# changelog

author: huangyu <huangyu106@huawei.com> - 32:9.11.21-14
changelog:
  - Type:CVE
  - ID:CVE-2022-2906 CVE-2022-38177 CVE-2022-38178 CVE-2022-2795 CVE-2022-2881
  - SUG:NA
  - DESC:FIX CVE-2022-2906CVE-2022-38177CVE-2022-38178CVE-2022-2795CVE-2022-2881


author: renmingshuai <renmingshuai@huawei.com> - 12:4.4.2-8
changelog:
  - Type:cves
  - ID:CVE-2021-25214, CVE-2021-25215, CVE-2021-25219, CVE-2021-25220
  - SUG:restart
  - DESC: Fix CVE-2021-25214 CVE-2021-25215 CVE-2021-25219 CVE-2021-25220


author: gaihuiying <eaglegai@163.com> - 1.31.0-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix adjust to abseil-cpp 20210324,since it dont provides absl_dynamic_annotations library anymore


author: zhangxiaoyu <zhangxiaoyu58@huawei.com> - 2.0.16-4
changelog:
  - Type: enhancement
  - ID: NA
  - SUG: NA
  - DESC: invalid free default-runtime and cri-runtime after free json-confs


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2208.2.0.0162
changelog:
  - netfilter: nf_queue: do not allow packet truncation below transport header offset
  - openvswitch: fix OOB access in reserve_sfa_size()
  - dm thin: use refcount_t for thin_c reference counting
  - exec: Force single empty string when argv is empty
  - usb: gadget: rndis: prevent integer overflow in rndis_set_response()
  - serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle
  - serial: 8250: fix return error code in serial8250_request_std_resource()
  - ipv4: Fix data-races around sysctl_ip_dynaddr.
  - icmp: Fix a data-race around sysctl_icmp_ratemask.
  - icmp: Fix a data-race around sysctl_icmp_ratelimit.
  - icmp: Fix data-races around sysctl.
  - net: Fix data-races around sysctl_mem.
  - inetpeer: Fix data-races around sysctl.
  - usbnet: fix memory leak in error case
  - esp: limit skb_page_frag_refill use to a single page
  - net: tun: avoid disabling NAPI twice
  - net: bonding: fix use-after-free after 802.3ad slave unbind
  - net: bonding: fix possible NULL deref in rlb code
  - usbnet: fix memory allocation in helpers
  - net: tun: stop NAPI when detaching queues
  - net: tun: unlink NAPI from device on destruction
  - virtio-net: fix race between ndo_open() and virtio_device_ready()
  - SUNRPC: Fix READ_PLUS crasher
  - virtio_net: fix xdp_rxq_info bug after suspend/resume
  - erspan: do not assume transport header is always set
  - net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms
  - bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
  - ext4: make variable "count" signed
  - serial: 8250: Store to lsr_save_flags after lsr read
  - irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions
  - irqchip/gic/realview: Fix refcount leak in realview_gic_of_init
  - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
  - ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr
  - io_uring: add missing item types for various requests
  - net/sched: cls_u32: fix possible leak in u32_init_knode()
  - fq_codel: reject silly quantum parameters
  - net: sched: sch_teql: fix null-pointer dereference
  - rcu: Set a maximum limit for back-to-back callback invocation
  - mm: Fix page counter mismatch in shmem_mfill_atomic_pte
  - scsi: mpt3sas: Fix unlock imbalance
  - io-wq: Switch io_wqe_worker's fs before releasing request
  - ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
  - Revert "iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()"


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2208.4.0.0163
changelog:
  - Revert "x86/unwind/orc: Change REG_SP_INDIRECT"
  - Phytium/S2500: kdump: Avoid vmcore saving failure across multi-socket
  - PCI: Add config control for phytium ACS quirks
  - scsi: libiscsi: Teardown iscsi_cls_conn gracefully
  - scsi: libiscsi: Add iscsi_cls_conn to sysfs after initialization
  - scsi: iscsi: Add helper functions to manage iscsi_cls_conn
  - media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls
  - sched: Fix null-ptr-deref in free_fair_sched_group
  - RDMA/ib_srp: Fix a deadlock
  - mm/slub: add missing TID updates on slab deactivation
  - block: fix regression for dm
  - blk-mq: handle bio after queue is initialized
  - x86: Clear .brk area at early boot
  - signal/seccomp: Dump core when there is only one live thread
  - x86/unwind/orc: Recheck address range after stack info was updated
  - x86/unwind/orc: Silence warnings caused by missing ORC data
  - x86/unwind/orc: Change REG_SP_INDIRECT


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2208.5.0.0164
changelog:
  - x86/speculation: Add LFENCE to RSB fill sequence
  - x86/speculation: Add RSB VM Exit protections
  - Revert "blk-mq: fix null pointer dereference in blk_mq_queue_tag_busy_ite"
  - blk-mq: fix null pointer dereference in blk_mq_queue_tag_busy_ite
  - arm64: Avoid premature usercopy failure for __arch_copy_to_user_generic_read
  - net_sched: cls_route: remove from list when handle is 0


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2208.6.0.0165
changelog:
  - tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
  - tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
  - tty: drop tty_schedule_flip()
  - tty: the rest, stop using tty_schedule_flip()
  - tty: drivers/tty/, stop using tty_schedule_flip()
  - can: bcm/raw/isotp: use per module netdevice notifier
  - CIFS: Fix retry mid list corruption on reconnects
  - KVM: arm64: vgic-its: Change default outer cacheability for {PEND, PROP}BASER
  - xhci: Fix a logic issue when display Zhaoxin XHCI root hub speed
  - dm verity: set DM_TARGET_IMMUTABLE feature flag
  - scsi: hisi_sas: Add SATA_DISK_ERR bit handling for v3 hw
  - Revert "scsi: hisi_sas: Modify v3 HW I/O processing when SATA_DISK_ERR bit is set and NCQ Error occurs"
  - netfilter: nf_tables: do not allow RULE_ID to refer to another chain
  - netfilter: nf_tables: do not allow SET_ID to refer to another table


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2209.1.0.0166
changelog:
  - dm-thin: Resume failed in FAIL mode
  - tpm: fix reference counting for struct tpm_chip
  - af_key: Do not call xfrm_probe_algs in parallel
  - net: usb: ax88179_178a: Fix packet receiving
  - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
  - net: usb: ax88179_178a: fix packet alignment padding


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2209.3.0.0167
changelog:
  - KVM: x86: do not report a vCPU as preempted outside instruction boundaries
  - KVM: arm64: Write arch.mdcr_el2 changes since last vcpu_load on VHE
  - netfilter: nf_conntrack_irc: Tighten matching on DCC message
  - ext4: avoid resizing to a partial cluster size
  - locking/atomic: Make test_and_*_bit() ordered on failure
  - geneve: do not use RT_TOS for IPv6 flowlabel
  - SUNRPC: Reinitialise the backchannel request buffers before reuse
  - NFSv4/pnfs: Fix a use-after-free bug in open
  - NFSv4.1: RECLAIM_COMPLETE must handle EACCES
  - tcp: fix over estimation in sk_forced_mem_schedule()
  - ext4: fix extent status tree race in writeback error recovery path
  - ext4: update s_overhead_clusters in the superblock during an on-line resize
  - ext4: make sure ext4_append() always allocates new block
  - kprobes: Forbid probing on trampoline and BPF code areas
  - kfifo: fix kfifo_to_user() return type
  - profiling: fix shift too large makes kernel panic
  - serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty()
  - mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
  - mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path
  - mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release
  - can: error: specify the values of data[5..7] of CAN error frames
  - fs: check FMODE_LSEEK to control internal pipe splicing
  - tcp: make retransmitted SKB fit into the send window
  - nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt()
  - bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe()
  - x86/pmem: Fix platform-device leak in error path
  - selinux: Add boundary check in put_entry()
  - ACPI: LPSS: Fix missing check in register_device_clock()
  - fs: Add missing umask strip in vfs_tmpfile
  - vfs: Check the truncate maximum size in inode_newsize_ok()
  - tcp: Fix a data-race around sysctl_tcp_comp_sack_nr.
  - tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns.
  - tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit.
  - tcp: Fix a data-race around sysctl_tcp_autocorking.
  - tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen.
  - tcp: Fix a data-race around sysctl_tcp_min_tso_segs.
  - igmp: Fix data-races around sysctl_igmp_qrv.
  - net: ping6: Fix memleak in ipv6_renew_options().
  - tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit.
  - tcp: Fix a data-race around sysctl_tcp_nometrics_save.
  - tcp: Fix a data-race around sysctl_tcp_frto.
  - tcp: Fix a data-race around sysctl_tcp_adv_win_scale.
  - tcp: Fix a data-race around sysctl_tcp_app_win.
  - tcp: Fix data-races around sysctl_tcp_dsack.
  - mm/mempolicy: fix uninit-value in mpol_rebind_policy()
  - tcp: Fix data-races around sysctl_tcp_max_reordering.
  - tcp: Fix a data-race around sysctl_tcp_rfc1337.
  - tcp: Fix a data-race around sysctl_tcp_stdurg.
  - tcp: Fix a data-race around sysctl_tcp_retrans_collapse.
  - tcp: Fix data-races around sysctl_tcp_slow_start_after_idle.
  - tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.
  - tcp: Fix data-races around sysctl_tcp_recovery.
  - tcp: Fix a data-race around sysctl_tcp_early_retrans.
  - tcp: Fix data-races around sysctl_tcp_fastopen.
  - tcp: Fix a data-race around sysctl_tcp_tw_reuse.
  - tcp: Fix a data-race around sysctl_tcp_notsent_lowat.
  - tcp: Fix data-races around some timeout sysctl knobs.
  - tcp: Fix data-races around sysctl_tcp_reordering.
  - igmp: Fix a data-race around sysctl_igmp_max_memberships.
  - igmp: Fix data-races around sysctl_igmp_llm_reports.
  - tcp: Fix a data-race around sysctl_tcp_probe_interval.
  - tcp: Fix a data-race around sysctl_tcp_probe_threshold.
  - tcp: Fix data-races around sysctl_tcp_mtu_probing.
  - tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
  - ip: Fix a data-race around sysctl_fwmark_reflect.
  - ip: Fix data-races around sysctl_ip_nonlocal_bind.
  - ip: Fix data-races around sysctl_ip_fwd_use_pmtu.
  - block: fix the problem of io_ticks becoming smaller
  - blk-mq: Fix memory leak in blk_mq_init_allocated_queue error handling
  - block, bfq: save & resume weight on a queue merge/split
  - ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1
  - acpi/nfit: improve bounds checking for 'func'
  - ACPICA: Do not increment operation_region reference counts for field units
  - ACPICA: Fix exception code class checks
  - ACPI: configfs: add missing check after configfs_register_default_group()
  - ACPI: custom_method: fix potential use-after-free issue
  - ACPI: custom_method: fix a possible memory leak
  - ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  - ACPI/IORT: Fix PMCG node single ID mapping handling
  - ACPI/IORT: Check node revision for PMCG resources
  - kprobes: don't call disarm_kprobe() for disabled kprobes
  - x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry
  - usb: gadget: function: printer: fix use-after-free in __lock_acquire
  - video: fbdev: i740fb: Error out if 'pixclock' equals zero
  - lightnvm: disable the subsystem
  - configfs: fix a race in configfs_lookup()
  - configfs: fold configfs_attach_attr into configfs_lookup
  - configfs: make configfs_create() return inode
  - configfs: factor dirent removal into helpers
  - configfs: simplify the configfs_dirent_is_ready
  - configfs: return -ENAMETOOLONG earlier in configfs_lookup


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2209.4.0.0168
changelog:
  - mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
  - video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2209.6.0.0170
changelog:
  - KVM: x86/pmu: Update AMD PMC sample period to fix guest NMI-watchdog
  - KVM: x86: Adjust counter sample period after a wrmsr
  - KVM: x86: Fix perfctr WRMSR for running counters
  - perf/core: Provide a kernel-internal interface to recalibrate event period
  - media: em28xx: initialize refcount before kref_get
  - mm: avoid potential deadlock tirgged by writing slab-attr-file
  - ext4: fix use-after-free in ext4_ext_shift_extents
  - quota: Add more checking after reading from quota file
  - quota: Replace all block number checking with helper function
  - quota: Check next/prev free block number after reading from quota file
  - efi: capsule-loader: Fix use-after-free in efi_capsule_write
  - ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header
  - mm/sharepool: Fix UAF reported by KASAN
  - blk-mq: avoid extending delays of active hctx from blk_mq_delay_run_hw_queues
  - mm: mem_reliable: Start fallback if no suitable zone found
  - net: hns3: update hns3 version to 22.9.2
  - net: hns3: fix error resume keep alive when remove hclgevf
  - net: hns3: update hns3 version to 22.9.1
  - net: hns3: fix keep alive can not resume problem when system busy


author: Laibin Qiu <qiulaibin@huawei.com> - 4.19.90-2210.1.0.0171
changelog:
  - netfilter: nf_conntrack_irc: Fix forged IP logic
  - ext4: fix check for block being out of directory size
  - ext4: check if directory block is within i_size
  - block: Fix UAF in bd_link_disk_holder()
  - ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
  - block: add a new config to control dispatching bios asynchronously
  - block: fix kabi broken in request_queue
  - md: enable dispatching bio asynchronously for raid10 by default
  - arm64/topology: getting preferred sibling's cpumask supported by platform
  - block: support to dispatch bio asynchronously
  - block: add new fields in request_queue
  - md/raid10: convert resync_lock to use seqlock
  - md/raid10: prevent unnecessary calls to wake_up() in fast path
  - !122 【kernel-openEuler-1.0-LTS】kernel：fix some issues with 4.19 kernel on openEuler 22.03 system
  - mm: sharepool: fix potential AA deadlock
  - mm: sharepool: check size=0 in mg_sp_make_share_k2u()
  - mm: sharepool: delete redundant check in __sp_remap_get_pfn
  - Revert "cifs: fix double free race when mount fails in cifs_get_root()"
  - scsi: hisi_sas: Release resource directly in hisi_sas_abort_task() when NCQ error
  - scsi: hisi_sas: Enable force phy when SATA disk directly connected
  - scsi: hisi_sas: Modify v3 HW ATA completion process when SATA disk is in error status
  - sched: Fix invalid free for tsk->se.dyn_affi_stats
  - scsi: target: tcmu: Fix warning: 'page' may be used uninitialized
  - scsi: target: tcmu: Fix crash on ARM during cmd completion
  - scsi: target: tcmu: Optimize use of flush_dcache_page
  - scsi: target: tcmu: Fix size in calls to tcmu_flush_dcache_range
  - signal: fix deadlock caused by calling printk() under sighand->siglock
  - mm: fix missing handler for __GFP_NOWARN
  - perf bench futex-wake: Restore thread count default to online CPU count
  - selftests/bpf: Enlarge select() timeout for test_maps
  - xfs: preserve default grace interval during quotacheck
  - i40e: Fix kernel crash during module removal
  - i40e: Fix use-after-free in i40e_client_subtask()
  - EDAC: skx_common: downgrade message importance on missing PCI device
  - x86/entry/64: Don't compile ignore_sysret if 32-bit emulation is enabled
  - x86: Fix early boot crash on gcc-10, third try
  - objtool: Don't fail on missing symbol table


author: chengzeruizhi<chengzeruizhi@huawei.com> - 2.0.8-3
changelog:
  - Type: enhancement
  - ID: NA
  - SUG: NA
  - DESC: add HAVE_ISULAD definition and fix cpu quota out of range


author: wangfengtu<wangfengtu@huawei.com> - 4.0.3-2022052301
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: do not operate playload and attach cgroup if no controller found


author: gaihuiying <gaihuiying1@huawei.com> - 5.9-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix undefined behavior in asn_build_int()
         libsnmp: Rework parse_imports()
         libsnmp: Increase MAX_IMPORTS
         libsnmp: Allocate the module import list on the heap
         libsnmp: Fix a memory leak in a MIB parser error path
         libsnmp: Fix the getoid() error path


author: gaihuiying <eaglegai@163.com> - 1:5.9-6
changelog:
  - Type:CVE
  - CVE:CVE-2022-24805 CVE-2022-24806 CVE-2022-24807 CVE-2022-24808 CVE-2022-24809 CVE-2022-24810
  - SUG:NA
  - DESC:fix CVE-2022-24805 CVE-2022-24806 CVE-2022-24807
             CVE-2022-24808 CVE-2022-24809 CVE-2022-24810


author: xingwei <xingwei14@h-partners.com> - 1:5.9-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: IF-MIB, IP-FORWARD-MIB: Improve robustness
          IF-MIB: pass the network interface index to net
          IF-MIB: fix a memory leak
          IF-MIB: fix a recently introduced use after free
          IF-MIB: add a trailing newline to an error message


author: cuixucui <cuixucui1@h-partners> - 1.1.1-3
changelog:
  - Fix the problem that the client fails to send messages after the server port is modified
  - Fix the problem that the system test item failed to check the integrity of the software package


author: cuixucui <cuixucui1@h-partners.com> - 1.1.2-4
changelog:
  - Add requirements for system and bugfix
  - Upgrade oec-hardware-server
  - Update readme and design doc
  - Fix nvme error
  - Update network fibre check and log 
  - Update description for perf test
  - Add automatic configuration network card IP


author: cuixucui <cuixucui1@h-partners.com> - 1.1.2-5
changelog:
  - fix the bug that the test board information is not added to the configuration file
  - Add kabi for hardware critical test
  - Optimize disk/raid/fc/ethernet/infiniband test suite
  - Fix the bug of reading nvme data failed
  - Add file size check when uploading file to server


author: yezengruan <yezengruan@huawei.com>
changelog:
  - vhost-vsock: detach the virqueue element in case of error (CVE-2022-26354)
  - virtio-net: fix map leaking on error during receive (CVE-2022-26353)


author: yezengruan <yezengruan@huawei.com>
changelog:
  - hw/block/fdc: Extract blk_create_empty_drive()
  - hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196
  - tests/fdc-test: Add a regression test for CVE-2021-20196
  - display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207)
  - ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)


author: yezengruan <yezengruan@huawei.com>
changelog:
  - hw/intc/arm_gicv3_dist: Rename 64-bit accessors with 'q' suffix
  - hw/intc/arm_gicv3: Replace mis-used MEMTX_* constants by booleans
  - hw/intc/arm_gicv3: Check for !MEMTX_OK instead of MEMTX_ERROR (CVE-2021-3750)
  - net/colo-compare.c: Check that colo-compare is active


author: sundongxu <sundongxu3@huawei.com>
changelog:
  - e1000: fail early for evil descriptor
  - e1000: fix tx re-entrancy problem
  - hw/sd/sdcard: Do not allow invalid SD card sizes
  - hw/sd/sdcard: Do not switch to ReceivingData if address is invalid
  - hw/sd/sdcard: Restrict Class 6 commands to SCSD cards
  - hw/sd/sdcard: Simplify realize() a bit
  - hw/sd/sdcard: Update coding style to make checkpatch.pl happy
  - scsi/qemu-pr-helper: Fix out-of-bounds access to trnptid_list[]
  - curses: Fixes curses compiling errors.
  - net/dump.c: Suppress spurious compiler warning
  - tests: Replace deprecated ASN1 code


author: yezengruan <yezengruan@huawei.com>
changelog:
  - hw/scsi/lsi53c895a: Do not abort when DMA requested and no data queued
  - scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216)
  - scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216)


