# changelog

author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-35
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:kern: Check for NULL when closing devices and disks
         kern/efi/mm: Fix use-after-free in finish boot services
         util/grub-install-common: Fix the key of the --core-compress option
         net/dns: Fix lookup error when no IPv6 is returned
         net/dns: Simplify error handling of recv_hook() function
         net/dns: Fix removal of DNS server


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-37
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fs/udf: Fix out of bounds access
         lib/relocator: Fix OOB write when initializing lo->freebytes[]
         util/grub-mount: Fix memory leak in fuse_getattr()


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-38
changelog:
  - Type:CVE
  - CVE:CVE-2023-4692 CVE-2023-4693
  - SUG:NA
  - DESC:fs/ntfs: Make code more readable
         fs/ntfs: Fix an OOB read when parsing a volume label
         fs/ntfs: Fix an OOB read when parsing bitmaps for index attributes
         fs/ntfs: Fix an OOB read when parsing directory entries from resident and non-resident index attributes
         fs/ntfs: Fix an OOB read when reading data from the resident $DATA attribute
         fs/ntfs: Fix an OOB write when parsing the $ATTRIBUTE_LIST attribute for the $MFT file


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-40
changelog:
  - Type:requirement
  - CVE:NA
  - SUG:NA
  - DESC:add TPCM support with ipmi channel
         change the name of module tpcm to tpcm_kunpeng
         skip verification when not loading grub.cfg


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-41
changelog:
  - Type:CVE
  - CVE:CVE-2024-1048
  - SUG:NA
  - DESC:grub-set-bootflag: Fix for CVE-2024-1048
         commands/acpi: Fix calculation of ACPI tables addresses when processing RSDT and XSDT
         kern/acpi: Skip NULL entries in RSDT and XSDT
         util/grub-mount: Check file path sanity


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-42
changelog:
  - Type:CVE
  - CVE:CVE-2021-46848
  - SUG:NA
  - DESC:lib/libtasn1: Fix ETYPE_OK off by one array size check


author: huangjie <huangjie150@huawei.com> - 1:11.0.23.9-0
changelog:
  - modified 8224675-Late-GC-barrier-insertion-for-ZGC.patch
  - modified delete_expired_certificates.patch


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.69.0.149
changelog:
  - !5534  media: pvrusb2: fix use after free on context disconnection
  - !5503 [sync] PR-5316: v2  iomap: add support to track dirty state of sub pages
  - media: pvrusb2: fix use after free on context disconnection
  - !5138 [sync] PR-4933:  scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
  - !5028 [sync] PR-4987:  net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
  - iomap: add support to track dirty state of sub pages
  - !5439 [sync] PR-5286:  serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
  - !5324  jfs: fix slab-out-of-bounds Read in dtSearch
  - !5329  UBSAN: array-index-out-of-bounds in dtSplitRoot
  - !5436 [sync] PR-5355:  CVE-2023-52593
  - !5311  FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - !5390 [sync] PR-5259:  CVE-2024-26627​
  - serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
  - wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()
  - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
  - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
  - !5372 [sync] PR-5313:  bus: mhi: host: Add alignment check for event ring read pointer
  - !5288 [sync] PR-5231:  af_unix: fix lockdep positive in sk_diag_dump_icons()
  - bus: mhi: host: Add alignment check for event ring read pointer
  - UBSAN: array-index-out-of-bounds in dtSplitRoot
  - jfs: fix slab-out-of-bounds Read in dtSearch
  - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - af_unix: fix lockdep positive in sk_diag_dump_icons()
  - scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.70.0.150
changelog:
  - !5682 [sync] PR-5266:  llc: call sock_orphan() at release time
  - !5690  net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  - !5686 [sync] PR-5253:  tomoyo: fix UAF write bug in tomoyo_write_control()
  - net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  - tomoyo: fix UAF write bug in tomoyo_write_control()
  - llc: call sock_orphan() at release time
  - !5433 [sync] PR-5232:  jfs: fix cve issue
  - !5638 [sync] PR-5617: v4  Fix I/O high when memory almost met memcg limit
  - !5665 [sync] PR-5580:  CVE-2023-52622
  - ext4: avoid online resizing failures due to oversized flex bg
  - ext4: unify the type of flexbg_size to unsigned int
  - ext4: remove unnecessary check from alloc_flex_gd()
  - !5648 [sync] PR-5493:  arm64/mpam: Fix repeated enabling in mpam_enable()
  - !5416 v2  mpt3sas bugfix
  - !5635 [sync] PR-5518:  dm: revert partial fix for redundant bio-based IO accounting
  - !5632 [sync] PR-5521:  md/raid5: fix atomicity violation in raid5_cache_count
  - arm64/mpam: Fix repeated enabling in mpam_enable()
  - mm/readahead: don't decrease mmap_miss when folio has workingset flags
  - mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM
  - !5619 [sync] PR-5606:  mm/mlock: return EINVAL for illegal user memory range in mlock
  - !5610 [sync] PR-5447:  Fix CVE-2021-47094
  - dm: revert partial fix for redundant bio-based IO accounting
  - md/raid5: fix atomicity violation in raid5_cache_count
  - mm/mlock: return EINVAL for illegal user memory range in mlock
  - KVM: x86/mmu: Don't advance iterator after restart due to yielding
  - KVM: x86/mmu: Factor out tdp_iter_return_to_root
  - !5475  jfs: fix array-index-out-of-bounds in dbAdjTree
  - jfs: fix array-index-out-of-bounds in dbAdjTree
  - jfs: fix array-index-out-of-bounds in diNewExt
  - jfs: fix uaf in jfs_evict_inode
  - scsi: mpt3sas: Fix loop logic
  - scsi: mpt3sas: Perform additional retries if doorbell read returns 0
  - scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
  - scsi: mpt3sas: Remove usage of dma_get_required_mask() API
  - scsi: mpt3sas: Don't change DMA mask while reallocating pools
  - scsi: mpt3sas: Fix a memory leak
  - scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.71.0.151
changelog:
  - !5941  CVE-2021-46926
  - !5945 [sync] PR-5861:  ksmbd: fix uaf in smb20_oplock_break_ack
  - !5937 [sync] PR-5911:  CVE-2023-52484
  - !5933 [sync] PR-5895:  i2c: i801: Fix block process call transactions
  - !5928 [sync] PR-5863:  CVE-2024-26788
  - !5909 [sync] PR-4928:  drm/bridge: sii902x: Fix probing race issue
  - !5784  ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - !5919 [sync] PR-5870:  drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - !4909 [sync] PR-4865:  Input: powermate - fix use-after-free in powermate_config_complete
  - !5904 [sync] PR-4931:  phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
  - ksmbd: fix uaf in smb20_oplock_break_ack
  - ALSA: hda: intel-sdw-acpi: harden detection of controller
  - iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range
  - iommu/arm-smmu-v3: Fix size calculation in arm_smmu_mm_invalidate_range()
  - !5913 [sync] PR-5811:  Fixed CVE-2021-47037
  - !5872 [sync] PR-4794:  serial: imx: fix tx statemachine deadlock
  - i2c: i801: Fix block process call transactions
  - dmaengine: fsl-qdma: init irq after reg initialization
  - !5897 [sync] PR-5808:  nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - !5889 [sync] PR-5832:  CVE-2023-52467
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - ASoC: q6afe-clocks: fix reprobing of the driver
  - ASoC: q6afe-clocks: fix warning on symbol scope
  - drm/bridge: sii902x: Fix probing race issue
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
  - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - !5749  ksmbd: fix global oob in ksmbd_nl_policy
  - mfd: syscon: Fix null pointer dereference in of_syscon_register()
  - serial: imx: fix tx statemachine deadlock
  - !5816 [sync] PR-5780:  bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  - !5827 [sync] PR-5785:  net: qualcomm: rmnet: fix global oob in rmnet_policy
  - !4800 [sync] PR-4764:  binder: signal epoll threads of self-work
  - !5791  usb: hub: Guard against accesses to uninitialized BOS descriptors
  - !5798 [sync] PR-5788: v2  Patches to Fix CVE-2023-52454
  - !5821 [sync] PR-5789:  perf/x86/lbr: Filter vsyscall addresses
  - net: qualcomm: rmnet: fix global oob in rmnet_policy
  - !5776 [sync] PR-5724:  ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - !4779 [sync] PR-4772:  x86/fpu: Stop relying on userspace for info to fault in xsave buffer
  - perf/x86/lbr: Filter vsyscall addresses
  - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  - !5765 [sync] PR-5642:  btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - nvmet-tcp: Fix the H2C expected PDU len calculation
  - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
  - usb: hub: Guard against accesses to uninitialized BOS descriptors
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - ksmbd: fix global oob in ksmbd_nl_policy
  - !5720 [sync] PR-5708:  ext4: dio: Put endio under
  - !5705 [sync] PR-5507:  ext4: Validate inode pa before using preallocation blocks
  - ext4: Optimize endio process for DIO overwrites
  - iomap: Add a IOMAP_DIO_MAY_INLINE_COMP flag
  - iomap: pass a flags argument to iomap_dio_rw
  - iomap: rename the flags variable in __iomap_dio_rw
  - iomap: add IOMAP_DIO_INLINE_COMP
  - iomap: use an unsigned type for IOMAP_DIO_* defines
  - iomap: cleanup up iomap_dio_bio_end_io()
  - ext4: Validate inode pa before using preallocation blocks
  - Input: powermate - fix use-after-free in powermate_config_complete
  - binder: signal epoll threads of self-work
  - x86/fpu: Stop relying on userspace for info to fault in xsave buffer


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.72.0.152
changelog:
  - !6181 [sync] PR-5093:  wifi: mac80211: fix potential key use-after-free
  - !6217  RDMA/siw: Fix connection failure handling
  - !6238 [sync] PR-6186:  Fixed CVE-2023-52504
  - !6234 [sync] PR-6193:  uio_hv_generic: Fix another memory leak in error handling paths
  - !6235 [sync] PR-6192:  arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
  - x86/alternatives: Disable KASAN in apply_alternatives()
  - arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
  - uio_hv_generic: Fix another memory leak in error handling paths
  - !6197  tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
  - !6189 [sync] PR-5466:  wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - RDMA/siw: Fix connection failure handling
  - !6114  cifs: Fix UAF in cifs_demultiplex_thread()
  - tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - !6173 [sync] PR-6137:  vfio/pci: Lock external INTx masking ops
  - wifi: mac80211: fix potential key use-after-free
  - !6126  fix-CVE-2021-47101-openEuler-22.03-LTS-SP1
  - vfio/pci: Lock external INTx masking ops
  - !6155 [sync] PR-5717: v2  fix CVE-2023-52587
  - !6149 [sync] PR-6101:  vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - !6142 [sync] PR-6047:  hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  - !6132 [sync] PR-4923:  mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
  - !5420 [sync] PR-5317:  KVM: s390: fix setting of fpc register
  - IB/ipoib: Fix mcast list locking
  - RDMA/IPoIB: Fix error code return in ipoib_mcast_join
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - !5130 [sync] PR-5113:  fix CVE-2023-52578
  - !5121 [sync] PR-5062:  team: fix null-ptr-deref when team device type is changed
  - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  - !6118  wifi: rt2x00: restart beacon queue when hardware reset
  - !6055 [sync] PR-6017:  drm/amdgpu: fix use-after-free bug
  - !6120  dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
  - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
  - asix: fix wrong return value in asix_check_host_enable()
  - asix: fix uninit-value in asix_mdio_read()
  - net: asix: fix uninit value bugs
  - dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
  - wifi: rt2x00: restart beacon queue when hardware reset
  - cifs: Fix UAF in cifs_demultiplex_thread()
  - !6078 [sync] PR-5973:  EDAC/thunderx: Fix possible out-of-bounds string access
  - !6043 [sync] PR-5995:  mm/swap: fix race when skipping swapcache
  - !6023 [sync] PR-5970:  fixup CVE-2024-26751
  - !6035 [sync] PR-5969:  fbdev: savage: Error out if pixclock equals zero
  - EDAC/thunderx: Fix possible out-of-bounds string access
  - !5849  ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - !6059  fs/ntfs3: fix CVE-2023-52640
  - fs/ntfs3: Fix oob in ntfs_listxattr
  - fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea()
  - ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
  - drm/amdgpu: fix use-after-free bug
  - mm/swap: fix race when skipping swapcache
  - !5988 [sync] PR-5901:  CVE-2024-26695
  - !5981 [sync] PR-5812:  afs: Increase buffer size in afs_update_volume_status()
  - fbdev: savage: Error out if pixclock equals zero
  - ARM: ep93xx: Add terminator to gpiod_lookup_table
  - !5948 [sync] PR-5831:  fbdev: sis: Error out if pixclock equals zero
  - !5959 [sync] PR-5884:  KVM: arm64: vgic-its: Fix CVE-2024-26598 fix patch issue
  - !5843 [sync] PR-5348:  s390/ptrace: handle setting of fpc register correctly
  - crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
  - !5857  dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - afs: Increase buffer size in afs_update_volume_status()
  - KVM: arm64: vgic-its: Fix CVE-2024-26598 fix patch issue
  - fbdev: sis: Error out if pixclock equals zero
  - dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - s390/ptrace: handle setting of fpc register correctly
  - KVM: s390: fix setting of fpc register
  - net: fix kabi check warning
  - net: Fix unwanted sign extension in netdev_stats_to_stats64()
  - net: bridge: use DEV_STATS_INC()
  - net: add atomic_long_t to net_device_stats fields
  - team: fix null-ptr-deref when team device type is changed


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.73.0.153
changelog:
  - !6414 [sync] PR-5510:  bus: mhi: host: Drop chan lock before queuing buffers
  - !6143 [sync] PR-6103:  riscv: Sparse-Memory/vmemmap out-of-bounds fix
  - !6535 [sync] PR-5222:  powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  - !6538 [sync] PR-5273:  net/smc: fix illegal rmb_desc access in SMC-D connection dump
  - !6529 [sync] PR-5468:  media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
  - !6298  sp1 fix deadlock in cgroup1_writeback
  - !6497 [sync] PR-6407:  wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump
  - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  - !6506 [sync] PR-5773:  patches for CVE-2023-52617
  - !6502 [sync] PR-5772:  firmware: arm_scmi: Check mailbox/SMT channel for consistency
  - !6518  Fix CVE-2023-52498
  - media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
  - PM: sleep: Fix error handling in dpm_prepare()
  - PM: sleep: Fix possible deadlocks in core system-wide PM code
  - PM: core: Remove unnecessary (void *) conversions
  - PM: sleep: Avoid calling put_device() under dpm_list_mtx
  - PM: sleep: Use dev_printk() when possible
  - async: Introduce async_schedule_dev_nocall()
  - async: Split async_schedule_node_domain()
  - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
  - PCI: switchtec: Fix stdev_release() crash after surprise hot remove
  - firmware: arm_scmi: Check mailbox/SMT channel for consistency
  - !6488 [sync] PR-6455:  CVE-2021-47182
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - !6433 [sync] PR-6312:  fix CVE-2024-24861 for 5.10
  - scsi: core: Fix scsi_mode_sense() buffer length handling
  - scsi: core: Reshuffle response handling in scsi_mode_sense()
  - media: xc4000: Fix atomicity violation in xc4000_get_frequency
  - !6411 [sync] PR-5195:  dmaengine: fix NULL pointer in channel unregistration function
  - bus: mhi: host: Drop chan lock before queuing buffers
  - dmaengine: fix NULL pointer in channel unregistration function
  - cgroup_writeback: fix softlockup for blkcg->memcg_list
  - cgroup_writeback: fix deadlock in cgroup1_writeback
  - !6081  Fix CVE-2024-26764
  - !5967  Fix CVE-2023-52441 and integrate the pre-patch
  - riscv: Sparse-Memory/vmemmap out-of-bounds fix
  - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
  - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
  - ksmbd: fix out of bounds in init_smb2_rsp_hdr()
  - ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr
  - ksmbd: return unsupported error on smb1 mount
  - ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.74.0.154
changelog:
  - !6426 [sync] PR-6291:  aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  - !6902  bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
  - !6920  bpf: Fix hashtab overflow check on 32-bit arches
  - !6926  firmware: arm_scmi: Harden accesses to the reset domains
  - !6922  bpf: Fix stackmap overflow check on 32-bit arches
  - !6864 [sync] PR-6835:  kprobes: Fix check for probe enabled in kill_kprobe()
  - !6898 [sync] PR-6592:  net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  - firmware: arm_scmi: Harden accesses to the reset domains
  - bpf: Fix stackmap overflow check on 32-bit arches
  - bpf: Fix hashtab overflow check on 32-bit arches
  - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
  - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  - !6644 [sync] PR-6623:  amdkfd: use calloc instead of kzalloc to avoid integer overflow
  - kprobes: Fix check for probe enabled in kill_kprobe()
  - !6388 [sync] PR-6202:  ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  - !6628 [sync] PR-6485:  CVE-2024-26843
  - !6752 [sync] PR-6677: v3  olk-5.10: bugfix for mm
  - mm/madvise: fix potential pte_unmap_unlock pte error
  - mm/page_alloc: always attempt to allocate at least one page during bulk allocation
  - !6505  cachefiles: fix memory leak in cachefiles_add_cache()
  - !6687 [sync] PR-6580:  drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  - !6637 [sync] PR-6561:  md: fix kmemleak of rdev->serial
  - amdkfd: use calloc instead of kzalloc to avoid integer overflow
  - !6598 [sync] PR-6584:  ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  - !6607 [sync] PR-6579:  media: rc: bpf attach/detach requires write permission
  - !6606 [sync] PR-6568:  IB/hfi1: Fix a memleak in init_credit_return
  - !6614 [sync] PR-6543:  net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  - !6603 [sync] PR-6520:  firmware: arm_scmi: Fix double free in SMC transport cleanup path
  - md: fix kmemleak of rdev->serial
  - firmware: arm_scmi: Fix double free in SMC transport cleanup path
  - efi: runtime: Fix potential overflow of soft-reserved region size
  - !6249  ubi: Check for too small LEB size in VTBL code
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  - !6449 [sync] PR-6281: v2  net/mlx5: Update error handler for UCTX and UMEM
  - media: rc: bpf attach/detach requires write permission
  - IB/hfi1: Fix a memleak in init_credit_return
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  - !6476  do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  - !6575 [sync] PR-6417:  media: pvrusb2: fix uaf in pvr2_context_set_notify
  - media: pvrusb2: fix uaf in pvr2_context_set_notify
  - cachefiles: fix memory leak in cachefiles_add_cache()
  - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  - net/mlx5: Update error handler for UCTX and UMEM
  - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  - ubi: Check for too small LEB size in VTBL code


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.75.0.155
changelog:
  - !6039 [sync] PR-6006:  fix CVE-2024-26669
  - !5882 [sync] PR-5751:  net: atlantic: Fix DMA mapping for PTP hwts ring
  - !7340  netfilter: nft_limit: reject configurations that cause integer overflow
  - !7253  netfilter: nf_tables: disallow timeout for anonymous sets
  - netfilter: nft_limit: reject configurations that cause integer overflow
  - netfilter: nf_tables: disallow timeout for anonymous sets
  - !7161 [sync] PR-6809:  memcg: fix possible use-after-free in memcg_write_event_control()
  - !7121 [sync] PR-7086:  media: ttpci: fix two memleaks in budget_av_attach
  - !7123 [sync] PR-7080:  drm: nv04: Fix out of bounds access
  - !7145 [sync] PR-7044: v2  nfs: fix UAF in direct writes
  - !7155 [sync] PR-7148:  scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - !7179  ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  - !6978  ksmbd: validate payload size in ipc response
  - !7098 [sync] PR-6818:  mm: memcg: fix stale protection of reclaim target memcg
  - memcg: fix possible use-after-free in memcg_write_event_control()
  - scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - nfs: fix UAF in direct writes
  - !6764 [sync] PR-6680:  cifs: fix underflow in parse_server_interfaces()
  - !6766 [sync] PR-6669:  NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - drm: nv04: Fix out of bounds access
  - media: ttpci: fix two memleaks in budget_av_attach
  - !7102 [sync] PR-7039:  USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - !7084 [sync] PR-7013:  media: edia: dvbdev: fix a use-after-free
  - !7024 [sync] PR-6988:  clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - !6213 [sync] PR-6178:  CVE-2024-26812
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - !7009 [sync] PR-6959:  mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - !7064 [sync] PR-7056:  scsi: qla2xxx: Fix command flush on cable pull
  - mm: memcg: fix stale protection of reclaim target memcg
  - !6946 [sync] PR-6840:  CVE-2023-52650
  - media: edia: dvbdev: fix a use-after-free
  - scsi: qla2xxx: Fix command flush on cable pull
  - !6093 [sync] PR-5921:  ext4: fix double-free of blocks due to wrong extents moved_len
  - !6090 [sync] PR-5977:  btrfs: dev-replace: properly validate device names
  - !6096 [sync] PR-6029:  ceph: prevent use-after-free in encode_cap_msg()
  - !7029 [sync] PR-6977:  wireguard: netlink: access device through ctx instead of peer
  - drm/tegra: dsi: Add missing check for of_find_device_by_node
  - wireguard: netlink: access device through ctx instead of peer
  - !6986 [sync] PR-6964: v2  CVE-2024-27000
  - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - !6691  quota: Fix potential NULL pointer dereference
  - serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
  - serial: mxs-auart: add spinlock around changing cts state
  - serial: core: Provide port lock wrappers
  - !6885 [sync] PR-6740:  V2 cpuset: fix race between rebuild scheduler domains and hotplug work
  - !6961 [sync] PR-6861:  media: dvb-frontends: avoid stack overflow warnings with clang
  - ksmbd: validate payload size in ipc response
  - !6912  pstore: inode: Only d_invalidate() is needed
  - !6937 [sync] PR-6826:  fat: fix uninitialized field in nostale filehandles
  - !6934 [sync] PR-6838:  fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - media: dvb-frontends: avoid stack overflow warnings with clang
  - fat: fix uninitialized field in nostale filehandles
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - pstore: inode: Only d_invalidate() is needed
  - cpuset: fix race between rebuild scheduler domains and hotplug work
  - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - cifs: fix underflow in parse_server_interfaces()
  - quota: Fix potential NULL pointer dereference
  - vfio/pci: Create persistent INTx handler
  - vfio: Introduce interface to flush virqfd inject workqueue
  - ceph: prevent use-after-free in encode_cap_msg()
  - ext4: fix double-free of blocks due to wrong extents moved_len
  - btrfs: dev-replace: properly validate device names
  - net/sched: flower: Fix kabi change
  - net/sched: flower: Fix chain template offload
  - net: atlantic: Fix DMA mapping for PTP hwts ring


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.76.0.156
changelog:
  - !7634  spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
  - !7642  hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - !7724  CVE-2024-27002
  - !7706  pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
  - !7618 [sync] PR-5930:  RDMA/srpt: Support specifying the srpt_service_guid parameter
  - !6243 [sync] PR-6082:  can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  - !6153 [sync] PR-6020:  net/sched: act_mirred: use the backlog for mirred ingress
  - !7621 [sync] PR-6259:  arp: Prevent overflow in arp_req_get().
  - !7616 [sync] PR-5993:  ipv6: sr: fix possible use-after-free and null-ptr-deref
  - !7613 [sync] PR-5996:  mptcp: fix double-free on socket dismantle
  - !6223 [sync] PR-6074:  Fix CVE-2024-26787
  - !7610 [sync] PR-6279:  Bluetooth: Avoid potential use-after-free in hci_error_reset
  - !7380 [sync] PR-6085:  netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  - !7377 [sync] PR-6086:  netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
  - !5984 [sync] PR-5852:  CVE-2024-26809
  - !7708  bpf: Guard stack limits against 32bit overflow
  - !7637  dm-crypt: don't modify the data when using authenticated encryption
  - !7623 [sync] PR-6033:  gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  - !7696  ext4: fix corruption during on-line resize
  - !7703  pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - !7628 [sync] PR-5950:  RDMA/qedr: Fix qedr_create_user_qp error flow
  - clk: mediatek: Do a runtime PM get on controllers during probe
  - !6532 [sync] PR-6486:  devlink: fix possible use-after-free and memory leaks in devlink_init()
  - !7554 [sync] PR-5530:  net: Fix CVE-2024-26641
  - !7551 [sync] PR-7006:  wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - !7667 [sync] PR-7586:  powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - bpf: Guard stack limits against 32bit overflow
  - pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
  - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - ext4: fix corruption during on-line resize
  - !7604  cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  - powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - Merge remote-tracking branch 'upstream/openEuler-22.03-LTS-SP1' into HEAD
  - !7512 [sync] PR-7408:  backport important fix for broadcom net card
  - !7510 [sync] PR-7407:  nvme-fc: do not wait in vain when unloading module
  - !7513 [sync] PR-7406:  drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  - !7508 [sync] PR-7402:  scsi: lpfc: Fix possible file string name overflow when updating firmware
  - !7507 [sync] PR-7404:  scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - !7503 [sync] PR-7403:  scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  - !7523 [sync] PR-7401:  nvme-core: check for too small lba shift
  - !7499 [sync] PR-7396:  drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
  - !7493 [sync] PR-7398:  drm/amd/display: Fix memory leak in dm_sw_fini()
  - !7490 [sync] PR-7399:  drm/amd/pm: fix a double-free in si_dpm_init
  - !7496 [sync] PR-7397:  drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  - Merge remote-tracking branch 'upstream/openEuler-22.03-LTS-SP1' into HEAD
  - !7590  drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
  - !7597 [sync] PR-7548:  btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - !7564  net: hns3: fix kernel crash when 1588 is received on HIP08 devices
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - dm-crypt: don't modify the data when using authenticated encryption
  - spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
  - can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  - dm-crypt: don't modify the data when using authenticated encryption
  - RDMA/qedr: Fix qedr_create_user_qp error flow
  - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  - arp: Prevent overflow in arp_req_get().
  - RDMA/srpt: Support specifying the srpt_service_guid parameter
  - ipv6: sr: fix possible use-after-free and null-ptr-deref
  - mptcp: fix double-free on socket dismantle
  - Bluetooth: Avoid potential use-after-free in hci_error_reset
  - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - !7557 [sync] PR-7520:  drm/i915/gt: Reset queue_priority_hint on parking
  - drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
  - !7363 [sync] PR-5491:  CVE-2024-26640
  - !6553  fixup CVE-2024-26908
  - !7535 v2  CVE-2024-26907
  - net: hns3: fix kernel crash when 1588 is received on HIP08 devices
  - drm/i915/gt: Reset queue_priority_hint on parking
  - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
  - ip6_tunnel: use dev_sw_netstats_rx_add()
  - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - !7518 [sync] PR-7484:  fix CVE-2024-26661
  - kernel-doc: fix struct_group_tagged() parsing
  - uapi: propagate __struct_group() attributes to the container union
  - RDMA/mlx5: Fix fortify source warning while accessing Eth segment
  - uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++
  - stddef: Introduce DECLARE_FLEX_ARRAY() helper
  - uapi/linux/stddef.h: Add include guards
  - stddef: Introduce struct_group() helper macro
  - !7516 [sync] PR-7483:  Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - !7355  blk-iocost: Fix an UBSAN shift-out-of-bounds warning
  - !7347  PM / devfreq: Synchronize devfreq_monitor_[start/stop
  - !7357  sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - !7443 [sync] PR-6037:  fix-CVE-2024-26706
  - nvme-core: check for too small lba shift
  - drm/amd/display: Fix && vs || typos
  - drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
  - !7486 [sync] PR-7476:  firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  - net/tg3: fix race condition in tg3_reset_task()
  - net/tg3: resolve deadlock in tg3_reset_task() during EEH
  - net: bnxt: fix a potential use-after-free in bnxt_init_tc
  - net/bnx2x: Prevent access to a freed page in page_pool
  - nvme-fc: do not wait in vain when unloading module
  - scsi: lpfc: Fix possible file string name overflow when updating firmware
  - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  - drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
  - drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  - drm/amd/display: Fix memory leak in dm_sw_fini()
  - drm/amd/pm: fix a double-free in si_dpm_init
  - !7295  KVM: s390: vsie: fix race during shadow creation
  - firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - !7257  netfilter: nf_tables: disallow anonymous set with timeout flag
  - !7336  inet: read sk->sk_family once in inet_recv_error()
  - !7329  tunnels: fix out of bounds access when building IPv6 PMTU error
  - !7324  net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
  - !7311  btrfs: don't drop extent_map for free space inode on write error
  - !7449 [sync] PR-5998:  net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
  - !7446 [sync] PR-6031:  nilfs2: fix potential bug in end_buffer_async_write
  - !7276  llc: Drop support for ETH_P_TR_802_2.
  - !7281  llc: make llc_ui_sendmsg() more robust against bonding changes
  - !7457  netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !7263  Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - !7479 [sync] PR-7424:  net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - !7343  ppp_async: limit MRU to 64K
  - !5867 [sync] PR-5794:  um: time-travel: fix time corruption
  - !7390 [sync] PR-5469:  wifi: iwlwifi: fix a memory corruption
  - !7313  CVE-2024-26686
  - !7301  nilfs2: fix data corruption in dsync block recovery for small block sizes
  - !7298  powerpc/kasan: Fix addr error caused by page alignment
  - !7274  binder: fix race between mmput() and do_exit()
  - !7261  ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  - !5623 [sync] PR-5566:  tracing: Ensure visibility when inserting an element into tracing_map
  - !7241  SUNRPC: Fix a suspicious RCU usage warning
  - !7231 [sync] PR-5460: v2  crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
  - !7240  bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  - !7319  mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  - !7467 [sync] PR-7394: v2  scsi: sr: Do not leak information in ioctl
  - scsi: sr: Do not leak information in ioctl
  - !7020 [sync] PR-6855:  KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - !7307  iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !7427  net: gtp: Fix Use-After-Free in gtp_dellink
  - !7431 [sync] PR-3972:  arm64: make cma=0 as default for openeuler
  - net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
  - nilfs2: fix potential bug in end_buffer_async_write
  - parisc/unaligned: Fix emulate_ldw() breakage
  - parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd()
  - parisc: Fix random data corruption from exception handler
  - parisc/unaligned: Rewrite 32-bit inline assembly of emulate_sth()
  - parisc/unaligned: Rewrite 32-bit inline assembly of emulate_ldd()
  - parisc/unaligned: Rewrite inline assembly of emulate_ldw()
  - parisc: Mark ex_table entries 32-bit aligned in uaccess.h
  - parisc: Fix some apparent put_user() failures
  - parisc: Implement __get/put_kernel_nofault()
  - parisc: Drop strnlen_user() in favour of generic version
  - parisc: Switch user access functions to signal errors in r29 instead of r8
  - parisc/unaligned: Rewrite inline assembly of emulate_ldh()
  - parisc/unaligned: Use EFAULT fixup handler in unaligned handlers
  - !7436 [sync] PR-7414:  clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
  - clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
  - arm64: make cma=0 as default for openeuler
  - net: gtp: Fix Use-After-Free in gtp_dellink
  - !7383 [sync] PR-6428:  net/sched: flower: Fix unable to handle page fault bug in fl_init
  - !7267  block/rnbd-srv: Check for unlikely string overflow
  - wifi: iwlwifi: fix a memory corruption
  - net/sched: flower: Fix unable to handle page fault bug in fl_init
  - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  - netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
  - tcp: add sanity checks to rx zerocopy
  - net-zerocopy: Refactor frag-is-remappable test.
  - sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - blk-iocost: Fix an UBSAN shift-out-of-bounds warning
  - PM / devfreq: Synchronize devfreq_monitor_[start/stop]
  - ppp_async: limit MRU to 64K
  - inet: read sk->sk_family once in inet_recv_error()
  - tunnels: fix out of bounds access when building IPv6 PMTU error
  - net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
  - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
  - fs/proc: do_task_stat: use __for_each_thread()
  - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand()
  - exit: Use the correct exit_code in /proc/<pid>/stat
  - btrfs: don't drop extent_map for free space inode on write error
  - iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  - nilfs2: fix data corruption in dsync block recovery for small block sizes
  - powerpc/kasan: Fix addr error caused by page alignment
  - KVM: s390: vsie: fix race during shadow creation
  - llc: make llc_ui_sendmsg() more robust against bonding changes
  - llc: Drop support for ETH_P_TR_802_2.
  - binder: fix race between mmput() and do_exit()
  - block/rnbd-srv: Check for unlikely string overflow
  - Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  - netfilter: nf_tables: disallow anonymous set with timeout flag
  - SUNRPC: Fix a suspicious RCU usage warning
  - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  - crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - x86/xen: Add some null pointer checking to smp.c
  - devlink: fix possible use-after-free and memory leaks in devlink_init()
  - mmc: mmci: stm32: fix DMA API overlapping mappings warning
  - mmc: mmci: stm32: use a buffer for unaligned DMA requests
  - net/sched: act_mirred: use the backlog for mirred ingress
  - netfilter: nft_set_pipapo: release elements in clone only from destroy path
  - netfilter: nft_set_pipapo: remove scratch_aligned pointer
  - netfilter: nft_set_pipapo: add helper to release pcpu scratch area
  - netfilter: nft_set_pipapo: store index in scratch maps
  - um: time-travel: fix time corruption
  - tracing: Ensure visibility when inserting an element into tracing_map


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.77.0.157
changelog:
  - !8099  Fix CVE-2023-52854
  - !8045  drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process
  - !8148  pinctrl: single: fix potential NULL dereference
  - !8157 [sync] PR-8017:  perf/core: Bail out early if the request AUX area is out of bound
  - !8114 [sync] PR-8023:  fs/ntfs3: Fixed overflow check in mi_enum_attr()
  - !8093 [sync] PR-7980:  Fix CVE-2021-47455
  - !8117 [sync] PR-8060:  soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  - !7799  net-memcg: Fix scope of sockmem pressure indicators
  - !8087 [sync] PR-8019:  pstore/zone: Add a null pointer check to the psz_kmsg_read
  - !8095 [sync] PR-7143:  media: usbtv: Remove useless locks in usbtv_video_free()
  - !7134 [sync] PR-7092:  Squashfs: check the inode number is not the invalid value of zero
  - perf/core: Bail out early if the request AUX area is out of bound
  - !8132  scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
  - pinctrl: single: fix potential NULL dereference
  - !8083 [sync] PR-6808:  CVE-2024-26923
  - !8003 [sync] PR-7970:  fbmon: prevent division by zero in fb_videomode_from_videomode()
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
  - !6875 [sync] PR-6756:  vfio/fsl-mc: Block calling interrupt handler without trigger
  - soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  - fs/ntfs3: Fixed overflow check in mi_enum_attr()
  - !7879 [sync] PR-7684:  dm snapshot: fix lockup in dm_exception_table_exit
  - !8072 [sync] PR-8030:  netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  - padata: Fix refcnt handling in padata_free_shell()
  - padata: Convert from atomic_t to refcount_t on parallel_data->refcnt
  - !7995  HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  - !8041  media: vidtv: mux: Add check and kfree for kstrdup
  - media: usbtv: Remove useless locks in usbtv_video_free()
  - ptp: fix code indentation issues
  - ptp: Fix possible memory leak in ptp_clock_register()
  - !7962  hwmon: (axi-fan-control) Fix possible NULL pointer dereference
  - pstore/zone: Add a null pointer check to the psz_kmsg_read
  - !8020  media: bttv: fix use after free error due to btv->timeout timer
  - af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
  - af_unix: Fix garbage collector racing against connect()
  - !8026 [sync] PR-7961:  net: atlantic: eliminate double free in error handling logic
  - !7945  crypto: engine - fix crypto_queue backlog handling
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  - !8034  clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data
  - drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process
  - media: vidtv: mux: Add check and kfree for kstrdup
  - clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data
  - !8005 [sync] PR-7903:  virtio_ring : keep used_wrap_counter in
  - net: atlantic: eliminate double free in error handling logic
  - media: bttv: fix use after free error due to btv->timeout timer
  - virtio_ring : keep used_wrap_counter in vq->last_used_idx
  - fbmon: prevent division by zero in fb_videomode_from_videomode()
  - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  - !7954  media: vidtv: psi: Add check for kstrdup
  - !7973 [sync] PR-7949:  drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
  - !7968 [sync] PR-7943: v2  netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  - !7939 v2  pstore/platform: Add check for kstrdup
  - drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
  - netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  - !7936 [sync] PR-7911:  ACPI: LPIT: Avoid u32 multiplication overflow
  - !7850 [sync] PR-7576:  f2fs: compress: fix reserve_cblocks counting error when out of space
  - !7862 [sync] PR-7757:  Fix CVE-2023-52656
  - hwmon: (axi-fan-control) Fix possible NULL pointer dereference
  - media: vidtv: psi: Add check for kstrdup
  - crypto: engine - fix crypto_queue backlog handling
  - !7914 [sync] PR-7853:  net/mlx5e: fix a double-free in arfs_create_groups
  - pstore/platform: Add check for kstrdup
  - ACPI: LPIT: Avoid u32 multiplication overflow
  - !7787 [sync] PR-7655: v3  KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
  - !7906 [sync] PR-7877: v4  eeprom: at24: fix memory corruption race condition
  - net/mlx5e: fix a double-free in arfs_create_groups
  - !7897  Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
  - eeprom: at24: fix memory corruption race condition
  - !7796 [sync] PR-7743:  netrom: Fix data-races around sysctl_net_busy_read
  - !7884 [sync] PR-7773:  Fix CVE-2023-52698
  - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
  - calipso: fix memory leak in netlbl_calipso_add_pass()
  - netlabel: remove unused parameter in netlbl_netlink_auditinfo()
  - net: netlabel: Fix kerneldoc warnings
  - dm snapshot: fix lockup in dm_exception_table_exit
  - !7859 [sync] PR-7846:  netrom: Fix a data-race around sysctl_netrom_transport_timeout
  - io_uring: drop any code related to SCM_RIGHTS
  - io_uring/unix: drop usage of io_uring socket
  - netrom: Fix a data-race around sysctl_netrom_transport_timeout
  - !7778 [sync] PR-7749: v2  wifi: iwlwifi: dbg-tlv: ensure NUL termination
  - f2fs: compress: fix reserve_cblocks counting error when out of space
  - !7829 [sync] PR-7779:  LoongArch: Define the __io_aw() hook as mmiowb()
  - !7826 [sync] PR-7714:  CVE-2024-35936
  - !7837 [sync] PR-7681:  xfs: three bug fix recently
  - xfs: update dir3 leaf block metadata after swap
  - xfs: ensure logflagsp is initialized in xfs_bmap_del_extent_real
  - iomap: fix warning in xfs_iomap_write_delalloc_release()
  - !7747  x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  - !7819 [sync] PR-7734:  mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
  - LoongArch: Define the __io_aw() hook as mmiowb()
  - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
  - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
  - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
  - net-memcg: Fix scope of sockmem pressure indicators
  - netrom: Fix data-races around sysctl_net_busy_read
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
  - !7768  net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination
  - !7711 [sync] PR-7579:  powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  - !7755  wifi: ath11k: decrease MHI channel buffer length to 8KB
  - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
  - wifi: ath11k: decrease MHI channel buffer length to 8KB
  - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  - powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  - Merge remote-tracking branch 'upstream/openEuler-22.03-LTS-SP1' into HEAD
  - Merge remote-tracking branch 'upstream/openEuler-22.03-LTS-SP1' into HEAD
  - Squashfs: check the inode number is not the invalid value of zero
  - vfio/fsl-mc: Block calling interrupt handler without trigger


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.78.0.158
changelog:
  - !8594 [sync] PR-6990:  netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - !8591 [sync] PR-7174:  CVE-2022-48689
  - !8595 [sync] PR-6939:  USB: core: Fix deadlock in usb_deauthorize_interface()
  - !8554 [sync] PR-8395:  5.10: fix CVE-2024-35978
  - !8364  perf: hisi: Fix use-after-free when register pmu fails
  - !8606  smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  - !7672  btrfs: send: handle path ref underflow in header iterate_inode_ref()
  - !8597 [sync] PR-6393:  crypto: xilinx - call finalize with bh disabled
  - !8514  net: ena: Fix incorrect descriptor free behavior
  - !8563 [sync] PR-8110:  drm/client: Fully protect modes[
  - smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  - crypto: xilinx - call finalize with bh disabled
  - USB: core: Fix deadlock in usb_deauthorize_interface()
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - tcp: TX zerocopy should not sense pfmemalloc status
  - net: skbuff: update comment about pfmemalloc propagating
  - net: introduce __skb_fill_page_desc_noacc
  - tcp: factor out tcp_build_frag()
  - !8505  CVE: CVE-2024-36015
  - drm/client: Fully protect modes[] with dev->mode_config.mutex
  - !8523  tty: vcc: Add check for kstrdup() in vcc_probe()
  - !8487 [sync] PR-8397:  mm/hugetlb: fix missing hugetlb_lock for resv uncharge
  - !8486 [sync] PR-8373:  dma-direct: Leak pages on dma_set_decrypted() failure
  - !8245 [sync] PR-7870:  CVE-2024-35995
  - Bluetooth: Fix memory leak in hci_req_sync_complete()
  - !8202  arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
  - !8408  pinctrl: core: delete incorrect free in pinctrl_enable()
  - tty: vcc: Add check for kstrdup() in vcc_probe()
  - net: ena: Fix incorrect descriptor free behavior
  - !8457 [sync] PR-8416:  iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
  - !8501 [sync] PR-7889:  vt: fix unicode buffer corruption when deleting characters
  - ppdev: Add an error check in register_device
  - ppdev: Remove usage of the deprecated ida_simple_xx() API
  - vt: fix unicode buffer corruption when deleting characters
  - mm/hugetlb: fix missing hugetlb_lock for resv uncharge
  - dma-direct: Leak pages on dma_set_decrypted() failure
  - !8429  drm/amdgpu: Fix even more out of bound writes from debugfs
  - !8340  soc: qcom: llcc: Handle a second device without data corruption
  - !8369  efi/capsule-loader: fix incorrect allocation size
  - !8312 [sync] PR-8039: v2  dynamic_hugetlb: backport some bugfix
  - !8451 [sync] PR-8342:  net/mlx5: Properly link new fs rules into the tree
  - !8293  drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
  - iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
  - net/mlx5: Properly link new fs rules into the tree
  - !8179  jfs: fix array-index-out-of-bounds in diAlloc
  - !8167 v2  mmc: sdio: fix possible resource leaks in some error paths
  - !8346 [sync] PR-8248:  gfs2: ignore negated quota changes
  - !8331 [sync] PR-8254:  sysv: don't call sb_bread() with pointers_lock held
  - !8375 [sync] PR-8306:  mptcp: ensure tx skbs always have the MPTCP ext
  - drm/amdgpu: Fix even more out of bound writes from debugfs
  - !8391 [sync] PR-8109:  vhost-vdpa: fix use after free in vhost_vdpa_probe()
  - pinctrl: core: delete incorrect free in pinctrl_enable()
  - !8370  locking/ww_mutex/test: Fix potential workqueue corruption
  - !8311  drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
  - !8334  wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
  - !8317  net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
  - !8235 [sync] PR-8054:  CVE-2023-52669
  - !8380 [sync] PR-8212:  fix CVE-2024-35877
  - vhost-vdpa: fix use after free in vhost_vdpa_probe()
  - !8294  CVE-2023-52735
  - x86/mm/pat: fix VM_PAT handling in COW mappings
  - !8196  clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
  - mptcp: ensure tx skbs always have the MPTCP ext
  - locking/ww_mutex/test: Fix potential workqueue corruption
  - efi/capsule-loader: fix incorrect allocation size
  - perf: hisi: Fix use-after-free when register pmu fails
  - !7776 [sync] PR-7717:  CVE-2023-52655
  - !8323 [sync] PR-8219:  tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
  - !8273  ALSA: hda: Do not unset preset when cleaning up codec
  - !8269  drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
  - !8251 v2  CVE-2024-35956
  - gfs2: ignore negated quota changes
  - soc: qcom: llcc: Handle a second device without data corruption
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
  - sysv: don't call sb_bread() with pointers_lock held
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
  - !8277  usb: udc: remove warning when queue disabled ep
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
  - !8289 [sync] PR-8150:  mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
  - !8265 [sync] PR-8228:  ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  - mm/dynamic_hugetlb: refine error info in the destruction
  - mm/dynamic_hugetlb: make free_huge_page_to_dhugetlb_pool irq safe
  - mm/dynamic_hugetlb: check NULL pointer for early parameter
  - mm/dynamic_hugetlb: add lru_add_drain_all() before migration
  - mm/dynamic_hugetlb: add cond_resched() in hpool_merge_page()
  - mm/dynamic_hugetlb: reduce the number of migration attempts
  - mm/dpool: Use helper function to lock/unlock
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
  - !8231  CVE-2023-52804
  - bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
  - bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself
  - drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
  - mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
  - !7833 [sync] PR-7599:  irqchip/gic-v3-its: Prevent double free on error
  - !8259 v5  can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
  - usb: udc: remove warning when queue disabled ep
  - ALSA: hda: Do not unset preset when cleaning up codec
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
  - ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
  - !7855  clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
  - btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations
  - btrfs: fix anon_dev leak in create_subvol()
  - ACPI: CPPC: Fix access width used for PCC registers
  - ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
  - ACPI: CPPC: Use access_width over bit_width for system memory accesses
  - ACPI: CPPC: Fix up I/O port access in cpc_read()
  - ACPI: CPPC: Implement support for SystemIO registers
  - crypto: s390/aes - Fix buffer overread in CTR mode
  - fs/jfs: Add validity check for db_maxag and db_agpref
  - fs: jfs: fix shift-out-of-bounds in dbAllocAG
  - !8224  ALSA: hda: Fix possible null-ptr-deref when assigning a stream
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream
  - !8125 [sync] PR-8042:  xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  - arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
  - clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
  - jfs: fix array-index-out-of-bounds in diAlloc
  - mmc: sdio: fix possible resource leaks in some error paths
  - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  - clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
  - irqchip/gic-v3-its: Prevent double free on error
  - usb: aqc111: check packet for fixup for true limit
  - btrfs: send: handle path ref underflow in header iterate_inode_ref()


author: yaoxin <yao_xin001@hoperun.com> - 2.20.0-1
changelog:
  - Upgrade to 2.20.0
  - Fix CVE-2023-39929
  - Fix minor issue about printf data type and value range
  - av1: Revise offsets comments for av1 encode
  - jpeg: add support for crop and partial decode
  - Drop no longer applicable vaGetDriverNames check


