# changelog

author: yexiao<yexiao7@huawei.com> - 202002-17
changelog:
  - fix CVE-2023-0464、CVE-2023-0465、CVE-2023-0466、CVE-2023-2650、CVE-2023-3446、CVE-2023-3817、CVE-2024-0727


author: yexiao<yexiao7@huawei.com> - 202002-19
changelog:
  - fix CVE-2023-45229、CVE-2023-45230、CVE-2023-45231、CVE-2023-45232、CVE-2023-45233、CVE-2023-45234、CVE-2023-45235


author: Jiabo Feng<fengjiabo1@huawei.com> - 202002-21
changelog:
  - update release. commit(2723c0159f0f84e2169b124dca9f4eb0dc6863f9) has been merged into commit(a8c3711f01ae9a152f0e8cede2547b4c54712400)


author: yinbin6 <jiangheng14@huawei.com> - 1.0.2-64
changelog:
  - cleancode: declare different cfg_params types
  - cleancode: add rpc_async_call, remove rpc_msg_arg.socklen, fix some format
  - cleancode: move some API from stack to rpc and rtw
  - cleancode: refactor rtc_api rtw_api and dummy_api


author: yinbin6 <jiangheng14@huawei.com> - 1.0.2-66
changelog:
  - af_xdp: set rlimit unlimit when gazelle init
  - add interrupt mode support
  - add pingpong dfx support


author: yinbin6 <jiangheng14@huawei.com> - 1.0.2-67
changelog:
  - bugfix: fix gazelle init failed while setup by non-root user
  - rpc: fix rpc_sync_call spinlock block when msg be recalled
  - rtw: fix send length exceeding send_ring_size
  - fix stack null when register interrupt


author: chenyi <chenyi211@huawei.com> - 4.19.90-2408.3.0.0290
changelog:
  - !10895  drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - !10897 v2  orangefs: fix out-of-bounds fsid access
  - !10858 v4  powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - orangefs: fix out-of-bounds fsid access
  - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - !10891  CVE-2024-42105
  - nilfs2: fix inode number range checks
  - !10871  USB: serial: mos7840: fix crash on resume
  - !10643  USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  - USB: serial: mos7840: fix crash on resume
  - !10865  Revert "NFS: Don't interrupt file writeout due to fatal errors"
  - !10825  Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
  - Revert "NFS: Don't interrupt file writeout due to fatal errors"
  - !10730  filelock: Remove locks reliably when fcntl/close race is detected
  - powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - !10802  media: dvb-frontends: tda10048: Fix integer overflow
  - !10703  x86: stop playing stack games in profile_pc()
  - !10838  bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
  - !10806  tcp_metrics: validate source addr length
  - !10803  s390/pkey: Wipe sensitive data on failure
  - !10786  CVE-2024-41034
  - tcp_metrics: validate source addr length
  - s390/pkey: Wipe sensitive data on failure
  - !10700  ethernet: Fix error handling in xemaclite_of_probe
  - !10777  Fix CVE-2024-42160
  - media: dvb-frontends: tda10048: Fix integer overflow
  - !10532  ftruncate: pass a signed offset
  - !10623  ata: libata-core: Fix double free on error
  - !10664 v2  ASoC: fsl-asoc-card: set priv->pdev before using it
  - nilfs2: fix kernel bug on rename operation of broken directory
  - nilfs2: return the mapped address from nilfs_get_page()
  - nilfs2: Remove check for PageError
  - f2fs: Add inline to f2fs_build_fault_attr() stub
  - f2fs: check validation of fault attrs in f2fs_build_fault_attr()
  - filelock: Remove locks reliably when fcntl/close race is detected
  - x86: stop playing stack games in profile_pc()
  - ethernet: Fix error handling in xemaclite_of_probe
  - ASoC: fsl-asoc-card: set priv->pdev before using it
  - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  - ata: libata-core: Fix double free on error
  - ftruncate: pass a signed offset


author: chenyi <chenyi211@huawei.com> - 4.19.90-2408.4.0.0291
changelog:
  - !10978  CVE-2024-42304
  - !10946  drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
  - !10957  bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
  - ext4: make sure the first directory block is not a hole
  - ext4: check dot and dotdot of dx_root before making dir indexed
  - !10954  leds: trigger: Unregister sysfs attributes before calling deactivate()
  - bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
  - !10930  libceph: fix race between delayed_work() and ceph_monc_stop()
  - leds: trigger: Unregister sysfs attributes before calling deactivate()
  - drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
  - libceph: fix race between delayed_work() and ceph_monc_stop()
  - !10841  ALSA: gus: fix null pointer dereference on pointer block
  - !10913  sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
  - !10915  usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
  - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
  - sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
  - !10894 v2  netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
  - !10892  crypto: aead,cipher - zeroize key buffer after use
  - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
  - crypto: aead,cipher - zeroize key buffer after use
  - ALSA: gus: fix null pointer dereference on pointer block


author: chenyi <chenyi211@huawei.com> - 4.19.90-2408.5.0.0292
changelog:
  - !11130  iio: adc: men_z188_adc: Fix a resource leak in an error handling path
  - !11132  KVM: x86/mmu: make apf token non-zero to fix bug
  - !11192  af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
  - af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
  - !11150  protect the fetch of ->fd[fd
  - !11117  net/iucv: fix use after free in iucv_sock_close()
  - !11122  fix CVE-2023-52893
  - !11089  f2fs: fix to don't dirty inode for readonly filesystem
  - !11078  nilfs2: fix general protection fault in nilfs_btree_insert()
  - !11047  filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions
  - !11095  exec: Fix ToCToU between perm check and set-uid/gid usage
  - KVM: x86/mmu: make apf token non-zero to fix bug
  - iio: adc: men_z188_adc: Fix a resource leak in an error handling path
  - !11121  scsi: qla2xxx: During vport delete send async logout explicitly
  - !11113  mISDN: Fix a use after free in hfcmulti_tx()
  - gsmi: fix null-deref in gsmi_get_variable
  - scsi: qla2xxx: During vport delete send async logout explicitly
  - net/iucv: fix use after free in iucv_sock_close()
  - !11074  wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
  - mISDN: Fix a use after free in hfcmulti_tx()
  - !11072  drm/virtio: Fix GEM handle creation UAF
  - exec: Fix ToCToU between perm check and set-uid/gid usage
  - !11086  thermal: int340x: fix memory leak in int3400_notify()
  - f2fs: fix to don't dirty inode for readonly filesystem
  - thermal: int340x: fix memory leak in int3400_notify()
  - !11061  Fix CVE-2023-52898
  - nilfs2: fix general protection fault in nilfs_btree_insert()
  - !11068  Fix CVE-2024-39501
  - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
  - drm/virtio: Fix GEM handle creation UAF
  - !11060  parisc: Fix data TLB miss in sba_unmap_sg
  - !11065  i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
  - !11062  ocfs2: add bounds checking to ocfs2_check_dir_entry()
  - driver core: Fix uevent_show() vs driver detach race
  - selftests: forwarding: devlink_lib: Wait for udev events after reloading
  - drivers: core: synchronize really_probe() and dev_uevent()
  - !10992  media: venus: fix use after free in vdec_close
  - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
  - ocfs2: add bounds checking to ocfs2_check_dir_entry()
  - !11001  tipc: Return non-zero value from tipc_udp_addr2str() on error
  - !10987  RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
  - xhci: Fix null pointer dereference when host dies
  - xhci: avoid race between disable slot command and host runtime suspend
  - parisc: Fix data TLB miss in sba_unmap_sg
  - filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64
  - !11037  s390/sclp: Fix sclp_init() cleanup on failure
  - !11021  net: usb: qmi_wwan: fix memory leak for not ip packets
  - s390/sclp: Fix sclp_init() cleanup on failure
  - net: usb: qmi_wwan: fix memory leak for not ip packets
  - !10966  perf: Optimize perf_pmu_migrate_context()
  - tipc: Return non-zero value from tipc_udp_addr2str() on error
  - media: venus: fix use after free in vdec_close
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
  - perf: Optimize perf_pmu_migrate_context()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2409.1.0.0293
changelog:
  - !11383  perf/core: Fix missing wakeup when waiting for context reference
  - !11384  fs/proc: fix softlockup in __read_vmcore
  - !11351  regulator: da9211: Use irq handler when ready
  - !11364  hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - fs/proc: fix softlockup in __read_vmcore
  - perf/core: Fix missing wakeup when waiting for context reference
  - !11242  CVE-2024-43892
  - !11301  ext4: remove the redundant folio_wait_stable()
  - hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - !11333  jbd2: avoid mount failed when commit block is partial submitted
  - !11345  netfilter: ctnetlink: use helper function to calculate expect ID
  - regulator: da9211: Use irq handler when ready
  - !11220  io_uring: add a schedule point in io_add_buffers()
  - netfilter: ctnetlink: use helper function to calculate expect ID
  - jbd2: avoid mount failed when commit block is partial submitted
  - !11290  Add exception protection processing for vd in axi_chan_handle_err function
  - !11258  net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()
  - !11215  Fix CVE-2024-40901
  - !11186  Backport bugfix for AMD SMN
  - !11265  mtd: rawnand: hynix: fixed typo
  - !11264  media: xc2028: avoid use-after-free in load_firmware_cb()
  - !11234  efi: fix NULL-deref in init error path
  - ext4: remove the redundant folio_wait_stable()
  - !11266  serial: core: check uartclk for zero to avoid divide by zero
  - Add exception protection processing for vd in axi_chan_handle_err function
  - !11216  scsi: qla2xxx: validate nvme_local_port correctly
  - !11254  mm: avoid overflows in dirty throttling logic
  - serial: core: check uartclk for zero to avoid divide by zero
  - !11189  tcp: fix race in tcp_v6_syn_recv_sock()
  - mtd: rawnand: hynix: fixed typo
  - media: xc2028: avoid use-after-free in load_firmware_cb()
  - !11154  xen/netfront: destroy queues before real_num_tx_queues is zeroed
  - !11259  ACPI: processor_idle: Fix invalid comparison with insertion sort for latency
  - !11260  ACPI: EC: Abort address space access upon error
  - !11261  ACPI: EC: Avoid returning AE_OK on errors in address space handler
  - !11114  sysctl: always initialize i_uid/i_gid
  - !11167  f2fs: let's avoid panic if extent_tree is not created
  - ACPI: EC: Avoid returning AE_OK on errors in address space handler
  - ACPI: EC: Abort address space access upon error
  - ACPI: processor_idle: Fix invalid comparison with insertion sort for latency
  - net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()
  - mm: avoid overflows in dirty throttling logic
  - !11164  usb: vhci-hcd: Do not drop references before new references are gained
  - !11173  tracing: Fix overflow in get_free_elt()
  - memcg: protect concurrent access to mem_cgroup_idr
  - efi: fix NULL-deref in init error path
  - !11185  kobject_uevent: Fix OOB access within zap_modalias_env()
  - !11178  irqchip/alpine-msi: Fix off-by-one in allocation error path
  - io_uring: add a schedule point in io_add_buffers()
  - scsi: qla2xxx: validate nvme_local_port correctly
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
  - scsi: mpt3sas: Gracefully handle online firmware update
  - scsi: mpt3sas: Add ioc_<level> logging macros
  - scsi: mpt3sas: Fix error return code of mpt3sas_base_attach()
  - !11193  net/ipv6: Fix the RT cache flush via sysctl using a previous delay
  - !11209  LTS patches round
  - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
  - net: tcp better handling of reordering then loss cases
  - tcp: tcp_mark_head_lost is only valid for sack-tcp
  - tcp: add ece_ack flag to reno sack functions
  - net/ipv6: Fix the RT cache flush via sysctl using a previous delay
  - tcp: fix race in tcp_v6_syn_recv_sock()
  - x86/amd_nb: Check for invalid SMN reads
  - PCI: Add PCI_ERROR_RESPONSE and related definitions
  - kobject_uevent: Fix OOB access within zap_modalias_env()
  - irqchip/alpine-msi: Fix off-by-one in allocation error path
  - tracing: Fix overflow in get_free_elt()
  - f2fs: let's avoid panic if extent_tree is not created
  - usb: vhci-hcd: Do not drop references before new references are gained
  - xen/netfront: destroy queues before real_num_tx_queues is zeroed
  - sysctl: always initialize i_uid/i_gid


author: chenyi <chenyi211@huawei.com> - 4.19.90-2409.3.0.0294
changelog:
  - !11434 v3  cifs: Fix pages leak when cifs_writedata allocate fails in cifs_writedata_direct_alloc()
  - cifs: Fix pages leak when cifs_writedata allocate fails in cifs_writedata_direct_alloc()
  - !11418  md/raid5: avoid BUG_ON() while continue reshape after reassembling
  - !11426  nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
  - nfc: pn533: initialize struct pn533_out_arg properly
  - nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
  - !11404  usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
  - !11406  net: hns3: do not allow call hns3_nic_net_open repeatedly
  - md/raid5: avoid BUG_ON() while continue reshape after reassembling
  - !11177  dma: fix call order in dmam_free_coherent
  - !11387  usb: gadget: rndis: add spinlock for rndis response list
  - !8301  tty: fix hang on tty device with no_room set
  - !7809  net-memcg: Fix scope of sockmem pressure indicators
  - net: hns3: do not allow call hns3_nic_net_open repeatedly
  - !11386 v5  support block hierarchy stats
  - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
  - !11349  jfs: Fix array-index-out-of-bounds in diFree
  - !11350  devres: Fix memory leakage caused by driver API devm_free_percpu()
  - !11378  drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
  - !11370  nilfs2: handle inconsistent state in nilfs_btnode_create_block()
  - !11367  ibmvnic: free reset-work-item when flushing
  - !11388  dev/parport: fix the array out-of-bounds risk
  - dev/parport: fix the array out-of-bounds risk
  - usb: gadget: rndis: add spinlock for rndis response list
  - blk-io-hierarchy: support new stage for bio lifetime
  - blk-io-hierarchy: support new rq based stage rq_driver
  - blk-io-hierarchy: support new rq based stage requeue
  - blk-io-hierarchy: support new rq based stage hctx
  - blk-io-hierarchy: support new rq based stage kyber
  - blk-io-hierarchy: support new rq based stage bfq
  - blk-io-hierarchy: support new rq based stage mq-deadline
  - blk-io-hierarchy: support new rq based stage plug
  - blk-io-hierarchy: support new bio based stage gettag
  - blk-mq: remove blk_mq_put_ctx()
  - blk-io-hierarchy: support new bio based stage blk-wbt
  - blk-io-hierarchy: support new bio based stage blk-throtl
  - blk-io-hierarchy: support to recored the number of slow IO
  - block-io-hierarchy: core hierarchy iodump implementation
  - block-io-hierarchy: core hierarchy stats implementation
  - block: support to record when request is completed
  - blk-mq-debugfs: factor out a new helper to show allocated request
  - block: block: fix kabi broken for struct blk_mq_alloc_data
  - block: support to recored bio allocation task in request
  - block: fix kabi broken for struct request
  - block: support to recored bio allocation time in request
  - block: support to recored bio allocation task
  - block: support to recored bio allocation time
  - block: fix kabi broken in struct blk_plug
  - block: fix that blk_time_get_ns() doesn't update time after schedule
  - block: limit block time caching to in_task() context
  - block: update cached timestamp post schedule/preemption
  - block: cache current nsec time in struct blk_plug
  - block: add blk_time_get_ns() and blk_time_get() helpers
  - blk-mq: export blk-mq-debugfs apis
  - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
  - nilfs2: handle inconsistent state in nilfs_btnode_create_block()
  - ibmvnic: free reset-work-item when flushing
  - devres: Fix memory leakage caused by driver API devm_free_percpu()
  - jfs: Fix array-index-out-of-bounds in diFree
  - dma: fix call order in dmam_free_coherent
  - tty: fix hang on tty device with no_room set
  - net-memcg: Fix scope of sockmem pressure indicators


author: chenyi <chenyi211@huawei.com> - 4.19.90-2409.4.0.0295
changelog:
  - !11557  xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
  - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
  - !11520  ipv6: prevent UAF in ip6_send_skb()
  - !11532 v2  Fix CVE-2023-52915
  - media: dvb-usb-v2: af9035: fix missing unlock
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
  - !11525 v2  usb: gadget: core: Check for unset descriptor
  - usb: gadget: core: Check for unset descriptor
  - !11512  x86/mtrr: Check if fixed MTRRs exist before saving them
  - ipv6: prevent UAF in ip6_send_skb()
  - x86/mtrr: Check if fixed MTRRs exist before saving them


author: chenyi <chenyi211@huawei.com> - 4.19.90-2409.6.0.0297
changelog:
  - !11816 v3  tools: fix implicit declaration of function __ALIGN_KERNEL
  - tools: fix implicit declaration of function __ALIGN_KERNEL
  - !11786  LTS patch backport
  - !11759  sch/netem: fix use after free in netem_dequeue
  - arm64: cpufeature: Fix the visibility of compat hwcaps
  - arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space
  - irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
  - irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
  - irqchip/mbigen: Fix mbigen node address layout
  - !11737  hwmon: (adc128d818) Fix underflows seen when writing limit attributes
  - !11692  fix CVE-2024-46723
  - !11695  wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
  - !11734  Input: MT - limit max slots
  - sch/netem: fix use after free in netem_dequeue
  - !11722  Squashfs: sanity check symbolic link size
  - !11697  Fix iBMA bug and change version
  - !11700  x86/mm: Fix pti_clone_pgtable() alignment assumption
  - hwmon: (adc128d818) Fix underflows seen when writing limit attributes
  - Input: MT - limit max slots
  - Squashfs: sanity check symbolic link size
  - x86/mm: Fix pti_clone_pgtable() alignment assumption
  - BMA: Fix edma driver initialization problem and change the version number.
  - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
  - !11671 v4  HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
  - drm/amdgpu: fix ucode out-of-bounds read warning
  - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
  - !11645  block: backport debugfs patches
  - !11544  Fix CVE-2024-45025
  - !11560  mm/ksm: fix possible UAF of stable_node
  - !11652  media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
  - media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
  - block: fix kabi broken in struct request_queue
  - block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex'
  - block: shutdown blktrace in blk_release_queue()
  - block: remove per-disk debugfs files in blk_unregister_queue
  - block: serialize all debugfs operations using q->debugfs_mutex
  - blk-mq: Fix spurious debugfs directory creation during initialization
  - block: create the request_queue debugfs_dir on registration
  - blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created
  - blk-mq: fix up placement of debugfs directory of queue files
  - blk-mq: no need to check return value of debugfs_create functions
  - blktrace: annotate required lock on do_blk_trace_setup()
  - blktrace: Avoid sparse warnings when assigning q->blk_trace
  - blktrace: break out of blktrace setup on concurrent calls
  - !11616  mmc: mmc_test: Fix NULL dereference on allocation failure
  - !11610  Input: uinput - reject requests with unreasonable number of slots
  - mmc: mmc_test: Fix NULL dereference on allocation failure
  - Input: uinput - reject requests with unreasonable number of slots
  - !11596  gtp: pull network headers in gtp_dev_xmit()
  - gtp: pull network headers in gtp_dev_xmit()
  - mm/ksm: fix possible UAF of stable_node
  - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
  - s390/cio: rename bitmap_size() -> idset_bitmap_size()
  - bitmap: introduce generic optimized bitmap_size()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2410.1.0.0298
changelog:
  - !12007  Fix CVE-2024-44958 for 4.19
  - !11785  perf/x86: Serialize set_attr_rdpmc()
  - sched/smt: Fix unbalance sched_smt_present dec/inc
  - sched/smt: Introduce sched_smt_present_inc/dec() helper
  - sched: Revert fix unbalance sched_smt_present dec/inc
  - !11918  dhugetlb: make spin_lock irq save
  - !11968  drm/amdgpu: fix mc_data out-of-bounds read warning
  - drm/amdgpu: fix mc_data out-of-bounds read warning
  - !11863  memcg_write_event_control(): fix a user-triggerable oops
  - !11921  hwmon: (lm95234) Fix underflows seen when writing limit attributes
  - !11924  nilfs2: protect references to superblock parameters exposed in sysfs
  - !11842  CVE-2024-46771
  - nilfs2: protect references to superblock parameters exposed in sysfs
  - hwmon: (lm95234) Fix underflows seen when writing limit attributes
  - dhugetlb: make free_huge_page_to_dhugetlb_pool irq safe
  - dhugetlb: avoid lockdep warning with spin_lock_nested
  - dhugetlb: Use helper function to lock/unlock
  - !11789  ALSA: line6: Fix racy access to midibuf
  - !11905  scsi: aacraid: Fix double-free on probe failure
  - !11888  pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  - !11855  VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  - scsi: aacraid: Fix double-free on probe failure
  - !11877  usb: dwc3: st: fix probed platform device ref count on probe error path
  - !11878  PCI: Add missing bridge lock to pci_bus_lock()
  - !11861  hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
  - !11803  CVE-2024-46781
  - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  - PCI: Add missing bridge lock to pci_bus_lock()
  - usb: dwc3: st: fix probed platform device ref count on probe error path
  - !11818  uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  - memcg_write_event_control(): fix a user-triggerable oops
  - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
  - !11703  binder: fix UAF caused by offsets overwrite
  - !11854  fix CVE-2024-46777 for 4.19
  - VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  - udf: Avoid excessive partition lengths
  - udf: Define EFSCORRUPTED error code
  - !11809  apparmor: fix possible NULL pointer dereference
  - !11777  blktrace: fix blktrace is disabled when CONFIG_BLK_DEBUG_FS is disabled
  - can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
  - can: bcm: Remove proc entry when dev is unregistered.
  - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  - apparmor: fix possible NULL pointer dereference
  - nilfs2: fix missing cleanup on rollforward recovery error
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
  - ALSA: line6: Fix racy access to midibuf
  - perf/x86: Serialize set_attr_rdpmc()
  - blktrace: fix blktrace is disabled when CONFIG_BLK_DEBUG_FS is disabled
  - binder: fix UAF caused by offsets overwrite


author: chenyi <chenyi211@huawei.com> - 4.19.90-2410.2.0.0299
changelog:
  - !8720  net: USB: Fix wrong-direction WARNING in plusb.c
  - !12116 [sync] PR-11856:  acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - !12071  btrfs: clean up our handling of refs == 0 in snapshot delete
  - !12069  platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - btrfs: clean up our handling of refs == 0 in snapshot delete
  - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - !12026  ASoC: meson: axg-card: fix 'use-after-free'
  - !12040  drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
  - !12012  rtmutex: Drop rt_mutex::wait_lock before scheduling
  - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
  - ASoC: meson: axg-card: fix 'use-after-free'
  - rtmutex: Drop rt_mutex::wait_lock before scheduling
  - net: USB: Fix wrong-direction WARNING in plusb.c


author: Jiabo Feng <fengjiabo1@huawei.com>
changelog:
  - accel/tcg: fix race in cpu_exec_step_atomic (bug 1863025)
  - pci: assert configuration access is within bounds
  - io: remove io watch if TLS channel is closed during handshake


author: Jiabo Feng <fengjiabo1@huawei.com>
changelog:
  - hw/scsi/lsi53c895a: add missing decrement of reentrancy counter
  - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330)
  - net: Update MemReentrancyGuard for NIC (CVE-2023-3019)
  - net: Provide MemReentrancyGuard * to qemu_new_nic()
  - memory: prevent dma-reentracy issues
  - softmmu/physmem: Introduce MemTxAttrs::memory field and MEMTX_ACCESS_ERROR
  - Fixed the early version of CVE-2022-4144 patch is not fully adapted


author: Jiabo Feng <fengjiabo1@huawei.com>
changelog:
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/virtio: Introduce virtio_bh_new_guarded() helper
  - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded
  - checkpatch: add qemu_bh_new/aio_bh_new checks
  - async: avoid use-after-free on re-entrancy guard
  - async: Add an optional reentrancy guard to the BH API
  - util/async: add a human-readable name to BHs for debugging
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set
  - Include sysemu/sysemu.h a lot less


author: Jiabo Feng <fengjiabo1@huawei.com>
changelog:
  - tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fix CVE-2023-5088)
  - hw/ide: reset: cancel async DMA operation before resetting state (Fix CVE-2023-5088)


author: Jiabo Feng <fengjiabo1@huawei.com>
changelog:
  - block: Parse filenames only when explicitly requested (CVE-2024-4467)
  - block: introduce bdrv_open_file_child() helper
  - qcow2: Don't open data_file with BDRV_O_NO_IO (CVE-2024-4467)
  - qcow2: Do not reopen data_file in invalidate_cache


author: Jiabo Feng <fengjiabo1@huawei.com> - 10:4.1.0-86
changelog:
  - nbd/server: CVE-2024-7409: Close stray clients at server-stop
  - main-loop.h: introduce qemu_in_main_thread()
  - aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED
  - nbd/server: CVE-2024-7409: Drop non-negotiating clients
  - nbd/server: CVE-2024-7409: Cap default max-connections to 100
  - nbd: Add max-connections to nbd-server-start
  - nbd/server: Plumb in new args to nbd_client_add()
  - nbd: Minor style and typo fixes


author: Jiabo Feng <fengjiabo1@huawei.com> - 10:4.1.0-88
changelog:
  - mac_dbdma: Remove leftover `dma_memory_unmap` calls(CVE-2024-8612)
  - softmmu: Support concurrent bounce buffers(CVE-2024-8612)
  - qdev-properties: add size32 property type
  - system/physmem: Per-AddressSpace bounce buffering
  - system/physmem: Propagate AddressSpace to MapClient helpers


author: huyubiao <huyubiao@huawei.com> - 243-75
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add backport-basic-fix-overflow-detection-in-sigbus_pop.patch
         backport-bus-use-bus_log_parse_error-to-print-message.patch
         backport-busctl-avoid-asserting-on-NULL-message.patch
         backport-sd-journal-check-sd-event-state-before-setting-up-po.patch


author: huyubiao <huyubiao@huawei.com> - 243-76
changelog:
  - DESC:add backport-utmp-remove-dev-from-line.patch
         backport-core-exec-do-not-crash-with-UtmpMode-user-without-Us.patch
         backport-resolved-limit-the-number-of-signature-validations-i.patch
         backport-resolved-reduce-the-maximum-nsec3-iterations-to-100.patch


author: huyubiao <huyubiao@huawei.com> - 243-79
changelog:
  - add backport-login-user-runtime-dir-properly-check-for-mount-poin.patch
        backport-user-util-validate-the-right-field.patch


author: zhangyao <zhangyao108@huawei.com> - 243-81
changelog:
  - remove redundant patch
    del 1610-add-new-rules-for-lower-priority-events-to-preempt.patch
        core-bugfix-call-malloc_trim-to-return-memory-to-OS-immediately.patch
        1612-serialize-pids-for-scope-when-not-started.patch
        systemd-core-Close-and-free-dbus-when-bus-authentica.patch
        1615-do-not-finish-job-during-daemon-reload-in-unit_notify.patch


