# changelog

author: chixinze <xmdxcxz@gmail.com> - 1:12.2.8-13
changelog:
  - fix CVE-2020-27781
  - ceph-volume-client: allow atomic updates for RADOS objects
  - qa: make test_volume_client.py py3 compatible


author: Li Qiang <liqiang64@huawei.com> - 1:12.2.8-16
changelog:
  - Synchronize the performance optimization of the pick_a_shard
  - function in the upstream community.


author: wuchangsheng <wuchangsheng2@huawei.com> - 19.11-15
changelog:
  - backport pathes from community
  - net/softnic fix memory leak as profile is freed
  - net/virtio fix interrupt handle leak
  - vhost fix crash on reconnect
  - net/virtio report maximum MTU in device info
  - bus/dpaa fix freeing in FMAN interface destructor
  - distributor fix 128 bit write alignment


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2204.2.0.0145
changelog:
  - Revert "module, async: async_synchronize_full() on module init iff async is used"
  - tty: n_gsm: fix encoding of control signal octet bit DV
  - fget: clarify and improve __fget_files() implementation
  - memblock: use kfree() to release kmalloced memblock regions
  - tty: n_gsm: fix proper link termination after failed open
  - gso: do not skip outer ip header in case of ipip and net_failover
  - net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends
  - cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug
  - tracing: Fix tp_printk option related with tp_printk_stop_on_boot
  - dmaengine: sh: rcar-dmac: Check for error num after setting mask
  - net: sched: limit TC_ACT_REPEAT loops
  - mtd: rawnand: qcom: Fix clock sequencing in qcom_nandc_probe()
  - NFS: Do not report writeback errors in nfs_getattr()
  - NFS: LOOKUP_DIRECTORY is also ok with symlinks
  - bonding: fix data-races around agg_select_timer
  - drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
  - ping: fix the dif and sdif check in ping_lookup
  - taskstats: Cleanup the use of task->exit_code
  - xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
  - nvme: fix a possible use-after-free in controller reset during load
  - quota: make dquot_quota_sync return errors from ->sync_fs
  - vfs: make freeze_super abort when sync_filesystem returns error
  - serial: parisc: GSC: fix build when IOSAPIC is not set
  - perf: Fix list corruption in perf_cgroup_switch()
  - seccomp: Invalidate seccomp mode to catch death failures
  - n_tty: wake up poll(POLLRDNORM) on receiving data
  - veth: fix races around rq->rx_notify_masked
  - net: fix a memleak when uncloning an skb dst and its metadata
  - net: do not keep the dst cache when uncloning an skb dst and its metadata
  - ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
  - bonding: pair enable_port with slave_arr_updates
  - bpf: Add kconfig knob for disabling unpriv bpf by default
  - scsi: target: iscsi: Make sure the np under each tpg is unique
  - NFSv4 expose nfs_parse_server_name function
  - NFSv4 remove zero number of fs_locations entries error check
  - NFSv4.1: Fix uninitialised variable in devicenotify
  - nfs: nfs4clinet: check the return value of kstrdup()
  - NFSv4 only print the label when its queried
  - NFS: Fix initialisation of nfs_client cl_flags field
  - ima: Allow template selection with ima_template[_fmt]= after ima_hash=
  - ima: Remove ima_policy file before directory
  - integrity: check the return value of audit_log_start()
  - ext4: fix error handling in ext4_restore_inline_data()
  - iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
  - iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()
  - block: bio-integrity: Advance seed correctly for larger interval sizes
  - af_packet: fix data-race in packet_setsockopt / packet_setsockopt
  - rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
  - ipv4: tcp: send zero IPID in SYNACK messages
  - ipv4: raw: lock the socket in raw_bind()
  - phylib: fix potential use-after-free
  - NFS: Ensure the server has an up to date ctime before renaming
  - NFS: Ensure the server has an up to date ctime before hardlinking
  - ipv6: annotate accesses to fn->fn_sernum
  - ipv4: avoid using shared IP generator for connected sockets
  - ping: fix the sk_bound_dev_if match in ping_lookup
  - ipv6_tunnel: Rate limit warning messages
  - tty: n_gsm: fix SW flow control encoding/handling
  - serial: stm32: fix software flow control transfer
  - serial: 8250: of: Fix mapped region size when using reg-offset property
  - netfilter: nft_payload: do not update layer 4 checksum when mangling fragments
  - PM: wakeup: simplify the output logic of pm_show_wakelocks()
  - tty: fix crash in release_tty if tty->port is not set
  - tty: don't crash in tty_init_dev when missing tty_port
  - printk: Convert a use of sprintf to snprintf in console_unlock


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2204.3.0.0146
changelog:
  - ext4: fix fs corruption when tring to remove a non-empty directory with IO error
  - Revert "ext4: fix file system corrupted when rmdir non empty directory with IO error"
  - sched: Fix yet more sched_fork() races
  - sched/fair: Fix wrong cpu selecting from isolated domain
  - netfilter: nf_tables: initialize registers in nft_do_chain()
  - nbd: fix possible overflow on 'first_minor' in nbd_dev_add()
  - net: sched: adapt Qdisc kabi
  - net_sched: fix a crash in tc_new_tfilter()
  - net: sched: use Qdisc rcu API instead of relying on rtnl lock
  - net: sched: add helper function to take reference to Qdisc
  - net: sched: extend Qdisc with rcu
  - net: core: netlink: add helper refcount dec and lock function
  - xen/netfront: react properly to failing gnttab_end_foreign_access_ref()
  - xen/gnttab: fix gnttab_end_foreign_access() without page specified
  - xen/pvcalls: use alloc/free_pages_exact()
  - xen/9p: use alloc/free_pages_exact()
  - xen: remove gnttab_query_foreign_access()
  - xen/gntalloc: don't use gnttab_query_foreign_access()
  - xen/scsifront: don't use gnttab_query_foreign_access() for mapped status
  - xen/netfront: don't use gnttab_query_foreign_access() for mapped status
  - xen/blkfront: don't use gnttab_query_foreign_access() for mapped status
  - xen/grant-table: add gnttab_try_end_foreign_access()
  - xen/xenbus: don't let xenbus_grant_ring() remove grants in error case
  - xen/xenbus: Fix granting of vmalloc'd memory
  - binder: fix test regression due to sender_euid change
  - binder: use cred instead of task for selinux checks
  - binder: use euid from cred instead of using task
  - svm: Change svm to modules
  - svm: Delete unused svm_get_unmapped_area ops
  - ascend: mm: Add MAP_ALIGN flag to map aligned va
  - svm: Delete unused function sysrq_sched_debug_show_export
  - svm: Delete get meminfo interface in svm ioctl
  - svm: Export symbols for svm module
  - can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
  - mm: Add space after ReliableFileCache
  - mm: Drop reliable_reserve_size
  - mm: page_counter: mitigate consequences of a page_counter underflow
  - drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
  - hamradio: remove needs_free_netdev to avoid UAF
  - hamradio: defer 6pack kfree after unregister_netdev
  - ovl: fix uninitialized pointer read in ovl_lookup_real_one()
  - ovl: fix IOCB_DIRECT if underlying fs doesn't support direct IO
  - ovl: fix lseek overflow on 32bit
  - ovl: sync dirty data when remounting to ro mode


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2204.4.0.0147
changelog:
  - Revert "perf: Paper over the hw.target problems"
  - ax25: Fix NULL pointer dereferences in ax25 timers
  - ax25: fix NPD bug in ax25_disconnect
  - ax25: Fix NULL pointer dereference in ax25_kill_by_device
  - ax25: improve the incomplete fix to avoid UAF and NPD bugs
  - ax25: NPD bug when detaching AX25 device
  - objtool: Fix stack offset tracking for indirect CFAs
  - x86/entry/64: Fix unwind hints in kernel exit path
  - af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
  - arm64: Use the clearbhb instruction in mitigations
  - arm64: add ID_AA64ISAR2_EL1 sys register
  - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated
  - arm64: Mitigate spectre style branch history side channels
  - KVM: arm64: Add templates for BHB mitigation sequences
  - arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2
  - arm64: Add percpu vectors for EL1
  - arm64: entry: Add macro for reading symbol addresses from the trampoline
  - arm64: entry: Add vectors that have the bhb mitigation sequences
  - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations
  - arm64: entry: Allow the trampoline text to occupy multiple pages
  - arm64: entry: Make the kpti trampoline's kpti sequence optional
  - arm64: entry: Move trampoline macros out of ifdef'd section
  - arm64: entry: Don't assume tramp_vectors is the start of the vectors
  - arm64: entry: Allow tramp_alias to access symbols after the 4K boundary
  - arm64: entry: Move the trampoline data page before the text page
  - arm64: entry: Free up another register on kpti's tramp_exit path
  - arm64: entry: Make the trampoline cleanup optional
  - arm64: entry.S: Add ventry overflow sanity checks
  - x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
  - x86/speculation: Warn about Spectre v2 LFENCE mitigation
  - x86/speculation: Update link to AMD speculation whitepaper
  - x86/speculation: Use generic retpoline by default on AMD
  - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
  - Documentation/hw-vuln: Update spectre doc
  - x86/speculation: Add eIBRS + Retpoline options
  - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE
  - x86,bugs: Unconditionally allow spectre_v2=retpoline,amd
  - x86/speculation: Merge one test in spectre_v2_user_select_mitigation()
  - mm/memory.c: fix clear_gigantic_page_chunk


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.1.0.0148
changelog:
  - hamradio: improve the incomplete fix to avoid NPD
  - hamradio: defer ax25 kfree after unregister_netdev
  - can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path
  - llc: only change llc->dev when bind() succeeds
  - netdevice: add the case if dev is NULL
  - llc: fix netdevice reference leaks in llc_ui_bind()
  - ARM: fix Thumb2 regression with Spectre BHB
  - ARM: Spectre-BHB: provide empty stub for non-config
  - ARM: fix build warning in proc-v7-bugs.c
  - ARM: Do not use NOCROSSREFS directive with ld.lld
  - ARM: fix co-processor register typo
  - ARM: fix build error when BPF_SYSCALL is disabled
  - ARM: include unprivileged BPF status in Spectre V2 reporting
  - ARM: Spectre-BHB workaround
  - ARM: use LOADADDR() to get load address of sections
  - ARM: early traps initialisation
  - ARM: report Spectre v2 status through sysfs
  - can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.3.0.0149
changelog:
  - ixgbevf: add disable link state
  - ixgbe: add improvement for MDD response functionality
  - ixgbe: add the ability for the PF to disable VF link state
  - io_uring: fix false WARN_ONCE
  - mm/sharepool: Fix sharepool node id invalid when using sp_alloc
  - sharepool: fix hisi oom deadlock
  - share_pool: Fix ABBA deadlock
  - net: ipv6: fix skb_over_panic in __ip6_append_data
  - net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit()
  - net/packet: fix slab-out-of-bounds access in packet_recvmsg()
  - mm: fix dereference a null pointer in migrate[_huge]_page_move_mapping()
  - cpuset: Fix unsafe lock order between cpuset lock and cpuslock
  - tcp: make tcp_read_sock() more robust
  - xfrm: Fix xfrm migrate issues when address family changes
  - Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0"
  - ext4: add check to prevent attempting to resize an fs with sparse_super2
  - net-sysfs: add check for netdevice being present to speed_show
  - memfd: fix F_SEAL_WRITE after shmem huge page allocated
  - PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
  - netfilter: nf_queue: fix possible use-after-free
  - netfilter: nf_queue: don't assume sk is full socket
  - xfrm: enforce validity of offload input flags
  - xfrm: fix the if_id check in changelink
  - netfilter: fix use-after-free in __nf_register_net_hook()
  - xfrm: fix MTU regression
  - cifs: fix double free race when mount fails in cifs_get_root()
  - mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status
  - x86/asm: Move native_write_cr0/4() out of line
  - x86/asm: Pin sensitive CR0 bits
  - x86/asm: Pin sensitive CR4 bits
  - mm: Add more debug info if oom occurs
  - mm: Fix reliable task used problem shown in meminfo
  - mm: Show correct reliable pagecache size


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.4.0.0150
changelog:
  - scsi: hisi_sas: Change hisi_sas_control_phy() phyup timeout
  - scsi: hisi_sas: Fix SAS disk sense info print incorrectly sometimes
  - scsi: hisi_sas: Don't fail IT nexus reset for Open Reject timeout
  - mm/share_pool: Support read-only memory allocation
  - mm: clear_freelist_page: Provide timeout mechanism for worker runtime
  - io_uring: fix race between timeout flush and removal
  - ax25: fix UAF bug in ax25_send_control()
  - ax25: Fix refcount leaks caused by ax25_cb_del()
  - ax25: fix UAF bugs of net_device caused by rebinding operation
  - ax25: fix reference count leaks of ax25_dev
  - ax25: add refcount in ax25_dev to avoid UAF bugs
  - ext4: fix bug_on in start_this_handle during umount filesystem
  - ext4: unregister sysfs path before destroying jbd2 journal
  - ext4: fix use-after-free in ext4_search_dir
  - mm: Update reliable flag in memory allocaion for reliable task only in task context
  - mm: refactor the reclaim thread of page cache from per-cpu to per-node


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.5.0.0151
changelog:
  - sched/qos: Add qos_tg_{throttle,unthrottle}_{up,down}
  - sched: Throttle offline task at tracehook_notify_resume()
  - sched: enable CONFIG_QOS_SCHED on arm64
  - sched/qos: Remove dependency CONFIG_x86
  - net/sched: cls_u32: fix netns refcount changes in u32_change()
  - mm: hwpoison: enable memory error handling on 1GB hugepage optionaly
  - mm: fix gup_pud_range
  - nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs
  - ext4: fix warning when submitting superblock in ext4_commit_super()
  - ext4: fix bug_on in __es_tree_search
  - secure_seq: use the 64 bits of the siphash for port offset calculation
  - floppy: use a statically allocated error counter
  - mmc: block: fix read single on recovery logic
  - SUNRPC: Ensure that the gssproxy client can start in a connected state
  - Revert "SUNRPC: attempt AF_LOCAL connect on setup"
  - ax25: Fix UAF bugs in ax25 timers
  - ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
  - drm/vgem: Close use-after-free race in vgem_gem_create
  - mm/memory.c: update the first page in clear_gigantic_page_chunk


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.6.0.0152
changelog:
  - net: hns3: update hns3 version to 22.5.1
  - net: hns3: fix vf link setting failed when no vf driver loaded
  - arm64: Add memmap reserve range check to avoid conflict
  - ext4: fix bug_on in ext4_writepages
  - ext4: fix warning in ext4_handle_inode_extension
  - ext4: fix use-after-free in ext4_rename_dir_prepare
  - uce: coredump scenario support kernel recovery
  - NULL pointer dereference on rmmod iptable_mangle.


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2206.1.0.0153
changelog:
  - ping: fix address binding wrt vrf
  - tcp: resalt the secret every 10 seconds
  - netlink: do not reset transport header in netlink_recvmsg()
  - ipv4: drop dst in multicast routing path
  - net: Fix features skip in for_each_netdev_feature()
  - VFS: Fix memory leak caused by concurrently mounting fs with subtype
  - mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic()
  - mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
  - dm: interlock pending dm_io and dm_wait_for_bios_completion
  - dm: fix mempool NULL pointer race when completing IO
  - tcp: make sure treq->af_specific is initialized
  - net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
  - x86: __memcpy_flushcache: fix wrong alignment if size > 2^32
  - tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
  - ip_gre: Make o_seqno start from 0 in native mode
  - tcp: md5: incorrect tcp_header_len for incoming connections
  - mtd: rawnand: Fix return value check of wait_for_completion_timeout
  - mtd: rawnand: fix ecc parameters for mt7622
  - hex2bin: fix access beyond string end
  - serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
  - serial: 8250: Also set sticky MCR bits in console restoration
  - ext4: force overhead calculation if the s_overhead_cluster makes no sense
  - ext4: fix overhead calculation to account for the reserved gdt blocks
  - ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
  - arm_pmu: Validate single/group leader events
  - netlink: reset network and mac headers in netlink_dump()
  - net/packet: fix packet_sock xmit return value checking
  - mm: page_alloc: fix building error on -Werror=array-compare
  - etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
  - smp: Fix offline cpu check in flush_smp_call_function_queue()
  - ipv6: fix panic when forwarding a pkt with no in6 dev
  - mm: kmemleak: take a full lowmem check in kmemleak_*_phys()
  - mm, page_alloc: fix build_zonerefs_node()
  - cifs: potential buffer overflow in handling symlinks
  - veth: Ensure eth header is in skb's linear part
  - mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning
  - mm: don't skip swap entry even if zap_details specified
  - irqchip/gic-v3: Fix GICR_CTLR.RWP polling
  - mm/mempolicy: fix mpol_new leak in shared_policy_replace
  - mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
  - mm: fix race between MADV_FREE reclaim and blkdev direct IO read
  - NFS: swap-out must always use STABLE writes.
  - NFS: swap IO handling is slightly different for O_DIRECT IO
  - SUNRPC/call_alloc: async tasks mustn't block waiting for memory
  - NFSv4: Protect the state recovery thread against direct reclaim
  - macvtap: advertise link netns via netlink
  - dm ioctl: prevent potential spectre v1 gadget
  - ipv4: Invalidate neighbour for broadcast address upon address addition
  - mm/memcontrol: return 1 from cgroup.memory __setup() handler
  - ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
  - ext4: don't BUG if someone dirty pages without asking ext4 first
  - PM: core: keep irq flags in device_pm_check_callbacks()
  - ACPI/APEI: Limit printable size of BERT table data
  - ACPICA: Avoid walking the ACPI Namespace if it is not there
  - netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
  - NFS: remove unneeded check in decode_devicenotify_args()
  - serial: 8250: Fix race condition in RTS-after-send handling
  - serial: 8250_mid: Balance reference count for PCI DMA device
  - tcp: ensure PMTU updates are processed during fastopen
  - af_netlink: Fix shift out of bounds in group mask calculation
  - mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
  - mtd: onenand: Check for error irq
  - printk: fix return value of printk.devkmsg __setup handler
  - perf/core: Fix address filter parser for multiple filters
  - ACPI: APEI: fix return value of __setup handlers
  - crypto: authenc - Fix sleep in atomic context in decrypt_tail
  - PCI: pciehp: Clear cmd_busy bit in polling mode
  - ACPI: properties: Consistently return -ENOENT if there are no more references
  - mm,hwpoison: unmap poisoned page before invalidation
  - scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
  - mempolicy: mbind_range() set_policy() after vma_merge()
  - mm: invalidate hwpoison page cache page in fault path
  - mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
  - NFSD: prevent integer overflow on 32 bit systems
  - SUNRPC: avoid race between mod_timer() and del_timer_sync()
  - xfrm: fix tunnel model fragmentation behavior
  - sched/fair: Fix enqueue_task_fair() warning some more
  - sched/fair: Fix enqueue_task_fair warning
  - floppy: disable FDRAWCMD by default
  - perf: Fix sys_perf_event_open() race against self
  - KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2206.2.0.0154
changelog:
  - x86: Pin task-stack in __get_wchan()
  - x86: Fix __get_wchan() for !STACKTRACE
  - x86/unwind/orc: Fix premature unwind stoppage due to IRET frames
  - x86/unwind: Prevent false warnings for non-current tasks
  - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
  - ALSA: pcm: Fix races among concurrent prealloc proc writes
  - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
  - ALSA: pcm: Fix races among concurrent read/write and buffer changes
  - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
  - NFC: netlink: fix sleep in atomic bug when firmware download timeout
  - nfc: replace improper check device_is_registered() in netlink related functions
  - ext4: fix super block checksum incorrect after mount
  - block: remove the bd_openers checks in blk_drop_partitions
  - block: fix busy device checking in blk_drop_partitions again
  - block: fix busy device checking in blk_drop_partitions
  - ext4: add reserved GDT blocks check


author: yezengruan <yezengruan@huawei.com>
changelog:
  - hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582)
  - pvrdma: Ensure correct input on ring init (CVE-2021-3607)
  - pvrdma: Fix the ring init error flow (CVE-2021-3608)


author: yezengruan <yezengruan@huawei.com>
changelog:
  - vhost-vsock: detach the virqueue element in case of error (CVE-2022-26354)
  - virtio-net: fix map leaking on error during receive (CVE-2022-26353)


author: yezengruan <yezengruan@huawei.com>
changelog:
  - hw/block/fdc: Extract blk_create_empty_drive()
  - hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196
  - tests/fdc-test: Add a regression test for CVE-2021-20196
  - display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207)
  - ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)


author: yezengruan <yezengruan@huawei.com>
changelog:
  - hw/intc/arm_gicv3_dist: Rename 64-bit accessors with 'q' suffix
  - hw/intc/arm_gicv3: Replace mis-used MEMTX_* constants by booleans
  - hw/intc/arm_gicv3: Check for !MEMTX_OK instead of MEMTX_ERROR (CVE-2021-3750)
  - net/colo-compare.c: Check that colo-compare is active


author: sundongxu <sundongxu3@huawei.com>
changelog:
  - e1000: fail early for evil descriptor
  - e1000: fix tx re-entrancy problem
  - hw/sd/sdcard: Do not allow invalid SD card sizes
  - hw/sd/sdcard: Do not switch to ReceivingData if address is invalid
  - hw/sd/sdcard: Restrict Class 6 commands to SCSD cards
  - hw/sd/sdcard: Simplify realize() a bit
  - hw/sd/sdcard: Update coding style to make checkpatch.pl happy
  - scsi/qemu-pr-helper: Fix out-of-bounds access to trnptid_list[]
  - curses: Fixes curses compiling errors.
  - net/dump.c: Suppress spurious compiler warning
  - tests: Replace deprecated ASN1 code


author: shixuantong <shixuantong@h-partners.com> - 2:8.2-27
changelog:
  - Type:CVE
  - ID:CVE-2022-1629 CVE-2022-1620 CVE-2022-1674 CVE-2022-1621 CVE-2022-1619
  - SUG:NA
  - DESC:fix CVE-2022-1629 CVE-2022-1620 CVE-2022-1674 CVE-2022-1621 CVE-2022-1619


