# changelog

author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.40.0.117
changelog:
  - !1367 [sync] PR-1324:  io_uring: hold uring mutex around poll removal
  - !1363 [sync] PR-1287:  ipvlan:Fix out-of-bounds caused by unclear skb->cb
  - io_uring: hold uring mutex around poll removal
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb
  - !1343 [sync] PR-1272:  xfs: fix some problems recently
  - xfs: fix uninitialized variable access
  - xfs: set XFS_FEAT_NLINK correctly
  - xfs: don't leak perag when growfs fails
  - xfs: factor out xfs_destroy_perag()
  - xfs: fix warning in xfs_vm_writepages()
  - xfs: don't leak intent item when recovery intents fail
  - xfs: factor out xfs_defer_pending_abort
  - xfs: fix mounting failed caused by sequencing problem in the log records
  - Fix x86 provides error symbol


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.41.0.118
changelog:
  - !1290 [sync] PR-1262:  drm/msm/dpu: Add check for pstates
  - !1456 [sync] PR-1358:  Remove DECnet support from kernel
  - !1439 [sync] PR-1426:  netfilter: nf_tables: do not ignore genmask when looking up chain by id
  - !1460 [sync] PR-1425:  loop: loop_set_status_from_info() check before assignment
  - !1463 [sync] PR-1436: Fix CVE-2023-3117
  - !1318 [sync] PR-1285:  nbd: fix null-ptr-dereference while accessing 'nbd->config'
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
  - netfilter: nf_tables: fix chain binding transaction logic
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
  - loop: loop_set_status_from_info() check before assignment
  - Remove DECnet support from kernel
  - netfilter: nf_tables: do not ignore genmask when looking up chain by id
  - !1420 [sync] PR-1415:  Fix generic/299 fail
  - !1378 [sync] PR-1295:  blk-wbt: don't show valid wbt_lat_usec in
  - ext4: Add debug message to notify user space is out of free
  - Revert "ext4: Stop trying writing pages if no free blocks generated"
  - Merge branch 'openEuler-22.03-LTS-SP1' of https://gitee.com/openeuler/kernel into openEuler-22.03-LTS-SP1
  - !759 【kernel-openEuler-22.03-LTS-SP1】kernel：fix a type error with 5.10 kernel on openEuler 22.03 LTS SP1 system
  - Merge branch 'openEuler-22.03-LTS-SP1' of https://gitee.com/openeuler/kernel into openEuler-22.03-LTS-SP1
  - ubifs: Fix memory leak in do_rename
  - ubifs: Free memory for tmpfile name
  - !1389 [sync] PR-1312:  quota: fix race condition between dqput() and dquot_mark_dquot_dirty()
  - !1392 [sync] PR-1376:  jbd2: Check 'jh->b_transaction' before remove it from checkpoint
  - !1308 [sync] PR-1280: cgroup: always put cset in cgroup_css_set_put_fork
  - jbd2: Check 'jh->b_transaction' before remove it from checkpoint
  - quota: simplify drop_dquot_ref()
  - quota: fix dqput() to follow the guarantees dquot_srcu should provide
  - quota: add new helper dquot_active()
  - quota: rename dquot_active() to inode_quota_active()
  - quota: factor out dquot_write_dquot()
  - Merge branch 'openEuler-22.03-LTS-SP1' of https://gitee.com/openeuler/kernel into openEuler-22.03-LTS-SP1
  - !1329 [sync] PR-1325:  jbd2: fix several checkpoint
  - !1332 [sync] PR-1314:  ext4: Stop trying writing pages if no free blocks generated
  - dm thin: fix deadlock when swapping to thin device
  - blk-wbt: don't show valid wbt_lat_usec in sysfs while wbt is disabled
  - blk-wbt: make enable_state more accurate
  - !1340 [sync] PR-1286:  ext4: turning quotas off if mount failed after enable quotas
  - ext4: turning quotas off if mount failed after enable quotas
  - ext4: Stop trying writing pages if no free blocks generated
  - jbd2: fix checkpoint cleanup performance regression
  - jbd2: remove __journal_try_to_free_buffer()
  - jbd2: fix a race when checking checkpoint buffer busy
  - jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
  - jbd2: remove journal_clean_one_cp_list()
  - nbd: fix null-ptr-dereference while accessing 'nbd->config'
  - nbd: factor out a helper to get nbd_config without holding 'config_lock'
  - nbd: fold nbd config initialization into nbd_alloc_config()
  - cgroup: always put cset in cgroup_css_set_put_fork
  - drm/msm/dpu: Add check for pstates
  - spdxcheck.py: Fix a type error


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.42.0.120
changelog:
  - !1525 [sync] PR-1482:  CVE-2023-3567 fix patches
  - !1336 [sync] PR-1335:  bpf: Fix incorrect verifier pruning due to missing register precision taints
  - vc_screen: modify vcs_size() handling in vcs_read()
  - vc_screen: don't clobber return value in vcs_read
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
  - !1490 [sync] PR-1476:  ipv6/addrconf: fix a potential refcount underflow for idev
  - !1486 [sync] PR-1452:  media: dvb-core: Fix use-after-free due on race condition at dvb_net
  - !1495 [sync] PR-1445:  netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
  - ipv6/addrconf: fix a potential refcount underflow for idev
  - media: dvb-core: Fix use-after-free due on race condition at dvb_net
  - !1422 [sync] PR-1254:  Two CVE fixes of ksmbd
  - ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem()
  - ksmbd: fix memleak in session setup
  - bpf: Fix incorrect verifier pruning due to missing register precision taints


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.43.0.121
changelog:
  - !1588 [sync] PR-1557:  net/sched: cls_fw: Fix improper refcount update leads to use-after-free
  - !1583 [sync] PR-1480:  ksmbd: fix wrong UserName check in session_user
  - !1599 [sync] PR-1547:  binder: fix UAF caused by faulty buffer cleanup
  - !1602 [sync] PR-1581:  psi: fix compile error for psi cgroupv1 when CONFIG_CGROUP=n
  - !1615 [sync] PR-1591:  net/sched: cls_u32: Fix reference counter leak leading to overflow
  - net/sched: cls_u32: Fix reference counter leak leading to overflow
  - !1593 [sync] PR-1585:  ksmbd: fix global-out-of-bounds in smb2_find_context_vals
  - psi: fix compile error for psi cgroupv1 when CONFIG_CGROUP=n
  - binder: fix UAF caused by faulty buffer cleanup
  - ksmbd: fix global-out-of-bounds in smb2_find_context_vals
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free
  - ksmbd: fix wrong UserName check in session_user
  - !1465 [sync] PR-1428:  scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
  - !1574 [sync] PR-1535:  net/sched: sch_qfq: account for stab overhead in qfq_enqueue
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue
  - !1559 [sync] PR-1548:  mm: memcontrol: fix cannot alloc the maximum memcg ID
  - !1362 [sync] PR-1294:  dm stats: check for and propagate alloc_percpu failure
  - !1503  block: don't set GD_NEED_PART_SCAN if scan partition failed
  - !1478 [sync] PR-1345:  dm: requeue IO if mapping table not yet
  - mm: memcontrol: fix cannot alloc the maximum memcg ID
  - block: don't set GD_NEED_PART_SCAN if scan partition failed
  - dm: don't lock fs when the map is NULL during suspend or resume
  - dm: don't lock fs when the map is NULL in process of resume
  - dm: requeue IO if mapping table not yet available
  - Revert "dm: make sure dm_table is binded before queue request"
  - scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
  - dm stats: check for and propagate alloc_percpu failure


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.44.0.122
changelog:
  - !1703 [sync] PR-1682:  netfilter: nft_set_pipapo: fix improper element removal
  - !1675 [sync] PR-1596:  ksmbd: fix out-of-bound read in deassemble_neg_contexts()
  - netfilter: nft_set_pipapo: fix improper element removal
  - !1642 [sync] PR-1551:  ksmbd: allocate one more byte for implied bcc[0
  - !1644 [sync] PR-1605:  CVE-2023-38430
  - ksmbd: fix out-of-bound read in deassemble_neg_contexts()
  - ksmbd: validate smb request protocol id
  - ksmbd: define SMB2_COMPRESSION_TRANSFORM_ID in fs/ksmbd/smb2pdu.h
  - ksmbd: allocate one more byte for implied bcc[0]
  - ksmbd: validate smb request protocol id
  - ksmbd: define SMB2_COMPRESSION_TRANSFORM_ID in fs/ksmbd/smb2pdu.h


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.45.0.123
changelog:
  - !1757 [sync] PR-1742:  cxgb4: fix use after free bugs caused by circular dependency problem
  - !1764 [sync] PR-1749:  Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync()
  - !1669 [sync] PR-1657:  media: usb: siano: Fix CVE-2023-4132
  - Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync()
  - !1754 [sync] PR-1737:  ksmbd: fix out of bounds read in smb2_sess_setup
  - cxgb4: fix use after free bugs caused by circular dependency problem
  - !1745 [sync] PR-1727:  add support for timer_shutdown() api
  - !1732 [sync] PR-1713:  netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
  - ksmbd: fix out of bounds read in smb2_sess_setup
  - timers: Keep del_timer[_sync]() exported
  - timers: Provide timer_shutdown[_sync]()
  - timers: Add shutdown mechanism to the internal functions
  - timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode
  - timers: Silently ignore timers with a NULL function
  - timers: Rename del_timer() to timer_delete()
  - timers: Rename del_timer_sync() to timer_delete_sync()
  - timers: Use del_timer_sync() even on UP
  - timers: Update kernel-doc for various functions
  - timers: Replace BUG_ON()s
  - timers: Get rid of del_singleshot_timer_sync()
  - sw64: Do not use timer namespace for timer_shutdown() function
  - clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function
  - clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function
  - ARM: spear: Do not use timer namespace for timer_shutdown() function
  - !1715 [sync] PR-1711:  xfrm: add NULL check in xfrm_update_ae_params
  - !1633 [sync] PR-1604:  net: nfc: Fix CVE-2023-3863
  - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
  - xfrm: add NULL check in xfrm_update_ae_params
  - media: usb: siano: Fix warning due to null work_func_t function pointer
  - media: usb: siano: Fix use after free bugs caused by do_submit_urb
  - net: nfc: Fix use-after-free caused by nfc_llcp_find_local
  - nfc: llcp: simplify llcp_sock_connect() error paths


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.46.0.124
changelog:
  - !1839  fix CVE-2023-20593 for openEuler
  - tools arch x86: Sync the msr-index.h copy with the kernel sources
  - x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
  - x86/cpu/amd: Add a Zenbleed fix
  - x86/cpu/amd: Move the errata checking functionality up
  - x86/cpu: Restore AMD's DE_CFG MSR after resume
  - !1776 [sync] PR-1729:  fix CVE-2023-4128 in OLK510
  - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
  - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.47.0.125
changelog:
  - !1892 [sync] PR-1784:  tun/tap: fix CVE-2023-4194
  - !1886 [sync] PR-1815:  Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
  - !1867 [sync] PR-1821:  nbd: pass nbd_sock to nbd_read_reply() instead of index
  - !1781 [sync] PR-1766:  xen/netback: Fix buffer overrun triggered by unusual packet
  - !1889 [sync] PR-1835:  tcp: Reduce chance of collisions in inet6_hashfn().
  - net: tap_open(): set sk_uid from current_fsuid()
  - net: tun_chr_open(): set sk_uid from current_fsuid()
  - tcp: Reduce chance of collisions in inet6_hashfn().
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
  - !1828 [sync] PR-1813:  ksmbd: fix cve-2023-38432
  - nbd: pass nbd_sock to nbd_read_reply() instead of index
  - ksmbd: validate command request size
  - ksmbd: validate command payload size
  - xen/netback: Fix buffer overrun triggered by unusual packet


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.48.0.126
changelog:
  - !2003 [sync] PR-1911:  ksmbd: fix out-of-bound read in smb2_write
  - !2010  block: don't get gendisk if queue has not been registered
  - block: don't get gendisk if queue has not been registered
  - !1627 [sync] PR-1621:  fix three CVEs by backport mainline patchs
  - !1818 [sync] PR-1788:  exfat: check if filename entries exceeds max filename length
  - ksmbd: fix out-of-bound read in smb2_write
  - !1980 [sync] PR-1446:  Fix the default return value of dm_pool_dec_data_range()
  - Fix the default return value of dm_pool_dec_data_range()
  - !1385 [sync] PR-1346:  dm thin metadata: check fail_io before using data_sm
  - exfat: check if filename entries exceeds max filename length
  - ksmbd: fix racy issue from session setup and logoff
  - ksmbd: Fix spelling mistake "excceed" -> "exceeded"
  - ksmbd: limit pdu length size according to connection status
  - ksmbd: Implements sess->ksmbd_chann_list as xarray
  - dm thin metadata: check fail_io before using data_sm


author: wangbin <wangbin224@huawei.com> - 7.3.0-5
changelog:
  - Handle task_struct cpu member changes for kernels >= 5.16-rc1
    and delete use_system_readline_v3.patch


author: jiangheng12 <jiangheng14@huawei.com> - 1.0.1-68
changelog:
  - check return value of hugepage_init to avoid coredump when hugepage memory is insufficient
  - fix core dump when slave mac failed


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-28
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:osdep/linux/hostdisk: Modify sector by sysfs as disk sector
         net/bootp: Fix unchecked return value
         fs/iso9660: Avoid reading past the entry boundary
         fs/iso9660: Incorrect check for entry boundary
         fs/iso9660: Prevent skipping CE or ST at start of continuation area
         fs/iso9660: Prevent read past the end of system use area
         fs/iso9660: Add check to prevent infinite loop
         gentpl.py: Remove .interp section from .img files
         kern/fs: Fix possible integer overflow in i386-pc mode with large partitions
         font: Reject fonts with negative max_char_width or max_char_height
         font: Assign null_font to unknown_glyph
         font: Check return value of grub_malloc() in ascii_glyph_lookup()


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-31
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:kern/acpi: Use xsdt_addr if present
         commands/acpi: Use xsdt_addrifpresent


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-35
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:kern: Check for NULL when closing devices and disks
         kern/efi/mm: Fix use-after-free in finish boot services
         util/grub-install-common: Fix the key of the --core-compress option
         net/dns: Fix lookup error when no IPv6 is returned
         net/dns: Simplify error handling of recv_hook() function
         net/dns: Fix removal of DNS server


author: noah <hedongbo@huawei.com> - 1:18.0.0.37-0.0.ea.rolling
changelog:
  - Update to jdk-18.0.0.0+37
  - adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch


author: DXwangg <wangjiawei80@huawei.com> -1:19.0.0.36-0.0.ea.rolling
changelog:
  - Update to jdk-19.0.0.0+36
  - Remove references to sample directory removed by JDK-8284999
  - Need to include the '.S' suffix in debuginfo checks after JDK-8284661


author: fengtao <fengtao40@huawei.com> - 0.15-5
changelog:
  - we got upgrade error when upgrade json-c from very low version,
    for example json-c-0.11-5. because old version has a softlink:
    /usr/include/json-c  --> /usr/include/json
    and now, softlink has been removed. so, we fix this in pretrans


author: mengkanglai <mengkanglai2@huawei.com> - 0.16-2
changelog:
  - add backport-Add-test-to-check-for-the-memory-leak-mentioned-in-issue-781.patch
  - add backport-Fix-memory-leak-with-emtpy-strings-in-json_object_set_string.patch
  - add backport-json_object_from_fd_ex-fail-if-file-is-too-large.patch


author: sunhai <sunhai10@huawei.com> - 0.16-4
changelog:
  - backport patch to Fix build with clang-15+
  - backport patch to Fix json_tokener_parse_ex: handle out of memory errors


author: zhouwenpei <zhouwenpei1@h-partners.com> - 4.3.0-23
changelog:
  - fix CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799,
  - fix CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804


author: Xiong Zhou <xiongzhou4@huawei.com> 0-2.20211016.gitb72f753
changelog:
  - Type:backport
  - ID:NA
  - SUG:NA
  - DESC: Handle data at the beginning of a function when disassembling and building CFG.


author: xingwei <xingwei14@h-partners.com> - 2:7.92-4
changelog:
  - Type:bugfix
  - CVE:
  - SUG:NA
  - DESC:decouple from PCRE because it has been End-of-life, use local libpcre to build instead


author: panxiaohe <panxh.life@foxmail.com> - 8.0.0-8
changelog:
  - use lmdb instead of Berkeley DB for package dba
  - update %configure for riscv
  - delete unused rcver


