# changelog

author: xinghe <xinghe2@h-partners.com> - 2.6.6-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:connection: Clear flags when a conn is removed
         connection: Preserve flags when a conn is removed
         stream: do not try to free a failed stream-conn
         http_ana/txn: don't re-initialize txn and req var
         mworker: prevent incorrect values in uptime
         protocol: fix minor memory leak in protocol_bind_all()
         stream: Perform errors handling in right order in stream_new()


author: xinghe <xinghe2@h-partners.com> - 2.6.6-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:backport to fix potential coredump:
         errors: handle malloc failure in usermsgs_put
         ssl_sock: add check for ha_meth
         thread: add a check for pthread_creat


author: xinghe <xinghe2@h-partners.com> - 2.6.6-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:server: add missing free for server->rdr_pfx
         server: do not leak default-server in defaults


author: xinghe <xinghe2@h-partners.com> - 2.6.6-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:server: 'source' interface ignored from 'default-server' directive


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.75.0.155
changelog:
  - !6039 [sync] PR-6006:  fix CVE-2024-26669
  - !5882 [sync] PR-5751:  net: atlantic: Fix DMA mapping for PTP hwts ring
  - !7340  netfilter: nft_limit: reject configurations that cause integer overflow
  - !7253  netfilter: nf_tables: disallow timeout for anonymous sets
  - netfilter: nft_limit: reject configurations that cause integer overflow
  - netfilter: nf_tables: disallow timeout for anonymous sets
  - !7161 [sync] PR-6809:  memcg: fix possible use-after-free in memcg_write_event_control()
  - !7121 [sync] PR-7086:  media: ttpci: fix two memleaks in budget_av_attach
  - !7123 [sync] PR-7080:  drm: nv04: Fix out of bounds access
  - !7145 [sync] PR-7044: v2  nfs: fix UAF in direct writes
  - !7155 [sync] PR-7148:  scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - !7179  ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  - !6978  ksmbd: validate payload size in ipc response
  - !7098 [sync] PR-6818:  mm: memcg: fix stale protection of reclaim target memcg
  - memcg: fix possible use-after-free in memcg_write_event_control()
  - scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - nfs: fix UAF in direct writes
  - !6764 [sync] PR-6680:  cifs: fix underflow in parse_server_interfaces()
  - !6766 [sync] PR-6669:  NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - drm: nv04: Fix out of bounds access
  - media: ttpci: fix two memleaks in budget_av_attach
  - !7102 [sync] PR-7039:  USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - !7084 [sync] PR-7013:  media: edia: dvbdev: fix a use-after-free
  - !7024 [sync] PR-6988:  clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - !6213 [sync] PR-6178:  CVE-2024-26812
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - !7009 [sync] PR-6959:  mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - !7064 [sync] PR-7056:  scsi: qla2xxx: Fix command flush on cable pull
  - mm: memcg: fix stale protection of reclaim target memcg
  - !6946 [sync] PR-6840:  CVE-2023-52650
  - media: edia: dvbdev: fix a use-after-free
  - scsi: qla2xxx: Fix command flush on cable pull
  - !6093 [sync] PR-5921:  ext4: fix double-free of blocks due to wrong extents moved_len
  - !6090 [sync] PR-5977:  btrfs: dev-replace: properly validate device names
  - !6096 [sync] PR-6029:  ceph: prevent use-after-free in encode_cap_msg()
  - !7029 [sync] PR-6977:  wireguard: netlink: access device through ctx instead of peer
  - drm/tegra: dsi: Add missing check for of_find_device_by_node
  - wireguard: netlink: access device through ctx instead of peer
  - !6986 [sync] PR-6964: v2  CVE-2024-27000
  - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - !6691  quota: Fix potential NULL pointer dereference
  - serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
  - serial: mxs-auart: add spinlock around changing cts state
  - serial: core: Provide port lock wrappers
  - !6885 [sync] PR-6740:  V2 cpuset: fix race between rebuild scheduler domains and hotplug work
  - !6961 [sync] PR-6861:  media: dvb-frontends: avoid stack overflow warnings with clang
  - ksmbd: validate payload size in ipc response
  - !6912  pstore: inode: Only d_invalidate() is needed
  - !6937 [sync] PR-6826:  fat: fix uninitialized field in nostale filehandles
  - !6934 [sync] PR-6838:  fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - media: dvb-frontends: avoid stack overflow warnings with clang
  - fat: fix uninitialized field in nostale filehandles
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - pstore: inode: Only d_invalidate() is needed
  - cpuset: fix race between rebuild scheduler domains and hotplug work
  - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - cifs: fix underflow in parse_server_interfaces()
  - quota: Fix potential NULL pointer dereference
  - vfio/pci: Create persistent INTx handler
  - vfio: Introduce interface to flush virqfd inject workqueue
  - ceph: prevent use-after-free in encode_cap_msg()
  - ext4: fix double-free of blocks due to wrong extents moved_len
  - btrfs: dev-replace: properly validate device names
  - net/sched: flower: Fix kabi change
  - net/sched: flower: Fix chain template offload
  - net: atlantic: Fix DMA mapping for PTP hwts ring


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.76.0.156
changelog:
  - !7634  spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
  - !7642  hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - !7724  CVE-2024-27002
  - !7706  pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
  - !7618 [sync] PR-5930:  RDMA/srpt: Support specifying the srpt_service_guid parameter
  - !6243 [sync] PR-6082:  can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  - !6153 [sync] PR-6020:  net/sched: act_mirred: use the backlog for mirred ingress
  - !7621 [sync] PR-6259:  arp: Prevent overflow in arp_req_get().
  - !7616 [sync] PR-5993:  ipv6: sr: fix possible use-after-free and null-ptr-deref
  - !7613 [sync] PR-5996:  mptcp: fix double-free on socket dismantle
  - !6223 [sync] PR-6074:  Fix CVE-2024-26787
  - !7610 [sync] PR-6279:  Bluetooth: Avoid potential use-after-free in hci_error_reset
  - !7380 [sync] PR-6085:  netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  - !7377 [sync] PR-6086:  netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
  - !5984 [sync] PR-5852:  CVE-2024-26809
  - !7708  bpf: Guard stack limits against 32bit overflow
  - !7637  dm-crypt: don't modify the data when using authenticated encryption
  - !7623 [sync] PR-6033:  gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  - !7696  ext4: fix corruption during on-line resize
  - !7703  pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - !7628 [sync] PR-5950:  RDMA/qedr: Fix qedr_create_user_qp error flow
  - clk: mediatek: Do a runtime PM get on controllers during probe
  - !6532 [sync] PR-6486:  devlink: fix possible use-after-free and memory leaks in devlink_init()
  - !7554 [sync] PR-5530:  net: Fix CVE-2024-26641
  - !7551 [sync] PR-7006:  wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - !7667 [sync] PR-7586:  powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - bpf: Guard stack limits against 32bit overflow
  - pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
  - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - ext4: fix corruption during on-line resize
  - !7604  cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  - powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - Merge remote-tracking branch 'upstream/openEuler-22.03-LTS-SP1' into HEAD
  - !7512 [sync] PR-7408:  backport important fix for broadcom net card
  - !7510 [sync] PR-7407:  nvme-fc: do not wait in vain when unloading module
  - !7513 [sync] PR-7406:  drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  - !7508 [sync] PR-7402:  scsi: lpfc: Fix possible file string name overflow when updating firmware
  - !7507 [sync] PR-7404:  scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - !7503 [sync] PR-7403:  scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  - !7523 [sync] PR-7401:  nvme-core: check for too small lba shift
  - !7499 [sync] PR-7396:  drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
  - !7493 [sync] PR-7398:  drm/amd/display: Fix memory leak in dm_sw_fini()
  - !7490 [sync] PR-7399:  drm/amd/pm: fix a double-free in si_dpm_init
  - !7496 [sync] PR-7397:  drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  - Merge remote-tracking branch 'upstream/openEuler-22.03-LTS-SP1' into HEAD
  - !7590  drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
  - !7597 [sync] PR-7548:  btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - !7564  net: hns3: fix kernel crash when 1588 is received on HIP08 devices
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - dm-crypt: don't modify the data when using authenticated encryption
  - spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
  - can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  - dm-crypt: don't modify the data when using authenticated encryption
  - RDMA/qedr: Fix qedr_create_user_qp error flow
  - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  - arp: Prevent overflow in arp_req_get().
  - RDMA/srpt: Support specifying the srpt_service_guid parameter
  - ipv6: sr: fix possible use-after-free and null-ptr-deref
  - mptcp: fix double-free on socket dismantle
  - Bluetooth: Avoid potential use-after-free in hci_error_reset
  - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - !7557 [sync] PR-7520:  drm/i915/gt: Reset queue_priority_hint on parking
  - drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
  - !7363 [sync] PR-5491:  CVE-2024-26640
  - !6553  fixup CVE-2024-26908
  - !7535 v2  CVE-2024-26907
  - net: hns3: fix kernel crash when 1588 is received on HIP08 devices
  - drm/i915/gt: Reset queue_priority_hint on parking
  - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
  - ip6_tunnel: use dev_sw_netstats_rx_add()
  - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - !7518 [sync] PR-7484:  fix CVE-2024-26661
  - kernel-doc: fix struct_group_tagged() parsing
  - uapi: propagate __struct_group() attributes to the container union
  - RDMA/mlx5: Fix fortify source warning while accessing Eth segment
  - uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++
  - stddef: Introduce DECLARE_FLEX_ARRAY() helper
  - uapi/linux/stddef.h: Add include guards
  - stddef: Introduce struct_group() helper macro
  - !7516 [sync] PR-7483:  Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - !7355  blk-iocost: Fix an UBSAN shift-out-of-bounds warning
  - !7347  PM / devfreq: Synchronize devfreq_monitor_[start/stop
  - !7357  sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - !7443 [sync] PR-6037:  fix-CVE-2024-26706
  - nvme-core: check for too small lba shift
  - drm/amd/display: Fix && vs || typos
  - drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
  - !7486 [sync] PR-7476:  firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  - net/tg3: fix race condition in tg3_reset_task()
  - net/tg3: resolve deadlock in tg3_reset_task() during EEH
  - net: bnxt: fix a potential use-after-free in bnxt_init_tc
  - net/bnx2x: Prevent access to a freed page in page_pool
  - nvme-fc: do not wait in vain when unloading module
  - scsi: lpfc: Fix possible file string name overflow when updating firmware
  - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  - drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
  - drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  - drm/amd/display: Fix memory leak in dm_sw_fini()
  - drm/amd/pm: fix a double-free in si_dpm_init
  - !7295  KVM: s390: vsie: fix race during shadow creation
  - firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - !7257  netfilter: nf_tables: disallow anonymous set with timeout flag
  - !7336  inet: read sk->sk_family once in inet_recv_error()
  - !7329  tunnels: fix out of bounds access when building IPv6 PMTU error
  - !7324  net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
  - !7311  btrfs: don't drop extent_map for free space inode on write error
  - !7449 [sync] PR-5998:  net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
  - !7446 [sync] PR-6031:  nilfs2: fix potential bug in end_buffer_async_write
  - !7276  llc: Drop support for ETH_P_TR_802_2.
  - !7281  llc: make llc_ui_sendmsg() more robust against bonding changes
  - !7457  netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !7263  Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - !7479 [sync] PR-7424:  net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - !7343  ppp_async: limit MRU to 64K
  - !5867 [sync] PR-5794:  um: time-travel: fix time corruption
  - !7390 [sync] PR-5469:  wifi: iwlwifi: fix a memory corruption
  - !7313  CVE-2024-26686
  - !7301  nilfs2: fix data corruption in dsync block recovery for small block sizes
  - !7298  powerpc/kasan: Fix addr error caused by page alignment
  - !7274  binder: fix race between mmput() and do_exit()
  - !7261  ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  - !5623 [sync] PR-5566:  tracing: Ensure visibility when inserting an element into tracing_map
  - !7241  SUNRPC: Fix a suspicious RCU usage warning
  - !7231 [sync] PR-5460: v2  crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
  - !7240  bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  - !7319  mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  - !7467 [sync] PR-7394: v2  scsi: sr: Do not leak information in ioctl
  - scsi: sr: Do not leak information in ioctl
  - !7020 [sync] PR-6855:  KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - !7307  iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !7427  net: gtp: Fix Use-After-Free in gtp_dellink
  - !7431 [sync] PR-3972:  arm64: make cma=0 as default for openeuler
  - net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
  - nilfs2: fix potential bug in end_buffer_async_write
  - parisc/unaligned: Fix emulate_ldw() breakage
  - parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd()
  - parisc: Fix random data corruption from exception handler
  - parisc/unaligned: Rewrite 32-bit inline assembly of emulate_sth()
  - parisc/unaligned: Rewrite 32-bit inline assembly of emulate_ldd()
  - parisc/unaligned: Rewrite inline assembly of emulate_ldw()
  - parisc: Mark ex_table entries 32-bit aligned in uaccess.h
  - parisc: Fix some apparent put_user() failures
  - parisc: Implement __get/put_kernel_nofault()
  - parisc: Drop strnlen_user() in favour of generic version
  - parisc: Switch user access functions to signal errors in r29 instead of r8
  - parisc/unaligned: Rewrite inline assembly of emulate_ldh()
  - parisc/unaligned: Use EFAULT fixup handler in unaligned handlers
  - !7436 [sync] PR-7414:  clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
  - clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
  - arm64: make cma=0 as default for openeuler
  - net: gtp: Fix Use-After-Free in gtp_dellink
  - !7383 [sync] PR-6428:  net/sched: flower: Fix unable to handle page fault bug in fl_init
  - !7267  block/rnbd-srv: Check for unlikely string overflow
  - wifi: iwlwifi: fix a memory corruption
  - net/sched: flower: Fix unable to handle page fault bug in fl_init
  - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  - netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
  - tcp: add sanity checks to rx zerocopy
  - net-zerocopy: Refactor frag-is-remappable test.
  - sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - blk-iocost: Fix an UBSAN shift-out-of-bounds warning
  - PM / devfreq: Synchronize devfreq_monitor_[start/stop]
  - ppp_async: limit MRU to 64K
  - inet: read sk->sk_family once in inet_recv_error()
  - tunnels: fix out of bounds access when building IPv6 PMTU error
  - net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
  - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
  - fs/proc: do_task_stat: use __for_each_thread()
  - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand()
  - exit: Use the correct exit_code in /proc/<pid>/stat
  - btrfs: don't drop extent_map for free space inode on write error
  - iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  - nilfs2: fix data corruption in dsync block recovery for small block sizes
  - powerpc/kasan: Fix addr error caused by page alignment
  - KVM: s390: vsie: fix race during shadow creation
  - llc: make llc_ui_sendmsg() more robust against bonding changes
  - llc: Drop support for ETH_P_TR_802_2.
  - binder: fix race between mmput() and do_exit()
  - block/rnbd-srv: Check for unlikely string overflow
  - Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  - netfilter: nf_tables: disallow anonymous set with timeout flag
  - SUNRPC: Fix a suspicious RCU usage warning
  - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  - crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - x86/xen: Add some null pointer checking to smp.c
  - devlink: fix possible use-after-free and memory leaks in devlink_init()
  - mmc: mmci: stm32: fix DMA API overlapping mappings warning
  - mmc: mmci: stm32: use a buffer for unaligned DMA requests
  - net/sched: act_mirred: use the backlog for mirred ingress
  - netfilter: nft_set_pipapo: release elements in clone only from destroy path
  - netfilter: nft_set_pipapo: remove scratch_aligned pointer
  - netfilter: nft_set_pipapo: add helper to release pcpu scratch area
  - netfilter: nft_set_pipapo: store index in scratch maps
  - um: time-travel: fix time corruption
  - tracing: Ensure visibility when inserting an element into tracing_map


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.77.0.157
changelog:
  - !8099  Fix CVE-2023-52854
  - !8045  drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process
  - !8148  pinctrl: single: fix potential NULL dereference
  - !8157 [sync] PR-8017:  perf/core: Bail out early if the request AUX area is out of bound
  - !8114 [sync] PR-8023:  fs/ntfs3: Fixed overflow check in mi_enum_attr()
  - !8093 [sync] PR-7980:  Fix CVE-2021-47455
  - !8117 [sync] PR-8060:  soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  - !7799  net-memcg: Fix scope of sockmem pressure indicators
  - !8087 [sync] PR-8019:  pstore/zone: Add a null pointer check to the psz_kmsg_read
  - !8095 [sync] PR-7143:  media: usbtv: Remove useless locks in usbtv_video_free()
  - !7134 [sync] PR-7092:  Squashfs: check the inode number is not the invalid value of zero
  - perf/core: Bail out early if the request AUX area is out of bound
  - !8132  scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
  - pinctrl: single: fix potential NULL dereference
  - !8083 [sync] PR-6808:  CVE-2024-26923
  - !8003 [sync] PR-7970:  fbmon: prevent division by zero in fb_videomode_from_videomode()
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
  - !6875 [sync] PR-6756:  vfio/fsl-mc: Block calling interrupt handler without trigger
  - soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  - fs/ntfs3: Fixed overflow check in mi_enum_attr()
  - !7879 [sync] PR-7684:  dm snapshot: fix lockup in dm_exception_table_exit
  - !8072 [sync] PR-8030:  netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  - padata: Fix refcnt handling in padata_free_shell()
  - padata: Convert from atomic_t to refcount_t on parallel_data->refcnt
  - !7995  HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  - !8041  media: vidtv: mux: Add check and kfree for kstrdup
  - media: usbtv: Remove useless locks in usbtv_video_free()
  - ptp: fix code indentation issues
  - ptp: Fix possible memory leak in ptp_clock_register()
  - !7962  hwmon: (axi-fan-control) Fix possible NULL pointer dereference
  - pstore/zone: Add a null pointer check to the psz_kmsg_read
  - !8020  media: bttv: fix use after free error due to btv->timeout timer
  - af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
  - af_unix: Fix garbage collector racing against connect()
  - !8026 [sync] PR-7961:  net: atlantic: eliminate double free in error handling logic
  - !7945  crypto: engine - fix crypto_queue backlog handling
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  - !8034  clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data
  - drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process
  - media: vidtv: mux: Add check and kfree for kstrdup
  - clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data
  - !8005 [sync] PR-7903:  virtio_ring : keep used_wrap_counter in
  - net: atlantic: eliminate double free in error handling logic
  - media: bttv: fix use after free error due to btv->timeout timer
  - virtio_ring : keep used_wrap_counter in vq->last_used_idx
  - fbmon: prevent division by zero in fb_videomode_from_videomode()
  - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  - !7954  media: vidtv: psi: Add check for kstrdup
  - !7973 [sync] PR-7949:  drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
  - !7968 [sync] PR-7943: v2  netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  - !7939 v2  pstore/platform: Add check for kstrdup
  - drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
  - netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  - !7936 [sync] PR-7911:  ACPI: LPIT: Avoid u32 multiplication overflow
  - !7850 [sync] PR-7576:  f2fs: compress: fix reserve_cblocks counting error when out of space
  - !7862 [sync] PR-7757:  Fix CVE-2023-52656
  - hwmon: (axi-fan-control) Fix possible NULL pointer dereference
  - media: vidtv: psi: Add check for kstrdup
  - crypto: engine - fix crypto_queue backlog handling
  - !7914 [sync] PR-7853:  net/mlx5e: fix a double-free in arfs_create_groups
  - pstore/platform: Add check for kstrdup
  - ACPI: LPIT: Avoid u32 multiplication overflow
  - !7787 [sync] PR-7655: v3  KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
  - !7906 [sync] PR-7877: v4  eeprom: at24: fix memory corruption race condition
  - net/mlx5e: fix a double-free in arfs_create_groups
  - !7897  Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
  - eeprom: at24: fix memory corruption race condition
  - !7796 [sync] PR-7743:  netrom: Fix data-races around sysctl_net_busy_read
  - !7884 [sync] PR-7773:  Fix CVE-2023-52698
  - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
  - calipso: fix memory leak in netlbl_calipso_add_pass()
  - netlabel: remove unused parameter in netlbl_netlink_auditinfo()
  - net: netlabel: Fix kerneldoc warnings
  - dm snapshot: fix lockup in dm_exception_table_exit
  - !7859 [sync] PR-7846:  netrom: Fix a data-race around sysctl_netrom_transport_timeout
  - io_uring: drop any code related to SCM_RIGHTS
  - io_uring/unix: drop usage of io_uring socket
  - netrom: Fix a data-race around sysctl_netrom_transport_timeout
  - !7778 [sync] PR-7749: v2  wifi: iwlwifi: dbg-tlv: ensure NUL termination
  - f2fs: compress: fix reserve_cblocks counting error when out of space
  - !7829 [sync] PR-7779:  LoongArch: Define the __io_aw() hook as mmiowb()
  - !7826 [sync] PR-7714:  CVE-2024-35936
  - !7837 [sync] PR-7681:  xfs: three bug fix recently
  - xfs: update dir3 leaf block metadata after swap
  - xfs: ensure logflagsp is initialized in xfs_bmap_del_extent_real
  - iomap: fix warning in xfs_iomap_write_delalloc_release()
  - !7747  x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  - !7819 [sync] PR-7734:  mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
  - LoongArch: Define the __io_aw() hook as mmiowb()
  - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
  - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
  - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
  - net-memcg: Fix scope of sockmem pressure indicators
  - netrom: Fix data-races around sysctl_net_busy_read
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
  - !7768  net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination
  - !7711 [sync] PR-7579:  powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  - !7755  wifi: ath11k: decrease MHI channel buffer length to 8KB
  - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
  - wifi: ath11k: decrease MHI channel buffer length to 8KB
  - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  - powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  - Merge remote-tracking branch 'upstream/openEuler-22.03-LTS-SP1' into HEAD
  - Merge remote-tracking branch 'upstream/openEuler-22.03-LTS-SP1' into HEAD
  - Squashfs: check the inode number is not the invalid value of zero
  - vfio/fsl-mc: Block calling interrupt handler without trigger


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.78.0.158
changelog:
  - !8594 [sync] PR-6990:  netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - !8591 [sync] PR-7174:  CVE-2022-48689
  - !8595 [sync] PR-6939:  USB: core: Fix deadlock in usb_deauthorize_interface()
  - !8554 [sync] PR-8395:  5.10: fix CVE-2024-35978
  - !8364  perf: hisi: Fix use-after-free when register pmu fails
  - !8606  smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  - !7672  btrfs: send: handle path ref underflow in header iterate_inode_ref()
  - !8597 [sync] PR-6393:  crypto: xilinx - call finalize with bh disabled
  - !8514  net: ena: Fix incorrect descriptor free behavior
  - !8563 [sync] PR-8110:  drm/client: Fully protect modes[
  - smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  - crypto: xilinx - call finalize with bh disabled
  - USB: core: Fix deadlock in usb_deauthorize_interface()
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - tcp: TX zerocopy should not sense pfmemalloc status
  - net: skbuff: update comment about pfmemalloc propagating
  - net: introduce __skb_fill_page_desc_noacc
  - tcp: factor out tcp_build_frag()
  - !8505  CVE: CVE-2024-36015
  - drm/client: Fully protect modes[] with dev->mode_config.mutex
  - !8523  tty: vcc: Add check for kstrdup() in vcc_probe()
  - !8487 [sync] PR-8397:  mm/hugetlb: fix missing hugetlb_lock for resv uncharge
  - !8486 [sync] PR-8373:  dma-direct: Leak pages on dma_set_decrypted() failure
  - !8245 [sync] PR-7870:  CVE-2024-35995
  - Bluetooth: Fix memory leak in hci_req_sync_complete()
  - !8202  arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
  - !8408  pinctrl: core: delete incorrect free in pinctrl_enable()
  - tty: vcc: Add check for kstrdup() in vcc_probe()
  - net: ena: Fix incorrect descriptor free behavior
  - !8457 [sync] PR-8416:  iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
  - !8501 [sync] PR-7889:  vt: fix unicode buffer corruption when deleting characters
  - ppdev: Add an error check in register_device
  - ppdev: Remove usage of the deprecated ida_simple_xx() API
  - vt: fix unicode buffer corruption when deleting characters
  - mm/hugetlb: fix missing hugetlb_lock for resv uncharge
  - dma-direct: Leak pages on dma_set_decrypted() failure
  - !8429  drm/amdgpu: Fix even more out of bound writes from debugfs
  - !8340  soc: qcom: llcc: Handle a second device without data corruption
  - !8369  efi/capsule-loader: fix incorrect allocation size
  - !8312 [sync] PR-8039: v2  dynamic_hugetlb: backport some bugfix
  - !8451 [sync] PR-8342:  net/mlx5: Properly link new fs rules into the tree
  - !8293  drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
  - iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
  - net/mlx5: Properly link new fs rules into the tree
  - !8179  jfs: fix array-index-out-of-bounds in diAlloc
  - !8167 v2  mmc: sdio: fix possible resource leaks in some error paths
  - !8346 [sync] PR-8248:  gfs2: ignore negated quota changes
  - !8331 [sync] PR-8254:  sysv: don't call sb_bread() with pointers_lock held
  - !8375 [sync] PR-8306:  mptcp: ensure tx skbs always have the MPTCP ext
  - drm/amdgpu: Fix even more out of bound writes from debugfs
  - !8391 [sync] PR-8109:  vhost-vdpa: fix use after free in vhost_vdpa_probe()
  - pinctrl: core: delete incorrect free in pinctrl_enable()
  - !8370  locking/ww_mutex/test: Fix potential workqueue corruption
  - !8311  drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
  - !8334  wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
  - !8317  net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
  - !8235 [sync] PR-8054:  CVE-2023-52669
  - !8380 [sync] PR-8212:  fix CVE-2024-35877
  - vhost-vdpa: fix use after free in vhost_vdpa_probe()
  - !8294  CVE-2023-52735
  - x86/mm/pat: fix VM_PAT handling in COW mappings
  - !8196  clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
  - mptcp: ensure tx skbs always have the MPTCP ext
  - locking/ww_mutex/test: Fix potential workqueue corruption
  - efi/capsule-loader: fix incorrect allocation size
  - perf: hisi: Fix use-after-free when register pmu fails
  - !7776 [sync] PR-7717:  CVE-2023-52655
  - !8323 [sync] PR-8219:  tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
  - !8273  ALSA: hda: Do not unset preset when cleaning up codec
  - !8269  drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
  - !8251 v2  CVE-2024-35956
  - gfs2: ignore negated quota changes
  - soc: qcom: llcc: Handle a second device without data corruption
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
  - sysv: don't call sb_bread() with pointers_lock held
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
  - !8277  usb: udc: remove warning when queue disabled ep
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
  - !8289 [sync] PR-8150:  mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
  - !8265 [sync] PR-8228:  ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  - mm/dynamic_hugetlb: refine error info in the destruction
  - mm/dynamic_hugetlb: make free_huge_page_to_dhugetlb_pool irq safe
  - mm/dynamic_hugetlb: check NULL pointer for early parameter
  - mm/dynamic_hugetlb: add lru_add_drain_all() before migration
  - mm/dynamic_hugetlb: add cond_resched() in hpool_merge_page()
  - mm/dynamic_hugetlb: reduce the number of migration attempts
  - mm/dpool: Use helper function to lock/unlock
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
  - !8231  CVE-2023-52804
  - bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
  - bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself
  - drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
  - mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
  - !7833 [sync] PR-7599:  irqchip/gic-v3-its: Prevent double free on error
  - !8259 v5  can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
  - usb: udc: remove warning when queue disabled ep
  - ALSA: hda: Do not unset preset when cleaning up codec
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
  - ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
  - !7855  clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
  - btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations
  - btrfs: fix anon_dev leak in create_subvol()
  - ACPI: CPPC: Fix access width used for PCC registers
  - ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
  - ACPI: CPPC: Use access_width over bit_width for system memory accesses
  - ACPI: CPPC: Fix up I/O port access in cpc_read()
  - ACPI: CPPC: Implement support for SystemIO registers
  - crypto: s390/aes - Fix buffer overread in CTR mode
  - fs/jfs: Add validity check for db_maxag and db_agpref
  - fs: jfs: fix shift-out-of-bounds in dbAllocAG
  - !8224  ALSA: hda: Fix possible null-ptr-deref when assigning a stream
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream
  - !8125 [sync] PR-8042:  xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  - arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
  - clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
  - jfs: fix array-index-out-of-bounds in diAlloc
  - mmc: sdio: fix possible resource leaks in some error paths
  - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  - clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
  - irqchip/gic-v3-its: Prevent double free on error
  - usb: aqc111: check packet for fixup for true limit
  - btrfs: send: handle path ref underflow in header iterate_inode_ref()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.79.0.159
changelog:
  - !8950  aio: fix mremap after fork null-deref
  - !8948  CVE-2022-48652
  - !8866  ipv6: prevent NULL dereference in ip6_output()
  - !8780  smb: client: fix UAF in smb2_reconnect_server()
  - !8859  net/smc: avoid data corruption caused by decline
  - !8722 v2  SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
  - !8964  Fix CVE-2024-35915
  - !8963  Fix CVE-2024-35915
  - !8735  mptcp: ensure snd_nxt is properly initialized on connect
  - !8761  tipc: fix UAF in error path
  - !8741  octeontx2-af: avoid off-by-one read from userspace
  - !8953  powerpc/powernv: Add a null pointer check in opal_event_init()
  - !8685  mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  - !8967  Fix CVE-2024-36949
  - !8861  blk-iocost: do not WARN if iocg was already offlined
  - !8841 v2  IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
  - !8945  usb: typec: ucsi: Limit read size on v1.2
  - !8905  ALSA: scarlett2: Add missing error checks to *_ctl_get()
  - !8709 [sync] PR-8046:  block: prevent division by zero in blk_rq_stat_sum()
  - !8839  blk-iocost: avoid out of bounds shift
  - !8857  PCI/PM: Drain runtime-idle callbacks before driver removal
  - amd/amdkfd: sync all devices to wait all processes being evicted
  - drm/amdkfd: Rework kfd_locked handling
  - !8911  net/mlx5e: Fix use-after-free of encap entry in neigh update handler
  - !8915  gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - !8788 [sync] PR-8558:  xen-netfront: Add missing skb_mark_for_recycle
  - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_rx_work
  - nfc: nci: Fix kcov check in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
  - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_rx_work
  - nfc: nci: Fix kcov check in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
  - powerpc/powernv: Add a null pointer check in opal_event_init()
  - aio: fix mremap after fork null-deref
  - ice: Fix crash by keep old cfg when update TCs more than queues
  - ice: ethtool: Prohibit improper channel config for DCB
  - !8880  net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - usb: typec: ucsi: Limit read size on v1.2
  - !8892  net: fix out-of-bounds access in ops_init
  - !8810  net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs
  - !8672  fix CVE-2024-36021 and CVE-2024-36900
  - !8886  CVE-2024-36933
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - net/mlx5e: Fix use-after-free of encap entry in neigh update handler
  - ALSA: scarlett2: Add missing error checks to *_ctl_get()
  - !8755  drm/amd/display: Avoid NULL dereference of timing generator
  - !8754  pwm: Fix double shift bug
  - !8850  ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - net: fix out-of-bounds access in ops_init
  - !8665  phonet/pep: fix racy skb_queue_empty() use
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - ipv6: prevent NULL dereference in ip6_output()
  - blk-iocost: do not WARN if iocg was already offlined
  - net/smc: avoid data corruption caused by decline
  - PCI/PM: Drain runtime-idle callbacks before driver removal
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - !8687  tcp: properly terminate timers for kernel sockets
  - !8630  erspan: make sure erspan_base_hdr is present in skb->head
  - IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
  - blk-iocost: avoid out of bounds shift
  - !7988 [sync] PR-7960:  ipv6: Fix infinite recursion in fib6_dump_done().
  - !8388 [sync] PR-8300:  ipvlan: add ipvlan_route_v6_outbound() helper
  - !8282 [sync] PR-8133:  fix CVE-2021-47265
  - !7925 [sync] PR-7741:  ipv4: check for NULL idev in ip_route_use_hint()
  - !8724  tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - !8480  scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - !8622  fs/9p: only translate RWX permissions for plain 9P2000
  - net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs
  - !8728  net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()
  - !8790  Bluetooth: SCO: Fix not validating setsockopt user input
  - !8680  rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  - !8713 [sync] PR-8583:  mmc: sdhci-msm: pervent access to suspended controller
  - !8670  CVE-2024-35854
  - Bluetooth: SCO: Fix not validating setsockopt user input
  - !8696  clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
  - !8653 v3  clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
  - xen-netfront: Add missing skb_mark_for_recycle
  - !8571  jfs: fix two array-index-out-of-bounds issuse
  - !8356  nilfs2: fix underflow in second superblock position calculations
  - !8592  geneve: fix header validation in geneve[6
  - !8531  gpiolib: cdev: fix uninitialised kfifo
  - smb: client: fix UAF in smb2_reconnect_server()
  - !8631 [sync] PR-8519:  mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq
  - tipc: fix UAF in error path
  - !8751  ubifs: Check @c->dirty_[n|p
  - drm/amd/display: Avoid NULL dereference of timing generator
  - pwm: Fix double shift bug
  - !8633 [sync] PR-8425:  CVE-2023-52677
  - ubifs: Check @c->dirty_[n|p]n_cnt and @c->nroot state under @c->lp_mutex
  - octeontx2-af: avoid off-by-one read from userspace
  - !8669  wifi: ath11k: fix dfs radar event locking
  - !8619  CVE-2024-35896
  - !8608  CVE-2024-35895
  - mptcp: ensure snd_nxt is properly initialized on connect
  - !8659  wifi: ath11k: fix htt pktlog locking
  - !8587  fix CVE-2021-47558
  - net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()
  - !8569  fix CVE-2024-36906
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
  - !7933  bpf: Protect against int overflow for stack access size
  - !8627 [sync] PR-8561:  mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
  - !8625 [sync] PR-8497:  Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
  - mmc: sdhci-msm: pervent access to suspended controller
  - !8572  xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
  - block: prevent division by zero in blk_rq_stat_sum()
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
  - tcp: properly terminate timers for kernel sockets
  - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  - net: hns3: fix kernel crash when devlink reload during initialization
  - net: hns3: release PTP resources if pf initialization failed
  - net: hns3: fix kernel crash when devlink reload during vf initialization
  - net: hns3: fix kernel crash when devlink reload during pf initialization
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
  - wifi: ath11k: fix dfs radar event locking
  - phonet/pep: fix racy skb_queue_empty() use
  - wifi: ath11k: fix htt pktlog locking
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
  - !8537  scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs
  - !8538  drm/amdgpu: Fix potential null pointer derefernce
  - !8540  s390/dasd: protect device queue against concurrent access
  - !8462  i2c: smbus: fix NULL function pointer dereference
  - !8432  platform/x86: wmi: Fix opening of char device
  - riscv: Check if the code to patch lies in the exit section
  - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq
  - erspan: make sure erspan_base_hdr is present in skb->head
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
  - fs/9p: only translate RWX permissions for plain 9P2000
  - netfilter: complete validation of user input
  - netfilter: validate user input for expected length
  - Revert "bpf, sockmap: Prevent lock inversion deadlock in map delete elem"
  - bpf: Allow delete from sockmap/sockhash only if update is allowed
  - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
  - geneve: fix header validation in geneve[6]_xmit_skb
  - net: stmmac: Disable Tx queues when reconfiguring the interface
  - xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
  - jfs: fix array-index-out-of-bounds in dbFindLeaf
  - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
  - ARM: 9381/1: kasan: clear stale stack poison
  - s390/dasd: protect device queue against concurrent access
  - drm/amdgpu: Fix potential null pointer derefernce
  - scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs
  - gpiolib: cdev: fix uninitialised kfifo
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - i2c: smbus: fix NULL function pointer dereference
  - platform/x86: wmi: Fix opening of char device
  - ipvlan: add ipvlan_route_v6_outbound() helper
  - nilfs2: fix underflow in second superblock position calculations
  - RDMA: Verify port when creating flow rule
  - IB/mlx4: Use port iterator and validation APIs
  - ipv6: Fix infinite recursion in fib6_dump_done().
  - bpf: Protect against int overflow for stack access size
  - ipv4: check for NULL idev in ip_route_use_hint()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.80.0.160
changelog:
  - !9093 v2  ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
  - !9031  bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - !9065  afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
  - !8933  Fix CVE-2023-52732
  - !8927 [sync] PR-8222:  Fix CVE-2023-52672
  - !9172 [sync] PR-7041:  netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  - !9171 [sync] PR-6994: v2  net/mlx5e: Prevent deadlock while disabling aRFS
  - !8733  batman-adv: Avoid infinite loop trying to resize local TT
  - !7374 [sync] PR-6879:  net/smc: Fix possible access to freed memory in link clear
  - !9098  Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  - net/mlx5e: Prevent deadlock while disabling aRFS
  - !9165  genirq: introduce handle_fasteoi_edge_irq flow handler
  - genirq: introduce handle_fasteoi_edge_irq for phytium
  - genirq: introduce handle_fasteoi_edge_irq flow handler
  - !9139 v2  CVE-2024-36971
  - !8495  rpmsg: virtio: Free driver_override when rpmsg_remove()
  - !9127  hsr: Prevent use after free in prp_create_tagged_frame()
  - !9075  Fix UAF problem of hpool
  - !9132  mm: swap: fix race between free_swap_and_cache() and swapoff()
  - !9130  ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
  - !9069  Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - !8970  mmc: mmc_spi: fix error handling in mmc_spi_probe()
  - !8977 [sync] PR-8584:  virtio-blk: fix implicit overflow on virtio_max_dma_size
  - !8701  wifi: cfg80211: check A-MSDU format more carefully
  - net: fix kabi breakage in struct dst_ops
  - net: fix __dst_negative_advice() race
  - net: annotate data-races around sk->sk_dst_pending_confirm
  - mm: swap: fix race between free_swap_and_cache() and swapoff()
  - ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
  - hsr: Prevent use after free in prp_create_tagged_frame()
  - !9002  scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - !9056  drm/panel: fix a possible null pointer dereference
  - !9054  soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !8939  clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - !8952  ACPI: video: check for error while searching for backlight device parent
  - !8986 [sync] PR-8639:  s390/qeth: Fix kernel panic after setting hsuid
  - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - !8714  Fix page corruption caused by racy check in __free_pages
  - ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
  - !9080  Bluetooth: L2CAP: Fix not validating setsockopt user input
  - Bluetooth: L2CAP: Fix not validating setsockopt user input
  - mm/dynamic_hugetlb: use rcu lock to protect hpool
  - mm/dynamic_hugetlb: simplify the refcount code
  - !9072 [sync] PR-9015:  CVE-2024-36953
  - !9071 [sync] PR-9014:  drm/vc4: don't check if plane->state->fb == state->fb
  - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
  - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
  - drm/vc4: don't check if plane->state->fb == state->fb
  - Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
  - !8947 [sync] PR-6800:  block: fix overflow in blk_ioctl_discard()
  - !9052  CVE-2024-35796
  - drm/panel: fix a possible null pointer dereference
  - soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !9021  wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - net: ll_temac: platform_get_resource replaced by wrong function
  - !9048  IB/hfi1: Restore allocated resources on failed copyout
  - IB/hfi1: Restore allocated resources on failed copyout
  - !9028  tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - !8830  Fix CVE-2024-35951
  - !9009  fix CVE-2024-35839
  - !9008  tipc: fix a possible memleak in tipc_buf_append
  - !8721  CVE-2024-35887
  - !8876  drm/vmwgfx: Fix invalid reads in fence signaled events
  - !8884  scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - !8922  hugetlbfs: fix hugetlbfs_statfs() locking
  - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - netfilter: bridge: replace physindev with physinif in nf_bridge_info
  - netfilter: propagate net to nf_bridge_get_physindev
  - netfilter: nfnetlink_log: use proper helper for fetching physinif
  - !8662  usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
  - tipc: fix a possible memleak in tipc_buf_append
  - !8617 [sync] PR-8472:  fix CVE-2024-27415
  - !8983  fix CVE-2024-36905
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - s390/qeth: Fix kernel panic after setting hsuid
  - net: relax socket state check at accept time.
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
  - virtio-blk: fix implicit overflow on virtio_max_dma_size
  - mmc: mmc_spi: fix error handling in mmc_spi_probe()
  - ACPI: video: check for error while searching for backlight device parent
  - block: fix overflow in blk_ioctl_discard()
  - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - ceph: blocklist the kclient when receiving corrupted snap trace
  - ceph: shut down access to inode when async create fails
  - ceph: refactor remove_session_caps_cb
  - ceph: fix auth cap handling logic in remove_session_caps_cb
  - ceph: drop private list from remove_session_caps_cb
  - pipe: wakeup wr_wait after setting max_usage
  - fs/pipe: move check to pipe_has_watch_queue()
  - hugetlbfs: fix hugetlbfs_statfs() locking
  - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - drm/vmwgfx: Fix invalid reads in fence signaled events
  - drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
  - drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
  - batman-adv: Avoid infinite loop trying to resize local TT
  - ax25: fix use-after-free bugs caused by ax25_ds_del_timer
  - Fix page corruption caused by racy check in __free_pages
  - wifi: cfg80211: check A-MSDU format more carefully
  - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
  - netfilter: br_netfilter: skip conntrack input hook for promisc packets
  - netfilter: bridge: confirm multicast packets before passing them up the stack
  - rpmsg: virtio: Free driver_override when rpmsg_remove()
  - net/smc: Fix possible access to freed memory in link clear


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.81.0.162
changelog:
  - !8104 [sync] PR-7886:  drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
  - !9443  net/mlx5: Discard command completions in internal error
  - !9448  rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - !9432  hid: cp2112: Fix duplicate workqueue initialization
  - !9424  ASoC: SOF: Fix DSP oops stack dump output contents
  - !9418 [sync] PR-6683: v2  CVE-2024-26921
  - !9296  CVE-2021-47599
  - !9403  Fix CVE-2024-31076
  - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - net/mlx5: Discard command completions in internal error
  - !9198  init/main.c: Fix potential static_command_line memory overflow
  - hid: cp2112: Fix duplicate workqueue initialization
  - ASoC: SOF: Fix DSP oops stack dump output contents
  - !6742 [sync] PR-6654:  net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
  - sk_buff: Fix KABI break for the modification of struct sk_buff
  - inet: inet_defrag: prevent sk release while still in use
  - net: Fix KABI break for introducing is_skb_wmem()
  - skb_expand_head() adjust skb->truesize incorrectly
  - skbuff: introduce skb_expand_head()
  - !9349  powerpc/powernv: Add a null pointer check in opal_powercap_init()
  - !9396  RDMA/hns: Fix deadlock on SRQ async events.
  - !9353 [sync] PR-9305:  CVE-2024-26661 following bugfix
  - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
  - !9359  serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - !9379  RDMA/hns: Fix UAF for cq async event
  - !9291  net: bridge: xmit: make sure we have at least eth header len bytes
  - RDMA/hns: Fix deadlock on SRQ async events.
  - !9049 [sync] PR-8774:  CVE-2024-36914
  - !9263  ring-buffer: Fix a race between readers and resize checks
  - RDMA/hns: Fix UAF for cq async event
  - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - drm/amd/display: Fix && vs || typos
  - drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'
  - Revert "drm/amd/display: Fix && vs || typos"
  - powerpc/powernv: Add a null pointer check in opal_powercap_init()
  - !9272  drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - !9274  wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
  - !9281  drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - !9279  net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - btrfs: remove stale comment about the btrfs_show_devname
  - btrfs: update latest_dev when we create a sprout device
  - btrfs: use latest_dev in btrfs_show_devname
  - btrfs: convert latest_bdev type to btrfs_device and rename
  - !9213 [sync] PR-9112:  Backport some optimizing patches for kunpeng920
  - !9106  ksmbd: no response from compound read
  - !9185  spi: Fix deadlock when adding SPI controllers on SPI buses
  - net: bridge: xmit: make sure we have at least eth header len bytes
  - drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
  - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - ring-buffer: Fix a race between readers and resize checks
  - !9181  wifi: wilc1000: fix RCU usage in connect path
  - !9214  drm/amd/display: Fix division by zero in setup_dsc_config
  - !7541 [sync] PR-6801:  block: fix discard
  - !9142 v2  CVE-2023-52810
  - !8460 [sync] PR-8069:  CVE-2021-47427
  - !9155  fix CVE-2023-52791
  - !9169  UBIFS: fixes a series of issues that caused by power cut
  - !9003  media: tc358743: register v4l2 async device only after successful setup
  - !9088  fs/9p: fix uninitialized values during inode evict
  - drm/amd/display: Fix division by zero in setup_dsc_config
  - arm64: syscall: unmask DAIF for tracing status
  - arm64: Snapshot thread flags
  - sched: Snapshot thread flags
  - entry: Snapshot thread flags
  - x86: Snapshot thread flags
  - thread_info: Add helpers to snapshot thread flags
  - irqchip/gic-v3: Use dsb(ishst) to order writes with ICC_SGI1R_EL1 accesses
  - sched/fair: Optimize test_idle_cores() for !SMT
  - init/main.c: Fix potential static_command_line memory overflow
  - spi: fix kabi breakage in struct spi_controller
  - spi: fix use-after-free of the add_lock mutex
  - spi: Fix deadlock when adding SPI controllers on SPI buses
  - wifi: wilc1000: fix RCU usage in connect path
  - ubifs: dbg_orphan_check: Fix missed key type checking
  - ubifs: Fix unattached inode when powercut happens in creating
  - ubifs: Fix space leak when powercut happens in linking tmpfile
  - ubifs: Move ui->data initialization after initializing security
  - ubifs: Fix adding orphan entry twice for the same inode
  - ubifs: Remove insert_dead_orphan from replaying orphan process
  - ubifs: Don't add xattr inode into orphan area
  - ubifs: Fix unattached xattr inode if powercut happens after deleting
  - ubifs: Fix some kernel-doc comments
  - ubifs: Fix spelling mistakes
  - i2c: core: Fix atomic xfer check for non-preempt config
  - i2c: core: Run atomic i2c xfer when !preemptible
  - fs/jfs: Add check for negative db_l2nbperpage
  - jfs: jfs_dmap: Validate db_l2nbperpage while mounting
  - ksmbd: no response from compound read
  - fs/9p: fix uninitialized values during inode evict
  - drm/amd/display: Skip on writeback when it's not applicable
  - media: tc358743: register v4l2 async device only after successful setup
  - scsi: iscsi: Fix iscsi_task use after free
  - scsi: iscsi: Have abort handler get ref to conn
  - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
  - block: check io size before submit discard
  - block: fix overflow in blk_ioctl_discard()
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.82.0.163
changelog:
  - !9461 [sync] PR-5860:  ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
  - !9197  scsi: core: Fix unremoved procfs host directory regression
  - !9203  dyndbg: fix old BUG_ON in >control parser
  - !9195  wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  - !9200  ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  - !9189  clk: Fix clk_core_get NULL dereference
  - !9187  net: phy: fix phy_get_internal_delay accessing an empty array
  - !9460 v2  CVE-2024-27032
  - ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
  - f2fs: fix to avoid potential panic during recovery
  - f2fs: fix to check return value of f2fs_reserve_new_block()
  - dyndbg: fix old BUG_ON in >control parser
  - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  - scsi: core: Fix unremoved procfs host directory regression
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  - clk: Fix clk_core_get NULL dereference
  - net: phy: fix phy_get_internal_delay accessing an empty array


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.83.0.164
changelog:
  - !9159  xfs: don't use current->journal_info
  - !9659  fix uaf when proc_cpuset_show
  - !9574 [sync] PR-8683: v4  Fix CVE-2024-35879
  - !9531  CVE-2024-37356
  - !9650  RDMA/hns: Modify the print level of CQE error
  - !9495  netrom: fix possible dead-lock in nr_rt_ioctl()
  - cgroup: fix uaf when proc_cpuset_show
  - RDMA/hns: Modify the print level of CQE error
  - !9515  RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - !9604 [sync] PR-9595:  drm/arm/malidp: fix a possible null pointer dereference
  - !9603 [sync] PR-9593:  ARM: 9170/1: fix panic when kasan and kprobe are enabled
  - !9602 [sync] PR-9504:  um: Add winch to winch_handlers before registering winch IRQ
  - !9601  CVE-2024-38597
  - drm/arm/malidp: fix a possible null pointer dereference
  - ARM: 9170/1: fix panic when kasan and kprobe are enabled
  - um: Add winch to winch_handlers before registering winch IRQ
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
  - !9575 [sync] PR-9321:  drm/amd/display: Fix potential index out of bounds in color transformation function
  - !9586 [sync] PR-9284:  of: module: add buffer overflow check in of_modalias()
  - !9589  s390/ap: Fix crash in AP internal function modify_bitmap()
  - s390/ap: Fix crash in AP internal function modify_bitmap()
  - of: module: add buffer overflow check in of_modalias()
  - !9541  net/mlx5e: Avoid field-overflowing memcpy()
  - !9480  watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - !9579 [sync] PR-9558:  CVE-2024-39362
  - !8565 [sync] PR-8240: v2  dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
  - !9545  ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - !9576 v2  btrfs: fix crash on racing fsync and size-extending write into prealloc
  - !9384  serial: max3100: Update uart_driver_registered on driver removal
  - !9564  fs/ntfs3: Check 'folio' pointer for NULL
  - i2c: acpi: Unbind mux adapters before delete
  - i2c: add fwnode APIs
  - btrfs: fix crash on racing fsync and size-extending write into prealloc
  - drm/amd/display: Fix potential index out of bounds in color transformation function
  - driver core: Fix kabi broken
  - of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
  - driver core: Introduce device_link_wait_removal()
  - !9484  fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - !9529  media: lgdt3306a: Add a check against null-pointer-def
  - fs/ntfs3: Check 'folio' pointer for NULL
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - net/mlx5e: Avoid field-overflowing memcpy()
  - !9375  ALSA: core: Fix NULL module pointer assignment at card init
  - !9468  net/mlx5: Add a timeout to acquire the command queue semaphore
  - !9458  bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
  - params: lift param_set_uint_minmax to common code
  - !9431  CVE-2022-48703
  - !9364  fs/ntfs3: Use variable length array instead of fixed size
  - media: lgdt3306a: Add a check against null-pointer-def
  - !9411  kprobes: Fix possible use-after-free issue on kprobe registration
  - !8743  ext4 bugfix from mainline
  - !9498  ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - !9397 [sync] PR-9350:  tracing: Fix permissions for the buffer_percent file
  - !9334  net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - !8712  ubifs: Set page uptodate in the correct place
  - !9259  Fix CVE-2024-38588
  - !9385  vfio/pci: fix potential memory leak in vfio_intx_enable()
  - !9454  jffs2: prevent xattr node from overflowing the eraseblock
  - !9328  CVE-2024-38596
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - netrom: fix possible dead-lock in nr_rt_ioctl()
  - fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - net/mlx5: Add a timeout to acquire the command queue semaphore
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - jffs2: prevent xattr node from overflowing the eraseblock
  - thermal: int340x_thermal: Consolidate priv->data_vault checks
  - thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR
  - kprobes: Fix possible use-after-free issue on kprobe registration
  - tracing: Fix permissions for the buffer_percent file
  - vfio/pci: fix potential memory leak in vfio_intx_enable()
  - serial: max3100: Update uart_driver_registered on driver removal
  - ALSA: core: Fix NULL module pointer assignment at card init
  - fs/ntfs3: Use variable length array instead of fixed size
  - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - af_unix: Fix data-races around sk->sk_shutdown.
  - af_unix: Fix data races around sk->sk_shutdown.
  - ftrace: Fix possible use-after-free issue in ftrace_location()
  - ftrace: Fix possible warning on checking all pages used in ftrace_process_locs()
  - ftrace: Store the order of pages allocated in ftrace_page
  - xfs: don't use current->journal_info
  - ext4: fix warning in ext4_dio_write_end_io()
  - ext4: properly sync file size update after O_SYNC direct IO
  - iomap: update ki_pos a little later in iomap_dio_complete
  - ubifs: Set page uptodate in the correct place
  - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms


author: yixiangzhike <yixiangzhike007@163.com> - 1.4.4-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:change the files order in patch file fix-doc-about-difok.patch


author: xinghe <xinghe2@h-partners.com> - 1:1.0.0-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix cache prepare nft_cache evaluate to return error
         fix cache validate handle string length
         add src support for implicit chain bindings
         fix cache release pending rules
         fix segtree map listing
         parser_json fix device parsing in netdev family
         fix src Don't parse string as verdict in map


author: huangyu <huangyu106@huawei.com> - 1:1.0.0-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix string prefix expression must retain original length
  fix release top level scope


author: zhanghao <zhanghao383@huawei.com> - 1:1.0.0-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:evaluate allow implicit ether vlan dep
  evaluate datatype memleak after binop transfer
  evaluate bogus datatype assertion in binary operation evaluation
  netlink delinearize do not transfer binary operation to non anonymous sets
  payload do not kill dependency for proto unknown
  monitor missing cache and set handle initialization
  netlink linearize fix timeout with map updates


author: zhanghao <zhanghao383@huawei.com> - 1:1.0.0-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix potential array out of bounds access
  evaluate: fix shift exponent underflow in concatenation evaluation
  netlink: Fix for potential NULL-pointer deref
  mnl: dump_nf_hooks() leaks memory in error path


author: gaihuiying <eaglegai@163.com> - 1:1.0.0-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: error out if basetypes are different
         evaluate: guard against NULL basetype
         evaluate: handle invalid mapping expressions gracefully
         evaluate: reject attempt to update a set
         evaluate: release mpz type in expr_evaluate_list() error path
         expression: missing line in describe command with invalid expression

  Thu Apr 18 2024 lingsheng <lingsheng1@h-partners.com> - 1:1.0.0-10
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:datatype: don't return a const string from cgroupv2_get_path()
  datatype: fix leak and cleanup reference counting for struct datatype
  datatype: initialize TYPE_CT_EVENTBIT slot in datatype array
  datatype: initialize TYPE_CT_LABEL slot in datatype array
  evaluate: do not remove anonymous set with protocol flags and single element
  evaluate: don't crash if object map does not refer to a value
  evaluate: error out when expression has no datatype
  evaluate: error out when store needs more than one 128bit register of align fixup
  evaluate: fix check for truncation in stmt_evaluate_log_prefix()
  evaluate: fix double free on dtype release
  evaluate: fix memleak in prefix evaluation with wildcard interface name
  evaluate: reject set in concatenation
  evaluate: revisit anonymous set with single element optimization
  evaluate: skip anonymous set optimization for concatenations
  evaluate: stmt_nat: set reference must point to a map
  evaluate: tproxy: move range error checks after arg evaluation
  evaluate: validate chain max length
  evaluate: validate maximum log statement prefix length
  exthdr: fix tcpopt_find_template to use length after mask adjustment
  exthdr: prefer raw_type instead of desc->type
  json: expose dynamic flag
  json: fix use after free in table_flags_json()
  libnftables: Drop cache in -c/--check mode
  meta: fix tc classid parsing out-of-bounds access
  netlink: don't crash if prefix for < byte is requested
  netlink: fix leaking typeof_expr_data/typeof_expr_key in netlink_delinearize_set()
  netlink: handle invalid etype in set_make_key()
  parser_bison: fix ct scope underflow if ct helper section is duplicated
  parser_bison: fix memleak in meta set error handling
  parser_bison: make sure obj_free releases timeout policies
  parser_json: Catch nonsense ops in match statement
  parser_json: Default meter size to zero
  parser_json: Fix flowtable prio value parsing
  parser_json: Fix synproxy object mss/wscale parsing
  parser_json: Fix typo in json_parse_cmd_add_object()
  parser_json: Proper ct expectation attribute parsing
  parser_json: Wrong check in json_parse_ct_timeout_policy()
  py: fix exception during cleanup of half-initialized Nftables
  rule: fix sym refcount assertion


author: huyubiao <huyubiao@huawei.com> - 249-70
changelog:
  - move the architecture patches after Patch9800 (excluding Patch9800)
    delete the duplicate systemd-coredump.socket


author: huyubiao <huyubiao@huawei.com> - 249-73
changelog:
  - DESC:add backport-core-exec-do-not-crash-with-UtmpMode-user-without-Us.patch
         backport-resolved-limit-the-number-of-signature-validations-i.patch
         backport-resolved-reduce-the-maximum-nsec3-iterations-to-100.patch


author: huyubiao <huyubiao@huawei.com> - 249-76
changelog:
  - add backport-login-user-runtime-dir-properly-check-for-mount-poin.patch
        backport-user-util-validate-the-right-field.patch


