# changelog

author: herengui <herengui@kylinsec.com.cn> - 4.14.0-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:dnf:remove useless patch of loongarch64
         dnf:recreate patch of sw64 and make arch sorted alphabetically


author: chenhaixing <chenhaixing@huawei.com> - 4.14.0-18
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:dnf:Fix bash completion due to sqlite changes
             When parsing over a KVP list, do not return till the whole list is parsed


author: hanhuihui <hanhuihui5@huawei.com> - 4.14.0-19
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:dnf:Remove --duplicates and --oldinstallonly exit with 0 when nothing to remove and Add all candidates for reinstall to solver


author: LuWu <2398491106@qq.com> - 4.14.0-20
changelog:
  - Limit queries to nevra forms when provided by command and Update the man page entry for the countme option


author: Li Nan <linan122@huawei.com> - 5.10.0-136.86.0.167
changelog:
  - !10283 v2  CVE-2022-48816
  - !9781  ksmbd: fix wrong DataOffset validation of create context
  - !10301 v2  usb-storage: alauda: Check whether the media is initialized
  - !10297  CVE-2023-52679
  - usb-storage: alauda: Check whether the media is initialized
  - !10263  media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
  - of: unittest: Fix compile in the non-dynamic case
  - of: unittest: Fix of_count_phandle_with_args() expected value message
  - of: Fix double free in of_parse_phandle_with_args_map
  - !10225  scsi: ufs: Fix a deadlock in the error handler
  - SUNRPC: Do not dereference non-socket transports in sysfs
  - SUNRPC: lock against ->sock changing during sysfs read
  - !10244  Bluetooth: hci_core: Fix leaking sent_cmd skb
  - !10230  ima: Fix use-after-free on a dentry's dname.name
  - !10235  ima: Avoid blocking in RCU read-side critical section
  - !10234  fix CVE-2024-41007
  - !10201  net: dsa: seville: register the mdiobus under devres
  - !10267  USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - !10256  dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
  - media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
  - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
  - Bluetooth: hci_core: Fix leaking sent_cmd skb
  - !9918  powerpc/pseries: Enforce hcall result buffer validity and size
  - !10223  CVE-2024-35931
  - !10085  nfs: Ensure that the NFS client returns a correct writeback error code
  - ima: Avoid blocking in RCU read-side critical section
  - tcp: avoid too many retransmit packets
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
  - net: tcp: fix unexcepted socket die when snd_wnd is 0
  - !10181 [sync] PR-9836:  fpga: manager: add owner module and take its refcount
  - !10221  bpf: Fix overrunning reservations in ringbuf
  - ima: Fix use-after-free on a dentry's dname.name
  - !10200  dma-mapping: benchmark: fix node id validation
  - !10209  drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
  - !10020  drm/exynos/vidi: fix memory leak in .get_modes()
  - scsi: ufs: Fix a deadlock in the error handler
  - drm/amdgpu: Fix kabi breakage in struct amdgpu_hive_info
  - drm/amdgpu: Skip do PCI error slot reset during RAS recovery
  - drm/amdgpu : Add hive ras recovery check
  - bpf: Fix overrunning reservations in ringbuf
  - drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
  - !10136  ALSA: timer: Set lower bound of start tick time
  - !10105  ecryptfs: Fix buffer size for tag 66 packet
  - net: dsa: seville: register the mdiobus under devres
  - dma-mapping: benchmark: fix node id validation
  - !10140 [sync] PR-10095:  CVE-2024-40968
  - !10108  tracing: Build event generation tests only as modules
  - !10157 v2  wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - !10008  xfs: fix mount hung while sb recover fail
  - fpga: manager: add owner module and take its refcount
  - !10164  drop_monitor: replace spin_lock by raw_spin_lock
  - !10163  RDMA/mlx5: Add check for srq max_sge attribute
  - !10049  tipc: force a dst refcount before doing decryption
  - !10023  liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - drop_monitor: replace spin_lock by raw_spin_lock
  - RDMA/mlx5: Add check for srq max_sge attribute
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - !10042  Fix CVE-2024-36939
  - MIPS: Octeon: Add PCIe link status check
  - !10129  wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - ALSA: timer: Set lower bound of start tick time
  - !10119  wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - !10080  drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - !10053  vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - !10089  fix CVE-2024-40995
  - !9993  io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - !9902  ipv6: fix possible race in __fib6_drop_pcpu_from()
  - !10098 [sync] PR-9741:  scsi: qedf: Ensure the copied buf is NUL terminated
  - !9932  nvdimm: Backport some bugfixs
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - tracing: Build event generation tests only as modules
  - ecryptfs: Fix buffer size for tag 66 packet
  - scsi: qedf: Ensure the copied buf is NUL terminated
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
  - net/sched: act_api: rely on rcu in tcf_idr_check_alloc
  - nfs: Ensure write and flush consume writeback errors
  - NFS: Don't report ENOSPC write errors twice
  - NFS: Use of mapping_set_error() results in spurious errors
  - nfs: ensure correct writeback errors are returned on close()
  - nfs: nfs_file_write() should check for writeback errors
  - drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - tipc: force a dst refcount before doing decryption
  - sunrpc: fix KABI broken in struct rpc_create_args
  - nfs: Handle error of rpc_proc_register() in nfs_net_init().
  - nfs: make the rpc_stat per net namespace
  - nfs: expose /proc/net/sunrpc/nfs in net namespaces
  - sunrpc: add a struct rpc_stats arg to rpc_create_args
  - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - drm/exynos/vidi: fix memory leak in .get_modes()
  - xfs: fix mount hung while sb recover fail
  - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - dax: alloc_dax() return ERR_PTR(-EOPNOTSUPP) for CONFIG_DAX=n
  - nvdimm/pmem: use add_disk() error handling
  - powerpc/pseries: Enforce hcall result buffer validity and size
  - ipv6: fix possible race in __fib6_drop_pcpu_from()
  - ksmbd: fix wrong DataOffset validation of create context


author: Li Nan <linan122@huawei.com> - 5.10.0-136.87.0.168
changelog:
  - !10435  md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING
  - !8942 [sync] PR-8468: v2  CVE-2024-35808
  - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING
  - !10067  iommu: Return right value in iommu_sva_bind_device()
  - !10335  fix CVE-2024-36479 for sp1
  - !10365  drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
  - !10213  net: mvpp2: clear BM pool before initialization
  - !10212  udp: do not accept non-tunnel GSO skbs landing in a tunnel
  - !10396  BMA: Fix DMA reset problem and change the version number
  - !10343  fix CVE-2024-27010
  - BMA/kbox_drv: Change the version number.
  - BMA/veth_drv: Change the version number.
  - BMA/cdev_drv: Change the version number.
  - BMA/edma_drv: Fix DMA reset problem and change the version number.
  - !10367 v2  jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
  - !10322  media: i2c: et8ek8: Don't strip remove function when driver is builtin
  - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
  - drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
  - net/sched: initialize noop_qdisc owner
  - net/sched: fix kabi change in struct Qdisc
  - net/sched: Fix mirred deadlock on device recursion
  - fpga: bridge: add owner module and take its refcount
  - fpga: remove redundant checks for bridge ops
  - fpga: bridge: properly initialize bridge device before populating children
  - fpga: bridge: Use standard dev_release for class driver
  - fpga: bridge: Rename dev to parent for parent device
  - !9369  macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
  - media: i2c: et8ek8: Don't strip remove function when driver is builtin
  - !10072  serial: imx: Introduce timeout when waiting on transmitter empty
  - !9975  KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
  - !10314 [sync] PR-10187:  fix CVE-2021-47205
  - !10313 [sync] PR-10189:  fix CVE-2024-40915
  - !10252  fbdev: savage: Handle err return when savagefb_check_var failed
  - !10308  net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr
  - !10259  batman-adv: bypass empty buckets in batadv_purge_orig_ref()
  - clk: sunxi-ng: Unregister clocks/resets when unbinding
  - riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context
  - net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr
  - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
  - fbdev: savage: Handle err return when savagefb_check_var failed
  - net: mvpp2: clear BM pool before initialization
  - udp: do not accept non-tunnel GSO skbs landing in a tunnel
  - serial: imx: Introduce timeout when waiting on transmitter empty
  - iommu: Return right value in iommu_sva_bind_device()
  - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
  - macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
  - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen
  - md/dm-raid: don't call md_reap_sync_thread() directly


author: Li Nan <linan122@huawei.com> - 5.10.0-136.88.0.169
changelog:
  - !10769  CVE-2024-41027
  - !10667 v2  ASoC: fsl-asoc-card: set priv->pdev before using it
  - !10724  scsi: qedf: Make qedf_execute_tmf() non-preemptible
  - Fix userfaultfd_api to return EINVAL as expected
  - mm/userfaultfd: fail uffd-wp registration if not supported
  - !10738  net/dpaa2: Avoid explicit cpumask var allocation on stack
  - !10744  media: mediatek: vcodec: Only free buffer VA that is not NULL
  - !10758  Fix CVE-2024-42160
  - !10531  ftruncate: pass a signed offset
  - f2fs: Add inline to f2fs_build_fault_attr() stub
  - f2fs: check validation of fault attrs in f2fs_build_fault_attr()
  - !10581 v2  bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
  - !10718  CVE-2024-42101
  - !10712  CVE-2024-41079
  - media: mediatek: vcodec: Only free buffer VA that is not NULL
  - !10728  net/iucv: Avoid explicit cpumask var allocation on stack
  - !10696 v2  drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
  - !10719  gve: Account for stopped queues when reading NIC stats
  - net/dpaa2: Avoid explicit cpumask var allocation on stack
  - !10620  fix CVE-2024-42129
  - !9680  drm: vc4: Fix possible null pointer dereference
  - !10671 [sync] PR-10598:  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  - net/iucv: Avoid explicit cpumask var allocation on stack
  - scsi: qedf: Make qedf_execute_tmf() non-preemptible
  - gve: Account for stopped queues when reading NIC stats
  - !10588 v2  ax25: Fix refcount imbalance on inbound connections
  - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
  - nvmet: always initialize cqe.result
  - !10682  ocfs2: fix DIO failure due to insufficient transaction credits
  - !10567  gpio: davinci: Validate the obtained number of IRQs
  - !10669  fix CVE-2024-42076
  - !10662  fix CVE-2024-41062
  - !10651  xfs: don't walk off the end of a directory data block
  - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
  - !10655  KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
  - !10632  sched/deadline: Fix task_struct reference leak
  - !10520  xfs: add bounds checking to xlog_recover_process_data
  - ocfs2: fix DIO failure due to insufficient transaction credits
  - !10390  pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  - net: can: j1939: Initialize unused data in j1939_send_one()
  - can: j1939: j1939_send_one(): fix missing CAN header initialization
  - ASoC: fsl-asoc-card: set priv->pdev before using it
  - !10638  usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  - !10645  inet_diag: Initialize pad field in struct inet_diag_req_v2
  - !10637  RDMA/restrack: Fix potential invalid address access
  - !10647  net: dsa: mv88e6xxx: Correct check for empty list
  - Bluetooth: L2CAP: Fix deadlock
  - bluetooth/l2cap: sync sock recv cb and release
  - !10619  fix CVE-2024-42155
  - KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
  - xfs: don't walk off the end of a directory data block
  - net: dsa: mv88e6xxx: Correct check for empty list
  - inet_diag: Initialize pad field in struct inet_diag_req_v2
  - !10558  CVE-2024-42105
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  - RDMA/restrack: Fix potential invalid address access
  - sched/deadline: Fix task_struct reference leak
  - !10602  ppp: reject claimed-as-LCP but actually malformed packets
  - !10611  wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
  - !10604  IB/core: Implement a limit on UMAD receive List
  - leds: mlxreg: Use devm_mutex_init() for mutex initialization
  - locking/mutex: Introduce devm_mutex_init()
  - s390/pkey: Wipe copies of protected- and secure-keys
  - !10553  skmsg: Skip zero length skb in sk_msg_recvmsg
  - !10537  CVE-2024-42082
  - !10595  fix CVE-2024-41046
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
  - !10570  ila: block BH in ila_output()
  - !10563  net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
  - IB/core: Implement a limit on UMAD receive List
  - ppp: reject claimed-as-LCP but actually malformed packets
  - !10587  filelock: Fix fcntl/close race recovery compat path
  - net: ethernet: lantiq_etop: fix double free in detach
  - net: lantiq_etop: add blank line after declaration
  - !10542  tap: add missing verification for short frame
  - !10535  ipv6: prevent possible NULL deref in fib6_nh_init()
  - !10550  backport serveral bugfixes from upstream
  - ax25: Fix refcount imbalance on inbound connections
  - filelock: Fix fcntl/close race recovery compat path
  - !10549  powerpc/eeh: avoid possible crash when edev->pdev changes
  - !10528  Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
  - !10421  stm class: Fix a double free in stm_register_device()
  - !10478  ALSA: emux: improve patch ioctl data validation
  - !10247  ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
  - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
  - !10543  tun: add missing verification for short frame
  - !10469 [sync] PR-10342:  CVE-2024-39471
  - ila: block BH in ila_output()
  - gpio: davinci: Validate the obtained number of IRQs
  - net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
  - nilfs2: fix inode number range checks
  - skmsg: Skip zero length skb in sk_msg_recvmsg
  - !10464  null_blk: fix validation of block size
  - bpf, events: Use prog to emit ksymbol event for main program
  - bpf, perf: Use subprog name when reporting subprog ksymbol
  - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
  - bpf: ensure main program has an extable
  - powerpc/eeh: avoid possible crash when edev->pdev changes
  - tun: add missing verification for short frame
  - tap: add missing verification for short frame
  - xdp: xdp_mem_allocator can be NULL in trace_mem_connect().
  - xdp: Remove WARN() from __xdp_reg_mem_model()
  - xdp: Allow registering memory model without rxq reference
  - xdp: Move the rxq_info.mem clearing to unreg_mem_model()
  - !10477  jffs2: Fix potential illegal address access in jffs2_free_inode
  - !10468  io_uring: fix possible deadlock in io_register_iowq_max_workers()
  - !10455  fs/ntfs3: Validate ff offset
  - ipv6: prevent possible NULL deref in fib6_nh_init()
  - ftruncate: pass a signed offset
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
  - xfs: add bounds checking to xlog_recover_process_data
  - !10461  udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
  - !10494  drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - !10488  fix CVE-2024-42086
  - !9937  media: gspca: cpia1: shift-out-of-bounds in set_flicker
  - !9930  ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
  - !9934  selinux: avoid dereference of garbage after mount failure
  - !10379  drm/radeon: fix UBSAN warning in kv_dpm.c
  - !10423  kunit: Fix kthread reference
  - !10422  kunit: Fix kthread reference
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - iio: chemical: bme680: Fix overflows in compensate() functions
  - !10362  PCI/ROM: Fix PCI ROM header check bug
  - !10459  xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
  - !10405  Fix CVE-2024-41069
  - ALSA: emux: improve patch ioctl data validation
  - jffs2: Fix potential illegal address access in jffs2_free_inode
  - !10353  fix CVE-2024-40976
  - !10272  HID: core: remove unnecessary WARN_ON() in implement()
  - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
  - drm/amdgpu: add error handle to avoid out-of-bounds
  - !10430  s390/qeth: fix deadlock during failing recovery
  - !10441  net/sched: Fix UAF when resolving a clash
  - !10447  net: ena: Add validation for completion descriptors consistency
  - !10426  net: stmmac: move the EST lock to struct stmmac_priv
  - io_uring: fix possible deadlock in io_register_iowq_max_workers()
  - null_blk: fix validation of block size
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
  - fs/ntfs3: Validate ff offset
  - net: ena: Add validation for completion descriptors consistency
  - net/sched: Fix UAF when resolving a clash
  - s390/qeth: fix deadlock during failing recovery
  - net: stmmac: move the EST lock to struct stmmac_priv
  - kunit: Fix kthread reference
  - kunit: Fix kthread reference
  - stm class: Fix a double free in stm_register_device()
  - ASoC: topology: Fix route memory corruption
  - ASoC: topology: Fix references to freed memory
  - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
  - drm/radeon: fix UBSAN warning in kv_dpm.c
  - PCI/ROM: Fix PCI ROM header check bug
  - drm/lima: mask irqs in timeout path before hard reset
  - drm/lima: add mask irq callback to gp and pp
  - HID: core: remove unnecessary WARN_ON() in implement()
  - ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker
  - selinux: avoid dereference of garbage after mount failure
  - ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
  - drm: vc4: Fix possible null pointer dereference


author: Li Nan <linan122@huawei.com> - 5.10.0-136.89.0.170
changelog:
  - !10881  orangefs: fix out-of-bounds fsid access
  - !10880  drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - !10879  drm/i915/gt: Fix potential UAF by revoke of fence registers
  - !10884  crypto: aead,cipher - zeroize key buffer after use
  - !10889  s390/pkey: Wipe copies of clear-key structures on failure
  - !10822  powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - !10844  netfilter: nf_tables: prefer nft_chain_validate
  - !10868 v2  net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
  - !10874  USB: serial: mos7840: fix crash on resume
  - s390/pkey: Wipe copies of clear-key structures on failure
  - crypto: aead,cipher - zeroize key buffer after use
  - orangefs: fix out-of-bounds fsid access
  - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - drm/i915/gt: Fix potential UAF by revoke of fence registers
  - USB: serial: mos7840: fix crash on resume
  - !10829  wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
  - !10867 [sync] PR-10817:  media: dvb-frontends: tda10048: Fix integer overflow
  - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
  - media: dvb-frontends: tda10048: Fix integer overflow
  - !10864 v3  ext4: flexibly control whether to enable dioread_nolock by default
  - !10850  wireguard: allowedips: avoid unaligned 64-bit memory accesses
  - !10617  USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  - !10830  Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
  - !10828  fix CVE-2024-42095
  - !10705  x86: stop playing stack games in profile_pc()
  - ext4: flexibly control whether to enable dioread_nolock by default
  - wireguard: allowedips: avoid unaligned 64-bit memory accesses
  - !10837  wifi: mt76: replace skb_put with skb_put_zero
  - !10840  bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - netfilter: nf_tables: prefer nft_chain_validate
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - wifi: mt76: replace skb_put with skb_put_zero
  - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
  - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
  - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
  - serial: 8250_omap: Implementation of Errata i2310
  - !10815  sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
  - !10811  tcp_metrics: validate source addr length
  - !10809  wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
  - powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - !10751  btrfs: qgroup: fix quota root leak after quota disable failure
  - sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
  - !10782  nilfs2: fix kernel bug on rename operation of broken directory
  - tcp_metrics: validate source addr length
  - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
  - !10734  filelock: Remove locks reliably when fcntl/close race is detected
  - !10804 [sync] PR-10761:  leds: an30259a: Use devm_mutex_init() for mutex initialization
  - leds: an30259a: Use devm_mutex_init() for mutex initialization
  - !10680  crypto: ecdh - explicitly zeroize private_key
  - !10791 [sync] PR-10787:  NFSD: Fix the behavior of READ near OFFSET_MAX
  - !10779  Fix CVE-2021-47582
  - !10780  crypto: hisilicon/sec - Fix memory leak for sec resource release
  - !10783  s390/pkey: Wipe sensitive data on failure
  - NFSD: Fix the behavior of READ near OFFSET_MAX
  - s390/pkey: Wipe sensitive data on failure
  - nilfs2: fix kernel bug on rename operation of broken directory
  - crypto: hisilicon/sec - Fix memory leak for sec resource release
  - usb: core: Don't hold the device lock while sleeping in do_proc_control()
  - USB: core: Make do_proc_control() and do_proc_bulk() killable
  - btrfs: qgroup: fix quota root leak after quota disable failure
  - filelock: Remove locks reliably when fcntl/close race is detected
  - x86: stop playing stack games in profile_pc()
  - crypto: ecdh - explicitly zeroize private_key
  - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor


author: Li Nan <linan122@huawei.com> - 5.10.0-136.90.0.171
changelog:
  - !10981 [sync] PR-10679:  ibmvnic: Add tx check to prevent skb leak
  - !11009  mm: avoid overflows in dirty throttling logic
  - !10980  CVE-2024-42304
  - mm: avoid overflows in dirty throttling logic
  - !10983  drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
  - !10938  CVE-2023-52868
  - !10959  bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
  - !10613  can: mcp251xfd: fix infinite loop when xmit fails
  - !10952  Fix CVE-2024-36880
  - !10790 [sync] PR-10652:  nvme: avoid double free special payload
  - !10789 [sync] PR-10624:  ata: libata-core: Fix double free on error
  - drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
  - ibmvnic: Add tx check to prevent skb leak
  - ext4: make sure the first directory block is not a hole
  - ext4: check dot and dotdot of dx_root before making dir indexed
  - !10955  leds: trigger: Unregister sysfs attributes before calling deactivate()
  - !10866 [sync] PR-10514:  powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
  - !10932  drm/lima: fix shared irq handling on driver remove
  - !10948  net: nexthop: Initialize all fields in dumped nexthops
  - bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
  - leds: trigger: Unregister sysfs attributes before calling deactivate()
  - Bluetooth: qca: fix firmware check error path
  - Bluetooth: qca: add missing firmware sanity checks
  - net: nexthop: Initialize all fields in dumped nexthops
  - !10929  libceph: fix race between delayed_work() and ceph_monc_stop()
  - thermal: core: prevent potential string overflow
  - drm/lima: fix shared irq handling on driver remove
  - !10747  jfs: xattr: fix buffer overflow for invalid xattr
  - libceph: fix race between delayed_work() and ceph_monc_stop()
  - !10917  Fix CVE-2024-36031
  - !10910  Fix CVE-2024-40966
  - keys: Fix overwrite of key expiration on instantiation
  - keys, dns: Fix size check of V1 server-list header
  - keys, dns: Fix missing size check of V1 server-list header
  - keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry
  - !10916  usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
  - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
  - tty: vt device use only n_tty ldisc
  - tty: add the option to have a tty reject a new ldisc
  - !10848  netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
  - powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
  - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
  - nvme: avoid double free special payload
  - ata: libata-core: Fix double free on error
  - jfs: xattr: fix buffer overflow for invalid xattr
  - can: mcp251xfd: fix infinite loop when xmit fails


author: Li Nan <linan122@huawei.com> - 5.10.0-136.91.0.172
changelog:
  - !11162  btrfs: get rid of warning on transaction commit when using flushoncommit
  - !11152  protect the fetch of ->fd[fd
  - !11096  usb: xhci: Check endpoint is valid before dereferencing it
  - !11093  mISDN: Fix a use after free in hfcmulti_tx()
  - !11146  drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer
  - btrfs: get rid of warning on transaction commit when using flushoncommit
  - !11082  f2fs: fix to don't dirty inode for readonly filesystem
  - !11097  io_uring: lock overflowing for IOPOLL
  - !11124  Fix CVE-2023-52893
  - !11139 v2  drm/amd/display: Check for NULL pointer
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions
  - !11098  exec: Fix ToCToU between perm check and set-uid/gid usage
  - !11029  remoteproc: imx_rproc: Skip over memory region when node value is NULL
  - drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer
  - !11076  wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
  - !11080  ixgbe: fix pci device refcount leak
  - !11002  tipc: Return non-zero value from tipc_udp_addr2str() on error
  - !10986  RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
  - !11137  netfilter: nf_tables: unregister flowtable hooks on netns exit
  - !11116  net/iucv: fix use after free in iucv_sock_close()
  - drm/amd/display: Check for NULL pointer
  - !11053  m68k: Fix spinlock race in kernel thread creation
  - !11052  phonet: fix rtm_phonet_notify() skb allocation
  - !11127  drm/amd/display: Check pipe offset before setting vblank
  - !11120  misc: fastrpc: Don't remove map on creater_process and device_release
  - netfilter: nf_tables: unregister flowtable hooks on netns exit
  - drm/amd/display: Check pipe offset before setting vblank
  - gsmi: fix null-deref in gsmi_get_variable
  - !11090  net/mlx5: Always drain health in shutdown callback
  - misc: fastrpc: Don't remove map on creater_process and device_release
  - net/iucv: fix use after free in iucv_sock_close()
  - exec: Fix ToCToU between perm check and set-uid/gid usage
  - io_uring: lock overflowing for IOPOLL
  - usb: xhci: Check endpoint is valid before dereferencing it
  - mISDN: Fix a use after free in hfcmulti_tx()
  - !11066  xhci: Fix null pointer dereference when host dies
  - net/mlx5: Always drain health in shutdown callback
  - f2fs: fix to don't dirty inode for readonly filesystem
  - ixgbe: fix pci device refcount leak
  - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
  - !11073  drm/virtio: Fix GEM handle creation UAF
  - drm/virtio: Fix GEM handle creation UAF
  - !11046  bpf: Fix a segment issue when downgrading gso_size
  - !11039  PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()
  - xhci: Fix null pointer dereference when host dies
  - !11016 [sync] PR-10965:  perf: Optimize perf_pmu_migrate_context()
  - m68k: Fix spinlock race in kernel thread creation
  - phonet: fix rtm_phonet_notify() skb allocation
  - !11000  media: venus: fix use after free in vdec_close
  - !11024  drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
  - !11014  media: mediatek: vcodec: Handle invalid decoder vsi
  - !10972  ext4: fix infinite loop when replaying fast_commit
  - bpf: Fix a segment issue when downgrading gso_size
  - !11031 [sync] PR-11006:  kvm: s390: Reject memory region operations for ucontrol VMs
  - !10994  ipvs: properly dereference pe in ip_vs_add_service
  - PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()
  - !11032 [sync] PR-10976:  CVE-2024-42126
  - !10967  Revert "kbuild: fix false positive warning/error about missing libelf"
  - powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
  - Revert "powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt."
  - !10989  drm/amd/display: Add NULL pointer check for kzalloc
  - !11020  net: usb: qmi_wwan: fix memory leak for not ip packets
  - kvm: s390: Reject memory region operations for ucontrol VMs
  - !10988  s390/sclp: Fix sclp_init() cleanup on failure
  - remoteproc: imx_rproc: Skip over memory region when node value is NULL
  - !10961  drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
  - !10452 v2  ipv6: sr: fix missing sk_buff release in seg6_input_core
  - drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
  - net: usb: qmi_wwan: fix memory leak for not ip packets
  - !10996  CVE-2024-42290
  - perf: Optimize perf_pmu_migrate_context()
  - media: mediatek: vcodec: Handle invalid decoder vsi
  - tipc: Return non-zero value from tipc_udp_addr2str() on error
  - media: venus: fix use after free in vdec_close
  - irqchip/imx-irqsteer: Handle runtime power management correctly
  - ipvs: properly dereference pe in ip_vs_add_service
  - drm/amd/display: Add NULL pointer check for kzalloc
  - s390/sclp: Fix sclp_init() cleanup on failure
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
  - ext4: fix infinite loop when replaying fast_commit
  - Revert "kbuild: fix false positive warning/error about missing libelf"
  - drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
  - ipv6: sr: fix missing sk_buff release in seg6_input_core


author: Li Nan <linan122@huawei.com> - 5.10.0-136.92.0.173
changelog:
  - !11373  xdp: fix invalid wait context of page_pool_destroy()
  - !11369  nilfs2: handle inconsistent state in nilfs_btnode_create_block()
  - !11362  kcm: Serialise kcm_sendmsg() for the same socket.
  - !11353  regulator: da9211: Use irq handler when ready
  - !11348 v2  ext4: sanity check for NULL pointer after ext4_force_shutdown
  - !11318  efi: fix NULL-deref in init error path
  - !10997  PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
  - !11285  fix CVE-2024-43905
  - !11344  netfilter: ctnetlink: use helper function to calculate expect ID
  - !11332  jbd2: avoid mount failed when commit block is partial submitted
  - !11191  fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
  - !11200  ibmvnic: don't release napi in __ibmvnic_open()
  - !10750 v2  CVE-2024-41016
  - !11195  tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  - !11296  padata: Fix possible divide-by-0 panic in padata_mt_helper()
  - !11289  Add exception protection processing for vd in axi_chan_handle_err function
  - !11312  nvme-fabrics: use reserved tag for reg read/write command
  - !11311  drm/radeon: check bo_va->bo is non-NULL before using it
  - xdp: fix invalid wait context of page_pool_destroy()
  - nilfs2: handle inconsistent state in nilfs_btnode_create_block()
  - kcm: Serialise kcm_sendmsg() for the same socket.
  - regulator: da9211: Use irq handler when ready
  - ext4: sanity check for NULL pointer after ext4_force_shutdown
  - netfilter: ctnetlink: use helper function to calculate expect ID
  - jbd2: avoid mount failed when commit block is partial submitted
  - efi: fix NULL-deref in init error path
  - nvme-fabrics: use reserved tag for reg read/write command
  - drm/radeon: check bo_va->bo is non-NULL before using it
  - !11059  drm/amdgpu: change vm->task_info handling
  - !11056  scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
  - !11281  misc: fastrpc: Fix use-after-free race condition for maps
  - padata: Fix possible divide-by-0 panic in padata_mt_helper()
  - Add exception protection processing for vd in axi_chan_handle_err function
  - !11278  net/sched: act_mpls: Fix warning during failed attribute validation
  - drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
  - !11225  apparmor: Fix null pointer deref when receiving skb during sock creation
  - misc: fastrpc: Fix use-after-free race condition for maps
  - !11274  serial: core: check uartclk for zero to avoid divide by zero
  - !11101  wifi: mac80211: sdata can be NULL during AMPDU start
  - net/sched: act_mpls: Fix warning during failed attribute validation
  - !11213  drm/amdgpu: Fix the null pointer dereference to ras_manager
  - !11268  net: bridge: mcast: wait for previous gc cycles when removing port
  - serial: core: check uartclk for zero to avoid divide by zero
  - net: bridge: mcast: wait for previous gc cycles when removing port
  - !11244 [sync] PR-11210:  jfs: Fix shift-out-of-bounds in dbDiscardAG
  - !11253  CVE-2024-43892
  - !11218  scsi: qla2xxx: validate nvme_local_port correctly
  - !11180  block: initialize integrity buffer to zero before writing it to media
  - !11112  sysctl: always initialize i_uid/i_gid
  - !11166  f2fs: let's avoid panic if extent_tree is not created
  - !11153  fix cve-2023-52896
  - !11165  tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
  - memcg: protect concurrent access to mem_cgroup_idr
  - !11232  Bluetooth: MGMT: Add error handling to pair_device()
  - jfs: Fix shift-out-of-bounds in dbDiscardAG
  - !11172  tracing: Fix overflow in get_free_elt()
  - !11212 [sync] PR-11123:  fix CVE-2024-42288
  - Bluetooth: MGMT: Add error handling to pair_device()
  - apparmor: Fix null pointer deref when receiving skb during sock creation
  - scsi: qla2xxx: validate nvme_local_port correctly
  - !11161  usb: vhci-hcd: Do not drop references before new references are gained
  - drm/amdgpu: Fix the null pointer dereference to ras_manager
  - scsi: qla2xxx: Fix for possible memory corruption
  - !11148  powerpc/pseries: Fix scv instruction crash with kexec
  - !11141  i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
  - ibmvnic: don't release napi in __ibmvnic_open()
  - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  - fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
  - block: initialize integrity buffer to zero before writing it to media
  - tracing: Fix overflow in get_free_elt()
  - f2fs: let's avoid panic if extent_tree is not created
  - tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
  - usb: vhci-hcd: Do not drop references before new references are gained
  - btrfs: fix race between quota rescan and disable leading to NULL pointer deref
  - btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker
  - powerpc/pseries: Fix scv instruction crash with kexec
  - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
  - sysctl: always initialize i_uid/i_gid
  - wifi: mac80211: sdata can be NULL during AMPDU start
  - drm/amdgpu: change vm->task_info handling
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
  - PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
  - ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
  - ocfs2: add bounds checking to ocfs2_xattr_find_entry()


author: Li Nan <linan122@huawei.com> - 5.10.0-136.93.0.174
changelog:
  - !10941 v2  xfs: fix file creation
  - !11492  Fix CVE-2022-48887
  - !11471  net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
  - drm/vmwgfx: Remove rcu locks from user resources
  - drm/vmwgfx: Remove vmw_user_bo_noref_release
  - drm/vmwgfx: Introduce ttm reference object find function
  - net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
  - !11103  soc: qcom: pdr: protect locator_addr with the main mutex
  - !11446  zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
  - !11392  fix CVE-2023-45896
  - !11445 [sync] PR-11015:  nvme-pci: add missing condition check for existence of mapped data
  - !11283  CVE-2024-44935
  - !11451 [sync] PR-11390:  hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
  - !11442 v2  drm/amd/display: Fix null pointer deref in dcn20_resource.c
  - nvme-pci: add missing condition check for existence of mapped data
  - drm/amd/display: Fix null pointer deref in dcn20_resource.c
  - !11396 [sync] PR-11324:  drm/amd/display: Add null checker before passing variables
  - !11416  md/raid5: avoid BUG_ON() while continue reshape after reassembling
  - !11429  nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
  - !11331  dma: fix call order in dmam_free_coherent
  - !11170  CVE-2024-42267
  - !11236  CVE-2024-43907
  - !11410  btrfs: do not start relocation until in progress drops are done
  - nfc: pn533: initialize struct pn533_out_arg properly
  - nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
  - !11412  wifi: cfg80211: Avoid Wdiscarded-qualifiers warning
  - md/raid5: avoid BUG_ON() while continue reshape after reassembling
  - !11407 [sync] PR-11403:  btrfs: do not WARN_ON() if we have PageError set
  - wifi: cfg80211: Avoid Wdiscarded-qualifiers warning
  - btrfs: do not start relocation until in progress drops are done
  - !11399  fuse: Initialize beyond-EOF page contents before setting uptodate
  - btrfs: do not WARN_ON() if we have PageError set
  - !11365  f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
  - !11377  drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
  - !11240 [sync] PR-11174:  md: restore 'noio_flag' for the last mddev_resume()
  - fuse: Initialize beyond-EOF page contents before setting uptodate
  - drm/amd/display: Add null checker before passing variables
  - fs/ntfs3: Add more attributes checks in mi_enum_attr()
  - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
  - f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
  - dma: fix call order in dmam_free_coherent
  - sctp: Fix null-ptr-deref in reuseport_add_sock().
  - sctp: move hlist_node and hashent out of sctp_ep_common
  - md: restore 'noio_flag' for the last mddev_resume()
  - drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules
  - riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
  - soc: qcom: pdr: protect locator_addr with the main mutex
  - xfs: Fix agf_longest update error
  - xfs: Fix file creation failure


author: Li Nan <linan122@huawei.com> - 5.10.0-136.94.0.175
changelog:
  - !11516  fix CVE-2024-44988
  - !11523  ipv6: prevent UAF in ip6_send_skb()
  - !11519  ipv6: fix possible UAF in ip6_finish_output2()
  - !11489 [sync] PR-11487:  bna: ensure the copied buf is NUL terminated
  - !8756  net: USB: Fix wrong-direction WARNING in plusb.c
  - !11533  Fix CVE-2023-52915
  - media: dvb-usb-v2: af9035: fix missing unlock
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
  - !11483  drm/qxl: Add check for drm_cvt_mode
  - !11477  Fix CVE-2023-52916
  - !11458  usb: gadget: core: Check for unset descriptor
  - !11511  x86/mtrr: Check if fixed MTRRs exist before saving them
  - ipv6: prevent UAF in ip6_send_skb()
  - ipv6: fix possible UAF in ip6_finish_output2()
  - net: dsa: mv88e6xxx: Fix out-of-bound access
  - net: dsa: mv88e6xxx: replace ATU violation prints with trace points
  - net: dsa: mv88e6xxx: read FID when handling ATU violations
  - x86/mtrr: Check if fixed MTRRs exist before saving them
  - bna: ensure the copied buf is NUL terminated
  - drm/qxl: Add check for drm_cvt_mode
  - media: aspeed: Fix memory overwrite if timing is 1600x900
  - media: aspeed: Fix no complete irq for non-64-aligned width
  - usb: gadget: core: Check for unset descriptor
  - net: USB: Fix wrong-direction WARNING in plusb.c


author: Li Nan <linan122@huawei.com> - 5.10.0-136.95.0.176
changelog:
  - !11712  btrfs: fix qgroup reserve leaks in cow_file_range
  - !11724  Squashfs: sanity check symbolic link size
  - !11710  btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
  - !11709  CVE-2024-46751
  - !11702  userfaultfd: fix checks for huge PMDs
  - !11699  x86/mm: Fix pti_clone_pgtable() alignment assumption
  - Squashfs: sanity check symbolic link size
  - btrfs: fix qgroup reserve leaks in cow_file_range
  - btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
  - btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()
  - btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info()
  - btrfs: remove superfluous metadata check at btrfs_lookup_extent_info()
  - userfaultfd: fix checks for huge PMDs
  - x86/mm: Fix pti_clone_pgtable() alignment assumption
  - !9776  wifi: ar5523: enable proper endpoint verification
  - !11664  drm/amd/pm: fix the Out-of-bounds read warning
  - !11643  HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
  - !11650  fix CVE-2024-46714
  - drm/amd/pm: fix the Out-of-bounds read warning
  - !11634  fix CVE-2024-46723
  - !11647  net: hns3: fix a deadlock problem when config TC during resetting
  - !11536  usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
  - !11627 [sync] PR-11615:  mmc: mmc_test: Fix NULL dereference on allocation failure
  - !11576 [sync] PR-11012:  hfsplus: fix uninit-value in copy_name
  - !11589  drm/amd/display: Skip finding free audio for unknown engine_id
  - !11587  jfs: don't walk off the end of ealist
  - !11580  kobject_uevent: Fix OOB access within zap_modalias_env()
  - !11636  netfilter: tproxy: bail out if IP has been disabled on the device
  - drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
  - net: hns3: fix a deadlock problem when config TC during resetting
  - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
  - netfilter: tproxy: bail out if IP has been disabled on the device
  - !11611  Input: uinput - reject requests with unreasonable number of slots
  - !10937  f2fs: avoid format-overflow warning
  - drm/amdgpu: fix ucode
  - !11591 [sync] PR-8827: v2  iomap: fix sub-page not set dirty state
  - mmc: mmc_test: Fix NULL dereference on allocation failure
  - !11597 v2  mptcp: pm: avoid possible UaF when selecting endp
  - !11605  Fix iBMA bug and change version
  - !11601 [sync] PR-11583:  nfs: always check dreq->error after a commit
  - Input: uinput - reject requests with unreasonable number of slots
  - !11590  CVE-2024-36915
  - !10934  drm/amd/display: Check index msg_id before read or write
  - !10935  ata: libata-core: Fix null pointer dereference on error
  - !11599 [sync] PR-11584:  vfs: Don't evict inode under the inode lru traversing context
  - BMA: Fix edma driver initialization problem and change the version number.
  - !11595  gtp: pull network headers in gtp_dev_xmit()
  - nfs: always check dreq->error after a commit
  - vfs: Don't evict inode under the inode lru traversing context
  - mptcp: pm: avoid possible UaF when selecting endp
  - gtp: pull network headers in gtp_dev_xmit()
  - iomap: Ensure sub-page dirty state is set during mmap writes
  - Revert "iomap: Don't create iomap_page objects in iomap_page_mkwrite_actor"
  - nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
  - net: add copy_safe_from_sockptr() helper
  - drm/amd/display: Skip finding free audio for unknown engine_id
  - !11575  nilfs2: add missing check for inode numbers on directory entries
  - jfs: don't walk off the end of ealist
  - !11572  nilfs2: fix general protection fault in nilfs_btree_insert()
  - kobject_uevent: Fix OOB access within zap_modalias_env()
  - hfsplus: fix uninit-value in copy_name
  - nilfs2: add missing check for inode numbers on directory entries
  - !11571  NFSD: Fix ia_size underflow
  - nilfs2: fix general protection fault in nilfs_btree_insert()
  - NFSD: Fix ia_size underflow
  - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
  - f2fs: avoid format-overflow warning
  - ata: libata-core: Fix null pointer dereference on error
  - drm/amd/display: Check index msg_id before read or write
  - wifi: ar5523: enable proper endpoint verification


author: wangkai <13474090681@163.com> - 1:12.22.11-5
changelog:
  - Fix CVE-2022-32212,CVE-2022-32213,CVE-2022-32214,CVE-2022-32215,
  - CVE-2022-25881,CVE-2023-23918,CVE-2023-23920,CVE-2023-30589,
  - CVE-2023-30590,CVE-2023-30581,CVE-2023-32002,CVE-2023-32006,
  - CVE-2023-32559,CVE-2022-35256


author: xinsheng <xinsheng3@huawei.com> - 3.9.9-31
changelog:
  - Type:CVE
  - CVE:NA
  - SUG:NA
  - DESC:fix CVE-2024-6923,CVE-2024-7592,CVE-2024-8088
      - Encode newlines in headers, and verify headers are sound
      - Fix quadratic complexity in parsing quoted cookie values with backslashes
      - Replaced SanitizedNames with a more surgical fix


author: xinsheng <xinsheng3@huawei.com> - 3.9.9-32
changelog:
  - Type:CVE
  - CVE:CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597,CVE-2024-4032
  - SUG:NA
  - DESC:fix CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597,CVE-2024-4032
      - rename all CVE patch name
      - CVE-2024-6232: Remove backtracking when parsing tarfile headers
      - CVE-2024-3219: patch1 Authenticate socket connection for `socket.socketpair()` fallback
      - CVE-2024-3219: patch2 Rework pure Python socketpair tests to avoid use of importlib.reload.
      - CVE-2024-0450: Protect zipfile from "quoted-overlap" zipbomb
      - CVE-2023-6597: tempfile.TemporaryDirectory: fix symlink bug in cleanup
      - CVE-2024-4032: Fix "private" (non-global) IP address ranges


author: <fengjiabo1@huawei.com> - 10:6.2.0-90
changelog:
  - i386/cpuid: Move leaf 7 to correct group
  - i386/cpuid: Decrease cpuid_i when skipping CPUID leaf 1F
  - i386/cpu: Mask with XCR0/XSS mask for FEAT_XSAVE_XCR0_HI and FEAT_XSAVE_XSS_HI leafs
  - i386/cpu: Clear FEAT_XSAVE_XSS_LO/HI leafs when CPUID_EXT_XSAVE is not available
  - target/i386: Change wrong XFRM value in SGX CPUID leaf
  - target/i386: Enable support for XSAVES based features
  - target/i386: Add kvm_get_one_msr helper
  - hw/block/hd-geometry: Do not override specified bios-chs-trans mainline inclusion commit fd8a68ad6823d33bedeba20a22857867a1c3890e category: bugfix
  - linux-user/riscv: Align signal frame to 16 bytes mainline inclusion commit 1eaa63429a9944265c92efdb94c02fabb231f564 category: bugfix
  - ipmi:smbus: Add a check around a memcpy mainline inclusion commit 3fde641e7286f9b968bdb3b4b922c6465f2a9abc category: bugfix
  - tests/tcg/linux-test: Fix random hangs in test_socket mainline inclusion commit b9e6074fc5b429b1e956e9c60db7e284a91e0f3d category: bugfix
  - qemu-options.hx: Don't claim "-serial" has limit of 4 serial ports Before v2.12, the implementation of serial ports was limited to a value of MAX_SERIAL_PORTS = 4. We now dynamically allocate the data structures for serial ports, so this limit is no longer present, but the documentation for the -serial options still reads:
  - target/ppc: Modify the uncorrect value irq to n_IRQ
  - block-migration: Ensure we don't crash during migration cleanup
  - target/s390x: fix handling of zeroes in vfmin/vfmax mainline inclusion commit 13c59eb09bd6d1fbc13f08b708226421f14a232b category: bugfix
  - hw/virtio/virtio-iommu: Enforce power-of-two notify for both MAP and UNMAP mainline inclusion commit 0522be9a0c0094088ccef7aab352c57f483ca250 category: bugfix
  - configure: Add missing POSIX-required space mainline inclusion commit 35a7a6fc5624b1df828d82f2dfa74d0e4188b3b2 category: bugfix
  - vga: fix incorrect line height in 640x200x2 mode mainline inclusion commit 37e7b86766244b62a406747bb78e049390d0b528 category: bugfix
  - hw/ide/core: set ERR_STAT in unsupported command completion
  - linux-user/flatload.c: Fix setting of  image_info::end_code mainline inclusion commit 734a659ad264ac080457167e845ffabbaaa66d0e category: bugfix
  - load_elf: fix iterator's type for elf file processing
  - hw/misc/mps2-scc: Free MPS2SCC::oscclk[] array on finalize()
  - hw/nvram/xlnx-efuse: Free XlnxEFuse::ro_bits[] array on finalize()
  - hw/nvram/xlnx-efuse-ctrl: Free XlnxVersalEFuseCtrl[] "pg0-lock" array
  - chardev/char.c: fix "abstract device type" error message
  - block/rbd: fix handling of holes in .bdrv_co_block_status
  - qga: treat get-guest-fsinfo as "best effort" mainline inclusion commit bbb0151cf2e82489120a15df5e2eb9653312b0ec category: bugfix
  - usb/hcd-xhci: check slotid in  xhci_wakeup_endpoint() mainline inclusion commit 84218892f05515d20347fde4506e1944eb11cb25 category: bugfix
  - hw/display/bcm2835_fb: Fix framebuffer allocation  address mainline inclusion commit 5865d99fe88d8c8fa437c18c6b63fb2a8165634f category: bugfix
  - block/parallels: Fix buffer-based write call mainline inclusion commit eba088f91d21d9e42a81bef847173da30c5da961 category: bugfix
  - vl: Improve error message for conflicting -incoming and -loadvm
  - hw/smbios: Fix OEM strings table option validation


author: <fengjiabo1@huawei.com> - 10:6.2.0-91
changelog:
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/virtio: Introduce virtio_bh_new_guarded() helper
  - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded
  - checkpatch: add qemu_bh_new/aio_bh_new checks
  - async: avoid use-after-free on re-entrancy guard
  - async: Add an optional reentrancy guard to the BH API
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set(CVE-2024-3447)
  - rtl8139: Remove unused variable
  - tulip: Remove unused variable
  - virtio-mem: Fix the bitmap index of the section offset
  - virtio-mem: Fix the iterator variable in a vmem->rdl_list loop
  - system/memory: use ldn_he_p/stn_he_p
  - block: Fix crash when loading snapshot on inactive node
  - smmu: Clear SMMUPciBus pointer cache when system reset
  - block/mirror: Fix NULL s->job in active writes
  - amd_iommu: Fix APIC address check
  - virtio-crypto: fix NULL pointer dereference in virtio_crypto_free_reques
  - libqos/virtio.c: Correct 'flags' reading in qvirtqueue_kick
  - ivshmem-test.c: enable test_ivshmem_server for ppc64 arch
  - ivshmem.c: change endianness to LITTLE_ENDIAN
  - hw/ppc/mac.h: Remove MAX_CPUS macro
  - configure: remove dead variables
  - virtio-gpu: do not byteswap padding
  - hw/intc: clean-up error reporting for failed ITS cmd
  - qemu-iotests: Discard stderr when probing devices
  - linux-user: un-parent OBJECT(cpu) when closing thread
  - hw/net/rocker: Avoid undefined shifts with more than 31 ports
  - contrib/vhost-user-blk: Clean up deallocation of VuVirtqElement
  - scsi-disk: fix overflow when block size is not a multiple of BDRV_SECTOR_SIZE


author: <fengjiabo1@huawei.com> - 10:6.2.0-92
changelog:
  - s390x/sclp: Simplify get_sclp_device() 
  - target/ppc: Remove msr_pr macro
  - docs/system/target-arm: Re-alphabetize board list
  - migration: Extend query-migrate to provide dirty page limit info
  - migration: Implement dirty-limit convergence algo
  - migration: Put the detection logic before auto-converge checking
  - migration: Refactor auto-converge capability logic
  - migration: Introduce dirty-limit capability
  - qapi/migration: Introduce vcpu-dirty-limit parameters
  - qapi/migration: Introduce x-vcpu-dirty-limit-period parameter
  - Change the value of no_ged from true to false
  - Allow UNIX socket option for VNC websocket
  - tpm_emulator: Avoid double initialization during
  - chardev/char-socket: Update AF_UNIX for Windows
  - KVM: dirty ring: add missing memory barrier
  - i386: reset KVM nested state upon CPU reset
  - esp: Handle CMD_BUSRESET by resetting the SCSI bus
  - dbus-vmstate: Restrict error checks to registered proxies in dbus_get_proxies
  - vfio/pci: Add Ascend310b scend910b support
  - target/i386: Export RFDS bit to guests
  - target/i386: Add new CPU model SierraForest
  - target/i386: Introduce Icelake-Server-v7 to enable TSX
  - hw/virtio: handle un-configured shutdown in virtio-pci
  - target/s390x: display deprecation status in '-cpu  help'
  - target/i386: display deprecation status in '-cpu  help'
  - pc-bios/s390-ccw: Fix booting with logical block size < physical block size


author: <fengjiabo1@huawei.com> - 10:6.2.0-93
changelog:
  - cvm: bug-fix for macro isolation
  - tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fix CVE-2023-5088)
  - hw/ide: reset: cancel async DMA operation before resetting state (Fix CVE-2023-5088)
  - Add support for the virtcca cvm feature.


author: <fengjiabo1@huawei.com> - 10:6.2.0-96
changelog:
  - vdpa: Fix bug where vdpa appliance migration does not resume after rollback
  - block: Parse filenames only when explicitly requested (CVE-2024-4467)
  - block: introduce bdrv_open_file_child() helper
  - iotests/270: Don't store data-file with json: prefix in image (CVE-2024-4467)
  - iotests/244: Don't store data-file with protocol in image (CVE-2024-4467)
  - qcow2: Don't open data_file with BDRV_O_NO_IO (CVE-2024-4467)
  - qcow2: Do not reopen data_file in invalidate_cache
  - hw/intc/arm_gic: Fix deactivation of SPI lines chery-pick from 7175a562f157d39725ab396e39c1e8e410d206b3
  - vhost-user: Skip unnecessary duplicated VHOST_USER_SET_LOG_BASE requests
  - target/ppc: Split off common embedded TLB init cheery-pick from 581eea5d656b73c6532109f4ced4c73fd4e5fd47`
  - vdpa: fix vdpa device migrate rollback wrong when suspend device failed 1. 
  - hw/virtio/virtio-pci:Support shadow device for virtio-net/blk/scsi devices


author: <fengjiabo1@huawei.com> - 10:6.2.0-97
changelog:
  - nbd/server: CVE-2024-7409: Close stray clients at server-stop
  - main-loop.h: introduce qemu_in_main_thread()
  - aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED
  - nbd/server: CVE-2024-7409: Drop non-negotiating clients
  - nbd/server: CVE-2024-7409: Cap default max-connections to 100
  - nbd/server: Plumb in new args to nbd_client_add()
  - nbd: Minor style and typo fixes


author: <fengjiabo1@huawei.com> - 10:6.2.0-98
changelog:
  - pci-host: designware: Limit value range of iATU viewport register
  - hmat acpi: Fix out of bounds access due to missing use of indirection
  - migration: Skip only empty block devices
  - aspeed/hace: Initialize g_autofree pointer
  - hw/net/vmxnet3: Fix guest-triggerable assert()
  - qxl: don't assert() if device isn't yet initialized
  - Avoid unaligned fetch in ladr_match()
  - linux-user: Fix waitid return of siginfo_t and rusage
  - hw/net/lan9118: Replace magic '2048' value by MIL_TXFIFO_SIZE definition
  - stdvga: fix screen blanking
  - virtio-net: drop too short packets early
  - ebpf: replace deprecated bpf_program__set_socket_filter
  - vhsot-user: only read reply of SET_LOG_BASE from vq 0
  - cpu: add Tengyun S5000C cpu support
  - hw/virtio: Fix obtain the buffer id from the last descriptor
  - hw/core: ensure kernel_end never gets used undefined


author: <fengjiabo1@huawei.com> - 10:6.2.0-99
changelog:
  - target/i386: Introduce SapphireRapids-v3 to add missing features
  - qtest/fuzz-lsi53c895a-test: set guest RAM to 2G
  - hw/net/lan9118: Signal TSFL_INT flag when TX FIFO reaches specified level
  - target/arm: Fix alignment for VLD4.32
  - hw/microblaze: pass random seed to fdt
  - tests/qtest: npcm7xx-emc-test: Skip checking MAC
  - tests: mark io-command test as skipped if socat is missing
  - tests: unit: add NULL-pointer check
  - tests: test-qga: close socket on failure to connect
  - vdpa:block device capacity expansion online support vdpa block device update capacity.
  - virtio-net: Ensure queue index fits with RSS(CVE-2024-6505)
  - nbd/server: CVE-2024-7409: Avoid use-after-free when closing server
  - ppc/vof: Fix unaligned FDT property access
  - vvfat: Fix reading files with non-continuous clusters
  - vvfat: Fix bug in writing to middle of file
  - savevm: Fix load_snapshot error path crash
  - hw/dma/xilinx_axidma: Use semicolon at end of statement, not comma
  - hw/remote/message.c: Don't directly invoke DeviceClass:reset
  - crypto/tlscredspsk: Free username on finalize
  - hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()
  - virtio: remove virtio_tswap16s() call in vring_packed_event_read()
  - char-stdio: Restore blocking mode of stdout on exit
  - hw/ppc: spapr: Use qemu_vfree() to free spapr->htab
  - smbios: sanitize type from external type before checking have_fields_bitmap
  - spapr_pci: fix leak in spapr_phb_vfio_get_loc_code
  - KVM: use store-release to mark dirty pages as harvested
  - monitor/hmp: print trace as option in help for log command
  - tpm_crb: Avoid backend startup just before shutdown under Xen
  - crypto/block-luks: make range overlap check more readable
  - spapr: Free stdout path
  - target/rx: Use target_ulong for address in LI
  - virtio-pci: Fix the use of an uninitialized irqfd
  - rtl8139: Fix behaviour for old kernels.
  - virtio-rng: block max-bytes=0 MIME-Version: 1.0
  - hw/audio/es1370: Clean up comment
  - vhost-user-server: do not set memory fd non-blocking
  - ui: reject extended clipboard message if not activated
  - virtio-net: Fix vhost virtqueue notifiers for RSS
  - hw/misc/applesmc: Fix memory leak in reset() handler


