# changelog

author: renmingshuai <renmingshuai@huawei.com> - 2.86-3
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Fix parsing of IPv6 addresses with peer from netlink
         Fix bad interaction between --address=/#/<ip> and
              --server=/some.domain/#
         Fix --address=/#/...... which was lost in 2.86


author: renmingshuai <renmingshuai@huawei.com> - 2.86-7
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Fix memory leak when using --dhcp-optsfile with DHCPv6 options


author: yexiao<yexiao7@huawei.com> - 202011-14
changelog:
  - fix CVE-2023-0464、CVE-2023-0465、CVE-2023-0466、CVE-2023-2650、CVE-2023-3446、CVE-2023-3817、CVE-2024-0727


author: yexiao<yexiao7@huawei.com> - 202011-16
changelog:
  - fix CVE-2023-45229、CVE-2023-45230、CVE-2023-45231、CVE-2023-45232、CVE-2023-45233、CVE-2023-45234、CVE-2023-45235


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 3.24.30-8
changelog:
  - Fix the problem that the prompt information of network icon volume icon is not displayed
  - update xscreen size when x11 screen size change
  - always send the monitors changed signal when screen size change
  - Add function definition of gtk_image_set_from_pixbuf_with_scale


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.78.0.158
changelog:
  - !8594 [sync] PR-6990:  netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - !8591 [sync] PR-7174:  CVE-2022-48689
  - !8595 [sync] PR-6939:  USB: core: Fix deadlock in usb_deauthorize_interface()
  - !8554 [sync] PR-8395:  5.10: fix CVE-2024-35978
  - !8364  perf: hisi: Fix use-after-free when register pmu fails
  - !8606  smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  - !7672  btrfs: send: handle path ref underflow in header iterate_inode_ref()
  - !8597 [sync] PR-6393:  crypto: xilinx - call finalize with bh disabled
  - !8514  net: ena: Fix incorrect descriptor free behavior
  - !8563 [sync] PR-8110:  drm/client: Fully protect modes[
  - smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  - crypto: xilinx - call finalize with bh disabled
  - USB: core: Fix deadlock in usb_deauthorize_interface()
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - tcp: TX zerocopy should not sense pfmemalloc status
  - net: skbuff: update comment about pfmemalloc propagating
  - net: introduce __skb_fill_page_desc_noacc
  - tcp: factor out tcp_build_frag()
  - !8505  CVE: CVE-2024-36015
  - drm/client: Fully protect modes[] with dev->mode_config.mutex
  - !8523  tty: vcc: Add check for kstrdup() in vcc_probe()
  - !8487 [sync] PR-8397:  mm/hugetlb: fix missing hugetlb_lock for resv uncharge
  - !8486 [sync] PR-8373:  dma-direct: Leak pages on dma_set_decrypted() failure
  - !8245 [sync] PR-7870:  CVE-2024-35995
  - Bluetooth: Fix memory leak in hci_req_sync_complete()
  - !8202  arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
  - !8408  pinctrl: core: delete incorrect free in pinctrl_enable()
  - tty: vcc: Add check for kstrdup() in vcc_probe()
  - net: ena: Fix incorrect descriptor free behavior
  - !8457 [sync] PR-8416:  iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
  - !8501 [sync] PR-7889:  vt: fix unicode buffer corruption when deleting characters
  - ppdev: Add an error check in register_device
  - ppdev: Remove usage of the deprecated ida_simple_xx() API
  - vt: fix unicode buffer corruption when deleting characters
  - mm/hugetlb: fix missing hugetlb_lock for resv uncharge
  - dma-direct: Leak pages on dma_set_decrypted() failure
  - !8429  drm/amdgpu: Fix even more out of bound writes from debugfs
  - !8340  soc: qcom: llcc: Handle a second device without data corruption
  - !8369  efi/capsule-loader: fix incorrect allocation size
  - !8312 [sync] PR-8039: v2  dynamic_hugetlb: backport some bugfix
  - !8451 [sync] PR-8342:  net/mlx5: Properly link new fs rules into the tree
  - !8293  drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
  - iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
  - net/mlx5: Properly link new fs rules into the tree
  - !8179  jfs: fix array-index-out-of-bounds in diAlloc
  - !8167 v2  mmc: sdio: fix possible resource leaks in some error paths
  - !8346 [sync] PR-8248:  gfs2: ignore negated quota changes
  - !8331 [sync] PR-8254:  sysv: don't call sb_bread() with pointers_lock held
  - !8375 [sync] PR-8306:  mptcp: ensure tx skbs always have the MPTCP ext
  - drm/amdgpu: Fix even more out of bound writes from debugfs
  - !8391 [sync] PR-8109:  vhost-vdpa: fix use after free in vhost_vdpa_probe()
  - pinctrl: core: delete incorrect free in pinctrl_enable()
  - !8370  locking/ww_mutex/test: Fix potential workqueue corruption
  - !8311  drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
  - !8334  wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
  - !8317  net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
  - !8235 [sync] PR-8054:  CVE-2023-52669
  - !8380 [sync] PR-8212:  fix CVE-2024-35877
  - vhost-vdpa: fix use after free in vhost_vdpa_probe()
  - !8294  CVE-2023-52735
  - x86/mm/pat: fix VM_PAT handling in COW mappings
  - !8196  clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
  - mptcp: ensure tx skbs always have the MPTCP ext
  - locking/ww_mutex/test: Fix potential workqueue corruption
  - efi/capsule-loader: fix incorrect allocation size
  - perf: hisi: Fix use-after-free when register pmu fails
  - !7776 [sync] PR-7717:  CVE-2023-52655
  - !8323 [sync] PR-8219:  tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
  - !8273  ALSA: hda: Do not unset preset when cleaning up codec
  - !8269  drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
  - !8251 v2  CVE-2024-35956
  - gfs2: ignore negated quota changes
  - soc: qcom: llcc: Handle a second device without data corruption
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
  - sysv: don't call sb_bread() with pointers_lock held
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
  - !8277  usb: udc: remove warning when queue disabled ep
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
  - !8289 [sync] PR-8150:  mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
  - !8265 [sync] PR-8228:  ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  - mm/dynamic_hugetlb: refine error info in the destruction
  - mm/dynamic_hugetlb: make free_huge_page_to_dhugetlb_pool irq safe
  - mm/dynamic_hugetlb: check NULL pointer for early parameter
  - mm/dynamic_hugetlb: add lru_add_drain_all() before migration
  - mm/dynamic_hugetlb: add cond_resched() in hpool_merge_page()
  - mm/dynamic_hugetlb: reduce the number of migration attempts
  - mm/dpool: Use helper function to lock/unlock
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
  - !8231  CVE-2023-52804
  - bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
  - bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself
  - drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
  - mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
  - !7833 [sync] PR-7599:  irqchip/gic-v3-its: Prevent double free on error
  - !8259 v5  can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
  - usb: udc: remove warning when queue disabled ep
  - ALSA: hda: Do not unset preset when cleaning up codec
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
  - ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
  - !7855  clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
  - btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations
  - btrfs: fix anon_dev leak in create_subvol()
  - ACPI: CPPC: Fix access width used for PCC registers
  - ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
  - ACPI: CPPC: Use access_width over bit_width for system memory accesses
  - ACPI: CPPC: Fix up I/O port access in cpc_read()
  - ACPI: CPPC: Implement support for SystemIO registers
  - crypto: s390/aes - Fix buffer overread in CTR mode
  - fs/jfs: Add validity check for db_maxag and db_agpref
  - fs: jfs: fix shift-out-of-bounds in dbAllocAG
  - !8224  ALSA: hda: Fix possible null-ptr-deref when assigning a stream
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream
  - !8125 [sync] PR-8042:  xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  - arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
  - clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
  - jfs: fix array-index-out-of-bounds in diAlloc
  - mmc: sdio: fix possible resource leaks in some error paths
  - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  - clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
  - irqchip/gic-v3-its: Prevent double free on error
  - usb: aqc111: check packet for fixup for true limit
  - btrfs: send: handle path ref underflow in header iterate_inode_ref()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.79.0.159
changelog:
  - !8950  aio: fix mremap after fork null-deref
  - !8948  CVE-2022-48652
  - !8866  ipv6: prevent NULL dereference in ip6_output()
  - !8780  smb: client: fix UAF in smb2_reconnect_server()
  - !8859  net/smc: avoid data corruption caused by decline
  - !8722 v2  SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
  - !8964  Fix CVE-2024-35915
  - !8963  Fix CVE-2024-35915
  - !8735  mptcp: ensure snd_nxt is properly initialized on connect
  - !8761  tipc: fix UAF in error path
  - !8741  octeontx2-af: avoid off-by-one read from userspace
  - !8953  powerpc/powernv: Add a null pointer check in opal_event_init()
  - !8685  mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  - !8967  Fix CVE-2024-36949
  - !8861  blk-iocost: do not WARN if iocg was already offlined
  - !8841 v2  IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
  - !8945  usb: typec: ucsi: Limit read size on v1.2
  - !8905  ALSA: scarlett2: Add missing error checks to *_ctl_get()
  - !8709 [sync] PR-8046:  block: prevent division by zero in blk_rq_stat_sum()
  - !8839  blk-iocost: avoid out of bounds shift
  - !8857  PCI/PM: Drain runtime-idle callbacks before driver removal
  - amd/amdkfd: sync all devices to wait all processes being evicted
  - drm/amdkfd: Rework kfd_locked handling
  - !8911  net/mlx5e: Fix use-after-free of encap entry in neigh update handler
  - !8915  gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - !8788 [sync] PR-8558:  xen-netfront: Add missing skb_mark_for_recycle
  - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_rx_work
  - nfc: nci: Fix kcov check in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
  - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_rx_work
  - nfc: nci: Fix kcov check in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
  - powerpc/powernv: Add a null pointer check in opal_event_init()
  - aio: fix mremap after fork null-deref
  - ice: Fix crash by keep old cfg when update TCs more than queues
  - ice: ethtool: Prohibit improper channel config for DCB
  - !8880  net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - usb: typec: ucsi: Limit read size on v1.2
  - !8892  net: fix out-of-bounds access in ops_init
  - !8810  net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs
  - !8672  fix CVE-2024-36021 and CVE-2024-36900
  - !8886  CVE-2024-36933
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - net/mlx5e: Fix use-after-free of encap entry in neigh update handler
  - ALSA: scarlett2: Add missing error checks to *_ctl_get()
  - !8755  drm/amd/display: Avoid NULL dereference of timing generator
  - !8754  pwm: Fix double shift bug
  - !8850  ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - net: fix out-of-bounds access in ops_init
  - !8665  phonet/pep: fix racy skb_queue_empty() use
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - ipv6: prevent NULL dereference in ip6_output()
  - blk-iocost: do not WARN if iocg was already offlined
  - net/smc: avoid data corruption caused by decline
  - PCI/PM: Drain runtime-idle callbacks before driver removal
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - !8687  tcp: properly terminate timers for kernel sockets
  - !8630  erspan: make sure erspan_base_hdr is present in skb->head
  - IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
  - blk-iocost: avoid out of bounds shift
  - !7988 [sync] PR-7960:  ipv6: Fix infinite recursion in fib6_dump_done().
  - !8388 [sync] PR-8300:  ipvlan: add ipvlan_route_v6_outbound() helper
  - !8282 [sync] PR-8133:  fix CVE-2021-47265
  - !7925 [sync] PR-7741:  ipv4: check for NULL idev in ip_route_use_hint()
  - !8724  tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - !8480  scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - !8622  fs/9p: only translate RWX permissions for plain 9P2000
  - net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs
  - !8728  net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()
  - !8790  Bluetooth: SCO: Fix not validating setsockopt user input
  - !8680  rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  - !8713 [sync] PR-8583:  mmc: sdhci-msm: pervent access to suspended controller
  - !8670  CVE-2024-35854
  - Bluetooth: SCO: Fix not validating setsockopt user input
  - !8696  clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
  - !8653 v3  clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
  - xen-netfront: Add missing skb_mark_for_recycle
  - !8571  jfs: fix two array-index-out-of-bounds issuse
  - !8356  nilfs2: fix underflow in second superblock position calculations
  - !8592  geneve: fix header validation in geneve[6
  - !8531  gpiolib: cdev: fix uninitialised kfifo
  - smb: client: fix UAF in smb2_reconnect_server()
  - !8631 [sync] PR-8519:  mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq
  - tipc: fix UAF in error path
  - !8751  ubifs: Check @c->dirty_[n|p
  - drm/amd/display: Avoid NULL dereference of timing generator
  - pwm: Fix double shift bug
  - !8633 [sync] PR-8425:  CVE-2023-52677
  - ubifs: Check @c->dirty_[n|p]n_cnt and @c->nroot state under @c->lp_mutex
  - octeontx2-af: avoid off-by-one read from userspace
  - !8669  wifi: ath11k: fix dfs radar event locking
  - !8619  CVE-2024-35896
  - !8608  CVE-2024-35895
  - mptcp: ensure snd_nxt is properly initialized on connect
  - !8659  wifi: ath11k: fix htt pktlog locking
  - !8587  fix CVE-2021-47558
  - net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()
  - !8569  fix CVE-2024-36906
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
  - !7933  bpf: Protect against int overflow for stack access size
  - !8627 [sync] PR-8561:  mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
  - !8625 [sync] PR-8497:  Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
  - mmc: sdhci-msm: pervent access to suspended controller
  - !8572  xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
  - block: prevent division by zero in blk_rq_stat_sum()
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
  - tcp: properly terminate timers for kernel sockets
  - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  - net: hns3: fix kernel crash when devlink reload during initialization
  - net: hns3: release PTP resources if pf initialization failed
  - net: hns3: fix kernel crash when devlink reload during vf initialization
  - net: hns3: fix kernel crash when devlink reload during pf initialization
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
  - wifi: ath11k: fix dfs radar event locking
  - phonet/pep: fix racy skb_queue_empty() use
  - wifi: ath11k: fix htt pktlog locking
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
  - !8537  scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs
  - !8538  drm/amdgpu: Fix potential null pointer derefernce
  - !8540  s390/dasd: protect device queue against concurrent access
  - !8462  i2c: smbus: fix NULL function pointer dereference
  - !8432  platform/x86: wmi: Fix opening of char device
  - riscv: Check if the code to patch lies in the exit section
  - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq
  - erspan: make sure erspan_base_hdr is present in skb->head
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
  - fs/9p: only translate RWX permissions for plain 9P2000
  - netfilter: complete validation of user input
  - netfilter: validate user input for expected length
  - Revert "bpf, sockmap: Prevent lock inversion deadlock in map delete elem"
  - bpf: Allow delete from sockmap/sockhash only if update is allowed
  - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
  - geneve: fix header validation in geneve[6]_xmit_skb
  - net: stmmac: Disable Tx queues when reconfiguring the interface
  - xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
  - jfs: fix array-index-out-of-bounds in dbFindLeaf
  - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
  - ARM: 9381/1: kasan: clear stale stack poison
  - s390/dasd: protect device queue against concurrent access
  - drm/amdgpu: Fix potential null pointer derefernce
  - scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs
  - gpiolib: cdev: fix uninitialised kfifo
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - i2c: smbus: fix NULL function pointer dereference
  - platform/x86: wmi: Fix opening of char device
  - ipvlan: add ipvlan_route_v6_outbound() helper
  - nilfs2: fix underflow in second superblock position calculations
  - RDMA: Verify port when creating flow rule
  - IB/mlx4: Use port iterator and validation APIs
  - ipv6: Fix infinite recursion in fib6_dump_done().
  - bpf: Protect against int overflow for stack access size
  - ipv4: check for NULL idev in ip_route_use_hint()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.80.0.160
changelog:
  - !9093 v2  ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
  - !9031  bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - !9065  afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
  - !8933  Fix CVE-2023-52732
  - !8927 [sync] PR-8222:  Fix CVE-2023-52672
  - !9172 [sync] PR-7041:  netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  - !9171 [sync] PR-6994: v2  net/mlx5e: Prevent deadlock while disabling aRFS
  - !8733  batman-adv: Avoid infinite loop trying to resize local TT
  - !7374 [sync] PR-6879:  net/smc: Fix possible access to freed memory in link clear
  - !9098  Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  - net/mlx5e: Prevent deadlock while disabling aRFS
  - !9165  genirq: introduce handle_fasteoi_edge_irq flow handler
  - genirq: introduce handle_fasteoi_edge_irq for phytium
  - genirq: introduce handle_fasteoi_edge_irq flow handler
  - !9139 v2  CVE-2024-36971
  - !8495  rpmsg: virtio: Free driver_override when rpmsg_remove()
  - !9127  hsr: Prevent use after free in prp_create_tagged_frame()
  - !9075  Fix UAF problem of hpool
  - !9132  mm: swap: fix race between free_swap_and_cache() and swapoff()
  - !9130  ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
  - !9069  Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - !8970  mmc: mmc_spi: fix error handling in mmc_spi_probe()
  - !8977 [sync] PR-8584:  virtio-blk: fix implicit overflow on virtio_max_dma_size
  - !8701  wifi: cfg80211: check A-MSDU format more carefully
  - net: fix kabi breakage in struct dst_ops
  - net: fix __dst_negative_advice() race
  - net: annotate data-races around sk->sk_dst_pending_confirm
  - mm: swap: fix race between free_swap_and_cache() and swapoff()
  - ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
  - hsr: Prevent use after free in prp_create_tagged_frame()
  - !9002  scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - !9056  drm/panel: fix a possible null pointer dereference
  - !9054  soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !8939  clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - !8952  ACPI: video: check for error while searching for backlight device parent
  - !8986 [sync] PR-8639:  s390/qeth: Fix kernel panic after setting hsuid
  - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - !8714  Fix page corruption caused by racy check in __free_pages
  - ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
  - !9080  Bluetooth: L2CAP: Fix not validating setsockopt user input
  - Bluetooth: L2CAP: Fix not validating setsockopt user input
  - mm/dynamic_hugetlb: use rcu lock to protect hpool
  - mm/dynamic_hugetlb: simplify the refcount code
  - !9072 [sync] PR-9015:  CVE-2024-36953
  - !9071 [sync] PR-9014:  drm/vc4: don't check if plane->state->fb == state->fb
  - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
  - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
  - drm/vc4: don't check if plane->state->fb == state->fb
  - Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
  - !8947 [sync] PR-6800:  block: fix overflow in blk_ioctl_discard()
  - !9052  CVE-2024-35796
  - drm/panel: fix a possible null pointer dereference
  - soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !9021  wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - net: ll_temac: platform_get_resource replaced by wrong function
  - !9048  IB/hfi1: Restore allocated resources on failed copyout
  - IB/hfi1: Restore allocated resources on failed copyout
  - !9028  tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - !8830  Fix CVE-2024-35951
  - !9009  fix CVE-2024-35839
  - !9008  tipc: fix a possible memleak in tipc_buf_append
  - !8721  CVE-2024-35887
  - !8876  drm/vmwgfx: Fix invalid reads in fence signaled events
  - !8884  scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - !8922  hugetlbfs: fix hugetlbfs_statfs() locking
  - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - netfilter: bridge: replace physindev with physinif in nf_bridge_info
  - netfilter: propagate net to nf_bridge_get_physindev
  - netfilter: nfnetlink_log: use proper helper for fetching physinif
  - !8662  usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
  - tipc: fix a possible memleak in tipc_buf_append
  - !8617 [sync] PR-8472:  fix CVE-2024-27415
  - !8983  fix CVE-2024-36905
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - s390/qeth: Fix kernel panic after setting hsuid
  - net: relax socket state check at accept time.
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
  - virtio-blk: fix implicit overflow on virtio_max_dma_size
  - mmc: mmc_spi: fix error handling in mmc_spi_probe()
  - ACPI: video: check for error while searching for backlight device parent
  - block: fix overflow in blk_ioctl_discard()
  - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - ceph: blocklist the kclient when receiving corrupted snap trace
  - ceph: shut down access to inode when async create fails
  - ceph: refactor remove_session_caps_cb
  - ceph: fix auth cap handling logic in remove_session_caps_cb
  - ceph: drop private list from remove_session_caps_cb
  - pipe: wakeup wr_wait after setting max_usage
  - fs/pipe: move check to pipe_has_watch_queue()
  - hugetlbfs: fix hugetlbfs_statfs() locking
  - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - drm/vmwgfx: Fix invalid reads in fence signaled events
  - drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
  - drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
  - batman-adv: Avoid infinite loop trying to resize local TT
  - ax25: fix use-after-free bugs caused by ax25_ds_del_timer
  - Fix page corruption caused by racy check in __free_pages
  - wifi: cfg80211: check A-MSDU format more carefully
  - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
  - netfilter: br_netfilter: skip conntrack input hook for promisc packets
  - netfilter: bridge: confirm multicast packets before passing them up the stack
  - rpmsg: virtio: Free driver_override when rpmsg_remove()
  - net/smc: Fix possible access to freed memory in link clear


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.81.0.162
changelog:
  - !8104 [sync] PR-7886:  drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
  - !9443  net/mlx5: Discard command completions in internal error
  - !9448  rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - !9432  hid: cp2112: Fix duplicate workqueue initialization
  - !9424  ASoC: SOF: Fix DSP oops stack dump output contents
  - !9418 [sync] PR-6683: v2  CVE-2024-26921
  - !9296  CVE-2021-47599
  - !9403  Fix CVE-2024-31076
  - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - net/mlx5: Discard command completions in internal error
  - !9198  init/main.c: Fix potential static_command_line memory overflow
  - hid: cp2112: Fix duplicate workqueue initialization
  - ASoC: SOF: Fix DSP oops stack dump output contents
  - !6742 [sync] PR-6654:  net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
  - sk_buff: Fix KABI break for the modification of struct sk_buff
  - inet: inet_defrag: prevent sk release while still in use
  - net: Fix KABI break for introducing is_skb_wmem()
  - skb_expand_head() adjust skb->truesize incorrectly
  - skbuff: introduce skb_expand_head()
  - !9349  powerpc/powernv: Add a null pointer check in opal_powercap_init()
  - !9396  RDMA/hns: Fix deadlock on SRQ async events.
  - !9353 [sync] PR-9305:  CVE-2024-26661 following bugfix
  - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
  - !9359  serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - !9379  RDMA/hns: Fix UAF for cq async event
  - !9291  net: bridge: xmit: make sure we have at least eth header len bytes
  - RDMA/hns: Fix deadlock on SRQ async events.
  - !9049 [sync] PR-8774:  CVE-2024-36914
  - !9263  ring-buffer: Fix a race between readers and resize checks
  - RDMA/hns: Fix UAF for cq async event
  - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - drm/amd/display: Fix && vs || typos
  - drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'
  - Revert "drm/amd/display: Fix && vs || typos"
  - powerpc/powernv: Add a null pointer check in opal_powercap_init()
  - !9272  drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - !9274  wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
  - !9281  drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - !9279  net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - btrfs: remove stale comment about the btrfs_show_devname
  - btrfs: update latest_dev when we create a sprout device
  - btrfs: use latest_dev in btrfs_show_devname
  - btrfs: convert latest_bdev type to btrfs_device and rename
  - !9213 [sync] PR-9112:  Backport some optimizing patches for kunpeng920
  - !9106  ksmbd: no response from compound read
  - !9185  spi: Fix deadlock when adding SPI controllers on SPI buses
  - net: bridge: xmit: make sure we have at least eth header len bytes
  - drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
  - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - ring-buffer: Fix a race between readers and resize checks
  - !9181  wifi: wilc1000: fix RCU usage in connect path
  - !9214  drm/amd/display: Fix division by zero in setup_dsc_config
  - !7541 [sync] PR-6801:  block: fix discard
  - !9142 v2  CVE-2023-52810
  - !8460 [sync] PR-8069:  CVE-2021-47427
  - !9155  fix CVE-2023-52791
  - !9169  UBIFS: fixes a series of issues that caused by power cut
  - !9003  media: tc358743: register v4l2 async device only after successful setup
  - !9088  fs/9p: fix uninitialized values during inode evict
  - drm/amd/display: Fix division by zero in setup_dsc_config
  - arm64: syscall: unmask DAIF for tracing status
  - arm64: Snapshot thread flags
  - sched: Snapshot thread flags
  - entry: Snapshot thread flags
  - x86: Snapshot thread flags
  - thread_info: Add helpers to snapshot thread flags
  - irqchip/gic-v3: Use dsb(ishst) to order writes with ICC_SGI1R_EL1 accesses
  - sched/fair: Optimize test_idle_cores() for !SMT
  - init/main.c: Fix potential static_command_line memory overflow
  - spi: fix kabi breakage in struct spi_controller
  - spi: fix use-after-free of the add_lock mutex
  - spi: Fix deadlock when adding SPI controllers on SPI buses
  - wifi: wilc1000: fix RCU usage in connect path
  - ubifs: dbg_orphan_check: Fix missed key type checking
  - ubifs: Fix unattached inode when powercut happens in creating
  - ubifs: Fix space leak when powercut happens in linking tmpfile
  - ubifs: Move ui->data initialization after initializing security
  - ubifs: Fix adding orphan entry twice for the same inode
  - ubifs: Remove insert_dead_orphan from replaying orphan process
  - ubifs: Don't add xattr inode into orphan area
  - ubifs: Fix unattached xattr inode if powercut happens after deleting
  - ubifs: Fix some kernel-doc comments
  - ubifs: Fix spelling mistakes
  - i2c: core: Fix atomic xfer check for non-preempt config
  - i2c: core: Run atomic i2c xfer when !preemptible
  - fs/jfs: Add check for negative db_l2nbperpage
  - jfs: jfs_dmap: Validate db_l2nbperpage while mounting
  - ksmbd: no response from compound read
  - fs/9p: fix uninitialized values during inode evict
  - drm/amd/display: Skip on writeback when it's not applicable
  - media: tc358743: register v4l2 async device only after successful setup
  - scsi: iscsi: Fix iscsi_task use after free
  - scsi: iscsi: Have abort handler get ref to conn
  - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
  - block: check io size before submit discard
  - block: fix overflow in blk_ioctl_discard()
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.82.0.163
changelog:
  - !9461 [sync] PR-5860:  ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
  - !9197  scsi: core: Fix unremoved procfs host directory regression
  - !9203  dyndbg: fix old BUG_ON in >control parser
  - !9195  wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  - !9200  ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  - !9189  clk: Fix clk_core_get NULL dereference
  - !9187  net: phy: fix phy_get_internal_delay accessing an empty array
  - !9460 v2  CVE-2024-27032
  - ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
  - f2fs: fix to avoid potential panic during recovery
  - f2fs: fix to check return value of f2fs_reserve_new_block()
  - dyndbg: fix old BUG_ON in >control parser
  - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  - scsi: core: Fix unremoved procfs host directory regression
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  - clk: Fix clk_core_get NULL dereference
  - net: phy: fix phy_get_internal_delay accessing an empty array


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.83.0.164
changelog:
  - !9159  xfs: don't use current->journal_info
  - !9659  fix uaf when proc_cpuset_show
  - !9574 [sync] PR-8683: v4  Fix CVE-2024-35879
  - !9531  CVE-2024-37356
  - !9650  RDMA/hns: Modify the print level of CQE error
  - !9495  netrom: fix possible dead-lock in nr_rt_ioctl()
  - cgroup: fix uaf when proc_cpuset_show
  - RDMA/hns: Modify the print level of CQE error
  - !9515  RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - !9604 [sync] PR-9595:  drm/arm/malidp: fix a possible null pointer dereference
  - !9603 [sync] PR-9593:  ARM: 9170/1: fix panic when kasan and kprobe are enabled
  - !9602 [sync] PR-9504:  um: Add winch to winch_handlers before registering winch IRQ
  - !9601  CVE-2024-38597
  - drm/arm/malidp: fix a possible null pointer dereference
  - ARM: 9170/1: fix panic when kasan and kprobe are enabled
  - um: Add winch to winch_handlers before registering winch IRQ
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
  - !9575 [sync] PR-9321:  drm/amd/display: Fix potential index out of bounds in color transformation function
  - !9586 [sync] PR-9284:  of: module: add buffer overflow check in of_modalias()
  - !9589  s390/ap: Fix crash in AP internal function modify_bitmap()
  - s390/ap: Fix crash in AP internal function modify_bitmap()
  - of: module: add buffer overflow check in of_modalias()
  - !9541  net/mlx5e: Avoid field-overflowing memcpy()
  - !9480  watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - !9579 [sync] PR-9558:  CVE-2024-39362
  - !8565 [sync] PR-8240: v2  dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
  - !9545  ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - !9576 v2  btrfs: fix crash on racing fsync and size-extending write into prealloc
  - !9384  serial: max3100: Update uart_driver_registered on driver removal
  - !9564  fs/ntfs3: Check 'folio' pointer for NULL
  - i2c: acpi: Unbind mux adapters before delete
  - i2c: add fwnode APIs
  - btrfs: fix crash on racing fsync and size-extending write into prealloc
  - drm/amd/display: Fix potential index out of bounds in color transformation function
  - driver core: Fix kabi broken
  - of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
  - driver core: Introduce device_link_wait_removal()
  - !9484  fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - !9529  media: lgdt3306a: Add a check against null-pointer-def
  - fs/ntfs3: Check 'folio' pointer for NULL
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - net/mlx5e: Avoid field-overflowing memcpy()
  - !9375  ALSA: core: Fix NULL module pointer assignment at card init
  - !9468  net/mlx5: Add a timeout to acquire the command queue semaphore
  - !9458  bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
  - params: lift param_set_uint_minmax to common code
  - !9431  CVE-2022-48703
  - !9364  fs/ntfs3: Use variable length array instead of fixed size
  - media: lgdt3306a: Add a check against null-pointer-def
  - !9411  kprobes: Fix possible use-after-free issue on kprobe registration
  - !8743  ext4 bugfix from mainline
  - !9498  ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - !9397 [sync] PR-9350:  tracing: Fix permissions for the buffer_percent file
  - !9334  net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - !8712  ubifs: Set page uptodate in the correct place
  - !9259  Fix CVE-2024-38588
  - !9385  vfio/pci: fix potential memory leak in vfio_intx_enable()
  - !9454  jffs2: prevent xattr node from overflowing the eraseblock
  - !9328  CVE-2024-38596
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - netrom: fix possible dead-lock in nr_rt_ioctl()
  - fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - net/mlx5: Add a timeout to acquire the command queue semaphore
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - jffs2: prevent xattr node from overflowing the eraseblock
  - thermal: int340x_thermal: Consolidate priv->data_vault checks
  - thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR
  - kprobes: Fix possible use-after-free issue on kprobe registration
  - tracing: Fix permissions for the buffer_percent file
  - vfio/pci: fix potential memory leak in vfio_intx_enable()
  - serial: max3100: Update uart_driver_registered on driver removal
  - ALSA: core: Fix NULL module pointer assignment at card init
  - fs/ntfs3: Use variable length array instead of fixed size
  - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - af_unix: Fix data-races around sk->sk_shutdown.
  - af_unix: Fix data races around sk->sk_shutdown.
  - ftrace: Fix possible use-after-free issue in ftrace_location()
  - ftrace: Fix possible warning on checking all pages used in ftrace_process_locs()
  - ftrace: Store the order of pages allocated in ftrace_page
  - xfs: don't use current->journal_info
  - ext4: fix warning in ext4_dio_write_end_io()
  - ext4: properly sync file size update after O_SYNC direct IO
  - iomap: update ki_pos a little later in iomap_dio_complete
  - ubifs: Set page uptodate in the correct place
  - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.84.0.165
changelog:
  - !9852  net/sched: act_skbmod: prevent kernel-infoleak
  - !9854  nilfs2: fix use-after-free of timer for log writer thread
  - !9855 [sync] PR-8096:  Fix CVE-2024-35988
  - !9469 [sync] PR-8098:  netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  - !9833  mmc: davinci: Don't strip remove function when driver is builtin
  - !9847 [sync] PR-9500:  netfilter: nf_tables: flush pending destroy work before exit_net release
  - riscv: Fix TASK_SIZE on 64-bit NOMMU
  - riscv: fix VMALLOC_START definition
  - nilfs2: fix use-after-free of timer for log writer thread
  - net/sched: act_skbmod: prevent kernel-infoleak
  - netfilter: nf_tables: flush pending destroy work before exit_net release
  - mmc: davinci: Don't strip remove function when driver is builtin
  - !9651  f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
  - !9818  kdb: Fix buffer overflow during tab-complete
  - kdb: Fix buffer overflow during tab-complete
  - !9806  CVE-2024-36478
  - !9773  btrfs: fix use-after-free after failure to create a snapshot
  - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
  - null_blk: Move driver into its own directory
  - !9794  drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
  - !9790  clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data
  - drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
  - clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data
  - !9661 v3  Fix CVE-2024-38567
  - !9552  virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - !9767  f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
  - !9769  iomap: Don't finish dio under irq when there exists pages
  - !9774  net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - !9733  drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
  - btrfs: fix use-after-free after failure to create a snapshot
  - iomap: Don't finish dio under irq when there exists pages
  - !9718  KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
  - !9762  CVE-2024-26816
  - f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
  - !9717  ax25: Fix reference count leak issues of ax25_dev
  - x86/boot: Ignore relocations in .notes sections in walk_relocs() too
  - x86, relocs: Ignore relocations in .notes section
  - !9702  dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - !9738  CVE-2024-38621
  - !9673  ax25: Fix reference count leak issue of net_device
  - !9734  net/9p: fix uninit-value in p9_client_rpc()
  - !9740  dma-mapping: benchmark: handle NUMA_NO_NODE correctly
  - !9739  media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
  - dma-mapping: benchmark: handle NUMA_NO_NODE correctly
  - media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
  - media: stk1160: fix bounds checking in stk1160_copy_video()
  - net/9p: fix uninit-value in p9_client_rpc()
  - drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
  - !9722  ext4: delete redundant uptodate
  - ext4: delete redundant uptodate check for buffer
  - KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
  - ax25: Fix reference count leak issues of ax25_dev
  - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - !9641  CVE-2024-38582
  - !9663  tls: fix missing memory barrier in tls_init
  - !9656 v2  CVE-2024-38586
  - !9685  greybus: lights: check return of get_channel_from_mode
  - !9671  crypto: bcm - Fix pointer arithmetic
  - !9635  fix CVE-2022-48721
  - greybus: lights: check return of get_channel_from_mode
  - ax25: Fix reference count leak issue of net_device
  - crypto: bcm - Fix pointer arithmetic
  - tls: fix missing memory barrier in tls_init
  - wifi: carl9170: add a proper sanity check for endpoints
  - USB: core: Add routines for endpoint checks in old drivers
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets.
  - r8169: remove nr_frags argument from rtl_tx_slots_avail
  - r8169: improve rtl8169_start_xmit
  - r8169: improve rtl_tx
  - r8169: use READ_ONCE in rtl_tx_slots_avail
  - r8169: remove unneeded memory barrier in rtl_tx
  - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
  - nilfs2: fix potential hang in nilfs_detach_log_writer()
  - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
  - net/smc: Fix slab-out-of-bounds issue in fallback
  - net/smc: Only save the original clcsock callback functions
  - net/smc: Avoid overwriting the copies of clcsock callback functions
  - net/smc: Forward wakeup to smc socket waitqueue after fallback
  - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path


author: Li Nan <linan122@huawei.com> - 5.10.0-136.85.0.166
changelog:
  - !10068 [sync] PR-9984:  nilfs2: fix potential kernel bug due to lack of writeback flag waiting
  - !10032  ipv6: prevent possible NULL dereference in rt6_probe()
  - !10063  ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  - nilfs2: fix potential kernel bug due to lack of writeback flag waiting
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  - !9991  netpoll: Fix race condition in netpoll_owner_active
  - !10043  lib/generic-radix-tree.c: Don't overflow in peek()
  - !9951  f2fs: remove clear SB_INLINECRYPT flag in default_options
  - !9981  CVE-2024-40972
  - !9995  Bluetooth: btusb: Add date->evt_skb is NULL check
  - !9846 v2  CVE-2024-38598
  - !9907  sock_map: avoid race between sock_map_close and sk_psock_put
  - !9927  ocfs2: fix races between hole punching and AIO+DIO
  - !9912  arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
  - !9947  ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
  - !9969 v2  netfilter: nft_set_pipapo: do not free live element
  - !9980  Fix CVE-2023-52781
  - !9954  drm/komeda: check for error-valued pointer
  - !9923  drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
  - lib/generic-radix-tree.c: Don't overflow in peek()
  - ipv6: prevent possible NULL dereference in rt6_probe()
  - Bluetooth: btusb: Add date->evt_skb is NULL check
  - netpoll: Fix race condition in netpoll_owner_active
  - ext4: do not create EA inode under buffer lock
  - ext4: fold quota accounting into ext4_xattr_inode_lookup_create()
  - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set()
  - usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
  - USB: core: Change configuration warnings to notices
  - netfilter: nft_set_pipapo: do not free live element
  - !9869  cifs: Fix deadlock in cifs_writepages during reconnect
  - drm/komeda: check for error-valued pointer
  - !9906  mptcp: ensure snd_una is properly initialized on connect
  - f2fs: remove clear SB_INLINECRYPT flag in default_options
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
  - !9894  bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  - ocfs2: fix races between hole punching and AIO+DIO
  - drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
  - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
  - !9828  ksmbd: fix slab out of bounds write in smb_inherit_dacl()
  - !9826  smb: client: fix potential deadlock when releasing mids
  - !9890  ipv6: sr: fix memleak in seg6_hmac_init_algo
  - !9822 [sync] PR-9712:  fix CVE-2024-38540
  - !9823 [sync] PR-9711:  fix CVE-2024-38615
  - sock_map: avoid race between sock_map_close and sk_psock_put
  - mptcp: ensure snd_una is properly initialized on connect
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  - ipv6: sr: fix memleak in seg6_hmac_init_algo
  - !9840  cgroup: Fix AA deadlock caused by cgroup_bpf_release
  - !9873  CVE-2024-38570
  - gfs2: Fix potential glock use-after-free on unmount
  - gfs2: Rename sd_{ glock => kill }_wait
  - cifs: Fix deadlock in cifs_writepages during reconnect
  - !9636  ice: Do not use WQ_MEM_RECLAIM flag for workqueue
  - !9747  CVE-2024-39469
  - !9844  xfs: fix log recovery buffer allocation for the legacy h_size fixup
  - md: fix resync softlockup when bitmap size is less than array size
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
  - Revert "md/raid10: fix slab-out-of-bounds in md_bitmap_get_counter"
  - xfs: fix log recovery buffer allocation for the legacy h_size fixup
  - cgroup: Fix AA deadlock caused by cgroup_bpf_release
  - ksmbd: fix slab out of bounds write in smb_inherit_dacl()
  - smb: client: fix potential deadlock when releasing mids
  - cpufreq: exit() callback is optional
  - cpufreq: Rearrange locking in cpufreq_remove_dev()
  - cpufreq: Split cpufreq_offline()
  - cpufreq: Reorganize checks in cpufreq_offline()
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
  - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
  - nilfs2: return the mapped address from nilfs_get_page()
  - ice: Do not use WQ_MEM_RECLAIM flag for workqueue


author: Li Nan <linan122@huawei.com> - 5.10.0-136.86.0.167
changelog:
  - !10283 v2  CVE-2022-48816
  - !9781  ksmbd: fix wrong DataOffset validation of create context
  - !10301 v2  usb-storage: alauda: Check whether the media is initialized
  - !10297  CVE-2023-52679
  - usb-storage: alauda: Check whether the media is initialized
  - !10263  media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
  - of: unittest: Fix compile in the non-dynamic case
  - of: unittest: Fix of_count_phandle_with_args() expected value message
  - of: Fix double free in of_parse_phandle_with_args_map
  - !10225  scsi: ufs: Fix a deadlock in the error handler
  - SUNRPC: Do not dereference non-socket transports in sysfs
  - SUNRPC: lock against ->sock changing during sysfs read
  - !10244  Bluetooth: hci_core: Fix leaking sent_cmd skb
  - !10230  ima: Fix use-after-free on a dentry's dname.name
  - !10235  ima: Avoid blocking in RCU read-side critical section
  - !10234  fix CVE-2024-41007
  - !10201  net: dsa: seville: register the mdiobus under devres
  - !10267  USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - !10256  dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
  - media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
  - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
  - Bluetooth: hci_core: Fix leaking sent_cmd skb
  - !9918  powerpc/pseries: Enforce hcall result buffer validity and size
  - !10223  CVE-2024-35931
  - !10085  nfs: Ensure that the NFS client returns a correct writeback error code
  - ima: Avoid blocking in RCU read-side critical section
  - tcp: avoid too many retransmit packets
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
  - net: tcp: fix unexcepted socket die when snd_wnd is 0
  - !10181 [sync] PR-9836:  fpga: manager: add owner module and take its refcount
  - !10221  bpf: Fix overrunning reservations in ringbuf
  - ima: Fix use-after-free on a dentry's dname.name
  - !10200  dma-mapping: benchmark: fix node id validation
  - !10209  drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
  - !10020  drm/exynos/vidi: fix memory leak in .get_modes()
  - scsi: ufs: Fix a deadlock in the error handler
  - drm/amdgpu: Fix kabi breakage in struct amdgpu_hive_info
  - drm/amdgpu: Skip do PCI error slot reset during RAS recovery
  - drm/amdgpu : Add hive ras recovery check
  - bpf: Fix overrunning reservations in ringbuf
  - drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
  - !10136  ALSA: timer: Set lower bound of start tick time
  - !10105  ecryptfs: Fix buffer size for tag 66 packet
  - net: dsa: seville: register the mdiobus under devres
  - dma-mapping: benchmark: fix node id validation
  - !10140 [sync] PR-10095:  CVE-2024-40968
  - !10108  tracing: Build event generation tests only as modules
  - !10157 v2  wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - !10008  xfs: fix mount hung while sb recover fail
  - fpga: manager: add owner module and take its refcount
  - !10164  drop_monitor: replace spin_lock by raw_spin_lock
  - !10163  RDMA/mlx5: Add check for srq max_sge attribute
  - !10049  tipc: force a dst refcount before doing decryption
  - !10023  liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - drop_monitor: replace spin_lock by raw_spin_lock
  - RDMA/mlx5: Add check for srq max_sge attribute
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - !10042  Fix CVE-2024-36939
  - MIPS: Octeon: Add PCIe link status check
  - !10129  wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - ALSA: timer: Set lower bound of start tick time
  - !10119  wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - !10080  drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - !10053  vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - !10089  fix CVE-2024-40995
  - !9993  io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - !9902  ipv6: fix possible race in __fib6_drop_pcpu_from()
  - !10098 [sync] PR-9741:  scsi: qedf: Ensure the copied buf is NUL terminated
  - !9932  nvdimm: Backport some bugfixs
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - tracing: Build event generation tests only as modules
  - ecryptfs: Fix buffer size for tag 66 packet
  - scsi: qedf: Ensure the copied buf is NUL terminated
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
  - net/sched: act_api: rely on rcu in tcf_idr_check_alloc
  - nfs: Ensure write and flush consume writeback errors
  - NFS: Don't report ENOSPC write errors twice
  - NFS: Use of mapping_set_error() results in spurious errors
  - nfs: ensure correct writeback errors are returned on close()
  - nfs: nfs_file_write() should check for writeback errors
  - drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - tipc: force a dst refcount before doing decryption
  - sunrpc: fix KABI broken in struct rpc_create_args
  - nfs: Handle error of rpc_proc_register() in nfs_net_init().
  - nfs: make the rpc_stat per net namespace
  - nfs: expose /proc/net/sunrpc/nfs in net namespaces
  - sunrpc: add a struct rpc_stats arg to rpc_create_args
  - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - drm/exynos/vidi: fix memory leak in .get_modes()
  - xfs: fix mount hung while sb recover fail
  - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - dax: alloc_dax() return ERR_PTR(-EOPNOTSUPP) for CONFIG_DAX=n
  - nvdimm/pmem: use add_disk() error handling
  - powerpc/pseries: Enforce hcall result buffer validity and size
  - ipv6: fix possible race in __fib6_drop_pcpu_from()
  - ksmbd: fix wrong DataOffset validation of create context


author: wangkai <13474090681@163.com> - 8.0.37-1
changelog:
  - Update to 8.0.37 for fix CVEs(CVE-2024-20964,CVE-2024-20971,CVE-2024-20976,
    CVE-2024-20973,CVE-2024-20978,CVE-2024-20981,CVE-2024-20962,CVE-2024-20977,
    CVE-2024-20963,CVE-2024-20965,CVE-2024-20972,CVE-2024-20961,CVE-2024-20982,
    CVE-2024-20970,CVE-2024-20967,CVE-2024-20984,CVE-2024-20974,CVE-2024-20966,
    CVE-2024-20960,CVE-2024-20985,CVE-2024-20969,CVE-2024-21000,CVE-2024-21069,
    CVE-2024-21009,CVE-2024-21087,CVE-2024-21047,CVE-2024-20998,CVE-2024-21013,
    CVE-2024-21060,CVE-2024-21008,CVE-2024-21102,CVE-2024-21054,CVE-2024-21062,
    CVE-2024-20994,CVE-2024-21096,CVE-2024-21061,CVE-2024-20993,CVE-2024-21055,
    CVE-2024-21057,CVE-2023-6129)


author: wangkai <13474090681@163.com> - 8.0.38-1
changelog:
  - Update to 8.0.38 for fix CVEs(CVE-2024-21125,CVE-2024-21142,CVE-2024-21179,
    CVE-2024-21171,CVE-2024-21130,CVE-2024-21162,CVE-2024-21177,CVE-2024-20996,
    CVE-2024-21134,CVE-2024-21165,CVE-2024-21173,CVE-2024-21129,CVE-2024-21127,
    CVE-2024-21163)


