# changelog

author: yexiao<yexiao7@huawei.com> - 202011-16
changelog:
  - fix CVE-2023-45229、CVE-2023-45230、CVE-2023-45231、CVE-2023-45232、CVE-2023-45233、CVE-2023-45234、CVE-2023-45235


author: lvxiangcong<lvxiangcong@kylinos.cn> - 3.4.14-7
changelog:
  - Type:CVE
  - CVE:CVE-2022-24675 CVE-2022-28327 CVE-2022-24921 CVE-2021-44717 CVE-2021-33195
  - SUG:NA
  - DESC: Batch fix cve through rebuild and sync release


author: lvxiangcong<lvxiangcong@kylinos.cn> - 3.4.14-9
changelog:
  - Type:CVES
  - CVES:CVE-2022-41723 CVE-2022-34038  CVE-2023-32082 CVE-2021-28235 CVE-2023-39325
  - SUG:NA
  - DESC: Batch fix sync failed cves for openEuler-22.03-LTS-SP1 branch


author: wangshuo <wangshuo@kylinos.cn> - 1.17.3-31
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport the upstream patch, fix the overflow issue in runtime.netpollWaiters


author: Li Nan <linan122@huawei.com> - 5.10.0-243.0.0.145
changelog:
  - !14246  soc: hisilicon: hbmdev: Only support built-in
  - !14242  sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
  - !14241  sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
  - soc: hisilicon: hbmdev: Only support built-in
  - !14060  etmem : fix page_ref count leak and head missing useing problem
  - !14205  crypto: arm64/sm4 - simplify sm4_ce_expand_key() of CE implementation
  - sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
  - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
  - crypto: arm64/sm4 - simplify sm4_ce_expand_key() of CE implementation
  - etmem : fix page_ref count leak and head missing useing problem


author: Li Nan <linan122@huawei.com> - 5.10.0-244.0.0.146
changelog:
  - !14314  x86/sgx: Fix deadlock in SGX NUMA node search
  - !14315  media: v4l2-tpg: prevent the risk of a division by zero
  - !14293  Fix the incorrect definition and use of IMA_FIX_OVERLAYFS_DETECTION
  - !14289 v2  erofs: add ondemand mode support
  - !14269  iomap: fix zero padding data issue in concurrent append writes
  - !14235  xfs: fix attr inactive issue
  - !14339  ocfs2: free inode when ocfs2_get_init_inode() fails
  - !14331  mm: avoid unconditional one-tick sleep when swapcache_prepare fails
  - !14330  mm/khugepaged: fix ->anon_vma race
  - !14305  RDMA/hns: Some patches are integrated into OLK-5.10
  - !14333  ALSA: usb-audio: Fix out of bounds reads when finding clock sources
  - ocfs2: free inode when ocfs2_get_init_inode() fails
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources
  - mm: avoid unconditional one-tick sleep when swapcache_prepare fails
  - mm/khugepaged: fix ->anon_vma race
  - !13006  Fix CVE-2024-50086
  - !14309  printk: Fix the qspinlock deadloop caused by zap_locks()
  - !14252 【OLK-5.10】backport some bugfix of hisi_sas module from upstream
  - media: v4l2-tpg: prevent the risk of a division by zero
  - x86/sgx: Fix deadlock in SGX NUMA node search
  - printk: Fix the qspinlock deadloop caused by zap_locks()
  - RDMA/hns: Don't query *except on hip10*
  - RDMA/hns: Fix creating GSI QP in non-extended SGE QP bank
  - RDMA/hns: Fix bonding failure due to wrong reset_state
  - config: Enable IMA_FIX_OVERLAYFS_DETECTION in openeuler defconfigs
  - IMA: Fix the incorrect definition and use of IMA_FIX_OVERLAYFS_DETECTION
  - !14208 Fix perf coredump and refcnt inccoret
  - cachefiles: modify inappropriate error return value in cachefiles_daemon_secctx
  - fscache: modify fscache_hash_cookie() to enhance security
  - cachefiles: prefault in user pages to aovid ABBA deadlock
  - fscache/cachefiles: add a memory barrier for page_write
  - fscache/cachefiles: add a memory barrier for waking and waiting
  - fscache: add a memory barrier for FSCACHE_COOKIE_LOOKING_UP
  - wait_on_bit: Add wait_on_bit_acquire() to provide memory barrier
  - s390: provide arch_test_bit_acquire() for architecture s390
  - wait_on_bit: add an acquire memory barrier
  - erofs: unify anonymous inodes for blob
  - erofs: remove unused device mapping in meta routine
  - fscache: fix assertion failure in cachefiles_put_object()
  - cachefiles: cyclic allocation of msg_id to avoid reuse
  - fscache: fix op leak due to abort init after parent ready
  - cachefiles: Set object to close if ondemand_id < 0 in copen
  - erofs: correct the blknr/blkoff calculation in erofs_read_raw_page()
  - cachefiles: Change the mark inactive sequence in erofs ondemand mode
  - cachefiles: clear FSCACHE_COOKIE_NO_DATA_YET for the new ondemand object
  - cachefiles: Add restrictions to cachefiles_daemon_cull()
  - cachefiles: disallow to complete open requests with uninitialised ondemand_id
  - cachefiles: defer exposing anon_fd until after copy_to_user() succeeds
  - fscache: Add the unhash_cookie mechanism to fscache_drop_object()
  - cachefiles: call cachefiles_ondemand_init_object() out of dir inode lock
  - cachefiles: Fix cookie reference count leakage error
  - cachefiles: Restrict monitor calls to read_page
  - cachefiles: flush all requests after setting CACHEFILES_DEAD
  - fscache: set the default value of object_max_active to 256
  - cachefiles: Fix NULL pointer dereference in object->file
  - cachefiles: make on-demand read killable
  - cachefiles: never get a new anon fd if ondemand_id is valid
  - cachefiles: add spin_lock for cachefiles_ondemand_info
  - cachefiles: flush ondemand_object_worker during clean object
  - fscache: limit fscache_object_max_active to avoid blocking
  - cachefiles: flush all requests for the object that is being dropped
  - cachefiles: stop sending new request when dropping object
  - cachefiles: add consistency check for copen/cread
  - cachefiles: add output string to cachefiles_obj_[get|put]_ondemand_fd
  - cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()
  - cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd()
  - cachefiles: remove err_put_fd tag in cachefiles_ondemand_daemon_read()
  - fscache: Fix trace UAF in fscache_cookie_put()
  - erofs: fix order >= MAX_ORDER warning due to crafted negative i_size
  - cachefiles: use mainline xattr in ondemand mode
  - fscache: rename new_location to new_version
  - erofs: switch to use new location
  - erofs: remove erofs_fscache_netfs
  - cachefiles: handle the unprintable case for new location in cachefiles_cook_key()
  - cachefiles: use key_hash as csum for new location
  - cachefiles: skip volum csum cachefiles_cook_key() for new location
  - cachefiles: skip acc in cachefiles_cook_key() for new location
  - cachefiles: use volume key directly in cachefiles_cook_key() for new location
  - cachefiles: factor out helper to generate csum from cachefiles_cook_key()
  - cachefiles: factor out helper to generate acc from cachefiles_cook_key()
  - fscache: generate new key_hash for new location
  - fscache: add new helper to determine cachefile location
  - fscache: add a waiting mechanism when duplicate cookies are detected
  - erofs: maintain cookies of share domain in self-contained list
  - fscache: fix kernel BUG at __fscache_read_or_alloc_page
  - erofs: fix handling kern_mount() failure
  - erofs: fix lockdep false positives on initializing erofs_pseudo_mnt
  - erofs: check the uniqueness of fsid in shared domain in advance
  - fscache: fix assertion failure in fscache_put_object()
  - fscache: fix reference count leakage during abort init
  - cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode
  - erofs: relinquish volume with mutex held
  - erofs: add erofs_ondemand switch
  - erofs: add erofs switch to better control it
  - erofs: fix page unlock advance during readahead
  - openeuler_defconfig: enable erofs ondemand for x86 and arm64
  - anolis: cachefiles: fix potential NULL in error path
  - anolis: cachefiles: add missing lock protection when polling
  - anolis: cachefiles: reset object->private to NULL when it's freed
  - anolis: cachefiles: add restore command to recover inflight ondemand read requests
  - anolis: cachefiles: narrow the scope of triggering EPOLLIN events in ondemand mode
  - anolis: cachefiles: resend an open request if the read request's object is closed
  - anolis: cachefiles: extract ondemand info field from cachefiles_object
  - anolis: cachefiles: introduce object ondemand state
  - anolis: fscache: export fscache_object_wq
  - anolis: cachefiles: optimize on-demand IO path with buffer IO
  - erofs: remove unused EROFS_GET_BLOCKS_RAW flag
  - erofs: fix use-after-free of fsid and domain_id string
  - erofs: protect s_inodes with s_inode_list_lock for fscache
  - erofs: introduce 'domain_id' mount option
  - erofs: Support sharing cookies in the same domain
  - erofs: introduce a pseudo mnt to manage shared cookies
  - erofs: introduce fscache-based domain
  - erofs: code clean up for fscache
  - anolis: erofs: implement fscache-based data readahead
  - anolis: fscache,cachefiles: add fscache_prepare_read() helper
  - anolis: cachefiles: maintain a file descriptor to the backing file
  - erofs: leave compressed inodes unsupported in fscache mode for now
  - anolis: erofs: fix the name of erofs_fscache_super_index_def
  - erofs: use kill_anon_super() to kill super in fscache mode
  - erofs: scan devices from device table
  - erofs: add 'fsid' mount option
  - erofs: implement fscache-based data read for inline layout
  - erofs: implement fscache-based data read for non-inline layout
  - erofs: implement fscache-based metadata read
  - erofs: register fscache context for extra data blobs
  - erofs: register fscache context for primary data blob
  - erofs: add anonymous inode caching metadata for data blobs
  - erofs: add fscache context helper functions
  - erofs: register fscache volume
  - erofs: add fscache mode check helper
  - erofs: make erofs_map_blocks() generally available
  - cachefiles: make on-demand request distribution fairer
  - anolis: cachefiles: refactor cachefiles_ondemand_daemon_read()
  - cachefiles: fix error return code in cachefiles_ondemand_copen()
  - anolis: cachefiles: fix volume key setup for cachefiles_open
  - anolis: cachefiles: replace BUG_ON() with WARN_ON()
  - cachefiles: narrow the scope of flushed requests when releasing fd
  - anolis: cachefiles: skip check for n_children in on-demand mode
  - cachefiles: enable on-demand read mode
  - cachefiles: implement on-demand read
  - cachefiles: notify the user daemon when withdrawing cookie
  - cachefiles: unbind cachefiles gracefully in on-demand mode
  - cachefiles: notify the user daemon when looking up cookie
  - erofs: fix misbehavior of unsupported chunk format check
  - erofs: use meta buffers for erofs_read_superblock()
  - erofs: use meta buffers for zmap operations
  - erofs: use meta buffers for xattr operations
  - erofs: use meta buffers for super operations
  - erofs: use meta buffers for inode operations
  - erofs: introduce meta buffer operations
  - erofs: clean up erofs_map_blocks tracepoints
  - erofs: add multiple device support
  - erofs: decouple basic mount options from fs_context
  - erofs: introduce erofs_sb_has_xxx() helpers
  - erofs: fix double free of 'copied'
  - erofs: support reading chunk-based uncompressed files
  - erofs: introduce chunk-based file on-disk format
  - erofs: clean up file headers & footers
  - erofs: don't use erofs_map_blocks() any more
  - [Backport]scsi: hisi_sas: Enable force phy when SATA disk directly connected
  - [Backport]scsi: hisi_sas: Add latest_dump for the debugfs dump
  - [Backport]scsi: hisi_sas: Create all dump files during debugfs initialization
  - [Backport]scsi: hisi_sas: Update v3 hw STP_LINK_TIMER setting
  - [Backport]scsi: hisi_sas: Add time interval between two H2D FIS following soft reset spec
  - [Backport]scsi: hisi_sas: Update disk locked timeout to 7 seconds
  - [Backport]scsi: hisi_sas: Reset PHY again if phyup timeout
  - [Backport]scsi: hisi_sas: Enable all PHYs that are not disabled by user during controller reset
  - [Backport]scsi: hisi_sas: Add firmware information check
  - [Backport]scsi: hisi_sas: Create trigger_dump at the end of the debugfs initialization
  - [Backport]scsi: hisi_sas: Adjust priority of registering and exiting debugfs for security
  - iomap: fix zero padding data issue in concurrent append writes
  - xfs: handle attr node/leaf blocks atomically during inactive
  - xfs: factor out xfs_attr3_leaf_init
  - xfs: factor out xfs_da3_node_entry_remove
  - perf addr_location: Add init/exit/copy functions
  - perf maps: Use a pointer for kmaps
  - ksmbd: fix user-after-free from session log off
  - ksmbd: fix race condition between session lookup and expire


author: Li Nan <linan122@huawei.com> - 5.10.0-245.0.0.147
changelog:
  - !14742  rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
  - !14751  mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
  - !14679  drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
  - !14572  PCI: Fix use-after-free of slot->bus on hot remove
  - !14758  media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
  - !14755  i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
  - !14777  tracing: Prevent bad count for tracing_cpumask_write
  - !14496  ovl: Filter invalid inodes with missing lookup function
  - !14497  nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
  - !14498  f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
  - !14495  ocfs2: fix uninitialized value in ocfs2_file_read_iter()
  - !14606  scsi: qla2xxx: Fix use after free on unload
  - !14579  io_uring: check for overflows in io_pin_pages
  - !14530  sched/deadline: Fix warning in migrate_enable for boosted tasks
  - !14526  drm/amdgpu: set the right AMDGPU sg segment limitation
  - !14734  Fix iBMA bug and change version
  - !14713  Fix CVE-2024-56705
  - tracing: Prevent bad count for tracing_cpumask_write
  - !14604  scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
  - !14601  nvme-pci: fix freeing of the HMB descriptor table
  - !14575  etmem: fix use-after-free of mm in the scan release process
  - !14381  virtiofs: use pages instead of pointer for kernel direct IO
  - !14668  Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
  - !14209  gpiolib: fix memory use-after-free in gpiochip_setup_dev()
  - !14651  backport mainline bugfix patch
  - media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
  - i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
  - !14629  net/mlx5: Fix error path in multi-packet WQE transmit
  - !14627  crypto: hisilicon/qm - inject error before stopping queue
  - !14626  drm/amd/display: Check null pointers before using dc->clk_mgr
  - !14623  staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
  - !14598  blk-cgroup: Fix UAF in blkcg_unpin_online()
  - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
  - rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
  - !14704  bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
  - BMA: Fix Oops and spin lock deadlock problem, and change the version number.
  - !14700  CVE-2024-53158
  - !14457  cgroup: Fix potential overflow issue when checking max_depth
  - !14620  drm: zynqmp_kms: Unplug DRM device before removal
  - !14616  scsi: sg: Fix slab-use-after-free read in sg_release()
  - media: atomisp: Add check for rgby_data memory allocation failure
  - media: atomisp: remove #ifdef HAS_NO_HMEM
  - !14456  f2fs: fix race in concurrent f2fs_stop_gc_thread
  - !14481  jfs: fix array-index-out-of-bounds in jfs_readdir
  - !14470  ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
  - bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
  - soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
  - !14440  sh: intc: Fix use-after-free bug in register_intc_controller()
  - !14535  RDMA/mlx5: Move events notifier registration to be after device registration
  - !14450  apparmor: test: Fix memory leak for aa_unpack_strdup()
  - !14636  CVE-2024-56604_OLK-5.10
  - !14547  media: wl128x: Fix atomicity violation in fmc_send_cmd()
  - !14563  f2fs: fix to do sanity check on node blkaddr in truncate_node()
  - !14460  sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
  - !14523  The bugfix for LPM trie
  - !14650  memcg: fix soft lockup in the OOM process
  - drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
  - Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
  - !14436  crypto: bcm - add error check in the ahash_hmac_init function
  - genirq/msi: Fix off-by-one error in msi_domain_alloc()
  - memcg: fix soft lockup in the OOM process
  - !14473  smb: client: fix NULL ptr deref in crypto_aead_setkey()
  - !14467  io_uring/tctx: work around xa_store() allocation error issue
  - !14503  net: phy: dp83869: fix memory corruption when enabling fiber
  - !14515  hfsplus: don't query the device logical block size multiple times
  - !14513  scsi: bfa: Fix use-after-free in bfad_im_module_exit()
  - !14512  f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
  - !14388  CVE-2024-53173
  - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
  - Bluetooth: Consolidate code around sk_alloc into a helper function
  - net/mlx5: Fix error path in multi-packet WQE transmit
  - crypto: hisilicon/qm - inject error before stopping queue
  - drm/amd/display: Check null pointers before using dc->clk_mgr
  - staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
  - drm: zynqmp_kms: Unplug DRM device before removal
  - scsi: sg: Fix slab-use-after-free read in sg_release()
  - scsi: qla2xxx: Fix use after free on unload
  - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
  - nvme-pci: fix freeing of the HMB descriptor table
  - blk-cgroup: Fix UAF in blkcg_unpin_online()
  - io_uring: check for overflows in io_pin_pages
  - etmem: fix use-after-free of mm in the scan release process
  - PCI: Fix use-after-free of slot->bus on hot remove
  - f2fs: fix to do sanity check on node blkaddr in truncate_node()
  - !14366  EDAC/bluefield: Fix potential integer overflow
  - media: wl128x: Fix atomicity violation in fmc_send_cmd()
  - RDMA/mlx5: Move events notifier registration to be after device registration
  - sched/deadline: Fix warning in migrate_enable for boosted tasks
  - drm/amdgpu: set the right AMDGPU sg segment limitation
  - !14380  io_uring: check if iowq is killed before queuing
  - !14354  btrfs: ref-verify: fix use-after-free after invalid ref action
  - !14351  jfs: array-index-out-of-bounds fix in dtReadFirst
  - bpf: Handle in-place update for full LPM trie correctly
  - bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
  - !14344  drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
  - hfsplus: don't query the device logical block size multiple times
  - scsi: bfa: Fix use-after-free in bfad_im_module_exit()
  - f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
  - !14371 [OLK-5.10] update AMD Zen5 Turin feature
  - net: phy: dp83869: fix memory corruption when enabling fiber
  - f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
  - nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
  - ovl: Filter invalid inodes with missing lookup function
  - ocfs2: fix uninitialized value in ocfs2_file_read_iter()
  - jfs: fix array-index-out-of-bounds in jfs_readdir
  - smb: client: fix NULL ptr deref in crypto_aead_setkey()
  - ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
  - io_uring/tctx: work around xa_store() allocation error issue
  - sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
  - cgroup: Fix potential overflow issue when checking max_depth
  - f2fs: fix race in concurrent f2fs_stop_gc_thread
  - apparmor: test: Fix memory leak for aa_unpack_strdup()
  - !14409  bpf: fix OOB devmap writes when deleting elements
  - !14419  HID: wacom: fix when get product name maybe null pointer
  - sh: intc: Fix use-after-free bug in register_intc_controller()
  - crypto: bcm - add error check in the ahash_hmac_init function
  - !14268  Revert "unicode: Don't special case ignorable code points"
  - !14397  backport some patches from upstream about HCCS low power
  - !14392  arm64: stacktrace: Handle 'lr' in interrupt context
  - !14317  exfat: fix out-of-bounds access of directory entries
  - !14402  gpio: grgpio: Add NULL check in grgpio_probe
  - !14396  scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
  - !14363  CVE-2024-53217
  - HID: wacom: fix when get product name maybe null pointer
  - !14097  vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
  - !14407  NFSD: Prevent a potential integer overflow
  - !14378  ftrace: Fix regression with module command in stack_trace_filter
  - bpf: fix OOB devmap writes when deleting elements
  - !14375  fix CVE-2024-53197
  - NFSD: Prevent a potential integer overflow
  - gpio: grgpio: Add NULL check in grgpio_probe
  - soc: hisilicon: kunpeng_hccs: Support low power feature for the specified HCCS type
  - soc: hisilicon: kunpeng_hccs: Add used HCCS types sysfs
  - soc: hisilicon: kunpeng_hccs: Fix the 'lane_mode' field name in port info structure to 'max_lane_num'
  - soc: hisilicon: kunpeng_hccs: Add the check for base address and size of shared memory
  - soc: hisilicon: kunpeng_hccs: Return failure on having not die or port information
  - soc: hisilicon: kunpeng_hccs: Fix a PCC typo
  - scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
  - arm64: stacktrace: Handle 'lr' in interrupt context
  - NFSv4.0: Fix a use-after-free problem in the asynchronous open()
  - NFSv4.0: Fix the wake up of the next waiter in nfs_release_seqid()
  - Revert "NFSv4: release seqid when open failed for nfs4.0"
  - Revert "nfs: fix rpc_task use-after-free when open and close different files concurrently"
  - virtiofs: use pages instead of pointer for kernel direct IO
  - io_uring: check if iowq is killed before queuing
  - ftrace: Fix regression with module command in stack_trace_filter
  - ALSA: usb-audio: Fix a DMA to stack memory bug
  - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
  - x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range
  - x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range
  - EDAC/bluefield: Fix potential integer overflow
  - nfsd: restore callback functionality for NFSv4.0
  - NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
  - btrfs: ref-verify: fix use-after-free after invalid ref action
  - jfs: array-index-out-of-bounds fix in dtReadFirst
  - drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
  - exfat: fix out-of-bounds access of directory entries
  - Revert "unicode: Don't special case ignorable code points"
  - gpiolib: fix memory use-after-free in gpiochip_setup_dev()
  - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans


author: Li Nan <linan122@huawei.com> - 5.10.0-246.0.0.148
changelog:
  - !14844  merge mainline patch into OLK-5.10
  - !14838 v2  fs: Filter specific inodes to prevent UAF issues
  - fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP
  - mm: kfence: fix using kfence_metadata without initialization in show_object()
  - x86/mm: Do not shuffle CPU entry areas without KASLR
  - fs: Filter specific inodes to prevent UAF issues
  - !14599  CVE-2024-56701
  - !14560  CVE-2024-56567
  - !14801  CVE-2024-53237
  - !14793  jfs: fix shift-out-of-bounds in dbSplit
  - !14815  OLK-5.10
  - !14790  acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
  - !14583  ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
  - !14582  jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
  - !14822  ALSA: 6fire: Release resources at card release
  - !14539 RDMA/hns backport some bugfix from maillist-v6.13 2025/01/03
  - ALSA: 6fire: Release resources at card release
  - RDMA/hns: Fix missing flush CQE for DWQE
  - RDMA/hns: Fix warning storm caused by invalid input in IO path
  - RDMA/hns: Fix mapping error of zero-hop WQE buffer
  - wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures
  - !14795  btrfs: fix use-after-free when COWing tree bock and tracing is enabled
  - !14768  tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
  - driver core: Introduce device_find_any_child() helper
  - Bluetooth: fix use-after-free in device_for_each_child()
  - btrfs: fix use-after-free when COWing tree bock and tracing is enabled
  - jfs: fix shift-out-of-bounds in dbSplit
  - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
  - tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
  - powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore
  - ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
  - jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
  - ad7780: fix division by zero in ad7780_write_raw()


author: Li Nan <linan122@huawei.com> - 5.10.0-247.0.0.149
changelog:
  - !14414 sdma-dae: add print in exceptional branch
  - !14870  quota: flush quota_release_work upon quota writeback
  - !14862  drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
  - !14866  NFS: Fix up nfs_ctx_key_to_expire()
  - !14853  drm/i915/hdcp: Add encoder check in hdcp2_get_capability
  - !14852  octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
  - !14851  nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
  - quota: flush quota_release_work upon quota writeback
  - !14663  xsk: Add generic xdp multi-buffer send support
  - NFS: Fix up nfs_ctx_key_to_expire()
  - !14803  net: hsr: avoid potential out-of-bound access in fill_frame_info()
  - !14829  ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
  - !14854  btrfs: check folio mapping after unlock in relocate_one_folio()
  - drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
  - !14857  sched: psi: fix bogus pressure spikes from aggregation race
  - sched: psi: fix bogus pressure spikes from aggregation race
  - btrfs: check folio mapping after unlock in relocate_one_folio()
  - drm/i915/hdcp: Add encoder check in hdcp2_get_capability
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
  - nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
  - ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
  - net: hsr: avoid potential out-of-bound access in fill_frame_info()
  - xsk: Add generic xdp multi-buffer send support
  - drivers:misc:sdma-dae: add print in exceptional branch


author: Li Nan <linan122@huawei.com> - 5.10.0-248.0.0.150
changelog:
  - !14995  mm/compaction: fix UBSAN shift-out-of-bounds warning
  - mm/compaction: fix UBSAN shift-out-of-bounds warning
  - !14894  btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
  - !14875  *** jffs2: Prevent rtime decompress memory corruption ***
  - !14960  mainline to olk-5.10 RDMA/hns: Check atomic wr length
  - !14937 v2  Two CVE fixes for ksmbd
  - !14966  memcg: fix memcg_swapmax_read() not declared warning
  - memcg: fix memcg_swapmax_read() not declared warning
  - RDMA/hns: Check atomic wr length
  - Revert "RDMA/hns: Fix a missing check of atomic wr length"
  - Revert "RDMA/hns: Check atomic wr length"
  - !14943  fix CVE-2024-57892
  - !14954  zram: fix NULL pointer in comp_algorithm_show()
  - !14948 Mainline patch to olk-5.10 v3
  - zram: fix NULL pointer in comp_algorithm_show()
  - !14247 [OLK-5.10] fix wangxun 1G/10G drivers hardware tx unit hang.
  - !14947  mm/slub: Reduce memory consumption in extreme scenarios
  - RDMA/hns: Fix different dgids mapping to the same dip_idx
  - Revert "RDMA/hns: Fix different dgids mapping to the same dip_idx"
  - RDMA/hns: Fix flush cqe error when racing with destroy qp
  - Revert "RDMA/hns: Fix flush cqe error when racing with destroy qp"
  - mm/slub: Reduce memory consumption in extreme scenarios
  - !14917  merge CVE patches into OLK-5.10
  - ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
  - ocfs2: correct return value of ocfs2_local_free_info()
  - ksmbd: fix potencial out-of-bounds when buffer offset is invalid
  - ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
  - net: wangxun: change netdev uc addr num maxmium
  - net: wangxun: fix resolving ipv6 pakets extension header errors
  - net: wangxun: fix tx csum by soft except tcp udp sctp
  - drm/i915: Fix potential context UAFs
  - arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning
  - arm64: probes: Fix uprobes for big-endian kernels
  - arm64:uprobe fix the uprobe SWBP_INSN in big-endian
  - dm cache: fix flushing uninitialized delayed_work on cache_ctr error
  - mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM
  - kcsan: Turn report_filterlist_lock into a raw_spinlock
  - media: uvcvideo: Require entities to have a non-zero unique ID
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
  - um: net: Do not use drvdata in release
  - xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
  - 9p/xen: fix release of IRQ
  - fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
  - fbdev/sh7760fb: Alloc DMA memory from hardware device
  - ionic: Fix netdev notifier unregister on failure
  - btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
  - jffs2: Fix rtime decompressor
  - jffs2: Prevent rtime decompress memory corruption


author: Li Nan <linan122@huawei.com> - 5.10.0-249.0.0.151
changelog:
  - !15061  ALSA: seq: oss: Fix races at processing SysEx messages
  - ALSA: seq: oss: Fix races at processing SysEx messages
  - !14286 [OLK-5.10] SCSI: Support Linkdata HBA/RAID Controllers
  - !15059  RDMA/hns: Fix free_mr_qp not assigning qp->device in error flow
  - RDMA/hns: Fix free_mr_qp not assigning qp->device in error flow
  - !15051  iio: light: vcnl4035: fix information leak in triggered buffer
  - !9883 AMD QoS new features BMEC and SMBA
  - iio: light: vcnl4035: fix information leak in triggered buffer
  - !14956  nbd: don't allow reconnect after disconnect
  - !15046  pinmux: Use sequential access to access desc->pinmux data
  - !15015  spi: mpc52xx: Add cancel_work_sync before module remove
  - !14865  fs/dirty_pages: Add exclusive open lock to prevent null pointer dereference
  - [PATCH] SCSI: Linkdata: Supports Linkdata HBA/RAID Controllers
  - pinmux: Use sequential access to access desc->pinmux data
  - !15044 [sync] PR-15042:  drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
  - !15024  net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg
  - !14991  usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
  - !14891  s390/cpum_sf: Handle CPU hotplug remove during sampling
  - !15014 v2  nilfs2: prevent use of deleted inode
  - drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
  - net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg
  - !15010  nvme-rdma: unquiesce admin_q before destroy it
  - spi: mpc52xx: Add cancel_work_sync before module remove
  - nilfs2: prevent use of deleted inode
  - nvme-rdma: unquiesce admin_q before destroy it
  - usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
  - tools headers cpufeatures: Sync with the kernel sources
  - tools arch x86: Sync the msr-index.h copy with the kernel sources
  - tools arch x86: Sync the msr-index.h copy with the kernel sources
  - x86/resctrl: Read supported bandwidth sources from CPUID
  - x86/resctrl: Remove redundant variable in mbm_config_write_domain()
  - x86/resctrl: Add per-rmid arch private storage for overflow and chunks
  - x86/resctrl: Group struct rdt_hw_domain cleanup
  - x86/resctrl: Add domain online callback for resctrl work
  - x86/resctrl: Merge mon_capable and mon_enabled
  - x86/resctrl: Fix kfree() of the wrong type in domain_add_cpu()
  - x86/resctrl: Split struct rdt_domain
  - x86/resctrl: Add interface to write mbm_local_bytes_config
  - x86/resctrl: Add interface to write mbm_total_bytes_config
  - x86/resctrl: Add interface to read mbm_local_bytes_config
  - x86/resctrl: Add interface to read mbm_total_bytes_config
  - x86/resctrl: Support monitor configuration
  - x86/resctrl: Add __init attribute to rdt_get_mon_l3_config()
  - x86/resctrl: Detect and configure Slow Memory Bandwidth Allocation
  - x86/resctrl: Move MSR defines into msr-index.h
  - x86/resctrl: Include new features in command line options
  - x86/cpufeatures: Add Bandwidth Monitoring Event Configuration feature flag
  - x86/resctrl: Add a new resource type RDT_RESOURCE_SMBA
  - x86/cpufeatures: Add Slow Memory Bandwidth Allocation feature flag
  - x86/resctrl: Replace smp_call_function_many() with on_each_cpu_mask()
  - x86/resctrl: Split struct rdt_resource
  - x86/resctrl: Fix kernel-doc in internal.h
  - x86/resctrl: Correct MBM total and local values
  - nbd: don't allow reconnect after disconnect
  - s390/cpum_sf: Handle CPU hotplug remove during sampling
  - fs/dirty_pages: Add exclusive open lock to prevent null pointer dereference


author: Li Nan <linan122@huawei.com> - 5.10.0-250.0.0.153
changelog:
  - !15099  sched: sch_cake: add bounds checks to host bulk flow fairness counts
  - !15087  netfilter: ipset: add missing range check in bitmap_ip_uadt
  - !15085  ila: call nf_unregister_net_hooks() sooner
  - !15100  ila: serialize calls to nf_register_net_hooks()
  - !15097  net: inet6: do not leave a dangling sk pointer in inet6_create()
  - !15096  net: inet: do not leave a dangling sk pointer in inet_create()
  - !15098  netfilter: conntrack: clamp maximum hashtable size to INT_MAX
  - !15089  net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
  - !15086  net: Fix CVE-2024-50125
  - !15117 v3  net: Fix CVE-2024-56658
  - !15095  wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
  - !15124 v2  fix CVE-2024-53056 for olk-5.10
  - !15129  comedi: Flush partial mappings in error case
  - !15127  iomap: avoid avoid truncating 64-bit offset to 32 bits
  - comedi: Flush partial mappings in error case
  - iomap: avoid avoid truncating 64-bit offset to 32 bits
  - mm: resolve faulty mmap_region() error path behaviour
  - mm: unconditionally close VMAs on error
  - mm: avoid unsafe VMA hook invocation when error arises on mmap hook
  - !15081  usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()
  - !15079  drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
  - net: Fix kabi breakage in struct net
  - net: defer final 'struct net' free in netns dismantle
  - ila: serialize calls to nf_register_net_hooks()
  - sched: sch_cake: add bounds checks to host bulk flow fairness counts
  - netfilter: conntrack: clamp maximum hashtable size to INT_MAX
  - net: inet6: do not leave a dangling sk pointer in inet6_create()
  - net: inet: do not leave a dangling sk pointer in inet_create()
  - wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
  - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
  - netfilter: ipset: add missing range check in bitmap_ip_uadt
  - Bluetooth: SCO: Fix UAF on sco_sock_timeout
  - Bluetooth: call sock_hold earlier in sco_conn_del
  - ila: call nf_unregister_net_hooks() sooner
  - usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()
  - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error


author: Li Nan <linan122@huawei.com> - 5.10.0-251.0.0.154
changelog:
  - !14327 [OLK-5.10] Enhanced Hygon processor's processing capabilities for large memory copying
  - !15137  net/mlx5: Fix variable not being completed when function returns
  - !15136  crypto: caam - Fix the pointer passed to caam_qi_shutdown()
  - !15134  usb: typec: altmode should keep reference to parent
  - !15198  CVE-2024-57857
  - !15196  iio: pressure: zpa2326: fix information leak in triggered buffer
  - !15199  power: supply: gpio-charger: Fix set charge current limits
  - power: supply: gpio-charger: Fix set charge current limits
  - RDMA/siw: Remove direct link to net_device
  - RDMA/siw: Fabricate a GID on tun and loopback devices
  - RDMA/siw: Use helper function to set sys_image_guid
  - RDMA/siw: Enable siw on tunnel devices
  - iio: pressure: zpa2326: fix information leak in triggered buffer
  - !15186  CVE-2024-57795
  - !15177  iio: imu: kmx61: fix information leak in triggered buffer
  - RDMA/rxe: Remove the direct link to net_device
  - RDMA: Export ib_device_get_netdev()
  - iio: imu: kmx61: fix information leak in triggered buffer
  - !14910 KVM:arm64:Add a kvm parameter to control guest wfi trapping
  - KVM:arm64:Add a kvm parameter to control guest wfi trapping
  - !15139  apparmor: fix 'Do simple duplicate message elimination'
  - !15094  netfilter: x_tables: fix LED ID check in led_tg_check()
  - !15146  Revert "media: uvcvideo: Require entities to have a non-zero unique ID"
  - !15077  kasan: fix incorrect return type of quarantine_put()
  - Revert "media: uvcvideo: Require entities to have a non-zero unique ID"
  - apparmor: fix 'Do simple duplicate message elimination'
  - net/mlx5: Fix variable not being completed when function returns
  - crypto: caam - Fix the pointer passed to caam_qi_shutdown()
  - usb: typec: altmode should keep reference to parent
  - netfilter: x_tables: fix LED ID check in led_tg_check()
  - kasan: fix incorrect return type of quarantine_put()
  - mm: Enhanced copy capabilities for Hygon processor


author: ZhengZhenyu <zhengzhenyu@openeuler.sh> - 13.12-1
changelog:
  - aupgrade libpq to 13.12,fix CVE-2023-2455, CVE-2023-2454, CVE-2023-39417, CVE-2023-39418, CVE-2020-21469


author: Funda Wang <fundawang@yeah.net> - 2.9.14-15
changelog:
  - Type:CVE
  - CVE:CVE-2024-56171
  - CVE:CVE-2025-24928
  - CVE:CVE-2025-27113
  - SUG:NA
  - DESC: fix CVE-2024-56171, CVE-2025-24928, CVE-2025-27113


author: zhanghao <zhanghao383@huawei.com> - 1:1.0.0-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:evaluate allow implicit ether vlan dep
  evaluate datatype memleak after binop transfer
  evaluate bogus datatype assertion in binary operation evaluation
  netlink delinearize do not transfer binary operation to non anonymous sets
  payload do not kill dependency for proto unknown
  monitor missing cache and set handle initialization
  netlink linearize fix timeout with map updates


author: zhanghao <zhanghao383@huawei.com> - 1:1.0.0-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix potential array out of bounds access
  evaluate: fix shift exponent underflow in concatenation evaluation
  netlink: Fix for potential NULL-pointer deref
  mnl: dump_nf_hooks() leaks memory in error path


author: gaihuiying <eaglegai@163.com> - 1:1.0.0-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: error out if basetypes are different
         evaluate: guard against NULL basetype
         evaluate: handle invalid mapping expressions gracefully
         evaluate: reject attempt to update a set
         evaluate: release mpz type in expr_evaluate_list() error path
         expression: missing line in describe command with invalid expression

  Thu Apr 18 2024 lingsheng <lingsheng1@h-partners.com> - 1:1.0.0-10
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:datatype: don't return a const string from cgroupv2_get_path()
  datatype: fix leak and cleanup reference counting for struct datatype
  datatype: initialize TYPE_CT_EVENTBIT slot in datatype array
  datatype: initialize TYPE_CT_LABEL slot in datatype array
  evaluate: do not remove anonymous set with protocol flags and single element
  evaluate: don't crash if object map does not refer to a value
  evaluate: error out when expression has no datatype
  evaluate: error out when store needs more than one 128bit register of align fixup
  evaluate: fix check for truncation in stmt_evaluate_log_prefix()
  evaluate: fix double free on dtype release
  evaluate: fix memleak in prefix evaluation with wildcard interface name
  evaluate: reject set in concatenation
  evaluate: revisit anonymous set with single element optimization
  evaluate: skip anonymous set optimization for concatenations
  evaluate: stmt_nat: set reference must point to a map
  evaluate: tproxy: move range error checks after arg evaluation
  evaluate: validate chain max length
  evaluate: validate maximum log statement prefix length
  exthdr: fix tcpopt_find_template to use length after mask adjustment
  exthdr: prefer raw_type instead of desc->type
  json: expose dynamic flag
  json: fix use after free in table_flags_json()
  libnftables: Drop cache in -c/--check mode
  meta: fix tc classid parsing out-of-bounds access
  netlink: don't crash if prefix for < byte is requested
  netlink: fix leaking typeof_expr_data/typeof_expr_key in netlink_delinearize_set()
  netlink: handle invalid etype in set_make_key()
  parser_bison: fix ct scope underflow if ct helper section is duplicated
  parser_bison: fix memleak in meta set error handling
  parser_bison: make sure obj_free releases timeout policies
  parser_json: Catch nonsense ops in match statement
  parser_json: Default meter size to zero
  parser_json: Fix flowtable prio value parsing
  parser_json: Fix synproxy object mss/wscale parsing
  parser_json: Fix typo in json_parse_cmd_add_object()
  parser_json: Proper ct expectation attribute parsing
  parser_json: Wrong check in json_parse_ct_timeout_policy()
  py: fix exception during cleanup of half-initialized Nftables
  rule: fix sym refcount assertion


author: gaihuiying <eaglegai@163.com> - 1:1.0.0-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: disable meta set with ranges
         src: reject large raw payload and concat expressions
         evaluate: fix stack overflow with huge priority string
         tcpopt: don't create exthdr expression without datatype
         src: do not allow to chain more than 16 binops
         rule: fix ASAN errors in chain priority to textual names
         tests: shell: add regression test for double-free crash bug
         evaluate: handle invalid mapping expressions in stateful object
         evaluate: Fix incorrect checking the `base` variable in case of IPV6
         netlink: reset temporary set element stmt list after list splice


author: gaihuiying <eaglegai@163.com> - 1:1.0.0-13
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:parser: split tcp option rules
         cache: prepare nft_cache_evaluate() to return error
         ct timeout: fix 'list object x' vs. 'list objects in table' confusion
         ct expectation: fix 'list object x' vs. 'list objects in table' confusion
         tests: shell: connect chains to hook point


author: gaihuiying <eaglegai@163.com> - 1:1.0.0-14
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         parser_json: release buffer returned by json_dumps
         parser_json: fix handle memleak from error path
         parser_json: fix several expression memleaks from error path
         libnftables: Zero ctx->vars after freeing it


author: dillon chen <dillon.chen@gmail.com> - 13.3-8
changelog:
  - Fix build error for loongarch64
  - Fix issue: confilct between libpq-devel and postgresql-devel
  - guess init spec from redhat
  - change redhat spec:rm private package and add files to server-devel
  - so add delete lines to Fix issue
  - Next: write oe libpq and postgresql spec by myself


author: wangjiang <wangjiang37@h-partners.com> - 35.5-17
changelog:
  - backport patch Allow virt_domain read device sysctls
                   Allow icecast rename its log files


author: chenyaqiang <chengyaqiang@huawei.com> - 1:9.0.96-1
changelog:
  - Update to 9.0.96
  - Fix CVE-2021-43980 CVE-2022-25762 CVE-2023-44487 CVE-2023-46589
    CVE-2024-23672 CVE-2024-24549 CVE-2024-34750


author: wangkai <13474090681@163.com> - 1:9.0.100-1
changelog:
  - Update to 9.0.100 for fix CVE-2024-56337
  - Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337,
    the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not.


author: gaihuiying <eaglegai@163.com> - 1.13.2-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:change run directory from /var/run to /run to fix "/usr/lib/tmpfiles.d/unbound.conf:1: xxxx"


