# changelog

author: Qingqing Li <liqingqing3@huawei.com> - 2.34-145
changelog:
  - elf: Add a way to check if tunable is set (BZ 27069)
  - malloc: Improve MAP_HUGETLB with glibc.malloc.hugetlb=2


author: chengyechun <chengyechun1@huawei.com> - 2.34-148
changelog:
  - Type:CVE
  - ID:CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602
  - SUG:NA
  - DESC:fix CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602


author: chengyechun <chengyechun1@huaiwe.com> - 2.34-149
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:nscd: Use errval, not errno to guide cache update
         nsce :Skip unusable entries in first pass in prune_cache


author: shixuantong <shixuantong1@huawei.com> - 2.34-150
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:elf: Add TLS modid reuse test for bug 29039
         elf: Fix TLS modid reuse generation assignment
         elf: Check objname before calling fatal_error
         elf: Fix _dl_debug_vdprintf to work before self-relocation
         elf: ldconfig should skip temporary files created by package managers
         ldconfig: Fixes for skipping temporary files.


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.66.0.146
changelog:
  - !4956 [sync] PR-4868:  net: openvswitch: limit the number of recursions from action sets
  - !4961 [sync] PR-4940:  apparmor: avoid crash when parsed profile name is empty
  - apparmor: avoid crash when parsed profile name is empty
  - net: openvswitch: limit the number of recursions from action sets
  - !4755 [sync] PR-4737:  blk-mq: fix IO hang from sbitmap wakeup race
  - !4814 [sync] PR-4702:  efivarfs: force RO when remounting if SetVariable is not supported
  - !4796 [sync] PR-4747:  KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
  - efivarfs: force RO when remounting if SetVariable is not supported
  - !4792 v2  gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
  - KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
  - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
  - blk-mq: fix IO hang from sbitmap wakeup race
  - !4723 [sync] PR-4694: v2  mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
  - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.67.0.147
changelog:
  - !5154 [sync] PR-4645:  f2fs: explicitly null-terminate the xattr list
  - !5147 [sync] PR-4925: v2  btrfs: do not ASSERT() if the newly created subvolume already got read
  - !4668 [sync] PR-4646:  binder: fix use-after-free in shinker's callback
  - !4831 [sync] PR-4803:  CVE-2024-26583
  - f2fs: explicitly null-terminate the xattr list
  - !4749 [sync] PR-4672:  uio: Fix use-after-free in uio_open
  - !5069 [sync] PR-5033: v3  Remove WQ_FLAG_BOOKMARK flag
  - btrfs: fix double free of anonymous device after snapshot creation failure
  - btrfs: do not ASSERT() if the newly created subvolume already got read
  - !5084 [sync] PR-5058:  net: fix possible store tearing in neigh_periodic_work()
  - !5086 [sync] PR-5064:  net: rds: Fix possible NULL-pointer dereference
  - !5126 [sync] PR-4891:  Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
  - !5080 [sync] PR-5051:  dm: limit the number of targets and parameter size area
  - !5001 [sync] PR-4988:  ieee802154: ca8210: Fix a potential UAF in ca8210_probe
  - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
  - !4839 [sync] PR-4742:  block: add check that partition length needs to be aligned with block size
  - !5066 [sync] PR-5032:  net/sched: act_ct: fix wild memory access when clearing fragments
  - net: rds: Fix possible NULL-pointer dereference
  - net: fix possible store tearing in neigh_periodic_work()
  - !4953  arm64: head.S: always initialize PSTATE
  - dm: limit the number of targets and parameter size area
  - sched: remove wait bookmarks
  - filemap: remove use of wait bookmarks
  - net/sched: act_ct: fix wild memory access when clearing fragments
  - !4985 [sync] PR-4339: 修复pmem_legacy_device未被编译问题
  - !4964 [sync] PR-4901:  fix CVE-2021-47036
  - !5012  nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
  - !5006 [sync] PR-4979:  CVE-2021-47028
  - !5014 [sync] PR-4991:  CVE-2023-52568
  - x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race
  - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
  - mt76: mt7915: fix txrate reporting
  - mt76: mt7915: rename mt7915_mcu_get_rate_info to mt7915_mcu_get_tx_rate
  - !4732 [sync] PR-4706:  mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
  - ieee802154: ca8210: Fix a potential UAF in ca8210_probe
  - pmem: compile pmem legacy device while libnvdimm as a module
  - udp: properly flush normal packet at GRO time
  - udp: skip L4 aggregation for UDP tunnel packets
  - arm64: head.S: always initialize PSTATE
  - block: add check that partition length needs to be aligned with block size
  - tls: fix race between tx work scheduling and socket close
  - tls: fix race between async notify and socket close
  - net: tls: factor out tls_*crypt_async_wait()
  - tls: rx: simplify async wait
  - uio: Fix use-after-free in uio_open
  - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
  - binder: fix use-after-free in shinker's callback


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.68.0.148
changelog:
  - !5344  CVE-2023-52447
  - !5366 v2  CVE-2023-52452
  - !5360  iommu/arm-smmu-v3: Disable ECMDQ before reset
  - bpf: Fix accesses to uninit stack slots
  - bpf: Fix verification of indirect var-off stack access
  - bpf: Allow reads from uninit stack
  - bpf: expose bpf_strtol and bpf_strtoul to all program types
  - bpf, verifier: Fix memory leak in array reallocation for stack state
  - bpf: verifier: Use copy_array for jmp_history
  - bpf: verifier: Improve function state reallocation
  - iommu/arm-smmu-v3: Disable ECMDQ before reset
  - !5182 [sync] PR-4805:  CVE-2023-52451 backport to OLK-5.10 v2
  - bpf: Fix kabi breakage in struct bpf_map and struct bpf_map_ops
  - bpf: Defer the free of inner map when necessary
  - bpf: Set need_defer as false when clearing fd array during map free
  - bpf: Add map and need_defer parameters to .map_fd_put_ptr()
  - !5278 [sync] PR-5246:  ceph: fix deadlock or deadcode of misusing dget()
  - !5294 [sync] PR-5240:  powerpc/lib: Validate size for vector operations
  - powerpc/lib: Validate size for vector operations
  - !5226 [sync] PR-5197:  drm: Don't unref the same fb many times by mistake due to deadlock handling
  - !4853 [sync] PR-4847:  btrfs: mainline backport
  - ceph: fix deadlock or deadcode of misusing dget()
  - !5204  Upgrade driver for Broadcom NIC BCM57414
  - !5192 [sync] PR-5164:  nfc: nci: assert requested protocol is valid
  - !5185 [sync] PR-5156:  RDMA/srp: Do not call scsi_done() from srp_abort()
  - !5124 [sync] PR-5109:  CVE-2024-26586
  - !5098 [sync] PR-5078:  RDMA/rxe: Return CQE error if invalid lkey was supplied
  - drm: Don't unref the same fb many times by mistake due to deadlock handling
  - !5201 [sync] PR-5178:  net: nfc: llcp: Add lock when modifying device list
  - Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
  - bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks
  - bnxt_en: Query default VLAN before VNIC setup on a VF
  - bnxt_en: Don't issue AP reset during ethtool's reset operation
  - net: bcmgenet: Restore phy_stop() depending upon suspend/close
  - net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
  - net: nfc: llcp: Add lock when modifying device list
  - nfc: nci: assert requested protocol is valid
  - RDMA/srp: Do not call scsi_done() from srp_abort()
  - !5166 [sync] PR-5117:  fix CVE-2023-52527
  - powerpc/pseries/memhp: Fix access beyond end of drmem array
  - powerpc/pseries/memhotplug: Quieten some DLPAR operations
  - l2tp: pass correct message length to ip6_append_data
  - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
  - mlxsw: spectrum_acl_tcam: Fix stack corruption
  - mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations
  - mlxsw: spectrum_acl_tcam: Make fini symmetric to init
  - mlxsw: spectrum_acl_tcam: Add missing mutex_destroy()
  - mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable
  - mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure
  - RDMA/rxe: Return CQE error if invalid lkey was supplied
  - btrfs: fix deadlock when cloning inline extents and using qgroups
  - btrfs: do not start and wait for delalloc on snapshot roots on transaction commit


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.69.0.149
changelog:
  - !5534  media: pvrusb2: fix use after free on context disconnection
  - !5503 [sync] PR-5316: v2  iomap: add support to track dirty state of sub pages
  - media: pvrusb2: fix use after free on context disconnection
  - !5138 [sync] PR-4933:  scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
  - !5028 [sync] PR-4987:  net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
  - iomap: add support to track dirty state of sub pages
  - !5439 [sync] PR-5286:  serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
  - !5324  jfs: fix slab-out-of-bounds Read in dtSearch
  - !5329  UBSAN: array-index-out-of-bounds in dtSplitRoot
  - !5436 [sync] PR-5355:  CVE-2023-52593
  - !5311  FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - !5390 [sync] PR-5259:  CVE-2024-26627​
  - serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
  - wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()
  - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
  - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
  - !5372 [sync] PR-5313:  bus: mhi: host: Add alignment check for event ring read pointer
  - !5288 [sync] PR-5231:  af_unix: fix lockdep positive in sk_diag_dump_icons()
  - bus: mhi: host: Add alignment check for event ring read pointer
  - UBSAN: array-index-out-of-bounds in dtSplitRoot
  - jfs: fix slab-out-of-bounds Read in dtSearch
  - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - af_unix: fix lockdep positive in sk_diag_dump_icons()
  - scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.70.0.150
changelog:
  - !5682 [sync] PR-5266:  llc: call sock_orphan() at release time
  - !5690  net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  - !5686 [sync] PR-5253:  tomoyo: fix UAF write bug in tomoyo_write_control()
  - net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  - tomoyo: fix UAF write bug in tomoyo_write_control()
  - llc: call sock_orphan() at release time
  - !5433 [sync] PR-5232:  jfs: fix cve issue
  - !5638 [sync] PR-5617: v4  Fix I/O high when memory almost met memcg limit
  - !5665 [sync] PR-5580:  CVE-2023-52622
  - ext4: avoid online resizing failures due to oversized flex bg
  - ext4: unify the type of flexbg_size to unsigned int
  - ext4: remove unnecessary check from alloc_flex_gd()
  - !5648 [sync] PR-5493:  arm64/mpam: Fix repeated enabling in mpam_enable()
  - !5416 v2  mpt3sas bugfix
  - !5635 [sync] PR-5518:  dm: revert partial fix for redundant bio-based IO accounting
  - !5632 [sync] PR-5521:  md/raid5: fix atomicity violation in raid5_cache_count
  - arm64/mpam: Fix repeated enabling in mpam_enable()
  - mm/readahead: don't decrease mmap_miss when folio has workingset flags
  - mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM
  - !5619 [sync] PR-5606:  mm/mlock: return EINVAL for illegal user memory range in mlock
  - !5610 [sync] PR-5447:  Fix CVE-2021-47094
  - dm: revert partial fix for redundant bio-based IO accounting
  - md/raid5: fix atomicity violation in raid5_cache_count
  - mm/mlock: return EINVAL for illegal user memory range in mlock
  - KVM: x86/mmu: Don't advance iterator after restart due to yielding
  - KVM: x86/mmu: Factor out tdp_iter_return_to_root
  - !5475  jfs: fix array-index-out-of-bounds in dbAdjTree
  - jfs: fix array-index-out-of-bounds in dbAdjTree
  - jfs: fix array-index-out-of-bounds in diNewExt
  - jfs: fix uaf in jfs_evict_inode
  - scsi: mpt3sas: Fix loop logic
  - scsi: mpt3sas: Perform additional retries if doorbell read returns 0
  - scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
  - scsi: mpt3sas: Remove usage of dma_get_required_mask() API
  - scsi: mpt3sas: Don't change DMA mask while reallocating pools
  - scsi: mpt3sas: Fix a memory leak
  - scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.71.0.151
changelog:
  - !5941  CVE-2021-46926
  - !5945 [sync] PR-5861:  ksmbd: fix uaf in smb20_oplock_break_ack
  - !5937 [sync] PR-5911:  CVE-2023-52484
  - !5933 [sync] PR-5895:  i2c: i801: Fix block process call transactions
  - !5928 [sync] PR-5863:  CVE-2024-26788
  - !5909 [sync] PR-4928:  drm/bridge: sii902x: Fix probing race issue
  - !5784  ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - !5919 [sync] PR-5870:  drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - !4909 [sync] PR-4865:  Input: powermate - fix use-after-free in powermate_config_complete
  - !5904 [sync] PR-4931:  phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
  - ksmbd: fix uaf in smb20_oplock_break_ack
  - ALSA: hda: intel-sdw-acpi: harden detection of controller
  - iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range
  - iommu/arm-smmu-v3: Fix size calculation in arm_smmu_mm_invalidate_range()
  - !5913 [sync] PR-5811:  Fixed CVE-2021-47037
  - !5872 [sync] PR-4794:  serial: imx: fix tx statemachine deadlock
  - i2c: i801: Fix block process call transactions
  - dmaengine: fsl-qdma: init irq after reg initialization
  - !5897 [sync] PR-5808:  nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - !5889 [sync] PR-5832:  CVE-2023-52467
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - ASoC: q6afe-clocks: fix reprobing of the driver
  - ASoC: q6afe-clocks: fix warning on symbol scope
  - drm/bridge: sii902x: Fix probing race issue
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
  - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - !5749  ksmbd: fix global oob in ksmbd_nl_policy
  - mfd: syscon: Fix null pointer dereference in of_syscon_register()
  - serial: imx: fix tx statemachine deadlock
  - !5816 [sync] PR-5780:  bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  - !5827 [sync] PR-5785:  net: qualcomm: rmnet: fix global oob in rmnet_policy
  - !4800 [sync] PR-4764:  binder: signal epoll threads of self-work
  - !5791  usb: hub: Guard against accesses to uninitialized BOS descriptors
  - !5798 [sync] PR-5788: v2  Patches to Fix CVE-2023-52454
  - !5821 [sync] PR-5789:  perf/x86/lbr: Filter vsyscall addresses
  - net: qualcomm: rmnet: fix global oob in rmnet_policy
  - !5776 [sync] PR-5724:  ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - !4779 [sync] PR-4772:  x86/fpu: Stop relying on userspace for info to fault in xsave buffer
  - perf/x86/lbr: Filter vsyscall addresses
  - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  - !5765 [sync] PR-5642:  btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - nvmet-tcp: Fix the H2C expected PDU len calculation
  - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
  - usb: hub: Guard against accesses to uninitialized BOS descriptors
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - ksmbd: fix global oob in ksmbd_nl_policy
  - !5720 [sync] PR-5708:  ext4: dio: Put endio under
  - !5705 [sync] PR-5507:  ext4: Validate inode pa before using preallocation blocks
  - ext4: Optimize endio process for DIO overwrites
  - iomap: Add a IOMAP_DIO_MAY_INLINE_COMP flag
  - iomap: pass a flags argument to iomap_dio_rw
  - iomap: rename the flags variable in __iomap_dio_rw
  - iomap: add IOMAP_DIO_INLINE_COMP
  - iomap: use an unsigned type for IOMAP_DIO_* defines
  - iomap: cleanup up iomap_dio_bio_end_io()
  - ext4: Validate inode pa before using preallocation blocks
  - Input: powermate - fix use-after-free in powermate_config_complete
  - binder: signal epoll threads of self-work
  - x86/fpu: Stop relying on userspace for info to fault in xsave buffer


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.72.0.152
changelog:
  - !6181 [sync] PR-5093:  wifi: mac80211: fix potential key use-after-free
  - !6217  RDMA/siw: Fix connection failure handling
  - !6238 [sync] PR-6186:  Fixed CVE-2023-52504
  - !6234 [sync] PR-6193:  uio_hv_generic: Fix another memory leak in error handling paths
  - !6235 [sync] PR-6192:  arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
  - x86/alternatives: Disable KASAN in apply_alternatives()
  - arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
  - uio_hv_generic: Fix another memory leak in error handling paths
  - !6197  tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
  - !6189 [sync] PR-5466:  wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - RDMA/siw: Fix connection failure handling
  - !6114  cifs: Fix UAF in cifs_demultiplex_thread()
  - tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - !6173 [sync] PR-6137:  vfio/pci: Lock external INTx masking ops
  - wifi: mac80211: fix potential key use-after-free
  - !6126  fix-CVE-2021-47101-openEuler-22.03-LTS-SP1
  - vfio/pci: Lock external INTx masking ops
  - !6155 [sync] PR-5717: v2  fix CVE-2023-52587
  - !6149 [sync] PR-6101:  vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - !6142 [sync] PR-6047:  hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  - !6132 [sync] PR-4923:  mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
  - !5420 [sync] PR-5317:  KVM: s390: fix setting of fpc register
  - IB/ipoib: Fix mcast list locking
  - RDMA/IPoIB: Fix error code return in ipoib_mcast_join
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - !5130 [sync] PR-5113:  fix CVE-2023-52578
  - !5121 [sync] PR-5062:  team: fix null-ptr-deref when team device type is changed
  - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  - !6118  wifi: rt2x00: restart beacon queue when hardware reset
  - !6055 [sync] PR-6017:  drm/amdgpu: fix use-after-free bug
  - !6120  dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
  - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
  - asix: fix wrong return value in asix_check_host_enable()
  - asix: fix uninit-value in asix_mdio_read()
  - net: asix: fix uninit value bugs
  - dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
  - wifi: rt2x00: restart beacon queue when hardware reset
  - cifs: Fix UAF in cifs_demultiplex_thread()
  - !6078 [sync] PR-5973:  EDAC/thunderx: Fix possible out-of-bounds string access
  - !6043 [sync] PR-5995:  mm/swap: fix race when skipping swapcache
  - !6023 [sync] PR-5970:  fixup CVE-2024-26751
  - !6035 [sync] PR-5969:  fbdev: savage: Error out if pixclock equals zero
  - EDAC/thunderx: Fix possible out-of-bounds string access
  - !5849  ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - !6059  fs/ntfs3: fix CVE-2023-52640
  - fs/ntfs3: Fix oob in ntfs_listxattr
  - fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea()
  - ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
  - drm/amdgpu: fix use-after-free bug
  - mm/swap: fix race when skipping swapcache
  - !5988 [sync] PR-5901:  CVE-2024-26695
  - !5981 [sync] PR-5812:  afs: Increase buffer size in afs_update_volume_status()
  - fbdev: savage: Error out if pixclock equals zero
  - ARM: ep93xx: Add terminator to gpiod_lookup_table
  - !5948 [sync] PR-5831:  fbdev: sis: Error out if pixclock equals zero
  - !5959 [sync] PR-5884:  KVM: arm64: vgic-its: Fix CVE-2024-26598 fix patch issue
  - !5843 [sync] PR-5348:  s390/ptrace: handle setting of fpc register correctly
  - crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
  - !5857  dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - afs: Increase buffer size in afs_update_volume_status()
  - KVM: arm64: vgic-its: Fix CVE-2024-26598 fix patch issue
  - fbdev: sis: Error out if pixclock equals zero
  - dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - s390/ptrace: handle setting of fpc register correctly
  - KVM: s390: fix setting of fpc register
  - net: fix kabi check warning
  - net: Fix unwanted sign extension in netdev_stats_to_stats64()
  - net: bridge: use DEV_STATS_INC()
  - net: add atomic_long_t to net_device_stats fields
  - team: fix null-ptr-deref when team device type is changed


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.73.0.153
changelog:
  - !6414 [sync] PR-5510:  bus: mhi: host: Drop chan lock before queuing buffers
  - !6143 [sync] PR-6103:  riscv: Sparse-Memory/vmemmap out-of-bounds fix
  - !6535 [sync] PR-5222:  powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  - !6538 [sync] PR-5273:  net/smc: fix illegal rmb_desc access in SMC-D connection dump
  - !6529 [sync] PR-5468:  media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
  - !6298  sp1 fix deadlock in cgroup1_writeback
  - !6497 [sync] PR-6407:  wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump
  - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  - !6506 [sync] PR-5773:  patches for CVE-2023-52617
  - !6502 [sync] PR-5772:  firmware: arm_scmi: Check mailbox/SMT channel for consistency
  - !6518  Fix CVE-2023-52498
  - media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
  - PM: sleep: Fix error handling in dpm_prepare()
  - PM: sleep: Fix possible deadlocks in core system-wide PM code
  - PM: core: Remove unnecessary (void *) conversions
  - PM: sleep: Avoid calling put_device() under dpm_list_mtx
  - PM: sleep: Use dev_printk() when possible
  - async: Introduce async_schedule_dev_nocall()
  - async: Split async_schedule_node_domain()
  - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
  - PCI: switchtec: Fix stdev_release() crash after surprise hot remove
  - firmware: arm_scmi: Check mailbox/SMT channel for consistency
  - !6488 [sync] PR-6455:  CVE-2021-47182
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - !6433 [sync] PR-6312:  fix CVE-2024-24861 for 5.10
  - scsi: core: Fix scsi_mode_sense() buffer length handling
  - scsi: core: Reshuffle response handling in scsi_mode_sense()
  - media: xc4000: Fix atomicity violation in xc4000_get_frequency
  - !6411 [sync] PR-5195:  dmaengine: fix NULL pointer in channel unregistration function
  - bus: mhi: host: Drop chan lock before queuing buffers
  - dmaengine: fix NULL pointer in channel unregistration function
  - cgroup_writeback: fix softlockup for blkcg->memcg_list
  - cgroup_writeback: fix deadlock in cgroup1_writeback
  - !6081  Fix CVE-2024-26764
  - !5967  Fix CVE-2023-52441 and integrate the pre-patch
  - riscv: Sparse-Memory/vmemmap out-of-bounds fix
  - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
  - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
  - ksmbd: fix out of bounds in init_smb2_rsp_hdr()
  - ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr
  - ksmbd: return unsupported error on smb1 mount
  - ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.74.0.154
changelog:
  - !6426 [sync] PR-6291:  aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  - !6902  bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
  - !6920  bpf: Fix hashtab overflow check on 32-bit arches
  - !6926  firmware: arm_scmi: Harden accesses to the reset domains
  - !6922  bpf: Fix stackmap overflow check on 32-bit arches
  - !6864 [sync] PR-6835:  kprobes: Fix check for probe enabled in kill_kprobe()
  - !6898 [sync] PR-6592:  net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  - firmware: arm_scmi: Harden accesses to the reset domains
  - bpf: Fix stackmap overflow check on 32-bit arches
  - bpf: Fix hashtab overflow check on 32-bit arches
  - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
  - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  - !6644 [sync] PR-6623:  amdkfd: use calloc instead of kzalloc to avoid integer overflow
  - kprobes: Fix check for probe enabled in kill_kprobe()
  - !6388 [sync] PR-6202:  ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  - !6628 [sync] PR-6485:  CVE-2024-26843
  - !6752 [sync] PR-6677: v3  olk-5.10: bugfix for mm
  - mm/madvise: fix potential pte_unmap_unlock pte error
  - mm/page_alloc: always attempt to allocate at least one page during bulk allocation
  - !6505  cachefiles: fix memory leak in cachefiles_add_cache()
  - !6687 [sync] PR-6580:  drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  - !6637 [sync] PR-6561:  md: fix kmemleak of rdev->serial
  - amdkfd: use calloc instead of kzalloc to avoid integer overflow
  - !6598 [sync] PR-6584:  ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  - !6607 [sync] PR-6579:  media: rc: bpf attach/detach requires write permission
  - !6606 [sync] PR-6568:  IB/hfi1: Fix a memleak in init_credit_return
  - !6614 [sync] PR-6543:  net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  - !6603 [sync] PR-6520:  firmware: arm_scmi: Fix double free in SMC transport cleanup path
  - md: fix kmemleak of rdev->serial
  - firmware: arm_scmi: Fix double free in SMC transport cleanup path
  - efi: runtime: Fix potential overflow of soft-reserved region size
  - !6249  ubi: Check for too small LEB size in VTBL code
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  - !6449 [sync] PR-6281: v2  net/mlx5: Update error handler for UCTX and UMEM
  - media: rc: bpf attach/detach requires write permission
  - IB/hfi1: Fix a memleak in init_credit_return
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  - !6476  do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  - !6575 [sync] PR-6417:  media: pvrusb2: fix uaf in pvr2_context_set_notify
  - media: pvrusb2: fix uaf in pvr2_context_set_notify
  - cachefiles: fix memory leak in cachefiles_add_cache()
  - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  - net/mlx5: Update error handler for UCTX and UMEM
  - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  - ubi: Check for too small LEB size in VTBL code


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.75.0.155
changelog:
  - !6039 [sync] PR-6006:  fix CVE-2024-26669
  - !5882 [sync] PR-5751:  net: atlantic: Fix DMA mapping for PTP hwts ring
  - !7340  netfilter: nft_limit: reject configurations that cause integer overflow
  - !7253  netfilter: nf_tables: disallow timeout for anonymous sets
  - netfilter: nft_limit: reject configurations that cause integer overflow
  - netfilter: nf_tables: disallow timeout for anonymous sets
  - !7161 [sync] PR-6809:  memcg: fix possible use-after-free in memcg_write_event_control()
  - !7121 [sync] PR-7086:  media: ttpci: fix two memleaks in budget_av_attach
  - !7123 [sync] PR-7080:  drm: nv04: Fix out of bounds access
  - !7145 [sync] PR-7044: v2  nfs: fix UAF in direct writes
  - !7155 [sync] PR-7148:  scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - !7179  ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  - !6978  ksmbd: validate payload size in ipc response
  - !7098 [sync] PR-6818:  mm: memcg: fix stale protection of reclaim target memcg
  - memcg: fix possible use-after-free in memcg_write_event_control()
  - scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - nfs: fix UAF in direct writes
  - !6764 [sync] PR-6680:  cifs: fix underflow in parse_server_interfaces()
  - !6766 [sync] PR-6669:  NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - drm: nv04: Fix out of bounds access
  - media: ttpci: fix two memleaks in budget_av_attach
  - !7102 [sync] PR-7039:  USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - !7084 [sync] PR-7013:  media: edia: dvbdev: fix a use-after-free
  - !7024 [sync] PR-6988:  clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - !6213 [sync] PR-6178:  CVE-2024-26812
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - !7009 [sync] PR-6959:  mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - !7064 [sync] PR-7056:  scsi: qla2xxx: Fix command flush on cable pull
  - mm: memcg: fix stale protection of reclaim target memcg
  - !6946 [sync] PR-6840:  CVE-2023-52650
  - media: edia: dvbdev: fix a use-after-free
  - scsi: qla2xxx: Fix command flush on cable pull
  - !6093 [sync] PR-5921:  ext4: fix double-free of blocks due to wrong extents moved_len
  - !6090 [sync] PR-5977:  btrfs: dev-replace: properly validate device names
  - !6096 [sync] PR-6029:  ceph: prevent use-after-free in encode_cap_msg()
  - !7029 [sync] PR-6977:  wireguard: netlink: access device through ctx instead of peer
  - drm/tegra: dsi: Add missing check for of_find_device_by_node
  - wireguard: netlink: access device through ctx instead of peer
  - !6986 [sync] PR-6964: v2  CVE-2024-27000
  - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - !6691  quota: Fix potential NULL pointer dereference
  - serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
  - serial: mxs-auart: add spinlock around changing cts state
  - serial: core: Provide port lock wrappers
  - !6885 [sync] PR-6740:  V2 cpuset: fix race between rebuild scheduler domains and hotplug work
  - !6961 [sync] PR-6861:  media: dvb-frontends: avoid stack overflow warnings with clang
  - ksmbd: validate payload size in ipc response
  - !6912  pstore: inode: Only d_invalidate() is needed
  - !6937 [sync] PR-6826:  fat: fix uninitialized field in nostale filehandles
  - !6934 [sync] PR-6838:  fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - media: dvb-frontends: avoid stack overflow warnings with clang
  - fat: fix uninitialized field in nostale filehandles
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - pstore: inode: Only d_invalidate() is needed
  - cpuset: fix race between rebuild scheduler domains and hotplug work
  - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - cifs: fix underflow in parse_server_interfaces()
  - quota: Fix potential NULL pointer dereference
  - vfio/pci: Create persistent INTx handler
  - vfio: Introduce interface to flush virqfd inject workqueue
  - ceph: prevent use-after-free in encode_cap_msg()
  - ext4: fix double-free of blocks due to wrong extents moved_len
  - btrfs: dev-replace: properly validate device names
  - net/sched: flower: Fix kabi change
  - net/sched: flower: Fix chain template offload
  - net: atlantic: Fix DMA mapping for PTP hwts ring


author: Eibz-Chan <chenbingzhao@huawei.com> - 590-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:[add] backport patches from upstream
  	Fix-memory-leak-when-using-corrupt-lesshst-file.patch
  	Fix-crash-when-enter-invaid-pattern-in-command.patch


author: lijian<lijian2@kylinos.cn> - 1:1.5.2-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:rebuild for golang cvefix: CVE-2023-24534,CVE-2023-24536,CVE-2023-24537,CVE-2023-24538


author: liukuo<liukuo@kylinos.cn> - 1:1.5.2-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:rebuild for golang cvefix: CVE-2022-41723,CVE-2023-29406,CVE-2023-39326


