# changelog

author: Benshuai5D <benshuai5d@163.com> - 1:1.8.0.402-b06.4
changelog:
  - add 8322725-tz-Update-Timezone-Data-to-2023d.patch
  - add 8325150-tz-Update-Timezone-Data-to-2024a.patch
  - add 8220175-serviceability-dcmd-framework-VMVersionTest..patch
  - add 8149343-assert-rp-num_q-no_of_gc_workers-failed-sani.patch
  - add 8139595-MethodHandles-remove_dependent_nmethod-is-no.patch
  - add 8143408-Crash-during-InstanceKlass-unloading-when-cl.patch
  - add GCC-12-reports-some-compiler-warnings.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> -1:1.8.0.412-b08.0
changelog:
  - del 8322725-tz-Update-Timezone-Data-to-2023d.patch
  - del 8325150-tz-Update-Timezone-Data-to-2024a.patch
  - del fix-the-length-value-of-ciBlock-in-ciMethodBlocks.cp.patch
  - modified 8014628-Support-AES-Encryption-with-HMAC-SHA2-for-Ke.patch
  - modified 8057743-process-Synchronize-exiting-of-threads-and-p.patch
  - modified add-missing-test-case.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified kae-phase2.patch
  - modified support-numactl-for-hadoop-yarn.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch


author: kuenking111 <wangkun49@huawei.com> -1:1.8.0.412-b08.3
changelog:
  - add DependencyContext-mark_dependent_nmethods-crash-in-Dynamic-cds-mode.patch
  - add 8138922-StubCodeDesc-constructor-publishes-partially-constructed.patch


author: songliyang <songliyang@kylinos.cn> -1:1.8.0.412-b08.4
changelog:
  - fix LoongArch64-support.patch error that apply patch on loongarch64 in prep stage
  - fix loongson vendor error


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.8.7-2
changelog:
  - add add-Parallel-Full-gc-mark-stack-draining-should.patch
  - add add-8271579-G1-Move-copy-before-CAS-in-do_copy.patch
  - add add-8267185-Add-string-deduplication-support-to.patch
  - add add-8292296-Use-multiple-threads-to-process-Par.patch
  - add fix-cds-SignedJar_java-test-fails.patch


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.9.8-0.rolling
changelog:
  - fix 8253495-CDS-generates-non-deterministic-outpu.patch
  - fix add-8267185-Add-string-deduplication-support-to.patch
  - fix add-version-txt.patch


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.9.8-1
changelog:
  - add 8295068-SSLEngine-throws-NPE-parsing-CertificateRequ.patch
  - add 8316576-com.sun.jndi.ldap.Connection.cleanup-does-no.patch
  - add 8314063-The-socket-is-not-closed-in-Connection-creat.patch
  - add 8314236-Overflow-in-Collections.rotate.patch
  - add 8313626-C2-crash-due-to-unexpected-exception-control.patch
  - add 8168469-Memory-leak-in-JceSecurity.patch
  - add 8312065-Socket.connect-does-not-timeout-when-profili.patch
  - add 8285516-clearPassword-should-be-called-in-a-finally-.patch
  - add 8312200-Fix-Parse-catch_call_exceptions-memory-leak.patch


author: neu-mobi <liuyulong.work@qq.com> - 1:17.0.10.9-0.rolling
changelog:
  - del 8168469-Memory-leak-in-JceSecurity.patch
  - del 8275509-ModuleDescriptor.hashCode-isn-t-rep.patch
  - del 8275509-ModuleDescriptor.hashCode-isn-t-reproducible.patch
  - del 8285516-clearPassword-should-be-called-in-a-finally-.patch
  - del 8312065-Socket.connect-does-not-timeout-when-profili.patch
  - del 8313626-C2-crash-due-to-unexpected-exception-control.patch
  - del 8314063-The-socket-is-not-closed-in-Connection-creat.patch
  - del 8316576-com.sun.jndi.ldap.Connection.cleanup-does-no.patch
  - modified 8253495-CDS-generates-non-deterministic-outpu.patch
  - modified 8280872-Reorder-code-cache-segments-to-improv.patch
  - modified add-version-txt.patch
  - add Add-problemlist.patch
  - add puyuan-jdk17.0.9-patch.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> - 1:17.0.11.9-0.rolling
changelog:
  - del 8295068-SSLEngine-throws-NPE-parsing-CertificateRequ.patch
  - modify puyuan-jdk17.0.9-patch.patch


author: songliyang <songliyang@kylinos.cn> - 1:17.0.11.9-1
changelog:
  - rewrite LoongArch64-support.patch to sovle error while applying this patch in prep stage
  - fix loongarch vendor error and delete redundant vendor args


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.47.0.125
changelog:
  - !5345  CVE-2023-52447
  - !5367 v2  CVE-2023-52452
  - !5295 [sync] PR-5229:  iommu/arm-smmu-v3: Disable ECMDQ before reset
  - bpf: Fix accesses to uninit stack slots
  - bpf: Fix verification of indirect var-off stack access
  - bpf: Allow reads from uninit stack
  - bpf: expose bpf_strtol and bpf_strtoul to all program types
  - bpf, verifier: Fix memory leak in array reallocation for stack state
  - bpf: verifier: Use copy_array for jmp_history
  - bpf: verifier: Improve function state reallocation
  - !5183 [sync] PR-4805:  CVE-2023-52451 backport to OLK-5.10 v2
  - bpf: Fix kabi breakage in struct bpf_map and struct bpf_map_ops
  - bpf: Defer the free of inner map when necessary
  - bpf: Set need_defer as false when clearing fd array during map free
  - bpf: Add map and need_defer parameters to .map_fd_put_ptr()
  - !5279 [sync] PR-5246:  ceph: fix deadlock or deadcode of misusing dget()
  - !5297 [sync] PR-5240:  powerpc/lib: Validate size for vector operations
  - powerpc/lib: Validate size for vector operations
  - iommu/arm-smmu-v3: Disable ECMDQ before reset
  - !5227 [sync] PR-5197:  drm: Don't unref the same fb many times by mistake due to deadlock handling
  - !4854 [sync] PR-4847:  btrfs: mainline backport
  - ceph: fix deadlock or deadcode of misusing dget()
  - !5193 [sync] PR-5164:  nfc: nci: assert requested protocol is valid
  - !5186 [sync] PR-5156:  RDMA/srp: Do not call scsi_done() from srp_abort()
  - !5099 [sync] PR-5078:  RDMA/rxe: Return CQE error if invalid lkey was supplied
  - drm: Don't unref the same fb many times by mistake due to deadlock handling
  - !5202 [sync] PR-5178:  net: nfc: llcp: Add lock when modifying device list
  - net: nfc: llcp: Add lock when modifying device list
  - nfc: nci: assert requested protocol is valid
  - RDMA/srp: Do not call scsi_done() from srp_abort()
  - !5167 [sync] PR-5117:  fix CVE-2023-52527
  - powerpc/pseries/memhp: Fix access beyond end of drmem array
  - powerpc/pseries/memhotplug: Quieten some DLPAR operations
  - l2tp: pass correct message length to ip6_append_data
  - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
  - RDMA/rxe: Return CQE error if invalid lkey was supplied
  - btrfs: fix deadlock when cloning inline extents and using qgroups
  - btrfs: do not start and wait for delalloc on snapshot roots on transaction commit


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.48.0.126
changelog:
  - !5535  media: pvrusb2: fix use after free on context disconnection
  - !5504 [sync] PR-5316: v2  iomap: add support to track dirty state of sub pages
  - media: pvrusb2: fix use after free on context disconnection
  - !5139 [sync] PR-4933:  scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
  - !5029 [sync] PR-4987:  net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
  - iomap: add support to track dirty state of sub pages
  - !5440 [sync] PR-5286:  serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
  - !5325  jfs: fix slab-out-of-bounds Read in dtSearch
  - !5330  UBSAN: array-index-out-of-bounds in dtSplitRoot
  - !5437 [sync] PR-5355:  CVE-2023-52593
  - !5312  FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - !5391 [sync] PR-5259:  CVE-2024-26627​
  - serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
  - wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()
  - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
  - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
  - !5373 [sync] PR-5313:  bus: mhi: host: Add alignment check for event ring read pointer
  - !5289 [sync] PR-5231:  af_unix: fix lockdep positive in sk_diag_dump_icons()
  - bus: mhi: host: Add alignment check for event ring read pointer
  - UBSAN: array-index-out-of-bounds in dtSplitRoot
  - jfs: fix slab-out-of-bounds Read in dtSearch
  - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - af_unix: fix lockdep positive in sk_diag_dump_icons()
  - scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.49.0.127
changelog:
  - !5683 [sync] PR-5266:  llc: call sock_orphan() at release time
  - !5691  net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  - !5687 [sync] PR-5253:  tomoyo: fix UAF write bug in tomoyo_write_control()
  - net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  - tomoyo: fix UAF write bug in tomoyo_write_control()
  - llc: call sock_orphan() at release time
  - !5434 [sync] PR-5232:  jfs: fix cve issue
  - !5639 [sync] PR-5617: v4  Fix I/O high when memory almost met memcg limit
  - !5666 [sync] PR-5580:  CVE-2023-52622
  - ext4: avoid online resizing failures due to oversized flex bg
  - ext4: unify the type of flexbg_size to unsigned int
  - ext4: remove unnecessary check from alloc_flex_gd()
  - !5649 [sync] PR-5493:  arm64/mpam: Fix repeated enabling in mpam_enable()
  - !5636 [sync] PR-5518:  dm: revert partial fix for redundant bio-based IO accounting
  - !5633 [sync] PR-5521:  md/raid5: fix atomicity violation in raid5_cache_count
  - arm64/mpam: Fix repeated enabling in mpam_enable()
  - !5620 [sync] PR-5606:  mm/mlock: return EINVAL for illegal user memory range in mlock
  - mm/readahead: don't decrease mmap_miss when folio has workingset flags
  - mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM
  - !5611 [sync] PR-5447:  Fix CVE-2021-47094
  - dm: revert partial fix for redundant bio-based IO accounting
  - md/raid5: fix atomicity violation in raid5_cache_count
  - mm/mlock: return EINVAL for illegal user memory range in mlock
  - KVM: x86/mmu: Don't advance iterator after restart due to yielding
  - KVM: x86/mmu: Factor out tdp_iter_return_to_root
  - !5472  jfs: fix array-index-out-of-bounds in dbAdjTree
  - jfs: fix array-index-out-of-bounds in dbAdjTree
  - jfs: fix array-index-out-of-bounds in diNewExt
  - jfs: fix uaf in jfs_evict_inode


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.50.0.128
changelog:
  - !5940  CVE-2021-46926
  - !5946 [sync] PR-5861:  ksmbd: fix uaf in smb20_oplock_break_ack
  - !5938 [sync] PR-5911:  CVE-2023-52484
  - !5934 [sync] PR-5895:  i2c: i801: Fix block process call transactions
  - !5929 [sync] PR-5863:  CVE-2024-26788
  - !5910 [sync] PR-4928:  drm/bridge: sii902x: Fix probing race issue
  - !5783  ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - !5917 [sync] PR-5870:  drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - !5902 [sync] PR-4931:  phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
  - ksmbd: fix uaf in smb20_oplock_break_ack
  - ALSA: hda: intel-sdw-acpi: harden detection of controller
  - iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range
  - iommu/arm-smmu-v3: Fix size calculation in arm_smmu_mm_invalidate_range()
  - !5914 [sync] PR-5811:  Fixed CVE-2021-47037
  - !5873 [sync] PR-4794:  serial: imx: fix tx statemachine deadlock
  - !4910 [sync] PR-4865:  Input: powermate - fix use-after-free in powermate_config_complete
  - i2c: i801: Fix block process call transactions
  - dmaengine: fsl-qdma: init irq after reg initialization
  - !5898 [sync] PR-5808:  nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - !5890 [sync] PR-5832:  CVE-2023-52467
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - ASoC: q6afe-clocks: fix reprobing of the driver
  - ASoC: q6afe-clocks: fix warning on symbol scope
  - drm/bridge: sii902x: Fix probing race issue
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
  - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - !5750  ksmbd: fix global oob in ksmbd_nl_policy
  - mfd: syscon: Fix null pointer dereference in of_syscon_register()
  - serial: imx: fix tx statemachine deadlock
  - !5828 [sync] PR-5785:  net: qualcomm: rmnet: fix global oob in rmnet_policy
  - !5818 [sync] PR-5780:  bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  - !5814 [sync] PR-5787:  bpf: fix check for attempt to corrupt spilled pointer
  - !4801 [sync] PR-4764:  binder: signal epoll threads of self-work
  - !5792  usb: hub: Guard against accesses to uninitialized BOS descriptors
  - !5799 [sync] PR-5788: v2  Patches to Fix CVE-2023-52454
  - !5819 [sync] PR-5789:  perf/x86/lbr: Filter vsyscall addresses
  - net: qualcomm: rmnet: fix global oob in rmnet_policy
  - !5777 [sync] PR-5724:  ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - !4780 [sync] PR-4772:  x86/fpu: Stop relying on userspace for info to fault in xsave buffer
  - perf/x86/lbr: Filter vsyscall addresses
  - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  - bpf: fix check for attempt to corrupt spilled pointer
  - !5766 [sync] PR-5642:  btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - nvmet-tcp: Fix the H2C expected PDU len calculation
  - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
  - usb: hub: Guard against accesses to uninitialized BOS descriptors
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - ksmbd: fix global oob in ksmbd_nl_policy
  - !5721 [sync] PR-5506:  ext4: dio: Put endio under irq context for overwrite
  - ext4: Optimize endio process for DIO overwrites
  - iomap: Add a IOMAP_DIO_MAY_INLINE_COMP flag
  - iomap: pass a flags argument to iomap_dio_rw
  - iomap: rename the flags variable in __iomap_dio_rw
  - iomap: add IOMAP_DIO_INLINE_COMP
  - iomap: use an unsigned type for IOMAP_DIO_* defines
  - iomap: cleanup up iomap_dio_bio_end_io()
  - !5706 [sync] PR-5507:  ext4: Validate inode pa before using preallocation blocks
  - !5692  arm64/mpam: support MPAM v0.1 version
  - ext4: Validate inode pa before using preallocation blocks
  - arm64/mpam: support MPAM v0.1 version
  - Input: powermate - fix use-after-free in powermate_config_complete
  - binder: signal epoll threads of self-work
  - x86/fpu: Stop relying on userspace for info to fault in xsave buffer


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.51.0.129
changelog:
  - !6194  serial: 8250_port: Check IRQ data before use
  - !6182 [sync] PR-5093:  wifi: mac80211: fix potential key use-after-free
  - !6219  RDMA/siw: Fix connection failure handling
  - !6239 [sync] PR-6186:  Fixed CVE-2023-52504
  - !6220  x86/srso: Fix SBPB enablement for spec_rstack_overflow=off
  - !6237  uio_hv_generic: Fix another memory leak in error handling paths
  - !6233 [sync] PR-6192:  arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
  - x86/alternatives: Disable KASAN in apply_alternatives()
  - uio_hv_generic: Fix another memory leak in error handling paths
  - arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
  - uio_hv_generic: Fix another memory leak in error handling paths
  - !6195  tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
  - !6191 [sync] PR-5466:  wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - x86/srso: Fix SBPB enablement for spec_rstack_overflow=off
  - RDMA/siw: Fix connection failure handling
  - !6187 [sync] PR-5770: v2  scsi: hisi_sas: Fixed some issues in the SAS
  - !6115  cifs: Fix UAF in cifs_demultiplex_thread()
  - tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
  - serial: 8250_port: Check IRQ data before use
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - scsi: hisi_sas: Add cond_resched() to cq_thread_v3_hw()
  - scsi: hisi_sas: Default enable interrupt coalescing
  - !6174 [sync] PR-6137:  vfio/pci: Lock external INTx masking ops
  - wifi: mac80211: fix potential key use-after-free
  - !6128  fix-CVE-2021-47101-openEuler-22.03-LTS-SP2
  - vfio/pci: Lock external INTx masking ops
  - !6156 [sync] PR-5717: v2  fix CVE-2023-52587
  - !6150 [sync] PR-6101:  vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - !6146 [sync] PR-6047:  hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  - !6133 [sync] PR-4923:  mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
  - !5421 [sync] PR-5317:  KVM: s390: fix setting of fpc register
  - IB/ipoib: Fix mcast list locking
  - RDMA/IPoIB: Fix error code return in ipoib_mcast_join
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  - !5131 [sync] PR-5113:  fix CVE-2023-52578
  - !5122 [sync] PR-5062:  team: fix null-ptr-deref when team device type is changed
  - !6119  wifi: rt2x00: restart beacon queue when hardware reset
  - !6056 [sync] PR-6017:  drm/amdgpu: fix use-after-free bug
  - !6121  dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
  - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
  - asix: fix wrong return value in asix_check_host_enable()
  - asix: fix uninit-value in asix_mdio_read()
  - net: asix: fix uninit value bugs
  - dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
  - wifi: rt2x00: restart beacon queue when hardware reset
  - cifs: Fix UAF in cifs_demultiplex_thread()
  - !6079 [sync] PR-5973:  EDAC/thunderx: Fix possible out-of-bounds string access
  - !6044 [sync] PR-5995:  mm/swap: fix race when skipping swapcache
  - !6024 [sync] PR-5970:  fixup CVE-2024-26751
  - !6036 [sync] PR-5969:  fbdev: savage: Error out if pixclock equals zero
  - EDAC/thunderx: Fix possible out-of-bounds string access
  - !5850  ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - !6060  fs/ntfs3: fix CVE-2023-52640
  - fs/ntfs3: Fix oob in ntfs_listxattr
  - fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea()
  - ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
  - drm/amdgpu: fix use-after-free bug
  - mm/swap: fix race when skipping swapcache
  - !5989 [sync] PR-5901:  CVE-2024-26695
  - !5982 [sync] PR-5812:  afs: Increase buffer size in afs_update_volume_status()
  - fbdev: savage: Error out if pixclock equals zero
  - ARM: ep93xx: Add terminator to gpiod_lookup_table
  - !5949 [sync] PR-5831:  fbdev: sis: Error out if pixclock equals zero
  - !5960 [sync] PR-5884:  KVM: arm64: vgic-its: Fix CVE-2024-26598 fix patch issue
  - !5844 [sync] PR-5348:  s390/ptrace: handle setting of fpc register correctly
  - !5962 [sync] PR-5745: v2  iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol
  - crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
  - !5859  dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - afs: Increase buffer size in afs_update_volume_status()
  - iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol
  - KVM: arm64: vgic-its: Fix CVE-2024-26598 fix patch issue
  - fbdev: sis: Error out if pixclock equals zero
  - dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - s390/ptrace: handle setting of fpc register correctly
  - KVM: s390: fix setting of fpc register
  - net: fix kabi check warning
  - net: Fix unwanted sign extension in netdev_stats_to_stats64()
  - net: bridge: use DEV_STATS_INC()
  - net: add atomic_long_t to net_device_stats fields
  - team: fix null-ptr-deref when team device type is changed


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.52.0.130
changelog:
  - !6415 [sync] PR-5510:  bus: mhi: host: Drop chan lock before queuing buffers
  - !6144 [sync] PR-6103:  riscv: Sparse-Memory/vmemmap out-of-bounds fix
  - !6536 [sync] PR-5222:  powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  - !6540 [sync] PR-5273:  net/smc: fix illegal rmb_desc access in SMC-D connection dump
  - !6530 [sync] PR-5468:  media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
  - !6498 [sync] PR-6407:  wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump
  - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  - !6507 [sync] PR-5773:  patches for CVE-2023-52617
  - !6503 [sync] PR-5772:  firmware: arm_scmi: Check mailbox/SMT channel for consistency
  - !6519  Fix CVE-2023-52498
  - media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
  - PM: sleep: Fix error handling in dpm_prepare()
  - PM: sleep: Fix possible deadlocks in core system-wide PM code
  - PM: core: Remove unnecessary (void *) conversions
  - PM: sleep: Avoid calling put_device() under dpm_list_mtx
  - PM: sleep: Use dev_printk() when possible
  - async: Introduce async_schedule_dev_nocall()
  - async: Split async_schedule_node_domain()
  - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
  - PCI: switchtec: Fix stdev_release() crash after surprise hot remove
  - firmware: arm_scmi: Check mailbox/SMT channel for consistency
  - !6489 [sync] PR-6455:  CVE-2021-47182
  - !6484 [sync] PR-3998:  cpufreq: CPPC: Fix performance/frequency conversion
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - !6434 [sync] PR-6312:  fix CVE-2024-24861 for 5.10
  - scsi: core: Fix scsi_mode_sense() buffer length handling
  - scsi: core: Reshuffle response handling in scsi_mode_sense()
  - cpufreq: CPPC: Fix performance/frequency conversion
  - !3994 [sync] PR-3982:  ACPI: CPPC: Assume no transition latency if no PCCT
  - !6471 [sync] PR-3793:  cppc_cpufreq: use policy->cpu in cppc_set_perf()
  - cppc_cpufreq: use policy->cpu as driver of frequency setting
  - cppc_cpufreq: clean up cpu, cpu_num and cpunum variable use
  - cppc_cpufreq: get cpunum from fb_ctrs instead of smp_processor_id()
  - media: xc4000: Fix atomicity violation in xc4000_get_frequency
  - !6412 [sync] PR-5195:  dmaengine: fix NULL pointer in channel unregistration function
  - bus: mhi: host: Drop chan lock before queuing buffers
  - dmaengine: fix NULL pointer in channel unregistration function
  - !6299  sp2 fix deadlock in cgroup1_writeback
  - cgroup_writeback: fix softlockup for blkcg->memcg_list
  - cgroup_writeback: fix deadlock in cgroup1_writeback
  - !6088  Fix CVE-2024-26764
  - !5968  Fix CVE-2023-52441 and integrate the pre-patch
  - riscv: Sparse-Memory/vmemmap out-of-bounds fix
  - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
  - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
  - ksmbd: fix out of bounds in init_smb2_rsp_hdr()
  - ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr
  - ksmbd: return unsupported error on smb1 mount
  - ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect
  - ACPI: CPPC: Assume no transition latency if no PCCT


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.53.0.131
changelog:
  - !6427 [sync] PR-6291:  aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  - !6903  bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
  - !6919  bpf: Fix hashtab overflow check on 32-bit arches
  - !6927  firmware: arm_scmi: Harden accesses to the reset domains
  - !6923  bpf: Fix stackmap overflow check on 32-bit arches
  - !6866 [sync] PR-6835:  kprobes: Fix check for probe enabled in kill_kprobe()
  - !6899 [sync] PR-6592:  net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  - firmware: arm_scmi: Harden accesses to the reset domains
  - bpf: Fix stackmap overflow check on 32-bit arches
  - bpf: Fix hashtab overflow check on 32-bit arches
  - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
  - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  - !6645 [sync] PR-6623:  amdkfd: use calloc instead of kzalloc to avoid integer overflow
  - kprobes: Fix check for probe enabled in kill_kprobe()
  - !6389 [sync] PR-6202:  ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  - !6629 [sync] PR-6485:  CVE-2024-26843
  - !6753 [sync] PR-6677: v3  olk-5.10: bugfix for mm
  - mm/madvise: fix potential pte_unmap_unlock pte error
  - mm/page_alloc: always attempt to allocate at least one page during bulk allocation
  - !6504  cachefiles: fix memory leak in cachefiles_add_cache()
  - !6688 [sync] PR-6580:  drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  - !6638 [sync] PR-6561:  md: fix kmemleak of rdev->serial
  - !6600 [sync] PR-6584:  ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  - amdkfd: use calloc instead of kzalloc to avoid integer overflow
  - !6609 [sync] PR-6579:  media: rc: bpf attach/detach requires write permission
  - !6608 [sync] PR-6568:  IB/hfi1: Fix a memleak in init_credit_return
  - !6610 [sync] PR-6543:  net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  - !6612 [sync] PR-6520:  firmware: arm_scmi: Fix double free in SMC transport cleanup path
  - md: fix kmemleak of rdev->serial
  - efi: runtime: Fix potential overflow of soft-reserved region size
  - !6250  ubi: Check for too small LEB size in VTBL code
  - firmware: arm_scmi: Fix double free in SMC transport cleanup path
  - !6450 [sync] PR-6281: v2  net/mlx5: Update error handler for UCTX and UMEM
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  - media: rc: bpf attach/detach requires write permission
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  - IB/hfi1: Fix a memleak in init_credit_return
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  - !6477  do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  - !6576 [sync] PR-6417:  media: pvrusb2: fix uaf in pvr2_context_set_notify
  - media: pvrusb2: fix uaf in pvr2_context_set_notify
  - cachefiles: fix memory leak in cachefiles_add_cache()
  - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  - net/mlx5: Update error handler for UCTX and UMEM
  - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  - ubi: Check for too small LEB size in VTBL code


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.54.0.132
changelog:
  - !6041 [sync] PR-6006:  fix CVE-2024-26669
  - !5883 [sync] PR-5751:  net: atlantic: Fix DMA mapping for PTP hwts ring
  - !7339  netfilter: nft_limit: reject configurations that cause integer overflow
  - !7255  netfilter: nf_tables: disallow timeout for anonymous sets
  - netfilter: nft_limit: reject configurations that cause integer overflow
  - netfilter: nf_tables: disallow timeout for anonymous sets
  - !7162 [sync] PR-6809:  memcg: fix possible use-after-free in memcg_write_event_control()
  - !7119 [sync] PR-7086:  media: ttpci: fix two memleaks in budget_av_attach
  - !7124 [sync] PR-7080:  drm: nv04: Fix out of bounds access
  - !7133 [sync] PR-7044: v2  nfs: fix UAF in direct writes
  - !7156 [sync] PR-7148:  scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - !6979  ksmbd: validate payload size in ipc response
  - !7099 [sync] PR-6818:  mm: memcg: fix stale protection of reclaim target memcg
  - memcg: fix possible use-after-free in memcg_write_event_control()
  - scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - nfs: fix UAF in direct writes
  - !6765 [sync] PR-6680:  cifs: fix underflow in parse_server_interfaces()
  - !6767 [sync] PR-6669:  NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - drm: nv04: Fix out of bounds access
  - media: ttpci: fix two memleaks in budget_av_attach
  - !7103 [sync] PR-7039:  USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - !7085 [sync] PR-7013:  media: edia: dvbdev: fix a use-after-free
  - !7025 [sync] PR-6988:  clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - !6214 [sync] PR-6178:  CVE-2024-26812
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - !7010 [sync] PR-6959:  mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - !7065 [sync] PR-7056:  scsi: qla2xxx: Fix command flush on cable pull
  - mm: memcg: fix stale protection of reclaim target memcg
  - !6947 [sync] PR-6840:  CVE-2023-52650
  - media: edia: dvbdev: fix a use-after-free
  - scsi: qla2xxx: Fix command flush on cable pull
  - !6094 [sync] PR-5921:  ext4: fix double-free of blocks due to wrong extents moved_len
  - !6091 [sync] PR-5977:  btrfs: dev-replace: properly validate device names
  - !6097 [sync] PR-6029:  ceph: prevent use-after-free in encode_cap_msg()
  - !7030 [sync] PR-6977:  wireguard: netlink: access device through ctx instead of peer
  - wireguard: netlink: access device through ctx instead of peer
  - !6987 [sync] PR-6964: v2  CVE-2024-27000
  - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - !6690  quota: Fix potential NULL pointer dereference
  - serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
  - serial: mxs-auart: add spinlock around changing cts state
  - serial: core: Provide port lock wrappers
  - !6886 [sync] PR-6740:  V2 cpuset: fix race between rebuild scheduler domains and hotplug work
  - !6962 [sync] PR-6861:  media: dvb-frontends: avoid stack overflow warnings with clang
  - ksmbd: validate payload size in ipc response
  - !6913  pstore: inode: Only d_invalidate() is needed
  - !6938 [sync] PR-6826:  fat: fix uninitialized field in nostale filehandles
  - !6936 [sync] PR-6838:  fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - media: dvb-frontends: avoid stack overflow warnings with clang
  - drm/tegra: dsi: Add missing check for of_find_device_by_node
  - fat: fix uninitialized field in nostale filehandles
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - pstore: inode: Only d_invalidate() is needed
  - cpuset: fix race between rebuild scheduler domains and hotplug work
  - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - cifs: fix underflow in parse_server_interfaces()
  - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  - quota: Fix potential NULL pointer dereference
  - vfio/pci: Create persistent INTx handler
  - vfio: Introduce interface to flush virqfd inject workqueue
  - ceph: prevent use-after-free in encode_cap_msg()
  - ext4: fix double-free of blocks due to wrong extents moved_len
  - btrfs: dev-replace: properly validate device names
  - net/sched: flower: Fix kabi change
  - net/sched: flower: Fix chain template offload
  - net: atlantic: Fix DMA mapping for PTP hwts ring


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.55.0.133
changelog:
  - !7635  spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
  - !7643  hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - !7648 [sync] PR-7385:  CVE-2024-27002
  - !7619 [sync] PR-5930:  RDMA/srpt: Support specifying the srpt_service_guid parameter
  - !7631 [sync] PR-6082:  can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  - !6154 [sync] PR-6020:  net/sched: act_mirred: use the backlog for mirred ingress
  - !7622 [sync] PR-6259:  arp: Prevent overflow in arp_req_get().
  - !7617 [sync] PR-5993:  ipv6: sr: fix possible use-after-free and null-ptr-deref
  - !7614 [sync] PR-5996:  mptcp: fix double-free on socket dismantle
  - !6225 [sync] PR-6074:  Fix CVE-2024-26787
  - !7611 [sync] PR-6279:  Bluetooth: Avoid potential use-after-free in hci_error_reset
  - !7608 [sync] PR-6085:  netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  - !7606 [sync] PR-6086:  netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
  - !5985 [sync] PR-5852:  CVE-2024-26809
  - !7709  bpf: Guard stack limits against 32bit overflow
  - !7638  dm-crypt: don't modify the data when using authenticated encryption
  - !7624 [sync] PR-6033:  gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  - !7698  ext4: fix corruption during on-line resize
  - !7687 [sync] PR-7574:  pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - !7629 [sync] PR-5950:  RDMA/qedr: Fix qedr_create_user_qp error flow
  - !6533 [sync] PR-6486:  devlink: fix possible use-after-free and memory leaks in devlink_init()
  - !7555 [sync] PR-5530:  net: Fix CVE-2024-26641
  - !7552 [sync] PR-7006:  wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - !7668 [sync] PR-7586:  powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - bpf: Guard stack limits against 32bit overflow
  - !7663 [sync] PR-7590:  drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
  - ext4: fix corruption during on-line resize
  - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - !7603  cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  - powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - !7511 [sync] PR-7407:  nvme-fc: do not wait in vain when unloading module
  - !7525 [sync] PR-7402:  scsi: lpfc: Fix possible file string name overflow when updating firmware
  - !7509 [sync] PR-7404:  scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - !7504 [sync] PR-7403:  scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  - !7501 [sync] PR-7400:  net/tg3: fix race condition in tg3_reset_task()
  - !7524 [sync] PR-7401:  nvme-core: check for too small lba shift
  - !7500 [sync] PR-7396:  drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
  - !7497 [sync] PR-7397:  drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  - !7494 [sync] PR-7398:  drm/amd/display: Fix memory leak in dm_sw_fini()
  - !7491 [sync] PR-7399:  drm/amd/pm: fix a double-free in si_dpm_init
  - !7514 [sync] PR-7406:  drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  - drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
  - !7598 [sync] PR-7548:  btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - !7565  net: hns3: fix kernel crash when 1588 is received on HIP08 devices
  - clk: mediatek: Do a runtime PM get on controllers during probe
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - dm-crypt: don't modify the data when using authenticated encryption
  - spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
  - can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  - RDMA/qedr: Fix qedr_create_user_qp error flow
  - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  - arp: Prevent overflow in arp_req_get().
  - RDMA/srpt: Support specifying the srpt_service_guid parameter
  - ipv6: sr: fix possible use-after-free and null-ptr-deref
  - mptcp: fix double-free on socket dismantle
  - Bluetooth: Avoid potential use-after-free in hci_error_reset
  - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  - netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
  - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - !7364 [sync] PR-5491:  CVE-2024-26640
  - !6527 [sync] PR-6314:  fixup CVE-2024-26908
  - !7388 [sync] PR-6546: v2  CVE-2024-26907
  - net: hns3: fix kernel crash when 1588 is received on HIP08 devices
  - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
  - ip6_tunnel: use dev_sw_netstats_rx_add()
  - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - !7519 [sync] PR-7484:  fix CVE-2024-26661
  - !7358  blk-iocost: Fix an UBSAN shift-out-of-bounds warning
  - !7349  PM / devfreq: Synchronize devfreq_monitor_[start/stop
  - !7360  sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - scsi: lpfc: Fix possible file string name overflow when updating firmware
  - !7444 [sync] PR-6037:  fix-CVE-2024-26706
  - nvme-core: check for too small lba shift
  - drm/amd/display: Fix && vs || typos
  - drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
  - !7487 [sync] PR-7476:  firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  - !7410  net: bnxt: fix a potential use-after-free in bnxt_init_tc
  - !7409  net/bnx2x: Prevent access to a freed page in page_pool
  - nvme-fc: do not wait in vain when unloading module
  - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  - net/tg3: fix race condition in tg3_reset_task()
  - drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
  - drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  - drm/amd/display: Fix memory leak in dm_sw_fini()
  - drm/amd/pm: fix a double-free in si_dpm_init
  - !7294  KVM: s390: vsie: fix race during shadow creation
  - firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - !7258  netfilter: nf_tables: disallow anonymous set with timeout flag
  - !7338  inet: read sk->sk_family once in inet_recv_error()
  - !7330  tunnels: fix out of bounds access when building IPv6 PMTU error
  - !7325  net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
  - !7310  btrfs: don't drop extent_map for free space inode on write error
  - !7450 [sync] PR-5998:  net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
  - !7447 [sync] PR-6031:  nilfs2: fix potential bug in end_buffer_async_write
  - !7279  llc: Drop support for ETH_P_TR_802_2.
  - !7278  llc: make llc_ui_sendmsg() more robust against bonding changes
  - !7455  netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !7264  Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - !7480 [sync] PR-7424:  net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - !7344  ppp_async: limit MRU to 64K
  - !5868 [sync] PR-5794:  um: time-travel: fix time corruption
  - !7391 [sync] PR-5469:  wifi: iwlwifi: fix a memory corruption
  - !7314  CVE-2024-26686
  - !7302  nilfs2: fix data corruption in dsync block recovery for small block sizes
  - !7299  powerpc/kasan: Fix addr error caused by page alignment
  - !7275  binder: fix race between mmput() and do_exit()
  - !7262  ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  - !5624 [sync] PR-5566:  tracing: Ensure visibility when inserting an element into tracing_map
  - !7239  SUNRPC: Fix a suspicious RCU usage warning
  - !7232 [sync] PR-5460: v2  crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
  - !7238  bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  - !7322  mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  - !7468 [sync] PR-7394: v2  scsi: sr: Do not leak information in ioctl
  - scsi: sr: Do not leak information in ioctl
  - !7021 [sync] PR-6855:  KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - !7305  iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !7428  net: gtp: Fix Use-After-Free in gtp_dellink
  - !7432 [sync] PR-3972:  arm64: make cma=0 as default for openeuler
  - net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
  - nilfs2: fix potential bug in end_buffer_async_write
  - parisc/unaligned: Fix emulate_ldw() breakage
  - parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd()
  - parisc: Fix random data corruption from exception handler
  - parisc/unaligned: Rewrite 32-bit inline assembly of emulate_sth()
  - parisc/unaligned: Rewrite 32-bit inline assembly of emulate_ldd()
  - parisc/unaligned: Rewrite inline assembly of emulate_ldw()
  - parisc: Mark ex_table entries 32-bit aligned in uaccess.h
  - parisc: Fix some apparent put_user() failures
  - parisc: Implement __get/put_kernel_nofault()
  - parisc: Drop strnlen_user() in favour of generic version
  - parisc: Switch user access functions to signal errors in r29 instead of r8
  - parisc/unaligned: Rewrite inline assembly of emulate_ldh()
  - parisc/unaligned: Use EFAULT fixup handler in unaligned handlers
  - !7438 [sync] PR-7414:  clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
  - clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
  - arm64: make cma=0 as default for openeuler
  - net: gtp: Fix Use-After-Free in gtp_dellink
  - !7384 [sync] PR-6428:  net/sched: flower: Fix unable to handle page fault bug in fl_init
  - net: bnxt: fix a potential use-after-free in bnxt_init_tc
  - net/bnx2x: Prevent access to a freed page in page_pool
  - !7269  block/rnbd-srv: Check for unlikely string overflow
  - wifi: iwlwifi: fix a memory corruption
  - RDMA/mlx5: Fix fortify source warning while accessing Eth segment
  - uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++
  - stddef: Introduce DECLARE_FLEX_ARRAY() helper
  - net/sched: flower: Fix unable to handle page fault bug in fl_init
  - tcp: add sanity checks to rx zerocopy
  - net-zerocopy: Refactor frag-is-remappable test.
  - sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - blk-iocost: Fix an UBSAN shift-out-of-bounds warning
  - PM / devfreq: Synchronize devfreq_monitor_[start/stop]
  - ppp_async: limit MRU to 64K
  - inet: read sk->sk_family once in inet_recv_error()
  - tunnels: fix out of bounds access when building IPv6 PMTU error
  - net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
  - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
  - fs/proc: do_task_stat: use __for_each_thread()
  - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand()
  - exit: Use the correct exit_code in /proc/<pid>/stat
  - btrfs: don't drop extent_map for free space inode on write error
  - iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  - nilfs2: fix data corruption in dsync block recovery for small block sizes
  - powerpc/kasan: Fix addr error caused by page alignment
  - KVM: s390: vsie: fix race during shadow creation
  - llc: Drop support for ETH_P_TR_802_2.
  - llc: make llc_ui_sendmsg() more robust against bonding changes
  - binder: fix race between mmput() and do_exit()
  - block/rnbd-srv: Check for unlikely string overflow
  - Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  - netfilter: nf_tables: disallow anonymous set with timeout flag
  - SUNRPC: Fix a suspicious RCU usage warning
  - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  - crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
  - devlink: fix possible use-after-free and memory leaks in devlink_init()
  - x86/xen: Add some null pointer checking to smp.c
  - mmc: mmci: stm32: fix DMA API overlapping mappings warning
  - mmc: mmci: stm32: use a buffer for unaligned DMA requests
  - net/sched: act_mirred: use the backlog for mirred ingress
  - netfilter: nft_set_pipapo: release elements in clone only from destroy path
  - netfilter: nft_set_pipapo: remove scratch_aligned pointer
  - netfilter: nft_set_pipapo: add helper to release pcpu scratch area
  - netfilter: nft_set_pipapo: store index in scratch maps
  - um: time-travel: fix time corruption
  - tracing: Ensure visibility when inserting an element into tracing_map


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-153.56.0.134
changelog:
  - !8158 [sync] PR-8017:  perf/core: Bail out early if the request AUX area is out of bound
  - !8115 [sync] PR-8023:  fs/ntfs3: Fixed overflow check in mi_enum_attr()
  - !8094 [sync] PR-7980:  Fix CVE-2021-47455
  - !8118 [sync] PR-8060:  soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  - !7800  net-memcg: Fix scope of sockmem pressure indicators
  - !8085 [sync] PR-8019:  pstore/zone: Add a null pointer check to the psz_kmsg_read
  - !7135 [sync] PR-7092:  Squashfs: check the inode number is not the invalid value of zero
  - perf/core: Bail out early if the request AUX area is out of bound
  - !8084 [sync] PR-6808:  CVE-2024-26923
  - !8004 [sync] PR-7970:  fbmon: prevent division by zero in fb_videomode_from_videomode()
  - !6876 [sync] PR-6756:  vfio/fsl-mc: Block calling interrupt handler without trigger
  - soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  - fs/ntfs3: Fixed overflow check in mi_enum_attr()
  - !7880 [sync] PR-7684:  dm snapshot: fix lockup in dm_exception_table_exit
  - !8073 [sync] PR-8030:  netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  - !7996  HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  - !8007 [sync] PR-7903:  virtio_ring : keep used_wrap_counter in
  - ptp: fix code indentation issues
  - ptp: Fix possible memory leak in ptp_clock_register()
  - !8022  media: bttv: fix use after free error due to btv->timeout timer
  - pstore/zone: Add a null pointer check to the psz_kmsg_read
  - af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
  - af_unix: Fix garbage collector racing against connect()
  - !8027 [sync] PR-7961:  net: atlantic: eliminate double free in error handling logic
  - !8048  drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  - drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process
  - net: atlantic: eliminate double free in error handling logic
  - media: bttv: fix use after free error due to btv->timeout timer
  - virtio_ring : keep used_wrap_counter in vq->last_used_idx
  - fbmon: prevent division by zero in fb_videomode_from_videomode()
  - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  - !7953  media: vidtv: psi: Add check for kstrdup
  - !7974 [sync] PR-7949:  drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
  - !7969 [sync] PR-7943: v2  netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  - drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
  - netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  - !7937 [sync] PR-7911:  ACPI: LPIT: Avoid u32 multiplication overflow
  - !7845 [sync] PR-7576:  f2fs: compress: fix reserve_cblocks counting error when out of space
  - !7863 [sync] PR-7757:  Fix CVE-2023-52656
  - media: vidtv: psi: Add check for kstrdup
  - !7915 [sync] PR-7853:  net/mlx5e: fix a double-free in arfs_create_groups
  - ACPI: LPIT: Avoid u32 multiplication overflow
  - !7759 [sync] PR-7655: v3  KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
  - net/mlx5e: fix a double-free in arfs_create_groups
  - !7797 [sync] PR-7743:  netrom: Fix data-races around sysctl_net_busy_read
  - !7885 [sync] PR-7773:  Fix CVE-2023-52698
  - calipso: fix memory leak in netlbl_calipso_add_pass()
  - netlabel: remove unused parameter in netlbl_netlink_auditinfo()
  - net: netlabel: Fix kerneldoc warnings
  - dm snapshot: fix lockup in dm_exception_table_exit
  - !7860 [sync] PR-7846:  netrom: Fix a data-race around sysctl_netrom_transport_timeout
  - io_uring: drop any code related to SCM_RIGHTS
  - io_uring/unix: drop usage of io_uring socket
  - netrom: Fix a data-race around sysctl_netrom_transport_timeout
  - !7830 [sync] PR-7779:  LoongArch: Define the __io_aw() hook as mmiowb()
  - !7827 [sync] PR-7714:  CVE-2024-35936
  - f2fs: compress: fix reserve_cblocks counting error when out of space
  - !7838 [sync] PR-7681:  xfs: three bug fix recently
  - xfs: update dir3 leaf block metadata after swap
  - xfs: ensure logflagsp is initialized in xfs_bmap_del_extent_real
  - iomap: fix warning in xfs_iomap_write_delalloc_release()
  - !7820 [sync] PR-7734:  mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
  - LoongArch: Define the __io_aw() hook as mmiowb()
  - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
  - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
  - !7746  x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
  - net-memcg: Fix scope of sockmem pressure indicators
  - netrom: Fix data-races around sysctl_net_busy_read
  - !7737 [sync] PR-7674:  net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
  - !7762 [sync] PR-7749: v2  wifi: iwlwifi: dbg-tlv: ensure NUL termination
  - !7712 [sync] PR-7579:  powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  - !7756  wifi: ath11k: decrease MHI channel buffer length to 8KB
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
  - wifi: ath11k: decrease MHI channel buffer length to 8KB
  - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
  - powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  - Squashfs: check the inode number is not the invalid value of zero
  - vfio/fsl-mc: Block calling interrupt handler without trigger


author: XuFei <xufei30@huawei.com> - 6.2.0-56
changelog:
  - nodedev: ignore EINVAL from libudev in udevEventHandleThread
  - qemu: tpm: Pass --logfile to swtpm_setup for incoming migration


author: zhangxinhao <zhangxinhao1@huawei.com> - 6.2.0-57
changelog:
  - cpu_topo: support for cpu_topo "clusters” in conf
  - cpu_topo: support for specifying "clusters" in qemu comand
  - cpu_topo: support for reporting cluster_id in NUMA topology
  - cpu_topo: fix detection of vCPU pids when multiple clusters are present


author: Jiabo Feng <fengjiabo1@huawei.com> - 6.2.0-58
changelog:
  - virnetsshsession: Adapt to change libssh2 API
  - selinux: Reflect context_str() type change
  - Revert "selinux: adapt to libselinux"
  - selinux: adapt to libselinux
  - fix error in printf format string


author: Jiabo Feng <fengjiabo1@huawei.com> - 6.2.0-61
changelog:
  - lxc: fix lxcContainerMountAllFS() DEREF_BEFORE_CHECK
  - qemu: Return perf status that affect next boot  for shutoff domains While we set up perf events for a shutoff domain and check the settings, All of perf events are reported as 'disabled', unless we add --config, This is redundant for a shutoff domain.
  - tests: upstream Fixing compiler warning in cputest
  - qemu_migration_cookie: Rename ret in qemuDomainExtractTLSSubject
  - virrandom: Fix printf format string in virRandomGenerateWWN()
  - fix the issue of errors when saving after 'virsh edit'
  - Use (un)signed printf specifiers correctly
  - admin: fix leak of typed parameters on error
  - esx: call freeaddrinfo earlier in esxUtil_ResolveHostname Call freeaddrinfo() as soon as @result is not needed anymore, i.e. right after getnameinfo(); this avoids calling freeaddrinfo() in two branches.
  - qemu: Fix incorrect command name in error messages


author: jiangdongxu <jiangdongxu1@huawei.com> - 6.2.0-62
changelog:
  - vdpa: Release pci slot address when unplugging vdpa device
  - vdpa: return pcieFlags when calculate vdpa passthrough devices.
  - vdpa: support vdpa device migrate
  - vdpa: support vdpa device hot plug/unplug
  - vdpa: Introduce the new device type vdpa to hostdev
  - node_device: fix leak of DIR*
  - Include vdpa devices in node device list


author: caozhongwang <caozhongwang1@huawei.com>
changelog:
  - interface: fix udev_device_get_sysattr_value return value check (CVE-2024-2496)
  - remote: check for negative array lengths before allocation (CVE-2024-2494)
  - vish:Fix off-by-one error in udevListInterfacesByStatus (CVE-2024-1441)


author: jiangjiacheng <jiangjiacheng@huawei.com> - 6.2.0-64
changelog:
  - util: keep track of full GSource object not source ID number
  - rpc: mark source returned by virEventGLibAddSocketWatch as unused
  - rpc: ensure temporary GSource is removed from client event loop (CVE-2024-4418)


author: yanglu<yanglu72@h-partners.com> - 8.17.1-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: fix newaliases command error and postfix service start execption after sendmail install


