before making dir indexed
  - !10954  leds: trigger: Unregister sysfs attributes before calling deactivate()
  - bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
  - !10930  libceph: fix race between delayed_work() and ceph_monc_stop()
  - leds: trigger: Unregister sysfs attributes before calling deactivate()
  - drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
  - libceph: fix race between delayed_work() and ceph_monc_stop()
  - !10841  ALSA: gus: fix null pointer dereference on pointer block
  - !10913  sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
  - !10915  usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
  - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
  - sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
  - !10894 v2  netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
  - !10892  crypto: aead,cipher - zeroize key buffer after use
  - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
  - crypto: aead,cipher - zeroize key buffer after use
  - ALSA: gus: fix null pointer dereference on pointer block


author: chenyi <chenyi211@huawei.com> - 4.19.90-2408.5.0.0292
changelog:
  - !11130  iio: adc: men_z188_adc: Fix a resource leak in an error handling path
  - !11132  KVM: x86/mmu: make apf token non-zero to fix bug
  - !11192  af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
  - af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
  - !11150  protect the fetch of ->fd[fd
  - !11117  net/iucv: fix use after free in iucv_sock_close()
  - !11122  fix CVE-2023-52893
  - !11089  f2fs: fix to don't dirty inode for readonly filesystem
  - !11078  nilfs2: fix general protection fault in nilfs_btree_insert()
  - !11047  filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions
  - !11095  exec: Fix ToCToU between perm check and set-uid/gid usage
  - KVM: x86/mmu: make apf token non-zero to fix bug
  - iio: adc: men_z188_adc: Fix a resource leak in an error handling path
  - !11121  scsi: qla2xxx: During vport delete send async logout explicitly
  - !11113  mISDN: Fix a use after free in hfcmulti_tx()
  - gsmi: fix null-deref in gsmi_get_variable
  - scsi: qla2xxx: During vport delete send async logout explicitly
  - net/iucv: fix use after free in iucv_sock_close()
  - !11074  wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
  - mISDN: Fix a use after free in hfcmulti_tx()
  - !11072  drm/virtio: Fix GEM handle creation UAF
  - exec: Fix ToCToU between perm check and set-uid/gid usage
  - !11086  thermal: int340x: fix memory leak in int3400_notify()
  - f2fs: fix to don't dirty inode for readonly filesystem
  - thermal: int340x: fix memory leak in int3400_notify()
  - !11061  Fix CVE-2023-52898
  - nilfs2: fix general protection fault in nilfs_btree_insert()
  - !11068  Fix CVE-2024-39501
  - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
  - drm/virtio: Fix GEM handle creation UAF
  - !11060  parisc: Fix data TLB miss in sba_unmap_sg
  - !11065  i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
  - !11062  ocfs2: add bounds checking to ocfs2_check_dir_entry()
  - driver core: Fix uevent_show() vs driver detach race
  - selftests: forwarding: devlink_lib: Wait for udev events after reloading
  - drivers: core: synchronize really_probe() and dev_uevent()
  - !10992  media: venus: fix use after free in vdec_close
  - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
  - ocfs2: add bounds checking to ocfs2_check_dir_entry()
  - !11001  tipc: Return non-zero value from tipc_udp_addr2str() on error
  - !10987  RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
  - xhci: Fix null pointer dereference when host dies
  - xhci: avoid race between disable slot command and host runtime suspend
  - parisc: Fix data TLB miss in sba_unmap_sg
  - filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64
  - !11037  s390/sclp: Fix sclp_init() cleanup on failure
  - !11021  net: usb: qmi_wwan: fix memory leak for not ip packets
  - s390/sclp: Fix sclp_init() cleanup on failure
  - net: usb: qmi_wwan: fix memory leak for not ip packets
  - !10966  perf: Optimize perf_pmu_migrate_context()
  - tipc: Return non-zero value from tipc_udp_addr2str() on error
  - media: venus: fix use after free in vdec_close
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
  - perf: Optimize perf_pmu_migrate_context()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2409.1.0.0293
changelog:
  - !11383  perf/core: Fix missing wakeup when waiting for context reference
  - !11384  fs/proc: fix softlockup in __read_vmcore
  - !11351  regulator: da9211: Use irq handler when ready
  - !11364  hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - fs/proc: fix softlockup in __read_vmcore
  - perf/core: Fix missing wakeup when waiting for context reference
  - !11242  CVE-2024-43892
  - !11301  ext4: remove the redundant folio_wait_stable()
  - hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - !11333  jbd2: avoid mount failed when commit block is partial submitted
  - !11345  netfilter: ctnetlink: use helper function to calculate expect ID
  - regulator: da9211: Use irq handler when ready
  - !11220  io_uring: add a schedule point in io_add_buffers()
  - netfilter: ctnetlink: use helper function to calculate expect ID
  - jbd2: avoid mount failed when commit block is partial submitted
  - !11290  Add exception protection processing for vd in axi_chan_handle_err function
  - !11258  net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()
  - !11215  Fix CVE-2024-40901
  - !11186  Backport bugfix for AMD SMN
  - !11265  mtd: rawnand: hynix: fixed typo
  - !11264  media: xc2028: avoid use-after-free in load_firmware_cb()
  - !11234  efi: fix NULL-deref in init error path
  - ext4: remove the redundant folio_wait_stable()
  - !11266  serial: core: check uartclk for zero to avoid divide by zero
  - Add exception protection processing for vd in axi_chan_handle_err function
  - !11216  scsi: qla2xxx: validate nvme_local_port correctly
  - !11254  mm: avoid overflows in dirty throttling logic
  - serial: core: check uartclk for zero to avoid divide by zero
  - !11189  tcp: fix race in tcp_v6_syn_recv_sock()
  - mtd: rawnand: hynix: fixed typo
  - media: xc2028: avoid use-after-free in load_firmware_cb()
  - !11154  xen/netfront: destroy queues before real_num_tx_queues is zeroed
  - !11259  ACPI: processor_idle: Fix invalid comparison with insertion sort for latency
  - !11260  ACPI: EC: Abort address space access upon error
  - !11261  ACPI: EC: Avoid returning AE_OK on errors in address space handler
  - !11114  sysctl: always initialize i_uid/i_gid
  - !11167  f2fs: let's avoid panic if extent_tree is not created
  - ACPI: EC: Avoid returning AE_OK on errors in address space handler
  - ACPI: EC: Abort address space access upon error
  - ACPI: processor_idle: Fix invalid comparison with insertion sort for latency
  - net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()
  - mm: avoid overflows in dirty throttling logic
  - !11164  usb: vhci-hcd: Do not drop references before new references are gained
  - !11173  tracing: Fix overflow in get_free_elt()
  - memcg: protect concurrent access to mem_cgroup_idr
  - efi: fix NULL-deref in init error path
  - !11185  kobject_uevent: Fix OOB access within zap_modalias_env()
  - !11178  irqchip/alpine-msi: Fix off-by-one in allocation error path
  - io_uring: add a schedule point in io_add_buffers()
  - scsi: qla2xxx: validate nvme_local_port correctly
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
  - scsi: mpt3sas: Gracefully handle online firmware update
  - scsi: mpt3sas: Add ioc_<level> logging macros
  - scsi: mpt3sas: Fix error return code of mpt3sas_base_attach()
  - !11193  net/ipv6: Fix the RT cache flush via sysctl using a previous delay
  - !11209  LTS patches round
  - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
  - net: tcp better handling of reordering then loss cases
  - tcp: tcp_mark_head_lost is only valid for sack-tcp
  - tcp: add ece_ack flag to reno sack functions
  - net/ipv6: Fix the RT cache flush via sysctl using a previous delay
  - tcp: fix race in tcp_v6_syn_recv_sock()
  - x86/amd_nb: Check for invalid SMN reads
  - PCI: Add PCI_ERROR_RESPONSE and related definitions
  - kobject_uevent: Fix OOB access within zap_modalias_env()
  - irqchip/alpine-msi: Fix off-by-one in allocation error path
  - tracing: Fix overflow in get_free_elt()
  - f2fs: let's avoid panic if extent_tree is not created
  - usb: vhci-hcd: Do not drop references before new references are gained
  - xen/netfront: destroy queues before real_num_tx_queues is zeroed
  - sysctl: always initialize i_uid/i_gid


author: yexiao<yexiao7@huawei.com> - 202002-17
changelog:
  - fix CVE-2023-0464、CVE-2023-0465、CVE-2023-0466、CVE-2023-2650、CVE-2023-3446、CVE-2023-3817、CVE-2024-0727


author: yexiao<yexiao7@huawei.com> - 202002-19
changelog:
  - fix CVE-2023-45229、CVE-2023-45230、CVE-2023-45231、CVE-2023-45232、CVE-2023-45233、CVE-2023-45234、CVE-2023-45235


author: Jiabo Feng<fengjiabo1@huawei.com> - 202002-21
changelog:
  - update release. commit(2723c0159f0f84e2169b124dca9f4eb0dc6863f9) has been merged into commit(a8c3711f01ae9a152f0e8cede2547b4c54712400)


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-50
changelog:
  - cleancode: rename gazelle files in lwip
  - add .gitignore
  - cleancode: improving makefile readability


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-51
changelog:
  - cleancode: refactor sys_now and lwip_ioctl
  - add sem post when update event
  - cleancode: refactor lwipgz_hlist.h
  - fix EPOLLIN event dropd
  - cleancode: refactor lwipgz_list.h
  - cleancode: refactor posix_api
  - fix some error of NULL pointer
  - cleancode: refactor posix type and get_socket
  - cleancode: refactor lwipsock.h


author: yangchen555 <yangchen145@huawei.com> - 1.0.2-52
changelog:
  - fix redis coredump when hugetlbs pagesize is 1024M
  - vitio_user: modify mbuf index for bond4
  - Check the return of lwip_init
  - support kernel connect
  - POSIX: fix select timeout disable and build failed in openEuler 2003


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-53
changelog:
  - virtio_user: modify mbuf index for bond4
  - fix issue: create virtio_user based on bond4 main network card
  - virtio: fix dfx error with multiple cpus
  - dfx: optimize gazellectl -x for bond


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-54
changelog:
  - refector fill udp sendring
  - virtio_user: solve the issue that failed to bind virtio_user's IPv6 address
  - virtio_user: add vlan info for kernerl packets when vlan switch is on
  - WRAP:fix double connect lead posix api disable


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-55
changelog:
  - virtio: mod virtio_user_name when multi process is on
  - WRAP: fix bind log error
  - WRAP:fix ltran mode did not bind kernel while open kni
  - virtio_user: The program establishes a network connection when network card status is up
  - fix redis coredump ctrl-c during the pressure test


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-59
changelog:
  - epoll: fix wild pointer detected by cooddy
  - tools: fix sync patch script date wrong and update the way get patchnum
  - cfg: modify maximum tcp_conn_count to 2w
  - fix mbuf_total calculation error


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-21
changelog:
  - Type:CVE
  - ID:CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237
  - SUG:NA
  - DESC:fix CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237


