# changelog

author: xinghe <xinghe2@h-partners.com> - 2.6.6-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:connection: Clear flags when a conn is removed
         connection: Preserve flags when a conn is removed
         stream: do not try to free a failed stream-conn
         http_ana/txn: don't re-initialize txn and req var
         mworker: prevent incorrect values in uptime
         protocol: fix minor memory leak in protocol_bind_all()
         stream: Perform errors handling in right order in stream_new()


author: xinghe <xinghe2@h-partners.com> - 2.6.6-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:backport to fix potential coredump:
         errors: handle malloc failure in usermsgs_put
         ssl_sock: add check for ha_meth
         thread: add a check for pthread_creat


author: xinghe <xinghe2@h-partners.com> - 2.6.6-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:server: add missing free for server->rdr_pfx
         server: do not leak default-server in defaults


author: xinghe <xinghe2@h-partners.com> - 2.6.6-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:server: 'source' interface ignored from 'default-server' directive


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-207.0.0.107
changelog:
  - !8599  Bluetooth: hci_core: Fix possible buffer overflow
  - !8949  CVE-2022-48652
  - !8602  netfilter: nf_tables: set dormant flag on hook register failure
  - !8867  ipv6: prevent NULL dereference in ip6_output()
  - !8779  smb: client: fix UAF in smb2_reconnect_server()
  - !8893 [sync] PR-8531:  gpiolib: cdev: fix uninitialised kfifo
  - !8985  cvm_tsi: Fix security issue for Confidential cVM TSI
  - !8686  mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  - !8711  ubifs: Set page uptodate in the correct place
  - !8860  blk-iocost: do not WARN if iocg was already offlined
  - !8639  s390/qeth: Fix kernel panic after setting hsuid
  - !8946  usb: typec: ucsi: Limit read size on v1.2
  - !8969  Fix CVE-2024-36949
  - cvm_tsi: Fix security issue for Confidential cVM TSI
  - !8216  ACPI: video: check for error while searching for backlight device parent
  - !8903  ALSA: scarlett2: Add missing error checks to *_ctl_get()
  - !8584  virtio-blk: fix implicit overflow on virtio_max_dma_size
  - !8838  blk-iocost: avoid out of bounds shift
  - !8856  PCI/PM: Drain runtime-idle callbacks before driver removal
  - amd/amdkfd: sync all devices to wait all processes being evicted
  - drm/amdkfd: Rework kfd_locked handling
  - !8906  net/mlx5e: Fix use-after-free of encap entry in neigh update handler
  - !8910  gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - ice: Fix crash by keep old cfg when update TCs more than queues
  - ice: ethtool: Prohibit improper channel config for DCB
  - !8879  net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - !6695  netfilter: nft_set_pipapo: do not free live element
  - usb: typec: ucsi: Limit read size on v1.2
  - !8891  net: fix out-of-bounds access in ops_init
  - !8871 add sdma-dae for openeuler 22.03 SP4
  - !8762  tipc: fix UAF in error path
  - !8742  octeontx2-af: avoid off-by-one read from userspace
  - !8734  mptcp: ensure snd_nxt is properly initialized on connect
  - !8634  batman-adv: Avoid infinite loop trying to resize local TT
  - !8736  net: hns3: fix kernel crash when devlink reload during initialization
  - !8745  afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
  - !3547  fs: mitigatin cacheline false sharing in struct file
  - !8887  nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  - net/mlx5e: Fix use-after-free of encap entry in neigh update handler
  - ALSA: scarlett2: Add missing error checks to *_ctl_get()
  - !8785  tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  - drivers: misc: sdma-dae: enable sdma_dae for arm64
  - drivers: misc: sdma-dae: support page fault preprocess
  - gpiolib: cdev: fix uninitialised kfifo
  - !8849  ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - net: fix out-of-bounds access in ops_init
  - !8666  phonet/pep: fix racy skb_queue_empty() use
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs
  - drivers: misc: sdma-dae: support interrupt init and handle
  - drivers: misc: sdma-dae: support sqe task send and execute
  - drivers: misc: sdma-dae: support channel management
  - drivers: misc: sdma-dae: support getting streamID
  - drivers: misc: sdma-dae: support initializ sdma driver
  - ipv6: prevent NULL dereference in ip6_output()
  - blk-iocost: do not WARN if iocg was already offlined
  - PCI/PM: Drain runtime-idle callbacks before driver removal
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  - !8684  tcp: properly terminate timers for kernel sockets
  - !8629  erspan: make sure erspan_base_hdr is present in skb->head
  - blk-iocost: avoid out of bounds shift
  - !8635  ipv6: Fix potential uninit-value access in __ip6_make_skb()
  - !8550  tipc: fix a possible memleak in tipc_buf_append
  - !8726  tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - !8808 v2  Add support for PCC Operation Region
  - !8623  fs/9p: only translate RWX permissions for plain 9P2000
  - !8479  scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - arm64: config: Enable ACPI_PCC
  - ACPI: PCC: Setup PCC Opregion handler only if platform interrupt is available
  - ACPI: PCC: Fix unintentional integer overflow
  - ACPI: PCC: Fix Tx acknowledge in the PCC address space handler
  - ACPI: PCC: replace wait_for_completion()
  - ACPI: PCC: Release resources on address space setup failure path
  - ACPI: PCC: pcc_ctx can be static
  - ACPI: PCC: Implement OperationRegion handler for the PCC Type 3 subtype
  - ACPICA: Add support for PCC Opregion special context data
  - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  - smb: client: fix UAF in smb2_reconnect_server()
  - tipc: fix UAF in error path
  - afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
  - octeontx2-af: avoid off-by-one read from userspace
  - net: hns3: fix kernel crash when devlink reload during initialization
  - mptcp: ensure snd_nxt is properly initialized on connect
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  - ubifs: Set page uptodate in the correct place
  - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  - tcp: properly terminate timers for kernel sockets
  - phonet/pep: fix racy skb_queue_empty() use
  - s390/qeth: Fix kernel panic after setting hsuid
  - ipv6: Fix potential uninit-value access in __ip6_make_skb()
  - batman-adv: Avoid infinite loop trying to resize local TT
  - erspan: make sure erspan_base_hdr is present in skb->head
  - fs/9p: only translate RWX permissions for plain 9P2000
  - netfilter: nf_tables: set dormant flag on hook register failure
  - Bluetooth: hci_core: Fix possible buffer overflow
  - virtio-blk: fix implicit overflow on virtio_max_dma_size
  - tipc: fix a possible memleak in tipc_buf_append
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
  - ACPI: video: check for error while searching for backlight device parent
  - netfilter: nft_set_pipapo: do not free live element
  - fs: enable CONFIG_FILE_MITIGATION_FALSE_SHARING by default on arm64
  - fs: mitigatin cacheline false sharing in struct file


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-208.0.0.108
changelog:
  - !9084 v5  xfs: atomic writes for xfs
  - block: fix kabi in struct queue_limits
  - xfs: make bunmapi observe forcealigin
  - xfs: Only free full extents for forcealign
  - xfs: Update xfs_is_falloc_aligned() mask for forcealign
  - xfs: fix set xflags fail when inode has extent hit
  - xfs: support atomic write ioctl
  - fs: xfs: Support setting FMODE_CAN_ATOMIC_WRITE
  - fs: xfs: Validate atomic writes
  - fs: xfs: Support FS_XFLAG_ATOMICWRITES for forcealign
  - fs: iomap: Atomic write support
  - fs: Add FS_XFLAG_ATOMICWRITES flag
  - fs: xfs: iomap: Sub-extent zeroing
  - fs: iomap: Sub-extent zeroing
  - fs: xfs: Do not free EOF blocks for forcealign
  - fs: xfs: Make file data allocations observe the 'forcealign' flag
  - fs: xfs: Enable file data forcealign feature
  - fs: xfs: Introduce FORCEALIGN inode flag
  - nvme: Atomic write support
  - block: Add core atomic write support
  - fs: Initial atomic write support
  - block: get atomic write max sectors
  - !9064 drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - !9067  config: enable CONFIG_BLK_CGROUP_IOCOST by default
  - !9063 v3  block: support to dispatch bio asynchronously
  - !9066 change sdma-dae default mode to n
  - !8827 v2  iomap: fix sub-page not set dirty state
  - drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
  - !9059 roh/hns3: Add ROH client case in hclgevf_init_client_instance.
  - !9055  CVE-2024-36020
  - !9015  CVE-2024-36953
  - !9014  drm/vc4: don't check if plane->state->fb == state->fb
  - config: enable CONFIG_BLK_CGROUP_IOCOST by default
  - drivers: misc: sdma-dae: not compile sdma-dae by default
  - block: fix kabi broken in struct request_queue about CONFIG_BLK_BIO_DISPATCH_ASYNC
  - block: support to dispatch bio asynchronously
  - !9050  CVE-2024-35796
  - roh/hns3: Add ROH client case in hclgevf_init_client_instance.
  - i40e: fix vf may be used uninitialized in this function warning
  - !9020  wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - net: ll_temac: platform_get_resource replaced by wrong function
  - !7205  mm: memcontrol: do not miss MEMCG_MAX events for enforced allocations
  - !8908  Refactor hbmdev a bit
  - !9001 roh/hns3: Fix IMP reset vlan unusable.
  - !8774  CVE-2024-36914
  - !9027  tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - !8828  drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
  - !8719  CVE-2024-35887
  - !8872  drm/vmwgfx: Fix invalid reads in fence signaled events
  - !8882  scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - !8921  hugetlbfs: fix hugetlbfs_statfs() locking
  - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
  - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
  - drm/vc4: don't check if plane->state->fb == state->fb
  - roh/hns3: Fix IMP reset vlan unusable.
  - !8965  cvm: enhance security for cvm host feature
  - !8982  fix CVE-2024-36905
  - !8996  pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
  - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
  - net: relax socket state check at accept time.
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
  - cvm: enhance security for cvm host feature
  - hugetlbfs: fix hugetlbfs_statfs() locking
  - arm64: config: Open the hbmdev related config
  - soc: hisilicon: Don't poweroff if memblocks don't offlined
  - soc: hisilicon: hisi_hbmdev: Notify the device in the ACPI
  - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
  - drm/vmwgfx: Fix invalid reads in fence signaled events
  - drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
  - iomap: Ensure sub-page dirty state is set during mmap writes
  - Revert "iomap: Don't create iomap_page objects in iomap_page_mkwrite_actor"
  - drm/amd/display: Skip on writeback when it's not applicable
  - ax25: fix use-after-free bugs caused by ax25_ds_del_timer
  - mm: memcontrol: do not miss MEMCG_MAX events for enforced allocations


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-209.0.0.109
changelog:
  - !9092 v2  ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
  - !9030  bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - !9112  Backport some optimizing patches for kunpeng920
  - !9099  Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - !9166  A Solution to Re-enable hugetlb vmemmap optimize on ARM64
  - !9163  genirq: introduce handle_fasteoi_edge_irq flow handler
  - ARM: 9278/1: kfence: only handle translation faults
  - arm64: mm: HVO: support BBM of vmemmap pgtable safely
  - arm64: mm: kfence: only handle translation faults
  - mm: HVO: introduce helper function to update and flush pgtable
  - genirq: introduce handle_fasteoi_edge_irq for phytium
  - genirq: introduce handle_fasteoi_edge_irq flow handler
  - !8753  memcg: fix input of try_to_free_mem_cgroup_pages
  - !9149 [sync] PR-9054:  soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !9125  arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
  - !9138 v2  CVE-2024-36971
  - !8494  rpmsg: virtio: Free driver_override when rpmsg_remove()
  - !9073 v2  Fix UAF problem of hpool
  - soc: fsl: qbman: Use raw spinlock for cgr_lock
  - !9131  mm: swap: fix race between free_swap_and_cache() and swapoff()
  - !9129  ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
  - !9068  Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - !8700  wifi: cfg80211: check A-MSDU format more carefully
  - net: fix kabi breakage in struct dst_ops
  - net: fix __dst_negative_advice() race
  - mm: swap: fix race between free_swap_and_cache() and swapoff()
  - ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
  - arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
  - !8999  scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - !8938  clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - arm64: syscall: unmask DAIF for tracing status
  - arm64: Snapshot thread flags
  - sched: Snapshot thread flags
  - entry: Snapshot thread flags
  - x86: Snapshot thread flags
  - thread_info: Add helpers to snapshot thread flags
  - irqchip/gic-v3: Use dsb(ishst) to order writes with ICC_SGI1R_EL1 accesses
  - sched/fair: Optimize test_idle_cores() for !SMT
  - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
  - !8940  firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - !8747  dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
  - !9074 [sync] PR-8963:  Fix CVE-2024-35915
  - !9083  Bluetooth: L2CAP: Fix not validating setsockopt user input
  - !9081 v2  arm64: mm: Replace global variable in pbha with static key
  - Bluetooth: L2CAP: Fix not validating setsockopt user input
  - arm64: mm: Replace global variable in pbha with static key
  - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_rx_work
  - nfc: nci: Fix kcov check in nci_rx_work()
  - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
  - mm/dynamic_hugetlb: use rcu lock to protect hpool
  - mm/dynamic_hugetlb: simplify the refcount code
  - Bluetooth: RFCOMM: Fix not validating setsockopt user input
  - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  - firewire: ohci: mask bus reset interrupts between ISR and bottom half
  - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  - memcg: fix input of try_to_free_mem_cgroup_pages
  - dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  - wifi: cfg80211: check A-MSDU format more carefully
  - rpmsg: virtio: Free driver_override when rpmsg_remove()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-210.0.0.110
changelog:
  - !9268  net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - !9103  ksmbd: no response from compound read
  - !9186  spi: Fix deadlock when adding SPI controllers on SPI buses
  - !9283 hns3 udma: support non share jfr mode in UM
  - !9277 ima: Fix violation digests extending issue in cvm
  - hns3 udma: kernel support non share jfr mode in UM mode
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  - !9244 urma: cannot uninstall uburma driver
  - !9250  Fix token error issue when concurrent calls
  - !9241 v2  Bugfix backport for rcu
  - urma: cannot uninstall uburma driver
  - Fix token error issue when concurrent calls
  - !9180  wifi: wilc1000: fix RCU usage in connect path
  - !9212  drm/amd/display: Fix division by zero in setup_dsc_config
  - ima: Fix violation digests extending issue in cvm
  - !9239  Fix allmodconfig build frame size error
  - !9207 v2  sched: smart_grid: fix potential NULL pointer dereference
  - srcu: Fix callbacks acceleration mishandling
  - entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up
  - rcu: Defer RCU kthreads wakeup when CPU is dying
  - RDMA/hiroce3: Fix allmodconfig build frame size error
  - !7729  loop: use lo->lo_disk for kobject_uevent
  - !9211  memcg: attach memcg async reclaim worker to curcpu
  - !9168  UBIFS: fixes a series of issues that caused by power cut
  - !9000  media: tc358743: register v4l2 async device only after successful setup
  - !9087  fs/9p: fix uninitialized values during inode evict
  - drm/amd/display: Fix division by zero in setup_dsc_config
  - memcg: attach memcg async reclaim worker to curcpu
  - sched: smart_grid: fix potential NULL pointer dereference
  - spi: fix kabi breakage in struct spi_controller
  - spi: fix use-after-free of the add_lock mutex
  - spi: Fix deadlock when adding SPI controllers on SPI buses
  - wifi: wilc1000: fix RCU usage in connect path
  - ubifs: dbg_orphan_check: Fix missed key type checking
  - ubifs: Fix unattached inode when powercut happens in creating
  - ubifs: Fix space leak when powercut happens in linking tmpfile
  - ubifs: Move ui->data initialization after initializing security
  - ubifs: Fix adding orphan entry twice for the same inode
  - ubifs: Remove insert_dead_orphan from replaying orphan process
  - ubifs: Don't add xattr inode into orphan area
  - ubifs: Fix unattached xattr inode if powercut happens after deleting
  - ubifs: Fix some kernel-doc comments
  - ubifs: Fix spelling mistakes
  - ksmbd: no response from compound read
  - fs/9p: fix uninitialized values during inode evict
  - media: tc358743: register v4l2 async device only after successful setup
  - loop: use lo->lo_disk for kobject_uevent


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-211.0.0.111
changelog:
  - !9318  Revert "sched/fair:ARM64 enables SIS_UTIL and disables SIS_PROP"
  - Revert "sched/fair:ARM64 enables SIS_UTIL and disables SIS_PROP"


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-212.0.0.112
changelog:
  - !9347  sched: ARM64 enables SIS_PROP and disables SIS_UTIL"
  - sched: ARM64 enables SIS_PROP and disables SIS_UTIL"


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-213.0.0.113
changelog:
  - !9327  af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - !9264  ring-buffer: Fix a race between readers and resize checks
  - !9305  CVE-2024-26661 following bugfix
  - !9246  ksmbd: no response from compound read
  - !9350  tracing: Fix permissions for the buffer_percent file
  - tracing: Fix permissions for the buffer_percent file
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  - drm/amd/display: Fix && vs || typos
  - drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'
  - Revert "drm/amd/display: Fix && vs || typos"
  - ring-buffer: Fix a race between readers and resize checks
  - ksmbd: no response from compound read


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-214.0.0.114
changelog:
  - !9391  fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
  - fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-216.0.0.115
changelog:
  - !9507  Enable SIS_UTIL for arm64 and optimize load_balance
  - !9508  Revert "fs: Use CHECK_DATA_CORRUPTION() when
  - Revert "fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected"
  - config: Disable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64
  - sched/numa: Fix numa imbalance in load_balance()
  - Revert "Revert "sched/fair:ARM64 enables SIS_UTIL and disables SIS_PROP""
  - Revert "sched: ARM64 enables SIS_PROP and disables SIS_UTIL""
  - !9333  net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - !8098  netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  - !5860  ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
  - !9421 v3  block: fix WARNING in init_blk_queue_async_dispatch
  - block: fix WARNING in init_blk_queue_async_dispatch
  - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  - ksmbd: fix UAF issue in ksmbd_tcp_new_connection()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-217.0.0.116
changelog:
  - !9160  xfs: don't use current->journal_info
  - !9429  usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  - !9644  fix uaf when proc_cpuset_show
  - !9532  CVE-2024-37356
  - !9496  netrom: fix possible dead-lock in nr_rt_ioctl()
  - cgroup: fix uaf when proc_cpuset_show
  - !9514  RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - !9559  CVE-2024-38597
  - !9039 [OLK-5.10] drm/phytium: Replace default efi fb0 with dc fb
  - !9595  drm/arm/malidp: fix a possible null pointer dereference
  - !9593  ARM: 9170/1: fix panic when kasan and kprobe are enabled
  - !9504  um: Add winch to winch_handlers before registering winch IRQ
  - drm/arm/malidp: fix a possible null pointer dereference
  - ARM: 9170/1: fix panic when kasan and kprobe are enabled
  - !9587  s390/ap: Fix crash in AP internal function modify_bitmap()
  - s390/ap: Fix crash in AP internal function modify_bitmap()
  - !9569  net: fec: remove .ndo_poll_controller to avoid deadlocks
  - !9540  net/mlx5e: Avoid field-overflowing memcpy()
  - !9577 v2  btrfs: fix crash on racing fsync and size-extending write into prealloc
  - !9563  fs/ntfs3: Check 'folio' pointer for NULL
  - !9383  serial: max3100: Update uart_driver_registered on driver removal
  - btrfs: fix crash on racing fsync and size-extending write into prealloc
  - !8744  ext4 bugfix from mainline
  - !9499  ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - !9500  netfilter: nf_tables: flush pending destroy work before exit_net release
  - !9453  jffs2: prevent xattr node from overflowing the eraseblock
  - !9202  dyndbg: fix old BUG_ON in >control parser
  - !9193  wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  - !9201  ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  - !9190  clk: Fix clk_core_get NULL dereference
  - !9188  net: phy: fix phy_get_internal_delay accessing an empty array
  - !9462 v2  CVE-2024-27032
  - !9408  drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - !9447  rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - !9425  ASoC: SOF: Fix DSP oops stack dump output contents
  - !9321  drm/amd/display: Fix potential index out of bounds in color transformation function
  - !9297  CVE-2021-47599
  - !9401  Fix CVE-2024-31076
  - !9434  cvm: delete dead code and resolve macro definition holes
  - !9395  CVE-2024-38587
  - !9386  vfio/pci: fix potential memory leak in vfio_intx_enable()
  - !9199  init/main.c: Fix potential static_command_line memory overflow
  - !8683 v4  Fix CVE-2024-35879
  - !9339  serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - !9470  net/mlx5: Add a timeout to acquire the command queue semaphore
  - !9442  net/mlx5: Discard command completions in internal error
  - !9290  net: bridge: xmit: make sure we have at least eth header len bytes
  - !9284  of: module: add buffer overflow check in of_modalias()
  - !9477  watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - !9544  ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - !9483  fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - !9558  CVE-2024-39362
  - !9456  bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - !9527  media: lgdt3306a: Add a check against null-pointer-def
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
  - fs/ntfs3: Check 'folio' pointer for NULL
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
  - i2c: acpi: Unbind mux adapters before delete
  - i2c: add fwnode APIs
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  - net/mlx5e: Avoid field-overflowing memcpy()
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
  - params: lift param_set_uint_minmax to common code
  - media: lgdt3306a: Add a check against null-pointer-def
  - !9511  blk-throttle: check for overflow in calculate_bytes_allowed
  - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
  - blk-throttle: check for overflow in calculate_bytes_allowed
  - blk-throttle: use calculate_io/bytes_allowed() for throtl_trim_slice()
  - blk-throttle: factor out code to calculate ios/bytes_allowed
  - um: Add winch to winch_handlers before registering winch IRQ
  - netfilter: nf_tables: flush pending destroy work before exit_net release
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  - netrom: fix possible dead-lock in nr_rt_ioctl()
  - fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
  - watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
  - net/mlx5: Add a timeout to acquire the command queue semaphore
  - f2fs: fix to avoid potential panic during recovery
  - f2fs: fix to check return value of f2fs_reserve_new_block()
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
  - jffs2: prevent xattr node from overflowing the eraseblock
  - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
  - net/mlx5: Discard command completions in internal error
  - cvm: delete dead code and resolve macro definition holes
  - usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  - ASoC: SOF: Fix DSP oops stack dump output contents
  - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
  - speakup: Fix sizeof() vs ARRAY_SIZE() bug
  - vfio/pci: fix potential memory leak in vfio_intx_enable()
  - serial: max3100: Update uart_driver_registered on driver removal
  - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  - drm/amd/display: Fix potential index out of bounds in color transformation function
  - btrfs: remove stale comment about the btrfs_show_devname
  - btrfs: update latest_dev when we create a sprout device
  - btrfs: use latest_dev in btrfs_show_devname
  - btrfs: convert latest_bdev type to btrfs_device and rename
  - net: bridge: xmit: make sure we have at least eth header len bytes
  - of: module: add buffer overflow check in of_modalias()
  - dyndbg: fix old BUG_ON in >control parser
  - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  - init/main.c: Fix potential static_command_line memory overflow
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  - clk: Fix clk_core_get NULL dereference
  - net: phy: fix phy_get_internal_delay accessing an empty array
  - xfs: don't use current->journal_info
  - drm/phytium: Replace default efi fb0 with dc fb
  - ext4: fix warning in ext4_dio_write_end_io()
  - ext4: properly sync file size update after O_SYNC direct IO
  - iomap: update ki_pos a little later in iomap_dio_complete
  - driver core: Fix kabi broken
  - of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
  - driver core: Introduce device_link_wait_removal()


author: yixiangzhike <yixiangzhike007@163.com> - 1.4.4-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:change the files order in patch file fix-doc-about-difok.patch


author: xinghe <xinghe2@h-partners.com> - 1:1.0.0-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix cache prepare nft_cache evaluate to return error
         fix cache validate handle string length
         add src support for implicit chain bindings
         fix cache release pending rules
         fix segtree map listing
         parser_json fix device parsing in netdev family
         fix src Don't parse string as verdict in map


author: huangyu <huangyu106@huawei.com> - 1:1.0.0-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix string prefix expression must retain original length
  fix release top level scope


author: zhanghao <zhanghao383@huawei.com> - 1:1.0.0-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:evaluate allow implicit ether vlan dep
  evaluate datatype memleak after binop transfer
  evaluate bogus datatype assertion in binary operation evaluation
  netlink delinearize do not transfer binary operation to non anonymous sets
  payload do not kill dependency for proto unknown
  monitor missing cache and set handle initialization
  netlink linearize fix timeout with map updates


author: zhanghao <zhanghao383@huawei.com> - 1:1.0.0-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix potential array out of bounds access
  evaluate: fix shift exponent underflow in concatenation evaluation
  netlink: Fix for potential NULL-pointer deref
  mnl: dump_nf_hooks() leaks memory in error path


author: gaihuiying <eaglegai@163.com> - 1:1.0.0-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: error out if basetypes are different
         evaluate: guard against NULL basetype
         evaluate: handle invalid mapping expressions gracefully
         evaluate: reject attempt to update a set
         evaluate: release mpz type in expr_evaluate_list() error path
         expression: missing line in describe command with invalid expression

  Thu Apr 18 2024 lingsheng <lingsheng1@h-partners.com> - 1:1.0.0-10
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:datatype: don't return a const string from cgroupv2_get_path()
  datatype: fix leak and cleanup reference counting for struct datatype
  datatype: initialize TYPE_CT_EVENTBIT slot in datatype array
  datatype: initialize TYPE_CT_LABEL slot in datatype array
  evaluate: do not remove anonymous set with protocol flags and single element
  evaluate: don't crash if object map does not refer to a value
  evaluate: error out when expression has no datatype
  evaluate: error out when store needs more than one 128bit register of align fixup
  evaluate: fix check for truncation in stmt_evaluate_log_prefix()
  evaluate: fix double free on dtype release
  evaluate: fix memleak in prefix evaluation with wildcard interface name
  evaluate: reject set in concatenation
  evaluate: revisit anonymous set with single element optimization
  evaluate: skip anonymous set optimization for concatenations
  evaluate: stmt_nat: set reference must point to a map
  evaluate: tproxy: move range error checks after arg evaluation
  evaluate: validate chain max length
  evaluate: validate maximum log statement prefix length
  exthdr: fix tcpopt_find_template to use length after mask adjustment
  exthdr: prefer raw_type instead of desc->type
  json: expose dynamic flag
  json: fix use after free in table_flags_json()
  libnftables: Drop cache in -c/--check mode
  meta: fix tc classid parsing out-of-bounds access
  netlink: don't crash if prefix for < byte is requested
  netlink: fix leaking typeof_expr_data/typeof_expr_key in netlink_delinearize_set()
  netlink: handle invalid etype in set_make_key()
  parser_bison: fix ct scope underflow if ct helper section is duplicated
  parser_bison: fix memleak in meta set error handling
  parser_bison: make sure obj_free releases timeout policies
  parser_json: Catch nonsense ops in match statement
  parser_json: Default meter size to zero
  parser_json: Fix flowtable prio value parsing
  parser_json: Fix synproxy object mss/wscale parsing
  parser_json: Fix typo in json_parse_cmd_add_object()
  parser_json: Proper ct expectation attribute parsing
  parser_json: Wrong check in json_parse_ct_timeout_policy()
  py: fix exception during cleanup of half-initialized Nftables
  rule: fix sym refcount assertion


author: renmingshuai<renmingshuai@huawei.com> - 8.8p1-25
changelog:
  - Type:CVE
  - CVE:CVE-2023-48795,CVE-2023-51385
  - SUG:NA
  - DESC:fix CVE-2023-48795 and CVE-2023-51385


author: zhouwenpei <zhouwenpei1@h-partners.com> - 0.90.0-6
changelog:
  - fix CVE-2022-37050,CVE-2022-37051,CVE-2022-37052,CVE-2022-38349,CVE-2020-23804
  - fix install error


author: xiongyi <xiongyi@uniontech.com> - 0.90.0-7
changelog:
  - fix CVE-2020-36023
  - fix infinite looping in cvtGlyph with broken files
  - patch source:https://gitlab.freedesktop.org/poppler/poppler/-/issues/1013


