# changelog

author: hanchao <hanchao63@huawei.com> - 1.17.3-28
changelog:
  - Type:CVE
  - CVE:CVE-2024-24783,CVE-2024-24785,CVE-2023-45290,CVE-2023-45289
  - SUG:NA
  - DESC:fix CVE-2024-24783,CVE-2024-24785,CVE-2023-45290,CVE-2023-45289


author: wangshuo <wangshuo@kylinos.cn> - 1.17.3-31
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport the upstream patch, fix the overflow issue in runtime.netpollWaiters


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.81.0.162
changelog:
  - !8104 [sync] PR-7886:  drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
  - !9443  net/mlx5: Discard command completions in internal error
  - !9448  rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - !9432  hid: cp2112: Fix duplicate workqueue initialization
  - !9424  ASoC: SOF: Fix DSP oops stack dump output contents
  - !9418 [sync] PR-6683: v2  CVE-2024-26921
  - !9296  CVE-2021-47599
  - !9403  Fix CVE-2024-31076
  - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - net/mlx5: Discard command completions in internal error
  - !9198  init/main.c: Fix potential static_command_line memory overflow
  - hid: cp2112: Fix duplicate workqueue initialization
  - ASoC: SOF: Fix DSP oops stack dump output contents
  - !6742 [sync] PR-6654:  net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
  - sk_buff: Fix KABI break for the modification of struct sk_buff
  - inet: inet_defrag: prevent sk release while still in use
  - net: Fix KABI break for introducing is_skb_wmem()
  - skb_expand_head() adjust skb->truesize incorrectly
  - skbuff: introduce skb_expand_head()
  - !9349  powerpc/powernv: Add a null pointer check in opal_powercap_init()
  - !9396  RDMA/hns: Fix deadlock on SRQ async events.
  - !9353 [sync] PR-9305:  CVE-2024-26661 following bugfix
  - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
  - !9359  serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - !9379  RDMA/hns: Fix UAF for cq async event
  - !9291  net: bridge: xmit: make sure we have at least eth header len bytes
  - RDMA/hns: Fix deadlock on SRQ async events.
  - !9049 [sync] PR-8774:  CVE-2024-36914
  - !9263  ring-buffer: Fix a race between readers and resize checks
  - RDMA/hns: Fix UAF for cq async event
  - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - drm/amd/display: Fix && vs || typos
  - drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'
  - Revert "drm/amd/display: Fix && vs || typos"
  - powerpc/powernv: Add a null pointer check in opal_powercap_init()
  - !9272  drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - !9274  wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
  - !9281  drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - !9279  net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - btrfs: remove stale comment about the btrfs_show_devname
  - btrfs: update latest_dev when we create a sprout device
  - btrfs: use latest_dev in btrfs_show_devname
  - btrfs: convert latest_bdev type to btrfs_device and rename
  - !9213 [sync] PR-9112:  Backport some optimizing patches for kunpeng920
  - !9106  ksmbd: no response from compound read
  - !9185  spi: Fix deadlock when adding SPI controllers on SPI buses
  - net: bridge: xmit: make sure we have at least eth header len bytes
  - drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
  - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - ring-buffer: Fix a race between readers and resize checks
  - !9181  wifi: wilc1000: fix RCU usage in connect path
  - !9214  drm/amd/display: Fix division by zero in setup_dsc_config
  - !7541 [sync] PR-6801:  block: fix discard
  - !9142 v2  CVE-2023-52810
  - !8460 [sync] PR-8069:  CVE-2021-47427
  - !9155  fix CVE-2023-52791
  - !9169  UBIFS: fixes a series of issues that caused by power cut
  - !9003  media: tc358743: register v4l2 async device only after successful setup
  - !9088  fs/9p: fix uninitialized values during inode evict
  - drm/amd/display: Fix division by zero in setup_dsc_config
  - arm64: syscall: unmask DAIF for tracing status
  - arm64: Snapshot thread flags
  - sched: Snapshot thread flags
  - entry: Snapshot thread flags
  - x86: Snapshot thread flags
  - thread_info: Add helpers to snapshot thread flags
  - irqchip/gic-v3: Use dsb(ishst) to order writes with ICC_SGI1R_EL1 accesses
  - sched/fair: Optimize test_idle_cores() for !SMT
  - init/main.c: Fix potential static_command_line memory overflow
  - spi: fix kabi breakage in struct spi_controller
  - spi: fix use-after-free of the add_lock mutex
  - spi: Fix deadlock when adding SPI controllers on SPI buses
  - wifi: wilc1000: fix RCU usage in connect path
  - ubifs: dbg_orphan_check: Fix missed key type checking
  - ubifs: Fix unattached inode when powercut happens in creating
  - ubifs: Fix space leak when powercut happens in linking tmpfile
  - ubifs: Move ui->data initialization after initializing security
  - ubifs: Fix adding orphan entry twice for the same inode
  - ubifs: Remove insert_dead_orphan from replaying orphan process
  - ubifs: Don't add xattr inode into orphan area
  - ubifs: Fix unattached xattr inode if powercut happens after deleting
  - ubifs: Fix some kernel-doc comments
  - ubifs: Fix spelling mistakes
  - i2c: core: Fix atomic xfer check for non-preempt config
  - i2c: core: Run atomic i2c xfer when !preemptible
  - fs/jfs: Add check for negative db_l2nbperpage
  - jfs: jfs_dmap: Validate db_l2nbperpage while mounting
  - ksmbd: no response from compound read
  - fs/9p: fix uninitialized values during inode evict
  - drm/amd/display: Skip on writeback when it's not applicable
  - media: tc358743: register v4l2 async device only after successful setup
  - scsi: iscsi: Fix iscsi_task use after free
  - scsi: iscsi: Have abort handler get ref to conn
  - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
  - block: check io size before submit discard
  - block: fix overflow in blk_ioctl_discard()
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.82.0.163
changelog:
  - !9461 [sync] PR-5860:  ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
  - !9197  scsi: core: Fix unremoved procfs host directory regression
  - !9203  dyndbg: fix old BUG_ON in >control parser
  - !9195  wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  - !9200  ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  - !9189  clk: Fix clk_core_get NULL dereference
  - !9187  net: phy: fix phy_get_internal_delay accessing an empty array
  - !9460 v2  CVE-2024-27032
  - ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
  - f2fs: fix to avoid potential panic during recovery
  - f2fs: fix to check return value of f2fs_reserve_new_block()
  - dyndbg: fix old BUG_ON in >control parser
  - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  - scsi: core: Fix unremoved procfs host directory regression
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  - clk: Fix clk_core_get NULL dereference
  - net: phy: fix phy_get_internal_delay accessing an empty array


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.83.0.164
changelog:
  - !9159  xfs: don't use current->journal_info
  - !9659  fix uaf when proc_cpuset_show
  - !9574 [sync] PR-8683: v4  Fix CVE-2024-35879
  - !9531  CVE-2024-37356
  - !9650  RDMA/hns: Modify the print level of CQE error
  - !9495  netrom: fix possible dead-lock in nr_rt_ioctl()
  - cgroup: fix uaf when proc_cpuset_show
  - RDMA/hns: Modify the print level of CQE error
  - !9515  RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - !9604 [sync] PR-9595:  drm/arm/malidp: fix a possible null pointer dereference
  - !9603 [sync] PR-9593:  ARM: 9170/1: fix panic when kasan and kprobe are enabled
  - !9602 [sync] PR-9504:  um: Add winch to winch_handlers before registering winch IRQ
  - !9601  CVE-2024-38597
  - drm/arm/malidp: fix a possible null pointer dereference
  - ARM: 9170/1: fix panic when kasan and kprobe are enabled
  - um: Add winch to winch_handlers before registering winch IRQ
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
  - !9575 [sync] PR-9321:  drm/amd/display: Fix potential index out of bounds in color transformation function
  - !9586 [sync] PR-9284:  of: module: add buffer overflow check in of_modalias()
  - !9589  s390/ap: Fix crash in AP internal function modify_bitmap()
  - s390/ap: Fix crash in AP internal function modify_bitmap()
  - of: module: add buffer overflow check in of_modalias()
  - !9541  net/mlx5e: Avoid field-overflowing memcpy()
  - !9480  watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - !9579 [sync] PR-9558:  CVE-2024-39362
  - !8565 [sync] PR-8240: v2  dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
  - !9545  ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - !9576 v2  btrfs: fix crash on racing fsync and size-extending write into prealloc
  - !9384  serial: max3100: Update uart_driver_registered on driver removal
  - !9564  fs/ntfs3: Check 'folio' pointer for NULL
  - i2c: acpi: Unbind mux adapters before delete
  - i2c: add fwnode APIs
  - btrfs: fix crash on racing fsync and size-extending write into prealloc
  - drm/amd/display: Fix potential index out of bounds in color transformation function
  - driver core: Fix kabi broken
  - of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
  - driver core: Introduce device_link_wait_removal()
  - !9484  fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - !9529  media: lgdt3306a: Add a check against null-pointer-def
  - fs/ntfs3: Check 'folio' pointer for NULL
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - net/mlx5e: Avoid field-overflowing memcpy()
  - !9375  ALSA: core: Fix NULL module pointer assignment at card init
  - !9468  net/mlx5: Add a timeout to acquire the command queue semaphore
  - !9458  bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
  - params: lift param_set_uint_minmax to common code
  - !9431  CVE-2022-48703
  - !9364  fs/ntfs3: Use variable length array instead of fixed size
  - media: lgdt3306a: Add a check against null-pointer-def
  - !9411  kprobes: Fix possible use-after-free issue on kprobe registration
  - !8743  ext4 bugfix from mainline
  - !9498  ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - !9397 [sync] PR-9350:  tracing: Fix permissions for the buffer_percent file
  - !9334  net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - !8712  ubifs: Set page uptodate in the correct place
  - !9259  Fix CVE-2024-38588
  - !9385  vfio/pci: fix potential memory leak in vfio_intx_enable()
  - !9454  jffs2: prevent xattr node from overflowing the eraseblock
  - !9328  CVE-2024-38596
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - netrom: fix possible dead-lock in nr_rt_ioctl()
  - fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - net/mlx5: Add a timeout to acquire the command queue semaphore
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - jffs2: prevent xattr node from overflowing the eraseblock
  - thermal: int340x_thermal: Consolidate priv->data_vault checks
  - thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR
  - kprobes: Fix possible use-after-free issue on kprobe registration
  - tracing: Fix permissions for the buffer_percent file
  - vfio/pci: fix potential memory leak in vfio_intx_enable()
  - serial: max3100: Update uart_driver_registered on driver removal
  - ALSA: core: Fix NULL module pointer assignment at card init
  - fs/ntfs3: Use variable length array instead of fixed size
  - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - af_unix: Fix data-races around sk->sk_shutdown.
  - af_unix: Fix data races around sk->sk_shutdown.
  - ftrace: Fix possible use-after-free issue in ftrace_location()
  - ftrace: Fix possible warning on checking all pages used in ftrace_process_locs()
  - ftrace: Store the order of pages allocated in ftrace_page
  - xfs: don't use current->journal_info
  - ext4: fix warning in ext4_dio_write_end_io()
  - ext4: properly sync file size update after O_SYNC direct IO
  - iomap: update ki_pos a little later in iomap_dio_complete
  - ubifs: Set page uptodate in the correct place
  - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-136.84.0.165
changelog:
  - !9852  net/sched: act_skbmod: prevent kernel-infoleak
  - !9854  nilfs2: fix use-after-free of timer for log writer thread
  - !9855 [sync] PR-8096:  Fix CVE-2024-35988
  - !9469 [sync] PR-8098:  netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  - !9833  mmc: davinci: Don't strip remove function when driver is builtin
  - !9847 [sync] PR-9500:  netfilter: nf_tables: flush pending destroy work before exit_net release
  - riscv: Fix TASK_SIZE on 64-bit NOMMU
  - riscv: fix VMALLOC_START definition
  - nilfs2: fix use-after-free of timer for log writer thread
  - net/sched: act_skbmod: prevent kernel-infoleak
  - netfilter: nf_tables: flush pending destroy work before exit_net release
  - mmc: davinci: Don't strip remove function when driver is builtin
  - !9651  f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
  - !9818  kdb: Fix buffer overflow during tab-complete
  - kdb: Fix buffer overflow during tab-complete
  - !9806  CVE-2024-36478
  - !9773  btrfs: fix use-after-free after failure to create a snapshot
  - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
  - null_blk: Move driver into its own directory
  - !9794  drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
  - !9790  clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data
  - drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
  - clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data
  - !9661 v3  Fix CVE-2024-38567
  - !9552  virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - !9767  f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
  - !9769  iomap: Don't finish dio under irq when there exists pages
  - !9774  net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - !9733  drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
  - btrfs: fix use-after-free after failure to create a snapshot
  - iomap: Don't finish dio under irq when there exists pages
  - !9718  KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
  - !9762  CVE-2024-26816
  - f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
  - !9717  ax25: Fix reference count leak issues of ax25_dev
  - x86/boot: Ignore relocations in .notes sections in walk_relocs() too
  - x86, relocs: Ignore relocations in .notes section
  - !9702  dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - !9738  CVE-2024-38621
  - !9673  ax25: Fix reference count leak issue of net_device
  - !9734  net/9p: fix uninit-value in p9_client_rpc()
  - !9740  dma-mapping: benchmark: handle NUMA_NO_NODE correctly
  - !9739  media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
  - dma-mapping: benchmark: handle NUMA_NO_NODE correctly
  - media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
  - media: stk1160: fix bounds checking in stk1160_copy_video()
  - net/9p: fix uninit-value in p9_client_rpc()
  - drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
  - !9722  ext4: delete redundant uptodate
  - ext4: delete redundant uptodate check for buffer
  - KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
  - ax25: Fix reference count leak issues of ax25_dev
  - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - !9641  CVE-2024-38582
  - !9663  tls: fix missing memory barrier in tls_init
  - !9656 v2  CVE-2024-38586
  - !9685  greybus: lights: check return of get_channel_from_mode
  - !9671  crypto: bcm - Fix pointer arithmetic
  - !9635  fix CVE-2022-48721
  - greybus: lights: check return of get_channel_from_mode
  - ax25: Fix reference count leak issue of net_device
  - crypto: bcm - Fix pointer arithmetic
  - tls: fix missing memory barrier in tls_init
  - wifi: carl9170: add a proper sanity check for endpoints
  - USB: core: Add routines for endpoint checks in old drivers
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets.
  - r8169: remove nr_frags argument from rtl_tx_slots_avail
  - r8169: improve rtl8169_start_xmit
  - r8169: improve rtl_tx
  - r8169: use READ_ONCE in rtl_tx_slots_avail
  - r8169: remove unneeded memory barrier in rtl_tx
  - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
  - nilfs2: fix potential hang in nilfs_detach_log_writer()
  - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
  - net/smc: Fix slab-out-of-bounds issue in fallback
  - net/smc: Only save the original clcsock callback functions
  - net/smc: Avoid overwriting the copies of clcsock callback functions
  - net/smc: Forward wakeup to smc socket waitqueue after fallback
  - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path


author: Li Nan <linan122@huawei.com> - 5.10.0-136.85.0.166
changelog:
  - !10068 [sync] PR-9984:  nilfs2: fix potential kernel bug due to lack of writeback flag waiting
  - !10032  ipv6: prevent possible NULL dereference in rt6_probe()
  - !10063  ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  - nilfs2: fix potential kernel bug due to lack of writeback flag waiting
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  - !9991  netpoll: Fix race condition in netpoll_owner_active
  - !10043  lib/generic-radix-tree.c: Don't overflow in peek()
  - !9951  f2fs: remove clear SB_INLINECRYPT flag in default_options
  - !9981  CVE-2024-40972
  - !9995  Bluetooth: btusb: Add date->evt_skb is NULL check
  - !9846 v2  CVE-2024-38598
  - !9907  sock_map: avoid race between sock_map_close and sk_psock_put
  - !9927  ocfs2: fix races between hole punching and AIO+DIO
  - !9912  arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
  - !9947  ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
  - !9969 v2  netfilter: nft_set_pipapo: do not free live element
  - !9980  Fix CVE-2023-52781
  - !9954  drm/komeda: check for error-valued pointer
  - !9923  drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
  - lib/generic-radix-tree.c: Don't overflow in peek()
  - ipv6: prevent possible NULL dereference in rt6_probe()
  - Bluetooth: btusb: Add date->evt_skb is NULL check
  - netpoll: Fix race condition in netpoll_owner_active
  - ext4: do not create EA inode under buffer lock
  - ext4: fold quota accounting into ext4_xattr_inode_lookup_create()
  - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set()
  - usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
  - USB: core: Change configuration warnings to notices
  - netfilter: nft_set_pipapo: do not free live element
  - !9869  cifs: Fix deadlock in cifs_writepages during reconnect
  - drm/komeda: check for error-valued pointer
  - !9906  mptcp: ensure snd_una is properly initialized on connect
  - f2fs: remove clear SB_INLINECRYPT flag in default_options
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
  - !9894  bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  - ocfs2: fix races between hole punching and AIO+DIO
  - drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
  - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
  - !9828  ksmbd: fix slab out of bounds write in smb_inherit_dacl()
  - !9826  smb: client: fix potential deadlock when releasing mids
  - !9890  ipv6: sr: fix memleak in seg6_hmac_init_algo
  - !9822 [sync] PR-9712:  fix CVE-2024-38540
  - !9823 [sync] PR-9711:  fix CVE-2024-38615
  - sock_map: avoid race between sock_map_close and sk_psock_put
  - mptcp: ensure snd_una is properly initialized on connect
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  - ipv6: sr: fix memleak in seg6_hmac_init_algo
  - !9840  cgroup: Fix AA deadlock caused by cgroup_bpf_release
  - !9873  CVE-2024-38570
  - gfs2: Fix potential glock use-after-free on unmount
  - gfs2: Rename sd_{ glock => kill }_wait
  - cifs: Fix deadlock in cifs_writepages during reconnect
  - !9636  ice: Do not use WQ_MEM_RECLAIM flag for workqueue
  - !9747  CVE-2024-39469
  - !9844  xfs: fix log recovery buffer allocation for the legacy h_size fixup
  - md: fix resync softlockup when bitmap size is less than array size
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
  - Revert "md/raid10: fix slab-out-of-bounds in md_bitmap_get_counter"
  - xfs: fix log recovery buffer allocation for the legacy h_size fixup
  - cgroup: Fix AA deadlock caused by cgroup_bpf_release
  - ksmbd: fix slab out of bounds write in smb_inherit_dacl()
  - smb: client: fix potential deadlock when releasing mids
  - cpufreq: exit() callback is optional
  - cpufreq: Rearrange locking in cpufreq_remove_dev()
  - cpufreq: Split cpufreq_offline()
  - cpufreq: Reorganize checks in cpufreq_offline()
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
  - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
  - nilfs2: return the mapped address from nilfs_get_page()
  - ice: Do not use WQ_MEM_RECLAIM flag for workqueue


author: Li Nan <linan122@huawei.com> - 5.10.0-136.86.0.167
changelog:
  - !10283 v2  CVE-2022-48816
  - !9781  ksmbd: fix wrong DataOffset validation of create context
  - !10301 v2  usb-storage: alauda: Check whether the media is initialized
  - !10297  CVE-2023-52679
  - usb-storage: alauda: Check whether the media is initialized
  - !10263  media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
  - of: unittest: Fix compile in the non-dynamic case
  - of: unittest: Fix of_count_phandle_with_args() expected value message
  - of: Fix double free in of_parse_phandle_with_args_map
  - !10225  scsi: ufs: Fix a deadlock in the error handler
  - SUNRPC: Do not dereference non-socket transports in sysfs
  - SUNRPC: lock against ->sock changing during sysfs read
  - !10244  Bluetooth: hci_core: Fix leaking sent_cmd skb
  - !10230  ima: Fix use-after-free on a dentry's dname.name
  - !10235  ima: Avoid blocking in RCU read-side critical section
  - !10234  fix CVE-2024-41007
  - !10201  net: dsa: seville: register the mdiobus under devres
  - !10267  USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - !10256  dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
  - media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
  - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
  - Bluetooth: hci_core: Fix leaking sent_cmd skb
  - !9918  powerpc/pseries: Enforce hcall result buffer validity and size
  - !10223  CVE-2024-35931
  - !10085  nfs: Ensure that the NFS client returns a correct writeback error code
  - ima: Avoid blocking in RCU read-side critical section
  - tcp: avoid too many retransmit packets
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
  - net: tcp: fix unexcepted socket die when snd_wnd is 0
  - !10181 [sync] PR-9836:  fpga: manager: add owner module and take its refcount
  - !10221  bpf: Fix overrunning reservations in ringbuf
  - ima: Fix use-after-free on a dentry's dname.name
  - !10200  dma-mapping: benchmark: fix node id validation
  - !10209  drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
  - !10020  drm/exynos/vidi: fix memory leak in .get_modes()
  - scsi: ufs: Fix a deadlock in the error handler
  - drm/amdgpu: Fix kabi breakage in struct amdgpu_hive_info
  - drm/amdgpu: Skip do PCI error slot reset during RAS recovery
  - drm/amdgpu : Add hive ras recovery check
  - bpf: Fix overrunning reservations in ringbuf
  - drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
  - !10136  ALSA: timer: Set lower bound of start tick time
  - !10105  ecryptfs: Fix buffer size for tag 66 packet
  - net: dsa: seville: register the mdiobus under devres
  - dma-mapping: benchmark: fix node id validation
  - !10140 [sync] PR-10095:  CVE-2024-40968
  - !10108  tracing: Build event generation tests only as modules
  - !10157 v2  wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - !10008  xfs: fix mount hung while sb recover fail
  - fpga: manager: add owner module and take its refcount
  - !10164  drop_monitor: replace spin_lock by raw_spin_lock
  - !10163  RDMA/mlx5: Add check for srq max_sge attribute
  - !10049  tipc: force a dst refcount before doing decryption
  - !10023  liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - drop_monitor: replace spin_lock by raw_spin_lock
  - RDMA/mlx5: Add check for srq max_sge attribute
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - !10042  Fix CVE-2024-36939
  - MIPS: Octeon: Add PCIe link status check
  - !10129  wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - ALSA: timer: Set lower bound of start tick time
  - !10119  wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - !10080  drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - !10053  vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - !10089  fix CVE-2024-40995
  - !9993  io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - !9902  ipv6: fix possible race in __fib6_drop_pcpu_from()
  - !10098 [sync] PR-9741:  scsi: qedf: Ensure the copied buf is NUL terminated
  - !9932  nvdimm: Backport some bugfixs
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - tracing: Build event generation tests only as modules
  - ecryptfs: Fix buffer size for tag 66 packet
  - scsi: qedf: Ensure the copied buf is NUL terminated
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
  - net/sched: act_api: rely on rcu in tcf_idr_check_alloc
  - nfs: Ensure write and flush consume writeback errors
  - NFS: Don't report ENOSPC write errors twice
  - NFS: Use of mapping_set_error() results in spurious errors
  - nfs: ensure correct writeback errors are returned on close()
  - nfs: nfs_file_write() should check for writeback errors
  - drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - tipc: force a dst refcount before doing decryption
  - sunrpc: fix KABI broken in struct rpc_create_args
  - nfs: Handle error of rpc_proc_register() in nfs_net_init().
  - nfs: make the rpc_stat per net namespace
  - nfs: expose /proc/net/sunrpc/nfs in net namespaces
  - sunrpc: add a struct rpc_stats arg to rpc_create_args
  - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - drm/exynos/vidi: fix memory leak in .get_modes()
  - xfs: fix mount hung while sb recover fail
  - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - dax: alloc_dax() return ERR_PTR(-EOPNOTSUPP) for CONFIG_DAX=n
  - nvdimm/pmem: use add_disk() error handling
  - powerpc/pseries: Enforce hcall result buffer validity and size
  - ipv6: fix possible race in __fib6_drop_pcpu_from()
  - ksmbd: fix wrong DataOffset validation of create context


author: Li Nan <linan122@huawei.com> - 5.10.0-136.87.0.168
changelog:
  - !10435  md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING
  - !8942 [sync] PR-8468: v2  CVE-2024-35808
  - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING
  - !10067  iommu: Return right value in iommu_sva_bind_device()
  - !10335  fix CVE-2024-36479 for sp1
  - !10365  drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
  - !10213  net: mvpp2: clear BM pool before initialization
  - !10212  udp: do not accept non-tunnel GSO skbs landing in a tunnel
  - !10396  BMA: Fix DMA reset problem and change the version number
  - !10343  fix CVE-2024-27010
  - BMA/kbox_drv: Change the version number.
  - BMA/veth_drv: Change the version number.
  - BMA/cdev_drv: Change the version number.
  - BMA/edma_drv: Fix DMA reset problem and change the version number.
  - !10367 v2  jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
  - !10322  media: i2c: et8ek8: Don't strip remove function when driver is builtin
  - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
  - drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
  - net/sched: initialize noop_qdisc owner
  - net/sched: fix kabi change in struct Qdisc
  - net/sched: Fix mirred deadlock on device recursion
  - fpga: bridge: add owner module and take its refcount
  - fpga: remove redundant checks for bridge ops
  - fpga: bridge: properly initialize bridge device before populating children
  - fpga: bridge: Use standard dev_release for class driver
  - fpga: bridge: Rename dev to parent for parent device
  - !9369  macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
  - media: i2c: et8ek8: Don't strip remove function when driver is builtin
  - !10072  serial: imx: Introduce timeout when waiting on transmitter empty
  - !9975  KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
  - !10314 [sync] PR-10187:  fix CVE-2021-47205
  - !10313 [sync] PR-10189:  fix CVE-2024-40915
  - !10252  fbdev: savage: Handle err return when savagefb_check_var failed
  - !10308  net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr
  - !10259  batman-adv: bypass empty buckets in batadv_purge_orig_ref()
  - clk: sunxi-ng: Unregister clocks/resets when unbinding
  - riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context
  - net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr
  - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
  - fbdev: savage: Handle err return when savagefb_check_var failed
  - net: mvpp2: clear BM pool before initialization
  - udp: do not accept non-tunnel GSO skbs landing in a tunnel
  - serial: imx: Introduce timeout when waiting on transmitter empty
  - iommu: Return right value in iommu_sva_bind_device()
  - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
  - macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
  - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen
  - md/dm-raid: don't call md_reap_sync_thread() directly


author: Li Nan <linan122@huawei.com> - 5.10.0-136.88.0.169
changelog:
  - !10769  CVE-2024-41027
  - !10667 v2  ASoC: fsl-asoc-card: set priv->pdev before using it
  - !10724  scsi: qedf: Make qedf_execute_tmf() non-preemptible
  - Fix userfaultfd_api to return EINVAL as expected
  - mm/userfaultfd: fail uffd-wp registration if not supported
  - !10738  net/dpaa2: Avoid explicit cpumask var allocation on stack
  - !10744  media: mediatek: vcodec: Only free buffer VA that is not NULL
  - !10758  Fix CVE-2024-42160
  - !10531  ftruncate: pass a signed offset
  - f2fs: Add inline to f2fs_build_fault_attr() stub
  - f2fs: check validation of fault attrs in f2fs_build_fault_attr()
  - !10581 v2  bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
  - !10718  CVE-2024-42101
  - !10712  CVE-2024-41079
  - media: mediatek: vcodec: Only free buffer VA that is not NULL
  - !10728  net/iucv: Avoid explicit cpumask var allocation on stack
  - !10696 v2  drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
  - !10719  gve: Account for stopped queues when reading NIC stats
  - net/dpaa2: Avoid explicit cpumask var allocation on stack
  - !10620  fix CVE-2024-42129
  - !9680  drm: vc4: Fix possible null pointer dereference
  - !10671 [sync] PR-10598:  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  - net/iucv: Avoid explicit cpumask var allocation on stack
  - scsi: qedf: Make qedf_execute_tmf() non-preemptible
  - gve: Account for stopped queues when reading NIC stats
  - !10588 v2  ax25: Fix refcount imbalance on inbound connections
  - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
  - nvmet: always initialize cqe.result
  - !10682  ocfs2: fix DIO failure due to insufficient transaction credits
  - !10567  gpio: davinci: Validate the obtained number of IRQs
  - !10669  fix CVE-2024-42076
  - !10662  fix CVE-2024-41062
  - !10651  xfs: don't walk off the end of a directory data block
  - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
  - !10655  KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
  - !10632  sched/deadline: Fix task_struct reference leak
  - !10520  xfs: add bounds checking to xlog_recover_process_data
  - ocfs2: fix DIO failure due to insufficient transaction credits
  - !10390  pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  - net: can: j1939: Initialize unused data in j1939_send_one()
  - can: j1939: j1939_send_one(): fix missing CAN header initialization
  - ASoC: fsl-asoc-card: set priv->pdev before using it
  - !10638  usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  - !10645  inet_diag: Initialize pad field in struct inet_diag_req_v2
  - !10637  RDMA/restrack: Fix potential invalid address access
  - !10647  net: dsa: mv88e6xxx: Correct check for empty list
  - Bluetooth: L2CAP: Fix deadlock
  - bluetooth/l2cap: sync sock recv cb and release
  - !10619  fix CVE-2024-42155
  - KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
  - xfs: don't walk off the end of a directory data block
  - net: dsa: mv88e6xxx: Correct check for empty list
  - inet_diag: Initialize pad field in struct inet_diag_req_v2
  - !10558  CVE-2024-42105
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  - RDMA/restrack: Fix potential invalid address access
  - sched/deadline: Fix task_struct reference leak
  - !10602  ppp: reject claimed-as-LCP but actually malformed packets
  - !10611  wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
  - !10604  IB/core: Implement a limit on UMAD receive List
  - leds: mlxreg: Use devm_mutex_init() for mutex initialization
  - locking/mutex: Introduce devm_mutex_init()
  - s390/pkey: Wipe copies of protected- and secure-keys
  - !10553  skmsg: Skip zero length skb in sk_msg_recvmsg
  - !10537  CVE-2024-42082
  - !10595  fix CVE-2024-41046
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
  - !10570  ila: block BH in ila_output()
  - !10563  net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
  - IB/core: Implement a limit on UMAD receive List
  - ppp: reject claimed-as-LCP but actually malformed packets
  - !10587  filelock: Fix fcntl/close race recovery compat path
  - net: ethernet: lantiq_etop: fix double free in detach
  - net: lantiq_etop: add blank line after declaration
  - !10542  tap: add missing verification for short frame
  - !10535  ipv6: prevent possible NULL deref in fib6_nh_init()
  - !10550  backport serveral bugfixes from upstream
  - ax25: Fix refcount imbalance on inbound connections
  - filelock: Fix fcntl/close race recovery compat path
  - !10549  powerpc/eeh: avoid possible crash when edev->pdev changes
  - !10528  Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
  - !10421  stm class: Fix a double free in stm_register_device()
  - !10478  ALSA: emux: improve patch ioctl data validation
  - !10247  ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
  - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
  - !10543  tun: add missing verification for short frame
  - !10469 [sync] PR-10342:  CVE-2024-39471
  - ila: block BH in ila_output()
  - gpio: davinci: Validate the obtained number of IRQs
  - net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
  - nilfs2: fix inode number range checks
  - skmsg: Skip zero length skb in sk_msg_recvmsg
  - !10464  null_blk: fix validation of block size
  - bpf, events: Use prog to emit ksymbol event for main program
  - bpf, perf: Use subprog name when reporting subprog ksymbol
  - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
  - bpf: ensure main program has an extable
  - powerpc/eeh: avoid possible crash when edev->pdev changes
  - tun: add missing verification for short frame
  - tap: add missing verification for short frame
  - xdp: xdp_mem_allocator can be NULL in trace_mem_connect().
  - xdp: Remove WARN() from __xdp_reg_mem_model()
  - xdp: Allow registering memory model without rxq reference
  - xdp: Move the rxq_info.mem clearing to unreg_mem_model()
  - !10477  jffs2: Fix potential illegal address access in jffs2_free_inode
  - !10468  io_uring: fix possible deadlock in io_register_iowq_max_workers()
  - !10455  fs/ntfs3: Validate ff offset
  - ipv6: prevent possible NULL deref in fib6_nh_init()
  - ftruncate: pass a signed offset
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
  - xfs: add bounds checking to xlog_recover_process_data
  - !10461  udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
  - !10494  drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - !10488  fix CVE-2024-42086
  - !9937  media: gspca: cpia1: shift-out-of-bounds in set_flicker
  - !9930  ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
  - !9934  selinux: avoid dereference of garbage after mount failure
  - !10379  drm/radeon: fix UBSAN warning in kv_dpm.c
  - !10423  kunit: Fix kthread reference
  - !10422  kunit: Fix kthread reference
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - iio: chemical: bme680: Fix overflows in compensate() functions
  - !10362  PCI/ROM: Fix PCI ROM header check bug
  - !10459  xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
  - !10405  Fix CVE-2024-41069
  - ALSA: emux: improve patch ioctl data validation
  - jffs2: Fix potential illegal address access in jffs2_free_inode
  - !10353  fix CVE-2024-40976
  - !10272  HID: core: remove unnecessary WARN_ON() in implement()
  - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
  - drm/amdgpu: add error handle to avoid out-of-bounds
  - !10430  s390/qeth: fix deadlock during failing recovery
  - !10441  net/sched: Fix UAF when resolving a clash
  - !10447  net: ena: Add validation for completion descriptors consistency
  - !10426  net: stmmac: move the EST lock to struct stmmac_priv
  - io_uring: fix possible deadlock in io_register_iowq_max_workers()
  - null_blk: fix validation of block size
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
  - fs/ntfs3: Validate ff offset
  - net: ena: Add validation for completion descriptors consistency
  - net/sched: Fix UAF when resolving a clash
  - s390/qeth: fix deadlock during failing recovery
  - net: stmmac: move the EST lock to struct stmmac_priv
  - kunit: Fix kthread reference
  - kunit: Fix kthread reference
  - stm class: Fix a double free in stm_register_device()
  - ASoC: topology: Fix route memory corruption
  - ASoC: topology: Fix references to freed memory
  - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
  - drm/radeon: fix UBSAN warning in kv_dpm.c
  - PCI/ROM: Fix PCI ROM header check bug
  - drm/lima: mask irqs in timeout path before hard reset
  - drm/lima: add mask irq callback to gp and pp
  - HID: core: remove unnecessary WARN_ON() in implement()
  - ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker
  - selinux: avoid dereference of garbage after mount failure
  - ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
  - drm: vc4: Fix possible null pointer dereference


author: Li Nan <linan122@huawei.com> - 5.10.0-136.89.0.170
changelog:
  - !10881  orangefs: fix out-of-bounds fsid access
  - !10880  drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - !10879  drm/i915/gt: Fix potential UAF by revoke of fence registers
  - !10884  crypto: aead,cipher - zeroize key buffer after use
  - !10889  s390/pkey: Wipe copies of clear-key structures on failure
  - !10822  powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - !10844  netfilter: nf_tables: prefer nft_chain_validate
  - !10868 v2  net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
  - !10874  USB: serial: mos7840: fix crash on resume
  - s390/pkey: Wipe copies of clear-key structures on failure
  - crypto: aead,cipher - zeroize key buffer after use
  - orangefs: fix out-of-bounds fsid access
  - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - drm/i915/gt: Fix potential UAF by revoke of fence registers
  - USB: serial: mos7840: fix crash on resume
  - !10829  wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
  - !10867 [sync] PR-10817:  media: dvb-frontends: tda10048: Fix integer overflow
  - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
  - media: dvb-frontends: tda10048: Fix integer overflow
  - !10864 v3  ext4: flexibly control whether to enable dioread_nolock by default
  - !10850  wireguard: allowedips: avoid unaligned 64-bit memory accesses
  - !10617  USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  - !10830  Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
  - !10828  fix CVE-2024-42095
  - !10705  x86: stop playing stack games in profile_pc()
  - ext4: flexibly control whether to enable dioread_nolock by default
  - wireguard: allowedips: avoid unaligned 64-bit memory accesses
  - !10837  wifi: mt76: replace skb_put with skb_put_zero
  - !10840  bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - netfilter: nf_tables: prefer nft_chain_validate
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - wifi: mt76: replace skb_put with skb_put_zero
  - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
  - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
  - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
  - serial: 8250_omap: Implementation of Errata i2310
  - !10815  sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
  - !10811  tcp_metrics: validate source addr length
  - !10809  wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
  - powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - !10751  btrfs: qgroup: fix quota root leak after quota disable failure
  - sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
  - !10782  nilfs2: fix kernel bug on rename operation of broken directory
  - tcp_metrics: validate source addr length
  - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
  - !10734  filelock: Remove locks reliably when fcntl/close race is detected
  - !10804 [sync] PR-10761:  leds: an30259a: Use devm_mutex_init() for mutex initialization
  - leds: an30259a: Use devm_mutex_init() for mutex initialization
  - !10680  crypto: ecdh - explicitly zeroize private_key
  - !10791 [sync] PR-10787:  NFSD: Fix the behavior of READ near OFFSET_MAX
  - !10779  Fix CVE-2021-47582
  - !10780  crypto: hisilicon/sec - Fix memory leak for sec resource release
  - !10783  s390/pkey: Wipe sensitive data on failure
  - NFSD: Fix the behavior of READ near OFFSET_MAX
  - s390/pkey: Wipe sensitive data on failure
  - nilfs2: fix kernel bug on rename operation of broken directory
  - crypto: hisilicon/sec - Fix memory leak for sec resource release
  - usb: core: Don't hold the device lock while sleeping in do_proc_control()
  - USB: core: Make do_proc_control() and do_proc_bulk() killable
  - btrfs: qgroup: fix quota root leak after quota disable failure
  - filelock: Remove locks reliably when fcntl/close race is detected
  - x86: stop playing stack games in profile_pc()
  - crypto: ecdh - explicitly zeroize private_key
  - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor


author: dillon chen <dillon.chen@gmail.com> - 13.3-8
changelog:
  - Fix build error for loongarch64
  - Fix issue: confilct between libpq-devel and postgresql-devel
  - guess init spec from redhat
  - change redhat spec:rm private package and add files to server-devel
  - so add delete lines to Fix issue
  - Next: write oe libpq and postgresql spec by myself


author: <fengjiabo1@huawei.com> - 10:6.2.0-88
changelog:
  - ui/vnc.c: Fixed a deadlock bug.
  - hw/i386: Fix comment style in topology.h
  - migration/multifd: Remove unnecessary usage of local Error
  - linux-user: fix sockaddr_in6 endianness
  - vhost_vdpa: fix the input in trace_vhost_vdpa_listener_region_del()
  - iotests: fix 194: filter out racy postcopy-active event
  - tests/avocado: fix waiting for vm shutdown in replay_linux
  - ui/vnc: fix debug output for invalid audio message


author: <fengjiabo1@huawei.com> - 10:6.2.0-89
changelog:
  - qga-win: Fix guest-get-fsinfo multi-disks collection
  - hw/timer: fix systick trace message
  - virtio-net: correctly copy vnet header when flushing TX (CVE-2023-6693)
  - ui/clipboard: mark type as not available when there is no data (CVE-2023-6683)
  - esp: restrict non-DMA transfer length to that of available data (CVE-2024-24474)
  - hw/scsi/lsi53c895a: add missing decrement of reentrancy counter
  - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330)
  - net: Update MemReentrancyGuard for NIC (CVE-2023-3019)
  - net: Provide MemReentrancyGuard * to qemu_new_nic()


author: <fengjiabo1@huawei.com> - 10:6.2.0-90
changelog:
  - i386/cpuid: Move leaf 7 to correct group
  - i386/cpuid: Decrease cpuid_i when skipping CPUID leaf 1F
  - i386/cpu: Mask with XCR0/XSS mask for FEAT_XSAVE_XCR0_HI and FEAT_XSAVE_XSS_HI leafs
  - i386/cpu: Clear FEAT_XSAVE_XSS_LO/HI leafs when CPUID_EXT_XSAVE is not available
  - target/i386: Change wrong XFRM value in SGX CPUID leaf
  - target/i386: Enable support for XSAVES based features
  - target/i386: Add kvm_get_one_msr helper
  - hw/block/hd-geometry: Do not override specified bios-chs-trans mainline inclusion commit fd8a68ad6823d33bedeba20a22857867a1c3890e category: bugfix
  - linux-user/riscv: Align signal frame to 16 bytes mainline inclusion commit 1eaa63429a9944265c92efdb94c02fabb231f564 category: bugfix
  - ipmi:smbus: Add a check around a memcpy mainline inclusion commit 3fde641e7286f9b968bdb3b4b922c6465f2a9abc category: bugfix
  - tests/tcg/linux-test: Fix random hangs in test_socket mainline inclusion commit b9e6074fc5b429b1e956e9c60db7e284a91e0f3d category: bugfix
  - qemu-options.hx: Don't claim "-serial" has limit of 4 serial ports Before v2.12, the implementation of serial ports was limited to a value of MAX_SERIAL_PORTS = 4. We now dynamically allocate the data structures for serial ports, so this limit is no longer present, but the documentation for the -serial options still reads:
  - target/ppc: Modify the uncorrect value irq to n_IRQ
  - block-migration: Ensure we don't crash during migration cleanup
  - target/s390x: fix handling of zeroes in vfmin/vfmax mainline inclusion commit 13c59eb09bd6d1fbc13f08b708226421f14a232b category: bugfix
  - hw/virtio/virtio-iommu: Enforce power-of-two notify for both MAP and UNMAP mainline inclusion commit 0522be9a0c0094088ccef7aab352c57f483ca250 category: bugfix
  - configure: Add missing POSIX-required space mainline inclusion commit 35a7a6fc5624b1df828d82f2dfa74d0e4188b3b2 category: bugfix
  - vga: fix incorrect line height in 640x200x2 mode mainline inclusion commit 37e7b86766244b62a406747bb78e049390d0b528 category: bugfix
  - hw/ide/core: set ERR_STAT in unsupported command completion
  - linux-user/flatload.c: Fix setting of  image_info::end_code mainline inclusion commit 734a659ad264ac080457167e845ffabbaaa66d0e category: bugfix
  - load_elf: fix iterator's type for elf file processing
  - hw/misc/mps2-scc: Free MPS2SCC::oscclk[] array on finalize()
  - hw/nvram/xlnx-efuse: Free XlnxEFuse::ro_bits[] array on finalize()
  - hw/nvram/xlnx-efuse-ctrl: Free XlnxVersalEFuseCtrl[] "pg0-lock" array
  - chardev/char.c: fix "abstract device type" error message
  - block/rbd: fix handling of holes in .bdrv_co_block_status
  - qga: treat get-guest-fsinfo as "best effort" mainline inclusion commit bbb0151cf2e82489120a15df5e2eb9653312b0ec category: bugfix
  - usb/hcd-xhci: check slotid in  xhci_wakeup_endpoint() mainline inclusion commit 84218892f05515d20347fde4506e1944eb11cb25 category: bugfix
  - hw/display/bcm2835_fb: Fix framebuffer allocation  address mainline inclusion commit 5865d99fe88d8c8fa437c18c6b63fb2a8165634f category: bugfix
  - block/parallels: Fix buffer-based write call mainline inclusion commit eba088f91d21d9e42a81bef847173da30c5da961 category: bugfix
  - vl: Improve error message for conflicting -incoming and -loadvm
  - hw/smbios: Fix OEM strings table option validation


author: <fengjiabo1@huawei.com> - 10:6.2.0-91
changelog:
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/virtio: Introduce virtio_bh_new_guarded() helper
  - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded
  - checkpatch: add qemu_bh_new/aio_bh_new checks
  - async: avoid use-after-free on re-entrancy guard
  - async: Add an optional reentrancy guard to the BH API
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set(CVE-2024-3447)
  - rtl8139: Remove unused variable
  - tulip: Remove unused variable
  - virtio-mem: Fix the bitmap index of the section offset
  - virtio-mem: Fix the iterator variable in a vmem->rdl_list loop
  - system/memory: use ldn_he_p/stn_he_p
  - block: Fix crash when loading snapshot on inactive node
  - smmu: Clear SMMUPciBus pointer cache when system reset
  - block/mirror: Fix NULL s->job in active writes
  - amd_iommu: Fix APIC address check
  - virtio-crypto: fix NULL pointer dereference in virtio_crypto_free_reques
  - libqos/virtio.c: Correct 'flags' reading in qvirtqueue_kick
  - ivshmem-test.c: enable test_ivshmem_server for ppc64 arch
  - ivshmem.c: change endianness to LITTLE_ENDIAN
  - hw/ppc/mac.h: Remove MAX_CPUS macro
  - configure: remove dead variables
  - virtio-gpu: do not byteswap padding
  - hw/intc: clean-up error reporting for failed ITS cmd
  - qemu-iotests: Discard stderr when probing devices
  - linux-user: un-parent OBJECT(cpu) when closing thread
  - hw/net/rocker: Avoid undefined shifts with more than 31 ports
  - contrib/vhost-user-blk: Clean up deallocation of VuVirtqElement
  - scsi-disk: fix overflow when block size is not a multiple of BDRV_SECTOR_SIZE


author: <fengjiabo1@huawei.com> - 10:6.2.0-92
changelog:
  - s390x/sclp: Simplify get_sclp_device() 
  - target/ppc: Remove msr_pr macro
  - docs/system/target-arm: Re-alphabetize board list
  - migration: Extend query-migrate to provide dirty page limit info
  - migration: Implement dirty-limit convergence algo
  - migration: Put the detection logic before auto-converge checking
  - migration: Refactor auto-converge capability logic
  - migration: Introduce dirty-limit capability
  - qapi/migration: Introduce vcpu-dirty-limit parameters
  - qapi/migration: Introduce x-vcpu-dirty-limit-period parameter
  - Change the value of no_ged from true to false
  - Allow UNIX socket option for VNC websocket
  - tpm_emulator: Avoid double initialization during
  - chardev/char-socket: Update AF_UNIX for Windows
  - KVM: dirty ring: add missing memory barrier
  - i386: reset KVM nested state upon CPU reset
  - esp: Handle CMD_BUSRESET by resetting the SCSI bus
  - dbus-vmstate: Restrict error checks to registered proxies in dbus_get_proxies
  - vfio/pci: Add Ascend310b scend910b support
  - target/i386: Export RFDS bit to guests
  - target/i386: Add new CPU model SierraForest
  - target/i386: Introduce Icelake-Server-v7 to enable TSX
  - hw/virtio: handle un-configured shutdown in virtio-pci
  - target/s390x: display deprecation status in '-cpu  help'
  - target/i386: display deprecation status in '-cpu  help'
  - pc-bios/s390-ccw: Fix booting with logical block size < physical block size


author: <fengjiabo1@huawei.com> - 10:6.2.0-93
changelog:
  - cvm: bug-fix for macro isolation
  - tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fix CVE-2023-5088)
  - hw/ide: reset: cancel async DMA operation before resetting state (Fix CVE-2023-5088)
  - Add support for the virtcca cvm feature.


author: <fengjiabo1@huawei.com> - 10:6.2.0-96
changelog:
  - vdpa: Fix bug where vdpa appliance migration does not resume after rollback
  - block: Parse filenames only when explicitly requested (CVE-2024-4467)
  - block: introduce bdrv_open_file_child() helper
  - iotests/270: Don't store data-file with json: prefix in image (CVE-2024-4467)
  - iotests/244: Don't store data-file with protocol in image (CVE-2024-4467)
  - qcow2: Don't open data_file with BDRV_O_NO_IO (CVE-2024-4467)
  - qcow2: Do not reopen data_file in invalidate_cache
  - hw/intc/arm_gic: Fix deactivation of SPI lines chery-pick from 7175a562f157d39725ab396e39c1e8e410d206b3
  - vhost-user: Skip unnecessary duplicated VHOST_USER_SET_LOG_BASE requests
  - target/ppc: Split off common embedded TLB init cheery-pick from 581eea5d656b73c6532109f4ced4c73fd4e5fd47`
  - vdpa: fix vdpa device migrate rollback wrong when suspend device failed 1. 
  - hw/virtio/virtio-pci:Support shadow device for virtio-net/blk/scsi devices


author: <fengjiabo1@huawei.com> - 10:6.2.0-97
changelog:
  - nbd/server: CVE-2024-7409: Close stray clients at server-stop
  - main-loop.h: introduce qemu_in_main_thread()
  - aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED
  - nbd/server: CVE-2024-7409: Drop non-negotiating clients
  - nbd/server: CVE-2024-7409: Cap default max-connections to 100
  - nbd/server: Plumb in new args to nbd_client_add()
  - nbd: Minor style and typo fixes


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-16
changelog:
  - Type:CVE
  - ID:CVE-2023-4736 CVE-2023-4733 CVE-2023-4734 CVE-2023-4735
  - SUG:NA
  - DESC:fix CVE-2023-4736 CVE-2023-4733 CVE-2023-4734 CVE-2023-4735


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-17
changelog:
  - Type:CVE
  - ID:CVE-2023-4738 CVE-2023-4750 CVE-2023-4752 CVE-2023-4781
  - SUG:NA
  - DESC:fix CVE-2023-4738 CVE-2023-4750 CVE-2023-4752 CVE-2023-4781


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-22
changelog:
  - Type:CVE
  - ID:CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237
  - SUG:NA
  - DESC:fix CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237


