# changelog

author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.110.0.137
changelog:
  - !2002 [sync] PR-1911:  ksmbd: fix out-of-bound read in smb2_write
  - !1626 [sync] PR-1621:  fix three CVEs by backport mainline patchs
  - !1817 [sync] PR-1788:  exfat: check if filename entries exceeds max filename length
  - ksmbd: fix out-of-bound read in smb2_write
  - !1979 [sync] PR-1446:  Fix the default return value of dm_pool_dec_data_range()
  - Fix the default return value of dm_pool_dec_data_range()
  - !1384 [sync] PR-1346:  dm thin metadata: check fail_io before using data_sm
  - exfat: check if filename entries exceeds max filename length
  - ksmbd: fix racy issue from session setup and logoff
  - ksmbd: Fix spelling mistake "excceed" -> "exceeded"
  - ksmbd: limit pdu length size according to connection status
  - ksmbd: Implements sess->ksmbd_chann_list as xarray
  - dm thin metadata: check fail_io before using data_sm


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.111.0.138
changelog:
  - !2143 [sync] PR-2126:  netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
  - !2107 [sync] PR-2090:  net/sched: sch_hfsc: Ensure inner classes have fsc curve
  - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
  - !2105 [sync] PR-2092:  netfilter: nf_tables: skip bound chain on rule flush
  - !2108 [sync] PR-2085:  af_unix: Fix null-ptr-deref in unix_stream_sendpage().
  - !2113 [sync] PR-2097:  Fixed 4 CVEs of the ksmbd
  - !1779  nvme-pci: clear the prp2 field when not used
  - !2081 [sync] PR-2065:  dm: switch to precise io accounting
  - ksmbd: not allow guest user on multichannel
  - ksmbd: fix deadlock in ksmbd_find_crypto_ctx()
  - ksmbd: block asynchronous requests when making a delay on session setup
  - ksmbd: destroy expired sessions
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage().
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve
  - netfilter: nf_tables: skip bound chain on rule flush
  - !1925 [sync] PR-1883:  SUNRPC: don't pause on incomplete allocation
  - !1748 [sync] PR-1649: Enable TPM TIS customization
  - !1747 [sync] PR-1646: Fixed extioi hardware emulation bugs on loongarch
  - dm: switch to precise io accounting
  - !2057 [sync] PR-2055: Only enable unicast promisc when mac table full to fix the hns3 bug
  - SUNRPC: don't pause on incomplete allocation
  - net: hns3: only enable unicast promisc when mac table full
  - !2047 [sync] PR-1752:  ksmbd: validate session id and tree id in the compound request
  - ksmbd: validate session id and tree id in the compound request
  - nvme-pci: clear the prp2 field when not used
  - loongarch/config: Enable TPM TIS customization
  - loongarch/kvm: Fixed extioi hardware emulation bugs


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.112.0.139
changelog:
  - !2214 [sync] PR-2210:  jbd2: Fix potential data lost in recovering journal raced with synchronizing fs bdev
  - !2231 [sync] PR-2086:  fix CVE-2023-20588
  - !2239 [sync] PR-2169:  net: sched: sch_qfq: Fix UAF in qfq_dequeue()
  - !2242 [sync] PR-2230:  media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
  - !2237  x86/speculation: Add force option to GDS mitigation
  - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue()
  - !2041 [sync] PR-1786: LoongArch: export lsx/lasx related struct to user space
  - x86: Move gds_ucode_mitigated() declaration to header
  - Documentation/x86: Fix backwards on/off logic about YMM support
  - KVM: Add GDS_NO support to KVM
  - x86/speculation: Add Kconfig option for GDS
  - x86/speculation: Add force option to GDS mitigation
  - x86/CPU/AMD: Fix the DIV(0) initial fix attempt
  - x86/CPU/AMD: Do not leak quotient data after a division by 0
  - !1877 [sync] PR-1826:  x86/speculation: Add Gather Data Sampling mitigation
  - jbd2: Fix potential data lost in recovering journal raced with synchronizing fs bdev
  - !2170 [sync] PR-2153:  netfilter: nftables: exthdr: fix 4-byte stack OOB write
  - netfilter: nftables: exthdr: fix 4-byte stack OOB write
  - !2149 [sync] PR-2095:  io_uring: ensure IOPOLL locks around deferred work
  - io_uring: ensure IOPOLL locks around deferred work
  - LoongArch: export lsx/lasx related struct to user space
  - x86/speculation: Add cpu_show_gds() prototype
  - x86/speculation: Add Gather Data Sampling mitigation


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.113.0.140
changelog:
  - !2391  netfilter: nf_tables: disallow rule removal from chain binding
  - netfilter: nf_tables: disallow rule removal from chain binding
  - !2389  nf_table LTS
  - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
  - netfilter: nf_tables: skip bound chain on rule flush
  - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails
  - netfilter: nf_tables: drop map element references from preparation phase
  - netfilter: nftables: rename set element data activation/deactivation functions
  - netfilter: nf_tables: reject unbound chain set before commit phase
  - netfilter: nf_tables: reject unbound anonymous set before commit phase
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
  - netfilter: nf_tables: fix chain binding transaction logic
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
  - netfilter: nf_tables: use net_generic infra for transaction data
  - Revert "netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID"
  - Revert "netfilter: nf_tables: skip bound chain on rule flush"
  - Revert "netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE"
  - Revert "netfilter: nf_tables: fix chain binding transaction logic"
  - Revert "netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain"
  - Revert "netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR"
  - Revert "netfilter: nf_tables: unbind non-anonymous set if rule construction fails"
  - !2378 [sync] PR-2359:  netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
  - !2299 [sync] PR-2287:  scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
  - !2297 [sync] PR-2286:  scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
  - scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
  - scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
  - !2273 [sync] PR-2156:  drm: add inspur drm driver support
  - !2238 [sync] PR-2163:  Fix the two problems when using binutil 2.41.
  - !2277 [sync] PR-2269:  etmem: Fixed an issue where the module reference counting is incorrect
  - etmem: Fixed an issue where the module reference counting is incorrect
  - !2124 [sync] PR-1778:  nvme-pci: fix DMA direction of unmapping integrity data
  - !2186  nvme-pci: fix timeout request state check
  - !2188  nvme-pci: fix mempool alloc size
  - drm: add inspur drm driver support
  - !2249 [sync] PR-2224:  ext4: fix rec_len verify error
  - ext4: fix rec_len verify error
  - LoongArch: Fix module relocation error with binutils 2.41
  - LoongArch: Fix the write_fcsr() macro
  - nvme-pci: fix mempool alloc size
  - nvme-pci: fix timeout request state check
  - nvme-pci: fix DMA direction of unmapping integrity data


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.114.0.141
changelog:
  - !2420 [sync] PR-2323:  net/sched: Retire rsvp classifier
  - net/sched: Retire rsvp classifier
  - !2366 [sync] PR-2282:  sdei_watchdog: Avoid exception during sdei handler
  - sdei_watchdog: Avoid exception during sdei handler


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.115.0.142
changelog:
  - !2690 [sync] PR-2666:  net: xfrm: Fix xfrm_address_filter OOB read
  - !2373 [sync] PR-2258:  ext4: do not mark inode dirty every time when appending using delalloc
  - !2637 [sync] PR-2454:  igb: set max size RX buffer when store bad packet is enabled
  - net: xfrm: Fix xfrm_address_filter OOB read
  - !2535 [sync] PR-2370:  ipv4: fix null-deref in ipv4_link_failure
  - !2524 [sync] PR-2440:  netfilter: xt_u32: validate user space input
  - !2530 [sync] PR-2411:  netfilter: xt_sctp: validate the flag_info count
  - !2527 [sync] PR-2410:  netfilter: nfnetlink_osf: avoid OOB read
  - !2658 [sync] PR-2628:  ubi: Refuse attaching if mtd's erasesize is 0
  - !2663  arm64: fix a concurrency issue in emulation_proc_handler()
  - arm64: armv8_deprecated: fix unused-function error
  - arm64: armv8_deprecated: rework deprected instruction handling
  - arm64: armv8_deprecated: move aarch32 helper earlier
  - arm64: armv8_deprecated move emulation functions
  - arm64: armv8_deprecated: fold ops into insn_emulation
  - arm64: rework EL0 MRS emulation
  - arm64: factor insn read out of call_undef_hook()
  - arm64: factor out EL1 SSBS emulation hook
  - arm64: split EL0/EL1 UNDEF handlers
  - arm64: allow kprobes on EL0 handlers
  - arm64: rework BTI exception handling
  - arm64: rework FPAC exception handling
  - arm64: consistently pass ESR_ELx to die()
  - arm64: die(): pass 'err' as long
  - arm64: report EL1 UNDEFs better
  - Revert "arm64: fix a concurrency issue in emulation_proc_handler()"
  - ubi: Refuse attaching if mtd's erasesize is 0
  - !2647 [sync] PR-2641:  Fix CVE-2023-5717
  - perf: Fix kabi breakage in struct perf_event
  - perf: Disallow mis-matched inherited group reads
  - !2563  fix cgroup poll UAF
  - !2519 [sync] PR-2437:  crypto: drbg - Only fail when jent is unavailable in FIPS mode
  - !2558  USB: ene_usb6250: Allocate enough memory for full object
  - igb: set max size RX buffer when store bad packet is enabled
  - !2595 [sync] PR-2573:  media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
  - !2566 [sync] PR-2557:  Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
  - !2580 [sync] PR-2476:  Fixed five CVEs vulnerabilities of ksmbd
  - !2613  CVE-2022-44033
  - char: pcmcia: remove all the drivers
  - tty: ipwireless: move Kconfig entry to tty
  - !2552  scsi: mpt3sas: Driver patch set for openEuler-22.03-LTS
  - !2584 [sync] PR-2571:  xen/events: replace evtchn_rwlock with RCU
  - media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
  - xen/events: replace evtchn_rwlock with RCU
  - ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN
  - ksmbd: fix infinite loop in ksmbd_conn_handler_loop()
  - ksmbd: send proper error response in smb2_tree_connect()
  - ksmbd: fix racy issue from smb2 close and logoff with multichannel
  - ksmbd: call rcu_barrier() in ksmbd_server_exit()
  - ksmbd: fix racy issue under cocurrent smb2 tree disconnect
  - Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
  - sched/psi: Select KERNFS as needed
  - kernfs: add stub helper for kernfs_generic_poll()
  - sched/psi: use kernfs polling functions for PSI trigger polling
  - USB: ene_usb6250: Allocate enough memory for full object
  - scsi: mpt3sas: Perform additional retries if doorbell read returns 0
  - scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
  - scsi: mpt3sas: Remove usage of dma_get_required_mask() API
  - scsi: mpt3sas: re-do lost mpt3sas DMA mask fix
  - scsi: mpt3sas: Don't change DMA mask while reallocating pools
  - scsi: mpt3sas: Fix a memory leak
  - scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
  - scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region
  - scsi: mpt3sas: Fix use-after-free warning
  - ipv4: fix null-deref in ipv4_link_failure
  - netfilter: xt_sctp: validate the flag_info count
  - netfilter: nfnetlink_osf: avoid OOB read
  - netfilter: xt_u32: validate user space input
  - !1561 Add ACS quirk for Wangxun NICs
  - !2514 [sync] PR-2499:  f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
  - crypto: drbg - Only fail when jent is unavailable in FIPS mode
  - !2485 [sync] PR-2340:  xfs: recent patches to fix xfs issues
  - f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
  - xfs: update the last_sync_lsn with ctx start lsn
  - xfs: shutdown xfs once inode double free
  - xfs: fix off-by-one-block in xfs_discard_folio()
  - xfs: xfs_bmap_punch_delalloc_range() should take a byte range
  - iomap: buffered write failure should not truncate the page cache
  - xfs,iomap: move delalloc punching to iomap
  - xfs: use byte ranges for write cleanup ranges
  - xfs: punching delalloc extents on write failure is racy
  - xfs: longest free extent no need consider postalloc
  - xfs: fix xfs shutdown since we reserve more blocks in agfl fixup
  - xfs: block reservation too large for minleft allocation
  - xfs: set minleft correctly for randomly sparse inode allocations
  - xfs: shutdown to ensure submits buffers on LSN boundaries
  - xfs: don't verify agf length when log recovery
  - xfs: Remove redundant assignment to busy
  - xfs: remove redundant pointer lip
  - xfs: remove redundant initializations of pointers drop_leaf and save_leaf
  - xfs: xfs_trans_cancel() path must check for log shutdown
  - xfs: fix bounds check in xfs_defer_agfl_block()
  - xfs: AGF length has never been bounds checked
  - xfs: journal geometry is not properly bounds checked
  - xfs: don't block in busy flushing when freeing extents
  - xfs: allow extent free intents to be retried
  - xfs: pass alloc flags through to xfs_extent_busy_flush()
  - Revert "xfs: propagate the return value of xfs_log_force() to avoid soft lockup"
  - xfs: use deferred frees for btree block freeing
  - xfs: don't reverse order of items in bulk AIL insertion
  - xfs: validate block number being freed before adding to xefi
  - xfs: validity check agbnos on the AGFL
  - xfs: pass xfs_extent_free_item directly through the log intent code
  - xfs: remove unused parameter from refcount code
  - xfs: reduce the size of struct xfs_extent_free_item
  - xfs: rename xfs_bmap_add_free to xfs_free_extent_later
  - xfs: create slab caches for frequently-used deferred items
  - xfs: compact deferred intent item structures
  - xfs: rename _zone variables to _cache
  - xfs: remove kmem_zone typedef
  - xfs: remove xfs_setattr_time() declaration
  - xfs: use setattr_copy to set vfs inode attributes
  - xfs: set prealloc flag in xfs_alloc_file_space()
  - xfs: don't assert fail on perag references on teardown
  - xfs: fix dir3 block read verify fail during log recover
  - xfs: propagate the return value of xfs_log_force() to avoid soft lockup
  - xfs: keep growfs sb log item active until ail flush success
  - !1141 [sync] PR-953:  xfs: fixes patchs and backport patchs
  - PCI: Add ACS quirk for Wangxun NICs
  - ext4: do not mark inode dirty every time when appending using delalloc
  - Revert "openeuler: pci: workaround multiple functions can be assigned to only one VM"
  - xfs: atomic drop extent entries when inactiving attr
  - xfs: factor out __xfs_da3_node_read()
  - xfs: fix a UAF in xfs_iflush_abort_clean
  - xfs: fix a UAF when inode item push
  - xfs: fix the problem of mount failure caused by not refreshing mp->m_sb
  - iomap: iomap: fix memory corruption when recording errors during writeback
  - xfs: fix hung when transaction commit fail in xfs_inactive_ifree
  - xfs: fix dead loop when do mount with IO fault injection
  - xfs: fix ag count overflow during growfs
  - xfs: account extra freespace btree splits for multiple allocations
  - xfs: force shutdown xfs when xfs_attr_inactive fails
  - xfs: fix negative array access in xfs_getbmap
  - xfs: fix BUG_ON in xfs_getbmap()
  - xfs: use iomap_valid method to detect stale cached iomaps
  - iomap: write iomap validity checks
  - xfs: write page faults in iomap are not buffered writes
  - xfs: fix exception caused by unexpected illegal bestcount in leaf dir
  - Revert "[Huawei] xfs: fix uaf when leaf dir bestcount not match with dir data blocks"
  - xfs: don't expose internal symlink metadata buffers to the vfs
  - xfs: shut down filesystem if we xfs_trans_cancel with deferred work items
  - xfs: fix maxlevels comparisons in the btree staging code
  - xfs: sb verifier doesn't handle uncached sb buffer
  - xfs: fallocate() should call file_modified()
  - xfs: remove XFS_PREALLOC_SYNC
  - xfs: shutdown during log recovery needs to mark the log shutdown
  - xfs: xfs_trans_commit() path must check for log shutdown
  - xfs: xfs_do_force_shutdown needs to block racing shutdowns
  - xfs: log shutdown triggers should only shut down the log
  - xfs: shutdown in intent recovery has non-intent items in the AIL
  - xfs: AIL should be log centric
  - xfs: increase rename inode reservation
  - xfs: trim the mapp array accordingly in xfs_da_grow_inode_int
  - xfs: check return codes when flushing block devices
  - xfs: remove xfs_blkdev_issue_flush
  - xfs: fix NULL pointer dereference in xfs_getbmap()


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.116.0.143
changelog:
  - !2717 [sync] PR-2678:  io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
  - !2739 [sync] PR-2443:  CVE-2023-37453
  - !2733 [sync] PR-2688:  nvmet-tcp: Fix a possible UAF in queue intialization setup
  - USB: core: Fix oversight in SuperSpeed initialization
  - USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
  - USB: core: Change usb_get_device_descriptor() API
  - USB: core: Unite old scheme and new scheme descriptor reads
  - nvmet-tcp: Fix a possible UAF in queue intialization setup
  - !2701 [sync] PR-2672:  fix CVE-2023-46813
  - io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
  - !2710 [sync] PR-2694:  LoongArch: add 32/64 pc relative relocation type support
  - !2664 [sync] PR-2579:  LoongArch: default IPMI related defconfig to m
  - LoongArch: Add support for 64_PCREL relocation type
  - LoongArch: Add support for 32_PCREL relocation type
  - LoongArch: Define relocation types for ABI v2.10
  - !2644 [sync] PR-2543:  psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n
  - x86/sev: Check for user-space IOIO pointing to kernel space
  - x86/sev: Check IOBM for IOIO exceptions from user-space
  - x86/sev: Disable MMIO emulation from user mode
  - LoongArch: default IPMI related defconfig to m
  - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.117.0.144
changelog:
  - !2860  bugfix for CVE-2022-45884
  - media: dvb-core: Fix use-after-free due to race at dvb_register_device()
  - media: dvbdev: fix error logic at dvb_register_device()
  - media: dvbdev: Fix memleak in dvb_register_device
  - !2846 [sync] PR-2840:  drm/qxl: fix UAF on handle creation
  - drm/qxl: fix UAF on handle creation
  - !2800 [sync] PR-2782:  cpufreq: Abort show()/store() for half-initialized policies
  - cpufreq: make interface functions and lock holding state clear
  - cpufreq: Abort show()/store() for half-initialized policies


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.118.0.145
changelog:
  - !2997 [sync] PR-2902:  net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
  - !829 [sync] PR-739: Fix kvm-unit-tests  vmx_cr4_osxsave_test  case failed
  - !831 [sync] PR-601: fix  test_vmxon failed
  - !2918 fix some bugs in loongarch kvm
  - net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
  - !2976 Add script to check & update openeuler_defconfig
  - config: update openeuler_defconfig for arm64
  - config: update openeuler_defconfig for x86
  - kconfig: Add script to check & update openeuler_defconfig
  - Revert "kconfig: Add script to update openeuler_defconfig"
  - !1562 [sync] PR-1527:  arm64/mpam: fix missing kfree domain's ctrl_val arrray
  - !2043 [sync] PR-1327:  Huawei BMA: To fix the bug in the iBMA driver code
  - !1896 [sync] PR-1853:  ring-buffer: Fix deadloop issue on reading trace_pipe
  - !1941 [sync] PR-1900:  tracing: Fix cpu buffers unavailable due to 'record_disabled' missed
  - !1983 [sync] PR-1905:  tracing: Fix memleak due to race between current_tracer and trace
  - !2652 [sync] PR-2377:  tracing: Backport bugfixes
  - !1402 [sync] PR-1399:  bpf: cpumap: Fix memory leak in cpu_map_update_elem
  - !2633 [sync] PR-2615:  preempt/dynamic: Fix setup_preempt_mode() return value
  - !1808 [sync] PR-1768:  bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
  - !2811 [sync] PR-2716:  ext4: recheck buffer valid after page unlock
  - loongarch/kvm: disable hugepage during migration process
  - loongarch/kvm: Fix oneshot timer emulation
  - loongarch/kvm: Remove SW timer switch when vcpu is halt polling
  - !2899 [sync] PR-2884:  LoongArch: fix two cpu hotplug problem
  - !1424 [sync] PR-1354:  ubi: Fix return value overwrite issue in try_write_vid_and_data()
  - !889 [sync] PR-886:  net: sched: fix NULL pointer dereference in mq_attach
  - !900 [sync] PR-890:  ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
  - !2019 [sync] PR-1965:  crypto:padata: Fix return err for PADATA_RESET
  - !2896 [sync] PR-2867:  netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
  - !1512 [sync] PR-1357:  SUNRPC: Ensure that the gssproxy client can start in a connected state
  - !2753  fix memcgv1 oom meminfo bug
  - LoongArch: fix two cpu hotplug problem
  - netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
  - ext4: recheck buffer valid after page unlock
  - memcg: dump memory.stat during cgroup OOM for v1
  - memcg: use seq_buf_do_printk() with mem_cgroup_print_oom_meminfo()
  - seq_buf: Add seq_buf_do_printk() helper
  - seq_buf: Add seq_buf_terminate() API
  - ring-buffer: Do not attempt to read past "commit"
  - ring-buffer: Do not swap cpu_buffer during resize process
  - preempt/dynamic: Fix setup_preempt_mode() return value
  - Huawei BMA: To fix the bug in the iBMA driver code
  - crypto:padata: Fix return err for PADATA_RESET
  - tracing: Fix memleak due to race between current_tracer and trace
  - tracing: Fix cpu buffers unavailable due to 'record_disabled' missed
  - ring-buffer: Fix deadloop issue on reading trace_pipe
  - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
  - arm64/mpam: fix missing kfree domain's ctrl_val arrray
  - SUNRPC: Ensure that the gssproxy client can start in a connected state
  - ubi: Fix return value overwrite issue in try_write_vid_and_data()
  - bpf: cpumap: Fix memory leak in cpu_map_update_elem
  - ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
  - net: sched: fix NULL pointer dereference in mq_attach
  - KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails
  - kvm: x86: Sink cpuid update into vendor-specific set_cr4 functions


author: Jialin Zhang <zhangjialin11@huawei.com> - 5.10.0-60.119.0.146
changelog:
  - !3193 [sync] PR-3128:  fix ksmbd to release the ones allocated for async work
  - ksmbd: delete asynchronous work from list
  - ksmbd: fix typo, syncronous->synchronous
  - ksmbd: fix possible memory leak in smb2_lock()
  - ksmbd: replace usage of found with dedicated list iterator variable
  - !3103 [sync] PR-3082:  fs/dirty_pages: add last read check in seq_read_dirty()
  - !3185 [sync] PR-3152:  scsi: scsi_device_gets returns failure
  - scsi: fix kabi broken in struct Scsi_Host
  - scsi: don't fail if hostt->module is NULL
  - scsi: scsi_device_gets returns failure when the module is NULL.
  - !2970  Add error handle for add_disk
  - !1394 [sync] PR-1355:  etmem: fix the div 0 problem in swapcache reclaim process
  - fs/dirty_pages: add last read check in seq_read_dirty()
  - !3078 [sync] PR-3022:  fs/dirty_pages: fix some errors in seq_read_dirty()
  - !3075 [sync] PR-3020:  fs/dirty_pages: fix inode reference count leakage error in dump_dirtypages_sb()
  - fs/dirty_pages: fix some errors in seq_read_dirty()
  - fs/dirty_pages: fix inode reference count leakage error in dump_dirtypages_sb()
  - block: Set memalloc_noio to false in the error path
  - block: Fix minor range check in device_add_disk()
  - block: clear ->slave_dir when dropping the main slave_dir reference
  - block: call blk_get_queue earlier in __device_add_disk
  - block: check minor range in device_add_disk()
  - block: fix memory leak for elevator on add_disk failure
  - block: Fix the kabi change on blk_register_region
  - block: Fix the kabi change in device_add_disk
  - block: fix error unwinding in device_add_disk
  - block: fix device_add_disk() kobject_create_and_add() error handling
  - block: add error handling for device_add_disk / add_disk
  - block: return errors from blk_register_region
  - block: add the events* attributes to disk_attrs
  - block: return errors from disk_alloc_events
  - block: return errors from blk_integrity_add
  - block: call blk_integrity_add earlier in device_add_disk
  - block: fold register_disk into device_add_disk
  - etmem: fix the div 0 problem in swapcache reclaim process


author: liningjie <liningjie@xfusion.com> - 3.3.1-6
changelog:
  - Type:CVE
  - CVE:CVE-2023-49083
  - SUG:NA
  - DESC:Fixed crash when loading a PKCS#7 bundle with no certificates


author: liningjie <liningjie@xfusion.com> - 3.3.1-7
changelog:
  - Type:CVE
  - CVE:CVE-2023-49083
  - SUG:NA
  - DESC:raise an exception instead of returning an empty list for pkcs7 cert loading


author: <fengjiabo1@huawei.com> - 10:6.2.0-74
changelog:
  - sw_64: Added sw64 architecture related updates
  - virtio-crypto: verify src&dst buffer length for sym request
  - vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present
  - qga: Fix suspend on Linux guests without systemd
  - tests: vhost-user-test: release mutex on protocol violation
  - qapi: support updating expected test output via make
  - block: Fix misleading hexadecimal format
  - block/rbd: fix write zeroes with growing images
  - block/nbd.c: Fixed IO request coroutine not being wakeup when kill NBD server
  - block/nfs: Fix 32-bit Windows build
  - qapi/qdev: Tidy up device_add documentation
  - hw/xen/xen_pt: fix uninitialized variable
  - migration/ram: Fix error handling in ram_write_tracking_start()
  - docs/about/build-platforms: Refine the distro support policy
  - xen-block: Avoid leaks on new error path
  - QGA VSS: Add wrapper to send log to debugger and stderr
  - chardev/char-socket: set s->listener = NULL in char_socket_finalize
  - qapi/block: Tidy up block-latency-histogram-set documentation
  - disas/riscv Fix ctzw disassemble
  - vfio: Fix vfio_get_dev_region() trace event
  - migration/ram: Fix populate_read_range()
  - Check and report for incomplete 'global' option  format


author: <fengjiabo1@huawei.com> - 10:6.2.0-76
changelog:
  - test: Fix test-crypto-secret when compiling without keyring support
  - aio-posix: fix build failure io_uring 2.2


author: <fengjiabo1@huawei.com> - 10:6.2.0-77
changelog:
  - io: remove io watch if TLS channel is closed during handshake
  - hw/ssi: Fix Linux driver init issue with xilinx_spi
  - chardev: report the handshake error
  - vhost: Drop unused eventfd_add|del hooks
  - virtio-iommu: use-after-free fix
  - hw/arm/virt: Check for attempt to use TrustZone with KVM or HVF
  - hw/rx: rx-gdbsim DTB load address aligned of 16byte
  - vhost-user: Use correct macro name TARGET_PPC64
  - accel/kvm: Make kvm_dirty_ring_reaper_init() void
  - accel/kvm: Free as when an error occurred


author: <fengjiabo1@huawei.com> - 10:6.2.0-78
changelog:
  - hw/nvme: Avoid dynamic stack allocation
  - ppc/vof: Fix missed fields in VOF cleanup
  - ui: fix crash when there are no active_console
  - tests/qtest/pflash: Clean up local variable shadowing
  - target/ppc: Fix the order of kvm_enable judgment about kvmppc_set_interrupt()
  - tulip: Assign default MAC address if not specified
  - hw/char: fix qcode array bounds check in ESCC impl


author: <fengjiabo1@huawei.com> - 10:6.2.0-79
changelog:
  - thread-pool: optimize scheduling of completion bottom half
  - migration/rdma: zore out head.repeat to make the error more clear
  - vhost-user-fs: Back up vqs before cleaning up vhost_dev
  - hw/vfio/pci-quirks: Sanitize capability pointer
  - hw/vfio/pci-quirks: Support alternate offset for GPUDirect Cliques
  - replay: fix event queue flush for qemu shutdown
  - hw/net: Fix read of uninitialized memory in ftgmac100
  - target/ppc: Fix tlbie
  - target/i386: fix INVD vmexit
  - qtest/npcm7xx_pwm-test: Fix memory leak in mft_qom_set
  - aio-posix: zero out io_uring sqe user_data


author: <fengjiabo1@huawei.com> - 10:6.2.0-80
changelog:
  - hw/virtio/virtio-pmem: Replace impossible check by assertion
  - tests: Fix printf format string in acpi-utils.c
  - softmmu/dirtylimit: Add parameter check for hmp "set_vcpu_dirty_limit"
  - disas/riscv: Fix the typo of inverted order of pmpaddr13 and pmpaddr14
  - qga: Fix memory leak when output stream is unused
  - ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255)
  - target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model
  - target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES
  - target/i386: Allow MCDT_NO if host supports
  - target/i386: Add support for MCDT_NO in CPUID enumeration
  - target/i386: Export MSR_ARCH_CAPABILITIES bits to guests
  - target/i386: add support for FB_CLEAR feature
  - target/i386: add support for FLUSH_L1D feature
  - crypto: remove shadowed 'ret' variable
  - hw/i2c/pmbus_device: Fix modifying QOM class internals from instance
  - hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number


author: <fengjiabo1@huawei.com> - 10:6.2.0-83
changelog:
  - hw/arm/fsl-imx: Do not ignore Error argument
  - hw/net/cadence_gem.c: spelling fixes: Octects
  - tests/qtest: check the return value
  - libvhost-user: Fix VHOST_USER_GET_MAX_MEM_SLOTS  reply mainline inclusion commit 69a5daec06f423843ce1bb9be5fb049314996f78 category: bugfix
  - io_uring: fix short read slow path mainline inclusion commit c06fc7ce147e57ab493bad9263f1601b8298484b category: bugfix
  - libvhost-user: Fix VHOST_USER_ADD_MEM_REG reply mainline inclusion commit 7f27d20ded2f480f3e66d03f90ea71507b834276 category: bugfix
  - qsd: Unlink absolute PID file path mainline inclusion commit 9d8f8233b9fa525a7e37350fbc18877051128c5d category: bugfix
  - net: Fix a misleading error message
  - target/i386: Adjust feature level according to FEAT_7_1_EDX
  - target/i386: Add new CPU model GraniteRapids
  - target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration
  - target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration
  - target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration
  - target/i386: Add support for AVX-IFMA in CPUID enumeration
  - target/i386: Add support for AMX-FP16 in CPUID enumeration
  - target/i386: Add support for CMPCCXADD in CPUID enumeration
  - tracetool: avoid invalid escape in Python string
  - hw/pvrdma: Protect against buggy or malicious guest driver
  - vga: avoid crash if no default vga card mainline inclusion commit 6985d8ede92494f3b791de01e8ee9306eb6d5e4a category: bugfix
  - qom/object: Remove circular include dependency mainline inclusion commit 5bba9bcfbb42e7c016626420e148a1bf1b080835 category: bugfix
  - artist: set memory region owners for buffers to the  artist device mainline inclusion commit 39fbaeca096a9bf6cbe2af88572c1cb2aa62aa8c category: bugfix
  - virtio-iommu: Fix the partial copy of probe request mainline inclusion commit 45461aace83d961e933b27519b81d17b4c690514 category: bugfix
  - e1000: set RX descriptor status in a separate  operation mainline inclusion commit 034d00d4858161e1d4cff82d8d230bce874a04d3 category: bugfix
  - pci: Fix the update of interrupt disable bit in PCI_COMMAND register
  - hw/timer/npcm7xx_timer: Prevent timer from counting down past zero
  - tpm_crb: mark command buffer as dirty on request  completion mainline inclusion commit e37a0ef4605e5d2041785ff3fc89ca6021faf7a0 category: bugfix
  - pci: fix overflow in snprintf string formatting mainline inclusion commit 36f18c6989a3d1ff1d7a0e50b0868ef3958299b4 category: bugfix
  - hw/usb/hcd-ehci: fix writeback order mainline inclusion commit f471e8b060798f26a7fc339c6152f82f22a7b33d category: bugfix
  - qemu-timer: Skip empty timer lists before locking  in qemu_clock_deadline_ns_all mainline inclusion commit 3f42906c9ab2c777a895b48b87b8107167e4a275 category: bugfix
  - semihosting/config: Merge --semihosting-config  option groups mainline inclusion commit 90c072e063737e9e8f431489bbd334452f89056e category: bugfix
  - semihosting: fix memleak at semihosting_arg_fallback
  - target/i386: Export GDS_NO bit to guests


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-16
changelog:
  - Type:CVE
  - ID:CVE-2023-4736 CVE-2023-4733 CVE-2023-4734 CVE-2023-4735
  - SUG:NA
  - DESC:fix CVE-2023-4736 CVE-2023-4733 CVE-2023-4734 CVE-2023-4735


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-17
changelog:
  - Type:CVE
  - ID:CVE-2023-4738 CVE-2023-4750 CVE-2023-4752 CVE-2023-4781
  - SUG:NA
  - DESC:fix CVE-2023-4738 CVE-2023-4750 CVE-2023-4752 CVE-2023-4781


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-22
changelog:
  - Type:CVE
  - ID:CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237
  - SUG:NA
  - DESC:fix CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237


