# changelog

author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2203.2.0.0140
changelog:
  - mm: Fix return val in khugepaged_scan_pmd()
  - mm: do some clean up of accounting ReliableTaskUsed
  - mm: fix statistic of ReliableTaskUsed
  - mm: fix missing reclaim of low-reliable page cache
  - mm: fix statistic of ReliableFileCache in /proc/meminfo
  - mm: Add more gfp flag check in prepare_before_alloc()
  - efi: Stub mirrored_kernelcore if CONFIG_HAVE_MEMBLOCK_NODE_MAP is not enabled
  - mm: Memory reliable features can only be disabled via proc interface
  - mm: Fix reliable_debug in proc not consistent with boot parameter problem
  - f2fs: fix to do sanity check on inode type during garbage collection
  - mm: Check page status in page_reliable()
  - mm: Show ReliableTaskUsed in /proc/meminfo
  - mm: Refactor code in reliable_report_meminfo()
  - mm: Show correct reliable_user_used if PAGE_SIZE is not 4K
  - proc: Fix reliable display err in /proc/pid/status
  - Revert "mm: add page cache fallback statistic"
  - mm: fix page cache use reliable memory when reliable_debug=P
  - mm: add support for limiting the usage of reliable memory in pagecache
  - mm: add "ReliableFileCache" item in /proc/meminfo
  - mm: Introduce shmem mirrored memory limit for memory reliable
  - mm: Introduce watermark check for memory reliable
  - mm: Count mirrored pages in buddy system
  - mm: Export mem_reliable_status() for checking memory reliable status
  - mm: Make MEMORY_RELIABLE depends on HAVE_MEMBLOCK_NODE_MAP
  - efi: Disable mirror feature if kernelcore is not spcified
  - mm: Introduce proc interface to control memory reliable features
  - mm: Demote warning message in vmemmap_verify() to debug level
  - mm: Ratelimited mirrored memory related warning messages


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2203.3.0.0141
changelog:
  - crypto: pcrypt - Fix user-after-free on module unload
  - lib/iov_iter: initialize "flags" in new pipe_buffer
  - mm: Count reliable shmem used based on NR_SHMEM
  - mm: fix zoneref mapping problem in memory reliable
  - mm: disable memory reliable when kdump is in progress
  - mm: introduce "clear_freelist" kernel parameter
  - mm: fix unable to use reliable memory in page cache
  - nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
  - select: Fix indefinitely sleeping task in poll_schedule_timeout()
  - mtd: nand: bbt: Fix corner case in bad block table handling
  - netns: add schedule point in ops_exit_list()
  - af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
  - crypto: stm32/crc32 - Fix kernel BUG triggered in probe()
  - ext4: don't use the orphan list when migrating an inode
  - ext4: set csum seed in tmp inode while migrating to extents
  - ext4: make sure quota gets properly shutdown on error
  - ext4: make sure to reset inode lockdep class when quota enabling fails
  - cputime, cpuacct: Include guest time in user time in cpuacct.stat
  - serial: Fix incorrect rs485 polarity on uart open
  - scsi: sr: Don't use GFP_DMA
  - dm space map common: add bounds check to sm_ll_lookup_bitmap()
  - dm btree: add a defensive bounds check to insert_at()
  - ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
  - ACPICA: Utilities: Avoid deleting the same object twice in a row
  - jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
  - bpf: Do not WARN in bpf_warn_invalid_xdp_action()
  - net: bonding: debug: avoid printing debug logs when bond is not notifying peers
  - net-sysfs: update the queue counts in the unregistration path
  - dmaengine: pxa/mmp: stop referencing config->slave_id
  - scsi: ufs: Fix race conditions related to driver data
  - iommu/io-pgtable-arm: Fix table descriptor paddr formatting
  - ext4: avoid trim error on fs with small groups
  - net: mcs7830: handle usb read errors properly
  - tpm: add request_locality before write TPM_INT_ENABLE
  - netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
  - xfrm: state and policy should fail if XFRMA_IF_ID 0
  - xfrm: interface with if_id 0 should return error
  - crypto: stm32/cryp - fix double pm exit
  - xfrm: fix a small bug in xfrm_sa_len()
  - sched/rt: Try to restart rt period timer when rt runtime exceeded
  - serial: amba-pl011: do not request memory region twice
  - tty: serial: uartlite: allow 64 bit address
  - netfilter: bridge: add support for pppoe filtering
  - crypto: qce - fix uaf on qce_ahash_register_one
  - shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
  - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet
  - ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
  - scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
  - ipv6: Do cleanup if attribute validation fails in multipath route
  - ipv6: Continue processing multipath route even if gateway attribute is invalid
  - ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
  - ipv6: Check attribute length for RTA_GATEWAY in multipath route
  - tracing: Tag trace_percpu_buffer as a percpu pointer
  - tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
  - net: fix use-after-free in tw_timer_handler
  - udp: using datalen to cap ipv6 udp max gso segments
  - selinux: initialize proto variable in selinux_ip_postroute_compat()
  - x86/pkey: Fix undefined behaviour with PKRU_WD_BIT
  - ipmi: fix initialization when workqueue allocation fails
  - ipmi: bail out if init_srcu_struct fails
  - bonding: fix ad_actor_system option setting to default
  - ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
  - net: skip virtio_net_hdr_set_proto if protocol already set
  - net: hns3: update hns3 version to 22.2.1
  - net: hns3: fix RMW issue for VLAN filter switch
  - net: hns3: fix pf vlan filter out of work after self test
  - arm64: acpi: fix UBSAN warning
  - sched: Fix sleeping in atomic context at cpu_qos_write()
  - io_uring: don't re-setup vecs/iter in io_resumit_prep() is already there
  - io_uring: don't double complete failed reissue request
  - io_uring: remove redundant initialization of variable ret
  - block: don't ignore REQ_NOWAIT for direct IO
  - io_uring: re-issue block requests that failed because of resources
  - dm multipath: fix missing blk_account_io_done() in error path
  - block: account inflight from blk_account_io_start() if 'precise_iostat' is set
  - block: add a switch for precise iostat accounting
  - blk-throttle: Set BIO_THROTTLED when bio has been throttled
  - bfq: fix use-after-free in bfq_dispatch_request
  - hugetlbfs: fix a truncation issue in hugepages parameter


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2203.4.0.0142
changelog:
  - kabi: fix kabi broken in struct fuse_in
  - fuse: fix pipe buffer lifetime for direct_io
  - blk-throtl: fix race in io dispatching
  - ext4: Fix symlink file size not match to file content
  - livepatch/core: Check klp_func before 'klp_init_object_loaded'
  - irqchip/gic-phytium-2500: Fix issue that interrupts are concentrated in one cpu
  - blk-mq: add exception handling when srcu->sda alloc failed
  - audit: improve audit queue handling when "audit=1" on cmdline
  - Revert "audit: bugfix for infinite loop when flush the hold queue"
  - veth: Do not record rx queue hint in veth_xmit


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2203.5.0.0143
changelog:
  - livepatch/arm64: Fix incorrect endian conversion when long jump
  - arm64/mpam: realign step entry when traversing rmid_transform
  - dt-bindings: mpam: refactor device tree node structure
  - arm64/mpam: refactor device tree structure to support multiple devices
  - arm64/mpam: fix __mpam_device_create() section mismatch error
  - block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
  - hugetlb: Add huge page alloced limit
  - swiotlb: rework "fix info leak with DMA_FROM_DEVICE"
  - swiotlb: fix info leak with DMA_FROM_DEVICE
  - esp: Fix possible buffer overflow in ESP transformation
  - sock: remove one redundant SKB_FRAG_PAGE_ORDER macro
  - io_uring: fix UAF in get_files_struct()
  - xfs: fix an undefined behaviour in _da3_path_shift
  - xfs: Fix possible null-pointer dereferences in xchk_da_btree_block_check_sibling()
  - xfs: fix use after free in buf log item unlock assert
  - ACPI/IORT: Do not blindly trust DMA masks from firmware


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2204.1.0.0144
changelog:
  - serial: 8250: Fix max baud limit in generic 8250 port
  - sched/fair: Add qos_throttle_list node in struct cfs_rq
  - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
  - Revert "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
  - USB: gadget: validate endpoint index for xilinx udc
  - sr9700: sanity check for packet length
  - ima: Fix return value of ima_write_policy()
  - ima: Don't modify file descriptor mode on the fly
  - ima: Set file->f_mode instead of file->f_flags in ima_calc_file_hash()
  - ima: Remove __init annotation from ima_pcrread()
  - ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init()
  - evm: Check size of security.evm before using it
  - ima: Don't ignore errors from crypto_shash_update()
  - mm: Fallback to non-mirrored region below low watermark
  - mm: Disable watermark check if reliable fallback is disabled
  - mm: Do limit checking after memory allocation for memory reliable


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2204.2.0.0145
changelog:
  - Revert "module, async: async_synchronize_full() on module init iff async is used"
  - tty: n_gsm: fix encoding of control signal octet bit DV
  - fget: clarify and improve __fget_files() implementation
  - memblock: use kfree() to release kmalloced memblock regions
  - tty: n_gsm: fix proper link termination after failed open
  - gso: do not skip outer ip header in case of ipip and net_failover
  - net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends
  - cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug
  - tracing: Fix tp_printk option related with tp_printk_stop_on_boot
  - dmaengine: sh: rcar-dmac: Check for error num after setting mask
  - net: sched: limit TC_ACT_REPEAT loops
  - mtd: rawnand: qcom: Fix clock sequencing in qcom_nandc_probe()
  - NFS: Do not report writeback errors in nfs_getattr()
  - NFS: LOOKUP_DIRECTORY is also ok with symlinks
  - bonding: fix data-races around agg_select_timer
  - drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
  - ping: fix the dif and sdif check in ping_lookup
  - taskstats: Cleanup the use of task->exit_code
  - xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
  - nvme: fix a possible use-after-free in controller reset during load
  - quota: make dquot_quota_sync return errors from ->sync_fs
  - vfs: make freeze_super abort when sync_filesystem returns error
  - serial: parisc: GSC: fix build when IOSAPIC is not set
  - perf: Fix list corruption in perf_cgroup_switch()
  - seccomp: Invalidate seccomp mode to catch death failures
  - n_tty: wake up poll(POLLRDNORM) on receiving data
  - veth: fix races around rq->rx_notify_masked
  - net: fix a memleak when uncloning an skb dst and its metadata
  - net: do not keep the dst cache when uncloning an skb dst and its metadata
  - ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
  - bonding: pair enable_port with slave_arr_updates
  - bpf: Add kconfig knob for disabling unpriv bpf by default
  - scsi: target: iscsi: Make sure the np under each tpg is unique
  - NFSv4 expose nfs_parse_server_name function
  - NFSv4 remove zero number of fs_locations entries error check
  - NFSv4.1: Fix uninitialised variable in devicenotify
  - nfs: nfs4clinet: check the return value of kstrdup()
  - NFSv4 only print the label when its queried
  - NFS: Fix initialisation of nfs_client cl_flags field
  - ima: Allow template selection with ima_template[_fmt]= after ima_hash=
  - ima: Remove ima_policy file before directory
  - integrity: check the return value of audit_log_start()
  - ext4: fix error handling in ext4_restore_inline_data()
  - iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
  - iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()
  - block: bio-integrity: Advance seed correctly for larger interval sizes
  - af_packet: fix data-race in packet_setsockopt / packet_setsockopt
  - rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
  - ipv4: tcp: send zero IPID in SYNACK messages
  - ipv4: raw: lock the socket in raw_bind()
  - phylib: fix potential use-after-free
  - NFS: Ensure the server has an up to date ctime before renaming
  - NFS: Ensure the server has an up to date ctime before hardlinking
  - ipv6: annotate accesses to fn->fn_sernum
  - ipv4: avoid using shared IP generator for connected sockets
  - ping: fix the sk_bound_dev_if match in ping_lookup
  - ipv6_tunnel: Rate limit warning messages
  - tty: n_gsm: fix SW flow control encoding/handling
  - serial: stm32: fix software flow control transfer
  - serial: 8250: of: Fix mapped region size when using reg-offset property
  - netfilter: nft_payload: do not update layer 4 checksum when mangling fragments
  - PM: wakeup: simplify the output logic of pm_show_wakelocks()
  - tty: fix crash in release_tty if tty->port is not set
  - tty: don't crash in tty_init_dev when missing tty_port
  - printk: Convert a use of sprintf to snprintf in console_unlock


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2204.3.0.0146
changelog:
  - ext4: fix fs corruption when tring to remove a non-empty directory with IO error
  - Revert "ext4: fix file system corrupted when rmdir non empty directory with IO error"
  - sched: Fix yet more sched_fork() races
  - sched/fair: Fix wrong cpu selecting from isolated domain
  - netfilter: nf_tables: initialize registers in nft_do_chain()
  - nbd: fix possible overflow on 'first_minor' in nbd_dev_add()
  - net: sched: adapt Qdisc kabi
  - net_sched: fix a crash in tc_new_tfilter()
  - net: sched: use Qdisc rcu API instead of relying on rtnl lock
  - net: sched: add helper function to take reference to Qdisc
  - net: sched: extend Qdisc with rcu
  - net: core: netlink: add helper refcount dec and lock function
  - xen/netfront: react properly to failing gnttab_end_foreign_access_ref()
  - xen/gnttab: fix gnttab_end_foreign_access() without page specified
  - xen/pvcalls: use alloc/free_pages_exact()
  - xen/9p: use alloc/free_pages_exact()
  - xen: remove gnttab_query_foreign_access()
  - xen/gntalloc: don't use gnttab_query_foreign_access()
  - xen/scsifront: don't use gnttab_query_foreign_access() for mapped status
  - xen/netfront: don't use gnttab_query_foreign_access() for mapped status
  - xen/blkfront: don't use gnttab_query_foreign_access() for mapped status
  - xen/grant-table: add gnttab_try_end_foreign_access()
  - xen/xenbus: don't let xenbus_grant_ring() remove grants in error case
  - xen/xenbus: Fix granting of vmalloc'd memory
  - binder: fix test regression due to sender_euid change
  - binder: use cred instead of task for selinux checks
  - binder: use euid from cred instead of using task
  - svm: Change svm to modules
  - svm: Delete unused svm_get_unmapped_area ops
  - ascend: mm: Add MAP_ALIGN flag to map aligned va
  - svm: Delete unused function sysrq_sched_debug_show_export
  - svm: Delete get meminfo interface in svm ioctl
  - svm: Export symbols for svm module
  - can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
  - mm: Add space after ReliableFileCache
  - mm: Drop reliable_reserve_size
  - mm: page_counter: mitigate consequences of a page_counter underflow
  - drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
  - hamradio: remove needs_free_netdev to avoid UAF
  - hamradio: defer 6pack kfree after unregister_netdev
  - ovl: fix uninitialized pointer read in ovl_lookup_real_one()
  - ovl: fix IOCB_DIRECT if underlying fs doesn't support direct IO
  - ovl: fix lseek overflow on 32bit
  - ovl: sync dirty data when remounting to ro mode


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2204.4.0.0147
changelog:
  - Revert "perf: Paper over the hw.target problems"
  - ax25: Fix NULL pointer dereferences in ax25 timers
  - ax25: fix NPD bug in ax25_disconnect
  - ax25: Fix NULL pointer dereference in ax25_kill_by_device
  - ax25: improve the incomplete fix to avoid UAF and NPD bugs
  - ax25: NPD bug when detaching AX25 device
  - objtool: Fix stack offset tracking for indirect CFAs
  - x86/entry/64: Fix unwind hints in kernel exit path
  - af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
  - arm64: Use the clearbhb instruction in mitigations
  - arm64: add ID_AA64ISAR2_EL1 sys register
  - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated
  - arm64: Mitigate spectre style branch history side channels
  - KVM: arm64: Add templates for BHB mitigation sequences
  - arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2
  - arm64: Add percpu vectors for EL1
  - arm64: entry: Add macro for reading symbol addresses from the trampoline
  - arm64: entry: Add vectors that have the bhb mitigation sequences
  - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations
  - arm64: entry: Allow the trampoline text to occupy multiple pages
  - arm64: entry: Make the kpti trampoline's kpti sequence optional
  - arm64: entry: Move trampoline macros out of ifdef'd section
  - arm64: entry: Don't assume tramp_vectors is the start of the vectors
  - arm64: entry: Allow tramp_alias to access symbols after the 4K boundary
  - arm64: entry: Move the trampoline data page before the text page
  - arm64: entry: Free up another register on kpti's tramp_exit path
  - arm64: entry: Make the trampoline cleanup optional
  - arm64: entry.S: Add ventry overflow sanity checks
  - x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
  - x86/speculation: Warn about Spectre v2 LFENCE mitigation
  - x86/speculation: Update link to AMD speculation whitepaper
  - x86/speculation: Use generic retpoline by default on AMD
  - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
  - Documentation/hw-vuln: Update spectre doc
  - x86/speculation: Add eIBRS + Retpoline options
  - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE
  - x86,bugs: Unconditionally allow spectre_v2=retpoline,amd
  - x86/speculation: Merge one test in spectre_v2_user_select_mitigation()
  - mm/memory.c: fix clear_gigantic_page_chunk


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.1.0.0148
changelog:
  - hamradio: improve the incomplete fix to avoid NPD
  - hamradio: defer ax25 kfree after unregister_netdev
  - can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path
  - llc: only change llc->dev when bind() succeeds
  - netdevice: add the case if dev is NULL
  - llc: fix netdevice reference leaks in llc_ui_bind()
  - ARM: fix Thumb2 regression with Spectre BHB
  - ARM: Spectre-BHB: provide empty stub for non-config
  - ARM: fix build warning in proc-v7-bugs.c
  - ARM: Do not use NOCROSSREFS directive with ld.lld
  - ARM: fix co-processor register typo
  - ARM: fix build error when BPF_SYSCALL is disabled
  - ARM: include unprivileged BPF status in Spectre V2 reporting
  - ARM: Spectre-BHB workaround
  - ARM: use LOADADDR() to get load address of sections
  - ARM: early traps initialisation
  - ARM: report Spectre v2 status through sysfs
  - can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.3.0.0149
changelog:
  - ixgbevf: add disable link state
  - ixgbe: add improvement for MDD response functionality
  - ixgbe: add the ability for the PF to disable VF link state
  - io_uring: fix false WARN_ONCE
  - mm/sharepool: Fix sharepool node id invalid when using sp_alloc
  - sharepool: fix hisi oom deadlock
  - share_pool: Fix ABBA deadlock
  - net: ipv6: fix skb_over_panic in __ip6_append_data
  - net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit()
  - net/packet: fix slab-out-of-bounds access in packet_recvmsg()
  - mm: fix dereference a null pointer in migrate[_huge]_page_move_mapping()
  - cpuset: Fix unsafe lock order between cpuset lock and cpuslock
  - tcp: make tcp_read_sock() more robust
  - xfrm: Fix xfrm migrate issues when address family changes
  - Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0"
  - ext4: add check to prevent attempting to resize an fs with sparse_super2
  - net-sysfs: add check for netdevice being present to speed_show
  - memfd: fix F_SEAL_WRITE after shmem huge page allocated
  - PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
  - netfilter: nf_queue: fix possible use-after-free
  - netfilter: nf_queue: don't assume sk is full socket
  - xfrm: enforce validity of offload input flags
  - xfrm: fix the if_id check in changelink
  - netfilter: fix use-after-free in __nf_register_net_hook()
  - xfrm: fix MTU regression
  - cifs: fix double free race when mount fails in cifs_get_root()
  - mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status
  - x86/asm: Move native_write_cr0/4() out of line
  - x86/asm: Pin sensitive CR0 bits
  - x86/asm: Pin sensitive CR4 bits
  - mm: Add more debug info if oom occurs
  - mm: Fix reliable task used problem shown in meminfo
  - mm: Show correct reliable pagecache size


author: gaoxingwang<gaoxingwang@huawei.com> - 7.71.1-12
changelog:
  - Type:CVE
  - CVE:CVE-2021-22922 CVE-2021-22923
  - SUG:NA
  - DESC:disable metalink to fix CVE-2021-22922 and CVE-2021-22923


author: gaihuiying <eaglegai@163.com> - 7.71.1-13
changelog:
  - Type:cves
  - CVE:CVE-2022-22576 CVE-2022-27774 CVE-2022-27775 CVE-2022-27776
  - SUG:NA
  - DESC:fix CVE-2022-22576 CVE-2022-27774 CVE-2022-27775 CVE-2022-27776


author: panxiaohe <panxiaohe@huawei.com> - 2.9.10-22
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix following issues:
         fix unsigned integer overflow in htmlParseTryOrFinish
         fix undefined behavior in UTF16LEToUTF8
         fix SEGV in xmlSAXParseFileWithData
         encoding: fix memleak in xmlRegisterCharEncodingHandler()
         fix null deref in xmlStringGetNodeList
         fix memory leak in xmlParseElementMixedContentDecl
         fix slow parsing of HTML with encoding errors


author: fuanan <fuanan3@h-partners.com> - 2.9.10-25
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:use upstream patch refix heap-use-after-free in xmlAddNextSibling and xmlAddChild


