# changelog

author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.36.0.112
changelog:
  - !1104 [sync] PR-1089:  power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
  - !1109 [sync] PR-1090:  fs/ntfs3: Check fields while reading
  - fs/ntfs3: Check fields while reading
  - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
  - !1062  Support dynamic_hugetlb on arm64 and fix some bug
  - !1058 [sync] PR-1028:  fs: hfsplus: fix UAF issue in hfsplus_put_super
  - mm/dynamic_hugetlb: fix type error of pfn in __hpool_split_gigantic_page()
  - mm/dynamic_hugetlb: set PagePool to bad page
  - mm/dynamic_hugetlb: replace spin_lock with mutex_lock and fix kabi broken
  - mm/dynamic_hugetlb: isolate hugepage without dissolve
  - mm/dynamic_hugetlb: support dynamic hugetlb on arm64
  - mm/dynamic_hugetlb: fix kabi broken when enable CONFIG_DYNAMIC_HUGETLB on arm64
  - !1021 [sync] PR-978:  io_uring: fix the problem of running
  - fs: hfsplus: fix UAF issue in hfsplus_put_super
  - !1051 [sync] PR-1027: scripts: Fix issue of module signing with openssl 3.x
  - scripts: Fix issue of module signing with openssl 3.x
  - !995 [sync] PR-990:  ubi: Fix deadlock caused by recursively holding work_sem
  - !1000 [sync] PR-928:  hikey9xx: Fixed incorrect use of kfree to free sreg
  - !1017 [sync] PR-944:  nbd: get config_lock before sock_shutdown
  - !1011 [sync] PR-924:  dm: add disk before alloc dax
  - !1014 [sync] PR-920:  dm thin: Fix ABBA deadlock by resetting dm_bufio_client
  - !951 [sync] PR-929:  xfs: rework feature flags
  - !972 [sync] PR-969:  kobject: Fix slab-out-of-bounds in fill_kobj_path()
  - !987 [sync] PR-954:  block: iocost bugfix
  - !984 [sync] PR-946:  icost bugfix
  - kernel: don't call do_exit() for PF_IO_WORKER threads
  - x86/process: setup io_threads more like normal user space threads
  - arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread()
  - arch: setup PF_IO_WORKER threads like PF_KTHREAD
  - nbd: get config_lock before sock_shutdown
  - dm thin: Fix ABBA deadlock by resetting dm_bufio_client
  - dm: add disk before alloc dax
  - hikey9xx: Fixed incorrect use of kfree to free sreg
  - ubi: Fix deadlock caused by recursively holding work_sem
  - mtd: ubi: wl: Fix a couple of kernel-doc issues
  - !976 [sync] PR-968:  Fix ORC unwinder on paravirt {save,restore}_fl
  - block: fix order error in blk_release_queue
  - block: fix null-pointer dereference in ioc_pd_init
  - blk-iocost: dispatch all throttled bio in ioc_pd_offline
  - blk-iocost: don't throttle bio if iocg is offlined
  - blk-iocost: track whether iocg is still online
  - blk-iocost: fix UAF in ioc_pd_free
  - x86/unwind: Fix check_paravirt() calls orc_find() before declaration
  - x86/unwind: Fix orc entry for paravirt {save,restore}_fl
  - kobject: Fix slab-out-of-bounds in fill_kobj_path()
  - xfs: kill xfs_sb_version_has_v3inode()
  - xfs: introduce xfs_sb_is_v5 helper
  - xfs: remove unused xfs_sb_version_has wrappers
  - xfs: convert xfs_sb_version_has checks to use mount features
  - xfs: convert scrub to use mount-based feature checks
  - xfs: open code sb verifier feature checks
  - xfs: convert xfs_fs_geometry to use mount feature checks
  - xfs: replace XFS_FORCED_SHUTDOWN with xfs_is_shutdown
  - xfs: convert remaining mount flags to state flags
  - xfs: convert mount flags to features
  - xfs: consolidate mount option features in m_features
  - xfs: replace xfs_sb_version checks with feature flag checks
  - xfs: reflect sb features in xfs_mount
  - xfs: rework attr2 feature and mount options
  - xfs: rename xfs_has_attr()
  - xfs: xfs_is_shutdown vs xlog_is_shutdown cage fight
  - xfs: log items should have a xlog pointer, not a mount
  - xfs: fix incorrect error-out in xfs_remove


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.37.0.113
changelog:
  - !1164 [sync] PR-1098:  proc: allow pid_revalidate() during LOOKUP_RCU
  - !1168 [sync] PR-1162:  fbcon: Check font dimension limits
  - fbcon: Check font dimension limits
  - proc: allow pid_revalidate() during LOOKUP_RCU
  - !582 mm: oom: move memcg_print_bad_task() out of  mem_cgroup_scan_tasks()
  - !1146 [sync] PR-1136:  gfs2: Don't deref jdesc in evict
  - gfs2: Don't deref jdesc in evict
  - !1025 [sync] PR-947:  locking/rwsem: Prevent potential lock starvation
  - !1072 [sync] PR-1042:  xfrm: Reinject transport-mode packets through workqueue
  - !1129 [sync] PR-1077:  drm/qxl: Fix missing free_irq
  - drm/qxl: Fix missing free_irq
  - xfrm: Reinject transport-mode packets through workqueue
  - locking/rwsem: Prevent potential lock starvation
  - locking/rwsem: Pass the current atomic count to rwsem_down_read_slowpath()
  - locking/rwsem: Better collate rwsem_read_trylock()
  - mm: oom: move memcg_print_bad_task() out of mem_cgroup_scan_tasks()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.38.0.114
changelog:
  - !1192 [sync] PR-1178:  memstick: r592: Fix UAF bug in r592_remove due to race condition
  - !1248 [sync] PR-1245:  hugetlb: Fix some incorrect behavior
  - hugetlb: fix hugepages_setup when deal with pernode
  - hugetlb: fix wrong use of nr_online_nodes
  - !1239 [sync] PR-1181:  relayfs: fix out-of-bounds access in relay_file_read
  - relayfs: fix out-of-bounds access in relay_file_read
  - !1210 [sync] PR-1185:  nbd: validate the block size in nbd_set_size
  - !1233 [sync] PR-1220:  mm/memory_hotplug: extend offline_and_remove_memory() to handle more than one memory block
  - mm/memory_hotplug: extend offline_and_remove_memory() to handle more than one memory block
  - !1225 [sync] PR-1221:  media: rkvdec: fix use after free bug in rkvdec_remove
  - media: rkvdec: fix use after free bug in rkvdec_remove
  - !1199 [sync] PR-1190:  memcg: fix implicit declaration of memcg_print_bad_task()
  - nbd: fix incomplete validation of ioctl arg
  - nbd: validate the block size in nbd_set_size
  - memcg: fix implicit declaration of memcg_print_bad_task()
  - memstick: r592: Fix UAF bug in r592_remove due to race condition
  - !1179 MAINTAINERS: update openEuler/MAINTAINERS for LoongArch
  - MAINTAINERS: update openEuler/MAINTAINERS for LoongArch


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.39.0.116
changelog:
  - !1251 [sync] PR-1191:  fix memory reliable related issues
  - !1230 [sync] PR-1194:  fix memleak with efi_fake_mem
  - !1275 [sync] PR-1253:  media: saa7134: fix use after free bug in saa7134_finidev due to race condition
  - !1302 [sync] PR-1283:  media: dm1105: Fix use after free bug in dm1105_remove due to race condition
  - !1305 [sync] PR-1269:  arm64: Add AMPERE1 to the Spectre-BHB affected list
  - !1300 [sync] PR-1270:  media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
  - arm64: Add AMPERE1 to the Spectre-BHB affected list
  - !1265 [sync] PR-1261:  usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition
  - !1188 [sync] PR-1177:  net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
  - media: saa7134: fix use after free bug in saa7134_finidev due to race condition
  - !1256 [sync] PR-1247:  HID: intel_ish-hid: Add check for ishtp_dma_tx_map
  - usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
  - HID: intel_ish-hid: Add check for ishtp_dma_tx_map
  - efi: Disable mirror feature during crashkernel
  - mm: mem_reliable: Update reliable page counter to zero if underflows
  - mm: mem_reliable: Fix reliable page counter mismatch problem
  - config: Disable EFI_FAKE_MEMMAP support for arm64 by default
  - efi: Fix UAF for arm64 when enable efi_fake_mem
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.40.0.117
changelog:
  - !1367 [sync] PR-1324:  io_uring: hold uring mutex around poll removal
  - !1363 [sync] PR-1287:  ipvlan:Fix out-of-bounds caused by unclear skb->cb
  - io_uring: hold uring mutex around poll removal
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb
  - !1343 [sync] PR-1272:  xfs: fix some problems recently
  - xfs: fix uninitialized variable access
  - xfs: set XFS_FEAT_NLINK correctly
  - xfs: don't leak perag when growfs fails
  - xfs: factor out xfs_destroy_perag()
  - xfs: fix warning in xfs_vm_writepages()
  - xfs: don't leak intent item when recovery intents fail
  - xfs: factor out xfs_defer_pending_abort
  - xfs: fix mounting failed caused by sequencing problem in the log records
  - Fix x86 provides error symbol


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.41.0.118
changelog:
  - !1290 [sync] PR-1262:  drm/msm/dpu: Add check for pstates
  - !1456 [sync] PR-1358:  Remove DECnet support from kernel
  - !1439 [sync] PR-1426:  netfilter: nf_tables: do not ignore genmask when looking up chain by id
  - !1460 [sync] PR-1425:  loop: loop_set_status_from_info() check before assignment
  - !1463 [sync] PR-1436: Fix CVE-2023-3117
  - !1318 [sync] PR-1285:  nbd: fix null-ptr-dereference while accessing 'nbd->config'
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
  - netfilter: nf_tables: fix chain binding transaction logic
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
  - loop: loop_set_status_from_info() check before assignment
  - Remove DECnet support from kernel
  - netfilter: nf_tables: do not ignore genmask when looking up chain by id
  - !1420 [sync] PR-1415:  Fix generic/299 fail
  - !1378 [sync] PR-1295:  blk-wbt: don't show valid wbt_lat_usec in
  - ext4: Add debug message to notify user space is out of free
  - Revert "ext4: Stop trying writing pages if no free blocks generated"
  - Merge branch 'openEuler-22.03-LTS-SP1' of https://gitee.com/openeuler/kernel into openEuler-22.03-LTS-SP1
  - !759 【kernel-openEuler-22.03-LTS-SP1】kernel：fix a type error with 5.10 kernel on openEuler 22.03 LTS SP1 system
  - Merge branch 'openEuler-22.03-LTS-SP1' of https://gitee.com/openeuler/kernel into openEuler-22.03-LTS-SP1
  - ubifs: Fix memory leak in do_rename
  - ubifs: Free memory for tmpfile name
  - !1389 [sync] PR-1312:  quota: fix race condition between dqput() and dquot_mark_dquot_dirty()
  - !1392 [sync] PR-1376:  jbd2: Check 'jh->b_transaction' before remove it from checkpoint
  - !1308 [sync] PR-1280: cgroup: always put cset in cgroup_css_set_put_fork
  - jbd2: Check 'jh->b_transaction' before remove it from checkpoint
  - quota: simplify drop_dquot_ref()
  - quota: fix dqput() to follow the guarantees dquot_srcu should provide
  - quota: add new helper dquot_active()
  - quota: rename dquot_active() to inode_quota_active()
  - quota: factor out dquot_write_dquot()
  - Merge branch 'openEuler-22.03-LTS-SP1' of https://gitee.com/openeuler/kernel into openEuler-22.03-LTS-SP1
  - !1329 [sync] PR-1325:  jbd2: fix several checkpoint
  - !1332 [sync] PR-1314:  ext4: Stop trying writing pages if no free blocks generated
  - dm thin: fix deadlock when swapping to thin device
  - blk-wbt: don't show valid wbt_lat_usec in sysfs while wbt is disabled
  - blk-wbt: make enable_state more accurate
  - !1340 [sync] PR-1286:  ext4: turning quotas off if mount failed after enable quotas
  - ext4: turning quotas off if mount failed after enable quotas
  - ext4: Stop trying writing pages if no free blocks generated
  - jbd2: fix checkpoint cleanup performance regression
  - jbd2: remove __journal_try_to_free_buffer()
  - jbd2: fix a race when checking checkpoint buffer busy
  - jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
  - jbd2: remove journal_clean_one_cp_list()
  - nbd: fix null-ptr-dereference while accessing 'nbd->config'
  - nbd: factor out a helper to get nbd_config without holding 'config_lock'
  - nbd: fold nbd config initialization into nbd_alloc_config()
  - cgroup: always put cset in cgroup_css_set_put_fork
  - drm/msm/dpu: Add check for pstates
  - spdxcheck.py: Fix a type error


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.42.0.120
changelog:
  - !1525 [sync] PR-1482:  CVE-2023-3567 fix patches
  - !1336 [sync] PR-1335:  bpf: Fix incorrect verifier pruning due to missing register precision taints
  - vc_screen: modify vcs_size() handling in vcs_read()
  - vc_screen: don't clobber return value in vcs_read
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
  - !1490 [sync] PR-1476:  ipv6/addrconf: fix a potential refcount underflow for idev
  - !1486 [sync] PR-1452:  media: dvb-core: Fix use-after-free due on race condition at dvb_net
  - !1495 [sync] PR-1445:  netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
  - ipv6/addrconf: fix a potential refcount underflow for idev
  - media: dvb-core: Fix use-after-free due on race condition at dvb_net
  - !1422 [sync] PR-1254:  Two CVE fixes of ksmbd
  - ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem()
  - ksmbd: fix memleak in session setup
  - bpf: Fix incorrect verifier pruning due to missing register precision taints


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.43.0.121
changelog:
  - !1588 [sync] PR-1557:  net/sched: cls_fw: Fix improper refcount update leads to use-after-free
  - !1583 [sync] PR-1480:  ksmbd: fix wrong UserName check in session_user
  - !1599 [sync] PR-1547:  binder: fix UAF caused by faulty buffer cleanup
  - !1602 [sync] PR-1581:  psi: fix compile error for psi cgroupv1 when CONFIG_CGROUP=n
  - !1615 [sync] PR-1591:  net/sched: cls_u32: Fix reference counter leak leading to overflow
  - net/sched: cls_u32: Fix reference counter leak leading to overflow
  - !1593 [sync] PR-1585:  ksmbd: fix global-out-of-bounds in smb2_find_context_vals
  - psi: fix compile error for psi cgroupv1 when CONFIG_CGROUP=n
  - binder: fix UAF caused by faulty buffer cleanup
  - ksmbd: fix global-out-of-bounds in smb2_find_context_vals
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free
  - ksmbd: fix wrong UserName check in session_user
  - !1465 [sync] PR-1428:  scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
  - !1574 [sync] PR-1535:  net/sched: sch_qfq: account for stab overhead in qfq_enqueue
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue
  - !1559 [sync] PR-1548:  mm: memcontrol: fix cannot alloc the maximum memcg ID
  - !1362 [sync] PR-1294:  dm stats: check for and propagate alloc_percpu failure
  - !1503  block: don't set GD_NEED_PART_SCAN if scan partition failed
  - !1478 [sync] PR-1345:  dm: requeue IO if mapping table not yet
  - mm: memcontrol: fix cannot alloc the maximum memcg ID
  - block: don't set GD_NEED_PART_SCAN if scan partition failed
  - dm: don't lock fs when the map is NULL during suspend or resume
  - dm: don't lock fs when the map is NULL in process of resume
  - dm: requeue IO if mapping table not yet available
  - Revert "dm: make sure dm_table is binded before queue request"
  - scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
  - dm stats: check for and propagate alloc_percpu failure


author: zhouwenpei <zhouwenpei1@h-partners.com> - 4.3.0-23
changelog:
  - fix CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799,
  - fix CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804


author: renmingshuai<renmingshuai@huawei.com> - 8.8p1-20
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport some upstream patches and modify some patches numbers


author: <xufei30@huawei.com> - 10:6.2.0-67
changelog:
  - hw/net/vmxnet3: Log guest-triggerable errors using LOG_GUEST_ERROR mainline
  - net/eth: Don't consider ESP to be an IPv6 option header mainline
  - net: Fix uninitialized data usage mainline
  - block-backend: prevent dangling BDS pointers across aio_poll() mainline inclusion
  - i386: add notify VM exit support
  - kvm: expose struct KVMState
  - kvm: allow target-specific accelerator properties
  - i386: kvm: extend kvm_{get, put}_vcpu_events to support pending triple fault
  - linux-headers: include missing changes from 6.0
  - dsoundaudio: fix crackling audio recordings mainline
  - hw/audio/intel-hda: fix stream reset mainline
  - hw/pvrdma: Protect against buggy or malicious guest driver
  - qemu support for loongarch
  - hw/pci: Trace IRQ routing on PCI topology
  - hw/pci: Fix a typo
  - hw/riscv: virt: Simplify virt_{get,set}_aclint()
  - curl: Fix error path in curl_open()
  - tests: add (riscv virt) machine mapping to testenv from v7.0.0
  - tests/tcg: Fix target-specific Makefile variables  path for user-mode mainline
  - hw/core/machine:Fix the missing consideration of cluster-id
  - arm/virt: Correct timing of pause all vcpus for hot-plugged CPUs
  - arm/virt: Correct timing of executing cpu_synchronize_post_init for hot-plugged cpus
  - hw/acpi: Support acpi-ged to report CPU's OST info
  - hw/acpi: Add ospm_status hook implementation for acpi-ged
  - fix qmp command migrate-set-parameters


author: <xufei30@huawei.com> - 10:6.2.0-71
changelog:
  - vhost-user-blk: fix the resize crash
  - plugins: make qemu_plugin_user_exit's locking order consistent with fork_start's
  - linux-user: fix strace build w/out munlockall
  - ui: fix crash on serial reset, during init
  - qga/win/vss: requester_freeze changes
  - migration: fix populate_vfio_info
  - block/rbd: workaround for ceph issue #53784
  - target/i386: add FZRM, FSRS, FSRC
  - i386: Add new CPU model SapphireRapids
  - core/cpu-common: Fix the wrong '#ifdef __aarch64__'


author: <xufei30@huawei.com> - 10:6.2.0-72
changelog:
  - migration/xbzrle: fix out-of-bounds write with axv512
  - migration/xbzrle: use ctz64 to avoid undefined result
  - Update bench-code for addressing CI problem
  - AVX512 support for xbzrle_encode_buffer
  - configure, meson: move AVX tests to meson
  - target/i386: KVM: allow fast string operations if host supports them
  - target/i386: add FSRM to TCG
  - hw/nvme: fix memory leak in nvme_dsm
  - aio-posix: fix race between epoll upgrade and aio_set_fd_handler()
  - target/i386: Add SGX aex-notify and EDECCSSA support
  - hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
  - target/i386: Set maximum APIC ID to KVM prior to vCPU creation
  - target/i386: Fix sanity check on max APIC ID / X2APIC enablement


author: <fengjiabo1@huawei.com> - 10:6.2.0-75
changelog:
  - Add lbt support for kvm.
  - Fix smp.cores value and Fix divide 0 error
  - hw/nvme: Change alignment in dma functions for nvme_blk_*
  - virtio: fix reachable assertion due to stale value of cached region size
  - hw/nvme: fix missing DNR on compare failure


author: <fengjiabo1@huawei.com> - 10:6.2.0-76
changelog:
  - qga/win32: Use rundll for VSS installation
  - qga/win32: Remove change action from MSI installer
  - ide: Increment BB in-flight counter for TRIM BH
  - hw/pci-bridge/pxb: Fix missing swizzle
  - host-vdpa: make notifiers _init()/_uninit() symmetric
  - hw/virtio: vdpa: Fix leak of host-notifier memory-region
  - accel/tcg/cpu-exec: Fix precise single-stepping after interrupt
  - Allow setting up to 8 bytes with the generic loader
  - hw/net/virtio-net: make some VirtIONet const
  - accel/tcg: Optimize jump cache flush during tlb range flush
  - 9pfs: prevent opening special files (CVE-2023-2861)
  - tcg: Reduce tcg_assert_listed_vecop() scope
  - gitlab: Disable plugins for cross-i386-tci
  - vfio/pci: Fix a segfault in vfio_realize
  - block/iscsi: fix double-free on BUSY or similar statuses
  - tests/tcg: fix unused variable in linux-test
  - hw/net/vmxnet3: allow VMXNET3_MAX_MTU itself as a value
  - qga/vss-win32: fix warning for clang++-15
  - vnc: avoid underflow when accessing user-provided address
  - block/monitor: Fix crash when executing HMP commit
  - virtio-gpu: add a FIXME for virtio_gpu_load()
  - hw/ppc/Kconfig: MAC_NEWWORLD should always select USB_OHCI_PCI
  - migration: report compress thread pid to libvirt


