# changelog

author: Jiachen Fan<fanjiachen3@huawei.com> - 1:1.5.2-1
changelog:
  - Type:revert
  - ID:NA
  - SUG:NA
  - DESC:revert commit ab1fb58b56ef0913e64b71a7bac60ba129e460ff, to fix skopeo install bug in standard iso


author: Wang Ding <wangding16@huawei.com> - 10.3.1-35
changelog:
  - Type:Spec
  - ID:NA
  - SUG:NA
  - DESC: To resolve the spec 548 fluctuation problem, revert GCC commit.


author: wangkai <13474090681@163.com> - 102.13.0-1
changelog:
  - Update to 102.13.0
  - Fix CVE-2023-34416 CVE-2023-34414 CVE-2023-37201 CVE-2023-37202 CVE-2023-37207 CVE-2023-37208 CVE-2023-37211
  - Remove unused patch


author: wangkai <13474090681@163.com> - 102.14.0-1
changelog:
  - Update to 102.14.0
  - Fix CVE-2023-4045 CVE-2023-4046 CVE-2023-4047 CVE-2023-4048 CVE-2023-4049 CVE-2023-4050 CVE-2023-4054 CVE-2023-4055 CVE-2023-4056


author: lvfei <lvfei@kylinos.cn> - 102.15.0-1
changelog:
  - Update to 102.15.0
  - Fix CVE-2023-4573 CVE-2023-4574 CVE-2023-4575 CVE-2023-4576  CVE-2023-4581 CVE-2023-4584


author: liyuxiang <liyuxiang@ncti-gba.cn> - 2:2.8.1-2
changelog:
  - Fix CVE-2022-39316
  - Fix CVE-2022-39318
  - Fix CVE-2022-39319
  - Fix CVE-2022-39347
  - Fix CVE-2022-41877


author: Funda Wang <fundawang@yeah.net> - 2:2.11.1-1
changelog:
  - 2.11.1
  - Fix CVE-2023-40567
  - Fix CVE-2023-40569
  - Fix CVE-2023-40188
  - Fix CVE-2023-40186
  - Fix CVE-2023-40181
  - Fix CVE-2023-39353
  - Fix CVE-2023-39352
  - Fix CVE-2023-39356
  - Fix CVE-2023-39350
  - Fix CVE-2023-39351
  - Fix CVE-2023-39354
  - Fix CVE-2023-40589


author: wangkai <13474090681@163.com> - 2:2.11.7-1
changelog:
  - Update to 2.11.7 for fix CVE-2024-32039,CVE-2024-32040,
    CVE-2024-32041,CVE-2024-32458,CVE-2024-32459,CVE-2024-32460,
    CVE-2024-32658,CVE-2024-32659 and CVE-2024-32660


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.43.0.121
changelog:
  - !4517 [sync] PR-4431: v2  patchset for CVE-2023-52340
  - !4445 [sync] PR-4290:  net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
  - !4615 [sync] PR-4521:  xen-netback: don't produce zero-size SKB frags
  - !4593  sctp: fix potential deadlock on &net->sctp.addr_wq_lock
  - !4550 [sync] PR-4461:  netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  - !4609 [sync] PR-4588:  fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
  - xen-netback: don't produce zero-size SKB frags
  - !4587 [sync] PR-4562: v4  tracing: Backport bugfixes
  - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
  - !3369 [sync] 22.03 LTS SP2 sync vdpa patches from branch OLK-5.10
  - sctp: fix potential deadlock on &net->sctp.addr_wq_lock
  - trace: Fix kabi breakage in struct trace_event_file
  - tracing: Fix uaf issue when open the hist or hist_debug file
  - tracing: Have event inject files inc the trace array ref count
  - tracing: Have trace_event_file have ref counters
  - tracing: Increase trace array ref count on enable and filter files
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  - ipv6: fix kabi change in struct dst_ops
  - ipv6: Document that max_size sysctl is deprecated
  - ipv6: remove max_size check inline with ipv4
  - net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
  - vdpa: add vmstate header file
  - vhost-vdpa: add reset state params to indicate reset level
  - vhost-vdpa: allow set feature VHOST_F_LOG_ALL when been negotiated.
  - vhost-vdpa: fix compile warnings
  - arm64: openeuler_defconfig: add VDPA config
  - vhost-vdpa: fix msi irq request err
  - vhost-vdpa: Allow transparent MSI IOV
  - export iommu_get_resv_regions and iommu_set_resv_regions
  - vhost: add VHOST feature VHOST_BACKEND_F_BYTEMAPLOG
  - vhost-vdpa: add uAPI for device migration status
  - vdpa: add vdpa device migration status ops
  - vhost-vdpa: add uAPI for device buffer
  - vdpa: add device state operations
  - vhost-vdpa: add uAPI for logging
  - vdpa: add log operations
  - tools include UAPI: Sync linux/vhost.h with the kernel sources
  - vdpa: add get_backend_features vdpa operation
  - virtio: fix virtio transitional ids
  - virtio: update virtio id table, add transitional ids
  - PCI/IOV: Add pci_iov_vf_id() to get VF index
  - vhost_vdpa: support PACKED when setting-getting vring_base
  - vhost_vdpa: tell vqs about the negotiated
  - vhost_vdpa: fix unmap process in no-batch mode
  - vhost-vdpa: use bind_mm/unbind_mm device callbacks
  - vdpa: add bind_mm/unbind_mm callbacks
  - vhost-vdpa: vhost_vdpa_alloc_domain() should be using a const struct bus_type *
  - vhost-vdpa: free iommu domain after last use during cleanup
  - vhost-vdpa: uAPI to resume the device
  - vhost-vdpa: Introduce RESUME backend feature bit
  - vdpa: Add resume operation
  - vhost_vdpa: fix the crash in unmap a large memory
  - vhost-vdpa: fix an iotlb memory leak


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.44.0.122
changelog:
  - !4468 [sync] PR-4256:  scsi: core: Always send batch on reset or error handling command
  - !4683 [sync] PR-4662: v3  CVE-2023-52435
  - !4693  ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
  - ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
  - !4627 [sync] PR-4531:  fs:/dcache.c: fix negative dentry flag warning in dentry_free
  - net: Fix compile warning in skb_segment()
  - net: prevent mss overflow in skb_segment()
  - fs:/dcache.c: fix negative dentry flag warning in dentry_free
  - scsi: core: Always send batch on reset or error handling command
  - Revert "scsi: core: Add scsi_prot_ref_tag() helper"
  - Revert "scsi: core: Introduce scsi_get_sector()"
  - Revert "scsi: core: Make scsi_get_lba() return the LBA"
  - Revert "scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request"
  - Revert "scsi: core: Use a structure member to track the SCSI command submitter"
  - Revert "scsi: core: Always send batch on reset or error handling command"
  - scsi: core: Always send batch on reset or error handling command
  - scsi: core: Use a structure member to track the SCSI command submitter
  - scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
  - scsi: core: Make scsi_get_lba() return the LBA
  - scsi: core: Introduce scsi_get_sector()
  - scsi: core: Add scsi_prot_ref_tag() helper


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.45.0.123
changelog:
  - !4957 [sync] PR-4868:  net: openvswitch: limit the number of recursions from action sets
  - !4962 [sync] PR-4940:  apparmor: avoid crash when parsed profile name is empty
  - !4934  arm64: head.S: always initialize PSTATE
  - apparmor: avoid crash when parsed profile name is empty
  - net: openvswitch: limit the number of recursions from action sets
  - arm64: head.S: always initialize PSTATE
  - !4864  ext4: regenerate buddy after block freeing failed if under fc replay
  - ext4: regenerate buddy after block freeing failed if under fc replay
  - !4756 [sync] PR-4737:  blk-mq: fix IO hang from sbitmap wakeup race
  - !4816 [sync] PR-4702:  efivarfs: force RO when remounting if SetVariable is not supported
  - !4797 [sync] PR-4747:  KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
  - efivarfs: force RO when remounting if SetVariable is not supported
  - !4768 [sync] PR-4729:  serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed
  - !4793 v2  gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
  - KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
  - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
  - serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed
  - blk-mq: fix IO hang from sbitmap wakeup race
  - !4724 [sync] PR-4694: v2  mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
  - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.46.0.124
changelog:
  - !5155 [sync] PR-4645:  f2fs: explicitly null-terminate the xattr list
  - !5148 [sync] PR-4925: v2  btrfs: do not ASSERT() if the newly created subvolume already got read
  - !4669 [sync] PR-4646:  binder: fix use-after-free in shinker's callback
  - !4832 [sync] PR-4803:  CVE-2024-26583
  - f2fs: explicitly null-terminate the xattr list
  - !4750 [sync] PR-4672:  uio: Fix use-after-free in uio_open
  - !5070 [sync] PR-5033: v3  Remove WQ_FLAG_BOOKMARK flag
  - btrfs: fix double free of anonymous device after snapshot creation failure
  - btrfs: do not ASSERT() if the newly created subvolume already got read
  - !5116 [sync] PR-5058:  net: fix possible store tearing in neigh_periodic_work()
  - !5087 [sync] PR-5064:  net: rds: Fix possible NULL-pointer dereference
  - !5127 [sync] PR-4891:  Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
  - !5081 [sync] PR-5051:  dm: limit the number of targets and parameter size area
  - !5002 [sync] PR-4988:  ieee802154: ca8210: Fix a potential UAF in ca8210_probe
  - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
  - !5109  CVE-2024-26586
  - net: fix possible store tearing in neigh_periodic_work()
  - mlxsw: spectrum_acl_tcam: Fix stack corruption
  - mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations
  - mlxsw: spectrum_acl_tcam: Make fini symmetric to init
  - mlxsw: spectrum_acl_tcam: Add missing mutex_destroy()
  - mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable
  - mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure
  - !4840 [sync] PR-4742:  block: add check that partition length needs to be aligned with block size
  - !5067 [sync] PR-5032:  net/sched: act_ct: fix wild memory access when clearing fragments
  - net: rds: Fix possible NULL-pointer dereference
  - dm: limit the number of targets and parameter size area
  - sched: remove wait bookmarks
  - filemap: remove use of wait bookmarks
  - net/sched: act_ct: fix wild memory access when clearing fragments
  - !4986 [sync] PR-4339: 修复pmem_legacy_device未被编译问题
  - !4965 [sync] PR-4901:  fix CVE-2021-47036
  - !5013  nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
  - !5007 [sync] PR-4979:  CVE-2021-47028
  - !5016 [sync] PR-4991:  CVE-2023-52568
  - x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race
  - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
  - mt76: mt7915: fix txrate reporting
  - mt76: mt7915: rename mt7915_mcu_get_rate_info to mt7915_mcu_get_tx_rate
  - !4733 [sync] PR-4706:  mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
  - ieee802154: ca8210: Fix a potential UAF in ca8210_probe
  - pmem: compile pmem legacy device while libnvdimm as a module
  - udp: properly flush normal packet at GRO time
  - udp: skip L4 aggregation for UDP tunnel packets
  - block: add check that partition length needs to be aligned with block size
  - tls: fix race between tx work scheduling and socket close
  - tls: fix race between async notify and socket close
  - net: tls: factor out tls_*crypt_async_wait()
  - tls: rx: simplify async wait
  - uio: Fix use-after-free in uio_open
  - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
  - binder: fix use-after-free in shinker's callback


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.47.0.125
changelog:
  - !5345  CVE-2023-52447
  - !5367 v2  CVE-2023-52452
  - !5295 [sync] PR-5229:  iommu/arm-smmu-v3: Disable ECMDQ before reset
  - bpf: Fix accesses to uninit stack slots
  - bpf: Fix verification of indirect var-off stack access
  - bpf: Allow reads from uninit stack
  - bpf: expose bpf_strtol and bpf_strtoul to all program types
  - bpf, verifier: Fix memory leak in array reallocation for stack state
  - bpf: verifier: Use copy_array for jmp_history
  - bpf: verifier: Improve function state reallocation
  - !5183 [sync] PR-4805:  CVE-2023-52451 backport to OLK-5.10 v2
  - bpf: Fix kabi breakage in struct bpf_map and struct bpf_map_ops
  - bpf: Defer the free of inner map when necessary
  - bpf: Set need_defer as false when clearing fd array during map free
  - bpf: Add map and need_defer parameters to .map_fd_put_ptr()
  - !5279 [sync] PR-5246:  ceph: fix deadlock or deadcode of misusing dget()
  - !5297 [sync] PR-5240:  powerpc/lib: Validate size for vector operations
  - powerpc/lib: Validate size for vector operations
  - iommu/arm-smmu-v3: Disable ECMDQ before reset
  - !5227 [sync] PR-5197:  drm: Don't unref the same fb many times by mistake due to deadlock handling
  - !4854 [sync] PR-4847:  btrfs: mainline backport
  - ceph: fix deadlock or deadcode of misusing dget()
  - !5193 [sync] PR-5164:  nfc: nci: assert requested protocol is valid
  - !5186 [sync] PR-5156:  RDMA/srp: Do not call scsi_done() from srp_abort()
  - !5099 [sync] PR-5078:  RDMA/rxe: Return CQE error if invalid lkey was supplied
  - drm: Don't unref the same fb many times by mistake due to deadlock handling
  - !5202 [sync] PR-5178:  net: nfc: llcp: Add lock when modifying device list
  - net: nfc: llcp: Add lock when modifying device list
  - nfc: nci: assert requested protocol is valid
  - RDMA/srp: Do not call scsi_done() from srp_abort()
  - !5167 [sync] PR-5117:  fix CVE-2023-52527
  - powerpc/pseries/memhp: Fix access beyond end of drmem array
  - powerpc/pseries/memhotplug: Quieten some DLPAR operations
  - l2tp: pass correct message length to ip6_append_data
  - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
  - RDMA/rxe: Return CQE error if invalid lkey was supplied
  - btrfs: fix deadlock when cloning inline extents and using qgroups
  - btrfs: do not start and wait for delalloc on snapshot roots on transaction commit


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.48.0.126
changelog:
  - !5535  media: pvrusb2: fix use after free on context disconnection
  - !5504 [sync] PR-5316: v2  iomap: add support to track dirty state of sub pages
  - media: pvrusb2: fix use after free on context disconnection
  - !5139 [sync] PR-4933:  scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
  - !5029 [sync] PR-4987:  net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
  - iomap: add support to track dirty state of sub pages
  - !5440 [sync] PR-5286:  serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
  - !5325  jfs: fix slab-out-of-bounds Read in dtSearch
  - !5330  UBSAN: array-index-out-of-bounds in dtSplitRoot
  - !5437 [sync] PR-5355:  CVE-2023-52593
  - !5312  FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - !5391 [sync] PR-5259:  CVE-2024-26627​
  - serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
  - wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()
  - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
  - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
  - !5373 [sync] PR-5313:  bus: mhi: host: Add alignment check for event ring read pointer
  - !5289 [sync] PR-5231:  af_unix: fix lockdep positive in sk_diag_dump_icons()
  - bus: mhi: host: Add alignment check for event ring read pointer
  - UBSAN: array-index-out-of-bounds in dtSplitRoot
  - jfs: fix slab-out-of-bounds Read in dtSearch
  - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - af_unix: fix lockdep positive in sk_diag_dump_icons()
  - scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.49.0.127
changelog:
  - !5683 [sync] PR-5266:  llc: call sock_orphan() at release time
  - !5691  net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  - !5687 [sync] PR-5253:  tomoyo: fix UAF write bug in tomoyo_write_control()
  - net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  - tomoyo: fix UAF write bug in tomoyo_write_control()
  - llc: call sock_orphan() at release time
  - !5434 [sync] PR-5232:  jfs: fix cve issue
  - !5639 [sync] PR-5617: v4  Fix I/O high when memory almost met memcg limit
  - !5666 [sync] PR-5580:  CVE-2023-52622
  - ext4: avoid online resizing failures due to oversized flex bg
  - ext4: unify the type of flexbg_size to unsigned int
  - ext4: remove unnecessary check from alloc_flex_gd()
  - !5649 [sync] PR-5493:  arm64/mpam: Fix repeated enabling in mpam_enable()
  - !5636 [sync] PR-5518:  dm: revert partial fix for redundant bio-based IO accounting
  - !5633 [sync] PR-5521:  md/raid5: fix atomicity violation in raid5_cache_count
  - arm64/mpam: Fix repeated enabling in mpam_enable()
  - !5620 [sync] PR-5606:  mm/mlock: return EINVAL for illegal user memory range in mlock
  - mm/readahead: don't decrease mmap_miss when folio has workingset flags
  - mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM
  - !5611 [sync] PR-5447:  Fix CVE-2021-47094
  - dm: revert partial fix for redundant bio-based IO accounting
  - md/raid5: fix atomicity violation in raid5_cache_count
  - mm/mlock: return EINVAL for illegal user memory range in mlock
  - KVM: x86/mmu: Don't advance iterator after restart due to yielding
  - KVM: x86/mmu: Factor out tdp_iter_return_to_root
  - !5472  jfs: fix array-index-out-of-bounds in dbAdjTree
  - jfs: fix array-index-out-of-bounds in dbAdjTree
  - jfs: fix array-index-out-of-bounds in diNewExt
  - jfs: fix uaf in jfs_evict_inode


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.50.0.128
changelog:
  - !5940  CVE-2021-46926
  - !5946 [sync] PR-5861:  ksmbd: fix uaf in smb20_oplock_break_ack
  - !5938 [sync] PR-5911:  CVE-2023-52484
  - !5934 [sync] PR-5895:  i2c: i801: Fix block process call transactions
  - !5929 [sync] PR-5863:  CVE-2024-26788
  - !5910 [sync] PR-4928:  drm/bridge: sii902x: Fix probing race issue
  - !5783  ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - !5917 [sync] PR-5870:  drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - !5902 [sync] PR-4931:  phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
  - ksmbd: fix uaf in smb20_oplock_break_ack
  - ALSA: hda: intel-sdw-acpi: harden detection of controller
  - iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range
  - iommu/arm-smmu-v3: Fix size calculation in arm_smmu_mm_invalidate_range()
  - !5914 [sync] PR-5811:  Fixed CVE-2021-47037
  - !5873 [sync] PR-4794:  serial: imx: fix tx statemachine deadlock
  - !4910 [sync] PR-4865:  Input: powermate - fix use-after-free in powermate_config_complete
  - i2c: i801: Fix block process call transactions
  - dmaengine: fsl-qdma: init irq after reg initialization
  - !5898 [sync] PR-5808:  nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - !5890 [sync] PR-5832:  CVE-2023-52467
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - ASoC: q6afe-clocks: fix reprobing of the driver
  - ASoC: q6afe-clocks: fix warning on symbol scope
  - drm/bridge: sii902x: Fix probing race issue
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
  - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - !5750  ksmbd: fix global oob in ksmbd_nl_policy
  - mfd: syscon: Fix null pointer dereference in of_syscon_register()
  - serial: imx: fix tx statemachine deadlock
  - !5828 [sync] PR-5785:  net: qualcomm: rmnet: fix global oob in rmnet_policy
  - !5818 [sync] PR-5780:  bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  - !5814 [sync] PR-5787:  bpf: fix check for attempt to corrupt spilled pointer
  - !4801 [sync] PR-4764:  binder: signal epoll threads of self-work
  - !5792  usb: hub: Guard against accesses to uninitialized BOS descriptors
  - !5799 [sync] PR-5788: v2  Patches to Fix CVE-2023-52454
  - !5819 [sync] PR-5789:  perf/x86/lbr: Filter vsyscall addresses
  - net: qualcomm: rmnet: fix global oob in rmnet_policy
  - !5777 [sync] PR-5724:  ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - !4780 [sync] PR-4772:  x86/fpu: Stop relying on userspace for info to fault in xsave buffer
  - perf/x86/lbr: Filter vsyscall addresses
  - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  - bpf: fix check for attempt to corrupt spilled pointer
  - !5766 [sync] PR-5642:  btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - nvmet-tcp: Fix the H2C expected PDU len calculation
  - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
  - usb: hub: Guard against accesses to uninitialized BOS descriptors
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - ksmbd: fix global oob in ksmbd_nl_policy
  - !5721 [sync] PR-5506:  ext4: dio: Put endio under irq context for overwrite
  - ext4: Optimize endio process for DIO overwrites
  - iomap: Add a IOMAP_DIO_MAY_INLINE_COMP flag
  - iomap: pass a flags argument to iomap_dio_rw
  - iomap: rename the flags variable in __iomap_dio_rw
  - iomap: add IOMAP_DIO_INLINE_COMP
  - iomap: use an unsigned type for IOMAP_DIO_* defines
  - iomap: cleanup up iomap_dio_bio_end_io()
  - !5706 [sync] PR-5507:  ext4: Validate inode pa before using preallocation blocks
  - !5692  arm64/mpam: support MPAM v0.1 version
  - ext4: Validate inode pa before using preallocation blocks
  - arm64/mpam: support MPAM v0.1 version
  - Input: powermate - fix use-after-free in powermate_config_complete
  - binder: signal epoll threads of self-work
  - x86/fpu: Stop relying on userspace for info to fault in xsave buffer


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.51.0.129
changelog:
  - !6194  serial: 8250_port: Check IRQ data before use
  - !6182 [sync] PR-5093:  wifi: mac80211: fix potential key use-after-free
  - !6219  RDMA/siw: Fix connection failure handling
  - !6239 [sync] PR-6186:  Fixed CVE-2023-52504
  - !6220  x86/srso: Fix SBPB enablement for spec_rstack_overflow=off
  - !6237  uio_hv_generic: Fix another memory leak in error handling paths
  - !6233 [sync] PR-6192:  arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
  - x86/alternatives: Disable KASAN in apply_alternatives()
  - uio_hv_generic: Fix another memory leak in error handling paths
  - arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
  - uio_hv_generic: Fix another memory leak in error handling paths
  - !6195  tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
  - !6191 [sync] PR-5466:  wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - x86/srso: Fix SBPB enablement for spec_rstack_overflow=off
  - RDMA/siw: Fix connection failure handling
  - !6187 [sync] PR-5770: v2  scsi: hisi_sas: Fixed some issues in the SAS
  - !6115  cifs: Fix UAF in cifs_demultiplex_thread()
  - tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
  - serial: 8250_port: Check IRQ data before use
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - scsi: hisi_sas: Add cond_resched() to cq_thread_v3_hw()
  - scsi: hisi_sas: Default enable interrupt coalescing
  - !6174 [sync] PR-6137:  vfio/pci: Lock external INTx masking ops
  - wifi: mac80211: fix potential key use-after-free
  - !6128  fix-CVE-2021-47101-openEuler-22.03-LTS-SP2
  - vfio/pci: Lock external INTx masking ops
  - !6156 [sync] PR-5717: v2  fix CVE-2023-52587
  - !6150 [sync] PR-6101:  vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - !6146 [sync] PR-6047:  hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  - !6133 [sync] PR-4923:  mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
  - !5421 [sync] PR-5317:  KVM: s390: fix setting of fpc register
  - IB/ipoib: Fix mcast list locking
  - RDMA/IPoIB: Fix error code return in ipoib_mcast_join
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  - !5131 [sync] PR-5113:  fix CVE-2023-52578
  - !5122 [sync] PR-5062:  team: fix null-ptr-deref when team device type is changed
  - !6119  wifi: rt2x00: restart beacon queue when hardware reset
  - !6056 [sync] PR-6017:  drm/amdgpu: fix use-after-free bug
  - !6121  dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
  - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
  - asix: fix wrong return value in asix_check_host_enable()
  - asix: fix uninit-value in asix_mdio_read()
  - net: asix: fix uninit value bugs
  - dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
  - wifi: rt2x00: restart beacon queue when hardware reset
  - cifs: Fix UAF in cifs_demultiplex_thread()
  - !6079 [sync] PR-5973:  EDAC/thunderx: Fix possible out-of-bounds string access
  - !6044 [sync] PR-5995:  mm/swap: fix race when skipping swapcache
  - !6024 [sync] PR-5970:  fixup CVE-2024-26751
  - !6036 [sync] PR-5969:  fbdev: savage: Error out if pixclock equals zero
  - EDAC/thunderx: Fix possible out-of-bounds string access
  - !5850  ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - !6060  fs/ntfs3: fix CVE-2023-52640
  - fs/ntfs3: Fix oob in ntfs_listxattr
  - fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea()
  - ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
  - drm/amdgpu: fix use-after-free bug
  - mm/swap: fix race when skipping swapcache
  - !5989 [sync] PR-5901:  CVE-2024-26695
  - !5982 [sync] PR-5812:  afs: Increase buffer size in afs_update_volume_status()
  - fbdev: savage: Error out if pixclock equals zero
  - ARM: ep93xx: Add terminator to gpiod_lookup_table
  - !5949 [sync] PR-5831:  fbdev: sis: Error out if pixclock equals zero
  - !5960 [sync] PR-5884:  KVM: arm64: vgic-its: Fix CVE-2024-26598 fix patch issue
  - !5844 [sync] PR-5348:  s390/ptrace: handle setting of fpc register correctly
  - !5962 [sync] PR-5745: v2  iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol
  - crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
  - !5859  dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - afs: Increase buffer size in afs_update_volume_status()
  - iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol
  - KVM: arm64: vgic-its: Fix CVE-2024-26598 fix patch issue
  - fbdev: sis: Error out if pixclock equals zero
  - dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - s390/ptrace: handle setting of fpc register correctly
  - KVM: s390: fix setting of fpc register
  - net: fix kabi check warning
  - net: Fix unwanted sign extension in netdev_stats_to_stats64()
  - net: bridge: use DEV_STATS_INC()
  - net: add atomic_long_t to net_device_stats fields
  - team: fix null-ptr-deref when team device type is changed


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.52.0.130
changelog:
  - !6415 [sync] PR-5510:  bus: mhi: host: Drop chan lock before queuing buffers
  - !6144 [sync] PR-6103:  riscv: Sparse-Memory/vmemmap out-of-bounds fix
  - !6536 [sync] PR-5222:  powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  - !6540 [sync] PR-5273:  net/smc: fix illegal rmb_desc access in SMC-D connection dump
  - !6530 [sync] PR-5468:  media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
  - !6498 [sync] PR-6407:  wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump
  - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  - !6507 [sync] PR-5773:  patches for CVE-2023-52617
  - !6503 [sync] PR-5772:  firmware: arm_scmi: Check mailbox/SMT channel for consistency
  - !6519  Fix CVE-2023-52498
  - media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
  - PM: sleep: Fix error handling in dpm_prepare()
  - PM: sleep: Fix possible deadlocks in core system-wide PM code
  - PM: core: Remove unnecessary (void *) conversions
  - PM: sleep: Avoid calling put_device() under dpm_list_mtx
  - PM: sleep: Use dev_printk() when possible
  - async: Introduce async_schedule_dev_nocall()
  - async: Split async_schedule_node_domain()
  - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
  - PCI: switchtec: Fix stdev_release() crash after surprise hot remove
  - firmware: arm_scmi: Check mailbox/SMT channel for consistency
  - !6489 [sync] PR-6455:  CVE-2021-47182
  - !6484 [sync] PR-3998:  cpufreq: CPPC: Fix performance/frequency conversion
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - !6434 [sync] PR-6312:  fix CVE-2024-24861 for 5.10
  - scsi: core: Fix scsi_mode_sense() buffer length handling
  - scsi: core: Reshuffle response handling in scsi_mode_sense()
  - cpufreq: CPPC: Fix performance/frequency conversion
  - !3994 [sync] PR-3982:  ACPI: CPPC: Assume no transition latency if no PCCT
  - !6471 [sync] PR-3793:  cppc_cpufreq: use policy->cpu in cppc_set_perf()
  - cppc_cpufreq: use policy->cpu as driver of frequency setting
  - cppc_cpufreq: clean up cpu, cpu_num and cpunum variable use
  - cppc_cpufreq: get cpunum from fb_ctrs instead of smp_processor_id()
  - media: xc4000: Fix atomicity violation in xc4000_get_frequency
  - !6412 [sync] PR-5195:  dmaengine: fix NULL pointer in channel unregistration function
  - bus: mhi: host: Drop chan lock before queuing buffers
  - dmaengine: fix NULL pointer in channel unregistration function
  - !6299  sp2 fix deadlock in cgroup1_writeback
  - cgroup_writeback: fix softlockup for blkcg->memcg_list
  - cgroup_writeback: fix deadlock in cgroup1_writeback
  - !6088  Fix CVE-2024-26764
  - !5968  Fix CVE-2023-52441 and integrate the pre-patch
  - riscv: Sparse-Memory/vmemmap out-of-bounds fix
  - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
  - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
  - ksmbd: fix out of bounds in init_smb2_rsp_hdr()
  - ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr
  - ksmbd: return unsupported error on smb1 mount
  - ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect
  - ACPI: CPPC: Assume no transition latency if no PCCT


author: Eibz-Chan <chenbingzhao@huawei.com> - 590-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:[add] backport patches from upstream
  	Fix-memory-leak-when-using-corrupt-lesshst-file.patch
  	Fix-crash-when-enter-invaid-pattern-in-command.patch


author: chenhaixing <chenhaixing@huawei.com> - 0.69.0-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libdnf:Avoid reinstalling installonly packages marked for ERASE
                Fix utimes error message in dnf-repo
                Do not download repository if our local cache is up to date in dnf-repo
                python bindings:Load all modules with RTLD_GLOBAL


author: <fengjiabo1@huawei.com> - 10:6.2.0-82
changelog:
  - thread-pool: optimize scheduling of completion bottom half
  - migration/rdma: zore out head.repeat to make the error more clear
  - vhost-user-fs: Back up vqs before cleaning up vhost_dev
  - hw/vfio/pci-quirks: Sanitize capability pointer
  - hw/vfio/pci-quirks: Support alternate offset for GPUDirect Cliques
  - replay: fix event queue flush for qemu shutdown
  - hw/net: Fix read of uninitialized memory in ftgmac100
  - target/ppc: Fix tlbie
  - target/i386: fix INVD vmexit
  - qtest/npcm7xx_pwm-test: Fix memory leak in mft_qom_set
  - aio-posix: zero out io_uring sqe user_data


author: <fengjiabo1@huawei.com> - 10:6.2.0-83
changelog:
  - hw/virtio/virtio-pmem: Replace impossible check by assertion
  - tests: Fix printf format string in acpi-utils.c
  - softmmu/dirtylimit: Add parameter check for hmp "set_vcpu_dirty_limit"
  - disas/riscv: Fix the typo of inverted order of pmpaddr13 and pmpaddr14
  - qga: Fix memory leak when output stream is unused
  - ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255)
  - target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model
  - target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES
  - target/i386: Allow MCDT_NO if host supports
  - target/i386: Add support for MCDT_NO in CPUID enumeration
  - target/i386: Export MSR_ARCH_CAPABILITIES bits to guests
  - target/i386: add support for FB_CLEAR feature
  - target/i386: add support for FLUSH_L1D feature
  - crypto: remove shadowed 'ret' variable
  - hw/i2c/pmbus_device: Fix modifying QOM class internals from instance
  - hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number


author: <fengjiabo1@huawei.com> - 10:6.2.0-84
changelog:
  - hw/arm/fsl-imx: Do not ignore Error argument
  - hw/net/cadence_gem.c: spelling fixes: Octects
  - tests/qtest: check the return value
  - libvhost-user: Fix VHOST_USER_GET_MAX_MEM_SLOTS  reply mainline inclusion commit 69a5daec06f423843ce1bb9be5fb049314996f78 category: bugfix
  - io_uring: fix short read slow path mainline inclusion commit c06fc7ce147e57ab493bad9263f1601b8298484b category: bugfix
  - libvhost-user: Fix VHOST_USER_ADD_MEM_REG reply mainline inclusion commit 7f27d20ded2f480f3e66d03f90ea71507b834276 category: bugfix
  - qsd: Unlink absolute PID file path mainline inclusion commit 9d8f8233b9fa525a7e37350fbc18877051128c5d category: bugfix
  - net: Fix a misleading error message
  - vdpa: stop all svq on device deletion
  - vhost: release virtqueue objects in error path
  - vhost: fix the fd leak
  - virtio: i2c: Check notifier helpers for VIRTIO_CONFIG_IRQ_IDX
  - hw/virtio: fix typo in VIRTIO_CONFIG_IRQ_IDX comments
  - virtio-net: clear guest_announce feature if no cvq backend
  - vdpa: fix VHOST_BACKEND_F_IOTLB_ASID flag check
  - vdpa: do not block migration if device has cvq and x-svq=on
  - vdpa net: block migration if the device has CVQ
  - vdpa: Return -EIO if device ack is VIRTIO_NET_ERR in _load_mq()
  - vdpa: Return -EIO if device ack is VIRTIO_NET_ERR in _load_mac()
  - vdpa: fix not using CVQ buffer in case of error
  - vdpa: Fix possible use-after-free for VirtQueueElement
  - hw/virtio: fix vhost_user_read tracepoint
  - vhost: Fix false positive out-of-bounds
  - vhost: fix possible wrap in SVQ descriptor ring
  - vhost: move iova_tree set to vhost_svq_start
  - vhost: Always store new kick fd on vhost_svq_set_svq_kick_fd
  - virtio-crypto: verify src&dst buffer length for sym request
  - vdpa: commit all host notifier MRs in a single MR transaction
  - vdpa: harden the error path if get_iova_range failed
  - vdpa-dev: get iova range explicitly
  - virtio-pci: add support for configure interrupt
  - virtio-mmio: add support for configure interrupt
  - virtio-net: add support for configure interrupt
  - vhost: add support for configure interrupt
  - virtio: add support for configure interrupt
  - vhost-vdpa: add support for config interrupt
  - vhost: introduce new VhostOps vhost_set_config_call
  - virtio-pci: decouple the single vector from the interrupt process
  - virtio-pci: decouple notifier from interrupt process
  - virtio: introduce macro VIRTIO_CONFIG_IRQ_IDX
  - vdpa: do not handle VIRTIO_NET_F_GUEST_ANNOUNCE in vhost-vdpa
  - vdpa: handle VIRTIO_NET_CTRL_ANNOUNCE in vhost_vdpa_net_handle_ctrl_avail
  - vhost: fix vq dirty bitmap syncing when vIOMMU is enabled
  - hw/virtio: gracefully handle unset vhost_dev vdev
  - hw/virtio/vhost: Fix typo in comment.
  - vdpa: always start CVQ in SVQ mode if possible
  - vdpa: add shadow_data to vhost_vdpa
  - vdpa: store x-svq parameter in VhostVDPAState
  - vdpa: add asid parameter to vhost_vdpa_dma_map/unmap
  - vdpa: allocate SVQ array unconditionally
  - vdpa: move SVQ vring features check to net/
  - vdpa: request iova_range only once
  - vdpa: add vhost_vdpa_net_valid_svq_features
  - vhost: allocate SVQ device file descriptors at device start
  - vhost: set SVQ device call handler at SVQ start
  - vdpa: use v->shadow_vqs_enabled in vhost_vdpa_svqs_start & stop
  - vhost: enable vrings in vhost_dev_start() for vhost-user devices
  - vhost-vdpa: fix assert !virtio_net_get_subqueue(nc)->async_tx.elem in virtio_net_reset
  - net/vhost-vdpa.c: Fix clang compilation failure
  - vhost-vdpa: allow passing opened vhostfd to vhost-vdpa
  - vdpa: Remove shadow CVQ command check
  - vdpa: Delete duplicated vdpa_feature_bits entry
  - hw/virtio: add some vhost-user trace events
  - vdpa: Allow MQ feature in SVQ
  - virtio-net: Update virtio-net curr_queue_pairs in vdpa backends
  - vdpa: validate MQ CVQ commands
  - vdpa: Add vhost_vdpa_net_load_mq
  - vdpa: extract vhost_vdpa_net_load_mac from vhost_vdpa_net_load
  - vdpa: Make VhostVDPAState cvq_cmd_in_buffer control ack type
  - vdpa: Delete CVQ migration blocker
  - vdpa: Add virtio-net mac address via CVQ at start
  - vhost_net: add NetClientState->load() callback
  - vdpa: extract vhost_vdpa_net_cvq_add from vhost_vdpa_net_handle_ctrl_avail
  - vdpa: Move command buffers map to start of net device
  - vdpa: add net_vhost_vdpa_cvq_info NetClientInfo
  - vhost_net: Add NetClientInfo stop callback
  - vhost_net: Add NetClientInfo start callback
  - vdpa: Use ring hwaddr at vhost_vdpa_svq_unmap_ring
  - vdpa: Make SVQ vring unmapping return void
  - vdpa: Remove SVQ vring from iova_tree at shutdown
  - util: accept iova_tree_remove_parameter by value
  - vdpa: do not save failed dma maps in SVQ iova tree
  - vdpa: Skip the maps not in the iova tree
  - vdpa: Fix file descriptor leak on get features error
  - vdpa: Fix memory listener deletions of iova tree
  - vhost: Get vring base from vq, not svq
  - vdpa: Add x-svq to NetdevVhostVDPAOptions
  - vdpa: Add device migration blocker
  - vdpa: Extract get features part from vhost_vdpa_get_max_queue_pairs
  - vdpa: Buffer CVQ support on shadow virtqueue
  - vdpa: manual forward CVQ buffers
  - vdpa: Export vhost_vdpa_dma_map and unmap calls
  - vhost: Add svq avail_handler callback
  - vhost: add vhost_svq_poll
  - vhost: Expose vhost_svq_add
  - vhost: add vhost_svq_push_elem
  - vhost: Track number of descs in SVQDescState
  - vhost: Add SVQDescState
  - vhost: Decouple vhost_svq_add from VirtQueueElement
  - vhost: Check for queue full at vhost_svq_add
  - vhost: Move vhost_svq_kick call to vhost_svq_add
  - vhost: Reorder vhost_svq_kick
  - vdpa: Avoid compiler to squash reads to used idx
  - virtio-net: Expose ctrl virtqueue logic
  - virtio-net: Expose MAC_TABLE_ENTRIES
  - vhost: move descriptor translation to vhost_svq_vring_write_descs
  - util: Return void on iova_tree_remove
  - virtio-net: don't handle mq request in userspace handler for vhost-vdpa
  - vhost-vdpa: change name and polarity for vhost_vdpa_one_time_request()
  - vhost-vdpa: backend feature should set only once
  - vhost-vdpa: fix improper cleanup in net_init_vhost_vdpa
  - virtio-net: align ctrl_vq index for non-mq guest for vhost_vdpa
  - virtio: add vhost support for virtio devices
  - include/hw: start documenting the vhost API
  - hw/virtio: add vhost_user_[read|write] trace points
  - vhost: Fix element in vhost_svq_add failure
  - vdpa: Fix index calculus at vhost_vdpa_svqs_start
  - vdpa: Fix bad index calculus at vhost_vdpa_get_vring_base
  - vhost: Fix device's used descriptor dequeue
  - vhost: Track descriptor chain in private at SVQ
  - vdpa: Add missing tracing to batch mapping functions
  - vhost-vdpa: fix typo in a comment
  - virtio: fix --enable-vhost-user build on non-Linux
  - vdpa: Expose VHOST_F_LOG_ALL on SVQ
  - vdpa: Never set log_base addr if SVQ is enabled
  - vdpa: Adapt vhost_vdpa_get_vring_base to SVQ
  - vdpa: Add custom IOTLB translations to SVQ
  - vhost: Add VhostIOVATree
  - util: add iova_tree_find_iova
  - util: Add iova_tree_alloc_map
  - vhost: Shadow virtqueue buffers forwarding
  - vdpa: adapt vhost_ops callbacks to svq
  - virtio: Add vhost_svq_get_vring_addr
  - vhost: Add vhost_svq_valid_features to shadow vq
  - vhost: Add Shadow VirtQueue call forwarding capabilities
  - vhost: Add Shadow VirtQueue kick forwarding capabilities
  - vhost: Add VhostShadowVirtqueue
  - vdpa: Make ncs autofree
  - Revert "virtio: introduce macro IRTIO_CONFIG_IRQ_IDX"
  - Revert "virtio-pci: decouple notifier from interrupt process"
  - Revert "virtio-pci: decouple the single vector from the interrupt process"
  - Revert "vhost-vdpa: add support for config interrupt"
  - Revert "virtio: add support for configure interrupt"
  - Revert "vhost: add support for configure interrupt"
  - Revert "virtio-net: add support for configure interrupt"
  - Revert "virtio-mmio: add support for configure interrupt"
  - Revert "virtio-pci: add support for configure interrupt"
  - Revert "vhost: introduce new VhostOps vhost_set_config_call"
  - virtio: signal after wrapping packed used_idx
  - target/i386: Adjust feature level according to FEAT_7_1_EDX
  - target/i386: Add new CPU model GraniteRapids
  - target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration
  - target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration
  - target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration
  - target/i386: Add support for AVX-IFMA in CPUID enumeration
  - target/i386: Add support for AMX-FP16 in CPUID enumeration
  - target/i386: Add support for CMPCCXADD in CPUID enumeration
  - tracetool: avoid invalid escape in Python string
  - hw/pvrdma: Protect against buggy or malicious guest driver
  - vga: avoid crash if no default vga card mainline inclusion commit 6985d8ede92494f3b791de01e8ee9306eb6d5e4a category: bugfix
  - qom/object: Remove circular include dependency mainline inclusion commit 5bba9bcfbb42e7c016626420e148a1bf1b080835 category: bugfix
  - artist: set memory region owners for buffers to the  artist device mainline inclusion commit 39fbaeca096a9bf6cbe2af88572c1cb2aa62aa8c category: bugfix
  - virtio-iommu: Fix the partial copy of probe request mainline inclusion commit 45461aace83d961e933b27519b81d17b4c690514 category: bugfix
  - e1000: set RX descriptor status in a separate  operation mainline inclusion commit 034d00d4858161e1d4cff82d8d230bce874a04d3 category: bugfix
  - vhost: introduce new VhostOps vhost_set_config_call
  - vhost: stick to -errno error return convention
  - vhost-user: stick to -errno error return convention
  - vhost-vdpa: stick to -errno error return convention
  - virtio-pci: add support for configure interrupt
  - virtio-mmio: add support for configure interrupt
  - virtio-net: add support for configure interrupt
  - vhost: add support for configure interrupt
  - virtio: add support for configure interrupt
  - vhost-vdpa: add support for config interrupt
  - virtio-pci: decouple the single vector from the interrupt process
  - virtio-pci: decouple notifier from interrupt process
  - virtio: introduce macro IRTIO_CONFIG_IRQ_IDX
  - pci: Fix the update of interrupt disable bit in PCI_COMMAND register
  - hw/timer/npcm7xx_timer: Prevent timer from counting down past zero
  - tpm_crb: mark command buffer as dirty on request  completion mainline inclusion commit e37a0ef4605e5d2041785ff3fc89ca6021faf7a0 category: bugfix
  - pci: fix overflow in snprintf string formatting mainline inclusion commit 36f18c6989a3d1ff1d7a0e50b0868ef3958299b4 category: bugfix
  - hw/usb/hcd-ehci: fix writeback order mainline inclusion commit f471e8b060798f26a7fc339c6152f82f22a7b33d category: bugfix
  - qemu-timer: Skip empty timer lists before locking  in qemu_clock_deadline_ns_all mainline inclusion commit 3f42906c9ab2c777a895b48b87b8107167e4a275 category: bugfix
  - semihosting/config: Merge --semihosting-config  option groups mainline inclusion commit 90c072e063737e9e8f431489bbd334452f89056e category: bugfix
  - semihosting: fix memleak at semihosting_arg_fallback
  - target/i386: Export GDS_NO bit to guests


author: <fengjiabo1@huawei.com> - 10:6.2.0-86
changelog:
  - vdpa: move memory listener to the realize stage
  - vdpa: implement vdpa device migration
  - vhost: implement post resume bh
  - vhost: implement migration state notifier for vdpa device
  - vhost: implement savevm_hanlder for vdpa device
  - vhost: implement vhost_vdpa_device_suspend/resume
  - vhost: implement vhost-vdpa suspend/resume
  - vhost: add vhost_dev_suspend/resume_op
  - vhost: introduce bytemap for vhost backend logging
  - vhost-vdpa: add migration log ops for VhostOps
  - vhost-vdpa: add VHOST_BACKEND_F_BYTEMAPLOG
  - vhost: fix null pointer access
  - ui/gtk: prevent ui lock up when dpy_gl_update called again before current draw event occurs
  - hw/usb: dev-mtp: Use g_mkdir()
  - target/ppc/cpu-models: Remove the "default" CPU alias
  - hw/intc/arm_gicv3: ICC_PMR_EL1 high bits should be RAZ
  - Fixed a QEMU hang when guest poweroff in COLO mode
  - migration/colo: More accurate update checkpoint time
  - scripts/entitlement.sh: Use backward-compatible cp flags
  - block/nvme: fix infinite loop in nvme_free_req_queue_cb()
  - hw/net: npcm7xx_emc fix missing queue_flush
  - Add dummy Aspeed AST2600 Display Port MCU (DPMCU)
  - hw/arm: ast2600: Fix address mapping of second SPI controller
  - vhost-user-blk: reconnect on any error during realize
  - vhost-user-blk: propagate error return from generic vhost
  - hw/riscv: boot: Reduce FDT address alignment constraints
  - Revert "hw/virtio/virtio-iommu-pci: Enforce the device is plugged on the root bus"
  - Fix STM32F2XX USART data register readout
  - block: use 'unsigned' for in_flight field on driver state
  - sphinx: change default language to 'en'
  - tests/qtest: Fix two format strings
  - trivial typos: namesapce
  - hw/ide/atapi.c: Correct typos (CD-CDROM -> CD-ROM)
  - hw/virtio/virtio-iommu-pci: Enforce the device is plugged on the root bus
  - hw/display/next-fb: Fix comment typo
  - xen/pass-through: merge emulated bits correctly mainline inclusion commit be9c61da9fc57eb7d293f380d0805ca6f46c2657 category: bugfix
  - tests/qtest/migration-test.c: spelling fix: bandwith
  - target/i386/cpu: Improve error message for property "vendor"
  - balloon: Fix a misleading error message
  - target/arm: Don't set syndrome ISS for loads and  stores with writeback mainline inclusion commit 53ae2fdef1f5661cbaa2ea571c517f98e6041cb8 category: bugfix
  - disas/hppa: Show hexcode of instruction along with disassembly
  - tcg/loongarch64: Fix tcg_out_mov() Aborted
  - ui/qmp-cmds: Improve two error messages
  - qga: Improve guest-exec-status error message
  - hmp: Improve sync-profile error message
  - spapr/pci: Correct "does not support hotplugging error messages
  - xen/pass-through: don't create needless register  group mainline inclusion commit c0e86b7624cb9d6db03e0d48cf82659e5b89a6a6 category: bugfix


author: <fengjiabo1@huawei.com> - 10:6.2.0-87
changelog:
  - vdpa: suspend function return 0 when the vdpa device is stopped
  - vdpa: don't suspend/resume device when vdpa device not started
  - vdpa: support vdpa device suspend/resume
  - vdpa: correct param passed in when unregister save
  - vdpa: set vring enable only if the vring address has already been set
  - shadow_dev: introduce shadow dev for virtio-net device
  - revert "tcg/loongarch64: Fix tcg_out_mov() Aborted"
  - migration: Set downtime_start even for postcopy
  - gdb-xml: fix duplicate register in arm-neon.xml
  - iotests: fix default machine type detection
  - migration: fix RAMBlock add NULL check
  - s390x: Fix spelling errors
  - ppc: spelling fixes
  - hw/scsi/vhost-scsi: don't double close vhostfd on error
  - virtio/vhost-vsock: don't double close vhostfd, remove redundant cleanup
  - hw/scsi/vhost-scsi: don't leak vqs on error
  - hw/i386/pc: Add missing property descriptions
  - pcie_aer: Don't trigger a LSI if none are defined
  - pci: Export the pci_intx() function
  - hw/qdev: Cosmetic around documentation
  - tests/unit: fix a -Wformat-truncation warning
  - tests/avocado: mark ReplayKernelNormal.test_mips64el_malta as flaky
  - i386/sev: Avoid SEV-ES crash due to missing MSR_EFER_LMA bit
  - ui/vnc-clipboard: fix inflate_buffer
  - hw/usb/hcd-xhci.c: spelling: tranfer


author: <fengjiabo1@huawei.com> - 10:6.2.0-88
changelog:
  - ui/vnc.c: Fixed a deadlock bug.
  - hw/i386: Fix comment style in topology.h
  - migration/multifd: Remove unnecessary usage of local Error
  - linux-user: fix sockaddr_in6 endianness
  - vhost_vdpa: fix the input in trace_vhost_vdpa_listener_region_del()
  - iotests: fix 194: filter out racy postcopy-active event
  - tests/avocado: fix waiting for vm shutdown in replay_linux
  - ui/vnc: fix debug output for invalid audio message


author: <fengjiabo1@huawei.com> - 10:6.2.0-89
changelog:
  - qga-win: Fix guest-get-fsinfo multi-disks collection
  - hw/timer: fix systick trace message
  - virtio-net: correctly copy vnet header when flushing TX (CVE-2023-6693)
  - ui/clipboard: mark type as not available when there is no data (CVE-2023-6683)
  - esp: restrict non-DMA transfer length to that of available data (CVE-2024-24474)
  - hw/scsi/lsi53c895a: add missing decrement of reentrancy counter
  - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330)
  - net: Update MemReentrancyGuard for NIC (CVE-2023-3019)
  - net: Provide MemReentrancyGuard * to qemu_new_nic()


author: <fengjiabo1@huawei.com> - 10:6.2.0-90
changelog:
  - i386/cpuid: Move leaf 7 to correct group
  - i386/cpuid: Decrease cpuid_i when skipping CPUID leaf 1F
  - i386/cpu: Mask with XCR0/XSS mask for FEAT_XSAVE_XCR0_HI and FEAT_XSAVE_XSS_HI leafs
  - i386/cpu: Clear FEAT_XSAVE_XSS_LO/HI leafs when CPUID_EXT_XSAVE is not available
  - target/i386: Change wrong XFRM value in SGX CPUID leaf
  - target/i386: Enable support for XSAVES based features
  - target/i386: Add kvm_get_one_msr helper
  - hw/block/hd-geometry: Do not override specified bios-chs-trans mainline inclusion commit fd8a68ad6823d33bedeba20a22857867a1c3890e category: bugfix
  - linux-user/riscv: Align signal frame to 16 bytes mainline inclusion commit 1eaa63429a9944265c92efdb94c02fabb231f564 category: bugfix
  - ipmi:smbus: Add a check around a memcpy mainline inclusion commit 3fde641e7286f9b968bdb3b4b922c6465f2a9abc category: bugfix
  - tests/tcg/linux-test: Fix random hangs in test_socket mainline inclusion commit b9e6074fc5b429b1e956e9c60db7e284a91e0f3d category: bugfix
  - qemu-options.hx: Don't claim "-serial" has limit of 4 serial ports Before v2.12, the implementation of serial ports was limited to a value of MAX_SERIAL_PORTS = 4. We now dynamically allocate the data structures for serial ports, so this limit is no longer present, but the documentation for the -serial options still reads:
  - target/ppc: Modify the uncorrect value irq to n_IRQ
  - block-migration: Ensure we don't crash during migration cleanup
  - target/s390x: fix handling of zeroes in vfmin/vfmax mainline inclusion commit 13c59eb09bd6d1fbc13f08b708226421f14a232b category: bugfix
  - hw/virtio/virtio-iommu: Enforce power-of-two notify for both MAP and UNMAP mainline inclusion commit 0522be9a0c0094088ccef7aab352c57f483ca250 category: bugfix
  - configure: Add missing POSIX-required space mainline inclusion commit 35a7a6fc5624b1df828d82f2dfa74d0e4188b3b2 category: bugfix
  - vga: fix incorrect line height in 640x200x2 mode mainline inclusion commit 37e7b86766244b62a406747bb78e049390d0b528 category: bugfix
  - hw/ide/core: set ERR_STAT in unsupported command completion
  - linux-user/flatload.c: Fix setting of  image_info::end_code mainline inclusion commit 734a659ad264ac080457167e845ffabbaaa66d0e category: bugfix
  - load_elf: fix iterator's type for elf file processing
  - hw/misc/mps2-scc: Free MPS2SCC::oscclk[] array on finalize()
  - hw/nvram/xlnx-efuse: Free XlnxEFuse::ro_bits[] array on finalize()
  - hw/nvram/xlnx-efuse-ctrl: Free XlnxVersalEFuseCtrl[] "pg0-lock" array
  - chardev/char.c: fix "abstract device type" error message
  - block/rbd: fix handling of holes in .bdrv_co_block_status
  - qga: treat get-guest-fsinfo as "best effort" mainline inclusion commit bbb0151cf2e82489120a15df5e2eb9653312b0ec category: bugfix
  - usb/hcd-xhci: check slotid in  xhci_wakeup_endpoint() mainline inclusion commit 84218892f05515d20347fde4506e1944eb11cb25 category: bugfix
  - hw/display/bcm2835_fb: Fix framebuffer allocation  address mainline inclusion commit 5865d99fe88d8c8fa437c18c6b63fb2a8165634f category: bugfix
  - block/parallels: Fix buffer-based write call mainline inclusion commit eba088f91d21d9e42a81bef847173da30c5da961 category: bugfix
  - vl: Improve error message for conflicting -incoming and -loadvm
  - hw/smbios: Fix OEM strings table option validation


author: <fengjiabo1@huawei.com> - 10:6.2.0-91
changelog:
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/virtio: Introduce virtio_bh_new_guarded() helper
  - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded
  - checkpatch: add qemu_bh_new/aio_bh_new checks
  - async: avoid use-after-free on re-entrancy guard
  - async: Add an optional reentrancy guard to the BH API
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set(CVE-2024-3447)
  - rtl8139: Remove unused variable
  - tulip: Remove unused variable
  - virtio-mem: Fix the bitmap index of the section offset
  - virtio-mem: Fix the iterator variable in a vmem->rdl_list loop
  - system/memory: use ldn_he_p/stn_he_p
  - block: Fix crash when loading snapshot on inactive node
  - smmu: Clear SMMUPciBus pointer cache when system reset
  - block/mirror: Fix NULL s->job in active writes
  - amd_iommu: Fix APIC address check
  - virtio-crypto: fix NULL pointer dereference in virtio_crypto_free_reques
  - libqos/virtio.c: Correct 'flags' reading in qvirtqueue_kick
  - ivshmem-test.c: enable test_ivshmem_server for ppc64 arch
  - ivshmem.c: change endianness to LITTLE_ENDIAN
  - hw/ppc/mac.h: Remove MAX_CPUS macro
  - configure: remove dead variables
  - virtio-gpu: do not byteswap padding
  - hw/intc: clean-up error reporting for failed ITS cmd
  - qemu-iotests: Discard stderr when probing devices
  - linux-user: un-parent OBJECT(cpu) when closing thread
  - hw/net/rocker: Avoid undefined shifts with more than 31 ports
  - contrib/vhost-user-blk: Clean up deallocation of VuVirtqElement
  - scsi-disk: fix overflow when block size is not a multiple of BDRV_SECTOR_SIZE


author: wangyuhang <wangyuhang27@huawei.com> - 249-67
changelog:
  - backport: sync patches from systemd community
              add backport-journal-recalculate-line_max-when-stdout-stream-stat.patch
              backport-pid1-terminate-cylon-string.patch
              backport-pid1-move-draw_cylong-to-pretty-print.-ch.patch
              backport-test-add-test-for-draw_cylon.patch
              backport-locale-util-do-not-call-setlocale-when-multi-threade.patch
              backport-resolve-fix-wrong-error-cause-assignment-to-log_debu.patch
              backport-resolve-do-not-trigger-assertion-on-exit.patch
              backport-network-neighbor-add-missing-OOM-check.patch
              backport-dissect-tool-right-align-the-partition-number.patch
              backport-dissect-image-fix-fd-leak-in-dissected_image_acquire.patch
              backport-udev-even-if-a-device-is-a-zac-device-scsi-ID_SERIAL.patch
              backport-core-log-message-when-reloading-finishes.patch


author: huyubiao <huyubiao@huawei.com> - 249-68
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add backport-basic-fix-overflow-detection-in-sigbus_pop.patch
         backport-busctl-avoid-asserting-on-NULL-message.patch
         backport-resolve-don-t-add-sockets-to-the-graveyard-on-shutdo.patch
         backport-sd-journal-check-sd-event-state-before-setting-up-po.patch


author: huyubiao <huyubiao@huawei.com> - 249-69
changelog:
  - move the architecture patches after Patch9800 (excluding Patch9800)
    delete the duplicate systemd-coredump.socket


author: huyubiao <huyubiao@huawei.com> - 249-72
changelog:
  - DESC:add backport-core-exec-do-not-crash-with-UtmpMode-user-without-Us.patch
         backport-resolved-limit-the-number-of-signature-validations-i.patch
         backport-resolved-reduce-the-maximum-nsec3-iterations-to-100.patch


