# changelog

author: chenyi <chenyi211@huawei.com> - 4.19.90-2412.5.0.0310
changelog:
  - !14357  media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
  - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
  - !14326  mm: Backport mainline patch
  - !14324  mm: shmem: don't truncate page if memory failure happens
  - !14310  signal: Replace BUG_ON()s
  - mm/hugetlb: fix nodes huge page allocation when there are surplus pages
  - mm/compaction: correctly return failure with bogus compound_order in strict mode
  - mm: shmem: don't truncate page if memory failure happens
  - !14306  printk: Fix the qspinlock deadloop caused by zap_locks()
  - signal: Replace BUG_ON()s
  - printk: Fix the qspinlock deadloop caused by zap_locks()
  - !14176  padata: make padata_do_parallel find alternate callback CPU
  - !14000 scsi: smartpqi: add no_write_same for logical volumes
  - !14290  ACPI: PMIC: fix compile error
  - !14288  dhugetlb: keep refcount to 0 while page is actually free in pool
  - ACPI: PMIC: fix compile error
  - dhugetlb: keep refcount to 0 while page is actually free in pool
  - padata: make padata_do_parallel find alternate callback CPU
  - scsi: smartpqi: add no_write_same for logical volumes


author: chenyi <chenyi211@huawei.com> - 4.19.90-2501.1.0.0311
changelog:
  - !14726  etmem: fix use-after-free of mm in the scan release process
  - !14603  scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
  - !14658  ALSA: us122l: Use snd_card_free_when_closed() at disconnection
  - !14411  ALSA: 6fire: Release resources at card release
  - !14633  backport mainline bugfix patch
  - !14708  CVE-2024-53158
  - !14596  ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
  - !14707  CVE-2024-56746
  - !14432  hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
  - !14570  PCI: Fix use-after-free of slot->bus on hot remove
  - !14706  9p/xen: fix release of IRQ
  - !14390  CVE-2024-53173
  - etmem: fix use-after-free of mm in the scan release process
  - !14521  netlink: terminate outstanding dump on socket close
  - soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
  - fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
  - fbdev/sh7760fb: Alloc DMA memory from hardware device
  - 9p/xen: fix release of IRQ
  - !14421  sh: intc: Fix use-after-free bug in register_intc_controller()
  - !14556  um: ubd: Do not use drvdata in release
  - !14647  memcg: fix soft lockup in the OOM process
  - !14551  selinux: ignore unknown extended permissions
  - !14566  um: net: Do not use drvdata in release
  - !14567  vfio/pci: Properly hide first-in-list PCIe extended capability
  - !14549  media: wl128x: Fix atomicity violation in fmc_send_cmd()
  - !14646  media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
  - !14641  net: Fix CVE-2024-47684
  - !14640  xfrm: validate new SA's prefixlen using SA family when sel.family is unset
  - !14430  crypto: bcm - add error check in the ahash_hmac_init function
  - !14565  wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
  - ALSA: us122l: Use snd_card_free_when_closed() at disconnection
  - !14297  netfilter: ipset: add missing range check in bitmap_ip_uadt
  - memcg: fix soft lockup in the OOM process
  - media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
  - tcp: check skb is non-NULL in tcp_rto_delta_us()
  - tcp: introduce tcp_skb_timestamp_us() helper
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset
  - genirq/msi: Fix off-by-one error in msi_domain_alloc()
  - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
  - ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
  - PCI: Fix use-after-free of slot->bus on hot remove
  - vfio/pci: Properly hide first-in-list PCIe extended capability
  - um: net: Do not use drvdata in release
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
  - um: ubd: Do not use drvdata in release
  - selinux: ignore unknown extended permissions
  - media: wl128x: Fix atomicity violation in fmc_send_cmd()
  - !14500  sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
  - !14413  sched/dynamic_affinity: Calculate cpu capacity in real time when realtime tasks are running on this cpu
  - netlink: terminate outstanding dump on socket close
  - sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
  - !14398  printk: Skip log flush in NMI context when logbuf_lock is held
  - hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
  - crypto: bcm - add error check in the ahash_hmac_init function
  - !14386  fix CVE-2024-53197
  - !14361  CVE-2024-53217
  - sh: intc: Fix use-after-free bug in register_intc_controller()
  - !14098  vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
  - !14360  nfs: nfs4_callback_compound should put client with async mode
  - !14404  NFSD: Prevent a potential integer overflow
  - sched/dynamic_affinity: Calculate cpu capacity in real time when realtime tasks are running on this cpu
  - ALSA: 6fire: Release resources at card release
  - NFSD: Prevent a potential integer overflow
  - printk: Skip log flush in NMI context when logbuf_lock is held
  - NFSv4.0: Fix a use-after-free problem in the asynchronous open()
  - NFSv4.0: Fix the wake up of the next waiter in nfs_release_seqid()
  - Revert "NFSv4: release seqid when open failed for nfs4.0"
  - Revert "nfs: fix rpc_task use-after-free when open and close different files concurrently"
  - ALSA: usb-audio: Fix a DMA to stack memory bug
  - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
  - nfsd: restore callback functionality for NFSv4.0
  - NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
  - nfs: nfs4_callback_compound should put client with async mode
  - netfilter: ipset: add missing range check in bitmap_ip_uadt
  - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans


author: chenyi <chenyi211@huawei.com> - 4.19.90-2501.3.0.0312
changelog:
  - !14858  ALSA: usb-audio: Fix out of bounds reads when finding clock sources
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources
  - !14843  acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
  - !14740  NFSv4: Fix deadlock during the running of state manager
  - !14837 v2  fs: Filter specific inodes to prevent UAF issues
  - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
  - fs: Filter specific inodes to prevent UAF issues
  - !14826 v2  mm: hugetlb: independent PMD page table shared count
  - mm: hugetlb: independent PMD page table shared count
  - !14812  net: af_can: do not leave a dangling sk pointer in can_create()
  - net: af_can: do not leave a dangling sk pointer in can_create()
  - !14661  firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
  - !14482  nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
  - !14484  ovl: Filter invalid inodes with missing lookup function
  - !14485  ocfs2: fix uninitialized value in ocfs2_file_read_iter()
  - !14773  CVE-2024-56642
  - !14748  BMA: Fix Oops and spin lock deadlock problem, and change the version number.
  - !14744  rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
  - tipc: fix NULL deref in cleanup_bearer()
  - tipc: Fix use-after-free of kernel socket in cleanup_bearer().
  - tipc: remove ub->ubsock checks
  - BMA: Fix Oops and spin lock deadlock problem, and change the version number.
  - rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
  - NFSv4: Fix deadlock during the running of state manager
  - firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
  - ocfs2: fix uninitialized value in ocfs2_file_read_iter()
  - ovl: Filter invalid inodes with missing lookup function
  - nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2501.4.0.0313
changelog:
  - !14254 [openEuler-1.0-LTS]fix wangxun 1G/10G drivers hardware tx unit hang.
  - net: wangxun: change netdev uc addr num maxmium
  - net: wangxun: fix resolving ipv6 pakets extension header errors
  - net: wangxun: fix tx csum by soft except tcp udp sctp
  - !14871  quota: flush quota_release_work upon quota writeback
  - !9360 Add support for Hygon model 10h processors
  - !14864  drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
  - !14850  Fix rt warning
  - quota: flush quota_release_work upon quota writeback
  - drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
  - sched: Replace WARN_ON_ONCE to printk_deferred_once
  - sched/rt: Fix rt_runtime leaks with cpu hotplug
  - ALSA: hda: Add support for Hygon family 18h model 10h HD-Audio
  - hwmon/k10temp: Add support for Hygon family 18h model 10h
  - EDAC/amd64: Add support for Hygon family 18h model 10h
  - x86/amd_nb: Add support for Hygon family 18h model 10h
  - x86/cpu: Get LLC ID for Hygon family 18h model 10h


author: chenyi <chenyi211@huawei.com> - 4.19.90-2502.1.0.0314
changelog:
  - !14942  fix CVE-2024-57892
  - ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
  - ocfs2: correct return value of ocfs2_local_free_info()
  - !14933  scsi: sg: Fix slab-use-after-free read in sg_release()
  - scsi: sg: Fix slab-use-after-free read in sg_release()
  - !14919  bpf: fix OOB devmap writes when deleting elements
  - bpf: fix OOB devmap writes when deleting elements


author: chenyi <chenyi211@huawei.com> - 4.19.90-2502.2.0.0315
changelog:
  - !15050  brd: fix AA deadlock for concurrent brd_probe()
  - !15030  nbd: don't allow reconnect after disconnect
  - brd: fix AA deadlock for concurrent brd_probe()
  - !15017  spi: mpc52xx: Add cancel_work_sync before module remove
  - !15042  drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
  - !14978  CVE-2024-56604_openEuler-1.0-LTS
  - !15012  Bluetooth: L2CAP: fix CVE-2024-56605
  - !14999  scsi: bfa: Fix use-after-free in bfad_im_module_exit()
  - drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
  - !14992  ALSA: seq: oss: Fix races at processing SysEx messages
  - !14996  mm/compaction: fix UBSAN shift-out-of-bounds warning
  - nbd: don't allow reconnect after disconnect
  - spi: mpc52xx: Add cancel_work_sync before module remove
  - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
  - Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
  - scsi: bfa: Fix use-after-free in bfad_im_module_exit()
  - mm/compaction: fix UBSAN shift-out-of-bounds warning
  - ALSA: seq: oss: Fix races at processing SysEx messages
  - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
  - Bluetooth: Consolidate code around sk_alloc into a helper function


author: chenyi <chenyi211@huawei.com> - 4.19.90-2502.3.0.0316
changelog:
  - !15116  netfilter: conntrack: clamp maximum hashtable size to INT_MAX
  - !15115  netfilter: x_tables: fix LED ID check in led_tg_check()
  - !15114 v3  net: Fix CVE-2024-56658
  - !14895  ceph: prevent use-after-free in encode_cap_msg()
  - !15131  xsk: fix OOB map writes when deleting elements
  - xsk: fix OOB map writes when deleting elements
  - !15058  net: let net.core.dev_weight always be non-zero
  - netfilter: conntrack: clamp maximum hashtable size to INT_MAX
  - netfilter: x_tables: fix LED ID check in led_tg_check()
  - net: Fix kabi breakage in struct net
  - net: defer final 'struct net' free in netns dismantle
  - net: let net.core.dev_weight always be non-zero
  - ceph: prevent use-after-free in encode_cap_msg()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2502.4.0.0317
changelog:
  - !9357 Add support for Hygon model 7h processors
  - !15138  drm/amdgpu: fix usage slab after free
  - drm/amdgpu: fix usage slab after free
  - perf/x86/uncore: Add L3 PMU support for Hygon family 18h model 7h
  - EDAC/amd64: Add support for Hygon family 18h model 7h
  - x86/amd_nb: Add support for Hygon family 18h model 7h


author: chenyi <chenyi211@huawei.com> - 4.19.90-2503.1.0.0318
changelog:
  - !15314  drm/imx: Fix memory leak in imx_pd_connector_get_modes
  - !15313  video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
  - !15285  tcp: Defer ts_recent changes until req is owned
  - !15256  ata: sata_dwc_460ex: Fix crash due to OOB write
  - drm/imx: Fix memory leak in imx_pd_connector_get_modes
  - video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
  - tcp: Defer ts_recent changes until req is owned
  - !15262  blk-iolatency: Fix inflight count imbalances and IO hangs on offline
  - !15193  Roll back the setting of nfs superblock s_flags.
  - blk-iolatency: Fix inflight count imbalances and IO hangs on offline
  - ata: sata_dwc_460ex: Fix crash due to OOB write
  - Revert "nfs: ignore SB_RDONLY when mounting nfs"
  - Revert "nfs: pass flags to second superblock"
  - Revert "nfs: fix the loss of superblock's initialized flags"


author: chenyi <chenyi211@huawei.com> - 4.19.90-2503.3.0.0319
changelog:
  - !15415  tracing/histograms: Fix memory leak problem
  - !15415  tracing/histograms: Fix memory leak problem
  - tracing/histograms: Fix memory leak problem
  - !15398  RDMA/hfi1: Prevent use of lock before it is initialized
  - !15401  hfsplus: don't query the device logical block size multiple times
  - !15401  hfsplus: don't query the device logical block size multiple times
  - !15399  drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
  - !15399  drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
  - !15411 v2  Ignore SB_RDONLY when mounting and remounting nfs
  - !15411 v2  Ignore SB_RDONLY when mounting and remounting nfs
  - !15337  net: tipc: fix possible refcount leak in tipc_sk_create()
  - !15336  CVE-2025-21702
  - !15335  net: sched: Disallow replacing of child qdisc from one parent to another
  - !15335  net: sched: Disallow replacing of child qdisc from one parent to another
  - nfs: ignore SB_RDONLY when remounting nfs
  - nfs: clear SB_RDONLY before getting superblock
  - !15393  powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup
  - !15392  ARM: hisi: Add missing of_node_put after of_find_compatible_node
  - !15392  ARM: hisi: Add missing of_node_put after of_find_compatible_node
  - !15275  scsi: libfc: Fix use after free in fc_exch_abts_resp()
  - !15297  af_packet: avoid erroring out after sock_init_data() in packet_create()
  - !15297  af_packet: avoid erroring out after sock_init_data() in packet_create()
  - hfsplus: don't query the device logical block size multiple times
  - drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
  - RDMA/hfi1: Prevent use of lock before it is initialized
  - !15374  can: gs_usb: gs_usb_open/close(): fix memory leak
  - !15332  Fix CVE-2022-49253
  - !15381  iio: trigger: sysfs: fix use-after-free on remove
  - !15386  crypto: qat - add param check for DH
  - !15353  rtl818x: Prevent using not initialized queues
  - !15354  drm/amdkfd: Check for potential null return of kmalloc_array()
  - !15231  cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0
  - powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup
  - ARM: hisi: Add missing of_node_put after of_find_compatible_node
  - !15240  smb: client: Fix netns refcount imbalance
  - crypto: qat - add param check for DH
  - iio: trigger: sysfs: fix use-after-free on remove
  - !15361  md/bitmap: don't set sb values if can't pass sanity check
  - !15361  md/bitmap: don't set sb values if can't pass sanity check
  - !15351  dm integrity: fix memory corruption when tag_size is less than digest size
  - !15350  video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
  - can: gs_usb: gs_usb_open/close(): fix memory leak
  - !15075 v4  Fix CVE-2023-52572 in openEuler-1.0-LTS
  - !15287  bpf, arm64: Clear prog->jited_len along prog->jited
  - md/bitmap: don't set sb values if can't pass sanity check
  - !15324  Fix Fix CVE-2022-49351
  - !15329  Fix CVE-2022-49308
  - drm/amdkfd: Check for potential null return of kmalloc_array()
  - rtl818x: Prevent using not initialized queues
  - dm integrity: fix memory corruption when tag_size is less than digest size
  - video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
  - !15282  fix CVE-2022-49404
  - !15282  fix CVE-2022-49404
  - !15273  ARM: davinci: da850-evm: Avoid NULL pointer dereference
  - !15273  ARM: davinci: da850-evm: Avoid NULL pointer dereference
  - !15303  md/raid1: fix memory leak in raid1_run() if no active rdev
  - !15304  md: bypass block throttle for superblock update
  - !15318  md/raid1: fix bitmap update when all write requests fail
  - !15318  md/raid1: fix bitmap update when all write requests fail
  - net: tipc: fix possible refcount leak in tipc_sk_create()
  - pfifo_tail_enqueue: Drop new packet when sch->limit == 0
  - net_sched: sch_fifo: implement lockless __fifo_dump()
  - net: sched: Disallow replacing of child qdisc from one parent to another
  - media: usb: go7007: s2250-board: fix leak in probe()
  - extcon: Modify extcon device to be created after driver data is set
  - extcon: Fix error handling in extcon_dev_register
  - net: altera: Fix refcount leak in altera_tse_mdio_create
  - md/raid1: fix bitmap update when all write requests fail
  - md: bypass block throttle for superblock update
  - md/raid1: fix memory leak in raid1_run() if no active rdev
  - af_packet: avoid erroring out after sock_init_data() in packet_create()
  - bpf, arm64: Clear prog->jited_len along prog->jited
  - RDMA/hfi1: Fix potential integer multiplication overflow errors
  - scsi: libfc: Fix use after free in fc_exch_abts_resp()
  - ARM: davinci: da850-evm: Avoid NULL pointer dereference
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free
  - smb: client: fix TCP timers deadlock after rmmod
  - cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0
  - cifs: Fix UAF in cifs_demultiplex_thread()


author: wangkai <13474090681@163.com> - 1:12.22.11-4
changelog:
  - Fix CVE-2022-32212,CVE-2022-32213,CVE-2022-32214,CVE-2022-32215,
  - CVE-2022-25881,CVE-2023-23918,CVE-2023-23920,CVE-2023-30589,
  - CVE-2023-30590,CVE-2023-30581,CVE-2023-32002,CVE-2023-32006,
  - CVE-2023-32559,CVE-2022-35256


author: xingwei <xingwei14@h-partners.com> - 2.18-5
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Add the socket option IPV6_MULTICAST_LOOP to prevent the interface from autocon
  figuring using RA messages sent by itself.


