# changelog

author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.90.0.114
changelog:
  - !574 Backport CVEs and bugfixes
  - driver core: Fix lockdep warning on wfs_lock
  - driver core: platform: Add extra error check in devm_platform_get_irqs_affinity()
  - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
  - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size
  - ubi: ensure that VID header offset + VID header size <= alloc, size
  - ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct()
  - perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach
  - ring-buffer: Fix race while reader and writer are on the same page
  - loop: Add parm check in loop_control_ioctl
  - ext4: Fix i_disksize exceeding i_size problem in paritally written case
  - ext4: ext4_put_super: Remove redundant checking for 'sbi->s_journal_bdev'
  - ext4: Fix reusing stale buffer heads from last failed mounting
  - btrfs: fix race between quota disable and quota assign ioctls
  - dm crypt: add cond_resched() to dmcrypt_write()
  - xfs: don't leak memory when attr fork loading fails
  - xfs: delete unnecessary NULL checks
  - xfs: replace inode fork size macros with functions
  - xfs: replace XFS_IFORK_Q with a proper predicate function
  - xfs: use XFS_IFORK_Q to determine the presence of an xattr fork
  - xfs: make inode attribute forks a permanent part of struct xfs_inode
  - xfs: convert XFS_IFORK_PTR to a static inline helper
  - xfs: don't reuse busy extents on extent trim
  - fs/xfs: convert comma to semicolon
  - xfs: xfs_ail_push_all_sync() stalls when racing with updates
  - xfs: check buffer pin state after locking in delwri_submit
  - xfs: log worker needs to start before intent/unlink recovery


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.91.0.115
changelog:
  - !588 [sync] PR-585:  x86/speculation: Allow enabling STIBP with legacy IBRS
  - !591 Backport CVEs and bugfixes
  - net/sched: Retire tcindex classifier
  - drm/vmwgfx: Validate the box size for the snooped cursor
  - netfilter: nf_tables: nft_parse_register can return a negative value
  - netfilter: nf_tables: validate registers coming from userspace.
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
  - KVM: nVMX: add missing consistency checks for CR0 and CR4
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
  - xfs: __percpu_counter_compare() inode count debug too expensive
  - xfs: fix memcpy fortify errors in EFI log format copying
  - xfs: fix memcpy fortify errors in RUI log format copying
  - xfs: fix memcpy fortify errors in CUI log format copying
  - xfs: fix memcpy fortify errors in BUI log format copying
  - xfs: Use struct xfs_bmdr_block instead of struct xfs_btree_block to calculate root node size
  - xfs: allow setting full range of panic tags
  - xfs: don't use BMBT btree split workers for IO completion
  - xfs: fix extent busy updating
  - xfs: get root inode correctly at bulkstat
  - xfs: invalidate xfs_bufs when allocating cow extents
  - xfs: attach dquots to inode before reading data/cow fork mappings
  - xfs: invalidate block device page cache during unmount
  - xfs: add selinux labels to whiteout inodes
  - xfs: convert buf_cancel_table allocation to kmalloc_array
  - xfs: don't leak xfs_buf_cancel structures when recovery fails
  - xfs: refactor buffer cancellation table allocation
  - xfs: fix type mismatches in the inode reclaim functions
  - xfs: don't allow log writes if the data device is readonly
  - x86/speculation: Allow enabling STIBP with legacy IBRS


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.92.0.116
changelog:
  - !632 Backport CVEs and bugfixes
  - bonding: Fix memory leak when changing bond type to Ethernet
  - bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
  - bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
  - rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975]
  - power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
  - timers/nohz: Last resort update jiffies on nohz_full IRQ entry
  - xfs: don't leak btree cursor when insrec fails after a split
  - xfs: avoid unnecessary runtime sibling pointer endian conversions
  - xfs: detect self referencing btree sibling pointers
  - xfs: introduce xfs_buf_daddr()
  - xfs: move kernel-specific superblock validation out of libxfs
  - xfs: bound maximum wait time for inodegc work
  - xfs: introduce xfs_inodegc_push()
  - xfs: flush inodegc workqueue tasks before cancel
  - xfs: drop async cache flushes from CIL commits.
  - xfs: limit iclog tail updates
  - xfs: need to see iclog flags in tracing
  - io_uring: ensure that io_init_req() passes in the right issue_flags
  - io_uring: add missing lock in io_get_file_fixed


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.93.0.117
changelog:
  - !723 Backport CVEs and bugfixes
  - USB: gadgetfs: Fix race between mounting and unmounting
  - prlimit: do_prlimit needs to have a speculation check
  - ext4: check iomap type only if ext4_iomap_begin() does not fail
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern
  - net: qcom/emac: Fix use after free bug in emac_remove due to race condition
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
  - i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
  - ext4: only update i_reserved_data_blocks on successful block allocation
  - can: af_can: fix NULL pointer dereference in can_rcv_filter
  - RDMA/core: Refactor rdma_bind_addr
  - RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
  - scsi: dpt_i2o: Remove obsolete driver
  - writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs
  - bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
  - bpf, sockmap: Fix double bpf_prog_put on error case in map_link
  - bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap
  - bpf, sockmap: Attach map progs to psock early for feature probes
  - bpf, sockmap: Fix return codes from tcp_bpf_recvmsg_parser()
  - bpf, sockmap: Fix race in ingress receive verdict with redirect to self


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.94.0.118
changelog:
  - !775 Backport CVEs and bugfixes
  - filemap: Correct the conditions for marking a folio as accessed
  - Revert "filemap: Correct the conditions for marking a folio as accessed"
  - netrom: Fix use-after-free caused by accept on already connected socket
  - bluetooth: Perform careful capability checks in hci_sock_ioctl()
  - fs/ntfs3: Delete duplicate condition in ntfs_read_mft()
  - fs/ntfs3: Fix slab-out-of-bounds read in run_unpack
  - fs/ntfs3: Validate data run offset
  - xfs: buffer pins need to hold a buffer reference
  - ovl: get_acl: Fix null pointer dereference at realinode in rcu-walk mode
  - fix kabi broken due to import new inode operation get_inode_acl
  - ovl: enable RCU'd ->get_acl()
  - vfs: add rcu argument to ->get_acl() callback
  - bpf: add missing header file include
  - uaccess: Add speculation barrier to copy_from_user()
  - !684 [sync] PR-675: driver/hifc&hinic: Fix compile error in allyesconfigs
  - scsi/hifc: Fix compile error in allyesconfigs
  - net/hinic: Fix compile error in allyesconfigs


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.95.0.119
changelog:
  - !800 Backport CVEs
  - netfilter: nf_tables: deactivate anonymous set from preparation phase
  - xfs: verify buffer contents when we skip log replay


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.96.0.120
changelog:
  - !862 Backport CVEs and bugfixes
  - cgroup: Stop task iteration when rebinding subsystem
  - drm/virtio: Fix error code in virtio_gpu_object_shmem_init()
  - drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling
  - drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init
  - sched/topology: Fix exceptional memory access in sd_llc_free_all()
  - block: Fix the partition start may overflow in add_partition()
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum
  - iomap: don't invalidate folios after writeback errors
  - iomap: Don't create iomap_page objects in iomap_page_mkwrite_actor
  - iomap: Don't create iomap_page objects for inline files
  - iomap: Permit pages without an iop to enter writeback
  - md: fix kabi broken in struct mddev
  - md: use interruptible apis in idle/frozen_sync_thread
  - md: wake up 'resync_wait' at last in md_reap_sync_thread()
  - md: refactor idle/frozen_sync_thread()
  - md: add a mutex to synchronize idle and frozen in action_store()
  - md: refactor action_store() for 'idle' and 'frozen'
  - Revert "md: unlock mddev before reap sync_thread in action_store"
  - md: unlock mddev before reap sync_thread in action_store
  - block: fix wrong mode for blkdev_put() from disk_scan_partitions()
  - block: fix scan partition for exclusively open device again
  - block: merge disk_scan_partitions and blkdev_reread_part
  - !812 [sync] PR-761: net: stmmac: fix potential double free of dma descriptor resources
  - net: stmmac: fix potential double free of dma descriptor resources
  - !806 [sync] PR-760: LoongArch: kvm: fix bug of kvm's hugepage
  - !669 [sync] PR-564: usb: disable soft retry for EJ188 controller
  - !796 [sync] PR-765: LoongArch: fix some stability issues
  - !784 [sync] PR-766: LoongArch: add kexec&kdump support
  - LoongArch: kvm: fix bug of kvm's hugepage
  - LoongArch: defconfig: enable CONFIG_CACHEFILES
  - i2c: loongson: fix irq not freed when remove module
  - LoongArch: Set _PAGE_DIRTY only if _PAGE_MODIFIED is set in {pmd,pte}_mkwrite()
  - LoongArch: Set _PAGE_DIRTY only if _PAGE_WRITE is set in {pmd,pte}_mkdirty()
  - LoongArch: Clear FPU/SIMD thread info flags for kernel thread
  - LoongArch: Remove generic irq migration
  - LoongArch: Fix secondary bridge routing errors
  - LoongArch: Fix kdump failure on v40 interface specification
  - LoongArch: configs: Enable kexec/kdump
  - LoongArch: kdump: Add crashkernel=YM handling
  - LoongArch: kdump: Add single kernel image implementation
  - LoongArch: Add support for kernel address space layout randomization (KASLR)
  - LoongArch: Add support for kernel relocation
  - LoongArch: Add la_abs macro implementation
  - LoongArch: Add JUMP_VIRT_ADDR macro implementation to avoid using la.abs
  - LoongArch: Use la.pcrel instead of la.abs when it's trivially possible
  - LoongArch: efistub: Modify the address where efistub jumps to the main kernel
  - LoongArch: kdump: Add memory reservation for old kernel
  - LoongArch: Integrate initrd operation
  - LoongArch: kexec: Add compatibility with old interfaces
  - LoongArch: Flush TLB earlier at initialization
  - LoongArch: Add kdump support
  - LoongArch: Add kexec support
  - usb: xhci: add XHCI_NO_SOFT_RETRY quirk for EJ188


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.97.0.121
changelog:
  - !904 [sync] PR-903: backport block bugfix
  - !962 [sync] PR-937:  tcp: restrict net.ipv4.tcp_app_win
  - !959 [sync] PR-925:  tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent
  - !955 [sync] PR-938:  config: Disable CONFIG_EULER_FS by default
  - tcp: restrict net.ipv4.tcp_app_win
  - tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent
  - config: Disable CONFIG_EULER_FS by default
  - !930  xfs: missing lts patchs
  - !935 [sync] PR-922:  jbd2: fix checkpoint inconsistent
  - !917 [sync] PR-880: LoongArch: kdump: Add high memory reservation
  - !916 [sync] PR-868: LoongArch: fix compile error caused by __ffs not defined
  - !915 [sync] PR-792: LoongArch: add ls2k500 bmc support
  - jbd2: remove t_checkpoint_io_list
  - jbd2: recheck chechpointing non-dirty buffer
  - xfs: validate inode fork size against fork format
  - xfs: reorder iunlink remove operation in xfs_ifree
  - !912 [sync] PR-906:  ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
  - LoongArch: kdump: Add high memory reservation
  - LoongArch: fix __ffs not defined compile error
  - LoongArch: fix ls2k500 bmc not work when installing iso
  - LoongArch: defconfig: enable CONFIG_FB_LS2K500=m.
  - ipmi: add ls2k500 bmc ipmi support.
  - fbdev: add ls2k500sfb driver for ls2k500 bmc.
  - ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
  - md/raid10: fix incorrect done of recovery
  - md/raid10: fix null-ptr-deref in raid10_sync_request
  - block/badblocks: fix badblocks loss when badblocks combine
  - block/badblocks: fix the bug of reverse order
  - md: fix unexpected changes of return value in rdev_set_badblocks
  - md/raid10: fix io hung in md_wait_for_blocked_rdev()
  - block: Only set bb->changed when badblocks changes
  - md/raid10: fix incorrect counting of rdev->nr_pending
  - md/raid10: remove WANR_ON_ONCE in raid10_end_write_request
  - md/raid10: fix uaf if replacement replaces rdev
  - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
  - md/raid10: fix io loss while replacement replace rdev
  - md/raid10: prioritize adding disk to 'removed' mirror
  - md: fix io loss when remove rdev fail
  - md/raid10: fix a race between removing rdev and access conf->mirrors[i].rdev
  - md/raid10: fix taks hung in raid10d
  - md/raid10: factor out code from wait_barrier() to stop_waiting_barrier()
  - md/raid10: fix softlockup in raid10_unplug
  - md/raid1: stop mdx_raid1 thread when raid1 array run failed
  - md: fix sysfs duplicate file while adding rdev
  - md: replace invalid function flush_rdev_wq() with flush_workqueue()
  - md: Flush workqueue md_rdev_misc_wq in md_alloc()
  - block: don't allow the same type rq_qos add more than once
  - blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost
  - blk-iocost: don't allow to configure bio based device
  - !867  arm64: kdump: Avoid reserving low memory repeatedly
  - !854 [sync] PR-793: LoongArch: kvm: add pv ipi support
  - !853 [sync] PR-809: LoongArch: defconfig: enable memory and pci hotplug related configs for LoongArch
  - arm64: kdump: Avoid reserving low memory repeatedly
  - LoongArch: LSVZ: Support PV IPI to reduce VM exit
  - LoongArch: defconfig: Add PCI hotplug support
  - LoongArch: defconfig: Add memory hotplug support


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.98.0.122
changelog:
  - !1103 [sync] PR-1089:  power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
  - !1108 [sync] PR-1090:  fs/ntfs3: Check fields while reading
  - !1117 [sync] PR-1084: LoongArch: fix wrong 7a1000 int_clear register write
  - !1116 [sync] PR-1083: LoongArch: fix system hang caused by 2k500 bmc driver
  - irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write.
  - ipmi_si: ls2k500 kcs driver add wait bmc reboot done and rebind support.
  - fs/ntfs3: Check fields while reading
  - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
  - !1008 [sync] PR-941: LoongArch: fix 2k500 sfb driver not work during reboot
  - !1031  nbd: get config_lock before sock_shutdown
  - !1060  Support dynamic_hugetlb on arm64 and fix some bug
  - !1057 [sync] PR-1028:  fs: hfsplus: fix UAF issue in hfsplus_put_super
  - mm/dynamic_hugetlb: fix type error of pfn in __hpool_split_gigantic_page()
  - mm/dynamic_hugetlb: set PagePool to bad page
  - mm/dynamic_hugetlb: replace spin_lock with mutex_lock and fix kabi broken
  - mm/dynamic_hugetlb: isolate hugepage without dissolve
  - mm/dynamic_hugetlb: support dynamic hugetlb on arm64
  - mm/dynamic_hugetlb: fix kabi broken when enable CONFIG_DYNAMIC_HUGETLB on arm64
  - !1034  io_uring: fix the problem of
  - fs: hfsplus: fix UAF issue in hfsplus_put_super
  - !1050 [sync] PR-1027: scripts: Fix issue of module signing with openssl 3.x
  - scripts: Fix issue of module signing with openssl 3.x
  - !994 [sync] PR-990:  ubi: Fix deadlock caused by recursively holding work_sem
  - !999 [sync] PR-928:  hikey9xx: Fixed incorrect use of kfree to free sreg
  - !1010 [sync] PR-924:  dm: add disk before alloc dax
  - !1013 [sync] PR-920:  dm thin: Fix ABBA deadlock by resetting dm_bufio_client
  - kernel: don't call do_exit() for PF_IO_WORKER threads
  - x86/process: setup io_threads more like normal user space threads
  - arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread()
  - arch: setup PF_IO_WORKER threads like PF_KTHREAD
  - !950 [sync] PR-929:  xfs: rework feature flags
  - nbd: get config_lock before sock_shutdown
  - !971 [sync] PR-969:  kobject: Fix slab-out-of-bounds in fill_kobj_path()
  - !986 [sync] PR-954:  block: iocost bugfix
  - !983 [sync] PR-946:  icost bugfix
  - dm thin: Fix ABBA deadlock by resetting dm_bufio_client
  - dm: add disk before alloc dax
  - PCI/portdrv: Prevent LS7A Bus Master clearing on shutdown
  - Revert "PCI: Add quirk for LS7A to avoid reboot failure"
  - hikey9xx: Fixed incorrect use of kfree to free sreg
  - ubi: Fix deadlock caused by recursively holding work_sem
  - mtd: ubi: wl: Fix a couple of kernel-doc issues
  - !975 [sync] PR-968:  Fix ORC unwinder on paravirt {save,restore}_fl
  - !936 [sync] PR-897: LoongArch: improve dma ops and interrupt process
  - !939 [sync] PR-869: LoongArch: defconfig: Enable a large number of configurations
  - block: fix order error in blk_release_queue
  - block: fix null-pointer dereference in ioc_pd_init
  - blk-iocost: dispatch all throttled bio in ioc_pd_offline
  - blk-iocost: don't throttle bio if iocg is offlined
  - blk-iocost: track whether iocg is still online
  - blk-iocost: fix UAF in ioc_pd_free
  - x86/unwind: Fix check_paravirt() calls orc_find() before declaration
  - x86/unwind: Fix orc entry for paravirt {save,restore}_fl
  - kobject: Fix slab-out-of-bounds in fill_kobj_path()
  - xfs: kill xfs_sb_version_has_v3inode()
  - xfs: introduce xfs_sb_is_v5 helper
  - xfs: remove unused xfs_sb_version_has wrappers
  - xfs: convert xfs_sb_version_has checks to use mount features
  - xfs: convert scrub to use mount-based feature checks
  - xfs: open code sb verifier feature checks
  - xfs: convert xfs_fs_geometry to use mount feature checks
  - xfs: replace XFS_FORCED_SHUTDOWN with xfs_is_shutdown
  - xfs: convert remaining mount flags to state flags
  - xfs: convert mount flags to features
  - xfs: consolidate mount option features in m_features
  - xfs: replace xfs_sb_version checks with feature flag checks
  - xfs: reflect sb features in xfs_mount
  - xfs: rework attr2 feature and mount options
  - xfs: rename xfs_has_attr()
  - xfs: xfs_is_shutdown vs xlog_is_shutdown cage fight
  - xfs: log items should have a xlog pointer, not a mount
  - xfs: fix incorrect error-out in xfs_remove
  - LoongArch: defconfig: Enable a large number of configurations
  - LoongArch: Add swiotlb backups buffer
  - LoongArch: Add ARCH_HAS_SETUP_DMA_OPS and DMA_OPS
  - pci: irq: Add early_param pci_irq_limit to limit pci irq numbers


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.99.0.123
changelog:
  - !1176 MAINTAINERS: update openEuler/MAINTAINERS for LoongArch
  - MAINTAINERS: update openEuler/MAINTAINERS for LoongArch
  - !1167 [sync] PR-1162:  fbcon: Check font dimension limits
  - !1171  mm: oom: move memcg_print_bad_task() out of mem_cgroup_scan_tasks()
  - !1163 [sync] PR-1098:  proc: allow pid_revalidate() during LOOKUP_RCU
  - mm: oom: move memcg_print_bad_task() out of mem_cgroup_scan_tasks()
  - fbcon: Check font dimension limits
  - proc: allow pid_revalidate() during LOOKUP_RCU
  - !1145 [sync] PR-1136:  gfs2: Don't deref jdesc in evict
  - gfs2: Don't deref jdesc in evict
  - !1024 [sync] PR-947:  locking/rwsem: Prevent potential lock starvation
  - !1073 [sync] PR-1042:  xfrm: Reinject transport-mode packets through workqueue
  - xfrm: Reinject transport-mode packets through workqueue
  - locking/rwsem: Prevent potential lock starvation
  - locking/rwsem: Pass the current atomic count to rwsem_down_read_slowpath()
  - locking/rwsem: Better collate rwsem_read_trylock()


