# changelog

author: shixuantong <shixuantong1@huawei.com> - 21.4-28
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:disable use-dns for secondary nics
         Make duplicate route add succeed
         Fix predictable interface rename issue


author: dongyuzhen <dongyuzhen@h-partners.com> - 21.4-29
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix(net): klibc ipconfig PROTO compatibility
         fix(openstack): Fix bond mac_address


author: shixuantong <shixuantong1@huawei.com> - 21.4-32
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:chore: set recursive=False for ensure_dir if parent path is "/"
         test(openstack): Test bond mac address
         fix: Ensure properties for bonded interfaces are properly translated


author: hantwofish <yinbin8@huawei.com> - 1.0.2-73
changelog:
  - xdp: support XDP_STATISTICS by posix_api->getsockopt_fn
  - add SO_NUMA_ID(optname) for adapting opneGauss
  - remove the unused return variable.
  - Fix annotation errors
  - bugfix: start fail when executing the popen command for the second time in openGauss


author: yinbin <jiangheng14@huawei.com> - 1.0.2-74
changelog:
  - LOG: Optimize some log displays
  - remove: code about nobolck mode for mysql
  - interrupt: fix timeout events cannot be counted


author: yinbin <yinbin8@huawei.com> - 1.0.2-77
changelog:
  - openGauss: support kernel connnect
  - xdp: support stack bind numa
  - CFG: fix xdp iface check error
  - fix build error in 2003SP4
  - cfg: show dpdk args after dpdk_adjust_args
  - fix free null pointer when no matching device is found
  - update test/unitest/ltran/ltran_param_test.c.
  - Fix the wrong spelling description in the notes and logs
  - LWIP: adjust position of shutdown in callback of connect
  - fix socket of control thread is overwirtten due to another primary process start


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-79
changelog:
  - cfg: notify that it's unsupported, when stack_num > 1
  - fix errno == ETIMEFOUT
  - fix epoll and recv threads blocked on the same semaphore. data cannot be read in recv thread.
  - fix rpc pool leak, when thread exits
  - remove app_bind_numa check from exclude_cpus
  - openGauss: fix connection attempt failed
  - openGauss: fix gs_ctl switchover failed


author: shixuantong <shixuantong1@huawei.com> - 2.34-157
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:enable shared library use huge page for aarch64 architecture
         revert "elf/ld.so: use special mmap for hugepage to get symbols"
         hugepageedit: static-link build
         elf: the hugepage feature of dynamic library keep compatible with llvm lld
         elf: add some debug info for dynamic library hugepage feature


author: chengyechun <chengyechun1@huawei.com> - 2.34-160
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:resolv: Track single-request fallback via _res._flags
         resolv: Allow short error responses to match any query


author: shixuantong <shixuantong1@huawei.com> - 2.34-162
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:elf: avoid jumping over a needed declaration
         elf: Move __rtld_malloc_init_stubs call into _dl_start_final


author: shixuantong <shixuantong1@huawei.com> - 2.34-163
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:elf: Handle static PIE with non-zero load address
         elf: Introduce _dl_relocate_object_no_relro
         elf: Switch to main malloc after final ld.so self-relocation


author: xinghe <xinghe2@h-partners.com> - 2.6.6-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:connection: Clear flags when a conn is removed
         connection: Preserve flags when a conn is removed
         stream: do not try to free a failed stream-conn
         http_ana/txn: don't re-initialize txn and req var
         mworker: prevent incorrect values in uptime
         protocol: fix minor memory leak in protocol_bind_all()
         stream: Perform errors handling in right order in stream_new()


author: xinghe <xinghe2@h-partners.com> - 2.6.6-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:backport to fix potential coredump:
         errors: handle malloc failure in usermsgs_put
         ssl_sock: add check for ha_meth
         thread: add a check for pthread_creat


author: xinghe <xinghe2@h-partners.com> - 2.6.6-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:server: add missing free for server->rdr_pfx
         server: do not leak default-server in defaults


author: xinghe <xinghe2@h-partners.com> - 2.6.6-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:server: 'source' interface ignored from 'default-server' directive


author: xinghe <xinghe2@h-partners.com> - 2.6.6-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:haproxy: only tid 0 must not sleep if got signal
         fix timehopping in freq_ctr_total


author: xinghe <xinghe2@h-partners.com> - 2.6.6-13
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:stream: Prevent mux upgrades if client connection is no longer ready


author: gaoxingwang <gaoxingwang1@huawei.com> - 1:5.15.0-11
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:add epoch version in changelog to fix check_spec_file ci failure


author: gaoxingwang <gaoxingwang1@huawei.com> - 1:5.15.0-14
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:ipnetns: fix fd leak with 'ip netns set'
         iproute2: optimize code and fix some mem-leak risk
         iproute_lwtunnel: fix array boundary check
         iproute_lwtunnel: fix possible use of NULL when malloc()
         m_action: fix warning of overwrite of const string
         netem: fix NULL deref on allocation failure
         nstat: fix potential NULL deref
         rdma/utils: fix some analyzer warnings
         rt_names: check for malloc() failure
         tc/prio: handle possible truncated kernel response
         tc_exec: don't dereference NULL on calloc failure
         tc_util fix unitialized warning
         iptunnel: detect protocol mismatch on tunnel change
         ipmaddr: fix dereference of NULL on malloc() failure


author: gaoxingwang <gaoxingwang1@huawei.com> - 1:5.15.0-16
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:libnetlink: Fix memory leak in __rtnl_talk_iov()
         tc: ct: Fix invalid pointer dereference
         tc_util: Change datatype for maj to avoid overflow issue
         tc_util: Fix no error return when large parent id used
         xfrm: prepare state offload logic to set mode


author: liubo335 <liubo335@huawei.com> - 1:5.15.0-17
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:f_flower: Treat port 0 as valid
         ip: error out if iplink does not consume all options
         iplink_bridge: fix incorrect root id dump
         ss: change aafilter port from int to long (inode support)
         ss: Fix socket type check in packet_show_line()
         ss: print unix socket "ports" as unsigned int (inode)
         Add utility to convert an unsigned int to string
         Add get_long utility and adapt get_integer accordingly
         utils: fix get_integer() logic


author: Li Nan <linan122@huawei.com> - 5.10.0-136.96.0.177
changelog:
  - !12070 [sync] PR-12050:  um: line: always fill *error_out in setup_one_line()
  - !11965  drm/amd/pm: Fix negative array index read
  - !12060  CVE-2024-46857
  - !12047  perf/x86/intel: Limit the period on Haswell
  - um: line: always fill *error_out in setup_one_line()
  - !12041 [sync] PR-12032:  serial: sc16is7xx: fix invalid FIFO access with special register set
  - !12042 [sync] PR-12002:  drm/amd/display: Assign linear_pitch_alignment even for VM
  - !12021  drm/amd/display: Check gpio_id before used as array index
  - !12025  ASoC: meson: axg-card: fix 'use-after-free'
  - !11991 [sync] PR-11941:  usb: typec: ucsi: Fix null pointer dereference in trace
  - !11990 [sync] PR-11939:  of/irq: Prevent device address out-of-bounds read in interrupt map walk
  - !12035  ksmbd: discard write access to the directory open
  - !12037  drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
  - net/mlx5: Fix bridge mode operations when there are no VFs
  - net/mlx5: E-switch, Introduce flag to indicate if fdb table is created
  - !11996  drm/amd/display: Add array index check for hdcp ddc access
  - !12010  rtmutex: Drop rt_mutex::wait_lock before scheduling
  - perf/x86/intel: Limit the period on Haswell
  - drm/amd/display: Assign linear_pitch_alignment even for VM
  - serial: sc16is7xx: fix invalid FIFO access with special register set
  - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
  - ksmbd: discard write access to the directory open
  - ASoC: meson: axg-card: fix 'use-after-free'
  - !11872 [sync] PR-11817:  uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  - drm/amd/display: Check gpio_id before used as array index
  - !12001  nvmet-tcp: fix kernel crash if commands allocation fails
  - rtmutex: Drop rt_mutex::wait_lock before scheduling
  - !11911  ksmbd: unset the binding mark of a reused connection
  - !11988 [sync] PR-11938:  KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
  - nvmet-tcp: fix kernel crash if commands allocation fails
  - drm/amd/display: Add array index check for hdcp ddc access
  - !11934 [sync] PR-11925:  nilfs2: protect references to superblock parameters exposed in sysfs
  - !11978  CVE-2024-46814
  - !11932 [sync] PR-11875:  btrfs: handle errors from btrfs_dec_ref() properly
  - usb: typec: ucsi: Fix null pointer dereference in trace
  - of/irq: Prevent device address out-of-bounds read in interrupt map walk
  - KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
  - drm/amd/display: Check msg_id before processing transcation
  - drm/amd/pm: Fix negative array index read
  - !11955  Fix CVE-2024-44958 5.10
  - !11743 [sync] PR-11693:  Fix CVE-2024-39501
  - !11947  btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
  - sched/smt: Fix unbalance sched_smt_present dec/inc
  - sched/smt: Introduce sched_smt_present_inc/dec() helper
  - !11917  ethtool: check device is present when getting link settings
  - !11937  btrfs: remove NULL transaction support for btrfs_lookup_extent_info()
  - !11923  hwmon: (lm95234) Fix underflows seen when writing limit attributes
  - btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
  - btrfs: remove NULL transaction support for btrfs_lookup_extent_info()
  - nilfs2: protect references to superblock parameters exposed in sysfs
  - btrfs: handle errors from btrfs_dec_ref() properly
  - !11841  fix CVE-2024-46771
  - !11913 [sync] PR-11890:  hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
  - hwmon: (lm95234) Fix underflows seen when writing limit attributes
  - ethtool: check device is present when getting link settings
  - !11793  ALSA: line6: Fix racy access to midibuf
  - !11868  pktgen: use cpus_read_lock() in pg_net_init()
  - !11892 [sync] PR-11866: v2  drm/amd/display: Ensure index calculation will not overflow
  - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
  - ksmbd: unset the binding mark of a reused connection
  - !11869  VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  - !11904  scsi: aacraid: Fix double-free on probe failure
  - scsi: aacraid: Fix double-free on probe failure
  - !11886  pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  - !11873 [sync] PR-11494:  ext4: Fix race in buffer_head read fault injection
  - !11880  PCI: Add missing bridge lock to pci_bus_lock()
  - !11879  usb: dwc3: st: fix probed platform device ref count on probe error path
  - !11739 [sync] PR-11625:  smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
  - !11851  usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
  - !11849  bcache: fix variable length array abuse in btree_iter
  - !11833  scsi: bfa: Ensure the copied buf is NUL terminated
  - !11832  enic: Validate length of nl attributes in enic_set_vf_port
  - !11831  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  - !11830  ALSA: usb-audio: Stop parsing channels bits when all channels are found.
  - drm/amd/display: Ensure index calculation will not overflow
  - !11827  CVE-2024-46781
  - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  - !11829 v2  drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
  - PCI: Add missing bridge lock to pci_bus_lock()
  - usb: dwc3: st: fix probed platform device ref count on probe error path
  - !11858 v2  Fix CVE-2024-45025
  - !11768 [sync] PR-11733:  Input: MT - limit max slots
  - !11846  bpf: verifier: prevent userspace memory access
  - ext4: Fix race in buffer_head read fault injection
  - !11750  ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
  - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  - !11853 [sync] PR-11815:  selinux,smack: don't bypass permissions check in inode_setsecctx hook
  - VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  - pktgen: use cpus_read_lock() in pg_net_init()
  - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
  - s390/cio: rename bitmap_size() -> idset_bitmap_size()
  - bitmap: introduce generic optimized bitmap_size()
  - fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64()
  - tools: move alignment-related macros to new <linux/align.h>
  - !11676  wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
  - !11674  netem: fix return value if duplicate enqueue fails
  - !11808  apparmor: fix possible NULL pointer dereference
  - !11807  drm/amdgpu: Fix out-of-bounds write warning
  - !11735  fix CVE-2024-46777 for SP1
  - !11684  binder: fix UAF caused by offsets overwrite
  - !11778 [sync] PR-11729:  scsi: qedi: Fix crash while reading debugfs attribute
  - !11779 [sync] PR-11730:  media: xc2028: avoid use-after-free in load_firmware_cb()
  - !11782 [sync] PR-11728:  lib: objagg: Fix general protection fault
  - !11781 [sync] PR-11727:  jfs: fix null ptr deref in dtInsertEntry
  - !11780 [sync] PR-11726:  drm/vmwgfx: Fix a deadlock in dma buf fence polling
  - selinux,smack: don't bypass permissions check in inode_setsecctx hook
  - !11776 [sync] PR-11738:  hwmon: (adc128d818) Fix underflows seen when writing limit attributes
  - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
  - bcache: fix variable length array abuse in btree_iter
  - bpf: verifier: prevent userspace memory access
  - can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
  - can: bcm: Remove proc entry when dev is unregistered.
  - scsi: bfa: Ensure the copied buf is NUL terminated
  - enic: Validate length of nl attributes in enic_set_vf_port
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  - ALSA: usb-audio: Stop parsing channels bits when all channels are found.
  - drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
  - nilfs2: fix missing cleanup on rollforward recovery error
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
  - !11745  powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
  - !11775 [sync] PR-11752:  driver: iio: add missing checks on iio_info's callback access
  - !11800  can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
  - apparmor: fix possible NULL pointer dereference
  - drm/amdgpu: Fix out-of-bounds write warning
  - !11762  sch/netem: fix use after free in netem_dequeue
  - can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
  - ALSA: line6: Fix racy access to midibuf
  - lib: objagg: Fix general protection fault
  - jfs: fix null ptr deref in dtInsertEntry
  - drm/vmwgfx: Fix a deadlock in dma buf fence polling
  - media: xc2028: avoid use-after-free in load_firmware_cb()
  - scsi: qedi: Fix crash while reading debugfs attribute
  - hwmon: (adc128d818) Fix underflows seen when writing limit attributes
  - driver: iio: add missing checks on iio_info's callback access
  - Input: MT - limit max slots
  - sch/netem: fix use after free in netem_dequeue
  - ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
  - powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
  - driver core: Fix uevent_show() vs driver detach race
  - selftests: forwarding: devlink_lib: Wait for udev events after reloading
  - drivers: core: synchronize really_probe() and dev_uevent()
  - smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
  - udf: Avoid excessive partition lengths
  - udf: Define EFSCORRUPTED error code
  - binder: fix UAF caused by offsets overwrite
  - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
  - netem: fix return value if duplicate enqueue fails


author: Li Nan <linan122@huawei.com> - 5.10.0-136.97.0.178
changelog:
  - !12117  CVE-2024-43855
  - !12167  crypto: stm32/cryp - call finalize with bh disabled
  - !12203  spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware
  - !12206 v2  atm: idt77252: prevent use after free in dequeue_rx()
  - !12143  nfc: pn533: Add poll mod list filling check
  - !12150  wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  - atm: idt77252: prevent use after free in dequeue_rx()
  - !12173  fou: remove warn in gue_gro_receive on unsupported protocol
  - !12169  xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
  - spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware
  - !12165  bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
  - fou: remove warn in gue_gro_receive on unsupported protocol
  - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
  - crypto: stm32/cryp - call finalize with bh disabled
  - bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
  - !12120  sched: sch_cake: fix bulk flow accounting logic for host fairness
  - !12119  ice: Add netif_device_attach/detach into PF reset flow
  - !12118  bpf: Remove tst_run from lwt_seg6local_prog_ops.
  - wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  - nfc: pn533: Add poll mod list filling check
  - !12085 [sync] PR-11856:  acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - !12046  s390/dasd: fix error recovery leading to data corruption on ESE devices
  - !12044  s390/sclp: Prevent release of buffer in I/O
  - sched: sch_cake: fix bulk flow accounting logic for host fairness
  - ice: Add netif_device_attach/detach into PF reset flow
  - bpf: Remove tst_run from lwt_seg6local_prog_ops.
  - md: ensure child flush IO does not affect origin bio->bi_status
  - md: Remove flush handling
  - md: fix a crash in mempool_free
  - !12097  netfilter: nft_socket: fix sk refcount leaks
  - !12099  CVE-2024-46858
  - !12098  net: dpaa: Pad packets to ETH_ZLEN
  - !12091  USB: usbtmc: prevent kernel-usb-infoleak
  - mptcp: pm: Fix uaf in __timer_delete_sync
  - mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer
  - mptcp: export lookup_anno_list_by_saddr
  - net: dpaa: Pad packets to ETH_ZLEN
  - netfilter: nft_socket: fix sk refcount leaks
  - USB: usbtmc: prevent kernel-usb-infoleak
  - acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - !12083  drm/i915/gt: Cleanup partial engine discovery failures
  - !12079  btrfs: clean up our handling of refs == 0 in snapshot delete
  - !12054  drm/amdgpu: the warning dereferencing obj for nbio_v7_4
  - drm/i915/gt: Cleanup partial engine discovery failures
  - btrfs: clean up our handling of refs == 0 in snapshot delete
  - drm/amdgpu: the warning dereferencing obj for nbio_v7_4
  - s390/dasd: fix error recovery leading to data corruption on ESE devices
  - s390/sclp: Prevent release of buffer in I/O


author: Li Nan <linan122@huawei.com> - 5.10.0-136.98.0.179
changelog:
  - !12297  CVE-2024-46822
  - !12242 [sync] PR-12227:  nbd: Fix signal handling
  - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
  - arm64: acpi: Move get_cpu_for_acpi_id() to a header
  - !12260  drm/lima: fix a memleak in lima_heap_alloc
  - !12258  media: go7007: fix a memleak in go7007_load_encoder
  - !12259  octeontx2-af: Use separate handlers for interrupts
  - !12256 [sync] PR-12254:  greybus: Fix use-after-free bug in gb_interface_release due to race condition.
  - !12265  drm/amd/display: Avoid overflow from uint32_t to uint8_t
  - drm/amd/display: Avoid overflow from uint32_t to uint8_t
  - !12243 v2  net/mlx5e: Fix netif state handling
  - drm/lima: fix a memleak in lima_heap_alloc
  - octeontx2-af: Use separate handlers for interrupts
  - media: go7007: fix a memleak in go7007_load_encoder
  - greybus: Fix use-after-free bug in gb_interface_release due to race condition.
  - !12221 [sync] PR-12102:  Fix CVE-2024-46826
  - !12156  bonding: Fix CVE-2024-44990
  - !12158  bonding: fix xfrm real_dev null pointer dereference
  - !12157  netfilter: flowtable: initialise extack before use
  - !11298  gpio: prevent potential speculation leaks in gpio_device_get_desc()
  - !8675 [sync] PR-8534:  riscv: process: Fix kernel gp leakage
  - !8674 [sync] PR-8542:  octeontx2-af: Fix possible null pointer dereference.
  - !12161  md/raid1: don't free conf on raid0_run failure
  - !12237  dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
  - !12235  drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
  - net/mlx5e: Fix netif state handling
  - !12184  mlxsw: spectrum_acl_erp: Fix object nesting warning
  - !12183  netns: Make get_net_ns() handle zero refcount net
  - !12180  net/sched: Fix CVE-2024-36244
  - !12177  ipv6: sr: fix invalid unregister error path
  - !12191  wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  - !12192  netfilter: nft_flow_offload: reset dst in route object after setting up flow
  - !12193  tcp: do not accept ACK of bytes we never sent
  - !12194  mlxsw: spectrum_acl_tcam: Fix warning during rehash
  - !12195  i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  - !12196  net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
  - !12211  scsi: qla2xxx: During vport delete send async logout explicitly
  - !12210  platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - nbd: Fix signal handling
  - nbd: Improve the documentation of the locking assumptions
  - !12231 [sync] PR-12208:  Some bugfixs for ubi/fs
  - dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
  - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
  - locks: fix TOCTOU race when granting write lease
  - ubi: block: fix null-pointer-dereference in ubiblock_create()
  - ubi: block: Remove in vain semicolon
  - !12224 [sync] PR-11910:  ext4: dax: Fix inconsistent isize during writing
  - ext4: dax: keep orphan list before truncate overflow allocated blocks
  - ext4: dax: fix overflowing extents beyond inode size when partially writing
  - !12064 [sync] PR-11942:  sbitmap: backport bugfix patches
  - ELF: Fix mixed declarations and code of "snapshot_randomize_va_space"
  - ELF: fix kernel.randomize_va_space double read
  - scsi: qla2xxx: During vport delete send async logout explicitly
  - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
  - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  - mlxsw: spectrum_acl_tcam: Fix warning during rehash
  - tcp: do not accept ACK of bytes we never sent
  - netfilter: nft_flow_offload: reset dst in route object after setting up flow
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  - mlxsw: spectrum_acl_erp: Fix object nesting warning
  - netns: Make get_net_ns() handle zero refcount net
  - net/sched: taprio: extend minimum interval restriction to entire cycle too
  - net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX.
  - ipv6: sr: fix invalid unregister error path
  - md/raid1: don't free conf on raid0_run failure
  - bonding: fix xfrm real_dev null pointer dereference
  - netfilter: flowtable: initialise extack before use
  - bonding: fix null pointer deref in bond_ipsec_offload_ok
  - bonding: fix bond_ipsec_offload_ok return type
  - blk-mq: Fix potential io hung for shared sbitmap per tagset
  - blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
  - sbitmap: fix lockup while swapping
  - sbitmap: Avoid leaving waitqueue in invalid state in __sbq_wake_up()
  - sbitmap: fix possible io hung due to lost wakeup
  - block: Fix lockdep warning in blk_mq_mark_tag_wait
  - blk-mq: fix potential io hang by wrong 'wake_batch'
  - sbitmap: correct wake_batch recalculation to avoid potential IO hung
  - blk-mq: Fix wrong wakeup batch configuration which will cause hang
  - blk-mq: fix tag_get wait task can't be awakened
  - gpio: prevent potential speculation leaks in gpio_device_get_desc()
  - riscv: process: Fix kernel gp leakage
  - octeontx2-af: Fix possible null pointer dereference.


author: Li Nan <linan122@huawei.com> - 5.10.0-136.99.0.180
changelog:
  - !12652  mm/gup: fix gup_pud_range() for dax
  - !12671  drm/amd/display: Fix index out of bounds in degamma hardware format translation
  - !12247  nilfs2: fix state management in error path of log writing function
  - !12647  sock_map: Add a cond_resched() in sock_hash_free()
  - !12646  tcp: check skb is non-NULL in tcp_rto_delta_us()
  - !12645  RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
  - !12644  net: do not delay dst_entries_add() in dst_release()
  - !12630 [sync] PR-12605:  fix CVE-2024-46802
  - !12657  NFSD: Limit the number of concurrent async COPY operations
  - !12636  ALSA: asihpi: Fix potential OOB array access
  - drm/amd/display: Fix index out of bounds in degamma hardware format translation
  - !12274  blk-mq: fix blk_mq_hw_ctx active request accounting
  - !12613  drm/amd/display: Check null pointer before dereferencing se
  - !12622  NFC: nci: Bounds check struct nfc_target arrays
  - !12619  PCI: mt7621: Add sentinel to quirks table
  - !12504  ocfs2: cancel dqi_sync_work before freeing oinfo
  - NFSD: Limit the number of concurrent async COPY operations
  - mm/gup: fix gup_pud_range() for dax
  - !12625  net: ethernet: nixge: fix NULL dereference
  - !12626  libbpf: Handle size overflow for ringbuf mmap
  - sock_map: Add a cond_resched() in sock_hash_free()
  - tcp: check skb is non-NULL in tcp_rto_delta_us()
  - RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
  - net: do not delay dst_entries_add() in dst_release()
  - !12624  hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
  - ALSA: asihpi: Fix potential OOB array access
  - drm/amd/display: fix mixed declarations warning
  - drm/amd/display: added NULL check at start of dc_validate_stream
  - libbpf: Handle size overflow for ringbuf mmap
  - net: ethernet: nixge: fix NULL dereference
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
  - NFC: nci: Bounds check struct nfc_target arrays
  - PCI: mt7621: Add sentinel to quirks table
  - !12602 [sync] PR-12459:  drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
  - !12601 [sync] PR-12453:  drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
  - !12600 [sync] PR-12442:  drm/amd/display: Fix index out of bounds in DCN30 color transformation
  - !12446  nilfs2: fix potential oob read in nilfs_btree_check_delete()
  - !8926  ext4: avoid deadlock in fs reclaim with page writeback
  - drm/amd/display: Check null pointer before dereferencing se
  - !12582  drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
  - !12578  gpio: amd8111: Fix PCI device reference count leak
  - !12456  nfsd: map the EBADMSG to nfserr_io to avoid warning
  - !12564  ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
  - !12561  fix CVE-2024-49900
  - !12562  fix CVE-2024-47667
  - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
  - drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
  - drm/amd/display: Fix index out of bounds in DCN30 color transformation
  - !12450  Fix CVE-2024-26917 and CVE-2024-50025
  - !12544 [sync] PR-12369:  x86/ioapic: Handle allocation failures gracefully
  - drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
  - !12401  drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
  - gpio: amd8111: Fix PCI device reference count leak
  - !12416  btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
  - !12420  nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
  - !12421  udf: Fix preallocation discarding at indirect extent boundary
  - !12419  jfs: Fix uaf in dbFreeBits
  - !12418  jfs: check if leafidx greater than num leaves per dmap tree
  - !12415  btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
  - !12417  btrfs: wait for fixup workers before stopping cleaner kthread during umount
  - !12522  netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
  - !12543  media: pci: cx23885: check cx23885_vdev_init() return
  - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
  - PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
  - PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
  - jfs: Fix uninit-value access of new_ea in ea_buffer
  - x86/ioapic: Handle allocation failures gracefully
  - media: pci: cx23885: check cx23885_vdev_init() return
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
  - !12251  KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
  - !12514  devres: Fix memory leakage caused by driver API devm_free_percpu()
  - !12513  jfs: Fix array-index-out-of-bounds in diFree
  - !12468  mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
  - !12388  spi: nxp-fspi: fix the KASAN report out-of-bounds bug
  - !12386  drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
  - !12381  fix CVE-2024-46675
  - !12364  hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
  - !12447  iommu/vt-d: Fix double list_add when enabling VMD in scalable mode
  - !12463  fix CVE-2024-42301
  - !12489  CVE-2024-40965_openEuler-22.03-LTS-SP1
  - !12481  CVE-2024-41015
  - !12485  CVE-2024-38667
  - !12483  CVE-2024-36286
  - devres: Fix memory leakage caused by driver API devm_free_percpu()
  - !12457  soundwire: cadence: fix invalid PDI offset
  - jfs: Fix array-index-out-of-bounds in diFree
  - ocfs2: cancel dqi_sync_work before freeing oinfo
  - !12430  CVE-2024-43894
  - i2c: lpi2c: Avoid calling clk_get_rate during transfer
  - i2c: imx-lpi2c: return -EINVAL when i2c peripheral clk doesn't work
  - i2c: imx-lpi2c: use bulk clk API
  - clk: Provide !COMMON_CLK dummy for devm_clk_rate_exclusive_get()
  - clk: Add a devm variant of clk_rate_exclusive_get()
  - riscv: prevent pt_regs corruption for secondary idle threads
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
  - ocfs2: add bounds checking to ocfs2_check_dir_entry()
  - !12392  mm/swapfile: skip HugeTLB pages for unuse_vma
  - !12433 v2  Fix CVE-2022-49006
  - !12356 [sync] PR-12334:  drm/nouveau: prime: fix refcount underflow
  - !12359 [sync] PR-12342:  nvmet: fix a possible leak when destroy a ctrl during qp establishment
  - !12371 [sync] PR-12344:  of: module: prevent NULL pointer dereference in vsnprintf()
  - !12352  i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
  - !12222 [sync] PR-12075:  blk-mq: fix lockdep hardirq warning in __blk_mq_tag_idle()
  - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
  - parport: Proper fix for array out-of-bounds access
  - dev/parport: fix the array out-of-bounds risk
  - !12357 [sync] PR-12318:  nfsd: call cache_put if xdr_reserve_space returns NULL
  - soundwire: cadence: fix invalid PDI offset
  - nfsd: map the EBADMSG to nfserr_io to avoid warning
  - scsi: fnic: Move flush_work initialization out of if block
  - scsi: fnic: Move fnic_fnic_flush_tx() to a work queue
  - iommu/vt-d: Fix double list_add when enabling VMD in scalable mode
  - nilfs2: fix potential oob read in nilfs_btree_check_delete()
  - !12271  drm/amdgpu: fix mc_data out-of-bounds read warning
  - tracing: Free buffers when a used dynamic event is removed
  - tracing: Add tracing_reset_all_online_cpus_unlocked() function
  - !12396  tracing/timerlat: Fix a race during cpuhp processing
  - !12405  CVE-2024-43841
  - drm/client: fix null pointer dereference in drm_client_modeset_probe
  - udf: Fix preallocation discarding at indirect extent boundary
  - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
  - jfs: Fix uaf in dbFreeBits
  - jfs: check if leafidx greater than num leaves per dmap tree
  - btrfs: wait for fixup workers before stopping cleaner kthread during umount
  - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
  - btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
  - wifi: virt_wifi: don't use strlen() in const context
  - wifi: virt_wifi: avoid reporting connection success with wrong SSID
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
  - tracing/timerlat: Fix a race during cpuhp processing
  - mm/swapfile: skip HugeTLB pages for unuse_vma
  - spi: nxp-fspi: fix the KASAN report out-of-bounds bug
  - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
  - usb: dwc3: core: Prevent USB core invalid event buffer address access
  - usb: dwc3: core: Skip setting event buffers for host only controllers
  - of: module: prevent NULL pointer dereference in vsnprintf()
  - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment
  - nfsd: call cache_put if xdr_reserve_space returns NULL
  - !12339  CVE-2023-52855
  - drm/nouveau: prime: fix refcount underflow
  - !12346  CVE-2024-35990
  - i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
  - !12337  ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
  - !12303  soc: qcom: cmd-db: Map shared memory as WC, not WB
  - !12302  media: imon: fix access to invalid resource for the second interface
  - dma: xilinx_dpdma: Fix locking
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
  - ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
  - soc: qcom: cmd-db: Map shared memory as WC, not WB
  - media: imon: fix access to invalid resource for the second interface
  - blk-mq: fix blk_mq_hw_ctx active request accounting
  - drm/amdgpu: fix mc_data out-of-bounds read warning
  - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
  - nilfs2: fix state management in error path of log writing function
  - blk-mq: fix lockdep hardirq warning in __blk_mq_tag_idle()
  - ext4: avoid deadlock in fs reclaim with page writeback


author: Li Nan <linan122@huawei.com> - 5.10.0-136.100.0.181
changelog:
  - !13008  CVE-2024-49950
  - !13050  ext4: fix CVE-2024-47701
  - !13045 [sync] PR-12958:  ext4: update orig_path in ext4_find_extent()
  - !12681  smb: client: fix UAF in async decryption
  - !12990  vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
  - !12995  drm/amd/display: Check BIOS images before it is used
  - !13020  l2tp: prevent possible tunnel refcount underflow
  - !13021  wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
  - !12985 [sync] PR-12781:  uprobes: fix kernel info leak via "[uprobes
  - !13038  drm/shmem-helper: Remove errant put in error path
  - !13037  Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
  - !13036  iio: health: afe4403: Fix oob read in afe4403_read_raw
  - !13035  efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
  - ext4: avoid OOB when system.data xattr changes underneath the filesystem
  - ext4: explicitly exit when ext4_find_inline_entry returns an error
  - ext4: return error on ext4_find_inline_entry
  - ext4: ext4_search_dir should return a proper error
  - ext4: fix RENAME_WHITEOUT handling for inline directories
  - !12902  ext4: fix double brelse() the buffer of the extents path
  - !12898  ext4: aovid use-after-free in ext4_ext_insert_extent()
  - ext4: update orig_path in ext4_find_extent()
  - drm/shmem-helper: Remove errant put in error path
  - !12989  CVE-2022-48966
  - Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
  - iio: health: afe4403: Fix oob read in afe4403_read_raw
  - efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
  - l2tp: prevent possible tunnel refcount underflow
  - !12885  CVE-2024-50016
  - !12836  ASoC: ops: Fix bounds check for _sx controls
  - !12999  f2fs: get rid of online repaire on corrupted directory
  - !12802  ext4: fix slab-use-after-free in ext4_split_extent_at()
  - !12910  fsnotify: fix CVE-2024-47660
  - !12907  io_uring: fix CVE-2024-50060
  - !12880  drm/stm: Avoid use-after-free issues with crtc and plane
  - !12917  tipc: re-fetch skb cb after tipc_msg_validate
  - !12914  CVE-2022-48961
  - !12912  ethernet: aeroflex: fix potential skb leak in greth_init_rings()
  - Bluetooth: L2CAP: Fix uaf in l2cap_connect
  - Bluetooth: Return whether a connection is outbound
  - !12945  fix CVE-2024-47723
  - !12951  drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
  - !12955  memcg_write_event_control(): fix a user-triggerable oops
  - !12823  f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
  - !12549  fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
  - !12872  Fix CVE-2024-47703
  - !12894  ext4: avoid use-after-free in ext4_ext_show_leaf()
  - f2fs: get rid of online repaire on corrupted directory
  - !12936  ASoC: soc-pcm: Add NULL check in BE reparenting
  - !12935  gpiolib: fix memory leak in gpiochip_setup_dev()
  - !12956  wifi: cfg80211: fix buffer overflow in elem comparison
  - drm/amd/display: Check BIOS images before it is used
  - vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
  - net: mvneta: Fix an out of bounds check
  - net: mvneta: Prevent out of bounds read in mvneta_config_rss()
  - !12864  CVE-2022-49020
  - !12833  lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
  - !12876  tipc: guard against string buffer overrun
  - !12839  ocfs2: reserve space for inline xattr before attaching reflink tree
  - !12921  ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
  - !12889  drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
  - uprobes: fix kernel info leak via "[uprobes]" vma
  - wifi: cfg80211: fix buffer overflow in elem comparison
  - memcg_write_event_control(): fix a user-triggerable oops
  - !12845  ACPI: sysfs: validate return type of _STR method
  - drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
  - jfs: Fix sanity check in dbMount
  - jfs: fix out-of-bounds in dbNextAG() and diAlloc()
  - !12931  tcp: fix mptcp DSS corruption due to large pmtu xmit
  - !12929  gso: fix udp gso fraglist segmentation after pull from frag_list
  - !12930  RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
  - ASoC: soc-pcm: Add NULL check in BE reparenting
  - gpiolib: fix memory leak in gpiochip_setup_dev()
  - tcp: fix mptcp DSS corruption due to large pmtu xmit
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
  - gso: fix udp gso fraglist segmentation after pull from frag_list
  - !12788  slip: make slhc_remember() more robust against malicious packets
  - !12789  net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
  - !12787  net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
  - !12786  mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  - !12740  r8169: add tally counter fields added with RTL8125
  - !12744  net/xen-netback: prevent UAF in xenvif_flush_hash()
  - !12408  padata: use integer wrap around to prevent deadlock on seq_nr overflow
  - !12379  nfsd: return -EINVAL when namelen is 0
  - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
  - tipc: re-fetch skb cb after tipc_msg_validate
  - net: mdio: fix unbalanced fwnode reference count in mdio_device_release()
  - net: mdio: use device_set_node() to setup both fwnode and of
  - driver core: add a helper to setup both the of_node and fwnode of a device
  - ethernet: aeroflex: fix potential skb leak in greth_init_rings()
  - fsnotify: clear PARENT_WATCHED flags lazily
  - fsnotify: remove unused declaration
  - fsnotify: Fix comment typo
  - io_uring: check if we need to reschedule during overflow flush
  - io_uring: always lock __io_cqring_overflow_flush
  - ext4: fix double brelse() the buffer of the extents path
  - ext4: aovid use-after-free in ext4_ext_insert_extent()
  - ext4: avoid use-after-free in ext4_ext_show_leaf()
  - drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
  - drm/amd/display: Avoid overflow assignment in link_dp_cts
  - drm/stm: Avoid use-after-free issues with crtc and plane
  - tipc: guard against string buffer overrun
  - bpf, lsm: Add check for BPF LSM return value
  - bpf, lsm: Add disabled BPF LSM hook list
  - net/9p: Fix a potential socket leak in p9_socket_open
  - !12811  serial: protect uart_port_dtr_rts() in uart_shutdown() too
  - !12819  iio: health: afe4404: Fix oob read in afe4404_[read|write
  - !12828  drm/amd/display: Check null pointers before using them
  - !12797  uprobe: avoid out-of-bounds memory access of fetching args
  - ACPI: sysfs: validate return type of _STR method
  - ocfs2: reserve space for inline xattr before attaching reflink tree
  - !12692 [sync] PR-12354: Backport important bugfix from the kernel-5.10.y
  - ASoC: ops: Fix bounds check for _sx controls
  - !12796  platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
  - !12765  thermal: core: Reference count the zone in thermal_zone_get_by_id()
  - !12660  nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
  - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
  - !12763  CVE-2024-50063
  - !12487  gtp: fix a potential NULL pointer dereference
  - !12761  smack: tcp: ipv4, fix incorrect labeling
  - !12779  riscv: Sync efi page table's kernel mappings before switching
  - drm/amd/display: Check null pointers before using them
  - f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
  - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
  - !12687 [sync] PR-12672:  ocfs2: remove unreasonable unlock in ocfs2_read_blocks
  - serial: protect uart_port_dtr_rts() in uart_shutdown() too
  - ext4: fix slab-use-after-free in ext4_split_extent_at()
  - uprobe: avoid out-of-bounds memory access of fetching args
  - platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
  - net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
  - slip: make slhc_remember() more robust against malicious packets
  - net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  - riscv: Sync efi page table's kernel mappings before switching
  - !12552  cifs: Fix buffer overflow when parsing NFS reparse points
  - !12714  drm: omapdrm: Add missing check for alloc_ordered_workqueue
  - !12706  fix CVE-2024-49924
  - thermal: core: Reference count the zone in thermal_zone_get_by_id()
  - !12731  net: phy: fix null-ptr-deref while probe() failed
  - !12722  ppp: fix ppp_async_encode() illegal access
  - !12555  NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
  - selftests/bpf: Add test for lsm tail call
  - bpf: Prevent tail call between progs attached to different hooks
  - smack: tcp: ipv4, fix incorrect labeling
  - !12734  CVE-2024-50059
  - !12404  fix CVE-2024-49954
  - !12367  fix CVE-2022-49011
  - !12518  fix CVE-2024-47742
  - !12664 v2  CVE-2024-49955
  - !12684  block: fix potential invalid pointer dereference in blk_add_partition
  - net/xen-netback: prevent UAF in xenvif_flush_hash()
  - !12696  mm: memcg: don't periodically flush stats when memcg is disabled
  - !12695  crypto: xor - fix template benchmarking
  - r8169: add tally counter fields added with RTL8125
  - !12702  vhost_vdpa: assign irq bypass producer token correctly
  - ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
  - net: phy: fix null-ptr-deref while probe() failed
  - ppp: fix ppp_async_encode() illegal access
  - !12520  ipv6: avoid use-after-free in ip6_fragment()
  - !12677  CVE-2024-47673
  - !12675  IB/core: Fix ib_cache_setup_one error flow cleanup
  - drm: omapdrm: Add missing check for alloc_ordered_workqueue
  - fbdev: pxafb: Fix possible use after free in pxafb_task()
  - vhost_vdpa: assign irq bypass producer token correctly
  - !12643  Bluetooth: Fix crash when replugging CSR fake controllers
  - !12500  nbd: fix race between timeout and normal completion
  - !12609  blk_iocost: fix more out of bound shifts
  - mm: memcg: don't periodically flush stats when memcg is disabled
  - crypto: xor - fix template benchmarking
  - crypto: xor - Fix typo of optimization
  - scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
  - scsi: mpt3sas: Remove scsi_dma_map() error messages
  - ocfs2: remove unreasonable unlock in ocfs2_read_blocks
  - block: fix potential invalid pointer dereference in blk_add_partition
  - smb: client: fix UAF in async decryption
  - wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
  - iwlwifi: mvm: move iwl_mvm_stop_device() out of line
  - IB/core: Fix ib_cache_setup_one error flow cleanup
  - ACPI: battery: Fix possible crash when unregistering a battery hook
  - ACPI: battery: Simplify battery hook locking
  - nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
  - Bluetooth: Fix crash when replugging CSR fake controllers
  - blk_iocost: fix more out of bound shifts
  - NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
  - cifs: Fix buffer overflow when parsing NFS reparse points
  - fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
  - ipv6: avoid use-after-free in ip6_fragment()
  - firmware_loader: Block path traversal
  - nbd: fix race between timeout and normal completion
  - gtp: fix a potential NULL pointer dereference
  - padata: use integer wrap around to prevent deadlock on seq_nr overflow
  - static_call: Replace pointless WARN_ON() in static_call_module_notify()
  - nfsd: return -EINVAL when namelen is 0
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()


author: Li Nan <linan122@huawei.com> - 5.10.0-136.101.0.182
changelog:
  - !13152  xfrm: validate new SA's prefixlen using SA family when sel.family is unset
  - !13153  tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  - !13155  RDMA/mad: Improve handling of timed out WRs of mad agent
  - !13166  CVE-2024-50133
  - !13163  Fix 'cgroup/cpuset: Prevent UAF in proc_cpuset_show()' issue with commmunity patches
  - LoongArch: Don't crash in stack_top() for tasks without vDSO
  - cgroup: add cgroup_root_ext to keep kabi
  - cgroup/cpuset: Prevent UAF in proc_cpuset_show()
  - cgroup: Make operations on the cgroup root_list RCU safe
  - Revert "cgroup: fix uaf when proc_cpuset_show"
  - RDMA/mad: Improve handling of timed out WRs of mad agent
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset
  - !13123  blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
  - !13145  tracing: Consider the NULL character when validating the event length
  - tracing: Consider the NULL character when validating the event length
  - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
  - !12967  : ext4: no need to continue when the number of entries is 1
  - !12964  ext4: fix timer use-after-free on failed mount
  - !12966  ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
  - !12963  ext4: fix i_data_sem unlock order in ext4_ind_migrate()
  - !12961  exfat: fix memory leak in exfat_load_bitmap()
  - !12962  ext4: fix access to uninitialised lock in fc replay path
  - !12965  vfs: fix race between evice_inodes() and find_inode()&iput()
  - !13090  bpf, net: Fix a potential race in do_sock_getsockopt()
  - !13102  thunderbolt: Mark XDomain as unplugged when router is removed
  - !13100  pinctrl: single: fix potential NULL dereference in pcs_get_function()
  - !13104  CVE-2024-49878
  - resource: fix region_intersects() vs add_memory_driver_managed()
  - thunderbolt: Mark XDomain as unplugged when router is removed
  - pinctrl: single: fix potential NULL dereference in pcs_get_function()
  - !13065 [sync] PR-12984: [OLK-5.10] Backport scsi bugfix and cleancode from upstream
  - bpf, net: Fix a potential race in do_sock_getsockopt()
  - !13070  f2fs: fix to check atomic_file in f2fs ioctl interfaces
  - !13071  static_call: Handle module init failure correctly in static_call_del_module()
  - !13058  net: add more sanity checks to qdisc_pkt_len_init()
  - !13059  net: avoid potential underflow in qdisc_pkt_len_init() with UFO
  - !13057 [sync] PR-13017:  f2fs: fix to wait dio completion
  - !13056 [sync] PR-13015:  drm/amd/display: Check stream before comparing them
  - !12946  drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[
  - static_call: Handle module init failure correctly in static_call_del_module()
  - f2fs: fix to check atomic_file in f2fs ioctl interfaces
  - [Backport]scsi: libsas: Fix disk not being scanned in after being removed
  - [Backport]scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type()
  - [Backport]scsi: libsas: Introduce struct smp_disc_resp
  - net: avoid potential underflow in qdisc_pkt_len_init() with UFO
  - f2fs: fix to wait dio completion
  - drm/amd/display: Check stream before comparing them
  - net: add more sanity checks to qdisc_pkt_len_init()
  - ext4: no need to continue when the number of entries is 1
  - ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
  - vfs: fix race between evice_inodes() and find_inode()&iput()
  - ext4: fix timer use-after-free on failed mount
  - ext4: fix i_data_sem unlock order in ext4_ind_migrate()
  - ext4: fix access to uninitialised lock in fc replay path
  - exfat: fix memory leak in exfat_load_bitmap()
  - drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]


author: Li Nan <linan122@huawei.com> - 5.10.0-136.102.0.183
changelog:
  - !13199  fs/ntfs3: Additional check in ntfs_file_release
  - !13284  wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
  - !13279  mailbox: bcm2835: Fix timeout during suspend mode
  - !13302  CVE-2024-50195
  - !13229  fs/ntfs3: Fix possible deadlock in mi_read
  - !13228  fs/ntfs3: Check if more than chunk-size bytes are written
  - !13224  fs/ntfs3: Add rough attr alloc_size check
  - !13191  net/ncsi: Disable the ncsi work before freeing the associated structure
  - !13195  fix CVE-2024-50115
  - posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
  - posix-clock: Fix missing timespec64 check in pc_clock_settime()
  - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
  - !13272 v2  scsi: libsas: Add smp_ata_check_ready_type()
  - !13175  bpf: Use raw_spinlock_t in ringbuf
  - mailbox: bcm2835: Fix timeout during suspend mode
  - !13262  bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
  - !13208 [sync] PR-13146:  arm64: probes: Remove broken LDR (literal) uprobe support
  - scsi: libsas: Add smp_ata_check_ready_type()
  - bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
  - !13232  Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
  - !9720  firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - !9095 [sync] PR-8747:  dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - !13223  e100: Fix possible use after free in e100_xmit_prepare
  - !13222  aoe: fix the potential use-after-free problem in more places
  - !13220  scsi: pm80xx: Set phy->enable_completion only when we wait for it
  - !13238  staging: iio: frequency: ad9834: Validate frequency parameter value
  - !13247  CVE-2022-48878
  - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
  - Bluetooth: hci_qca: Fixed issue during suspend
  - Bluetooth: hci_qca: check for SSR triggered flag while suspend
  - Bluetooth: hci_qca: Wait for SSR completion during suspend
  - Bluetooth: hci_qca: Fix driver shutdown on closed serdev
  - Bluetooth: hci_qca: Wait for timeout during suspend
  - Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
  - !12374  wifi: mac80211: fix NULL dereference at band check in starting tx ba session
  - !8793  netfilter: nf_tables: honor table dormant flag from netdev release event path
  - staging: iio: frequency: ad9834: Validate frequency parameter value
  - !13147  CVE-2022-48953
  - Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
  - !13200  iio: light: veml6030: fix IIO device retrieval from embedded device
  - fs/ntfs3: Fix possible deadlock in mi_read
  - fs/ntfs3: Check if more than chunk-size bytes are written
  - fs/ntfs3: Add rough attr alloc_size check
  - e100: Fix possible use after free in e100_xmit_prepare
  - aoe: fix the potential use-after-free problem in more places
  - scsi: pm80xx: Set phy->enable_completion only when we wait for it
  - !13203 [sync] PR-13186:  virtio_pmem: Check device status before requesting flush
  - !13168  drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe
  - arm64: probes: Remove broken LDR (literal) uprobe support
  - virtio_pmem: Check device status before requesting flush
  - iio: light: veml6030: fix IIO device retrieval from embedded device
  - fs/ntfs3: Additional check in ntfs_file_release
  - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
  - net/ncsi: Disable the ncsi work before freeing the associated structure
  - bpf: Use raw_spinlock_t in ringbuf
  - drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe
  - rtc: cmos: Fix wake alarm breakage
  - rtc: cmos: Fix event handler registration ordering issue
  - wifi: mac80211: fix NULL dereference at band check in starting tx ba session
  - firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - netfilter: nf_tables: honor table dormant flag from netdev release event path


author: Li Nan <linan122@huawei.com> - 5.10.0-136.103.0.184
changelog:
  - !13814  nilfs2: fix kernel bug due to missing clearing of checked flag
  - !13457  io_uring: fix CVE-2024-53052
  - !13461  ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
  - !13385  bpf: Fix out-of-bounds write in trie_get_next_key()
  - !13830  fix CVE-2024-50192
  - !13412  udf: fix uninit-value use in udf_get_fileshortad
  - !13801  media: av7110: fix a spectre vulnerability
  - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs
  - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE
  - !13420  btrfs: reinitialize delayed ref list after deleting it from the list
  - !13422  nfs: Fix KMSAN warning in decode_getfattr_attrs()
  - !13811 [sync] PR-13793:  nilfs2: fix potential deadlock with newly created symlinks
  - !13425  media: s5p-jpeg: prevent buffer overflows
  - nilfs2: fix kernel bug due to missing clearing of checked flag
  - nilfs2: fix potential deadlock with newly created symlinks
  - !13798  drm/amd/display: Initialize denominators' default to 1
  - media: av7110: fix a spectre vulnerability
  - drm/amd/display: Initialize denominators' default to 1
  - !13438  net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
  - !13437  netfilter: br_netfilter: fix panic with metadata_dst skb
  - !13434  netfilter: nf_tables: prevent nf_skb_duplicated corruption
  - !13432  wifi: iwlwifi: mvm: avoid NULL pointer dereference
  - !13320  unicode: Don't special case ignorable code points
  - !13380  fbdev: sisfb: Fix strbuf array overflow
  - !13455 [sync] PR-13356:  NFSD: Initialize struct nfsd4_copy earlier
  - ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
  - io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
  - io_uring: use kiocb_{start,end}_write() helpers
  - fs: create kiocb_{start,end}_write() helpers
  - io_uring: rename kiocb_end_write() local helper
  - !13440  RDMA/cxgb4: Added NULL check for lookup_atid
  - !13442  net: netfilter: Fix CVE-2024-50038
  - !13445  RDMA/rtrs-srv: Avoid null pointer deref during path establishment
  - !13431  xen-netfront: Fix NULL sring after live migration
  - !13430  RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
  - !13429  SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
  - !13428  bonding: Fix CVE-2023-52784
  - !13427  llc: verify mac len before reading mac header
  - NFSD: Initialize struct nfsd4_copy earlier
  - !13390 [sync] PR-12686:  security/keys: fix slab-out-of-bounds in key_task_permission
  - RDMA/rtrs-srv: Avoid null pointer deref during path establishment
  - netfilter: xtables: fix typo causing some targets not to load on IPv6
  - netfilter: xtables: avoid NFPROTO_UNSPEC where needed
  - RDMA/cxgb4: Added NULL check for lookup_atid
  - net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
  - netfilter: br_netfilter: fix panic with metadata_dst skb
  - netfilter: nf_tables: prevent nf_skb_duplicated corruption
  - wifi: iwlwifi: mvm: avoid NULL pointer dereference
  - xen-netfront: Fix NULL sring after live migration
  - RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
  - bonding: stop the device in bond_setup_by_slave()
  - bonding: reset bond's flags when down link is P2P device
  - llc: verify mac len before reading mac header
  - media: s5p-jpeg: prevent buffer overflows
  - nfs: Fix KMSAN warning in decode_getfattr_attrs()
  - btrfs: reinitialize delayed ref list after deleting it from the list
  - udf: fix uninit-value use in udf_get_fileshortad
  - !13388  usb: musb: sunxi: Fix accessing an released usb phy
  - !13393  CVE-2024-47745
  - !13369  CVE-2024-46713
  - !13342  ntfs3: fix CVE-2024-50248
  - !13348  ceph: remove the incorrect Fw reference check when dirtying pages
  - !13347  nilfs2: propagate directory read errors from nilfs_find_entry()
  - mm: split critical region in remap_file_pages() and invoke LSMs in between
  - mm: call the security_mmap_file() LSM hook in remap_file_pages()
  - remap_file_pages: Use vma_lookup() instead of find_vma()
  - mm/mmap.c: don't unlock VMAs in remap_file_pages()
  - !13330  tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
  - security/keys: fix slab-out-of-bounds in key_task_permission
  - usb: musb: sunxi: Fix accessing an released usb phy
  - bpf: Fix out-of-bounds write in trie_get_next_key()
  - fbdev: sisfb: Fix strbuf array overflow
  - !13304  ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
  - perf: Fix kabi problem by put mutex in front of perf_buffer
  - perf/aux: Fix AUX buffer serialization
  - !13311  fs/ntfs3: Additional check in ni_clear()
  - ceph: remove the incorrect Fw reference check when dirtying pages
  - nilfs2: propagate directory read errors from nilfs_find_entry()
  - !13339  smb: client: fix OOBs when building SMB2_IOCTL request
  - fs/ntfs3: Sequential field availability check in mi_enum_attr()
  - ntfs3: Add bounds checking to mi_enum_attr()
  - smb: client: fix OOBs when building SMB2_IOCTL request
  - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
  - unicode: Don't special case ignorable code points
  - fs/ntfs3: Additional check in ni_clear()
  - ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()


author: Li Nan <linan122@huawei.com> - 5.10.0-136.104.0.185
changelog:
  - !14034  xfs: Fix data overflow in xfs_mod_fdblocks()
  - !14016  *** CVE-2024-53063 ***
  - !13957  fs: Fix uninitialized value issue in from_kuid and from_kgid
  - xfs: Fix data overflow in xfs_mod_fdblocks()
  - !13336  fix CVE-2024-50135
  - !13944  net/sched: accept TCA_STAB only for root qdisc
  - !13939  wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
  - !13947  ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
  - !13946  wifi: rtw88: always wait for both firmware loading attempts
  - !13945  Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
  - !13943  net: ethernet: lantiq_etop: fix memory disclosure
  - !13942  net: Fix an unsafe loop on the list
  - !13941  net: stmmac: Fix zero-division error when disabling tc cbs
  - !13940  sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
  - !13938  wifi: ath11k: fix array out-of-bound access in SoC stats
  - media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
  - media: dvbdev: prevent the risk of out of memory access
  - !13840  afs: Fix lock recursion
  - !13907 [sync] PR-13905:  NFSD: Never decrement pending_async_copies on error
  - !13924  wifi: ath10k: Fix memory leak in management tx
  - !13923  RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
  - !13968  bpf: Check validity of link->type in bpf_link_show_fdinfo()
  - bpf: Check validity of link->type in bpf_link_show_fdinfo()
  - fs: Fix uninitialized value issue in from_kuid and from_kgid
  - !13803  pinctrl: ocelot: fix system hang on level based interrupts
  - ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
  - wifi: rtw88: always wait for both firmware loading attempts
  - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
  - net/sched: accept TCA_STAB only for root qdisc
  - net: ethernet: lantiq_etop: fix memory disclosure
  - net: Fix an unsafe loop on the list
  - net: stmmac: Fix zero-division error when disabling tc cbs
  - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
  - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
  - wifi: ath11k: fix array out-of-bound access in SoC stats
  - wifi: ath10k: Fix memory leak in management tx
  - RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
  - !13899  drm/amd/display: Check link_index before accessing dc->links[
  - NFSD: Never decrement pending_async_copies on error
  - !13886  scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths
  - !13863  net: systemport: fix potential memory leak in bcm_sysport_xmit()
  - !13865  Bluetooth: bnep: fix wild-memory-access in proto_unregister
  - !13868  wifi: iwlegacy: Clear stale interrupts before resuming device
  - !13882  RDMA/bnxt_re: Add a check for memory allocation
  - drm/amd/display: Check link_index before accessing dc->links[]
  - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths
  - !13856  CVE-2024-53059
  - !13855  sctp: properly validate chunk size in sctp_sf_ootb()
  - RDMA/bnxt_re: Add a check for memory allocation
  - wifi: iwlegacy: Clear stale interrupts before resuming device
  - Bluetooth: bnep: fix wild-memory-access in proto_unregister
  - net: systemport: fix potential memory leak in bcm_sysport_xmit()
  - mac80211: always have ieee80211_sta_restart()
  - wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
  - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
  - mac80211: Add support to trigger sta disconnect on hardware restart
  - mac80211: do drv_reconfig_complete() before restarting all
  - sctp: properly validate chunk size in sctp_sf_ootb()
  - afs: Fix lock recursion
  - pinctrl: ocelot: fix system hang on level based interrupts
  - nvme-pci: fix race condition between reset and nvme_dev_disable()
  - nvme-pci: refactor the tagset handling in nvme_reset_work
  - nvme-pci: split nvme_dev_add


author: Li Nan <linan122@huawei.com> - 5.10.0-136.105.0.186
changelog:
  - !14047  smb: client: Fix use-after-free of network namespace.
  - !14118  bpf: sync_linked_regs() must preserve subreg_def
  - !14125  media: cx24116: prevent overflows on SNR calculus
  - !13826 [sync] PR-13403: some bugfix of ksmbd smb2_open()
  - !13825 [sync] PR-13448: bugfix of nfs
  - media: cx24116: prevent overflows on SNR calculus
  - bpf: sync_linked_regs() must preserve subreg_def
  - !14105  nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
  - !14115  media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
  - !14084  ocfs2: uncache inode which has failed entering the group
  - nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
  - !14032  fix CVE-2024-50278
  - !14093  USB: serial: io_edgeport: fix use after free in debug printk
  - !14078  vp_vdpa: fix id_table array not null terminated error
  - !14074  HID: core: zero-initialize the report buffer
  - !14029  drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
  - !14028  drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
  - !14023  iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
  - !14063  CVE-2024-53054
  - !14050  wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
  - !14052  net: sched: fix use-after-free in taprio_change()
  - !14053  can: bcm: Fix UAF in bcm_proc_show()
  - USB: serial: io_edgeport: fix use after free in debug printk
  - !14081 [sync] PR-13871:  ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
  - ocfs2: uncache inode which has failed entering the group
  - ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
  - !14020  ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
  - !14061 [sync] PR-13948:  fix CVE-2024-49906
  - vp_vdpa: fix id_table array not null terminated error
  - HID: core: zero-initialize the report buffer
  - cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction
  - Revert "cgroup: Fix AA deadlock caused by cgroup_bpf_release"
  - !13996  drm/radeon: Fix encoder->possible_clones
  - drm/amd/display: Check null pointer before try to access it
  - drm/amd/display: Check null pointer before try to access it
  - !13992  fix CVE-2024-49861
  - can: bcm: Fix UAF in bcm_proc_show()
  - net: sched: fix use-after-free in taprio_change()
  - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
  - smb: client: Fix use-after-free of network namespace.
  - dm cache: fix potential out-of-bounds access on the first resume
  - dm cache: optimize dirty bit checking with find_next_bit when resizing
  - dm cache: fix out-of-bounds access to the dirty bitset when resizing
  - drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
  - drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
  - iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
  - ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
  - drm/radeon: Fix encoder->possible_clones
  - bpf: Fix kabi breakage in enum bpf_type_flag
  - selftests/bpf: Rename ARG_PTR_TO_LONG test description
  - selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test
  - bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
  - bpf: Fix helper writes to read-only maps
  - bpf: Remove truncation test in bpf_strtol and bpf_strtoul helpers
  - bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
  - bpf: Allow helpers to accept pointers with a fixed size
  - bpf: Add MEM_UNINIT as a bpf_type_flag
  - ksmbd: fix return value of smb2_open()
  - ksmbd: fix possible refcount leak in smb2_open()
  - NFSv4: check FMODE_EXEC from open context mode in nfs4_opendata_access()
  - NFS: make sure open context mode have FMODE_EXEC when file open for exec


author: zhaoxiaohu <zhaoxiaohu@kuaishou.com> - 20211027-3
changelog:
  - fix build install need use copy-firmware.sh ice Intel(R) E810 Series intel/ice/ddp/ice.pkg -> ice-1.3.26.0.pkg


author: yinbin <yinbin8@huawei.com> - 2.2.0-60
changelog:
  - IPV6: Enable IPV6_FRAG_COPYHEADER macro to adapt 64bit
  - IPV6: fix array out of bounds in function ip6_ntoa_r
  - IPV6: add group check while mld6 schedule a report


author: hankangkang <hankangkang5@huawei.com> - 2.2.0-62
changelog:
  - When the GAZELLE_TCP_REUSE_IPPORT is on, min_cnts_lpcb is NULL
  - Turn on the LWIP_SO-LINGER switch


author: huangyu <huangyu106@huawei.com> - 1:1.0.0-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix string prefix expression must retain original length
  fix release top level scope


author: zhanghao <zhanghao383@huawei.com> - 1:1.0.0-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:evaluate allow implicit ether vlan dep
  evaluate datatype memleak after binop transfer
  evaluate bogus datatype assertion in binary operation evaluation
  netlink delinearize do not transfer binary operation to non anonymous sets
  payload do not kill dependency for proto unknown
  monitor missing cache and set handle initialization
  netlink linearize fix timeout with map updates


author: zhanghao <zhanghao383@huawei.com> - 1:1.0.0-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix potential array out of bounds access
  evaluate: fix shift exponent underflow in concatenation evaluation
  netlink: Fix for potential NULL-pointer deref
  mnl: dump_nf_hooks() leaks memory in error path


author: gaihuiying <eaglegai@163.com> - 1:1.0.0-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: error out if basetypes are different
         evaluate: guard against NULL basetype
         evaluate: handle invalid mapping expressions gracefully
         evaluate: reject attempt to update a set
         evaluate: release mpz type in expr_evaluate_list() error path
         expression: missing line in describe command with invalid expression

  Thu Apr 18 2024 lingsheng <lingsheng1@h-partners.com> - 1:1.0.0-10
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:datatype: don't return a const string from cgroupv2_get_path()
  datatype: fix leak and cleanup reference counting for struct datatype
  datatype: initialize TYPE_CT_EVENTBIT slot in datatype array
  datatype: initialize TYPE_CT_LABEL slot in datatype array
  evaluate: do not remove anonymous set with protocol flags and single element
  evaluate: don't crash if object map does not refer to a value
  evaluate: error out when expression has no datatype
  evaluate: error out when store needs more than one 128bit register of align fixup
  evaluate: fix check for truncation in stmt_evaluate_log_prefix()
  evaluate: fix double free on dtype release
  evaluate: fix memleak in prefix evaluation with wildcard interface name
  evaluate: reject set in concatenation
  evaluate: revisit anonymous set with single element optimization
  evaluate: skip anonymous set optimization for concatenations
  evaluate: stmt_nat: set reference must point to a map
  evaluate: tproxy: move range error checks after arg evaluation
  evaluate: validate chain max length
  evaluate: validate maximum log statement prefix length
  exthdr: fix tcpopt_find_template to use length after mask adjustment
  exthdr: prefer raw_type instead of desc->type
  json: expose dynamic flag
  json: fix use after free in table_flags_json()
  libnftables: Drop cache in -c/--check mode
  meta: fix tc classid parsing out-of-bounds access
  netlink: don't crash if prefix for < byte is requested
  netlink: fix leaking typeof_expr_data/typeof_expr_key in netlink_delinearize_set()
  netlink: handle invalid etype in set_make_key()
  parser_bison: fix ct scope underflow if ct helper section is duplicated
  parser_bison: fix memleak in meta set error handling
  parser_bison: make sure obj_free releases timeout policies
  parser_json: Catch nonsense ops in match statement
  parser_json: Default meter size to zero
  parser_json: Fix flowtable prio value parsing
  parser_json: Fix synproxy object mss/wscale parsing
  parser_json: Fix typo in json_parse_cmd_add_object()
  parser_json: Proper ct expectation attribute parsing
  parser_json: Wrong check in json_parse_ct_timeout_policy()
  py: fix exception during cleanup of half-initialized Nftables
  rule: fix sym refcount assertion


author: gaihuiying <eaglegai@163.com> - 1:1.0.0-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: disable meta set with ranges
         src: reject large raw payload and concat expressions
         evaluate: fix stack overflow with huge priority string
         tcpopt: don't create exthdr expression without datatype
         src: do not allow to chain more than 16 binops
         rule: fix ASAN errors in chain priority to textual names
         tests: shell: add regression test for double-free crash bug
         evaluate: handle invalid mapping expressions in stateful object
         evaluate: Fix incorrect checking the `base` variable in case of IPV6
         netlink: reset temporary set element stmt list after list splice


author: gaihuiying <eaglegai@163.com> - 1:1.0.0-13
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:parser: split tcp option rules
         cache: prepare nft_cache_evaluate() to return error
         ct timeout: fix 'list object x' vs. 'list objects in table' confusion
         ct expectation: fix 'list object x' vs. 'list objects in table' confusion
         tests: shell: connect chains to hook point


author: zhaoxiaohu <zhaoxiaohu@kuaishou.com> - 249-87
changelog:
  - add backport-userdb-Use-json_dispatch_user_group_name-to-parse-Ge.patch
        backport-README-explicitly-note-that-util-linux-s-mount-swap-.patch
        backport-man-fix-section-number.patch
        backport-repart-fix-invalid-errno-in-log.patch
        backport-sysusers-insist-that-root-group-is-0.patch
        backport-importd-Always-specify-file-unpacked-by-tar.patch
        backport-docs-remove-dev-tty-confusion.patch


author: zhaoxiaohu <zhaoxiaohu@kuaishou.com> - 249-88
changelog:
  - wait-online: fix handling of unmanaged state
  - add backport-wait-online-make-manager_link_is_online-return-0-whe.patch


author: zhaoxiaohu <zhaoxiaohu@kuaishou.com> - 249-91
changelog:
  - add backport-cgroup-util-introduce-cg_is_threaded.patch
        backport-core-execute-warn-when-threaded-mode-is-detected.patch


author: huyubiao <huyubiao@huawei.com> - 249-94
changelog:
  - backport upstream patch to solve systemd-shutdown hang all the time caused by fsync blocked by absence of DM mapping table


author: zhangyao <zhangyao108@huawei.com> - 249-95
changelog:
  - add backport-logind-give-better-error-messages-when-failing-to-at.patch
        backport-sd-journal-refuse-entry-objects-with-an-empty-boot-I.patch
        backport-fs-util-readlinkat-supports-an-empty-string.patch
        backport-exec-invoke-correct-dont_close-size.patch
        backport-core-fix-NULL-pointer-dereference-during-deserializa.patch
        backport-core-service-fix-accept-socket-deserialization.patch
        backport-resolved-correct-parsing-of-OPT-extended-RCODEs.patch
        backport-coredump-correctly-take-tmpfs-size-into-account-for-.patch
        backport-sysusers-handle-NSS-errors-gracefully.patch
        backport-shared-log-error-when-execve-fail.patch


