# changelog

author: chenyi <chenyi211@huawei.com> - 4.19.90-2410.1.0.0298
changelog:
  - !12007  Fix CVE-2024-44958 for 4.19
  - !11785  perf/x86: Serialize set_attr_rdpmc()
  - sched/smt: Fix unbalance sched_smt_present dec/inc
  - sched/smt: Introduce sched_smt_present_inc/dec() helper
  - sched: Revert fix unbalance sched_smt_present dec/inc
  - !11918  dhugetlb: make spin_lock irq save
  - !11968  drm/amdgpu: fix mc_data out-of-bounds read warning
  - drm/amdgpu: fix mc_data out-of-bounds read warning
  - !11863  memcg_write_event_control(): fix a user-triggerable oops
  - !11921  hwmon: (lm95234) Fix underflows seen when writing limit attributes
  - !11924  nilfs2: protect references to superblock parameters exposed in sysfs
  - !11842  CVE-2024-46771
  - nilfs2: protect references to superblock parameters exposed in sysfs
  - hwmon: (lm95234) Fix underflows seen when writing limit attributes
  - dhugetlb: make free_huge_page_to_dhugetlb_pool irq safe
  - dhugetlb: avoid lockdep warning with spin_lock_nested
  - dhugetlb: Use helper function to lock/unlock
  - !11789  ALSA: line6: Fix racy access to midibuf
  - !11905  scsi: aacraid: Fix double-free on probe failure
  - !11888  pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  - !11855  VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  - scsi: aacraid: Fix double-free on probe failure
  - !11877  usb: dwc3: st: fix probed platform device ref count on probe error path
  - !11878  PCI: Add missing bridge lock to pci_bus_lock()
  - !11861  hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
  - !11803  CVE-2024-46781
  - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  - PCI: Add missing bridge lock to pci_bus_lock()
  - usb: dwc3: st: fix probed platform device ref count on probe error path
  - !11818  uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  - memcg_write_event_control(): fix a user-triggerable oops
  - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
  - !11703  binder: fix UAF caused by offsets overwrite
  - !11854  fix CVE-2024-46777 for 4.19
  - VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  - udf: Avoid excessive partition lengths
  - udf: Define EFSCORRUPTED error code
  - !11809  apparmor: fix possible NULL pointer dereference
  - !11777  blktrace: fix blktrace is disabled when CONFIG_BLK_DEBUG_FS is disabled
  - can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
  - can: bcm: Remove proc entry when dev is unregistered.
  - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  - apparmor: fix possible NULL pointer dereference
  - nilfs2: fix missing cleanup on rollforward recovery error
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
  - ALSA: line6: Fix racy access to midibuf
  - perf/x86: Serialize set_attr_rdpmc()
  - blktrace: fix blktrace is disabled when CONFIG_BLK_DEBUG_FS is disabled
  - binder: fix UAF caused by offsets overwrite


author: chenyi <chenyi211@huawei.com> - 4.19.90-2410.2.0.0299
changelog:
  - !8720  net: USB: Fix wrong-direction WARNING in plusb.c
  - !12116 [sync] PR-11856:  acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - !12071  btrfs: clean up our handling of refs == 0 in snapshot delete
  - !12069  platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - btrfs: clean up our handling of refs == 0 in snapshot delete
  - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - !12026  ASoC: meson: axg-card: fix 'use-after-free'
  - !12040  drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
  - !12012  rtmutex: Drop rt_mutex::wait_lock before scheduling
  - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
  - ASoC: meson: axg-card: fix 'use-after-free'
  - rtmutex: Drop rt_mutex::wait_lock before scheduling
  - net: USB: Fix wrong-direction WARNING in plusb.c


author: chenyi <chenyi211@huawei.com> - 4.19.90-2410.3.0.0300
changelog:
  - !12299 v2  ACPI&PCI LTS patches 2024.10
  - !12278  hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
  - ACPI: processor: Fix memory leaks in error paths of processor_add()
  - ntp: Safeguard against time_constant overflow
  - ntp: Clamp maxerror and esterror to operating range
  - Revert "ntp: Avoid undefined behaviour in second_overflow()"
  - arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE
  - hrtimer: Prevent queuing of hrtimer without a function callback
  - smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
  - ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add()
  - !12270  pinctrl: core: fix possible memory leak when pinctrl_enable() fails
  - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
  - pinctrl: core: fix possible memory leak when pinctrl_enable() fails
  - !12220  Fix CVE-2024-46826
  - !12268  selinux: fix potential counting error in avc_add_xperms_decision()
  - selinux: fix potential counting error in avc_add_xperms_decision()
  - !12138  md/raid1: don't free conf on raid0_run failure
  - ELF: Fix mixed declarations and code of "snapshot_randomize_va_space"
  - ELF: fix kernel.randomize_va_space double read
  - md/raid1: don't free conf on raid0_run failure


author: chenyi <chenyi211@huawei.com> - 4.19.90-2411.1.0.0301
changelog:
  - !12501  nbd: fix race between timeout and normal completion
  - !12659  netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
  - !12638  net: do not delay dst_entries_add() in dst_release()
  - !12669  drm/amd/display: Fix index out of bounds in degamma hardware format translation
  - drm/amd/display: Fix index out of bounds in degamma hardware format translation
  - !12627  NFC: nci: Bounds check struct nfc_target arrays
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
  - net: do not delay dst_entries_add() in dst_release()
  - !12623  hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
  - NFC: nci: Bounds check struct nfc_target arrays
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
  - !12592  of/irq: Prevent device address out-of-bounds read in interrupt map walk
  - !12593  pinctrl: single: fix potential NULL dereference in pcs_get_function()
  - !12606  swap: stop add to avail list if swap is full
  - !8931 v2  ext4: avoid deadlock in fs reclaim with page writeback
  - !12566  ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
  - !12558  Fix CVE-2024-49900
  - !12577  gpio: amd8111: Fix PCI device reference count leak
  - swap: stop add to avail list if swap is full
  - !12441  hwmon: (coretemp) Check for null before removing sysfs attrs
  - !12572  media: pci: cx23885: check cx23885_vdev_init() return
  - !12403  drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
  - !12414  nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
  - pinctrl: single: fix potential NULL dereference in pcs_get_function()
  - of/irq: Prevent device address out-of-bounds read in interrupt map walk
  - !12412  btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
  - !12413  udf: Fix preallocation discarding at indirect extent boundary
  - gpio: amd8111: Fix PCI device reference count leak
  - media: pci: cx23885: check cx23885_vdev_init() return
  - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
  - jfs: Fix uninit-value access of new_ea in ea_buffer
  - !12486  gtp: Fix CVE-2024-46677
  - !12475 v2  mm/swapfile: skip HugeTLB pages for unuse_vma
  - !12502  svm: fix UAF/Double Free in svm
  - !12384  drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
  - !12380  fix CVE-2024-46675
  - svm: fix UAF/Double Free in svm
  - nbd: fix race between timeout and normal completion
  - gtp: fix a potential NULL pointer dereference
  - gtp: make sure only SOCK_DGRAM UDP sockets are accepted
  - mm/swapfile: skip HugeTLB pages for unuse_vma
  - !12378  cgroup: Protect css->cgroup write under css_set_lock
  - hwmon: (coretemp) Check for null before removing sysfs attrs
  - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
  - udf: Fix preallocation discarding at indirect extent boundary
  - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
  - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
  - usb: dwc3: core: Prevent USB core invalid event buffer address access
  - usb: dwc3: core: Skip setting event buffers for host only controllers
  - cgroup: Protect css->cgroup write under css_set_lock
  - !12353  ida: Fix crash in ida_free when the bitmap is empty
  - ida: Fix crash in ida_free when the bitmap is empty
  - !12316  backport some LTS patches
  - net: busy-poll: use ktime_get_ns() instead of local_clock()
  - SUNRPC: Fix a race to wake a sync task
  - net: linkwatch: use system_unbound_wq
  - ext4: avoid deadlock in fs reclaim with page writeback


author: chenyi <chenyi211@huawei.com> - 4.19.90-2411.2.0.0302
changelog:
  - !13007  CVE-2024-49950
  - !13041  tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
  - !13052  ext4: fix CVE-2024-47701
  - !12959  ext4: update orig_path in ext4_find_extent()
  - ext4: avoid OOB when system.data xattr changes underneath the filesystem
  - ext4: explicitly exit when ext4_find_inline_entry returns an error
  - ext4: return error on ext4_find_inline_entry
  - ext4: ext4_search_dir should return a proper error
  - ext4: fix RENAME_WHITEOUT handling for inline directories
  - !12899  ext4: fix double brelse() the buffer of the extents path
  - !12895  ext4: aovid use-after-free in ext4_ext_insert_extent()
  - !13011  CVE-2024-49878
  - !13001  iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
  - !12997  net: fix crash when config small gso_max_size/gso_ipv4_max_size
  - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
  - resource: fix region_intersects() vs add_memory_driver_managed()
  - mm/resource: Use resource_overlaps() to simplify region_intersects()
  - Bluetooth: L2CAP: Fix uaf in l2cap_connect
  - Bluetooth: Return whether a connection is outbound
  - !12891  ext4: avoid use-after-free in ext4_ext_show_leaf()
  - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
  - net: fix crash when config small gso_max_size/gso_ipv4_max_size
  - !12860  drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
  - !12924  CVE-2022-48966
  - !12938  ASoC: soc-pcm: Add NULL check in BE reparenting
  - !12863  CVE-2022-49020
  - !12873  tipc: guard against string buffer overrun
  - ext4: update orig_path in ext4_find_extent()
  - !12919  ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
  - !12925  RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
  - !12792  HID: core: fix shift-out-of-bounds in hid_report_raw_event
  - !12743  net/xen-netback: prevent UAF in xenvif_flush_hash()
  - !12846  ACPI: sysfs: validate return type of _STR method
  - ASoC: soc-pcm: Add NULL check in BE reparenting
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
  - net: mvneta: Fix an out of bounds check
  - net: mvneta: Prevent out of bounds read in mvneta_config_rss()
  - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
  - !12804  ext4: fix CVE-2024-49884
  - !12783  mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  - !12782  net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
  - !12784  net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
  - !12785  slip: make slhc_remember() more robust against malicious packets
  - !12852  iio: health: afe4403: Fix oob read in afe4403_read_raw
  - !12813  serial: protect uart_port_dtr_rts() in uart_shutdown() too
  - ext4: fix double brelse() the buffer of the extents path
  - ext4: aovid use-after-free in ext4_ext_insert_extent()
  - !12842  NFSv4: release seqid when open failed for nfs4.0
  - ext4: avoid use-after-free in ext4_ext_show_leaf()
  - !12887  nfs: fix memory lead and nfs_server uaf
  - !12882  Bluetooth: Fix not cleanup led when bt_init fails
  - !12881  igb: Initialize mailbox message for VF reset
  - nfs: maintain nfs_server in the reclaim process
  - nfs: fix memory leak in error path of nfs4_do_reclaim
  - Bluetooth: Fix not cleanup led when bt_init fails
  - igb: Initialize mailbox message for VF reset
  - tipc: guard against string buffer overrun
  - net/9p: Fix a potential socket leak in p9_socket_open
  - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
  - !12815  media: venus: fix use after free bug in venus_remove due to race condition
  - !12814  iio: health: afe4404: Fix oob read in afe4404_[read|write
  - iio: health: afe4403: Fix oob read in afe4403_read_raw
  - ACPI: sysfs: validate return type of _STR method
  - NFSv4: release seqid when open failed for nfs4.0
  - !12757  drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
  - !12777  selinux: add the processing of the failure of avc_add_xperms_decision()
  - !12750  usb: gadget: uvc: Prevent buffer overflow in setup handler
  - !12760  smack: tcp: ipv4, fix incorrect labeling
  - media: venus: fix use after free bug in venus_remove due to race condition
  - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
  - serial: protect uart_port_dtr_rts() in uart_shutdown() too
  - !12732  net: phy: fix null-ptr-deref while probe() failed
  - !12721  ppp: fix ppp_async_encode() illegal access
  - ext4: fix slab-use-after-free in ext4_split_extent_at()
  - ext4: avoid ext4_error()'s caused by ENOMEM in the truncate path
  - HID: core: fix shift-out-of-bounds in hid_report_raw_event
  - slip: make slhc_remember() more robust against malicious packets
  - net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  - net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
  - selinux: add the processing of the failure of avc_add_xperms_decision()
  - smack: tcp: ipv4, fix incorrect labeling
  - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
  - !12614  writeback: Fix inode->i_io_list not be protected by inode->i_lock error
  - usb: gadget: uvc: Prevent buffer overflow in setup handler
  - !12366  fix CVE-2022-49011
  - !12704  fix CVE-2024-49924
  - !12519  fix CVE-2024-47742
  - net/xen-netback: prevent UAF in xenvif_flush_hash()
  - net: phy: fix null-ptr-deref while probe() failed
  - ppp: fix ppp_async_encode() illegal access
  - !12683  nilfs2: fix state management in error path of log writing function
  - fbdev: pxafb: Fix possible use after free in pxafb_task()
  - nilfs2: fix state management in error path of log writing function
  - init: Initialize noop_backing_dev_info early
  - writeback: Fix inode->i_io_list not be protected by inode->i_lock error
  - firmware_loader: Block path traversal
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2411.3.0.0303
changelog:
  - !13165  security/keys: fix slab-out-of-bounds in key_task_permission
  - !13150  net: fix data-races around sk->sk_forward_alloc
  - security/keys: fix slab-out-of-bounds in key_task_permission
  - net: fix data-races around sk->sk_forward_alloc
  - !13068  nfs: fix rpc_task use-after-free when open and close different files concurrently
  - nfs: fix rpc_task use-after-free when open and close different files concurrently


author: chenyi <chenyi211@huawei.com> - 4.19.90-2411.4.0.0304
changelog:
  - !13286  wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
  - !13305  CVE-2024-50195
  - !13209  fix CVE-2024-50115
  - posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
  - posix-clock: Fix missing timespec64 check in pc_clock_settime()
  - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
  - !13274  CVE-2024-50117
  - drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
  - drm/amd: Guard against bad data for ATIF ACPI method
  - !13254  Revert "sched/dynamic_affinity: fix preffered_cpu offline problem"
  - Revert "sched/dynamic_affinity: fix preffered_cpu offline problem"
  - !13249  sched/dynamic_affinity: fix preffered_cpu offline problem
  - sched/dynamic_affinity: fix preffered_cpu offline problem
  - !13213  CVE-2024-47745
  - mm: split critical region in remap_file_pages() and invoke LSMs in between
  - mm: call the security_mmap_file() LSM hook in remap_file_pages()
  - mm/mmap.c: don't unlock VMAs in remap_file_pages()
  - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
  - !13138  fs: call fsnotify_sb_delete after evict_inodes
  - !13187 v3  sched: smart_grid: Prevent double-free in sched_grid_qos_free
  - !13188  serial: core: Fix atomicity violation in uart_tiocmget
  - serial: core: Fix atomicity violation in uart_tiocmget
  - sched: smart_grid: Prevent double-free in sched_grid_qos_free
  - fs: call fsnotify_sb_delete after evict_inodes


author: chenyi <chenyi211@huawei.com> - 4.19.90-2411.5.0.0305
changelog:
  - !13821  tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  - !13451 bugfix of nfs
  - !13426  media: s5p-jpeg: prevent buffer overflows
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  - !13424  btrfs: reinitialize delayed ref list after deleting it from the list
  - !13423  nfs: Fix KMSAN warning in decode_getfattr_attrs()
  - NFS: make sure open context mode have FMODE_EXEC when file open for exec
  - media: s5p-jpeg: prevent buffer overflows
  - btrfs: reinitialize delayed ref list after deleting it from the list
  - nfs: Fix KMSAN warning in decode_getfattr_attrs()
  - !13346  nilfs2: propagate directory read errors from nilfs_find_entry()
  - !13349  ceph: remove the incorrect Fw reference check when dirtying pages
  - !13351  lts backport 11
  - irqchip/gic-v3: Force propagation of the active state with a read-back
  - ceph: remove the incorrect Fw reference check when dirtying pages
  - nilfs2: propagate directory read errors from nilfs_find_entry()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2412.1.0.0306
changelog:
  - !13959  fs: Fix uninitialized value issue in from_kuid and from_kgid
  - !13796  vfs: fix race between evice_inodes() and find_inode()&iput()
  - !13925  CVE-2024-50236
  - !13892  crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
  - fs: Fix uninitialized value issue in from_kuid and from_kgid
  - wifi: ath10k: Fix memory leak in management tx
  - ath10k: Remove msdu from idr when management pkt send fails
  - !13879  Fix problems of mounting nfs
  - !13866  Bluetooth: bnep: fix wild-memory-access in proto_unregister
  - !13459  io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
  - !13460  ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
  - crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
  - !13852  sctp: properly validate chunk size in sctp_sf_ootb()
  - !13875  bpf: Fix out-of-bounds write in trie_get_next_key()
  - nfs: ignore SB_RDONLY when mounting nfs
  - nfs: pass flags to second superblock
  - bpf: Fix out-of-bounds write in trie_get_next_key()
  - Bluetooth: bnep: fix wild-memory-access in proto_unregister
  - !13812  nilfs2: fix kernel bug due to missing clearing of checked flag
  - sctp: properly validate chunk size in sctp_sf_ootb()
  - nilfs2: fix kernel bug due to missing clearing of checked flag
  - vfs: fix race between evice_inodes() and find_inode()&iput()
  - ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
  - io_uring/rw: fix missing NOWAIT check for O_DIRECT start write


author: chenyi <chenyi211@huawei.com> - 4.19.90-2412.2.0.0307
changelog:
  - !14068  media: v4l2-tpg: prevent the risk of a division by zero
  - !14116  media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
  - !14051  fix CVE-2024-50278
  - !14080  USB: serial: io_edgeport: fix use after free in debug printk
  - !14077  usb: typec: altmode should keep reference to parent
  - !14075  HID: core: zero-initialize the report buffer
  - USB: serial: io_edgeport: fix use after free in debug printk
  - usb: typec: altmode should keep reference to parent
  - HID: core: zero-initialize the report buffer
  - media: v4l2-tpg: prevent the risk of a division by zero
  - dm cache: fix potential out-of-bounds access on the first resume
  - dm cache: optimize dirty bit checking with find_next_bit when resizing
  - dm cache: fix out-of-bounds access to the dirty bitset when resizing


author: xujing<xujing125@huawei.com> - 4.15.1-55
changelog:
  - sync patches from upstream
    add backport-Fix-a-theoretical-use-of-uninitialized-struct-member.patch
        backport-Fix-spec-parser-leaks-from-trans-f-file.patch
        backport-Tip-toe-around-rpmfiFN-thin-ice-in-fsm.patch
        backport-Use-unsigned-integers-for-buildtime-too-for-Y2K38-sa.patch


