# changelog

author: huwentao <huwentao19@h-partners.com> - 4.19.90-2508.1.0.0339
changelog:
  - !17509 v2  ext4: add bounds checking in get_max_inline_xattr_value_size()
  - ext4: add bounds checking in get_max_inline_xattr_value_size()
  - !17482  mm: Fix possible deadlock in console_trylock_spinning
  - mm: Fix possible deadlock in console_trylock_spinning
  - !17456  md/raid1: Fix stack memory use after return in raid1_reshape
  - !17460 v2  net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  - !17448  vsock/vmci: Clear the vmci transport packet properly when initializing it
  - net: vlan: Fix kabi breakage of struct vlan_info
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  - md/raid1: Fix stack memory use after return in raid1_reshape
  - !17397  Squashfs: check return result of sb_min_blocksize
  - vsock/vmci: Clear the vmci transport packet properly when initializing it
  - !17314  ovl: fix general protection fault in security_inode_getattr
  - !17420  bcache: fix NULL pointer in cache_set_flush()
  - !17431  ACPICA: Refuse to evaluate a method if arguments are missing
  - !17409  usb: net: sierra: check for no status endpoint
  - !17426 EDAC/amd64: Fix the calculation of umc base for Hygon family 18h model 4h
  - !17392  atm: clip: Fix infinite recursive call of clip_push().
  - ACPICA: Refuse to evaluate a method if arguments are missing
  - EDAC/amd64: Fix the calculation of umc base for Hygon family 18h model 4h
  - bcache: fix NULL pointer in cache_set_flush()
  - usb: net: sierra: check for no status endpoint
  - Squashfs: check return result of sb_min_blocksize
  - !17040  net: ch9200: fix uninitialised access during mii_nway_restart
  - atm: clip: Fix infinite recursive call of clip_push().
  - !17348  calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  - !17369  ext4: inline: fix len overflow in ext4_prepare_inline_data
  - !17220  Fix the race of lock/unlock and open for nfs
  - ext4: inline: fix len overflow in ext4_prepare_inline_data
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  - ovl: fix general protection fault in security_inode_getattr
  - nfs: do not unlock when no lock is held
  - nfs: fix the race of lock/unlock and open
  - net: ch9200: fix uninitialised access during mii_nway_restart


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2508.2.0.0340
changelog:
  - !17478 EDAC/amd64: Do not warn when removing instances
  - EDAC/amd64: Do not warn when removing instances
  - !17552 [openEuler-1.0-LTS] Revert "scsi: hisi_sas: fix a issue related to timer of internal IO and SMP IO"
  - !17535  net/sched: sch_qfq: Fix CVE-2025-38477
  - Revert "scsi: hisi_sas: fix a issue related to timer of internal IO and SMP IO"
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2508.3.0.0341
changelog:
  - !17764  mm/smaps: fix race between smaps_hugetlb_range and migration
  - mm/smaps: fix race between smaps_hugetlb_range and migration
  - !17736 v2  mm/dpool: mark dpool hugetlb page as dirty in free_huge_page()
  - !17684  HID: core: do not bypass hid_hw_raw_request
  - mm/dpool: mark dpool hugetlb page as dirty in free_huge_page()
  - !17732  CVE-2025-38180
  - net: atm: fix /proc/net/atm/lec handling
  - net: atm: add lec_mutex
  - !17607  drm/sched: Increment job count before swapping tail spsc queue
  - HID: core: do not bypass hid_hw_raw_request
  - drm/sched: Increment job count before swapping tail spsc queue
  - !17562  sched: Fix sched tunable parameter range overflow
  - sched: Fix sched tunable parameter range overflow


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2509.1.0.0342
changelog:
  - !17822  iwlwifi: Add missing check for alloc_ordered_workqueue
  - !17814  crypto: ccp - Fix crash when rebind ccp device for ccp.ko
  - !17819  jbd2: prevent softlockup in jbd2_log_do_checkpoint()
  - !17829  ipv6: reject malicious packets in ipv6_gso_segment()
  - !17827  net/packet: fix a race in packet_set_ring() and packet_notifier()
  - !17828  vsock: Do not allow binding to VMADDR_PORT_ANY
  - ipv6: reject malicious packets in ipv6_gso_segment()
  - vsock: Do not allow binding to VMADDR_PORT_ANY
  - net/packet: fix a race in packet_set_ring() and packet_notifier()
  - iwlwifi: Add missing check for alloc_ordered_workqueue
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint()
  - !17812  net: bridge: fix soft lockup in br_multicast_query_expired()
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko
  - net: bridge: fix soft lockup in br_multicast_query_expired()
  - !17528  clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
  - !17761  Fix oob when trace_get_user failed
  - tracing: Limit access to parser->buffer when trace_get_user failed
  - tracing: Remove unneeded goto out logic
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2509.4.0.0343
changelog:
  - !17935  ftrace: Also allocate and copy hash for reading of filter files
  - ftrace: Also allocate and copy hash for reading of filter files
  - !17920  x86/smp: ignore reboot IPI when stopping_cpu contains value
  - x86/smp: ignore reboot IPI when stopping_cpu contains value
  - !17905 [openEuler-1.0-LTS] perf/zhaoxin/uncore: Enhance uncore support and fix related
  - perf/zhaoxin/uncore: Enhance uncore support and fix related bugs
  - !17891  wifi: mac80211: reject TDLS operations when station is not associated
  - !17873  blk-cgroup: Use cond_resched() when destroy blkgs
  - wifi: mac80211: reject TDLS operations when station is not associated
  - !17878  Fix CVE-2025-38498
  - !17843  NFSv4: Fail mounts if the lease setup times out
  - use uniform permission checks for all mount propagation changes
  - do_change_type(): refuse to operate on unmounted/not ours mounts
  - blk-cgroup: Use cond_resched() when destroy blkgs
  - NFSv4: Fail mounts if the lease setup times out


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2509.5.0.0344
changelog:
  - !8566 [openEuler-1.0-LTS] Update a series of xhci-related Zhaoxin patches
  - !18002  gfs2: Validate i_depth for exhash directories
  - !17998  fix CVE-2025-38449
  - gfs2: Validate i_depth for exhash directories
  - drm: fix kabi for struct drm_framebuffer
  - drm/gem: Acquire references on GEM handles for framebuffers
  - drm/print: introduce new struct drm_device based WARN* macros
  - xhci: Add ZHAOXIN xHCI host U1/U2 feature support
  - Revert "xhci: Add Zhaoxin xHCI LPM U1/U2 feature support"
  - xhci: Show ZHAOXIN xHCI root hub speed correctly
  - Revert "xhci: Show Zhaoxin XHCI root hub speed correctly"
  - Revert "xhci: Fix a logic issue when display Zhaoxin XHCI root hub speed"
  - xhci: Fix TRB prefetch issue of ZHAOXIN hosts
  - Revert "xhci: fix issue of cross page boundary in TRB prefetch"
  - xhci: Fix resume issue of some ZHAOXIN hosts
  - Revert "xhci: fix issue with resume from system Sx state"


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2509.6.0.0345
changelog:
  - !18098  drivers: serial: jsm: fix some leaks in probe
  - !18074  tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
  - !18085  Fix CVE-2022-50343
  - !18022  ALSA: usb-audio: Validate UAC3 power domain descriptors, too
  - drivers: serial: jsm: fix some leaks in probe
  - rapidio: fix possible name leaks when rio_add_device() fails
  - tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2510.1.0.0346
changelog:
  - !17921  nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
  - !18255  scsi: qla2xxx: Pointer may be dereferenced
  - !18257  udf: Do not update file length for failed writes to inline files
  - !18261  drm/radeon: Fix integer overflow in radeon_cs_parser_init
  - !18174  fix CVE-2022-50384 and CVE-2022-50249
  - !18252  mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init
  - udf: Do not update file length for failed writes to inline files
  - scsi: qla2xxx: Pointer may be dereferenced
  - !18163  x86/MCE: Always save CS register on AMD Zen IF Poison errors
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
  - !18185  crypto: cavium - prevent integer overflow loading firmware
  - !18113  wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
  - !18198  drm/radeon: Add the missed acpi_put_table() to fix memory leak
  - !18187  media: uvcvideo: Handle cameras with invalid descriptors
  - !18134  wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
  - !18181  udf: Fix uninitialized array access for some pathnames
  - !18139  ALSA: hda: Fix Oops by 9.1 surround channel names
  - !18141  sched/core: Fix potential deadlock on rq lock
  - !18121  nfsd: call op_release, even when op_func returns an error
  - !18148  rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
  - !18158  firewire: net: fix use after free in fwnet_finish_incoming_packet()
  - !18109  recordmcount: Fix memory leaks in the uwrite function
  - drm/radeon: Add the missed acpi_put_table() to fix memory leak
  - media: uvcvideo: Handle cameras with invalid descriptors
  - crypto: cavium - prevent integer overflow loading firmware
  - !18136  sched/fair: Don't balance task to its current running CPU
  - !18137  VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
  - udf: Fix uninitialized array access for some pathnames
  - staging: vme_user: Fix possible UAF in tsi148_dma_list_add
  - memory: of: Fix refcount leak bug in of_get_ddr_timings()
  - !18142  Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
  - x86/MCE: Always save CS register on AMD Zen IF Poison errors
  - firewire: net: fix use after free in fwnet_finish_incoming_packet()
  - !18135  wifi: ath9k: verify the expected usb_endpoints are present
  - !18108  tee: fix NULL pointer dereference in tee_shm_put
  - !18069  fs: writeback: fix use-after-free in __mark_inode_dirty()
  - !18065  btrfs: fix BUG_ON condition in btrfs_cancel_balance
  - !18132  Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
  - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
  - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
  - sched/core: Fix potential deadlock on rq lock
  - ALSA: hda: Fix Oops by 9.1 surround channel names
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
  - sched/fair: Don't balance task to its current running CPU
  - wifi: ath9k: verify the expected usb_endpoints are present
  - wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
  - !18125  mm: vmscan: fix page cache limit work condition
  - Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
  - !18042  scsi: target: iscsi: Fix a race condition between login_work and the login thread
  - !18039  ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
  - mm: vmscan: fix page cache limit work condition
  - nfsd: call op_release, even when op_func returns an error
  - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
  - recordmcount: Fix memory leaks in the uwrite function
  - tee: fix NULL pointer dereference in tee_shm_put
  - fs: writeback: fix use-after-free in __mark_inode_dirty()
  - btrfs: fix BUG_ON condition in btrfs_cancel_balance
  - scsi: target: iscsi: Fix a race condition between login_work and the login thread
  - ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2510.2.0.0347
changelog:
  - !18323  platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx
  - !18329  umount performance fix
  - !18347  Add Huawei Intelligent Network Card Driver: hinic3
  - !18349  vme: Fix error not catched in fake_init()
  - vme: Fix error not catched in fake_init()
  - Add Huawei Intelligent Network Card Driver: hinic3
  - !18066  NFSD: Protect against send buffer overflow in NFSv2 READ
  - !18337  drm/i915/gvt: fix vgpu debugfs clean in remove
  - !18332  kobject: Add sanity check for kset->kobj.ktype in kset_register()
  - drm/i915/gvt: fix vgpu debugfs clean in remove
  - kobject: Add sanity check for kset->kobj.ktype in kset_register()
  - do_make_slave(): choose new master sanely
  - change_mnt_propagation(): do_make_slave() is a no-op unless IS_MNT_SHARED()
  - change_mnt_propagation() cleanups, step 1
  - !18115  media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
  - !18318  CVE-2023-53254
  - !18317  scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
  - !18302  mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
  - platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
  - drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug
  - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
  - scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
  - mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
  - !18176  fix race between memory offline and UCE handling
  - !18175  watchdog: Fix kmemleak in watchdog_cdev_register
  - !18111  mmc: vub300: fix return value check of mmc_add_host()
  - !18145  PNP: fix name memory leak in pnp_alloc_dev()
  - !18285  Bluetooth: L2CAP: Fix user-after-free
  - Bluetooth: L2CAP: Fix user-after-free
  - !18193 v3  fix CVE-2025-38709
  - !18008  scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
  - !18274  wifi: mwifiex: Fix OOB and integer underflow when rx packets
  - !18238  wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
  - !18239  wifi: mac80211: fix memory leak in ieee80211_if_add()
  - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
  - wifi: mwifiex: Fix missed return in oob checks failed path
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets
  - wifi: mac80211: fix memory leak in ieee80211_if_add()
  - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
  - loop: Avoid updating block size under exclusive owner
  - block: use bd_prepare_to_claim directly in the loop driver
  - mm/memory_hotplug: fix hwpoisoned large folio handling in do_migrate_range()
  - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
  - watchdog: Fix kmemleak in watchdog_cdev_register
  - PNP: fix name memory leak in pnp_alloc_dev()
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
  - mmc: vub300: fix return value check of mmc_add_host()
  - NFSD: Protect against send buffer overflow in NFSv2 READ
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2510.3.0.0348
changelog:
  - !18072  CVE-2023-53431
  - !18469  e1000e: fix heap overflow in e1000_set_eeprom
  - !18396  scsi: target: target_core_configfs: Add length check to avoid buffer overflow
  - !18380  iommu/amd: Fix pci device refcount leak in ppr_notifier()
  - !18379  Fix CVE-2022-50494
  - !18468 scsi/hifc: Fix rport dev loss tmo flag and function parameter check err
  - e1000e: fix heap overflow in e1000_set_eeprom
  - scsi/hifc: Fix rport dev loss tmo flag and function parameter check err
  - !18315  fs: quota: create dedicated workqueue for quota_release_work
  - !18399  scsi: qla4xxx: Add length check when parsing nlattrs
  - !18359  CVE-2022-50341
  - !18210  drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
  - !18209  md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
  - !18208  fix CVE-2023-53357
  - !18207  md/raid10: fix wrong setting of max_corr_read_errors
  - !18206  nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
  - !18205  md/raid10: prevent soft lockup while flush writes
  - !18204  md/raid10: fix leak of 'r10bio->remaining' for recovery
  - !18203  md: Replace snprintf with scnprintf
  - !18408  udf: Do not bother merging very long extents
  - !18373  mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
  - !18377  clk: samsung: Fix memory leak in _samsung_clk_register_pll()
  - !18333  scsi: qla2xxx: Wait for io return on terminate rport
  - !17992  NFS: Fix a race when updating an existing write
  - !18394  ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
  - udf: Do not bother merging very long extents
  - !18375  Enable Huawei Intelligent Network Card Driver: hinic3
  - scsi: qla4xxx: Add length check when parsing nlattrs
  - scsi: target: target_core_configfs: Add length check to avoid buffer overflow
  - ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
  - iommu/amd: Fix pci device refcount leak in ppr_notifier()
  - thermal: intel_powerclamp: Use first online CPU as control_cpu
  - thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
  - clk: samsung: Fix memory leak in _samsung_clk_register_pll()
  - Enable Huawei Intelligent Network Card Driver: hinic3
  - mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
  - !18340  binfmt_misc: fix shift-out-of-bounds in check_special_flags
  - !18355  fix CVE-2023-53560
  - cifs: Remove duplicated include in cifsglob.h
  - cifs: fix oops during encryption
  - tracing/histograms: Return an error if we fail to add histogram to hist_vars list
  - tracing/histograms: Add histograms to hist_vars if they have referenced variables
  - binfmt_misc: fix shift-out-of-bounds in check_special_flags
  - scsi: qla2xxx: Wait for io return on terminate rport
  - fs: quota: create dedicated workqueue for quota_release_work
  - drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
  - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
  - md: fix resync softlockup when bitmap size is less than array size
  - md/bitmap: md_bitmap_get_counter returns wrong blocks
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
  - md/raid10: fix wrong setting of max_corr_read_errors
  - nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
  - md/raid10: prevent soft lockup while flush writes
  - md/raid10: fix leak of 'r10bio->remaining' for recovery
  - md: Replace snprintf with scnprintf
  - scsi: ses: Handle enclosure with just a primary component gracefully
  - scsi: ses: Don't attach if enclosure has no components
  - NFS: Fix a race when updating an existing write


author: liyunfei <liyunfei33@huawei.com> - 17.0.6-11
changelog:
  - update to llvm-for-oe-17.0.6-2509.0.2
  - release-note https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-17.0.6-2509.0.2
  - add fix for Propeller MachineBasicBlock hash set


author: GuoCe <guoce@kylinos.cn> - 3.7.9-37
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Modify the spec file to synchronize the version information of
         CHANGLOG and VERSION.


author: GuoCe <guoce@kylinos.cn> - 3.7.9-39
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: add loongarch64 support and disable valgrind-devel for loongarch64


author: wangshuo <wangshuo@kylinos.cn> - 3.7.9-40
changelog:
  - Type:CVE
  - CVE:CVE-2007-4559
  - SUG:NA
  - DESC:Patch9007-9008, fix CVE-2007-4559
  -      Patch9009, fix test_xml_etree error with expat versions that fix CVE-2023-52425


author: wangshuo <wangshuo@kylinos.cn> - 3.7.9-41
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport upstream patches
  -      gh-104049: do not expose on-disk location from SimpleHTTPRequestHandler
  -      gh-99889: Fix directory traversal security flaw in uu.decode()


author: wangshuo <wangshuo@kylinos.cn> - 3.7.9-43
changelog:
  - Type:CVE
  - CVE:CVE-2024-9287
  - SUG:NA
  - DESC:fix CVE-2024-9287
  -      gh-124651: Quote template strings in `venv` activation scripts


