# changelog

author: chenyi <chenyi211@huawei.com> - 4.19.90-2412.1.0.0306
changelog:
  - !13959  fs: Fix uninitialized value issue in from_kuid and from_kgid
  - !13796  vfs: fix race between evice_inodes() and find_inode()&iput()
  - !13925  CVE-2024-50236
  - !13892  crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
  - fs: Fix uninitialized value issue in from_kuid and from_kgid
  - wifi: ath10k: Fix memory leak in management tx
  - ath10k: Remove msdu from idr when management pkt send fails
  - !13879  Fix problems of mounting nfs
  - !13866  Bluetooth: bnep: fix wild-memory-access in proto_unregister
  - !13459  io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
  - !13460  ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
  - crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
  - !13852  sctp: properly validate chunk size in sctp_sf_ootb()
  - !13875  bpf: Fix out-of-bounds write in trie_get_next_key()
  - nfs: ignore SB_RDONLY when mounting nfs
  - nfs: pass flags to second superblock
  - bpf: Fix out-of-bounds write in trie_get_next_key()
  - Bluetooth: bnep: fix wild-memory-access in proto_unregister
  - !13812  nilfs2: fix kernel bug due to missing clearing of checked flag
  - sctp: properly validate chunk size in sctp_sf_ootb()
  - nilfs2: fix kernel bug due to missing clearing of checked flag
  - vfs: fix race between evice_inodes() and find_inode()&iput()
  - ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
  - io_uring/rw: fix missing NOWAIT check for O_DIRECT start write


author: chenyi <chenyi211@huawei.com> - 4.19.90-2412.2.0.0307
changelog:
  - !14068  media: v4l2-tpg: prevent the risk of a division by zero
  - !14116  media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
  - !14051  fix CVE-2024-50278
  - !14080  USB: serial: io_edgeport: fix use after free in debug printk
  - !14077  usb: typec: altmode should keep reference to parent
  - !14075  HID: core: zero-initialize the report buffer
  - USB: serial: io_edgeport: fix use after free in debug printk
  - usb: typec: altmode should keep reference to parent
  - HID: core: zero-initialize the report buffer
  - media: v4l2-tpg: prevent the risk of a division by zero
  - dm cache: fix potential out-of-bounds access on the first resume
  - dm cache: optimize dirty bit checking with find_next_bit when resizing
  - dm cache: fix out-of-bounds access to the dirty bitset when resizing


author: chenyi <chenyi211@huawei.com> - 4.19.90-2412.3.0.0308
changelog:
  - !14186  nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
  - !14156  Bluetooth: Fix CVE-2024-50125
  - !14157  net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
  - !14158  be2net: fix potential memory leak in be_xmit()
  - !14160  net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
  - !14159  netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
  - !14192  nfs: fix the loss of superblock's initialized flags
  - nfs: fix the loss of superblock's initialized flags
  - nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
  - !14147  CVE-2024-53142
  - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
  - netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
  - be2net: fix potential memory leak in be_xmit()
  - net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
  - Bluetooth: SCO: Fix UAF on sco_sock_timeout
  - Bluetooth: call sock_hold earlier in sco_conn_del
  - initramfs: avoid filename buffer overrun


author: chenyi <chenyi211@huawei.com> - 4.19.90-2412.4.0.0309
changelog:
  - !14248  Fix CVE-2024-50194
  - !14285  ACPI: battery: Fix possible crash when unregistering a battery hook
  - !14265  PCI: Mark Creative Labs EMU20k2 INTx masking as broken
  - !14264  PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
  - !14262  x86/apic: Always explicitly disarm TSC-deadline timer
  - ACPI: battery: Fix possible crash when unregistering a battery hook
  - !14249  smb: client: Fix use-after-free of network namespace.
  - !14267  backport LTS commits
  - ACPI: battery: Simplify battery hook locking
  - ACPICA: iasl: handle empty connection_node
  - ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
  - ACPI: EC: Do not release locks during operation region accesses
  - ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
  - ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
  - ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
  - x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
  - PCI: Mark Creative Labs EMU20k2 INTx masking as broken
  - PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
  - x86/apic: Always explicitly disarm TSC-deadline timer
  - !14261  io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - !14255  cgroup: Fix potential overflow issue when checking max_depth
  - cgroup: Fix potential overflow issue when checking max_depth
  - !14240  sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
  - !14239  sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
  - !14245  selinux: improve error checking in sel_write_load()
  - smb: client: Fix use-after-free of network namespace.
  - arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning
  - arm64: probes: Fix uprobes for big-endian kernels
  - arm64:uprobe fix the uprobe SWBP_INSN in big-endian
  - !14233  block, bfq: fix possible UAF for bfqq->bic with merge chain
  - selinux: improve error checking in sel_write_load()
  - !14181  net: Fix icmp host relookup triggering ip_rt_bug
  - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
  - sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
  - block, bfq: fix possible UAF for bfqq->bic with merge chain
  - !14139  ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
  - !14167  CVE-2024-46733
  - net: Fix icmp host relookup triggering ip_rt_bug
  - btrfs: fix the length of reserved qgroup to free
  - btrfs: fix qgroup reserve leaks in cow_file_range
  - ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow


author: chenyi <chenyi211@huawei.com> - 4.19.90-2412.5.0.0310
changelog:
  - !14357  media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
  - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
  - !14326  mm: Backport mainline patch
  - !14324  mm: shmem: don't truncate page if memory failure happens
  - !14310  signal: Replace BUG_ON()s
  - mm/hugetlb: fix nodes huge page allocation when there are surplus pages
  - mm/compaction: correctly return failure with bogus compound_order in strict mode
  - mm: shmem: don't truncate page if memory failure happens
  - !14306  printk: Fix the qspinlock deadloop caused by zap_locks()
  - signal: Replace BUG_ON()s
  - printk: Fix the qspinlock deadloop caused by zap_locks()
  - !14176  padata: make padata_do_parallel find alternate callback CPU
  - !14000 scsi: smartpqi: add no_write_same for logical volumes
  - !14290  ACPI: PMIC: fix compile error
  - !14288  dhugetlb: keep refcount to 0 while page is actually free in pool
  - ACPI: PMIC: fix compile error
  - dhugetlb: keep refcount to 0 while page is actually free in pool
  - padata: make padata_do_parallel find alternate callback CPU
  - scsi: smartpqi: add no_write_same for logical volumes


author: chenyi <chenyi211@huawei.com> - 4.19.90-2501.1.0.0311
changelog:
  - !14726  etmem: fix use-after-free of mm in the scan release process
  - !14603  scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
  - !14658  ALSA: us122l: Use snd_card_free_when_closed() at disconnection
  - !14411  ALSA: 6fire: Release resources at card release
  - !14633  backport mainline bugfix patch
  - !14708  CVE-2024-53158
  - !14596  ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
  - !14707  CVE-2024-56746
  - !14432  hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
  - !14570  PCI: Fix use-after-free of slot->bus on hot remove
  - !14706  9p/xen: fix release of IRQ
  - !14390  CVE-2024-53173
  - etmem: fix use-after-free of mm in the scan release process
  - !14521  netlink: terminate outstanding dump on socket close
  - soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
  - fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
  - fbdev/sh7760fb: Alloc DMA memory from hardware device
  - 9p/xen: fix release of IRQ
  - !14421  sh: intc: Fix use-after-free bug in register_intc_controller()
  - !14556  um: ubd: Do not use drvdata in release
  - !14647  memcg: fix soft lockup in the OOM process
  - !14551  selinux: ignore unknown extended permissions
  - !14566  um: net: Do not use drvdata in release
  - !14567  vfio/pci: Properly hide first-in-list PCIe extended capability
  - !14549  media: wl128x: Fix atomicity violation in fmc_send_cmd()
  - !14646  media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
  - !14641  net: Fix CVE-2024-47684
  - !14640  xfrm: validate new SA's prefixlen using SA family when sel.family is unset
  - !14430  crypto: bcm - add error check in the ahash_hmac_init function
  - !14565  wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
  - ALSA: us122l: Use snd_card_free_when_closed() at disconnection
  - !14297  netfilter: ipset: add missing range check in bitmap_ip_uadt
  - memcg: fix soft lockup in the OOM process
  - media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
  - tcp: check skb is non-NULL in tcp_rto_delta_us()
  - tcp: introduce tcp_skb_timestamp_us() helper
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset
  - genirq/msi: Fix off-by-one error in msi_domain_alloc()
  - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
  - ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
  - PCI: Fix use-after-free of slot->bus on hot remove
  - vfio/pci: Properly hide first-in-list PCIe extended capability
  - um: net: Do not use drvdata in release
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
  - um: ubd: Do not use drvdata in release
  - selinux: ignore unknown extended permissions
  - media: wl128x: Fix atomicity violation in fmc_send_cmd()
  - !14500  sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
  - !14413  sched/dynamic_affinity: Calculate cpu capacity in real time when realtime tasks are running on this cpu
  - netlink: terminate outstanding dump on socket close
  - sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
  - !14398  printk: Skip log flush in NMI context when logbuf_lock is held
  - hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
  - crypto: bcm - add error check in the ahash_hmac_init function
  - !14386  fix CVE-2024-53197
  - !14361  CVE-2024-53217
  - sh: intc: Fix use-after-free bug in register_intc_controller()
  - !14098  vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
  - !14360  nfs: nfs4_callback_compound should put client with async mode
  - !14404  NFSD: Prevent a potential integer overflow
  - sched/dynamic_affinity: Calculate cpu capacity in real time when realtime tasks are running on this cpu
  - ALSA: 6fire: Release resources at card release
  - NFSD: Prevent a potential integer overflow
  - printk: Skip log flush in NMI context when logbuf_lock is held
  - NFSv4.0: Fix a use-after-free problem in the asynchronous open()
  - NFSv4.0: Fix the wake up of the next waiter in nfs_release_seqid()
  - Revert "NFSv4: release seqid when open failed for nfs4.0"
  - Revert "nfs: fix rpc_task use-after-free when open and close different files concurrently"
  - ALSA: usb-audio: Fix a DMA to stack memory bug
  - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
  - nfsd: restore callback functionality for NFSv4.0
  - NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
  - nfs: nfs4_callback_compound should put client with async mode
  - netfilter: ipset: add missing range check in bitmap_ip_uadt
  - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans


author: chenyi <chenyi211@huawei.com> - 4.19.90-2501.3.0.0312
changelog:
  - !14858  ALSA: usb-audio: Fix out of bounds reads when finding clock sources
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources
  - !14843  acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
  - !14740  NFSv4: Fix deadlock during the running of state manager
  - !14837 v2  fs: Filter specific inodes to prevent UAF issues
  - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
  - fs: Filter specific inodes to prevent UAF issues
  - !14826 v2  mm: hugetlb: independent PMD page table shared count
  - mm: hugetlb: independent PMD page table shared count
  - !14812  net: af_can: do not leave a dangling sk pointer in can_create()
  - net: af_can: do not leave a dangling sk pointer in can_create()
  - !14661  firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
  - !14482  nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
  - !14484  ovl: Filter invalid inodes with missing lookup function
  - !14485  ocfs2: fix uninitialized value in ocfs2_file_read_iter()
  - !14773  CVE-2024-56642
  - !14748  BMA: Fix Oops and spin lock deadlock problem, and change the version number.
  - !14744  rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
  - tipc: fix NULL deref in cleanup_bearer()
  - tipc: Fix use-after-free of kernel socket in cleanup_bearer().
  - tipc: remove ub->ubsock checks
  - BMA: Fix Oops and spin lock deadlock problem, and change the version number.
  - rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
  - NFSv4: Fix deadlock during the running of state manager
  - firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
  - ocfs2: fix uninitialized value in ocfs2_file_read_iter()
  - ovl: Filter invalid inodes with missing lookup function
  - nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2501.4.0.0313
changelog:
  - !14254 [openEuler-1.0-LTS]fix wangxun 1G/10G drivers hardware tx unit hang.
  - net: wangxun: change netdev uc addr num maxmium
  - net: wangxun: fix resolving ipv6 pakets extension header errors
  - net: wangxun: fix tx csum by soft except tcp udp sctp
  - !14871  quota: flush quota_release_work upon quota writeback
  - !9360 Add support for Hygon model 10h processors
  - !14864  drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
  - !14850  Fix rt warning
  - quota: flush quota_release_work upon quota writeback
  - drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
  - sched: Replace WARN_ON_ONCE to printk_deferred_once
  - sched/rt: Fix rt_runtime leaks with cpu hotplug
  - ALSA: hda: Add support for Hygon family 18h model 10h HD-Audio
  - hwmon/k10temp: Add support for Hygon family 18h model 10h
  - EDAC/amd64: Add support for Hygon family 18h model 10h
  - x86/amd_nb: Add support for Hygon family 18h model 10h
  - x86/cpu: Get LLC ID for Hygon family 18h model 10h


author: chenyi <chenyi211@huawei.com> - 4.19.90-2502.1.0.0314
changelog:
  - !14942  fix CVE-2024-57892
  - ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
  - ocfs2: correct return value of ocfs2_local_free_info()
  - !14933  scsi: sg: Fix slab-use-after-free read in sg_release()
  - scsi: sg: Fix slab-use-after-free read in sg_release()
  - !14919  bpf: fix OOB devmap writes when deleting elements
  - bpf: fix OOB devmap writes when deleting elements


author: chenyi <chenyi211@huawei.com> - 4.19.90-2502.2.0.0315
changelog:
  - !15050  brd: fix AA deadlock for concurrent brd_probe()
  - !15030  nbd: don't allow reconnect after disconnect
  - brd: fix AA deadlock for concurrent brd_probe()
  - !15017  spi: mpc52xx: Add cancel_work_sync before module remove
  - !15042  drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
  - !14978  CVE-2024-56604_openEuler-1.0-LTS
  - !15012  Bluetooth: L2CAP: fix CVE-2024-56605
  - !14999  scsi: bfa: Fix use-after-free in bfad_im_module_exit()
  - drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
  - !14992  ALSA: seq: oss: Fix races at processing SysEx messages
  - !14996  mm/compaction: fix UBSAN shift-out-of-bounds warning
  - nbd: don't allow reconnect after disconnect
  - spi: mpc52xx: Add cancel_work_sync before module remove
  - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
  - Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
  - scsi: bfa: Fix use-after-free in bfad_im_module_exit()
  - mm/compaction: fix UBSAN shift-out-of-bounds warning
  - ALSA: seq: oss: Fix races at processing SysEx messages
  - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
  - Bluetooth: Consolidate code around sk_alloc into a helper function


author: fuanan <fuanan3@h-partners.com> - 2.27.0-16
changelog:
  - Type:CVE
  - ID:CVE-2023-25652 CVE-2023-29007 CVE-2023-25815
  - SUG:NA
  - DESC:Fix CVE-2023-25652 CVE-2023-29007 CVE-2023-25815


author: fuanan <fuanan3@h-partners.com> - 2.27.0-17
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:enable multithreading compilation and installation,
         move Git.3pm.gz to perl-Git,avoid installation conflicts,
         change BuildRequires from pcre-devel to pcre2-devel.


author: huyubiao <huyubiao@huawei.com> - 2.27.0-18
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Specifying Obsoletes and Provides version numbers, prevent upgrade conflicts.
         Delete git-core-doc from git, git-core-doc is provided by git-help.


author: fuanan <fuanan3@h-partners.com> - 2.27.0-19
changelog:
  - Type:CVE
  - ID:CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465
  - SUG:NA
  - DESC:Fix CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-21
changelog:
  - Type:CVE
  - ID:CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237
  - SUG:NA
  - DESC:fix CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237


