# changelog

author: yinbin6 <jiangheng14@huawei.com> - 1.0.2-67
changelog:
  - bugfix: fix gazelle init failed while setup by non-root user
  - rpc: fix rpc_sync_call spinlock block when msg be recalled
  - rtw: fix send length exceeding send_ring_size
  - fix stack null when register interrupt


author: hantwofish <yinbin8@huawei.com> - 1.0.2-73
changelog:
  - xdp: support XDP_STATISTICS by posix_api->getsockopt_fn
  - add SO_NUMA_ID(optname) for adapting opneGauss
  - remove the unused return variable.
  - Fix annotation errors
  - bugfix: start fail when executing the popen command for the second time in openGauss


author: yinbin <jiangheng14@huawei.com> - 1.0.2-74
changelog:
  - LOG: Optimize some log displays
  - remove: code about nobolck mode for mysql
  - interrupt: fix timeout events cannot be counted


author: songliyang <songliyang@kylinos.cn> - 1:17.0.12.7-1
changelog:
  - update Loongarch support patch to fix the error while applying in prep stage
  - delete redundant symbols while viewing spec file with vim that make it strange on highlight


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.12.7-2
changelog:
  - add Huawei-Extending-the-IV-Length-Supported-by-KAEProvider-AES.patch
  - add Backport-7036144-GZIPInputStream-readTrailer-uses-faulty-avai.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> - 1:17.0.12.7-5
changelog:
  - Add Backport-of-JDK-8305680.patch
  - Add Backport-of-JDK-8305937.patch
  - Add 8338785-The-java.awt.datatransfer.SystemFlavorMap-FL.patch
  - Add 8337982-Remove-dead-undef-assrt0n.patch
  - Add 8337274-Remove-repeated-the-in-StyleSheet.create-Sma.patch
  - Add 8335610-DiagnosticFramework-CmdLine-is_executable-co.patch
  - Add Backport-of-8333088-ubsan-shenandoahAdaptiveHeuristi.patch
  - Add Backport-of-8339351-Remove-duplicate-line-in-FileMap.patch
  - Add Backport-of-8330191-Fix-typo-in-precompiled.hpp.patch
  - Add Backport-of-8337712-Wrong-javadoc-in-java.util.Date-.patch


author: Benshuai5D <zhangyunbo7@huawei.com> - 1:17.0.13.11-0
changelog:
  - modify 8264805-Backport-Ahead-of-Time-Compiler.patch
  - modify 8264806-Backport-Graal-Compiler.patch
  - modify Add-JBooster-Lazy-AOT-module.patch
  - modify Apply-TBI-to-ZGC-of-JDK17.patch
  - modify Backport-Important-Fixed-Issues.patch
  - modify KAE-zip-Features.patch
  - modify add-version-txt.patch
  - add Huawei-Fix-JBooster-file-issue-caused-by-os-write-change.patch
  - update to 17.0.13+11(ga)


author: Li Nan <linan122@huawei.com> - 5.10.0-136.93.0.174
changelog:
  - !10941 v2  xfs: fix file creation
  - !11492  Fix CVE-2022-48887
  - !11471  net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
  - drm/vmwgfx: Remove rcu locks from user resources
  - drm/vmwgfx: Remove vmw_user_bo_noref_release
  - drm/vmwgfx: Introduce ttm reference object find function
  - net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
  - !11103  soc: qcom: pdr: protect locator_addr with the main mutex
  - !11446  zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
  - !11392  fix CVE-2023-45896
  - !11445 [sync] PR-11015:  nvme-pci: add missing condition check for existence of mapped data
  - !11283  CVE-2024-44935
  - !11451 [sync] PR-11390:  hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
  - !11442 v2  drm/amd/display: Fix null pointer deref in dcn20_resource.c
  - nvme-pci: add missing condition check for existence of mapped data
  - drm/amd/display: Fix null pointer deref in dcn20_resource.c
  - !11396 [sync] PR-11324:  drm/amd/display: Add null checker before passing variables
  - !11416  md/raid5: avoid BUG_ON() while continue reshape after reassembling
  - !11429  nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
  - !11331  dma: fix call order in dmam_free_coherent
  - !11170  CVE-2024-42267
  - !11236  CVE-2024-43907
  - !11410  btrfs: do not start relocation until in progress drops are done
  - nfc: pn533: initialize struct pn533_out_arg properly
  - nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
  - !11412  wifi: cfg80211: Avoid Wdiscarded-qualifiers warning
  - md/raid5: avoid BUG_ON() while continue reshape after reassembling
  - !11407 [sync] PR-11403:  btrfs: do not WARN_ON() if we have PageError set
  - wifi: cfg80211: Avoid Wdiscarded-qualifiers warning
  - btrfs: do not start relocation until in progress drops are done
  - !11399  fuse: Initialize beyond-EOF page contents before setting uptodate
  - btrfs: do not WARN_ON() if we have PageError set
  - !11365  f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
  - !11377  drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
  - !11240 [sync] PR-11174:  md: restore 'noio_flag' for the last mddev_resume()
  - fuse: Initialize beyond-EOF page contents before setting uptodate
  - drm/amd/display: Add null checker before passing variables
  - fs/ntfs3: Add more attributes checks in mi_enum_attr()
  - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
  - f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
  - dma: fix call order in dmam_free_coherent
  - sctp: Fix null-ptr-deref in reuseport_add_sock().
  - sctp: move hlist_node and hashent out of sctp_ep_common
  - md: restore 'noio_flag' for the last mddev_resume()
  - drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules
  - riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
  - soc: qcom: pdr: protect locator_addr with the main mutex
  - xfs: Fix agf_longest update error
  - xfs: Fix file creation failure


author: Li Nan <linan122@huawei.com> - 5.10.0-136.94.0.175
changelog:
  - !11516  fix CVE-2024-44988
  - !11523  ipv6: prevent UAF in ip6_send_skb()
  - !11519  ipv6: fix possible UAF in ip6_finish_output2()
  - !11489 [sync] PR-11487:  bna: ensure the copied buf is NUL terminated
  - !8756  net: USB: Fix wrong-direction WARNING in plusb.c
  - !11533  Fix CVE-2023-52915
  - media: dvb-usb-v2: af9035: fix missing unlock
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
  - !11483  drm/qxl: Add check for drm_cvt_mode
  - !11477  Fix CVE-2023-52916
  - !11458  usb: gadget: core: Check for unset descriptor
  - !11511  x86/mtrr: Check if fixed MTRRs exist before saving them
  - ipv6: prevent UAF in ip6_send_skb()
  - ipv6: fix possible UAF in ip6_finish_output2()
  - net: dsa: mv88e6xxx: Fix out-of-bound access
  - net: dsa: mv88e6xxx: replace ATU violation prints with trace points
  - net: dsa: mv88e6xxx: read FID when handling ATU violations
  - x86/mtrr: Check if fixed MTRRs exist before saving them
  - bna: ensure the copied buf is NUL terminated
  - drm/qxl: Add check for drm_cvt_mode
  - media: aspeed: Fix memory overwrite if timing is 1600x900
  - media: aspeed: Fix no complete irq for non-64-aligned width
  - usb: gadget: core: Check for unset descriptor
  - net: USB: Fix wrong-direction WARNING in plusb.c


author: Li Nan <linan122@huawei.com> - 5.10.0-136.95.0.176
changelog:
  - !11712  btrfs: fix qgroup reserve leaks in cow_file_range
  - !11724  Squashfs: sanity check symbolic link size
  - !11710  btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
  - !11709  CVE-2024-46751
  - !11702  userfaultfd: fix checks for huge PMDs
  - !11699  x86/mm: Fix pti_clone_pgtable() alignment assumption
  - Squashfs: sanity check symbolic link size
  - btrfs: fix qgroup reserve leaks in cow_file_range
  - btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
  - btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()
  - btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info()
  - btrfs: remove superfluous metadata check at btrfs_lookup_extent_info()
  - userfaultfd: fix checks for huge PMDs
  - x86/mm: Fix pti_clone_pgtable() alignment assumption
  - !9776  wifi: ar5523: enable proper endpoint verification
  - !11664  drm/amd/pm: fix the Out-of-bounds read warning
  - !11643  HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
  - !11650  fix CVE-2024-46714
  - drm/amd/pm: fix the Out-of-bounds read warning
  - !11634  fix CVE-2024-46723
  - !11647  net: hns3: fix a deadlock problem when config TC during resetting
  - !11536  usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
  - !11627 [sync] PR-11615:  mmc: mmc_test: Fix NULL dereference on allocation failure
  - !11576 [sync] PR-11012:  hfsplus: fix uninit-value in copy_name
  - !11589  drm/amd/display: Skip finding free audio for unknown engine_id
  - !11587  jfs: don't walk off the end of ealist
  - !11580  kobject_uevent: Fix OOB access within zap_modalias_env()
  - !11636  netfilter: tproxy: bail out if IP has been disabled on the device
  - drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
  - net: hns3: fix a deadlock problem when config TC during resetting
  - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
  - netfilter: tproxy: bail out if IP has been disabled on the device
  - !11611  Input: uinput - reject requests with unreasonable number of slots
  - !10937  f2fs: avoid format-overflow warning
  - drm/amdgpu: fix ucode
  - !11591 [sync] PR-8827: v2  iomap: fix sub-page not set dirty state
  - mmc: mmc_test: Fix NULL dereference on allocation failure
  - !11597 v2  mptcp: pm: avoid possible UaF when selecting endp
  - !11605  Fix iBMA bug and change version
  - !11601 [sync] PR-11583:  nfs: always check dreq->error after a commit
  - Input: uinput - reject requests with unreasonable number of slots
  - !11590  CVE-2024-36915
  - !10934  drm/amd/display: Check index msg_id before read or write
  - !10935  ata: libata-core: Fix null pointer dereference on error
  - !11599 [sync] PR-11584:  vfs: Don't evict inode under the inode lru traversing context
  - BMA: Fix edma driver initialization problem and change the version number.
  - !11595  gtp: pull network headers in gtp_dev_xmit()
  - nfs: always check dreq->error after a commit
  - vfs: Don't evict inode under the inode lru traversing context
  - mptcp: pm: avoid possible UaF when selecting endp
  - gtp: pull network headers in gtp_dev_xmit()
  - iomap: Ensure sub-page dirty state is set during mmap writes
  - Revert "iomap: Don't create iomap_page objects in iomap_page_mkwrite_actor"
  - nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
  - net: add copy_safe_from_sockptr() helper
  - drm/amd/display: Skip finding free audio for unknown engine_id
  - !11575  nilfs2: add missing check for inode numbers on directory entries
  - jfs: don't walk off the end of ealist
  - !11572  nilfs2: fix general protection fault in nilfs_btree_insert()
  - kobject_uevent: Fix OOB access within zap_modalias_env()
  - hfsplus: fix uninit-value in copy_name
  - nilfs2: add missing check for inode numbers on directory entries
  - !11571  NFSD: Fix ia_size underflow
  - nilfs2: fix general protection fault in nilfs_btree_insert()
  - NFSD: Fix ia_size underflow
  - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
  - f2fs: avoid format-overflow warning
  - ata: libata-core: Fix null pointer dereference on error
  - drm/amd/display: Check index msg_id before read or write
  - wifi: ar5523: enable proper endpoint verification


author: Li Nan <linan122@huawei.com> - 5.10.0-136.96.0.177
changelog:
  - !12070 [sync] PR-12050:  um: line: always fill *error_out in setup_one_line()
  - !11965  drm/amd/pm: Fix negative array index read
  - !12060  CVE-2024-46857
  - !12047  perf/x86/intel: Limit the period on Haswell
  - um: line: always fill *error_out in setup_one_line()
  - !12041 [sync] PR-12032:  serial: sc16is7xx: fix invalid FIFO access with special register set
  - !12042 [sync] PR-12002:  drm/amd/display: Assign linear_pitch_alignment even for VM
  - !12021  drm/amd/display: Check gpio_id before used as array index
  - !12025  ASoC: meson: axg-card: fix 'use-after-free'
  - !11991 [sync] PR-11941:  usb: typec: ucsi: Fix null pointer dereference in trace
  - !11990 [sync] PR-11939:  of/irq: Prevent device address out-of-bounds read in interrupt map walk
  - !12035  ksmbd: discard write access to the directory open
  - !12037  drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
  - net/mlx5: Fix bridge mode operations when there are no VFs
  - net/mlx5: E-switch, Introduce flag to indicate if fdb table is created
  - !11996  drm/amd/display: Add array index check for hdcp ddc access
  - !12010  rtmutex: Drop rt_mutex::wait_lock before scheduling
  - perf/x86/intel: Limit the period on Haswell
  - drm/amd/display: Assign linear_pitch_alignment even for VM
  - serial: sc16is7xx: fix invalid FIFO access with special register set
  - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
  - ksmbd: discard write access to the directory open
  - ASoC: meson: axg-card: fix 'use-after-free'
  - !11872 [sync] PR-11817:  uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  - drm/amd/display: Check gpio_id before used as array index
  - !12001  nvmet-tcp: fix kernel crash if commands allocation fails
  - rtmutex: Drop rt_mutex::wait_lock before scheduling
  - !11911  ksmbd: unset the binding mark of a reused connection
  - !11988 [sync] PR-11938:  KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
  - nvmet-tcp: fix kernel crash if commands allocation fails
  - drm/amd/display: Add array index check for hdcp ddc access
  - !11934 [sync] PR-11925:  nilfs2: protect references to superblock parameters exposed in sysfs
  - !11978  CVE-2024-46814
  - !11932 [sync] PR-11875:  btrfs: handle errors from btrfs_dec_ref() properly
  - usb: typec: ucsi: Fix null pointer dereference in trace
  - of/irq: Prevent device address out-of-bounds read in interrupt map walk
  - KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
  - drm/amd/display: Check msg_id before processing transcation
  - drm/amd/pm: Fix negative array index read
  - !11955  Fix CVE-2024-44958 5.10
  - !11743 [sync] PR-11693:  Fix CVE-2024-39501
  - !11947  btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
  - sched/smt: Fix unbalance sched_smt_present dec/inc
  - sched/smt: Introduce sched_smt_present_inc/dec() helper
  - !11917  ethtool: check device is present when getting link settings
  - !11937  btrfs: remove NULL transaction support for btrfs_lookup_extent_info()
  - !11923  hwmon: (lm95234) Fix underflows seen when writing limit attributes
  - btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
  - btrfs: remove NULL transaction support for btrfs_lookup_extent_info()
  - nilfs2: protect references to superblock parameters exposed in sysfs
  - btrfs: handle errors from btrfs_dec_ref() properly
  - !11841  fix CVE-2024-46771
  - !11913 [sync] PR-11890:  hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
  - hwmon: (lm95234) Fix underflows seen when writing limit attributes
  - ethtool: check device is present when getting link settings
  - !11793  ALSA: line6: Fix racy access to midibuf
  - !11868  pktgen: use cpus_read_lock() in pg_net_init()
  - !11892 [sync] PR-11866: v2  drm/amd/display: Ensure index calculation will not overflow
  - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
  - ksmbd: unset the binding mark of a reused connection
  - !11869  VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  - !11904  scsi: aacraid: Fix double-free on probe failure
  - scsi: aacraid: Fix double-free on probe failure
  - !11886  pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  - !11873 [sync] PR-11494:  ext4: Fix race in buffer_head read fault injection
  - !11880  PCI: Add missing bridge lock to pci_bus_lock()
  - !11879  usb: dwc3: st: fix probed platform device ref count on probe error path
  - !11739 [sync] PR-11625:  smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
  - !11851  usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
  - !11849  bcache: fix variable length array abuse in btree_iter
  - !11833  scsi: bfa: Ensure the copied buf is NUL terminated
  - !11832  enic: Validate length of nl attributes in enic_set_vf_port
  - !11831  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  - !11830  ALSA: usb-audio: Stop parsing channels bits when all channels are found.
  - drm/amd/display: Ensure index calculation will not overflow
  - !11827  CVE-2024-46781
  - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  - !11829 v2  drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
  - PCI: Add missing bridge lock to pci_bus_lock()
  - usb: dwc3: st: fix probed platform device ref count on probe error path
  - !11858 v2  Fix CVE-2024-45025
  - !11768 [sync] PR-11733:  Input: MT - limit max slots
  - !11846  bpf: verifier: prevent userspace memory access
  - ext4: Fix race in buffer_head read fault injection
  - !11750  ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
  - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  - !11853 [sync] PR-11815:  selinux,smack: don't bypass permissions check in inode_setsecctx hook
  - VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  - pktgen: use cpus_read_lock() in pg_net_init()
  - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
  - s390/cio: rename bitmap_size() -> idset_bitmap_size()
  - bitmap: introduce generic optimized bitmap_size()
  - fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64()
  - tools: move alignment-related macros to new <linux/align.h>
  - !11676  wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
  - !11674  netem: fix return value if duplicate enqueue fails
  - !11808  apparmor: fix possible NULL pointer dereference
  - !11807  drm/amdgpu: Fix out-of-bounds write warning
  - !11735  fix CVE-2024-46777 for SP1
  - !11684  binder: fix UAF caused by offsets overwrite
  - !11778 [sync] PR-11729:  scsi: qedi: Fix crash while reading debugfs attribute
  - !11779 [sync] PR-11730:  media: xc2028: avoid use-after-free in load_firmware_cb()
  - !11782 [sync] PR-11728:  lib: objagg: Fix general protection fault
  - !11781 [sync] PR-11727:  jfs: fix null ptr deref in dtInsertEntry
  - !11780 [sync] PR-11726:  drm/vmwgfx: Fix a deadlock in dma buf fence polling
  - selinux,smack: don't bypass permissions check in inode_setsecctx hook
  - !11776 [sync] PR-11738:  hwmon: (adc128d818) Fix underflows seen when writing limit attributes
  - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
  - bcache: fix variable length array abuse in btree_iter
  - bpf: verifier: prevent userspace memory access
  - can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
  - can: bcm: Remove proc entry when dev is unregistered.
  - scsi: bfa: Ensure the copied buf is NUL terminated
  - enic: Validate length of nl attributes in enic_set_vf_port
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  - ALSA: usb-audio: Stop parsing channels bits when all channels are found.
  - drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
  - nilfs2: fix missing cleanup on rollforward recovery error
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
  - !11745  powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
  - !11775 [sync] PR-11752:  driver: iio: add missing checks on iio_info's callback access
  - !11800  can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
  - apparmor: fix possible NULL pointer dereference
  - drm/amdgpu: Fix out-of-bounds write warning
  - !11762  sch/netem: fix use after free in netem_dequeue
  - can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
  - ALSA: line6: Fix racy access to midibuf
  - lib: objagg: Fix general protection fault
  - jfs: fix null ptr deref in dtInsertEntry
  - drm/vmwgfx: Fix a deadlock in dma buf fence polling
  - media: xc2028: avoid use-after-free in load_firmware_cb()
  - scsi: qedi: Fix crash while reading debugfs attribute
  - hwmon: (adc128d818) Fix underflows seen when writing limit attributes
  - driver: iio: add missing checks on iio_info's callback access
  - Input: MT - limit max slots
  - sch/netem: fix use after free in netem_dequeue
  - ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
  - powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
  - driver core: Fix uevent_show() vs driver detach race
  - selftests: forwarding: devlink_lib: Wait for udev events after reloading
  - drivers: core: synchronize really_probe() and dev_uevent()
  - smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
  - udf: Avoid excessive partition lengths
  - udf: Define EFSCORRUPTED error code
  - binder: fix UAF caused by offsets overwrite
  - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
  - netem: fix return value if duplicate enqueue fails


author: Li Nan <linan122@huawei.com> - 5.10.0-136.97.0.178
changelog:
  - !12117  CVE-2024-43855
  - !12167  crypto: stm32/cryp - call finalize with bh disabled
  - !12203  spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware
  - !12206 v2  atm: idt77252: prevent use after free in dequeue_rx()
  - !12143  nfc: pn533: Add poll mod list filling check
  - !12150  wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  - atm: idt77252: prevent use after free in dequeue_rx()
  - !12173  fou: remove warn in gue_gro_receive on unsupported protocol
  - !12169  xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
  - spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware
  - !12165  bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
  - fou: remove warn in gue_gro_receive on unsupported protocol
  - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
  - crypto: stm32/cryp - call finalize with bh disabled
  - bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
  - !12120  sched: sch_cake: fix bulk flow accounting logic for host fairness
  - !12119  ice: Add netif_device_attach/detach into PF reset flow
  - !12118  bpf: Remove tst_run from lwt_seg6local_prog_ops.
  - wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  - nfc: pn533: Add poll mod list filling check
  - !12085 [sync] PR-11856:  acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - !12046  s390/dasd: fix error recovery leading to data corruption on ESE devices
  - !12044  s390/sclp: Prevent release of buffer in I/O
  - sched: sch_cake: fix bulk flow accounting logic for host fairness
  - ice: Add netif_device_attach/detach into PF reset flow
  - bpf: Remove tst_run from lwt_seg6local_prog_ops.
  - md: ensure child flush IO does not affect origin bio->bi_status
  - md: Remove flush handling
  - md: fix a crash in mempool_free
  - !12097  netfilter: nft_socket: fix sk refcount leaks
  - !12099  CVE-2024-46858
  - !12098  net: dpaa: Pad packets to ETH_ZLEN
  - !12091  USB: usbtmc: prevent kernel-usb-infoleak
  - mptcp: pm: Fix uaf in __timer_delete_sync
  - mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer
  - mptcp: export lookup_anno_list_by_saddr
  - net: dpaa: Pad packets to ETH_ZLEN
  - netfilter: nft_socket: fix sk refcount leaks
  - USB: usbtmc: prevent kernel-usb-infoleak
  - acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - !12083  drm/i915/gt: Cleanup partial engine discovery failures
  - !12079  btrfs: clean up our handling of refs == 0 in snapshot delete
  - !12054  drm/amdgpu: the warning dereferencing obj for nbio_v7_4
  - drm/i915/gt: Cleanup partial engine discovery failures
  - btrfs: clean up our handling of refs == 0 in snapshot delete
  - drm/amdgpu: the warning dereferencing obj for nbio_v7_4
  - s390/dasd: fix error recovery leading to data corruption on ESE devices
  - s390/sclp: Prevent release of buffer in I/O


author: Li Nan <linan122@huawei.com> - 5.10.0-136.98.0.179
changelog:
  - !12297  CVE-2024-46822
  - !12242 [sync] PR-12227:  nbd: Fix signal handling
  - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
  - arm64: acpi: Move get_cpu_for_acpi_id() to a header
  - !12260  drm/lima: fix a memleak in lima_heap_alloc
  - !12258  media: go7007: fix a memleak in go7007_load_encoder
  - !12259  octeontx2-af: Use separate handlers for interrupts
  - !12256 [sync] PR-12254:  greybus: Fix use-after-free bug in gb_interface_release due to race condition.
  - !12265  drm/amd/display: Avoid overflow from uint32_t to uint8_t
  - drm/amd/display: Avoid overflow from uint32_t to uint8_t
  - !12243 v2  net/mlx5e: Fix netif state handling
  - drm/lima: fix a memleak in lima_heap_alloc
  - octeontx2-af: Use separate handlers for interrupts
  - media: go7007: fix a memleak in go7007_load_encoder
  - greybus: Fix use-after-free bug in gb_interface_release due to race condition.
  - !12221 [sync] PR-12102:  Fix CVE-2024-46826
  - !12156  bonding: Fix CVE-2024-44990
  - !12158  bonding: fix xfrm real_dev null pointer dereference
  - !12157  netfilter: flowtable: initialise extack before use
  - !11298  gpio: prevent potential speculation leaks in gpio_device_get_desc()
  - !8675 [sync] PR-8534:  riscv: process: Fix kernel gp leakage
  - !8674 [sync] PR-8542:  octeontx2-af: Fix possible null pointer dereference.
  - !12161  md/raid1: don't free conf on raid0_run failure
  - !12237  dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
  - !12235  drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
  - net/mlx5e: Fix netif state handling
  - !12184  mlxsw: spectrum_acl_erp: Fix object nesting warning
  - !12183  netns: Make get_net_ns() handle zero refcount net
  - !12180  net/sched: Fix CVE-2024-36244
  - !12177  ipv6: sr: fix invalid unregister error path
  - !12191  wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  - !12192  netfilter: nft_flow_offload: reset dst in route object after setting up flow
  - !12193  tcp: do not accept ACK of bytes we never sent
  - !12194  mlxsw: spectrum_acl_tcam: Fix warning during rehash
  - !12195  i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  - !12196  net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
  - !12211  scsi: qla2xxx: During vport delete send async logout explicitly
  - !12210  platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - nbd: Fix signal handling
  - nbd: Improve the documentation of the locking assumptions
  - !12231 [sync] PR-12208:  Some bugfixs for ubi/fs
  - dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
  - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
  - locks: fix TOCTOU race when granting write lease
  - ubi: block: fix null-pointer-dereference in ubiblock_create()
  - ubi: block: Remove in vain semicolon
  - !12224 [sync] PR-11910:  ext4: dax: Fix inconsistent isize during writing
  - ext4: dax: keep orphan list before truncate overflow allocated blocks
  - ext4: dax: fix overflowing extents beyond inode size when partially writing
  - !12064 [sync] PR-11942:  sbitmap: backport bugfix patches
  - ELF: Fix mixed declarations and code of "snapshot_randomize_va_space"
  - ELF: fix kernel.randomize_va_space double read
  - scsi: qla2xxx: During vport delete send async logout explicitly
  - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
  - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  - mlxsw: spectrum_acl_tcam: Fix warning during rehash
  - tcp: do not accept ACK of bytes we never sent
  - netfilter: nft_flow_offload: reset dst in route object after setting up flow
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  - mlxsw: spectrum_acl_erp: Fix object nesting warning
  - netns: Make get_net_ns() handle zero refcount net
  - net/sched: taprio: extend minimum interval restriction to entire cycle too
  - net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX.
  - ipv6: sr: fix invalid unregister error path
  - md/raid1: don't free conf on raid0_run failure
  - bonding: fix xfrm real_dev null pointer dereference
  - netfilter: flowtable: initialise extack before use
  - bonding: fix null pointer deref in bond_ipsec_offload_ok
  - bonding: fix bond_ipsec_offload_ok return type
  - blk-mq: Fix potential io hung for shared sbitmap per tagset
  - blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
  - sbitmap: fix lockup while swapping
  - sbitmap: Avoid leaving waitqueue in invalid state in __sbq_wake_up()
  - sbitmap: fix possible io hung due to lost wakeup
  - block: Fix lockdep warning in blk_mq_mark_tag_wait
  - blk-mq: fix potential io hang by wrong 'wake_batch'
  - sbitmap: correct wake_batch recalculation to avoid potential IO hung
  - blk-mq: Fix wrong wakeup batch configuration which will cause hang
  - blk-mq: fix tag_get wait task can't be awakened
  - gpio: prevent potential speculation leaks in gpio_device_get_desc()
  - riscv: process: Fix kernel gp leakage
  - octeontx2-af: Fix possible null pointer dereference.


author: Li Nan <linan122@huawei.com> - 5.10.0-136.99.0.180
changelog:
  - !12652  mm/gup: fix gup_pud_range() for dax
  - !12671  drm/amd/display: Fix index out of bounds in degamma hardware format translation
  - !12247  nilfs2: fix state management in error path of log writing function
  - !12647  sock_map: Add a cond_resched() in sock_hash_free()
  - !12646  tcp: check skb is non-NULL in tcp_rto_delta_us()
  - !12645  RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
  - !12644  net: do not delay dst_entries_add() in dst_release()
  - !12630 [sync] PR-12605:  fix CVE-2024-46802
  - !12657  NFSD: Limit the number of concurrent async COPY operations
  - !12636  ALSA: asihpi: Fix potential OOB array access
  - drm/amd/display: Fix index out of bounds in degamma hardware format translation
  - !12274  blk-mq: fix blk_mq_hw_ctx active request accounting
  - !12613  drm/amd/display: Check null pointer before dereferencing se
  - !12622  NFC: nci: Bounds check struct nfc_target arrays
  - !12619  PCI: mt7621: Add sentinel to quirks table
  - !12504  ocfs2: cancel dqi_sync_work before freeing oinfo
  - NFSD: Limit the number of concurrent async COPY operations
  - mm/gup: fix gup_pud_range() for dax
  - !12625  net: ethernet: nixge: fix NULL dereference
  - !12626  libbpf: Handle size overflow for ringbuf mmap
  - sock_map: Add a cond_resched() in sock_hash_free()
  - tcp: check skb is non-NULL in tcp_rto_delta_us()
  - RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
  - net: do not delay dst_entries_add() in dst_release()
  - !12624  hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
  - ALSA: asihpi: Fix potential OOB array access
  - drm/amd/display: fix mixed declarations warning
  - drm/amd/display: added NULL check at start of dc_validate_stream
  - libbpf: Handle size overflow for ringbuf mmap
  - net: ethernet: nixge: fix NULL dereference
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
  - NFC: nci: Bounds check struct nfc_target arrays
  - PCI: mt7621: Add sentinel to quirks table
  - !12602 [sync] PR-12459:  drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
  - !12601 [sync] PR-12453:  drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
  - !12600 [sync] PR-12442:  drm/amd/display: Fix index out of bounds in DCN30 color transformation
  - !12446  nilfs2: fix potential oob read in nilfs_btree_check_delete()
  - !8926  ext4: avoid deadlock in fs reclaim with page writeback
  - drm/amd/display: Check null pointer before dereferencing se
  - !12582  drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
  - !12578  gpio: amd8111: Fix PCI device reference count leak
  - !12456  nfsd: map the EBADMSG to nfserr_io to avoid warning
  - !12564  ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
  - !12561  fix CVE-2024-49900
  - !12562  fix CVE-2024-47667
  - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
  - drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
  - drm/amd/display: Fix index out of bounds in DCN30 color transformation
  - !12450  Fix CVE-2024-26917 and CVE-2024-50025
  - !12544 [sync] PR-12369:  x86/ioapic: Handle allocation failures gracefully
  - drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
  - !12401  drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
  - gpio: amd8111: Fix PCI device reference count leak
  - !12416  btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
  - !12420  nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
  - !12421  udf: Fix preallocation discarding at indirect extent boundary
  - !12419  jfs: Fix uaf in dbFreeBits
  - !12418  jfs: check if leafidx greater than num leaves per dmap tree
  - !12415  btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
  - !12417  btrfs: wait for fixup workers before stopping cleaner kthread during umount
  - !12522  netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
  - !12543  media: pci: cx23885: check cx23885_vdev_init() return
  - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
  - PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
  - PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
  - jfs: Fix uninit-value access of new_ea in ea_buffer
  - x86/ioapic: Handle allocation failures gracefully
  - media: pci: cx23885: check cx23885_vdev_init() return
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
  - !12251  KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
  - !12514  devres: Fix memory leakage caused by driver API devm_free_percpu()
  - !12513  jfs: Fix array-index-out-of-bounds in diFree
  - !12468  mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
  - !12388  spi: nxp-fspi: fix the KASAN report out-of-bounds bug
  - !12386  drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
  - !12381  fix CVE-2024-46675
  - !12364  hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
  - !12447  iommu/vt-d: Fix double list_add when enabling VMD in scalable mode
  - !12463  fix CVE-2024-42301
  - !12489  CVE-2024-40965_openEuler-22.03-LTS-SP1
  - !12481  CVE-2024-41015
  - !12485  CVE-2024-38667
  - !12483  CVE-2024-36286
  - devres: Fix memory leakage caused by driver API devm_free_percpu()
  - !12457  soundwire: cadence: fix invalid PDI offset
  - jfs: Fix array-index-out-of-bounds in diFree
  - ocfs2: cancel dqi_sync_work before freeing oinfo
  - !12430  CVE-2024-43894
  - i2c: lpi2c: Avoid calling clk_get_rate during transfer
  - i2c: imx-lpi2c: return -EINVAL when i2c peripheral clk doesn't work
  - i2c: imx-lpi2c: use bulk clk API
  - clk: Provide !COMMON_CLK dummy for devm_clk_rate_exclusive_get()
  - clk: Add a devm variant of clk_rate_exclusive_get()
  - riscv: prevent pt_regs corruption for secondary idle threads
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
  - ocfs2: add bounds checking to ocfs2_check_dir_entry()
  - !12392  mm/swapfile: skip HugeTLB pages for unuse_vma
  - !12433 v2  Fix CVE-2022-49006
  - !12356 [sync] PR-12334:  drm/nouveau: prime: fix refcount underflow
  - !12359 [sync] PR-12342:  nvmet: fix a possible leak when destroy a ctrl during qp establishment
  - !12371 [sync] PR-12344:  of: module: prevent NULL pointer dereference in vsnprintf()
  - !12352  i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
  - !12222 [sync] PR-12075:  blk-mq: fix lockdep hardirq warning in __blk_mq_tag_idle()
  - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
  - parport: Proper fix for array out-of-bounds access
  - dev/parport: fix the array out-of-bounds risk
  - !12357 [sync] PR-12318:  nfsd: call cache_put if xdr_reserve_space returns NULL
  - soundwire: cadence: fix invalid PDI offset
  - nfsd: map the EBADMSG to nfserr_io to avoid warning
  - scsi: fnic: Move flush_work initialization out of if block
  - scsi: fnic: Move fnic_fnic_flush_tx() to a work queue
  - iommu/vt-d: Fix double list_add when enabling VMD in scalable mode
  - nilfs2: fix potential oob read in nilfs_btree_check_delete()
  - !12271  drm/amdgpu: fix mc_data out-of-bounds read warning
  - tracing: Free buffers when a used dynamic event is removed
  - tracing: Add tracing_reset_all_online_cpus_unlocked() function
  - !12396  tracing/timerlat: Fix a race during cpuhp processing
  - !12405  CVE-2024-43841
  - drm/client: fix null pointer dereference in drm_client_modeset_probe
  - udf: Fix preallocation discarding at indirect extent boundary
  - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
  - jfs: Fix uaf in dbFreeBits
  - jfs: check if leafidx greater than num leaves per dmap tree
  - btrfs: wait for fixup workers before stopping cleaner kthread during umount
  - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
  - btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
  - wifi: virt_wifi: don't use strlen() in const context
  - wifi: virt_wifi: avoid reporting connection success with wrong SSID
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
  - tracing/timerlat: Fix a race during cpuhp processing
  - mm/swapfile: skip HugeTLB pages for unuse_vma
  - spi: nxp-fspi: fix the KASAN report out-of-bounds bug
  - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
  - usb: dwc3: core: Prevent USB core invalid event buffer address access
  - usb: dwc3: core: Skip setting event buffers for host only controllers
  - of: module: prevent NULL pointer dereference in vsnprintf()
  - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment
  - nfsd: call cache_put if xdr_reserve_space returns NULL
  - !12339  CVE-2023-52855
  - drm/nouveau: prime: fix refcount underflow
  - !12346  CVE-2024-35990
  - i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
  - !12337  ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
  - !12303  soc: qcom: cmd-db: Map shared memory as WC, not WB
  - !12302  media: imon: fix access to invalid resource for the second interface
  - dma: xilinx_dpdma: Fix locking
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
  - ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
  - soc: qcom: cmd-db: Map shared memory as WC, not WB
  - media: imon: fix access to invalid resource for the second interface
  - blk-mq: fix blk_mq_hw_ctx active request accounting
  - drm/amdgpu: fix mc_data out-of-bounds read warning
  - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
  - nilfs2: fix state management in error path of log writing function
  - blk-mq: fix lockdep hardirq warning in __blk_mq_tag_idle()
  - ext4: avoid deadlock in fs reclaim with page writeback


author: Li Nan <linan122@huawei.com> - 5.10.0-136.100.0.181
changelog:
  - !13008  CVE-2024-49950
  - !13050  ext4: fix CVE-2024-47701
  - !13045 [sync] PR-12958:  ext4: update orig_path in ext4_find_extent()
  - !12681  smb: client: fix UAF in async decryption
  - !12990  vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
  - !12995  drm/amd/display: Check BIOS images before it is used
  - !13020  l2tp: prevent possible tunnel refcount underflow
  - !13021  wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
  - !12985 [sync] PR-12781:  uprobes: fix kernel info leak via "[uprobes
  - !13038  drm/shmem-helper: Remove errant put in error path
  - !13037  Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
  - !13036  iio: health: afe4403: Fix oob read in afe4403_read_raw
  - !13035  efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
  - ext4: avoid OOB when system.data xattr changes underneath the filesystem
  - ext4: explicitly exit when ext4_find_inline_entry returns an error
  - ext4: return error on ext4_find_inline_entry
  - ext4: ext4_search_dir should return a proper error
  - ext4: fix RENAME_WHITEOUT handling for inline directories
  - !12902  ext4: fix double brelse() the buffer of the extents path
  - !12898  ext4: aovid use-after-free in ext4_ext_insert_extent()
  - ext4: update orig_path in ext4_find_extent()
  - drm/shmem-helper: Remove errant put in error path
  - !12989  CVE-2022-48966
  - Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
  - iio: health: afe4403: Fix oob read in afe4403_read_raw
  - efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
  - l2tp: prevent possible tunnel refcount underflow
  - !12885  CVE-2024-50016
  - !12836  ASoC: ops: Fix bounds check for _sx controls
  - !12999  f2fs: get rid of online repaire on corrupted directory
  - !12802  ext4: fix slab-use-after-free in ext4_split_extent_at()
  - !12910  fsnotify: fix CVE-2024-47660
  - !12907  io_uring: fix CVE-2024-50060
  - !12880  drm/stm: Avoid use-after-free issues with crtc and plane
  - !12917  tipc: re-fetch skb cb after tipc_msg_validate
  - !12914  CVE-2022-48961
  - !12912  ethernet: aeroflex: fix potential skb leak in greth_init_rings()
  - Bluetooth: L2CAP: Fix uaf in l2cap_connect
  - Bluetooth: Return whether a connection is outbound
  - !12945  fix CVE-2024-47723
  - !12951  drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
  - !12955  memcg_write_event_control(): fix a user-triggerable oops
  - !12823  f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
  - !12549  fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
  - !12872  Fix CVE-2024-47703
  - !12894  ext4: avoid use-after-free in ext4_ext_show_leaf()
  - f2fs: get rid of online repaire on corrupted directory
  - !12936  ASoC: soc-pcm: Add NULL check in BE reparenting
  - !12935  gpiolib: fix memory leak in gpiochip_setup_dev()
  - !12956  wifi: cfg80211: fix buffer overflow in elem comparison
  - drm/amd/display: Check BIOS images before it is used
  - vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
  - net: mvneta: Fix an out of bounds check
  - net: mvneta: Prevent out of bounds read in mvneta_config_rss()
  - !12864  CVE-2022-49020
  - !12833  lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
  - !12876  tipc: guard against string buffer overrun
  - !12839  ocfs2: reserve space for inline xattr before attaching reflink tree
  - !12921  ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
  - !12889  drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
  - uprobes: fix kernel info leak via "[uprobes]" vma
  - wifi: cfg80211: fix buffer overflow in elem comparison
  - memcg_write_event_control(): fix a user-triggerable oops
  - !12845  ACPI: sysfs: validate return type of _STR method
  - drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
  - jfs: Fix sanity check in dbMount
  - jfs: fix out-of-bounds in dbNextAG() and diAlloc()
  - !12931  tcp: fix mptcp DSS corruption due to large pmtu xmit
  - !12929  gso: fix udp gso fraglist segmentation after pull from frag_list
  - !12930  RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
  - ASoC: soc-pcm: Add NULL check in BE reparenting
  - gpiolib: fix memory leak in gpiochip_setup_dev()
  - tcp: fix mptcp DSS corruption due to large pmtu xmit
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
  - gso: fix udp gso fraglist segmentation after pull from frag_list
  - !12788  slip: make slhc_remember() more robust against malicious packets
  - !12789  net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
  - !12787  net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
  - !12786  mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  - !12740  r8169: add tally counter fields added with RTL8125
  - !12744  net/xen-netback: prevent UAF in xenvif_flush_hash()
  - !12408  padata: use integer wrap around to prevent deadlock on seq_nr overflow
  - !12379  nfsd: return -EINVAL when namelen is 0
  - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
  - tipc: re-fetch skb cb after tipc_msg_validate
  - net: mdio: fix unbalanced fwnode reference count in mdio_device_release()
  - net: mdio: use device_set_node() to setup both fwnode and of
  - driver core: add a helper to setup both the of_node and fwnode of a device
  - ethernet: aeroflex: fix potential skb leak in greth_init_rings()
  - fsnotify: clear PARENT_WATCHED flags lazily
  - fsnotify: remove unused declaration
  - fsnotify: Fix comment typo
  - io_uring: check if we need to reschedule during overflow flush
  - io_uring: always lock __io_cqring_overflow_flush
  - ext4: fix double brelse() the buffer of the extents path
  - ext4: aovid use-after-free in ext4_ext_insert_extent()
  - ext4: avoid use-after-free in ext4_ext_show_leaf()
  - drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
  - drm/amd/display: Avoid overflow assignment in link_dp_cts
  - drm/stm: Avoid use-after-free issues with crtc and plane
  - tipc: guard against string buffer overrun
  - bpf, lsm: Add check for BPF LSM return value
  - bpf, lsm: Add disabled BPF LSM hook list
  - net/9p: Fix a potential socket leak in p9_socket_open
  - !12811  serial: protect uart_port_dtr_rts() in uart_shutdown() too
  - !12819  iio: health: afe4404: Fix oob read in afe4404_[read|write
  - !12828  drm/amd/display: Check null pointers before using them
  - !12797  uprobe: avoid out-of-bounds memory access of fetching args
  - ACPI: sysfs: validate return type of _STR method
  - ocfs2: reserve space for inline xattr before attaching reflink tree
  - !12692 [sync] PR-12354: Backport important bugfix from the kernel-5.10.y
  - ASoC: ops: Fix bounds check for _sx controls
  - !12796  platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
  - !12765  thermal: core: Reference count the zone in thermal_zone_get_by_id()
  - !12660  nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
  - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
  - !12763  CVE-2024-50063
  - !12487  gtp: fix a potential NULL pointer dereference
  - !12761  smack: tcp: ipv4, fix incorrect labeling
  - !12779  riscv: Sync efi page table's kernel mappings before switching
  - drm/amd/display: Check null pointers before using them
  - f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
  - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
  - !12687 [sync] PR-12672:  ocfs2: remove unreasonable unlock in ocfs2_read_blocks
  - serial: protect uart_port_dtr_rts() in uart_shutdown() too
  - ext4: fix slab-use-after-free in ext4_split_extent_at()
  - uprobe: avoid out-of-bounds memory access of fetching args
  - platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
  - net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
  - slip: make slhc_remember() more robust against malicious packets
  - net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  - riscv: Sync efi page table's kernel mappings before switching
  - !12552  cifs: Fix buffer overflow when parsing NFS reparse points
  - !12714  drm: omapdrm: Add missing check for alloc_ordered_workqueue
  - !12706  fix CVE-2024-49924
  - thermal: core: Reference count the zone in thermal_zone_get_by_id()
  - !12731  net: phy: fix null-ptr-deref while probe() failed
  - !12722  ppp: fix ppp_async_encode() illegal access
  - !12555  NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
  - selftests/bpf: Add test for lsm tail call
  - bpf: Prevent tail call between progs attached to different hooks
  - smack: tcp: ipv4, fix incorrect labeling
  - !12734  CVE-2024-50059
  - !12404  fix CVE-2024-49954
  - !12367  fix CVE-2022-49011
  - !12518  fix CVE-2024-47742
  - !12664 v2  CVE-2024-49955
  - !12684  block: fix potential invalid pointer dereference in blk_add_partition
  - net/xen-netback: prevent UAF in xenvif_flush_hash()
  - !12696  mm: memcg: don't periodically flush stats when memcg is disabled
  - !12695  crypto: xor - fix template benchmarking
  - r8169: add tally counter fields added with RTL8125
  - !12702  vhost_vdpa: assign irq bypass producer token correctly
  - ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
  - net: phy: fix null-ptr-deref while probe() failed
  - ppp: fix ppp_async_encode() illegal access
  - !12520  ipv6: avoid use-after-free in ip6_fragment()
  - !12677  CVE-2024-47673
  - !12675  IB/core: Fix ib_cache_setup_one error flow cleanup
  - drm: omapdrm: Add missing check for alloc_ordered_workqueue
  - fbdev: pxafb: Fix possible use after free in pxafb_task()
  - vhost_vdpa: assign irq bypass producer token correctly
  - !12643  Bluetooth: Fix crash when replugging CSR fake controllers
  - !12500  nbd: fix race between timeout and normal completion
  - !12609  blk_iocost: fix more out of bound shifts
  - mm: memcg: don't periodically flush stats when memcg is disabled
  - crypto: xor - fix template benchmarking
  - crypto: xor - Fix typo of optimization
  - scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
  - scsi: mpt3sas: Remove scsi_dma_map() error messages
  - ocfs2: remove unreasonable unlock in ocfs2_read_blocks
  - block: fix potential invalid pointer dereference in blk_add_partition
  - smb: client: fix UAF in async decryption
  - wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
  - iwlwifi: mvm: move iwl_mvm_stop_device() out of line
  - IB/core: Fix ib_cache_setup_one error flow cleanup
  - ACPI: battery: Fix possible crash when unregistering a battery hook
  - ACPI: battery: Simplify battery hook locking
  - nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
  - Bluetooth: Fix crash when replugging CSR fake controllers
  - blk_iocost: fix more out of bound shifts
  - NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
  - cifs: Fix buffer overflow when parsing NFS reparse points
  - fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
  - ipv6: avoid use-after-free in ip6_fragment()
  - firmware_loader: Block path traversal
  - nbd: fix race between timeout and normal completion
  - gtp: fix a potential NULL pointer dereference
  - padata: use integer wrap around to prevent deadlock on seq_nr overflow
  - static_call: Replace pointless WARN_ON() in static_call_module_notify()
  - nfsd: return -EINVAL when namelen is 0
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()


author: Li Nan <linan122@huawei.com> - 5.10.0-136.101.0.182
changelog:
  - !13152  xfrm: validate new SA's prefixlen using SA family when sel.family is unset
  - !13153  tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  - !13155  RDMA/mad: Improve handling of timed out WRs of mad agent
  - !13166  CVE-2024-50133
  - !13163  Fix 'cgroup/cpuset: Prevent UAF in proc_cpuset_show()' issue with commmunity patches
  - LoongArch: Don't crash in stack_top() for tasks without vDSO
  - cgroup: add cgroup_root_ext to keep kabi
  - cgroup/cpuset: Prevent UAF in proc_cpuset_show()
  - cgroup: Make operations on the cgroup root_list RCU safe
  - Revert "cgroup: fix uaf when proc_cpuset_show"
  - RDMA/mad: Improve handling of timed out WRs of mad agent
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset
  - !13123  blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
  - !13145  tracing: Consider the NULL character when validating the event length
  - tracing: Consider the NULL character when validating the event length
  - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
  - !12967  : ext4: no need to continue when the number of entries is 1
  - !12964  ext4: fix timer use-after-free on failed mount
  - !12966  ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
  - !12963  ext4: fix i_data_sem unlock order in ext4_ind_migrate()
  - !12961  exfat: fix memory leak in exfat_load_bitmap()
  - !12962  ext4: fix access to uninitialised lock in fc replay path
  - !12965  vfs: fix race between evice_inodes() and find_inode()&iput()
  - !13090  bpf, net: Fix a potential race in do_sock_getsockopt()
  - !13102  thunderbolt: Mark XDomain as unplugged when router is removed
  - !13100  pinctrl: single: fix potential NULL dereference in pcs_get_function()
  - !13104  CVE-2024-49878
  - resource: fix region_intersects() vs add_memory_driver_managed()
  - thunderbolt: Mark XDomain as unplugged when router is removed
  - pinctrl: single: fix potential NULL dereference in pcs_get_function()
  - !13065 [sync] PR-12984: [OLK-5.10] Backport scsi bugfix and cleancode from upstream
  - bpf, net: Fix a potential race in do_sock_getsockopt()
  - !13070  f2fs: fix to check atomic_file in f2fs ioctl interfaces
  - !13071  static_call: Handle module init failure correctly in static_call_del_module()
  - !13058  net: add more sanity checks to qdisc_pkt_len_init()
  - !13059  net: avoid potential underflow in qdisc_pkt_len_init() with UFO
  - !13057 [sync] PR-13017:  f2fs: fix to wait dio completion
  - !13056 [sync] PR-13015:  drm/amd/display: Check stream before comparing them
  - !12946  drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[
  - static_call: Handle module init failure correctly in static_call_del_module()
  - f2fs: fix to check atomic_file in f2fs ioctl interfaces
  - [Backport]scsi: libsas: Fix disk not being scanned in after being removed
  - [Backport]scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type()
  - [Backport]scsi: libsas: Introduce struct smp_disc_resp
  - net: avoid potential underflow in qdisc_pkt_len_init() with UFO
  - f2fs: fix to wait dio completion
  - drm/amd/display: Check stream before comparing them
  - net: add more sanity checks to qdisc_pkt_len_init()
  - ext4: no need to continue when the number of entries is 1
  - ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
  - vfs: fix race between evice_inodes() and find_inode()&iput()
  - ext4: fix timer use-after-free on failed mount
  - ext4: fix i_data_sem unlock order in ext4_ind_migrate()
  - ext4: fix access to uninitialised lock in fc replay path
  - exfat: fix memory leak in exfat_load_bitmap()
  - drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]


author: Li Nan <linan122@huawei.com> - 5.10.0-136.102.0.183
changelog:
  - !13199  fs/ntfs3: Additional check in ntfs_file_release
  - !13284  wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
  - !13279  mailbox: bcm2835: Fix timeout during suspend mode
  - !13302  CVE-2024-50195
  - !13229  fs/ntfs3: Fix possible deadlock in mi_read
  - !13228  fs/ntfs3: Check if more than chunk-size bytes are written
  - !13224  fs/ntfs3: Add rough attr alloc_size check
  - !13191  net/ncsi: Disable the ncsi work before freeing the associated structure
  - !13195  fix CVE-2024-50115
  - posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
  - posix-clock: Fix missing timespec64 check in pc_clock_settime()
  - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
  - !13272 v2  scsi: libsas: Add smp_ata_check_ready_type()
  - !13175  bpf: Use raw_spinlock_t in ringbuf
  - mailbox: bcm2835: Fix timeout during suspend mode
  - !13262  bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
  - !13208 [sync] PR-13146:  arm64: probes: Remove broken LDR (literal) uprobe support
  - scsi: libsas: Add smp_ata_check_ready_type()
  - bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
  - !13232  Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
  - !9720  firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - !9095 [sync] PR-8747:  dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - !13223  e100: Fix possible use after free in e100_xmit_prepare
  - !13222  aoe: fix the potential use-after-free problem in more places
  - !13220  scsi: pm80xx: Set phy->enable_completion only when we wait for it
  - !13238  staging: iio: frequency: ad9834: Validate frequency parameter value
  - !13247  CVE-2022-48878
  - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
  - Bluetooth: hci_qca: Fixed issue during suspend
  - Bluetooth: hci_qca: check for SSR triggered flag while suspend
  - Bluetooth: hci_qca: Wait for SSR completion during suspend
  - Bluetooth: hci_qca: Fix driver shutdown on closed serdev
  - Bluetooth: hci_qca: Wait for timeout during suspend
  - Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
  - !12374  wifi: mac80211: fix NULL dereference at band check in starting tx ba session
  - !8793  netfilter: nf_tables: honor table dormant flag from netdev release event path
  - staging: iio: frequency: ad9834: Validate frequency parameter value
  - !13147  CVE-2022-48953
  - Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
  - !13200  iio: light: veml6030: fix IIO device retrieval from embedded device
  - fs/ntfs3: Fix possible deadlock in mi_read
  - fs/ntfs3: Check if more than chunk-size bytes are written
  - fs/ntfs3: Add rough attr alloc_size check
  - e100: Fix possible use after free in e100_xmit_prepare
  - aoe: fix the potential use-after-free problem in more places
  - scsi: pm80xx: Set phy->enable_completion only when we wait for it
  - !13203 [sync] PR-13186:  virtio_pmem: Check device status before requesting flush
  - !13168  drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe
  - arm64: probes: Remove broken LDR (literal) uprobe support
  - virtio_pmem: Check device status before requesting flush
  - iio: light: veml6030: fix IIO device retrieval from embedded device
  - fs/ntfs3: Additional check in ntfs_file_release
  - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
  - net/ncsi: Disable the ncsi work before freeing the associated structure
  - bpf: Use raw_spinlock_t in ringbuf
  - drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe
  - rtc: cmos: Fix wake alarm breakage
  - rtc: cmos: Fix event handler registration ordering issue
  - wifi: mac80211: fix NULL dereference at band check in starting tx ba session
  - firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - netfilter: nf_tables: honor table dormant flag from netdev release event path


author: ZhengZhenyu <zhengzhenyu@openeuler.sh> - 13.12-1
changelog:
  - aupgrade libpq to 13.12,fix CVE-2023-2455, CVE-2023-2454, CVE-2023-39417, CVE-2023-39418, CVE-2020-21469


author: xinghe <xinghe2@h-partners.com> - 2.74.2-5
changelog:
  - Type:cves
  - ID:CVE-2024-52530 CVE-2024-52531 CVE-2024-52532
  - SUG:NA
  - DESC:fix CVE-2024-52530 CVE-2024-52531 CVE-2024-52532


author: wangkai <13474090681@163.com> - 20240312-1
changelog:
  - Update to 20240312 for fix CVE-2023-38575, CVE-2023-39368,
    CVE-2023-22655, CVE-2023-43490, CVE-2023-28746


author: Funda Wang <fundawang@yeah.net> - 20240813-1
changelog:
  - update to 20240813 for fix CVE-2024-24853, CVE-2024-25939,
    CVE-2024-24980, CVE-2023-42667, CVE-2023-49141


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-0
changelog:
  - Add support for openEuler 20.03 LTS SP4, openEuler 22.03 LTS SP2, openEuler 22.03 LTS SP3
  - Add modifications to Kylinsec with oec-hardware
  - Add support for Loongson and SW architectures
  - Bugfix


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Add virtual cases
  - Resolve IB startup IB_Read_BW service failure issue
  - Delete redundant references
  - Resolve incorrect type in vgpu result data
  - Resolve the issue of getting the kernel source rpm


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Resolve kdump\watchdog\cpufreq\kabiwhitelist\network test failure issue 
  - Add fio test cases:read,write,randread,randwrite
  - Solve the nvme line break issue in the command line interface
  - Fix compilation errors in the make command
  - Add Vulkan testcase for nvida GPU
  - Resolve the issue of oech server startup failure on version 24.03


author: xiaochn <xiaochuannan@inspur.com> - 1.1.5-3
changelog:
  - Resolve the issue of different kernel source download locations in kabi test case
  - Resolve the issue that kabiwhitelist still passes when the ko and rpm file does not exist
  - Add the way for manually adding kabiwhitelist file
  - For custom vendors, refer to the method of obtaining openEuler os information
  - Supports custom vendor


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-0
changelog:
  - Add new test suite srpm and intel
  - Add virtual branch of test suite
  - Add support for Kylin and UOS
  - Bugfix


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-3
changelog:
  - Update the pci.ids file
  - Remove unused variable in cdrom test suite
  - Update test_guide doc
  - Unify the location for downloading kernel source RPMs
  - Optimize kabiwhitelist and system test


author: dillon chen <dillon.chen@gmail.com> - 13.3-8
changelog:
  - Fix build error for loongarch64
  - Fix issue: confilct between libpq-devel and postgresql-devel
  - guess init spec from redhat
  - change redhat spec:rm private package and add files to server-devel
  - so add delete lines to Fix issue
  - Next: write oe libpq and postgresql spec by myself


author: chenyaqiang <chengyaqiang@huawei.com> - 1:9.0.96-1
changelog:
  - Update to 9.0.96
  - Fix CVE-2021-43980 CVE-2022-25762 CVE-2023-44487 CVE-2023-46589
    CVE-2024-23672 CVE-2024-24549 CVE-2024-34750


