# changelog

author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.37.0.113
changelog:
  - !1164 [sync] PR-1098:  proc: allow pid_revalidate() during LOOKUP_RCU
  - !1168 [sync] PR-1162:  fbcon: Check font dimension limits
  - fbcon: Check font dimension limits
  - proc: allow pid_revalidate() during LOOKUP_RCU
  - !582 mm: oom: move memcg_print_bad_task() out of  mem_cgroup_scan_tasks()
  - !1146 [sync] PR-1136:  gfs2: Don't deref jdesc in evict
  - gfs2: Don't deref jdesc in evict
  - !1025 [sync] PR-947:  locking/rwsem: Prevent potential lock starvation
  - !1072 [sync] PR-1042:  xfrm: Reinject transport-mode packets through workqueue
  - !1129 [sync] PR-1077:  drm/qxl: Fix missing free_irq
  - drm/qxl: Fix missing free_irq
  - xfrm: Reinject transport-mode packets through workqueue
  - locking/rwsem: Prevent potential lock starvation
  - locking/rwsem: Pass the current atomic count to rwsem_down_read_slowpath()
  - locking/rwsem: Better collate rwsem_read_trylock()
  - mm: oom: move memcg_print_bad_task() out of mem_cgroup_scan_tasks()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.38.0.114
changelog:
  - !1192 [sync] PR-1178:  memstick: r592: Fix UAF bug in r592_remove due to race condition
  - !1248 [sync] PR-1245:  hugetlb: Fix some incorrect behavior
  - hugetlb: fix hugepages_setup when deal with pernode
  - hugetlb: fix wrong use of nr_online_nodes
  - !1239 [sync] PR-1181:  relayfs: fix out-of-bounds access in relay_file_read
  - relayfs: fix out-of-bounds access in relay_file_read
  - !1210 [sync] PR-1185:  nbd: validate the block size in nbd_set_size
  - !1233 [sync] PR-1220:  mm/memory_hotplug: extend offline_and_remove_memory() to handle more than one memory block
  - mm/memory_hotplug: extend offline_and_remove_memory() to handle more than one memory block
  - !1225 [sync] PR-1221:  media: rkvdec: fix use after free bug in rkvdec_remove
  - media: rkvdec: fix use after free bug in rkvdec_remove
  - !1199 [sync] PR-1190:  memcg: fix implicit declaration of memcg_print_bad_task()
  - nbd: fix incomplete validation of ioctl arg
  - nbd: validate the block size in nbd_set_size
  - memcg: fix implicit declaration of memcg_print_bad_task()
  - memstick: r592: Fix UAF bug in r592_remove due to race condition
  - !1179 MAINTAINERS: update openEuler/MAINTAINERS for LoongArch
  - MAINTAINERS: update openEuler/MAINTAINERS for LoongArch


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.39.0.116
changelog:
  - !1251 [sync] PR-1191:  fix memory reliable related issues
  - !1230 [sync] PR-1194:  fix memleak with efi_fake_mem
  - !1275 [sync] PR-1253:  media: saa7134: fix use after free bug in saa7134_finidev due to race condition
  - !1302 [sync] PR-1283:  media: dm1105: Fix use after free bug in dm1105_remove due to race condition
  - !1305 [sync] PR-1269:  arm64: Add AMPERE1 to the Spectre-BHB affected list
  - !1300 [sync] PR-1270:  media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
  - arm64: Add AMPERE1 to the Spectre-BHB affected list
  - !1265 [sync] PR-1261:  usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition
  - !1188 [sync] PR-1177:  net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
  - media: saa7134: fix use after free bug in saa7134_finidev due to race condition
  - !1256 [sync] PR-1247:  HID: intel_ish-hid: Add check for ishtp_dma_tx_map
  - usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
  - HID: intel_ish-hid: Add check for ishtp_dma_tx_map
  - efi: Disable mirror feature during crashkernel
  - mm: mem_reliable: Update reliable page counter to zero if underflows
  - mm: mem_reliable: Fix reliable page counter mismatch problem
  - config: Disable EFI_FAKE_MEMMAP support for arm64 by default
  - efi: Fix UAF for arm64 when enable efi_fake_mem
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.40.0.117
changelog:
  - !1367 [sync] PR-1324:  io_uring: hold uring mutex around poll removal
  - !1363 [sync] PR-1287:  ipvlan:Fix out-of-bounds caused by unclear skb->cb
  - io_uring: hold uring mutex around poll removal
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb
  - !1343 [sync] PR-1272:  xfs: fix some problems recently
  - xfs: fix uninitialized variable access
  - xfs: set XFS_FEAT_NLINK correctly
  - xfs: don't leak perag when growfs fails
  - xfs: factor out xfs_destroy_perag()
  - xfs: fix warning in xfs_vm_writepages()
  - xfs: don't leak intent item when recovery intents fail
  - xfs: factor out xfs_defer_pending_abort
  - xfs: fix mounting failed caused by sequencing problem in the log records
  - Fix x86 provides error symbol


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.41.0.118
changelog:
  - !1290 [sync] PR-1262:  drm/msm/dpu: Add check for pstates
  - !1456 [sync] PR-1358:  Remove DECnet support from kernel
  - !1439 [sync] PR-1426:  netfilter: nf_tables: do not ignore genmask when looking up chain by id
  - !1460 [sync] PR-1425:  loop: loop_set_status_from_info() check before assignment
  - !1463 [sync] PR-1436: Fix CVE-2023-3117
  - !1318 [sync] PR-1285:  nbd: fix null-ptr-dereference while accessing 'nbd->config'
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
  - netfilter: nf_tables: fix chain binding transaction logic
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
  - loop: loop_set_status_from_info() check before assignment
  - Remove DECnet support from kernel
  - netfilter: nf_tables: do not ignore genmask when looking up chain by id
  - !1420 [sync] PR-1415:  Fix generic/299 fail
  - !1378 [sync] PR-1295:  blk-wbt: don't show valid wbt_lat_usec in
  - ext4: Add debug message to notify user space is out of free
  - Revert "ext4: Stop trying writing pages if no free blocks generated"
  - Merge branch 'openEuler-22.03-LTS-SP1' of https://gitee.com/openeuler/kernel into openEuler-22.03-LTS-SP1
  - !759 【kernel-openEuler-22.03-LTS-SP1】kernel：fix a type error with 5.10 kernel on openEuler 22.03 LTS SP1 system
  - Merge branch 'openEuler-22.03-LTS-SP1' of https://gitee.com/openeuler/kernel into openEuler-22.03-LTS-SP1
  - ubifs: Fix memory leak in do_rename
  - ubifs: Free memory for tmpfile name
  - !1389 [sync] PR-1312:  quota: fix race condition between dqput() and dquot_mark_dquot_dirty()
  - !1392 [sync] PR-1376:  jbd2: Check 'jh->b_transaction' before remove it from checkpoint
  - !1308 [sync] PR-1280: cgroup: always put cset in cgroup_css_set_put_fork
  - jbd2: Check 'jh->b_transaction' before remove it from checkpoint
  - quota: simplify drop_dquot_ref()
  - quota: fix dqput() to follow the guarantees dquot_srcu should provide
  - quota: add new helper dquot_active()
  - quota: rename dquot_active() to inode_quota_active()
  - quota: factor out dquot_write_dquot()
  - Merge branch 'openEuler-22.03-LTS-SP1' of https://gitee.com/openeuler/kernel into openEuler-22.03-LTS-SP1
  - !1329 [sync] PR-1325:  jbd2: fix several checkpoint
  - !1332 [sync] PR-1314:  ext4: Stop trying writing pages if no free blocks generated
  - dm thin: fix deadlock when swapping to thin device
  - blk-wbt: don't show valid wbt_lat_usec in sysfs while wbt is disabled
  - blk-wbt: make enable_state more accurate
  - !1340 [sync] PR-1286:  ext4: turning quotas off if mount failed after enable quotas
  - ext4: turning quotas off if mount failed after enable quotas
  - ext4: Stop trying writing pages if no free blocks generated
  - jbd2: fix checkpoint cleanup performance regression
  - jbd2: remove __journal_try_to_free_buffer()
  - jbd2: fix a race when checking checkpoint buffer busy
  - jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
  - jbd2: remove journal_clean_one_cp_list()
  - nbd: fix null-ptr-dereference while accessing 'nbd->config'
  - nbd: factor out a helper to get nbd_config without holding 'config_lock'
  - nbd: fold nbd config initialization into nbd_alloc_config()
  - cgroup: always put cset in cgroup_css_set_put_fork
  - drm/msm/dpu: Add check for pstates
  - spdxcheck.py: Fix a type error


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.42.0.120
changelog:
  - !1525 [sync] PR-1482:  CVE-2023-3567 fix patches
  - !1336 [sync] PR-1335:  bpf: Fix incorrect verifier pruning due to missing register precision taints
  - vc_screen: modify vcs_size() handling in vcs_read()
  - vc_screen: don't clobber return value in vcs_read
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
  - !1490 [sync] PR-1476:  ipv6/addrconf: fix a potential refcount underflow for idev
  - !1486 [sync] PR-1452:  media: dvb-core: Fix use-after-free due on race condition at dvb_net
  - !1495 [sync] PR-1445:  netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
  - ipv6/addrconf: fix a potential refcount underflow for idev
  - media: dvb-core: Fix use-after-free due on race condition at dvb_net
  - !1422 [sync] PR-1254:  Two CVE fixes of ksmbd
  - ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem()
  - ksmbd: fix memleak in session setup
  - bpf: Fix incorrect verifier pruning due to missing register precision taints


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.43.0.121
changelog:
  - !1588 [sync] PR-1557:  net/sched: cls_fw: Fix improper refcount update leads to use-after-free
  - !1583 [sync] PR-1480:  ksmbd: fix wrong UserName check in session_user
  - !1599 [sync] PR-1547:  binder: fix UAF caused by faulty buffer cleanup
  - !1602 [sync] PR-1581:  psi: fix compile error for psi cgroupv1 when CONFIG_CGROUP=n
  - !1615 [sync] PR-1591:  net/sched: cls_u32: Fix reference counter leak leading to overflow
  - net/sched: cls_u32: Fix reference counter leak leading to overflow
  - !1593 [sync] PR-1585:  ksmbd: fix global-out-of-bounds in smb2_find_context_vals
  - psi: fix compile error for psi cgroupv1 when CONFIG_CGROUP=n
  - binder: fix UAF caused by faulty buffer cleanup
  - ksmbd: fix global-out-of-bounds in smb2_find_context_vals
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free
  - ksmbd: fix wrong UserName check in session_user
  - !1465 [sync] PR-1428:  scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
  - !1574 [sync] PR-1535:  net/sched: sch_qfq: account for stab overhead in qfq_enqueue
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue
  - !1559 [sync] PR-1548:  mm: memcontrol: fix cannot alloc the maximum memcg ID
  - !1362 [sync] PR-1294:  dm stats: check for and propagate alloc_percpu failure
  - !1503  block: don't set GD_NEED_PART_SCAN if scan partition failed
  - !1478 [sync] PR-1345:  dm: requeue IO if mapping table not yet
  - mm: memcontrol: fix cannot alloc the maximum memcg ID
  - block: don't set GD_NEED_PART_SCAN if scan partition failed
  - dm: don't lock fs when the map is NULL during suspend or resume
  - dm: don't lock fs when the map is NULL in process of resume
  - dm: requeue IO if mapping table not yet available
  - Revert "dm: make sure dm_table is binded before queue request"
  - scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
  - dm stats: check for and propagate alloc_percpu failure


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.44.0.122
changelog:
  - !1703 [sync] PR-1682:  netfilter: nft_set_pipapo: fix improper element removal
  - !1675 [sync] PR-1596:  ksmbd: fix out-of-bound read in deassemble_neg_contexts()
  - netfilter: nft_set_pipapo: fix improper element removal
  - !1642 [sync] PR-1551:  ksmbd: allocate one more byte for implied bcc[0
  - !1644 [sync] PR-1605:  CVE-2023-38430
  - ksmbd: fix out-of-bound read in deassemble_neg_contexts()
  - ksmbd: validate smb request protocol id
  - ksmbd: define SMB2_COMPRESSION_TRANSFORM_ID in fs/ksmbd/smb2pdu.h
  - ksmbd: allocate one more byte for implied bcc[0]
  - ksmbd: validate smb request protocol id
  - ksmbd: define SMB2_COMPRESSION_TRANSFORM_ID in fs/ksmbd/smb2pdu.h


author: chenhaixing <chenhaixing@huawei.com> 4.14.0-12
changelog:
  - CVE:NA
  - SUG:NA
  - DESC:dnf:fix undo error when include rollback of group upgrade
             fix can't download package when url have characters encoded


author: gaihuiying <eaglegai@163.com> - 2.0.11-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix ebtables-config file access permisson
         fix ebt_print_error for prints null


author: wangkai <13474090681@163.com> - 102.13.0-1
changelog:
  - Update to 102.13.0
  - Fix CVE-2023-34416 CVE-2023-34414 CVE-2023-37201 CVE-2023-37202 CVE-2023-37207 CVE-2023-37208 CVE-2023-37211
  - Remove unused patch


author: wangkai <13474090681@163.com> - 102.14.0-1
changelog:
  - Update to 102.14.0
  - Fix CVE-2023-4045 CVE-2023-4046 CVE-2023-4047 CVE-2023-4048 CVE-2023-4049 CVE-2023-4050 CVE-2023-4054 CVE-2023-4055 CVE-2023-4056


author: hanchao <hanchao47@huawei.com> - 1.17.3-12
changelog:
  - Type:CVE
  - CVE:CVE-2022-41716
  - SUG:NA
  - DESC: remove hard code and strong dependency of git, subversion and mercurial


author: hanchao <hanchao47@huawei.com> - 1.17.3-14
changelog:
  - Type:CVE
  - CVE:CVE-2022-23806,CVE-2022-23773,CVE-2022-24921,CVE-2021-44716,CVE-2022-23772,CVE-2022-41717
  - SUG:NA
  - DESC: fix CVE-2022-23806,CVE-2022-23773,CVE-2022-24921,CVE-2021-44716,CVE-2022-23772,CVE-2022-41717


author: hanchao <hanchao47@huawei.com> - 1.17.3-15
changelog:
  - Type:CVE
  - CVE:CVE-2022-41723,CVE-2022-41724,CVE-2022-41725
  - SUG:NA
  - DESC: fix CVE-2022-41723,CVE-2022-41724,CVE-2022-41725


author: hanchao <hanchao47@huawei.com> - 1.17.3-16
changelog:
  - Type:CVE
  - CVE:CVE-2023-24534,CVE-2023-24536,CVE-2023-24537,CVE-2023-24538
  - SUG:NA
  - DESC: fix CVE-2023-24534,CVE-2023-24536,CVE-2023-24537,CVE-2023-24538


author: hanchao <hanchao63@huawei.com> - 1.17.3-18
changelog:
  - Type:CVE
  - CVE:CVE-2023-29400,CVE-2023-24539,CVE-2023-24540
  - SUG:NA
  - DESC: fix CVE-2023-29400,CVE-2023-24539,CVE-2023-24540


author: hanchao <hanchao63@huawei.com> - 1.17.3-19
changelog:
  - Type:CVE
  - CVE:CVE-2023-29402,CVE-2023-29403,CVE-2023-29404,CVE-2023-29405
  - SUG:NA
  - DESC:fix CVE-2023-29402,CVE-2023-29403,CVE-2023-29404,CVE-2023-29405


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-28
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:osdep/linux/hostdisk: Modify sector by sysfs as disk sector
         net/bootp: Fix unchecked return value
         fs/iso9660: Avoid reading past the entry boundary
         fs/iso9660: Incorrect check for entry boundary
         fs/iso9660: Prevent skipping CE or ST at start of continuation area
         fs/iso9660: Prevent read past the end of system use area
         fs/iso9660: Add check to prevent infinite loop
         gentpl.py: Remove .interp section from .img files
         kern/fs: Fix possible integer overflow in i386-pc mode with large partitions
         font: Reject fonts with negative max_char_width or max_char_height
         font: Assign null_font to unknown_glyph
         font: Check return value of grub_malloc() in ascii_glyph_lookup()


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-31
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:kern/acpi: Use xsdt_addr if present
         commands/acpi: Use xsdt_addrifpresent


author: chenyanpanHW <chenyanpan@huawei.com> - 1.2.2-6
changelog:
  - DESC: delete -Sgit from 
  %setup       -q



  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/backport-BUG-fix-a-minor-refcounting-issue-in-Py_FindObjects.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/bin/cat /home/lkp/rpmbuild/SOURCES/backport-BUG-fix-small-refcount-issue-in-ndimage._ctest.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f

  , and delete BuildRequires git


