# changelog

author: maminjie <maminjie1@huawei.com> - 1.3.30-8
changelog:
  - fix some CVEs: CVE-2018-18544 CVE-2019-7397 CVE-2019-11005 CVE-2019-11006
    CVE-2019-11010 CVE-2019-12921 CVE-2020-10938 CVE-2020-12672


author: zhanghua <zhanghua40@huawei.com> - 2.2.0-18
changelog:
  - Type:CVE
  - ID:NA
  - SUG:NA
  - DESC:fix CVE-2017-9110 CVE-2017-9111 CVE-2017-9112 CVE-2017-9113
    CVE-2017-9114 CVE-2017-9115 CVE-2017-9116 CVE-2017-12596


author: wangyue <wangyue92@huawei.com> - 2.2.0-19
changelog:
  - fix CVE-2021-3474 CVE-2021-3477 CVE-2021-3476 CVE-2021-3475 CVE-2021-20296 CVE-2021-3479 CVE-2021-20296


author: yaoxin <yaoxin30@huawei.com> - 2.2.0-22
changelog:
  - fix CVE-2020-11758 CVE-2020-11759 CVE-2020-11760 CVE-2020-11761 CVE-2020-11762 CVE-2020-11763 CVE-2020-11764 CVE-2020-11765 CVE-2020-15305 CVE-2020-15306


author: panxiaohe <panxiaohe@huawei.com> - 3.6.4-2
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:use make macros to run check in parallel;
         fix a concurrent build issue in examples


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.4.0.0150
changelog:
  - scsi: hisi_sas: Change hisi_sas_control_phy() phyup timeout
  - scsi: hisi_sas: Fix SAS disk sense info print incorrectly sometimes
  - scsi: hisi_sas: Don't fail IT nexus reset for Open Reject timeout
  - mm/share_pool: Support read-only memory allocation
  - mm: clear_freelist_page: Provide timeout mechanism for worker runtime
  - io_uring: fix race between timeout flush and removal
  - ax25: fix UAF bug in ax25_send_control()
  - ax25: Fix refcount leaks caused by ax25_cb_del()
  - ax25: fix UAF bugs of net_device caused by rebinding operation
  - ax25: fix reference count leaks of ax25_dev
  - ax25: add refcount in ax25_dev to avoid UAF bugs
  - ext4: fix bug_on in start_this_handle during umount filesystem
  - ext4: unregister sysfs path before destroying jbd2 journal
  - ext4: fix use-after-free in ext4_search_dir
  - mm: Update reliable flag in memory allocaion for reliable task only in task context
  - mm: refactor the reclaim thread of page cache from per-cpu to per-node


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.5.0.0151
changelog:
  - sched/qos: Add qos_tg_{throttle,unthrottle}_{up,down}
  - sched: Throttle offline task at tracehook_notify_resume()
  - sched: enable CONFIG_QOS_SCHED on arm64
  - sched/qos: Remove dependency CONFIG_x86
  - net/sched: cls_u32: fix netns refcount changes in u32_change()
  - mm: hwpoison: enable memory error handling on 1GB hugepage optionaly
  - mm: fix gup_pud_range
  - nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs
  - ext4: fix warning when submitting superblock in ext4_commit_super()
  - ext4: fix bug_on in __es_tree_search
  - secure_seq: use the 64 bits of the siphash for port offset calculation
  - floppy: use a statically allocated error counter
  - mmc: block: fix read single on recovery logic
  - SUNRPC: Ensure that the gssproxy client can start in a connected state
  - Revert "SUNRPC: attempt AF_LOCAL connect on setup"
  - ax25: Fix UAF bugs in ax25 timers
  - ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
  - drm/vgem: Close use-after-free race in vgem_gem_create
  - mm/memory.c: update the first page in clear_gigantic_page_chunk


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2205.6.0.0152
changelog:
  - net: hns3: update hns3 version to 22.5.1
  - net: hns3: fix vf link setting failed when no vf driver loaded
  - arm64: Add memmap reserve range check to avoid conflict
  - ext4: fix bug_on in ext4_writepages
  - ext4: fix warning in ext4_handle_inode_extension
  - ext4: fix use-after-free in ext4_rename_dir_prepare
  - uce: coredump scenario support kernel recovery
  - NULL pointer dereference on rmmod iptable_mangle.


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2206.1.0.0153
changelog:
  - ping: fix address binding wrt vrf
  - tcp: resalt the secret every 10 seconds
  - netlink: do not reset transport header in netlink_recvmsg()
  - ipv4: drop dst in multicast routing path
  - net: Fix features skip in for_each_netdev_feature()
  - VFS: Fix memory leak caused by concurrently mounting fs with subtype
  - mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic()
  - mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
  - dm: interlock pending dm_io and dm_wait_for_bios_completion
  - dm: fix mempool NULL pointer race when completing IO
  - tcp: make sure treq->af_specific is initialized
  - net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
  - x86: __memcpy_flushcache: fix wrong alignment if size > 2^32
  - tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
  - ip_gre: Make o_seqno start from 0 in native mode
  - tcp: md5: incorrect tcp_header_len for incoming connections
  - mtd: rawnand: Fix return value check of wait_for_completion_timeout
  - mtd: rawnand: fix ecc parameters for mt7622
  - hex2bin: fix access beyond string end
  - serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
  - serial: 8250: Also set sticky MCR bits in console restoration
  - ext4: force overhead calculation if the s_overhead_cluster makes no sense
  - ext4: fix overhead calculation to account for the reserved gdt blocks
  - ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
  - arm_pmu: Validate single/group leader events
  - netlink: reset network and mac headers in netlink_dump()
  - net/packet: fix packet_sock xmit return value checking
  - mm: page_alloc: fix building error on -Werror=array-compare
  - etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
  - smp: Fix offline cpu check in flush_smp_call_function_queue()
  - ipv6: fix panic when forwarding a pkt with no in6 dev
  - mm: kmemleak: take a full lowmem check in kmemleak_*_phys()
  - mm, page_alloc: fix build_zonerefs_node()
  - cifs: potential buffer overflow in handling symlinks
  - veth: Ensure eth header is in skb's linear part
  - mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning
  - mm: don't skip swap entry even if zap_details specified
  - irqchip/gic-v3: Fix GICR_CTLR.RWP polling
  - mm/mempolicy: fix mpol_new leak in shared_policy_replace
  - mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
  - mm: fix race between MADV_FREE reclaim and blkdev direct IO read
  - NFS: swap-out must always use STABLE writes.
  - NFS: swap IO handling is slightly different for O_DIRECT IO
  - SUNRPC/call_alloc: async tasks mustn't block waiting for memory
  - NFSv4: Protect the state recovery thread against direct reclaim
  - macvtap: advertise link netns via netlink
  - dm ioctl: prevent potential spectre v1 gadget
  - ipv4: Invalidate neighbour for broadcast address upon address addition
  - mm/memcontrol: return 1 from cgroup.memory __setup() handler
  - ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
  - ext4: don't BUG if someone dirty pages without asking ext4 first
  - PM: core: keep irq flags in device_pm_check_callbacks()
  - ACPI/APEI: Limit printable size of BERT table data
  - ACPICA: Avoid walking the ACPI Namespace if it is not there
  - netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
  - NFS: remove unneeded check in decode_devicenotify_args()
  - serial: 8250: Fix race condition in RTS-after-send handling
  - serial: 8250_mid: Balance reference count for PCI DMA device
  - tcp: ensure PMTU updates are processed during fastopen
  - af_netlink: Fix shift out of bounds in group mask calculation
  - mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
  - mtd: onenand: Check for error irq
  - printk: fix return value of printk.devkmsg __setup handler
  - perf/core: Fix address filter parser for multiple filters
  - ACPI: APEI: fix return value of __setup handlers
  - crypto: authenc - Fix sleep in atomic context in decrypt_tail
  - PCI: pciehp: Clear cmd_busy bit in polling mode
  - ACPI: properties: Consistently return -ENOENT if there are no more references
  - mm,hwpoison: unmap poisoned page before invalidation
  - scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
  - mempolicy: mbind_range() set_policy() after vma_merge()
  - mm: invalidate hwpoison page cache page in fault path
  - mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
  - NFSD: prevent integer overflow on 32 bit systems
  - SUNRPC: avoid race between mod_timer() and del_timer_sync()
  - xfrm: fix tunnel model fragmentation behavior
  - sched/fair: Fix enqueue_task_fair() warning some more
  - sched/fair: Fix enqueue_task_fair warning
  - floppy: disable FDRAWCMD by default
  - perf: Fix sys_perf_event_open() race against self
  - KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2206.2.0.0154
changelog:
  - x86: Pin task-stack in __get_wchan()
  - x86: Fix __get_wchan() for !STACKTRACE
  - x86/unwind/orc: Fix premature unwind stoppage due to IRET frames
  - x86/unwind: Prevent false warnings for non-current tasks
  - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
  - ALSA: pcm: Fix races among concurrent prealloc proc writes
  - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
  - ALSA: pcm: Fix races among concurrent read/write and buffer changes
  - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
  - NFC: netlink: fix sleep in atomic bug when firmware download timeout
  - nfc: replace improper check device_is_registered() in netlink related functions
  - ext4: fix super block checksum incorrect after mount
  - block: remove the bd_openers checks in blk_drop_partitions
  - block: fix busy device checking in blk_drop_partitions again
  - block: fix busy device checking in blk_drop_partitions
  - ext4: add reserved GDT blocks check


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2206.3.0.0155
changelog:
  - arm64: fix out-of-range error when adapting for ARM64_SPECTRE_BHB
  - xfs: replace -EIO with -EFSCORRUPTED for corrupt metadata
  - xfs: namecheck directory entry names before listing them
  - xfs: namecheck attribute names before listing them
  - xfs: check attribute leaf block structure
  - xfs: check attribute name validity
  - xfs: check directory name validity
  - xfs: scrub should flag dir/attr offsets that aren't mappable with xfs_dablk_t
  - xfs: abort xattr scrub if fatal signals are pending
  - tcp: increase source port perturb table to 2^16
  - tcp: change source port randomizarion at connect() time
  - arm64: fix extra cpucaps setup problem
  - Revert "sched: Fix sched_fork() access an invalid sched_task_group"
  - Revert "sched: Fix yet more sched_fork() races"
  - powerpc/32: Fix overread/overwrite of thread_struct via ptrace
  - sctp: use call_rcu to free endpoint
  - ext4: convert from atomic_t to refcount_t on ext4_io_end->count
  - ext4: correct the judgment of BUG in ext4_mb_normalize_request
  - ext4: fix bug_on ext4_mb_use_inode_pa
  - HID: holtek: fix mouse probing
  - HID: check for valid USB device for many HID drivers
  - HID: wacom: fix problems when device is not a valid USB device
  - HID: add USB_HID dependancy on some USB HID drivers
  - HID: add USB_HID dependancy to hid-chicony
  - HID: add USB_HID dependancy to hid-prodikeys
  - HID: add hid_is_usb() function to make it simpler for USB detection
  - netfilter: nf_tables: disallow non-stateful expression in sets earlier
  - NFSv4: fix open failure with O_ACCMODE flag
  - Revert "NFSv4: Handle the special Linux file open access mode"


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2206.4.0.0156
changelog:
  - mm/memcontrol: fix wrong vmstats for dying memcg
  - ext4: recover csum seed of tmp_inode after migrating to extents
  - xfs: show the proper user quota options
  - drivers core: node: Use a more typical macro definition style for ACCESS_ATTR
  - drivers core: Use sysfs_emit for shared_cpu_map_show and shared_cpu_list_show
  - mm: and drivers core: Convert hugetlb_report_node_meminfo to sysfs_emit
  - drivers core: Miscellaneous changes for sysfs_emit
  - drivers core: Remove strcat uses around sysfs_emit and neaten
  - drivers core: Use sysfs_emit and sysfs_emit_at for show(device *...) functions


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2207.1.0.0157
changelog:
  - ext4: correct the misjudgment in ext4_iget_extra_inode
  - ext4: correct max_inline_xattr_value_size computing
  - ext4: fix use-after-free in ext4_xattr_set_entry
  - ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
  - tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing
  - swiotlb: skip swiotlb_bounce when orig_addr is zero
  - KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated
  - mm/sharepool: Fix using uninitialized sp_flag
  - mm/sharepool: Add a task_struct parameter for sp_get_local_group()
  - mm/sharepool: Don't check the DVPP address space range before merging
  - mm/sharepool: Configure the DVPP range for process
  - mm/sharepool: Introduce SPG_NON_DVPP flag for sp_group_add_task
  - mm/sharepool: Update sp_mapping structure
  - mm/sharepool: Clear the initialization of sp-associated structure for a process
  - mm/sharepool: Unify the memory allocation process
  - mm/sharepool: Use vm_private_data to store the spa
  - mm/sharepool: Share pool statistics adaption
  - mm/sharepool: Release the sp addr based on the id
  - mm/sharepool: Add an interface to obtain an id
  - mm/sharepool: Address space management for sp_group
  - mm/sharepool: Create global normal and dvpp mapping
  - mm/sharepool: Delete single-group mode
  - io_uring: io_close: Set owner as current->files if req->work.files uninitialized


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2207.2.0.0158
changelog:
  - x86: Fix return value of __setup handlers
  - x86/delay: Fix the wrong asm constraint in delay_loop()
  - ACPI: sysfs: Fix BERT error region memory mapping
  - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd
  - nbd: fix io hung while disconnecting device
  - nbd: fix race between nbd_alloc_config() and module removal
  - nbd: call genl_unregister_family() first in nbd_cleanup()
  - ip_gre: test csum_start instead of transport header
  - net: xfrm: unexport __init-annotated xfrm4_protocol_init()
  - SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()
  - af_unix: Fix a data-race in unix_dgram_peer_wake_me().
  - NFSv4: Don't hold the layoutget locks across multiple RPC calls
  - tcp: tcp_rtx_synack() can be called from process context
  - serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485
  - md: fix an incorrect NULL check in md_reload_sb
  - md: fix an incorrect NULL check in does_sb_need_changing
  - ext4: avoid cycles in directory h-tree
  - ext4: verify dir block before splitting it
  - proc: fix dentry/inode overinstantiating under /proc/${pid}/net
  - drivers/base/node.c: fix compaction sysfs file leak
  - fsnotify: fix wrong lockdep annotations
  - PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
  - fat: add ratelimit to fat*_ent_bread()
  - nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags
  - bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes
  - dm stats: add cond_resched when looping over entries
  - zsmalloc: fix races between asynchronous zspage free and page migration
  - netfilter: conntrack: re-fetch conntrack after insertion
  - assoc_array: Fix BUG_ON during garbage collect
  - net: af_key: check encryption module availability consistency
  - x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests
  - net: bridge: Clear offload_fwd_mark when passing frame up bridge interface.
  - ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2
  - ARM: 9196/1: spectre-bhb: enable for Cortex-A15
  - block:Fix kabi broken
  - block: Fix warning in bd_link_disk_holder()
  - block: move the NEED_PART_SCAN flag to struct gendisk
  - block: rename bd_invalidated
  - scsi: hisi_sas: Modify v3 HW I/O processing when SATA_DISK_ERR bit is set and NCQ Error occurs
  - scsi: hisi_sas: enable use_clustering
  - scsi: hisi_sas: Change DMA setup lock timeout to 2.5s
  - x86/speculation/mmio: Print SMT warning
  - KVM: x86/speculation: Disable Fill buffer clear within guests
  - x86/speculation/mmio: Reuse SRBDS mitigation for SBDS
  - x86/speculation/srbds: Update SRBDS mitigation selection
  - x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data
  - x86/speculation/mmio: Enable CPU Fill buffer clearing on idle
  - x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations
  - x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data
  - x86/speculation: Add a common function for MD_CLEAR mitigation update
  - x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug
  - Documentation: Add documentation for Processor MMIO Stale Data
  - x86/cpu: Add another Alder Lake CPU to the Intel family
  - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family
  - x86/cpu: Add Jasper Lake to Intel family
  - cpu/speculation: Add prototype for cpu_show_srbds()
  - x86/cpu: Add Elkhart Lake to Intel family
  - block: open accurate iostat account by default
  - block: use "precise_iostat" to switch accurate iostat account
  - block/diskstats: more accurate approximation of io_ticks for slow disks
  - fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2207.3.0.0159
changelog:
  - block: fix that part scan is disabled in device_add_disk()
  - Revert "block: rename bd_invalidated"
  - Revert "block: move the NEED_PART_SCAN flag to struct gendisk"
  - Revert "block:Fix kabi broken"
  - rcu/tree: Mark functions as notrace
  - netfilter: nf_tables: stricter validation of element data
  - net: rose: fix UAF bugs caused by timer handler
  - xen/arm: Fix race in RB-tree based P2M accounting
  - vt: drop old FONT ioctls
  - dm thin: Fix crash in dm_sm_register_threshold_callback()
  - xen/blkfront: force data bouncing when backend is untrusted
  - xen/netfront: force data bouncing when backend is untrusted
  - xen-netfront: fix potential deadlock in xennet_remove()
  - xen/netfront: fix leaking data in shared pages
  - xen/blkfront: fix leaking data in shared pages
  - xen/blkfront: fix memory allocation flags in blkfront_setup_indirect()
  - tmpfs: fix the issue that the mount and remount results are inconsistent.
  - tmpfs: fix undefined-behaviour in shmem_reconfigure()
  - mm/sharepool: Check sp_is_enabled() before show spa_stat


author: liulong <liulong20@huawei.com> - 2.82-4
changelog:
  - Type:CVE
  - Id:NA
  - SUG:NA
  - DESC:fix CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25684 CVE-2020-25685 CVE-2020-25686 
  CVE-2020-25687


author: zengwefeng <zwfeng@huawei.com> - 2.82-6
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Add missing check for NULL return from allocate_rfd
         Fix DNS reply when asking for DNSSEC and a validated


author: gaihuiying <gaihuiying1@huawei.com> - 2.82-8
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC: Handle caching with EDNS options better
          Fix to 75e2f0aec33e58ef5b8d4d107d821c215a52827c
          Fix for 12af2b171de0d678d98583e2190789e544440e02
          Fix problem with DNS retries in 2.83 2.84 version
          Simplify preceding fix
          Update to new struct frec fields in conntrack code
          Use the values of min port and max port in TCP connection
          Correct occasional bind dynamic synchronization
          Move fd into frec_src fixes 15b60ddf935a531269bb8c68
          fix CVE-2021-3448


author: yangzhuangzhuang <yangzhuangzhuang1@huawei.com> - 2.27.0-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Resolved the problem that a failure message is displayed when the git-daemon package is uninstalled


author: panxiaohe <panxiaohe@huawei.com> - 2.27.0-4
changelog:
  - Fix CVE-2021-29468
  - Add gcc and gettext to BuildRequires
    - necessary for building and msgfmt command


author: shixuantong <shixuantong@h-partners.com> - 2:8.2-42
changelog:
  - Type:CVE
  - ID:CVE-2022-2000 CVE-2022-2042 CVE-2022-2284 CVE-2022-2285 CVE-2022-2304 CVE-2022-2344 CVE-2022-2345
  - SUG:NA
  - DESC:fix CVE-2022-2000 CVE-2022-2042 CVE-2022-2284 CVE-2022-2285 CVE-2022-2304 CVE-2022-2344 CVE-2022-2345


author: shixuantong <shixuantong@h-partners.com> - 2:8.2-43
changelog:
  - Type:CVE
  - ID:CVE-2022-2264 CVE-2022-2257 CVE-2022-2286 CVE-2022-2287
  - SUG:NA
  - DESC:fix CVE-2022-2264 CVE-2022-2257 CVE-2022-2286 CVE-2022-2287


