# changelog

author: Funda Wang <fundawang@yeah.net> - 2.37-31
changelog:
  - Fix CVE-2024-57360: nm: Avoid potential segmentation fault when displaying
    symbols without version info.
  - Fix CVE-2025-0840: stack-buffer-overflow at objdump disassemble_bytes


author: zhouyihang <zhouyihang3@h-partners.com> - 7.79.1-34
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:multi: check that the multi handle is valid in curl_multi_assign


author: xingwei <xingwei14@h-partners.com> - 7.79.1-38
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:altsvc: avoid integer overflow in expire calculation
         test391: verify --path-as-is with redirect
         urlapi: fix redirect to a new fragment or query (only)
         tool_getparam: clear sensitive arguments better


author: zhouyihang <zhouyihang3@h-partners.com> - 7.79.1-39
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix freeing of resources in disconnect
         openssl: fix crash on missing cert password


author: yaoxin <yao_xin001@hoperun.com> - 1.16.2-7
changelog:
  - Fix cves:
    CVE-2024-47606,CVE-2024-47613,CVE-2024-47775,CVE-2024-47776
    CVE-2024-47777,CVE-2024-47778,CVE-2024-47774,CVE-2024-47540
    CVE-2024-47602,CVE-2024-47601,CVE-2024-47834,CVE-2024-47537
    CVE-2024-47597,CVE-2024-47543,CVE-2024-47596,CVE-2024-47539
    CVE-2024-47546


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-273.0.0.176
changelog:
  - !17045  arm64: Fix a typo in xcall_init_task()
  - !17105  arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  - !17099  arm64: exec: add mcs support for prepare_binprm
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  - !17104  hugetlb: drain pcp for movable zone before alloc
  - !16949  media: uvcvideo: Remove dangling pointers
  - hugetlb: drain pcp for movable zone before alloc
  - arm64: exec: add mcs support for prepare_binprm
  - iov_iter: add copy_mc_page_to_kvec_iter
  - !16927  nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
  - !16761  cifs: fix mount deadlock by avoiding super block iteration in DFS reconnect
  - !16429 CVE-2025-21855
  - !17050 EDAC/amd64: Fix the check build warning info in hygon_umc_normaddr_to_sysaddr()
  - !17058  media: cxusb: no longer judge rbuf when the write fails
  - !16943  KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT
  - media: cxusb: no longer judge rbuf when the write fails
  - ibmvnic: Don't reference skb after sending to VIOS
  - !17002  net_sched: red: fix a race in __red_change()
  - EDAC/amd64: Fix the check build warning info in hygon_umc_normaddr_to_sysaddr()
  - arm64: Fix a typo in xcall_init_task()
  - net_sched: red: fix a race in __red_change()
  - media: uvcvideo: Remove dangling pointers
  - KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
  - cifs: fix mount deadlock by avoiding super block iteration in DFS reconnect


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-274.0.0.177
changelog:
  - !17195  smb: client: fix use-after-free in crypt_message when using async crypto
  - !17239 【OLK 5.10】some bugfixes and cleanups for hns3 driver
  - !17077  smb: client: fix use-after-free in cifs_oplock_break
  - !17242  ima: prevent concurrent list operations in ima_lsm_update_rules
  - ima: prevent concurrent list operations in ima_lsm_update_rules
  - net: hns3: Change the function return type from int to bool
  - !17232 soc: hisilicon: kunpeng_hccs: Fix incorrect log information
  - !17233  hugeltb: Fix null ptr exception during drain movable pcp
  - soc: hisilicon: kunpeng_hccs: Fix incorrect log information
  - net: hns3: defer calling ptp_clock_register()
  - net: hns3: fix an interrupt residual problem
  - hugeltb: Fix null ptr exception during drain movable pcp
  - net: hns3: store rx VLAN tag offload state for VF
  - !17204 v2  CVE-2022-49961
  - !16809  vhost-scsi: protect vq->log_used with vq->mutex
  - !16885  fs: Backport two namespace fix patches
  - !17158  arm64/mpam: Use an IPI instead of task_work_add() to update MPAM sysreg
  - selftests/bpf: Add regression test for pruning fix
  - bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO
  - !17146  jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  - !17173  wifi: ath9k_htc: Abort software beacon handling if disabled
  - !16942  ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()
  - smb: client: fix use-after-free in crypt_message when using async crypto
  - wifi: ath9k_htc: Abort software beacon handling if disabled
  - !17149  Bluetooth: MGMT: Protect mgmt_pending list with its own lock
  - arm64/mpam: Only inform the CPUs running tasks of the group
  - arm64/mpam: Fix the potential deadlock when updating the rmid
  - arm64/mpam: Fix task CLOSID/RMID update race
  - arm64/mpam: Apply READ_ONCE/WRITE_ONCE to task_struct.{rmid,closid}
  - arm64/mpam: Use an IPI instead of task_work_add() to update MPAM sysreg
  - !17123  crypto: algif_hash - fix double free in hash_accept
  - Bluetooth: MGMT: Protect mgmt_pending list with its own lock
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  - !17125  EDAC/skx_common: Fix general protection fault
  - !17131  modify xcall xint proc file permissions
  - modify xcall proc file permissions to 640
  - modify xint proc file permissions to 640
  - EDAC/skx_common: Fix general protection fault
  - crypto: algif_hash - fix double free in hash_accept
  - smb: client: fix use-after-free in cifs_oplock_break
  - ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
  - do_change_type(): refuse to operate on unmounted/not ours mounts
  - vhost-scsi: protect vq->log_used with vq->mutex


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-275.0.0.178
changelog:
  - !17327  perf: Revert to requiring CAP_SYS_ADMIN for uprobes
  - perf: Revert to requiring CAP_SYS_ADMIN for uprobes
  - !17252 ROH:fix security issues and eliminate redundancies
  - !17241 gpiolib: Get rid of ARCH_NR_GPIOS
  - !17010  perf: Fix sample vs do_exit()
  - !17256 Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - ROH:fix security issues and eliminate redundancies
  - !17311  usb: typec: altmodes/displayport: do not index invalid pin_assignments
  - !15469  scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
  - !17283  fs/writeback: bail out if there is no more inodes for IO and queued once
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments
  - !17306  atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
  - !17297  scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
  - !17298  dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
  - !17300  jfs: add check read-only before txBeginAnon() call
  - !16386 v5  Fix x2apic enablement and allow more CPUs, clean up I/OAPIC and MSI bitfields
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
  - !17288 RDMA/hns: Support querying DIP SCC context
  - jfs: add check read-only before txBeginAnon() call
  - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
  - scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
  - !17285  libbpf: Fix null pointer dereference in btf_dump__free on allocation failure
  - !16746 [OLK-5.10] backport important bugfix for nvme driver from upstream linux-5.10.y
  - RDMA/hns: Support querying DIP SCC context
  - libbpf: Fix null pointer dereference in btf_dump__free on allocation failure
  - fs/writeback: bail out if there is no more inodes for IO and queued once
  - !17279 RDMA/hns: Remove MW support
  - RDMA/hns: Remove MW support
  - RDMA/hns: Drop GFP_NOWARN
  - RDMA/hns: Fix -Wframe-larger-than issue
  - RDMA/hns: Fix HW resources are not cleared in error flow
  - RDMA/hns: Fix remove debugfs after device has been unregistered
  - RDMA/hns: Add trace for MR/MTR attribute dumping
  - RDMA/hns: Add trace for WQE dumping
  - RDMA/hns: Add trace for CMDQ dumping
  - RDMA/hns: Add trace for AEQE dumping
  - RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
  - RDMA/hns: Inappropriate format characters cleanup
  - RDMA/hns: Add trace for flush CQE
  - !17258  mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
  - Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
  - gpiolib: Get rid of never false gpio_is_valid() calls
  - perf: Fix sample vs do_exit()
  - nvmet-tcp: don't restore null sk_state_change
  - x86/hyperv: Enable 15-bit APIC ID if the hypervisor supports it
  - iommu/amd: Keep track of amd_iommu_irq_remap state
  - iommu/amd: Stop irq_remapping_select() matching when remapping is disabled
  - iommu/hyper-v: Remove I/O-APIC ID check from hyperv_irq_remapping_select()
  - x86/ioapic: Correct the PCI/ISA trigger type selection
  - x86/ioapic: Use I/O-APIC ID for finding irqdomain, not index
  - x86/kvm: Enable 15-bit extension when KVM_FEATURE_MSI_EXT_DEST_ID detected
  - iommu/hyper-v: Disable IRQ pseudo-remapping if 15 bit APIC IDs are available
  - x86/apic: Support 15 bits of APIC ID in MSI where available
  - x86/ioapic: Handle Extended Destination ID field in RTE
  - iommu/vt-d: Simplify intel_irq_remapping_select()
  - x86: Kill all traces of irq_remapping_get_irq_domain()
  - x86/ioapic: Use irq_find_matching_fwspec() to find remapping irqdomain
  - x86/hpet: Use irq_find_matching_fwspec() to find remapping irqdomain
  - iommu/hyper-v: Implement select() method on remapping irqdomain
  - iommu/vt-d: Implement select() method on remapping irqdomain
  - iommu/amd: Implement select() method on remapping irqdomain
  - x86/apic: Add select() method on vector irqdomain
  - genirq/irqdomain: Implement get_name() method on irqchip fwnodes
  - x86/ioapic: Generate RTE directly from parent irqchip's MSI message
  - x86/ioapic: Cleanup IO/APIC route entry structs
  - x86/io_apic: Cleanup trigger/polarity helpers
  - x86/msi: Remove msidef.h
  - x86/pci/xen: Use msi_msg shadow structs
  - x86/kvm: Use msi_msg shadow structs
  - PCI: vmd: Use msi_msg shadow structs
  - x86/hpet: Move MSI support into hpet.c
  - x86/devicetree: Fix the ioapic interrupt type table
  - scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-276.0.0.179
changelog:
  - !16940 v2  dm: fix unconditional IO throttle caused by REQ_PREFLUSH
  - !17315  ovl: fix general protection fault in security_inode_getattr
  - !17425  net: stmmac: make sure that ptp_rate is not 0 before configuring EST
  - !17424  bcache: fix NULL pointer in cache_set_flush()
  - !17433  ACPICA: Refuse to evaluate a method if arguments are missing
  - !17417  drm/dp_mst: Fix MST sideband message body length check
  - !17418  drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()
  - !17407  usb: net: sierra: check for no status endpoint
  - !17429  drm/v3d: Disable interrupts before resetting the GPU
  - !17292 [OLK 5.10] AMD Turin and auto IBRS patches backport
  - ACPICA: Refuse to evaluate a method if arguments are missing
  - drm/v3d: Disable interrupts before resetting the GPU
  - !17394  selftests/tracing: Fix false failure of subsystem event test
  - net: stmmac: make sure that ptp_rate is not 0 before configuring EST
  - bcache: fix NULL pointer in cache_set_flush()
  - drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()
  - drm/dp_mst: Fix MST sideband message body length check
  - usb: net: sierra: check for no status endpoint
  - !17389  CVE-2025-21702
  - !17388  ipvlan: ensure network headers are in skb linear part
  - !17383  net/sched: act_ct: fix ref leak when switching zones
  - !17382  net: annotate races around sk->sk_bound_dev_if
  - !17381  net: sched: Disallow replacing of child qdisc from one parent to another
  - !17377  net: sched: fix ets qdisc OOB Indexing
  - !17379  bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
  - selftests/tracing: Fix false failure of subsystem event test
  - pfifo_tail_enqueue: Drop new packet when sch->limit == 0
  - net_sched: sch_fifo: implement lockless __fifo_dump()
  - ipvlan: ensure network headers are in skb linear part
  - net/sched: act_ct: fix ref leak when switching zones
  - net: annotate races around sk->sk_bound_dev_if
  - !17359 [OLK 5.10] AMD HSMP driver support patches backport
  - net: sched: Disallow replacing of child qdisc from one parent to another
  - !17374  RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
  - !17365  atm: clip: Fix infinite recursive call of clip_push().
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
  - net: sched: fix ets qdisc OOB Indexing
  - !17347  calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  - !17373  drm/amd/display: Add null pointer check for get_first_active_display()
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
  - !17370  ext4: inline: fix len overflow in ext4_prepare_inline_data
  - drm/amd/display: Add null pointer check for get_first_active_display()
  - ext4: inline: fix len overflow in ext4_prepare_inline_data
  - atm: clip: Fix infinite recursive call of clip_push().
  - !17350  scsi: lpfc: Use memcpy() for BIOS version
  - platform/x86/amd/hsmp: Check HSMP support on AMD family of processors
  - platform/x86/amd/hsmp: switch to use device_add_groups()
  - platform/x86/amd/hsmp: Change devm_kzalloc() to devm_kcalloc()
  - platform/x86/amd/hsmp: Remove extra parenthesis and add a space
  - platform/x86/amd/hsmp: Check num_sockets against MAX_AMD_SOCKETS
  - platform/x86/amd/hsmp: Non-ACPI support for AMD F1A_M00~0Fh
  - platform/x86/amd/hsmp: Add support for ACPI based probing
  - platform/x86/amd/hsmp: Restructure sysfs group creation
  - platform/x86/amd/hsmp: Move dev from platdev to hsmp_socket
  - platform/x86/amd/hsmp: Define a struct to hold mailbox regs
  - platform/x86/amd/hsmp: Create static func to handle platdev
  - platform/x86/amd/hsmp: Cache pci_dev in struct hsmp_socket
  - platform/x86/amd/hsmp: Move hsmp_test to probe
  - platform/x86/amd/hsmp: Fix iomem handling
  - platform/x86/amd/hsmp: improve the error log
  - platform/x86/amd/hsmp: add support for metrics tbl
  - platform/x86/amd/hsmp: create plat specific struct
  - platform/x86: Move AMD platform drivers to separate directory
  - !17344 v2  eventpoll: Fix return fixed cpu bug in set_prefetch_numa_cpu()
  - tools headers x86 cpufeatures: Sync with the kernel sources
  - KVM: x86: Fix clang -Wimplicit-fallthrough in do_host_cpuid()
  - KVM: x86: work around QEMU issue with synthetic CPUID leaves
  - KVM: x86: Propagate the AMD Automatic IBRS feature to the guest
  - x86/cpu, kvm: Add the SMM_CTL MSR not present feature
  - x86/cpu, kvm: Add the Null Selector Clears Base feature
  - x86/cpu, kvm: Move X86_FEATURE_LFENCE_RDTSC to its native leaf
  - x86/cpu, kvm: Add the NO_NESTED_DATA_BP feature
  - KVM: x86: Move open-coded CPUID leaf 0x80000021 EAX bit propagation code
  - x86/bugs: Don't fill RSB on context switch with eIBRS
  - x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier()
  - x86/bugs: Move the X86_FEATURE_USE_IBPB check into callers
  - x86/mm: Refactor cond_ibpb() to support other use cases
  - KVM: x86: Advertise that the SMM_CTL MSR is not supported
  - KVM: x86: synthesize CPUID leaf 0x80000021h if useful
  - KVM: x86: skip host CPUID call for hypervisor leaves
  - KVM: x86: add support for CPUID leaf 0x80000021
  - x86/bugs: Use SBPB in write_ibpb() if applicable
  - x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix
  - x86/asm: Have the __ASM_FORM macros handle commas in arguments
  - x86/cpu/amd: Fix workaround for erratum 1054
  - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
  - scsi: lpfc: Use memcpy() for BIOS version
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  - eventpoll: Fix return fixed cpu bug in set_prefetch_numa_cpu()
  - ovl: fix general protection fault in security_inode_getattr
  - dm: fix unconditional IO throttle caused by REQ_PREFLUSH


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-277.0.0.180
changelog:
  - !17505  CVE-2024-58237
  - !17504  net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
  - !17503  sctp: detect and prevent references to a freed transport in sendmsg
  - !17461 drivers:misc:sdma-dae: fix incorrect debugfs print
  - !17506 ROH: fix variable type inconsistency issue
  - !17437 [OLK-5.10]:update patches for sw64 architecture
  - ROH: fix variable type inconsistency issue
  - bpf: consider that tail calls invalidate packet pointers
  - bpf: refactor bpf_helper_changes_pkt_data to use helper number
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
  - sctp: detect and prevent references to a freed transport in sendmsg
  - !17486  net: atm: fix use after free in lec_send()
  - !17485  vlan: enforce underlying device type
  - !17484  net: gso: fix ownership in __udp_gso_segment
  - net: atm: fix use after free in lec_send()
  - vlan: enforce underlying device type
  - net: gso: fix ownership in __udp_gso_segment
  - !17466  arm-smmu-v3: adjust ecmdq log level
  - drivers:misc:sdma-dae: fix incorrect debugfs print
  - arm-smmu-v3: adjust ecmdq log level
  - !17457 v2  posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  - sw64: ptrace: return -EIO in invalid PEEKUSR/POKEUSR requests
  - sw64: kvm: fix compile error of kvm.ko
  - sw64: kvm: remove the duplicated Kconfig selection of KVM
  - sw64: cpuidle: add dedicated driver
  - sw64: crypto: implement crc32 assembly optimization
  - sw64: efi: remove meaningless code from asm/efi.h
  - sw64: cpufreq: using PLL0 to provide clock for idle cores
  - sw64: kvm: enable dirty log gradually in small chunks for core4
  - sw64: fix guest kdump function
  - sw64: use wait/complete for smp boot
  - sw64: fix sw64_rrk_store() wrap handling


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-278.0.0.181
changelog:
  - !17568  comedi: aio_iiro_16: Fix bit shift out of bounds
  - !17545  net_sched: drr: Fix double list add in class with netem as child qdisc
  - comedi: aio_iiro_16: Fix bit shift out of bounds
  - !17566  hugelb: do not sleep during spinlock hugetlb_lock
  - hugelb: do not sleep during spinlock hugetlb_lock
  - !17480  HID: core: fix __hid_request when no report ID is used
  - !17554  arm64: mm: fix EFI_BUFFER_TOO_SMALL problem for MemoryOnChipMode
  - arm64: mm: fix EFI_BUFFER_TOO_SMALL problem for MemoryOnChipMode
  - !17544  net_sched: qfq: Fix double list add in class with netem as child qdisc
  - !17543  net: sch: Fix CVE-2025-37798
  - !17539  wifi: at76c50x: fix use after free access in at76_disconnect
  - !17536  net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  - !17532  sched: Fix sched tunable parameter range overflow
  - !15064  arm64: mm: Update PBHA related variable name
  - net_sched: drr: Fix double list add in class with netem as child qdisc
  - net_sched: qfq: Fix double list add in class with netem as child qdisc
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
  - sch_ets: make est_qlen_notify() idempotent
  - sch_qfq: make qfq_qlen_notify() idempotent
  - sch_hfsc: make hfsc_qlen_notify() idempotent
  - sch_drr: make drr_qlen_notify() idempotent
  - sch_htb: make htb_deactivate() idempotent
  - sch_htb: make htb_qlen_notify() idempotent
  - wifi: at76c50x: fix use after free access in at76_disconnect
  - net: vlan: Fix kabi breakage of struct vlan_info
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  - !17531 RDMA/hns: Fix dip entries leak on devices newer than hip09
  - sched: Fix sched tunable parameter range overflow
  - !17494 v2  kernfs performance optimization
  - RDMA/hns: Fix dip entries leak on devices newer than hip09
  - !17527  PCI/ASPM: Fix link state exit during switch upstream function removal
  - !17525  fix CVE-2022-49623
  - PCI/ASPM: Fix link state exit during switch upstream function removal
  - !17522  CVE-2025-38180
  - powerpc/xive/spapr: correct bitmap allocation size
  - powerpc/xive: Add some error handling code to 'xive_spapr_init()'
  - net: atm: fix /proc/net/atm/lec handling
  - net: atm: add lec_mutex
  - kernfs: don't create a negative dentry if inactive node exists
  - kernfs: also call kernfs_set_rev() for positive dentry
  - kernfs: dont call d_splice_alias() under kernfs node lock
  - kernfs: use i_lock to protect concurrent inode updates
  - kernfs: switch kernfs to use an rwsem
  - kernfs: use VFS negative dentry caching
  - kernfs: add a revision to identify directory node changes
  - HID: core: do not bypass hid_hw_raw_request
  - HID: core: ensure __hid_request reserves the report ID as the first byte
  - HID: core: ensure the allocated report buffer can contain the reserved report ID
  - arm64: mm: Update PBHA related variable name


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-279.0.0.182
changelog:
  - !17745  trace/fgraph: Fix the warning caused by missing unregister notifier
  - !17726  perf/core: Don't leak AUX buffer refcount on allocation failure
  - !17675  ftrace: Also allocate and copy hash for reading of filter files
  - !17670  ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
  - !15618  partitions: mac: fix handling of bogus partition table
  - trace/fgraph: Fix the warning caused by missing unregister notifier
  - !17723  mm/dpool: mark dpool hugetlb page as dirty in free_huge_page()
  - !17727  CVE-2025-38465
  - !17454  md/raid1: Fix stack memory use after return in raid1_reshape
  - !17452  blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx
  - netlink: avoid infinite retry looping in netlink_unicast()
  - netlink: make sure we allow at least one dump skb
  - netlink: Fix rmem check in netlink_broadcast_deliver().
  - netlink: Fix wraparounds of sk->sk_rmem_alloc.
  - perf/core: Don't leak AUX buffer refcount on allocation failure
  - mm/dpool: mark dpool hugetlb page as dirty in free_huge_page()
  - !17631  perf/core: Exit early on perf_mmap() fail
  - ftrace: Also allocate and copy hash for reading of filter files
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
  - !17603  two bugfix for arm64 support HVO
  - !17657  selftests/bpf: Add remaining ASSERT_xxx() variants
  - selftests/bpf: Add remaining ASSERT_xxx() variants
  - !17614  xfrm: state: fix out-of-bounds read during lookup
  - !17626  Fix CVE-2025-37780
  - !17627  Fix CVE-2024-58069
  - !17624  rtnetlink: Allocate vfinfo size for VF GUIDs when supported
  - !17623  net_sched: hfsc: Fix a UAF vulnerability in class handling
  - !17622  tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  - !17621  CVE-2025-38052
  - !17619  tipc: Fix use-after-free in tipc_conn_close().
  - !17620  net: clear the dst when changing skb protocol
  - !17618  net_sched: sch_sfq: fix a potential crash on gso_skb handling
  - !17617  net: fix udp gso skb_segment after pull from frag_list
  - !17616  atm: Fix NULL pointer dereference
  - !17615  udp: Fix memory accounting leak.
  - !17613  macsec: fix UAF bug for real_dev
  - !17612  vfio/pci: Properly hide first-in-list PCIe extended capability
  - perf/core: Exit early on perf_mmap() fail
  - rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
  - isofs: Prevent the use of too small fid
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported
  - net_sched: hfsc: Fix a UAF vulnerability in class handling
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  - net: tipc: fix refcount warning in tipc_aead_encrypt
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
  - net: clear the dst when changing skb protocol
  - tipc: Fix use-after-free in tipc_conn_close().
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling
  - net: fix udp gso skb_segment after pull from frag_list
  - atm: Fix NULL pointer dereference
  - udp: Fix memory accounting leak.
  - xfrm: state: fix out-of-bounds read during lookup
  - macsec: fix UAF bug for real_dev
  - vfio/pci: Properly hide first-in-list PCIe extended capability
  - !17376 net_sched: Flush gso_skb list too during ->change()
  - !17576  net/sched: Fix CVE-2025-37890
  - arm64: mm: HVO: fix deadlock in split vmemmap pmd
  - mm: HVO: fix hard lockup in split_vmemmap_huge_pmd under x86
  - !17581  tracing: Add down_write(trace_event_sem) when adding trace event
  - !17580  iio: adc: ti-ads8688: fix information leak in triggered buffer
  - tracing: Add down_write(trace_event_sem) when adding trace event
  - !17579 v2  two cve fix
  - iio: adc: ti-ads8688: fix information leak in triggered buffer
  - vfio/platform: check the bounds of read/write syscalls
  - powerpc/mm/fault: Fix kfence page fault reporting
  - net/sched: ets: use old 'nbands' while purging unused classes
  - net/sched: Always pass notifications when child class becomes empty
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
  - md/raid1: Fix stack memory use after return in raid1_reshape
  - blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx
  - net_sched: Flush gso_skb list too during ->change()
  - partitions: mac: fix handling of bogus partition table


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-280.0.0.183
changelog:
  - !17849 [OLK-5.10]:update patches for sw64 architecture
  - !17852  cpufreq: Init policy->rwsem before it may be possibly used
  - sw64: fix for userspace asking for syscall(-1)
  - sw64: update junzhang default config file
  - sw64: kvm: introduce pmd_thp_or_huge for PMD hugepage checking
  - sw64: add cross-page check in software unaligned write handling
  - sw64: ptrace: fail system calls on invalid address access in PEEKUSR
  - sw64: ptrace: fix a bug in return value handling in PEEKUSR AND POKEUSR
  - !17738  CVE-2024-53216 && CVE-2024-56558
  - cpufreq: Init policy->rwsem before it may be possibly used
  - !17801  page_pool: Fix use-after-free in page_pool_recycle_in_ring
  - !17799  iwlwifi: Add missing check for alloc_ordered_workqueue
  - !17817  vmci: Prevent the dispatching of uninitialized payloads
  - !17680 Add Model specific EPP adjustment support for EMR/SPR/GNR
  - !17667 cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
  - !17682 Add TPMI RAPL PMU support for GNR/CWF and later Intel Xeon machines
  - !17664 intel_pstate support OOB mode for EMR/GNR/SRF/CWF
  - !17662 platform/x86: ISST: Add Clearwater Forest to support list
  - !17820  mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
  - mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
  - !17767 RDMA/hns: Fix bond not cleared when the configuration becomes invalid
  - !17806  pinmux: fix race causing mux_owner NULL with active mux_usecount
  - !17805  f2fs: fix to avoid out-of-boundary access in devs.path
  - vmci: Prevent the dispatching of uninitialized payloads
  - pinmux: fix race causing mux_owner NULL with active mux_usecount
  - f2fs: fix to avoid out-of-boundary access in devs.path
  - !17795  perf/core: Prevent VMA split of buffer mappings
  - !17316 [OLK-5.10] backport the follow important bugfix for nvme driver from upstream linux-5.10.y
  - !17791  ipv6: mcast: extend RCU protection in igmp6_send()
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring
  - page_pool: fix inconsistency for page_pool_ring_[un]lock()
  - net: page_pool: use in_softirq() instead
  - iwlwifi: Add missing check for alloc_ordered_workqueue
  - !17573 ROH: Add crc_err_cnt and retry_cnt mib statistics
  - perf/core: Prevent VMA split of buffer mappings
  - !17773  thunderbolt: Do not double dequeue a configuration request
  - !17793 v2  fix some CVEs
  - KVM: x86: Reset IRTE to host control if *new* route isn't postable
  - rapidio: fix an API misues when rio_add_net() fails
  - filemap: avoid truncating 64-bit offset to 32 bits
  - drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table
  - drm/amd/display: Fix memory leak
  - scsi: ufs: bsg: Set bsg_queue to NULL after removal
  - ipv6: mcast: extend RCU protection in igmp6_send()
  - !17759  CVE-2025-37834
  - !17749  mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
  - !17688  netfilter: fix CVE-2022-49622
  - !17698  netfilter: nft_tunnel: fix geneve_opt type confusion addition
  - !17686  net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
  - !17710  bnxt_en: Fix out-of-bound memcpy() during ethtool -w
  - !17765  mm/smaps: fix race between smaps_hugetlb_range and migration
  - !17740  Fix trace may OOB when trace_get_user failed
  - !17743  i2c: qup: jump out of the loop in case of timeout
  - thunderbolt: Do not double dequeue a configuration request
  - RDMA/hns: Fix bond not cleared when the configuration becomes invalid
  - mm/smaps: fix race between smaps_hugetlb_range and migration
  - mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
  - mm/vmscan: don't try to reclaim hwpoison folio
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
  - i2c: qup: jump out of the loop in case of timeout
  - tracing: Limit access to parser->buffer when trace_get_user failed
  - tracing: Remove unneeded goto out logic
  - nfsd: fix UAF when access ex_uuid or ex_stats
  - SUNRPC: no need get cache ref when protected by rcu
  - nfsd: no need get cache ref when protected by rcu
  - SUNRPC: introduce cache_check_rcu to help check in rcu context
  - nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work"
  - nfsd: release svc_expkey/svc_export with rcu_work
  - SUNRPC: make sure cache entry active before cache_show
  - nfsd: make sure exp active before svc_export_show
  - platform/x86: ISST: Add Clearwater Forest to support list
  - powercap: intel_rapl_tpmi: Enable PMU support
  - powercap: intel_rapl: Introduce APIs for PMU support
  - powercap: intel_rapl: Sort header files
  - cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
  - cpufreq: intel_pstate: Update Balance-performance EPP for Granite Rapids
  - cpufreq: intel_pstate: Update Balance performance EPP for Emerald Rapids
  - cpufreq: intel_pstate: Allow model specific EPPs
  - bitfield: add FIELD_PREP_CONST()
  - cpufreq: intel_pstate: Adjust balance_performance EPP for Sapphire Rapids
  - cpufreq: intel_pstate: Update EPP for AlderLake mobile
  - cpufreq: intel_pstate: Support Clearwater Forest OOB mode
  - cpufreq: intel_pstate: Support Granite Rapids and Sierra Forest OOB mode
  - cpufreq: intel_pstate: Support Emerald Rapids OOB mode
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w
  - netfilter: nft_tunnel: fix geneve_opt type confusion addition
  - selftests: netfilter: add test case for nf trace infrastructure
  - netfilter: nf_tables: fix crash when nf_trace is enabled
  - netfilter: nf_tables: avoid skb access on nf_stolen
  - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
  - ROH: Add crc_err_cnt and retry_cnt mib statistics
  - nvme-tcp: fix premature queue removal and I/O failover


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-281.0.0.184
changelog:
  - !17933  CVE-2025-38502
  - bpf: Fix updating attached freplace prog in prog_array map
  - bpf: Resolve fext program type when checking map compatibility
  - Fix kabi breakage for bpf_map by using KABI_FILL_HOLE and KABI_EXTEND
  - bpf: Fix oob access in cgroup local storage
  - bpf: Move cgroup iterator helpers to bpf.h
  - bpf: Move bpf map owner out of common struct
  - bpf: Add cookie object to bpf maps
  - bpf: generalise tail call map compatibility check
  - !17904 [OLK-5.5] perf/zhaoxin/uncore: Enhance uncore support and fix related bugs
  - !16636 [OLK-5.10] dma: phytium: Add PSWIOTLB mechanism to improve DMA performance
  - !17912  net/mlx5: Check device memory pointer before usage
  - net/mlx5: Check device memory pointer before usage
  - !17885 [OLK-5.10] backport important bugfix for lpfc driver from upstream linux-5.10.y
  - perf/zhaoxin/uncore: Enhance uncore support and fix related bugs
  - !17867  scsi: core: ufs: Fix a hang in the error handler
  - scsi: lpfc: Fix link down processing to address NULL pointer dereference
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
  - !17443  scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
  - scsi: core: ufs: Fix a hang in the error handler
  - dma: phyitum: enable CONFIG_PHYTIUM_ERRATUM_FT3386
  - dma: pswiotlb: Move platform-identification to cpu errata
  - dma: pswiotlb: Move pswiotlb dma functions behind dma_map_ops
  - dma: Fix kabi breakage due to "dma: phytium: Add PSWIOTLB mechanism to improve DMA performance"
  - dma: phyitum: enable CONFIG_PSWIOTLB
  - dma: phytium: Add PSWIOTLB mechanism to improve DMA performance
  - scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-282.0.0.185
changelog:
  - !17999  gfs2: Validate i_depth for exhash directories
  - !17970  nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
  - gfs2: Validate i_depth for exhash directories
  - !17995  media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()


author: zhangmingyi <zhangmingyi5@huawei.com> 2:0.8.1-12
changelog:
  - backport patches from upstream:
    backport-libbpf-Fix-NULL-pointer-dereference-in_bpf_object__c.patch
    backport-libbpf-Fix-str_has_sfxs-return-value.patch
    backport-libbpf-Initialize-err-in-probe_map_create.patch


author: jinzhiguang <jinzhiguang@kylinos.cn> - 2:0.8.1-13
changelog:
  - backport patch from upstream:
    backport-libbpf-Modify-the-function-name-in-libbpf.c-to-match.patch


author: xiesongyang <xiesongyang@huawei.com> - 2:0.8.1-14
changelog:
  - backport patch from upstream:
    backport-libbpf-Fix-an-error-in-64bit-relocation-value-comput.patch


author: zhangmingyi <zhangmingyi5@huawei.com> 2:0.8.1-15
changelog:
  - backport patch from upstream:
    backport-libbpf-Avoid-uninitialized-value-in-BPF_CORE_READ_BI.patch


author: zhangmingyi <zhangmingyi5@huawei.com> 2:0.8.1-16
changelog:
  - backport patch from upstream:
    backport-libbpf-Add-NULL-checks-to-bpf_object__prev_map,next_.patch
    backport-libbpf-Apply-map_set_def_max_entries-for-inner_maps-.patch
    backport-libbpf-Fix-uninitialized-warning-in-btf_dump_dump_ty.patch


author: zhangmingyi <zhangmingyi5@huawei.com> 2:0.8.1-17
changelog:
  - backport patch from upstream:
    backport-libbpf-Dont-take-direct-pointers-into-BTF-data-from-.patch


author: zhangmingyi <zhangmingyi5@huawei.com> 2:0.8.1-18
changelog:
  - backport patch from upstream:
    backport-libbpf-Do-not-resolve-size-on-duplicate-FUNCs.patch
    backport-libbpf-Fix-bpf_object__open_skeleton-s-mishandling-o.patch
    backport-libbpf-Fix-segfault-due-to-libelf-functions-not-sett.patch
    backport-libbpf-Fixed-getting-wrong-return-address-on-arm64-a.patch
    backport-libbpf-fix-sym_is_subprog-logic-for-weak-global-subp.patch
    backport-libbpf-move-global-data-mmap-ing-into-bpf_object__lo.patch


author: tianmuyang <tianmuyang@huawei.com> 2:0.8.1-19
changelog:
  - Adaption for sched type eBPF program:
    backport-libbpf-Adaption-for-sched-type-eBPF-program.patch


author: andy <liuyang01@kylinos.cn> 2:0.8.1-20
changelog:
  - backport patch from upstream:
    backport-libbpf-Fix-out-of-bound-read.patch
    backport-libbpf-fix-LDX_STX_ST-CO-RE-relocation-size-adjustment-logic.patch
    backport-libbpf-Fix-hypothetical-STT_SECTION-extern-NULL-deref-case.patch


author: tianmuyang <tianmuyang@huawei.com> 2:0.8.1-21
changelog:
  - Add bpf_cpumask_op API to support prefered cpu control in eBPF program:
    backport-libbpf-Add-bpf_cpumask_op-API-to-support-prefered-cp.patch


author: renmingshuai <renmingshuai@huawei.com> - 0.9.6-8
changelog:
  - Type:CVE
  - Id:CVE-2023-6004,CVE-2023-6918,CVE-2023-48795
  - SUG:NA
  - DESC:fix CVE-2023-6004, CVE-2023-6918 and CVE-2023-48795


author: gaihuiying <eaglegai@163.com> - 0.9.6-11
changelog:
  - Type:CVE
  - CVE:CVE-2025-4877 CVE-2025-4878 CVE-2025-5372
  - SUG:NA
  - DESC:fix CVE-2025-4877 CVE-2025-4878 CVE-2025-5372


author: xinsheng <xinsheng3@huawei.com> - 3.9.9-36
changelog:
  - Type:CVE
  - CVE:CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597,CVE-2024-4032
  - SUG:NA
  - DESC:fix CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597,CVE-2024-4032
      - rename all CVE patch name
      - CVE-2024-6232: Remove backtracking when parsing tarfile headers
      - CVE-2024-3219: patch1 Authenticate socket connection for `socket.socketpair()` fallback
      - CVE-2024-3219: patch2 Rework pure Python socketpair tests to avoid use of importlib.reload.
      - CVE-2024-0450: Protect zipfile from "quoted-overlap" zipbomb
      - CVE-2023-6597: tempfile.TemporaryDirectory: fix symlink bug in cleanup
      - CVE-2024-4032: Fix "private" (non-global) IP address ranges


author: wangshuo <wangshuo@kylinos.cn> - 3.9.9-37
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport upstream patch, fix the bug introduced by the fix for CVE-2007-4559
  -      gh-107845: Fix symlink handling for tarfile.data_filter


author: Funda Wang <fundawang@yeah.net> - 3.9.9-38
changelog:
  - Type:CVE
  - CVE:CVE-2024-9287
  - SUG:NA
  - DESC:fix CVE-2024-9287
    - Quote template strings in venv activation scripts


author: xinsheng <xinsheng3@huawei.com> - 3.9.9-40
changelog:
  - Type:CVE
  - CVE:CVE-2024-11168
  - SUG:NA
  - DESC:fix CVE-2024-11168
         - Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format


author: lipengyu <lipengyu@kylinos.cn> - 3.9.9-45
changelog:
  - Type:CVE
  - CVE:CVE-2025-4517 CVE-2025-4138 CVE-2024-12718 CVE-2025-4330 CVE-2025-4435
  - SUG:NA
  - DESC:fix CVE-2025-4517 CVE-2025-4138 CVE-2024-12718 CVE-2025-4330 CVE-2025-4435


