# changelog

author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-35
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:kern: Check for NULL when closing devices and disks
         kern/efi/mm: Fix use-after-free in finish boot services
         util/grub-install-common: Fix the key of the --core-compress option
         net/dns: Fix lookup error when no IPv6 is returned
         net/dns: Simplify error handling of recv_hook() function
         net/dns: Fix removal of DNS server


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-37
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fs/udf: Fix out of bounds access
         lib/relocator: Fix OOB write when initializing lo->freebytes[]
         util/grub-mount: Fix memory leak in fuse_getattr()


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-38
changelog:
  - Type:CVE
  - CVE:CVE-2023-4692 CVE-2023-4693
  - SUG:NA
  - DESC:fs/ntfs: Make code more readable
         fs/ntfs: Fix an OOB read when parsing a volume label
         fs/ntfs: Fix an OOB read when parsing bitmaps for index attributes
         fs/ntfs: Fix an OOB read when parsing directory entries from resident and non-resident index attributes
         fs/ntfs: Fix an OOB read when reading data from the resident $DATA attribute
         fs/ntfs: Fix an OOB write when parsing the $ATTRIBUTE_LIST attribute for the $MFT file


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-40
changelog:
  - Type:requirement
  - CVE:NA
  - SUG:NA
  - DESC:add TPCM support with ipmi channel
         change the name of module tpcm to tpcm_kunpeng
         skip verification when not loading grub.cfg


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-41
changelog:
  - Type:CVE
  - CVE:CVE-2024-1048
  - SUG:NA
  - DESC:grub-set-bootflag: Fix for CVE-2024-1048
         commands/acpi: Fix calculation of ACPI tables addresses when processing RSDT and XSDT
         kern/acpi: Skip NULL entries in RSDT and XSDT
         util/grub-mount: Check file path sanity


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.58.0.137
changelog:
  - !3625  ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
  - !3622  netfilter: nft_set_pipapo: skip inactive elements during set walk
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
  - netfilter: nft_set_pipapo: skip inactive elements during set walk
  - !3595 [sync] PR-3583:  tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
  - !3581 [sync] PR-3577:  perf/core: Fix CVE-2023-6931
  - perf: Fix perf_event_validate_size() lockdep splat
  - perf: Fix perf_event_validate_size()
  - !3293 [sync] PR-2843:  Add error handle for sd
  - !3290 [sync] PR-3222:  md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk()
  - scsi: sd: Clean up sdkp if device_add_disk() failed
  - scsi: sd: Add error handling support for add_disk()
  - md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk()
  - !3180 [sync] PR-2825:  Add error handle for driver
  - !3016 [sync] PR-1203:  Revert "locking/rwsem: Prevent potential lock starvation"
  - !3230 [sync] PR-3161:  fs: Fix error checking for d_hash_and_lookup()
  - fs: Fix error checking for d_hash_and_lookup()
  - nbd: fix uaf in nbd_open
  - mtd/ubi/block: Fix uaf problem in ubiblock_cleanup
  - mtd/ubi/block: Fix null pointer dereference issue in error path
  - mtd/ubi/block: add error handling support for add_disk()
  - ubi: use blk_mq_alloc_disk and blk_cleanup_disk
  - scsi: sr: Add error handling support for add_disk()
  - block/brd: add error handling support for add_disk()
  - brd: convert to blk_alloc_disk/blk_cleanup_disk
  - nvme: add error handling support for add_disk()
  - nvme: use blk_mq_alloc_disk
  - block: add a flag to make put_disk on partially initalized disks safer
  - nbd: add error handling support for add_disk()
  - nbd: fix order of cleaning up the queue and freeing the tagset
  - nbd: use blk_mq_alloc_disk and blk_cleanup_disk
  - loop: add error handling support for add_disk()
  - loop: fix order of cleaning up the queue and freeing the tagset
  - loop: use blk_mq_alloc_disk and blk_cleanup_disk
  - blk-mq: fix an IS_ERR() vs NULL bug
  - blk-mq: add the blk_mq_alloc_disk APIs
  - block: add blk_alloc_disk and blk_cleanup_disk APIs
  - Revert "locking/rwsem: Better collate rwsem_read_trylock()"
  - Revert "locking/rwsem: Pass the current atomic count to rwsem_down_read_slowpath()"
  - Revert "locking/rwsem: Prevent potential lock starvation"


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.59.0.138
changelog:
  - !3854 [sync] PR-3694:  Fix tow CVEs of CIFS
  - !3765 [sync] PR-3594:  CVE-2023-35827 patchset
  - smb: client: fix potential OOB in smb2_dump_detail()
  - smb: client: fix OOB in smbCalcSize()
  - !3800 [sync] PR-3659:  atm: Fix Use-After-Free in do_vcc_ioctl
  - !3825 [sync] PR-3822:  ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
  - !3798  md: protect md_thread with rcu
  - ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
  - !3781 [sync] PR-3447:  dm: add error handling support for add_disk()
  - !3783 [sync] PR-3379:  md: do not return existing mddevs from mddev_find_or_alloc
  - atm: Fix Use-After-Free in do_vcc_ioctl
  - md: protect md_thread with rcu
  - md/bitmap: factor out a helper to set timeout
  - md/bitmap: always wake up md_thread in timeout_store
  - dm-raid: remove useless checking in raid_message()
  - md: factor out a helper to wake up md_thread directly
  - md: do not return existing mddevs from mddev_find_or_alloc
  - md: refactor mddev_find_or_alloc
  - md: factor out a mddev_alloc_unit helper from mddev_find
  - dm: add error handling support for add_disk()
  - ravb: Fix races between ravb_tx_timeout_work() and net related ops
  - ravb: Fix use-after-free issue in ravb_tx_timeout_work()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.60.0.139
changelog:
  - !3987 [sync] PR-3715:  appletalk: Fix Use-After-Free in atalk_ioctl
  - !3990 [sync] PR-3668:  net/rose: Fix Use-After-Free in rose_ioctl
  - !3984 [sync] PR-3915:  nvmet: nul-terminate the NQNs passed in the connect command
  - !3796 [sync] PR-3771:  ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
  - !3772 [sync] PR-3686:  Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
  - net/rose: Fix Use-After-Free in rose_ioctl
  - appletalk: Fix Use-After-Free in atalk_ioctl
  - nvmet: nul-terminate the NQNs passed in the connect command
  - !3878 [sync] PR-3466:  livepatch/core: Disable support for replacing
  - livepatch/core: Disable support for replacing
  - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
  - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.61.0.141
changelog:
  - !4130 [sync] PR-4100:  netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
  - !4126 [sync] PR-4022:  netfilter: nf_tables: Reject tables of unsupported family
  - !4056  ext4: correct return value of ext4_convert_meta_bg
  - !4060  ext4: synchronize the casefold bugfix from the mainline
  - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
  - netfilter: nf_tables: Reject tables of unsupported family
  - !4078 [sync] PR-4069:  tipc: fix a potential deadlock on &tx->lock
  - !4074 [sync] PR-4064:  smb: client: fix OOB in receive_encrypted_standard()
  - !4017  mm/filemap: avoid buffered read/write race to read inconsistent data
  - tipc: fix a potential deadlock on &tx->lock
  - smb: client: fix OOB in receive_encrypted_standard()
  - !4041 [sync] PR-3981:  vhost: use kzalloc() instead of kmalloc() followed by memset()
  - ext4: improve error handling from ext4_dirhash()
  - ext4: reject casefold inode flag without casefold feature
  - ext4: correct return value of ext4_convert_meta_bg
  - vhost: use kzalloc() instead of kmalloc() followed by memset()
  - mm/filemap: avoid buffered read/write race to read inconsistent data


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.62.0.142
changelog:
  - !4335 [sync] PR-4289:  fs:/dcache.c: fix negative dentry limit not complete problem
  - !4325 [sync] PR-4266:  ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
  - fs:/dcache.c: fix negative dentry limit not complete problem
  - !4286 [sync] PR-4257:  nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
  - ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
  - !4264 [sync] PR-4255:  drm/amdgpu: Fix potential fence use-after-free v2
  - nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
  - !4223 [sync] PR-4213:  netlink: fix potential sleeping issue in mqueue_flush_file
  - !4206 [sync] PR-4203:  mm/dynamic_hugetlb: skip unexpected migration
  - !4005  ext4: fix some ext4_lblk_t overflow issues
  - drm/amdgpu: Fix potential fence use-after-free v2
  - netlink: fix potential sleeping issue in mqueue_flush_file
  - mm/dynamic_hugetlb: skip unexpected migration
  - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS
  - ext4: avoid overlapping preallocations due to overflow
  - ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
  - ext4: add two helper functions extent_logical_end() and pa_logical_end()
  - ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.63.0.143
changelog:
  - !4498 [sync] PR-4362:  ubifs: Queue up space reservation tasks if retrying many times
  - !4447 [sync] PR-4321:  io_uring/af_unix: disable sending io_uring over sockets
  - ubifs: Queue up space reservation tasks if retrying many times
  - !4096 [sync] PR-4090:  ida: Fix crash in ida_free when the bitmap is empty
  - !4420 v2  drm/atomic: Fix potential use-after-free in nonblocking commits
  - io_uring/af_unix: disable sending io_uring over sockets
  - !4118 [sync] PR-3975:  md/raid1-10: limit the number of plugged bio
  - drm/atomic: Fix potential use-after-free in nonblocking commits
  - !3859 [sync] PR-3756:  md: mainline backport
  - !4282 [sync] PR-4270:  fix spinlock already unlocked in inet_csk_reqsk_queue_add' bug
  - !4239 [sync] PR-3228:  net: txgbe: Fix memleak in txgbe_calc_eeprom_checksum()
  - !3362 [sync] PR-1680:  nvme-pci: fix doorbell buffer value endianness
  - !3361 [sync] PR-2188:  nvme-pci: fix mempool alloc size
  - !3023 [sync] PR-1666:  nvme-pci: fix timeout request state check
  - !3359 [sync] PR-2287:  scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
  - !3358 [sync] PR-2286:  scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
  - !3355 [sync] PR-1779:  nvme-pci: clear the prp2 field when not used
  - !3354 [sync] PR-1778:  nvme-pci: fix DMA direction of unmapping integrity data
  - !4194 [sync] PR-4015:  drm/amdgpu: correct the amdgpu runtime dereference usage count
  - !4191 [sync] PR-4014:  drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
  - !4187 [sync] PR-4013:  drm/amdgpu: correct chunk_ptr to a pointer to chunk.
  - !4186 [sync] PR-4012:  drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
  - !4182 [sync] PR-4010:  drm/amd/display: Exit idle optimizations before attempt to access PHY
  - !4181 [sync] PR-3955:  drm/radeon: possible buffer overflow
  - !4226 [sync] PR-4149:  block: remove precise_iostat
  - !4349 [sync] PR-4268:  linux Mainline ubifs Fix Patch bacnport to 5.10
  - ubifs: fix possible dereference after free
  - ubi: block: Fix use-after-free in ubiblock_cleanup
  - Revert "mtd/ubi/block: Fix uaf problem in ubiblock_cleanup"
  - ipv6: init the accept_queue's spinlocks in inet6_create
  - tcp: make sure init the accept_queue's spinlocks once
  - net: txgbe: Fix memleak in txgbe_calc_eeprom_checksum()
  - block: remove precise_iostat
  - drm/amdgpu: correct the amdgpu runtime dereference usage count
  - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
  - drm/amdgpu: correct chunk_ptr to a pointer to chunk.
  - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
  - drm/amd/display: Exit idle optimizations before attempt to access PHY
  - drm/radeon: possible buffer overflow
  - md/raid1-10: fix casting from randomized structure in raid1_submit_write()
  - md/raid1-10: limit the number of plugged bio
  - md/raid1-10: don't handle pluged bio by daemon thread
  - md/md-bitmap: add a new helper to unplug bitmap asynchrously
  - md/raid1-10: submit write io directly if bitmap is not enabled
  - md/raid1-10: factor out a helper to submit normal write
  - md/raid1-10: factor out a helper to add bio to plug
  - md/raid10: prevent soft lockup while flush writes
  - md: raid1/raid10: drop pending_cnt
  - md: drop queue limitation for RAID1 and RAID10
  - Revert "md/raid10: fix softlockup in raid10_unplug"
  - ida: Fix crash in ida_free when the bitmap is empty
  - md: fix error handling in md_alloc
  - md: Constify attribute_group structs
  - md: fix mddev->kobj lifetime
  - md: properly unwind when failing to add the kobject in md_alloc
  - md: extend disks_mutex coverage
  - md: add the bitmap group to the default groups for the md kobject
  - md: add error handling support for add_disk()
  - md: convert to blk_alloc_disk/blk_cleanup_disk
  - md/raid10: fix improper BUG_ON() in raise_barrier()
  - md: use msleep() in md_notify_reboot()
  - md: fix double free of mddev->private in autorun_array()
  - nvme-pci: fix doorbell buffer value endianness
  - nvme-pci: fix mempool alloc size
  - scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
  - scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
  - nvme-pci: clear the prp2 field when not used
  - nvme-pci: fix DMA direction of unmapping integrity data
  - nvme-pci: fix timeout request state check


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.64.0.144
changelog:
  - !4516 [sync] PR-4431: v2  patchset for CVE-2023-52340
  - !4444 [sync] PR-4290:  net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
  - !4614 [sync] PR-4521:  xen-netback: don't produce zero-size SKB frags
  - !4592  sctp: fix potential deadlock on &net->sctp.addr_wq_lock
  - !4549 [sync] PR-4461:  netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  - !4608 [sync] PR-4588:  fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
  - xen-netback: don't produce zero-size SKB frags
  - !4586 [sync] PR-4562: v4  tracing: Backport bugfixes
  - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
  - !3343 [sync] 22.03 LTS SP1 sync vdpa patches from branch OLK-5.10
  - sctp: fix potential deadlock on &net->sctp.addr_wq_lock
  - trace: Fix kabi breakage in struct trace_event_file
  - tracing: Fix uaf issue when open the hist or hist_debug file
  - tracing: Have event inject files inc the trace array ref count
  - tracing: Have trace_event_file have ref counters
  - tracing: Increase trace array ref count on enable and filter files
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  - ipv6: fix kabi change in struct dst_ops
  - ipv6: Document that max_size sysctl is deprecated
  - ipv6: remove max_size check inline with ipv4
  - net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
  - vdpa: add vmstate header file
  - vhost-vdpa: add reset state params to indicate reset level
  - vhost-vdpa: allow set feature VHOST_F_LOG_ALL when been negotiated.
  - vhost-vdpa: fix compile warnings
  - arm64: openeuler_defconfig: add VDPA config
  - vhost-vdpa: fix msi irq request err
  - vhost-vdpa: Allow transparent MSI IOV
  - export iommu_get_resv_regions and iommu_set_resv_regions
  - vhost: add VHOST feature VHOST_BACKEND_F_BYTEMAPLOG
  - vhost-vdpa: add uAPI for device migration status
  - vdpa: add vdpa device migration status ops
  - vhost-vdpa: add uAPI for device buffer
  - vdpa: add device state operations
  - vhost-vdpa: add uAPI for logging
  - vdpa: add log operations
  - tools include UAPI: Sync linux/vhost.h with the kernel sources
  - vdpa: add get_backend_features vdpa operation
  - virtio: fix virtio transitional ids
  - virtio: update virtio id table, add transitional ids
  - PCI/IOV: Add pci_iov_vf_id() to get VF index
  - vhost_vdpa: support PACKED when setting-getting vring_base
  - vhost_vdpa: tell vqs about the negotiated
  - vhost_vdpa: fix unmap process in no-batch mode
  - vhost-vdpa: use bind_mm/unbind_mm device callbacks
  - vdpa: add bind_mm/unbind_mm callbacks
  - vhost-vdpa: vhost_vdpa_alloc_domain() should be using a const struct bus_type *
  - vhost-vdpa: free iommu domain after last use during cleanup
  - vhost-vdpa: uAPI to resume the device
  - vhost-vdpa: Introduce RESUME backend feature bit
  - vdpa: Add resume operation
  - vhost_vdpa: fix the crash in unmap a large memory
  - vhost-vdpa: fix an iotlb memory leak


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.65.0.145
changelog:
  - !4467 [sync] PR-4256:  scsi: core: Always send batch on reset or error handling command
  - !4682 [sync] PR-4662: v3  CVE-2023-52435
  - !4692  ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
  - ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
  - !4626 [sync] PR-4531:  fs:/dcache.c: fix negative dentry flag warning in dentry_free
  - net: Fix compile warning in skb_segment()
  - net: prevent mss overflow in skb_segment()
  - fs:/dcache.c: fix negative dentry flag warning in dentry_free
  - scsi: core: Always send batch on reset or error handling command
  - Revert "scsi: core: Add scsi_prot_ref_tag() helper"
  - Revert "scsi: core: Introduce scsi_get_sector()"
  - Revert "scsi: core: Make scsi_get_lba() return the LBA"
  - Revert "scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request"
  - Revert "scsi: core: Use a structure member to track the SCSI command submitter"
  - Revert "scsi: core: Always send batch on reset or error handling command"
  - scsi: core: Always send batch on reset or error handling command
  - scsi: core: Use a structure member to track the SCSI command submitter
  - scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
  - scsi: core: Make scsi_get_lba() return the LBA
  - scsi: core: Introduce scsi_get_sector()
  - scsi: core: Add scsi_prot_ref_tag() helper


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.66.0.146
changelog:
  - !4956 [sync] PR-4868:  net: openvswitch: limit the number of recursions from action sets
  - !4961 [sync] PR-4940:  apparmor: avoid crash when parsed profile name is empty
  - apparmor: avoid crash when parsed profile name is empty
  - net: openvswitch: limit the number of recursions from action sets
  - !4755 [sync] PR-4737:  blk-mq: fix IO hang from sbitmap wakeup race
  - !4814 [sync] PR-4702:  efivarfs: force RO when remounting if SetVariable is not supported
  - !4796 [sync] PR-4747:  KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
  - efivarfs: force RO when remounting if SetVariable is not supported
  - !4792 v2  gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
  - KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
  - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
  - blk-mq: fix IO hang from sbitmap wakeup race
  - !4723 [sync] PR-4694: v2  mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
  - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path


author: gaihuiying <eaglegai@163.com> - 1.13.2-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:remove buildin key
         add macros to control if key files permissons is 600 or 644
         remove useless BuildRequires:unbound-libs


author: yanglu <yanglu72@h-partners.com> - 1.13.2-5
changelog:
  - Type:cves
  - CVE:CVE-2022-30698 CVE-2022-30699
  - SUG:NA
  - DESC:fix CVE-2022-30698 and CVE-2022-30699


author: gaihuiying <eaglegai@163.com> - 1.13.2-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:change run directory from /var/run to /run to fix "/usr/lib/tmpfiles.d/unbound.conf:1: xxxx"


author: qinyu<qinyu32@huawei.com> - 2022a-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Greenland change should affect only America/Nuuk; The northern edge of Chihuahua changes to US rules


author: langfei<langfei@huawei.com> - 2022a-16
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Fix Palestine predictions for 2072 through 2075; Ittoqqortoormiit (America/Scoresbysund) zone change.


author: liuchao <liuchao173@huawei.com> - 2022a-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Vostok switches to +05; Sync Casey data from timeanddata.com; Kazakhstan unifies on UTC+5


