# changelog

author: Huawei Technologies Co., Ltd. <pannengyuan@huawei.com>
changelog:
  - migration/ram: do error_free after migrate_set_error to avoid memleaks.
  - migration/ram: fix memleaks in multifd_new_send_channel_async.
  - migration/rdma: fix a memleak on error path in rdma_start_incoming_migration.


author: Huawei Technologies Co., Ltd. <fangying1@huawei.com>
changelog:
  - ide: Fix incorrect handling of some PRDTs in ide_dma_cb()
  - ati-vga: Fix checks in ati_2d_blt() to avoid crash
  - slirp: tftp: restrict relative path access


author: Huawei Technologies Co., Ltd. <fangying1@huawei.com>
changelog:
  - ip_reass: Fix use after free
  - bt: use size_t type for length parameters instead of int
  - log: Add some logs on VM runtime path


author: Huawei Technologies Co., Ltd. <fangying1@huawei.com>
changelog:
  - Revert: "vtimer: compat cross version migration from v4.0.1"
  - ARM64: record vtimer tick when cpu is stopped
  - hw/arm/virt: add missing compat for kvm-no-adjvtime
  - migration: Compat virtual timer adjust for v4.0.1 and v4.1.0
  - vtimer: Drop vtimer virtual timer adjust


author: Huawei Technologies Co., Ltd <zhang.zhanghailiang@huawei.com>
changelog:
  - es1370: check total frame count against current frame
  - exec: set map length to zero when returning NULL
  - ati-vga: check mm_index before recursive call (CVE-2020-13800)
  - megasas: use unsigned type for reply_queue_head and check index
  - megasas: avoid NULL pointer dereference
  - megasas: use unsigned type for positive numeric fields
  - hw/scsi/megasas: Fix possible out-of-bounds array access in tracepoints


