# changelog

author: Yu Peng <yupeng@kylinos.cn> - 1:1.26.2-14
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: bond:avoid logging warning to set "ad_actor_system=00:00:00:00:00:00".


author: yaoxin <yao_xin001@hoperun.com> - 1.2.24-1
changelog:
  - Update to 1.2.24:
    * Fixed formatting of ipsec.conf snippet. This is a security
    issue with severity of "Important." (CVE-2024-9050)
    * Added support for "require-id-on-certificate" setting.
    * Updated Georgian, Slovenian and Ukrainian translations.


author: wangkai <wangkai385@huawei.com> - 2.5.5-5
changelog:
  - Fix CVE-2019-3828 and hostname module support openEuler
  - and add defination of is_subpath and remove module_response_deepcopy


author: majianhan <majianhan@kylinos.cn> - 3.3.1-27
changelog:
  - Type:CVE
  - CVE:CVE-2025-2752 CVE-2025-2755 CVE-2025-2756 CVE-2025-5200 CVE-2025-5201 CVE-2025-5203 CVE-2025-5204
  - SUG:NA
  - DESC:fix CVE-2025-2752 CVE-2025-2755 CVE-2025-2756 CVE-2025-5200 CVE-2025-5201 CVE-2025-5203 CVE-2025-5204


author: huangyu <huangyu106@huawei.com> - 32:9.11.21-14
changelog:
  - Type:CVE
  - ID:CVE-2022-2906 CVE-2022-38177 CVE-2022-38178 CVE-2022-2795 CVE-2022-2881
  - SUG:NA
  - DESC:FIX CVE-2022-2906CVE-2022-38177CVE-2022-38178CVE-2022-2795CVE-2022-2881


author: zhanghao <zhanghao383@huawei.com> - 32:9.11.21-15
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix output expected information when install bing-sdborbind-sdb-chroot


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 32:9.11.21-23
changelog:
  - Type:CVE
  - CVE:CVE-2026-1519
  - SUG:NA
  - DESC:fix CVE-2026-1519: excessive NSEC3 iterations CPU exhaustion


author: tangce1 <tangce1@h-partners.com> - 32:9.11.21-24
changelog:
  - Type:CVE
  - CVE:CVE-2026-3039,CVE-2026-3592,CVE-2026-5946
  - SUG:NA
  - DESC:fix CVE-2026-3039,CVE-2026-3592,CVE-2026-5946


author: YunYi Yang <yangyunyi2@huawei.com> - 4.19.90-2311.3.0.0248
changelog:
  - config: arm64: Enable dubugfs config of hisi sas
  - scsi: hisi_sas_v3_hw: Remove extra function calls for runtime pm
  - scsi: hisi_sas_v3_hw: Don't use PCI helper functions
  - scsi: hisi_sas: Check usage count only when the runtime PM status is RPM_SUSPENDING
  - scsi: hisi_sas: Work around build failure in suspend function
  - scsi: hisi_sas: Block requests before take debugfs snapshot
  - scsi: hisi_sas: Add slave_destroy interface for v3 hw
  - scsi: hisi_sas: Configure the initialization registers according to HBA model
  - scsi: hisi_sas: Increase debugfs_dump_index after dump is completed
  - scsi: hisi_sas: Ensure all enabled PHYs up during controller reset
  - scsi: hisi_sas: Exit suspending state when usage count is greater than 0
  - scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id
  - Revert "scsi: hisi_sas: Disable SATA disk phy for severe I_T nexus reset failure"
  - scsi: hisi_sas: Disable-SATA-disk-phy-for-severe-I_T-nexus reset failure
  - scsi: hisi_sas: Use abort task set to reset SAS disks when discovered
  - scsi: hisi_sas: Undo RPM resume for failed notify phy event for v3 HW
  - scsi: hisi_sas: Fix rescan after deleting a disk
  - scsi: hisi_sas: Modify v3 HW SSP underflow error processing
  - scsi: hisi_sas: Fix phyup timeout on FPGA
  - scsi: hisi_sas: Prevent parallel controller reset and control phy command
  - scsi: hisi_sas: Limit users changing debugfs BIST count value
  - scsi: hisi_sas: Use autosuspend for the host controller
  - scsi: hisi_sas: Keep controller active between ISR of phyup and the event being processed
  - scsi: hisi_sas: Add more logs for runtime suspend/resume
  - scsi: hisi_sas: Wait for phyup in hisi_sas_control_phy()
  - scsi: hisi_sas: Initialise devices in .slave_alloc callback
  - scsi: hisi_sas: Speed up error handling when internal abort timeout occurs
  - scsi: hisi_sas: Reset controller for internal abort timeout
  - scsi: hisi_sas: Include HZ in timer macros
  - scsi: hisi_sas: Run I_T nexus resets in parallel for clear nexus reset
  - scsi: hisi_sas: Put a limit of link reset retries
  - scsi: hisi_sas: Print SATA device SAS address for soft reset failure
  - scsi: hisi_sas: Warn in v3 hw channel interrupt handler when status reg cleared
  - scsi: hisi_sas: Directly snapshot registers when executing a reset
  - scsi: hisi_sas: Call sas_unregister_ha() to roll back if .hw_init() fails
  - scsi: hisi_sas: Print SAS address for v3 hw erroneous completion print
  - scsi: hisi_sas: Add trace FIFO debugfs support
  - scsi: hisi_sas: Enable debugfs support by default
  - scsi: hisi_sas: Remove deferred probe check in hisi_sas_v2_probe()
  - scsi: hisi_sas: use threaded irq to process CQ interrupts
  - scsi: hisi_sas: Remove preemptible()
  - scsi: hisi_sas: Move debugfs code to v3 hw driver
  - scsi: hisi_sas: Reduce some indirection in v3 hw driver
  - scsi: hisi_sas: Fix up probe error handling for v3 hw
  - scsi: hisi_sas: Recover PHY state according to the status before reset
  - scsi: hisi_sas: Add device link between SCSI devices and hisi_hba
  - scsi: hisi_sas: Add check for methods _PS0 and _PR0
  - scsi: hisi_sas: Add controller runtime PM support for v3 hw
  - scsi: hisi_sas: Switch to new framework to support suspend and resume
  - scsi: hisi_sas: Code style cleanup
  - scsi: hisi_sas: Add missing newlines
  - scsi: hisi_sas: Add BIST support for fixed code pattern
  - scsi: hisi_sas: Add BIST support for phy FFE
  - scsi: hisi_sas: Make phy index variable name consistent
  - scsi: hisi_sas: Do not modify upper fields of PROG_PHY_LINK_RATE reg
  - scsi: hisi_sas: Modify macro name for OOB phy linkrate
  - scsi: hisi_sas: Remove one kerneldoc comment
  - scsi: hisi_sas: Do not reset phy timer to wait for stray phy up
  - scsi: hisi_sas: Stop returning error code from slot_complete_vX_hw()
  - scsi: hisi_sas: Add SAS_RAS_INTR0 to debugfs register name list
  - scsi: hisi_sas: Modify the commit information for DSM method
  - scsi: hisi_sas: Display proc_name in sysfs
  - scsi: hisi_sas: Fix build error without SATA_HOST
  - scsi: hisi_sas: Use dev_err() in read_iost_itct_cache_v3_hw()
  - scsi: hisi_sas: Add prints for v3 hw interrupt converge and automatic affinity
  - scsi: hisi_sas: Modify the file permissions of trigger_dump to write only
  - scsi: hisi_sas: Replace magic number when handle channel interrupt
  - scsi: hisi_sas: Stop converting a bool into a bool
  - scsi: hisi_sas: Return directly if init hardware failed
  - scsi: hisi_sas: Record the phy down event in debugfs
  - scsi: hisi_sas: Delete the debugfs folder of hisi_sas when the probe fails
  - scsi: hisi_sas: Add ability to have multiple debugfs dumps
  - scsi: hisi_sas: Add module parameter for debugfs dump count
  - scsi: hisi_sas: Allocate memory for multiple dumps of debugfs
  - scsi: hisi_sas: Add debugfs file structure for ITCT cache
  - scsi: hisi_sas: Add debugfs file structure for IOST cache
  - scsi: hisi_sas: Add debugfs file structure for ITCT
  - scsi: hisi_sas: Add debugfs file structure for IOST
  - scsi: hisi_sas: Add debugfs file structure for port
  - scsi: hisi_sas: Add debugfs file structure for registers
  - scsi: hisi_sas: Add debugfs file structure for DQ
  - scsi: hisi_sas: Add debugfs file structure for CQ
  - scsi: hisi_sas: Add timestamp for a debugfs dump
  - scsi: hisi_sas: Don't create debugfs dump folder twice
  - scsi: hisi_sas: Make three functions static
  - scsi: hisi_sas: fix spelling mistake "digial" -> "digital"
  - scsi: hisi_sas: Add hisi_sas_debugfs_alloc() to centralise allocation
  - scsi: hisi_sas: Remove some unused function arguments
  - scsi: hisi_sas: Remove redundant work declaration
  - scsi: hisi_sas: Remove hisi_sas_hw.slot_complete
  - scsi: hisi_sas: add debugfs auto-trigger for internal abort time out
  - scsi: hisi_sas: use devm_platform_ioremap_resource() to simplify code
  - scsi: hisi_sas: remove set but not used variable 'irq_value'
  - scsi: hisi_sas: Remove some unnecessary code
  - scsi: hisi_sas: Modify return type of debugfs functions
  - scsi: hisi_sas: Drop free_irq() when devm_request_irq() failed
  - scsi: hisi_sas: Drop SMP resp frame DMA mapping
  - scsi: hisi_sas: Drop kmap_atomic() in SMP command completion
  - scsi: hisi_sas: Snapshot AXI and RAS register at debugfs
  - scsi: hisi_sas: Snapshot HW cache of IOST and ITCT at debugfs
  - scsi: hisi_sas: Fix pointer usage error in show debugfs IOST/ITCT
  - scsi: hisi_sas: Make max IPTT count equal for all hw revisions
  - scsi: hisi_sas: Some misc tidy-up
  - scsi: hisi_sas: Use pci_irq_get_affinity() for v3 hw as experimental
  - scsi: hisi_sas: Fix losing directly attached disk when hot-plug
  - scsi: hisi_sas: Fix type casting and missing static qualifier in debugfs code
  - scsi: hisi_sas: No need to check return value of debugfs_create functions


author: Luo Shengwei <luoshengwei@huawei.com> - 4.19.90-2311.4.0.0249
changelog:
  - !1935 [openEuler-1.0-LTS] Add Phytium optee driver support
  - !2895  netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
  - !2873 Fix SAS start error with maxcpus=1
  - genirq: Take the proposed affinity at face value if force==true
  - optee: add phytium optee driver
  - optee: model OP-TEE as a platform device/driver
  - netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
  - irqchip/gic-v3: Always trust the managed affinity provided by the core code
  - genirq: Always limit the affinity to online CPUs
  - genirq/msi: Shutdown managed interrupts with unsatifiable affinities
  - !2508 [openEuler-1.0-LTS] jpeg: Add a Phytium JPEG Engine driver
  - !2522 [openEuler-1.0-LTS] Add support for Phytium SoC RNG
  - !2877  Revert "tcp: fix delayed ACKs for MSS boundary condition"
  - !2693 [openEuler-1.0-LTS] Add support for Phytium QSPI
  - !2402 [openEuler-1.0-LTS] Add Phytium w1 driver support
  - !2403 [openEuler-1.0-LTS] Add Phytium adc driver support
  - !1874 [openEuler-1.0-LTS] Add Phytium mailbox driver support
  - !2024 [openEuler-1.0-LTS] Add Phytium RTC driver support
  - !2682 [openEuler-1.0-LTS] Add support for Phytium MMC
  - !2671 [openEuler-1.0-LTS] phytium dwmac net driver
  - !2676 [openEuler-1.0-LTS] Add Phytium gpio driver support
  - !2604 [openEuler-1.0-LTS] Add support for Phytium SPI
  - !2540 [openEuler-1.0-LTS] Driver for the Phytium keypad port.
  - Revert "tcp: fix delayed ACKs for MSS boundary condition"
  - hwrng: Add support for Phytium SoC RNG
  - jpeg: Add a Phytium JPEG Engine driver
  - !2818  Fix memleak in disassociate_ctty()
  - !2810 drivers/gmjstcm: import CVE-2011-1160 CVE-2011-1162 fixes to tcm.c
  - drivers/gmjstcm: import CVE-2011-1160 CVE-2011-1162 fixes to tcm.c
  - rtc: add phytium rtc driver document
  - rtc: add rtc drivers for Phytium SOCs
  - gpio: add phytium gpio driver
  - dwmac:add phytium dwmac driver
  - mailbox:add phytium mailbox driver document
  - mailbox: add phytium mailbox driver
  - mmc: add phytium mmc driver DT binding docs
  - mmc: add support for Phytium MMC
  - tty: tty_jobctrl: fix pid memleak in disassociate_ctty()
  - Revert "tty: fix pid memleak in disassociate_ctty()"
  - spi: add phytium spi driver DT binding docs
  - spi: add phytium spi support
  - qspi: add phytium qspi driver DT binding docs
  - qspi: add support for Phytium QSPI controller
  - gpio: add phytium gpio driver document
  - dwmac:add phytium dwmac driver DT binding docs
  - adc: add phytium adc driver
  - adc: add phytium adc driver document
  - w1: add phytium w1 driver
  - w1: add phytium w1 driver document
  - KEYPAD: Driver for the Phytium keypad port.
  - KEYPAD: Document for the Phytium keypad port.


author: Li Xiaodong <lixiaodong67@huawei.com> - 4.19.90-2311.5.0.0252
changelog:
  - !3000 [openEuler-1.0-LTS] add Phytium drivers CONFIG
  - arm64: config: add config for Phytium drivers
  - !2908  mm/migrate.c: fix potential indeterminate pte entry in migrate_vma_insert_page()
  - !2869  mm, memory_hotplug: update pcp lists everytime onlining a memory block
  - !2805  sched/fair: Refill bandwidth before scaling
  - !2804  signal: Properly set TRACE_SIGNAL_LOSE_INFO in __send_signal
  - !2960  Add script to check & update openeuler_defconfig
  - config: update openeuler_defconfig for arm64
  - config: update openeuler_defconfig for x86
  - kconfig: Add script to check & update openeuler_defconfig
  - kbuild: ensure full rebuild when the compiler is updated
  - mm/migrate.c: fix potential indeterminate pte entry in migrate_vma_insert_page()
  - mm, memory_hotplug: update pcp lists everytime onlining a memory block
  - sched/fair: Refill bandwidth before scaling
  - signal: Properly set TRACE_SIGNAL_LOSE_INFO in __send_signal


author: Yuan Zhang <zhangyuan162@huawei.com> - 4.19.90-2311.5.0.0253
changelog:
  - arm64: cpufeature: Extract capped perfmon fields
  - KVM: arm64: limit PMU version to PMUv3 for ARMv8.1


author: YunYi Yang <yangyunyi2@huawei.com> - 4.19.90-2312.1.0.0255
changelog:
  - !3158  mm: don't let userspace spam allocations warnings
  - mm: don't let userspace spam allocations warnings
  - !2781  cpufreq: Abort show()/store() for half-initialized policies
  - !3118  sched: smart grid: check is active in affinity timer
  - sched: smart grid: check is active in affinity timer
  - !2977  Backport crypto bugfix
  - !3071  perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled
  - perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled
  - !3038  ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
  - !3031  x86/mce/amd: Publish the bank pointer only after setup has succeeded
  - !3030  x86/mce/inject: Fix a wrong assignment of i_mce.status
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
  - x86/mce/amd: Publish the bank pointer only after setup has succeeded
  - x86/mce/inject: Fix a wrong assignment of i_mce.status
  - crypto: fix kabi broken in struct crypto_instance
  - crypto: api - Use work queue in crypto_destroy_instance
  - cpufreq: make interface functions and lock holding state clear
  - cpufreq: Abort show()/store() for half-initialized policies


author: YunYi Yang <yangyunyi2@huawei.com> - 4.19.90-2312.3.0.0256
changelog:
  - !3347  tun: avoid double free in tun_free_netdev
  - tun: avoid double free in tun_free_netdev
  - !3239  net: hns: fix fake link up
  - !3113 KVM: arm64: limit PMU version to PMUv3 for ARMv8.1
  - !3281  LTS patch backport
  - !3122  nvme: retain split access workaround for capability reads
  - !3262  icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.
  - net: fix kabi broken in struct netns_xfrm
  - xfrm: fix a data-race in xfrm_gen_index()
  - !3276  linux-4.19.y inclusion
  - !3263  workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask()
  - !3267  x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
  - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
  - can: dev: can_restart(): fix race condition between controller restart and netif_carrier_on()
  - can: dev: can_restart(): don't crash kernel if carrier is OK
  - can: dev: move driver related infrastructure into separate subdir
  - ipv6: avoid atomic fragment on GSO packets
  - tcp_metrics: do not create an entry from tcp_init_metrics()
  - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics()
  - tcp_metrics: add missing barriers on delete
  - tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb
  - tcp: fix excessive TLP and RACK timeouts from HZ rounding
  - genirq/matrix: Exclude managed interrupts in irq_matrix_allocated()
  - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias()
  - ACPI: irq: Fix incorrect return value in acpi_register_gsi()
  - ext4: move 'ix' sanity check to corrent position
  - vfs: fix readahead(2) on block devices
  - overlayfs: set ctime when setting mtime and atime
  - quota: Fix slow quotaoff
  - mcb: remove is_added flag from mcb_device struct
  - sched,idle,rcu: Push rcu_idle deeper into the idle path
  - cgroup: Remove duplicates in cgroup v1 tasks file
  - x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
  - workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask()
  - icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.
  - net: hns: update hns version to 23.12.1
  - net: hns: fix fake link up on xge port
  - !3021  fix CFS bandwidth vs. hrtimer self deadlock
  - !3202  regmap: fix NULL deref on lookup
  - regmap: fix NULL deref on lookup
  - KVM: arm64: limit PMU version to PMUv3 for ARMv8.1
  - arm64: cpufeature: Extract capped perfmon fields
  - nvme: retain split access workaround for capability reads
  - cpu/hotplug: fix kabi breakage in enum cpuhp_state
  - hrtimers: Push pending hrtimers away from outgoing CPU earlier


author: YunYi Yang <yangyunyi2@huawei.com> - 4.19.90-2312.4.0.0257
changelog:
  - !3426  Revert "hrtimers: Push pending hrtimers away from outgoing CPU earlier"
  - Revert "hrtimers: Push pending hrtimers away from outgoing CPU earlier"
  - Revert "cpu/hotplug: fix kabi breakage in enum cpuhp_state"


author: YunYi Yang <yangyunyi2@huawei.com> - 4.19.90-2312.6.0.0258
changelog:
  - !3607  Fix CVE-2023-6546
  - !3606  perf/core: Fix CVE-2023-6931
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
  - tty: n_gsm: fix restart handling via CLD command
  - perf: Fix perf_event_validate_size() lockdep splat
  - perf: Fix perf_event_validate_size()
  - !3417  SCSI: hisi_raid: support SPxxx serial RAID/HBA controllers
  - !3531 Fix kernel panic occurs during ISO installation on the 20.03 SP3/SP4
  - i2c: hisi: Only handle the interrupt of the driver's transfer
  - i2c: hisi: Only use the completion interrupt to finish the transfer
  - i2c: hisi: Avoid redundant interrupts
  - !3483  net: Remove acked SYN flag from packet in the transmit queue correctly
  - net: Remove acked SYN flag from packet in the transmit queue correctly
  - SCSI: hisi_raid: support SPxxx serial RAID/HBA controllers


author: YunYi Yang <yangyunyi2@huawei.com> - 4.19.90-2401.1.0.0259
changelog:
  - !3660  atm: Fix Use-After-Free in do_vcc_ioctl
  - !3687  Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
  - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
  - !3672  smb: client: fix potential OOB in smb2_dump_detail()
  - !3671  smb: client: fix OOB in smbCalcSize()
  - !3627  jbd2: fix soft lockup in journal_finish_inode_data_buffers()
  - !3189  fs: don't audit the capability check in simple_xattr_list()
  - smb: client: fix potential OOB in smb2_dump_detail()
  - smb: client: fix OOB in smbCalcSize()
  - !3555  net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
  - atm: Fix Use-After-Free in do_vcc_ioctl
  - !3592  CVE-2023-35827 patchset
  - !3449  Fix data-races around
  - jbd2: fix soft lockup in journal_finish_inode_data_buffers()
  - ravb: Fix races between ravb_tx_timeout_work() and net related ops
  - ravb: Fix use-after-free issue in ravb_tx_timeout_work()
  - net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
  - ip: Fix data-races around sysctl_ip_no_pmtu_disc.
  - ip: Fix data-races around sysctl_ip_fwd_update_priority.
  - fs: don't audit the capability check in simple_xattr_list()


author: YunYi Yang <yangyunyi2@huawei.com> - 4.19.90-2401.3.0.0260
changelog:
  - !3768  iomap: add support to track dirty state of sub pages
  - !3845  netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
  - !3847  nvmet: nul-terminate the NQNs passed in the connect command
  - !3863 linux-4.19.y inclusion(4.19.299..4.19.303) part2
  - team: Fix use-after-free when an option instance allocation fails
  - packet: Move reference count in packet_sock to atomic_long_t
  - tcp: do not accept ACK of bytes we never sent
  - ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit()
  - ipv6: fix potential NULL deref in fib6_add()
  - ipv4: Correct/silence an endian warning in __ip_do_redirect
  - net: sched: fix race condition in qdisc_graft()
  - macvlan: Don't propagate promisc change to lower dev in passthru
  - ppp: limit MRU to 64K
  - tty: Fix uninit-value access in ppp_sync_receive()
  - net: annotate data-races around sk->sk_dst_pending_confirm
  - net: annotate data-races around sk->sk_tx_queue_mapping
  - !3862 linux-4.19.y inclusion(4.19.299..4.19.303) part1
  - ring-buffer: Fix memory leak of free page
  - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify
  - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation
  - Revert "PCI: acpiphp: Reassign resources on bridge if necessary"
  - x86/CPU/AMD: Check vendor in the AMD microcode callback
  - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
  - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
  - audit: don't take task_lock() in audit_exe_compare() code path
  - nvmet: nul-terminate the NQNs passed in the connect command
  - netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
  - !3823 [sync] PR-3822:  ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
  - ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
  - !3803  net/sched: cbs: Fix not adding cbs instance to list
  - net/sched: cbs: Fix not adding cbs instance to list
  - !3770  ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
  - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
  - iomap: add support to track dirty state of sub pages
  - !3757  Fix bugs from LTS patches
  - devcoredump: Send uevent once devcd is ready
  - devcoredump : Serialize devcd_del work
  - driver core: Release all resources during unbind before updating device links
  - !3716  appletalk: Fix Use-After-Free in atalk_ioctl
  - !3667  net/rose: Fix Use-After-Free in rose_ioctl
  - appletalk: Fix Use-After-Free in atalk_ioctl
  - net/rose: Fix Use-After-Free in rose_ioctl


author: YunYi Yang <yangyunyi2@huawei.com> - 4.19.90-2401.4.0.0261
changelog:
  - !4006  crypto: hisilicon/sec2: fix memory use-after-free issue
  - crypto: hisilicon/sec2: fix memory use-after-free issue
  - !3923  net: bridge: multicast: fix UAF of net_bridge
  - net: bridge: multicast: fix UAF of net_bridge


author: hongrongxuan <hongrongxuan@huawei.com> - 4.19.90-2401.5.0.0262
changelog:
  - !4101  netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
  - !2954 spi: phytium: fix phytium_spi_irq panic on boot
  - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
  - !4067  fix CVE-2022-48619
  - !4080  rtnetlink: Reject negative ifindexes in RTM_NEWLINK
  - rtnetlink: Reject negative ifindexes in RTM_NEWLINK
  - Revert "rtnetlink: Reject negative ifindexes in RTM_NEWLINK"
  - !4065  smb: client: fix OOB in receive_encrypted_standard()
  - !4021  netfilter: nf_tables: Reject tables of unsupported family
  - Input: add bounds checking to input_set_capability()
  - smb: client: fix OOB in receive_encrypted_standard()
  - !4039  crypto: hisilicon/qm: fix several issues
  - !4025  crypto: hisilicon - replace 'smp_processor_id' with the raw version of the macro
  - !3980  vhost: use kzalloc() instead of kmalloc() followed by memset()
  - crypto: hisilicon/qm: fix several issues
  - crypto: hisilicon - replace 'smp_processor_id' with the raw version of the macro
  - netfilter: nf_tables: Reject tables of unsupported family
  - vhost: use kzalloc() instead of kmalloc() followed by memset()
  - spi: phytium: fix phytium_spi_irq panic on boot


author: hongrongxuan <hongrongxuan@huawei.com> - 4.19.90-2402.1.0.0263
changelog:
  - !4277  fs:/dcache.c: fix negative dentry limit not complete problem
  - !4288  net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
  - !4299  smb: client: fix NULL deref in asn1_ber_decoder()
  - smb: client: fix NULL deref in asn1_ber_decoder()
  - net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
  - !4228  fix spinlock already unlocked in inet_csk_reqsk_queue_add' bug
  - fs:/dcache.c: fix negative dentry limit not complete problem
  - !4235  nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
  - !4255  drm/amdgpu: Fix potential fence use-after-free v2
  - !4209  dhugetlb: skip unexpected migration
  - drm/amdgpu: Fix potential fence use-after-free v2
  - !4231  crypto: hisilicon/qm - drop unnecessary IS_ENABLE(CONFIG_NUMA) check
  - nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
  - crypto: hisilicon/qm - drop unnecessary IS_ENABLE(CONFIG_NUMA) check
  - ipv6: init the accept_queue's spinlocks in inet6_create
  - tcp: make sure init the accept_queue's spinlocks once
  - !4212  netlink: fix potential sleeping issue in mqueue_flush_file
  - netlink: fix potential sleeping issue in mqueue_flush_file
  - dhugetlb: skip unexpected migration
  - dhugetlb: introduce page_belong_to_dynamic_hugetlb() function
  - !3944  time: Handle negative seconds correctly in timespec64_to_ns()
  - !3943  timerqueue: Use rb_entry_safe() in timerqueue_getnext()
  - !3942  efi/x86: Map the entire EFI vendor string before copying it
  - !4166  sched/fair: Fix qos_timer deadlock when cpuhp offline
  - sched/fair: Fix qos_timer deadlock when cpuhp offline
  - !4137  sctp: fix potential deadlock on &net->sctp.addr_wq_lock
  - sctp: fix potential deadlock on &net->sctp.addr_wq_lock
  - time: Handle negative seconds correctly in timespec64_to_ns()
  - timerqueue: Use rb_entry_safe() in timerqueue_getnext()
  - efi/x86: Map the entire EFI vendor string before copying it


author: hongrongxuan <hongrongxuan@huawei.com> - 4.19.90-2402.4.0.0264
changelog:
  - !4454  netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  - !4411 v2  drm/atomic: Fix potential use-after-free in nonblocking commits
  - !4412 v3  Save and restore msg_namelen in sock_sendmsg
  - net: Save and restore msg_namelen in sock_sendmsg
  - net: prevent rewrite of msg_name in sock_sendmsg()
  - !4399  net: dst: Optimized route gc
  - drm/atomic: Fix potential use-after-free in nonblocking commits
  - !4392 linux-4.19.y inclusion
  - !4369  mm/filemap: avoid buffered read/write race to read inconsistent data
  - net/dst: use a smaller percpu_counter batch for dst entries accounting
  - net: add a route cache full diagnostic message
  - net: check dev->gso_max_size in gso_features_check()
  - net: warn if gso_type isn't set for a GSO SKB
  - mm: fix unmap_mapping_range high bits shift bug
  - x86/alternatives: Sync core before enabling interrupts
  - mm/filemap: avoid buffered read/write race to read inconsistent data
  - !4360  net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
  - !4320  io_uring/af_unix: disable sending io_uring over sockets
  - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
  - io_uring/af_unix: disable sending io_uring over sockets


author: hongrongxuan <hongrongxuan@huawei.com> - 4.19.90-2402.5.0.0266
changelog:
  - !4601 v2  xen-netback: don't produce zero-size SKB frags
  - xen-netback: don't produce zero-size SKB frags
  - !4583  net: hns3: fix a bug and modify the hns3 driver version
  - net: hns3: update hns3 version to 24.2.1
  - net: hns3: fix tm port shapping of fibre port is incorrect after driver initialization
  - !4552 v4  CVE-2023-52340
  - !4526 v2  fs:/dcache.c: fix negative dentry flag warning in dentry_free
  - ipv6: fix kabi broken in struct dst_ops
  - ipv6: Document that max_size sysctl is deprecated
  - ipv6: remove max_size check inline with ipv4
  - !4538  fix kprobe reenter bug
  - arm64/openeuler_defconfig: add not set config to fix compiling error
  - tracing/kprobes: Do the notrace functions check without kprobes on ftrace
  - fs:/dcache.c: fix negative dentry flag warning in dentry_free


author: hongrongxuan <hongrongxuan@huawei.com> - 4.19.90-2402.6.0.0267
changelog:
  - !4701 v2  mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
  - !4684 v3  CVE-2023-52435
  - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
  - net: Fix compile warning in skb_segment()
  - net: prevent mss overflow in skb_segment()
  - !4643  f2fs: explicitly null-terminate the xattr list
  - f2fs: explicitly null-terminate the xattr list


author: hongrongxuan <hongrongxuan@huawei.com> - 4.19.90-2403.1.0.0268
changelog:
  - !4947  powerpc/64s: Fix pte update for kernel memory on radix
  - !4932  phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
  - powerpc/64s: Fix pte update for kernel memory on radix
  - !4874 v2  net: openvswitch: limit the number of recursions from action sets
  - !4920  ARM: footbridge: remove personal server platform
  - !4887  KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU
  - !4918 v3  usb: hub: Guard against accesses to uninitialized BOS descriptors
  - !4936  i2c: validate user data in compat ioctl
  - i2c: validate user data in compat ioctl
  - !4898  platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios
  - !4879  KVM: Stop looking for coalesced MMIO zones if the bus is destroyed
  - !4869  Fix CVE-2021-46941
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
  - !4904  i2c: sprd: fix reference leak when pm_runtime_get_sync fails
  - !4859  hfsplus: prevent corruption in shrinking truncate
  - !4877  i2c: Fix a potential use after free
  - ARM: footbridge: fix PCI interrupt mapping
  - !4888 v3  media: dvbdev: Fix memory leak in dvb_media_device_free()
  - usb: hub: Guard against accesses to uninitialized BOS descriptors
  - !4825  sched/membarrier: reduce the ability to hammer on sys_membarrier
  - !4882  Input: appletouch - initialize work before device registration
  - !4876  backport patch to fix CVE-2021-47077
  - !4899  net: qualcomm: rmnet: fix global oob in rmnet_policy
  - i2c: sprd: fix reference leak when pm_runtime_get_sync fails
  - !4892  Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
  - !4881  i2c: cadence: fix reference leak when pm_runtime_get_sync fails
  - net: qualcomm: rmnet: fix global oob in rmnet_policy
  - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios
  - !4865  Input: powermate - fix use-after-free in powermate_config_complete
  - !4860  apparmor: avoid crash when parsed profile name is empty
  - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
  - media: dvbdev: Fix memory leak in dvb_media_device_free()
  - KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU
  - Input: appletouch - initialize work before device registration
  - i2c: cadence: fix reference leak when pm_runtime_get_sync fails
  - KVM: Stop looking for coalesced MMIO zones if the bus is destroyed
  - i2c: Fix a potential use after free
  - ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook
  - net: openvswitch: limit the number of recursions from action sets
  - usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup
  - usb: dwc3: core: balance phy init and exit
  - usb: dwc3: core: Do core softreset when switch mode
  - Input: powermate - fix use-after-free in powermate_config_complete
  - !4856  bus: qcom: Put child node before return
  - apparmor: avoid crash when parsed profile name is empty
  - hfsplus: prevent corruption in shrinking truncate
  - bus: qcom: Put child node before return
  - !4828  Drivers: hv: vmbus: Use after free in __vmbus_open()
  - !4806 v2  media: pvrusb2: fix use after free on context disconnection
  - !4777  drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - !4819 v2  fix CVE-2020-36782
  - !4833  openvswitch: fix stack OOB read while fragmenting IPv4 packets
  - !4677  f2fs: fix to avoid dirent corruption
  - !4804  CVE-2023-52451 backport to 4.19 v2
  - openvswitch: fix stack OOB read while fragmenting IPv4 packets
  - Drivers: hv: vmbus: Use after free in __vmbus_open()
  - !4778 v3  Revert "memcg: fix a UAF problem in drain_all_stock()"
  - sched/membarrier: reduce the ability to hammer on sys_membarrier
  - i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails
  - PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter
  - !4812  parisc: Clear stale IIR value on instruction access rights trap
  - parisc: Clear stale IIR value on instruction access rights trap
  - media: pvrusb2: fix use after free on context disconnection
  - powerpc/pseries/memhp: Fix access beyond end of drmem array
  - powerpc/pseries/memhotplug: Quieten some DLPAR operations
  - !4758  binder: signal epoll threads of self-work
  - !4746  KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
  - Revert "memcg: fix a UAF problem in drain_all_stock()"
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  - !4751 [sync] PR-4623: i2c: Optimized the value setting of maxwrite limit to  fifo depth - 1
  - !4707  mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
  - !4686  mlxsw: spectrum_acl_tcam: Fix stack corruption
  - binder: signal epoll threads of self-work
  - !4710  CVE-2021-46904 for openEuler1.0
  - i2c: hisi: Add clearing tx aempty interrupt operation
  - i2c: hisi: Optimized the value setting of maxwrite limit to fifo depth - 1
  - !4671  uio: Fix use-after-free in uio_open
  - KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
  - net: hso: fix NULL-deref on disconnect regression
  - net: hso: fix null-ptr-deref during tty device unregistration
  - usb: hso: check for return value in hso_serial_common_create()
  - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
  - mlxsw: spectrum_acl_tcam: Fix stack corruption
  - f2fs: fix to avoid dirent corruption
  - uio: Fix use-after-free in uio_open


author: hongrongxuan <hongrongxuan@huawei.com> - 4.19.90-2403.2.0.0269
changelog:
  - !5133  CVE-2021-46926
  - !5136  NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
  - !5052 v3  Remove WQ_FLAG_BOOKMARK flag
  - !5140 linux-4.19.y inclusion(4.19.305..4.19.307) part3
  - dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
  - NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
  - ALSA: hda: intel-sdw-acpi: harden detection of controller
  - soundwire: intel: filter SoundWire controller device search
  - !5114  fix CVE-2023-52578
  - !5119  crypto: scomp - fix req->dst buffer overflow
  - !5101  EDAC/thunderx: Fix possible out-of-bounds string access
  - !5094  HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
  - crypto: scomp - fix req->dst buffer overflow
  - net: fix kabi check warning
  - net: Fix unwanted sign extension in netdev_stats_to_stats64()
  - net: bridge: use DEV_STATS_INC()
  - net: add atomic_long_t to net_device_stats fields
  - !5092  wifi: mac80211: fix potential key use-after-free
  - EDAC/thunderx: Fix possible out-of-bounds string access
  - !5095 linux-4.19.y inclusion(4.19.305..4.19.307) part 2
  - !5090  drm: bridge/panel: Cleanup connector on bridge detach
  - !5088  uio_hv_generic: Fix a memory leak in error handling paths
  - !4952  scsi: qedf: Add pointer checks in qedf_update_link_speed()
  - !5076 v3  CVE-2021-47074
  - netfilter: nft_compat: reject unused compat flag
  - ppp_async: limit MRU to 64K
  - inet: read sk->sk_family once in inet_recv_error()
  - bonding: remove print in bond_verify_device_path
  - af_unix: fix lockdep positive in sk_diag_dump_icons()
  - net: ipv4: fix a memleak in ip_setup_cork
  - ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
  - virtio_net: Fix Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
  - bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
  - SUNRPC: Fix a suspicious RCU usage warning
  - tcp: Add memory barrier to tcp_push()
  - vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
  - md: Whenassemble the array, consult the superblock of the freshest device
  - jbd2: correct the printing of write_flags in jbd2_write_superblock()
  - !5073  RDMA/rxe: Clear all QP fields if creation failed
  - !5077  RDMA/rxe: Return CQE error if invalid lkey was supplied
  - !5055 linux-4.19.y inclusion(4.19.305..4.19.307) part 1
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
  - wifi: mac80211: fix potential key use-after-free
  - drm: bridge/panel: Cleanup connector on bridge detach
  - uio_hv_generic: Fix a memory leak in error handling paths
  - of: unittest: Fix of_count_phandle_with_args() expected value message
  - of: unittest: Fix compile in the non-dynamic case
  - RDMA/rxe: Return CQE error if invalid lkey was supplied
  - nvme-loop: fix memory leak in nvme_loop_create_ctrl()
  - nvme-loop: don't put ctrl on nvme_init_ctrl error
  - !5060  net: fix possible store tearing in neigh_periodic_work()
  - RDMA/rxe: Clear all QP fields if creation failed
  - net: fix possible store tearing in neigh_periodic_work()
  - of: Fix double free in of_parse_phandle_with_args_map
  - pmdomain: core: Move the unused cleanup to a _sync initcall
  - tick/sched: Preserve number of idle sleeps across CPU hotplug events
  - acpi: property: Let args be NULL in __acpi_node_get_property_reference
  - tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
  - ACPI: LPIT: Avoid u32 multiplication overflow
  - audit: Send netlink ACK before setting connection in auditd_set
  - crypto: scompress - return proper error code for allocation failure
  - crypto: af_alg - Disallow multiple in-flight AIO requests
  - x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
  - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  - !5046  usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
  - sched: remove wait bookmarks
  - filemap: remove use of wait bookmarks
  - usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
  - !4929  scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
  - !4752  block: add check that partition length needs to be aligned with block size
  - !4735  blk-mq: fix IO hang from sbitmap wakeup race
  - !3864  nvme: sanitize metadata bounce buffer for reads
  - !4946  NFC: st21nfca: Fix memory leak in device probe and remove
  - !4999  CVE-2021-46984
  - !4938  crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
  - !4990  vt: fix memory overlapping when deleting chars in the buffer
  - !4978  nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
  - !5018  ethernet:enic: Fix a use after free bug in enic_hard_start_xmit
  - !4992  bnxt_en: Fix RX consumer index logic in the error path.
  - !4997  Fixed CVE-2023-52504
  - !4982  i2c: img-scb: fix reference leak when pm_runtime_get_sync fails
  - !4983  net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
  - !4995  mpam/mpam_ctrlmon: update monitor config with its parent's ctrl_val
  - !4974  arm64/mpam: set default feedback of last_cmd_status interface as null string
  - !4975  arm64/mpam: support resctrl fs to show mounting option
  - !4973  arm64/mpam: Skip updates of unrelated ctrl type
  - ethernet:enic: Fix a use after free bug in enic_hard_start_xmit
  - !4996  soundwire: stream: fix memory leak in stream config error path
  - !4817 v2  io_uring: fix overflows checks in provide buffers
  - kyber: fix kabi broken in ->bio_merge()
  - kyber: fix out of bounds access when preempted
  - x86/alternatives: Disable KASAN in apply_alternatives()
  - soundwire: stream: fix memory leak in stream config error path
  - mpam/mpam_ctrlmon: update monitor config with its parent's ctrl_val
  - bnxt_en: Fix RX consumer index logic in the error path.
  - !4969  CVE-2021-46990
  - vt: fix memory overlapping when deleting chars in the buffer
  - !4945  ieee802154: ca8210: Fix a potential UAF in ca8210_probe
  - !4944  perf/x86/lbr: Filter vsyscall addresses
  - !4967  i2c: xiic: fix reference leak when pm_runtime_get_sync fails
  - !4970  binder: fix async_free_space accounting for empty parcels
  - !4919 v2  HID: usbhid: fix info leak in hid_submit_ctrl
  - !4980  net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
  - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
  - i2c: img-scb: fix reference leak when pm_runtime_get_sync fails
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
  - !4949  CVE-2021-47024
  - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
  - arm64/mpam: support resctrl fs to show mounting option
  - arm64/mpam: set default feedback of last_cmd_status interface as null string
  - arm64/mpam: Skip updates of unrelated ctrl type
  - binder: fix async_free_space accounting for empty parcels
  - powerpc/64s: Fix crashes when toggling entry flush barrier
  - i2c: xiic: fix reference leak when pm_runtime_get_sync fails
  - scsi: qedf: Add pointer checks in qedf_update_link_speed()
  - vsock/virtio: free queued packets when closing socket
  - vsock/virtio: discard packets only when socket is really closed
  - virtio_vsock: Fix race condition in virtio_transport_recv_pkt
  - NFC: st21nfca: Fix memory leak in device probe and remove
  - ieee802154: ca8210: Fix a potential UAF in ca8210_probe
  - perf/x86/lbr: Filter vsyscall addresses
  - crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
  - scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
  - HID: usbhid: fix info leak in hid_submit_ctrl
  - io_uring: fix overflows checks in provide buffers
  - block: add check that partition length needs to be aligned with block size
  - blk-mq: fix IO hang from sbitmap wakeup race
  - nvme: sanitize metadata bounce buffer for reads


author: hongrongxuan <hongrongxuan@huawei.com> - 4.19.90-2403.3.0.0270
changelog:
  - !5306  FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - !5347  s390/ptrace: handle setting of fpc register correctly
  - !5309  drm/msm/dpu: Add mutex lock in control vblank irq
  - s390/ptrace: handle setting of fpc register correctly
  - !5267  llc: call sock_orphan() at release time
  - drm/msm/dpu: Add mutex lock in control vblank irq
  - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  - !5241  powerpc/lib: Validate size for vector operations
  - !5246  ceph: fix deadlock or deadcode of misusing dget()
  - !5268  crypto: algif_aead - fix uninitialized ctx->init
  - crypto: algif_aead - fix uninitialized ctx->init
  - llc: call sock_orphan() at release time
  - !5220  powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  - !5196  drm: Don't unref the same fb many times by mistake due to deadlock handling
  - ceph: fix deadlock or deadcode of misusing dget()
  - powerpc/lib: Validate size for vector operations
  - !5210 v2  Fix CVE-2022-48629 and CVE-2022-48630
  - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  - !5175  arm64/mpam: Fix use-after-free when deleting resource groups
  - !5163  nfc: nci: assert requested protocol is valid
  - !5172  CVE-2023-52502 for openEuler-1.0-LTS
  - crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ
  - crypto: qcom-rng - ensure buffer for generate is completely filled
  - drm: Don't unref the same fb many times by mistake due to deadlock handling
  - !5177  net: nfc: llcp: Add lock when modifying device list
  - !5157  RDMA/srp: Do not call scsi_done() from srp_abort()
  - net: nfc: llcp: Add lock when modifying device list
  - arm64/mpam: Fix use-after-free when deleting resource groups
  - arm64/mpam: remove kernfs_get() calls() and add kernfs_put() calls to prevent refcount leak
  - !5142  arm64/mpam: Expand the monitor number of the resctrl root
  - net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  - nfc: constify several pointers to u8, char and sk_buff
  - nfc: nci: assert requested protocol is valid
  - RDMA/srp: Do not call scsi_done() from srp_abort()
  - arm64/mpam: Expand the monitor number of the resctrl root


author: hongrongxuan <hongrongxuan@huawei.com> - 4.19.90-2403.4.0.0271
changelog:
  - !5539  spi: spi-fsl-dspi: Fix a resource leak in an error handling path
  - !5542  round lts patches
  - !5520  scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan()
  - l2tp: pass correct message length to ip6_append_data
  - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
  - spi: spi-fsl-dspi: Fix a resource leak in an error handling path
  - !5514 CVE-2021-47110
  - !5497  llc: Drop support for ETH_P_TR_802_2.
  - !5498  llc: make llc_ui_sendmsg() more robust against bonding changes
  - !5490  tcp: add sanity checks to rx zerocopy
  - scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan()
  - x86/kvm: Do not try to disable kvmclock if it was not enabled
  - x86/kvm: Disable kvmclock on all CPUs on shutdown
  - !5502  pstore/ram: Fix crash when setting number of cpus to an odd number
  - !5477  Fixed CVE-2021-47112
  - pstore/ram: Fix crash when setting number of cpus to an odd number
  - llc: make llc_ui_sendmsg() more robust against bonding changes
  - llc: Drop support for ETH_P_TR_802_2.
  - tcp: add sanity checks to rx zerocopy
  - !5479  jfs: fix cve-2023-52600
  - !5478  jfs: fix array-index-out-of-bounds in diNewExt
  - !5485  nfsd: fix use-after-free due to delegation race
  - nfsd: fix use-after-free due to delegation race
  - !5281  printk: avoid deadlock in panic
  - jfs: fix uaf in jfs_evict_inode
  - JFS: fix memleak in jfs_mount
  - jfs: fix array-index-out-of-bounds in diNewExt
  - x86/kvm: Teardown PV features on boot CPU as well
  - !5465  wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - !5361  btrfs: abort in rename_exchange if we fail to insert the second ref
  - !5254  tomoyo: fix UAF write bug in tomoyo_write_control()
  - !5321  UBSAN: array-index-out-of-bounds in dtSplitRoot
  - !5455  CVE-2021-47114
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  - !5320  jfs: fix slab-out-of-bounds Read in dtSearch
  - ocfs2: issue zeroout to EOF blocks
  - ocfs2: fix zero out valid data
  - ocfs2: fix data corruption by fallocate
  - !5374  hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - !5418 [sync] PR-5317:  KVM: s390: fix setting of fpc register
  - !5272  net/smc: fix illegal rmb_desc access in SMC-D connection dump
  - !5274  phonet/pep: refuse to enable an unbound pipe
  - !5359  CVE-2021-47121 and CVE-2021-47122
  - KVM: s390: fix setting of fpc register
  - !5358 v5  CVE-2023-52595
  - !5336  binder: fix race between mmput() and do_exit()
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  - btrfs: abort in rename_exchange if we fail to insert the second ref
  - net: caif: fix memory leak in caif_device_notify
  - net: caif: fix memory leak in cfusbl_device_notify
  - net: caif: add proper error handling
  - net: caif: added cfserl_release function
  - rt2x00: Fix kabi breakage in struct rt2x00lib_ops
  - wifi: rt2x00: restart beacon queue when hardware reset
  - rt2x00: clear up IV's on key removal
  - rt2x00: clear IV's on start to fix AP mode regression
  - rt2800: add pre_reset_hw callback
  - rt2800: do not nullify initialization vector data
  - binder: fix race between mmput() and do_exit()
  - UBSAN: array-index-out-of-bounds in dtSplitRoot
  - jfs: fix slab-out-of-bounds Read in dtSearch
  - printk: avoid deadlock in panic
  - phonet/pep: refuse to enable an unbound pipe
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump
  - tomoyo: fix UAF write bug in tomoyo_write_control()


author: hongrongxuan <hongrongxuan@huawei.com> - 4.19.90-2404.1.0.0272
changelog:
  - !5874  scsi: hisi_sas: Update disk locked timeout to 7 seconds
  - scsi: hisi_sas: Update disk locked timeout to 7 seconds
  - !5841  fixup CVE-2024-26751
  - !5834  CVE-2021-47144
  - ARM: ep93xx: Add terminator to gpiod_lookup_table
  - drm/amd/amdgpu: fix refcount leak
  - !5796  netfilter: nft_limit: reject configurations that cause integer overflow
  - netfilter: nft_limit: reject configurations that cause integer overflow
  - !5755  sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - !5767 v5  net: fec: fix the potential memory leak in fec_enet_init()
  - !5718  CVE-2024-26654
  - net: fec: fix the potential memory leak in fec_enet_init()
  - !5722  btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  - !5727  fix CVE-2021-47101
  - !5531  ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  - !5715  net: hns3: updates 2024.04.02
  - !5710 v2  ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
  - asix: fix wrong return value in asix_check_host_enable()
  - asix: fix uninit-value in asix_mdio_read()
  - net: asix: fix uninit value bugs
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  - !5700  sr9800: Add check for usbnet_get_endpoints
  - !5680  USB: usbfs: Don't WARN about excessively large memory allocations
  - !5679  fix CVE-2023-52587
  - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  - ALSA: aica: Fix a long-time build breakage
  - !5713 v2  tipc: wait and exit until all work queues are done
  - net: hns3: update hns3 version to 24.3.1
  - net: hns3: fix port vlan filter not disabled problem in dynamic vlan mode
  - !5696  NFS: Fix an Oopsable condition in __nfs_pageio_add_request()
  - tipc: wait and exit until all work queues are done
  - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
  - !5702  ext4: Validate inode pa before using preallocation blocks
  - !5694  tipc: skb_linearize the head skb when reassembling msgs
  - ext4: Validate inode pa before using preallocation blocks
  - !5674  mac80211: fix locking in ieee80211_start_ap error path
  - !5672  arm64/mpam_ctrlmon: Update ctrl group config with rdtgrp's partid
  - sr9800: Add check for usbnet_get_endpoints
  - !5528  btrfs: do not BUG_ON in link_to_fixup_dir
  - NFS: Fix an Oopsable condition in __nfs_pageio_add_request()
  - tipc: skb_linearize the head skb when reassembling msgs
  - !5522  md/raid5: fix atomicity violation in raid5_cache_count
  - USB: usbfs: Don't WARN about excessively large memory allocations
  - IB/ipoib: Fix mcast list locking
  - RDMA/IPoIB: Fix error code return in ipoib_mcast_join
  - mac80211: fix locking in ieee80211_start_ap error path
  - arm64/mpam: Allocate new partid for the created ctrl group
  - arm64/mpam_ctrlmon: Update ctrl group config with rdtgrp's partid
  - !5581  CVE-2023-52622
  - !5658 v2  CVE-2021-47131
  - !5645 [sync] PR-5493:  arm64/mpam: Fix repeated enabling in mpam_enable()
  - !5559  fix CVE-2021-47173
  - !5575  net: dsa: fix a crash if ->get_sset_count() fails
  - net/tls: Use RCU API to access tls_ctx->netdev
  - net/tls: Remove the context from the list in tls_device_down
  - tls: Fix context leak on tls_device_down
  - net/tls: Resolve KABI break when backport bugfix of CVE-2021-47131
  - net/tls: Fix use-after-free after the TLS device goes down and up
  - net/tls: Replace TLS_RX_SYNC_RUNNING with RCU
  - !5625  i2c: i801: Don't generate an interrupt on bus reset
  - !5517  dm: revert partial fix for redundant bio-based IO accounting
  - arm64/mpam: Fix repeated enabling in mpam_enable()
  - !5481  jfs: fix array-index-out-of-bounds in dbAdjTree
  - !5572  mld: fix panic in mld_newpack()
  - !5565  tracing: Ensure visibility when inserting an element into tracing_map
  - !5571 v2  mm/mlock: return EINVAL for illegal user memory range in mlock
  - i2c: i801: Don't generate an interrupt on bus reset
  - !5587  Fix CVE-2021-47171
  - !5579  mm: ksm: fix use-after-free kasan report in ksm_might_need_to_copy
  - !5573  Fix CVE-2021-47160
  - !5564  serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'
  - !5560  drm/amdgpu: Fix a use-after-free
  - net: usb: fix possible use-after-free in smsc75xx_bind
  - net: usb: fix memory leak in smsc75xx_bind
  - ext4: avoid online resizing failures due to oversized flex bg
  - ext4: unify the type of flexbg_size to unsigned int
  - ext4: remove unnecessary check from alloc_flex_gd()
  - mm: ksm: fix use-after-free kasan report in ksm_might_need_to_copy
  - !5558  net: fujitsu: fix potential null-ptr-deref
  - !5556  NFC: nci: fix memory leak in nci_allocate_device
  - net: dsa: fix a crash if ->get_sset_count() fails
  - net: dsa: mt7530: fix VLAN traffic leaks again
  - net: dsa: mt7530: fix VLAN traffic leaks
  - mld: fix panic in mld_newpack()
  - mm/mlock: return EINVAL for illegal user memory range in mlock
  - tracing: Ensure visibility when inserting an element into tracing_map
  - serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'
  - !5552  net/smc: remove device from smcd_dev_list after failed device_add()
  - !5290  crypto: algif_aead - Only wake up when ctx->more is zero
  - !5446  keys: safe concurrent user->{session,uid}_keyring access
  - drm/amdgpu: Fix a use-after-free
  - !5550  pciehp: clear p_slot->work.data after powering off a slot
  - usb: misc: fix improper handling of refcount in uss720_probe()
  - misc/uss720: fix memory leak in uss720_probe
  - !5515  netfilter: nf_tables: disallow timeout for anonymous sets
  - !5538  netfilter: nf_tables: disallow anonymous set with timeout flag
  - net: fujitsu: fix potential null-ptr-deref
  - NFC: nci: fix memory leak in nci_allocate_device
  - net/smc: remove device from smcd_dev_list after failed device_add()
  - pciehp: clear p_slot->work.data after powering off a slot
  - netfilter: nf_tables: disallow anonymous set with timeout flag
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  - btrfs: do not BUG_ON in link_to_fixup_dir
  - md/raid5: fix atomicity violation in raid5_cache_count
  - dm: revert partial fix for redundant bio-based IO accounting
  - netfilter: nf_tables: disallow timeout for anonymous sets
  - jfs: fix array-index-out-of-bounds in dbAdjTree
  - keys: safe concurrent user->{session,uid}_keyring access
  - crypto: af_alg - Work around empty control messages without MSG_MORE
  - crypto: af_alg - Fix regression on empty requests
  - crypto: algif_aead - Only wake up when ctx->more is zero


author: chenyi <chenyi211@huawei.com> - 4.19.90-2404.2.0.0273
changelog:
  - !6231 v2  drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put()
  - !6083  can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  - !6160  net/sched: act_mirred: don't override retval if we already lost the skb
  - drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put()
  - !6152  Fix CVE-2024-26812
  - !6139  iavf: free q_vectors before queues in iavf_disable_vf
  - !6164  CVE-2021-47194
  - !6123  xen/events: close evtchn after mapping cleanup
  - cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
  - net/sched: act_mirred: don't override retval if we already lost the skb
  - vfio/pci: Create persistent INTx handler
  - vfio: Introduce interface to flush virqfd inject workqueue
  - !6053  net: ip_tunnel: prevent perpetual headroom growth
  - !6002  KVM: s390: vsie: fix race during shadow creation
  - iavf: free q_vectors before queues in iavf_disable_vf
  - !6102  Fix CVE-2024-27437
  - !6070  Fix CVE-2024-26686
  - !6049  wifi: mac80211: fix race condition on enabling fast-xmit
  - !5916  ext4: fix double-free of blocks due to wrong extents moved_len
  - xen/events: close evtchn after mapping cleanup
  - !6099  vfio/pci: Lock external INTx masking ops
  - !6032  gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  - !5899  dm-crypt: don't modify the data when using authenticated encryption
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ
  - genirq: Add IRQF_NO_AUTOEN for request_irq/nmi()
  - vfio/pci: Lock external INTx masking ops
  - !6042  nilfs2: fix data corruption in dsync block recovery for small block sizes
  - !6030  Fix CVE-2024-26685
  - !6015  btrfs: don't drop extent_map for free space inode on write error
  - !5963  btrfs: dev-replace: properly validate device names
  - can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
  - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand()
  - fs/proc: do_task_stat: use __for_each_thread()
  - exit: Use the correct exit_code in /proc/<pid>/stat
  - net: ip_tunnel: prevent perpetual headroom growth
  - wifi: mac80211: fix race condition on enabling fast-xmit
  - !5999  mm/swap: fix race when skipping swapcache
  - nilfs2: fix data corruption in dsync block recovery for small block sizes
  - !6019  net/sched: act_mirred: use the backlog for mirred ingress
  - !6010  PM / devfreq: Synchronize devfreq_monitor_[start/stop
  - !5846  ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  - !5994  ipv6: sr: fix possible use-after-free and null-ptr-deref
  - nilfs2: fix potential bug in end_buffer_async_write
  - nilfs2: fix buffer corruption due to concurrent device reads
  - !5951  RDMA/qedr: Fix qedr_create_user_qp error flow
  - net/sched: act_mirred: use the backlog for mirred ingress
  - btrfs: don't drop extent_map for free space inode on write error
  - PM / devfreq: Synchronize devfreq_monitor_[start/stop]
  - !5961  fbdev: savage: Error out if pixclock equals zero
  - KVM: s390: vsie: fix race during shadow creation
  - mm/swap: fix race when skipping swapcache
  - ipv6: sr: fix possible use-after-free and null-ptr-deref
  - !5875 v3  CVE-2024-26771
  - !5926  RDMA/srpt: Support specifying the srpt_service_guid parameter
  - btrfs: dev-replace: properly validate device names
  - fbdev: savage: Error out if pixclock equals zero
  - !5778  ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  - RDMA/qedr: Fix qedr_create_user_qp error flow
  - !5830  fbdev: sis: Error out if pixclock equals zero
  - RDMA/srpt: Support specifying the srpt_service_guid parameter
  - ext4: fix double-free of blocks due to wrong extents moved_len
  - dm-crypt: don't modify the data when using authenticated encryption
  - !5807  nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  - dmaengine: ti: edma: Fix error return code in edma_probe()
  - dmaengine: ti: edma: add missed operations
  - dmaengine: ti: edma: fix missed failure handling
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  - fbdev: sis: Error out if pixclock equals zero
  - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2404.3.0.0274
changelog:
  - !6313  fixup CVE-2024-26908
  - !6447  can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock
  - !6309 v5  ima: Avoid blocking in RCU read-side critical section
  - !6405  wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - !6466  bpf: Fix hashtab overflow check on 32-bit arches
  - !6396  tracing/trigger: Fix to return error if failed to alloc snapshot
  - !6278  Bluetooth: Avoid potential use-after-free in hci_error_reset
  - bpf: Fix hashtab overflow check on 32-bit arches
  - can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock
  - !6203  ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  - !6292  aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  - !6301 v2  tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  - !6266  usb: typec: tipd: Remove WARN_ON in tps6598x_block_read
  - tracing/trigger: Fix to return error if failed to alloc snapshot
  - !6290  CVE-2024-24861
  - x86/xen: Add some null pointer checking to smp.c
  - ima: Avoid blocking in RCU read-side critical section
  - !6269  scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
  - !6276  wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
  - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
  - !6277  gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
  - !6275  arp: Prevent overflow in arp_req_get().
  - !6280  scsi: advansys: Fix kernel pointer leak
  - !6177  arm64/mpam: Not allowed setting 0 to cache portion bit mask
  - !6176  arm64/mpam: return EOPNOTSUPP when changing rmid of monitor group or resource group with monitor
  - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  - media: xc4000: Fix atomicity violation in xc4000_get_frequency
  - !6075  Fix CVE-2024-26764
  - scsi: advansys: Fix kernel pointer leak
  - Bluetooth: Avoid potential use-after-free in hci_error_reset
  - gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
  - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
  - arp: Prevent overflow in arp_req_get().
  - !6084  netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  - scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
  - usb: typec: tipd: Remove WARN_ON in tps6598x_block_read
  - !6246  ubi: Check for too small LEB size in VTBL code
  - ubi: Check for too small LEB size in VTBL code
  - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  - arm64/mpam: Not allowed setting 0 to cache portion bit mask
  - arm64/mpam: return EOPNOTSUPP when changing rmid of monitor group or resource group with monitor
  - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
  - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio


author: chenyi <chenyi211@huawei.com> - 4.19.90-2405.1.0.0275
changelog:
  - !6858  CVE-2024-26883
  - !6836  fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - !6845  erofs: fix pcluster use-after-free on UP platforms
  - !6827  fat: fix uninitialized field in nostale filehandles
  - !6807  CVE-2024-26923
  - !6847  ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
  - bpf: Fix stackmap overflow check on 32-bit arches
  - bpf: Check for integer overflow when using roundup_pow_of_two()
  - !6758  CVE-2022-48664
  - ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
  - erofs: fix pcluster use-after-free on UP platforms
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  - !6795  rtmutex: Add acquire semantics for rtmutex lock acquisition slow path
  - fat: fix uninitialized field in nostale filehandles
  - !6777  tun: Fix xdp_rxq_info's queue_index when detaching
  - !6803  scsi: target: core: Add TMF to tmr_list handling
  - af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
  - af_unix: Fix garbage collector racing against connect()
  - scsi: target: core: Add TMF to tmr_list handling
  - !6705  quota: fix CVE-2024-26878
  - rtmutex: Add acquire semantics for rtmutex lock acquisition slow path
  - tun: Fix xdp_rxq_info's queue_index when detaching
  - !6674  cifs: fix underflow in parse_server_interfaces()
  - !6494 v2  oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup
  - !6745  PCI/IOV: Improve performance of creating VFs concurrently
  - !6754  binder: check offset alignment in binder_get_object()
  - !6746 v3  openEuler-1.0-LTS: bugfix for mm
  - !6716  CVE-2024-26922
  - btrfs: fix hang during unmount when stopping a space reclaim worker
  - Btrfs: fix crash during unmount due to race with delayed inode workers
  - binder: check offset alignment in binder_get_object()
  - !6652  geneve: make sure to pull inner header in geneve_rx()
  - mm/madvise: fix potential pte_unmap_unlock pte error
  - PCI/IOV: Improve performance of creating VFs concurrently
  - !6664  drm/bridge: adv7511: fix crash on irq during probe
  - !6653  net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
  - !6510  cachefiles: fix memory leak in cachefiles_add_cache()
  - drm/amdgpu: validate the parameters of bo mapping operations more clearly
  - amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
  - drm/amdgpu: restrict bo mapping within gpu address limits
  - drm/amdgpu: check alignment on CPU page for bo map
  - quota: Fix potential NULL pointer dereference
  - quota: check time limit when back out space/inode change
  - quota: code cleanup for __dquot_alloc_space()
  - !6662  sched/rt: Disallow writing invalid values to sched_rt_period_us
  - !6661  sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
  - !6659  sched/rt: Fix sysctl_sched_rr_timeslice intial value
  - !6578  drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  - !6641  CVE-2024-26863
  - cifs: fix underflow in parse_server_interfaces()
  - !6646  fix race between rebuild scheduler domains and hotplug work
  - drm/bridge: adv7511: fix crash on irq during probe
  - sched/rt: Disallow writing invalid values to sched_rt_period_us
  - sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
  - sched/rt: Fix sysctl_sched_rr_timeslice intial value
  - !6642 v3  x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
  - geneve: make sure to pull inner header in geneve_rx()
  - !6621  amdkfd: use calloc instead of kzalloc to avoid integer overflow
  - cpuset: fix race between rebuild scheduler domains and hotplug work
  - !6617  net/bnx2x: Prevent access to a freed page in page_pool
  - !6611  net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  - x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails
  - hsr: Fix uninit-value access in hsr_get_node()
  - net: hsr: fix placement of logical operator in a multi-line statement
  - !6397  btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
  - !6616  drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
  - amdkfd: use calloc instead of kzalloc to avoid integer overflow
  - net/bnx2x: Prevent access to a freed page in page_pool
  - drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
  - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  - !6525 v2  CVE-2024-24860 bugfix
  - !6478  do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  - !6582  ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  - !6577  media: rc: bpf attach/detach requires write permission
  - !6560  IB/hfi1: Fix a memleak in init_credit_return
  - !6420  tty: fix read of tty->pgrp outside of ctrl_lock
  - !6436  dm: call the resume method on internal suspend
  - !6562  nfc: nci: free rx_data_reassembly skb on NCI device cleanup
  - !6481  CVE-2024-26875
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  - media: rc: bpf attach/detach requires write permission
  - !6495  RDMA/srpt: Do not register event handler until srpt device is fully setup
  - !6457  CVE-2024-26813
  - nfc: nci: free rx_data_reassembly skb on NCI device cleanup
  - IB/hfi1: Fix a memleak in init_credit_return
  - !6517  scsi: lpfc: Fix link down processing to address NULL pointer dereference
  - !6521  netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - !6454  CVE-2021-47182
  - Bluetooth: Fix atomicity violation in {min,max}_key_size_set
  - Bluetooth: Move {min,max}_key_size debugfs into hci_debugfs_create_le
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  - scsi: lpfc: Fix link down processing to address NULL pointer dereference
  - cachefiles: fix memory leak in cachefiles_add_cache()
  - RDMA/srpt: Do not register event handler until srpt device is fully setup
  - mm: oom_kill: fix KABI broken by "oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup"
  - oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup
  - sched: Allocate a new task_struct_resvd object for fork task
  - media: pvrusb2: fix uaf in pvr2_context_set_notify
  - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  - vfio/platform: Create persistent IRQ handlers
  - vfio/platform: Disable virqfds on cleanup
  - scsi: core: Fix scsi_mode_sense() buffer length handling
  - scsi: core: Reshuffle response handling in scsi_mode_sense()
  - scsi: core: Fixup calling convention for scsi_mode_sense()
  - dm: call the resume method on internal suspend
  - tty: fix read of tty->pgrp outside of ctrl_lock
  - btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve


author: chenyi <chenyi211@huawei.com> - 4.19.90-2405.3.0.0276
changelog:
  - !7194  s390/dasd: fix double module refcount decrement
  - !7059  nilfs2: prevent kernel bug at submit_bh_wbc()
  - !7163 v2  usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
  - !7104  KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - !7203  NTB: fix possible name leak in ntb_register_device()
  - NTB: fix possible name leak in ntb_register_device()
  - s390/dasd: fix double module refcount decrement
  - !7158 v2  Squashfs: check the inode number is not the invalid value of zero
  - !7181  nfs: fix UAF in direct writes
  - !7091  nouveau: lock the client object tree.
  - !7120 v2  clk: zynq: Prevent null pointer dereference caused by kmalloc failure
  - !7089  nilfs2: fix failure to detect DAT corruption in btree and direct mappings
  - !7151 v2  scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - nfs: fix UAF in direct writes
  - !7033  Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
  - !7079  nvmet: fix a use-after-free
  - usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
  - !7140  media: usbtv: Remove useless locks in usbtv_video_free()
  - Squashfs: check the inode number is not the invalid value of zero
  - scsi: sd: Fix sd_do_mode_sense() buffer length handling
  - !7137 v2  SUNRPC: fix a memleak in gss_import_v2_context
  - !7138  SUNRPC: fix some memleaks in gssx_dec_option_array
  - !7100  netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  - !7095  CVE-2024-27020
  - media: usbtv: Remove useless locks in usbtv_video_free()
  - SUNRPC: fix some memleaks in gssx_dec_option_array
  - SUNRPC: fix a memleak in gss_import_v2_context
  - !7114 v2  backport patch for thp deferred list for 4.19
  - !7034  fix CVE-2024-27001 for 4.19
  - !7032  clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
  - !7115  drm/radeon: add a force flush to delay work when radeon
  - !7055  scsi: qla2xxx: Fix command flush on cable pull
  - !7109  fix CVE-2024-26960
  - clk: zynq: Prevent null pointer dereference caused by kmalloc failure
  - !6260  packet: move from strlcpy with unused retval to strscpy
  - drm/radeon: add a force flush to delay work when radeon
  - THP: avoid lock when check whether THP is in deferred list
  - mm/mmu_gather: limit free batch count and add schedule point in tlb_batch_pages_flush
  - mm, thp: do not queue fully unmapped pages for deferred split
  - !7046  USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - mm: swap: fix race between free_swap_and_cache() and swapoff()
  - mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache()
  - !7053  CVE-2024-27024
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  - !6970  ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
  - !6995 v2  net/mlx5e: Prevent deadlock while disabling aRFS
  - !7038  i40e: Fix NULL ptr dereference on VSI filter sync
  - !7037  media: v4l2-tpg: fix some memleaks in tpg_alloc
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  - netfilter: nf_tables: __nft_expr_type_get() selects specific family type
  - nouveau: lock the client object tree.
  - nilfs2: fix failure to detect DAT corruption in btree and direct mappings
  - !6992  media: edia: dvbdev: fix a use-after-free
  - nvmet: fix a use-after-free
  - !7045 v2  b43: fix CVE-2023-52644
  - !7017 v2  net: ath9k: fix CVE-2024-26897
  - nilfs2: prevent kernel bug at submit_bh_wbc()
  - !7016 v3  Fix CVE-2022-48693
  - !7012  clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
  - scsi: qla2xxx: Fix command flush on cable pull
  - net/rds: fix possible cp null dereference
  - net/rds: fix WARNING in rds_conn_connect_if_down
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  - !6991  mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  - b43: dma: Fix use true/false for bool type variable
  - !7005  media: ttpci: fix two memleaks in budget_av_attach
  - !7014  nilfs2: fix OOB in nilfs_set_de_type
  - !7001  fix CVE-2024-27010
  - i40e: Fix NULL ptr dereference on VSI filter sync
  - media: v4l2-tpg: fix some memleaks in tpg_alloc
  - !6880  media: go7007: fix a memleak in go7007_load_encoder
  - comedi: vmk80xx: fix incomplete endpoint checking
  - Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
  - clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
  - !6984  clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - !6893  cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
  - !6958  netfilter: nf_tables: fix memleak in map from abort path
  - !6820  s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup
  - !6940  drm: nv04: Fix out of bounds access
  - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
  - ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()
  - soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs
  - soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe
  - nilfs2: fix OOB in nilfs_set_de_type
  - !6968  CVE-2024-26974
  - clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
  - !6976  nfp: flower: handle acti_netdevs allocation failure
  - media: ttpci: fix two memleaks in budget_av_attach
  - !6944  USB: core: Fix deadlock in usb_deauthorize_interface()
  - net/sched: fix kabi change in struct Qdisc
  - net/sched: Fix mirred deadlock on device recursion
  - !6870  scsi: mpt3sas: Fix use-after-free warning
  - net/mlx5e: Prevent deadlock while disabling aRFS
  - media: edia: dvbdev: fix a use-after-free
  - !6966  speakup: Avoid crash on very long word
  - !6963 v2  CVE-2024-27000
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del
  - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  - !6942 v2  ima: fix deadlock when traversing "ima_default_rules".
  - !6951 v2  spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
  - nfp: flower: handle acti_netdevs allocation failure
  - ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
  - crypto: qat - resolve race condition during AER recovery
  - crypto: qat - fix double free during reset
  - !6881 v4  CVE-2024-26846
  - !6894  tun: limit printing rate when illegal packet received by tun dev
  - speakup: Avoid crash on very long word
  - serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
  - serial: mxs-auart: add spinlock around changing cts state
  - serial: core: Provide port lock wrappers
  - !6883  Bluetooth: Fix TOCTOU in HCI debugfs implementation
  - !6856  media: dvb-frontends: avoid stack overflow warnings with clang
  - netfilter: nf_tables: fix memleak in map from abort path
  - spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
  - !6839  CVE-2023-52650
  - !6869 v2  media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
  - !6867 v2  nouveau: fix instmem race condition around ptr stores
  - USB: core: Fix deadlock in usb_deauthorize_interface()
  - !6852  serial/pmac_zilog: Remove flawed mitigation for rx irq flood
  - ima: fix deadlock when traversing "ima_default_rules".
  - drm: nv04: Fix out of bounds access
  - tun: limit printing rate when illegal packet received by tun dev
  - cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
  - Bluetooth: Fix TOCTOU in HCI debugfs implementation
  - nvme-fc: do not wait in vain when unloading module
  - nvme-fc: remove err_work work item
  - media: go7007: fix a memleak in go7007_load_encoder
  - scsi: mpt3sas: Fix use-after-free warning
  - media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
  - nouveau: fix instmem race condition around ptr stores
  - media: dvb-frontends: avoid stack overflow warnings with clang
  - serial/pmac_zilog: Remove flawed mitigation for rx irq flood
  - drm/tegra: dsi: Add missing check for of_find_device_by_node
  - s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup
  - packet: move from strlcpy with unused retval to strscpy


author: hongrongxuan <hongrongxuan@huawei.com> - 4.19.90-2405.4.0.0277
changelog:
  - !7694  Bluetooth: af_bluetooth: Fix deadlock
  - !7701  ext4: fix corruption during on-line resize
  - !7676  sched/all: Change all BUG_ON() instances in the scheduler to WARN_ON_ONCE()
  - ext4: fix corruption during on-line resize
  - Bluetooth: af_bluetooth: Fix deadlock
  - !7573  pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - sched/all: Change all BUG_ON() instances in the scheduler to WARN_ON_ONCE()
  - !7547  btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - !7586  powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  - !7477  firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  - !7483  Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  - firewire: nosy: ensure user_length is taken into account when fetching packet contents
  - !7425  net: gtp: Fix Use-After-Free in gtp_dellink
  - !7434  net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - net: gtp: Fix Use-After-Free in gtp_dellink
  - !7228  s390/zcrypt: fix reference counting on zcrypt card objects
  - !7193  CVE-2024-26921
  - !7096  fix CVE-2024-26865
  - s390/zcrypt: fix reference counting on zcrypt card objects
  - sk_buff: Fix KABI break for the modification of struct sk_buff
  - inet: inet_defrag: prevent sk release while still in use
  - inet: frags: re-introduce skb coalescing for local delivery
  - net: Fix KABI break for introducing is_skb_wmem()
  - skb_expand_head() adjust skb->truesize incorrectly
  - skbuff: introduce skb_expand_head()
  - tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
  - tcp: Clean up kernel listener's reqsk in inet_twsk_purge()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2405.5.0.0278
changelog:
  - !8066  drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
  - !8038  CVE-2023-52817
  - !8106  usb: dwc3: ep0: fix NULL pointer exception
  - !8059  soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  - !8017  perf/core: Bail out early if the request AUX area is out of bound
  - !8064  isdn: mISDN: netjet: Fix crash in nj_probe:
  - !8049  xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  - usb: dwc3: ep0: fix NULL pointer exception
  - !8055  drm/client: Fully protect modes[
  - !8000 v2  net/tls: Fix flipped sign in tls_err_abort() calls
  - !8032  netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
  - isdn: mISDN: netjet: Fix crash in nj_probe:
  - !8056  scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()
  - !7999  HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  - soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  - scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()
  - drm/client: Fully protect modes[] with dev->mode_config.mutex
  - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  - !7817  netfilter: nft_flow_offload: reset dst in route object after setting up flow
  - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
  - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  - !7965  nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
  - !7951  sched/rt: Fix rt_runtime leaks with cpu hotplug and RT_RUNTIME_SHARE
  - perf/core: Bail out early if the request AUX area is out of bound
  - !7981  Fix CVE-2021-47455
  - !7901  f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances
  - !7700  scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - !7682  dm snapshot: fix lockup in dm_exception_table_exit
  - !7867  media: bttv: fix use after free error due to btv->timeout timer
  - !7421  x86/CPU/AMD: Update the Zenbleed microcode revisions
  - !7415  cpu/SMT: Make SMT control more robust against enumeration failures
  - !7451 v2  ip: Treat IPv4 segment's lowest address as unicast
  - !7393 v2  scsi: sr: Do not leak information in ioctl
  - !7971  fbmon: prevent division by zero in fb_videomode_from_videomode()
  - net/tls: Fix flipped sign in tls_err_abort() calls
  - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  - !7963  ipv6: Fix infinite recursion in fib6_dump_done().
  - !7979  drm/radeon: fix a possible null pointer dereference
  - ptp: fix code indentation issues
  - ptp: Fix possible memory leak in ptp_clock_register()
  - drm/radeon: fix a possible null pointer dereference
  - fbmon: prevent division by zero in fb_videomode_from_videomode()
  - !7944 v2  netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
  - ipv6: Fix infinite recursion in fib6_dump_done().
  - sched/rt: Fix rt_runtime leaks with cpu hotplug and RT_RUNTIME_SHARE
  - netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  - !7811  Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
  - !7892  CVE-2023-52868
  - !7910  hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
  - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
  - !7851  netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
  - f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances
  - thermal: core: prevent potential string overflow
  - !7854  net/mlx5e: fix a double-free in arfs_create_groups
  - !7794 v2  Fix CVE-2023-52656
  - media: bttv: fix use after free error due to btv->timeout timer
  - !7840  netrom: Fix a data-race around sysctl_netrom_transport_timeout
  - net/mlx5e: fix a double-free in arfs_create_groups
  - netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
  - !7770  drm/amd/pm: fix a double-free in si_dpm_init
  - netrom: Fix a data-race around sysctl_netrom_transport_timeout
  - !7589  irqchip/gic-v3-its: Prevent double free on error
  - !7713  CVE-2024-35936
  - !7751  Fix CVE-2023-52698
  - netfilter: nft_flow_offload: reset dst in route object after setting up flow
  - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
  - io_uring: drop any code related to SCM_RIGHTS
  - io_uring/unix: drop usage of io_uring socket
  - !7742  netrom: Fix data-races around sysctl_net_busy_read
  - !7748  drm/radeon: possible buffer overflow
  - drm/amd/pm: fix a double-free in si_dpm_init
  - calipso: fix memory leak in netlbl_calipso_add_pass()
  - netlabel: remove unused parameter in netlbl_netlink_auditinfo()
  - net: netlabel: Fix kerneldoc warnings
  - drm/radeon: possible buffer overflow
  - netrom: Fix data-races around sysctl_net_busy_read
  - !7669  btrfs: send: handle path ref underflow in header iterate_inode_ref()
  - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
  - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
  - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  - dm snapshot: fix lockup in dm_exception_table_exit
  - btrfs: send: handle path ref underflow in header iterate_inode_ref()
  - irqchip/gic-v3-its: Prevent double free on error
  - ip: Treat IPv4 segment's lowest address as unicast
  - x86/CPU/AMD: Update the Zenbleed microcode revisions
  - cpu/SMT: Make SMT control more robust against enumeration failures
  - scsi: sr: Do not leak information in ioctl


author: chenyi <chenyi211@huawei.com> - 4.19.90-2406.1.0.0279
changelog:
  - !8437  comedi: dt9812: fix DMA buffers on stack
  - !8515 v2  *** CVE-2021-47356 ***
  - !8582 v2  bcache: avoid oversized read request in cache missing code path
  - !8522  smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  - !8499  udf: Fix NULL pointer dereference in udf_symlink function
  - !8498  Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
  - !8570  net: hamradio: fix memory leak in mkiss_close
  - !8506  CVE-2024-36015
  - !8508  memory: fsl_ifc: fix leak of private memory on probe failure
  - !8470 v2  CVE-2024-35808
  - !8050  block: prevent division by zero in blk_rq_stat_sum()
  - !8469  watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff()
  - !8482 v2  Fix hugetlb deadlock
  - bcache: avoid oversized read request in cache missing code path
  - !8327  wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
  - !8316  net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
  - net: hamradio: fix memory leak in mkiss_close
  - !8310  jfs: fix two
  - !8507  tty: vcc: Add check for kstrdup() in vcc_probe()
  - !8441  pinctrl: core: delete incorrect free in pinctrl_enable()
  - !8414  backport for CVE-2023-52750
  - !8449  drm/amd/pm: Update intermediate power state for SI
  - !8453  net: fix uninit-value in caif_seqpkt_sendmsg
  - !6800  block: fix overflow in blk_ioctl_discard()
  - !8068  CVE-2021-47427
  - !8102 v2  sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
  - !8413  NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
  - !8417  NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
  - !8403  can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
  - !8393  4.19: fix CVE-2024-35978
  - !8349  perf hist: Fix memory leak of a perf_hpp_fmt
  - smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq
  - mISDN: fix possible use-after-free in HFC_cleanup()
  - memory: fsl_ifc: fix leak of private memory on probe failure
  - tty: vcc: Add check for kstrdup() in vcc_probe()
  - !8296  atm: iphase: fix possible use-after-free in ia_module_exit()
  - !8297 v2  powerpc/mm: Fix lockup on kernel exec fault
  - !8405  tty: serial: 8250: serial_cs: Fix a memory leak in error handling path
  - ppdev: Add an error check in register_device
  - ppdev: Remove usage of the deprecated ida_simple_xx() API
  - !8423  mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
  - udf: Fix NULL pointer dereference in udf_symlink function
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
  - !8354  CVE-2021-47277
  - !8386  drm/nouveau/debugfs: fix file release memory leak
  - !8452  Fix CVE-2021-47438
  - !8308  mac80211: fix use-after-free in CCMP/GCMP RX
  - !8341  net/mlx5: Properly link new fs rules into the tree
  - hugetlb: pass head page to remove_hugetlb_page()
  - hugetlbfs: fix hugetlbfs_statfs() locking
  - hugetlb: make free_huge_page irq safe
  - hugetlb: change free_pool_huge_page to remove_pool_huge_page
  - hugetlb: call update_and_free_page without hugetlb_lock
  - hugetlb: create remove_hugetlb_page() to separate functionality
  - Revert "hugetlb: make free_huge_page irq safe"
  - Revert "hugetlbfs: fix hugetlbfs_statfs() locking"
  - !8075 v2  HID: betop: fix slab-out-of-bounds Write in betop_probe
  - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen
  - md/dm-raid: don't call md_reap_sync_thread() directly
  - watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff()
  - !8191  HID: usbhid: free raw_report buffers in usbhid_stop
  - !8314  mcb: fix error handling in mcb_alloc_bus()
  - !7852  CVE-2021-47407
  - net: fix uninit-value in caif_seqpkt_sendmsg
  - net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()
  - net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path
  - !8276  usb: udc: remove warning when queue disabled ep
  - !8142  i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  - !8410  iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
  - drm/amd/pm: Update intermediate power state for SI
  - !8175  jfs: fix array-index-out-of-bounds in diAlloc
  - pinctrl: core: delete incorrect free in pinctrl_enable()
  - comedi: dt9812: fix DMA buffers on stack
  - mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
  - !8292  netfilter: conntrack: serialize hash resizes and cleanups
  - NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
  - arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
  - arm64: Make CPU_BIG_ENDIAN depend on ld.bfd or ld.lld 13.0.0+
  - NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
  - iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
  - tty: serial: 8250: serial_cs: Fix a memory leak in error handling path
  - !8348  ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()
  - can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
  - !8324  drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
  - !8394  hugetlbfs: fix hugetlbfs_statfs() locking
  - !8188 v2  ACPI: video: check for error while searching for backlight device parent
  - hugetlbfs: fix hugetlbfs_statfs() locking
  - Bluetooth: Fix memory leak in hci_req_sync_complete()
  - !8303  ipvlan: add ipvlan_route_v6_outbound() helper
  - drm/nouveau/debugfs: fix file release memory leak
  - !8211  fix CVE-2024-35877
  - !7964 v2  vt: fix unicode buffer corruption when deleting characters
  - !8160 v2  ipack: ipoctal: fix stack information leak
  - !8100  arch related major bugfix before 2023
  - !8192  atm: nicstar: Fix possible use-after-free in nicstar_cleanup()
  - kvm: fix previous commit for 32-bit builds
  - kvm: avoid speculation-based attacks from out-of-range memslot accesses
  - !8181 v3  cpu/hotplug: Don't offline the last non-isolated CPU
  - perf hist: Fix memory leak of a perf_hpp_fmt
  - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()
  - !8205  fix hugetlb deadlock
  - !8061  *** CVE-2021-47475 ***
  - !8252  sysv: don't call sb_bread() with pointers_lock held
  - !8248  gfs2: ignore negated quota changes
  - !8206  RDMA: Verify port when creating flow rule
  - net/mlx5: Properly link new fs rules into the tree
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
  - !8219  tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
  - !8223  CVE-2023-52804
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
  - mcb: fix error handling in mcb_alloc_bus()
  - jfs: fix array-index-out-of-bounds in dbFindLeaf
  - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
  - mac80211: fix use-after-free in CCMP/GCMP RX
  - !8209  net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
  - !8257 v5  can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
  - ipvlan: add ipvlan_route_v6_outbound() helper
  - powerpc/mm: Fix lockup on kernel exec fault
  - atm: iphase: fix possible use-after-free in ia_module_exit()
  - netfilter: conntrack: serialize hash resizes and cleanups
  - !8062  CVE-2024-35789
  - usb: udc: remove warning when queue disabled ep
  - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
  - !7804 v2  selinux: avoid dereference of garbage after mount failure
  - sysv: don't call sb_bread() with pointers_lock held
  - !8186  ALSA: hda: Fix possible null-ptr-deref when assigning a stream
  - !8208  ocfs2: mount fails with buffer overflow in strlen
  - !8207  drm/msm: Fix null pointer dereference on pointer edp
  - gfs2: ignore negated quota changes
  - !7470  x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
  - !7699  CVE-2023-52669
  - !7868  CVE-2024-35995
  - fs/jfs: Add validity check for db_maxag and db_agpref
  - fs: jfs: fix shift-out-of-bounds in dbAllocAG
  - jfs: fix divide error in dbNextAG
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
  - x86/mm/pat: fix VM_PAT handling in COW mappings
  - net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
  - ocfs2: mount fails with buffer overflow in strlen
  - drm/msm: Fix null pointer dereference on pointer edp
  - !8180  Fix CVE-2021-47495
  - RDMA: Verify port when creating flow rule
  - hugetlb: make free_huge_page irq safe
  - mm/hugetlb: defer freeing of huge pages if in non-task context
  - !8146  pinctrl: single: fix potential NULL dereference
  - !8164  sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
  - !8131  scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
  - atm: nicstar: Fix possible use-after-free in nicstar_cleanup()
  - HID: usbhid: free raw_report buffers in usbhid_stop
  - ACPI: video: check for error while searching for backlight device parent
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream
  - cpu/hotplug: Don't offline the last non-isolated CPU
  - usbnet: fix error return code in usbnet_probe()
  - usbnet: sanity check for maxpacket
  - jfs: fix array-index-out-of-bounds in diAlloc
  - sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
  - ipack: ipoctal: fix stack information leak
  - pinctrl: single: fix potential NULL dereference
  - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
  - sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
  - x86/ioapic: Unbreak check_timer()
  - irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling
  - genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
  - HID: betop: fix slab-out-of-bounds Write in betop_probe
  - scsi: iscsi: Fix iscsi_task use after free
  - scsi: iscsi: Have abort handler get ref to conn
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  - mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN
  - comedi: vmk80xx: fix expression for tx buffer size
  - comedi: vmk80xx: fix transfer-buffer overflows
  - block: prevent division by zero in blk_rq_stat_sum()
  - vt: fix unicode buffer corruption when deleting characters
  - ACPI: CPPC: Fix access width used for PCC registers
  - ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
  - ACPI: CPPC: Use access_width over bit_width for system memory accesses
  - ACPI: CPPC: Fix up I/O port access in cpc_read()
  - ACPI: CPPC: Implement support for SystemIO registers
  - KVM: x86: Handle SRCU initialization failure during page track init
  - selinux: avoid dereference of garbage after mount failure
  - crypto: s390/aes - Fix buffer overread in CTR mode
  - x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
  - block: fix overflow in blk_ioctl_discard()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2406.2.0.0281
changelog:
  - !8895  net: fix out-of-bounds access in ops_init
  - !8694  clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
  - !8858  PCI/PM: Drain runtime-idle callbacks before driver removal
  - !8626  fs/9p: only translate RWX permissions for plain 9P2000
  - !8490  scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - !8777  memory: fsl_ifc: fix leak of IO mapping on probe failure
  - !8806  media: zr364xx: fix memory leak in zr364xx_start_readpipe
  - !8664  mmc: mmc_spi: fix error handling in mmc_spi_probe()
  - !8865  staging: rtl8712: fix use-after-free in rtl8712_dl_fw
  - !8888  nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  - !8825  watchdog: Fix possible use-after-free in wdt_startup()
  - !8654  nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
  - !8358  perf report: Fix memory leaks around perf_tip()
  - !8552  tipc: fix a possible memleak in tipc_buf_append
  - !8851  ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - net: fix out-of-bounds access in ops_init
  - !8802  CVE-2021-47294
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  - staging: rtl8712: fix use-after-free in rtl8712_dl_fw
  - PCI/PM: Drain runtime-idle callbacks before driver removal
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - !8628  erspan: make sure erspan_base_hdr is present in skb->head
  - !8716  CVE-2024-35910
  - !8325  ocfs2: fix data corruption after conversion from inline format
  - !8729  tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - !8636  ipv6: Fix potential uninit-value access in __ip6_make_skb()
  - watchdog: Fix possible use-after-free in wdt_startup()
  - !8773  sched: remove WARN_ON on checking rq->tmp_alone_branch
  - media: zr364xx: fix memory leak in zr364xx_start_readpipe
  - !8678  can: pch_can: pch_can_rx_normal: fix use after free
  - netrom: Fix use-after-free of a listening socket.
  - netrom: Decrease sock refcount when sock timers expire
  - !8676  net: tulip: de4x5: fix the problem that the array 'lp->phy[8
  - !8708  media: imon: fix access to invalid resource for the second interface
  - !8707  regmap: Fix possible double-free in regcache_rbtree_exit()
  - !8706  isdn: mISDN: Fix sleeping function called from invalid context
  - !8705  usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
  - !8357  nilfs2: fix underflow in second superblock position calculations
  - !8681  rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  - !8484  scsi: megaraid_sas: Fix resource leak in case of probe failure
  - memory: fsl_ifc: fix leak of IO mapping on probe failure
  - sched: remove WARN_ON on checking rq->tmp_alone_branch
  - !8620  CVE-2024-35896
  - !8526  SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
  - !8336  tcp: fix page frag corruption on page fault
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - !8521  isofs: Fix out of bound access for corrupted isofs image
  - !7786  powerpc/powernv: Add a null pointer check in opal_event_init()
  - !8568  gfs2: Fix use-after-free in gfs2_glock_shrink_scan
  - tcp: properly terminate timers for kernel sockets
  - mptcp: add sk_stop_timer_sync helper
  - !8478  arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
  - !8366  net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
  - !8544  CVE-2021-47358
  - !8577  mmc: sdhci-msm: pervent access to suspended controller
  - !8579  net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()
  - !8603  rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
  - media: imon: fix access to invalid resource for the second interface
  - regmap: Fix possible double-free in regcache_rbtree_exit()
  - isdn: mISDN: Fix sleeping function called from invalid context
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
  - !8516  CVE-2021-47409
  - !8465  drm/amd/display: Avoid NULL dereference of timing generator
  - !8500  pwm: Fix double shift bug
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  - can: pch_can: pch_can_rx_normal: fix use after free
  - net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound
  - !8402  i40e: Fix freeing of uninitialized misc IRQ vector
  - !8398  comedi: ni_usb6501: fix NULL-deref in command paths
  - mmc: mmc_spi: fix error handling in mmc_spi_probe()
  - nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
  - !8464  i2c: smbus: fix NULL function pointer dereference
  - !8434  iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
  - !8411  platform/x86: wmi: Fix opening of char device
  - ipv6: Fix potential uninit-value access in __ip6_make_skb()
  - !8307  s390/dasd: protect device queue against concurrent access
  - !8444  CVE-2021-47511
  - !8443 v2  ipack: ipoctal: fix module reference leak
  - !8611  smackfs: restrict bytes count in smk_set_cipso()
  - !8610  media: gspca: cpia1: shift-out-of-bounds in set_flicker
  - !8609  can: peak_pci: peak_pci_remove(): fix UAF
  - !8430  drm/sched: Avoid data corruptions
  - !8557  net: cdc_eem: fix tx fixup skb leak
  - !8365  efi/capsule-loader: fix incorrect allocation size
  - !8333  soc: qcom: llcc: Handle a second device without data corruption
  - erspan: make sure erspan_base_hdr is present in skb->head
  - fs/9p: only translate RWX permissions for plain 9P2000
  - netfilter: complete validation of user input
  - netfilter: validate user input for expected length
  - smackfs: restrict bytes count in smk_set_cipso()
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker
  - can: peak_pci: peak_pci_remove(): fix UAF
  - rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
  - net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()
  - mmc: sdhci-msm: pervent access to suspended controller
  - gfs2: Fix use-after-free in gfs2_glock_shrink_scan
  - net: cdc_eem: fix tx fixup skb leak
  - tipc: fix a possible memleak in tipc_buf_append
  - staging: greybus: uart: fix tty use after free
  - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
  - isofs: Fix out of bound access for corrupted isofs image
  - usb: dwc2: Fix memory leak in dwc2_hcd_init
  - usb: dwc2: check return value after calling platform_get_resource()
  - pwm: Fix double shift bug
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - scsi: megaraid_sas: Fix resource leak in case of probe failure
  - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
  - drm/amd/display: Avoid NULL dereference of timing generator
  - i2c: smbus: fix NULL function pointer dereference
  - ALSA: pcm: oss: Fix negative period/buffer sizes
  - ALSA: pcm: oss: Fix a few more UBSAN fixes
  - ipack: ipoctal: fix module reference leak
  - iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
  - drm/sched: Avoid data corruptions
  - platform/x86: wmi: Fix opening of char device
  - i40e: Fix freeing of uninitialized misc IRQ vector
  - comedi: ni_usb6501: fix NULL-deref in command paths
  - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
  - efi/capsule-loader: fix incorrect allocation size
  - perf report: Fix memory leaks around perf_tip()
  - nilfs2: fix underflow in second superblock position calculations
  - tcp: fix page frag corruption on page fault
  - soc: qcom: llcc: Handle a second device without data corruption
  - ocfs2: fix data corruption after conversion from inline format
  - s390/dasd: protect device queue against concurrent access
  - powerpc/powernv: Add a null pointer check in opal_event_init()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2406.3.0.0282
changelog:
  - !9086 v2  dhugetlb: use rcu lock to protect hpool
  - !8796  CVE-2023-52810
  - !8699  wifi: cfg80211: check A-MSDU format more carefully
  - !9123  staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
  - staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
  - !9005  scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - !9113  IB/qib: Protect from buffer
  - !9119  PCI: aardvark: Fix kernel panic during PIO transfer
  - !9058  watchdog: Fix possible use-after-free by calling del_timer_sync()
  - !9053  soc: fsl: qbman: Use raw spinlock for cgr_lock
  - PCI: aardvark: Fix kernel panic during PIO transfer
  - PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response
  - PCI: aardvark: Don't rely on jiffies while holding spinlock
  - !9091  RDMA/cma: Fix rdma_resolve_route() memory leak
  - IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
  - IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
  - !9037  fix CVE-2021-47509
  - RDMA/cma: Fix rdma_resolve_route() memory leak
  - dhugetlb: use rcu lock to protect hpool
  - !8291 Fix CVE-2023-52836
  - !8574  net: ieee802154: fix null deref in parse dev addr
  - !9017  misc/libmasm/module: Fix two use after free in ibmasm_init_one
  - !9045  ALSA: seq: Fix race of snd_seq_timer_open()
  - !9046  net: rds: fix memory leak in rds_recvmsg
  - !8632  phy: phy-mtk-tphy: Fix some resource leaks in mtk_phy_init()
  - !8695  net: macb: fix use after free on rmmod
  - !4633 Add support for Hygon family 18h model 5h HD-Audio
  - !9057  CVE-2021-47261
  - !8637  dyndbg: fix old BUG_ON in >control parser
  - !8698  net: batman-adv: fix error handling
  - !8715  net/sched: act_skbmod: prevent kernel-infoleak
  - !8775  llc: verify mac len before reading mac header
  - watchdog: Fix possible use-after-free by calling del_timer_sync()
  - IB/mlx5: Fix initializing CQ fragments buffer
  - soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !9022  wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - !8786  tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  - !8704  usb: fix various gadget panics on 10gbps cabling
  - !9013  net: encx24j600: check error in devm_regmap_init_encx24j600
  - net: rds: fix memory leak in rds_recvmsg
  - ALSA: seq: Fix race of snd_seq_timer_open()
  - !9036  IB/hfi1: Restore allocated resources on failed copyout
  - !4620 Some fixes for Hygon model 4h~6h processors
  - !4630 Add support for Hygon model 6h L3 PMU
  - ALSA: pcm: oss: Limit the period size to 16MB
  - ALSA: pcm: oss: Fix potential out-of-bounds shift
  - !8549  batman-adv: Avoid infinite loop trying to resize local TT
  - !8763  tipc: fix UAF in error path
  - IB/hfi1: Restore allocated resources on failed copyout
  - !8956  net: ti: fix UAF in tlan_remove_one
  - !8959  comedi: vmk80xx: fix bulk-buffer overflow
  - !8740  CVE-2024-36914
  - !8824  igb: Fix use-after-free error during reset
  - !8987  bna: ensure the copied buf is NUL terminated
  - !9026  tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - !8923  i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
  - !8961  nfp: Fix memory leak in nfp_cpp_area_cache_add()
  - !8875  drm/vmwgfx: Fix invalid reads in fence signaled events
  - !8883  scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - misc/libmasm/module: Fix two use after free in ibmasm_init_one
  - net: encx24j600: check error in devm_regmap_init_encx24j600
  - !8998  i2c: acpi: fix resource leak in reconfiguration device addition
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - !8991  clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
  - !8992  fix CVE-2024-36905
  - i2c: acpi: fix resource leak in reconfiguration device addition
  - !8868  ipv6: prevent NULL dereference in ip6_output()
  - net: relax socket state check at accept time.
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
  - !8737  ubifs: Set page uptodate in the correct place
  - !8668  phonet/pep: fix racy skb_queue_empty() use
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
  - bna: ensure the copied buf is NUL terminated
  - nfp: Fix memory leak in nfp_cpp_area_cache_add()
  - comedi: vmk80xx: fix bulk-buffer overflow
  - net: ti: fix UAF in tlan_remove_one
  - i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
  - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - drm/vmwgfx: Fix invalid reads in fence signaled events
  - ipv6: prevent NULL dereference in ip6_output()
  - igb: Fix use-after-free error during reset
  - fs/jfs: Add check for negative db_l2nbperpage
  - jfs: jfs_dmap: Validate db_l2nbperpage while mounting
  - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  - llc: verify mac len before reading mac header
  - tipc: fix UAF in error path
  - drm/amd/display: Skip on writeback when it's not applicable
  - ubifs: Set page uptodate in the correct place
  - net/sched: act_skbmod: prevent kernel-infoleak
  - usb: fix various gadget panics on 10gbps cabling
  - wifi: cfg80211: check A-MSDU format more carefully
  - net: batman-adv: fix error handling
  - net: macb: fix use after free on rmmod
  - phonet/pep: fix racy skb_queue_empty() use
  - dyndbg: fix old BUG_ON in >control parser
  - phy: phy-mtk-tphy: Fix some resource leaks in mtk_phy_init()
  - net: ieee802154: fix null deref in parse dev addr
  - batman-adv: Avoid infinite loop trying to resize local TT
  - locking/ww_mutex/test: Fix potential workqueue corruption
  - EDAC/amd64: Adjust UMC channel for Hygon family 18h model 6h
  - x86/amd_nb: Get DF ID from F5 device for Hygon family 18h model 6h
  - EDAC/amd64: Fix intlv_num_chan for Hygon family 18h model 4h
  - EDAC/amd64: Revert hi_addr_offset for Hygon family 18h model 4h
  - ALSA: hda: Fix single byte write failure issue for Hygon
  - ALSA: hda: Add Hygon HD-Audio support
  - perf/x86/uncore: Add L3 PMU support for Hygon family 18h model 6h


author: chenyi <chenyi211@huawei.com> - 4.19.90-2406.4.0.0283
changelog:
  - !9471  CVE-2021-47434
  - xhci: Fix commad ring abort, write all 64 bits to CRCR register.
  - xhci: Fix command ring pointer corruption while aborting a command
  - !8935  wifi: nl80211: don't free NULL coalescing rule
  - !9444  CVE-2022-48737
  - !8493  rpmsg: virtio: Free driver_override when rpmsg_remove()
  - !8473  scsi: mpt3sas: Fix kernel panic during drive powercycle test
  - ASoC: ops: Fix bounds check for _sx controls
  - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()
  - !9322  drm/amd/display: Fix potential index out of bounds in color transformation function
  - !9366  macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
  - !9392  drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable
  - !9232  batman-adv: Avoid WARN_ON timing related checks
  - !9351  Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."
  - !9393  net: lts v4.311 backport
  - !9286  mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations
  - !9206 v2  sched: smart_grid: fix potential NULL pointer dereference
  - !9314  spi: Fix deadlock when adding SPI controllers on SPI buses
  - net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
  - ipv6: fib6_rules: flush route cache when rule is changed
  - drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable
  - !8360 v2  loop: use lo->lo_disk for kobject_uevent
  - !9343  firmware: arm_scpi: Fix string overflow in SCPI genpd driver
  - !9326  af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
  - !9285  of: module: add buffer overflow check in of_modalias()
  - !9316  CVE-2022-48755
  - Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."
  - !9344  round lts patches
  - !8769  atl1c: Work around the DMA RX overflow issue
  - !9292  net: bridge: xmit: make sure we have at least eth header len bytes
  - net: bridge: fix corrupted ethernet header on multicast-to-unicast
  - net: bridge: fix multicast-to-unicast with fraglist GSO
  - net: mark racy access on sk->sk_rcvbuf
  - net l2tp: drop flow hash on forward
  - firmware: arm_scpi: Fix string overflow in SCPI genpd driver
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - !9324 v2  Linux 4.19.312-313 LTS patches
  - vxlan: Fix regression when dropping packets due to invalid src addresses
  - udp: preserve the connected status if only UDP cmsg
  - vxlan: drop packets from invalid src-address
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int
  - drm/amd/display: Fix potential index out of bounds in color transformation function
  - powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06
  - spi: fix kabi breakage in struct spi_controller
  - spi: Fix deadlock when adding SPI controllers on SPI buses
  - !9278  CVE-2021-47231
  - !8783 v2  arm64 mpam fix patch
  - !9270  inet_diag: fix kernel-infoleak for UDP sockets
  - !9140 v2  CVE-2024-36971
  - !8847  wl1251: Fix possible buffer overflow in wl1251_cmd_scan
  - !9260 v3  ftrace: Fix possible use-after-free issue in ftrace_location()
  - net: bridge: xmit: make sure we have at least eth header len bytes
  - mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations
  - of: module: add buffer overflow check in of_modalias()
  - !9061  iio: mma8452: Fix trigger reference couting
  - can: mcba_usb_start(): add missing urb->transfer_dma initialization
  - can: mcba_usb: fix memory leak in mcba_usb
  - inet_diag: fix kernel-infoleak for UDP sockets
  - ftrace: Fix possible use-after-free issue in ftrace_location()
  - !9227  kprobes: Fix possible use-after-free issue on kprobe registration
  - !9228  coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()
  - !9225  can: sja1000: fix use after free in ems_pcmcia_add_card()
  - !8656  mm, slub: fix potential memoryleak in kmem_cache_open()
  - !8937  firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - !8691  Fix page corruption caused by racy check in __free_pages
  - batman-adv: Avoid WARN_ON timing related checks
  - coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()
  - kprobes: Fix possible use-after-free issue on kprobe registration
  - can: sja1000: fix use after free in ems_pcmcia_add_card()
  - !9179  CVE-2021-47232
  - !9004  media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
  - !8130 v2  CVE-2021-47493
  - !9006  media: tc358743: register v4l2 async device only after successful setup
  - !9144  serial: 8250_exar: Don't remove GPIO device on suspend
  - sched: smart_grid: fix potential NULL pointer dereference
  - can: j1939: fix Use-after-Free, hold skb ref while in use
  - can: j1939: transport: j1939_session_tx_dat(): fix use-after-free read in j1939_tp_txtimer()
  - can: j1939: transport: add j1939_session_skb_find_by_offset() function
  - !8800  ALSA: usb-audio: Stop parsing channels bits when all channels are found.
  - !8798  hid: cp2112: Fix duplicate workqueue initialization
  - !8799  usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
  - serial: 8250_exar: Don't remove GPIO device on suspend
  - net: fix kabi breakage in struct dst_ops
  - net: fix __dst_negative_advice() race
  - iio: mma8452: Fix trigger reference couting
  - media: tc358743: register v4l2 async device only after successful setup
  - media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
  - firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - wifi: nl80211: don't free NULL coalescing rule
  - wl1251: Fix possible buffer overflow in wl1251_cmd_scan
  - ALSA: usb-audio: Stop parsing channels bits when all channels are found.
  - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
  - hid: cp2112: Fix duplicate workqueue initialization
  - arm64/mpam: Fix softlockup when reading mondata
  - arm64/mpam: Fix wrong seconds to jiffies conversion
  - arm64/mpam: change allocation mode from GFP_KERNEL to GFP_NOWAIT
  - mpam/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup
  - mpam/resctrl: Clean up resctrl_group_rmdir_[ctrl/mon]()
  - mpam/resctrl: Clean up unused function parameter in mkdir path
  - mpam/resctrl: Fix a deadlock due to inaccurate reference
  - atl1c: Work around the DMA RX overflow issue
  - Fix page corruption caused by racy check in __free_pages
  - mm, slub: fix potential memoryleak in kmem_cache_open()
  - rpmsg: virtio: Free driver_override when rpmsg_remove()
  - scsi: mpt3sas: Fix kernel panic during drive powercycle test
  - loop: use lo->lo_disk for kobject_uevent
  - jbd2: export jbd2_journal_[grab|put]_journal_head
  - ocfs2: fix a deadlock when commit trans
  - ocfs2: fix race between searching chunks and release journal_head from buffer_head


author: chenyi <chenyi211@huawei.com> - 4.19.90-2407.1.0.0284
changelog:
  - !9629  stm class: Fix a double free in stm_register_device()
  - !9646  phonet: fix rtm_phonet_notify() skb allocation
  - !9628  m68k: Fix spinlock race in kernel thread creation
  - !9623 v2  net/nfc/rawsock.c: fix a permission check bug
  - !9648 backport two patches from 5.10 to fix some bugs for GuestOS
  - !9617  mac80211: track only QoS data frames for admission control
  - !9637  ipv6: sr: fix invalid unregister error path
  - !9607  enic: Validate length of nl attributes in enic_set_vf_port
  - !9606  drm/nouveau: fix off by one in BIOS boundary checking
  - !9605  scsi: bfa: Ensure the copied buf is NUL terminated
  - irqchip: gic-v3: Collection table support muti pages
  - scsi: virtio_scsi: limit number of hw queues by nr_cpu_ids
  - phonet: fix rtm_phonet_notify() skb allocation
  - ipv6: sr: fix invalid unregister error path
  - stm class: Fix a double free in stm_register_device()
  - m68k: Fix spinlock race in kernel thread creation
  - !9076  RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
  - net/nfc/rawsock.c: fix a permission check bug
  - mac80211: track only QoS data frames for admission control
  - enic: Validate length of nl attributes in enic_set_vf_port
  - drm/nouveau: fix off by one in BIOS boundary checking
  - !9600  CVE-2024-38597
  - scsi: bfa: Ensure the copied buf is NUL terminated
  - !9409  drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - !9452  jffs2: prevent xattr node from overflowing the eraseblock
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
  - !8163 v2  mmc: sdio: fix possible resource leaks in some error paths
  - !9535  igbvf: fix double free in `igbvf_probe`
  - !9590  s390/ap: Fix crash in AP internal function modify_bitmap()
  - !9584  ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  - !9537  virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - !9585  net/mlx5e: Avoid field-overflowing memcpy()
  - s390/ap: Fix crash in AP internal function modify_bitmap()
  - net/mlx5e: Avoid field-overflowing memcpy()
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  - !9534  rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
  - !9419  mm/migrate: set swap entry values of THP tail pages properly.
  - !9560  net: systemport: Add global locking for descriptor lifecycle
  - !9526  media: lgdt3306a: Add a check against null-pointer-def
  - !9539  ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - net: systemport: Add global locking for descriptor lifecycle
  - !9340  serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - !9330  ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx()
  - !9382  serial: max3100: Update uart_driver_registered on driver removal
  - !9503 v2  watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - !9464  quota: Fix rcu annotations of inode dquot pointers
  - !9530 v2  Backport LTS patches
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  - !9435  fix CVE-2024-38621
  - igbvf: fix double free in `igbvf_probe`
  - rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
  - !9381  vfio/pci: fix potential memory leak in vfio_intx_enable()
  - !9497  netrom: fix possible dead-lock in nr_rt_ioctl()
  - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
  - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map
  - media: lgdt3306a: Add a check against null-pointer-def
  - !9505  CVE-2024-38587
  - !9473  um: Add winch to winch_handlers before registering winch IRQ
  - !9407  drm/arm/malidp: fix a possible null pointer dereference
  - !9400  Fix CVE-2024-31076
  - speakup: Fix sizeof() vs ARRAY_SIZE() bug
  - !9439  CVE-2022-48715
  - !9133  net: ethernet: fix potential use-after-free in ec_bhf_remove
  - watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - netrom: fix possible dead-lock in nr_rt_ioctl()
  - !9265  ring-buffer: Fix a race between readers and resize checks
  - !9390  NFS: Fix an off by one in root_nfs_cat()
  - um: Add winch to winch_handlers before registering winch IRQ
  - quota: Fix rcu annotations of inode dquot pointers
  - fs/quota: erase unused but set variable warning
  - jffs2: prevent xattr node from overflowing the eraseblock
  - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
  - media: stk1160: fix bounds checking in stk1160_copy_video()
  - mm/migrate: set swap entry values of THP tail pages properly.
  - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - drm/arm/malidp: fix a possible null pointer dereference
  - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
  - NFS: Fix an off by one in root_nfs_cat()
  - serial: max3100: Update uart_driver_registered on driver removal
  - vfio/pci: fix potential memory leak in vfio_intx_enable()
  - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx()
  - ring-buffer: Fix a race between readers and resize checks
  - net: ethernet: fix potential use-after-free in ec_bhf_remove
  - RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
  - mmc: sdio: fix possible resource leaks in some error paths


author: chenyi <chenyi211@huawei.com> - 4.19.90-2407.3.0.0285
changelog:
  - !9803 v2  x86/ftrace: Disable lockdep check when execute ftrace_int3_handler()
  - x86/ftrace: Disable lockdep check when execute ftrace_int3_handler()
  - !9797  sch_cake: do not call cake_destroy() from cake_init()
  - sch_cake: do not call cake_destroy() from cake_init()
  - !9786  drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
  - drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
  - !9777  CVE-2024-23848
  - media: cec: cec-api: add locking in cec_release()
  - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
  - !9765  i40e: Fix queues reservation for XDP
  - !9760  CVE-2024-26816
  - !9754  net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - !9367 v2  net: qcom/emac: fix UAF in emac_remove
  - !9512  drm: vc4: Fix possible null pointer dereference
  - !9755  wifi: ar5523: enable proper endpoint verification
  - i40e: Fix queues reservation for XDP
  - !9744  Fix CVE-2024-36949
  - !9741  scsi: qedf: Ensure the copied buf is NUL terminated
  - !9727  net: amd-xgbe: Fix skb data length underflow
  - x86/boot: Ignore relocations in .notes sections in walk_relocs() too
  - x86, relocs: Ignore relocations in .notes section
  - !9743  USB: core: Fix hang in usb_kill_urb by adding memory barriers
  - wifi: ar5523: enable proper endpoint verification
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6
  - !9674  ax25: Fix reference count leak issue of net_device
  - !9729  seg6: fix the iif in the IPv6 socket control block
  - !9725 v2  net: Fix CVE-2022-48757
  - !9737  net/9p: fix uninit-value in p9_client_rpc()
  - amd/amdkfd: sync all devices to wait all processes being evicted
  - drm/amdkfd: Rework kfd_locked handling
  - USB: core: Fix hang in usb_kill_urb by adding memory barriers
  - scsi: qedf: Ensure the copied buf is NUL terminated
  - net/9p: fix uninit-value in p9_client_rpc()
  - !9710  CVE-2022-48738
  - !9568  media: mxl111sf: change mutex_init() location
  - !9570  net: ieee802154: ca8210: Stop leaking skb's
  - seg6: fix the iif in the IPv6 socket control block
  - !9700 v2  crypto: bcm - Fix pointer arithmetic
  - !9684  greybus: lights: check return of get_channel_from_mode
  - net: amd-xgbe: Fix skb data length underflow
  - !9666  ftrace: Fix rcu warn in ftrace_location()
  - net: fix kabi breakage in struct packet_type
  - net: fix information leakage in /proc/net/ptype
  - !9724  Fix CVE-2024-35915
  - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_rx_work
  - nfc: nci: Fix kcov check in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
  - !9658  KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak
  - !9698  Fix CVE-2021-47270
  - !9699  dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - !9550  scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()
  - !9707  nilfs2: fix use-after-free of timer for log writer thread
  - ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min
  - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()
  - nilfs2: fix use-after-free of timer for log writer thread
  - !9655  nfc: fix segfault in nfc_genl_dump_devices_done
  - !9654  mac80211: validate extended element ID is present
  - !9653  ecryptfs: Fix buffer size for tag 66 packet
  - !9652  ALSA: timer: Set lower bound of start tick time
  - !9697 v3  Fix CVE-2024-38567
  - !9633  CVE-2024-38582
  - !9692  netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
  - crypto: bcm - Fix pointer arithmetic
  - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  - usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS
  - usb: fix various gadgets null ptr deref on 10gbps cabling.
  - wifi: carl9170: add a proper sanity check for endpoints
  - USB: core: Add routines for endpoint checks in old drivers
  - !9597  ASoC: max9759: fix underflow in speaker_gain_control_put()
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
  - !9626  fix uaf when proc_cpuset_show
  - !9660  nilfs2: fix potential kernel bug due to lack of writeback flag waiting
  - greybus: lights: check return of get_channel_from_mode
  - ax25: Fix reference count leak issue of net_device
  - ftrace: Fix rcu warn in ftrace_location()
  - !9553  CVE-2024-37356
  - nilfs2: fix potential kernel bug due to lack of writeback flag waiting
  - KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak
  - nfc: fix segfault in nfc_genl_dump_devices_done
  - mac80211: validate extended element ID is present
  - ecryptfs: Fix buffer size for tag 66 packet
  - ALSA: timer: Set lower bound of start tick time
  - nilfs2: fix potential hang in nilfs_detach_log_writer()
  - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
  - cgroup: fix uaf when proc_cpuset_show
  - ASoC: max9759: fix underflow in speaker_gain_control_put()
  - net: ieee802154: ca8210: Stop leaking skb's
  - media: mxl111sf: change mutex_init() location
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
  - params: lift param_set_uint_minmax to common code
  - scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()
  - drm: vc4: Fix possible null pointer dereference
  - net: qcom/emac: fix UAF in emac_remove


author: chenyi <chenyi211@huawei.com> - 4.19.90-2407.4.0.0286
changelog:
  - !9925  ocfs2: fix races between hole punching and AIO+DIO
  - !9874  crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
  - !9830  mmc: davinci: Don't strip remove function when driver is builtin
  - !9870  cifs: Fix deadlock in cifs_writepages during reconnect
  - !9895  bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  - ocfs2: fix races between hole punching and AIO+DIO
  - !9891  ipv6: sr: fix memleak in seg6_hmac_init_algo
  - !9856  btrfs: fix memory ordering between normal and ordered work functions
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  - ipv6: sr: fix memleak in seg6_hmac_init_algo
  - !9492  netlabel: fix out-of-bounds memory accesses
  - !9868  usb: musb: tusb6010: check return value after calling platform_get_resource()
  - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
  - cifs: Fix deadlock in cifs_writepages during reconnect
  - usb: musb: tusb6010: check return value after calling platform_get_resource()
  - !9858  khugepaged: fix null-pointer dereference due to race
  - !9819  kdb: Fix buffer overflow during tab-complete
  - khugepaged: fix null-pointer dereference due to race
  - btrfs: fix memory ordering between normal and ordered work functions
  - !9842  net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove
  - net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove
  - mmc: davinci: Don't strip remove function when driver is builtin
  - kdb: Fix buffer overflow during tab-complete
  - netlabel: fix out-of-bounds memory accesses


author: chenyi <chenyi211@huawei.com> - 4.19.90-2407.5.0.0287
changelog:
  - !10125  nvme-rdma: fix possible use-after-free in transport error_recovery work
  - !10112  ftrace: Fix use-after-free for dynamic ftrace_ops
  - !10276  net: ieee802154: at86rf230: Stop leaking skb's
  - net: ieee802154: at86rf230: Stop leaking skb's
  - !9917  powerpc/pseries: Enforce hcall result buffer validity and size
  - !10240  CVE-2024-41007
  - !10251  sctp: fix kernel-infoleak for SCTP sockets
  - !10241  USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - sctp: fix kernel-infoleak for SCTP sockets
  - !10229  staging: gdm724x: fix use after free in gdm_lte_rx()
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
  - tcp: avoid too many retransmit packets
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
  - net: tcp: fix unexcepted socket die when snd_wnd is 0
  - tcp: refactor tcp_retransmit_timer()
  - tcp: fix incorrect undo caused by DSACK of TLP retransmit
  - staging: gdm724x: fix use after free in gdm_lte_rx()
  - !10137  NFSD: Fix ia_size underflow
  - !10183 v3  ima: Fix use-after-free on a dentry's dname.name
  - !10121  usb: f_fs: Fix use-after-free for epfile
  - !10016  drm/exynos/vidi: fix memory leak in .get_modes()
  - !10211  fix CVE-2022-48865
  - !10206  gianfar: ethtool: Fix refcount leak in gfar_get_ts_info
  - tipc: fix kernel panic when enabling bearer
  - tipc: fix NULL pointer dereference in tipc_disc_rcv()
  - gianfar: ethtool: Fix refcount leak in gfar_get_ts_info
  - !10186  vsock: remove vsock from connected table when connect is interrupted by a signal
  - !10190  Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj
  - Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj
  - vsock: remove vsock from connected table when connect is interrupted by a signal
  - !10141  vt_ioctl: fix array_index_nospec in vt_setactivate
  - ima: Fix use-after-free on a dentry's dname.name
  - !10152  wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - !10026  liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - !10147  CVE-2022-48836
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
  - Input: aiptek - properly check endpoint type
  - Input: aiptek - fix endpoint sanity check
  - vt_ioctl: fix array_index_nospec in vt_setactivate
  - !10095  CVE-2024-40968
  - !10130  wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - NFSD: Fix ia_size underflow
  - !10123  CVE-2022-48838
  - !10122  wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - !10081  drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
  - !10092  usb: host: ohci-tmio: check return value after calling platform_get_resource()
  - nvme-rdma: fix possible use-after-free in transport error_recovery work
  - usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
  - usb: f_fs: Fix use-after-free for epfile
  - !10094  net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
  - ftrace: Fix use-after-free for dynamic ftrace_ops
  - !10054  vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - MIPS: Octeon: Add PCIe link status check
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
  - usb: host: ohci-tmio: check return value after calling platform_get_resource()
  - !10033  ipv6: prevent possible NULL dereference in rt6_probe()
  - drm/amdgpu: fix UBSAN warning in kv_dpm.c
  - !9996  netpoll: Fix race condition in netpoll_owner_active
  - !9948  ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
  - vmci: prevent speculation leaks by sanitizing event in event_deliver()
  - ipv6: prevent possible NULL dereference in rt6_probe()
  - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
  - drm/exynos/vidi: fix memory leak in .get_modes()
  - netpoll: Fix race condition in netpoll_owner_active
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
  - powerpc/pseries: Enforce hcall result buffer validity and size


author: chenyi <chenyi211@huawei.com> - 4.19.90-2408.1.0.0288
changelog:
  - !10327  NFC: port100: fix use-after-free in port100_send_complete
  - !10325  kobject: Fix global-out-of-bounds in kobject_action_type()
  - !10337  drm/radeon: fix UBSAN warning in kv_dpm.c
  - !10368 v2  jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
  - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
  - !10227  MIPS: smp: fill in sibling and core maps earlier
  - drm/radeon: fix UBSAN warning in kv_dpm.c
  - !10324  BMA: Fix iBMA bug and change
  - NFC: port100: fix use-after-free in port100_send_complete
  - kobject: Fix global-out-of-bounds in kobject_action_type()
  - !10315  jfs: xattr: fix buffer overflow for invalid xattr
  - BMA/cdev_veth_drv: Fix softlockup problem
  - BMA/kbox_drv: Change the version number.
  - BMA/veth_drv: Fix soft interrupt loops and change the version number
  - BMA/cdev_drv: Change the version number.
  - BMA/edma_drv: Fix DMA reset problem and change the version number.
  - !10173  netrom: Fix a memory leak in nr_heartbeat_expiry()
  - !10249  fbdev: savage: Handle err return when savagefb_check_var failed
  - !10306  mISDN: Fix memory leak in dsp_pipeline_build()
  - jfs: xattr: fix buffer overflow for invalid xattr
  - !10198  scsi: qedi: Fix crash while reading debugfs attribute
  - !10310  batman-adv: bypass empty buckets in batadv_purge_orig_ref()
  - !10307  wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
  - !10296  Backport dvb-usb bugfix
  - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
  - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
  - mISDN: Fix memory leak in dsp_pipeline_build()
  - media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
  - USB: move snd_usb_pipe_sanity_check into the USB core
  - fbdev: savage: Handle err return when savagefb_check_var failed
  - MIPS: smp: fill in sibling and core maps earlier
  - scsi: qedi: Fix crash while reading debugfs attribute
  - netrom: Fix a memory leak in nr_heartbeat_expiry()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2408.2.0.0289
changelog:
  - !10629 v2  hfsplus: fix uninit-value in copy_name
  - !10723  net/iucv: Avoid explicit cpumask var allocation on stack
  - !10646  net: dsa: mv88e6xxx: Correct check for empty list
  - !10609  wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
  - !10608  CVE-2024-41044
  - net/iucv: Avoid explicit cpumask var allocation on stack
  - !10693  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  - !10571  ila: block BH in ila_output()
  - !10593  fix CVE-2024-41046
  - !10521  xfs: add bounds checking to xlog_recover_process_data
  - !10597  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  - !10562  nilfs2: add missing check for inode numbers on directory entries
  - !10706  jfs: don't walk off the end of ealist
  - !10699  drm/amd/display: Skip finding free audio for unknown engine_id
  - !10672  inet_diag: Initialize pad field in struct inet_diag_req_v2
  - !10684  ocfs2: fix DIO failure due to insufficient transaction credits
  - !10565  gpio: davinci: Validate the obtained number of IRQs
  - !10389  pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
  - jfs: don't walk off the end of ealist
  - drm/amd/display: Skip finding free audio for unknown engine_id
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  - ocfs2: fix DIO failure due to insufficient transaction credits
  - inet_diag: Initialize pad field in struct inet_diag_req_v2
  - !10641  usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  - !10601  IB/core: Implement a limit on UMAD receive List
  - net: dsa: mv88e6xxx: Correct check for empty list
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  - hfsplus: fix uninit-value in copy_name
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
  - ppp: reject claimed-as-LCP but actually malformed packets
  - ppp: ensure minimum packet size in ppp_write()
  - IB/core: Implement a limit on UMAD receive List
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  - net: ethernet: lantiq_etop: fix double free in detach
  - net: lantiq_etop: add blank line after declaration
  - !10320  thermal: Fix NULL pointer dereferences in of_thermal_ functions
  - !10529  Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
  - ila: block BH in ila_output()
  - gpio: davinci: Validate the obtained number of IRQs
  - nilfs2: add missing check for inode numbers on directory entries
  - !10471  ALSA: emux: improve patch ioctl data validation
  - !10479  jffs2: Fix potential illegal address access in jffs2_free_inode
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
  - xfs: add bounds checking to xlog_recover_process_data
  - !10386  filelock: Fix fcntl/close race recovery compat path
  - !10485  fix CVE-2024-42086
  - !10492  drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - !10400  Fix CVE-2024-41069
  - !10270  HID: core: remove unnecessary WARN_ON() in implement()
  - !10472 v2  xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
  - !10359 v2  PCI/ROM: Fix PCI ROM header check bug
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
  - iio: chemical: bme680: Fix overflows in compensate() functions
  - jffs2: Fix potential illegal address access in jffs2_free_inode
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
  - ALSA: emux: improve patch ioctl data validation
  - !10341  net/sched: initialize noop_qdisc owner
  - ASoC: topology: Fix route memory corruption
  - ASoC: topology: Fix references to freed memory
  - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
  - filelock: Fix fcntl/close race recovery compat path
  - PCI/ROM: Fix PCI ROM header check bug
  - net/sched: initialize noop_qdisc owner
  - thermal: Fix NULL pointer dereferences in of_thermal_ functions
  - HID: core: remove unnecessary WARN_ON() in implement()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2408.3.0.0290
changelog:
  - !10895  drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - !10897 v2  orangefs: fix out-of-bounds fsid access
  - !10858 v4  powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - orangefs: fix out-of-bounds fsid access
  - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
  - !10891  CVE-2024-42105
  - nilfs2: fix inode number range checks
  - !10871  USB: serial: mos7840: fix crash on resume
  - !10643  USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  - USB: serial: mos7840: fix crash on resume
  - !10865  Revert "NFS: Don't interrupt file writeout due to fatal errors"
  - !10825  Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
  - Revert "NFS: Don't interrupt file writeout due to fatal errors"
  - !10730  filelock: Remove locks reliably when fcntl/close race is detected
  - powerpc/pseries: Whitelist dtl slub object for copying to userspace
  - !10802  media: dvb-frontends: tda10048: Fix integer overflow
  - !10703  x86: stop playing stack games in profile_pc()
  - !10838  bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
  - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
  - !10806  tcp_metrics: validate source addr length
  - !10803  s390/pkey: Wipe sensitive data on failure
  - !10786  CVE-2024-41034
  - tcp_metrics: validate source addr length
  - s390/pkey: Wipe sensitive data on failure
  - !10700  ethernet: Fix error handling in xemaclite_of_probe
  - !10777  Fix CVE-2024-42160
  - media: dvb-frontends: tda10048: Fix integer overflow
  - !10532  ftruncate: pass a signed offset
  - !10623  ata: libata-core: Fix double free on error
  - !10664 v2  ASoC: fsl-asoc-card: set priv->pdev before using it
  - nilfs2: fix kernel bug on rename operation of broken directory
  - nilfs2: return the mapped address from nilfs_get_page()
  - nilfs2: Remove check for PageError
  - f2fs: Add inline to f2fs_build_fault_attr() stub
  - f2fs: check validation of fault attrs in f2fs_build_fault_attr()
  - filelock: Remove locks reliably when fcntl/close race is detected
  - x86: stop playing stack games in profile_pc()
  - ethernet: Fix error handling in xemaclite_of_probe
  - ASoC: fsl-asoc-card: set priv->pdev before using it
  - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  - ata: libata-core: Fix double free on error
  - ftruncate: pass a signed offset


author: chenyi <chenyi211@huawei.com> - 4.19.90-2408.4.0.0291
changelog:
  - !10978  CVE-2024-42304
  - !10946  drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
  - !10957  bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
  - ext4: make sure the first directory block is not a hole
  - ext4: check dot and dotdot of dx_root before making dir indexed
  - !10954  leds: trigger: Unregister sysfs attributes before calling deactivate()
  - bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
  - !10930  libceph: fix race between delayed_work() and ceph_monc_stop()
  - leds: trigger: Unregister sysfs attributes before calling deactivate()
  - drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
  - libceph: fix race between delayed_work() and ceph_monc_stop()
  - !10841  ALSA: gus: fix null pointer dereference on pointer block
  - !10913  sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
  - !10915  usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
  - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
  - sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
  - !10894 v2  netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
  - !10892  crypto: aead,cipher - zeroize key buffer after use
  - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
  - crypto: aead,cipher - zeroize key buffer after use
  - ALSA: gus: fix null pointer dereference on pointer block


author: chenyi <chenyi211@huawei.com> - 4.19.90-2408.5.0.0292
changelog:
  - !11130  iio: adc: men_z188_adc: Fix a resource leak in an error handling path
  - !11132  KVM: x86/mmu: make apf token non-zero to fix bug
  - !11192  af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
  - af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
  - !11150  protect the fetch of ->fd[fd
  - !11117  net/iucv: fix use after free in iucv_sock_close()
  - !11122  fix CVE-2023-52893
  - !11089  f2fs: fix to don't dirty inode for readonly filesystem
  - !11078  nilfs2: fix general protection fault in nilfs_btree_insert()
  - !11047  filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions
  - !11095  exec: Fix ToCToU between perm check and set-uid/gid usage
  - KVM: x86/mmu: make apf token non-zero to fix bug
  - iio: adc: men_z188_adc: Fix a resource leak in an error handling path
  - !11121  scsi: qla2xxx: During vport delete send async logout explicitly
  - !11113  mISDN: Fix a use after free in hfcmulti_tx()
  - gsmi: fix null-deref in gsmi_get_variable
  - scsi: qla2xxx: During vport delete send async logout explicitly
  - net/iucv: fix use after free in iucv_sock_close()
  - !11074  wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
  - mISDN: Fix a use after free in hfcmulti_tx()
  - !11072  drm/virtio: Fix GEM handle creation UAF
  - exec: Fix ToCToU between perm check and set-uid/gid usage
  - !11086  thermal: int340x: fix memory leak in int3400_notify()
  - f2fs: fix to don't dirty inode for readonly filesystem
  - thermal: int340x: fix memory leak in int3400_notify()
  - !11061  Fix CVE-2023-52898
  - nilfs2: fix general protection fault in nilfs_btree_insert()
  - !11068  Fix CVE-2024-39501
  - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
  - drm/virtio: Fix GEM handle creation UAF
  - !11060  parisc: Fix data TLB miss in sba_unmap_sg
  - !11065  i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
  - !11062  ocfs2: add bounds checking to ocfs2_check_dir_entry()
  - driver core: Fix uevent_show() vs driver detach race
  - selftests: forwarding: devlink_lib: Wait for udev events after reloading
  - drivers: core: synchronize really_probe() and dev_uevent()
  - !10992  media: venus: fix use after free in vdec_close
  - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
  - ocfs2: add bounds checking to ocfs2_check_dir_entry()
  - !11001  tipc: Return non-zero value from tipc_udp_addr2str() on error
  - !10987  RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
  - xhci: Fix null pointer dereference when host dies
  - xhci: avoid race between disable slot command and host runtime suspend
  - parisc: Fix data TLB miss in sba_unmap_sg
  - filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64
  - !11037  s390/sclp: Fix sclp_init() cleanup on failure
  - !11021  net: usb: qmi_wwan: fix memory leak for not ip packets
  - s390/sclp: Fix sclp_init() cleanup on failure
  - net: usb: qmi_wwan: fix memory leak for not ip packets
  - !10966  perf: Optimize perf_pmu_migrate_context()
  - tipc: Return non-zero value from tipc_udp_addr2str() on error
  - media: venus: fix use after free in vdec_close
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
  - perf: Optimize perf_pmu_migrate_context()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2409.1.0.0293
changelog:
  - !11383  perf/core: Fix missing wakeup when waiting for context reference
  - !11384  fs/proc: fix softlockup in __read_vmcore
  - !11351  regulator: da9211: Use irq handler when ready
  - !11364  hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - fs/proc: fix softlockup in __read_vmcore
  - perf/core: Fix missing wakeup when waiting for context reference
  - !11242  CVE-2024-43892
  - !11301  ext4: remove the redundant folio_wait_stable()
  - hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
  - !11333  jbd2: avoid mount failed when commit block is partial submitted
  - !11345  netfilter: ctnetlink: use helper function to calculate expect ID
  - regulator: da9211: Use irq handler when ready
  - !11220  io_uring: add a schedule point in io_add_buffers()
  - netfilter: ctnetlink: use helper function to calculate expect ID
  - jbd2: avoid mount failed when commit block is partial submitted
  - !11290  Add exception protection processing for vd in axi_chan_handle_err function
  - !11258  net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()
  - !11215  Fix CVE-2024-40901
  - !11186  Backport bugfix for AMD SMN
  - !11265  mtd: rawnand: hynix: fixed typo
  - !11264  media: xc2028: avoid use-after-free in load_firmware_cb()
  - !11234  efi: fix NULL-deref in init error path
  - ext4: remove the redundant folio_wait_stable()
  - !11266  serial: core: check uartclk for zero to avoid divide by zero
  - Add exception protection processing for vd in axi_chan_handle_err function
  - !11216  scsi: qla2xxx: validate nvme_local_port correctly
  - !11254  mm: avoid overflows in dirty throttling logic
  - serial: core: check uartclk for zero to avoid divide by zero
  - !11189  tcp: fix race in tcp_v6_syn_recv_sock()
  - mtd: rawnand: hynix: fixed typo
  - media: xc2028: avoid use-after-free in load_firmware_cb()
  - !11154  xen/netfront: destroy queues before real_num_tx_queues is zeroed
  - !11259  ACPI: processor_idle: Fix invalid comparison with insertion sort for latency
  - !11260  ACPI: EC: Abort address space access upon error
  - !11261  ACPI: EC: Avoid returning AE_OK on errors in address space handler
  - !11114  sysctl: always initialize i_uid/i_gid
  - !11167  f2fs: let's avoid panic if extent_tree is not created
  - ACPI: EC: Avoid returning AE_OK on errors in address space handler
  - ACPI: EC: Abort address space access upon error
  - ACPI: processor_idle: Fix invalid comparison with insertion sort for latency
  - net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()
  - mm: avoid overflows in dirty throttling logic
  - !11164  usb: vhci-hcd: Do not drop references before new references are gained
  - !11173  tracing: Fix overflow in get_free_elt()
  - memcg: protect concurrent access to mem_cgroup_idr
  - efi: fix NULL-deref in init error path
  - !11185  kobject_uevent: Fix OOB access within zap_modalias_env()
  - !11178  irqchip/alpine-msi: Fix off-by-one in allocation error path
  - io_uring: add a schedule point in io_add_buffers()
  - scsi: qla2xxx: validate nvme_local_port correctly
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
  - scsi: mpt3sas: Gracefully handle online firmware update
  - scsi: mpt3sas: Add ioc_<level> logging macros
  - scsi: mpt3sas: Fix error return code of mpt3sas_base_attach()
  - !11193  net/ipv6: Fix the RT cache flush via sysctl using a previous delay
  - !11209  LTS patches round
  - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
  - net: tcp better handling of reordering then loss cases
  - tcp: tcp_mark_head_lost is only valid for sack-tcp
  - tcp: add ece_ack flag to reno sack functions
  - net/ipv6: Fix the RT cache flush via sysctl using a previous delay
  - tcp: fix race in tcp_v6_syn_recv_sock()
  - x86/amd_nb: Check for invalid SMN reads
  - PCI: Add PCI_ERROR_RESPONSE and related definitions
  - kobject_uevent: Fix OOB access within zap_modalias_env()
  - irqchip/alpine-msi: Fix off-by-one in allocation error path
  - tracing: Fix overflow in get_free_elt()
  - f2fs: let's avoid panic if extent_tree is not created
  - usb: vhci-hcd: Do not drop references before new references are gained
  - xen/netfront: destroy queues before real_num_tx_queues is zeroed
  - sysctl: always initialize i_uid/i_gid


author: chenyi <chenyi211@huawei.com> - 4.19.90-2409.3.0.0294
changelog:
  - !11434 v3  cifs: Fix pages leak when cifs_writedata allocate fails in cifs_writedata_direct_alloc()
  - cifs: Fix pages leak when cifs_writedata allocate fails in cifs_writedata_direct_alloc()
  - !11418  md/raid5: avoid BUG_ON() while continue reshape after reassembling
  - !11426  nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
  - nfc: pn533: initialize struct pn533_out_arg properly
  - nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
  - !11404  usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
  - !11406  net: hns3: do not allow call hns3_nic_net_open repeatedly
  - md/raid5: avoid BUG_ON() while continue reshape after reassembling
  - !11177  dma: fix call order in dmam_free_coherent
  - !11387  usb: gadget: rndis: add spinlock for rndis response list
  - !8301  tty: fix hang on tty device with no_room set
  - !7809  net-memcg: Fix scope of sockmem pressure indicators
  - net: hns3: do not allow call hns3_nic_net_open repeatedly
  - !11386 v5  support block hierarchy stats
  - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
  - !11349  jfs: Fix array-index-out-of-bounds in diFree
  - !11350  devres: Fix memory leakage caused by driver API devm_free_percpu()
  - !11378  drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
  - !11370  nilfs2: handle inconsistent state in nilfs_btnode_create_block()
  - !11367  ibmvnic: free reset-work-item when flushing
  - !11388  dev/parport: fix the array out-of-bounds risk
  - dev/parport: fix the array out-of-bounds risk
  - usb: gadget: rndis: add spinlock for rndis response list
  - blk-io-hierarchy: support new stage for bio lifetime
  - blk-io-hierarchy: support new rq based stage rq_driver
  - blk-io-hierarchy: support new rq based stage requeue
  - blk-io-hierarchy: support new rq based stage hctx
  - blk-io-hierarchy: support new rq based stage kyber
  - blk-io-hierarchy: support new rq based stage bfq
  - blk-io-hierarchy: support new rq based stage mq-deadline
  - blk-io-hierarchy: support new rq based stage plug
  - blk-io-hierarchy: support new bio based stage gettag
  - blk-mq: remove blk_mq_put_ctx()
  - blk-io-hierarchy: support new bio based stage blk-wbt
  - blk-io-hierarchy: support new bio based stage blk-throtl
  - blk-io-hierarchy: support to recored the number of slow IO
  - block-io-hierarchy: core hierarchy iodump implementation
  - block-io-hierarchy: core hierarchy stats implementation
  - block: support to record when request is completed
  - blk-mq-debugfs: factor out a new helper to show allocated request
  - block: block: fix kabi broken for struct blk_mq_alloc_data
  - block: support to recored bio allocation task in request
  - block: fix kabi broken for struct request
  - block: support to recored bio allocation time in request
  - block: support to recored bio allocation task
  - block: support to recored bio allocation time
  - block: fix kabi broken in struct blk_plug
  - block: fix that blk_time_get_ns() doesn't update time after schedule
  - block: limit block time caching to in_task() context
  - block: update cached timestamp post schedule/preemption
  - block: cache current nsec time in struct blk_plug
  - block: add blk_time_get_ns() and blk_time_get() helpers
  - blk-mq: export blk-mq-debugfs apis
  - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
  - nilfs2: handle inconsistent state in nilfs_btnode_create_block()
  - ibmvnic: free reset-work-item when flushing
  - devres: Fix memory leakage caused by driver API devm_free_percpu()
  - jfs: Fix array-index-out-of-bounds in diFree
  - dma: fix call order in dmam_free_coherent
  - tty: fix hang on tty device with no_room set
  - net-memcg: Fix scope of sockmem pressure indicators


author: chenyi <chenyi211@huawei.com> - 4.19.90-2409.4.0.0295
changelog:
  - !11557  xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
  - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
  - !11520  ipv6: prevent UAF in ip6_send_skb()
  - !11532 v2  Fix CVE-2023-52915
  - media: dvb-usb-v2: af9035: fix missing unlock
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
  - !11525 v2  usb: gadget: core: Check for unset descriptor
  - usb: gadget: core: Check for unset descriptor
  - !11512  x86/mtrr: Check if fixed MTRRs exist before saving them
  - ipv6: prevent UAF in ip6_send_skb()
  - x86/mtrr: Check if fixed MTRRs exist before saving them


author: chenyi <chenyi211@huawei.com> - 4.19.90-2409.6.0.0297
changelog:
  - !11816 v3  tools: fix implicit declaration of function __ALIGN_KERNEL
  - tools: fix implicit declaration of function __ALIGN_KERNEL
  - !11786  LTS patch backport
  - !11759  sch/netem: fix use after free in netem_dequeue
  - arm64: cpufeature: Fix the visibility of compat hwcaps
  - arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space
  - irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
  - irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
  - irqchip/mbigen: Fix mbigen node address layout
  - !11737  hwmon: (adc128d818) Fix underflows seen when writing limit attributes
  - !11692  fix CVE-2024-46723
  - !11695  wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
  - !11734  Input: MT - limit max slots
  - sch/netem: fix use after free in netem_dequeue
  - !11722  Squashfs: sanity check symbolic link size
  - !11697  Fix iBMA bug and change version
  - !11700  x86/mm: Fix pti_clone_pgtable() alignment assumption
  - hwmon: (adc128d818) Fix underflows seen when writing limit attributes
  - Input: MT - limit max slots
  - Squashfs: sanity check symbolic link size
  - x86/mm: Fix pti_clone_pgtable() alignment assumption
  - BMA: Fix edma driver initialization problem and change the version number.
  - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
  - !11671 v4  HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
  - drm/amdgpu: fix ucode out-of-bounds read warning
  - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
  - !11645  block: backport debugfs patches
  - !11544  Fix CVE-2024-45025
  - !11560  mm/ksm: fix possible UAF of stable_node
  - !11652  media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
  - media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
  - block: fix kabi broken in struct request_queue
  - block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex'
  - block: shutdown blktrace in blk_release_queue()
  - block: remove per-disk debugfs files in blk_unregister_queue
  - block: serialize all debugfs operations using q->debugfs_mutex
  - blk-mq: Fix spurious debugfs directory creation during initialization
  - block: create the request_queue debugfs_dir on registration
  - blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created
  - blk-mq: fix up placement of debugfs directory of queue files
  - blk-mq: no need to check return value of debugfs_create functions
  - blktrace: annotate required lock on do_blk_trace_setup()
  - blktrace: Avoid sparse warnings when assigning q->blk_trace
  - blktrace: break out of blktrace setup on concurrent calls
  - !11616  mmc: mmc_test: Fix NULL dereference on allocation failure
  - !11610  Input: uinput - reject requests with unreasonable number of slots
  - mmc: mmc_test: Fix NULL dereference on allocation failure
  - Input: uinput - reject requests with unreasonable number of slots
  - !11596  gtp: pull network headers in gtp_dev_xmit()
  - gtp: pull network headers in gtp_dev_xmit()
  - mm/ksm: fix possible UAF of stable_node
  - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
  - s390/cio: rename bitmap_size() -> idset_bitmap_size()
  - bitmap: introduce generic optimized bitmap_size()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2410.1.0.0298
changelog:
  - !12007  Fix CVE-2024-44958 for 4.19
  - !11785  perf/x86: Serialize set_attr_rdpmc()
  - sched/smt: Fix unbalance sched_smt_present dec/inc
  - sched/smt: Introduce sched_smt_present_inc/dec() helper
  - sched: Revert fix unbalance sched_smt_present dec/inc
  - !11918  dhugetlb: make spin_lock irq save
  - !11968  drm/amdgpu: fix mc_data out-of-bounds read warning
  - drm/amdgpu: fix mc_data out-of-bounds read warning
  - !11863  memcg_write_event_control(): fix a user-triggerable oops
  - !11921  hwmon: (lm95234) Fix underflows seen when writing limit attributes
  - !11924  nilfs2: protect references to superblock parameters exposed in sysfs
  - !11842  CVE-2024-46771
  - nilfs2: protect references to superblock parameters exposed in sysfs
  - hwmon: (lm95234) Fix underflows seen when writing limit attributes
  - dhugetlb: make free_huge_page_to_dhugetlb_pool irq safe
  - dhugetlb: avoid lockdep warning with spin_lock_nested
  - dhugetlb: Use helper function to lock/unlock
  - !11789  ALSA: line6: Fix racy access to midibuf
  - !11905  scsi: aacraid: Fix double-free on probe failure
  - !11888  pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  - !11855  VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  - scsi: aacraid: Fix double-free on probe failure
  - !11877  usb: dwc3: st: fix probed platform device ref count on probe error path
  - !11878  PCI: Add missing bridge lock to pci_bus_lock()
  - !11861  hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
  - !11803  CVE-2024-46781
  - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  - PCI: Add missing bridge lock to pci_bus_lock()
  - usb: dwc3: st: fix probed platform device ref count on probe error path
  - !11818  uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  - memcg_write_event_control(): fix a user-triggerable oops
  - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
  - !11703  binder: fix UAF caused by offsets overwrite
  - !11854  fix CVE-2024-46777 for 4.19
  - VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  - udf: Avoid excessive partition lengths
  - udf: Define EFSCORRUPTED error code
  - !11809  apparmor: fix possible NULL pointer dereference
  - !11777  blktrace: fix blktrace is disabled when CONFIG_BLK_DEBUG_FS is disabled
  - can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
  - can: bcm: Remove proc entry when dev is unregistered.
  - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  - apparmor: fix possible NULL pointer dereference
  - nilfs2: fix missing cleanup on rollforward recovery error
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
  - ALSA: line6: Fix racy access to midibuf
  - perf/x86: Serialize set_attr_rdpmc()
  - blktrace: fix blktrace is disabled when CONFIG_BLK_DEBUG_FS is disabled
  - binder: fix UAF caused by offsets overwrite


author: chenyi <chenyi211@huawei.com> - 4.19.90-2410.2.0.0299
changelog:
  - !8720  net: USB: Fix wrong-direction WARNING in plusb.c
  - !12116 [sync] PR-11856:  acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
  - !12071  btrfs: clean up our handling of refs == 0 in snapshot delete
  - !12069  platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - btrfs: clean up our handling of refs == 0 in snapshot delete
  - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
  - !12026  ASoC: meson: axg-card: fix 'use-after-free'
  - !12040  drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
  - !12012  rtmutex: Drop rt_mutex::wait_lock before scheduling
  - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
  - ASoC: meson: axg-card: fix 'use-after-free'
  - rtmutex: Drop rt_mutex::wait_lock before scheduling
  - net: USB: Fix wrong-direction WARNING in plusb.c


author: chenyi <chenyi211@huawei.com> - 4.19.90-2410.3.0.0300
changelog:
  - !12299 v2  ACPI&PCI LTS patches 2024.10
  - !12278  hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
  - ACPI: processor: Fix memory leaks in error paths of processor_add()
  - ntp: Safeguard against time_constant overflow
  - ntp: Clamp maxerror and esterror to operating range
  - Revert "ntp: Avoid undefined behaviour in second_overflow()"
  - arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE
  - hrtimer: Prevent queuing of hrtimer without a function callback
  - smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
  - ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add()
  - !12270  pinctrl: core: fix possible memory leak when pinctrl_enable() fails
  - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
  - pinctrl: core: fix possible memory leak when pinctrl_enable() fails
  - !12220  Fix CVE-2024-46826
  - !12268  selinux: fix potential counting error in avc_add_xperms_decision()
  - selinux: fix potential counting error in avc_add_xperms_decision()
  - !12138  md/raid1: don't free conf on raid0_run failure
  - ELF: Fix mixed declarations and code of "snapshot_randomize_va_space"
  - ELF: fix kernel.randomize_va_space double read
  - md/raid1: don't free conf on raid0_run failure


author: chenyi <chenyi211@huawei.com> - 4.19.90-2411.1.0.0301
changelog:
  - !12501  nbd: fix race between timeout and normal completion
  - !12659  netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
  - !12638  net: do not delay dst_entries_add() in dst_release()
  - !12669  drm/amd/display: Fix index out of bounds in degamma hardware format translation
  - drm/amd/display: Fix index out of bounds in degamma hardware format translation
  - !12627  NFC: nci: Bounds check struct nfc_target arrays
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
  - net: do not delay dst_entries_add() in dst_release()
  - !12623  hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
  - NFC: nci: Bounds check struct nfc_target arrays
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
  - !12592  of/irq: Prevent device address out-of-bounds read in interrupt map walk
  - !12593  pinctrl: single: fix potential NULL dereference in pcs_get_function()
  - !12606  swap: stop add to avail list if swap is full
  - !8931 v2  ext4: avoid deadlock in fs reclaim with page writeback
  - !12566  ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
  - !12558  Fix CVE-2024-49900
  - !12577  gpio: amd8111: Fix PCI device reference count leak
  - swap: stop add to avail list if swap is full
  - !12441  hwmon: (coretemp) Check for null before removing sysfs attrs
  - !12572  media: pci: cx23885: check cx23885_vdev_init() return
  - !12403  drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
  - !12414  nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
  - pinctrl: single: fix potential NULL dereference in pcs_get_function()
  - of/irq: Prevent device address out-of-bounds read in interrupt map walk
  - !12412  btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
  - !12413  udf: Fix preallocation discarding at indirect extent boundary
  - gpio: amd8111: Fix PCI device reference count leak
  - media: pci: cx23885: check cx23885_vdev_init() return
  - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
  - jfs: Fix uninit-value access of new_ea in ea_buffer
  - !12486  gtp: Fix CVE-2024-46677
  - !12475 v2  mm/swapfile: skip HugeTLB pages for unuse_vma
  - !12502  svm: fix UAF/Double Free in svm
  - !12384  drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
  - !12380  fix CVE-2024-46675
  - svm: fix UAF/Double Free in svm
  - nbd: fix race between timeout and normal completion
  - gtp: fix a potential NULL pointer dereference
  - gtp: make sure only SOCK_DGRAM UDP sockets are accepted
  - mm/swapfile: skip HugeTLB pages for unuse_vma
  - !12378  cgroup: Protect css->cgroup write under css_set_lock
  - hwmon: (coretemp) Check for null before removing sysfs attrs
  - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
  - udf: Fix preallocation discarding at indirect extent boundary
  - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
  - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
  - usb: dwc3: core: Prevent USB core invalid event buffer address access
  - usb: dwc3: core: Skip setting event buffers for host only controllers
  - cgroup: Protect css->cgroup write under css_set_lock
  - !12353  ida: Fix crash in ida_free when the bitmap is empty
  - ida: Fix crash in ida_free when the bitmap is empty
  - !12316  backport some LTS patches
  - net: busy-poll: use ktime_get_ns() instead of local_clock()
  - SUNRPC: Fix a race to wake a sync task
  - net: linkwatch: use system_unbound_wq
  - ext4: avoid deadlock in fs reclaim with page writeback


author: chenyi <chenyi211@huawei.com> - 4.19.90-2411.2.0.0302
changelog:
  - !13007  CVE-2024-49950
  - !13041  tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
  - !13052  ext4: fix CVE-2024-47701
  - !12959  ext4: update orig_path in ext4_find_extent()
  - ext4: avoid OOB when system.data xattr changes underneath the filesystem
  - ext4: explicitly exit when ext4_find_inline_entry returns an error
  - ext4: return error on ext4_find_inline_entry
  - ext4: ext4_search_dir should return a proper error
  - ext4: fix RENAME_WHITEOUT handling for inline directories
  - !12899  ext4: fix double brelse() the buffer of the extents path
  - !12895  ext4: aovid use-after-free in ext4_ext_insert_extent()
  - !13011  CVE-2024-49878
  - !13001  iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
  - !12997  net: fix crash when config small gso_max_size/gso_ipv4_max_size
  - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
  - resource: fix region_intersects() vs add_memory_driver_managed()
  - mm/resource: Use resource_overlaps() to simplify region_intersects()
  - Bluetooth: L2CAP: Fix uaf in l2cap_connect
  - Bluetooth: Return whether a connection is outbound
  - !12891  ext4: avoid use-after-free in ext4_ext_show_leaf()
  - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
  - net: fix crash when config small gso_max_size/gso_ipv4_max_size
  - !12860  drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
  - !12924  CVE-2022-48966
  - !12938  ASoC: soc-pcm: Add NULL check in BE reparenting
  - !12863  CVE-2022-49020
  - !12873  tipc: guard against string buffer overrun
  - ext4: update orig_path in ext4_find_extent()
  - !12919  ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
  - !12925  RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
  - !12792  HID: core: fix shift-out-of-bounds in hid_report_raw_event
  - !12743  net/xen-netback: prevent UAF in xenvif_flush_hash()
  - !12846  ACPI: sysfs: validate return type of _STR method
  - ASoC: soc-pcm: Add NULL check in BE reparenting
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
  - net: mvneta: Fix an out of bounds check
  - net: mvneta: Prevent out of bounds read in mvneta_config_rss()
  - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
  - !12804  ext4: fix CVE-2024-49884
  - !12783  mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  - !12782  net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
  - !12784  net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
  - !12785  slip: make slhc_remember() more robust against malicious packets
  - !12852  iio: health: afe4403: Fix oob read in afe4403_read_raw
  - !12813  serial: protect uart_port_dtr_rts() in uart_shutdown() too
  - ext4: fix double brelse() the buffer of the extents path
  - ext4: aovid use-after-free in ext4_ext_insert_extent()
  - !12842  NFSv4: release seqid when open failed for nfs4.0
  - ext4: avoid use-after-free in ext4_ext_show_leaf()
  - !12887  nfs: fix memory lead and nfs_server uaf
  - !12882  Bluetooth: Fix not cleanup led when bt_init fails
  - !12881  igb: Initialize mailbox message for VF reset
  - nfs: maintain nfs_server in the reclaim process
  - nfs: fix memory leak in error path of nfs4_do_reclaim
  - Bluetooth: Fix not cleanup led when bt_init fails
  - igb: Initialize mailbox message for VF reset
  - tipc: guard against string buffer overrun
  - net/9p: Fix a potential socket leak in p9_socket_open
  - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
  - !12815  media: venus: fix use after free bug in venus_remove due to race condition
  - !12814  iio: health: afe4404: Fix oob read in afe4404_[read|write
  - iio: health: afe4403: Fix oob read in afe4403_read_raw
  - ACPI: sysfs: validate return type of _STR method
  - NFSv4: release seqid when open failed for nfs4.0
  - !12757  drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
  - !12777  selinux: add the processing of the failure of avc_add_xperms_decision()
  - !12750  usb: gadget: uvc: Prevent buffer overflow in setup handler
  - !12760  smack: tcp: ipv4, fix incorrect labeling
  - media: venus: fix use after free bug in venus_remove due to race condition
  - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
  - serial: protect uart_port_dtr_rts() in uart_shutdown() too
  - !12732  net: phy: fix null-ptr-deref while probe() failed
  - !12721  ppp: fix ppp_async_encode() illegal access
  - ext4: fix slab-use-after-free in ext4_split_extent_at()
  - ext4: avoid ext4_error()'s caused by ENOMEM in the truncate path
  - HID: core: fix shift-out-of-bounds in hid_report_raw_event
  - slip: make slhc_remember() more robust against malicious packets
  - net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  - net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
  - selinux: add the processing of the failure of avc_add_xperms_decision()
  - smack: tcp: ipv4, fix incorrect labeling
  - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
  - !12614  writeback: Fix inode->i_io_list not be protected by inode->i_lock error
  - usb: gadget: uvc: Prevent buffer overflow in setup handler
  - !12366  fix CVE-2022-49011
  - !12704  fix CVE-2024-49924
  - !12519  fix CVE-2024-47742
  - net/xen-netback: prevent UAF in xenvif_flush_hash()
  - net: phy: fix null-ptr-deref while probe() failed
  - ppp: fix ppp_async_encode() illegal access
  - !12683  nilfs2: fix state management in error path of log writing function
  - fbdev: pxafb: Fix possible use after free in pxafb_task()
  - nilfs2: fix state management in error path of log writing function
  - init: Initialize noop_backing_dev_info early
  - writeback: Fix inode->i_io_list not be protected by inode->i_lock error
  - firmware_loader: Block path traversal
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2411.3.0.0303
changelog:
  - !13165  security/keys: fix slab-out-of-bounds in key_task_permission
  - !13150  net: fix data-races around sk->sk_forward_alloc
  - security/keys: fix slab-out-of-bounds in key_task_permission
  - net: fix data-races around sk->sk_forward_alloc
  - !13068  nfs: fix rpc_task use-after-free when open and close different files concurrently
  - nfs: fix rpc_task use-after-free when open and close different files concurrently


author: chenyi <chenyi211@huawei.com> - 4.19.90-2411.4.0.0304
changelog:
  - !13286  wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
  - !13305  CVE-2024-50195
  - !13209  fix CVE-2024-50115
  - posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
  - posix-clock: Fix missing timespec64 check in pc_clock_settime()
  - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
  - !13274  CVE-2024-50117
  - drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
  - drm/amd: Guard against bad data for ATIF ACPI method
  - !13254  Revert "sched/dynamic_affinity: fix preffered_cpu offline problem"
  - Revert "sched/dynamic_affinity: fix preffered_cpu offline problem"
  - !13249  sched/dynamic_affinity: fix preffered_cpu offline problem
  - sched/dynamic_affinity: fix preffered_cpu offline problem
  - !13213  CVE-2024-47745
  - mm: split critical region in remap_file_pages() and invoke LSMs in between
  - mm: call the security_mmap_file() LSM hook in remap_file_pages()
  - mm/mmap.c: don't unlock VMAs in remap_file_pages()
  - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
  - !13138  fs: call fsnotify_sb_delete after evict_inodes
  - !13187 v3  sched: smart_grid: Prevent double-free in sched_grid_qos_free
  - !13188  serial: core: Fix atomicity violation in uart_tiocmget
  - serial: core: Fix atomicity violation in uart_tiocmget
  - sched: smart_grid: Prevent double-free in sched_grid_qos_free
  - fs: call fsnotify_sb_delete after evict_inodes


author: chenyi <chenyi211@huawei.com> - 4.19.90-2411.5.0.0305
changelog:
  - !13821  tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  - !13451 bugfix of nfs
  - !13426  media: s5p-jpeg: prevent buffer overflows
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  - !13424  btrfs: reinitialize delayed ref list after deleting it from the list
  - !13423  nfs: Fix KMSAN warning in decode_getfattr_attrs()
  - NFS: make sure open context mode have FMODE_EXEC when file open for exec
  - media: s5p-jpeg: prevent buffer overflows
  - btrfs: reinitialize delayed ref list after deleting it from the list
  - nfs: Fix KMSAN warning in decode_getfattr_attrs()
  - !13346  nilfs2: propagate directory read errors from nilfs_find_entry()
  - !13349  ceph: remove the incorrect Fw reference check when dirtying pages
  - !13351  lts backport 11
  - irqchip/gic-v3: Force propagation of the active state with a read-back
  - ceph: remove the incorrect Fw reference check when dirtying pages
  - nilfs2: propagate directory read errors from nilfs_find_entry()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2412.1.0.0306
changelog:
  - !13959  fs: Fix uninitialized value issue in from_kuid and from_kgid
  - !13796  vfs: fix race between evice_inodes() and find_inode()&iput()
  - !13925  CVE-2024-50236
  - !13892  crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
  - fs: Fix uninitialized value issue in from_kuid and from_kgid
  - wifi: ath10k: Fix memory leak in management tx
  - ath10k: Remove msdu from idr when management pkt send fails
  - !13879  Fix problems of mounting nfs
  - !13866  Bluetooth: bnep: fix wild-memory-access in proto_unregister
  - !13459  io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
  - !13460  ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
  - crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
  - !13852  sctp: properly validate chunk size in sctp_sf_ootb()
  - !13875  bpf: Fix out-of-bounds write in trie_get_next_key()
  - nfs: ignore SB_RDONLY when mounting nfs
  - nfs: pass flags to second superblock
  - bpf: Fix out-of-bounds write in trie_get_next_key()
  - Bluetooth: bnep: fix wild-memory-access in proto_unregister
  - !13812  nilfs2: fix kernel bug due to missing clearing of checked flag
  - sctp: properly validate chunk size in sctp_sf_ootb()
  - nilfs2: fix kernel bug due to missing clearing of checked flag
  - vfs: fix race between evice_inodes() and find_inode()&iput()
  - ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
  - io_uring/rw: fix missing NOWAIT check for O_DIRECT start write


author: chenyi <chenyi211@huawei.com> - 4.19.90-2412.2.0.0307
changelog:
  - !14068  media: v4l2-tpg: prevent the risk of a division by zero
  - !14116  media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
  - !14051  fix CVE-2024-50278
  - !14080  USB: serial: io_edgeport: fix use after free in debug printk
  - !14077  usb: typec: altmode should keep reference to parent
  - !14075  HID: core: zero-initialize the report buffer
  - USB: serial: io_edgeport: fix use after free in debug printk
  - usb: typec: altmode should keep reference to parent
  - HID: core: zero-initialize the report buffer
  - media: v4l2-tpg: prevent the risk of a division by zero
  - dm cache: fix potential out-of-bounds access on the first resume
  - dm cache: optimize dirty bit checking with find_next_bit when resizing
  - dm cache: fix out-of-bounds access to the dirty bitset when resizing


author: chenyi <chenyi211@huawei.com> - 4.19.90-2412.3.0.0308
changelog:
  - !14186  nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
  - !14156  Bluetooth: Fix CVE-2024-50125
  - !14157  net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
  - !14158  be2net: fix potential memory leak in be_xmit()
  - !14160  net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
  - !14159  netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
  - !14192  nfs: fix the loss of superblock's initialized flags
  - nfs: fix the loss of superblock's initialized flags
  - nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
  - !14147  CVE-2024-53142
  - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
  - netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
  - be2net: fix potential memory leak in be_xmit()
  - net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
  - Bluetooth: SCO: Fix UAF on sco_sock_timeout
  - Bluetooth: call sock_hold earlier in sco_conn_del
  - initramfs: avoid filename buffer overrun


author: chenyi <chenyi211@huawei.com> - 4.19.90-2412.4.0.0309
changelog:
  - !14248  Fix CVE-2024-50194
  - !14285  ACPI: battery: Fix possible crash when unregistering a battery hook
  - !14265  PCI: Mark Creative Labs EMU20k2 INTx masking as broken
  - !14264  PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
  - !14262  x86/apic: Always explicitly disarm TSC-deadline timer
  - ACPI: battery: Fix possible crash when unregistering a battery hook
  - !14249  smb: client: Fix use-after-free of network namespace.
  - !14267  backport LTS commits
  - ACPI: battery: Simplify battery hook locking
  - ACPICA: iasl: handle empty connection_node
  - ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
  - ACPI: EC: Do not release locks during operation region accesses
  - ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
  - ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
  - ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
  - x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
  - PCI: Mark Creative Labs EMU20k2 INTx masking as broken
  - PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
  - x86/apic: Always explicitly disarm TSC-deadline timer
  - !14261  io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
  - !14255  cgroup: Fix potential overflow issue when checking max_depth
  - cgroup: Fix potential overflow issue when checking max_depth
  - !14240  sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
  - !14239  sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
  - !14245  selinux: improve error checking in sel_write_load()
  - smb: client: Fix use-after-free of network namespace.
  - arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning
  - arm64: probes: Fix uprobes for big-endian kernels
  - arm64:uprobe fix the uprobe SWBP_INSN in big-endian
  - !14233  block, bfq: fix possible UAF for bfqq->bic with merge chain
  - selinux: improve error checking in sel_write_load()
  - !14181  net: Fix icmp host relookup triggering ip_rt_bug
  - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
  - sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
  - block, bfq: fix possible UAF for bfqq->bic with merge chain
  - !14139  ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
  - !14167  CVE-2024-46733
  - net: Fix icmp host relookup triggering ip_rt_bug
  - btrfs: fix the length of reserved qgroup to free
  - btrfs: fix qgroup reserve leaks in cow_file_range
  - ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow


author: chenyi <chenyi211@huawei.com> - 4.19.90-2412.5.0.0310
changelog:
  - !14357  media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
  - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
  - !14326  mm: Backport mainline patch
  - !14324  mm: shmem: don't truncate page if memory failure happens
  - !14310  signal: Replace BUG_ON()s
  - mm/hugetlb: fix nodes huge page allocation when there are surplus pages
  - mm/compaction: correctly return failure with bogus compound_order in strict mode
  - mm: shmem: don't truncate page if memory failure happens
  - !14306  printk: Fix the qspinlock deadloop caused by zap_locks()
  - signal: Replace BUG_ON()s
  - printk: Fix the qspinlock deadloop caused by zap_locks()
  - !14176  padata: make padata_do_parallel find alternate callback CPU
  - !14000 scsi: smartpqi: add no_write_same for logical volumes
  - !14290  ACPI: PMIC: fix compile error
  - !14288  dhugetlb: keep refcount to 0 while page is actually free in pool
  - ACPI: PMIC: fix compile error
  - dhugetlb: keep refcount to 0 while page is actually free in pool
  - padata: make padata_do_parallel find alternate callback CPU
  - scsi: smartpqi: add no_write_same for logical volumes


author: chenyi <chenyi211@huawei.com> - 4.19.90-2501.1.0.0311
changelog:
  - !14726  etmem: fix use-after-free of mm in the scan release process
  - !14603  scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
  - !14658  ALSA: us122l: Use snd_card_free_when_closed() at disconnection
  - !14411  ALSA: 6fire: Release resources at card release
  - !14633  backport mainline bugfix patch
  - !14708  CVE-2024-53158
  - !14596  ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
  - !14707  CVE-2024-56746
  - !14432  hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
  - !14570  PCI: Fix use-after-free of slot->bus on hot remove
  - !14706  9p/xen: fix release of IRQ
  - !14390  CVE-2024-53173
  - etmem: fix use-after-free of mm in the scan release process
  - !14521  netlink: terminate outstanding dump on socket close
  - soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
  - fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
  - fbdev/sh7760fb: Alloc DMA memory from hardware device
  - 9p/xen: fix release of IRQ
  - !14421  sh: intc: Fix use-after-free bug in register_intc_controller()
  - !14556  um: ubd: Do not use drvdata in release
  - !14647  memcg: fix soft lockup in the OOM process
  - !14551  selinux: ignore unknown extended permissions
  - !14566  um: net: Do not use drvdata in release
  - !14567  vfio/pci: Properly hide first-in-list PCIe extended capability
  - !14549  media: wl128x: Fix atomicity violation in fmc_send_cmd()
  - !14646  media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
  - !14641  net: Fix CVE-2024-47684
  - !14640  xfrm: validate new SA's prefixlen using SA family when sel.family is unset
  - !14430  crypto: bcm - add error check in the ahash_hmac_init function
  - !14565  wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
  - ALSA: us122l: Use snd_card_free_when_closed() at disconnection
  - !14297  netfilter: ipset: add missing range check in bitmap_ip_uadt
  - memcg: fix soft lockup in the OOM process
  - media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
  - tcp: check skb is non-NULL in tcp_rto_delta_us()
  - tcp: introduce tcp_skb_timestamp_us() helper
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset
  - genirq/msi: Fix off-by-one error in msi_domain_alloc()
  - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
  - ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
  - PCI: Fix use-after-free of slot->bus on hot remove
  - vfio/pci: Properly hide first-in-list PCIe extended capability
  - um: net: Do not use drvdata in release
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
  - um: ubd: Do not use drvdata in release
  - selinux: ignore unknown extended permissions
  - media: wl128x: Fix atomicity violation in fmc_send_cmd()
  - !14500  sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
  - !14413  sched/dynamic_affinity: Calculate cpu capacity in real time when realtime tasks are running on this cpu
  - netlink: terminate outstanding dump on socket close
  - sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
  - !14398  printk: Skip log flush in NMI context when logbuf_lock is held
  - hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
  - crypto: bcm - add error check in the ahash_hmac_init function
  - !14386  fix CVE-2024-53197
  - !14361  CVE-2024-53217
  - sh: intc: Fix use-after-free bug in register_intc_controller()
  - !14098  vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
  - !14360  nfs: nfs4_callback_compound should put client with async mode
  - !14404  NFSD: Prevent a potential integer overflow
  - sched/dynamic_affinity: Calculate cpu capacity in real time when realtime tasks are running on this cpu
  - ALSA: 6fire: Release resources at card release
  - NFSD: Prevent a potential integer overflow
  - printk: Skip log flush in NMI context when logbuf_lock is held
  - NFSv4.0: Fix a use-after-free problem in the asynchronous open()
  - NFSv4.0: Fix the wake up of the next waiter in nfs_release_seqid()
  - Revert "NFSv4: release seqid when open failed for nfs4.0"
  - Revert "nfs: fix rpc_task use-after-free when open and close different files concurrently"
  - ALSA: usb-audio: Fix a DMA to stack memory bug
  - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
  - nfsd: restore callback functionality for NFSv4.0
  - NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
  - nfs: nfs4_callback_compound should put client with async mode
  - netfilter: ipset: add missing range check in bitmap_ip_uadt
  - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans


author: chenyi <chenyi211@huawei.com> - 4.19.90-2501.3.0.0312
changelog:
  - !14858  ALSA: usb-audio: Fix out of bounds reads when finding clock sources
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources
  - !14843  acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
  - !14740  NFSv4: Fix deadlock during the running of state manager
  - !14837 v2  fs: Filter specific inodes to prevent UAF issues
  - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
  - fs: Filter specific inodes to prevent UAF issues
  - !14826 v2  mm: hugetlb: independent PMD page table shared count
  - mm: hugetlb: independent PMD page table shared count
  - !14812  net: af_can: do not leave a dangling sk pointer in can_create()
  - net: af_can: do not leave a dangling sk pointer in can_create()
  - !14661  firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
  - !14482  nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
  - !14484  ovl: Filter invalid inodes with missing lookup function
  - !14485  ocfs2: fix uninitialized value in ocfs2_file_read_iter()
  - !14773  CVE-2024-56642
  - !14748  BMA: Fix Oops and spin lock deadlock problem, and change the version number.
  - !14744  rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
  - tipc: fix NULL deref in cleanup_bearer()
  - tipc: Fix use-after-free of kernel socket in cleanup_bearer().
  - tipc: remove ub->ubsock checks
  - BMA: Fix Oops and spin lock deadlock problem, and change the version number.
  - rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
  - NFSv4: Fix deadlock during the running of state manager
  - firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
  - ocfs2: fix uninitialized value in ocfs2_file_read_iter()
  - ovl: Filter invalid inodes with missing lookup function
  - nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2501.4.0.0313
changelog:
  - !14254 [openEuler-1.0-LTS]fix wangxun 1G/10G drivers hardware tx unit hang.
  - net: wangxun: change netdev uc addr num maxmium
  - net: wangxun: fix resolving ipv6 pakets extension header errors
  - net: wangxun: fix tx csum by soft except tcp udp sctp
  - !14871  quota: flush quota_release_work upon quota writeback
  - !9360 Add support for Hygon model 10h processors
  - !14864  drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
  - !14850  Fix rt warning
  - quota: flush quota_release_work upon quota writeback
  - drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
  - sched: Replace WARN_ON_ONCE to printk_deferred_once
  - sched/rt: Fix rt_runtime leaks with cpu hotplug
  - ALSA: hda: Add support for Hygon family 18h model 10h HD-Audio
  - hwmon/k10temp: Add support for Hygon family 18h model 10h
  - EDAC/amd64: Add support for Hygon family 18h model 10h
  - x86/amd_nb: Add support for Hygon family 18h model 10h
  - x86/cpu: Get LLC ID for Hygon family 18h model 10h


author: chenyi <chenyi211@huawei.com> - 4.19.90-2502.1.0.0314
changelog:
  - !14942  fix CVE-2024-57892
  - ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
  - ocfs2: correct return value of ocfs2_local_free_info()
  - !14933  scsi: sg: Fix slab-use-after-free read in sg_release()
  - scsi: sg: Fix slab-use-after-free read in sg_release()
  - !14919  bpf: fix OOB devmap writes when deleting elements
  - bpf: fix OOB devmap writes when deleting elements


author: chenyi <chenyi211@huawei.com> - 4.19.90-2502.2.0.0315
changelog:
  - !15050  brd: fix AA deadlock for concurrent brd_probe()
  - !15030  nbd: don't allow reconnect after disconnect
  - brd: fix AA deadlock for concurrent brd_probe()
  - !15017  spi: mpc52xx: Add cancel_work_sync before module remove
  - !15042  drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
  - !14978  CVE-2024-56604_openEuler-1.0-LTS
  - !15012  Bluetooth: L2CAP: fix CVE-2024-56605
  - !14999  scsi: bfa: Fix use-after-free in bfad_im_module_exit()
  - drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
  - !14992  ALSA: seq: oss: Fix races at processing SysEx messages
  - !14996  mm/compaction: fix UBSAN shift-out-of-bounds warning
  - nbd: don't allow reconnect after disconnect
  - spi: mpc52xx: Add cancel_work_sync before module remove
  - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
  - Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
  - scsi: bfa: Fix use-after-free in bfad_im_module_exit()
  - mm/compaction: fix UBSAN shift-out-of-bounds warning
  - ALSA: seq: oss: Fix races at processing SysEx messages
  - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
  - Bluetooth: Consolidate code around sk_alloc into a helper function


author: chenyi <chenyi211@huawei.com> - 4.19.90-2502.3.0.0316
changelog:
  - !15116  netfilter: conntrack: clamp maximum hashtable size to INT_MAX
  - !15115  netfilter: x_tables: fix LED ID check in led_tg_check()
  - !15114 v3  net: Fix CVE-2024-56658
  - !14895  ceph: prevent use-after-free in encode_cap_msg()
  - !15131  xsk: fix OOB map writes when deleting elements
  - xsk: fix OOB map writes when deleting elements
  - !15058  net: let net.core.dev_weight always be non-zero
  - netfilter: conntrack: clamp maximum hashtable size to INT_MAX
  - netfilter: x_tables: fix LED ID check in led_tg_check()
  - net: Fix kabi breakage in struct net
  - net: defer final 'struct net' free in netns dismantle
  - net: let net.core.dev_weight always be non-zero
  - ceph: prevent use-after-free in encode_cap_msg()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2502.4.0.0317
changelog:
  - !9357 Add support for Hygon model 7h processors
  - !15138  drm/amdgpu: fix usage slab after free
  - drm/amdgpu: fix usage slab after free
  - perf/x86/uncore: Add L3 PMU support for Hygon family 18h model 7h
  - EDAC/amd64: Add support for Hygon family 18h model 7h
  - x86/amd_nb: Add support for Hygon family 18h model 7h


author: chenyi <chenyi211@huawei.com> - 4.19.90-2503.1.0.0318
changelog:
  - !15314  drm/imx: Fix memory leak in imx_pd_connector_get_modes
  - !15313  video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
  - !15285  tcp: Defer ts_recent changes until req is owned
  - !15256  ata: sata_dwc_460ex: Fix crash due to OOB write
  - drm/imx: Fix memory leak in imx_pd_connector_get_modes
  - video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
  - tcp: Defer ts_recent changes until req is owned
  - !15262  blk-iolatency: Fix inflight count imbalances and IO hangs on offline
  - !15193  Roll back the setting of nfs superblock s_flags.
  - blk-iolatency: Fix inflight count imbalances and IO hangs on offline
  - ata: sata_dwc_460ex: Fix crash due to OOB write
  - Revert "nfs: ignore SB_RDONLY when mounting nfs"
  - Revert "nfs: pass flags to second superblock"
  - Revert "nfs: fix the loss of superblock's initialized flags"


author: chenyi <chenyi211@huawei.com> - 4.19.90-2503.3.0.0319
changelog:
  - !15415  tracing/histograms: Fix memory leak problem
  - !15415  tracing/histograms: Fix memory leak problem
  - tracing/histograms: Fix memory leak problem
  - !15398  RDMA/hfi1: Prevent use of lock before it is initialized
  - !15401  hfsplus: don't query the device logical block size multiple times
  - !15401  hfsplus: don't query the device logical block size multiple times
  - !15399  drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
  - !15399  drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
  - !15411 v2  Ignore SB_RDONLY when mounting and remounting nfs
  - !15411 v2  Ignore SB_RDONLY when mounting and remounting nfs
  - !15337  net: tipc: fix possible refcount leak in tipc_sk_create()
  - !15336  CVE-2025-21702
  - !15335  net: sched: Disallow replacing of child qdisc from one parent to another
  - !15335  net: sched: Disallow replacing of child qdisc from one parent to another
  - nfs: ignore SB_RDONLY when remounting nfs
  - nfs: clear SB_RDONLY before getting superblock
  - !15393  powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup
  - !15392  ARM: hisi: Add missing of_node_put after of_find_compatible_node
  - !15392  ARM: hisi: Add missing of_node_put after of_find_compatible_node
  - !15275  scsi: libfc: Fix use after free in fc_exch_abts_resp()
  - !15297  af_packet: avoid erroring out after sock_init_data() in packet_create()
  - !15297  af_packet: avoid erroring out after sock_init_data() in packet_create()
  - hfsplus: don't query the device logical block size multiple times
  - drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
  - RDMA/hfi1: Prevent use of lock before it is initialized
  - !15374  can: gs_usb: gs_usb_open/close(): fix memory leak
  - !15332  Fix CVE-2022-49253
  - !15381  iio: trigger: sysfs: fix use-after-free on remove
  - !15386  crypto: qat - add param check for DH
  - !15353  rtl818x: Prevent using not initialized queues
  - !15354  drm/amdkfd: Check for potential null return of kmalloc_array()
  - !15231  cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0
  - powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup
  - ARM: hisi: Add missing of_node_put after of_find_compatible_node
  - !15240  smb: client: Fix netns refcount imbalance
  - crypto: qat - add param check for DH
  - iio: trigger: sysfs: fix use-after-free on remove
  - !15361  md/bitmap: don't set sb values if can't pass sanity check
  - !15361  md/bitmap: don't set sb values if can't pass sanity check
  - !15351  dm integrity: fix memory corruption when tag_size is less than digest size
  - !15350  video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
  - can: gs_usb: gs_usb_open/close(): fix memory leak
  - !15075 v4  Fix CVE-2023-52572 in openEuler-1.0-LTS
  - !15287  bpf, arm64: Clear prog->jited_len along prog->jited
  - md/bitmap: don't set sb values if can't pass sanity check
  - !15324  Fix Fix CVE-2022-49351
  - !15329  Fix CVE-2022-49308
  - drm/amdkfd: Check for potential null return of kmalloc_array()
  - rtl818x: Prevent using not initialized queues
  - dm integrity: fix memory corruption when tag_size is less than digest size
  - video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
  - !15282  fix CVE-2022-49404
  - !15282  fix CVE-2022-49404
  - !15273  ARM: davinci: da850-evm: Avoid NULL pointer dereference
  - !15273  ARM: davinci: da850-evm: Avoid NULL pointer dereference
  - !15303  md/raid1: fix memory leak in raid1_run() if no active rdev
  - !15304  md: bypass block throttle for superblock update
  - !15318  md/raid1: fix bitmap update when all write requests fail
  - !15318  md/raid1: fix bitmap update when all write requests fail
  - net: tipc: fix possible refcount leak in tipc_sk_create()
  - pfifo_tail_enqueue: Drop new packet when sch->limit == 0
  - net_sched: sch_fifo: implement lockless __fifo_dump()
  - net: sched: Disallow replacing of child qdisc from one parent to another
  - media: usb: go7007: s2250-board: fix leak in probe()
  - extcon: Modify extcon device to be created after driver data is set
  - extcon: Fix error handling in extcon_dev_register
  - net: altera: Fix refcount leak in altera_tse_mdio_create
  - md/raid1: fix bitmap update when all write requests fail
  - md: bypass block throttle for superblock update
  - md/raid1: fix memory leak in raid1_run() if no active rdev
  - af_packet: avoid erroring out after sock_init_data() in packet_create()
  - bpf, arm64: Clear prog->jited_len along prog->jited
  - RDMA/hfi1: Fix potential integer multiplication overflow errors
  - scsi: libfc: Fix use after free in fc_exch_abts_resp()
  - ARM: davinci: da850-evm: Avoid NULL pointer dereference
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free
  - smb: client: fix TCP timers deadlock after rmmod
  - cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0
  - cifs: Fix UAF in cifs_demultiplex_thread()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2503.4.0.0320
changelog:
  - !15574  some CVE fixes
  - rtc: mt6397: check return value after calling platform_get_resource()
  - nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
  - drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
  - !15503  ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
  - !15500  Fix 4 CVEs in JFFS2
  - !15544  ext4: fix race condition between ext4_write and ext4_convert_inline_data
  - !15521  ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
  - ext4: fix race condition between ext4_write and ext4_convert_inline_data
  - ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
  - !15495  drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume
  - !15372  xtensa: Fix refcount leak bug in time.c
  - !15494  mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
  - ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
  - !15448  vrf: use RCU protection in l3mdev_l3_out()
  - !15433  scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
  - !15432  CVE-2022-49087
  - !15486  mm: fix unexpected zeroed page mapping with zram swap
  - !15487  CVE-2022-49514
  - !15485  media: venus: hfi: avoid null dereference in deinit
  - !15484  drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected
  - jffs2: fix memory leak in jffs2_do_fill_super
  - jffs2: fix memory leak in jffs2_do_mount_fs
  - jffs2: fix memory leak in jffs2_scan_medium
  - jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
  - drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume
  - mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
  - !15371  pinctrl: ralink: Check for null return of devm_kcalloc
  - !15343  ipw2x00: Fix potential NULL dereference in libipw_xmit()
  - !15342  drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
  - !15425  CVE-2022-49513
  - ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe
  - ASoC: mediatek: mt8173: fix device_node leak
  - mm: fix unexpected zeroed page mapping with zram swap
  - media: venus: hfi: avoid null dereference in deinit
  - drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected
  - !15461  be2net: Fix buffer overflow in be_get_module_eeprom
  - !15443  i40e: Fix call trace in setup_tx_descriptors
  - !15442  nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred
  - !15458  sfc: fix kernel panic when creating VF
  - be2net: Fix buffer overflow in be_get_module_eeprom
  - sfc: fix kernel panic when creating VF
  - vrf: use RCU protection in l3mdev_l3_out()
  - i40e: Fix call trace in setup_tx_descriptors
  - nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred
  - scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
  - rxrpc: Restore removed timer deletion
  - rxrpc: fix a race in rxrpc_exit_net()
  - cpufreq: governor: Use kobject release() method to free dbs_data
  - cpufreq: Move to_gov_attr_set() to cpufreq.h
  - xtensa: Fix refcount leak bug in time.c
  - pinctrl: ralink: Check for null return of devm_kcalloc
  - ipw2x00: Fix potential NULL dereference in libipw_xmit()
  - drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes


author: chenyi <chenyi211@huawei.com> - 4.19.90-2503.5.0.0321
changelog:
  - !15605  mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
  - !15600  vfio/platform: check the bounds of read/write syscalls
  - !15633  ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
  - !15634  ALSA: oss: Fix PCM OSS buffer allocation overflow
  - ALSA: oss: Fix PCM OSS buffer allocation overflow
  - ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
  - !15582  CVE-2022-49508
  - !15467  net: mdio: unexport __init-annotated mdio_bus_init()
  - !15465  CVE-2022-49490
  - !15604 v3  rtc: Fix race when disable/enable UIE in rtc_set_time()
  - !15583  block: fix error unwinding in blk_register_queue
  - mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
  - rtc: Fix race when disable/enable UIE in rtc_set_time()
  - rtc: Cleanup for UIE timer/polling emulation support
  - vfio/platform: check the bounds of read/write syscalls
  - !15586  scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
  - scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
  - !15569  ubi: ubi_create_volume: Fix use-after-free when volume creation failed
  - !15579  block: Fix handling of offline queues in blk_mq_alloc_request_hctx()
  - !15578  scsi: target: tcmu: Fix possible page UAF
  - !15577  drm/plane: Move range check for format_count earlier
  - !15576  drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.
  - block: fix error unwinding in blk_register_queue
  - HID: elan: Fix potential double free in elan_input_configured
  - HID: elan: Fix memleak in elan_input_configured
  - block: Fix handling of offline queues in blk_mq_alloc_request_hctx()
  - scsi: target: tcmu: Fix possible page UAF
  - drm/plane: Move range check for format_count earlier
  - drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.
  - ubi: ubi_create_volume: Fix use-after-free when volume creation failed
  - net: mdio: unexport __init-annotated mdio_bus_init()
  - drm/msm/mdp5: Fix global state lock backoff
  - drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected


author: chenyi <chenyi211@huawei.com> - 4.19.90-2504.1.0.0322
changelog:
  - !15491  dlm: fix plock invalid read
  - !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
  - !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
  - !15653  tty: goldfish: Fix free_irq() on remove
  - !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
  - !15703  tracing: Make sure trace_printk() can output as soon as it can be used
  - !15702  trace_events_hist: add check for return value of 'create_hist_field'
  - !15708  f2fs: fix dereference of stale list iterator after loop body
  - f2fs: fix dereference of stale list iterator after loop body
  - tracing: Make sure trace_printk() can output as soon as it can be used
  - !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
  - !15509  ath9k_htc: fix uninit value bugs
  - !15506  phy: qcom-qmp: fix struct clk leak on probe errors
  - !15505  net: sfp: fix memory leak in sfp_probe()
  - trace_events_hist: add check for return value of 'create_hist_field'
  - !15647  nilfs2: do not force clear folio if buffer is referenced
  - !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
  - !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
  - !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
  - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
  - !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
  - !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
  - !15663  ARM: versatile: Add missing of_node_put in dcscb_init
  - !15504  um: Fix out-of-bounds read in LDT setup
  - !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
  - ARM: versatile: Add missing of_node_put in dcscb_init
  - media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
  - ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
  - !15502  wifi: mac80211: fix use-after-free in chanctx code
  - !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
  - !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
  - !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
  - !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
  - Revert "smb: client: fix TCP timers deadlock after rmmod"
  - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
  - media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
  - tty: goldfish: Fix free_irq() on remove
  - nilfs2: do not force clear folio if buffer is referenced
  - ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
  - ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
  - ath9k_htc: fix uninit value bugs
  - scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
  - phy: qcom-qmp: fix struct clk leak on probe errors
  - net: sfp: fix memory leak in sfp_probe()
  - um: Fix out-of-bounds read in LDT setup
  - wifi: mac80211: fix use-after-free in chanctx code
  - cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
  - dlm: fix plock invalid read
  - ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
  - ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
  - can: m_can: m_can_tx_handler(): fix use after free of skb
  - ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
  - net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register


author: chenyi <chenyi211@huawei.com> - 4.19.90-2504.2.0.0323
changelog:
  - !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
  - !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
  - !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
  - !15377  virtio_console: eliminate anonymous module_init & module_exit
  - bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
  - dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
  - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
  - !15784  HID: betop: check shape of output reports
  - HID: betop: check shape of output reports
  - !15740  ftrace: Avoid potential division by zero in function_stat_show()
  - !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
  - !15637  net_sched: sch_sfq: don't allow 1 packet limit
  - !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
  - !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
  - !15638  CVE-2022-49374
  - !15692  tty: fix deadlock caused by calling printk() under tty_port->lock
  - !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
  - !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
  - !15691  media: uvcvideo: Fix double free in error path
  - !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
  - !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
  - dmaengine: Fix double increment of client_count in dma_chan_get()
  - EDAC/highbank: Fix memory leak in highbank_mc_probe()
  - bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
  - ftrace: Avoid potential division by zero in function_stat_show()
  - !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
  - drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
  - !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
  - !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
  - !15632  macsec: fix UAF bug for real_dev
  - !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  - !15688  usb: usbip: fix a refcount leak in stub_probe()
  - !15713  CVE-2022-49370
  - !15712  drbd: Fix five use after free bugs in get_initial_state
  - !15619  partitions: mac: fix handling of bogus partition table
  - !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
  - !15720  nfc: nci: add flush_workqueue to prevent uaf
  - phy: qcom-qmp: fix reset-controller leak on probe errors
  - nfc: nci: add flush_workqueue to prevent uaf
  - firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
  - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
  - drbd: Fix five use after free bugs in get_initial_state
  - fs/dcache: fix bad unlock balance in shrink_dentry_list()
  - firmware: arm_scmi: Fix list protocols enumeration in the base protocol
  - rxrpc: Fix listen() setting the bar too high for the prealloc rings
  - tty: fix deadlock caused by calling printk() under tty_port->lock
  - media: uvcvideo: Fix double free in error path
  - usb: usbip: fix a refcount leak in stub_probe()
  - drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  - drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
  - regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
  - tipc: check attribute length for bearer name
  - tipc: add extack messages for bearer/media failure
  - net_sched: sch_sfq: don't allow 1 packet limit
  - macsec: fix UAF bug for real_dev
  - partitions: mac: fix handling of bogus partition table
  - cpufreq: pmac32-cpufreq: Fix refcount leak bug
  - virtio_console: eliminate anonymous module_init & module_exit


author: chenyi <chenyi211@huawei.com> - 4.19.90-2504.3.0.0324
changelog:
  - !15862  tty: goldfish: Use tty_port_destroy() to destroy port
  - tty: goldfish: Use tty_port_destroy() to destroy port
  - !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  - !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
  - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  - !15664  CVE-2025-21858
  - !15815  dm raid: fix accesses beyond end of raid member array
  - !15368  nfsd: clear acl_access/acl_default after releasing them
  - !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
  - vc_screen: don't clobber return value in vcs_read
  - vc_screen: modify vcs_size() handling in vcs_read()
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
  - !15380  media: cx25821: Fix the warning when removing the module
  - !15649  media: uvcvideo: Remove dangling pointers
  - !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
  - dm raid: fix accesses beyond end of raid member array
  - wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
  - geneve: Suppress list corruption splat in geneve_destroy_tunnels().
  - geneve: Fix use-after-free in geneve_find_dev().
  - media: uvcvideo: Remove dangling pointers
  - media: cx25821: Fix the warning when removing the module
  - nfsd: clear acl_access/acl_default after releasing them
  - NFSD: prevent underflow in nfssvc_decode_writeargs()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2504.4.0.0325
changelog:
  - !15624  proc: fix use-after-free in proc_get_inode()
  - !15900  Backport mainline patches to avoid crash caused by rsize being 0
  - !15820  io_uring: prevent opcode speculation
  - !15751  fix-CVE-2022-49538
  - !15914  block: fix resource leak in blk_register_queue() error path
  - !15930  loop: fix UAF in mutex_spin_on_owner()
  - loop: loop_set_status_from_info() check before assignment
  - Revert "loop: loop_set_status_from_info() check before assignment"
  - block: fix resource leak in blk_register_queue() error path
  - smb: client: Update IO sizes after reconnection
  - smb: client: Store original IO parameters and prevent zero IO sizes
  - smb:client: smb: client: Add reverse mapping from tcon to superblocks
  - Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0"
  - !15830  ASoC: rt5645: Fix errorenous cleanup order
  - ASoC: rt5645: Fix errorenous cleanup order
  - io_uring: prevent opcode speculation
  - ALSA: jack: Fix mutex call in snd_jack_report()
  - ALSA: jack: Access input_dev under mutex
  - proc: fix use-after-free in proc_get_inode()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2505.1.0.0326
changelog:
  - !16154  driver: base: fix UAF when driver_attach failed
  - !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
  - !16153  scsi: pm8001: Fix abort all task initialization
  - !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
  - !16107  qede: confirm skb is allocated before using
  - !16112  mpage: fix softlockup in mpage_readahead()
  - !16104  md/raid1,raid10: don't ignore IO flags
  - driver: base: fix UAF when driver_attach failed
  - !16151  can: peak_usb: fix use after free bugs
  - scsi: pm8001: Fix abort all task initialization
  - video: fbdev: cirrusfb: check pixclock to avoid divide by zero
  - !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
  - can: peak_usb: fix use after free bugs
  - ipv6: mcast: extend RCU protection in igmp6_send()
  - !16142  CVE-2023-53023
  - !16077  CVE-2022-49626
  - !16078  CVE-2022-49429
  - net: nfc: Fix use-after-free in local_cleanup()
  - !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
  - !16122  ndisc: extend RCU protection in ndisc_send_skb()
  - !16111  arp: use RCU protection in arp_xmit()
  - !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
  - !16109  net: Fix CVE-2025-21763
  - !16126  net: openvswitch: fix leak of nested actions
  - net: mdio: validate parameter addr in mdiobus_get_phy()
  - net: openvswitch: fix leak of nested actions
  - netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
  - ndisc: extend RCU protection in ndisc_send_skb()
  - mpage: fix softlockup in mpage_readahead()
  - arp: use RCU protection in arp_xmit()
  - openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
  - neighbour: use RCU protection in __neigh_notify()
  - neighbour: delete redundant judgment statements
  - qede: confirm skb is allocated before using
  - md/raid1,raid10: don't ignore IO flags
  - !16082  CVE-2021-47668
  - !16089  mm/khugepaged: fix ->anon_vma race
  - !16071  Backport SMC patchs
  - mm/khugepaged: fix ->anon_vma race
  - !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
  - can: dev: can_restart: fix use after free bug
  - can: dev: can_restart(): post buffer from the right context
  - RDMA/hfi1: Prevent panic when SDMA is disabled
  - sfc: fix use after free when disabling sriov
  - sfc: error code if SRIOV cannot be disabled
  - net/smc: fix restoring of fallback changes
  - net/smc: fix closing of fallback SMC sockets
  - net/smc: propagate file from SMC to TCP socket
  - !16067  net: fix geneve_opt length integer overflow
  - !16058  udp: Fix memory accounting leak.
  - !16029  CVE-2022-49647
  - !16064  ndisc: Fix CVE-2025-21764
  - net: fix geneve_opt length integer overflow
  - ndisc: use RCU protection in ndisc_alloc_skb()
  - net: add dev_net_rcu() helper
  - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
  - udp: Fix memory accounting leak.
  - !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
  - !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
  - jfs: add check read-only before truncation in jfs_truncate_nolock()
  - !16032  net: atm: fix use after free in lec_send()
  - net: atm: fix use after free in lec_send()
  - cgroup: fix kabi for css_set
  - cgroup: Use separate src/dst nodes when preloading css_sets for migration
  - !15993  Fix CVE-2025-37785
  - !15984  vlan: enforce underlying device type
  - ext4: fix OOB read when checking dotdot dir
  - ext4: optimize __ext4_check_dir_entry()
  - !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
  - vlan: enforce underlying device type
  - !15953  Fix CVE-2020-36789
  - !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
  - tracing: Fix use-after-free in print_graph_function_flags during tracer switching
  - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
  - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
  - drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
  - staging: rtl8712: fix uninit-value in r871xu_drv_init()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2505.3.0.0327
changelog:
  - !16177  Fix CVE-2022-49850
  - !16176  Fix CVE-2022-49842
  - !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
  - !16188  nvmet: avoid potential UAF in nvmet_req_complete()
  - !16238  dm ioctl: fix misbehavior if list_versions races with module loading
  - !16200  drm/amdkfd: Fix an illegal memory access
  - dm ioctl: fix misbehavior if list_versions races with module loading
  - !16175  Fix CVE-2022-49915
  - drm/amdkfd: Fix an illegal memory access
  - nvmet: avoid potential UAF in nvmet_req_complete()
  - ata: libata-transport: fix double ata_host_put() in ata_tport_add()
  - nilfs2: fix deadlock in nilfs_count_free_blocks()
  - ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
  - ASoC: core: Fix use-after-free in snd_soc_exit()
  - mISDN: fix misuse of put_device() in mISDN_register_device()
  - mISDN: fix possible memory leak in mISDN_register_device()
  - !16139  Bluetooth: Fix use after free in hci_send_acl
  - !16140  NFC: NULL out the dev->rfkill to prevent UAF
  - !16145  CVE-2022-49755
  - usb: gadget: f_fs: Add unbind event before functionfs_unbind
  - usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
  - usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
  - NFC: NULL out the dev->rfkill to prevent UAF
  - Bluetooth: Fix use after free in hci_send_acl


author: chenyi <chenyi211@huawei.com> - 4.19.90-2505.4.0.0328
changelog:
  - !15445 Add IOAPIC support for Hygon family 18h model 10h
  - !15444 Add LS and IF mce types for Hygon family 18h model 7h
  - !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
  - !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
  - !16203  ext4: fix off-by-one error in do_split
  - !16221  jbd2: remove wrong sb->s_sequence check
  - !16205  ext4: update s_journal_inum if it changes after journal replay
  - !16288  scsi: core: Clear driver private data when retrying request
  - bpf: Fix WARN() in get_bpf_raw_tp_regs
  - !15446 Add support for Hygon family 18h model 8h
  - !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
  - !16290  CVE-2024-57982
  - !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
  - !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
  - !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
  - mISDN: fix possible memory leak in mISDN_dsp_element_register()
  - net: fix kabi broken in struct netns_xfrm
  - xfrm: state: fix out-of-bounds read during lookup
  - net: xfrm: Localize sequence counter per network namespace
  - scsi: core: Clear driver private data when retrying request
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
  - x86: Enhanced copy capabilities for Hygon processor
  - kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
  - jbd2: remove wrong sb->s_sequence check
  - ext4: update s_journal_inum if it changes after journal replay
  - ext4: fix off-by-one error in do_split
  - EDAC/amd64: Add support for Hygon family 18h model 8h
  - x86/amd_nb: Add support for Hygon family 18h model 8h
  - iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
  - EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
  - x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h


author: chenyi <chenyi211@huawei.com> - 4.19.90-2505.5.0.0329
changelog:
  - !16353  CVE-2022-49769
  - !16417  dm-bufio: don't schedule in atomic context
  - !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
  - !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
  - dm-bufio: don't schedule in atomic context
  - HID: hyperv: fix possible memory leak in mousevsc_probe()
  - !16375  CVE-2025-37752
  - net_sched: sch_sfq: move the limit validation
  - net_sched: sch_sfq: use a temporary work area for validating configuration
  - gfs2: Check sb_bsize_shift after reading superblock
  - gfs2: add validation checks for size of superblock


author: chenyi <chenyi211@huawei.com> - 4.19.90-2506.1.0.0330
changelog:
  - !16548  mm/vmscan: don't try to reclaim hwpoison folio
  - !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
  - !16294  fs/jfs: Prevent integer overflow in AG size calculation
  - mm/vmscan: don't try to reclaim hwpoison folio
  - !16534  memcg: always call cond_resched() after fn()
  - memcg: always call cond_resched() after fn()
  - !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
  - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
  - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
  - fs/jfs: Prevent integer overflow in AG size calculation


author: chenyi <chenyi211@huawei.com> - 4.19.90-2506.2.0.0331
changelog:
  - !16577  capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
  - !16306 [openEuler-1.0-LTS] scsi: libsas: Abort all in-flight requests when device is gone
  - !16583  module: ensure that kobject_put() is safe for module type kobjects
  - !16598  vgacon: Add check for vc_origin address range in vgacon_scroll()
  - !16616  pci:vga fix race condition in vga_arb_write
  - !16495  dm crypt: add cond_resched() to dmcrypt_write()
  - !16540  scsi: target: Fix WRITE_SAME No Data Buffer crash
  - pci:vga fix race condition in vga_arb_write
  - vgacon: Add check for vc_origin address range in vgacon_scroll()
  - module: ensure that kobject_put() is safe for module type kobjects
  - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
  - scsi: target: Fix WRITE_SAME No Data Buffer crash
  - scsi: libsas: Abort all in-flight requests when device is gone
  - dm crypt: add cond_resched() to dmcrypt_write()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2506.3.0.0332
changelog:
  - !16650  mm/vmscan: fix hwpoisoned THP handling in shrink_page_list
  - mm/vmscan: fix hwpoisoned THP handling in shrink_page_list


author: chenyi <chenyi211@huawei.com> - 4.19.90-2506.4.0.0333
changelog:
  - !16754  video: fbdev: amba-clcd: Fix refcount leak bugs
  - !16704  ima: prevent concurrent list operations in ima_lsm_update_rules
  - video: fbdev: amba-clcd: Fix refcount leak bugs
  - !16554 [openEuler-1.0-LTS] PCI: Supplement ACS quirk for more Zhaoxin Root Ports
  - PCI: Supplement ACS quirk for more Zhaoxin Root Ports
  - PCI: Add ACS quirk for more Zhaoxin Root Ports
  - ima: prevent concurrent list operations in ima_lsm_update_rules


author: chenyi <chenyi211@huawei.com> - 4.19.90-2507.1.0.0334
changelog:
  - !16854  ftrace: Fix UAF when lookup kallsym after ftrace disabled
  - !16802  tty: vt: initialize unicode screen buffer
  - !16856  ipvs: fix WARNING in ip_vs_app_net_cleanup()
  - ipvs: fix WARNING in ip_vs_app_net_cleanup()
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled
  - !16846  Fix CVE-2025-38058
  - !16835  erspan: do not use skb_mac_header() in ndo_start_xmit()
  - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
  - do_umount(): add missing barrier before refcount checks in sync case
  - !16834  kcm: close race conditions on sk_receive_queue
  - !16833  qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
  - !16832  net: usb: smsc95xx: Limit packet length to skb->len
  - !16831  CVE-2023-53125
  - erspan: do not use skb_mac_header() in ndo_start_xmit()
  - kcm: close race conditions on sk_receive_queue
  - qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
  - net: usb: smsc95xx: Limit packet length to skb->len
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
  - net: usb: smsc75xx: Limit packet length to skb->len
  - !16823  hidraw:·fix·memory·leak·in·hidraw_release
  - HID: hidraw: fix a problem of memory leak in hidraw_release()
  - HID: hidraw: fix memory leak in hidraw_release()
  - !16811  ARM: OMAP2+: display: Fix refcount leak bug
  - !16796  spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
  - !16810  CVE-2022-50080
  - ARM: OMAP2+: display: Fix refcount leak bug
  - !16800  media: pvrusb2: fix memory leak in pvr_probe
  - tee: fix compiler warning in tee_shm_register()
  - tee: add overflow check in register_shm_helper()
  - tty: vt: initialize unicode screen buffer
  - media: pvrusb2: fix memory leak in pvr_probe
  - spmi: trace: fix stack-out-of-bound access in SPMI tracing functions


author: chenyi <chenyi211@huawei.com> - 4.19.90-2507.2.0.0335
changelog:
  - !17017  ipvlan: Fix out-of-bounds caused by unclear skb->cb in I2e mode
  - !17018 v2  bnxt_en: Fix out-of-bound memcpy() during ethtool -w
  - !16962  firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
  - !16945  scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
  - !17021  dm raid: fix address sanitizer warning in raid_status
  - dm raid: fix address sanitizer warning in raid_status
  - !17005  sch_htb: Fix CVE-2025-37932
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w
  - ipvlan: Fix out-of-bounds caused by unclear skb->cb in I2e mode
  - !16941 v2  dm: fix unconditional IO throttle caused by REQ_PREFLUSH
  - sch_htb: make htb_deactivate() idempotent
  - sch_htb: make htb_qlen_notify() idempotent
  - !16987  PCI/GPU: fix hard lockup in vga_arb_release
  - !16974  iavf: Fix reset error handling
  - !16975  RDMA/rxe: Fix error unwind in rxe_create_qp()
  - !16976  RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  - !16978  usbnet: Fix linkwatch use-after-free on disconnect
  - !16979  RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
  - PCI/GPU: fix hard lockup in vga_arb_release
  - !16980  arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
  - !16923  PM: hibernate: defer device probing when resuming from hibernation
  - arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
  - RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
  - usbnet: Fix linkwatch use-after-free on disconnect
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  - RDMA/rxe: Fix error unwind in rxe_create_qp()
  - iavf: Fix reset error handling
  - !16953  usb: host: ohci-ppc-of: Fix refcount leak bug
  - !16955  dm raid: fix address sanitizer warning in raid_resume
  - !16928  net: mdio: fix undefined behavior in bit shift for __mdiobus_register
  - !16929  tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
  - !16960  wifi: cfg80211: fix memory leak in query_regdb_file()
  - !16961  CVE-2022-49871
  - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
  - net: tun: call napi_schedule_prep() to ensure we own a napi
  - net: tun: Fix memory leaks of napi_get_frags
  - wifi: cfg80211: fix memory leak in query_regdb_file()
  - dm raid: fix address sanitizer warning in raid_resume
  - !16913  drm/amd/display: clear optc underflow before turn off odm clock
  - usb: host: ohci-ppc-of: Fix refcount leak bug
  - !16910  KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
  - !16931  md: call __md_stop_writes in md_stop
  - !16930  md-raid10: fix KASAN warning
  - scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
  - dm: fix unconditional IO throttle caused by REQ_PREFLUSH
  - !16506  ipvs: fix WARNING in __ip_vs_cleanup_batch()
  - !16505  net: sched: Fix use after free in red_enqueue()
  - !16917  nfs: handle failure of nfs_get_lock_context in unlock path
  - md: call __md_stop_writes in md_stop
  - md-raid10: fix KASAN warning
  - tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
  - net: mdio: fix undefined behavior in bit shift for __mdiobus_register
  - !16920  net: atlantic: fix aq_vec index out of range error
  - !16921  net: tunnels: annotate lockless accesses to dev->needed_headroom
  - PM: hibernate: defer device probing when resuming from hibernation
  - !16907  crypto: algif_hash - fix double free in hash_accept
  - net: tunnels: annotate lockless accesses to dev->needed_headroom
  - !16890  sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed
  - !16889  scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
  - net: atlantic: fix aq_vec index out of range error
  - !16876  hulk-4.19-fix-CVE-2022-49989
  - nfs: handle failure of nfs_get_lock_context in unlock path
  - !16904  wifi: mac80211: Fix UAF in ieee80211_scan_rx()
  - !16888  drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
  - drm/amd/display: clear optc underflow before turn off odm clock
  - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
  - !16824  cifs: fix small mempool leak in SMB2_negotiate()
  - !16825  smb: client: Fix use-after-free in cifs_fill_dirent
  - crypto: algif_hash - fix double free in hash_accept
  - !16900  regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
  - wifi: mac80211: Fix UAF in ieee80211_scan_rx()
  - regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
  - !16869  vt: Clear selection before changing the font
  - !16873  mtd: maps: Fix refcount leak in ap_flash_init
  - !16871  ALSA: bcd2000: Fix a UAF bug on the error path of probing
  - !16878  wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
  - !16867  drivers:md:fix a potential use-after-free bug
  - sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed
  - scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
  - drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
  - wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
  - xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
  - xen/privcmd: Corrected error handling path
  - mtd: maps: Fix refcount leak in ap_flash_init
  - ALSA: bcd2000: Fix a UAF bug on the error path of probing
  - vt: Clear selection before changing the font
  - drivers:md:fix a potential use-after-free bug
  - smb: client: Reset all search buffer pointers when releasing buffer
  - smb: client: Fix use-after-free in cifs_fill_dirent
  - cifs: fix small mempool leak in SMB2_negotiate()
  - ipvs: fix WARNING in __ip_vs_cleanup_batch()
  - net: sched: Fix use after free in red_enqueue()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2507.3.0.0336
changelog:
  - !17108  arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  - !17113  Bluetooth: btrtl: Prevent potential NULL dereference
  - Bluetooth: btrtl: Prevent potential NULL dereference
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  - !17057  media: cxusb: no longer judge rbuf when the write fails
  - !17073  Revert "dm-bufio: don't schedule in atomic context"
  - Revert "dm-bufio: don't schedule in atomic context"
  - !17046 v2  net: Fix CVE-2025-38000
  - media: cxusb: no longer judge rbuf when the write fails
  - sch_cbq: make cbq_qlen_notify() idempotent
  - net/sched: Always pass notifications when child class becomes empty
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
  - sch_qfq: make qfq_qlen_notify() idempotent
  - sch_hfsc: make hfsc_qlen_notify() idempotent
  - sch_drr: make drr_qlen_notify() idempotent


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2507.4.0.0337
changelog:
  - !17221  net/sched: Abort __tc_modify_qdisc if parent class does not exist
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist
  - !17147  jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2507.5.0.0338
changelog:
  - !17008  perf: Fix sample vs do_exit()
  - !17313  usb: typec: altmodes/displayport: do not index invalid pin_assignments
  - !17302  fs/writeback: bail out if there is no more inodes for IO and queued once
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments
  - fs/writeback: bail out if there is no more inodes for IO and queued once
  - !17097  smb: client: fix use-after-free in cifs_oplock_break
  - !17129  ipc: fix to protect IPCS lookups using RCU
  - !17130  fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
  - !17263  mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
  - ipc: fix to protect IPCS lookups using RCU
  - smb: client: fix use-after-free in cifs_oplock_break
  - perf: Fix sample vs do_exit()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2508.1.0.0339
changelog:
  - !17509 v2  ext4: add bounds checking in get_max_inline_xattr_value_size()
  - ext4: add bounds checking in get_max_inline_xattr_value_size()
  - !17482  mm: Fix possible deadlock in console_trylock_spinning
  - mm: Fix possible deadlock in console_trylock_spinning
  - !17456  md/raid1: Fix stack memory use after return in raid1_reshape
  - !17460 v2  net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  - !17448  vsock/vmci: Clear the vmci transport packet properly when initializing it
  - net: vlan: Fix kabi breakage of struct vlan_info
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  - md/raid1: Fix stack memory use after return in raid1_reshape
  - !17397  Squashfs: check return result of sb_min_blocksize
  - vsock/vmci: Clear the vmci transport packet properly when initializing it
  - !17314  ovl: fix general protection fault in security_inode_getattr
  - !17420  bcache: fix NULL pointer in cache_set_flush()
  - !17431  ACPICA: Refuse to evaluate a method if arguments are missing
  - !17409  usb: net: sierra: check for no status endpoint
  - !17426 EDAC/amd64: Fix the calculation of umc base for Hygon family 18h model 4h
  - !17392  atm: clip: Fix infinite recursive call of clip_push().
  - ACPICA: Refuse to evaluate a method if arguments are missing
  - EDAC/amd64: Fix the calculation of umc base for Hygon family 18h model 4h
  - bcache: fix NULL pointer in cache_set_flush()
  - usb: net: sierra: check for no status endpoint
  - Squashfs: check return result of sb_min_blocksize
  - !17040  net: ch9200: fix uninitialised access during mii_nway_restart
  - atm: clip: Fix infinite recursive call of clip_push().
  - !17348  calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  - !17369  ext4: inline: fix len overflow in ext4_prepare_inline_data
  - !17220  Fix the race of lock/unlock and open for nfs
  - ext4: inline: fix len overflow in ext4_prepare_inline_data
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  - ovl: fix general protection fault in security_inode_getattr
  - nfs: do not unlock when no lock is held
  - nfs: fix the race of lock/unlock and open
  - net: ch9200: fix uninitialised access during mii_nway_restart


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2508.2.0.0340
changelog:
  - !17478 EDAC/amd64: Do not warn when removing instances
  - EDAC/amd64: Do not warn when removing instances
  - !17552 [openEuler-1.0-LTS] Revert "scsi: hisi_sas: fix a issue related to timer of internal IO and SMP IO"
  - !17535  net/sched: sch_qfq: Fix CVE-2025-38477
  - Revert "scsi: hisi_sas: fix a issue related to timer of internal IO and SMP IO"
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2508.3.0.0341
changelog:
  - !17764  mm/smaps: fix race between smaps_hugetlb_range and migration
  - mm/smaps: fix race between smaps_hugetlb_range and migration
  - !17736 v2  mm/dpool: mark dpool hugetlb page as dirty in free_huge_page()
  - !17684  HID: core: do not bypass hid_hw_raw_request
  - mm/dpool: mark dpool hugetlb page as dirty in free_huge_page()
  - !17732  CVE-2025-38180
  - net: atm: fix /proc/net/atm/lec handling
  - net: atm: add lec_mutex
  - !17607  drm/sched: Increment job count before swapping tail spsc queue
  - HID: core: do not bypass hid_hw_raw_request
  - drm/sched: Increment job count before swapping tail spsc queue
  - !17562  sched: Fix sched tunable parameter range overflow
  - sched: Fix sched tunable parameter range overflow


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2509.1.0.0342
changelog:
  - !17822  iwlwifi: Add missing check for alloc_ordered_workqueue
  - !17814  crypto: ccp - Fix crash when rebind ccp device for ccp.ko
  - !17819  jbd2: prevent softlockup in jbd2_log_do_checkpoint()
  - !17829  ipv6: reject malicious packets in ipv6_gso_segment()
  - !17827  net/packet: fix a race in packet_set_ring() and packet_notifier()
  - !17828  vsock: Do not allow binding to VMADDR_PORT_ANY
  - ipv6: reject malicious packets in ipv6_gso_segment()
  - vsock: Do not allow binding to VMADDR_PORT_ANY
  - net/packet: fix a race in packet_set_ring() and packet_notifier()
  - iwlwifi: Add missing check for alloc_ordered_workqueue
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint()
  - !17812  net: bridge: fix soft lockup in br_multicast_query_expired()
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko
  - net: bridge: fix soft lockup in br_multicast_query_expired()
  - !17528  clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
  - !17761  Fix oob when trace_get_user failed
  - tracing: Limit access to parser->buffer when trace_get_user failed
  - tracing: Remove unneeded goto out logic
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2509.4.0.0343
changelog:
  - !17935  ftrace: Also allocate and copy hash for reading of filter files
  - ftrace: Also allocate and copy hash for reading of filter files
  - !17920  x86/smp: ignore reboot IPI when stopping_cpu contains value
  - x86/smp: ignore reboot IPI when stopping_cpu contains value
  - !17905 [openEuler-1.0-LTS] perf/zhaoxin/uncore: Enhance uncore support and fix related
  - perf/zhaoxin/uncore: Enhance uncore support and fix related bugs
  - !17891  wifi: mac80211: reject TDLS operations when station is not associated
  - !17873  blk-cgroup: Use cond_resched() when destroy blkgs
  - wifi: mac80211: reject TDLS operations when station is not associated
  - !17878  Fix CVE-2025-38498
  - !17843  NFSv4: Fail mounts if the lease setup times out
  - use uniform permission checks for all mount propagation changes
  - do_change_type(): refuse to operate on unmounted/not ours mounts
  - blk-cgroup: Use cond_resched() when destroy blkgs
  - NFSv4: Fail mounts if the lease setup times out


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2509.5.0.0344
changelog:
  - !8566 [openEuler-1.0-LTS] Update a series of xhci-related Zhaoxin patches
  - !18002  gfs2: Validate i_depth for exhash directories
  - !17998  fix CVE-2025-38449
  - gfs2: Validate i_depth for exhash directories
  - drm: fix kabi for struct drm_framebuffer
  - drm/gem: Acquire references on GEM handles for framebuffers
  - drm/print: introduce new struct drm_device based WARN* macros
  - xhci: Add ZHAOXIN xHCI host U1/U2 feature support
  - Revert "xhci: Add Zhaoxin xHCI LPM U1/U2 feature support"
  - xhci: Show ZHAOXIN xHCI root hub speed correctly
  - Revert "xhci: Show Zhaoxin XHCI root hub speed correctly"
  - Revert "xhci: Fix a logic issue when display Zhaoxin XHCI root hub speed"
  - xhci: Fix TRB prefetch issue of ZHAOXIN hosts
  - Revert "xhci: fix issue of cross page boundary in TRB prefetch"
  - xhci: Fix resume issue of some ZHAOXIN hosts
  - Revert "xhci: fix issue with resume from system Sx state"


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2509.6.0.0345
changelog:
  - !18098  drivers: serial: jsm: fix some leaks in probe
  - !18074  tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
  - !18085  Fix CVE-2022-50343
  - !18022  ALSA: usb-audio: Validate UAC3 power domain descriptors, too
  - drivers: serial: jsm: fix some leaks in probe
  - rapidio: fix possible name leaks when rio_add_device() fails
  - tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2510.1.0.0346
changelog:
  - !17921  nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
  - !18255  scsi: qla2xxx: Pointer may be dereferenced
  - !18257  udf: Do not update file length for failed writes to inline files
  - !18261  drm/radeon: Fix integer overflow in radeon_cs_parser_init
  - !18174  fix CVE-2022-50384 and CVE-2022-50249
  - !18252  mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init
  - udf: Do not update file length for failed writes to inline files
  - scsi: qla2xxx: Pointer may be dereferenced
  - !18163  x86/MCE: Always save CS register on AMD Zen IF Poison errors
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
  - !18185  crypto: cavium - prevent integer overflow loading firmware
  - !18113  wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
  - !18198  drm/radeon: Add the missed acpi_put_table() to fix memory leak
  - !18187  media: uvcvideo: Handle cameras with invalid descriptors
  - !18134  wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
  - !18181  udf: Fix uninitialized array access for some pathnames
  - !18139  ALSA: hda: Fix Oops by 9.1 surround channel names
  - !18141  sched/core: Fix potential deadlock on rq lock
  - !18121  nfsd: call op_release, even when op_func returns an error
  - !18148  rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
  - !18158  firewire: net: fix use after free in fwnet_finish_incoming_packet()
  - !18109  recordmcount: Fix memory leaks in the uwrite function
  - drm/radeon: Add the missed acpi_put_table() to fix memory leak
  - media: uvcvideo: Handle cameras with invalid descriptors
  - crypto: cavium - prevent integer overflow loading firmware
  - !18136  sched/fair: Don't balance task to its current running CPU
  - !18137  VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
  - udf: Fix uninitialized array access for some pathnames
  - staging: vme_user: Fix possible UAF in tsi148_dma_list_add
  - memory: of: Fix refcount leak bug in of_get_ddr_timings()
  - !18142  Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
  - x86/MCE: Always save CS register on AMD Zen IF Poison errors
  - firewire: net: fix use after free in fwnet_finish_incoming_packet()
  - !18135  wifi: ath9k: verify the expected usb_endpoints are present
  - !18108  tee: fix NULL pointer dereference in tee_shm_put
  - !18069  fs: writeback: fix use-after-free in __mark_inode_dirty()
  - !18065  btrfs: fix BUG_ON condition in btrfs_cancel_balance
  - !18132  Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
  - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
  - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
  - sched/core: Fix potential deadlock on rq lock
  - ALSA: hda: Fix Oops by 9.1 surround channel names
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
  - sched/fair: Don't balance task to its current running CPU
  - wifi: ath9k: verify the expected usb_endpoints are present
  - wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
  - !18125  mm: vmscan: fix page cache limit work condition
  - Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
  - !18042  scsi: target: iscsi: Fix a race condition between login_work and the login thread
  - !18039  ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
  - mm: vmscan: fix page cache limit work condition
  - nfsd: call op_release, even when op_func returns an error
  - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
  - recordmcount: Fix memory leaks in the uwrite function
  - tee: fix NULL pointer dereference in tee_shm_put
  - fs: writeback: fix use-after-free in __mark_inode_dirty()
  - btrfs: fix BUG_ON condition in btrfs_cancel_balance
  - scsi: target: iscsi: Fix a race condition between login_work and the login thread
  - ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2510.2.0.0347
changelog:
  - !18323  platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx
  - !18329  umount performance fix
  - !18347  Add Huawei Intelligent Network Card Driver: hinic3
  - !18349  vme: Fix error not catched in fake_init()
  - vme: Fix error not catched in fake_init()
  - Add Huawei Intelligent Network Card Driver: hinic3
  - !18066  NFSD: Protect against send buffer overflow in NFSv2 READ
  - !18337  drm/i915/gvt: fix vgpu debugfs clean in remove
  - !18332  kobject: Add sanity check for kset->kobj.ktype in kset_register()
  - drm/i915/gvt: fix vgpu debugfs clean in remove
  - kobject: Add sanity check for kset->kobj.ktype in kset_register()
  - do_make_slave(): choose new master sanely
  - change_mnt_propagation(): do_make_slave() is a no-op unless IS_MNT_SHARED()
  - change_mnt_propagation() cleanups, step 1
  - !18115  media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
  - !18318  CVE-2023-53254
  - !18317  scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
  - !18302  mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
  - platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
  - drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug
  - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
  - scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
  - mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
  - !18176  fix race between memory offline and UCE handling
  - !18175  watchdog: Fix kmemleak in watchdog_cdev_register
  - !18111  mmc: vub300: fix return value check of mmc_add_host()
  - !18145  PNP: fix name memory leak in pnp_alloc_dev()
  - !18285  Bluetooth: L2CAP: Fix user-after-free
  - Bluetooth: L2CAP: Fix user-after-free
  - !18193 v3  fix CVE-2025-38709
  - !18008  scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
  - !18274  wifi: mwifiex: Fix OOB and integer underflow when rx packets
  - !18238  wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
  - !18239  wifi: mac80211: fix memory leak in ieee80211_if_add()
  - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
  - wifi: mwifiex: Fix missed return in oob checks failed path
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets
  - wifi: mac80211: fix memory leak in ieee80211_if_add()
  - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
  - loop: Avoid updating block size under exclusive owner
  - block: use bd_prepare_to_claim directly in the loop driver
  - mm/memory_hotplug: fix hwpoisoned large folio handling in do_migrate_range()
  - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
  - watchdog: Fix kmemleak in watchdog_cdev_register
  - PNP: fix name memory leak in pnp_alloc_dev()
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
  - mmc: vub300: fix return value check of mmc_add_host()
  - NFSD: Protect against send buffer overflow in NFSv2 READ
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2510.3.0.0348
changelog:
  - !18072  CVE-2023-53431
  - !18469  e1000e: fix heap overflow in e1000_set_eeprom
  - !18396  scsi: target: target_core_configfs: Add length check to avoid buffer overflow
  - !18380  iommu/amd: Fix pci device refcount leak in ppr_notifier()
  - !18379  Fix CVE-2022-50494
  - !18468 scsi/hifc: Fix rport dev loss tmo flag and function parameter check err
  - e1000e: fix heap overflow in e1000_set_eeprom
  - scsi/hifc: Fix rport dev loss tmo flag and function parameter check err
  - !18315  fs: quota: create dedicated workqueue for quota_release_work
  - !18399  scsi: qla4xxx: Add length check when parsing nlattrs
  - !18359  CVE-2022-50341
  - !18210  drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
  - !18209  md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
  - !18208  fix CVE-2023-53357
  - !18207  md/raid10: fix wrong setting of max_corr_read_errors
  - !18206  nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
  - !18205  md/raid10: prevent soft lockup while flush writes
  - !18204  md/raid10: fix leak of 'r10bio->remaining' for recovery
  - !18203  md: Replace snprintf with scnprintf
  - !18408  udf: Do not bother merging very long extents
  - !18373  mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
  - !18377  clk: samsung: Fix memory leak in _samsung_clk_register_pll()
  - !18333  scsi: qla2xxx: Wait for io return on terminate rport
  - !17992  NFS: Fix a race when updating an existing write
  - !18394  ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
  - udf: Do not bother merging very long extents
  - !18375  Enable Huawei Intelligent Network Card Driver: hinic3
  - scsi: qla4xxx: Add length check when parsing nlattrs
  - scsi: target: target_core_configfs: Add length check to avoid buffer overflow
  - ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
  - iommu/amd: Fix pci device refcount leak in ppr_notifier()
  - thermal: intel_powerclamp: Use first online CPU as control_cpu
  - thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
  - clk: samsung: Fix memory leak in _samsung_clk_register_pll()
  - Enable Huawei Intelligent Network Card Driver: hinic3
  - mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
  - !18340  binfmt_misc: fix shift-out-of-bounds in check_special_flags
  - !18355  fix CVE-2023-53560
  - cifs: Remove duplicated include in cifsglob.h
  - cifs: fix oops during encryption
  - tracing/histograms: Return an error if we fail to add histogram to hist_vars list
  - tracing/histograms: Add histograms to hist_vars if they have referenced variables
  - binfmt_misc: fix shift-out-of-bounds in check_special_flags
  - scsi: qla2xxx: Wait for io return on terminate rport
  - fs: quota: create dedicated workqueue for quota_release_work
  - drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
  - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
  - md: fix resync softlockup when bitmap size is less than array size
  - md/bitmap: md_bitmap_get_counter returns wrong blocks
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
  - md/raid10: fix wrong setting of max_corr_read_errors
  - nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
  - md/raid10: prevent soft lockup while flush writes
  - md/raid10: fix leak of 'r10bio->remaining' for recovery
  - md: Replace snprintf with scnprintf
  - scsi: ses: Handle enclosure with just a primary component gracefully
  - scsi: ses: Don't attach if enclosure has no components
  - NFS: Fix a race when updating an existing write


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2510.4.0.0349
changelog:
  - !18619  notifiers: Add oops check in blocking_notifier_call_chain()
  - !18595  Fix CVE-2023-53719
  - !18618  CVE-2023-53648
  - !18590  mtd: Fix device name leak when register device failed in add_mtd_device()
  - !18601  xhci: Remove device endpoints from bandwidth list when freeing the device
  - !18582  media: v4l2-mem2mem: add lock to protect parameter num_rdy
  - notifiers: Add oops check in blocking_notifier_call_chain()
  - ALSA: ac97: Fix possible error value of *rac97
  - ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
  - !18607  wifi: mwifiex: avoid possible NULL skb pointer dereference
  - !18603  Bluetooth: L2CAP: Fix use-after-free
  - wifi: mwifiex: avoid possible NULL skb pointer dereference
  - !18575  CVE-2023-53153
  - !18581  net/tunnel: wait until all sk_user_data reader finish before releasing the sock
  - !18580  sctp: fix a potential overflow in sctp_ifwdtsn_skip
  - !18578  sctp: check send stream number after wait_for_sndbuf
  - !18577  CVE-2023-53148
  - !18576  wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
  - !18574  sctp: handle the error returned from sctp_auth_asoc_init_active_key
  - !18573  igb: Do not free q_vector unless new one was allocated
  - Bluetooth: L2CAP: Fix use-after-free
  - !18600  mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  - !18599  scsi: qla4xxx: Prevent a potential error pointer dereference
  - xhci: Remove device endpoints from bandwidth list when freeing the device
  - !18551  posix-timers: Ensure timer ID search-loop limit is valid
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  - scsi: qla4xxx: Prevent a potential error pointer dereference
  - drivers: fix a typo in the kernel doc for devm_platform_ioremap_resource()
  - serial: arc_uart: fix of_iomap leak in `arc_serial_probe`
  - drivers: provide devm_platform_ioremap_resource()
  - mtd: Fix device name leak when register device failed in add_mtd_device()
  - !18543  CVE-2023-53567
  - !18529  drm/radeon: free iio for atombios when driver shutdown
  - media: v4l2-mem2mem: add lock to protect parameter num_rdy
  - net/tunnel: wait until all sk_user_data reader finish before releasing the sock
  - sctp: fix a potential overflow in sctp_ifwdtsn_skip
  - sctp: check send stream number after wait_for_sndbuf
  - igb: Do not bring the device up after non-fatal error
  - igb: Fix igb_down hung on surprise removal
  - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
  - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext"
  - wifi: cfg80211: Fix use after free for wext
  - sctp: handle the error returned from sctp_auth_asoc_init_active_key
  - igb: Do not free q_vector unless new one was allocated
  - !18499  posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  - !18454  usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
  - !18366  squashfs: add more sanity checks
  - !18240  efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
  - !18491  CVE-2023-53515
  - posix-timers: Ensure timer ID search-loop limit is valid
  - spi: qup: Don't skip cleanup in remove's error path
  - spi: qup: fix PM reference leak in spi_qup_remove()
  - drm/radeon: free iio for atombios when driver shutdown
  - !18429  bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
  - !18426  dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path
  - !18416  ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
  - !18418  CVE-2023-53271
  - !18420  CVE-2023-53265
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  - virtio-mmio: fix memory leak of vm_dev
  - virtio-mmio: don't break lifecycle of vm_dev
  - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
  - bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path
  - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size
  - ubi: ensure that VID header offset + VID header size <= alloc, size
  - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
  - ubi: Fix use-after-free when volume resizing failed
  - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
  - Squashfs: fix handling and sanity checking of xattr_ids count
  - squashfs: fix xattr id and id lookup sanity checks
  - squashfs: fix inode lookup sanity checks
  - squashfs: add more sanity checks in inode lookup
  - squashfs: add more sanity checks in xattr id lookup
  - squashfs: add more sanity checks in id lookup
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2511.1.0.0350
changelog:
  - !18795  *** fix CVE-2023-53454 ***
  - HID: multitouch: Add NULL check in mt_input_configured
  - HID: multitouch: Correct devm device reference for hidinput input_dev name
  - !18787  misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
  - misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
  - !18776  tty: vt: Fix vc_origin buffer copy overflow in fbcon_prepare_logo()
  - tty: vt: Fix vc_origin buffer copy overflow in fbcon_prepare_logo()
  - !18759  wifi: ath9k: hif_usb: fix memory leak of remain_skbs
  - !18757  fix CVE-2023-53675
  - !18754  scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
  - !18727  fbdev: Fix out-of-bounds issue in sys_fillrect()
  - !18734  drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
  - wifi: ath9k: hif_usb: fix memory leak of remain_skbs
  - scsi: ses: Fix possible desc_ptr out-of-bounds accesses
  - Revert "scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process"
  - !18749  wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
  - !18740  *** CVE-2023-53199 ***
  - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
  - !18731  *** CVE-2023-53446 ***
  - !18730  wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
  - !18724  *** CVE-2023-53185 ***
  - !18460  blk-mq: use quiesced elevator switch when reinitializing queues
  - !18726 v2  ext4: avoid crash when inline data creation follows DIO write
  - !18417  cifs: Fix warning and UAF when destroy the MR list
  - wifi: ath9k: use proper statements in conditionals
  - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
  - ath9k: htc: clean up statistics macros
  - ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
  - ath9k: hif_usb: simplify if-if to if-else
  - !18725  ipvs: Defer ip_vs_ftp unregister during netns cleanup
  - drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
  - !18698  i40e: add validation for ring_len param
  - !18697  wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()
  - !18693  wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
  - PCI/ASPM: Fix link state exit during switch upstream function removal
  - PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
  - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
  - fbdev: Fix out-of-bounds issue in sys_fillrect()
  - ext4: avoid crash when inline data creation follows DIO write
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup
  - ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb()
  - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
  - ath9k: Fix use-after-free Write in ath9k_htc_rx_msg
  - !18717  drm/mipi-dsi: Detach devices when removing the host
  - !18716  scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
  - !18715  net: hns: fix possible memory leak in hnae_ae_register()
  - !18714  net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode
  - !18707 v2  xfrm: fix slab-use-after-free in decode_session6
  - !18712  can: peak_usb: fix shift-out-of-bounds issue
  - drm/mipi-dsi: Detach devices when removing the host
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
  - net: hns: fix possible memory leak in hnae_ae_register()
  - net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode
  - can: peak_usb: fix shift-out-of-bounds issue
  - xfrm: fix slab-use-after-free in decode_session6
  - i40e: add validation for ring_len param
  - wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()
  - wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
  - !18688  PCI/sysfs: Prohibit unaligned access to I/O port on non-x86
  - PCI/sysfs: Prohibit unaligned access to I/O port on non-x86
  - !18657  ALSA: usb-audio: Fix potential memory leaks
  - !18658  iommu/vt-d: Clean up si_domain in the init_dmars() error path
  - !18269  can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
  - iommu/vt-d: Clean up si_domain in the init_dmars() error path
  - ALSA: usb-audio: Fix potential memory leaks
  - !18643  wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
  - !18642  tipc: fix a null-ptr-deref in tipc_topsrv_accept
  - !18641  tipc: fix an information leak in tipc_topsrv_kern_subscr
  - !18623  *** SUBJECT HERE ***
  - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
  - tipc: fix a null-ptr-deref in tipc_topsrv_accept
  - tipc: fix an information leak in tipc_topsrv_kern_subscr
  - udf: Detect system inodes linked into directory hierarchy
  - udf: Preserve link count of system files
  - blk-mq: use quiesced elevator switch when reinitializing queues
  - cifs: Fix warning and UAF when destroy the MR list
  - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2511.2.0.0351
changelog:
  - !18884  Revert "fbdev: Fix out-of-bounds issue in sys_fillrect()"
  - Revert "fbdev: Fix out-of-bounds issue in sys_fillrect()"
  - !18811  net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
  - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
  - !18736  fs: udf: fix OOB read in lengthAllocDescs handling
  - fs: udf: fix OOB read in lengthAllocDescs handling


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2511.3.0.0352
changelog:
  - !19025  scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
  - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
  - !18973  Fix CVE-2025-39964
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2511.4.0.0353
changelog:
  - !19055  scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
  - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2512.1.0.0354
changelog:
  - !19381  net/sched: Abort __tc_modify_qdisc if parent is a clsact/ingress qdisc
  - net/sched: Abort __tc_modify_qdisc if parent is a clsact/ingress qdisc
  - !19298  pid: Add a judgment for ns null in pid_nr_ns
  - !19286  sched: Fix race between yield_to() and try_to_wake_up()
  - pid: Add a judgment for ns null in pid_nr_ns
  - sched: Fix race between yield_to() and try_to_wake_up()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2512.3.0.0355
changelog:
  - !19658  mmc: core: Fix kernel panic when remove non-standard SDIO card
  - !19654  scsi: hpsa: Fix possible memory leak in hpsa_init_one()
  - !19535  fs/proc: fix uaf in proc_readdir_de()
  - mmc: core: Fix kernel panic when remove non-standard SDIO card
  - scsi: hpsa: Fix possible memory leak in hpsa_init_one()
  - !19646  fbdev: bitblit: bound-check glyph index in bit_putcs*
  - !19648  usb-storage: alauda: Fix uninit-value in alauda_check_media()
  - usb-storage: alauda: Fix uninit-value in alauda_check_media()
  - fbdev: bitblit: bound-check glyph index in bit_putcs*
  - fs/proc: fix uaf in proc_readdir_de()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2512.4.0.0356
changelog:
  - !19698 merge refs/pull/19698/head into openEuler-1.0-LTS
  - !19703  ppp: associate skb with a device at tx
  - !19699  ip6_vti: fix slab-use-after-free in decode_session6
  - ppp: associate skb with a device at tx
  - ip6_vti: fix slab-use-after-free in decode_session6
  - xfs: remove superfluous writeback mapping eof trimming
  - xfs: update fork seq counter on data fork changes


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2601.2.0.0357
changelog:
  - !19887 merge patch-1767078288 into openEuler-1.0-LTS
  - !19906 merge patch-1767163222 into openEuler-1.0-LTS
  - !19907 merge patch-1767172215 into openEuler-1.0-LTS
  - !19929 merge patch-1767516390 into openEuler-1.0-LTS
  - !19910 merge patch-1767492010 into openEuler-1.0-LTS
  - usb: idmouse: fix an uninit-value in idmouse_open
  - !19905 merge patch-1767162893 into openEuler-1.0-LTS
  - !19891 merge patch-1767084968 into openEuler-1.0-LTS
  - mm: mem_reliable: prevent excessive direct reclaim loops
  - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
  - udf: Avoid double brelse() in udf_rename()
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
  - !19880 merge patch-1767065442 into openEuler-1.0-LTS
  - md/raid10: fix memleak for 'conf->bio_split'
  - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
  - hwrng: virtio - Fix race on data_avail and actual data
  - hwrng: virtio - always add a pending request
  - hwrng: virtio - don't waste entropy
  - hwrng: virtio - don't wait on cleanup
  - hwrng: virtio - add an internal buffer
  - !19877 merge patch-1767015578 into openEuler-1.0-LTS
  - !19853 merge patch-1766829678 into openEuler-1.0-LTS
  - firmware: arm_sdei: Fix "firmware: arm_sdei: Fix sleep from invalid context BUG" KABI issue
  - firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state()
  - firmware: arm_sdei: Fix sleep from invalid context BUG
  - libceph: Fix kabi breakage
  - libceph: fix potential use-after-free in have_mon_and_osd_map()
  - !19813 merge patch-1766634705 into openEuler-1.0-LTS
  - !19821 merge patch-1766661542 into openEuler-1.0-LTS
  - RDMA/rxe: Fix "kernel NULL pointer dereference" error
  - md/raid10: fix null-ptr-deref in raid10_sync_request
  - !19723 merge refs/pull/19723/head into openEuler-1.0-LTS
  - !19618 merge refs/pull/19618/head into openEuler-1.0-LTS
  - mm/mem_reliable: use percise count during limit check
  - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2601.3.0.0358
changelog:
  - !20029 merge patch-1768185625 into openEuler-1.0-LTS
  - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
  - !20021 merge patch-1767946628 into openEuler-1.0-LTS
  - sched/rt: Skip currently executing CPU in rto_next_cpu()
  - !19961 merge patch-1767681076 into openEuler-1.0-LTS
  - !19986 merge patch-1767701968 into openEuler-1.0-LTS
  - !19954 merge patch-1767621081 into openEuler-1.0-LTS
  - !19948 merge patch-1767605117 into openEuler-1.0-LTS
  - !19941 merge patch-1767597922 into openEuler-1.0-LTS
  - !19947 merge patch-1767604374 into openEuler-1.0-LTS
  - acct: fix potential integer overflow in encode_comp_t()
  - drm/client: Fix memory leak in drm_client_target_cloned
  - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
  - dm flakey: fix a crash with invalid table line
  - Revert "firmware: arm_sdei: Fix sleep from invalid context BUG"
  - Revert "firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state()"
  - Revert "firmware: arm_sdei: Fix "firmware: arm_sdei: Fix sleep from invalid context BUG" KABI issue"
  - drm: Prevent drm_copy_field() to attempt copying a NULL pointer


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2601.4.0.0359
changelog:
  - !20113 merge patch-1768544718 into openEuler-1.0-LTS
  - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
  - !20106 merge patch-1768480822 into openEuler-1.0-LTS
  - fbcon: Fix the issue of uninitialized charcount in the remaining consoles


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2601.5.0.0360
changelog:
  - !20279  e1000: fix OOB in e1000_tbi_should_accept()
  - e1000: fix OOB in e1000_tbi_should_accept()
  - !20108  mmc: via-sdmmc: fix return value check of mmc_add_host()
  - !20111  Fix CVE-2023-54179
  - !20039  tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
  - !20038  CVE-2023-54110
  - !20165  CVE-2022-50885
  - !20171  ipv6: ensure sane device mtu in tunnels
  - !20172  net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
  - !20007  ubi: Fix possible null-ptr-deref in ubi_free_volume()
  - !19984  bpf: Address KCSAN report on bpf_lru_list
  - !19957  scsi: ipr: Fix WARNING in ipr_init()
  - net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
  - ipv6: ensure sane device mtu in tunnels
  - RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed
  - RDMA/rxe: Fix the error caused by qp->sk
  - scsi: qla2xxx: Array index may go out of bound
  - scsi: qla2xxx: Fix inconsistent format argument type in qla_os.c
  - mmc: via-sdmmc: fix return value check of mmc_add_host()
  - tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
  - usb: rndis_host: Secure rndis_query check against int overflow
  - ubi: Fix possible null-ptr-deref in ubi_free_volume()
  - bpf: Address KCSAN report on bpf_lru_list
  - scsi: ipr: Fix WARNING in ipr_init()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2602.1.0.0361
changelog:
  - !20557  dm flakey: don't corrupt the zero page
  - dm flakey: don't corrupt the zero page
  - !20484  usb: typec: altmodes/displayport: fix pin_assignment_show
  - usb: typec: altmodes/displayport: fix pin_assignment_show
  - !20434  md/raid10: fix memleak of md thread
  - !20448  scsi/hiraid: Support New Raid feature
  - !20443  RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()
  - scsi/hiraid: Support New Raid feature
  - RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()
  - md/raid10: fix memleak of md thread


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2602.2.0.0362
changelog:
  - !20658  media: av7110: prevent underflow in write_ts_to_decoder()
  - !20577  CVE-2026-23003
  - media: av7110: prevent underflow in write_ts_to_decoder()
  - !20530 [Hygon][4.19][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts
  - !20618  nohz_full stall
  - sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups
  - sched/fair: Prevent unlimited runtime on throttled group
  - x86: Resolve FPU state corruption between atomic and non-atomic contexts
  - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
  - geneve: Fix incorrect inner network header offset when innerprotoinherit is set
  - geneve: fix header validation in geneve[6]_xmit_skb
  - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb
  - net: geneve: check skb is large enough for IPv4/IPv6 header


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2602.3.0.0363
changelog:
  - !20786  irqchip/gic-v3-its: Avoid truncating memory addresses
  - irqchip/gic-v3-its: Avoid truncating memory addresses
  - !20275 [Hygon][4.19][Bugfix] Get correct CPU LLC ID in guest for Hygon processors
  - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2603.1.0.0364
changelog:
  - !20828  squashfs: fix memory leak in squashfs_fill_super
  - !20900 Fix CVE-2026-23216
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
  - !20840  bpf, cpumap: Make sure kthread is running before map update returns
  - bpf, cpumap: Make sure kthread is running before map update returns
  - squashfs: fix memory leak in squashfs_fill_super


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2603.2.0.0365
changelog:
  - !21158  PCI: Fix AB-BA deadlock between aer_isr() and device_shutdown()
  - !21020  CVE-2026-23209
  - PCI: Fix AB-BA deadlock between aer_isr() and device_shutdown()
  - !21138  PCI: Fix pci_slot_trylock() error handling
  - PCI: Fix pci_slot_trylock() error handling
  - !21009  net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path
  - macvlan: fix error recovery in macvlan_common_newlink()
  - net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2603.3.0.0366
changelog:
  - !21330  sched/cputime: Fix time overflow in cputime_adjust()
  - sched/cputime: Fix time overflow in cputime_adjust()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2604.1.0.0367
changelog:
  - !21397  RDMA/umad: Reject negative data_len in ib_umad_write
  - RDMA/umad: Reject negative data_len in ib_umad_write


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2604.2.0.0368
changelog:
  - !21468  mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
  - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2604.3.0.0369
changelog:
  - !20911 [openEuler-1.0-LTS] Fix CVE-2025-39710
  - !20867 [openEuler-1.0-LTS] Fix CVE-2025-39738
  - !20549 [openEuler-1.0-LTS] Fix CVE-2022-50300
  - media: venus: Add a check for packet size after reading from shared memory
  - btrfs: do not allow relocation of partially dropped subvolumes
  - btrfs: fix extent map use-after-free when handling missing device in read_one_chunk


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2605.1.0.0370
changelog:
  - !22146 v4  CVE-2026-31431
  - crypto: algif_aead - Fix minimum RX size check for decryption
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
  - crypto: authencesn - Fix src offset when decrypting in-place
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
  - crypto: authenc - use memcpy_sglist() instead of null skcipher
  - crypto: algif_aead - snapshot IV for async AEAD requests
  - crypto: algif_aead - Revert to operating out-of-place
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
  - crypto: scatterwalk - Backport memcpy_sglist()
  - crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2605.2.0.0371
changelog:
  - !22018  ext4: publish jinode after initialization
  - !22019  FIX CVE-2026-31449
  - !21123 [openEuler-1.0-LTS] Fix CVE-2025-68340
  - !22063  KVM: x86: Use scratch field in MMIO fragment to hold small write values
  - !22131 Fix CVE-2026-31678
  - openvswitch: defer tunnel netdev_put to RCU release
  - KVM: x86: Use scratch field in MMIO fragment to hold small write values
  - ext4: validate p_idx bounds in ext4_ext_correct_indexes
  - ext4: prevent partial update of the extents path
  - ext4: refactor ext4_ext_rm_idx() to index 'path'
  - ext4: publish jinode after initialization
  - team: Move team device type change at the end of team_port_add


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2605.3.0.0372
changelog:
  - !22312  drm/ioc32: stop speculation on the drm_compat_ioctl path
  - !22338  rxrpc: proc: size address buffers for %pISpc output
  - !22043 Fix CVE-2026-31515
  - !22123  net: fix fanout UAF in packet_release() via NETDEV_UP race
  - !22047 Fix CVE-2026-31682
  - !22052 Fix CVE-2026-31674
  - !22072 CVE-2026-31673
  - rxrpc: proc: size address buffers for %pISpc output
  - drm/ioc32: stop speculation on the drm_compat_ioctl path
  - !22252 [openEuler-1.0-LTS] Fix CVE-2026-43284
  - xfrm: esp: avoid in-place decrypt on shared skb frags
  - net: fix fanout UAF in packet_release() via NETDEV_UP race
  - af_unix: read UNIX_DIAG_VFS data under unix_state_lock
  - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
  - bridge: br_nd_send: linearize skb before parsing ND options
  - af_key: validate families in pfkey_send_migrate()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2605.4.0.0373
changelog:
  - !22431  bugfix set of CVEs
  - !22556  CVE-2026-46333
  - ptrace: Fix kabi breakage in struct task_struct
  - ptrace: slightly saner 'get_dumpable()' logic
  - !22388  crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
  - !22343 Fix CVE-2026-31699
  - !22407 Fix CVE-2026-31527
  - HID: multitouch: Check to ensure report responses match the request
  - HID: core: Mitigate potential OOB by removing bogus memset()
  - HID: core: Add printk_ratelimited variants to hid_warn() etc
  - driver/core: Fix kabi broken of platform_device/device/bus_type
  - driver core: platform: use generic driver_override infrastructure
  - driver core: generalize driver_override in struct device
  - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
  - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2605.5.0.0374
changelog:
  - !22879 Fix CVE-2026-43503
  - !22870 Fix CVE-2026-46300
  - net: skbuff: preserve shared-frag marker during coalescing
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers
  - !22774 Fix CVE-2026-43493
  - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
  - !22681  mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
  - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2606.1.0.0375
changelog:
  - !23395 Fix CVE-2026-45840
  - !22954 Fix CVE-2026-43139
  - !22955 Fix CVE-2026-43190
  - !22951 Fix CVE-2026-43233
  - !23371  sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
  - !23342  drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
  - !23401  lib/crypto: chacha: Zeroize permuted_state before it leaves scope
  - !23367  crypto: authencesn - reject short ahash digests during instance creation
  - !23366  net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
  - openvswitch: cap upcall PID array size and pre-size vport replies
  - lib/crypto: chacha: Zeroize permuted_state before it leaves scope
  - !23195  ceph: only d_add() negative dentries when they are unhashed
  - !22663 Fix CVE-2026-43038
  - !22668 Fix CVE-2026-43037
  - !23019 Fix CVE-2026-46023
  - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
  - crypto: authencesn - reject short ahash digests during instance creation
  - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
  - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
  - ceph: only d_add() negative dentries when they are unhashed
  - !23037  thermal: core: Fix thermal zone governor cleanup issues
  - !23150  smb: client: reject userspace cifs.spnego descriptions
  - smb: client: reject userspace cifs.spnego descriptions
  - !23038  CVE-2026-43427
  - !23036  mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
  - !23030 CVE-2026-31759
  - usb: class: cdc-wdm: fix reordering issue in read code path
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
  - thermal: core: Fix thermal zone governor cleanup issues
  - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
  - usb: ulpi: fix memory leak on ulpi_register() error paths
  - usb: ulpi: Call of_node_put correctly
  - !22984  CVE-2026-43328
  - dm mirror: fix integer overflow in create_dirty_log()
  - !22994  Fix CVE-2026-43158
  - !22842  net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks
  - xfs: delete attr leaf freemap entries when empty
  - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
  - cpufreq: governor: Free dbs_data directly when gov->init() fails
  - xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
  - netfilter: xt_tcpmss: check remaining length before reading optlen
  - netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
  - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2606.3.0.0376
changelog:
  - !23663 Fix CVE-2026-46259
  - !23552  mm: slab: fix double destroy of kmem_cache
  - !23514  backport some zram bugfixes
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  - !23637  *** revert CVE-2026-31527 ***
  - Revert "driver core: generalize driver_override in struct device"
  - Revert "driver core: platform: use generic driver_override infrastructure"
  - Revert "driver/core: Fix kabi broken of platform_device/device/bus_type"
  - mm: slab: fix double destroy of kmem_cache
  - !23533  RDMA/rxe: Fix double free in rxe_srq_from_init
  - !23502  drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
  - !23494  ipmi: Add limits to event and receive message requests
  - !23523  ipv6: prevent possible UaF in addrconf_permanent_addr()
  - RDMA/rxe: Fix double free in rxe_srq_from_init
  - !23492  bonding: alb: fix UAF in rlb_arp_recv during bond up/down
  - !23429 Fix HWPSIRT-2026-70484
  - !23339 Fix CVE-2026-45843
  - !23407  net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
  - ipv6: prevent possible UaF in addrconf_permanent_addr()
  - !23461  netfilter: x_tables: ensure names are nul-terminated
  - !23470  netfilter: nf_conntrack_helper: pass helper to expect cleanup
  - !23453  netfilter: nft_ct: fix use-after-free in timeout object destroy
  - !23404  net/sched: Enforce that teql can only be used as root qdisc
  - !23399  ipvs: fix ipv4 null-ptr-deref in route error path
  - mm/page_io: use pr_alert_ratelimited for swap read/write errors
  - drivers/block/zram/zram_drv.c: do not keep dangling zcomp pointer after zram reset
  - zram: do not lookup algorithm in backends table
  - zram: avoid race between zram_remove and disksize_store
  - zram: don't fail to remove zram during unloading module
  - zram: fix race between zram_reset_device() and disksize_store()
  - zsmalloc: account the number of compacted pages correctly
  - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
  - !22992 Fix CVE-2026-43194
  - !23297 Fix CVE-2026-43383
  - !23286  netfilter: nft_ct: drop pending enqueued packets on removal
  - !23307  netfilter: x_tables: guard option walkers against 1-byte tail reads
  - !23292  netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
  - !23042 Fix CVE-2026-43499
  - ipmi: Add limits to event and receive message requests
  - bonding: alb: fix UAF in rlb_arp_recv during bond up/down
  - xfrm: esp: restore combined single-frag length gate
  - slip: bound decode() reads against the compressed packet length
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup
  - !23393  CVE-2026-46043
  - netfilter: x_tables: ensure names are nul-terminated
  - netfilter: nft_ct: fix use-after-free in timeout object destroy
  - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
  - net/sched: Enforce that teql can only be used as root qdisc
  - ipvs: fix ipv4 null-ptr-deref in route error path
  - RDMA/rxe: Reject unknown opcodes before ICRC processing
  - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
  - netfilter: x_tables: guard option walkers against 1-byte tail reads
  - net/tcp-md5: Fix MAC comparison to be constant-time
  - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
  - netfilter: nft_ct: drop pending enqueued packets on removal
  - rtmutex: Use waiter::task instead of current in remove_waiter()
  - net: consume xmit errors of GSO frames


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2606.4.0.0377
changelog:
  - !23944  hugetlbfs: prevent filesystem stacking of hugetlbfs
  - hugetlbfs: prevent filesystem stacking of hugetlbfs
  - !23900  dm: fix a buffer overflow in ioctl processing
  - dm: fix a buffer overflow in ioctl processing


author: liuxu <liuxu156@huawei.com> - 1:1.31.1-21
changelog:
  - Type:CVE
  - Id:NA
  - SUG:NA
  - DESC:revert fix CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 CVE-2023-42363


author: xinghe <xinghe2@h-partners.com> - 1.16.1-7
changelog:
  - Type:cves
  - CVE:CVE-2023-31130 CVE-2023-31124 CVE-2023-31147
  - SUG:NA
  - DESC:fix CVE-2023-31130 CVE-2023-31124 CVE-2023-31147


author: wangjiang <wangjiang37@h-partners.com> - 2023.2.60-3
changelog:
  - remove expired and sync new certificates
    Removing:
      Security Communication Root CA
      Trustis FPS Root CA
    Adding:
      Atos TrustedRoot Root CA ECC G2 2020
      Atos TrustedRoot Root CA ECC TLS 2021
      Atos TrustedRoot Root CA RSA G2 2020
      Atos TrustedRoot Root CA RSA TLS 2021
      CommScope Public Trust ECC Root-01
      CommScope Public Trust ECC Root-02
      CommScope Public Trust RSA Root-01
      CommScope Public Trust RSA Root-02
      D-Trust SBR Root CA 1 2022
      D-Trust SBR Root CA 2 2022
      LAWtrust Root CA2 (4096)
      Sectigo Public Email Protection Root E46
      Sectigo Public Email Protection Root R46
      Sectigo Public Server Authentication Root E46
      Sectigo Public Server Authentication Root R46
      SSL.com Client ECC Root CA 2022
      SSL.com Client RSA Root CA 2022
      SSL.com TLS ECC Root CA 2022
      SSL.com TLS RSA Root CA 2022
      Telekom Security SMIME ECC Root 2021
      Telekom Security SMIME RSA Root 2023
      Telekom Security TLS ECC Root 2020
      Telekom Security TLS RSA Root 2023
      TrustAsia Global Root CA G3
      TrustAsia Global Root CA G4


author: wangjiang <app@cameyan.com> - 2023.2.60-4
changelog:
  - remove expired and sync new certificates
    Removing:
      Certificate "Explicitly Distrust DigiNotar Root CA"
      Certificate "Baltimore CyberTrust Root"
    Adding:
      Certificate "FIRMAPROFESIONAL CA ROOT-A WEB"
      Certificate "TWCA CYBER Root CA"
      Certificate "TWCA Global Root CA G2"
      Certificate "SecureSign Root CA12"
      Certificate "SecureSign Root CA14"
      Certificate "SecureSign Root CA15"
      Certificate "D-TRUST BR Root CA 2 2023"
      Certificate "D-TRUST EV Root CA 2 2023"


author: zhongjiawei<zhongjiawei1@huawei.com> - 1.2.0-213
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:bump ttrpc to fix containerd-shim socket connect increase leak after restart docker


author: zhongjiawei<zhongjiawei1@huawei.com> - 1.2.0-217
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:disable Transparent HugePage for shim process if SHIM_DISABLE_THP is set


author: lijian<lijian2@kylinos.cn> - 1:1.1.0-9
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:rebuild for golang cvefix: CVE-2023-24534,CVE-2023-24536,CVE-2023-24537,CVE-2023-24538


author: Jianmin <jianmin@iscas.ac.cn> - 1:1.1.0-13
changelog:
  - Type:bugfix
  - CVE:CVE-2023-39325 CVE-2023-44487 CVE-2025-27144
  - SUG:NA
  - DESC: fix CVE-2023-39325 CVE-2023-44487 CVE-2025-27144


author: jiangchuangang<jiangchuangang@huawei.com> - 8.32-9
changelog:
  - sync patches from community
  - add backport-pr-fix-infinite-loop-when-double-spacing.patch
    backport-wc-ensure-we-update-file-offset.patch


author: jiangchuangang <jiangchuangang@huawei.com> - 8.32-10
changelog:
  - sync patches from community
  - add backport-who-fix-only-theoretical-overflow.patch
        backport-tac-handle-short-reads-on-input.patch
        backport-setenv-Don-t-crash-if-malloc-returns-NULL.patch
        backport-who-don-t-crash-if-clock-gyrates.patch
        backport-doc-od-strings-clarify-operation.patch


author: cenhuilin <cenhuilin@kylinos.cn> - 8.32-12
changelog:
  - sync patches from community
  - add backport-coverity-utimens.patch
        backport-fuse-portal.patch
        backport-expr-unmatched-par.patch


author: wangjiang <app@cameyan.com> - 8.32-14
changelog:
  - sync patches from community
  - add backport-numfmt-don-t-require-a-suffix-with-from-iec-i.patch
        backport-sort-fix-debug-buffer-overrun.patch
        backport-tac-avoid-out-of-bounds-access.patch
        backport-yes-avoid-failure-on-CHERI-protected-systems.patch


author: Funda Wang <fundawang@yeah.net> - 8.32-17
changelog:
  - fix upstream bug#72445: Fill the ISAAC buffer instead of storing at most
    BYTES_BOUND bytes into it.


author: xinghe <xinghe2@h-partners.com> - 4.11.12-30
changelog:
  - Type:cves
  - CVE:CVE-2022-2127 CVE-2023-34966 CVE-2023-34967
  - SUG:NA
  - DESC:fix CVE-2022-2127 CVE-2023-34966 CVE-2023-34967


author: xinghe <xingheyd@163.com> - 4.11.12-38
changelog:
  - Type:cves
  - CVE:CVE-2026-3238 CVE-2026-4480 CVE-2026-4408
  - SUG:NA
  - DESC:fix CVE-2026-3238 CVE-2026-4480 CVE-2026-4408


author: Funda Wang <fundawang@yeah.net> - 1:2.2.13-22
changelog:
  - fix CVE-2025-58060, CVE-2025-58364
  - move www files into main package due to requirement by web interface


author: gaihuiying <eaglegai@163.com> - 1:2.2.13-24
changelog:
  - fix CVE-2026-27447 CVE-2026-34978 CVE-2026-34979 CVE-2026-34980 CVE-2026-34990 CVE-2026-39314 CVE-2026-39316


author: zhouyihang <zhouyihang3@h-partners.com> - 7.71.1-34
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:dynbuf: provide curlx_ names for reuse by the curl tool
         curl: use curlx_dynbuf for realloc when loading config files
         curl: make file2string use dynbuf
         paramhlp: fix CRLF-stripping files with "-d @file"
         libssh2: set length to 0 if strdup failed
         openldap: create ldap URLs correctly for IPv6 addresses
         multi: avoid memory-leak risk
         tool_cb_rea: limit rate unpause for -T . uploads
         tool_cfgable: free {proxy_}cipher13_list on exit


author: zhouyihang <zhouyihang3@h-partners.com> - 7.71.1-38
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:multi: check that the multi handle is valid in curl_multi_assign


author: xingwei <xingwei14@h-partners.com> - 7.71.1-41
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:altsvc: avoid integer overflow in expire calculation
         test391: verify --path-as-is with redirect
         urlapi: fix redirect to a new fragment or query (only)


author: xinghe <xinghe2@h-partners.com> - 7.71.1-42
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:curl_path: bring back support for SFTP path ending in /~
         curl_path: make SFTP handle a path like /~ properly


author: zhouyihang <zhouyihang3@h-partners.com> - 7.71.1-45
changelog:
  - Type:CVE
  - CVE:CVE-2025-14017 CVE-2025-14524 CVE-2025-15079 CVE-2025-15224
  - SUG:NA
  - DESC:fix CVE-2025-14017 CVE-2025-14524 CVE-2025-15079 CVE-2025-15224


author: zhouyihang <zhouyihang_z@163.com> - 7.71.1-46
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:formdata: validate callback is non-NULL before use
         tftp: correct the filename length check


author: zhouyihang <zhouyihang_z@163.com> - 7.71.1-47
changelog:
  - Type:CVE
  - CVE:CVE-2026-1965 CVE-2026-3783 CVE-2026-3784
  - SUG:NA
  - DESC:fix CVE-2026-1965 CVE-2026-3783 CVE-2026-3784


author: zhouyihang <zhouyihang_z@163.com> - 7.71.1-48
changelog:
  - Type:CVE
  - CVE:CVE-2026-4873 CVE-2026-5545 CVE-2026-5773 CVE-2026-6253 CVE-2026-6276 CVE-2026-6429 CVE-2026-7168
  - SUG:NA
  - DESC:fix CVE-2026-4873 CVE-2026-5545 CVE-2026-5773 CVE-2026-6253 CVE-2026-6276 CVE-2026-6429 CVE-2026-7168


author: renmingshuai <renmingshuai@huawei.com> - 12:4.4.2-10
changelog:
  - Type:CVE
  - ID:CVE-2022-2795,CVE-2022-38177,CVE-2022-38178
  - SUG:restart
  - DESC:fix CVE-2022-2795,CVE-2022-38177 and CVE-2022-38178


author: renmingshuai <renmingshuai@huawei.com> - 2.82-14
changelog:
  - Type:bugfix
  - Id:
  - SUG:NA
  - DESC:Reduce code duplication, reuse existing functions
         Fix memory leak when using --dhcp-optsfile with DHCPv6 options


author: lingsheng <lingsheng1@h-partners.com> - 2.82-18
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Update DNS records after pruning DHCP leases
         Fix potential memory leak
         Fix possible SIGSEGV in bpf.c
         adapt bugfix allow binding mac with ipv6


author: luoguocui <luoguocui@h-partners.com> - 2.82-19
changelog:
  - Type:bugfix
  - CVE:
  - SUG:NA
  - DESC:Fix bad reply to DHCPCONFIRM messages (wrong message type)
         Fix reply confirm packet when binding-mac-with-ip6 on


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.82-20
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
    Fix bounds checking in check_ia
    Fix SEGV in Dbus code
    More fixes for DHCP ops in Dbus when DHCP not configured


author: zhaoyonghao10 <zhaoyonghao10@h-partners.com> - 2.82-21
changelog:
  - Type:CVE
  - CVE:CVE-2026-2291 CVE-2026-4890 CVE-2026-4891 CVE-2026-4892 CVE-2026-4893
  - SUG:NA
  - DESC:Fix buffer overflow in struct bigname (CVE-2026-2291)
         Fix NSEC bitmap parsing infinite loop (CVE-2026-4890)
         Verify rdlen field in RRSIG packets (CVE-2026-4891)
         Fix buffer overflow in helper with large CLIDs (CVE-2026-4892)
         Fix broken client subnet validation (CVE-2026-4893)


author: zhongjiawei<zhongjiawei1@huawei.com> - 18.09.0-253
changelog:
  - Type:CVE
  - CVE:CVE-2023-28840,CVE-2023-28841,CVE-2023-28842
  - SUG:NA
  - DESC:fix CVE-2023-28840,CVE-2023-28841,CVE-2023-28842


author: chenjiankun<chenjiankun1@huawei.com> - 18.09.0-256
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:repalce unix.Rmdir with os.RemoveAll when remove mount point dir


author: zhangbowei<zhangbowei@kylinos.cn> - 1.0.0.rc3-219
changelog:
  - Type: bugfix
  - CVE:  NA
  - SUG:  NA
  - DESC: fix the bug when runc failed to update fat container memory value


author: wangkai <13474090681@163.com> - 1:2.3.15-7
changelog:
  - Fix CVE-2025-59031, CVE-2025-59032, CVE-2026-27855, CVE-2026-27856,
    CVE-2026-27857, CVE-2026-27858, CVE-2026-27859, CVE-2026-0394


author: lifeifei<lifeifei@kylinos.cn> - 2.0.11-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix: if libvirt and ebtables are installed at the same time, ping the operation prompts "sendmsg: Operation not permitted".


author: xinghe <xinghe2@h-partners.com> - 2.0.11-9
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix ebtables-restore --noflush failed when ebtables is uninstall


author: yexiao<yexiao7@huawei.com> - 202002-17
changelog:
  - fix CVE-2023-0464、CVE-2023-0465、CVE-2023-0466、CVE-2023-2650、CVE-2023-3446、CVE-2023-3817、CVE-2024-0727


author: yexiao<yexiao7@huawei.com> - 202002-19
changelog:
  - fix CVE-2023-45229、CVE-2023-45230、CVE-2023-45231、CVE-2023-45232、CVE-2023-45233、CVE-2023-45234、CVE-2023-45235


author: Jiabo Feng<fengjiabo1@huawei.com> - 202002-21
changelog:
  - update release. commit(2723c0159f0f84e2169b124dca9f4eb0dc6863f9) has been merged into commit(a8c3711f01ae9a152f0e8cede2547b4c54712400)


author: taolinghongfei <taolinghongfei@h-partners.com> - 202002-34
changelog:
  - fix CVE-2026-22795,CVE-2026-22796
  - fix CVE-2025-69420
  - fix CVE-2025-69421
  - fix CVE-2025-68160
  - fix CVE-2025-69418
  - fix CVE-2025-69419


author: lvxiangcong<lvxiangcong@kylinos.cn> - 3.4.14-6
changelog:
  - Type:CVE
  - CVE:CVE-2022-3064
  - SUG:NA
  - DESC: backport fix CVE-2022-3064 for openEuler-20.03-LTS-SP4


author: lvxiangcong<lvxiangcong@kylinos.cn> - 3.4.14-7
changelog:
  - Type:CVE
  - CVE:CVE-2022-41723
  - SUG:NA
  - DESC: backport fix CVE-2022-41723 for openEuler-20.03-LTS-SP4


author: lvxiangcong<lvxiangcong@kylinos.cn> - 3.4.14-9
changelog:
  - Type:CVE
  - CVE:CVE-2023-32082 CVE-2021-28235
  - SUG:NA
  - DESC: backport fix CVE-2023-32082 and CVE-2021-28235


author: lvxiangcong <lvxiangcong@kylinos.cn> - 3.4.14-11
changelog:
  - Type:CVES
  - ID:CVE-2024-24791 CVE-2023-45288 CVE-2022-1962 CVE-2022-41725 CVE-2022-2880
       CVE-2024-24785 CVE-2023-45290 CVE-2022-32148 CVE-2023-29406 CVE-2023-39326
       CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 
  - SUG:NA
  - DESC:Batch fix cves through rebuild


author: dillon chen <dillon.chen@gmail.com> - 2.4.5-5
changelog:
  - CVE-2020-18651,CVE-2020-18652
  - CVE-2021-36048,CVE-2021-39847,CVE-2021-42530,CVE-2021-36046,CVE-2021-36055
  - CVE-2021-40716,CVE-2018-12648,CVE-2021-36054,CVE-2021-36047,CVE-2021-36052
  - CVE-2021-36058,CVE-2021-36045,CVE-2021-42531,CVE-2021-36064,CVE-2021-42529
  - CVE-2021-42528,CVE-2021-36050,CVE-2021-40732
  - CVE-2021-36056,CVE-2021-42532,CVE-2021-36053,CVE-2021-36051


author: wangkai <13474090681@163.com> - 1:2.3.0-1
changelog:
  - Update to 2.3.0 for fix CVE-2022-48682
  - Add ncurses mode for interactive file deletion (plain mode still available via --plain or ./configure).
  - Add --minsize --maxsize --time --order=ctime --log --deferconfirmation --cache option.
  - Use configure script for installation (Autotools/Automake).
  - Rename cs command ("clear all selections") from cs to csel.
  - Rename igs command ("invert selections") from igs to isel.
  - Add "prune" command as synonym for DELETE key.
  - Clear selections after deleting files via prune/DELETE.
  - Fix dependency issues when fdupes is configured to not use ncurses.
  - Do not enter ncurses mode when --immediate option given.


author: happyworker <208suo@208suo.com> - 4.2.4-23
changelog:
  - Fix CVE-2020-22026/CVE-2020-22019/CVE-2020-22021/CVE-2020-22038/CVE-2020-22039/CVE-2020-22044/CVE-2020-22043


author: happyworker <208suo@208suo.com> - 4.2.4-24
changelog:
  - Fix CVE-2021-38090/CVE-2020-21697/CVE-2020-22042/CVE-2020-21688/CVE-2020-22037/CVE-2020-22051/CVE-2020-22020/CVE-2025-22921/CVE-2025-22919


author: weidongkl <weidong@kylinsec.com.cn> - 4.2.4-25
changelog:
  - Type: CVE
  - CVE: CVE-2020-22017
  - SUG: NA
  - DESC: fix heap buffer overflow in avfilter/vf_datascope.c


author: weidongkl <weidong@kylinsec.com.cn> - 4.2.4-26
changelog:
  - Type: CVE
  - CVE: CVE-2020-20451
  - SUG: NA
  - DESC: fix memory leak in open_files when parsing options fails


author: weidongkl <weidong@kylinsec.com.cn> - 4.2.4-27
changelog:
  - Type: CVE
  - CVE: CVE-2020-22029
  - SUG: NA
  - DESC: fix overreads in gauss array in libavfilter/vf_colorconstancy.c


author: weidongkl <weidong@kylinsec.com.cn> - 4.2.4-28
changelog:
  - Type: CVE
  - CVE: CVE-2020-22025
  - SUG: NA
  - DESC: check if height is big enough in gaussian_blur to prevent heap buffer overflow


author: weidongkl <weidong@kylinsec.com.cn> - 4.2.4-30
changelog:
  - Type: CVE
  - CVE: CVE-2020-20450
  - SUG: NA
  - DESC: mxfenc: never set codec_ul UID to NULL to prevent null pointer dereference


author: lvfei <lvfei@kylinos.cn> - 79.0-12
changelog:
  - Fix for expat CVE-2021-45960 CVE-2021-46143
    CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 CVE-2022-22825 CVE-2022-22826 CVE-2022-22827


author: zhouyihang <zhouyihang3@h-partners.com> - 0.6.6-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:To reduce unnecessary loading of ebtables-related kernel modules
         fix(nm): release NM client after a timeout


author: liyuxiang <liyuxiang@ncti-gba.cn> - 2:2.8.1-2
changelog:
  - Fix CVE-2022-39316
  - Fix CVE-2022-39318
  - Fix CVE-2022-39319
  - Fix CVE-2022-39347
  - Fix CVE-2022-41877


author: Funda Wang <fundawang@yeah.net> - 2:2.11.1-1
changelog:
  - 2.11.1
  - Fix CVE-2023-40567
  - Fix CVE-2023-40569
  - Fix CVE-2023-40188
  - Fix CVE-2023-40186
  - Fix CVE-2023-40181
  - Fix CVE-2023-39353
  - Fix CVE-2023-39352
  - Fix CVE-2023-39356
  - Fix CVE-2023-39350
  - Fix CVE-2023-39351
  - Fix CVE-2023-39354
  - Fix CVE-2023-40589


author: wangkai <13474090681@163.com> - 2:2.11.7-1
changelog:
  - Update to 2.11.7 for fix CVE-2024-32039,CVE-2024-32040,
    CVE-2024-32041,CVE-2024-32458,CVE-2024-32459,CVE-2024-32460,
    CVE-2024-32658,CVE-2024-32659 and CVE-2024-32660


author: wangkai <13474090681@163.com> - 2:2.11.8-1
changelog:
  - Update to 2.11.8
  - Fix CVE-2026-22852, CVE-2026-22856, CVE-2026-22859, CVE-2026-23530, CVE-2026-23531,
    CVE-2026-23532, CVE-2026-23534, CVE-2026-24491, CVE-2026-24675, CVE-2026-24676,
    CVE-2026-24679, CVE-2026-24681, CVE-2026-24682, CVE-2026-24683, CVE-2026-24684,
    CVE-2026-25997, CVE-2026-26271, CVE-2026-26986, CVE-2026-27015, CVE-2026-25941,
    CVE-2026-22855, CVE-2026-22857, CVE-2026-23533, CVE-2026-23732, CVE-2026-23883,
    CVE-2026-23884


author: wangkai <13474090681@163.com> - 2:2.11.8-3
changelog:
  - Fix CVE-2026-26955, CVE-2026-26965, CVE-2026-31806, CVE-2026-31883, CVE-2026-31885,
    CVE-2026-33984, CVE-2026-33983


author: wangkai <13474090681@163.com> - 2:2.11.8-5
changelog:
  - Fix CVE-2026-25942, CVE-2026-25952, CVE-2026-25953, CVE-2026-25954, CVE-2026-27951,
    CVE-2026-29774, CVE-2026-29775, CVE-2026-31884, CVE-2026-33985


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-47
changelog:
  - fix coredump when get empty from udp sendring
  - [virtio]: distribute pkg by dst_port
  - parse packages type in rx_poll
  - [virtio]: cfg ipv4 and ipv6 addr
  - fix build failed in 2003sp4
  - fix dpdk_bond_primary_set bug
  - cfg: del unnecessary logs
  - perftool: add latency tool


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-48
changelog:
  - add flow_bifurcation switch in lstack_cfg file
  - virtio: dfx data of virtio
  - virtio: update g_rule_port by reg_ring_type enum
  - virtio: mode actual_queue_num
  - fix poll init not clear old fd


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-50
changelog:
  - cleancode: rename gazelle files in lwip
  - add .gitignore
  - cleancode: improving makefile readability


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-51
changelog:
  - cleancode: refactor sys_now and lwip_ioctl
  - add sem post when update event
  - cleancode: refactor lwipgz_hlist.h
  - fix EPOLLIN event dropd
  - cleancode: refactor lwipgz_list.h
  - cleancode: refactor posix_api
  - fix some error of NULL pointer
  - cleancode: refactor posix type and get_socket
  - cleancode: refactor lwipsock.h


author: yangchen555 <yangchen145@huawei.com> - 1.0.2-52
changelog:
  - fix redis coredump when hugetlbs pagesize is 1024M
  - vitio_user: modify mbuf index for bond4
  - Check the return of lwip_init
  - support kernel connect
  - POSIX: fix select timeout disable and build failed in openEuler 2003


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-53
changelog:
  - virtio_user: modify mbuf index for bond4
  - fix issue: create virtio_user based on bond4 main network card
  - virtio: fix dfx error with multiple cpus
  - dfx: optimize gazellectl -x for bond


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-54
changelog:
  - refector fill udp sendring
  - virtio_user: solve the issue that failed to bind virtio_user's IPv6 address
  - virtio_user: add vlan info for kernerl packets when vlan switch is on
  - WRAP:fix double connect lead posix api disable


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-55
changelog:
  - virtio: mod virtio_user_name when multi process is on
  - WRAP: fix bind log error
  - WRAP:fix ltran mode did not bind kernel while open kni
  - virtio_user: The program establishes a network connection when network card status is up
  - fix redis coredump ctrl-c during the pressure test


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-59
changelog:
  - epoll: fix wild pointer detected by cooddy
  - tools: fix sync patch script date wrong and update the way get patchnum
  - cfg: modify maximum tcp_conn_count to 2w
  - fix mbuf_total calculation error


author: yinbin6 <jiangheng14@huawei.com> - 1.0.2-64
changelog:
  - cleancode: declare different cfg_params types
  - cleancode: add rpc_async_call, remove rpc_msg_arg.socklen, fix some format
  - cleancode: move some API from stack to rpc and rtw
  - cleancode: refactor rtc_api rtw_api and dummy_api


author: yinbin6 <jiangheng14@huawei.com> - 1.0.2-66
changelog:
  - af_xdp: set rlimit unlimit when gazelle init
  - add interrupt mode support
  - add pingpong dfx support


author: yinbin6 <jiangheng14@huawei.com> - 1.0.2-67
changelog:
  - bugfix: fix gazelle init failed while setup by non-root user
  - rpc: fix rpc_sync_call spinlock block when msg be recalled
  - rtw: fix send length exceeding send_ring_size
  - fix stack null when register interrupt


author: yinbin <yinbin8@huawei.com> - 1.0.2-77
changelog:
  - openGauss: support kernel connnect
  - xdp: support stack bind numa
  - CFG: fix xdp iface check error
  - fix build error in 2003SP4
  - cfg: show dpdk args after dpdk_adjust_args
  - fix free null pointer when no matching device is found
  - update test/unitest/ltran/ltran_param_test.c.
  - Fix the wrong spelling description in the notes and logs
  - LWIP: adjust position of shutdown in callback of connect
  - fix socket of control thread is overwirtten due to another primary process start


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-79
changelog:
  - cfg: notify that it's unsupported, when stack_num > 1
  - fix errno == ETIMEFOUT
  - fix epoll and recv threads blocked on the same semaphore. data cannot be read in recv thread.
  - fix rpc pool leak, when thread exits
  - remove app_bind_numa check from exclude_cpus
  - openGauss: fix connection attempt failed
  - openGauss: fix gs_ctl switchover failed


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-80
changelog:
  - Connect: execute lwip connect if dst_ip and host_ip are in the same network.
  - kernerl bind: add ipv6 add check
  - openGauss unsupport_tcp_optname
  - fix a contention issue when rpc pools are added to rpc_pool_array


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-82
changelog:
  - DUMP: fix abnomal printing in the dump process.
  - SIGNAL: Adjust hijack sigal table to hijack SIGABRT SIGQUIT and delet SIGKILL
  - SIGNAL: Adjust sigaction function to keep lstack signal function executed successfully.


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-83
changelog:
  - SIGNAL: block SIGSEGV during exit process
  - Stack: unset stack_stop, while stacks exit by rpc message.
  - fix the memory leak when using strdup


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-84
changelog:
  - update gazelle max numa nodes 8
  - Protocal: fixing deathlock between protocol threads and app thread
  - Connect: fix benchmark_dws connect failed
  - RTC-mode: fix gazellectl can't print connenct info
  - add xdp tx checksum/tso offload


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-85
changelog:
  - sockio: fix rpc_send coredump after RPC_MSG_EXIT
  - sockio: fix tcp_write not remove EPOLLOUT
  - fix 20.03-LTS build failed
  - sk_wait: igonre mem_thread flush signal
  - sockio: fix sendmbox full return EWOULDBLOCK
  - sockio: fix callback_tcp_send output too many at once
  - mempool: increase MEM_THREAD_MANAGER_FREE_S to avoid poll
  - sockctl: fix rtw broadcast close and shutdown
  - poll: fix do_lwip_connected_callback not delete poll kernel fd
  - sk_event: fix rtw epoll wrong event notify and remove
  - sockio: fix rtw_stack_tcp_write wrong copied_total after append
  - epoll: fix do_lwip_connected_callback
  - sk_wait: fix lwip_wait_foreach_notify coredump at startup
  - socket: fix stack_udp_readmsg return len
  - sk_wait: fix sock_wait_common_free socket: simplify calling free_count in rtw_stack_tcp_write
  - mbox: fix mbox_ring_common_free coredump when rte_ring_create failed
  - sk_wait: fix lwip_tcp_allow_send coredump
  - mempool: stop using cache when too many threads
  - mempool: fix pthread_tryjoin_np coredump when mysqld shutdown
  - mempool: mem_get_rpc add reserve limit
  - mempool: fix mbox_ring free not call recv_finish_burst
  - mempool: modify mbuf num and rpc_msg num
  - socket: fix sk_wait cannot be interrupted by signals
  - socket: fix tcp closed
  - tcp: add GAZELLE_TCP_ASYNC_RECVD      fix mbuf OOM caused by untimely sockio_peek_recv_free
  - socket: fix stack_tcp_read do not recv_finish_burst
  - socket: fix connect blocking
  - mempool: fix copy_mbuf_private
  - dfx: support sk_wait stat
  - mempool: add mem_thread_cache_flush          fix PBUF_POOL_PREINIT
  - cfg: add mem_async_mode
  - cfg: add mem_cache_max and change default rpc_msg_max
  - socket: adapt to tcp and udp
  - socket: refactor tcp and udp
  - socket: adapt to sock_event
  - socket: refactor sock_event
  - cleancode: remove get_stack_tid DPDK_PKT_BURST_SIZE PACKET_READ_SIZE
  - cleancode: remove gazelle_light_ring
  - cleancode: add GAZELLE_SAME_NODE
  - RTC: fixing program stuck while gazelle exit in multi-threads envirement


author: hugel <gengqihu2@h-partners.com> - 9.52-23
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Sync some patches from community
         backport-Fix-memory-leak-in-pdfwrite-device.patch
         backport-Fix-memory-leak-on-error-in-bitmap_paint-and-its-cal.patch
         backport-Fix-memory-leaks-in-tiffsep.patch


author: yaoxin <yao_xin001@hoperun.com> - 5.2.2-1
changelog:
  - Update to 5.2.2
    * Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)
    * Address SF issue #151: A heap-buffer-overflow in gif2rgb.c:294:45
    * Address SF issue #166: a read zero page leads segment fault in
      getarg.c and memory leaks in gif2rgb.c and gifmalloc.c


author: fuanan <fuanan3@h-partners.com> - 2.27.0-16
changelog:
  - Type:CVE
  - ID:CVE-2023-25652 CVE-2023-29007 CVE-2023-25815
  - SUG:NA
  - DESC:Fix CVE-2023-25652 CVE-2023-29007 CVE-2023-25815


author: fuanan <fuanan3@h-partners.com> - 2.27.0-17
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:enable multithreading compilation and installation,
         move Git.3pm.gz to perl-Git,avoid installation conflicts,
         change BuildRequires from pcre-devel to pcre2-devel.


author: huyubiao <huyubiao@huawei.com> - 2.27.0-18
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Specifying Obsoletes and Provides version numbers, prevent upgrade conflicts.
         Delete git-core-doc from git, git-core-doc is provided by git-help.


author: fuanan <fuanan3@h-partners.com> - 2.27.0-19
changelog:
  - Type:CVE
  - ID:CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465
  - SUG:NA
  - DESC:Fix CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465


author: fuanan <fuanan3@h-partners.com> - 2.27.0-25
changelog:
  - Type:CVE
  - ID:CVE-2025-27613 CVE-2025-46334 CVE-2025-46835
  - SUG:NA 
  - DESC:Fix CVE-2025-27613 CVE-2025-46334 CVE-2025-46835


author: fuanan <fuanan3@h-partners.com> - 2.27.0-26
changelog:
  - Type:CVE
  - ID:CVE-2025-27613 CVE-2025-46334 CVE-2025-46835
  - SUG:NA
  - DESC:refix CVE-2025-27613 CVE-2025-46334 CVE-2025-46835


author: fuanan <fuanan3@h-partners.com> - 2.27.0-27
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:modify patch
         backport-CVE-2025-27613-CVE-2025-46334-CVE-2025-46835.patch


author: chengyechun <chengyechun1@huawei.com> - 2.28-99
changelog:
  - Type:CVE
  - ID:CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602
  - SUG:NA
  - DESC:fix CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602


author: chengyechun <chengyechun1@huaiwe.com> - 2.28-101
changelog:
  - Type:bugfix
  - ID:
  - SUG:NA
  - DESC:nscd: Use errval, not errno to guide cache update
         nsce :Skip unusable entries in first pass in prune_cache


author: Feifei Wang <wangfeifei@hygon.cn> - 2.28-102
changelog:
  - x86: Reversing calculation of __x86_shared_non_temporal_threshold
    x86: Optimizing memcpy for AMD Zen architecture
    x86: Add Hygon Dhyana support
    https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=d3c57027470b
    https://sourceware.org/git/?p=glibc.git;a=commit;h=59803e81f96b479c17f583b31eac44b57591a1bf
    https://sourceware.org/git/?p=glibc.git;a=commit;h=ade8b817fead73b302d08c88cd44ea2ea56793d4


author: liumingran <liumr1@chinatelecom.cn> 2.28-108
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fnmatch: Fix memory leak problem by backport from glibc 2.35
    https://sourceware.org/git/?p=glibc.git;a=commit;h=252864544afa45feb28f8ef505056f17eccd3073
    https://sourceware.org/git/?p=glibc.git;a=commit;h=d7ee6bd8c217a4deb756739039fa9c165d26ec43
    https://sourceware.org/git/?p=glibc.git;a=commit;h=a79328c745219dcb395070cdcd3be065a8347f24
    https://sourceware.org/git/?p=glibc.git;a=commit;h=4e32c8f5682004d0571395fe9fa1bc1b73b40f4c


author: panzhe <panzhe@kylinos.cn> - 2.28-120
changelog:
  - sync from glibc upstream for fix bugs
  - libio: Disable vtable validation for pre-2.1 interposed handles [BZ #25203]
  - x86: Assume --enable-cet if GCC defaults to CET [BZ #25225]
  - string: Define __CORRECT_ISO_CPP_STRING_H_PROTO for Clang [BZ #25232]


author: Qingqing Li <liqingqing3@huawei.com> - 2.28-124
changelog:
  - libio: Fix ungetwc operating on byte stream [BZ #33998] (CVE-2026-5928)
  - stdio-common: Fix buffer overflow in scanf %mc [BZ #34008] (CVE-2026-5450)


author: Xu Raoqing <609179072@qq.com> - 3.6.14-22
changelog:
  - fix CVE-2026-42009
  - fix CVE-2026-42010
  - fix CVE-2026-42013
  - fix CVE-2026-42014
  - fix CVE-2026-5260
  - fix CVE-2026-42015
  - fix CVE-2026-3832


author: hanchao <hanchao63@huawei.com> - 1.15.7-28
changelog:
  - Type:CVE
  - CVE:CVE-2023-29402,CVE-2023-29404,CVE-2023-29405
  - SUG:NA
  - DESC: fix CVE-2023-29402,CVE-2023-29404,CVE-2023-29405


author: luoyujie <luoyujie5@huawei.com> - 1.15.7-34
changelog:
  - Type:CVE
  - CVE:CVE-2023-39318,CVE-2023-39319
  - SUG:NA
  - DESC:fix CVE-2023-39318 and CVE-2023-39319


author: hanchao <hanchao63@huawei.com> - 1.15.7-39
changelog:
  - Type:CVE
  - CVE:CVE-2024-24783,CVE-2024-24785,CVE-2023-45290,CVE-2023-45289
  - SUG:NA
  - DESC:fix CVE-2024-24783,CVE-2024-24785,CVE-2023-45290,CVE-2023-45289


author: wangshuo <wangshuo@kylinos.cn> - 1.15.7-42
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport the upstream patch, fix the overflow issue in runtime.netpollWaiters


author: wujichao <wujichao1@huawei.com> - 1.15.7-50
changelog:
  - Type:CVE
  - CVE:CVE-2024-45336
  - SUG:NA
  - DESC:remove 0001-drop-hard-code-cert.patch and modify CVE-2024-45336


author: huzhangying <huzhangying@huawei.com> - 1.15.7-55
changelog:
  - Type:CVE
  - CVE:CVE-2025-58183, CVE-2025-58185, CVE-2025-61724
  - SUG:NA
  - DESC:fix CVE-2025-58183, CVE-2025-58185, CVE-2025-61724


author: huzhangying <huzhangying@huawei.com> - 1.15.7-59
changelog:
  - Type:CVE
  - CVE:CVE-2025-61732,CVE-2025-68119,CVE-2025-61731,CVE-2025-61726,CVE-2025-68121
  - SUG:NA
  - DESC:fix CVE-2025-61732,CVE-2025-68119,CVE-2025-61731,CVE-2025-61726,CVE-2025-68121


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.04-31
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:disk/diskfilter: Check calloc() result for NULL
         kern/buffer: Handle NULL input pointer in grub_buffer_free()
         disk/diskfilter: Don't make a RAID array with more than 1024 disks
         loader/multiboot_elfxx: Fix memory leak
         loader/linux: Ensure the newc pathname is NULL-terminated
         term/i386/pc/vga_text: Prevent out-of-bounds writes to VGA text buffer
         normal/cmdline: Fix two related integer underflows
         fs/iso9660: Fix memory leaks in grub_iso9660_susp_iterate()
         fs/squash4: Fix memory leaks in grub_squash_iterate_dir()
         fs/xfs: Fix memory leaks in XFS module
         kern/file: Fix error handling in grub_file_open()


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.04-32
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:osdep/linux/hostdisk: Modify sector by sysfs as disk sector
         net/bootp: Fix unchecked return value
         fs/iso9660: Avoid reading past the entry boundary
         fs/iso9660: Incorrect check for entry boundary
         fs/iso9660: Prevent skipping CE or ST at start of continuation area
         fs/iso9660: Prevent read past the end of system use area
         fs/iso9660: Add check to prevent infinite loop
         gentpl.py: Remove .interp section from .img files
         kern/fs: Fix possible integer overflow in i386-pc mode with large partitions
         font: Reject fonts with negative max_char_width or max_char_height
         font: Assign null_font to unknown_glyph
         font: Check return value of grub_malloc() in ascii_glyph_lookup()


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.04-36
changelog:
  - Type:CVE
  - CVE:CVE-2023-4692 CVE-2023-4693
  - SUG:NA
  - DESC:fs/ntfs: Make code more readable
         fs/ntfs: Fix an OOB read when parsing a volume label
         fs/ntfs: Fix an OOB read when parsing bitmaps for index attributes
         fs/ntfs: Fix an OOB read when parsing directory entries from resident and non-resident index attributes
         fs/ntfs: Fix an OOB read when reading data from the resident $DATA attribute
         fs/ntfs: Fix an OOB write when parsing the $ATTRIBUTE_LIST attribute for the $MFT file


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.04-38
changelog:
  - Type:CVE
  - CVE:CVE-2024-1048
  - SUG:NA
  - DESC:grub-set-bootflag: Fix for CVE-2024-1048
         commands/acpi: Fix calculation of ACPI tables addresses when processing RSDT and XSDT
         kern/acpi: Skip NULL entries in RSDT and XSDT
         util/grub-mount: Check file path sanity
         kern/acpi: Use xsdt_addr if present
         commands/acpi: Use xsdt_addrifpresent


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.04-40
changelog:
  - Type:CVE
  - CVE:CVE-2024-45781,CVE-2024-45782,CVE-2024-56737,CVE-2024-45780,CVE-2024-45783,CVE-2024-49504,CVE-2025-0624,CVE-20
  24-45774,CVE-2024-45775,CVE-2025-0622,CVE-2025-0622,CVE-2025-0622,CVE-2024-45776,CVE-2024-45777,CVE-2025-0690,CVE-20
  25-1118,CVE-2024-45778,CVE-2024-45779,CVE-2025-0677,CVE-2025-0684,CVE-2025-0685,CVE-2025-0686,CVE-2025-0689,CVE-2025
  -0678,CVE-2025-1125
  - SUG:NA
  - DESC:fix the vulnerabilities announced on February 18th, 2025


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 1:2.04-42
changelog:
  - Type:CVE
  - CVE:CVE-2025-61661,CVE-2025-61662,CVE-2025-61663,CVE-2025-61664
  - SUG:NA
  - DESC:commands/usbtest: Ensure string length is sufficient in usb string processing
         commands/usbtest: Use correct string length field
         tests/lib/functional_test: Unregister commands on module unload
         normal/main: Unregister commands on module unload
         gettext/gettext: Unregister gettext command on module unload


author: yueyuankun <yueyuankun@kylinos.cn> - 1:2.04-43
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:protect grub2 packages
         protected: grub2-efi-aa64, grub2-efi-ia32, grub2-efi-x64, grub2-pc, grub2-tools-minimal


author: lizhengde <lizhengde@xfusion.com> - 1.16.2-7
changelog:
  - Type:CVE
  - CVE:CVE-2026-53702
  - SUG:NA
  - DESC:Stack buffer overflow in GStreamer H.265 parser. Fix incorrect loop bound.


author: Funda Wang <fundawang@yeah.net> - 1.16.2-6
changelog:
  - fix CVE-2024-47538, CVE-2024-47541, CVE-2024-47542, CVE-2024-47600,
    CVE-2024-47607, CVE-2024-47615, CVE-2024-47835


author: yaoxin <yao_xin001@hoperun.com> - 1.16.2-7
changelog:
  - Fix cves:
    CVE-2024-47606,CVE-2024-47613,CVE-2024-47775,CVE-2024-47776
    CVE-2024-47777,CVE-2024-47778,CVE-2024-47774,CVE-2024-47540
    CVE-2024-47602,CVE-2024-47601,CVE-2024-47834,CVE-2024-47537
    CVE-2024-47597,CVE-2024-47543,CVE-2024-47596,CVE-2024-47539
    CVE-2024-47546


author: Funda Wang <fundawang@yeah.net> - 1.16.2-12
changelog:
  - fix CVE-2026-1940, CVE-2026-3083, CVE-2026-3085
  - fix GStreamer-SA-2026-0002: Out-of-bounds read in MP4 demuxer


author: xinghe <xinghe2@h-partners.com> - 2.2.16-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:server: 'source' interface ignored from 'default-server' directive


author: yaoxin <yaoxin30@h-parters.com> - 1.12.1-1
changelog:
  - Update to 1.12.1 and fix CVE-2018-13867,CVE-2018-14031,CVE-2018-16438,CVE-2019-8396,CVE-2020-10812 and CVE-2021-37501


author: chenzhitao <chenzhitao8@huawei.com> - 2.4.43-16
changelog:
  - Type:CVE
  - ID:NA
  - SUG:restart
  - DESC:fix CVE-2022-28614 CVE-2022-26377 CVE-2022-30522 CVE-2022-28615  CVE-2022-31813


author: chengyechun <chengyechun1@huawei.com> - 2.4.43-19
changelog:
  - Type:CVE
  - ID:CVE-2022-36760, CVE-2006-20001, CVE-2022-37436
  - SUG:restart
  - DESC:fix CVE-2022-36760,CVE-2006-20001,CVE-2022-37436


author: chengyechun <chengyechun1@huawei.com> - 2.4.43-20
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:restart
  - DESC:add ExecStartPost option to htcacheclean.service for solving error message when htcacheclean starting


author: chengyechun <chengyechun1@huawei.com> - 2.4.43-21
changelog:
  - Type:CVE
  - ID:CVE-2023-27522, CVE-2023-25690
  - SUG:restart
  - DESC:fix CVE-2023-27522, CVE-2023-25690


author: chengyechun <chengyechun1@huawei.com> - 2.4.43-23
changelog:
  - Type:CVE
  - ID:CVE-2023-31122, CVE-2023-45802
  - SUG:restart
  - DESC:fix CVE-2023-31122 and CVE-2023-45802


author: chengyechun <chengyechun1@huaiwe.com> - 2.4.43-24
changelog:
  - Type:CVE
  - ID:CVE-2024-24795,CVE-2023-38709,CVE-2024-27316
  - SUG:NA
  - DESC:fix CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 and sync some patches from upstream


author: chengyechun <chengyechun1@huawei.com> - 2.4.43-25
changelog:
  - Type:CVE
  - ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573
  - SUG:NA
  - DSEC:fix some CVEs


author: yanglu <yanglu72@h-partners.com> - 2.4.43-28
changelog:
  - Type:CVE
  - CVE:CVE-2025-49812,CVE-2025-23048,CVE-2024-47252,CVE-2024-43204,CVE-2024-42516
  - SUG:NA
  - DESC:fix CVE-2025-49812 CVE-2025-23048 CVE-2024-47252 CVE-2024-43204 CVE-2024-42516
         mod_lua: Fix memory handling in output filters.
         Fix a regression that caused stickysession keys
         avoid ap_set_content_type when processing a _Request_Header
         set_cookie_name: ensure correct format


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.4.43-31
changelog:
  - Type:CVE
  - CVE:CVE-2025-58098,CVE-2025-65082,CVE-2025-66200
  - SUG:NA
  - DESC:fix CVE-2025-58098,CVE-2025-65082,CVE-2025-66200


author: tangce <tangce1@h-partners.com> - 2.4.43-34
changelog:
  - Type:CVE
  - CVE:CVE-2026-24072,CVE-2026-29168,CVE-2026-29169,CVE-2026-33006,CVE-2026-34059
  - SUG:NA
  - DESC:fix CVE-2026-24072,CVE-2026-29168,CVE-2026-29169,CVE-2026-33006,CVE-2026-34059


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.4.43-35
changelog:
  - Type:CVE
  - CVE:CVE-2026-33007,CVE-2026-33523,CVE-2026-33857,CVE-2026-34032
  - SUG:NA
  - DESC:fix CVE-2026-33007,CVE-2026-33523,CVE-2026-33857,CVE-2026-34032


author: tangce <tangce1@h-partners.com> - 2.4.43-36
changelog:
  - Type:CVE
  - CVE:CVE-2026-29167,CVE-2026-42535,CVE-2026-44631
  - SUG:NA
  - DESC:fix CVE-2026-29167,CVE-2026-42535,CVE-2026-44631


author: tangce <tangce1@h-partners.com> - 2.4.43-37
changelog:
  - Type:CVE
  - CVE:CVE-2026-44186,CVE-2026-44185,CVE-2026-42536,CVE-2026-34356,CVE-2026-34355,CVE-2026-29170
  - SUG:NA
  - DESC:fix CVE-2026-44186,CVE-2026-44185,CVE-2026-42536,CVE-2026-34356,CVE-2026-34355,CVE-2026-29170


author: yangjiaqi <yangjiaqi16@huawei.com> - 2.0.18-15
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: keep the service status unchanged after iSulad service upgrade


author: zhangxingrong <zhangxingrong@uniontech.com> - 3.16-4
changelog:
  - iperf3 now builds correctly on architectures without native support for 64-bit atomic types, by linking with the libatomic library


author: wangkai <13474090681@163.com> - 3.17.1-1
changelog:
  - Update to 3.17.1
  - iperf3 no longer changes its current working directory in --daemon mode. This results in more 
    predictable behavior with relative paths, in particular finding key and credential files for authentication.
  - A new --json-stream option has been added to enable a streaming output format, consisting of 
    a series of JSON objects (for the start of the test, each measurement interval, and the end of the test) separated by newlines
  - UDP tests now work correctly between different endian hosts
  - The --fq-rate parameter now works for --reverse tests
  - The statistics reporting interval is now available in the --json start test object


author: wuchangsheng <wuchangsheng2@huawei.com> - 5.5.0-10
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:tc flowerr Fix buffer overflow on large labels
         q_cake allow changing to diffserv3


author: jiangheng <jiangheng14@huawei.com> - 5.5.0-11
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:fix devlink health dump command without arg
         tc: em_u32: fix offset parsing
         l2tp: fix typo in AF_INET6 checksum JSON print
         bridge: fix memory leak when doing fdb get
         ip neigh: fix memory leak when doing 'get'
         ip address: fix memory leak when specifying device


author: liubo <liubo335@huawei.com> - 5.5.0-16
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:libnetlink: fix socket leak in rtnl_open_byproto()
         lnstat: fix strdup leak in -w argument parsing
         tc_util: Fix parsing action control with space and slash
         remove libcap dependency


author: liubo <liubo335@huawei.com> - 5.5.0-17
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:nexthop: fix error reporting in filter dump
         bridge: report correct version
         q_cake: Make fwmark uint instead of int
         tc: m_action: check cookie hex string len
         iproute2: fix MPLS label parsing
         tc_util: detect overflow in get_size
         Revert "bpf: replace snprintf with asprintf when dealing with long buffers"
         tc/m_estimator: Print proper value for estimator interval in raw.
         iproute2: ip maddress: Check multiaddr length
         iproute2: ip addr: Organize flag properties structurally
         addr: Fix noprefixroute and autojoin for IPv4
         devlink: fix memory leak in cmd_dev_flash()
         tipc: bail out if algname is abnormally long
         tipc: bail out if key is abnormally long
         utils: Fix BIT() to support up to 64 bits on all architectures
         ipmonitor: Fix recvmsg with ancillary data
         devlink: fix infinite loop on flash update for drivers without status
         tc: u32: Fix key folding in sample option
         lnstat: fix buffer overflow in header output
         nstat: print useful error messages in abort() cases


author: yanglu <yanglu72@h-partners.com> - 5.5.0-19
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:lib:names:check calloc return value in db_names_alloc
         fix fd leak when playing with netns


author: kuenking111 <wangkun49@huawei.com> - 1:1.8.0.382-b05.9
changelog:
  - add add-0010-8301749-Tracking-malloc-pooled-memory-size.patch
  - add 8213397-Stack-dump-should-show-more-clearly-when-a-t.patch
  - add Record-the-number-of-processes-to-errlog-file.patch.patch
  - add 8254723-Add-diagnostic-command-to-write-Linux-perf-m.patch
  - add The-OverWriteOldestGCLog-option-is-added-to-control.patch
  - add add-6899049-G1-Clean-up-code-in-ptrQueue.-ch-pp-and-.patch
  - add add-make-Appcds-jsa-rw-region-deterministic.patch
  - add add-8142508-To-bring-j.u.z.ZipFile-s-native-implemen.patch
  - add add-8198423-Improve-metaspace-chunk-allocation.patch
  - add add-8226530-ZipFile-reads-wrong-entry-size-from-ZIP6.patch
  - add add-fix-lock_fd-no-close-and-improve-KAEProvider.patch
  - add add-8242842-Avoid-reallocating-name-when-checking-fo.patch
  - add add-8170831-ZipFile-implementation-no-longer-caches-.patch
  - add add-8146431-j.u.z.ZipFile.getEntry-throws-AIOOBE.patch
  - add add-8226530-test-case-fixed.patch
  - add add-8147940-Modify-testcase-this-test-does-not-assum.patch
  - add add-8191924-Adjust-DelegatingClassLoader-s-metadata-.patch
  - add add-Do-not-collect_class-when-DynamicCDS-dump.patch
  - add add-add-Count-instance-klass-when-loading-from-jsa-f.patch
  - add add-Adapting-IOException-of-Zip-to-ZipException.patch
  - add add-8227041-runtime-memory-RunUnitTestsConcurrently.patch
  - add add-fix-windows-build-Dynamic-CDS-failure.patch
  - add add-Fix-aarch64-runtime-thread-signal-transfer-bug.patch
  - add 8295068-SSLEngine-throws-NPE-parsing-CertificateRequ.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> - 1:1.8.0.392-b08.0
changelog:
  - add 8308682-Enhance-AES-performance.patch
  - add Fix-the-memory-leak-of-MetaspaceAllocationTest.patch
  - add Add-metaspace-memory-allocation-failure-validation.patch
  - add change-value-of-GCLockerRetryAllocationCount-from-2-.patch
  - del 8202952.patch
  - del 8283441-C2-segmentation-fault-in-ciMethodBlocks-make.patch
  - modified Dynamic-CDS-Archive.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified kae-phase1.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch
  - upgrade to jdk8u392-b08


author: kuenking111 <wangkun49@huawei.com> - 1:1.8.0.392-b08.1
changelog:
  - add Fix-crash-in-JNI-s-GetDoubleArrayRegion-and-SetDoubl.patch
  - add  8263557-Possible-NULL-dereference-in-Arena-destruct_.patch
  - add 8294906-Memory-leak-in-PKCS11-NSS-TLS-server.patch
  - add 8314236-Overflow-in-Collections.rotate.patch
  - add 8313626-C2-crash-due-to-unexpected-exception-control.patch
  - add 8312200-Fix-Parse-catch_call_exceptions-memory-leak.patch
  - add 8193682-Infinite-loop-in-ZipOutputStream.close.patch
  - add 8285516-clearPassword-should-be-called-in-a-finally-.patch
  - add 8148470-Metadata-print-routines-should-not-print-to-.patch
  - add 8293344-JDK-8242181-broke-stack-printing-for-non-att.patch
  - add 8278794-Infinite-loop-in-DeflaterOutputStream.finish.patch
  - add 8312065-Socket.connect-does-not-timeout-when-profili.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified add-missing-test-case.patch


author: kuenking111 <wangkun49@huawei.com> - 1:1.8.0.392-b08.2
changelog:
  - remove add-8142508-To-bring-j.u.z.ZipFile-s-native-implemen.patch
  - remove add-8226530-ZipFile-reads-wrong-entry-size-from-ZIP6.patch
  - remove add-8242842-Avoid-reallocating-name-when-checking-fo.patch
  - remove add-8170831-ZipFile-implementation-no-longer-caches-.patch
  - remove add-8146431-j.u.z.ZipFile.getEntry-throws-AIOOBE.patch
  - remove add-8226530-test-case-fixed.patch
  - remove add-Adapting-IOException-of-Zip-to-ZipException.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> - 1:1.8.0.402-b06.0
changelog:
  - modified 0019-8040213-C2-does-not-put-all-modified-nodes-on-IGVN-w.patch
  - modified Improve_AlgorithmConstraints_checkAlgorithm_performance.patch
  - modified add-missing-test-case.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified g1gc-numa-aware-Implementation.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch
  - modified 8203699.patch
  - add Add-CaptchaTest-and-fix-KAE-Testcases.patch
  - add 8177146-MethodHandles.Lookup-bind-allows-illegal-pro.patch
  - add Add-compiling-option-GS-when-building-windows-JDK.patch
  - add Fix-for-JDK-8137099-for-G1-is-to-not-return-null-unt.patch
  - add 8273553-sun.security.ssl.SSLEngineImpl.closeInbound-.patch
  - add 8260923-Add-more-tests-for-SSLSocket-input-output-sh.patch
  - add 8057967-CallSite-dependency-tracking-scales-devastat.patch
  - add 8079205-CallSite-dependency-tracking-is-broken-after.patch


author: Benshuai5D <benshuai5d@163.com> - 1:1.8.0.402-b06.4
changelog:
  - add 8322725-tz-Update-Timezone-Data-to-2023d.patch
  - add 8325150-tz-Update-Timezone-Data-to-2024a.patch
  - add 8220175-serviceability-dcmd-framework-VMVersionTest..patch
  - add 8149343-assert-rp-num_q-no_of_gc_workers-failed-sani.patch
  - add 8139595-MethodHandles-remove_dependent_nmethod-is-no.patch
  - add 8143408-Crash-during-InstanceKlass-unloading-when-cl.patch
  - add GCC-12-reports-some-compiler-warnings.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> -1:1.8.0.412-b08.0
changelog:
  - del 8322725-tz-Update-Timezone-Data-to-2023d.patch
  - del 8325150-tz-Update-Timezone-Data-to-2024a.patch
  - del fix-the-length-value-of-ciBlock-in-ciMethodBlocks.cp.patch
  - modified 8014628-Support-AES-Encryption-with-HMAC-SHA2-for-Ke.patch
  - modified 8057743-process-Synchronize-exiting-of-threads-and-p.patch
  - modified add-missing-test-case.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified kae-phase2.patch
  - modified support-numactl-for-hadoop-yarn.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch


author: kuenking111 <wangkun49@huawei.com> -1:1.8.0.412-b08.3
changelog:
  - add DependencyContext-mark_dependent_nmethods-crash-in-Dynamic-cds-mode.patch
  - add 8138922-StubCodeDesc-constructor-publishes-partially-constructed.patch


author: songliyang <songliyang@kylinos.cn> -1:1.8.0.412-b08.4
changelog:
  - fix LoongArch64-support.patch error that apply patch on loongarch64 in prep stage
  - fix loongson vendor error


author: songliyang <songliyang@kylinos.cn> -1:1.8.0.422-b05.6
changelog:
  - let support-KAE-zip.patch not install libz.so on loongarch64
  - update LoongArch64 port to 8u422
  - fix changelog date error


author: Autistic_boyya <wangzhongyi7@huawei.com> -1:1.8.0.432.b06-1
changelog:
  - modified 8014628-Support-AES-Encryption-with-HMAC-SHA2-for-Ke.patch
  - modified 8193682-Infinite-loop-in-ZipOutputStream.close.patch
  - modified 8313626-C2-crash-due-to-unexpected-exception-control.patch
  - modified Backport-8318889-Backport-Important-Fixed-Issues-in-Later-Ver.patch
  - modified GCC-12-reports-some-compiler-warnings.patch
  - modified add-missing-test-case.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch
  - deleted 8278794-Infinite-loop-in-DeflaterOutputStream.finish.patch
  - add Backport-8057910-G1-BOT-verification-should-not-pass.patch
  - add Backport-8069330-and-adapt-G1GC-related-optimization.patch
  - add SA-redact-support-password.patch


author: kuenking111 <wangkun49@huawei.com> -1:1.8.0.432.b06-2
changelog:
  - modified add-Fix-aarch64-runtime-thread-signal-transfer-bug.patch
  - add 8253072-XERCES-version-is-displayed-incorrect.patch
  - add 8159461-8288556-getComponentType.patch
  - add 8136926-phi-NULL-assert-in-PhaseIdealLoop-try_move_s.patch
  - add 8269934-RunThese24H.java-failed-with-EXCEPTION_ACCES.patch


author: DXwangg <wangjiawei80@huawei.com> - 1:11.0.21.9-0
changelog:
  - update to 11.0.21+9(GA)
  - modified delete_expired_certificates.patch
  - modified G1-iterate-region-by-bitmap-rather-than-obj-size-in.patch 
  - modified 8210473-JEP-345-NUMA-Aware-Memory-Allocation-for-G1.patch
  - modified 8214527-AArch64-ZGC-for-Aarch64.patch


author: DXwangg <wangjiawei80@huawei.com> - 1:11.0.22.7-0
changelog:
  - update to 11.0.22+7(GA)
  - modified delete_expired_certificates.patch
  - modified G1-iterate-region-by-bitmap-rather-than-obj-size-in.patch


author: huangjie <huangjie150@huawei.com> - 1:11.0.23.9-0
changelog:
  - modified 8224675-Late-GC-barrier-insertion-for-ZGC.patch
  - modified delete_expired_certificates.patch


author: yangyingqing <yangyingqing@h-partners.com> - 1:11.0.27.6-0
changelog:
  - update to 11.0.27+6(GA)
  - delete 8347965-tz-Update-Timezone-Data-to-2025a.patch
  - add fix-potential-build-fail-in-jbolt.patch


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.8.7-2
changelog:
  - add add-Parallel-Full-gc-mark-stack-draining-should.patch
  - add add-8271579-G1-Move-copy-before-CAS-in-do_copy.patch
  - add add-8267185-Add-string-deduplication-support-to.patch
  - add add-8292296-Use-multiple-threads-to-process-Par.patch
  - add fix-cds-SignedJar_java-test-fails.patch


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.9.8-0.rolling
changelog:
  - fix 8253495-CDS-generates-non-deterministic-outpu.patch
  - fix add-8267185-Add-string-deduplication-support-to.patch
  - fix add-version-txt.patch


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.9.8-1
changelog:
  - add 8295068-SSLEngine-throws-NPE-parsing-CertificateRequ.patch
  - add 8316576-com.sun.jndi.ldap.Connection.cleanup-does-no.patch
  - add 8314063-The-socket-is-not-closed-in-Connection-creat.patch
  - add 8314236-Overflow-in-Collections.rotate.patch
  - add 8313626-C2-crash-due-to-unexpected-exception-control.patch
  - add 8168469-Memory-leak-in-JceSecurity.patch
  - add 8312065-Socket.connect-does-not-timeout-when-profili.patch
  - add 8285516-clearPassword-should-be-called-in-a-finally-.patch
  - add 8312200-Fix-Parse-catch_call_exceptions-memory-leak.patch


author: neu-mobi <liuyulong.work@qq.com> - 1:17.0.10.9-0.rolling
changelog:
  - del 8168469-Memory-leak-in-JceSecurity.patch
  - del 8275509-ModuleDescriptor.hashCode-isn-t-rep.patch
  - del 8275509-ModuleDescriptor.hashCode-isn-t-reproducible.patch
  - del 8285516-clearPassword-should-be-called-in-a-finally-.patch
  - del 8312065-Socket.connect-does-not-timeout-when-profili.patch
  - del 8313626-C2-crash-due-to-unexpected-exception-control.patch
  - del 8314063-The-socket-is-not-closed-in-Connection-creat.patch
  - del 8316576-com.sun.jndi.ldap.Connection.cleanup-does-no.patch
  - modified 8253495-CDS-generates-non-deterministic-outpu.patch
  - modified 8280872-Reorder-code-cache-segments-to-improv.patch
  - modified add-version-txt.patch
  - add Add-problemlist.patch
  - add puyuan-jdk17.0.9-patch.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> - 1:17.0.11.9-0.rolling
changelog:
  - del 8295068-SSLEngine-throws-NPE-parsing-CertificateRequ.patch
  - modify puyuan-jdk17.0.9-patch.patch


author: songliyang <songliyang@kylinos.cn> - 1:17.0.11.9-1
changelog:
  - rewrite LoongArch64-support.patch to sovle error while applying this patch in prep stage
  - fix loongarch vendor error and delete redundant vendor args


author: songliyang <songliyang@kylinos.cn> - 1:17.0.12.7-1
changelog:
  - update Loongarch support patch to fix the error while applying in prep stage
  - delete redundant symbols while viewing spec file with vim that make it strange on highlight


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.12.7-2
changelog:
  - add Huawei-Extending-the-IV-Length-Supported-by-KAEProvider-AES.patch
  - add Backport-7036144-GZIPInputStream-readTrailer-uses-faulty-avai.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> - 1:17.0.12.7-5
changelog:
  - Add Backport-of-JDK-8305680.patch
  - Add Backport-of-JDK-8305937.patch
  - Add 8338785-The-java.awt.datatransfer.SystemFlavorMap-FL.patch
  - Add 8337982-Remove-dead-undef-assrt0n.patch
  - Add 8337274-Remove-repeated-the-in-StyleSheet.create-Sma.patch
  - Add 8335610-DiagnosticFramework-CmdLine-is_executable-co.patch
  - Add Backport-of-8333088-ubsan-shenandoahAdaptiveHeuristi.patch
  - Add Backport-of-8339351-Remove-duplicate-line-in-FileMap.patch
  - Add Backport-of-8330191-Fix-typo-in-precompiled.hpp.patch
  - Add Backport-of-8337712-Wrong-javadoc-in-java.util.Date-.patch


author: Benshuai5D <zhangyunbo7@huawei.com> - 1:17.0.13.11-0
changelog:
  - modify 8264805-Backport-Ahead-of-Time-Compiler.patch
  - modify 8264806-Backport-Graal-Compiler.patch
  - modify Add-JBooster-Lazy-AOT-module.patch
  - modify Apply-TBI-to-ZGC-of-JDK17.patch
  - modify Backport-Important-Fixed-Issues.patch
  - modify KAE-zip-Features.patch
  - modify add-version-txt.patch
  - add Huawei-Fix-JBooster-file-issue-caused-by-os-write-change.patch
  - update to 17.0.13+11(ga)


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.13.11-4
changelog:
  - add Add-jbolt-feature.patch
  - add Enable-TLS-to-communciation-between-JBooster-Server-.patch
  - add SA-redact-support-password.patch
  - add Add-specialized-hashmap-version-of-the-long-type.patch
  - add Implement-JBooster-RPC-byte-alignment.patch
  - add Optimize-LazyAOT-klasses-sending-strategy.patch
  - add Add-KAE-zip-GzipKAEBenchmark-Benchmark.patch
  - add Add-Fix-clear-mark-for-NativeGotJump.patch
  - add 8323066-TestSkipRebuildRemsetPhase.java-fails-with-S.patch
  - modify downgrade-the-glibc-symver-of-memcpy.patch


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.13.11-7
changelog:
  - modify Add-jbolt-feature.patch
  - modify Add-specialized-hashmap-version-of-the-long-type.patch
  - modify Enable-TLS-to-communciation-between-JBooster-Server-.patch


author: Benshuai5D <benshuai5d@huawei> - 1:17.0.14.7-0
changelog:
  - update to 17.0.14
  - modify 8264805-Backport-Ahead-of-Time-Compiler.patch
  - modify 8280872-Reorder-code-cache-segments-to-improv.patch
  - modify 8323066-TestSkipRebuildRemsetPhase.java-fails-with-S.patch
  - modify Backport-Important-Fixed-Issues.patch
  - modify add-version-txt.patch
  - modify jdk17-Add-KAE-provider.patch


author: yaoxin <yao_xin001@hoperun.com> - 1.5.4-1
changelog:
  - Upgrade to 1.5.4 for fix cves: CVE-2022-40149,CVE-2022-40150,
    CVE-2022-45685,CVE-2022-45693 and CVE-2023-1436


author: yinsist <jianhui.oerv@isrc.iscas.ac.cn> - 1.6-4
changelog:
  - Valgrind does not support certain architectures like RISC-V, Before depending on Valgrind, first check if Valgrind supports the architecture


author: yaoxin <1024769339@qq.com> - 1.8.0-4
changelog:
  - Fix CVE-2026-40612,CVE-2026-41256,CVE-2026-41257,CVE-2026-43894,
    CVE-2026-43895,CVE-2026-43896 and CVE-2026-44777


author: sunhai <sunhai10@huawei.com> - 0.15-7
changelog:
  - Handle yet another out of memory condition
  - Fix issue 854 Set error json_tokener_error_memory in
  - Issue 857 fix a few places where json_tokener should
  - Handle NULL gracefully in json_tokener_free
  - Issue 881 don t allow json_tokener_new_ex with a dep


author: caixiaomeng<caixiaomeng2@huawei.com> -1:0.9.1-23
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:ignore sssnic module when building hotpatch to fix sssnic wrongly dependency of sssnic


author: zhangxiaoyu<zhangxiaoyu58@huawei.com> - 2.0.9-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix update cpu-rt period failed and fix layer size type as int64


author: jikai<jikai11@huawei.com> - 2.0.9-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix potential log error, empty pointer reference and overflow


author: lingsheng <lingsheng1@h-partners.com> - 3.4.3-10
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: zhangyao<zhangyao108@huawei.com> - 2.35.2-13
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         backport-column-segmentation-fault-on-invalid-unicode-input-passed-to-s-option.patch
         backport-su-offer-usernames-rather-than-files.patch
         backport-Fix-memory-leaks-in-the-chcpu.patch
         backport-logger-fix-prio-prefix-doesnot-use-priority-default.patch
         backport-mcookie-fix-infinite-loop-when-use-f.patch
         backport-logger-realloc-buffer-when-header-size-changed.patch
         backport-logger-fix-size-use-for-stdin.patch
         backport-vipw-flush-stdout-before-getting-answer.patch
         backport-chfn-Make-readline-prompt-for-each-field-on-a-separate-line.patch
         backport-chfn-flush-stdout-before-reading-stdin-and-fix-uninitialized-variable.patch
         backport-chsh-fflush-stdout-before-reading-from-stdin.patch
         backport-login-Restore-tty-size-after-calling-vhangup.patch
         backport-lsblk-fix-endless-loop-if-device-specified-more-than-once.patch
         backport-libblkid-avoid-buffer-overflow-in-ocfs-superblock-parsing.patch
         backport-libblkid-use-checksum-for-jmicron.patch
         backport-libblkid-cleanup-indentation.patch
         backport-libblkid-fix-jmicron-checksum-and-LE-to-CPU.patch
         backport-libblkid-nvidia_raid-verify-superblock-size.patch
         backport-libblkid-nvidia_raid-validate-checksum.patch


author: cenhuilin <cenhuilin@kylinos.cn> - 2.35.2-15
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         backport-uuidd-fix-open-lock-state-issue.patch


author: fuanan <fuanan3@h-partners.com> - 2.35.2-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         backport-include-c.h-add-helpers-for-unaligned-structure-acce.patch
         backport-libblkid-drbd-reduce-false-positive.patch


author: Yu Peng <yupeng@kylinos.cn> - 2.35.2-19
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
  	   backport-libfdisk-fix-fdisk_reread_changes-for-extended-partitions.patch


author: cenhuilin <cenhuilin@kylinos.cn> - 2.35.2-24
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:lsblk: fix memory leak [coverity scan]
         lsblk: fix possible use-after-free


author: yixiangzhike <yixiangzhike007@163.com> - 2.35.2-26
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport community patches
          fix off-by-one in maximum last sector calculation


author: yaoxin <yao_xin001@hoperun.com> - 1.27.4-1
changelog:
  - Update to 1.27.4 for fix CVE-2024-6381 and CVE-2024-6383
  - libbson Fixes:
    * Fix build with Visual Studio 2013.
    * Fix parsing of colon in timezone.
    * Error on failure to init subdocument in bson_iter_visit_all.
    * Fix string handling in bson_string_new and bson_string_append.
    * Fix iteration in bson_strfreev.
    * Use aligned alloc for bson_array_builder_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Fix conversion warning with GCC 12.
    * Fixes to some format strings in trace logs.
    * Allow mongoc_buffer_t to be larger than INT_MAX.
    * Add bson_array_builder_t.
  - libmongoc Fixes:
    * Fix possible crash reading malformed wire protocol message.
    * Upgraded bundled Zlib from 1.2.3 to 1.3.1
    * Close leftover connections to removed servers.
    * Fix possible crash when client is configured with empty password.
    * Fix possible hang if mongoc_gridfs_file_readv is called with a corrupt chunk with incomplete data.
    * Fix 32-bit compile with 64-bit time_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Disable shared libmongoc targets if ENABLE_SHARED=OFF
    * Fix documentation build with Python 3.9.
    * Fix data race in mongoc_cursor_get_host.
    * Add back support for BUILD_VERSION CMake option. BUILD_VERSION was unintentionally removed in 1.25.0.
    * Send recoveryToken in transactions when connected to a load balancer.


author: wangkai <13474090681@163.com> - 2.5.18-5
changelog:
  - Fix CVE-2026-40334, CVE-2026-40334, CVE-2026-40338, CVE-2026-40339,
    CVE-2026-40340, CVE-2026-40341


author: yanglu <yanglu72@h-partners.com> - 8.16.1-7
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Add require procmail, Fix send mail error which no procmail command


author: yanglu<yanglu72@h-partners.com> - 8.16.1-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: fix newaliases command error and postfix service start execption after sendmail install


author: xinghe <xinghe2@h-partners.com> - 2:1.6.37-2
changelog:
  - Type:cves
  - CVE:CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720
  - SUG:NA
  - DESC:fix CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720


author: yixiangzhike <yixiangzhike007@163.com> - 1.4.2-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:change the files order in patch file fix-doc-about-difok.patch


author: xinghe <xinghe2@h-partners.com> - 2.71.0-4
changelog:
  - Type:cves
  - ID:CVE-2024-52530 CVE-2024-52531 CVE-2024-52532
  - SUG:NA
  - DESC:fix CVE-2024-52530 CVE-2024-52531 CVE-2024-52532


author: zhangpan <zhangpan103@h-partners.com> - 2.71.0-5
changelog:
  - Type:cves
  - ID:CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784
  - SUG:NA
  - DESC:fix CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784


author: zhangpan <zhangpan103@h-partners.com> - 2.71.0-6
changelog:
  - Type:cves
  - ID:CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913
  - SUG:NA
  - DESC:fix CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913


author: zhangpan <zhangpan103@h-partners.com> - 2.71.0-9
changelog:
  - Type:cves
  - ID:CVE-2025-4476 CVE-2025-4948 CVE-2025-4969
  - SUG:NA
  - DESC:fix CVE-2025-4476 CVE-2025-4948 CVE-2025-4969


author: nickyang <nickyang228@163.com> - 2.71.0-11
changelog:
  - Type:cves
  - ID:CVE-2026-1539 CVE-2026-1467 CVE-2026-1761 CVE-2026-0716
  - SUG:NA
  - DESC:fix CVE-2026-1539 CVE-2026-1467 CVE-2026-1761 CVE-2026-0716


author: nickyang <nickyang228@163.com> - 2.71.0-12
changelog:
  - Type:cves
  - ID:CVE-2026-1760 CVE-2026-1801 CVE-2026-2369
  - SUG:NA
  - DESC:fix CVE-2026-1760 CVE-2026-1801 CVE-2026-2369


author: renmingshuai <renmingshuai@huawei.com> - 0.9.4-9
changelog:
  - Type:CVE
  - Id:CVE-2023-6004,CVE-2023-48795,CVE-2023-6918
  - SUG:NA
  - DESC:fix CVE-2023-6004,CVE-2023-48795 and CVE-2023-6918


author: gaihuiying <eaglegai@163.com> - 0.9.4-11
changelog:
  - Type:CVE
  - CVE:CVE-2025-4877 CVE-2025-4878 CVE-2025-5372
  - SUG:NA
  - DESC:fix CVE-2025-4877 CVE-2025-4878 CVE-2025-5372


author: zhangbinqin <zhangbinqin@h-partners.com> - 0.9.4-15
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:fix CVE-2026-0968 CVE-2026-0967 CVE-2026-0966 CVE-2026-0965 CVE-2026-0964 CVE-2025-14821


author: gaihuiying <eaglegai@163.com> - 0.9.4-6
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:backport upstream patches:
         add errno while reset with strtoul call
         fix error returned in ssh_userauth_try_publicke
         client do not close the socket if it was set via opt
         fix openForward to not set sourcehost to NULL
         fix the length calculation of packet in sftp_write


author: zhangbinqin <zhangbinqin@h-partners.com> - 1.9.0-10
changelog:
  - Type:CVE
  - CVE:CVE-2026-7598
  - SUG:NA
  - DESC:add username_len bounds checking to fix CVE-2026-7598


author: yaoxin <yao_xin001@hoperun.com> - 2.20.0-1
changelog:
  - Upgrade to 2.20.0 for fix CVE-2023-39929
  - Fix minor issue about printf data type and value range
  - av1: Revise offsets comments for av1 encode
  - jpeg: add support for crop and partial decode
  - Drop no longer applicable vaGetDriverNames check


author: jiangjiacheng <jiangjiacheng@huawei.com>
changelog:
  - util: keep track of full GSource object not source ID number
  - rpc: mark source returned by virEventGLibAddSocketWatch as unused
  - rpc: ensure temporary GSource is removed from client event loop (CVE-2024-4418)


author: ZixinLi <lizixin10@h-partners.com> - 6.2.0-26
changelog:
  - Fix CVE-2025-12748 CVE-2025-13193
  - conf: split out virDomainDefParseIDs (CVE-2025-12748)
  - conf: Add virDomainDefIDsParseString (CVE-2025-12748)
  - bhyve: Check ACLs before parsing the whole domain XML (CVE-2025-12748)
  - libxl: Check ACLs before parsing the whole domain XML (CVE-2025-12748)
  - lxc: Check ACLs before parsing the whole domain XML (CVE-2025-12748)
  - vz: Check ACLs before parsing the whole domain XML (CVE-2025-12748)
  - qemu: Check ACLs before parsing the whole domain XML (CVE-2025-12748)
  - qemu: snapshot: Set umask for 'qemu-img' when creating external inactive snapshots (CVE-2025-13193)


author: Funda Wang <fundawang@yeah.net> - 2.9.10-43
changelog:
  - Type:CVE
  - CVE:CVE-2024-56171
  - CVE:CVE-2025-24928
  - CVE:CVE-2025-27113
  - SUG:NA
  - DESC: fix CVE-2024-56171, CVE-2025-24928, CVE-2025-27113


author: Funda Wang <fundawang@yeah.net> - 2.9.10-47
changelog:
  - Type:CVE
  - CVE:CVE-2025-49794
  - CVE:CVE-2025-49796
  - SUG:NA
  - DESC: fix CVE-2025-49794, CVE-2025-49796


author: fuanan <fuanan3@h-partners.com> - 1.1.34-9
changelog:
  - fix xsltCleanupSourceDoc function:
    Clean up attributes in source doc
    Avoid null deref on documents without root


author: liyunfei <liyunfei33@huawei.com> - 17.0.6-11
changelog:
  - update to llvm-for-oe-17.0.6-2509.0.2
  - release-note https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-17.0.6-2509.0.2
  - add fix for Propeller MachineBasicBlock hash set


author: hankangkang <hankangkang5@huawei.com> - 2.2.0-62
changelog:
  - When the GAZELLE_TCP_REUSE_IPPORT is on, min_cnts_lpcb is NULL
  - Turn on the LWIP_SO-LINGER switch


author: wangkai <13474090681@163.com> - 20240312-1
changelog:
  - Update to 20240312 for fix CVE-2023-38575, CVE-2023-39368,
    CVE-2023-22655, CVE-2023-43490, CVE-2023-28746


author: Funda Wang <fundawang@yeah.net> - 20240813-1
changelog:
  - update to 20240813 for fix CVE-2024-24853, CVE-2024-25939,
    CVE-2024-24980, CVE-2023-42667, CVE-2023-49141


author: Funda Wang <fundawang@yeah.net> - 20250211-1
changelog:
  - update to 2025021 for fix CVE-2024-28047, CVE-2024-31157, CVE-2024-39279,
    CVE-2024-28127, CVE-2024-29214, CVE-2024-24582, CVE-2023-34440, CVE-2024-37020,
    CVE-2024-39355, CVE-2023-43758, CVE-2024-36293, CVE-2024-31068


author: Funda Wang <fundawang@yeah.net> - 20250512-1
changelog:
  - update to 20250512 to fix CVE-2024-28956, CVE-2025-24495, CVE-2025-20012,
    CVE-2024-45332, CVE-2025-20623, CVE-2024-43420, CVE-2025-20054, CVE-2025-20103


author: Funda Wang <fundawang@yeah.net> - 20250812-1
changelog:
  - update to 20250812 to fix CVE-2025-20053, CVE-2025-20109, CVE-2025-21090,
    CVE-2025-22839, CVE-2025-22840, CVE-2025-22889, CVE-2025-24305, CVE-2025-26403,
    CVE-2025-32086


author: zhangxingrong <zhangxingrong@uniontech.com> - 5:2.2.12-3
changelog:
  - Fix smtp client to respect $use_envelope_from option.
  - Fix smtp client $envelope_from_address possible dangling pointer.


author: Funda Wang <fundawang@yeah.net> - 5:2.2.12-4
changelog:
  - fix CVE-2026-43859, CVE-2026-43860, CVE-2026-43861, CVE-2026-43862,
    CVE-2026-43863, CVE-2026-43864


author: wangkai <wangkai385@huawei.com> - 3.2.8-4
changelog:
  - This package depends on log4j.After the log4j vulnerability CVE-2021-44832 is fixed,the version needs to be rebuild.


author: <yaoxin30@huawei.com> - 8.0.27-1
changelog:
  - Upgrade mysql to 8.0.27,fix CVES:CVE-2021-2471 CVE-2021-2478 CVE-2021-2479
    CVE-2021-2481  CVE-2021-35546 CVE-2021-35575 CVE-2021-35577 CVE-2021-35591
    CVE-2021-35596 CVE-2021-35597 CVE-2021-35602 CVE-2021-35604 CVE-2021-35607
    CVE-2021-35608 CVE-2021-35610 CVE-2021-35612 CVE-2021-35618
    CVE-2021-35621-to-CVE-2021-35628 CVE-2021-35630-to-CVE-2021-35648


author: wangkai <13474090681@163.com> - 8.0.38-1
changelog:
  - Update to 8.0.38 for fix CVEs(CVE-2024-21125,CVE-2024-21142,CVE-2024-21179,
    CVE-2024-21171,CVE-2024-21130,CVE-2024-21162,CVE-2024-21177,CVE-2024-20996,
    CVE-2024-21134,CVE-2024-21165,CVE-2024-21173,CVE-2024-21129,CVE-2024-21127,
    CVE-2024-21163,CVE-2022-21423,CVE-2022-21451,CVE-2022-21444,CVE-2022-21417,
    CVE-2022-21427,CVE-2022-21414,CVE-2022-21435,CVE-2022-21413,CVE-2022-21462,
    CVE-2022-21412,CVE-2022-21437,CVE-2022-21438,CVE-2022-21418,CVE-2022-21459,
    CVE-2022-21478,CVE-2022-21479,CVE-2022-21440,CVE-2022-21425,CVE-2022-21457,
    CVE-2022-21454,CVE-2022-21483,CVE-2022-21482,CVE-2022-21484,CVE-2022-21485,
    CVE-2022-21486,CVE-2022-21489,CVE-2022-21490,CVE-2021-22570,CVE-2022-21556,
    CVE-2022-21455,CVE-2022-21517,CVE-2022-21530,CVE-2022-21527,CVE-2022-21547,
    CVE-2022-21515,CVE-2022-21534,CVE-2022-21529,CVE-2022-21509,CVE-2022-21539,
    CVE-2022-21538,CVE-2022-21537,CVE-2022-21531,CVE-2022-21525,CVE-2022-21528,
    CVE-2022-21526,CVE-2022-21569,CVE-2022-39408,CVE-2022-39410,CVE-2022-21604,
    CVE-2022-21637,CVE-2022-21617,CVE-2022-21594,CVE-2022-21608,CVE-2022-21640,
    CVE-2022-39400,CVE-2022-21633,CVE-2022-21632,CVE-2022-21599,CVE-2022-21625,
    CVE-2022-21611,CVE-2022-21635,CVE-2022-21638,CVE-2022-21641,CVE-2022-21592,
    CVE-2023-21878,CVE-2023-21877,CVE-2023-21876,CVE-2023-21875,CVE-2023-21879,
    CVE-2023-21880,CVE-2023-21887,CVE-2023-21883,CVE-2023-21881,CVE-2023-21882,
    CVE-2023-21869,CVE-2023-21863,CVE-2023-21868,CVE-2023-21874,CVE-2023-21866,
    CVE-2023-21870,CVE-2023-21864,CVE-2023-21873,CVE-2023-21867,CVE-2023-21872,
    CVE-2023-21865,CVE-2023-21871,CVE-2023-21836,CVE-2022-32221,CVE-2023-21920,
    CVE-2023-21953,CVE-2023-21976,CVE-2023-21911,CVE-2023-21940,CVE-2023-21977,
    CVE-2023-21917,CVE-2023-21962,CVE-2023-21972,CVE-2023-21919,CVE-2023-21947,
    CVE-2023-21980,CVE-2023-21913,CVE-2023-21966,CVE-2023-21929,CVE-2023-21955,
    CVE-2023-21982,CVE-2023-21935,CVE-2023-21933,CVE-2023-21945,CVE-2023-21912,
    CVE-2023-21963,CVE-2023-21946,CVE-2022-43551,CVE-2023-0215,CVE-2023-22007,
    CVE-2023-22056,CVE-2023-22048,CVE-2023-22033,CVE-2023-22054,CVE-2023-22005,
    CVE-2023-22057,CVE-2023-22008,CVE-2023-22053,CVE-2023-22038,CVE-2023-22046,
    CVE-2023-22058,CVE-2023-22103,CVE-2023-22111,CVE-2023-22092,CVE-2023-22112,
    CVE-2023-22065,CVE-2023-22110,CVE-2023-22097,CVE-2023-22114,CVE-2023-22104,
    CVE-2023-22028,CVE-2023-22115,CVE-2023-22070,CVE-2023-22059,CVE-2023-22032,
    CVE-2023-22015,CVE-2023-22026,CVE-2023-22113,CVE-2023-22066,CVE-2023-22078,
    CVE-2023-22064,CVE-2023-22084,CVE-2023-22079,CVE-2023-38545,CVE-2023-22068,
    CVE-2024-20964,CVE-2024-20971,CVE-2024-20976,CVE-2024-20973,CVE-2024-20978,
    CVE-2024-20981,CVE-2024-20962,CVE-2024-20977,CVE-2024-20963,CVE-2024-20965,
    CVE-2024-20972,CVE-2024-20961,CVE-2024-20982,CVE-2024-20970,CVE-2024-20983,
    CVE-2024-20967,CVE-2024-20984,CVE-2024-20974,CVE-2024-20966,CVE-2024-20960,
    CVE-2024-20968,CVE-2024-20985,CVE-2024-20969,CVE-2022-21605,CVE-2022-21607,
    CVE-2024-21049,CVE-2024-21050,CVE-2024-21000,CVE-2024-21069,CVE-2024-21009,
    CVE-2024-21061,CVE-2024-20993,CVE-2024-21087,CVE-2024-21047,CVE-2024-20998,
    CVE-2024-21052,CVE-2024-21056,CVE-2024-21053,CVE-2024-21055,CVE-2024-21015,
    CVE-2024-21013,CVE-2024-21051,CVE-2024-21060,CVE-2024-21008,CVE-2024-21102,
    CVE-2024-21054,CVE-2024-21062,CVE-2024-20994,CVE-2024-21057,CVE-2024-21096,
    CVE-2023-6129,CVE-2024-21160,CVE-2024-21135,CVE-2024-21157,CVE-2024-21166,
    CVE-2024-21137,CVE-2024-21159)


author: wangkai <13474090681@163.com> - 8.0.40-1
changelog:
  - Update to 8.0.40 for fix CVEs(CVE-2024-21218,CVE-2024-21196,CVE-2024-21207,
    CVE-2024-21198,CVE-2024-21203,CVE-2024-21213,CVE-2024-21239,CVE-2024-21199,
    CVE-2024-21197,CVE-2024-21247,CVE-2024-21193,CVE-2024-21212,CVE-2024-21241,
    CVE-2024-21230,CVE-2024-21236,CVE-2024-21194,CVE-2024-21238,CVE-2024-21237,
    CVE-2024-21201,CVE-2024-21231,CVE-2024-21219,CVE-2024-21185)


author: yaoxin <1024769339@qq.com> - 8.0.41-1
changelog:
  - Update to 8.0.41 for fix CVEs(CVE-2025-21490,CVE-2025-21491,CVE-2025-21495,
    CVE-2025-21497,CVE-2025-21500,CVE-2025-21501,CVE-2025-21503,CVE-2025-21505,
    CVE-2025-21518,CVE-2025-21519,CVE-2025-21520,CVE-2025-21522,CVE-2025-21523,
    CVE-2025-21529,CVE-2025-21531,CVE-2025-21540,CVE-2025-21543,CVE-2025-21546,
    CVE-2025-21555,CVE-2025-21559)


author: yaoxin <1024769339@qq.com> - 8.0.42-1
changelog:
  - Update to 8.0.42 for fix CVEs(CVE-2025-21574,CVE-2025-21575,CVE-2025-21577,
    CVE-2025-21580,CVE-2025-21581,CVE-2025-21584,CVE-2025-21585,CVE-2025-30681,
    CVE-2025-30682,CVE-2025-30683,CVE-2025-30684,CVE-2025-30685,CVE-2025-30687,
    CVE-2025-30688,CVE-2025-30689,CVE-2025-30693,CVE-2025-30695,CVE-2025-30696,
    CVE-2025-30699,CVE-2025-30703,CVE-2025-30704,CVE-2025-30705,CVE-2025-30710,
    CVE-2025-30715,CVE-2025-30721,CVE-2025-30722


author: yaoxin <1024769339@qq.com> - 8.0.43-1
changelog:
  - Update to 8.4.6 for fix CVEs (CVE-2025-50068,CVE-2025-50077,CVE-2025-50078,
    CVE-2025-50079,CVE-2025-50080,CVE-2025-50081,CVE-2025-50082,CVE-2025-50083,
    CVE-2025-50084,CVE-2025-50085,CVE-2025-50086,CVE-2025-50087,CVE-2025-50091,
    CVE-2025-50092,CVE-2025-50093,CVE-2025-50094,CVE-2025-50096,CVE-2025-50097,
    CVE-2025-50098,CVE-2025-50099,CVE-2025-50100,CVE-2025-50101,CVE-2025-50102,
    CVE-2025-50104,CVE-2025-53023)


author: wangkai <13474090681@163.com> - 8.0.44-1
changelog:
  - Update to 8.0.44 for fix CVEs (CVE-2025-53069,CVE-2025-53062,CVE-2025-53054,
    CVE-2025-53053,CVE-2025-53045,CVE-2025-53044,CVE-2025-53042,CVE-2025-53040)


author: yaoxin <1024769339@qq.com> - 8.0.45-1
changelog:
  - Update to 8.0.45 for fix CVEs (CVE-2026-21936,CVE-2026-21937,
    CVE-2026-21941,CVE-2026-21948,CVE-2026-21964,CVE-2026-21968)


author: wangkai <13474090681@163.com> - 8.0.46-1
changelog:
  - Update to 8.0.46 for fix CVEs (CVE-2026-21998, CVE-2026-22001, CVE-2026-22002,
    CVE-2026-22004, CVE-2026-22005, CVE-2026-22009, CVE-2026-22015, CVE-2026-22017,
    CVE-2026-34267, CVE-2026-34270, CVE-2026-34271, CVE-2026-34276, CVE-2026-34278,
    CVE-2026-34293, CVE-2026-34303, CVE-2026-34304, CVE-2026-34308, CVE-2026-35236,
    CVE-2026-35237, CVE-2026-35238, CVE-2026-35239, CVE-2026-35240)


author: yaoxin <yao_xin001@hoperun.com> - 8.0-1
changelog:
  - Update to 8.0
    * CVE-2024-5742: Avoid privilege escalations via symlink attacks
      on emergency save file (boo#1226099)
    * By default ^F is bound to starting a forward search, and ^B to
      starting a backward search, while M-F and M-B repeat the search
      in the corresponding direction. (See the documentation if you
      want the old bindings back.)
    * Command-line option --modernbindings (-/) makes ^Q quit, ^X cut,
      ^C copy, ^V paste, ^Z undo, ^Y redo, ^O open a file, ^W write a file,
      ^R replace, ^G find again, ^D find again backwards, ^A set the mark,
      ^T jump to a line, ^P show the position, and ^E execute.
    * For easier access, M-" is bound to placing/removing an anchor,
      and M-' to jumping to the next anchor.


author: yaoxin <yao_xin001@hoperun.com> - 2.15.05-1
changelog:
  - Update to 2.15.05
    * fix %ifid with $ and $$
    * Add --reproducible option to suppress NASM version numbers and timestamps in output files


author: xingwei <xingwei14@h-partners.com> - 1:5.9-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Sync upstream patches to fix Buffer overflow
         Disable T200snmpv2cwalkall_simple test to fix make check fail


author: wangkai <wangkai385@huawei.com> - 4.1.13-13
changelog:
  - This package depends on log4j.After the log4j vulnerability CVE-2021-44228 is fixed,the version needs to be rebuild.


author: wangkai <wangkai385@huawei.com> - 4.1.13-15
changelog:
  - This package depends on log4j.After the log4j vulnerability CVE-2021-45105 is fixed,the version needs to be rebuild.


author: wangkai <13474090681@163.com> - 1:12.22.11-4
changelog:
  - Fix CVE-2022-32212,CVE-2022-32213,CVE-2022-32214,CVE-2022-32215,
  - CVE-2022-25881,CVE-2023-23918,CVE-2023-23920,CVE-2023-30589,
  - CVE-2023-30590,CVE-2023-30581,CVE-2023-32002,CVE-2023-32006,
  - CVE-2023-32559,CVE-2022-35256


author: cuixucui <cuixucui1@h-partners.com> - 1.1.2-4
changelog:
  - Add requirements for system and bugfix
  - Upgrade oec-hardware-server
  - Update readme and design doc
  - Fix nvme error
  - Update network fibre check and log 
  - Update description for perf test
  - Add automatic configuration network card IP


author: cuixucui <cuixucui1@h-partners.com> - 1.1.2-5
changelog:
  - fix the bug that the test board information is not added to the configuration file
  - Add kabi for hardware critical test
  - Optimize disk/raid/fc/ethernet/infiniband test suite
  - Fix the bug of reading nvme data failed
  - Add file size check when uploading file to server


author: zhangyale <zhangyale3@h-partners.com> - 1.1.3-0
changelog:
  - Add support for openEuler 22.03 LTS SP1
  - Add AMD GPU testcase
  - Add automatic configuration network card IP
  - Add generate compatibility information


author: cuixucui <cuixucui1@h-partner.com> - 1.1.3-2
changelog:
  - Fix code issue and update log print in network
  - Cancel deleting the IP that automatically configured on the server
  - Fix cdrom bug


author: liqiang <liqiang332@h-partner.com> - 1.1.3-3
changelog:
  - Fix libswsds.so not stripped
  - Fix the value of kernel.src obtained by the kabi test case is incorrect
  - Add board infomation and fix memory bug
  - Fix the block size fails to be obtained during the NVME test
  - Judge whether to support kabi testing by architecture
  - Update readme and dev_design


author: cuixucui <cuixucui1@h-partner.com> - 1.1.4-0
changelog:
  - Add board information in the test report
  - Add spdk test case
  - Add dpdk test case
  - Update pci.ids file


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-0
changelog:
  - Add support for openEuler 20.03 LTS SP4, openEuler 22.03 LTS SP2, openEuler 22.03 LTS SP3
  - Add modifications to Kylinsec with oec-hardware
  - Add support for Loongson and SW architectures
  - Bugfix


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Add virtual cases
  - Resolve IB startup IB_Read_BW service failure issue
  - Delete redundant references
  - Resolve incorrect type in vgpu result data
  - Resolve the issue of getting the kernel source rpm


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Resolve kdump\watchdog\cpufreq\kabiwhitelist\network test failure issue 
  - Add fio test cases:read,write,randread,randwrite
  - Solve the nvme line break issue in the command line interface
  - Fix compilation errors in the make command
  - Add Vulkan testcase for nvida GPU
  - Resolve the issue of oech server startup failure on version 24.03


author: xiaochn <xiaochuannan@inspur.com> - 1.1.5-3
changelog:
  - Resolve the issue of different kernel source download locations in kabi test case
  - Resolve the issue that kabiwhitelist still passes when the ko and rpm file does not exist
  - Add the way for manually adding kabiwhitelist file
  - For custom vendors, refer to the method of obtaining openEuler os information
  - Supports custom vendor


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-0
changelog:
  - Add new test suite srpm and intel
  - Add virtual branch of test suite
  - Add support for Kylin and UOS
  - Bugfix


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-3
changelog:
  - Update the pci.ids file
  - Remove unused variable in cdrom test suite
  - Update test_guide doc
  - Unify the location for downloading kernel source RPMs
  - Optimize kabiwhitelist and system test


author: xiaochn <xiaochuannan@inspur.com> - 1.1.7-1
changelog:
  - Add KylinSec 3.5.3 support
  - Fix the problem of disk size calculation
  - Fix bcm57414 nic test failed issue
  - Change the format of date
  - Fixed a bug where a non-existent logger level was used
  - Update README.md
  - Fix vgpu testing issue


author: Funda Wang <fundawang@yeah.net> - 0.20.0-15
changelog:
  - fix CVE-2024-8443, CVE-2024-45615, CVE-2024-45616,
    CVE-2024-45617, CVE-2024-45618, CVE-2024-45619, CVE-2024-45620


author: zhangbinqin<zhangbinqin@h-partners.com> - 8.2p1-32
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix the missing member of the struct Authmethod method_gsskeyex


author: zhangbinqin<zhangbinqin@h-partners.com> - 8.2p1-35
changelog:
  - Type:CVE
  - CVE:CVE-2026-35414 CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388
  - SUG:NA
  - DESC:fix CVE-2026-35414 CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388


author: fly_fzc <2385803914@qq.com> - 1:1.1.1f-41
changelog:
  - fix CVE-2025-68160 CVE-2026-22796 CVE-2026-22795 CVE-2025-69418 CVE-2025-69421 CVE-2025-69419 CVE-2025-69420


author: Funda Wang <fundawang@yeah.net> - 8.0.30-7
changelog:
  - Fix Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface
    GHSA-4w77-75f9-2c8w
  - Fix OOB access in ldap_escape
    CVE-2024-8932
  - Fix Integer overflow in the dblib/firebird quoter causing OOB writes
    CVE-2024-11236
  - Fix Configuring a proxy in a stream context might allow for CRLF injection in URIs
    CVE-2024-11234
  - Fix Single byte overread with convert.quoted-printable-decode filter
    CVE-2024-11233


author: Funda Wang <fundawang@yeah.net> - 8.0.30-11
changelog:
  - Fix Null byte termination in dns_get_record()
    GHSA-www2-q4fc-65wf
  - Fix Heap buffer overflow in array_merge()
    CVE-2025-14178
  - Fix Information Leak of Memory in getimagesize
    CVE-2025-14177


author: Funda Wang <fundawang@yeah.net> - 8.0.30-12
changelog:
  - Fix Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
    CVE-2026-7259
  - Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map
    CVE-2026-6722
  - Fix Broken Apache map value NULL check
    CVE-2026-7262
  - Fix Signed integer overflow of char array offset
    CVE-2026-7568


author: Funda Wang <fundawang@yeah.net> - 8.0.30-13
changelog:
  - Fix XSS within status endpoint
    CVE-2026-6735
  - Fix SQL injection via NUL bytes in quoted strings
    CVE-2025-14179
  - Fix Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION
    CVE-2026-7261
  - Fix Consistently pass unsigned char to ctype.h functions
    CVE-2026-7258


author: duyiwei <duyiwei@kylinos.cn> - 1:0.10.1-10
changelog:
  - Type:bugfix
  - CVE:CVE-2024-9355、CVE-2019-9514、CVE-2024-24791、CVE-2022-32189、CVE-2022-41715、CVE-2022-2880、CVE-2022-1962、CVE-2023-45290、CVE-2024-24783、CVE-2024-24785
  - SUG:NA
  - DESC:  fix CVE in batches through rebuild


author: zhouwenpei <zhouwenpei1@h-partners.com> - 0.90.0-4
changelog:
  - fix CVE-2022-37050,CVE-2022-37051,CVE-2022-37052,CVE-2022-38349,CVE-2020-23804
  - fix install error


author: xiongyi <xiongyi@uniontech.com> - 0.90.0-6
changelog:
  - fix CVE-2020-36023
  - fix infinite looping in cvtGlyph with broken files
  - patch source:https://gitlab.freedesktop.org/poppler/poppler/-/issues/1013


author: gaihuiying <eaglegai@163.com> - 2.4.8-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream
         Fixing up parsing in radiusclient.conf


author: zhengxiaoxiao <zhengxiaoxiao2@huawei.com> - 3.14.0-9
changelog:
  - Type:CVE
  - ID:CVE-2026-0994
  - SUG:NA
  - DESC:Fix Any recursion depth bypass in Python json_format.ParseDict


author: wangkai <13474090681@163.com> - 9.0.1-5
changelog:
  - correct memory allocation in alloc_array (this is the rear patch of CVE-2022-22815,CVE-2022-22816)


author: xujing<xujing125@huawei.com> - 4.15.1-55
changelog:
  - sync patches from upstream
    add backport-Fix-a-theoretical-use-of-uninitialized-struct-member.patch
        backport-Fix-spec-parser-leaks-from-trans-f-file.patch
        backport-Tip-toe-around-rpmfiFN-thin-ice-in-fsm.patch
        backport-Use-unsigned-integers-for-buildtime-too-for-Y2K38-sa.patch


author: yaoxin <1024769339@qq.com> - 1.4.4-1
changelog:
  - Update to 1.4.4 for fix CVE-2019-16785,CVE-2019-16786,CVE-2019-16789 and CVE-2019-16792
  - Add patches for CVE-2024-49769: DoS due to resource exhaustion


author: GuoCe <guoce@kylinos.cn> - 3.7.9-37
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Modify the spec file to synchronize the version information of
         CHANGLOG and VERSION.


author: GuoCe <guoce@kylinos.cn> - 3.7.9-39
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: add loongarch64 support and disable valgrind-devel for loongarch64


author: wangshuo <wangshuo@kylinos.cn> - 3.7.9-40
changelog:
  - Type:CVE
  - CVE:CVE-2007-4559
  - SUG:NA
  - DESC:Patch9007-9008, fix CVE-2007-4559
  -      Patch9009, fix test_xml_etree error with expat versions that fix CVE-2023-52425


author: wangshuo <wangshuo@kylinos.cn> - 3.7.9-41
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport upstream patches
  -      gh-104049: do not expose on-disk location from SimpleHTTPRequestHandler
  -      gh-99889: Fix directory traversal security flaw in uu.decode()


author: wangshuo <wangshuo@kylinos.cn> - 3.7.9-43
changelog:
  - Type:CVE
  - CVE:CVE-2024-9287
  - SUG:NA
  - DESC:fix CVE-2024-9287
  -      gh-124651: Quote template strings in `venv` activation scripts


author: yanglu<yanglu72@h-partners.com> - 1.11.0-6
changelog:
  - Type:cves
  - CVE:CVE-2022-30698 CVE-2022-30699
  - SUG:NA
  - DESC:fix CVE-2022-30698 and CVE-2022-30699


author: gaihuiying <eaglegai@163.com> - 1.11.0-21
changelog:
  - Type:CVE
  - CVE:CVE-2025-11411
  - SUG:NA
  - DESC:Additional fix for CVE-2025-11411 to include YXDOMAIN and non-referral nodata answers in the mitigation


author: gaihuiying <eaglegai@163.com> - 1.11.0-22
changelog:
  - Type:cves
  - CVE:CVE-2026-33278,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960
  - SUG:NA
  - DESC:fix CVE-2026-33278,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960


author: gaihuiying <eaglegai@163.com> - 1.11.0-23
changelog:
  - Type:cves
  - CVE:CVE-2026-32792,CVE-2026-42923,CVE-2026-40622,CVE-2026-42534,CVE-2026-44390
  - SUG:NA
  - DESC:fix CVE-2026-32792,CVE-2026-42923,CVE-2026-40622,CVE-2026-42534,CVE-2026-44390


author: lixiaoyong <lixiaoyong@kylinos.cn> - 0.14.1-1
changelog:
  - Upgrade package to version 0.14.1
    - Drop support for Python older than 3.6
    - Additional ruff/Pyflakes/codespell fixes


author: yezengruan <yezengruan@huawei.com>
changelog:
  - hw/scsi/lsi53c895a: Do not abort when DMA requested and no data queued
  - scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216)
  - scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216)


author: Jiabo Feng <fengjiabo1@huawei.com>
changelog:
  - qga/win32: Use rundll for VSS installation
  - qga/win32: Remove change action from MSI installer
  - 9pfs: prevent opening special files (CVE-2023-2861)


author: Jiabo Feng <fengjiabo1@huawei.com>
changelog:
  - accel/tcg: fix race in cpu_exec_step_atomic (bug 1863025)
  - pci: assert configuration access is within bounds
  - io: remove io watch if TLS channel is closed during handshake


author: Jiabo Feng <fengjiabo1@huawei.com>
changelog:
  - hw/scsi/lsi53c895a: add missing decrement of reentrancy counter
  - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330)
  - net: Update MemReentrancyGuard for NIC (CVE-2023-3019)
  - net: Provide MemReentrancyGuard * to qemu_new_nic()
  - memory: prevent dma-reentracy issues
  - softmmu/physmem: Introduce MemTxAttrs::memory field and MEMTX_ACCESS_ERROR
  - Fixed the early version of CVE-2022-4144 patch is not fully adapted


author: Jiabo Feng <fengjiabo1@huawei.com>
changelog:
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/virtio: Introduce virtio_bh_new_guarded() helper
  - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded
  - checkpatch: add qemu_bh_new/aio_bh_new checks
  - async: avoid use-after-free on re-entrancy guard
  - async: Add an optional reentrancy guard to the BH API
  - util/async: add a human-readable name to BHs for debugging
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set
  - Include sysemu/sysemu.h a lot less


author: Jiabo Feng <fengjiabo1@huawei.com>
changelog:
  - tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fix CVE-2023-5088)
  - hw/ide: reset: cancel async DMA operation before resetting state (Fix CVE-2023-5088)


author: Jiabo Feng <fengjiabo1@huawei.com>
changelog:
  - block: Parse filenames only when explicitly requested (CVE-2024-4467)
  - block: introduce bdrv_open_file_child() helper
  - qcow2: Don't open data_file with BDRV_O_NO_IO (CVE-2024-4467)
  - qcow2: Do not reopen data_file in invalidate_cache


author: Jiabo Feng <fengjiabo1@huawei.com> - 10:4.1.0-86
changelog:
  - nbd/server: CVE-2024-7409: Close stray clients at server-stop
  - main-loop.h: introduce qemu_in_main_thread()
  - aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED
  - nbd/server: CVE-2024-7409: Drop non-negotiating clients
  - nbd/server: CVE-2024-7409: Cap default max-connections to 100
  - nbd: Add max-connections to nbd-server-start
  - nbd/server: Plumb in new args to nbd_client_add()
  - nbd: Minor style and typo fixes


author: Jiabo Feng <fengjiabo1@huawei.com> - 10:4.1.0-88
changelog:
  - mac_dbdma: Remove leftover `dma_memory_unmap` calls(CVE-2024-8612)
  - softmmu: Support concurrent bounce buffers(CVE-2024-8612)
  - qdev-properties: add size32 property type
  - system/physmem: Per-AddressSpace bounce buffering
  - system/physmem: Propagate AddressSpace to MapClient helpers


author: Pengrui Zhang <zhangpengrui@huawei.com> - 10:4.1.0-92
changelog:
  - io: release active GSource in TLS channel finalizer
  - io: move websock resource release to close method
  - io: fix use after free in websocket handshake code(CVE-2025-11234)
  - sphinx: change default language to 'en'
  - curl: Check curl_multi_add_handle()'s return code
  - block/curl.c: Check error return from curl_easy_setopt()
  - block: Handle curl 7.55.0, 7.85.0 version changes
  - block/vpc: Make vpc_open() read the full dynamic header
  - net/eth: Use correct in6_address offset in _eth_get_rss_ex_dst_addr()
  - net/eth: Simplify _eth_get_rss_ex_dst_addr()
  - net/eth: Better describe _eth_get_rss_ex_dst_addr's offset argument
  - net/eth: Check size earlier in _eth_get_rss_ex_dst_addr()
  - net/eth: Check iovec has enough data earlier
  - net/eth: Read ip6_ext_hdr_routing buffer before accessing it
  - net/eth: Add an assert() and invert if() statement to simplify code
  - pc-bios/optionrom: compile with -Wno-array-bounds
  - amd_iommu: fix uninitialized error
  - tests/unit/test-block-iothread: fix maybe-uninitialized error on GCC 11
  - scripts: improve message when TAP based tests fail
  - make check-unit: use after free in test-opts-visitor
  - crypto: use a stronger private key for tests


author: xingwei <xingwei14@h-partners.com> - 2.18-5
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Add the socket option IPV6_MULTICAST_LOOP to prevent the interface from autocon
  figuring using RA messages sent by itself.


author: wangkai <13474090681@163.com> - 7.2.7-1
changelog:
  - Update to 7.2.7
  - Fix CVE-2021-32626 CVE-2021-32627 CVE-2021-32762 CVE-2021-32675
    CVE-2021-41099 CVE-2021-32628 CVE-2021-32687 CVE-2022-24735
    CVE-2022-24736 CVE-2022-3647 CVE-2022-3734 CVE-2022-35977
    CVE-2023-25155 CVE-2024-46981


author: yixiangzhike <yixiangzhike007@163.com> - 2.15-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:avoid truncate trailer space and do not escape backslash when read filename


author: yixiangzhike <yixiangzhike007@163.com> - 2.15-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:revert "avoid truncate trailer space and do not escape backslash when read filename"


author: zouzhimin <zouzhimin@kylinos.cn> - 1:2.2.3.1-3
changelog:
  - Type:CVES
  - ID:CVE-2024-26141 CVE-2024-26146 CVE-2024-25126
  - SUG:NA
  - DESC:CVE-2024-26141 CVE-2024-26146 CVE-2024-25126


author: zouzhimin <zouzhimin@kylinos.cn> - 1:2.2.3.1-4
changelog:
  - Type:CVES
  - ID:CVE-2022-44570 CVE-2022-44571 CVE-2022-44572
  - SUG:NA
  - DESC:CVE-2022-44570 CVE-2022-44571 CVE-2022-44572


author: beta <beta@yfqm.date> - 3.14.2-82
changelog:
  - backport some upstream patches
    backport-Label-etc-redis-as-redis_conf_t.patch
    backport-Relabel-usr-sbin-charon-systemd-as-ipsec_exec_t.patch


author: wangkai <13474090681@163.com> - 14.4.2.0-29
changelog:
  - Fix CVE-2021-33844,CVE-2023-32627,CVE-2021-23159,CVE-2023-34432
  - CVE-2023-34318,CVE-2021-23172,CVE-2021-3643,CVE-2021-23210
  - CVE-2022-31650,CVE-2023-26590,CVE-2022-31651,CVE-2023-32627
  - CVE-2017-18189


author: xinghe <xinghe2@h-partners.com> - 7:4.9-25
changelog:
  - Type:cves
  - ID:CVE-2023-49288 CVE-2025-54574 CVE-2023-5824 CVE-2025-62168
  - SUG:NA
  - DESC:fix CVE-2023-49288 CVE-2025-54574 CVE-2023-5824 CVE-2025-62168


author: lingsheng <lingsheng1@h-partners.com> - 6.04-14
changelog:
  - update libpng 1.6.36 to fix CVE-2011-2501 CVE-2011-2690 CVE-2011-2691
  - CVE-2011-2692 CVE-2011-3045 CVE-2011-3048 CVE-2012-3425 CVE-2015-7981
  - CVE-2015-8126 CVE-2015-8472 CVE-2015-8540 CVE-2016-10087 CVE-2017-12652


author: huyubiao <huyubiao@huawei.com> - 243-64
changelog:
  - add backport-pstore-fix-use-after-free.patch
        backport-udev-also-logs-file-permission.patch
        backport-core-Fix-setting-StatusUnitFormat-from-config-files.patch
        backport-udevadm-missing-initialization-of-descriptor.patch
        backport-udevadm-use-usec_add.patch
        backport-shared-install-fix-error-codes-returned-by-install_c.patch
        backport-udevadm-trigger-do-not-propagate-EACCES-and-ENODEV.patch
        backport-pstore-rework-memory-handling-for-dmesg.patch
        backport-udev-fix-memleak-caused-by-wrong-cleanup-function.patch
        backport-network-ndisc-do-not-drop-all-prefixes-when-a-prefix.patch
        backport-nspawn-fix-handling-of-console-help.patch
        backport-core-job-fix-breakage-of-ordering-dependencies-by-sy.patch
        backport-sd-device-enumerator-do-not-return-error-when-a-devi.patch
        backport-udev-ignore-ENOENT-when-chmod_and_chown-device-node.patch
        backport-udev-fix-error-code-in-the-log-message.patch
        backport-udev-do-not-append-newline-when-write-attributes.patch
        backport-udevd-wait-for-workers-to-finish-when-exiting.patch
        backport-verify-fix-segmentation-fault.patch
        backport-core-path-serialize-the-previous_exists-state.patch
        backport-core-path-fix-spurious-triggering-of-PathExists-on-r.patch
        backport-udevadm-ignore-EROFS-and-return-earlier.patch
        backport-udevd-don-t-use-monitor-after-manager_exit.patch
        backport-hibernate-resume-generator-wait-infinitely-for-the-r.patch
        backport-sd-event-refuse-running-default-event-loops-in-any-o.patch
        backport-time-util-deal-with-systems-where-userspace-has-64bi.patch
        backport-time-util-also-use-32bit-hack-on-EOVERFLOW.patch
        backport-test-condition-fix-group-check-condition.patch
        backport-udev-do-not-use-exact-match-of-file-permission.patch
        backport-network-udev-use-uint64_t-for-bit-rate.patch
        backport-unit-add-AF_ALG-to-systemd-networkd.service.patch
        backport-Fix-generator-name-in-hibernate-resume-generator-s-d.patch
        backport-udevadm-show-more-error-message-during-exporting-dat.patch


author: huyubiao <huyubiao@huawei.com> - 243-66
changelog:
  - add backport-journalctl-allow-running-vacuum-on-remote-journals-t.patch
        backport-systemctl-skip-non-existent-units-in-the-cat-verb.patch
        backport-journalctl-implement-facility-foo.patch
        backport-journalctl-show-duplicate-entries-if-they-are-from-t.patch
        backport-fix-journal-regression.patch
        backport-fs-util-when-calling-chase_symlinks-with-root-path-l.patch
        backport-test-add-test-for-the-non-resolving-of-chase_symlink.patch
        backport-fs-util-make-sure-we-output-normalized-paths-in-chas.patch
        backport-test-make-sure-chase_symlink-returns-normalized-path.patch
        backport-test-fix-rename_noreplace-test.patch
        backport-logind-check-PolicyKit-before-allowing-VT-switch.patch
        backport-errno-ETIMEDOUT-is-also-a-connection-error.patch
        backport-sd-bus-break-the-loop-in-bus_ensure_running-if-the-b.patch


author: huyubiao <huyubiao@huawei.com> - 243-67
changelog:
  - add backport-core-make-sure-we-don-t-get-confused-when-setting-TE.patch
        backport-mount-setup-change-the-system-mount-propagation-to-s.patch
        backport-core-transition-to-FINAL_SIGTERM-state-after-ExecSto.patch


author: huyubiao <huyubiao@huawei.com> - 243-70
changelog:
  - backport: sync patches from systemd community
    add backport-sd-device-do-no-allocate-strings-of-unknown-length-o.patch
        backport-sd-device-minor-optimization-for-sd_device_new_from_.patch
        backport-sd-device-use-memdupa_suffix0-where-appropriate.patch
        backport-sd-device-reject-empty-driver-name.patch
        backport-tmpfiles-use-a-entry-in-hashmap-as-ItemArray-in-read.patch
        backport-dissect-ext4-and-loopback-files-are-unimpressed-by-r.patch
        backport-mount-until-make-sure-we-ll-exit-bind_remount_recurs.patch
        backport-sd-device-use-strjoina-more-again-in-sd_device_new_f.patch
        backport-core-when-looping-over-mount-swap-names-continue-if-.patch
        backport-libblkid-open-device-in-nonblock-mode.patch
        backport-udev-ignore-the-case-that-the-device-is-already-remo.patch
        backport-udev-fix-key-name-in-debug-log.patch
        backport-sd-event-use-usec_add.patch
        backport-timesync-fix-wrong-type-for-receiving-timestamp-in-n.patch
        backport-udev-fix-potential-memleak.patch
        backport-journalctl-never-fail-at-flushing-when-the-flushed-f.patch
        backport-core-fix-SIGABRT-on-empty-exec-command-argv.patch
        backport-core-service-also-check-path-in-exec-commands.patch


author: hongjinghao <hongjinghao@huawei.com> - 243-71
changelog:
  - add: backport-json-use-unsigned-for-refernce-counter.patch
        backport-macro-check-over-flow-in-reference-counter.patch
        backport-sd-bus-fix-reference-counter-to-be-incremented.patch
        backport-sd-bus-introduce-ref-unref-function-for-track_item.patch
        backport-sd-bus-do-not-read-unused-value.patch
        backport-sd-bus-do-not-return-negative-errno-when-unknown-nam.patch
        backport-sd-bus-use-hashmap_contains-and-drop-unnecessary-cas.patch
        backport-test-shorten-code-a-bit.patch
        backport-test-add-several-tests-for-track-item.patch
        backport-sd-bus-switch-to-a-manual-overflow-check-in.patch


author: huyubiao <huyubiao@huawei.com> - 243-75
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add backport-basic-fix-overflow-detection-in-sigbus_pop.patch
         backport-bus-use-bus_log_parse_error-to-print-message.patch
         backport-busctl-avoid-asserting-on-NULL-message.patch
         backport-sd-journal-check-sd-event-state-before-setting-up-po.patch


author: huyubiao <huyubiao@huawei.com> - 243-76
changelog:
  - DESC:add backport-utmp-remove-dev-from-line.patch
         backport-core-exec-do-not-crash-with-UtmpMode-user-without-Us.patch
         backport-resolved-limit-the-number-of-signature-validations-i.patch
         backport-resolved-reduce-the-maximum-nsec3-iterations-to-100.patch


author: huyubiao <huyubiao@huawei.com> - 243-79
changelog:
  - add backport-login-user-runtime-dir-properly-check-for-mount-poin.patch
        backport-user-util-validate-the-right-field.patch


author: zhangyao <zhangyao108@huawei.com> - 243-81
changelog:
  - remove redundant patch
    del 1610-add-new-rules-for-lower-priority-events-to-preempt.patch
        core-bugfix-call-malloc_trim-to-return-memory-to-OS-immediately.patch
        1612-serialize-pids-for-scope-when-not-started.patch
        systemd-core-Close-and-free-dbus-when-bus-authentica.patch
        1615-do-not-finish-job-during-daemon-reload-in-unit_notify.patch


author: zhangyao <zhangyao108@huawei.com> - 243-82
changelog:
  - sync community patches
    add backport-pid1-set-SYSTEMD_NSS_DYNAMIC_BYPASS-1-env-var-for-db.patch
        backport-pid1-lookup-owning-PID-of-BusName-name-of-services-a.patch
        backport-pid1-watch-bus-name-always-when-we-have-it.patch


author: Han Jinpeng <hanjinpeng@kylinos.cn> - 243-83
changelog:
  - Enhance the logging function of the systemctl command
    Add process-util-log-more-information-when-runnin.patch


author: xujing <xujing125@huawei.com> - 243-86
changelog:
  - print the real reason for link update
  - run link_update() with increased retry count in second invocation


author: chenyaqiang <chengyaqiang@huawei.com> - 1:9.0.96-1
changelog:
  - Update to 9.0.96
  - Fix CVE-2021-43980 CVE-2022-25762 CVE-2023-44487 CVE-2023-46589
    CVE-2024-23672 CVE-2024-24549 CVE-2024-34750


author: wangkai <13474090681@163.com> - 1:9.0.100-1
changelog:
  - Update to 9.0.100 for fix CVE-2024-56337
  - Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337,
    the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not.


author: yaoxin <1024769339@qq.com> - 1:9.0.117-1
changelog:
  - Update to 9.0.117 for fix CVEs: CVE-2026-24880, CVE-2026-25854,
    CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990,
    CVE-2026-34483, CVE-2026-34486, CVE-2026-34487, CVE-2026-34500


author: yaoxin <1024769339@qq.com> - 1:9.0.118-1
changelog:
  - Update to 9.0.118 for fix CVEs: CVE-2026-41284, CVE-2026-41293,
    CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514,
    CVE-2026-43515
  - Fix tomcat-jsvc stop failed


author: Liu Chao <liuchao173@huawei.com> - 2.24.1-1
changelog:
  - Upgrade to 2.24.1:
    - fixed privileged execution of arbitrary scripts by active local user. (CVE-2024-52336)
    - added sanity checks for API methods parameters. (CVE-2024-52337)


author: qinyu<qinyu32@huawei.com> - 2022a-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Greenland change should affect only America/Nuuk; The northern edge of Chihuahua changes to US rules


author: langfei<langfei@huawei.com> - 2022a-16
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Fix Palestine predictions for 2072 through 2075; Ittoqqortoormiit (America/Scoresbysund) zone change.


author: liuchao <liuchao173@huawei.com> - 2022a-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Vostok switches to +05; Sync Casey data from timeanddata.com; Kazakhstan unifies on UTC+5


author: langfei <langfei@huawei.com> - 2022a-20
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Aysén Region moves from -04/-03 to -03; new zone;
  -	Improve recent commentary for Chilean decrees.


author: herengui <herengui@kylinsec.com.cn> - 7.4.3-5
changelog:
  - Fix CVE-2026-34475: Fix http/1.1 absolute form dissection edge case leading to cache poisoning or authentication bypass


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-15
changelog:
  - Type:CVE
  - ID:CVE-2023-4736 CVE-2023-4733 CVE-2023-4734 CVE-2023-4735
  - SUG:NA
  - DESC:fix CVE-2023-4736 CVE-2023-4733 CVE-2023-4734 CVE-2023-4735


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-16
changelog:
  - Type:CVE
  - ID:CVE-2023-4738 CVE-2023-4750 CVE-2023-4752 CVE-2023-4781
  - SUG:NA
  - DESC:fix CVE-2023-4738 CVE-2023-4750 CVE-2023-4752 CVE-2023-4781


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-21
changelog:
  - Type:CVE
  - ID:CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237
  - SUG:NA
  - DESC:fix CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237


author: wangxiaomeng <wangxiaomeng@kylinos.cn> - 1:3.6.14-12
changelog:
  - Delete /usr/share/man/man1/wireshark.* in wireshark package because wireshark-help package also contains this files


author: zhouwenpei <zhouwenpei1@h-partners.com> - 1.20.8-15
changelog:
  - Fix openEuler hard code problem
  - use -git instead of .git as the filename, to avoid .git ignore
  - Fix changelog date


author: yanglu <yanglu72@h-partners.com> -1.20.8-28
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix regression caused by the fix for CVE-2024-0229
         fix use after free related to CVE-2024-21886


author: shuaijiakun <shuaijiakun1288@phytium.com.cn> -1.20.8-29
changelog:
  - Type:feature
  - CVE:NA
  - SUG:NA
  - DESC:fix display error for ps23xx when using ast and pe2201 bmc card.


author: Funda Wang <fundawang@yeah.net> - 1.20.8-32
changelog:
  - fix CVE-2025-26594, CVE-2025-26595, CVE-2025-26596,
    CVE-2025-26597, CVE-2025-26598, CVE-2025-26599
    CVE-2025-26600, CVE-2025-26601


author: lingsheng <ultra_planet@qq.com> - 1.20.8-35
changelog:
  - fix CVE-2022-49737 CVE-2025-49175 CVE-2025-49176 CVE-2025-49178 CVE-2025-49179 CVE-2025-49180 CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


author: lingsheng <ultra_planet@qq.com> - 1.20.8-38
changelog:
  - fix CVE-2026-50256 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264


author: kouwenqi <kouwenqi@kylinos.cn> - 5.2.5-4
changelog:
  - Type:enhancement
  - CVE:NA
  - SUG:NA
  - DESC:Add overflow check for Unpadded size in lzma_index_append


author: yaoxin <1024769339@qq.com> - 0.2.35-10
changelog:
  - Fix CVE-2025-2175
  - Rename CVE-2025-2174_CVE-2025-2176_CVE-2025-2177.patch to
    CVE-2025-2174_CVE-2025-2175_CVE-2025-2176_CVE-2025-2177.patch


