# changelog

author: chenyi <chenyi211@huawei.com> - 21.11-78
changelog:
  Sync some patches from upstream about bugfix, modifies are as follow:
  - bus/pci: fix UIO resource mapping in secondary process


author: Li Nan <linan122@huawei.com> - 5.10.0-136.97.0.178
changelog:
  - !12117  CVE-2024-43855
  - !12167  crypto: stm32/cryp - call finalize with bh disabled
  - !12203  spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware
  - !12206 v2  atm: idt77252: prevent use after free in dequeue_rx()
  - !12143  nfc: pn533: Add poll mod list filling check
  - !12150  wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  - atm: idt77252: prevent use after free in dequeue_rx()
  - !12173  fou: remove warn in gue_gro_receive on unsupported protocol
  - !12169  xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
  - spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware
  - !12165  bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
  - fou: remove warn in gue_gro_receive on unsupported protocol
  - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
  - crypto: stm32/cryp - call finalize with bh disabled
  - bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
  - !12120  sched: sch_cake: fix bulk flow accounting logic for host fairness
  - !12119  ice: Add netif_device_attach/detach into PF reset flow
  - !12118  bpf: Remove tst_run from lwt_seg6local_prog_ops.
  - wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  - nfc: pn533: Add poll mod list filling check
  - !12085 [sync] PR-11856:  acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - !12046  s390/dasd: fix error recovery leading to data corruption on ESE devices
  - !12044  s390/sclp: Prevent release of buffer in I/O
  - sched: sch_cake: fix bulk flow accounting logic for host fairness
  - ice: Add netif_device_attach/detach into PF reset flow
  - bpf: Remove tst_run from lwt_seg6local_prog_ops.
  - md: ensure child flush IO does not affect origin bio->bi_status
  - md: Remove flush handling
  - md: fix a crash in mempool_free
  - !12097  netfilter: nft_socket: fix sk refcount leaks
  - !12099  CVE-2024-46858
  - !12098  net: dpaa: Pad packets to ETH_ZLEN
  - !12091  USB: usbtmc: prevent kernel-usb-infoleak
  - mptcp: pm: Fix uaf in __timer_delete_sync
  - mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer
  - mptcp: export lookup_anno_list_by_saddr
  - net: dpaa: Pad packets to ETH_ZLEN
  - netfilter: nft_socket: fix sk refcount leaks
  - USB: usbtmc: prevent kernel-usb-infoleak
  - acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - !12083  drm/i915/gt: Cleanup partial engine discovery failures
  - !12079  btrfs: clean up our handling of refs == 0 in snapshot delete
  - !12054  drm/amdgpu: the warning dereferencing obj for nbio_v7_4
  - drm/i915/gt: Cleanup partial engine discovery failures
  - btrfs: clean up our handling of refs == 0 in snapshot delete
  - drm/amdgpu: the warning dereferencing obj for nbio_v7_4
  - s390/dasd: fix error recovery leading to data corruption on ESE devices
  - s390/sclp: Prevent release of buffer in I/O


author: Li Nan <linan122@huawei.com> - 5.10.0-136.98.0.179
changelog:
  - !12297  CVE-2024-46822
  - !12242 [sync] PR-12227:  nbd: Fix signal handling
  - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
  - arm64: acpi: Move get_cpu_for_acpi_id() to a header
  - !12260  drm/lima: fix a memleak in lima_heap_alloc
  - !12258  media: go7007: fix a memleak in go7007_load_encoder
  - !12259  octeontx2-af: Use separate handlers for interrupts
  - !12256 [sync] PR-12254:  greybus: Fix use-after-free bug in gb_interface_release due to race condition.
  - !12265  drm/amd/display: Avoid overflow from uint32_t to uint8_t
  - drm/amd/display: Avoid overflow from uint32_t to uint8_t
  - !12243 v2  net/mlx5e: Fix netif state handling
  - drm/lima: fix a memleak in lima_heap_alloc
  - octeontx2-af: Use separate handlers for interrupts
  - media: go7007: fix a memleak in go7007_load_encoder
  - greybus: Fix use-after-free bug in gb_interface_release due to race condition.
  - !12221 [sync] PR-12102:  Fix CVE-2024-46826
  - !12156  bonding: Fix CVE-2024-44990
  - !12158  bonding: fix xfrm real_dev null pointer dereference
  - !12157  netfilter: flowtable: initialise extack before use
  - !11298  gpio: prevent potential speculation leaks in gpio_device_get_desc()
  - !8675 [sync] PR-8534:  riscv: process: Fix kernel gp leakage
  - !8674 [sync] PR-8542:  octeontx2-af: Fix possible null pointer dereference.
  - !12161  md/raid1: don't free conf on raid0_run failure
  - !12237  dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
  - !12235  drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
  - net/mlx5e: Fix netif state handling
  - !12184  mlxsw: spectrum_acl_erp: Fix object nesting warning
  - !12183  netns: Make get_net_ns() handle zero refcount net
  - !12180  net/sched: Fix CVE-2024-36244
  - !12177  ipv6: sr: fix invalid unregister error path
  - !12191  wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  - !12192  netfilter: nft_flow_offload: reset dst in route object after setting up flow
  - !12193  tcp: do not accept ACK of bytes we never sent
  - !12194  mlxsw: spectrum_acl_tcam: Fix warning during rehash
  - !12195  i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  - !12196  net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
  - !12211  scsi: qla2xxx: During vport delete send async logout explicitly
  - !12210  platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - nbd: Fix signal handling
  - nbd: Improve the documentation of the locking assumptions
  - !12231 [sync] PR-12208:  Some bugfixs for ubi/fs
  - dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
  - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
  - locks: fix TOCTOU race when granting write lease
  - ubi: block: fix null-pointer-dereference in ubiblock_create()
  - ubi: block: Remove in vain semicolon
  - !12224 [sync] PR-11910:  ext4: dax: Fix inconsistent isize during writing
  - ext4: dax: keep orphan list before truncate overflow allocated blocks
  - ext4: dax: fix overflowing extents beyond inode size when partially writing
  - !12064 [sync] PR-11942:  sbitmap: backport bugfix patches
  - ELF: Fix mixed declarations and code of "snapshot_randomize_va_space"
  - ELF: fix kernel.randomize_va_space double read
  - scsi: qla2xxx: During vport delete send async logout explicitly
  - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
  - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  - mlxsw: spectrum_acl_tcam: Fix warning during rehash
  - tcp: do not accept ACK of bytes we never sent
  - netfilter: nft_flow_offload: reset dst in route object after setting up flow
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  - mlxsw: spectrum_acl_erp: Fix object nesting warning
  - netns: Make get_net_ns() handle zero refcount net
  - net/sched: taprio: extend minimum interval restriction to entire cycle too
  - net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX.
  - ipv6: sr: fix invalid unregister error path
  - md/raid1: don't free conf on raid0_run failure
  - bonding: fix xfrm real_dev null pointer dereference
  - netfilter: flowtable: initialise extack before use
  - bonding: fix null pointer deref in bond_ipsec_offload_ok
  - bonding: fix bond_ipsec_offload_ok return type
  - blk-mq: Fix potential io hung for shared sbitmap per tagset
  - blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
  - sbitmap: fix lockup while swapping
  - sbitmap: Avoid leaving waitqueue in invalid state in __sbq_wake_up()
  - sbitmap: fix possible io hung due to lost wakeup
  - block: Fix lockdep warning in blk_mq_mark_tag_wait
  - blk-mq: fix potential io hang by wrong 'wake_batch'
  - sbitmap: correct wake_batch recalculation to avoid potential IO hung
  - blk-mq: Fix wrong wakeup batch configuration which will cause hang
  - blk-mq: fix tag_get wait task can't be awakened
  - gpio: prevent potential speculation leaks in gpio_device_get_desc()
  - riscv: process: Fix kernel gp leakage
  - octeontx2-af: Fix possible null pointer dereference.


author: Li Nan <linan122@huawei.com> - 5.10.0-136.99.0.180
changelog:
  - !12652  mm/gup: fix gup_pud_range() for dax
  - !12671  drm/amd/display: Fix index out of bounds in degamma hardware format translation
  - !12247  nilfs2: fix state management in error path of log writing function
  - !12647  sock_map: Add a cond_resched() in sock_hash_free()
  - !12646  tcp: check skb is non-NULL in tcp_rto_delta_us()
  - !12645  RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
  - !12644  net: do not delay dst_entries_add() in dst_release()
  - !12630 [sync] PR-12605:  fix CVE-2024-46802
  - !12657  NFSD: Limit the number of concurrent async COPY operations
  - !12636  ALSA: asihpi: Fix potential OOB array access
  - drm/amd/display: Fix index out of bounds in degamma hardware format translation
  - !12274  blk-mq: fix blk_mq_hw_ctx active request accounting
  - !12613  drm/amd/display: Check null pointer before dereferencing se
  - !12622  NFC: nci: Bounds check struct nfc_target arrays
  - !12619  PCI: mt7621: Add sentinel to quirks table
  - !12504  ocfs2: cancel dqi_sync_work before freeing oinfo
  - NFSD: Limit the number of concurrent async COPY operations
  - mm/gup: fix gup_pud_range() for dax
  - !12625  net: ethernet: nixge: fix NULL dereference
  - !12626  libbpf: Handle size overflow for ringbuf mmap
  - sock_map: Add a cond_resched() in sock_hash_free()
  - tcp: check skb is non-NULL in tcp_rto_delta_us()
  - RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
  - net: do not delay dst_entries_add() in dst_release()
  - !12624  hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
  - ALSA: asihpi: Fix potential OOB array access
  - drm/amd/display: fix mixed declarations warning
  - drm/amd/display: added NULL check at start of dc_validate_stream
  - libbpf: Handle size overflow for ringbuf mmap
  - net: ethernet: nixge: fix NULL dereference
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
  - NFC: nci: Bounds check struct nfc_target arrays
  - PCI: mt7621: Add sentinel to quirks table
  - !12602 [sync] PR-12459:  drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
  - !12601 [sync] PR-12453:  drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
  - !12600 [sync] PR-12442:  drm/amd/display: Fix index out of bounds in DCN30 color transformation
  - !12446  nilfs2: fix potential oob read in nilfs_btree_check_delete()
  - !8926  ext4: avoid deadlock in fs reclaim with page writeback
  - drm/amd/display: Check null pointer before dereferencing se
  - !12582  drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
  - !12578  gpio: amd8111: Fix PCI device reference count leak
  - !12456  nfsd: map the EBADMSG to nfserr_io to avoid warning
  - !12564  ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
  - !12561  fix CVE-2024-49900
  - !12562  fix CVE-2024-47667
  - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
  - drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
  - drm/amd/display: Fix index out of bounds in DCN30 color transformation
  - !12450  Fix CVE-2024-26917 and CVE-2024-50025
  - !12544 [sync] PR-12369:  x86/ioapic: Handle allocation failures gracefully
  - drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
  - !12401  drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
  - gpio: amd8111: Fix PCI device reference count leak
  - !12416  btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
  - !12420  nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
  - !12421  udf: Fix preallocation discarding at indirect extent boundary
  - !12419  jfs: Fix uaf in dbFreeBits
  - !12418  jfs: check if leafidx greater than num leaves per dmap tree
  - !12415  btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
  - !12417  btrfs: wait for fixup workers before stopping cleaner kthread during umount
  - !12522  netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
  - !12543  media: pci: cx23885: check cx23885_vdev_init() return
  - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
  - PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
  - PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
  - jfs: Fix uninit-value access of new_ea in ea_buffer
  - x86/ioapic: Handle allocation failures gracefully
  - media: pci: cx23885: check cx23885_vdev_init() return
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
  - !12251  KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
  - !12514  devres: Fix memory leakage caused by driver API devm_free_percpu()
  - !12513  jfs: Fix array-index-out-of-bounds in diFree
  - !12468  mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
  - !12388  spi: nxp-fspi: fix the KASAN report out-of-bounds bug
  - !12386  drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
  - !12381  fix CVE-2024-46675
  - !12364  hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
  - !12447  iommu/vt-d: Fix double list_add when enabling VMD in scalable mode
  - !12463  fix CVE-2024-42301
  - !12489  CVE-2024-40965_openEuler-22.03-LTS-SP1
  - !12481  CVE-2024-41015
  - !12485  CVE-2024-38667
  - !12483  CVE-2024-36286
  - devres: Fix memory leakage caused by driver API devm_free_percpu()
  - !12457  soundwire: cadence: fix invalid PDI offset
  - jfs: Fix array-index-out-of-bounds in diFree
  - ocfs2: cancel dqi_sync_work before freeing oinfo
  - !12430  CVE-2024-43894
  - i2c: lpi2c: Avoid calling clk_get_rate during transfer
  - i2c: imx-lpi2c: return -EINVAL when i2c peripheral clk doesn't work
  - i2c: imx-lpi2c: use bulk clk API
  - clk: Provide !COMMON_CLK dummy for devm_clk_rate_exclusive_get()
  - clk: Add a devm variant of clk_rate_exclusive_get()
  - riscv: prevent pt_regs corruption for secondary idle threads
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
  - ocfs2: add bounds checking to ocfs2_check_dir_entry()
  - !12392  mm/swapfile: skip HugeTLB pages for unuse_vma
  - !12433 v2  Fix CVE-2022-49006
  - !12356 [sync] PR-12334:  drm/nouveau: prime: fix refcount underflow
  - !12359 [sync] PR-12342:  nvmet: fix a possible leak when destroy a ctrl during qp establishment
  - !12371 [sync] PR-12344:  of: module: prevent NULL pointer dereference in vsnprintf()
  - !12352  i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
  - !12222 [sync] PR-12075:  blk-mq: fix lockdep hardirq warning in __blk_mq_tag_idle()
  - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
  - parport: Proper fix for array out-of-bounds access
  - dev/parport: fix the array out-of-bounds risk
  - !12357 [sync] PR-12318:  nfsd: call cache_put if xdr_reserve_space returns NULL
  - soundwire: cadence: fix invalid PDI offset
  - nfsd: map the EBADMSG to nfserr_io to avoid warning
  - scsi: fnic: Move flush_work initialization out of if block
  - scsi: fnic: Move fnic_fnic_flush_tx() to a work queue
  - iommu/vt-d: Fix double list_add when enabling VMD in scalable mode
  - nilfs2: fix potential oob read in nilfs_btree_check_delete()
  - !12271  drm/amdgpu: fix mc_data out-of-bounds read warning
  - tracing: Free buffers when a used dynamic event is removed
  - tracing: Add tracing_reset_all_online_cpus_unlocked() function
  - !12396  tracing/timerlat: Fix a race during cpuhp processing
  - !12405  CVE-2024-43841
  - drm/client: fix null pointer dereference in drm_client_modeset_probe
  - udf: Fix preallocation discarding at indirect extent boundary
  - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
  - jfs: Fix uaf in dbFreeBits
  - jfs: check if leafidx greater than num leaves per dmap tree
  - btrfs: wait for fixup workers before stopping cleaner kthread during umount
  - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
  - btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
  - wifi: virt_wifi: don't use strlen() in const context
  - wifi: virt_wifi: avoid reporting connection success with wrong SSID
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
  - tracing/timerlat: Fix a race during cpuhp processing
  - mm/swapfile: skip HugeTLB pages for unuse_vma
  - spi: nxp-fspi: fix the KASAN report out-of-bounds bug
  - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
  - usb: dwc3: core: Prevent USB core invalid event buffer address access
  - usb: dwc3: core: Skip setting event buffers for host only controllers
  - of: module: prevent NULL pointer dereference in vsnprintf()
  - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment
  - nfsd: call cache_put if xdr_reserve_space returns NULL
  - !12339  CVE-2023-52855
  - drm/nouveau: prime: fix refcount underflow
  - !12346  CVE-2024-35990
  - i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
  - !12337  ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
  - !12303  soc: qcom: cmd-db: Map shared memory as WC, not WB
  - !12302  media: imon: fix access to invalid resource for the second interface
  - dma: xilinx_dpdma: Fix locking
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
  - ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
  - soc: qcom: cmd-db: Map shared memory as WC, not WB
  - media: imon: fix access to invalid resource for the second interface
  - blk-mq: fix blk_mq_hw_ctx active request accounting
  - drm/amdgpu: fix mc_data out-of-bounds read warning
  - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
  - nilfs2: fix state management in error path of log writing function
  - blk-mq: fix lockdep hardirq warning in __blk_mq_tag_idle()
  - ext4: avoid deadlock in fs reclaim with page writeback


author: Li Nan <linan122@huawei.com> - 5.10.0-136.100.0.181
changelog:
  - !13008  CVE-2024-49950
  - !13050  ext4: fix CVE-2024-47701
  - !13045 [sync] PR-12958:  ext4: update orig_path in ext4_find_extent()
  - !12681  smb: client: fix UAF in async decryption
  - !12990  vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
  - !12995  drm/amd/display: Check BIOS images before it is used
  - !13020  l2tp: prevent possible tunnel refcount underflow
  - !13021  wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
  - !12985 [sync] PR-12781:  uprobes: fix kernel info leak via "[uprobes
  - !13038  drm/shmem-helper: Remove errant put in error path
  - !13037  Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
  - !13036  iio: health: afe4403: Fix oob read in afe4403_read_raw
  - !13035  efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
  - ext4: avoid OOB when system.data xattr changes underneath the filesystem
  - ext4: explicitly exit when ext4_find_inline_entry returns an error
  - ext4: return error on ext4_find_inline_entry
  - ext4: ext4_search_dir should return a proper error
  - ext4: fix RENAME_WHITEOUT handling for inline directories
  - !12902  ext4: fix double brelse() the buffer of the extents path
  - !12898  ext4: aovid use-after-free in ext4_ext_insert_extent()
  - ext4: update orig_path in ext4_find_extent()
  - drm/shmem-helper: Remove errant put in error path
  - !12989  CVE-2022-48966
  - Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
  - iio: health: afe4403: Fix oob read in afe4403_read_raw
  - efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
  - l2tp: prevent possible tunnel refcount underflow
  - !12885  CVE-2024-50016
  - !12836  ASoC: ops: Fix bounds check for _sx controls
  - !12999  f2fs: get rid of online repaire on corrupted directory
  - !12802  ext4: fix slab-use-after-free in ext4_split_extent_at()
  - !12910  fsnotify: fix CVE-2024-47660
  - !12907  io_uring: fix CVE-2024-50060
  - !12880  drm/stm: Avoid use-after-free issues with crtc and plane
  - !12917  tipc: re-fetch skb cb after tipc_msg_validate
  - !12914  CVE-2022-48961
  - !12912  ethernet: aeroflex: fix potential skb leak in greth_init_rings()
  - Bluetooth: L2CAP: Fix uaf in l2cap_connect
  - Bluetooth: Return whether a connection is outbound
  - !12945  fix CVE-2024-47723
  - !12951  drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
  - !12955  memcg_write_event_control(): fix a user-triggerable oops
  - !12823  f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
  - !12549  fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
  - !12872  Fix CVE-2024-47703
  - !12894  ext4: avoid use-after-free in ext4_ext_show_leaf()
  - f2fs: get rid of online repaire on corrupted directory
  - !12936  ASoC: soc-pcm: Add NULL check in BE reparenting
  - !12935  gpiolib: fix memory leak in gpiochip_setup_dev()
  - !12956  wifi: cfg80211: fix buffer overflow in elem comparison
  - drm/amd/display: Check BIOS images before it is used
  - vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
  - net: mvneta: Fix an out of bounds check
  - net: mvneta: Prevent out of bounds read in mvneta_config_rss()
  - !12864  CVE-2022-49020
  - !12833  lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
  - !12876  tipc: guard against string buffer overrun
  - !12839  ocfs2: reserve space for inline xattr before attaching reflink tree
  - !12921  ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
  - !12889  drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
  - uprobes: fix kernel info leak via "[uprobes]" vma
  - wifi: cfg80211: fix buffer overflow in elem comparison
  - memcg_write_event_control(): fix a user-triggerable oops
  - !12845  ACPI: sysfs: validate return type of _STR method
  - drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
  - jfs: Fix sanity check in dbMount
  - jfs: fix out-of-bounds in dbNextAG() and diAlloc()
  - !12931  tcp: fix mptcp DSS corruption due to large pmtu xmit
  - !12929  gso: fix udp gso fraglist segmentation after pull from frag_list
  - !12930  RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
  - ASoC: soc-pcm: Add NULL check in BE reparenting
  - gpiolib: fix memory leak in gpiochip_setup_dev()
  - tcp: fix mptcp DSS corruption due to large pmtu xmit
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
  - gso: fix udp gso fraglist segmentation after pull from frag_list
  - !12788  slip: make slhc_remember() more robust against malicious packets
  - !12789  net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
  - !12787  net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
  - !12786  mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  - !12740  r8169: add tally counter fields added with RTL8125
  - !12744  net/xen-netback: prevent UAF in xenvif_flush_hash()
  - !12408  padata: use integer wrap around to prevent deadlock on seq_nr overflow
  - !12379  nfsd: return -EINVAL when namelen is 0
  - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
  - tipc: re-fetch skb cb after tipc_msg_validate
  - net: mdio: fix unbalanced fwnode reference count in mdio_device_release()
  - net: mdio: use device_set_node() to setup both fwnode and of
  - driver core: add a helper to setup both the of_node and fwnode of a device
  - ethernet: aeroflex: fix potential skb leak in greth_init_rings()
  - fsnotify: clear PARENT_WATCHED flags lazily
  - fsnotify: remove unused declaration
  - fsnotify: Fix comment typo
  - io_uring: check if we need to reschedule during overflow flush
  - io_uring: always lock __io_cqring_overflow_flush
  - ext4: fix double brelse() the buffer of the extents path
  - ext4: aovid use-after-free in ext4_ext_insert_extent()
  - ext4: avoid use-after-free in ext4_ext_show_leaf()
  - drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
  - drm/amd/display: Avoid overflow assignment in link_dp_cts
  - drm/stm: Avoid use-after-free issues with crtc and plane
  - tipc: guard against string buffer overrun
  - bpf, lsm: Add check for BPF LSM return value
  - bpf, lsm: Add disabled BPF LSM hook list
  - net/9p: Fix a potential socket leak in p9_socket_open
  - !12811  serial: protect uart_port_dtr_rts() in uart_shutdown() too
  - !12819  iio: health: afe4404: Fix oob read in afe4404_[read|write
  - !12828  drm/amd/display: Check null pointers before using them
  - !12797  uprobe: avoid out-of-bounds memory access of fetching args
  - ACPI: sysfs: validate return type of _STR method
  - ocfs2: reserve space for inline xattr before attaching reflink tree
  - !12692 [sync] PR-12354: Backport important bugfix from the kernel-5.10.y
  - ASoC: ops: Fix bounds check for _sx controls
  - !12796  platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
  - !12765  thermal: core: Reference count the zone in thermal_zone_get_by_id()
  - !12660  nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
  - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
  - !12763  CVE-2024-50063
  - !12487  gtp: fix a potential NULL pointer dereference
  - !12761  smack: tcp: ipv4, fix incorrect labeling
  - !12779  riscv: Sync efi page table's kernel mappings before switching
  - drm/amd/display: Check null pointers before using them
  - f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
  - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
  - !12687 [sync] PR-12672:  ocfs2: remove unreasonable unlock in ocfs2_read_blocks
  - serial: protect uart_port_dtr_rts() in uart_shutdown() too
  - ext4: fix slab-use-after-free in ext4_split_extent_at()
  - uprobe: avoid out-of-bounds memory access of fetching args
  - platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
  - net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
  - slip: make slhc_remember() more robust against malicious packets
  - net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  - riscv: Sync efi page table's kernel mappings before switching
  - !12552  cifs: Fix buffer overflow when parsing NFS reparse points
  - !12714  drm: omapdrm: Add missing check for alloc_ordered_workqueue
  - !12706  fix CVE-2024-49924
  - thermal: core: Reference count the zone in thermal_zone_get_by_id()
  - !12731  net: phy: fix null-ptr-deref while probe() failed
  - !12722  ppp: fix ppp_async_encode() illegal access
  - !12555  NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
  - selftests/bpf: Add test for lsm tail call
  - bpf: Prevent tail call between progs attached to different hooks
  - smack: tcp: ipv4, fix incorrect labeling
  - !12734  CVE-2024-50059
  - !12404  fix CVE-2024-49954
  - !12367  fix CVE-2022-49011
  - !12518  fix CVE-2024-47742
  - !12664 v2  CVE-2024-49955
  - !12684  block: fix potential invalid pointer dereference in blk_add_partition
  - net/xen-netback: prevent UAF in xenvif_flush_hash()
  - !12696  mm: memcg: don't periodically flush stats when memcg is disabled
  - !12695  crypto: xor - fix template benchmarking
  - r8169: add tally counter fields added with RTL8125
  - !12702  vhost_vdpa: assign irq bypass producer token correctly
  - ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
  - net: phy: fix null-ptr-deref while probe() failed
  - ppp: fix ppp_async_encode() illegal access
  - !12520  ipv6: avoid use-after-free in ip6_fragment()
  - !12677  CVE-2024-47673
  - !12675  IB/core: Fix ib_cache_setup_one error flow cleanup
  - drm: omapdrm: Add missing check for alloc_ordered_workqueue
  - fbdev: pxafb: Fix possible use after free in pxafb_task()
  - vhost_vdpa: assign irq bypass producer token correctly
  - !12643  Bluetooth: Fix crash when replugging CSR fake controllers
  - !12500  nbd: fix race between timeout and normal completion
  - !12609  blk_iocost: fix more out of bound shifts
  - mm: memcg: don't periodically flush stats when memcg is disabled
  - crypto: xor - fix template benchmarking
  - crypto: xor - Fix typo of optimization
  - scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
  - scsi: mpt3sas: Remove scsi_dma_map() error messages
  - ocfs2: remove unreasonable unlock in ocfs2_read_blocks
  - block: fix potential invalid pointer dereference in blk_add_partition
  - smb: client: fix UAF in async decryption
  - wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
  - iwlwifi: mvm: move iwl_mvm_stop_device() out of line
  - IB/core: Fix ib_cache_setup_one error flow cleanup
  - ACPI: battery: Fix possible crash when unregistering a battery hook
  - ACPI: battery: Simplify battery hook locking
  - nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
  - Bluetooth: Fix crash when replugging CSR fake controllers
  - blk_iocost: fix more out of bound shifts
  - NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
  - cifs: Fix buffer overflow when parsing NFS reparse points
  - fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
  - ipv6: avoid use-after-free in ip6_fragment()
  - firmware_loader: Block path traversal
  - nbd: fix race between timeout and normal completion
  - gtp: fix a potential NULL pointer dereference
  - padata: use integer wrap around to prevent deadlock on seq_nr overflow
  - static_call: Replace pointless WARN_ON() in static_call_module_notify()
  - nfsd: return -EINVAL when namelen is 0
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()


author: Li Nan <linan122@huawei.com> - 5.10.0-136.101.0.182
changelog:
  - !13152  xfrm: validate new SA's prefixlen using SA family when sel.family is unset
  - !13153  tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  - !13155  RDMA/mad: Improve handling of timed out WRs of mad agent
  - !13166  CVE-2024-50133
  - !13163  Fix 'cgroup/cpuset: Prevent UAF in proc_cpuset_show()' issue with commmunity patches
  - LoongArch: Don't crash in stack_top() for tasks without vDSO
  - cgroup: add cgroup_root_ext to keep kabi
  - cgroup/cpuset: Prevent UAF in proc_cpuset_show()
  - cgroup: Make operations on the cgroup root_list RCU safe
  - Revert "cgroup: fix uaf when proc_cpuset_show"
  - RDMA/mad: Improve handling of timed out WRs of mad agent
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset
  - !13123  blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
  - !13145  tracing: Consider the NULL character when validating the event length
  - tracing: Consider the NULL character when validating the event length
  - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
  - !12967  : ext4: no need to continue when the number of entries is 1
  - !12964  ext4: fix timer use-after-free on failed mount
  - !12966  ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
  - !12963  ext4: fix i_data_sem unlock order in ext4_ind_migrate()
  - !12961  exfat: fix memory leak in exfat_load_bitmap()
  - !12962  ext4: fix access to uninitialised lock in fc replay path
  - !12965  vfs: fix race between evice_inodes() and find_inode()&iput()
  - !13090  bpf, net: Fix a potential race in do_sock_getsockopt()
  - !13102  thunderbolt: Mark XDomain as unplugged when router is removed
  - !13100  pinctrl: single: fix potential NULL dereference in pcs_get_function()
  - !13104  CVE-2024-49878
  - resource: fix region_intersects() vs add_memory_driver_managed()
  - thunderbolt: Mark XDomain as unplugged when router is removed
  - pinctrl: single: fix potential NULL dereference in pcs_get_function()
  - !13065 [sync] PR-12984: [OLK-5.10] Backport scsi bugfix and cleancode from upstream
  - bpf, net: Fix a potential race in do_sock_getsockopt()
  - !13070  f2fs: fix to check atomic_file in f2fs ioctl interfaces
  - !13071  static_call: Handle module init failure correctly in static_call_del_module()
  - !13058  net: add more sanity checks to qdisc_pkt_len_init()
  - !13059  net: avoid potential underflow in qdisc_pkt_len_init() with UFO
  - !13057 [sync] PR-13017:  f2fs: fix to wait dio completion
  - !13056 [sync] PR-13015:  drm/amd/display: Check stream before comparing them
  - !12946  drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[
  - static_call: Handle module init failure correctly in static_call_del_module()
  - f2fs: fix to check atomic_file in f2fs ioctl interfaces
  - [Backport]scsi: libsas: Fix disk not being scanned in after being removed
  - [Backport]scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type()
  - [Backport]scsi: libsas: Introduce struct smp_disc_resp
  - net: avoid potential underflow in qdisc_pkt_len_init() with UFO
  - f2fs: fix to wait dio completion
  - drm/amd/display: Check stream before comparing them
  - net: add more sanity checks to qdisc_pkt_len_init()
  - ext4: no need to continue when the number of entries is 1
  - ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
  - vfs: fix race between evice_inodes() and find_inode()&iput()
  - ext4: fix timer use-after-free on failed mount
  - ext4: fix i_data_sem unlock order in ext4_ind_migrate()
  - ext4: fix access to uninitialised lock in fc replay path
  - exfat: fix memory leak in exfat_load_bitmap()
  - drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]


author: Li Nan <linan122@huawei.com> - 5.10.0-136.102.0.183
changelog:
  - !13199  fs/ntfs3: Additional check in ntfs_file_release
  - !13284  wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
  - !13279  mailbox: bcm2835: Fix timeout during suspend mode
  - !13302  CVE-2024-50195
  - !13229  fs/ntfs3: Fix possible deadlock in mi_read
  - !13228  fs/ntfs3: Check if more than chunk-size bytes are written
  - !13224  fs/ntfs3: Add rough attr alloc_size check
  - !13191  net/ncsi: Disable the ncsi work before freeing the associated structure
  - !13195  fix CVE-2024-50115
  - posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
  - posix-clock: Fix missing timespec64 check in pc_clock_settime()
  - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
  - !13272 v2  scsi: libsas: Add smp_ata_check_ready_type()
  - !13175  bpf: Use raw_spinlock_t in ringbuf
  - mailbox: bcm2835: Fix timeout during suspend mode
  - !13262  bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
  - !13208 [sync] PR-13146:  arm64: probes: Remove broken LDR (literal) uprobe support
  - scsi: libsas: Add smp_ata_check_ready_type()
  - bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
  - !13232  Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
  - !9720  firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - !9095 [sync] PR-8747:  dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - !13223  e100: Fix possible use after free in e100_xmit_prepare
  - !13222  aoe: fix the potential use-after-free problem in more places
  - !13220  scsi: pm80xx: Set phy->enable_completion only when we wait for it
  - !13238  staging: iio: frequency: ad9834: Validate frequency parameter value
  - !13247  CVE-2022-48878
  - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
  - Bluetooth: hci_qca: Fixed issue during suspend
  - Bluetooth: hci_qca: check for SSR triggered flag while suspend
  - Bluetooth: hci_qca: Wait for SSR completion during suspend
  - Bluetooth: hci_qca: Fix driver shutdown on closed serdev
  - Bluetooth: hci_qca: Wait for timeout during suspend
  - Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
  - !12374  wifi: mac80211: fix NULL dereference at band check in starting tx ba session
  - !8793  netfilter: nf_tables: honor table dormant flag from netdev release event path
  - staging: iio: frequency: ad9834: Validate frequency parameter value
  - !13147  CVE-2022-48953
  - Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
  - !13200  iio: light: veml6030: fix IIO device retrieval from embedded device
  - fs/ntfs3: Fix possible deadlock in mi_read
  - fs/ntfs3: Check if more than chunk-size bytes are written
  - fs/ntfs3: Add rough attr alloc_size check
  - e100: Fix possible use after free in e100_xmit_prepare
  - aoe: fix the potential use-after-free problem in more places
  - scsi: pm80xx: Set phy->enable_completion only when we wait for it
  - !13203 [sync] PR-13186:  virtio_pmem: Check device status before requesting flush
  - !13168  drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe
  - arm64: probes: Remove broken LDR (literal) uprobe support
  - virtio_pmem: Check device status before requesting flush
  - iio: light: veml6030: fix IIO device retrieval from embedded device
  - fs/ntfs3: Additional check in ntfs_file_release
  - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
  - net/ncsi: Disable the ncsi work before freeing the associated structure
  - bpf: Use raw_spinlock_t in ringbuf
  - drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe
  - rtc: cmos: Fix wake alarm breakage
  - rtc: cmos: Fix event handler registration ordering issue
  - wifi: mac80211: fix NULL dereference at band check in starting tx ba session
  - firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - netfilter: nf_tables: honor table dormant flag from netdev release event path


author: Li Nan <linan122@huawei.com> - 5.10.0-136.103.0.184
changelog:
  - !13814  nilfs2: fix kernel bug due to missing clearing of checked flag
  - !13457  io_uring: fix CVE-2024-53052
  - !13461  ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
  - !13385  bpf: Fix out-of-bounds write in trie_get_next_key()
  - !13830  fix CVE-2024-50192
  - !13412  udf: fix uninit-value use in udf_get_fileshortad
  - !13801  media: av7110: fix a spectre vulnerability
  - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs
  - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE
  - !13420  btrfs: reinitialize delayed ref list after deleting it from the list
  - !13422  nfs: Fix KMSAN warning in decode_getfattr_attrs()
  - !13811 [sync] PR-13793:  nilfs2: fix potential deadlock with newly created symlinks
  - !13425  media: s5p-jpeg: prevent buffer overflows
  - nilfs2: fix kernel bug due to missing clearing of checked flag
  - nilfs2: fix potential deadlock with newly created symlinks
  - !13798  drm/amd/display: Initialize denominators' default to 1
  - media: av7110: fix a spectre vulnerability
  - drm/amd/display: Initialize denominators' default to 1
  - !13438  net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
  - !13437  netfilter: br_netfilter: fix panic with metadata_dst skb
  - !13434  netfilter: nf_tables: prevent nf_skb_duplicated corruption
  - !13432  wifi: iwlwifi: mvm: avoid NULL pointer dereference
  - !13320  unicode: Don't special case ignorable code points
  - !13380  fbdev: sisfb: Fix strbuf array overflow
  - !13455 [sync] PR-13356:  NFSD: Initialize struct nfsd4_copy earlier
  - ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
  - io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
  - io_uring: use kiocb_{start,end}_write() helpers
  - fs: create kiocb_{start,end}_write() helpers
  - io_uring: rename kiocb_end_write() local helper
  - !13440  RDMA/cxgb4: Added NULL check for lookup_atid
  - !13442  net: netfilter: Fix CVE-2024-50038
  - !13445  RDMA/rtrs-srv: Avoid null pointer deref during path establishment
  - !13431  xen-netfront: Fix NULL sring after live migration
  - !13430  RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
  - !13429  SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
  - !13428  bonding: Fix CVE-2023-52784
  - !13427  llc: verify mac len before reading mac header
  - NFSD: Initialize struct nfsd4_copy earlier
  - !13390 [sync] PR-12686:  security/keys: fix slab-out-of-bounds in key_task_permission
  - RDMA/rtrs-srv: Avoid null pointer deref during path establishment
  - netfilter: xtables: fix typo causing some targets not to load on IPv6
  - netfilter: xtables: avoid NFPROTO_UNSPEC where needed
  - RDMA/cxgb4: Added NULL check for lookup_atid
  - net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
  - netfilter: br_netfilter: fix panic with metadata_dst skb
  - netfilter: nf_tables: prevent nf_skb_duplicated corruption
  - wifi: iwlwifi: mvm: avoid NULL pointer dereference
  - xen-netfront: Fix NULL sring after live migration
  - RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
  - bonding: stop the device in bond_setup_by_slave()
  - bonding: reset bond's flags when down link is P2P device
  - llc: verify mac len before reading mac header
  - media: s5p-jpeg: prevent buffer overflows
  - nfs: Fix KMSAN warning in decode_getfattr_attrs()
  - btrfs: reinitialize delayed ref list after deleting it from the list
  - udf: fix uninit-value use in udf_get_fileshortad
  - !13388  usb: musb: sunxi: Fix accessing an released usb phy
  - !13393  CVE-2024-47745
  - !13369  CVE-2024-46713
  - !13342  ntfs3: fix CVE-2024-50248
  - !13348  ceph: remove the incorrect Fw reference check when dirtying pages
  - !13347  nilfs2: propagate directory read errors from nilfs_find_entry()
  - mm: split critical region in remap_file_pages() and invoke LSMs in between
  - mm: call the security_mmap_file() LSM hook in remap_file_pages()
  - remap_file_pages: Use vma_lookup() instead of find_vma()
  - mm/mmap.c: don't unlock VMAs in remap_file_pages()
  - !13330  tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
  - security/keys: fix slab-out-of-bounds in key_task_permission
  - usb: musb: sunxi: Fix accessing an released usb phy
  - bpf: Fix out-of-bounds write in trie_get_next_key()
  - fbdev: sisfb: Fix strbuf array overflow
  - !13304  ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
  - perf: Fix kabi problem by put mutex in front of perf_buffer
  - perf/aux: Fix AUX buffer serialization
  - !13311  fs/ntfs3: Additional check in ni_clear()
  - ceph: remove the incorrect Fw reference check when dirtying pages
  - nilfs2: propagate directory read errors from nilfs_find_entry()
  - !13339  smb: client: fix OOBs when building SMB2_IOCTL request
  - fs/ntfs3: Sequential field availability check in mi_enum_attr()
  - ntfs3: Add bounds checking to mi_enum_attr()
  - smb: client: fix OOBs when building SMB2_IOCTL request
  - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
  - unicode: Don't special case ignorable code points
  - fs/ntfs3: Additional check in ni_clear()
  - ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()


author: Li Nan <linan122@huawei.com> - 5.10.0-136.104.0.185
changelog:
  - !14034  xfs: Fix data overflow in xfs_mod_fdblocks()
  - !14016  *** CVE-2024-53063 ***
  - !13957  fs: Fix uninitialized value issue in from_kuid and from_kgid
  - xfs: Fix data overflow in xfs_mod_fdblocks()
  - !13336  fix CVE-2024-50135
  - !13944  net/sched: accept TCA_STAB only for root qdisc
  - !13939  wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
  - !13947  ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
  - !13946  wifi: rtw88: always wait for both firmware loading attempts
  - !13945  Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
  - !13943  net: ethernet: lantiq_etop: fix memory disclosure
  - !13942  net: Fix an unsafe loop on the list
  - !13941  net: stmmac: Fix zero-division error when disabling tc cbs
  - !13940  sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
  - !13938  wifi: ath11k: fix array out-of-bound access in SoC stats
  - media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
  - media: dvbdev: prevent the risk of out of memory access
  - !13840  afs: Fix lock recursion
  - !13907 [sync] PR-13905:  NFSD: Never decrement pending_async_copies on error
  - !13924  wifi: ath10k: Fix memory leak in management tx
  - !13923  RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
  - !13968  bpf: Check validity of link->type in bpf_link_show_fdinfo()
  - bpf: Check validity of link->type in bpf_link_show_fdinfo()
  - fs: Fix uninitialized value issue in from_kuid and from_kgid
  - !13803  pinctrl: ocelot: fix system hang on level based interrupts
  - ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
  - wifi: rtw88: always wait for both firmware loading attempts
  - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
  - net/sched: accept TCA_STAB only for root qdisc
  - net: ethernet: lantiq_etop: fix memory disclosure
  - net: Fix an unsafe loop on the list
  - net: stmmac: Fix zero-division error when disabling tc cbs
  - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
  - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
  - wifi: ath11k: fix array out-of-bound access in SoC stats
  - wifi: ath10k: Fix memory leak in management tx
  - RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
  - !13899  drm/amd/display: Check link_index before accessing dc->links[
  - NFSD: Never decrement pending_async_copies on error
  - !13886  scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths
  - !13863  net: systemport: fix potential memory leak in bcm_sysport_xmit()
  - !13865  Bluetooth: bnep: fix wild-memory-access in proto_unregister
  - !13868  wifi: iwlegacy: Clear stale interrupts before resuming device
  - !13882  RDMA/bnxt_re: Add a check for memory allocation
  - drm/amd/display: Check link_index before accessing dc->links[]
  - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths
  - !13856  CVE-2024-53059
  - !13855  sctp: properly validate chunk size in sctp_sf_ootb()
  - RDMA/bnxt_re: Add a check for memory allocation
  - wifi: iwlegacy: Clear stale interrupts before resuming device
  - Bluetooth: bnep: fix wild-memory-access in proto_unregister
  - net: systemport: fix potential memory leak in bcm_sysport_xmit()
  - mac80211: always have ieee80211_sta_restart()
  - wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
  - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
  - mac80211: Add support to trigger sta disconnect on hardware restart
  - mac80211: do drv_reconfig_complete() before restarting all
  - sctp: properly validate chunk size in sctp_sf_ootb()
  - afs: Fix lock recursion
  - pinctrl: ocelot: fix system hang on level based interrupts
  - nvme-pci: fix race condition between reset and nvme_dev_disable()
  - nvme-pci: refactor the tagset handling in nvme_reset_work
  - nvme-pci: split nvme_dev_add


author: Li Nan <linan122@huawei.com> - 5.10.0-136.105.0.186
changelog:
  - !14047  smb: client: Fix use-after-free of network namespace.
  - !14118  bpf: sync_linked_regs() must preserve subreg_def
  - !14125  media: cx24116: prevent overflows on SNR calculus
  - !13826 [sync] PR-13403: some bugfix of ksmbd smb2_open()
  - !13825 [sync] PR-13448: bugfix of nfs
  - media: cx24116: prevent overflows on SNR calculus
  - bpf: sync_linked_regs() must preserve subreg_def
  - !14105  nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
  - !14115  media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
  - !14084  ocfs2: uncache inode which has failed entering the group
  - nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
  - !14032  fix CVE-2024-50278
  - !14093  USB: serial: io_edgeport: fix use after free in debug printk
  - !14078  vp_vdpa: fix id_table array not null terminated error
  - !14074  HID: core: zero-initialize the report buffer
  - !14029  drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
  - !14028  drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
  - !14023  iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
  - !14063  CVE-2024-53054
  - !14050  wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
  - !14052  net: sched: fix use-after-free in taprio_change()
  - !14053  can: bcm: Fix UAF in bcm_proc_show()
  - USB: serial: io_edgeport: fix use after free in debug printk
  - !14081 [sync] PR-13871:  ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
  - ocfs2: uncache inode which has failed entering the group
  - ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
  - !14020  ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
  - !14061 [sync] PR-13948:  fix CVE-2024-49906
  - vp_vdpa: fix id_table array not null terminated error
  - HID: core: zero-initialize the report buffer
  - cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction
  - Revert "cgroup: Fix AA deadlock caused by cgroup_bpf_release"
  - !13996  drm/radeon: Fix encoder->possible_clones
  - drm/amd/display: Check null pointer before try to access it
  - drm/amd/display: Check null pointer before try to access it
  - !13992  fix CVE-2024-49861
  - can: bcm: Fix UAF in bcm_proc_show()
  - net: sched: fix use-after-free in taprio_change()
  - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
  - smb: client: Fix use-after-free of network namespace.
  - dm cache: fix potential out-of-bounds access on the first resume
  - dm cache: optimize dirty bit checking with find_next_bit when resizing
  - dm cache: fix out-of-bounds access to the dirty bitset when resizing
  - drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
  - drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
  - iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
  - ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
  - drm/radeon: Fix encoder->possible_clones
  - bpf: Fix kabi breakage in enum bpf_type_flag
  - selftests/bpf: Rename ARG_PTR_TO_LONG test description
  - selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test
  - bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
  - bpf: Fix helper writes to read-only maps
  - bpf: Remove truncation test in bpf_strtol and bpf_strtoul helpers
  - bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
  - bpf: Allow helpers to accept pointers with a fixed size
  - bpf: Add MEM_UNINIT as a bpf_type_flag
  - ksmbd: fix return value of smb2_open()
  - ksmbd: fix possible refcount leak in smb2_open()
  - NFSv4: check FMODE_EXEC from open context mode in nfs4_opendata_access()
  - NFS: make sure open context mode have FMODE_EXEC when file open for exec


author: Li Nan <linan122@huawei.com> - 5.10.0-136.107.0.187
changelog:
  - !14270  iomap: fix zero padding data issue in concurrent append writes
  - !14234  xfs: fix attr inactive issue
  - !14335  ALSA: usb-audio: Fix out of bounds reads when finding clock sources
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources
  - !13005  Fix CVE-2024-50086
  - !14277  net: hsr: Fix potential use-after-free
  - !14308  printk: Fix the qspinlock deadloop caused by zap_locks()
  - !14275  ixgbevf: Fix resource leak in ixgbevf_init_module()
  - !14276  wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration
  - !14278  net: tun: Fix use-after-free in tun_detach()
  - !14279  Bluetooth: Fix not cleanup led when bt_init fails
  - !14280  igb: Initialize mailbox message for VF reset
  - !14281  CVE-2024-46765
  - printk: Fix the qspinlock deadloop caused by zap_locks()
  - ice: protect XDP configuration with a mutex
  - ice: allow hot-swapping XDP programs
  - ice: Consolidate VSI state and flags
  - ice: fix writeback enable logic
  - ice: Remove vlan_ena from vsi structure
  - igb: Initialize mailbox message for VF reset
  - Bluetooth: Fix not cleanup led when bt_init fails
  - net: tun: Fix use-after-free in tun_detach()
  - net: hsr: Fix potential use-after-free
  - wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration
  - ixgbevf: Fix resource leak in ixgbevf_init_module()
  - iomap: fix zero padding data issue in concurrent append writes
  - xfs: handle attr node/leaf blocks atomically during inactive
  - xfs: factor out xfs_attr3_leaf_init
  - xfs: factor out xfs_da3_node_entry_remove
  - Revert "xfs: factor out __xfs_da3_node_read()"
  - Revert "xfs: atomic drop extent entries when inactiving attr"
  - !14138  ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
  - !14150  CVE-2024-53142
  - !14173  dmaengine: idxd: Let probe fail when workqueue cannot be enabled
  - dmaengine: idxd: Let probe fail when workqueue cannot be enabled
  - !10238 [sync] PR-10179: [22.03-LTS-SP3]net:openvswitch: Before calling ovs_vport_send, check the link status of vport->dev
  - initramfs: avoid filename buffer overrun
  - ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
  - ksmbd: fix user-after-free from session log off
  - ksmbd: fix race condition between session lookup and expire
  - net: openvswitch: fix race on port output


