# changelog

author: Zheng Zengkai <zhengzengkai@huawei.com> - 5.10.0-60.75.0.99
changelog:
  - ext2: replace bh_submit_read() helper with bh_read()
  - ufs: replace ll_rw_block()
  - udf: replace ll_rw_block()
  - reiserfs: replace ll_rw_block()
  - ocfs2: replace ll_rw_block()
  - ntfs3: replace ll_rw_block()
  - jbd2: replace ll_rw_block()
  - isofs: replace ll_rw_block()
  - gfs2: replace ll_rw_block()
  - fs/buffer: replace ll_rw_block()
  - fs/buffer: add some new buffer read helpers
  - sched/qos: Don't unthrottle cfs_rq when cfs_rq is throttled by qos
  - mtd: physmap-core: Fix NULL pointer dereferencing in of_select_probe_type()
  - blk-mq: set default elevator as deadline in case of hctx shared tagset
  - dm thin: Use last transaction's pmd->root when commit failed
  - media: mceusb: Use new usb_control_msg_*() routines
  - block, bfq: fix possible uaf for 'bfqq->bic'
  - block, bfq: fix null pointer dereference in bfq_bio_bfqg()
  - scsi: iscsi: remove .unbind_conn from iscsi_transport
  - Revert "scsi: iscsi: fix kabi broken in struct iscsi_transport"
  - blk-mq: fix kabi broken in struct bio
  - blk-mq: fix kabi broken in struct request
  - mm/dynamic_hugetlb: fix clear PagePool without lock protection
  - mm/dynamic_hugetlb: fix list corruption in hpool_merge_page()
  - x86/cpu/hygon: Set __max_die_per_package on Hygon
  - block: always align request_wrapper to cacheline
  - block: fix crash on cmpxchg for request_wrapper
  - clk: imx: Add check for kcalloc
  - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
  - Bluetooth: L2CAP: Fix build errors in some archs


author: Zheng Zengkai <zhengzengkai@huawei.com> - 5.10.0-60.76.0.100
changelog:
  - KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
  - bfq: fix null-ptr-deref in bfq_pd_offline
  - i2c: ismt: Fix an out-of-bounds bug in ismt_access()
  - ksmbd: fix heap-based overflow in set_ntacl_dacl()
  - ksmbd: prevent out of bound read for SMB2_WRITE
  - ksmbd: validate length in smb2_write()
  - xfs: fix super block buf log item UAF during force shutdown
  - xfs: wait iclog complete before tearing down AIL
  - xfs: get rid of assert from xfs_btree_islastblock


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.77.0.101
changelog:
  - !348 Backport CVEs and fs bugfixes
  - io_uring: kill goto error handling in io_sqpoll_wait_sq()
  - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
  - ext4: fix bad checksum after online resize
  - xfs: fix use-after-free in xattr node block inactivation
  - USB: core: Fix RST error in hub.c
  - USB: core: Prevent nested device-reset calls


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.78.0.102
changelog:
  - !357 Backport CVEs, bugfixes, performance and other
  - binder: fix UAF of alloc->vma in race with munmap()
  - io_uring: add missing item types for splice request
  - xfs: fix overfilling of reserve pool
  - xfs: always succeed at setting the reserve pool size
  - xfs: remove infinite loop when reserving free block pool
  - xfs: use current->journal_info for detecting transaction recursion
  - mm: fix unexpected changes to {failslab|fail_page_alloc}.attr
  - fix kabi broken due to may_pollfree
  - io_uring: disable polling pollfree files
  - sched: disable sched_autogroup by default
  - driver: char: delete svm.c
  - ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob
  - fs/ntfs3: Fix attr_punch_hole() null pointer derenference
  - tracing/osnoise: Do not unregister events twice
  - tracing/osnoise: Properly unhook events if start_per_cpu_kthreads() fails
  - mm/filemap.c: remove bogus VM_BUG_ON
  - mm: oom_kill: fix KABI broken by "oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup"
  - oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup
  - fork: Allocate a new task_struct_resvd object for fork task
  - tmpfs: fix regressions from wider use of ZERO_PAGE
  - tmpfs: do not allocate pages on read


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.79.0.103
changelog:
  - !369 Backport CVEs and bugfixes
  - mm/vmpressure: fix data-race with memcg->socket_pressure
  - of/fdt: Don't calculate initrd size from DT if start > end
  - lib/cmdline: avoid page fault in next_arg
  - mm/memory: return vm_fault_t result from migrate_to_ram() callback
  - net: sched: disallow noqueue for qdisc classes
  - netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
  - xfs: Fix deadlock on xfs_inodegc_worker
  - net: sched: cbq: dont intepret cls results when asked to drop
  - net: sched: atm: dont intepret cls results when asked to drop
  - scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process
  - rndis_wlan: Prevent buffer overflow in rndis_query_oid


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.80.0.104
changelog:
  - !386 Backport CVEs and bugfixes
  - net: sched: fix race condition in qdisc_graft()
  - macvlan: enforce a consistent minimal mtu
  - net: switch to storing KCOV handle directly in sk_buff
  - drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
  - mm/memcg_memfs_info: fix potential oom_lock recursion deadlock
  - mm: memcontrol: fix potential oom_lock recursion deadlock
  - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames
  - ext4: fix use-after-free in ext4_orphan_cleanup
  - ext4: fix null-ptr-deref in ext4_write_info
  - xfs: fix potential log item leak


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.81.0.105
changelog:
  - !400 Backport fs and block bugfixes
  - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
  - ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap
  - ubifs: Re-statistic cleaned znode count if commit failed
  - ubifs: dirty_cow_znode: Fix memleak in error handling path
  - block, bfq: switch 'bfqg->ref' to use atomic refcount apis
  - cifs: sanitize multiple delimiters in prepath
  - !392 OpenEuler-22.03-LTS Fixes Some Bugs in Accelerator Disk Storage Encryption and Decryption Scenarios
  - crypto: hisilicon/sec - delete the flag CRYPTO_ALG_ALLOCATES_MEMORY
  - crypto: hisilicon/qm - prevent soft lockup in qm_poll_req_cb()'s loop
  - crypto: hisilicon/qm - modify event irq processing
  - crypto: hisilicon/qm - move alloc qm->wq to qm.c
  - crypto: hisilicon/qm - add functions for releasing resources


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.82.0.106
changelog:
  - !410 Backport CVEs and bugfixes
  - x86/kasan: Populate shadow for shared chunk of the CPU entry area
  - x86/kasan: Add helpers to align shadow addresses up and down
  - x86/kasan: Rename local CPU_ENTRY_AREA variables to shorten names
  - x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area
  - x86/mm: Recompute physical address for every page of per-CPU CEA mapping
  - x86/kasan: Map shadow for percpu pages on demand
  - x86/mm: Randomize per-cpu entry area
  - Huawei BMA: Fix iBMA driver bug
  - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath()
  - mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
  - ppp: associate skb with a device at tx
  - arm32: kaslr: Avoid using the -fpic and fno-pic parameters together
  - bpf, sockmap: fix race in sock_map_free()
  - bpf: make sure skb->len != 0 when redirecting to a tunneling device
  - cifs: Fix use-after-free in rdata->read_into_pages()
  - net: bridge: mcast: add and enforce query interval minimum
  - net: bridge: mcast: add and enforce startup query interval minimum
  - media: vivid: fix compose size exceed boundary
  - !405 kvm: arm64: fix some pvsched bugs
  - kvm: arm64: fix some pvsched bugs


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.83.0.107
changelog:
  - !419 Backport CVEs and bugfixes
  - net: mpls: fix stale pointer if allocation fails during device rename
  - x86/bugs: Flush IBP in ib_prctl_set()
  - binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
  - binder: Address corner cases in deferred copy and fixup
  - binder: fix pointer cast warning
  - binder: defer copies of pre-patched txn data
  - binder: read pre-translated fds from sender buffer
  - binder: avoid potential data leakage when copying txn
  - ARM: 9242/1: kasan: Only map modules if CONFIG_KASAN_VMALLOC=n
  - rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed
  - net/sched: sch_taprio: do not schedule in taprio_reset()
  - net/sched: sch_taprio: fix possible use-after-free
  - nbd: fix assignment error for first_minor in nbd_dev_add
  - md/raid10: fix wrong setting of max_corr_read_errors
  - md/raid10: fix overflow in safe_delay_store
  - md/raid10: fix slab-out-of-bounds in md_bitmap_get_counter
  - fix kabi broken due to import of 5.15-stable io_uring
  - io_uring: import 5.15-stable io_uring
  - task_work: add helper for more targeted task_work canceling
  - coredump: Limit what can interrupt coredumps
  - kernel: provide create_io_thread() helper
  - fs: provide locked helper variant of close_fd_get_file()
  - kernel: remove checking for TIF_NOTIFY_SIGNAL
  - entry: Add support for TIF_NOTIFY_SIGNAL
  - signal: Add task_sigpending() helper
  - arm: add support for TIF_NOTIFY_SIGNAL
  - arm64: add support for TIF_NOTIFY_SIGNAL
  - riscv: add support for TIF_NOTIFY_SIGNAL
  - powerpc: add support for TIF_NOTIFY_SIGNAL
  - x86: Wire up TIF_NOTIFY_SIGNAL
  - iov_iter: add helper to save iov_iter state
  - perf beauty: Update copy of linux/socket.h with the kernel sources
  - perf trace beauty: Update copy of linux/socket.h with the kernel sources
  - io_uring: correct pinned_vm accounting
  - file: Rename __close_fd_get_file close_fd_get_file
  - io_uring: don't hold uring_lock when calling io_run_task_work*
  - io_uring: don't take uring_lock during iowq cancel
  - fs: make do_renameat2() take struct filename
  - net: add accept helper not installing fd
  - net: provide __sys_shutdown_sock() that takes a socket
  - fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED
  - Make sure nd->path.mnt and nd->path.dentry are always valid pointers
  - fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy*
  - fs: add support for LOOKUP_CACHED
  - Revert "io_uring: fix soft lockup when call __io_remove_buffers"
  - Revert "io_uring: deduplicate failing task_work_add"
  - Revert "io_uring: don't take uring_lock during iowq cancel"
  - Revert "[Backport] io_uring: don't keep looping for more events if we can't flush overflow"
  - Revert "[Huawei] io-wq: Switch io_wqe_worker's fs before releasing request"
  - Revert "[Huawei] io_uring:drop identity before creating a private one"


author: Zheng Zengkai <zhengzengkai@huawei.com> - 5.10.0-60.84.0.108
changelog:
  - !454 Backport CVEs and bugfixes
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
  - neigh: make sure used and confirmed times are valid
  - HID: check empty report_list in bigben_probe()
  - HID: check empty report_list in hid_validate_values()
  - Documentation/hw-vuln: Fix rST warning
  - Documentation/hw-vuln: Add documentation for Cross-Thread Return Predictions
  - KVM: x86: Mitigate the cross-thread return address predictions bug
  - x86/speculation: Identify processors vulnerable to SMT RSB predictions
  - radi10: fix leak of 'r10bio->remaining' for recovery
  - md: fix soft lockup in status_resync
  - md: don't update recovery_cp when curr_resync is ACTIVE
  - md: Ensure resync is reported after it starts
  - md: Use enum for overloaded magic numbers used by mddev->curr_resync
  - raid10: fix leak of io accounting
  - tcp: Fix listen() regression in 5.15.88.
  - net/ulp: Remove redundant ->clone() test in inet_clone_ulp().
  - net/ulp: use consistent error code when blocking ULP
  - net/ulp: prevent ULP without clone op from entering the LISTEN status
  - net/tls: tls_is_tx_ready() checked list_entry
  - usb: dwc3: dwc3-qcom: Add missing platform_device_put() in dwc3_qcom_acpi_register_core
  - ntfs: fix out-of-bounds read in ntfs_attr_find()
  - splice: don't generate zero-len segement bvecs
  - rds: rds_rm_zerocopy_callback() use list_first_entry()
  - tap: tap_open(): correctly initialize socket uid
  - tun: tun_chr_open(): correctly initialize socket uid
  - net: add sock_init_data_uid()
  - ring-buffer: Handle race between rb_move_tail and rb_check_pages
  - blk-mq: use quiesced elevator switch when reinitializing queues
  - ovl: fix use inode directly in rcu-walk mode


author: sunsuwan<sunsuwan3@huawei.com> - 5.15.0-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:lnstat: fix buffer overflow in header output 
         libnetlink: fix socket leak in rtnl_open_byptoyo
         lnstat: fix strdup leak in w argument parsing
         q_cake: allow fix buffer overflow on large labels
         tc flower: fix buffer overflow on large labels
         tc_tuil: fix parsing action control with space and sl
         tipc: fix keylen check
         fix devlink health dump command without arg
         tc: em_u32: fix offset parsing
         l2tp fix typo in AF_INET6 checksum JSON print
         ip: Fix size_columns() for very large values
         ip: Fix size_columns() invocation that passes a 32-bit quantity


author: jiangheng<jiangheng14@huawei.com> - 5.15.0-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:bridge: fix memory leak when doing fdb get
         mptcp: fix memory leak when doing 'endpoint show'
         mptcp: fix memory leak when getting limits
         ip neigh: fix memory leak when doing 'get'
         ip address: fix memory leak when specifying device
         fix marco expansion in changelog


author: gaoxingwang <gaoxingwang1@huawei.com> - 1:5.15.0-11
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:add epoch version in changelog to fix check_spec_file ci failure


author: gaihuiying <eaglegai@163.com> - 1.13.2-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:remove buildin key
         add macros to control if key files permissons is 600 or 644
         remove useless BuildRequires:unbound-libs


author: yanglu <yanglu72@h-partners.com> - 1.13.2-5
changelog:
  - Type:cves
  - CVE:CVE-2022-30698 CVE-2022-30699
  - SUG:NA
  - DESC:fix CVE-2022-30698 and CVE-2022-30699


author: gaihuiying <eaglegai@163.com> - 1.13.2-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:change run directory from /var/run to /run to fix "/usr/lib/tmpfiles.d/unbound.conf:1: xxxx"


