# changelog

author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.83.0.107
changelog:
  - !419 Backport CVEs and bugfixes
  - net: mpls: fix stale pointer if allocation fails during device rename
  - x86/bugs: Flush IBP in ib_prctl_set()
  - binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
  - binder: Address corner cases in deferred copy and fixup
  - binder: fix pointer cast warning
  - binder: defer copies of pre-patched txn data
  - binder: read pre-translated fds from sender buffer
  - binder: avoid potential data leakage when copying txn
  - ARM: 9242/1: kasan: Only map modules if CONFIG_KASAN_VMALLOC=n
  - rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed
  - net/sched: sch_taprio: do not schedule in taprio_reset()
  - net/sched: sch_taprio: fix possible use-after-free
  - nbd: fix assignment error for first_minor in nbd_dev_add
  - md/raid10: fix wrong setting of max_corr_read_errors
  - md/raid10: fix overflow in safe_delay_store
  - md/raid10: fix slab-out-of-bounds in md_bitmap_get_counter
  - fix kabi broken due to import of 5.15-stable io_uring
  - io_uring: import 5.15-stable io_uring
  - task_work: add helper for more targeted task_work canceling
  - coredump: Limit what can interrupt coredumps
  - kernel: provide create_io_thread() helper
  - fs: provide locked helper variant of close_fd_get_file()
  - kernel: remove checking for TIF_NOTIFY_SIGNAL
  - entry: Add support for TIF_NOTIFY_SIGNAL
  - signal: Add task_sigpending() helper
  - arm: add support for TIF_NOTIFY_SIGNAL
  - arm64: add support for TIF_NOTIFY_SIGNAL
  - riscv: add support for TIF_NOTIFY_SIGNAL
  - powerpc: add support for TIF_NOTIFY_SIGNAL
  - x86: Wire up TIF_NOTIFY_SIGNAL
  - iov_iter: add helper to save iov_iter state
  - perf beauty: Update copy of linux/socket.h with the kernel sources
  - perf trace beauty: Update copy of linux/socket.h with the kernel sources
  - io_uring: correct pinned_vm accounting
  - file: Rename __close_fd_get_file close_fd_get_file
  - io_uring: don't hold uring_lock when calling io_run_task_work*
  - io_uring: don't take uring_lock during iowq cancel
  - fs: make do_renameat2() take struct filename
  - net: add accept helper not installing fd
  - net: provide __sys_shutdown_sock() that takes a socket
  - fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED
  - Make sure nd->path.mnt and nd->path.dentry are always valid pointers
  - fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy*
  - fs: add support for LOOKUP_CACHED
  - Revert "io_uring: fix soft lockup when call __io_remove_buffers"
  - Revert "io_uring: deduplicate failing task_work_add"
  - Revert "io_uring: don't take uring_lock during iowq cancel"
  - Revert "[Backport] io_uring: don't keep looping for more events if we can't flush overflow"
  - Revert "[Huawei] io-wq: Switch io_wqe_worker's fs before releasing request"
  - Revert "[Huawei] io_uring:drop identity before creating a private one"


author: Zheng Zengkai <zhengzengkai@huawei.com> - 5.10.0-60.84.0.108
changelog:
  - !454 Backport CVEs and bugfixes
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
  - neigh: make sure used and confirmed times are valid
  - HID: check empty report_list in bigben_probe()
  - HID: check empty report_list in hid_validate_values()
  - Documentation/hw-vuln: Fix rST warning
  - Documentation/hw-vuln: Add documentation for Cross-Thread Return Predictions
  - KVM: x86: Mitigate the cross-thread return address predictions bug
  - x86/speculation: Identify processors vulnerable to SMT RSB predictions
  - radi10: fix leak of 'r10bio->remaining' for recovery
  - md: fix soft lockup in status_resync
  - md: don't update recovery_cp when curr_resync is ACTIVE
  - md: Ensure resync is reported after it starts
  - md: Use enum for overloaded magic numbers used by mddev->curr_resync
  - raid10: fix leak of io accounting
  - tcp: Fix listen() regression in 5.15.88.
  - net/ulp: Remove redundant ->clone() test in inet_clone_ulp().
  - net/ulp: use consistent error code when blocking ULP
  - net/ulp: prevent ULP without clone op from entering the LISTEN status
  - net/tls: tls_is_tx_ready() checked list_entry
  - usb: dwc3: dwc3-qcom: Add missing platform_device_put() in dwc3_qcom_acpi_register_core
  - ntfs: fix out-of-bounds read in ntfs_attr_find()
  - splice: don't generate zero-len segement bvecs
  - rds: rds_rm_zerocopy_callback() use list_first_entry()
  - tap: tap_open(): correctly initialize socket uid
  - tun: tun_chr_open(): correctly initialize socket uid
  - net: add sock_init_data_uid()
  - ring-buffer: Handle race between rb_move_tail and rb_check_pages
  - blk-mq: use quiesced elevator switch when reinitializing queues
  - ovl: fix use inode directly in rcu-walk mode


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.85.0.109
changelog:
  - !485 Backport CVEs and bugfixes
  - !491 [sync] PR-477: tools: fix compile error introduced by LoongArch commit
  - fix compile error introduced by LoongArch commit
  - scsi: cancel the inflight async device probe when remove scsi_target
  - scsi: fix use-after-free problem in scsi_remove_target
  - ring-buffer: Fix race between reset page and reading page
  - raid1, raid10: switch to precise io accounting
  - block: add precise io accouting apis
  - md/raid10: fix memleak for 'conf->bio_split'
  - sctp: fail if no bound addresses can be used for a given scope
  - ext4: fix WARNING in mb_find_extent
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
  - scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
  - scsi: iscsi: Move pool freeing
  - xfs: aborting inodes on shutdown may need buffer lock
  - ext4: fix incorrect options show of original mount_opt and extend mount_opt2
  - !439 openeuler: pci: workaround multiple functions can be assigned to only one VM
  - !474 [sync] PR-447: add perf loongarch support
  - tools/perf: Add basic support for LoongArch
  - perf machine: Use path__join() to compose a path instead of snprintf(dir, '/', filename)
  - !467 LoongArch: add kvm support
  - LoongArch: kvm: KVM support for 5.10
  - !472 [sync] PR-466: LoongArch: fix compile error when using make allmodconfig
  - LoongArch: fix compile error when using make allmodconfig
  - LoongArch: Export symbol for function smp_send_reschedule()
  - LoongArch: kvm: add initial kvm support
  - !453 Backport CVEs and bugfixes
  - !463 [sync] PR-444: LoongArch: some LS7a device drivers support and LoongArch bug fix
  - LoongArch: remove __ARCH_WANT_NEW_STAT
  - LoongArch: modify defconfig according to other architectures
  - LoongArch: Change definition of cpu_relax() for Loongson-3
  - drm/loongson: add kernel modesetting driver support for ls7a1000/ls7a2000
  - LoongArch: Use alternative to optimize libraries
  - LoongArch: Add alternative runtime patching mechanism
  - LoongArch: Remove the .fixup section usage
  - LoongArch: extable: Add a dedicated uaccess handler
  - LoongArch: extable: Add `type` and `data` fields
  - LoongArch: Switch to relative exception tables
  - LoongArch: Consolidate __ex_table construction
  - LoongArch: fix SECCOMP test error
  - LoongArch: fix vmlinux ld error
  - LoongArch: enable hugetlbfs support
  - LoongArch: save one instruction for arch_local_irq_{enable,disable}
  - LoongArch: optimize for syscall return
  - LoongArch: refresh usage of sync
  - LoongArch: use 40 bits address space for user
  - LoongArch: Support loader and kernel interface V40
  - LoongArch: Enhance booting and resume compatibility
  - LoongArch: Remove redudant csr save/restore
  - LoongArch: Support Power Manager
  - irqchip/loongson-liointc: Set different isr for differnt core
  - platform: Support loongson laptop generic driver
  - LoongArch: Adapted SECTION_SIZE_BITS with page size
  - ACPI: Support ACPI_MACHINE_WIDTH for 64
  - spi: loongson: Add LS7A spi driver support
  - i2c: loongson: Add LS7A i2c driver support
  - LoongArch: Call irq_find_matching_fwnode get irq domain
  - irqchip/ACPI: Introduce ACPI_IRQ_MODEL_LPIC for LoongArch
  - gpio: loongson: Add 3A/3B/3C/7A gpio dirver support
  - rtc: ls2x: Add support for the Loongson-2K/LS7A RTC
  - LoongArch: convert p v s cache to l1 l2 l3 format
  - cpufreq: Add cpufreq driver for LoongArch
  - LoongArch: Fix section mismatch due to acpi_os_ioremap()
  - LoongArch: Add vector extensions support
  - phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
  - openeuler: pci: workaround multiple functions can be assigned to only one VM


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.86.0.110
changelog:
  - !512 Backport CVEs and bugfixes
  - livepatch/core: Fix hungtask against cpu hotplug on x86
  - livepatch: Narrow the scope of the 'text_mutex' lock
  - livepatch: Cleanup klp_mem_prepare()
  - seccomp: Move copy_seccomp() to no failure path.
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
  - ftrace: Fix invalid address access in lookup_rec() when index is 0
  - mm: optimize do_wp_page() for fresh pages in local LRU pagevecs
  - mm: optimize do_wp_page() for exclusive pages in the swapcache
  - tipc: add an extra conn_get in tipc_conn_alloc
  - tipc: set con sock in tipc_conn_alloc
  - ext4: fix another off-by-one fsmap error on 1k block filesystems
  - mm/vmalloc: huge vmalloc backing pages should be split rather than compound
  - HID: asus: use spinlock to safely schedule workers
  - HID: asus: use spinlock to protect concurrent accesses
  - HID: asus: Remove check for same LED brightness on set
  - jbd2: fix data missing when reusing bh which is ready to be checkpointed
  - !502 [sync] PR-476: LoongArch: fix failed to boot
  - !498 [sync] PR-479: LoongArch: update network related default config
  - !496 [sync] PR-448: LoongArch: fix some pci problems
  - LoongArch: Initialize screen_info variable
  - LoongArch: Fixed EIOINTC structure members
  - LoongArch: Fix virtual machine startup error
  - loongarch/kvm: ls7a add iocsrw emulation
  - LoongArch: fix signal handler name changed
  - LoongArch: defconfig: update network configurations
  - LoongArch: pci root bridige set acpi companion only when not acpi_disabled.
  - pci: fix X server auto probe fail when both ast and etnaviv drm present
  - LS7A2000: PCIE: Fixup GPU card error
  - pci/quirks: ls7a2000: fix pm transition of devices under pcie port
  - LoongArch: Fixed some pcie card not scanning properly
  - pci: fix kabi error caused by pm_suspend_target_state
  - PCI: PM: Fix pcie mrrs restoring
  - PCI: Check if the pci controller can use both CFG0 and CFG1 mode to access configuration space
  - PCI: Check if entry->offset already exist for mem resource


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.87.0.111
changelog:
  - !529 Backport CVEs and bugfixes
  - block: fix use-after-free of q->q_usage_counter
  - block: move q_usage_counter release into blk_queue_release
  - Revert "block: fix null-deref in percpu_ref_put"
  - mm: compaction: avoid possible NULL pointer dereference in kcompactd_cpu_online
  - md/raid6: Fix the problem of repeatedly applying for memory in raid5_read_one_chunk
  - xfs, iomap: limit individual ioend chain lengths in writeback
  - net/sched: tcindex: search key must be 16 bits
  - net/sched: tcindex: update imperfect hash filters respecting rcu
  - tty: fix out-of-bounds access in tty_driver_lookup_tty()
  - fs/ntfs3: Validate resident attribute name
  - ima: Fix memory leakage in ima_store_template
  - Revert "mm/vmalloc: huge vmalloc backing pages should be split rather than compound"
  - coredump: fix kabi broken in struct coredump_params
  - coredump: Use the vma snapshot in fill_files_note
  - coredump/elf: Pass coredump_params into fill_note_info
  - coredump: Remove the WARN_ON in dump_vma_snapshot
  - coredump: Snapshot the vmas in do_coredump
  - mm/swapfile: add cond_resched() in get_swap_pages()
  - mm: slince possible data races about pgdat->kswapd
  - mm: fix null-ptr-deref in kswapd_is_running()
  - fs/ntfs3: Validate MFT flags before replaying logs
  - fs/ntfs3: Validate attribute name offset
  - bpf: Fixes possible race in update_prog_stats() for 32bit arches
  - bpf: Avoid races in __bpf_prog_run() for 32bit arches
  - ext4: make sure fs error flag setted before clear journal error
  - ext4: commit super block if fs record error when journal record without error
  - af_unix: Get user_ns from in_skb in unix_diag_get_exact().
  - net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
  - arm64: errata: Remove AES hwcap for COMPAT tasks
  - ARM: 9206/1: A9: Add ARM ERRATA 764319 workaround (Updated)
  - kernel: Initialize cpumask before parsing
  - softirq: Don't try waking ksoftirqd before it has been spawned
  - bpf: Prevent decl_tag from being referenced in func_proto arg
  - bpf: Skip task with pid=1 in send_signal_common()
  - bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
  - !460 Backport CVEs and bugfixes
  - !517 [sync] PR-510: LoongArch: fix dual-bridge machine can not work
  - !516 [sync] PR-509: Loongson: fix 7a2000 gpu driver can not work
  - irqchip/loongson: Fix syscore ops registration
  - irqchip/loongarch: Fix some issues of irq controllers
  - drm/loongson: using hdmi hot plug status register
  - malidp: Fix NULL vs IS_ERR() checking


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.89.0.113
changelog:
  - !550 anolis: bond: broadcast ARP or ND messages to all slaves
  - !561 Backport CVEs and bugfixes
  - !560 [sync] PR-539: LoongArch: fix compile warnning of drm/loongson driver
  - net: sched: Use struct_size() helper in kvmalloc()
  - net_sched: Use struct_size() and flex_array_size() helpers
  - ext4: dio take shared inode lock when overwriting preallocated blocks
  - ext4: fix race between writepages and remount
  - clocksource/drivers/arm_arch_timer: Fix CNTPCT_LO and CNTVCT_LO value
  - kvm: initialize all of the kvm_debugregs structure before sending it to userspace
  - nvme: use nvme_cid to generate command_id in trace event
  - xfs: don't report reserved bnobt space as available
  - xfs: don't include bnobt blocks when reserving free block pool
  - xfs: set aside allocation btree blocks from block reservation
  - xfs: introduce in-core global counter of allocbt blocks
  - act_mirred: use the backlog for nested calls to mirred ingress
  - net/sched: act_mirred: better wording on protection against excessive stack growth
  - net/sched: act_mirred: refactor the handle of xmit
  - scsi: scsi_dh_alua: fix memleak for 'qdata' in alua_activate()
  - anolis: bond: broadcast ARP or ND messages to all slaves
  - !558 net: hns3: modify reset delay time to avoid configuration timeout
  - drm/loongson: fix compile warnning
  - net: hns3: modify reset delay time to avoid configuration timeout


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.90.0.114
changelog:
  - !574 Backport CVEs and bugfixes
  - driver core: Fix lockdep warning on wfs_lock
  - driver core: platform: Add extra error check in devm_platform_get_irqs_affinity()
  - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
  - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size
  - ubi: ensure that VID header offset + VID header size <= alloc, size
  - ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct()
  - perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach
  - ring-buffer: Fix race while reader and writer are on the same page
  - loop: Add parm check in loop_control_ioctl
  - ext4: Fix i_disksize exceeding i_size problem in paritally written case
  - ext4: ext4_put_super: Remove redundant checking for 'sbi->s_journal_bdev'
  - ext4: Fix reusing stale buffer heads from last failed mounting
  - btrfs: fix race between quota disable and quota assign ioctls
  - dm crypt: add cond_resched() to dmcrypt_write()
  - xfs: don't leak memory when attr fork loading fails
  - xfs: delete unnecessary NULL checks
  - xfs: replace inode fork size macros with functions
  - xfs: replace XFS_IFORK_Q with a proper predicate function
  - xfs: use XFS_IFORK_Q to determine the presence of an xattr fork
  - xfs: make inode attribute forks a permanent part of struct xfs_inode
  - xfs: convert XFS_IFORK_PTR to a static inline helper
  - xfs: don't reuse busy extents on extent trim
  - fs/xfs: convert comma to semicolon
  - xfs: xfs_ail_push_all_sync() stalls when racing with updates
  - xfs: check buffer pin state after locking in delwri_submit
  - xfs: log worker needs to start before intent/unlink recovery


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.91.0.115
changelog:
  - !588 [sync] PR-585:  x86/speculation: Allow enabling STIBP with legacy IBRS
  - !591 Backport CVEs and bugfixes
  - net/sched: Retire tcindex classifier
  - drm/vmwgfx: Validate the box size for the snooped cursor
  - netfilter: nf_tables: nft_parse_register can return a negative value
  - netfilter: nf_tables: validate registers coming from userspace.
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
  - KVM: nVMX: add missing consistency checks for CR0 and CR4
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
  - xfs: __percpu_counter_compare() inode count debug too expensive
  - xfs: fix memcpy fortify errors in EFI log format copying
  - xfs: fix memcpy fortify errors in RUI log format copying
  - xfs: fix memcpy fortify errors in CUI log format copying
  - xfs: fix memcpy fortify errors in BUI log format copying
  - xfs: Use struct xfs_bmdr_block instead of struct xfs_btree_block to calculate root node size
  - xfs: allow setting full range of panic tags
  - xfs: don't use BMBT btree split workers for IO completion
  - xfs: fix extent busy updating
  - xfs: get root inode correctly at bulkstat
  - xfs: invalidate xfs_bufs when allocating cow extents
  - xfs: attach dquots to inode before reading data/cow fork mappings
  - xfs: invalidate block device page cache during unmount
  - xfs: add selinux labels to whiteout inodes
  - xfs: convert buf_cancel_table allocation to kmalloc_array
  - xfs: don't leak xfs_buf_cancel structures when recovery fails
  - xfs: refactor buffer cancellation table allocation
  - xfs: fix type mismatches in the inode reclaim functions
  - xfs: don't allow log writes if the data device is readonly
  - x86/speculation: Allow enabling STIBP with legacy IBRS


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.92.0.116
changelog:
  - !632 Backport CVEs and bugfixes
  - bonding: Fix memory leak when changing bond type to Ethernet
  - bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
  - bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
  - rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975]
  - power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
  - timers/nohz: Last resort update jiffies on nohz_full IRQ entry
  - xfs: don't leak btree cursor when insrec fails after a split
  - xfs: avoid unnecessary runtime sibling pointer endian conversions
  - xfs: detect self referencing btree sibling pointers
  - xfs: introduce xfs_buf_daddr()
  - xfs: move kernel-specific superblock validation out of libxfs
  - xfs: bound maximum wait time for inodegc work
  - xfs: introduce xfs_inodegc_push()
  - xfs: flush inodegc workqueue tasks before cancel
  - xfs: drop async cache flushes from CIL commits.
  - xfs: limit iclog tail updates
  - xfs: need to see iclog flags in tracing
  - io_uring: ensure that io_init_req() passes in the right issue_flags
  - io_uring: add missing lock in io_get_file_fixed


author: fuanan <fuanan3@h-partners.com> - 2.9.12-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix memory leaks in xmlACatalogAdd when xmlHashAddEntry failed


